[SaulBuilds]

Tests-only. No production code changes.

What this adds

Four tests that pin existing guards at the call sites that use them. Before this PR, the guards were tested only through their helpers, so removing them at the call site left the suite green:

Guard (call site)	New test	With the guard removed
validate_commit_domain: the node-feature loop (nat-weightspace)	commit::tests::commit_checked_rejects_a_bad_node_feature	green before, red now
is_canonical_hash length check, reached through gather_and_aggregate (nat-federated)	tests::gather_refuses_a_trace_hash_that_is_not_64_lowercase_hex	green before, red now
Sidecar::from_json calls validate() (nat-sidecar)	tests::from_json_refuses_aliased_and_zero_width_slices	green before, red now
step_contribution passes the realized loss and the backend label into the step digest (nat-candle)	train_loop::tests::step_contribution_binds_the_realized_loss_and_backend	green before (loss replaced by a constant, or backend by a literal), red now

It also contains one test fix: nat-aggregate tests::determinism_same_inputs_same_digest called aggregate with trim = 0. The pinned citrate-fed-types kernel now refuses a zero trim budget (NoTrimBudget), so this test failed on main (cargo test --workspace: 1 failure). It now uses trim = 1 of 3 inputs. It still asserts determinism.

Standard: met

• Red on the old code: each new test was run against a build with one guard reverted at a time (a behaviour-only change that still compiles, such as if g { → if false && g { or a dropped call). Each test failed on an assertion there and passes with the guard restored.
• Revert sweep: 20 single-guard reverts across nat-weightspace, nat-federated, nat-sidecar, nat-core, nat-data, nat-aggregate, nat-provenance and nat-candle, each followed by the affected crate suites:
  • 14 went red on existing tests.
  • The 4 call sites above went green before this PR and red with it.
  • 2 are unobservable by construction and left unpinned on purpose:
    • the positive-denominator assert! in div_round_nearest, because compress always passes a scale of at least 1;
    • the i128 ceiling in prune_and_reweight, because the threshold clamp before it keeps the i64 form in range.
• Suite: cargo test --workspace. Before: 241 passed, 1 failed (the trim-0 test above). After: 246 passed, 0 failed. Every new test runs on CPU in a few seconds, and none starts a training run.
• cargo fmt --all -- --check is clean. cargo clippy -p nat-weightspace -p nat-federated -p nat-sidecar -p nat-candle -p nat-aggregate --all-targets -- -D warnings is clean.
• Host safety: no network and no filesystem writes in the new tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4

[BerryManifold]

Approval at d898e60353f212362b50fb275afb9c4c99ab6eeb after focused differential review of changed files, history, security guards and immediate callers. nat-aggregate15, nat-federated21, nat-sidecar6, nat-weightspace17 tests pass; nat-candle focused provenance test1 pass.

Limits: No deployments, live authority/chain/storage operations, full cross-repository integration or full historical security audit. Required CI/branch/owner gates still apply. Both account submissions reflect the same automated review.

[Matr0xshka]

Approval at d898e60353f212362b50fb275afb9c4c99ab6eeb after focused differential review of changed files, history, security guards and immediate callers. nat-aggregate15, nat-federated21, nat-sidecar6, nat-weightspace17 tests pass; nat-candle focused provenance test1 pass.

Limits: No deployments, live authority/chain/storage operations, full cross-repository integration or full historical security audit. Required CI/branch/owner gates still apply. Both account submissions reflect the same automated review.

[BerryManifold]

Automated Codex static review of d898e60353f212362b50fb275afb9c4c99ab6eeb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of d898e60353f212362b50fb275afb9c4c99ab6eeb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[BerryManifold]

Automated Codex static review of d898e60353f212362b50fb275afb9c4c99ab6eeb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of d898e60353f212362b50fb275afb9c4c99ab6eeb is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.