A floor per cell: shapes may improve, and may not quietly get worse (#198, step 3)

[milyin]

Step 3 of #198, on shape-coverage (#402).

Why the committed report is not enough

REPORT.md makes every changed answer a reviewed diff. But it shows a cell going header → rejected in exactly the same shade as one going the other way, so it catches a regression only if a reviewer reads the diff and knows which direction is which.

Two different questions:

Gate	Question	Needs a reviewer?
committed REPORT.md	did anything move?	yes
GUARANTEES.md	did anything move down?	no

The ratchet

Each cell that produces something carries a floor — the level it has been seen to reach. 130 floors: 45 at header, 75 at compiles, 10 at generates (50 C cells, 80 JNI).

Rising above a floor is free and silent. Falling below it fails a test that names the cell, the floor, and where it is now:

cells got worse:
  array_scalar__field__jni: was guaranteed to reach `header`, now reaches only `compiles`

Raising is automatic, lowering is a hand edit. cargo run -p shape-matrix -- --update-guarantees raises floors and never lowers one. That asymmetry is the whole mechanism: if the file were rewritten on every run, a floor would follow its cell downwards and the ratchet would hold nothing. Giving up on a shape that used to work should cost a line in a diff a reviewer can argue with.

The ladder is per target, because C runs one stage further: header is C's ceiling, compiles is JNI's until the Kotlin compiler runs. A shared ceiling would let a C cell lose its header without falling below any floor.

Tests

Four, and three of them exist because a gate nobody has seen fail is a gate nobody can trust:

• the ratchet reports exactly the cell that fell and ignores the one that rose;
• --update-guarantees leaves a floor standing when the run does worse — the ratchet's integrity, tested directly;
• every floor names a cell the matrix still enumerates, so a renamed shape cannot leave an entry behind being satisfied by nothing at all;
• and the live gate, against the floors this repository commits.

The first three run on synthetic floors rather than on the repository's, deliberately: a rule whose behaviour can only be observed by breaking the repo is a rule nobody checks. I also verified it end-to-end by hand — claiming header for a JNI cell produces the failure above — and reverted.

Exit: answer-preserving

REPORT.md is byte-identical. This stage adds a second gate over the same measurements and moves none of them.

One performance note: report::survey() is now memoized, so the report and the ratchet share one pass over both generators plus one cargo check, rather than doubling the suite's cost to compute the same answer twice. The suite runs in ~4s.

Not in this step

The issue also asks for a must execute level. There is no runtime state for a floor to stand on until step 2c, so the ladder stops at header.

Checks

cargo test -p shape-matrix (14 tests), clippy -D warnings over all targets and features, cargo fmt --check with CI's config, RUSTDOCFLAGS=-D warnings cargo doc, and REPORT.md unchanged.