Parity governance: qualify ChunkClockDiag twin surface

[bhelm]

Scope

Track only the paired Swift/Kotlin ChunkClockDiag surface imported from upstream commit 8124da33ee654d79d4cf0680e4df75dfc0f6e554 (source comments/commit label it #1008) during the meta032 upstream sync.

Exact currently unclassified identities:

• Swift file Packages/WhoopProtocol/Sources/WhoopProtocol/ChunkClockDiag.swift
• Swift ChunkClockDiag.line/4#1
• Swift ChunkClockDiag.signed/1#1
• Swift ChunkClockDiag.fixed2/2#1
• Kotlin file android/app/src/main/java/com/noop/protocol/ChunkClockDiag.kt
• Kotlin ChunkClockDiag.line/4#1
• Kotlin ChunkClockDiag.signed/1#1
• Kotlin ChunkClockDiag.fixed2/2#1

Reachability and current evidence

line/4 is live production diagnostic code: Swift calls it from Strand/Collect/Backfiller.swift; Kotlin calls it from android/app/src/main/java/com/noop/ble/Backfiller.kt. signed/1 and fixed2/2 are internal helpers reached through line/4.

Upstream includes mirrored platform-local KATs in ChunkClockDiagTests.swift and ChunkClockDiagTest.kt. They cover empty input, honest stream, packed records, duplicated delivery, stale-clock threshold, negative offset, half-up tie rounding, and unsorted span. Expected strings are intentionally mirrored.

That is not yet the repository's differential qualification: there is no shared canonical corpus/schema, package-local differential runner contract, side-specific mutant/control proof, or executed-lines evidence for this surface. The declared domains also differ (Int timestamps/arithmetic in Swift versus Kotlin Long timestamps and helper arithmetic), so arbitrary-domain overflow behavior cannot be assumed identical from the platform KATs.

The current upstream GitHub issue numbered #1008 is not a ChunkClockDiag governance specification; provenance here is therefore the exact imported commit plus its source comments, not an inference from that issue body.

Severity

P2 governance debt. Current shipped behavior is upstream code with platform tests; the risk is incorrectly claiming differential parity or silently losing inventory coverage, not a newly demonstrated product defect.

Acceptance for a later harness wave

• Freeze the exact shared input domain, including integer/timestamp bounds that avoid language-specific overflow.
• Add a strict shared schema and independent oracle for line/4; helpers may be covered through it only if executed-lines proof is explicit.
• Include all existing KATs plus overflow/boundary, empty, threshold, ordering, and rounding rails.
• Add deterministic seeded cases and one meaningful schema-valid mutant per side with opposite-side controls.
• Use package-local Swift/Kotlin runners, canonical outputs, exact-ID merge, and fail-closed shard wiring.
• Record executed-line coverage for all promoted declarations.
• Only then promote exact declarations from issue-bound ledger baseline to declared differential twins and retire exactly those baseline entries.

Until those conditions are met, keep exactly the eight identities above issue-bound in the parity ledger baseline; do not broad-bootstrap or delete curated mappings.