Flag deferred pillars; document that Cascade Stroke 1 can drop true hits - #346

Two behaviours flagged by the lance-graph Mexican-hat probe (board entry 2026-10-08-mexhat-bucket-cascade-probe.md).

Deferred pillars passed as certified

Pillar-15, -16 and -17 are placeholders. They run no probe, yet they report passed = true. Any gate that reads passed therefore counted three pillars that had measured nothing.

• PillarReport gains deferred: bool, set only on those three pillars.
• New method certified(), defined as passed && !deferred. Gates should use this.
• print() now shows DEFERRED instead of PASS for them.
• passed keeps its existing meaning, so existing callers behave the same.
• Breaking for struct literals: code that builds a PillarReport must add deferred: false. All 18 in-tree literals are updated.
• deferred_pillars_are_not_certified pins the split: pillars 12–14 are certified, 15–17 are deferred, and deferred == (n_paths == 0 && n_hops == 0) on every report.

Cascade Stroke 1 recall

Cascade::query's Stroke 1 drops any candidate whose scaled prefix estimate exceeds threshold + 3σ. Nothing falls back to an exact check, so a hit within the threshold is lost when its differing bits sit in the prefix. That is how a statistical cascade is designed, so the behaviour is unchanged.

• The doc now says recall is not guaranteed. Returned hits remain exact.
• stroke1_drops_a_prefix_heavy_true_hit pins the behaviour with 128 candidates, all at distance 400 against a threshold of 600:
  • the one with all 400 differing bits in the prefix is dropped;
  • the 127 with the same bits at the tail are kept.
• A future change that makes Stroke 1 exact will flip this test on purpose.

Also

The SplitMix64::new doctest failed under deny(warnings) because of an unused mut. Fixed.

Verification (debug 0)

• cargo test -p ndarray --features pillar --release --lib -- pillar cascade: 200 passed.
• Pillar doctests: 36 passed.
• cargo clippy --features pillar --lib -- -D warnings is clean, in both the dev and test profiles.
• cargo fmt is clean.
• Disable runs, both red, both restored:
  • certified() returning passed;
  • Stroke 1 also admitting d <= threshold.

Not fixed (pre-existing, unrelated): clippy errors in tests/splat3d_correctness.rs under --tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EFw2WdKr1oxvaKCJC2ua2R

Generated by Claude Code