S-1 is not closed. R-V became two different rules: C# resolves an edge's
target by record key plus the declared leaf set, Rust by an exact schema-and-
key lookup. They give opposite answers on the exact shared-key shape the
ruling was written for, and no vector covers it because the fixture has no
duplicate keys at all. That is why it survived four passes.
Both runtimes fault on an attacker-supplied cursor, on mirror-image inputs.
C# overflows an int and lets an untyped exception reach the server's poll
loop; Rust overflows a usize and panics. Each holds exactly the hole the other
closed, which is what happens when a rule is hardened twice independently and
neither run is fed garbage.
R-Z was neither done nor reported as outstanding. I recorded batch 4 as
closing its rulings without checking that one, so the tracking failure is
mine. It also cannot be built as written: the two runtimes have no common
wire type for a page, so the comparison needs a shape decision first. I have
ruled one and flagged it for review rather than letting the vectors harden
around an unexamined choice.
Two further findings worth the pass. The Rust vocabulary has 59 live mutants
nobody has looked at, and about 35 of them sit on canonical_number, whose door
survives every branch mutation: the byte-for-byte parity rule is pinned by
nothing in Rust while the C# side was blocked at 66% over the same class. And
Soul settled the out-of-bounds read I had ruled most urgent: it is not a
defect, the mutant was a coverage gap.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9c588f87af