docs: the BMP rest, the terminator and the pointer block

CHANGELOG under the UNTAGGED `[0.10.1]` -- no version bump, no tag. Three
entries: the forged carry under Security, the truncated RLE8 under Fixed, and
the two small rests (the judge's fidelity limit, the lossless guard's core
arm) under "Documented, not changed".

The report carries the measurements with their denominators, including the two
checks this round introduced and then REMOVED after measuring that no mutant
can fell them -- with the numbers for each (the gate suite green without the
line anchor; 95 passed with and 95 without the length check, so the mutant the
order asked for survives).

CLAUDE.md records both defects and both rules where the viewable-asset
paragraph already stands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -1055,6 +1055,32 @@ and fixtures, never code.
   elements, and the gate's verdict is the same `RED: rows 2, 3, 6` as before
   the round. Report:
   `docs/2026-09-19-hvert-baaret-bilde-kan-vises.md`.
+  **THAT ROUND SHIPPED TWO DEFECTS AND 0.10.1 CLOSES THEM.** A TRUNCATED RLE8
+  stream was carried as a partly blank PNG: the decoder painted what the
+  stream held and left the frame at index 0, which is what the format says
+  about a SKIPPED pixel, so no decoder disagreed -- measured on a real R761
+  asset of 192 896 pixels, a stream cut to 90 % was carried with 13 923 pixels
+  wrong, to 50 % with 95 890, to 10 % with 166 525, no code and no row. The
+  decode may now end at an explicit **end-of-bitmap escape and nowhere else**
+  (`asset_samples_invalid`, the code the uncompressed path already uses), and
+  the rule is the terminator rather than `biSizeImage` -- a claim by the same
+  untrusted header -- or a coverage count, which would refuse the delta the
+  format defines: over the 19 real RLE8 assets **19 of 19** end at an explicit
+  EOB, on **19 of 19** it is the last two bytes, and on **19 of 19**
+  `biSizeImage` equals the available bytes, so the same 19 still convert
+  losslessly, 2 366 365 pixels, now with stdlib on BOTH sides. And the JUDGE's
+  new conversion route could be **FORGED BY THE DOCUMENT**: it read the two
+  digests out of the WHOLE bundle text, so a BMP refused `asset_too_large` and
+  absent from `assets/` was reported as held, through an image's `alt` text
+  and through ordinary body text alike. The claim now counts only inside a
+  POINTER BLOCK this code wrote and only where it names that block's own
+  asset, and `assets._inline` disarms a checksum field in anything that came
+  from the document -- **the boundary is that everything `_inline` returns
+  came from the document and everything `render_block` appends after it came
+  from the run**; neither half is sufficient alone. The gate proves CARRIAGE
+  and not FIDELITY, which its docstring now states: a converter writing a
+  blank PNG is accepted, the suite fells that mutant and the judge cannot.
+  Report: `docs/2026-09-19-bmp-resten-terminator-og-pekerblokk.md`.
 - **Account for content: `okf build --accounting PATH` and its judge
   `python3 tools/okf_accounting_gate.py` (2026-09-17).**
   - The gate was written RED at `0b00de4` and turned GREEN on all six rows by