ogar-loco: proof-carrying vocabularies, the 3-ref min_shape fix, and the permanent floor

[AdaWorldAPI]

Hardening pass on #239, from the external review of the merge — both review findings implemented, plus a third defect the fix itself surfaced.

1. The >3 body_refs panic edge — closed by type

Program::references_are_resolvable / branches_of indexed call.values[slot] with slot driven by v.body_refs(); an unvalidated vocabulary claiming more than three references panicked. Conformance would have rejected that vocabulary — but nothing forced conformance to have run.

Fix, per the review's "better still" option: conformance::validate(v) → CheckedVocabulary<V>, constructible only through validation. The traversal methods now require the wrapper, so holding it IS the proof that body_refs ≤ 3 everywhere (the shape check bounds it: no LaneShape holds more than three value bytes). The wrapper delegates all Vocabulary methods, composed included — conformance validated the composed answers, so re-deriving from the hooks could answer differently than what was validated. debug_asserts remain as the belt.

2. A defect the fix surfaced: the default min_shape wrongly rejected THREE references

The trait default mapped everything ≥2 refs to Triples — so a legal three-reference domain function (fits Quads exactly) failed conformance unless the vocabulary overrode min_shape. Fixed in the trait default and shared_core (2 → Triples, 3+ → Quads), pinned two-sided:

• three_body_references_are_legal_and_default_to_quads — the conforming 3-ref vocabulary passes and defaults to Quads (would have failed before the fix);
• validate_refuses_a_vocabulary_whose_refs_exceed_a_calls_capacity — the hostile 200-ref vocabulary is refused even with a Quads override, and traversal is unreachable without the wrapper it refused to construct.

3. DOMAIN_FLOOR is PERMANENT stored-byte ABI

0x00..=0x8F universal forever; 0x90..=0xFF vocabulary-local forever. Moving the floor would silently reinterpret every persisted program — the layout-reclaim hazard the reserve-don't-reclaim rule forbids. Now documented on the constant and pinned by a const assert whose failure message says why the "fix" would be wrong.

Gates

cargo fmt --check / clippy --all-targets --all-features -- -D warnings / tests (38 ogar-loco + 7 ogar-blockly) / RUSTDOCFLAGS="-D warnings" cargo doc — all green, scoped -p ogar-loco -p ogar-blockly. Plan ledger appended (docs/BLOCK-EDITOR-PLAN.md § W6 hardening).

🤖 Generated with Claude Code

https://claude.ai/code/session_011DN5odWu4eisdevH9bPWyz

---

Generated by Claude Code

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5959b23e-0cc8-423e-a49e-3a38a3db5b1b)