fix(release): v0.64 cold-review corrections — retract a fabricated attribution, state the selector growth

[avrabe]

v0.64 cold-review corrections — before the tag

The clean-room review found six things wrong or overstated in the release I
wrote. Correcting them here is what the review is for.

1. Retracted: a fabricated attribution (severity 1)

I closed #1108 (z3 0.20.2→0.21.0) as "breaks the required Bazel build",
attributing it to z3-sys linking the system libz3 — and made it the release's
only evidence that the dependabot hold has ever caught a breaking bump.

The mechanism was impossible. crates/BUILD.bazel:167-170:

Default feature set (#553): pure-Rust ordeal QF_BV engine + arm semantics —
no z3-sys / C++ build in the Bazel graph.

The real failure was a 504 Gateway Time-out fetching bazel-skylib. Bazel
compiled nothing; the log contains zero occurrences of "z3"; it was never
re-run. "Three siblings on the same base" was also wrong — their merge-bases
differed.

How I got there matters more than the fact. The job logs were unretrievable
through the API, and instead of recording unattributable, needs a re-run, I
reasoned from the job's name plus a plausible mechanism and wrote it up as
measurement. This repo's "read the failure name, not the count" rule extends to
the failure's content — and when that's unavailable the answer is "unknown",
not an inference. The bump is neither exonerated nor convicted; sent for recreate.

2. The subtraction metric moved the wrong way, unstated

selector_lines_code 19227 → 19740 (+513) against a baseline that must
fall. Every increment carries a written waiver, but the direction is the
direction — now stated in the notes, as v0.59 did.

3. Mach-O claim narrowed

ObjectPlan does not carry symbol binding — elf.rs hard-codes
STB_GLOBAL, macho.rs marks N_EXT independently. So "the structural answer
to #1180" was an overstatement, #1180 being precisely binding. The module count
is now derived (144 here) instead of appearing as three different undated
figures (140/141/144) — in the release that named that defect class.

4–5. Internal contradictions

RQ-64-DEPS landed: still said the artifact stays proposed while its status
was implemented. SCOPEGAP's two populations disambiguated: 23 undated
citations across 13 artifacts flagged, of which 9 are the named shape.

6. The new gate had no tests

check_live_floor_prose shipped with zero unit tests — its red-first was a
one-time manual transcript, and a transcript is not a test. Shipping that rule
unchecked is the defect the rule describes.

Five added, in the file's own unittest style so CI actually runs them — a
pytest-style first draft would never have executed, which would have been the
same class again. Mutation-verified:

mutation	result
drop the hit collection	FAILED (1)
blinded rule returns clean instead of failing	FAILED (1)
restored	77/77 OK

Verification

77/77 tests · status_evidence exit 0 · claim_check 62/62 · rivet at the
cross-repo baseline with 0 broken cross-refs.

Refs #965, #910, #242, #1085

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!