fix(scaling): bound LSR ranking input materialization

[seonghobae]

Buyer-visible reliability gap

The public LSR/I-LSR ranking wrappers validate item values and cap the dense chain at n <= 10_000, but the current branch still materializes each caller-controlled ranking with list(ranking) and consumes the outer rankings iterable without a total-entry bound. Infinite/adversarial iterables can therefore run indefinitely or leak caller-controlled exception text before package validation; very large finite streams can grow Python/NumPy CSR storage until memory pressure even though the Rust numerical kernel is bounded by n.

This Draft advances #612 with a fail-first resource/security contract.

Intentional RED contract

tests/test_scaling_ranking_input_bounds.py requires:

• at most n + 1 requests from one inner ranking before rejecting impossible overlength;
• an explicit fixed-width CSR byte ceiling over flattened items plus start offsets;
• boundary-minus-one, exact-boundary and boundary-plus-one behavior with tiny monkeypatched limits;
• stable non-reflective ValueError normalization for ordinary outer/inner iterable failures;
• unchanged propagation of KeyboardInterrupt, SystemExit and GeneratorExit;
• exact numerical identity for accepted list/tuple/generator inputs through the unchanged Rust-backed LSR path; and
• removal of unbounded list(ranking) while preserving one shared _rankings_to_csr boundary for LSR and I-LSR.

Finite probes deliberately raise if the implementation asks for an unbounded next value, so the RED is fast and deterministic rather than hanging CI.

Exact-current evidence

Freshly revalidated for this update:

• protected main: 8db4bf358b0a469915d6c5e336054f4a4f9c6b46 with PR 🧪 Add tests for Luce Spectral Ranking (LSR) #590 already integrated;
• exact Draft source head: cd3443801090249eafc9e60a4ca9fb57133dc789;
• exact-head Security Scan and SAST Semgrep: success;
• exact-head CI: Rust/PyO3, package/reinstall/release acceptance, GPU-smoke and fuzz succeed; Python completes with exactly six intended failures in tests/test_scaling_ranking_input_bounds.py after the rest of the suite passes;
• those six REDs identify the production boundary precisely: unbounded list(ranking), unbounded outer consumption, missing CSR-byte enforcement at the 31-byte boundary, unredacted ordinary outer iteration failure, unredacted ordinary inner iteration failure, and the source-level ban on list(ranking);
• 🧪 Add tests for Luce Spectral Ranking (LSR) #590 is accepted protected-main baseline behavior to preserve; no claim that it remains an independent pending dependency is current;
• a fresh bounded OpenCode handoff is already bound to this exact head plus current protected main for non-destructive reconciliation and the minimum GREEN implementation. Do not race or duplicate that same-head source-writer request unless source/base state materially changes.

The top-level GitHub PR base_sha field can reflect the historical base at PR creation; live integration decisions must use the exact protected-main tip above and a fresh compare_commits, not that stale metadata field.

Planned minimum GREEN

• add a documented package-owned fixed-width MAX_RANKING_CSR_BYTES ceiling;
• stream entries with at most n + 1 requests per inner ranking;
• preflight flat/start storage before growth or NumPy allocation and include every simultaneously live fixed-width CSR array in the memory budget;
• remove unbounded list(ranking) or equivalent full materialization;
• normalize ordinary caller-controlled iteration failures without reflecting exception text, while preserving process-control exceptions;
• preserve contiguous np.uint64 transport and byte/numerical identity for accepted list/tuple/generator inputs through the unchanged Rust LSR/I-LSR kernels; and
• document the bounded resource/security contract plus authoritative changelog fragment.

Numerical and scope boundary

All LSR/I-LSR transition-rate, stationary-distribution, smoothing, convergence, parameter-centering and worth-normalization arithmetic remains Rust-owned and unchanged. _top1_to_csr is a separate adjacent follow-up after this shared rankings boundary is accepted; do not silently widen this PR. No provider, database, workflow, dependency, scoring decision, validity claim, version bump, canonical #604 architecture rewrite, or release belongs here.

Remaining Draft gate

Keep Draft until current protected main is reconciled non-destructively, the intended RED reaches focused GREEN, the changed production boundary has 100% statement/branch coverage and complete public docs, authoritative changelog material is rendered/checked, and one unchanged exact head passes full Python, Rust/PyO3, package/reinstall/release acceptance, explicit GPU-no-skip, fuzz, Security Scan, SAST, current-head automated review, zero valid unresolved findings, and repository approval/branch-protection policy.

Advances #612.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 755bc334-aa87-4de7-a03b-ff947ec804eb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Take a bounded writer lease only if a final refetch still shows Draft head cd3443801090249eafc9e60a4ca9fb57133dc789 on protected main 7516031df533d1131572eb07b6e3a86b04d12793; abort without writing if either moved or another writer receipt appears.

Run pytest -q tests/test_scaling_ranking_input_bounds.py first and record the intended RED: current _rankings_to_csr must overread the finite inner/outer probes, ignore the monkeypatched CSR byte ceiling, leak ordinary iteration exceptions, or retain list(ranking). Correct any test setup defect before production work; do not change production unless RED reaches those intended boundaries.

Implement the plan in docs/superpowers/plans/2026-08-09-lsr-ranking-input-bounds.md with the smallest source change in python/fast_mlsirm/scaling.py:

• explicit private fixed-width CSR byte ceiling;
• at most n + 1 inner requests;
• bounded outer/total flat+start storage with checked arithmetic;
• no unbounded list(ranking);
• stable redacted ordinary iteration failures while preserving process-control exceptions;
• accepted list/tuple/generator inputs passed to the unchanged Rust LSR/I-LSR kernels with identical uint64 values and numerical results.

Prefer standard-library fixed-width unsigned storage plus zero-copy/bounded NumPy conversion; include all live fixed-width arrays in the budget and document what the ceiling does not claim. Add only meaningful missing edge/coverage tests in the existing authoritative test file, reach 100% changed production statement/branch coverage and complete public docstrings, add bounded doctoring/changelog fragment, render/check CHANGELOG.md, rerun focused tests and git diff --check, then commit one ordinary bounded GREEN change. Keep Draft. Do not alter Rust formulas, public signatures/results, dependencies, workflows, version/release, PR #590, or repository policy.

[seonghobae]

@opencode-agent address

Previous handoff is stale because protected main moved after PR #590 merged. Reacquire a bounded writer lease only if a final refetch still shows Draft head cd3443801090249eafc9e60a4ca9fb57133dc789 and protected main exactly 8db4bf358b0a469915d6c5e336054f4a4f9c6b46; abort without writing if either moved or another writer receipt/source mutation appears.

Preserve the existing RED-first scope in tests/test_scaling_ranking_input_bounds.py. Confirm RED reaches the unbounded _rankings_to_csr/iteration-exception/resource-budget boundary, then implement only the smallest Python marshalling/resource fix in python/fast_mlsirm/scaling.py: fixed-width CSR byte ceiling, at most n + 1 inner requests, bounded total flat/start storage with checked arithmetic, no unbounded list(ranking), stable redacted ordinary iteration failures with process-control exceptions preserved, and list/tuple/generator numerical identity through the unchanged Rust LSR/I-LSR kernels. Reconcile the newly integrated #590 test-only change from protected main without weakening or rewriting it. Add/retain complete focused coverage, doctoring/changelog fragment, render/check CHANGELOG, run focused tests and git diff --check, and commit one bounded GREEN source change. Keep Draft; no Rust formula/public-signature/dependency/workflow/version/release changes.

[seonghobae]

@opencode-agent address

Fresh handoff after protected main advanced. Take a bounded writer lease only if a final refetch still shows Draft source head cd3443801090249eafc9e60a4ca9fb57133dc789 and protected main tip 8db4bf358b0a469915d6c5e336054f4a4f9c6b46; abort without writing if either moves or another active writer receipt appears.

The intended RED is now exact machine evidence from CI run 31312748482, Python job 93243004433: exactly six failures in tests/test_scaling_ranking_input_bounds.py after 2,931 passes. The failures prove current _rankings_to_csr (1) overreads the bounded inner probe through list(ranking), (2) consumes the outer stream without a CSR byte ceiling, (3) does not reject the 31-byte boundary, (4-5) leaks ordinary outer/inner iteration exceptions, and (6) still contains unbounded list(ranking). Rust, package/reinstall/release acceptance, explicit GPU smoke, fuzz, Security Scan and SAST succeeded on that predecessor exact head; those successes do not transfer after a write.

Implement only the bounded GREEN specified by docs/superpowers/plans/2026-08-09-lsr-ranking-input-bounds.md: stream at most n + 1 entries per ranking into standard-library fixed-width unsigned storage, budget the live flattened values plus starts exactly before append, expose contiguous np.uint64 to the unchanged Rust kernels without an unbudgeted second full-size copy, redact ordinary iteration failures with stable ValueError/no caller text while allowing KeyboardInterrupt, SystemExit, and GeneratorExit to propagate, and preserve accepted list/tuple/generator numerical identity. Add meaningful missing branch tests only if required for 100% changed statement/branch coverage. Add doctoring + changelog fragment and render/check the managed CHANGELOG.md. Keep Draft; do not change Rust formulas, signatures/result types, dependencies, workflows, version/release, or PR #590.

[seonghobae]

@opencode-agent address

Reacquire a bounded source-writer lease only if a final refetch still shows Draft head cd3443801090249eafc9e60a4ca9fb57133dc789 and live protected main 8db4bf358b0a469915d6c5e336054f4a4f9c6b46; abort without writing if either moved or another current-base writer receipt appears. The earlier handoff bound to protected main 7516031... is stale and must not be reused.

The intended RED is already proven on exact source head in CI run 31312748482, Python job 93243004433: 6 failed, 2931 passed, 2 skipped, and all six failures are the committed ranking-bound contract. Rust, package/reinstall/release acceptance, explicit GPU-no-skip, fuzz, Security Scan and SAST are green on that source head. Do not rewrite the RED tests or change Rust numerical semantics.

Implement only docs/superpowers/plans/2026-08-09-lsr-ranking-input-bounds.md:

1. In python/fast_mlsirm/scaling.py, replace unbounded list(ranking) and unbounded outer accumulation with one shared bounded _rankings_to_csr stream boundary. Add a documented MAX_RANKING_CSR_BYTES fixed-width CSR ceiling. A ranking may contain at most n entries and must consume no more than n + 1 pulls to prove overlength.
2. Accumulate flattened items and start offsets in fixed-width unsigned storage, preflighting the combined live (flat_count + start_count) * 8 budget before append/allocation. Reserve the next start offset while reading a ranking. Convert/expose contiguous np.uint64 arrays without an unbudgeted same-size Python-int list or second full-size copy. Preserve accepted list/tuple/generator bytes/results and the existing n <= 10_000 contract.
3. Normalize ordinary caller-controlled outer/inner iteration failures to stable non-reflective ValueError text; preserve KeyboardInterrupt, SystemExit, and GeneratorExit. Preserve existing item-validation semantics and leave duplicate detection to Rust as today.
4. Run pytest -q tests/test_scaling_ranking_input_bounds.py to GREEN, then existing scaling/LSR tests and focused statement+branch coverage until changed production is 100% with meaningful tests. Do not add unreachable coverage branches.
5. Add/update LSR/I-LSR docstrings, docs/doctoring/lsr_ranking_input_bounds.md, and docs/changelog.d/612-lsr-ranking-input-bounds.md; then run python scripts/render_changelog_fragments.py --update CHANGELOG.md, --check CHANGELOG.md, changelog contract, formatting/lint and git diff --check.
6. Reconcile current protected main non-destructively only if needed for exact integration, preserving 🧪 Add tests for Luce Spectral Ranking (LSR) #590 and all accepted-main content; no force-push/destructive rebase. Commit one bounded GREEN/integration result and leave Draft.

Do not change Rust LSR/I-LSR formulas, public signatures/results, dependencies/workflows/version/release, canonical architecture PR #604, or unrelated scaling APIs. Stop after exact-head deterministic GREEN evidence so normal CI/security/review can run.

[seonghobae]

@opencode-agent address

Take a bounded writer lease only if a final refetch still shows Draft head cd3443801090249eafc9e60a4ca9fb57133dc789 and protected main 8db4bf358b0a469915d6c5e336054f4a4f9c6b46; the earlier handoff bound to 7516031... is stale. Abort without writing if the head/base moves or another current writer receipt appears.

Fresh exact RED is already established on CI run 31312748482, Python job 93243004433: exactly 6 failures, 2931 passes, 2 skips. The failures are the intended production boundaries only: unbounded inner list(ranking) overread, unbounded outer stream, missing 31/32-byte CSR ceiling, unredacted ordinary outer/inner iteration exceptions, and retained list(ranking) source. Rust, GPU, fuzz, package, Security Scan, and SAST all passed on this RED head.

First reconcile protected main non-destructively because #590 changed only independent tests/test_scaling.py; rerun pytest -q tests/test_scaling_ranking_input_bounds.py and require the same intended RED before production edits. Then implement the smallest GREEN in python/fast_mlsirm/scaling.py per the existing plan:

• explicit private MAX_RANKING_CSR_BYTES fixed-width budget;
• stream each inner ranking with at most n + 1 requests and no list(ranking);
• bound the outer stream and total flat/start fixed-width storage before requesting/allocating past the limit;
• preserve accepted list/tuple/generator np.uint64 values and exact Rust LSR/I-LSR numerical results;
• normalize ordinary caller iteration failures to stable non-reflective ValueError while preserving KeyboardInterrupt, SystemExit, and GeneratorExit;
• keep all LSR/I-LSR numerical formulas, public signatures, dependencies, workflows, and release/version unchanged.

Add only the bounded doctoring/changelog fragment required by this reliability contract, render/check CHANGELOG, run focused tests plus relevant scaling tests, changed-production statement/branch coverage, docstring checks and git diff --check, then commit one ordinary bounded GREEN change. Keep Draft for exact-head CI/security/SAST/review. Do not touch canonical architecture PR #604 or PR #613.

[seonghobae]

@opencode-agent address

Reacquire this bounded writer lease only if a final refetch still shows Draft head cd3443801090249eafc9e60a4ca9fb57133dc789 and protected main 8db4bf358b0a469915d6c5e336054f4a4f9c6b46; abort without writing if either moves or another current-head source writer appears. The earlier handoff was bound to superseded main 7516031df533d1131572eb07b6e3a86b04d12793 and is no longer executable.

Fresh CI proves the intended production-boundary RED at this head: exactly six failures in tests/test_scaling_ranking_input_bounds.py show unbounded list(ranking), unbounded outer consumption, absent CSR-byte enforcement, and unredacted ordinary iterable exceptions; Rust, package/reinstall/release-acceptance, GPU-no-skip, fuzz, Security Scan, and SAST were green. PR #590 is now integrated into protected main and its ranking/scaling invariants are baseline behavior to preserve.

First reconcile current protected main non-destructively; do not discard #590 or widen the two-wrapper _rankings_to_csr slice. Then implement the minimum GREEN from the existing plan: fixed-width package-owned CSR byte ceiling; at most n + 1 inner requests; bounded outer/flat/start storage preflight; no list(ranking); stable non-reflective ordinary iteration ValueError; unchanged KeyboardInterrupt/SystemExit/GeneratorExit; and byte/numerical identity for accepted list/tuple/generator inputs through the unchanged Rust LSR/I-LSR kernels. Include all simultaneously live fixed-width CSR arrays in the budget and preserve Rust numerical ownership.

Add only necessary doctoring/changelog material, render/check CHANGELOG.md, run the focused fail-first contract to GREEN with 100% changed production statement/branch coverage, then relevant #590 scaling invariants plus full feasible validation and git diff --check. Commit only this bounded current-main reconciliation/implementation. Keep Draft; do not change dependencies/workflows/version/release, canonical docs PR #604, approval/merge state, or the intentionally separate _top1_to_csr follow-up.

[seonghobae]

@opencode-agent address

Take a bounded writer lease only if a final refetch still shows Draft head 67f6af210c00f8dc90a19a8e1a95c5b63149a301 over protected main a6b7ecc680b73a277714a795143c7a27125022c3; abort without writing if either moved or another source writer appears.

The branch has already been reconciled non-destructively with current protected main and now carries only the fail-first test plus its implementation plan. Fresh predecessor CI 31312748482 proved exactly the intended RED: 6 failed, 2931 passed, 2 skipped; all six failures are in tests/test_scaling_ranking_input_bounds.py, while Rust, package/reinstall/release acceptance, GPU-smoke, fuzz, Security Scan and SAST are green. The failures prove unbounded list(ranking), unbounded outer consumption, missing 31-byte CSR-limit enforcement, ordinary outer/inner iterable exception leakage, and the source-level materialization defect.

Implement the minimum GREEN only in python/fast_mlsirm/scaling.py, plus focused doctoring/changelog after GREEN:

• add a documented package-owned MAX_RANKING_CSR_BYTES fixed-width ceiling;
• stream one inner ranking with at most n + 1 requests before rejecting impossible overlength;
• bound outer consumption and fixed-width CSR storage before growth/allocation; count both flattened items and starts as uint64 storage, so one two-item ranking plus starts [0, 2] is exactly 32 bytes;
• remove list(ranking) and any equivalent unbounded full materialization;
• normalize ordinary outer/inner iteration failures to stable non-reflective ValueError containing iteration, while preserving KeyboardInterrupt, SystemExit, and GeneratorExit unchanged;
• preserve all existing integer/index validation, contiguous np.uint64 transport, exact accepted list/tuple/generator results, and unchanged Rust-owned LSR/I-LSR numerical kernels;
• keep _top1_to_csr out of scope.

Run pytest -q tests/test_scaling_ranking_input_bounds.py, changed-boundary statement/branch coverage, authoritative changelog renderer update/check, formatting and git diff --check, then relevant full verification. Commit only the bounded GREEN implementation/tests/docs required by those gates.

Keep Draft. Do not alter Rust formulas, public LSR/I-LSR result semantics, dependencies/workflows/credentials/version/release, canonical architecture PR #604, mark Ready, approve, merge, or widen into adjacent input classes. Stop after exact-head deterministic evidence.

[seonghobae]

@opencode-agent address

Take a bounded writer lease on PR #614 only if a final refetch still shows exact Draft head 67f6af210c00f8dc90a19a8e1a95c5b63149a301 and protected main f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f; abort without writing if either moved or another source writer is active. The earlier handoff bound to cd344380... / 7516031... is stale and does not authorize a current write.

Fresh exact-head CI proves the intended production RED is still live and isolated: 6 failures in tests/test_scaling_ranking_input_bounds.py while 2936 tests pass; Rust, package, GPU-smoke, fuzz, Security and SAST are green. The failures are exactly unbounded list(ranking), unbounded outer consumption, absent CSR-byte enforcement at the 31-byte boundary, and unredacted ordinary outer/inner iteration failures.

Implement the minimum GREEN in python/fast_mlsirm/scaling.py only, preserving the existing public APIs and unchanged Rust LSR/I-LSR arithmetic:

• stream each inner ranking with at most n + 1 requests;
• bound total flat/start fixed-width CSR storage with checked arithmetic and a package-owned byte ceiling, counting all simultaneously live fixed-width CSR arrays;
• remove unbounded list(ranking);
• normalize ordinary caller-controlled iteration failures to stable non-reflective ValueError, preserving KeyboardInterrupt, SystemExit, and GeneratorExit;
• preserve accepted list/tuple/generator uint64 values and numerical identity.

Then run pytest -q tests/test_scaling_ranking_input_bounds.py, meaningful changed-production statement/branch coverage, python scripts/render_changelog_fragments.py --update and --check, the changelog contract, and git diff --check; reconcile current protected main non-destructively if needed. Push only a bounded GREEN/doctoring/fragment/renderer diff if all focused checks pass and the lease still holds. Keep Draft; do not alter Rust formulas, dependencies, workflows, version/release, or canonical architecture PR #604.

[seonghobae]

Superseded bookkeeping note: an earlier exact-current writer handoff already covers head 67f6af210c00f8dc90a19a8e1a95c5b63149a301 over protected main f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f. This duplicate request is withdrawn; do not create an additional writer from this comment.

[seonghobae]

@opencode-agent address

Take a bounded source-writer lease only if a final refetch still shows Draft head 67f6af210c00f8dc90a19a8e1a95c5b63149a301 and protected main f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f; abort without writing if either moved or another current-head source writer appears. All older handoffs are stale.

Exact-current CI already establishes the intended production-boundary RED: Security Scan and SAST are green; Rust, package/reinstall/release-acceptance, GPU and fuzz jobs are green; Python has exactly six failures in tests/test_scaling_ranking_input_bounds.py after the rest of the suite passes. Fix those six only, preserving the accepted #590 behavior and unchanged Rust numerical kernels:

1. Replace unbounded list(ranking) in _rankings_to_csr with bounded streaming. An inner ranking may request at most n + 1 values before rejecting impossible overlength.
2. Add the package-owned MAX_RANKING_CSR_BYTES fixed-width transport ceiling and preflight flattened uint64 items plus uint64 start offsets before growth/allocation. Preserve the tested 31-byte reject / 32-byte accept / 33-byte accept boundary for one two-item ranking.
3. Bound the outer stream by that same storage budget so an infinite outer iterable cannot grow indefinitely.
4. Normalize ordinary caller-controlled outer/inner iteration exceptions to stable non-reflective ValueError messages with no caller exception text. Preserve KeyboardInterrupt, SystemExit, and GeneratorExit by catching ordinary Exception, never BaseException.
5. Preserve accepted list/tuple/generator np.uint64 CSR bytes and LSR/I-LSR numerical identity through the existing Rust core.
6. Keep one shared _rankings_to_csr boundary; do not expand into _top1_to_csr, model arithmetic, dependencies, workflows, canonical docs docs: establish canonical product and architecture baseline #604, versioning, or release work.

Run the focused tests to GREEN, add only meaningful branch/statement coverage needed for 100% changed production coverage, update the bounded resource/security doctoring and authoritative changelog fragment if the implementation contract changes, render/check managed CHANGELOG.md, run formatting/lint and git diff --check, then commit one bounded fix. Keep the PR Draft; do not mark Ready, approve, merge, or create another PR. Stop if exact head/base changes during the write.

[seonghobae]

@opencode-agent address

Take the bounded source-writer lease only if a final refetch still shows Draft head 686c9b3004e027eb0e7891e8ef9341530331f273 and protected main f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f; abort without writing if either moved or another current-head source writer appears. This exact head now non-destructively reconciles the two fail-first #612 paths onto current protected main. All predecessor handoffs are stale.

The intended production-boundary RED remains the six previously proven behaviors in tests/test_scaling_ranking_input_bounds.py: unbounded inner list(ranking), unbounded outer consumption, missing CSR-byte enforcement at the 31/32/33-byte boundary, unredacted ordinary outer/inner iterable failures, and the source-level ban on list(ranking).

Implement the minimum GREEN only in the shared _rankings_to_csr boundary plus focused doctoring/changelog if the contract changes: package-owned MAX_RANKING_CSR_BYTES; at most n + 1 pulls per inner ranking before overlength rejection; preflight fixed-width uint64 flat-item plus start-offset storage before growth/allocation; bound outer streaming by the same budget; normalize ordinary caller iteration exceptions to stable non-reflective ValueError; preserve KeyboardInterrupt, SystemExit, GeneratorExit; preserve accepted list/tuple/generator CSR bytes and unchanged Rust LSR/I-LSR arithmetic. Run focused RED→GREEN, 100% changed production statement/branch coverage, authoritative changelog render/check, formatting/lint and git diff --check, then commit one bounded fix. Keep Draft. Do not expand into _top1_to_csr, model arithmetic, dependencies/workflows/version/release/canonical docs #604, Ready/approval/merge, or another PR. Stop if exact head/base moves during the write.

[seonghobae]

@jules address

Fallback bounded source-writer handoff for exact Draft head 686c9b3004e027eb0e7891e8ef9341530331f273 over protected main f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f. The prior exact-head OpenCode handoff has no receipt/reaction and no source movement after the exact-current six-RED CI completed; treat it as inactive, but perform a final head/base/comment refetch before writing and abort if another writer appears or either ref moved.

The intended RED is already exact and deterministic: tests/test_scaling_ranking_input_bounds.py has six failures and the remaining suite is green. Implement only the minimum GREEN in the shared python/fast_mlsirm/scaling.py::_rankings_to_csr boundary plus focused doctoring/changelog if required: package-owned fixed-width MAX_RANKING_CSR_BYTES; at most n + 1 pulls per inner ranking before overlength rejection; bounded outer and flat/start fixed-width CSR storage with checked/preflight byte arithmetic; no list(ranking) or equivalent unbounded materialization; ordinary caller-controlled outer/inner iteration failures normalized to stable non-reflective ValueError; KeyboardInterrupt, SystemExit, and GeneratorExit preserved; accepted list/tuple/generator values transported as contiguous uint64 to unchanged Rust LSR/I-LSR kernels with identical numerical results.

Run focused RED→GREEN, meaningful 100% changed production statement/branch coverage and complete public docs, authoritative changelog render/check if a fragment is added/changed, formatting/lint and git diff --check, then commit one bounded fix. Keep Draft. Do not expand into _top1_to_csr, alter Rust formulas/public numerical behavior/dependencies/workflows/version/release/canonical docs #604, mark Ready, approve, merge, close #612, or open another PR. Stop writing if exact head/base moves.

[seonghobae]

@opencode-agent address

Superseding bounded RED→GREEN handoff after protected-main movement. Fresh identities immediately before dispatch: Draft #614 exact head 686c9b3004e027eb0e7891e8ef9341530331f273; live protected main dccd1f281ec95216b3fcfd682d872c3ace74c68b; compare = diverged, ahead 5 / behind 1. Net unique paths are the bounded implementation plan and fail-first ranking-input tests; prior writer instructions were bound to older bases and required abort on movement, so they are predecessor evidence. Final-refetch head/base/comments before writing and abort if either ref moves or another current-head writer appears.

First reconcile current protected main non-destructively, preserving accepted #630 CodeQL analyze pin and the committed RED plan/tests. Re-run pytest -q tests/test_scaling_ranking_input_bounds.py and require the intended finite RED at _rankings_to_csr before production changes. Then implement only the #612 minimum GREEN in python/fast_mlsirm/scaling.py: package-owned fixed-width CSR byte ceiling; at most n+1 inner requests; bounded outer/flat/start consumption with checked arithmetic; no unbounded list(ranking); stable non-reflective ordinary iteration failures while preserving process-control exceptions; accepted list/tuple/generator values unchanged into Rust LSR/I-LSR. Add only missing meaningful coverage/docstrings/doctoring/changelog, render/check CHANGELOG, focused scaling/security tests, formatting/lint and git diff --check.

Keep Draft. Do not alter Rust LSR formulas, public result semantics, dependencies/workflows/version/release, canonical docs #604, Ready/approval/merge state, or widen to _top1_to_csr. Stop after one coherent verified branch update; fresh exact-head full CI/Security/SAST/review returns to the maintainer loop.

[seonghobae]

@opencode-agent address

Superseding LSR bounded-materialization handoff after #631 merged. Fresh identities: Draft #614 head 686c9b3004e027eb0e7891e8ef9341530331f273; protected main a7be9eb8ca0b807364173f8471fc300e3cf9350f. Prior handoffs required abort on base movement and are predecessor evidence. Refetch head/main/comments before writing; abort if either moves or another current-head writer appears.

First reconcile protected main non-destructively, preserving both CodeQL 4.37.6 pins and the fail-first plan/tests. Run pytest -q tests/test_scaling_ranking_input_bounds.py and require intended RED at _rankings_to_csr before production work. Then implement issue #612's minimum GREEN only: package-owned fixed-width CSR byte ceiling, at most n+1 inner requests, bounded outer/flat/start consumption with checked arithmetic, no unbounded list(ranking), stable non-reflective ordinary iteration failures while preserving process-control exceptions, and unchanged accepted list/tuple/generator uint64 values/results through Rust LSR/I-LSR. Add only necessary coverage/docstrings/doctoring/changelog and render/check CHANGELOG; run focused scaling/security tests, formatting/lint and git diff --check.

Keep Draft. No Rust formula/public-result/dependency/workflow/version/release/canonical-docs #604/Ready/approval/merge changes and no _top1_to_csr expansion. Stop after one coherent verified branch update; full exact-head CI/Security/SAST/review returns to the maintainer loop.

[seonghobae]

@jules address

Fallback sole branch writer for exact Draft #614 head 686c9b3004e027eb0e7891e8ef9341530331f273 over live protected main a7be9eb8ca0b807364173f8471fc300e3cf9350f. Fresh compare remains diverged, ahead 5 / behind 2, merge base f43a466b1441b27bd2ac4a71be8aa3e4f08c8e8f; the net branch currently contains only the fail-first ranking-bound plan and tests. The latest exact-base OpenCode handoff 5235684691 has no receipt/reaction and has produced no source movement for more than six hours. Treat it as inactive for this bounded fallback. Immediately refetch head/main/comments before writing and abort if either ref moves or any other current writer appears.

First reconcile the two accepted CodeQL 4.37.6 protected-main commits non-destructively. Preserve the intentional RED history and run pytest -q tests/test_scaling_ranking_input_bounds.py; production work is authorized only if failures still reach issue #612's intended _rankings_to_csr boundaries rather than setup/import/fixture problems. Implement the minimum GREEN only: package-owned fixed-width CSR byte ceiling with checked arithmetic, at most n + 1 inner requests, bounded outer/flat/start consumption before NumPy allocation, removal of unbounded list(ranking) or equivalent materialization, stable non-reflective normalization of ordinary caller iteration failures, unchanged propagation of KeyboardInterrupt/SystemExit/GeneratorExit, and byte/numerical parity for accepted list/tuple/generator inputs through the unchanged Rust LSR/I-LSR kernels. Add only meaningful coverage/docstring/doctoring/changelog evidence required by that slice, render/check managed CHANGELOG.md with the repository renderer, and run focused scaling/resource/security tests plus formatting/lint and git diff --check.

Keep Draft and stop source writes after one coherent verified update. Do not touch _top1_to_csr (sequenced issue #632), Rust formulas/public result semantics, dependencies/workflows/version/release, canonical docs #604, Ready/approval/merge state, or create another PR. Fresh exact-head full CI/Security/SAST/review belongs to the maintainer loop.

[seonghobae]

Superseded by clean-lineage Draft #692. Fresh comparison against protected main a7be9eb8ca0b807364173f8471fc300e3cf9350f shows this head 686c9b3004e027eb0e7891e8ef9341530331f273 is diverged (ahead 5 / behind 2) while #692 head 7814561569221789a9ccbcd69da9876add812bf1 is directly ahead of current main and carries the same bounded LSR/I-LSR fail-first plan/tests. No checks, reviews, approvals, or writer authority transfer from this predecessor. Continue issue #612 only through #692; closing this stale branch to remove duplicate writer/merge authority.