# The pointer block, bound to the run

2026-09-19. PM's checkpoint on `ae441ab` judged the previous round PARTIAL
with one load-bearing rest and two small ones. The rest is the same class the
round before it: the judge's fasit came from the reader it judges. It had been
narrowed, not closed. This closes it, closes the two small ones, and clears
three further residuals PM had listed. No new format, no new dependency, no
version bump and no tag.

## 1. A form is not a signature

`tools/okf_accounting_gate.py` read the conversion claim out of the bundle
text. The round before bound it to a POINTER BLOCK, which is the two lines
`assets.render_block` writes:

```
![<label>](/assets/<sha12>-<name>)
Image: <name> (<w>x<h> px) -- converted from <type> sha256:<A> to <type> sha256:<B>
```

That closed the two routes PM had measured (an `alt` attribute and plain body
text) and left the class open, because a document can write the whole block.
Reproduced here through the real `okf build`, three ways, each a whole build:

| way | before | known-positive in the same build |
|---|---|---|
| two `<p>` elements in one HTML file | **forged** | held |
| one `<p>` with a `<br>` | **forged** | held |
| a markdown note beside the HTML carrier | **forged** | held |

"Forged" means `asset_holds` returned True for a BMP declaring 50 000 x
50 000, refused `asset_too_large`, absent from `assets/`. The forger needs two
digests: the one it wants vouched for, and one of a picture the bundle really
carries — public in the bundle, and computable in advance for a PNG carried
verbatim.

### What was chosen, and why

Two fixes were on the table. The claim is now read from the RUN's own ledger:

- `assets.conversion(image)` names the `(source digest, asset digest)` pair.
- `DocumentAssets.conversions` carries it out of the run.
- `DocumentAccount.conversions` books it, and `okf build --accounting` writes
  `conversions: [{from, to}]` per document.
- `_declared_conversions` reads that file; `_conversions` believes a pair only
  when the ledger holds it AND a pointer block confirms it for the asset it
  points at.

The confirmation can be forged and the ledger cannot, which is why the ledger
decides. The alternative — neutralising pointer-shaped text at extraction, the
way the soft-hyphen door neutralises U+00AD — was felled: it changes what every
document SAYS in order to defend a tool outside the build, a source quoting a
bundle listing would come out altered, and the bytes of existing bundles would
move. This reads a file the run already writes.

A build with no accounting door has no ledger. A converted image is then
reported claimed-and-not-found rather than believed, which is the reading the
gate had before the conversion route existed, and it is visible in the row.

### After

3 of 3 forged → refused, with the known-positive True in all three. The
text-level regression guard goes from 3 arms to 13: PM's eleven ways that the
shape anchoring already refused, kept so a later narrowing cannot widen one of
them, plus the two forms that defeated it — a perfectly written pointer block
the run never booked.

R761 rebuilt from the frozen delivery: bundle `diff -r`-identical to the build
before the change, 50 assets (29 JPEG + 21 PNG, 0 BMP), 19 of 19 conversions
confirmed against 19 declared, soft hyphens 71 → 0, u = 0, d = 0, exit 0.

## 2. A terminator is not a coverage proof

The previous round's terminator rule asks only that a stream SAY it is
finished, and a stream may say so anywhere. Measured: a stream whose FIRST two
bytes are the end-of-bitmap escape was carried, with 32 of 32 pixels never
decoded and all of them palette index 0. Pillow refuses the same file.

`_bmp_rle8_rows` now also requires the cursor to stand at or past the end of
the last row, refusing with the same `asset_samples_invalid` otherwise.

**The line is the cursor, not the pixels.** A delta escape and an end-of-line
escape STATE their skip, so the pixels they pass over keep index 0 and every
decoder produces the same picture; a pixel-coverage count would refuse both
constructions the format defines. The corpus cannot choose between the two
rules — over the 25 RLE8 BMPs the R761 delivery ships (24 distinct; the bundle
carries 19), 25 of 25 paint every pixel, 25 of 25 reach the end of the frame
and 0 of 25 use a delta. An independent decoder can:

| stream over one 8x4 frame | cursor reaches the frame | Pillow |
|---|---|---|
| end-of-bitmap before one pixel is decoded | no | refuses |
| one 4-pixel run, then end-of-bitmap | no | refuses |
| last row one pixel short, no end-of-line | no | refuses |
| every row painted and closed | yes | reads |
| last row one pixel short, then end-of-line | yes | reads |
| a delta skipping a whole row | yes | reads |
| last row painted to its end, no end-of-line | yes | reads |
| the shipped fixture, which uses a delta | yes | reads |

Eight of eight agree with the new rule, and a second test holds Pillow to the
table so it is not our own rule restated.

Both docstrings PM named are rewritten. The test no longer says "NO PIXEL MAY
BE GUESSED: either every one of them is decoded from the stream, or the picture
is refused" — that was false as measured. `_bmp_rle8_rows` no longer frames the
delta argument as read off the corpus, which it never was: 0 of the 25 files
use a delta, so the corpus had nothing to say about it.

## 3. One number, read from one place

`assert sum(tbx.values()) == 568` sat behind a `skipif` on a delivery only this
machine has, so on a fresh clone the sentence five files publish was unguarded
again — the state in which 574 survived in four docstrings until PM counted it.
`N101_TBX_TAGS` is now the one place the number lives, and a second test reads
the published sentence out of `CHANGELOG.md`, `CLAUDE.md`, `tools/okf_witness.py`,
`tests/test_accounting_gate.py` and this round's predecessor report, holding all
five to it. It needs no corpus and no clock.

It was red at birth, and for a reason worth keeping: the scan read the test
file's own known-positive string (`574`) as a sixth publisher. That string is
now assembled from pieces, and the failure is the demonstration that the scan
reads what it is pointed at. What the guard does NOT prove is stated in its
docstring: five files agreeing is agreement, not a count. The measurement stays
where it was.

## 4. A clean extract is not a checkout

`test_the_four_existing_goldens_are_untouched` ran `git status` with
`check=True` in a `git archive` extract and raised `CalledProcessError`. It was
the single failure of the whole suite run from a clean extract, twice reported
as a round's one failure by a round that had not touched the file. Both arms
measure the checkout with `git`, so an extract has nothing to ask: it now skips
with the reason stated, and a checkout still has to answer.

## 5. The mutant runner

`tools/okf_gate_mutants.py` could only run one test file, which is why PM's
three survivors from `43331fc` could not be added: two are held by the gate's
row 3 and one by the soft-hyphen door's own suite. A mutant now names the suite
it is judged by, and the catalogue goes 39 to 45:

- **X3** and **X4** were rewritten against the code as it now stands. A mutant
  table is a copy of the code it mutates, and this round moved the lines both
  of them quoted.
- **X6** is the defeated state exactly: a pointer block believed without the
  run having booked it.
- **X7** cuts the ledger off at its source.
- **X8** removes the cursor rule.
- **P6**, **P11**, **P12** are PM's three, now held by what runs AS the gate.

Two survivors appeared on the first run and both were findings.

**X4** — "the claim need not be about the asset its block points at" — survived
because every forgery arm now fails on the ledger check before the binding is
reached. An arm was added where the run DID book the pair and the block stating
it points at another picture; under the mutant that reads as a carry.

**X5** — "a document-supplied label may emit a checksum field" — survived the
WHOLE suite, measured: 2134 passed with the disarming removed. The gate no
longer reads its claim out of the bundle, so a document-supplied field cannot
reach it. The property did not stop mattering — the line stands in every
concept body, and a bundle must not state a conversion in a sentence the run
did not write — so it is measured where it lives, in `tests/test_assets.py`,
and the mutant is judged there. Deleting an unfellable guard was the other
option and was felled: this guard is about the bundle, not about one judge.

## 6. What this round does not do

- It does not teach the gate FIDELITY. A converter writing a blank PNG is still
  accepted, for the reason `asset_holds` states: both routes ask whether a file
  holds the bytes the run names, and neither decodes a pixel.
- It does not touch the guard, the goldens, the proposer, any profile, any
  version or any dependency.