re: sweep my own crates for fallbacks that fabricate a quantity

The mirror of sylpheed-port's sweep after their exit_ramp_units catch, where a
refuted 24.0 survived in a `get(..., 24.0)` fallback because the authored entry
had been deleted as progress and the deletion was a no-op.

112 fallback sites across sylpheed-formats and sylpheed-cli. 64 supply 0, false,
empty or Default -- sentinels asserting nothing. Of the 48 remaining most are
pass-through or an extent. Positive control: the filter found media.rs:314
unwrap_or(anchor), the voice-region start fallback landed earlier this session,
so the detector finds a known case rather than only reporting absence. The
mesh.rs cluster (1.0, 0.85, 0.5, 0.70, 0.45) is env-var tunables with defaults
documented in xbg7-mesh.md.

ui_layout.rs, the crate the port pins, has 8 sites; 6 sentinel or pass-through
and 2 that could fabricate a quantity. Both fabricate a value that is
LEGITIMATE, which is worse than the port's conspicuous 24.0:

  :695  unwrap_or((DESIGN_W, DESIGN_H)) -- 1280x720, which is what every real
        screen states, so no parser output can distinguish read from invented.
        MEASURED: it fires 0 times in 965 builds disc-wide, so design_w/design_h
        is read and the port can rely on it.

  :1681 kf.time.unwrap_or(0) in the serialiser -- 0 is a real keyframe time
        (pose 0's time IS 0). Unreachable today under the corrected record
        layout, the same status as their exit_ramp_units branch, but a
        fabricated 0 would be indistinguishable from a real one.

The measuring instrument failed its own control first: a version reading EVERY
RATC child reported all 965 builds stating a non-standard design size
(GP_TUTORIAL 12x3), where `screen list` prints 1280x720 for every one -- a T8aD
sprite header read at +0x18 is garbage that passes the range test. Filtered to
the .rat records, it reproduces screen list exactly.

METHOD: a fallback default is an authored value no reader can see, and the
dangerous ones are IN-RANGE -- the only way to know is to count how often they
fire, which no parser output reveals.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wuu56cE8vJGTBtn1ppsk8v

docs/re/METHOD.md

@@ -284,6 +284,31 @@ agent's loop prompt, i.e. nowhere durable. See [`README.md`](README.md) for the
   across 105 units against edges at 78. The sweep was luck; the entry is here so
   the next one is not.
 
+* **A fallback default is an authored value that no reader can see** — and the
+  dangerous ones are **in-range**. `sylpheed-port` found `exit_ramp_units`
+  defaulting to **24.0**, the exact constant this corpus had *refuted*: the
+  authored entry had been deleted as progress, and a
+  `timing.get("exit_ramp_units", 24.0)` made the deletion a no-op, in the one
+  place a reader checking `authored/` would never look. **Deleting a value does
+  not remove it if something supplies it silently.**
+
+  ⚠️ Their 24.0 was at least conspicuous. Sweeping this side for the same shape
+  ([`data/fallback-fabrication-sweep.txt`](data/fallback-fabrication-sweep.txt))
+  found 112 fallback sites, of which two in the pinned `ui_layout.rs` could
+  fabricate a quantity — and **both fabricate a value that is legitimate**:
+  `(1280, 720)`, which is what every real screen states, and `kf.time.unwrap_or(0)`,
+  where 0 is a real keyframe time (pose 0's time *is* 0). An in-range fallback
+  cannot be caught downstream by inspecting the output, because the output looks
+  exactly like the true case. The only way to know is to **count how often it
+  fires**: measured, the design-size fallback fires **0 times in 965 builds**, so
+  that number is read rather than invented — which could not have been established
+  from any parser output.
+
+  Sweep for these by listing every fallback and asking *"does this supply a
+  quantity, or a sentinel?"* — 0/empty/`Default` and pass-throughs assert nothing;
+  a literal that could pass for a measurement is the hazard. Build the sweep so it
+  finds a **known** case as its positive control.
+
 ## Runtime / emulator
 
 * **Look at the PNG** — and check its dimensions.