SPATIAL-3A: exact orthogonal geometry

[gunbai-bot]

Stacked on #8156 (base is spatial-2b-carried-frame-identity, not main) — it consumes the carried CoordinateFrameIdentity. Retarget to main once #8156 merges.

Scope

Everything here is closed under integer millimetre arithmetic — no roots, no trigonometry, no rounding policy. That is why this band sits before an approximate-numeric realization rather than after it: rectilinear architectural geometry is exactly representable, so it is represented exactly, and the layer that needs a real number pays for it there.

Carriers: Axis2/Axis3, AxisAlignedSegment2, AxisAlignedRectangle2, Plane3, AxisAlignedBox3, BoundingBox3, OrthogonalLoop2, AxisAlignedSurface3, OrthogonalPrism3, OrthogonalRotation3.

The walls are construction, not validation

Every carrier is sole_constructor, so its record literal cannot be written and no cast reaches it from another module. The only route to a value is the mint beside it, and the mint refuses. A degenerate segment, an unclosed or self-intersecting loop, a zero-extent box and a cross-frame composition have no constructor outside this module — DESIGN §4b rung four, rather than a check a caller might not run.

The 24 rotations are 24 by construction

A rotation is fixed by the images of +X and +Y — six choices, then four perpendicular ones. +Z is derived as their cross product, so orientation-preservation isn't a determinant check that rejects reflections: a reflection has no representation. Enumerating 24 variants would be a table to get wrong once and maintain forever; storing three images concedes the reflected state is writable.

What is deliberately absent

No polygon Booleans. Union, intersection and difference are absent — not stubbed, not approximated. Rectilinear Booleans need a sweep with a canonical output ordering and a touching-edge degeneracy policy, and inventing that policy under the name union is how a plausible wrong region reaches a consumer.

OrthogonalSegment2 and OrthogonalSurface3 are not minted, and that's recorded in-module rather than silently omitted. In 2D an axis-aligned segment and an orthogonal segment denote the same set, as do an axis-aligned rectangle and an orthogonal surface in an axis-perpendicular plane. Minting both spellings forks one concept across two authorities (§3). A rotated rectilinear loop is a genuinely different concept and would be an OrthogonalLoop2 plus an OrthogonalRotation3, not a second segment carrier.

Evidence

Eight witnesses, green by execution. Every negative control has a positive sibling in the same witness — a mint that refused everything would satisfy the refusal half of each pair, and that is precisely the gap that let SPATIAL-2 ship a wall which did not exist.

Two controls earned their keep by failing first:

• The orientation control asserts a derived z-image rather than merely that construction succeeded — and caught a sign inversion that made the identity rotation X × Y produce NegativeZ, i.e. left-handed.
• The self-intersection control is a figure-eight whose eight edges are all axis-aligned, all adjacent pairs perpendicular, and no vertex repeated. Nothing local to an edge distinguishes it from a valid loop, which is why the pairwise non-adjacent edge test exists rather than a repeated-vertex check standing in for it.

Boundary convention, asserted rather than commented: touching faces are adjacent, not overlapping. Two rooms sharing a wall plane must not report as a collision.

Gate note

The ruling's resume condition 1 — "resolved direct calls reject wrong nominal identities and wrong applied arguments" — was proven infeasible at that seam and withdrawn; see #8157 for the measurement (976 false refusals, and the finding that Node.children at the argument seam holds fields and variants, not applied type arguments). Conditions 2 and 3 hold: the differential is classified and the runtime frame controls are green. This band therefore rests on #8156's checked-derivation guarantee alone, consistent with "static call-argument refusal is an additional wall, not the sole authority."

[gunbai-bot]

All three findings verified against the code and fixed in b4d75cc275 — none were declined.

Unreachable refusal variants (review 51202). Confirmed: LoopNotClosed and SurfaceNotInPlane were declared and emitted by no mint. Closure is structural (the last vertex connects to the first by construction, so there is no unclosed loop to reject) and a surface is a Plane3 plus a 2D rectangle, so non-coplanarity has no representation either. You're right that this is rung inflation on the refusal sum — a consumer reads an unreachable arm as a live failure mode and writes a handler for a state nothing produces. Both deleted, with the reasoning kept as a comment beside the loop walls so the next author doesn't re-add them.

Duplicated note (review 51202). Confirmed and deleted. DESIGN §4c is explicit that a String declaration whose sole purpose is commentary is misplaced or dead data, and it was a second copy of the decision in the // block directly above it. The comment stays; the row is gone.

in_plane_axes (review 51199). Deleted. It was unused, and you were right that it was wrong as well as dead — plural name returning a single axis, and the Y-normal case returned only Axis3X.

The loop scan (review 51199) — measured worse than reported, and fixed rather than deferred. You flagged any_nonadjacent_edges_touch as O(n²) inside an O(n) fold. The re-indexing made it worse than that: loop_vertex_at was vertices |> skip(i) |> first, linear in i, so each linear pass was quadratic and the pairwise test was cubic. Edges are now materialised once in a single linear pass (accumulator carrying the previous vertex; cons-then-reverse, since concat(list, [x]) is itself quadratic), and perpendicularity is read off consecutive edges in one pass carrying the first edge's axis so the closing pair needs no re-indexing. The pairwise comparison is inherently quadratic and stays — that is the algorithm, not a defect.

On "fine for architectural n": DESIGN §6's bare-minimum-cost rule rejects that reasoning explicitly — a proven quadratic fold is always fixed regardless of realized n, because "n is small here" is not time-stable under reuse. So it was worth doing on the repo's own terms, not just prospectively.

All eight witnesses re-run green after the rework.

— sent from deep-fox-168

[gunbai-bot]

Fixed in 916f156551 — deleted the second copy of point2_x, point2_y, point2_same_position. review 51210 is correct on all three.

Provenance, since it says something about the substrate: an earlier splice of mine over-deleted a run of helpers; when I restored them I re-added three that had actually survived. A duplicate-declaration scan over the module now returns empty, and all 8 witnesses in orthogonal_geometry_witness_test.dag stay green.

One correction to the review's premise, worth recording rather than letting stand: "this should fail compilation" — it does not. A duplicate top-level declaration does not refuse in this substrate; that is a known gap, and it is exactly why this reached review instead of failing locally. The duplicate was invisible to every mechanism I ran.

— sent from deep-fox-168

[gunbai-bot]

All three findings in review 51213 are real and are fixed in c1d3300c1e — by construction in each case, not by adding a refusal arm.

Prism extrusion axis. Correct: any Axis3 was accepted once the height was positive, and an XY footprint extruded along X is geometrically undefined. Rather than refuse a non-Z argument, the parameter and the field are deleted. OrthogonalLoop2 is a loop of Point2 whose components are the frame's X and Y, so Z is the only axis it can be extruded along — the invalid state now has no representation (DESIGN §5, rung four rather than rung two).

Surface plane. Same class, same fix: the plane is derived from the extent's frame at the given offset instead of supplied beside it. The frame-mismatch arm went with the parameter, since there is now one frame in play — I replaced the then-dead cross-frame clause with a control that pins the new property (Z-normal, right offset, extent's frame), and confirmed it discriminates by minting with Axis3X and watching it red.

Worth stating plainly since it is a real narrowing: this mints XY-plane surfaces only. A genuinely X- or Y-normal surface needs a 2D carrier that records which plane its coordinates span. The Plane3 parameter did not deliver that generality — it silently mis-delivered it — so removing it loses nothing that was actually correct. The dissolve-on is recorded in-carrier.

AxisDirection3 helpers. Correct §3 fork; moved. Axis3 had to move with them, because AxisDirection3 is Axis3 crossed with a sign — leaving Axis3 in orthogonal_geometry would have left the helpers unable to import the type they decompose. They are now one authority in std.euclidean_geometry.

Eight witnesses green. Four in-body annotations this work had introduced are hoisted (33 hard diagnostics, down from 37; none of the remainder are in these files).

— sent from deep-fox-168

[gunbai-bot]

Took the non-blocking note in review 51225 rather than leaving it — 68c4a88e3e.

axis_aligned_surface3 now returns AxisAlignedSurface3 directly. The review excused the decorative wrapper as consistent with its siblings, but the siblings genuinely refuse, and there is no generic consumer that the uniform shape buys anything for — so the wrapper was advertising a refusal no arm can produce, which is the same rung inflation on the shape that the deleted LoopNotClosed/SurfaceNotInPlane arms were on the sum. Every caller was paying a match for an arm that cannot arrive.

The witness's success arm is now a direct read of the minted surface rather than a tautological OrthogonalReady => true, and it discriminates: expecting 4001 mm reds it.

Eight witnesses green.

— sent from deep-fox-168