llm-ingestion-okf/docs/2026-09-19-bmp-resten-terminator-og-pekerblokk.md

The BMP rest: a terminator, and a claim that has to come from a pointer block

2026-09-19. Two defects PM's checkpoint on c39b666 found in the viewable-asset round, both shipped, both with the default flags. The round that introduced them was judged PARTIAL; this closes the two load-bearing rests and the two small ones. No new format, no new dependency, no version bump and no tag.

1. A truncated RLE8 stream was carried, silently

_bmp_rle8_rows painted what the stream held and left the rest of the frame at palette index 0. That is what the format says about a pixel a delta SKIPPED, so no decoder disagrees — every one of them agrees on the wrong picture. Measured by PM on a real R761 asset, 1631e526275d-7-graphic-0003.bmp, 352x548 = 192 896 pixels:

cut	result
stream truncated to 90 %	carried, 13 923 pixels wrong, no code, no row
to 50 %	carried, 95 890 wrong
to 10 %	carried, 166 525 wrong

The uncompressed path already refused the same shape (asset_samples_invalid, "refusing to pad, because a short buffer means the header was read wrong"). Eval point 6 of the round's own order says "corrupt -> published code, never silent"; this was the one place it did not hold.

The rule, read off the corpus rather than chosen

The order named two candidates — compare available bytes against biSizeImage, or require an end-of-bitmap escape. Measured first, over the 19 real RLE8 assets of the frozen R761 delivery (~/corpora/po-frosne-bundles/ r761-2025-58e1ecca6007/assets, read only):

denominator (RLE8 files): 19
stream reaches an explicit EOB:      19 of 19
the EOB is the stream's LAST 2 bytes: 19 of 19
biSizeImage == available bytes:      19 of 19
bytes after the EOB:                 Counter({0: 19})

Both candidates are satisfied by every real file, so the choice is made on what each MEANS. biSizeImage is a claim by the same untrusted header that declares the size; the terminator is a statement inside the data that the picture is complete. A third candidate, requiring every pixel to be painted, is wrong by construction: it would refuse the delta escape the format defines. So the decode may end at an explicit end-of-bitmap and nowhere else, and a stream that runs out first is refused with asset_samples_invalid.

A stream that is WHOLE but omits the terminator is refused alongside a cut one. From a reader's side they are the same bytes, and the measurement says no writer in this corpus produces the first.

Nothing real changes hands

The same 19 files still convert losslessly after the rule: 19 of 19, 2 366 365 pixels compared — PM's own figure, re-measured here with stdlib on BOTH sides (an independent BMP reader and an independent zlib + filter-reversal PNG decoder, no Pillow anywhere), with a one-byte control proving the comparison can fail.

The guard in the suite is pinned to a decoder written in the test file, which computes what each cut costs: 8, 11, 17, 0 and 0 of 32 pixels. Two of the five cuts lose no pixel at all, which is the whole reason the rule has to be the terminator and not a pixel count.

2. The judge's new route could be forged by the document

asset_holds gained a second route in the viewable-asset round, because a converted image's own bytes are not in assets/ and never will be. It reads the two digests the bundle states on the pointer line — with an expression that ran over the WHOLE bundle text. So a document could write the sentence itself. Measured by PM, and reproduced here before any code moved:

the 50000x50000 BMP was REFUSED and is not in assets/: True
judge asset_holds(refused BMP) = True          (via the image's alt text)
forged via PLAIN BODY TEXT -> asset_holds(refused BMP) = True

Before that route existed, asset_holds hashed the source file and looked in assets/ — nothing a document wrote could reach it. The gate's own first sentence is THE FASIT NEVER COMES FROM THE READER IT JUDGES, and claimed and not found had become something a document could ask to have silenced.

Two halves, and neither is sufficient alone

The judge reads the clause only from inside a pointer block — the markdown image line plus the detail line under it — and only where the clause names the asset that block points at. That closes ordinary body text and a table cell. It cannot close an image's own alt text, because a LABEL is document text that the build writes INSIDE a pointer block.

The door is assets._inline, and this is where the boundary runs: everything it returns came from the document (an alt attribute, an STS caption, a publisher's file name); everything render_block appends after it came from the run (the size it measured, the type it sniffed, the digests it computed). The second line carries both, so document text may not emit the metadata grammar the run writes there. A checksum field is disarmed: the digits are kept, because a reader is owed what the document said, and the colon that makes them a FIELD is not.

The mutants, and one finding about the harness

Three mutants in tools/okf_gate_mutants.py, one per check, each felled by its own arm: the pre-round _conversions restored verbatim (X3), the asset-name tie dropped (X4), _inline's disarming dropped (X5).

X5 survived 112 green tests on its first run, and had never been applied. The harness copies the tree and runs pytest in the copy with the venv's interpreter — which carries an EDITABLE install pointing at the working tree, so import llm_ingestion_okf in the copy resolved to the original src/. The subprocess now gets the copy's own src/ on PYTHONPATH, which wins over the editable finder, and X5 dies on the first run under it. The gate and the witness were never affected: the suite reaches those through the copy's own tools/.

killed 39 of 39, exit 0 (36 before this round).

3. Two small rests

The judge proves carriage, not fidelity. PM's M10: a mutated converter writing a BLANK PNG gives asset_holds = True, because the bundle is internally consistent — the digest it claims to have written really is the asset's digest. The suite fells that mutant by decoding both sides; the gate cannot. The docstring now says so, and the limit is asserted in BOTH directions: a test shows the blank PNG is accepted AND that the docstring names the gap. Teaching the judge pixels is a different job.

The lossless guard now runs on a core install. It decoded through Pillow, which this package neither uses nor ships and which arrives only as a transitive dependency of pdfplumber under [extract]. Measured by PM on a core environment: 4 of the 13 guards in tests/test_asset_viewable.py were SKIPPED, the lossless one among them, so a plain pip install llm-ingestion-okf never measured the property the round is named after. The new arm decodes the carried PNG with zlib and the five PNG SS 9.2 filters and compares against pixels written out in the test file, over read_image and over what the BUILD wrote. The environment is MADE rather than assumed: a sys.meta_path finder raising for every PIL name, with a known-positive that it fires. Control, run once and not committed: a Pillow-dependent line placed inside the blocked section turns the guard red.

4. Two checks this round introduced and then removed

Both were measured and found unkillable, and a guard nothing can fell is not a guard.

• The end-of-line anchor on the judge's clause expression. With the pointer-block route and the asset-name tie in place, the only case it covers is a label forging a clause inside a block that also carries a real one — which _inline makes unreachable from a document. The whole gate suite is green without it.
• The length check on a short absolute run in _bmp_rle8_rows. Unobservable by construction: a run shorter than its declared count means the stream ran out, so the loop cannot reach an end-of-bitmap afterwards and the picture is refused either way. Measured in a scratch copy, both directions: 95 passed with the check, 95 passed without it, so the mutant that removes it SURVIVES. The order asked for that mutant; this is the answer to it.

A fifth cut replaces them and makes an existing bound load-bearing: a stream cut in the middle of a delta escape, 17 of 32 pixels wrong. Without the two-byte bound in that branch it raises IndexError instead of a coded refusal.

5. What this round did NOT measure

• The 43-document reference corpus was not rebuilt. The accounting gate's rows are unchanged (GATE RED: rows 2, 3, 6, row 3 identical at u = 19, d = 2, 17 of 22) — the operator-accepted losses of 2026-09-17.
• No R761 end-to-end build was run this round; the 19-file lossless measurement is over the frozen delivery's own assets, which is the input that half of the build.
• 16 JPEG 2000 objects are still lost with a line in the concept, and WebP is in the viewable set while sniff does not recognise one. Both are stated limits from the previous round and neither moved.