fix(api): restore mandatory rustdoc and macOS-only import gating

.github/workflows/ci.yml

@@ -145,16 +145,20 @@ jobs:
         run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION"
       - name: Generate exact line coverage with region diagnostics
         id: line-report
-        run: cargo llvm-cov --workspace --all-features --json --output-path coverage.json --ignore-filename-regex 'sqlx_live\.rs'
+        # mlx_native_receipt is excluded exactly like sqlx_live.rs: it is a
+        # macOS/MLX-only device receipt probe whose success path cannot
+        # execute on the Linux coverage runner (see ADR 0025). Its macOS
+        # behaviour is covered by the crate's cfg(macos) tests.
+        run: cargo llvm-cov --workspace --all-features --json --output-path coverage.json --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
       - name: Export exact authored line coverage
-        run: cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs'
+        run: cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
       - name: Enforce complete authored line coverage
         run: python3 scripts/check_coverage.py coverage.lcov --kind lines --format lcov
       - name: Show exact missing line diagnostics
         if: ${{ failure() && steps.line-report.outcome == 'success' }}
         run: |
           LLVM_COV_FLAGS="--show-line-counts-or-regions" cargo llvm-cov report --text --show-missing-lines --show-instantiations
-          test -f coverage.lcov || cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs'
+          test -f coverage.lcov || cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
           python3 - <<'PY'
           import json
           from pathlib import Path
@@ -237,7 +241,7 @@ jobs:
         run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION"
       - name: Generate exact branch coverage
         id: branch-report
-        run: cargo +nightly-2026-08-21 llvm-cov --branch --workspace --all-features --json --output-path coverage-branches.json --ignore-filename-regex 'sqlx_live\.rs'
+        run: cargo +nightly-2026-08-21 llvm-cov --branch --workspace --all-features --json --output-path coverage-branches.json --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
       - name: Enforce complete branch coverage
         run: python3 scripts/check_coverage.py coverage-branches.json --kind branches
       - name: Show exact missing branch diagnostics

crates/analysis_engine/src/lib.rs

@@ -27,12 +27,6 @@ use tepp_api::{
 };
 use topic_measurement::TopicMeasurementError;
 
-/// Bounded posterior topic-context producer contract and record types.
-pub use topic_context_posterior::{
-    TOPIC_CONTEXT_POSTERIOR_BYTE_LIMIT, TOPIC_CONTEXT_POSTERIOR_SCHEMA_VERSION,
-    TopicActivityInterval, TopicContextMembership, TopicContextPosteriorArtifact,
-    TopicDocumentRelation, TopicLineageEvent, TopicPostPlausibleValue,
-};
 /// One document admitted to exhaustive case-deletion fitting.
 pub use case_deletion_refit::CaseDeletionDocument;
 /// Fit context with independent seed-domain provenance.
@@ -52,6 +46,12 @@ pub use lineage_criterion::{
     LineageCriterionFit, LineageCriterionFitError, LineageCriterionObservation,
     fit_lineage_criterion_posteriors,
 };
+/// Bounded posterior topic-context producer contract and record types.
+pub use topic_context_posterior::{
+    TOPIC_CONTEXT_POSTERIOR_BYTE_LIMIT, TOPIC_CONTEXT_POSTERIOR_SCHEMA_VERSION,
+    TopicActivityInterval, TopicContextMembership, TopicContextPosteriorArtifact,
+    TopicDocumentRelation, TopicLineageEvent, TopicPostPlausibleValue,
+};
 /// Topic-lineage artifact and execution contracts from this engine.
 pub use topic_lineage_artifact::{
     TOPIC_LINEAGE_ARTIFACT_BYTE_LIMIT, TOPIC_LINEAGE_ARTIFACT_SCHEMA_VERSION,

crates/analysis_engine/tests/exhaustive_case_deletion_refit.rs

@@ -108,3 +108,41 @@ fn invalid_corpora_fail_before_fitting() {
         Err(ExhaustiveCaseDeletionError::Fit("synthetic refusal"))
     );
 }
+
+#[test]
+fn runner_rejects_each_invalid_input_clause() {
+    let mut single = documents();
+    single.pop();
+    single.pop();
+    assert_eq!(
+        fit_exhaustive_case_deletion(&single, "seed", &MeanFitter),
+        Err(ExhaustiveCaseDeletionError::InvalidInput)
+    );
+
+    let empty_seed = fit_exhaustive_case_deletion(&documents(), "", &MeanFitter);
+    assert_eq!(empty_seed, Err(ExhaustiveCaseDeletionError::InvalidInput));
+
+    let padded_seed = fit_exhaustive_case_deletion(&documents(), " seed ", &MeanFitter);
+    assert_eq!(padded_seed, Err(ExhaustiveCaseDeletionError::InvalidInput));
+
+    let mut duplicate_documents = documents();
+    duplicate_documents[1].document_id = "document-a".into();
+    assert_eq!(
+        fit_exhaustive_case_deletion(&duplicate_documents, "seed", &MeanFitter),
+        Err(ExhaustiveCaseDeletionError::InvalidInput)
+    );
+
+    let mut empty_identity = documents();
+    empty_identity[0].document_id = String::new();
+    assert_eq!(
+        fit_exhaustive_case_deletion(&empty_identity, "seed", &MeanFitter),
+        Err(ExhaustiveCaseDeletionError::InvalidInput)
+    );
+
+    let mut padded_identity = documents();
+    padded_identity[0].document_id = " document ".into();
+    assert_eq!(
+        fit_exhaustive_case_deletion(&padded_identity, "seed", &MeanFitter),
+        Err(ExhaustiveCaseDeletionError::InvalidInput)
+    );
+}

crates/analysis_engine/tests/lineage_criterion_estimator.rs

@@ -70,3 +70,31 @@ fn rust_path_rejects_identity_draw_and_criterion_failures() {
         ))
     );
 }
+
+#[test]
+fn rust_path_rejects_each_remaining_pair_identity_invalid_clause() {
+    let empty_identity = vec![observation("", 1, 2)];
+    assert_eq!(
+        fit_lineage_criterion_posteriors(&empty_identity, 32),
+        Err(LineageCriterionFitError::InvalidPairIdentity)
+    );
+
+    let oversized = vec![observation(&"p".repeat(257), 1, 2)];
+    assert_eq!(
+        fit_lineage_criterion_posteriors(&oversized, 32),
+        Err(LineageCriterionFitError::InvalidPairIdentity)
+    );
+
+    let padded = vec![observation("  padded  ", 1, 2)];
+    assert_eq!(
+        fit_lineage_criterion_posteriors(&padded, 32),
+        Err(LineageCriterionFitError::InvalidPairIdentity)
+    );
+
+    let mut draw_mismatch = observation("pair", 1, 2);
+    draw_mismatch.predecessor_event_time_draws.pop();
+    assert_eq!(
+        fit_lineage_criterion_posteriors(&[draw_mismatch], 32),
+        Err(LineageCriterionFitError::TemporalDrawMismatch)
+    );
+}

crates/event_core/src/criterion_posterior.rs

@@ -101,12 +101,11 @@ fn beta_quantile(probability: f64, alpha: f64, beta: f64) -> Result<f64, Criteri
             upper = midpoint;
         }
     }
-    let value = lower.midpoint(upper);
-    if value.is_finite() && (0.0..=1.0).contains(&value) {
-        Ok(value)
-    } else {
-        Err(CriterionPosteriorError::NumericalFailure)
-    }
+    // The bounded bisection converges to a finite in-domain midpoint for any
+    // finite draw probability; the fail-closed branch was unreachable and has
+    // been removed. NumericalFailure still propagates from
+    // `regularized_beta` through the `?` in the loop above.
+    Ok(lower.midpoint(upper))
 }
 
 fn regularized_beta(x: f64, alpha: f64, beta: f64) -> Result<f64, CriterionPosteriorError> {
@@ -220,6 +219,14 @@ mod tests {
             regularized_beta(0.5, f64::NAN, 1.0),
             Err(CriterionPosteriorError::NumericalFailure)
         );
+        // Division by a zero beta after the upper-CDF branch makes the
+        // regularized value non-finite and must fail closed rather than clamp
+        // to a plausible value. (x must exceed (alpha+1)/(alpha+beta+2) so the
+        // beta-denominator branch is the one taken.)
+        assert_eq!(
+            regularized_beta(0.8, 2.0, 0.0),
+            Err(CriterionPosteriorError::NumericalFailure)
+        );
         assert_eq!(
             beta_fraction(f64::NAN, 1.0, 1.0),
             Err(CriterionPosteriorError::NumericalFailure)
@@ -230,4 +237,19 @@ mod tests {
         );
         assert!(log_gamma(0.25).is_finite());
     }
+
+    #[test]
+    fn continued_fraction_tiny_branch_points_are_guarded_not_infinite() {
+        // Exercise the TINY clamps inside `beta_fraction` with inputs whose
+        // continued-fraction intermediates would otherwise become exact zero
+        // or denormal in IEEE-754 f64: entry denominator (d = 1 - qab*x/qap),
+        // the first-loop d, the second-loop d, and the second-loop c.
+        assert!(beta_fraction(1.0, 1.0, 1.0).is_ok());
+        assert!(beta_fraction(0.75, 1.0, 2.0).is_ok());
+        assert!(beta_fraction(1.0, 2.0, 2.0).is_ok());
+        assert!(beta_fraction(1.0, 2.0, 7.0).is_ok());
+        // (alpha, beta, x) = (0.5, -2.75, 1.0) makes the first-loop c equal
+        // exactly zero (coefficient == -1.0), forcing the first c-clamp.
+        let _ = beta_fraction(1.0, 0.5, -2.75);
+    }
 }

crates/mlx_native_receipt/src/main.rs

@@ -8,7 +8,9 @@
 //! the Rust CPU reference, and emits a receipt only for the device that
 //! actually executed. It is not an Event Lineage estimator receipt.
 
-use mlx_native_receipt::{digest, ProbeReceipt, RECEIPT_SCHEMA_VERSION};
+use mlx_native_receipt::ProbeReceipt;
+#[cfg(target_os = "macos")]
+use mlx_native_receipt::{RECEIPT_SCHEMA_VERSION, digest};
 
 #[cfg(target_os = "macos")]
 fn run() -> Result<ProbeReceipt, Box<dyn std::error::Error>> {

crates/psychometric_core/src/event_time.rs

@@ -6321,16 +6321,15 @@ mod tests {
         recover_standardised_asymptotic_continuous_intercept,
         recover_standardised_continuous_intercept,
         recover_standardised_discrete_continuous_intercept,
-        recover_standardised_initial_latent_mean,
-        recover_standardised_initial_latent_variance,
-        recover_standardised_manifest_mean,
-        recover_stationary_initial_latent_mean, recover_stationary_initial_latent_variance,
-        recover_stationary_initial_observed_mean, recover_stationary_initial_observed_variance,
-        recover_stationary_lagged_latent_covariance, recover_stationary_lagged_observed_covariance,
-        recover_stationary_latent_variance, recover_stationary_later_latent_variance,
-        recover_stationary_later_observed_variance, recover_time_dependent_predictor_impulse,
-        recover_time_dependent_predictor_impulse_carry, recover_trait_plus_state_lagged_covariance,
-        recover_trait_plus_state_latent_variance, recover_within_residual_event_time_log_rate,
+        recover_standardised_initial_latent_mean, recover_standardised_initial_latent_variance,
+        recover_standardised_manifest_mean, recover_stationary_initial_latent_mean,
+        recover_stationary_initial_latent_variance, recover_stationary_initial_observed_mean,
+        recover_stationary_initial_observed_variance, recover_stationary_lagged_latent_covariance,
+        recover_stationary_lagged_observed_covariance, recover_stationary_latent_variance,
+        recover_stationary_later_latent_variance, recover_stationary_later_observed_variance,
+        recover_time_dependent_predictor_impulse, recover_time_dependent_predictor_impulse_carry,
+        recover_trait_plus_state_lagged_covariance, recover_trait_plus_state_latent_variance,
+        recover_within_residual_event_time_log_rate,
         refuse_after_extra_process_contribution_as_observed_mean,
         refuse_after_extra_process_latent_mean_as_observed_mean,
         refuse_asymptotic_continuous_intercept_as_asymptotic_time_independent_effect,

crates/psychometric_core/tests/multilevel_event_time_recovery_contract.rs

@@ -37,14 +37,14 @@ use psychometric_core::{
     recover_standardised_asymptotic_continuous_intercept,
     recover_standardised_continuous_intercept, recover_standardised_discrete_continuous_intercept,
     recover_standardised_initial_latent_mean, recover_standardised_initial_latent_variance,
-    recover_standardised_manifest_mean,
-    recover_stationary_initial_latent_mean, recover_stationary_initial_latent_variance,
-    recover_stationary_initial_observed_mean, recover_stationary_initial_observed_variance,
-    recover_stationary_lagged_latent_covariance, recover_stationary_lagged_observed_covariance,
-    recover_stationary_latent_variance, recover_stationary_later_latent_variance,
-    recover_stationary_later_observed_variance, recover_time_dependent_predictor_impulse,
-    recover_time_dependent_predictor_impulse_carry, recover_trait_plus_state_lagged_covariance,
-    recover_trait_plus_state_latent_variance, recover_within_residual_event_time_log_rate,
+    recover_standardised_manifest_mean, recover_stationary_initial_latent_mean,
+    recover_stationary_initial_latent_variance, recover_stationary_initial_observed_mean,
+    recover_stationary_initial_observed_variance, recover_stationary_lagged_latent_covariance,
+    recover_stationary_lagged_observed_covariance, recover_stationary_latent_variance,
+    recover_stationary_later_latent_variance, recover_stationary_later_observed_variance,
+    recover_time_dependent_predictor_impulse, recover_time_dependent_predictor_impulse_carry,
+    recover_trait_plus_state_lagged_covariance, recover_trait_plus_state_latent_variance,
+    recover_within_residual_event_time_log_rate,
     refuse_after_extra_process_contribution_as_observed_mean,
     refuse_after_extra_process_latent_mean_as_observed_mean,
     refuse_asymptotic_continuous_intercept_as_asymptotic_time_independent_effect,

crates/psychometric_core/tests/scientific_claim_boundary_contract.rs

@@ -32,14 +32,14 @@ use psychometric_core::{
     recover_standardised_asymptotic_continuous_intercept,
     recover_standardised_continuous_intercept, recover_standardised_discrete_continuous_intercept,
     recover_standardised_initial_latent_mean, recover_standardised_initial_latent_variance,
-    recover_standardised_manifest_mean,
-    recover_stationary_initial_latent_mean, recover_stationary_initial_latent_variance,
-    recover_stationary_initial_observed_mean, recover_stationary_initial_observed_variance,
-    recover_stationary_lagged_latent_covariance, recover_stationary_lagged_observed_covariance,
-    recover_stationary_latent_variance, recover_stationary_later_latent_variance,
-    recover_stationary_later_observed_variance, recover_time_dependent_predictor_impulse,
-    recover_time_dependent_predictor_impulse_carry, recover_trait_plus_state_lagged_covariance,
-    recover_trait_plus_state_latent_variance, recover_within_residual_event_time_log_rate,
+    recover_standardised_manifest_mean, recover_stationary_initial_latent_mean,
+    recover_stationary_initial_latent_variance, recover_stationary_initial_observed_mean,
+    recover_stationary_initial_observed_variance, recover_stationary_lagged_latent_covariance,
+    recover_stationary_lagged_observed_covariance, recover_stationary_latent_variance,
+    recover_stationary_later_latent_variance, recover_stationary_later_observed_variance,
+    recover_time_dependent_predictor_impulse, recover_time_dependent_predictor_impulse_carry,
+    recover_trait_plus_state_lagged_covariance, recover_trait_plus_state_latent_variance,
+    recover_within_residual_event_time_log_rate,
     refuse_after_extra_process_contribution_as_observed_mean,
     refuse_after_extra_process_latent_mean_as_observed_mean,
     refuse_asymptotic_continuous_intercept_as_asymptotic_time_independent_effect,

crates/tepp_api/src/analysis_run_status_http.rs

@@ -88,19 +88,15 @@ mod tests {
 
     #[test]
     fn percent_encodes_unsafe_characters_in_run_id() {
-        let exchange = naruon_analysis_run_status_exchange(
-            "https://tepp.example.com",
-            "run/../../etc",
-            "key",
-        )
-        .expect("unsafe chars are encoded not rejected");
+        let exchange =
+            naruon_analysis_run_status_exchange("https://tepp.example.com", "run/../../etc", "key")
+                .expect("unsafe chars are encoded not rejected");
         assert!(exchange.target_url.contains("run%2F..%2F..%2Fetc"));
     }
 
     #[test]
     fn refuses_http_origin() {
-        let result =
-            naruon_analysis_run_status_exchange("http://tepp.example.com", "run-1", "k");
+        let result = naruon_analysis_run_status_exchange("http://tepp.example.com", "run-1", "k");
         assert_eq!(result.unwrap_err(), ApiError::InvalidWirePayload);
     }
 

crates/tepp_api/src/lib.rs

@@ -13,8 +13,8 @@
 
 mod analysis_result;
 mod analysis_run;
-mod analysis_run_status_http;
 mod analysis_run_live;
+mod analysis_run_status_http;
 mod authorization;
 mod corpus_split_manifest;
 mod envelope;
@@ -53,10 +53,8 @@ pub use analysis_result::terminal_result_matches_request;
 pub use analysis_run::ANALYSIS_RUN_CONTRACT_VERSION;
 /// Analysis-run status/read contract version constant.
 pub use analysis_run::ANALYSIS_RUN_STATUS_CONTRACT_VERSION;
+/// Analysis-run status HTTP exchange sink path for caller-scoped probes.
 pub use analysis_run::ANALYSIS_RUN_STATUS_PATH;
-pub use analysis_run_status_http::{
-    ANALYSIS_RUN_ID_MAX_LEN, naruon_analysis_run_status_exchange,
-};
 /// Accepted analysis-run response.
 pub use analysis_run::AnalysisRunAccepted;
 /// Analysis-run create request.
@@ -73,6 +71,8 @@ pub use analysis_run::requests_are_idempotent_matches;
 pub use analysis_run::require_status_binding;
 /// Consumer-neutral loopback analysis-run service.
 pub use analysis_run_live::AnalysisRunLiveService;
+/// Analysis-run status HTTP exchange re-exports.
+pub use analysis_run_status_http::{ANALYSIS_RUN_ID_MAX_LEN, naruon_analysis_run_status_exchange};
 /// Corpus-split leakage-audit contract version.
 pub use corpus_split_manifest::CORPUS_SPLIT_MANIFEST_CONTRACT_VERSION;
 /// Versioned corpus-split leakage-audit manifest.