Admit computed ordered-fold validation

[PraneethMerugu]

Summary

• admit runtime-computed semantic validity on FoldStep with a bounded Int32 witness
• reject an invalid step before applying any private accumulator writes, preserving atomic final publication
• distinguish semantic invalidity from an ordinary scientific denial, which remains a valid zero-change disposition
• preserve the existing 1024-byte update-plus-halt envelope and admit the validity layout within a 1032-byte total ceiling
• keep CPU and Metal on the same ordered-fold executor and narrow the prepared-state read boundary to the exact supported scalar indices

Contracts and evidence

• the valid and invalid paths use the same transition type and prepared object; a runtime Parameter(:imbalance, Int32) selects the outcome
• the invalid fixture also proposes a live malformed destination, proving :invalid_step wins before structural write validation or mutation
• diagnostics carry failure class, source item, canonical position, and bounded witness
• focused package tests: 20/20
• affected ordered-fold and inventory tests: 61/61
• authoring and quality tests: 116/116
• package quality and focused signatures: 38/38
• real Metal before the read-boundary correction: 9/11; later recurrence steps observed the initializer snapshot
• real Metal after the shared Base.@noinline Int/Int32 read boundary: 11/11 with scalar indexing disabled
• CPU A/B recurrence median: 50.7085 µs inline vs 50.5830 µs noinline; both 11,424 bytes
• typed transition IR: 33 statements / 17 calls / 9 raw Any before, 12 / 5 / 3 after, with a concrete FoldStep return
• independent re-review: clean

Hosted real Metal remains the final backend authority.

Deliberate boundary

This exposes the explicit FoldStep compiler SPI needed by conserved settlement. High-level @ordered syntax is unchanged; extending it without another real consumer would be speculative.