Extract named steps from reconciliation::build_reconciliation, pinning three untested gaps first

[lamemustafa]

Outcome

sync/reconciliation.rs::build_reconciliation was 276 lines against a file median of 12. It is now the run sequence, with each gap check and the cross-window accumulation as named steps. No behaviour change.

Before the move, three of its gap branches had no test at all. A PR commit now pins each one, proven on the original code.

step	what it decides
insert_run_drift_gaps	source-stability and end-profile drift gaps
insert_window_count_gaps	one window's parse, accept, dedupe and accounting counter gaps
report_tie_out_gap	the tie-out gap, or none when it passed for this exact source, pack, period, profile and filters
SnapshotTotals::add_object_counts	per-object counts, window and complete source-count checks
SnapshotTotals::add_canonical_records	duplicate or changed identities across windows
SnapshotTotals::finish	complete counts vs unique identities accepted; window-only or unavailable counts

gaps is a BTreeSet and mismatches is sorted and deduplicated before use, and nothing reads either while the loop runs. So the order in which steps insert cannot change the output.

Commits

1. Pin three build_reconciliation gaps no test reached (tests only, on the original code). A hand mutation run on the moved branches found that three mutations left all 967 bridge lib tests green:

   • drop report.pack == input.pack from the tie-out guard;
   • never insert duplicate_record_across_windows;
   • skip the complete-count vs unique-identity comparison.

   No test anywhere names those gap codes, and each decides whether a snapshot can be Verified and write a checkpoint. The new tests are report_tie_out_passes_only_for_the_run_pack, identical_record_in_two_windows_without_complete_scope_is_a_duplicate and complete_source_count_must_equal_the_unique_identities_accepted. Each fails under its mutation on the original code (21 passed, 1 failed, each time).

2. The extraction. The same four mutations (the three above plus dropping source_cut_atomicity_unavailable) applied to the new code each fail (21/1). Mutations were restored from the commit each time.

3. Review fixes (comments only) and the reseal.

Proof

• Test names: cargo test --workspace -- --list on src-tauri/ gives 1,573 names, identical before and after the extraction (sorted diff empty), plus the 3 new tests from commit 1. Tests and the diff were run on the original base before the rebase.
• Comments: all 6 comment lines of the old function are present after normalisation (0 missing). Sonnet review found two that the move had left pointing at moved code; both are fixed.
• cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings -A clippy::pedantic pass on src-tauri/.
• Rebased onto 6b57943 (Extract named steps from book_presence::decide #477): the conflicts were in the compatibility JSONs only, and master's copy was taken. reconciliation.rs and its tests are byte-identical to the reviewed head. ./scripts/reseal.sh then --verify exits 0: 262 pins, cap 262, one content hash.
• Independent review (Sonnet): equivalence traced line by line and no P1. Its two P2 comment fixes and one P3 doc gap are fixed. One P3 remains open, listed below.

Open follow-up (P3, not in this PR)

The per-window record_counts sum stays inline in build_reconciliation while the other accumulations live on SnapshotTotals. Folding it in needs a full rebuild, deferred because disk was tight tonight.

Conventions checklist (docs/rust-module-conventions.md), measured

1. Deletion first? No. build_reconciliation is a live pub fn called by the snapshot orchestration.
2. Pinned? Yes. There are no new files; this is a content reseal only.
3. Inline tests separated? Yes, already in reconciliation_tests.rs (Move the inline tests out of commands.rs and sync/reconciliation.rs #441).
4. One huge function or many small things? One huge function: 276/12 (23x). After, canonicalize_core_window (169) is the longest, and build_reconciliation holds the loop and proof assembly.
5. Read the boundary? Each step is one gap family, and each gap code is emitted by exactly one step.
6. Layer or wrapper? None is a wrapper; SnapshotTotals holds the six mutually coupled per-iteration accumulators.
7. Deep? Yes: small signatures (evidence in, gaps or totals out).
8. Change coupling? 7 commits on master touch the file; the steps stay in-file, so no history seam is crossed.
9. Façade? Not applicable (in-file).

Coordination: claimed with the app-crate lane owner. It joins BRIDGE-MERGE-QUEUE.md at the tail and merges only after announcement.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.