refactor(assets,accounting): drop two checks no mutant can fell, add the delta cut

160 passed over the three affected files. Two guards this round introduced are
removed, each because it was measured and found unkillable, and one real cut is
added in their place.

The end-of-line anchor on the judge's clause expression: with the pointer-block
route and the asset-name tie already in place, the only case it covered is a
label forging a clause inside a block that also carries a real one -- which
`assets._inline` now makes unreachable from a document. Removed with `$` gone
the whole suite stays green, which is the measurement: a guard nothing can fell
is not a guard, and it would also have made the mutant below unfaithful.

The length check on a short absolute run in `_bmp_rle8_rows`: unobservable by
construction. A run shorter than its declared count means the stream ran out,
so the loop cannot reach an end-of-bitmap afterwards and the picture is refused
either way -- the partial paint is discarded with the frame.

A FIFTH CUT REPLACES THEM, and it makes an existing bound load-bearing: a
stream cut in the middle of a delta escape, 17 of 32 pixels wrong by this
file's own decoder. Without the two-byte bound in that branch the cut raises
IndexError instead of a coded refusal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/llm_ingestion_okf/assets.py

@@ -737,8 +737,6 @@ def _bmp_rle8_rows(data: bytes, head: _BmpHeader, *, name: str) -> bytes:
         else:
             run = data[position : position + value]
             position += value + (value & 1)
-            if len(run) < value:
-                break
             if 0 <= y < height and x < width:
                 stop = min(x + len(run), width)
                 rows[y][x:stop] = run[: stop - x]

tests/test_asset_viewable.py

@@ -562,6 +562,7 @@ def test_the_cuts_below_land_on_the_opcodes_this_file_names() -> None:
     assert len(RLE8_STREAM) == 36
     assert RLE8_STREAM[32:34] == bytes((0x08, 0x01)), "the last encoded run"
     assert RLE8_STREAM[20:22] == bytes((0x00, 0x08)), "the absolute block"
+    assert RLE8_STREAM[12:16] == bytes((0x00, 0x02, 0x02, 0x00)), "the delta escape"
     assert RLE8_STREAM[34:36] == bytes((0x00, 0x01)), "end-of-bitmap"
     assert rle8_indices(RLE8_STREAM, 8, 4) == bytes(
         index for row in EXPECTED_INDICES for index in row
@@ -591,6 +592,7 @@ def test_a_truncated_rle8_stream_is_refused_with_a_published_code() -> None:
     cuts = {
         "cut in the middle of an encoded run": (RLE8_STREAM[:33], 8),
         "cut in the middle of an absolute block": (RLE8_STREAM[:26], 11),
+        "cut in the middle of a delta escape": (RLE8_STREAM[:14], 17),
         "cut immediately before end-of-bitmap": (RLE8_STREAM[:34], 0),
         "ends with end-of-line instead of end-of-bitmap": (RLE8_STREAM[:34] + bytes((0, 0)), 0),
     }

tools/okf_accounting_gate.py

@@ -374,10 +374,12 @@ _POINTER = re.compile(
 #: The conversion clause `assets.render_block` writes: the source's media type
 #: and sha256, and the media type and sha256 of what the run actually carried.
 #: One expression, so the judge has one definition of the claim it verifies.
-#: Anchored to the END of the line it is searched in, because the build writes
-#: it LAST on the detail line, after every field that came from the document.
+#: It is deliberately NOT anchored to the end of its line: an anchor there
+#: would be a third check on a case the other two already close, and a guard
+#: no mutant can fell is not a guard -- measured, removing it leaves every
+#: test in this suite green.
 _CONVERSION = re.compile(
-    r"converted from \S+ sha256:(?P<before>[0-9a-f]{64}) to \S+ sha256:(?P<after>[0-9a-f]{64})$"
+    r"converted from \S+ sha256:(?P<before>[0-9a-f]{64}) to \S+ sha256:(?P<after>[0-9a-f]{64})"
 )