feat(variation): execute localized joint torque offsets

AGENT_HANDOFF.md

@@ -3,6 +3,101 @@
 > **Update this file with every PR and every push to main.**
 > Last updated: 2026-08-12
 
+## 2026-08-12 Localized torque static-gate closure (#4142)
+
+The final cumulative changed-source MyPy blockers are closed without runtime
+changes: `dataset_io.read_csv` explicitly types its NumPy input/success arrays,
+and the Rate pipeline removes a redundant `SwingSource` cast around the already
+typed source factory return. The source factory also relies on the validated
+`DoublePendulumRunConfig | None` narrowing instead of recasting its non-`None`
+branch. SPEC change-log rows 1.16.55 through 1.16.58 restore the monotonic audit
+trail without replacing any mission text. The exact pinned Python 3.12 / MyPy
+1.13 16-file delta command, 147 focused localized tests, Ruff, formatting, and
+diff checks pass. UI, Rust, protected-publication, and #4142 completion gates
+remain open.
+
+## 2026-08-12 Source execution/dataset discriminator hardening (#4142)
+
+The source factory no longer uses `run_config or default`. It validates the
+raw value as `None` or `DoublePendulumRunConfig`, then defaults only the exact
+`None` case. Manual and triple-pendulum sources reject prescribed mode/profile,
+joint locks, and localized offsets while preserving explicit or implicit
+default passive empty execution.
+
+The outer variation-dataset JSON schema version now requires a genuine
+non-Boolean integer before normalization. Boolean, float, and string lookalikes
+fail closed, consistent with the strict nested plan and sibling Morris reader
+contracts. Evidence is 34/34 focused and 1,483/1,483 broader shared-swing,
+variation, and Rate tests, with one expected missing-Rust-wheel skip. UI, Rust,
+protected-publication, and #4142 completion gates remain open.
+
+## 2026-08-12 Localized torque source/wire hardening (#4142)
+
+The Rate source factory now enforces the same double-pendulum-only capability
+already declared by `SimulationConfig`: manual and triple-pendulum source
+discriminators reject non-empty localized torque commands instead of silently
+discarding them. `DoublePendulumRunConfig` validates the raw command collection
+before tuple normalization, guaranteeing typed contract failures for `None`
+and other malformed collection domains.
+
+`VariationPlan.from_json_dict` no longer coerces its schema discriminator with
+`int(...)`; only a genuine non-Boolean integer may select supported v1/v2
+behavior. Regression evidence is 102/102 focused and 1,464/1,464 broader
+shared-swing, variation, and Rate tests, with one expected missing-Rust-wheel
+skip. The broader UI, Rust, protected-publication, and #4142 completion gates
+remain open.
+
+## 2026-08-12 Localized torque adversarial corrections (#4142)
+
+The affected localized variation and helper seams now fail closed on their raw
+numeric domains. `NoiseSpec`/`VariationPlan` fields reject Boolean, string, and
+nonfinite values without coercion while preserving ordinary JSON integer/float
+plans and v1 migration. Localized helper functions validate command
+collections, base torque pairs, sample times, and durations with typed contract
+errors.
+
+One canonical fixed-step helper computes the effective RK4 duration used by
+Rate request validation, `SimulationConfig`, source construction, and fallback
+trace-grid construction. A locus inside the requested duration but outside the
+rounded integration grid is therefore rejected during request construction,
+not during a trial. The current PyQt variable picker hides
+`localized_torque_only` entries until a locus editor exists; loading such a
+plan remains fail-closed and atomic with an explicit locus-editor message.
+
+Local evidence is 118/118 correction-focused tests and 1,455/1,455 broader
+shared-swing/variation and Rate tests, with one expected missing-Rust-wheel
+skip. PyQt/React locus authoring, Rust parity, complete raw persistence,
+protected publication, and #4142 completion remain open.
+
+## 2026-08-12 Localized double-pendulum torque execution (#4142)
+
+Local child `codex/4142-localized-double-torque-core` starts from exact commit
+`11a699155588d3d948990c5f08b72c5cc8d2c746`. It implements the first bounded
+localized-perturbation execution path without widening the UI surface.
+
+- Immutable `LocalizedTorqueOffset` commands use only the topological IDs
+  `joint.shoulder` and `joint.wrist`, a required finite half-open
+  `time_window_s = [start, end)`, and a finite additive torque in N.m. These IDs
+  remain deliberately distinct from spatial trace points such as
+  `swing.wrist`.
+- Passive and prescribed double-pendulum runs add every active command at each
+  Python RK4 stage. Recorded joint-torque samples use the same half-open rule;
+  exact shared boundaries cannot double-apply.
+- Rate variation requests map the two registered commanded-torque variables to
+  exact one-point loci and deterministic pre-sampled values. Missing, multiple,
+  mismatched, out-of-duration, base-only, wrong-source, and unsupported
+  localized specifications fail before trial execution.
+- Explicit Rust execution fails closed. `auto` selects the Python forced path
+  when localized commands are present. Valid misses remain typed
+  `evaluated_no_impact` results with closest-approach evidence.
+
+Exact local evidence is 99/99 focused tests and 1,413/1,413 broader shared-
+swing/variation and Rate tests (one expected Rust-wheel skip), plus Ruff, Ruff
+format, and changed-source MyPy. This is a narrow core seam: PyQt/React locus
+authoring and presentation, other source/locus kinds, Rust parity, complete
+state/event/torque persistence, protected CI/publication, and epic completion
+remain open.
+
 ## 2026-08-12 Bounded ensemble chunk lifecycle foundation (#4142 R11.5)
 
 Local child `codex/4142-ensemble-chunks` starts from published #4405 head

SPEC.md

@@ -26,12 +26,108 @@
 | **Owner**               | D-sorganization                            |
 | **Primary Language(s)** | Python 3.11+, Rust, JavaScript, TypeScript |
 | **License**             | MIT                                        |
-| **Current Version**     | 1.16.53                                    |
-| **Spec Version**        | 1.16.53                                    |
+| **Current Version**     | 1.16.58                                    |
+| **Spec Version**        | 1.16.58                                    |
 | **Last Spec Update**    | 2026-08-12                                 |
 
 ## 2. Purpose & Mission
 
+### 2026-08-12 Localized torque static-gate closure (#4142)
+
+Version 1.16.58 closes the final cumulative changed-source static-analysis
+findings without changing runtime behavior. The variation CSV reader explicitly
+types its input and success arrays as NumPy arrays, satisfying the repository's
+`follow-imports=skip` delta MyPy gate. The Rate simulation pipeline returns the
+already typed `SwingSource` from `make_source` directly instead of wrapping it
+in a redundant cast. The source factory also uses the type narrowing guaranteed
+by its run-config contract instead of recasting the validated non-`None` branch.
+Behavioral contracts and serialized data are unchanged.
+
+Evidence is the exact cumulative 16-file changed-source MyPy command, 147/147
+localized contract tests, and scoped Ruff/format/diff gates. UI locus authoring,
+Rust parity, protected publication, and epic completion remain open.
+
+### 2026-08-12 Source execution and dataset discriminator hardening (#4142)
+
+Version 1.16.57 removes a truthiness-based source-configuration fallback.
+`make_source` now requires `run_config` to be `None` or an actual
+`DoublePendulumRunConfig` before constructing a default, so falsey and truthy
+wrong-type objects cannot silently select passive execution or reach incidental
+attribute errors. Manual and triple-pendulum sources accept only the default
+passive, profile-free, lock-free, localized-offset-free execution declaration;
+all non-default double-pendulum semantics fail before source construction.
+
+The outer variation dataset JSON reader now applies the same genuine
+non-Boolean integer schema discriminator used by `VariationPlan`. `True`,
+`1.5`, and `"1"` cannot select dataset schema v1 through coercion. The sibling
+Morris observation reader already performs an exact integer type check. Local
+evidence is 34/34 focused and 1,483/1,483 broader shared-swing, variation, and
+Rate tests, with one expected missing-Rust-wheel skip. UI locus authoring, Rust
+parity, protected publication, and epic completion remain open.
+
+### 2026-08-12 Localized torque source and wire hardening (#4142)
+
+Version 1.16.56 makes the double-pendulum-only localized-torque capability
+fail closed at every nearby public boundary. The source factory rejects a
+non-empty `commanded_torque_offsets` collection for both manual and triple-
+pendulum discriminators instead of silently dropping the command. The run
+configuration validates the raw collection as a tuple or list before
+canonical tuple conversion, so `None` and other malformed domains raise
+`ContractViolationError` rather than incidental `TypeError`.
+
+`VariationPlan.from_json_dict` now requires `schema_version` to be a genuine
+non-Boolean integer before normalization. Boolean, float, and string lookalikes
+cannot select a wire schema through coercion; emitted v2 and supported integer
+v1 migration documents retain their existing behavior. Evidence is 102/102
+focused tests and 1,464/1,464 broader shared-swing, variation, and Rate tests,
+with one expected missing-Rust-wheel skip. UI locus authoring, Rust parity,
+protected publication, and epic completion remain open.
+
+### 2026-08-12 Localized torque adversarial corrections (#4142)
+
+Version 1.16.55 closes three fail-closed gaps in the initial localized torque
+core. `NoiseSpec` numeric scale, bounds, and time loci and `VariationPlan` base
+values reject Boolean, string, and nonfinite raw values; run count and seed
+require genuine non-Boolean integers. Normal JSON integer/float documents and
+v1 migration remain supported. Public localized helpers likewise validate base
+torques, command collections, sample times, and duration before use and report
+contract violations rather than coercion or incidental Python exceptions.
+
+A shared fixed-step grid function is now authoritative for effective RK4
+duration in request, configuration, source, and fallback trace-grid paths.
+Localized windows must fit that effective duration before sampling or trial
+execution. The existing PyQt variation picker excludes contextual localized
+torque entries because it has no locus editor; an imported localized plan fails
+atomically with an explicit unrepresentable/locus-editor explanation. This does
+not claim PyQt or React locus authoring. Evidence is 118 correction-focused and
+1,455 broader passing tests, with one expected missing-Rust-wheel skip.
+
+### 2026-08-12 Localized double-pendulum torque execution (#4142)
+
+Version 1.16.54 introduces the first dynamics-backed localized perturbation
+contract. A `LocalizedTorqueOffset` targets exactly one topological
+double-pendulum joint, `joint.shoulder` or `joint.wrist`, over a required finite
+half-open time window `[start_s, end_s)` wholly inside the run. The finite N.m
+value adds to passive or prescribed commanded torque at every Python RK4 stage.
+Topological torque IDs remain intentionally distinct from spatial output point
+IDs, including `swing.wrist`.
+
+Two registry variables map deterministic variation samples to those exact
+joint loci. Validation rejects unsupported variables, non-torque localized
+sources, absent/multiple/mismatched point IDs or windows, out-of-duration
+windows, base-only localized use, incompatible swing sources, and explicit Rust
+before simulation. Automatic backend selection uses Python whenever localized
+commands are present. Recorded torque history obeys the same half-open rule;
+chunk-size changes do not alter deterministic outcomes; and a physically valid
+miss remains typed no-impact data with closest-approach evidence.
+
+This version is a narrow core execution seam. PyQt and React authoring and
+presentation, other localized variables/source kinds, Rust parity, complete
+raw state/event/torque persistence, protected publication, and #4142 completion
+remain open. Evidence is 99 focused tests and 1,413 broader shared-swing,
+variation, and Rate tests with one expected missing-Rust-wheel skip, plus Ruff,
+format, and changed-source MyPy.
+
 ### 2026-08-12 Bounded ensemble chunk lifecycle foundation (#4142 R11.5)
 
 Version 1.16.53 adds a bounded in-process execution lifecycle for complete Rate
@@ -3309,6 +3405,11 @@ Active development with stable core, continuous tool expansion, and web API in p
 
 | Date | Version | Changes |
 | ---- | ------- | ------- |
+| 2026-08-12 | 1.16.58 | fix(rate-of-closure, #4142): close the cumulative 16-source static gate with explicit NumPy CSV array annotations and removal of redundant pipeline/source-config casts; restore the missing 1.16.55-1.16.58 append-only history while preserving runtime and wire behavior. |
+| 2026-08-12 | 1.16.57 | fix(rate-of-closure, #4142): validate source run configurations before exact-`None` fallback; reject prescribed mode/profile, locks, and localized offsets on manual/triple sources; and require a genuine non-Boolean integer outer variation-dataset schema discriminator. |
+| 2026-08-12 | 1.16.56 | fix(rate-of-closure, #4142): reject localized torque offsets on unsupported manual/triple sources; validate run-config offset collections before tuple conversion; and require genuine non-Boolean integer variation-plan schema versions. |
+| 2026-08-12 | 1.16.55 | fix(rate-of-closure, #4142): fail closed on malformed localized numeric/collection domains; make the fixed-step effective RK4 duration authoritative for windows; and hide or atomically reject localized PyQt factors until locus authoring exists. |
+| 2026-08-12 | 1.16.54 | feat(rate-of-closure, #4142): execute additive shoulder/wrist commanded-torque offsets over strict half-open one-point loci at every Python RK4 stage; bind deterministic variation samples to exact topological joint IDs; fail closed on unsupported source, locus, duration, and Rust contracts; preserve typed no-impact and distinct spatial provenance while keeping UI, persistence, protected release, and epic completion open. |
 | 2026-08-12 | 1.16.53 | feat(rate-of-closure, #4142 R11.5): add immutable resource-bounded ensemble stream headers/result chunks and an injected commit/abort sink lifecycle; project and release one chunk of complete runs at a time; retain the existing materialized API through a compatibility collector; and keep durable streaming/archive/memory claims explicitly open. |
 | 2026-08-12 | 1.16.52 | fix(rate-of-closure, #4142): satisfy the exact protected Python 3.12 / NumPy 2.3.5 / Mypy 1.13 typing boundary with explicit array annotations/casts and built-in-float `finfo` normalization; retain unchanged numerical and wire behavior. |
 | 2026-08-12 | 1.16.51 | fix(rate-of-closure, #4142 R11.4): require complete trial output scalars to be finite real non-booleans; normalize accepted NumPy real scalars to built-in floats; and prove typed-object writer/reader domain closure with five TDD cases and 39 focused persistence tests. |