docs/cultnet-selection-cut.md, Self's rulings for fix batch 3 (2026-09-22),
the Rust-owned share:
- R-N: cultnet.error.v0 gains additive code/details fields. SelectionRefusal
now maps to a wire code (selection_invalid, cursor_stale, cursor_invalid,
reference_outside_target) and a flat string-map details payload via
to_wire_message(); the legacy array wire (gamecult.networking.v0) has no
slot for either and never carries them, matching v0 peers ignoring them.
- R-O: the snapshot cursor is keyed. CursorKey is a random 32-byte
per-process key; Cursor::mint/compute_digest now take it and use
HMAC-SHA256 instead of plain SHA-256, so a cursor forged without the key,
or minted under a different process's key, is refused cursor_invalid.
Cursor::parse stays public and decodes as_of without the key (Huginn's
dependency); only verify_digest (called from select()) needs it. The
cursor body itself is now length-prefixed fields, not a delimiter-joined
string, so a record key carrying any character - including the pre-fix
C# delimiter U+241F - round-trips.
- R-T: matches_citation (the `cites` path) now checks every one of a
citer's edges against its declared target before applying the
citation's own role/key filters, closing F15: a corrupt edge used to
hide behind an unrelated filter and never get validated.
- The retired Rust mutation harness entries file
(scripts/mutate-cultnet-selection-rust.entries.ps1) is deleted; tests
pin the behaviour directly.
Regenerated contracts/cultnet/interop/selection-vectors.rs-written.json
from the shared fixture; it is byte-identical to what was committed, so
R-T's fix does not change any existing fixture vector's outcome. The Rust
reader still evaluates every vector in the committed cs-written.json
(15/15) unchanged - that file predates the parallel C# Hands' R-N/R-S
work and was not touched here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5cf31d1e87