[OffgridwithJD]

@jdatcmd The pytest twin of hilbert_curve.sh (#1341), plus two shell fixes. It goes on top of my stack (#1638 → … → #1641) and will be restated there, so it collides with the stack on purpose until then.

The twin. It compiles src/columnar_curve.c with a small driver into a shared library and calls it through ctypes. The driver only encodes and counts its calls. Every property is checked in Python, with its own readers:

• the permutation test (C1);
• the memcmp-order adjacency walk (C2);
• dyadic contiguity (C3), counted as runs per level along index order. Over a permutation this is exactly the shell's max - min + 1 == count, and where C1 is already red the shell's own form is computed instead;
• the production-width bridge (C4a);
• a Python transcription of Skilling's TransposetoAxes, with its mutated twin, for the round trips (C4b);
• the goldens and the pack's extent and content (C5), ncols == 1 (C6) and the frozen Z-order bytes (C7);
• the serpentine, Z-order and truncating controls, through the same checkers.

There are 184 tests, one per check, all in NO_CLUSTER: no connection and no cluster. guard_tests goes 467 → 651. The twin takes about 50 s.

Shell audit, red-first. I mutated src/columnar_curve.c 17 ways. Each mutant reddened the suite on main, and between them they reddened every arm except the six premises and the ten INSTRUMENT controls, which link nothing from src/ by design. So no shell arm was vacuous. Two things were wrong around the arms:

1. The battery read what the last key left. Key buffers were reused, and the first use read uninitialized memory. Under memsetshort (the pack's memset stops one byte short), which goldens went red depended on what the previous call had written into that byte: 121 red on main. The battery now fills every key buffer with 0xa5 before the pack writes it (pk()), and the result is a stable 124. The C5 extent arms still fill their own buffers with 0x00 and 0xff and call the pack directly. The twin's driver does the same fill, and every twin buffer carries guard bytes, so overrun reds the C5 tail arms instead of segfaulting.
2. compare_to_bash refused this whole suite. arms_unrunnable and arms_failed took a list of names in one argument, so its 184 arms were never graded. They are now written out as loops at their call sites, and the grader reads the suite: missing 0, extra 0. The refusal arms keep their coverage. test_the_grader_itself_refuses_the_suite_it_cannot_read now builds a fixture holding the two helpers as they stood. The pinned refused set becomes none. Self-test 480's pinned emitters lose arms_unrunnable, and its check is renamed "the refusal emitters are the ones the tree defines", ledger row with it.

Mutants, PG17, shell then twin as shipped: SAME red sets for all 17.

mutant	reds	mutant	reds
notranspose	51	memsetshort	124
nogray	51	memset48	35
notfix	39	overrun	24
tlowbit	16	collide	34
undoskip0	48	noexchange	36
lowflip (the header's own 0x5a example)	3	lowtop	35
packrev	82	setlast	74
pack32	117	rounds_up (a permutation with scattered sub-cubes; the only one that reds C3)	109
low32	117

Clean runs: 184/184 in both harnesses on each of 15–19. With CC=/bin/false, both report 184 unrunnable. With src/columnar_curve.c absent, both fail the 174 battery arms by name, and the 10 controls still pass.

Counts:

• 184 rows: 168 dated by the 17 mutations, and 16 never (the six premises and the ten controls);
• census 3793 → 3809 never, 2073 → 2241 dated, 6050 rows;
• suites_not_covered 113 → 112;
• TESTS.md §256, which the stack restate will renumber.

Gates: guards 651 passed, collection 2454 = cluster_tests, ledger gate rc=0, self-test PASSED.

🤖 Generated with Claude Code

[jdatcmd]

Approved at 6965d7f. Measured on PG17 at main a1b04ee with the memset one byte short (memset(out, 0, keybytes - 1), src/columnar_curve.c:116):

run	result
main's shell, twice	63 + 121 failed both times
this head's shell, twice	60 + 124 failed both times, the same 124 names
this head's twin	124 failed. I dumped the twin's own records with a small plugin (the pgc_records user property): its 124 FAIL names equal the shell's, byte for byte
clean	shell 184/184 on PG15 and PG19; twin 184 passed
harness_selftest, this head	1248/1248, including "the refusal emitters are the ones the tree defines"

The compare_to_bash changes keep both refusal arms testing something: one uses inline source, and test_the_grader_itself_refuses_the_suite_it_cannot_read now builds a fixture holding the two helpers as they stood. I did not rerun the other sixteen mutants.

Like the rest of the stack, this needs a restate onto main. I'll re-approve one whose non-registry files are unchanged.