# Fallbacks that could FABRICATE a quantity, in sylpheed-formats + sylpheed-cli.
# 2026-08-30. The mirror of sylpheed-port's sweep of their own tree.
#
# 112 fallback sites (unwrap_or / unwrap_or_else / unwrap_or_default /
# serde(default)). 64 supply 0, false, empty or Default -- sentinels that assert
# nothing. Of the 48 remaining, most are pass-through (unwrap_or(s),
# unwrap_or(name)) or an extent (unwrap_or(bytes.len())), which are identity.
#
# POSITIVE CONTROL: the filter found media.rs:314 unwrap_or(anchor) -- the
# voice-region start fallback landed earlier this session -- so the detector
# finds a known case rather than only reporting absence.
#
# mesh.rs 1077/1084/1099/1106/1139/1177 (1.0, 0.85, 1, 0.5, 0.70, 0.45) are
# env-var tunables (XBG7_EDGE_CAP etc.) with defaults documented in
# structures/xbg7-mesh.md. Knobs, not measurements. Out of the menu lane.
#
## ui_layout.rs -- the crate the port PINS. 8 sites; 6 sentinel or pass-through;
## 2 could fabricate a quantity:
#
#   :695   unwrap_or((DESIGN_W, DESIGN_H))  -> MEASURED BELOW: never fires
#   :1681  kf.time.unwrap_or(0)             -> unreachable today; note below
#
## Does the design-size fallback ever fire? Disc-wide.
## instrument: examples/design_size_fallback.rs
## CONTROL: it must reproduce screen list's 1280x720 for every build.
##   A first version read EVERY RATC child and FAILED that control -- it
##   reported all 965 builds stating a non-standard size (GP_TUTORIAL 12x3),
##   because a T8aD sprite header read at +0x18 is garbage that passes the
##   range test. Filtered to the .rat records, the control passes.
#
GP_BUNK.pak                        8 read       0 FABRICATED
GP_CHALLENGE.pak                  78 read       0 FABRICATED
GP_DEBRIEFING_PILOTLOG.pak        18 read       0 FABRICATED
GP_DIALOG.pak                    105 read       0 FABRICATED
GP_GAMEOVER.pak                   10 read       0 FABRICATED
GP_HANGAR_ARSENAL.pak            390 read       0 FABRICATED
GP_LEADERBOARD.pak                 4 read       0 FABRICATED
GP_MAIN_GAME_D2D.pak              18 read       0 FABRICATED
GP_MAIN_GAME_E2D.pak              18 read       0 FABRICATED
GP_MAIN_GAME_F2D.pak              18 read       0 FABRICATED
GP_MAIN_GAME_I2D.pak              18 read       0 FABRICATED
GP_MAIN_GAME_J2D.pak              18 read       0 FABRICATED
GP_MAIN_GAME_S2D.pak              18 read       0 FABRICATED
GP_MISSION_LOG.pak                 4 read       0 FABRICATED
GP_MISSION_SELECT.pak             66 read       0 FABRICATED
GP_MOVIE_THEATER.pak              56 read       0 FABRICATED
GP_OPTIONS.pak                    14 read       0 FABRICATED
GP_PAUSE_MENU.pak                  6 read       0 FABRICATED
GP_READY_ROOM.pak                 60 read       0 FABRICATED
GP_SAVE_LOAD.pak                  18 read       0 FABRICATED
GP_STAGE_CLEAR.pak                 4 read       0 FABRICATED
GP_SYSTEM.pak                      2 read       0 FABRICATED
GP_TITLE.pak                      12 read       0 FABRICATED
GP_TUTORIAL.pak                    2 read       0 FABRICATED
965 builds state a design size, 0 get the 1280x720 FALLBACK
0 builds state something other than 1280x720

# So design_w/design_h is READ, not fabricated: 965 of 965 builds state it
# explicitly and every one states 1280x720. The port can rely on it.
#
# The remaining site, ui_layout.rs:1681, serialises kf.time.unwrap_or(0) when
# writing a bundle back. `time` is still Option<u32> (line 130). Under the
# corrected record layout every pose is timed, so this cannot fire today -- the
# same status as the port's exit_ramp_units branch. What makes it worse than
# theirs if it ever did: their fabricated value was 24.0, a conspicuous magic
# number. Mine is 0, which is a LEGITIMATE keyframe time -- pose 0's time really
# is 0 -- so a fabricated one would be indistinguishable from a real one in any
# output. An in-range fallback cannot be caught downstream.

################################################################################
# COUNTED, not inspected -- 2026-08-30, after sylpheed-port pointed out that
# classifying defaults "by inspection" is exactly the method that cannot see an
# in-range fallback. That correction applies to this file's own first pass: 64
# sites were waved through as sentinels by reading them.
# instrument: examples/inrange_fallback_count.rs
#
#   965 builds, 24 811 keyframes
#   :1681  untimed poses (fallback would fabricate t=0):            0
#   :1010  pose_at queries 168 264, of which None (reads a=0):      0
#
# ⚠️ Two zeroes, which is the result this corpus distrusts most. So the detector
# was made to prove it can see a hit -- ask pose_at for a time no build declares:
#
#   CONTROL  10 906 out-of-range queries, 0 None      <-- THE CONTROL FAILED
#
# The detector was BLIND, and the :1010 zero meant nothing. The failure is the
# finding: pose_at is TOTAL. Reading the source, its only None path is an
# `if ks.is_empty() { return None }` guard at line 217 -- and disc-wide there are
# 0 elements with zero keyframes out of 5 453. So :1010's unwrap_or(0) is
# unreachable by CONSTRUCTION, which is stronger than "0 in this corpus", and it
# was established by the control failing rather than by the count passing.
#
# :1681 stands on a different footing: 0 of 24 811, and `time` really is
# Option<u32>, with the STALE reader demonstrably producing None (its `screen
# info` prints a trailing `-`). So the state is representable and a detector
# would see it; the corrected reader simply never produces one.
#
# :973's unwrap_or(0) is NOT a hazard: it is guarded two lines later by
# `if tmax == 0 { return false; }`. Read, not counted, and that is sufficient
# because the guard is the proof.