diff --git a/.coveragerc b/.coveragerc
index e312baf..4aaecbe 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -3,8 +3,6 @@ branch = True
 data_file = build/coverage/.coverage
 source =
     netgraph_core
-omit =
-    python/netgraph_core/_docs.py
 
 [report]
 show_missing = True
diff --git a/.github/ci-constraints.txt b/.github/ci-constraints.txt
new file mode 100644
index 0000000..d0991f1
--- /dev/null
+++ b/.github/ci-constraints.txt
@@ -0,0 +1,78 @@
+# Exact versions for CI's Python environments and for the coverage venv of `make cov`, so a new
+# release of a tool cannot change a CI result without a change in this repository: the accepted
+# development environment's versions, and for what only Linux, Windows or Python 3.11 installs,
+# the version a resolver chose for those platforms (its marker says where it applies). pip itself
+# is one of them: a job installs this pip (`pip install -U -c` this file, which also downgrades a
+# newer one) before anything else. They reach a build environment only through the mechanism of
+# the tool that fills it: pip's own isolated build takes --build-constraint or
+# PIP_BUILD_CONSTRAINT (since pip 26.2 never -c or PIP_CONSTRAINT), `python -m build` takes
+# PIP_CONSTRAINT, and its uv installer (the release wheels) UV_CONSTRAINT. NumPy 2.5 needs Python
+# 3.12; Python 3.11 gets the last NumPy that supports it. Update deliberately.
+build==1.5.0
+certifi==2026.7.22
+cfgv==3.5.0
+charset-normalizer==3.5.1
+cmake==4.4.2
+colorlog==6.12.0
+coverage==7.15.4
+distlib==0.4.3
+docutils==0.23
+filelock==3.32.3
+gcovr==8.6
+id==1.6.1
+identify==2.6.19
+idna==3.19
+iniconfig==2.3.0
+jaraco.classes==3.4.0
+jaraco.context==6.1.2
+jaraco.functools==4.6.0
+Jinja2==3.1.6
+keyring==25.7.0
+lxml==6.1.2
+markdown-it-py==4.2.0
+MarkupSafe==3.0.3
+mdurl==0.1.2
+more-itertools==11.1.0
+nh3==0.3.6
+ninja==1.13.0
+nodeenv==1.10.0
+packaging==26.3
+pathspec==1.1.1
+pip==26.2.1
+platformdirs==4.11.3
+pluggy==1.6.0
+pre_commit==4.6.2
+pybind11==3.1.0
+pybind11-stubgen==3.0.0
+Pygments==2.21.0
+pyproject_hooks==1.2.0
+pyright==1.1.401
+pytest==9.1.1
+pytest-cov==7.1.0
+python-discovery==1.5.2
+PyYAML==6.0.3
+readme_renderer==45.0
+requests==2.34.2
+requests-toolbelt==1.0.0
+rfc3986==2.0.0
+rich==15.0.0
+ruff==0.11.13
+scikit_build_core==1.0.3
+setuptools==84.0.0
+twine==7.0.0
+typing_extensions==4.16.0
+urllib3==2.7.0
+virtualenv==21.7.4
+wheel==0.48.0
+numpy==2.5.2; python_version >= "3.12"
+numpy==2.4.4; python_version < "3.12"
+backports.tarfile==1.2.0; python_version < "3.12"
+importlib_metadata==9.0.1; python_version < "3.12"
+zipp==4.1.1; python_version < "3.12"
+cffi==2.1.1; sys_platform == "linux"
+cryptography==50.0.2; sys_platform == "linux"
+jeepney==0.9.0; sys_platform == "linux"
+pycparser==3.11; sys_platform == "linux"
+SecretStorage==3.5.0; sys_platform == "linux"
+colorama==0.4.6; sys_platform == "win32"
+pywin32-ctypes==0.2.3; sys_platform == "win32"
diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml
new file mode 100644
index 0000000..8824f22
--- /dev/null
+++ b/.github/workflows/proofs.yml
@@ -0,0 +1,187 @@
+name: Lean verification
+
+on:
+  pull_request:
+  push:
+    branches: ["**"]
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      sdist-artifact:
+        description: Existing source artifact to check, rather than building a new archive
+        type: string
+        default: ""
+      wheels-pattern:
+        description: Existing release wheel artifacts corresponding to that archive
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+env:
+  LEAN_NUM_THREADS: "2"
+  PROOFS_DEPENDENCY_ORIGIN: cache+local
+
+jobs:
+  model:
+    name: Lean proofs
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      # Official action, pinned to its reviewed source. The package's own entry point
+      # controls build/audit/replay; the action supplies Elan and the pinned mathlib cache.
+      - uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6
+        with:
+          lake-package-directory: proofs
+          auto-config: "false"
+          build: "false"
+          test: "false"
+          lint: "false"
+          use-github-cache: "false"
+          use-mathlib-cache: "true"
+      - name: Model proofs, fingerprints and fresh kernel replay
+        run: bash dev/proofs/run.sh replay
+      - name: Real-discovery negative controls
+        run: bash dev/proofs/run.sh test
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: lean-model-evidence
+          path: |
+            build/proofs/check.json
+            build/proofs/replay.json
+            build/proofs/*.log
+          if-no-files-found: error
+
+  distribution:
+    name: Lean distribution
+    runs-on: ubuntu-22.04
+    env:
+      PIP_CONSTRAINT: ${{ github.workspace }}/.github/ci-constraints.txt
+      PIP_BUILD_CONSTRAINT: ${{ github.workspace }}/.github/ci-constraints.txt
+      CMAKE_BUILD_PARALLEL_LEVEL: "4"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Pinned packaging tools
+        run: |
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt build
+      - uses: actions/download-artifact@v4
+        if: inputs.sdist-artifact != ''
+        with:
+          name: ${{ inputs.sdist-artifact }}
+          path: build/proofs/dist
+      - uses: actions/download-artifact@v4
+        if: inputs.wheels-pattern != ''
+        with:
+          pattern: ${{ inputs.wheels-pattern }}
+          merge-multiple: true
+          path: build/proofs/dist
+      - name: Build candidate distributions with excluded local by-products present
+        if: inputs.sdist-artifact == ''
+        run: |
+          mkdir -p proofs/.lake build/proofs
+          echo must-not-ship > proofs/.lake/packaging-plant.keep
+          echo must-not-ship > build/proofs/generated-report.keep
+          python -m build --sdist --wheel --outdir build/proofs/dist \
+            --config-setting=build-dir=build/proofs/wheel-build
+      - name: Check exact members, record archive identity and extract
+        shell: bash
+        run: |
+          sdists=(build/proofs/dist/*.tar.gz)
+          wheels=(build/proofs/dist/*.whl)
+          [[ ${#sdists[@]} -eq 1 && -f ${sdists[0]} ]]
+          [[ -f ${wheels[0]} ]]
+          proof_extract="$RUNNER_TEMP/netgraph-core-proofs-sdist"
+          echo "PROOFS_EXTRACTED=$proof_extract" >> "$GITHUB_ENV"
+          args=(--sdist "${sdists[0]}" --receipt build/proofs/receipt.json --extract "$proof_extract")
+          for wheel in "${wheels[@]}"; do args+=(--wheel "$wheel"); done
+          python -I -B dev/proofs/package.py "${args[@]}"
+          test ! -e "$proof_extract/.git"
+          test ! -e "$proof_extract/dev"
+          test ! -e "$proof_extract/proofs/.lake"
+          ! git -C "$proof_extract" rev-parse --show-toplevel
+      - uses: leanprover/lean-action@24581d74d674803a25a81b10b059c5c0cdd344c6
+        with:
+          lake-package-directory: ${{ env.PROOFS_EXTRACTED }}/proofs
+          auto-config: "false"
+          build: "false"
+          test: "false"
+          lint: "false"
+          use-github-cache: "false"
+          use-mathlib-cache: "true"
+      - name: Check proofs using only the extracted source and pinned dependencies
+        run: |
+          cd "$PROOFS_EXTRACTED/proofs"
+          lake --wfail build
+          lake exe proof-audit --output "$GITHUB_WORKSPACE/build/proofs/sdist-check.json"
+          lake env leanchecker --fresh Checks > "$GITHUB_WORKSPACE/build/proofs/sdist-replay.log" 2>&1
+          python -I -B Checks/audit.py --verify-report "$GITHUB_WORKSPACE/build/proofs/sdist-check.json"
+      - name: Recheck artifact identities after proof execution
+        shell: bash
+        run: |
+          args=(--verify --sdist build/proofs/dist/*.tar.gz --receipt build/proofs/receipt.json)
+          for wheel in build/proofs/dist/*.whl; do args+=(--wheel "$wheel"); done
+          python -I -B dev/proofs/package.py "${args[@]}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: proof-distribution-receipt
+          path: |
+            build/proofs/receipt.json
+            build/proofs/sdist-check.json
+            build/proofs/sdist-replay.log
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: lean-native-wheels
+          path: build/proofs/dist/*.whl
+          if-no-files-found: error
+
+  bridge:
+    name: Lean bridge
+    needs: [model, distribution]
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/download-artifact@v4
+        with:
+          name: lean-model-evidence
+          path: build/proofs
+      - uses: actions/download-artifact@v4
+        with:
+          name: lean-native-wheels
+          path: build/proofs/wheels
+      - name: Install the selected native wheel
+        run: |
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt numpy
+          python -m pip install --no-index --no-deps --find-links build/proofs/wheels \
+            --report build/proofs/install.json netgraph-core
+          python - <<'PY'
+          import json, os
+          from urllib.parse import unquote, urlparse
+          data = json.load(open('build/proofs/install.json'))
+          installed = [x for x in data['install'] if x['metadata']['name'] == 'netgraph-core']
+          assert len(installed) == 1
+          url = urlparse(installed[0]['download_info']['url'])
+          assert url.scheme == 'file'
+          with open(os.environ['GITHUB_ENV'], 'a') as f:
+              f.write('PROOFS_WHEEL=' + unquote(url.path) + '\n')
+          PY
+      - name: Exact native comparisons against current model evidence
+        run: PROOFS_NATIVE_PYTHON=$(command -v python) bash dev/proofs/run.sh bridge
+      - uses: actions/upload-artifact@v4
+        with:
+          name: lean-bridge-evidence
+          path: build/proofs/bridge.json
+          if-no-files-found: error
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 85d5023..8f504bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,8 +48,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Install uv for faster dependency installation (required on macOS, bundled in manylinux)
+      # Install uv for faster dependency installation (required on macOS, bundled in manylinux).
+      # An exact version, like the Python tools of .github/ci-constraints.txt.
       - uses: astral-sh/setup-uv@v4
+        with:
+          version: "0.11.16"
 
       # Build wheels using cibuildwheel
       - name: Build wheels
@@ -62,10 +65,24 @@ jobs:
 
           # Use uv for faster dependency installation (10-100x faster than pip)
           CIBW_BUILD_FRONTEND: "build[uv]"
+          # The pins of .github/ci-constraints.txt for what uv installs without constraints of
+          # cibuildwheel's own: the build requirements of every wheel (scikit-build-core and its
+          # dependencies; pybind11 is pinned in pyproject.toml) and the test requirements. uv
+          # reads UV_CONSTRAINT only when a call passes no -c, so cibuildwheel's own tools keep
+          # its pins. Linux builds in a container that holds the project at /project.
+          CIBW_ENVIRONMENT_LINUX: "UV_CONSTRAINT=/project/.github/ci-constraints.txt"
+          CIBW_ENVIRONMENT_MACOS: UV_CONSTRAINT="$GITHUB_WORKSPACE/.github/ci-constraints.txt"
+          CIBW_ENVIRONMENT_WINDOWS: UV_CONSTRAINT="$GITHUB_WORKSPACE/.github/ci-constraints.txt"
 
           # Target architecture per matrix entry (native compilation, no QEMU)
           CIBW_ARCHS: "${{ matrix.cibw_archs }}"
-          CIBW_TEST_COMMAND: 'python -c "import netgraph_core; print(netgraph_core.__version__)"'
+          # The Python suite on every built wheel (the shipped configuration, hooks off; the
+          # free-threaded cp314t wheels included): exactly the tests that need a hook skip.
+          # Windows runs the same guard as dev/run-checks.sh directly (no shell): the wheel lacks
+          # the private hooks and exactly the hook-only tests skip.
+          CIBW_TEST_REQUIRES: "pytest==9.1.1"
+          CIBW_TEST_COMMAND: "PYTHON=python bash {project}/dev/run-checks.sh pytest off -p no:cacheprovider"
+          CIBW_TEST_COMMAND_WINDOWS: "python {project}/dev/pytest_guard.py off {project}/tests/py -p no:cacheprovider"
           CIBW_BEFORE_ALL_LINUX: "yum install -y libatomic || (apt-get update && apt-get install -y libatomic1) || apk add libatomic"
 
       - uses: actions/upload-artifact@v4
@@ -73,20 +90,59 @@ jobs:
           name: cibw-wheels-${{ matrix.os }}-${{ matrix.cibw_archs }}
           path: ./wheelhouse/*.whl
 
+  # build fills its isolated environment with a plain pip install, which PIP_CONSTRAINT reaches;
+  # the same variable pins pip itself and build.
   build_sdist:
     name: Build SDist
     runs-on: ubuntu-latest
+    env:
+      PIP_CONSTRAINT: ${{ github.workspace }}/.github/ci-constraints.txt
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
 
       - name: Build SDist
-        run: pipx run build --sdist
+        run: |
+          python -m pip install -U pip
+          python -m pip install build
+          python -m build --sdist
 
       - uses: actions/upload-artifact@v4
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
 
+  # An installation built from the source distribution, tested with the Python suite of the same
+  # commit. pip builds it in an isolated environment of its own, which since pip 26.2 takes only
+  # build constraints (PIP_BUILD_CONSTRAINT), never PIP_CONSTRAINT: both name the same file.
+  # PIP_CONSTRAINT pins the venv's pip itself and pytest.
+  test_sdist:
+    name: Test an installation built from the SDist
+    needs: [build_sdist]
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-sdist
+          path: sdist
+      - name: Build and install from the SDist
+        env:
+          PIP_CONSTRAINT: ${{ github.workspace }}/.github/ci-constraints.txt
+          PIP_BUILD_CONSTRAINT: ${{ github.workspace }}/.github/ci-constraints.txt
+        run: |
+          python -m venv "$RUNNER_TEMP/sdist-venv"
+          "$RUNNER_TEMP/sdist-venv/bin/python" -m pip install -U pip
+          "$RUNNER_TEMP/sdist-venv/bin/python" -m pip install pytest
+          "$RUNNER_TEMP/sdist-venv/bin/python" -m pip install -v sdist/*.tar.gz
+      - name: Python tests against the installation
+        run: PYTHON="$RUNNER_TEMP/sdist-venv/bin/python" bash dev/run-checks.sh pytest off -p no:cacheprovider
+
   test_wheels_centos_stream_9:
     name: Test wheels (CentOS Stream 9, py${{ matrix.python-version }})
     needs: [build_wheels]
@@ -100,6 +156,8 @@ jobs:
       - name: Install Python
         run: dnf install -y python${{ matrix.python-version }} python${{ matrix.python-version }}-pip
 
+      - uses: actions/checkout@v4
+
       - uses: actions/download-artifact@v4
         with:
           pattern: cibw-wheels-ubuntu-*
@@ -108,27 +166,57 @@ jobs:
 
       - name: Install and test wheel
         run: |
-          python${{ matrix.python-version }} -m pip install --upgrade pip
-          python${{ matrix.python-version }} -m pip install netgraph-core --find-links wheelhouse/
-          python${{ matrix.python-version }} -c "import netgraph_core; print('CentOS Stream 9:', netgraph_core.__version__)"
+          python${{ matrix.python-version }} -m venv /tmp/wheel-venv
+          /tmp/wheel-venv/bin/python -m pip install --upgrade -c .github/ci-constraints.txt pip
+          /tmp/wheel-venv/bin/python -m pip install -c .github/ci-constraints.txt pytest numpy
+          # --no-index: the wheel built above, never a published one of the same version.
+          /tmp/wheel-venv/bin/python -m pip install --no-index --find-links wheelhouse/ netgraph-core
+          PYTHON=/tmp/wheel-venv/bin/python bash dev/run-checks.sh pytest off -p no:cacheprovider
+
+  proofs:
+    name: Verify release proofs and distributions
+    needs: [build_sdist, build_wheels]
+    uses: ./.github/workflows/proofs.yml
+    with:
+      sdist-artifact: cibw-sdist
+      wheels-pattern: cibw-wheels-*
 
   publish_pypi:
     name: Publish to PyPI
-    needs: [check_version, build_wheels, build_sdist, test_wheels_centos_stream_9]
+    needs: [check_version, build_wheels, build_sdist, test_sdist, test_wheels_centos_stream_9, proofs]
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
+      contents: read # Checkout the same tag's artifact-identity verifier.
       id-token: write # Required for Trusted Publishing (OIDC)
 
     # Only publish on tag pushes
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
 
     steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
       - uses: actions/download-artifact@v4
         with:
           pattern: cibw-*
           path: dist
           merge-multiple: true
 
+      - uses: actions/download-artifact@v4
+        with:
+          name: proof-distribution-receipt
+          path: proof-evidence
+
+      - name: Publish exactly the artifacts whose proof distribution was checked
+        shell: bash
+        run: |
+          sdists=(dist/*.tar.gz)
+          [[ ${#sdists[@]} -eq 1 && -f ${sdists[0]} ]]
+          args=(--verify --sdist "${sdists[0]}" --receipt proof-evidence/receipt.json)
+          for wheel in dist/*.whl; do args+=(--wheel "$wheel"); done
+          python -I -B dev/proofs/package.py "${args[@]}"
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ba61abb..c7dd2a6 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Every job installs its Python tools with the pins of .github/ci-constraints.txt, pip itself
+# first. An editable install builds the package in an isolated environment of pip's own, which
+# since pip 26.2 takes only build constraints (--build-constraint), never -c: both name the same
+# file.
 jobs:
   test:
     name: Unit tests (${{ matrix.os }}, py${{ matrix.python-version }})
@@ -15,21 +19,37 @@ jobs:
       matrix:
         os: [ubuntu-22.04, macos-latest, windows-latest]
         python-version: ["3.11", "3.12", "3.13", "3.14"]
+        include:
+          # Free-threaded CPython (no GIL): the module declares py::mod_gil_not_used().
+          - os: ubuntu-22.04
+            python-version: "3.14t"
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      # bash on every OS: PowerShell would not stop when the first command fails.
       - name: Install deps
+        shell: bash
         run: |
-          python -m pip install -U pip wheel
-          python -m pip install -e .[dev]
-      - name: Run CI checks (lint + C++/Python tests)
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt --build-constraint .github/ci-constraints.txt -e ".[dev]"
+      - name: Run CI checks (lint + C++ tests with and without the hooks + Python tests)
         if: runner.os != 'Windows'
         run: make check-ci
+      # Windows runs the Python tests through the guard dev/run-checks.sh uses, without the shell
+      # script: the editable build must carry the private hooks and no test may skip.
       - name: Run Python tests (Windows)
         if: runner.os == 'Windows'
-        run: python -m pytest tests/py/ -v
+        run: python dev/pytest_guard.py on tests/py -v
+      # The timing tool of dev/perf compiles against the library (its adapter uses the public
+      # API and two private functions of the queue rule), and nothing else builds it: its own
+      # tests, which compile its driver with this checkout's library, run on one job, so a
+      # library change that breaks the tool fails here. macOS: the platform the tool is made
+      # and checked on (its build record and memory reading are macOS-first).
+      - name: Timing tool tests (macOS, py3.14)
+        if: runner.os == 'macOS' && matrix.python-version == '3.14'
+        run: make perf-tool-test
 
   test-centos-stream-9:
     name: CentOS Stream 9 (py${{ matrix.python-version }})
@@ -53,12 +73,87 @@ jobs:
 
       - name: Install Python deps
         run: |
-          python${{ matrix.python-version }} -m pip install -U pip wheel
-          python${{ matrix.python-version }} -m pip install -e .[dev]
+          python${{ matrix.python-version }} -m pip install -U -c .github/ci-constraints.txt pip
+          python${{ matrix.python-version }} -m pip install -c .github/ci-constraints.txt \
+            --build-constraint .github/ci-constraints.txt -e ".[dev]"
 
-      - name: Run CI checks (lint + C++/Python tests)
+      - name: Run CI checks (lint + C++ tests with and without the hooks + Python tests)
         run: PYTHON=python${{ matrix.python-version }} make check-ci
 
+  # The C++ tests with MSVC: a Release build with CMake's link-time optimisation (the wheel's
+  # configuration), with and without the private hooks.
+  cpp-windows-msvc:
+    name: C++ tests (windows, MSVC)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    env:
+      CC: cl
+      CXX: cl
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: |
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt cmake ninja
+      - uses: ilammy/msvc-dev-cmd@v1
+      - name: C++ tests, private hooks on
+        run: bash dev/cpp-tests.sh release
+      - name: C++ tests, private hooks off
+        run: bash dev/cpp-tests.sh off
+
+  sanitizers:
+    name: C++ tests (ubuntu, ASan + UBSan)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: |
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt cmake ninja
+      - name: C++ tests under AddressSanitizer and UndefinedBehaviorSanitizer
+        run: bash dev/cpp-tests.sh sanitize
+
+  thread-sanitizer:
+    name: C++ tests (macOS, ThreadSanitizer)
+    runs-on: macos-15
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: |
+          python -m pip install -U -c .github/ci-constraints.txt pip
+          python -m pip install -c .github/ci-constraints.txt cmake ninja
+      - name: C++ tests under ThreadSanitizer
+        run: bash dev/cpp-tests.sh tsan
+
+  # The generated type stub python/netgraph_core/__init__.pyi (make stubs-check): no drift from a
+  # fresh generation out of a wheel of this commit, the stub and py.typed in the wheel and the
+  # sdist, and the typed clients of tests/typing (valid: no diagnostic; invalid: exactly the
+  # expected ones) under pinned Pyright against the installed wheel and an installation built
+  # from the sdist. The script makes its own pinned venvs. Python 3.14: the version the
+  # committed stub is generated with.
+  stubs:
+    name: Type stub and typed clients (ubuntu, py3.14)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+      - name: Stub drift, package contents, typed clients (wheel and sdist)
+        run: PYTHON=python bash dev/stubs/run.sh check
+
   coverage:
     name: Coverage (ubuntu, py3.11)
     runs-on: ubuntu-22.04
@@ -67,10 +162,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
-      - name: Install deps
-        run: |
-          python -m pip install -U pip wheel
-          python -m pip install -e .[dev]
+      # make cov builds its own pinned venv (build/coverage-venv) and fails on any failure.
       - name: Generate coverage (Python + C++)
         run: make cov
       - name: Upload coverage artifacts
diff --git a/.gitignore b/.gitignore
index eca4b33..e0d3023 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,229 +1,38 @@
-# Byte-compiled / optimized / DLL files
+# Python
 __pycache__/
 *.py[codz]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-share/python-wheels/
 *.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py.cover
-.hypothesis/
-.pytest_cache/
-.benchmarks/
-cover/
-
-# Consolidated coverage artifacts
-build/coverage/
-
-# CTest output if created in project root
-Testing/
-CTestTestfile.cmake
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-.pybuilder/
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-# .python-version
-
-# pipenv
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-#Pipfile.lock
-
-# UV
-#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#uv.lock
-
-# poetry
-#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
-#poetry.toml
-
-# pdm
-#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
-#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
-#pdm.lock
-#pdm.toml
-.pdm-python
-.pdm-build/
-
-# pixi
-#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
-#pixi.lock
-#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
-#   in the .venv directory. It is recommended not to include this directory in version control.
-.pixi
-
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
-.env
-.envrc
-.venv
-env/
 venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
-
-# Pyre type checker
-.pyre/
-
-# pytype static type analyzer
-.pytype/
-
-# Cython debug symbols
-cython_debug/
-
-# PyCharm
-#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#  and can be added to the global gitignore or merged into this file.  For a more nuclear
-#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
-
-# Abstra
-# Abstra is an AI-powered process automation framework.
-# Ignore directories containing user credentials, local state, and settings.
-# Learn more at https://abstra.io/docs
-.abstra/
-
-# Visual Studio Code
-#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
-#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
-#  and can be added to the global gitignore or merged into this file. However, if you prefer,
-#  you could uncomment the following to ignore the entire vscode folder
-.vscode/
-
-# Ruff stuff:
+.venv/
+.pytest_cache/
 .ruff_cache/
 
-# PyPI configuration file
-.pypirc
+# Build outputs: CMake and scikit-build directories, distributions, compiled extensions
+build/
+dist/
+*.so
 
-# Cursor
-#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
-#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
-#  refer to https://docs.cursor.com/context/ignore-files
-.cursorignore
-.cursorindexingignore
+# Credentials of `make publish`
+.pypirc
 
-# OS-specific
-.DS_Store
+# The backup and reject files `patch` leaves beside the files it patches
+*.orig
+*.rej
 
-# IDEs
+# Editors and OS
+.vscode/
 .idea/
 *.code-workspace
+.DS_Store
 
-# Marimo
-marimo/_static/
-marimo/_lsp/
-__marimo__/
-.pgo-profile/
+# Local output of browser-automation tools (Playwright's MCP server)
+.playwright-mcp/
 
 # Personal Superset lifecycle overrides
 .superset/config.local.json
 
-# Performance harness run logs
-dev/perf/**/*.log
+# The performance tool's default output directory
+/dev/perf/results/
+
+# Lean dependencies, compiled declarations and local cache state.
+/proofs/.lake/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0dfd90b..3f8522a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,14 +4,12 @@ repos:
     hooks:
       - id: check-merge-conflict
       - id: check-yaml
-      # Recorded measurement artefacts and review patches must stay byte-exact.
       - id: end-of-file-fixer
-        exclude: ^dev/(research/|perf/.*/(results|review-[^/]+)/)
       - id: trailing-whitespace
-        exclude: ^dev/(research/|perf/.*/(results|review-[^/]+)/)
       - id: mixed-line-ending
       - id: debug-statements
 
+  # The revision matches the dev pin of Ruff (pyproject.toml).
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.11.13
     hooks:
@@ -19,9 +17,15 @@ repos:
         args: ["--fix"]
       - id: ruff-format
 
-  - repo: https://github.com/RobertCraigie/pyright-python
-    rev: v1.1.401
+  # Pyright needs the compiled extension _netgraph_core to resolve the package's imports, so it
+  # runs as make lint runs it: the pinned Pyright of the project's venv (make dev), whose
+  # interpreter has the extension built, over the whole project (pyproject.toml's settings).
+  # An isolated hook environment cannot hold the extension.
+  - repo: local
     hooks:
       - id: pyright
-        additional_dependencies: ["numpy>=1.22"]
-        # Pyright reads configuration from pyproject.toml
+        name: pyright
+        entry: venv/bin/python -m pyright --pythonpath venv/bin/python
+        language: system
+        types_or: [python, pyi]
+        pass_filenames: false
diff --git a/AGENTS.md b/AGENTS.md
index 917fa5f..f93beea 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,13 +3,20 @@
 - Setup: `bash .superset/workspace.sh setup`. Each worktree gets its own venv;
   setup does not replace the Git hooks shared by worktrees.
 - Superset **Run**: `bash .superset/workspace.sh check` rebuilds the Python
-  extension, then runs lint, types, C++ and Python tests. Editable Python imports
-  alone do not rebuild changed C++.
-- For C++ changes, also run `make sanitize-test` (ASan/UBSan; errors must fail).
+  extension, then runs lint, types, the C++ tests with and without the private
+  hooks, and the Python tests. Editable Python imports alone do not rebuild
+  changed C++.
+- For C++ changes, also run `make sanitize-test` (ASan/UBSan) and
+  `make tsan-test` (ThreadSanitizer); errors must fail.
 - For downstream changes, run NetGraph's `dev/check_core_integration.sh` with
   this worktree's absolute path. Test the chosen build, not the published wheel.
 
 Confirm defects with a reproducer. Max-flow tests need feasibility, conservation
-and optimality/cut checks with nonuniform costs, masks and cost-factor cases.
-Keep bindings and `_docs.py` consistent. Performance claims need correctness
-checks and A/B/A on one quiet machine. Local checks do not replace CI.
+and optimality/cut checks with nonuniform costs, excluded nodes and edges, and
+cost ceilings (AbsoluteCost, CostStretch).
+A binding signature or docstring change needs the regenerated type stub
+(`bash dev/stubs/run.sh generate`; `make stubs-check` checks drift, package
+contents and typed clients). Performance claims need correctness checks and
+A/B/A on one quiet machine (`dev/perf/README.md`; `make perf-tool-test` after
+changing that tool; CI runs it on one macOS job, as a library change can break
+it). Local checks do not replace CI.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2b5c1a..52275f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,94 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] - 2026-10-27
+
+**BREAKING.** The Core is rebuilt and its whole API changes: the graph works on integer units, one
+placement engine with four routing models takes the place of the 0.11 policy and algorithm
+objects, and three evaluators take the place of the 0.11 max-flow, batch max-flow and sensitivity
+calls. No 0.11 name survives as an alias or a warning. [docs/semantics.md](docs/semantics.md) states
+the new behaviour exactly.
+
+### Changed
+
+- **BREAKING: amounts are integers.** Capacities, offers, deliveries and drops are whole units of a
+  resolution `q` (a power of two in `[2^-32, 2^32]`) that each graph carries; `to_units` (rounding
+  half up) and `as_float` convert physical values, and all arithmetic is exact, with no tolerance.
+  0.11 used `float64` amounts.
+- **BREAKING: costs are at least 1.** Edge costs are integers `>= 1`; 0.11 accepted a cost of 0.
+- **BREAKING: edge numbering.** EdgeIds sort the edges by source, cost and destination, ties kept in
+  input order, and `input_positions()` maps an EdgeId to its input position. 0.11 sorted by cost,
+  source and destination and carried caller-supplied external ids.
+- **BREAKING: zero-capacity edges stay in routing.** Searches and routes use an edge of capacity 0,
+  a source that reaches a destination only over it still takes part, and an equal split sends it its
+  share, which is lost: zero capacity alone never excludes an edge. 0.11's equal split left such
+  edges out.
+- **BREAKING: distances** are `int64`, with `UNREACHABLE` for a node not reached; 0.11 returned
+  `float64` distances with `inf` by default.
+- **BREAKING: failure sensitivity** (`evaluate_edge_failures`) reports, with its baseline, a signed
+  and exact `delivery_reduction` for every candidate edge, zero and negative values included. 0.11
+  tested only saturated edges and returned only the reductions above 1/4096.
+- **Worker counts.** Without an explicit `workers`, `evaluate_pairs` and `evaluate_edge_failures`
+  take their worker count from `NGRAPH_CORE_BATCH_THREADS` and `NGRAPH_CORE_SENSITIVITY_THREADS`,
+  and use 1 when the variable is unset or invalid (0.11: the hardware concurrency); a supplied
+  `ShortestPathCache` defaults to 1.
+
+### Added
+
+- **Graph and units**: `Graph`, `Eligibility` (the nodes and edges a call may use, built from
+  excluded node and edge ids; a failure is an exclusion), `to_units`, `as_float`.
+- **Routes and searches**: `PredecessorDAG` and `Path`; `spf` (forward or reverse, to every node or
+  to the nearest targets, the structure containing every shortest route or one canonical path),
+  `ksp` with exact cost ceilings (`AbsoluteCost`, `CostStretch`) and `resolve_to_paths`;
+  `RouteTieBreak`, the one rule that orders equal-cost choices.
+- **Ledger**: `FlowLedger`, which keeps the traffic each edge carries apart from the bandwidth T1
+  tunnels reserve on it, and its `FlowRecord` snapshots.
+- **Policies**: `FlowPolicy` and `FlowPolicyConfig` route one demand from source nodes to
+  destination nodes with `LOSSLESS` or `LOSSY` admission. Choose `ShortestPaths` (ECMP, WCMP or a
+  controller on shortest routes), `DistributedTE` (T1 in the docs: RSVP-TE-style tunnels set up by
+  each source router), `CentralizedTE` (an ideal controller, optionally with equal-bandwidth
+  tunnels, T2 in the docs) or `Pinned` (replay of a saved program).
+- **Source allocation**: `EQUAL` splits the demand equally between its sources, `OPTIMIZED` lets
+  the controller choose, and `WEIGHTED` follows declared weights.
+- **Policy operations**: `place`, `evaluate`, `replace` and `forward` return a `PlacementResult`;
+  `remove` takes the policy's traffic out.
+- **Forwarding programs**: `ForwardingProgram`, produced by every computing model and built by
+  `ForwardingProgram.from_routes` and `ForwardingProgram.from_dag`.
+- **Several demands at once**: `apply_actions` with `Place`, `Replace` and `Forward` actions, one
+  after another (`ORDERED`) or at the same time (`SIMULTANEOUS`) with the losses on shared links
+  divided between the demands.
+- **Shortest-path cache**: `ShortestPathCache`, building or frozen, shared by the evaluators'
+  workers.
+- **Evaluators**: `evaluate_demand`, `evaluate_pairs` and `evaluate_edge_failures`, with one
+  `EvaluationOptions` and an optional finite offer, which every model accepts.
+- **Guarantees**: every public call either completes or changes nothing, except that running out of
+  memory inside pybind11's own object construction may crash the process, and a supplied
+  shortest-path cache may keep completed entries and lookup statistics; native work releases the
+  GIL, placements included, and calls on one ledger take effect one at a time.
+- **Proofs**: the round-robin rule that splits whole units among members in order, and the
+  increments it gives when an offer grows over several calls, have machine-checked Lean proofs of
+  their stated properties, explained with worked examples in
+  [docs/formal/theorems/round-robin.md](docs/formal/theorems/round-robin.md). Nothing changes at
+  run time, and installing the package does not need Lean.
+- **Typing**: the package ships `py.typed` and a type stub that carries the docstrings.
+- **C++**: the same API in self-contained headers under `netgraph/core/` (`types.hpp`, `graph.hpp`,
+  `eligibility.hpp`, `options.hpp`, `route_structures.hpp`, `forwarding_program.hpp`, `search.hpp`,
+  `flow_record.hpp`, `flow_ledger.hpp`, `flow_policy.hpp`, `shortest_path_cache.hpp`,
+  `evaluators.hpp`).
+
+### Removed
+
+- **BREAKING:** the 0.11 Python API: `StrictMultiDiGraph`, `FlowGraph`, `FlowState`, `Algorithms`,
+  `Backend` with its `Graph` handle, `EdgeSelection`, `EdgeTieBreak`, `FlowPlacement`, `PathAlg`,
+  `PredDAG`, `FlowIndex`, `FlowSummary`, `MinCut`, the 0.11 forms of `FlowPolicy` and
+  `FlowPolicyConfig`, and the profiling functions `profiling_enabled`, `profiling_dump` and
+  `profiling_reset`.
+- **BREAKING:** the 0.11 C++ headers `algorithms.hpp`, `backend.hpp`, `constants.hpp`, `flow.hpp`,
+  `flow_graph.hpp`, `flow_state.hpp`, `k_shortest_paths.hpp`, `max_flow.hpp`, `profiling.hpp`,
+  `shortest_paths.hpp` and `strict_multidigraph.hpp`, and the 0.11 contents of `flow_policy.hpp`,
+  `options.hpp` and `types.hpp`.
+- The environment variables `NGRAPH_CORE_PROFILE` and `NGRAPH_CORE_SPF_QUEUE`.
+
 ## [0.11.0] - 2026-10-02
 
 ### Changed
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1f08d4c..528c972 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,47 +1,34 @@
 cmake_minimum_required(VERSION 3.23)
 project(netgraph_core LANGUAGES CXX)
-# Silence pybind11 FindPython compatibility warning by selecting the modern mode
-set(PYBIND11_FINDPYTHON NEW CACHE STRING "Use modern FindPython in pybind11")
-# Optional C++ tests
+
+# =============================================================================
+# Options. Every build states them on its command line (pyproject.toml for pip builds,
+# dev/cpp-tests.sh for the C++ test builds), so a value cached by an earlier configure of the same
+# build directory never decides a later build.
+# =============================================================================
+
 option(NETGRAPH_CORE_BUILD_TESTS "Build C++ unit tests" OFF)
-if(NETGRAPH_CORE_BUILD_TESTS)
-  include(FetchContent)
-  FetchContent_Declare(
-    googletest
-    URL https://github.com/google/googletest/archive/refs/tags/v1.14.0.zip
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
-  )
-  FetchContent_MakeAvailable(googletest)
-  enable_testing()
-add_executable(netgraph_core_tests
-  tests/cpp/smoke_test.cpp
-  tests/cpp/flow_policy_tests.cpp
-  tests/cpp/strict_multidigraph_tests.cpp
-  tests/cpp/shortest_paths_tests.cpp
-  tests/cpp/flow_state_tests.cpp
-  tests/cpp/flow_graph_tests.cpp
-  tests/cpp/max_flow_tests.cpp
-  tests/cpp/k_shortest_paths_tests.cpp
-  tests/cpp/masking_tests.cpp
-)
-  target_link_libraries(netgraph_core_tests PRIVATE netgraph_core GTest::gtest_main)
-  target_include_directories(netgraph_core_tests PRIVATE tests/cpp)
-  if(NETGRAPH_CORE_COVERAGE AND (CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang"))
-    # Atomic counters: see the NETGRAPH_CORE_COVERAGE block below.
-    target_compile_options(netgraph_core_tests PRIVATE -O0 -g --coverage)
-    if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
-      target_compile_options(netgraph_core_tests PRIVATE -fprofile-update=atomic)
-    endif()
-    target_link_options(netgraph_core_tests PRIVATE --coverage)
-  endif()
-  include(GoogleTest)
-  gtest_discover_tests(netgraph_core_tests)
+# The private hooks (test controls, and diagnostics such as the placement trace that the tests
+# compare with the reference under tests/reference/policy/; neither is public API):
+# ON for the editable development build (pyproject.toml) and the hooks-on test suites
+# (dev/cpp-tests.sh), OFF for a wheel and for the hooks-off test suite.
+option(NETGRAPH_CORE_PRIVATE_HOOKS "Build the private test hooks into the library and the extension" OFF)
+option(NETGRAPH_CORE_COVERAGE "Enable C++ coverage instrumentation" OFF)
+option(NETGRAPH_CORE_SANITIZE "Enable Address/Undefined sanitizers" OFF)
+option(NETGRAPH_CORE_TSAN "Enable ThreadSanitizer" OFF)
+option(NETGRAPH_CORE_NATIVE "Optimize for current CPU (not portable)" OFF)
+if(NETGRAPH_CORE_SANITIZE AND NETGRAPH_CORE_TSAN)
+  # ThreadSanitizer cannot be combined with AddressSanitizer in one binary.
+  message(FATAL_ERROR "NETGRAPH_CORE_SANITIZE and NETGRAPH_CORE_TSAN are mutually exclusive")
 endif()
 
+# Settings for every target: CMake applies them to targets created later, so they come first.
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+# Silence pybind11 FindPython compatibility warning by selecting the modern mode
+set(PYBIND11_FINDPYTHON NEW CACHE STRING "Use modern FindPython in pybind11")
 
 # macOS: enforce consistent deployment target and architecture for wheels/builds
 if(APPLE)
@@ -59,81 +46,211 @@ if(APPLE)
   endif()
 endif()
 
-# Dependencies
-find_package(pybind11 3 CONFIG QUIET)
+# Dependencies. pybind11 is exactly the version pinned in pyproject.toml's build requirements,
+# whose licence notice the wheel ships (third_party/pybind11/LICENSE).
+find_package(pybind11 3.1.0 EXACT CONFIG QUIET)
 if(NOT pybind11_FOUND)
-  message(STATUS "pybind11 not found via config; using FetchContent")
+  message(STATUS "pybind11 3.1.0 not found via config; using FetchContent")
   include(FetchContent)
   FetchContent_Declare(
     pybind11
-    GIT_REPOSITORY https://github.com/pybind/pybind11.git
-    GIT_TAG v3.0.0
+    URL https://github.com/pybind/pybind11/archive/refs/tags/v3.1.0.tar.gz
+    URL_HASH SHA256=ef712655692a2e9bf7bb7874c022564a45f91d847ddee987e720cd9e28849665
     DOWNLOAD_EXTRACT_TIMESTAMP TRUE
   )
   FetchContent_MakeAvailable(pybind11)
 endif()
 
+# =============================================================================
+# Targets
+# =============================================================================
 
 add_library(netgraph_core STATIC
-  src/strict_multidigraph.cpp
-  src/shortest_paths.cpp
-  src/k_shortest_paths.cpp
-  src/max_flow.cpp
-  src/flow_state.cpp
-  src/flow_graph.cpp
+  src/concurrency.cpp
+  src/graph.cpp
+  src/eligibility.cpp
+  src/min_cost_flow.cpp
+  src/route_structures.cpp
+  src/search.cpp
+  src/route_kernels.cpp
+  src/flow_ledger.cpp
+  src/shortest_path_cache.cpp
   src/flow_policy.cpp
-  src/cpu_backend.cpp
-  src/profiling.cpp
+  src/evaluators.cpp
+  src/forwarding_program.cpp
+  src/forwarding.cpp
+  src/distributed_te.cpp
+  src/centralized_te_tunnels.cpp
 )
 target_include_directories(netgraph_core PUBLIC
   $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
   $<INSTALL_INTERFACE:include>
 )
-## C++ standard is set globally above.
+# PUBLIC: the library, the extension and the tests see one value (0 or 1).
+target_compile_definitions(netgraph_core PUBLIC NETGRAPH_CORE_PRIVATE_HOOKS=$<BOOL:${NETGRAPH_CORE_PRIVATE_HOOKS}>)
 target_compile_features(netgraph_core PUBLIC cxx_std_20)
 
-# Warnings
-if(MSVC)
-  target_compile_options(netgraph_core PRIVATE /W4 /permissive-)
-else()
-  target_compile_options(netgraph_core PRIVATE -Wall -Wextra -Wpedantic)
-endif()
-
-# Python extension
-pybind11_add_module(_netgraph_core bindings/python/module.cpp)
+# Python extension: the module entry and its registration files (bindings/python/), in the
+# order the entry calls them; the shared helpers are headers there.
+pybind11_add_module(_netgraph_core
+  bindings/python/module.cpp
+  bindings/python/options.cpp
+  bindings/python/units.cpp
+  bindings/python/eligibility.cpp
+  bindings/python/graph.cpp
+  bindings/python/flow_solver_hook.cpp
+  bindings/python/predecessor_dag.cpp
+  bindings/python/path.cpp
+  bindings/python/flow_record.cpp
+  bindings/python/flow_ledger.cpp
+  bindings/python/forwarding_program.cpp
+  bindings/python/routing_models.cpp
+  bindings/python/flow_policy_config.cpp
+  bindings/python/placement_result.cpp
+  bindings/python/shortest_path_cache.cpp
+  bindings/python/flow_policy.cpp
+  bindings/python/apply_actions.cpp
+  bindings/python/evaluators.cpp
+  bindings/python/path_enumeration.cpp
+  bindings/python/search.cpp
+  bindings/python/hooks.cpp
+  bindings/python/concurrency_hooks.cpp
+)
+# The library's PUBLIC usage requirements (C++20, the hooks flag, the libc++ settings below) reach
+# the extension through this link.
 target_link_libraries(_netgraph_core PRIVATE netgraph_core)
-target_compile_features(_netgraph_core PRIVATE cxx_std_20)
 if(APPLE)
   # Prefer maximum runtime compatibility for libc++ on macOS
   target_compile_definitions(netgraph_core PUBLIC _LIBCPP_DISABLE_AVAILABILITY=1 _LIBCPP_ABI_VERSION=1)
-  target_compile_definitions(_netgraph_core PRIVATE _LIBCPP_DISABLE_AVAILABILITY=1 _LIBCPP_ABI_VERSION=1)
 endif()
 
+# The targets that get the project's warnings and either the link-time optimisation (where the
+# compiler supports it) or, in a coverage or sanitizer build, the instrumentation: the library,
+# the extension and, in a test build, the two test executables (added below). The header
+# self-containment check below is not one of them. The extra code-generation flags go to the
+# library and the extension only.
+set(NETGRAPH_CORE_PROJECT_TARGETS netgraph_core _netgraph_core)
+
+if(NETGRAPH_CORE_BUILD_TESTS)
+  include(FetchContent)
+  FetchContent_Declare(
+    googletest
+    URL https://github.com/google/googletest/archive/refs/tags/v1.14.0.zip
+    URL_HASH SHA256=1f357c27ca988c3f7c6b4bf68a9395005ac6761f034046e9dde0896e3aba00e4
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+  )
+  # MSVC: link googletest against the same (shared) C runtime as the project.
+  set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+  FetchContent_MakeAvailable(googletest)
+  # googletest itself stays at C++17 (under C++20 its char8_t printer warns with Clang 21); the
+  # project's tests below are C++20 like the library.
+  set_target_properties(gtest gtest_main gmock gmock_main PROPERTIES CXX_STANDARD 17)
+  enable_testing()
+  add_executable(netgraph_core_tests
+    tests/cpp/graph_tests.cpp
+    tests/cpp/graph_layout_tests.cpp
+    tests/cpp/graph_concurrency_tests.cpp
+    tests/cpp/concurrency_tests.cpp
+    tests/cpp/min_cost_flow_tests.cpp
+    tests/cpp/min_cost_flow_deletion_tests.cpp
+    tests/cpp/eligibility_tests.cpp
+    tests/cpp/route_structures_tests.cpp
+    tests/cpp/search_tests.cpp
+    tests/cpp/ksp_tests.cpp
+    tests/cpp/shortest_path_cache_tests.cpp
+    tests/cpp/route_kernels_tests.cpp
+    tests/cpp/shortest_paths_creation_tests.cpp
+    tests/cpp/flow_ledger_tests.cpp
+    tests/cpp/flow_policy_fixture_tests.cpp
+    tests/cpp/flow_policy_tests.cpp
+    tests/cpp/epoch_static_tests.cpp
+    tests/cpp/weighted_source_tests.cpp
+    tests/cpp/zero_capacity_tests.cpp
+    tests/cpp/pooled_source_allocation_tests.cpp
+    tests/cpp/program_tests.cpp
+    tests/cpp/joint_forwarding_tests.cpp
+    tests/cpp/apply_actions_tests.cpp
+    tests/cpp/distributed_te_tests.cpp
+    tests/cpp/centralized_te_tunnels_tests.cpp
+    tests/cpp/contract_examples_tests.cpp
+    tests/cpp/public_names_tests.cpp
+  )
+  target_compile_definitions(netgraph_core_tests PRIVATE NETGRAPH_CORE_TEST_DATA="${CMAKE_CURRENT_SOURCE_DIR}/tests/data")
+  # Allocation-failure tests replace the global operator new: a separate executable.
+  add_executable(netgraph_core_fault_tests
+    tests/cpp/fault_injection.cpp
+    tests/cpp/flow_ledger_fault_tests.cpp
+    tests/cpp/flow_policy_fault_tests.cpp
+    tests/cpp/apply_actions_fault_tests.cpp
+    tests/cpp/min_cost_flow_deletion_fault_tests.cpp
+    tests/cpp/search_fault_tests.cpp
+    tests/cpp/graph_fault_tests.cpp
+  )
+  foreach(tgt netgraph_core_tests netgraph_core_fault_tests)
+    target_link_libraries(${tgt} PRIVATE netgraph_core GTest::gtest_main)
+    target_include_directories(${tgt} PRIVATE tests/cpp)
+  endforeach()
+  # Every public header compiles on its own: one generated source file per header, holding only
+  # its include, built with the test executables. No public header names a private detail/
+  # header in an #include (the configure stops on one).
+  file(GLOB NETGRAPH_CORE_PUBLIC_HEADERS RELATIVE ${CMAKE_CURRENT_SOURCE_DIR}/include
+       CONFIGURE_DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/include/netgraph/core/*.hpp)
+  set(NETGRAPH_CORE_HEADER_CHECKS)
+  foreach(header ${NETGRAPH_CORE_PUBLIC_HEADERS})
+    file(STRINGS ${CMAKE_CURRENT_SOURCE_DIR}/include/${header} private_includes
+         REGEX "^[ \t]*#[ \t]*include[ \t]*[\"<][^\">]*detail/")
+    if(private_includes)
+      message(FATAL_ERROR "public header ${header} includes a private detail/ header: ${private_includes}")
+    endif()
+    string(MAKE_C_IDENTIFIER ${header} id)
+    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/header_checks/${id}.cpp CONTENT "#include \"${header}\"\n")
+    list(APPEND NETGRAPH_CORE_HEADER_CHECKS ${CMAKE_CURRENT_BINARY_DIR}/header_checks/${id}.cpp)
+  endforeach()
+  add_library(netgraph_core_header_checks OBJECT ${NETGRAPH_CORE_HEADER_CHECKS})
+  target_link_libraries(netgraph_core_header_checks PRIVATE netgraph_core)
+  add_dependencies(netgraph_core_tests netgraph_core_header_checks)
+  list(APPEND NETGRAPH_CORE_PROJECT_TARGETS netgraph_core_tests netgraph_core_fault_tests)
+  include(GoogleTest)
+  gtest_discover_tests(netgraph_core_tests)
+  # The fault sweeps fail every allocation of a call in turn, each with a clean retry, and some
+  # create and join worker threads: under ASan on a CI runner one sweep took nearly ten minutes.
+  # Every attempt is kept; each fault test gets thirty minutes.
+  gtest_discover_tests(netgraph_core_fault_tests PROPERTIES TIMEOUT 1800)
+endif()
+
+# Warnings: the project's set on the library, the extension and the test executables (the list
+# above); third-party code keeps its own.
+if(MSVC)
+  set(NETGRAPH_CORE_WARNINGS /W4 /permissive-)
+else()
+  set(NETGRAPH_CORE_WARNINGS -Wall -Wextra -Wpedantic)
+endif()
+foreach(tgt ${NETGRAPH_CORE_PROJECT_TARGETS})
+  target_compile_options(${tgt} PRIVATE ${NETGRAPH_CORE_WARNINGS})
+endforeach()
+
 # =============================================================================
 # Performance optimizations (disabled when coverage/sanitizers are enabled)
 # =============================================================================
 
-option(NETGRAPH_CORE_COVERAGE "Enable C++ coverage instrumentation" OFF)
-option(NETGRAPH_CORE_SANITIZE "Enable Address/Undefined sanitizers" OFF)
-option(NETGRAPH_CORE_NATIVE "Optimize for current CPU (not portable)" OFF)
-option(NETGRAPH_CORE_FAST_MATH "Enable fast math (may affect precision)" OFF)
-option(NETGRAPH_CORE_PGO_GENERATE "Instrument for PGO profile collection" OFF)
-option(NETGRAPH_CORE_PGO_USE "Use PGO profile data (set NETGRAPH_CORE_PGO_DIR)" OFF)
-set(NETGRAPH_CORE_PGO_DIR "${CMAKE_BINARY_DIR}/pgo" CACHE PATH "Directory for PGO profile data")
-
-# Only apply optimizations when not in debug/instrumentation mode
-if(NOT NETGRAPH_CORE_COVERAGE AND NOT NETGRAPH_CORE_SANITIZE)
-  # LTO (Link Time Optimization) - enables cross-module inlining
+# Apply the extra optimization settings when coverage and sanitizers are off (whatever the build
+# type: a Debug build gets them too).
+if(NOT NETGRAPH_CORE_COVERAGE AND NOT NETGRAPH_CORE_SANITIZE AND NOT NETGRAPH_CORE_TSAN)
+  # LTO (Link Time Optimization) - enables cross-module inlining. LANGUAGES CXX: googletest
+  # enables C as well, and the check would otherwise require LTO support for C too and turn LTO
+  # off in every test build. The test executables are LTO-linked like the extension, so the C++
+  # tests exercise the code generation that ships.
   include(CheckIPOSupported)
-  check_ipo_supported(RESULT ipo_supported OUTPUT ipo_error)
+  check_ipo_supported(RESULT ipo_supported OUTPUT ipo_error LANGUAGES CXX)
   if(ipo_supported)
     message(STATUS "Enabling LTO (Link Time Optimization)")
-    set_target_properties(netgraph_core PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
-    set_target_properties(_netgraph_core PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+    set_target_properties(${NETGRAPH_CORE_PROJECT_TARGETS} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
   else()
     message(STATUS "LTO not supported: ${ipo_error}")
   endif()
 
+  # MSVC gets no extra flags: its build type's optimisation (/O2 in Release) and CMake's LTO (/GL
+  # with the matching /LTCG link option) suffice.
   if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
     # GCC-only: allow aggressive inlining by promising symbols won't be interposed
     if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
@@ -155,78 +272,33 @@ if(NOT NETGRAPH_CORE_COVERAGE AND NOT NETGRAPH_CORE_SANITIZE)
       target_compile_options(netgraph_core PRIVATE -march=native)
       target_compile_options(_netgraph_core PRIVATE -march=native)
     endif()
-
-    # Fast math - trades IEEE compliance for speed
-    if(NETGRAPH_CORE_FAST_MATH)
-      message(STATUS "Enabling fast math optimizations")
-      target_compile_options(netgraph_core PRIVATE -ffast-math)
-      target_compile_options(_netgraph_core PRIVATE -ffast-math)
-    endif()
-
-    # PGO (Profile-Guided Optimization) - uses runtime profile to guide inlining decisions
-    # GCC: -fprofile-generate/-fprofile-use, Clang: -fprofile-instr-*
-    if(NETGRAPH_CORE_PGO_GENERATE)
-      message(STATUS "PGO: Instrumenting for profile generation -> ${NETGRAPH_CORE_PGO_DIR}")
-      file(MAKE_DIRECTORY ${NETGRAPH_CORE_PGO_DIR})
-      if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
-        target_compile_options(netgraph_core PRIVATE -fprofile-generate=${NETGRAPH_CORE_PGO_DIR})
-        target_compile_options(_netgraph_core PRIVATE -fprofile-generate=${NETGRAPH_CORE_PGO_DIR})
-        target_link_options(netgraph_core PRIVATE -fprofile-generate=${NETGRAPH_CORE_PGO_DIR})
-        target_link_options(_netgraph_core PRIVATE -fprofile-generate=${NETGRAPH_CORE_PGO_DIR})
-      else()
-        # Clang/AppleClang: use LLVM instrumentation PGO
-        target_compile_options(netgraph_core PRIVATE -fprofile-instr-generate=${NETGRAPH_CORE_PGO_DIR}/default.profraw)
-        target_compile_options(_netgraph_core PRIVATE -fprofile-instr-generate=${NETGRAPH_CORE_PGO_DIR}/default.profraw)
-        target_link_options(netgraph_core PRIVATE -fprofile-instr-generate=${NETGRAPH_CORE_PGO_DIR}/default.profraw)
-        target_link_options(_netgraph_core PRIVATE -fprofile-instr-generate=${NETGRAPH_CORE_PGO_DIR}/default.profraw)
-      endif()
-    elseif(NETGRAPH_CORE_PGO_USE)
-      message(STATUS "PGO: Using profile data from ${NETGRAPH_CORE_PGO_DIR}")
-      if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
-        target_compile_options(netgraph_core PRIVATE -fprofile-use=${NETGRAPH_CORE_PGO_DIR} -fprofile-correction)
-        target_compile_options(_netgraph_core PRIVATE -fprofile-use=${NETGRAPH_CORE_PGO_DIR} -fprofile-correction)
-      else()
-        # Clang/AppleClang: use merged .profdata file
-        target_compile_options(netgraph_core PRIVATE -fprofile-instr-use=${NETGRAPH_CORE_PGO_DIR}/default.profdata)
-        target_compile_options(_netgraph_core PRIVATE -fprofile-instr-use=${NETGRAPH_CORE_PGO_DIR}/default.profdata)
-      endif()
-    endif()
-  elseif(MSVC)
-    # /O2: full optimization, /GL: whole program optimization (MSVC's LTO)
-    target_compile_options(netgraph_core PRIVATE /O2 /GL)
-    target_compile_options(_netgraph_core PRIVATE /O2 /GL)
-    if(NETGRAPH_CORE_FAST_MATH)
-      target_compile_options(netgraph_core PRIVATE /fp:fast)
-      target_compile_options(_netgraph_core PRIVATE /fp:fast)
-    endif()
   endif()
 endif()
 
 # =============================================================================
-# Debug/instrumentation options (mutually exclusive with optimizations above)
+# Coverage and sanitizer options (mutually exclusive with the extra optimizations above). A request
+# the compiler cannot honour stops the configure: a build that ran its tests without the requested
+# checker would otherwise report success.
 # =============================================================================
 
 if(NETGRAPH_CORE_COVERAGE)
   message(STATUS "Enabling coverage instrumentation (disables optimizations)")
   if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
-    # batch_max_flow and sensitivity_analysis run worker threads, and the default
-    # non-atomic profile counters corrupt under concurrent updates (gcov then
-    # emits impossible values such as "branch 4 taken -1").
-    set(COV_FLAGS -O0 -g --coverage)
-    if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
-      list(APPEND COV_FLAGS -fprofile-update=atomic)
-    endif()
-    foreach(tgt netgraph_core _netgraph_core)
+    # Atomic counters (GCC and Clang): the evaluators' worker threads corrupt the default
+    # non-atomic profile counters under concurrent updates (gcov then emits impossible values
+    # such as "branch 4 taken -1").
+    set(COV_FLAGS -O0 -g --coverage -fprofile-update=atomic)
+    foreach(tgt ${NETGRAPH_CORE_PROJECT_TARGETS})
       target_compile_options(${tgt} PRIVATE ${COV_FLAGS})
       target_link_options(${tgt} PRIVATE --coverage)
     endforeach()
   else()
-    message(WARNING "NETGRAPH_CORE_COVERAGE requires GCC or Clang")
+    message(FATAL_ERROR "NETGRAPH_CORE_COVERAGE requires GCC or Clang")
   endif()
 endif()
 
 if(NETGRAPH_CORE_SANITIZE)
-  message(STATUS "Enabling sanitizers (disables optimizations)")
+  message(STATUS "Enabling sanitizers (without the extra optimizations)")
   if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
     # Must be a CMake list: a single quoted string reaches the compiler as one
     # argument and clang rejects "-fsanitize=address,undefined -fno-omit-frame-pointer".
@@ -237,18 +309,34 @@ if(NETGRAPH_CORE_SANITIZE)
     # and then silently ignored, which is indistinguishable from not checking at all.
     set(SAN_FLAGS -fsanitize=address,undefined -fno-omit-frame-pointer
                   -fno-sanitize-recover=undefined)
-    set(SAN_TARGETS netgraph_core _netgraph_core)
-    if(TARGET netgraph_core_tests)
-      # The test executable links the sanitized static library, so it must be
-      # built and linked with the same flags to pull in the sanitizer runtime.
-      list(APPEND SAN_TARGETS netgraph_core_tests)
-    endif()
-    foreach(tgt ${SAN_TARGETS})
+    # The test executables link the sanitized static library, so they are built and linked with
+    # the same flags to pull in the sanitizer runtime.
+    foreach(tgt ${NETGRAPH_CORE_PROJECT_TARGETS})
       target_compile_options(${tgt} PRIVATE ${SAN_FLAGS})
       target_link_options(${tgt} PRIVATE ${SAN_FLAGS})
     endforeach()
   else()
-    message(WARNING "NETGRAPH_CORE_SANITIZE requires GCC or Clang")
+    message(FATAL_ERROR "NETGRAPH_CORE_SANITIZE requires GCC or Clang")
+  endif()
+endif()
+
+if(NETGRAPH_CORE_TSAN)
+  message(STATUS "Enabling ThreadSanitizer (without the extra optimizations)")
+  if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
+    # The data-race check of the evaluators' worker threads and the shared ShortestPathCache. A CMake
+    # list, as SAN_FLAGS above. A report makes the process exit non-zero (TSan's exit code 66,
+    # or an abort under the halt_on_error=1 of dev/cpp-tests.sh), so ctest fails on any race. -O1
+    # as the TSan documentation advises (the Debug build type adds -g); the instrumented
+    # suites at -O0 would be several times slower for no extra coverage.
+    set(TSAN_FLAGS -fsanitize=thread -fno-omit-frame-pointer -O1)
+    # The test executables link the instrumented static library: same compile and link flags, so
+    # they carry the TSan runtime and their own accesses are instrumented too.
+    foreach(tgt ${NETGRAPH_CORE_PROJECT_TARGETS})
+      target_compile_options(${tgt} PRIVATE ${TSAN_FLAGS})
+      target_link_options(${tgt} PRIVATE ${TSAN_FLAGS})
+    endforeach()
+  else()
+    message(FATAL_ERROR "NETGRAPH_CORE_TSAN requires GCC or Clang")
   endif()
 endif()
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6cd3577..34d629e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,7 +9,7 @@ NetGraph-Core is a hybrid C++/Python project. You will need:
 - Python 3.11+
 - C++20 compatible compiler (GCC 10+, Clang 12+, MSVC 2019+)
 - CMake 3.23+
-- Ninja (recommended)
+- Ninja (the C++ test runner uses it; `make dev` installs CMake and Ninja into the venv)
 
 ### 1. Clone the repository
 
@@ -37,7 +37,11 @@ This will:
 
 ### Running Tests
 
-Run all checks (linting + C++ tests + Python tests):
+Run all checks: rebuild the editable extension, then lint (ruff, pyright), the check that the
+policy fixture data still equals its frozen reference (`tests/reference/policy/README.md`), the
+C++ tests with and without the private test hooks, and the Python tests. It only verifies and
+never edits a file; `make check-ci` is the same without the rebuild (CI installs the package
+itself):
 
 ```bash
 make check
@@ -46,8 +50,12 @@ make check
 Run specific test suites:
 
 ```bash
-make cpp-test   # C++ tests (GoogleTest)
-make test       # Python tests (pytest)
+make cpp-test       # C++ tests (GoogleTest), private hooks on
+make cpp-test-off   # C++ tests without the hooks (the shipped configuration)
+make test           # Python tests (pytest)
+make sanitize-test  # C++ tests under ASan/UBSan (required for C++ changes)
+make tsan-test      # C++ tests under ThreadSanitizer (required for C++ changes)
+make cov            # Coverage of the C++ and Python suites (its own venv and builds)
 ```
 
 ### Code Style
@@ -55,26 +63,54 @@ make test       # Python tests (pytest)
 - **Python**: We use `ruff` for linting and formatting, and `pyright` for static type checking.
 - **C++**: We follow standard C++20 practices.
 
-Auto-fix Python formatting:
+Apply fixes (these edit files):
 
 ```bash
-make format
+make format   # ruff formatting
+make hooks    # every pre-commit hook, including ruff --fix and whitespace fixers
 ```
 
+The commit hook and `make hooks` run Pyright as `make lint` does, from the `make dev` venv: it
+needs the built extension to resolve the package's imports.
+
+### Type Stub
+
+`python/netgraph_core/__init__.pyi` is generated from the compiled module. After changing a
+binding's signature or docstring, run `bash dev/stubs/run.sh generate` and commit the stub;
+`make stubs-check` (also in CI) fails when the stub drifts or the typed client checks fail.
+
+### Behaviour Documentation
+
+[docs/semantics.md](docs/semantics.md) is the maintained statement of what the library computes.
+A change to observable behaviour (a result, an order, an outcome, an error, a default) updates it
+in the same change, and its examples must still print what the document shows:
+`tests/py/test_docs_examples.py` runs them, and README's quick start, in the Python tests.
+
+### Mathematical Proofs
+
+`proofs/` is a Lean project that proves properties of the round-robin rule;
+[proofs/README.md](proofs/README.md) gives the commands and
+[dev/proofs/README.md](dev/proofs/README.md) the rules for adding or changing a theorem. Ordinary
+native and Python development does not need Lean. A theorem is accepted only with a plain
+explanation of its statement and its proof, supporting lemmas included, that an engineer without
+mathematical training can follow: a worked example and a boundary example, and a failing case
+for each assumption that can fail, with every input, step and result explained.
+
 ## Release Process
 
 Releases are automated via GitHub Actions when a new tag is pushed.
 
 1. Move the pending notes into a new `## [X.Y.Z] - YYYY-MM-DD` section in `CHANGELOG.md`,
    dated the day you tag. Mark anything that breaks consumers as **BREAKING**.
-2. Bump `version` in `pyproject.toml` to the same `X.Y.Z`. CI does not cross-check the
-   tag against this value, so a mismatch publishes the wrong version silently.
-3. Commit and push.
+2. Bump `version` in `pyproject.toml` to the same `X.Y.Z`. Release CI compares the tag
+   with this value and refuses to publish on a mismatch.
+3. Commit and push, then wait for the `Lean verification` workflow to pass on the pushed
+   branch: publication waits for the same workflow on the tag, so a failure there blocks it.
 4. Create and push a matching tag:
 
    ```bash
-   git tag v0.8.0
-   git push origin v0.8.0
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
    ```
 
 5. The CI pipeline builds wheels and the sdist, tests them, and publishes to PyPI via
diff --git a/Makefile b/Makefile
index 3828d0f..feb6218 100644
--- a/Makefile
+++ b/Makefile
@@ -1,14 +1,14 @@
 # NetGraph-Core Development Makefile
 
-.PHONY: help venv clean-venv dev install install-native install-pgo check check-ci lint format test qt build clean check-dist publish-test publish info hooks check-python cpp-test cov sanitize-test rebuild
+.PHONY: help venv clean-venv dev install install-native check check-ci lint format test build clean check-dist publish-test publish info hooks check-python cpp-test cpp-test-off cov sanitize-test tsan-test stubs-check perf-tool-test rebuild
 
 .DEFAULT_GOAL := help
 
 # --------------------------------------------------------------------------
 # Python interpreter detection
 # --------------------------------------------------------------------------
-# VENV_BIN: path to local virtualenv bin directory
-VENV_BIN := $(PWD)/venv/bin
+# VENV_BIN: the checkout's virtualenv bin directory (CURDIR is the directory make runs in, -C included)
+VENV_BIN := $(CURDIR)/venv/bin
 
 # PY_BEST: scan for newest supported Python (used when creating new venvs)
 # Supports 3.11-3.14 to match requires-python >=3.11
@@ -41,22 +41,27 @@ help:
 	@echo "Setup & Installation:"
 	@echo "  make venv          - Create a local virtualenv (./venv)"
 	@echo "  make dev           - Full development environment (package + dev deps + hooks)"
-	@echo "  make install       - Install package (default optimizations: LTO, loop unrolling)"
+	@echo "  make install       - Install package (editable, private hooks; LTO, loop unrolling)"
 	@echo "  make install-native - Install with CPU-specific optimizations (faster, not portable)"
-	@echo "  make install-pgo   - Profile-guided optimization (two-phase build, experimental)"
 	@echo "  make clean-venv    - Remove virtual environment"
 	@echo "  make rebuild       - Clean and rebuild (respects CMAKE_ARGS)"
 	@echo ""
 	@echo "Code Quality & Testing:"
-	@echo "  make check         - Run pre-commit (auto-fix) + C++/Python tests, then lint"
-	@echo "  make check-ci      - Run non-mutating lint + tests (CI entrypoint)"
+	@echo "  make check         - Rebuild the editable extension, then everything check-ci runs"
+	@echo "  make check-ci      - Lint, fixture data check, the pytest guard's rules, C++ tests (hooks on and off), Python tests"
+	@echo "                       (the CI entrypoint)"
+	@echo "                       (check and check-ci only verify: they never edit a file)"
 	@echo "  make lint          - Run only linting (non-mutating: ruff + pyright)"
-	@echo "  make format        - Auto-format code with ruff"
+	@echo "  make format        - Auto-format code with ruff (edits files)"
 	@echo "  make test          - Run Python tests (pytest)"
-	@echo "  make qt            - Run quick tests only (exclude slow/benchmark)"
-	@echo "  make cpp-test      - Build and run C++ tests"
-	@echo "  make cov           - Coverage summary + XML + single-page combined HTML"
+	@echo "  make cpp-test      - Build and run C++ tests (private hooks on)"
+	@echo "  make cpp-test-off  - Build and run C++ tests without the hooks (the shipped configuration)"
+	@echo "  make cov           - Coverage (own venv and builds) + XML + single-page combined HTML"
 	@echo "  make sanitize-test - Build and run C++ tests with sanitizers"
+	@echo "  make tsan-test     - Build and run C++ tests with ThreadSanitizer"
+	@echo "  make stubs-check   - Type stub: drift, wheel/sdist contents, typed clients (own venvs)"
+	@echo "                       (regenerate the stub: bash dev/stubs/run.sh generate)"
+	@echo "  make perf-tool-test - Tests of the A/B/A timing tool in dev/perf (after changing it; CI: macOS)"
 	@echo ""
 	@echo "Build & Package:"
 	@echo "  make build         - Build distribution packages"
@@ -67,7 +72,7 @@ help:
 	@echo ""
 	@echo "Utilities:"
 	@echo "  make info          - Show project information"
-	@echo "  make hooks         - Run pre-commit on all files"
+	@echo "  make hooks         - Run pre-commit on all files (applies its fixes)"
 	@echo "  make check-python  - Check if venv Python matches best available"
 
 # Allow callers to pass CMAKE_ARGS and MACOSX_DEPLOYMENT_TARGET consistently
@@ -120,48 +125,34 @@ install:
 	@echo "📦 Installing package (editable, default optimizations)"
 	@$(DEV_ENV) $(PIP) install -e .
 
+# The project options are stated in pyproject.toml for every build; a variant overrides one of them
+# with -C (a config setting), so it cannot stay in the shared build directory's cache.
 install-native:
 	@echo "📦 Installing with native CPU optimizations (-march=native)"
 	@echo "   Note: Binary will only work on this CPU architecture"
-	@$(ENV_MACOS) $(ENV_CC) $(ENV_CXX) CMAKE_ARGS="$(strip $(CMAKE_ARGS) -DNETGRAPH_CORE_NATIVE=ON)" $(PIP) install -e .
-
-# PGO profile stored outside build/ so it survives rebuild
-PGO_DIR := $(PWD)/.pgo-profile
-
-install-pgo:
-	@echo "📦 PGO Build Phase 1/3: Instrumenting..."
-	@rm -rf build/ $(PGO_DIR)
-	@mkdir -p $(PGO_DIR)
-	@$(ENV_MACOS) $(ENV_CC) $(ENV_CXX) CMAKE_ARGS="$(strip $(CMAKE_ARGS) -DNETGRAPH_CORE_PGO_GENERATE=ON -DNETGRAPH_CORE_PGO_DIR=$(PGO_DIR) -DNETGRAPH_CORE_NATIVE=ON)" $(PIP) install -e .
-	@echo "📦 PGO Build Phase 2/3: Collecting profile (running benchmark)..."
-	@$(PYTHON) dev/benchmark_profiling_overhead.py --mesh-size 25 --spf-iters 1000 --flow-iters 200 >/dev/null 2>&1
-	@# Clang: merge raw profiles into .profdata (profile may be in cwd or PGO_DIR)
-	@if ls $(PGO_DIR)/*.profraw >/dev/null 2>&1; then \
-		echo "   Merging Clang profile data..."; \
-		xcrun llvm-profdata merge -output=$(PGO_DIR)/default.profdata $(PGO_DIR)/*.profraw 2>/dev/null || \
-		llvm-profdata merge -output=$(PGO_DIR)/default.profdata $(PGO_DIR)/*.profraw; \
-	elif ls *.profraw >/dev/null 2>&1; then \
-		mv *.profraw $(PGO_DIR)/; \
-		xcrun llvm-profdata merge -output=$(PGO_DIR)/default.profdata $(PGO_DIR)/*.profraw 2>/dev/null || \
-		llvm-profdata merge -output=$(PGO_DIR)/default.profdata $(PGO_DIR)/*.profraw; \
-	fi
-	@echo "📦 PGO Build Phase 3/3: Rebuilding with profile data..."
-	@rm -rf build/
-	@$(ENV_MACOS) $(ENV_CC) $(ENV_CXX) CMAKE_ARGS="$(strip $(CMAKE_ARGS) -DNETGRAPH_CORE_PGO_USE=ON -DNETGRAPH_CORE_PGO_DIR=$(PGO_DIR) -DNETGRAPH_CORE_NATIVE=ON)" $(PIP) install -e .
-	@echo "✅ PGO build complete"
+	@$(DEV_ENV) $(PIP) install -e . -C cmake.define.NETGRAPH_CORE_NATIVE=ON
 
+# Verification only: neither target edits a file (make format and make hooks apply fixes).
 check:
-	@PYTHON=$(PYTHON) bash dev/run-checks.sh
+	@$(MAKE) install
+	@$(MAKE) check-ci
 
+# The fixture data check: tests/data/policy_fixtures.json still equals what its frozen reference
+# computes (tests/reference/policy/README.md; standard library only; -B writes no __pycache__).
 check-ci:
 	@$(MAKE) lint
+	@$(PYTHON) -I -B tests/reference/policy/export_policy_fixtures.py --check
+	@$(PYTHON) -I -B dev/test_pytest_guard.py
 	@$(MAKE) cpp-test
-	@$(MAKE) test
+	@$(MAKE) cpp-test-off
+	@PYTHON=$(PYTHON) bash dev/run-checks.sh pytest on
 
+# Pyright resolves imports (NumPy in the type stub, the extension) through the interpreter it
+# is given; without --pythonpath it would take whichever python3 comes first on PATH.
 lint:
 	@$(RUFF) format --check .
 	@$(RUFF) check .
-	@$(PYTHON) -m pyright
+	@$(PYTHON) -m pyright --pythonpath "$$($(PYTHON) -c 'import sys; print(sys.executable)')"
 
 format:
 	@$(RUFF) format .
@@ -169,9 +160,6 @@ format:
 test:
 	@$(PYTEST)
 
-qt:
-	@$(PYTEST) --no-cov -m "not slow and not benchmark"
-
 build:
 	@echo "🏗️  Building distribution packages..."
 	@if $(PYTHON) -c "import build" >/dev/null 2>&1; then \
@@ -211,8 +199,7 @@ publish:
 clean:
 	@echo "🧹 Cleaning build artifacts and cache files..."
 	@rm -rf build/ dist/ *.egg-info/ || true
-	@rm -rf .pytest_cache .ruff_cache .mypy_cache htmlcov htmlcov-python .coverage coverage.xml coverage-*.xml .benchmarks .pytest-benchmark || true
-	@rm -rf Testing CTestTestfile.cmake || true
+	@rm -rf .pytest_cache .ruff_cache || true
 	@find . -path "./venv" -prune -o -type f -name "*.pyc" -delete 2>/dev/null || true
 	@find . -path "./venv" -prune -o -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
 	@find . -path "./venv" -prune -o -type f -name "*.pyo" -delete 2>/dev/null || true
@@ -246,38 +233,26 @@ hooks:
 cpp-test:
 	@PATH="$(VENV_BIN):$$PATH" bash dev/cpp-tests.sh release
 
+cpp-test-off:
+	@PATH="$(VENV_BIN):$$PATH" bash dev/cpp-tests.sh off
+
+# The summary script's own rules first (its refusals make a failed measurement fail; no build).
 cov:
-	@echo "📦 Reinstalling with C++ coverage instrumentation..."
-	@$(PIP) install -U scikit-build-core "pybind11>=2.11"
-	@PIP_NO_BUILD_ISOLATION=1 CMAKE_ARGS="-DNETGRAPH_CORE_COVERAGE=ON" $(PIP) install -e .'[dev]'
-	@echo "🧪 Running Python tests with coverage..."
-	@mkdir -p build/coverage
-	@$(PYTEST) --cov=netgraph_core --cov-report=term-missing --cov-report=xml:build/coverage/coverage-python.xml
-	@echo "🛠️  Building and running C++ tests with coverage..."
-	@BUILD_DIR="build/cpp-tests-cov"; \
-		mkdir -p "$$BUILD_DIR"; \
-		GEN_ARGS=""; \
-		if command -v ninja >/dev/null 2>&1; then GEN_ARGS="-G Ninja"; fi; \
-		cmake -S . -B "$$BUILD_DIR" -DNETGRAPH_CORE_BUILD_TESTS=ON -DNETGRAPH_CORE_COVERAGE=ON -DCMAKE_BUILD_TYPE=Debug $$GEN_ARGS; \
-		cmake --build "$$BUILD_DIR" --config Debug -j; \
-		ctest --test-dir "$$BUILD_DIR" --output-on-failure || echo "⚠️  Some C++ tests failed (continuing for coverage)"
-	@echo "📈 Generating C++ coverage XML (gcovr)..."
-	@$(PYTHON) -m gcovr --root . \
-		--object-directory build \
-		--object-directory build/cpp-tests-cov \
-		--filter 'include/netgraph' --filter 'src' --exclude 'tests' --exclude 'bindings/.*' --exclude '.*pybind11.*' --exclude '_deps/pybind11-src/.*' \
-		--gcov-ignore-errors=all \
-		--gcov-ignore-parse-errors=negative_hits.warn_once_per_file \
-		--xml-pretty -o build/coverage/coverage-cpp.xml
-	@echo ""
-	@echo "================ Python + C++ coverage (summary) ================"
-	@$(PYTHON) dev/coverage_summary.py build/coverage/coverage-python.xml build/coverage/coverage-cpp.xml --html=build/coverage/coverage-combined.html
-	@echo ""
-	@echo "✅ Coverage ready in build/coverage/: coverage-python.xml, coverage-cpp.xml, coverage-combined.html"
+	@$(PYTHON) -I -B dev/test_coverage_summary.py
+	@PYTHON=$(PYTHON) bash dev/run-checks.sh cov
 
 sanitize-test:
 	@PATH="$(VENV_BIN):$$PATH" bash dev/cpp-tests.sh sanitize
 
+tsan-test:
+	@PATH="$(VENV_BIN):$$PATH" bash dev/cpp-tests.sh tsan
+
+stubs-check:
+	@PYTHON=$(PYTHON) bash dev/stubs/run.sh check
+
+perf-tool-test:
+	@$(PYTHON) -B dev/perf/test_tool.py
+
 # Clean + reinstall in dev mode (respects CMAKE_ARGS and MACOSX_DEPLOYMENT_TARGET)
 # Uses active PYTHON (venv or PATH) to avoid environment mismatches
 rebuild: clean
diff --git a/README.md b/README.md
index 6bd2eff..363d4ab 100644
--- a/README.md
+++ b/README.md
@@ -1,142 +1,122 @@
 # NetGraph-Core
 
-C++ graph engine for network flow analysis, traffic engineering simulation, and capacity planning.
-
-## Overview
-
-NetGraph-Core provides a specialized graph implementation for networking problems. Key design priorities:
-
-- **Determinism**: Guaranteed reproducible edge ordering by (cost, src, dst).
-- **Flow Modeling**: Native support for multi-commodity flow state, residual tracking, and ECMP/WCMP placement.
-- **Performance**: Immutable CSR (Compressed Sparse Row) adjacency, and zero-copy NumPy views over mutable flow state.
-
-## Core Features
-
-### 1. Graph Representations
-
-- **`StrictMultiDiGraph`**: Immutable directed multigraph using CSR adjacency. Supports parallel edges (multi-graph), essential for network topologies.
-- **`FlowGraph`**: Topology overlay managing mutable flow state, per-flow edge allocations, and residual capacities.
-
-### 2. Network Algorithms
-
-- **Shortest Paths (SPF)**:
-  - Modified Dijkstra returns a **Predecessor DAG** to capture all equal-cost paths.
-  - Supports **ECMP** (Equal-Cost Multi-Path) routing.
-  - Features **node/edge masking** and **residual-aware tie-breaking**.
-
-- **K-Shortest Paths (KSP)**:
-  - Yen's algorithm returning DAG-wrapped paths.
-  - Configurable constraints on cost factors (e.g., paths within 1.5x of optimal).
-
-- **Explicit Paths**:
-  - `PredDAG.from_edges(graph, edges)` builds a path bundle from an operator-supplied
-    edge sequence, usable anywhere a `PredDAG` is accepted.
-
-- **Max-Flow**:
-  - **Algorithm**: Iterative augmentation using Successive Shortest Path on residual graphs, pushing flow across full ECMP/WCMP DAGs at each step. For `Proportional` placement with `require_capacity=True`, a final residual completion phase augments with reverse arcs so the result is a true maximum flow; the other modes are placement models and may report less.
-  - **Traffic Engineering (TE) Mode**: Routing adapts to residual capacity (progressive fill).
-  - **IP Routing Mode**: Cost-only routing (ECMP/WCMP) ignoring capacity constraints.
-
-- **Analysis**:
-  - **Sensitivity Analysis**: Identifies critical edges by removing each saturated edge and measuring how much total flow is *lost*. Supports `shortest_path` mode to analyze only edges used under ECMP routing (IP/IGP networks) vs. full max-flow (SDN/TE networks).
-  - **Min-Cut**: Computes minimum cuts on residual graphs.
-
-### 3. Flow Policy Engine
-
-Unified configuration object (`FlowPolicy`) that models diverse routing behaviors:
-
-- **Modeling**: Unified configuration for **IP Routing** (static costs) and **Traffic Engineering** (dynamic residuals).
-- **Placement Strategies**:
-  - `EqualBalanced`: **ECMP** (equal splitting) - equal distribution across next-hops and parallel edges.
-  - `Proportional`: **WCMP** (weighted splitting) - distribution proportional to residual capacity.
-- **Lifecycle Management**: Handles demand placement, re-optimization of existing flows, and constraints (path cost, stretch factor, flow counts).
-- **Static (Pinned) Paths**: `FlowPolicy.set_static_paths()` pins a demand to explicit path bundles (MPLS-style). One flow per usable bundle; a bundle with no path surviving the failure masks is *down* and carries nothing, since a pinned path does not reroute.
-
-### 4. Python Integration
-
-- **Zero-Copy**: `FlowState` and `FlowGraph` `*_view()` methods expose C++ buffers as read-only NumPy arrays that track mutation in place. `StrictMultiDiGraph.*_view()` returns copies instead, so the graph's immutability cannot be violated.
-- **Concurrency**: Releases the Python GIL during the long-running algorithms (SPF, KSP, max-flow, placement) to enable threading. `PredDAG.resolve_to_paths` holds the GIL. `batch_max_flow` and `sensitivity_analysis` also use internal worker threads, sized by `NGRAPH_CORE_BATCH_THREADS` / `NGRAPH_CORE_SENSITIVITY_THREADS`.
+NetGraph-Core is a C++ engine with Python bindings that computes how traffic crosses a network:
+the maximum flow between two sets of nodes, how ECMP or WCMP shortest-path routing, RSVP-TE
+tunnels or an ideal controller would carry a demand, and how much a link failure costs. All
+amounts are exact integers, so a result never depends on floating-point tolerance. It is a
+library for developers who build network analysis tools. For a ready tool, with networks and
+failure scenarios in YAML and reports, use [NetGraph](https://github.com/networmix/NetGraph),
+which is built on this engine.
+
+## The main ideas
+
+- **Units.** Capacities and traffic are whole numbers of units. Each graph carries its
+  resolution `q`, the size of one unit (a power of two, for example `2**-12` Gbit/s);
+  `to_units` converts a physical value (rounding half up) and `as_float` converts back.
+- **The graph** (`Graph`) is directed and may have parallel links. Each edge has a capacity and
+  an integer cost of at least 1. Edges are numbered (their `EdgeId`) by sorting on source, cost
+  and destination. An edge of capacity 0 is an empty link, not a missing one: routing still uses
+  it, and traffic sent there is lost.
+- **A failure** is an `Eligibility`: the nodes and edges a call may not use.
+- **A demand** is traffic from a set of sources to a set of destinations. A `FlowPolicy` routes
+  one demand on a `FlowLedger`, the record of what each edge carries; several demands share one
+  ledger, and `apply_actions` places them one after another or at the same time.
+- **The routing model** decides the routes:
+  - `ShortestPaths`: routers forwarding on shortest paths, split equally (ECMP) or by
+    weights (WCMP), or a controller restricted to those paths;
+  - `DistributedTE` (called T1 in the docs): each source router sets up its own N tunnels of
+    fixed bandwidth on the shortest path with enough unreserved bandwidth, as RSVP-TE head ends
+    do;
+  - `CentralizedTE`: an ideal controller, the cheapest flow that delivers the most; with a
+    tunnel count (T2), it lays out the same number of single-path tunnels for every source
+    router, all of one planned bandwidth;
+  - `Pinned`: forwards a given program, to replay a result or study a failure.
+- **Admission** says what happens to traffic that does not fit: `LOSSLESS` admits only what goes
+  through without loss, `LOSSY` sends everything and reports where it is lost.
+- **A program** (`ForwardingProgram`) is what a model decided: the routes and the integer
+  weights that split traffic over them. `place`, `evaluate`, `replace` and `forward` return a
+  `PlacementResult`: what was delivered and lost, and where.
+- **The evaluators** answer one question each on a fresh ledger at full capacity:
+  `evaluate_demand` for one demand (with `CentralizedTE` and the optimized source allocation,
+  the exact maximum flow, its cost curve and its minimum cut), `evaluate_pairs` for many
+  independent pairs in parallel, and `evaluate_edge_failures` for how much delivery each edge's
+  removal takes away.
+- **Calls are all or nothing.** A failing call raises one exception and leaves every ledger,
+  policy and cache as it was, with two limits: running out of memory inside pybind11's own
+  object construction may crash the process, and a supplied shortest-path cache may keep
+  completed entries and lookup statistics. Native work releases Python's interpreter lock (the
+  GIL); calls on one ledger take effect one at a time, and different ledgers run in parallel.
 
 ## Quick Start
 
+Two paths from node 0 to node 3: 10 Gbit/s at cost 1 per hop, and 5 Gbit/s at cost 2 per hop.
+One unit is 1 Gbit/s (`q = 1.0`), so every printed amount is in Gbit/s.
+
 ```python
-import numpy as np
 import netgraph_core as ngc
 
-# Two parallel paths from node 0 to node 3.
-graph = ngc.StrictMultiDiGraph.from_arrays(
-    num_nodes=4,
-    src=np.array([0, 1, 0, 2], dtype=np.int32),
-    dst=np.array([1, 3, 2, 3], dtype=np.int32),
-    capacity=np.array([10.0, 10.0, 5.0, 5.0], dtype=np.float64),
-    cost=np.array([1, 1, 1, 1], dtype=np.int64),
-    ext_edge_ids=np.arange(4, dtype=np.int64),  # your own stable edge ids
-)
-
-algs = ngc.Algorithms(ngc.Backend.cpu())
-handle = algs.build_graph(graph)
-
-total, summary = algs.max_flow(handle, 0, 3)
-print(total)                            # 15.0
-print(summary.min_cut.edges.tolist())   # [0, 1] -- bottleneck edge ids
+q = 1.0
+graph = ngc.Graph(4, [0, 1, 0, 2], [1, 3, 2, 3], [10, 10, 5, 5], [1, 1, 2, 2], q)
+
+# The maximum flow: 10 on the cost-2 path, then 5 on the cost-4 path; the minimum cut is the first
+# link of each path (edges 0 and 1).
+te = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED))
+r = ngc.evaluate_demand(graph, 0, 3, ngc.EvaluationOptions(te, outputs=ngc.OutputOptions(min_cut=True)))
+print(r.call_delivered, r.marginal_cost_curve, r.min_cut)  # 15 [(2, 10), (4, 5)] [0, 1]
+
+# ECMP sends 12 on the only shortest path; its first link (edge 0) carries 10 and drops 2.
+ecmp = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+r = ngc.FlowPolicy(ngc.FlowLedger(graph), 0, 3, ecmp).place(12)
+print(r.call_delivered, r.call_edge_drops)  # 10 [(0, 2)]
+
+# T1: two tunnels of 6 for a demand of 12; the first takes the 10 path, the second finds no path
+# with 6 unreserved. A reservation does not cap traffic: all 12 go into the tunnel that is up,
+# and its path carries 10.
+t1 = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=ngc.Admission.LOSSY)
+r = ngc.FlowPolicy(ngc.FlowLedger(graph), 0, 3, t1).replace(12, design_demand=12)
+print([t.status.name for t in r.program.tunnels], r.call_delivered)  # ['UP', 'INSUFFICIENT_BANDWIDTH'] 10
 ```
 
+A `marginal_cost_curve` lists `(cost, units)` pairs: the first 10 units cost 2 each, the next 5
+cost 4 each. With a finer resolution the same calls count fractions exactly:
+`ngc.to_units(2.5, 2**-12)` is 10240 units.
+
 ## Installation
 
 ```bash
 pip install netgraph-core
 ```
 
-Or from source:
-
-```bash
-pip install -e .
-```
-
-### Build Optimizations
-
-Default builds include LTO and loop unrolling. For local development:
+From source, `pip install .` builds the shipped configuration; `pip install -e .` is the editable
+development build, which also carries private test hooks. The package is typed: it ships
+`py.typed` and a type stub generated from the compiled module.
 
-```bash
-make install-native   # CPU-specific optimizations (not portable)
-```
+## Documentation
 
-## Repository Structure
-
-```
-src/                    # C++ implementation
-include/netgraph/core/  # Public C++ headers
-bindings/python/        # pybind11 bindings
-python/netgraph_core/   # Python package
-tests/cpp/              # C++ tests (googletest)
-tests/py/               # Python tests (pytest)
-dev/                    # Developer scripts (not shipped): checks, coverage,
-dev/perf/               #   performance tooling and recorded A/B/A results,
-dev/research/           #   research prototypes and their evidence
-```
+- [docs/semantics.md](https://github.com/networmix/NetGraph-Core/blob/main/docs/semantics.md): the exact rules (units and rounding, edge numbering,
+  which route a search returns, how each model splits traffic, results, failures, the
+  shortest-path cache and the evaluators), with worked examples that the tests run.
+- The type stub `netgraph_core/__init__.pyi`: every signature, with its docstring.
+- The C++ API: the headers under [include/netgraph/core/](https://github.com/networmix/NetGraph-Core/tree/main/include/netgraph/core); their names
+  are listed in the last section of the semantics.
+- [proofs/](https://github.com/networmix/NetGraph-Core/blob/main/proofs/README.md): machine-checked Lean proofs of the round-robin splitting rule,
+  explained in [docs/formal/theorems/](https://github.com/networmix/NetGraph-Core/blob/main/docs/formal/theorems/round-robin.md). They prove the
+  mathematical rule, not the C++ code; nothing in the build or the package needs Lean.
 
 ## Development
 
-```bash
-make dev        # Setup: venv, dependencies, pre-commit hooks
-make check      # Run all tests and linting (auto-fix formatting)
-make check-ci   # Strict checks without auto-fix (for CI)
-make test       # Python tests
-make cpp-test   # C++ tests only
-make cov        # Combined coverage report (C++ + Python)
-```
-
-Performance work (harnesses, old/new/old protocol, recorded measurements) is
-described in [dev/perf/README.md](dev/perf/README.md).
+[CONTRIBUTING.md](https://github.com/networmix/NetGraph-Core/blob/main/CONTRIBUTING.md) covers setup, the test targets and the release process. In
+short: `make dev` sets up a venv with the editable build and the pre-commit hooks, and
+`make check` rebuilds the extension and runs every check without editing a file.
+`make install-native` builds with CPU-specific optimizations (not portable). Performance claims
+are timed with the A/B/A tool in [dev/perf/](https://github.com/networmix/NetGraph-Core/blob/main/dev/perf/README.md).
 
 ## Environment Variables
 
 | Variable | Effect |
 | --- | --- |
-| `NGRAPH_CORE_PROFILE=1` | Enable profiling of C++ hot paths (`profiling_dump()` / `profiling_reset()`). |
-| `NGRAPH_CORE_BATCH_THREADS` | Worker threads for `batch_max_flow` (default: hardware concurrency). Set to `1` when calling from your own worker pool. |
-| `NGRAPH_CORE_SENSITIVITY_THREADS` | Worker threads for `sensitivity_analysis` (default: hardware concurrency). |
-| `NGRAPH_CORE_SPF_QUEUE` | Frontier queue for SPF: `heap` forces the reference binary heap, `bucket` prefers the bucket queue where the graph is eligible. Unset (default) selects automatically; both give bit-identical results. Read once per process; for benchmarking and diagnosis. |
+| `NGRAPH_CORE_BATCH_THREADS` | Default worker count of `evaluate_pairs`: an integer in [1, 4096]; 1 when unset or invalid, or when a cache is supplied. An explicit `workers` wins. |
+| `NGRAPH_CORE_SENSITIVITY_THREADS` | The same for `evaluate_edge_failures`. |
 
 ## Requirements
 
@@ -147,4 +127,4 @@ described in [dev/perf/README.md](dev/perf/README.md).
 
 ## License
 
-[MIT License](LICENSE)
+[MIT License](https://github.com/networmix/NetGraph-Core/blob/main/LICENSE)
diff --git a/bindings/python/apply_actions.cpp b/bindings/python/apply_actions.cpp
new file mode 100644
index 0000000..eb711f8
--- /dev/null
+++ b/bindings/python/apply_actions.cpp
@@ -0,0 +1,214 @@
+// Several demands at once: BatchMode, the actions Place, Replace and Forward, and apply_actions.
+#include <pybind11/pybind11.h>
+#include <pybind11/stl.h>
+
+#include <cstddef>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "integers.hpp"
+#include "publication.hpp"
+#include "native_call.hpp"
+#include "policy_value.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "values.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// The Python actions keep their arguments as given (the objects themselves, so an action keeps its
+// policy and black holes alive); the call converts them.
+struct PyPlace {
+  py::object policy;
+  py::object offer;
+};
+struct PyReplace {
+  py::object policy;
+  py::object offer;
+  py::object design_demand;
+};
+struct PyForward {
+  py::object policy;
+  py::object offer;
+  py::object black_holes;
+};
+
+std::string type_name(const py::handle& obj) { return std::string(py::str(py::type::of(obj).attr("__name__"))); }
+
+py::object policy_arg(const py::object& policy) {
+  const auto* type = py::detail::get_type_info(typeid(FlowPolicy), true);
+  if (PyObject_TypeCheck(policy.ptr(), type->type) == 0) throw py::type_error("policy must be a FlowPolicy (got " + type_name(policy) + ")");
+  (void)policy_value(policy);
+  return policy;
+}
+
+// An offer: an int (an __index__ object is kept as its int) or a float, None refused.
+py::object offer_arg(const py::object& offer) {
+  if (offer.is_none()) throw py::type_error("offer must be an int or a float (got NoneType)");
+  return units_as_given(offer, "offer");
+}
+
+py::object black_holes_arg(const py::object& black_holes) {
+  (void)eligibility_or_none(black_holes, "black_holes");
+  return black_holes;
+}
+
+// The offer of a converted action: +inf nullopt; any value outside the domain -1, so the call's
+// own check raises the offer text in its place.
+std::optional<Amount> offer_at_use(const py::object& offer) { return *units_at_use(offer); }
+
+FlowPolicy& policy_at_use(const py::object& policy) { return policy_value(policy); }
+
+// The native action of entry i, or the type error of an entry that is not an action.
+Action action_of(const py::handle& item, std::size_t i) {
+  if (py::isinstance<PyPlace>(item)) {
+    const auto& a = item.cast<const PyPlace&>();
+    return Place {policy_at_use(a.policy), offer_at_use(a.offer)};
+  }
+  if (py::isinstance<PyReplace>(item)) {
+    const auto& a = item.cast<const PyReplace&>();
+    return Replace {policy_at_use(a.policy), offer_at_use(a.offer), units_at_use(a.design_demand)};
+  }
+  if (py::isinstance<PyForward>(item)) {
+    const auto& a = item.cast<const PyForward&>();
+    const Eligibility* black_holes = a.black_holes.is_none() ? nullptr : a.black_holes.cast<const Eligibility*>();
+    return Forward {policy_at_use(a.policy), offer_at_use(a.offer), black_holes};
+  }
+  throw py::type_error("actions[" + std::to_string(i) + "] must be a Place, Replace or Forward (got " + type_name(item) + ")");
+}
+
+} // namespace
+
+void register_apply_actions(py::module_& m) {
+  py::enum_<BatchMode>(m, "BatchMode",
+                       "How apply_actions runs its list. ORDERED: each action as its scalar call, in list order, on the\n"
+                       "state the earlier actions left (earlier actions are served first). SIMULTANEOUS: every action forwarded at\n"
+                       "the same time on one view, losses shared on links across the demands.")
+      .value("ORDERED", BatchMode::Ordered)
+      .value("SIMULTANEOUS", BatchMode::Simultaneous);
+
+  py::class_<PyPlace>(m, "Place",
+                      "An incremental place(offer) of policy in an apply_actions list (ORDERED only). An immutable value:\n"
+                      "policy (a FlowPolicy, kept alive) and offer (int units or a float, kept as given; another type\n"
+                      "raises TypeError here, a value outside the domain raises the call's ValueError at apply_actions).")
+      .def(py::init([](const py::object& policy, const py::object& offer) {
+             return PyPlace {policy_arg(policy), offer_arg(offer)};
+           }),
+           py::arg("policy"), py::arg("offer"))
+      .def_readonly("policy", &PyPlace::policy, "the FlowPolicy")
+      .def_readonly("offer", &PyPlace::offer, "the offer as given (int units or a float)");
+
+  py::class_<PyReplace>(m, "Replace",
+                        "A replace(offer, design_demand) of policy in an apply_actions list; SIMULTANEOUS takes it only for\n"
+                        "ShortestPaths EQUAL or WEIGHTED and for Pinned. An immutable value: policy (kept alive), offer and\n"
+                        "design_demand (int units or a float, kept as given; None: absent; another type raises TypeError\n"
+                        "here, a value outside the domain raises the call's ValueError at apply_actions).")
+      .def(py::init([](const py::object& policy, const py::object& offer, const py::object& design_demand) {
+             return PyReplace {policy_arg(policy), offer_arg(offer), units_as_given(design_demand, "design_demand")};
+           }),
+           py::arg("policy"), py::arg("offer"), py::kw_only(), py::arg("design_demand") = py::none())
+      .def_readonly("policy", &PyReplace::policy, "the FlowPolicy")
+      .def_readonly("offer", &PyReplace::offer, "the offer as given (int units or a float)")
+      .def_readonly("design_demand", &PyReplace::design_demand, "the design demand as given (int units or a float); None: absent");
+
+  py::class_<PyForward>(m, "Forward",
+                        "A forward(offer, black_holes) of policy over its installed program in an apply_actions list. An\n"
+                        "immutable value: policy and black_holes (an Eligibility of the policy's graph or None) kept alive,\n"
+                        "offer (int units or a float, kept as given; another type raises TypeError here, a value outside\n"
+                        "the domain raises the call's ValueError at apply_actions).")
+      .def(py::init([](const py::object& policy, const py::object& offer, const py::object& black_holes) {
+             return PyForward {policy_arg(policy), offer_arg(offer), black_holes_arg(black_holes)};
+           }),
+           py::arg("policy"), py::arg("offer"), py::kw_only(), py::arg("black_holes") = py::none())
+      .def_readonly("policy", &PyForward::policy, "the FlowPolicy")
+      .def_readonly("offer", &PyForward::offer, "the offer as given (int units or a float)")
+      .def_readonly("black_holes", &PyForward::black_holes, "the black holes (an Eligibility); None: none");
+
+  m.def(
+      "apply_actions",
+      [](const py::object& ledger, const py::object& actions, const py::object& mode, const py::object& outputs) {
+        // The arguments' types in argument order, every entry included, before any native check.
+        if (!py::isinstance<FlowLedger>(ledger)) throw py::type_error("ledger must be a FlowLedger");
+        if (is_invalid_sequence(actions)) {
+          throw py::type_error("actions must be a sequence of Place, Replace or Forward (got " + type_name(actions) + ")");
+        }
+        const auto items = py::reinterpret_borrow<py::sequence>(actions);
+        const Py_ssize_t count = PySequence_Size(items.ptr());
+        if (count < 0) throw py::error_already_set();
+        const auto n = static_cast<std::size_t>(count);
+        // The entries are held for the call: the actions borrow their policies and black holes.
+        std::vector<py::object> held;
+        held.reserve(n);
+        std::vector<Action> native;
+        native.reserve(n);
+        for (std::size_t i = 0; i < n; ++i) {
+          PyObject* raw = PySequence_GetItem(items.ptr(), static_cast<Py_ssize_t>(i));
+          if (raw == nullptr) throw py::error_already_set();
+          held.push_back(py::reinterpret_steal<py::object>(raw));
+          native.push_back(action_of(held.back(), i));
+        }
+        if (!py::isinstance<BatchMode>(mode)) throw py::type_error("mode must be a BatchMode (got " + type_name(mode) + ")");
+        const auto batch_mode = mode.cast<BatchMode>();
+        const auto o = outputs_of(outputs);
+        auto& target = ledger.cast<FlowLedger&>();
+        detail::check_list_arguments(target, native, batch_mode, o);
+        // The list and every result holder exist before the native transaction.
+        auto out = py::reinterpret_steal<py::typing::List<PlacementResult>>(checked(PyList_New(count)).release());
+        std::vector<PlacementResult*> slots(n);
+        for (std::size_t i = 0; i < n; ++i) {
+          auto [obj, slot] = new_object<PlacementResult>();
+          slots[i] = slot;
+          PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), obj.release().ptr());
+        }
+        native_call([&] {
+          auto results = apply_actions(target, native, batch_mode, o);
+          for (std::size_t i = 0; i < n; ++i) *slots[i] = std::move(results[i]);
+        });
+        return out;
+      },
+      py::arg("ledger"), py::arg("actions"), py::kw_only(), py::arg_v("mode", BatchMode::Ordered, "BatchMode.ORDERED"),
+      py::arg("outputs") = py::none(),
+      "Run the actions of several policies of ledger (a sequence of Place, Replace and Forward) as one\n"
+      "transaction -> list[PlacementResult], one per action in input order, each the scalar call's fields\n"
+      "for its policy. The whole list is validated first, then computed, then published once (one exchange\n"
+      "of every policy's records, then their epochs): a failed call raises with the ledger and every\n"
+      "policy unchanged (with the two limits stated in the package docstring). A policy appears\n"
+      "at most once, and every policy belongs to ledger.\n"
+      "mode ORDERED: each action runs in list order on a private working state exactly as its scalar call\n"
+      "would on the state the earlier actions left (their carried load and holds); new records take\n"
+      "FlowIds in list order. Earlier actions are served first: a reservation gives no protection. mode SIMULTANEOUS:\n"
+      "Replace of ShortestPaths EQUAL or WEIGHTED (routes prepared on the view) and of Pinned, Forward of\n"
+      "any policy with an installed program, every one LOSSY with a finite offer, forwarded at the same\n"
+      "time on one view: the residual plus every participant's old carried load (outside owners and orphans\n"
+      "stay; holds are never added). At a link that cannot carry its arrivals the loss is shared by highest\n"
+      "averages over the demands (ties by policy creation order, never by list position), then over each\n"
+      "demand's sources, then its tunnels; each participant's black holes are its own. Permuting the list\n"
+      "changes nothing. outputs (OutputOptions; None: none) as for the scalar calls: residual and\n"
+      "saturated_boundary_edges read the state after that action (ORDERED) or after the whole list\n"
+      "(SIMULTANEOUS, one residual for every entry, each entry's boundary from its own sources and mask).\n"
+      "Checked in this order: the arguments' types (TypeError: `ledger must be a FlowLedger`, `actions must\n"
+      "be a sequence of Place, Replace or Forward (got <type>)`, `actions[<i>] must be a Place, Replace or\n"
+      "Forward (got <type>)`, `mode must be a BatchMode (got <type>)`, `outputs must be an OutputOptions\n"
+      "(got <type>)`); mode's value (`mode: <v> is not a value of BatchMode`); then each action's\n"
+      "argument/immutable checks in list order: `list policy belongs\n"
+      "to another ledger`, `duplicate policy in list`, SIMULTANEOUS's own rules (`SIMULTANEOUS does not\n"
+      "accept Place`, `SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned`,\n"
+      "`SIMULTANEOUS requires admission=LOSSY`, `SIMULTANEOUS requires finite offers`), then the scalar\n"
+      "call's argument checks. Ledger usability and every action's mutable state are then checked under\n"
+      "the gate, in list order, before any computation. An empty list checks usability and mode, then\n"
+      "returns []. An error of the computation (a\n"
+      "loss-iteration error, a solver or forwarding size limit, the record identity limit counted for the\n"
+      "whole list) publishes nothing.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/concurrency_hooks.cpp b/bindings/python/concurrency_hooks.cpp
new file mode 100644
index 0000000..113064f
--- /dev/null
+++ b/bindings/python/concurrency_hooks.cpp
@@ -0,0 +1,198 @@
+// Native rendezvous controls for progress/atomicity tests. Python is called only
+// by run(), outside every native lock; the probes themselves touch native state.
+#include "registration.hpp"
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstdio>
+#include <cstdlib>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/detail/concurrency.hpp"
+#include "netgraph/core/detail/concurrency_models.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "native_call.hpp"
+#include "values.hpp"
+
+namespace py = pybind11;
+namespace netgraph::core::bindings {
+namespace {
+using Stage = detail::ConcurrentStage;
+constexpr std::array<const char*, static_cast<std::size_t>(Stage::Count)> names {
+  "ledger_wait", "ledger_acquired", "cache_queued", "cache_acquired",
+  "before_publication", "after_exchange", "native_complete", "worker_begin", "thread_launch", "native_begin",
+  "cache_tally_complete", "policy_engine_installed", "tunnel_roster_search", "route_definition_check", "route_walk", "argument_begin"
+};
+Stage stage_of(const std::string& name) {
+  for (std::size_t i = 0; i < names.size(); ++i) if (name == names[i]) return static_cast<Stage>(i);
+  throw py::value_error("unknown native probe stage: " + name);
+}
+struct NativeProbe {
+  std::mutex mutex;
+  std::condition_variable changed;
+  std::array<std::size_t, names.size() + 2> counts {};
+  std::optional<Stage> pause, fail;
+  std::vector<std::size_t> failing_workers;
+  bool reverse_failures {false};
+  bool later_failed {false};
+  bool released {false};
+  int auto_release_ms {0};
+  detail::ConcurrentProbe probe {notify, this};
+
+  NativeProbe(const std::string& paused, const std::string& failed, std::vector<std::size_t> workers, bool reverse,
+              int automatic)
+      : failing_workers(std::move(workers)), reverse_failures(reverse), auto_release_ms(automatic) {
+    if (automatic < 0 || automatic > 10000) throw py::value_error("auto_release_ms must be in [0, 10000]");
+    if (!paused.empty()) pause = stage_of(paused);
+    if (!failed.empty()) fail = stage_of(failed);
+  }
+  static void notify(void* context, Stage stage, const void* object) {
+    auto& self = *static_cast<NativeProbe*>(context);
+    std::unique_lock lock(self.mutex);
+    ++self.counts[static_cast<std::size_t>(stage)];
+    self.changed.notify_all();
+    if (stage == Stage::WorkerBegin && !self.failing_workers.empty()) {
+      const auto index = *static_cast<const std::size_t*>(object);
+      if (std::find(self.failing_workers.begin(), self.failing_workers.end(), index) != self.failing_workers.end()) {
+        if (self.reverse_failures && index == self.failing_workers.front()) {
+          if (!self.changed.wait_for(lock, std::chrono::seconds(10), [&] { return self.later_failed; })) {
+            throw std::runtime_error("worker rendezvous timed out");
+          }
+        } else {
+          self.later_failed = true;
+          self.changed.notify_all();
+        }
+        throw std::runtime_error("injected worker failure " + std::to_string(index));
+      }
+    }
+    if (self.pause == stage && !self.released) {
+      ++self.counts[names.size()];
+      const auto duration = std::chrono::milliseconds(self.auto_release_ms == 0 ? 10000 : self.auto_release_ms);
+      const bool signalled = self.changed.wait_for(lock, duration, [&] { return self.released; });
+      ++self.counts[names.size() + 1];
+      if (!signalled && self.auto_release_ms == 0) throw std::runtime_error("native rendezvous timed out");
+      self.released = true;
+    }
+    if (self.fail == stage) throw std::runtime_error("injected native failure: " + std::string(names[static_cast<std::size_t>(stage)]));
+  }
+  bool wait(Stage stage, double seconds, std::size_t count) {
+    std::unique_lock lock(mutex);
+    return changed.wait_for(lock, std::chrono::duration<double>(seconds), [&] { return counts[static_cast<std::size_t>(stage)] >= count; });
+  }
+  void release() {
+    const std::lock_guard lock(mutex);
+    released = true;
+    changed.notify_all();
+  }
+};
+
+// Py_AtExit runs after Python teardown. Keep only native owners here, so this
+// fixture cannot accidentally retain a Python global through the daemon frame.
+struct ShutdownWaiter {
+  std::shared_ptr<FlowLedger> ledger;
+  std::shared_ptr<ShortestPathCache> cache;
+  std::shared_ptr<NativeProbe> probe;
+  std::unique_ptr<FlowPolicy> policy;
+};
+std::atomic<ShutdownWaiter*> shutdown_waiter {nullptr};
+void native_shutdown() noexcept {
+  std::unique_ptr<ShutdownWaiter> state(shutdown_waiter.exchange(nullptr));
+  if (!state) return;
+  if (Py_IsInitialized() != 0) std::_Exit(91);
+  {
+    const std::lock_guard lock(state->probe->mutex);
+    if (state->probe->counts[names.size()] <= state->probe->counts[names.size() + 1]) std::_Exit(92);
+  }
+  std::fputs("CHILD: native finalizer waiting after Python teardown\n", stdout);
+  std::fflush(stdout);
+  try {
+    state->policy.reset();
+    if (state->cache) state->cache->thaw();
+    state.reset();
+  } catch (...) {
+    std::_Exit(93);
+  }
+  std::fputs("CHILD: native finalizer completed\n", stdout);
+  std::fflush(stdout);
+}
+} // namespace
+void register_concurrency_hooks(py::module_& m) {
+  py::class_<NativeProbe, std::shared_ptr<NativeProbe>>(m, "_ConcurrencyProbe")
+    .def(py::init<const std::string&, const std::string&, std::vector<std::size_t>, bool, int>(),
+         py::arg("pause") = "", py::arg("fail") = "", py::arg("workers") = std::vector<std::size_t>{}, py::arg("reverse") = false,
+         py::arg("auto_release_ms") = 0)
+    .def("run", [](NativeProbe& self, const py::function& callback, const py::args& args) {
+      const detail::ScopedConcurrentProbe scope(&self.probe);
+      return callback(*args);
+    }, py::arg("callable"))
+    .def("wait", [](NativeProbe& self, const std::string& stage, double seconds, std::size_t count) {
+      const auto point = stage_of(stage);
+      // Do not run native_call's entry probe inside the probe's own wait.
+      py::gil_scoped_release detached;
+      return self.wait(point, seconds, count);
+    }, py::arg("stage"), py::arg("seconds") = 5.0, py::arg("count") = 1)
+    .def("release", &NativeProbe::release, py::call_guard<py::gil_scoped_release>())
+    .def("counts", [](NativeProbe& self) {
+      std::array<std::size_t, names.size() + 2> snapshot;
+      {
+        py::gil_scoped_release detached;
+        const std::lock_guard lock(self.mutex);
+        snapshot = self.counts;
+      }
+      py::dict out;
+      for (std::size_t i = 0; i < names.size(); ++i) out[names[i]] = snapshot[i];
+      out["pause_begin"] = snapshot[names.size()];
+      out["pause_end"] = snapshot[names.size() + 1];
+      return out;
+    });
+  m.def("_at_native_exit", [](const std::shared_ptr<FlowLedger>& ledger,
+      const std::shared_ptr<ShortestPathCache>& cache, const std::shared_ptr<NativeProbe>& probe) {
+    if ((!ledger && !cache) || (ledger && cache) || !probe) throw py::value_error("one native exit resource and a probe are required");
+    auto state = native_call([&] {
+      auto s = std::make_unique<ShutdownWaiter>();
+      s->ledger = ledger;
+      s->cache = cache;
+      s->probe = probe;
+      if (ledger) s->policy = std::make_unique<FlowPolicy>(*ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, FlowPolicyConfig{});
+      return s;
+    });
+    ShutdownWaiter* empty = nullptr;
+    if (!shutdown_waiter.compare_exchange_strong(empty, state.get())) {
+      native_call([&] { state.reset(); });
+      throw py::value_error("a native exit waiter is already registered");
+    }
+    if (Py_AtExit(native_shutdown) != 0) {
+      shutdown_waiter.store(nullptr);
+      native_call([&] { state.reset(); });
+      throw std::runtime_error("native exit registration failed");
+    }
+    (void)state.release();
+  });
+  m.def("_concurrency_model", [](const std::string& name) {
+    py::dict out;
+    if (name == "publication-locked" || name == "publication-unlocked") {
+      const auto result = detail::publication_model(name == "publication-locked");
+      out["states"] = result.states;
+      out["mixed"] = result.mixed;
+    } else {
+      const auto result = detail::phase_model(name);
+      out["states"] = result.states;
+      out["partial"] = result.partial;
+      out["python_under_lock"] = result.python_under_lock;
+      out["late_hits"] = result.late_hits;
+    }
+    return out;
+  }, py::arg("protocol"));
+}
+} // namespace netgraph::core::bindings
+#endif
diff --git a/bindings/python/eligibility.cpp b/bindings/python/eligibility.cpp
new file mode 100644
index 0000000..6e12c78
--- /dev/null
+++ b/bindings/python/eligibility.cpp
@@ -0,0 +1,57 @@
+// Eligibility: the static node and edge flags of one graph.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+#include <utility>
+
+#include "netgraph/core/eligibility.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+void register_eligibility(py::module_& m) {
+  py::class_<Eligibility, std::shared_ptr<Eligibility>>(
+      m, "Eligibility",
+      "Which nodes and edges of one graph may be used: one flag per node and per edge, fixed when built\n"
+      "(it does not depend on traffic). Built by Graph.eligibility(excluded_nodes, excluded_edges) and\n"
+      "Eligibility.intersect.")
+      .def("graph_uid", &Eligibility::graph_uid, "uid of the graph this value belongs to")
+      .def("uid", &Eligibility::uid, "0 for the all-allowed value, a fresh uid otherwise")
+      .def(
+          "node_allowed",
+          [](const py::object& self) {
+            const auto& el = self.cast<const Eligibility&>();
+            return readonly_view(el.node_allowed(), self, py::dtype("bool"));
+          },
+          "bool[N] read-only view")
+      .def(
+          "edge_allowed",
+          [](const py::object& self) {
+            const auto& el = self.cast<const Eligibility&>();
+            return readonly_view(el.edge_allowed(), self, py::dtype("bool"));
+          },
+          "bool[E] read-only view (not excluded and both endpoints allowed)")
+      .def_static(
+          "intersect",
+          [](const std::shared_ptr<Eligibility>& a, const std::shared_ptr<Eligibility>& b) {
+            if (!a || !b) throw py::type_error("Eligibility.intersect takes two Eligibility values");
+            if (a->graph_uid() != b->graph_uid()) throw py::value_error("Eligibility.intersect: the two values belong to different graphs");
+            auto r = native_call([&] { return Eligibility::intersect(*a, *b); });
+            if (r.uid() == a->uid()) return typed_shared(a);
+            if (r.uid() == b->uid()) return typed_shared(b);
+            return typed_shared(std::make_shared<Eligibility>(std::move(r)));
+          },
+          py::arg("a"), py::arg("b"),
+          "The intersection of two values of one graph (ValueError for values of different graphs):\n"
+          "an operand itself when the result equals it (a first, then b), otherwise a new value with a\n"
+          "fresh uid; equal intersections built separately get distinct uids.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/evaluators.cpp b/bindings/python/evaluators.cpp
new file mode 100644
index 0000000..9a6f43c
--- /dev/null
+++ b/bindings/python/evaluators.cpp
@@ -0,0 +1,274 @@
+// evaluate_demand, evaluate_pairs and evaluate_edge_failures with their options and results. Each
+// evaluator places on a new, empty ledger; a frozen ShortestPathCache counts its hits only when the whole Python
+// call succeeds (detail::frozen_call).
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <exception>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/evaluator_checks.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "integers.hpp"
+#include "publication.hpp"
+#include "native_call.hpp"
+#include "values.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// The Python form of EvaluationOptions: the Eligibility and the cache are held by reference count
+// for the call (the C++ structs borrow raw pointers); design_demand and offer as given.
+struct PyEvaluationOptions {
+  FlowPolicyConfig config;
+  std::shared_ptr<Eligibility> eligibility;
+  std::shared_ptr<ShortestPathCache> cache;
+  OutputOptions outputs;
+  py::object design_demand;
+  py::object offer;
+  [[nodiscard]] EvaluationOptions native() const {
+    return EvaluationOptions {config, eligibility.get(), cache.get(), outputs, units_at_use(design_demand), units_at_use(offer)};
+  }
+};
+
+// workers: an explicit integer is passed through (validated by the evaluator); None takes the
+// environment default (detail::default_workers), and 1 whenever a cache is supplied (a building
+// cache has one writer; a frozen one is shared only when the caller asks for workers).
+std::int32_t workers_of(const py::object& workers, bool edge_failures, bool cache_given) {
+  if (!workers.is_none()) {
+    return static_cast<std::int32_t>(integer_value(workers, std::numeric_limits<std::int32_t>::min(),
+                                                   std::numeric_limits<std::int32_t>::max(), "workers"));
+  }
+  if (cache_given) return 1;
+  return detail::default_workers(edge_failures);
+}
+
+} // namespace
+
+void register_evaluators(py::module_& m) {
+  py::class_<PyEvaluationOptions>(m, "EvaluationOptions",
+                             "The options of every evaluator (evaluate_demand, evaluate_pairs, evaluate_edge_failures): config\n"
+                             "(the configuration), eligibility (the static Eligibility; None: all allowed), cache (the\n"
+                             "ShortestPathCache; None: private per worker), outputs (the optional outputs of each result;\n"
+                             "evaluate_edge_failures: of its baseline), design_demand and\n"
+                             "offer (int units or a float, kept as given; another type raises TypeError). offer: a finite offer\n"
+                             "for every model (None: the uncapped LOSSLESS question, or for ShortestPaths EQUAL/WEIGHTED with\n"
+                             "LOSSY the first-hop experiment; required for DistributedTE, Pinned and, without a finite design,\n"
+                             "CentralizedTE with tunnel_count under LOSSY). design_demand: DistributedTE always, required and\n"
+                             "finite; CentralizedTE with tunnel_count: None means the offer when it is finite, else unlimited;\n"
+                             "every other model leaves it None. The evaluators check both after the configuration, in this order:\n"
+                             "an explicit offer (`offer must be an integer in [0, 2^62)`, +inf included), the design\n"
+                             "(`<model> does not accept design_demand`, `design_demand must be an integer in [0, 2^62) or\n"
+                             "permitted +inf`, `DistributedTE requires a finite design demand`), DistributedTE's missing design\n"
+                             "(`DistributedTE evaluation requires design_demand`), the missing LOSSY offer (`<DistributedTE or\n"
+                             "CentralizedTE or Pinned> LOSSY evaluation requires a finite offer`).")
+      .def(py::init([](const FlowPolicyConfig& config, const std::shared_ptr<Eligibility>& elig,
+                       const std::shared_ptr<ShortestPathCache>& cache, const py::object& outputs, const py::object& design_demand,
+                       const py::object& offer) {
+             auto d = units_as_given(design_demand, "design_demand");
+             auto o = units_as_given(offer, "offer");
+             return PyEvaluationOptions {config, elig, cache, outputs_of(outputs), std::move(d), std::move(o)};
+           }),
+           py::arg("config"), py::kw_only(), py::arg("eligibility") = nullptr, py::arg("cache") = nullptr,
+           py::arg("outputs") = py::none(), py::arg("design_demand") = py::none(), py::arg("offer") = py::none())
+      .def_property_readonly("config", field_object(&PyEvaluationOptions::config),
+                    "the FlowPolicyConfig of every evaluated policy (evaluate_edge_failures: the baseline and every deletion)")
+      .def_property_readonly("eligibility", shared_field(&PyEvaluationOptions::eligibility), "the static Eligibility; None: everything allowed")
+      .def_property_readonly("cache", shared_field(&PyEvaluationOptions::cache), "the supplied ShortestPathCache; None: a private cache per worker")
+      .def_property_readonly("outputs", field_object(&PyEvaluationOptions::outputs),
+                    "the OutputOptions of every result (evaluate_edge_failures: of the baseline)")
+      .def_readonly("design_demand", &PyEvaluationOptions::design_demand,
+                    "the tunnel models' design volume as given (int units or a float); None: absent")
+      .def_readonly("offer", &PyEvaluationOptions::offer, "the offer as given (int units or a float); None: absent");
+
+  py::class_<SensitivityEntry>(m, "SensitivityEntry",
+                                "One candidate edge: edge and delivery_reduction (int units: the baseline's delivery minus the\n"
+                                "delivery without the edge; signed).")
+      .def_property_readonly("edge", int_reader(&SensitivityEntry::edge))
+      .def_property_readonly("delivery_reduction", int_reader(&SensitivityEntry::delivery_reduction));
+
+  py::class_<SensitivityResult>(m, "SensitivityResult",
+                                "baseline (the PlacementResult of evaluate_demand()) and entries (ascending EdgeId; an\n"
+                                "absent edge has reduction 0).")
+      .def_property_readonly("baseline", field_object(&SensitivityResult::baseline))
+      .def_property_readonly("entries", list_field(&SensitivityResult::entries));
+
+  m.def(
+      "evaluate_demand",
+      [](const std::shared_ptr<Graph>& graph, const py::object& sources, const py::object& destinations,
+         const py::object& opts) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        const auto o = options_of<PyEvaluationOptions>(opts, "EvaluationOptions");
+        const auto s = node_ids(sources, graph->num_nodes(), "sources");
+        const auto d = node_ids(destinations, graph->num_nodes(), "destinations");
+        const EvaluationOptions c = o.native();
+        const auto roster = detail::check_demand_arguments(*graph, s, d, c, detached_argument_work);
+        auto [obj, slot] = new_object<PlacementResult>();
+        native_call([&] {
+          return detail::frozen_call(c.cache, [&](detail::FrozenCacheHitTally& tally) {
+            *slot = detail::evaluate_demand_in_call(*graph, s, d, c, tally, roster ? &*roster : nullptr);
+            return true;
+          });
+        });
+        return std::move(obj);
+      },
+      py::arg("graph"), py::arg("sources"), py::arg("destinations"), py::arg("options"),
+      "The evaluation of a fresh FlowPolicy with options.config on a fresh ledger of graph at options.offer\n"
+      "(None: +inf; DistributedTE and CentralizedTE with tunnel_count: evaluate(offer, design_demand=...))\n"
+      "-> PlacementResult. LOSSLESS delivers up to a finite offer; LOSSY accounts for exactly that offer\n"
+      "(ShortestPaths EQUAL/WEIGHTED LOSSY without an offer: the first-hop experiment). The options are checked as\n"
+      "the EvaluationOptions docstring states.\n"
+      "Without an offer, CentralizedTE(source_allocation=OPTIMIZED) gives the exact maximum flow (a finite offer below\n"
+      "it stops the solve there, with no cut); with source_allocation=EQUAL, the largest\n"
+      "total whose round-robin source shares are all carried; with WEIGHTED (CentralizedTE without tunnel_count),\n"
+      "the largest total whose highest-averages shares of source_weights are all carried.\n"
+      "A supplied frozen cache raises ShortestPathCacheMiss\n"
+      "for an absent key, unchanged.\n"
+      "A failed call raises; a supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.");
+
+  m.def(
+      "evaluate_pairs",
+      [](const std::shared_ptr<Graph>& graph, const py::object& pairs, const py::object& opts,
+         const py::object& per_pair_eligibility, const py::object& workers) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        // The arguments first, then each pair completely and in pair order (the same two parts
+        // as the C++ validation), so the lowest failing pair index is reported.
+        const auto o = options_of<PyEvaluationOptions>(opts, "EvaluationOptions");
+        const auto w = workers_of(workers, false, static_cast<bool>(o.cache));
+        const EvaluationOptions c = o.native();
+        detail::check_batch_arguments(*graph, c, w);
+        if (is_invalid_sequence(pairs)) throw py::type_error("pairs must be a sequence of (sources, destinations)");
+        const auto items = py::reinterpret_borrow<py::sequence>(pairs);
+        const auto num_pairs = py::len(items);
+        std::optional<py::sequence> eligs;
+        if (!per_pair_eligibility.is_none()) {
+          // An explicit sequence has one entry per pair (None entries allowed), also when empty.
+          if (is_invalid_sequence(per_pair_eligibility)) throw py::type_error("per_pair_eligibility must be a sequence of Eligibility or None");
+          eligs = py::reinterpret_borrow<py::sequence>(per_pair_eligibility);
+          if (py::len(*eligs) != num_pairs) {
+            throw py::value_error("per_pair_eligibility has " + std::to_string(py::len(*eligs)) + " entries for " +
+                                  std::to_string(num_pairs) + " pairs");
+          }
+        }
+        std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> ps;
+        std::vector<std::shared_ptr<Eligibility>> keep;
+        std::vector<const Eligibility*> per;
+        std::exception_ptr pending;
+        const auto n = graph->num_nodes();
+        for (std::size_t i = 0; i < num_pairs; ++i) {
+          try {
+            const py::object item = items[i];
+            // Not a sequence is a wrong type, a sequence of another length a wrong value: one text.
+            if (is_invalid_sequence(item)) throw py::type_error("each pair must be (sources, destinations)");
+            if (py::len(item) != 2) throw py::value_error("each pair must be (sources, destinations)");
+            auto t = py::reinterpret_borrow<py::sequence>(item);
+            auto src = node_ids(t[0], n, "sources");
+            auto dst = node_ids(t[1], n, "destinations");
+            const Eligibility* e = nullptr;
+            if (eligs) {
+              const py::object entry = (*eligs)[i];
+              if (!entry.is_none()) {
+                if (!py::isinstance<Eligibility>(entry)) throw py::type_error("per_pair_eligibility entries must be Eligibility or None");
+                keep.push_back(entry.cast<std::shared_ptr<Eligibility>>());
+                e = keep.back().get();
+              }
+              per.push_back(e);
+            }
+            detail::check_batch_pair(*graph, c.config, src, dst, e, i);
+            ps.emplace_back(std::move(src), std::move(dst));
+          } catch (...) {
+            pending = std::current_exception();
+            break;
+          }
+        }
+        const auto rosters = detail::prepare_batch_rosters(*graph, ps, c, per, w, detached_argument_work);
+        if (pending) std::rethrow_exception(pending);
+        auto out = py::reinterpret_steal<py::list>(checked(PyList_New(static_cast<Py_ssize_t>(num_pairs))).release());
+        std::vector<PlacementResult*> slots(num_pairs);
+        for (std::size_t i = 0; i < num_pairs; ++i) {
+          auto [obj, slot] = new_object<PlacementResult>();
+          slots[i] = slot;
+          PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), obj.release().ptr());
+        }
+        native_call([&] {
+          return detail::frozen_call(c.cache, [&](detail::FrozenCacheHitTally& tally) {
+            auto rs = detail::evaluate_pairs_in_call(*graph, ps, c, per, w, tally, rosters);
+            for (std::size_t i = 0; i < rs.size(); ++i) *slots[i] = std::move(rs[i]);
+            return true;
+          });
+        });
+        return out;
+      },
+      py::arg("graph"), py::arg("pairs"), py::arg("options"), py::arg("per_pair_eligibility") = py::none(),
+      py::arg("workers") = py::none(),
+      "evaluate_demand() for each (sources, destinations) pair, results in pair order. Pair i uses\n"
+      "options.eligibility "
+      "intersected with per_pair_eligibility[i] (None entries allowed; a given sequence has one entry per pair,\n"
+      "also when empty). workers >= 1; None: NGRAPH_CORE_BATCH_THREADS or 1, and 1 when a cache is\n"
+      "supplied. All checks finish before evaluation workers start: the arguments first, then each pair\n"
+      "completely in pair order, so the error of the lowest failing pair is raised. First-pass tunnel\n"
+      "searches run in parallel under one GIL release, before any lease or gate. Pinned is rejected\n"
+      "(`evaluate_pairs does not accept Pinned`: a program has fixed endpoints);\n"
+      "an empty batch returns [].\n"
+      "Caches: a supplied building cache needs workers == 1; a frozen cache is shared by every worker\n"
+      "(pass workers explicitly), and its ShortestPathCacheMiss reaches the caller unchanged (the lowest failing\n"
+      "pair's). An intersection that differs from both operands gets a new Eligibility uid, which a\n"
+      "frozen cache cannot hold: pass the combined per-pair values with eligibility None, or a common value\n"
+      "that contains them.\n"
+      "A failed call raises; a supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.");
+
+  m.def(
+      "evaluate_edge_failures",
+      [](const std::shared_ptr<Graph>& graph, const py::object& sources, const py::object& destinations,
+         const py::object& opts, const py::object& workers) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        const auto o = options_of<PyEvaluationOptions>(opts, "EvaluationOptions");
+        const auto s = node_ids(sources, graph->num_nodes(), "sources");
+        const auto d = node_ids(destinations, graph->num_nodes(), "destinations");
+        const auto w = workers_of(workers, true, static_cast<bool>(o.cache));
+        const EvaluationOptions c = o.native();
+        const auto roster = detail::check_edge_failure_arguments(*graph, s, d, c, w, detached_argument_work);
+        auto [obj, slot] = new_object<SensitivityResult>();
+        native_call([&] {
+          return detail::frozen_call(c.cache, [&](detail::FrozenCacheHitTally& tally) {
+            *slot = detail::evaluate_edge_failures_in_call(*graph, s, d, c, w, tally, roster ? &*roster : nullptr);
+            return true;
+          });
+        });
+        return std::move(obj);
+      },
+      py::arg("graph"), py::arg("sources"), py::arg("destinations"), py::arg("options"), py::arg("workers") = py::none(),
+      "The baseline evaluate_demand() and one SensitivityEntry per candidate edge. Candidates: with unrestricted\n"
+      "CentralizedTE and the optimized source allocation, the edges that carry flow in the baseline (removing any\n"
+      "other edge keeps the baseline feasible, at any offer); otherwise every allowed edge, whatever its capacity (an edge of capacity 0\n"
+      "can carry a route, so deleting it can change the result, and with the equal source allocation a deletion that\n"
+      "removes a source from the roster can raise the total: a negative reduction). delivery_reduction =\n"
+      "baseline.call_delivered minus the call_delivered of a fresh evaluate_demand() without the edge, at the\n"
+      "same offer, design and other options, in signed units, never thresholded; it is not the traffic the\n"
+      "edge carried. ShortestPaths\n"
+      "gives reduction 0 without placing to an edge outside the static shortest-path support reachable from\n"
+      "the roster sources (no route can use it). CentralizedTE with a support solves every deletion afresh; Pinned\n"
+      "replays the same program under each deletion. workers as evaluate_pairs\n"
+      "(NGRAPH_CORE_SENSITIVITY_THREADS). Only ShortestPaths reads the cache, and each placed deletion uses a\n"
+      "new Eligibility uid, so a frozen cache raises ShortestPathCacheMiss there.\n"
+      "A failed deletion fails the call (the lowest failing candidate's exception, no partial result); a\n"
+      "supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/flow_ledger.cpp b/bindings/python/flow_ledger.cpp
new file mode 100644
index 0000000..d60ddb8
--- /dev/null
+++ b/bindings/python/flow_ledger.cpp
@@ -0,0 +1,136 @@
+// FlowLedger: the integer ledger of one graph.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/graph.hpp"
+#include "integers.hpp"
+#include "values.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "native_call.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+void register_flow_ledger(py::module_& m) {
+  [[maybe_unused]] auto ledger_class = py::class_<FlowLedger, std::shared_ptr<FlowLedger>>(
+      m, "FlowLedger",
+      "The integer ledger of one graph, in two projections that are never added: carried traffic (the\n"
+      "service baseline; carried() is the sum of every record's edge_flows and residual() = baseline -\n"
+      "carried()) and the strict holds of T1 tunnels (the reservation baseline; reserved() is the sum of\n"
+      "every record's edge_reservations and unreserved() = reservation baseline - reserved()), all int64[E]\n"
+      "snapshots. Traffic may use bandwidth that is held: holds never police. The baselines are replaced\n"
+      "only by reset(); the records are the flows placed on it by policies (the ledger has no public\n"
+      "placement, removal or reservation). reset() and copy() are rejected while a policy is bound (a\n"
+      "FlowPolicy built on this ledger still exists).")
+      .def(py::init([](const std::shared_ptr<Graph>& graph, const py::object& service_baseline, const py::object& reservation_baseline) {
+             if (!graph) throw py::type_error("graph must be a Graph");
+             const auto caps = graph->edge_capacity_units();
+             const auto r = service_baseline.is_none() ? std::vector<Amount>(caps.begin(), caps.end())
+                                               : edge_units(service_baseline, *graph, "service_baseline");
+             const auto u = reservation_baseline.is_none() ? std::vector<Amount>(caps.begin(), caps.end())
+                                                 : edge_units(reservation_baseline, *graph, "reservation_baseline");
+             return native_call([&] { return std::make_shared<FlowLedger>(graph, r, u); });
+           }),
+           py::arg("graph"), py::arg("service_baseline") = py::none(), py::kw_only(), py::arg("reservation_baseline") = py::none(),
+           "service_baseline and reservation_baseline: the baselines as integer units, one entry per edge in\n"
+           "[0, the edge's capacity] (a physical baseline goes through to_units first; service_baseline\n"
+           "checked first); None: the capacities. A wrong type (not a 1-D sequence of integers, a non-integer\n"
+           "entry) raises TypeError, a wrong length or an entry outside its range ValueError.")
+      .def("uid", [](const FlowLedger& l) { return native_call([&] { return l.uid(); }); }, "process-unique ledger uid (the first half of every FlowId)")
+      .def(
+          "graph", [](const FlowLedger& fg) { auto graph = native_call([&] { return std::shared_ptr<const Graph>(fg.graph()); }); return typed_shared(std::move(graph)); },
+          "the ledger's graph")
+      .def(
+          "edge_capacity_units",
+          [](const py::object& self) {
+            const auto& ledger = self.cast<const FlowLedger&>();
+            const auto capacities = native_call([&] { return ledger.edge_capacity_units(); });
+            return readonly_view(capacities, self);
+          },
+          "int64[E] the graph's capacities in units (read-only view)")
+      .def(
+          "residual", [](const FlowLedger& fg) { return int64_array(native_call([&] { return fg.residual(); })); },
+          "int64[E] snapshot: service_baseline - carried()")
+      .def(
+          "carried", [](const FlowLedger& fg) { return int64_array(native_call([&] { return fg.carried(); })); },
+          "int64[E] snapshot: the sum of every record's edge_flows")
+      .def(
+          "reserved", [](const FlowLedger& fg) { return int64_array(native_call([&] { return fg.reserved(); })); },
+          "int64[E] snapshot: strict holds per edge (T1), the sum of every record's edge_reservations")
+      .def(
+          "unreserved", [](const FlowLedger& fg) { return int64_array(native_call([&] { return fg.unreserved(); })); },
+          "int64[E] snapshot: reservation baseline minus strict holds, per edge")
+      .def(
+          "records", [](const FlowLedger& fg) { return list_of(native_call([&] { return fg.records(); })); },
+          "live records as snapshots in FlowId order: those of bound policies and orphans (records left by a\n"
+          "policy destroyed without remove())")
+      .def(
+          "record",
+          [](const FlowLedger& fg, const py::object& flow_id) { const auto id = flow_id_of(flow_id); return typed_object(native_call([&] { return fg.record(id); })); },
+          py::arg("flow_id"),
+          "one record by FlowId (ValueError for a FlowId of another ledger, a retired or an unknown id)")
+      .def(
+          "saturated_boundary_edges",
+          [](const FlowLedger& fg, const py::object& sources, const std::shared_ptr<Eligibility>& elig) {
+            const auto s = node_ids(sources, detail::LedgerAccess::graph(fg)->num_nodes(), "sources");
+            if (elig && elig->graph_uid() != detail::LedgerAccess::graph(fg)->uid()) throw py::value_error("foreign Eligibility: built for another graph");
+            return native_call([&] { return fg.saturated_boundary_edges(s, elig.get()); });
+          },
+          py::arg("sources"), py::arg("eligibility") = nullptr,
+          "Saturation report: the eligible edges with capacity >= 1 unit that leave the set of nodes the\n"
+          "allowed sources can reach (following eligible edges forward with residual >= 1 unit), in\n"
+          "ascending EdgeId. It ignores the destinations, so it is not a source-destination cut.")
+      .def(
+          "reset",
+          [](FlowLedger& fg, const py::object& service_baseline, const py::object& reservation_baseline) {
+            const auto& graph = detail::LedgerAccess::graph(fg);
+            const auto caps = graph->edge_capacity_units();
+            const auto r = service_baseline.is_none() ? std::vector<Amount>(caps.begin(), caps.end())
+                                              : edge_units(service_baseline, *graph, "service_baseline");
+            const auto u = reservation_baseline.is_none() ? std::vector<Amount>(caps.begin(), caps.end())
+                                                : edge_units(reservation_baseline, *graph, "reservation_baseline");
+            native_call([&] { fg.reset(r, u); });
+          },
+          py::arg("service_baseline") = py::none(), py::kw_only(), py::arg("reservation_baseline") = py::none(),
+          "New baselines (None: the capacities); orphaned records with their allocations and holds are\n"
+          "cleared and their ids retired (ids are never reused). ValueError while a policy is bound.")
+      .def(
+          "copy", [](const FlowLedger& fg) { return native_call([&] { return std::make_shared<FlowLedger>(fg); }); },
+          "a new ledger (new uid) with the same baselines, records and holds, ids kept under the new uid;\n"
+          "ValueError while a policy is bound")
+      .def("__copy__", [](const FlowLedger& fg) { return native_call([&] { return std::make_shared<FlowLedger>(fg); }); })
+      .def("__deepcopy__", [](const FlowLedger& fg, const py::object&) { return native_call([&] { return std::make_shared<FlowLedger>(fg); }); },
+           py::arg("memo"));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  ledger_class
+      .def(
+          "_state",
+          [](const FlowLedger& fg) {
+            struct Snapshot {
+              std::int64_t next;
+              std::vector<std::int64_t> bound, orphans;
+            };
+            const auto state = native_call([&] {
+              const auto gate = detail::LedgerAccess::lock(fg);
+              return Snapshot {detail::LedgerAccess::next_record_counter(fg),
+                  detail::LedgerAccess::bound_policy_ids(fg), detail::LedgerAccess::orphan_policy_ids(fg)};
+            });
+            py::dict out;
+            out["next_flow_id"] = state.next;
+            out["bound"] = state.bound;
+            out["orphans"] = state.orphans;
+            return out;
+          },
+          "private: {next_flow_id, bound, orphans} (owner ids)");
+#endif
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/flow_policy.cpp b/bindings/python/flow_policy.cpp
new file mode 100644
index 0000000..88522a5
--- /dev/null
+++ b/bindings/python/flow_policy.cpp
@@ -0,0 +1,387 @@
+// FlowPolicy: the one placement engine, bound to its ledger.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cmath>
+#include <initializer_list>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "integers.hpp"
+#include "publication.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "policy_value.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+#include <functional>
+#include <variant>
+
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "trace.hpp"
+#endif
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// Register all dependencies before binding the policy. This leaves no flag or
+// incremented reference behind when
+// a map/vector allocation fails. with_internals supplies pybind11's registry
+// lock on a free-threaded interpreter; no Python callback runs inside it.
+void pin_policy(py::detail::instance* nurse, std::initializer_list<py::handle> dependencies) {
+  std::vector<PyObject*> pins;
+  pins.reserve(dependencies.size());
+  for (const auto dependency : dependencies) {
+    if (!dependency.is_none()) pins.push_back(dependency.ptr());
+  }
+  py::detail::with_internals([&](py::detail::internals& internals) {
+    const auto [it, inserted] = internals.patients.emplace(reinterpret_cast<PyObject*>(nurse), std::move(pins));
+    (void)it;
+    if (!inserted) throw std::logic_error("FlowPolicy dependencies already registered");
+  });
+  // Arguments still pin these objects. The remaining steps cannot fail and run
+  // after the registry lock, before this shell can publish a bound policy.
+  for (const auto dependency : dependencies) {
+    if (!dependency.is_none()) Py_INCREF(dependency.ptr());
+  }
+  nurse->has_patients = true;
+}
+
+// A request or a full offer: units in [0, 2^62) or +inf (float('inf')); nullopt is +inf.
+std::optional<Amount> request_units(const py::object& offer) {
+  return units_or_inf(offer, "offer must be an integer in [0, 2^62) or permitted +inf");
+}
+
+// A design demand argument: None absent; float('inf') the inner nullopt; an integer passed on for
+// the call's own checks in their order (one outside int64 as -1, outside the domain like it); any
+// other value raises the domain text here (a conversion failure comes first).
+std::optional<std::optional<Amount>> design_units(const py::object& design) {
+  constexpr const char* text = "design_demand must be an integer in [0, 2^62) or permitted +inf";
+  if (design.is_none()) return std::nullopt;
+  if (is_bool(design) || !PyIndex_Check(design.ptr())) return units_or_inf(design, text);
+  const py::object idx = python_int(design, "design_demand");
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  return std::optional<Amount>(overflow != 0 ? Amount {-1} : static_cast<Amount>(v));
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+
+// The epoch state of a policy (roster, requested, +inf, per roster source the flows).
+py::dict state_obj(const py::object& self) {
+  const auto& policy = policy_value(self);
+  const auto& pe = detail::PolicyAccess::engine(policy);
+  struct Flow { detail::LiveFlow flow; FlowRecord record; };
+  struct Snapshot {
+    std::vector<NodeId> roster;
+    Counter128 requested;
+    bool infinite;
+    Amount delivered {0};
+    std::vector<std::vector<Flow>> record_groups;
+  };
+  auto snapshot = native_call([&] {
+    const auto gate = detail::LedgerAccess::lock(pe.ledger);
+    Snapshot state {pe.reachable_sources, pe.epoch.requested, pe.epoch.infinite, 0, {}};
+    state.record_groups.resize(pe.epoch.record_groups.size());
+    for (std::size_t i = 0; i < state.record_groups.size(); ++i) {
+      for (const auto& flow : pe.epoch.record_groups[i]) {
+        auto record = detail::LedgerAccess::live(pe.ledger, flow.record_counter);
+        state.delivered += record.delivered;
+        state.record_groups[i].push_back({flow, std::move(record)});
+      }
+    }
+    return state;
+  });
+  py::dict out;
+  const auto& r = pe.config.routing;
+  out["mode"] = detail::model_name(r);
+  out["roster"] = snapshot.roster;
+  out["requested"] = counter_int(snapshot.requested);
+  out["infinite"] = snapshot.infinite;
+  out["placed_demand"] = snapshot.delivered;
+  py::dict record_groups;
+  // Per roster source its flows (T1, T2 and Pinned: per program entry, keyed by its position).
+  const auto* gl = std::get_if<CentralizedTE>(&r);
+  const bool per_entry = std::holds_alternative<Pinned>(r) || std::holds_alternative<DistributedTE>(r) ||
+                         (gl != nullptr && gl->tunnel_count.has_value());
+  for (std::size_t i = 0; i < snapshot.record_groups.size(); ++i) {
+    py::list flows;
+    for (const auto& row : snapshot.record_groups[i]) {
+      const auto& s = row.flow;
+      const FlowRecord& rec = row.record;
+      py::dict f;
+      f["flow_id"] = py::make_tuple(rec.flow_id.first, rec.flow_id.second);
+      f["src"] = s.source;
+      const auto edges = detail::PredecessorDAGBuilder::ascending(*s.route);
+      f["route"] = std::vector<EdgeId>(edges.begin(), edges.end());
+      f["T"] = rec.delivered;
+      f["delivered"] = rec.delivered;
+      f["alloc"] = pairs_list(rec.edge_flows);
+      f["entry"] = s.entry_id < 0 ? py::object(py::none()) : py::object(py::int_(s.entry_id));
+      flows.append(f);
+    }
+    record_groups[py::int_(per_entry ? static_cast<std::int64_t>(i) : static_cast<std::int64_t>(snapshot.roster[i]))] = flows;
+  }
+  out["cohorts"] = record_groups;
+  return out;
+}
+
+#endif
+
+} // namespace
+
+// A policy's destructor waits for its ledger gate: it runs detached, as native work does.
+struct DetachedDelete {
+  void operator()(FlowPolicy* policy) const noexcept {
+    const Detached detached;
+    delete policy;
+  }
+};
+
+void register_flow_policy(py::module_& m) {
+  [[maybe_unused]] auto flow_policy = py::class_<FlowPolicy, std::unique_ptr<FlowPolicy, DetachedDelete>>(
+      m, "FlowPolicy", py::is_final(),
+      "The placement engine for one demand, bound to its ledger at construction. A final Python class.\n"
+      "Native computation releases the GIL; one ledger gate serializes calls and mutable reads. Every call (place,\n"
+      "evaluate, replace, forward) is all-or-nothing: a failed call raises and leaves the ledger and the\n"
+      "policy as they were (with the two limits stated in the package docstring). remove()\n"
+      "takes every flow of the policy back out, clears its program and starts a new epoch (the request\n"
+      "total starts again from 0); replace and forward start one too. A policy dropped without remove()\n"
+      "leaves its records in the ledger as orphans: readable, never changed again, cleared by\n"
+      "FlowLedger.reset(). sources and destinations are one NodeId or a sequence; the two sets must not\n"
+      "overlap. ValueError for invalid endpoints, configurations and requests and for objects of another\n"
+      "graph, ledger or policy; TypeError for a ledger (None included), config, eligibility, cache or\n"
+      "outputs of the wrong class, a node id or a request of a wrong type (a bool, a float node id, a\n"
+      "string) and an unknown keyword.")
+      .def("__init__", [](py::detail::value_and_holder& instance, const std::shared_ptr<FlowLedger>& ledger,
+                       const py::object& sources, const py::object& destinations, const FlowPolicyConfig& config,
+                       const std::shared_ptr<Eligibility>& elig, const std::shared_ptr<ShortestPathCache>& cache) {
+             if (!ledger) throw py::type_error("ledger must be a FlowLedger");
+             const auto n = detail::LedgerAccess::graph(*ledger)->num_nodes();
+             const auto s = node_ids(sources, n, "sources");
+             const auto d = node_ids(destinations, n, "destinations");
+             auto prepared = detail::PolicyAccess::prepare(*ledger, s, d, config, elig.get(), cache.get(), nullptr, detached_argument_work);
+             // Registration and holder construction can allocate. Complete them while the
+             // shell is unbound; no Python work remains after native construction publishes.
+             std::unique_ptr<FlowPolicy, DetachedDelete> holder(detail::PolicyAccess::shell().release());
+             auto* policy = holder.get();
+             instance.inst->owned = false;
+             instance.value_ptr() = policy;
+             try {
+               instance.type->init_instance(instance.inst, &holder);
+               instance.inst->owned = true;
+             } catch (...) {
+               instance.value_ptr() = nullptr;
+               throw;
+             }
+             try {
+               pin_policy(instance.inst, {py::cast(ledger), py::cast(elig), py::cast(cache)});
+               native_call([&] { detail::PolicyAccess::construct(*policy, std::move(prepared), cache.get()); });
+             } catch (...) {
+               // A failed __init__ must leave no usable shell, including explicit __new__
+               // followed by a caught constructor failure. Final classes also forbid a
+               // subclass that swallows __init__'s exception.
+               if (instance.instance_registered()) {
+                 py::detail::deregister_instance(instance.inst, instance.value_ptr(), instance.type);
+                 instance.set_instance_registered(false);
+               }
+               instance.type->dealloc(instance);
+               if (instance.inst->has_patients) py::detail::clear_patients(reinterpret_cast<PyObject*>(instance.inst));
+               throw;
+             }
+           }, py::detail::is_new_style_constructor(),
+           py::arg("ledger"),
+           py::arg("sources"), py::arg("destinations"), py::arg("config"), py::arg("eligibility") = nullptr,
+           py::arg("cache") = nullptr,
+           "Bind a policy to ledger. eligibility (None: everything allowed) and cache (None: none; only ShortestPaths\n"
+           "routing reads it, another model rejects it) belong to the ledger's graph; the policy keeps the\n"
+           "ledger, eligibility and cache alive (a Pinned policy shares its program and black holes). The roster\n"
+           "(the sources that statically reach an allowed destination, over allowed edges whatever their\n"
+           "capacity, the tunnel models' heads; Pinned: the program's heads that reach an allowed destination over its basis\n"
+           "under eligibility) is fixed here. Everything is validated before the policy binds, in this order: the endpoints, the\n"
+           "graph of eligibility, the program, the support, the cache and the black holes (`foreign Eligibility:\n"
+           "built for another graph`, `program belongs to another graph`, `support belongs to another graph`,\n"
+           "`foreign ShortestPathCache: bound to another graph`, `black_holes belongs to another graph`), the\n"
+           "configuration (FlowPolicyConfig's order, the pooled single-path rule and T2's several-sources rule\n"
+           "included), the tunnel limit (`tunnel limit exceeded:\n"
+           "<H> heads x <N> tunnels > 1073741823`) and a Pinned program's endpoints (`program endpoints do not\n"
+           "match policy endpoints`).")
+      .def(
+          "place",
+          [](const py::object& self, const py::object& offer, const py::object& outputs) {
+            auto& p = policy_value(self);
+            // The operation comes before the offer (the call's order).
+            detail::check_place_operation(detail::PolicyAccess::engine(p));
+            const auto v = request_units(offer);
+            const auto o = outputs_of(outputs);
+            detail::check_policy_arguments(detail::PolicyAccess::engine(p), detail::PolicyOperation::Place, v);
+            auto [obj, slot] = new_object<PlacementResult>();
+            native_call([&] { *slot = p.place(v, o); });
+            return std::move(obj);
+          },
+          py::arg("offer"), py::arg("outputs") = py::none(),
+          "Place offer (int units in [0, 2^62), or float('inf')) all or nothing -> PlacementResult. T1 and T2\n"
+          "raise `<DistributedTE or CentralizedTE with tunnel_count> does not support incremental placement`\n"
+          "(also for 0).\n"
+          "Requests add up within an epoch (from construction, the last remove(), replace() or forward());\n"
+          "after float('inf') any finite request is rejected, 0 included. A request of 0 places nothing and\n"
+          "reports the current state. ShortestPaths prepares its program at the epoch's first positive request.\n"
+          "LOSSLESS admits the largest total in [admitted, admitted + offer] that the program carries with no\n"
+          "loss (a refused unit is not offered again); LOSSY forwards the new round-robin (or captured-weight)\n"
+          "injections, each head splitting its increment afresh (earlier drops are not offered again); a\n"
+          "controller re-solves admitted + offer. A LOSSY float('inf') is ShortestPaths's first-hop experiment;\n"
+          "Pinned raises `LOSSY forwarding requires a finite offer`. outputs (OutputOptions; None: none)\n"
+          "requests edge_flows, residual, saturated_boundary_edges, edge_reservations and min_cut. Everything is\n"
+          "validated before any change; a\n"
+          "failed call raises with the ledger and the policy unchanged. A solve of the flow core (CentralizedTE\n"
+          "or ShortestPaths OPTIMIZED) on a network beyond its int32 numbering raises ValueError:\n"
+          "more than INT32_MAX - 2 nodes, or more than 2^30 - 1 edges, sources and destinations together. A\n"
+          "LOSSY forwarding whose losses wait on each other in a cycle raises ValueError when its rounds\n"
+          "alternate between two states or reach the round limit, RuntimeError when the result's check fails.")
+      .def("remove", [](const py::object& self) { auto& p = policy_value(self); native_call([&] { p.remove(); }); },
+           "revert every flow and hold of the policy, retire the ids, clear the program, open a new epoch")
+      .def("delivered", [](const py::object& self) { auto& p = policy_value(self); return native_call([&] { return p.delivered(); }); }, "the sum of delivered over the policy's live records")
+      .def(
+          "records", [](const py::object& self) { auto& p = policy_value(self); return list_of(native_call([&] { return p.records(); })); },
+          "the policy's live records as snapshots in FlowId order")
+      .def(
+          "record",
+          [](const py::object& self, const py::object& flow_id) {
+            auto& p = policy_value(self); const auto id = flow_id_of(flow_id); return typed_object(native_call([&] { return p.record(id); })); },
+          py::arg("flow_id"),
+          "one of the policy's live records by FlowId (ValueError for a FlowId of another ledger or policy, a\n"
+          "retired or an unknown id)")
+      .def(
+          "evaluate",
+          [](const py::object& self, const py::object& offer, const py::object& design_demand, const py::object& outputs) {
+            auto& p = policy_value(self);
+            const auto v = request_units(offer);
+            const auto d = design_units(design_demand);
+            const auto o = outputs_of(outputs);
+            detail::check_policy_arguments(detail::PolicyAccess::engine(p), detail::PolicyOperation::Evaluate, v, d);
+            auto [obj, slot] = new_object<PlacementResult>();
+            native_call([&] { *slot = p.evaluate(v, d, o); });
+            return std::move(obj);
+          },
+          py::arg("offer"), py::kw_only(), py::arg("design_demand") = py::none(), py::arg("outputs") = py::none(),
+          "A full, independent computation and forwarding of offer (int units or float('inf')) from the\n"
+          "policy's own released view (the residual plus its own carried load; T1 sets up on the unreserved\n"
+          "capacity with its own holds released; T2 lays out on the released residual), as replace would do it -> PlacementResult (the computed\n"
+          "program and plan, the flags replace would set, the outputs of the evaluated state); publishes\n"
+          "nothing, creates no record, books no hold and leaves the epoch as it was. design_demand as for\n"
+          "replace. LOSSY requires a finite offer.")
+      .def(
+          "replace",
+          [](const py::object& self, const py::object& offer, const py::object& design_demand, const py::object& outputs) {
+            auto& p = policy_value(self);
+            const auto v = request_units(offer);
+            const auto d = design_units(design_demand);
+            const auto o = outputs_of(outputs);
+            detail::check_policy_arguments(detail::PolicyAccess::engine(p), detail::PolicyOperation::Replace, v, d);
+            auto [obj, slot] = new_object<PlacementResult>();
+            native_call([&] { *slot = p.replace(v, d, o); });
+            return std::move(obj);
+          },
+          py::arg("offer"), py::kw_only(), py::arg("design_demand") = py::none(), py::arg("outputs") = py::none(),
+          "Recompute from the policy's own released view and forward the full offer, published atomically ->\n"
+          "PlacementResult: the old records and holds are retired (their ids never live again), new ones\n"
+          "created, and a new epoch starts at this offer (delivery may go down: delivery_delta). ShortestPaths\n"
+          "prepares its routes again on that view; a\n"
+          "controller re-solves; T1 sets its tunnels up again for the design and books their holds; T2 lays its\n"
+          "tunnels out again for the design (planned bandwidth, never held);\n"
+          "Pinned forwards its program. design_demand (T1 and T2: int units, or float('inf'); None: equal to\n"
+          "the offer): T1 needs a finite design (`DistributedTE requires a finite design demand`), T2 takes an unlimited\n"
+          "one (its largest common size); every other model raises `<model> does not accept design_demand`.\n"
+          "In this order: the offer, LOSSY's finite offer, then the design demand (the model, its domain,\n"
+          "finiteness).")
+      .def(
+          "forward",
+          [](const py::object& self, const py::object& offer, const py::object& black_holes, const py::object& outputs) {
+            auto& p = policy_value(self);
+            // Only the immutable operation check precedes offer conversion.
+            detail::check_forward_operation(detail::PolicyAccess::engine(p));
+            const auto v = request_units(offer);
+            const auto bh = eligibility_or_none(black_holes, "black_holes");
+            const auto o = outputs_of(outputs);
+            detail::check_policy_arguments(detail::PolicyAccess::engine(p), detail::PolicyOperation::Forward, v, {}, bh.get());
+            auto [obj, slot] = new_object<PlacementResult>();
+            native_call([&] { *slot = p.forward(v, bh.get(), o); });
+            return std::move(obj);
+          },
+          py::arg("offer"), py::kw_only(), py::arg("black_holes") = py::none(), py::arg("outputs") = py::none(),
+          "Forward a full new offer over the installed program, with no route computation and no setup, on the\n"
+          "released view -> PlacementResult; a new epoch like replace, the program, its plan and T1's holds\n"
+          "kept (no flag; T1's records are recreated with the same edge_reservations). LOSSLESS admits the\n"
+          "program's lossless bound up to the offer; LOSSY sends the offer. black_holes (an Eligibility of the\n"
+          "graph): the nodes and edges it excludes are black holes for this call (stale forwarding: traffic\n"
+          "reaching one is dropped there; a black-holed source loses its share). In this order: Pinned raises\n"
+          "`Pinned forwards with replace`; the offer; LOSSY +inf `LOSSY forwarding requires a finite offer`;\n"
+          "black_holes of another graph `black_holes belongs to another graph`; then, under the gate,\n"
+          "no installed program `forward requires an installed program`.")
+      .def_property_readonly(
+
+          "program",
+          [](const py::object& self) { auto& p = policy_value(self); return optional_shared(native_call([&] { return p.program(); })); },
+          "the installed ForwardingProgram; None before the first preparation and after remove()")
+      .def_property_readonly("config", [](const py::object& self) { auto& p = policy_value(self); return typed_object(p.config()); },
+                             "the configuration as validated at construction, ShortestPaths' absent\n"
+                             "source_allocation and weight_basis resolved to the allocation's defaults");
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  py::class_<detail::Trace>(m, "_PlacementTrace")
+      .def("as_dict", [](const detail::Trace& trace) { return trace_obj(trace); },
+           "private: convert the completed native trace to Python values");
+  flow_policy
+      .def("_seed_requested", [](const py::object& self, std::uint64_t hi, std::uint64_t lo) {
+            auto& p = policy_value(self);
+        if (hi >= (std::uint64_t{1} << 63)) throw py::value_error("requested seed reaches 2^127");
+        native_call([&] {
+          auto& engine = detail::PolicyAccess::engine(p);
+          const auto gate = detail::LedgerAccess::lock(engine.ledger);
+          engine.epoch.requested = Counter128 {hi, lo};
+        });
+      }, py::arg("hi"), py::arg("lo"), "private: seed the exact requested counter")
+      .def(
+          "_place_traced",
+          [](const py::object& self, const py::object& offer, const py::object& outputs) {
+            auto& p = policy_value(self);
+            detail::check_place_operation(detail::PolicyAccess::engine(p));
+            const auto v = request_units(offer);
+            const auto o = outputs_of(outputs);
+            detail::check_policy_arguments(detail::PolicyAccess::engine(p), detail::PolicyOperation::Place, v);
+            auto [obj, slot] = new_object<PlacementResult>();
+            auto [trace_obj, trace] = new_object<detail::Trace>();
+            auto pair = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(2)).release());
+            PyTuple_SET_ITEM(pair.ptr(), 0, obj.release().ptr());
+            PyTuple_SET_ITEM(pair.ptr(), 1, trace_obj.release().ptr());
+            native_call([&] { *slot = detail::place_traced(p, v, o, *trace); });
+            return pair;
+          },
+          py::arg("offer"), py::arg("outputs") = py::none(),
+          "private: place() with the transaction's trace (the call's intermediate values, keyed as\n"
+          "the tests' model of the policy keys them)")
+      .def("_state", &state_obj, "private: the epoch state (roster, requested, +inf, record_groups)")
+      .def(
+          "_owner", [](const py::object& self) { auto& p = policy_value(self); return detail::PolicyAccess::engine(p).policy_id; },
+          "private: the ledger-local owner id (FlowRecord.policy_id)");
+#endif
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/flow_policy_config.cpp b/bindings/python/flow_policy_config.cpp
new file mode 100644
index 0000000..8c41a92
--- /dev/null
+++ b/bindings/python/flow_policy_config.cpp
@@ -0,0 +1,97 @@
+// FlowPolicyConfig and OutputOptions: the configuration of a placement.
+#include <pybind11/pybind11.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/options.hpp"
+#include "integers.hpp"
+#include "strict_bool.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+Routing routing_of(const py::object& obj) {
+  if (py::isinstance<ShortestPaths>(obj)) return obj.cast<ShortestPaths>();
+  if (py::isinstance<DistributedTE>(obj)) return obj.cast<DistributedTE>();
+  if (py::isinstance<CentralizedTE>(obj)) return obj.cast<CentralizedTE>();
+  if (py::isinstance<Pinned>(obj)) return obj.cast<Pinned>();
+  throw py::type_error("routing must be ShortestPaths, DistributedTE, CentralizedTE or Pinned (got " +
+                       std::string(py::str(py::type::of(obj).attr("__name__"))) + ")");
+}
+
+// The routing as a new Python object through the checked allocation (publication.hpp): a failed
+// allocation raises instead of crashing.
+py::object routing_obj(const Routing& r) {
+  return std::visit([](const auto& x) { return object_of(x); }, r);
+}
+
+} // namespace
+
+void register_policy_config(py::module_& m) {
+  py::class_<FlowPolicyConfig>(
+      m, "FlowPolicyConfig",
+      "One demand's settings: the routing model, which holds every option it reads (ShortestPaths,\n"
+      "DistributedTE (T1), CentralizedTE, CentralizedTE(tunnel_count=...) (T2) or Pinned), and the admission\n"
+      "(LOSSLESS by default; LOSSY for ShortestPaths EQUAL and WEIGHTED, T1, T2 and Pinned). The\n"
+      "combination is checked when a policy or an evaluator uses the configuration (ValueError), in\n"
+      "this order: the enumeration values; the model matrix (route and source allocation, admission,\n"
+      "the ineffective tie rule, the pooled single-path rule, prefer_headroom, the weight combinations,\n"
+      "and last a ShortestPathCache on a model that does not read it); the tunnel count, an up_to count\n"
+      "for DistributedTE, the ceilings, min_unreserved_bandwidth and edge_weights' length and entries;\n"
+      "the tunnel limit (roster heads times the tunnel count at most 2^30 - 1); a Pinned program's\n"
+      "endpoints.")
+      .def(py::init([](const py::object& routing, Admission admission) {
+             return FlowPolicyConfig {routing_of(routing), admission};
+           }),
+           py::kw_only(), py::arg("routing"), py::arg_v("admission", Admission::Lossless, "Admission.LOSSLESS"))
+      .def_property_readonly(
+          "routing", [](const FlowPolicyConfig& c) { return routing_obj(c.routing); },
+          "the routing model: ShortestPaths, DistributedTE, CentralizedTE or Pinned")
+      .def_property_readonly("admission", field_object(&FlowPolicyConfig::admission), "LOSSLESS or LOSSY")
+      .def("__repr__", [](const FlowPolicyConfig& c) {
+        return "FlowPolicyConfig(routing=" + own_repr(routing_obj(c.routing)) + ", admission=" +
+               (c.admission == Admission::Lossy ? "Admission.LOSSY" : "Admission.LOSSLESS") + ")";
+      });
+
+  py::class_<OutputOptions>(m, "OutputOptions",
+                            "Optional outputs of a placement (all false by default; absent outputs are None):\n"
+                            "edge_flows (the policy's own allocation per edge after the call), residual and\n"
+                            "saturated_boundary_edges (the ledger's after the call), edge_reservations (the policy's own\n"
+                            "strict holds per edge after the call; zeros for a model without holds), and min_cut (unrestricted\n"
+                            "CentralizedTE with the optimized source allocation, when the call's solve reached the maximum\n"
+                            "flow; [] for an empty roster, place(0) excepted; None for every other model or source allocation,\n"
+                            "for place(0) and for a forward with a nonempty roster).")
+      .def(py::init([](StrictBool edge_flows, StrictBool residual, StrictBool saturated_boundary_edges, StrictBool edge_reservations,
+                       StrictBool min_cut) {
+             OutputOptions o;
+             o.edge_flows = edge_flows;
+             o.residual = residual;
+             o.saturated_boundary_edges = saturated_boundary_edges;
+             o.edge_reservations = edge_reservations;
+             o.min_cut = min_cut;
+             return o;
+           }),
+           py::kw_only(), py::arg("edge_flows") = StrictBool {false}, py::arg("residual") = StrictBool {false},
+           py::arg("saturated_boundary_edges") = StrictBool {false}, py::arg("edge_reservations") = StrictBool {false},
+           py::arg("min_cut") = StrictBool {false})
+      .def_readonly("edge_flows", &OutputOptions::edge_flows, "request PlacementResult.edge_flows")
+      .def_readonly("residual", &OutputOptions::residual, "request PlacementResult.residual")
+      .def_readonly("saturated_boundary_edges", &OutputOptions::saturated_boundary_edges, "request PlacementResult.saturated_boundary_edges")
+      .def_readonly("edge_reservations", &OutputOptions::edge_reservations,
+                    "request PlacementResult.edge_reservations")
+      .def_readonly("min_cut", &OutputOptions::min_cut, "request PlacementResult.min_cut");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/flow_record.cpp b/bindings/python/flow_record.cpp
new file mode 100644
index 0000000..8e6aff0
--- /dev/null
+++ b/bindings/python/flow_record.cpp
@@ -0,0 +1,84 @@
+// FlowRecord: one flow of a ledger, as a snapshot.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+#include <string>
+
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "values.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+py::object cost_or_none(Cost c) { return c == kUnreachable ? py::object(py::none()) : py::object(int_object(c)); }
+
+} // namespace
+
+void register_flow_record(py::module_& m) {
+  py::class_<FlowRecord>(
+      m, "FlowRecord",
+      "One flow of a ledger, as a snapshot: flow_id (ledger uid, id), policy_id (the policy's id),\n"
+      "sources, destinations, admission, entry_id (a T1, T2 or Pinned policy's program entry, else None),\n"
+      "route (PredecessorDAG: the flow's route), min_route_cost (its minimum walk cost; None when empty),\n"
+      "offered (Lossy only, else None), delivered, edge_flows [(EdgeId, units)] (carried load) and\n"
+      "edge_drops [(EdgeId, units)] (cumulative, ascending EdgeId), edge_reservations [(EdgeId, units)]\n"
+      "(T1's strict holds, ascending EdgeId). offered and the edge_drops units are exact Python ints (they\n"
+      "may exceed 64 bits).")
+      .def_property_readonly(
+
+          "flow_id", [](const FlowRecord& r) { return int_pair(r.flow_id.first, r.flow_id.second); },
+          "(ledger uid, id): ids are assigned in creation order and never reused in the ledger")
+      .def_property_readonly("policy_id", int_reader(&FlowRecord::policy_id), "the ledger-local id of the policy that created the flow")
+      .def_property_readonly(
+          "sources", [](const FlowRecord& r) { return ints_list(std::span<const NodeId>(r.sources)); },
+          "the flow's source node ids, ascending")
+      .def_property_readonly(
+          "destinations", [](const FlowRecord& r) { return ints_list(std::span<const NodeId>(r.destinations)); },
+          "the flow's destination node ids, ascending")
+      .def_property_readonly("admission", field_object(&FlowRecord::admission), "LOSSLESS or LOSSY")
+      .def_property_readonly("entry_id", optional_int_reader(&FlowRecord::entry_id),
+                    "the program entry the record carries (T1, T2 and Pinned: the entry identifier); None for the\n"
+                    "records kept per roster source (ShortestPaths, CentralizedTE)")
+      .def_property_readonly(
+          "route", [](const FlowRecord& r) { return typed_shared(r.route); },
+          "the flow's route (an immutable PredecessorDAG shared with the ledger)")
+      .def_property_readonly(
+          "min_route_cost", [](const FlowRecord& r) { return cost_or_none(r.min_route_cost); },
+          "the cost of the cheapest walk of the route from the sources to the destinations; None when\n"
+          "the route has no such walk")
+      .def_property_readonly(
+
+          "offered",
+          [](const FlowRecord& r) -> py::object {
+            return r.offered.has_value() ? counter_int(*r.offered) : py::object(py::none());
+          },
+          "Lossy: the units offered to the flow, summed over calls (an exact int, may exceed 64 bits);\n"
+          "None for a Lossless flow")
+      .def_property_readonly("delivered", int_reader(&FlowRecord::delivered), "the units the flow delivers to its destinations (its total)")
+      .def_property_readonly(
+          "edge_flows", [](const FlowRecord& r) { return pairs_list(r.edge_flows); },
+          "the flow's allocation [(EdgeId, units)], positive entries in ascending EdgeId")
+      .def_property_readonly(
+          "edge_drops",
+          [](const FlowRecord& r) { return pairs_list(r.edge_drops); },
+          "Lossy: the units dropped per edge [(EdgeId, units)], summed over calls, positive entries in\n"
+          "ascending EdgeId (exact ints); empty for a Lossless flow")
+      .def_property_readonly(
+          "edge_reservations", [](const FlowRecord& r) { return pairs_list(r.edge_reservations); },
+          "T1: the strict holds of an up tunnel [(EdgeId, units)], its request on every link of its path,\n"
+          "ascending EdgeId; empty for every other record (holds never police traffic)")
+      .def("__repr__", [](const FlowRecord& r) {
+        return "FlowRecord(flow_id=(" + std::to_string(r.flow_id.first) + ", " + std::to_string(r.flow_id.second) +
+               "), policy_id=" + std::to_string(r.policy_id) + ", delivered=" + std::to_string(r.delivered) + ")";
+      });
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/flow_solver_hook.cpp b/bindings/python/flow_solver_hook.cpp
new file mode 100644
index 0000000..2b62104
--- /dev/null
+++ b/bindings/python/flow_solver_hook.cpp
@@ -0,0 +1,109 @@
+// The private entry _solve_min_cost_flow, registered in both builds: the flow core's
+// minimum-cost flow from zero on a given view, with its full payload for the flow checks.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstddef>
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/graph.hpp"
+#include "integers.hpp"
+#include "registration.hpp"
+#include "native_call.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+py::list int_list(const std::vector<std::int64_t>& v) {
+  py::list out(v.size());
+  for (std::size_t i = 0; i < v.size(); ++i) out[i] = py::int_(v[i]);
+  return out;
+}
+
+} // namespace
+
+void register_flow_solver_hook(py::module_& m) {
+  m.def(
+      "_solve_min_cost_flow",
+      [](const std::shared_ptr<Graph>& graph, const py::object& view, const py::object& sources,
+         const py::object& destinations, const std::shared_ptr<Eligibility>& elig,
+         const py::object& cap) -> py::dict {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        // The core's order (view length, view entries, sources, destinations, overlap, cap,
+        // Eligibility), every value checked before narrowing; the core re-checks the same order.
+        const auto v = edge_amounts(view, *graph, "view", "view (capacity units)");
+        const auto s = checked_ids(wide_integers(sources, "sources node ids"), graph->num_nodes(), "sources");
+        const auto d = checked_ids(wide_integers(destinations, "destinations node ids"), graph->num_nodes(), "destinations");
+        detail::check_disjoint(detail::node_set(s, graph->num_nodes(), "sources"),
+                               detail::node_set(d, graph->num_nodes(), "destinations"), "sources", "destinations");
+        std::optional<Amount> c;
+        if (!cap.is_none()) {
+          if (is_bool(cap) || !PyIndex_Check(cap.ptr())) {
+            throw py::type_error("cap must be an integer number of units in [0, 2^63 - 2] or None");
+          }
+          py::object idx = python_int(cap, "cap");
+          int overflow = 0;
+          const long long value = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+          if (overflow != 0 || value < 0 || value > detail::kMaxFlowCap) {
+            throw py::value_error("cap " + std::string(py::str(idx)) + " is outside [0, 2^63 - 2]");
+          }
+          c = static_cast<Amount>(value);
+        }
+        if (elig && elig->graph_uid() != graph->uid()) {
+          throw py::value_error("foreign Eligibility: built for another graph");
+        }
+        const auto view_units = v.narrow<Amount>();
+        auto r = native_call([&] { return detail::solve_min_cost_flow(*graph, view_units, s, d, elig.get(), c); });
+        py::dict out;
+        out["flow_value"] = py::int_(r.flow_value);
+        py::list curve;
+        for (const auto& [cost, units] : r.marginal_cost_curve) {
+          py::list entry;
+          entry.append(py::int_(cost));
+          entry.append(py::int_(units));
+          curve.append(entry);
+        }
+        out["marginal_cost_curve"] = curve;
+        out["edge_flows"] = int_list(r.edge_flows);
+        if (r.min_cut.has_value()) {
+          py::list cut;
+          for (EdgeId e : *r.min_cut) cut.append(py::int_(e));
+          out["min_cut"] = cut;
+        } else {
+          out["min_cut"] = py::none();
+        }
+        out["potentials"] = int_list(r.potentials);
+        py::dict counters;
+        counters["dijkstra_runs"] = py::int_(r.counters.dijkstra_runs);
+        counters["dijkstra_pops"] = py::int_(r.counters.dijkstra_pops);
+        counters["settled"] = py::int_(r.counters.settled);
+        counters["arc_scans"] = py::int_(r.counters.arc_scans);
+        counters["dinic_phases"] = py::int_(r.counters.dinic_phases);
+        counters["augmentations"] = py::int_(r.counters.augmentations);
+        out["counters"] = counters;
+        return out;
+      },
+      py::arg("graph"), py::arg("view"), py::arg("sources"), py::arg("destinations"), py::arg("eligibility"),
+      py::arg("cap"),
+      "Private flow-core entry: the largest flow up to cap (None: no cap) from the source set to the\n"
+      "destination set over the eligible edges, sent at the lowest total cost, on the capacities `view`\n"
+      "(int64 units, EdgeId order), starting from zero flow. Returns {flow_value, marginal_cost_curve:\n"
+      "[[cost, units]], edge_flows, min_cut (None while the destinations are still reachable, because\n"
+      "the cap stopped the solve, and on cap 0), potentials (per-node prices from the shortest-path runs\n"
+      "that prove the flow is cheapest; -1 = never reached), counters}. Invalid inputs raise ValueError\n"
+      "before any work. A solve (cap not 0) then raises ValueError, before the solver sizes anything, on\n"
+      "a network beyond the flow core's int32 numbering: more than INT32_MAX - 2 nodes, or more than\n"
+      "2^30 - 1 eligible edges, eligible sources and eligible destinations together.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/forwarding_program.cpp b/bindings/python/forwarding_program.cpp
new file mode 100644
index 0000000..7634bd0
--- /dev/null
+++ b/bindings/python/forwarding_program.cpp
@@ -0,0 +1,262 @@
+// Forwarding programs: TunnelStatus, Tunnel, RouteDefinition and ForwardingProgram with from_routes and from_dag.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "integers.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+py::typing::Union<Path, PredecessorDAG> route_obj(const RouteDefinition& r) {
+  py::object out = std::holds_alternative<std::shared_ptr<const Path>>(r.route)
+                       ? shared_object(std::get<std::shared_ptr<const Path>>(r.route))
+                       : shared_object(std::get<std::shared_ptr<const PredecessorDAG>>(r.route));
+  return py::reinterpret_steal<py::typing::Union<Path, PredecessorDAG>>(out.release());
+}
+
+
+// A per-edge integer argument of from_routes read without narrowing (its type defects raise
+// here); its values are checked later, in the order of the call's validation.
+std::optional<CheckedIntegerVector> wide_or_none(const py::object& obj, const char* name) {
+  if (obj.is_none()) return std::nullopt;
+  (void)sequence_length(obj, name);
+  return wide_integers(obj, name);
+}
+
+// Validate and narrow captured weights at the factory's weight-validation step.
+std::vector<Amount> checked_edge_weights(const CheckedIntegerVector& weights, std::size_t num_edges) {
+  if (weights.size() != num_edges) throw py::value_error("edge_weights: expected " + std::to_string(num_edges) + " entries");
+  for (std::size_t e = 0; e < num_edges; ++e) {
+    if (!weights.in(e, 0, kDomainLimit - 1)) {
+      throw py::value_error("edge_weights[" + std::to_string(e) + "] must be an integer in [0, 2^62)");
+    }
+  }
+  return weights.narrow<Amount>();
+}
+
+} // namespace
+
+void register_program(py::module_& m) {
+  py::enum_<TunnelStatus>(m, "TunnelStatus",
+                          "A tunnel's state. UP; INSUFFICIENT_BANDWIDTH and COST_CEILING_EXCEEDED: T1's setup left it down (no path\n"
+                          "passes the bandwidth filter, or the cheapest exceeds the cost ceiling): no path, weight 0, and it\n"
+                          "stays down in every forwarding of its program; and in one forwarding only (a by_tunnel row)\n"
+                          "FAILED: its path touches a node or an edge the forwarding policy's Eligibility excludes, so it\n"
+                          "gets nothing and its head splits over its other entries (replay), and BLACKHOLED: up, but its\n"
+                          "path reaches a black hole of stale forwarding, where its traffic is dropped.")
+      .value("UP", TunnelStatus::Up)
+      .value("INSUFFICIENT_BANDWIDTH", TunnelStatus::InsufficientBandwidth)
+      .value("COST_CEILING_EXCEEDED", TunnelStatus::CostCeilingExceeded)
+      .value("FAILED", TunnelStatus::Failed)
+      .value("BLACKHOLED", TunnelStatus::Blackholed);
+
+  py::class_<Tunnel>(m, "Tunnel",
+                     "One tunnel (a path entry) of a ForwardingProgram, read-only. entry_id: the entry identifier (T1 and\n"
+                     "T2: j*H + i for round j and roster position i, T2's dead heads leaving holes; CentralizedTE and ShortestPaths\n"
+                     "OPTIMIZED: the path's position in the decomposition order; supplied routes: the route's position in\n"
+                     "the list), never a position in program.tunnels; head; local_index: its position among the head's entries of both kinds;\n"
+                     "destination: where its path ends; edges: its EdgeIds in path order; path_cost: the sum of their\n"
+                     "costs (all three None for a tunnel that is down); status: UP, INSUFFICIENT_BANDWIDTH or\n"
+                     "COST_CEILING_EXCEEDED; requested_bandwidth and reserved_bandwidth: T1's strict bandwidth (its request,\n"
+                     "and what it holds on every link of its path: the request when UP, else 0; 0 for the other models);\n"
+                     "planned_bandwidth: T2's planned bandwidth\n"
+                     "u (metadata, never held; 0 for the other models); weight: its integer share among the head's\n"
+                     "entries (T1: 1 up, 0 down; T2: 1; a controller path: its solved amount).")
+      .def_property_readonly("entry_id", int_reader(&Tunnel::entry_id))
+      .def_property_readonly("head", int_reader(&Tunnel::head))
+      .def_property_readonly("local_index", int_reader(&Tunnel::local_index))
+      .def_property_readonly("destination", optional_int_reader(&Tunnel::destination))
+      .def_property_readonly(
+
+          "edges",
+          [](const Tunnel& t) -> py::object {
+            return t.edges.has_value() ? py::object(ints_tuple(*t.edges)) : py::object(py::none());
+          },
+          "the path's EdgeIds in path order; None for a tunnel that is down")
+      .def_property_readonly("path_cost", optional_int_reader(&Tunnel::path_cost))
+      .def_property_readonly("status", [](const Tunnel& t) { return typed_object(t.status); })
+      .def_property_readonly("requested_bandwidth", int_reader(&Tunnel::requested_bandwidth))
+      .def_property_readonly("reserved_bandwidth", int_reader(&Tunnel::reserved_bandwidth))
+      .def_property_readonly("planned_bandwidth", int_reader(&Tunnel::planned_bandwidth))
+      .def_property_readonly("weight", int_reader(&Tunnel::weight))
+      .def("__repr__", [](const Tunnel& t) {
+        return "Tunnel(entry_id=" + std::to_string(t.entry_id) + ", head=" + std::to_string(t.head) +
+               ", weight=" + std::to_string(t.weight) + ")";
+      });
+
+  py::class_<RouteDefinition>(m, "RouteDefinition",
+                    "A supplied route for ForwardingProgram.from_routes: a Path with one edge per hop (a tunnel) or a\n"
+                    "PredecessorDAG (a split route) starting at `head`; weight is its integer share among the head's routes\n"
+                    "(0 allowed: it carries nothing). from_routes validates it.")
+      .def(py::init([](const py::object& head, const py::object& route, const py::object& weight) {
+             RouteDefinition r;
+             r.head = static_cast<NodeId>(
+                 integer_value(head, std::numeric_limits<NodeId>::min(), std::numeric_limits<NodeId>::max(), "head"));
+             if (py::isinstance<Path>(route)) {
+               r.route = std::shared_ptr<const Path>(route.cast<std::shared_ptr<Path>>());
+             } else if (py::isinstance<PredecessorDAG>(route)) {
+               r.route = std::shared_ptr<const PredecessorDAG>(route.cast<std::shared_ptr<PredecessorDAG>>());
+             } else {
+               throw py::type_error("RouteDefinition route must be a Path or a PredecessorDAG (got " +
+                                    std::string(py::str(py::type::of(route).attr("__name__"))) + ")");
+             }
+             r.weight = integer_value(weight, std::numeric_limits<Amount>::min(), std::numeric_limits<Amount>::max(), "weight");
+             return r;
+           }),
+           py::arg("head"), py::arg("route"), py::kw_only(), py::arg("weight") = 1,
+           "RouteDefinition(head, route, *, weight=1): head a NodeId, route a Path or a PredecessorDAG (TypeError\n"
+           "otherwise), weight an integer (checked in [0, 2^62) by from_routes).")
+      .def_property_readonly("head", int_reader(&RouteDefinition::head), "the route's head (a source of the program)")
+      .def_property_readonly("route", &route_obj, "the Path (a tunnel) or the PredecessorDAG (a split route)")
+      .def_property_readonly("weight", int_reader(&RouteDefinition::weight), "the route's integer share among the head's routes")
+      .def("__repr__", [](const RouteDefinition& r) {
+        return "RouteDefinition(head=" + std::to_string(r.head) + ", weight=" + std::to_string(r.weight) + ")";
+      });
+
+  py::class_<ForwardingProgram, std::shared_ptr<ForwardingProgram>>(
+      m, "ForwardingProgram",
+      "An immutable value: one demand's routes and integer weights. sources and destinations (the normalized\n"
+      "sets); tunnels: the path entries in ascending entry_id (split routes are not listed); source_weights: the\n"
+      "captured weights ((source, weight) for every roster source, ascending): optimized controllers' solved\n"
+      "supplies, weighted CentralizedTE's declared weights, or None for equal sources (round robin). Each head splits its share by\n"
+      "highest averages over its entries' weights; identical routes are never merged. ShortestPaths and CentralizedTE\n"
+      "produce one (FlowPolicy.program, PlacementResult.program), and so do T1 and T2 (their tunnels);\n"
+      "from_routes builds one from given routes and from_dag one shared hop-by-hop program on a DAG; Pinned\n"
+      "forwards one. No public constructor.")
+      .def_property_readonly(
+
+          "sources", [](const ForwardingProgram& p) { return ints_tuple(p.sources()); }, "the source set, ascending")
+      .def_property_readonly(
+
+          "destinations", [](const ForwardingProgram& p) { return ints_tuple(p.destinations()); },
+          "the destination set, ascending")
+      .def_property_readonly(
+
+          "tunnels",
+          [](const ForwardingProgram& p) {
+            const auto t = p.tunnels();
+            return tuple_of(std::vector<Tunnel>(t.begin(), t.end()));
+          },
+          "the program's tunnels (Tunnel), ascending entry_id")
+      .def_property_readonly(
+
+          "source_weights",
+          [](const ForwardingProgram& p) -> py::object {
+            const auto& w = p.source_weights();
+            if (!w.has_value()) return py::none();
+            return pairs_tuple(*w);
+          },
+          "the captured source weights ((source, weight), ascending), or None for equal sources")
+      .def_static(
+          "from_routes",
+          [](const std::shared_ptr<Graph>& graph, const py::object& sources, const py::object& destinations,
+             const py::object& routes, std::optional<RouteAllocation> allocation, std::optional<WeightBasis> weight_basis,
+             const py::object& edge_weights, const py::object& residual) {
+            if (!graph) throw py::type_error("graph must be a Graph");
+            // Conversion first (TypeError and integer type defects), then the validation order of
+            // from_routes; the values beyond int64 are checked here in that order.
+            if (is_invalid_sequence(routes)) throw py::type_error("routes must be a sequence of RouteDefinition");
+            std::vector<RouteDefinition> rs;
+            for (const auto& item : py::reinterpret_borrow<py::sequence>(routes)) {
+              if (!py::isinstance<RouteDefinition>(item)) throw py::type_error("routes must be a sequence of RouteDefinition");
+              rs.push_back(item.cast<RouteDefinition>());
+            }
+            const auto ew = wide_or_none(edge_weights, "edge_weights");
+            const auto rw = wide_or_none(residual, "residual");
+            const auto n = graph->num_nodes();
+            const auto s = detail::node_set(node_ids(sources, n, "sources"), n, "sources");
+            const auto d = detail::node_set(node_ids(destinations, n, "destinations"), n, "destinations");
+            detail::check_disjoint(s, d, "sources", "destinations");
+            if (rs.empty()) throw py::value_error("routes must not be empty");
+            bool any_dag = false;
+            for (const auto& r : rs) any_dag = any_dag || std::holds_alternative<std::shared_ptr<const PredecessorDAG>>(r.route);
+            detail::check_route_options("from_routes", any_dag, allocation, weight_basis, ew.has_value(), rw.has_value());
+            RouteOptions options;
+            options.allocation = allocation;
+            options.weight_basis = weight_basis;
+            if (ew.has_value()) options.edge_weights = checked_edge_weights(*ew, static_cast<std::size_t>(graph->num_edges()));
+            if (rw.has_value()) options.residual = edge_amounts(residual, *graph, "residual", "residual (units)").narrow<Amount>();
+            auto checked = native_call<false>([&] { return detail::check_route_definitions(*graph, s, d, rs, options); });
+            return typed_shared(native_call([&] {
+              auto prepared = std::move(checked);
+              return detail::ProgramAccess::from_checked_routes(s, d, rs, std::move(prepared));
+            }));
+          },
+          py::arg("graph"), py::arg("sources"), py::arg("destinations"), py::arg("routes"), py::kw_only(),
+          py::arg("allocation") = py::none(), py::arg("weight_basis") = py::none(), py::arg("edge_weights") = py::none(),
+          py::arg("residual") = py::none(),
+          "Validate and freeze supplied routes -> ForwardingProgram. A wrong type raises TypeError; structural,\n"
+          "range and combination defects raise ValueError, in this order: the endpoint sets; `routes must not be empty`; when no route is a PredecessorDAG, any option given\n"
+          "(`<allocation, weight_basis, edge_weights or residual> applies only to PredecessorDAG routes`); allocation\n"
+          "OPTIMIZED (`from_routes allocation must be EQUAL or WEIGHTED`); weight_basis only with allocation=WEIGHTED,\n"
+          "EXPLICIT with edge_weights, RESIDUAL_SNAPSHOT with residual; edge_weights' length and entries in [0,\n"
+          "2^62) and residual's (one entry per edge in [0, capacity]); then each route in list order: its\n"
+          "route's graph, its head a source, a Path with one edge per hop that starts at the head, ends at a\n"
+          "destination and meets none before, a PredecessorDAG with a walk from the head to a destination, its weight\n"
+          "in [0, 2^62). Order and duplicates are kept; a route of weight 0 is validated in full. allocation\n"
+          "(None: EQUAL) is the interior split of the PredecessorDAG routes; each split route is its own\n"
+          "split context (a router splits only that route's share). The roster is the sources with a route.")
+      .def_static(
+          "from_dag",
+          [](const std::shared_ptr<Graph>& graph, const py::object& sources, const py::object& destinations,
+             const py::object& dag, std::optional<RouteAllocation> allocation, std::optional<WeightBasis> weight_basis,
+             const py::object& edge_weights, const py::object& residual) {
+            if (!graph) throw py::type_error("graph must be a Graph");
+            // Conversion first (TypeError and integer type defects), then the validation order of
+            // from_dag; the values beyond int64 are checked here in that order.
+            if (!py::isinstance<PredecessorDAG>(dag)) {
+              throw py::type_error("dag must be a PredecessorDAG (got " + std::string(py::str(py::type::of(dag).attr("__name__"))) +
+                                   ")");
+            }
+            const auto shared_dag = dag.cast<std::shared_ptr<PredecessorDAG>>();
+            const auto ew = wide_or_none(edge_weights, "edge_weights");
+            const auto rw = wide_or_none(residual, "residual");
+            const auto n = graph->num_nodes();
+            const auto s = detail::node_set(node_ids(sources, n, "sources"), n, "sources");
+            const auto d = detail::node_set(node_ids(destinations, n, "destinations"), n, "destinations");
+            detail::check_disjoint(s, d, "sources", "destinations");
+            if (shared_dag->graph_uid() != graph->uid()) throw py::value_error("dag belongs to another graph");
+            detail::check_route_options("from_dag", true, allocation, weight_basis, ew.has_value(), rw.has_value());
+            RouteOptions options;
+            options.allocation = allocation;
+            options.weight_basis = weight_basis;
+            if (ew.has_value()) options.edge_weights = checked_edge_weights(*ew, static_cast<std::size_t>(graph->num_edges()));
+            if (rw.has_value()) options.residual = edge_amounts(residual, *graph, "residual", "residual (units)").narrow<Amount>();
+            return typed_shared(native_call([&] { return ForwardingProgram::from_dag(*graph, s, d, shared_dag, options); }));
+          },
+          py::arg("graph"), py::arg("sources"), py::arg("destinations"), py::arg("dag"), py::kw_only(),
+          py::arg("allocation") = py::none(), py::arg("weight_basis") = py::none(), py::arg("edge_weights") = py::none(),
+          py::arg("residual") = py::none(),
+          "One shared hop-by-hop program on a supplied PredecessorDAG of the graph -> ForwardingProgram: the sources\n"
+          "allocated equally and pooled at every shared router exactly as ShortestPaths EQUAL/WEIGHTED (one\n"
+          "split context), the DAG trimmed to the walks from each source to its first destinations. A wrong type\n"
+          "raises TypeError; structural, range and combination defects raise ValueError, in this order: the endpoint sets; `dag belongs to another graph`; allocation OPTIMIZED\n"
+          "(`from_dag allocation must be EQUAL or WEIGHTED`); weight_basis only with allocation=WEIGHTED, EXPLICIT\n"
+          "with edge_weights, RESIDUAL_SNAPSHOT with residual; edge_weights' length and entries in [0, 2^62) and\n"
+          "residual's (one entry per edge in [0, capacity]). A dag of another type raises TypeError. The roster is\n"
+          "the sources that reach a destination in the DAG (possibly none): one split route per roster source,\n"
+          "identified by roster position, no tunnel; a replay rebuilds the roster on the DAG.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/graph.cpp b/bindings/python/graph.cpp
new file mode 100644
index 0000000..77f2920
--- /dev/null
+++ b/bindings/python/graph.cpp
@@ -0,0 +1,221 @@
+// Graph: the immutable graph on integer units and its validating constructor.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <string>
+
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/graph.hpp"
+#include "integers.hpp"
+#include "strict_float.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// The unit-value step on the capacity argument whatever its shape (the shape step comes next):
+// every integer entry it holds must lie in [0, 2^62). A NumPy array is read flattened; nested
+// entries of a Python sequence and a non-integer non-sequence are left to the shape step.
+void check_unit_values(const py::handle& edge_capacity_units) {
+  const auto out_of_domain = [](const std::string& what, const std::string& value) {
+    return py::value_error(what + " = " + value + " is outside the units domain [0, 2^62)");
+  };
+  if (py::isinstance<py::array>(edge_capacity_units)) {
+    py::object flat = edge_capacity_units.attr("ravel")();
+    const auto w = wide_integers(flat, "edge_capacity_units");
+    for (std::size_t i = 0; i < w.size(); ++i) {
+      if (!w.in(i, 0, kDomainLimit - 1)) throw out_of_domain("edge_capacity_units[" + std::to_string(i) + "]", w.text(i));
+    }
+    return;
+  }
+  if (!is_invalid_sequence(edge_capacity_units)) {
+    auto seq = py::reinterpret_borrow<py::sequence>(edge_capacity_units);
+    for (std::size_t i = 0; i < seq.size(); ++i) {
+      py::object item = seq[i];
+      if (is_nested(item)) continue;
+      const std::string what = "edge_capacity_units[" + std::to_string(i) + "]";
+      py::object idx = python_int(item, what);
+      int overflow = 0;
+      const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+      if (overflow != 0 || v < 0 || v >= kDomainLimit) throw out_of_domain(what, std::string(py::str(idx)));
+    }
+    return;
+  }
+  if (!is_bool(edge_capacity_units) && PyIndex_Check(edge_capacity_units.ptr())) {
+    py::object idx = python_int(edge_capacity_units, "edge_capacity_units");
+    int overflow = 0;
+    const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+    if (overflow != 0 || v < 0 || v >= kDomainLimit) throw out_of_domain("edge_capacity_units", std::string(py::str(idx)));
+  }
+}
+
+std::shared_ptr<Graph> make_graph(const py::object& num_nodes, const py::object& source,
+                                  const py::object& destination, const py::object& edge_capacity_units,
+                                  const py::object& cost, StrictFloat resolution) {
+  // The constructor's validation order: the resolution, the unit values, the shapes, zero or
+  // negative costs, the remaining bounds (ids in range, then the sums); every value is read
+  // without narrowing, and the messages are the C++ constructor's, which re-checks the same order.
+  (void)resolution_exponent(resolution);
+  check_unit_values(edge_capacity_units);
+  // The shapes: num_nodes, then every array argument rank 1 (in signature order), then equal
+  // lengths; no entry of source, destination or cost is read before the cost step.
+  const auto n = integer_value(num_nodes, 0, std::numeric_limits<std::int32_t>::max(), "num_nodes");
+  const std::size_t m = sequence_length(source, "edge_sources");
+  const std::size_t md = sequence_length(destination, "edge_destinations");
+  const std::size_t mu = sequence_length(edge_capacity_units, "edge_capacity_units");
+  const std::size_t mc = sequence_length(cost, "edge_costs");
+  if (md != m || mu != m || mc != m) {
+    throw py::value_error("edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got " +
+                          std::to_string(m) + ", " + std::to_string(md) + ", " + std::to_string(mu) + ", " +
+                          std::to_string(mc) + ")");
+  }
+  const auto cap = wide_integers(edge_capacity_units, "edge_capacity_units");  // rank 1, values checked
+  if (m > static_cast<std::size_t>(std::numeric_limits<std::int32_t>::max())) {
+    throw py::value_error("the number of edges exceeds INT32_MAX (array length)");
+  }
+  const auto w = wide_integers(cost, "edge_costs");
+  for (std::size_t i = 0; i < m; ++i) {
+    if (w.sign(i) < 0 || (w.sign(i) == 0 && w.value[i] < 1)) {
+      throw py::value_error("edge_costs[" + std::to_string(i) + "] = " + w.text(i) + ": costs must be positive (edge_costs >= 1)");
+    }
+  }
+  const auto s = wide_integers(source, "edge_sources");
+  const auto d = wide_integers(destination, "edge_destinations");
+  for (std::size_t i = 0; i < m; ++i) {
+    if (!s.in(i, 0, n - 1) || !d.in(i, 0, n - 1)) {
+      throw py::value_error("edge " + std::to_string(i) + ": endpoint (" + s.text(i) + ", " + d.text(i) +
+                            ") out of node range [0, " + std::to_string(n) + ")");
+    }
+  }
+  constexpr auto kLimit = static_cast<std::uint64_t>(kDomainLimit);
+  std::uint64_t cap_sum = 0;
+  std::uint64_t cost_sum = 0;
+  for (std::size_t i = 0; i < m; ++i) {
+    cap_sum += static_cast<std::uint64_t>(cap.value[i]);  // each below 2^62: no wrap before the check
+    if (cap_sum >= kLimit) {
+      throw py::value_error("the sum of all capacities reaches the bound of the units domain (2^62 units)");
+    }
+    if (w.sign(i) > 0 || static_cast<std::uint64_t>(w.value[i]) >= kLimit - cost_sum) {
+      throw py::value_error("the sum of all edge costs reaches the bound 2^62: path costs would overflow int64");
+    }
+    cost_sum += static_cast<std::uint64_t>(w.value[i]);
+  }
+  auto cap_v = cap.narrow<Amount>();
+  auto cost_v = w.narrow<Cost>();
+  auto src_v = s.narrow<NodeId>();
+  auto dst_v = d.narrow<NodeId>();
+  return native_call([&] { return std::make_shared<Graph>(static_cast<std::int32_t>(n), src_v, dst_v, cap_v, cost_v, resolution); });
+}
+
+} // namespace
+
+void register_graph(py::module_& m) {
+  py::class_<Graph, std::shared_ptr<Graph>>(
+      m, "Graph",
+      "Immutable directed multigraph on integer units (parallel edges and self-loops allowed). Edges are\n"
+      "given in input order and numbered by sorting on (source, cost, destination), ties kept in input\n"
+      "order: that number is the public EdgeId. input_positions()[e] is the input position of edge e.\n"
+      "Per-edge values use EdgeId order; incoming_edges() instead lists EdgeIds in incoming-slot order.\n"
+      "Costs are positive integers; capacities are int64 units of the explicit resolution q (a power of\n"
+      "two in [2^-32, 2^32]); physical capacities enter through to_units.")
+      .def(py::init(&make_graph), py::arg("num_nodes"), py::arg("edge_sources"), py::arg("edge_destinations"),
+           py::arg("edge_capacity_units"), py::arg("edge_costs"), py::arg("resolution"),
+           "Validates, in order, and reports the first defect: the resolution (a power of two in\n"
+           "[2^-32, 2^32]; a bool is a TypeError), the unit values (every capacity in [0, 2^62)), the array\n"
+           "shapes, zero or negative costs, the remaining bounds (endpoints in range, then the capacity\n"
+           "and cost sums below 2^62); a value of a wrong type (a bool or a float for an integer, a\n"
+           "non-sequence, an array of another rank or dtype) raises TypeError, a value outside its domain\n"
+           "ValueError. Integers are read without narrowing, so the error does not depend on how the\n"
+           "input is represented.")
+      .def("uid", &Graph::uid, "process-unique id (never reused)")
+      .def("resolution", &Graph::resolution, "the resolution q (units of capacity)")
+      .def("num_nodes", &Graph::num_nodes, "N: node ids are 0 .. N - 1")
+      .def("num_edges", &Graph::num_edges, "E: EdgeIds are 0 .. E - 1")
+      .def("max_edge_cost", &Graph::max_edge_cost, "largest edge cost (0 without edges)")
+      .def("edge_cost_gcd", &Graph::edge_cost_gcd, "gcd of the edge costs (0 without edges)")
+      .def(
+          "edge_capacity_units", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.edge_capacity_units(), self);
+          },
+          "int64[E] capacities in units, id order (read-only view)")
+      .def(
+          "edge_costs", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.edge_costs(), self);
+          },
+          "int64[E] costs, id order (read-only view)")
+      .def(
+          "edge_sources", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.edge_sources(), self);
+          },
+          "int32[E] source node per edge (read-only view)")
+      .def(
+          "edge_destinations", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.edge_destinations(), self);
+          },
+          "int32[E] destination node per edge (read-only view)")
+      .def(
+          "input_positions", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.input_positions(), self);
+          },
+          "int32[E]: EdgeId -> input position (read-only view); build the inverse yourself if needed")
+      .def(
+          "outgoing_offsets", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.outgoing_offsets(), self);
+          },
+          "int32[N + 1]: the out-edges of u are the ids [outgoing_offsets()[u], outgoing_offsets()[u + 1])")
+      .def(
+          "incoming_offsets", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.incoming_offsets(), self);
+          },
+          "int32[N + 1]: the in-edges of v are incoming_edges()[incoming_offsets()[v] : incoming_offsets()[v + 1]]")
+      .def(
+          "incoming_edges", [](const py::object& self) {
+            const auto& g = self.cast<const Graph&>();
+            return readonly_view(g.incoming_edges(), self);
+          },
+          "int32[E]: the in-edges of v in (cost, source, input) order, as EdgeIds")
+      .def(
+          "eligibility",
+          [](const Graph& g, const py::object& excluded_nodes, const py::object& excluded_edges) {
+            // Nodes, then edges, each range-checked before narrowing (the constructor's order).
+            const auto xn = wide_integers(excluded_nodes, "excluded_nodes");
+            for (std::size_t i = 0; i < xn.size(); ++i) {
+              if (!xn.in(i, 0, static_cast<std::int64_t>(g.num_nodes()) - 1)) {
+                throw py::value_error("excluded node " + xn.text(i) + " out of node range [0, " +
+                                      std::to_string(g.num_nodes()) + ")");
+              }
+            }
+            const auto xe = wide_integers(excluded_edges, "excluded_edges");
+            for (std::size_t i = 0; i < xe.size(); ++i) {
+              if (!xe.in(i, 0, static_cast<std::int64_t>(g.num_edges()) - 1)) {
+                throw py::value_error("excluded edge " + xe.text(i) + " out of edge range [0, " +
+                                      std::to_string(g.num_edges()) + ")");
+              }
+            }
+            const auto nodes = xn.narrow<NodeId>();
+            const auto edges = xe.narrow<EdgeId>();
+            return native_call([&] { return std::make_shared<Eligibility>(g.eligibility(nodes, edges)); });
+          },
+          py::arg("excluded_nodes") = py::tuple(), py::arg("excluded_edges") = py::tuple(),
+          "Static eligibility from excluded node ids and EdgeIds (duplicates and unsorted lists\n"
+          "accepted, out-of-range ids rejected); an edge is allowed when it is not excluded and\n"
+          "both endpoints are allowed. Empty lists mean all allowed (uid 0).");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/hooks.cpp b/bindings/python/hooks.cpp
new file mode 100644
index 0000000..3b37734
--- /dev/null
+++ b/bindings/python/hooks.cpp
@@ -0,0 +1,315 @@
+// The private hooks (NETGRAPH_CORE_PRIVATE_HOOKS builds only): the test controls of Python and
+// native allocation failures and of lowered forwarding size limits, and the apportionment kernels.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include "registration.hpp"
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <cstdlib>
+#include <limits>
+#include <mutex>
+#include <new>
+#include <thread>
+#include <vector>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/types.hpp"
+#include "integers.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// Take the normalized exception, including its traceback, without replacing an existing
+// exception instance. PyErr_GetRaisedException was added in Python 3.12.
+py::object take_raised_exception() {
+#if PY_VERSION_HEX >= 0x030C0000
+  return py::reinterpret_steal<py::object>(PyErr_GetRaisedException());
+#else
+  PyObject* type = nullptr;
+  PyObject* value = nullptr;
+  PyObject* traceback = nullptr;
+  PyErr_Fetch(&type, &value, &traceback);
+  PyErr_NormalizeException(&type, &value, &traceback);
+  const auto kind = py::reinterpret_steal<py::object>(type);
+  auto error = py::reinterpret_steal<py::object>(value);
+  const auto trace = py::reinterpret_steal<py::object>(traceback);
+  if (trace && PyException_SetTraceback(error.ptr(), trace.ptr()) < 0) throw py::error_already_set();
+  return error;
+#endif
+}
+
+// The allocation-failure hook: the k-th object-domain allocation fails (Python's allocator
+// wrapped for one call, then restored). The allocator is process-wide while the call runs, so
+// the hook serves one caller at a time (the tests); its counters are atomics because the module
+// does not hold the GIL for every thread (mod_gil_not_used).
+PyMemAllocatorEx g_saved_allocator {};
+std::atomic<long> g_fail_countdown {-1};
+std::atomic<long> g_fail_seen {0};
+std::atomic<bool> g_fail_hit {false};
+std::atomic<bool> g_numpy_only {false};
+
+bool fail_now() {
+  if (g_numpy_only.load() && !in_numpy_conversion) return false;
+  g_fail_seen.fetch_add(1);
+  if (g_fail_countdown.load() < 0) return false;
+  if (g_fail_countdown.fetch_sub(1) == 0) {
+    g_fail_hit.store(true);
+    return true;
+  }
+  return false;
+}
+void* failing_malloc(void*, std::size_t n) { return fail_now() ? nullptr : g_saved_allocator.malloc(g_saved_allocator.ctx, n); }
+void* failing_calloc(void*, std::size_t n, std::size_t size) {
+  return fail_now() ? nullptr : g_saved_allocator.calloc(g_saved_allocator.ctx, n, size);
+}
+void* failing_realloc(void*, void* ptr, std::size_t n) {
+  return fail_now() ? nullptr : g_saved_allocator.realloc(g_saved_allocator.ctx, ptr, n);
+}
+void forwarding_free(void*, void* ptr) { g_saved_allocator.free(g_saved_allocator.ctx, ptr); }
+
+// The calling thread's trace function (a coverage tool's tracer) suspended while the guard lives:
+// a tracer allocates at the calls and lines of the swept function and absorbs or translates its
+// own failures, which are not the function's.
+class Untraced {
+ public:
+  Untraced()
+      : trace_(PyThreadState_Get()->c_tracefunc),
+        arg_(py::reinterpret_borrow<py::object>(PyThreadState_Get()->c_traceobj)) {
+    PyEval_SetTrace(nullptr, nullptr);
+  }
+  ~Untraced() { PyEval_SetTrace(trace_, arg_.ptr()); }
+  Untraced(const Untraced&) = delete;
+  Untraced& operator=(const Untraced&) = delete;
+
+ private:
+  Py_tracefunc trace_;
+  py::object arg_;
+};
+
+// The native allocation-failure hook: while armed for one call, the k-th allocation of
+// the calling thread through the extension's global operator new (the bindings and the library
+// linked into the extension) throws std::bad_alloc, and the thread's allocations and deletions
+// are counted, so a test also sees what a failed call left allocated. Other threads and other
+// images (libc++, Python) are not counted; the aligned forms are not replaced. The counters are
+// atomics for the same reason as above.
+std::atomic<bool> g_native_armed {false};
+std::atomic<std::thread::id> g_native_owner {};
+std::atomic<long> g_native_countdown {-1};
+std::atomic<long> g_native_seen {0};
+std::atomic<long> g_native_live {0};
+std::atomic<bool> g_native_hit {false};
+
+bool native_counted() noexcept {
+  return g_native_armed.load(std::memory_order_relaxed) && g_native_owner.load() == std::this_thread::get_id();
+}
+
+// Registration may lazily allocate a bucket table which pybind11 keeps after
+// the last instance is removed. In a free-threaded build the address of a new
+// result can select a previously unused shard despite warming the operation.
+// Prepare only those interpreter-owned empty tables before counting the call;
+// native buffers, holders and registry nodes still fail/count in the call.
+void prepare_native_registry() {
+  auto prepare = [](py::detail::instance_map& instances) {
+    if (instances.empty() && instances.bucket_count() <= 1) instances.reserve(1);
+  };
+  auto& internals = py::detail::get_internals();
+#ifdef Py_GIL_DISABLED
+  for (std::size_t i = 0; i <= internals.instance_shards_mask; ++i) {
+    auto& shard = internals.instance_shards[i];
+    std::unique_lock<py::detail::pymutex> lock(shard.mutex);
+    prepare(shard.registered_instances);
+  }
+#else
+  prepare(internals.registered_instances);
+#endif
+}
+
+void* native_allocate(std::size_t n) {
+  if (native_counted()) {
+    g_native_seen.fetch_add(1);
+    if (g_native_countdown.load() >= 0 && g_native_countdown.fetch_sub(1) == 0) {
+      g_native_hit.store(true);
+      throw std::bad_alloc();
+    }
+  }
+  void* p = std::malloc(n == 0 ? 1 : n);
+  if (p == nullptr) throw std::bad_alloc();
+  if (native_counted()) g_native_live.fetch_add(1);
+  return p;
+}
+
+void* native_allocate_nothrow(std::size_t n) noexcept {
+  try {
+    return native_allocate(n);
+  } catch (...) {
+    return nullptr;
+  }
+}
+
+void native_free(void* p) noexcept {
+  if (p != nullptr && native_counted()) g_native_live.fetch_sub(1);
+  std::free(p);
+}
+
+} // namespace
+
+void register_private_hooks(py::module_& m) {
+  register_concurrency_hooks(m);
+  m.def(
+      "_fail_python_allocation",
+      [](const py::object& fn, const py::tuple& args, long k, bool numpy_only) {
+        // Calls fn(*args) with the k-th Python object allocation (from 0) failing, then
+        // restores the allocator. Returns (hit, allocations seen, result or None, exception or
+        // None). One caller at a time: the allocator is process-wide while the call runs.
+        const Untraced untraced;
+        g_numpy_only.store(numpy_only);
+        PyMem_GetAllocator(PYMEM_DOMAIN_OBJ, &g_saved_allocator);
+        PyMemAllocatorEx hook {nullptr, failing_malloc, failing_calloc, failing_realloc, forwarding_free};
+        g_fail_countdown.store(k);
+        g_fail_seen.store(0);
+        g_fail_hit.store(false);
+        PyMem_SetAllocator(PYMEM_DOMAIN_OBJ, &hook);
+        PyObject* r = PyObject_CallObject(fn.ptr(), args.ptr());
+        PyMem_SetAllocator(PYMEM_DOMAIN_OBJ, &g_saved_allocator);
+        g_fail_countdown.store(-1);
+        g_numpy_only.store(false);
+        py::object result = r != nullptr ? py::reinterpret_steal<py::object>(r) : py::object(py::none());
+        py::object error = py::none();
+        if (r == nullptr) error = take_raised_exception();
+        return py::make_tuple(g_fail_hit.load(), g_fail_seen.load(), result, error);
+      },
+      py::arg("fn"), py::arg("args"), py::arg("k"), py::arg("numpy_only") = false,
+      "private test hook: fn(*args) with the k-th Python object allocation failing -> (hit, seen, result, error);\n"
+      "numpy_only=True counts and fails only allocations inside NumPy casts, excluding other binding allocations");
+
+  m.def(
+      "_fail_native_allocation",
+      [](const py::object& fn, const py::tuple& args, long k) {
+        // Calls fn(*args) with the calling thread's k-th native allocation (from 0) failing.
+        // Returns (hit, allocations seen, result or None, exception or None, allocations of the
+        // call still live). One caller at a time.
+        prepare_native_registry();
+        g_native_countdown.store(k);
+        g_native_seen.store(0);
+        g_native_live.store(0);
+        g_native_hit.store(false);
+        g_native_owner.store(std::this_thread::get_id());
+        g_native_armed.store(true);
+        PyObject* r = PyObject_CallObject(fn.ptr(), args.ptr());
+        g_native_armed.store(false);
+        g_native_countdown.store(-1);
+        py::object result = r != nullptr ? py::reinterpret_steal<py::object>(r) : py::object(py::none());
+        py::object error = py::none();
+        if (r == nullptr) error = take_raised_exception();
+        return py::make_tuple(g_native_hit.load(), g_native_seen.load(), result, error, g_native_live.load());
+      },
+      py::arg("fn"), py::arg("args"), py::arg("k"),
+      "private test hook: fn(*args) with the k-th native allocation failing -> (hit, seen, result, error, live)");
+
+  m.def(
+      "_with_forwarding_limits",
+      [](const py::object& fn, const py::tuple& args, const py::object& limits) {
+        // Calls fn(*args) with this thread's forwarding size limits lowered (entry, occurrence,
+        // router, event, dependency; 0 keeps the contract's limit), then restores them. Returns
+        // (result or None, exception or None, the event structures the call's last forwarding
+        // allocated).
+        const auto w = wide_integers(limits, "limits");
+        if (w.size() != 5) throw py::value_error("limits needs 5 entries (got " + std::to_string(w.size()) + ")");
+        std::array<std::int64_t, 5> lowered {};
+        for (std::size_t i = 0; i < 5; ++i) {
+          if (!w.in(i, 0, detail::kForwardingLimit)) throw py::value_error("limits[" + std::to_string(i) + "] = " + w.text(i) + " is out of range");
+          lowered[i] = w.value[i];
+        }
+        auto& current = detail::thread_forwarding_limits();
+        const auto saved = current;
+        current = lowered;
+        detail::thread_lossy_counters().event_structures = 0;
+        PyObject* r = PyObject_CallObject(fn.ptr(), args.ptr());
+        current = saved;
+        py::object result = r != nullptr ? py::reinterpret_steal<py::object>(r) : py::object(py::none());
+        py::object error = py::none();
+        if (r == nullptr) error = take_raised_exception();
+        return py::make_tuple(result, error, detail::thread_lossy_counters().event_structures);
+      },
+      py::arg("fn"), py::arg("args"), py::arg("limits"),
+      "private test hook: fn(*args) with the five forwarding size limits lowered (0: unchanged) ->\n"
+      "(result, error, event structures)");
+
+  m.def(
+      "_check_forwarding_count",
+      [](const py::object& counter, const py::object& n) {
+        // The forwarding sizes' counting step on one exact count (counter: entry 0, occurrence 1,
+        // router 2, event 3, dependency 4), under this thread's limits.
+        const auto c = integer_value(counter, 0, 4, "counter");
+        const auto v = integer_value(n, 0, std::numeric_limits<std::int64_t>::max(), "n");
+        detail::check_forwarding_count(static_cast<detail::ForwardingCounter>(c), v);
+      },
+      py::arg("counter"), py::arg("n"),
+      "private: the forwarding size check of one count (entry, occurrence, router, event, dependency:\n"
+      "0 to 4); raises the limit's ValueError above it");
+
+  m.def(
+      "_round_robin",
+      [](const py::object& total, const py::object& k) {
+        const auto t = integer_value(total, 0, kDomainLimit - 1, "total");
+        const auto n = integer_value(k, 1, 1 << 20, "k");
+        std::vector<Amount> out(static_cast<std::size_t>(n));
+        detail::round_robin(t, out);
+        return out;
+      },
+      py::arg("total"), py::arg("k"),
+      "private: round robin of total units over k members (the first total % k get one unit more)");
+
+  m.def(
+      "_highest_averages",
+      [](const py::object& total, const py::object& weights) {
+        const auto t = integer_value(total, 0, kDomainLimit - 1, "total");
+        const auto w = wide_integers(weights, "weights");
+        if (w.size() == 0) throw py::value_error("highest averages over no member");
+        for (std::size_t i = 0; i < w.size(); ++i) {
+          if (!w.in(i, 1, kDomainLimit - 1)) {
+            throw py::value_error("weights[" + std::to_string(i) + "] = " + w.text(i) + " is outside [1, 2^62)");
+          }
+        }
+        const auto wv = w.narrow<Amount>();
+        std::vector<Amount> out(wv.size());
+        detail::highest_averages(t, wv, out);
+        return out;
+      },
+      py::arg("total"), py::arg("weights"),
+      "private: highest-averages (D'Hondt) apportionment of total units over positive weights, ties by\n"
+      "the lower index");
+}
+
+} // namespace netgraph::core::bindings
+
+// The extension's global allocation functions in a hooks build: the native allocation-failure
+// hook above. Unarmed they allocate as the defaults do (malloc and free, which every image's
+// operator delete accepts).
+using netgraph::core::bindings::native_allocate;
+using netgraph::core::bindings::native_allocate_nothrow;
+using netgraph::core::bindings::native_free;
+
+void* operator new(std::size_t n) { return native_allocate(n); }
+void* operator new[](std::size_t n) { return native_allocate(n); }
+void* operator new(std::size_t n, const std::nothrow_t&) noexcept { return native_allocate_nothrow(n); }
+void* operator new[](std::size_t n, const std::nothrow_t&) noexcept { return native_allocate_nothrow(n); }
+void operator delete(void* p) noexcept { native_free(p); }
+void operator delete[](void* p) noexcept { native_free(p); }
+void operator delete(void* p, std::size_t) noexcept { native_free(p); }
+void operator delete[](void* p, std::size_t) noexcept { native_free(p); }
+void operator delete(void* p, const std::nothrow_t&) noexcept { native_free(p); }
+void operator delete[](void* p, const std::nothrow_t&) noexcept { native_free(p); }
+
+#endif
diff --git a/bindings/python/integers.hpp b/bindings/python/integers.hpp
new file mode 100644
index 0000000..eea1200
--- /dev/null
+++ b/bindings/python/integers.hpp
@@ -0,0 +1,253 @@
+/*
+  Integer arguments from Python: Python ints, NumPy integer scalars and integer arrays, read
+  without narrowing (CheckedIntegerVector) and validated in the C++ constructors' order before any
+  conversion to the C++ types, so the reported error does not depend on how the input is
+  represented; bools and floats are rejected, never truncated. Also the shape step of sequence
+  arguments, the per-edge amount arrays and the node sets.
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+#include "strict_bool.hpp"
+#include "numpy_conversion.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+// A Python bool or a numpy.bool_, by type identity (as StrictBool reads them).
+inline bool is_bool(const py::handle& obj) {
+  return PyBool_Check(obj.ptr()) || reinterpret_cast<PyObject*>(Py_TYPE(obj.ptr())) == numpy_bool_type();
+}
+
+// A wrong-type integer argument (a bool, a float, a string, None, another class): TypeError at
+// every position, the value errors of a well-typed integer being ValueError (the library's one rule
+// for the class of an input error).
+[[noreturn]] inline void throw_not_an_integer(const py::handle& item, const std::string& what) {
+  throw py::type_error(what + " must be an integer (got " + std::string(py::str(py::type::of(item).attr("__name__"))) + ")");
+}
+
+// The Python int of any non-bool object with __index__, read with PyNumber_Index; bools and
+// objects without that protocol are rejected (throw_not_an_integer), and an exception of the
+// object's own __index__ propagates as raised. The result is an exact int, so PyLong_AsLongLongAndOverflow
+// cannot fail on it.
+inline py::object python_int(const py::handle& item, const std::string& what) {
+  if (is_bool(item) || !PyIndex_Check(item.ptr())) throw_not_an_integer(item, what);
+  py::object idx = py::reinterpret_steal<py::object>(PyNumber_Index(item.ptr()));
+  if (!idx) throw py::error_already_set();
+  return idx;
+}
+
+// One integer of [lo, hi] (scalar arguments).
+inline std::int64_t integer_value(const py::handle& item, std::int64_t lo, std::int64_t hi, const std::string& what) {
+  py::object idx = python_int(item, what);
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  if (overflow != 0 || v < lo || v > hi) {
+    throw py::value_error(what + " = " + std::string(py::str(idx)) + " is out of range [" +
+                          std::to_string(lo) + ", " + std::to_string(hi) + "]");
+  }
+  return static_cast<std::int64_t>(v);
+}
+
+// A 1-D integer sequence read without narrowing: every entry's int64 value where it fits, and
+// the sign of the overflow where it does not (+1 above INT64_MAX, -1 below INT64_MIN). Only type
+// defects raise here (a non-integer, a bool, a float array, a non-sequence); every value bound
+// is checked by the caller in the C++ constructor's order, so the reported error does not depend
+// on the representation of the input.
+struct CheckedIntegerVector {
+  py::object source;
+  std::vector<std::int64_t> value;
+  std::vector<std::int8_t> overflow;  // empty when no entry overflows
+  [[nodiscard]] std::size_t size() const noexcept { return value.size(); }
+  [[nodiscard]] int sign(std::size_t i) const noexcept { return overflow.empty() ? 0 : overflow[i]; }
+  // Entry i of the source as given, through a checked call (pybind11's int index reports a
+  // failed allocation as RuntimeError).
+  [[nodiscard]] py::object item(std::size_t i) const {
+    PyObject* o = PySequence_GetItem(source.ptr(), static_cast<Py_ssize_t>(i));
+    if (o == nullptr) throw py::error_already_set();
+    return py::reinterpret_steal<py::object>(o);
+  }
+  // The entry as Python prints it (exact also beyond int64).
+  [[nodiscard]] std::string text(std::size_t i) const {
+    if (sign(i) == 0) return std::to_string(value[i]);
+    return std::string(py::str(item(i)));
+  }
+  [[nodiscard]] bool in(std::size_t i, std::int64_t lo, std::int64_t hi) const noexcept {
+    return sign(i) == 0 && value[i] >= lo && value[i] <= hi;
+  }
+  // The entry as an exact Python int (an overflowing entry compared with another). The entry is
+  // converted again here, so its __index__ may now fail: that exception propagates as raised.
+  [[nodiscard]] py::object exact(std::size_t i) const {
+    py::object entry = item(i);
+    py::object idx = py::reinterpret_steal<py::object>(PyNumber_Index(entry.ptr()));
+    if (!idx) throw py::error_already_set();
+    return idx;
+  }
+  template <typename T>
+  [[nodiscard]] std::vector<T> narrow() const {  // after every bound was checked
+    return std::vector<T>(value.begin(), value.end());
+  }
+};
+
+inline bool is_invalid_sequence(const py::handle& obj) {
+  return py::isinstance<py::str>(obj) || py::isinstance<py::bytes>(obj) || !py::isinstance<py::sequence>(obj);
+}
+
+// A type or shape defect of a sequence argument (a non-sequence, a string, a nested entry, an
+// array of another rank or of a non-integer dtype): TypeError, as for the scalars
+// (throw_not_an_integer); its length is a value.
+[[noreturn]] inline void throw_vector_defect(const std::string& text) { throw py::type_error(text); }
+
+inline CheckedIntegerVector wide_integers(const py::handle& obj, const char* name) {
+  CheckedIntegerVector out;
+  out.source = py::reinterpret_borrow<py::object>(obj);
+  if (py::isinstance<py::array>(obj)) {
+    auto arr = py::reinterpret_borrow<py::array>(obj);
+    if (arr.ndim() != 1) {
+      throw_vector_defect(std::string(name) + " must be a 1-D array (got " + std::to_string(arr.ndim()) + " dimensions)");
+    }
+    const char kind = arr.dtype().kind();
+    if (kind != 'i' && kind != 'u') {
+      throw_vector_defect(std::string(name) + " entries must be integers (got dtype " + std::string(py::str(arr.dtype())) + ")");
+    }
+    out.value.reserve(static_cast<std::size_t>(arr.size()));
+    if (kind == 'u' && arr.itemsize() == 8) {
+      const auto u = numpy_conversion<std::uint64_t>(arr);
+      auto r = u.unchecked<1>();
+      constexpr auto kMax = static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max());
+      for (py::ssize_t i = 0; i < r.shape(0); ++i) {
+        if (r(i) > kMax) {
+          if (out.overflow.empty()) out.overflow.assign(static_cast<std::size_t>(r.shape(0)), 0);
+          out.overflow[static_cast<std::size_t>(i)] = 1;
+          out.value.push_back(std::numeric_limits<std::int64_t>::max());
+        } else {
+          out.value.push_back(static_cast<std::int64_t>(r(i)));
+        }
+      }
+      return out;
+    }
+    const auto a = numpy_conversion<std::int64_t>(arr);
+    auto r = a.unchecked<1>();
+    for (py::ssize_t i = 0; i < r.shape(0); ++i) out.value.push_back(r(i));
+    return out;
+  }
+  if (is_invalid_sequence(obj)) throw_vector_defect(std::string(name) + " must be a sequence of integers");
+  auto seq = py::reinterpret_borrow<py::sequence>(obj);
+  const std::size_t n = seq.size();
+  out.value.reserve(n);
+  for (std::size_t i = 0; i < n; ++i) {
+    py::object idx = python_int(seq[i], std::string(name) + "[" + std::to_string(i) + "]");
+    int overflow = 0;
+    const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+    if (overflow != 0) {
+      if (out.overflow.empty()) out.overflow.assign(n, 0);
+      out.overflow[i] = static_cast<std::int8_t>(overflow);
+      out.value.push_back(overflow > 0 ? std::numeric_limits<std::int64_t>::max()
+                                       : std::numeric_limits<std::int64_t>::min());
+    } else {
+      out.value.push_back(static_cast<std::int64_t>(v));
+    }
+  }
+  return out;
+}
+
+// An entry that is itself a sequence or an array of rank >= 1 (a shape defect of its argument).
+inline bool is_nested(const py::handle& item) {
+  if (py::isinstance<py::array>(item)) return py::reinterpret_borrow<py::array>(item).ndim() >= 1;
+  return !py::isinstance<py::str>(item) && !py::isinstance<py::bytes>(item) && PySequence_Check(item.ptr()) != 0;
+}
+
+// The shape step: the length of a rank-1 integer sequence argument. A NumPy array of another
+// rank (0-D included), a nested sequence or a non-sequence is a shape defect. Entry types and
+// values are not read here; their steps come later.
+inline std::size_t sequence_length(const py::handle& obj, const char* name) {
+  if (py::isinstance<py::array>(obj)) {
+    auto arr = py::reinterpret_borrow<py::array>(obj);
+    if (arr.ndim() != 1) {
+      throw_vector_defect(std::string(name) + " must be a 1-D array (got " + std::to_string(arr.ndim()) + " dimensions)");
+    }
+    return static_cast<std::size_t>(arr.size());
+  }
+  if (is_invalid_sequence(obj)) {
+    throw_vector_defect(std::string(name) + " must be a 1-D sequence of integers (got " +
+                        std::string(py::str(py::type::of(obj).attr("__name__"))) + ")");
+  }
+  auto seq = py::reinterpret_borrow<py::sequence>(obj);
+  const std::size_t n = seq.size();
+  for (std::size_t i = 0; i < n; ++i) {
+    if (is_nested(seq[i])) {
+      throw_vector_defect(std::string(name) + " must be a 1-D sequence of integers (entry " + std::to_string(i) +
+                          " is a sequence)");
+    }
+  }
+  return n;
+}
+
+// A per-edge integer array in [0, the edge's capacity] (a ledger baseline, a search residual,
+// the capacities `view` of _solve_min_cost_flow), validated on the unnarrowed values: the length
+// (shape step), then every entry in EdgeId order. `label` names the entries in a type error
+// ("residual (units)", "view (capacity units)"). The checked values come back unnarrowed: a
+// caller narrows them later (_solve_min_cost_flow, inside its call).
+inline CheckedIntegerVector edge_amounts(const py::object& obj, const Graph& graph, const char* name, const char* label) {
+  const auto num_edges = static_cast<std::size_t>(graph.num_edges());
+  const std::size_t len = sequence_length(obj, name);
+  if (len != num_edges) {
+    throw py::value_error(std::string(name) + " has length " + std::to_string(len) + ", expected " +
+                          std::to_string(num_edges) + " (one entry per edge)");
+  }
+  auto v = wide_integers(obj, label);
+  const auto capacity = graph.edge_capacity_units();
+  for (std::size_t e = 0; e < num_edges; ++e) {
+    if (!v.in(e, 0, capacity[e])) {
+      throw py::value_error(std::string(name) + "[" + std::to_string(e) + "] = " + v.text(e) + " is outside [0, edge_capacity_units[" +
+                            std::to_string(e) + "] = " + std::to_string(capacity[e]) + "]");
+    }
+  }
+  return v;
+}
+
+// A per-edge integer array in [0, the edge's capacity] (a ledger baseline, a search residual),
+// validated on the unnarrowed values: the length (shape step), then every entry.
+inline std::vector<Amount> edge_units(const py::object& obj, const Graph& graph, const char* name) {
+  return edge_amounts(obj, graph, name, (std::string(name) + " (units)").c_str()).narrow<Amount>();
+}
+
+// A node set's ids, non-empty and range-checked before narrowing (detail::node_set's messages).
+inline std::vector<NodeId> checked_ids(const CheckedIntegerVector& ids, std::int32_t num_nodes, const char* name) {
+  if (ids.size() == 0) throw py::value_error(detail::empty_set_error(name));
+  for (std::size_t i = 0; i < ids.size(); ++i) {
+    if (!ids.in(i, 0, static_cast<std::int64_t>(num_nodes) - 1)) {
+      throw py::value_error(detail::node_range_error(name, ids.text(i), num_nodes));
+    }
+  }
+  return ids.narrow<NodeId>();
+}
+
+// A node set: one NodeId or a sequence of them.
+inline std::vector<NodeId> node_ids(const py::object& obj, std::int32_t num_nodes, const char* name) {
+  if (!is_bool(obj) && PyIndex_Check(obj.ptr()) && !py::isinstance<py::array>(obj)) {
+    // A one-entry list made through a checked allocation (pybind11's list constructor reports a
+    // failed allocation as RuntimeError).
+    PyObject* raw = PyList_New(1);
+    if (raw == nullptr) throw py::error_already_set();
+    auto one = py::reinterpret_steal<py::list>(raw);
+    PyList_SET_ITEM(raw, 0, obj.inc_ref().ptr());
+    return checked_ids(wide_integers(one, name), num_nodes, name);
+  }
+  return checked_ids(wide_integers(obj, name), num_nodes, name);
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/module.cpp b/bindings/python/module.cpp
index e01488f..beffe44 100644
--- a/bindings/python/module.cpp
+++ b/bindings/python/module.cpp
@@ -1,686 +1,75 @@
 /*
-  Pybind11 module exposing NetGraph-Core C++ APIs to Python.
-  - Uses NumPy arrays with zero-copy spans where possible for FlowState/FlowGraph views (read-only)
-  - Returns distances as float64 arrays by default (inf for unreachable); dtype='int64' available
-  - Validates edge/node masks for bool dtype and length
-  - StrictMultiDiGraph view methods return copies (by design) to avoid exposing lifetime
+  Pybind11 module `_netgraph_core`: the graph on integer units with Eligibility and the unit
+  conversions, the route structures (PredecessorDAG, Path), the route choice and placement axes, the
+  ledger with its records, the forwarding programs, the policy engine with its configuration
+  and results, several policies' actions in one operation (apply_actions), the ShortestPathCache,
+  the evaluators (evaluate_demand, evaluate_pairs, evaluate_edge_failures) and the public search (spf, ksp,
+  resolve_to_paths); and one private entry: the flow core's _solve_min_cost_flow.
+  A build with the private hooks (CMake NETGRAPH_CORE_PRIVATE_HOOKS: the editable development
+  build) adds the test controls and the parity diagnostics.
+
+  - Graph accessors return read-only NumPy views that keep the graph alive (no per-call copy).
+  - Integer inputs (capacities, costs, ids, views, caps) take any non-bool object with __index__, including Python ints and NumPy
+    integer scalars, and sequences or integer arrays; floats and bools are rejected with TypeError, never
+    truncated. Values are read without narrowing and validated in the C++
+    constructors' order before any conversion to the C++ types. Physical values
+    enter only through to_units; the resolution is validated before anything else.
+  - One rule for the class of an input error: a type the position never takes TypeError, a value
+    outside its domain ValueError. std::invalid_argument from Core maps to ValueError; enumeration
+    domains are checked when a configuration or options value is consumed (ValueError).
+  - _solve_min_cost_flow is a private entry point for the flow checks: it returns the flow
+    core's payload as a dict of Python ints and lists.
+  - Amounts and counters cross as Python ints (exact, also beyond 64 bits); per-edge arrays as
+    int64 NumPy arrays in EdgeId order; +inf is accepted only as a request (float('inf')).
+  - Python spells constants in UPPER_SNAKE_CASE: UNREACHABLE is the C++ kUnreachable.
 */
 #include <pybind11/pybind11.h>
-#include <pybind11/numpy.h>
-#include <pybind11/stl.h>
-#include <cstring>
-#include <memory>
-#include <optional>
 
-#include "netgraph/core/k_shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/flow_state.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
-#include "netgraph/core/flow_graph.hpp"
-#include "netgraph/core/flow.hpp"
-#include "netgraph/core/flow_policy.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/options.hpp"
-#include "netgraph/core/profiling.hpp"
+#include "registration.hpp"
 
 namespace py = pybind11;
 using namespace netgraph::core;
 
-// Helper opaque wrappers (defined at file scope to ensure stable type identity)
-struct PyBackend { BackendPtr impl; };
-struct PyGraph { GraphHandle handle; py::object keep_alive; std::int32_t num_nodes; std::int32_t num_edges; };
-
-// Helpers to check NumPy arrays
-namespace {
-// Small helper: copy a span into a new NumPy array of the same dtype.
-template <typename T>
-py::array_t<T> copy_to_numpy(std::span<const T> s) {
-  py::array_t<T> arr(s.size());
-  if (!s.empty()) std::memcpy(arr.mutable_data(), s.data(), s.size()*sizeof(T));
-  return arr;
-}
-
-// Owns a bool[] buffer and exposes a const span view onto it.
-struct BoolSpan {
-  std::unique_ptr<bool[]> buf;
-  std::span<const bool> view;
-};
-
-// Validate 1-D C-contig NumPy bool array and deep-copy into bool[].
-static BoolSpan to_bool_span_from_numpy(py::object obj, std::size_t expected_len, const char* what) {
-  BoolSpan out;
-  if (obj.is_none()) return out;  // empty span
-  py::array arr = obj.cast<py::array>();
-  if (!(arr.flags() & py::array::c_style)) {
-    throw py::type_error(std::string(what) + " must be C-contiguous");
-  }
-  auto b = arr.request();
-  if (b.ndim != 1 || b.format != py::format_descriptor<bool>::format()) {
-    throw py::type_error(std::string(what) + " must be 1-D bool");
-  }
-  if (static_cast<std::size_t>(b.shape[0]) != expected_len) {
-    throw py::type_error(std::string(what) + " length must equal " + std::to_string(expected_len));
-  }
-  out.buf.reset(new bool[expected_len]);
-  // NumPy bool_ uses 1 byte; C++ bool is 1 byte on supported platforms.
-  std::memcpy(out.buf.get(), b.ptr, expected_len * sizeof(bool));
-  out.view = std::span<const bool>(out.buf.get(), expected_len);
-  return out;
-}
-} // namespace
-
-// Helpers to check NumPy arrays
-template <typename T>
-static std::span<const T> as_span(const py::array& arr, const char* name) {
-  if (!py::isinstance<py::array_t<T>>(arr)) {
-    throw py::type_error(std::string(name) + ": expected numpy array of correct dtype");
-  }
-  if (!(arr.flags() & py::array::c_style)) {
-    throw py::type_error(std::string(name) + ": array must be C-contiguous (use np.ascontiguousarray)");
-  }
-  auto buf = arr.request();
-  if (buf.ndim != 1) {
-    throw py::type_error(std::string(name) + ": expected 1-D array");
-  }
-  return std::span<const T>(static_cast<const T*>(buf.ptr), static_cast<std::size_t>(buf.size));
-}
-
 PYBIND11_MODULE(_netgraph_core, m, py::mod_gil_not_used()) {
-  m.doc() = "NetGraph-Core C++ bindings";
-
-  py::enum_<EdgeTieBreak>(m, "EdgeTieBreak")
-      .value("DETERMINISTIC", EdgeTieBreak::Deterministic)
-      .value("PREFER_HIGHER_RESIDUAL", EdgeTieBreak::PreferHigherResidual);
-
-  py::class_<EdgeSelection>(m, "EdgeSelection")
-      .def(py::init<>())
-      .def(py::init([](bool multi_edge, bool require_capacity, EdgeTieBreak tie_break){
-        EdgeSelection s; s.multi_edge = multi_edge; s.require_capacity = require_capacity; s.tie_break = tie_break; return s;
-      }),
-        py::kw_only(),
-        py::arg("multi_edge") = true,
-        py::arg("require_capacity") = false,
-        py::arg("tie_break") = EdgeTieBreak::Deterministic)
-      .def_readwrite("multi_edge", &EdgeSelection::multi_edge)
-      .def_readwrite("require_capacity", &EdgeSelection::require_capacity)
-      .def_readwrite("tie_break", &EdgeSelection::tie_break);
-
-  py::enum_<FlowPlacement>(m, "FlowPlacement")
-      .value("PROPORTIONAL", FlowPlacement::Proportional)
-      .value("EQUAL_BALANCED", FlowPlacement::EqualBalanced)
-      .value("EQUAL_BALANCED_LOSSY", FlowPlacement::EqualBalancedLossy);
-
-  py::class_<StrictMultiDiGraph>(m, "StrictMultiDiGraph")
-      .def_static(
-          "from_arrays",
-          [](std::int32_t num_nodes,
-             py::array src, py::array dst,
-             py::array capacity, py::array cost,
-             py::array ext_edge_ids) {
-            // public API: src/dst are int32; pass through as int32 to core
-            auto src_s = as_span<std::int32_t>(src, "src");
-            auto dst_s = as_span<std::int32_t>(dst, "dst");
-            if (src_s.size() != dst_s.size()) throw py::type_error("src and dst must have the same length");
-            auto cap_s = as_span<double>(capacity, "capacity");
-            // Cost dtype must be int64 to match internal Cost type
-            auto cost_s = as_span<std::int64_t>(cost, "cost");
-            // ext_edge_ids required: maps internal edge indices to caller's stable IDs
-            auto ext_s = as_span<std::int64_t>(ext_edge_ids, "ext_edge_ids");
-            return StrictMultiDiGraph::from_arrays(num_nodes,
-                                                  src_s,
-                                                  dst_s,
-                                                  cap_s, cost_s, ext_s);
-          },
-          py::arg("num_nodes"), py::arg("src"), py::arg("dst"), py::arg("capacity"), py::arg("cost"),
-          py::arg("ext_edge_ids"))
-      .def("num_nodes", &StrictMultiDiGraph::num_nodes)
-      .def("num_edges", &StrictMultiDiGraph::num_edges)
-      .def("capacity_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<double>(g.capacity_view()); })
-      .def("edge_src_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.edge_src_view()); })
-      .def("edge_dst_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.edge_dst_view()); })
-      .def("ext_edge_ids_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int64_t>(g.ext_edge_ids_view()); })
-      .def("cost_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int64_t>(g.cost_view()); })
-      .def("row_offsets_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.row_offsets_view()); })
-      .def("col_indices_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.col_indices_view()); })
-      .def("adj_edge_index_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.adj_edge_index_view()); })
-      .def("in_row_offsets_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.in_row_offsets_view()); })
-      .def("in_col_indices_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.in_col_indices_view()); })
-      .def("in_adj_edge_index_view", [](const StrictMultiDiGraph& g){ return copy_to_numpy<std::int32_t>(g.in_adj_edge_index_view()); });
-
-  // Backend and Algorithms
-
-  // Opaque wrapper types
-  py::class_<PyBackend>(m, "Backend")
-      .def_static("cpu", [](){ return PyBackend{ make_cpu_backend() }; });
-
-  py::class_<PyGraph>(m, "Graph")
-      // Opaque holder; constructed via Algorithms.build_graph
-      .def_property_readonly("num_nodes", [](const PyGraph& pg){ return pg.num_nodes; })
-      .def_property_readonly("num_edges", [](const PyGraph& pg){ return pg.num_edges; });
-
-  py::class_<Algorithms, std::shared_ptr<Algorithms>>(m, "Algorithms")
-      .def(py::init([](const PyBackend& b){ return std::make_shared<Algorithms>(b.impl); }), py::arg("backend"))
-      .def("build_graph", [](const Algorithms& algs, py::object graph_obj){
-        // graph_obj is py::object so PyGraph can keep it alive; check the type
-        // explicitly, since a bare .cast<> failure surfaces as an opaque
-        // "RuntimeError: Unable to cast ... to C++ type '?'".
-        if (!py::isinstance<StrictMultiDiGraph>(graph_obj)) {
-          throw py::type_error("build_graph: graph must be a StrictMultiDiGraph");
-        }
-        const StrictMultiDiGraph& g = graph_obj.cast<const StrictMultiDiGraph&>();
-        auto gh = algs.build_graph(g);
-        // Keep the Python graph object alive alongside the handle when
-        // referencing a non-owned graph instance.
-        return PyGraph{ gh, graph_obj, g.num_nodes(), g.num_edges() };
-      }, py::arg("graph"))
-      .def("spf", [](const Algorithms& algs, const PyGraph& pg, std::int32_t src,
-                       py::object dst, py::object selection_obj, py::object residual_obj,
-                       py::object node_mask, py::object edge_mask, bool multipath, std::string dtype) -> py::tuple {
-        if (src < 0 || src >= pg.num_nodes) throw py::value_error("src out of range");
-        SpfOptions opts; if (!selection_obj.is_none()) opts.selection = py::cast<EdgeSelection>(selection_obj);
-        if (!dst.is_none()) { auto d = py::cast<std::int32_t>(dst); if (d < 0 || d >= pg.num_nodes) throw py::value_error("dst out of range"); opts.dst = static_cast<NodeId>(d); }
-        std::vector<double> residual_vec;
-        if (!residual_obj.is_none()) {
-          auto arr = py::cast<py::array>(residual_obj);
-          if (!(arr.flags() & py::array::c_style)) throw py::type_error("residual must be C-contiguous (np.ascontiguousarray)");
-          auto buf = arr.request();
-          if (buf.ndim != 1 || buf.format != py::format_descriptor<double>::format()) throw py::type_error("residual must be 1-D float64");
-          // Check length here so this matches the TypeError raised by every other
-          // length check (masks, FlowState residual); otherwise the core throws
-          // std::invalid_argument, which reaches Python as ValueError.
-          if (static_cast<std::int32_t>(buf.shape[0]) != pg.num_edges) {
-            throw py::type_error("residual length must equal " + std::to_string(pg.num_edges));
-          }
-          residual_vec.resize(static_cast<std::size_t>(buf.shape[0]));
-          std::memcpy(residual_vec.data(), buf.ptr, residual_vec.size()*sizeof(double));
-          opts.residual = std::span<const double>(residual_vec.data(), residual_vec.size());
-        }
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-        opts.node_mask = node_bs.view;
-        opts.edge_mask = edge_bs.view;
-        opts.multipath = multipath;
-        py::gil_scoped_release rel; auto res = algs.spf(pg.handle, src, opts); py::gil_scoped_acquire acq;
-        auto maxc = std::numeric_limits<Cost>::max();
-        if (dtype == "int64") {
-          py::array_t<std::int64_t> dist_arr(res.first.size());
-          auto* out = dist_arr.mutable_data();
-          for (std::size_t i=0;i<res.first.size();++i) out[i] = (res.first[i]==maxc) ? static_cast<std::int64_t>(maxc) : static_cast<std::int64_t>(res.first[i]);
-          return py::make_tuple(std::move(dist_arr), std::move(res.second));
-        } else if (dtype == "float64") {
-          py::array_t<double> dist_arr(res.first.size());
-          auto* out = dist_arr.mutable_data();
-          for (std::size_t i=0;i<res.first.size();++i) out[i] = (res.first[i]==maxc) ? std::numeric_limits<double>::infinity() : static_cast<double>(res.first[i]);
-          return py::make_tuple(std::move(dist_arr), std::move(res.second));
-        } else {
-          throw py::value_error("dtype must be 'float64' or 'int64'");
-        }
-      }, py::arg("graph"), py::arg("src"), py::arg("dst") = py::none(), py::kw_only(), py::arg("selection") = py::none(), py::arg("residual") = py::none(), py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none(), py::arg("multipath") = true, py::arg("dtype") = "float64")
-      .def("spf_to", [](const Algorithms& algs, const PyGraph& pg, std::int32_t dst,
-                          py::object selection_obj, py::object residual_obj,
-                          py::object node_mask, py::object edge_mask, bool multipath,
-                          py::object fanout_obj, std::string dtype) -> py::tuple {
-        if (dst < 0 || dst >= pg.num_nodes) throw py::value_error("dst out of range");
-        SpfToOptions opts; if (!selection_obj.is_none()) opts.selection = py::cast<EdgeSelection>(selection_obj);
-        std::vector<double> residual_vec;
-        if (!residual_obj.is_none()) {
-          auto arr = py::cast<py::array>(residual_obj);
-          if (!(arr.flags() & py::array::c_style)) throw py::type_error("residual must be C-contiguous (np.ascontiguousarray)");
-          auto buf = arr.request();
-          if (buf.ndim != 1 || buf.format != py::format_descriptor<double>::format()) throw py::type_error("residual must be 1-D float64");
-          if (static_cast<std::int32_t>(buf.shape[0]) != pg.num_edges) {
-            throw py::type_error("residual length must equal " + std::to_string(pg.num_edges));
-          }
-          residual_vec.resize(static_cast<std::size_t>(buf.shape[0]));
-          std::memcpy(residual_vec.data(), buf.ptr, residual_vec.size()*sizeof(double));
-          opts.residual = std::span<const double>(residual_vec.data(), residual_vec.size());
-        }
-        std::vector<EdgeId> fanout_vec;
-        if (!fanout_obj.is_none()) {
-          for (auto item : py::iterable(fanout_obj)) {
-            auto e = py::cast<std::int64_t>(item);
-            if (e < 0 || e >= pg.num_edges) throw py::value_error("fanout edge id out of range");
-            fanout_vec.push_back(static_cast<EdgeId>(e));
-          }
-          opts.fanout_edges = std::span<const EdgeId>(fanout_vec.data(), fanout_vec.size());
-        }
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-        opts.node_mask = node_bs.view;
-        opts.edge_mask = edge_bs.view;
-        opts.multipath = multipath;
-        py::gil_scoped_release rel; auto res = algs.spf_to(pg.handle, dst, opts); py::gil_scoped_acquire acq;
-        auto maxc = std::numeric_limits<Cost>::max();
-        if (dtype == "int64") {
-          py::array_t<std::int64_t> dist_arr(res.first.size());
-          auto* out = dist_arr.mutable_data();
-          for (std::size_t i=0;i<res.first.size();++i) out[i] = (res.first[i]==maxc) ? static_cast<std::int64_t>(maxc) : static_cast<std::int64_t>(res.first[i]);
-          return py::make_tuple(std::move(dist_arr), std::move(res.second));
-        } else if (dtype == "float64") {
-          py::array_t<double> dist_arr(res.first.size());
-          auto* out = dist_arr.mutable_data();
-          for (std::size_t i=0;i<res.first.size();++i) out[i] = (res.first[i]==maxc) ? std::numeric_limits<double>::infinity() : static_cast<double>(res.first[i]);
-          return py::make_tuple(std::move(dist_arr), std::move(res.second));
-        } else {
-          throw py::value_error("dtype must be 'float64' or 'int64'");
-        }
-      }, py::arg("graph"), py::arg("dst"), py::kw_only(), py::arg("selection") = py::none(), py::arg("residual") = py::none(), py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none(), py::arg("multipath") = true, py::arg("fanout_edges") = py::none(), py::arg("dtype") = "float64",
-         "Shortest paths from every node to dst (reverse SPF). Returns (distances_to_dst, dag); the DAG is forward-oriented and valid for placement from any node toward dst. fanout_edges are added to the DAG regardless of cost (see shortest_paths.hpp).")
-      .def("ksp", [](const Algorithms& algs, const PyGraph& pg, std::int32_t src, std::int32_t dst,
-                       int k, py::object max_cost_factor, bool unique, py::object node_mask, py::object edge_mask, std::string dtype){
-        if (src < 0 || src >= pg.num_nodes || dst < 0 || dst >= pg.num_nodes) throw py::value_error("src/dst out of range");
-        if (k <= 0) throw py::value_error("k must be >= 1");
-        if (dtype != "float64" && dtype != "int64") throw py::value_error("dtype must be 'float64' or 'int64'");
-        KspOptions opts; opts.k = k; opts.unique = unique; if (!max_cost_factor.is_none()) opts.max_cost_factor = py::cast<double>(max_cost_factor);
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-        opts.node_mask = node_bs.view; opts.edge_mask = edge_bs.view;
-        py::gil_scoped_release rel; auto items = algs.ksp(pg.handle, src, dst, opts); py::gil_scoped_acquire acq;
-        py::list out;
-        auto maxc = std::numeric_limits<Cost>::max();
-        for (auto& pr : items) {
-          auto& dist = pr.first;
-          if (dtype == "int64") {
-            py::array_t<std::int64_t> dist_arr(dist.size());
-            auto* outp = dist_arr.mutable_data();
-            for (std::size_t i=0;i<dist.size();++i) outp[i] = (dist[i]==maxc) ? static_cast<std::int64_t>(maxc) : static_cast<std::int64_t>(dist[i]);
-            out.append(py::make_tuple(std::move(dist_arr), pr.second));
-          } else if (dtype == "float64") {
-            py::array_t<double> dist_arr(dist.size());
-            auto* outp = dist_arr.mutable_data();
-            for (std::size_t i=0;i<dist.size();++i) outp[i] = (dist[i]==maxc) ? std::numeric_limits<double>::infinity() : static_cast<double>(dist[i]);
-            out.append(py::make_tuple(std::move(dist_arr), pr.second));
-          }
-        }
-        return out;
-      }, py::arg("graph"), py::arg("src"), py::arg("dst"), py::kw_only(), py::arg("k"), py::arg("max_cost_factor") = py::none(), py::arg("unique") = true, py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none(), py::arg("dtype") = "float64")
-      .def("max_flow", [](const Algorithms& algs, const PyGraph& pg, std::int32_t src, std::int32_t dst,
-                            FlowPlacement placement, bool shortest_path, bool require_capacity, bool with_edge_flows, bool with_reachable, bool with_residuals,
-                            py::object node_mask, py::object edge_mask){
-        if (src < 0 || src >= pg.num_nodes || dst < 0 || dst >= pg.num_nodes) throw py::value_error("src/dst out of range");
-        MaxFlowOptions o; o.placement = placement; o.shortest_path = shortest_path; o.require_capacity = require_capacity; o.with_edge_flows = with_edge_flows; o.with_reachable = with_reachable; o.with_residuals = with_residuals;
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-        o.node_mask = node_bs.view; o.edge_mask = edge_bs.view;
-        py::gil_scoped_release rel; auto res = algs.max_flow(pg.handle, src, dst, o); py::gil_scoped_acquire acq; return res;
-      }, py::arg("graph"), py::arg("src"), py::arg("dst"), py::kw_only(), py::arg("flow_placement") = FlowPlacement::Proportional, py::arg("shortest_path") = false, py::arg("require_capacity") = true, py::arg("with_edge_flows") = false, py::arg("with_reachable") = false, py::arg("with_residuals") = false, py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none())
-      .def("batch_max_flow", [](const Algorithms& algs, const PyGraph& pg, py::array pairs,
-                                 py::object node_masks, py::object edge_masks,
-                                 FlowPlacement placement, bool shortest_path, bool require_capacity,
-                                 bool with_edge_flows, bool with_reachable, bool with_residuals){
-        // Check the dtype, not the buffer format string: NumPy spells int32 as
-        // NPY_LONG ('l') on LLP64 (Windows) and NPY_INT ('i') on LP64, while
-        // format_descriptor<int32_t> is always 'i'. Comparing format strings
-        // therefore rejects a genuine int32 array on Windows. isinstance uses
-        // dtype equivalence, matching as_span() above.
-        if (!py::isinstance<py::array_t<std::int32_t>>(pairs)) throw py::type_error("pairs dtype must be int32");
-        if (!(pairs.flags() & py::array::c_style)) throw py::type_error("pairs must be C-contiguous (use np.ascontiguousarray)");
-        auto buf = pairs.request();
-        if (buf.ndim != 2 || buf.shape[1] != 2) throw py::type_error("pairs must be shape [B,2]");
-        const std::size_t B = static_cast<std::size_t>(buf.shape[0]);
-        std::vector<std::pair<NodeId,NodeId>> pp; pp.reserve(B);
-        auto* p = static_cast<const std::int32_t*>(buf.ptr);
-        for (std::size_t i=0;i<B;++i) { pp.emplace_back(p[2*i], p[2*i+1]); }
-        // Match the single-pair entry points: an out-of-range id is a caller error,
-        // not a zero-flow result that silently disappears into the batch.
-        for (std::size_t i=0;i<pp.size();++i) {
-          if (pp[i].first < 0 || pp[i].first >= pg.num_nodes ||
-              pp[i].second < 0 || pp[i].second >= pg.num_nodes) {
-            throw py::value_error("pairs[" + std::to_string(i) + "] has a src/dst out of range");
-          }
-        }
-        std::vector<BoolSpan> node_bufs, edge_bufs;
-        std::vector<std::span<const bool>> node_spans; std::vector<std::span<const bool>> edge_spans;
-        auto parse_mask_list = [&](py::object list_obj, std::size_t expected_len, const char* what,
-                                   std::vector<BoolSpan>& bufs, std::vector<std::span<const bool>>& spans) {
-          if (list_obj.is_none()) return;
-          auto seq = py::cast<py::sequence>(list_obj);
-          if (static_cast<std::size_t>(py::len(seq)) != B)
-            throw py::type_error(std::string(what) + " length must equal number of pairs");
-          bufs.reserve(B); spans.reserve(B);
-          for (auto item : seq) {
-            auto bs = to_bool_span_from_numpy(item, expected_len, what);
-            spans.push_back(bs.view);
-            bufs.push_back(std::move(bs)); // keep storage alive across GIL release
-          }
-        };
-        parse_mask_list(node_masks, static_cast<std::size_t>(pg.num_nodes), "node_masks", node_bufs, node_spans);
-        parse_mask_list(edge_masks, static_cast<std::size_t>(pg.num_edges), "edge_masks", edge_bufs, edge_spans);
-        MaxFlowOptions o; o.placement = placement; o.shortest_path = shortest_path; o.require_capacity = require_capacity; o.with_edge_flows = with_edge_flows; o.with_reachable = with_reachable; o.with_residuals = with_residuals;
-        py::gil_scoped_release rel; auto out = algs.batch_max_flow(pg.handle, pp, o, node_spans, edge_spans); py::gil_scoped_acquire acq; return out;
-      }, py::arg("graph"), py::arg("pairs"), py::kw_only(), py::arg("node_masks") = py::none(), py::arg("edge_masks") = py::none(), py::arg("flow_placement") = FlowPlacement::Proportional, py::arg("shortest_path") = false, py::arg("require_capacity") = true, py::arg("with_edge_flows") = false, py::arg("with_reachable") = false, py::arg("with_residuals") = false)
-      .def("sensitivity_analysis", [](const Algorithms& algs, const PyGraph& pg, std::int32_t src, std::int32_t dst,
-                                      FlowPlacement placement, bool shortest_path, bool require_capacity,
-                                      py::object node_mask, py::object edge_mask){
-        if (src < 0 || src >= pg.num_nodes || dst < 0 || dst >= pg.num_nodes) throw py::value_error("src/dst out of range");
-        MaxFlowOptions o; o.placement = placement; o.shortest_path = shortest_path; o.require_capacity = require_capacity;
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-        o.node_mask = node_bs.view; o.edge_mask = edge_bs.view;
-        py::gil_scoped_release rel; auto res = algs.sensitivity_analysis(pg.handle, src, dst, o); py::gil_scoped_acquire acq;
-        // Return as list of tuples (EdgeId, FlowDelta)
-        py::list out;
-        for (auto const& pr : res) {
-          out.append(py::make_tuple(pr.first, pr.second));
-        }
-        return out;
-      }, py::arg("graph"), py::arg("src"), py::arg("dst"), py::kw_only(), py::arg("flow_placement") = FlowPlacement::Proportional, py::arg("shortest_path") = false, py::arg("require_capacity") = true, py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none());
-
-  py::class_<PredDAG>(m, "PredDAG")
-      .def_property_readonly("parent_offsets", [](const PredDAG& d){
-        return copy_to_numpy<std::int32_t>(std::span<const std::int32_t>(d.parent_offsets.data(), d.parent_offsets.size()));
-      })
-      .def_property_readonly("parents", [](const PredDAG& d){
-        return copy_to_numpy<std::int32_t>(std::span<const std::int32_t>(d.parents.data(), d.parents.size()));
-      })
-      .def_property_readonly("via_edges", [](const PredDAG& d){
-        return copy_to_numpy<std::int32_t>(std::span<const std::int32_t>(d.via_edges.data(), d.via_edges.size()));
-      })
-      .def_static("from_edges", [](const StrictMultiDiGraph& g, py::sequence edges){
-        std::vector<EdgeId> e;
-        e.reserve(py::len(edges));
-        for (auto item : edges) e.push_back(py::cast<EdgeId>(item));
-        return make_path_dag(g, e);
-      }, py::arg("graph"), py::arg("edges"),
-         "Build a single-path PredDAG from a contiguous edge-id sequence.\n"
-         "Validates that each edge exists, consecutive edges connect, and the walk "
-         "is a simple path. The result works anywhere a PredDAG is accepted "
-         "(place_on_dag, FlowGraph.place, FlowPolicy.set_static_paths).")
-      .def("resolve_to_paths", [](const PredDAG& dag, std::int32_t src, std::int32_t dst, bool split_parallel_edges, py::object max_paths){
-        std::optional<std::int64_t> mp;
-        if (!max_paths.is_none()) mp = py::cast<std::int64_t>(max_paths);
-        auto out = netgraph::core::resolve_to_paths(dag, src, dst, split_parallel_edges, mp);
-        py::list paths;
-        for (auto& path : out) {
-          py::list py_elems;
-          for (auto& pr : path) {
-            py::tuple edge_tuple(pr.second.size());
-            for (std::size_t i=0;i<pr.second.size();++i) edge_tuple[i] = py::int_(pr.second[i]);
-            py_elems.append(py::make_tuple(py::int_(pr.first), edge_tuple));
-          }
-          paths.append(py::tuple(py_elems));
-        }
-        return paths;
-      }, py::arg("src"), py::arg("dst"), py::kw_only(), py::arg("split_parallel_edges") = false, py::arg("max_paths") = py::none());
-
-  py::class_<MinCut>(m, "MinCut")
-      .def_property_readonly("edges", [](const MinCut& mc){
-        return copy_to_numpy<std::int32_t>(std::span<const std::int32_t>(mc.edges.data(), mc.edges.size()));
-      });
-
-  py::class_<FlowSummary>(m, "FlowSummary")
-      .def_readonly("total_flow", &FlowSummary::total_flow)
-      .def_readonly("min_cut", &FlowSummary::min_cut)
-      .def_property_readonly("costs", [](const FlowSummary& s){
-        return copy_to_numpy<std::int64_t>(std::span<const std::int64_t>(s.costs.data(), s.costs.size()));
-      })
-      .def_property_readonly("flows", [](const FlowSummary& s){
-        return copy_to_numpy<double>(std::span<const double>(s.flows.data(), s.flows.size()));
-      })
-      .def_property_readonly("edge_flows", [](const FlowSummary& s){
-        return copy_to_numpy<double>(std::span<const double>(s.edge_flows.data(), s.edge_flows.size()));
-      })
-      .def_property_readonly("residual_capacity", [](const FlowSummary& s){
-        return copy_to_numpy<double>(std::span<const double>(s.residual_capacity.data(), s.residual_capacity.size()));
-      })
-      .def_property_readonly("reachable_nodes", [](const FlowSummary& s){
-        // Store as bool array for Python; cast bytes to bool
-        py::array_t<bool> arr(s.reachable_nodes.size());
-        auto* out = arr.mutable_data();
-        for (std::size_t i=0;i<s.reachable_nodes.size();++i) out[i] = static_cast<bool>(s.reachable_nodes[i]);
-        return arr;
-      });
-
-  // FlowState bindings
-  py::class_<FlowState>(m, "FlowState")
-      .def(py::init([](const StrictMultiDiGraph& g){ return FlowState(g); }),
-           py::arg("graph"), py::keep_alive<1, 2>())
-      .def(py::init([](const StrictMultiDiGraph& g, py::array residual){
-        if (!(py::isinstance<py::array_t<double>>(residual))) throw py::type_error("residual must be a numpy float64 array");
-        if (!(residual.flags() & py::array::c_style)) throw py::type_error("residual must be C-contiguous");
-        auto buf = residual.request();
-        if (buf.ndim != 1 || static_cast<std::size_t>(buf.shape[0]) != static_cast<std::size_t>(g.num_edges())) throw py::type_error("residual length must equal num_edges");
-        std::span<const double> rspan(static_cast<const double*>(buf.ptr), static_cast<std::size_t>(buf.shape[0]));
-        return FlowState(g, rspan);
-      }), py::arg("graph"), py::arg("residual"), py::keep_alive<1, 2>())
-      .def("reset", [](FlowState& fs){ fs.reset(); })
-      .def("reset", [](FlowState& fs, py::array residual){
-        if (!(py::isinstance<py::array_t<double>>(residual))) throw py::type_error("residual must be a numpy float64 array");
-        if (!(residual.flags() & py::array::c_style)) throw py::type_error("residual must be C-contiguous");
-        auto buf = residual.request();
-        if (buf.ndim != 1 || static_cast<std::size_t>(buf.shape[0]) != static_cast<std::size_t>(fs.capacity_view().size())) throw py::type_error("residual length must equal num_edges");
-        std::span<const double> rspan(static_cast<const double*>(buf.ptr), static_cast<std::size_t>(buf.shape[0]));
-        fs.reset(rspan);
-      })
-      .def("capacity_view", [](py::object self_obj){
-        const FlowState& fs = py::cast<const FlowState&>(self_obj);
-        auto s = fs.capacity_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def("residual_view", [](py::object self_obj){
-        const FlowState& fs = py::cast<const FlowState&>(self_obj);
-        auto s = fs.residual_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def("edge_flow_view", [](py::object self_obj){
-        const FlowState& fs = py::cast<const FlowState&>(self_obj);
-        auto s = fs.edge_flow_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def("place_on_dag", [](FlowState& fs, std::int32_t src, std::int32_t dst, const PredDAG& dag, double requested_flow, FlowPlacement placement){
-        py::gil_scoped_release rel; auto placed = fs.place_on_dag(src, dst, dag, requested_flow, placement); py::gil_scoped_acquire acq; return placed;
-      }, py::arg("src"), py::arg("dst"), py::arg("dag"), py::arg("requested_flow") = std::numeric_limits<double>::infinity(), py::arg("flow_placement") = FlowPlacement::Proportional)
-      .def("place_max_flow", [](py::object self_obj, std::int32_t src, std::int32_t dst,
-                                 FlowPlacement placement, bool shortest_path, bool require_capacity,
-                                 py::object node_mask, py::object edge_mask){
-        FlowState& fs = py::cast<FlowState&>(self_obj);
-        const StrictMultiDiGraph& g = fs.graph();
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(g.num_nodes()), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(g.num_edges()), "edge_mask");
-        py::gil_scoped_release rel;
-        auto total = fs.place_max_flow(src, dst, placement, shortest_path, require_capacity,
-                                       node_bs.view, edge_bs.view);
-        py::gil_scoped_acquire acq;
-        return total;
-      }, py::arg("src"), py::arg("dst"),
-         py::arg("flow_placement") = FlowPlacement::Proportional,
-         py::arg("shortest_path") = false, py::arg("require_capacity") = true,
-         py::kw_only(), py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none())
-      .def("compute_min_cut", [](py::object self_obj, std::int32_t src, py::object node_mask, py::object edge_mask){
-        const FlowState& fs = py::cast<const FlowState&>(self_obj);
-        const StrictMultiDiGraph& g = fs.graph();
-        auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(g.num_nodes()), "node_mask");
-        auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(g.num_edges()), "edge_mask");
-        py::gil_scoped_release rel;
-        auto mc = fs.compute_min_cut(src, node_bs.view, edge_bs.view);
-        py::gil_scoped_acquire acq;
-        return mc;
-      }, py::arg("src"), py::kw_only(), py::arg("node_mask") = py::none(), py::arg("edge_mask") = py::none());
-
-  // FlowIndex and FlowGraph bindings
-  py::class_<FlowIndex>(m, "FlowIndex")
-      .def(py::init<NodeId, NodeId, std::int32_t, std::int64_t>())
-      .def_readonly("src", &FlowIndex::src)
-      .def_readonly("dst", &FlowIndex::dst)
-      .def_readonly("flowClass", &FlowIndex::flowClass)
-      .def_readonly("flowId", &FlowIndex::flowId);
-
-  py::class_<FlowGraph>(m, "FlowGraph")
-      .def(py::init([](const StrictMultiDiGraph& g){ return FlowGraph(g); }),
-           py::arg("graph"), py::keep_alive<1, 2>())
-      .def("capacity_view", [](py::object self_obj){
-        const FlowGraph& fg = py::cast<const FlowGraph&>(self_obj);
-        auto s = fg.capacity_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def("residual_view", [](py::object self_obj){
-        const FlowGraph& fg = py::cast<const FlowGraph&>(self_obj);
-        auto s = fg.residual_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def("edge_flow_view", [](py::object self_obj){
-        const FlowGraph& fg = py::cast<const FlowGraph&>(self_obj);
-        auto s = fg.edge_flow_view();
-        py::array view(py::buffer_info(const_cast<double*>(s.data()), sizeof(double), py::format_descriptor<double>::format(), 1, { s.size() }, { sizeof(double) }), self_obj);
-        view.attr("setflags")(py::arg("write") = false);
-        return view;
-      })
-      .def_property_readonly("graph", [](const FlowGraph& fg){ return &fg.graph(); }, py::return_value_policy::reference_internal)
-      .def("place", [](FlowGraph& fg, const FlowIndex& idx, std::int32_t src, std::int32_t dst, const PredDAG& dag, double amount, FlowPlacement placement){ py::gil_scoped_release rel; auto placed = fg.place(idx, src, dst, dag, amount, placement); py::gil_scoped_acquire acq; return placed; }, py::arg("index"), py::arg("src"), py::arg("dst"), py::arg("dag"), py::arg("amount"), py::arg("flow_placement") = FlowPlacement::Proportional)
-      .def("place_with_drops", [](FlowGraph& fg, const FlowIndex& idx, std::int32_t src, std::int32_t dst, const PredDAG& dag, double amount, FlowPlacement placement){
-        std::vector<std::pair<EdgeId, Flow>> drops;
-        double placed;
-        { py::gil_scoped_release rel; placed = fg.place(idx, src, dst, dag, amount, placement, &drops); }
-        py::list out; for (auto const& pr : drops) out.append(py::make_tuple(pr.first, pr.second));
-        return py::make_tuple(placed, out);
-      }, py::arg("index"), py::arg("src"), py::arg("dst"), py::arg("dag"), py::arg("amount"), py::arg("flow_placement") = FlowPlacement::EqualBalancedLossy,
-         "Like place(), but also returns the per-edge dropped volume as a list of (edge_id, dropped) pairs. Only EQUAL_BALANCED_LOSSY drops flow; other placements return an empty list.")
-      .def("remove", [](FlowGraph& fg, const FlowIndex& idx){ py::gil_scoped_release rel; fg.remove(idx); py::gil_scoped_acquire acq; })
-      .def("remove_by_class", [](FlowGraph& fg, std::int32_t cls){ py::gil_scoped_release rel; fg.remove_by_class(cls); py::gil_scoped_acquire acq; })
-      .def("reset", [](FlowGraph& fg){ py::gil_scoped_release rel; fg.reset(); py::gil_scoped_acquire acq; })
-      .def("get_flow_edges", [](const FlowGraph& fg, const FlowIndex& idx){ auto v = fg.get_flow_edges(idx); py::list out; for (auto const& pr : v) { out.append(py::make_tuple(pr.first, pr.second)); } return out; })
-      .def("get_flow_path", [](const FlowGraph& fg, const FlowIndex& idx){ auto v = fg.get_flow_path(idx); py::list out; for (auto e : v) out.append(e); return out; });
-
-  // NOTE: FlowRecord is deliberately not bound. No binding constructs or returns one
-  // (FlowPolicy.flows yields plain tuples), so the class was unreachable, and the
-  // Python name "Flow" collided with the C++ alias `using Flow = double`. If per-flow
-  // records become part of the public API, bind it under an unambiguous name such as
-  // "FlowRecord" and have FlowPolicy.flows return it instead of tuples.
-
-  py::enum_<PathAlg>(m, "PathAlg")
-      .value("SPF", PathAlg::SPF);
-
-  py::class_<FlowPolicyConfig>(m, "FlowPolicyConfig")
-      .def(py::init<>())
-      .def(py::init([](PathAlg path_alg,
-                       FlowPlacement flow_placement,
-                       EdgeSelection selection,
-                       bool require_capacity,
-                       bool multipath,
-                       int min_flow_count,
-                       py::object max_flow_count,
-                       py::object max_path_cost,
-                       py::object max_path_cost_factor,
-                       bool shortest_path,
-                       bool reoptimize_flows_on_each_placement,
-                       int max_no_progress_iterations,
-                       int max_total_iterations,
-                       bool diminishing_returns_enabled,
-                       int diminishing_returns_window,
-                       double diminishing_returns_epsilon_frac){
-            FlowPolicyConfig cfg;
-            cfg.path_alg = path_alg;
-            cfg.flow_placement = flow_placement;
-            cfg.selection = selection;
-            cfg.require_capacity = require_capacity;
-            cfg.multipath = multipath;
-            cfg.min_flow_count = min_flow_count;
-            if (!max_flow_count.is_none()) cfg.max_flow_count = py::cast<int>(max_flow_count);
-            if (!max_path_cost.is_none()) cfg.max_path_cost = py::cast<Cost>(max_path_cost);
-            if (!max_path_cost_factor.is_none()) cfg.max_path_cost_factor = py::cast<double>(max_path_cost_factor);
-            cfg.shortest_path = shortest_path;
-            cfg.reoptimize_flows_on_each_placement = reoptimize_flows_on_each_placement;
-            cfg.max_no_progress_iterations = max_no_progress_iterations;
-            cfg.max_total_iterations = max_total_iterations;
-            cfg.diminishing_returns_enabled = diminishing_returns_enabled;
-            cfg.diminishing_returns_window = diminishing_returns_window;
-            cfg.diminishing_returns_epsilon_frac = diminishing_returns_epsilon_frac;
-            return cfg;
-          }),
-          py::kw_only(),
-          py::arg("path_alg") = PathAlg::SPF,
-          py::arg("flow_placement") = FlowPlacement::Proportional,
-          py::arg("selection") = EdgeSelection{},
-          py::arg("require_capacity") = true,
-          py::arg("multipath") = true,
-          py::arg("min_flow_count") = 1,
-          py::arg("max_flow_count") = py::none(),
-          py::arg("max_path_cost") = py::none(),
-          py::arg("max_path_cost_factor") = py::none(),
-          py::arg("shortest_path") = false,
-          py::arg("reoptimize_flows_on_each_placement") = false,
-          py::arg("max_no_progress_iterations") = 100,
-          py::arg("max_total_iterations") = 10000,
-          py::arg("diminishing_returns_enabled") = true,
-          py::arg("diminishing_returns_window") = 8,
-          py::arg("diminishing_returns_epsilon_frac") = 1e-3)
-      .def_readwrite("path_alg", &FlowPolicyConfig::path_alg)
-      .def_readwrite("flow_placement", &FlowPolicyConfig::flow_placement)
-      .def_readwrite("selection", &FlowPolicyConfig::selection)
-      .def_readwrite("require_capacity", &FlowPolicyConfig::require_capacity)
-      .def_readwrite("multipath", &FlowPolicyConfig::multipath)
-      .def_readwrite("min_flow_count", &FlowPolicyConfig::min_flow_count)
-      .def_readwrite("max_flow_count", &FlowPolicyConfig::max_flow_count)
-      .def_readwrite("max_path_cost", &FlowPolicyConfig::max_path_cost)
-      .def_readwrite("max_path_cost_factor", &FlowPolicyConfig::max_path_cost_factor)
-      .def_readwrite("shortest_path", &FlowPolicyConfig::shortest_path)
-      .def_readwrite("reoptimize_flows_on_each_placement", &FlowPolicyConfig::reoptimize_flows_on_each_placement)
-      .def_readwrite("max_no_progress_iterations", &FlowPolicyConfig::max_no_progress_iterations)
-      .def_readwrite("max_total_iterations", &FlowPolicyConfig::max_total_iterations)
-      .def_readwrite("diminishing_returns_enabled", &FlowPolicyConfig::diminishing_returns_enabled)
-      .def_readwrite("diminishing_returns_window", &FlowPolicyConfig::diminishing_returns_window)
-      .def_readwrite("diminishing_returns_epsilon_frac", &FlowPolicyConfig::diminishing_returns_epsilon_frac);
-
-  py::class_<FlowPolicy>(m, "FlowPolicy")
-      .def("__init__", [](FlowPolicy& self, py::object algs_obj, const PyGraph& pg, FlowPolicyConfig cfg,
-                          py::object node_mask, py::object edge_mask){
-            if (!py::isinstance<Algorithms>(algs_obj)) {
-              throw py::type_error("FlowPolicy: algorithms must be an Algorithms instance");
-            }
-            std::shared_ptr<Algorithms> algs = py::cast<std::shared_ptr<Algorithms>>(algs_obj);
-
-            auto node_bs = to_bool_span_from_numpy(node_mask, static_cast<std::size_t>(pg.num_nodes), "node_mask");
-            auto edge_bs = to_bool_span_from_numpy(edge_mask, static_cast<std::size_t>(pg.num_edges), "edge_mask");
-
-            cfg.node_mask = node_bs.view;
-            cfg.edge_mask = edge_bs.view;
-
-            ExecutionContext ctx(algs, pg.handle);
-            new (&self) FlowPolicy(ctx, cfg);
-           },
-           py::arg("algorithms"), py::arg("graph"), py::arg("config"),
-           py::kw_only(),
-           py::arg("node_mask") = py::none(),
-           py::arg("edge_mask") = py::none(),
-           py::keep_alive<1, 2>(),   // self keeps algorithms alive
-           py::keep_alive<1, 3>())   // self keeps graph alive
-      .def("flow_count", &FlowPolicy::flow_count)
-      .def("placed_demand", &FlowPolicy::placed_demand)
-      .def("place_demand", [](FlowPolicy& p, FlowGraph& fg, std::int32_t src, std::int32_t dst, FlowClass flowClass, double volume, py::object target_per_flow, py::object min_flow){ std::optional<double> tpf; if (!target_per_flow.is_none()) tpf = py::cast<double>(target_per_flow); std::optional<double> mfl; if (!min_flow.is_none()) mfl = py::cast<double>(min_flow); py::gil_scoped_release rel; auto pr = p.place_demand(fg, src, dst, flowClass, volume, tpf, mfl); py::gil_scoped_acquire acq; return py::make_tuple(pr.first, pr.second); }, py::arg("flow_graph"), py::arg("src"), py::arg("dst"), py::arg("flowClass"), py::arg("volume"), py::arg("target_per_flow") = py::none(), py::arg("min_flow") = py::none())
-      .def("rebalance_demand", [](FlowPolicy& p, FlowGraph& fg, std::int32_t src, std::int32_t dst, FlowClass flowClass, double target){ py::gil_scoped_release rel; auto pr = p.rebalance_demand(fg, src, dst, flowClass, target); py::gil_scoped_acquire acq; return py::make_tuple(pr.first, pr.second); },
-           py::arg("flow_graph"), py::arg("src"), py::arg("dst"), py::arg("flowClass"), py::arg("target"))
-      .def("remove_demand", [](FlowPolicy& p, FlowGraph& fg){ py::gil_scoped_release rel; p.remove_demand(fg); py::gil_scoped_acquire acq; })
-      .def("set_static_paths", [](FlowPolicy& p, std::int32_t src, std::int32_t dst, py::sequence paths){
-        std::vector<PredDAG> bundles;
-        bundles.reserve(py::len(paths));
-        for (auto item : paths) bundles.push_back(py::cast<const PredDAG&>(item));
-        py::gil_scoped_release rel;
-        p.set_static_paths(src, dst, std::move(bundles));
-        py::gil_scoped_acquire acq;
-      }, py::arg("src"), py::arg("dst"), py::arg("paths"),
-         "Pin this policy's demand to explicit path bundles (one flow per usable "
-         "bundle, bound in supply order). See FlowPolicy docs for validation, mask "
-         "(failure) semantics, and which config knobs become inert.")
-      .def_property_readonly("flows", [](const FlowPolicy& p){ py::dict out; for (auto const& kv : p.flows()) { const auto& idx = kv.first; const auto& f = kv.second; out[py::make_tuple(idx.src, idx.dst, idx.flowClass, idx.flowId)] = py::make_tuple(f.src, f.dst, f.cost, f.placed_flow); } return out; });
-
-  // Profiling functions (enabled via NGRAPH_CORE_PROFILE=1 environment variable)
-  m.def("profiling_enabled", &profiling_enabled,
-        "Return True if profiling is enabled (NGRAPH_CORE_PROFILE=1).");
-  m.def("profiling_dump", []{ ProfilingStats::instance().dump(); },
-        "Print profiling statistics to stderr.");
-  m.def("profiling_reset", []{ ProfilingStats::instance().reset(); },
-        "Clear all profiling statistics.");
+  m.doc() =
+      "NetGraph-Core: the graph on integer units, the route structures, the integer ledger, the forwarding\n"
+      "programs, the policy engine FlowPolicy and its lists of actions (apply_actions), the ShortestPathCache,\n"
+      "the evaluators (evaluate_demand, evaluate_pairs, evaluate_edge_failures) and the searches (spf, ksp,\n"
+      "resolve_to_paths).\n"
+      "One rule for the class of an input error, at every public entry: a type the position never takes\n"
+      "(a bool at a numeric position, a float where only an integer is taken, a string, None where none\n"
+      "is allowed, another class; for a vector a non-sequence, a nested entry, an array of another rank\n"
+      "or of a non-integer dtype) raises TypeError, a value outside its domain (a range, a length, NaN,\n"
+      "-inf, a finite float where floats are taken only for +inf) ValueError; the text is the same.\n"
+      "Every public call either completes or raises and leaves Core state as it was, with two limits:\n"
+      "(1) pybind11 does not check every allocation when it constructs a bound object from Python, parses\n"
+      "the arguments of a call that passes keywords, or converts an attribute or a returned value into a\n"
+      "new Python object outside the library's checked result construction; running out of memory exactly\n"
+      "there may crash the process, with Core state unchanged. (2) A ShortestPathCache passed to the call: a building one keeps the complete entries and\n"
+      "statistics of the lookups that succeeded before the call failed; a frozen one counts one miss\n"
+      "when the call raised ShortestPathCacheMiss.";
+
+  // In this order: a later binding's defaults and conversions need the earlier types.
+  bindings::register_options(m);
+  bindings::register_units(m);
+  bindings::register_eligibility(m);
+  bindings::register_graph(m);
+  bindings::register_flow_solver_hook(m);
+  bindings::register_predecessor_dag(m);
+  bindings::register_path(m);
+  bindings::register_flow_record(m);
+  bindings::register_flow_ledger(m);
+  bindings::register_program(m);
+  bindings::register_routing(m);
+  bindings::register_policy_config(m);
+  bindings::register_placement_result(m);
+  bindings::register_shortest_path_cache(m);
+  bindings::register_flow_policy(m);
+  bindings::register_apply_actions(m);
+  bindings::register_evaluators(m);
+  bindings::register_paths(m);
+  bindings::register_search(m);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  bindings::register_private_hooks(m);
+#endif
 }
diff --git a/bindings/python/native_call.hpp b/bindings/python/native_call.hpp
new file mode 100644
index 0000000..1d03764
--- /dev/null
+++ b/bindings/python/native_call.hpp
@@ -0,0 +1,67 @@
+// The Python/native boundary. Only native values may cross this scope: all Python
+// conversion and ownership work is done by the caller before or after it.
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <chrono>
+#include <thread>
+#include <utility>
+#include <type_traits>
+#include "netgraph/core/detail/concurrency.hpp"
+
+namespace netgraph::core::bindings {
+// The GIL released for native work: every native_call, and a FlowPolicy's destructor (its holder's
+// deleter, which waits for the ledger gate); made with the GIL held. A thread whose call began
+// while Python was initialized and that ends it after finalization began (a daemon thread) never
+// retakes the GIL: CPython before 3.13.8 would end the thread with pthread_exit, which on glibc
+// unwinds into this noexcept destructor and terminates the process. It parks forever instead, as
+// later CPython does. A call that began during finalization (the finalizing thread destroying
+// module globals) retakes the GIL as usual. Finalization starting between the check and the
+// retake surfaces as a forced unwind from PyEval_RestoreThread, which parks the thread the same way.
+class Detached {
+ public:
+  Detached() : initialized_(Py_IsInitialized() != 0), state_(PyEval_SaveThread()) {}
+  ~Detached() {
+    if (initialized_ && Py_IsInitialized() == 0) park();
+    attach(state_);
+  }
+  Detached(const Detached&) = delete;
+  Detached& operator=(const Detached&) = delete;
+
+ private:
+  [[noreturn]] static void park() noexcept {
+    for (;;) std::this_thread::sleep_for(std::chrono::hours(1));
+  }
+  static void attach(PyThreadState* state) {
+    try {
+      PyEval_RestoreThread(state);
+    } catch (...) {
+      park();
+    }
+  }
+  bool initialized_;
+  PyThreadState* state_;
+};
+
+// Native argument work can precede computation. It uses the same detach scope,
+// without announcing that the computation or its publication has begun.
+template<bool Computation = true, class Body>
+decltype(auto) native_call(Body&& body) {
+  const Detached detached;
+  if constexpr (Computation) detail::concurrent_event(detail::ConcurrentStage::NativeBegin, nullptr);
+  else detail::concurrent_event(detail::ConcurrentStage::ArgumentBegin, nullptr);
+  if constexpr (std::is_void_v<std::invoke_result_t<Body>>) {
+    std::forward<Body>(body)();
+    if constexpr (Computation) detail::publication_event(detail::ConcurrentStage::NativeComplete, nullptr);
+  } else {
+    auto result = std::forward<Body>(body)();
+    if constexpr (Computation) detail::publication_event(detail::ConcurrentStage::NativeComplete, nullptr);
+    return result;
+  }
+}
+// Run only the graph-size part of a first pass detached, preserving the
+// attached argument conversions and the surrounding check order.
+inline void detached_argument_work(void (*body)(void*), void* context) {
+  native_call<false>([&] { body(context); });
+}
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/numpy_conversion.hpp b/bindings/python/numpy_conversion.hpp
new file mode 100644
index 0000000..8e5270b
--- /dev/null
+++ b/bindings/python/numpy_conversion.hpp
@@ -0,0 +1,33 @@
+// Throwing NumPy conversions, with a private allocation-test window around the cast itself.
+#pragma once
+
+#include <pybind11/numpy.h>
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+
+namespace netgraph::core::bindings {
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+inline thread_local bool in_numpy_conversion = false;
+
+class NumpyConversionScope {
+ public:
+  NumpyConversionScope() noexcept : previous_(in_numpy_conversion) { in_numpy_conversion = true; }
+  ~NumpyConversionScope() { in_numpy_conversion = previous_; }
+  NumpyConversionScope(const NumpyConversionScope&) = delete;
+  NumpyConversionScope& operator=(const NumpyConversionScope&) = delete;
+
+ private:
+  bool previous_;
+};
+#endif
+
+template <class T, int Flags = pybind11::array::forcecast>
+pybind11::array_t<T, Flags> numpy_conversion(const pybind11::object& input) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const NumpyConversionScope scope;
+#endif
+  return pybind11::array_t<T, Flags>(input);
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/options.cpp b/bindings/python/options.cpp
new file mode 100644
index 0000000..deeec5a
--- /dev/null
+++ b/bindings/python/options.cpp
@@ -0,0 +1,81 @@
+// The enumerations: RouteAllocation, Admission, SourceAllocation, WeightBasis, RouteTieBreak and Direction.
+#include <pybind11/pybind11.h>
+#include <pybind11/stl.h>
+
+#include <string>
+
+#include "netgraph/core/options.hpp"
+
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+void register_options(py::module_& m) {
+  py::enum_<RouteAllocation>(m, "RouteAllocation",
+                           "How a demand's traffic is split at every router of its routes (ShortestPaths; also the interior split\n"
+                           "of supplied PredecessorDAG routes, EQUAL or WEIGHTED).\n"
+                           "OPTIMIZED: the minimum-cost flow core over the routes (a controller restricted to them), re-solved\n"
+                           "over the free capacity plus the policy's own allocation (it may move its own earlier placement,\n"
+                           "never another's). WEIGHTED (WCMP, weighted-cost multipath): every node splits in proportion to\n"
+                           "weights fixed when the routes are prepared (highest averages (D'Hondt): assign each next unit\n"
+                           "to the largest weight / (assigned + 1), ties to the lower EdgeId; the weights come from\n"
+                           "WeightBasis). EQUAL (ECMP, equal-cost\n"
+                           "multipath): every node splits equally, by round robin.")
+      .value("EQUAL", RouteAllocation::Equal)
+      .value("WEIGHTED", RouteAllocation::Weighted)
+      .value("OPTIMIZED", RouteAllocation::Optimized);
+
+  py::enum_<Admission>(m, "Admission",
+                       "LOSSLESS admits the largest total the routes carry with no loss at all; LOSSY sends the whole\n"
+                       "finite offer hop by hop and records where it is lost (every model except the optimizing ones:\n"
+                       "ShortestPaths OPTIMIZED and CentralizedTE without tunnel_count).")
+      .value("LOSSLESS", Admission::Lossless)
+      .value("LOSSY", Admission::Lossy);
+
+  py::enum_<SourceAllocation>(m, "SourceAllocation",
+                    "How a demand's traffic enters at its sources, separately from how it is routed. EQUAL: round\n"
+                    "robin over the roster (ascending NodeId, the first sources one unit more); a source whose share\n"
+                    "cannot go anywhere keeps it and loses it (LOSSLESS then admits only totals that give it\n"
+                    "nothing). OPTIMIZED: the controller chooses the injections (one virtual source). WEIGHTED:\n"
+                    "CentralizedTE without tunnels prescribes highest-averages shares of declared source_weights.")
+      .value("EQUAL", SourceAllocation::Equal)
+      .value("OPTIMIZED", SourceAllocation::Optimized)
+      .value("WEIGHTED", SourceAllocation::Weighted);
+
+  py::enum_<WeightBasis>(m, "WeightBasis",
+                         "Where WEIGHTED member weights come from (ShortestPaths WEIGHTED and supplied PredecessorDAG routes).\n"
+                         "CAPACITY (the default): each member's static capacity. EXPLICIT: edge_weights, one integer per\n"
+                         "edge (a positive weight on an edge of capacity 0 becomes 0). RESIDUAL_SNAPSHOT: each member's free\n"
+                         "capacity read once when the routes are prepared, against one common view, and frozen for the\n"
+                         "epoch. A member of weight 0 is pruned with the branches it leaves without a destination, inside\n"
+                         "the route only. The tie rule never chooses weights.")
+      .value("CAPACITY", WeightBasis::Capacity)
+      .value("EXPLICIT", WeightBasis::Explicit)
+      .value("RESIDUAL_SNAPSHOT", WeightBasis::ResidualSnapshot);
+
+  py::enum_<RouteTieBreak>(m, "RouteTieBreak",
+                           "How a route choice breaks a cost tie; cost always comes first. FEWER_HOPS: then fewer hops,\n"
+                           "then the smaller EdgeId sequence. HIGHER_CAPACITY / HIGHER_AVAILABLE_CAPACITY /\n"
+                           "HIGHER_HEADROOM: then the larger path bottleneck of static capacity / availability /\n"
+                           "availability over static capacity (exact; 0 at static capacity 0), then fewer hops, then the\n"
+                           "EdgeId sequence. Availability: unreserved bandwidth for DistributedTE, the service view for\n"
+                           "ShortestPaths, the residual for spf and ksp, static capacity without one. The same order\n"
+                           "keeps one of each (u, v) pair's parallel edges when parallel_edges is False. It never\n"
+                           "supplies weights and never enables a controller objective.")
+      .value("FEWER_HOPS", RouteTieBreak::FewerHops)
+      .value("HIGHER_CAPACITY", RouteTieBreak::HigherCapacity)
+      .value("HIGHER_AVAILABLE_CAPACITY", RouteTieBreak::HigherAvailableCapacity)
+      .value("HIGHER_HEADROOM", RouteTieBreak::HigherHeadroom);
+
+  py::enum_<Direction>(m, "Direction",
+                       "The orientation of a search: FORWARD from the roots along the edges, or REVERSE toward the roots\n"
+                       "against the edges (the DAG it returns keeps the edges' own direction, so its walks lead to the\n"
+                       "roots).")
+      .value("FORWARD", Direction::Forward)
+      .value("REVERSE", Direction::Reverse);
+
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/path.cpp b/bindings/python/path.cpp
new file mode 100644
index 0000000..80761de
--- /dev/null
+++ b/bindings/python/path.cpp
@@ -0,0 +1,86 @@
+// Path: an explicit walk of hops of one graph.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "integers.hpp"
+#include "registration.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+void register_path(py::module_& m) {
+  py::class_<Path, std::shared_ptr<Path>>(
+      m, "Path",
+      "Immutable route of one graph, hop by hop: each hop lists one or more parallel edges (members)\n"
+      "from the same u to the same v, in the caller's order. cost = the sum over hops of the cost of\n"
+      "each hop's cheapest member.")
+      .def(py::init([](const std::shared_ptr<Graph>& graph, const py::object& hops) {
+             if (!graph) throw py::type_error("graph must be a Graph");
+             if (is_invalid_sequence(hops)) throw py::type_error("Path: hops must be a sequence of hops (sequences of EdgeIds)");
+             auto seq = py::reinterpret_borrow<py::sequence>(hops);
+             std::vector<CheckedIntegerVector> raw;
+             for (std::size_t h = 0; h < seq.size(); ++h) {
+               py::object hop = seq[h];
+               raw.push_back(wide_integers(hop, ("hops[" + std::to_string(h) + "]").c_str()));
+             }
+             // Every member in range before anything else (no id is narrowed unchecked), then the
+             // C++ constructor's order.
+             const auto edge_count = static_cast<std::int64_t>(graph->num_edges());
+             for (std::size_t h = 0; h < raw.size(); ++h) {
+               for (std::size_t i = 0; i < raw[h].size(); ++i) {
+                 if (!raw[h].in(i, 0, edge_count - 1)) {
+                   throw py::value_error("Path: hop " + std::to_string(h) + " member " + raw[h].text(i) +
+                                         " out of edge range [0, " + std::to_string(edge_count) + ")");
+                 }
+               }
+             }
+             std::vector<std::vector<EdgeId>> narrowed;
+             narrowed.reserve(raw.size());
+             for (const auto& r : raw) narrowed.push_back(r.narrow<EdgeId>());
+             detail::check_hops(*graph, narrowed);
+             return native_call([&] { return std::make_shared<Path>(detail::PathBuilder::of_hops(*graph, std::move(narrowed))); });
+           }),
+           py::arg("graph"), py::arg("hops"),
+           "A wrong type raises TypeError; structural and range defects raise ValueError. Validates, in order:\n"
+           "every member id in range, no duplicate\n"
+           "member, a non-empty hop list, every hop non-empty, the members of a hop sharing (u, v),\n"
+           "contiguous hops, no repeated node.")
+      .def("graph_uid", &Path::graph_uid, "uid of the graph this path belongs to")
+      .def("hops", [](const Path& p) { return p.hops(); }, "the hops as lists of EdgeIds (the caller's member order)")
+      .def("source", &Path::source, "the first node of the walk")
+      .def("destination", &Path::destination, "the last node of the walk")
+      .def("cost", &Path::cost, "sum over hops of the minimum member cost")
+      .def(
+          "to_dag", [](const Path& p) { return native_call([&] { return std::make_shared<PredecessorDAG>(p.to_dag()); }); },
+          "the equivalent PredecessorDAG (every member of every hop)")
+      .def("__eq__", [](const Path& a, const py::object& b) {
+        return py::isinstance<Path>(b) && a == b.cast<const Path&>();
+      })
+      .def("__hash__",
+           [](const Path& a) {
+             const auto& path_hops = a.hops();
+             auto hops = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(static_cast<Py_ssize_t>(path_hops.size()))).release());
+             for (std::size_t i = 0; i < path_hops.size(); ++i) {
+               PyTuple_SET_ITEM(hops.ptr(), static_cast<Py_ssize_t>(i), ints_tuple(path_hops[i]).release().ptr());
+             }
+             return hash_int(objects_tuple({int_object(a.graph_uid()), hops}));
+           })
+      .def("__repr__", [](const Path& a) {
+        return "Path(source=" + std::to_string(a.source()) + ", destination=" + std::to_string(a.destination()) +
+               ", hops=" + std::to_string(a.hops().size()) + ", cost=" + std::to_string(a.cost()) + ")";
+      });
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/path_enumeration.cpp b/bindings/python/path_enumeration.cpp
new file mode 100644
index 0000000..1d9b96e
--- /dev/null
+++ b/bindings/python/path_enumeration.cpp
@@ -0,0 +1,182 @@
+// The path listings: ksp with KspOptions, and resolve_to_paths.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "integers.hpp"
+#include "strict_bool.hpp"
+#include "publication.hpp"
+#include "values.hpp"
+#include "registration.hpp"
+#include "native_call.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// One NodeId of [0, num_nodes) (a single endpoint); the range message of detail/endpoints.hpp.
+NodeId endpoint(const py::object& obj, std::int32_t num_nodes, const char* name) {
+  const py::object idx = python_int(obj, name);
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  if (overflow != 0 || v < 0 || v >= num_nodes) {
+    throw py::value_error(detail::node_range_error(name, std::string(py::str(idx)), num_nodes));
+  }
+  return static_cast<NodeId>(v);
+}
+
+// A count of at least 1 (KSP's k, the resolver's max_paths): the validation message below 1; a count
+// above INT64_MAX means the same as INT64_MAX (no list reaches it).
+std::int64_t count_of(const py::object& obj, const char* name) {
+  const py::object idx = python_int(obj, name);
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  if (overflow < 0 || (overflow == 0 && v < 1)) {
+    throw py::value_error(std::string(name) + " must be >= 1 (got " + std::string(py::str(idx)) + ")");
+  }
+  return overflow != 0 ? std::numeric_limits<std::int64_t>::max() : static_cast<std::int64_t>(v);
+}
+
+// The Python form of KspOptions: the arguments as given (k, cost_ceiling and residual are
+// validated at the call, in ksp's validation order, on their unnarrowed values).
+struct PyKspOptions {
+  py::object k;
+  RouteTieBreak tie_break;
+  bool parallel_edges;
+  py::object cost_ceiling;
+  py::object residual;
+  std::shared_ptr<Eligibility> eligibility;
+};
+
+} // namespace
+
+void register_paths(py::module_& m) {
+  py::class_<PyKspOptions>(
+      m, "KspOptions",
+      "The options of ksp: k (>= 1); tie_break (RouteTieBreak) orders paths of equal cost;\n"
+      "parallel_edges = True lists each parallel edge as a separate path, False keeps one per (u, v)\n"
+      "pair by the tie rule (no multipath field: k sets the number of paths); cost_ceiling (None,\n"
+      "AbsoluteCost(c) with c >= 0, or CostStretch(n/d) with n/d >= 1 times the static shortest\n"
+      "cost under the eligibility, compared exactly, residual ignored; inclusive); residual (int64 units per\n"
+      "EdgeId, each in [0, edge_capacity_units]: edges with less than 1 unit are skipped, and the values\n"
+      "feed the availability; it is the only capacity threshold, and without it an edge of capacity 0 is\n"
+      "searched like any other); eligibility (None: everything allowed). A parallel_edges that is not a\n"
+      "bool raises TypeError here; the other fields are validated by ksp, in the order its docstring\n"
+      "gives.")
+      .def(py::init([](const py::object& k, RouteTieBreak tie_break, StrictBool parallel_edges,
+                       const py::object& cost_ceiling, const py::object& residual,
+                       const std::shared_ptr<Eligibility>& eligibility) {
+             return PyKspOptions {k, tie_break, parallel_edges, cost_ceiling, residual, eligibility};
+           }),
+           py::arg("k"), py::kw_only(), py::arg_v("tie_break", RouteTieBreak::FewerHops, "RouteTieBreak.FEWER_HOPS"),
+           py::arg("parallel_edges") = StrictBool {true}, py::arg("cost_ceiling") = py::none(),
+           py::arg("residual") = py::none(), py::arg("eligibility") = nullptr)
+      .def_readonly("k", &PyKspOptions::k, "the number of paths as given (validated by ksp: an integer >= 1)")
+      .def_property_readonly("tie_break", field_object(&PyKspOptions::tie_break), "the RouteTieBreak of paths of equal cost")
+      .def_readonly("parallel_edges", &PyKspOptions::parallel_edges,
+                    "True: each parallel edge a separate path; False: one per (u, v) pair by the tie rule")
+      .def_readonly("cost_ceiling", &PyKspOptions::cost_ceiling,
+                    "the inclusive cost ceiling as given: None, AbsoluteCost or CostStretch (validated by ksp)")
+      .def_readonly("residual", &PyKspOptions::residual,
+                    "the residual units per EdgeId as given (validated by ksp); None: no capacity filter;\n"
+                    "the tie scores read static capacity")
+      .def_property_readonly("eligibility", shared_field(&PyKspOptions::eligibility), "the static Eligibility; None: everything allowed");
+
+  m.def(
+      "ksp",
+      [](const std::shared_ptr<Graph>& graph, const py::object& src, const py::object& dst, const py::object& opts) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        const auto o = options_of<PyKspOptions>(opts, "KspOptions");
+        const auto n = graph->num_nodes();
+        // ksp's validation order on unnarrowed values (Core repeats every check): the tie_break, the
+        // source, the destination, source == destination, k, the ceiling, the residual, then a foreign
+        // Eligibility.
+        detail::check_member(o.tie_break, "tie_break");
+        const NodeId s = endpoint(src, n, "source");
+        const NodeId t = endpoint(dst, n, "destination");
+        if (s == t) throw py::value_error(detail::overlap_error(s, "source", "destination"));
+        KspOptions c(count_of(o.k, "k"));
+        c.tie_break = o.tie_break;
+        c.parallel_edges = o.parallel_edges;
+        c.cost_ceiling = cost_ceiling_of(o.cost_ceiling);
+        detail::check_ceiling(c.cost_ceiling);
+        std::optional<std::vector<Amount>> res;
+        if (!o.residual.is_none()) res = edge_units(o.residual, *graph, "residual");
+        if (res.has_value()) c.residual = std::span<const Amount>(*res);
+        c.eligibility = o.eligibility.get();
+        if (c.eligibility && c.eligibility->graph_uid() != graph->uid()) {
+          throw py::value_error("foreign Eligibility: built for another graph");
+        }
+        auto paths = native_call([&] { return ksp(*graph, s, t, c); });
+        // Every object through a checked allocation: a failure raises MemoryError.
+        auto out = py::reinterpret_steal<py::list>(checked(PyList_New(static_cast<Py_ssize_t>(paths.size()))).release());
+        for (std::size_t i = 0; i < paths.size(); ++i) {
+          py::object cost = int_object(paths[i].first);
+          py::object path = object_from<Path>(std::move(paths[i].second));
+          PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), objects_tuple({cost, path}).release().ptr());
+        }
+        return out;
+      },
+      py::arg("graph"), py::arg("source"), py::arg("destination"), py::arg("options"),
+      "The k shortest simple source -> destination paths over the eligible edges (only those with residual >= 1 when\n"
+      "a residual is given; an edge of capacity 0 is searched like any other) -> [(cost, Path)], each hop\n"
+      "a single edge. Order: lowest cost; then, under a HIGHER_* tie_break only, the highest bottleneck\n"
+      "(the smallest edge score along the path); then fewest hops; then the smallest EdgeId\n"
+      "sequence. The result is the first k paths of that order\n"
+      "within the inclusive cost ceiling. A wrong type raises TypeError; structural, range and combination\n"
+      "defects raise ValueError. Validated in this order before any work: source and\n"
+      "destination in range, source == destination, k >= 1, the ceiling, the residual (length, then every\n"
+      "entry), a foreign Eligibility. An excluded endpoint, no static route under a CostStretch ceiling, or\n"
+      "no path gives [].");
+
+  m.def(
+      "resolve_to_paths",
+      [](const std::shared_ptr<Graph>& graph, const std::shared_ptr<PredecessorDAG>& dag, const py::object& src,
+         const py::object& dst, StrictBool split_parallel_edges, const py::object& max_paths) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        if (!dag) throw py::type_error("dag must be a PredecessorDAG");
+        if (dag->graph_uid() != graph->uid()) throw py::value_error("foreign PredecessorDAG: built for another graph");
+        const auto n = graph->num_nodes();
+        const NodeId s = endpoint(src, n, "source");
+        const NodeId t = endpoint(dst, n, "destination");
+        if (s == t) throw py::value_error(detail::overlap_error(s, "source", "destination"));
+        std::optional<std::int64_t> mp;
+        if (!max_paths.is_none()) mp = count_of(max_paths, "max_paths");
+        auto paths = native_call([&] { return resolve_to_paths(*graph, *dag, s, t, split_parallel_edges, mp); });
+        auto out = py::reinterpret_steal<py::list>(checked(PyList_New(static_cast<Py_ssize_t>(paths.size()))).release());
+        for (std::size_t i = 0; i < paths.size(); ++i) {
+          PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), object_from<Path>(std::move(paths[i])).release().ptr());
+        }
+        return out;
+      },
+      py::arg("graph"), py::arg("dag"), py::arg("source"), py::arg("destination"), py::arg("split_parallel_edges") = StrictBool {false},
+      py::arg("max_paths") = py::none(),
+      "The source -> destination walks of a DAG -> [Path], in increasing (cost, hops, edge-id sequence):\n"
+      "a hop costs its cheapest member and is keyed by its lowest member id. split_parallel_edges = False\n"
+      "keeps every parallel member of a (u, v) pair in one hop (members ascending); True gives one path\n"
+      "per member combination, sorted by that path's own (cost, hops, edge-id sequence). max_paths\n"
+      "(>= 1) truncates; None lists every walk.\n"
+      "ValueError: a DAG of another graph, source or destination out of range, source == destination,\n"
+      "max_paths < 1. An endpoint outside the DAG, or no walk, gives [].");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/placement_result.cpp b/bindings/python/placement_result.cpp
new file mode 100644
index 0000000..d47e8e7
--- /dev/null
+++ b/bindings/python/placement_result.cpp
@@ -0,0 +1,347 @@
+// Termination, SourceFlow, TunnelFlow, TunnelPlan and PlacementResult: the outcome of one policy call.
+#include <pybind11/pybind11.h>
+#include <pybind11/gil_safe_call_once.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <limits>
+#include <memory>
+#include <optional>
+#include <string>
+
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "values.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// A Termination's name, without a Python object (a repr must not fail on its own allocation of an
+// enum object).
+const char* termination_name(Termination t) {
+  switch (t) {
+    case Termination::Complete: return "COMPLETE";
+    case Termination::NoRoute: return "NO_ROUTE";
+    case Termination::Exhausted: return "EXHAUSTED";
+    case Termination::NoActiveWeight: return "NO_ACTIVE_WEIGHT";
+  }
+  return "?";
+}
+
+py::object inf_or(const std::optional<Amount>& r) {
+  return r.has_value() ? py::object(int_object(*r)) : py::object(float_object(std::numeric_limits<double>::infinity()));
+}
+
+py::object counter_or_none(const std::optional<Counter128>& c) {
+  return c.has_value() ? counter_int(*c) : py::object(py::none());
+}
+
+// fractions.Fraction, imported once when the module is registered: TunnelPlan.max_fractional_bandwidth_per_tunnel only
+// calls it (an import inside a getter can absorb a failed allocation and still succeed).
+py::gil_safe_call_once_and_store<py::object>& fraction_class() {
+  PYBIND11_CONSTINIT static py::gil_safe_call_once_and_store<py::object> storage;
+  return storage;
+}
+
+} // namespace
+
+void register_placement_result(py::module_& m) {
+  fraction_class().call_once_and_store_result([] { return py::module_::import("fractions").attr("Fraction"); });
+  py::enum_<Termination>(m, "Termination",
+                         "How a call ended, the first that applies: COMPLETE for a zero request; NO_ROUTE for a positive\n"
+                         "request with an empty roster (no eligible source statically reaches an allowed destination);\n"
+                         "NO_ACTIVE_WEIGHT when the program has an entry with a path (an up tunnel, a controller path or\n"
+                         "a split route) but no head can use one (no positive weight: WEIGHTED over edges of capacity 0\n"
+                         "only, routes of weight 0, every up tunnel failed); a program whose tunnels are all down is not\n"
+                         "this case. A live CentralizedTE WEIGHTED call without tunnel_count with a positive offer\n"
+                         "and a nonempty all-zero source-weight roster is also NO_ACTIVE_WEIGHT, with no tunnels;\n"
+                         "Pinned replay of that empty program follows the remaining rules. A LOSSY finite request: COMPLETE (delivery and losses account for the whole offer,\n"
+                         "which does not mean nothing was lost); otherwise COMPLETE when the whole request was delivered,\n"
+                         "else EXHAUSTED (an infinite request is EXHAUSTED). A controller whose maximum is 0 over existing\n"
+                         "routes is EXHAUSTED, not NO_ROUTE.")
+      .value("COMPLETE", Termination::Complete)
+      .value("NO_ROUTE", Termination::NoRoute)
+      .value("EXHAUSTED", Termination::Exhausted)
+      .value("NO_ACTIVE_WEIGHT", Termination::NoActiveWeight);
+
+  py::class_<SourceFlow>(m, "SourceFlow",
+                         "One normalized input source's forwarding in the epoch (read-only; zero rows included: a\n"
+                         "masked or unreachable source): source, offered (LOSSY: its injections; None when\n"
+                         "LOSSLESS), admitted (LOSSLESS: what it delivers; LOSSY: offered), delivered, source_drops\n"
+                         "(offered units lost at the source for lack of a usable route) and total_edge_drops (its losses\n"
+                         "on links). LOSSY: offered = delivered + source_drops + total_edge_drops. Exact ints.")
+      .def_property_readonly("source", int_reader(&SourceFlow::source), "the source node id")
+      .def_property_readonly(
+
+          "offered", [](const SourceFlow& r) { return counter_or_none(r.offered); },
+          "LOSSY: the units this source injected; None when LOSSLESS")
+      .def_property_readonly(
+
+          "admitted", [](const SourceFlow& r) { return counter_int(r.admitted); },
+          "LOSSLESS: the units it delivers; LOSSY: offered")
+      .def_property_readonly("delivered", int_reader(&SourceFlow::delivered), "the units it delivers to the destinations")
+      .def_property_readonly(
+          "source_drops", [](const SourceFlow& r) { return counter_int(r.source_drops); },
+          "LOSSY: its offered units lost at the source (no usable route); 0 when LOSSLESS")
+      .def_property_readonly(
+          "total_edge_drops", [](const SourceFlow& r) { return counter_int(r.total_edge_drops); },
+          "LOSSY: its units dropped on links; 0 when LOSSLESS")
+      .def("__repr__", [](const SourceFlow& r) {
+        return "SourceFlow(source=" + std::to_string(r.source) + ", delivered=" + std::to_string(r.delivered) + ")";
+      });
+
+  py::class_<TunnelFlow>(m, "TunnelFlow",
+                         "One program tunnel's forwarding in the epoch (read-only): entry_id (its entry identifier) and\n"
+                         "head, status (TunnelStatus: UP; INSUFFICIENT_BANDWIDTH or COST_CEILING_EXCEEDED for a tunnel\n"
+                         "T1's setup left down; FAILED, BLACKHOLED in this forwarding), assigned (its share of the\n"
+                         "injections: LOSSY the shares sent to it, LOSSLESS what it carries), delivered and\n"
+                         "total_edge_drops (its losses on links). Exact ints (assigned and total_edge_drops may exceed 64\n"
+                         "bits).")
+      .def_property_readonly("entry_id", int_reader(&TunnelFlow::entry_id), "the tunnel's entry identifier")
+      .def_property_readonly("head", int_reader(&TunnelFlow::head), "the tunnel's head")
+      .def_property_readonly("status", field_object(&TunnelFlow::status),
+                    "UP, a down tunnel's setup status (INSUFFICIENT_BANDWIDTH, COST_CEILING_EXCEEDED), FAILED or\n"
+                    "BLACKHOLED in this forwarding")
+      .def_property_readonly(
+
+          "assigned", [](const TunnelFlow& r) { return counter_int(r.assigned); },
+          "its share of the injections in the epoch (LOSSY: sent to it; LOSSLESS: what it carries)")
+      .def_property_readonly("delivered", int_reader(&TunnelFlow::delivered), "the units it delivers")
+      .def_property_readonly(
+          "total_edge_drops", [](const TunnelFlow& r) { return counter_int(r.total_edge_drops); }, "its units dropped on links")
+      .def("__repr__", [](const TunnelFlow& r) {
+        return "TunnelFlow(entry_id=" + std::to_string(r.entry_id) + ", delivered=" + std::to_string(r.delivered) + ")";
+      });
+
+  py::class_<TunnelPlan>(m, "TunnelPlan",
+                         "The tunnel models' setup summary (read-only): tunnels_per_head (T2 up to: the chosen count),\n"
+                         "design_demand (the design demand D in units), design_by_head ((head, RR(D, H, i)) for every\n"
+                         "roster head in ascending NodeId) and total_reserved_bandwidth (T1's strict holds, counted once\n"
+                         "per up tunnel: the sum of their requests; 0 for T2). T2 only (None for T1): heads_with_capacity,\n"
+                         "insufficient_resolution (live heads exist but no whole unit per tunnel fits, U == 0: the\n"
+                         "program has no tunnels), max_fractional_bandwidth_per_tunnel (the exact fluid optimum s*, a\n"
+                         "Fraction), max_bandwidth_per_tunnel (U), planned_bandwidth_per_tunnel (u),\n"
+                         "total_planned_bandwidth (K*u), total_tunnel_cost (the route-cost sum, can exceed 2^64),\n"
+                         "headroom_penalty (with prefer_headroom only) and max_lossless_offer (the program's lossless\n"
+                         "maximum on the view it was planned on; a dead head's share blocks it). Exact ints. A plan\n"
+                         "describes the computation that installed the tunnels: forward returns it unchanged, its\n"
+                         "bounds not recomputed for the new offer, load or black holes.")
+      .def_property_readonly("tunnels_per_head", int_reader(&TunnelPlan::tunnels_per_head), "the tunnels per head (T2 up to: the chosen count)")
+      .def_property_readonly(
+
+          "design_demand", [](const TunnelPlan& p) { return inf_or(p.design_demand); },
+          "the design volume D in units; float('inf') when unlimited")
+      .def_property_readonly(
+          "design_by_head", [](const TunnelPlan& p) { return pairs_tuple(p.design_by_head); },
+          "((head, share), ...): every roster head's share RR(D, H, i), ascending NodeId")
+      .def_property_readonly("total_reserved_bandwidth", int_reader(&TunnelPlan::total_reserved_bandwidth),
+                    "the strict holds of the up tunnels, each tunnel's request counted once")
+      .def_property_readonly(
+          "heads_with_capacity",
+          [](const TunnelPlan& p) -> py::object {
+            return p.heads_with_capacity.has_value() ? py::object(ints_tuple(*p.heads_with_capacity)) : py::object(py::none());
+          },
+          "T2: the heads that reach a destination over links with free capacity >= 1 (ascending); None for T1")
+      .def_readonly("insufficient_resolution", &TunnelPlan::insufficient_resolution,
+                    "T2: True when live heads exist but no whole unit per tunnel fits (max_bandwidth_per_tunnel 0,\n"
+                    "no tunnels)")
+      .def_property_readonly(
+          "max_fractional_bandwidth_per_tunnel",
+          [](const TunnelPlan& p) -> py::object {
+            if (!p.max_fractional_bandwidth_per_tunnel.has_value()) return py::none();
+            const auto& [n, d] = *p.max_fractional_bandwidth_per_tunnel;
+            return fraction_object(fraction_class().get_stored(), n, d);
+          },
+          "T2: the exact fluid optimum s* (a fractions.Fraction; 0 without a live head); None for T1")
+      .def_property_readonly("max_bandwidth_per_tunnel", optional_int_reader(&TunnelPlan::max_bandwidth_per_tunnel), "T2: U, the largest common whole-unit size")
+      .def_property_readonly("planned_bandwidth_per_tunnel", optional_int_reader(&TunnelPlan::planned_bandwidth_per_tunnel), "T2: u, every tunnel's planned bandwidth")
+      .def_property_readonly("total_planned_bandwidth", optional_int_reader(&TunnelPlan::total_planned_bandwidth), "T2: K*u over the K tunnels")
+      .def_property_readonly(
+          "total_tunnel_cost",
+          [](const TunnelPlan& p) -> py::object { return p.total_tunnel_cost.has_value() ? counter_int(*p.total_tunnel_cost) : py::none(); },
+          "T2: the sum of cost * tunnel count over the links (exact; can exceed 2^64)")
+      .def_property_readonly(
+
+          "headroom_penalty",
+          [](const TunnelPlan& p) -> py::object {
+            return p.headroom_penalty.has_value() ? counter_int(*p.headroom_penalty) : py::none();
+          },
+          "T2 with prefer_headroom: the sum over the links' tunnel slots j of floor(2^32 (B - V + j*u) / B)\n"
+          "(B: static capacity; V: free capacity); None without prefer_headroom and for T1")
+      .def_property_readonly("max_lossless_offer", optional_int_reader(&TunnelPlan::max_lossless_offer),
+                    "T2: F, the program's lossless maximum on the view it was planned on (a dead head's share blocks\n"
+                    "it); forward keeps the plan unchanged")
+      .def("__repr__", [](const TunnelPlan& p) {
+        return "TunnelPlan(tunnels_per_head=" + std::to_string(p.tunnels_per_head) + ", total_reserved_bandwidth=" + std::to_string(p.total_reserved_bandwidth) + ")";
+      });
+
+  py::class_<PlacementResult>(
+      m, "PlacementResult",
+      "The result of one call. This call: call_delivered (units delivered by the call; replace, forward\n"
+      "and evaluate: the full new delivery), call_undelivered (request - call_delivered; float('inf') for\n"
+      "an infinite request), delivery_delta (new minus old delivery, may be negative), call_edge_drops\n"
+      "[(EdgeId, units)], call_source_drops, termination, routes_changed, weights_changed and\n"
+      "reservations_changed. The\n"
+      "demand's state after the call (totals of the epoch): program (the installed ForwardingProgram;\n"
+      "evaluate: the computed one; None before the first preparation), plan (a TunnelPlan for T1 and T2;\n"
+      "None for every other model), requested (float('inf') after an infinite request), offered (LOSSY: the traffic sent; None when LOSSLESS), admitted, delivered, unadmitted\n"
+      "(LOSSLESS: requested - delivered, None after an infinite request; LOSSY: 0), source_drops,\n"
+      "edge_drops [(EdgeId, units)], by_source (one SourceFlow per normalized input source, ascending\n"
+      "NodeId), by_tunnel (one TunnelFlow per program tunnel, ascending entry_id; an alternative view, never\n"
+      "added to by_source), total_cost (controllers: CentralizedTE and ShortestPaths OPTIMIZED; else None)\n"
+      "and marginal_cost_curve (unrestricted CentralizedTE with the optimized source allocation only).\n"
+      "LOSSY: offered = source_drops + sum(edge_drops) + delivered. The rows sum to the totals, except, under\n"
+      "LOSSY, for an empty roster and for a forwarding whose remaining captured source weights are all 0\n"
+      "(a controller program that sent nothing, or a mask that left only zero-weight heads): the whole\n"
+      "offer is then the demand's source drops and every row is zero. Optional outputs, None unless requested: edge_flows, residual and edge_reservations\n"
+      "(int64[E]), saturated_boundary_edges, min_cut (they describe the same\n"
+      "state; evaluate: the evaluated one). Amounts that accumulate are exact ints (they may exceed 64 bits).")
+      .def_property_readonly("call_delivered", int_reader(&PlacementResult::call_delivered), "the units placed (delivered) by this call")
+      .def_property_readonly(
+          "call_undelivered", [](const PlacementResult& r) { return inf_or(r.call_undelivered); },
+          "the request minus call_delivered, in units (an amount, not a status); float('inf') for an infinite\n"
+          "request")
+      .def_property_readonly("delivery_delta", int_reader(&PlacementResult::delivery_delta),
+                    "the delivery after the call minus before it (call_delivered for a placement; may be negative\n"
+                    "for a full-offer call)")
+      .def_property_readonly(
+          "call_edge_drops", [](const PlacementResult& r) { return pairs_list(r.call_edge_drops); },
+          "this call's drops on links [(EdgeId, units)], ascending EdgeId (empty unless LOSSY)")
+      .def_property_readonly("call_source_drops", int_reader(&PlacementResult::call_source_drops),
+                    "this call's offered units lost at sources without a usable route (LOSSY)")
+      .def_property_readonly("termination", field_object(&PlacementResult::termination), "the call's outcome (Termination)")
+      .def_readonly("routes_changed", &PlacementResult::routes_changed,
+                    "True when the call's program differs from the installed one in its ordered heads, paths, split\n"
+                    "tables or duplicates (no program counts as the empty program; two programs without an entry\n"
+                    "are equal). An offer-only change (forward, Pinned, ShortestPaths increments) and an identical\n"
+                    "replace set nothing")
+      .def_readonly("weights_changed", &PlacementResult::weights_changed,
+                    "True when the call's program differs from the installed one in its injection (source weights)\n"
+                    "or any entry or split-table weight (a controller's re-solve that changes a path's amount; an\n"
+                    "absent entry weighs 0)")
+      .def_readonly("reservations_changed", &PlacementResult::reservations_changed,
+                    "True when a tunnel's requested or reserved amount differs from the installed program's, by\n"
+                    "entry_id (an absent tunnel holds 0): only T1 sets it; forward and Pinned never do")
+      .def_property_readonly(
+
+          "program",
+          [](const PlacementResult& r) { return optional_shared(r.program); },
+          "the installed ForwardingProgram after the call (evaluate: the computed one); None before the first\n"
+          "preparation")
+      .def_property_readonly(
+
+          "plan", [](const PlacementResult& r) { return optional_of(r.plan); },
+          "T1 and T2: the TunnelPlan of the program after the call; None for every other model (Pinned over\n"
+          "a tunnel program too)")
+      .def_property_readonly(
+
+          "requested",
+          [](const PlacementResult& r) -> py::object {
+            return r.requested.has_value() ? counter_int(*r.requested)
+                                           : py::object(float_object(std::numeric_limits<double>::infinity()));
+          },
+          "the sum of the epoch's requests; float('inf') after an infinite one")
+      .def_property_readonly(
+
+          "offered", [](const PlacementResult& r) { return counter_or_none(r.offered); },
+          "LOSSY: the traffic sent in the epoch (the first-hop injection of an infinite request); None\n"
+          "when LOSSLESS")
+      .def_property_readonly(
+
+          "admitted", [](const PlacementResult& r) { return counter_int(r.admitted); },
+          "LOSSLESS: the total carried; LOSSY: offered")
+      .def_property_readonly("delivered", int_reader(&PlacementResult::delivered), "the units the demand delivers")
+      .def_property_readonly(
+
+          "unadmitted", [](const PlacementResult& r) { return counter_or_none(r.unadmitted); },
+          "LOSSLESS: requested - delivered, None after an infinite request; LOSSY: 0")
+      .def_property_readonly(
+          "source_drops", [](const PlacementResult& r) { return counter_int(r.source_drops); },
+          "LOSSY: the offered units lost at sources (no usable route, or an empty roster); 0 when LOSSLESS")
+      .def_property_readonly(
+          "edge_drops", [](const PlacementResult& r) { return pairs_list(r.edge_drops); },
+          "the epoch's drops on links [(EdgeId, units)], ascending EdgeId (empty unless LOSSY)")
+      .def_property_readonly(
+
+          "by_source", [](const PlacementResult& r) { return tuple_of(r.by_source); },
+          "one SourceFlow per normalized input source, ascending NodeId (zero rows included)")
+      .def_property_readonly(
+
+          "by_tunnel", [](const PlacementResult& r) { return tuple_of(r.by_tunnel); },
+          "one TunnelFlow per program tunnel, ascending entry_id (empty without tunnels)")
+      .def_property_readonly(
+
+          "total_cost", [](const PlacementResult& r) { return counter_or_none(r.total_cost); },
+          "controllers (CentralizedTE, ShortestPaths OPTIMIZED): the exact sum of cost * flow over the policy's\n"
+          "allocation; None for the other models (T1, T2, Pinned)")
+      .def_property_readonly(
+          "marginal_cost_curve",
+          [](const PlacementResult& r) {
+            using Curve = py::typing::List<py::typing::Tuple<py::int_, py::int_>>;
+            return py::reinterpret_steal<py::typing::Optional<Curve>>(
+                r.marginal_cost_curve ? pairs_list<Curve>(*r.marginal_cost_curve).release() : py::none().release());
+          },
+                    "unrestricted CentralizedTE with the optimized source allocation: the marginal cost curve [(cost, units)] of the policy's\n"
+                    "flow as the call's solve computed it (a positive place: the cumulative flow; evaluate and replace,\n"
+                    "a zero offer included: the whole offer); place(0) keeps the stored curve (None before the epoch's\n"
+                    "first solve or forward; after a forward, None for a nonempty roster and [] for an empty one);\n"
+                    "a forward with a nonempty roster solves nothing and reports None; with an empty roster every\n"
+                    "call but place(0) reports []; in ascending cost, delivering `units` more raised the minimum total flow cost by `cost`\n"
+                    "per unit (more delivery can reroute earlier flow, so these are not the costs of the final\n"
+                    "paths). None for the other models and prescribed (EQUAL or WEIGHTED) sources")
+      .def_property_readonly(
+
+          "edge_flows",
+          [](const PlacementResult& r) -> py::object {
+            return r.edge_flows ? py::object(int64_array(*r.edge_flows)) : py::object(py::none());
+          },
+          "if requested: the policy's own allocation per edge after the call (int64[E], EdgeId order),\n"
+          "else None")
+      .def_property_readonly(
+
+          "residual",
+          [](const PlacementResult& r) -> py::object {
+            return r.residual ? py::object(int64_array(*r.residual)) : py::object(py::none());
+          },
+          "if requested: the ledger's residual after the call (int64[E], EdgeId order), else None")
+      .def_property_readonly(
+          "edge_reservations",
+          [](const PlacementResult& r) -> py::object {
+            return r.edge_reservations ? py::object(int64_array(*r.edge_reservations)) : py::object(py::none());
+          },
+          "if requested: the policy's own strict holds per edge after the call (int64[E], EdgeId order; zeros\n"
+          "for a model without holds), else None")
+      .def_property_readonly(
+          "saturated_boundary_edges",
+          [](const PlacementResult& r) {
+            return py::reinterpret_steal<py::typing::Optional<py::typing::List<py::int_>>>(
+                r.saturated_boundary_edges ? ints_list(std::span<const EdgeId>(*r.saturated_boundary_edges)).release() : py::none().release());
+          },
+                    "if requested: the ledger's saturation report after the call\n"
+                    "(FlowLedger.saturated_boundary_edges of the "
+                    "policy's sources and Eligibility), else None")
+      .def_property_readonly(
+          "min_cut",
+          [](const PlacementResult& r) {
+            return py::reinterpret_steal<py::typing::Optional<py::typing::List<py::int_>>>(
+                r.min_cut ? ints_list(std::span<const EdgeId>(*r.min_cut)).release() : py::none().release());
+          },
+                    "if requested (OutputOptions(min_cut=True)), unrestricted CentralizedTE with the optimized source allocation, when the solve\n"
+                    "reached the maximum flow: the minimum cut closest to the sources, every allowed edge leaving\n"
+                    "the nodes the roster sources reach in the residual network (free capacity plus the policy's\n"
+                    "own allocation), an edge with nothing free (capacity 0, or held by others) included,\n"
+                    "ascending EdgeId; [] for an empty roster, place(0) excepted. None otherwise (another model,\n"
+                    "prescribed EQUAL or WEIGHTED sources, a support, a solve stopped below the maximum, place(0),\n"
+                    "a forward with a nonempty roster)")
+      .def("__repr__", [](const PlacementResult& r) {
+        return "PlacementResult(call_delivered=" + std::to_string(r.call_delivered) + ", termination=" +
+               termination_name(r.termination) + ")";
+      });
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/policy_value.hpp b/bindings/python/policy_value.hpp
new file mode 100644
index 0000000..6fe66e8
--- /dev/null
+++ b/bindings/python/policy_value.hpp
@@ -0,0 +1,23 @@
+// Reject an unconstructed Python policy before pybind11's ordinary value loader
+// can allocate raw storage for it. Explicit __new__/failed __init__ is legal Python.
+#pragma once
+#include <pybind11/pybind11.h>
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+
+namespace netgraph::core::bindings {
+inline FlowPolicy& policy_value(const pybind11::handle& self) {
+  const auto* type = pybind11::detail::get_type_info(typeid(FlowPolicy), true);
+  // isinstance can consult a forged __class__. Only the real extension type has
+  // the instance layout read below; never reinterpret an unrelated Python object.
+  if (PyObject_TypeCheck(self.ptr(), type->type) == 0) throw pybind11::type_error("policy must be a FlowPolicy");
+  auto* instance = reinterpret_cast<pybind11::detail::instance*>(self.ptr());
+  auto value = instance->get_value_and_holder(type);
+  if (!value.holder_constructed() || !value.instance_registered() || value.value_ptr() == nullptr) {
+    throw pybind11::type_error("FlowPolicy is not constructed");
+  }
+  auto& policy = *static_cast<FlowPolicy*>(value.value_ptr());
+  if (!detail::PolicyAccess::constructed(policy)) throw pybind11::type_error("FlowPolicy is not constructed");
+  return policy;
+}
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/predecessor_dag.cpp b/bindings/python/predecessor_dag.cpp
new file mode 100644
index 0000000..e2a1b57
--- /dev/null
+++ b/bindings/python/predecessor_dag.cpp
@@ -0,0 +1,130 @@
+// PredecessorDAG: the immutable predecessor DAG of one graph.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "integers.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// The exact order of wide integers: a positive overflow above every int64, a negative one
+// below, and two overflows on the same side by their exact values.
+bool wide_less(const CheckedIntegerVector& w, std::size_t i, std::size_t j) {
+  if (w.sign(i) != w.sign(j)) return w.sign(i) < w.sign(j);
+  if (w.sign(i) == 0) return w.value[i] < w.value[j];
+  const int less = PyObject_RichCompareBool(w.exact(i).ptr(), w.exact(j).ptr(), Py_LT);
+  if (less < 0) throw py::error_already_set();
+  return less == 1;
+}
+
+} // namespace
+
+void register_predecessor_dag(py::module_& m) {
+  py::class_<PredecessorDAG, std::shared_ptr<PredecessorDAG>>(
+      m, "PredecessorDAG",
+      "Immutable route structure of one graph, a predecessor DAG (directed, no cycle): for each node v,\n"
+      "the edges that reach v on the route and the node each comes from (its parent). The entries of v\n"
+      "are parents()[k], via_edges()[k] for k in [parent_offsets()[v], parent_offsets()[v + 1]), in\n"
+      "strictly ascending EdgeId, so two DAGs of the same graph with the same entries have equal arrays\n"
+      "and compare equal; DAGs of different graphs never compare equal.\n"
+      "parents() and via_edges() are read-only views that keep the DAG alive; parent_offsets() is a new\n"
+      "read-only array on each call (the DAG stores only the nodes that have entries). Built by\n"
+      "PredecessorDAG.from_csr, Path.to_dag(), the searches and the policies (FlowRecord.route).")
+      .def_static(
+          "from_csr",
+          [](const std::shared_ptr<Graph>& graph, const py::object& offsets, const py::object& parents,
+             const py::object& via) {
+            if (!graph) throw py::type_error("graph must be a Graph");
+            // Validate the unnarrowed shape and ranges, then the native structural
+            // rules below (endpoints, duplicates, acyclic, ascending), all before
+            // detaching. The builder consumes these checked native arrays.
+            const auto n = static_cast<std::size_t>(graph->num_nodes());
+            const auto edge_count = static_cast<std::int64_t>(graph->num_edges());
+            const std::size_t lo = sequence_length(offsets, "parent_offsets");
+            const std::size_t lp = sequence_length(parents, "parents");
+            const std::size_t lv = sequence_length(via, "via_edges");
+            if (lo != n + 1) {
+              throw py::value_error("PredecessorDAG.from_csr: parent_offsets has length " + std::to_string(lo) +
+                                    ", expected N + 1 = " + std::to_string(n + 1));
+            }
+            const auto o = wide_integers(offsets, "parent_offsets");
+            if (!o.in(0, 0, 0)) throw py::value_error("PredecessorDAG.from_csr: parent_offsets[0] = " + o.text(0) + ", expected 0");
+            for (std::size_t v = 0; v < n; ++v) {
+              if (wide_less(o, v + 1, v)) {
+                throw py::value_error("PredecessorDAG.from_csr: parent_offsets are not monotone at " + std::to_string(v + 1) + " (" +
+                                      o.text(v) + " > " + o.text(v + 1) + ")");
+              }
+            }
+            if (!o.in(n, static_cast<std::int64_t>(lp), static_cast<std::int64_t>(lp)) || lp != lv) {
+              throw py::value_error("PredecessorDAG.from_csr: parent_offsets[N] = " + o.text(n) + " but parents has " +
+                                    std::to_string(lp) + " and via_edges has " + std::to_string(lv) + " entries");
+            }
+            const auto p = wide_integers(parents, "parents");
+            const auto w = wide_integers(via, "via_edges");
+            for (std::size_t k = 0; k < lp; ++k) {
+              if (!p.in(k, 0, static_cast<std::int64_t>(n) - 1)) {
+                throw py::value_error("PredecessorDAG.from_csr: parents[" + std::to_string(k) + "] = " + p.text(k) +
+                                      " out of node range [0, " + std::to_string(n) + ")");
+              }
+              if (!w.in(k, 0, edge_count - 1)) {
+                throw py::value_error("PredecessorDAG.from_csr: via_edges[" + std::to_string(k) + "] = " + w.text(k) +
+                                      " out of edge range [0, " + std::to_string(edge_count) + ")");
+              }
+            }
+            const auto ov = o.narrow<std::int32_t>();
+            const auto pv = p.narrow<NodeId>();
+            const auto wv = w.narrow<EdgeId>();
+            detail::check_csr(*graph, ov, pv, wv);
+            return native_call([&] { return std::make_shared<PredecessorDAG>(detail::PredecessorDAGBuilder::of_csr(*graph, ov, pv, wv)); });
+          },
+          py::arg("graph"), py::arg("parent_offsets"), py::arg("parents"), py::arg("via_edges"),
+          "A wrong type raises TypeError; structural and range defects raise ValueError. Validates, in order,\n"
+          "before any traversal: parent_offsets of\n"
+          "length N + 1, parent_offsets[0] == 0, monotone, parent_offsets[N] == len(parents) ==\n"
+          "len(via_edges); then every parent and via edge in range, every via edge joining (parent, child),\n"
+          "no duplicate (child, via edge), acyclic; within a node the entries in ascending via EdgeId.")
+      .def("graph_uid", &PredecessorDAG::graph_uid, "uid of the graph this DAG belongs to")
+      .def(
+          "parent_offsets",
+          [](const PredecessorDAG& d) {
+            const auto off = d.parent_offsets();
+            py::array_t<std::int32_t> arr(static_cast<py::ssize_t>(off.size()));
+            std::copy(off.begin(), off.end(), arr.mutable_data());
+            py::detail::array_proxy(arr.ptr())->flags &= ~py::detail::npy_api::NPY_ARRAY_WRITEABLE_;
+            return arr;
+          },
+          "int32[N + 1]: the entries of node v are [parent_offsets[v], parent_offsets[v + 1]); a new read-only array per call")
+      .def(
+          "parents", [](const py::object& self) { return readonly_view(self.cast<const PredecessorDAG&>().parents(), self); },
+          "int32 parent NodeId per entry (read-only view)")
+      .def(
+          "via_edges",
+          [](const py::object& self) { return readonly_view(self.cast<const PredecessorDAG&>().via_edges(), self); },
+          "int32 via EdgeId per entry (read-only view)")
+      .def("__eq__", [](const PredecessorDAG& a, const py::object& b) {
+        return py::isinstance<PredecessorDAG>(b) && a == b.cast<const PredecessorDAG&>();
+      })
+      .def("__hash__", [](const PredecessorDAG& a) {
+        return hash_int(objects_tuple({int_object(a.graph_uid()), ints_tuple(a.via_edges())}));
+      })
+      .def("__repr__", [](const PredecessorDAG& a) {
+        return "PredecessorDAG(graph_uid=" + std::to_string(a.graph_uid()) + ", entries=" +
+               std::to_string(a.via_edges().size()) + ")";
+      });
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/publication.hpp b/bindings/python/publication.hpp
new file mode 100644
index 0000000..f00b209
--- /dev/null
+++ b/bindings/python/publication.hpp
@@ -0,0 +1,218 @@
+/*
+  The checked construction of result objects: the Python object of a bound class is allocated
+  through a checked tp_alloc, so an allocation failure raises instead of crashing, and a policy
+  call makes its result object before it changes anything.
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+#include <pybind11/typing.h>
+
+#include <memory>
+#include <optional>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_policy.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+// A new Python object of the bound class T owning a T made from `args`, made like pybind11's
+// generic move-cast (type_caster_generic::cast) but with the object allocation checked:
+// pybind11's make_new_instance uses the result of tp_alloc unchecked, so a failed Python
+// allocation there is a crash rather than a MemoryError. Holder is the class's holder type
+// (std::unique_ptr<T> by default, std::shared_ptr<T> for PredecessorDAG and Path); another type is
+// refused before anything is made.
+// The steps, in order (new_object and object_from both use them): (1) allocate the object and
+// check for null; (2) hold it in `obj` at once, so any later failure releases it; (3) allocate
+// its layout; (4) make the value inside a local holder; (5) register the value and let the
+// object take the holder; (6) mark the object as owner. Every failure raises and frees what was
+// made exactly once. Until step 5 succeeds the object owns nothing: the local holder frees the
+// value (std::shared_ptr also deletes it when its control block cannot be allocated), and the
+// object is released without touching it. Taking the holder never allocates (pybind11 copies or
+// moves it).
+template <class T, class Holder, class... Args>
+std::pair<py::object, T*> emplace_object(Args&&... args) {
+  static_assert(std::is_same_v<Holder, std::unique_ptr<T>> || std::is_same_v<Holder, std::shared_ptr<T>>);
+  const py::detail::type_info* tinfo = py::detail::get_type_info(typeid(T), /*throw_if_missing=*/true);
+  constexpr auto holder_kind = std::is_same_v<Holder, std::shared_ptr<T>> ? py::detail::holder_enum_t::std_shared_ptr
+                                                                          : py::detail::holder_enum_t::std_unique_ptr;
+  if (tinfo->holder_enum_v != holder_kind) {
+    py::pybind11_fail("emplace_object: Holder is not the holder of the bound class");
+  }
+  PyTypeObject* type = tinfo->type;
+  PyObject* raw = type->tp_alloc(type, 0);
+  if (raw == nullptr) throw py::error_already_set();
+  auto obj = py::reinterpret_steal<py::object>(raw);
+  auto* inst = reinterpret_cast<py::detail::instance*>(raw);
+  inst->allocate_layout();
+  inst->owned = false;
+  Holder holder(new T(std::forward<Args>(args)...));
+  T* value = holder.get();
+  py::detail::values_and_holders(inst).begin()->value_ptr() = value;
+  tinfo->init_instance(inst, &holder);
+  inst->owned = true;
+  return {std::move(obj), value};
+}
+
+// A new Python object of the bound class T (default holder) owning a default-constructed T
+// (emplace_object). The policy calls make their result object with this before they change
+// anything.
+template <class T>
+std::pair<py::object, T*> new_object() {
+  return emplace_object<T, std::unique_ptr<T>>();
+}
+
+// The value moved into its result object after the commit: nothing may allocate there.
+static_assert(std::is_nothrow_move_assignable_v<PlacementResult>);
+static_assert(std::is_nothrow_move_assignable_v<SensitivityResult>);
+static_assert(std::is_nothrow_move_assignable_v<py::object>);
+
+template <class T>
+py::object object_of(T value) {
+  return emplace_object<T, std::unique_ptr<T>>(std::move(value)).first;
+}
+
+// A tuple of new Python objects of the bound class T, one per row (object_of each): a failed
+// allocation raises and releases what was made (pybind11's cast of a vector of bound values
+// allocates each object unchecked).
+template <class T>
+py::tuple tuple_of(const std::vector<T>& rows) {
+  PyObject* raw = PyTuple_New(static_cast<Py_ssize_t>(rows.size()));
+  if (raw == nullptr) throw py::error_already_set();
+  auto out = py::reinterpret_steal<py::tuple>(raw);
+  for (std::size_t i = 0; i < rows.size(); ++i) {
+    PyTuple_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), object_of<T>(rows[i]).release().ptr());
+  }
+  return out;
+}
+
+// A new Python object of the bound class T (held by std::shared_ptr) owning `value`, through the
+// same checked allocation as new_object: for the values without a default constructor (PredecessorDAG,
+// Path) that a search returns. A failure raises and releases everything made so far.
+template <class T>
+py::object object_from(T value) {
+  return emplace_object<T, std::shared_ptr<T>>(std::move(value)).first;
+}
+
+// The Python object of a shared value of the bound class T (held by std::shared_ptr): None for a
+// null pointer; the object already registered for it, if any (as pybind11's cast); else a new
+// object made by emplace_object's steps with `holder` in place of a new value. pybind11's own
+// cast of an existing holder marks the object as owner before it registers the value, so a
+// failed registration deletes the value while the holder still owns it (a double free); here
+// the object owns nothing until it holds its copy of the holder (a copy never allocates).
+template <class T>
+py::object shared_object(std::shared_ptr<T> holder) {
+  if (!holder) return py::none();
+  const py::detail::type_info* tinfo = py::detail::get_type_info(typeid(T), /*throw_if_missing=*/true);
+  if (tinfo->holder_enum_v != py::detail::holder_enum_t::std_shared_ptr) {
+    py::pybind11_fail("shared_object: the bound class is not held by std::shared_ptr");
+  }
+  if (py::handle existing = py::detail::find_registered_python_instance(holder.get(), tinfo)) {
+    return py::reinterpret_steal<py::object>(existing);
+  }
+  PyTypeObject* type = tinfo->type;
+  PyObject* raw = type->tp_alloc(type, 0);
+  if (raw == nullptr) throw py::error_already_set();
+  auto obj = py::reinterpret_steal<py::object>(raw);
+  auto* inst = reinterpret_cast<py::detail::instance*>(raw);
+  inst->allocate_layout();
+  inst->owned = false;
+  py::detail::values_and_holders(inst).begin()->value_ptr() = holder.get();
+  tinfo->init_instance(inst, &holder);
+  inst->owned = true;
+  return obj;
+}
+
+template <class T>
+py::object shared_object(std::shared_ptr<const T> holder) {
+  return shared_object(std::const_pointer_cast<T>(std::move(holder)));
+}
+
+// A py::object known to be a T, for signatures: pybind11 names it as T (the specialization of
+// handle_type_name below), so a binding that returns shared_object's result keeps its type.
+template <class T>
+class TypedPythonObject : public py::object {
+public:
+  TypedPythonObject() = default;
+  TypedPythonObject(py::handle h, py::object::stolen_t) : py::object(h, py::object::stolen_t {}) {}
+  TypedPythonObject(py::handle h, py::object::borrowed_t) : py::object(h, py::object::borrowed_t {}) {}
+  static bool check_(py::handle h) { return py::isinstance<T>(h); }
+};
+
+// object_of(value) as a T; a list of object_of each row (as tuple_of); object_of of a present
+// value or None. pybind11's cast of a bound value, a vector or an optional of them allocates the
+// object unchecked.
+template <class T>
+TypedPythonObject<T> typed_object(T value) {
+  return py::reinterpret_steal<TypedPythonObject<T>>(object_of<T>(std::move(value)).release());
+}
+template <class T>
+py::typing::List<T> list_of(const std::vector<T>& rows) {
+  PyObject* raw = PyList_New(static_cast<Py_ssize_t>(rows.size()));
+  if (raw == nullptr) throw py::error_already_set();
+  auto out = py::reinterpret_steal<py::typing::List<T>>(raw);
+  for (std::size_t i = 0; i < rows.size(); ++i) {
+    PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), object_of<T>(rows[i]).release().ptr());
+  }
+  return out;
+}
+template <class T>
+py::typing::Optional<T> optional_of(const std::optional<T>& value) {
+  return py::reinterpret_steal<py::typing::Optional<T>>(value.has_value() ? object_of<T>(*value).release()
+                                                                          : py::none().release());
+}
+
+// The repr of a bound value through its class's own __repr__. PyObject_Repr (py::repr) on Python
+// 3.13 and older returns the default repr when the lookup of the method fails to allocate.
+inline std::string own_repr(const py::handle& value) {
+  return std::string(py::str(py::type::of(value).attr("__repr__")(value)));
+}
+
+// shared_object(holder) as a T (holder not null) or as T | None.
+template <class T>
+TypedPythonObject<std::remove_const_t<T>> typed_shared(std::shared_ptr<T> holder) {
+  return py::reinterpret_steal<TypedPythonObject<std::remove_const_t<T>>>(shared_object(std::move(holder)).release());
+}
+template <class T>
+py::typing::Optional<std::remove_const_t<T>> optional_shared(std::shared_ptr<T> holder) {
+  return py::reinterpret_steal<py::typing::Optional<std::remove_const_t<T>>>(shared_object(std::move(holder)).release());
+}
+
+// The getters of read-only fields whose values are Python objects of bound classes or
+// enumerations: def_readonly casts them through pybind11's unchecked allocation (a failed Python
+// allocation is a crash); these make them through the checked one above. A field of a bound value
+// or enumeration, an optional one, a shared one (its registered object, or None) and a vector of
+// bound values (a list).
+template <class C, class D>
+auto field_object(D C::*member) {
+  return [member](const C& c) { return typed_object(c.*member); };
+}
+template <class C, class D>
+auto optional_field(std::optional<D> C::*member) {
+  return [member](const C& c) { return optional_of(c.*member); };
+}
+template <class C, class D>
+auto shared_field(std::shared_ptr<D> C::*member) {
+  return [member](const C& c) { return optional_shared(c.*member); };
+}
+template <class C, class D>
+auto list_field(std::vector<D> C::*member) {
+  return [member](const C& c) { return list_of(c.*member); };
+}
+
+} // namespace netgraph::core::bindings
+
+namespace pybind11::detail {
+template <class T>
+struct handle_type_name<netgraph::core::bindings::TypedPythonObject<T>> {
+  static constexpr auto name = make_caster<T>::name;
+};
+} // namespace pybind11::detail
diff --git a/bindings/python/registration.hpp b/bindings/python/registration.hpp
new file mode 100644
index 0000000..f479c9a
--- /dev/null
+++ b/bindings/python/registration.hpp
@@ -0,0 +1,43 @@
+/*
+  The registration functions of the module _netgraph_core, one file each under bindings/python/.
+  The module entry (module.cpp) calls them in this order, which is the order of the module's
+  attributes: a default argument or a conversion of a later binding needs the types registered
+  before it. The private recorder entry (_solve_min_cost_flow) is registered
+  in both builds; only register_private_hooks and the private members of FlowLedger and
+  FlowPolicy depend on NETGRAPH_CORE_PRIVATE_HOOKS.
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+
+namespace netgraph::core::bindings {
+
+void register_options(pybind11::module_& m);              // the axes' enumerations
+void register_units(pybind11::module_& m);             // to_units, as_float
+void register_eligibility(pybind11::module_& m);       // Eligibility
+void register_graph(pybind11::module_& m);             // Graph
+void register_flow_solver_hook(pybind11::module_& m);          // _solve_min_cost_flow (both builds)
+void register_predecessor_dag(pybind11::module_& m);          // PredecessorDAG
+void register_path(pybind11::module_& m);              // Path
+void register_flow_record(pybind11::module_& m);       // FlowRecord
+void register_flow_ledger(pybind11::module_& m);       // FlowLedger
+void register_program(pybind11::module_& m);           // TunnelStatus, Tunnel, RouteDefinition, ForwardingProgram
+void register_routing(pybind11::module_& m);           // AbsoluteCost, CostStretch, TunnelCount, the four routings
+void register_policy_config(pybind11::module_& m);     // FlowPolicyConfig, OutputOptions
+void register_placement_result(pybind11::module_& m);  // Termination, SourceFlow, TunnelFlow, PlacementResult
+void register_shortest_path_cache(pybind11::module_& m);         // ShortestPathCacheStats, ShortestPathCacheMiss, ShortestPathCache
+void register_flow_policy(pybind11::module_& m);       // FlowPolicy
+void register_apply_actions(pybind11::module_& m);     // BatchMode, Place, Replace, Forward, apply_actions
+void register_evaluators(pybind11::module_& m);        // evaluate_demand, evaluate_pairs, evaluate_edge_failures and their types
+void register_paths(pybind11::module_& m);             // KspOptions, ksp, resolve_to_paths
+void register_search(pybind11::module_& m);            // UNREACHABLE, SpfOptions, SpfResult, spf
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+void register_concurrency_hooks(pybind11::module_& m);
+void register_private_hooks(pybind11::module_& m);     // the test controls and diagnostics
+#endif
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/routing_models.cpp b/bindings/python/routing_models.cpp
new file mode 100644
index 0000000..aa1eabe
--- /dev/null
+++ b/bindings/python/routing_models.cpp
@@ -0,0 +1,432 @@
+// The routing modes of a policy (ShortestPaths, DistributedTE, CentralizedTE, Pinned) and their parameters:
+// the cost ceilings AbsoluteCost and CostStretch, the tunnel count TunnelCount, CentralizedTE's support and Pinned's
+// program and black holes.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <string>
+#include <variant>
+
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "integers.hpp"
+#include "strict_bool.hpp"
+#include "publication.hpp"
+#include "registration.hpp"
+#include "values.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// A RouteTieBreak as its repr spells it, without a Python object (a repr must not fail on its own
+// allocations of an enum object).
+const char* tie_break_repr(RouteTieBreak t) {
+  switch (t) {
+    case RouteTieBreak::FewerHops: return "RouteTieBreak.FEWER_HOPS";
+    case RouteTieBreak::HigherCapacity: return "RouteTieBreak.HIGHER_CAPACITY";
+    case RouteTieBreak::HigherAvailableCapacity: return "RouteTieBreak.HIGHER_AVAILABLE_CAPACITY";
+    case RouteTieBreak::HigherHeadroom: return "RouteTieBreak.HIGHER_HEADROOM";
+  }
+  return "RouteTieBreak(?)";
+}
+
+// The other enumerations of the models as their reprs spell them (C++ tables, as tie_break_repr).
+const char* allocation_repr(RouteAllocation a) {
+  switch (a) {
+    case RouteAllocation::Equal: return "RouteAllocation.EQUAL";
+    case RouteAllocation::Weighted: return "RouteAllocation.WEIGHTED";
+    case RouteAllocation::Optimized: return "RouteAllocation.OPTIMIZED";
+  }
+  return "RouteAllocation(?)";
+}
+const char* source_allocation_repr(SourceAllocation a) {
+  switch (a) {
+    case SourceAllocation::Equal: return "SourceAllocation.EQUAL";
+    case SourceAllocation::Optimized: return "SourceAllocation.OPTIMIZED";
+    case SourceAllocation::Weighted: return "SourceAllocation.WEIGHTED";
+  }
+  return "SourceAllocation(?)";
+}
+const char* weight_basis_repr(WeightBasis b) {
+  switch (b) {
+    case WeightBasis::Capacity: return "WeightBasis.CAPACITY";
+    case WeightBasis::Explicit: return "WeightBasis.EXPLICIT";
+    case WeightBasis::ResidualSnapshot: return "WeightBasis.RESIDUAL_SNAPSHOT";
+  }
+  return "WeightBasis(?)";
+}
+
+// Explicit edge or source weights, converted once and shared by policies built from the model.
+// Scan all shape defects, then integer types, then int64 storage overflow (ValueError).
+// The policy checks graph-sized length and the range [0, 2^62); only the diagnostic name differs.
+std::shared_ptr<const std::vector<Amount>> weights_of(const py::object& weights, const char* name) {
+  if (weights.is_none()) return {};
+  (void)sequence_length(weights, name);
+  const auto w = wide_integers(weights, name);
+  for (std::size_t e = 0; e < w.size(); ++e) {
+    if (w.sign(e) != 0) throw py::value_error(std::string(name) + "[" + std::to_string(e) + "] must be an integer in [0, 2^62)");
+  }
+  return std::make_shared<const std::vector<Amount>>(w.narrow<Amount>());
+}
+
+// A CostStretch factor as its one exact fraction, converted in this order: a bool (Python or
+// numpy.bool_) raises TypeError; a fractions.Fraction is taken as it is; a Python float or a NumPy
+// floating value is Fraction(str(f)), the shortest decimal its own type prints (a NaN or an infinity
+// raises ValueError); an integer (an object with __index__) is n/1; anything else raises TypeError.
+// Then the reduced components: a numerator in [-2^63, 2^63), a denominator in [1, 2^63).
+CostStretch cost_stretch_of(const py::object& factor) {
+  const auto type_error = [&] {
+    return py::type_error("CostStretch factor must be a Fraction, a float or an integer (got " +
+                          std::string(py::str(py::type::of(factor).attr("__name__"))) + ")");
+  };
+  if (is_bool(factor)) throw type_error();
+  const py::object fraction_type = py::module_::import("fractions").attr("Fraction");
+  py::object fraction;
+  if (py::isinstance(factor, fraction_type)) {
+    fraction = factor;
+  } else if (PyFloat_Check(factor.ptr()) || has_type(factor.ptr(), numpy_number_types().second)) {
+    const double x = PyFloat_AsDouble(factor.ptr());
+    if (x == -1.0 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+    if (!std::isfinite(x)) throw py::value_error("CostStretch factor must be finite (got " + std::string(py::str(factor)) + ")");
+    fraction = fraction_type(py::str(factor));
+  } else if (PyIndex_Check(factor.ptr())) {
+    const auto n = py::reinterpret_steal<py::object>(PyNumber_Index(factor.ptr()));
+    if (!n) throw py::error_already_set();
+    fraction = fraction_type(n);
+  } else {
+    throw type_error();
+  }
+  const auto component = [&](const char* name, std::int64_t lo, const char* text) {
+    const py::object v = fraction.attr(name);
+    int overflow = 0;
+    const long long x = PyLong_AsLongLongAndOverflow(v.ptr(), &overflow);
+    if (x == -1 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+    if (overflow != 0 || x < lo) throw py::value_error(text);
+    return static_cast<std::int64_t>(x);
+  };
+  const auto n = component("numerator", std::numeric_limits<std::int64_t>::min(),
+                           "CostStretch fraction numerator must be in [-2^63, 2^63)");
+  const auto d = component("denominator", 1, "CostStretch fraction denominator must be in [1, 2^63)");
+  return CostStretch(n, d);
+}
+
+} // namespace
+
+void register_routing(py::module_& m) {
+  py::class_<AbsoluteCost>(m, "AbsoluteCost", "Cost ceiling: an absolute, inclusive path-cost budget (cost >= 0).")
+      .def(py::init([](const py::object& cost) {
+             return AbsoluteCost {integer_value(cost, std::numeric_limits<Cost>::min(), std::numeric_limits<Cost>::max(),
+                                             "AbsoluteCost cost")};
+           }),
+           py::arg("cost"), "AbsoluteCost(cost): a 64-bit integer budget in cost units (checked >= 0 where it is used)")
+      .def_property_readonly("cost", int_reader(&AbsoluteCost::cost), "the budget: a path qualifies when its cost is at most this")
+      .def("__eq__", [](const AbsoluteCost& a, const py::object& b) { return py::isinstance<AbsoluteCost>(b) && a == b.cast<AbsoluteCost>(); })
+      .def("__hash__", [](const AbsoluteCost& a) { return hash_int(objects_tuple({str_object("AbsoluteCost"), int_object(a.cost)})); })
+      .def("__repr__", [](const AbsoluteCost& a) { return "AbsoluteCost(" + std::to_string(a.cost) + ")"; });
+
+  py::class_<CostStretch>(m, "CostStretch",
+                      "Cost ceiling: a path qualifies when cost * d <= n * base, exactly, where n/d is the factor as\n"
+                      "one reduced fraction and base the static shortest cost under the Eligibility (T1: the smallest\n"
+                      "over all roster heads).")
+      .def(py::init([](const py::object& factor) { return cost_stretch_of(factor); }), py::arg("factor"),
+           "CostStretch(factor): in this order, a bool (or numpy.bool_) raises TypeError; a fractions.Fraction\n"
+           "is taken as it is; a Python float or any NumPy floating value is Fraction(str(f)), the shortest\n"
+           "decimal its own type prints (1.2, np.float64(1.2) and np.float32(1.2) are all 6/5), and a NaN or\n"
+           "an infinity raises ValueError; an integer, NumPy integer or any __index__ object is n/1 exactly;\n"
+           "anything else raises TypeError. Then a reduced numerator outside [-2^63, 2^63) or denominator\n"
+           "outside [1, 2^63) raises ValueError. A factor below 1 is valid here and refused where the\n"
+           "ceiling is used.")
+      .def_property_readonly(
+          "factor",
+          [](const CostStretch& a) {
+            return fraction_object(py::module_::import("fractions").attr("Fraction"), a.numerator(), a.denominator());
+          },
+          "the factor as a fractions.Fraction (built on each access)")
+      .def("__eq__", [](const CostStretch& a, const py::object& b) { return py::isinstance<CostStretch>(b) && a == b.cast<CostStretch>(); })
+      .def("__hash__",
+           [](const CostStretch& a) {
+             return hash_int(fraction_object(py::module_::import("fractions").attr("Fraction"), a.numerator(), a.denominator()));
+           })
+      .def("__repr__", [](const CostStretch& a) {
+        return "CostStretch(Fraction(" + std::to_string(a.numerator()) + ", " + std::to_string(a.denominator()) + "))";
+      });
+
+  py::class_<TunnelCount>(m, "TunnelCount",
+                      "The tunnel count of T1 (DistributedTE) and T2, per head: per_head in [1, 10000] (checked when a\n"
+                      "policy or an evaluator uses it). up_to=True (T2 only; T1 rejects it): one common count k in\n"
+                      "1..per_head for every head: the smallest common count whose program carries the live heads'\n"
+                      "design shares; if none does, the largest live-share score, then the smallest count. It does not\n"
+                      "promise whole-demand lossless delivery.")
+      .def(py::init([](const py::object& count, StrictBool up_to) {
+             return TunnelCount {integer_value(count, std::numeric_limits<std::int64_t>::min(),
+                                            std::numeric_limits<std::int64_t>::max(), "TunnelCount per_head"),
+                             up_to};
+           }),
+           py::arg("per_head"), py::kw_only(), py::arg("up_to") = StrictBool {false},
+           "TunnelCount(per_head, *, up_to=False): a 64-bit integer per_head (a bool, a float or None raises\n"
+           "TypeError and an integer outside 64 bits ValueError here; [1, 10000] is checked where it is\n"
+           "used) and a bool")
+      .def_property_readonly("per_head", int_reader(&TunnelCount::per_head), "the tunnels per head (the largest count for up_to)")
+      .def_readonly("up_to", &TunnelCount::up_to, "True: the smallest count up to per_head whose program carries the live heads' design shares (else the\n"
+                    "best live-share score, then the smallest); T2 only")
+      .def("__eq__", [](const TunnelCount& a, const py::object& b) { return py::isinstance<TunnelCount>(b) && a == b.cast<TunnelCount>(); })
+      .def("__hash__", [](const TunnelCount& a) {
+        return hash_int(objects_tuple({str_object("TunnelCount"), int_object(a.per_head), py::bool_(a.up_to)}));
+      })
+      .def("__repr__", [](const TunnelCount& a) {
+        return "TunnelCount(" + std::to_string(a.per_head) + (a.up_to ? ", up_to=True)" : ")");
+      });
+
+  py::class_<ShortestPaths>(m, "ShortestPaths",
+                       "Routing like IGP forwarding (OSPF, IS-IS routers) on each roster source's static shortest-path\n"
+                       "DAG (read from the ShortestPathCache; the route choice is applied when the program is prepared:\n"
+                       "a positive place of an epoch without one, or any replace or evaluate), fixed for the epoch;\n"
+                       "one record per roster source. EQUAL (ECMP, the default) and WEIGHTED\n"
+                       "(WCMP) pool the sources (source allocation EQUAL): where their routes meet, a router splits\n"
+                       "their traffic once. OPTIMIZED is a controller on the union of those routes (source allocation\n"
+                       "OPTIMIZED by default, or EQUAL). An edge of capacity 0 stays in the DAG: EQUAL still sends it\n"
+                       "its share, which it cannot carry, and WEIGHTED gives it weight 0.")
+      .def(py::init([](RouteAllocation allocation, std::optional<SourceAllocation> source_allocation,
+                       std::optional<WeightBasis> weight_basis, const py::object& edge_weights, RouteTieBreak tie_break,
+                       StrictBool multipath, StrictBool parallel_edges) {
+             ShortestPaths sp;
+             sp.allocation = allocation;
+             sp.source_allocation = source_allocation;
+             sp.weight_basis = weight_basis;
+             sp.edge_weights = weights_of(edge_weights, "edge_weights");
+             sp.tie_break = tie_break;
+             sp.multipath = multipath;
+             sp.parallel_edges = parallel_edges;
+             return sp;
+           }),
+           py::kw_only(), py::arg_v("allocation", RouteAllocation::Equal, "RouteAllocation.EQUAL"),
+           py::arg("source_allocation") = py::none(), py::arg("weight_basis") = py::none(),
+           py::arg("edge_weights") = py::none(), py::arg_v("tie_break", RouteTieBreak::FewerHops, "RouteTieBreak.FEWER_HOPS"),
+           py::arg("multipath") = StrictBool {true}, py::arg("parallel_edges") = StrictBool {true},
+           "ShortestPaths(*, allocation=EQUAL, source_allocation=None, weight_basis=None, edge_weights=None,\n"
+           "tie_break=FEWER_HOPS, multipath=True, parallel_edges=True): ShortestPaths() is ECMP.\n"
+           "source_allocation None resolves to EQUAL for EQUAL and WEIGHTED (the only allowed value) and to\n"
+           "OPTIMIZED for OPTIMIZED; weight_basis (WEIGHTED only; None: CAPACITY) and edge_weights (one\n"
+           "integer per edge, given exactly when weight_basis=EXPLICIT; one array shared by every policy\n"
+           "built from this model). The combination is checked when a policy or an evaluator uses the model\n"
+           "(ValueError, in the order of the model matrix). Here, a value of the wrong type (a multipath or parallel_edges that\n"
+           "is not a bool, an enumeration of another class, an edge_weights that is not a 1-D sequence of\n"
+           "integers or has a bool or a float entry) raises TypeError, and an edge_weights entry beyond\n"
+           "int64 ValueError.")
+      .def_property_readonly("allocation", field_object(&ShortestPaths::allocation), "the RouteAllocation: EQUAL, WEIGHTED or OPTIMIZED")
+      .def_property_readonly("source_allocation", optional_field(&ShortestPaths::source_allocation),
+                    "the SourceAllocation, or None (a policy's config: resolved to the allocation's default)")
+      .def_property_readonly("weight_basis", optional_field(&ShortestPaths::weight_basis),
+                    "the WeightBasis, or None (a policy's config: CAPACITY resolved for WEIGHTED)")
+      .def_property_readonly(
+          "edge_weights",
+          [](const ShortestPaths& sp) -> py::object {
+            if (!sp.edge_weights) return py::none();
+            return amounts_tuple(*sp.edge_weights);
+          },
+          "the explicit weights (one int per edge, a tuple), or None")
+      .def_property_readonly("tie_break", field_object(&ShortestPaths::tie_break), "the RouteTieBreak of equal-cost choices")
+      .def_readonly("multipath", &ShortestPaths::multipath,
+                    "True: every equal-cost route; False: one canonical path per roster source toward the destination set")
+      .def_readonly("parallel_edges", &ShortestPaths::parallel_edges,
+                    "True: every eligible parallel edge; False: one per (u, v) pair by the tie rule")
+      .def("__repr__", [](const ShortestPaths& sp) {
+        return "ShortestPaths(allocation=" + std::string(allocation_repr(sp.allocation)) + ", source_allocation=" +
+               (sp.source_allocation ? source_allocation_repr(*sp.source_allocation) : "None") +
+               ", weight_basis=" + (sp.weight_basis ? weight_basis_repr(*sp.weight_basis) : "None") +
+               ", edge_weights=" + (sp.edge_weights ? "(...)" : "None") +
+               ", tie_break=" + tie_break_repr(sp.tie_break) + ", multipath=" + (sp.multipath ? "True" : "False") +
+               ", parallel_edges=" + (sp.parallel_edges ? "True" : "False") + ")";
+      });
+
+  py::class_<DistributedTE>(
+      m, "DistributedTE",
+      "T1: every head sets up its own strict tunnels by CSPF, no controller (like RSVP-TE head ends).\n"
+      "The design volume D is split equally over the roster heads and each head's share equally over its\n"
+      "tunnel_count.per_head tunnels; in round order (round j, heads ascending: entry_id j*H + i) each tunnel\n"
+      "keeps the allowed links whose unreserved capacity (the ledger's, minus the holds of every other\n"
+      "owner and of this setup's earlier tunnels) is at least max(request, min_unreserved_bandwidth) (a\n"
+      "request of 0 with a minimum of 0 has no filter) and takes the shortest path in the tie_break's\n"
+      "single-path order; it comes up holding exactly its request on every link (UP), or stays down\n"
+      "holding nothing: INSUFFICIENT_BANDWIDTH (no path passes the filter) or COST_CEILING_EXCEEDED (the cheapest exceeds\n"
+      "cost_ceiling: AbsoluteCost is inclusive; CostStretch(f) is f times the smallest static shortest cost over\n"
+      "all roster heads). Traffic enters equally at the heads and splits equally over each head's up\n"
+      "tunnels; a head with no tunnel up loses its share. Holds never police traffic.")
+      .def(py::init([](const TunnelCount& tunnels, const py::object& cost_ceiling, const py::object& min_unreserved,
+                       RouteTieBreak tie_break, StrictBool parallel_edges) {
+             DistributedTE ca;
+             ca.tunnel_count = tunnels;
+             ca.tie_break = tie_break;
+             ca.parallel_edges = parallel_edges;
+             ca.cost_ceiling = cost_ceiling_of(cost_ceiling);
+             ca.min_unreserved_bandwidth = integer_value(min_unreserved, std::numeric_limits<Amount>::min(),
+                                                          std::numeric_limits<Amount>::max(), "min_unreserved_bandwidth");
+             return ca;
+           }),
+           py::arg("tunnel_count"), py::kw_only(), py::arg("cost_ceiling") = py::none(),
+           py::arg("min_unreserved_bandwidth") = 0,
+           py::arg_v("tie_break", RouteTieBreak::FewerHops, "RouteTieBreak.FEWER_HOPS"),
+           py::arg("parallel_edges") = StrictBool {true},
+           "DistributedTE(tunnel_count, *, cost_ceiling=None, min_unreserved_bandwidth=0, tie_break=FEWER_HOPS,\n"
+           "parallel_edges=True): the fields are checked when a policy is built with them (the count in\n"
+           "[1, 10000] and exact, the ceiling, min_unreserved_bandwidth in [0, 2^62) units). tie_break and\n"
+           "parallel_edges are the CSPF choice, scored on unreserved bandwidth. Here, a\n"
+           "min_unreserved_bandwidth outside 64 bits raises ValueError; one of the wrong type, a tunnel_count\n"
+           "that is not a TunnelCount, a ceiling of the wrong class, a parallel_edges that is not a bool and an\n"
+           "unknown keyword raise TypeError.")
+      .def_property_readonly(
+          "tunnel_count", [](const DistributedTE& ca) { return typed_object(ca.tunnel_count); },
+          "the tunnel count per head (a TunnelCount)")
+      .def_property_readonly(
+          "cost_ceiling",
+          [](const DistributedTE& ca) -> py::object {
+            if (!ca.cost_ceiling.has_value()) return py::none();
+            return std::visit([](const auto& x) { return object_of(x); }, *ca.cost_ceiling);
+          },
+          "the inclusive route cost ceiling (AbsoluteCost or CostStretch); None: no ceiling")
+      .def_property_readonly("min_unreserved_bandwidth", int_reader(&DistributedTE::min_unreserved_bandwidth),
+                    "units in [0, 2^62): a search minimum only (each attempt keeps the links with at least\n"
+                    "max(request, this) unreserved units), never a reservation")
+      .def_property_readonly("tie_break", field_object(&DistributedTE::tie_break), "the RouteTieBreak of the CSPF choice")
+      .def_readonly("parallel_edges", &DistributedTE::parallel_edges,
+                    "True: every eligible parallel edge; False: one per (u, v) pair by the tie rule")
+      .def("__repr__", [](const DistributedTE& ca) {
+        std::string ceiling = "None";
+        if (ca.cost_ceiling.has_value()) {
+          ceiling = std::visit([](const auto& x) { return own_repr(typed_object(x)); }, *ca.cost_ceiling);
+        }
+        return "DistributedTE(TunnelCount(" + std::to_string(ca.tunnel_count.per_head) + (ca.tunnel_count.up_to ? ", up_to=True)" : ")") +
+               ", cost_ceiling=" + ceiling + ", min_unreserved_bandwidth=" + std::to_string(ca.min_unreserved_bandwidth) +
+               ", tie_break=" + std::string(tie_break_repr(ca.tie_break)) +
+               ", parallel_edges=" + (ca.parallel_edges ? "True" : "False") + ")";
+      });
+
+  py::class_<CentralizedTE>(m, "CentralizedTE",
+                     "Routing: an ideal central controller that sees the whole network, or only a support DAG. It takes\n"
+                     "no route choice, and its source_allocation is required.\n"
+                     "Without tunnel_count: a positive place re-solves the minimum-cost flow of what the policy\n"
+                     "already delivers plus this call's request (delivered() + offer; what an earlier call could not\n"
+                     "place is not requested again); evaluate and replace solve their whole offer afresh, and forward\n"
+                     "sends its offer over the installed paths without a solve. A solve runs over the eligible graph,\n"
+                     "or exactly over `support` (a\n"
+                     "PredecessorDAG of the policy's graph, trimmed to the walks from the sources to the allowed\n"
+                     "destinations under the Eligibility; every other edge carries nothing), on the free capacity\n"
+                     "plus its own allocation: it may move its own traffic, never another's. OPTIMIZED: the controller\n"
+                     "chooses how much enters at each source. EQUAL: every roster source sends its round-robin share\n"
+                     "of the largest total whose shares all fit. WEIGHTED: highest-averages shares of the declared\n"
+                     "source_weights; zero weights receive nothing, and all-zero roster weights end NO_ACTIVE_WEIGHT\n"
+                     "on a positive live call. The program is the solve cut into paths per source, each a tunnel\n"
+                     "weighted by its amount; it keeps the declared weights for weighted sources and the solved\n"
+                     "supplies for optimized ones. A positive call on a network beyond the flow core's int32\n"
+                     "numbering raises ValueError (see FlowPolicy.place).\n"
+                     "With tunnel_count=TunnelCount(N) (T2; with support, every step uses only the support's edges\n"
+                     "allowed by the policy's mask): a controller (like a PCE) lays out, for every live head (one\n"
+                     "reaching a destination over links with free capacity >= 1; the other heads are dead and lose\n"
+                     "their share), N single-path tunnels with one common whole-unit planned bandwidth: first as\n"
+                     "large as possible (U), then for a finite design no larger than needed (u), then the cheapest\n"
+                     "routes, then with prefer_headroom=True the routes that leave the most spare capacity, then one\n"
+                     "fixed unit-by-unit tie. TunnelCount(L, up_to=True): the smallest common count k <= L whose\n"
+                     "program carries the live heads' design shares (else the largest live-share score, then the\n"
+                     "smallest count); no promise of whole-demand lossless delivery. Traffic splits equally over the\n"
+                     "heads and over each head's tunnels; planned bandwidth is never held.")
+      .def(py::init([](SourceAllocation source_allocation, const py::object& source_weights, const py::object& support, const py::object& tunnels,
+                       StrictBool prefer_headroom) {
+             CentralizedTE gl(source_allocation);
+             gl.source_weights = weights_of(source_weights, "source_weights");
+             gl.prefer_headroom = prefer_headroom;
+             if (!support.is_none()) {
+               if (!py::isinstance<PredecessorDAG>(support)) throw py::type_error("CentralizedTE support must be a PredecessorDAG or None");
+               gl.support = support.cast<std::shared_ptr<PredecessorDAG>>();
+             }
+             if (!tunnels.is_none()) {
+               if (!py::isinstance<TunnelCount>(tunnels)) throw py::type_error("CentralizedTE tunnel_count must be a TunnelCount or None");
+               gl.tunnel_count = tunnels.cast<TunnelCount>();
+             }
+             return gl;
+           }),
+           py::kw_only(), py::arg("source_allocation"), py::arg("source_weights") = py::none(), py::arg("support") = py::none(),
+           py::arg("tunnel_count") = py::none(), py::arg("prefer_headroom") = StrictBool {false},
+           "CentralizedTE(*, source_allocation, source_weights=None, support=None, tunnel_count=None, prefer_headroom=False):\n"
+           "source_allocation is required (EQUAL, OPTIMIZED or WEIGHTED; None or a missing argument raises TypeError).\n"
+           "WEIGHTED requires source_weights and no tunnel_count: one integer per graph node in [0, 2^62),\n"
+           "copied once and exposed as an immutable tuple. Other source allocations refuse source_weights.\n"
+           "support a PredecessorDAG of the policy's graph (checked when a policy is built with it: `support\n"
+           "belongs to another graph`) or None for every eligible edge; tunnel_count a TunnelCount (T2;\n"
+           "the count in [1, 10000] is checked when a policy is built with it) or None; prefer_headroom (T2\n"
+           "only; True without tunnel_count raises `prefer_headroom requires tunnel_count` when a policy is\n"
+           "built with it): the headroom penalty as T2's objective after route cost")
+      .def_property_readonly("source_allocation", field_object(&CentralizedTE::source_allocation), "the SourceAllocation: EQUAL, OPTIMIZED or WEIGHTED")
+      .def_property_readonly("source_weights", [](const CentralizedTE& gl) -> py::object {
+        if (!gl.source_weights) return py::none();
+        return amounts_tuple(*gl.source_weights);
+      }, "declared node-indexed source weights as an immutable tuple, or None")
+      .def_property_readonly(
+          "support",
+          [](const CentralizedTE& gl) {
+            return optional_shared(gl.support);
+          },
+          "the supplied support (a PredecessorDAG), or None")
+      .def_property_readonly(
+          "tunnel_count", [](const CentralizedTE& gl) { return optional_of(gl.tunnel_count); },
+          "T2's tunnel count per head (a TunnelCount), or None")
+      .def_readonly("prefer_headroom", &CentralizedTE::prefer_headroom,
+                    "True: T2 minimizes the headroom penalty after route cost (T2 only)")
+      .def("__repr__", [](const CentralizedTE& gl) {
+        // The source allocation and every other field that is set.
+        std::string out;
+        const auto add = [&](const std::string& part) { out += (out.empty() ? "" : ", ") + part; };
+        add("source_allocation=" + std::string(source_allocation_repr(gl.source_allocation)));
+        if (gl.source_weights) add("source_weights=...");
+        if (gl.support) add("support=...");
+        if (gl.tunnel_count.has_value()) {
+          add("tunnel_count=TunnelCount(" + std::to_string(gl.tunnel_count->per_head) + (gl.tunnel_count->up_to ? ", up_to=True)" : ")"));
+        }
+        if (gl.prefer_headroom) add("prefer_headroom=True");
+        return "CentralizedTE(" + out + ")";
+      });
+
+  py::class_<Pinned>(m, "Pinned",
+                     "Routing: forwarding over a given program, computing nothing (the program's endpoints must be\n"
+                     "the policy's). The policy's Eligibility repairs failures: a tunnel touching an excluded element is\n"
+                     "FAILED, a split route loses its excluded members, and the roster is rebuilt from the program's\n"
+                     "basis (a head that no longer reaches a destination leaves the equal pool). black_holes: the nodes\n"
+                     "and edges this Eligibility excludes are silent failures; the program is forwarded unchanged and\n"
+                     "traffic reaching them is dropped there (stale forwarding; None: no black holes). One record per\n"
+                     "program entry.")
+      .def(py::init([](const std::shared_ptr<ForwardingProgram>& program, const std::shared_ptr<Eligibility>& black_holes) {
+             if (!program) throw py::type_error("Pinned program must be a ForwardingProgram");
+             Pinned p;
+             p.program = program;
+             p.black_holes = black_holes;
+             return p;
+           }),
+           py::arg("program"), py::kw_only(), py::arg("black_holes") = nullptr,
+           "Pinned(program, *, black_holes=None): a ForwardingProgram and an Eligibility of the same graph (both\n"
+           "kept by reference; checked when a policy is built with them)")
+      .def_property_readonly(
+          "program", [](const Pinned& p) { return typed_shared(p.program); },
+          "the forwarded program (shared, immutable)")
+      .def_property_readonly(
+          "black_holes",
+          [](const Pinned& p) {
+            return optional_shared(p.black_holes);
+          },
+          "the black holes (an Eligibility), or None")
+      .def("__repr__", [](const Pinned& p) {
+        return "Pinned(tunnels=" + std::to_string(p.program->tunnels().size()) + ")";
+      });
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/search.cpp b/bindings/python/search.cpp
new file mode 100644
index 0000000..5f5eabb
--- /dev/null
+++ b/bindings/python/search.cpp
@@ -0,0 +1,206 @@
+// spf with SpfOptions and SpfResult, the public search, and UNREACHABLE.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/types.hpp"
+#include "integers.hpp"
+#include "strict_bool.hpp"
+#include "publication.hpp"
+#include "values.hpp"
+#include "registration.hpp"
+#include "native_call.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+// The Python form of SpfOptions: the arguments as given (targets, residual and min_residual are
+// validated at the call, in spf's validation order, on their unnarrowed values); the Eligibility is
+// held by reference count.
+struct PySpfOptions {
+  Direction direction;
+  RouteTieBreak tie_break;
+  bool multipath;
+  bool parallel_edges;
+  py::object targets;
+  py::object residual;
+  py::object min_residual;
+  std::shared_ptr<Eligibility> eligibility;
+};
+
+// The Python form of SpfResult: every field already a Python object (made by the call through
+// the checked allocations), so reading one allocates nothing.
+struct PySpfResult {
+  py::object costs;        // a read-only int64 array (full searches) or None
+  py::object dag;          // PredecessorDAG
+  py::object target_cost;  // an int, or None (no target reached, or a full search)
+};
+
+} // namespace
+
+void register_search(py::module_& m) {
+  m.attr("UNREACHABLE") = py::int_(kUnreachable);
+
+  py::class_<PySpfOptions>(
+      m, "SpfOptions",
+      "The options of spf: the direction; targets (one NodeId or a sequence; None: a full search)\n"
+      "stops the search at the nearest targets (anycast: any nearest target will do); tie_break\n"
+      "(RouteTieBreak) orders equal-cost choices; multipath (True: every equal-cost walk as a DAG,\n"
+      "False: the one canonical path, targets required); parallel_edges (True: every eligible parallel\n"
+      "edge, False: one per (u, v) pair by the tie rule); a HIGHER_* tie_break with multipath and\n"
+      "parallel_edges both True is rejected by spf; residual (int64 units per EdgeId, each in [0,\n"
+      "edge_capacity_units]) makes the search skip edges with fewer than min_residual residual units\n"
+      "(an integer >= 1; without a residual it has no effect) and supplies the availability: it is the\n"
+      "only capacity threshold, and without it an edge of capacity 0 is searched like any other;\n"
+      "eligibility (None: everything allowed). A direction outside its enumeration raises ValueError\n"
+      "here, a multipath or parallel_edges that is not a bool TypeError; the other fields are validated\n"
+      "by spf, in the order its docstring gives.")
+      .def(py::init([](Direction direction, const py::object& targets, RouteTieBreak tie_break, StrictBool multipath,
+                       StrictBool parallel_edges, const py::object& residual, const py::object& min_residual,
+                       const std::shared_ptr<Eligibility>& eligibility) {
+             detail::check_member(direction, "direction");
+             return PySpfOptions {direction, tie_break, multipath, parallel_edges, targets, residual, min_residual, eligibility};
+           }),
+           py::arg("direction"), py::kw_only(), py::arg("targets") = py::none(),
+           py::arg_v("tie_break", RouteTieBreak::FewerHops, "RouteTieBreak.FEWER_HOPS"),
+           py::arg("multipath") = StrictBool {true}, py::arg("parallel_edges") = StrictBool {true},
+           py::arg("residual") = py::none(), py::arg("min_residual") = 1, py::arg("eligibility") = nullptr)
+      .def_property_readonly("direction", field_object(&PySpfOptions::direction), "FORWARD or REVERSE")
+      .def_property_readonly("tie_break", field_object(&PySpfOptions::tie_break), "the RouteTieBreak of equal-cost choices")
+      .def_readonly("multipath", &PySpfOptions::multipath,
+                    "True: every equal-cost walk (a DAG); False: the canonical single path")
+      .def_readonly("parallel_edges", &PySpfOptions::parallel_edges,
+                    "True: every eligible parallel edge; False: one per (u, v) pair by the tie rule")
+      .def_readonly("targets", &PySpfOptions::targets, "the targets as given (validated by spf); None: a full search")
+      .def_readonly("residual", &PySpfOptions::residual,
+                    "the residual units per EdgeId as given (validated by spf); None: no capacity filter;\n"
+                    "the tie scores read static capacity")
+      .def_readonly("min_residual", &PySpfOptions::min_residual,
+                    "the gating threshold in units as given (validated by spf: an integer >= 1)")
+      .def_property_readonly("eligibility", shared_field(&PySpfOptions::eligibility), "the static Eligibility; None: everything allowed");
+
+  py::class_<PySpfResult>(m, "SpfResult",
+                          "The result of spf: costs (full searches: a read-only int64 array, UNREACHABLE for the nodes not\n"
+                          "reached; None with targets), dag (PredecessorDAG of the tight edges, the edges on some shortest walk,\n"
+                          "one per (u, v) pair with parallel_edges = False, each in its own direction; with targets only the\n"
+                          "walks between the roots and a nearest target, for REVERSE from the target to a root; for\n"
+                          "multipath = False the canonical single path) and\n"
+                          "target_cost (with targets: the nearest targets' cost, None when no target is reached; None for a\n"
+                          "full search).")
+      .def_property_readonly(
+          "costs", [](const PySpfResult& r) { return r.costs ? r.costs : py::object(py::none()); },
+          "full search: each node's distance from the roots for FORWARD, or to the roots for REVERSE\n"
+          "(read-only int64[N], UNREACHABLE for nodes not reached); None with targets")
+      .def_property_readonly(
+          "dag", [](const PySpfResult& r) { return r.dag; },
+          "the PredecessorDAG of the result, in the edges' original orientation")
+      .def_property_readonly(
+          "target_cost", [](const PySpfResult& r) { return r.target_cost ? r.target_cost : py::object(py::none()); },
+          "with targets: the cost of the nearest targets, None when no target is reached; None for a\n"
+          "full search")
+      .def("__repr__", [](const PySpfResult& r) {
+        std::string tc = r.target_cost && !r.target_cost.is_none() ? std::string(py::str(r.target_cost)) : "None";
+        return "SpfResult(costs=" + std::string(r.costs ? "array" : "None") +
+               ", dag_entries=" + std::to_string(r.dag.cast<const PredecessorDAG&>().via_edges().size()) +
+               ", target_cost=" + tc + ")";
+      });
+
+  m.def(
+      "spf",
+      [](const std::shared_ptr<Graph>& graph, const py::object& roots, const py::object& opts) {
+        if (!graph) throw py::type_error("graph must be a Graph");
+        const auto o = options_of<PySpfOptions>(opts, "SpfOptions");
+        const auto n = graph->num_nodes();
+        // spf's validation order on unnarrowed values (Core repeats every check): the enumerations,
+        // the roots, the targets, their overlap, a single path without targets, the ineffective tie
+        // rule, the residual, then min_residual and a foreign Eligibility.
+        detail::check_member(o.direction, "direction");
+        detail::check_member(o.tie_break, "tie_break");
+        const auto r = node_ids(roots, n, "roots");
+        std::optional<std::vector<NodeId>> t;
+        if (!o.targets.is_none()) {
+          t = node_ids(o.targets, n, "targets");
+          detail::check_disjoint(detail::node_set(r, n, "roots"), detail::node_set(*t, n, "targets"), "roots",
+                                 "targets");
+        } else if (!o.multipath) {
+          throw py::value_error("multipath = false requires targets (the single path joins a root to a target)");
+        }
+        if (detail::RouteChoice {o.tie_break, o.multipath, o.parallel_edges}.tie_is_ineffective()) {
+          throw py::value_error("spf tie_break requires multipath=False or parallel_edges=False");
+        }
+        std::optional<std::vector<Amount>> res;
+        if (!o.residual.is_none()) res = edge_units(o.residual, *graph, "residual");
+        const auto minr = python_int(o.min_residual, "min_residual");
+        int overflow = 0;
+        const long long mv = PyLong_AsLongLongAndOverflow(minr.ptr(), &overflow);
+        if (overflow < 0 || (overflow == 0 && mv < 1)) {
+          throw py::value_error("min_residual must be at least 1 unit (got " + std::string(py::str(minr)) + ")");
+        }
+        SpfOptions c(o.direction);
+        c.tie_break = o.tie_break;
+        c.multipath = o.multipath;
+        c.parallel_edges = o.parallel_edges;
+        c.targets = std::move(t);
+        if (res.has_value()) c.residual = std::span<const Amount>(*res);
+        // Above INT64_MAX it gates every residual edge exactly as INT64_MAX does (residuals < 2^62).
+        c.min_residual = overflow != 0 ? std::numeric_limits<Amount>::max() : static_cast<Amount>(mv);
+        c.eligibility = o.eligibility.get();
+        if (c.eligibility && c.eligibility->graph_uid() != graph->uid()) {
+          throw py::value_error("foreign Eligibility: built for another graph");
+        }
+        auto result = native_call([&] { return spf(*graph, r, c); });
+        // The result's Python objects, each through a checked allocation: a failure raises.
+        auto [obj, slot] = new_object<PySpfResult>();
+        if (result.costs.has_value()) {
+          py::array_t<std::int64_t> costs(static_cast<py::ssize_t>(result.costs->size()));
+          std::copy(result.costs->begin(), result.costs->end(), costs.mutable_data());
+          py::detail::array_proxy(costs.ptr())->flags &= ~py::detail::npy_api::NPY_ARRAY_WRITEABLE_;
+          slot->costs = std::move(costs);
+        }
+        slot->dag = object_from<PredecessorDAG>(std::move(result.dag));
+        if (result.target_cost.has_value() && *result.target_cost != kUnreachable) {
+          slot->target_cost = int_object(*result.target_cost);
+        }
+        return std::move(obj);
+      },
+      py::arg("graph"), py::arg("roots"), py::arg("options"),
+      "Shortest paths from the roots for FORWARD, or to the roots for REVERSE (one NodeId or a sequence;\n"
+      "every root at distance 0), over the eligible edges (only those with residual >= min_residual when\n"
+      "a residual is given; an edge of capacity 0 is searched like any other) -> SpfResult. Without\n"
+      "targets every reachable node gets its distance: costs and the full DAG of tight edges (the edges\n"
+      "on some shortest walk; one per (u, v) pair with parallel_edges = False). With targets the search\n"
+      "stops at the nearest targets' cost:\n"
+      "target_cost and the DAG of the walks between the roots and a nearest target (for REVERSE, from\n"
+      "the target to a root, in the edges' own direction);\n"
+      "with multipath = False, instead the canonical single path, the walk minimising (cost, -bottleneck\n"
+      "under a HIGHER_* tie_break, hops, EdgeId sequence). Validated in this order before any work\n"
+      "(ValueError): the roots (non-empty, ids in range), the targets (the same), a node in both sets,\n"
+      "multipath = False without targets, a HIGHER_* tie_break with multipath and parallel_edges both\n"
+      "True ('spf tie_break requires multipath=False or parallel_edges=False'), the residual (length,\n"
+      "then every entry in [0, edge_capacity_units]),\n"
+      "min_residual >= 1, a foreign Eligibility. Excluded roots and targets are skipped; all roots\n"
+      "excluded gives an empty result.");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/shortest_path_cache.cpp b/bindings/python/shortest_path_cache.cpp
new file mode 100644
index 0000000..a4da871
--- /dev/null
+++ b/bindings/python/shortest_path_cache.cpp
@@ -0,0 +1,62 @@
+// ShortestPathCacheStats, ShortestPathCacheMiss and ShortestPathCache: the cache of static shortest-path DAGs.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <memory>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/graph.hpp"
+#include "registration.hpp"
+#include "native_call.hpp"
+#include "values.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+void register_shortest_path_cache(py::module_& m) {
+  py::class_<ShortestPathCache::Stats>(m, "ShortestPathCacheStats",
+                              "ShortestPathCache statistics (atomic per field, not a consistent snapshot): hits, misses,\n"
+                              "entries, bytes (the entries' retained payload), live_values (values alive anywhere).")
+      .def_property_readonly("hits", int_reader(&ShortestPathCache::Stats::hits), "lookups answered from an entry (they persist across clear())")
+      .def_property_readonly("misses", int_reader(&ShortestPathCache::Stats::misses),
+                    "lookups without an entry: a building cache searched, a frozen one raised ShortestPathCacheMiss")
+      .def_property_readonly("entries", int_reader(&ShortestPathCache::Stats::entries), "the entries held")
+      .def_property_readonly("bytes", int_reader(&ShortestPathCache::Stats::bytes), "the retained payload of the entries (their DAGs' stored arrays)")
+      .def_property_readonly("live_values", int_reader(&ShortestPathCache::Stats::live_values), "the cached values alive anywhere, entries included");
+
+  py::register_exception<ShortestPathCacheMiss>(m, "ShortestPathCacheMiss", PyExc_Exception);
+  m.attr("ShortestPathCacheMiss").attr("__doc__") =
+      "A lookup in a frozen ShortestPathCache whose key is absent: a dedicated exception (not a\n"
+      "RuntimeError or ValueError); the evaluators propagate it unchanged.";
+
+  py::class_<ShortestPathCache, std::shared_ptr<ShortestPathCache>>(
+      m, "ShortestPathCache",
+      "A cache of static shortest-path DAGs (from costs and the Eligibility only) for one graph, keyed by\n"
+      "(the root set, the direction, the Eligibility uid). It stores the full DAG and applies each\n"
+      "caller's route choice afterwards, so the route choice is never cached. ShortestPaths policies and the\n"
+      "evaluators read it.\n"
+      "Building mode (a new cache): one exclusive lease per call; a miss searches and inserts;\n"
+      "clear() empties it (the hit and miss counters persist), and values already handed out stay valid.\n"
+      "Frozen mode (freeze()): read-only and shareable by every worker; a miss counts one miss and raises\n"
+      "ShortestPathCacheMiss; clear() raises ValueError; thaw() waits for active calls, then returns to building.\n"
+      "Lifecycle calls take exclusive FIFO admission and cannot be overtaken by later calls.\n"
+      "When a public call fails: a building cache passed to it keeps the complete entries and statistics\n"
+      "of the lookups that succeeded before the failure (never a partial entry; a kept entry never\n"
+      "changes a result); a frozen cache's statistics stay unchanged, except one miss when the call\n"
+      "raised ShortestPathCacheMiss. A frozen cache counts its hits only when the call succeeds, Python result\n"
+      "included.")
+      .def(py::init([](const std::shared_ptr<Graph>& graph) {
+             if (!graph) throw py::type_error("graph must be a Graph");
+             return std::make_shared<ShortestPathCache>(*graph);
+           }),
+           py::arg("graph"), "An empty cache in building mode, bound to graph (by its uid).")
+      .def("graph_uid", &ShortestPathCache::graph_uid, "uid of the graph this cache is bound to")
+      .def("freeze", [](ShortestPathCache& cache) { native_call([&] { cache.freeze(); }); }, "wait for active calls and enter frozen mode (no effect when frozen)")
+      .def("thaw", [](ShortestPathCache& cache) { native_call([&] { cache.thaw(); }); }, "wait for active calls and return to building mode (no effect when building)")
+      .def("clear", [](ShortestPathCache& cache) { native_call([&] { cache.clear(); }); }, "empty a building cache; ValueError when frozen")
+      .def("stats", &ShortestPathCache::stats, "the current ShortestPathCacheStats (each field read atomically)");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/strict_bool.hpp b/bindings/python/strict_bool.hpp
new file mode 100644
index 0000000..1722bb5
--- /dev/null
+++ b/bindings/python/strict_bool.hpp
@@ -0,0 +1,70 @@
+/*
+  The one bool converter of every bool parameter: exactly a Python bool or a numpy.bool_, both by
+  type identity. pybind11's own bool caster in no-convert mode recognizes NumPy's bool by the name
+  of its type, so a class named "numpy.bool_" passes it; this caster compares the type object.
+  Also NumPy's number types and the check of an object's real type against them: isinstance would
+  honour an object's own __class__, which may claim any class.
+*/
+#pragma once
+
+#include <pybind11/gil_safe_call_once.h>
+#include <pybind11/pybind11.h>
+
+#include <utility>
+
+namespace netgraph::core::bindings {
+
+// A bool parameter's value (its signature says bool).
+struct StrictBool {
+  bool value {false};
+  constexpr operator bool() const noexcept { return value; }  // NOLINT(google-explicit-constructor)
+};
+
+// numpy.bool_'s type object, looked up once.
+inline PyObject* numpy_bool_type() {
+  PYBIND11_CONSTINIT static pybind11::gil_safe_call_once_and_store<pybind11::object> storage;
+  return storage.call_once_and_store_result([] { return pybind11::module_::import("numpy").attr("bool_"); }).get_stored().ptr();
+}
+
+// numpy.integer and numpy.floating, looked up once (a lookup per call would import NumPy each time).
+inline const std::pair<pybind11::object, pybind11::object>& numpy_number_types() {
+  PYBIND11_CONSTINIT static pybind11::gil_safe_call_once_and_store<std::pair<pybind11::object, pybind11::object>> storage;
+  return storage
+      .call_once_and_store_result([] {
+        const auto np = pybind11::module_::import("numpy");
+        return std::make_pair(pybind11::object(np.attr("integer")), pybind11::object(np.attr("floating")));
+      })
+      .get_stored();
+}
+
+// Whether o's real type (never its __class__) is `type` or a subclass of it.
+inline bool has_type(PyObject* o, const pybind11::object& type) {
+  return PyType_IsSubtype(Py_TYPE(o), reinterpret_cast<PyTypeObject*>(type.ptr())) != 0;
+}
+
+} // namespace netgraph::core::bindings
+
+namespace pybind11::detail {
+
+template <>
+struct type_caster<netgraph::core::bindings::StrictBool> {
+  PYBIND11_TYPE_CASTER(netgraph::core::bindings::StrictBool, const_name("bool"));
+
+  bool load(handle src, bool /*convert*/) {
+    if (src.ptr() == Py_True || src.ptr() == Py_False) {
+      value.value = src.ptr() == Py_True;
+      return true;
+    }
+    if (reinterpret_cast<PyObject*>(Py_TYPE(src.ptr())) != netgraph::core::bindings::numpy_bool_type()) return false;
+    const int truth = PyObject_IsTrue(src.ptr());
+    if (truth < 0) throw error_already_set();
+    value.value = truth == 1;
+    return true;
+  }
+
+  static handle cast(netgraph::core::bindings::StrictBool b, return_value_policy /*policy*/, handle /*parent*/) {
+    return handle(b.value ? Py_True : Py_False).inc_ref();
+  }
+};
+
+} // namespace pybind11::detail
diff --git a/bindings/python/strict_float.hpp b/bindings/python/strict_float.hpp
new file mode 100644
index 0000000..e27e59b
--- /dev/null
+++ b/bindings/python/strict_float.hpp
@@ -0,0 +1,67 @@
+/*
+  The float converter of the resolution parameters. It takes exactly a number: a float (a Python
+  float, read by its stored value, or a NumPy floating value, converted to double) or an integer (a Python int or a
+  NumPy integer, read exactly). Every other type is refused, and the call fails with pybind11's
+  TypeError for incompatible arguments: a bool (Python's or numpy.bool_, by type identity), a
+  fractions.Fraction, a decimal.Decimal, any object known only by __float__ or __index__. An
+  integer beyond the float range is a value: it becomes +inf or -inf, which the resolution's own
+  check refuses with its ValueError. An exception of the value's own conversion propagates as
+  raised.
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+
+#include <limits>
+
+#include "strict_bool.hpp"
+
+namespace netgraph::core::bindings {
+
+// The double value of a parameter that takes concrete Python and NumPy numbers.
+struct StrictFloat {
+  double value {0.0};
+  constexpr operator double() const noexcept { return value; }  // NOLINT(google-explicit-constructor)
+};
+
+} // namespace netgraph::core::bindings
+
+namespace pybind11::detail {
+
+template <>
+struct type_caster<netgraph::core::bindings::StrictFloat> {
+  // The input names exactly the concrete number types accepted by load().
+  PYBIND11_TYPE_CASTER(netgraph::core::bindings::StrictFloat, io_name("int | float | numpy.integer | numpy.floating", "float"));
+
+  bool load(handle src, bool convert) {
+    PyObject* o = src.ptr();
+    if (PyBool_Check(o) || reinterpret_cast<PyObject*>(Py_TYPE(o)) == netgraph::core::bindings::numpy_bool_type()) return false;
+    const auto& [np_integer, np_floating] = netgraph::core::bindings::numpy_number_types();
+    if (PyFloat_Check(o) || netgraph::core::bindings::has_type(o, np_floating)) {
+      const double x = PyFloat_AsDouble(o);
+      if (x == -1.0 && PyErr_Occurred() != nullptr) throw error_already_set();
+      value.value = x;
+      return true;
+    }
+    if (!convert || (PyLong_Check(o) == 0 && !netgraph::core::bindings::has_type(o, np_integer))) return false;
+    const object idx = reinterpret_steal<object>(PyNumber_Index(o));
+    if (!idx) throw error_already_set();
+    const double x = PyLong_AsDouble(idx.ptr());
+    if (x == -1.0 && PyErr_Occurred() != nullptr) {
+      if (PyErr_ExceptionMatches(PyExc_OverflowError) == 0) throw error_already_set();
+      PyErr_Clear();
+      const int sign = PyObject_RichCompareBool(idx.ptr(), int_(0).ptr(), Py_GT);
+      if (sign < 0) throw error_already_set();
+      value.value = sign == 1 ? std::numeric_limits<double>::infinity() : -std::numeric_limits<double>::infinity();
+      return true;
+    }
+    value.value = x;
+    return true;
+  }
+
+  static handle cast(netgraph::core::bindings::StrictFloat f, return_value_policy policy, handle parent) {
+    return type_caster<double>::cast(f.value, policy, parent);
+  }
+};
+
+} // namespace pybind11::detail
diff --git a/bindings/python/trace.hpp b/bindings/python/trace.hpp
new file mode 100644
index 0000000..3e3f55e
--- /dev/null
+++ b/bindings/python/trace.hpp
@@ -0,0 +1,55 @@
+/*
+  The trace of a traced placement as Python values (the private hooks only).
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+#include <algorithm>
+#include <string>
+
+#include "netgraph/core/detail/trace.hpp"
+#include "values.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+// A trace value as Python objects (map keys that are decimal integers become ints: the maps
+// keyed by source NodeId), each made through a checked C API call: a failed allocation raises
+// MemoryError (pybind11's int, str, list and dict constructors report it as RuntimeError).
+inline py::object trace_obj(const detail::Trace& t) {
+  using K = detail::Trace::Kind;
+  switch (t.kind) {
+    case K::Null: return py::none();
+    case K::Int: return checked(PyLong_FromLongLong(t.i));
+    case K::Str: return checked(PyUnicode_FromStringAndSize(t.s.data(), static_cast<Py_ssize_t>(t.s.size())));
+    case K::List: {
+      py::object out = checked(PyList_New(0));
+      for (const auto& x : t.items) {
+        if (PyList_Append(out.ptr(), trace_obj(x).ptr()) != 0) throw py::error_already_set();
+      }
+      return out;
+    }
+    case K::Map: {
+      py::object out = checked(PyDict_New());
+      for (const auto& [k, x] : t.fields) {
+        const bool digits = !k.empty() && std::all_of(k.begin(), k.end(), [](char ch) { return ch >= '0' && ch <= '9'; });
+        const py::object key = digits ? checked(PyLong_FromLongLong(std::stoll(k)))
+                                      : checked(PyUnicode_FromStringAndSize(k.data(), static_cast<Py_ssize_t>(k.size())));
+        if (PyDict_SetItem(out.ptr(), key.ptr(), trace_obj(x).ptr()) != 0) throw py::error_already_set();
+      }
+      return out;
+    }
+  }
+  return py::none();
+}
+
+} // namespace netgraph::core::bindings
+
+#endif
diff --git a/bindings/python/units.cpp b/bindings/python/units.cpp
new file mode 100644
index 0000000..358d2ea
--- /dev/null
+++ b/bindings/python/units.cpp
@@ -0,0 +1,337 @@
+// to_units and as_float: physical values to integer units and back.
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/detail/unit_conversion.hpp"
+#include "integers.hpp"
+#include "strict_float.hpp"
+#include "values.hpp"
+#include "native_call.hpp"
+#include "registration.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+namespace {
+
+constexpr const char* kNotPhysical = "to_units takes physical numbers (a float or an array of floats)";
+constexpr const char* kNotOneDimensional = "to_units takes a float or a 1-D array of floats";
+
+std::string dtype_text(const py::array& a) {
+  return "to_units takes physical numbers (got dtype " + std::string(py::str(a.dtype())) + ")";
+}
+
+enum class Kind { Number, Wide, Bool, Other };
+
+// An int's value as NumPy reads it, read from the int itself (a subclass's own methods are never
+// called): through int64 or uint64, rounded to the nearest double (Number); beyond 64 bits NumPy
+// holds it as an object (Wide: a value outside the domain).
+Kind int_value(PyObject* o, double& value) {
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(o, &overflow);
+  if (v == -1 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+  if (overflow == 0) {
+    value = static_cast<double>(v);
+    return Kind::Number;
+  }
+  if (overflow > 0) {
+    const unsigned long long u = PyLong_AsUnsignedLongLong(o);
+    if (u != static_cast<unsigned long long>(-1) || PyErr_Occurred() == nullptr) {
+      value = static_cast<double>(u);
+      return Kind::Number;
+    }
+    if (PyErr_ExceptionMatches(PyExc_OverflowError) == 0) throw py::error_already_set();
+    PyErr_Clear();
+  }
+  return Kind::Wide;
+}
+
+// One scalar under the rule, in this order: a bool (Python's or numpy.bool_) is Bool; an int or a
+// float, a subclass included, is a Number (Wide beyond 64 bits) read by its stored value (PyLong_*
+// and PyFloat_AS_DOUBLE read the object itself, never its __int__, __float__ or sequence methods);
+// a NumPy integer or floating scalar is a Number; anything else is Other. Every type is the
+// object's real one (never its __class__).
+Kind scalar_kind(const py::handle& x, double& value) {
+  PyObject* o = x.ptr();
+  if (is_bool(x)) return Kind::Bool;
+  if (PyLong_Check(o) != 0) return int_value(o, value);
+  if (PyFloat_Check(o) != 0) {
+    value = PyFloat_AS_DOUBLE(o);
+    return Kind::Number;
+  }
+  const auto& [np_integer, np_floating] = numpy_number_types();
+  if (has_type(o, np_integer)) {
+    const auto exact = checked(PyNumber_Index(o));
+    return int_value(exact.ptr(), value);
+  }
+  if (has_type(o, np_floating)) {
+    value = PyFloat_AsDouble(o);
+    if (value == -1.0 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+    return Kind::Number;
+  }
+  return Kind::Other;
+}
+
+// Whether NumPy reads `o` without running code of the caller's: a str, bytes, bool, None, an exact
+// int or float, an exact NumPy scalar or array (its type named "numpy.*"), or a list or tuple of
+// those (nested at most 32 deep).
+bool read_by_numpy_alone(PyObject* o, int depth = 0) {
+  if (PyUnicode_CheckExact(o) || PyBytes_CheckExact(o) || PyBool_Check(o) || o == Py_None || PyLong_CheckExact(o) ||
+      PyFloat_CheckExact(o)) {
+    return true;
+  }
+  if (std::string_view(Py_TYPE(o)->tp_name).starts_with("numpy.")) return true;
+  if (depth >= 32 || (PyList_CheckExact(o) == 0 && PyTuple_CheckExact(o) == 0)) return false;
+  const Py_ssize_t n = PySequence_Fast_GET_SIZE(o);
+  PyObject** items = PySequence_Fast_ITEMS(o);
+  for (Py_ssize_t i = 0; i < n; ++i) {
+    if (!read_by_numpy_alone(items[i], depth + 1)) return false;
+  }
+  return true;
+}
+
+// The refusal of an input that holds something other than numbers, always a TypeError, worded as
+// NumPy reads it (the texts these inputs always had): a non-numeric dtype names it; a numeric
+// reading of more than one dimension is the shape text; any other numeric reading the scalar text.
+// An input NumPy would read through the caller's code (an object's own __array__, a subclass) is
+// not given to NumPy: it holds an object, NumPy's `got dtype object`.
+[[noreturn]] void refuse_physical(const py::handle& x) {
+  if (!read_by_numpy_alone(x.ptr())) throw py::type_error("to_units takes physical numbers (got dtype object)");
+  const auto np = py::module_::import("numpy");
+  const auto raw = py::reinterpret_steal<py::array>(checked(PyObject_CallOneArg(np.attr("asarray").ptr(), x.ptr())).release());
+  const char kind = raw.dtype().kind();
+  if (kind != 'f' && kind != 'i' && kind != 'u') throw py::type_error(dtype_text(raw));
+  if (raw.ndim() > 1) throw py::type_error(kNotOneDimensional);
+  throw py::type_error(kNotPhysical);
+}
+
+// to_units' x as doubles: one scalar, or the entries of a 1-D input.
+struct PhysicalValues {
+  bool scalar {false};
+  std::vector<double> values;
+};
+
+// The one classifier of to_units' x, in this order:
+//   1. a bool, a str or a bytes: TypeError (the scalar text);
+//   2. an int or a float, a subclass included, by its stored value; a NumPy integer or floating
+//      scalar (scalar_kind): one number (an int beyond 64 bits: ValueError);
+//   3. a NumPy array: an integer or floating dtype (else TypeError, the dtype text), of rank 0 (one
+//      number) or 1 (its entries; another rank TypeError, the shape text);
+//   4. a Python sequence (a memoryview of rank 1; a str or bytes never reaches here), each entry
+//      through scalar_kind: any entry of another type refuses it as NumPy words it; then NumPy's
+//      dtype: bools alone TypeError with `got dtype bool`, an int beyond 64 bits `got dtype
+//      object` (ValueError among numbers alone, TypeError beside a bool); then bools among
+//      numbers TypeError (the scalar text: NumPy would read them as numbers); numbers alone are
+//      its values;
+//   5. anything else: TypeError, as NumPy words it (refuse_physical).
+// An int beyond 64 bits among numbers is a value outside the domain (ValueError, NumPy's `got dtype
+// object`), decided after every entry is classified. No Python object is made but the checked
+// copies of NumPy integers, NumPy's array of a given array and the refusal's reading.
+PhysicalValues physical_values(const py::handle& x) {
+  PhysicalValues out;
+  if (py::isinstance<py::str>(x) || py::isinstance<py::bytes>(x)) throw py::type_error(kNotPhysical);
+  constexpr const char* wide = "to_units takes physical numbers (got dtype object)";
+  double value = 0.0;
+  switch (scalar_kind(x, value)) {
+    case Kind::Bool:
+      throw py::type_error(kNotPhysical);
+    case Kind::Wide:
+      throw py::value_error(wide);
+    case Kind::Number:
+      out.scalar = true;
+      out.values.push_back(value);
+      return out;
+    case Kind::Other:
+      break;
+  }
+  if (py::isinstance<py::array>(x)) {
+    const auto given = py::reinterpret_borrow<py::array>(x);
+    const char kind = given.dtype().kind();
+    if (kind != 'f' && kind != 'i' && kind != 'u') throw py::type_error(dtype_text(given));
+    if (given.ndim() > 1) throw py::type_error(kNotOneDimensional);
+    const auto doubles = numpy_conversion<double, py::array::c_style | py::array::forcecast>(given);
+    out.scalar = given.ndim() == 0;
+    out.values.assign(doubles.data(), doubles.data() + doubles.size());
+    return out;
+  }
+  if (PySequence_Check(x.ptr()) == 0) refuse_physical(x);
+  if (PyMemoryView_Check(x.ptr()) != 0 && PyMemoryView_GET_BUFFER(x.ptr())->ndim != 1) {
+    if (PyMemoryView_GET_BUFFER(x.ptr())->ndim > 1) throw py::type_error(kNotOneDimensional);
+    refuse_physical(x);
+  }
+  // A list or a tuple is read in place; any other sequence by index, as NumPy reads it (its
+  // own __len__ and __getitem__; no iterator, whose machinery may absorb a failure).
+  const bool in_place = PyList_Check(x.ptr()) != 0 || PyTuple_Check(x.ptr()) != 0;
+  const Py_ssize_t size = PySequence_Size(x.ptr());
+  if (size < 0) throw py::error_already_set();
+  const auto n = static_cast<std::size_t>(size);
+  const auto entry = [&](std::size_t i) {
+    if (in_place) return py::reinterpret_borrow<py::object>(PySequence_Fast_ITEMS(x.ptr())[i]);
+    return checked(PySequence_GetItem(x.ptr(), static_cast<Py_ssize_t>(i)));
+  };
+  // A refusal is worded on the entries as a list: the sequence itself, or a checked copy.
+  const auto refuse = [&]() {
+    if (in_place) refuse_physical(x);
+    const py::object copy = checked(PyList_New(size));
+    for (std::size_t i = 0; i < n; ++i) PyList_SET_ITEM(copy.ptr(), static_cast<Py_ssize_t>(i), entry(i).release().ptr());
+    refuse_physical(copy);
+  };
+  out.values.reserve(n);
+  std::size_t bools = 0;
+  std::size_t wides = 0;
+  for (std::size_t i = 0; i < n; ++i) {
+    switch (scalar_kind(entry(i), value)) {
+      case Kind::Number:
+        out.values.push_back(value);
+        break;
+      case Kind::Wide:
+        ++wides;
+        break;
+      case Kind::Bool:
+        ++bools;
+        break;
+      case Kind::Other:
+        refuse();
+    }
+  }
+  // NumPy's order: its dtype first (bools alone: bool; an int beyond 64 bits: object, a value
+  // error only among numbers alone), then a bool among numbers.
+  if (bools == n && n > 0) throw py::type_error("to_units takes physical numbers (got dtype bool)");
+  if (wides > 0) {
+    if (bools > 0) throw py::type_error(wide);
+    throw py::value_error(wide);
+  }
+  if (bools > 0) throw py::type_error(kNotPhysical);
+  return out;
+}
+
+// x * 2^k for an unbounded Python int, correctly rounded: Python's int shift and int true
+// division are exact or correctly rounded, so only a result beyond the finite doubles fails.
+double scaled_python_int(const py::object& x, int k) {
+  try {
+    py::object r;
+    if (k >= 0) {
+      r = py::float_(x.attr("__lshift__")(py::int_(k)));
+    } else {
+      r = x.attr("__truediv__")(py::int_(1).attr("__lshift__")(py::int_(-k)));
+    }
+    return r.cast<double>();
+  } catch (py::error_already_set& e) {
+    if (e.matches(PyExc_OverflowError)) {
+      throw py::value_error("as_float: " + std::string(py::str(x)) +
+                            " units times the resolution exceed the largest finite double");
+    }
+    throw;
+  }
+}
+
+// One Amount to a physical double; the resolution's exponent k is already validated.
+double amount_as_float(const py::handle& item, int k, double resolution) {
+  py::object idx = python_int(item, "as_float: x");
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  if (overflow == 0) return as_float(static_cast<std::int64_t>(v), resolution);
+  return scaled_python_int(idx, k);
+}
+
+} // namespace
+
+void register_units(py::module_& m) {
+  m.def(
+      "to_units",
+      [](const py::object& x, StrictFloat resolution) -> py::object {
+        const int k = resolution_exponent(resolution);  // before the shape: an empty array is no exemption
+        const PhysicalValues v = physical_values(x);
+        if (v.scalar) return int_object(to_units(v.values[0], resolution));
+        // At this scale the nearest double below 2^62 is hundreds of units
+        // away: rounding cannot cross the boundary. Validate with the physical
+        // bound, then leave the scaling/rounding kernel to the detached phase.
+        const double limit = 4611686018427387904.0 * static_cast<double>(resolution);
+        for (double x : v.values) {
+          if (!(x >= 0.0 && x < limit)) (void)to_units(x, resolution);
+        }
+        auto result = native_call([&] {
+          std::vector<std::int64_t> values(v.values.size());
+          for (std::size_t i = 0; i < v.values.size(); ++i) {
+            values[i] = static_cast<Amount>(detail::rounded_units(v.values[i], k));
+          }
+          return values;
+        });
+        return int64_array(result);
+      },
+      py::arg("x"), py::arg("resolution"),
+      "Physical value(s) to whole units of the resolution q: each input is read as its binary64 value b,\n"
+      "and b/q is rounded half up to an integer, exactly. Converted back, a result differs from b by at\n"
+      "most q/2 (+q/2 exactly at a tie, which goes up).\n"
+      "float32 widens exactly; integers become the nearest double, ties to even, so an integer above 2^53\n"
+      "can change before the rounding (2^53+1 at q=1 gives 2^53). The result is floor(b/q + 1/2),\n"
+      "evaluated exactly, never by floating addition of 1/2 or by reading the printed decimal. Ties are\n"
+      "b=(2n+1)*q/2, 0 <= n < 2^52; each gives n+1, never the even neighbour.\n"
+      "A scalar or 0-d array gives an int; a sequence or 1-d array gives an int64 array. Negative\n"
+      "zero gives 0. NaN, infinity, negative values, an integer too large for NumPy and results\n"
+      "at or above 2^62 units raise ValueError. A bool, string, wrong dtype/rank or type other\n"
+      "than int, float or NumPy numbers raises TypeError; int/float subclasses use stored values.\n"
+      "q must be a power of two in [2^-32, 2^32]: a float, NumPy float or integer (another type\n"
+      "raises TypeError, an integer beyond the float range ValueError).\n"
+      "N separately rounded values have a total error in (-N*q/2, N*q/2], with no promised sign: round a\n"
+      "demand once, then split whole units. A decimal and the double it parses to give the same units\n"
+      "only when both lie in the same half-up cell: 5501195.1796 at q=2^-21 gives 11536842473289, whereas\n"
+      "its decimal reading would give 11536842473288 (docs/semantics.md, section 1, has the full rule).\n"
+      "CostStretch deliberately reads printed decimals for ratios; physical amounts use b.");
+
+  m.def(
+      "as_float",
+      [](const py::object& x, StrictFloat resolution) -> py::object {
+        const int k = resolution_exponent(resolution);  // the resolution before the shape
+        if (!is_bool(x) &&
+            (PyLong_Check(x.ptr()) != 0 || has_type(x.ptr(), numpy_number_types().first))) {
+          return py::float_(amount_as_float(x, k, resolution));
+        }
+        // A sequence, a NumPy array of any rank included: wide_integers refuses a rank other than 1.
+        if (!is_invalid_sequence(x)) {
+          const auto v = wide_integers(x, "as_float: x");
+          std::vector<double> values(v.size());
+          // Arbitrary Python integer arithmetic remains attached; the ordinary
+          // fixed-width conversion loop works only on the copied native values.
+          for (std::size_t i = 0; i < v.size(); ++i) {
+            if (v.sign(i) != 0) values[i] = amount_as_float(v.source[py::int_(i)], k, resolution);
+          }
+          native_call([&] {
+            for (std::size_t i = 0; i < v.size(); ++i) {
+              if (v.sign(i) == 0) values[i] = detail::scaled_units(v.value[i], k);
+            }
+          });
+          py::array_t<double> out(static_cast<py::ssize_t>(values.size()));
+          std::copy(values.begin(), values.end(), out.mutable_data());
+          return std::move(out);
+        }
+        return py::float_(amount_as_float(x, k, resolution));
+      },
+      py::arg("x"), py::arg("resolution"),
+      "Units to physical value(s): the exact product x*q correctly rounded to binary64, nearest\n"
+      "with ties to even; exact for abs(x) <= 2^53. x is any signed, unbounded integer: an int or NumPy integer gives a\n"
+      "float, an integer vector a float64 array. An int or NumPy integer, a subclass included,\n"
+      "is never read as a sequence. An integer position accepts __index__, never\n"
+      "a bool; other types raise TypeError. q is a power of two in [2^-32, 2^32] (float, NumPy\n"
+      "float or integer). The result is finite iff abs(x*q) < 2^1024 - 2^970; otherwise raise\n"
+      "ValueError('as_float: <x> units times the resolution exceed the largest finite double').\n"
+      "Exact for abs(x) <= 2^53 inclusive. Above 2^53 an integer of binary length L is exact\n"
+      "iff divisible by 2^(L-53); 2^53+1 rounds to 2^53, 2^53+3 to 2^53+4, times q.\n"
+      "to_units(as_float(x,q),q)==x holds for x in [0,2^53] at every q, and for larger x in\n"
+      "[0,2^62) exactly when x is a double. The first failure is 2^53+1; 2^62-1 rounds to\n"
+      "2^62*q and reconversion raises the to_units domain ValueError. A successful to_units\n"
+      "result is always exact here; its error against the promoted binary64 input is in\n"
+      "(-q/2,q/2]. Choose q before Graph construction, then use Graph.resolution().");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/bindings/python/values.hpp b/bindings/python/values.hpp
new file mode 100644
index 0000000..d3de1ab
--- /dev/null
+++ b/bindings/python/values.hpp
@@ -0,0 +1,318 @@
+/*
+  Small conversions shared by the registration files: read-only NumPy views that
+  keep their owner alive, the resolution's check, exact counters, int64 arrays, FlowIds,
+  (EdgeId, units) pairs, amounts (checked at once or kept as given) and the type checks of option
+  arguments.
+*/
+#pragma once
+
+#include <pybind11/pybind11.h>
+#include <pybind11/numpy.h>
+#include <pybind11/stl.h>
+#include <pybind11/typing.h>
+
+#include <algorithm>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <initializer_list>
+#include <memory>
+#include <optional>
+#include <span>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+#include "integers.hpp"
+
+namespace py = pybind11;
+
+namespace netgraph::core::bindings {
+
+// Read-only NumPy view of a span owned by `owner`.
+template <typename T>
+py::array readonly_view(std::span<const T> s, const py::handle& owner, const py::dtype& dtype) {
+  static constexpr T empty_element {};
+  py::array arr(dtype, {static_cast<py::ssize_t>(s.size())}, {static_cast<py::ssize_t>(sizeof(T))},
+                s.empty() ? &empty_element : s.data(), owner);
+  py::detail::array_proxy(arr.ptr())->flags &= ~py::detail::npy_api::NPY_ARRAY_WRITEABLE_;
+  return arr;
+}
+
+template <typename T>
+py::array readonly_view(std::span<const T> s, const py::handle& owner) {
+  return readonly_view(s, owner, py::dtype::of<T>());
+}
+
+// Validates a resolution (a power of two in [2^-32, 2^32]) and returns its exponent.
+inline int resolution_exponent(double resolution) {
+  (void)as_float(0, resolution);  // throws the resolution message
+  return std::ilogb(resolution);
+}
+
+// A new reference from the C API, or the pending Python error raised (pybind11's own int and
+// tuple constructors fail on a failed allocation with an unchecked internal error instead).
+inline py::object checked(PyObject* o) {
+  if (o == nullptr) throw py::error_already_set();
+  return py::reinterpret_steal<py::object>(o);
+}
+
+// hi * 2^64 + lo as an exact Python int.
+inline py::object counter_int(const Counter128& c) {
+  py::object lo = checked(PyLong_FromUnsignedLongLong(c.lo));
+  if (c.hi == 0) return lo;
+  py::object hi = checked(PyLong_FromUnsignedLongLong(c.hi));
+  py::object shift = checked(PyLong_FromLong(64));
+  py::object high = checked(PyNumber_Lshift(hi.ptr(), shift.ptr()));
+  return checked(PyNumber_Or(high.ptr(), lo.ptr()));
+}
+
+// The readers of fields and properties build every Python value below through the checked C API
+// (a new reference, or the pending MemoryError raised). pybind11's own conversions report a failed
+// allocation as another class: its return conversion of a C++ value as TypeError, its int, float,
+// list and tuple constructors as RuntimeError.
+
+// An integer (any integer type but bool) or a 128-bit counter as a Python int.
+template <class T>
+py::int_ int_object(T v) {
+  static_assert(std::is_integral_v<T> && !std::is_same_v<T, bool>);
+  PyObject* o = nullptr;
+  if constexpr (std::is_signed_v<T>) {
+    o = PyLong_FromLongLong(static_cast<long long>(v));
+  } else {
+    o = PyLong_FromUnsignedLongLong(static_cast<unsigned long long>(v));
+  }
+  return py::reinterpret_steal<py::int_>(checked(o).release());
+}
+inline py::int_ int_object(const Counter128& c) { return py::reinterpret_steal<py::int_>(counter_int(c).release()); }
+
+inline py::float_ float_object(double v) { return py::reinterpret_steal<py::float_>(checked(PyFloat_FromDouble(v)).release()); }
+
+// None, or the value as a Python int.
+template <class T>
+py::typing::Optional<py::int_> optional_int(const std::optional<T>& v) {
+  return py::reinterpret_steal<py::typing::Optional<py::int_>>(v.has_value() ? int_object(*v).release() : py::none().release());
+}
+
+// The reader of an integer field, and of an optional one (None when absent).
+template <class C, class T>
+auto int_reader(T C::*field) {
+  return [field](const C& c) { return int_object(c.*field); };
+}
+template <class C, class T>
+auto optional_int_reader(std::optional<T> C::*field) {
+  return [field](const C& c) { return optional_int(c.*field); };
+}
+
+// (a, b) as a tuple of two Python ints.
+template <class A, class B>
+py::typing::Tuple<py::int_, py::int_> int_pair(const A& a, const B& b) {
+  py::object x = int_object(a);
+  py::object y = int_object(b);
+  PyObject* out = checked(PyTuple_New(2)).release().ptr();
+  PyTuple_SET_ITEM(out, 0, x.release().ptr());
+  PyTuple_SET_ITEM(out, 1, y.release().ptr());
+  return py::reinterpret_steal<py::typing::Tuple<py::int_, py::int_>>(out);
+}
+
+// Integers as a list of Python ints.
+template <class T>
+py::typing::List<py::int_> ints_list(std::span<const T> v) {
+  auto out = py::reinterpret_steal<py::typing::List<py::int_>>(checked(PyList_New(static_cast<Py_ssize_t>(v.size()))).release());
+  for (std::size_t i = 0; i < v.size(); ++i) PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), int_object(v[i]).release().ptr());
+  return out;
+}
+
+// (a, b) pairs as a list (Out: its pybind11 type, which names the stub's type) or a tuple of
+// two-int tuples.
+template <class Out = py::list, class A, class B>
+Out pairs_list(const std::vector<std::pair<A, B>>& v) {
+  auto out = py::reinterpret_steal<Out>(checked(PyList_New(static_cast<Py_ssize_t>(v.size()))).release());
+  for (std::size_t i = 0; i < v.size(); ++i) {
+    PyList_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), int_pair(v[i].first, v[i].second).release().ptr());
+  }
+  return out;
+}
+template <class A, class B>
+py::tuple pairs_tuple(const std::vector<std::pair<A, B>>& v) {
+  auto out = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(static_cast<Py_ssize_t>(v.size()))).release());
+  for (std::size_t i = 0; i < v.size(); ++i) {
+    PyTuple_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), int_pair(v[i].first, v[i].second).release().ptr());
+  }
+  return out;
+}
+
+// A tuple of the given objects (made by the caller), through a checked allocation.
+inline py::tuple objects_tuple(std::initializer_list<py::object> items) {
+  auto out = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(static_cast<Py_ssize_t>(items.size()))).release());
+  Py_ssize_t i = 0;
+  for (const auto& item : items) PyTuple_SET_ITEM(out.ptr(), i++, item.inc_ref().ptr());
+  return out;
+}
+
+// fraction_type(n, d) (fractions.Fraction): the two ints through checked allocations and the call
+// through the C API, so a failure of the call raises as raised.
+inline py::object fraction_object(const py::handle& fraction_type, std::int64_t n, std::int64_t d) {
+  const py::object num = int_object(n);
+  const py::object den = int_object(d);
+  return checked(PyObject_CallFunctionObjArgs(fraction_type.ptr(), num.ptr(), den.ptr(), nullptr));
+}
+
+// A str through a checked allocation.
+inline py::str str_object(const char* text) { return py::reinterpret_steal<py::str>(checked(PyUnicode_FromString(text)).release()); }
+
+// The hash of `key` as a Python int: a failure of the hash raises as raised, and the int is made
+// through a checked allocation (pybind11's return conversion of a hash reports a failed
+// allocation as TypeError).
+inline py::int_ hash_int(const py::handle& key) {
+  const Py_hash_t h = PyObject_Hash(key.ptr());
+  if (h == -1 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+  return int_object(static_cast<long long>(h));
+}
+
+// Integers as a tuple of Python ints.
+inline py::tuple ints_tuple(std::span<const std::int32_t> v) {
+  auto out = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(static_cast<Py_ssize_t>(v.size()))).release());
+  for (std::size_t i = 0; i < v.size(); ++i) {
+    PyTuple_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), checked(PyLong_FromLong(v[i])).release().ptr());
+  }
+  return out;
+}
+
+// A tuple of Python ints, each through a checked allocation.
+inline py::tuple amounts_tuple(std::span<const Amount> v) {
+  auto out = py::reinterpret_steal<py::tuple>(checked(PyTuple_New(static_cast<Py_ssize_t>(v.size()))).release());
+  for (std::size_t i = 0; i < v.size(); ++i) {
+    PyTuple_SET_ITEM(out.ptr(), static_cast<Py_ssize_t>(i), checked(PyLong_FromLongLong(v[i])).release().ptr());
+  }
+  return out;
+}
+
+inline py::array_t<std::int64_t> int64_array(const std::vector<std::int64_t>& v) {
+  py::array_t<std::int64_t> out(static_cast<py::ssize_t>(v.size()));
+  std::copy(v.begin(), v.end(), out.mutable_data());
+  return out;
+}
+
+inline FlowId flow_id_of(const py::object& obj) {
+  // Not a tuple is a wrong type, a tuple of another length a wrong value: one text.
+  if (!py::isinstance<py::tuple>(obj)) throw py::type_error("a FlowId is a tuple (ledger uid, id)");
+  if (py::len(obj) != 2) throw py::value_error("a FlowId is a tuple (ledger uid, id)");
+  auto t = py::reinterpret_borrow<py::tuple>(obj);
+  py::object uid = python_int(t[0], "FlowId ledger uid");
+  py::object id = python_int(t[1], "FlowId id");
+  int o1 = 0, o2 = 0;
+  const unsigned long long u = PyLong_AsUnsignedLongLong(uid.ptr());
+  if (PyErr_Occurred()) {
+    // Only the range error means no such ledger; another failure (memory running out while that
+    // error is raised) propagates as raised.
+    if (!PyErr_ExceptionMatches(PyExc_OverflowError)) throw py::error_already_set();
+    PyErr_Clear();
+    o1 = 1;
+  }
+  const long long i = PyLong_AsLongLongAndOverflow(id.ptr(), &o2);
+  if (o1 != 0 || o2 != 0 || i < 0) {
+    throw py::value_error("FlowId (" + std::string(py::str(uid)) + ", " + std::string(py::str(id)) + ") is retired or unknown");
+  }
+  return FlowId {static_cast<std::uint64_t>(u), static_cast<std::int64_t>(i)};
+}
+
+
+// An amount argument: an integer number of units in [0, 2^62) or +inf (float('inf')); nullopt is
+// +inf. Every other argument raises the one `text`, with the class of its cause: a type the position
+// never takes (a bool, a string, None, another non-number) TypeError; a float other than +inf (NaN,
+// -inf, a finite one) or an integer out of range ValueError. An exception of the object's own
+// __index__ propagates as raised.
+inline std::optional<Amount> units_or_inf(const py::object& value, const char* text) {
+  if (PyFloat_Check(value.ptr()) || has_type(value.ptr(), numpy_number_types().second)) {
+    const double x = PyFloat_AsDouble(value.ptr());
+    if (x == -1.0 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+    if (std::isinf(x) && x > 0) return std::nullopt;
+    throw py::value_error(text);
+  }
+  if (is_bool(value) || !PyIndex_Check(value.ptr())) throw py::type_error(text);
+  const py::object idx = py::reinterpret_steal<py::object>(PyNumber_Index(value.ptr()));
+  if (!idx) throw py::error_already_set();
+  int overflow = 0;
+  const long long v = PyLong_AsLongLongAndOverflow(idx.ptr(), &overflow);
+  if (overflow != 0 || v < 0 || v >= kDomainLimit) throw py::value_error(text);
+  return static_cast<Amount>(v);
+}
+
+// An amount kept as given (Units: an int or a float; None: absent): an action's offer and design
+// demand, an EvaluationOptions option. A value of another type (a bool, a string, ...) raises
+// TypeError here; its domain is the call's check. An __index__ object is kept as its int.
+inline py::object units_as_given(const py::object& obj, const char* name) {
+  if (obj.is_none() || PyFloat_Check(obj.ptr()) || has_type(obj.ptr(), numpy_number_types().second)) {
+    return obj;
+  }
+  if (!is_bool(obj) && PyIndex_Check(obj.ptr())) {
+    auto idx = py::reinterpret_steal<py::object>(PyNumber_Index(obj.ptr()));
+    if (!idx) throw py::error_already_set();
+    return idx;
+  }
+  throw py::type_error(std::string(name) + " must be an int or a float (got " +
+                       std::string(py::str(py::type::of(obj).attr("__name__"))) + ")");
+}
+
+// The C++ form of an amount kept as given: None absent; +inf the inner nullopt; an int in int64 its
+// value; any other value (a float other than +inf, an int beyond int64) -1, which is outside every
+// domain and so raises the amount's domain error in its place.
+inline std::optional<std::optional<Amount>> units_at_use(const py::object& obj) {
+  if (obj.is_none()) return std::nullopt;
+  if (PyLong_Check(obj.ptr())) {
+    int overflow = 0;
+    const long long v = PyLong_AsLongLongAndOverflow(obj.ptr(), &overflow);
+    if (overflow != 0) return Amount {-1};
+    return Amount {v};
+  }
+  const double x = PyFloat_AsDouble(obj.ptr());
+  if (x == -1.0 && PyErr_Occurred() != nullptr) throw py::error_already_set();
+  if (std::isinf(x) && x > 0) return std::optional<std::optional<Amount>> {std::in_place, std::nullopt};
+  return Amount {-1};
+}
+
+// A black-hole set argument: an Eligibility or None (its graph is checked by the call).
+inline std::shared_ptr<Eligibility> eligibility_or_none(const py::object& obj, const char* name) {
+  if (obj.is_none()) return nullptr;
+  if (!py::isinstance<Eligibility>(obj)) {
+    throw py::type_error(std::string(name) + " must be an Eligibility or None (got " +
+                         std::string(py::str(py::type::of(obj).attr("__name__"))) + ")");
+  }
+  return obj.cast<std::shared_ptr<Eligibility>>();
+}
+
+inline OutputOptions outputs_of(const py::object& obj) {
+  if (obj.is_none()) return OutputOptions {};
+  if (!py::isinstance<OutputOptions>(obj)) {
+    throw py::type_error("outputs must be an OutputOptions (got " + std::string(py::str(py::type::of(obj).attr("__name__"))) +
+                         ")");
+  }
+  return obj.cast<OutputOptions>();
+}
+
+template <class Options>
+Options options_of(const py::object& obj, const char* name) {
+  if (!py::isinstance<Options>(obj)) {
+    throw py::type_error(std::string(name) + " expected (got " + std::string(py::str(py::type::of(obj).attr("__name__"))) +
+                         ")");
+  }
+  return obj.cast<Options>();
+}
+
+// A cost ceiling argument (DistributedTE's and KspOptions'): None, an AbsoluteCost or a CostStretch;
+// any other object raises one TypeError.
+inline std::optional<CostCeiling> cost_ceiling_of(const py::object& obj) {
+  if (obj.is_none()) return std::nullopt;
+  if (py::isinstance<AbsoluteCost>(obj)) return CostCeiling {obj.cast<AbsoluteCost>()};
+  if (py::isinstance<CostStretch>(obj)) return CostCeiling {obj.cast<CostStretch>()};
+  throw py::type_error("cost_ceiling must be AbsoluteCost, CostStretch or None");
+}
+
+} // namespace netgraph::core::bindings
diff --git a/dev/benchmark_profiling_overhead.py b/dev/benchmark_profiling_overhead.py
deleted file mode 100644
index 1a32e68..0000000
--- a/dev/benchmark_profiling_overhead.py
+++ /dev/null
@@ -1,297 +0,0 @@
-#!/usr/bin/env python3
-"""Benchmark for measuring netgraph_core performance and profiling overhead.
-
-Runs SPF and flow placement operations on a mesh graph topology.
-Useful for:
-  - Measuring profiling infrastructure overhead (compare with/without NGRAPH_CORE_PROFILE=1)
-  - Regression testing after code changes
-  - Comparing performance across versions
-
-Usage:
-    # Default run (400-node mesh, 500 SPF + 100 flow ops)
-    python dev/benchmark_profiling_overhead.py
-
-    # Quick smoke test
-    python dev/benchmark_profiling_overhead.py --quick
-
-    # Custom parameters
-    python dev/benchmark_profiling_overhead.py --mesh-size 30 --spf-iters 1000 --flow-iters 200
-
-    # Compare profiling overhead
-    python dev/benchmark_profiling_overhead.py                      # baseline
-    NGRAPH_CORE_PROFILE=1 python dev/benchmark_profiling_overhead.py  # with profiling
-
-    # JSON output for scripting
-    python dev/benchmark_profiling_overhead.py --json
-"""
-
-import argparse
-import json
-import statistics
-import sys
-import time
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def create_mesh_graph(n: int) -> ngc.StrictMultiDiGraph:
-    """Create an n x n mesh graph with bidirectional edges.
-
-    Args:
-        n: Grid dimension (creates n*n nodes)
-
-    Returns:
-        Graph with 4-connected mesh topology, unit costs, 100.0 capacity per edge.
-    """
-    num_nodes = n * n
-    edges = []
-
-    for row in range(n):
-        for col in range(n):
-            node = row * n + col
-            if col < n - 1:
-                right = row * n + (col + 1)
-                edges.append((node, right, 1, 100.0))
-                edges.append((right, node, 1, 100.0))
-            if row < n - 1:
-                down = (row + 1) * n + col
-                edges.append((node, down, 1, 100.0))
-                edges.append((down, node, 1, 100.0))
-
-    src = np.array([e[0] for e in edges], dtype=np.int32)
-    dst = np.array([e[1] for e in edges], dtype=np.int32)
-    cost = np.array([e[2] for e in edges], dtype=np.int64)
-    cap = np.array([e[3] for e in edges], dtype=np.float64)
-    ext_edge_ids = np.arange(len(edges), dtype=np.int64)
-
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-def benchmark_spf(
-    graph_handle, algs: ngc.Algorithms, num_nodes: int, iterations: int
-) -> list[float]:
-    """Run SPF iterations and return per-call times in ms."""
-    times = []
-    edge_sel = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-
-    for i in range(iterations):
-        src = i % num_nodes
-        start = time.perf_counter()
-        algs.spf(graph_handle, src, selection=edge_sel)
-        times.append((time.perf_counter() - start) * 1000)
-
-    return times
-
-
-def benchmark_flow_placement(
-    g: ngc.StrictMultiDiGraph, graph_handle, algs: ngc.Algorithms, iterations: int
-) -> list[float]:
-    """Run flow placement iterations and return per-call times in ms."""
-    num_nodes = g.num_nodes()
-    times = []
-
-    for i in range(iterations):
-        fg = ngc.FlowGraph(g)
-        cfg = ngc.FlowPolicyConfig()
-        cfg.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-        cfg.max_flow_count = 16
-        cfg.min_flow_count = 16
-        cfg.selection = ngc.EdgeSelection(
-            multi_edge=False,
-            require_capacity=True,
-            tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-        )
-        cfg.require_capacity = True
-        cfg.multipath = False
-        cfg.reoptimize_flows_on_each_placement = True
-        policy = ngc.FlowPolicy(algs, graph_handle, cfg)
-
-        src = i % num_nodes
-        dst = (num_nodes - 1 - i) % num_nodes
-        if src == dst:
-            dst = (dst + 1) % num_nodes
-
-        start = time.perf_counter()
-        policy.place_demand(fg, src, dst, 0, 1000.0)
-        times.append((time.perf_counter() - start) * 1000)
-
-    return times
-
-
-def compute_stats(name: str, times: list[float]) -> dict:
-    """Compute statistics for a benchmark run."""
-    return {
-        "name": name,
-        "iterations": len(times),
-        "mean_ms": statistics.mean(times),
-        "median_ms": statistics.median(times),
-        "stdev_ms": statistics.stdev(times) if len(times) > 1 else 0,
-        "min_ms": min(times),
-        "max_ms": max(times),
-        "total_ms": sum(times),
-    }
-
-
-def print_stats(stats: dict) -> None:
-    """Print benchmark statistics."""
-    print(f"\n{stats['name']}:")
-    print(f"  Iterations: {stats['iterations']}")
-    print(f"  Mean:   {stats['mean_ms']:.3f} ms")
-    print(f"  Median: {stats['median_ms']:.3f} ms")
-    print(f"  Stdev:  {stats['stdev_ms']:.3f} ms")
-    print(f"  Min:    {stats['min_ms']:.3f} ms")
-    print(f"  Max:    {stats['max_ms']:.3f} ms")
-    print(f"  Total:  {stats['total_ms']:.1f} ms")
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Benchmark netgraph_core performance and profiling overhead.",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog="""
-Examples:
-  %(prog)s                     # default benchmark
-  %(prog)s --quick             # fast smoke test
-  %(prog)s --mesh-size 30      # larger graph
-  %(prog)s --json              # machine-readable output
-  NGRAPH_CORE_PROFILE=1 %(prog)s  # measure with profiling enabled
-""",
-    )
-    parser.add_argument(
-        "--mesh-size",
-        type=int,
-        default=20,
-        metavar="N",
-        help="mesh grid size (N x N nodes, default: 20)",
-    )
-    parser.add_argument(
-        "--spf-iters",
-        type=int,
-        default=500,
-        metavar="N",
-        help="number of SPF iterations (default: 500)",
-    )
-    parser.add_argument(
-        "--flow-iters",
-        type=int,
-        default=100,
-        metavar="N",
-        help="number of flow placement iterations (default: 100)",
-    )
-    parser.add_argument(
-        "--quick",
-        action="store_true",
-        help="quick run with minimal iterations (mesh=10, spf=50, flow=10)",
-    )
-    parser.add_argument(
-        "--json",
-        action="store_true",
-        help="output results as JSON (for scripting)",
-    )
-    args = parser.parse_args()
-
-    if args.quick:
-        args.mesh_size = 10
-        args.spf_iters = 50
-        args.flow_iters = 10
-
-    profiling_enabled = getattr(ngc, "profiling_enabled", lambda: None)()
-
-    if not args.json:
-        print("=" * 60)
-        print("NetGraph-Core Benchmark")
-        print("=" * 60)
-        print(f"\nVersion: {ngc.__version__}")
-        if profiling_enabled is not None:
-            print(f"Profiling: {'ON' if profiling_enabled else 'OFF'}")
-        print(
-            f"\nGraph: {args.mesh_size}x{args.mesh_size} mesh ({args.mesh_size**2} nodes)"
-        )
-        print(f"SPF iterations: {args.spf_iters}")
-        print(f"Flow iterations: {args.flow_iters}")
-        print("\nCreating graph...", end=" ", flush=True)
-
-    g = create_mesh_graph(args.mesh_size)
-    num_nodes = g.num_nodes()
-    num_edges = g.num_edges()
-
-    if not args.json:
-        print(f"done ({num_nodes} nodes, {num_edges} edges)")
-
-    backend = ngc.Backend.cpu()
-    algs = ngc.Algorithms(backend)
-    graph_handle = algs.build_graph(g)
-
-    # Warmup (results discarded, profiling stats reset after)
-    if not args.json:
-        print("\nWarmup...", end=" ", flush=True)
-        sys.stdout.flush()
-    _ = benchmark_spf(graph_handle, algs, num_nodes, min(10, args.spf_iters))
-    _ = benchmark_flow_placement(g, graph_handle, algs, min(5, args.flow_iters))
-    if hasattr(ngc, "profiling_reset"):
-        ngc.profiling_reset()
-    if not args.json:
-        print("done", flush=True)
-        print("\n" + "-" * 40)
-        print("Running benchmarks...", flush=True)
-        sys.stdout.flush()
-
-    spf_times = benchmark_spf(graph_handle, algs, num_nodes, args.spf_iters)
-    spf_stats = compute_stats("Shortest Paths (SPF)", spf_times)
-
-    flow_times = benchmark_flow_placement(g, graph_handle, algs, args.flow_iters)
-    flow_stats = compute_stats("Flow Placement", flow_times)
-
-    total_ops = args.spf_iters + args.flow_iters
-    total_time_ms = spf_stats["total_ms"] + flow_stats["total_ms"]
-    throughput = total_ops / (total_time_ms / 1000) if total_time_ms > 0 else 0
-
-    if args.json:
-        result = {
-            "version": ngc.__version__,
-            "profiling_enabled": profiling_enabled,
-            "config": {
-                "mesh_size": args.mesh_size,
-                "num_nodes": num_nodes,
-                "num_edges": num_edges,
-                "spf_iterations": args.spf_iters,
-                "flow_iterations": args.flow_iters,
-            },
-            "spf": {k: v for k, v in spf_stats.items() if k != "name"},
-            "flow": {k: v for k, v in flow_stats.items() if k != "name"},
-            "summary": {
-                "total_ops": total_ops,
-                "total_time_ms": total_time_ms,
-                "throughput_ops_per_sec": throughput,
-            },
-        }
-        print(json.dumps(result, indent=2))
-    else:
-        print_stats(spf_stats)
-        print_stats(flow_stats)
-
-        print("\n" + "=" * 60)
-        print("SUMMARY")
-        print("=" * 60)
-        print(f"Total operations: {total_ops}")
-        print(f"Total time: {total_time_ms:.1f} ms ({total_time_ms / 1000:.2f} s)")
-        print(f"Throughput: {throughput:.1f} ops/sec")
-
-        if profiling_enabled:
-            print("\n" + "-" * 40)
-            print("Profiling stats:", flush=True)
-            sys.stdout.flush()
-            ngc.profiling_dump()
-            sys.stderr.flush()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/dev/coverage_summary.py b/dev/coverage_summary.py
index ecd1b33..ae18ad9 100644
--- a/dev/coverage_summary.py
+++ b/dev/coverage_summary.py
@@ -10,46 +10,93 @@
 Defaults:
   PY_XML  = build/coverage/coverage-python.xml
   CPP_XML = build/coverage/coverage-cpp.xml
+
+A missing, unreadable or malformed report is an error (exit 1), never zero coverage, and so is a
+report that counts no line, which would otherwise show as 100%: gcovr writes one, and exits 0,
+when it reads no profile data (the profiles are not where it looks, or the filters match no
+file), and coverage.py when the files it measured hold no statement. A report carries both
+branch totals or neither, and covers at most what it counts. Each total is a count written in
+decimal digits, optionally with a zero fraction ("12" or "12.0"), and at most 2**63 - 1 (far
+beyond any real report); anything else (a sign, a nonzero fraction, an exponent, NaN or
+infinity) is malformed. The counts are read and compared exactly.
 """
 
 from __future__ import annotations
 
+import argparse
 import html
 import os
+import re
 import sys
 import xml.etree.ElementTree as ET
 from typing import Optional, Tuple
 
+# A count: decimal digits, optionally with a zero fraction (some tools write "12.0").
+_COUNT = re.compile(r"([0-9]+)(?:\.0*)?")
+_MAX_COUNT = 2**63 - 1
+
+
+class ReportError(Exception):
+    """A coverage report is missing, unreadable or malformed."""
+
 
 def parse_cobertura_totals(
     xml_path: str,
 ) -> Tuple[int, int, Optional[int], Optional[int]]:
     """Return (lines_valid, lines_covered, branches_valid, branches_covered).
 
-    Missing values are returned as None. If the file is missing, returns zeros/None.
+    The line totals are required; the branch totals are both None when the report has none.
+    Raises ReportError when the file is missing or unreadable, is not a Cobertura report,
+    holds a total that is not a count (the module docstring's spelling and bound), has one
+    branch total without the other, covers more lines or branches than it counts, or counts
+    no line (it measured nothing).
     """
-    if not os.path.exists(xml_path):
-        return 0, 0, None, None
-
     try:
         root = ET.parse(xml_path).getroot()
-    except Exception:
-        return 0, 0, None, None
+    except (OSError, ET.ParseError) as exc:
+        raise ReportError(f"{xml_path}: cannot read the report: {exc}") from exc
+    if root.tag != "coverage":
+        raise ReportError(f"{xml_path}: not a Cobertura report (root <{root.tag}>)")
 
-    def _to_int(value: Optional[str]) -> Optional[int]:
+    def _to_int(name: str, required: bool) -> Optional[int]:
+        value = root.attrib.get(name)
         if value is None:
+            if required:
+                raise ReportError(f"{xml_path}: no {name} total")
             return None
-        try:
-            # Some tools may write floats; coerce safely
-            return int(float(value))
-        except Exception:
-            return None
-
-    lines_valid = _to_int(root.attrib.get("lines-valid")) or 0
-    lines_covered = _to_int(root.attrib.get("lines-covered")) or 0
-    branches_valid = _to_int(root.attrib.get("branches-valid"))
-    branches_covered = _to_int(root.attrib.get("branches-covered"))
-
+        match = _COUNT.fullmatch(value)
+        if match is None:
+            raise ReportError(
+                f"{xml_path}: {name}={value!r} is not a count (a nonnegative integer)"
+            )
+        digits = match.group(1).lstrip("0") or "0"
+        if len(digits) > len(str(_MAX_COUNT)) or int(digits) > _MAX_COUNT:
+            raise ReportError(
+                f"{xml_path}: {name}={value!r} is above the largest count, 2**63 - 1"
+            )
+        return int(digits)
+
+    lines_valid = _to_int("lines-valid", True)
+    lines_covered = _to_int("lines-covered", True)
+    branches_valid = _to_int("branches-valid", False)
+    branches_covered = _to_int("branches-covered", False)
+    assert lines_valid is not None and lines_covered is not None
+    if lines_covered > lines_valid:
+        raise ReportError(f"{xml_path}: {lines_covered} lines covered of {lines_valid}")
+    if lines_valid == 0:
+        raise ReportError(
+            f"{xml_path}: the report counts no line (no coverage data was read, or the"
+            " measured files hold no statement)"
+        )
+    if branches_valid is None or branches_covered is None:
+        if branches_valid is not None or branches_covered is not None:
+            raise ReportError(
+                f"{xml_path}: branches-valid and branches-covered must both be present or both absent"
+            )
+    elif branches_covered > branches_valid:
+        raise ReportError(
+            f"{xml_path}: {branches_covered} branches covered of {branches_valid}"
+        )
     return lines_valid, lines_covered, branches_valid, branches_covered
 
 
@@ -70,10 +117,8 @@ def format_text_table(
     total_lines_valid = py_lines_valid + cpp_lines_valid
     total_lines_cov = py_lines_cov + cpp_lines_cov
 
-    # Branch totals only if present in both
-    have_branches = (py_br_valid is not None and py_br_cov is not None) or (
-        cpp_br_valid is not None and cpp_br_cov is not None
-    )
+    # Branch columns when either report has branch totals; a report without them counts 0 of 0.
+    have_branches = py_br_valid is not None or cpp_br_valid is not None
     total_br_valid = (py_br_valid or 0) + (cpp_br_valid or 0) if have_branches else 0
     total_br_cov = (py_br_cov or 0) + (cpp_br_cov or 0) if have_branches else 0
 
@@ -108,31 +153,40 @@ def format_html_table(text_table: str, title: str = "Combined Coverage") -> str:
 </head><body><h2>{html.escape(title)}</h2><pre>{pre}</pre></body></html>"""
 
 
-def main() -> int:
-    py_xml = (
-        sys.argv[1]
-        if len(sys.argv) > 1 and not sys.argv[1].startswith("--")
-        else "build/coverage/coverage-python.xml"
+def main(argv: Optional[list[str]] = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Combine the Python and C++ Cobertura reports into one summary."
     )
-    cpp_xml = (
-        sys.argv[2]
-        if len(sys.argv) > 2 and not sys.argv[2].startswith("--")
-        else "build/coverage/coverage-cpp.xml"
+    parser.add_argument(
+        "py_xml", nargs="?", default="build/coverage/coverage-python.xml"
     )
+    parser.add_argument("cpp_xml", nargs="?", default="build/coverage/coverage-cpp.xml")
+    parser.add_argument(
+        "--html", metavar="OUT_HTML", help="also write the table as HTML"
+    )
+    args = parser.parse_args(argv)
 
-    html_out: Optional[str] = None
-    for arg in sys.argv[1:]:
-        if arg.startswith("--html="):
-            html_out = arg.split("=", 1)[1]
-
-    py_totals = parse_cobertura_totals(py_xml)
-    cpp_totals = parse_cobertura_totals(cpp_xml)
+    try:
+        py_totals = parse_cobertura_totals(args.py_xml)
+        cpp_totals = parse_cobertura_totals(args.cpp_xml)
+    except ReportError as exc:
+        print(f"coverage_summary.py: {exc}", file=sys.stderr)
+        return 1
     text = format_text_table(py_totals, cpp_totals)
     print(text)
+    html_out: Optional[str] = args.html
     if html_out:
-        os.makedirs(os.path.dirname(html_out), exist_ok=True)
-        with open(html_out, "w", encoding="utf-8") as f:
-            f.write(format_html_table(text))
+        out_dir = os.path.dirname(html_out)
+        try:
+            if out_dir:
+                os.makedirs(out_dir, exist_ok=True)
+            with open(html_out, "w", encoding="utf-8") as f:
+                f.write(format_html_table(text))
+        except OSError as exc:
+            print(
+                f"coverage_summary.py: cannot write {html_out}: {exc}", file=sys.stderr
+            )
+            return 1
     return 0
 
 
diff --git a/dev/cpp-tests.sh b/dev/cpp-tests.sh
index aab39be..b1d452a 100644
--- a/dev/cpp-tests.sh
+++ b/dev/cpp-tests.sh
@@ -1,27 +1,128 @@
 #!/usr/bin/env bash
-# Propagate configuration, build, and test failures; bound local CPU use.
+# The C++ test runner (make cpp-test, cpp-test-off, sanitize-test, tsan-test, check-ci, cov).
+#
+#   bash dev/cpp-tests.sh MODE
+#
+#   MODE      private hooks  build type             build directory
+#   release   ON             Release (LTO)          build/cpp-tests
+#   off       OFF            Release (LTO)          build/cpp-tests-off   the shipped configuration
+#   sanitize  ON             Debug, ASan + UBSan    build/cpp-sanitize
+#   tsan      ON             Debug, TSan            build/cpp-tsan
+#   coverage  ON             Debug, --coverage      build/cpp-tests-cov   used by make cov
+#
+# Each mode has its own build directory and states every project option on the command line, so a
+# value cached by an earlier configure never decides this one. One generator (Ninja), parallelism
+# bounded by CMAKE_BUILD_PARALLEL_LEVEL (default 4), ctest fails when it finds no test, and every
+# configuration, build or test failure fails the script. The skipped tests are checked: none in a
+# hooks-on mode, exactly EXPECTED_OFF_SKIPS (the tests that need a hook) in mode off, so a test that
+# silently became hooks-only is caught.
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+# The C++ tests that need the private hooks and skip without them (GTEST_SKIP). Inside tests that
+# still run, three checks are weaker without them: the helper check_deletion
+# (min_cost_flow_deletion_tests.cpp) checks each re-solve's final result, but observes each repair step
+# only through the probe hook (see that file's header); PolicyFixtures.EveryFixtureReplaysIdentically
+# compares no trace, and PolicyFixtures.ACorruptedExpectationFails corrupts only what that replay
+# compares (see flow_policy_fixture_tests.cpp's header).
+EXPECTED_OFF_SKIPS="
+ApplyActions.ForwardingSizesCountEveryParticipant
+Concurrency.CacheLifecycleCannotBeOvertaken
+Concurrency.FailedAdmissionLeavesNoQueuedNodeOrLease
+Concurrency.LedgerReadsWaitAtTheSameGate
+Concurrency.PolicyReadinessFollowsEngineInstallation
+Concurrency.GateCoversExchangeAndEveryEpoch
+Concurrency.FailureBeforePublicationReleasesTheGate
+Concurrency.LowestWorkerFailureWins
+Concurrency.PartialThreadLaunchJoinsAndReleasesLease
+Concurrency.TunnelRosterChecksRunInParallelBeforeAdmission
+Concurrency.TunnelPreflightReportsTheLowestErrorBeforeLaterChecks
+Concurrency.TunnelPreflightJoinsAfterPartialLaunchFailure
+Concurrency.NativeArgumentsAreCopiedBeforeWaiting
+Concurrency.NativeEvaluatorInputsAreOwnedWhileQueued
+Concurrency.NativeCacheRootsAreOwnedWhileQueued
+Concurrency.FrozenTallyPublishesInsideTheLease
+DeadOccurrences.ForwardingSizesWithoutThem
+FlowCoreDeletion.CheckpointsEqualTheIterativeUpdate
+FlowCoreDeletion.RerunningTheFailedSearchAddsExactlyOneSearch
+FlowCoreDeletion.ScalarRepairStopsBeforeCancellation
+ForwardingSize.TheCallChecksEachCountInOrder
+GraphLayout.CombinedKeyPassesOnlyBelowNTimesKEqualsE
+GraphLayout.HashAndFallbackBoundaryAt65536DistinctCosts
+GraphLayout.ProbeBudgetFallbackInCollectionAndGrowth
+GraphLayout.ProbeBudgetIsCumulativeAcrossTheLargeTableGrowths
+GraphLayout.RadixFallbackDigitsOnBothSidesOfTheCombinedKeyBoundary
+GraphLayout.RunsOfEqualCostsSkipTheLookup
+Ksp.DeviationSkipsOnlySearchesComparedWithFullYen
+Search.QueueDispatchAtTheWidthLimit
+Sensitivity.ShortcutControlsPreserveEveryFieldAndClassifyCuts
+"
+
+die() { echo "dev/cpp-tests.sh: $*" >&2; exit 1; }
+
 jobs=${CMAKE_BUILD_PARALLEL_LEVEL:-4}
 case "$jobs" in ''|*[!0-9]*|0) echo 'CMAKE_BUILD_PARALLEL_LEVEL must be positive.' >&2; exit 2 ;; esac
-case "${1:-release}" in
-    release) build_dir=build/cpp-tests; build_type=Release; sanitize=OFF ;;
+mode=${1:-}
+hooks=ON; sanitize=OFF; tsan=OFF; coverage=OFF
+case "$mode" in
+    release) build_dir=build/cpp-tests; build_type=Release ;;
+    off) build_dir=build/cpp-tests-off; build_type=Release; hooks=OFF ;;
     sanitize) build_dir=build/cpp-sanitize; build_type=Debug; sanitize=ON ;;
-    *) echo 'Expected release or sanitize.' >&2; exit 2 ;;
+    # ThreadSanitizer (data races of the worker threads and the shared ShortestPathCache); the longest
+    # instrumented test takes about 30 s, inside the common timeout.
+    tsan) build_dir=build/cpp-tsan; build_type=Debug; tsan=ON ;;
+    coverage) build_dir=build/cpp-tests-cov; build_type=Debug; coverage=ON ;;
+    *) echo 'Usage: bash dev/cpp-tests.sh release|off|sanitize|tsan|coverage' >&2; exit 2 ;;
 esac
+
+command -v cmake >/dev/null 2>&1 || die "cmake not found on PATH (make dev installs it into venv/bin)"
+command -v ctest >/dev/null 2>&1 || die "ctest not found on PATH (make dev installs it into venv/bin)"
+command -v ninja >/dev/null 2>&1 || die "ninja not found on PATH (make dev installs it into venv/bin)"
+cache="$build_dir/CMakeCache.txt"
+if [[ -f "$cache" ]] && ! grep -qx 'CMAKE_GENERATOR:INTERNAL=Ninja' "$cache"; then
+    die "$build_dir was configured by another generator ($(sed -n 's/^CMAKE_GENERATOR:INTERNAL=//p' "$cache")); remove that directory and rerun"
+fi
+
 if [[ "$(uname -s)" == Darwin ]]; then
-    export CC="$(xcrun --find clang)"
-    export CXX="$(xcrun --find clang++)"
+    CC=$(xcrun --find clang)
+    CXX=$(xcrun --find clang++)
+    export CC CXX
     export MACOSX_DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-15.0}"
     leak_detection=0
 else
     leak_detection=1
 fi
-cmake -S . -B "$build_dir" -DNETGRAPH_CORE_BUILD_TESTS=ON \
-    -DNETGRAPH_CORE_SANITIZE="$sanitize" -DCMAKE_BUILD_TYPE="$build_type"
-cmake --build "$build_dir" --config "$build_type" --parallel "$jobs"
 if [[ "$sanitize" == ON ]]; then
-    export ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=$leak_detection}"
+    # A sanitizer report must fail, including during test discovery at build time. Append
+    # the failure settings after the caller's options; keep the platform's leak policy.
+    export ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=$leak_detection}:halt_on_error=1:exitcode=1"
+    export UBSAN_OPTIONS="${UBSAN_OPTIONS:+$UBSAN_OPTIONS:}halt_on_error=1:exitcode=1"
+fi
+if [[ "$tsan" == ON ]]; then
+    export TSAN_OPTIONS="${TSAN_OPTIONS:-second_deadlock_stack=1}:halt_on_error=1:exitcode=1"
+fi
+cmake -S . -B "$build_dir" -G Ninja -DCMAKE_BUILD_TYPE="$build_type" \
+    -DNETGRAPH_CORE_BUILD_TESTS=ON -DNETGRAPH_CORE_PRIVATE_HOOKS="$hooks" \
+    -DNETGRAPH_CORE_SANITIZE="$sanitize" -DNETGRAPH_CORE_TSAN="$tsan" \
+    -DNETGRAPH_CORE_COVERAGE="$coverage" -DNETGRAPH_CORE_NATIVE=OFF
+cmake --build "$build_dir" --parallel "$jobs"
+if [[ "$coverage" == ON ]]; then
+    # Test discovery runs each binary at build time and writes profiles that are no test's coverage.
+    find "$build_dir" -name '*.gcda' -delete
+fi
+log="$build_dir/ctest.log"
+ctest --test-dir "$build_dir" --output-on-failure --parallel "$jobs" --timeout 120 --no-tests=error \
+    2>&1 | tee "$log"
+
+# ctest reports a GTEST_SKIP as "***Skipped" (gtest_discover_tests' skip pattern).
+skipped=$(sed -n 's/^ *[0-9]*\/[0-9]* Test *#[0-9]*: \([^ ]*\) .*\*\*\*Skipped.*/\1/p' "$log" | LC_ALL=C sort)
+if [[ "$hooks" == OFF ]]; then
+    expected=$(echo "$EXPECTED_OFF_SKIPS" | sed '/^$/d' | LC_ALL=C sort)
+    if [[ "$skipped" != "$expected" ]]; then
+        diff <(echo "$expected") <(echo "$skipped") >&2 || true
+        die "the skipped tests differ from the expected hook-only tests (< expected, > skipped)"
+    fi
+    echo "hooks off: exactly the $(echo "$expected" | wc -l | tr -d ' ') expected hook-only tests skipped"
+elif [[ -n "$skipped" ]]; then
+    die "tests skipped in a hooks-on build: $(echo "$skipped" | tr '\n' ' ')"
 fi
-ctest --test-dir "$build_dir" --build-config "$build_type" \
-    --output-on-failure --parallel "$jobs" --timeout 120 --no-tests=error
diff --git a/dev/perf/README.md b/dev/perf/README.md
index d9c6cc0..ec79894 100644
--- a/dev/perf/README.md
+++ b/dev/perf/README.md
@@ -1,21 +1,427 @@
-# Performance tooling
-
-Developer-only tools for measuring NetGraph-Core. Nothing here ships in the
-wheel or the sdist, and nothing here is run by CI; the repository gates
-(`make check-ci`, `make sanitize-test`) remain the acceptance tests.
-
-- [`spf_queue/`](spf_queue/): the shortest-path frontier queue and workspace
-  work (plan, parity harness, old-versus-new bit-gate, NetGraph-level
-  benchmark, recorded A/B/A results and the independent review). Start with
-  [`spf_queue/PLAN.md`](spf_queue/PLAN.md).
-- [`../benchmark_profiling_overhead.py`](../benchmark_profiling_overhead.py):
-  SPF and placement micro-benchmark used for the PGO training run
-  (`make install-pgo`) and for measuring profiling overhead.
-
-Conventions for performance claims (see `AGENTS.md`): verify correctness
-first (bit-identical outputs where the contract is exact, certificates for
-flows), then measure old/new/old in fresh processes on one quiet machine,
-record load, hashes and raw samples, and treat differences inside the
-run-to-run band as inconclusive. The research record behind the queue work,
-including the Apple GPU investigation that preceded it, is in
-[`../research/`](../research/).
+# Timing tool (A/B/A)
+
+Developer-only tool for timing two builds of NetGraph-Core against each other, as `AGENTS.md`
+asks for every performance claim. Nothing here ships in the wheel or the sdist, and no timing
+runs in CI; only the tool's own tests do (below), and the repository gates (`make check-ci`,
+`make sanitize-test`, `make tsan-test`) stay the acceptance tests. Verify correctness first
+(bit-identical results where the library is exact, certificates for flows); time second.
+
+**A/B/A** means: the reference build A, the candidate build B, then A again, each block in a
+fresh process, repeated seven times; the candidate's time is compared with the mean of the two
+reference blocks around it, so slow drift of the machine cancels out. A bootstrap interval over
+the seven triples says whether a difference is real.
+
+| File | Role |
+| --- | --- |
+| `build.sh` | builds one harness binary against the Core of a revision or of the working tree, with its build record |
+| `harness.cpp`, `aba_rows.hpp`, `aba_api.hpp` | the harness: the rows (workloads, semantic work per iteration, digests) and the adapter that maps them onto the current public Core API (plus two private functions of the queue rule, below) |
+| `aba.py` | runs one A/B/A comparison: blocks, statistics, verdicts, `report.json`, `summary.md`, `blocks.csv`, `meta.txt` |
+| `queries/` | the frozen row inputs (`*.json`, `storage/inputs.json`) with their `SHA256SUMS` |
+| `test_tool.py` | the tool's own tests (`make perf-tool-test`) |
+
+## Quick start
+
+Compare the working tree (candidate) with a revision (reference); both binaries carry the same
+rows, each compiled against its own Core. Run on a quiet machine, nothing else running.
+
+```sh
+bash dev/perf/build.sh <ref-rev> build/perf/aba/ref       # e.g. HEAD, or main
+bash dev/perf/build.sh worktree build/perf/aba/cand
+venv/bin/python dev/perf/aba.py \
+    --old-bin build/perf/aba/ref/harness --new-bin build/perf/aba/cand/harness \
+    --old-label ref --new-label cand --rows "kernel.*,maxflow.*" --out build/perf/aba/run
+```
+
+`aba.py` needs Python 3.10 or newer (the venv's; macOS's system `python3` 3.9 is refused with a
+message). The run prints a plan (the expected duration of every row) before the first timed
+block, then one line per row, and writes `report.json`, `summary.md` (the table to read),
+`blocks.csv` (every block; in an aborted run, those of the finished warm-up pairs and triples)
+and `meta.txt` (every hash) to `--out` (default `dev/perf/results/<timestamp>/`, ignored by
+git). The run's verdict is the worst row verdict, and a row whose results differ between the two
+builds fails: the tool compares two builds of the current Core, so a change it times (an
+optimisation) must leave every result identical. A change that is meant to change results is
+checked for correctness by the test suites, not timed against the old results. The adapter
+`aba_api.hpp` is written against the current public API, apart from the queue check of the
+storage search rows, which reads the library's queue rule through the private
+`detail::bucket_width` and `detail::uses_buckets`: a reference revision with another API needs
+the adapter adapted first.
+
+**Across an API change.** To compare with a reference revision whose API this adapter does not
+compile against, build the reference harness in a checkout of that revision instead, with its
+own driver adapted to its API and the same rows (`bash dev/perf/build.sh worktree OUT_DIR` in that
+checkout), move its `harness.json` aside so that the run does not refuse it for carrying another
+driver, and pass the binary as `--old-bin`. The run still requires both harnesses to list the same
+rows, record for record, and `report.json` records that side's build record as empty.
+
+**Exit statuses and acceptance.** `aba.py` exits 0 when the run completed, whatever its verdict
+and conformance; 1 when it aborted after starting blocks; 2 when it refused an input or failed
+before the first block; 130 for Ctrl-C before the first block. Every failure writes its reason
+to `report.json` and `summary.md`, with verdict `aborted` and conformance false. A reason names
+the side, mode and row when it comes from a block. A refusal before row selection writes a
+minimal report with no rows. A failed harness, malformed response, changed or unreadable binary,
+non-finite derived value, operating-system error, internal exception or Ctrl-C ends the run.
+The first Ctrl-C stops the active harness; later interrupts are held while the outputs are
+written. An interrupt during final writing records an abort and rewrites both outputs.
+
+Both files are created before the first block. Each final output is attempted even if another
+fails; text that cannot be formed is replaced by a minimal abort record. Complete output text
+replaces its file in one operation; if directory permissions no longer allow replacement, an
+existing writable file is retried directly with the abort reason. An invalid, ambiguous,
+occupied or unwritable `--out` cannot receive a new report; existing unrelated files are never
+overwritten. A persistent write failure (for example a full disk), or a process killed by an
+uncatchable signal, can prevent output. Write failures are also reported on stderr. `--help`
+prints help and writes no run files. Both outputs list every selected row with the step it reached: `measured`, and in an
+aborted run `not run`, `warm-up` (its warm-up step did not finish: a warm-up block failed, or a
+count or the expected duration derived from them is not finite), `planned` (warmed up, not
+timed) or `timing` (its timed step did not finish: a timed block failed, or a row statistic
+derived from them is not finite). A run killed by another signal writes nothing more. Its exit
+status is no acceptance: a run is accepted when it is conforming and its verdict is `pass`, the
+first two items of `summary.md` (and `report.json`'s `conforming` and `verdict`).
+
+## Building the two sides
+
+`build.sh` requires `bash`, `git`, `tar`, `python3` and the compiler on `PATH` (on macOS,
+`xcrun` for an explicitly selected compiler). `vtool` supplies optional build diagnostics.
+
+`bash dev/perf/build.sh REV OUT_DIR` compiles this checkout's `harness.cpp` (with `aba_rows.hpp`
+and `aba_api.hpp`) against the Core sources of `REV`: `worktree` takes this checkout's `include/`
+and `src/` with their uncommitted changes; a git revision is extracted with `git archive` into
+`OUT_DIR/src`. `REV` is required (there is no default reference), and a revision git does not
+know is refused. `OUT_DIR` must be absent or empty; it receives `harness` and the build record
+`harness.json`. The compiler is `clang++` from `PATH` with the first `flags=(...)` line of
+`build.sh` (`-std=c++20 -O3 -DNDEBUG -funroll-loops -fno-math-errno -fno-trapping-math
+-falign-functions=64 -Wall -Wextra`). `CXX` overrides the compiler; on macOS a set `CXX` also gets `-isysroot "$(xcrun
+--show-sdk-path)"` (a toolchain compiler such as `$(xcrun --find clang++)` finds no system headers
+without it), and a set `CXX` without an SDK is refused. A refusal exits 2. A failed compile exits
+with the compiler's status, and a failure while the build record is written exits non-zero;
+either leaves neither `harness` nor `harness.json` (a revision's extracted sources stay in
+`OUT_DIR/src`, so a second attempt needs another or an emptied `OUT_DIR`).
+
+Function alignment reduces timing variation due to code placement. Build both sides with
+the same flags. The script enables neither `-march=native` nor PGO. These harness flags do not
+change the package wheels' Release flags.
+
+### Build records
+
+`harness.json` names everything that changes the binary's bytes:
+
+| Field | Meaning |
+| --- | --- |
+| `binary`, `binary_sha256` | the output path and the hash of the file written there; the file name is part of the bytes (below) |
+| `rev`, `commit`, `dirty_core_paths` | the revision asked for, its commit (`HEAD` for `worktree`), and for `worktree` the number of paths `git status --short` lists under `include/` and `src/` (0 for a revision) |
+| `core_sources_sha256` | sha256 of `"<sha256>  <path>\n"` lines over every file under the `include/` and `src/` compiled against (the checkout's or the extracted ones), sorted by path; a path with a part that starts with a dot is left out |
+| `driver_sha256` | the sha256 of `dev/perf/harness.cpp` and of every `dev/perf/*.hpp`, by path |
+| `compiler`, `compiler_path`, `cxx_env` | the compiler's `--version` line, the program the name resolved to on `PATH`, and `CXX` as given (null when unset) |
+| `flags`, `isysroot` | the flags passed (`-isysroot <SDK>` included when added), and that SDK path (null when none was passed) |
+| `sdk.path`, `sdk.version`, `sdk.sdkroot_env`, `sdk.source` | the SDK `xcrun` names (the one the `clang++` shim and `-isysroot` use) and `SDKROOT`, which overrides the shim's choice; path and version null when `xcrun` names no SDK |
+| `deployment_target.requested` | `MACOSX_DEPLOYMENT_TARGET` (null when unset: the compiler then targets the SDK's own OS version) |
+| `deployment_target.effective_minos`, `binary_sdk`, `platform`, `raw`, `source` | the minimum OS and SDK version the binary carries, read back from its `LC_BUILD_VERSION` load command with `vtool -show-build` (the first value of each when the binary carries several; `raw` has every line) |
+| `built_by` | `dev/perf/build.sh` |
+
+Besides the sources and the flags, the bytes depend on the **deployment target** (the same
+sources built with `MACOSX_DEPLOYMENT_TARGET=15.0` and without it differ), the **output file
+name** (the linker signs every arm64 binary ad hoc with the file name as the signature's
+identifier, and the binary's UUID follows; copying a binary keeps its bytes, the name at link
+time is what counts), the **SDK** and the **compiler**. A pinned binary hash is reproducible
+only with all of them equal. `aba.py` refuses a binary whose hash differs from its record. Every field in the table is
+required and no other key is accepted, including inside `sdk` and `deployment_target`.
+All values are strings except `dirty_core_paths` (a finite nonnegative integer), the three
+objects `sdk`, `deployment_target`, `driver_sha256`, and these nullable strings: `compiler_path`, `cxx_env`, `isysroot`, `sdk.path`, `sdk.version`,
+`sdk.sdkroot_env`, and `deployment_target.requested`, `effective_minos`, `binary_sdk`, `platform`,
+`raw`. A null means the value was unavailable or the environment variable was unset. `binary_sha256` and `core_sources_sha256` are 64 lowercase hexadecimal digits;
+`driver_sha256` has exactly this checkout's driver paths and matching hashes. Descriptive
+strings are recorded as text; the old build path, revision and compiler are not re-executed or
+used to locate inputs.
+
+## Protocol
+
+**Blocks.** Each block is a fresh process of one side's harness running one row: setup
+(untimed), one untimed iteration that fixes the reference digest, then a fixed iteration count
+with every iteration timed; the harness reports the median iteration time and `block_s`, its own
+wall-clock measurement of the timed loop. Every iteration must return the reference digest (else
+the harness exits 3 and the run aborts), which the block line carries as 16 lowercase hexadecimal
+digits. A block's whole output is its response, and the run
+aborts unless it is exactly one block line for the requested row ended by a newline, with
+nothing before or after it (a usable line is never picked out of a broken response). A block
+line is malformed, and aborts the run, when it is not one JSON object, names a key twice or a
+key outside the listed fields, or a required number is missing, of another type, not finite (an integer beyond the largest
+float counts as not finite) or outside its domain: the iteration count is an integer in [1, 2^63 - 1]; the median iteration
+time and the harness's own peak RSS are positive; `block_s`, `setup_s` and the children's peak
+RSS may be 0 (the harness prints the two times rounded to microseconds, and starts no child
+process); the statistics no rule reads (`mean_s`, `min_s`, `p10_s`, `p90_s`, `max_s`) are
+nonnegative when present. A timed block must report the iteration count it was given. The
+numeric options are checked the same way (`--tolerance`, `--rss-floor-mib` and
+`--calibration-margin` may be 0, `--seed` is an integer of either sign within the finite float range, the others are positive), and the
+values derived from them must be finite (`--target-seconds` times one plus the margin, the floor
+in bytes). "Inputs" below lists every input's rule.
+
+**Derived values.** Every number of a block line is finite, and every one but the iteration
+count is read as a float, but arithmetic on huge ones need not be finite: the mean of two
+medians near 1e308 is infinite, and a ratio against it would read 0, a false pass. So a value
+derived from the blocks that is not finite (a mean of A1 and A2, a ratio, the statistic, its
+interval, the drift, a median, a peak sum, the memory allowance, a calibrated count, an expected
+duration or a finish time beyond any date) aborts the run before the row's statistics or verdict
+are recorded or printed.
+
+**Per row.** One warm-up block per side (discarded; it calibrates the iteration counts), then
+seven triples A1, B, A2 in that order (fewer only with `--allow-short`, which labels the run
+"not gate evidence"). The counts are **per side**: `ceil(target * (1 + margin) / median_side)`
+from that side's own warm-up block (a calibrated count above 2^63 - 1 aborts with the side and row named) (`--target-seconds`, default 2, `--calibration-margin`,
+default 0.10), so every block on either side lasts about the target even when the two sides'
+speeds differ by orders of magnitude. A1 and A2 share side A's count. `--iters` pins the counts
+instead (below). The block value is the median iteration time, so the ratio does not depend on
+the counts. The warm-up blocks of every selected row run first; the expected duration of every
+row and of the run is printed and stored (`report.json` `plan`, each row's `expected`) before
+the first timed block.
+
+**Statistics.** `r_t = B_t / mean(A1_t, A2_t)`; the statistic is `median_t(r_t - 1)`; its 95
+percent percentile interval comes from `--resamples` (default 10,000) bootstrap resamples of
+whole triples, seeded with `--seed`; drift is `median_t |A1_t / A2_t - 1|`.
+
+**Verdicts per row.**
+
+* timing: `inconclusive` when the drift exceeds the tolerance (`--tolerance`, default 0.03),
+  else `pass` when the interval's upper bound is within the tolerance, else `fail`;
+* blocks: `fail` when any timed block's `block_s` is below `--target-seconds`;
+* same-side clusters: per side, the timed blocks' per-iteration times sorted; a gap between two
+  consecutive blocks above the tolerance with at least two blocks on each side marks the side
+  `bimodal` and fails the row even when the median passes;
+* memory (below);
+* digests: every timed block of both sides must report one and the same digest.
+
+The row is `fail` if any check fails, else `inconclusive` if timing is, else `pass`. The run's
+verdict is `aborted` when the run aborted, else the worst row verdict. A run is **conforming**
+(gate evidence) only when it did not abort, `--allow-short` was not given (without it fewer than
+seven triples or a target below 2 s are refused; a measured block shorter than the target fails
+its row), no timed block was short and the
+allocator environment is normal; the summary's first line says which.
+
+**Memory.** Each block's peak RSS (resident set size: the memory the process holds in RAM) of the
+harness process tree is the larger of the harness's own `getrusage` (self + children)
+`ru_maxrss` and `ru_maxrss` from the orchestrator's `os.wait4` (macOS reports bytes, Linux KiB,
+converted). The harness's own record of the iteration times is the same in every block, whatever
+its iteration count: allocated and written before the row's setup, it keeps a count per duration
+below 65,536 clock ticks (65.5 µs with the nanosecond clocks of macOS and Linux) and a list of
+the longer ones with 65,536 slots, which grows only past 4.3 s of such iterations in one block
+(1 MiB of bookkeeping in all; its statistics are those of the sorted list of every iteration's
+time). A faster side runs more iterations, and a record that grew with them would count in its
+peak. Reference = the largest A1 block peak, candidate = the largest B block peak (over the
+timed triples); the row fails when the candidate exceeds `max(1.10 * reference, reference + 8
+MiB)` bytes (`--budget`, `--rss-floor-mib`). A1, the first reference block of every triple, is
+fixed in advance: a larger A2 peak or a larger warm-up peak never rescues a failure. Why the
+maxima: macOS's allocator keeps freed large blocks in a cache whose pages stay resident, so on
+several rows the block peaks of any build land on one of two levels about 9 to 10 MiB apart at
+random; medians can fall on different levels by chance and fail identical binaries, while the
+largest peaks of both sides reach the upper level. A row records `rss_a1_max_bytes`,
+`rss_b_max_bytes`, `rss_allowance_bytes`, `rss_balanced_ratio`, `rss_a2_max_bytes` (a
+diagnostic) and `rss_verdict`. The check compares the largest observed peaks; it is no absolute
+memory bound.
+
+**Allocator environment.** `aba.py` neither sets nor clears an allocator variable
+(`MallocLargeCache=0` would hide the cache levels and with them a candidate's genuine peak). It
+records the harness's environment in `report.json` `allocator_env` and on the summary's
+"allocator environment" line: whether `MallocLargeCache` is set, and every variable whose name
+starts with `Malloc` or `MALLOC_` or is `DYLD_INSERT_LIBRARIES`, `LD_PRELOAD` or
+`GLIBC_TUNABLES`. A run with any such variable is not conforming.
+
+**Provenance.** `meta.txt` lists the sha256 of both harness binaries (each checked against its
+build record when it has one) and of the orchestrator and driver sources (`aba.py`,
+`harness.cpp`, `aba_rows.hpp`, `aba_api.hpp`, hashed at the start). A side's binary is
+re-hashed before and after every block and at the end of the run; a difference, or a binary
+that can no longer be read, aborts the run. `--expect-meta meta.txt` refuses to start unless
+every hash equals a previous run's (the refusal names the hashes that differ). Both sides'
+harnesses run in the repository root with the environment `aba.py` was started in, unchanged:
+`aba.py` sets and clears no variable.
+
+**Machine state.** Each block records the 1-minute load before and after; the summary has a
+machine-state line (load averages, top CPU consumers) at the start and the end of the run.
+
+### The sides
+
+Every selected row runs as A1 = `--old-bin`, B = `--new-bin`, A2 = `--old-bin` with every rule
+above: two builds of the current Core. Both must run this checkout's driver (`build.sh` builds
+them so): the two harnesses must list the same rows, record for record, and a side's build
+record, when it has one, must carry this checkout's driver as its `driver_sha256`: exactly the
+driver files `meta.txt` names (`harness.cpp`, `aba_rows.hpp`, `aba_api.hpp`), each with the
+sha256 it has at the start of the run; else the run is refused, so a harness built before the
+rows or the adapter changed is not timed. A side without a build record is not checked this way
+(`report.json` records its build record as empty).
+
+### Selecting rows
+
+`--rows` takes comma-separated globs over row names and groups (`all`, `construct.*`,
+`kernel`); spaces around a glob are ignored, and no text means `all`. **A glob that matches no
+row or group refuses the run** before any block, with the list of the groups that exist, even
+beside globs that match. The report records, per glob, the rows it selected and the rows of its
+groups it did not, and per group the rows the whole selection left out.
+
+Other options: `--iters row=N,...` (both sides) or `row=NA:NB,...` (per side) pins the timed
+blocks' iteration counts of a row in place of the calibrated ones (every item names a selected
+row, once; a count is at most 2^63 - 1, the largest the harness reads); `--triples` (default 7,
+fewer only with `--allow-short`, "Per row" above); `--seed` (default 20261003) and
+`--resamples` of the bootstrap; `--old-label` and `--new-label` (defaults `old` and `new`; two
+different labels, below); `--out` (absent or empty).
+
+**Names.** A row's name and its group are 1 to 64 of the characters `a`-`z`, `0`-`9`, `.`,
+`_` and `-`; a side's label is 1 to 32 of `a`-`z`, `0`-`9`, `_` and `-` (no dot). They make the
+stderr logs' names, `blocks/<row>.<label>.<mode>.stderr`, and the fields of `meta.txt`'s lines:
+lower case only, so no two names share a log on a file system that ignores case, and no dot in a
+label, so a log's name splits back into one row, label and mode. A log collects the stderr of
+every block of its row, side and mode, in run order; a log that is still empty after a block is
+removed, and an abort for a block names the log only when that block wrote to it ("nothing on
+stderr" otherwise). A path the run records (the binaries', `--out`, `--expect-meta`, this
+directory's) has printable characters only: no tab, line break or other control or separator
+character but the space.
+
+### Inputs
+
+Everything `aba.py` reads that it did not produce in the same process has a rule, checked where
+it is read; anything else is refused (exit 2 before the first block) or aborts the run (once
+blocks have run). Only the keys listed below are accepted, with plain scalar values except the build record's
+three explicitly listed objects. JSON is read with no key twice in an object (Python's reader would otherwise
+keep the last value of a repeated key).
+
+| Input | Rule |
+| --- | --- |
+| a harness response (every mode) | exit 0; UTF-8 lines, each ended by a newline and each one JSON object; nothing else |
+| `aba-list` | at least one row; each a string `row` and a string `group`, each a name ("Names" above) (`desc`, `queries` strings when present); no other keys; no row twice; the same list, record for record, from both harnesses |
+| `aba-run`, `aba-calibrate` | exactly one record; required keys `row`, `iterations`, `median_s`, `block_s`, `setup_s`, `digest`, `rss_self_bytes`, `rss_children_bytes`; optional `mean_s`, `min_s`, `p10_s`, `p90_s`, `max_s`; no others. The row is the requested one, its numbers as in "Blocks" above, its digest 16 lowercase hexadecimal digits; `aba-run`'s count the requested one; the values derived from them finite ("Derived values" above) |
+| `--rows` | the characters of names, the glob characters `*`, `?`, `[`, `]` and `!`, commas and spaces; every glob matches a row or a group on its own; at least one glob |
+| command line | full option names only, each at most once; argparse checks required options and value types; raw arguments are strings, recorded only after all checks pass |
+| numeric options | of their type, finite, in their domain ("Blocks" above); the values derived from them finite |
+| `--iters` | every item `row=N` or `row=NA:NB` (positive integers up to 2^63 - 1) naming a selected row, once |
+| `--expect-meta` | a printable path; UTF-8, newline-ended lines: `#` comments; `label`, side A/B, valid label (tab-separated, side at most once); or exactly five tab-separated hash fields: A/B, `binary`, `harness`, sha256, printable path; or `run`, `source`, one of the four source files, sha256, printable path. No hash named twice, at least one; exactly this run's hash names and values |
+| `--old-bin`, `--new-bin` | a readable file whose resolved path is printable; its build record (`<resolved path>.json`; a `.json` beside a symbolic link to the binary that is not that file is refused), when there is one, the complete typed object of "Build records", whose `binary_sha256` is the binary's and whose `driver_sha256` is this checkout's driver ("The sides" above) |
+| `--old-label`, `--new-label` | two different labels ("Names" above; they name the sides in every block, stderr log and `meta.txt`) |
+| `--out` | a printable path, absent or an empty directory (the stderr logs append; an earlier run's files would mix in) |
+| operating-system errors | before the first block a refusal, from the first block on an abort ("Exit statuses" above) |
+| the environment | OS-provided string keys and values, passed to the harness unchanged; allocator variables recorded by the prefix/name rule above (a run with one is not conforming); `PATH` resolves diagnostic commands; no other environment value is interpreted by the driver |
+| system readings | block loads, elapsed times and wait4 peak: finite nonnegative numbers, checked before storage; CPU count: positive integer or null; machine load: three finite nonnegative numbers, or null when unavailable. CPU/platform names and timestamps are text |
+| diagnostic commands | `ps`: decoded text with replacement for bad UTF-8; among its first five lines only a finite nonnegative CPU share and nonempty command name are kept; unavailable output means no consumers. `sysctl`: decoded text, or empty when unavailable |
+| other file reads | binary and source contents are arbitrary readable bytes, hashed by sha256; log sizes are OS file sizes used only to name a nonempty stderr log; `--out` directory entries only test emptiness. The query JSON and hash files are not read by `aba.py`: their frozen values are compiled into the harness, and the tool tests check them against those files |
+| the Python running `aba.py` | 3.10 or newer |
+
+## Rows
+
+`harness aba-list` prints every row as JSON (`row`, `group`, `desc`, and `queries` for a row
+with a frozen query list: the file and its sha256). The harness's other modes are `aba-run ROW N`
+(`N` a positive integer) and `aba-calibrate ROW SECONDS` (`SECONDS` a positive number). Exit
+status 1 is a failure inside an iteration (the untimed first one included), 2 a usage error or
+an unknown row, 3 a digest that changed between iterations, 4 a row whose input or setup check
+failed.
+
+| Group | Rows | Work per iteration |
+| --- | --- | --- |
+| `spf` | `spf.full.{random16k,clos,grid10k,elig_residual16k,wide_fallback16k}` | 8 (grid: 4) full forward searches; `elig_residual16k` with static exclusions and a capacity-gated residual; `wide_fallback16k` with costs up to 2^20 (the heap) |
+| `spf` | `spf.dag.{near65k,far16k}` | 64 / 8 searches to frozen targets (`queries/near65k.json`, `far16k.json`) |
+| `spf` | `spf.to.random16k`, `spf.to.targetset_clos` | 8 reverse searches; 16 reverse searches rooted at a destination set (`queries/targetset_clos.json`) |
+| `spf` | `spf.single.canonical16k` | 8 canonical single paths to frozen targets (`queries/canonical16k.json`) on the residual |
+| `construct` | `construct.random65k`, `construct.clos` | graph construction from arrays, unit conversion included |
+| `kernel` | `kernel.{proportional,eb,lossy}.clos`, `kernel.{proportional,eb}.grid`, `kernel.weighted.clos` | placements on fixed ShortestPaths DAGs into one ledger |
+| `capacity` | `capacity.costonly_{eb,prop}.failures` | ShortestPaths capacity over 32 failure states x 8 pairs |
+| `maxflow` | `maxflow.exact.{totals,detailed}` | exact maximum flow over 8 failure states x 4 pairs |
+| `sensitivity` | `sens.exact`, `sens.policy_all_edges`, `sens.equal_global` | exact-model sensitivity; policy-model loss for every eligible edge; equal-source-allocation CentralizedTE, every edge solved afresh |
+| `sensitivity` | `sens.exact.{cut,partial,branch,reroute,capped}` | full exact-model sensitivity calls on a 64-link saturated chain, 32 partial-repair branches, 32 branches with a second upstream route and a shared downstream cut, 32 branches with a parallel upstream member and a downstream cut, and the chain at binding offer 1; nonuniform costs, baseline/classification/copies/results included |
+| `pooled` | `pooled.{ecmp,lossy}.clos`, `pooled.from_dag.clos`, `pooled.from_dag_build.clos` | 8 demands of 8 pooled sources on one ledger, Lossless / Lossy above capacity; the same demands by Pinned over prebuilt `from_dag` programs, and building those programs |
+| `global` | `global.equal.random` | equal-source-allocation CentralizedTE capacity, 2 demands of 4 sources |
+| `program` | `program.forward.global`, `program.replay.lossy`, `program.stale.lossy`, `program.replace.costonly`, `program.ring.lossy` | forwarding programs: a CentralizedTE program forwarded, replayed under failures (Lossy), stale under black holes, ShortestPaths pooled replace with retained static preparation and current released-view forwarding; a 64-head program on a ring of 64 links whose 64 barriers form one cyclic group (6 rounds) |
+| `batch` | `batch.{scalar,ordered,simultaneous}.clos`, `batch.simultaneous.ring` | several demands at once: the 8 pooled Lossy demands as 8 scalar `replace` calls, one ORDERED `apply_actions` list (the same work and digest) and one SIMULTANEOUS list (the joint evaluator; the demands share no link, so the same digest); the ring's 64 tunnels as 64 policies in one SIMULTANEOUS list (the same traffic amounts and digest as `program.ring.lossy`; 64 publishing policies against one, so a 2x operating budget that includes their per-policy bookkeeping) |
+| `t1` | `t1.setup.fabric`, `t1.forward.fabric` | T1 with 16 tunnels per head, 12 demands on one ledger: the setup with its holds; the installed programs forwarded under 32 offers |
+| `t2` | `t2.exact16.headroom`, `t2.exact16.cost`, `t2.upto256.headroom`, `t2.size.mesh` | T2 on the same fabric and demands: 16 tunnels per head with and without `prefer_headroom`, up to 256 with it; 16 tunnels for 10 heads on a 500-node mesh (2000 links, 5/8 to 8/8 free), sizing-dominated |
+| `msd` | `msd.loop`, `msd.loop.epochs` | the same maximum-supported-demand bracket, bisection, 64 demands and offers with a per-series DAG cache; `loop` creates a fresh ledger and policies per probe, `loop.epochs` keeps one ledger and its policies and removes every policy before each probe |
+| `ksp` | `ksp.fabric3_k8` | k = 8 shortest paths for 8 pairs |
+| `ksp` | `ksp.longprefix_k64` | 96-edge common prefix and 64 branches, k = 64; all prefix and result work timed |
+| `ksp` | `ksp.weighted_k32` | random 128 x6, seed64, four pairs, k = 32 |
+| `ksp` | `ksp.collapse` | 12-hop parallel prefix, 32 branches, HIGHER_CAPACITY Collapse |
+| `ksp` | `ksp.ties` | 64 equal-cost branches, each of the four tie rules |
+| `ksp` | `ksp.k1` | the long-prefix population with k = 1 |
+| `cache` | `cache.cold`, `cache.warm`, `cache.frozen.reads` | 64 direct lookups from a cleared, prepopulated building, or prepopulated frozen cache |
+| `concurrency` | `concurrency.place_zero`, `delivered`, `program`, `config` | 10,000 calls of one operation on a prepared one-link policy (capacity 16, cost 3, q=1, replace(4)); config is the immutable control |
+| `concurrency` | `concurrency.two_ledgers_serial`, `concurrency.two_ledgers_parallel` | 32 evaluate(32) calls on each independent ledger, reading the static preparation installed during setup; 384-node/2816-edge layered graph, q=1, capacity 64, two thread launches and joins in both modes |
+| `eligibility` | `eligibility.build_intersect` | 64 failure states built and intersected |
+| `construct` | the fourteen storage construction rows (`construct.wgrid256`, `fanout_clos`, `random1m_nat`, `random1m_scat`, `wide65k`, `k65536`, `k65537`, `star1m`, `sparse1m`, `empty1m`, `random65k_bprime`, `random65k_reversed`, `star1m_smallk`, `instar1m_smallk`) | the constructor on prepared input: many short rows, the sort fallback above 65,536 distinct costs and both sides of that limit, very long rows, mostly isolated nodes, an empty graph, input already in or reversed from edge-id order |
+| `spf` | the six storage search rows (`spf.to.{wgrid256,random1m,wide_fallback16k,width65536,width65537}`, `spf.full.random1m`) | 8 full searches each: the bucket queue, a large scattered graph, the heap, and both sides of the bucket-width limit 65,536 |
+
+Every row's `desc` (in `aba-list`) describes its input and its work; the generators, seeds and
+sources are in `aba_rows.hpp`. The row names are fixed (the frozen inputs and earlier reports
+name them): `proportional` and `prop` in a name mean the OPTIMIZED route allocation, and `lossy`
+means the EQUAL route allocation with LOSSY admission.
+
+The tiny native operation rows use added time per call against the same row on the reference:
+at most 0.1 microseconds for a gated call. The two direct-hit cache rows have the same
+0.1-microsecond allowance per lookup; `cache.cold` keeps the ordinary 3% tolerance. The immutable
+configuration control keeps the ordinary tolerance. For two ledgers compare candidate serial
+against candidate parallel on identical work, with a speedup target of at least 1.5; both modes
+include two thread launches/joins. These budgets are interpreted separately from the default
+percentage verdict of `aba.py`. Correctness checks assert full delivery (one unit per head,
+below every link's capacity) before accepting a time.
+
+**The storage rows** exercise the graph's storage and construction. Every input comes from a
+generator in `aba_rows.hpp` (`storage_inputs()`) with fixed seeds, one random draw per
+statement, explicit costs and positive integral capacities. Their timed digests read only
+API-independent values (node-indexed counts and distances, costs, physical capacities, edges
+named by their input position) on 16 sampled nodes. A search row also checks its queue in setup
+(exit 4 otherwise): the library's choice (the bucket width W and buckets or heap) and the width
+read from the input (max cost / cost GCD + 1) must both equal the frozen expectation, and its
+roots must be the rule's `(i * 997 + 1) mod N`. A sampled digest is not correctness evidence.
+
+### Frozen inputs
+
+The destination rows' targets, the endpoint set and the storage inputs are frozen, so every
+build works on exactly the same queries: `queries/*.json` with `queries/SHA256SUMS` (each query
+list with its row, its input generator and digest, and its rule), `queries/storage/inputs.json`
+with `queries/storage/SHA256SUMS` (each storage input's shape, full-content digest and
+`input_sha256`, and each storage search row's roots and queue), and the two frozen blocks and the
+storage search table of `aba_rows.hpp` that compile their values in. A row refuses an input its
+generator no longer reproduces (exit 4): the query lists by the input digest, the storage inputs
+by their shape and full-content digest. The byte hashes inside the JSON files (`arrays_sha256`,
+`input_sha256`) record the inputs as they were frozen; no tool in the checkout recomputes them or
+regenerates the frozen files. A deliberate change of a generator needs new values in the JSON
+files, their `SHA256SUMS` and `aba_rows.hpp` together, and the tool's tests check that they agree
+(and that every frozen width up to 65,536 takes the buckets and every wider one the heap).
+
+## The tool's own tests
+
+```sh
+make perf-tool-test          # or: venv/bin/python -B dev/perf/test_tool.py -v
+```
+
+Run them whenever a file under `dev/perf/` changes. CI runs them on one job (macOS, Python
+3.14): the adapter compiles against the library's API and two private functions, so a library
+change that breaks the tool fails there. They need Python 3.10 or newer, `git`, `tar`, `python3` and `clang++` on
+`PATH` for one unoptimised build of the harness's driver and Core (a few seconds); they time
+nothing. They test the rules of this file:
+
+* `aba.py` end to end with fake harnesses (short Python scripts that answer like the harness):
+  the protocol's block order and counts, every verdict rule, the exit statuses and the summary's
+  first lines, every input of "Inputs" (each refusal and each abort, operating-system errors
+  before and after the first block included), every abort again with several rows selected
+  (each row's status in both outputs), an interrupt during the blocks, a second one while the
+  first is handled, and one while the final outputs are written (a fake `ps` sends it), the
+  child environment, the allocator record and the stderr logs; and its parts directly: the
+  memory rule's boundary, the bootstrap interval, the cluster rule, the row selection, the
+  block-line parser, a block's stderr log, derived values that are not finite, the SIGINT handler
+  and the hashes of the tool's sources;
+* `build.sh` with a fake compiler (no real build) in a scratch repository of two revisions:
+  its refusals, a failing compile, a failing build-record step, the sources of the revision asked
+  for, and every field of its build record;
+* the harness's driver compiled with a few extra test rows: `aba-list`, one iteration of every
+  row, the block line (its own peak RSS in bytes, the same for 1,000 and 2,000,000 iterations;
+  its statistics against the sorted list of the same times), every exit status, and the
+  frozen-input, root and queue checks;
+* the frozen files: both `SHA256SUMS` files, and the values compiled into `aba_rows.hpp` against
+  the JSON files (each storage row on its input).
+
+The `sens.exact`, cut/repair population and `sens.policy_all_edges` rows also have
+`.w2` counterparts: the identical full query on two workers. Unsuffixed rows use one worker.
+
+### Captured source weights
+
+`program.increment.optimized` includes controller computation/export, a Pinned LOSSY policy,
+32 positive `place` calls and teardown. It reaches cumulative captured-weight injection and is
+a common baseline/candidate regression row. `program.increment.weighted` exercises declared
+unequal weights; `.wide` uses five weights `2^62-1` and crosses 64-bit cumulative totals.
+`program.replay.weighted` is the separate full-offer `replace` control. `global.weighted.random`
+and `sens.weighted_global` cover weighted-source optimization and fresh deletion solves.
+The new model rows have no pre-feature baseline; run them separately. Tool correctness checks
+all source quotas and complete row digests against independent ordinary/wide histories.
diff --git a/dev/perf/aba.py b/dev/perf/aba.py
new file mode 100644
index 0000000..2da7d30
--- /dev/null
+++ b/dev/perf/aba.py
@@ -0,0 +1,2215 @@
+#!/usr/bin/env python3
+"""A/B/A comparison of two Core timing harness binaries (README.md in this directory).
+
+    venv/bin/python dev/perf/aba.py --old-bin REF --new-bin CAND [options]
+
+A (``--old-bin``) is the reference build and B (``--new-bin``) the candidate, each the rows of
+``aba_rows.hpp`` compiled against one Core (``build.sh``). Every selected row runs one warm-up
+block per side, then A1, B, A2 triples, each block a fresh harness process; the row's statistics
+and verdicts follow, and a row whose blocks do not all report one and the same digest fails.
+README.md, "Protocol" and "Inputs", states every rule; test_tool.py tests each one.
+
+The run prints its plan, one line per row, and writes ``report.json``, ``summary.md``,
+``blocks.csv`` and ``meta.txt``. Exit status: 0 the run completed, whatever its verdict (the
+summary's first lines and ``report.json`` give the verdict and the conformance); 1 it aborted; 2 it
+was refused before the first block; 130 it was interrupted (Ctrl-C) before the first block.
+"""
+
+from __future__ import annotations
+
+import argparse
+import contextlib
+import csv
+import datetime as dt
+import fnmatch
+import hashlib
+import io
+import json
+import math
+import os
+import platform
+import random
+import re
+import signal
+import statistics
+import subprocess
+import sys
+import tempfile
+import time
+import traceback
+from dataclasses import dataclass, field
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REPO = HERE.parents[1]
+PYTHON_MIN = (3, 10)
+PROTOCOL_BLOCK_SECONDS = 2.0  # a timed block lasts at least 2 s
+PROTOCOL_TRIPLES = 7  # at least seven A-B-A triples
+RSS_FLOOR_MIB = 8.0  # memory allowance max(1.10 * reference, reference + 8 MiB)
+# Child-environment variables that change the allocator: recorded, never set or cleared (an
+# override such as MallocLargeCache=0 would hide the allocator-cache levels and with them a
+# candidate's genuine peak, so a run with one is not conforming).
+ALLOCATOR_PREFIXES = ("Malloc", "MALLOC_")
+ALLOCATOR_NAMES = ("DYLD_INSERT_LIBRARIES", "LD_PRELOAD", "GLIBC_TUNABLES")
+# Orchestrator and driver sources: hashed into meta.txt at the start of a run.
+SOURCE_FILES = ("aba.py", "harness.cpp", "aba_rows.hpp", "aba_api.hpp")
+# The names the tool accepts (README "Names"). They become parts of file names
+# (blocks/<row>.<label>.<mode>.stderr) and fields of meta.txt's tab-separated lines: lower case
+# only (two names that differ in case would share a log on a case-insensitive file system), and
+# no dot in a label (the log name then splits back into its row, label and mode).
+ROW_NAME = re.compile(r"[a-z0-9._-]{1,64}")  # a row's name or its group
+LABEL = re.compile(r"[a-z0-9_-]{1,32}")
+DIGEST = re.compile(r"[0-9a-f]{16}")  # as the harness prints it
+ROWS_TEXT = frozenset("abcdefghijklmnopqrstuvwxyz0123456789._-*?[]!, ")
+
+
+class Abort(RuntimeError):
+    """The run cannot go on once its blocks have begun: the message is the abort's reason, which
+    names the block (side, mode and row) or the row it comes from where there is one."""
+
+
+class ProvenanceError(Abort):
+    """A side's binary changed or became unreadable during the run."""
+
+
+class ResponseError(Abort):
+    """A harness response that is not what its command answers (``response_records``)."""
+
+
+class Refused(Exception):
+    """An input refused before the first block (exit 2)."""
+
+
+def sha256_file(path: Path | str) -> str:
+    return hashlib.sha256(Path(path).read_bytes()).hexdigest()
+
+
+SHA256_HEX = frozenset("0123456789abcdef")
+
+
+def is_sha256(text) -> bool:
+    return isinstance(text, str) and len(text) == 64 and set(text) <= SHA256_HEX
+
+
+def unique_keys(pairs: list[tuple[str, object]]) -> dict:
+    out = {}
+    for key, value in pairs:
+        if key in out:
+            raise ValueError(f"key {clip(key)} twice in one object")
+        out[key] = value
+    return out
+
+
+def load_json(text: str):
+    """JSON text with no key twice in an object: ``json.loads`` keeps the last value of a
+    repeated key, so one record could carry two values of a field and be read by the second.
+    ValueError otherwise (``json.JSONDecodeError`` is one), also for values nested too deeply
+    for Python's reader (it raises RecursionError)."""
+    try:
+        return json.loads(text, object_pairs_hook=unique_keys)
+    except RecursionError as exc:
+        raise ValueError(f"JSON nested too deeply ({exc})") from exc
+
+
+def clip(value, limit: int = 120) -> str:
+    """An input value for a message: an array or an object by its kind only (one nested deeply
+    cannot even be printed: Python's printer and JSON writer recurse, and fail where the reader
+    did not), anything else by its ``repr`` cut to ``limit`` characters."""
+    if isinstance(value, (list, dict)):
+        return "an object" if isinstance(value, dict) else "an array"
+    text = repr(value)
+    return text if len(text) <= limit else text[: limit - 3] + "..."
+
+
+def shown(rec: dict) -> str:
+    """A record for a message: JSON cut at 200 characters, a nested value by its kind only
+    (``clip``)."""
+    flat = {
+        k: f"<{clip(v)}>" if isinstance(v, (list, dict)) else v for k, v in rec.items()
+    }
+    return json.dumps(flat)[:200]
+
+
+def unknown_keys(rec: dict, known) -> str | None:
+    """Why ``rec`` has a key outside ``known`` (the first five named), or None: an input carries
+    only the keys its rule lists, so nothing unchecked reaches the report."""
+    unknown = [k for k in rec if k not in known]
+    if not unknown:
+        return None
+    names = ", ".join(clip(k) for k in unknown[:5]) + (
+        ", ..." if len(unknown) > 5 else ""
+    )
+    return f"unknown key{'s' if len(unknown) > 1 else ''} {names}"
+
+
+def response_records(out: bytes, what: str) -> list[dict]:
+    """A harness's complete standard output: UTF-8 text of whole lines, each ended by a newline
+    and each one JSON object (``load_json``). Nothing else is accepted (no blank line, no text and
+    no partial record before or after the records), so a usable line is never picked out of a
+    broken response. ResponseError otherwise."""
+    try:
+        text = out.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise ResponseError(f"{what}: the output is not UTF-8 text ({exc})") from exc
+    if text and not text.endswith("\n"):
+        raise ResponseError(
+            f"{what}: malformed output line (not ended by a newline): {text[-200:]!r}"
+        )
+    lines = text.split("\n")[:-1]
+    records = []
+    for i, line in enumerate(lines, 1):
+        try:
+            rec = load_json(line)
+        except ValueError as exc:
+            rec, why = None, str(exc)
+        else:
+            why = "not a JSON object"
+        if not isinstance(rec, dict):
+            raise ResponseError(
+                f"{what}: malformed output line ({why}; line {i} of {len(lines)}): "
+                f"{line[:200]}"
+            )
+        records.append(rec)
+    return records
+
+
+def one_record(out: bytes, what: str, row: str) -> dict:
+    """The response of a command that answers for one row: exactly one record
+    (``response_records``), and it names that row. ResponseError otherwise."""
+    records = response_records(out, what)
+    if len(records) != 1:
+        raise ResponseError(
+            f"{what}: {len(records)} output records, exactly one expected"
+        )
+    if records[0].get("row") != row:
+        raise ResponseError(
+            f"{what}: the record names row {clip(records[0].get('row'))}, not {row!r}"
+        )
+    return records[0]
+
+
+# The keys of an aba-list record: whether each is required (every one a string).
+ROW_LIST_FIELDS = {"row": True, "group": True, "desc": False, "queries": False}
+
+
+def row_list(out: bytes, what: str) -> dict[str, dict]:
+    """``aba-list``'s complete response (``response_records``): at least one row, every record
+    with a string ``row`` and a string ``group``, each a name of ``ROW_NAME`` (``desc`` and
+    ``queries`` strings when present) and no other key, no row twice. ResponseError otherwise."""
+    rows: dict[str, dict] = {}
+    for rec in response_records(out, what):
+        bad = [
+            k
+            for k, required in ROW_LIST_FIELDS.items()
+            if (k in rec or required) and not isinstance(rec.get(k), str)
+        ]
+        if bad:
+            raise ResponseError(
+                f"{what}: a row record without a string {', '.join(bad)}: {shown(rec)}"
+            )
+        for k in ("row", "group"):
+            if not ROW_NAME.fullmatch(rec[k]):
+                raise ResponseError(
+                    f"{what}: {k} {clip(rec[k])} is not 1 to 64 of the characters a-z, 0-9,"
+                    f" '.', '_' and '-': {shown(rec)}"
+                )
+        if unknown := unknown_keys(rec, ROW_LIST_FIELDS):
+            raise ResponseError(f"{what}: row {rec['row']}: {unknown}: {shown(rec)}")
+        if rec["row"] in rows:
+            raise ResponseError(f"{what}: row {rec['row']!r} listed twice")
+        rows[rec["row"]] = rec
+    if not rows:
+        raise ResponseError(f"{what}: no row listed")
+    return rows
+
+
+@dataclass
+class Side:
+    """One harness binary, its hash at the start of the run and its build record."""
+
+    key: str  # "A" or "B" in meta.txt
+    label: str
+    binary: str
+    sha256: str
+    build_record: dict = field(default_factory=dict)
+
+    def cmd(self, mode: str, *args: str) -> list[str]:
+        return [self.binary, mode, *args]
+
+    def verify(self, when: str) -> None:
+        """ProvenanceError unless the binary still has its hash."""
+        try:
+            got = sha256_file(self.binary)
+        except OSError as exc:
+            raise ProvenanceError(
+                f"{self.label}: harness {self.binary} unreadable {when} ({exc})"
+            ) from exc
+        if got != self.sha256:
+            raise ProvenanceError(
+                f"{self.label}: harness changed {when}: {self.binary} "
+                f"(meta.txt {self.sha256[:12]}..., now {got[:12]}...)"
+            )
+
+
+TEXT = (str,)
+TEXT_OR_NULL = (str, type(None))
+# The build record build.sh writes (README "Build records"): every key with the JSON types of its
+# value, a nested object with its own keys. Beyond the types: binary_sha256 and
+# core_sources_sha256 are sha256 values, dirty_core_paths is a nonnegative integer, and
+# driver_sha256's content is this checkout's driver (same_driver).
+BUILD_RECORD = {
+    "binary": TEXT,
+    "binary_sha256": TEXT,
+    "rev": TEXT,
+    "commit": TEXT,
+    "dirty_core_paths": (int,),
+    "core_sources_sha256": TEXT,
+    "driver_sha256": (dict,),
+    "compiler": TEXT,
+    "flags": TEXT,
+    "compiler_path": TEXT_OR_NULL,
+    "cxx_env": TEXT_OR_NULL,
+    "isysroot": TEXT_OR_NULL,
+    "sdk": {
+        "path": TEXT_OR_NULL,
+        "version": TEXT_OR_NULL,
+        "sdkroot_env": TEXT_OR_NULL,
+        "source": TEXT,
+    },
+    "deployment_target": {
+        "requested": TEXT_OR_NULL,
+        "effective_minos": TEXT_OR_NULL,
+        "binary_sdk": TEXT_OR_NULL,
+        "platform": TEXT_OR_NULL,
+        "raw": TEXT_OR_NULL,
+        "source": TEXT,
+    },
+    "built_by": TEXT,
+}
+
+
+def record_problems(rec: dict, schema: dict, prefix: str = "") -> list[str]:
+    """Why ``rec`` is not an object of ``schema`` (``BUILD_RECORD``): every key of the schema
+    present, no other key, each value of its JSON types (a bool is no integer)."""
+    problems = [f"no {prefix}{k}" for k in schema if k not in rec]
+    if unknown := unknown_keys(rec, schema):
+        problems.append(f"{unknown} in {prefix[:-1]}" if prefix else unknown)
+    for k, kind in schema.items():
+        if k not in rec:
+            continue
+        value = rec[k]
+        if isinstance(kind, dict):
+            if isinstance(value, dict):
+                problems += record_problems(value, kind, f"{prefix}{k}.")
+            else:
+                problems.append(f"{prefix}{k} is {clip(value)}, not an object")
+        elif isinstance(value, bool) or not isinstance(value, kind):
+            problems.append(f"{prefix}{k} is {clip(value)}, of another type")
+    return problems
+
+
+def build_record_problems(rec: dict) -> list[str]:
+    """Why ``rec`` is not a build record as build.sh writes it (``BUILD_RECORD``)."""
+    problems = record_problems(rec, BUILD_RECORD)
+    for k in ("binary_sha256", "core_sources_sha256"):
+        if isinstance(rec.get(k), str) and not is_sha256(rec[k]):
+            problems.append(f"{k} {clip(rec[k])} is not a sha256")
+    count = rec.get("dirty_core_paths")
+    if isinstance(count, int) and not isinstance(count, bool):
+        if p := domain_problem("dirty_core_paths", count, (int,), NONNEGATIVE):
+            problems.append(p)
+    return problems
+
+
+def make_side(key: str, label: str, binary: str) -> Side:
+    """One side, Refused unless ``binary`` is a readable file whose resolved path is printable
+    text (``meta.txt`` records it on one line) and its build record (``build.sh`` writes
+    ``<binary>.json``), when there is one, is a JSON object whose ``binary_sha256`` is the
+    binary's sha256 and which is build.sh's record (``build_record_problems``). The record is
+    read beside the resolved path; a ``<binary>.json`` that is not that file (beside a symbolic
+    link to the binary) is refused, so a harness given through a link keeps its record and the
+    checks of it. A refusal of the record names the side."""
+    try:
+        path = Path(binary).resolve()  # RuntimeError for a symlink loop before 3.13
+        if not str(path).isprintable():
+            raise Refused(
+                f"{label}: {binary!r}: a path with a character that is not printable"
+            )
+        if not path.is_file():
+            raise Refused(f"{label}: {binary}: no such file")
+        sha = sha256_file(path)
+        record_path = Path(f"{path}.json")
+        has_record = record_path.exists()
+        given = Path(binary + ".json")
+        if given.exists() and not (has_record and given.samefile(record_path)):
+            raise Refused(
+                f"{label}: {given}: a build record beside {binary}, not beside the binary it names"
+                f" ({path}); keep the record beside the binary"
+            )
+    except (OSError, RuntimeError) as exc:
+        raise Refused(f"{label}: {binary}: cannot read it ({exc})") from exc
+    record = {}
+    if has_record:
+        try:
+            record = load_json(record_path.read_text(encoding="utf-8"))
+        except (OSError, ValueError) as exc:
+            raise Refused(
+                f"{label}: {record_path}: not a readable JSON build record ({exc})"
+            ) from exc
+        if not isinstance(record, dict) or not is_sha256(record.get("binary_sha256")):
+            raise Refused(
+                f"{label}: {record_path}: a build record without binary_sha256"
+            )
+        if record["binary_sha256"] != sha:
+            raise Refused(
+                f"{label}: {binary}: differs from its build record {record_path}"
+            )
+        if problems := build_record_problems(record):
+            raise Refused(
+                f"{label}: {record_path}: not a build record as build.sh writes it"
+                f" ({'; '.join(problems)}); rebuild the harness with build.sh"
+            )
+    return Side(key, label, str(path), sha, record)
+
+
+def same_driver(side: Side, sources: dict[str, str]) -> None:
+    """Refused when the side's binary has a build record whose ``driver_sha256`` (the hashes of
+    the driver sources it was compiled from, under ``build.sh``'s names ``dev/perf/<file>``) is
+    not that of this checkout's driver sources (``sources``, as ``meta.txt`` records them): a
+    harness built before the rows or the adapter changed would run code ``meta.txt`` does not
+    name."""
+    if not side.build_record:
+        return
+    have = side.build_record.get("driver_sha256")
+    want = {f"dev/perf/{n}": sha for n, sha in sources.items() if n != "aba.py"}
+    if have != want:
+        files = (
+            sorted(k for k in have.keys() | want.keys() if have.get(k) != want.get(k))
+            if isinstance(have, dict)
+            else ["driver_sha256"]
+        )
+        raise Refused(
+            f"{side.label}: harness {side.binary} was not built from this checkout's driver"
+            f" sources (its build record differs in {', '.join(files)}); rebuild it with"
+            " build.sh"
+        )
+
+
+def allocator_record(env: dict[str, str]) -> dict:
+    """The allocator variables of the harness's environment: whether ``MallocLargeCache`` is
+    set, every variable named by ``ALLOCATOR_PREFIXES`` / ``ALLOCATOR_NAMES`` with its value, and
+    ``normal`` when there is none."""
+    variables = {
+        k: env[k]
+        for k in sorted(env)
+        if k.startswith(ALLOCATOR_PREFIXES) or k in ALLOCATOR_NAMES
+    }
+    return {
+        "MallocLargeCache": {
+            "set": "MallocLargeCache" in env,
+            "value": env.get("MallocLargeCache"),
+        },
+        "variables": variables,
+        "normal": not variables,
+    }
+
+
+def allocator_line(rec: dict) -> str:
+    cache = rec["MallocLargeCache"]
+    text = (
+        f"MallocLargeCache={cache['value']}"
+        if cache["set"]
+        else "MallocLargeCache unset"
+    )
+    others = {k: v for k, v in rec["variables"].items() if k != "MallocLargeCache"}
+    text += (
+        ", " + ", ".join(f"{k}={v}" for k, v in others.items())
+        if others
+        else ", no other allocator variable"
+    )
+    verdict = "normal" if rec["normal"] else "**allocator override: not gate evidence**"
+    return f"{text} ({verdict})"
+
+
+def peak_rss(ru_maxrss: float) -> float:
+    """``ru_maxrss`` in bytes (macOS reports bytes, Linux KiB)."""
+    return float(ru_maxrss) if sys.platform == "darwin" else float(ru_maxrss) * 1024.0
+
+
+# The domains of the numbers aba.py reads (block lines, options). Every number must also be
+# finite: json.loads reads NaN and Infinity, and NaN compares false with every bound, so a NaN
+# duration would pass any check written as a comparison.
+POSITIVE, NONNEGATIVE, ANY = "positive", "nonnegative", "any"
+NUMBER = (int, float)
+
+
+def domain_problem(name: str, value, types: tuple, domain: str) -> str | None:
+    """Why ``value`` is not a ``name`` of these JSON types (a bool is no number) in this
+    domain, or None. A number is finite: a float that is not, and an integer beyond the
+    largest float (JSON integers have no bound; arithmetic with a float would raise), are
+    refused."""
+    if isinstance(value, bool) or not isinstance(value, types):
+        return f"missing or mistyped {name}"
+    if isinstance(value, str):
+        return None
+    if isinstance(value, float) and not math.isfinite(value):
+        return f"{name} {value!r} is not finite"
+    if isinstance(value, int) and abs(value) > sys.float_info.max:
+        return f"{name} is not finite (an integer of {len(str(abs(value)))} digits)"
+    if domain == POSITIVE and value <= 0:
+        return f"{name} {value!r} is not positive"
+    if domain == NONNEGATIVE and value < 0:
+        return f"{name} {value!r} is negative"
+    return None
+
+
+# The fields of a block line the rules read, with their JSON types and domains (the row a block
+# answers for is checked against the requested one: ``one_record``; the digest is 16 lowercase
+# hexadecimal digits: ``block_problems``). The iteration count and the
+# median iteration time are positive (the ratio and the calibration divide by the median).
+# block_s and setup_s may be 0: the harness prints them rounded to microseconds, so a loop or a
+# setup shorter than half a microsecond reads 0 (a timed block that short fails the block-length
+# rule). The harness's own peak RSS is positive (a process that ran held pages); its children's is
+# 0 when it starts none, as the harness never does.
+BLOCK_FIELDS = {
+    "row": ((str,), ANY),
+    "iterations": ((int,), POSITIVE),
+    "median_s": (NUMBER, POSITIVE),
+    "block_s": (NUMBER, NONNEGATIVE),
+    "setup_s": (NUMBER, NONNEGATIVE),
+    "digest": ((str,), ANY),
+    "rss_self_bytes": (NUMBER, POSITIVE),
+    "rss_children_bytes": (NUMBER, NONNEGATIVE),
+}
+# The harness's other iteration-time statistics: no rule reads them (blocks.csv copies the mean,
+# minimum and maximum); checked when present, and 0 is accepted because an iteration shorter
+# than one clock tick reads 0.
+BLOCK_STATS = ("mean_s", "min_s", "p10_s", "p90_s", "max_s")
+# The numbers parse_block turns into floats: all but the iteration count.
+FLOAT_FIELDS = (
+    *(k for k, (types, _) in BLOCK_FIELDS.items() if types is NUMBER),
+    *BLOCK_STATS,
+)
+
+
+def block_problems(rec: dict) -> list[str]:
+    """Why ``rec`` is not a block line (``BLOCK_FIELDS``, ``BLOCK_STATS``, no other key)."""
+    problems = [
+        p
+        for k, (types, domain) in BLOCK_FIELDS.items()
+        if (p := domain_problem(k, rec.get(k), types, domain))
+    ]
+    problems += [
+        p
+        for k in BLOCK_STATS
+        if k in rec and (p := domain_problem(k, rec[k], NUMBER, NONNEGATIVE))
+    ]
+    digest = rec.get("digest")
+    if isinstance(digest, str) and not DIGEST.fullmatch(digest):
+        problems.append(f"digest {clip(digest)} is not 16 lowercase hexadecimal digits")
+    if unknown := unknown_keys(rec, (*BLOCK_FIELDS, *BLOCK_STATS)):
+        problems.append(unknown)
+    count = rec.get("iterations")
+    if type(count) is int and count > MAX_COUNT:
+        problems.append(f"iterations above {MAX_COUNT}")
+    return problems
+
+
+def require_finite(what: str, value) -> None:
+    """Stop the run (Abort) when a derived value, or any number inside it (lists and
+    dicts are searched), is not finite. Every number a block line carries is finite
+    (``BLOCK_FIELDS``), but arithmetic on huge ones is not: the mean of two medians near 1e308 is
+    infinite, and a ratio against it would read 0, a false pass. Checked before the value is
+    recorded or printed, so no verdict rests on it."""
+    if isinstance(value, dict):
+        for k, v in value.items():
+            require_finite(f"{what} {k}", v)
+    elif isinstance(value, list):
+        for v in value:
+            require_finite(what, v)
+    elif isinstance(value, float) and not math.isfinite(value):
+        raise Abort(
+            f"{what} is {value!r}, not finite: the blocks' numbers are outside the range the "
+            "statistics can use"
+        )
+
+
+def system_number(what: str, value, *, types=NUMBER, domain=NONNEGATIVE):
+    """An OS reading of its declared numeric type and domain, checked before storage."""
+    if problem := domain_problem(what, value, types, domain):
+        raise Abort(problem)
+    return value
+
+
+def parse_block(out: bytes, what: str, row: str) -> dict:
+    """A block's complete response: exactly one record for ``row`` (``one_record``) whose
+    fields are of their types and domains, with no other key (``block_problems``); ResponseError
+    (the run aborts) otherwise. The times and peaks become floats (the harness prints a peak as
+    an integer), so every value derived from them is float arithmetic, where an overflow is an
+    infinity that ``require_finite`` catches, never an exception."""
+    rec = one_record(out, what, row)
+    bad = block_problems(rec)
+    if bad:
+        raise ResponseError(
+            f"{what}: malformed output line ({'; '.join(bad)}): {shown(rec)}"
+        )
+    rec.update({k: float(rec[k]) for k in FLOAT_FIELDS if k in rec})
+    return rec
+
+
+def run_block(
+    side: Side, mode: str, row: str, arg: str, env: dict[str, str], log_dir: Path
+) -> dict:
+    """Run one block in a fresh process and return its record (``one_block``); an
+    operating-system error during the block aborts the run (Abort) and an interrupt is raised
+    again, each naming the block (side, mode and row)."""
+    block = f"{side.label} {mode} {row}"
+    try:
+        return one_block(side, mode, row, arg, env, log_dir)
+    except OSError as exc:
+        raise Abort(f"{block}: operating-system error: {exc}") from exc
+    except KeyboardInterrupt as exc:
+        raise KeyboardInterrupt(block) from exc
+    except Abort:
+        raise
+    except Exception as exc:
+        raise Abort(f"{block}: {type(exc).__name__}: {exc}") from exc
+
+
+def one_block(
+    side: Side, mode: str, row: str, arg: str, env: dict[str, str], log_dir: Path
+) -> dict:
+    """One block in a fresh process and its record.
+
+    The side's binary is verified before and after the block. Peak RSS of the harness process
+    tree, two readings:
+    * ``rss_self_bytes + rss_children_bytes``: reported by the harness at exit from
+      ``getrusage(RUSAGE_SELF)`` and ``getrusage(RUSAGE_CHILDREN)`` (the sum is an upper
+      bound on the simultaneous peak of the tree; exact without children);
+    * ``rss_wait4_bytes``: ``ru_maxrss`` from ``os.wait4`` on the harness process, which
+      covers the process and its waited-for descendants (largest member).
+    ``rss_tree_bytes`` is the larger of the two and is what the memory rule reads.
+    ``block_s`` is the harness's own wall-clock measurement of its timed loop.
+
+    The harness's stderr is appended to ``log_dir/<row>.<label>.<mode>.stderr``, one log for
+    every block of the row, side and mode. A log that is still empty after the block is
+    removed, also when the harness could not start or was interrupted, and an abort names the
+    log only when this block wrote to it.
+    """
+    side.verify(f"before {mode} {row}")
+    log_dir.mkdir(parents=True, exist_ok=True)
+    load_before = system_number(
+        f"{side.label} {mode} {row} load before", os.getloadavg()[0]
+    )
+    t0 = time.perf_counter()
+    err_path = log_dir / f"{row}.{side.label}.{mode}.stderr"
+    try:
+        with open(err_path, "ab") as err:
+            logged = os.fstat(err.fileno()).st_size  # the earlier blocks' text
+            try:
+                proc = subprocess.Popen(
+                    side.cmd(mode, row, arg),
+                    stdout=subprocess.PIPE,
+                    stderr=err,
+                    env=env,
+                    cwd=REPO,
+                )
+            except OSError as exc:
+                raise Abort(
+                    f"{side.label} {mode} {row}: cannot start {side.binary} ({exc})"
+                ) from exc
+            try:
+                out = proc.stdout.read() if proc.stdout else b""
+                _, status, ru = os.wait4(proc.pid, 0)
+            except BaseException:
+                # an interrupt (Ctrl-C): the block's harness does not run on
+                proc.kill()
+                proc.wait()
+                raise
+            finally:
+                if proc.stdout:
+                    proc.stdout.close()
+            returncode = os.waitstatus_to_exitcode(status)
+            proc.returncode = returncode  # reaped by os.wait4, so Popen waits no more
+    except BaseException:
+        # the run aborts for the first error; a log that cannot be checked is left as it is
+        with contextlib.suppress(OSError):
+            if err_path.stat().st_size == 0:
+                err_path.unlink()
+        raise
+    wall = time.perf_counter() - t0
+    size = err_path.stat().st_size
+    if size == 0:
+        err_path.unlink()
+    stderr = f"stderr: {err_path}" if size > logged else "nothing on stderr"
+    if returncode != 0:
+        raise Abort(f"{side.label} {mode} {row} exited {returncode} ({stderr})")
+    side.verify(f"after {mode} {row}")
+    rec = parse_block(out, f"{side.label} {mode} {row} ({stderr})", row)
+    rec["side"] = side.label
+    rec["wall_s"] = system_number(f"{side.label} {mode} {row} wall time", wall)
+    rec["load1_before"] = load_before
+    rec["load1_after"] = system_number(
+        f"{side.label} {mode} {row} load after", os.getloadavg()[0]
+    )
+    usage = system_number(f"{side.label} {mode} {row} wait4 peak", ru.ru_maxrss)
+    rec["rss_wait4_bytes"] = system_number(
+        f"{side.label} {mode} {row} wait4 bytes", peak_rss(usage)
+    )
+    rec["rss_tree_bytes"] = max(
+        rec["rss_self_bytes"] + rec["rss_children_bytes"], rec["rss_wait4_bytes"]
+    )
+    require_finite(f"{side.label} {mode} {row} rss_tree_bytes", rec["rss_tree_bytes"])
+    return rec
+
+
+def list_rows(side: Side, env: dict[str, str]) -> dict[str, dict]:
+    """The side's row list (``row_list`` of ``aba-list``); Refused when the harness does not exit
+    0 or its response is not one."""
+    cmd = side.cmd("aba-list")
+    what = " ".join(cmd)
+    try:
+        proc = subprocess.run(cmd, capture_output=True, env=env, cwd=REPO)
+    except OSError as exc:
+        raise Refused(f"{side.label}: {what}: {exc}") from exc
+    except KeyboardInterrupt as exc:
+        raise KeyboardInterrupt(f"{side.label} aba-list") from exc
+    if proc.returncode != 0:
+        tail = proc.stderr.decode("utf-8", "replace").strip()[-300:]
+        raise Refused(f"{side.label}: {what}: exit {proc.returncode}: {tail}")
+    try:
+        return row_list(proc.stdout, what)
+    except ResponseError as exc:
+        raise Refused(f"{side.label}: {exc}") from exc
+
+
+def median(xs: list[float]) -> float:
+    return statistics.median(xs)
+
+
+def bootstrap_interval(
+    x: list[float], resamples: int, seed: int, level: float = 0.95
+) -> tuple[float, float]:
+    """Percentile interval of the median over whole-triple resamples."""
+    rng = random.Random(seed)
+    n = len(x)
+    stats = sorted(
+        median([x[rng.randrange(n)] for _ in range(n)]) for _ in range(resamples)
+    )
+    lo_q, hi_q = (1 - level) / 2, 1 - (1 - level) / 2
+    lo = stats[int(math.floor(lo_q * (resamples - 1)))]
+    hi = stats[int(math.ceil(hi_q * (resamples - 1)))]
+    return lo, hi
+
+
+def side_clusters(times: list[float], tolerance: float) -> dict | None:
+    """Same-side clusters: one side's timed per-iteration times (positive, ``BLOCK_FIELDS``)
+    sorted; a split between consecutive blocks whose relative gap exceeds the tolerance, with at
+    least two blocks on each side of it, makes the side bimodal. Returns the widest such split, or
+    None."""
+    s = sorted(times)
+    best = None
+    for i in range(2, len(s) - 1):
+        gap = s[i] / s[i - 1] - 1
+        if gap > tolerance and (best is None or gap > best["gap"]):
+            best = {
+                "gap": gap,
+                "low": {"blocks": i, "min_s": s[0], "max_s": s[i - 1]},
+                "high": {"blocks": len(s) - i, "min_s": s[i], "max_s": s[-1]},
+            }
+    return best
+
+
+def machine_state() -> dict:
+    """Load averages and the top CPU consumers (a machine-state line at the start and the
+    end of every report), diagnostics no rule reads: the load is None when the system gives
+    none, and a line of ``ps``'s output that is not a finite nonnegative CPU share and a command
+    name is left out."""
+    cmd = (
+        ["ps", "-Ao", "pcpu=,comm=", "-r"]
+        if sys.platform == "darwin"
+        else ["ps", "-eo", "pcpu=,comm=", "--sort=-pcpu"]
+    )
+    try:
+        out = subprocess.run(
+            cmd, capture_output=True, text=True, errors="replace", timeout=10
+        ).stdout
+    except (OSError, subprocess.SubprocessError):
+        out = ""
+    top = []
+    for line in out.splitlines()[:5]:
+        cpu, _, comm = line.strip().partition(" ")
+        try:
+            share = float(cpu)
+        except ValueError:
+            continue
+        if math.isfinite(share) and share >= 0 and comm.strip():
+            top.append([share, Path(comm.strip()).name])
+    try:
+        load = [system_number("machine load", x) for x in os.getloadavg()]
+    except OSError:
+        load = None
+    if load is not None and len(load) != 3:
+        raise Abort("machine load: expected three readings")
+    return {
+        "utc": dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"),
+        "load": load,
+        "top_cpu": top,
+    }
+
+
+def machine_line(state: dict) -> str:
+    load = "/".join(f"{x:.2f}" for x in state["load"]) if state["load"] else "n/a"
+    top = ", ".join(f"{name} {cpu:.0f}%" for cpu, name in state["top_cpu"]) or "n/a"
+    return f"{state['utc']}: load {load}; top CPU {top}"
+
+
+def cpu_name() -> str:
+    """The CPU's name, a diagnostic: ``sysctl`` on macOS, else ``platform.processor()``."""
+    if sys.platform != "darwin":
+        return platform.processor()
+    try:
+        cmd = ["sysctl", "-n", "machdep.cpu.brand_string"]
+        proc = subprocess.run(cmd, capture_output=True, text=True, errors="replace")
+        return proc.stdout.strip()
+    except OSError:
+        return ""
+
+
+def cpu_count():
+    value = os.cpu_count()
+    return (
+        None
+        if value is None
+        else system_number("CPU count", value, types=(int,), domain=POSITIVE)
+    )
+
+
+def rss_balanced(triples: list[dict], budget: float, floor_bytes: float) -> dict:
+    """The memory rule: the maximum of the n A1 block peaks against the maximum of the n B block
+    peaks, equal sample counts on both sides. A1 is fixed in advance for every row: a larger A2
+    peak or a larger peak elsewhere never raises the reference. Only the timed triples count
+    (warm-up blocks are not in ``triples``). The allowance is in bytes, so the 8 MiB floor
+    applies even when the ratio exceeds 1.10."""
+    peaks = {k: [t[k]["rss_tree_bytes"] for t in triples] for k in ("A1", "B", "A2")}
+    reference, candidate = max(peaks["A1"]), max(peaks["B"])
+    allowance = max(budget * reference, reference + floor_bytes)
+    return {
+        "rss_a1_max_bytes": reference,
+        "rss_b_max_bytes": candidate,
+        "rss_balanced_ratio": candidate / reference,
+        "rss_allowance_bytes": allowance,
+        "rss_a2_max_bytes": max(peaks["A2"]),
+        "rss_verdict": "pass" if candidate <= allowance else "fail",
+    }
+
+
+def row_verdict(
+    time_verdict: str,
+    rss_verdict: str,
+    block_verdict: str,
+    cluster_verdict: str,
+    digest_verdict: str,
+) -> str:
+    """``fail`` if any check fails, else ``inconclusive`` if timing is, else ``pass``."""
+    verdicts = [
+        time_verdict,
+        rss_verdict,
+        block_verdict,
+        cluster_verdict,
+        digest_verdict,
+    ]
+    if "fail" in verdicts:
+        return "fail"
+    return "inconclusive" if time_verdict == "inconclusive" else "pass"
+
+
+def row_statistics(
+    triples: list[dict],
+    tolerance: float,
+    budget: float,
+    floor_bytes: float,
+    min_block_s: float,
+    resamples: int,
+    seed: int,
+) -> dict:
+    """The statistics and verdicts of one measured row; the row fails unless every timed block
+    of both sides reports one and the same digest. A derived value that is not finite aborts the
+    run instead (``require_finite``)."""
+    a1 = [t["A1"]["median_s"] for t in triples]
+    b = [t["B"]["median_s"] for t in triples]
+    a2 = [t["A2"]["median_s"] for t in triples]
+    means = [(x + y) / 2 for x, y in zip(a1, a2, strict=True)]
+    require_finite("the mean of A1 and A2", means)
+    ratios = [bt / m for bt, m in zip(b, means, strict=True)]
+    x = [r - 1 for r in ratios]
+    stat = median(x)
+    lo, hi = bootstrap_interval(x, resamples, seed)
+    drift = median([abs(p / q - 1) for p, q in zip(a1, a2, strict=True)])
+    if drift > tolerance:
+        time_verdict = "inconclusive"
+    elif hi <= tolerance:
+        time_verdict = "pass"
+    else:
+        time_verdict = "fail"
+    rss = rss_balanced(triples, budget, floor_bytes)
+    # Block length: the harness's measured wall time of every timed block.
+    blocks = [(i, k, t[k]) for i, t in enumerate(triples, 1) for k in ("A1", "B", "A2")]
+    short = [
+        {"triple": i, "slot": k, "block_s": blk["block_s"]}
+        for i, k, blk in blocks
+        if blk["block_s"] < min_block_s
+    ]
+    block_verdict = "fail" if short else "pass"
+    # Same-side clusters: every timed block's per-iteration time per side.
+    blocks_a = [t[k]["median_s"] for t in triples for k in ("A1", "A2")]
+    blocks_b = [t["B"]["median_s"] for t in triples]
+    clusters = {
+        side: side_clusters(times, tolerance)
+        for side, times in (("A", blocks_a), ("B", blocks_b))
+    }
+    bimodal = [side for side, c in clusters.items() if c is not None]
+    cluster_verdict = "fail" if bimodal else "pass"
+    digests_a = {t[k]["digest"] for t in triples for k in ("A1", "A2")}
+    digests_b = {t["B"]["digest"] for t in triples}
+    digest_match = len(digests_a) == 1 and digests_a == digests_b
+    digest_verdict = "pass" if digest_match else "fail"
+    durations = [blk["block_s"] for _, _, blk in blocks]
+    stats = {
+        "ratios": ratios,
+        "statistic": stat,
+        "ci95": [lo, hi],
+        "drift": drift,
+        "time_verdict": time_verdict,
+        **rss,
+        "block_s_min": min(durations),
+        "block_s_median": median(durations),
+        "short_blocks": short,
+        "block_verdict": block_verdict,
+        "blocks_a_s": blocks_a,
+        "blocks_b_s": blocks_b,
+        "clusters": clusters,
+        "bimodal": bimodal,
+        "cluster_verdict": cluster_verdict,
+        "median_a_s": median(a1 + a2),
+        "median_b_s": median(b),
+        "load1_max": max(
+            max(blk["load1_before"], blk["load1_after"]) for _, _, blk in blocks
+        ),
+        "digest_a": sorted(digests_a),
+        "digest_b": sorted(digests_b),
+        "digest_match": digest_match,
+        "digest_verdict": digest_verdict,
+        "verdict": row_verdict(
+            time_verdict,
+            rss["rss_verdict"],
+            block_verdict,
+            cluster_verdict,
+            digest_verdict,
+        ),
+    }
+    require_finite("row statistic", stats)
+    return stats
+
+
+def glob_matches(name: str, meta: dict, pattern: str) -> bool:
+    """A pattern matches a row's name or its group, case-sensitively; ``all`` is ``*``."""
+    pattern = "*" if pattern == "all" else pattern
+    return fnmatch.fnmatchcase(name, pattern) or fnmatch.fnmatchcase(
+        meta["group"], pattern
+    )
+
+
+def split_patterns(text: str) -> list[str]:
+    """``--rows`` as globs: comma-separated, spaces around each glob ignored, empty items
+    dropped; no text at all means ``all``."""
+    if not text.strip():
+        return ["all"]
+    return [p.strip() for p in text.split(",") if p.strip()]
+
+
+def groups_of(rows: dict[str, dict]) -> dict[str, list[str]]:
+    out: dict[str, list[str]] = {}
+    for name, rec in rows.items():
+        out.setdefault(rec["group"], []).append(name)
+    return out
+
+
+def choose_rows(rows: dict[str, dict], rows_arg: str) -> dict:
+    """Resolve ``--rows`` against the harnesses' row list.
+
+    Errors (the run is refused before any block): a text that names no glob; a glob that matches
+    no row or group on its own. The record lists, per glob, the rows it selected and the rows of
+    their groups it did not, and per group the rows the whole selection did not select.
+    """
+    pats = split_patterns(rows_arg)
+    errors = [] if pats else [f"--rows {rows_arg!r} names no glob"]
+    groups = groups_of(rows)
+    globs = []
+    for pat in pats:
+        hit = [n for n, rec in rows.items() if glob_matches(n, rec, pat)]
+        touched = sorted({rows[n]["group"] for n in hit})
+        globs.append(
+            {
+                "glob": pat,
+                "matched": hit,
+                "groups": touched,
+                "group_rows_not_matched": [
+                    n for g in touched for n in groups[g] if n not in hit
+                ],
+            }
+        )
+        if not hit:
+            errors.append(f"--rows glob {pat!r} matches no row or group")
+    names = [n for n in rows if any(n in g["matched"] for g in globs)]
+    return {
+        "rows": rows_arg,
+        "selected": names,
+        "globs": globs,
+        "not_selected": {
+            g: [n for n in members if n not in names]
+            for g, members in groups.items()
+            if any(n not in names for n in members)
+        },
+        "errors": errors,
+    }
+
+
+def same_rows(rows_old: dict[str, dict], rows_new: dict[str, dict]) -> None:
+    """Refused unless both harnesses list the same rows, record for record, in the same order
+    (``build.sh`` compiles this checkout's rows into both)."""
+    if list(rows_old.items()) == list(rows_new.items()):
+        return
+    only_old = [n for n in rows_old if n not in rows_new]
+    only_new = [n for n in rows_new if n not in rows_old]
+    other = [n for n in rows_new if n in rows_old and rows_old[n] != rows_new[n]]
+    raise Refused(
+        "the two harnesses list different rows (build both with this checkout's"
+        f" build.sh): only the reference has {only_old or 'none'}, only the candidate"
+        f" {only_new or 'none'}, other records {other or 'none'}"
+        + ("" if only_old or only_new or other else ", another order")
+    )
+
+
+def row_choice_error_text(sel: dict, rows: dict[str, dict]) -> str:
+    listing = "\n".join(
+        f"  {group} ({len(names)}): {', '.join(names)}"
+        for group, names in groups_of(rows).items()
+    )
+    return (
+        "; ".join(sel["errors"])
+        + '.\nThe groups that exist (the harness\'s list; README "Selecting rows"; a'
+        " pattern matches a row's name or its group):\n" + listing
+    )
+
+
+# The largest count the harness reads (a 64-bit signed integer).
+MAX_COUNT = 2**63 - 1
+
+
+def parse_count(text: str) -> tuple[int, int]:
+    """``N`` (both sides) or ``NA:NB`` (per side), each a positive integer the harness reads (at
+    most ``MAX_COUNT``); ValueError otherwise (``NA:`` too: a count is never implied)."""
+    a, sep, b = text.partition(":")
+    try:
+        pair = (int(a), int(b if sep else a))
+    except ValueError:
+        raise ValueError(f"iteration count {text!r} is not N or NA:NB") from None
+    if min(pair) < 1:
+        raise ValueError(f"iteration count {text!r} below 1")
+    if max(pair) > MAX_COUNT:
+        raise ValueError(f"iteration count {text!r} above {MAX_COUNT}")
+    return pair
+
+
+def pinned_iterations(text: str | None, names: list[str]) -> dict[str, tuple[int, int]]:
+    """Pinned per-side counts ``row -> (n_A, n_B)`` from ``--iters row=N`` (both sides) or
+    ``row=NA:NB``, every item naming a selected row (``names``), none twice; ValueError for any
+    item that is not valid."""
+    pins: dict[str, tuple[int, int]] = {}
+    for item in (text or "").split(","):
+        if not item.strip():
+            continue  # empty items are dropped, as in --rows
+        k, sep, v = item.partition("=")
+        k = k.strip()
+        if not sep or not k:
+            raise ValueError(f"--iters item {item!r} is not row=N or row=NA:NB")
+        if k not in names:
+            raise ValueError(f"--iters row {k!r} is not a selected row")
+        if k in pins:
+            raise ValueError(f"--iters row {k!r} given twice")
+        pins[k] = parse_count(v.strip())
+    return pins
+
+
+def side_counts(
+    warm_a: dict,
+    warm_b: dict,
+    target_s: float,
+    margin: float,
+    pin: tuple[int, int] | None,
+) -> tuple[int, int, str]:
+    """The iteration counts of the timed blocks: each side ``ceil(target * (1 + margin) /
+    median_side)`` from its own warm-up block, so every block on either side is calibrated to
+    the target; the block value is the median iteration time, so the ratio does not depend on
+    the counts. A pin (``--iters``) overrides both. A count that is not finite aborts the run,
+    naming the row and the side (the warm-up record's ``row`` and ``side``)."""
+    if pin is not None:
+        return pin[0], pin[1], "pinned"
+    want = target_s * (1 + margin)
+    quotients = [want / warm_a["median_s"], want / warm_b["median_s"]]
+    for warm, quotient in zip((warm_a, warm_b), quotients, strict=True):
+        require_finite(
+            f"{warm['row']} {warm['side']}: the calibrated iteration count", quotient
+        )
+        if quotient > MAX_COUNT:
+            raise Abort(
+                f"{warm['side']} aba-calibrate {warm['row']}: calibrated iteration count above {MAX_COUNT}"
+            )
+    return (
+        max(1, math.ceil(quotients[0])),
+        max(1, math.ceil(quotients[1])),
+        "calibrated per side",
+    )
+
+
+def source_hashes() -> dict[str, str]:
+    """sha256 of every file of ``SOURCE_FILES``; Refused when one cannot be read or the
+    directory's path is not printable text (``meta.txt`` records it on one line)."""
+    if not str(HERE).isprintable():
+        raise Refused(f"{str(HERE)!r}: a path with a character that is not printable")
+    try:
+        return {name: sha256_file(HERE / name) for name in SOURCE_FILES}
+    except OSError as exc:
+        raise Refused(f"the tool's sources: {exc}") from exc
+
+
+META_HEADER = """\
+# aba.py provenance: sha256 of both harness binaries (each the driver compiled with that side's
+# Core; re-hashed before and after every block) and of the orchestrator and driver sources
+# (hashed at the start of the run). Columns: side, role, name, sha256, path (tab separated).
+"""
+
+
+def meta_lines(sides: list[Side], sources: dict[str, str]) -> list[str]:
+    """``meta.txt``'s hash lines: one per binary, one per source."""
+    lines = [f"{s.key}\tbinary\tharness\t{s.sha256}\t{s.binary}" for s in sides]
+    lines += [
+        f"run\tsource\t{name}\t{sha}\t{HERE / name}" for name, sha in sources.items()
+    ]
+    return lines
+
+
+def meta_table(lines: list[str]) -> dict[str, str]:
+    """``side/role/name -> sha256`` of hash lines."""
+    return {"/".join(cols[:3]): cols[3] for cols in (ln.split("\t") for ln in lines)}
+
+
+def read_meta(path: Path) -> dict[str, str]:
+    """A ``meta.txt`` as ``write_meta`` writes it, Refused otherwise: every line a comment, a
+    ``label`` line of side A or B, or a hash line (side A, B or ``run``, role, name, sha256,
+    path), no hash named twice and at least one hash."""
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as exc:
+        raise Refused(f"--expect-meta {path}: {exc}") from exc
+    table = {}
+    labels = set()
+    if text and not text.endswith("\n"):
+        raise Refused(f"--expect-meta {path}: last line is not ended by a newline")
+    for i, line in enumerate(text.splitlines(), 1):
+        cols = line.split("\t")
+        if line.startswith("#"):
+            continue
+        if (
+            len(cols) == 3
+            and cols[0] == "label"
+            and cols[1] in ("A", "B")
+            and LABEL.fullmatch(cols[2])
+            and cols[1] not in labels
+        ):
+            labels.add(cols[1])
+            continue
+        hash_line = (
+            len(cols) == 5
+            and is_sha256(cols[3])
+            and cols[4].isprintable()
+            and (
+                (cols[0] in ("A", "B") and cols[1:3] == ["binary", "harness"])
+                or (cols[0:2] == ["run", "source"] and cols[2] in SOURCE_FILES)
+            )
+        )
+        if not hash_line:
+            raise Refused(
+                f"--expect-meta {path}: line {i} is not a meta.txt line: {line!r}"
+            )
+        key = "/".join(cols[:3])
+        if key in table:
+            raise Refused(f"--expect-meta {path}: {key} named twice (line {i})")
+        table[key] = cols[3]
+    if not table:
+        raise Refused(f"--expect-meta {path}: no hash")
+    return table
+
+
+def write_meta(path: Path, sides: list[Side], lines: list[str]) -> None:
+    labels = [f"label\t{s.key}\t{s.label}" for s in sides]
+    path.write_text(META_HEADER + "\n".join(labels + lines) + "\n", encoding="utf-8")
+
+
+CSV_FIELDS = (
+    "row",
+    "slot",
+    "triple",
+    "side",
+    "iterations",
+    "iterations_requested",
+    "block_s",
+    "min_block_s",
+    "meets_min",
+    "median_s",
+    "mean_s",
+    "min_s",
+    "max_s",
+    "setup_s",
+    "process_wall_s",
+    "rss_self_bytes",
+    "rss_children_bytes",
+    "rss_wait4_bytes",
+    "rss_tree_bytes",
+    "digest",
+    "load1_before",
+    "load1_after",
+)
+
+
+def csv_rows(report: dict) -> list[dict]:
+    """Every block run so far, one line each; ``block_s`` is the measured wall time of the
+    block's timed loop (warm-up blocks: the calibration loop, not checked). A row not run, or one
+    whose warm-up did not finish, has no warm-up blocks; a row not timed yet has no triples."""
+    min_block = report["protocol"]["target_block_s"]
+    out = []
+    for rec in report["rows"]:
+        for k, blk in rec.get("warmup", {}).items():
+            out.append(
+                {
+                    **blk,
+                    "row": rec["row"],
+                    "slot": f"W-{k}",
+                    "process_wall_s": blk["wall_s"],
+                }
+            )
+        for i, t in enumerate(rec.get("triples", []), 1):
+            for k in ("A1", "B", "A2"):
+                blk = t[k]
+                out.append(
+                    {
+                        **blk,
+                        "row": rec["row"],
+                        "slot": k,
+                        "triple": i,
+                        "min_block_s": min_block,
+                        "meets_min": blk["block_s"] >= min_block,
+                        "iterations_requested": rec[
+                            "iterations_b" if k == "B" else "iterations_a"
+                        ],
+                        "process_wall_s": blk["wall_s"],
+                    }
+                )
+    return out
+
+
+def csv_text(report: dict) -> str:
+    """blocks.csv's text (``csv_rows``)."""
+    f = io.StringIO()
+    w = csv.DictWriter(f, fieldnames=CSV_FIELDS, extrasaction="ignore")
+    w.writeheader()
+    w.writerows(csv_rows(report))
+    return f.getvalue()
+
+
+def write_csv(report: dict, path: Path) -> None:
+    path.write_text(csv_text(report), encoding="utf-8", newline="")
+
+
+def report_text(report: dict) -> str:
+    """report.json's text: standard JSON, so a value that is not finite (NaN or an infinity,
+    which Python's writer would print as nonstandard literals) raises ValueError instead of
+    reaching the file."""
+    return json.dumps(report, indent=1, allow_nan=False)
+
+
+def write_report(report: dict, path: Path) -> None:
+    path.write_text(report_text(report), encoding="utf-8")
+
+
+def run_verdict(report: dict) -> str:
+    """``aborted``, else the worst row verdict. A run that did not abort measured every selected
+    row, and a selection has at least one (``choose_rows``)."""
+    if "aborted" in report:
+        return "aborted"
+    verdicts = [r["verdict"] for r in report["rows"] if r["status"] == "measured"]
+    if "fail" in verdicts:
+        return "fail"
+    return "inconclusive" if "inconclusive" in verdicts else "pass"
+
+
+def conforming(report: dict) -> bool:
+    """Gate evidence: not aborted, no ``--allow-short`` (without it ``main`` refuses fewer
+    triples or a smaller target than the protocol), no short block and the normal allocator."""
+    return (
+        "aborted" not in report
+        and not report["protocol"]["allow_short"]
+        and not any(r.get("short_blocks") for r in report["rows"])
+        and report["allocator_env"]["normal"]
+    )
+
+
+def start_run(args, old: Side, new: Side):
+    """Everything before the first block that writes nothing: ``--out``, each build record's
+    driver (``same_driver``), ``meta.txt``'s lines, ``--expect-meta``, both row lists, the
+    selection, ``--iters`` (the pins) and the report's start. Refused for any input outside its
+    rule; an operating-system error escapes (``run``)."""
+    out = (
+        Path(args.out)
+        if args.out
+        else HERE / "results" / dt.datetime.now().strftime("%Y%m%dT%H%M%S")
+    )
+    if out.exists() and (not out.is_dir() or any(out.iterdir())):
+        # A file of an earlier run would mix into this one's (the stderr logs append).
+        raise Refused(f"--out {out}: must be absent or an empty directory")
+    sources = source_hashes()
+    for side in (old, new):
+        same_driver(side, sources)
+    lines = meta_lines([old, new], sources)
+    if args.expect_meta:
+        expected = read_meta(Path(args.expect_meta))
+        have = meta_table(lines)
+        diff = sorted(
+            k for k in expected.keys() | have.keys() if expected.get(k) != have.get(k)
+        )
+        if diff:
+            raise Refused(
+                f"--expect-meta {args.expect_meta}: hashes differ: {', '.join(diff)}"
+            )
+    env = dict(os.environ)  # the harnesses run with the caller's environment, unchanged
+    rows = list_rows(new, env)
+    same_rows(list_rows(old, env), rows)
+    chosen = choose_rows(rows, args.rows)
+    if chosen["errors"]:
+        raise Refused(row_choice_error_text(chosen, rows))
+    names = chosen["selected"]
+    try:
+        pins = pinned_iterations(args.iters, names)
+    except ValueError as exc:
+        raise Refused(f"--iters: {exc}") from exc
+    report = {
+        "started_utc": dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"),
+        "argv": list(sys.argv),
+        "protocol": {
+            "triples": args.triples,
+            "protocol_triples": PROTOCOL_TRIPLES,
+            "target_block_s": args.target_seconds,
+            "protocol_block_s": PROTOCOL_BLOCK_SECONDS,
+            "allow_short": args.allow_short,
+            "calibration_margin": args.calibration_margin,
+            "tolerance": args.tolerance,
+            "budget": args.budget,
+            "rss_floor_bytes": args.rss_floor_mib * 2**20,
+            "bootstrap_resamples": args.resamples,
+            "bootstrap_seed": args.seed,
+        },
+        "selection": chosen,
+        "machine": {
+            "platform": platform.platform(),
+            "cpu": cpu_name(),
+            "ncpu": cpu_count(),
+            "state_at_start": machine_state(),
+        },
+        "sides": {
+            s.key: {
+                "label": s.label,
+                "binary": s.binary,
+                "sha256": s.sha256,
+                "build_record": s.build_record,
+            }
+            for s in (old, new)
+        },
+        "meta": meta_table(lines),
+        "allocator_env": allocator_record(env),
+        # Every selected row from the start, so an abort at any point reports each one.
+        "rows": [
+            {
+                "row": name,
+                "group": rows[name]["group"],
+                "desc": rows[name].get("desc"),
+                "status": "not run",
+            }
+            for name in names
+        ],
+    }
+    if args.expect_meta:
+        report["expect_meta"] = args.expect_meta
+    return out, report, lines, env, pins
+
+
+def create_outputs(
+    out: Path, sides: list[Side], lines: list[str], report: dict | None = None
+) -> None:
+    """``--out`` and ``meta.txt``, the last step before the first block. On an operating-system
+    error (Refused) or an interrupt, what this step created is removed again, so a run refused or
+    interrupted before the first block leaves no partial setup; main writes its refusal reason."""
+    created: list[Path] = []
+    try:
+        created = [d for d in (out, *out.parents) if not d.exists()]  # deepest first
+        out.mkdir(parents=True, exist_ok=True)
+        write_meta(out / "meta.txt", sides, lines)
+        if report is not None:
+            pending = {**report, "aborted": "run has not finished"}
+            atomic_text(out / "report.json", report_text(minimal_report(pending)))
+            atomic_text(out / "summary.md", minimal_summary(pending))
+    except (Exception, KeyboardInterrupt) as exc:
+        for name in ("meta.txt", "report.json", "summary.md"):
+            with contextlib.suppress(OSError):
+                (out / name).unlink(missing_ok=True)
+        for d in created:
+            with contextlib.suppress(OSError):
+                d.rmdir()
+        if isinstance(exc, OSError):
+            raise Refused(f"--out {out}: {exc}") from exc
+        raise
+
+
+def run(args, old: Side, new: Side) -> int:
+    """One run; the exit status as in the module docstring (0 completed, 1 aborted, 2 refused;
+    an interrupt before the first block reaches ``main``). An operating-system error refuses the
+    run before the first block and aborts it from there on."""
+    try:
+        out, report, lines, env, pins = start_run(args, old, new)
+    except OSError as exc:
+        raise Refused(f"before the first block: {exc}") from exc
+    report_path = out / "report.json"
+    t_run = time.perf_counter()
+    # One SIGINT handler serves the rest of the run: it raises KeyboardInterrupt at the first
+    # interrupt only and records every later one, so a second Ctrl-C cannot cut short the
+    # handling of the first. An interrupt while the outputs are created leaves nothing and
+    # reaches main; from then on it aborts the run. The final outputs are written with no
+    # interrupt raised; an interrupt during them, recorded or raised before they began, writes
+    # them again as aborted.
+    with interrupts_once() as interrupts:
+        create_outputs(out, [old, new], lines, report)
+        try:
+            try:
+                # First the warm-up blocks of every selected row (counts and the plan).
+                for rec in report["rows"]:
+                    prepare_row(args, rec, old, new, env, out, pins)
+                    write_csv(report, out / "blocks.csv")
+                report["plan"] = run_plan(report)
+                write_report(report, report_path)
+                print(plan_text(report), flush=True)
+                # Then the timed triples, row by row.
+                for rec in report["rows"]:
+                    run_triples(args, report, report_path, rec, old, new, env)
+                    write_csv(report, out / "blocks.csv")
+                # The reference's last block (A2) was verified after it ran; the candidate's
+                # binary could still change during that block.
+                new.verify("at the end of the run")
+            # A refused response, a failed harness, a changed binary, a value that is not
+            # finite; a block's own operating-system errors among them (run_block).
+            except Abort as exc:
+                report["aborted"] = str(exc)
+            # An output written during the run that cannot be written, a closed stdout.
+            except OSError as exc:
+                report["aborted"] = f"operating-system error: {exc}{during(report)}"
+            except KeyboardInterrupt as exc:
+                report["aborted"] = f"interrupted (SIGINT, Ctrl-C){during(report, exc)}"
+            # A defect of aba.py: aborted like the others, with its traceback on stderr.
+            except Exception as exc:
+                with contextlib.suppress(OSError, ValueError):
+                    traceback.print_exc()
+                report["aborted"] = (
+                    f"internal error: {type(exc).__name__}: {exc}{during(report)}"
+                )
+            before = len(interrupts)
+            interrupts.hold()
+            status = finish(report, out, t_run)
+            if len(interrupts) > before:
+                status = finish_interrupted(report, out, t_run)
+        except KeyboardInterrupt:
+            status = finish_interrupted(report, out, t_run)
+    return status
+
+
+def during(report: dict, exc: BaseException | None = None) -> str:
+    """Where an abort reason that does not name its block came from: the block an interrupt
+    stopped (``run_block`` raises it again with the block's name), else the row step in
+    progress, else nothing (the plan, the end of the run)."""
+    if exc is not None and exc.args:
+        return f" during {exc}"
+    for r in report["rows"]:
+        if r["status"] in ("warm-up", "timing"):
+            step = "warm-up" if r["status"] == "warm-up" else "timed"
+            return f" during the {step} step of {r['row']}"
+    return ""
+
+
+class Interrupts(list):
+    """The SIGINTs (Ctrl-C) of a run, in order, as ``interrupts_once`` records them: the first
+    one raises KeyboardInterrupt unless ``hold`` came first, and every other one is only
+    recorded."""
+
+    def __init__(self):
+        super().__init__()
+        self._armed = {"first": True}
+
+    def hold(self) -> None:
+        """From now on every interrupt is only recorded."""
+        self._armed.clear()
+
+    def receive(self, signum: int, _frame) -> None:
+        # dict.pop is one call, so two interrupts in a row cannot both take "first": at most one
+        # KeyboardInterrupt is ever raised.
+        first = self._armed.pop("first", False)
+        self.append(signum)
+        if first:
+            raise KeyboardInterrupt
+
+
+@contextlib.contextmanager
+def interrupts_once():
+    """SIGINT handled by the yielded ``Interrupts``, so that a second interrupt cannot cut short
+    the handling of the first or a write of the final outputs; the previous handler is restored
+    afterwards."""
+    interrupts = Interrupts()
+    previous = signal.signal(signal.SIGINT, interrupts.receive)
+    try:
+        yield interrupts
+    finally:
+        signal.signal(signal.SIGINT, previous)
+
+
+def warn(text: str) -> None:
+    """A line on stderr; a closed stderr is no error."""
+    with contextlib.suppress(OSError, ValueError):
+        print(text, file=sys.stderr, flush=True)
+
+
+def finish(report: dict, out: Path, t_run: float) -> int:
+    """The verdict, the machine state at the end and the outputs (``write_outputs``); 1 if the
+    run aborted, else 0. An output that cannot be made or written aborts the run: the reason
+    goes to stderr and, unless the run had aborted already, into every output, each written
+    again where it can be (in its minimal form where its full text cannot be made)."""
+    if "aborted" in report:
+        warn(f"aborted: {report['aborted']}")
+    report["finished_utc"] = dt.datetime.now(dt.timezone.utc).isoformat(
+        timespec="seconds"
+    )
+    try:
+        report["wall_s"] = system_number("run wall time", time.perf_counter() - t_run)
+        report["machine"]["state_at_end"] = machine_state()
+    except Exception as exc:
+        why = f"while finishing the run: {type(exc).__name__}: {exc}"
+        report.setdefault("aborted", why)
+        warn(f"aborted: {why}")
+    report["verdict"] = run_verdict(report)
+    report["conforming"] = conforming(report)
+    problems = write_outputs(report, out)
+    if problems:
+        why = "; ".join(problems)
+        if any(p.startswith("operating-system error") for p in problems):
+            why += f"; the outputs in {out} are incomplete"
+        warn(f"aborted: {why}")
+        report.setdefault("aborted", why)
+        report["verdict"], report["conforming"] = "aborted", False
+        write_outputs(report, out)
+        return 1
+    # The outputs are written: a stdout that is closed or cannot show a path is no abort.
+    with contextlib.suppress(OSError, ValueError):
+        print(
+            f"report: {out / 'report.json'}\nsummary: {out / 'summary.md'}\n"
+            f"blocks: {out / 'blocks.csv'}\nmeta: {out / 'meta.txt'}",
+            flush=True,
+        )
+    return 1 if "aborted" in report else 0
+
+
+def finish_interrupted(report: dict, out: Path, t_run: float) -> int:
+    """An interrupt while the final outputs were written: the run is aborted (an earlier
+    reason is kept) and the outputs are written again, each one that can be; 1."""
+    why = "interrupted (SIGINT, Ctrl-C) while the outputs were written"
+    report.setdefault("aborted", why)
+    warn(f"aborted: {why}")
+    report.setdefault(
+        "finished_utc",
+        dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"),
+    )
+    if "wall_s" not in report:
+        try:
+            report["wall_s"] = system_number(
+                "run wall time", time.perf_counter() - t_run
+            )
+        except Abort as exc:
+            warn(str(exc))
+    report["verdict"], report["conforming"] = "aborted", False
+    if problems := write_outputs(report, out):
+        warn(f"the outputs in {out} are incomplete: {'; '.join(problems)}")
+    return 1
+
+
+def write_outputs(report: dict, out: Path) -> list[str]:
+    """Write the final outputs into ``out`` (report.json, blocks.csv, summary.md), each one that
+    can be: one whose text cannot be made (a defect of aba.py, as every value of the report
+    passed a rule) is written in its minimal form once the run is aborted, and one that cannot
+    be written does not stop the next. Why each output not written in full failed."""
+    problems = []
+    for name, full, minimal in (
+        ("report.json", report_text, lambda r: report_text(minimal_report(r))),
+        ("blocks.csv", csv_text, lambda r: ",".join(CSV_FIELDS) + "\r\n"),
+        ("summary.md", summary_text, minimal_summary),
+    ):
+        try:
+            text = full(report)
+        except Exception as exc:  # a defect: the run's abort, not a traceback
+            problems.append(f"{name} could not be made ({type(exc).__name__}: {exc})")
+            if "aborted" not in report:
+                continue  # finish aborts the run and writes the outputs again
+            text = minimal(report)
+        try:
+            atomic_text(out / name, text)
+        except Exception as exc:
+            kind = (
+                "operating-system error"
+                if isinstance(exc, OSError)
+                else type(exc).__name__
+            )
+            problems.append(f"{kind} writing {name}: {exc}")
+            # A directory may have become read-only while its existing output files remain
+            # writable. Keep the abort reason there too when replacement is unavailable.
+            if isinstance(exc, OSError) and "aborted" in report:
+                try:
+                    (out / name).write_text(text, encoding="utf-8", newline="")
+                except Exception as retry:
+                    problems.append(f"{name} retry failed: {retry}")
+    return problems
+
+
+def atomic_text(path: Path, text: str) -> None:
+    """Replace an output only after its complete UTF-8 text is written; remove a failed draft."""
+    draft = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            newline="",
+            dir=path.parent,
+            prefix=".aba-",
+            delete=False,
+        ) as stream:
+            draft = Path(stream.name)
+            stream.write(text)
+        os.replace(draft, path)
+    finally:
+        if draft is not None:
+            draft.unlink(missing_ok=True)
+
+
+def minimal_report(report: dict) -> dict:
+    """report.json in its minimal form, for an aborted run whose full report cannot be made:
+    the start, the verdict and its reason, and every selected row with the step it reached
+    (strings and booleans only, so it can always be written)."""
+    return {
+        "started_utc": report["started_utc"],
+        "verdict": "aborted",
+        "conforming": False,
+        "aborted": report["aborted"],
+        "minimal": "the full report could not be made; why is on stderr",
+        "rows": [{"row": r["row"], "status": r["status"]} for r in report["rows"]],
+    }
+
+
+def minimal_summary(report: dict) -> str:
+    """summary.md in its minimal form (``minimal_report``), its first lines as the full one's."""
+    lines = [
+        "# A/B/A report",
+        "",
+        "* **not gate evidence**: the run aborted (a minimal summary: the full one could not"
+        " be made; why is on stderr)",
+        f"* started {report['started_utc']}, overall verdict **aborted**",
+        f"* **aborted**: {report['aborted']}",
+        "",
+        "Rows and the step each reached: "
+        + ", ".join(f"{r['row']} ({r['status']})" for r in report["rows"])
+        + ".",
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def prepare_row(args, rec, old, new, env, out, pins) -> None:
+    """The warm-up step for one row: warm-up blocks, per-side counts and the expected duration;
+    the row's status goes from ``warm-up`` to ``planned``."""
+    name = rec["row"]
+    rec["status"] = "warm-up"
+    target = str(args.target_seconds)
+    rec["warmup"] = {
+        "A": run_block(old, "aba-calibrate", name, target, env, out / "blocks"),
+        "B": run_block(new, "aba-calibrate", name, target, env, out / "blocks"),
+    }
+    warm_a, warm_b = rec["warmup"]["A"], rec["warmup"]["B"]
+    n_a, n_b, source = side_counts(
+        warm_a, warm_b, args.target_seconds, args.calibration_margin, pins.get(name)
+    )
+    rec["iterations_a"], rec["iterations_b"] = n_a, n_b
+    rec["iterations_source"] = source
+    # Per-block cost outside the timed loop (process start, setup, the untimed first
+    # iteration): the warm-up block's process wall time minus its timed loop.
+    blk_a = n_a * warm_a["median_s"] + max(0.0, warm_a["wall_s"] - warm_a["block_s"])
+    blk_b = n_b * warm_b["median_s"] + max(0.0, warm_b["wall_s"] - warm_b["block_s"])
+    row_s = args.triples * (2 * blk_a + blk_b)
+    require_finite(f"{name} expected duration", [blk_a, blk_b, row_s])
+    rec["expected"] = {"block_a_s": blk_a, "block_b_s": blk_b, "row_s": row_s}
+    rec["status"] = "planned"
+
+
+def run_plan(report: dict) -> dict:
+    planned = [r for r in report["rows"] if r["status"] == "planned"]
+    total = sum(r["expected"]["row_s"] for r in planned)
+    require_finite("the expected duration of the run", total)
+    try:
+        finish = dt.datetime.now() + dt.timedelta(seconds=total)
+    except OverflowError as exc:
+        raise Abort(
+            f"the expected duration of the run, {total:.3g} s, ends beyond any date ({exc})"
+        ) from exc
+    return {
+        "rows": len(planned),
+        "expected_s": total,
+        "expected_finish_local": finish.isoformat(timespec="minutes"),
+    }
+
+
+def plan_text(report: dict) -> str:
+    lines = [
+        "plan (from the warm-up blocks, before the first timed block): "
+        f"{report['protocol']['triples']} triples per row",
+        f"  {'row':34s} {'iters A / B':>17s} {'block A / B s':>15s} {'expected':>10s}",
+    ]
+    for r in report["rows"]:
+        if r["status"] != "planned":
+            lines.append(f"  {r['row']:34s} {r['status']}")
+            continue
+        e = r["expected"]
+        iters = f"{r['iterations_a']} / {r['iterations_b']}"
+        blocks = f"{e['block_a_s']:.2f} / {e['block_b_s']:.2f}"
+        lines.append(f"  {r['row']:34s} {iters:>17s} {blocks:>15s} {e['row_s']:9.0f}s")
+    p = report["plan"]
+    lines.append(
+        f"  total: {p['rows']} rows, expected {p['expected_s']:.0f} s "
+        f"({p['expected_s'] / 60:.1f} min), finishing about {p['expected_finish_local']}"
+    )
+    return "\n".join(lines)
+
+
+def run_triples(args, report, report_path, rec, old, new, env) -> None:
+    """The timed step for one row: the timed triples with the per-side counts (each block must
+    report the count it was given), then the row statistics; the row's status goes from
+    ``timing`` to ``measured``."""
+    name = rec["row"]
+    rec["status"] = "timing"
+    t_row = time.perf_counter()
+    counts = {
+        "A1": rec["iterations_a"],
+        "B": rec["iterations_b"],
+        "A2": rec["iterations_a"],
+    }
+    rec["triples"] = []
+    for _ in range(args.triples):
+        trip = {}
+        for slot, side in (("A1", old), ("B", new), ("A2", old)):
+            blk = run_block(
+                side,
+                "aba-run",
+                name,
+                str(counts[slot]),
+                env,
+                report_path.parent / "blocks",
+            )
+            if blk["iterations"] != counts[slot]:
+                raise Abort(
+                    f"{side.label} aba-run {name}: the harness ran {blk['iterations']} "
+                    f"iterations, {counts[slot]} requested"
+                )
+            trip[slot] = blk
+        rec["triples"].append(trip)
+        write_report(report, report_path)
+    try:
+        stats = row_statistics(
+            rec["triples"],
+            args.tolerance,
+            args.budget,
+            args.rss_floor_mib * 2**20,
+            args.target_seconds,
+            args.resamples,
+            args.seed,
+        )
+    except Abort as exc:
+        raise Abort(f"{name}: {exc}") from exc  # a statistic of this row's blocks
+    rec.update(stats)
+    rec["row_wall_s"] = system_number(
+        f"{name} row wall time", time.perf_counter() - t_row
+    )
+    rec["status"] = "measured"
+    lo, hi = rec["ci95"]
+    print(
+        f"{name}: {rec['verdict']:12s} stat {rec['statistic'] * 100:+6.2f}% "
+        f"CI [{lo * 100:+6.2f}, {hi * 100:+6.2f}]% drift {rec['drift'] * 100:5.2f}% "
+        f"rss max B/A1 x{rec['rss_balanced_ratio']:.3f} {rec['rss_verdict']} "
+        f"iters {rec['iterations_a']}/{rec['iterations_b']} "
+        f"block min {rec['block_s_min']:.2f}s ({len(rec['short_blocks'])} short) "
+        f"digest {'same' if rec['digest_match'] else 'DIFFER'} "
+        f"({rec['row_wall_s']:.0f}s, expected {rec['expected']['row_s']:.0f}s)",
+        flush=True,
+    )
+    write_report(report, report_path)
+
+
+def pct(x: float) -> str:
+    return f"{x * 100:+.2f}"
+
+
+def iters_text(rec: dict) -> str:
+    return f"{rec['iterations_a']} / {rec['iterations_b']}"
+
+
+def row_choice_lines(report: dict) -> list[str]:
+    """The rows each glob selected and the rows of the groups it did not."""
+    sel = report["selection"]
+    status = {r["row"]: r["status"] for r in report["rows"]}
+    lines = [f"Selection (`--rows {sel['rows']}`):", ""]
+    for g in sel["globs"]:
+        rows = ", ".join(f"{n} ({status[n]})" for n in g["matched"])
+        lines.append(f"* `{g['glob']}` selected {len(g['matched'])}: {rows}")
+        if g["group_rows_not_matched"]:
+            lines.append(
+                f"  * rows of its groups ({', '.join(g['groups'])}) it did not select: "
+                + ", ".join(g["group_rows_not_matched"])
+            )
+    lines.append(
+        "* rows the selection did not select, by group: "
+        + (
+            "; ".join(
+                f"{grp}: {', '.join(names)}"
+                for grp, names in sel["not_selected"].items()
+            )
+            or "none"
+        )
+    )
+    return lines
+
+
+def plan_lines(report: dict) -> list[str]:
+    """The plan with each row's expected and actual duration; none when the run aborted during
+    the warm-up blocks."""
+    plan = report.get("plan")
+    if plan is None:
+        return []
+    lines = [
+        f"Plan printed before the first timed block: {plan['rows']} rows, expected"
+        f" {plan['expected_s'] / 60:.1f} min (finishing about"
+        f" {plan['expected_finish_local']}); per row expected / actual s:",
+        "",
+    ]
+    for r in report["rows"]:
+        if "expected" not in r:
+            continue
+        actual = r.get("row_wall_s")
+        lines.append(
+            f"* {r['row']}: iters {iters_text(r)}, expected"
+            f" {r['expected']['row_s']:.0f} s (blocks A {r['expected']['block_a_s']:.2f}"
+            f" s, B {r['expected']['block_b_s']:.2f} s), actual "
+            + (
+                f"{actual:.0f} s"
+                if actual is not None
+                else "not finished"
+                if r["status"] == "timing"
+                else "not run"
+            )
+        )
+    return lines
+
+
+def summary_text(report: dict) -> str:
+    """summary.md: the run's conformance and verdict first, then the table of rows."""
+    p = report["protocol"]
+    min_block = p["target_block_s"]
+    floor_mib = p["rss_floor_bytes"] / 2**20
+    machine = report["machine"]
+    lines = [
+        "# A/B/A report",
+        "",
+        "* **conforming run** (the protocol's evidence: accepted when the overall verdict"
+        " is pass)"
+        if report["conforming"]
+        else "* **not gate evidence**: the run does not conform to the protocol (see the"
+        " protocol, allocator and aborted lines)",
+        f"* started {report['started_utc']}, wall {report['wall_s'] / 60:.1f} min,"
+        f" overall verdict **{report['verdict']}**",
+        f"* A: `{report['sides']['A']['label']}`; B: `{report['sides']['B']['label']}`",
+        f"* protocol: triples {p['triples']} (protocol {p['protocol_triples']}),"
+        f" minimum timed block {min_block} s (protocol {p['protocol_block_s']} s)"
+        + (
+            ", **--allow-short given: below the protocol, not gate evidence**"
+            if p["allow_short"]
+            else ""
+        )
+        + f"; tolerance {p['tolerance'] * 100:.1f}%;"
+        f" memory: max B block peak <= max(x{p['budget']:.2f}, +{floor_mib:.0f} MiB) of max"
+        f" A1 block peak; bootstrap {p['bootstrap_resamples']} resamples",
+        f"* machine {machine['cpu']}, {machine['ncpu']} CPUs",
+        f"* machine state at start: {machine_line(machine['state_at_start'])}",
+        f"* machine state at end: {machine_line(machine['state_at_end'])}",
+        f"* allocator environment: {allocator_line(report['allocator_env'])}",
+        "* provenance: binary and source hashes in `meta.txt`; each binary re-hashed before and"
+        " after every block"
+        + (
+            f"; every hash equal to `{report['expect_meta']}`"
+            if "expect_meta" in report
+            else ""
+        ),
+        *([f"* **aborted**: {report['aborted']}"] if "aborted" in report else []),
+        "",
+        "Statistic = median over triples of `B / mean(A1, A2) - 1`; CI = 95% bootstrap"
+        " over triples; drift = median `|A1/A2 - 1|`. Times are per-iteration medians."
+        " Block s = shortest / median measured timed-block wall time (every block is in"
+        " `blocks.csv`). RSS max A1 / B = the largest A1 block peak (A1, the first"
+        " reference block of every triple, fixed in advance) and the largest B block peak;"
+        f" RSS allowance = max({p['budget']:.2f} x max A1, max A1 + {floor_mib:.0f} MiB), the"
+        " bound on max B; RSS max B/A1 = their ratio (warm-up blocks never count). Iters A / B"
+        " = the per-side iteration counts of the timed blocks (each side calibrated on its own"
+        " warm-up, unless pinned). Digest = whether every timed block of both sides reported"
+        " one and the same digest.",
+        "",
+        "| Row | Iters A / B | Block s min / med | A ms | B ms | Stat % | 95% CI % |"
+        " Drift % | RSS max A1 / B MiB | RSS allowance MiB | RSS max B/A1 | Digest |"
+        " Load max | Verdict |",
+        "|---|---:|---:|---:|---:|---:|---|---:|---:|---:|---:|---|---:|---|",
+    ]
+    for r in report["rows"]:
+        if r["status"] != "measured":
+            lines.append(f"| {r['row']} | | | | | | | | | | | | | {r['status']} |")
+            continue
+        lo, hi = r["ci95"]
+        short = f" ({len(r['short_blocks'])} short)" if r["short_blocks"] else ""
+        lines.append(
+            f"| {r['row']} | {iters_text(r)} |"
+            f" {r['block_s_min']:.2f} / {r['block_s_median']:.2f}{short} |"
+            f" {r['median_a_s'] * 1e3:.3f} | {r['median_b_s'] * 1e3:.3f} |"
+            f" {pct(r['statistic'])} | [{pct(lo)}, {pct(hi)}] | {r['drift'] * 100:.2f} |"
+            f" {r['rss_a1_max_bytes'] / 2**20:.1f} / {r['rss_b_max_bytes'] / 2**20:.1f} |"
+            f" {r['rss_allowance_bytes'] / 2**20:.1f} | {r['rss_balanced_ratio']:.3f} |"
+            f" {'same' if r['digest_match'] else 'DIFFER'} | {r['load1_max']:.1f} |"
+            f" {r['verdict']} |"
+        )
+    measured = [r for r in report["rows"] if r["status"] == "measured"]
+    if measured:
+        abs_stat = sorted(abs(r["statistic"]) for r in measured)
+        widths = sorted(r["ci95"][1] - r["ci95"][0] for r in measured)
+        drifts = sorted(r["drift"] for r in measured)
+        counts = {
+            v: sum(r["verdict"] == v for r in measured)
+            for v in ("pass", "fail", "inconclusive")
+        }
+
+        def rows_where(test, text=lambda r: r["row"]) -> str:
+            return ", ".join(text(r) for r in measured if test(r)) or "none"
+
+        lines += [
+            "",
+            f"Rows measured: {len(measured)} ({counts['pass']} pass, {counts['fail']} fail,"
+            f" {counts['inconclusive']} inconclusive); not measured:"
+            f" {len(report['rows']) - len(measured)}.",
+            f"Noise floor over measured rows: |statistic| median {median(abs_stat) * 100:.2f}%,"
+            f" max {abs_stat[-1] * 100:.2f}%; CI width median {median(widths) * 100:.2f}%,"
+            f" max {widths[-1] * 100:.2f}%; drift median {median(drifts) * 100:.2f}%,"
+            f" max {drifts[-1] * 100:.2f}%.",
+            f"Rows with timed blocks below {min_block} s (fail): "
+            + rows_where(
+                lambda r: r["short_blocks"],
+                lambda r: f"{r['row']} ({len(r['short_blocks'])} blocks, shortest"
+                f" {r['block_s_min']:.2f} s)",
+            )
+            + ".",
+            "Bimodal sides (same-side clusters, fail): "
+            + rows_where(
+                lambda r: r["bimodal"],
+                lambda r: f"{r['row']} ({', '.join(r['bimodal'])}: gap"
+                f" {max(r['clusters'][x]['gap'] for x in r['bimodal']) * 100:.1f}%)",
+            )
+            + ".",
+            "Memory failures: "
+            + rows_where(lambda r: r["rss_verdict"] == "fail")
+            + ".",
+            "Inconclusive rows: "
+            + rows_where(lambda r: r["verdict"] == "inconclusive")
+            + ".",
+            "Digest mismatches (fail): "
+            + rows_where(lambda r: not r["digest_match"])
+            + ".",
+            "",
+            "Timed blocks per side (ms per iteration; A in triple order A1, A2):",
+            "",
+        ]
+        for r in measured:
+            lines.append(
+                f"* {r['row']}: A "
+                + ", ".join(f"{x * 1e3:.4g}" for x in r["blocks_a_s"])
+                + "; B "
+                + ", ".join(f"{x * 1e3:.4g}" for x in r["blocks_b_s"])
+            )
+        lines += [
+            "",
+            "Peak RSS per timed block (MiB, triple order; the memory rule compares the largest"
+            " A1 with the largest B; A2 is a diagnostic):",
+            "",
+        ]
+        for r in measured:
+            peaks = {
+                k: ", ".join(
+                    f"{t[k]['rss_tree_bytes'] / 2**20:.1f}" for t in r["triples"]
+                )
+                for k in ("A1", "B", "A2")
+            }
+            lines.append(
+                f"* {r['row']}: A1 {peaks['A1']}; B {peaks['B']}; A2 {peaks['A2']}"
+            )
+    lines += ["", *plan_lines(report), "", *row_choice_lines(report)]
+    return "\n".join(lines) + "\n"
+
+
+def number_option(kind: type, domain: str):
+    """An argparse ``type``: ``kind(text)`` in ``domain`` (``domain_problem``)."""
+
+    def parse(text: str):
+        value = kind(text)
+        if bad := domain_problem("value", value, NUMBER, domain):
+            raise argparse.ArgumentTypeError(bad)
+        return value
+
+    return parse
+
+
+class ArgumentParser(argparse.ArgumentParser):
+    def error(self, message):
+        raise Refused(message)
+
+
+def parser() -> argparse.ArgumentParser:
+    # Options by their full names only, each at most once (main): argparse would otherwise take a
+    # prefix of a name for the option, and the last of an option given twice.
+    ap = ArgumentParser(
+        allow_abbrev=False,
+        description=__doc__.split("\n\n")[0],
+        epilog="Exit status: 0 the run completed, whatever its verdict (summary.md and"
+        " report.json give the verdict and the conformance), 1 aborted, 2 refused before the"
+        " first block, 130 interrupted (Ctrl-C) before the first block.",
+    )
+    ap.add_argument("--old-bin", required=True, help="the reference harness (side A)")
+    ap.add_argument("--new-bin", required=True, help="the candidate harness (side B)")
+    ap.add_argument("--old-label", default="old")
+    ap.add_argument("--new-label", default="new")
+    ap.add_argument(
+        "--rows",
+        default="all",
+        help="comma list of row/group globs (spaces around a glob ignored, case-sensitive); "
+        "a glob that matches no row or group is an error (the groups that exist are "
+        "listed)",
+    )
+    ap.add_argument(
+        "--triples",
+        type=number_option(int, POSITIVE),
+        default=PROTOCOL_TRIPLES,
+        help=f"A-B-A triples per row (protocol: {PROTOCOL_TRIPLES}; fewer needs "
+        "--allow-short)",
+    )
+    ap.add_argument("--tolerance", type=number_option(float, NONNEGATIVE), default=0.03)
+    ap.add_argument(
+        "--budget",
+        type=number_option(float, POSITIVE),
+        default=1.10,
+        help="RSS budget factor",
+    )
+    ap.add_argument(
+        "--rss-floor-mib",
+        type=number_option(float, NONNEGATIVE),
+        default=RSS_FLOOR_MIB,
+        help="absolute RSS allowance: allowance = max(budget * ref, ref + floor)",
+    )
+    ap.add_argument(
+        "--target-seconds",
+        type=number_option(float, POSITIVE),
+        default=PROTOCOL_BLOCK_SECONDS,
+        help="minimum measured timed-block length (protocol: 2 s; shorter needs "
+        "--allow-short); every shorter block fails its row",
+    )
+    ap.add_argument(
+        "--calibration-margin",
+        type=number_option(float, NONNEGATIVE),
+        default=0.10,
+        help="iterations are calibrated for target * (1 + margin)",
+    )
+    ap.add_argument(
+        "--allow-short",
+        action="store_true",
+        help="permit fewer triples or shorter blocks than the protocol; the summary "
+        "labels the run as not gate evidence",
+    )
+    ap.add_argument(
+        "--expect-meta",
+        help="a previous meta.txt: refuse to run unless every hash matches it",
+    )
+    ap.add_argument("--resamples", type=number_option(int, POSITIVE), default=10000)
+    ap.add_argument("--seed", type=number_option(int, ANY), default=20261003)
+    ap.add_argument(
+        "--iters",
+        help="row=N,... (both sides) or row=NA:NB,... (per side) pinned iteration counts; "
+        "every row a selected one, none twice",
+    )
+    ap.add_argument(
+        "--out",
+        help="output directory, absent or empty (default dev/perf/results/<timestamp>)",
+    )
+    return ap
+
+
+def main_run() -> int:
+    if sys.version_info < PYTHON_MIN:
+        raise Refused(
+            f"aba.py needs Python {'.'.join(map(str, PYTHON_MIN))} or newer, not "
+            f"{platform.python_version()} ({sys.executable})"
+        )
+    ap = parser()
+    args = ap.parse_args()
+    # Every option at most once: argparse keeps the last of two, so one would be ignored. After a
+    # successful parse an argument that starts with "--" is an option, alone or joined to its
+    # value by "=" (argparse takes a separate value that starts with "--" for an option).
+    given = [a.split("=", 1)[0] for a in sys.argv[1:] if a.startswith("--")]
+    if twice := sorted({a for a in given if given.count(a) > 1}):
+        ap.error(f"{', '.join(twice)} given more than once")
+    # The labels name the sides in every block, stderr log and meta.txt.
+    for option, label in (
+        ("--old-label", args.old_label),
+        ("--new-label", args.new_label),
+    ):
+        if not LABEL.fullmatch(label):
+            ap.error(
+                f"{option} {label!r}: a label is 1 to 32 of the characters a-z, 0-9, '_' and"
+                " '-'"
+            )
+    if args.old_label == args.new_label:
+        ap.error("--old-label and --new-label must be two different names")
+    if set(args.rows) - ROWS_TEXT:
+        ap.error(
+            f"--rows {args.rows!r}: only the characters of row names (a-z, 0-9, '.', '_',"
+            " '-'), the glob characters '*', '?', '[', ']' and '!', commas and spaces"
+        )
+    for option, path in (("--out", args.out), ("--expect-meta", args.expect_meta)):
+        if path is not None and not path.isprintable():
+            ap.error(
+                f"{option} {path!r}: a path with a character that is not printable"
+            )
+    short = []
+    if args.triples < PROTOCOL_TRIPLES:
+        short.append(f"--triples {args.triples} < {PROTOCOL_TRIPLES}")
+    if args.target_seconds < PROTOCOL_BLOCK_SECONDS:
+        short.append(
+            f"--target-seconds {args.target_seconds} < {PROTOCOL_BLOCK_SECONDS}"
+        )
+    if short and not args.allow_short:
+        ap.error(
+            "below the protocol: "
+            + "; ".join(short)
+            + " (pass --allow-short for a run labelled as not gate evidence)"
+        )
+    # The options' own domains hold (number_option); the values derived from them must be
+    # finite too (a huge --target-seconds or --rss-floor-mib overflows).
+    for what, value in (
+        (
+            "--target-seconds * (1 + --calibration-margin)",
+            args.target_seconds * (1 + args.calibration_margin),
+        ),
+        ("--rss-floor-mib in bytes", args.rss_floor_mib * 2**20),
+    ):
+        if not math.isfinite(value):
+            ap.error(f"{what} is {value!r}, not finite")
+    old = make_side("A", args.old_label, args.old_bin)
+    new = make_side("B", args.new_label, args.new_bin)
+    return run(args, old, new)
+
+
+def refusal_outputs(reason: str) -> None:
+    """A refusal's minimal report, when an unambiguous, printable, unused output path is writable.
+    An invalid or occupied path is never used; failure to write it is reported on stderr."""
+    paths = []
+    argv = sys.argv[1:]
+    for i, arg in enumerate(argv):
+        if arg.startswith("--out="):
+            paths.append(arg[6:])
+        elif arg == "--out":
+            paths.append(
+                argv[i + 1]
+                if i + 1 < len(argv) and not argv[i + 1].startswith("--")
+                else ""
+            )
+    if len(paths) > 1 or (paths and not paths[0].isprintable()):
+        warn("cannot write refusal outputs: --out is ambiguous or not a printable path")
+        return
+    out = (
+        Path(paths[0])
+        if paths
+        else HERE / "results" / dt.datetime.now().strftime("%Y%m%dT%H%M%S%f")
+    )
+    try:
+        if out.exists() and (not out.is_dir() or any(out.iterdir())):
+            warn(f"cannot write refusal outputs: {out} must be absent or empty")
+            return
+        out.mkdir(parents=True, exist_ok=True)
+    except OSError as exc:
+        warn(f"cannot write refusal outputs: {exc}")
+        return
+    report = {
+        "started_utc": dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"),
+        "aborted": reason,
+        "rows": [],
+    }
+    for name, text in (
+        ("report.json", report_text(minimal_report(report))),
+        ("summary.md", minimal_summary(report)),
+    ):
+        try:
+            atomic_text(out / name, text)
+        except Exception as exc:
+            warn(f"cannot write {out / name}: {exc}")
+
+
+def main() -> int:
+    with interrupts_once() as interrupts:
+        try:
+            return main_run()
+        except KeyboardInterrupt as exc:
+            interrupts.hold()
+            reason = "interrupted (SIGINT, Ctrl-C)" + (
+                f" during {exc}" if exc.args else ""
+            )
+            status = 130
+        except Exception as exc:
+            interrupts.hold()
+            reason = (
+                str(exc) if isinstance(exc, Refused) else f"{type(exc).__name__}: {exc}"
+            )
+            status = 2
+        warn(f"error: {reason}")
+        refusal_outputs(reason)
+        return status
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/dev/perf/aba_api.hpp b/dev/perf/aba_api.hpp
new file mode 100644
index 0000000..3170593
--- /dev/null
+++ b/dev/perf/aba_api.hpp
@@ -0,0 +1,1244 @@
+// The A/B/A row adapter for the current Core API. The rows (aba_rows.hpp) call only `abaapi::`;
+// this file implements each call with the public Core API, so the same rows run unchanged on any
+// two builds that share this API (README.md: a build with another public API needs this file
+// adapted first).
+//
+// Row mapping of the search rows:
+// The route choice of a search is spelled in target terms (Sel: multipath, parallel_edges,
+// higher_available_capacity as the HIGHER_AVAILABLE_CAPACITY tie_break); the default Sel is
+// multipath and parallel_edges with the FEWER_HOPS tie_break. A supplied residual always gates its
+// edges at min_residual = 1 unit (through to_units); capacity is no condition of a search (the
+// row graphs have no edge below 1 unit, so this does not change their digests).
+// * spf (spf.full.*, except the storage row spf.full.random1m, which runs search_run below):
+//   spf(g, {src}, Forward, no targets), the default route choice, with or without the masks (as one
+//   Eligibility) and the residual. Digest: 16 sampled costs, the DAG's entry count and its first
+//   and last via.
+// * spf_dag (spf.dag.*): spf(g, {src}, Forward, targets {dst}), the default route choice: the DAG of
+//   the shortest walks that end in the target. Digest: target_cost, entries, first and last via.
+// * spf_to (spf.to.random16k): spf(g, {dst}, Reverse, no targets), the default route choice.
+// * targetset_* (spf.to.targetset_clos): the Clos graph and the destination set; the timed call is
+//   a full reverse spf rooted at the destination set, targets absent.
+// * spf_path (spf.single.canonical16k): spf(g, {src}, Forward, targets {dst}) with the row's
+//   route choice (multipath = false) and the residual: the canonical single path. Digest:
+//   target_cost and the walk.
+// * ksp: K shortest paths with the row's tie and parallel-edge choices, no
+//   residual, no ceiling, no masks. Digest: the path count, then per
+//   path its cost, hop count and B' edge ids (the graph's edge ids, ordered by source, cost, target
+//   and input position).
+// The kernel rows place on fixed DAGs read with the public spf with targets (base_dag): Optimized
+// as CentralizedTE restricted to the DAG (CentralizedTE(support = dag)), the other kernels as Pinned over a
+// program of the one split route (from_routes per placement; Weighted with the capacity weights).
+//
+// The storage rows' interface (README "Rows"): construct_prepare and construct_run (the
+// constructor on prepared unit capacities, then the sampled digest of construct_sample),
+// queue_choice (the library's queue rule, read through the private detail::bucket_width and
+// detail::uses_buckets: the one use of a non-public function here) and search_run (one full
+// search plus the sampled digest of search_sample). The digests read only API-independent
+// values: node-indexed counts and distances, costs, physical capacities and edges named by
+// their input position, so they are the same for any API that builds the same graph.
+#pragma once
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+
+#include <algorithm>
+#include <array>
+#include <exception>
+#include <stdexcept>
+#include <thread>
+#include <cstdint>
+#include <cstring>
+#include <memory>
+#include <optional>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace abaapi {
+namespace nc = netgraph::core;
+
+// Digest: order-sensitive 64-bit mix (splitmix64 finaliser over a running state).
+struct Digest {
+  std::uint64_t h = 0x9e3779b97f4a7c15ULL;
+  void add(std::uint64_t v) {
+    std::uint64_t z = (h ^ v) + 0x9e3779b97f4a7c15ULL;
+    z = (z ^ (z >> 30)) * 0xbf58476d1ce4e5b9ULL;
+    z = (z ^ (z >> 27)) * 0x94d049bb133111ebULL;
+    h = z ^ (z >> 31);
+  }
+  void add_i(std::int64_t v) { add(static_cast<std::uint64_t>(v)); }
+  void add_d(double v) {
+    std::uint64_t bits;
+    std::memcpy(&bits, &v, sizeof bits);
+    add(bits);
+  }
+};
+
+// API-independent graph description: edges in input order, physical capacities.
+struct Arrays {
+  int n = 0;
+  std::vector<std::int32_t> src, dst;
+  std::vector<double> cap;
+  std::vector<std::int64_t> cost;
+  int num_edges() const { return static_cast<int>(src.size()); }
+};
+
+// The resolution a NetGraph scenario supplies by default: one integer unit is 1/4096 of a
+// capacity unit.
+inline constexpr double kResolution = 1.0 / 4096.0;
+
+inline nc::Graph graph_of(const Arrays& a) {
+  std::vector<nc::Amount> units(a.cap.size());
+  for (std::size_t i = 0; i < a.cap.size(); ++i) units[i] = nc::to_units(a.cap[i], kResolution);
+  return nc::Graph(a.n, a.src, a.dst, units, a.cost, kResolution);
+}
+
+// The graph plus the caller's inverse of input_positions() (input edge index -> EdgeId), and the
+// warm ShortestPathCache of the cache.warm row (one per graph, prepopulated by the untimed iteration).
+struct Graph {
+  std::shared_ptr<const nc::Graph> g;
+  std::vector<std::int32_t> edge_of_input;
+  std::shared_ptr<nc::ShortestPathCache> warm_cache;
+  const nc::Graph& ref() const { return *g; }
+};
+
+// Construction from physical arrays: to_units on every capacity, then the one constructor.
+inline std::uint64_t construct(const Arrays& a) {
+  auto g = graph_of(a);
+  Digest d;
+  d.add_i(g.num_edges());
+  d.add_i(g.max_edge_cost());
+  d.add_i(g.edge_cost_gcd());
+  d.add_i(g.outgoing_offsets()[static_cast<std::size_t>(a.n / 2)]);
+  return d.h;
+}
+
+inline Graph build(const Arrays& a) {
+  Graph out;
+  out.g = std::make_shared<const nc::Graph>(graph_of(a));
+  out.edge_of_input.assign(a.src.size(), -1);
+  auto ii = out.g->input_positions();
+  for (std::size_t e = 0; e < ii.size(); ++e) out.edge_of_input[static_cast<std::size_t>(ii[e])] = static_cast<std::int32_t>(e);
+  return out;
+}
+
+// Per-edge values given in input-edge order, in id order.
+inline std::vector<double> edge_values(const Graph& g, const std::vector<double>& by_input) {
+  std::vector<double> out(by_input.size());
+  for (std::size_t i = 0; i < by_input.size(); ++i) out[static_cast<std::size_t>(g.edge_of_input[i])] = by_input[i];
+  return out;
+}
+
+// Static eligibility: the Eligibility value built from excluded ids (input edges translated).
+struct Elig {
+  std::optional<nc::Eligibility> el;
+  const nc::Eligibility* get() const { return el ? &*el : nullptr; }
+};
+
+inline Elig eligibility(const Graph& g, const std::vector<int>& excluded_nodes,
+                        const std::vector<int>& excluded_input_edges) {
+  std::vector<nc::NodeId> xn(excluded_nodes.begin(), excluded_nodes.end());
+  std::vector<nc::EdgeId> xe;
+  xe.reserve(excluded_input_edges.size());
+  for (int i : excluded_input_edges) xe.push_back(g.edge_of_input[static_cast<std::size_t>(i)]);
+  Elig out;
+  out.el = g.ref().eligibility(xn, xe);
+  return out;
+}
+
+inline std::uint64_t eligibility_build_intersect(const Graph& g, const std::vector<int>& common,
+                                                 const std::vector<std::vector<int>>& states) {
+  const Elig base = eligibility(g, {}, common);
+  Digest d;
+  d.add(base.el->uid() != 0 ? 1U : 0U);
+  for (const auto& st : states) {
+    const Elig el = eligibility(g, {}, st);
+    const auto both = nc::Eligibility::intersect(*base.el, *el.el);
+    std::uint64_t allowed = 0;
+    for (auto x : both.edge_allowed()) allowed += x;
+    d.add(allowed);
+  }
+  return d.h;
+}
+
+// A search's route choice, spelled in target terms (multipath: the DAG of every equal-cost walk).
+struct Sel {
+  bool multipath = true;
+  bool parallel_edges = true;
+  bool higher_available_capacity = false;
+};
+
+inline void choose(nc::SpfOptions& o, const Sel& s) {
+  o.tie_break = s.higher_available_capacity ? nc::RouteTieBreak::HigherAvailableCapacity : nc::RouteTieBreak::FewerHops;
+  o.multipath = s.multipath;
+  o.parallel_edges = s.parallel_edges;
+}
+
+// A residual given in physical units (id order) as units.
+inline std::vector<nc::Amount> residual_units(const std::vector<double>& residual) {
+  std::vector<nc::Amount> out(residual.size());
+  for (std::size_t e = 0; e < residual.size(); ++e) out[e] = nc::to_units(residual[e], kResolution);
+  return out;
+}
+
+inline nc::SpfResult run_spf(const Graph& g, std::span<const nc::NodeId> roots, nc::Direction dir,
+                             std::optional<std::vector<nc::NodeId>> targets, const Sel& s, const Elig* el,
+                             const std::vector<double>* residual) {
+  nc::SpfOptions o(dir);
+  choose(o, s);
+  o.targets = std::move(targets);
+  std::vector<nc::Amount> units;
+  if (residual != nullptr) {
+    units = residual_units(*residual);
+    o.residual = std::span<const nc::Amount>(units);
+  }
+  o.eligibility = el ? el->get() : nullptr;
+  return nc::spf(g.ref(), roots, o);
+}
+
+inline void fold_dag(Digest& d, const nc::PredecessorDAG& dag) {
+  const auto via = dag.via_edges();
+  d.add_i(static_cast<std::int64_t>(via.size()));
+  if (!via.empty()) {
+    d.add_i(via.front());
+    d.add_i(via.back());
+  }
+}
+
+inline void fold_costs(Digest& d, const std::vector<nc::Cost>& dist) {
+  const std::size_t n = dist.size();
+  for (std::size_t k = 0; k < 16 && n; ++k) d.add_i(dist[(k * 7919) % n]);
+}
+
+inline std::uint64_t spf(const Graph& g, int src, const Elig* el, const std::vector<double>* residual) {
+  const nc::NodeId roots[1] = {src};
+  auto r = run_spf(g, roots, nc::Direction::Forward, std::nullopt, Sel {}, el, residual);
+  Digest d;
+  fold_costs(d, *r.costs);
+  fold_dag(d, r.dag);
+  return d.h;
+}
+
+inline std::uint64_t spf_dag(const Graph& g, int src, int dst) {
+  const nc::NodeId roots[1] = {src};
+  auto r = run_spf(g, roots, nc::Direction::Forward, std::vector<nc::NodeId> {dst}, Sel {}, nullptr, nullptr);
+  Digest d;
+  d.add_i(*r.target_cost);
+  fold_dag(d, r.dag);
+  return d.h;
+}
+
+inline std::uint64_t spf_to(const Graph& g, int dst) {
+  const nc::NodeId roots[1] = {dst};
+  auto r = run_spf(g, roots, nc::Direction::Reverse, std::nullopt, Sel {}, nullptr, nullptr);
+  Digest d;
+  fold_costs(d, *r.costs);
+  fold_dag(d, r.dag);
+  return d.h;
+}
+
+// ---- Destination, endpoint-set and canonical single-path rows (README "Rows")
+
+// spf.to.targetset_clos: the Clos graph and the destination set; nothing else is built.
+struct TargetSet {
+  std::shared_ptr<Graph> g;
+  std::vector<nc::NodeId> destinations;
+};
+
+inline TargetSet targetset_prepare(const Arrays& clos, const std::vector<int>& destinations) {
+  TargetSet ts;
+  ts.g = std::make_shared<Graph>(build(clos));
+  ts.destinations.assign(destinations.begin(), destinations.end());
+  return ts;
+}
+
+inline std::uint64_t targetset_run(const TargetSet& ts) {
+  auto r = run_spf(*ts.g, ts.destinations, nc::Direction::Reverse, std::nullopt, Sel {}, nullptr, nullptr);
+  Digest d;
+  fold_costs(d, *r.costs);
+  fold_dag(d, r.dag);
+  return d.h;
+}
+
+// spf.single.canonical16k: the canonical single path (multipath = false) to a target.
+inline std::uint64_t spf_path(const Graph& g, int src, int dst, const Sel& s, const std::vector<double>* residual) {
+  const nc::NodeId roots[1] = {src};
+  auto r = run_spf(g, roots, nc::Direction::Forward, std::vector<nc::NodeId> {dst}, s, nullptr, residual);
+  Digest d;
+  d.add_i(*r.target_cost);
+  for (auto e : r.dag.via_edges()) d.add_i(e);
+  return d.h;
+}
+
+// A fixed DAG for placement kernels: the ShortestPaths destination search (setup, not timed).
+struct Dag {
+  std::shared_ptr<const nc::PredecessorDAG> dag;
+};
+inline Dag base_dag(const Graph& g, int src, int dst) {
+  const nc::NodeId roots[1] = {src};
+  auto r = run_spf(g, roots, nc::Direction::Forward, std::vector<nc::NodeId> {dst}, Sel {}, nullptr, nullptr);
+  return Dag {std::make_shared<const nc::PredecessorDAG>(std::move(r.dag))};
+}
+
+// The placement kernels the rows time; Lossy is Equal placement with Lossy admission.
+enum class Kernel { Optimized, Equal, Lossy, Weighted };
+
+struct KernelAxes {
+  nc::RouteAllocation allocation = nc::RouteAllocation::Optimized;
+  nc::Admission admission = nc::Admission::Lossless;
+};
+
+inline KernelAxes axes(Kernel k) {
+  KernelAxes a;
+  switch (k) {
+    case Kernel::Optimized: break;
+    case Kernel::Equal: a.allocation = nc::RouteAllocation::Equal; break;
+    case Kernel::Lossy: a.allocation = nc::RouteAllocation::Equal; a.admission = nc::Admission::Lossy; break;
+    case Kernel::Weighted: a.allocation = nc::RouteAllocation::Weighted; break;
+  }
+  return a;
+}
+
+// ShortestPaths `sp` with the kernel's allocation, and the kernel's admission.
+inline nc::FlowPolicyConfig config(nc::ShortestPaths sp, Kernel k) {
+  const auto a = axes(k);
+  sp.allocation = a.allocation;
+  return nc::FlowPolicyConfig {std::move(sp), a.admission};
+}
+
+// CentralizedTE with its source allocation, on `support` (nullptr: every eligible edge).
+inline nc::CentralizedTE centralized(nc::SourceAllocation source_allocation,
+                                     std::shared_ptr<const nc::PredecessorDAG> support = {}) {
+  nc::CentralizedTE gl(source_allocation);
+  gl.support = std::move(support);
+  return gl;
+}
+
+// Manual placements on fixed DAGs into one ledger: one policy per placement on that one DAG
+// (Optimized: CentralizedTE with the DAG as its support; the other kernels: Pinned over the program of the
+// one split route), destroyed after the call (its records stay in the ledger as orphans).
+struct Ledger {
+  nc::FlowLedger fg;
+  explicit Ledger(const Graph& g) : fg(g.g) {}
+  double place(int src, int dst, const Dag& dag, double amount, Kernel k) {
+    const auto a = axes(k);
+    const nc::NodeId s[1] = {src};
+    const nc::NodeId t[1] = {dst};
+    nc::FlowPolicyConfig cfg;
+    cfg.admission = a.admission;
+    if (k == Kernel::Optimized) {
+      cfg.routing = centralized(nc::SourceAllocation::Optimized, dag.dag);
+    } else {
+      nc::RouteOptions options;
+      options.allocation = a.allocation;
+      const nc::RouteDefinition routes[1] = {nc::RouteDefinition {src, dag.dag, 1}};
+      cfg.routing = nc::Pinned {nc::ForwardingProgram::from_routes(*fg.graph(), s, t, routes, options), nullptr};
+    }
+    nc::FlowPolicy policy(fg, s, t, std::move(cfg));
+    const auto r = policy.place(nc::to_units(amount, kResolution));
+    return nc::as_float(r.call_delivered, kResolution);
+  }
+};
+
+// Scalar ShortestPaths policy capacity: place(+inf) of a ShortestPaths policy on a fresh ledger.
+inline double shortest_paths_capacity(const Graph& g, int src, int dst, Kernel k, const Elig& el) {
+  const nc::NodeId s[1] = {src};
+  const nc::NodeId t[1] = {dst};
+  nc::EvaluationOptions opts {config(nc::ShortestPaths {}, k), el.get(), nullptr, {}};
+  return nc::as_float(nc::evaluate_demand(g.ref(), s, t, opts).call_delivered, kResolution);
+}
+
+inline nc::FlowPolicyConfig global_config() {
+  return nc::FlowPolicyConfig {.routing = centralized(nc::SourceAllocation::Optimized)};
+}
+
+// Exact maximum flow: evaluate_demand() with CentralizedTE (optimized source allocation), totals only
+// or with every optional output (edge flows, residual, saturated boundary edges, min_cut).
+inline std::uint64_t maxflow_exact(const Graph& g, int src, int dst, const Elig& el, bool detailed) {
+  const nc::NodeId s[1] = {src};
+  const nc::NodeId t[1] = {dst};
+  nc::OutputOptions out;
+  if (detailed) out = nc::OutputOptions {true, true, true, true};
+  nc::EvaluationOptions opts {global_config(), el.get(), nullptr, out};
+  const auto r = nc::evaluate_demand(g.ref(), s, t, opts);
+  Digest d;
+  d.add_d(nc::as_float(r.call_delivered, kResolution));
+  d.add_i(r.min_cut ? static_cast<std::int64_t>(r.min_cut->size()) : -1);
+  d.add_i(r.marginal_cost_curve ? static_cast<std::int64_t>(r.marginal_cost_curve->size()) : -1);
+  if (detailed) {
+    std::int64_t residual = 0;
+    for (auto x : *r.residual) residual += x;
+    d.add_i(residual);
+    d.add_i(static_cast<std::int64_t>(r.saturated_boundary_edges->size()));
+  }
+  return d.h;
+}
+
+inline std::uint64_t fold_edge_failures(const nc::SensitivityResult& r) {
+  Digest d;
+  d.add_d(nc::as_float(r.baseline.call_delivered, kResolution));
+  for (const auto& e : r.entries) {
+    d.add_i(e.edge);
+    d.add_d(nc::as_float(e.delivery_reduction, kResolution));
+  }
+  return d.h;
+}
+
+// Exact-model failure study: CentralizedTE, optimized source allocation (candidates: the baseline's positive-flow edges).
+inline std::uint64_t edge_failures_exact(const Graph& g, int src, int dst, const Elig& el, std::int32_t workers = 1) {
+  const nc::NodeId s[1] = {src};
+  const nc::NodeId t[1] = {dst};
+  nc::EvaluationOptions opts {global_config(), el.get(), nullptr, {}};
+  return fold_edge_failures(nc::evaluate_edge_failures(g.ref(), s, t, opts, workers));
+}
+
+// Complete evaluator call on a fixed failure-study population. A finite offer is
+// physical, converted on both sides at the graph's common resolution.
+inline std::uint64_t edge_failures_unmasked(const Graph& g, int dst, std::optional<double> offer = std::nullopt,
+                                           std::int32_t workers = 1) {
+  const nc::NodeId sources[1] = {0};
+  const nc::NodeId destinations[1] = {dst};
+  nc::EvaluationOptions options {global_config()};
+  if (offer) options.offer = std::optional<nc::Amount>(nc::to_units(*offer, kResolution));
+  return fold_edge_failures(nc::evaluate_edge_failures(g.ref(), sources, destinations, options, workers));
+}
+
+// Policy-model failure study over every allowed edge: ShortestPaths Equal.
+inline std::uint64_t edge_failures_policy_all_edges(const Graph& g, int src, int dst, const Elig& el, std::int32_t workers = 1) {
+  const nc::NodeId s[1] = {src};
+  const nc::NodeId t[1] = {dst};
+  const auto cfg = config(nc::ShortestPaths {}, Kernel::Equal);
+  nc::EvaluationOptions opts {cfg, el.get(), nullptr, {}};
+  return fold_edge_failures(nc::evaluate_edge_failures(g.ref(), s, t, opts, workers));
+}
+
+// Pooled ShortestPaths placement: one Equal policy (Lossless, or Lossy) per demand of several
+// sources to one destination on one shared ledger, place(to_units(offer)) each. The digest folds
+// every call's delivered amount, its drop total and count, and every source row (source, admitted,
+// delivered, source loss, dropped).
+inline std::uint64_t pooled_place(const Graph& g, const std::vector<std::pair<std::vector<int>, int>>& demands,
+                                  double offer, bool lossy) {
+  const auto cfg = config(nc::ShortestPaths {}, lossy ? Kernel::Lossy : Kernel::Equal);
+  nc::FlowLedger fg(g.g);
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  Digest d;
+  const auto units = nc::to_units(offer, kResolution);
+  for (const auto& [srcs, dst] : demands) {
+    const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+    const nc::NodeId tv[1] = {dst};
+    policies.push_back(std::make_unique<nc::FlowPolicy>(fg, sv, tv, cfg));
+    const auto r = policies.back()->place(units);
+    d.add_i(r.call_delivered);
+    nc::Amount drops = 0;
+    for (const auto& [e, x] : r.call_edge_drops) drops += x;
+    d.add_i(drops);
+    d.add_i(static_cast<std::int64_t>(r.call_edge_drops.size()));
+    for (const auto& row : r.by_source) {
+      d.add_i(row.source);
+      d.add(row.admitted.lo);
+      d.add_i(row.delivered);
+      d.add(row.source_drops.lo);
+      d.add(row.total_edge_drops.lo);
+    }
+  }
+  return d.h;
+}
+
+// Several demands at once: the pooled demands of pooled_place (ShortestPaths Equal Lossy, one
+// ledger per iteration, the policies created in demand order) given a full offer each: as scalar
+// replace(to_units(offer)) calls in demand order, or as one apply_actions list of the same Replace
+// actions (ORDERED: the same work as the scalar calls, the same results; SIMULTANEOUS: forwarded at
+// once). The digest folds every entry as pooled_place folds a call.
+enum class Batch { Scalar, Ordered, Simultaneous };
+inline std::uint64_t batch_place(const Graph& g, const std::vector<std::pair<std::vector<int>, int>>& demands, double offer, Batch mode) {
+  const auto cfg = config(nc::ShortestPaths {}, Kernel::Lossy);
+  nc::FlowLedger fg(g.g);
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  const auto units = nc::to_units(offer, kResolution);
+  for (const auto& [srcs, dst] : demands) {
+    const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+    const nc::NodeId tv[1] = {dst};
+    policies.push_back(std::make_unique<nc::FlowPolicy>(fg, sv, tv, cfg));
+  }
+  std::vector<nc::PlacementResult> results;
+  if (mode == Batch::Scalar) {
+    for (auto& p : policies) results.push_back(p->replace(units));
+  } else {
+    std::vector<nc::Action> actions;
+    for (auto& p : policies) actions.push_back(nc::Replace {*p, units});
+    results = nc::apply_actions(fg, actions, mode == Batch::Ordered ? nc::BatchMode::Ordered : nc::BatchMode::Simultaneous);
+  }
+  Digest d;
+  for (const auto& r : results) {
+    d.add_i(r.call_delivered);
+    nc::Amount drops = 0;
+    for (const auto& [e, x] : r.call_edge_drops) drops += x;
+    d.add_i(drops);
+    d.add_i(static_cast<std::int64_t>(r.call_edge_drops.size()));
+    for (const auto& row : r.by_source) {
+      d.add_i(row.source);
+      d.add(row.admitted.lo);
+      d.add_i(row.delivered);
+      d.add(row.source_drops.lo);
+      d.add(row.total_edge_drops.lo);
+    }
+  }
+  return d.h;
+}
+
+// The ring: routers 0..63 with ring links i -> (i + 1) mod 64 of 3 units (EdgeIds 0..63), heads
+// 64..127 with wide feeders head i -> router i, wide exits router i -> 128 (2^40 units each; built
+// in units, not through a resolution). Tunnel i: its feeder, ring links i and i + 1, the exit of
+// router i + 2. Every ring link carries two tunnels of 3 (load 6 > 3): 64 barriers in one cyclic
+// group that settles at round 6, every head delivering 1. As one 64-head Pinned LOSSY program (one
+// policy, replace(192): 3 per head) or as 64 one-tunnel Pinned LOSSY policies created in head
+// order (one SIMULTANEOUS list of Replace(3) each), each on its own ledger, built once.
+struct Ring {
+  std::shared_ptr<const nc::Graph> g;
+  std::unique_ptr<nc::FlowLedger> program_ledger;
+  std::unique_ptr<nc::FlowLedger> list_ledger;
+  std::unique_ptr<nc::FlowPolicy> program;
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+};
+inline std::shared_ptr<Ring> ring_fixture() {
+  constexpr int n = 64;
+  constexpr nc::Amount wide = nc::Amount {1} << 40;
+  std::vector<std::int32_t> src;
+  std::vector<std::int32_t> dst;
+  std::vector<nc::Amount> units;
+  for (int i = 0; i < n; ++i) src.push_back(i), dst.push_back((i + 1) % n), units.push_back(3);
+  for (int i = 0; i < n; ++i) src.push_back(i), dst.push_back(2 * n), units.push_back(wide);
+  for (int i = 0; i < n; ++i) src.push_back(n + i), dst.push_back(i), units.push_back(wide);
+  auto ring = std::make_shared<Ring>();
+  ring->g = std::make_shared<const nc::Graph>(2 * n + 1, src, dst, units, std::vector<std::int64_t>(src.size(), 1), kResolution);
+  const auto inv = ring->g->input_positions();
+  std::vector<std::int32_t> id(inv.size());
+  for (std::size_t e = 0; e < inv.size(); ++e) id[static_cast<std::size_t>(inv[e])] = static_cast<std::int32_t>(e);
+  auto tunnel = [&](int i) {
+    const std::vector<std::vector<nc::EdgeId>> hops = {{id[static_cast<std::size_t>(2 * n + i)]}, {id[static_cast<std::size_t>(i)]},
+                                                       {id[static_cast<std::size_t>((i + 1) % n)]}, {id[static_cast<std::size_t>(n + (i + 2) % n)]}};
+    return nc::RouteDefinition {n + i, std::make_shared<const nc::Path>(*ring->g, hops), 1};
+  };
+  const nc::NodeId sink[1] = {2 * n};
+  std::vector<nc::NodeId> heads;
+  std::vector<nc::RouteDefinition> all;
+  for (int i = 0; i < n; ++i) heads.push_back(n + i), all.push_back(tunnel(i));
+  ring->program_ledger = std::make_unique<nc::FlowLedger>(ring->g);
+  ring->list_ledger = std::make_unique<nc::FlowLedger>(ring->g);
+  auto pinned = [](std::shared_ptr<const nc::ForwardingProgram> prog) {
+    nc::FlowPolicyConfig cfg;
+    cfg.routing = nc::Pinned {std::move(prog), nullptr};
+    cfg.admission = nc::Admission::Lossy;
+    return cfg;
+  };
+  ring->program = std::make_unique<nc::FlowPolicy>(*ring->program_ledger, heads, sink, pinned(nc::ForwardingProgram::from_routes(*ring->g, heads, sink, all)));
+  for (int i = 0; i < n; ++i) {
+    const nc::NodeId h[1] = {n + i};
+    const std::vector<nc::RouteDefinition> one = {tunnel(i)};
+    ring->policies.push_back(std::make_unique<nc::FlowPolicy>(*ring->list_ledger, h, sink, pinned(nc::ForwardingProgram::from_routes(*ring->g, h, sink, one))));
+  }
+  return ring;
+}
+// The digest of a ring forwarding: per head its delivery, then per ring link its carried load.
+inline std::uint64_t ring_digest(const std::vector<nc::Amount>& delivered, std::span<const nc::Amount> carried) {
+  Digest d;
+  for (auto x : delivered) d.add_i(x);
+  for (int e = 0; e < 64; ++e) d.add_i(carried[static_cast<std::size_t>(e)]);
+  return d.h;
+}
+// One replace(192) of the ring's one program (a replace releases its own load: every iteration
+// starts from the same state).
+inline std::uint64_t ring_program(Ring& r) {
+  const auto res = r.program->replace(192);
+  std::vector<nc::Amount> delivered;
+  for (const auto& t : res.by_tunnel) delivered.push_back(t.delivered);
+  return ring_digest(delivered, r.program_ledger->carried());
+}
+// One SIMULTANEOUS list of the 64 one-tunnel policies, Replace(3) each.
+inline std::uint64_t ring_list(Ring& r) {
+  std::vector<nc::Action> actions;
+  for (auto& p : r.policies) actions.push_back(nc::Replace {*p, 3});
+  const auto res = nc::apply_actions(*r.list_ledger, actions, nc::BatchMode::Simultaneous);
+  std::vector<nc::Amount> delivered;
+  for (const auto& x : res) delivered.push_back(x.call_delivered);
+  return ring_digest(delivered, r.list_ledger->carried());
+}
+
+// Pooled programs from supplied DAGs: per demand, ForwardingProgram::from_dag of its sources over
+// the reverse shortest-path DAG to its destination (trimmed to the sources' walks: their selected
+// supports, the DAG ShortestPaths Equal pools).
+using PooledPrograms = std::vector<std::shared_ptr<const nc::ForwardingProgram>>;
+inline PooledPrograms pooled_dag_programs(const Graph& g, const std::vector<std::pair<std::vector<int>, int>>& demands) {
+  PooledPrograms out;
+  for (const auto& [srcs, dst] : demands) {
+    const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+    const nc::NodeId tv[1] = {dst};
+    auto dag = std::make_shared<const nc::PredecessorDAG>(run_spf(g, tv, nc::Direction::Reverse, std::nullopt, Sel {}, nullptr, nullptr).dag);
+    out.push_back(nc::ForwardingProgram::from_dag(g.ref(), sv, tv, dag));
+  }
+  return out;
+}
+
+// Building the pooled programs: the digest folds each program's roster size and its Lossless bound
+// is not computed (building only).
+inline std::uint64_t pooled_dag_build(const Graph& g, const std::vector<std::pair<std::vector<int>, int>>& demands) {
+  Digest d;
+  for (const auto& p : pooled_dag_programs(g, demands)) {
+    d.add_i(static_cast<std::int64_t>(p->sources().size()));
+    d.add_i(static_cast<std::int64_t>(p->tunnels().size()));
+  }
+  return d.h;
+}
+
+// Pinned over prebuilt pooled programs: one policy per demand on one shared ledger,
+// place(to_units(offer)) each; the digest as pooled_place's.
+inline std::uint64_t pooled_pinned_place(const Graph& g, const std::vector<std::pair<std::vector<int>, int>>& demands,
+                                         const PooledPrograms& programs, double offer, bool lossy) {
+  nc::FlowLedger fg(g.g);
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  Digest d;
+  const auto units = nc::to_units(offer, kResolution);
+  for (std::size_t i = 0; i < demands.size(); ++i) {
+    const auto& [srcs, dst] = demands[i];
+    const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+    const nc::NodeId tv[1] = {dst};
+    const nc::FlowPolicyConfig cfg {.routing = nc::Pinned {programs[i], nullptr},
+                                    .admission = lossy ? nc::Admission::Lossy : nc::Admission::Lossless};
+    policies.push_back(std::make_unique<nc::FlowPolicy>(fg, sv, tv, cfg));
+    const auto r = policies.back()->place(units);
+    d.add_i(r.call_delivered);
+    nc::Amount drops = 0;
+    for (const auto& [e, x] : r.call_edge_drops) drops += x;
+    d.add_i(drops);
+    d.add_i(static_cast<std::int64_t>(r.call_edge_drops.size()));
+    for (const auto& row : r.by_source) {
+      d.add_i(row.source);
+      d.add(row.admitted.lo);
+      d.add_i(row.delivered);
+      d.add(row.source_drops.lo);
+      d.add(row.total_edge_drops.lo);
+    }
+  }
+  return d.h;
+}
+
+// ---- forwarding programs
+
+// One demand's program: the optimized CentralizedTE solve of `offer` from `srcs` to `dst` on a fresh
+// ledger (its paths with their solved amounts, the captured source weights).
+struct Program {
+  std::shared_ptr<const nc::ForwardingProgram> p;
+  std::vector<nc::NodeId> srcs;
+  nc::NodeId dst {0};
+};
+inline Program global_program(const Graph& g, const std::vector<int>& srcs, int dst, double offer) {
+  Program out;
+  out.srcs.assign(srcs.begin(), srcs.end());
+  out.dst = dst;
+  nc::FlowLedger fg(g.g);
+  const nc::NodeId tv[1] = {dst};
+  nc::FlowPolicy policy(fg, out.srcs, tv, global_config());
+  out.p = policy.replace(nc::to_units(offer, kResolution)).program;
+  return out;
+}
+
+// The failure states as shared Eligibility values (a Pinned black-hole set is held by reference).
+using Masks = std::vector<std::shared_ptr<const nc::Eligibility>>;
+inline Masks masks(const Graph& g, const std::vector<std::vector<int>>& states) {
+  Masks out;
+  for (const auto& st : states) out.push_back(std::make_shared<const nc::Eligibility>(*eligibility(g, {}, st).el));
+  return out;
+}
+
+// A status as a fixed code, so a digest does not move when the enum gains or reorders values:
+// Up 0, Failed 1, Blackholed 2 (the codes of every older Core), InsufficientBandwidth 3,
+// CostCeilingExceeded 4.
+inline std::int64_t status_code(nc::TunnelStatus s) {
+  switch (s) {
+    case nc::TunnelStatus::Up: return 0;
+    case nc::TunnelStatus::Failed: return 1;
+    case nc::TunnelStatus::Blackholed: return 2;
+    case nc::TunnelStatus::InsufficientBandwidth: return 3;
+    case nc::TunnelStatus::CostCeilingExceeded: return 4;
+  }
+  return -1;
+}
+
+inline void add_rows(Digest& d, const nc::PlacementResult& r) {
+  d.add_i(r.call_delivered);
+  d.add(r.source_drops.lo);
+  nc::Amount drops = 0;
+  for (const auto& [e, x] : r.call_edge_drops) drops += x;
+  d.add_i(drops);
+  for (const auto& t : r.by_tunnel) {
+    d.add_i(status_code(t.status));
+    d.add(t.assigned.lo);
+    d.add_i(t.delivered);
+  }
+}
+
+// An installed program's policy: forward(offer) for each offer (no route computation). The policy
+// and its ledger live for the whole row; each call retires and creates its records.
+struct Installed {
+  nc::FlowLedger fg;
+  std::unique_ptr<nc::FlowPolicy> policy;
+  Installed(const Graph& g, const std::vector<int>& srcs, int dst, double offer) : fg(g.g) {
+    const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+    const nc::NodeId tv[1] = {dst};
+    policy = std::make_unique<nc::FlowPolicy>(fg, sv, tv, global_config());
+    (void)policy->replace(nc::to_units(offer, kResolution));
+  }
+  std::uint64_t forward_all(const std::vector<double>& offers) {
+    Digest d;
+    for (double o : offers) add_rows(d, policy->forward(nc::to_units(o, kResolution)));
+    return d.h;
+  }
+};
+
+// Pinned Lossy over a program under each failure state, each on a fresh ledger: the state as the
+// policy's mask (replay: failed tunnels, the heads split over the survivors) or as its black holes
+// (stale forwarding: the program unchanged, traffic dropped at the failures); replace(offer).
+inline std::uint64_t pinned_failures(const Graph& g, const Program& prog, const Masks& states, double offer,
+                                     bool stale) {
+  Digest d;
+  const nc::NodeId tv[1] = {prog.dst};
+  const auto units = nc::to_units(offer, kResolution);
+  for (const auto& st : states) {
+    nc::FlowLedger fg(g.g);
+    nc::FlowPolicyConfig cfg;
+    cfg.routing = nc::Pinned {prog.p, stale ? st : nullptr};
+    cfg.admission = nc::Admission::Lossy;
+    nc::FlowPolicy policy(fg, prog.srcs, tv, std::move(cfg), stale ? nullptr : st.get());
+    add_rows(d, policy.replace(units));
+  }
+  return d.h;
+}
+
+// A ShortestPaths Equal demand replaced while an outside ShortestPaths demand changes its load: for
+// each load, the outside policy replaces its offer, then the demand replace(offer) uses its static
+// program on the new released view and retires its records (first preparation included). One ledger for the row's iteration.
+inline std::uint64_t replace_under_load(const Graph& g, const std::vector<int>& srcs, int dst,
+                                        const std::vector<int>& outside_srcs, int outside_dst,
+                                        const std::vector<double>& loads, double offer) {
+  const auto cfg = config(nc::ShortestPaths {}, Kernel::Equal);
+  nc::FlowLedger fg(g.g);
+  const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+  const std::vector<nc::NodeId> ov(outside_srcs.begin(), outside_srcs.end());
+  const nc::NodeId tv[1] = {dst};
+  const nc::NodeId otv[1] = {outside_dst};
+  nc::FlowPolicy demand(fg, sv, tv, cfg);
+  nc::FlowPolicy outside(fg, ov, otv, cfg);
+  Digest d;
+  const auto units = nc::to_units(offer, kResolution);
+  for (double load : loads) {
+    (void)outside.replace(nc::to_units(load, kResolution));
+    const auto r = demand.replace(units);
+    d.add_i(r.call_delivered);
+    d.add_i(r.delivery_delta);
+    d.add_i(r.routes_changed ? 1 : 0);
+    d.add_i(r.weights_changed ? 1 : 0);
+  }
+  return d.h;
+}
+
+// The equal-source-allocation CentralizedTE configuration (every roster source sends its round-robin share).
+inline nc::FlowPolicyConfig global_equal_config() {
+  return nc::FlowPolicyConfig {.routing = centralized(nc::SourceAllocation::Equal)};
+}
+
+// evaluate_demand() of equal-source-allocation CentralizedTE from several sources to one destination. The digest folds the
+// delivered amount, the exact total cost (both halves) and every source row's admitted amount.
+inline std::uint64_t global_equal_capacity(const Graph& g, const std::vector<int>& srcs, int dst) {
+  const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+  const nc::NodeId tv[1] = {dst};
+  const auto r = nc::evaluate_demand(g.ref(), sv, tv, nc::EvaluationOptions {global_equal_config(), nullptr, nullptr, {}});
+  Digest d;
+  d.add_i(r.call_delivered);
+  d.add(r.total_cost->hi);
+  d.add(r.total_cost->lo);
+  for (const auto& row : r.by_source) {
+    d.add_i(row.source);
+    d.add(row.admitted.lo);
+  }
+  return d.h;
+}
+
+// evaluate_edge_failures() of equal-source-allocation CentralizedTE (every allowed edge is a candidate, each solved afresh).
+inline std::uint64_t edge_failures_equal_global(const Graph& g, const std::vector<int>& srcs, int dst) {
+  const std::vector<nc::NodeId> sv(srcs.begin(), srcs.end());
+  const nc::NodeId tv[1] = {dst};
+  return fold_edge_failures(nc::evaluate_edge_failures(g.ref(), sv, tv, nc::EvaluationOptions {global_equal_config()}, 1));
+}
+
+// Keep the historical-build adapter compilable against a Core preceding declared
+// source weights. New weighted rows are run only on builds that implement them;
+// the common optimized-increment row executes exactly the same work on both.
+template<class Model = nc::CentralizedTE>
+inline nc::FlowPolicyConfig captured_config(const std::vector<nc::Amount>& weights, bool weighted) {
+  Model model(nc::SourceAllocation::Optimized);
+  if (weighted) {
+    if constexpr (requires(Model m) { m.source_weights; }) {
+      using Allocation = decltype(model.source_allocation);
+      model.source_allocation = Allocation::Weighted;
+      model.source_weights = std::make_shared<const std::vector<nc::Amount>>(weights);
+    } else {
+      throw std::invalid_argument("this Core does not implement weighted source allocation");
+    }
+  }
+  return nc::FlowPolicyConfig{std::move(model)};
+}
+
+inline std::uint64_t global_weighted_capacity(const Graph& g, const std::vector<int>& srcs, int dst, bool failures) {
+  const std::vector<nc::NodeId> sv(srcs.begin(),srcs.end());
+  const nc::NodeId tv[1]={dst};
+  std::vector<nc::Amount> weights(static_cast<std::size_t>(g.ref().num_nodes()),0);
+  for(std::size_t i=0;i<sv.size();++i)weights[static_cast<std::size_t>(sv[i])]=static_cast<nc::Amount>(i+1);
+  const nc::EvaluationOptions options{captured_config(weights,true),nullptr,nullptr,{true,true,true,true,true}};
+  if(failures)return fold_edge_failures(nc::evaluate_edge_failures(g.ref(),sv,tv,options,1));
+  Digest d;add_rows(d,nc::evaluate_demand(g.ref(),sv,tv,options));return d.h;
+}
+
+inline std::shared_ptr<const nc::Graph> captured_graph() {
+  return std::make_shared<const nc::Graph>(6,std::vector<nc::NodeId>{0,1,2,3,4},std::vector<nc::NodeId>(5,5),
+      std::vector<nc::Amount>(5,10),std::vector<nc::Cost>(5,1),1.0);
+}
+
+// A complete lifetime: controller computation/export, Pinned LOSSY construction,
+// 32 calls, result materialization and teardown. Incremental calls enter
+// source_offer_increments; replace calls are a distinct full-offer control.
+inline std::uint64_t captured_series(const std::shared_ptr<const nc::Graph>& g,int mode,bool incremental) {
+  const bool weighted=mode!=0,wide=mode==2;
+  const nc::Amount m=nc::kDomainLimit-1;
+  const std::vector<nc::Amount> weights=wide ? std::vector<nc::Amount>{m,m,m,m,m,0} : std::vector<nc::Amount>{2,1,3,1,2,0};
+  const std::vector<nc::NodeId> sv{0,1,2,3,4},tv{5};
+  const auto program=nc::evaluate_demand(*g,sv,tv,nc::EvaluationOptions{captured_config(weights,weighted)}).program;
+  nc::FlowLedger ledger(g);
+  nc::FlowPolicy p(ledger,sv,tv,nc::FlowPolicyConfig{nc::Pinned{program},nc::Admission::Lossy});
+  Digest d;
+  for(int i=0;i<32;++i) {
+    const nc::Amount offer=wide && i<4 ? m : wide && i==4 ? 5 : 17;
+    const auto r=incremental ? p.place(offer) : p.replace(offer);
+    add_rows(d,r);
+  }
+  return d.h;
+}
+
+// T1: one DistributedTE(TunnelCount(tunnels)) policy per pair on one shared ledger, Lossless, each head
+// setting up its tunnels by CSPF on the unreserved view (the earlier pairs' holds count).
+struct T1Fabric {
+  nc::FlowLedger fg;
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  T1Fabric(const Graph& g, const std::vector<std::pair<int, int>>& pairs, int tunnels, nc::Admission admission)
+      : fg(g.g) {
+    const nc::FlowPolicyConfig cfg {.routing = nc::DistributedTE {nc::TunnelCount {tunnels}}, .admission = admission};
+    for (auto [s, t] : pairs) {
+      const nc::NodeId sv[1] = {s};
+      const nc::NodeId tv[1] = {t};
+      policies.push_back(std::make_unique<nc::FlowPolicy>(fg, sv, tv, cfg));
+    }
+  }
+};
+
+// The digest of a T1 call: its delivery, its up tunnels and its holds in all.
+inline void add_t1(Digest& d, const nc::PlacementResult& r) {
+  d.add_i(r.call_delivered);
+  std::int64_t up = 0;
+  for (const auto& t : r.program->tunnels()) up += t.status == nc::TunnelStatus::Up ? 1 : 0;
+  d.add_i(up);
+  d.add_i(r.plan->total_reserved_bandwidth);
+}
+
+// t1.setup.fabric: every pair's replace(to_units(offer), design = the same) on a fresh ledger, in
+// pair order: CSPF setup, the holds' commit and the Lossless forwarding.
+inline std::uint64_t t1_setup(const Graph& g, const std::vector<std::pair<int, int>>& pairs, double offer, int tunnels) {
+  T1Fabric f(g, pairs, tunnels, nc::Admission::Lossless);
+  Digest d;
+  const auto units = nc::to_units(offer, kResolution);
+  for (auto& p : f.policies) add_t1(d, p->replace(units, units));
+  return d.h;
+}
+
+// The fabric of t1.forward.fabric: Lossy, every pair set up once by replace(to_units(offer),
+// design = the same), outside the timed iterations.
+inline std::shared_ptr<T1Fabric> t1_installed(const Graph& g, const std::vector<std::pair<int, int>>& pairs, double offer,
+                                              int tunnels) {
+  auto f = std::make_shared<T1Fabric>(g, pairs, tunnels, nc::Admission::Lossy);
+  const auto units = nc::to_units(offer, kResolution);
+  for (auto& p : f->policies) (void)p->replace(units, units);
+  return f;
+}
+
+// t1.forward.fabric: the installed Lossy programs of every pair forwarded under each offer (no
+// setup: forward keeps the tunnels and the holds).
+inline std::uint64_t t1_forward(T1Fabric& f, const std::vector<double>& offers) {
+  Digest d;
+  for (double offer : offers) {
+    const auto units = nc::to_units(offer, kResolution);
+    for (auto& p : f.policies) add_t1(d, p->forward(units));
+  }
+  return d.h;
+}
+
+// T2: a CentralizedTE(source_allocation=EQUAL, tunnel_count=TunnelCount(count, up_to),
+// prefer_headroom=headroom) configuration, Lossless.
+inline nc::FlowPolicyConfig t2_config(int count, bool up_to, bool headroom) {
+  auto t2 = centralized(nc::SourceAllocation::Equal);
+  t2.tunnel_count = nc::TunnelCount {count, up_to};
+  t2.prefer_headroom = headroom;
+  return {.routing = std::move(t2)};
+}
+
+// The digest of a T2 call: its delivery, the chosen count, U, u, F, the route cost and the
+// tunnels.
+inline void add_t2(Digest& d, const nc::PlacementResult& r) {
+  d.add_i(r.call_delivered);
+  d.add_i(r.plan->tunnels_per_head);
+  d.add_i(*r.plan->max_bandwidth_per_tunnel);
+  d.add_i(*r.plan->planned_bandwidth_per_tunnel);
+  d.add_i(*r.plan->max_lossless_offer);
+  d.add(r.plan->total_tunnel_cost->lo);
+  d.add_i(static_cast<std::int64_t>(r.program->tunnels().size()));
+}
+
+// t2.exact16.*, t2.upto256.headroom: one T2 policy per pair on one shared ledger, in pair order,
+// each replace(to_units(offer), design = the same) on the residual the earlier pairs left: live
+// heads, sizing (the quota flows), s*, the canonical augmentation (with Phi under Headroom), the
+// cut into tunnels, the lossless bound and the forwarding.
+inline std::uint64_t t2_fabric(const Graph& g, const std::vector<std::pair<int, int>>& pairs, double offer, int count,
+                               bool up_to, bool headroom) {
+  nc::FlowLedger fg(g.g);
+  const auto cfg = t2_config(count, up_to, headroom);
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  Digest d;
+  const auto units = nc::to_units(offer, kResolution);
+  for (auto [s, t] : pairs) {
+    const nc::NodeId sv[1] = {s};
+    const nc::NodeId tv[1] = {t};
+    policies.push_back(std::make_unique<nc::FlowPolicy>(fg, sv, tv, cfg));
+    add_t2(d, policies.back()->replace(units, units));
+  }
+  return d.h;
+}
+
+// t2.size.mesh: one T2 policy of the heads to the destination on a ledger whose residual is
+// `free` (input order, units), replace(+inf): an unlimited design, u = U.
+inline std::uint64_t t2_mesh(const Graph& g, const std::vector<std::int64_t>& free, const std::vector<int>& heads,
+                             int destination, int count, bool up_to, bool headroom) {
+  std::vector<nc::Amount> residual(free.size());
+  for (std::size_t i = 0; i < free.size(); ++i) residual[static_cast<std::size_t>(g.edge_of_input[i])] = free[i];
+  nc::FlowLedger fg(g.g, residual);
+  std::vector<nc::NodeId> sv(heads.begin(), heads.end());
+  const nc::NodeId tv[1] = {destination};
+  nc::FlowPolicy p(fg, sv, tv, t2_config(count, up_to, headroom));
+  Digest d;
+  add_t2(d, p.replace(std::nullopt));
+  return d.h;
+}
+
+// One series of ShortestPaths Equal placements with one ShortestPathCache per series (the support of
+// each destination set under the series Eligibility; NetGraph's hop-by-hop engine).
+struct ShortestPathsSeries {
+  const Graph& g;
+  const Elig& el;
+  nc::ShortestPathCache cache;
+  ShortestPathsSeries(const Graph& graph, const Elig& elig) : g(graph), el(elig), cache(graph.ref()) {}
+  // Places every demand on a fresh ledger; returns the delivered amount per demand.
+  std::vector<double> place_all(const std::vector<std::pair<int, int>>& demands, const std::vector<double>& offers) {
+    nc::FlowLedger fg(g.g);
+    const auto cfg = config(nc::ShortestPaths {}, Kernel::Equal);
+    std::vector<double> delivered(demands.size());
+    for (std::size_t i = 0; i < demands.size(); ++i) {
+      const nc::NodeId s[1] = {demands[i].first};
+      const nc::NodeId t[1] = {demands[i].second};
+      nc::FlowPolicy policy(fg, s, t, cfg, el.get(), &cache);
+      delivered[i] = nc::as_float(policy.place(nc::to_units(offers[i], kResolution)).call_delivered, kResolution);
+    }
+    return delivered;
+  }
+};
+
+// One ledger and one policy per demand for the whole MSD series. Every probe begins
+// by removing every policy, including before the first probe, then places in demand order.
+struct ShortestPathsEpochSeries {
+  nc::ShortestPathCache cache;
+  nc::FlowLedger ledger;
+  std::vector<std::unique_ptr<nc::FlowPolicy>> policies;
+  ShortestPathsEpochSeries(const Graph& graph, const Elig& elig,
+                          const std::vector<std::pair<int, int>>& demands)
+      : cache(graph.ref()), ledger(graph.g) {
+    const auto cfg = config(nc::ShortestPaths {}, Kernel::Equal);
+    policies.reserve(demands.size());
+    for (auto [source, destination] : demands) {
+      const nc::NodeId s[1] = {source};
+      const nc::NodeId t[1] = {destination};
+      policies.push_back(std::make_unique<nc::FlowPolicy>(ledger, s, t, cfg, elig.get(), &cache));
+    }
+  }
+  std::vector<double> place_all(const std::vector<double>& offers) {
+    for (const auto& policy : policies) policy->remove();
+    std::vector<double> delivered(policies.size());
+    for (std::size_t i = 0; i < policies.size(); ++i)
+      delivered[i] = nc::as_float(policies[i]->place(nc::to_units(offers[i], kResolution)).call_delivered, kResolution);
+    return delivered;
+  }
+};
+
+inline double grid_resolution() { return kResolution; }
+
+// ShortestPathCache series: lookups (roots {r}, Reverse, no eligibility) for every root; cold: a fresh
+// cache per series (misses: one support search each); warm: the graph's cache, prepopulated by the
+// first (untimed) iteration (hits).
+inline std::uint64_t dag_cache_series(const Graph& g, const std::vector<int>& roots, bool warm) {
+  std::shared_ptr<nc::ShortestPathCache> cache;
+  if (warm) {
+    auto& w = const_cast<Graph&>(g).warm_cache;
+    if (!w) w = std::make_shared<nc::ShortestPathCache>(g.ref());
+    cache = w;
+  } else {
+    cache = std::make_shared<nc::ShortestPathCache>(g.ref());
+  }
+  Digest d;
+  for (int r : roots) {
+    const nc::NodeId root[1] = {r};
+    const auto v = cache->lookup(g.ref(), root, nc::Direction::Reverse, nullptr);
+    d.add_i(static_cast<std::int64_t>(v->via_edges().size()));
+  }
+  d.add_i(static_cast<std::int64_t>(cache->stats().entries));
+  return d.h;
+}
+
+// One operation per row, 10,000 calls per iteration. Construction and preparation
+// are untimed. The immutable config getter is the control for the gated getters.
+enum class TinyOperation { PlaceZero, Delivered, Program, Config };
+struct TinyCalls {
+  std::shared_ptr<const nc::Graph> graph;
+  nc::FlowLedger ledger;
+  nc::FlowPolicy policy;
+  TinyCalls()
+      : graph(std::make_shared<const nc::Graph>(2, std::vector<nc::NodeId>{0}, std::vector<nc::NodeId>{1},
+            std::vector<nc::Amount>{16}, std::vector<nc::Cost>{3}, 1.0)),
+        ledger(graph), policy(ledger, std::vector<nc::NodeId>{0}, std::vector<nc::NodeId>{1}, {}) {
+    const auto r = policy.replace(4);
+    if (r.delivered != 4 || !r.program || r.by_source.size() != 1 || r.by_source[0].delivered != 4 ||
+        ledger.residual() != std::vector<nc::Amount>{12}) throw std::runtime_error("tiny fixture preparation failed");
+    const auto zero = policy.place(0);
+    if (zero.call_delivered != 0 || zero.delivered != 4 || zero.requested != nc::Counter128{0, 4} ||
+        zero.routes_changed || zero.weights_changed || zero.reservations_changed || zero.program != r.program ||
+        zero.edge_flows || zero.residual || zero.plan) throw std::runtime_error("tiny zero-call result differs");
+  }
+  std::uint64_t run(TinyOperation operation) {
+    std::uint64_t sum = 0;
+    for (int i = 0; i < 10000; ++i) {
+      switch (operation) {
+        case TinyOperation::PlaceZero: sum += static_cast<std::uint64_t>(policy.place(0).delivered); break;
+        case TinyOperation::Delivered: sum += static_cast<std::uint64_t>(policy.delivered()); break;
+        case TinyOperation::Program: sum += policy.program() != nullptr ? 1U : 0U; break;
+        case TinyOperation::Config: sum += policy.config().admission == nc::Admission::Lossless ? 1U : 0U; break;
+      }
+    }
+    return sum;
+  }
+};
+
+// Fixed layered graph, 32 heads, 32 destinations, 12 layers, eight outgoing links
+// per nonterminal node. Offer 32 sends one unit per head; no link can receive more
+// than 32, below every capacity 64, so every call must deliver all 32 units.
+struct ParallelLedgers {
+  std::shared_ptr<const nc::Graph> graph;
+  std::array<std::unique_ptr<nc::FlowLedger>, 2> ledgers;
+  std::array<std::unique_ptr<nc::FlowPolicy>, 2> policies;
+  ParallelLedgers() {
+    std::vector<nc::NodeId> source, destination;
+    std::vector<nc::Amount> capacity;
+    std::vector<nc::Cost> cost;
+    constexpr std::array<int, 8> offsets {0, 1, 3, 7, 11, 17, 23, 29};
+    for (int layer = 0; layer < 11; ++layer) for (int head = 0; head < 32; ++head) for (int offset : offsets) {
+      source.push_back(layer * 32 + head);
+      destination.push_back((layer + 1) * 32 + (head + offset) % 32);
+      capacity.push_back(64);
+      cost.push_back(1 + (head * 17 + offset * 13 + layer) % 7);
+    }
+    graph = std::make_shared<const nc::Graph>(384, source, destination, capacity, cost, 1.0);
+    std::vector<nc::NodeId> heads, targets;
+    for (int i = 0; i < 32; ++i) { heads.push_back(i); targets.push_back(352 + i); }
+    for (std::size_t i = 0; i < 2; ++i) {
+      ledgers[i] = std::make_unique<nc::FlowLedger>(graph);
+      policies[i] = std::make_unique<nc::FlowPolicy>(*ledgers[i], heads, targets, nc::FlowPolicyConfig{});
+      const auto r = policies[i]->replace(32);
+      if (r.delivered != 32 || r.by_source.size() != 32) throw std::runtime_error("parallel fixture preparation failed");
+      for (const auto& row : r.by_source) if (row.delivered != 1) throw std::runtime_error("parallel fixture source delivery differs");
+    }
+  }
+  std::uint64_t run(bool parallel) {
+    std::array<std::uint64_t, 2> sums {};
+    std::array<std::exception_ptr, 2> errors {};
+    auto worker = [&](std::size_t i) noexcept {
+      try {
+        for (int call = 0; call < 32; ++call) {
+          // evaluate reads the static preparation installed during setup, without publishing it.
+          const auto r = policies[i]->evaluate(32);
+          if (r.delivered != 32 || r.call_delivered != 32 || r.delivery_delta != 0 || r.by_source.size() != 32) {
+            throw std::runtime_error("parallel evaluation differs");
+          }
+          for (const auto& row : r.by_source) if (row.delivered != 1) throw std::runtime_error("parallel source delivery differs");
+          sums[i] += static_cast<std::uint64_t>(r.delivered);
+        }
+      } catch (...) { errors[i] = std::current_exception(); }
+    };
+    std::array<std::thread, 2> threads;
+    try {
+      for (std::size_t i = 0; i < 2; ++i) {
+        threads[i] = std::thread(worker, i);
+        if (!parallel) threads[i].join();
+      }
+    } catch (...) {
+      for (auto& thread : threads) if (thread.joinable()) thread.join();
+      throw;
+    }
+    for (auto& thread : threads) if (thread.joinable()) thread.join();
+    for (const auto& error : errors) if (error) std::rethrow_exception(error);
+    return sums[0] + sums[1];
+  }
+};
+
+// K shortest paths; defaults retain FEWER_HOPS and every parallel edge.
+enum class KspTie { Fewer, Capacity, Available, Headroom };
+inline std::uint64_t ksp(const Graph& g, int src, int dst, int k, bool parallel = true, KspTie tie = KspTie::Fewer) {
+  nc::KspOptions opts(k);
+  opts.parallel_edges = parallel;
+  switch (tie) {
+    case KspTie::Fewer: opts.tie_break = nc::RouteTieBreak::FewerHops; break;
+    case KspTie::Capacity: opts.tie_break = nc::RouteTieBreak::HigherCapacity; break;
+    case KspTie::Available: opts.tie_break = nc::RouteTieBreak::HigherAvailableCapacity; break;
+    case KspTie::Headroom: opts.tie_break = nc::RouteTieBreak::HigherHeadroom; break;
+  }
+  const auto paths = nc::ksp(g.ref(), src, dst, opts);
+  Digest d;
+  d.add_i(static_cast<std::int64_t>(paths.size()));
+  for (const auto& [cost, path] : paths) {
+    d.add_i(cost);
+    const auto& hops = path.hops();
+    d.add_i(static_cast<std::int64_t>(hops.size()));
+    for (const auto& hop : hops) {
+      for (const auto e : hop) d.add_i(e);
+    }
+  }
+  return d.h;
+}
+
+// ---- The storage rows' interface (README "Rows")
+
+// Construction rows: the API's own input (capacities in units of kResolution), prepared untimed.
+struct ConstructInput {
+  const Arrays* a = nullptr;
+  std::vector<nc::Amount> units;
+};
+
+inline ConstructInput construct_prepare(const Arrays& a) {
+  ConstructInput in;
+  in.a = &a;
+  in.units.resize(a.cap.size());
+  for (std::size_t i = 0; i < a.cap.size(); ++i) in.units[i] = nc::to_units(a.cap[i], kResolution);
+  return in;
+}
+
+// The sampled construction digest (API-independent, see the file comment):
+// N, E, max_edge_cost, edge_cost_gcd; then for the 16 nodes u_k = (k * 7919) mod N: the out-degree and the
+// in-degree; for a non-empty out-row the input positions of its first and last edge in
+// traversal order and the cost and physical capacity of the first; for a non-empty in-row the
+// input positions of its first and last slot in reverse order.
+inline std::uint64_t construct_sample(const nc::Graph& g) {
+  Digest d;
+  const std::int64_t n = g.num_nodes();
+  d.add_i(n);
+  d.add_i(g.num_edges());
+  d.add_i(g.max_edge_cost());
+  d.add_i(g.edge_cost_gcd());
+  const auto row = g.outgoing_offsets();
+  const auto in_row = g.incoming_offsets();
+  const auto in_adj = g.incoming_edges();
+  const auto input = g.input_positions();
+  for (std::int64_t k = 0; k < 16 && n > 0; ++k) {
+    const auto u = static_cast<std::size_t>((k * 7919) % n);
+    const std::int32_t b = row[u], e = row[u + 1], ib = in_row[u], ie = in_row[u + 1];
+    d.add_i(e - b);
+    d.add_i(ie - ib);
+    if (e > b) {
+      d.add_i(input[static_cast<std::size_t>(b)]);
+      d.add_i(input[static_cast<std::size_t>(e - 1)]);
+      d.add_i(g.edge_costs()[static_cast<std::size_t>(b)]);
+      d.add_d(nc::as_float(g.edge_capacity_units()[static_cast<std::size_t>(b)], kResolution));
+    }
+    if (ie > ib) {
+      d.add_i(input[static_cast<std::size_t>(in_adj[static_cast<std::size_t>(ib)])]);
+      d.add_i(input[static_cast<std::size_t>(in_adj[static_cast<std::size_t>(ie - 1)])]);
+    }
+  }
+  return d.h;
+}
+
+// Timed: the constructor on the prepared input, then the sampled digest.
+inline std::uint64_t construct_run(const ConstructInput& in) {
+  const auto& [n, tails, heads, caps, weights] = *in.a;  // the Arrays fields, in declaration order
+  const nc::Graph g(n, tails, heads, in.units, weights, kResolution);
+  return construct_sample(g);
+}
+
+// The queue a search with the default queue (Auto) takes on g: the production rule.
+struct QueueChoice {
+  std::int64_t width = 0;
+  bool buckets = false;
+};
+
+inline QueueChoice queue_choice(const Graph& g) {
+  return {nc::detail::bucket_width(g.ref()), nc::detail::uses_buckets(g.ref(), nc::SpfQueue::Auto)};
+}
+
+// The sampled search digest (API-independent, see the file comment): the
+// number of DAG entries; the distances of the 16 nodes v_k = (k * 7919) mod N (-1 unreachable);
+// for each of those nodes the number of its entries and the smallest and largest input position
+// of their edges (an entry's node is its edge's head; the entries of a node are a set).
+inline std::uint64_t search_sample(const Graph& g, const nc::SpfResult& r) {
+  Digest d;
+  const auto& [distances, dag, nearest] = r;  // costs, dag, target_cost
+  const auto via = dag.via_edges();
+  const auto dst = g.ref().edge_destinations();
+  const auto input = g.ref().input_positions();
+  const auto& costs = *distances;
+  const std::int64_t n = static_cast<std::int64_t>(costs.size());
+  d.add_i(static_cast<std::int64_t>(via.size()));
+  for (std::int64_t k = 0; k < 16 && n > 0; ++k) {
+    const auto v = static_cast<std::int32_t>((k * 7919) % n);
+    const nc::Cost c = costs[static_cast<std::size_t>(v)];
+    d.add_i(c == nc::kUnreachable ? -1 : c);
+    // The entries are grouped by node in ascending order: the run of node v.
+    const auto lo = std::partition_point(via.begin(), via.end(), [&](nc::EdgeId e) { return dst[static_cast<std::size_t>(e)] < v; });
+    const auto hi = std::partition_point(lo, via.end(), [&](nc::EdgeId e) { return dst[static_cast<std::size_t>(e)] <= v; });
+    std::int64_t lo_in = -1, hi_in = -1;
+    for (auto it = lo; it != hi; ++it) {
+      const std::int64_t x = input[static_cast<std::size_t>(*it)];
+      lo_in = lo_in < 0 ? x : std::min(lo_in, x);
+      hi_in = std::max(hi_in, x);
+    }
+    d.add_i(hi - lo);
+    d.add_i(lo_in);
+    d.add_i(hi_in);
+  }
+  return d.h;
+}
+
+// Timed: one full search (default route choice: multipath, every parallel member) and its digest.
+inline std::uint64_t search_run(const Graph& g, int root, bool reverse) {
+  const nc::NodeId roots[1] = {root};
+  return search_sample(g, run_spf(g, roots, reverse ? nc::Direction::Reverse : nc::Direction::Forward, std::nullopt,
+                                  Sel {}, nullptr, nullptr));
+}
+
+}  // namespace abaapi
diff --git a/dev/perf/aba_rows.hpp b/dev/perf/aba_rows.hpp
new file mode 100644
index 0000000..750226f
--- /dev/null
+++ b/dev/perf/aba_rows.hpp
@@ -0,0 +1,1551 @@
+// The A/B/A rows of the Core timing harness (README.md, "Protocol"). Each row prepares its
+// inputs (untimed), then times a fixed unit of semantic work per iteration through the adapter
+// in aba_api.hpp. One process runs one block:
+//
+//   harness aba-list                         -> one JSON object per row
+//   harness aba-run <row> <iterations>       -> one JSON object: per-iteration time stats,
+//                                               digest, peak RSS, setup time
+//   harness aba-calibrate <row> <seconds>    -> runs the row for about <seconds>, reports the
+//                                               median iteration time (the warm-up block)
+//
+// harness_main, at the end of this file, reads the command line and gives the exit statuses.
+// Every iteration returns a digest of its results; all iterations of a block must agree (the
+// work is deterministic), and the orchestrator compares digests across sides.
+//
+// The destination rows read frozen query lists (queries/*.json, compiled into the block below)
+// rather than a target picked through the library's edge layout, so every build searches for the
+// same targets.
+//
+// The storage rows (README "Rows"): fourteen graph-construction shapes and six full searches for
+// the graph's storage and construction, every input from a generator with fixed seeds, explicit
+// integral capacities and costs, frozen with its full-content digest and shape (the second
+// frozen block below); their timed digests read only API-independent values.
+#pragma once
+
+#include "aba_api.hpp"
+
+#include <algorithm>
+#include <array>
+#include <cerrno>
+#include <chrono>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <functional>
+#include <numeric>
+#include <random>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <sys/resource.h>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+namespace abarows {
+
+using abaapi::Arrays;
+using abaapi::Digest;
+using abaapi::Elig;
+using abaapi::Graph;
+using abaapi::Kernel;
+using abaapi::Sel;
+using Iter = std::function<std::uint64_t()>;
+
+// ---------------------------------------------------------------- frozen query lists
+// BEGIN FROZEN QUERY LISTS (the values of queries/*.json; test_tool.py checks that they agree)
+inline constexpr std::array<std::pair<int, int>, 64> kNear65k{{
+    {1, 2}, {998, 999}, {1995, 1996}, {2992, 2993}, {3989, 3990}, {4986, 116}, {5983, 5984}, {6980, 5695},
+    {7977, 4460}, {8974, 3025}, {9971, 1894}, {10968, 10969}, {11965, 4249}, {12962, 9444}, {13959, 2698}, {14956, 3611},
+    {15953, 1555}, {16950, 6755}, {17947, 15211}, {18944, 2177}, {19941, 2870}, {20938, 4285}, {21935, 17837}, {22932, 10793},
+    {23929, 23930}, {24926, 11028}, {25923, 3885}, {26920, 4095}, {27917, 5336}, {28914, 3084}, {29911, 5525}, {30908, 8194},
+    {31905, 13485}, {32902, 2444}, {33899, 3487}, {34896, 3662}, {35893, 9132}, {36890, 7109}, {37887, 10077}, {38884, 7934},
+    {39881, 4570}, {40878, 20916}, {41875, 2116}, {42872, 5858}, {43869, 14903}, {44866, 24}, {45863, 16319}, {46860, 5995},
+    {47857, 26465}, {48854, 17016}, {49851, 9574}, {50848, 5966}, {51845, 14215}, {52842, 22580}, {53839, 5643}, {54836, 5009},
+    {55833, 580}, {56830, 1068}, {57827, 1275}, {58824, 4854}, {59821, 11006}, {60818, 12565}, {61815, 7166}, {62812, 35168}}};
+inline constexpr std::uint64_t kNear65kInput = 3859296219677894378ULL;
+inline constexpr std::array<std::pair<int, int>, 8> kFar16k{{
+    {1, 5378}, {998, 9128}, {1995, 11844}, {2992, 10152}, {3989, 10152}, {4986, 7529}, {5983, 16342}, {6980, 16342}}};
+inline constexpr std::uint64_t kFar16kInput = 5806366537376710903ULL;
+inline constexpr std::array<std::pair<int, int>, 8> kCanonical16k{{
+    {1, 1339}, {998, 1339}, {1995, 2641}, {2992, 1339}, {3989, 10530}, {4986, 1339}, {5983, 1339}, {6980, 11931}}};
+inline constexpr std::uint64_t kCanonical16kInput = 11698079179288285235ULL;
+inline constexpr std::array<int, 50> kTargetSetDestinations{150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199};
+inline constexpr std::uint64_t kTargetSetInput = 4484954733111131726ULL;
+inline constexpr std::array<std::pair<const char*, const char*>, 4> kQueryLists{{
+    {"spf.dag.near65k", "queries/near65k.json sha256:3f47de99a2b521fafe6d23b29805cdc19aca1306b6af64d13133745dbd8aecd4"},
+    {"spf.dag.far16k", "queries/far16k.json sha256:bb84f77497bd2ffc9ba16bf9fdc87d41e848328632c8cb33d7057522062f14ad"},
+    {"spf.single.canonical16k", "queries/canonical16k.json sha256:2e842fb1f95908a90603da81904c79d594d306084f125dfcd91942e8051236cd"},
+    {"spf.to.targetset_clos", "queries/targetset_clos.json sha256:280f599ac837d892ef6e35a6e2161d657b09e1fea25d89ae38a6668895e76210"}}};
+// END FROZEN QUERY LISTS
+
+// The digest of an input (node count, then src, dst and cost of every edge in input order):
+// a row refuses a frozen list whose input digest differs from its generator's arrays.
+inline std::uint64_t input_digest(const Arrays& a) {
+  Digest d;
+  d.add_i(a.n);
+  for (int e = 0; e < a.num_edges(); ++e) {
+    d.add_i(a.src[std::size_t(e)]);
+    d.add_i(a.dst[std::size_t(e)]);
+    d.add_i(a.cost[std::size_t(e)]);
+  }
+  return d.h;
+}
+
+inline void require_frozen(const Arrays& a, std::uint64_t frozen_input, const char* list) {
+  if (input_digest(a) != frozen_input)
+    throw std::runtime_error(std::string("the frozen list ") + list + " was not frozen from this row's arrays");
+}
+
+// ---------------------------------------------------------------- generators (API-free)
+
+// The harness "random" generator: ring plus random out-edges, costs 1..max_edge_cost.
+inline Arrays gen_random(int n, int degree, unsigned seed, std::int64_t max_edge_cost = 31) {
+  Arrays a;
+  a.n = n;
+  std::mt19937 rng(seed);
+  auto add = [&](int u, int v, std::int64_t c) {
+    a.src.push_back(u);
+    a.dst.push_back(v);
+    a.cost.push_back(c);
+    a.cap.push_back(1.0 + double(rng() % 100) / 7.0);
+  };
+  for (int u = 0; u < n; ++u) {
+    add(u, (u + 1) % n, 1 + std::int64_t(rng() % std::uint64_t(max_edge_cost)));
+    for (int k = 1; k < degree; ++k) {
+      const int v = int(rng() % unsigned(n));  // one draw per statement: the draw order is fixed
+      add(u, v, 1 + std::int64_t(rng() % std::uint64_t(max_edge_cost)));
+    }
+  }
+  return a;
+}
+
+// T2's mesh: a bidirectional ring over n nodes plus directed chords up to 4n distinct links in
+// ascending (u, v), full capacities of 2^14, 2^15, 2^16 or 2^17 units (physical at kResolution),
+// each with 5/8 to 8/8 of it free, costs 1..10; heads 0..h-1 toward node n - 1. `free` is in input order, in units.
+struct T2Mesh {
+  Arrays a;
+  std::vector<std::int64_t> free;
+  std::vector<int> heads;
+};
+inline T2Mesh gen_t2_mesh(int n, int h, unsigned seed) {
+  std::mt19937 rng(seed);
+  std::set<std::pair<int, int>> links;
+  for (int i = 0; i < n; ++i) {
+    links.insert({i, (i + 1) % n});
+    links.insert({(i + 1) % n, i});
+  }
+  while (static_cast<int>(links.size()) < 4 * n) {
+    const int u = int(rng() % unsigned(n));  // one draw per statement: the draw order is fixed
+    const int v = int(rng() % unsigned(n));
+    if (u != v) links.insert({u, v});
+  }
+  T2Mesh m;
+  m.a.n = n;
+  for (auto [u, v] : links) {
+    const std::int64_t full = std::int64_t {1} << (14 + rng() % 4);
+    const std::int64_t eighths = 5 + std::int64_t(rng() % 4);
+    const std::int64_t cost = 1 + std::int64_t(rng() % 10);
+    m.a.src.push_back(u);
+    m.a.dst.push_back(v);
+    m.a.cost.push_back(cost);
+    m.a.cap.push_back(double(full) * abaapi::kResolution);
+    m.free.push_back(full * eighths / 8);
+  }
+  for (int i = 0; i < h; ++i) m.heads.push_back(i);
+  return m;
+}
+
+// Bidirectional link: input edges 2l (u -> v) and 2l + 1 (v -> u), same cost and capacity.
+inline void add_link(Arrays& a, int u, int v, std::int64_t cost, double cap) {
+  a.src.push_back(u); a.dst.push_back(v); a.cost.push_back(cost); a.cap.push_back(cap);
+  a.src.push_back(v); a.dst.push_back(u); a.cost.push_back(cost); a.cap.push_back(cap);
+}
+
+inline double link_cap(std::mt19937& rng) { return 10.0 * double(1 + rng() % 8); }
+
+// Two-tier Clos: leaves [0, L), spines [L, L + S), unit costs, capacities 10..80.
+inline Arrays gen_clos(int leaves, int spines, unsigned seed) {
+  Arrays a;
+  a.n = leaves + spines;
+  std::mt19937 rng(seed);
+  for (int u = 0; u < leaves; ++u)
+    for (int s = 0; s < spines; ++s) add_link(a, u, leaves + s, 1, link_cap(rng));
+  return a;
+}
+
+// Square grid of bidirectional links; unit costs or costs 1..20.
+inline Arrays gen_grid(int side, unsigned seed, bool unit) {
+  Arrays a;
+  a.n = side * side;
+  std::mt19937 rng(seed);
+  // One draw per statement (the cost before the capacity): the draw order is fixed.
+  auto link = [&](int u, int v) {
+    const std::int64_t cost = unit ? 1 : 1 + std::int64_t(rng() % 20);
+    add_link(a, u, v, cost, link_cap(rng));
+  };
+  for (int u = 0; u < a.n; ++u) {
+    if (u % side + 1 < side) link(u, u + 1);
+    if (u + side < a.n) link(u, u + side);
+  }
+  return a;
+}
+
+// Three-tier Clos: supers [0, X); pod p: leaves then spines; leaf-spine mesh per pod, every
+// spine to every super. Leaf id of (pod, i) is returned by fabric3_leaf.
+struct Fabric3 { Arrays a; int leaves, spines, supers; };
+inline int fabric3_leaf(const Fabric3& f, int pod, int i) { return f.supers + pod * (f.leaves + f.spines) + i; }
+inline Fabric3 gen_fabric3(int pods, int leaves, int spines, int supers, unsigned seed) {
+  Fabric3 f{{}, leaves, spines, supers};
+  f.a.n = supers + pods * (leaves + spines);
+  std::mt19937 rng(seed);
+  for (int p = 0; p < pods; ++p) {
+    const int base = supers + p * (leaves + spines);
+    for (int i = 0; i < leaves; ++i)
+      for (int j = 0; j < spines; ++j) add_link(f.a, base + i, base + leaves + j, 1, link_cap(rng));
+    for (int j = 0; j < spines; ++j)
+      for (int k = 0; k < supers; ++k) add_link(f.a, base + leaves + j, k, 1, 4 * link_cap(rng));
+  }
+  return f;
+}
+
+// F distinct failure states of k links each (bidirectional generators: both directions).
+inline std::vector<std::vector<int>> failure_states(int num_links, int states, int k, unsigned seed) {
+  std::mt19937 rng(seed);
+  std::set<std::vector<int>> seen;
+  std::vector<std::vector<int>> out;
+  while (int(out.size()) < states) {
+    std::set<int> links;
+    while (int(links.size()) < k) links.insert(int(rng() % unsigned(num_links)));
+    std::vector<int> edges;
+    for (int l : links) { edges.push_back(2 * l); edges.push_back(2 * l + 1); }
+    if (seen.insert(edges).second) out.push_back(edges);
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- rows
+
+struct Row {
+  std::string name, group, desc;
+  std::function<Iter()> setup;
+};
+
+// The static exclusions and the residual of the masked and residual rows (input order): one
+// seeded draw per node, then two per edge (an excluded edge, a zero residual).
+struct MasksResidual {
+  std::vector<int> xn, xe;
+  std::vector<double> res_in;  // input-edge order: the capacity, or 0 for a gated edge
+};
+inline MasksResidual masks_residual(const Arrays& a) {
+  MasksResidual m;
+  std::mt19937 rng(17);
+  m.res_in = a.cap;
+  for (int v = 0; v < a.n; ++v) if (rng() % 23 == 0) m.xn.push_back(v);
+  for (int e = 0; e < a.num_edges(); ++e) {
+    if (rng() % 11 == 0) m.xe.push_back(e);
+    if (rng() % 13 == 0) m.res_in[std::size_t(e)] = 0.0;
+  }
+  return m;
+}
+
+// The full forward searches from `queries` sources, plain or with the static exclusions and the
+// residual of masks_residual.
+inline Iter spf_full_row(Arrays a, int queries, bool masked_residual) {
+  auto g = std::make_shared<Graph>(abaapi::build(a));
+  auto el = std::make_shared<Elig>();
+  auto res = std::make_shared<std::vector<double>>();
+  if (masked_residual) {
+    const auto m = masks_residual(a);
+    *el = abaapi::eligibility(*g, m.xn, m.xe);
+    *res = abaapi::edge_values(*g, m.res_in);
+  }
+  std::vector<int> srcs;
+  for (int i = 0; i < queries; ++i) srcs.push_back(int((std::int64_t(i) * 997 + 1) % a.n));
+  return [g, el, res, srcs, masked_residual] {
+    Digest d;
+    for (int s : srcs)
+      d.add(abaapi::spf(*g, s, masked_residual ? el.get() : nullptr, masked_residual ? res.get() : nullptr));
+    return d.h;
+  };
+}
+
+// ---------------------------------------------------------------- storage rows (graph storage and construction)
+// README "Rows". Every input comes from a generator below with fixed seeds, one random draw per
+// statement (the draw order is part of the input), explicit costs and positive integral
+// capacities (exact as doubles and in the adapter's units of 1/4096). Each input is frozen
+// in the frozen block by its full-content digest and its shape; a row refuses an input whose
+// generator no longer reproduces both.
+
+// The full-content digest of an input: n and E, then src, dst, cost and the capacity's bits of
+// every edge in input order (input_digest above omits the capacities).
+inline std::uint64_t input_digest_full(const Arrays& a) {
+  Digest d;
+  d.add_i(a.n);
+  d.add_i(a.num_edges());
+  for (std::size_t e = 0; e < a.src.size(); ++e) {
+    d.add_i(a.src[e]);
+    d.add_i(a.dst[e]);
+    d.add_i(a.cost[e]);
+    d.add_d(a.cap[e]);
+  }
+  return d.h;
+}
+
+// The shape of an input, as frozen: N, E, the number K of distinct costs, the largest out- and
+// in-degree, the cost GCD and maximum (0 without edges), the nodes without any edge, the number
+// of input positions where src decreases, and whether the input is in ascending (source, cost, destination)
+// order (key_sorted; equal keys keep their input order, so this is the B' id order) or in
+// descending order (key_reversed). digest: input_digest_full.
+struct InputShape {
+  std::int64_t n = 0, e = 0, k = 0, max_out = 0, max_in = 0, gcd = 0, max_edge_cost = 0, isolated = 0, src_descents = 0;
+  bool key_sorted = false, key_reversed = false;
+  std::uint64_t digest = 0;
+  bool operator==(const InputShape&) const = default;
+};
+
+inline InputShape shape_of(const Arrays& a) {
+  InputShape s;
+  s.n = a.n;
+  s.e = a.num_edges();
+  std::vector<std::int64_t> costs(a.cost.begin(), a.cost.end());
+  std::sort(costs.begin(), costs.end());
+  s.k = std::unique(costs.begin(), costs.end()) - costs.begin();
+  std::vector<std::int64_t> out(std::size_t(a.n), 0), in(std::size_t(a.n), 0);
+  for (std::size_t e = 0; e < a.src.size(); ++e) {
+    ++out[std::size_t(a.src[e])];
+    ++in[std::size_t(a.dst[e])];
+    s.gcd = std::gcd(s.gcd, a.cost[e]);
+    s.max_edge_cost = std::max(s.max_edge_cost, a.cost[e]);
+  }
+  for (int v = 0; v < a.n; ++v) {
+    s.max_out = std::max(s.max_out, out[std::size_t(v)]);
+    s.max_in = std::max(s.max_in, in[std::size_t(v)]);
+    if (out[std::size_t(v)] == 0 && in[std::size_t(v)] == 0) ++s.isolated;
+  }
+  s.key_sorted = s.key_reversed = true;
+  for (std::size_t e = 0; e + 1 < a.src.size(); ++e) {
+    const auto x = std::make_tuple(a.src[e], a.cost[e], a.dst[e]);
+    const auto y = std::make_tuple(a.src[e + 1], a.cost[e + 1], a.dst[e + 1]);
+    if (y < x) s.key_sorted = false;
+    if (x < y) s.key_reversed = false;
+    if (a.src[e + 1] < a.src[e]) ++s.src_descents;
+  }
+  s.digest = input_digest_full(a);
+  return s;
+}
+
+inline std::string json_shape(const InputShape& s) {
+  return "{\"n\":" + std::to_string(s.n) + ",\"e\":" + std::to_string(s.e) + ",\"k\":" + std::to_string(s.k) +
+         ",\"max_out\":" + std::to_string(s.max_out) + ",\"max_in\":" + std::to_string(s.max_in) + ",\"gcd\":" +
+         std::to_string(s.gcd) + ",\"max_cost\":" + std::to_string(s.max_edge_cost) + ",\"isolated\":" +
+         std::to_string(s.isolated) + ",\"src_descents\":" + std::to_string(s.src_descents) + ",\"key_sorted\":" +
+         (s.key_sorted ? "true" : "false") + ",\"key_reversed\":" + (s.key_reversed ? "true" : "false") +
+         ",\"digest\":\"" + std::to_string(s.digest) + "\"}";
+}
+
+inline void push_edge(Arrays& a, int u, int v, std::int64_t cost, double cap) {
+  a.src.push_back(u);
+  a.dst.push_back(v);
+  a.cost.push_back(cost);
+  a.cap.push_back(cap);
+}
+
+// Fisher-Yates with mt19937_64 (fully specified by the standard, unlike std::shuffle).
+inline std::vector<std::size_t> permutation(std::size_t m, std::uint64_t seed) {
+  std::vector<std::size_t> p(m);
+  std::iota(p.begin(), p.end(), std::size_t {0});
+  std::mt19937_64 rng(seed);
+  for (std::size_t i = m; i > 1; --i) {
+    const std::size_t j = std::size_t(rng() % std::uint64_t(i));
+    std::swap(p[i - 1], p[j]);
+  }
+  return p;
+}
+
+// The input permuted: position i takes the edge at position p[i] (every property together).
+inline Arrays permuted(const Arrays& a, const std::vector<std::size_t>& p) {
+  Arrays s;
+  s.n = a.n;
+  for (std::size_t i = 0; i < p.size(); ++i) push_edge(s, a.src[p[i]], a.dst[p[i]], a.cost[p[i]], a.cap[p[i]]);
+  return s;
+}
+
+// A 256 x 256 weighted grid, both directions of every link with independently drawn costs 1..31.
+// Each edge draws its cost first, then its integral capacity in 1..100.
+inline Arrays gen_wgrid256() {
+  Arrays a;
+  const int side = 256;
+  a.n = side * side;
+  std::mt19937 rng(1729);
+  auto edge = [&](int u, int v) {
+    const std::int64_t c = 1 + std::int64_t(rng() % 31);
+    const double cap = double(1 + rng() % 100);
+    push_edge(a, u, v, c, cap);
+  };
+  for (int u = 0; u < a.n; ++u) {
+    if (u % side + 1 < side) { edge(u, u + 1); edge(u + 1, u); }
+    if (u + side < a.n) { edge(u, u + side); edge(u + side, u); }
+  }
+  return a;
+}
+
+// A Clos with source and sink hubs at positive costs (the graph rejects zero costs): Clos 400 leaves x
+// 400 spines in both directions at cost 1, a source hub (node 800) with cost-2 edges to leaves
+// 0..99 and a sink hub (node 801) fed by leaves 300..399 at cost 2.
+inline Arrays gen_fanout_clos() {
+  Arrays a;
+  a.n = 802;
+  std::mt19937 rng(1729);
+  auto edge = [&](int u, int v, std::int64_t c) {
+    const double cap = double(1 + rng() % 100);
+    push_edge(a, u, v, c, cap);
+  };
+  for (int u = 0; u < 400; ++u)
+    for (int v = 400; v < 800; ++v) { edge(u, v, 1); edge(v, u, 1); }
+  for (int u = 0; u < 100; ++u) edge(800, u, 2);
+  for (int u = 300; u < 400; ++u) edge(u, 801, 2);
+  return a;
+}
+
+// A ring plus random out-edges (gen_random's shape) with explicit draws: per node the
+// ring edge u -> u + 1 (cost draw, capacity draw), then degree - 1 edges (target draw, cost draw,
+// capacity draw). cost_of(rng) draws one cost.
+template <class CostOf>
+inline Arrays gen_random_drawn(int n, int degree, unsigned seed, CostOf cost_of) {
+  Arrays a;
+  a.n = n;
+  std::mt19937 rng(seed);
+  for (int u = 0; u < n; ++u) {
+    {
+      const std::int64_t c = cost_of(rng);
+      const double cap = double(1 + rng() % 100);
+      push_edge(a, u, (u + 1) % n, c, cap);
+    }
+    for (int k = 1; k < degree; ++k) {
+      const int v = int(rng() % unsigned(n));
+      const std::int64_t c = cost_of(rng);
+      const double cap = double(1 + rng() % 100);
+      push_edge(a, u, v, c, cap);
+    }
+  }
+  return a;
+}
+
+inline std::int64_t cost_1_to_31(std::mt19937& rng) { return 1 + std::int64_t(rng() % 31); }
+
+// Random graph: 131,072 nodes x 8 = 1,048,576 edges, costs 1..31, generator order
+// (random1m_nat) or the same edges in a uniform random order (random1m_scat; Fisher-Yates over
+// mt19937_64(4242), every property permuted together).
+inline Arrays gen_random1m(bool scattered) {
+  auto a = gen_random_drawn(131072, 8, 1729, cost_1_to_31);
+  return scattered ? permuted(a, permutation(a.src.size(), 4242)) : a;
+}
+
+// 65,536 nodes x 8, costs drawn from 1..2^30 (far more than 65,536 distinct values).
+inline Arrays gen_wide65k() {
+  return gen_random_drawn(65536, 8, 1031, [](std::mt19937& rng) { return 1 + std::int64_t(rng() % (1U << 30)); });
+}
+
+// 65,536 nodes x 8 with exactly k distinct costs 1..k: the topology and capacities from
+// mt19937(1032) (one topology for both k); the first k edges take a random permutation of 1..k
+// (every value present; permutation() with seed 2032), every later edge a uniform draw from 1..k
+// (mt19937_64(2033)).
+inline Arrays gen_kcosts(std::int64_t k) {
+  auto a = gen_random_drawn(65536, 8, 1032, [](std::mt19937&) { return std::int64_t {1}; });
+  const auto perm = permutation(std::size_t(k), 2032);
+  std::mt19937_64 rng(2033);
+  for (std::size_t e = 0; e < a.cost.size(); ++e)
+    a.cost[e] = e < std::size_t(k) ? 1 + std::int64_t(perm[e]) : 1 + std::int64_t(rng() % std::uint64_t(k));
+  return a;
+}
+
+// One node (0) with 1,048,576 out-edges to targets drawn from 131,072 nodes (parallel edges and
+// self-loops of node 0 included): per edge the target draw, the cost draw, the capacity draw.
+inline Arrays gen_star1m() {
+  Arrays a;
+  a.n = 131072;
+  std::mt19937 rng(1034);
+  for (int e = 0; e < (1 << 20); ++e) {
+    const int v = int(rng() % unsigned(a.n));
+    const std::int64_t c = 1 + std::int64_t(rng() % (1U << 20));
+    const double cap = double(1 + rng() % 100);
+    push_edge(a, 0, v, c, cap);
+  }
+  return a;
+}
+
+// The same single long out-row with exactly 31 costs (1..31) and distinct capacities 1 + the
+// input position (equal (source, cost, destination) keys are told apart by their capacity); reversed: every
+// edge turned around, one long in-row of node 0.
+inline Arrays gen_star1m_smallk(bool reversed) {
+  Arrays a;
+  a.n = 131072;
+  std::mt19937 rng(1036);
+  for (int e = 0; e < (1 << 20); ++e) {
+    const int v = int(rng() % unsigned(a.n));
+    const std::int64_t c = 1 + std::int64_t(rng() % 31);
+    if (reversed) push_edge(a, v, 0, c, double(1 + e));
+    else push_edge(a, 0, v, c, double(1 + e));
+  }
+  return a;
+}
+
+// 1,048,576 nodes, 4,096 edges with both endpoints drawn over the whole node range, costs 1..31.
+inline Arrays gen_sparse1m() {
+  Arrays a;
+  a.n = 1 << 20;
+  std::mt19937 rng(1035);
+  for (int e = 0; e < 4096; ++e) {
+    const int u = int(rng() % unsigned(a.n));
+    const int v = int(rng() % unsigned(a.n));
+    const std::int64_t c = 1 + std::int64_t(rng() % 31);
+    const double cap = double(1 + rng() % 100);
+    push_edge(a, u, v, c, cap);
+  }
+  return a;
+}
+
+inline Arrays gen_empty1m() {
+  Arrays a;
+  a.n = 1 << 20;
+  return a;
+}
+
+// construct.random65k's topology and costs (gen_random(65536, 8, 11)) with integral capacities
+// recovered from the same draws (1 + k for the generator's 1 + k / 7), stably sorted by (src, cost,
+// dst): the B' id order; reversed: the whole sequence of that input in reverse.
+inline Arrays gen_random65k_bprime(bool reversed) {
+  auto g = gen_random(65536, 8, 11);
+  for (auto& c : g.cap) c = double(1 + std::llround((c - 1.0) * 7.0));
+  const auto& [gn, tails, heads, caps, weights] = g;  // the Arrays fields, in declaration order
+  std::vector<std::size_t> p(tails.size());
+  std::iota(p.begin(), p.end(), std::size_t {0});
+  std::stable_sort(p.begin(), p.end(), [&](std::size_t x, std::size_t y) {
+    return std::make_tuple(tails[x], weights[x], heads[x]) < std::make_tuple(tails[y], weights[y], heads[y]);
+  });
+  if (reversed) std::reverse(p.begin(), p.end());
+  return permuted(g, p);
+}
+
+// The reverse-search heap row: 16,384 nodes x 8, costs 1..2^20 (W far above 65,536: the heap).
+inline Arrays gen_wide_fallback16k() {
+  return gen_random_drawn(16384, 8, 1037, [](std::mt19937& rng) { return 1 + std::int64_t(rng() % (1U << 20)); });
+}
+
+// The bucket-width boundary: one topology (mt19937(1038), 16,384 nodes x 8), each edge's cost
+// base + one drawn bit: base 65,534 gives costs {65534, 65535} (gcd 1, W = 65,536: the buckets),
+// base 65,535 gives {65535, 65536} (W = 65,537: the heap).
+inline Arrays gen_width(std::int64_t base) {
+  return gen_random_drawn(16384, 8, 1038, [base](std::mt19937& rng) { return base + std::int64_t(rng() % 2); });
+}
+
+struct StorageInput {
+  const char* name;
+  Arrays (*make)();
+};
+
+inline const std::vector<StorageInput>& storage_inputs() {
+  static const std::vector<StorageInput> inputs = {
+      {"wgrid256", [] { return gen_wgrid256(); }},
+      {"fanout_clos", [] { return gen_fanout_clos(); }},
+      {"random1m_nat", [] { return gen_random1m(false); }},
+      {"random1m_scat", [] { return gen_random1m(true); }},
+      {"wide65k", [] { return gen_wide65k(); }},
+      {"k65536", [] { return gen_kcosts(65536); }},
+      {"k65537", [] { return gen_kcosts(65537); }},
+      {"star1m", [] { return gen_star1m(); }},
+      {"sparse1m", [] { return gen_sparse1m(); }},
+      {"empty1m", [] { return gen_empty1m(); }},
+      {"random65k_bprime", [] { return gen_random65k_bprime(false); }},
+      {"random65k_reversed", [] { return gen_random65k_bprime(true); }},
+      {"star1m_smallk", [] { return gen_star1m_smallk(false); }},
+      {"instar1m_smallk", [] { return gen_star1m_smallk(true); }},
+      {"wide_fallback16k", [] { return gen_wide_fallback16k(); }},
+      {"width65536", [] { return gen_width(65534); }},
+      {"width65537", [] { return gen_width(65535); }},
+  };
+  return inputs;
+}
+
+inline Arrays make_storage_input(const std::string& name) {
+  for (const auto& i : storage_inputs())
+    if (name == i.name) return i.make();
+  throw std::runtime_error("no storage input " + name);
+}
+
+struct FrozenShape {
+  const char* input;
+  InputShape shape;
+};
+
+// The frozen inputs (shape and digest per input), the search roots and the expected queues.
+// BEGIN FROZEN STORAGE INPUTS (queries/storage/inputs.json; test_tool.py checks that they agree)
+inline const std::vector<FrozenShape> kStorageInputs {
+    {"wgrid256", {65536, 261120, 31, 4, 4, 1, 31, 0, 130305, false, false, 14812220864904460480ULL}},
+    {"fanout_clos", {802, 320200, 2, 401, 401, 1, 2, 0, 160000, false, false, 5230821760560145505ULL}},
+    {"random1m_nat", {131072, 1048576, 31, 8, 24, 1, 31, 0, 0, false, false, 16852305707948996038ULL}},
+    {"random1m_scat", {131072, 1048576, 31, 8, 24, 1, 31, 0, 524810, false, false, 10807403047943366003ULL}},
+    {"wide65k", {65536, 524288, 524146, 8, 21, 1, 1073738528, 0, 0, false, false, 13538344444856380895ULL}},
+    {"k65536", {65536, 524288, 65536, 8, 21, 1, 65536, 0, 0, false, false, 10929368686095504329ULL}},
+    {"k65537", {65536, 524288, 65537, 8, 21, 1, 65537, 0, 0, false, false, 758208004199587604ULL}},
+    {"star1m", {131072, 1048576, 662682, 1048576, 27, 1, 1048575, 41, 0, false, false, 15197849622511790248ULL}},
+    {"sparse1m", {1048576, 4096, 31, 2, 2, 1, 31, 1040409, 2050, false, false, 12990156200638721186ULL}},
+    {"empty1m", {1048576, 0, 0, 0, 0, 0, 0, 1048576, 0, true, true, 18109181668318218688ULL}},
+    {"random65k_bprime", {65536, 524288, 31, 8, 21, 1, 31, 0, 0, true, false, 12833760064757678648ULL}},
+    {"random65k_reversed", {65536, 524288, 31, 8, 21, 1, 31, 0, 65535, false, true, 11592727304513109687ULL}},
+    {"star1m_smallk", {131072, 1048576, 31, 1048576, 23, 1, 31, 46, 0, false, false, 8802474158293546069ULL}},
+    {"instar1m_smallk", {131072, 1048576, 31, 23, 1048576, 1, 31, 46, 524217, false, false, 10839275545656040073ULL}},
+    {"wide_fallback16k", {16384, 131072, 123230, 8, 23, 1, 1048557, 0, 0, false, false, 1535512841938229597ULL}},
+    {"width65536", {16384, 131072, 2, 8, 20, 1, 65535, 0, 0, false, false, 6236947617789042840ULL}},
+    {"width65537", {16384, 131072, 2, 8, 20, 1, 65536, 0, 0, false, false, 9851477194174659493ULL}},
+};
+inline const std::vector<std::pair<const char*, std::vector<int>>> kStorageRoots {
+    {"spf.to.wgrid256", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+    {"spf.to.random1m", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+    {"spf.to.wide_fallback16k", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+    {"spf.to.width65536", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+    {"spf.to.width65537", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+    {"spf.full.random1m", {1, 998, 1995, 2992, 3989, 4986, 5983, 6980}},
+};
+// END FROZEN STORAGE INPUTS
+
+// The roots of a storage search row: 8 nodes (i * 997 + 1) mod N, frozen in the block above.
+inline std::vector<int> rule_roots(std::int64_t n) {
+  std::vector<int> r;
+  for (std::int64_t i = 0; i < 8; ++i) r.push_back(int((i * 997 + 1) % n));
+  return r;
+}
+
+// The input of a storage row, checked against the frozen shape and digest.
+inline Arrays checked_storage_input(const std::string& name, Arrays a) {
+  const auto got = shape_of(a);
+  for (const auto& f : kStorageInputs) {
+    if (name != f.input) continue;
+    if (!(got == f.shape))
+      throw std::runtime_error("storage input " + name + " differs from its frozen shape: " + json_shape(got) + " frozen " +
+                               json_shape(f.shape));
+    return a;
+  }
+  throw std::runtime_error("storage input " + name + " is not frozen");
+}
+
+inline Arrays frozen_storage_input(const std::string& name) { return checked_storage_input(name, make_storage_input(name)); }
+
+inline std::vector<int> frozen_roots(const std::string& row, std::int64_t n) {
+  for (const auto& [name, roots] : kStorageRoots)
+    if (row == name) {
+      if (roots != rule_roots(n)) throw std::runtime_error("the frozen roots of " + row + " differ from the rule");
+      return roots;
+    }
+  throw std::runtime_error("no frozen roots for " + row);
+}
+
+// Checks the queue choice of a search row: the adapter's (the library's rule: the width W and
+// buckets or heap) and the width read from the input arrays (max cost / cost GCD + 1) must both
+// equal the frozen expectation.
+inline void require_queue(const Graph& g, const Arrays& a, std::int64_t want_width, bool want_buckets) {
+  const auto got = abaapi::queue_choice(g);
+  std::int64_t gcd = 0, mx = 0;
+  for (auto c : a.cost) { gcd = std::gcd(gcd, c); mx = std::max(mx, c); }
+  const std::int64_t w_in = mx / std::max<std::int64_t>(1, gcd) + 1;
+  if (got.width != want_width || got.buckets != want_buckets || w_in != want_width)
+    throw std::runtime_error("queue choice: the adapter reports W = " + std::to_string(got.width) +
+                             (got.buckets ? " (buckets)" : " (heap)") + ", the input gives W = " + std::to_string(w_in) +
+                             ", the row expects W = " + std::to_string(want_width) + (want_buckets ? " (buckets)" : " (heap)"));
+}
+
+struct StorageSearch {
+  const char* row;
+  const char* input;
+  bool reverse;
+  std::int64_t width;
+  bool buckets;
+  const char* desc;
+};
+
+inline void add_storage_rows(std::vector<Row>& r) {
+  struct C { const char* row; const char* input; const char* desc; };
+  const C constructs[] = {
+      {"construct.wgrid256", "wgrid256", "construction, 256x256 grid both directions, independent costs 1..31 per direction (many short rows, K = 31)"},
+      {"construct.fanout_clos", "fanout_clos", "construction, Clos 400x400 at cost 1 plus a cost-2 source hub to 100 leaves and a sink hub from 100 leaves (K = 2; rows of about 400, two 100-edge hub rows)"},
+      {"construct.random1m_nat", "random1m_nat", "construction, random 131,072 x 8 = 1,048,576 edges, costs 1..31, generator (source-major) order"},
+      {"construct.random1m_scat", "random1m_scat", "construction, the same 1,048,576 edges in a uniform random input order"},
+      {"construct.wide65k", "wide65k", "construction, random 65,536 x 8, costs 1..2^30 (K far above 65,536: the sort fallback)"},
+      {"construct.k65536", "k65536", "construction, random 65,536 x 8 with exactly 65,536 distinct costs (the hash limit)"},
+      {"construct.k65537", "k65537", "construction, the same topology with exactly 65,537 distinct costs (one above the hash limit)"},
+      {"construct.star1m", "star1m", "construction, one node with 1,048,576 out-edges to 131,072 nodes, costs 1..2^20 (one very long row, large K)"},
+      {"construct.sparse1m", "sparse1m", "construction, 1,048,576 nodes and 4,096 edges spread over the node range, K = 31 (mostly isolated nodes)"},
+      {"construct.empty1m", "empty1m", "construction, 1,048,576 nodes and no edge (empty offsets, maximum and GCD 0)"},
+      {"construct.random65k_bprime", "random65k_bprime", "construction, construct.random65k's topology and costs sorted by (src, cost, dst, input): already in B' order"},
+      {"construct.random65k_reversed", "random65k_reversed", "construction, the preceding input in reverse order, every property array included"},
+      {"construct.star1m_smallk", "star1m_smallk", "construction, one node with 1,048,576 out-edges to 131,072 nodes, exactly 31 costs, distinct capacities"},
+      {"construct.instar1m_smallk", "instar1m_smallk", "construction, the preceding edges turned around: one node with 1,048,576 in-edges, exactly 31 costs"},
+  };
+  for (const auto& c : constructs) {
+    const std::string row = c.row, input = c.input;
+    Row x {row, "construct", c.desc,
+           [input]() -> Iter {
+             auto a = std::make_shared<Arrays>(frozen_storage_input(input));
+             auto in = std::make_shared<abaapi::ConstructInput>(abaapi::construct_prepare(*a));
+             return Iter([a, in] { return abaapi::construct_run(*in); });
+           }};
+    r.push_back(std::move(x));
+  }
+  const StorageSearch searches[] = {
+      {"spf.to.wgrid256", "wgrid256", true, 32, true, "8 full reverse searches on construct.wgrid256's graph, frozen roots (bucket queue, W = 32)"},
+      {"spf.to.random1m", "random1m_scat", true, 32, true, "8 full reverse searches on construct.random1m_scat's graph, frozen roots (large scattered graph, bucket queue)"},
+      {"spf.to.wide_fallback16k", "wide_fallback16k", true, 1048558, false, "8 full reverse searches, random 16k x8, costs 1..2^20, gcd 1: the heap (W above 65,536)"},
+      {"spf.to.width65536", "width65536", true, 65536, true, "8 full reverse searches, random 16k x8, costs 65,534 and 65,535: the buckets at W = 65,536"},
+      {"spf.to.width65537", "width65537", true, 65537, false, "8 full reverse searches, the same topology and roots, costs 65,535 and 65,536: the heap at W = 65,537"},
+      {"spf.full.random1m", "random1m_scat", false, 32, true, "8 full forward searches on construct.random1m_scat's graph, frozen roots (forward only: the reverse arrays unread)"},
+  };
+  for (const auto& sp : searches) {
+    const std::string row = sp.row, input = sp.input;
+    const bool reverse = sp.reverse, buckets = sp.buckets;
+    const std::int64_t width = sp.width;
+    Row x {row, "spf", sp.desc,
+           [row, input, reverse, width, buckets]() -> Iter {
+             const auto a = frozen_storage_input(input);
+             const auto roots = frozen_roots(row, a.n);
+             auto g = std::make_shared<Graph>(abaapi::build(a));
+             require_queue(*g, a, width, buckets);
+             return Iter([g, roots, reverse] {
+               Digest d;
+               for (int v : roots) d.add(abaapi::search_run(*g, v, reverse));
+               return d.h;
+             });
+           }};
+    r.push_back(std::move(x));
+  }
+}
+
+inline std::vector<Row> rows() {
+  std::vector<Row> r;
+  // ---- SPF classes
+  r.push_back({"spf.full.random16k", "spf",
+               "full forward SPF, random 16k nodes x8 out-edges, costs 1..31, 8 sources",
+               [] { return spf_full_row(gen_random(16384, 8, 1), 8, false); }});
+  r.push_back({"spf.full.clos", "spf",
+               "full forward SPF, two-tier Clos 400x400 (unit costs, 320k edges), 8 sources",
+               [] { return spf_full_row(gen_clos(400, 400, 2), 8, false); }});
+  r.push_back({"spf.full.grid10k", "spf", "full forward SPF, 100x100 unit grid, 4 sources",
+               [] { return spf_full_row(gen_grid(100, 3, true), 4, false); }});
+  r.push_back({"spf.full.elig_residual16k", "spf",
+               "full forward SPF with static exclusions and a capacity-gated residual, random 16k, 8 sources",
+               [] { return spf_full_row(gen_random(16384, 8, 4), 8, true); }});
+  r.push_back({"spf.full.wide_fallback16k", "spf",
+               "full forward SPF, costs 1..2^20 (bucket width above the limit: heap route), random 16k, 8 sources",
+               [] { return spf_full_row(gen_random(16384, 8, 6, std::int64_t(1) << 20), 8, false); }});
+  // The destination rows read frozen (source, target) lists (queries/near65k.json, far16k.json),
+  // so every build searches for the same targets. The timed call returns the DAG of the shortest
+  // walks that end in the target.
+  auto dag_row = [](int n, unsigned seed, const auto& pairs, std::uint64_t frozen, const char* list) {
+    auto a = gen_random(n, 8, seed);
+    require_frozen(a, frozen, list);
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    std::vector<std::pair<int, int>> q(pairs.begin(), pairs.end());
+    return Iter([g, q] { Digest d; for (auto [s, t] : q) d.add(abaapi::spf_dag(*g, s, t)); return d.h; });
+  };
+  r.push_back({"spf.dag.near65k", "spf",
+               "destination SPF to a near target (frozen list: the lowest-numbered other out-neighbour), random 65k, "
+               "64 queries",
+               [=] { return dag_row(65536, 7, kNear65k, kNear65kInput, "near65k"); }});
+  r.push_back({"spf.dag.far16k", "spf",
+               "destination SPF to the farthest node (frozen list), random 16k, 8 queries",
+               [=] { return dag_row(16384, 8, kFar16k, kFar16kInput, "far16k"); }});
+  r.push_back({"spf.to.random16k", "spf", "reverse SPF (spf_to), random 16k, 8 destinations",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_random(16384, 8, 9)));
+                 return Iter([g] { Digest d; for (int i = 0; i < 8; ++i) d.add(abaapi::spf_to(*g, (i * 997 + 1) % 16384)); return d.h; });
+               }});
+  // The endpoint-set reverse search: the input is the 300-node Clos gen_clos(200, 100, 10) and the
+  // destination set, leaves 150..199 (queries/targetset_clos.json); the timed call is a full
+  // reverse spf rooted at the destination set with targets absent.
+  auto targetset_dests = [] { return std::vector<int>(kTargetSetDestinations.begin(), kTargetSetDestinations.end()); };
+  r.push_back({"spf.to.targetset_clos", "spf",
+               "endpoint-set reverse SPF rooted at leaves 150..199 of a Clos 200x100, 16 calls (spf(roots, Reverse), "
+               "no targets)",
+               [=]() -> Iter {
+                 auto a = gen_clos(200, 100, 10);
+                 require_frozen(a, kTargetSetInput, "targetset_clos");
+                 auto ts = std::make_shared<abaapi::TargetSet>(abaapi::targetset_prepare(a, targetset_dests()));
+                 return Iter([ts] { Digest d; for (int i = 0; i < 16; ++i) d.add(abaapi::targetset_run(*ts)); return d.h; });
+               }});
+  // ---- the canonical single path
+  // The canonical single path (multipath = false: the complete key under HIGHER_AVAILABLE_CAPACITY
+  // on the residual, one member per pair, residual gating) from 8 fixed sources to frozen targets
+  // (queries/canonical16k.json: the farthest node over the edges the gating keeps).
+  r.push_back({"spf.single.canonical16k", "spf",
+               "canonical single path to a fixed target, HIGHER_AVAILABLE_CAPACITY on the residual, one member, residual "
+               "gating, random 16k, 8 frozen pairs",
+               []() -> Iter {
+                 auto a = gen_random(16384, 8, 5);
+                 require_frozen(a, kCanonical16kInput, "canonical16k");
+                 auto g = std::make_shared<Graph>(abaapi::build(a));
+                 auto res = std::make_shared<std::vector<double>>(abaapi::edge_values(*g, masks_residual(a).res_in));
+                 Sel s;
+                 s.multipath = false;
+                 s.parallel_edges = false;
+                 s.higher_available_capacity = true;
+                 std::vector<std::pair<int, int>> q(kCanonical16k.begin(), kCanonical16k.end());
+                 return Iter([g, res, q, s] { Digest d; for (auto [u, v] : q) d.add(abaapi::spf_path(*g, u, v, s, res.get())); return d.h; });
+               }});
+  // ---- construction
+  r.push_back({"construct.random65k", "construct", "graph construction from arrays, random 65k x8 (524k edges)",
+               [] { auto a = std::make_shared<Arrays>(gen_random(65536, 8, 11)); return Iter([a] { return abaapi::construct(*a); }); }});
+  r.push_back({"construct.clos", "construct", "graph construction from arrays, Clos 400x400 (320k edges)",
+               [] { auto a = std::make_shared<Arrays>(gen_clos(400, 400, 12)); return Iter([a] { return abaapi::construct(*a); }); }});
+  // ---- placement kernels on fixed DAGs
+  auto kernel_row = [](Arrays a, std::vector<std::pair<int, int>> pairs, double amount, Kernel k) {
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    auto dags = std::make_shared<std::vector<abaapi::Dag>>();
+    for (auto [s, t] : pairs) dags->push_back(abaapi::base_dag(*g, s, t));
+    return Iter([g, dags, pairs, amount, k] {
+      abaapi::Ledger led(*g);
+      Digest d;
+      for (std::size_t i = 0; i < pairs.size(); ++i) d.add_d(led.place(pairs[i].first, pairs[i].second, (*dags)[i], amount, k));
+      return d.h;
+    });
+  };
+  auto clos_pairs = [] { std::vector<std::pair<int, int>> p; for (int i = 0; i < 64; ++i) p.push_back({i, (i + 32) % 64}); return p; };
+  auto grid_pairs = [] {
+    std::vector<std::pair<int, int>> p;
+    const int side = 24;
+    for (int i = 0; i < 32; ++i) { int r0 = i % side, c0 = (i * 7) % side; p.push_back({r0 * side + c0, (side - 1 - r0) * side + (side - 1 - c0)}); }
+    return p;
+  };
+  r.push_back({"kernel.proportional.clos", "kernel",
+               "Optimized placement on fixed ShortestPaths DAGs, Clos 64x32, 64 pairs of 50 on one ledger",
+               [=] { return kernel_row(gen_clos(64, 32, 13), clos_pairs(), 50.0, Kernel::Optimized); }});
+  r.push_back({"kernel.eb.clos", "kernel",
+               "Equal placement on fixed ShortestPaths DAGs, Clos 64x32, 64 pairs of 50 on one ledger",
+               [=] { return kernel_row(gen_clos(64, 32, 13), clos_pairs(), 50.0, Kernel::Equal); }});
+  r.push_back({"kernel.lossy.clos", "kernel",
+               "Equal placement with Lossy admission on fixed ShortestPaths DAGs, Clos 64x32, 64 pairs of 50 on one ledger",
+               [=] { return kernel_row(gen_clos(64, 32, 13), clos_pairs(), 50.0, Kernel::Lossy); }});
+  r.push_back({"kernel.proportional.grid", "kernel",
+               "Optimized placement on fixed ShortestPaths DAGs, 24x24 unit grid, 32 corner pairs of 20",
+               [=] { return kernel_row(gen_grid(24, 14, true), grid_pairs(), 20.0, Kernel::Optimized); }});
+  r.push_back({"kernel.eb.grid", "kernel",
+               "Equal placement on fixed ShortestPaths DAGs, 24x24 unit grid, 32 corner pairs of 20",
+               [=] { return kernel_row(gen_grid(24, 14, true), grid_pairs(), 20.0, Kernel::Equal); }});
+  r.push_back({"kernel.weighted.clos", "kernel",
+               "Weighted placement on fixed ShortestPaths DAGs, Clos 64x32, 64 pairs of 50 on one ledger",
+               [=] { return kernel_row(gen_clos(64, 32, 13), clos_pairs(), 50.0, Kernel::Weighted); }});
+  // ---- scalar ShortestPaths capacity across unique failure states and pairs
+  auto capacity_row = [](Kernel k) {
+    auto a = gen_clos(32, 16, 15);
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    auto states = std::make_shared<std::vector<Elig>>();
+    for (auto& fs : failure_states(a.num_edges() / 2, 32, 3, 16)) states->push_back(abaapi::eligibility(*g, {}, fs));
+    std::vector<std::pair<int, int>> pairs;
+    for (int i = 0; i < 8; ++i) pairs.push_back({i, i + 16});
+    return Iter([g, states, pairs, k] {
+      Digest d;
+      for (auto& el : *states) for (auto [s, t] : pairs) d.add_d(abaapi::shortest_paths_capacity(*g, s, t, k, el));
+      return d.h;
+    });
+  };
+  r.push_back({"capacity.costonly_eb.failures", "capacity",
+               "scalar ShortestPaths Equal capacity, Clos 32x16, 32 unique failure states (3 links) x 8 pairs",
+               [=] { return capacity_row(Kernel::Equal); }});
+  r.push_back({"capacity.costonly_prop.failures", "capacity",
+               "scalar ShortestPaths Optimized capacity, Clos 32x16, 32 unique failure states (3 links) x 8 pairs",
+               [=] { return capacity_row(Kernel::Optimized); }});
+  // ---- exact max-flow, totals only versus detailed
+  auto exact_row = [](bool detailed) {
+    auto a = gen_random(1024, 6, 17);
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    auto states = std::make_shared<std::vector<Elig>>();
+    std::mt19937 rng(18);
+    for (int f = 0; f < 8; ++f) {
+      std::vector<int> xe;
+      for (int k = 0; k < 16; ++k) xe.push_back(int(rng() % unsigned(a.num_edges())));
+      states->push_back(abaapi::eligibility(*g, {}, xe));
+    }
+    std::vector<std::pair<int, int>> pairs = {{1, 513}, {100, 900}, {300, 7}, {777, 222}};
+    return Iter([g, states, pairs, detailed] {
+      Digest d;
+      for (auto& el : *states) for (auto [s, t] : pairs) d.add(abaapi::maxflow_exact(*g, s, t, el, detailed));
+      return d.h;
+    });
+  };
+  r.push_back({"maxflow.exact.totals", "maxflow",
+               "exact max-flow totals only, random 1024 x6 weighted, 8 failure states x 4 pairs",
+               [=] { return exact_row(false); }});
+  r.push_back({"maxflow.exact.detailed", "maxflow",
+               "exact max-flow with edge flows, residuals and bottleneck edges, same inputs as totals",
+               [=] { return exact_row(true); }});
+  // ---- the failure study (evaluate_edge_failures)
+  for (int workers : {1, 2}) {
+    r.push_back({workers == 1 ? "sens.exact" : "sens.exact.w2", "sensitivity",
+                 "exact-model sensitivity (candidates: the positive-flow edges), random 256 x6, 4 pairs",
+                 [=] {
+                   auto g = std::make_shared<Graph>(abaapi::build(gen_random(256, 6, 19)));
+                   auto el = std::make_shared<Elig>(abaapi::eligibility(*g, {}, {}));
+                   std::vector<std::pair<int, int>> pairs = {{1, 129}, {30, 200}, {77, 5}, {250, 60}};
+                   return Iter([g, el, pairs, workers] { Digest d; for (auto [s, t] : pairs) d.add(abaapi::edge_failures_exact(*g, s, t, *el, workers)); return d.h; });
+                 }});
+  }
+  // Fixed cut/repair populations. Every timed iteration includes the full
+  // baseline and complete SensitivityResult, including all classification and copies.
+  auto edge_failure_population = [](int kind, int workers = 1) {
+    Arrays a;
+    const int blocks = 32;
+    auto add = [&](int u, int v, double capacity, std::int64_t cost) {
+      a.src.push_back(u); a.dst.push_back(v); a.cap.push_back(capacity); a.cost.push_back(cost);
+    };
+    if (kind == 0 || kind == 3) {
+      a.n = 65;
+      for (int u = 0; u < 64; ++u) add(u, u + 1, 3, 1 + u % 3);
+    } else if (kind == 1 || kind == 4) {
+      a.n = blocks + 2;
+      for (int i = 0; i < blocks; ++i) {
+        add(0, i + 1, 3, 1);
+        if (kind == 4) {
+          add(0, i + 1, 3, 3);
+          add(i + 1, a.n - 1, 3, 2);
+        } else {
+          add(i + 1, a.n - 1, 3, 2);
+          add(i + 1, a.n - 1, 1, 5);
+        }
+      }
+    } else {
+      a.n = 3 * blocks + 2;
+      for (int i = 0; i < blocks; ++i) {
+        const int u = 3 * i + 1, v = u + 1, w = u + 2;
+        add(0, u, 3, 1); add(0, v, 3, 3);
+        add(u, w, 3, 1); add(v, w, 3, 1); add(w, a.n - 1, 3, 1);
+      }
+    }
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    return Iter([g, destination = a.n - 1, kind, workers] {
+      return abaapi::edge_failures_unmasked(*g, destination, kind == 3 ? std::optional<double>(1) : std::nullopt, workers);
+    });
+  };
+  r.push_back({"sens.exact.cut", "sensitivity", "unrestricted optimized edge-failure evaluation, 64-edge nonuniform-cost saturated chain; full baseline/results", [=] { return edge_failure_population(0); }});
+  r.push_back({"sens.exact.partial", "sensitivity", "unrestricted optimized edge-failure evaluation, 32 branches with one of three deleted units reroutable; full baseline/results", [=] { return edge_failure_population(1); }});
+  r.push_back({"sens.exact.branch", "sensitivity", "32 branches; upstream deletion reroutes all 3 units through a second branch (first repair, zero loss), shared downstream is a cut; full baseline/results", [=] { return edge_failure_population(2); }});
+  r.push_back({"sens.exact.reroute", "sensitivity", "32 branches with a parallel upstream member (first repair, zero loss) and a cut downstream link; full baseline/results", [=] { return edge_failure_population(4); }});
+  r.push_back({"sens.exact.capped", "sensitivity", "same 64-edge saturated chain at binding offer 1, unchanged fresh-solve fallback; full baseline/results", [=] { return edge_failure_population(3); }});
+  r.push_back({"sens.exact.cut.w2", "sensitivity", "unrestricted optimized edge-failure evaluation, 64-edge nonuniform-cost saturated chain; full baseline/results", [=] { return edge_failure_population(0, 2); }});
+  r.push_back({"sens.exact.partial.w2", "sensitivity", "unrestricted optimized edge-failure evaluation, 32 branches with one of three deleted units reroutable; full baseline/results", [=] { return edge_failure_population(1, 2); }});
+  r.push_back({"sens.exact.branch.w2", "sensitivity", "32 branches; upstream deletion reroutes all 3 units through a second branch (first repair, zero loss), shared downstream is a cut; full baseline/results", [=] { return edge_failure_population(2, 2); }});
+  r.push_back({"sens.exact.reroute.w2", "sensitivity", "32 branches with a parallel upstream member (first repair, zero loss) and a cut downstream link; full baseline/results", [=] { return edge_failure_population(4, 2); }});
+  r.push_back({"sens.exact.capped.w2", "sensitivity", "same 64-edge saturated chain at binding offer 1, unchanged fresh-solve fallback; full baseline/results", [=] { return edge_failure_population(3, 2); }});
+  for (int workers : {1, 2}) {
+    r.push_back({workers == 1 ? "sens.policy_all_edges" : "sens.policy_all_edges.w2", "sensitivity",
+                 "policy-model sensitivity over every eligible edge, ShortestPaths EB, Clos 16x8 (256 edges), 2 pairs",
+                 [=] {
+                   auto g = std::make_shared<Graph>(abaapi::build(gen_clos(16, 8, 20)));
+                   auto el = std::make_shared<Elig>(abaapi::eligibility(*g, {}, {}));
+                   return Iter([g, el, workers] {
+                     Digest d;
+                     d.add(abaapi::edge_failures_policy_all_edges(*g, 0, 8, *el, workers));
+                     d.add(abaapi::edge_failures_policy_all_edges(*g, 3, 12, *el, workers));
+                     return d.h;
+                   });
+                 }});
+  }
+  // ---- pooled sources and the equal source allocation (several sources of one demand)
+  // Eight demands of eight source leaves each to one destination leaf on a Clos 64x32 (unit costs,
+  // links of 10..80): demand j has the leaves 8j..8j+7 and the leaf (8j + 36) mod 64. Every source
+  // splits over its 32 spines and the eight sources share each spine's one link into the
+  // destination: the pooled program, its attribution and (Lossless) its bisection. One ledger.
+  auto pooled_row = [](double offer, bool lossy) {
+    auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 22)));
+    std::vector<std::pair<std::vector<int>, int>> demands;
+    for (int j = 0; j < 8; ++j) {
+      std::vector<int> srcs;
+      for (int i = 0; i < 8; ++i) srcs.push_back(8 * j + i);
+      demands.push_back({srcs, (8 * j + 36) % 64});
+    }
+    return Iter([g, demands, offer, lossy] { return abaapi::pooled_place(*g, demands, offer, lossy); });
+  };
+  r.push_back({"pooled.ecmp.clos", "pooled",
+               "pooled ShortestPaths Equal Lossless placement, Clos 64x32, 8 demands of 8 source leaves to one leaf, "
+               "400 each on one ledger (the program, attribution and bisection over 8 x 32 + 32 links per demand)",
+               [=] { return pooled_row(400.0, false); }});
+  r.push_back({"pooled.lossy.clos", "pooled",
+               "pooled ShortestPaths Equal Lossy placement, the same Clos and demands, 4,000 each (above capacity: "
+               "drops attributed by highest averages on every shared spine link)",
+               [=] { return pooled_row(4000.0, true); }});
+  // The same demands forwarded by Pinned over from_dag programs of their reverse shortest-path DAGs
+  // (built once, before timing: the one pooled builder ShortestPaths Equal uses), and the building
+  // of those programs alone.
+  auto pooled_dag_row = [](double offer) {
+    auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 22)));
+    std::vector<std::pair<std::vector<int>, int>> demands;
+    for (int j = 0; j < 8; ++j) {
+      std::vector<int> srcs;
+      for (int i = 0; i < 8; ++i) srcs.push_back(8 * j + i);
+      demands.push_back({srcs, (8 * j + 36) % 64});
+    }
+    auto programs = std::make_shared<const abaapi::PooledPrograms>(abaapi::pooled_dag_programs(*g, demands));
+    return Iter([g, demands, programs, offer] { return abaapi::pooled_pinned_place(*g, demands, *programs, offer, false); });
+  };
+  r.push_back({"pooled.from_dag.clos", "pooled",
+               "Pinned over from_dag programs (built before timing) of the same Clos 64x32 demands, Equal Lossless, "
+               "400 each on one ledger: the forwarding and bisection of pooled.ecmp.clos without the route search",
+               [=] { return pooled_dag_row(400.0); }});
+  r.push_back({"pooled.from_dag_build.clos", "pooled",
+               "building the from_dag programs of the same 8 demands from their reverse shortest-path DAGs (the "
+               "search, trimming and the pooled plan; reported, no budget)",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 22)));
+                 std::vector<std::pair<std::vector<int>, int>> demands;
+                 for (int j = 0; j < 8; ++j) {
+                   std::vector<int> srcs;
+                   for (int i = 0; i < 8; ++i) srcs.push_back(8 * j + i);
+                   demands.push_back({srcs, (8 * j + 36) % 64});
+                 }
+                 return Iter([g, demands] { return abaapi::pooled_dag_build(*g, demands); });
+               }});
+  // ---- several demands at once (apply_actions): the eight pooled Lossy demands above given 4,000
+  // each, as eight scalar replace() calls (the reference), as one ORDERED list (the same work: an
+  // equal digest, budget +3 %) and as one SIMULTANEOUS list (every pooled demand forwarded by the
+  // joint evaluator at once, budget 2x the ORDERED list; the demands share no link, so its digest
+  // equals too).
+  auto batch_row = [](abaapi::Batch mode) {
+    auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 22)));
+    std::vector<std::pair<std::vector<int>, int>> demands;
+    for (int j = 0; j < 8; ++j) {
+      std::vector<int> srcs;
+      for (int i = 0; i < 8; ++i) srcs.push_back(8 * j + i);
+      demands.push_back({srcs, (8 * j + 36) % 64});
+    }
+    return Iter([g, demands, mode] { return abaapi::batch_place(*g, demands, 4000.0, mode); });
+  };
+  r.push_back({"batch.scalar.clos", "batch",
+               "the eight pooled Lossy demands of pooled.lossy.clos on a fresh ledger, then eight scalar replace(4000) "
+               "calls (the reference of the list rows)",
+               [=] { return batch_row(abaapi::Batch::Scalar); }});
+  r.push_back({"batch.ordered.clos", "batch",
+               "the same construction, then one ORDERED apply_actions of the eight Replace(4000): the scalar calls' work "
+               "on a working state, one publication (digest equal to batch.scalar.clos)",
+               [=] { return batch_row(abaapi::Batch::Ordered); }});
+  r.push_back({"batch.simultaneous.clos", "batch",
+               "the same construction, then one SIMULTANEOUS apply_actions of the eight Replace(4000): every program "
+               "prepared on one view and forwarded at once by the joint loss evaluator (the demands share no link)",
+               [=] { return batch_row(abaapi::Batch::Simultaneous); }});
+  // The ring (abaapi::ring_fixture): 64 barriers in one cyclic group settling at round 6, as one
+  // program (the reference) and as a SIMULTANEOUS list of its 64 tunnels (equal traffic amounts and
+  // digests; the list has 64 publishing policies rather than one, with a 2x operating budget).
+  r.push_back({"program.ring.lossy", "program",
+               "one Pinned Lossy replace(192) of a 64-head program on a ring of 64 links of 3 units, each tunnel over two "
+               "consecutive links: 64 barriers in one cyclic group, 6 rounds",
+               [] {
+                 auto ring = abaapi::ring_fixture();
+                 return Iter([ring] { return abaapi::ring_program(*ring); });
+               }});
+  r.push_back({"batch.simultaneous.ring", "batch",
+               "the same ring as 64 one-tunnel Pinned Lossy policies, one SIMULTANEOUS apply_actions of Replace(3) each: "
+               "the same 64 barriers and 6 rounds across 64 demands (digest equal to program.ring.lossy)",
+               [] {
+                 auto ring = abaapi::ring_fixture();
+                 return Iter([ring] { return abaapi::ring_list(*ring); });
+               }});
+  r.push_back({"global.equal.random", "global",
+               "evaluate_demand() of CentralizedTE with the equal source allocation, random 1024 x6, 2 demands of 4 sources (the bisection's "
+               "probe solves and the final solve)",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_random(1024, 6, 23)));
+                 const std::vector<std::pair<std::vector<int>, int>> demands = {{{1, 257, 513, 769}, 600},
+                                                                                {{50, 300, 550, 800}, 999}};
+                 return Iter([g, demands] {
+                   Digest d;
+                   for (const auto& [srcs, dst] : demands) d.add(abaapi::global_equal_capacity(*g, srcs, dst));
+                   return d.h;
+                 });
+               }});
+  r.push_back({"sens.equal_global", "sensitivity",
+               "evaluate_edge_failures() of CentralizedTE with the equal source allocation (every edge a candidate, each solved afresh with its "
+               "bisection), random 64 x4 (256 edges), 3 sources to one destination",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_random(64, 4, 24)));
+                 const std::vector<int> srcs = {1, 17, 33};
+                 return Iter([g, srcs] { return abaapi::edge_failures_equal_global(*g, srcs, 50); });
+               }});
+  r.push_back({"global.weighted.random", "global",
+               "weighted-source evaluate_demand, random 1024x6 seed23, four NodeId weights1..4; complete solve lifetime",
+               [] { auto g=std::make_shared<Graph>(abaapi::build(gen_random(1024,6,23)));
+                 return Iter([g]{return abaapi::global_weighted_capacity(*g,{1,257,513,769},600,false);}); }});
+  r.push_back({"sens.weighted_global", "sensitivity",
+               "weighted-source evaluate_edge_failures, random64x4 seed24, three source weights1..3; every allowed deletion",
+               [] { auto g=std::make_shared<Graph>(abaapi::build(gen_random(64,4,24)));
+                 return Iter([g]{return abaapi::global_weighted_capacity(*g,{1,17,33},50,true);}); }});
+  for(int mode:{0,1,2}) {
+    const std::string name=mode==0 ? "program.increment.optimized" : mode==1 ? "program.increment.weighted" : "program.increment.weighted.wide";
+    r.push_back({name,"program",
+                "controller export and Pinned LOSSY lifetime, five cap10 heads, 32 positive place calls; captured source increments",
+                [mode] { auto g=abaapi::captured_graph();return Iter([g,mode]{return abaapi::captured_series(g,mode,true);}); }});
+  }
+  r.push_back({"program.replay.weighted","program",
+               "weighted controller export and Pinned LOSSY lifetime, five cap10 heads, 32 full-offer replace calls",
+               [] { auto g=abaapi::captured_graph();return Iter([g]{return abaapi::captured_series(g,1,false);}); }});
+  // ---- forwarding programs: no older Core has them; they guard later changes.
+  // One demand of eight source leaves to one leaf on a Clos 32x16 (links of 10..80): its optimized
+  // CentralizedTE program (paths with solved amounts, captured source weights), solved for 2,000.
+  auto program_demand = [] {
+    std::vector<int> srcs;
+    for (int i = 0; i < 8; ++i) srcs.push_back(i);
+    return srcs;
+  };
+  r.push_back({"program.forward.global", "program",
+               "forward() of an installed optimized CentralizedTE program, Clos 32x16, 8 sources to one leaf, 32 offers "
+               "of 100..3,200 (the injection by captured weights and the per-tunnel split, no solve)",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_clos(32, 16, 25)));
+                 auto inst = std::make_shared<abaapi::Installed>(*g, program_demand(), 20, 2000.0);
+                 std::vector<double> offers;
+                 for (int i = 1; i <= 32; ++i) offers.push_back(100.0 * i);
+                 return Iter([g, inst, offers] { return inst->forward_all(offers); });
+               }});
+  auto failure_row = [=](bool stale) {
+    auto a = gen_clos(32, 16, 25);
+    auto g = std::make_shared<Graph>(abaapi::build(a));
+    auto prog = std::make_shared<abaapi::Program>(abaapi::global_program(*g, program_demand(), 20, 2000.0));
+    auto states = std::make_shared<abaapi::Masks>(abaapi::masks(*g, failure_states(a.num_edges() / 2, 32, 3, 26)));
+    return Iter([g, prog, states, stale] { return abaapi::pinned_failures(*g, *prog, *states, 2400.0, stale); });
+  };
+  r.push_back({"program.replay.lossy", "program",
+               "Pinned Lossy replace() of that CentralizedTE program under 32 failure states (3 links) as the mask, each on a "
+               "fresh ledger: failed tunnels, the heads' shares over the survivors, the loss rule",
+               [=] { return failure_row(false); }});
+  r.push_back({"program.stale.lossy", "program",
+               "the same with the failure states as black holes (stale forwarding: the program unchanged, traffic "
+               "dropped at the failures)",
+               [=] { return failure_row(true); }});
+  r.push_back({"program.replace.costonly", "program",
+               "ShortestPaths Equal replace() of 8 source leaves to one leaf, Clos 32x16, under 16 changing loads of "
+               "an outside demand (static preparation retained across replacements, the released view and retiring commit)",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_clos(32, 16, 25)));
+                 std::vector<double> loads;
+                 for (int i = 0; i < 16; ++i) loads.push_back(50.0 * (i % 8));
+                 return Iter([g, loads, srcs = program_demand()] {
+                   return abaapi::replace_under_load(*g, srcs, 20, {9, 10, 11, 12}, 21, loads, 800.0);
+                 });
+               }});
+  // ---- T1 tunnels (the fabric of 4 pods, 12 demands of 120: one policy per demand, one ledger)
+  auto t1_pairs = [](const Fabric3& f) {
+    std::vector<std::pair<int, int>> pairs;
+    for (int p = 0; p < 4; ++p) for (int i = 0; i < 3; ++i) pairs.push_back({fabric3_leaf(f, p, i), fabric3_leaf(f, (p + 1) % 4, 7 - i)});
+    return pairs;
+  };
+  r.push_back({"t1.setup.fabric", "t1",
+               "T1 DistributedTE(TunnelCount(16)) replace(120, design 120) per demand, fabric 4 pods, 12 demands on one "
+               "ledger: CSPF setup on the unreserved view, the holds' commit, Lossless forwarding",
+               [=] {
+                 auto f = gen_fabric3(4, 8, 4, 8, 21);
+                 auto g = std::make_shared<Graph>(abaapi::build(f.a));
+                 return Iter([g, pairs = t1_pairs(f)] { return abaapi::t1_setup(*g, pairs, 120.0, 16); });
+               }});
+  r.push_back({"t1.forward.fabric", "t1",
+               "the same 12 T1 programs (Lossy) set up once, then forward() of each under 32 offers (no setup, the holds "
+               "kept)",
+               [=] {
+                 auto f = gen_fabric3(4, 8, 4, 8, 21);
+                 auto g = std::make_shared<Graph>(abaapi::build(f.a));
+                 auto fabric = abaapi::t1_installed(*g, t1_pairs(f), 120.0, 16);
+                 std::vector<double> offers;
+                 for (int i = 0; i < 32; ++i) offers.push_back(40.0 + 10.0 * i);
+                 return Iter([g, fabric, offers] { return abaapi::t1_forward(*fabric, offers); });
+               }});
+  // ---- T2 tunnels (the same fabric and demands; and a mesh: a bidirectional ring plus directed
+  // chords, 4n links, full capacities 2^14..2^17 units, 5/8 to 8/8 of each free, costs 1..10, heads
+  // 0..h-1, destination n-1)
+  auto t2_row = [=](int count, bool up_to, bool headroom) {
+    auto f = gen_fabric3(4, 8, 4, 8, 21);
+    auto g = std::make_shared<Graph>(abaapi::build(f.a));
+    return Iter([g, pairs = t1_pairs(f), count, up_to, headroom] {
+      return abaapi::t2_fabric(*g, pairs, 120.0, count, up_to, headroom);
+    });
+  };
+  r.push_back({"t2.exact16.headroom", "t2",
+               "T2 CentralizedTE(tunnel_count=TunnelCount(16), prefer_headroom=True), replace(120, design 120) per demand, fabric 4 pods, 12 demands "
+               "on one ledger: sizing, the canonical augmentation with Phi, the lossless bound, Lossless forwarding",
+               [=] { return t2_row(16, false, true); }});
+  r.push_back({"t2.exact16.cost", "t2",
+               "the same without prefer_headroom: sizing and the canonical augmentation without Phi",
+               [=] { return t2_row(16, false, false); }});
+  r.push_back({"t2.upto256.headroom", "t2",
+               "T2 CentralizedTE(tunnel_count=TunnelCount(256, up_to=True), prefer_headroom=True), the same demands: count selection over 1..256 with "
+               "the proved bounds, then the chosen count's layout",
+               [=] { return t2_row(256, true, true); }});
+  r.push_back({"t2.size.mesh", "t2",
+               "T2 TunnelCount(16) without prefer_headroom, replace(+inf) of 10 heads on a 500-node mesh (2000 links, 5/8 to 8/8 free): "
+               "sizing-dominated",
+               [] {
+                 auto m = gen_t2_mesh(500, 10, 1744);
+                 auto g = std::make_shared<Graph>(abaapi::build(m.a));
+                 return Iter([g, m] { return abaapi::t2_mesh(*g, m.free, m.heads, 499, 16, false, false); });
+               }});
+  // ---- MSD loop
+  r.push_back({"msd.loop", "msd",
+               "MSD bracket and bisection over ShortestPaths EB placement with a per-series DAG cache, Clos 32x16, 64 demands",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_clos(32, 16, 22)));
+                 auto el = std::make_shared<Elig>(abaapi::eligibility(*g, {}, {}));
+                 std::mt19937 rng(23);
+                 std::vector<std::pair<int, int>> dem;
+                 std::vector<double> base;
+                 while (dem.size() < 64) {
+                   int s = int(rng() % 32), t = int(rng() % 32);
+                   if (s != t) { dem.push_back({s, t}); base.push_back(double(1 + rng() % 5)); }
+                 }
+                 return Iter([g, el, dem, base] {
+                   abaapi::ShortestPathsSeries series(*g, *el);
+                   int probes = 0;
+                   auto feasible = [&](double alpha) {
+                     ++probes;
+                     std::vector<double> v(base.size());
+                     for (std::size_t i = 0; i < v.size(); ++i) v[i] = base[i] * alpha;
+                     auto delivered = series.place_all(dem, v);
+                     for (std::size_t i = 0; i < v.size(); ++i) if (v[i] - delivered[i] > abaapi::grid_resolution()) return false;
+                     return true;
+                   };
+                   // NetGraph MaximumSupportedDemand: start 1, growth 2, resolution 0.01.
+                   double lo = 0, hi = 0, alpha = 1;
+                   if (feasible(alpha)) { lo = alpha; for (int k = 0; k < 32; ++k) { alpha *= 2; if (!feasible(alpha)) { hi = alpha; break; } lo = alpha; } }
+                   else { hi = alpha; for (int k = 0; k < 32; ++k) { alpha /= 2; if (feasible(alpha)) { lo = alpha; break; } hi = alpha; } }
+                   for (int k = 0; k < 32 && hi - lo > 0.01; ++k) { double mid = (lo + hi) / 2; (feasible(mid) ? lo : hi) = mid; }
+                   Digest d;
+                   d.add_d(lo);
+                   d.add_i(probes);
+                   return d.h;
+                 });
+               }});
+  r.push_back({"msd.loop.epochs", "msd",
+               "MSD bracket and bisection over ShortestPaths EB placement, one ledger and 64 policies per series, remove all before each probe, Clos 32x16",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_clos(32, 16, 22)));
+                 auto el = std::make_shared<Elig>(abaapi::eligibility(*g, {}, {}));
+                 std::mt19937 rng(23);
+                 std::vector<std::pair<int, int>> dem;
+                 std::vector<double> base;
+                 while (dem.size() < 64) {
+                   int s = int(rng() % 32), t = int(rng() % 32);
+                   if (s != t) { dem.push_back({s, t}); base.push_back(double(1 + rng() % 5)); }
+                 }
+                 return Iter([g, el, dem, base] {
+                   abaapi::ShortestPathsEpochSeries series(*g, *el, dem);
+                   int probes = 0;
+                   auto feasible = [&](double alpha) {
+                     ++probes;
+                     std::vector<double> v(base.size());
+                     for (std::size_t i = 0; i < v.size(); ++i) v[i] = base[i] * alpha;
+                     auto delivered = series.place_all(v);
+                     for (std::size_t i = 0; i < v.size(); ++i) if (v[i] - delivered[i] > abaapi::grid_resolution()) return false;
+                     return true;
+                   };
+                   // NetGraph MaximumSupportedDemand: start 1, growth 2, resolution 0.01.
+                   double lo = 0, hi = 0, alpha = 1;
+                   if (feasible(alpha)) { lo = alpha; for (int k = 0; k < 32; ++k) { alpha *= 2; if (!feasible(alpha)) { hi = alpha; break; } lo = alpha; } }
+                   else { hi = alpha; for (int k = 0; k < 32; ++k) { alpha /= 2; if (feasible(alpha)) { lo = alpha; break; } hi = alpha; } }
+                   for (int k = 0; k < 32 && hi - lo > 0.01; ++k) { double mid = (lo + hi) / 2; (feasible(mid) ? lo : hi) = mid; }
+                   Digest d;
+                   d.add_d(lo);
+                   d.add_i(probes);
+                   return d.h;
+                 });
+               }});
+  // ---- k shortest paths, the DAG cache, eligibility
+  auto prefix_population = [](int stem, int width, bool ties, bool parallels) {
+    Arrays a;
+    a.n = stem + width + 2;
+    auto add = [&](int u, int v, double cap, std::int64_t cost) {
+      a.src.push_back(u); a.dst.push_back(v); a.cap.push_back(cap); a.cost.push_back(cost);
+    };
+    for (int v = 0; v < stem; ++v) {
+      add(v, v + 1, 100, 1);
+      if (parallels) add(v, v + 1, 50, 1);
+    }
+    for (int i = 0; i < width; ++i) {
+      add(stem, stem + i + 1, 1 + i % 9, 1);
+      add(stem + i + 1, a.n - 1, 1 + i % 9, ties ? 1 : 1 + i % 9);
+    }
+    return a;
+  };
+  r.push_back({"ksp.longprefix_k64", "ksp",
+               "96-edge common prefix then 64 two-edge branches, costs 2..10, k=64, FEWER_HOPS Expand; complete ordered paths",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(prefix_population(96, 64, false, false)));
+                 return Iter([g] { return abaapi::ksp(*g, 0, 161, 64); });
+               }});
+  r.push_back({"ksp.weighted_k32", "ksp",
+               "random 128 x6 seed64, costs1..31, k=32, four endpoint pairs, FEWER_HOPS Expand",
+               [] {
+                 auto g = std::make_shared<Graph>(abaapi::build(gen_random(128, 6, 64)));
+                 return Iter([g] {
+                   Digest d;
+                   for (int s : {0, 16, 32, 48}) d.add(abaapi::ksp(*g, s, 127 - s, 32));
+                   return d.h;
+                 });
+               }});
+  r.push_back({"ksp.collapse", "ksp",
+               "12-edge common prefix with two parallel members per hop, 32 branches, k=32, HIGHER_CAPACITY Collapse",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(prefix_population(12, 32, false, true)));
+                 return Iter([g] { return abaapi::ksp(*g, 0, 45, 32, false, abaapi::KspTie::Capacity); });
+               }});
+  r.push_back({"ksp.ties", "ksp",
+               "three-edge prefix and 64 equal-cost branches with varied capacities, k=64, each of the four ties, Expand",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(prefix_population(3, 64, true, false)));
+                 return Iter([g] {
+                   Digest d;
+                   for (auto tie : {abaapi::KspTie::Fewer, abaapi::KspTie::Capacity, abaapi::KspTie::Available, abaapi::KspTie::Headroom})
+                     d.add(abaapi::ksp(*g, 0, 68, 64, true, tie));
+                   return d.h;
+                 });
+               }});
+  r.push_back({"ksp.k1", "ksp",
+               "same 96-edge prefix/64 branches as ksp.longprefix_k64, k=1, unchanged first-search-only work",
+               [=] {
+                 auto g = std::make_shared<Graph>(abaapi::build(prefix_population(96, 64, false, false)));
+                 return Iter([g] { return abaapi::ksp(*g, 0, 161, 1); });
+               }});
+  r.push_back({"ksp.fabric3_k8", "ksp",
+               "K shortest paths, k = 8, three-tier fabric 8 pods x 16 leaves, 8 pairs",
+               [] {
+                 auto f = gen_fabric3(8, 16, 8, 16, 24);
+                 auto g = std::make_shared<Graph>(abaapi::build(f.a));
+                 std::vector<std::pair<int, int>> pairs;
+                 for (int p = 1; p < 8; ++p) pairs.push_back({fabric3_leaf(f, 0, p % 4), fabric3_leaf(f, p, 0)});
+                 pairs.push_back({fabric3_leaf(f, 0, 0), fabric3_leaf(f, 0, 9)});
+                 return Iter([g, pairs] { Digest d; for (auto [s, t] : pairs) d.add(abaapi::ksp(*g, s, t, 8)); return d.h; });
+               }});
+  auto cache_row = [](bool warm) {
+    auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 25)));
+    std::vector<int> roots;
+    for (int i = 0; i < 64; ++i) roots.push_back(i);
+    abaapi::dag_cache_series(*g, {}, warm);  // setup: creates the warm row's cache
+    return Iter([g, roots, warm] { return abaapi::dag_cache_series(*g, roots, warm); });
+  };
+  r.push_back({"cache.cold", "cache", "ShortestPathCache series from a cleared cache: 64 roots, Clos 64x32",
+               [=] { return cache_row(false); }});
+  r.push_back({"cache.warm", "cache", "ShortestPathCache series on a prepopulated cache: 64 roots, Clos 64x32",
+               [=] { return cache_row(true); }});
+  r.push_back({"elig.build_intersect", "eligibility",
+               "Eligibility build for 64 failure states and intersect with a common state, Clos 64x32",
+               [] {
+                 auto a = gen_clos(64, 32, 26);
+                 auto g = std::make_shared<Graph>(abaapi::build(a));
+                 auto states = failure_states(a.num_edges() / 2, 64, 4, 27);
+                 std::vector<int> common = {0, 1, 2, 3};
+                 abaapi::eligibility_build_intersect(*g, common, {});
+                 return Iter([g, states, common] { return abaapi::eligibility_build_intersect(*g, common, states); });
+               }});
+  for (const auto& [name, operation] : std::array<std::pair<const char*, abaapi::TinyOperation>, 4>{{
+      {"concurrency.place_zero", abaapi::TinyOperation::PlaceZero},
+      {"concurrency.delivered", abaapi::TinyOperation::Delivered},
+      {"concurrency.program", abaapi::TinyOperation::Program},
+      {"concurrency.config", abaapi::TinyOperation::Config}}}) {
+    r.push_back({name, "concurrency", "10,000 calls of one operation on a prepared one-link LOSSLESS policy (4 of 16 units)",
+      [operation] {
+        auto fixture = std::make_shared<abaapi::TinyCalls>();
+        return Iter([fixture, operation] { return fixture->run(operation); });
+      }});
+  }
+  r.push_back({"cache.frozen.reads", "cache", "64 direct frozen-cache hits, Clos 64x32, same roots as cache.warm",
+    [] {
+      auto g = std::make_shared<Graph>(abaapi::build(gen_clos(64, 32, 25)));
+      std::vector<int> roots;
+      for (int i = 0; i < 64; ++i) roots.push_back(i);
+      (void)abaapi::dag_cache_series(*g, roots, true);
+      g->warm_cache->freeze();
+      return Iter([g, roots] { return abaapi::dag_cache_series(*g, roots, true); });
+    }});
+  for (bool parallel : {false, true}) {
+    r.push_back({parallel ? "concurrency.two_ledgers_parallel" : "concurrency.two_ledgers_serial", "concurrency",
+      "Two independent ledgers, 32 evaluate(32) calls each using static preparation installed in setup; two thread launches/joins in both modes; layered graph 384 nodes/2816 edges",
+      [parallel] {
+        auto fixture = std::make_shared<abaapi::ParallelLedgers>();
+        return Iter([fixture, parallel] { return fixture->run(parallel); });
+      }});
+  }
+  add_storage_rows(r);  // the storage rows come last in the list
+  return r;
+}
+
+// ---------------------------------------------------------------- driver
+
+inline double peak_rss_bytes(int who) {
+  struct rusage ru{};
+  getrusage(who, &ru);
+#if defined(__APPLE__)
+  return double(ru.ru_maxrss);  // bytes on macOS
+#else
+  return double(ru.ru_maxrss) * 1024.0;  // KiB on Linux
+#endif
+}
+
+inline std::string json_escape(const std::string& s) {
+  std::string o;
+  for (char c : s) { if (c == '"' || c == '\\') o += '\\'; o += c; }
+  return o;
+}
+
+using Clock = std::chrono::steady_clock;
+static_assert(Clock::is_steady && std::is_integral_v<Clock::rep>, "durations are whole clock ticks, never negative");
+
+// The durations of a block's timed iterations, in clock ticks, in memory that does not grow with
+// the iteration count, so every block's peak RSS holds the same bookkeeping whatever its count
+// (README "Memory"): a count per duration below kShort ticks (65.5 us with the nanosecond clocks
+// of macOS and Linux), and the longer durations listed. Each listed duration lasted at least
+// kShort ticks, so the list's kLong slots fill only after 4.3 s of such iterations; beyond them it
+// grows. Both are allocated and written before the row's setup. The statistics are those of the
+// sorted list of every duration, value for value.
+class IterationTimes {
+ public:
+  static constexpr std::size_t kShort = std::size_t{1} << 16;
+  static constexpr std::size_t kLong = std::size_t{1} << 16;
+
+  IterationTimes() : short_(kShort, 0), long_(kLong, 0) {
+    // Volatile stores, one per page: the pages are resident from here on, not from the first
+    // duration that lands on them.
+    for (std::vector<std::uint64_t>* v : {&short_, &long_})
+      for (std::size_t i = 0; i < v->size(); i += 512) static_cast<volatile std::uint64_t*>(v->data())[i] = 0;
+  }
+
+  void add(Clock::duration d) {
+    const auto t = static_cast<std::uint64_t>(d.count());
+    if (t < kShort) {
+      ++short_[t];
+    } else {
+      if (n_long_ < long_.size()) long_[n_long_] = t;
+      else long_.push_back(t);
+      ++n_long_;
+    }
+    ++n_;
+  }
+
+  std::size_t size() const { return n_; }
+
+  // Sorts the long durations; once, after the last add.
+  void finish() { std::sort(long_.begin(), long_.begin() + std::ptrdiff_t(n_long_)); }
+
+  // The k-th smallest duration (k < size(), from 0) in seconds, converted as one duration is.
+  double at(std::size_t k) const {
+    std::size_t seen = 0;
+    for (std::size_t t = 0; t < kShort; ++t) {
+      seen += short_[t];
+      if (k < seen) return seconds(t);
+    }
+    return seconds(long_[k - seen]);
+  }
+
+  // The sum of every duration in seconds, the smallest added first.
+  double sum() const {
+    double s = 0;
+    for (std::size_t t = 0; t < kShort; ++t)
+      for (std::uint64_t c = short_[t]; c > 0; --c) s += seconds(t);
+    for (std::size_t i = 0; i < n_long_; ++i) s += seconds(long_[i]);
+    return s;
+  }
+
+ private:
+  static double seconds(std::uint64_t t) {
+    return std::chrono::duration<double>(Clock::duration(Clock::rep(t))).count();
+  }
+
+  std::vector<std::uint64_t> short_;  // the count of every duration below kShort ticks
+  std::vector<std::uint64_t> long_;   // the longer durations, the first n_long_ entries
+  std::size_t n_long_ = 0;
+  std::size_t n_ = 0;
+};
+
+inline const char* query_list_of(const std::string& row) {
+  for (const auto& [name, list] : kQueryLists)
+    if (row == name) return list;
+  return nullptr;
+}
+
+// The harness's command line over a row list (harness.cpp passes rows()):
+//
+//   aba-list | aba-run <row> <iterations> | aba-calibrate <row> <seconds>
+//
+// Exit status: 0 success; 1 a failure inside an iteration, the untimed first one included (the
+// message on stderr after "FAIL: ");
+// 2 a usage error (an unknown mode, a missing argument, an iteration count that is not a positive
+// integer, seconds that are not a positive finite number) or an unknown row; 3 a digest that
+// changed between iterations; 4 a row whose input or setup check failed.
+inline int harness_main(int argc, char** argv, const std::vector<Row>& all) {
+  const std::string mode = argc > 1 ? argv[1] : "";
+  if (mode == "aba-list" && argc == 2) {
+    for (const auto& row : all) {
+      const char* list = query_list_of(row.name);
+      std::printf("{\"row\":\"%s\",\"group\":\"%s\",\"desc\":\"%s\"%s%s%s}\n", row.name.c_str(),
+                  row.group.c_str(), json_escape(row.desc).c_str(), list ? ",\"queries\":\"" : "", list ? list : "",
+                  list ? "\"" : "");
+    }
+    return 0;
+  }
+  const bool calibrate = mode == "aba-calibrate";
+  long long iterations = 0;
+  double seconds = 0.0;
+  bool usage = (mode != "aba-run" && !calibrate) || argc != 4;
+  if (!usage) {
+    char* end = nullptr;
+    errno = 0;
+    if (calibrate) {
+      seconds = std::strtod(argv[3], &end);
+      usage = *argv[3] == '\0' || *end != '\0' || errno != 0 || !std::isfinite(seconds) || seconds <= 0.0;
+    } else {
+      iterations = std::strtoll(argv[3], &end, 10);
+      usage = *argv[3] == '\0' || *end != '\0' || errno != 0 || iterations < 1;
+    }
+  }
+  if (usage) {
+    std::fprintf(stderr, "usage: harness aba-list | aba-run <row> <iterations> | aba-calibrate <row> <seconds>\n");
+    return 2;
+  }
+  const std::string name = argv[2];
+  auto it = std::find_if(all.begin(), all.end(), [&](const Row& r) { return r.name == name; });
+  if (it == all.end()) { std::fprintf(stderr, "unknown row %s\n", name.c_str()); return 2; }
+  IterationTimes times;  // before the setup: the same memory in every block's peak
+  auto t0 = Clock::now();
+  Iter fn;
+  try {
+    fn = it->setup();
+  } catch (const std::exception& e) {
+    // A row whose input or setup check fails (a frozen digest, a queue assertion) exits 4.
+    std::fprintf(stderr, "row %s setup failed: %s\n", name.c_str(), e.what());
+    return 4;
+  }
+  std::uint64_t digest = 0;
+  double setup_s = 0.0;  // the setup and the untimed first iteration
+  auto start = Clock::now();
+  try {
+    digest = fn();  // untimed first iteration: the reference digest and warm state
+    setup_s = std::chrono::duration<double>(Clock::now() - t0).count();
+    start = Clock::now();
+    for (long long i = 0; calibrate ? std::chrono::duration<double>(Clock::now() - start).count() < seconds : i < iterations; ++i) {
+      auto a = Clock::now();
+      const std::uint64_t got = fn();
+      times.add(Clock::now() - a);
+      if (got != digest) { std::fprintf(stderr, "nondeterministic digest in %s at iteration %lld\n", name.c_str(), i); return 3; }
+    }
+  } catch (const std::exception& e) {
+    std::fprintf(stderr, "FAIL: %s\n", e.what());
+    return 1;
+  }
+  const double block_s = std::chrono::duration<double>(Clock::now() - start).count();
+  times.finish();
+  const std::size_t n = times.size();
+  auto q = [&](double p) { return n == 0 ? 0.0 : times.at(std::min(n - 1, std::size_t(p * double(n - 1) + 0.5))); };
+  const double mean = n == 0 ? 0.0 : times.sum() / double(n);
+  const double median = n == 0 ? 0.0 : (n % 2 ? times.at(n / 2) : 0.5 * (times.at(n / 2 - 1) + times.at(n / 2)));
+  std::printf("{\"row\":\"%s\",\"iterations\":%zu,\"median_s\":%.9g,\"mean_s\":%.9g,"
+              "\"min_s\":%.9g,\"p10_s\":%.9g,\"p90_s\":%.9g,\"max_s\":%.9g,\"block_s\":%.6f,\"setup_s\":%.6f,"
+              "\"digest\":\"%016llx\",\"rss_self_bytes\":%.0f,\"rss_children_bytes\":%.0f}\n",
+              name.c_str(), n, median, mean, n == 0 ? 0.0 : times.at(0), q(0.1), q(0.9),
+              n == 0 ? 0.0 : times.at(n - 1), block_s, setup_s, static_cast<unsigned long long>(digest),
+              peak_rss_bytes(RUSAGE_SELF), peak_rss_bytes(RUSAGE_CHILDREN));
+  return 0;
+}
+
+}  // namespace abarows
diff --git a/dev/perf/build.sh b/dev/perf/build.sh
new file mode 100755
index 0000000..a3af25c
--- /dev/null
+++ b/dev/perf/build.sh
@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# Build one A/B/A timing harness and its build record (README.md, "Building the two sides").
+#
+#   bash dev/perf/build.sh REV OUT_DIR
+#
+# REV is required: `worktree` compiles this checkout's include/ and src/ (uncommitted changes
+# included); anything else is a git revision whose include/ and src/ are extracted with
+# `git archive` into OUT_DIR/src. The driver (harness.cpp, aba_rows.hpp, aba_api.hpp) always
+# comes from this checkout, so both sides of a comparison run the same rows, each compiled
+# against its own Core. OUT_DIR must be absent or empty; it receives `harness` and the build
+# record `harness.json`.
+#
+# The compiler is clang++ from PATH (Xcode's shim adds the SDK itself) with exactly the flags of
+# the first flags=(...) line below. CXX overrides the compiler; on macOS a set CXX also gets
+# -isysroot "$(xcrun --show-sdk-path)" (a toolchain compiler such as "$(xcrun --find clang++)"
+# finds no system headers without it), and a set CXX without an SDK is refused.
+set -euo pipefail
+flags=(-std=c++20 -O3 -DNDEBUG -funroll-loops -fno-math-errno -fno-trapping-math -falign-functions=64 -Wall -Wextra)
+[ $# -eq 2 ] && [ -n "$1" ] && [ -n "$2" ] || { echo "usage: build.sh REV|worktree OUT_DIR" >&2; exit 2; }
+rev=$1
+out=$2
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)
+case "$out" in /*) ;; *) out=$PWD/$out ;; esac
+if [ -e "$out" ] && { [ ! -d "$out" ] || [ -n "$(ls -A "$out")" ]; }; then
+  echo "build.sh: $out must be absent or an empty directory" >&2
+  exit 2
+fi
+if [ "$rev" = worktree ]; then
+  commit=$(git -C "$root" rev-parse HEAD)
+else
+  commit=$(git -C "$root" rev-parse --verify --quiet "$rev^{commit}") || { echo "build.sh: no revision $rev" >&2; exit 2; }
+fi
+# The compiler and its SDK are settled before OUT_DIR is touched: a refusal leaves it as it was.
+cxx=${CXX:-clang++}
+sdk_path=
+sdk_version=
+if command -v xcrun > /dev/null 2>&1; then
+  sdk_path=$(xcrun --show-sdk-path 2> /dev/null || true)
+  sdk_version=$(xcrun --show-sdk-version 2> /dev/null || true)
+fi
+isysroot=
+if [ -n "${CXX:-}" ] && [ "$(uname -s)" = Darwin ]; then
+  if [ -z "$sdk_path" ] || [ ! -d "$sdk_path" ]; then
+    echo "build.sh: CXX=$CXX is set but xcrun names no macOS SDK, so this compiler would not find the system headers; install Xcode or the Command Line Tools, or unset CXX to build with the clang++ shim" >&2
+    exit 2
+  fi
+  isysroot=$sdk_path
+  flags+=(-isysroot "$isysroot")
+fi
+mkdir -p "$out"
+out=$(cd "$out" && pwd -P)
+cd "$root"
+if [ "$rev" = worktree ]; then
+  src=$root
+  dirty=$(git status --short -- include src | wc -l | tr -d ' ')
+else
+  src=$out/src
+  mkdir -p "$src"
+  git archive "$commit" include src | tar -x -C "$src"
+  dirty=0
+fi
+# A harness without its record would be timed unchecked (aba.py checks a record's driver), so
+# a failure from the compile to the written record removes both.
+trap 'rm -f "$out/harness" "$out/harness.json"' EXIT
+"$cxx" "${flags[@]}" -I"$src/include" dev/perf/harness.cpp "$src"/src/*.cpp -o "$out/harness"
+buildv=
+if command -v vtool > /dev/null 2>&1; then buildv=$(vtool -show-build "$out/harness" 2> /dev/null || true); fi
+OUT=$out/harness SRC=$src REV=$rev COMMIT=$commit DIRTY=$dirty CXXV="$("$cxx" --version | head -1)" \
+  FLAGS="${flags[*]}" CXXPATH="$(command -v "$cxx" || true)" CXXSET="${CXX-}" CXXISSET="${CXX+1}" \
+  ISYSROOT="$isysroot" SDKPATH="$sdk_path" SDKVERSION="$sdk_version" SDKROOTENV="${SDKROOT-}" \
+  SDKROOTSET="${SDKROOT+1}" DTSET="${MACOSX_DEPLOYMENT_TARGET+1}" DT="${MACOSX_DEPLOYMENT_TARGET-}" \
+  BUILDV="$buildv" python3 - << 'EOF'
+import glob
+import hashlib
+import json
+import os
+
+
+def sha(path):
+    with open(path, "rb") as f:
+        return hashlib.sha256(f.read()).hexdigest()
+
+
+def env_or_null(value, is_set):
+    return os.environ[value] if os.environ[is_set] else None
+
+
+src = os.environ["SRC"]
+lines = [
+    (os.path.relpath(p, src), sha(p))
+    for sub in ("include", "src")
+    for p in glob.glob(os.path.join(src, sub, "**", "*"), recursive=True)
+    if os.path.isfile(p)
+]
+driver = sorted(glob.glob("dev/perf/*.hpp") + ["dev/perf/harness.cpp"])
+# LC_BUILD_VERSION as vtool prints it: "platform MACOS", "minos 15.0", "sdk 27.0", ...
+build = {}
+raw = []
+for ln in os.environ["BUILDV"].splitlines()[1:]:
+    parts = ln.split(None, 1)
+    if len(parts) == 2:
+        raw.append(f"{parts[0]} {parts[1].strip()}")
+        build.setdefault(parts[0], parts[1].strip())
+info = {
+    "binary": os.environ["OUT"],
+    "binary_sha256": sha(os.environ["OUT"]),
+    "rev": os.environ["REV"],
+    "commit": os.environ["COMMIT"],
+    "dirty_core_paths": int(os.environ["DIRTY"]),
+    # sha256 of "<sha256>  <path>\n" lines over include/ and src/, sorted by path.
+    "core_sources_sha256": hashlib.sha256(
+        "".join(f"{h}  {p}\n" for p, h in sorted(lines)).encode()
+    ).hexdigest(),
+    "driver_sha256": {p: sha(p) for p in driver},
+    "compiler": os.environ["CXXV"],
+    "flags": os.environ["FLAGS"],
+    # The compiler binary the name resolved to, and CXX as given (null: unset, the PATH clang++).
+    "compiler_path": os.environ["CXXPATH"] or None,
+    "cxx_env": env_or_null("CXXSET", "CXXISSET"),
+    # The SDK passed with -isysroot (a set CXX on macOS), else null (the shim's own choice).
+    "isysroot": os.environ["ISYSROOT"] or None,
+    # xcrun's SDK: the one the clang++ shim and -isysroot use unless SDKROOT names another.
+    "sdk": {
+        "path": os.environ["SDKPATH"] or None,
+        "version": os.environ["SDKVERSION"] or None,
+        "sdkroot_env": env_or_null("SDKROOTENV", "SDKROOTSET"),
+        "source": "xcrun --show-sdk-path / --show-sdk-version"
+        if os.environ["SDKPATH"]
+        else "no xcrun SDK on this host: the compiler's own system headers",
+    },
+    # Requested: MACOSX_DEPLOYMENT_TARGET (null when unset: the compiler's default, the SDK's
+    # OS version). Effective: the minimum OS and SDK the binary carries (LC_BUILD_VERSION).
+    "deployment_target": {
+        "requested": env_or_null("DT", "DTSET"),
+        "effective_minos": build.get("minos"),
+        "binary_sdk": build.get("sdk"),
+        "platform": build.get("platform"),
+        "raw": "; ".join(raw) or None,
+        "source": "vtool -show-build" if raw else "no LC_BUILD_VERSION read (no vtool, or it printed none)",
+    },
+    "built_by": "dev/perf/build.sh",
+}
+with open(os.environ["OUT"] + ".json", "w") as f:
+    json.dump(info, f, indent=2)
+print(
+    f"{os.environ['OUT']}: {info['rev']} {info['commit'][:12]} core "
+    f"{info['core_sources_sha256'][:16]} sha256 {info['binary_sha256'][:16]}"
+)
+EOF
+trap - EXIT
diff --git a/dev/perf/harness.cpp b/dev/perf/harness.cpp
new file mode 100644
index 0000000..68280f4
--- /dev/null
+++ b/dev/perf/harness.cpp
@@ -0,0 +1,7 @@
+// The A/B/A timing harness: the rows of aba_rows.hpp compiled against one Core build's include/
+// and src/ (build.sh). harness_main (aba_rows.hpp) reads the command line:
+//
+//   harness aba-list | aba-run <row> <iterations> | aba-calibrate <row> <seconds>
+#include "aba_rows.hpp"
+
+int main(int argc, char** argv) { return abarows::harness_main(argc, argv, abarows::rows()); }
diff --git a/dev/perf/queries/SHA256SUMS b/dev/perf/queries/SHA256SUMS
new file mode 100644
index 0000000..efd0ace
--- /dev/null
+++ b/dev/perf/queries/SHA256SUMS
@@ -0,0 +1,4 @@
+3f47de99a2b521fafe6d23b29805cdc19aca1306b6af64d13133745dbd8aecd4  near65k.json
+bb84f77497bd2ffc9ba16bf9fdc87d41e848328632c8cb33d7057522062f14ad  far16k.json
+2e842fb1f95908a90603da81904c79d594d306084f125dfcd91942e8051236cd  canonical16k.json
+280f599ac837d892ef6e35a6e2161d657b09e1fea25d89ae38a6668895e76210  targetset_clos.json
diff --git a/dev/perf/queries/canonical16k.json b/dev/perf/queries/canonical16k.json
new file mode 100644
index 0000000..c3994e4
--- /dev/null
+++ b/dev/perf/queries/canonical16k.json
@@ -0,0 +1,48 @@
+{
+ "format": "frozen-queries/1",
+ "row": "spf.single.canonical16k",
+ "list": "canonical16k",
+ "input": {
+  "generator": "gen_random(16384, 8, 5)",
+  "num_nodes": 16384,
+  "num_edges": 131072,
+  "arrays_sha256": "5d045b157c560e00a0df2205a55d67965735773ed976a2c6e8d1ac0ff2c4f84e",
+  "input_digest": 11698079179288285235,
+  "residual_zero": 10050
+ },
+ "rule": "sources s_i = (i * 997 + 1) mod n, i = 0..7; target t_i = the reachable node with the largest shortest-path distance from s_i over the input edges whose residual is not zero (the row's residual gating; residual_zero lists the gated input edges), ties to the lowest node id",
+ "pairs": [
+  [
+   1,
+   1339
+  ],
+  [
+   998,
+   1339
+  ],
+  [
+   1995,
+   2641
+  ],
+  [
+   2992,
+   1339
+  ],
+  [
+   3989,
+   10530
+  ],
+  [
+   4986,
+   1339
+  ],
+  [
+   5983,
+   1339
+  ],
+  [
+   6980,
+   11931
+  ]
+ ]
+}
diff --git a/dev/perf/queries/far16k.json b/dev/perf/queries/far16k.json
new file mode 100644
index 0000000..6acb902
--- /dev/null
+++ b/dev/perf/queries/far16k.json
@@ -0,0 +1,47 @@
+{
+ "format": "frozen-queries/1",
+ "row": "spf.dag.far16k",
+ "list": "far16k",
+ "input": {
+  "generator": "gen_random(16384, 8, 8)",
+  "num_nodes": 16384,
+  "num_edges": 131072,
+  "arrays_sha256": "0e082572f1af743dc27102d03914d2571204d38989af970e497b145289cb848e",
+  "input_digest": 5806366537376710903
+ },
+ "rule": "sources s_i = (i * 997 + 1) mod n, i = 0..7; target t_i = the reachable node with the largest shortest-path distance from s_i over every input edge (positive integer costs), ties to the lowest node id",
+ "pairs": [
+  [
+   1,
+   5378
+  ],
+  [
+   998,
+   9128
+  ],
+  [
+   1995,
+   11844
+  ],
+  [
+   2992,
+   10152
+  ],
+  [
+   3989,
+   10152
+  ],
+  [
+   4986,
+   7529
+  ],
+  [
+   5983,
+   16342
+  ],
+  [
+   6980,
+   16342
+  ]
+ ]
+}
diff --git a/dev/perf/queries/near65k.json b/dev/perf/queries/near65k.json
new file mode 100644
index 0000000..92490db
--- /dev/null
+++ b/dev/perf/queries/near65k.json
@@ -0,0 +1,271 @@
+{
+ "format": "frozen-queries/1",
+ "row": "spf.dag.near65k",
+ "list": "near65k",
+ "input": {
+  "generator": "gen_random(65536, 8, 7)",
+  "num_nodes": 65536,
+  "num_edges": 524288,
+  "arrays_sha256": "632aecbf53617daca2c255cdd55ce15ca808893713adaabab498dcc5ce59d960",
+  "input_digest": 3859296219677894378
+ },
+ "rule": "sources s_i = (i * 997 + 1) mod n, i = 0..63; target t_i = the lowest-numbered node v != s_i with an edge s_i -> v in the input arrays (self-loops skipped)",
+ "pairs": [
+  [
+   1,
+   2
+  ],
+  [
+   998,
+   999
+  ],
+  [
+   1995,
+   1996
+  ],
+  [
+   2992,
+   2993
+  ],
+  [
+   3989,
+   3990
+  ],
+  [
+   4986,
+   116
+  ],
+  [
+   5983,
+   5984
+  ],
+  [
+   6980,
+   5695
+  ],
+  [
+   7977,
+   4460
+  ],
+  [
+   8974,
+   3025
+  ],
+  [
+   9971,
+   1894
+  ],
+  [
+   10968,
+   10969
+  ],
+  [
+   11965,
+   4249
+  ],
+  [
+   12962,
+   9444
+  ],
+  [
+   13959,
+   2698
+  ],
+  [
+   14956,
+   3611
+  ],
+  [
+   15953,
+   1555
+  ],
+  [
+   16950,
+   6755
+  ],
+  [
+   17947,
+   15211
+  ],
+  [
+   18944,
+   2177
+  ],
+  [
+   19941,
+   2870
+  ],
+  [
+   20938,
+   4285
+  ],
+  [
+   21935,
+   17837
+  ],
+  [
+   22932,
+   10793
+  ],
+  [
+   23929,
+   23930
+  ],
+  [
+   24926,
+   11028
+  ],
+  [
+   25923,
+   3885
+  ],
+  [
+   26920,
+   4095
+  ],
+  [
+   27917,
+   5336
+  ],
+  [
+   28914,
+   3084
+  ],
+  [
+   29911,
+   5525
+  ],
+  [
+   30908,
+   8194
+  ],
+  [
+   31905,
+   13485
+  ],
+  [
+   32902,
+   2444
+  ],
+  [
+   33899,
+   3487
+  ],
+  [
+   34896,
+   3662
+  ],
+  [
+   35893,
+   9132
+  ],
+  [
+   36890,
+   7109
+  ],
+  [
+   37887,
+   10077
+  ],
+  [
+   38884,
+   7934
+  ],
+  [
+   39881,
+   4570
+  ],
+  [
+   40878,
+   20916
+  ],
+  [
+   41875,
+   2116
+  ],
+  [
+   42872,
+   5858
+  ],
+  [
+   43869,
+   14903
+  ],
+  [
+   44866,
+   24
+  ],
+  [
+   45863,
+   16319
+  ],
+  [
+   46860,
+   5995
+  ],
+  [
+   47857,
+   26465
+  ],
+  [
+   48854,
+   17016
+  ],
+  [
+   49851,
+   9574
+  ],
+  [
+   50848,
+   5966
+  ],
+  [
+   51845,
+   14215
+  ],
+  [
+   52842,
+   22580
+  ],
+  [
+   53839,
+   5643
+  ],
+  [
+   54836,
+   5009
+  ],
+  [
+   55833,
+   580
+  ],
+  [
+   56830,
+   1068
+  ],
+  [
+   57827,
+   1275
+  ],
+  [
+   58824,
+   4854
+  ],
+  [
+   59821,
+   11006
+  ],
+  [
+   60818,
+   12565
+  ],
+  [
+   61815,
+   7166
+  ],
+  [
+   62812,
+   35168
+  ]
+ ]
+}
diff --git a/dev/perf/queries/storage/SHA256SUMS b/dev/perf/queries/storage/SHA256SUMS
new file mode 100644
index 0000000..c63ee9f
--- /dev/null
+++ b/dev/perf/queries/storage/SHA256SUMS
@@ -0,0 +1 @@
+8144cad5932dd0580fb8b0732e0bbaae64aa7ef6b2b6bbb3408c053aa112f78e  inputs.json
diff --git a/dev/perf/queries/storage/inputs.json b/dev/perf/queries/storage/inputs.json
new file mode 100644
index 0000000..78f6510
--- /dev/null
+++ b/dev/perf/queries/storage/inputs.json
@@ -0,0 +1,545 @@
+{
+ "format": "storage-inputs/1",
+ "capacities": "positive integers (physical); the adapter converts them to units of 1/4096 exactly",
+ "input_sha256_rule": "sha256 of src int32, dst int32, cost int64, capacity float64 (little-endian), concatenated",
+ "inputs": {
+  "wgrid256": {
+   "generator": "gen_wgrid256(): 256x256 grid, both directions, costs 1..31 drawn per direction, mt19937(1729)",
+   "shape": {
+    "n": 65536,
+    "e": 261120,
+    "k": 31,
+    "max_out": 4,
+    "max_in": 4,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 0,
+    "src_descents": 130305,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "14812220864904460480"
+   },
+   "rows": [
+    "construct.wgrid256",
+    "spf.to.wgrid256"
+   ],
+   "input_sha256": "d307d7797682fadb6c168cef20c1a5efd4c74446538d5ba05421e9db8fd395de"
+  },
+  "fanout_clos": {
+   "generator": "gen_fanout_clos(): Clos 400x400 at cost 1, hubs 800 -> leaves 0..99 and leaves 300..399 -> 801 at cost 2, mt19937(1729)",
+   "shape": {
+    "n": 802,
+    "e": 320200,
+    "k": 2,
+    "max_out": 401,
+    "max_in": 401,
+    "gcd": 1,
+    "max_cost": 2,
+    "isolated": 0,
+    "src_descents": 160000,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "5230821760560145505"
+   },
+   "rows": [
+    "construct.fanout_clos"
+   ],
+   "input_sha256": "408fd7321f41a7f8931ab999cf6aa9299e11eae5f5efdd4cd826ac47692e67cd"
+  },
+  "random1m_nat": {
+   "generator": "gen_random1m(false): ring + 7 random out-edges per node, 131,072 nodes, costs 1..31, mt19937(1729)",
+   "shape": {
+    "n": 131072,
+    "e": 1048576,
+    "k": 31,
+    "max_out": 8,
+    "max_in": 24,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "16852305707948996038"
+   },
+   "rows": [
+    "construct.random1m_nat"
+   ],
+   "input_sha256": "b395d1bc9952a3c0d6ece00c9c48300edffd5de39696ffe98728d31b094c3382"
+  },
+  "random1m_scat": {
+   "generator": "gen_random1m(true): random1m_nat permuted by Fisher-Yates over mt19937_64(4242)",
+   "shape": {
+    "n": 131072,
+    "e": 1048576,
+    "k": 31,
+    "max_out": 8,
+    "max_in": 24,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 0,
+    "src_descents": 524810,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "10807403047943366003"
+   },
+   "rows": [
+    "construct.random1m_scat",
+    "spf.to.random1m",
+    "spf.full.random1m"
+   ],
+   "input_sha256": "658928f7c0a60dbe388482a0bd5dc034f6cd163cc412895800a1f7561ac9631b"
+  },
+  "wide65k": {
+   "generator": "gen_wide65k(): ring + 7 random out-edges, 65,536 nodes, costs 1..2^30, mt19937(1031)",
+   "shape": {
+    "n": 65536,
+    "e": 524288,
+    "k": 524146,
+    "max_out": 8,
+    "max_in": 21,
+    "gcd": 1,
+    "max_cost": 1073738528,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "13538344444856380895"
+   },
+   "rows": [
+    "construct.wide65k"
+   ],
+   "input_sha256": "ccc9b83bdd040c6f9e2c401dcb4ab126bc10349d52f34d1b505bff876787b957"
+  },
+  "k65536": {
+   "generator": "gen_kcosts(65536): ring + 7 random out-edges, 65,536 nodes (mt19937(1032)), exactly the costs 1..65,536",
+   "shape": {
+    "n": 65536,
+    "e": 524288,
+    "k": 65536,
+    "max_out": 8,
+    "max_in": 21,
+    "gcd": 1,
+    "max_cost": 65536,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "10929368686095504329"
+   },
+   "rows": [
+    "construct.k65536"
+   ],
+   "input_sha256": "2dec5408f2e7f5829b5f6dcfdfcdc931eca4cf31c32df06c1fb2abfecb078dc9"
+  },
+  "k65537": {
+   "generator": "gen_kcosts(65537): the k65536 topology and capacities, exactly the costs 1..65,537",
+   "shape": {
+    "n": 65536,
+    "e": 524288,
+    "k": 65537,
+    "max_out": 8,
+    "max_in": 21,
+    "gcd": 1,
+    "max_cost": 65537,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "758208004199587604"
+   },
+   "rows": [
+    "construct.k65537"
+   ],
+   "input_sha256": "1b92d4c2c5a7cb69ce0417cd7162ab29e3f05b63a2dc575fa5d195d6ff1db90d"
+  },
+  "star1m": {
+   "generator": "gen_star1m(): node 0 -> 1,048,576 targets drawn from 131,072 nodes, costs 1..2^20, mt19937(1034)",
+   "shape": {
+    "n": 131072,
+    "e": 1048576,
+    "k": 662682,
+    "max_out": 1048576,
+    "max_in": 27,
+    "gcd": 1,
+    "max_cost": 1048575,
+    "isolated": 41,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "15197849622511790248"
+   },
+   "rows": [
+    "construct.star1m"
+   ],
+   "input_sha256": "a3694088fe43fcdbbdc32b093f4fe67bb3261d3af2d39d8017d22c29f7ddbe3b"
+  },
+  "sparse1m": {
+   "generator": "gen_sparse1m(): 1,048,576 nodes, 4,096 edges with endpoints drawn over the node range, costs 1..31, mt19937(1035)",
+   "shape": {
+    "n": 1048576,
+    "e": 4096,
+    "k": 31,
+    "max_out": 2,
+    "max_in": 2,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 1040409,
+    "src_descents": 2050,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "12990156200638721186"
+   },
+   "rows": [
+    "construct.sparse1m"
+   ],
+   "input_sha256": "5afbaee69477cbf72c55adda097cdca617dd42f7279600226b639010bc52ae80"
+  },
+  "empty1m": {
+   "generator": "gen_empty1m(): 1,048,576 nodes, no edge",
+   "shape": {
+    "n": 1048576,
+    "e": 0,
+    "k": 0,
+    "max_out": 0,
+    "max_in": 0,
+    "gcd": 0,
+    "max_cost": 0,
+    "isolated": 1048576,
+    "src_descents": 0,
+    "key_sorted": true,
+    "key_reversed": true,
+    "digest": "18109181668318218688"
+   },
+   "rows": [
+    "construct.empty1m"
+   ],
+   "input_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+  },
+  "random65k_bprime": {
+   "generator": "gen_random65k_bprime(false): gen_random(65536, 8, 11) with capacities 1 + k, stably sorted by (src, cost, dst)",
+   "shape": {
+    "n": 65536,
+    "e": 524288,
+    "k": 31,
+    "max_out": 8,
+    "max_in": 21,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": true,
+    "key_reversed": false,
+    "digest": "12833760064757678648"
+   },
+   "rows": [
+    "construct.random65k_bprime"
+   ],
+   "input_sha256": "6980bf923ad851f797f2b03bd473d6a21a5d589904321df228dd40d817fd1c44"
+  },
+  "random65k_reversed": {
+   "generator": "gen_random65k_bprime(true): the preceding input reversed",
+   "shape": {
+    "n": 65536,
+    "e": 524288,
+    "k": 31,
+    "max_out": 8,
+    "max_in": 21,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 0,
+    "src_descents": 65535,
+    "key_sorted": false,
+    "key_reversed": true,
+    "digest": "11592727304513109687"
+   },
+   "rows": [
+    "construct.random65k_reversed"
+   ],
+   "input_sha256": "8bffe4a301176138124aa6c98f16f7247d7abf6079eb2807cc61cb13532019b6"
+  },
+  "star1m_smallk": {
+   "generator": "gen_star1m_smallk(false): node 0 -> 1,048,576 targets, costs 1..31, capacity 1 + input position, mt19937(1036)",
+   "shape": {
+    "n": 131072,
+    "e": 1048576,
+    "k": 31,
+    "max_out": 1048576,
+    "max_in": 23,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 46,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "8802474158293546069"
+   },
+   "rows": [
+    "construct.star1m_smallk"
+   ],
+   "input_sha256": "568bb27e12240968d40acba5d3227eac7cb03124c3545c6711a8d470db86f95c"
+  },
+  "instar1m_smallk": {
+   "generator": "gen_star1m_smallk(true): the preceding edges turned around",
+   "shape": {
+    "n": 131072,
+    "e": 1048576,
+    "k": 31,
+    "max_out": 23,
+    "max_in": 1048576,
+    "gcd": 1,
+    "max_cost": 31,
+    "isolated": 46,
+    "src_descents": 524217,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "10839275545656040073"
+   },
+   "rows": [
+    "construct.instar1m_smallk"
+   ],
+   "input_sha256": "3ae01017c142485b2a99be76f5749d11988ed37e09354812677c4776f5c97356"
+  },
+  "wide_fallback16k": {
+   "generator": "gen_wide_fallback16k(): ring + 7 random out-edges, 16,384 nodes, costs 1..2^20, mt19937(1037)",
+   "shape": {
+    "n": 16384,
+    "e": 131072,
+    "k": 123230,
+    "max_out": 8,
+    "max_in": 23,
+    "gcd": 1,
+    "max_cost": 1048557,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "1535512841938229597"
+   },
+   "rows": [
+    "spf.to.wide_fallback16k"
+   ],
+   "input_sha256": "1cbec6cfbcbb07a49b61a609da523cbc68829abe7f9ec9d8c7befb456af22400"
+  },
+  "width65536": {
+   "generator": "gen_width(65534): ring + 7 random out-edges, 16,384 nodes (mt19937(1038)), costs 65,534 + one drawn bit",
+   "shape": {
+    "n": 16384,
+    "e": 131072,
+    "k": 2,
+    "max_out": 8,
+    "max_in": 20,
+    "gcd": 1,
+    "max_cost": 65535,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "6236947617789042840"
+   },
+   "rows": [
+    "spf.to.width65536"
+   ],
+   "input_sha256": "0b7d0ca1b9c5c648a637f7b6f9f8f8c132d0f600e9bba7611c0dc770964e7f1d"
+  },
+  "width65537": {
+   "generator": "gen_width(65535): the width65536 topology, costs 65,535 + the same bit",
+   "shape": {
+    "n": 16384,
+    "e": 131072,
+    "k": 2,
+    "max_out": 8,
+    "max_in": 20,
+    "gcd": 1,
+    "max_cost": 65536,
+    "isolated": 0,
+    "src_descents": 0,
+    "key_sorted": false,
+    "key_reversed": false,
+    "digest": "9851477194174659493"
+   },
+   "rows": [
+    "spf.to.width65537"
+   ],
+   "input_sha256": "71e2e6dad1037a2bd7bcc8460ff82b940286364042e37233145aecacbefc36ab"
+  }
+ },
+ "rows": {
+  "construct.wgrid256": {
+   "input": "wgrid256",
+   "kind": "construct"
+  },
+  "construct.fanout_clos": {
+   "input": "fanout_clos",
+   "kind": "construct"
+  },
+  "construct.random1m_nat": {
+   "input": "random1m_nat",
+   "kind": "construct"
+  },
+  "construct.random1m_scat": {
+   "input": "random1m_scat",
+   "kind": "construct"
+  },
+  "construct.wide65k": {
+   "input": "wide65k",
+   "kind": "construct"
+  },
+  "construct.k65536": {
+   "input": "k65536",
+   "kind": "construct"
+  },
+  "construct.k65537": {
+   "input": "k65537",
+   "kind": "construct"
+  },
+  "construct.star1m": {
+   "input": "star1m",
+   "kind": "construct"
+  },
+  "construct.sparse1m": {
+   "input": "sparse1m",
+   "kind": "construct"
+  },
+  "construct.empty1m": {
+   "input": "empty1m",
+   "kind": "construct"
+  },
+  "construct.random65k_bprime": {
+   "input": "random65k_bprime",
+   "kind": "construct"
+  },
+  "construct.random65k_reversed": {
+   "input": "random65k_reversed",
+   "kind": "construct"
+  },
+  "construct.star1m_smallk": {
+   "input": "star1m_smallk",
+   "kind": "construct"
+  },
+  "construct.instar1m_smallk": {
+   "input": "instar1m_smallk",
+   "kind": "construct"
+  },
+  "spf.to.wgrid256": {
+   "input": "wgrid256",
+   "kind": "search",
+   "direction": "reverse",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 32,
+    "buckets": true
+   }
+  },
+  "spf.to.random1m": {
+   "input": "random1m_scat",
+   "kind": "search",
+   "direction": "reverse",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 32,
+    "buckets": true
+   }
+  },
+  "spf.to.wide_fallback16k": {
+   "input": "wide_fallback16k",
+   "kind": "search",
+   "direction": "reverse",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 1048558,
+    "buckets": false
+   }
+  },
+  "spf.to.width65536": {
+   "input": "width65536",
+   "kind": "search",
+   "direction": "reverse",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 65536,
+    "buckets": true
+   }
+  },
+  "spf.to.width65537": {
+   "input": "width65537",
+   "kind": "search",
+   "direction": "reverse",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 65537,
+    "buckets": false
+   }
+  },
+  "spf.full.random1m": {
+   "input": "random1m_scat",
+   "kind": "search",
+   "direction": "forward",
+   "roots": [
+    1,
+    998,
+    1995,
+    2992,
+    3989,
+    4986,
+    5983,
+    6980
+   ],
+   "roots_rule": "(i * 997 + 1) mod N, i = 0..7",
+   "queue": {
+    "width": 32,
+    "buckets": true
+   }
+  }
+ }
+}
diff --git a/dev/perf/queries/targetset_clos.json b/dev/perf/queries/targetset_clos.json
new file mode 100644
index 0000000..2912b83
--- /dev/null
+++ b/dev/perf/queries/targetset_clos.json
@@ -0,0 +1,65 @@
+{
+ "format": "frozen-queries/1",
+ "row": "spf.to.targetset_clos",
+ "list": "targetset_clos",
+ "input": {
+  "generator": "gen_clos(200, 100, 10)",
+  "num_nodes": 300,
+  "num_edges": 40000,
+  "arrays_sha256": "e40203a3e3584a8e8db6756e6f5d547f51540d14ddb24ee20696bd065d3d38b1",
+  "input_digest": 4484954733111131726
+ },
+ "rule": "destinations = the last 50 leaves (150..199) of the 200-leaf Clos (leaves 0..199, spines 200..299)",
+ "destinations": [
+  150,
+  151,
+  152,
+  153,
+  154,
+  155,
+  156,
+  157,
+  158,
+  159,
+  160,
+  161,
+  162,
+  163,
+  164,
+  165,
+  166,
+  167,
+  168,
+  169,
+  170,
+  171,
+  172,
+  173,
+  174,
+  175,
+  176,
+  177,
+  178,
+  179,
+  180,
+  181,
+  182,
+  183,
+  184,
+  185,
+  186,
+  187,
+  188,
+  189,
+  190,
+  191,
+  192,
+  193,
+  194,
+  195,
+  196,
+  197,
+  198,
+  199
+ ]
+}
diff --git a/dev/perf/spf_queue/PLAN.md b/dev/perf/spf_queue/PLAN.md
deleted file mode 100644
index 1696f0c..0000000
--- a/dev/perf/spf_queue/PLAN.md
+++ /dev/null
@@ -1,581 +0,0 @@
-# CPU optimisation implementation plan
-
-Status: implemented in the working tree (P0–P2 and the P3 fallback review
-below); not yet committed or released.
-Consolidated on 27 September 2026 against NetGraph-Core `fbab119`, revised the
-same day after the [queue-substitution experiment](./), then updated
-with the implementation and its old/new/old measurements. This is the current
-CPU plan, superseding the implementation-order guidance in the two Metal
-research reports. Those reports and their raw measurements remain the historical
-evidence; the earlier BFS/Dial prototypes are now understood as special cases of
-one queue.
-
-## Implementation status (27 September 2026)
-
-What landed, as one change on top of `fbab119`:
-
-- `StrictMultiDiGraph::from_arrays` records `max_cost()` and `cost_gcd()` in
-  its existing cost scan; they follow copies and moves as members.
-- `shortest_paths_core` and `shortest_paths_to_core` share one relaxation loop
-  templated on the queue. `HeapQueue` is the reference binary heap on
-  `(cost, -bottleneck, node)`; `BucketQueue` is the ordered bucket queue
-  (`W = max_cost / gcd + 1` cyclic buckets, 64-bit occupancy bitmap, active
-  bucket kept as a heap on `(-bottleneck, node)`). Dispatch is
-  `W <= 65536`; `SpfQueue::Heap` or `NGRAPH_CORE_SPF_QUEUE=heap` forces the
-  reference route, `Bucket`/`bucket` prefers the bucket queue when eligible.
-- Scratch state is a thread-local workspace per direction with touched-node
-  tracking and a hybrid reset (sparse when fewer than a quarter of the nodes
-  were touched, wholesale otherwise; the same predicate chooses how outputs are
-  materialised). An RAII lease restores the invariant on every exit path,
-  including the reverse search's fanout exceptions. Arrays shrink when a much
-  smaller graph is searched; entry arrays and buckets keep their capacity.
-- Tests: `ShortestPaths.QueueDifferential_Forward` / `_Reverse` (forced heap
-  against forced bucket over ten random graph families, the option matrix,
-  five destinations, twice on the reused workspace; more than 25,000
-  comparisons), `_ComparisonHasTeeth`, `BucketQueueKeepsCapacityOrderedPredecessors`,
-  `WorkspaceIsResetAfterFanoutThrow`, `WorkspaceReuseAcrossGraphSizesAndEmptyGraphs`,
-  `StrictMultiDiGraph.CostSummaryMaxAndGcd`, and a Python test that runs the
-  same script under both `NGRAPH_CORE_SPF_QUEUE` values and unset.
-- Documentation: README environment table and CHANGELOG (Unreleased). No
-  Python API change; `_docs.py` is unchanged.
-
-Gates passed on the final code (logs in [cpu_queue/](./)):
-
-- Old-versus-new bit-gate ([bitgate/](bitgate/)): a C++ program that
-  exercises forward and reverse SPF with fanout, `calc_max_flow` in every
-  placement mode, `batch_max_flow`, `sensitivity_analysis`, `FlowPolicy`
-  place/rebalance/remove sequences and KSP through the public API, built once
-  against the `fbab119` sources and once against the working tree. 6,226
-  output lines, identical SHA-256, also with the new build forced onto the heap.
-- `bash .superset/workspace.sh check`: lint, types, 177 C++ tests, 466 Python
-  tests. `make sanitize-test`: 177 C++ tests under ASan/UBSan.
-- NetGraph `dev/check_core_integration.sh` against this worktree: a wheel built
-  in a fresh environment, 1,278 NetGraph tests passed.
-- The research harness, rebuilt against the new production sources, still
-  matches its copies of the old loop across 1,351,168 comparisons on both
-  routes.
-
-One finding from the first old/new/old pass that the earlier experiment could
-not show: the new code's *heap* route (the fallback for `W > 65536`) was 8–15%
-slower than the old heap. Two causes were fixed: the scratch arrays were reached
-through the thread-local struct, so their base pointers were reloaded around
-every store (now hoisted to raw pointers for the search), and the heap
-comparator was a static function that decays to a function pointer inside
-`std::push_heap`/`pop_heap` (now a functor, as the old lambda was). The
-measured tables below are from the final code.
-
-A second finding concerns measurement, not Core: NetGraph's failure Monte Carlo
-results differ between processes of the *same* build unless `PYTHONHASHSEED`
-is fixed (set-iteration order), so the NetGraph driver pins it; with the seed
-fixed, old and new digests agree ([hashseed-determinism.txt](results/netgraph/hashseed-determinism.txt)).
-
-## Independent review (2 October 2026)
-
-An independent reviewer (the `gpt-6-astra` model through the `codex` CLI, brief
-and full report in [cpu_queue/review-astra/](review-2026-10/)) was
-asked whether all easily achievable, reasonable optimisations had been
-considered and verified. Its verdict: the algorithm choice is sound and the
-weighted-graph and small-query gains reproduce independently, but several
-small changes were missed, one exception path was wrong, and the retained
-memory statement was false. Each finding was re-verified here before adoption
-(harness parity on both routes, the old-versus-new bit-gate, the repository
-gates and a fresh old/new/old sequence; tables below are from the final code).
-
-Adopted:
-
-- **Exception safety (reviewer finding 1, reproduced).** The source or target
-  node's distance was written before its `touched.push_back`; a throwing
-  allocation there left an unrecorded modification that the next same-sized
-  search would see. Nodes are now recorded before their entries are written,
-  and `WorkspaceLease` documents that rule.
-- **Skip settled neighbours before scanning their parallel edges (finding
-  3).** A settled node cannot be improved with non-negative costs and no longer
-  accepts equal-cost or capacity-tie updates, so its group is skipped before
-  any edge or bottleneck is examined. Dense unit fabrics, which the earlier
-  passes recorded as neutral, now gain about 1.3x.
-- **One-pass predecessor output (finding 4).** Implemented as a live per-node
-  count maintained by the search (exact sizing, no over-reservation) rather
-  than the reviewer's reserve-and-append variant; the second list walk is gone.
-- **Inline single-item frontier (finding 5).** A frontier of one node is held
-  inline and promoted into the buckets on the next push; chain graphs improve
-  from about 2.1x slower to about 1.6x slower than the old heap.
-- **Retention bound (finding 6, counterexample reproduced).** Bucket item
-  storage accumulated the high-water marks of every bucket ever used. The queue
-  now drops its item storage when it exceeds four times the last search's peak
-  frontier plus 4,096 items, the growable buffers are released whenever the
-  node arrays shrink, and the code comment and this plan describe the actual
-  policy instead of "at most the largest graph".
-- **Bitmap bookkeeping (finding 8).** `begin`/`end` touched every occupancy
-  word (O(W/64) per search, measurable for tiny searches at large `W`); the
-  words set during a search are now listed and only those are cleared.
-- **Fixed-routing callers (finding 2).** `calc_max_flow` and
-  `FlowState::place_max_flow` with `require_capacity=false` recomputed an
-  identical cost-only search on every tier; the result is now computed once per
-  invocation. Outputs are bit-identical (bit-gate).
-- **Two redundant copies (findings 10 and 13).** `get_path_bundle` moves its
-  DAG into the returned pair, and the `spf`/`spf_to` bindings move the DAG into
-  the Python tuple instead of copying it.
-- **Measurement corrections.** Reverse-search rows are now part of the Core
-  sequence (P2's gate was previously marked done without them); the unit-cost
-  rows are described as "no demonstrated regression" rather than "within
-  drift"; the heap-route delta is recorded as unexplained (the reviewer's
-  ablations of touched tracking, item layout and front-copy pop all showed no
-  gain); and the earlier claim that a distance-only API would remove the O(N)
-  output floor was wrong, since a distance vector still has N entries.
-
-Recorded as follow-ups, not done:
-
-- A narrower internal result for callers that only inspect `dist[dst]` or the
-  DAG (max-flow, FlowPolicy, KSP spur searches), which is the only lever left
-  for tiny searches on large graphs (finding 9).
-- KSP's per-spur O(N+E) mask allocations and copies (finding 11), and
-  `place_on_dag`'s quadratic parent grouping on wide ECMP DAGs (finding 14),
-  both outside the search.
-- `W_max` on a second platform, a two-level occupancy summary for very wide
-  ranges, and the reviewer's boundary rows (at `W` = 65,535–65,536 full
-  searches still gain about 1.4x while first-neighbour queries pay 9–17%
-  against the new heap route), which argue against raising the limit from the
-  full-search sweep alone (finding 8).
-- A zero-copy int64 distance result in the bindings (finding 13), and the
-  stale `has_min_flow` memo-key discriminator in `FlowPolicy` (finding 10).
-- Refuted by the reviewer: a gcd early-out in graph construction (finding 12).
-
-### Measured against the previous production build
-
-Both sequences ran one fresh process per phase in the order old (A1), new,
-new forced onto the heap route, old (A2), on the final code (after the
-independent review). The old build is the `fbab119` sources; the harness
-binaries and the NetGraph extension modules are hashed in each
-`environment.txt`. Load averages were 3.8–5.9 during both sequences because
-other sessions were active; the desktop was not isolated, so differences under
-about 5% are within run-to-run noise here. Earlier sequences on the
-pre-review code are kept in the same directories' history
-(the reviewer's own runs).
-
-Core level ([results-core](results/core/), harness `ref` = the
-production function of each build, sequential, nine samples, medians in ms):
-
-| Workload: case / nodes / edges / queries / destination | W | Old A1 / A2 | New | New, forced heap | Old / new |
-|---|---:|---:|---:|---:|---:|
-| random / 1,024 / 8,192 / 1 / none | 32 | 0.107 / 0.102 | 0.067 | 0.089 | 1.52–1.60 |
-| random / 4,096 / 32,768 / 256 / none | 32 | 211.6 / 207.6 | 132.6 | 221.3 | 1.57–1.60 |
-| random / 16,384 / 131,072 / 64 / none | 32 | 254.4 / 250.6 | 150.9 | 266.1 | 1.66–1.69 |
-| random / 65,536 / 524,288 / 1 / none | 32 | 21.21 / 19.03 | 11.51 | 23.14 | 1.65–1.84 |
-| random, degree 32 / 4,096 / 131,072 / 64 / none | 32 | 112.0 / 110.6 | 77.1 | 115.4 | 1.43–1.45 |
-| random, masked / 16,384 / 131,072 / 64 / none | 32 | 230.0 / 229.2 | 140.9 | 236.7 | 1.63 |
-| random / 262,144 / 2,097,152 / 1 / none | 32 | 136.6 / 133.8 | 96.2 | 130.3 | 1.39–1.42 |
-| random / 1,024 / 8,192 / 64 / farthest | 32 | 10.81 / 10.65 | 7.09 | 11.21 | 1.50–1.52 |
-| random / 16,384 / 131,072 / 64 / farthest | 32 | 251.6 / 250.5 | 149.8 | 264.0 | 1.67–1.68 |
-| random / 65,536 / 524,288 / 16 / farthest | 32 | 324.3 / 330.2 | 201.2 | 336.0 | 1.61–1.64 |
-| uniform cost 31 / 16,384 / 131,072 / 64 / none | 2 | 181.4 / 177.1 | 146.3 | 178.6 | 1.21–1.24 |
-| unit grid / 10,000 / 39,600 / 1 / none | 2 | 0.614 / 0.618 | 0.459 | 0.635 | 1.34–1.35 |
-| unit fabric / 800 / 320,000 / 64 / none | 2 | 143.9 / 144.3 | 110.2 | 111.1 | 1.31 |
-| pseudo src/sink fabric / 802 / 320,200 / 64 / fixed pair | 2 | 143.4 / 143.9 | 108.0 | 110.3 | 1.33 |
-| chain / 2,048 / 2,047 / 1 / none | 32 | 0.021 / 0.021 | 0.027 | 0.029 | 0.77–0.78 |
-| random / 1,024 / 8,192 / 64 / first neighbour | 32 | 0.116 / 0.115 | 0.043 | 0.038 | 2.70–2.72 |
-| random / 16,384 / 131,072 / 64 / first neighbour | 32 | 1.160 / 1.158 | 0.402 | 0.392 | 2.88 |
-| random / 65,536 / 524,288 / 64 / first neighbour | 32 | 4.351 / 4.254 | 1.506 | 1.517 | 2.83–2.89 |
-| random / 262,144 / 2,097,152 / 16 / first neighbour | 32 | 4.509 / 4.053 | 1.491 | 1.471 | 2.72–3.02 |
-| reverse: random / 4,096 / 32,768 / 64 | 32 | 55.85 / 55.34 | 34.23 | 58.82 | 1.62–1.63 |
-| reverse: random / 16,384 / 131,072 / 16 | 32 | 66.55 / 66.34 | 38.67 | 69.33 | 1.72 |
-| reverse: unit fabric / 800 / 320,000 / 16 | 2 | 45.43 / 45.72 | 37.15 | 36.90 | 1.22–1.23 |
-| reverse: chain / 2,048 / 2,047 / 1 | 32 | 0.002 / 0.003 | 0.001 | 0.001 | 2.57–2.61 |
-
-Cost-range sweep (random 16,384 / 131,072, 16 full-source queries, costs in
-`1..K`), same sequence:
-
-| K | W | Old A1 / A2 | New | New, forced heap | Old / new |
-|---:|---:|---:|---:|---:|---:|
-| 1 | 2 | 44.4 / 45.3 | 36.5 | 44.9 | 1.22–1.24 |
-| 31 | 32 | 64.5 / 62.6 | 37.2 | 65.9 | 1.68–1.73 |
-| 1,023 | 1,024 | 59.2 / 58.9 | 35.3 | 64.5 | 1.67–1.68 |
-| 32,767 | 32,768 | 51.3 / 51.2 | 42.7 | 53.3 | 1.20 |
-| 1,048,575 | heap fallback | 49.7 / 49.5 | 52.8 | 51.6 | 0.94 |
-| 33,554,431 | heap fallback | 51.0 / 49.6 | 51.2 | 52.8 | 0.97–1.00 |
-
-NetGraph level ([results-netgraph](results/netgraph/),
-[bench_netgraph.py](bench_netgraph.py) run by NetGraph's interpreter
-against each build with `PYTHONHASHSEED=0`, five samples, medians in ms, every
-workload's result digest identical across all four phases):
-
-| Workload | Old A1 / A2 | New | New, forced heap | Old / new |
-|---|---:|---:|---:|---:|
-| full-source `spf`, 2-tier Clos 200×200 (400 sources) | 214.2 / 212.7 | 163.4 | 164.6 | 1.30–1.31 |
-| full-source `spf`, weighted grid 100×100 (50 sources) | 220.8 / 220.3 | 181.7 | 245.4 | 1.21–1.22 |
-| bound-context `max_flow`, Clos 200×200, combine, ×50 | 52.6 / 51.9 | 47.1 | 46.8 | 1.10–1.12 |
-| `max_flow` with 100 link-exclusion sets, Clos 100×100 | 44.3 / 43.0 | 40.4 | 39.3 | 1.06–1.10 |
-| bound-context `max_flow`, weighted grid, combine, ×20 | 202.9 / 202.1 | 174.6 | 219.1 | 1.16 |
-| `max_flow`, weighted grid, pairwise corners, ×5 | 204.0 / 200.6 | 208.2 | 212.9 | 0.96–0.98 |
-| demand placement, backbone_clos matrix, ×50 | 69.2 / 67.4 | 69.0 | 68.7 | 0.98–1.00 |
-| placement Monte Carlo, backbone_clos, 300 iterations | 74.5 / 75.3 | 67.8 | 71.4 | 1.10–1.11 |
-| max-flow Monte Carlo, backbone_clos, 300 iterations | 29.3 / 29.1 | 27.6 | 29.0 | 1.06 |
-| KSP k=8, 3-tier Clos, 56 leaf pairs | 54.7 / 53.4 | 46.3 | 46.2 | 1.15–1.18 |
-| `max_flow`, 3-tier Clos, 56 pod pairs, combine | 167.5 / 166.1 | 168.2 | 171.8 | 0.99–1.00 |
-| placement, 3-tier Clos, 64 WCMP + 8 ECMP demands | 366.4 / 363.3 | 376.3 | 368.9 | 0.97 |
-| placement with 20 link-failure sets, 3-tier Clos | 7,646 / 7,548 | 7,640 | 7,571 | 0.99–1.00 |
-| scenario square_mesh.yaml, 100 iterations, serial | 10.3 / 10.3 | 9.9 | 9.9 | 1.04 |
-| scenario nsfnet.yaml, 200 iterations, serial | 958.2 / 939.1 | 929.6 | 912.2 | 1.01–1.03 |
-| scenario backbone_clos.yml, 100 iterations, serial | 82.3 / 81.1 | 78.3 | 77.6 | 1.04–1.05 |
-
-Reading of the two sequences:
-
-- **Weighted graphs** (`W` between 32 and 32,768) gain 1.4–1.8x at the Core
-  level, forward and reverse, and 1.16–1.22x end to end on the weighted grid
-  workloads in NetGraph, where graph preparation, Python and placement share
-  the time.
-- **Unit-cost fabrics** (`W = 2`), the class NetGraph's Clos scenarios and
-  pseudo source/sink max-flow graphs belong to, now gain 1.2–1.35x at the Core
-  level (settled-neighbour skip and one-pass output, adopted from the review)
-  and 1.06–1.3x through NetGraph's SPF, max-flow, KSP and Monte Carlo paths.
-  The wide-ECMP placement rows (0.97–1.00) are not a demonstrated regression:
-  they lie inside the run-to-run band and are dominated by placement, whose
-  quadratic parent grouping is a recorded follow-up.
-- **Small destination-limited searches** gain 2.7–3.0x from the workspace
-  regardless of the queue (the forced-heap column matches the bucket column).
-- **Fallback class** (`W > 65,536`): the two fallback rows are 0.94 and
-  0.97–1.00 of the old heap; the forced-heap column on eligible graphs is
-  0.82–0.97, which is the same unexplained route penalty. The reviewer's
-  ablations (touched tracking, item layout, front-copy pop) showed no gain,
-  so its cause remains open; it is recorded, not rationalised.
-- **Chain graphs** are now 0.77x (about +6 µs on a 21 µs query) on the bucket
-  route after the inline single-item frontier, from 0.47x before.
-- **Correctness**: every NetGraph workload digest was identical across old,
-  new and the forced heap; the Core parity, differential tests and the
-  old-versus-new bit-gate remain the semantic evidence, since these digests
-  only summarise distances and parent counts.
-
-## What the experiment established (27 September 2026)
-
-Harness: [cpu_queue/](./) is plain C++ (no Objective-C++ or Metal) and
-compiles the production `shortest_paths.cpp` beside a copy of its forward loop
-with the queue and workspace injected ([spf_variants.hpp](spf_variants.hpp),
-[harness.cpp](harness.cpp)). Results are in
-[cpu_queue/results](results/first/) and [cpu_queue/results-short](results/short/);
-the earlier research results are untouched.
-
-**Parity.** 1,351,168 comparisons against the production `shortest_paths`,
-bit-exact on distances, `parent_offsets`, `parents` and `via_edges`, over: twelve
-masked random seeds, six graphs with zero-cost cycles, int64-offset costs (which
-exercise the heap fallback), a unit grid, uniform cost 31, costs to 100,000, a
-fabric with NetGraph-style zero-cost pseudo source/sink attachments, a chain, a
-dense fabric and a 12-node multigraph with self-loops, parallel edges and
-residuals at multiples of `kMinCap`; times `{multipath, single-path}` ×
-`{multi-edge, single-edge}` × `{Deterministic, PreferHigherResidual}` ×
-`{require_capacity}` × `{residual}` × `{masks}` × destinations `{none, first
-neighbour, farthest, self, arbitrary}`, each run twice on a reused workspace.
-Zero mismatches for every queue/workspace variant. The checker has teeth:
-dropping the bottleneck key from the bucket comparator produces 167,636
-mismatches. ASan/UBSan runs of the same matrix are clean
-([plain](results/first/correctness.txt),
-[sanitized](results/first/correctness-sanitized.txt),
-[teeth](results/first/correctness-teeth.txt)).
-
-**Timing.** Sequential, single thread, one process per variant, production
-reference first and last (A1/A2), nine samples after two checked warmups,
-medians in milliseconds for the whole query set, every timed result verified
-against the reference outside the timed interval. `bucket` is the ordered bucket
-queue; `fresh` allocates scratch per query as production does; `sparse` reuses a
-workspace and resets only touched nodes; `hybrid` picks full or sparse reset
-from the touched count after the search. Load average was 2.9–4.1 on 14 cores
-throughout; the desktop was not isolated.
-
-| Workload: case / nodes / edges / queries / destination | W | Production A1 / A2 | bucket, fresh | bucket, sparse | bucket, hybrid |
-|---|---:|---:|---:|---:|---:|
-| random / 1,024 / 8,192 / 1 / none | 32 | 0.101 / 0.104 | 0.078 | 0.069 | — |
-| random / 4,096 / 32,768 / 256 / none | 32 | 198.7 / 205.8 | 117.7 | 122.1 | — |
-| random / 16,384 / 131,072 / 64 / none | 32 | 238.8 / 245.6 | 133.4 | 140.3 | 142.5 † |
-| random / 65,536 / 524,288 / 1 / none | 32 | 18.38 / 19.63 | 10.96 | 10.68 | 10.80 † |
-| random, degree 32 / 4,096 / 131,072 / 64 / none | 32 | 106.7 / 109.0 | 64.1 | 65.8 | — |
-| random, masked / 16,384 / 131,072 / 64 / none | 32 | 219.5 / 225.3 | 130.6 | 138.4 | — |
-| random / 262,144 / 2,097,152 / 1 / none | 32 | 119.7 / 125.2 | 83.6 | 87.0 | 84.5 † |
-| random / 1,024 / 8,192 / 64 / farthest | 32 | 10.13 / 10.43 | 6.26 | 6.55 | — |
-| random / 16,384 / 131,072 / 64 / farthest | 32 | 240.0 / 246.3 | 134.8 | 140.8 | — |
-| random / 65,536 / 524,288 / 16 / farthest | 32 | 289.4 / 299.9 | 162.7 | 176.1 | — |
-| uniform cost 31 / 16,384 / 131,072 / 64 / none | 2 | 170.3 / 175.4 | 142.4 | 140.7 | — |
-| unit grid / 10,000 / 39,600 / 1 / none | 2 | 0.614 / 0.622 | 0.466 | 0.497 | — |
-| unit fabric / 800 / 320,000 / 64 / none | 2 | 142.1 / 143.6 | 126.1 | 127.9 | 142.1 † |
-| pseudo src/sink fabric / 802 / 320,200 / 64 / fixed pair | 2 | 140.6 / 142.2 | 125.5 | 127.2 | — |
-| chain / 2,048 / 2,047 / 1 / none | 32 | 0.021 / 0.021 | 0.045 | 0.045 | 0.041 † |
-| random / 1,024 / 8,192 / 64 / first neighbour | 32 | 0.105 / 0.120 | 0.111 | 0.043 | — |
-| random / 16,384 / 131,072 / 64 / first neighbour | 32 | 1.044 / 1.171 | 1.190 | 0.393 | 0.390 † |
-| random / 65,536 / 524,288 / 64 / first neighbour | 32 | 4.034 / 4.207 | 4.332 | 1.489 | 1.484 † |
-| random / 262,144 / 2,097,152 / 16 / first neighbour | 32 | 3.872 / 3.997 | 4.090 | 1.449 | 1.442 † |
-
-† from the [second, shorter sequence](results/short/), whose own
-production A1/A2 were 240.6 / 245.4, 18.51 / 18.77, 137.8 / 141.6, 0.021 / 0.023,
-1.047 / 1.104, 4.206 / 4.305, 3.913 / 19.193 and 119.5 / 124.2 for the rows marked.
-
-Cost-range sweep, random 16,384 nodes / 131,072 edges, 16 full-source queries,
-costs uniform in `1..K` ([sweep files](results/first/)):
-
-| K | W | Production | bucket, sparse | Ratio |
-|---:|---:|---:|---:|---:|
-| 1 | 2 | 43.7 | 35.2 | 1.24 |
-| 31 | 32 | 62.1 | 35.8 | 1.74 |
-| 1,023 | 1,024 | 58.2 | 34.1 | 1.71 |
-| 32,767 | 32,768 | 50.0 | 35.0 | 1.43 |
-| 1,048,575 | 1,048,576 | 48.6 | 46.8 | 1.04 |
-| 33,554,431 | fallback | 48.9 | 56.5 (harness heap) | — |
-
-Interpretation to carry into implementation:
-
-- **Weighted graphs, `W` ≤ 32,768: 1.4–1.8x** over the production heap under
-  the full contract, sequentially, whether the query is full-source, farthest
-  destination or masked. Production A1/A2 drift was 2–7% on these rows (up to
-  14% on sub-millisecond rows), so these clear the decision gate on this
-  machine. The 1,024-node single query improves 1.3–1.5x.
-- **Uniform-cost graphs: 1.1–1.3x, and inconclusive on the dense fabric.** With
-  `W = 2` the queue is a small share of the work; edge scanning dominates the
-  800-node fabric with 320,000 edges (0.97–1.13x across the two sequences). The
-  unit grid improves 1.32x, uniform cost 31 improves 1.2x.
-- **Destination-limited queries that touch few nodes are bounded by O(N)
-  per-query overhead, not by the queue.** Production spends about 1.6 µs at
-  1,024 nodes, 16 µs at 16,384, 63 µs at 65,536 and 242 µs at 262,144 per
-  first-neighbour query; the queue variant alone does not change this. Reusing
-  the workspace with a full reset changes nothing (consistent with the earlier
-  thread-local measurement recorded in the perf notes), while resetting only
-  touched nodes removes about 60% (2.4–3.0x). The remaining floor is the
-  N-sized `dist` and `parent_offsets` outputs that the API returns.
-- **Hybrid reset is the right default:** it matches sparse on small queries and
-  full reset on full-graph queries, where sparse tracking costs 3–5%.
-- **Chain graphs regress 1.7–2.1x (+15–24 µs on a 21 µs query)** in this
-  pre-implementation experiment (later reduced to 1.3x by the inline
-  single-item frontier adopted from the review). Every pop
-  advances the active bucket, so the per-pop bookkeeping (occupancy bitmap,
-  heap rebuild of a one-element bucket) exceeds a one-element binary heap.
-  Replacing the modulo by a power-of-two mask did not remove it. This is the
-  smallest absolute regression in the matrix and no production caller runs on
-  a path graph, but it is repeatable and must be recorded, not hidden.
-- **Sorting each bucket once instead of heaping it is slower** on weighted
-  graphs (up to 8%) and equal on uniform graphs, except the unit grid (0.393 vs
-  0.466). It is not worth a second queue.
-- **The harness's own heap copy runs 7–14% slower than production** on the
-  random workloads. The cause is not isolated (candidates: the touched-node
-  branch per relaxation, runtime mode checks, scratch arrays reached through a
-  struct instead of locals). Production work must therefore be measured against
-  production, not against the harness heap, and P1 must check that its
-  workspace integration does not carry this penalty. The bucket gain is far
-  larger than the penalty.
-- **Decomposition of the earlier prototype gain.** The research Dial package
-  reached 3.6x over native on the 16k/64 batch with ten workers and a relaxed
-  contract (no capacity ordering, canonical incoming-CSR DAG, cached eligibility
-  bitmap). The contract-preserving queue alone gives 1.8x sequentially. Roughly
-  half of the prototype's advantage came from dropping the contract and is not
-  available to production; the other half is.
-- **One unattributed transient.** In two of twelve fresh-allocation phases the
-  262,144-node first-neighbour set took 19 ms instead of 4 ms (once in the
-  harness heap copy, once in the production reference A2); none of fourteen
-  reused-workspace phases did. A page-fault probe in a fresh process showed
-  neither faults nor slowness. It is recorded as environmental variance, not as
-  a property of either implementation.
-- Timings are sequential and cover synthetic graphs; ten-worker batch timings
-  from the research are not comparable row for row. No end-to-end flow
-  improvement is measured yet.
-
-## What the first consolidation overlooked
-
-1. **Every production caller is destination-limited.** `calc_max_flow`,
-   `FlowState::place_max_flow`, `FlowPolicy::get_path_bundle` and the KSP spur
-   searches all pass `dst`; only NetGraph's cost/DAG-cache paths call `spf`
-   without one. The earlier dispatch table sent destination-limited searches
-   to the existing implementation, which would have excluded the callers that
-   dominate placement time. Early-exit parity is now verified, so
-   destination-limited queries are in scope from the first enablement.
-2. **Zero-cost edges are the normal case downstream.** NetGraph attaches pseudo
-   source/sink nodes with cost-0 augmentation edges, so "any zero-cost graph
-   stays on the heap" would have excluded every max-flow analysis. Zero-cost
-   pushes land in the active bucket's heap and are verified against the native
-   settled-node acyclicity rule; the dispatch condition is only `W`.
-3. **The dominant fixed cost of small queries is O(N) scratch initialisation**,
-   which no queue change touches; touched-node reset addresses it and was not
-   in the previous plan (which specified a complete reset).
-4. **Uniform non-unit costs** are covered by the gcd stride rather than by a
-   separate BFS; they were previously flagged as untested.
-5. **Reverse SPF** (`shortest_paths_to_core`) has the same queue and takes the
-   same substitution mechanically; it is not yet measured. KSP's private
-   `dijkstra_single` is a cost-only search on a different key and is out of
-   scope for the first change.
-6. **Ordered parity is not an open research question**; it follows from queue
-   monotonicity. The plan no longer needs "investigate per-layer ordering" or
-   "a LIFO vector is not sufficient" as open items.
-
-## Contract and fallback rules
-
-Keep `Cost=int64_t`, `Cap=double`, the unreachable sentinel and graph cost-sum
-bound. Preserve validation, empty graphs, invalid/blocked endpoints, masks,
-reverse DAG orientation, parallel-edge IDs, multipath selection, single-path
-capacity ties, destination early exit and `fanout_edges` behaviour. The queue
-key stays `(distance, -bottleneck_capacity, node_id)` with the existing
-`kEpsilon` stale-entry and re-push semantics; boolean eligibility cannot replace
-the capacity values used for ordering. SPF excludes `rem < kMinCap` when
-capacity gating applies; a supplied residual forces that gate.
-
-Dispatch is a graph property, decided before the search starts:
-
-| Condition | Route |
-|---|---|
-| `W = max_cost / gcd + 1 ≤ W_max` (any mix of zero and positive costs, any selection mode, any destination, forward or reverse once P2 lands) | Ordered bucket queue |
-| `W > W_max` (wide or int64-offset costs) | Existing heap |
-| Forced reference (tests, benchmarks) | Existing heap |
-
-`W_max` starts at 65,536 (2^16): the sweep shows 1.4x at `W = 32,768` and
-break-even near `W = 2^20`. Memory per workspace is `W` empty vector headers
-plus a `W`-bit occupancy bitmap, about 1.6 MB at the limit. Widening the range
-(two-level occupancy summary, or a radix heap whose last level is ordered the
-same way) is later work with its own sweep. The graph-level `max_cost` is an
-upper bound for every masked query, so no per-query rescan is needed; a
-masked-out wide edge merely wastes empty buckets.
-
-## Implementation sequence
-
-### P0 — Parity oracle and forced route (done)
-
-The harness is the parity oracle. Before production work, add the equivalent
-differential test to [tests/cpp](../../../tests/cpp/shortest_paths_tests.cpp):
-the forced-heap route against the dispatched route over random graphs, the
-option matrix and the destination set above, bit-exact on all four output
-arrays, plus a guard test proving the comparison rejects a wrong ordering.
-Forcing must be reachable from tests and benchmarks without a public API
-(an internal function parameter or a build/env switch used only there).
-
-Keep the measured originals and hashes intact; write new results to new
-directories. Dynamic profiling of NetGraph callers (full versus
-destination-limited counts, touched fraction, weight range) remains useful for
-the downstream gate but no longer blocks the first enablement, because both
-call classes are covered.
-
-**Exit:** differential test with teeth in the C++ suite; forced route available.
-
-### P1 — Queue and workspace in the forward search (done)
-
-Work in [shortest_paths.cpp](../../../src/shortest_paths.cpp) and
-[strict_multidigraph.cpp](../../../src/strict_multidigraph.cpp):
-
-- Record `max_cost` and the cost gcd in `from_arrays`'s existing cost scan as
-  members, so they follow copies and moves; no process-global cache keyed by a
-  graph address.
-- Replace the priority queue in `shortest_paths_core` with the ordered bucket
-  queue when `W ≤ W_max`; keep the heap code path intact for the fallback and
-  the forced route. Keep the relaxation loop shared between routes (one loop,
-  two queue types), as the harness does, so parity is structural.
-- Give the search a reusable workspace (distances, bottlenecks, predecessor
-  heads/tails, settled flags, entry arrays, queue buckets) with touched-node
-  tracking and the hybrid reset. Concurrency: `batch_max_flow` and
-  `sensitivity_analysis` run on `std::async` threads and Python callers release
-  the GIL, so the workspace must be per thread (thread-local) or caller-owned;
-  it must hold no pointer into a graph, residual or mask. Bound retained memory:
-  one workspace per thread sized to the largest graph seen, and state the bound
-  (or add a shrink rule) in the code comment and in `_docs.py` if it is
-  observable. Returned vectors must own their data.
-- Early exit leaves items in buckets; clear only occupied buckets.
-
-**Exit:** the existing positive-cost SPF output hash and the flow output hash
-from the August review are unchanged; the differential test passes; the full
-suite and `make sanitize-test` pass; A/B/A against `main` on the harness
-workloads reproduces the table above within drift, including the recorded
-chain regression; no new implicit threads.
-
-### P2 — Reverse search and KSP (done for the reverse search)
-
-Apply the same substitution to `shortest_paths_to_core` (same key, in-adjacency)
-and measure it with reverse workloads added to the harness. Leave KSP's
-`dijkstra_single` alone unless profiling shows it matters.
-
-**Exit:** parity for reverse results including `fanout_edges`, and a measured
-result either way.
-
-### P3 — Limits, regressions and dispatch review (fallback reviewed; second machine class pending)
-
-Confirm `W_max` on a second machine class (Linux/x86 CI-class hardware), and
-decide the chain-like regime: the inline single-item frontier cut the recorded
-regression to about 6 µs on a 21 µs query; either accept that residual on
-frontier-of-one searches or reduce the per-pop advance cost and re-measure. Do
-not choose the queue per query retrospectively; the rule stays a graph property.
-
-**Exit:** dispatch rule frozen with a held-out workload pass.
-
-### P4 — Downstream validation, then batching and GPU reconsideration (validation done; batching/GPU unchanged)
-
-Run NetGraph's profiles and representative demand/flow runs with the chosen
-Core build, including residual updates, mask changes, cache hit/miss cases,
-all placement modes and path-cost constraints. For max-flow behaviour, check
-feasibility, conservation and optimality/cut certificates with nonuniform
-costs, masks and cost-factor cases; SPF distance agreement alone does not
-satisfy this gate.
-
-Explicit CPU batching stays conditional on demonstrated independent-query
-callers: deterministic result order, bounded worker count, per-worker scratch
-and bounded output memory. Sequential flow augmentations with changing
-residuals cannot be batched as if independent. Any public batch or
-distance-only extension must preserve current defaults and update bindings and
-`_docs.py` together; a distance-only result would also remove the O(N) output
-floor measured above, which is the only remaining lever for tiny queries on
-large graphs. It is not a prerequisite for shipping this change.
-
-Revisit GPU only against the accepted CPU implementation and matching result
-contracts; this plan does not require Metal, GPU frontier queues or automatic
-CPU/GPU selection.
-
-## Acceptance and validation
-
-Correctness gates precede performance claims. Cover forward/reverse results,
-both edge tie-break policies, multipath/single-path, multi-edge/single-edge,
-parallel edges, self-loops, zero-cost cycles, isolated vertices, empty graphs,
-invalid and blocked endpoints, all-masked graphs and malformed spans. Include
-costs above `2^53`, near the constructor's bound, `W` at and just above
-`W_max`, long chains, duplicate/stale queue entries, uniform non-unit weights,
-and capacity values at/around `kMinCap` and the tie epsilon. Mutate masks and
-residual contents in place between calls, including changes that leave
-eligibility unchanged. Verify graph lifetime, workspace reuse across graphs of
-different sizes, concurrent callers, repeated determinism, fanout validation,
-target early exit and capped enumeration.
-
-Relevant existing suites include [C++ SPF](../../../tests/cpp/shortest_paths_tests.cpp),
-[masking](../../../tests/cpp/masking_tests.cpp),
-[Python edge selection](../../../tests/py/test_spf_edge_select.py),
-[path enumeration](../../../tests/py/test_paths_resolve.py),
-[reverse SPF](../../../tests/py/test_spf_to.py),
-[memoisation](../../../tests/py/test_flow_policy_spf_memo.py),
-[thread safety](../../../tests/py/test_thread_safety.py), and
-[lifetime safety](../../../tests/py/test_lifetime_safety.py).
-
-For each change, run correctness-checked old/new/old in fresh processes on one
-quiet machine, same build settings, with builds/tests excluded from the timed
-run. Record raw samples, hashes, workload parameters, load, fallback counts and
-peak memory. Keep warm reused-query timing, first-query timing and
-changing-input end-to-end timing separate. Ship a class only when the new median
-improves beyond both A1/A2 drift and sample variability, with no unrecorded
-regression in its supported classes or reference fallback. A single M4 result
-is insufficient to set `W_max` for every supported platform.
-
-Reproduce the experiment from the repository root:
-
-```sh
-bash dev/perf/spf_queue/build.sh
-build/perf/cpu-queue correctness
-bash dev/perf/spf_queue/run_aba.sh
-python3 dev/perf/spf_queue/summarize.py
-bash dev/perf/spf_queue/build.sh sanitize
-ASAN_OPTIONS=detect_leaks=0 build/perf/cpu-queue-sanitize correctness
-```
-
-For implementation changes, run:
-
-```sh
-bash .superset/workspace.sh setup  # when the worktree environment needs setup
-bash .superset/workspace.sh check  # rebuild extension, lint, types, C++ and Python
-make sanitize-test               # required for C++ changes
-bash /Users/networmix/ws/NetGraph/dev/check_core_integration.sh \
-  /absolute/path/to/the/chosen/NetGraph-Core-worktree
-```
-
-Use the actual worktree's absolute path for downstream verification. Local
-checks do not replace CI. The prior research passed 170 C++ and 465 Python
-tests plus sanitizers; that is baseline evidence, not completion of any
-implementation gate.
-
-**Immediate next step:** review and commit the working-tree change (a
-version bump and CHANGELOG date at release time), then confirm `W_max` on a
-Linux/x86 CI-class machine before treating the chain-graph and wide-cost
-fallback numbers as portable. Batching and GPU work remain later, conditional
-items.
diff --git a/dev/perf/spf_queue/README.md b/dev/perf/spf_queue/README.md
deleted file mode 100644
index 9b1c88d..0000000
--- a/dev/perf/spf_queue/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Ordered bucket queue experiment (CPU only)
-
-Plain C++ harness (no Objective-C++ or Metal) behind the
-[CPU optimisation plan](PLAN.md). It compiles the production
-`src/shortest_paths.cpp` next to a copy of its forward search loop in which only
-the priority queue and the scratch workspace are pluggable, then checks every
-variant bit-exactly against the production function and times them.
-
-- `spf_variants.hpp`: `HeapQueue` (production key), `BucketHeapQueueT` (monotone
-  cyclic buckets, active bucket kept as a heap on `(-bottleneck, node)`; the
-  `<true>` instantiation masks instead of taking a modulo), `BucketSortQueue`
-  (sorted active bucket plus a side heap), `Workspace` (fresh, full reset,
-  sparse reset, hybrid reset) and `spf_variant`, the shared loop.
-- `harness.cpp`: workload generators (the research generator verbatim, plus
-  uniform, wide, zero-cost-cycle and pseudo source/sink cases), the parity
-  matrix, timing and the cost-range sweep. Variant names are
-  `{ref, heap, bucket, bucket2, bsort}-{fresh, full, sparse, hybrid}`.
-- `run_aba.sh`: one fresh process per variant, production reference first and
-  last, plus the sweep. `summarize.py` prints Markdown tables.
-- `results/first/`: the first sequence (nine samples), sweep files, load readings,
-  source hashes and the parity outputs (plain, sanitized and the teeth check
-  built with `-DSPFX_BAD_ORDER`, which must fail). `results/short/`: the second
-  sequence for the hybrid and power-of-two variants.
-
-```sh
-bash dev/perf/spf_queue/build.sh
-build/perf/cpu-queue correctness
-build/perf/cpu-queue time bucket-hybrid 9
-build/perf/cpu-queue sweep bucket-sparse 9 2097152
-bash dev/perf/spf_queue/run_aba.sh
-python3 dev/perf/spf_queue/summarize.py
-```
-
-Timings are sequential and single-threaded; they are not comparable row for row
-with the ten-worker batch timings in the research reports.
-
-## Production verification (after the change landed in `src/shortest_paths.cpp`)
-
-- `bitgate/dump.cpp`: exercises forward/reverse SPF, max-flow, batch max-flow,
-  sensitivity, `FlowPolicy` sequences and KSP through the public C++ API; built
-  once against the previous sources (`git archive` of the base commit) and once
-  against the working tree. `bitgate/sha256.txt` records the identical digests
-  of `old.txt` and `new.txt` (and of the new build forced onto the heap route).
-- `run_core_aba.sh` + `results/core/` (+ `summarize_core.py`): old/new/old on
-  the harness workloads, where `ref` is the production function of the sources
-  each binary was built from (`cpu-queue-old` is built from a `git archive` of
-  the base commit); `b-new-heap` forces the heap route in the new binary as an
-  in-binary control.
-- `bench_netgraph.py` + `run_netgraph_aba.sh` + `results/netgraph/`: old/new/old
-  on NetGraph workloads run through NetGraph's own API and interpreter (full
-  SPF, bound-context max-flow with pseudo nodes, failure exclusions, demand
-  placement with WCMP and ECMP policies, failure Monte Carlo, KSP, and three of
-  the shipped scenarios end to end with `parallelism: 1`). Each workload
-  returns a checksum that must agree across builds; `summarize_netgraph.py`
-  tabulates medians and checks the checksums. The driver pins
-  `PYTHONHASHSEED=0`: NetGraph's Monte Carlo digests otherwise differ between
-  two processes of the same build (`results/netgraph/hashseed-determinism.txt`).
-- `review-2026-10/`: brief, full report, patches, experiment sources and
-  raw results of the independent review (2 October 2026); what was adopted
-  from it is listed in the plan. Its full-source experimental copies, session
-  log and 10 MB bit-gate dumps were not kept (they are reproducible from the
-  patches against the base commit). `bash build.sh old` builds the
-  old-source harness binary from `git archive` of the base commit.
-- Timing modes now include reverse-search rows (`dst` = `reverse`), which are
-  production-only (the harness variants implement the forward loop).
diff --git a/dev/perf/spf_queue/bench_netgraph.py b/dev/perf/spf_queue/bench_netgraph.py
deleted file mode 100644
index 3424d75..0000000
--- a/dev/perf/spf_queue/bench_netgraph.py
+++ /dev/null
@@ -1,393 +0,0 @@
-#!/usr/bin/env python3
-"""Realistic NetGraph workloads for the Core old/new A/B/A.
-
-Run with NetGraph's interpreter and PYTHONPATH pointing at the Core build under
-test (see run_netgraph_aba.sh). Prints CSV rows:
-    workload,label,median_s,samples,checksum,samples_s
-Every workload returns a checksum of its results that must be identical across
-builds; the driver compares them.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import random
-import statistics
-import sys
-import time
-from pathlib import Path
-
-NETGRAPH = Path.home() / "ws" / "NetGraph"
-sys.path.insert(0, str(NETGRAPH))
-
-import numpy as np  # noqa: E402
-from ngraph.analysis import FailureManager  # noqa: E402
-from ngraph.analysis.context import AnalysisContext  # noqa: E402
-from ngraph.analysis.functions import demand_placement_analysis  # noqa: E402
-from ngraph.model.network import Link, Network, Node  # noqa: E402
-from ngraph.scenario import Scenario  # noqa: E402
-from ngraph.types.base import Mode  # noqa: E402
-
-import netgraph_core  # noqa: E402
-
-
-def norm(obj):
-    """JSON-safe, order-stable view of nested results (tuple keys become strings)."""
-    if isinstance(obj, dict):
-        skip = {
-            "metadata",
-            "execution_time",
-            "duration",
-            "timestamp",
-            "started_at",
-            "finished_at",
-            "run_id",
-            "id",
-        }
-        return {
-            str(k): norm(v)
-            for k, v in sorted(obj.items(), key=lambda kv: str(kv[0]))
-            if str(k) not in skip
-        }
-    if isinstance(obj, (list, tuple, set, frozenset)):
-        items = [norm(v) for v in obj]
-        return sorted(items, key=str) if isinstance(obj, (set, frozenset)) else items
-    if isinstance(obj, float):
-        return repr(obj)
-    if isinstance(obj, (str, int, bool)) or obj is None:
-        return obj
-    if hasattr(obj, "to_dict"):
-        return norm(obj.to_dict())
-    return str(obj)
-
-
-def digest(obj) -> str:
-    return hashlib.sha256(json.dumps(norm(obj), sort_keys=True).encode()).hexdigest()[
-        :16
-    ]
-
-
-def clos(leaves: int, spines: int, cap: float = 100.0) -> Network:
-    net = Network()
-    for i in range(leaves):
-        net.add_node(Node(f"leaf/leaf{i:03d}"))
-    for j in range(spines):
-        net.add_node(Node(f"spine/spine{j:03d}"))
-    for i in range(leaves):
-        for j in range(spines):
-            net.add_link(
-                Link(f"leaf/leaf{i:03d}", f"spine/spine{j:03d}", capacity=cap, cost=1.0)
-            )
-    return net
-
-
-def grid(rows: int, cols: int, seed: int = 3) -> Network:
-    rng = random.Random(seed)
-    net = Network()
-    for r in range(rows):
-        for c in range(cols):
-            net.add_node(Node(f"g/r{r:03d}c{c:03d}"))
-    for r in range(rows):
-        for c in range(cols):
-            if c + 1 < cols:
-                net.add_link(
-                    Link(
-                        f"g/r{r:03d}c{c:03d}",
-                        f"g/r{r:03d}c{c + 1:03d}",
-                        capacity=10.0,
-                        cost=float(rng.randint(1, 20)),
-                    )
-                )
-            if r + 1 < rows:
-                net.add_link(
-                    Link(
-                        f"g/r{r:03d}c{c:03d}",
-                        f"g/r{r + 1:03d}c{c:03d}",
-                        capacity=10.0,
-                        cost=float(rng.randint(1, 20)),
-                    )
-                )
-    return net
-
-
-def clos3(pods: int, leaves: int, spines: int, supers: int) -> Network:
-    """Three-tier Clos: per pod a leaf/spine mesh, spines meshed to super-spines."""
-    net = Network()
-    for k in range(supers):
-        net.add_node(Node(f"ss/ss{k:03d}"))
-    for p in range(pods):
-        for i in range(leaves):
-            net.add_node(Node(f"pod{p:02d}/leaf/leaf{i:03d}"))
-        for j in range(spines):
-            net.add_node(Node(f"pod{p:02d}/spine/spine{j:03d}"))
-        for i in range(leaves):
-            for j in range(spines):
-                net.add_link(
-                    Link(
-                        f"pod{p:02d}/leaf/leaf{i:03d}",
-                        f"pod{p:02d}/spine/spine{j:03d}",
-                        capacity=100.0,
-                        cost=1.0,
-                    )
-                )
-        for j in range(spines):
-            for k in range(supers):
-                net.add_link(
-                    Link(
-                        f"pod{p:02d}/spine/spine{j:03d}",
-                        f"ss/ss{k:03d}",
-                        capacity=400.0,
-                        cost=1.0,
-                    )
-                )
-    return net
-
-
-def scenario_text(name: str, iterations: int) -> str:
-    path = NETGRAPH / "scenarios" / name
-    text = path.read_text()
-    text = text.replace("parallelism: auto", "parallelism: 1").replace(
-        "parallelism: 8", "parallelism: 1"
-    )
-    text = text.replace("iterations: 1000", f"iterations: {iterations}")
-    return text
-
-
-def results_digest(scenario: Scenario) -> str:
-    out = {}
-    for step in scenario.results.get_steps_by_execution_order():
-        data = scenario.results.get_step(step)
-        out[step] = {k: v for k, v in data.items() if k not in ("metadata",)}
-    return digest(out)
-
-
-def build_workloads() -> dict[str, tuple[callable, int]]:
-    """Return name -> (fn returning checksum, inner repetitions)."""
-    wl: dict[str, tuple[callable, int]] = {}
-    sel = netgraph_core.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=netgraph_core.EdgeTieBreak.DETERMINISTIC,
-    )
-
-    clos200 = clos(200, 200)
-    ctx_clos200 = AnalysisContext.from_network(clos200)
-    n_clos = ctx_clos200.multidigraph.num_nodes()
-
-    def spf_clos():
-        acc = []
-        for s in range(n_clos):
-            dist, dag = ctx_clos200.algorithms.spf(ctx_clos200.handle, s, selection=sel)
-            acc.append((int(np.asarray(dist).sum()), int(len(dag.parents))))
-        return digest(acc)
-
-    wl["spf_full_clos_200x200"] = (spf_clos, 1)
-
-    grid100 = grid(100, 100)
-    ctx_grid = AnalysisContext.from_network(grid100)
-
-    def spf_grid():
-        acc = []
-        for s in range(0, 10000, 200):
-            dist, dag = ctx_grid.algorithms.spf(ctx_grid.handle, s, selection=sel)
-            d = np.asarray(dist)
-            acc.append((int(d[d < 2**62].sum()), int(len(dag.parents))))
-        return digest(acc)
-
-    wl["spf_full_grid_100x100_weighted"] = (spf_grid, 5)
-
-    ctx_mf_clos = AnalysisContext.from_network(
-        clos200,
-        source="^leaf/leaf00[0-9]$",
-        sink="^leaf/leaf19[0-9]$",
-        mode=Mode.COMBINE,
-    )
-    wl["maxflow_clos_200x200_combine"] = (lambda: digest(ctx_mf_clos.max_flow()), 50)
-
-    clos100 = clos(100, 100)
-    ctx_fail = AnalysisContext.from_network(
-        clos100,
-        source="^leaf/leaf00[0-9]$",
-        sink="^leaf/leaf09[0-9]$",
-        mode=Mode.COMBINE,
-    )
-    link_ids = sorted(clos100.links)
-    rng = random.Random(11)
-    exclusions = [set(rng.sample(link_ids, 12)) for _ in range(100)]
-
-    def maxflow_failures():
-        return digest([ctx_fail.max_flow(excluded_links=ex) for ex in exclusions])
-
-    wl["maxflow_failures_clos_100x100_x100"] = (maxflow_failures, 1)
-
-    ctx_mf_grid = AnalysisContext.from_network(
-        grid100, source="^g/r00[0-9]c000$", sink="^g/r09[0-9]c099$", mode=Mode.COMBINE
-    )
-    wl["maxflow_grid_100x100_weighted_combine"] = (
-        lambda: digest(ctx_mf_grid.max_flow()),
-        20,
-    )
-    wl["maxflow_grid_100x100_weighted_pairwise"] = (
-        lambda: digest(
-            AnalysisContext.from_network(
-                grid100, source="^g/r000c000$", sink="^g/r099c099$", mode=Mode.PAIRWISE
-            ).max_flow()
-        ),
-        5,
-    )
-
-    backbone = Scenario.from_yaml(scenario_text("backbone_clos.yml", 1000))
-    demands = [
-        td.to_dict() for td in backbone.demand_set.get_set("baseline_traffic_matrix")
-    ]
-    wl["placement_backbone_clos"] = (
-        lambda: digest(
-            demand_placement_analysis(backbone.network, set(), set(), demands)
-        ),
-        50,
-    )
-
-    fm = FailureManager(
-        network=backbone.network,
-        failure_policy_set=backbone.failure_policy_set,
-        policy_name="weighted_modes",
-    )
-    wl["placement_mc_backbone_clos_x300"] = (
-        lambda: digest(
-            fm.run_demand_placement_monte_carlo(
-                demands_config=demands, iterations=300, parallelism=1, seed=42
-            )
-        ),
-        1,
-    )
-    wl["maxflow_mc_backbone_clos_x300"] = (
-        lambda: digest(
-            fm.run_max_flow_monte_carlo(
-                source="^metro1/dc1/.*",
-                target="^metro2/dc1/.*",
-                mode="combine",
-                iterations=300,
-                parallelism=1,
-                seed=7,
-            )
-        ),
-        1,
-    )
-
-    fabric = clos3(pods=8, leaves=16, spines=8, supers=16)
-    ctx_fabric = AnalysisContext.from_network(fabric)
-    wl["ksp_clos3_pairwise_k8"] = (
-        lambda: digest(
-            {
-                f"{k[0]}->{k[1]}": [str(p) for p in v]
-                for k, v in ctx_fabric.k_shortest_paths(
-                    "^pod00/leaf/leaf00[0-3]$",
-                    "^pod0[1-7]/leaf/leaf00[0-1]$",
-                    mode=Mode.PAIRWISE,
-                    max_k=8,
-                ).items()
-            }
-        ),
-        1,
-    )
-    wl["maxflow_clos3_pod_pairs_combine"] = (
-        lambda: digest(
-            [
-                AnalysisContext.from_network(
-                    fabric,
-                    source=f"^pod{a:02d}/leaf/.*",
-                    sink=f"^pod{b:02d}/leaf/.*",
-                    mode=Mode.COMBINE,
-                ).max_flow()
-                for a in range(8)
-                for b in range(8)
-                if a != b
-            ]
-        ),
-        1,
-    )
-    fabric_demands = [
-        {
-            "source": f"^pod{a:02d}/leaf/.*",
-            "target": f"^pod{b:02d}/leaf/.*",
-            "mode": "pairwise",
-            "priority": 0,
-            "volume": 2000.0,
-            "flow_policy": policy,
-        }
-        for a in range(8)
-        for b in range(8)
-        if a != b
-        for policy in ("TE_WCMP_UNLIM",)
-    ] + [
-        {
-            "source": f"^pod{a:02d}/leaf/.*",
-            "target": f"^pod{(a + 1) % 8:02d}/leaf/.*",
-            "mode": "pairwise",
-            "priority": 1,
-            "volume": 500.0,
-            "flow_policy": "SHORTEST_PATHS_ECMP",
-        }
-        for a in range(8)
-    ]
-    wl["placement_clos3_wcmp_and_ecmp"] = (
-        lambda: digest(demand_placement_analysis(fabric, set(), set(), fabric_demands)),
-        1,
-    )
-    fabric_links = sorted(fabric.links)
-    rng2 = random.Random(5)
-    fabric_exclusions = [set(rng2.sample(fabric_links, 6)) for _ in range(20)]
-    wl["placement_clos3_failures_x20"] = (
-        lambda: digest(
-            [
-                demand_placement_analysis(fabric, set(), ex, fabric_demands)
-                for ex in fabric_exclusions
-            ]
-        ),
-        1,
-    )
-
-    def run_scenario(name: str, iterations: int):
-        def fn():
-            sc = Scenario.from_yaml(scenario_text(name, iterations))
-            sc.run()
-            return results_digest(sc)
-
-        return fn
-
-    wl["scenario_square_mesh_iter100"] = (run_scenario("square_mesh.yaml", 100), 1)
-    wl["scenario_nsfnet_iter200"] = (run_scenario("nsfnet.yaml", 200), 1)
-    wl["scenario_backbone_clos_iter100"] = (run_scenario("backbone_clos.yml", 100), 1)
-    return wl
-
-
-def main() -> int:
-    label = sys.argv[1] if len(sys.argv) > 1 else "run"
-    samples = int(sys.argv[2]) if len(sys.argv) > 2 else 5
-    only = sys.argv[3].split(",") if len(sys.argv) > 3 else None
-    wl = build_workloads()
-    print("workload,label,median_s,samples,checksum,samples_s", flush=True)
-    for name, (fn, reps) in wl.items():
-        if only and name not in only:
-            continue
-        checksum = fn()  # warm-up and reference checksum
-        times = []
-        for _ in range(samples):
-            t0 = time.perf_counter()
-            for _ in range(reps):
-                c = fn()
-            times.append(time.perf_counter() - t0)
-            if c != checksum:
-                raise SystemExit(
-                    f"nondeterministic result in {name}: {c} != {checksum}"
-                )
-        print(
-            f"{name},{label},{statistics.median(times):.6f},{samples},{checksum},{';'.join(f'{t:.6f}' for t in times)}",
-            flush=True,
-        )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/dev/perf/spf_queue/bitgate/dump.cpp b/dev/perf/spf_queue/bitgate/dump.cpp
deleted file mode 100644
index 1ef7ba4..0000000
--- a/dev/perf/spf_queue/bitgate/dump.cpp
+++ /dev/null
@@ -1,157 +0,0 @@
-// Old-versus-new output bit-gate. Built once against the previous sources and
-// once against the working tree; the SHA-256 of stdout must match. Exercises
-// forward/reverse SPF, max-flow, batch max-flow, sensitivity, FlowPolicy
-// placement sequences and KSP through the public C++ API only.
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/flow_graph.hpp"
-#include "netgraph/core/flow_policy.hpp"
-#include "netgraph/core/k_shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/options.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-
-#include <cstdio>
-#include <memory>
-#include <random>
-#include <vector>
-
-using namespace netgraph::core;
-
-struct Case {
-  StrictMultiDiGraph g;
-  std::unique_ptr<bool[]> nm, em;
-  std::vector<Cap> residual;
-  NodeId src = 0, dst = 1;
-  std::span<const bool> nmask() const { return {nm.get(), size_t(g.num_nodes())}; }
-  std::span<const bool> emask() const { return {em.get(), size_t(g.num_edges())}; }
-};
-
-static Case make(unsigned seed, int n, int degree, Cost max_cost, int zero_pct, bool duplex, bool pseudo) {
-  std::mt19937 rng(seed);
-  std::vector<std::int32_t> s, d; std::vector<Cap> cap; std::vector<Cost> cost;
-  auto add = [&](int u, int v, Cost c, double k) { s.push_back(u); d.push_back(v); cost.push_back(c); cap.push_back(k); };
-  for (int u = 0; u < n; ++u) for (int k = 0; k < degree; ++k) {
-    int v = k == 0 ? (u + 1) % n : int(rng() % n);
-    Cost c = (int(rng() % 100) < zero_pct) ? 0 : 1 + Cost(rng() % unsigned(max_cost));
-    double w = 1.0 + double(rng() % 100) / 7.0;
-    add(u, v, c, w); if (duplex) add(v, u, c, w);
-  }
-  Case c;
-  NodeId src = 0, dst = n / 2;
-  int total = n;
-  if (pseudo) {
-    int k = std::max(1, n / 8);
-    for (int u = 0; u < k; ++u) add(n, u, 0, 1e9);
-    for (int u = n - k; u < n; ++u) add(u, n + 1, 0, 1e9);
-    src = n; dst = n + 1; total = n + 2;
-  }
-  c.g = StrictMultiDiGraph::from_arrays(total, s, d, cap, cost);
-  c.src = src; c.dst = dst;
-  int N = c.g.num_nodes(), E = c.g.num_edges();
-  c.nm = std::make_unique<bool[]>(N); c.em = std::make_unique<bool[]>(E);
-  for (int i = 0; i < N; ++i) c.nm[i] = rng() % 29 != 0 || i == src || i == dst;
-  for (int i = 0; i < E; ++i) c.em[i] = rng() % 13 != 0;
-  c.residual.assign(c.g.capacity_view().begin(), c.g.capacity_view().end());
-  for (int i = 0; i < E; ++i) if (rng() % 11 == 0) c.residual[i] = (rng() % 2) ? 0.0 : kMinCap / 2;
-  return c;
-}
-
-static void dump_res(const std::pair<std::vector<Cost>, PredDAG>& r) {
-  for (auto v : r.first) std::printf("%lld,", (long long)v);
-  std::printf("|");
-  for (auto v : r.second.parent_offsets) std::printf("%d,", v);
-  std::printf("|");
-  for (auto v : r.second.parents) std::printf("%d,", v);
-  std::printf("|");
-  for (auto v : r.second.via_edges) std::printf("%d,", v);
-  std::printf("\n");
-}
-
-static void dump_summary(double total, const FlowSummary& sm) {
-  std::printf("flow %.17g cut:", total);
-  for (auto e : sm.min_cut.edges) std::printf("%d,", e);
-  std::printf(" costs:");
-  for (size_t i = 0; i < sm.costs.size(); ++i) std::printf("%lld=%.17g,", (long long)sm.costs[i], sm.flows[i]);
-  std::printf(" ef:");
-  for (auto f : sm.edge_flows) std::printf("%.17g,", f);
-  std::printf("\n");
-}
-
-int main() {
-  auto be = make_cpu_backend();
-  auto algs = std::make_shared<Algorithms>(be);
-  std::vector<Case> cases;
-  cases.push_back(make(1, 60, 4, 31, 0, true, false));
-  cases.push_back(make(2, 80, 3, 31, 20, true, true));
-  cases.push_back(make(3, 120, 5, 1, 0, true, true));
-  cases.push_back(make(4, 90, 4, 20, 10, false, false));
-  cases.push_back(make(5, 200, 3, 1000, 5, true, true));
-  cases.push_back(make(6, 40, 6, 4, 30, true, false));
-  for (auto& c : cases) {
-    const int n = c.g.num_nodes();
-    std::printf("# case n=%d e=%d\n", n, c.g.num_edges());
-    // Forward and reverse SPF over the option matrix.
-    for (NodeId s : {c.src, NodeId(3), NodeId(n - 1)}) for (int mp = 0; mp < 2; ++mp) for (int me = 0; me < 2; ++me)
-    for (int tb = 0; tb < 2; ++tb) for (int rc = 0; rc < 2; ++rc) for (int ur = 0; ur < 2; ++ur) for (int um = 0; um < 2; ++um) {
-      EdgeSelection sel; sel.multi_edge = me; sel.require_capacity = rc;
-      sel.tie_break = tb ? EdgeTieBreak::PreferHigherResidual : EdgeTieBreak::Deterministic;
-      auto res = ur ? std::span<const Cap>(c.residual) : std::span<const Cap>{};
-      auto nm = um ? c.nmask() : std::span<const bool>{};
-      auto em = um ? c.emask() : std::span<const bool>{};
-      for (std::optional<NodeId> dst : {std::optional<NodeId>{}, std::optional<NodeId>{c.dst}, std::optional<NodeId>{NodeId((s + 1) % n)}})
-        dump_res(shortest_paths(c.g, s, dst, mp, sel, res, nm, em));
-      const auto row = c.g.row_offsets_view(); const auto aei = c.g.adj_edge_index_view();
-      std::vector<EdgeId> fan(aei.begin() + row[c.src], aei.begin() + row[c.src + 1]);
-      dump_res(shortest_paths_to(c.g, s, mp, sel, res, nm, em, {}));
-      if (c.src >= n - 2) dump_res(shortest_paths_to(c.g, c.dst, mp, sel, res, nm, em, fan));   // pseudo source fan-out
-    }
-    // Max-flow matrix.
-    for (int pl = 1; pl <= 3; ++pl) for (int sp = 0; sp < 2; ++sp) for (int rc = 0; rc < 2; ++rc) for (int um = 0; um < 2; ++um) {
-      auto nm = um ? c.nmask() : std::span<const bool>{};
-      auto em = um ? c.emask() : std::span<const bool>{};
-      auto [total, sm] = calc_max_flow(c.g, c.src, c.dst, static_cast<FlowPlacement>(pl), sp, rc, true, true, true, nm, em);
-      dump_summary(total, sm);
-    }
-    auto gh = algs->build_graph(c.g);
-    MaxFlowOptions mo; mo.with_edge_flows = true;
-    std::vector<std::pair<NodeId, NodeId>> pairs;
-    for (int i = 0; i < 12; ++i) pairs.emplace_back(NodeId((i * 7) % n), NodeId((i * 11 + 5) % n));
-    for (auto& sm : algs->batch_max_flow(gh, pairs, mo)) dump_summary(sm.total_flow, sm);
-    for (auto& [e, f] : algs->sensitivity_analysis(gh, c.src, c.dst, mo)) std::printf("sens %d %.17g\n", e, f);
-    // FlowPolicy sequences.
-    for (int pl = 1; pl <= 3; ++pl) for (int mp = 0; mp < 2; ++mp) for (int rc = 0; rc < 2; ++rc) {
-      FlowGraph fg(c.g);
-      ExecutionContext ctx(algs, gh);
-      FlowPolicyConfig cfg;
-      cfg.flow_placement = static_cast<FlowPlacement>(pl);
-      cfg.multipath = mp; cfg.require_capacity = rc;
-      cfg.min_flow_count = mp ? 1 : 4; cfg.max_flow_count = mp ? std::optional<int>{} : std::optional<int>{4};
-      cfg.node_mask = c.nmask(); cfg.edge_mask = c.emask();
-      FlowPolicy pol(ctx, cfg);
-      auto r1 = pol.place_demand(fg, c.src, c.dst, 0, 25.0);
-      auto r2 = pol.place_demand(fg, c.src, c.dst, 0, 40.0);
-      auto r3 = pol.rebalance_demand(fg, c.src, c.dst, 0, 5.0);
-      std::printf("policy %d %d %d: %.17g %.17g %.17g %.17g %.17g %.17g placed=%.17g flows=%zu\n", pl, mp, rc,
-                  r1.first, r1.second, r2.first, r2.second, r3.first, r3.second, pol.placed_demand(), pol.flows().size());
-      std::vector<std::pair<long long, std::pair<long long, double>>> recs;
-      for (auto& kv : pol.flows()) recs.push_back({kv.first.flowId, {(long long)kv.second.cost, kv.second.placed_flow}});
-      std::sort(recs.begin(), recs.end());
-      for (auto& r : recs) std::printf("  flow %lld cost %lld placed %.17g\n", r.first, r.second.first, r.second.second);
-      for (auto f : fg.edge_flow_view()) std::printf("%.17g,", f);
-      std::printf("\n");
-      pol.remove_demand(fg);
-      double left = 0; for (auto f : fg.edge_flow_view()) left += f;
-      std::printf("after remove %.17g\n", left);
-    }
-    // KSP.
-    for (int k : {1, 3, 6}) for (int uq = 0; uq < 2; ++uq) {
-      auto paths = k_shortest_paths(c.g, c.src, c.dst, k, std::optional<double>{1.5}, uq, c.nmask(), c.emask());
-      std::printf("ksp k=%d unique=%d n=%zu\n", k, uq, paths.size());
-      for (auto& p : paths) dump_res(p);
-    }
-  }
-  return 0;
-}
diff --git a/dev/perf/spf_queue/bitgate/sha256.txt b/dev/perf/spf_queue/bitgate/sha256.txt
deleted file mode 100644
index 7ae872f..0000000
--- a/dev/perf/spf_queue/bitgate/sha256.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-a976f254eced152b14991ba2198351ec7983506f3f1e177c289852ec2bcaab90  dev/perf/spf_queue/bitgate/old.txt
-a976f254eced152b14991ba2198351ec7983506f3f1e177c289852ec2bcaab90  dev/perf/spf_queue/bitgate/new.txt
-a976f254eced152b14991ba2198351ec7983506f3f1e177c289852ec2bcaab90  dev/perf/spf_queue/bitgate/new-heap.txt
diff --git a/dev/perf/spf_queue/bitgate/status.txt b/dev/perf/spf_queue/bitgate/status.txt
deleted file mode 100644
index 9228bca..0000000
--- a/dev/perf/spf_queue/bitgate/status.txt
+++ /dev/null
@@ -1 +0,0 @@
-BITGATE IDENTICAL
diff --git a/dev/perf/spf_queue/build.sh b/dev/perf/spf_queue/build.sh
deleted file mode 100755
index 4c06ad5..0000000
--- a/dev/perf/spf_queue/build.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# Plain C++ build of the parity/timing harness (no Objective-C++/Metal; any
-# clang/gcc with C++20).
-#   bash build.sh            -> build/perf/cpu-queue           (working tree sources)
-#   bash build.sh sanitize   -> build/perf/cpu-queue-sanitize  (ASan/UBSan)
-#   bash build.sh old [REV]  -> build/perf/cpu-queue-old       (sources of REV, default fbab119,
-#                               extracted with git archive into build/perf/old-src)
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-mode=${1:-release}
-flags=(-std=c++20 -O3 -funroll-loops -fno-math-errno -fno-trapping-math -Wall -Wextra)
-src=.
-out=build/perf/cpu-queue
-case "$mode" in
-  release) ;;
-  sanitize)
-    flags=(-std=c++20 -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
-    out=build/perf/cpu-queue-sanitize ;;
-  old)
-    rev=${2:-fbab119}
-    src=build/perf/old-src
-    rm -rf "$src" && mkdir -p "$src"
-    git archive "$rev" src include | tar -x -C "$src"
-    out=build/perf/cpu-queue-old ;;
-  *) echo "usage: build.sh [release|sanitize|old [REV]]" >&2; exit 2 ;;
-esac
-mkdir -p build/perf
-${CXX:-clang++} "${flags[@]}" -I"$src/include" \
-  dev/perf/spf_queue/harness.cpp \
-  "$src/src/strict_multidigraph.cpp" "$src/src/shortest_paths.cpp" "$src/src/profiling.cpp" -o "$out"
-echo "built $out"
diff --git a/dev/perf/spf_queue/harness.cpp b/dev/perf/spf_queue/harness.cpp
deleted file mode 100644
index 1e8b869..0000000
--- a/dev/perf/spf_queue/harness.cpp
+++ /dev/null
@@ -1,354 +0,0 @@
-// Portable CPU harness: bit-exact parity of queue/workspace variants against the
-// production shortest_paths, plus sequential single-thread timing.
-//
-//   harness correctness                      -> parity matrix, exit 1 on mismatch
-//   harness time <variant> [samples] [maxW]   -> CSV timing rows on stdout
-//   harness sweep <variant> [samples] [maxW]  -> cost-range sweep rows
-//
-// variant = ref | heap-fresh | heap-full | heap-sparse | bucket-fresh |
-//           bucket-full | bucket-sparse | bsort-sparse | bsort-fresh
-#include "spf_variants.hpp"
-
-#include <chrono>
-#include <cmath>
-#include <cstdio>
-#include <cstring>
-#include <iostream>
-#include <memory>
-#include <random>
-#include <string>
-#include <sys/resource.h>
-
-using namespace netgraph::core;
-using spfx::INF;
-using Result = std::pair<std::vector<Cost>, PredDAG>;
-using Clock = std::chrono::steady_clock;
-
-static double ms(Clock::time_point start) {
-  return std::chrono::duration<double, std::milli>(Clock::now() - start).count();
-}
-
-struct Case {
-  std::string name;
-  StrictMultiDiGraph graph;
-  std::unique_ptr<bool[]> node_mask, edge_mask;
-  std::vector<Cap> residual;
-  NodeId fixed_src = -1, fixed_dst = -1;
-  std::span<const bool> nm() const { return {node_mask.get(), size_t(graph.num_nodes())}; }
-  std::span<const bool> em() const { return {edge_mask.get(), size_t(graph.num_edges())}; }
-};
-
-// Verbatim port of the research generator (same RNG draws), plus new kinds:
-//   uniform  : random topology, every cost == 31
-//   wideK    : random topology, costs 1..K (K via max_cost argument)
-//   pseudo   : 2-tier fabric with a zero-cost pseudo source/sink attachment, as
-//              NetGraph's max-flow builds; fixed src/dst = the pseudo nodes
-//   zerocyc  : random graph with a share of zero-cost edges (zero-cost cycles)
-static Case make_case(std::string kind, int n, int degree = 8, bool masked = false,
-                      bool large = false, unsigned seed = 1729, Cost max_cost = 31) {
-  std::vector<NodeId> src, dst;
-  std::vector<Cost> costs;
-  std::vector<Cap> caps;
-  std::mt19937 rng(seed);
-  auto add = [&](int u, int v, Cost c) {
-    src.push_back(u); dst.push_back(v);
-    costs.push_back(c + (large ? (Cost(1) << 34) : 0));
-    caps.push_back(1.0 + double(rng() % 100) / 7.0);
-  };
-  NodeId fsrc = -1, fdst = -1;
-  if (kind == "chain") {
-    for (int i = 0; i < n - 1; ++i) add(i, i + 1, 1 + rng() % 31);
-  } else if (kind == "grid") {
-    int side = int(std::sqrt(n));
-    if (side * side != n) throw std::runtime_error("grid must be square");
-    for (int u = 0; u < n; ++u) {
-      if (u % side + 1 < side) { add(u, u + 1, 1); add(u + 1, u, 1); }
-      if (u + side < n) { add(u, u + side, 1); add(u + side, u, 1); }
-    }
-  } else if (kind == "fabric" || kind == "clos") {
-    int spines = kind == "clos" ? n / 2 : 32;
-    for (int u = 0; u < n - spines; ++u) for (int v = n - spines; v < n; ++v) {
-      add(u, v, 1); add(v, u, 1);
-    }
-  } else if (kind == "uniform") {
-    for (int u = 0; u < n; ++u) {
-      add(u, (u + 1) % n, 31);
-      for (int k = 1; k < degree; ++k) add(u, rng() % n, 31);
-    }
-  } else if (kind == "wide") {
-    for (int u = 0; u < n; ++u) {
-      add(u, (u + 1) % n, 1 + Cost(rng() % max_cost));
-      for (int k = 1; k < degree; ++k) add(u, rng() % n, 1 + Cost(rng() % max_cost));
-    }
-  } else if (kind == "zerocyc") {
-    for (int u = 0; u < n; ++u) {
-      add(u, (u + 1) % n, rng() % 4 == 0 ? 0 : 1 + rng() % 31);
-      for (int k = 1; k < degree; ++k) add(u, rng() % n, rng() % 4 == 0 ? 0 : 1 + rng() % 31);
-    }
-  } else if (kind == "pseudo") {
-    // n real nodes: leaves [0, n/2), spines [n/2, n); then pseudo src n, pseudo dst n+1.
-    int leaves = n / 2;
-    for (int u = 0; u < leaves; ++u) for (int v = leaves; v < n; ++v) { add(u, v, 1); add(v, u, 1); }
-    int k = std::max(1, leaves / 4);
-    for (int u = 0; u < k; ++u) add(n, u, 0);
-    for (int u = leaves - k; u < leaves; ++u) add(u, n + 1, 0);
-    fsrc = n; fdst = n + 1; n += 2;
-  } else {
-    for (int u = 0; u < n; ++u) {
-      add(u, (u + 1) % n, 1 + rng() % 31);
-      for (int k = 1; k < degree; ++k) add(u, rng() % n, 1 + rng() % 31);
-    }
-  }
-  Case c{kind + (masked ? "_masked" : "") + (large ? "_int64" : ""),
-         StrictMultiDiGraph::from_arrays(n, src, dst, caps, costs)};
-  c.fixed_src = fsrc; c.fixed_dst = fdst;
-  int e = c.graph.num_edges();
-  c.node_mask = std::make_unique<bool[]>(n);
-  c.edge_mask = std::make_unique<bool[]>(e);
-  c.residual.assign(c.graph.capacity_view().begin(), c.graph.capacity_view().end());
-  for (int i = 0; i < n; ++i) c.node_mask[i] = !masked || rng() % 23 != 0;
-  for (int i = 0; i < e; ++i) {
-    c.edge_mask[i] = !masked || rng() % 11 != 0;
-    if (masked && rng() % 13 == 0) c.residual[i] = 0;
-  }
-  if (fsrc >= 0) { c.node_mask[fsrc] = true; c.node_mask[fdst] = true; }
-  return c;
-}
-
-struct Query {
-  NodeId src; std::optional<NodeId> dst; bool multipath; EdgeSelection sel;
-  bool use_residual; bool use_masks; bool reverse = false;
-};
-
-static Result run_ref(const Case& c, const Query& q) {
-  auto res = q.use_residual ? std::span<const Cap>(c.residual) : std::span<const Cap>{};
-  auto nm = q.use_masks ? c.nm() : std::span<const bool>{};
-  auto em = q.use_masks ? c.em() : std::span<const bool>{};
-  if (q.reverse) return shortest_paths_to(c.graph, q.src, q.multipath, q.sel, res, nm, em, {});
-  return shortest_paths(c.graph, q.src, q.dst, q.multipath, q.sel, res, nm, em);
-}
-
-struct Runner {
-  std::string variant;
-  spfx::HeapQueue heap; spfx::BucketHeapQueue bucket; spfx::BucketPow2Queue bucket2; spfx::BucketSortQueue bsort;
-  spfx::Workspace ws;
-  spfx::CostProfile prof;
-  std::size_t max_width = 1u << 20;
-  bool fallback = false;
-  void prepare(const Case& c) {
-    prof = spfx::profile_costs(c.graph);
-    fallback = static_cast<std::size_t>(prof.max_cost / prof.stride) + 1 > max_width;
-    ws = spfx::Workspace{};
-    if (variant.find("fresh") != std::string::npos) ws.mode = spfx::WsMode::Fresh;
-    else if (variant.find("full") != std::string::npos) ws.mode = spfx::WsMode::ReuseFull;
-    else if (variant.find("hybrid") != std::string::npos) ws.mode = spfx::WsMode::ReuseHybrid;
-    else ws.mode = spfx::WsMode::ReuseSparse;
-  }
-  Result run(const Case& c, const Query& q) {
-    if (variant == "ref" || q.reverse) return run_ref(c, q);   // reverse: production only
-    spfx::Workspace fresh; fresh.mode = spfx::WsMode::Fresh;
-    spfx::Workspace& w = (ws.mode == spfx::WsMode::Fresh) ? fresh : ws;
-    auto res = q.use_residual ? std::span<const Cap>(c.residual) : std::span<const Cap>{};
-    auto nm = q.use_masks ? c.nm() : std::span<const bool>{};
-    auto em = q.use_masks ? c.em() : std::span<const bool>{};
-    const bool use_heap = fallback || variant.rfind("heap", 0) == 0;
-    if (use_heap) return spfx::spf_variant(c.graph, q.src, q.dst, q.multipath, q.sel, res, nm, em, heap, w, prof.max_cost, prof.stride);
-    if (variant.rfind("bsort", 0) == 0) return spfx::spf_variant(c.graph, q.src, q.dst, q.multipath, q.sel, res, nm, em, bsort, w, prof.max_cost, prof.stride);
-    if (variant.rfind("bucket2", 0) == 0) return spfx::spf_variant(c.graph, q.src, q.dst, q.multipath, q.sel, res, nm, em, bucket2, w, prof.max_cost, prof.stride);
-    return spfx::spf_variant(c.graph, q.src, q.dst, q.multipath, q.sel, res, nm, em, bucket, w, prof.max_cost, prof.stride);
-  }
-};
-
-static bool same(const Result& a, const Result& b) {
-  return a.first == b.first && a.second.parent_offsets == b.second.parent_offsets &&
-         a.second.parents == b.second.parents && a.second.via_edges == b.second.via_edges;
-}
-
-static NodeId far_node(const std::vector<Cost>& d) {
-  NodeId best = -1; Cost bd = -1;
-  for (std::size_t v = 0; v < d.size(); ++v) if (d[v] != INF && d[v] > bd) { bd = d[v]; best = NodeId(v); }
-  return best;
-}
-
-static int correctness() {
-  const char* variants[] = {"heap-fresh", "heap-full", "heap-sparse", "heap-hybrid", "bucket-fresh",
-                            "bucket-full", "bucket-sparse", "bucket-hybrid", "bucket2-fresh", "bucket2-sparse",
-                            "bucket2-hybrid", "bsort-fresh", "bsort-sparse"};
-  std::vector<Case> cases;
-  for (unsigned seed = 1; seed <= 12; ++seed) cases.push_back(make_case("random", 37 + seed * 3, 6, true, false, seed));
-  for (unsigned seed = 1; seed <= 6; ++seed) cases.push_back(make_case("zerocyc", 40 + seed * 5, 5, seed % 2, false, seed));
-  cases.push_back(make_case("random", 1024));
-  cases.push_back(make_case("random", 512, 8, true, true, 7));
-  cases.push_back(make_case("grid", 1024));
-  cases.push_back(make_case("uniform", 500));
-  cases.push_back(make_case("wide", 600, 8, true, false, 3, 100000));
-  cases.push_back(make_case("pseudo", 64));
-  cases.push_back(make_case("pseudo", 200, 8, true, false, 5));
-  cases.push_back(make_case("chain", 300));
-  cases.push_back(make_case("fabric", 100));
-  // Dense parallel edges and self-loops: a tiny multigraph.
-  {
-    std::vector<NodeId> s, d; std::vector<Cost> c; std::vector<Cap> k; std::mt19937 r(99);
-    for (int i = 0; i < 400; ++i) { s.push_back(r() % 12); d.push_back(r() % 12); c.push_back(r() % 3); k.push_back(double(r() % 5)); }
-    Case mc{"multi", StrictMultiDiGraph::from_arrays(12, s, d, k, c)};
-    mc.node_mask = std::make_unique<bool[]>(12); mc.edge_mask = std::make_unique<bool[]>(400);
-    mc.residual.assign(mc.graph.capacity_view().begin(), mc.graph.capacity_view().end());
-    for (int i = 0; i < 12; ++i) mc.node_mask[i] = r() % 9 != 0;
-    for (int i = 0; i < 400; ++i) { mc.edge_mask[i] = r() % 7 != 0; if (r() % 5 == 0) mc.residual[i] = kMinCap * (r() % 3); }
-    cases.push_back(std::move(mc));
-  }
-  std::size_t checked = 0, failed = 0;
-  for (auto& c : cases) {
-    const int n = c.graph.num_nodes();
-    std::vector<NodeId> sources;
-    if (c.fixed_src >= 0) sources = {c.fixed_src, 0, 3};
-    else for (int i = 0; i < 6; ++i) sources.push_back((i * 997 + 1) % n);
-    for (const char* vname : variants) {
-      Runner r; r.variant = vname; r.prepare(c);
-      for (NodeId s : sources) {
-        for (int mp = 0; mp < 2; ++mp) for (int me = 0; me < 2; ++me) for (int tb = 0; tb < 2; ++tb)
-        for (int rc = 0; rc < 2; ++rc) for (int ur = 0; ur < 2; ++ur) for (int um = 0; um < 2; ++um) {
-          Query q; q.src = s; q.multipath = mp; q.sel.multi_edge = me;
-          q.sel.tie_break = tb ? EdgeTieBreak::PreferHigherResidual : EdgeTieBreak::Deterministic;
-          q.sel.require_capacity = rc; q.use_residual = ur; q.use_masks = um;
-          std::vector<std::optional<NodeId>> dsts = {std::nullopt};
-          auto full = run_ref(c, q);
-          if (c.fixed_dst >= 0) dsts.push_back(c.fixed_dst);
-          auto row = c.graph.row_offsets_view(); auto col = c.graph.col_indices_view();
-          if (row[s + 1] > row[s]) dsts.push_back(col[row[s]]);
-          NodeId far = far_node(full.first); if (far >= 0) dsts.push_back(far);
-          dsts.push_back(s); dsts.push_back((s + n / 2) % n);
-          for (auto& d : dsts) {
-            q.dst = d;
-            auto expected = run_ref(c, q);
-            for (int rep = 0; rep < 2; ++rep) {   // second run exercises reuse/reset paths
-              auto actual = r.run(c, q);
-              ++checked;
-              if (!same(expected, actual)) {
-                ++failed;
-                if (failed <= 20)
-                  std::cerr << "MISMATCH case=" << c.name << " n=" << n << " variant=" << vname
-                            << " src=" << s << " dst=" << (d ? std::to_string(*d) : "none")
-                            << " mp=" << mp << " me=" << me << " tb=" << tb << " rc=" << rc
-                            << " ur=" << ur << " um=" << um << " rep=" << rep << '\n';
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-  std::cout << "checked=" << checked << " failed=" << failed << '\n';
-  return failed ? 1 : 0;
-}
-
-struct Workload { std::string label; Case c; int queries; std::string dst_mode; };
-
-static void time_workloads(std::vector<Workload>& wls, const std::string& variant, int samples, std::size_t maxw) {
-  std::cout << "case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms\n";
-  for (auto& w : wls) {
-    auto& c = w.c; const int n = c.graph.num_nodes();
-    std::vector<Query> qs;
-    for (int i = 0; i < w.queries; ++i) {
-      Query q; q.multipath = true; q.sel = EdgeSelection{}; q.use_residual = true; q.use_masks = true;
-      q.src = c.fixed_src >= 0 ? c.fixed_src : (i * 997) % n;
-      if (w.dst_mode == "reverse") q.reverse = true;
-      else if (w.dst_mode == "fixed") q.dst = c.fixed_dst;
-      else if (w.dst_mode == "near") {
-        auto row = c.graph.row_offsets_view(); auto col = c.graph.col_indices_view();
-        q.dst = col[row[q.src]];
-      } else if (w.dst_mode == "far") {
-        Query f = q; f.dst = std::nullopt; q.dst = far_node(run_ref(c, f).first);
-      }
-      qs.push_back(q);
-    }
-    std::vector<Result> expected; for (auto& q : qs) expected.push_back(run_ref(c, q));
-    Runner r; r.variant = variant; r.max_width = maxw; r.prepare(c);
-    std::vector<double> times;
-    for (int rep = -2; rep < samples; ++rep) {
-      std::vector<Result> actual(qs.size());
-      auto start = Clock::now();
-      for (std::size_t i = 0; i < qs.size(); ++i) actual[i] = r.run(c, qs[i]);
-      double el = ms(start);
-      for (std::size_t i = 0; i < qs.size(); ++i) if (!same(expected[i], actual[i])) throw std::runtime_error("timed result mismatch in " + w.label);
-      if (rep >= 0) times.push_back(el);
-    }
-    std::vector<double> sorted = times; std::sort(sorted.begin(), sorted.end());
-    std::cout << w.label << ',' << n << ',' << c.graph.num_edges() << ',' << w.queries << ',' << w.dst_mode << ','
-              << variant << ',' << (r.fallback ? 1 : 0) << ',' << (r.prof.max_cost / r.prof.stride + 1) << ','
-              << std::fixed << sorted[sorted.size() / 2] << ',' << samples << ',';
-    for (std::size_t j = 0; j < times.size(); ++j) std::cout << (j ? ";" : "") << times[j];
-    std::cout << '\n' << std::flush;
-  }
-}
-
-int main(int argc, char** argv) {
-  try {
-    std::string mode = argc > 1 ? argv[1] : "correctness";
-    if (mode == "correctness") return correctness();
-    std::string variant = argc > 2 ? argv[2] : "ref";
-    int samples = argc > 3 ? std::stoi(argv[3]) : 7;
-    std::size_t maxw = argc > 4 ? std::stoull(argv[4]) : (1u << 20);
-    std::vector<Workload> wls;
-    if (mode == "time") {
-      wls.push_back({"random", make_case("random", 1024), 1, "none"});
-      wls.push_back({"random", make_case("random", 4096), 256, "none"});
-      wls.push_back({"random", make_case("random", 16384), 64, "none"});
-      wls.push_back({"random", make_case("random", 65536), 1, "none"});
-      wls.push_back({"random", make_case("random", 4096, 32), 64, "none"});
-      wls.push_back({"clos", make_case("clos", 800), 64, "none"});
-      wls.push_back({"grid", make_case("grid", 10000), 1, "none"});
-      wls.push_back({"chain", make_case("chain", 2048), 1, "none"});
-      wls.push_back({"uniform", make_case("uniform", 16384), 64, "none"});
-      wls.push_back({"random_masked", make_case("random", 16384, 8, true), 64, "none"});
-      wls.push_back({"pseudo", make_case("pseudo", 800), 64, "fixed"});
-      wls.push_back({"random", make_case("random", 1024), 64, "far"});
-      wls.push_back({"random", make_case("random", 16384), 64, "far"});
-      wls.push_back({"random", make_case("random", 65536), 16, "far"});
-      wls.push_back({"random", make_case("random", 1024), 64, "near"});
-      wls.push_back({"random", make_case("random", 16384), 64, "near"});
-      wls.push_back({"random", make_case("random", 65536), 64, "near"});
-      wls.push_back({"random", make_case("random", 262144), 16, "near"});
-      wls.push_back({"random", make_case("random", 262144), 1, "none"});
-      wls.push_back({"random", make_case("random", 4096), 64, "reverse"});
-      wls.push_back({"random", make_case("random", 16384), 16, "reverse"});
-      wls.push_back({"clos", make_case("clos", 800), 16, "reverse"});
-      wls.push_back({"chain", make_case("chain", 2048), 1, "reverse"});
-    } else if (mode == "short") {
-      wls.push_back({"random", make_case("random", 16384), 64, "none"});
-      wls.push_back({"random", make_case("random", 65536), 1, "none"});
-      wls.push_back({"clos", make_case("clos", 800), 64, "none"});
-      wls.push_back({"chain", make_case("chain", 2048), 1, "none"});
-      wls.push_back({"random", make_case("random", 16384), 64, "near"});
-      wls.push_back({"random", make_case("random", 65536), 64, "near"});
-      wls.push_back({"random", make_case("random", 262144), 16, "near"});
-      wls.push_back({"random", make_case("random", 262144), 1, "none"});
-      wls.push_back({"random", make_case("random", 4096), 64, "reverse"});
-      wls.push_back({"clos", make_case("clos", 800), 16, "reverse"});
-    } else if (mode == "faults") {
-      auto c = make_case("random", 262144);
-      Runner r; r.variant = variant; r.prepare(c);
-      std::vector<Query> qs;
-      for (int i = 0; i < 16; ++i) {
-        Query q; q.multipath = true; q.sel = EdgeSelection{}; q.use_residual = true; q.use_masks = true;
-        q.src = (i * 997) % c.graph.num_nodes();
-        auto row = c.graph.row_offsets_view(); auto col = c.graph.col_indices_view();
-        q.dst = col[row[q.src]]; qs.push_back(q);
-      }
-      std::cout << "variant,sample,ms,minor_faults\n";
-      for (int rep = 0; rep < samples; ++rep) {
-        struct rusage a{}, b{}; getrusage(RUSAGE_SELF, &a);
-        auto start = Clock::now();
-        for (auto& q : qs) { auto res = r.run(c, q); (void)res; }
-        double el = ms(start); getrusage(RUSAGE_SELF, &b);
-        std::cout << variant << ',' << rep << ',' << el << ',' << (b.ru_minflt - a.ru_minflt) << '\n';
-      }
-      return 0;
-    } else if (mode == "sweep") {
-      for (Cost k : {Cost(1), Cost(31), Cost(1023), Cost(32767), Cost(1048575), Cost(33554431)})
-        wls.push_back({"wide" + std::to_string(k), make_case("wide", 16384, 8, false, false, 11, k), 16, "none"});
-    } else { std::cerr << "unknown mode\n"; return 2; }
-    time_workloads(wls, variant, samples, maxw);
-    return 0;
-  } catch (const std::exception& e) { std::cerr << "FAIL: " << e.what() << '\n'; return 1; }
-}
diff --git a/dev/perf/spf_queue/results/core/environment.txt b/dev/perf/spf_queue/results/core/environment.txt
deleted file mode 100644
index 7e3715f..0000000
--- a/dev/perf/spf_queue/results/core/environment.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-date: 2026-10-02T01:55:02Z
-commit: fbab119e794c843838f4f3f96d75cb7f32f06845
-398e99a789a55595c2862a1574d5dbb7b79105debd23893e513145331c8ebf20  build/perf/cpu-queue-old
-0caa759264760987d39f2e34774fb972e6d906aa30c0ba50b338b630bc2ecb82  build/perf/cpu-queue
-32b56468bdbf2aa01cd24f4d49bc32572a4fb3df2cdfbee222919365ddb345ac  src/shortest_paths.cpp
diff --git a/dev/perf/spf_queue/results/core/load.txt b/dev/perf/spf_queue/results/core/load.txt
deleted file mode 100644
index 355b2d8..0000000
--- a/dev/perf/spf_queue/results/core/load.txt
+++ /dev/null
@@ -1,5 +0,0 @@
- 2:55  up 52 days,  7:30, 3 users, load averages: 4.90 3.90 3.58
- 2:55  up 52 days,  7:31, 3 users, load averages: 5.87 4.25 3.72
- 2:55  up 52 days,  7:31, 3 users, load averages: 5.55 4.28 3.74
- 2:56  up 52 days,  7:32, 3 users, load averages: 4.78 4.23 3.74
- 2:56  up 52 days,  7:32, 3 users, load averages: 3.81 4.06 3.70
diff --git a/dev/perf/spf_queue/results/core/sweep-a1-old.csv b/dev/perf/spf_queue/results/core/sweep-a1-old.csv
deleted file mode 100644
index f9e3244..0000000
--- a/dev/perf/spf_queue/results/core/sweep-a1-old.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,ref,0,2,44.352291,9,44.086875;44.377000;44.628125;44.352291;44.023541;43.918208;44.219417;44.613792;44.580041
-wide31,16384,131072,16,none,ref,0,32,64.523625,9,65.509584;63.234250;65.116667;65.243042;64.903458;64.523625;63.181459;63.612750;63.286166
-wide1023,16384,131072,16,none,ref,0,1024,59.174417,9,58.785959;58.733333;58.501958;59.025541;59.562083;59.174417;59.679125;61.427416;60.950667
-wide32767,16384,131072,16,none,ref,0,32768,51.340375,9,51.536250;50.769167;51.296250;50.826084;51.254458;51.340375;55.436375;52.199417;51.832375
-wide1048575,16384,131072,16,none,ref,0,1048570,49.692959,9,49.268709;49.916458;49.665333;50.078875;50.071583;49.323417;49.692959;49.539000;50.344708
-wide33554431,16384,131072,16,none,ref,1,33554196,50.979792,9,51.642458;50.843541;51.670125;52.071708;50.979792;49.830125;49.897750;53.102917;50.218000
diff --git a/dev/perf/spf_queue/results/core/sweep-a2-old.csv b/dev/perf/spf_queue/results/core/sweep-a2-old.csv
deleted file mode 100644
index 481ab09..0000000
--- a/dev/perf/spf_queue/results/core/sweep-a2-old.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,ref,0,2,45.312333,9,44.464833;44.154500;47.801250;53.494416;50.825042;45.947750;45.312333;44.580125;43.997000
-wide31,16384,131072,16,none,ref,0,32,62.621250,9,62.490250;62.513000;63.224833;65.986583;63.337458;62.931083;62.621250;62.527625;62.346834
-wide1023,16384,131072,16,none,ref,0,1024,58.916208,9,59.217541;58.972542;58.553250;58.374542;58.483916;58.916208;58.997625;59.213500;58.537375
-wide32767,16384,131072,16,none,ref,0,32768,51.218083,9,51.855000;50.652958;51.594542;52.729791;54.058500;50.825625;51.218083;50.761458;50.697500
-wide1048575,16384,131072,16,none,ref,0,1048570,49.482167,9,49.696250;49.551542;50.780459;49.118250;49.691791;49.366750;49.482167;49.194792;49.096834
-wide33554431,16384,131072,16,none,ref,1,33554196,49.570416,9,49.298209;49.703792;49.571917;49.570416;49.748334;49.420875;48.950458;49.058333;49.650792
diff --git a/dev/perf/spf_queue/results/core/sweep-b-new-heap.csv b/dev/perf/spf_queue/results/core/sweep-b-new-heap.csv
deleted file mode 100644
index ebdd1c8..0000000
--- a/dev/perf/spf_queue/results/core/sweep-b-new-heap.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,ref,0,2,44.878208,9,45.642250;44.777125;44.635208;44.826041;44.878208;44.698917;44.906916;45.127375;46.000833
-wide31,16384,131072,16,none,ref,0,32,65.879833,9,65.689708;65.387917;65.879833;65.649000;65.923375;65.449416;71.317416;70.386500;66.445333
-wide1023,16384,131072,16,none,ref,0,1024,64.511417,9,65.141875;64.957542;64.511417;63.439542;63.949875;65.523292;64.848458;62.969292;61.874125
-wide32767,16384,131072,16,none,ref,0,32768,53.333916,9,56.096500;53.301334;53.190750;52.911167;53.580208;53.497084;53.135542;53.689084;53.333916
-wide1048575,16384,131072,16,none,ref,0,1048570,51.609166,9,51.523833;51.587417;51.883958;51.651209;51.836750;51.609166;51.933042;51.236250;51.375834
-wide33554431,16384,131072,16,none,ref,1,33554196,52.825083,9,51.052583;53.398959;52.825083;53.651458;52.462500;53.022917;51.669167;52.227625;52.896750
diff --git a/dev/perf/spf_queue/results/core/sweep-b-new.csv b/dev/perf/spf_queue/results/core/sweep-b-new.csv
deleted file mode 100644
index 9433c7f..0000000
--- a/dev/perf/spf_queue/results/core/sweep-b-new.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,ref,0,2,36.503458,9,37.167208;36.729708;37.140375;36.533916;36.503458;36.221459;36.294459;36.378834;36.433625
-wide31,16384,131072,16,none,ref,0,32,37.245334,9,37.449375;37.121292;37.245334;37.061000;37.297667;37.611959;37.674375;37.111042;37.001167
-wide1023,16384,131072,16,none,ref,0,1024,35.254125,9,35.443709;34.672542;34.525583;35.358042;35.254125;34.552375;35.635083;35.049750;37.176667
-wide32767,16384,131072,16,none,ref,0,32768,42.723500,9,46.660292;46.680417;43.522792;42.570000;42.480250;42.398000;43.176167;42.561459;42.723500
-wide1048575,16384,131072,16,none,ref,0,1048570,52.842042,9,52.842042;54.554709;52.937625;51.867250;53.022625;53.576167;51.793459;51.445958;51.624084
-wide33554431,16384,131072,16,none,ref,1,33554196,51.172125,9,51.042458;51.125750;51.288833;51.172125;51.396875;51.077375;50.950125;51.360083;51.348583
diff --git a/dev/perf/spf_queue/results/core/time-a1-old.csv b/dev/perf/spf_queue/results/core/time-a1-old.csv
deleted file mode 100644
index 9fc4aae..0000000
--- a/dev/perf/spf_queue/results/core/time-a1-old.csv
+++ /dev/null
@@ -1,24 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.106958,9,0.115667;0.110708;0.106792;0.106958;0.104708;0.109125;0.105583;0.110708;0.105542
-random,4096,32768,256,none,ref,0,32,211.610083,9,212.391417;213.572625;211.610083;212.972792;209.318375;211.922333;211.232708;210.825583;211.031791
-random,16384,131072,64,none,ref,0,32,254.445125,9,255.636625;250.567292;256.788750;255.059291;254.445125;252.375416;252.658750;251.488167;258.346709
-random,65536,524288,1,none,ref,0,32,21.207166,9,22.317625;20.960375;22.085000;21.607833;21.891917;20.436417;21.207166;20.212583;19.644375
-random,4096,131072,64,none,ref,0,32,111.982500,9,111.510291;111.280167;110.260750;114.967625;111.982500;116.551958;115.775541;112.375292;110.651750
-clos,800,320000,64,none,ref,0,2,143.850792,9,144.580583;159.426375;146.935833;144.435542;143.749167;143.498125;143.109583;143.096916;143.850792
-grid,10000,39600,1,none,ref,0,2,0.613667,9,0.626875;0.617250;0.614458;0.608209;0.605041;0.613667;0.602333;0.630500;0.612917
-chain,2048,2047,1,none,ref,0,32,0.021084,9,0.021125;0.023292;0.021250;0.021291;0.021000;0.020833;0.021084;0.021000;0.020833
-uniform,16384,131072,64,none,ref,0,2,181.359417,9,184.075459;184.356917;181.359417;179.613750;176.768791;176.969792;183.551792;185.391208;179.085709
-random_masked,16384,131072,64,none,ref,0,32,229.998916,9,231.366959;229.379667;229.071125;230.344541;229.998916;229.167958;231.250333;229.889500;233.766959
-pseudo,802,320200,64,fixed,ref,0,2,143.435458,9,145.647375;143.648291;143.467333;143.388459;143.066459;143.010917;142.905250;143.435458;144.383417
-random,1024,8192,64,far,ref,0,32,10.809542,9,10.983583;10.809542;10.820083;10.535125;10.627583;11.172125;10.714834;10.797625;10.889416
-random,16384,131072,64,far,ref,0,32,251.559084,9,251.398833;255.170833;249.550292;257.199750;256.924875;251.559084;262.081709;250.485417;250.757833
-random,65536,524288,16,far,ref,0,32,324.283292,9,317.256292;323.378583;317.522917;335.351792;344.360000;328.237084;332.692291;323.432333;324.283292
-random,1024,8192,64,near,ref,0,32,0.115916,9,0.131834;0.116125;0.114917;0.116166;0.114417;0.115916;0.115167;0.115916;0.114916
-random,16384,131072,64,near,ref,0,32,1.160042,9,1.184500;1.160042;1.155458;1.184875;1.169292;1.155208;1.161750;1.149708;1.133042
-random,65536,524288,64,near,ref,0,32,4.350791,9,4.351875;4.369875;4.271042;4.321834;4.495250;4.440125;4.322833;4.295916;4.350791
-random,262144,2097152,16,near,ref,0,32,4.508541,9,4.475417;4.420459;4.466000;4.534375;4.546958;4.508541;4.552375;4.574167;4.442375
-random,262144,2097152,1,none,ref,0,32,136.600542,9,131.104333;132.261833;151.478750;136.600542;153.047334;136.134208;151.398709;138.768875;133.424375
-random,4096,32768,64,reverse,ref,0,32,55.852125,9,56.317833;55.482417;55.200209;55.489792;55.858208;56.313583;55.924292;55.852125;55.504916
-random,16384,131072,16,reverse,ref,0,32,66.552625,9,66.607458;66.686250;66.552625;66.465708;66.405917;66.595375;66.715500;66.423000;66.335334
-clos,800,320000,16,reverse,ref,0,2,45.430417,9,45.366916;46.270000;45.521083;45.523167;45.045208;45.342166;46.058917;45.430417;45.360167
-chain,2048,2047,1,reverse,ref,0,32,0.002459,9,0.002542;0.002500;0.002458;0.002417;0.002458;0.002459;0.002459;0.002417;0.002500
diff --git a/dev/perf/spf_queue/results/core/time-a2-old.csv b/dev/perf/spf_queue/results/core/time-a2-old.csv
deleted file mode 100644
index 94e8ab2..0000000
--- a/dev/perf/spf_queue/results/core/time-a2-old.csv
+++ /dev/null
@@ -1,24 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.101834,9,0.109500;0.105542;0.101750;0.104625;0.101834;0.100333;0.101167;0.103750;0.100666
-random,4096,32768,256,none,ref,0,32,207.613708,9,207.485375;206.933041;208.212125;207.613708;207.810167;208.212750;210.455416;207.561500;207.319334
-random,16384,131072,64,none,ref,0,32,250.635500,9,248.790875;255.047708;252.925667;250.635500;259.166875;256.407833;249.778542;249.601458;249.926959
-random,65536,524288,1,none,ref,0,32,19.031875,9,19.095375;18.645916;18.997584;19.031875;19.140959;18.780000;18.720708;19.176583;19.497166
-random,4096,131072,64,none,ref,0,32,110.612875,9,109.587375;110.209167;111.275208;110.612875;111.021292;109.861250;109.868792;111.204875;112.800917
-clos,800,320000,64,none,ref,0,2,144.348666,9,144.072417;144.348666;142.863833;144.374250;143.269584;143.490667;145.960250;146.807167;149.376125
-grid,10000,39600,1,none,ref,0,2,0.617875,9,0.702541;0.759916;0.659916;0.617875;0.626667;0.612417;0.608000;0.610875;0.602750
-chain,2048,2047,1,none,ref,0,32,0.021125,9,0.021167;0.021208;0.020917;0.021042;0.021125;0.021042;0.021125;0.021125;0.021083
-uniform,16384,131072,64,none,ref,0,2,177.095166,9,182.894583;177.679000;176.943375;178.067417;177.095166;175.792833;175.764500;177.102125;176.212083
-random_masked,16384,131072,64,none,ref,0,32,229.178375,9,236.057750;234.569458;229.058791;230.634208;228.691667;229.766125;229.178375;228.735667;228.920333
-pseudo,802,320200,64,fixed,ref,0,2,143.852875,9,142.524209;145.574958;144.100459;142.070458;141.723667;142.472459;145.693959;143.852875;144.534584
-random,1024,8192,64,far,ref,0,32,10.644542,9,10.938208;10.673625;10.548000;10.667625;10.833166;10.644542;10.574875;10.554875;10.396333
-random,16384,131072,64,far,ref,0,32,250.480292,9,249.484750;256.099917;256.425250;250.480292;250.175000;252.559959;249.520334;250.489750;249.955709
-random,65536,524288,16,far,ref,0,32,330.221833,9,315.811792;313.175667;318.501292;354.013792;334.924291;358.063459;337.334500;330.221833;325.634834
-random,1024,8192,64,near,ref,0,32,0.115000,9,0.131166;0.120875;0.123250;0.114667;0.115125;0.114500;0.114542;0.115000;0.114458
-random,16384,131072,64,near,ref,0,32,1.158416,9,1.172833;1.157791;1.135833;1.134000;1.149042;1.170666;1.162125;1.159625;1.158416
-random,65536,524288,64,near,ref,0,32,4.254209,9,4.462792;4.332792;4.254209;4.196083;4.119875;4.314084;4.682750;4.132750;4.198625
-random,262144,2097152,16,near,ref,0,32,4.052500,9,4.064917;4.003458;4.176958;3.968500;4.052500;4.077541;4.024875;4.008208;4.084000
-random,262144,2097152,1,none,ref,0,32,133.776042,9,129.185667;137.226125;140.845583;129.927167;138.156834;133.776042;129.648542;129.228250;140.502583
-random,4096,32768,64,reverse,ref,0,32,55.341708,9,55.341708;54.893125;55.288291;55.720083;55.631458;55.147375;55.813000;55.523584;55.047041
-random,16384,131072,16,reverse,ref,0,32,66.335584,9,66.911958;66.478584;66.164500;66.552166;65.950875;66.265667;66.290083;66.454625;66.335584
-clos,800,320000,16,reverse,ref,0,2,45.715584,9,45.088375;45.245375;45.715584;45.252958;45.571917;47.052000;47.791334;48.474250;47.146917
-chain,2048,2047,1,reverse,ref,0,32,0.002500,9,0.002541;0.006000;0.002542;0.002500;0.002500;0.002459;0.002417;0.002417;0.002459
diff --git a/dev/perf/spf_queue/results/core/time-b-new-heap.csv b/dev/perf/spf_queue/results/core/time-b-new-heap.csv
deleted file mode 100644
index 205909f..0000000
--- a/dev/perf/spf_queue/results/core/time-b-new-heap.csv
+++ /dev/null
@@ -1,24 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.088833,9,0.096708;0.091625;0.088833;0.088750;0.090125;0.088541;0.088417;0.089375;0.087750
-random,4096,32768,256,none,ref,0,32,221.265750,9,220.144584;223.817375;220.986583;223.324666;222.115833;219.679500;221.265750;223.397125;220.469791
-random,16384,131072,64,none,ref,0,32,266.067667,9,274.505625;266.067667;267.851333;270.677250;269.163250;264.256125;265.097667;263.502791;263.624708
-random,65536,524288,1,none,ref,0,32,23.134583,9,20.670500;23.134583;24.174791;23.200709;23.227667;24.203375;22.576833;22.547500;22.666666
-random,4096,131072,64,none,ref,0,32,115.415541,9,115.824416;115.139792;115.361583;115.253792;118.206167;115.457125;114.843167;115.415541;115.862542
-clos,800,320000,64,none,ref,0,2,111.078375,9,111.197500;111.471166;110.903000;110.062458;111.763917;111.078375;111.423292;110.355000;109.572500
-grid,10000,39600,1,none,ref,0,2,0.634583,9,0.667334;0.642000;0.634583;0.619208;0.621583;0.626667;0.608708;0.755708;0.666667
-chain,2048,2047,1,none,ref,0,32,0.029416,9,0.029459;0.029416;0.029208;0.029459;0.029083;0.029542;0.029250;0.029125;0.029541
-uniform,16384,131072,64,none,ref,0,2,178.581250,9,195.664541;191.799417;182.415708;177.275333;178.194333;176.856083;178.398166;178.581250;185.570167
-random_masked,16384,131072,64,none,ref,0,32,236.748625,9,236.023250;236.838417;236.574250;236.748625;236.012875;235.968875;237.149583;243.117416;237.379625
-pseudo,802,320200,64,fixed,ref,0,2,110.311166,9,106.727958;108.254041;111.146250;113.320334;111.019083;109.168833;111.504666;110.311166;108.458625
-random,1024,8192,64,far,ref,0,32,11.213583,9,11.372458;11.213583;11.326291;11.234958;11.130166;11.206750;11.241334;11.163084;11.072542
-random,16384,131072,64,far,ref,0,32,264.043167,9,264.706709;261.972584;270.202333;264.043167;261.499958;260.463167;261.026333;272.374125;265.389125
-random,65536,524288,16,far,ref,0,32,336.034334,9,336.034334;332.651584;356.911208;348.736917;331.438584;330.369333;334.507666;361.791000;338.378541
-random,1024,8192,64,near,ref,0,32,0.037709,9,0.049833;0.037750;0.037709;0.038917;0.036584;0.036625;0.041125;0.037125;0.037375
-random,16384,131072,64,near,ref,0,32,0.391916,9,0.401042;0.391125;0.400458;0.387916;0.393584;0.391916;0.391000;0.391417;0.392417
-random,65536,524288,64,near,ref,0,32,1.516667,9,1.524625;1.527166;1.501125;1.529125;1.489458;1.496208;1.504041;1.516667;1.544250
-random,262144,2097152,16,near,ref,0,32,1.470708,9,1.496750;1.484625;1.459750;1.510000;1.470708;1.463125;1.449584;1.478750;1.448833
-random,262144,2097152,1,none,ref,0,32,130.310667,9,130.310667;129.807542;135.604750;131.635916;127.798916;133.017500;130.851417;128.863917;128.407125
-random,4096,32768,64,reverse,ref,0,32,58.814625,9,58.716666;58.974417;58.564417;58.924000;58.719750;58.765125;58.819625;59.099708;58.814625
-random,16384,131072,16,reverse,ref,0,32,69.334166,9,69.079041;70.882875;72.038375;70.165583;69.543625;69.334166;68.577084;68.910917;69.139291
-clos,800,320000,16,reverse,ref,0,2,36.895583,9,36.895583;36.931584;36.731667;36.628208;37.129375;37.363000;36.916333;36.660125;36.753125
-chain,2048,2047,1,reverse,ref,0,32,0.000959,9,0.000959;0.000958;0.000917;0.000958;0.001041;0.000917;0.001000;0.001000;0.001000
diff --git a/dev/perf/spf_queue/results/core/time-b-new.csv b/dev/perf/spf_queue/results/core/time-b-new.csv
deleted file mode 100644
index 34b6d95..0000000
--- a/dev/perf/spf_queue/results/core/time-b-new.csv
+++ /dev/null
@@ -1,24 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.066833,9,0.069250;0.075792;0.070875;0.068000;0.065625;0.066125;0.066042;0.066833;0.066625
-random,4096,32768,256,none,ref,0,32,132.648459,9,132.505375;132.265375;132.831417;132.648459;132.447625;132.762458;132.147750;133.442458;133.112792
-random,16384,131072,64,none,ref,0,32,150.945333,9,153.656875;164.973750;153.952125;152.398625;150.712417;150.172000;150.945333;148.924042;150.006708
-random,65536,524288,1,none,ref,0,32,11.514416,9,12.729084;11.643750;11.423167;11.514416;11.301959;11.454750;11.378291;11.714166;13.003042
-random,4096,131072,64,none,ref,0,32,77.140875,9,77.841792;76.885000;76.946334;77.022959;77.553333;77.419958;77.140875;77.250500;76.946625
-clos,800,320000,64,none,ref,0,2,110.201250,9,110.201250;110.459333;111.589125;110.316375;110.060292;109.016875;109.324375;111.536917;109.488958
-grid,10000,39600,1,none,ref,0,2,0.458667,9,0.455084;0.457958;0.457750;0.454583;0.525708;0.490208;0.472750;0.473292;0.458667
-chain,2048,2047,1,none,ref,0,32,0.027209,9,0.027667;0.032000;0.027583;0.027167;0.027167;0.027500;0.027209;0.027209;0.026875
-uniform,16384,131072,64,none,ref,0,2,146.318459,9,148.808250;145.343750;145.932500;145.638708;144.796250;146.318459;147.311791;149.775541;151.739708
-random_masked,16384,131072,64,none,ref,0,32,140.926917,9,141.910000;140.926917;140.947875;142.060625;140.763166;140.562292;140.122166;140.942208;140.426417
-pseudo,802,320200,64,fixed,ref,0,2,107.962250,9,107.962250;107.616041;110.084750;111.659083;109.297500;109.965042;107.801958;107.381167;107.513167
-random,1024,8192,64,far,ref,0,32,7.093000,9,7.049625;6.997417;7.093000;6.971875;7.082042;7.106000;7.180791;7.158083;7.143250
-random,16384,131072,64,far,ref,0,32,149.749750,9,149.000292;149.749750;149.729417;154.389250;149.780083;149.536709;149.227542;150.169167;155.094416
-random,65536,524288,16,far,ref,0,32,201.204958,9,198.333625;195.605250;206.026334;204.001458;199.659708;201.204958;196.077834;233.704458;211.461416
-random,1024,8192,64,near,ref,0,32,0.042584,9,0.053208;0.042500;0.042166;0.043625;0.042625;0.042584;0.042667;0.041833;0.042000
-random,16384,131072,64,near,ref,0,32,0.402375,9,0.403084;0.411250;0.396709;0.396209;0.402375;0.405083;0.404750;0.393667;0.394125
-random,65536,524288,64,near,ref,0,32,1.505625,9,1.490084;1.491875;1.527917;1.524792;1.505625;1.635250;1.522292;1.500542;1.498333
-random,262144,2097152,16,near,ref,0,32,1.491458,9,1.448042;1.475334;1.456458;1.498000;1.502959;1.516000;1.550250;1.491458;1.483708
-random,262144,2097152,1,none,ref,0,32,96.220542,9,96.220542;99.851167;96.823708;92.344792;90.409417;89.217250;89.115792;96.658666;97.151708
-random,4096,32768,64,reverse,ref,0,32,34.225416,9,34.518125;34.398250;34.308125;34.140792;34.143125;34.115125;34.155500;34.273000;34.225416
-random,16384,131072,16,reverse,ref,0,32,38.665209,9,38.807916;38.697167;38.897083;38.665209;38.407208;38.855583;38.632208;38.602916;38.591125
-clos,800,320000,16,reverse,ref,0,2,37.150083,9,39.364542;37.592042;37.042417;38.531000;37.150083;37.109750;38.969375;37.142042;36.280792
-chain,2048,2047,1,reverse,ref,0,32,0.000958,9,0.000958;0.000959;0.000917;0.000958;0.000959;0.000958;0.000916;0.000917;0.000916
diff --git a/dev/perf/spf_queue/results/first/correctness-sanitized.txt b/dev/perf/spf_queue/results/first/correctness-sanitized.txt
deleted file mode 100644
index 347c0ee..0000000
--- a/dev/perf/spf_queue/results/first/correctness-sanitized.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-checked=1351168 failed=0
-exit=0
diff --git a/dev/perf/spf_queue/results/first/correctness-teeth.txt b/dev/perf/spf_queue/results/first/correctness-teeth.txt
deleted file mode 100644
index d723574..0000000
--- a/dev/perf/spf_queue/results/first/correctness-teeth.txt
+++ /dev/null
@@ -1 +0,0 @@
-checked=1351168 failed=167636
diff --git a/dev/perf/spf_queue/results/first/correctness.txt b/dev/perf/spf_queue/results/first/correctness.txt
deleted file mode 100644
index 347c0ee..0000000
--- a/dev/perf/spf_queue/results/first/correctness.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-checked=1351168 failed=0
-exit=0
diff --git a/dev/perf/spf_queue/results/first/environment.txt b/dev/perf/spf_queue/results/first/environment.txt
deleted file mode 100644
index b5c6fa9..0000000
--- a/dev/perf/spf_queue/results/first/environment.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-date: 2026-09-27T13:35:56Z
-commit: fbab119e794c843838f4f3f96d75cb7f32f06845
-Apple M4 Max
-ae2f8f3b2f2839d6d088e0a938b86cba02c23c285c33cac99df6bf369286f264  dev/perf/spf_queue/spf_variants.hpp
-a0ac4290fd6b47bdefcc4bd4cf50257e275406cb34f371e4c0ba30368b0fea45  dev/perf/spf_queue/harness.cpp
-9ee6053d38a0b1e44df958e423e12ab93fb54c3d80c8d4bcb623730362b8f441  src/shortest_paths.cpp
-12f65bdc8daa9415d118d062bdc897981bde448f5391bed2c711c8c968e9322b  src/strict_multidigraph.cpp
-Apple clang version 21.0.0 (clang-2100.1.1.101)
diff --git a/dev/perf/spf_queue/results/first/load.txt b/dev/perf/spf_queue/results/first/load.txt
deleted file mode 100644
index 3452f6c..0000000
--- a/dev/perf/spf_queue/results/first/load.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-14:35  up 47 days, 19:11, 3 users, load averages: 3.33 3.01 3.05
-14:36  up 47 days, 19:12, 3 users, load averages: 2.94 2.95 3.03
-14:36  up 47 days, 19:12, 3 users, load averages: 4.08 3.21 3.12
-14:37  up 47 days, 19:12, 3 users, load averages: 3.95 3.25 3.14
-14:37  up 47 days, 19:13, 3 users, load averages: 3.41 3.18 3.11
-14:37  up 47 days, 19:13, 3 users, load averages: 3.16 3.14 3.10
-14:38  up 47 days, 19:13, 3 users, load averages: 3.64 3.25 3.14
-14:38  up 47 days, 19:14, 3 users, load averages: 3.28 3.18 3.12
-14:38  up 47 days, 19:14, 3 users, load averages: 3.21 3.17 3.11
-14:39  up 47 days, 19:14, 3 users, load averages: 3.47 3.24 3.14
-14:39  up 47 days, 19:15, 3 users, load averages: 3.59 3.29 3.16
-14:39  up 47 days, 19:15, 3 users, load averages: 3.55 3.28 3.16
-14:39  up 47 days, 19:15, 3 users, load averages: 3.42 3.26 3.15
-14:39  up 47 days, 19:15, 3 users, load averages: 3.63 3.31 3.17
-14:39  up 47 days, 19:15, 3 users, load averages: 3.63 3.31 3.17
diff --git a/dev/perf/spf_queue/results/first/sweep-bsort-sparse.csv b/dev/perf/spf_queue/results/first/sweep-bsort-sparse.csv
deleted file mode 100644
index d6524b4..0000000
--- a/dev/perf/spf_queue/results/first/sweep-bsort-sparse.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,bsort-sparse,0,2,36.213417,9,37.503167;36.411458;36.550708;35.483709;36.001917;36.213417;37.912750;35.776291;36.088458
-wide31,16384,131072,16,none,bsort-sparse,0,32,37.633250,9,37.642292;37.615583;37.526041;37.746125;37.884709;37.733334;37.633250;37.480625;37.275917
-wide1023,16384,131072,16,none,bsort-sparse,0,1024,33.782917,9,33.744125;33.971042;33.692333;33.873166;33.782917;33.827375;33.746500;33.667792;33.785417
-wide32767,16384,131072,16,none,bsort-sparse,0,32768,34.269584,9,34.145166;34.158250;34.001209;34.269584;33.649958;34.406584;34.414625;34.346042;34.283834
-wide1048575,16384,131072,16,none,bsort-sparse,0,1048570,46.217500,9,45.310209;47.594125;46.217500;46.955084;46.440625;46.040500;45.000041;46.189209;47.516000
-wide33554431,16384,131072,16,none,bsort-sparse,1,33554196,56.886334,9,55.632334;57.164750;57.547542;57.042417;56.886334;57.274458;56.415333;56.450250;56.839292
diff --git a/dev/perf/spf_queue/results/first/sweep-bucket-sparse.csv b/dev/perf/spf_queue/results/first/sweep-bucket-sparse.csv
deleted file mode 100644
index e172a77..0000000
--- a/dev/perf/spf_queue/results/first/sweep-bucket-sparse.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,bucket-sparse,0,2,35.220125,9,34.863958;35.220125;35.179708;35.015167;35.218083;35.266916;35.852333;35.964375;35.417875
-wide31,16384,131072,16,none,bucket-sparse,0,32,35.754000,9,35.186583;35.210584;36.171750;36.027334;36.380417;35.901208;35.754000;35.222417;35.417541
-wide1023,16384,131072,16,none,bucket-sparse,0,1024,34.063333,9,34.236000;34.070875;34.083625;33.672625;34.063333;33.680458;33.881833;33.872875;34.160292
-wide32767,16384,131072,16,none,bucket-sparse,0,32768,35.003458,9,35.149750;35.003458;34.967500;35.018583;35.021125;34.919542;34.933209;35.050500;34.908083
-wide1048575,16384,131072,16,none,bucket-sparse,0,1048570,46.844291,9,46.844291;44.614167;46.522541;45.393916;46.223250;47.520584;48.872792;48.944750;46.885625
-wide33554431,16384,131072,16,none,bucket-sparse,1,33554196,56.527708,9,56.282083;56.527708;56.688292;56.450375;58.205833;56.590208;56.040166;56.696125;56.417125
diff --git a/dev/perf/spf_queue/results/first/sweep-heap-sparse.csv b/dev/perf/spf_queue/results/first/sweep-heap-sparse.csv
deleted file mode 100644
index 7164155..0000000
--- a/dev/perf/spf_queue/results/first/sweep-heap-sparse.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,heap-sparse,0,2,46.968625,9,47.229292;46.897250;46.189542;46.399666;48.464125;47.555375;46.968625;47.561292;46.556542
-wide31,16384,131072,16,none,heap-sparse,0,32,69.403708,9,69.283542;69.735167;69.185625;69.599000;69.889917;69.209417;69.402167;69.403708;70.222125
-wide1023,16384,131072,16,none,heap-sparse,0,1024,67.032584,9,67.360250;66.871958;67.032584;67.299542;67.001125;67.400292;68.543416;66.935334;66.819000
-wide32767,16384,131072,16,none,heap-sparse,0,32768,58.449708,9,57.046833;58.449708;59.940292;59.077958;59.057333;58.319000;58.592958;58.129917;57.809250
-wide1048575,16384,131072,16,none,heap-sparse,0,1048570,57.236042,9,57.512500;56.372916;57.242875;56.918167;57.274917;57.236042;56.913416;57.412625;57.007750
-wide33554431,16384,131072,16,none,heap-sparse,1,33554196,56.640542,9,56.641292;55.692875;55.862500;55.489417;56.796875;56.640542;56.854500;56.504375;56.956292
diff --git a/dev/perf/spf_queue/results/first/sweep-ref.csv b/dev/perf/spf_queue/results/first/sweep-ref.csv
deleted file mode 100644
index 0b8390b..0000000
--- a/dev/perf/spf_queue/results/first/sweep-ref.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,ref,0,2,43.727417,9,43.343875;44.084000;43.727417;43.741292;43.888209;43.588916;43.806583;43.654875;43.198666
-wide31,16384,131072,16,none,ref,0,32,62.112375,9,62.803250;61.927958;62.112375;61.957708;61.832417;61.767541;63.810750;68.329792;62.300042
-wide1023,16384,131072,16,none,ref,0,1024,58.154708,9,57.620875;58.266375;58.270167;57.265875;57.078750;59.170875;57.157083;58.154708;63.124917
-wide32767,16384,131072,16,none,ref,0,32768,49.973584,9,50.194417;49.654458;49.866084;49.973584;50.138500;50.410167;49.828167;49.296625;50.260250
-wide1048575,16384,131072,16,none,ref,0,1048570,48.596208,9,47.921292;48.808916;48.395167;48.596208;48.227875;48.645500;48.894667;49.038500;48.373792
-wide33554431,16384,131072,16,none,ref,1,33554196,48.868375,9,48.062459;48.759333;49.000291;48.868375;48.529750;48.639958;49.409125;48.982166;48.976000
diff --git a/dev/perf/spf_queue/results/first/time-bsort-fresh-b.csv b/dev/perf/spf_queue/results/first/time-bsort-fresh-b.csv
deleted file mode 100644
index 807378f..0000000
--- a/dev/perf/spf_queue/results/first/time-bsort-fresh-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,bsort-fresh,0,32,0.073000,9,0.079958;0.074375;0.074041;0.072541;0.072417;0.072791;0.073250;0.072875;0.073000
-random,4096,32768,256,none,bsort-fresh,0,32,127.398375,9,126.718708;125.971417;126.947417;129.972584;128.232417;128.374958;128.044166;127.398375;127.396167
-random,16384,131072,64,none,bsort-fresh,0,32,144.333333,9,144.555416;147.892875;145.481209;143.996083;144.333333;144.136167;144.596167;144.100209;143.942459
-random,65536,524288,1,none,bsort-fresh,0,32,10.920625,9,10.780291;10.920625;10.930583;10.925833;10.912958;10.827666;10.885833;11.177000;10.983875
-random,4096,131072,64,none,bsort-fresh,0,32,65.595250,9,65.367834;65.363375;64.938292;66.759000;67.187209;68.249708;67.946375;65.595250;64.582250
-clos,800,320000,64,none,bsort-fresh,0,2,126.180125,9,127.017042;126.199333;125.849000;125.754625;125.813333;126.180125;126.682042;126.612375;125.955541
-grid,10000,39600,1,none,bsort-fresh,0,2,0.392833,9,0.435875;0.402709;0.395417;0.394042;0.392833;0.389209;0.389291;0.389250;0.391500
-chain,2048,2047,1,none,bsort-fresh,0,32,0.044875,9,0.065416;0.045250;0.048167;0.045000;0.043750;0.044666;0.044708;0.044875;0.044791
-uniform,16384,131072,64,none,bsort-fresh,0,2,142.049166,9,142.963458;143.555708;140.099292;144.939667;147.514959;141.901334;142.049166;141.335459;141.541834
-random_masked,16384,131072,64,none,bsort-fresh,0,32,140.737542,9,139.656959;139.978542;141.379625;142.474875;140.737542;140.405875;141.147333;139.679375;141.383500
-pseudo,802,320200,64,fixed,bsort-fresh,0,2,130.713667,9,134.616125;131.302333;132.074667;131.003750;130.271167;130.713667;129.811250;128.510167;126.406125
-random,1024,8192,64,far,bsort-fresh,0,32,6.481416,9,6.446375;6.834125;6.495416;6.481416;6.725083;6.711584;6.344709;6.472000;6.272958
-random,16384,131072,64,far,bsort-fresh,0,32,143.584500,9,144.152958;143.569083;143.288000;144.914292;143.919625;143.357792;142.812792;144.227542;143.584500
-random,65536,524288,16,far,bsort-fresh,0,32,177.307125,9,172.243125;178.124000;174.089375;187.898458;194.189167;181.906334;177.307125;173.282583;175.041833
-random,1024,8192,64,near,bsort-fresh,0,32,0.115500,9,0.127708;0.113375;0.112916;0.111750;0.118541;0.116708;0.131792;0.115500;0.112166
-random,16384,131072,64,near,bsort-fresh,0,32,1.114708,9,1.096125;1.098250;1.114708;1.131916;1.203875;1.139833;1.164917;1.066291;1.106917
-random,65536,524288,64,near,bsort-fresh,0,32,4.342334,9,4.342334;4.513791;4.308459;4.539084;4.296958;4.536416;4.332875;4.542125;4.300667
-random,262144,2097152,16,near,bsort-fresh,0,32,4.199250,9,19.132917;19.258458;16.012125;3.874875;4.016334;4.104625;4.215708;4.122584;4.199250
-random,262144,2097152,1,none,bsort-fresh,0,32,82.487666,9,82.487666;82.558167;83.558916;82.006250;80.108042;81.022917;82.437333;87.462667;84.019958
diff --git a/dev/perf/spf_queue/results/first/time-bsort-sparse-b.csv b/dev/perf/spf_queue/results/first/time-bsort-sparse-b.csv
deleted file mode 100644
index 42185a1..0000000
--- a/dev/perf/spf_queue/results/first/time-bsort-sparse-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,bsort-sparse,0,32,0.072208,9,0.077833;0.073958;0.074833;0.072125;0.072000;0.072208;0.072333;0.071375;0.071583
-random,4096,32768,256,none,bsort-sparse,0,32,130.563333,9,130.291542;129.928333;129.826125;130.341792;132.589334;130.890375;130.563333;132.631791;133.538958
-random,16384,131072,64,none,bsort-sparse,0,32,154.019875,9,150.272541;149.183208;158.544792;154.019875;152.807500;157.225917;154.544834;152.768542;156.195500
-random,65536,524288,1,none,bsort-sparse,0,32,12.254041,9,11.671833;11.614125;11.664000;12.254041;12.390959;13.516750;12.239416;13.174959;12.510875
-random,4096,131072,64,none,bsort-sparse,0,32,66.531042,9,66.602416;66.531042;67.645250;66.783667;66.124292;66.494833;66.341375;66.474667;66.600375
-clos,800,320000,64,none,bsort-sparse,0,2,128.233625,9,127.980125;127.916459;128.161375;128.233625;128.160375;131.579125;129.286625;131.803792;130.153792
-grid,10000,39600,1,none,bsort-sparse,0,2,0.414875,9,0.424042;0.419708;0.413625;0.414875;0.412208;0.410958;0.410708;0.578292;0.429708
-chain,2048,2047,1,none,bsort-sparse,0,32,0.045375,9,0.047542;0.047834;0.047791;0.047667;0.043625;0.043500;0.043500;0.043416;0.045375
-uniform,16384,131072,64,none,bsort-sparse,0,2,140.927958,9,140.451625;140.927958;140.518625;141.233375;140.714709;146.751417;144.065209;141.193125;140.622750
-random_masked,16384,131072,64,none,bsort-sparse,0,32,147.117084,9,150.706875;160.268500;150.488166;146.747542;146.520458;146.777958;147.836209;147.117084;146.608750
-pseudo,802,320200,64,fixed,bsort-sparse,0,2,126.737125,9,130.360708;126.737125;125.585334;126.883500;126.408666;126.394500;128.847042;127.032125;126.336500
-random,1024,8192,64,far,bsort-sparse,0,32,6.427875,9,6.558666;6.515333;6.526083;6.427875;6.496250;6.376792;6.409709;6.403500;6.394375
-random,16384,131072,64,far,bsort-sparse,0,32,150.673083,9,150.673083;150.674500;151.902042;149.348292;149.884167;150.329125;150.647417;154.169167;153.845334
-random,65536,524288,16,far,bsort-sparse,0,32,185.616042,9,186.573292;184.522542;185.096875;187.703416;185.322625;185.616042;185.213666;193.822083;188.567750
-random,1024,8192,64,near,bsort-sparse,0,32,0.043000,9,0.065917;0.043125;0.043125;0.043167;0.042916;0.042833;0.043000;0.043000;0.043000
-random,16384,131072,64,near,bsort-sparse,0,32,0.393959,9,0.405375;0.395667;0.393333;0.393542;0.393959;0.393208;0.393417;0.394000;0.418083
-random,65536,524288,64,near,bsort-sparse,0,32,1.495875,9,1.513000;1.495875;1.430333;1.527417;1.487333;1.504167;1.507000;1.488542;1.487417
-random,262144,2097152,16,near,bsort-sparse,0,32,1.450708,9,1.420625;1.438834;1.450708;1.506708;1.423125;1.437542;1.453250;1.454167;1.470750
-random,262144,2097152,1,none,bsort-sparse,0,32,86.061459,9,86.686250;86.173459;86.626250;86.437875;84.282875;86.061459;84.945792;84.178333;85.198459
diff --git a/dev/perf/spf_queue/results/first/time-bucket-fresh-b.csv b/dev/perf/spf_queue/results/first/time-bucket-fresh-b.csv
deleted file mode 100644
index 5059745..0000000
--- a/dev/perf/spf_queue/results/first/time-bucket-fresh-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,bucket-fresh,0,32,0.078458,9,0.093458;0.084416;0.082417;0.076584;0.078708;0.077917;0.076000;0.078458;0.075917
-random,4096,32768,256,none,bucket-fresh,0,32,117.688709,9,117.763250;117.568541;119.826709;117.148083;116.848875;117.782000;117.688709;117.028166;118.412333
-random,16384,131072,64,none,bucket-fresh,0,32,133.422291,9,133.422291;135.131084;134.927209;134.389375;133.486125;132.716542;132.560333;133.355458;132.436375
-random,65536,524288,1,none,bucket-fresh,0,32,10.957041,9,10.897542;11.583166;10.951750;11.056250;10.957041;10.634750;10.294625;11.157000;11.140709
-random,4096,131072,64,none,bucket-fresh,0,32,64.141542,9,64.153834;64.116459;64.415125;64.283583;64.291917;64.082167;63.974250;64.141542;63.823958
-clos,800,320000,64,none,bucket-fresh,0,2,126.132042,9,126.527125;127.438167;126.097917;126.135291;124.511084;125.285209;127.010417;126.132042;125.727250
-grid,10000,39600,1,none,bucket-fresh,0,2,0.465958,9,0.481958;0.518250;0.500708;0.485542;0.445792;0.465958;0.458459;0.460042;0.458459
-chain,2048,2047,1,none,bucket-fresh,0,32,0.044875,9,0.040125;0.039916;0.039792;0.041417;0.044916;0.047375;0.045000;0.044875;0.044959
-uniform,16384,131072,64,none,bucket-fresh,0,2,142.378625,9,142.732667;142.469708;141.925417;141.230333;141.874083;141.373375;142.378625;144.852500;143.189958
-random_masked,16384,131072,64,none,bucket-fresh,0,32,130.637375,9,130.457042;130.042792;130.783042;130.637375;131.483084;129.935333;130.749792;130.790208;129.892000
-pseudo,802,320200,64,fixed,bucket-fresh,0,2,125.455083,9,126.943167;127.354084;127.369666;125.342417;124.162583;124.628250;126.541666;124.528000;125.455083
-random,1024,8192,64,far,bucket-fresh,0,32,6.255334,9,6.339792;6.285750;6.213042;6.201625;6.179083;6.276625;6.341917;6.255334;6.172750
-random,16384,131072,64,far,bucket-fresh,0,32,134.766458,9,133.359833;134.506208;135.116584;134.766458;133.574917;135.545875;134.077708;135.431416;134.812250
-random,65536,524288,16,far,bucket-fresh,0,32,162.663333,9,161.521083;163.212958;161.964459;162.663333;162.321958;162.549250;176.804958;175.382292;163.466083
-random,1024,8192,64,near,bucket-fresh,0,32,0.111042,9,0.117166;0.110916;0.111334;0.111125;0.103458;0.110916;0.111167;0.111042;0.106584
-random,16384,131072,64,near,bucket-fresh,0,32,1.190333,9,1.202959;1.218000;1.134083;1.148417;1.185709;1.190333;1.194292;1.222500;1.178833
-random,65536,524288,64,near,bucket-fresh,0,32,4.332041,9,4.265875;4.366833;4.247917;4.384917;4.282750;4.491208;4.332041;4.374708;4.267042
-random,262144,2097152,16,near,bucket-fresh,0,32,4.090291,9,3.828583;3.954084;3.899584;4.046292;4.130250;4.090291;4.241917;4.186083;4.144292
-random,262144,2097152,1,none,bucket-fresh,0,32,83.624875,9,91.434167;85.099291;87.027625;80.038375;82.772375;82.189167;89.432791;83.624875;82.109959
diff --git a/dev/perf/spf_queue/results/first/time-bucket-full-b.csv b/dev/perf/spf_queue/results/first/time-bucket-full-b.csv
deleted file mode 100644
index 538ceb5..0000000
--- a/dev/perf/spf_queue/results/first/time-bucket-full-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,bucket-full,0,32,0.074792,9,0.077917;0.075750;0.075750;0.074292;0.075417;0.074625;0.074583;0.074792;0.074333
-random,4096,32768,256,none,bucket-full,0,32,119.398208,9,119.398208;120.878167;121.197792;119.620666;119.044750;119.726625;118.877792;119.055292;118.027042
-random,16384,131072,64,none,bucket-full,0,32,133.055000,9,132.952084;133.698125;133.055000;132.576417;132.905875;132.183916;134.968292;134.945500;133.846167
-random,65536,524288,1,none,bucket-full,0,32,10.186875,9,10.190542;10.191834;10.115083;10.186875;10.053959;10.254500;10.136125;10.263666;10.180708
-random,4096,131072,64,none,bucket-full,0,32,64.248666,9,64.910709;65.125209;64.397542;64.248666;64.636667;63.902875;64.126208;64.172666;64.079292
-clos,800,320000,64,none,bucket-full,0,2,126.467500,9,126.599375;125.362625;126.467500;125.210875;126.247625;126.411750;128.020208;127.637875;126.887833
-grid,10000,39600,1,none,bucket-full,0,2,0.472750,9,0.490500;0.472750;0.471250;0.472041;0.469583;0.471792;0.475917;0.481375;0.482125
-chain,2048,2047,1,none,bucket-full,0,32,0.045209,9,0.044459;0.049250;0.044791;0.045209;0.044875;0.045292;0.054958;0.052167;0.044208
-uniform,16384,131072,64,none,bucket-full,0,2,145.564458,9,144.952791;143.328833;147.899167;146.651959;145.564458;144.691208;149.940875;145.752250;145.242666
-random_masked,16384,131072,64,none,bucket-full,0,32,131.274375,9,135.150667;131.974417;131.884375;130.784167;131.197041;132.654042;131.274375;131.134000;131.139709
-pseudo,802,320200,64,fixed,bucket-full,0,2,125.527166,9,126.696875;125.384625;125.527166;124.887125;124.589833;124.728791;128.626125;126.069667;126.432875
-random,1024,8192,64,far,bucket-full,0,32,6.198584,9,6.198584;6.652333;6.384875;6.345208;6.184625;6.220209;6.114625;6.120791;6.145667
-random,16384,131072,64,far,bucket-full,0,32,133.248250,9,132.824000;134.288167;136.456167;134.005667;133.142208;133.248250;133.024458;133.895208;132.927083
-random,65536,524288,16,far,bucket-full,0,32,163.100042,9,167.189291;163.153667;162.840500;163.100042;163.073125;163.641167;165.388459;162.862792;163.054042
-random,1024,8192,64,near,bucket-full,0,32,0.111750,9,0.112333;0.111750;0.112292;0.102667;0.108375;0.112416;0.111000;0.102417;0.111916
-random,16384,131072,64,near,bucket-full,0,32,1.309166,9,1.309166;1.320833;1.325750;1.314833;1.301125;1.302167;1.301375;1.326458;1.305167
-random,65536,524288,64,near,bucket-full,0,32,4.804834,9,4.460792;4.986750;4.804834;5.224542;4.583125;4.763250;4.781834;4.829125;4.814208
-random,262144,2097152,16,near,bucket-full,0,32,5.560917,9,5.646708;5.523042;5.358334;5.583625;5.366417;5.509125;5.560917;5.655583;5.652541
-random,262144,2097152,1,none,bucket-full,0,32,80.930042,9,82.033958;78.861125;81.416959;81.632916;81.707416;80.163083;80.265000;79.492458;80.930042
diff --git a/dev/perf/spf_queue/results/first/time-bucket-sparse-b.csv b/dev/perf/spf_queue/results/first/time-bucket-sparse-b.csv
deleted file mode 100644
index e4898a0..0000000
--- a/dev/perf/spf_queue/results/first/time-bucket-sparse-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,bucket-sparse,0,32,0.069417,9,0.073833;0.070791;0.069417;0.069167;0.068500;0.068208;0.068208;0.072083;0.075166
-random,4096,32768,256,none,bucket-sparse,0,32,122.055459,9,122.239000;121.626000;121.953875;121.374791;123.540416;122.909333;122.823917;121.561042;122.055459
-random,16384,131072,64,none,bucket-sparse,0,32,140.305917,9,140.002792;140.915750;141.959167;139.621583;140.114750;140.479542;140.596666;140.305917;139.659000
-random,65536,524288,1,none,bucket-sparse,0,32,10.681958,9,10.657250;10.608375;10.681958;10.690167;10.477083;10.461584;10.873584;12.338417;11.963750
-random,4096,131072,64,none,bucket-sparse,0,32,65.799209,9,65.799209;65.483625;65.478167;65.776875;66.112542;65.268375;66.647750;67.733209;67.061167
-clos,800,320000,64,none,bucket-sparse,0,2,127.859500,9,127.814458;126.084333;125.578083;127.859500;129.214167;128.186167;127.734041;128.022083;131.675041
-grid,10000,39600,1,none,bucket-sparse,0,2,0.497208,9,0.497417;0.496833;0.535958;0.512917;0.497208;0.490792;0.489250;0.496250;0.501875
-chain,2048,2047,1,none,bucket-sparse,0,32,0.044541,9,0.044166;0.044541;0.044792;0.044875;0.043875;0.040167;0.044000;0.044709;0.044833
-uniform,16384,131072,64,none,bucket-sparse,0,2,140.725750,9,140.679042;140.899333;140.650959;140.534083;143.067333;141.098916;140.725750;140.329209;141.557458
-random_masked,16384,131072,64,none,bucket-sparse,0,32,138.444792,9,137.654583;138.033375;139.399875;137.454083;139.411583;138.656625;140.437916;138.444792;137.928167
-pseudo,802,320200,64,fixed,bucket-sparse,0,2,127.199916,9,127.469500;126.634000;126.764916;127.199916;126.949334;126.892792;127.591084;127.256125;127.498833
-random,1024,8192,64,far,bucket-sparse,0,32,6.545583,9,6.714750;6.495500;6.545583;6.496458;6.496833;6.469416;6.560708;6.591291;6.639250
-random,16384,131072,64,far,bucket-sparse,0,32,140.847709,9,140.817500;144.266000;140.847709;140.950125;140.655417;141.417417;140.807834;140.897667;140.688000
-random,65536,524288,16,far,bucket-sparse,0,32,176.071583,9,174.404500;173.780334;176.126125;175.394916;174.731542;207.892875;177.738708;176.071583;177.683416
-random,1024,8192,64,near,bucket-sparse,0,32,0.043500,9,0.051000;0.044833;0.043958;0.044500;0.043500;0.043167;0.038750;0.043416;0.043208
-random,16384,131072,64,near,bucket-sparse,0,32,0.393292,9,0.393458;0.393208;0.394791;0.393292;0.393250;0.393375;0.395333;0.392917;0.392709
-random,65536,524288,64,near,bucket-sparse,0,32,1.488667,9,1.476667;1.489542;1.501916;1.490959;1.503042;1.488625;1.488667;1.420125;1.457042
-random,262144,2097152,16,near,bucket-sparse,0,32,1.448875,9,1.507625;1.487041;1.448875;1.448041;1.456500;1.461791;1.438708;1.408958;1.411375
-random,262144,2097152,1,none,bucket-sparse,0,32,87.025667,9,88.228625;88.995625;89.278125;86.785542;85.460000;87.117750;87.025000;86.052083;87.025667
diff --git a/dev/perf/spf_queue/results/first/time-heap-fresh-b.csv b/dev/perf/spf_queue/results/first/time-heap-fresh-b.csv
deleted file mode 100644
index c7f0a9d..0000000
--- a/dev/perf/spf_queue/results/first/time-heap-fresh-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,heap-fresh,0,32,0.115375,9,0.135375;0.116291;0.120250;0.116500;0.113917;0.110208;0.114250;0.115084;0.115375
-random,4096,32768,256,none,heap-fresh,0,32,223.834916,9,224.898208;224.539834;224.930084;222.888125;222.325041;223.091583;221.774625;224.744125;223.834916
-random,16384,131072,64,none,heap-fresh,0,32,265.681750,9,266.057250;262.723041;265.681750;265.032292;264.191792;271.088500;266.109166;263.244750;269.137166
-random,65536,524288,1,none,heap-fresh,0,32,19.683459,9,19.345209;19.499500;20.155625;20.074083;19.409083;19.608167;19.887625;19.941041;19.683459
-random,4096,131072,64,none,heap-fresh,0,32,113.862791,9,114.006792;113.152833;113.679917;113.862791;115.032583;114.331750;113.343167;114.297083;113.528666
-clos,800,320000,64,none,heap-fresh,0,2,133.167417,9,134.150583;134.728791;135.087416;132.998625;132.928084;134.091042;133.023917;133.167417;132.971333
-grid,10000,39600,1,none,heap-fresh,0,2,0.689458,9,0.712083;0.697250;0.709292;0.689458;0.686583;0.683166;0.679958;0.682000;0.691167
-chain,2048,2047,1,none,heap-fresh,0,32,0.023542,9,0.023708;0.023750;0.023500;0.023792;0.023459;0.023458;0.023500;0.023666;0.023542
-uniform,16384,131072,64,none,heap-fresh,0,2,183.190666,9,181.771166;182.520459;184.364584;181.516292;183.190666;189.134792;183.239958;190.424542;183.068458
-random_masked,16384,131072,64,none,heap-fresh,0,32,242.620042,9,243.224625;251.311000;241.052000;241.867042;242.354042;250.248167;243.503416;241.469541;242.620042
-pseudo,802,320200,64,fixed,heap-fresh,0,2,133.608041,9,134.581458;133.274083;133.141459;132.606250;134.189167;133.608041;132.927208;136.439583;135.795666
-random,1024,8192,64,far,heap-fresh,0,32,11.316167,9,11.444291;11.045375;11.190875;11.316167;11.364459;11.323000;11.470167;11.278541;11.179041
-random,16384,131072,64,far,heap-fresh,0,32,266.656375,9,266.065000;263.982750;266.656375;270.425500;269.786708;266.468000;265.333458;268.683750;271.332375
-random,65536,524288,16,far,heap-fresh,0,32,326.680791,9,329.341125;326.680791;326.758208;321.000542;335.756333;326.244750;323.910042;340.101375;324.130500
-random,1024,8192,64,near,heap-fresh,0,32,0.107708,9,0.149875;0.118667;0.100459;0.107375;0.108125;0.107708;0.102208;0.107541;0.108417
-random,16384,131072,64,near,heap-fresh,0,32,1.120875,9,1.115834;1.116750;1.131292;1.120875;1.117917;1.148708;1.117417;1.132916;1.144584
-random,65536,524288,64,near,heap-fresh,0,32,4.239500,9,4.239500;4.149917;4.355250;4.177916;4.380166;4.192875;4.372500;4.234792;4.392750
-random,262144,2097152,16,near,heap-fresh,0,32,18.921708,9,18.899709;18.846708;19.207000;18.773125;18.921708;18.525292;19.286667;19.227375;19.109542
-random,262144,2097152,1,none,heap-fresh,0,32,128.563542,9,128.563542;129.742458;130.436708;130.550250;129.716083;127.658042;128.143750;127.020417;127.533833
diff --git a/dev/perf/spf_queue/results/first/time-heap-full-b.csv b/dev/perf/spf_queue/results/first/time-heap-full-b.csv
deleted file mode 100644
index ff3653c..0000000
--- a/dev/perf/spf_queue/results/first/time-heap-full-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,heap-full,0,32,0.118166,9,0.146458;0.119167;0.118291;0.118166;0.115708;0.110000;0.114708;0.118625;0.114792
-random,4096,32768,256,none,heap-full,0,32,225.395542,9,228.126834;225.598041;226.784417;224.466333;225.105541;223.834291;229.336083;225.395542;224.983000
-random,16384,131072,64,none,heap-full,0,32,265.663667,9,265.335083;264.208125;265.271333;265.663667;270.274833;266.530500;266.512042;265.724917;265.575583
-random,65536,524288,1,none,heap-full,0,32,19.883583,9,20.028709;19.561417;20.049292;19.653542;20.800750;19.901500;19.473959;19.149125;19.883583
-random,4096,131072,64,none,heap-full,0,32,114.433792,9,114.462042;113.903833;114.012792;113.931000;114.783792;113.315125;116.039125;115.399625;114.433792
-clos,800,320000,64,none,heap-full,0,2,135.741666,9,135.116917;134.591250;135.741666;135.747500;137.683500;134.934209;135.111292;136.439125;136.778917
-grid,10000,39600,1,none,heap-full,0,2,0.666084,9,0.686292;0.695459;0.687708;0.668750;0.666084;0.652834;0.655833;0.664750;0.651542
-chain,2048,2047,1,none,heap-full,0,32,0.024042,9,0.024125;0.024000;0.024042;0.024166;0.024000;0.024166;0.024000;0.024042;0.023917
-uniform,16384,131072,64,none,heap-full,0,2,186.434333,9,186.382125;187.959625;187.210125;186.661417;186.400625;186.434333;185.308791;186.939208;186.230500
-random_masked,16384,131072,64,none,heap-full,0,32,242.225833,9,243.238083;241.939542;240.649917;243.730625;242.225833;241.985083;242.513833;242.397167;241.178917
-pseudo,802,320200,64,fixed,heap-full,0,2,135.039292,9,136.127209;133.944250;134.869292;135.412083;135.039292;136.334667;134.849584;135.085750;134.163375
-random,1024,8192,64,far,heap-full,0,32,11.354459,9,11.433541;11.354459;11.310458;11.410833;11.384834;11.358375;11.285875;11.261625;11.155958
-random,16384,131072,64,far,heap-full,0,32,266.233750,9,270.825250;270.773958;265.282750;266.282667;266.233750;265.749042;267.558791;264.842958;266.230209
-random,65536,524288,16,far,heap-full,0,32,326.155042,9,326.112541;326.155042;324.624875;328.796792;338.246416;326.962750;329.384750;325.279000;325.245000
-random,1024,8192,64,near,heap-full,0,32,0.111833,9,0.115042;0.111333;0.112917;0.111833;0.112875;0.108791;0.112125;0.111584;0.100958
-random,16384,131072,64,near,heap-full,0,32,1.321000,9,1.307833;1.309541;1.333500;1.328000;1.316583;1.303833;1.358750;1.322084;1.321000
-random,65536,524288,64,near,heap-full,0,32,4.666167,9,4.680125;4.746792;4.687000;4.710875;4.567125;4.445833;4.520084;4.598542;4.666167
-random,262144,2097152,16,near,heap-full,0,32,4.416333,9,4.437667;4.416333;4.343000;4.427208;4.405584;4.448750;4.410709;4.395916;4.423042
-random,262144,2097152,1,none,heap-full,0,32,133.189250,9,132.078166;154.603666;138.514625;134.731917;133.189250;132.093292;133.728792;132.005875;130.611875
diff --git a/dev/perf/spf_queue/results/first/time-heap-sparse-b.csv b/dev/perf/spf_queue/results/first/time-heap-sparse-b.csv
deleted file mode 100644
index e0779bf..0000000
--- a/dev/perf/spf_queue/results/first/time-heap-sparse-b.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,heap-sparse,0,32,0.117333,9,0.130291;0.124250;0.121584;0.114292;0.117333;0.118042;0.116625;0.116834;0.112292
-random,4096,32768,256,none,heap-sparse,0,32,229.792625,9,229.388833;230.305875;231.628292;230.546042;229.461750;229.950458;228.498667;229.238584;229.792625
-random,16384,131072,64,none,heap-sparse,0,32,276.181541,9,279.428708;277.561000;276.181541;275.323584;278.222333;275.489833;274.415166;276.176833;276.760000
-random,65536,524288,1,none,heap-sparse,0,32,21.996833,9,21.128708;21.069625;20.960500;21.339375;22.240083;22.326084;24.122875;22.688334;21.996833
-random,4096,131072,64,none,heap-sparse,0,32,116.661125,9,117.081084;117.246125;117.409959;116.661125;115.278166;116.601917;115.869209;116.179458;116.846666
-clos,800,320000,64,none,heap-sparse,0,2,136.225542,9,135.596375;134.843917;137.157458;136.865917;138.362334;135.601875;136.225542;136.789542;134.530292
-grid,10000,39600,1,none,heap-sparse,0,2,0.707875,9,0.731333;0.707875;0.691917;0.692833;0.686791;0.682042;0.830041;0.820875;0.843250
-chain,2048,2047,1,none,heap-sparse,0,32,0.027833,9,0.027750;0.032125;0.027833;0.030542;0.028041;0.115791;0.024167;0.023709;0.024167
-uniform,16384,131072,64,none,heap-sparse,0,2,184.445750,9,183.342291;184.445750;184.596791;183.134708;183.946209;182.170375;184.866542;185.646792;186.874458
-random_masked,16384,131072,64,none,heap-sparse,0,32,251.644875,9,250.169625;249.810584;250.236708;252.644666;254.517125;258.871958;254.390125;251.196209;251.644875
-pseudo,802,320200,64,fixed,heap-sparse,0,2,136.496834,9,136.217500;136.784500;137.803792;136.429167;136.496834;135.609042;136.616375;135.702375;138.337834
-random,1024,8192,64,far,heap-sparse,0,32,11.728833,9,11.823709;11.680708;11.769959;11.700625;11.871875;11.755625;11.670667;11.596583;11.728833
-random,16384,131072,64,far,heap-sparse,0,32,276.217541,9,276.196792;276.217541;275.599250;276.902334;277.647209;276.274125;284.605208;275.271625;274.206834
-random,65536,524288,16,far,heap-sparse,0,32,331.986958,9,339.849750;338.197000;329.244917;331.144125;331.986958;329.266792;332.546125;342.616583;330.256208
-random,1024,8192,64,near,heap-sparse,0,32,0.040208,9,0.047250;0.040208;0.040750;0.037333;0.037959;0.040042;0.040209;0.040208;0.040208
-random,16384,131072,64,near,heap-sparse,0,32,0.385916,9,0.386458;0.395208;0.403959;0.385916;0.415292;0.360208;0.351250;0.381875;0.363916
-random,65536,524288,64,near,heap-sparse,0,32,1.486333,9,1.472916;1.488500;1.480625;1.486333;1.494833;1.479833;1.481375;1.495417;1.489333
-random,262144,2097152,16,near,heap-sparse,0,32,1.460417,9,1.436792;1.463291;1.460417;1.442041;1.469333;1.442625;1.458000;1.467083;1.467917
-random,262144,2097152,1,none,heap-sparse,0,32,137.015333,9,134.901125;140.954125;143.564417;137.015333;143.781125;143.934167;136.714000;134.648500;133.846833
diff --git a/dev/perf/spf_queue/results/first/time-ref-a1.csv b/dev/perf/spf_queue/results/first/time-ref-a1.csv
deleted file mode 100644
index 0b656c2..0000000
--- a/dev/perf/spf_queue/results/first/time-ref-a1.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.100625,9,0.100084;0.100625;0.113375;0.094750;0.101875;0.115375;0.109708;0.095333;0.095792
-random,4096,32768,256,none,ref,0,32,198.718250,9,197.933375;197.190208;195.268000;199.687250;205.407833;198.453000;198.718250;199.052333;199.647459
-random,16384,131072,64,none,ref,0,32,238.755083,9,238.755083;235.413583;238.942375;237.525208;235.592584;239.616750;240.090875;240.277500;237.924625
-random,65536,524288,1,none,ref,0,32,18.375666,9,18.342500;18.308292;18.375666;18.354417;17.978417;18.898875;18.709833;21.097667;19.911959
-random,4096,131072,64,none,ref,0,32,106.741584,9,106.072083;106.741584;105.991084;107.077666;107.519958;106.421125;107.008459;107.891375;105.394958
-clos,800,320000,64,none,ref,0,2,142.105167,9,142.505333;142.222834;141.403875;142.105167;140.911792;141.648084;141.805625;142.577541;142.248125
-grid,10000,39600,1,none,ref,0,2,0.614125,9,0.629125;0.630625;0.621958;0.620959;0.614125;0.607250;0.606917;0.602959;0.603291
-chain,2048,2047,1,none,ref,0,32,0.020833,9,0.022250;0.026583;0.045542;0.021500;0.020833;0.020709;0.020750;0.020667;0.020750
-uniform,16384,131072,64,none,ref,0,2,170.249750,9,168.616459;168.656292;170.249750;170.986333;172.660916;172.197834;167.438625;171.170375;168.618917
-random_masked,16384,131072,64,none,ref,0,32,219.464666,9,216.439000;220.720375;219.626583;219.428917;221.002208;220.503125;216.853333;219.464666;219.259125
-pseudo,802,320200,64,fixed,ref,0,2,140.618958,9,140.512042;140.764125;141.042750;138.901291;140.618958;140.345292;139.922334;142.146583;142.305542
-random,1024,8192,64,far,ref,0,32,10.129084,9,10.252625;10.129084;10.263500;10.034291;9.965875;10.187417;9.917250;10.094625;10.151000
-random,16384,131072,64,far,ref,0,32,240.012083,9,239.525250;239.438250;241.082250;240.157208;242.569167;239.640250;240.012083;241.302292;238.371542
-random,65536,524288,16,far,ref,0,32,289.354125,9,292.384500;302.566458;289.184583;290.246875;288.628292;289.354125;285.801458;288.569916;289.974167
-random,1024,8192,64,near,ref,0,32,0.104666,9,0.104666;0.101875;0.102208;0.115333;0.102042;0.113416;0.112625;0.111500;0.099667
-random,16384,131072,64,near,ref,0,32,1.044334,9,0.998958;1.029041;1.039625;1.044334;1.030583;1.056791;1.046792;1.069291;1.064209
-random,65536,524288,64,near,ref,0,32,4.034208,9,3.985625;4.076125;3.991750;4.027791;4.034208;4.034833;4.035667;4.096250;4.005333
-random,262144,2097152,16,near,ref,0,32,3.871542,9,3.840209;3.836792;3.842625;3.912084;3.873375;3.898500;3.871542;3.867917;3.907875
-random,262144,2097152,1,none,ref,0,32,119.703333,9,121.781375;119.108459;118.500666;120.011333;119.737667;122.042291;119.297917;118.898958;119.703333
diff --git a/dev/perf/spf_queue/results/first/time-ref-a2.csv b/dev/perf/spf_queue/results/first/time-ref-a2.csv
deleted file mode 100644
index 948912b..0000000
--- a/dev/perf/spf_queue/results/first/time-ref-a2.csv
+++ /dev/null
@@ -1,20 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,1024,8192,1,none,ref,0,32,0.104208,9,0.111125;0.100583;0.110625;0.105583;0.103792;0.100542;0.103708;0.106417;0.104208
-random,4096,32768,256,none,ref,0,32,205.803292,9,207.161417;204.300125;205.676917;205.803292;207.224167;205.854417;206.188916;204.471167;205.455292
-random,16384,131072,64,none,ref,0,32,245.574917,9,246.231958;250.732666;245.339292;245.376208;245.066250;245.574917;247.844667;245.871292;245.273291
-random,65536,524288,1,none,ref,0,32,19.633375,9,19.437083;18.434834;18.742708;19.423083;19.633375;20.104666;20.097833;20.449042;19.730208
-random,4096,131072,64,none,ref,0,32,109.030458,9,109.414000;108.868500;108.683666;109.278042;109.245667;109.650583;109.021959;109.030458;108.857542
-clos,800,320000,64,none,ref,0,2,143.648375,9,143.608167;143.648375;142.897167;141.598667;145.929375;145.318334;145.996750;142.662042;143.719000
-grid,10000,39600,1,none,ref,0,2,0.621917,9,0.638042;0.621250;0.621917;0.629333;0.611333;0.618750;0.617416;0.636459;0.634125
-chain,2048,2047,1,none,ref,0,32,0.020583,9,0.020625;0.020375;0.020542;0.020584;0.020708;0.020583;0.020583;0.020542;0.020584
-uniform,16384,131072,64,none,ref,0,2,175.401208,9,175.401208;174.853709;174.902833;176.983417;175.576708;175.084000;174.032000;177.454708;176.266458
-random_masked,16384,131072,64,none,ref,0,32,225.265708,9,224.450417;225.327166;224.965458;225.131000;224.263917;225.615750;226.301708;227.413958;225.265708
-pseudo,802,320200,64,fixed,ref,0,2,142.151958,9,143.465209;142.830625;142.089583;141.701500;142.102959;142.151958;143.083291;141.934459;142.653250
-random,1024,8192,64,far,ref,0,32,10.432500,9,10.424959;10.307958;10.458000;10.432500;10.516459;10.506750;10.504625;10.343583;10.309125
-random,16384,131072,64,far,ref,0,32,246.256583,9,245.007042;246.015000;246.830125;245.896333;245.123167;246.953958;247.596042;248.142625;246.256583
-random,65536,524288,16,far,ref,0,32,299.940042,9,302.783792;297.925292;312.234125;303.503083;300.796917;297.393250;299.940042;297.575833;299.894000
-random,1024,8192,64,near,ref,0,32,0.120042,9,0.133000;0.118916;0.120667;0.117375;0.129250;0.120042;0.120416;0.119792;0.118791
-random,16384,131072,64,near,ref,0,32,1.170917,9,1.152417;1.192917;1.163625;1.170917;1.172084;1.167875;1.174625;1.188250;1.153333
-random,65536,524288,64,near,ref,0,32,4.207375,9,4.285375;4.206917;4.205583;4.207375;4.201167;4.213958;4.213542;4.165792;4.244750
-random,262144,2097152,16,near,ref,0,32,3.996708,9,3.968250;4.090666;3.967375;4.077625;3.996375;3.976584;3.996708;4.000083;4.050416
-random,262144,2097152,1,none,ref,0,32,125.213500,9,129.476167;123.631583;125.867208;125.910000;125.753333;125.213500;125.165250;124.951542;121.767417
diff --git a/dev/perf/spf_queue/results/netgraph/a1-old.csv b/dev/perf/spf_queue/results/netgraph/a1-old.csv
deleted file mode 100644
index ca2a577..0000000
--- a/dev/perf/spf_queue/results/netgraph/a1-old.csv
+++ /dev/null
@@ -1,17 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,a1-old,0.214242,5,946e7cf8b5a36980,0.215061;0.216031;0.213735;0.214242;0.212930
-spf_full_grid_100x100_weighted,a1-old,0.220778,5,4c2f7751ff9a5057,0.220560;0.220778;0.220257;0.221003;0.221978
-maxflow_clos_200x200_combine,a1-old,0.052564,5,2576c34f1fd9b85e,0.053311;0.053040;0.052564;0.052143;0.051846
-maxflow_failures_clos_100x100_x100,a1-old,0.044261,5,26dc7541b17fd051,0.044064;0.044782;0.044379;0.043525;0.044261
-maxflow_grid_100x100_weighted_combine,a1-old,0.202941,5,b0453b641647871b,0.202895;0.206061;0.205235;0.202941;0.202883
-maxflow_grid_100x100_weighted_pairwise,a1-old,0.203949,5,4fc2486a01221d75,0.205356;0.205253;0.172211;0.203949;0.200981
-placement_backbone_clos,a1-old,0.069218,5,a3bbef71a61656e1,0.069218;0.067452;0.067574;0.070175;0.071420
-placement_mc_backbone_clos_x300,a1-old,0.074473,5,13b9a5f311b911a9,0.077150;0.074793;0.073446;0.074473;0.073984
-maxflow_mc_backbone_clos_x300,a1-old,0.029282,5,ac971ec1b53a4b0a,0.029265;0.029166;0.029931;0.029314;0.029282
-ksp_clos3_pairwise_k8,a1-old,0.054646,5,9bf30f2f50792fe9,0.053493;0.053920;0.056333;0.054646;0.056298
-maxflow_clos3_pod_pairs_combine,a1-old,0.167483,5,2e23a5712f361ff7,0.167694;0.167483;0.197351;0.162379;0.163569
-placement_clos3_wcmp_and_ecmp,a1-old,0.366377,5,14d7ba5534c9ce95,0.370620;0.366377;0.372593;0.365110;0.333473
-placement_clos3_failures_x20,a1-old,7.646194,5,eafa50e144281360,7.614464;7.688954;7.711631;7.610305;7.646194
-scenario_square_mesh_iter100,a1-old,0.010309,5,5046cbe45e195f6e,0.009954;0.010309;0.010277;0.010874;0.010464
-scenario_nsfnet_iter200,a1-old,0.958151,5,d966e67ffac4393c,0.965309;0.958151;0.947347;0.993366;0.944487
-scenario_backbone_clos_iter100,a1-old,0.082340,5,e904ac0839c6cac1,0.082945;0.084257;0.082340;0.081514;0.082249
diff --git a/dev/perf/spf_queue/results/netgraph/a2-old.csv b/dev/perf/spf_queue/results/netgraph/a2-old.csv
deleted file mode 100644
index 08b21fd..0000000
--- a/dev/perf/spf_queue/results/netgraph/a2-old.csv
+++ /dev/null
@@ -1,17 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,a2-old,0.212650,5,946e7cf8b5a36980,0.213604;0.213158;0.212128;0.212650;0.211883
-spf_full_grid_100x100_weighted,a2-old,0.220314,5,4c2f7751ff9a5057,0.219253;0.221249;0.220314;0.222180;0.219875
-maxflow_clos_200x200_combine,a2-old,0.051853,5,2576c34f1fd9b85e,0.052104;0.051853;0.052154;0.051545;0.051553
-maxflow_failures_clos_100x100_x100,a2-old,0.043021,5,26dc7541b17fd051,0.043132;0.043212;0.042954;0.042811;0.043021
-maxflow_grid_100x100_weighted_combine,a2-old,0.202080,5,b0453b641647871b,0.203003;0.202080;0.202227;0.202046;0.201641
-maxflow_grid_100x100_weighted_pairwise,a2-old,0.200578,5,4fc2486a01221d75,0.202322;0.200159;0.177585;0.204723;0.200578
-placement_backbone_clos,a2-old,0.067439,5,a3bbef71a61656e1,0.067937;0.067139;0.067662;0.067130;0.067439
-placement_mc_backbone_clos_x300,a2-old,0.075278,5,13b9a5f311b911a9,0.075415;0.074549;0.074713;0.075430;0.075278
-maxflow_mc_backbone_clos_x300,a2-old,0.029137,5,ac971ec1b53a4b0a,0.029212;0.029137;0.029388;0.029131;0.029046
-ksp_clos3_pairwise_k8,a2-old,0.053399,5,9bf30f2f50792fe9,0.053732;0.053322;0.054482;0.053399;0.053396
-maxflow_clos3_pod_pairs_combine,a2-old,0.166107,5,2e23a5712f361ff7,0.161893;0.166107;0.198977;0.167306;0.163009
-placement_clos3_wcmp_and_ecmp,a2-old,0.363318,5,14d7ba5534c9ce95,0.362654;0.363394;0.363318;0.363318;0.330417
-placement_clos3_failures_x20,a2-old,7.547826,5,eafa50e144281360,7.463701;7.512790;7.602702;7.609344;7.547826
-scenario_square_mesh_iter100,a2-old,0.010336,5,5046cbe45e195f6e,0.009918;0.010012;0.010376;0.010627;0.010336
-scenario_nsfnet_iter200,a2-old,0.939100,5,d966e67ffac4393c,0.945634;0.934857;0.927139;0.974911;0.939100
-scenario_backbone_clos_iter100,a2-old,0.081112,5,e904ac0839c6cac1,0.082197;0.081385;0.081112;0.080830;0.080991
diff --git a/dev/perf/spf_queue/results/netgraph/b-new-heap.csv b/dev/perf/spf_queue/results/netgraph/b-new-heap.csv
deleted file mode 100644
index 7345cd3..0000000
--- a/dev/perf/spf_queue/results/netgraph/b-new-heap.csv
+++ /dev/null
@@ -1,17 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,b-new-heap,0.164632,5,946e7cf8b5a36980,0.171094;0.163302;0.164001;0.164632;0.165386
-spf_full_grid_100x100_weighted,b-new-heap,0.245422,5,4c2f7751ff9a5057,0.245311;0.244615;0.246294;0.245422;0.247913
-maxflow_clos_200x200_combine,b-new-heap,0.046796,5,2576c34f1fd9b85e,0.046604;0.046809;0.046796;0.046520;0.047011
-maxflow_failures_clos_100x100_x100,b-new-heap,0.039282,5,26dc7541b17fd051,0.039282;0.040234;0.038893;0.039675;0.038654
-maxflow_grid_100x100_weighted_combine,b-new-heap,0.219054,5,b0453b641647871b,0.217967;0.219054;0.218718;0.224953;0.221065
-maxflow_grid_100x100_weighted_pairwise,b-new-heap,0.212886,5,4fc2486a01221d75,0.212886;0.220461;0.186507;0.211249;0.216741
-placement_backbone_clos,b-new-heap,0.068715,5,a3bbef71a61656e1,0.068128;0.067605;0.072257;0.071829;0.068715
-placement_mc_backbone_clos_x300,b-new-heap,0.071399,5,13b9a5f311b911a9,0.072645;0.071349;0.071399;0.071738;0.070936
-maxflow_mc_backbone_clos_x300,b-new-heap,0.029019,5,ac971ec1b53a4b0a,0.029019;0.028594;0.028178;0.029278;0.031190
-ksp_clos3_pairwise_k8,b-new-heap,0.046233,5,9bf30f2f50792fe9,0.046716;0.046282;0.046233;0.045945;0.045440
-maxflow_clos3_pod_pairs_combine,b-new-heap,0.171827,5,2e23a5712f361ff7,0.171827;0.174949;0.201334;0.167000;0.164015
-placement_clos3_wcmp_and_ecmp,b-new-heap,0.368871,5,14d7ba5534c9ce95,0.368871;0.363981;0.374026;0.375693;0.334427
-placement_clos3_failures_x20,b-new-heap,7.570639,5,eafa50e144281360,7.638405;7.570639;7.578404;7.479565;7.433718
-scenario_square_mesh_iter100,b-new-heap,0.009861,5,5046cbe45e195f6e,0.009619;0.009698;0.009861;0.009916;0.009878
-scenario_nsfnet_iter200,b-new-heap,0.912169,5,d966e67ffac4393c,0.918451;0.912169;0.909963;0.962305;0.906028
-scenario_backbone_clos_iter100,b-new-heap,0.077625,5,e904ac0839c6cac1,0.077511;0.077981;0.077051;0.078228;0.077625
diff --git a/dev/perf/spf_queue/results/netgraph/b-new.csv b/dev/perf/spf_queue/results/netgraph/b-new.csv
deleted file mode 100644
index 335acf4..0000000
--- a/dev/perf/spf_queue/results/netgraph/b-new.csv
+++ /dev/null
@@ -1,17 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,b-new,0.163387,5,946e7cf8b5a36980,0.163696;0.163391;0.163122;0.163197;0.163387
-spf_full_grid_100x100_weighted,b-new,0.181652,5,4c2f7751ff9a5057,0.181652;0.182234;0.180117;0.180609;0.181705
-maxflow_clos_200x200_combine,b-new,0.047118,5,2576c34f1fd9b85e,0.047558;0.046946;0.047023;0.047830;0.047118
-maxflow_failures_clos_100x100_x100,b-new,0.040410,5,26dc7541b17fd051,0.040004;0.040410;0.040879;0.040360;0.040449
-maxflow_grid_100x100_weighted_combine,b-new,0.174551,5,b0453b641647871b,0.177566;0.174597;0.174551;0.170893;0.173684
-maxflow_grid_100x100_weighted_pairwise,b-new,0.208183,5,4fc2486a01221d75,0.211970;0.206165;0.176239;0.208183;0.208189
-placement_backbone_clos,b-new,0.069022,5,a3bbef71a61656e1,0.069022;0.069117;0.067956;0.067765;0.072885
-placement_mc_backbone_clos_x300,b-new,0.067803,5,13b9a5f311b911a9,0.069155;0.067885;0.067111;0.066996;0.067803
-maxflow_mc_backbone_clos_x300,b-new,0.027553,5,ac971ec1b53a4b0a,0.028108;0.027674;0.027451;0.027553;0.027179
-ksp_clos3_pairwise_k8,b-new,0.046303,5,9bf30f2f50792fe9,0.046303;0.045928;0.047188;0.046233;0.046584
-maxflow_clos3_pod_pairs_combine,b-new,0.168243,5,2e23a5712f361ff7,0.167244;0.168132;0.199066;0.168243;0.172598
-placement_clos3_wcmp_and_ecmp,b-new,0.376317,5,14d7ba5534c9ce95,0.378218;0.372257;0.377731;0.376317;0.338946
-placement_clos3_failures_x20,b-new,7.639934,5,eafa50e144281360,7.639045;7.660284;7.732032;7.616304;7.639934
-scenario_square_mesh_iter100,b-new,0.009892,5,5046cbe45e195f6e,0.009892;0.009624;0.009909;0.009814;0.010528
-scenario_nsfnet_iter200,b-new,0.929637,5,d966e67ffac4393c,0.939539;0.929637;0.925644;0.978736;0.926841
-scenario_backbone_clos_iter100,b-new,0.078271,5,e904ac0839c6cac1,0.078327;0.078636;0.078104;0.077679;0.078271
diff --git a/dev/perf/spf_queue/results/netgraph/environment.txt b/dev/perf/spf_queue/results/netgraph/environment.txt
deleted file mode 100644
index 014b006..0000000
--- a/dev/perf/spf_queue/results/netgraph/environment.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-date: 2026-10-02T01:56:58Z
-new: fbab119e794c843838f4f3f96d75cb7f32f06845 (dirty: 14 paths)
-old: fbab119e794c843838f4f3f96d75cb7f32f06845
-netgraph: 775530768eec3951b7aec738f7e99d1abb6b7efc
-dd3b394c0ba16f7ed0e0e403188f4fcc38dbd9ce2cf594368d2b2a8a19a105a0  dev/perf/spf_queue/bench_netgraph.py
-9d684e1280714cd8d4b275c418b34cf936e0b340243612bfab40913bbe60610c  /Users/networmix/ws/NetGraph-Core/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-91dc3b7e2bd3611d54d762e0fb1f875881138d66843866990f019cddfec5cc2c  /Users/networmix/ws/NetGraph-Core-main/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-Apple M4 Max
diff --git a/dev/perf/spf_queue/results/netgraph/hashseed-determinism.txt b/dev/perf/spf_queue/results/netgraph/hashseed-determinism.txt
deleted file mode 100644
index 2f2a1e1..0000000
--- a/dev/perf/spf_queue/results/netgraph/hashseed-determinism.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-new maxflow_mc_backbone_clos_x300 ac971ec1b53a4b0a
-old1 maxflow_mc_backbone_clos_x300 ac971ec1b53a4b0a
-old2 maxflow_mc_backbone_clos_x300 ac971ec1b53a4b0a
-new placement_mc_backbone_clos_x300 13b9a5f311b911a9
-old1 placement_mc_backbone_clos_x300 13b9a5f311b911a9
-old2 placement_mc_backbone_clos_x300 13b9a5f311b911a9
-new scenario_backbone_clos_iter100 e904ac0839c6cac1
-old1 scenario_backbone_clos_iter100 e904ac0839c6cac1
-old2 scenario_backbone_clos_iter100 e904ac0839c6cac1
diff --git a/dev/perf/spf_queue/results/netgraph/load.txt b/dev/perf/spf_queue/results/netgraph/load.txt
deleted file mode 100644
index 8adfc14..0000000
--- a/dev/perf/spf_queue/results/netgraph/load.txt
+++ /dev/null
@@ -1,5 +0,0 @@
- 2:56  up 52 days,  7:32, 3 users, load averages: 3.81 4.06 3.70
- 2:58  up 52 days,  7:33, 3 users, load averages: 5.32 4.48 3.88
- 2:59  up 52 days,  7:34, 3 users, load averages: 4.18 4.30 3.85
- 3:00  up 52 days,  7:35, 3 users, load averages: 4.64 4.42 3.93
- 3:01  up 52 days,  7:36, 3 users, load averages: 3.82 4.20 3.87
diff --git a/dev/perf/spf_queue/results/short/environment.txt b/dev/perf/spf_queue/results/short/environment.txt
deleted file mode 100644
index 65f8240..0000000
--- a/dev/perf/spf_queue/results/short/environment.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-date: 2026-09-27T13:41:37Z
-30748a1034498f6a2bd05645f72b60750f3ef366c81476fd3f87bbac93c1a381  dev/perf/spf_queue/spf_variants.hpp
-cecf8edfd17c19624890ba8c6bc2fa647d7841c25baaebeaaa175712ceebf688  dev/perf/spf_queue/harness.cpp
diff --git a/dev/perf/spf_queue/results/short/load.txt b/dev/perf/spf_queue/results/short/load.txt
deleted file mode 100644
index 0abff49..0000000
--- a/dev/perf/spf_queue/results/short/load.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-14:41  up 47 days, 19:17, 3 users, load averages: 3.46 3.26 3.16
-14:41  up 47 days, 19:17, 3 users, load averages: 3.34 3.23 3.15
-14:41  up 47 days, 19:17, 3 users, load averages: 3.23 3.21 3.14
-14:41  up 47 days, 19:17, 3 users, load averages: 3.06 3.18 3.13
-14:42  up 47 days, 19:17, 3 users, load averages: 2.89 3.14 3.12
-14:42  up 47 days, 19:17, 3 users, load averages: 2.82 3.12 3.11
-14:42  up 47 days, 19:17, 3 users, load averages: 2.93 3.13 3.11
-14:42  up 47 days, 19:18, 3 users, load averages: 3.18 3.18 3.13
diff --git a/dev/perf/spf_queue/results/short/sweep-bucket2-sparse.csv b/dev/perf/spf_queue/results/short/sweep-bucket2-sparse.csv
deleted file mode 100644
index 04079ec..0000000
--- a/dev/perf/spf_queue/results/short/sweep-bucket2-sparse.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide1,16384,131072,16,none,bucket2-sparse,0,2,37.299375,9,37.058584;37.299375;37.285416;37.232875;37.307000;36.957291;39.781167;38.166292;37.387791
-wide31,16384,131072,16,none,bucket2-sparse,0,32,36.781667,9,36.781667;36.675875;36.531209;36.388875;37.259583;36.938000;36.847333;36.702833;36.799709
-wide1023,16384,131072,16,none,bucket2-sparse,0,1024,34.703667,9,34.732500;34.721584;34.703667;34.777416;34.599666;34.279333;34.665333;34.923625;34.495458
-wide32767,16384,131072,16,none,bucket2-sparse,0,32768,35.819209,9,36.423291;36.809583;35.480750;35.858125;35.819209;35.829750;35.007125;35.601084;35.079583
-wide1048575,16384,131072,16,none,bucket2-sparse,0,1048570,47.752208,9,47.993250;46.520667;47.752208;46.565125;48.841959;47.888041;46.563958;47.450625;48.453833
-wide33554431,16384,131072,16,none,bucket2-sparse,1,33554196,56.532583,9,56.001958;56.304709;57.229250;55.514583;56.225541;56.869458;56.854875;58.679041;56.532583
diff --git a/dev/perf/spf_queue/results/short/time-bucket-hybrid-b.csv b/dev/perf/spf_queue/results/short/time-bucket-hybrid-b.csv
deleted file mode 100644
index 3840549..0000000
--- a/dev/perf/spf_queue/results/short/time-bucket-hybrid-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,bucket-hybrid,0,32,142.547666,9,141.814042;142.235333;142.547666;145.159000;142.753125;142.732000;141.346416;141.522875;143.547708
-random,65536,524288,1,none,bucket-hybrid,0,32,10.798875,9,10.798875;10.912625;10.936292;10.787250;10.552875;10.718083;10.778958;11.122250;10.962833
-clos,800,320000,64,none,bucket-hybrid,0,2,142.141958,9,142.959250;140.614458;141.870500;145.317042;141.619250;142.141958;142.838250;141.910292;143.447083
-chain,2048,2047,1,none,bucket-hybrid,0,32,0.040834,9,0.040834;0.041125;0.040458;0.040583;0.040750;0.040875;0.040958;0.041167;0.040792
-random,16384,131072,64,near,bucket-hybrid,0,32,0.389791,9,0.389542;0.412500;0.387250;0.390875;0.394083;0.387292;0.386500;0.389791;0.392209
-random,65536,524288,64,near,bucket-hybrid,0,32,1.484459,9,1.484459;1.473000;1.474459;1.487292;1.477583;1.475709;1.498208;1.484625;1.489750
-random,262144,2097152,16,near,bucket-hybrid,0,32,1.442292,9,1.459500;1.451458;1.432125;1.436708;1.440500;1.442292;1.450166;1.442209;1.446667
-random,262144,2097152,1,none,bucket-hybrid,0,32,84.464083,9,85.850916;89.099833;91.374917;84.464083;85.462917;82.968792;82.194042;83.954375;82.687375
diff --git a/dev/perf/spf_queue/results/short/time-bucket-sparse-b.csv b/dev/perf/spf_queue/results/short/time-bucket-sparse-b.csv
deleted file mode 100644
index 9af8e2a..0000000
--- a/dev/perf/spf_queue/results/short/time-bucket-sparse-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,bucket-sparse,0,32,146.151375,9,145.365875;146.581375;147.046709;145.907750;145.879916;147.234791;146.151375;147.714292;145.136625
-random,65536,524288,1,none,bucket-sparse,0,32,10.988416,9,11.044125;10.804042;10.830375;10.933083;11.017500;10.988416;11.095125;10.766667;11.091958
-clos,800,320000,64,none,bucket-sparse,0,2,141.707584,9,141.602916;142.928875;141.394458;141.996958;144.307250;141.192500;141.707584;141.517500;141.947458
-chain,2048,2047,1,none,bucket-sparse,0,32,0.041792,9,0.037042;0.038417;0.041917;0.041792;0.041625;0.041625;0.041792;0.042292;0.046542
-random,16384,131072,64,near,bucket-sparse,0,32,0.386666,9,0.386666;0.385417;0.392792;0.381959;0.383250;0.387625;0.390833;0.383792;0.392417
-random,65536,524288,64,near,bucket-sparse,0,32,1.439458,9,1.416958;1.482792;1.507250;1.425667;1.424709;1.541000;1.429417;1.439458;1.523084
-random,262144,2097152,16,near,bucket-sparse,0,32,1.455000,9,1.455000;1.447125;1.366958;1.453084;1.511791;1.458042;1.451667;1.496875;1.467875
-random,262144,2097152,1,none,bucket-sparse,0,32,92.620833,9,93.362750;91.775833;96.660417;93.237000;98.978917;92.009125;92.620833;89.293292;88.834333
diff --git a/dev/perf/spf_queue/results/short/time-bucket2-fresh-b.csv b/dev/perf/spf_queue/results/short/time-bucket2-fresh-b.csv
deleted file mode 100644
index e68bded..0000000
--- a/dev/perf/spf_queue/results/short/time-bucket2-fresh-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,bucket2-fresh,0,32,142.163000,9,140.967209;141.247417;142.163000;141.064542;144.924083;142.519750;142.667958;144.079083;141.456417
-random,65536,524288,1,none,bucket2-fresh,0,32,10.603833,9,10.704708;10.602166;10.760750;10.537584;10.620416;10.371667;10.603833;10.354041;10.773959
-clos,800,320000,64,none,bucket2-fresh,0,2,141.902750,9,141.549417;141.541042;144.366500;141.535417;142.107375;141.902167;143.362708;142.260042;141.902750
-chain,2048,2047,1,none,bucket2-fresh,0,32,0.035542,9,0.035083;0.035542;0.035458;0.035625;0.046708;0.035375;0.035708;0.035375;0.035834
-random,16384,131072,64,near,bucket2-fresh,0,32,1.336000,9,1.396750;1.399000;1.436458;1.324125;1.275750;1.291083;1.333292;1.336000;1.380375
-random,65536,524288,64,near,bucket2-fresh,0,32,5.261459,9,5.480084;4.884666;5.216500;5.141875;5.405084;5.249708;5.399750;5.261459;5.417583
-random,262144,2097152,16,near,bucket2-fresh,0,32,5.230458,9,5.177375;5.003542;5.108792;7.128292;5.230458;5.224084;5.279209;5.274916;5.299583
-random,262144,2097152,1,none,bucket2-fresh,0,32,86.550500,9,86.550500;86.679625;84.645666;85.720708;83.300834;85.359417;91.528000;91.843500;89.670625
diff --git a/dev/perf/spf_queue/results/short/time-bucket2-hybrid-b.csv b/dev/perf/spf_queue/results/short/time-bucket2-hybrid-b.csv
deleted file mode 100644
index 9108b2c..0000000
--- a/dev/perf/spf_queue/results/short/time-bucket2-hybrid-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,bucket2-hybrid,0,32,146.908458,9,149.103333;146.908458;153.407334;151.466584;148.761833;142.588416;143.540292;144.859666;144.793083
-random,65536,524288,1,none,bucket2-hybrid,0,32,11.742542,9,11.742542;12.280833;12.336916;12.553708;11.515250;11.836375;11.498792;11.367084;11.614458
-clos,800,320000,64,none,bucket2-hybrid,0,2,144.050750,9,144.281250;143.780042;142.801334;144.050750;143.585833;145.442250;145.965375;144.048125;146.001791
-chain,2048,2047,1,none,bucket2-hybrid,0,32,0.038334,9,0.038542;0.038042;0.038458;0.038334;0.038291;0.038416;0.038292;0.038291;0.038500
-random,16384,131072,64,near,bucket2-hybrid,0,32,0.393166,9,0.394125;0.401459;0.403000;0.392291;0.392875;0.398375;0.392250;0.393166;0.392334
-random,65536,524288,64,near,bucket2-hybrid,0,32,1.498541,9,1.497833;1.510291;1.492042;1.498541;1.516292;1.486791;1.499625;1.487583;1.511375
-random,262144,2097152,16,near,bucket2-hybrid,0,32,1.411375,9,1.340875;1.415917;1.435625;1.349125;1.366625;1.403875;1.422208;1.411375;1.436292
-random,262144,2097152,1,none,bucket2-hybrid,0,32,84.643541,9,83.597292;84.989084;83.386458;85.441959;83.921208;83.676792;84.643541;86.611042;85.450250
diff --git a/dev/perf/spf_queue/results/short/time-bucket2-sparse-b.csv b/dev/perf/spf_queue/results/short/time-bucket2-sparse-b.csv
deleted file mode 100644
index 705d100..0000000
--- a/dev/perf/spf_queue/results/short/time-bucket2-sparse-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,bucket2-sparse,0,32,147.686917,9,147.830750;147.531417;147.372209;147.061958;149.109292;149.496875;147.970583;146.964417;147.686917
-random,65536,524288,1,none,bucket2-sparse,0,32,11.416459,9,11.431292;11.416459;11.210667;11.834542;11.816958;11.380167;11.199083;11.488292;11.214833
-clos,800,320000,64,none,bucket2-sparse,0,2,143.678625,9,144.810291;143.678625;142.837750;142.298541;142.889500;143.704667;143.648000;145.034541;146.672667
-chain,2048,2047,1,none,bucket2-sparse,0,32,0.040916,9,0.037208;0.039334;0.040833;0.040916;0.041000;0.041041;0.041042;0.041083;0.039667
-random,16384,131072,64,near,bucket2-sparse,0,32,0.398333,9,0.403250;0.411209;0.398333;0.395750;0.391458;0.455709;0.478792;0.378000;0.378500
-random,65536,524288,64,near,bucket2-sparse,0,32,1.500166,9,1.500166;1.477167;1.504708;1.495167;1.497542;1.516500;1.489167;1.687291;1.531375
-random,262144,2097152,16,near,bucket2-sparse,0,32,1.450625,9,1.381625;1.413875;1.471417;1.457458;1.450625;1.440000;1.462625;1.466166;1.447083
-random,262144,2097152,1,none,bucket2-sparse,0,32,95.974167,9,100.352250;98.287042;95.974167;94.826000;92.828416;95.038750;93.860083;98.846875;96.269292
diff --git a/dev/perf/spf_queue/results/short/time-heap-hybrid-b.csv b/dev/perf/spf_queue/results/short/time-heap-hybrid-b.csv
deleted file mode 100644
index b745303..0000000
--- a/dev/perf/spf_queue/results/short/time-heap-hybrid-b.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,heap-hybrid,0,32,273.173042,9,273.535959;273.173042;272.987500;274.413708;272.240708;272.831625;272.374041;273.861250;275.296667
-random,65536,524288,1,none,heap-hybrid,0,32,20.333792,9,20.587500;20.226958;20.591334;20.201833;20.277375;19.883125;20.333792;20.459667;20.590542
-clos,800,320000,64,none,heap-hybrid,0,2,135.961625,9,135.924375;135.899834;138.616000;135.521958;136.078250;136.760792;136.773459;135.961625;135.061542
-chain,2048,2047,1,none,heap-hybrid,0,32,0.024500,9,0.022000;0.023083;0.024500;0.024750;0.025042;0.024750;0.024375;0.024541;0.024500
-random,16384,131072,64,near,heap-hybrid,0,32,0.390458,9,0.387792;0.389541;0.390458;0.390459;0.386875;0.391084;0.392083;0.408167;0.388917
-random,65536,524288,64,near,heap-hybrid,0,32,1.481000,9,1.497167;1.481000;1.481041;1.492750;1.483334;1.396500;1.409125;1.445125;1.464084
-random,262144,2097152,16,near,heap-hybrid,0,32,1.456709,9,1.430542;1.456709;1.462583;1.456834;1.475000;1.445459;1.443833;1.464333;1.447459
-random,262144,2097152,1,none,heap-hybrid,0,32,131.476542,9,131.909875;131.235750;129.497458;131.023292;131.906417;132.037875;132.782167;130.478583;131.476542
diff --git a/dev/perf/spf_queue/results/short/time-ref-a1.csv b/dev/perf/spf_queue/results/short/time-ref-a1.csv
deleted file mode 100644
index 4a3fb44..0000000
--- a/dev/perf/spf_queue/results/short/time-ref-a1.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,ref,0,32,240.574042,9,239.941250;243.446250;243.989666;240.574042;239.140083;241.751209;239.183292;241.564583;239.675084
-random,65536,524288,1,none,ref,0,32,18.512292,9,18.477250;18.512292;18.502583;18.579334;18.885459;18.153333;18.186375;18.595458;18.531083
-clos,800,320000,64,none,ref,0,2,137.762333,9,137.476083;137.589542;141.538542;139.405833;137.762333;136.658917;138.521917;138.898375;137.596916
-chain,2048,2047,1,none,ref,0,32,0.020583,9,0.020583;0.023083;0.019750;0.018500;0.018500;0.020166;0.020708;0.020667;0.020875
-random,16384,131072,64,near,ref,0,32,1.046583,9,1.099292;1.076792;1.031625;1.002583;1.015500;1.046583;1.051792;1.043291;1.053416
-random,65536,524288,64,near,ref,0,32,4.206375,9,4.206375;4.798000;5.190875;4.624958;4.175583;4.034417;4.407375;4.000666;4.178959
-random,262144,2097152,16,near,ref,0,32,3.913459,9,3.901625;3.917291;3.924083;3.913459;3.900458;3.938041;3.915958;3.895375;3.909083
-random,262144,2097152,1,none,ref,0,32,119.533542,9,120.662833;117.989875;119.298416;120.215542;117.608500;119.533542;119.545958;118.972500;129.493667
diff --git a/dev/perf/spf_queue/results/short/time-ref-a2.csv b/dev/perf/spf_queue/results/short/time-ref-a2.csv
deleted file mode 100644
index 1c7b4be..0000000
--- a/dev/perf/spf_queue/results/short/time-ref-a2.csv
+++ /dev/null
@@ -1,9 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random,16384,131072,64,none,ref,0,32,245.430000,9,248.316125;247.171583;244.164041;245.430000;244.551542;243.334791;244.229459;247.001041;245.512083
-random,65536,524288,1,none,ref,0,32,18.767000,9,18.134292;18.544916;18.387041;18.409583;18.924417;18.847500;18.767000;18.922875;18.988125
-clos,800,320000,64,none,ref,0,2,141.644542,9,141.412958;141.113542;141.644542;140.970292;142.218375;143.736166;140.296792;143.137291;142.293208
-chain,2048,2047,1,none,ref,0,32,0.023334,9,0.020709;0.022041;0.021000;0.023375;0.023334;0.024250;0.024042;0.023875;0.023333
-random,16384,131072,64,near,ref,0,32,1.104167,9,1.087125;1.084917;1.086542;1.119541;1.148958;1.118583;1.104167;1.099708;1.144750
-random,65536,524288,64,near,ref,0,32,4.305042,9,4.331750;4.193667;4.377625;4.208583;4.354542;4.137708;4.409417;4.166125;4.305042
-random,262144,2097152,16,near,ref,0,32,19.192541,9,19.290125;19.192541;19.075667;18.905375;19.081709;19.091959;19.239083;19.242709;19.201542
-random,262144,2097152,1,none,ref,0,32,124.229000,9,122.850416;129.890541;123.901291;123.352166;131.279125;139.409250;136.247250;124.229000;122.618125
diff --git a/dev/perf/spf_queue/review-2026-10/BRIEF.md b/dev/perf/spf_queue/review-2026-10/BRIEF.md
deleted file mode 100644
index 6c200b5..0000000
--- a/dev/perf/spf_queue/review-2026-10/BRIEF.md
+++ /dev/null
@@ -1,79 +0,0 @@
-# Critical review brief: SPF optimisation in NetGraph-Core
-
-You are an independent, sceptical performance reviewer. Repository root is the
-current directory (NetGraph-Core, C++20 core + pybind11). The working tree has
-an UNCOMMITTED change on top of commit `fbab119` that replaces the Dijkstra
-frontier in `src/shortest_paths.cpp` with a monotone bucket queue (active bucket
-kept as a heap on `(-bottleneck, node)` so pop order is identical to the old
-binary heap), plus a thread-local scratch workspace with touched-node tracking
-and a hybrid reset. Read, in this order:
-
-1. `dev/perf/spf_queue/PLAN.md` (the plan: decision,
-   experiment, implementation status, old/new/old measurements, trade-offs).
-2. `dev/perf/spf_queue/review-2026-10/change.diff`
-   (the exact production + test diff) and the live files `src/shortest_paths.cpp`,
-   `src/strict_multidigraph.cpp`, `include/netgraph/core/shortest_paths.hpp`.
-3. `dev/perf/spf_queue/README.md` and the harness
-   `spf_variants.hpp` / `harness.cpp` (plain C++; `bash dev/perf/spf_queue/build.sh`
-   builds `build/perf/cpu-queue`; `build/perf/cpu-queue-old`
-   is the same harness built from the previous sources; `time ref 7`,
-   `short ref 7`, `sweep ref 7 2097152`, `correctness` are the modes).
-4. Callers: `src/max_flow.cpp`, `src/flow_state.cpp` (place_max_flow),
-   `src/flow_policy.cpp` (get_path_bundle, memo), `src/k_shortest_paths.cpp`
-   (its own `dijkstra_single` and spur searches), `src/cpu_backend.cpp`.
-5. Context memos: `dev/research/metal_pathfinding/optimization/README.md` (GPU research)
-   and the measured dead ends listed in CPU_PLAN.md ("do not retry").
-
-## Your task
-
-Think hard and answer: **were all easily achievable and reasonable
-optimisations considered and verified?** Specifically:
-
-- Cheap wins inside the new code that were missed: the bucket queue (bucket
-  advance, bitmap, per-pop overhead, item layout, the chain-graph regression,
-  width limit), the heap route (the recorded 5–9% fallback regression and its
-  real cause), the workspace (reset policy, output materialisation, the O(N)
-  output floor), predecessor-list construction and the PredDAG conversion,
-  early-exit handling, the reverse search, the cost/gcd metadata.
-- Cheap wins around the search that were not touched: how max-flow,
-  place_max_flow and FlowPolicy call SPF (repeated full searches, residual
-  recomputation, memoisation, early termination), KSP's private
-  `dijkstra_single`, graph construction (CSR layout, edge ordering by cost),
-  the Python binding path (copies, GIL), batch/thread usage.
-- Whether the measurements support the claims: A/B/A design, noise, the
-  `W_max = 65536` choice, the sweep, the NetGraph-level workloads
-  (`cpu_queue/bench_netgraph.py`) and whether they represent realistic
-  NetGraph use; anything the author may have rationalised away.
-- Correctness or robustness risks that an optimisation reviewer should flag:
-  thread_local lifetime and memory bound, exception paths, reentrancy,
-  int64 overflow in bucket arithmetic, graphs with zero edges, Python threads.
-
-## Rules
-
-- Be concrete and sceptical. Cite file paths and line numbers. Do not restate
-  the plan; find what it misses or gets wrong.
-- Verify, don't speculate: build the harness and run experiments where a claim
-  can be checked in minutes (old binary vs new binary, forced heap via
-  `NGRAPH_CORE_SPF_QUEUE=heap`, fresh processes, several samples, record load
-  with `uptime`). Treat differences under ~5% as noise unless reproduced.
-- Do NOT modify tracked files. Put every experiment, patch (as `.patch` files)
-  or script under `dev/perf/spf_queue/review-2026-10/`.
-  You may build into `build/`. Do not run `git commit`, `git stash`, `git
-  checkout`, or anything that changes the working tree outside that directory.
-  The Python venv is `venv/`; NetGraph lives in `/Users/networmix/ws/NetGraph`
-  (read-only for you). Do not run the full test suites; they already passed.
-- Other sessions share this machine; keep runs short and sequential.
-
-## Report (write it to `dev/perf/spf_queue/review-2026-10/REPORT.md`, in English)
-
-1. A ranked list of findings. For each: title; what exactly is missed or wrong
-   (with evidence); expected gain and the workload class it applies to; cost
-   and risk; verdict as one of VERIFIED-GAIN (you measured it), PLAUSIBLE-
-   UNTESTED (why you could not verify), REFUTED (you measured no gain),
-   ALREADY-COVERED (the plan handles it; say where).
-2. For every VERIFIED-GAIN: the exact patch (file + diff) and the numbers
-   (old / new / your variant, samples, load).
-3. Measurement critique: what in the recorded A/B/A would you not trust, and
-   what would you rerun.
-4. A short verdict: is the shipped approach the right streamlined choice, and
-   what (if anything) should be done before committing it.
diff --git a/dev/perf/spf_queue/review-2026-10/REPORT.md b/dev/perf/spf_queue/review-2026-10/REPORT.md
deleted file mode 100644
index 195d4b9..0000000
--- a/dev/perf/spf_queue/review-2026-10/REPORT.md
+++ /dev/null
@@ -1,280 +0,0 @@
-# Independent review of the SPF optimisation
-
-Reviewed 2 October 2026 against `fbab119e794c843838f4f3f96d75cb7f32f06845` and the supplied uncommitted diff. Line references below refer to the live, unmodified production files, not the experimental copies.
-
-**No: the main algorithm choice is sensible, but several small, worthwhile changes were neither considered nor verified.** I measured gains in neighbour processing, predecessor output construction, singleton-frontier handling, and fixed-routing callers. More importantly, I reproduced a new exception-safety defect and disproved the stated retained-memory bound. The weighted-graph speedup itself survives independent measurement.
-
-All experimental sources, patches, scripts and results are in this directory; executables/objects are under `build/perf/`. All 97 tracked files were checked byte-for-byte against the review-start snapshot; none changed ([verification](results/tracked-verification.txt)). No full repository suite, commit, checkout, stash, or downstream source modification was performed.
-
-## 1. Ranked findings
-
-### 1. A failed touched-list allocation corrupts the next SPF call
-
-**Verdict: VERIFIED-GAIN — correctness restoration, not a latency claim. Priority: fix before committing.**
-
-`src/shortest_paths.cpp:726–728` writes the source distance and bottleneck **before** the potentially allocating `touched.push_back`. Reverse SPF does the same at `:932–934`. If that allocation throws, the lease runs, but sparse cleanup at `:433–436`/`:475–479` has no record of the modified node. The next same-sized search can suppress a valid relaxation against the stale zero distance. Sparse output materialisation then reports the reachable node as unreachable.
-
-[Reproducer](robustness.cpp), [public old-build reproducer](fault-public.cpp), and [exact fix](exception-fix.patch), affecting those two blocks in `src/shortest_paths.cpp`:
-
-| Eight-node, one-edge graph; inject one four-byte allocation failure, then search from/to the other endpoint | Old | New | Fix |
-|---|---:|---:|---:|
-| Forward distance to the reachable node | 1 | `INT64_MAX` | 1 |
-| Reverse distance from the reachable node | 1 | `INT64_MAX` | 1 |
-
-Raw outputs: [old](results/fault-old.txt), [new](results/fault.txt), [fix](results/fault-fixed.txt). The patch records the source/target first, then performs the nonthrowing writes. It does not change successful-call work or outputs. Cost/risk: two statement reorderings; very low. The existing fanout-throw test at `tests/cpp/shortest_paths_tests.cpp:641–668` does not exercise this failure point. The comment claiming restoration on *every* exit at `src/shortest_paths.cpp:497` is presently false.
-
-### 2. Do not recompute an identical SPF inside fixed-routing max-flow calls
-
-**Verdict: VERIFIED-GAIN.**
-
-`src/max_flow.cpp:123–151` and `src/flow_state.cpp:537–552` repeatedly call SPF. With `require_capacity=false`, they pass no residual; graph, masks, endpoints and selection remain identical. The next placement still needs current residuals, but the next SPF does not. This is a particularly simple caller optimisation, independent of the queue. It is unnecessary when `shortest_path=true`, which already stops after one successful tier.
-
-[Exact patch](fixed-routing.patch) caches the result **within the invocation**, in both files, only re-searching when capacity-aware routing is enabled. It does not cache changing residual-aware routes. On eight weighted 4,096-node/32,768-edge queries, seven samples per fresh process:
-
-| Workload | Old A1 / A2, ms | New A1 / A2, ms | Reuse variant, ms | Reduction from new |
-|---|---:|---:|---:|---:|
-| `place_max_flow`, fixed routing | 5.757 / 5.646 | 3.857 / 3.784 | 2.134 | 44–45% |
-| Same, node/edge exclusions | 4.255 / 4.150 | 3.090 / 2.951 | 1.693 | 43–45% |
-| `calc_max_flow`, exclusions | 6.032 / 6.033 | 4.942 / 4.846 | 3.531 | 27–29% |
-| `calc_max_flow`, no exclusions | 7.105 / 6.903 | 5.139 / 4.972 | 4.486 | Unstable samples; do not use for a precise claim |
-
-The unmasked `calc_max_flow` variant samples span 3.851–5.648 ms; I am explicitly not treating its median as equally strong evidence. The other gains also appeared in the screening pass. The accepted rerun fixes all query endpoints in the masks before warmup; the earlier screening files are retained and labelled `screen-flow-*`.
-
-Evidence: [driver](flow-driver.cpp), [build/run script](build-flow.sh), [old A1](results/flow-old1.csv), [new A1](results/flow-new1.csv), [variant](results/flow-fixed.csv), [new A2](results/flow-new2.csv), [old A2](results/flow-old2.csv), [load](results/load-flow.txt): 1-minute load 4.46–4.76. Output hashes agree; capacity and conservation checks run outside timing. See section 2 for stronger flow validation.
-
-Expected applicability: fixed IP/IGP routing through these helpers, with repeated placement enabled. No promised improvement for residual-aware default max-flow or the recommended single-pass IP-ECMP combination. Cost/risk: small local lifetime extension; review the old result's extra lifetime during replacement on the residual-aware route. Keep this as a separate caller patch if the SPF change is to remain narrowly scoped.
-
-### 3. Skip settled neighbours before collecting their parallel edges
-
-**Verdict: VERIFIED-GAIN.**
-
-At `src/shortest_paths.cpp:583–640` and `:832–881`, the code collects eligible edges and computes their bottleneck even when the neighbour is settled. With nonnegative costs, a settled neighbour cannot receive a shorter path; equal-cost predecessor changes and single-path capacity improvements are already prohibited for settled neighbours at `:644–655`/`:884–895`. Skipping its contiguous neighbour run early preserves the existing outputs.
-
-[Exact patch](settled.patch): two condition changes in `src/shortest_paths.cpp`. This is not a different tie-break, cached eligibility policy, or new queue.
-
-| Dense unit fabric, 800 nodes / 320,000 edges, 16 full-source queries | Old A1 / A2 | New A1 / A2 | Skip-settled |
-|---|---:|---:|---:|
-| Pass A, ms | 36.784 / 36.827 | 34.775 / 35.326 | 30.552 |
-| Pass B, ms | 36.005 / 36.967 | 35.225 / 36.691 | 29.811 |
-| Reverse search, 16 targets, ms | 48.257 / 46.690 | 46.923 | 37.042 |
-
-Forward improvement is 12–19% against the new code; reverse improvement is 21%. Weighted random graphs do **not** establish a gain: pass B is 36.487 versus 36.437/36.404 ms. Do not advertise this as a universal improvement. The extra branch could be unfavourable in other graph families.
-
-Evidence: `results/{old-a1,new-a1,settled,new-a2,old-a2}.csv`, the corresponding `*-b*` files, and `results/reverse-*.csv`; [first load log](results/load.txt), [second load log](results/load-second.txt). Loads during these forward phases were 3.53–4.42; reverse phases 4.67. Full forward old-loop comparison: 1,351,168 comparisons, zero failures. Reverse hashes agree with the separately built old implementation; targeted sanitizers and the cross-caller bitgate also pass.
-
-Cost/risk: very small implementation, low semantic risk after nonnegative-weight proof and parity checks. This directly challenges the suggestion at `CPU_PLAN.md:150–155` that edge-scanning dominance makes unit fabrics merely neutral: some of that edge processing is avoidable.
-
-### 4. Forward PredDAG conversion need not walk every surviving list twice
-
-**Verdict: VERIFIED-GAIN.**
-
-`src/shortest_paths.cpp:679–700` walks each predecessor list to count entries, prefixes the counts, sizes/initialises two output arrays, and walks the same lists again to fill them. On dense equal-cost DAGs this is measurable work, not an irreducible result-size floor.
-
-[Exact patch](append.patch) keeps the sparse path unchanged. For the dense case it reserves the number of recorded entries as an upper bound, appends surviving entries once in node/list order, and writes each final offset immediately. It preserves parent ordering and all four output arrays.
-
-| Same dense forward workload as finding 3 | Old A1 / A2, ms | New A1 / A2, ms | One-pass conversion, ms |
-|---|---:|---:|---:|
-| Pass B | 36.005 / 36.967 | 35.225 / 36.691 | 29.755 |
-| Pass C | 37.396 / 37.468 | 35.800 / 35.380 | 31.159 |
-
-This is a reproduced 12–19% reduction. Random-graph changes remain below the review's significance threshold. Combined with settled-neighbour skipping, the dense row is 26.327 ms versus 35.800/35.380 ms, about 26% lower; that combined timing is one phase, not a separately replicated universal claim.
-
-Evidence: [patch](append.patch), [combined patch](combined.patch), `results/{append,append-c,combined}.csv`, [pass C load](results/load-third.txt). Pass B load was 3.53; pass C was busier, 7.93–8.46. The individual improvement survives both passes. [Forward comparison](results/correctness-append.txt): 1,351,168 comparisons, zero failures.
-
-Expected applicability: dense multipath outputs with many live predecessor entries. Cost/risk: small conversion change, but reserving *all* recorded entries can retain excess space in the returned vectors when many predecessors were superseded. This must be weighed against the exact-sized current output; it is not a free memory improvement. Reverse conversion is a scatter by successor and requires ascending-tail order (`:981–1015`), so this exact patch cannot simply be copied there.
-
-### 5. The chain regression is partly avoidable without another search algorithm
-
-**Verdict: VERIFIED-GAIN.**
-
-For a frontier with one item, `BucketQueue` still divides/modulos its key, sets/clears occupancy, advances the cursor and touches a vector/heap (`src/shortest_paths.cpp:329–362`). The plan tried modulo masking and accepted the regression; that does not test avoiding the bucket machinery altogether for an isolated item.
-
-[Exact patch](inline.patch) stores a lone newly pushed item inline, promoting it into the existing buckets if a second item arrives. After ordinary bucket operation it only re-enters this mode when the frontier empties. Keys, queue selection and pop order are unchanged. This is not retrospective dispatch to a second Dijkstra implementation.
-
-| Chain: 2,048 nodes, 256 queries with varying sources | Old A1 / A2, ms | New A1 / A2, ms | Inline item, ms |
-|---|---:|---:|---:|
-| Pass B | 2.929 / 3.114 | 5.232 / 5.462 | 3.541 |
-| Pass C | 3.039 / 3.115 | 5.607 / 5.569 | 3.618 |
-
-Reduction from the new bucket route: 32–35%. It still trails the old implementation by about 14–21% in these passes. These are 256 varying-length chain queries, **not** the plan's single full-chain query; do not quote the whole batch as single-query latency. Other focus rows show no reproduced material gain or regression.
-
-Evidence: `results/{inline,inline-c}.csv`, the B/C controls above, and [correctness](results/correctness-inline.txt): 1,351,168 comparisons, zero failures. Same load ranges as finding 4. A smaller experiment retaining just a sole item's bucket location ([singleton.patch](singleton.patch)) gave only about 9% in the first chain pass; bypassing the bucket storage is the useful version.
-
-Cost/risk: modest queue-state complexity; promotion after zero-cost pushes and cyclic cursor transitions deserve explicit tests. Applicability includes narrow-frontier portions of ordinary graphs, not just graphs that are globally chains. There is no workload evidence behind the plan's categorical statement that no production caller runs on a path graph (`CPU_PLAN.md:287–292`).
-
-### 6. Retained memory is not bounded by one largest-graph workspace
-
-**Verdict: PLAUSIBLE-UNTESTED for the reclamation optimisation; the counterexample itself is verified. Priority: correct the bound before committing.**
-
-Only the fixed node arrays go through `ensure_sized` (`src/shortest_paths.cpp:402–405,424–430,465–472`). Entry arrays, touched/selection buffers, heap storage, bucket headers and each individual bucket's item capacity retain their high-water marks. Both directional workspaces coexist per thread (`:494–495`).
-
-The stronger problem is the **sum of independent bucket high-water marks**. [Memory probe](robustness.cpp), [output](results/memory.txt): with 63 graphs, each having only 1,027 nodes and 1,026 edges and a maximum live frontier of 1,024 items, retained bucket-item capacity rises from **16,400 bytes to 1,032,208 bytes**. A subsequent two-node graph shrinks `dist.capacity()` to two but retains all 1,032,208 bucket bytes.
-
-Thus `:260–264` is misleading and `CPU_PLAN.md:368–369` accounts only for empty headers/bitmap. A conservative bound is proportional to `W_max × historical maximum queued items`, plus node/entry/heap buffers, **per direction per live thread**, rather than just the largest simultaneous frontier. The multiplier can be much more important than the 1.6 MB header number. Entries and heap capacity also survive a graph-size shrink.
-
-Expected benefit: memory reclamation after heterogeneous graphs or worker-pool traffic; no measured latency gain. Cost/risk: add a total retained-byte budget or reclaim bucket/item storage on substantial graph-size shrink; avoid destroying hot capacities every query. I did not benchmark such a policy because choosing a memory budget requires a workload trade-off; pretending that `W_max` already supplies it would be incorrect. Thread exit does free the TLS vectors; long-lived Python/executor threads are the relevant retention case.
-
-### 7. The fallback regression is real in some rows, but its “workspace cost” explanation is not established
-
-**Verdict: PLAUSIBLE-UNTESTED for the remaining causal attribution. Specific cheap remedies below are REFUTED as material gains.**
-
-`CPU_PLAN.md:156–162` converts an unresolved difference into “the cost of the reusable workspace.” The new route does extra touched-list work, copies dense distances (`src/shortest_paths.cpp:675`), and resets arrays after copying (`:438–443`); these are candidates, not a measured attribution. The three previously attempted mitigations were not repeated.
-
-I isolated three other possibilities, using the same production loop:
-
-| Pass A/B, 16 full queries | New forced heap | Experiment | Outcome |
-|---|---:|---:|---|
-| Random 16k, remove touched tracking and force dense handling | 65.364 / 66.960 ms | 64.784 ms | Under 5%; no established full-search gain |
-| Wide ~2^20 costs, same ablation | 52.299 / 53.113 ms | 51.040 ms | Under 5%; insufficient to attribute the gap |
-| Near-target queries, same ablation | 0.399 / 0.408 ms | 1.233 ms | Destroys the intended workspace benefit |
-| Wide ~2^20, explicit heap item/comparator | 52.299 / 53.113 ms | 55.679 ms | No gain |
-| Wide ~2^20, copy heap front before pop, like old priority_queue | 52.248 ms | 52.007 ms | Noise |
-
-Patches: [notouch](notouch.patch), [heapitem](heapitem.patch), [frontpop](frontpop.patch). The 24-byte heap item versus 16-byte bucket item is a genuine layout difference; merely replacing the tuple with an explicitly ordered struct did not help. Do not narrow the double bottleneck or int64 distance to pack a key.
-
-The quarter-touched threshold at `src/shortest_paths.cpp:399` is not established as the crossover: the reported workload matrix mostly samples very sparse or nearly full searches. Reset and output materialisation need not have the same optimal threshold; reverse sparse conversion additionally sorts touched nodes (`:986–987`). Intermediate touched fractions, locality and graph-size churn remain unmeasured. This is a plausible tuning opportunity, not a verified gain, and the no-touch ablation is not a threshold sweep.
-
-Fresh old/new controls vary: pass B wide ~2^20 is 48.972/50.562 ms old versus 53.175/52.534 ms new; pass A is 50.820/52.036 versus 53.541/53.120. The boundary run at the same broad cost range is 25.107/25.151 versus 27.498 ms for eight queries. These support a workload-dependent penalty, sometimes clearly over 5%, not a fixed universal 5–9% tax. Cost/risk of further attribution: targeted search/finish/reset profiling on a quieter machine. Expected recoverable percentage remains unknown. Neither “noise” nor “inevitable” is an adequate root cause.
-
-### 8. `W_max=65536` is conservative and useful, not a verified optimal or portable threshold
-
-**Verdict: PLAUSIBLE-UNTESTED for the remaining bitmap/cleanup refinements.** The bounded-dispatch design and deferred wider-queue alternatives are already covered by the plan.
-
-The recorded sweep jumps from `W=32768` to approximately `2^20`; it never measures the chosen boundary (`cpu_queue/harness.cpp:339–341`). Passing `2097152` as harness `maxW` does **not** change the production `ref` route's compile-time limit: `Runner::run` immediately calls `run_ref` (`:147`), while `src/shortest_paths.cpp:270,368–393` decides actual dispatch. The CSV's harness `fallback` field therefore is not a production fallback counter.
-
-I added the missing near-boundary rows, seven samples, 16,384 nodes/131,072 edges:
-
-| Actual W | Old A1 / A2, ms | New auto, ms | New forced heap, ms |
-|---:|---:|---:|---:|
-| 32,768; eight full queries | 25.959 / 26.272 | 17.628 | 27.216 |
-| 65,535; eight full queries | 25.433 / 25.761 | 18.147 | 26.350 |
-| 65,536; eight full queries | 25.641 / 26.609 | 18.499 | 27.175 |
-| 65,537; eight full queries | 25.659 / 25.454 | 26.491 | 26.865 |
-| 65,535; 64 near queries | 1.131 / 1.123 | 0.455 | 0.390 |
-| 65,536; 64 near queries | 1.171 / 1.149 | 0.435 | 0.399 |
-
-[Raw boundary files](results/boundary-new1.csv), corresponding old/heap controls, and [load](results/load-second.txt), 4.42–4.67. The boundary supports full-search acceleration on this M4; near queries pay a 9–17% bucket overhead relative to the new heap while still beating old substantially. This is evidence against treating W alone as a universal profitability predictor, not a request to add a complex dispatcher immediately.
-
-The occupancy bitmap is already implemented. However, `settle_active` can scan up to `ceil(W/64)` words (`:349`); `end()` also scans **every word**, including zero ones (`:317`), and `begin()` clears every word (`:312`). “Clear only occupied buckets” does not mean O(number of occupied buckets) total cleanup. A second-level nonempty-word bitmap or touched-word list addresses this overhead; its benefit at small W is unproven. Both workspaces also call both queues' `end()`, so a heap query after a wide bucket query still scans that old bitmap.
-
-The plan already defers a hierarchical bitmap/radix alternative and x86 verification (`CPU_PLAN.md:367–373,433–438`); these are not omitted discoveries. Do not widen the limit solely from the old full-search sweep, especially before bounding retained item capacity and measuring cold construction, sparse frontiers, masks and graph changes. No second machine was available in this review.
-
-### 9. An O(N) result floor exists, but the proposed distance-only remedy is misstated; early exit also has a compatibility trap
-
-**Verdict: PLAUSIBLE-UNTESTED for a target-specific internal result path.**
-
-`src/shortest_paths.cpp:671–687` necessarily fills N distances and N+1 offsets under the current API. Sparse reset correctly removes scratch initialisation, not these outputs. But a **distance-only vector still has N elements**; it cannot remove the O(N) floor as claimed at `CPU_PLAN.md:454–457`. A scalar target-distance result, compact target subgraph/path, caller-owned output, or a lazy/sparse result contract is needed. The internal callers commonly inspect only `dist[dst]` (`src/max_flow.cpp:142`, `src/flow_policy.cpp:184`), and `place_max_flow` does not use distances at all (`src/flow_state.cpp:543–549`). They are concrete candidates for a narrower internal result interface, without changing Python defaults. Removing the distances alone still leaves the dense DAG offsets.
-
-Also, the current early-exit code is not simply “process exactly through the target's distance.” Stale-entry `continue` branches at `:566–569` bypass the stop check at `:661`. A stale equal-distance entry behind the target can cause a more expensive node to be expanded. [Six-node reproducer](early-exit.cpp): target cost 1, yet a node reachable only by expanding a distance-2 node gets distance 3. [Old](results/early-old.txt) and [new](results/early-new.txt) both do this.
-
-Moving the stop test to the loop head would save work, but changes the returned tentative off-target distances/DAG and fails strict old-result parity. Likewise, breaking immediately when the destination is popped or skipping all relaxations beyond its distance is not a drop-in optimisation. Use an explicit narrower internal contract if taking this route. Expected gain: large only when output/unused exploration dominates; not measured. Cost/risk: moderate API/contract work. Bidirectional search/A* and canonical incoming-CSR reconstruction are not equally cheap substitutes under the current ordered-output contract.
-
-### 10. FlowPolicy already avoids many searches; it still has avoidable copies and post-search rejection
-
-**Verdict: PLAUSIBLE-UNTESTED for the remaining copy and bounded-search opportunities.** Existing memoisation and shared seeding already cover much of this area.
-
-Memoisation is not missing: `src/flow_policy.cpp:148–205` matches exact state stamps or residual bytes, and `:434–444` computes the initial bundle once. The header documents a prior 94% repeat rate for the measured EqualBalanced cycle and 0% for Proportional (`include/netgraph/core/flow_policy.hpp:215–228`). This is historical profiling evidence, not a distribution I remeasured here. Residual-aware memoisation must retain exact capacities: unchanged eligibility does not preserve bottleneck ordering or zero-cost DAG choices.
-
-There is nevertheless a definite redundant copy: after obtaining an owned `dag`, `get_path_bundle` returns `std::make_pair(dag, dst_cost)` at `src/flow_policy.cpp:238`. Moving that local would avoid another full DAG copy on both hit and miss. A hit still needs its own owned result because the cache retains its DAG. Also, `has_min_flow` remains a memo-key discriminator at `:159–160`, although residual awareness now depends solely on `require_capacity_` at `:94–101`, and EB skips the threshold-derived edge mask. Revisit that stale key/comment with a call-count reproducer before changing it.
-
-Cost ceilings are applied after SPF at `:207–232`; when a bound is already known, an internal bounded-target search could reject earlier. Respect `best_path_cost_` updates and equal-cost/zero-edge behaviour. Expected gain: one DAG copy per bundle return, fewer equivalent-key misses, and less work on rejected high-cost routes; workload speedup unmeasured. Cost/risk: move is trivial; memo-key/ceiling changes require focused semantic tests. Broad new memoisation is not justified by the existing measured Proportional miss rate. I did not build an isolated memo-hit/bundle-return benchmark for this private helper; the source proves the copy, not a measurable end-to-end gain.
-
-### 11. KSP's main missed cheap cost is not necessarily its private Dijkstra queue
-
-**Verdict: PLAUSIBLE-UNTESTED for mask/result work.** Deferring private-queue replacement is already justified in the plan.
-
-`dijkstra_single` is used for the initial path (`src/k_shortest_paths.cpp:204`); its comparator only compares cost (`:61–63`), so substituting SPF's capacity/node key can change first-path selection. Most subsequent spur work calls the newly optimised public SPF (`:283`). Replacing the private queue without profiling may have little impact on k>1.
-
-Every spur builds byte masks of N/E elements (`:247–267`), then allocates bool arrays and copies them again (`:269–279`). Reuse bool scratch directly, reset only the prefix/edge exclusions that changed, and preserve the base masks. KSP already caps enumeration and rejects candidate families against the cost ceiling (`:289–305`), but the ceiling is checked *after* the complete SPF/DAG result. A bounded internal search could help rejected spurs. Expected benefit: fewer O(N+E) allocations/copies per spur, especially on large graphs and small reachable regions; no percentage established. Cost/risk: moderate scratch-lifetime and ordering work. The one k=8 Clos benchmark does not profile these components or cover long WAN paths and changing k.
-
-### 12. Graph layout and metadata are not free, but the obvious gcd micro-optimisation is not a demonstrated win
-
-**Verdict: REFUTED for a material gcd-guard gain in these measurements.** A separate adjacency-local attribute layout remains an untested possibility.
-
-[One-line gcd patch](gcd.patch) stops calling `std::gcd` once the running gcd reaches 1 (`src/strict_multidigraph.cpp:66`). I timed the **whole constructor**, not just that operation: 16,384 nodes, 131,072 edges, nine samples, old/new/guard/new/old. Random-input construction was 9.060/9.137 ms old, 9.164/9.289 new, 9.122 guarded. Already cost-ordered input was 1.344/1.374 old, 1.430/1.448 new, 1.364 guarded; the repeat was 1.448/1.456 new versus 1.411 guarded. The smaller repeat does not reproduce a >5% gain. Do not sell this as a significant speedup. Output graph hashes agree. Raw files: `results/build-*.csv`, `results/build-repeat-*.csv`; load logs are the B/C logs.
-
-The graph already has forward and reverse CSR. Global `(cost,src,dst)` edge ordering (`src/strict_multidigraph.cpp:80–108`) means a CSR row gathers cost/capacity through edge IDs, and the comment that *all* parallel edges are consecutive at `src/shortest_paths.cpp:580` is too strong across cost tiers. Cost-first rows are useful, but not the same as CSR-local cost/capacity arrays. Reordering edge IDs or neighbour visitation risks documented edge-ID tie-breaking and predecessor order. An auxiliary CSR-aligned attribute layout could preserve IDs/order but costs memory and still needs edge-ID gathers for residuals/masks. No layout experiment establishes that trade-off here.
-
-The max/gcd metadata itself is correct and cheap to access, travels with graph copies, handles zero costs, and avoids repeated eligibility scans. A masked-out wide edge can force the whole query onto the heap; computing a tighter per-query profile is not free and needs amortisation over a stable mask. It is not automatically a cheap win.
-
-### 13. Python copies and threading deserve separate measurements; “release the GIL” is already done
-
-**Verdict: PLAUSIBLE-UNTESTED for owned-output transfer and worker reuse.** GIL release and bounded existing batches are already implemented.
-
-`bindings/python/module.cpp:185–206,228–255` copies residuals/masks before releasing the GIL. The copied inputs give the native call a snapshot; blindly borrowing writable NumPy memory would remove that protection while another Python thread runs. The GIL is already released around SPF, reverse SPF, max-flow, KSP and placement. `CpuBackend` forwards spans directly (`src/cpu_backend.cpp:24–37,40–51`); removing its small duplicated validation is not a credible main optimisation.
-
-Outputs do have extra traffic: the binding allocates/copies or converts the distance vector and passes `res.second` as an lvalue into `py::make_tuple` (`bindings/python/module.cpp:208–217,257–266`). The installed pybind11 caster maps an lvalue under automatic policy to a copy (`venv/lib/python3.14/site-packages/pybind11/include/pybind11/detail/type_caster_base.h:1650–1659`). Move the owned DAG; consider a capsule owning the int64 vector for a zero-copy int64 result. Float64's sentinel conversion still needs a pass. No separately rebuilt pybind extension variant was timed in this review, so the existing-module NetGraph rerun cannot verify these transfer changes. Expected benefit: output-heavy and tiny-search Python calls; not measured, and public ownership/mutability/default-dtype tests are needed.
-
-`batch_max_flow` already dynamically schedules bounded `std::async` workers (`src/max_flow.cpp:354–379`), and sensitivity has its own bounded workers (`:427–454`). TLS scratch is reusable within those workers but is destroyed when each batch's workers exit. Persistent workers may amortise first-use allocation; nested Python pools plus native batches can oversubscribe the machine. The NetGraph benchmark explicitly uses serial Monte Carlo/scenarios, so it cannot establish throughput or persistent-pool memory behaviour. Sequential augmentations sharing residuals cannot be batched as independent searches.
-
-### 14. There is another potentially larger dense-placement hotspot outside SPF
-
-**Verdict: PLAUSIBLE-UNTESTED.**
-
-`src/flow_state.cpp:174–199` finds unique DAG parents by linear search and then rescans the entire parent list once per unique parent. For a node with P distinct predecessors, this is quadratic parent processing before the placement solve. Preserve first-appearance and edge accumulation order with a reusable indexed grouping/counting structure; do not sort indiscriminately because floating-point accumulation and group order are observable.
-
-Expected applicability: wide ECMP/Clos DAGs where queue changes hardly move end-to-end placement time. Expected asymptotic improvement is O(P²) to O(P), but I did not measure a latency gain or implement it: maintaining arbitrary caller-supplied PredDAG order and all three placement semantics needs a separate patch and feasibility/conservation/cut checks. Cost/risk: larger than the four small verified performance changes above. This is a concrete profiling target, not evidence that the existing solver can simply be replaced.
-
-### 15. Arithmetic/empty-graph/Python-thread risks are mostly covered; reentrancy is a separate assumption
-
-**Verdict: ALREADY-COVERED for ordinary arithmetic, edgeless graphs and independent threads.** Same-thread reentrancy remains a separate, unverified use case.
-
-The constructor enforces nonnegative costs and total cost below `2^62` (`src/strict_multidigraph.cpp:40–66`). Therefore `max_cost/gcd+1` cannot overflow int64; cursor advancement corresponds to an actual queued nonnegative distance, and its stride step is bounded by an edge-cost window. I found no ordinary signed-overflow counterexample in the bucket arithmetic. All-zero costs give W=1; no-edge graphs need no edge access despite empty residual/mask sizes comparing equal to E=0.
-
-[Targeted sanitizer probe](safety.cpp) covered exact W=65,535/65,536/65,537, zero costs, costs near the constructor's aggregate bound, N=0 and N>0/E=0, both directions, option combinations, reused workspaces and concurrent C++ threads. It passed under ASan/UBSan. This does not substitute for Python-thread throughput measurements. Independent immutable-graph calls receive independent TLS state; Python input copies and GIL release remain unchanged.
-
-There is no in-use guard or nested lease stack for `tls_forward`/`tls_reverse` (`src/shortest_paths.cpp:494–501`). A same-direction recursive call on one thread would reset the outer call's workspace. I found no supported callback/reentry path in these synchronous loops; ordinary Python threads are not such a path. Document the non-reentrant assumption or add an in-use fallback if callbacks/custom allocation hooks become supported. Do not present a hypothetical recursive call as a reproduced production failure.
-
-## 2. Experiments, exact patches and validation coverage
-
-The reproducible performance patches are linked in findings 2–5; the exception fix is linked in finding 1. Each `.patch` contains the full unified diff against the unmodified live source. Experimental `.cpp` copies let them be built without applying anything to the working tree.
-
-- [build-review.sh](build-review.sh) creates old sources/headers using read-only `git show fbab119:...` and builds the focused harness variants. Same Apple clang 21, C++20, `-O3 -funroll-loops -fno-math-errno -fno-trapping-math` as the supplied harness. The supplied `build.sh` was also run successfully.
-- [driver.cpp](driver.cpp) reuses the supplied generators/query setup and adds focused, reverse and boundary rows. Random16/wide rows contain 16 queries; Clos contains 16; near contains 64; chain contains 256 varying sources. Every phase is a fresh process; two warmups precede seven measured samples. Raw CSVs include all samples.
-- [run-review.py](run-review.py), [run-second.py](run-second.py), [run-third.py](run-third.py) record phase order/load and keep old and new controls on both sides of the focus experiments. [environment](results/environment.txt) records compiler/host/source/binary hashes; [final manifest](results/final-sha256.txt) covers later experimental builds and sources. Pass C is deliberately reported as noisier, not quietly substituted for pass B.
-- Baseline, skip-settled, inline-item and one-pass-output versions each passed the supplied forward comparison matrix: **1,351,168 comparisons each**, against the preserved old-loop variants, not just distances. These are repeated combinations on a finite set of graphs, not millions of independent graphs. Files: `results/correctness-{baseline,settled,inline,append}.txt`.
-- [validate-review.sh](validate-review.sh) builds settled+one-pass output together with the fixed-routing caller patch under **ASan/UBSan**, with sanitizer failures fatal. Its targeted fixture checks nonuniform-cost flow feasibility/conservation, all single-edge exclusions, exhaustive small-graph cut optimality and reported cut capacity, plus FlowPolicy cost factors 1 and 2. [Results](results/validate-flow-variant.txt), the build/run log (not retained).
-- The same sanitized combined/caller build passes the existing cross-caller dump: **6,226 lines byte-identical** to the old binary, including forward/reverse/fanout, placement modes, FlowPolicy sequences, batch/sensitivity and KSP. [Hashes](results/bitgate-sha256.txt). Native batch/sensitivity thread budgets were set to 1 for this check to keep load bounded. The inline queue was separately checked by the full forward matrix; it was not included in that combined sanitized build.
-- [safety.cpp](safety.cpp) adds the width/int64/edgeless/concurrency probes described above. [Output](results/safety.txt).
-- [run-netgraph-review.py](run-netgraph-review.py) reruns four NetGraph workloads with five samples, `PYTHONHASHSEED=0`, bytecode writes disabled, explicitly selected old/new modules. [Module paths/hashes/load](results/netgraph-environment.txt) verify the same extension binaries used by the recorded experiment. No downstream rebuild was needed or performed; these runs measure the existing uncommitted change, **not** my C++ variants.
-
-NetGraph rerun, medians in ms, identical recorded workload digests in all phases:
-
-| Workload | Old A1 / A2 | New | New forced heap |
-|---|---:|---:|---:|
-| Full SPF, Clos 200×200 | 212.167 / 212.584 | 215.551 | 215.680 |
-| Full SPF, weighted 100×100 grid | 219.249 / 219.160 | 169.151 | 235.446 |
-| Bound-context max-flow, weighted grid combine | 201.715 / 204.482 | 160.344 | 216.545 |
-| Backbone Clos placement | 68.333 / 68.736 | 67.171 | 67.445 |
-
-The weighted benefit is independently reproduced. Sub-5% Clos/placement changes are noise under this review's rule. The broader 16-row scenario suite was read but not rerun.
-
-## 3. What the measurements do and do not establish
-
-Already-measured dead ends were not retried: sorting active buckets once, power-of-two masking as a cure for chains, re-hoisting TLS array pointers, re-fixing the function-pointer comparator, and moving growable buffers into locals. None is presented here as a new recommendation.
-
-1. **The strongest original claims are sound.** A matched old/new/forced-heap/old sequence, result checks and fresh processes are much better than comparing the slower experimental heap copy with its sibling bucket implementation. The weighted Core gain and approximately 1.25–1.30× weighted NetGraph gains survived this review. The small-query workspace gain also survives. GPU ten-worker tables and relaxed canonical-DAG prototypes are not comparable replacements; the plan correctly separates them.
-
-2. **A/B/A is not machine isolation.** Original Core load ranged 6.5–12.1, and original NetGraph load 3.9–6.5. Medians from consecutive samples within one process do not remove thermal/frequency, scheduler or allocator drift. My own load logs show 3.5–4.7 during the first two passes and roughly 8 during the third. These are useful large-effect confirmations on a shared machine, not the plan's promised quiet-machine acceptance evidence. Do not derive confidence intervals from nine correlated samples as if they were nine isolated process runs.
-
-3. **The “no unit workload regressed beyond A1/A2 drift” statement is literally too strong.** The recorded backbone placement row is 68.5/67.9 old versus 71.4 new; three-tier placement is 370.7/366.7 versus 381.3 (`CPU_PLAN.md:126–139,150–155`). Both exceed the old bracketing drift while being around the declared noise band. The defensible conclusion is “not a demonstrated regression,” not “within A1/A2 drift.” The first pre-comparator-fix pass is useful context but is not an independent replication of the final binary.
-
-4. **The sweep samples the wrong dimensions for a universal cutoff.** One positive uniform-random cost distribution, one N/degree and full-source queries cannot establish a universal W limit. Add exact boundary widths, stride>1, all-zero costs, sparse/high-diameter graphs, outlier edges, changing masks, first-query allocation and memory high-water behaviour. This review supplies boundary and some safety rows, not that entire performance matrix. Linux/x86 remains open. A masked wide edge can cause a fallback, rather than “merely wasting empty buckets.”
-
-5. **All supplied Core timing rows are warmed.** Expected `run_ref` calls occur before timing (`harness.cpp:263`), followed by two warmups (`:266`). This warms the new TLS workspace before its first measured call. All graph construction is outside timing. The timing loop retains the entire batch's output vectors until checking (`:267–271`), unlike callers that immediately consume/discard each result. This matters for allocation/cache pressure and the large-output conversion variant. Add cold first-call and immediate-consumption measurements rather than replacing the warmed numbers.
-
-6. **The NetGraph workloads are useful software-path coverage, not a representative demand distribution.** They include real APIs, shipped scenarios, pseudo nodes, failures, WCMP/ECMP and KSP. However, the positive result is dominated by a synthetic planar 100×100 grid with costs sampled from 1–20 (`bench_netgraph.py:85–110`). It is not evidence that a typical metric-weighted WAN simulation speeds up 25%; the included NSFNET scenario was already near neutral. Bound contexts are created outside timing (`:174–175,187–188,200–205`), while pairwise grid builds a context inside (`:231–237`); their different gains do not isolate queue effectiveness. Timed Python functions also hash/normalise results and perform NumPy reductions. Serial scenarios/Monte Carlo do not represent parallel worker-pool reuse or oversubscription.
-
-7. **Digest agreement has limits.** SPF checksums contain only a distance sum and parent count (`bench_netgraph.py:178–196`), so they cannot detect reordered/wrong parents, swapped distances or wrong via-edges. `norm` drops fields named `id` recursively (`:38–51`). Only the last inner repetition's checksum is compared (`:376–381`). Keep the full bitgate/differential evidence separate from these weaker end-to-end digests. Hash-seed pinning is a legitimate correction, but does not turn this into a semantic max-flow certificate. The targeted certificate added here provides a small independent check, not complete application acceptance.
-
-8. **Reverse P2 was not finished according to its own gate.** `CPU_PLAN.md:426–431` requires a measured reverse result; the plan elsewhere admits none. This review's reverse measurements show 14.188/13.807 → 8.539 ms on random weighted 4k graphs, and 0.402/0.409 → 0.741 ms on chains. Add these to the evidence rather than labelling an unmeasured stage done.
-
-9. **Rerun priorities:** first the exception reproducer after the production fix; then isolated new/variant/new and old/new/old on dense fabrics, narrow frontiers and wide-cost fallback, with shorter interleaved phase blocks and source hashes. Include cold/warm and immediate-consumption results, realistic caller counts/touched fractions/cost ranges, output size and total per-thread retained bytes. Profile search versus output versus reset to settle the fallback attribution. Finally run the normal project/integration/sanitizer gates after applying any production patches, and CI plus a second CPU architecture. Local measurements and previously passed suites do not replace those checks on the final code.
-
-## 4. Commit recommendation
-
-**Keep the ordered bucket queue, exact pop-order contract and sparse workspace strategy. They are a good streamlined baseline. Do not commit this exact tree unchanged.**
-
-Fix the reproduced allocation-failure contamination first. Correct the memory claim and either bound aggregate retained bucket capacity or explicitly accept and document the actual retention policy. Consider the settled-neighbour skip and one-pass forward output together: their dense-fabric gain is large enough to merit the modest additional review. The inline singleton path and fixed-routing reuse are measured, contained follow-ups; they can be separate commits rather than expanding the queue patch without limit.
-
-Retain the conservative width limit while documenting that its second-platform and cold/memory acceptance remains open. Record the remaining heap penalty as unexplained rather than an unavoidable workspace tax. There is no justification to block this CPU direction on GPU work, a general batch API, a different KSP algorithm, or a wholesale graph-layout redesign. There is also no evidence for saying that all reasonable cheap wins were exhausted.
diff --git a/dev/perf/spf_queue/review-2026-10/append.patch b/dev/perf/spf_queue/review-2026-10/append.patch
deleted file mode 100644
index 6c1139b..0000000
--- a/dev/perf/spf_queue/review-2026-10/append.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -676,6 +676,20 @@
-   }
-   PredDAG dag;
-   dag.parent_offsets.assign(static_cast<std::size_t>(N+1), 0);
-+  if (!sparse) {
-+    // Upper bound includes obsolete entries, but avoids a second list walk.
-+    dag.parents.reserve(ws.ent_parent.size());
-+    dag.via_edges.reserve(ws.ent_edge.size());
-+    for (std::int32_t v = 0; v < N; ++v) {
-+      for (auto i = ws.pred_head[static_cast<std::size_t>(v)]; i >= 0;
-+           i = ws.ent_next[static_cast<std::size_t>(i)]) {
-+        dag.parents.push_back(ws.ent_parent[static_cast<std::size_t>(i)]);
-+        dag.via_edges.push_back(ws.ent_edge[static_cast<std::size_t>(i)]);
-+      }
-+      dag.parent_offsets[static_cast<std::size_t>(v) + 1] = static_cast<std::int32_t>(dag.parents.size());
-+    }
-+    return {std::move(dist), std::move(dag)};
-+  }
-   auto count = [&](std::int32_t v) {
-     std::size_t c = 0;
-     for (std::int32_t i = ws.pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) ++c;
diff --git a/dev/perf/spf_queue/review-2026-10/build-flow.sh b/dev/perf/spf_queue/review-2026-10/build-flow.sh
deleted file mode 100644
index 5331fb6..0000000
--- a/dev/perf/spf_queue/review-2026-10/build-flow.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-set -eu
-r=dev/perf/spf_queue/review-2026-10
-flags=(-std=c++20 -O3 -funroll-loops -fno-math-errno -fno-trapping-math)
-for v in old new fixed; do
- case $v in
-  old) inc="$r/old-include"; spf="$r/old-shortest_paths.cpp"; graph="$r/old-strict_multidigraph.cpp"; flow=src/max_flow.cpp; state=src/flow_state.cpp;;
-  new) inc=include; spf=src/shortest_paths.cpp; graph=src/strict_multidigraph.cpp; flow=src/max_flow.cpp; state=src/flow_state.cpp;;
-  fixed) inc=include; spf=src/shortest_paths.cpp; graph=src/strict_multidigraph.cpp; flow="$r/max_flow-fixed.cpp"; state="$r/flow_state-fixed.cpp";;
- esac
- clang++ "${flags[@]}" -I"$inc" -Iinclude "$r/flow-driver.cpp" "$spf" "$graph" "$flow" "$state" src/profiling.cpp -o "build/perf/review-flow-$v"
-done
-for phase in old1 new1 fixed new2 old2; do
- case $phase in old*) v=old;;new*)v=new;;*)v=fixed;;esac
- uptime >> "$r/results/load-flow.txt"
- build/perf/review-flow-$v > "$r/results/flow-$phase.csv"
- echo "$phase done"
-done
diff --git a/dev/perf/spf_queue/review-2026-10/build-review.sh b/dev/perf/spf_queue/review-2026-10/build-review.sh
deleted file mode 100644
index 4dc1fe2..0000000
--- a/dev/perf/spf_queue/review-2026-10/build-review.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-set -eu
-cd "$(dirname "$0")/../../../../.."
-r=dev/perf/spf_queue/review-2026-10
-flags=(-std=c++20 -O3 -funroll-loops -fno-math-errno -fno-trapping-math)
-mkdir -p "$r/old-include/netgraph/core"
-for f in shortest_paths strict_multidigraph; do
-  git show "fbab119:include/netgraph/core/$f.hpp" > "$r/old-include/netgraph/core/$f.hpp"
-  git show "fbab119:src/$f.cpp" > "$r/old-$f.cpp"
-done
-clang++ "${flags[@]}" -I"$r/old-include" -Iinclude "$r/driver.cpp" "$r/old-shortest_paths.cpp" "$r/old-strict_multidigraph.cpp" src/profiling.cpp -o build/perf/review-old
-for v in baseline settled singleton heapitem notouch inline append frontpop combined; do
-  clang++ "${flags[@]}" -Iinclude "$r/driver.cpp" "$r/$v.cpp" src/strict_multidigraph.cpp src/profiling.cpp -o "build/perf/review-$v"
-  echo "built $v"
-done
diff --git a/dev/perf/spf_queue/review-2026-10/check-and-build.sh b/dev/perf/spf_queue/review-2026-10/check-and-build.sh
deleted file mode 100644
index 9abfc41..0000000
--- a/dev/perf/spf_queue/review-2026-10/check-and-build.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -eu
-r=dev/perf/spf_queue/review-2026-10
-for v in baseline settled inline; do
-  build/perf/review-$v correctness > "$r/results/correctness-$v.txt"
-  echo "correctness $v passed"
-done
-clang++ -std=c++20 -O3 -funroll-loops -fno-math-errno -fno-trapping-math -Iinclude "$r/driver.cpp" "$r/append.cpp" src/strict_multidigraph.cpp src/profiling.cpp -o build/perf/review-append
-for v in old baseline gcd; do
-  case $v in
-    old) graph="$r/old-strict_multidigraph.cpp"; inc="$r/old-include";;
-    baseline) graph=src/strict_multidigraph.cpp; inc=include;;
-    gcd) graph="$r/gcd.cpp"; inc=include;;
-  esac
-  clang++ -std=c++20 -O3 -funroll-loops -fno-math-errno -fno-trapping-math -I"$inc" -Iinclude "$r/construction.cpp" "$graph" -o build/perf/review-build-$v
-done
diff --git a/dev/perf/spf_queue/review-2026-10/combined.patch b/dev/perf/spf_queue/review-2026-10/combined.patch
deleted file mode 100644
index 5b645c3..0000000
--- a/dev/perf/spf_queue/review-2026-10/combined.patch
+++ /dev/null
@@ -1,41 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -580,7 +580,7 @@
-     // Process edges grouped by destination node (parallel edges are consecutive in CSR).
-     while (i < end) {
-       NodeId v = col[i];
--      if (use_node_mask && !node_mask[static_cast<std::size_t>(v)]) {
-+      if (settled[static_cast<std::size_t>(v)] || (use_node_mask && !node_mask[static_cast<std::size_t>(v)])) {
-         std::size_t j_skip = i; while (j_skip < end && col[j_skip] == v) ++j_skip; i = j_skip; continue;
-       }
- 
-@@ -676,6 +676,20 @@
-   }
-   PredDAG dag;
-   dag.parent_offsets.assign(static_cast<std::size_t>(N+1), 0);
-+  if (!sparse) {
-+    // Upper bound includes obsolete entries, but avoids a second list walk.
-+    dag.parents.reserve(ws.ent_parent.size());
-+    dag.via_edges.reserve(ws.ent_edge.size());
-+    for (std::int32_t v = 0; v < N; ++v) {
-+      for (auto i = ws.pred_head[static_cast<std::size_t>(v)]; i >= 0;
-+           i = ws.ent_next[static_cast<std::size_t>(i)]) {
-+        dag.parents.push_back(ws.ent_parent[static_cast<std::size_t>(i)]);
-+        dag.via_edges.push_back(ws.ent_edge[static_cast<std::size_t>(i)]);
-+      }
-+      dag.parent_offsets[static_cast<std::size_t>(v) + 1] = static_cast<std::int32_t>(dag.parents.size());
-+    }
-+    return {std::move(dist), std::move(dag)};
-+  }
-   auto count = [&](std::int32_t v) {
-     std::size_t c = 0;
-     for (std::int32_t i = ws.pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) ++c;
-@@ -829,7 +843,7 @@
-     std::size_t i = start;
-     while (i < end) {
-       NodeId u = icol[i];
--      if (use_node_mask && !node_mask[static_cast<std::size_t>(u)]) {
-+      if (settled[static_cast<std::size_t>(u)] || (use_node_mask && !node_mask[static_cast<std::size_t>(u)])) {
-         std::size_t j_skip = i; while (j_skip < end && icol[j_skip] == u) ++j_skip; i = j_skip; continue;
-       }
-       Cost min_edge_cost = kInf;
diff --git a/dev/perf/spf_queue/review-2026-10/construction.cpp b/dev/perf/spf_queue/review-2026-10/construction.cpp
deleted file mode 100644
index afbeaac..0000000
--- a/dev/perf/spf_queue/review-2026-10/construction.cpp
+++ /dev/null
@@ -1,28 +0,0 @@
-#include "netgraph/core/strict_multidigraph.hpp"
-#include <algorithm>
-#include <chrono>
-#include <iostream>
-#include <random>
-#include <vector>
-using namespace netgraph::core;
-int main() {
-  for (bool ordered: {false,true}) {
-    const int n=16384,m=131072;
-    std::vector<NodeId>s(m),d(m);std::vector<Cost>w(m);std::vector<Cap>a(m,1);
-    std::mt19937 rng(11);
-    for(int i=0;i<m;++i){s[i]=i%n;d[i]=rng()%n;w[i]=ordered?i+1:1+rng()%1048575;}
-    std::vector<double> samples;
-    std::uint64_t checksum=0;
-    for(int rep=-2;rep<9;++rep){
-      auto t=std::chrono::steady_clock::now();
-      auto g=StrictMultiDiGraph::from_arrays(n,s,d,a,w);
-      auto ms=std::chrono::duration<double,std::milli>(std::chrono::steady_clock::now()-t).count();
-      std::uint64_t h=0;for(auto c:g.cost_view())h=h*31+c;for(auto c:g.adj_edge_index_view())h=h*31+c;
-      if(rep==-2)checksum=h;else if(h!=checksum)return 2;
-      if(rep>=0)samples.push_back(ms);
-    }
-    auto sorted=samples;std::sort(sorted.begin(),sorted.end());
-    std::cout<<(ordered?"ordered":"random")<<','<<sorted[4]<<','<<checksum<<',';
-    for(auto t:samples)std::cout<<t<<';';std::cout<<std::endl;
-  }
-}
diff --git a/dev/perf/spf_queue/review-2026-10/driver.cpp b/dev/perf/spf_queue/review-2026-10/driver.cpp
deleted file mode 100644
index 9213224..0000000
--- a/dev/perf/spf_queue/review-2026-10/driver.cpp
+++ /dev/null
@@ -1,51 +0,0 @@
-#define main original_harness_main
-#include "../harness.cpp"
-#undef main
-
-static std::uint64_t hash_result(const Result& r) {
-  std::uint64_t h=1469598103934665603ULL;
-  auto mix=[&](auto const& v) { for (auto x:v) {h^=static_cast<std::uint64_t>(x);h*=1099511628211ULL;} };
-  mix(r.first); mix(r.second.parent_offsets);mix(r.second.parents);mix(r.second.via_edges);
-  return h;
-}
-int main(int argc,char**argv) {
-  std::string mode=argc>1?argv[1]:"focus";
-  int samples=argc>2?std::stoi(argv[2]):7;
-  if(mode=="correctness") return correctness();
-  if(mode=="reverse") {
-    std::cout<<"case,median_ms,hash,samples_ms\n";
-    for(auto kind:{"random","clos","chain","zerocyc"}) {
-      auto c=make_case(kind,std::string(kind)=="clos"?800:4096);
-      std::vector<double> times;
-      std::uint64_t hash=0;
-      for(int rep=-2;rep<samples;++rep) {
-        std::vector<Result> out;
-        auto start=Clock::now();
-        for(int q=0;q<16;++q) out.push_back(shortest_paths_to(c.graph,(q*997)%c.graph.num_nodes(),true,EdgeSelection{},c.residual,c.nm(),c.em()));
-        auto elapsed=ms(start);
-        std::uint64_t h=0;for(auto& r:out) h^=hash_result(r);
-        if(rep==-2) hash=h; else if(hash!=h) throw std::runtime_error("reverse nondeterminism");
-        if(rep>=0) times.push_back(elapsed);
-      }
-      auto sorted=times;std::sort(sorted.begin(),sorted.end());
-      std::cout<<kind<<','<<sorted[sorted.size()/2]<<','<<hash<<',';
-      for(auto t:times) std::cout<<t<<';';std::cout<<std::endl;
-    }
-    return 0;
-  }
-  std::vector<Workload> w;
-  if(mode=="boundary") {
-    for(Cost k:{32767,65534,65535,65536,131071,262143,1048575}) {
-      w.push_back({"wide"+std::to_string(k),make_case("wide",16384,8,false,false,11,k),8,"none"});
-      w.push_back({"near"+std::to_string(k),make_case("wide",16384,8,false,false,11,k),64,"near"});
-    }
-  } else {
-    w.push_back({"random16",make_case("random",16384),16,"none"});
-    w.push_back({"clos800",make_case("clos",800),16,"none"});
-    w.push_back({"chain2048",make_case("chain",2048),256,"none"});
-    w.push_back({"near16",make_case("random",16384),64,"near"});
-    w.push_back({"wide20",make_case("wide",16384,8,false,false,11,1048575),16,"none"});
-    w.push_back({"wide25",make_case("wide",16384,8,false,false,11,33554431),16,"none"});
-  }
-  time_workloads(w,"ref",samples,2097152);
-}
diff --git a/dev/perf/spf_queue/review-2026-10/early-exit.cpp b/dev/perf/spf_queue/review-2026-10/early-exit.cpp
deleted file mode 100644
index 3e2619e..0000000
--- a/dev/perf/spf_queue/review-2026-10/early-exit.cpp
+++ /dev/null
@@ -1,8 +0,0 @@
-#include "netgraph/core/shortest_paths.hpp"
-#include <iostream>
-using namespace netgraph::core;
-int main(){
- auto g=StrictMultiDiGraph::from_arrays(6,std::vector<NodeId>{0,0,2,0,0,4},std::vector<NodeId>{1,2,1,3,4,5},std::vector<Cap>{1,10,10,10,10,10},std::vector<Cost>{1,0,0,1,2,1});
- auto r=shortest_paths(g,0,3,true,EdgeSelection{});
- std::cout<<"target_cost="<<r.first[3]<<" beyond_target_cost="<<r.first[5]<<" (node 5 requires expanding distance-2 node 4)\n";
-}
diff --git a/dev/perf/spf_queue/review-2026-10/exception-fix.patch b/dev/perf/spf_queue/review-2026-10/exception-fix.patch
deleted file mode 100644
index 9c07780..0000000
--- a/dev/perf/spf_queue/review-2026-10/exception-fix.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -723,9 +723,9 @@
-   ForwardWorkspace& ws = tls_forward;
-   ws.acquire(static_cast<std::size_t>(N));
-   WorkspaceLease<ForwardWorkspace> lease{ws};
-+  ws.touched.push_back(src);
-   ws.dist[static_cast<std::size_t>(src)] = static_cast<Cost>(0);
-   ws.min_res[static_cast<std::size_t>(src)] = std::numeric_limits<Cap>::max();
--  ws.touched.push_back(src);
-   BucketPlan plan;
-   if (use_bucket_queue(g, queue, plan)) {
-     run_forward(ws.bucket, ws, g, src, dst, multipath, selection, residual, node_mask, edge_mask, plan);
-@@ -929,9 +929,9 @@
-   WorkspaceLease<ReverseWorkspace> lease{ws};
- 
-   if (target_allowed) {
-+    ws.touched.push_back(target);
-     ws.dist[static_cast<std::size_t>(target)] = static_cast<Cost>(0);
-     ws.min_res[static_cast<std::size_t>(target)] = std::numeric_limits<Cap>::max();
--    ws.touched.push_back(target);
-     BucketPlan plan;
-     if (use_bucket_queue(g, queue, plan)) {
-       run_reverse(ws.bucket, ws, g, target, multipath, selection, residual, node_mask, edge_mask, plan);
diff --git a/dev/perf/spf_queue/review-2026-10/fault-public.cpp b/dev/perf/spf_queue/review-2026-10/fault-public.cpp
deleted file mode 100644
index 7a89b53..0000000
--- a/dev/perf/spf_queue/review-2026-10/fault-public.cpp
+++ /dev/null
@@ -1,30 +0,0 @@
-#include <cstdlib>
-#include <new>
-#include <iostream>
-static bool fail_four = false;
-void* operator new(std::size_t n) {
-  if (fail_four && n == 4) { fail_four=false; throw std::bad_alloc(); }
-  if (void* p=std::malloc(n?n:1)) return p;
-  throw std::bad_alloc();
-}
-void operator delete(void* p) noexcept { std::free(p); }
-#include "netgraph/core/shortest_paths.hpp"
-using namespace netgraph::core;
-int main(int argc,char**argv) {
-  std::string mode=argc>1?argv[1]:"fault";
-  EdgeSelection sel;
-  if(mode=="fault") {
-    auto g=StrictMultiDiGraph::from_arrays(8,std::vector<NodeId>{1},std::vector<NodeId>{0},std::vector<Cap>{1},std::vector<Cost>{1});
-    fail_four=true;
-    try { (void)shortest_paths(g,0,std::nullopt,true,sel); }
-    catch(const std::bad_alloc&) { std::cout<<"caught forward bad_alloc\n"; }
-    auto r=shortest_paths(g,1,std::nullopt,true,sel);
-    std::cout<<"forward distance[0]="<<r.first[0]<<" expected=1\n";
-    auto rev=StrictMultiDiGraph::from_arrays(8,std::vector<NodeId>{0},std::vector<NodeId>{1},std::vector<Cap>{1},std::vector<Cost>{1});
-    fail_four=true;
-    try { (void)shortest_paths_to(rev,0,true,sel); }
-    catch(const std::bad_alloc&) { std::cout<<"caught reverse bad_alloc\n"; }
-    auto t=shortest_paths_to(rev,1,true,sel);
-    std::cout<<"reverse distance[0]="<<t.first[0]<<" expected=1\n";
-  }
-}
diff --git a/dev/perf/spf_queue/review-2026-10/fixed-routing.patch b/dev/perf/spf_queue/review-2026-10/fixed-routing.patch
deleted file mode 100644
index 36d2bc9..0000000
--- a/dev/perf/spf_queue/review-2026-10/fixed-routing.patch
+++ /dev/null
@@ -1,52 +0,0 @@
---- a/src/max_flow.cpp
-+++ b/src/max_flow.cpp
-@@ -120,18 +120,24 @@
-   // Iterate tiers: SPF over current residual or costs only
-   // require_capacity=true: Require edges to have capacity, exclude saturated links (SDN/TE behavior)
-   // require_capacity=false: Routes based on costs only, ignore capacity (IP/IGP behavior)
-+  std::pair<std::vector<Cost>, PredDAG> path_result;
-+  bool have_path_result = false;
-   while (true) {
-     EdgeSelection sel;
-     sel.multi_edge = true;
-     sel.require_capacity = require_capacity;
-     sel.tie_break = EdgeTieBreak::Deterministic;
--    auto [dist, dag] = shortest_paths(
-+    if (require_capacity || !have_path_result) {
-+      path_result = shortest_paths(
-         g, src, dst,
-         /*multipath=*/true,
-         sel,
-         require_capacity ? fs.residual_view() : std::span<const Cap>{},
-         use_node_mask ? node_mask : std::span<const bool>{},
-         use_edge_mask ? edge_mask : std::span<const bool>{});
-+      have_path_result = true;
-+    }
-+    const auto& [dist, dag] = path_result;
- 
-     // No path if t has no parents in DAG
-     if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size() - 1 ||
---- a/src/flow_state.cpp
-+++ b/src/flow_state.cpp
-@@ -535,14 +535,20 @@
-   }
- 
-   Flow total = static_cast<Flow>(0.0);
-+  std::pair<std::vector<Cost>, PredDAG> path_result;
-+  bool have_path_result = false;
-   while (true) {
-     EdgeSelection sel;
-     sel.multi_edge = true;
-     sel.require_capacity = require_capacity;
-     sel.tie_break = EdgeTieBreak::Deterministic;
--    auto [dist, dag] = shortest_paths(*g_, src, dst, /*multipath=*/true, sel,
-+    if (require_capacity || !have_path_result) {
-+      path_result = shortest_paths(*g_, src, dst, /*multipath=*/true, sel,
-                                       require_capacity ? residual_ : std::span<const Cap>{},
-                                       node_mask, edge_mask);
-+      have_path_result = true;
-+    }
-+    const auto& [dist, dag] = path_result;
-     if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size()-1 || dag.parent_offsets[static_cast<std::size_t>(dst)] == dag.parent_offsets[static_cast<std::size_t>(dst)+1]) {
-       break;
-     }
diff --git a/dev/perf/spf_queue/review-2026-10/flow-driver.cpp b/dev/perf/spf_queue/review-2026-10/flow-driver.cpp
deleted file mode 100644
index cf7fcb1..0000000
--- a/dev/perf/spf_queue/review-2026-10/flow-driver.cpp
+++ /dev/null
@@ -1,30 +0,0 @@
-#define main original_harness_main
-#include "../harness.cpp"
-#undef main
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/flow_state.hpp"
-static void feasible(const StrictMultiDiGraph&g,NodeId s,NodeId t,double f,std::span<const Cap> ef) {
- std::vector<double> balance(g.num_nodes());auto src=g.edge_src_view();auto dst=g.edge_dst_view();auto cap=g.capacity_view();
- for(std::size_t e=0;e<ef.size();++e){if(ef[e]<-1e-7||ef[e]>cap[e]+1e-7)throw std::runtime_error("capacity");balance[src[e]]+=ef[e];balance[dst[e]]-=ef[e];}
- for(int v=0;v<g.num_nodes();++v)if(std::abs(balance[v]-(v==s?f:v==t?-f:0))>1e-6)throw std::runtime_error("conservation");
-}
-int main() {
- std::cout<<"case,median_ms,hash,samples_ms\n";
- for(bool masked:{false,true})for(bool state:{false,true}) {
-  auto c=make_case("random",4096,8,masked);std::vector<double> samples;std::uint64_t hash=0;
-  for(int q=0;q<8;++q){c.node_mask[q*17]=true;c.node_mask[2048+q]=true;}
-  for(int rep=-2;rep<7;++rep){
-   std::vector<std::pair<Flow,FlowSummary>> out;out.reserve(8);
-   auto start=Clock::now();
-   for(int q=0;q<8;++q){
-    NodeId s=q*17,t=2048+q;
-    if(state){FlowState fs(c.graph);double f=fs.place_max_flow(s,t,FlowPlacement::Proportional,false,false,c.nm(),c.em());FlowSummary sm;sm.edge_flows.assign(fs.edge_flow_view().begin(),fs.edge_flow_view().end());out.emplace_back(f,std::move(sm));}
-    else out.push_back(calc_max_flow(c.graph,s,t,FlowPlacement::Proportional,false,false,true,false,false,c.nm(),c.em()));
-   }
-   auto elapsed=ms(start);std::uint64_t h=0;
-   for(int q=0;q<8;++q){auto&[f,sm]=out[q];feasible(c.graph,q*17,2048+q,f,sm.edge_flows);h=h*31+std::bit_cast<std::uint64_t>(f);for(auto e:sm.edge_flows)h=h*31+std::bit_cast<std::uint64_t>(e);for(auto e:sm.costs)h=h*31+e;for(auto e:sm.flows)h=h*31+std::bit_cast<std::uint64_t>(e);}
-   if(rep==-2)hash=h;else if(hash!=h)throw std::runtime_error("changed output");if(rep>=0)samples.push_back(elapsed);
-  }
-  auto sorted=samples;std::sort(sorted.begin(),sorted.end());std::cout<<(state?"place_max_flow":"calc_max_flow")<<(masked?"_masked":"")<<','<<sorted[3]<<','<<hash<<',';for(auto t:samples)std::cout<<t<<';';std::cout<<std::endl;
- }
-}
diff --git a/dev/perf/spf_queue/review-2026-10/frontpop.patch b/dev/perf/spf_queue/review-2026-10/frontpop.patch
deleted file mode 100644
index 1726359..0000000
--- a/dev/perf/spf_queue/review-2026-10/frontpop.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -283,8 +283,9 @@
-   bool empty() const { return h.empty(); }
-   Cost top_cost() const { return std::get<0>(h.front()); }
-   QItem pop() {
-+    QItem t = h.front();
-     std::pop_heap(h.begin(), h.end(), Greater{});
--    QItem t = h.back(); h.pop_back(); return t;
-+    h.pop_back(); return t;
-   }
-   void push(Cost c, Cap nr, NodeId v) {
-     h.emplace_back(c, nr, v);
diff --git a/dev/perf/spf_queue/review-2026-10/gcd.cpp b/dev/perf/spf_queue/review-2026-10/gcd.cpp
deleted file mode 100644
index 7c5ba12..0000000
--- a/dev/perf/spf_queue/review-2026-10/gcd.cpp
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
-  StrictMultiDiGraph — immutable directed multigraph with deterministic layout.
-
-  Construction from arrays validates inputs and builds CSR and reverse CSR
-  adjacency structures. Edges are reordered by (cost, src, dst) to cluster
-  equal-cost tiers for deterministic traversal.
-*/
-#include "netgraph/core/strict_multidigraph.hpp"
-
-#include <algorithm>
-#include <numeric>
-#include <stdexcept>
-
-namespace netgraph::core {
-
-StrictMultiDiGraph StrictMultiDiGraph::from_arrays(
-    std::int32_t num_nodes,
-    std::span<const std::int32_t> src,
-    std::span<const std::int32_t> dst,
-    std::span<const Cap> capacity,
-    std::span<const Cost> cost,
-    std::span<const std::int64_t> ext_edge_ids) {
-
-  if (num_nodes < 0) {
-    throw std::invalid_argument("num_nodes must be >= 0");
-  }
-  if (src.size() != dst.size() || src.size() != capacity.size() || src.size() != cost.size()) {
-    throw std::invalid_argument("src, dst, capacity, and cost must have the same length");
-  }
-  if (!ext_edge_ids.empty() && ext_edge_ids.size() != src.size()) {
-    throw std::invalid_argument("ext_edge_ids must be empty or have the same length as src/dst/capacity/cost");
-  }
-  StrictMultiDiGraph g;
-  g.num_nodes_ = num_nodes;
-  std::size_t m = src.size();
-  if (m > static_cast<std::size_t>(std::numeric_limits<std::int32_t>::max())) {
-    throw std::invalid_argument("number of edges exceeds INT32_MAX");
-  }
-
-  // Invariants: ids within [0, num_nodes), non-negative weights.
-  // SPF accumulates path costs as int64 without overflow checks and uses
-  // INT64_MAX as the unreachable sentinel, so the total of all edge costs
-  // (an upper bound on any simple path, and on one reverse-edge bounce) must
-  // stay below 2^62 or accumulated costs could wrap negative and silently
-  // corrupt results.
-  constexpr std::uint64_t kMaxTotalCost = (std::uint64_t{1} << 62);
-  std::uint64_t total_cost = 0;
-  Cost max_cost = 0;
-  Cost cost_gcd = 0;
-  for (std::size_t i = 0; i < m; ++i) {
-    if (src[i] < 0 || dst[i] < 0 || src[i] >= num_nodes || dst[i] >= num_nodes) {
-      throw std::out_of_range("edge index out of range of num_nodes");
-    }
-    if (capacity[i] < 0.0) {
-      throw std::invalid_argument("capacity must be >= 0");
-    }
-    if (cost[i] < 0) { throw std::invalid_argument("cost must be >= 0"); }
-    const auto c = static_cast<std::uint64_t>(cost[i]);
-    if (c >= kMaxTotalCost - total_cost) {
-      throw std::invalid_argument(
-          "total edge cost must stay below 2^62: larger accumulated path costs "
-          "overflow int64 cost arithmetic and silently corrupt results");
-    }
-    total_cost += c;
-    if (cost[i] > max_cost) max_cost = cost[i];
-    if (cost_gcd != 1) cost_gcd = std::gcd(cost_gcd, cost[i]);
-  }
-  g.max_cost_ = max_cost;
-  g.cost_gcd_ = cost_gcd;
-  // Gather initial arrays
-  std::vector<NodeId> src_v(src.begin(), src.end());
-  std::vector<NodeId> dst_v(dst.begin(), dst.end());
-  std::vector<Cap> cap_v(capacity.begin(), capacity.end());
-  std::vector<Cost> cost_v(cost.begin(), cost.end());
-  std::vector<std::int64_t> ext_v;
-  if (!ext_edge_ids.empty()) {
-    ext_v.assign(ext_edge_ids.begin(), ext_edge_ids.end());
-  }
-
-  // Sort edges by (cost, src, dst) to cluster equal-cost tiers for deterministic traversal.
-  // Create an index array [0, 1, 2, ..., m-1] that we'll permute to define the reordering.
-  std::vector<std::size_t> idx(m);
-  std::iota(idx.begin(), idx.end(), 0);  // iota fills with sequential values
-
-  // Cost-first ordering keeps equal-cost tiers clustered; within the same
-  // cost, maintain stable source/destination ordering for reproducibility.
-  // stable_sort preserves relative order of equal elements, ensuring determinism.
-  // Lambda comparator: [&] captures variables by reference, (a, b) are indices to compare.
-  std::stable_sort(idx.begin(), idx.end(), [&](std::size_t a, std::size_t b) {
-    if (cost_v[a] != cost_v[b]) return cost_v[a] < cost_v[b];
-    if (src_v[a] != src_v[b]) return src_v[a] < src_v[b];
-    return dst_v[a] < dst_v[b];
-  });
-
-  // Reorder all edge arrays using the computed permutation.
-  // Generic lambda (auto parameters) works with any vector type.
-  auto apply_perm = [&](auto& out_vec, const auto& in_vec) {
-    out_vec.resize(m);
-    for (std::size_t i = 0; i < m; ++i) out_vec[i] = in_vec[idx[i]];
-  };
-  apply_perm(g.src_, src_v);
-  apply_perm(g.dst_, dst_v);
-  apply_perm(g.capacity_, cap_v);
-  apply_perm(g.cost_, cost_v);
-  if (!ext_v.empty()) {
-    apply_perm(g.ext_edge_ids_, ext_v);
-  }
-  g.edges_ = m;
-
-  // Build CSR (Compressed Sparse Row) adjacency structure.
-  // For each node u, row_offsets_[u]:row_offsets_[u+1] gives the range in col_indices_
-  // that stores u's outgoing neighbors, and adj_edge_index_ stores the corresponding EdgeIds.
-
-  // Step 1: Count outgoing edges per node (histogram).
-  g.row_offsets_.assign(static_cast<std::size_t>(num_nodes) + 1, 0);
-  for (std::size_t i = 0; i < m; ++i) {
-    g.row_offsets_[static_cast<std::size_t>(g.src_[i]) + 1]++;
-  }
-
-  // Step 2: Convert counts to cumulative offsets (prefix sum).
-  // row_offsets_[u] is the starting index for node u's adjacency list.
-  for (std::size_t i = 1; i < g.row_offsets_.size(); ++i) {
-    g.row_offsets_[i] += g.row_offsets_[i - 1];
-  }
-
-  // Step 3: Fill col_indices_ and adj_edge_index_ arrays.
-  g.col_indices_.resize(m);
-  g.adj_edge_index_.resize(m);
-  // cursor tracks the current write position for each node's adjacency list.
-  std::vector<std::int32_t> cursor = g.row_offsets_;  // copy for in-place filling
-  for (std::size_t e = 0; e < m; ++e) {
-    auto u = g.src_[e];
-    auto pos = static_cast<std::size_t>(cursor[static_cast<std::size_t>(u)]++);
-    g.col_indices_[pos] = g.dst_[e];        // neighbor node
-    g.adj_edge_index_[pos] = static_cast<EdgeId>(e);  // edge index
-  }
-  // Build reverse CSR (incoming adjacency) for predecessor tracking.
-  // Same CSR construction algorithm, but keyed by destination node instead of source.
-  // This enables efficient lookup of incoming edges for any node.
-
-  // Step 1: Count incoming edges per node.
-  g.in_row_offsets_.assign(static_cast<std::size_t>(num_nodes) + 1, 0);
-  for (std::size_t i = 0; i < m; ++i) {
-    g.in_row_offsets_[static_cast<std::size_t>(g.dst_[i]) + 1]++;
-  }
-
-  // Step 2: Convert counts to cumulative offsets.
-  for (std::size_t i = 1; i < g.in_row_offsets_.size(); ++i) {
-    g.in_row_offsets_[i] += g.in_row_offsets_[i - 1];
-  }
-
-  // Step 3: Fill reverse adjacency arrays.
-  g.in_col_indices_.resize(m);
-  g.in_adj_edge_index_.resize(m);
-  std::vector<std::int32_t> rcursor = g.in_row_offsets_;
-  for (std::size_t e = 0; e < m; ++e) {
-    auto v = g.dst_[e];
-    auto pos = static_cast<std::size_t>(rcursor[static_cast<std::size_t>(v)]++);
-    g.in_col_indices_[pos] = g.src_[e];     // predecessor node
-    g.in_adj_edge_index_[pos] = static_cast<EdgeId>(e);
-  }
-  return g;
-}
-
-} // namespace netgraph::core
diff --git a/dev/perf/spf_queue/review-2026-10/gcd.patch b/dev/perf/spf_queue/review-2026-10/gcd.patch
deleted file mode 100644
index 44d24db..0000000
--- a/dev/perf/spf_queue/review-2026-10/gcd.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/strict_multidigraph.cpp
-+++ b/src/strict_multidigraph.cpp
-@@ -63,7 +63,7 @@
-     }
-     total_cost += c;
-     if (cost[i] > max_cost) max_cost = cost[i];
--    cost_gcd = std::gcd(cost_gcd, cost[i]);
-+    if (cost_gcd != 1) cost_gcd = std::gcd(cost_gcd, cost[i]);
-   }
-   g.max_cost_ = max_cost;
-   g.cost_gcd_ = cost_gcd;
diff --git a/dev/perf/spf_queue/review-2026-10/heapitem.patch b/dev/perf/spf_queue/review-2026-10/heapitem.patch
deleted file mode 100644
index 65e21b4..0000000
--- a/dev/perf/spf_queue/review-2026-10/heapitem.patch
+++ /dev/null
@@ -1,26 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -269,19 +269,20 @@
- constexpr Cost kInf = std::numeric_limits<Cost>::max();
- constexpr std::size_t kMaxBucketWidth = std::size_t{1} << 16;
- 
--using QItem = std::tuple<Cost, Cap, NodeId>;
-+struct QItem { Cost cost; Cap neg_res; NodeId node; };
-+
- 
- // Reference queue: binary heap on (cost, -bottleneck, node). Keys are unique per
- // push (a node is re-pushed only with a strictly smaller cost or a strictly
- // larger bottleneck), so the pop order is fully determined by the key.
- struct HeapQueue {
-   // Functor, not a function pointer: std::push_heap / pop_heap inline it.
--  struct Greater { bool operator()(const QItem& a, const QItem& b) const { return a > b; } };
-+  struct Greater { bool operator()(const QItem& a, const QItem& b) const { return a.cost != b.cost ? a.cost > b.cost : (a.neg_res != b.neg_res ? a.neg_res > b.neg_res : a.node > b.node); } };
-   std::vector<QItem> h;
-   void begin(std::size_t, Cost) { h.clear(); }
-   void end() { h.clear(); }
-   bool empty() const { return h.empty(); }
--  Cost top_cost() const { return std::get<0>(h.front()); }
-+  Cost top_cost() const { return h.front().cost; }
-   QItem pop() {
-     std::pop_heap(h.begin(), h.end(), Greater{});
-     QItem t = h.back(); h.pop_back(); return t;
diff --git a/dev/perf/spf_queue/review-2026-10/inline.patch b/dev/perf/spf_queue/review-2026-10/inline.patch
deleted file mode 100644
index 11bf039..0000000
--- a/dev/perf/spf_queue/review-2026-10/inline.patch
+++ /dev/null
@@ -1,70 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -304,13 +304,15 @@
-   std::vector<std::uint64_t> occ;   // one bit per non-empty bucket
-   std::size_t W = 0, cur_b = 0, pending = 0;
-   Cost cur = 0, stride = 1;
-+  bool inline_item = false;
-+  QItem single;
- 
-   void begin(std::size_t width, Cost stride_) {
-     stride = stride_;
-     W = width;
-     if (buckets.size() < W) buckets.resize(W);
-     occ.assign((W + 63) / 64, 0);
--    cur = 0; cur_b = 0; pending = 0;
-+    cur = 0; cur_b = 0; pending = 0; inline_item = false;
-   }
-   // Early exit can leave items behind; clear only the occupied buckets.
-   void end() {
-@@ -323,20 +325,31 @@
-       }
-       occ[w] = 0;
-     }
--    pending = 0;
-+    pending = 0; inline_item = false;
-   }
-   bool empty() const { return pending == 0; }
-   std::size_t bucket_of(Cost c) const {
-     const Cost q = stride == 1 ? c : c / stride;
-     return static_cast<std::size_t>(q % static_cast<Cost>(W));
-   }
--  void push(Cost c, Cap nr, NodeId v) {
-+  void push_bucket(Cost c, Cap nr, NodeId v) {
-     const std::size_t b = bucket_of(c);
-     auto& vec = buckets[b];
-     if (vec.empty()) occ[b >> 6] |= (std::uint64_t{1} << (b & 63));
-     vec.push_back({nr, v});
-     if (b == cur_b) std::push_heap(vec.begin(), vec.end(), Greater{});
-     ++pending;
-+  }
-+  void push(Cost c, Cap nr, NodeId v) {
-+    if (pending == 0) {
-+      single = {c, nr, v}; inline_item = true; pending = 1; return;
-+    }
-+    if (inline_item) {
-+      inline_item = false; pending = 0;
-+      cur_b = bucket_of(cur);
-+      push_bucket(std::get<0>(single), std::get<1>(single), std::get<2>(single));
-+    }
-+    push_bucket(c, nr, v);
-   }
-   // Advance to the next non-empty bucket when the active one is exhausted.
-   // Precondition: pending > 0.
-@@ -352,8 +365,15 @@
-     cur += static_cast<Cost>(steps) * stride; cur_b = f;
-     std::make_heap(buckets[f].begin(), buckets[f].end(), Greater{});
-   }
--  Cost top_cost() { settle_active(); return cur; }
-+  Cost top_cost() { if (inline_item) return std::get<0>(single); settle_active(); return cur; }
-   QItem pop() {
-+    if (inline_item) {
-+      inline_item = false; pending = 0;
-+      // Keep cursor tied to the last bucket activation. A later promotion
-+      // must first restore the current absolute cost and cyclic index.
-+      cur = std::get<0>(single);
-+      return single;
-+    }
-     settle_active();
-     auto& vec = buckets[cur_b];
-     std::pop_heap(vec.begin(), vec.end(), Greater{});
diff --git a/dev/perf/spf_queue/review-2026-10/notouch.patch b/dev/perf/spf_queue/review-2026-10/notouch.patch
deleted file mode 100644
index d89d905..0000000
--- a/dev/perf/spf_queue/review-2026-10/notouch.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -396,7 +396,7 @@
- // Shared reset policy: sparse when few nodes were touched, wholesale otherwise.
- // The same predicate decides how outputs are materialised, so the two agree.
- template <class WS>
--bool sparse_reset(const WS& ws) { return ws.touched.size() * 4 < ws.dist.size(); }
-+bool sparse_reset(const WS&) { return false; }
- 
- template <class Vec>
- void ensure_sized(Vec& v, std::size_t n, typename Vec::value_type init) {
-@@ -644,7 +644,7 @@
-         if (new_cost < dist[v_idx] ||
-             (!multipath && new_cost == dist[v_idx] && !settled[v_idx] &&
-              path_residual > min_residual_to_node[v_idx] + kEpsilon)) {
--          if (dist[v_idx] == kInf) ws.touched.push_back(v);
-+          
-           dist[v_idx] = new_cost;
-           min_residual_to_node[v_idx] = path_residual;
-           pred_clear(v_idx);
-@@ -884,7 +884,7 @@
-         if (new_cost < dist[u_idx] ||
-             (!multipath && new_cost == dist[u_idx] && !settled[u_idx] &&
-              path_residual > min_residual_to_dst[u_idx] + kEpsilon)) {
--          if (dist[u_idx] == kInf) ws.touched.push_back(u);
-+          
-           dist[u_idx] = new_cost;
-           min_residual_to_dst[u_idx] = path_residual;
-           succ_clear(u_idx);
diff --git a/dev/perf/spf_queue/review-2026-10/results/append-c.csv b/dev/perf/spf_queue/review-2026-10/results/append-c.csv
deleted file mode 100644
index 963e199..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/append-c.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,37.635792,7,38.207416;37.606375;37.612834;38.542167;37.918750;36.896417;37.635792
-clos800,800,320000,16,none,ref,0,2,31.158875,7,32.008042;31.218041;30.541250;31.576083;30.373084;30.469209;31.158875
-chain2048,2048,2047,256,none,ref,0,32,5.696250,7,5.622625;5.661208;5.606292;5.892458;6.009208;5.816542;5.696250
-near16,16384,131072,64,near,ref,0,32,0.406750,7,0.406542;0.404417;0.408167;0.406750;0.404791;0.409375;0.415750
-wide20,16384,131072,16,none,ref,0,1048570,54.188333,7,54.352083;54.185958;55.721250;54.188333;55.605583;52.820000;53.110667
-wide25,16384,131072,16,none,ref,1,33554196,51.991458,7,51.991458;51.997417;52.447250;52.295000;51.866917;51.883875;51.872750
diff --git a/dev/perf/spf_queue/review-2026-10/results/append.csv b/dev/perf/spf_queue/review-2026-10/results/append.csv
deleted file mode 100644
index 6c8c744..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/append.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,35.207541,7,35.238625;35.097416;35.207541;35.161000;35.137917;35.443708;35.211333
-clos800,800,320000,16,none,ref,0,2,29.755084,7,29.659500;29.755084;30.265916;29.593917;29.666625;31.104000;31.114667
-chain2048,2048,2047,256,none,ref,0,32,5.591333,7,5.560791;5.577542;5.731958;5.845959;5.459833;5.591333;5.787625
-near16,16384,131072,64,near,ref,0,32,0.392125,7,0.392125;0.382834;0.387250;0.393375;0.392000;0.400333;0.393125
-wide20,16384,131072,16,none,ref,0,1048570,50.562958,7,50.479000;50.832333;50.819333;50.634875;50.442125;50.358042;50.562958
-wide25,16384,131072,16,none,ref,1,33554196,52.024125,7,53.655625;53.328708;52.807833;51.244209;52.024125;51.598250;50.987958
diff --git a/dev/perf/spf_queue/review-2026-10/results/bitgate-sha256.txt b/dev/perf/spf_queue/review-2026-10/results/bitgate-sha256.txt
deleted file mode 100644
index 5c7d9c6..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/bitgate-sha256.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-a976f254eced152b14991ba2198351ec7983506f3f1e177c289852ec2bcaab90  dev/perf/spf_queue/review-2026-10/results/bitgate-old.txt
-a976f254eced152b14991ba2198351ec7983506f3f1e177c289852ec2bcaab90  dev/perf/spf_queue/review-2026-10/results/bitgate-variant.txt
diff --git a/dev/perf/spf_queue/review-2026-10/results/boundary-heap.csv b/dev/perf/spf_queue/review-2026-10/results/boundary-heap.csv
deleted file mode 100644
index 9a39655..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/boundary-heap.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide32767,16384,131072,8,none,ref,0,32768,27.216125,7,28.146458;28.266458;27.100084;27.216125;27.213083;26.975083;27.599292
-near32767,16384,131072,64,near,ref,0,32768,0.395458,7,0.395458;0.391791;0.388500;0.389708;0.395542;0.395542;0.430625
-wide65534,16384,131072,8,none,ref,0,65535,26.349792,7,26.349792;26.298375;26.907792;26.210750;27.317625;26.253333;26.499417
-near65534,16384,131072,64,near,ref,0,65535,0.389917,7,0.389917;0.390083;0.388792;0.389791;0.390125;0.389750;0.392041
-wide65535,16384,131072,8,none,ref,0,65536,27.174750,7,27.377917;28.266584;26.928917;27.180500;27.174750;26.481250;26.367625
-near65535,16384,131072,64,near,ref,0,65536,0.398709,7,0.380667;0.395583;0.475958;0.724667;0.407708;0.398709;0.394125
-wide65536,16384,131072,8,none,ref,0,65537,26.865125,7,26.781208;26.649750;26.865125;26.975500;27.283250;26.901583;26.306791
-near65536,16384,131072,64,near,ref,0,65537,0.406292,7,0.406375;0.394000;0.394916;0.406292;0.400000;0.407583;0.407459
-wide131071,16384,131072,8,none,ref,0,131072,27.059250,7,26.298084;27.059250;27.075958;27.368333;26.491750;27.280125;26.502750
-near131071,16384,131072,64,near,ref,0,131072,0.389958,7,0.389833;0.389958;0.389042;0.388833;0.440458;0.397708;0.407625
-wide262143,16384,131072,8,none,ref,0,262144,26.460459,7,27.210333;26.460459;25.910166;26.587958;26.447375;27.095792;26.146417
-near262143,16384,131072,64,near,ref,0,262144,0.394750,7,0.394750;0.388334;0.404417;0.399833;0.397458;0.393167;0.393458
-wide1048575,16384,131072,8,none,ref,0,1048570,27.349042,7,27.048000;26.335291;26.375625;27.913125;29.361833;28.475000;27.349042
-near1048575,16384,131072,64,near,ref,0,1048570,0.441584,7,0.397750;0.396167;0.442500;0.448958;0.426250;0.453333;0.441584
diff --git a/dev/perf/spf_queue/review-2026-10/results/boundary-new1.csv b/dev/perf/spf_queue/review-2026-10/results/boundary-new1.csv
deleted file mode 100644
index 5e16cdf..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/boundary-new1.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide32767,16384,131072,8,none,ref,0,32768,17.627750,7,17.467708;17.788917;17.774958;17.912958;17.627750;17.498041;17.571250
-near32767,16384,131072,64,near,ref,0,32768,0.420792,7,0.420792;0.418875;0.419792;0.424292;0.422000;0.419125;0.450750
-wide65534,16384,131072,8,none,ref,0,65535,18.146791,7,17.373209;18.146791;17.820625;18.424875;18.379041;19.409584;18.128625
-near65534,16384,131072,64,near,ref,0,65535,0.455083,7,0.485750;0.434000;0.433791;0.455083;0.460917;0.459959;0.449458
-wide65535,16384,131072,8,none,ref,0,65536,18.499458,7,18.164084;21.170541;19.691125;18.580833;18.453917;18.499458;17.288917
-near65535,16384,131072,64,near,ref,0,65536,0.434500,7,0.439750;0.494458;0.464708;0.432375;0.434500;0.431833;0.431417
-wide65536,16384,131072,8,none,ref,0,65537,26.490750,7,26.255750;27.382208;26.490750;26.883292;26.491833;26.317709;26.318292
-near65536,16384,131072,64,near,ref,0,65537,0.413542,7,0.413542;0.412375;0.412042;0.422792;0.530541;0.414708;0.412959
-wide131071,16384,131072,8,none,ref,0,131072,26.303167,7,26.388291;26.303167;26.215125;26.181541;26.688667;26.346208;26.260875
-near131071,16384,131072,64,near,ref,0,131072,0.411958,7,0.412792;0.411958;0.412542;0.411333;0.411958;0.413125;0.411833
-wide262143,16384,131072,8,none,ref,0,262144,27.104375,7,27.291750;28.251584;27.074000;27.684125;26.756209;26.675708;27.104375
-near262143,16384,131072,64,near,ref,0,262144,0.418458,7,0.422875;0.416291;0.412375;0.411208;0.418458;0.418916;0.535708
-wide1048575,16384,131072,8,none,ref,0,1048570,27.498000,7,28.209334;26.654250;27.265667;27.498000;28.699583;27.445416;27.548208
-near1048575,16384,131072,64,near,ref,0,1048570,0.419458,7,0.412292;0.409958;0.438000;0.465000;0.417958;0.419458;0.420875
diff --git a/dev/perf/spf_queue/review-2026-10/results/boundary-old1.csv b/dev/perf/spf_queue/review-2026-10/results/boundary-old1.csv
deleted file mode 100644
index cf301c2..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/boundary-old1.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide32767,16384,131072,8,none,ref,0,32768,25.959000,7,25.920750;25.994708;26.018958;25.959000;25.868584;25.998833;25.945334
-near32767,16384,131072,64,near,ref,0,32768,1.123792,7,1.123792;1.143875;1.312083;1.174542;1.120500;1.118458;1.117542
-wide65534,16384,131072,8,none,ref,0,65535,25.432833,7,25.434417;25.484792;25.432833;25.497625;25.411417;25.386000;25.402792
-near65534,16384,131072,64,near,ref,0,65535,1.131375,7,1.134792;1.131375;1.126750;1.150958;1.130917;1.142292;1.127750
-wide65535,16384,131072,8,none,ref,0,65536,25.641458,7,26.183459;25.641458;25.704083;25.475583;25.608166;26.744875;25.582750
-near65535,16384,131072,64,near,ref,0,65536,1.171208,7,1.171375;1.171208;1.144834;1.162584;1.129458;1.229166;1.239417
-wide65536,16384,131072,8,none,ref,0,65537,25.659250,7,25.589125;25.567500;25.659250;25.878333;25.921041;25.928000;25.645167
-near65536,16384,131072,64,near,ref,0,65537,1.172500,7,1.195500;1.233375;1.134375;1.126542;1.172500;1.192833;1.132958
-wide131071,16384,131072,8,none,ref,0,131072,25.524916,7,25.363959;26.327625;25.538041;25.349375;25.411375;25.524916;25.594667
-near131071,16384,131072,64,near,ref,0,131072,1.128166,7,1.148709;1.154292;1.137500;1.125667;1.128166;1.125709;1.125333
-wide262143,16384,131072,8,none,ref,0,262144,25.191500,7,25.191500;25.104833;25.250792;25.137333;25.226084;25.305292;25.094250
-near262143,16384,131072,64,near,ref,0,262144,1.129625,7,1.129625;1.127042;1.123833;1.136125;1.134375;1.128792;1.140958
-wide1048575,16384,131072,8,none,ref,0,1048570,25.106542,7,25.123750;24.851209;25.116375;25.106542;25.039958;24.997625;25.230250
-near1048575,16384,131072,64,near,ref,0,1048570,1.142375,7,1.179875;1.140000;1.142375;1.240625;1.144541;1.120459;1.122583
diff --git a/dev/perf/spf_queue/review-2026-10/results/boundary-old2.csv b/dev/perf/spf_queue/review-2026-10/results/boundary-old2.csv
deleted file mode 100644
index f00beda..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/boundary-old2.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide32767,16384,131072,8,none,ref,0,32768,26.271750,7,26.301167;26.686875;26.371917;26.255292;26.271750;26.190042;26.068333
-near32767,16384,131072,64,near,ref,0,32768,1.136167,7,1.182583;1.136167;1.135125;1.136917;1.135708;1.133125;1.143458
-wide65534,16384,131072,8,none,ref,0,65535,25.761125,7,25.856750;26.884209;26.271416;25.761125;25.596167;25.732250;25.505250
-near65534,16384,131072,64,near,ref,0,65535,1.122666,7,1.153667;1.121250;1.114917;1.114459;1.201875;1.122666;1.176334
-wide65535,16384,131072,8,none,ref,0,65536,26.609084,7,26.609084;26.286708;26.560916;27.546417;26.013458;26.998000;27.639542
-near65535,16384,131072,64,near,ref,0,65536,1.149334,7,1.201292;1.135834;1.149334;1.146417;1.154333;1.138625;1.189833
-wide65536,16384,131072,8,none,ref,0,65537,25.453542,7,25.453542;25.423167;25.036875;25.191000;25.708125;26.894000;26.066042
-near65536,16384,131072,64,near,ref,0,65537,1.156958,7,1.140209;1.261541;1.156958;1.205750;1.184833;1.146458;1.149083
-wide131071,16384,131072,8,none,ref,0,131072,25.179291,7,25.184625;25.557708;25.030125;25.059708;25.179291;25.229375;25.011292
-near131071,16384,131072,64,near,ref,0,131072,1.118291,7,1.117792;1.129750;1.117000;1.118291;1.116959;1.148750;1.128125
-wide262143,16384,131072,8,none,ref,0,262144,25.164583,7,25.164583;24.947750;24.892708;25.117916;25.187125;26.459750;25.999500
-near262143,16384,131072,64,near,ref,0,262144,1.178209,7,1.201500;1.223667;1.178209;1.121833;1.120084;1.119375;1.190333
-wide1048575,16384,131072,8,none,ref,0,1048570,25.150958,7,25.270875;25.395917;25.150958;25.117542;25.158292;24.994500;25.007375
-near1048575,16384,131072,64,near,ref,0,1048570,1.136750,7,1.179000;1.136750;1.121125;1.119167;1.150625;1.138500;1.136375
diff --git a/dev/perf/spf_queue/review-2026-10/results/boundary-settled.csv b/dev/perf/spf_queue/review-2026-10/results/boundary-settled.csv
deleted file mode 100644
index b638446..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/boundary-settled.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-wide32767,16384,131072,8,none,ref,0,32768,17.436917,7,19.366000;17.364333;17.382625;16.994875;17.436917;19.600291;17.841792
-near32767,16384,131072,64,near,ref,0,32768,0.414458,7,0.420208;0.413459;0.413458;0.414458;0.832042;0.430917;0.412333
-wide65534,16384,131072,8,none,ref,0,65535,18.717125,7,18.717125;17.463917;17.628958;16.499875;19.448833;19.348125;18.993583
-near65534,16384,131072,64,near,ref,0,65535,0.471833,7,0.493834;0.480708;0.470208;0.470625;0.483500;0.471833;0.470708
-wide65535,16384,131072,8,none,ref,0,65536,19.366166,7,19.366166;18.572250;17.788084;20.007792;20.720959;19.390792;18.908375
-near65535,16384,131072,64,near,ref,0,65536,0.465041,7,0.479500;0.518542;0.465041;0.484917;0.464042;0.451834;0.450375
-wide65536,16384,131072,8,none,ref,0,65537,27.207833,7,27.207833;26.963750;27.583833;27.970459;26.963125;26.581584;27.401875
-near65536,16384,131072,64,near,ref,0,65537,0.406500,7,0.407208;0.407375;0.406209;0.406166;0.406500;0.407334;0.406125
-wide131071,16384,131072,8,none,ref,0,131072,26.218208,7,26.337125;26.079042;26.577292;25.786125;26.615584;26.218208;25.834875
-near131071,16384,131072,64,near,ref,0,131072,0.426083,7,0.506875;0.455750;0.429416;0.426083;0.425041;0.424834;0.424500
-wide262143,16384,131072,8,none,ref,0,262144,26.430375,7,26.452084;26.167375;26.274000;26.541625;26.430375;26.457833;25.998250
-near262143,16384,131072,64,near,ref,0,262144,0.431250,7,0.424125;0.431250;0.422500;0.435792;0.450667;0.437833;0.425791
-wide1048575,16384,131072,8,none,ref,0,1048570,26.015250,7,26.626792;26.934209;25.769292;26.277167;25.513209;25.970167;26.015250
-near1048575,16384,131072,64,near,ref,0,1048570,0.428000,7,0.466750;0.462792;0.421166;0.426500;0.419584;0.436417;0.428000
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-gcd.csv b/dev/perf/spf_queue/review-2026-10/results/build-gcd.csv
deleted file mode 100644
index c795d2b..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-gcd.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.12225,12169309226976897007,9.0255;9.29696;9.24317;8.97583;9.07829;9.15029;9.33504;9.12225;9.08346;
-ordered,1.36387,16379939557917917184,1.34192;1.37963;1.37363;1.36387;1.37554;1.36342;1.36637;1.19475;1.25596;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-new1.csv b/dev/perf/spf_queue/review-2026-10/results/build-new1.csv
deleted file mode 100644
index b5b70f2..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-new1.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.16392,12169309226976897007,9.23296;9.28317;9.09125;9.15975;9.1805;9.07479;9.11642;9.16392;9.2345;
-ordered,1.42971,16379939557917917184,1.42;1.42271;1.45396;1.44892;1.53179;1.43958;1.42463;1.426;1.42971;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-new2.csv b/dev/perf/spf_queue/review-2026-10/results/build-new2.csv
deleted file mode 100644
index ace6a92..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-new2.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.28858,12169309226976897007,9.44521;9.57671;9.38425;9.28858;9.21017;9.27567;9.307;9.17375;9.10067;
-ordered,1.44796,16379939557917917184,1.57033;1.44246;1.42517;1.44796;1.47513;1.44875;1.70025;1.44121;1.43358;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-old1.csv b/dev/perf/spf_queue/review-2026-10/results/build-old1.csv
deleted file mode 100644
index a4b41de..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-old1.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.06046,12169309226976897007,9.02929;9.15596;9.06567;9.11125;8.99808;9.17017;9.01704;9.06046;9.05;
-ordered,1.34379,16379939557917917184,1.39417;1.32854;1.34379;1.32638;1.35642;1.32892;1.32942;1.44129;1.37017;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-old2.csv b/dev/perf/spf_queue/review-2026-10/results/build-old2.csv
deleted file mode 100644
index c1d84c0..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-old2.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.13721,12169309226976897007,9.37308;9.16767;9.17583;9.13721;8.98692;9.06342;9.17796;9.13525;9.11583;
-ordered,1.37433,16379939557917917184,1.37433;1.36271;1.41938;1.37692;1.36771;1.36867;1.39604;1.38129;1.36892;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-repeat-gcd.csv b/dev/perf/spf_queue/review-2026-10/results/build-repeat-gcd.csv
deleted file mode 100644
index 1dabbeb..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-repeat-gcd.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.32917,12169309226976897007,9.33104;9.60546;8.98971;9.32917;10.0803;9.30875;9.5125;9.26842;9.25737;
-ordered,1.41108,16379939557917917184,1.43392;1.41154;1.40246;1.41108;1.4155;1.43271;1.39921;1.30079;1.30358;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-repeat-new1.csv b/dev/perf/spf_queue/review-2026-10/results/build-repeat-new1.csv
deleted file mode 100644
index ed3fe22..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-repeat-new1.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.38404,12169309226976897007,9.69817;9.4765;9.30413;9.89342;9.32408;9.525;9.38404;9.29583;9.32975;
-ordered,1.44821,16379939557917917184,1.45875;1.44821;1.47833;1.41417;1.46692;1.45879;1.42346;1.42167;1.43983;
diff --git a/dev/perf/spf_queue/review-2026-10/results/build-repeat-new2.csv b/dev/perf/spf_queue/review-2026-10/results/build-repeat-new2.csv
deleted file mode 100644
index ab39ff6..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/build-repeat-new2.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-random,9.31475,12169309226976897007,9.33629;9.25583;9.40537;9.58625;9.47825;9.30892;9.31475;9.11708;9.164;
-ordered,1.45571,16379939557917917184,1.48362;1.41492;1.42183;1.41204;1.48937;1.45629;1.49546;1.45571;1.42967;
diff --git a/dev/perf/spf_queue/review-2026-10/results/combined.csv b/dev/perf/spf_queue/review-2026-10/results/combined.csv
deleted file mode 100644
index ff1c4cf..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/combined.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.724875,7,36.876459;36.764792;36.888208;36.207875;36.669584;36.724875;36.502542
-clos800,800,320000,16,none,ref,0,2,26.326583,7,26.326583;26.456250;26.174583;26.294958;25.905208;26.594291;26.357125
-chain2048,2048,2047,256,none,ref,0,32,5.749834,7,6.107542;5.749834;5.632792;5.484209;5.450416;6.257625;5.891458
-near16,16384,131072,64,near,ref,0,32,0.392708,7,0.396208;0.393666;0.392583;0.392000;0.393166;0.392708;0.392458
-wide20,16384,131072,16,none,ref,0,1048570,52.384667,7,51.748375;52.904292;52.384667;52.881667;52.289333;52.270334;52.416291
-wide25,16384,131072,16,none,ref,1,33554196,52.605833,7,52.605833;51.553042;52.051292;53.022542;52.452708;57.664459;52.894334
diff --git a/dev/perf/spf_queue/review-2026-10/results/correctness-append.txt b/dev/perf/spf_queue/review-2026-10/results/correctness-append.txt
deleted file mode 100644
index 24d6ed9..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/correctness-append.txt
+++ /dev/null
@@ -1 +0,0 @@
-checked=1351168 failed=0
diff --git a/dev/perf/spf_queue/review-2026-10/results/correctness-baseline.txt b/dev/perf/spf_queue/review-2026-10/results/correctness-baseline.txt
deleted file mode 100644
index 24d6ed9..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/correctness-baseline.txt
+++ /dev/null
@@ -1 +0,0 @@
-checked=1351168 failed=0
diff --git a/dev/perf/spf_queue/review-2026-10/results/correctness-inline.txt b/dev/perf/spf_queue/review-2026-10/results/correctness-inline.txt
deleted file mode 100644
index 24d6ed9..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/correctness-inline.txt
+++ /dev/null
@@ -1 +0,0 @@
-checked=1351168 failed=0
diff --git a/dev/perf/spf_queue/review-2026-10/results/correctness-settled.txt b/dev/perf/spf_queue/review-2026-10/results/correctness-settled.txt
deleted file mode 100644
index 24d6ed9..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/correctness-settled.txt
+++ /dev/null
@@ -1 +0,0 @@
-checked=1351168 failed=0
diff --git a/dev/perf/spf_queue/review-2026-10/results/early-new.txt b/dev/perf/spf_queue/review-2026-10/results/early-new.txt
deleted file mode 100644
index e4ba7ee..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/early-new.txt
+++ /dev/null
@@ -1 +0,0 @@
-target_cost=1 beyond_target_cost=3 (node 5 requires expanding distance-2 node 4)
diff --git a/dev/perf/spf_queue/review-2026-10/results/early-old.txt b/dev/perf/spf_queue/review-2026-10/results/early-old.txt
deleted file mode 100644
index e4ba7ee..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/early-old.txt
+++ /dev/null
@@ -1 +0,0 @@
-target_cost=1 beyond_target_cost=3 (node 5 requires expanding distance-2 node 4)
diff --git a/dev/perf/spf_queue/review-2026-10/results/environment.txt b/dev/perf/spf_queue/review-2026-10/results/environment.txt
deleted file mode 100644
index b12a313..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/environment.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-Fri Oct  2 01:24:25 UTC 2026
-Darwin mbp_andrey.lan 25.6.0 Darwin Kernel Version 25.6.0: Sat Jul 11 15:27:27 PDT 2026; root:xnu-12377.161.13~4/RELEASE_ARM64_T6041 arm64
-Apple M4 Max
-fbab119e794c843838f4f3f96d75cb7f32f06845
-Apple clang version 21.0.0 (clang-2100.1.1.101)
-Target: arm64-apple-darwin25.6.0
-Thread model: posix
-InstalledDir: /Library/Developer/CommandLineTools/usr/bin
-08a76164496831181942b976ef2b2034a506df7e530853db315cd6cf956408ac build/perf/review-settled
-d7aa874e4b7dfde3ed53eabf644cb8e6a73a0581638f771276ab2c851b5580c3 build/perf/review-old
-c27c21e0446c0b07881cd2ab671b3ae46978082571c88a0860e71e7d920fb26d build/perf/review-singleton
-493c12c969ecb87fb753796cbae177fb6214db988197fcea5eb72404e38338cc build/perf/review-heapitem
-7452d40d922869ca2ea3d1f0e0f46088f57b5a01782f9c5200dd8b5ada71855f build/perf/review-notouch
-e48e8976f1a0dea1c4bd6edfdd1a4490b7a5e00b40892871a1580ae5680c5106 build/perf/review-baseline
-c0b0cb4d010a706f6c545cfb716fd21e10c3ed0aee4ecec7b346eeb9f9eb7ffc build/perf/cpu-queue
-4e717d373d97fd2789b2292529646d4f81353c8ba205e384c818f121d4cbe167 build/perf/cpu-queue-old
-aa1437b6e04447662c521979eb68b23a354447f634e777442c2dc72404f5bce7 src/shortest_paths.cpp
diff --git a/dev/perf/spf_queue/review-2026-10/results/fault-fixed.txt b/dev/perf/spf_queue/review-2026-10/results/fault-fixed.txt
deleted file mode 100644
index 4157487..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/fault-fixed.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-caught forward bad_alloc
-forward distance[0]=1 expected=1
-caught reverse bad_alloc
-reverse distance[0]=1 expected=1
diff --git a/dev/perf/spf_queue/review-2026-10/results/fault-old.txt b/dev/perf/spf_queue/review-2026-10/results/fault-old.txt
deleted file mode 100644
index 4157487..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/fault-old.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-caught forward bad_alloc
-forward distance[0]=1 expected=1
-caught reverse bad_alloc
-reverse distance[0]=1 expected=1
diff --git a/dev/perf/spf_queue/review-2026-10/results/fault.txt b/dev/perf/spf_queue/review-2026-10/results/fault.txt
deleted file mode 100644
index 7043974..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/fault.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-caught forward bad_alloc
-forward distance[0]=9223372036854775807 expected=1
-caught reverse bad_alloc
-reverse distance[0]=9223372036854775807 expected=1
diff --git a/dev/perf/spf_queue/review-2026-10/results/final-sha256.txt b/dev/perf/spf_queue/review-2026-10/results/final-sha256.txt
deleted file mode 100644
index e4b68e8..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/final-sha256.txt
+++ /dev/null
@@ -1,68 +0,0 @@
-2744894b016d205e8c2d27124702b8584a16c01768d0b478e43ddda37133118b  build/perf/review-append
-e48e8976f1a0dea1c4bd6edfdd1a4490b7a5e00b40892871a1580ae5680c5106  build/perf/review-baseline
-f1930794735764cb2d83f93c3cb5fb3cea0bfaaa631cf6b35939054e95a80b87  build/perf/review-build-baseline
-aca82c7a96944ea868506171cb3ecceb62d31555b927ab5aae5233fa1bcafea2  build/perf/review-build-gcd
-0dbb455ca3bc0d9fc1cc73ee2ddf9ef88f06634b4d138a0dcf242ba778d9f9c4  build/perf/review-build-old
-7cb163b801210c385d0b058833a977b09c0ce2061ea2b6755ddd51064fc5869a  build/perf/review-combined
-a4685d608080bbac1904e2884fc306a9de971129c8d4098691c061d77e50fb76  build/perf/review-early-new
-b7f45fc227bc8df3679ba26d210ebb682f219d582296c8af8becc29d671a492d  build/perf/review-early-old
-35eb0e8a822b977e66c8fb3620c6c5cc15674e5eccee1220d2a46f2a5cd057bc  build/perf/review-fault-old
-a53a8436f40ec23a1bf1b6e8bd78d6e3536943a534a7d72e445520130f778d77  build/perf/review-flow-fixed
-b95d95d88924ec47a404225c80fcc2757759cfdc6c1466612516abb76dbffa93  build/perf/review-flow-new
-d556b4d468a45f5334bb27a460368aede0da75ab3d2188b37c851a33a05f8a8f  build/perf/review-flow-old
-789be1de40247f35ef8303a017a2e7f93c42ac78cfbc17738f4ac16a37837bb8  build/perf/review-frontpop
-493c12c969ecb87fb753796cbae177fb6214db988197fcea5eb72404e38338cc  build/perf/review-heapitem
-e4611d037e1fdc92d5dd837f6cc5226b6c268b6671a2275429fd6f80c35e00e9  build/perf/review-inline
-7452d40d922869ca2ea3d1f0e0f46088f57b5a01782f9c5200dd8b5ada71855f  build/perf/review-notouch
-d7aa874e4b7dfde3ed53eabf644cb8e6a73a0581638f771276ab2c851b5580c3  build/perf/review-old
-caa9b636764606a8756cd1c24a4690d70d83d72270fd9c1907b67e94f029b696  build/perf/review-robustness
-41f68d6f39296328c681c924ba430805a5a2703deed661f2237687b6bbbd7cd0  build/perf/review-robustness-fixed
-41eccdff5c751acb75678bd0981afc84ee3f57666a7f5b733f2816c9a7274a7a  build/perf/review-safety
-08a76164496831181942b976ef2b2034a506df7e530853db315cd6cf956408ac  build/perf/review-settled
-c27c21e0446c0b07881cd2ab671b3ae46978082571c88a0860e71e7d920fb26d  build/perf/review-singleton
-f3aa9f51f195b98adb2d88e5df7cc55f34393b33c455b98e1fb94f2a1787419f  dev/perf/spf_queue/review-2026-10/BRIEF.md
-2adfec05029ff96cf16f4d286ec29cb81859914712d1a6e4f87a12f6e70f9274  dev/perf/spf_queue/review-2026-10/append.cpp
-4a92134cff8baddcbf0eca4193b478d66414a90ac409b943372fb4a46d755e51  dev/perf/spf_queue/review-2026-10/append.patch
-aa1437b6e04447662c521979eb68b23a354447f634e777442c2dc72404f5bce7  dev/perf/spf_queue/review-2026-10/baseline.cpp
-480fd230f8603af15aa2f9c9ff454806552bd94c7fb88c1395c6f428a666fd54  dev/perf/spf_queue/review-2026-10/build-flow.sh
-29b4e6cbdaa87570899c474aed6dad8a20beab19195c8f99a2bcaa28335811b0  dev/perf/spf_queue/review-2026-10/build-review.sh
-2a991bae311206a2e4bf48d1fae14c5eebdb15b38cae0e7ed1c5278e09fc24c5  dev/perf/spf_queue/review-2026-10/change.diff
-baaa96908abd5cff5dd46e1e3a19d715c7728adedede93e6af5c9cc648f67e0c  dev/perf/spf_queue/review-2026-10/check-and-build.sh
-1abad31a13aa7bddb492fd9331c42157f98969348773e6898fcc39bce77dd126  dev/perf/spf_queue/review-2026-10/combined.cpp
-8a3515790228359aac4a25517843bad6eecf00c6bb5815ed663a3fdbe96bff64  dev/perf/spf_queue/review-2026-10/combined.patch
-ef9941c043378591c5a772c7b179fe107fd3c96f64e28939f3741d5fe73f4df4  dev/perf/spf_queue/review-2026-10/construction.cpp
-9138f40c0f91b6c8bc769d75aa99d6099639f7798a5373478c09278ccc6c21bf  dev/perf/spf_queue/review-2026-10/driver.cpp
-edca624df600d7757020c7b73869d1c79469a2c28e75f4e0f59264d401f6e298  dev/perf/spf_queue/review-2026-10/early-exit.cpp
-9a57d0e6cb308ff744f6ccfc5adbf7ec96d79304453a34d45db91c1b2dbb7827  dev/perf/spf_queue/review-2026-10/exception-fix.cpp
-43f1a4a9f49eaaf4e5a048c554f628110c45c1d80208d1de4b112029ca7886e9  dev/perf/spf_queue/review-2026-10/exception-fix.patch
-2ef1bcd3a030c446bb0741ea6a717ec53d1e8ea5ae8da1d6301ef0b97fb7bcd8  dev/perf/spf_queue/review-2026-10/fault-public.cpp
-1b29d98b499beddb38a42c9d0629418566e2e170737e6b43d3a3875a49b744e3  dev/perf/spf_queue/review-2026-10/fixed-routing.patch
-28fb9c4871b23f802fcf31263743d9d42bedf14e1572e7ccc84310056758b194  dev/perf/spf_queue/review-2026-10/flow-driver.cpp
-6b3587eddb0d2400b175a6e202eb76c90eefe18faab7d9e282d0d4f3fa1f52b3  dev/perf/spf_queue/review-2026-10/flow_state-fixed.cpp
-ae6027fe3b7ed96e1d2a521049cc477c9a4525c43e2a7f35d7359a3d984a48b0  dev/perf/spf_queue/review-2026-10/frontpop.cpp
-01ddb2f04a7a9fe09527ae775922e583a5dc601b93e555390bfbfc4b8d518e5d  dev/perf/spf_queue/review-2026-10/frontpop.patch
-afbc777de4ffb05584d07e23068af20ac757df393a046d912933547a66a54d11  dev/perf/spf_queue/review-2026-10/gcd.cpp
-82c08c66f360d85f1c3fd22d5d025fee9e79b8d8e0c6cddc1694173121c8cc0b  dev/perf/spf_queue/review-2026-10/gcd.patch
-d24fc5af1fe919e9253d4c04c72f3e47cdcc494053e408d370dbadf1d1154bdc  dev/perf/spf_queue/review-2026-10/heapitem.cpp
-5773f710a5da67c058d1b6315f239f9f6f7593fafe2c42d5fc21ade73c56b7af  dev/perf/spf_queue/review-2026-10/heapitem.patch
-aab2c327bcc7312c07b8f8bc2bc02a2f21ec22e8978eb08a3dc9f4464e6518bf  dev/perf/spf_queue/review-2026-10/inline.cpp
-6e412d05382b923d1a8e8cc82a2ecc9c5e0a4aa6419ba2be4c2df2317ac747c5  dev/perf/spf_queue/review-2026-10/inline.patch
-48aea198eac88fbc9e0cfa67192038b82dcdffd13c6e42fcf011455cc83231b4  dev/perf/spf_queue/review-2026-10/max_flow-fixed.cpp
-7411f13155b1afc714eb53d14929c4a251f6ea1666eacaf35d166fc674430337  dev/perf/spf_queue/review-2026-10/notouch.cpp
-4d8e57e6fb155c47713e98c02ff6f0aeeaf96bfdd9edb1b2f11c2c8d5f7dfdc4  dev/perf/spf_queue/review-2026-10/notouch.patch
-9ee6053d38a0b1e44df958e423e12ab93fb54c3d80c8d4bcb623730362b8f441  dev/perf/spf_queue/review-2026-10/old-shortest_paths.cpp
-12f65bdc8daa9415d118d062bdc897981bde448f5391bed2c711c8c968e9322b  dev/perf/spf_queue/review-2026-10/old-strict_multidigraph.cpp
-d24c175f74cf132b695beceb419cadcada130fbd6b90d2d1583ded5676ce4532  dev/perf/spf_queue/review-2026-10/robustness.cpp
-bc9620bc27580072f6836f916a6388c4a7da6b17086e4f38a497b59f1a82fbf8  dev/perf/spf_queue/review-2026-10/run-netgraph-review.py
-bd8575eb91dbf5e72bac1c490e38fb5a5de39175562d1972843ab940d5c04ebd  dev/perf/spf_queue/review-2026-10/run-review.py
-e7641bf19905876035df281a69b09819c2ac8a6d044f23cfdfa8fc73e7352673  dev/perf/spf_queue/review-2026-10/run-second.py
-2c32450294701cd948f0a093c03df129e0046dcdf2f8a5a27c445f50b78ebac2  dev/perf/spf_queue/review-2026-10/run-third.py
-4a0b720c75d3911cfba99caeed4f0ef3a83dd4bd44ef29ef7ef8c04a2f0fec85  dev/perf/spf_queue/review-2026-10/safety.cpp
-ec2d5cfe913551b6ae225e2f2576d79a4230dbb55fe95eace34344a591f9801a  dev/perf/spf_queue/review-2026-10/session.log
-7522cb44d30dbd3a74171ad6ec36b1b463ca7a5b74794e4fd0cd99fa004f6eb0  dev/perf/spf_queue/review-2026-10/settled.cpp
-25b8bdcf8620c78c5a16668ddb6c0454cbf5e3acdb656c2bb3c2f3a4135564c5  dev/perf/spf_queue/review-2026-10/settled.patch
-56136aa3598672bf39673e55774ace0f4bc32de88406cf78a477a11cc368f93f  dev/perf/spf_queue/review-2026-10/singleton.cpp
-89f6374be7a2318289daeeb1c5a4d034295fb3856e7dedc15218383fe42bb4c5  dev/perf/spf_queue/review-2026-10/singleton.patch
-8c0fb19a0e62d710cfc18d8e000b05e322ae3954aba6f3639358ed513736417f  dev/perf/spf_queue/review-2026-10/tracked-before.json
-8b106f036839a2de638a340968084bfbd04dba027129062f70c1690f57ac818c  dev/perf/spf_queue/review-2026-10/validate-flow.cpp
-0028e525aa9503b25a741a04523bd6bb113c4bb96359b251c4e23740baa8fd6f  dev/perf/spf_queue/review-2026-10/validate-review.sh
diff --git a/dev/perf/spf_queue/review-2026-10/results/flow-fixed.csv b/dev/perf/spf_queue/review-2026-10/results/flow-fixed.csv
deleted file mode 100644
index 6eb842e..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/flow-fixed.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,4.48646,17694640663380043544,5.64775;4.78913;4.61479;4.48646;4.03329;4.01167;3.85121;
-place_max_flow,2.13392,7688852859487360956,2.13375;2.13392;2.16279;2.223;2.05733;2.11654;2.21879;
-calc_max_flow_masked,3.53092,9889262484581709037,3.53092;3.60033;3.58104;3.63612;3.50758;3.42379;3.39221;
-place_max_flow_masked,1.69258,17611571108701524338,1.66437;1.69258;1.68496;1.68037;1.81683;1.83758;1.73129;
diff --git a/dev/perf/spf_queue/review-2026-10/results/flow-new1.csv b/dev/perf/spf_queue/review-2026-10/results/flow-new1.csv
deleted file mode 100644
index 46ed257..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/flow-new1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,5.13942,17694640663380043544,5.13942;5.10746;5.1655;5.18054;5.18562;5.04467;5.0835;
-place_max_flow,3.85738,7688852859487360956,3.99929;3.89029;4.10267;3.83567;3.80596;3.85738;3.74071;
-calc_max_flow_masked,4.94221,9889262484581709037,4.97875;4.96592;4.87587;4.852;4.91233;4.94221;4.98758;
-place_max_flow_masked,3.09025,17611571108701524338,3.1895;3.08596;3.09504;3.09025;2.93175;2.93383;3.11563;
diff --git a/dev/perf/spf_queue/review-2026-10/results/flow-new2.csv b/dev/perf/spf_queue/review-2026-10/results/flow-new2.csv
deleted file mode 100644
index da00167..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/flow-new2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,4.97171,17694640663380043544,12.4792;5.39579;4.84162;4.97171;4.92546;4.85942;5.09742;
-place_max_flow,3.78354,7688852859487360956,3.86612;4.03892;3.81296;3.77933;3.77858;3.77338;3.78354;
-calc_max_flow_masked,4.84563,9889262484581709037,4.76683;4.93637;4.70108;4.87838;4.74988;4.87417;4.84563;
-place_max_flow_masked,2.95096,17611571108701524338,3.04258;2.95096;2.95379;2.94037;2.93587;3.03713;2.88842;
diff --git a/dev/perf/spf_queue/review-2026-10/results/flow-old1.csv b/dev/perf/spf_queue/review-2026-10/results/flow-old1.csv
deleted file mode 100644
index ab82099..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/flow-old1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,7.10546,17694640663380043544,7.31242;7.09342;7.04033;7.10546;6.95367;7.22346;7.20029;
-place_max_flow,5.75662,7688852859487360956,5.85796;5.75662;6.00521;5.74729;6.26367;5.69708;5.68617;
-calc_max_flow_masked,6.03229,9889262484581709037,6.01621;6.01492;6.09821;6.08133;6.05596;6.03229;5.88475;
-place_max_flow_masked,4.25525,17611571108701524338,4.16933;4.25525;4.1865;4.20538;4.41496;4.33842;4.36954;
diff --git a/dev/perf/spf_queue/review-2026-10/results/flow-old2.csv b/dev/perf/spf_queue/review-2026-10/results/flow-old2.csv
deleted file mode 100644
index 011041b..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/flow-old2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,6.90321,17694640663380043544,7.05717;7.08817;6.90321;6.98071;6.71904;6.76312;6.74846;
-place_max_flow,5.64579,7688852859487360956,5.64337;5.49796;5.64579;5.71962;5.80021;5.50375;5.68417;
-calc_max_flow_masked,6.03338,9889262484581709037,6.05592;5.85275;6.01258;5.94246;6.03558;6.03338;6.18562;
-place_max_flow_masked,4.1495,17611571108701524338,4.27125;4.15796;4.13183;4.11067;4.1495;4.16883;4.12979;
diff --git a/dev/perf/spf_queue/review-2026-10/results/frontpop.csv b/dev/perf/spf_queue/review-2026-10/results/frontpop.csv
deleted file mode 100644
index 3510c69..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/frontpop.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,65.101375,7,64.946167;64.845875;65.101375;66.617167;65.057041;65.682500;66.550625
-clos800,800,320000,16,none,ref,0,2,36.453708,7,36.859000;36.501083;36.235875;36.292584;36.453708;36.801833;36.208833
-chain2048,2048,2047,256,none,ref,0,32,3.965958,7,3.979875;3.971083;3.965958;3.944334;3.945583;4.008875;3.904917
-near16,16384,131072,64,near,ref,0,32,0.399084,7,0.401458;0.397583;0.398417;0.399084;0.413459;0.399000;0.400584
-wide20,16384,131072,16,none,ref,0,1048570,52.007125,7,51.567083;51.588583;53.758542;51.699834;52.041208;52.007125;53.121209
-wide25,16384,131072,16,none,ref,1,33554196,52.792000,7,52.439583;52.826333;52.792000;51.533250;53.775917;52.867667;51.741292
diff --git a/dev/perf/spf_queue/review-2026-10/results/heap-a1.csv b/dev/perf/spf_queue/review-2026-10/results/heap-a1.csv
deleted file mode 100644
index c17721f..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/heap-a1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,65.364334,7,64.756958;65.060417;65.364334;65.463167;65.001625;68.270959;66.302125
-clos800,800,320000,16,none,ref,0,2,36.700709,7,36.959416;37.673333;37.636916;36.700709;35.915000;35.896875;35.791000
-chain2048,2048,2047,256,none,ref,0,32,3.833208,7,3.968084;3.818500;3.833208;3.799833;3.817417;3.895208;3.882750
-near16,16384,131072,64,near,ref,0,32,0.398833,7,0.398500;0.405291;0.396542;0.413500;0.398833;0.399917;0.394875
-wide20,16384,131072,16,none,ref,0,1048570,52.299333,7,51.901458;52.139167;51.921916;53.186583;52.547000;52.299333;52.796500
-wide25,16384,131072,16,none,ref,1,33554196,53.495500,7,53.457000;54.495542;53.495500;52.239750;53.158500;60.914167;54.363500
diff --git a/dev/perf/spf_queue/review-2026-10/results/heap-a2.csv b/dev/perf/spf_queue/review-2026-10/results/heap-a2.csv
deleted file mode 100644
index fbe8c21..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/heap-a2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,66.959792,7,66.386958;67.185125;66.959792;66.987375;67.456792;66.839292;66.192000
-clos800,800,320000,16,none,ref,0,2,38.442333,7,38.359708;38.193083;38.292875;38.442333;38.770833;38.635042;38.761959
-chain2048,2048,2047,256,none,ref,0,32,3.979125,7,4.027625;3.979125;4.017958;3.958625;3.933666;3.968250;4.100041
-near16,16384,131072,64,near,ref,0,32,0.408334,7,0.408334;0.419542;0.399500;0.417125;0.396375;0.395500;0.467042
-wide20,16384,131072,16,none,ref,0,1048570,53.113375,7,55.139833;53.365250;55.346916;52.507042;52.512042;52.528292;53.113375
-wide25,16384,131072,16,none,ref,1,33554196,52.646833,7,52.678042;52.766708;52.343250;52.677500;52.646833;52.270042;52.505291
diff --git a/dev/perf/spf_queue/review-2026-10/results/heap-b.csv b/dev/perf/spf_queue/review-2026-10/results/heap-b.csv
deleted file mode 100644
index ab7c51b..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/heap-b.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,64.951416,7,65.302459;65.453125;65.329416;64.659166;64.446250;64.951416;64.798125
-clos800,800,320000,16,none,ref,0,2,36.226458,7,37.005584;36.537167;36.034083;36.226458;36.123375;36.493833;35.697291
-chain2048,2048,2047,256,none,ref,0,32,3.839833,7,3.794083;3.867417;3.791833;3.912125;3.839833;3.788834;3.859667
-near16,16384,131072,64,near,ref,0,32,0.395334,7,0.397834;0.406833;0.417958;0.395334;0.394542;0.395083;0.394875
-wide20,16384,131072,16,none,ref,0,1048570,52.248167,7,51.969083;52.299750;52.537667;53.162542;52.145375;52.248167;52.134541
-wide25,16384,131072,16,none,ref,1,33554196,52.650625,7,56.771042;52.650625;52.413416;53.770875;51.828708;52.274333;52.884625
diff --git a/dev/perf/spf_queue/review-2026-10/results/heapitem.csv b/dev/perf/spf_queue/review-2026-10/results/heapitem.csv
deleted file mode 100644
index a8d22f9..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/heapitem.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,63.692209,7,63.582792;63.341250;63.692209;64.101500;62.794375;63.752166;64.545166
-clos800,800,320000,16,none,ref,0,2,36.740125,7,36.518208;36.507958;37.177708;36.930292;36.740125;36.797583;36.663875
-chain2048,2048,2047,256,none,ref,0,32,3.830709,7,3.828250;3.830709;3.863875;3.904916;3.865083;3.727083;3.738709
-near16,16384,131072,64,near,ref,0,32,0.401250,7,0.401167;0.421708;0.406167;0.398958;0.404458;0.401250;0.394708
-wide20,16384,131072,16,none,ref,0,1048570,55.679208,7,55.679208;54.908417;55.376417;55.983709;55.692125;55.792750;55.223375
-wide25,16384,131072,16,none,ref,1,33554196,55.341667,7,55.341667;54.808333;54.961084;56.034541;58.019625;56.560750;53.575291
diff --git a/dev/perf/spf_queue/review-2026-10/results/inline-c.csv b/dev/perf/spf_queue/review-2026-10/results/inline-c.csv
deleted file mode 100644
index eea0177..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/inline-c.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,37.301584,7,38.150125;36.608291;36.901625;37.301584;37.162167;38.334875;38.687125
-clos800,800,320000,16,none,ref,0,2,36.877125,7,37.527166;36.744125;36.877125;38.040291;37.015458;36.548667;36.728291
-chain2048,2048,2047,256,none,ref,0,32,3.618334,7,3.663250;3.590083;3.618334;3.732833;3.579958;3.576042;3.697333
-near16,16384,131072,64,near,ref,0,32,0.398833,7,0.404917;0.398667;0.398209;0.400166;0.398417;0.398833;0.409833
-wide20,16384,131072,16,none,ref,0,1048570,54.109250,7,53.218667;53.234042;52.633916;54.959083;54.398584;54.646250;54.109250
-wide25,16384,131072,16,none,ref,1,33554196,52.257916,7,51.796250;52.257916;52.638666;51.878834;51.613834;52.369708;52.386042
diff --git a/dev/perf/spf_queue/review-2026-10/results/inline.csv b/dev/perf/spf_queue/review-2026-10/results/inline.csv
deleted file mode 100644
index aa86258..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/inline.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.222334,7,36.340209;36.811125;36.222334;36.304458;35.971375;35.917041;36.017125
-clos800,800,320000,16,none,ref,0,2,35.565125,7,35.587916;35.565125;35.683458;35.919167;35.414541;35.554083;35.558292
-chain2048,2048,2047,256,none,ref,0,32,3.540667,7,3.521250;3.546916;3.657333;3.527917;3.520250;3.584084;3.540667
-near16,16384,131072,64,near,ref,0,32,0.398500,7,0.400458;0.393000;0.392417;0.398500;0.401208;0.395834;0.439000
-wide20,16384,131072,16,none,ref,0,1048570,52.062375,7,50.544250;50.945583;52.159042;53.085375;52.836917;52.062375;51.674417
-wide25,16384,131072,16,none,ref,1,33554196,50.749417,7,50.995958;50.749417;50.962750;50.671917;50.935917;50.605375;50.528250
diff --git a/dev/perf/spf_queue/review-2026-10/results/load-flow-screen.txt b/dev/perf/spf_queue/review-2026-10/results/load-flow-screen.txt
deleted file mode 100644
index 9e06b03..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/load-flow-screen.txt
+++ /dev/null
@@ -1,5 +0,0 @@
- 2:34  up 52 days,  7:10, 3 users, load averages: 3.54 4.58 3.94
- 2:34  up 52 days,  7:10, 3 users, load averages: 3.54 4.58 3.94
- 2:34  up 52 days,  7:10, 3 users, load averages: 3.54 4.58 3.94
- 2:34  up 52 days,  7:10, 3 users, load averages: 3.54 4.58 3.94
- 2:34  up 52 days,  7:10, 3 users, load averages: 3.54 4.58 3.94
diff --git a/dev/perf/spf_queue/review-2026-10/results/load-flow.txt b/dev/perf/spf_queue/review-2026-10/results/load-flow.txt
deleted file mode 100644
index f1cb9c1..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/load-flow.txt
+++ /dev/null
@@ -1,5 +0,0 @@
- 2:35  up 52 days,  7:11, 3 users, load averages: 4.76 4.70 4.02
- 2:35  up 52 days,  7:11, 3 users, load averages: 4.76 4.70 4.02
- 2:35  up 52 days,  7:11, 3 users, load averages: 4.76 4.70 4.02
- 2:35  up 52 days,  7:11, 3 users, load averages: 4.46 4.64 4.01
- 2:35  up 52 days,  7:11, 3 users, load averages: 4.46 4.64 4.01
diff --git a/dev/perf/spf_queue/review-2026-10/results/load-second.txt b/dev/perf/spf_queue/review-2026-10/results/load-second.txt
deleted file mode 100644
index 248ed13..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/load-second.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-old-b1  2:28  up 52 days,  7:04, 3 users, load averages: 3.66 3.48 3.15
-new-b1  2:28  up 52 days,  7:04, 3 users, load averages: 3.66 3.48 3.15
-settled-b  2:28  up 52 days,  7:04, 3 users, load averages: 3.66 3.48 3.15
-inline  2:28  up 52 days,  7:04, 3 users, load averages: 3.53 3.45 3.14
-append  2:28  up 52 days,  7:04, 3 users, load averages: 3.53 3.45 3.14
-frontpop  2:28  up 52 days,  7:04, 3 users, load averages: 3.57 3.46 3.15
-heap-b  2:29  up 52 days,  7:04, 3 users, load averages: 3.57 3.46 3.15
-new-b2  2:29  up 52 days,  7:04, 3 users, load averages: 3.60 3.47 3.15
-old-b2  2:29  up 52 days,  7:04, 3 users, load averages: 3.60 3.47 3.15
-build-old1  2:29  up 52 days,  7:04, 3 users, load averages: 3.60 3.47 3.15
-build-new1  2:29  up 52 days,  7:04, 3 users, load averages: 3.60 3.47 3.15
-build-gcd  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-build-new2  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-build-old2  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-reverse-old1  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-reverse-new1  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-reverse-heap  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-reverse-settled  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-reverse-old2  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-boundary-old1  2:29  up 52 days,  7:04, 3 users, load averages: 4.67 3.69 3.23
-boundary-new1  2:29  up 52 days,  7:04, 3 users, load averages: 4.46 3.67 3.22
-boundary-heap  2:29  up 52 days,  7:04, 3 users, load averages: 4.46 3.67 3.22
-boundary-settled  2:29  up 52 days,  7:05, 3 users, load averages: 4.42 3.67 3.23
-boundary-old2  2:29  up 52 days,  7:05, 3 users, load averages: 4.42 3.67 3.23
diff --git a/dev/perf/spf_queue/review-2026-10/results/load-third.txt b/dev/perf/spf_queue/review-2026-10/results/load-third.txt
deleted file mode 100644
index ed7b1df..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/load-third.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-old-c1  2:31  up 52 days,  7:07, 3 users, load averages: 8.46 5.42 3.97
-new-c1  2:31  up 52 days,  7:07, 3 users, load averages: 8.19 5.41 3.98
-append-c  2:31  up 52 days,  7:07, 3 users, load averages: 8.19 5.41 3.98
-combined  2:31  up 52 days,  7:07, 3 users, load averages: 8.19 5.41 3.98
-inline-c  2:31  up 52 days,  7:07, 3 users, load averages: 7.93 5.41 3.98
-new-c2  2:31  up 52 days,  7:07, 3 users, load averages: 7.93 5.41 3.98
-old-c2  2:31  up 52 days,  7:07, 3 users, load averages: 8.26 5.51 4.03
-build-repeat-new1  2:31  up 52 days,  7:07, 3 users, load averages: 8.26 5.51 4.03
-build-repeat-gcd  2:31  up 52 days,  7:07, 3 users, load averages: 8.26 5.51 4.03
-build-repeat-new2  2:31  up 52 days,  7:07, 3 users, load averages: 8.26 5.51 4.03
diff --git a/dev/perf/spf_queue/review-2026-10/results/load.txt b/dev/perf/spf_queue/review-2026-10/results/load.txt
deleted file mode 100644
index 6437b22..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/load.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-old-a1  2:24  up 52 days, 7 hrs, 3 users, load averages: 3.69 3.44 3.03
-new-a1  2:24  up 52 days, 7 hrs, 3 users, load averages: 3.69 3.44 3.03
-heap-a1  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.04 3.52 3.06
-settled  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.04 3.52 3.06
-settled-heap  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.11 3.54 3.07
-singleton  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.11 3.54 3.07
-heapitem  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.42 3.61 3.10
-notouch  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.42 3.61 3.10
-new-a2  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.39 3.62 3.10
-heap-a2  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.39 3.62 3.10
-old-a2  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.39 3.62 3.10
-end  2:24  up 52 days, 7 hrs, 3 users, load averages: 4.28 3.61 3.10
diff --git a/dev/perf/spf_queue/review-2026-10/results/memory.txt b/dev/perf/spf_queue/review-2026-10/results/memory.txt
deleted file mode 100644
index 5f003a1..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/memory.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-after 1 graphs: bucket item capacity bytes=16400 N=1027 E=1026 peak_queue=1024
-after 63 graphs: bucket item capacity bytes=1032208 N=1027 E=1026 peak_queue=1024
-after N=2 graph: bucket item capacity bytes=1032208 dist_capacity=2
diff --git a/dev/perf/spf_queue/review-2026-10/results/netgraph-environment.txt b/dev/perf/spf_queue/review-2026-10/results/netgraph-environment.txt
deleted file mode 100644
index 16d68f0..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/netgraph-environment.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-old1  2:32  up 52 days,  7:08, 3 users, load averages: 5.87 5.41 4.09
-91dc3b7e2bd3611d54d762e0fb1f875881138d66843866990f019cddfec5cc2c /Users/networmix/ws/NetGraph-Core-main/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core-main/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core-main/python/netgraph_core/__init__.py
-new  2:32  up 52 days,  7:08, 3 users, load averages: 5.64 5.37 4.08
-996ae1c6aef243b9950c345651c901b155b375da2fc429d00f079de0df67e116 /Users/networmix/ws/NetGraph-Core/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core/python/netgraph_core/__init__.py
-heap  2:32  up 52 days,  7:08, 3 users, load averages: 5.64 5.37 4.08
-996ae1c6aef243b9950c345651c901b155b375da2fc429d00f079de0df67e116 /Users/networmix/ws/NetGraph-Core/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core/python/netgraph_core/__init__.py
-old2  2:32  up 52 days,  7:08, 3 users, load averages: 5.74 5.40 4.10
-91dc3b7e2bd3611d54d762e0fb1f875881138d66843866990f019cddfec5cc2c /Users/networmix/ws/NetGraph-Core-main/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core-main/venv/lib/python3.14/site-packages/_netgraph_core.cpython-314-darwin.so
-/Users/networmix/ws/NetGraph-Core-main/python/netgraph_core/__init__.py
diff --git a/dev/perf/spf_queue/review-2026-10/results/netgraph-heap.csv b/dev/perf/spf_queue/review-2026-10/results/netgraph-heap.csv
deleted file mode 100644
index 67501d0..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/netgraph-heap.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,heap,0.215680,5,946e7cf8b5a36980,0.215093;0.215680;0.217045;0.214475;0.215709
-spf_full_grid_100x100_weighted,heap,0.235446,5,4c2f7751ff9a5057,0.235446;0.235428;0.234089;0.236250;0.238091
-maxflow_grid_100x100_weighted_combine,heap,0.216545,5,b0453b641647871b,0.216545;0.214937;0.219780;0.215704;0.216563
-placement_backbone_clos,heap,0.067445,5,a3bbef71a61656e1,0.068307;0.068552;0.067445;0.067098;0.066769
diff --git a/dev/perf/spf_queue/review-2026-10/results/netgraph-new.csv b/dev/perf/spf_queue/review-2026-10/results/netgraph-new.csv
deleted file mode 100644
index a4840b0..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/netgraph-new.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,new,0.215551,5,946e7cf8b5a36980,0.215551;0.215907;0.218243;0.214622;0.214636
-spf_full_grid_100x100_weighted,new,0.169151,5,4c2f7751ff9a5057,0.171143;0.169339;0.168719;0.169148;0.169151
-maxflow_grid_100x100_weighted_combine,new,0.160344,5,b0453b641647871b,0.160344;0.159538;0.159366;0.161421;0.160476
-placement_backbone_clos,new,0.067171,5,a3bbef71a61656e1,0.067222;0.067171;0.067064;0.066943;0.069957
diff --git a/dev/perf/spf_queue/review-2026-10/results/netgraph-old1.csv b/dev/perf/spf_queue/review-2026-10/results/netgraph-old1.csv
deleted file mode 100644
index 060b57b..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/netgraph-old1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,old1,0.212167,5,946e7cf8b5a36980,0.212167;0.211826;0.211942;0.215837;0.213694
-spf_full_grid_100x100_weighted,old1,0.219249,5,4c2f7751ff9a5057,0.220500;0.219115;0.219249;0.219192;0.219299
-maxflow_grid_100x100_weighted_combine,old1,0.201715,5,b0453b641647871b,0.201715;0.200953;0.200980;0.201761;0.202154
-placement_backbone_clos,old1,0.068333,5,a3bbef71a61656e1,0.071259;0.069470;0.068333;0.067665;0.067146
diff --git a/dev/perf/spf_queue/review-2026-10/results/netgraph-old2.csv b/dev/perf/spf_queue/review-2026-10/results/netgraph-old2.csv
deleted file mode 100644
index 8fb46d2..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/netgraph-old2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-workload,label,median_s,samples,checksum,samples_s
-spf_full_clos_200x200,old2,0.212584,5,946e7cf8b5a36980,0.215052;0.213002;0.212584;0.211673;0.211985
-spf_full_grid_100x100_weighted,old2,0.219160,5,4c2f7751ff9a5057,0.219166;0.219314;0.219160;0.218651;0.218967
-maxflow_grid_100x100_weighted_combine,old2,0.204482,5,b0453b641647871b,0.204155;0.205131;0.202814;0.206448;0.204482
-placement_backbone_clos,old2,0.068736,5,a3bbef71a61656e1,0.073860;0.068736;0.069312;0.067899;0.067647
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-a1.csv b/dev/perf/spf_queue/review-2026-10/results/new-a1.csv
deleted file mode 100644
index 437e0c8..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-a1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.102459,7,35.199334;35.690875;38.373709;38.308667;36.978666;35.956458;36.102459
-clos800,800,320000,16,none,ref,0,2,34.775459,7,34.500583;34.933417;35.096750;34.769667;34.775459;34.758333;34.956375
-chain2048,2048,2047,256,none,ref,0,32,5.474458,7,5.474458;5.427250;5.537375;5.544917;5.404750;5.244750;5.608208
-near16,16384,131072,64,near,ref,0,32,0.399542,7,0.405667;0.398833;0.399542;0.397875;0.397334;0.401334;0.527208
-wide20,16384,131072,16,none,ref,0,1048570,53.540750,7,54.768666;53.546709;53.889500;53.540750;51.955959;51.682333;51.324000
-wide25,16384,131072,16,none,ref,1,33554196,51.896333,7,51.418416;51.288208;51.196500;52.728375;51.896333;52.195541;51.900459
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-a2.csv b/dev/perf/spf_queue/review-2026-10/results/new-a2.csv
deleted file mode 100644
index 1c162b2..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-a2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,35.831792,7,36.189667;35.773375;35.695792;35.831792;35.725083;36.297667;36.324250
-clos800,800,320000,16,none,ref,0,2,35.326334,7,35.498916;35.326334;35.124375;35.321917;35.321917;36.149375;35.790500
-chain2048,2048,2047,256,none,ref,0,32,5.512958,7,5.512958;5.298833;5.615125;5.432375;5.915125;5.433833;5.638750
-near16,16384,131072,64,near,ref,0,32,0.400833,7,0.441875;0.400833;0.399042;0.400542;0.401750;0.402708;0.397625
-wide20,16384,131072,16,none,ref,0,1048570,53.120167,7,53.321333;53.068083;53.353167;52.922958;52.360084;53.120167;53.810084
-wide25,16384,131072,16,none,ref,1,33554196,53.291750,7,52.971000;53.298666;53.693958;52.207583;53.393625;53.291750;53.217625
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-b1.csv b/dev/perf/spf_queue/review-2026-10/results/new-b1.csv
deleted file mode 100644
index 8a65069..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-b1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.437375,7,36.458750;36.437375;38.069833;36.224666;36.010291;36.396042;37.253792
-clos800,800,320000,16,none,ref,0,2,35.225250,7,34.455709;35.475875;35.529291;35.883833;35.225250;35.163875;34.286250
-chain2048,2048,2047,256,none,ref,0,32,5.232375,7,5.232375;5.161833;5.193875;5.241000;5.442209;5.288500;5.128166
-near16,16384,131072,64,near,ref,0,32,0.393208,7,0.393208;0.422042;0.394291;0.392958;0.393208;0.392875;0.528167
-wide20,16384,131072,16,none,ref,0,1048570,53.174917,7,58.161917;55.200583;57.610292;53.174917;52.132458;52.841833;52.854667
-wide25,16384,131072,16,none,ref,1,33554196,51.289500,7,51.586333;51.127750;51.289500;51.351333;51.227667;51.099000;51.490417
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-b2.csv b/dev/perf/spf_queue/review-2026-10/results/new-b2.csv
deleted file mode 100644
index 39a7f2c..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-b2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.404042,7,36.404042;36.566625;36.893834;36.811875;35.520042;35.665875;35.423125
-clos800,800,320000,16,none,ref,0,2,36.691083,7,36.693000;36.691083;36.777375;36.492916;36.721750;36.260792;36.411417
-chain2048,2048,2047,256,none,ref,0,32,5.462458,7,5.488625;5.462458;5.325083;5.346833;5.282000;5.603708;5.615292
-near16,16384,131072,64,near,ref,0,32,0.398292,7,0.402209;0.398041;0.398292;0.403500;0.398208;0.398250;0.398875
-wide20,16384,131072,16,none,ref,0,1048570,52.534209,7,53.152833;52.864875;52.173209;52.534209;51.993000;51.975541;52.824167
-wide25,16384,131072,16,none,ref,1,33554196,51.805792,7,51.580833;51.931458;51.890167;51.724667;51.865584;51.728083;51.805792
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-c1.csv b/dev/perf/spf_queue/review-2026-10/results/new-c1.csv
deleted file mode 100644
index b1b8412..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-c1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,37.139500,7,36.504416;36.802209;37.139500;38.133916;37.465166;37.054833;38.317666
-clos800,800,320000,16,none,ref,0,2,35.800416,7,35.303583;36.024750;36.169166;36.144750;35.518792;35.800416;35.443250
-chain2048,2048,2047,256,none,ref,0,32,5.607416,7,5.607416;5.575208;5.649000;5.624584;5.693125;5.270625;5.536083
-near16,16384,131072,64,near,ref,0,32,0.399667,7,0.399667;0.400375;0.400917;0.394542;0.392208;0.392333;0.568209
-wide20,16384,131072,16,none,ref,0,1048570,54.419250,7,54.419250;54.934584;53.961750;58.652125;55.884458;53.924291;54.415167
-wide25,16384,131072,16,none,ref,1,33554196,53.599334,7,53.390917;53.599334;53.398084;53.811875;54.324917;53.464542;53.836208
diff --git a/dev/perf/spf_queue/review-2026-10/results/new-c2.csv b/dev/perf/spf_queue/review-2026-10/results/new-c2.csv
deleted file mode 100644
index ae9d0a6..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/new-c2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,35.804375,7,37.196709;36.498875;35.856709;35.804375;35.703334;35.523000;35.752333
-clos800,800,320000,16,none,ref,0,2,35.380250,7,34.909542;34.823166;35.486375;35.805667;35.469875;35.380250;35.227375
-chain2048,2048,2047,256,none,ref,0,32,5.569458,7,5.755125;5.363458;5.786500;5.960208;5.536959;5.553417;5.569458
-near16,16384,131072,64,near,ref,0,32,0.410583,7,0.410583;0.406541;0.480917;0.408208;0.413625;0.412792;0.404583
-wide20,16384,131072,16,none,ref,0,1048570,54.147083,7,55.012958;54.037667;54.147083;54.609250;58.278625;53.827542;52.777916
-wide25,16384,131072,16,none,ref,1,33554196,55.281334,7,55.281334;55.300417;54.891208;55.485083;54.879417;56.778000;54.301083
diff --git a/dev/perf/spf_queue/review-2026-10/results/notouch.csv b/dev/perf/spf_queue/review-2026-10/results/notouch.csv
deleted file mode 100644
index 02b2e38..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/notouch.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,64.783708,7,65.583000;64.783708;65.158708;64.282958;63.893125;63.678958;64.801625
-clos800,800,320000,16,none,ref,0,2,35.476459,7,35.412791;35.386666;35.476459;35.508416;36.327584;39.811958;35.461834
-chain2048,2048,2047,256,none,ref,0,32,3.864416,7,3.864416;3.936958;3.750625;3.911541;3.743166;3.722166;3.938917
-near16,16384,131072,64,near,ref,0,32,1.233209,7,1.226250;1.227584;1.253875;1.213750;1.234292;1.233209;1.234292
-wide20,16384,131072,16,none,ref,0,1048570,51.039792,7,51.251833;50.497792;50.554000;50.847667;51.061708;53.260042;51.039792
-wide25,16384,131072,16,none,ref,1,33554196,52.060541,7,52.351833;52.380375;52.677792;51.515375;50.656833;51.244459;52.060541
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-a1.csv b/dev/perf/spf_queue/review-2026-10/results/old-a1.csv
deleted file mode 100644
index ccec261..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-a1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,62.661917,7,63.361167;62.796042;62.371417;61.183166;61.657917;62.661917;63.670791
-clos800,800,320000,16,none,ref,0,2,36.783917,7,37.430625;37.233792;36.468375;36.783917;36.168666;35.968083;37.098833
-chain2048,2048,2047,256,none,ref,0,32,3.057542,7,2.948125;3.260791;3.042750;3.032208;3.165833;3.057542;3.211375
-near16,16384,131072,64,near,ref,0,32,1.092541,7,1.155958;1.279500;1.142084;1.017416;1.051916;1.092042;1.092541
-wide20,16384,131072,16,none,ref,0,1048570,50.820084,7,50.733791;50.221000;50.086750;50.820084;52.921666;52.840042;54.729458
-wide25,16384,131072,16,none,ref,1,33554196,52.896333,7,51.156375;53.299750;53.507959;52.896333;52.904042;51.731917;52.568667
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-a2.csv b/dev/perf/spf_queue/review-2026-10/results/old-a2.csv
deleted file mode 100644
index 5f08a8f..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-a2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,64.328708,7,65.860417;67.227500;69.844208;63.343917;64.328708;63.977542;63.754750
-clos800,800,320000,16,none,ref,0,2,36.826667,7,37.149125;37.741042;36.605166;36.811375;36.489750;37.581458;36.826667
-chain2048,2048,2047,256,none,ref,0,32,2.990084,7,3.024791;2.990084;3.052875;2.964083;2.980958;3.019750;2.961667
-near16,16384,131072,64,near,ref,0,32,1.199667,7,1.191166;1.206875;1.208292;1.198708;1.190500;1.199667;1.214209
-wide20,16384,131072,16,none,ref,0,1048570,52.035958,7,52.165042;53.316625;52.035958;51.401875;51.295833;52.107750;51.960041
-wide25,16384,131072,16,none,ref,1,33554196,50.975833,7,51.363500;51.186625;50.880625;50.549250;50.549292;50.975833;52.110708
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-b1.csv b/dev/perf/spf_queue/review-2026-10/results/old-b1.csv
deleted file mode 100644
index 7872b37..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-b1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,61.637542,7,61.942917;61.538791;61.641750;61.961083;61.442291;61.637542;61.568000
-clos800,800,320000,16,none,ref,0,2,36.004833,7,36.153250;36.197042;36.012833;35.441125;35.771541;35.491000;36.004833
-chain2048,2048,2047,256,none,ref,0,32,2.928958,7,2.928958;2.962292;3.033417;2.922334;2.904750;2.933958;2.916417
-near16,16384,131072,64,near,ref,0,32,1.124750,7,1.148625;1.238209;1.100708;1.092209;1.103667;1.124750;1.146000
-wide20,16384,131072,16,none,ref,0,1048570,48.971583,7,48.840500;48.835708;49.106709;48.960542;49.092709;48.971583;49.089000
-wide25,16384,131072,16,none,ref,1,33554196,50.581042,7,49.251042;48.808875;49.316292;50.581042;52.614792;53.201250;54.016584
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-b2.csv b/dev/perf/spf_queue/review-2026-10/results/old-b2.csv
deleted file mode 100644
index fa019c1..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-b2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,63.736459,7,63.736459;63.137583;63.046959;62.846708;63.976583;65.935500;64.739708
-clos800,800,320000,16,none,ref,0,2,36.966917,7,37.437042;37.236958;36.966917;36.455042;36.567083;37.288084;36.713500
-chain2048,2048,2047,256,none,ref,0,32,3.113500,7,3.200416;3.036708;3.115750;3.069792;3.124292;2.971250;3.113500
-near16,16384,131072,64,near,ref,0,32,1.156625,7,1.156625;1.151708;1.166083;1.200334;1.282791;1.110500;1.146583
-wide20,16384,131072,16,none,ref,0,1048570,50.562250,7,50.748417;50.573167;50.539084;50.234584;50.562250;49.976792;50.625125
-wide25,16384,131072,16,none,ref,1,33554196,50.306625,7,50.242875;50.322416;51.103708;50.099792;50.298542;50.384375;50.306625
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-c1.csv b/dev/perf/spf_queue/review-2026-10/results/old-c1.csv
deleted file mode 100644
index 1d1ba55..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-c1.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,65.450625,7,65.882125;64.276208;65.260500;67.423833;65.450625;64.917750;66.206416
-clos800,800,320000,16,none,ref,0,2,37.396042,7,37.188167;37.396042;37.494208;37.605083;37.457750;37.083417;37.271541
-chain2048,2048,2047,256,none,ref,0,32,3.038625,7,3.047042;3.021875;3.101083;3.038625;3.018084;3.103375;3.018792
-near16,16384,131072,64,near,ref,0,32,1.172167,7,1.313208;1.183792;1.158750;1.165458;1.171416;1.172167;1.174500
-wide20,16384,131072,16,none,ref,0,1048570,52.389542,7,52.971667;51.957750;52.280500;52.823083;51.671041;52.389542;54.248084
-wide25,16384,131072,16,none,ref,1,33554196,52.215416,7,52.625458;52.215416;52.307000;51.824541;51.515833;51.631542;52.662375
diff --git a/dev/perf/spf_queue/review-2026-10/results/old-c2.csv b/dev/perf/spf_queue/review-2026-10/results/old-c2.csv
deleted file mode 100644
index e5b4788..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/old-c2.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,67.528541,7,66.008416;68.058333;70.523875;65.632458;67.528541;66.204166;69.484250
-clos800,800,320000,16,none,ref,0,2,37.468209,7,37.360667;37.451250;37.468209;37.111125;43.702125;40.555084;37.667917
-chain2048,2048,2047,256,none,ref,0,32,3.115042,7,3.325166;3.384667;3.109333;3.115042;3.085416;3.101334;3.127666
-near16,16384,131072,64,near,ref,0,32,1.226250,7,1.229375;1.227542;1.220333;1.224041;1.234542;1.226250;1.216458
-wide20,16384,131072,16,none,ref,0,1048570,54.983958,7,54.983958;53.121458;52.081750;52.332667;61.260375;55.755916;62.780084
-wide25,16384,131072,16,none,ref,1,33554196,51.311292,7,50.930792;51.031875;51.381208;50.627125;51.311292;52.826625;53.041833
diff --git a/dev/perf/spf_queue/review-2026-10/results/reverse-heap.csv b/dev/perf/spf_queue/review-2026-10/results/reverse-heap.csv
deleted file mode 100644
index d6b3e18..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/reverse-heap.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-random,14.29,4323550201995714722,14.2146;14.2688;14.1871;14.3387;14.3591;14.29;14.2905;
-clos,46.6671,16998307955055842784,46.2878;48.1355;46.3228;47.327;46.6671;46.6519;48.5254;
-chain,0.519167,6923677047050424156,0.52075;0.515292;0.532917;0.5175;0.516583;0.519167;0.525042;
-zerocyc,17.8648,3520531437519771524,18.1898;18.3212;17.6796;17.7299;17.8648;17.9677;17.7341;
diff --git a/dev/perf/spf_queue/review-2026-10/results/reverse-new1.csv b/dev/perf/spf_queue/review-2026-10/results/reverse-new1.csv
deleted file mode 100644
index 8e362a8..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/reverse-new1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-random,8.53917,4323550201995714722,8.53917;8.44875;8.4335;8.56229;8.54592;8.52125;8.59829;
-clos,46.9226,16998307955055842784,46.9246;46.809;47.0009;46.268;46.7838;46.9226;47.6712;
-chain,0.7405,6923677047050424156,0.813791;0.7405;0.70425;0.729833;0.716333;0.742916;0.742958;
-zerocyc,11.101,3520531437519771524,11.2392;11.2819;10.9927;11.0575;10.9636;11.2812;11.101;
diff --git a/dev/perf/spf_queue/review-2026-10/results/reverse-old1.csv b/dev/perf/spf_queue/review-2026-10/results/reverse-old1.csv
deleted file mode 100644
index c151b3d..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/reverse-old1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-random,14.1883,4323550201995714722,13.9235;13.8795;15.3225;14.1821;14.587;14.1883;14.5707;
-clos,48.2569,16998307955055842784,47.954;48.6985;48.2569;47.5812;47.9113;48.4309;49.74;
-chain,0.401625,6923677047050424156,0.403;0.403834;0.400166;0.401167;0.400791;0.401625;0.405333;
-zerocyc,17.3234,3520531437519771524,18.1433;17.3234;17.294;17.1341;16.9652;17.4247;17.6095;
diff --git a/dev/perf/spf_queue/review-2026-10/results/reverse-old2.csv b/dev/perf/spf_queue/review-2026-10/results/reverse-old2.csv
deleted file mode 100644
index b917885..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/reverse-old2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-random,13.8073,4323550201995714722,13.9139;13.7902;13.8063;13.707;13.8688;13.8073;13.871;
-clos,46.6904,16998307955055842784,47.0873;46.4569;46.6064;47.3114;46.4868;46.6904;47.2773;
-chain,0.409,6923677047050424156,0.404834;0.408334;0.41;0.41075;0.409;0.405917;0.410666;
-zerocyc,17.2142,3520531437519771524,17.2065;17.2142;17.3031;17.17;17.3148;17.2411;17.2045;
diff --git a/dev/perf/spf_queue/review-2026-10/results/reverse-settled.csv b/dev/perf/spf_queue/review-2026-10/results/reverse-settled.csv
deleted file mode 100644
index 808695a..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/reverse-settled.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-random,8.46929,4323550201995714722,8.32779;8.44088;8.74062;8.55787;8.46929;8.53213;8.43412;
-clos,37.0421,16998307955055842784,37.0421;36.9092;37.2337;36.9606;36.7457;37.5333;37.2674;
-chain,0.712,6923677047050424156,0.703833;0.703125;0.711333;0.715333;0.712;0.719459;0.73825;
-zerocyc,10.7184,3520531437519771524,10.7537;10.7373;10.701;10.7016;10.8767;10.7184;10.7129;
diff --git a/dev/perf/spf_queue/review-2026-10/results/safety.txt b/dev/perf/spf_queue/review-2026-10/results/safety.txt
deleted file mode 100644
index 2cd383b..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/safety.txt
+++ /dev/null
@@ -1 +0,0 @@
-PASS: boundary widths, near-int64-bound, zero costs, edgeless, forward/reverse, reused and concurrent threads
diff --git a/dev/perf/spf_queue/review-2026-10/results/screen-flow-fixed.csv b/dev/perf/spf_queue/review-2026-10/results/screen-flow-fixed.csv
deleted file mode 100644
index 4a67f8f..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/screen-flow-fixed.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,3.49771,17694640663380043544,3.49771;3.44867;3.59746;3.5455;3.50575;3.47817;3.46129;
-place_max_flow,2.17654,7688852859487360956,2.19533;2.13963;2.12258;2.17654;2.27933;2.22033;2.16417;
-calc_max_flow_masked,3.52533,9889262484581709037,3.65667;3.66458;3.51767;3.585;3.52533;3.47987;3.45167;
-place_max_flow_masked,1.74058,17611571108701524338,1.83658;1.77683;1.732;1.76604;1.69054;1.74058;1.72042;
diff --git a/dev/perf/spf_queue/review-2026-10/results/screen-flow-new1.csv b/dev/perf/spf_queue/review-2026-10/results/screen-flow-new1.csv
deleted file mode 100644
index 81f770f..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/screen-flow-new1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,6.30813,17694640663380043544,9.53404;7.89408;6.85742;6.30813;5.85308;5.42833;5.04875;
-place_max_flow,3.75046,7688852859487360956,3.74292;3.99771;3.72096;3.729;3.75046;3.83758;3.78788;
-calc_max_flow_masked,4.66933,9889262484581709037,4.59392;4.66933;4.66683;4.63588;4.70075;4.6815;4.69033;
-place_max_flow_masked,2.88571,17611571108701524338,2.89621;2.88571;2.85225;2.96892;2.94071;2.87242;2.83696;
diff --git a/dev/perf/spf_queue/review-2026-10/results/screen-flow-new2.csv b/dev/perf/spf_queue/review-2026-10/results/screen-flow-new2.csv
deleted file mode 100644
index c4e6c54..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/screen-flow-new2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,5.17758,17694640663380043544,5.17758;5.18304;5.10125;5.14938;5.25413;5.22612;5.08204;
-place_max_flow,3.74721,7688852859487360956,3.75838;3.76867;3.74721;3.74708;3.81875;3.70783;3.73663;
-calc_max_flow_masked,4.81,9889262484581709037,4.72837;5.11983;4.78008;4.89187;4.76479;4.89292;4.81;
-place_max_flow_masked,3.03613,17611571108701524338,2.90725;3.02983;3.03613;3.24267;3.35433;3.13017;2.93463;
diff --git a/dev/perf/spf_queue/review-2026-10/results/screen-flow-old1.csv b/dev/perf/spf_queue/review-2026-10/results/screen-flow-old1.csv
deleted file mode 100644
index 8fc2c18..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/screen-flow-old1.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,7.46421,17694640663380043544,10.7697;9.501;8.27529;7.46421;7.01146;6.62575;6.60421;
-place_max_flow,5.55046,7688852859487360956,5.59325;5.56725;5.55046;5.51917;5.50913;5.47129;5.66104;
-calc_max_flow_masked,5.81396,9889262484581709037,5.84025;5.81396;5.74475;5.87383;5.77688;5.95671;5.79425;
-place_max_flow_masked,4.05721,17611571108701524338,4.07908;3.97954;4.06804;4.05721;4.03087;4.07292;4.049;
diff --git a/dev/perf/spf_queue/review-2026-10/results/screen-flow-old2.csv b/dev/perf/spf_queue/review-2026-10/results/screen-flow-old2.csv
deleted file mode 100644
index 858bc08..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/screen-flow-old2.csv
+++ /dev/null
@@ -1,5 +0,0 @@
-case,median_ms,hash,samples_ms
-calc_max_flow,6.88671,17694640663380043544,6.84333;7.00104;6.84063;6.88671;6.92425;6.96867;6.83817;
-place_max_flow,5.62904,7688852859487360956,5.63633;5.73642;5.73917;5.62904;5.55379;5.56463;5.51196;
-calc_max_flow_masked,5.98637,9889262484581709037,6.01696;6.03279;5.98104;6.00467;5.90329;5.98637;5.91071;
-place_max_flow_masked,4.12329,17611571108701524338,4.01337;4.18213;4.31404;4.14071;4.12329;4.08954;4.03029;
diff --git a/dev/perf/spf_queue/review-2026-10/results/settled-b.csv b/dev/perf/spf_queue/review-2026-10/results/settled-b.csv
deleted file mode 100644
index ef1d574..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/settled-b.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.487333,7,36.090542;35.959583;36.007542;36.487333;37.377167;37.102084;37.204959
-clos800,800,320000,16,none,ref,0,2,29.811083,7,30.447334;29.933166;29.725458;29.967459;29.711791;29.811083;29.528292
-chain2048,2048,2047,256,none,ref,0,32,5.354125,7,5.354125;5.338375;5.379333;5.297166;5.476250;5.512584;5.302708
-near16,16384,131072,64,near,ref,0,32,0.395167,7,0.395041;0.398792;0.394875;0.395167;0.424417;0.403875;0.394458
-wide20,16384,131072,16,none,ref,0,1048570,50.286542,7,50.904542;50.359750;50.286542;50.461416;50.228625;49.448917;49.680083
-wide25,16384,131072,16,none,ref,1,33554196,50.049500,7,49.963709;50.266833;49.922667;50.049500;50.208000;50.201000;50.021375
diff --git a/dev/perf/spf_queue/review-2026-10/results/settled-heap.csv b/dev/perf/spf_queue/review-2026-10/results/settled-heap.csv
deleted file mode 100644
index 1b13e44..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/settled-heap.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,66.158167,7,65.501291;66.360792;66.991167;66.015583;65.004458;66.158167;66.720208
-clos800,800,320000,16,none,ref,0,2,31.214834,7,30.765625;30.921833;31.332292;31.329458;31.445500;30.828375;31.214834
-chain2048,2048,2047,256,none,ref,0,32,3.968333,7,3.945500;3.968333;3.876041;3.986583;4.052458;3.981292;3.927458
-near16,16384,131072,64,near,ref,0,32,0.414542,7,0.414542;0.408208;0.422417;0.401750;0.511000;0.439917;0.376750
-wide20,16384,131072,16,none,ref,0,1048570,52.167875,7,52.122625;51.577041;51.598167;52.167875;53.366667;54.189042;53.137125
-wide25,16384,131072,16,none,ref,1,33554196,52.316375,7,52.712750;52.543958;52.056167;51.818583;52.316375;52.301791;53.811375
diff --git a/dev/perf/spf_queue/review-2026-10/results/settled.csv b/dev/perf/spf_queue/review-2026-10/results/settled.csv
deleted file mode 100644
index 6c37d15..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/settled.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,36.302292,7,36.267083;36.252209;36.461292;36.329834;36.278333;36.428250;36.302292
-clos800,800,320000,16,none,ref,0,2,30.552375,7,30.552375;30.614834;30.552375;30.799083;30.420875;30.354875;30.576750
-chain2048,2048,2047,256,none,ref,0,32,5.646583,7,5.629958;5.646583;5.675459;5.604167;5.825583;5.854708;5.641583
-near16,16384,131072,64,near,ref,0,32,0.399458,7,0.399375;0.400292;0.401459;0.397750;0.398125;0.399625;0.399458
-wide20,16384,131072,16,none,ref,0,1048570,50.866667,7,50.945000;51.409333;50.611417;50.734542;51.366167;50.730708;50.866667
-wide25,16384,131072,16,none,ref,1,33554196,52.316458,7,51.991083;52.700875;52.316458;52.266458;52.743542;52.306916;52.581667
diff --git a/dev/perf/spf_queue/review-2026-10/results/singleton.csv b/dev/perf/spf_queue/review-2026-10/results/singleton.csv
deleted file mode 100644
index f904009..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/singleton.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,dst,variant,fallback,W,median_ms,samples,wall_samples_ms
-random16,16384,131072,16,none,ref,0,32,37.232584,7,43.237917;46.446917;37.663959;36.975792;37.232584;36.434750;37.170750
-clos800,800,320000,16,none,ref,0,2,35.920375,7,35.833750;36.086250;35.904916;36.143000;36.049708;35.366042;35.920375
-chain2048,2048,2047,256,none,ref,0,32,5.007084,7,5.030291;4.919834;5.007084;4.996291;5.026125;4.996833;5.083959
-near16,16384,131072,64,near,ref,0,32,0.402250,7,0.402958;0.397958;0.470084;0.408875;0.402250;0.398000;0.397250
-wide20,16384,131072,16,none,ref,0,1048570,54.110209,7,53.133625;53.488875;55.287875;54.976625;54.198959;53.358917;54.110209
-wide25,16384,131072,16,none,ref,1,33554196,52.396375,7,52.396375;51.643959;52.706292;52.540000;51.862250;51.330000;53.099542
diff --git a/dev/perf/spf_queue/review-2026-10/results/tracked-verification.txt b/dev/perf/spf_queue/review-2026-10/results/tracked-verification.txt
deleted file mode 100644
index 424b153..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/tracked-verification.txt
+++ /dev/null
@@ -1 +0,0 @@
-97 tracked files compared; changed since review start: []
diff --git a/dev/perf/spf_queue/review-2026-10/results/validate-flow-variant.txt b/dev/perf/spf_queue/review-2026-10/results/validate-flow-variant.txt
deleted file mode 100644
index 114a384..0000000
--- a/dev/perf/spf_queue/review-2026-10/results/validate-flow-variant.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-excluded=-1 flow=cut=6
-excluded=0 flow=cut=4
-excluded=1 flow=cut=2
-excluded=2 flow=cut=6
-excluded=3 flow=cut=4
-excluded=4 flow=cut=3
-factor=1 placed=2
-factor=2 placed=6
diff --git a/dev/perf/spf_queue/review-2026-10/robustness.cpp b/dev/perf/spf_queue/review-2026-10/robustness.cpp
deleted file mode 100644
index f1cda4a..0000000
--- a/dev/perf/spf_queue/review-2026-10/robustness.cpp
+++ /dev/null
@@ -1,48 +0,0 @@
-#include <cstdlib>
-#include <new>
-#include <iostream>
-static bool fail_four = false;
-void* operator new(std::size_t n) {
-  if (fail_four && n == 4) { fail_four=false; throw std::bad_alloc(); }
-  if (void* p=std::malloc(n?n:1)) return p;
-  throw std::bad_alloc();
-}
-void operator delete(void* p) noexcept { std::free(p); }
-#ifndef REVIEW_SOURCE
-#define REVIEW_SOURCE "baseline.cpp"
-#endif
-#include REVIEW_SOURCE
-using namespace netgraph::core;
-int main(int argc,char**argv) {
-  std::string mode=argc>1?argv[1]:"fault";
-  EdgeSelection sel;
-  if(mode=="fault") {
-    auto g=StrictMultiDiGraph::from_arrays(8,std::vector<NodeId>{1},std::vector<NodeId>{0},std::vector<Cap>{1},std::vector<Cost>{1});
-    fail_four=true;
-    try { (void)shortest_paths(g,0,std::nullopt,true,sel); }
-    catch(const std::bad_alloc&) { std::cout<<"caught forward bad_alloc\n"; }
-    auto r=shortest_paths(g,1,std::nullopt,true,sel);
-    std::cout<<"forward distance[0]="<<r.first[0]<<" expected=1\n";
-    auto rev=StrictMultiDiGraph::from_arrays(8,std::vector<NodeId>{0},std::vector<NodeId>{1},std::vector<Cap>{1},std::vector<Cost>{1});
-    fail_four=true;
-    try { (void)shortest_paths_to(rev,0,true,sel); }
-    catch(const std::bad_alloc&) { std::cout<<"caught reverse bad_alloc\n"; }
-    auto t=shortest_paths_to(rev,1,true,sel);
-    std::cout<<"reverse distance[0]="<<t.first[0]<<" expected=1\n";
-  } else {
-    auto bytes=[] { std::size_t n=0;for(auto& b:tls_forward.bucket.buckets)n+=b.capacity()*sizeof(BucketQueue::Item);return n; };
-    for(int c=1;c<=63;++c) {
-      std::vector<NodeId> s,d;std::vector<Cap> a;std::vector<Cost> w;
-      for(int v=1;v<=1024;++v){s.push_back(0);d.push_back(v);a.push_back(1);w.push_back(c);}
-      s.push_back(1025);d.push_back(1026);a.push_back(1);w.push_back(63);
-      s.push_back(1025);d.push_back(1026);a.push_back(1);w.push_back(1);
-      auto g=StrictMultiDiGraph::from_arrays(1027,s,d,a,w);
-      auto r=shortest_paths(g,0,std::nullopt,true,sel);
-      if(r.first[1]!=c) return 2;
-      if(c==1 || c==63)std::cout<<"after "<<c<<" graphs: bucket item capacity bytes="<<bytes()<<" N=1027 E=1026 peak_queue=1024\n";
-    }
-    auto g=StrictMultiDiGraph::from_arrays(2,std::vector<NodeId>{0},std::vector<NodeId>{1},std::vector<Cap>{1},std::vector<Cost>{1});
-    (void)shortest_paths(g,0,std::nullopt,true,sel);
-    std::cout<<"after N=2 graph: bucket item capacity bytes="<<bytes()<<" dist_capacity="<<tls_forward.dist.capacity()<<"\n";
-  }
-}
diff --git a/dev/perf/spf_queue/review-2026-10/run-netgraph-review.py b/dev/perf/spf_queue/review-2026-10/run-netgraph-review.py
deleted file mode 100644
index 5278d44..0000000
--- a/dev/perf/spf_queue/review-2026-10/run-netgraph-review.py
+++ /dev/null
@@ -1,55 +0,0 @@
-import hashlib
-import os
-import subprocess
-from pathlib import Path
-
-r = Path(__file__).resolve().parent
-out = r / "results"
-repo = Path.cwd()
-bench = repo / "dev/perf/spf_queue/bench_netgraph.py"
-py = "/Users/networmix/ws/NetGraph/venv/bin/python"
-workloads = "spf_full_clos_200x200,spf_full_grid_100x100_weighted,maxflow_grid_100x100_weighted_combine,placement_backbone_clos"
-for label, root, heap in [
-    ("old1", Path("/Users/networmix/ws/NetGraph-Core-main"), False),
-    ("new", repo, False),
-    ("heap", repo, True),
-    ("old2", Path("/Users/networmix/ws/NetGraph-Core-main"), False),
-]:
-    env = os.environ.copy()
-    env.pop("NGRAPH_CORE_SPF_QUEUE", None)
-    env.update(
-        PYTHONHASHSEED="0",
-        PYTHONDONTWRITEBYTECODE="1",
-        PYTHONPATH=f"{root}/venv/lib/python3.14/site-packages:{root}/python",
-    )
-    if heap:
-        env["NGRAPH_CORE_SPF_QUEUE"] = "heap"
-    with (out / "netgraph-environment.txt").open("a") as f:
-        f.write(label + " " + subprocess.check_output(["uptime"], text=True))
-        for p in (root / "venv/lib/python3.14/site-packages").glob(
-            "_netgraph_core*.so"
-        ):
-            f.write(hashlib.sha256(p.read_bytes()).hexdigest() + " " + str(p) + "\n")
-        f.write(
-            subprocess.check_output(
-                [
-                    py,
-                    "-c",
-                    "import _netgraph_core,netgraph_core;print(_netgraph_core.__file__);print(netgraph_core.__file__)",
-                ],
-                env=env,
-                text=True,
-            )
-        )
-    with (
-        (out / ("netgraph-" + label + ".csv")).open("w") as f,
-        (out / ("netgraph-" + label + ".stderr")).open("w") as e,
-    ):
-        subprocess.run(
-            [py, str(bench), label, "5", workloads],
-            env=env,
-            stdout=f,
-            stderr=e,
-            check=True,
-        )
-    print("netgraph", label, flush=True)
diff --git a/dev/perf/spf_queue/review-2026-10/run-review.py b/dev/perf/spf_queue/review-2026-10/run-review.py
deleted file mode 100644
index 36cc09b..0000000
--- a/dev/perf/spf_queue/review-2026-10/run-review.py
+++ /dev/null
@@ -1,51 +0,0 @@
-import hashlib
-import os
-import subprocess
-from pathlib import Path
-
-r = Path(__file__).resolve().parent
-out = r / "results"
-b = Path("build/metal_pathfinding")
-with (out / "environment.txt").open("w") as f:
-    for cmd in [
-        ["date", "-u"],
-        ["uname", "-a"],
-        ["sysctl", "-n", "machdep.cpu.brand_string"],
-        ["git", "rev-parse", "HEAD"],
-        ["clang++", "--version"],
-    ]:
-        f.write(subprocess.check_output(cmd, text=True))
-    for p in list(b.glob("review-*")) + [
-        b / "cpu-queue",
-        b / "cpu-queue-old",
-        Path("src/shortest_paths.cpp"),
-    ]:
-        if p.is_file():
-            f.write(hashlib.sha256(p.read_bytes()).hexdigest() + " " + str(p) + "\n")
-phases = [
-    ("old-a1", "old", False),
-    ("new-a1", "baseline", False),
-    ("heap-a1", "baseline", True),
-    ("settled", "settled", False),
-    ("settled-heap", "settled", True),
-    ("singleton", "singleton", False),
-    ("heapitem", "heapitem", True),
-    ("notouch", "notouch", True),
-    ("new-a2", "baseline", False),
-    ("heap-a2", "baseline", True),
-    ("old-a2", "old", False),
-]
-for name, v, heap in phases:
-    with (out / "load.txt").open("a") as f:
-        f.write(name + " " + subprocess.check_output(["uptime"], text=True))
-    env = os.environ.copy()
-    env.pop("NGRAPH_CORE_SPF_QUEUE", None)
-    if heap:
-        env["NGRAPH_CORE_SPF_QUEUE"] = "heap"
-    with (out / (name + ".csv")).open("w") as f:
-        subprocess.run(
-            [str(b / ("review-" + v)), "focus", "7"], env=env, stdout=f, check=True
-        )
-    print(name, flush=True)
-with (out / "load.txt").open("a") as f:
-    f.write("end " + subprocess.check_output(["uptime"], text=True))
diff --git a/dev/perf/spf_queue/review-2026-10/run-second.py b/dev/perf/spf_queue/review-2026-10/run-second.py
deleted file mode 100644
index b89750c..0000000
--- a/dev/perf/spf_queue/review-2026-10/run-second.py
+++ /dev/null
@@ -1,62 +0,0 @@
-import os
-import subprocess
-from pathlib import Path
-
-r = Path(__file__).resolve().parent
-out = r / "results"
-b = Path("build/metal_pathfinding")
-phases = [
-    ("old-b1", "old", False),
-    ("new-b1", "baseline", False),
-    ("settled-b", "settled", False),
-    ("inline", "inline", False),
-    ("append", "append", False),
-    ("frontpop", "frontpop", True),
-    ("heap-b", "baseline", True),
-    ("new-b2", "baseline", False),
-    ("old-b2", "old", False),
-]
-for name, v, heap in phases:
-    with (out / "load-second.txt").open("a") as f:
-        f.write(name + " " + subprocess.check_output(["uptime"], text=True))
-    env = os.environ.copy()
-    env.pop("NGRAPH_CORE_SPF_QUEUE", None)
-    if heap:
-        env["NGRAPH_CORE_SPF_QUEUE"] = "heap"
-    with (out / (name + ".csv")).open("w") as f:
-        subprocess.run(
-            [str(b / ("review-" + v)), "focus", "7"], env=env, stdout=f, check=True
-        )
-    print(name, flush=True)
-for name, v in [
-    ("old1", "old"),
-    ("new1", "baseline"),
-    ("gcd", "gcd"),
-    ("new2", "baseline"),
-    ("old2", "old"),
-]:
-    with (out / "load-second.txt").open("a") as f:
-        f.write("build-" + name + " " + subprocess.check_output(["uptime"], text=True))
-    with (out / ("build-" + name + ".csv")).open("w") as f:
-        subprocess.run([str(b / ("review-build-" + v))], stdout=f, check=True)
-for mode in ["reverse", "boundary"]:
-    for name, v, heap in [
-        ("old1", "old", False),
-        ("new1", "baseline", False),
-        ("heap", "baseline", True),
-        ("settled", "settled", False),
-        ("old2", "old", False),
-    ]:
-        with (out / "load-second.txt").open("a") as f:
-            f.write(
-                mode + "-" + name + " " + subprocess.check_output(["uptime"], text=True)
-            )
-        env = os.environ.copy()
-        env.pop("NGRAPH_CORE_SPF_QUEUE", None)
-        if heap:
-            env["NGRAPH_CORE_SPF_QUEUE"] = "heap"
-        with (out / (mode + "-" + name + ".csv")).open("w") as f:
-            subprocess.run(
-                [str(b / ("review-" + v)), mode, "7"], env=env, stdout=f, check=True
-            )
-        print(mode, name, flush=True)
diff --git a/dev/perf/spf_queue/review-2026-10/run-third.py b/dev/perf/spf_queue/review-2026-10/run-third.py
deleted file mode 100644
index 94f63b2..0000000
--- a/dev/perf/spf_queue/review-2026-10/run-third.py
+++ /dev/null
@@ -1,30 +0,0 @@
-import subprocess
-from pathlib import Path
-
-r = Path(__file__).resolve().parent
-out = r / "results"
-b = Path("build/metal_pathfinding")
-for name, v in [
-    ("old-c1", "old"),
-    ("new-c1", "baseline"),
-    ("append-c", "append"),
-    ("combined", "combined"),
-    ("inline-c", "inline"),
-    ("new-c2", "baseline"),
-    ("old-c2", "old"),
-]:
-    with (out / "load-third.txt").open("a") as f:
-        f.write(name + " " + subprocess.check_output(["uptime"], text=True))
-    with (out / (name + ".csv")).open("w") as f:
-        subprocess.run([str(b / ("review-" + v)), "focus", "7"], stdout=f, check=True)
-    print(name, flush=True)
-for name, v in [("new1", "baseline"), ("gcd", "gcd"), ("new2", "baseline")]:
-    with (out / "load-third.txt").open("a") as f:
-        f.write(
-            "build-repeat-"
-            + name
-            + " "
-            + subprocess.check_output(["uptime"], text=True)
-        )
-    with (out / ("build-repeat-" + name + ".csv")).open("w") as f:
-        subprocess.run([str(b / ("review-build-" + v))], stdout=f, check=True)
diff --git a/dev/perf/spf_queue/review-2026-10/safety.cpp b/dev/perf/spf_queue/review-2026-10/safety.cpp
deleted file mode 100644
index 9c17ff4..0000000
--- a/dev/perf/spf_queue/review-2026-10/safety.cpp
+++ /dev/null
@@ -1,33 +0,0 @@
-#include "../spf_variants.hpp"
-#include <iostream>
-#include <memory>
-#include <thread>
-using namespace netgraph::core;
-static bool eq(const auto&a,const auto&b) {return a.first==b.first&&a.second.parent_offsets==b.second.parent_offsets&&a.second.parents==b.second.parents&&a.second.via_edges==b.second.via_edges;}
-static void checks() {
-  for(Cost k: {Cost(0),Cost(1),Cost(65534),Cost(65535),Cost(65536),(Cost(1)<<60)-1}) {
-    auto g=StrictMultiDiGraph::from_arrays(8,std::vector<NodeId>{0,0,1,2,3,4,6},std::vector<NodeId>{1,2,3,3,4,5,7},std::vector<Cap>{1,2,4,8,16,32,64},std::vector<Cost>{k,k,0,0,k,0,1});
-    auto nm=std::make_unique<bool[]>(8);auto em=std::make_unique<bool[]>(7);
-    std::fill_n(nm.get(),8,true);std::fill_n(em.get(),7,true);
-    std::vector<Cap> res(g.capacity_view().begin(),g.capacity_view().end());
-    for(int mp=0;mp<2;++mp)for(int me=0;me<2;++me)for(int tb=0;tb<2;++tb)for(int rc=0;rc<2;++rc)for(int mask=0;mask<2;++mask) {
-      EdgeSelection sel;sel.multi_edge=me;sel.require_capacity=rc;sel.tie_break=tb?EdgeTieBreak::PreferHigherResidual:EdgeTieBreak::Deterministic;
-      em[0]=!mask;nm[2]=!mask;
-      for(int dest=-1;dest<8;++dest) {
-        std::optional<NodeId> dst=dest<0?std::nullopt:std::optional<NodeId>(dest);
-        auto a=shortest_paths(g,0,dst,mp,sel,res,{nm.get(),8},{em.get(),7},SpfQueue::Heap);
-        auto b=shortest_paths(g,0,dst,mp,sel,res,{nm.get(),8},{em.get(),7},SpfQueue::Bucket);
-        spfx::HeapQueue h;spfx::Workspace ws;auto c=spfx::spf_variant(g,0,dst,mp,sel,res,{nm.get(),8},{em.get(),7},h,ws,k,1);
-        if(!eq(a,b)||!eq(a,c))throw std::runtime_error("forward mismatch");
-        if(dest>=0){auto x=shortest_paths_to(g,dest,mp,sel,res,{nm.get(),8},{em.get(),7},{},SpfQueue::Heap);auto y=shortest_paths_to(g,dest,mp,sel,res,{nm.get(),8},{em.get(),7},{},SpfQueue::Bucket);if(!eq(x,y))throw std::runtime_error("reverse mismatch");}
-      }
-    }
-  }
-  for(int n:{0,1,8}){
-    auto g=StrictMultiDiGraph::from_arrays(n,{},{},{},{});
-    auto a=shortest_paths(g,0,std::nullopt,true,EdgeSelection{});
-    auto b=shortest_paths_to(g,0,true,EdgeSelection{});
-    if(a.first.size()!=std::size_t(n)||b.first.size()!=std::size_t(n)||a.second.parent_offsets.size()!=std::size_t(n+1))throw std::runtime_error("empty mismatch");
-  }
-}
-int main(){checks();std::thread t(checks);checks();t.join();std::cout<<"PASS: boundary widths, near-int64-bound, zero costs, edgeless, forward/reverse, reused and concurrent threads\n";}
diff --git a/dev/perf/spf_queue/review-2026-10/settled.patch b/dev/perf/spf_queue/review-2026-10/settled.patch
deleted file mode 100644
index 31cfe2b..0000000
--- a/dev/perf/spf_queue/review-2026-10/settled.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -580,7 +580,7 @@
-     // Process edges grouped by destination node (parallel edges are consecutive in CSR).
-     while (i < end) {
-       NodeId v = col[i];
--      if (use_node_mask && !node_mask[static_cast<std::size_t>(v)]) {
-+      if (settled[static_cast<std::size_t>(v)] || (use_node_mask && !node_mask[static_cast<std::size_t>(v)])) {
-         std::size_t j_skip = i; while (j_skip < end && col[j_skip] == v) ++j_skip; i = j_skip; continue;
-       }
- 
-@@ -829,7 +829,7 @@
-     std::size_t i = start;
-     while (i < end) {
-       NodeId u = icol[i];
--      if (use_node_mask && !node_mask[static_cast<std::size_t>(u)]) {
-+      if (settled[static_cast<std::size_t>(u)] || (use_node_mask && !node_mask[static_cast<std::size_t>(u)])) {
-         std::size_t j_skip = i; while (j_skip < end && icol[j_skip] == u) ++j_skip; i = j_skip; continue;
-       }
-       Cost min_edge_cost = kInf;
diff --git a/dev/perf/spf_queue/review-2026-10/singleton.patch b/dev/perf/spf_queue/review-2026-10/singleton.patch
deleted file mode 100644
index c01ae87..0000000
--- a/dev/perf/spf_queue/review-2026-10/singleton.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/src/shortest_paths.cpp
-+++ b/src/shortest_paths.cpp
-@@ -304,6 +304,9 @@
-   std::vector<std::uint64_t> occ;   // one bit per non-empty bucket
-   std::size_t W = 0, cur_b = 0, pending = 0;
-   Cost cur = 0, stride = 1;
-+  Cost sole_cost = 0;
-+  std::size_t sole_bucket = 0;
-+  bool sole = false;
- 
-   void begin(std::size_t width, Cost stride_) {
-     stride = stride_;
-@@ -333,6 +336,8 @@
-   void push(Cost c, Cap nr, NodeId v) {
-     const std::size_t b = bucket_of(c);
-     auto& vec = buckets[b];
-+    sole = pending == 0;
-+    if (sole) { sole_cost = c; sole_bucket = b; }
-     if (vec.empty()) occ[b >> 6] |= (std::uint64_t{1} << (b & 63));
-     vec.push_back({nr, v});
-     if (b == cur_b) std::push_heap(vec.begin(), vec.end(), Greater{});
-@@ -341,6 +346,7 @@
-   // Advance to the next non-empty bucket when the active one is exhausted.
-   // Precondition: pending > 0.
-   void settle_active() {
-+    if (sole) { cur = sole_cost; cur_b = sole_bucket; return; }
-     if (!buckets[cur_b].empty()) return;
-     std::size_t i = cur_b + 1; if (i == W) i = 0;
-     std::size_t w = i >> 6;
diff --git a/dev/perf/spf_queue/review-2026-10/validate-flow.cpp b/dev/perf/spf_queue/review-2026-10/validate-flow.cpp
deleted file mode 100644
index b3412a6..0000000
--- a/dev/perf/spf_queue/review-2026-10/validate-flow.cpp
+++ /dev/null
@@ -1,28 +0,0 @@
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/flow_policy.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include <cmath>
-#include <iostream>
-using namespace netgraph::core;
-int main(){
- auto g=StrictMultiDiGraph::from_arrays(4,std::vector<NodeId>{0,0,1,1,2},std::vector<NodeId>{1,2,2,3,3},std::vector<Cap>{3,4,1,2,4},std::vector<Cost>{1,4,2,2,1});
- bool em[5];auto s=g.edge_src_view();auto d=g.edge_dst_view();auto cap=g.capacity_view();
- for(int excluded=-1;excluded<5;++excluded){
-  for(int e=0;e<5;++e)em[e]=e!=excluded;
-  auto [total,sm]=calc_max_flow(g,0,3,FlowPlacement::Proportional,false,true,true,true,true,{},em);
-  double balance[4]={};for(int e=0;e<5;++e){double f=sm.edge_flows[e];if(f<-1e-7||f>cap[e]+1e-7||(!em[e]&&std::abs(f)>1e-7))throw std::runtime_error("capacity/mask");balance[s[e]]+=f;balance[d[e]]-=f;}
-  for(int v=0;v<4;++v)if(std::abs(balance[v]-(v==0?total:v==3?-total:0))>1e-7)throw std::runtime_error("conservation");
-  double cut=1e30;for(int subset=1;subset<8;subset+=2){double k=0;for(int e=0;e<5;++e)if(em[e]&&(subset&(1<<s[e]))&&!(subset&(1<<d[e])))k+=cap[e];cut=std::min(cut,k);}
-  if(std::abs(cut-total)>1e-7)throw std::runtime_error("optimality");
-  double reported=0;for(auto e:sm.min_cut.edges)reported+=cap[e];if(std::abs(reported-total)>1e-7)throw std::runtime_error("reported cut");
-  std::cout<<"excluded="<<excluded<<" flow=cut="<<total<<'\n';
- }
- auto algs=std::make_shared<Algorithms>(make_cpu_backend());auto gh=algs->build_graph(g);ExecutionContext ctx(algs,gh);
- for(double factor:{1.,2.}){
-  FlowPolicyConfig cfg;cfg.max_path_cost_factor=factor;cfg.require_capacity=true;cfg.multipath=true;
-  FlowPolicy p(ctx,cfg);FlowGraph fg(g);auto res=p.place_demand(fg,0,3,1,100);
-  double expected=factor==1.?2.:6.;if(std::abs(res.first-expected)>1e-7)throw std::runtime_error("factor cap");
-  std::cout<<"factor="<<factor<<" placed="<<res.first<<'\n';
- }
-}
diff --git a/dev/perf/spf_queue/review-2026-10/validate-review.sh b/dev/perf/spf_queue/review-2026-10/validate-review.sh
deleted file mode 100644
index 5b849e1..0000000
--- a/dev/perf/spf_queue/review-2026-10/validate-review.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-set -eu
-r=dev/perf/spf_queue/review-2026-10
-out=build/perf/review-validation
-mkdir -p "$out"
-flags=(-std=c++20 -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer -Iinclude)
-for file in src/strict_multidigraph.cpp "$r/combined.cpp" "$r/max_flow-fixed.cpp" "$r/flow_state-fixed.cpp" src/flow_graph.cpp src/flow_policy.cpp src/k_shortest_paths.cpp src/cpu_backend.cpp src/profiling.cpp; do
- clang++ "${flags[@]}" -c "$file" -o "$out/$(basename "$file" .cpp).o"
-done
-for spec in validate-flow bitgate; do
- if [[ $spec == bitgate ]]; then file=dev/perf/spf_queue/bitgate/dump.cpp; else file="$r/validate-flow.cpp"; fi
- clang++ "${flags[@]}" "$file" "$out"/*.o -o "$out/$spec"
- ASAN_OPTIONS=detect_leaks=0 NGRAPH_CORE_BATCH_THREADS=1 NGRAPH_CORE_SENSITIVITY_THREADS=1 "$out/$spec" > "$r/results/$spec-variant.txt"
-done
-NGRAPH_CORE_BATCH_THREADS=1 NGRAPH_CORE_SENSITIVITY_THREADS=1 build/perf/bitgate-old > "$r/results/bitgate-old.txt"
-cmp "$r/results/bitgate-old.txt" "$r/results/bitgate-variant.txt"
-shasum -a 256 "$r/results/bitgate-old.txt" "$r/results/bitgate-variant.txt" > "$r/results/bitgate-sha256.txt"
-echo 'targeted flow certificates, cost factors, and bitgate passed under ASan/UBSan'
diff --git a/dev/perf/spf_queue/run_aba.sh b/dev/perf/spf_queue/run_aba.sh
deleted file mode 100755
index 5a4aeff..0000000
--- a/dev/perf/spf_queue/run_aba.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-# Fresh process per variant; production reference first and last (A1 ... A2).
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-out=${1:-dev/perf/spf_queue/results/first}
-samples=${2:-9}
-mkdir -p "$out"
-bin=build/perf/cpu-queue
-{
-  echo "date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"; echo "commit: $(git rev-parse HEAD)"; sysctl -n machdep.cpu.brand_string
-  shasum -a 256 dev/perf/spf_queue/*.hpp dev/perf/spf_queue/*.cpp src/shortest_paths.cpp src/strict_multidigraph.cpp
-  "${CXX:-clang++}" --version | head -1
-} > "$out/environment.txt"
-for phase in ref:a1 heap-fresh:b heap-full:b heap-sparse:b bucket-fresh:b bucket-full:b bucket-sparse:b bsort-fresh:b bsort-sparse:b ref:a2; do
-  v=${phase%%:*}; tag=${phase##*:}
-  uptime >> "$out/load.txt"
-  "$bin" time "$v" "$samples" > "$out/time-$v-$tag.csv"
-done
-for v in ref heap-sparse bucket-sparse bsort-sparse; do
-  uptime >> "$out/load.txt"
-  "$bin" sweep "$v" "$samples" 2097152 > "$out/sweep-$v.csv"
-done
-uptime >> "$out/load.txt"
-echo done
diff --git a/dev/perf/spf_queue/run_core_aba.sh b/dev/perf/spf_queue/run_core_aba.sh
deleted file mode 100755
index ff1c557..0000000
--- a/dev/perf/spf_queue/run_core_aba.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-# Core-level old/new/old A/B/A on the harness workloads: the `ref` variant is the
-# production shortest_paths of whichever sources the binary was built from.
-#   cpu-queue-old: previous sources (git archive of the base commit)
-#   cpu-queue:     this worktree; B-heap forces the heap route in the new binary
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-out=${1:-dev/perf/spf_queue/results/core}
-samples=${2:-9}
-mkdir -p "$out"
-{
-  echo "date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"; echo "commit: $(git rev-parse HEAD)"
-  shasum -a 256 build/perf/cpu-queue-old build/perf/cpu-queue src/shortest_paths.cpp
-} > "$out/environment.txt"
-for phase in a1-old b-new b-new-heap a2-old; do
-  uptime >> "$out/load.txt"
-  case $phase in
-    *old) bin=build/perf/cpu-queue-old; envs=() ;;
-    b-new) bin=build/perf/cpu-queue; envs=() ;;
-    b-new-heap) bin=build/perf/cpu-queue; envs=(NGRAPH_CORE_SPF_QUEUE=heap) ;;
-  esac
-  env ${envs[@]+"${envs[@]}"} "$bin" time ref "$samples" > "$out/time-$phase.csv"
-  env ${envs[@]+"${envs[@]}"} "$bin" sweep ref "$samples" 2097152 > "$out/sweep-$phase.csv"
-done
-uptime >> "$out/load.txt"
-echo done
diff --git a/dev/perf/spf_queue/run_netgraph_aba.sh b/dev/perf/spf_queue/run_netgraph_aba.sh
deleted file mode 100755
index 707a4ca..0000000
--- a/dev/perf/spf_queue/run_netgraph_aba.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Old/new/old A/B/A on realistic NetGraph workloads, one fresh process per phase.
-#   A1: main worktree build (fbab119)   B: this worktree   B-heap: this worktree with
-#   NGRAPH_CORE_SPF_QUEUE=heap (in-binary control)   A2: main worktree build again.
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-out=${1:-dev/perf/spf_queue/results/netgraph}
-samples=${2:-5}
-old=${OLD_CORE:-/Users/networmix/ws/NetGraph-Core-main}
-new=$PWD
-py=/Users/networmix/ws/NetGraph/venv/bin/python
-bench=dev/perf/spf_queue/bench_netgraph.py
-mkdir -p "$out"
-{
-  echo "date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  echo "new: $(git rev-parse HEAD) (dirty: $(git status --short | wc -l | tr -d ' ') paths)"
-  echo "old: $(git -C "$old" rev-parse HEAD)"
-  echo "netgraph: $(git -C /Users/networmix/ws/NetGraph rev-parse HEAD)"
-  shasum -a 256 "$bench" "$new"/venv/lib/python3.14/site-packages/_netgraph_core*.so "$old"/venv/lib/python3.14/site-packages/_netgraph_core*.so
-  sysctl -n machdep.cpu.brand_string
-} > "$out/environment.txt"
-run() {  # label core-root extra-env
-  local label=$1 root=$2; shift 2
-  uptime >> "$out/load.txt"
-  # PYTHONHASHSEED pins NetGraph's set-iteration order so Monte Carlo result
-  # digests are comparable across processes (verified: with a random seed the
-  # digests differ between two runs of the same build).
-  env "$@" PYTHONHASHSEED=0 PYTHONPATH="$root/venv/lib/python3.14/site-packages:$root/python" "$py" "$bench" "$label" "$samples" > "$out/$label.csv"
-}
-run a1-old "$old"
-run b-new "$new"
-run b-new-heap "$new" NGRAPH_CORE_SPF_QUEUE=heap
-run a2-old "$old"
-uptime >> "$out/load.txt"
-echo done
diff --git a/dev/perf/spf_queue/spf_variants.hpp b/dev/perf/spf_queue/spf_variants.hpp
deleted file mode 100644
index 653cd58..0000000
--- a/dev/perf/spf_queue/spf_variants.hpp
+++ /dev/null
@@ -1,492 +0,0 @@
-// Experimental copies of the production forward SPF loop (src/shortest_paths.cpp,
-// shortest_paths_core) with the priority queue and the scratch workspace made
-// pluggable. The relaxation, selection, tie-break and predecessor rules are kept
-// verbatim so that any observable difference is attributable to the queue or
-// the workspace policy. Research code only; not part of the library.
-#pragma once
-
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-
-#include <algorithm>
-#include <bit>
-#include <cstdint>
-#include <limits>
-#include <optional>
-#include <span>
-#include <stdexcept>
-#include <tuple>
-#include <vector>
-
-namespace spfx {
-
-using namespace netgraph::core;
-constexpr Cost INF = std::numeric_limits<Cost>::max();
-using QItem = std::tuple<Cost, Cap, NodeId>;
-
-// Reference queue: a binary heap over (cost, -bottleneck, node), the exact key
-// std::priority_queue uses in production. Keys are unique per push (a node is
-// re-pushed only with a strictly smaller cost or a strictly larger bottleneck), so
-// any correct binary heap pops in the same order as std::priority_queue.
-struct HeapQueue {
-  static constexpr const char* name = "heap";
-  std::vector<QItem> h;
-  static bool gt(const QItem& a, const QItem& b) { return a > b; }
-  void begin(Cost, Cost) { h.clear(); }
-  void end() { h.clear(); }
-  bool empty() const { return h.empty(); }
-  Cost top_cost() { return std::get<0>(h.front()); }
-  QItem pop() {
-    std::pop_heap(h.begin(), h.end(), gt);
-    QItem t = h.back(); h.pop_back(); return t;
-  }
-  void push(Cost c, Cap nr, NodeId v) {
-    h.emplace_back(c, nr, v);
-    std::push_heap(h.begin(), h.end(), gt);
-  }
-};
-
-// Monotone bucket queue with ordered buckets. Dijkstra pops keys in
-// non-decreasing cost order and every push is >= the cost being popped, so with
-// W = max_cost/stride + 1 cyclic buckets each bucket holds exactly one cost value
-// at any time. The active bucket is a binary heap on (-bottleneck, node); pushes
-// into it (zero-cost edges) keep the heap property. The pop sequence is therefore
-// identical to the global heap's (cost, -bottleneck, node) order, including
-// stale-entry handling, zero-cost edges, single-path re-pushes and early exit.
-template <bool kPow2 = false>
-struct BucketHeapQueueT {
-  static constexpr const char* name = kPow2 ? "bucket2" : "bucket";
-  struct Item { Cap neg_res; NodeId node; };
-  static bool gt(const Item& a, const Item& b) {
-#ifdef SPFX_BAD_ORDER
-    return a.node > b.node;   // teeth check: ignore bottleneck ordering
-#else
-    return a.neg_res != b.neg_res ? a.neg_res > b.neg_res : a.node > b.node;
-#endif
-  }
-  std::vector<std::vector<Item>> buckets;
-  std::vector<std::uint64_t> occ;
-  std::size_t W = 0, cur_b = 0, pending = 0;
-  Cost cur = 0, stride = 1;
-
-  void begin(Cost max_cost, Cost stride_) {
-    stride = stride_ > 0 ? stride_ : 1;
-    W = static_cast<std::size_t>(max_cost / stride) + 1;
-    if constexpr (kPow2) W = std::bit_ceil(W);   // modulo becomes a mask
-    if (buckets.size() < W) buckets.resize(W);
-    occ.assign((W + 63) / 64, 0);
-    cur = 0; cur_b = 0; pending = 0;
-  }
-  void end() {
-    // Early exit can leave items behind; clear only occupied buckets.
-    for (std::size_t w = 0; w < occ.size(); ++w) {
-      std::uint64_t word = occ[w];
-      while (word) {
-        const std::size_t b = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
-        buckets[b].clear();
-        word &= word - 1;
-      }
-      occ[w] = 0;
-    }
-    pending = 0;
-  }
-  bool empty() const { return pending == 0; }
-  std::size_t bucket_of(Cost c) const {
-    const Cost q = stride == 1 ? c : c / stride;
-    if constexpr (kPow2) return static_cast<std::size_t>(q) & (W - 1);
-    else return static_cast<std::size_t>(q % static_cast<Cost>(W));
-  }
-  void push(Cost c, Cap nr, NodeId v) {
-    const std::size_t b = bucket_of(c);
-    auto& vec = buckets[b];
-    if (vec.empty()) occ[b >> 6] |= (std::uint64_t{1} << (b & 63));
-    vec.push_back({nr, v});
-    if (b == cur_b) std::push_heap(vec.begin(), vec.end(), gt);
-    ++pending;
-  }
-  void settle_active() {
-    if (!buckets[cur_b].empty()) return;
-    std::size_t i = cur_b + 1; if (i == W) i = 0;
-    std::size_t w = i >> 6;
-    std::uint64_t word = occ[w] & (~std::uint64_t{0} << (i & 63));
-    const std::size_t nwords = occ.size();
-    while (!word) { w = (w + 1 == nwords) ? 0 : w + 1; word = occ[w]; }
-    const std::size_t f = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
-    const std::size_t steps = f > cur_b ? f - cur_b : f + W - cur_b;
-    cur += static_cast<Cost>(steps) * stride; cur_b = f;
-    std::make_heap(buckets[f].begin(), buckets[f].end(), gt);
-  }
-  Cost top_cost() { settle_active(); return cur; }
-  QItem pop() {
-    settle_active();
-    auto& vec = buckets[cur_b];
-    std::pop_heap(vec.begin(), vec.end(), gt);
-    const Item it = vec.back(); vec.pop_back(); --pending;
-    if (vec.empty()) occ[cur_b >> 6] &= ~(std::uint64_t{1} << (cur_b & 63));
-    return {cur, it.neg_res, it.node};
-  }
-};
-using BucketHeapQueue = BucketHeapQueueT<false>;
-using BucketPow2Queue = BucketHeapQueueT<true>;
-
-// Variant of the bucket queue that sorts a bucket once when it becomes active and
-// consumes it linearly; same-cost pushes that arrive while the bucket is active
-// (zero-cost edges) go to a small side heap, and pop takes the smaller head.
-struct BucketSortQueue {
-  static constexpr const char* name = "bsort";
-  using Item = BucketHeapQueue::Item;
-  static bool lt(const Item& a, const Item& b) {
-    return a.neg_res != b.neg_res ? a.neg_res < b.neg_res : a.node < b.node;
-  }
-  static bool gt(const Item& a, const Item& b) { return lt(b, a); }
-  std::vector<std::vector<Item>> buckets;
-  std::vector<std::uint64_t> occ;
-  std::vector<Item> side;      // heap of same-cost pushes into the active bucket
-  std::size_t W = 0, cur_b = 0, pending = 0, head = 0;
-  Cost cur = 0, stride = 1;
-
-  void begin(Cost max_cost, Cost stride_) {
-    stride = stride_ > 0 ? stride_ : 1;
-    W = static_cast<std::size_t>(max_cost / stride) + 1;
-    if (buckets.size() < W) buckets.resize(W);
-    occ.assign((W + 63) / 64, 0);
-    side.clear(); cur = 0; cur_b = 0; pending = 0; head = 0;
-  }
-  void end() {
-    for (std::size_t w = 0; w < occ.size(); ++w) {
-      std::uint64_t word = occ[w];
-      while (word) {
-        const std::size_t b = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
-        buckets[b].clear();
-        word &= word - 1;
-      }
-      occ[w] = 0;
-    }
-    buckets[cur_b].clear(); side.clear(); pending = 0; head = 0;
-  }
-  bool empty() const { return pending == 0; }
-  std::size_t bucket_of(Cost c) const {
-    return static_cast<std::size_t>((c / stride) % static_cast<Cost>(W));
-  }
-  bool active_empty() const { return head >= buckets[cur_b].size() && side.empty(); }
-  void push(Cost c, Cap nr, NodeId v) {
-    const std::size_t b = bucket_of(c);
-    if (b == cur_b) {
-      side.push_back({nr, v});
-      std::push_heap(side.begin(), side.end(), gt);
-    } else {
-      auto& vec = buckets[b];
-      if (vec.empty()) occ[b >> 6] |= (std::uint64_t{1} << (b & 63));
-      vec.push_back({nr, v});
-    }
-    ++pending;
-  }
-  void settle_active() {
-    if (!active_empty()) return;
-    buckets[cur_b].clear(); head = 0;
-    std::size_t i = cur_b + 1; if (i == W) i = 0;
-    std::size_t w = i >> 6;
-    std::uint64_t word = occ[w] & (~std::uint64_t{0} << (i & 63));
-    const std::size_t nwords = occ.size();
-    while (!word) { w = (w + 1 == nwords) ? 0 : w + 1; word = occ[w]; }
-    const std::size_t f = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
-    const std::size_t steps = f > cur_b ? f - cur_b : f + W - cur_b;
-    cur += static_cast<Cost>(steps) * stride; cur_b = f;
-    occ[f >> 6] &= ~(std::uint64_t{1} << (f & 63));   // active bucket is tracked by head/side
-    auto& vec = buckets[f];
-    std::sort(vec.begin(), vec.end(), lt);
-  }
-  Cost top_cost() { settle_active(); return cur; }
-  QItem pop() {
-    settle_active();
-    auto& vec = buckets[cur_b];
-    Item it;
-    if (head < vec.size() && (side.empty() || lt(vec[head], side.front()))) {
-      it = vec[head++];
-    } else {
-      std::pop_heap(side.begin(), side.end(), gt);
-      it = side.back(); side.pop_back();
-    }
-    --pending;
-    return {cur, it.neg_res, it.node};
-  }
-};
-
-enum class WsMode { Fresh, ReuseFull, ReuseSparse, ReuseHybrid };
-// ReuseHybrid tracks touched nodes like ReuseSparse but chooses the reset, output
-// and DAG-conversion strategy at the end of the query from the touched count.
-
-// Scratch arrays of the production loop. Fresh: allocate per query as production
-// does (including reserve(E) on the entry arrays). ReuseFull: keep the vectors and
-// reset all N entries. ReuseSparse: keep the vectors and reset only touched nodes.
-struct Workspace {
-  std::vector<Cost> dist;
-  std::vector<Cap> minres;
-  std::vector<std::int32_t> pred_head, pred_tail;
-  std::vector<char> settled;
-  std::vector<NodeId> ent_parent;
-  std::vector<EdgeId> ent_edge;
-  std::vector<std::int32_t> ent_next;
-  std::vector<NodeId> touched;
-  WsMode mode = WsMode::Fresh;
-
-  bool tracking() const { return mode == WsMode::ReuseSparse || mode == WsMode::ReuseHybrid; }
-  // Decisions taken after the search from the touched fraction (hybrid only).
-  bool sparse_reset() const {
-    return mode == WsMode::ReuseSparse || (mode == WsMode::ReuseHybrid && touched.size() * 4 < dist.size());
-  }
-  void begin(std::int32_t n, std::int32_t e) {
-    const auto N = static_cast<std::size_t>(n);
-    if (tracking()) {
-      if (dist.size() != N) {
-        dist.assign(N, INF); minres.assign(N, 0); pred_head.assign(N, -1);
-        pred_tail.assign(N, -1); settled.assign(N, 0);
-      }
-      touched.clear();
-    } else {
-      dist.assign(N, INF); minres.assign(N, 0); pred_head.assign(N, -1);
-      pred_tail.assign(N, -1); settled.assign(N, 0);
-    }
-    ent_parent.clear(); ent_edge.clear(); ent_next.clear();
-    if (mode == WsMode::Fresh) {
-      const auto E = static_cast<std::size_t>(e);
-      ent_parent.reserve(E); ent_edge.reserve(E); ent_next.reserve(E);
-    }
-  }
-  inline void touch(NodeId v) { if (tracking()) touched.push_back(v); }
-  void end() {
-    if (!tracking()) return;
-    if (sparse_reset()) {
-      for (auto v : touched) {
-        const auto i = static_cast<std::size_t>(v);
-        dist[i] = INF; minres[i] = 0; pred_head[i] = -1; pred_tail[i] = -1; settled[i] = 0;
-      }
-    } else {
-      std::fill(dist.begin(), dist.end(), INF); std::fill(minres.begin(), minres.end(), 0);
-      std::fill(pred_head.begin(), pred_head.end(), -1); std::fill(pred_tail.begin(), pred_tail.end(), -1);
-      std::fill(settled.begin(), settled.end(), 0);
-    }
-    touched.clear();
-  }
-};
-
-// Copy of shortest_paths_core with the queue and workspace injected.
-template <class Queue>
-std::pair<std::vector<Cost>, PredDAG>
-spf_variant(const StrictMultiDiGraph& g, NodeId src,
-            std::optional<NodeId> dst,
-            bool multipath_arg,
-            const EdgeSelection& selection,
-            std::span<const Cap> residual,
-            std::span<const bool> node_mask,
-            std::span<const bool> edge_mask,
-            Queue& pq, Workspace& ws, Cost max_cost, Cost stride) {
-  const auto N = g.num_nodes();
-  const auto row = g.row_offsets_view();
-  const auto col = g.col_indices_view();
-  const auto aei = g.adj_edge_index_view();
-  const auto cost = g.cost_view();
-  const auto cap  = g.capacity_view();
-
-  ws.begin(N, g.num_edges());
-  auto& dist = ws.dist;
-  auto& min_residual_to_node = ws.minres;
-  auto& pred_head = ws.pred_head;
-  auto& pred_tail = ws.pred_tail;
-  auto& ent_parent = ws.ent_parent;
-  auto& ent_edge = ws.ent_edge;
-  auto& ent_next = ws.ent_next;
-  auto& settled = ws.settled;
-
-  auto finish_dist = [&]() {
-    std::vector<Cost> out;
-    if (ws.mode == WsMode::Fresh) { out = std::move(dist); dist.clear(); }
-    else if (ws.mode == WsMode::ReuseFull || !ws.sparse_reset()) { out = dist; }
-    else {
-      out.assign(static_cast<std::size_t>(N), INF);
-      for (auto v : ws.touched) out[static_cast<std::size_t>(v)] = dist[static_cast<std::size_t>(v)];
-    }
-    return out;
-  };
-
-  const bool use_node_mask = (node_mask.size() == static_cast<std::size_t>(g.num_nodes()));
-  const bool use_edge_mask = (edge_mask.size() == static_cast<std::size_t>(g.num_edges()));
-  const bool src_allowed = (src >= 0 && src < N && (!use_node_mask || node_mask[static_cast<std::size_t>(src)]));
-  if (src_allowed) {
-    dist[static_cast<std::size_t>(src)] = static_cast<Cost>(0);
-    min_residual_to_node[static_cast<std::size_t>(src)] = std::numeric_limits<Cap>::max();
-    ws.touch(src);
-  }
-
-  auto pred_clear = [&](std::size_t v){ pred_head[v] = -1; pred_tail[v] = -1; };
-  auto pred_append = [&](std::size_t v, NodeId p, EdgeId e){
-    const auto idx = static_cast<std::int32_t>(ent_parent.size());
-    ent_parent.push_back(p); ent_edge.push_back(e); ent_next.push_back(-1);
-    if (pred_head[v] < 0) { pred_head[v] = idx; }
-    else { ent_next[static_cast<std::size_t>(pred_tail[v])] = idx; }
-    pred_tail[v] = idx;
-  };
-  if (!src_allowed) {
-    PredDAG dag;
-    dag.parent_offsets.assign(static_cast<std::size_t>(N + 1), 0);
-    auto out = finish_dist();
-    ws.end();
-    return {std::move(out), std::move(dag)};
-  }
-
-  pq.begin(max_cost, stride);
-  pq.push(static_cast<Cost>(0), -std::numeric_limits<Cap>::max(), src);
-  Cost best_dst_cost = std::numeric_limits<Cost>::max();
-  bool have_best_dst = false;
-  const bool early_exit = dst.has_value();
-  const NodeId dst_node = dst.value_or(-1);
-
-  const bool has_residual = (residual.size() == static_cast<std::size_t>(g.num_edges()));
-  const bool require_cap = selection.require_capacity || has_residual;
-  const bool multipath = multipath_arg;
-
-  std::vector<EdgeId> sel_buf; sel_buf.reserve(16);
-  while (!pq.empty()) {
-    auto [d_u, neg_res_u, u] = pq.pop();
-    if (u < 0 || u >= N) continue;
-    if (d_u > dist[static_cast<std::size_t>(u)]) continue;
-    if (!multipath && d_u == dist[static_cast<std::size_t>(u)] &&
-        -neg_res_u < min_residual_to_node[static_cast<std::size_t>(u)] - kEpsilon) continue;
-    settled[static_cast<std::size_t>(u)] = 1;
-
-    if (early_exit && u == dst_node && !have_best_dst) { best_dst_cost = d_u; have_best_dst = true; }
-    if (early_exit && u == dst_node) {
-      if (pq.empty() || pq.top_cost() > best_dst_cost) break; else continue;
-    }
-
-    auto start = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto end   = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    std::size_t i = start;
-    while (i < end) {
-      NodeId v = col[i];
-      if (use_node_mask && !node_mask[static_cast<std::size_t>(v)]) {
-        std::size_t j_skip = i; while (j_skip < end && col[j_skip] == v) ++j_skip; i = j_skip; continue;
-      }
-      Cost min_edge_cost = std::numeric_limits<Cost>::max();
-      std::vector<EdgeId>& selected_edges = sel_buf; selected_edges.clear();
-      double best_rem_for_min_cost = -1.0;
-      std::size_t j = i;
-      int best_edge_id = -1;
-      for (; j < end && col[j] == v; ++j) {
-        auto e = static_cast<std::size_t>(aei[j]);
-        if (use_edge_mask && !edge_mask[e]) continue;
-        const Cap rem = has_residual ? residual[e] : cap[e];
-        if (require_cap && rem < kMinCap) continue;
-        const Cost ecost = static_cast<Cost>(cost[e]);
-        if (ecost < min_edge_cost) {
-          min_edge_cost = ecost;
-          selected_edges.clear();
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(aei[j]));
-          } else {
-            best_edge_id = static_cast<int>(e);
-            best_rem_for_min_cost = static_cast<double>(rem);
-          }
-        } else if (ecost == min_edge_cost) {
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(aei[j]));
-          } else {
-            if (selection.tie_break == EdgeTieBreak::PreferHigherResidual) {
-              if (static_cast<double>(rem) > best_rem_for_min_cost + kEpsilon) {
-                best_edge_id = static_cast<int>(e);
-                best_rem_for_min_cost = static_cast<double>(rem);
-              } else if (std::abs(static_cast<double>(rem) - best_rem_for_min_cost) <= kEpsilon) {
-                if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) {
-                  best_edge_id = static_cast<int>(e);
-                }
-              }
-            } else {
-              if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) {
-                best_edge_id = static_cast<int>(e);
-              }
-            }
-          }
-        }
-      }
-      if (!selection.multi_edge && best_edge_id >= 0) {
-        selected_edges.clear();
-        selected_edges.push_back(static_cast<EdgeId>(best_edge_id));
-      }
-      if (!selected_edges.empty()) {
-        Cost new_cost = static_cast<Cost>(d_u + min_edge_cost);
-        auto v_idx = static_cast<std::size_t>(v);
-        Cap max_edge_residual = static_cast<Cap>(0);
-        for (auto edge_id : selected_edges) {
-          const Cap rem = has_residual ? residual[static_cast<std::size_t>(edge_id)]
-                                        : cap[static_cast<std::size_t>(edge_id)];
-          if (rem > max_edge_residual) max_edge_residual = rem;
-        }
-        Cap path_residual = std::min(min_residual_to_node[static_cast<std::size_t>(u)], max_edge_residual);
-        if (new_cost < dist[v_idx] ||
-            (!multipath && new_cost == dist[v_idx] && !settled[v_idx] &&
-             path_residual > min_residual_to_node[v_idx] + kEpsilon)) {
-          if (dist[v_idx] == INF) ws.touch(v);
-          dist[v_idx] = new_cost;
-          min_residual_to_node[v_idx] = path_residual;
-          pred_clear(v_idx);
-          for (auto sel_e : selected_edges) pred_append(v_idx, u, sel_e);
-          pq.push(new_cost, -path_residual, v);
-        }
-        else if (multipath && new_cost == dist[v_idx] && !settled[v_idx]) {
-          for (auto sel_e : selected_edges) pred_append(v_idx, u, sel_e);
-        }
-      }
-      i = j;
-    }
-    if (have_best_dst) { if (pq.empty() || pq.top_cost() > best_dst_cost) break; }
-  }
-  pq.end();
-
-  PredDAG dag;
-  dag.parent_offsets.assign(static_cast<std::size_t>(N+1), 0);
-  if (ws.tracking() && ws.sparse_reset()) {
-    for (auto v : ws.touched) {
-      std::size_t c = 0;
-      for (std::int32_t i = pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ent_next[static_cast<std::size_t>(i)]) ++c;
-      dag.parent_offsets[static_cast<std::size_t>(v+1)] = static_cast<std::int32_t>(c);
-    }
-  } else {
-    for (std::int32_t v=0; v<N; ++v) {
-      std::size_t c=0;
-      for (std::int32_t i = pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ent_next[static_cast<std::size_t>(i)]) ++c;
-      dag.parent_offsets[static_cast<std::size_t>(v+1)] = static_cast<std::int32_t>(c);
-    }
-  }
-  for (std::size_t k=1; k<dag.parent_offsets.size(); ++k)
-    dag.parent_offsets[k] += dag.parent_offsets[k-1];
-  dag.parents.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  dag.via_edges.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  auto fill = [&](std::int32_t v) {
-    auto base = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v)]);
-    std::size_t k = 0;
-    for (std::int32_t i = pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ent_next[static_cast<std::size_t>(i)]) {
-      dag.parents[base+k] = ent_parent[static_cast<std::size_t>(i)];
-      dag.via_edges[base+k] = ent_edge[static_cast<std::size_t>(i)];
-      ++k;
-    }
-  };
-  if (ws.tracking() && ws.sparse_reset()) { for (auto v : ws.touched) fill(v); }
-  else { for (std::int32_t v=0; v<N; ++v) fill(v); }
-  auto out = finish_dist();
-  ws.end();
-  return {std::move(out), std::move(dag)};
-}
-
-// Graph-level dispatch metadata: maximum edge cost and the gcd of all costs.
-struct CostProfile { Cost max_cost = 0; Cost stride = 1; };
-inline CostProfile profile_costs(const StrictMultiDiGraph& g) {
-  CostProfile p; Cost gcd = 0;
-  for (auto c : g.cost_view()) {
-    if (c > p.max_cost) p.max_cost = c;
-    Cost a = gcd, b = c; while (b) { Cost t = a % b; a = b; b = t; } gcd = a;
-  }
-  p.stride = gcd > 0 ? gcd : 1;
-  return p;
-}
-
-} // namespace spfx
diff --git a/dev/perf/spf_queue/summarize.py b/dev/perf/spf_queue/summarize.py
deleted file mode 100644
index 89b4efa..0000000
--- a/dev/perf/spf_queue/summarize.py
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Tabulate cpu_queue A/B/A results as Markdown (sequential single-thread medians)."""
-
-import csv
-import glob
-import os
-import sys
-
-root = (
-    sys.argv[1]
-    if len(sys.argv) > 1
-    else os.path.join(os.path.dirname(__file__), "results", "first")
-)
-
-
-def load(pattern):
-    rows = {}
-    for path in sorted(glob.glob(os.path.join(root, pattern))):
-        tag = (
-            os.path.basename(path)[len("time-") : -4]
-            if "time-" in path
-            else os.path.basename(path)[len("sweep-") : -4]
-        )
-        with open(path) as f:
-            for r in csv.DictReader(f):
-                key = (r["case"], r["n"], r["e"], r["queries"], r["dst"])
-                rows.setdefault(key, {})[tag] = r
-    return rows
-
-
-def fmt(r):
-    if r is None:
-        return "—"
-    s = f"{float(r['median_ms']):.3f}"
-    return s + (" (heap fallback)" if r.get("fallback") == "1" else "")
-
-
-time_rows = load("time-*.csv")
-order = [
-    "ref-a1",
-    "heap-fresh-b",
-    "heap-full-b",
-    "heap-sparse-b",
-    "bucket-fresh-b",
-    "bucket-full-b",
-    "bucket-sparse-b",
-    "bsort-fresh-b",
-    "bsort-sparse-b",
-    "ref-a2",
-]
-seen = {t for v in time_rows.values() for t in v}
-present = [t for t in order if t in seen] + sorted(t for t in seen if t not in order)
-present = [t for t in present if t != "ref-a2"] + (
-    ["ref-a2"] if "ref-a2" in seen else []
-)
-print(
-    "| Workload: case / nodes / edges / queries / dst | W | "
-    + " | ".join(present)
-    + " |"
-)
-print("|---|---:|" + "---:|" * len(present))
-for key, v in time_rows.items():
-    any_row = next(iter(v.values()))
-    label = f"{key[0]} / {key[1]} / {key[2]} / {key[3]} / {key[4]}"
-    print(
-        f"| {label} | {any_row['W']} | "
-        + " | ".join(fmt(v.get(t)) for t in present)
-        + " |"
-    )
-
-sweep_rows = load("sweep-*.csv")
-if sweep_rows:
-    tags = sorted({t for v in sweep_rows.values() for t in v})
-    print()
-    print("| Cost sweep: case / nodes / queries | W | " + " | ".join(tags) + " |")
-    print("|---|---:|" + "---:|" * len(tags))
-    for key, v in sweep_rows.items():
-        any_row = next(iter(v.values()))
-        print(
-            f"| {key[0]} / {key[1]} / {key[3]} | {any_row['W']} | "
-            + " | ".join(fmt(v.get(t)) for t in tags)
-            + " |"
-        )
diff --git a/dev/perf/spf_queue/summarize_core.py b/dev/perf/spf_queue/summarize_core.py
deleted file mode 100644
index b409d8d..0000000
--- a/dev/perf/spf_queue/summarize_core.py
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/usr/bin/env python3
-"""Tabulate the Core-level old/new/old A/B/A (results-core) as Markdown."""
-
-import csv
-import os
-import sys
-
-root = (
-    sys.argv[1]
-    if len(sys.argv) > 1
-    else os.path.join(os.path.dirname(__file__), "results", "core")
-)
-phases = ["a1-old", "b-new", "b-new-heap", "a2-old"]
-for kind in ("time", "sweep"):
-    rows = {}
-    for p in phases:
-        with open(f"{root}/{kind}-{p}.csv") as f:
-            for r in csv.DictReader(f):
-                key = (r["case"], r["n"], r["e"], r["queries"], r["dst"], r["W"])
-                rows.setdefault(key, {})[p] = float(r["median_ms"])
-    print(
-        f"| {kind}: case / nodes / edges / queries / destination | W | "
-        + " | ".join(phases)
-        + " | old/new | old/new-heap |"
-    )
-    print("|---|---:|" + "---:|" * (len(phases) + 2))
-    for k, v in rows.items():
-        lo, hi = min(v["a1-old"], v["a2-old"]), max(v["a1-old"], v["a2-old"])
-        print(
-            f"| {' / '.join(k[:5])} | {k[5]} | "
-            + " | ".join(f"{v[p]:.3f}" for p in phases)
-            + f" | {lo / v['b-new']:.2f}–{hi / v['b-new']:.2f} | {lo / v['b-new-heap']:.2f}–{hi / v['b-new-heap']:.2f} |"
-        )
-    print()
diff --git a/dev/perf/spf_queue/summarize_netgraph.py b/dev/perf/spf_queue/summarize_netgraph.py
deleted file mode 100644
index dab8f4a..0000000
--- a/dev/perf/spf_queue/summarize_netgraph.py
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env python3
-"""Tabulate the NetGraph-workload A/B/A (old/new/old, fresh processes) as Markdown."""
-
-import csv
-import glob
-import os
-import sys
-
-root = (
-    sys.argv[1]
-    if len(sys.argv) > 1
-    else os.path.join(os.path.dirname(__file__), "results", "netgraph")
-)
-phases = ["a1-old", "b-new", "b-new-heap", "a2-old"]
-rows: dict[str, dict[str, dict]] = {}
-for path in sorted(glob.glob(os.path.join(root, "*.csv"))):
-    tag = os.path.basename(path)[:-4]
-    with open(path) as f:
-        for r in csv.DictReader(f):
-            rows.setdefault(r["workload"], {})[tag] = r
-present = [p for p in phases if any(p in v for v in rows.values())]
-print(
-    "| Workload | "
-    + " | ".join(f"{p} ms" for p in present)
-    + " | old/new | checksums |"
-)
-print("|---|" + "---:|" * len(present) + "---:|---|")
-mismatch = 0
-for name, v in rows.items():
-    med = {p: float(v[p]["median_s"]) * 1000 for p in present if p in v}
-    ratio = ""
-    if "a1-old" in med and "a2-old" in med and "b-new" in med:
-        ratio = f"{min(med['a1-old'], med['a2-old']) / med['b-new']:.2f}–{max(med['a1-old'], med['a2-old']) / med['b-new']:.2f}"
-    sums = {v[p]["checksum"] for p in present if p in v}
-    ok = "same" if len(sums) == 1 else "DIFFER"
-    if ok != "same":
-        mismatch += 1
-    print(
-        f"| {name} | "
-        + " | ".join(f"{med[p]:.2f}" if p in med else "—" for p in present)
-        + f" | {ratio} | {ok} |"
-    )
-print()
-print(f"checksum mismatches: {mismatch}")
diff --git a/dev/perf/test_tool.py b/dev/perf/test_tool.py
new file mode 100644
index 0000000..4b35f45
--- /dev/null
+++ b/dev/perf/test_tool.py
@@ -0,0 +1,3572 @@
+"""Tests of the timing tool itself (README.md, "The tool's own tests"); nothing is timed.
+
+    venv/bin/python -B dev/perf/test_tool.py [-v]        # or: make perf-tool-test
+
+The rules README.md states are tested here:
+
+* ``aba.py`` end to end with two fake harnesses (Python scripts that answer ``aba-list``,
+  ``aba-calibrate`` and ``aba-run`` like the real one; ``Driver``), and its parts directly (the
+  memory rule, the verdicts, the bootstrap interval, the cluster rule, the row selection, the
+  harness responses, the block line, derived values that are not finite, the SIGINT handler,
+  the hashes of the tool's sources);
+* ``build.sh`` with a fake compiler, ``xcrun`` and ``vtool`` in a scratch git repository
+  (``BuildScript``);
+* the harness's driver and the checks of ``aba_rows.hpp``, compiled unoptimised against this
+  checkout's Core with a few test rows (``Harness``);
+* the frozen files against the values compiled into ``aba_rows.hpp`` (``FrozenFiles``).
+"""
+
+from __future__ import annotations
+
+import concurrent.futures
+import contextlib
+import csv
+import glob
+import hashlib
+import io
+import json
+import math
+import os
+import platform
+import random
+import re
+import shutil
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from fractions import Fraction
+from pathlib import Path
+from unittest import mock
+
+HERE = Path(__file__).resolve().parent
+REPO = HERE.parents[1]
+ABA = HERE / "aba.py"
+sys.path.insert(0, str(HERE))
+
+import aba  # noqa: E402
+
+MIB = 2**20
+
+
+def sha256sums(directory: Path) -> dict[str, str]:
+    """``directory``'s SHA256SUMS as {file name: sha256}; ValueError for a file named twice."""
+    lines = (directory / "SHA256SUMS").read_text().splitlines()
+    out = dict(reversed(ln.split("  ", 1)) for ln in lines)
+    if len(out) != len(lines):
+        raise ValueError(f"{directory}/SHA256SUMS names a file twice")
+    return out
+
+
+def block(rss: float) -> dict:
+    return {
+        "rss_self_bytes": rss,
+        "rss_children_bytes": 0,
+        "rss_wait4_bytes": rss,
+        "rss_tree_bytes": rss,
+    }
+
+
+def triples(a1: list[float], b: list[float], a2: list[float]) -> list[dict]:
+    return [
+        {"A1": block(x), "B": block(y), "A2": block(z)}
+        for x, y, z in zip(a1, b, a2, strict=True)
+    ]
+
+
+def rule(a1, b, a2=None) -> dict:
+    return aba.rss_balanced(triples(a1, b, a2 or a1), 1.10, 8 * MIB)
+
+
+def exact_pass(reference: int, candidate: int) -> bool:
+    """The allowance in exact arithmetic (1.10 = 11/10)."""
+    return candidate <= max(Fraction(11, 10) * reference, reference + 8 * MIB)
+
+
+class MemoryBoundary(unittest.TestCase):
+    def check(self, ref: int, allowance: int) -> None:
+        a1 = [ref - 4096] * 6 + [ref]
+        at = rule(a1, [allowance] + [ref] * 6)
+        over = rule(a1, [allowance + 1] + [ref] * 6)
+        self.assertEqual((at["rss_verdict"], over["rss_verdict"]), ("pass", "fail"))
+        self.assertEqual(at["rss_a1_max_bytes"], ref)
+        self.assertEqual(at["rss_b_max_bytes"], allowance)
+        self.assertTrue(exact_pass(ref, allowance))
+        self.assertFalse(exact_pass(ref, allowance + 1))
+
+    def test_floor_branch_equal_and_one_byte_over(self):
+        # 10 MiB: 1.10 x R = 11 MiB < R + 8 MiB = 18 MiB.
+        self.check(10 * MIB, 18 * MIB)
+        self.assertEqual(rule([10 * MIB] * 7, [0] * 7)["rss_allowance_bytes"], 18 * MIB)
+
+    def test_ratio_branch_equal_and_one_byte_over(self):
+        # 100 MiB: 1.10 x R = 110 MiB > R + 8 MiB; the float allowance is a hair above
+        # 115,343,360, which changes no integer verdict.
+        self.check(100 * MIB, 110 * MIB)
+        self.assertGreaterEqual(
+            rule([100 * MIB] * 7, [0] * 7)["rss_allowance_bytes"], 110 * MIB
+        )
+
+    def test_branches_meet_at_80_mib(self):
+        self.check(80 * MIB, 88 * MIB)
+
+    def test_floor_applies_above_the_ratio(self):
+        # +7 MiB on 40 MiB is ratio 1.175: above 1.10 but within the 8 MiB floor. A check
+        # of the ratio against 1.10 alone would wrongly fail it.
+        r = rule([40 * MIB] * 7, [47 * MIB] * 7)
+        self.assertGreater(r["rss_balanced_ratio"], 1.10)
+        self.assertEqual(r["rss_verdict"], "pass")
+        self.assertEqual(r["rss_allowance_bytes"], 48 * MIB)
+
+    def test_ratio_branch_above_the_floor(self):
+        # 200 MiB: +16 MiB is within 10 percent (220 MiB), +21 MiB is not.
+        self.assertEqual(rule([200 * MIB] * 7, [216 * MIB] * 7)["rss_verdict"], "pass")
+        self.assertEqual(rule([200 * MIB] * 7, [221 * MIB] * 7)["rss_verdict"], "fail")
+
+    def test_float_agrees_with_exact_arithmetic_on_page_multiples(self):
+        page = 16384
+        for ref in range(page, 400 * MIB, 7 * MIB + 3 * page):
+            r = rule([ref] * 7, [0] * 7)
+            edge = int(r["rss_allowance_bytes"]) // page * page
+            for cand in (edge - page, edge, edge + page):
+                got = rule([ref] * 7, [cand] * 7)["rss_verdict"] == "pass"
+                self.assertEqual(got, exact_pass(ref, cand), (ref, cand))
+
+
+class MemoryFixedA1(unittest.TestCase):
+    def test_larger_a2_cannot_rescue(self):
+        r = rule([40 * MIB] * 7, [50 * MIB] * 7, [40 * MIB] * 6 + [60 * MIB])
+        self.assertEqual(r["rss_verdict"], "fail")
+        self.assertEqual(r["rss_a2_max_bytes"], 60 * MIB)
+        self.assertEqual(r["rss_a1_max_bytes"], 40 * MIB)
+
+    def test_slot_not_value_selects_the_reference(self):
+        # The same seven pairs of A values with the large one moved from A2 to A1: the
+        # reference follows the slot.
+        a_low, a_high = [40 * MIB] * 7, [40 * MIB] * 6 + [60 * MIB]
+        b = [50 * MIB] * 7
+        self.assertEqual(rule(a_low, b, a_high)["rss_verdict"], "fail")
+        self.assertEqual(rule(a_high, b, a_low)["rss_verdict"], "pass")
+
+    def test_one_high_b_block_fails(self):
+        r = rule([40 * MIB] * 7, [40 * MIB] * 6 + [49 * MIB])
+        self.assertEqual(r["rss_verdict"], "fail")
+
+
+class Verdicts(unittest.TestCase):
+    def test_row_verdict_combines(self):
+        # any failing check fails the row; else timing's inconclusive; else pass
+        for i in range(5):
+            checks = ["pass"] * 5
+            checks[i] = "fail"
+            self.assertEqual(aba.row_verdict(*checks), "fail", i)
+        self.assertEqual(
+            aba.row_verdict("inconclusive", "fail", "pass", "pass", "pass"), "fail"
+        )
+        self.assertEqual(
+            aba.row_verdict("inconclusive", "pass", "pass", "pass", "pass"),
+            "inconclusive",
+        )
+        self.assertEqual(aba.row_verdict(*["pass"] * 5), "pass")
+
+
+def expected_interval(x: list[float], resamples: int, seed: int) -> tuple[float, float]:
+    """The bootstrap interval computed independently of aba.py: ``resamples`` draws of
+    ``len(x)`` whole triples with ``random.Random(seed).randrange`` (the documented procedure),
+    the middle element of each sorted draw (``len(x)`` is odd), and the 2.5 % and 97.5 %
+    order statistics at floor(0.025 * (R - 1)) and ceil(0.975 * (R - 1))."""
+    rng = random.Random(seed)
+    meds = []
+    for _ in range(resamples):
+        draw = sorted(x[rng.randrange(len(x))] for _ in range(len(x)))
+        meds.append(draw[len(draw) // 2])
+    meds.sort()
+    return (
+        meds[math.floor(0.025 * (resamples - 1))],
+        meds[math.ceil(0.975 * (resamples - 1))],
+    )
+
+
+def timed_block(
+    median_s: float,
+    digest: str = "d",
+    rss: float = 40 * MIB,
+    block_s: float = 2.5,
+) -> dict:
+    """A timed block as report.json stores it (2,000 iterations)."""
+    return {
+        **block(rss),
+        "row": "w.one",
+        "iterations": 2000,
+        "median_s": median_s,
+        "block_s": block_s,
+        "setup_s": 0.01,
+        "digest": digest,
+        "load1_before": 0.0,
+        "load1_after": 0.0,
+        "side": "old",
+        "wall_s": 2.6,
+    }
+
+
+def timed_triples(
+    a1: list[float], b: list[float], a2: list[float], **block
+) -> list[dict]:
+    """Timed triples of these median iteration times (``timed_block``'s other fields from
+    ``block``)."""
+    return [
+        {
+            "A1": timed_block(x, **block),
+            "B": timed_block(y, **block),
+            "A2": timed_block(z, **block),
+        }
+        for x, y, z in zip(a1, b, a2, strict=True)
+    ]
+
+
+class Bootstrap(unittest.TestCase):
+    SEED = 20261003
+    # Seven per-triple statistics: median 0.01 (inside a 3 % tolerance), long right tail.
+    X_TAIL = [-0.05, -0.04, 0.0, 0.01, 0.02, 0.10, 0.12]
+    X_TIGHT = [-0.04, -0.03, -0.02, -0.01, 0.0, 0.01, 0.02]
+
+    def test_endpoints_equal_an_independent_computation(self):
+        for x in (self.X_TAIL, self.X_TIGHT):
+            got = aba.bootstrap_interval(x, 10000, self.SEED)
+            want = expected_interval(x, 10000, self.SEED)
+            self.assertEqual(got, want)
+            self.assertLess(got[0], got[1])  # nonconstant
+        self.assertEqual(
+            expected_interval(self.X_TAIL, 10000, self.SEED), (-0.04, 0.10)
+        )
+
+    def row(self, x: list[float]) -> dict:
+        # A1 = A2 = 1 ms (no drift), B = 1 ms * (1 + x_t): r_t - 1 = x_t up to rounding.
+        a = [1e-3] * len(x)
+        triples = timed_triples(a, [1e-3 * (1 + v) for v in x], a)
+        return aba.row_statistics(triples, 0.03, 1.10, 8 * MIB, 2.0, 10000, self.SEED)
+
+    def test_upper_bound_decides_the_timing_verdict(self):
+        tail = self.row(self.X_TAIL)
+        self.assertAlmostEqual(tail["statistic"], 0.01)  # the median alone would pass
+        self.assertAlmostEqual(tail["ci95"][1], 0.10)
+        self.assertEqual(tail["time_verdict"], "fail")
+        self.assertEqual(tail["verdict"], "fail")
+        tight = self.row(self.X_TIGHT)
+        self.assertAlmostEqual(tight["ci95"][1], 0.01)
+        self.assertLessEqual(tight["ci95"][1], 0.03)
+        self.assertEqual(tight["time_verdict"], "pass")
+
+
+class TimingRules(unittest.TestCase):
+    """The timing statistics and the block-length rule on exact binary fractions (2^-10 s and
+    1.25 x 2^-10 s), so every boundary is met exactly."""
+
+    U = 2.0**-10
+
+    def test_drift_takes_precedence_over_a_failing_interval(self):
+        data = timed_triples([1.0] * 7, [2.0] * 7, [1.1] * 7)
+        rec = aba.row_statistics(data, 0.03, 1.10, 8 * MIB, 2.0, 100, 7)
+        self.assertGreater(rec["ci95"][0], 0.03)
+        self.assertGreater(rec["drift"], 0.03)
+        self.assertEqual(rec["time_verdict"], "inconclusive")
+
+    def stats(self, a1, b, a2, tolerance=0.25, block_s=2.5):
+        a1, b, a2 = ([v * self.U for v in side] for side in (a1, b, a2))
+        triples = timed_triples(a1, b, a2, block_s=block_s)
+        return aba.row_statistics(triples, tolerance, 1.10, 8 * MIB, 2.0, 200, 1)
+
+    def test_ratio_against_the_mean_of_a1_and_a2(self):
+        r = self.stats([1.0] * 7, [1.25] * 7, [1.5] * 7, tolerance=1.0)
+        self.assertEqual(r["statistic"], 1.25 / 1.25 - 1)
+        self.assertEqual(r["ratios"], [1.0] * 7)
+
+    def test_drift_is_the_median_of_a1_over_a2(self):
+        # |A1/A2 - 1| = 0, 0, 0, 0.5, 0.5, 0.5, 0.5: median 0.5 (mean 0.29; |A2/A1 - 1| 0.33)
+        r = self.stats([1.0] * 3 + [1.5] * 4, [1.0] * 7, [1.0] * 7, tolerance=1.0)
+        self.assertEqual(r["drift"], 0.5)
+
+    def test_boundaries_are_inclusive(self):
+        # the interval's upper bound equal to the tolerance passes
+        r = self.stats([1.0] * 7, [1.25] * 7, [1.0] * 7)
+        self.assertEqual((r["ci95"][1], r["time_verdict"]), (0.25, "pass"))
+        # a drift equal to the tolerance is not inconclusive (B 1.125 = mean of A1 and A2)
+        r = self.stats([1.25] * 7, [1.125] * 7, [1.0] * 7)
+        self.assertEqual((r["drift"], r["time_verdict"]), (0.25, "pass"))
+        # a block as long as the minimum is not short
+        r = self.stats([1.0] * 7, [1.0] * 7, [1.0] * 7, block_s=2.0)
+        self.assertEqual((r["short_blocks"], r["block_verdict"]), ([], "pass"))
+
+
+class Clusters(unittest.TestCase):
+    """The same-side cluster rule: a gap above the tolerance between consecutive sorted blocks,
+    with at least two blocks on each side of it."""
+
+    def test_two_blocks_on_each_side(self):
+        for times, want in (
+            ([1.0] * 5 + [1.5] * 2, (5, 2)),  # two high blocks: bimodal
+            ([1.0] * 2 + [1.5] * 5, (2, 5)),  # two low blocks: bimodal
+            ([1.0] * 6 + [1.5], None),  # one outlier above: not a cluster
+            ([0.5] + [1.0] * 6, None),  # one outlier below: not a cluster
+            ([1.0] * 4 + [1.25] * 3, None),  # a gap of exactly the tolerance, not above
+        ):
+            got = aba.side_clusters(times, 0.25)
+            self.assertEqual(
+                None if got is None else (got["low"]["blocks"], got["high"]["blocks"]),
+                want,
+                times,
+            )
+
+    def test_the_widest_split_is_reported(self):
+        got = aba.side_clusters([1.0, 1.0, 1.1, 1.1, 1.5, 1.5], 0.03)
+        self.assertAlmostEqual(got["gap"], 1.5 / 1.1 - 1)
+        self.assertEqual((got["low"]["blocks"], got["high"]["blocks"]), (4, 2))
+
+
+class DerivedValues(unittest.TestCase):
+    """Finite block numbers whose derived values are not finite abort the run (RuntimeError)
+    before any statistic or verdict is returned."""
+
+    def stats(self, a1, b, a2, rss=40 * MIB):
+        triples = timed_triples(a1, b, a2, rss=rss)
+        return aba.row_statistics(triples, 0.03, 1.10, 8 * MIB, 2.0, 200, 1)
+
+    def aborts(self, why: str, *args, **kwargs) -> None:
+        with self.assertRaises(RuntimeError) as ctx:
+            self.stats(*args, **kwargs)
+        self.assertIn(why, str(ctx.exception))
+
+    def test_ordinary_values_pass(self):
+        self.assertEqual(
+            self.stats([1e-3] * 7, [1e-3] * 7, [1e-3] * 7)["verdict"], "pass"
+        )
+
+    def test_mean_overflow_in_one_triple(self):
+        # Only the mean of A1 and A2 of triple 7 overflows (1.7e308 + 1e307): every value the
+        # row records stays finite, so only the mean's own check stops the ratio 1e300 / inf = 0.
+        a1 = [1e300] * 6 + [1.7e308]
+        a2 = [1e300] * 6 + [1e307]
+        self.aborts("the mean of A1 and A2 is inf, not finite", a1, [1e300] * 7, a2)
+
+    def test_ratio_and_allowance_overflow(self):
+        self.aborts(
+            "row statistic ratios is inf", [1e-300] * 7, [1e10] * 7, [1e-300] * 7
+        )
+        # a peak near the largest double: 1.10 * peak overflows
+        self.aborts(
+            "row statistic rss_allowance_bytes is inf",
+            [1e-3] * 7,
+            [1e-3] * 7,
+            [1e-3] * 7,
+            rss=1.7e308,
+        )
+
+    def test_calibrated_count_overflow(self):
+        # the count of the side whose warm-up median is tiny, named with its row
+        ok = {"row": "r", "side": "old", "median_s": 1e-3}
+        tiny = {"row": "r", "side": "new", "median_s": 5e-324}
+        self.assertEqual(aba.side_counts(ok, ok, 2.0, 0.1, None)[:2], (2200, 2200))
+        for warm_a, warm_b, side in ((tiny, ok, "old"), (ok, tiny, "new")):
+            with self.assertRaises(RuntimeError) as ctx:
+                aba.side_counts(
+                    {**warm_a, "side": "old"}, {**warm_b, "side": "new"}, 2.0, 0.1, None
+                )
+            self.assertIn(
+                f"r {side}: the calibrated iteration count is inf", str(ctx.exception)
+            )
+
+
+ROWS = {
+    "a.one": {"group": "a"},
+    "a.two": {"group": "a"},
+    "b.one": {"group": "b"},
+    "c.one": {"group": "c"},
+}
+
+
+class RowResolution(unittest.TestCase):
+    def plan(self, rows: str) -> dict:
+        return aba.choose_rows(ROWS, rows)
+
+    def test_row_name_group_and_all(self):
+        self.assertEqual(self.plan("a.one")["selected"], ["a.one"])
+        self.assertEqual(self.plan("a")["selected"], ["a.one", "a.two"])
+        self.assertEqual(self.plan("a.*")["selected"], ["a.one", "a.two"])
+        self.assertEqual(self.plan("all")["selected"], list(ROWS))
+        self.assertEqual(self.plan("")["selected"], list(ROWS))
+
+    def test_glob_characters(self):
+        # '?' one character, '[...]' one of a set, '[!...]' one outside it
+        self.assertEqual(self.plan("?.one")["selected"], ["a.one", "b.one", "c.one"])
+        self.assertEqual(self.plan("[ab].t*")["selected"], ["a.two"])
+        self.assertEqual(self.plan("[!a].one")["selected"], ["b.one", "c.one"])
+
+    def test_glob_matching_nothing_is_an_error(self):
+        sel = self.plan("a.*,placement.*")
+        self.assertEqual(
+            sel["errors"], ["--rows glob 'placement.*' matches no row or group"]
+        )
+        text = aba.row_choice_error_text(sel, ROWS)
+        self.assertIn("a (2): a.one, a.two", text)
+        self.assertIn("b (1): b.one", text)
+        self.assertEqual(self.plan(" , ")["errors"], ["--rows ' , ' names no glob"])
+
+    def test_records(self):
+        sel = self.plan("a.one,b.one")
+        self.assertEqual(sel["errors"], [])
+        first = sel["globs"][0]
+        self.assertEqual(first["group_rows_not_matched"], ["a.two"])
+        self.assertEqual(sel["not_selected"], {"a": ["a.two"], "c": ["c.one"]})
+
+    def test_rows_parsing(self):
+        cases = {
+            " a.* , b.one ": ["a.one", "a.two", "b.one"],
+            "a.one,,c": ["a.one", "c.one"],
+            "all": list(ROWS),
+        }
+        for text, want in cases.items():
+            self.assertEqual(self.plan(text)["selected"], want, text)
+        self.assertEqual(aba.split_patterns(" a.* , b.one "), ["a.*", "b.one"])
+
+    def test_both_sides_list_the_same_rows(self):
+        aba.same_rows(ROWS, dict(ROWS))
+        for old, new, why in (
+            (ROWS, {**ROWS, "d.one": {"group": "d"}}, "only the candidate ['d.one']"),
+            (
+                {**ROWS, "d.one": {"group": "d"}},
+                ROWS,
+                "only the reference has ['d.one']",
+            ),
+            (ROWS, {**ROWS, "c.one": {"group": "e"}}, "other records ['c.one']"),
+            (ROWS, dict(reversed(ROWS.items())), "another order"),
+        ):
+            with self.assertRaises(aba.Refused) as ctx:
+                aba.same_rows(old, new)
+            self.assertIn(why, str(ctx.exception))
+
+
+class Responses(unittest.TestCase):
+    """A harness's whole response, never a usable line picked out of it."""
+
+    LINE = json.dumps(
+        {
+            "row": "r",
+            "iterations": 5,
+            "median_s": 0.001,
+            "block_s": 0.005,
+            "setup_s": 0.0,
+            "digest": "00000000000000ff",
+            "rss_self_bytes": 41943040,
+            "rss_children_bytes": 0,
+        }
+    )
+
+    def refused(self, out: bytes, why: str) -> None:
+        with self.assertRaises(aba.ResponseError) as ctx:
+            aba.parse_block(out, "fake run r", "r")
+        self.assertIn(why, str(ctx.exception))
+
+    def test_one_block_record_and_nothing_else(self):
+        line = self.LINE
+        self.assertEqual(
+            aba.parse_block(f"{line}\n".encode(), "fake run r", "r")["median_s"], 0.001
+        )
+        negative = line.replace('"median_s": 0.001', '"median_s": -0.001')
+        for out, why in (
+            # a broken record, a negative median or text around the valid record
+            (f'{{"row": "r", "median_s": 0.001,\n{line}\n', "; line 1 of 2): {"),
+            (f"{negative}\n{line}\n", "2 output records, exactly one expected"),
+            (f"{line}\nNOT JSON\n", "; line 2 of 2): NOT JSON"),
+            (f"{line}\n\n", "; line 2 of 2)"),
+            (f"[1]\n{line}\n", "not a JSON object; line 1 of 2"),
+            (f"{line}", "not ended by a newline"),
+            ("", "0 output records, exactly one expected"),
+            # one record, but the key twice (the valid value last) or another row's
+            ('{"median_s": -1.0, ' + line[1:] + "\n", "key 'median_s' twice"),
+            (line.replace('"row": "r"', '"row": "q"') + "\n", "names row 'q', not 'r'"),
+        ):
+            self.refused(out.encode(), why)
+        self.refused(b"\xff\n", "the output is not UTF-8 text")
+
+    def test_row_list(self):
+        def rows(*lines: str) -> dict:
+            return aba.row_list(("".join(f"{ln}\n" for ln in lines)).encode(), "list")
+
+        good = [json.dumps({"row": n, "group": "g", "desc": "d"}) for n in ("a", "b")]
+        self.assertEqual(list(rows(*good)), ["a", "b"])
+        for lines, why in (
+            ((*good, good[0]), "row 'a' listed twice"),
+            (("junk", *good), "malformed output line"),
+            ((*good, json.dumps({"row": "c"})), "without a string group"),
+            ((*good, json.dumps({"row": 3, "group": "g"})), "without a string row"),
+            ((*good, json.dumps({"row": "c", "group": "g", "desc": 3})), "string desc"),
+            (
+                (*good, json.dumps({"row": "c", "group": "g", "queries": 1})),
+                "string queries",
+            ),
+            (
+                (*good, json.dumps({"row": "c", "group": "g", "x": float("nan")})),
+                'list: row c: unknown key \'x\': {"row": "c", "group": "g", "x": NaN}',
+            ),
+            ((), "no row listed"),
+        ):
+            with self.assertRaises(aba.ResponseError) as ctx:
+                rows(*lines)
+            self.assertIn(why, str(ctx.exception))
+        # a row's name and its group: 1 to 64 of a-z, 0-9, '.', '_' and '-'
+        names = ("a.b_c-9", "x" * 64)
+        self.assertEqual(
+            list(rows(*(json.dumps({"row": n, "group": n}) for n in names))),
+            list(names),
+        )
+        for name in (
+            "",
+            "probe/row",
+            "Upper",
+            "x" * 65,
+            "tab\there",
+            "\ud800",
+            "\u00e9",
+        ):
+            for key in ("row", "group"):
+                rec = {"row": "a", "group": "g", key: name}
+                with self.assertRaises(aba.ResponseError, msg=(key, name)) as ctx:
+                    rows(json.dumps(rec))
+                self.assertIn(f"{key} {name!r} is not 1 to 64 of", str(ctx.exception))
+
+
+class BlockLine(unittest.TestCase):
+    """``aba.parse_block``, the harness boundary: every number of a block line of its type,
+    finite and in its domain, else the run aborts."""
+
+    LINE = {
+        "row": "r",
+        "iterations": 5,
+        "median_s": 0.001,
+        "mean_s": 0.001,
+        "min_s": 0.0009,
+        "p10_s": 0.0009,
+        "p90_s": 0.0011,
+        "max_s": 0.002,
+        "block_s": 0.005,
+        "setup_s": 0.01,
+        "digest": "00000000000000ff",
+        "rss_self_bytes": 41943040,
+        "rss_children_bytes": 0,
+    }
+
+    def parse(self, **change) -> dict:
+        line = json.dumps({**self.LINE, **change}) + "\n"
+        return aba.parse_block(line.encode(), "fake run r", "r")
+
+    def test_valid_line_and_the_zero_cases(self):
+        # The writer refuses non-finite values even if a future caller misses an input check.
+        for value in (float("nan"), float("inf"), -float("inf")):
+            with self.assertRaises(ValueError):
+                aba.report_text({"value": value})
+        rec = self.parse()
+        self.assertEqual(rec, self.LINE)
+        # every number a float but the count, so arithmetic on them overflows to an infinity
+        # (caught as not finite), never to an exception
+        self.assertEqual(
+            {k for k, v in rec.items() if type(v) is float},
+            set(self.LINE) - {"row", "iterations", "digest"},
+        )
+        self.assertIs(type(rec["iterations"]), int)
+        # 0 where a real block prints it: block_s and setup_s (rounded to microseconds), the
+        # children's peak (no child), the unread statistics (an iteration under a clock tick)
+        try:
+            self.parse(
+                block_s=0.0, setup_s=0.0, rss_children_bytes=0, min_s=0.0, p10_s=0
+            )
+        except RuntimeError as exc:
+            self.fail(f"a real 0 refused: {exc}")
+
+    def test_numbers_outside_their_domain_abort(self):
+        for change, why in (
+            ({"median_s": -0.001}, "median_s -0.001 is not positive"),
+            ({"median_s": 0}, "median_s 0 is not positive"),
+            ({"iterations": 0}, "iterations 0 is not positive"),
+            ({"rss_self_bytes": 0}, "rss_self_bytes 0 is not positive"),
+            ({"block_s": -0.5}, "block_s -0.5 is negative"),
+            ({"setup_s": -1e-06}, "setup_s -1e-06 is negative"),
+            ({"rss_children_bytes": -1}, "rss_children_bytes -1 is negative"),
+            ({"max_s": -1.0}, "max_s -1.0 is negative"),
+            ({"p90_s": "fast"}, "missing or mistyped p90_s"),
+            ({"iterations": 2.0}, "missing or mistyped iterations"),
+            ({"iterations": True}, "missing or mistyped iterations"),
+            ({"digest": 255}, "missing or mistyped digest"),
+            (
+                {"digest": "00000000000000FF"},
+                "digest '00000000000000FF' is not 16 lowercase hexadecimal digits",
+            ),
+            ({"digest": "ff"}, "digest 'ff' is not 16 lowercase hexadecimal digits"),
+            (
+                {"digest": "\ud800" * 16},
+                f"digest {chr(0xD800) * 16!r} is not 16 lowercase hexadecimal digits",
+            ),
+            ({"rss_children_bytes": None}, "missing or mistyped rss_children_bytes"),
+            # JSON integers have no bound: one beyond the largest float is not finite
+            (
+                {"rss_self_bytes": 10**400},
+                "rss_self_bytes is not finite (an integer of 401 digits)",
+            ),
+            ({"min_s": -(10**309)}, "min_s is not finite (an integer of 310 digits)"),
+        ):
+            with self.assertRaises(RuntimeError) as ctx:
+                self.parse(**change)
+            self.assertIn(
+                f"fake run r: malformed output line ({why}", str(ctx.exception)
+            )
+        # NaN and Infinity are JSON literals json.loads reads
+        for literal, why in (
+            ("NaN", "median_s nan is not finite"),
+            ("Infinity", "median_s inf is not finite"),
+            ("-Infinity", "median_s -inf is not finite"),
+        ):
+            line = json.dumps(self.LINE).replace(
+                '"median_s": 0.001', f'"median_s": {literal}'
+            )
+            with self.assertRaises(RuntimeError) as ctx:
+                aba.parse_block((line + "\n").encode(), "fake run r", "r")
+            self.assertIn(why, str(ctx.exception))
+
+    def test_keys_outside_the_rule_abort(self):
+        # A block line carries the keys of its rule only: any other aborts the run whatever its
+        # value (NaN; nested deeper than Python's writer goes), and no reason prints a nested
+        # value (Python 3.14's reader reads this nesting; older ones refuse it as too deep).
+        deep = "[" * 110000 + "]" * 110000
+        line = json.dumps(self.LINE)[:-1]
+        for extra, why in (
+            (', "x": 1}', "unknown key 'x'"),
+            (', "x": NaN}', "unknown key 'x'"),
+            (', "x": ' + deep + "}", "unknown key 'x'"),
+            (
+                ', "a": 1, "b": 2, "c": 3, "d": 4, "e": 5, "f": 6}',
+                "unknown keys 'a', 'b', 'c', 'd', 'e', ...",
+            ),
+            (', "' + "k" * 200 + '": 1}', "unknown key '" + "k" * 116 + "..."),
+        ):
+            with self.assertRaises(aba.ResponseError) as ctx:
+                aba.parse_block((line + extra + "\n").encode(), "fake run r", "r")
+            msg = str(ctx.exception)
+            ok = f"fake run r: malformed output line ({why}" in msg
+            self.assertTrue(ok or "JSON nested too deeply" in msg, msg)
+        # a nested value where the rule reads a number or the row: refused by its type
+        for key, why in (
+            ("median_s", "malformed output line (missing or mistyped median_s): "),
+            ("row", "the record names row an array, not 'r'"),
+        ):
+            text = json.dumps({**self.LINE, key: "@"}).replace('"@"', deep)
+            with self.assertRaises(aba.ResponseError) as ctx:
+                aba.parse_block((text + "\n").encode(), "fake run r", "r")
+            msg = str(ctx.exception)
+            self.assertTrue(why in msg or "JSON nested too deeply" in msg, msg)
+        self.assertIn('"median_s": "<an array>"', aba.shown({"median_s": [[1]]}))
+
+
+# The driver files build.sh compiles and records.
+DRIVER = ("aba_api.hpp", "aba_rows.hpp", "harness.cpp")
+
+
+def checkout_driver(perf: Path = HERE) -> dict[str, str]:
+    """The ``driver_sha256`` build.sh writes for the driver in ``perf`` (this checkout's)."""
+    return {
+        f"dev/perf/{n}": hashlib.sha256((perf / n).read_bytes()).hexdigest()
+        for n in DRIVER
+    }
+
+
+def fake_record(binary: Path, rev: str) -> dict:
+    """A build record as build.sh writes it for ``binary`` (every field, this checkout's
+    driver)."""
+    return {
+        "binary": str(binary),
+        "binary_sha256": hashlib.sha256(binary.read_bytes()).hexdigest(),
+        "rev": rev,
+        "commit": "0" * 40,
+        "dirty_core_paths": 0,
+        "core_sources_sha256": "0" * 64,
+        "driver_sha256": checkout_driver(),
+        "compiler": "fake clang version 1.0",
+        "flags": "-O3",
+        "compiler_path": "/usr/bin/clang++",
+        "cxx_env": None,
+        "isysroot": None,
+        "sdk": {
+            "path": None,
+            "version": None,
+            "sdkroot_env": None,
+            "source": "no xcrun SDK on this host: the compiler's own system headers",
+        },
+        "deployment_target": {
+            "requested": None,
+            "effective_minos": None,
+            "binary_sdk": None,
+            "platform": None,
+            "raw": None,
+            "source": "no LC_BUILD_VERSION read (no vtool, or it printed none)",
+        },
+        "built_by": "dev/perf/build.sh",
+    }
+
+
+class CreateOutputs(unittest.TestCase):
+    """``aba.create_outputs``, the last step before the first block: an operating-system error
+    or an interrupt there leaves nothing the run created (``meta.txt`` cut short by a full disk,
+    ``--out`` and the parents it made)."""
+
+    def test_nothing_left(self):
+        def partial(path, sides, lines):
+            Path(path).write_text("# aba.py provenance\n")
+            raise exc
+
+        saved = aba.write_meta
+        self.addCleanup(setattr, aba, "write_meta", saved)
+        aba.write_meta = partial
+        for exc, caught in (
+            (OSError(28, "No space left on device"), aba.Refused),
+            (KeyboardInterrupt(), KeyboardInterrupt),
+        ):
+            with tempfile.TemporaryDirectory() as tmp:
+                top = Path(tmp)
+                with self.assertRaises(caught) as ctx:
+                    aba.create_outputs(top / "a" / "out", [], [])
+                self.assertEqual(list(top.iterdir()), [], exc)
+                if caught is aba.Refused:
+                    self.assertIn("No space left on device", str(ctx.exception))
+                # an --out that existed, empty, stays and stays empty
+                (top / "kept").mkdir()
+                with self.assertRaises(caught):
+                    aba.create_outputs(top / "kept", [], [])
+                self.assertEqual(list((top / "kept").iterdir()), [], exc)
+
+
+class BlockLogs(unittest.TestCase):
+    """``aba.run_block``'s stderr log beside a log that earlier blocks of the same row, side
+    and mode filled: an abort names it only when this block wrote to it, and a log still empty
+    after a block is removed, also when the harness could not start or was interrupted."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name)
+        self.blocks = self.dir / "blocks"
+        self.log = self.blocks / "r.new.aba-run.stderr"
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def block(self, script: str) -> str:
+        """Run one block of a harness made of ``script``; the abort's message."""
+        path = self.dir / "harness"
+        path.write_text(f"#!/bin/sh\n{script}\n")
+        path.chmod(0o755)
+        side = aba.Side("B", "new", str(path), aba.sha256_file(path))
+        with self.assertRaises(RuntimeError) as ctx:
+            aba.run_block(side, "aba-run", "r", "1", clean_env(), self.blocks)
+        return str(ctx.exception)
+
+    def test_named_only_when_written(self):
+        self.blocks.mkdir()
+        self.log.write_text("an earlier block\n")
+        why = self.block("exit 3")
+        self.assertEqual(why, "new aba-run r exited 3 (nothing on stderr)")
+        self.assertEqual(self.log.read_text(), "an earlier block\n")
+        why = self.block("echo this block >&2; exit 3")
+        self.assertEqual(why, f"new aba-run r exited 3 (stderr: {self.log})")
+        self.assertEqual(self.log.read_text(), "an earlier block\nthis block\n")
+        why = self.block("echo this block again >&2; echo garbage")
+        self.assertIn(f"new aba-run r (stderr: {self.log}): ", why)
+        why = self.block("echo garbage")
+        self.assertIn("new aba-run r (nothing on stderr): ", why)
+        self.assertEqual(
+            self.log.read_text(), "an earlier block\nthis block\nthis block again\n"
+        )
+
+    def test_empty_log_removed(self):
+        self.assertEqual(
+            self.block("exit 3"), "new aba-run r exited 3 (nothing on stderr)"
+        )
+        self.assertEqual(os.listdir(self.blocks), [])
+        # a harness that cannot start (here a script without its interpreter)
+        path = self.dir / "harness"
+        path.write_text("#!/no/such/interpreter\n")
+        side = aba.Side("B", "new", str(path), aba.sha256_file(path))
+        with self.assertRaises(RuntimeError) as ctx:
+            aba.run_block(side, "aba-run", "r", "1", clean_env(), self.blocks)
+        self.assertIn("new aba-run r: cannot start", str(ctx.exception))
+        self.assertEqual(os.listdir(self.blocks), [])
+        # an interrupt while the harness runs
+        saved = os.wait4
+        self.addCleanup(setattr, os, "wait4", saved)
+
+        def interrupted(*args):
+            raise KeyboardInterrupt
+
+        os.wait4 = interrupted
+        path.write_text("#!/bin/sh\nexec sleep 30 >&-\n")  # stdout at its end at once
+        side = aba.Side("B", "new", str(path), aba.sha256_file(path))
+        with self.assertRaises(KeyboardInterrupt):
+            aba.run_block(side, "aba-run", "r", "1", clean_env(), self.blocks)
+        os.wait4 = saved
+        self.assertEqual(os.listdir(self.blocks), [])
+
+
+class InterruptsOnce(unittest.TestCase):
+    """``aba.interrupts_once``, the run's SIGINT handler: the first interrupt raises
+    KeyboardInterrupt, every later one, and every one after ``hold``, is only recorded, and the
+    previous handler comes back."""
+
+    def test_first_raises_the_others_are_recorded(self):
+        before = signal.getsignal(signal.SIGINT)
+        with aba.interrupts_once() as interrupts:
+            with self.assertRaises(KeyboardInterrupt):
+                signal.raise_signal(signal.SIGINT)
+            signal.raise_signal(signal.SIGINT)
+            signal.raise_signal(signal.SIGINT)
+            self.assertEqual(interrupts, [signal.SIGINT] * 3)
+        self.assertIs(signal.getsignal(signal.SIGINT), before)
+        with aba.interrupts_once() as interrupts:
+            interrupts.hold()
+            signal.raise_signal(signal.SIGINT)
+            self.assertEqual(interrupts, [signal.SIGINT])
+        self.assertIs(signal.getsignal(signal.SIGINT), before)
+        # the previous handler comes back after an exception too
+        with self.assertRaises(KeyboardInterrupt), aba.interrupts_once():
+            signal.raise_signal(signal.SIGINT)
+        self.assertIs(signal.getsignal(signal.SIGINT), before)
+
+
+class SourceHashes(unittest.TestCase):
+    """``aba.source_hashes``: the hash of every orchestrator and driver source, refused when the
+    tool's directory is not printable text or a source cannot be read."""
+
+    def test_refusals(self):
+        saved = aba.HERE
+        self.addCleanup(setattr, aba, "HERE", saved)
+        self.assertEqual(
+            aba.source_hashes(),
+            {
+                n: hashlib.sha256((HERE / n).read_bytes()).hexdigest()
+                for n in aba.SOURCE_FILES
+            },
+        )
+        with tempfile.TemporaryDirectory() as tmp:
+            for name in aba.SOURCE_FILES:
+                shutil.copy(HERE / name, Path(tmp) / name)
+            aba.HERE = Path(tmp) / "a\tb"
+            with self.assertRaises(aba.Refused) as ctx:
+                aba.source_hashes()
+            self.assertIn(
+                "a\\tb': a path with a character that is not", str(ctx.exception)
+            )
+            aba.HERE = Path(tmp)
+            self.assertEqual(set(aba.source_hashes()), set(aba.SOURCE_FILES))
+            (Path(tmp) / "aba_rows.hpp").unlink()
+            with self.assertRaises(aba.Refused) as ctx:
+                aba.source_hashes()
+            self.assertIn("the tool's sources: ", str(ctx.exception))
+            self.assertIn("aba_rows.hpp", str(ctx.exception))
+
+
+# A fake harness: rows of two groups, the candidate twice as fast, special rows for every rule.
+# Every call appends "side mode row argument pid" to DIR/events.log, and a block's environment
+# and working directory as one JSON line to DIR/env.log (a block line carries only the keys of
+# its rule); FAKE_STDERR names a side whose blocks write one line to stderr.
+FAKE = r"""#!{py}
+import json, os, shutil, signal, sys, time
+SIDE = {side!r}
+ROWS = ["n.fast", "n.digest", "n.drift", "n.bimodal", "n.rss", "n.short", "n.tamper",
+        "n.cross_tamper", "n.end_tamper", "n.late_a1", "n.late_b", "n.late_a2", "n.garbled",
+        "n.negative", "n.other", "n.warmfail", "n.crash", "n.fewer", "n.vanish", "n.noexec",
+        "n.wander", "n.noisy", "n.tinyrss", "n.huge", "n.hugewarm", "n.longplan", "n.rsswarm",
+        "n.intwarm", "n.sigint_warm", "n.sigint", "n.rmlogs", "n.lockout", "n.lockreport",
+        "n.extra", "n.nan", "n.deep", "o.ok", "o.big", "o.warm"]
+mode, row = sys.argv[1], (sys.argv[2] if len(sys.argv) > 2 else None)
+me = os.path.realpath(__file__)
+top = os.path.dirname(os.path.dirname(me))
+if mode == "aba-list":
+    listing = [json.dumps({{"row": name, "group": name.split(".")[0]}}) for name in ROWS]
+    broken = os.environ.get("FAKE_LIST")  # a broken list on request
+    if broken == "junk":
+        listing.insert(0, "a line that is no row record")
+    if broken == "twice":
+        listing.append(listing[0])
+    if broken == "nogroup":
+        listing.append(json.dumps({{"row": "n.extra"}}))
+    if broken == "slash":
+        listing.append(json.dumps({{"row": "n/extra", "group": "n"}}))
+    if broken == "unknown" and SIDE == "new":  # a key no rule lists
+        listing.append(json.dumps({{"row": "n.extra", "group": "n", "x": 1}}))
+    if broken == "deepdesc" and SIDE == "new":  # a description nested 110,000 deep
+        listing.append('{{"row": "n.extra", "group": "n", "desc": ' + "[" * 110000 + "]" * 110000 + "}}")
+    if broken == "extra" and SIDE == "new":  # a row the reference does not list
+        listing.append(json.dumps({{"row": "n.list_extra", "group": "n"}}))
+    if broken == "fail":
+        sys.exit(5)
+    if broken == "sigint" and SIDE == "new":  # Ctrl-C before the first block
+        os.kill(os.getppid(), signal.SIGINT)
+        time.sleep(30)
+    print("\n".join(listing))
+    sys.exit(0)
+with open(os.path.join(top, "events.log"), "a") as f:
+    f.write(f"{{SIDE}} {{mode}} {{row}} {{sys.argv[3]}} {{os.getpid()}}\n")
+with open(os.path.join(top, "env.log"), "a") as f:
+    f.write(json.dumps({{
+        "side": SIDE, "mode": mode, "row": row,
+        "core": {{k: v for k, v in os.environ.items() if k.startswith("NGRAPH_CORE_")}},
+        "pythonpath": os.environ.get("PYTHONPATH"), "pythonhome": os.environ.get("PYTHONHOME"),
+        "malloc": os.environ.get("MallocLargeCache"), "cwd": os.getcwd()}}) + "\n")
+if os.environ.get("FAKE_STDERR") == SIDE:  # one stderr line in every block of that side
+    print(f"{{SIDE}} {{mode}} {{row}}: a message", file=sys.stderr)
+# Ctrl-C during the candidate's warm-up block or its first timed block: SIGINT to aba.py, then
+# a block that would last 30 s unless aba.py stops it.
+if SIDE == "new" and (row, mode) in (("n.sigint_warm", "aba-calibrate"), ("n.sigint", "aba-run")):
+    os.kill(os.getppid(), signal.SIGINT)
+    time.sleep(30)
+iters = 2000 if mode == "aba-calibrate" else int(sys.argv[3])
+t = 0.0005 if SIDE == "new" else 0.001
+digest = "00000000000000bb" if row == "n.digest" and SIDE == "new" else "00000000000000aa"
+n = 0
+if mode == "aba-run":
+    counter = os.path.join(top, f"n-{{SIDE}}-{{row}}")
+    n = int(open(counter).read()) if os.path.exists(counter) else 0
+    open(counter, "w").write(str(n + 1))
+    if row == "n.drift" and SIDE == "old":
+        t = 0.001 * (1.10 if n % 2 else 1.0)  # A1 and A2 apart by 10 %
+    if row == "n.bimodal" and SIDE == "new":
+        t = 0.00060 if n in (1, 4) else 0.00050  # B split 5/2 at a 20 % gap
+    if row == "n.wander" and SIDE == "old":
+        # A drifts 2 % per triple and A2 is 4 % above A1: drift above 3 %, no cluster
+        t = 0.001 * (1 + 0.02 * (n // 2)) * (1.04 if n % 2 else 1.0)
+    if row == "n.noisy" and SIDE == "new":
+        t = 0.0005 * (1 + 0.02 * n)  # a different ratio in every triple
+    # A digest change only in triple 5 of 7: the reference runs A1 then A2 of triple k as its
+    # calls 2k and 2k + 1, the candidate runs B of triple k as its call k.
+    if (row, SIDE, n) in (("n.late_a1", "old", 8), ("n.late_a2", "old", 9), ("n.late_b", "new", 4)):
+        digest = "00000000000000cc"
+mib = 2**20
+rss = 40 * mib  # above the fake process's own peak, so os.wait4 does not mask it
+if row in ("n.rss", "o.big") and SIDE == "new":
+    rss = 60 * mib
+if row == "o.warm" and mode == "aba-calibrate" and SIDE == "old":
+    rss = 500 * mib  # a warm-up peak: must not raise the reference
+if row == "o.warm" and SIDE == "new" and mode == "aba-run":
+    rss = 49 * mib  # over 40 + 8 MiB: fails unless the warm-up peak counted
+if row == "n.tinyrss":
+    rss = 1  # below the process's real peak: os.wait4's reading is the larger
+rec = {{"row": row, "iterations": iters, "median_s": t,
+       "mean_s": t, "min_s": t, "max_s": t, "setup_s": 0.0,
+       "block_s": (0.5 if row == "n.short" and mode == "aba-run" else iters * t),
+       "digest": digest, "rss_self_bytes": rss, "rss_children_bytes": 0}}
+# Finite numbers whose derived values are not: medians near 1e308 in the timed blocks (the
+# mean of A1 and A2 overflows), a warm-up median that makes the expected duration overflow or
+# end beyond any date, and warm-up peaks whose sum overflows.
+if row == "n.huge" and mode == "aba-run":
+    rec.update(median_s=1.5e308 if SIDE == "new" else 1e308, block_s=2.5)
+if row == "n.hugewarm" and mode == "aba-calibrate":
+    rec.update(median_s=1e308, block_s=2.5)
+if row == "n.longplan" and mode == "aba-calibrate":
+    rec.update(median_s=1e15, block_s=2.5)
+if row == "n.rsswarm" and mode == "aba-calibrate":
+    rec.update(rss_self_bytes=1.7e308, rss_children_bytes=1.7e308)
+if row == "n.intwarm" and mode == "aba-calibrate":
+    rec.update(median_s=10**300, block_s=2.5)  # an integer: times a pinned count, above any float
+if mode == "aba-run":
+    # A binary changed or lost: by itself during a block, by the reference before the
+    # candidate's first block or during the last block of the run; removed; made unexecutable.
+    if row == "n.tamper" and SIDE == "new" or row == "n.cross_tamper" and SIDE == "old" and n == 0:
+        with open(os.path.join(top, "new", "fake-new"), "a") as f:
+            f.write("# rebuilt during the run\n")
+    if row == "n.end_tamper" and SIDE == "old" and n == 13:
+        with open(os.path.join(top, "new", "fake-new"), "a") as f:
+            f.write("# rebuilt during the run\n")
+    if row == "n.vanish" and SIDE == "new":
+        os.remove(me)
+    if row == "n.noexec" and SIDE == "new":
+        os.chmod(me, 0o644)
+    if row == "n.fewer" and SIDE == "new":
+        rec["iterations"] = iters - 1
+    # An operating-system error in aba.py after the first block: the logs' directory removed,
+    # the output directory made read-only, or report.json (FAKE_OUT names the directory).
+    if row == "n.rmlogs" and SIDE == "new":
+        shutil.rmtree(os.path.join(os.environ["FAKE_OUT"], "blocks"))
+    if row == "n.lockout" and SIDE == "new":
+        os.chmod(os.environ["FAKE_OUT"], 0o555)
+    if row == "n.lockreport" and SIDE == "new":
+        os.chmod(os.path.join(os.environ["FAKE_OUT"], "report.json"), 0o444)
+if (os.environ.get("FAKE_CHANGE_SIDE") == SIDE and
+        os.environ.get("FAKE_CHANGE_MODE") == mode):
+    rec.update(json.loads(os.environ["FAKE_CHANGE"]))
+line = json.dumps(rec)
+if SIDE == "new" and row == "n.warmfail" and mode == "aba-calibrate":
+    print("not a block line")  # the warm-up block's response is broken
+    sys.exit(0)
+# A key no rule lists: a plain one in the candidate's timed block; NaN in the reference's
+# warm-up block (written to report.json as nonstandard JSON when it was copied there); one
+# nested 110,000 deep in the candidate's timed block (read by Python 3.14's JSON reader, which
+# its writer cannot write back, so copying it crashed the run without outputs; older readers
+# refuse it as nested too deeply).
+if row == "n.extra" and SIDE == "new" and mode == "aba-run":
+    line = line[:-1] + ', "x": 1}}'
+if row == "n.nan" and SIDE == "old" and mode == "aba-calibrate":
+    line = line[:-1] + ', "x": NaN}}'
+if row == "n.deep" and SIDE == "new" and mode == "aba-run":
+    line = line[:-1] + ', "x": ' + "[" * 110000 + "]" * 110000 + "}}"
+if SIDE == "new" and mode == "aba-run":
+    if row == "n.crash":
+        sys.exit(3)  # a harness that fails
+    if row == "n.garbled":
+        line = '{{"row": "n.garbled", "median_s": 0.0005,'  # a truncated line
+    if row == "n.negative":
+        line = json.dumps({{**rec, "median_s": -t}})
+    if row == "n.other":
+        line = json.dumps({{**rec, "row": "n.fast"}})  # another row's record
+print(line)
+"""
+
+# A fake ps, first on PATH: aba.py runs ps for the machine state at the start of a run and at its
+# end. At its second call, while the final outputs are written, it sends SIGINT to aba.py TIMES
+# times. Each call appends "x" to CALLS.
+FAKE_PS = r"""#!{py}
+import os, signal
+with open({calls!r}, "a+") as f:
+    f.seek(0)
+    n = len(f.read())
+    f.write("x")
+if n == 1:
+    for _ in range({times}):
+        os.kill(os.getppid(), signal.SIGINT)
+print(" 1.0 /usr/bin/fake")
+"""
+
+# Variables removed from the tests' own environment so a developer's shell cannot change a
+# result (a test sets what it needs): the allocator variables aba.py records, PYTHONPATH and
+# PYTHONHOME, which reach the Python of aba.py and of the fake harnesses, and NGRAPH_CORE_*, which
+# the fake harness reports.
+SPECIAL = ("PYTHONPATH", "PYTHONHOME", "NGRAPH_CORE_", *aba.ALLOCATOR_PREFIXES)
+
+
+def clean_env(**extra: str) -> dict[str, str]:
+    env = {
+        k: v
+        for k, v in os.environ.items()
+        if not k.startswith(SPECIAL) and k not in aba.ALLOCATOR_NAMES
+    }
+    env.update(extra)
+    return env
+
+
+# n.intwarm's warm-up median (an integer near 1e300) times the largest count overflows a float.
+INTWARM_PIN = ("--iters", f"n.intwarm={aba.MAX_COUNT}")
+
+
+def strict_json(text: str):
+    """Standard JSON only: Python's reader would also accept NaN and the infinities."""
+
+    def refuse(literal: str):
+        raise ValueError(f"{literal} is not standard JSON")
+
+    return json.loads(text, parse_constant=refuse)
+
+
+def report_of(out: Path) -> dict:
+    """``out``'s report.json, read as standard JSON."""
+    return strict_json((out / "report.json").read_text())
+
+
+def by_row(rep: dict) -> dict[str, dict]:
+    return {r["row"]: r for r in rep["rows"]}
+
+
+def blocks_of(rec: dict) -> list[dict]:
+    return [t[k] for t in rec["triples"] for k in ("A1", "B", "A2")]
+
+
+class Driver(unittest.TestCase):
+    """aba.py end to end with two fake harnesses (a few hundred short processes)."""
+
+    QUICK = ("--resamples", "200")
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name).resolve()
+        self.fakes()
+
+    def fakes(self):
+        """Both fake harnesses and their build records, written afresh."""
+        for side in ("old", "new"):
+            path = self.dir / side / f"fake-{side}"
+            path.parent.mkdir(exist_ok=True)
+            path.write_text(FAKE.format(py=sys.executable, side=side))
+            path.chmod(0o755)
+            # the build record build.sh writes beside a harness (the report's side info), built
+            # from this checkout's driver
+            path.with_name(path.name + ".json").write_text(
+                json.dumps(fake_record(path, side))
+            )
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def aba(self, *args: str, env: dict[str, str] | None = None, script: Path = ABA):
+        return subprocess.run(
+            [sys.executable, "-B", str(script), *args],
+            capture_output=True,
+            text=True,
+            env=clean_env(**(env or {})),
+            timeout=600,
+        )
+
+    def sides(self) -> tuple[str, ...]:
+        return (
+            "--old-bin",
+            str(self.dir / "old" / "fake-old"),
+            "--new-bin",
+            str(self.dir / "new" / "fake-new"),
+        )
+
+    def run_aba(self, out: str, *extra: str, env: dict[str, str] | None = None):
+        sides = () if "--old-bin" in extra else self.sides()
+        proc = self.aba(*sides, "--out", str(self.dir / out), *extra, env=env)
+        path = self.dir / out / "report.json"
+        return proc, (report_of(path.parent) if path.exists() else None)
+
+    def summary(self, out: str) -> list[str]:
+        return (self.dir / out / "summary.md").read_text().splitlines()
+
+    def events(self, row: str) -> list[list[str]]:
+        return [
+            ln.split()
+            for ln in (self.dir / "events.log").read_text().splitlines()
+            if ln.split()[2] == row
+        ]
+
+    def envs(self, row: str) -> list[dict]:
+        """The environment and working directory each block of ``row`` reported (env.log)."""
+        lines = (self.dir / "env.log").read_text().splitlines()
+        return [rec for rec in map(json.loads, lines) if rec["row"] == row]
+
+    def blocks_run(self) -> int:
+        log = self.dir / "events.log"
+        return len(log.read_text().splitlines()) if log.exists() else 0
+
+    def refused(self, out: str, *args: str, env: dict[str, str] | None = None) -> str:
+        """Run aba.py; it must refuse before any block (exit 2, no traceback,
+        no harness block run) and return its stderr. Both files carry the reason."""
+        before = self.blocks_run()
+        proc, rep = self.run_aba(out, *args, env=env)
+        self.assertEqual(proc.returncode, 2, (args, proc.stderr[-500:]))
+        self.assertNotIn("Traceback", proc.stderr)
+        self.assertIsNotNone(rep, args)
+        self.assertEqual((rep["verdict"], rep["conforming"]), ("aborted", False), args)
+        self.assertIn(rep["aborted"], proc.stderr)
+        self.assertIn(rep["aborted"], (self.dir / out / "summary.md").read_text())
+        self.assertEqual(self.blocks_run(), before, args)
+        shutil.rmtree(self.dir / out)
+        return proc.stderr
+
+    def aborted(self, out: str, *args: str, env: dict[str, str] | None = None) -> dict:
+        """Run aba.py; it must abort (exit 1, no traceback, verdict aborted, not conforming,
+        the reason in the summary) and return the report."""
+        proc, rep = self.run_aba(out, *args, *self.QUICK, env=env)
+        self.assertEqual(proc.returncode, 1, (args, proc.stderr[-500:]))
+        self.assertNotIn("Traceback", proc.stderr)
+        self.assertEqual(rep["verdict"], "aborted", args)
+        self.assertIs(rep["conforming"], False, args)
+        summary = self.summary(out)
+        self.assertIn("overall verdict **aborted**", summary[3])
+        self.assertIn(f"* **aborted**: {rep['aborted']}", summary)
+        self.assertIn(f"aborted: {rep['aborted']}", proc.stderr)
+        return rep
+
+    def test_clean_run(self):
+        proc, rep = self.run_aba("same", "--rows", " n.fast , o.ok ")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(proc.stderr, "")
+        fast = by_row(rep)["n.fast"]
+        self.assertEqual(rep["verdict"], "pass")
+        self.assertIs(rep["conforming"], True)
+        self.assertEqual(rep["selection"]["selected"], ["n.fast", "o.ok"])
+        self.assertEqual(rep["protocol"]["bootstrap_resamples"], 10000)
+        self.assertEqual(len(fast["triples"]), 7)
+        # The candidate is twice as fast: per-side counts ceil(2 s * 1.10 / median),
+        # statistic -50 %.
+        self.assertEqual((fast["iterations_a"], fast["iterations_b"]), (2200, 4400))
+        self.assertEqual(fast["iterations_source"], "calibrated per side")
+        self.assertEqual(
+            [b["iterations"] for b in blocks_of(fast)], [2200, 4400, 2200] * 7
+        )
+        self.assertAlmostEqual(fast["statistic"], -0.5)
+        self.assertEqual(fast["digest_verdict"], "pass")
+        for blk in [*fast["warmup"].values(), *blocks_of(fast)]:
+            for key in ("load1_before", "load1_after"):
+                self.assertTrue(math.isfinite(blk[key]) and blk[key] >= 0, blk)
+        for when in ("state_at_start", "state_at_end"):
+            load = rep["machine"][when]["load"]
+            self.assertEqual(len(load), 3)
+            self.assertTrue(all(math.isfinite(x) and x >= 0 for x in load))
+        # meta.txt: both binaries and every source, as the report records them
+        meta = (self.dir / "same" / "meta.txt").read_text().splitlines()
+        want = {
+            "A/binary/harness": hashlib.sha256(
+                (self.dir / "old" / "fake-old").read_bytes()
+            ).hexdigest(),
+            "B/binary/harness": hashlib.sha256(
+                (self.dir / "new" / "fake-new").read_bytes()
+            ).hexdigest(),
+            **{
+                f"run/source/{n}": hashlib.sha256((HERE / n).read_bytes()).hexdigest()
+                for n in aba.SOURCE_FILES
+            },
+        }
+        self.assertEqual(rep["meta"], want)
+        self.assertEqual(aba.read_meta(self.dir / "same" / "meta.txt"), want)
+        self.assertIn("label\tA\told", meta)
+        self.assertEqual(rep["sides"]["B"]["build_record"]["rev"], "new")
+        summary = self.summary("same")
+        # the summary's first lines: the conformance, then the verdict
+        self.assertEqual(
+            summary[2],
+            "* **conforming run** (the protocol's evidence: "
+            "accepted when the overall verdict is pass)",
+        )
+        self.assertIn("overall verdict **pass**", summary[3])
+        self.assertIn("| n.fast | 2200 / 4400 |", "\n".join(summary))
+        # blocks.csv: every block, warm-ups first
+        csv_lines = (self.dir / "same" / "blocks.csv").read_text().splitlines()
+        self.assertEqual(csv_lines[0].split(","), list(aba.CSV_FIELDS))
+        self.assertEqual(len(csv_lines), 1 + 2 * (2 + 21))
+        self.assertTrue(csv_lines[1].startswith("n.fast,W-A,,old,2000,,"))
+        self.assertTrue(csv_lines[3].startswith("n.fast,A1,1,old,2200,2200,"))
+
+    def test_block_order_counts_and_fresh_processes(self):
+        proc, rep = self.run_aba("order", "--rows", "o.ok,n.fast", *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        log = [ln.split() for ln in (self.dir / "events.log").read_text().splitlines()]
+        # the warm-up blocks of every selected row first, one per side, given the target
+        self.assertEqual(
+            [e[:4] for e in log[:4]],
+            [
+                ["old", "aba-calibrate", "n.fast", "2.0"],
+                ["new", "aba-calibrate", "n.fast", "2.0"],
+                ["old", "aba-calibrate", "o.ok", "2.0"],
+                ["new", "aba-calibrate", "o.ok", "2.0"],
+            ],
+        )
+        # then row by row seven reference/candidate/reference repetitions with their counts
+        want = [
+            [side, "aba-run", row, count]
+            for row in ("n.fast", "o.ok")
+            for _ in range(7)
+            for side, count in (("old", "2200"), ("new", "4400"), ("old", "2200"))
+        ]
+        self.assertEqual([e[:4] for e in log[4:]], want)
+        pids = [e[4] for e in log]
+        self.assertEqual(len(set(pids)), len(pids))  # a fresh process per block
+        # each slot holds its side's answer (the reference's median 1 ms, the candidate's 0.5 ms)
+        slots = [
+            (s, t[s]["side"], t[s]["median_s"])
+            for t in by_row(rep)["o.ok"]["triples"]
+            for s in ("A1", "B", "A2")
+        ]
+        self.assertEqual(
+            slots,
+            [("A1", "old", 0.001), ("B", "new", 0.0005), ("A2", "old", 0.001)] * 7,
+        )
+        # the plan, printed before the first timed block, with each row's expected duration
+        plan_at = proc.stdout.index("plan (from the warm-up blocks")
+        self.assertLess(plan_at, proc.stdout.index("n.fast: pass"))
+        self.assertEqual(rep["plan"]["rows"], 2)
+        for rec in rep["rows"]:
+            wa, wb = rec["warmup"]["A"], rec["warmup"]["B"]
+            blk_a = 2200 * 0.001 + max(0.0, wa["wall_s"] - wa["block_s"])
+            blk_b = 4400 * 0.0005 + max(0.0, wb["wall_s"] - wb["block_s"])
+            self.assertAlmostEqual(rec["expected"]["row_s"], 7 * (2 * blk_a + blk_b))
+        self.assertAlmostEqual(
+            rep["plan"]["expected_s"], sum(r["expected"]["row_s"] for r in rep["rows"])
+        )
+
+    def test_options_take_effect(self):
+        # counts calibrated with the margin; 0 accepted where the domain allows it
+        proc, rep = self.run_aba(
+            "zero",
+            "--rows",
+            "n.fast,n.drift,n.rss",
+            "--calibration-margin",
+            "0",
+            "--tolerance",
+            "0.2",
+            "--rss-floor-mib",
+            "0",
+            "--budget",
+            "1.6",
+            "--seed",
+            "-5",
+            *self.QUICK,
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        res = by_row(rep)
+        self.assertEqual(
+            (res["n.fast"]["iterations_a"], res["n.fast"]["iterations_b"]), (2000, 4000)
+        )
+        self.assertEqual(res["n.drift"]["time_verdict"], "pass")  # drift 9 % <= 20 %
+        self.assertEqual(res["n.rss"]["rss_verdict"], "pass")  # 60 <= 1.6 x 40 MiB
+        self.assertEqual(res["n.rss"]["rss_allowance_bytes"], 64 * MIB)
+        # a tolerance of 0: equal blocks are no drift and no cluster
+        proc, rep = self.run_aba(
+            "tolerance0", "--rows", "n.fast", "--tolerance", "0", *self.QUICK
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["protocol"]["tolerance"], 0.0)
+        self.assertEqual(by_row(rep)["n.fast"]["time_verdict"], "pass")
+        # the floor alone: 40 + 30 MiB covers 60 MiB
+        proc, rep = self.run_aba(
+            "floor", "--rows", "n.rss", "--rss-floor-mib", "30", *self.QUICK
+        )
+        self.assertEqual(by_row(rep)["n.rss"]["rss_allowance_bytes"], 70 * MIB)
+        # --seed and --resamples reach the bootstrap; --triples and --target-seconds the blocks
+        proc, rep = self.run_aba(
+            "seed",
+            "--rows",
+            "n.noisy,n.short",
+            "--seed",
+            "7",
+            "--resamples",
+            "5",
+            "--triples",
+            "5",
+            "--target-seconds",
+            "0.4",
+            "--allow-short",
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        rec = by_row(rep)["n.noisy"]
+        self.assertEqual(len(rec["triples"]), 5)
+        x = [r - 1 for r in rec["ratios"]]
+        self.assertEqual(rec["ci95"], list(aba.bootstrap_interval(x, 5, 7)))
+        # (the interval depends on both: the default seed or count gives another one)
+        self.assertNotEqual(rec["ci95"], list(aba.bootstrap_interval(x, 5, 20261003)))
+        self.assertNotEqual(rec["ci95"], list(aba.bootstrap_interval(x, 10000, 7)))
+        short = by_row(rep)["n.short"]
+        self.assertEqual(short["block_verdict"], "pass")  # 0.5 s >= 0.4 s
+        self.assertEqual(rec["iterations_a"], math.ceil(0.4 * 1.1 / 0.001))
+        warmups = [e[:4] for e in self.events("n.noisy")[:2]]
+        self.assertEqual(
+            warmups, [[s, "aba-calibrate", "n.noisy", "0.4"] for s in ("old", "new")]
+        )
+
+    def test_iters_pin_takes_effect(self):
+        proc, rep = self.run_aba(
+            "pin", "--rows", "o.ok,n.fast", "--iters", "o.ok=3:5,n.fast=4", *self.QUICK
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        for name, want in (("o.ok", [3, 5, 3]), ("n.fast", [4, 4, 4])):
+            rec = by_row(rep)[name]
+            self.assertEqual(rec["iterations_source"], "pinned")
+            self.assertEqual(
+                (rec["iterations_a"], rec["iterations_b"]), tuple(want[:2])
+            )
+            self.assertEqual([b["iterations"] for b in blocks_of(rec)], want * 7)
+            self.assertEqual(
+                [e[3] for e in self.events(name)[2:]], [str(c) for c in want] * 7
+            )
+
+    def test_option_domains(self):
+        for repeated in (
+            ("--triples", "7", "--triples", "8"),
+            ("--seed=1", "--seed=2"),
+            ("--allow-short", "--allow-short"),
+        ):
+            self.assertIn(
+                "given more than once",
+                self.refused("repeated", "--rows", "o.ok", *repeated),
+            )
+        self.assertIn(
+            "unrecognized arguments",
+            self.refused("prefix", "--rows", "o.ok", "--target", "2"),
+        )
+        for option, value, why in (
+            ("--triples", "0", "value 0 is not positive"),
+            ("--triples", "2.5", "invalid parse value: '2.5'"),
+            ("--tolerance", "nan", "value nan is not finite"),
+            ("--tolerance", "-0.1", "value -0.1 is negative"),
+            ("--budget", "0", "value 0.0 is not positive"),
+            ("--rss-floor-mib", "-1", "value -1.0 is negative"),
+            ("--target-seconds", "-2", "value -2.0 is not positive"),
+            ("--target-seconds", "inf", "value inf is not finite"),
+            ("--calibration-margin", "-0.5", "value -0.5 is negative"),
+            ("--resamples", "0", "value 0 is not positive"),
+            ("--seed", "x", "invalid parse value: 'x'"),
+            ("--triples", "9" * 400, "value is not finite (an integer of 400 digits)"),
+        ):
+            stderr = self.refused("option", "--rows", "o.ok", option, value)
+            self.assertIn(f"argument {option}: {why}", stderr)
+        # the values derived from them must be finite
+        for option, value, why in (
+            (
+                "--target-seconds",
+                "1.7e308",
+                "--target-seconds * (1 + --calibration-margin) is inf, not finite",
+            ),
+            ("--rss-floor-mib", "1e303", "--rss-floor-mib in bytes is inf, not finite"),
+        ):
+            self.assertIn(why, self.refused("derived", "--rows", "o.ok", option, value))
+        # below the protocol only with --allow-short
+        for args in (("--triples", "3"), ("--target-seconds", "1")):
+            stderr = self.refused("short", "--rows", "o.ok", *args)
+            self.assertIn("below the protocol", stderr)
+            self.assertIn("--allow-short", stderr)
+
+    def test_rows_glob_characters_are_accepted(self):
+        # main's character check passes '?', '[', ']' and '!' on to the row selection
+        globs = ["?.ok", "[on].ok", "[!n].ok"]
+        proc, rep = self.run_aba("globs", "--rows", ",".join(globs), *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["selection"]["selected"], ["o.ok"])
+        self.assertEqual(
+            [(g["glob"], g["matched"]) for g in rep["selection"]["globs"]],
+            [(g, ["o.ok"]) for g in globs],
+        )
+
+    def test_input_rules(self):
+        o_ok = ("--rows", "o.ok", *self.QUICK)
+        # --rows
+        stderr = self.refused("nomatch", "--rows", "o.ok,placement.*")
+        self.assertIn("'placement.*' matches no row or group", stderr)
+        self.assertIn("o (3): o.ok, o.big, o.warm", stderr)
+        self.assertIn("names no glob", self.refused("noglob", "--rows", ","))
+        for rows in ("O.OK", "o.ok;x", "o/ok", "o.ok\t", "o.\u00e9"):
+            why = self.refused("rowtext", "--rows", rows)
+            self.assertIn(f"--rows {rows!r}: only the characters of row names", why)
+        # --iters: every item row=N or row=NA:NB, naming a selected row, once
+        for iters, why in (
+            ("o.ok", "--iters item 'o.ok' is not row=N or row=NA:NB"),
+            ("=5", "--iters item '=5' is not row=N or row=NA:NB"),
+            ("o.big=5", "--iters row 'o.big' is not a selected row"),
+            ("o.ok=5,o.ok=6", "--iters row 'o.ok' given twice"),
+            ("o.ok=5:", "iteration count '5:' is not N or NA:NB"),
+            ("o.ok=0:5", "iteration count '0:5' below 1"),
+            (f"o.ok=5:{2**63}", f"iteration count '5:{2**63}' above {2**63 - 1}"),
+        ):
+            self.assertIn(why, self.refused("iters", *o_ok, "--iters", iters))
+        # the build record: a JSON object whose binary_sha256 is the binary's (each refusal
+        # names the side)
+        record = self.dir / "new" / "fake-new.json"
+        for text, why in (
+            ("{}", "a build record without binary_sha256"),
+            ("[]", "a build record without binary_sha256"),
+            ("{not json", "not a readable JSON build record"),
+            # deeper than Python's reader goes (it raises RecursionError)
+            ('{"a":' * 10**6 + "1" + "}" * 10**6, "JSON nested too deeply"),
+        ):
+            record.write_text(text)
+            self.assertIn(why, self.refused("record", *o_ok))
+        record.write_text(json.dumps({"binary_sha256": "0" * 64}))
+        self.assertIn("differs from its build record", self.refused("record", *o_ok))
+        # and exactly build.sh's record: its keys only, all of them, each of its type
+        full = fake_record(self.dir / "new" / "fake-new", "new")
+        sdk, target = full["sdk"], full["deployment_target"]
+        for name, rec, why in (
+            ("unknown key", {**full, "x": 1}, "unknown key 'x'"),
+            ("unknown keys", {**full, "x": 1, "y": 2}, "unknown keys 'x', 'y'"),
+            ("no key", {k: v for k, v in full.items() if k != "flags"}, "no flags"),
+            (
+                "no driver",
+                {k: v for k, v in full.items() if k != "driver_sha256"},
+                "no driver_sha256",
+            ),
+            (
+                "text null",
+                {**full, "compiler": None},
+                "compiler is None, of another type",
+            ),
+            ("text number", {**full, "rev": 7}, "rev is 7, of another type"),
+            (
+                "count text",
+                {**full, "dirty_core_paths": "2"},
+                "dirty_core_paths is '2', of another type",
+            ),
+            (
+                "count bool",
+                {**full, "dirty_core_paths": True},
+                "dirty_core_paths is True, of another type",
+            ),
+            (
+                "count negative",
+                {**full, "dirty_core_paths": -1},
+                "dirty_core_paths -1 is negative",
+            ),
+            (
+                "count huge",
+                {**full, "dirty_core_paths": 10**400},
+                "dirty_core_paths is not finite (an integer of 401 digits)",
+            ),
+            (
+                "not sha",
+                {**full, "core_sources_sha256": "x"},
+                "core_sources_sha256 'x' is not a sha256",
+            ),
+            (
+                "driver null",
+                {**full, "driver_sha256": None},
+                "driver_sha256 is None, of another type",
+            ),
+            (
+                "driver list",
+                {**full, "driver_sha256": []},
+                "driver_sha256 is an array, of another type",
+            ),
+            ("map text", {**full, "sdk": "x"}, "sdk is 'x', not an object"),
+            (
+                "map unknown",
+                {**full, "sdk": {**sdk, "y": None}},
+                "unknown key 'y' in sdk",
+            ),
+            (
+                "map no key",
+                {
+                    **full,
+                    "deployment_target": {
+                        k: v for k, v in target.items() if k != "raw"
+                    },
+                },
+                "no deployment_target.raw",
+            ),
+            (
+                "map type",
+                {**full, "sdk": {**sdk, "source": None}},
+                "sdk.source is None, of another type",
+            ),
+            (
+                "map nested",
+                {**full, "sdk": {**sdk, "path": [["x"]]}},
+                "sdk.path is an array, of another type",
+            ),
+        ):
+            record.write_text(json.dumps(rec))
+            why = f"new: {record}: not a build record as build.sh writes it ({why}"
+            self.assertIn(why, self.refused("record", *o_ok), name)
+        # a NaN or a deeply nested value where no key is listed, and NaN where a text is: refused,
+        # never stored
+        text = json.dumps(full)[:-1]
+        for literal, why in (
+            (', "x": NaN}', "unknown key 'x'"),
+            (', "x": ' + "[" * 110000 + "]" * 110000 + "}", "unknown key 'x'"),
+        ):
+            record.write_text(text + literal)
+            refusal = self.refused("record", *o_ok)
+            self.assertTrue(
+                why in refusal or "JSON nested too deeply" in refusal, refusal
+            )
+        record.write_text(json.dumps(full).replace('"rev": "new"', '"rev": NaN'))
+        self.assertIn("rev is nan, of another type", self.refused("record", *o_ok))
+        record.unlink()
+        # a binary that is no file
+        proc = self.aba(
+            "--old-bin",
+            str(self.dir / "old" / "fake-old"),
+            "--new-bin",
+            str(self.dir / "missing"),
+            "--out",
+            str(self.dir / "nobin"),
+        )
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn(f"error: new: {self.dir / 'missing'}: no such file", proc.stderr)
+        self.assertEqual(report_of(self.dir / "nobin")["verdict"], "aborted")
+        # an unreadable binary: refused, not a traceback
+        (self.dir / "new" / "fake-new").chmod(0o000)
+        try:
+            why = self.refused("unreadable", *o_ok)
+        finally:
+            (self.dir / "new" / "fake-new").chmod(0o755)
+        self.assertIn(f"{self.dir / 'new' / 'fake-new'}: cannot read it", why)
+        # a build record of other driver sources than this checkout's, on either side: one
+        # file changed after the build (a stale harness, even when both sides agree), a file
+        # missing or added, a hash of another type (no driver_sha256, or one that is not an
+        # object, is no build record of build.sh's: below); a side without a build record is
+        # not checked
+        here = checkout_driver()
+        rows = "dev/perf/aba_rows.hpp"
+        for sides, driver, files in (
+            (("new",), {**here, rows: "0" * 64}, rows),
+            (("old",), {**here, rows: "0" * 64}, rows),
+            (("old", "new"), {**here, rows: "0" * 64}, rows),
+            (("new",), {k: v for k, v in here.items() if k != rows}, rows),
+            (("new",), {**here, "dev/perf/extra.hpp": "0" * 64}, "dev/perf/extra.hpp"),
+            (("new",), {**here, rows: [[here[rows]]]}, rows),
+        ):
+            self.fakes()
+            for side in sides:
+                record = self.dir / side / f"fake-{side}.json"
+                rec = json.loads(record.read_text())
+                rec["driver_sha256"] = driver
+                record.write_text(json.dumps(rec))
+            why = self.refused("drivers", *o_ok)
+            first = self.dir / sides[0] / f"fake-{sides[0]}"
+            self.assertIn(
+                f"{sides[0]}: harness {first} was not built from this checkout's driver"
+                f" sources (its build record differs in {files}); rebuild it with build.sh",
+                why,
+            )
+        self.fakes()
+        (self.dir / "new" / "fake-new.json").unlink()
+        proc, rep = self.run_aba("no-record", *o_ok)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["sides"]["B"]["build_record"], {})
+        # a harness given through a symbolic link: its build record is the one beside the
+        # binary it names (read and checked, here a stale driver), and a record beside the link
+        # that is not that file is refused
+        self.fakes()
+        link = self.dir / "link" / "fake-new"
+        link.parent.mkdir()
+        link.symlink_to(self.dir / "new" / "fake-new")
+        through_link = (*self.sides()[:3], str(link), *o_ok)
+        proc, rep = self.run_aba("link-ok", *through_link)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["sides"]["B"]["build_record"]["rev"], "new")
+        record = self.dir / "new" / "fake-new.json"
+        rec = json.loads(record.read_text())
+        record.write_text(json.dumps({**rec, "driver_sha256": {}}))
+        why = self.refused("link-stale", *through_link)
+        self.assertIn(
+            f"harness {self.dir / 'new' / 'fake-new'} was not built from", why
+        )
+        for target_record in (False, True):
+            self.fakes()
+            if not target_record:
+                record.unlink()
+            link.with_name("fake-new.json").write_text(json.dumps(rec))
+            why = self.refused("link-record", *through_link)
+            self.assertIn(
+                f"{link}.json: a build record beside {link}, not beside the binary it names",
+                why,
+            )
+        link.with_name("fake-new.json").unlink()
+        self.fakes()
+        # two different side labels, each 1 to 32 of a-z, 0-9, '_' and '-'
+        self.assertIn(
+            "two different names",
+            self.refused("labels", *o_ok, "--old-label", "x", "--new-label", "x"),
+        )
+        for label in ("", "a/b", "a.b", "Ref", "x" * 33, "a\tb", "a\nb", "\u00e9"):
+            why = self.refused("labels", *o_ok, "--new-label", label)
+            self.assertIn(f"--new-label {label!r}: a label is 1 to 32 of", why)
+        proc, rep = self.run_aba(
+            "label-ok", *o_ok, "--old-label", "0-ref_1", "--new-label", "c" * 32
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        # paths of printable characters only (meta.txt records them on one line)
+        why = self.refused("path", *o_ok, "--expect-meta", "a\nb")
+        self.assertIn("--expect-meta 'a\\nb': a path with a character", why)
+        proc = self.aba(*self.sides(), "--out", str(self.dir / "a\nb"), *o_ok)
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn(
+            "a\\nb': a path with a character that is not printable", proc.stderr
+        )
+        self.assertFalse((self.dir / "a\nb").exists())
+        tab = self.dir / "new" / "fake\tnew"
+        shutil.copy(self.dir / "new" / "fake-new", tab)
+        proc = self.aba(
+            *self.sides()[:3], str(tab), "--out", str(self.dir / "tab"), *o_ok
+        )
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn("a path with a character that is not printable", proc.stderr)
+        self.assertEqual(report_of(self.dir / "tab")["verdict"], "aborted")
+        # --out absent or empty: a file of an earlier run is never mixed in
+        (self.dir / "used").mkdir()
+        (self.dir / "used" / "old.stderr").write_text("an earlier run\n")
+        proc, rep = self.run_aba("used", *o_ok)
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn("must be absent or an empty directory", proc.stderr)
+        self.assertEqual(
+            [f.name for f in (self.dir / "used").iterdir()], ["old.stderr"]
+        )
+        (self.dir / "file").write_text("")
+        proc, rep = self.run_aba("file", *o_ok)
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn("must be absent or an empty directory", proc.stderr)
+        (self.dir / "empty").mkdir()
+        proc, rep = self.run_aba("empty", *o_ok)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+
+    def test_expect_meta(self):
+        o_ok = ("--rows", "o.ok", *self.QUICK)
+        proc, prev = self.run_aba("prev", *o_ok)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        meta = (self.dir / "prev" / "meta.txt").read_text().splitlines()
+        # a meta.txt as a run writes it is accepted, and the summary says so
+        path = str(self.dir / "prev" / "meta.txt")
+        proc, rep = self.run_aba("pinned", *o_ok, "--expect-meta", path)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["expect_meta"], path)
+        self.assertIn(
+            f"every hash equal to `{path}`", "\n".join(self.summary("pinned"))
+        )
+        # lines as meta.txt writes them, no hash twice, at least one
+        pin = next(ln for ln in meta if ln.startswith("B\tbinary\t"))
+        cols = pin.split("\t")
+        changed = "\t".join([*cols[:3], "0" * 64, cols[4]])
+        for name, lines, why in (
+            ("twice", [changed, *meta], "B/binary/harness named twice"),
+            ("junk", ["junk line", *meta], "line 1 is not a meta.txt line"),
+            (
+                "short",
+                [ln.rsplit("\t", 1)[0] if ln == pin else ln for ln in meta],
+                "is not a meta.txt line",
+            ),
+            (
+                "nosha",
+                [ln.replace(cols[3], "x" * 64) for ln in meta],
+                "is not a meta.txt line",
+            ),
+            ("empty", ["# no hash", "label\tA\told"], "no hash"),
+            (
+                "role",
+                [pin.replace("binary", "other"), *meta[1:]],
+                "not a meta.txt line",
+            ),
+            ("label", ["label\tA\tBAD", *meta], "not a meta.txt line"),
+            (
+                "label-twice",
+                ["label\tA\told", "label\tA\told", pin],
+                "not a meta.txt line",
+            ),
+            ("path", [pin + "\x01"], "not a meta.txt line"),
+            # every hash must equal this run's: one changed, one missing
+            (
+                "changed",
+                [changed if ln == pin else ln for ln in meta],
+                "hashes differ: B/binary/harness",
+            ),
+            (
+                "missing",
+                [ln for ln in meta if ln != pin],
+                "hashes differ: B/binary/harness",
+            ),
+        ):
+            path = self.dir / f"meta-{name}.txt"
+            path.write_text("\n".join(lines) + "\n")
+            self.assertIn(
+                why, self.refused("meta", *o_ok, "--expect-meta", str(path)), name
+            )
+        self.assertIn(
+            "No such file",
+            self.refused("meta", *o_ok, "--expect-meta", str(self.dir / "none")),
+        )
+
+    def test_row_list_response_is_checked_whole(self):
+        for broken, why in (
+            ("junk", "malformed output line (Expecting value"),
+            ("twice", "row 'n.fast' listed twice"),
+            ("nogroup", "a row record without a string group"),
+            ("fail", "aba-list: exit 5"),
+            (
+                "unknown",
+                f"error: new: {self.dir / 'new' / 'fake-new'} aba-list: row n.extra: unknown key 'x'",
+            ),
+        ):
+            stderr = self.refused("list", "--rows", "o.ok", env={"FAKE_LIST": broken})
+            self.assertIn(why, stderr)
+        # a nested value where a text is read: refused by its type, never printed (Python 3.14's
+        # reader reads this nesting; older ones refuse it as too deep)
+        stderr = self.refused("list", "--rows", "o.ok", env={"FAKE_LIST": "deepdesc"})
+        why = 'a row record without a string desc: {"row": "n.extra", "group": "n", "desc": "<an array>"}'
+        self.assertTrue(why in stderr or "JSON nested too deeply" in stderr, stderr)
+
+    def test_child_environment(self):
+        # the caller's environment reaches every harness unchanged, in the repository root
+        passed = {
+            "NGRAPH_CORE_SENSITIVITY_THREADS": "8",
+            "NGRAPH_CORE_FOO": "x",
+            "PYTHONPATH": str(self.dir),
+            "PYTHONHOME": sys.base_prefix,
+        }
+        proc, rep = self.run_aba("env", "--rows", "o.ok", *self.QUICK, env=passed)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        blocks = self.envs("o.ok")
+        self.assertEqual(len(blocks), 2 + 3 * 7)  # the warm-up pair and seven triples
+        for blk in blocks:
+            self.assertEqual(
+                blk["core"],
+                {"NGRAPH_CORE_SENSITIVITY_THREADS": "8", "NGRAPH_CORE_FOO": "x"},
+            )
+            self.assertEqual(blk["pythonpath"], str(self.dir))
+            self.assertEqual(blk["pythonhome"], sys.base_prefix)
+            self.assertEqual(blk["cwd"], str(REPO))
+
+    def test_allocator_variable_recorded_not_changed(self):
+        proc, rep = self.run_aba(
+            "malloc",
+            "--rows",
+            "o.ok",
+            *self.QUICK,
+            env={"MallocLargeCache": "0", "LD_PRELOAD": "x.so"},
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        alloc = rep["allocator_env"]
+        self.assertEqual(alloc["MallocLargeCache"], {"set": True, "value": "0"})
+        self.assertEqual(
+            alloc["variables"], {"LD_PRELOAD": "x.so", "MallocLargeCache": "0"}
+        )
+        self.assertIs(alloc["normal"], False)
+        self.assertIs(rep["conforming"], False)
+        malloc = [blk["malloc"] for blk in self.envs("o.ok")]
+        self.assertEqual(malloc, ["0"] * (2 + 3 * 7))
+        summary = self.summary("malloc")
+        self.assertTrue(summary[2].startswith("* **not gate evidence**"))
+        self.assertIn(
+            "* allocator environment: MallocLargeCache=0, LD_PRELOAD=x.so (**allocator override:"
+            " not gate evidence**)",
+            summary,
+        )
+        proc, rep = self.run_aba("normal", "--rows", "o.ok", *self.QUICK)
+        self.assertEqual(rep["allocator_env"]["variables"], {})
+        # every name the rule lists, by prefix or in full, beside near misses that are none
+        # (the record itself, not a run: set, they would load into or retune the allocator of
+        # aba.py and of every process it starts)
+        named = {
+            "MallocScribble": "1",
+            "MALLOC_ARENA_MAX": "2",
+            "DYLD_INSERT_LIBRARIES": "x.dylib",
+            "LD_PRELOAD": "x.so",
+            "GLIBC_TUNABLES": "glibc.malloc.tcache_count=0",
+        }
+        misses = {"MALLOCX": "1", "malloc_x": "1", "XMalloc": "1", "LD_PRELOAD_X": "1"}
+        rec = aba.allocator_record({**named, **misses, "PATH": "/bin"})
+        self.assertEqual(rec["variables"], dict(sorted(named.items())))
+        self.assertEqual(
+            (rec["MallocLargeCache"], rec["normal"]),
+            ({"set": False, "value": None}, False),
+        )
+        self.assertIn(
+            "* allocator environment: MallocLargeCache unset, no other allocator variable (normal)",
+            self.summary("normal"),
+        )
+
+    def test_machine_state_keeps_only_readable_ps_lines(self):
+        # ps output is a diagnostic: a line that is not a finite share and a name is left out
+        fake = self.dir / "fakebin"
+        fake.mkdir()
+        (fake / "ps").write_text(
+            "#!/bin/sh\nprintf 'nan evil\\n12.5 /usr/bin/real\\ninf x\\n7 \\nbusy\\n'\n"
+        )
+        (fake / "ps").chmod(0o755)
+        path = f"{fake}{os.pathsep}{os.environ.get('PATH', '')}"
+        proc, rep = self.run_aba(
+            "ps", "--rows", "o.ok", *self.QUICK, env={"PATH": path}
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        for when in ("state_at_start", "state_at_end"):
+            self.assertEqual(rep["machine"][when]["top_cpu"], [[12.5, "real"]])
+        lines = [ln for ln in self.summary("ps") if "top CPU real 12%" in ln]
+        self.assertEqual(
+            [ln.split(":")[0] for ln in lines],
+            ["* machine state at start", "* machine state at end"],
+        )
+
+    def test_both_sides_list_the_same_rows(self):
+        for broken, why in (
+            ("extra", "only the candidate ['n.list_extra']"),
+            ("slash", "row 'n/extra' is not 1 to 64 of the characters"),
+        ):
+            stderr = self.refused("rows", "--rows", "o.ok", env={"FAKE_LIST": broken})
+            self.assertIn(why, stderr)
+
+    def test_os_errors(self):
+        # before the first block: a refusal that leaves nothing in --out (here an empty,
+        # read-only directory, so meta.txt cannot be written)
+        locked = self.dir / "locked"
+        locked.mkdir()
+        locked.chmod(0o555)
+        try:
+            proc, rep = self.run_aba("locked", "--rows", "o.ok")
+            sub_proc, sub_rep = self.run_aba("locked/sub", "--rows", "o.ok")
+            sub = sub_proc.stderr
+            self.assertEqual(sub_proc.returncode, 2)
+            self.assertIsNone(sub_rep)
+            self.assertIn("cannot write refusal outputs", sub)
+        finally:
+            locked.chmod(0o755)
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn(f"--out {locked}: [Errno 13] Permission denied", proc.stderr)
+        self.assertNotIn("Traceback", proc.stderr)
+        self.assertEqual(list(locked.iterdir()), [])
+        self.assertIn(f"--out {locked / 'sub'}: [Errno 13] Permission denied", sub)
+        self.assertEqual(self.blocks_run(), 0)
+        # after it: the run aborts, with both outputs
+        out = self.dir / "rmlogs"
+        rep = self.aborted(
+            "rmlogs", "--rows", "n.rmlogs,o.ok", env={"FAKE_OUT": str(out)}
+        )
+        self.assertIn("operating-system error: [Errno 2] No such file", rep["aborted"])
+        self.assertEqual([r["status"] for r in rep["rows"]], ["timing", "planned"])
+        self.assertTrue((out / "blocks.csv").is_file())
+        # and when the outputs themselves cannot be written: exit 1, the reason on stderr
+        out = self.dir / "lockout"
+        try:
+            proc, rep = self.run_aba(
+                "lockout",
+                "--rows",
+                "n.lockout",
+                "--triples",
+                "2",
+                "--allow-short",
+                *self.QUICK,
+                env={"FAKE_OUT": str(out)},
+            )
+        finally:
+            out.chmod(0o755)
+        # Both files existed before the first block. They can still be written directly when
+        # the directory stops allowing a replacement; the final reason records that failure.
+        self.assertEqual(proc.returncode, 1, proc.stderr)
+        self.assertNotIn("Traceback", proc.stderr)
+        self.assertIn("Permission denied", proc.stderr)
+        self.assertEqual(rep["verdict"], "aborted")
+        self.assertIn("Permission denied", rep["aborted"])
+        self.assertIn(rep["aborted"], (out / "summary.md").read_text())
+
+    def test_default_output_directory(self):
+        # Without --out the report lands in results/<second stamp>/ beside aba.py. The run uses a
+        # copy of the tool's sources in this test's own directory, so it writes nothing into the
+        # checkout and two runs at once never share a results directory.
+        perf = self.dir / "checkout" / "dev" / "perf"
+        perf.mkdir(parents=True)
+        for name in aba.SOURCE_FILES:
+            shutil.copy(HERE / name, perf / name)
+        proc = self.aba(
+            *self.sides(),
+            "--rows",
+            "o.ok",
+            "--triples",
+            "2",
+            "--allow-short",
+            *self.QUICK,
+            script=perf / "aba.py",
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        report = Path(re.search(r"^report: (.*)$", proc.stdout, re.M).group(1))
+        self.assertEqual(report.parent.parent, perf / "results")
+        self.assertRegex(report.parent.name, r"^\d{8}T\d{6}$")
+        self.assertTrue(report.is_file())
+
+    def test_peak_rss_reading(self):
+        # the larger of the harness's own reading (self + children) and os.wait4's, in bytes
+        proc, rep = self.run_aba("rss", "--rows", "n.tinyrss,o.ok", *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        for name in ("n.tinyrss", "o.ok"):
+            rec = by_row(rep)[name]
+            for blk in [*rec["warmup"].values(), *blocks_of(rec)]:
+                own = blk["rss_self_bytes"] + blk["rss_children_bytes"]
+                self.assertEqual(
+                    blk["rss_tree_bytes"], max(own, blk["rss_wait4_bytes"])
+                )
+                # a Python process's real peak: some MiB, never GiB (a KiB/byte mix-up)
+                self.assertTrue(MIB < blk["rss_wait4_bytes"] < 40 * MIB, blk)
+                self.assertEqual(
+                    blk["rss_tree_bytes"],
+                    blk["rss_wait4_bytes"] if own == 1 else 40 * MIB,
+                )
+
+    def test_digest_change_in_a_later_block_fails(self):
+        rows = "n.late_a1,n.late_b,n.late_a2,o.ok"
+        proc, rep = self.run_aba("late", "--rows", rows, *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        res = by_row(rep)
+        for name, slot in (("n.late_a1", "A1"), ("n.late_b", "B"), ("n.late_a2", "A2")):
+            rec = res[name]
+            # the change sits in triple 5 only: the first triples agree
+            self.assertEqual(
+                rec["triples"][0]["A1"]["digest"], rec["triples"][0]["B"]["digest"]
+            )
+            self.assertEqual(
+                rec["triples"][4][slot]["digest"], "00000000000000cc", name
+            )
+            self.assertIs(rec["digest_match"], False, name)
+            self.assertEqual(rec["digest_verdict"], "fail", name)
+            self.assertEqual(rec["verdict"], "fail", name)
+        self.assertEqual(res["o.ok"]["digest_verdict"], "pass")
+
+    def test_rules_apply_to_every_row(self):
+        rowset = "n.digest,n.drift,n.bimodal,n.rss,n.short,n.wander,o.big,o.warm"
+        proc, rep = self.run_aba("rules", "--rows", rowset, *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        res = by_row(rep)
+        self.assertEqual(res["n.digest"]["verdict"], "fail")
+        self.assertEqual(res["n.digest"]["digest_verdict"], "fail")
+        self.assertEqual(res["n.digest"]["time_verdict"], "pass")
+        self.assertEqual(res["n.drift"]["time_verdict"], "inconclusive")
+        self.assertGreater(res["n.drift"]["drift"], 0.03)
+        self.assertAlmostEqual(res["n.drift"]["statistic"], 0.0005 / 0.00105 - 1)
+        self.assertEqual(
+            res["n.drift"]["bimodal"], ["A"]
+        )  # A1 and A2 apart: two clusters
+        wander = res["n.wander"]
+        self.assertGreater(wander["drift"], 0.03)
+        self.assertEqual(
+            [wander[k] for k in ("time_verdict", "cluster_verdict", "verdict")],
+            ["inconclusive", "pass", "inconclusive"],
+        )
+        self.assertEqual(res["n.bimodal"]["bimodal"], ["B"])
+        self.assertEqual(res["n.bimodal"]["verdict"], "fail")
+        self.assertEqual(res["n.rss"]["rss_verdict"], "fail")
+        self.assertEqual(res["o.big"]["verdict"], "fail")
+        warm = res["o.warm"]
+        self.assertEqual(warm["warmup"]["A"]["rss_tree_bytes"], 500 * MIB)
+        self.assertEqual(warm["rss_a1_max_bytes"], 40 * MIB)
+        self.assertEqual(warm["rss_verdict"], "fail")
+        self.assertEqual(res["n.short"]["block_verdict"], "fail")
+        self.assertEqual(len(res["n.short"]["short_blocks"]), 21)
+        self.assertEqual(rep["verdict"], "fail")
+        # every other check passed: the short blocks alone make the run non-conforming
+        self.assertIs(rep["allocator_env"]["normal"], True)
+        self.assertIs(rep["conforming"], False)
+        summary = self.summary("rules")
+        header = next(ln for ln in summary if ln.startswith("| Row |"))
+        table = [ln for ln in summary if ln.startswith(("| n.", "| o."))]
+        self.assertEqual(len(table), 8)
+        self.assertTrue(all(ln.count("|") == header.count("|") for ln in table))
+        self.assertIn(
+            "Rows measured: 8 (0 pass, 7 fail, 1 inconclusive); not measured: 0.",
+            summary,
+        )
+        self.assertIn("Inconclusive rows: n.wander.", summary)
+        self.assertIn("Digest mismatches (fail): n.digest.", summary)
+        self.assertIn("Memory failures: n.rss, o.big, o.warm.", summary)
+        # an inconclusive row makes a run without failing rows inconclusive
+        proc, rep = self.run_aba("wander", "--rows", "n.wander,o.ok", *self.QUICK)
+        self.assertEqual(rep["verdict"], "inconclusive")
+
+    def test_failing_or_short_run_exits_0_with_its_verdict(self):
+        # aba.py's exit status only says the run completed; the summary's first lines and
+        # report.json give the verdict and the conformance.
+        proc, rep = self.run_aba("fail", "--rows", "n.bimodal,o.ok", *self.QUICK)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["verdict"], "fail")
+        self.assertIs(rep["conforming"], True)
+        self.assertIn("overall verdict **fail**", self.summary("fail")[3])
+        proc, rep = self.run_aba(
+            "short", "--rows", "o.ok", "--triples", "2", "--allow-short", *self.QUICK
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertEqual(rep["verdict"], "pass")
+        self.assertEqual(by_row(rep)["o.ok"]["short_blocks"], [])
+        self.assertIs(rep["conforming"], False)  # --allow-short alone
+        summary = self.summary("short")
+        self.assertTrue(summary[2].startswith("* **not gate evidence**"), summary[2])
+        self.assertIn("--allow-short given", "\n".join(summary))
+
+    def test_python_version(self):
+        out = self.dir / "py39"
+        code = (
+            "import runpy, sys; sys.version_info = (3, 9, 6, 'final', 0); "
+            f"sys.argv = ['aba.py', *{list(self.sides())!r}, '--out', {str(out)!r}]; "
+            f"runpy.run_path({str(ABA)!r}, run_name='__main__')"
+        )
+        proc = subprocess.run(
+            [sys.executable, "-B", "-c", code],
+            capture_output=True,
+            text=True,
+            env=clean_env(),
+        )
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn("error: aba.py needs Python 3.10 or newer", proc.stderr)
+        self.assertNotIn("Traceback", proc.stderr)
+        self.assertEqual(report_of(out)["verdict"], "aborted")
+        self.assertIn(report_of(out)["aborted"], (out / "summary.md").read_text())
+
+    def test_stderr_logs(self):
+        # Every block of a row, side and mode appends its stderr to one log; a log still empty
+        # after a block is removed, and an abort names a log only when the failing block wrote
+        # to it.
+        proc, rep = self.run_aba("said", "--rows", "o.ok", env={"FAKE_STDERR": "new"})
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        blocks = self.dir / "said" / "blocks"
+        self.assertEqual(
+            sorted(os.listdir(blocks)),
+            ["o.ok.new.aba-calibrate.stderr", "o.ok.new.aba-run.stderr"],
+        )
+        self.assertEqual(
+            (blocks / "o.ok.new.aba-calibrate.stderr").read_text(),
+            "new aba-calibrate o.ok: a message\n",
+        )
+        self.assertEqual(
+            (blocks / "o.ok.new.aba-run.stderr").read_text(),
+            "new aba-run o.ok: a message\n" * 7,
+        )
+        for row in ("n.crash", "n.garbled"):
+            rep = self.aborted(f"said-{row}", "--rows", row, env={"FAKE_STDERR": "new"})
+            blocks = self.dir / f"said-{row}" / "blocks"
+            log = blocks / f"{row}.new.aba-run.stderr"
+            self.assertIn(f"new aba-run {row} ", rep["aborted"])
+            self.assertIn(f" (stderr: {log})", rep["aborted"])
+            self.assertEqual(log.read_text(), f"new aba-run {row}: a message\n")
+            # the reference's A1 block before it wrote nothing: no log
+            self.assertEqual(
+                sorted(os.listdir(blocks)),
+                [f"{row}.new.aba-calibrate.stderr", log.name],
+            )
+            rep = self.aborted(f"quiet-{row}", "--rows", row)
+            self.assertIn(f"new aba-run {row} ", rep["aborted"])
+            self.assertIn(" (nothing on stderr)", rep["aborted"])
+            self.assertNotIn("stderr: ", rep["aborted"])
+            self.assertEqual(os.listdir(self.dir / f"quiet-{row}" / "blocks"), [])
+
+    def test_nonfinite_derived_values_abort_before_any_verdict(self):
+        for row, why in (
+            # A1 = A2 = 1e308, B = 1.5e308: the mean of A1 and A2 overflows; a ratio
+            # against it would read 0, statistic -1, a false pass of a 50 % slowdown
+            ("n.huge", "the mean of A1 and A2 is inf, not finite"),
+            ("n.hugewarm", "n.hugewarm expected duration is inf, not finite"),
+            ("n.longplan", "ends beyond any date"),
+            ("n.rsswarm", "aba-calibrate n.rsswarm rss_tree_bytes is inf, not finite"),
+        ):
+            rep = self.aborted(row, "--rows", row)
+            self.assertIn(why, rep["aborted"], row)
+            rec = by_row(rep)[row]
+            for key in ("verdict", "statistic", "time_verdict", "rss_verdict"):
+                self.assertNotIn(key, rec, (row, key))
+            # nothing written is a non-finite number
+            text = (self.dir / row / "report.json").read_text()
+            self.assertNotIn("Infinity", text, row)
+            self.assertNotIn("NaN", text, row)
+        # a finite target over a short warm-up median: the calibrated count overflows
+        rep = self.aborted("count", "--rows", "o.ok", "--target-seconds", "1e308")
+        self.assertIn(
+            "o.ok old: the calibrated iteration count is inf, not finite",
+            rep["aborted"],
+        )
+        self.assertNotIn("iterations_a", by_row(rep)["o.ok"])
+        # a warm-up median printed as an integer, times a pinned count, is beyond any float:
+        # an infinity the run reports, not an exception
+        rep = self.aborted("intwarm", "--rows", "n.intwarm", *INTWARM_PIN)
+        self.assertIn("n.intwarm expected duration is inf, not finite", rep["aborted"])
+
+    def test_both_block_modes_and_sides_refuse_unruled_values(self):
+        for side in ("old", "new"):
+            for mode in ("aba-calibrate", "aba-run"):
+                for change in (
+                    {"x": 1},
+                    {"x": float("nan")},
+                    {"x": [[1]]},
+                    {"median_s": [1]},
+                    {"iterations": True},
+                    {"p90_s": float("inf")},
+                    {"iterations": 2**63},
+                ):
+                    with self.subTest(side=side, mode=mode, change=change):
+                        out = f"schema-{side}-{mode}-{len(list(self.dir.iterdir()))}"
+                        rep = self.aborted(
+                            out,
+                            "--rows",
+                            "o.ok",
+                            "--triples",
+                            "1",
+                            "--allow-short",
+                            env={
+                                "FAKE_CHANGE_SIDE": side,
+                                "FAKE_CHANGE_MODE": mode,
+                                "FAKE_CHANGE": json.dumps(change),
+                            },
+                        )
+                        self.assertIn(f"{side} {mode} o.ok", rep["aborted"])
+                        self.assertNotIn(
+                            '"x":', (self.dir / out / "report.json").read_text()
+                        )
+
+    def test_final_output_exceptions_keep_both_files(self):
+        # A serializer or writer can fail after a successful comparison, or after a failed
+        # harness. Each output is still attempted; a failed serializer gets a minimal record.
+        saved_report = aba.report_text
+        saved_atomic = aba.atomic_text
+        for row in ("o.ok", "n.crash"):
+            for fault in (
+                "json",
+                "summary",
+                "csv",
+                "write",
+                "machine",
+                "closed_stderr",
+                "closed_traceback",
+            ):
+                with self.subTest(row=row, fault=fault):
+                    out = self.dir / f"output-{row}-{fault}"
+                    argv = [
+                        "aba.py",
+                        *self.sides(),
+                        "--rows",
+                        row,
+                        "--out",
+                        str(out),
+                        "--triples",
+                        "1",
+                        "--allow-short",
+                        *self.QUICK,
+                    ]
+
+                    def bad_json(report):
+                        if "verdict" in report and "protocol" in report:
+                            raise RecursionError("full JSON failed")
+                        return saved_report(report)
+
+                    attempts = []
+
+                    def bad_write(path, text, attempts=attempts):
+                        # The first two writes make the initial files. Fail the final JSON
+                        # replacement once; the retry must overwrite both files as aborted.
+                        attempts.append(path.name)
+                        if len(attempts) == 3:
+                            raise RuntimeError("write failed")
+                        return saved_atomic(path, text)
+
+                    state_calls = []
+                    saved_state = aba.machine_state
+
+                    def bad_state(
+                        state_calls=state_calls, saved_state=saved_state, fault=fault
+                    ):
+                        state_calls.append(1)
+                        if len(state_calls) > 1:
+                            if fault == "closed_stderr":
+                                sys.stderr.close()
+                            raise ValueError("machine diagnostic failed")
+                        return saved_state()
+
+                    def bad_csv(report):
+                        sys.stderr.close()
+                        raise RuntimeError("csv failed")
+
+                    patch = {
+                        "json": mock.patch.object(aba, "report_text", bad_json),
+                        "summary": mock.patch.object(
+                            aba,
+                            "summary_text",
+                            side_effect=ValueError("summary failed"),
+                        ),
+                        "csv": mock.patch.object(
+                            aba, "csv_text", side_effect=RuntimeError("csv failed")
+                        ),
+                        "closed_traceback": mock.patch.object(aba, "csv_text", bad_csv),
+                        "write": mock.patch.object(aba, "atomic_text", bad_write),
+                        "machine": mock.patch.object(aba, "machine_state", bad_state),
+                        "closed_stderr": mock.patch.object(
+                            aba, "machine_state", bad_state
+                        ),
+                    }[fault]
+                    with (
+                        mock.patch.object(sys, "argv", argv),
+                        patch,
+                        contextlib.redirect_stdout(io.StringIO()),
+                        contextlib.redirect_stderr(io.StringIO()),
+                    ):
+                        status = aba.main()
+                    rep = report_of(out)
+                    self.assertEqual(status, 1)
+                    self.assertEqual(
+                        (rep["verdict"], rep["conforming"]), ("aborted", False)
+                    )
+                    self.assertIn(rep["aborted"], (out / "summary.md").read_text())
+                    self.assertEqual([r["row"] for r in rep["rows"]], [row])
+                    self.assertFalse(list(out.glob(".aba-*")))
+
+    def test_system_numbers_are_checked_before_storage(self):
+        for value in (float("nan"), float("inf"), -1, True, [1], "1"):
+            with self.subTest(value=value):
+                with mock.patch.object(
+                    os, "getloadavg", return_value=(value, 0.0, 0.0)
+                ):
+                    out = self.dir / f"system-{len(list(self.dir.iterdir()))}"
+                    argv = [
+                        "aba.py",
+                        *self.sides(),
+                        "--out",
+                        str(out),
+                        "--rows",
+                        "o.ok",
+                    ]
+                    with (
+                        mock.patch.object(sys, "argv", argv),
+                        contextlib.redirect_stderr(io.StringIO()),
+                    ):
+                        self.assertEqual(aba.main(), 2)
+                    rep = report_of(out)
+                    self.assertIn("machine load", rep["aborted"])
+                    self.assertIn(rep["aborted"], (out / "summary.md").read_text())
+
+        # An interrupt before the final elapsed-time reading must check that reading too.
+        out = self.dir / "interrupted-clock"
+        out.mkdir()
+        report = {"started_utc": "test", "rows": []}
+        with (
+            mock.patch.object(time, "perf_counter", return_value=float("nan")),
+            contextlib.redirect_stderr(io.StringIO()),
+        ):
+            self.assertEqual(aba.finish_interrupted(report, out, 0.0), 1)
+        self.assertNotIn("wall_s", report)
+        saved = report_of(out)
+        self.assertIn(saved["aborted"], (out / "summary.md").read_text())
+
+    def test_interrupt_aborts_and_stops_the_block(self):
+        # Ctrl-C (SIGINT to aba.py) during a warm-up or a timed block: the run aborts like any
+        # other, and the harness of that block is stopped at once, not left running
+        for row, block in (
+            ("n.sigint_warm", "new aba-calibrate n.sigint_warm"),
+            ("n.sigint", "new aba-run n.sigint"),
+        ):
+            started = time.monotonic()
+            rep = self.aborted(row, "--rows", row)
+            self.assertEqual(
+                rep["aborted"], f"interrupted (SIGINT, Ctrl-C) during {block}"
+            )
+            self.assertLess(time.monotonic() - started, 20, row)
+            pid = int(self.events(row)[-1][4])
+            with self.assertRaises(ProcessLookupError, msg=row):
+                os.kill(pid, 0)
+        # Before the first block: exit 130, both outputs record the interrupted listing.
+        started = time.monotonic()
+        proc, rep = self.run_aba(
+            "listing", "--rows", "o.ok", env={"FAKE_LIST": "sigint"}
+        )
+        self.assertEqual(proc.returncode, 130, proc.stderr)
+        self.assertIn(
+            "interrupted (SIGINT, Ctrl-C) during new aba-list", rep["aborted"]
+        )
+        self.assertIn(rep["aborted"], (self.dir / "listing" / "summary.md").read_text())
+        self.assertLess(time.monotonic() - started, 20)
+
+    def test_interrupt_while_the_outputs_are_written(self):
+        # Ctrl-C while the final outputs are written (once, or twice): held until they are
+        # written, then the run aborts like any other, its outputs written again
+        for times in (1, 2):
+            tools = self.dir / f"tools{times}"
+            tools.mkdir()
+            ps = tools / "ps"
+            calls = tools / "calls"
+            ps.write_text(
+                FAKE_PS.format(py=sys.executable, calls=str(calls), times=times)
+            )
+            ps.chmod(0o755)
+            path = f"{tools}{os.pathsep}{os.environ['PATH']}"
+            rep = self.aborted(f"ps{times}", "--rows", "o.ok", env={"PATH": path})
+            self.assertEqual(
+                rep["aborted"],
+                "interrupted (SIGINT, Ctrl-C) while the outputs were written",
+            )
+            self.assertEqual(by_row(rep)["o.ok"]["status"], "measured")
+            # ps ran twice: at the start and at the end
+            self.assertEqual(calls.read_text(), "xx", times)
+            self.assertEqual(rep["machine"]["state_at_end"]["top_cpu"], [[1.0, "fake"]])
+            with (self.dir / f"ps{times}" / "blocks.csv").open() as f:
+                self.assertEqual(len(list(csv.DictReader(f))), 2 + 3 * 7, times)
+        # An interrupt raised before the hold began (summary_text raises it once): the same
+        # abort; a run that aborted already keeps its reason.
+        saved = aba.summary_text
+        self.addCleanup(setattr, aba, "summary_text", saved)
+        self.addCleanup(setattr, sys, "argv", sys.argv)
+        for row, why in (
+            ("o.ok", "interrupted (SIGINT, Ctrl-C) while the outputs were written"),
+            ("n.crash", "new aba-run n.crash exited 3"),
+        ):
+            verdicts: list[str] = []
+
+            def interrupted_once(report, verdicts=verdicts):
+                verdicts.append(report["verdict"])
+                if len(verdicts) == 1:
+                    raise KeyboardInterrupt
+                return saved(report)
+
+            aba.summary_text = interrupted_once
+            out = self.dir / f"raised-{row}"
+            argv = [
+                "aba.py",
+                *self.sides(),
+                "--rows",
+                row,
+                "--out",
+                str(out),
+                *self.QUICK,
+            ]
+            err = io.StringIO()
+            sys.argv = argv
+            with (
+                contextlib.redirect_stdout(io.StringIO()),
+                contextlib.redirect_stderr(err),
+            ):
+                status = aba.main()
+            self.assertEqual(status, 1, row)
+            rep = report_of(out)
+            self.assertIn(why, rep["aborted"], row)
+            self.assertEqual(
+                (rep["verdict"], rep["conforming"]), ("aborted", False), row
+            )
+            self.assertEqual(verdicts[-1], "aborted", row)
+            summary = (out / "summary.md").read_text().splitlines()
+            self.assertIn("overall verdict **aborted**", summary[3], row)
+            self.assertIn(f"* **aborted**: {rep['aborted']}", summary, row)
+            self.assertIn(
+                "aborted: interrupted (SIGINT, Ctrl-C) while the outputs were written",
+                err.getvalue(),
+                row,
+            )
+
+    def test_second_interrupt_while_the_first_is_handled(self):
+        # Ctrl-C during a block (the fake harness sends it), and again while the run records
+        # that interrupt: the second is held, so the run aborts for the first, with every
+        # output written (exit 1, not the 130 of an interrupt before the first block)
+        class SecondInterrupt(dict):
+            def __setitem__(self, key, value):
+                if key == "aborted":
+                    signal.raise_signal(signal.SIGINT)
+                super().__setitem__(key, value)
+
+        saved = aba.start_run
+
+        def start_run(*args):
+            out, report, *rest = saved(*args)
+            return (out, SecondInterrupt(report), *rest)
+
+        self.addCleanup(setattr, aba, "start_run", saved)
+        self.addCleanup(setattr, sys, "argv", sys.argv)
+        aba.start_run = start_run
+        out = self.dir / "second"
+        sys.argv = ["aba.py", *self.sides(), "--rows", "n.sigint", "--out", str(out)]
+        sys.argv += self.QUICK
+        err = io.StringIO()
+        with (
+            contextlib.redirect_stdout(io.StringIO()),
+            contextlib.redirect_stderr(err),
+        ):
+            status = aba.main()
+        self.assertEqual(status, 1, err.getvalue())
+        rep = report_of(out)
+        self.assertEqual(
+            rep["aborted"], "interrupted (SIGINT, Ctrl-C) during new aba-run n.sigint"
+        )
+        self.assertEqual((rep["verdict"], rep["conforming"]), ("aborted", False))
+        self.assertIn("overall verdict **aborted**", self.summary("second")[3])
+        self.assertEqual(
+            sorted(os.listdir(out)),
+            ["blocks", "blocks.csv", "meta.txt", "report.json", "summary.md"],
+        )
+        self.assertIs(signal.getsignal(signal.SIGINT), signal.default_int_handler)
+
+    # Every way a run aborts: the step it aborts in, the row that makes it abort, the options
+    # that needs, and the reason ({new} stands for the candidate harness's path).
+    ABORTS = (
+        ("warm-up", "n.warmfail", (), "new aba-calibrate n.warmfail"),
+        ("warm-up", "n.hugewarm", (), "n.hugewarm expected duration is inf"),
+        ("warm-up", "n.rsswarm", (), "n.rsswarm rss_tree_bytes is inf"),
+        (
+            "warm-up",
+            "n.intwarm",
+            INTWARM_PIN,
+            "n.intwarm expected duration is inf",
+        ),
+        (
+            "warm-up",
+            "n.sigint_warm",
+            (),
+            "interrupted (SIGINT, Ctrl-C) during new aba-calibrate n.sigint_warm",
+        ),
+        (
+            "warm-up",
+            "n.nan",
+            (),
+            "old aba-calibrate n.nan (nothing on stderr): malformed output line (unknown"
+            " key 'x'): ",
+        ),
+        ("plan", "n.longplan", (), "ends beyond any date"),
+        (
+            "timing",
+            "n.garbled",
+            (),
+            "new aba-run n.garbled (nothing on stderr): malformed output line (Expecting"
+            " property name",
+        ),
+        ("timing", "n.negative", (), "median_s -0.0005 is not positive"),
+        ("timing", "n.other", (), "the record names row 'n.fast', not 'n.other'"),
+        ("timing", "n.crash", (), "new aba-run n.crash exited 3 (nothing on stderr)"),
+        (
+            "timing",
+            "n.fewer",
+            (),
+            "new aba-run n.fewer: the harness ran 4399 iterations, 4400 requested",
+        ),
+        (
+            "timing",
+            "n.tamper",
+            (),
+            "new: harness changed after aba-run n.tamper: {new} ",
+        ),
+        (
+            "timing",
+            "n.cross_tamper",
+            (),
+            "new: harness changed before aba-run n.cross_tamper: {new} ",
+        ),
+        (
+            "timing",
+            "n.vanish",
+            (),
+            "new: harness {new} unreadable after aba-run n.vanish",
+        ),
+        ("timing", "n.noexec", (), "new aba-run n.noexec: cannot start {new} "),
+        ("timing", "n.huge", (), "n.huge: the mean of A1 and A2 is inf"),
+        (
+            "timing",
+            "n.sigint",
+            (),
+            "interrupted (SIGINT, Ctrl-C) during new aba-run n.sigint",
+        ),
+        (
+            "timing",
+            "n.extra",
+            (),
+            "new aba-run n.extra (nothing on stderr): malformed output line (unknown key"
+            " 'x'): ",
+        ),
+        (
+            "timing",
+            "n.deep",
+            (),
+            # Python 3.14's reader reads it (the key is refused), older ones refuse the nesting
+            "new aba-run n.deep (nothing on stderr): malformed output line (",
+        ),
+        (
+            "end",
+            "n.end_tamper",
+            (),
+            "new: harness changed at the end of the run: {new} ",
+        ),
+    )
+    # The status of the rows before, at and after the aborting one, by step.
+    REACHED = {
+        "warm-up": ("planned", "warm-up", "not run"),
+        "plan": ("planned", "planned", "planned"),
+        "timing": ("measured", "timing", "planned"),
+        "end": ("measured", "measured"),
+    }
+
+    def test_every_abort_with_several_rows(self):
+        # Each abort with a row before the aborting one and one after it (none after the end
+        # of the run): report.json and summary.md still list every selected row with the step
+        # it reached, and the summary's plan says which rows did not finish.
+        for step, row, extra, why in self.ABORTS:
+            self.fakes()  # the previous case changed, removed or locked the candidate
+            rows = ["n.fast", row, *(["o.ok"] if step != "end" else [])]
+            # the end-of-run change needs all seven triples (the last A2 changes the candidate)
+            short = () if step == "end" else ("--triples", "2", "--allow-short")
+            out = f"several-{row}"
+            rep = self.aborted(out, "--rows", ",".join(rows), *short, *extra)
+            new = self.dir / "new" / "fake-new"
+            self.assertIn(why.format(new=new), rep["aborted"], row)
+            want = dict(zip(rows, self.REACHED[step], strict=True))
+            self.assertEqual({r["row"]: r["status"] for r in rep["rows"]}, want, row)
+            # blocks.csv: the blocks of the finished warm-up pairs and triples, row by row
+            with open(self.dir / out / "blocks.csv", newline="") as f:
+                slots = [(b["row"], b["slot"]) for b in csv.DictReader(f)]
+            finished = [
+                (r["row"], s)
+                for r in rep["rows"]
+                for s in [
+                    *(["W-A", "W-B"] if "warmup" in r else []),
+                    *["A1", "B", "A2"] * len(r.get("triples", [])),
+                ]
+            ]
+            self.assertEqual(slots, finished, row)
+            summary = self.summary(out)
+            table = [ln for ln in summary if ln.startswith(("| n.", "| o."))]
+            self.assertEqual([ln.split(" | ")[0][2:] for ln in table], rows, row)
+            text = "\n".join(summary)
+            for name, status in want.items():
+                self.assertIn(f"{name} ({status})", text, row)
+            if step == "timing":
+                actual = {
+                    ln.split(":")[0][2:]: ln.rsplit(", actual ", 1)[1]
+                    for ln in summary
+                    if ln.startswith("* ") and ", actual " in ln
+                }
+                self.assertEqual(
+                    (actual[row], actual["o.ok"]), ("not finished", "not run"), row
+                )
+        # an option that aborts the first row's warm-up step: nothing after it ran
+        self.fakes()
+        rep = self.aborted(
+            "several-count",
+            "--rows",
+            "n.fast,o.ok",
+            "--target-seconds",
+            "1e308",
+        )
+        self.assertEqual([r["status"] for r in rep["rows"]], ["warm-up", "not run"])
+
+
+def git(cwd: Path, *args: str) -> str:
+    """git without the user's hooks, signing or identity."""
+    cmd = [
+        "git",
+        "-c",
+        "core.hooksPath=/dev/null",
+        "-c",
+        "commit.gpgsign=false",
+        "-c",
+        "user.name=test",
+        "-c",
+        "user.email=test@example.com",
+        *args,
+    ]
+    return subprocess.run(
+        cmd, cwd=cwd, check=True, capture_output=True, text=True
+    ).stdout
+
+
+def tree_digest(root: Path) -> str:
+    """build.sh's core_sources_sha256, computed independently (dot-files left out)."""
+    lines = sorted(
+        (p.relative_to(root).as_posix(), hashlib.sha256(p.read_bytes()).hexdigest())
+        for sub in ("include", "src")
+        for p in (root / sub).rglob("*")
+        if p.is_file()
+        and not any(part.startswith(".") for part in p.relative_to(root).parts)
+    )
+    return hashlib.sha256("".join(f"{h}  {p}\n" for p, h in lines).encode()).hexdigest()
+
+
+# The fake compiler logs its arguments and writes a small binary; xcrun names $FAKE_SDK (none
+# when it is empty); vtool prints one LC_BUILD_VERSION, or fails when $FAKE_VTOOL is "fail".
+FAKE_CXX = """#!/bin/sh
+if [ "$1" = --version ]; then echo "fake clang version 1.0"; echo second line; exit 0; fi
+if [ -n "$FAKE_CXX_FAIL" ]; then echo "fake: error: does not compile" >&2; exit 1; fi
+printf '%s\\n' "$@" > "$FAKE_LOG"
+while [ $# -gt 0 ]; do if [ "$1" = -o ]; then printf 'binary\\n' > "$2"; fi; shift; done
+"""
+FAKE_XCRUN = """#!/bin/sh
+[ -n "$FAKE_SDK" ] || exit 1
+case "$1" in --show-sdk-path) echo "$FAKE_SDK" ;; --show-sdk-version) echo 27.0 ;; esac
+"""
+FAKE_VTOOL = """#!/bin/sh
+[ "$FAKE_VTOOL" = fail ] && exit 1
+printf '%s:\\nLoad command 9\\n      cmd LC_BUILD_VERSION\\n platform MACOS\\n    minos 15.0\\n      sdk 27.0\\n' "$2"
+if [ "$FAKE_VTOOL" = several ]; then
+  printf 'Load command 10\\n platform OTHER\\n    minos 99.0\\n      sdk 100.0\\n'
+fi
+"""
+
+
+class BuildScript(unittest.TestCase):
+    """build.sh in a scratch git repository with this checkout's build.sh and driver files, a
+    small include/ and src/, and a fake compiler, xcrun and vtool on PATH."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        top = Path(self.tmp.name).resolve()
+        self.repo = top / "repo"
+        perf = self.repo / "dev" / "perf"
+        perf.mkdir(parents=True)
+        for name in ("build.sh", *DRIVER):
+            shutil.copy2(HERE / name, perf / name)
+        for path, text in (
+            ("include/netgraph/core/a.hpp", "a\n"),
+            ("src/a.cpp", "a\n"),
+            ("src/b.cpp", "b\n"),
+            # dot-files: left out of core_sources_sha256
+            ("src/.hidden", "h\n"),
+            ("include/.d/c.hpp", "c\n"),
+        ):
+            (self.repo / path).parent.mkdir(parents=True, exist_ok=True)
+            (self.repo / path).write_text(text)
+        git(self.repo, "init", "-q")
+        git(self.repo, "add", ".")
+        git(self.repo, "commit", "-q", "-m", "base")
+        self.base = git(self.repo, "rev-parse", "HEAD").strip()
+        # HEAD is a second revision with another src/a.cpp: a revision build of the first one
+        # must take the first one's sources, not HEAD's
+        (self.repo / "src" / "a.cpp").write_text("a at HEAD\n")
+        git(self.repo, "commit", "-q", "-am", "head")
+        self.head = git(self.repo, "rev-parse", "HEAD").strip()
+        self.bin = top / "bin"
+        self.bin.mkdir()
+        for name, text in (
+            ("clang++", FAKE_CXX),
+            ("mycxx", FAKE_CXX),  # a CXX that is not the PATH's clang++
+            ("xcrun", FAKE_XCRUN),
+            ("vtool", FAKE_VTOOL),
+        ):
+            (self.bin / name).write_text(text)
+            (self.bin / name).chmod(0o755)
+        self.sdk = top / "sdk"
+        self.sdk.mkdir()
+        self.log = top / "compiler.log"
+        self.top = top
+        self.flags = (
+            re.search(r"^flags=\((.*)\)$", (HERE / "build.sh").read_text(), re.M)
+            .group(1)
+            .split()
+        )
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def build(self, *args: str, **env: str) -> subprocess.CompletedProcess:
+        base = {
+            k: v
+            for k, v in os.environ.items()
+            if k not in ("CXX", "SDKROOT", "MACOSX_DEPLOYMENT_TARGET")
+        }
+        base.update(
+            PATH=f"{self.bin}{os.pathsep}{os.environ['PATH']}",
+            FAKE_LOG=str(self.log),
+            FAKE_SDK=str(self.sdk),
+            GIT_CONFIG_GLOBAL=os.devnull,
+        )
+        base.update(env)
+        return subprocess.run(
+            ["bash", str(self.repo / "dev" / "perf" / "build.sh"), *args],
+            cwd=self.top,
+            capture_output=True,
+            text=True,
+            env=base,
+            timeout=120,
+        )
+
+    def record(self, out: Path) -> dict:
+        return json.loads((out / "harness.json").read_text())
+
+    def test_function_alignment_on_both_sides(self):
+        # Check the actual compiler arguments and record independently of self.flags, which
+        # is parsed from build.sh and would otherwise accept an accidentally removed flag.
+        for rev, name in (("worktree", "aligned-worktree"), (self.base, "aligned-ref")):
+            with self.subTest(rev=rev):
+                proc = self.build(rev, name)
+                self.assertEqual(proc.returncode, 0, proc.stderr)
+                argv = self.log.read_text().splitlines()
+                self.assertEqual(argv.count("-falign-functions=64"), 1)
+                recorded = self.record(self.top / name)["flags"].split()
+                self.assertEqual(recorded.count("-falign-functions=64"), 1)
+
+    def test_refusals(self):
+        for args, why in (
+            ((), "usage: build.sh REV|worktree OUT_DIR"),
+            (("worktree",), "usage"),
+            (("", "out"), "usage"),
+            (("worktree", "out", "extra"), "usage"),
+            (("no-such-revision", "out"), "no revision no-such-revision"),
+        ):
+            proc = self.build(*args)
+            self.assertEqual(proc.returncode, 2, (args, proc.stderr))
+            self.assertIn(why, proc.stderr)
+            self.assertFalse((self.top / "out").exists())
+        used = self.top / "used"
+        used.mkdir()
+        (used / "x").write_text("x")
+        proc = self.build("worktree", str(used))
+        self.assertEqual(proc.returncode, 2, proc.stderr)
+        self.assertIn("must be absent or an empty directory", proc.stderr)
+        self.assertEqual(os.listdir(used), ["x"])
+        self.assertFalse(self.log.exists())  # the compiler never ran
+        # a failing compile: the compiler's status, its message, no binary and no record
+        for rev in ("worktree", self.base):
+            out = self.top / f"failed-{rev}"
+            proc = self.build(rev, str(out), FAKE_CXX_FAIL="1")
+            self.assertEqual(proc.returncode, 1, proc.stderr)
+            self.assertIn("fake: error: does not compile", proc.stderr)
+            self.assertFalse((out / "harness").exists())
+            self.assertFalse((out / "harness.json").exists())
+
+    def test_failed_record_leaves_no_harness(self):
+        # the compile succeeds, the record's writer fails (before writing, or half-way): a
+        # harness without its record would be timed without the driver check, so none is left
+        for name, script in (
+            ("silent", "exit 1"),
+            ("partial", 'printf "{" > "$OUT.json"; exit 1'),
+        ):
+            (self.bin / "python3").write_text(f"#!/bin/sh\n{script}\n")
+            (self.bin / "python3").chmod(0o755)
+            for rev in ("worktree", self.base):
+                out = self.top / f"{name}-{rev}"
+                proc = self.build(rev, str(out))
+                self.assertEqual(proc.returncode, 1, (name, rev, proc.stderr))
+                kept = ["src"] if rev == self.base else []
+                self.assertEqual(sorted(os.listdir(out)), kept, (name, rev))
+                self.assertIn(
+                    f"-o {out / 'harness'}", self.log.read_text().replace("\n", " ")
+                )
+
+    def test_worktree_build_and_record(self):
+        (self.repo / "src" / "a.cpp").write_text("changed\n")
+        (self.repo / "src" / "new.cpp").write_text("new\n")
+        (self.top / "empty").mkdir()
+        # SDKROOT must name a real SDK on macOS: git there is a shim that reads it
+        sdkroot = "/sdkroot"
+        if platform.system() == "Darwin":
+            cmd = ["/usr/bin/xcrun", "--show-sdk-path"]
+            sdkroot = subprocess.run(cmd, capture_output=True, text=True).stdout.strip()
+        proc = self.build("worktree", "empty", SDKROOT=sdkroot)
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        out = self.top / "empty"
+        rec = self.record(out)
+        self.assertEqual(sorted(os.listdir(out)), ["harness", "harness.json"])
+        argv = self.log.read_text().splitlines()
+        src = sorted(str(p) for p in (self.repo / "src").glob("*.cpp"))
+        self.assertEqual(
+            argv,
+            [
+                *self.flags,
+                f"-I{self.repo}/include",
+                "dev/perf/harness.cpp",
+                *src,
+                "-o",
+                str(out / "harness"),
+            ],
+        )
+        perf = self.repo / "dev" / "perf"
+        want = {
+            "binary": str(out / "harness"),
+            "binary_sha256": hashlib.sha256(b"binary\n").hexdigest(),
+            "rev": "worktree",
+            "commit": self.head,
+            "dirty_core_paths": 2,
+            "core_sources_sha256": tree_digest(self.repo),
+            "driver_sha256": checkout_driver(perf),
+            "compiler": "fake clang version 1.0",
+            "flags": " ".join(self.flags),
+            "compiler_path": str(self.bin / "clang++"),
+            "cxx_env": None,
+            "isysroot": None,
+            "sdk": {
+                "path": str(self.sdk),
+                "version": "27.0",
+                "sdkroot_env": sdkroot,
+                "source": "xcrun --show-sdk-path / --show-sdk-version",
+            },
+            "deployment_target": {
+                "requested": None,
+                "effective_minos": "15.0",
+                "binary_sdk": "27.0",
+                "platform": "MACOS",
+                "raw": "Load command 9; cmd LC_BUILD_VERSION; platform MACOS; minos 15.0; sdk 27.0",
+                "source": "vtool -show-build",
+            },
+            "built_by": "dev/perf/build.sh",
+        }
+        self.assertEqual(rec, want)
+        self.assertIn(f"worktree {self.head[:12]} core ", proc.stdout)
+
+    def test_vtool_records_the_first_values_and_all_lines(self):
+        proc = self.build("worktree", "several", FAKE_VTOOL="several")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        target = self.record(self.top / "several")["deployment_target"]
+        self.assertEqual(
+            [target[k] for k in ("platform", "effective_minos", "binary_sdk")],
+            ["MACOS", "15.0", "27.0"],
+        )
+        self.assertEqual(
+            target["raw"],
+            "Load command 9; cmd LC_BUILD_VERSION; platform MACOS; minos 15.0; sdk 27.0; Load command 10; platform OTHER; minos 99.0; sdk 100.0",
+        )
+
+    def test_revision_build_with_cxx(self):
+        (self.repo / "src" / "a.cpp").write_text("uncommitted\n")  # not in the revision
+        cxx = str(self.bin / "mycxx")
+        proc = self.build(
+            self.base[:10],
+            "rev",
+            CXX=cxx,
+            MACOSX_DEPLOYMENT_TARGET="15.0",
+            FAKE_VTOOL="fail",
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        out = self.top / "rev"
+        rec = self.record(out)
+        extracted = sorted(
+            p.relative_to(out / "src").as_posix()
+            for p in (out / "src").rglob("*")
+            if p.is_file()
+        )
+        self.assertEqual(
+            extracted,
+            [
+                "include/.d/c.hpp",
+                "include/netgraph/core/a.hpp",
+                "src/.hidden",
+                "src/a.cpp",
+                "src/b.cpp",
+            ],
+        )
+        self.assertEqual((out / "src" / "src" / "a.cpp").read_text(), "a\n")
+        darwin = platform.system() == "Darwin"
+        flags = [*self.flags, *(["-isysroot", str(self.sdk)] if darwin else [])]
+        argv = self.log.read_text().splitlines()
+        self.assertEqual(
+            argv[: len(flags) + 2],
+            [*flags, f"-I{out}/src/include", "dev/perf/harness.cpp"],
+        )
+        self.assertEqual(
+            argv[len(flags) + 2 : -2],
+            [str(out / "src" / "src" / n) for n in ("a.cpp", "b.cpp")],
+        )
+        self.assertEqual(
+            (rec["rev"], rec["commit"], rec["dirty_core_paths"]),
+            (self.base[:10], self.base, 0),
+        )
+        self.assertEqual(rec["core_sources_sha256"], tree_digest(out / "src"))
+        # the first revision's tree, not HEAD's (extracted the same way for the comparison)
+        head = self.top / "head"
+        head.mkdir()
+        tar = subprocess.run(
+            ["git", "archive", self.head, "include", "src"],
+            cwd=self.repo,
+            check=True,
+            capture_output=True,
+        ).stdout
+        subprocess.run(["tar", "-x", "-C", str(head)], input=tar, check=True)
+        self.assertNotEqual(rec["core_sources_sha256"], tree_digest(head))
+        self.assertEqual((rec["cxx_env"], rec["flags"]), (cxx, " ".join(flags)))
+        self.assertEqual(rec["compiler_path"], cxx)  # CXX, not the PATH's clang++
+        self.assertEqual(rec["isysroot"], str(self.sdk) if darwin else None)
+        self.assertIsNone(rec["sdk"]["sdkroot_env"])
+        self.assertEqual(
+            rec["deployment_target"],
+            {
+                "requested": "15.0",
+                "effective_minos": None,
+                "binary_sdk": None,
+                "platform": None,
+                "raw": None,
+                "source": "no LC_BUILD_VERSION read (no vtool, or it printed none)",
+            },
+        )
+
+    def test_no_sdk(self):
+        # CXX without an SDK: refused on macOS; the clang++ shim needs none
+        proc = self.build("worktree", "cxx", CXX=str(self.bin / "clang++"), FAKE_SDK="")
+        if platform.system() == "Darwin":
+            self.assertEqual(proc.returncode, 2, proc.stderr)
+            self.assertIn("names no macOS SDK", proc.stderr)
+            self.assertFalse(self.log.exists())
+            # refused before OUT_DIR is made or a revision extracted into it, so the
+            # corrected retry can use the same OUT_DIR
+            for rev in ("worktree", self.base):
+                out = self.top / f"no-sdk-{rev}"
+                proc = self.build(
+                    rev, str(out), CXX=str(self.bin / "clang++"), FAKE_SDK=""
+                )
+                self.assertEqual(proc.returncode, 2, proc.stderr)
+                self.assertFalse(out.exists())
+                proc = self.build(rev, str(out))
+                self.assertEqual(proc.returncode, 0, proc.stderr)
+        else:
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+        proc = self.build("worktree", "shim", FAKE_SDK="")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        sdk = self.record(self.top / "shim")["sdk"]
+        self.assertEqual(
+            (sdk["path"], sdk["version"], sdk["source"]),
+            (
+                None,
+                None,
+                "no xcrun SDK on this host: the compiler's own system headers",
+            ),
+        )
+
+
+# The test rows appended to the harness's own: a constant digest (a slow and a fast iteration),
+# a digest that changes at the first or the second timed iteration, an iteration that throws (the
+# untimed first one or a timed one), and one row per setup check of aba_rows.hpp fed an input it
+# must refuse. The extra command test-times compares IterationTimes with the sorted list of the
+# same durations.
+HARNESS_TEST = r"""
+#include "aba_rows.hpp"
+
+#include <memory>
+#include <random>
+#include <stdexcept>
+
+using namespace abarows;
+
+namespace {
+// About 20,000 additions: an iteration well above the clock's resolution (a median of 0 is refused).
+Iter constant() {
+  return Iter([] {
+    volatile std::uint64_t x = 0;
+    for (int i = 0; i < 20000; ++i) x = x + 1;
+    return std::uint64_t {7};
+  });
+}
+
+Row check(const char* name, std::function<void()> f) {
+  return Row {name, "test", "a setup check that must fail", [f]() -> Iter { f(); return constant(); }};
+}
+
+std::shared_ptr<Graph> graph(const char* input) {
+  return std::make_shared<Graph>(abaapi::build(make_storage_input(input)));
+}
+
+// Durations below, at and above IterationTimes::kShort, many repeated, and more long ones than
+// its preallocated slots: every statistic the block line prints must equal the sorted list's.
+int test_times() {
+  std::mt19937_64 rng(5);
+  const std::uint64_t k = IterationTimes::kShort;
+  int cases = 0;
+  for (std::size_t n : {1, 2, 3, 10, 1001, 200000}) {
+    IterationTimes times;
+    std::vector<double> sorted;
+    for (std::size_t i = 0; i < n; ++i) {
+      const std::uint64_t pick = rng() % 4;
+      const std::uint64_t t = pick == 0 ? k - 1 + rng() % 2 : pick == 1 ? 700 + rng() % 20 : pick == 2 ? rng() % k : k + rng() % 1000000000;
+      const auto d = Clock::duration(Clock::rep(t));
+      times.add(d);
+      sorted.push_back(std::chrono::duration<double>(d).count());
+    }
+    times.finish();
+    std::sort(sorted.begin(), sorted.end());
+    double sum = 0;
+    for (double x : sorted) sum += x;
+    std::vector<std::size_t> ks = {0, n / 2, n - 1, (n - 1) / 2, std::size_t(0.1 * double(n - 1) + 0.5)};
+    for (int j = 0; j < 200; ++j) ks.push_back(std::size_t(rng() % n));
+    bool same = times.size() == n && times.sum() == sum;
+    for (std::size_t i : ks) same = same && times.at(i) == sorted[i];
+    if (!same) { std::printf("IterationTimes differs from the sorted list at n = %zu\n", n); return 1; }
+    ++cases;
+  }
+  std::printf("IterationTimes equals the sorted list in %d cases\n", cases);
+  return 0;
+}
+
+// Check every probe's complete delivery vector, not just the final bracket digest.
+int test_msd_epochs() {
+  auto network = abaapi::build(gen_clos(32, 16, 22));
+  auto el = abaapi::eligibility(network, {}, {});
+  std::mt19937 rng(23);
+  std::vector<std::pair<int, int>> demands;
+  std::vector<double> base;
+  while (demands.size() < 64) {
+    int s = int(rng() % 32), t = int(rng() % 32);
+    if (s != t) { demands.push_back({s, t}); base.push_back(double(1 + rng() % 5)); }
+  }
+  abaapi::ShortestPathsSeries fresh(network, el);
+  abaapi::ShortestPathsEpochSeries epochs(network, el, demands);
+  const auto uid = epochs.ledger.uid();
+  std::int64_t last_id = -1;
+  int probes = 0;
+  auto feasible = [&](double alpha) {
+    ++probes;
+    std::vector<double> offers(base.size());
+    for (std::size_t i = 0; i < base.size(); ++i) offers[i] = base[i] * alpha;
+    const auto expected = fresh.place_all(demands, offers);
+    const auto actual = epochs.place_all(offers);
+    if (actual != expected) throw std::runtime_error("MSD epoch probe differs from fresh ledger");
+    const auto records = epochs.ledger.records();
+    if (records.size() != 64 || epochs.ledger.uid() != uid || records.front().flow_id.second <= last_id)
+      throw std::runtime_error("MSD epochs did not retain the ledger and retire all previous records");
+    last_id = records.back().flow_id.second;
+    bool fits = true;
+    for (std::size_t i = 0; i < base.size(); ++i)
+      if (offers[i] - actual[i] > abaapi::grid_resolution()) fits = false;
+    return fits;
+  };
+  double lo = 0, hi = 0, alpha = 1;
+  if (feasible(alpha)) { lo = alpha; for (int k = 0; k < 32; ++k) { alpha *= 2; if (!feasible(alpha)) { hi = alpha; break; } lo = alpha; } }
+  else { hi = alpha; for (int k = 0; k < 32; ++k) { alpha /= 2; if (feasible(alpha)) { lo = alpha; break; } hi = alpha; } }
+  for (int k = 0; k < 32 && hi - lo > 0.01; ++k) { double mid = (lo + hi) / 2; (feasible(mid) ? lo : hi) = mid; }
+  for (const auto& policy : epochs.policies) {
+    policy->remove();
+    if (policy->program() || !policy->records().empty()) throw std::runtime_error("MSD remove left a visible epoch");
+  }
+  const auto carried = epochs.ledger.carried(), reserved = epochs.ledger.reserved();
+  if (!epochs.ledger.records().empty() ||
+      std::any_of(carried.begin(), carried.end(), [](auto n) { return n != 0; }) ||
+      std::any_of(reserved.begin(), reserved.end(), [](auto n) { return n != 0; }))
+    throw std::runtime_error("MSD remove did not restore the ledger");
+  std::printf("MSD epochs: 64 demands, %d probes, lo %.8f; every delivery vector equals fresh\n", probes, lo);
+  return 0;
+}
+}  // namespace
+
+int test_captured_sources() {
+  auto network=abaapi::captured_graph();
+  for(int mode:{0,1,2})for(bool incremental:{false,true}) {
+    const auto m=netgraph::core::kDomainLimit-1;
+    std::vector<netgraph::core::Amount> weights=mode==2 ? std::vector<netgraph::core::Amount>{m,m,m,m,m,0} : std::vector<netgraph::core::Amount>{2,1,3,1,2,0};
+    const std::vector<netgraph::core::NodeId> heads{0,1,2,3,4},destinations{5};
+    auto saved=netgraph::core::evaluate_demand(*network,heads,destinations,netgraph::core::EvaluationOptions{abaapi::captured_config(weights,mode!=0)}).program;
+    netgraph::core::FlowLedger ledger(network);
+    netgraph::core::FlowPolicy policy(ledger,heads,destinations,netgraph::core::FlowPolicyConfig{netgraph::core::Pinned{saved},netgraph::core::Admission::Lossy});
+    Digest expected;
+    unsigned __int128 total=0;
+    for(int i=0;i<32;++i) {
+      const netgraph::core::Amount offer=mode==2&&i<4 ? m : mode==2&&i==4 ? 5 : 17;
+      total=incremental ? total+static_cast<unsigned __int128>(offer) : static_cast<unsigned __int128>(offer);
+      const auto result=incremental ? policy.place(offer) : policy.replace(offer);
+      std::vector<unsigned __int128> share(5,0);
+      if(mode==1) {
+        const unsigned w[]={2,1,3,1,2};
+        for(unsigned __int128 u=0;u<total;++u) {
+          std::size_t best=0;
+          for(std::size_t j=1;j<5;++j)if(w[j]*(share[best]+1)>w[best]*(share[j]+1))best=j;
+          ++share[best];
+        }
+      } else for(std::size_t j=0;j<5;++j)share[j]=total/5+(j<total%5);
+      for(std::size_t j=0;j<5;++j) {
+        const auto actual=*result.by_source[j].offered;
+        if(((static_cast<unsigned __int128>(actual.hi)<<64)|actual.lo)!=share[j])throw std::runtime_error("captured-source series quota mismatch");
+      }
+      abaapi::add_rows(expected,result);
+    }
+    if(abaapi::captured_series(network,mode,incremental)!=expected.h)throw std::runtime_error("captured-source timing row omits or changes work");
+  }
+  std::puts("captured sources: all 32-step ordinary/wide histories and row digests match");
+  return 0;
+}
+
+int main(int argc, char** argv) {
+  if (argc == 2 && std::string(argv[1]) == "test-captured-sources") return test_captured_sources();
+  if (argc == 2 && std::string(argv[1]) == "test-times") return test_times();
+  if (argc == 2 && std::string(argv[1]) == "test-msd-epochs") return test_msd_epochs();
+  auto r = rows();
+  r.push_back({"test.constant", "test", "every iteration the same digest", [] { return constant(); }});
+  r.push_back({"test.fast", "test", "every iteration the same digest, at once", [] {
+                 return Iter([] { return std::uint64_t {7}; });
+               }});
+  r.push_back({"test.changes", "test", "the digest changes at the second timed iteration", [] {
+                 auto n = std::make_shared<int>(0);
+                 return Iter([n] { return std::uint64_t(++*n > 2); });
+               }});
+  r.push_back({"test.changes_first", "test", "the digest changes at the first timed iteration", [] {
+                 auto n = std::make_shared<int>(0);
+                 return Iter([n] { return std::uint64_t(++*n > 1); });
+               }});
+  r.push_back({"test.throws_first", "test", "the untimed first iteration throws", []() -> Iter {
+                 return Iter([]() -> std::uint64_t { throw std::runtime_error("the first iteration failed"); });
+               }});
+  r.push_back({"test.throws", "test", "the second timed iteration throws", [] {
+                 auto n = std::make_shared<int>(0);
+                 return Iter([n]() -> std::uint64_t {
+                   if (++*n > 2) throw std::runtime_error("an iteration failed");
+                   return 0;
+                 });
+               }});
+  r.push_back(check("test.query_input", [] {
+    auto a = gen_random(16384, 8, 8);  // spf.dag.far16k's arrays, one cost changed
+    a.cost[0] += 1;
+    require_frozen(a, kFar16kInput, "far16k");
+  }));
+  r.push_back(check("test.storage_cost", [] {
+    auto a = make_storage_input("width65536");
+    a.cost[0] = a.cost[0] == 65534 ? 65535 : 65534;  // the shape's counts unchanged, the digest not
+    checked_storage_input("width65536", a);
+  }));
+  r.push_back(check("test.storage_capacity", [] {
+    auto a = make_storage_input("width65536");
+    a.cap[0] += 1;  // only the full-content digest sees a capacity
+    checked_storage_input("width65536", a);
+  }));
+  r.push_back(check("test.storage_unknown", [] { checked_storage_input("nonesuch", make_storage_input("width65536")); }));
+  r.push_back(check("test.roots_rule", [] { frozen_roots("spf.to.width65536", 1000); }));
+  r.push_back(check("test.roots_unknown", [] { frozen_roots("nonesuch", 16384); }));
+  // the library's width wrong (wgrid256's graph: W = 32, buckets), the input's right
+  r.push_back(check("test.queue_library", [] { require_queue(*graph("wgrid256"), make_storage_input("width65536"), 65536, true); }));
+  // the library's choice right, the input's width wrong
+  r.push_back(check("test.queue_input", [] { require_queue(*graph("width65536"), make_storage_input("width65537"), 65536, true); }));
+  // the width right everywhere, buckets or heap wrong
+  r.push_back(check("test.queue_kind", [] { require_queue(*graph("width65536"), make_storage_input("width65536"), 65536, false); }));
+  return harness_main(argc, argv, r);
+}
+"""
+
+
+class Harness(unittest.TestCase):
+    """The harness's driver (harness_main) and the setup checks of aba_rows.hpp, compiled
+    unoptimised with this checkout's Core and the test rows above."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.tmp = tempfile.TemporaryDirectory()
+        top = Path(cls.tmp.name)
+        (top / "harness_test.cpp").write_text(HARNESS_TEST)
+        cls.binary = top / "harness_test"
+        cmd = [
+            "clang++",
+            "-std=c++20",
+            "-O0",
+            "-Wall",
+            "-Wextra",
+            f"-I{REPO / 'include'}",
+            f"-I{HERE}",
+            str(top / "harness_test.cpp"),
+            *sorted(glob.glob(str(REPO / "src" / "*.cpp"))),
+            "-o",
+            str(cls.binary),
+        ]
+        cls.compiled = subprocess.run(cmd, capture_output=True, text=True)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.tmp.cleanup()
+
+    def harness(self, *args: str) -> subprocess.CompletedProcess:
+        # a timeout turns a harness that never stops (a count it should refuse) into a failure
+        cmd = [str(self.binary), *args]
+        return subprocess.run(cmd, capture_output=True, text=True, timeout=60)
+
+    def test_captured_source_rows_match_independent_quotas(self):
+        result = subprocess.run(
+            [str(self.binary), "test-captured-sources"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertIn("all 32-step", result.stdout)
+
+    def test_compiles_without_a_diagnostic(self):
+        self.assertEqual(self.compiled.returncode, 0, self.compiled.stderr[-2000:])
+        self.assertEqual(self.compiled.stderr, "")
+
+    def test_list(self):
+        proc = self.harness("aba-list")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        rows = aba.row_list(proc.stdout.encode(), "aba-list")
+        real = {k: v for k, v in rows.items() if not k.startswith("test.")}
+        self.assertEqual(len(real), 101)
+        sums = sha256sums(HERE / "queries")
+        lists = {}
+        for name in sums:
+            rec = json.loads((HERE / "queries" / name).read_text())
+            lists[rec["row"]] = f"queries/{name} sha256:{sums[name]}"
+        self.assertEqual(
+            {k: v["queries"] for k, v in real.items() if "queries" in v}, lists
+        )
+        self.assertTrue(all(v["group"] and v["desc"] for v in real.values()))
+
+    def test_blocks(self):
+        proc = self.harness("aba-run", "test.constant", "5")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        run = aba.parse_block(proc.stdout.encode(), "aba-run", "test.constant")
+        self.assertEqual((run["iterations"], run["digest"]), (5, "0000000000000007"))
+        self.assertLessEqual(run["min_s"], run["median_s"])
+        self.assertLessEqual(run["median_s"], run["max_s"])
+        proc = self.harness("aba-calibrate", "test.constant", "0.05")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        cal = aba.parse_block(proc.stdout.encode(), "aba-calibrate", "test.constant")
+        self.assertGreaterEqual(cal["block_s"], 0.05)
+        # its own peak RSS in bytes (macOS reports bytes, Linux KiB): a process that loaded the
+        # driver holds some MiB, never a GiB (a KiB/byte mix-up is a factor of 1024); it starts
+        # no child
+        for rec in (run, cal):
+            self.assertTrue(MIB < rec["rss_self_bytes"] < 1024 * MIB, rec)
+            self.assertEqual(rec["rss_children_bytes"], 0)
+        # every real row, one timed iteration: its setup (the frozen-input, root and queue
+        # checks included) and its adapter calls run against this checkout's Core
+        listed = aba.row_list(self.harness("aba-list").stdout.encode(), "aba-list")
+        real = [row for row in listed if not row.startswith("test.")]
+        with concurrent.futures.ThreadPoolExecutor(os.cpu_count() or 1) as pool:
+            procs = list(pool.map(lambda row: self.harness("aba-run", row, "1"), real))
+        self.assertEqual(len(procs), 101)
+        for row, proc in zip(real, procs, strict=True):
+            self.assertEqual(proc.returncode, 0, (row, proc.stderr))
+            self.assertEqual(
+                aba.parse_block(proc.stdout.encode(), row, row)["iterations"], 1
+            )
+
+    def test_list_rows_equal_their_references(self):
+        # an ORDERED list does the scalar calls' work (the same digest), and the ring's list gives
+        # the one program's amounts (64 policies against one: not the same work, the same digest);
+        # the eight Clos demands share no link (their own
+        # sources, destination and spine links), so the SIMULTANEOUS list's joint evaluation of
+        # pooled demands gives the kernel's amounts too
+        def digest(row):
+            proc = self.harness("aba-run", row, "1")
+            self.assertEqual(proc.returncode, 0, (row, proc.stderr))
+            return aba.parse_block(proc.stdout.encode(), row, row)["digest"]
+
+        self.assertEqual(digest("batch.ordered.clos"), digest("batch.scalar.clos"))
+        self.assertEqual(
+            digest("batch.simultaneous.ring"), digest("program.ring.lossy")
+        )
+        self.assertEqual(
+            digest("batch.simultaneous.clos"), digest("batch.ordered.clos")
+        )
+
+    def test_msd_epoch_row_matches_fresh_probes(self):
+        proc = self.harness("test-msd-epochs")
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        self.assertIn("every delivery vector equals fresh", proc.stdout)
+        results = []
+        for row in ("msd.loop", "msd.loop.epochs"):
+            proc = self.harness("aba-run", row, "2")
+            self.assertEqual(proc.returncode, 0, (row, proc.stderr))
+            results.append(aba.parse_block(proc.stdout.encode(), row, row)["digest"])
+        self.assertEqual(*results)
+
+    def test_concurrency_rows_have_fixed_work_and_equal_serial_results(self):
+        expected = {
+            "concurrency.place_zero": 40000,
+            "concurrency.delivered": 40000,
+            "concurrency.program": 10000,
+            "concurrency.config": 10000,
+            "concurrency.two_ledgers_serial": 2048,
+            "concurrency.two_ledgers_parallel": 2048,
+        }
+        for row, digest in expected.items():
+            proc = self.harness("aba-run", row, "1")
+            self.assertEqual(proc.returncode, 0, (row, proc.stderr))
+            result = aba.parse_block(proc.stdout.encode(), row, row)
+            self.assertEqual(result["digest"], f"{digest:016x}")
+
+    def test_memory_does_not_grow_with_the_count(self):
+        # the per-iteration bookkeeping is allocated before the setup and does not grow: the
+        # peak of a block of 2,000,000 iterations is that of a block of 1,000 (keeping every
+        # time in a list would add 16 MiB, and a faster candidate would hold more of it)
+        peaks = []
+        for count in ("1000", "2000000"):
+            proc = self.harness("aba-run", "test.fast", count)
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            # json, not parse_block: an iteration this fast has a median of 0 clock ticks
+            rec = json.loads(proc.stdout)
+            self.assertEqual(rec["iterations"], int(count))
+            peaks.append(rec["rss_self_bytes"])
+        self.assertLess(peaks[1] - peaks[0], MIB / 4, peaks)
+
+    def test_statistics_equal_the_sorted_list(self):
+        proc = self.harness("test-times")
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertEqual(
+            proc.stdout, "IterationTimes equals the sorted list in 6 cases\n"
+        )
+
+    def test_exit_statuses(self):
+        usage = "usage: harness aba-list | aba-run <row> <iterations> | aba-calibrate <row> <seconds>"
+        for args in (
+            (),
+            ("aba-list", "x"),
+            ("aba-run",),
+            ("aba-run", "test.constant"),
+            ("aba-run", "test.constant", "1", "x"),
+            ("aba-bogus", "test.constant", "1"),
+            ("aba-run", "test.constant", "0"),
+            ("aba-run", "test.constant", "-1"),
+            ("aba-run", "test.constant", "1x"),
+            ("aba-run", "test.constant", ""),
+            ("aba-run", "test.constant", "99999999999999999999"),
+            ("aba-calibrate", "test.constant", "0"),
+            ("aba-calibrate", "test.constant", "nan"),
+            ("aba-calibrate", "test.constant", "inf"),
+            ("aba-calibrate", "test.constant", "1e999"),
+            ("aba-calibrate", "test.constant", "0.1s"),
+        ):
+            proc = self.harness(*args)
+            self.assertEqual((proc.returncode, proc.stdout), (2, ""), args)
+            self.assertEqual(proc.stderr.strip(), usage, args)
+        for args, status, why in (
+            (("aba-run", "nonesuch", "1"), 2, "unknown row nonesuch"),
+            (
+                ("aba-run", "test.changes", "5"),
+                3,
+                "nondeterministic digest in test.changes at iteration 1",
+            ),
+            (
+                ("aba-calibrate", "test.changes", "1"),
+                3,
+                "nondeterministic digest in test.changes",
+            ),
+            (
+                ("aba-run", "test.changes_first", "5"),
+                3,
+                "nondeterministic digest in test.changes_first at iteration 0",
+            ),
+            (("aba-run", "test.throws", "5"), 1, "FAIL: an iteration failed"),
+            # a library failure in the untimed first iteration is an iteration's, not setup's
+            (
+                ("aba-run", "test.throws_first", "5"),
+                1,
+                "FAIL: the first iteration failed",
+            ),
+        ):
+            proc = self.harness(*args)
+            self.assertEqual((proc.returncode, proc.stdout), (status, ""), args)
+            self.assertIn(why, proc.stderr)
+
+    def test_setup_checks_refuse(self):
+        for row, why in (
+            (
+                "test.query_input",
+                "the frozen list far16k was not frozen from this row's arrays",
+            ),
+            (
+                "test.storage_cost",
+                "storage input width65536 differs from its frozen shape",
+            ),
+            (
+                "test.storage_capacity",
+                "storage input width65536 differs from its frozen shape",
+            ),
+            ("test.storage_unknown", "storage input nonesuch is not frozen"),
+            (
+                "test.roots_rule",
+                "the frozen roots of spf.to.width65536 differ from the rule",
+            ),
+            ("test.roots_unknown", "no frozen roots for nonesuch"),
+            (
+                "test.queue_library",
+                "queue choice: the adapter reports W = 32 (buckets), the input gives"
+                " W = 65536, the row expects W = 65536 (buckets)",
+            ),
+            (
+                "test.queue_input",
+                "queue choice: the adapter reports W = 65536 (buckets), the input gives"
+                " W = 65537, the row expects W = 65536 (buckets)",
+            ),
+            (
+                "test.queue_kind",
+                "queue choice: the adapter reports W = 65536 (buckets), the input gives"
+                " W = 65536, the row expects W = 65536 (heap)",
+            ),
+        ):
+            proc = self.harness("aba-run", row, "1")
+            self.assertEqual((proc.returncode, proc.stdout), (4, ""), row)
+            self.assertIn(f"row {row} setup failed: {why}", proc.stderr)
+
+
+class FrozenFiles(unittest.TestCase):
+    """The frozen inputs: the SHA256SUMS files hash the frozen JSON files, and the values
+    compiled into aba_rows.hpp are exactly theirs."""
+
+    QUERIES = HERE / "queries"
+    LISTS = {  # list -> (its pairs constant or None, its input digest constant)
+        "near65k": ("kNear65k", "kNear65kInput"),
+        "far16k": ("kFar16k", "kFar16kInput"),
+        "canonical16k": ("kCanonical16k", "kCanonical16kInput"),
+        "targetset_clos": (None, "kTargetSetInput"),
+    }
+
+    def block(self, name: str) -> str:
+        text = (HERE / "aba_rows.hpp").read_text()
+        begin, end = f"// BEGIN {name} (", f"// END {name}\n"
+        self.assertEqual((text.count(begin), text.count(end)), (1, 1), name)
+        return text[text.index(begin) : text.index(end)]
+
+    def test_hashes(self):
+        for directory, files in (
+            (self.QUERIES, [f"{k}.json" for k in self.LISTS]),
+            (self.QUERIES / "storage", ["inputs.json"]),
+        ):
+            got = sha256sums(directory)
+            self.assertEqual(sorted(got), sorted(files), directory)
+            self.assertEqual(
+                sorted(p.name for p in directory.glob("*.json")), sorted(files)
+            )
+            for name, sha in got.items():
+                want = hashlib.sha256((directory / name).read_bytes()).hexdigest()
+                self.assertEqual(sha, want, name)
+
+    def test_query_lists_block(self):
+        block = self.block("FROZEN QUERY LISTS")
+        sums = sha256sums(self.QUERIES)
+        listed = re.findall(
+            r'\{"([^"]+)", "queries/([^"]+) sha256:([0-9a-f]{64})"\}', block
+        )
+        self.assertEqual(len(listed), len(self.LISTS))
+        counts = []
+        for key, (pairs_name, digest_name) in self.LISTS.items():
+            rec = json.loads((self.QUERIES / f"{key}.json").read_text())
+            self.assertEqual(rec["list"], key)
+            self.assertIn((rec["row"], f"{key}.json", sums[f"{key}.json"]), listed)
+            digest = re.search(rf"\b{digest_name} = (\d+)ULL;", block)
+            self.assertEqual(int(digest.group(1)), rec["input"]["input_digest"], key)
+            if pairs_name is None:
+                found = re.search(
+                    r"std::array<int, (\d+)> kTargetSetDestinations\{([^}]*)\};", block
+                )
+                values = [int(x) for x in found.group(2).split(",")]
+                self.assertEqual(values, rec["destinations"], key)
+            else:
+                found = re.search(
+                    rf"std::array<std::pair<int, int>, (\d+)> {pairs_name}\{{\{{(.*?)\}}\}};",
+                    block,
+                    re.S,
+                )
+                values = [
+                    [int(s), int(t)]
+                    for s, t in re.findall(r"\{(\d+), (\d+)\}", found.group(2))
+                ]
+                self.assertEqual(values, rec["pairs"], key)
+            self.assertEqual(int(found.group(1)), len(values), key)
+            counts.append(len(values))
+        self.assertEqual(sorted(counts), [8, 8, 50, 64])  # no list can be empty
+
+    def test_storage_block(self):
+        block = self.block("FROZEN STORAGE INPUTS")
+        reg = json.loads((self.QUERIES / "storage" / "inputs.json").read_text())
+        fields = list(next(iter(reg["inputs"].values()))["shape"])
+        inputs, roots_part = block.split("kStorageRoots")
+        compiled = re.findall(r'\{"([^"]+)", \{([^}]*)\}\},', inputs)
+        self.assertEqual([name for name, _ in compiled], list(reg["inputs"]))
+        for name, values in compiled:
+            shape = reg["inputs"][name]["shape"]
+            self.assertEqual(list(shape), fields, name)
+            want = [
+                ("true" if v else "false") if isinstance(v, bool) else str(int(v))
+                for v in shape.values()
+            ]
+            got = [v.strip().removesuffix("ULL") for v in values.split(",")]
+            self.assertEqual(got, want, name)
+        roots = re.findall(r'\{"([^"]+)", \{([^}]*)\}\},', roots_part)
+        searches = {r: s for r, s in reg["rows"].items() if s["kind"] == "search"}
+        self.assertEqual([r for r, _ in roots], list(searches))
+        for row, values in roots:
+            n = reg["inputs"][searches[row]["input"]]["shape"]["n"]
+            rule = [(i * 997 + 1) % n for i in range(8)]
+            self.assertEqual([int(v) for v in values.split(",")], rule, row)
+            self.assertEqual(searches[row]["roots"], rule, row)
+        # every row of the registry is an input's row, and the counts are the frozen ones
+        self.assertEqual(
+            sorted(reg["rows"]),
+            sorted(r for v in reg["inputs"].values() for r in v["rows"]),
+        )
+        self.assertEqual((len(compiled), len(reg["rows"]), len(roots)), (17, 20, 6))
+
+    def test_construct_table(self):
+        # the storage construction rows' table in aba_rows.hpp: each row on its registry input
+        reg = json.loads((self.QUERIES / "storage" / "inputs.json").read_text())
+        text = (HERE / "aba_rows.hpp").read_text()
+        start = text.index("const C constructs[] = {")
+        table = re.findall(
+            r'\{"(construct\.[^"]+)", "([^"]+)", "',
+            text[start : text.index("};", start)],
+        )
+        want = {
+            r: s["input"] for r, s in reg["rows"].items() if s["kind"] == "construct"
+        }
+        self.assertEqual(dict(table), want)
+        self.assertEqual(len(table), 14)
+
+    def test_search_table(self):
+        # the storage search rows' table in aba_rows.hpp: the registry's input, direction and
+        # queue, and every width up to 65,536 on the buckets, every wider one on the heap
+        reg = json.loads((self.QUERIES / "storage" / "inputs.json").read_text())
+        searches = {r: s for r, s in reg["rows"].items() if s["kind"] == "search"}
+        text = (HERE / "aba_rows.hpp").read_text()
+        table = re.findall(
+            r'\{"([a-z]+\.[^"]+)", "([^"]+)", (true|false), (\d+), (true|false), "',
+            text,
+        )
+        self.assertEqual(sorted(r for r, *_ in table), sorted(searches))
+        for row, inp, reverse, width, buckets in table:
+            spec = searches[row]
+            self.assertEqual(spec["input"], inp, row)
+            self.assertEqual(
+                spec["direction"], "reverse" if reverse == "true" else "forward", row
+            )
+            self.assertEqual(
+                spec["queue"], {"width": int(width), "buckets": buckets == "true"}, row
+            )
+            self.assertEqual(int(width) <= 65536, buckets == "true", row)
+            shape = reg["inputs"][inp]["shape"]
+            self.assertEqual(shape["max_cost"] // shape["gcd"] + 1, int(width), row)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/dev/proofs/README.md b/dev/proofs/README.md
new file mode 100644
index 0000000..08e531c
--- /dev/null
+++ b/dev/proofs/README.md
@@ -0,0 +1,234 @@
+# Lean proofs: rules for contributors
+
+`proofs/` is a Lean 4 project that states parts of the library's mathematical model and proves
+properties of it; Lean checks every step of each proof. This page gives the rules a theorem
+meets before it is accepted, and how the checks and the release use the proofs. The commands
+are in [proofs/README.md](../../proofs/README.md); the explained theorems are under
+[docs/formal/theorems/](../../docs/formal/theorems/round-robin.md). Ordinary native and Python
+development does not need Lean, and `make check` does not run the proofs.
+
+## What a proof shows
+
+[docs/semantics.md](../../docs/semantics.md) is the statement of what the library computes. A
+Lean definition expresses a selected part of it, and each theorem states its assumptions
+exactly. When the contract, the model and the code disagree, review the three together; a proof
+never changes a default, an order, a supported domain or a result on its own.
+
+Three different claims need three different kinds of evidence:
+
+| Claim | Evidence it needs |
+| --- | --- |
+| A property holds for the mathematical model | A reviewed statement and a Lean proof checked by Lean's kernel, with audited dependencies |
+| A solver's result for one input meets its objective | A certificate for that exact input, accepted by a checker that is itself proved sound; the compiled checker and its input decoding stay trusted assumptions |
+| The C++ code implements the model on its whole supported domain | A refinement proof connecting the code and its machine semantics to the model |
+
+The project gives the first kind only. Comparisons of the model with the native package (the
+bridge, below) check the tested inputs exactly; they do not give the third claim. A proof about
+the model says nothing about native exception safety, memory safety, locking or caching. Never
+describe the package as "formally verified": name the model property that is proved.
+
+## Files
+
+```text
+proofs/README.md                     commands, for a checkout and for the source archive
+proofs/lean-toolchain                exact Lean release (mathlib's own pin, copied byte for byte)
+proofs/lakefile.toml                 Lake package, mathlib at an exact Git revision
+proofs/lake-manifest.json            every transitive dependency revision
+proofs/NetGraphCore.lean             imports every model and proof module
+proofs/NetGraphCore/Apportionment/   the round-robin model and its theorems
+proofs/Checks.lean                   imports every check module
+proofs/Checks/                       audit program, examples, Python inventory checker (audit.py)
+proofs/theorems.json                 accepted theorems and their pinned digests
+proofs/cases.json                    example inputs and expected outputs, derived independently
+docs/formal/theorems/                plain explanation of each theorem and its proof
+dev/proofs/run.sh                    entry point: check, replay, test, bridge, record
+dev/proofs/test_tool.py              negative controls of the gate
+dev/proofs/bridge.py                 exact comparisons with an installed native wheel
+dev/proofs/replay_report.py          evidence file of the kernel replay
+dev/proofs/package.py                source archive and wheel contents, published-file identity
+.github/workflows/proofs.yml         CI jobs: Lean proofs, Lean distribution, Lean bridge
+```
+
+A new module directory under `proofs/NetGraphCore/` is created with its first definitions. Scratch
+arguments, review notes, timing logs and abandoned models stay out of the project.
+
+## What ships where
+
+| Distribution | Proof content |
+| --- | --- |
+| Git checkout and version tag | Everything above |
+| Source archive (sdist) | `proofs/` without `proofs/.lake/`, and `docs/`, including the explanations; no `dev/` |
+| Wheel | No proof sources, Lean, mathlib or proof build products |
+| `pip install`, CMake, run time | Lean is never installed or run; building the library does not build the proofs |
+| CI evidence | Reports are workflow artifacts of one commit, never shipped |
+
+The source archive's file rule is `sdist.include` and `sdist.exclude` in `pyproject.toml`;
+`dev/stubs/check_contents.py` repeats it independently, and `make stubs-check` and
+`dev/proofs/package.py` compare the built archive with it. Because the archive's file list is
+explicit, the `/proofs/.lake/` line in `.gitignore` alone does not keep Lake's dependencies and
+build products out: the sdist exclusion does. Reports go to `build/proofs/`, which neither git
+nor the archive takes.
+
+The archive holds every local file its proof audit reads (the Lean sources, `proofs/Checks/`,
+the inventory, the explanations and the mapped semantic and native files) and needs nothing
+from `dev/`, `.git` or a sibling checkout. Lean and the pinned dependencies are downloaded.
+
+## Adding or changing a theorem
+
+1. Find the rule in `docs/semantics.md`, who calls it and the intended claim. List the exact
+   assumptions, the degenerate cases (zero, empty, all-zero weights) and known counterexamples.
+   Settle an ambiguity in the contract before choosing a convenient formal statement.
+2. Write the plain explanation of the statement and of the proof first (next section), and have
+   the definitions and statement reviewed before the Lean proof. Check the expanded types and
+   assumptions, that the intended domain is not empty, and member identity and exact integer
+   rules. Use concrete cases that satisfy the assumptions and cases that break a necessary one.
+3. Write the simple model, then the supporting lemmas, then the theorem. Keep the definitions
+   that state what is computed separate from any faster evaluator and from the proof itself.
+   No unfinished proof enters the project.
+4. Add the theorem to `proofs/theorems.json`, import its module from its root file, and add its
+   examples to `proofs/cases.json` with expected values derived by hand, never generated from
+   Lean or from the native code. A comparison with the native code gets a plausible wrong variant
+   that the comparison rejects.
+5. Run `bash dev/proofs/run.sh check`, `replay` and `test`, and `bridge` for a connected theorem.
+   A change to native code still runs its own checks under `AGENTS.md`; a proof replaces none.
+6. Get an independent review of the statement, definitions, domain and evidence, by a reviewer
+   able to check the mathematical argument, and the readability review described below. The
+   review keeps what is proved about the model apart from evidence about the implementation.
+7. Land the definitions, proofs, inventory, explanations, cases and any contract change together.
+
+A theorem is accepted when it has all of the following:
+
+- a statement reviewed against `docs/semantics.md`, with its domain written in `theorems.json`;
+- a Lean proof that builds with warnings as errors and depends only on the standard axioms;
+- a plain explanation of the statement and the proof, with a worked example and a boundary
+  example, and a failing case for every assumption that can fail;
+- doc comments on every project declaration, private helpers included;
+- its pins recorded in `theorems.json` and the gate passing (`check`, `replay`, `test`, and
+  `bridge` when it is connected to native code).
+
+Changing native code can leave a theorem true but break its link to the implementation;
+changing the model or a dependency can invalidate the proof evidence. In either case review the
+affected records; a green report from older inputs does not carry over.
+
+## Plain explanations
+
+Every theorem and its proof, supporting lemmas included, is explained so that an engineer who
+knows the library, has no mathematical training and does not read Lean can follow it. This is a
+condition of acceptance, not documentation added afterwards. Each theorem has its own section in
+a page under `docs/formal/theorems/`, marked by an anchor named after its ID
+(`<a id="NGC-AP-001"></a>`). [round-robin.md](../../docs/formal/theorems/round-robin.md) shows
+the expected form. A section explains:
+
+- the practical question and the result in ordinary words: what is split, carried, bounded or
+  kept, and why it matters to a caller;
+- every symbol and term at first use, with units, and each assumption as a concrete operating
+  condition, zero and empty cases included;
+- a small worked example with its actual inputs, intermediate steps and result, checked by an
+  executable case;
+- the proof as a sequence of steps: what is known, why the next conclusion follows and which
+  earlier fact it uses; for an induction, a bound or a transformation, the reasoning itself, not
+  only the name of the technique;
+- each supporting lemma's meaning and why it is needed, and each mathlib fact used, in plain
+  words where it is used;
+- the formal declaration and the library behaviour it describes, the conditions under which it
+  applies, and a concrete failing case for each necessary restriction.
+
+Examples answer a concrete question. Each theorem has a representative example and a boundary
+example; where an assumption can fail, a contrasting example shows the failure. Choose small
+inputs that expose the rule (unequal weights, an explicit member order where ties matter, exact
+units), explain every input, step and output so a reader can redo the calculation by hand, derive
+the expected values before running any code, and compare outputs exactly. A formula, a code block
+or "it is easy to see" without a walkthrough does not count.
+
+In Lean, every definition and theorem has a doc comment saying what it means in ordinary words,
+and each substantive proof block has a comment naming its reasoning step. Explanations and
+comments follow the actual proof; they never state a different rule or hide an assumption behind
+an analogy.
+
+The checker enforces doc comments, explanation anchors and the examples. A human reviewer checks
+the rest: an independent reader restates the result, its conditions and why it holds without
+reading Lean, recalculates the examples and says what each one shows. Missing, misleading or
+unexplained examples block acceptance even when Lean accepts the proof.
+
+## Modelling rules
+
+- Prove properties over unbounded integers and, separately, that the machine values stay in
+  range: amounts, cumulative counters, products, intermediate sums, sentinels and refusal limits.
+  A proof over natural numbers does not show that a C++ expression cannot overflow. Rounding of
+  floating-point inputs and outputs is not covered unless a theorem states it.
+- A graph model keeps edge identity: parallel edges, self-loops, the EdgeId order, and the
+  difference between an edge of capacity 0 and an excluded edge.
+- Do not add theorems that hold only because of the choice of a type.
+
+## The checker's pins
+
+`proofs/theorems.json` lists accepted theorems only, each with a stable ID (`NGC-AP-001`), its
+module and declaration, a short claim, its domain, the semantic sections it rests on (by
+heading), its explanation and anchor, its example IDs, and its implementation status: `tested`
+(compared with native code by a named bridge) or `unconnected`. Planned work is not listed.
+
+The audit (`lake exe proof-audit` with `proofs/Checks/audit.py`) builds digests from the built
+Lean environment and compares them with the recorded ones: the elaborated statement, the type and
+body of every project definition it depends on, the explanation page, the cited semantic
+sections, the cited native source files, the toolchain and dependency pins, and the checker's own
+sources. Any change fails the check until the record is reviewed and recorded again. The native
+digests cover whole files, so even an edit that keeps behaviour needs a review of the mapping.
+
+The check also fails on a missing or duplicate ID, an unresolved declaration, an empty inventory,
+a Lean source not listed or not imported, a missing explanation or anchor, a missing doc comment,
+a declaration outside the project namespace, examples that differ from `cases.json`, and missing
+evidence. A proof may depend only on the axioms `propext`, `Classical.choice` and `Quot.sound`;
+`sorry`, project axioms, `native_decide`, `unsafe` code, options that skip the kernel and
+commands that add declarations unchecked are refused. Audit metaprogramming lives only in
+`proofs/Checks/`.
+
+`bash dev/proofs/run.sh replay` also replays every declaration in a fresh environment with
+`leanchecker --fresh`, which reuses Lean's own kernel (it is not an independent kernel); the
+release requires it. Set `PROOFS_DEPENDENCY_ORIGIN` truthfully (`cache+local`, `source` or
+`mixed`).
+
+`bash dev/proofs/run.sh test` runs the gate's negative controls on a disposable copy: a weakened
+definition or statement, a weakened definition imported from another module, an imported
+`sorry` or axiom, a kernel-skip option, an unimported module, an empty inventory, a missing
+theorem, changed semantic or native inputs, a missing anchor or doc comment (private and root
+helpers included), a declaration outside the namespace and a disabled audit must each fail with
+the expected message; a false theorem added with kernel checking skipped inside a check module
+passes the audit and must fail the replay. They test the gate, not the mathematics.
+
+`bash dev/proofs/run.sh record` rewrites the recorded digests after an intended change. It
+approves nothing: inspect the diff, get the mathematical and readability reviews, then run the
+checks. Never use it to make a drift failure go away; CI refuses it.
+
+## Pins
+
+The project pins one mathlib release by Git revision, Lean at the version that revision names,
+and every transitive revision in `lake-manifest.json`. Routine checks never run `lake update` or
+follow a branch; a mathlib cache download is a build aid, must match the pins, and is not proof
+evidence. Upgrading a pin is a reviewed change that rebuilds every proof and reruns the audit,
+the replay and the controls.
+
+## CI and release
+
+`.github/workflows/proofs.yml` ("Lean verification") runs on every pull request and every branch
+push, with no path filters, and can be started by hand. Its jobs:
+
+- **Lean proofs**: the check, the replay and the negative controls, on Ubuntu;
+- **Lean distribution**: builds the sdist and wheel with planted files in `proofs/.lake/` and
+  `build/proofs/`, checks their exact contents, extracts the archive into a directory without
+  `.git` or `dev/`, builds and audits the proofs there and replays them, and records the
+  archive's and wheels' SHA-256;
+- **Lean bridge**: installs that wheel and compares it exactly with the model cases.
+
+A pull request merges only when these three pass. For a version tag, `release.yml` calls the same
+workflow on the release's own sdist and wheels, and publication waits for it; the publish job
+checks again that the files it uploads are the ones whose proofs were checked. Push the release
+branch first and let the workflow pass there before pushing the tag
+([CONTRIBUTING.md](../../CONTRIBUTING.md), "Release Process").
+
+## References
+
+- Lean axioms and incomplete proofs: <https://lean-lang.org/doc/reference/latest/Axioms/>
+- Lake configuration and manifest: <https://lean-lang.org/doc/reference/latest/Build-Tools-and-Distribution/Lake/>
+- mathlib projects and cache: <https://leanprover-community.github.io/install/project>
+- Kernel replay checker: <https://github.com/leanprover/lean4checker>
+- Reusable GitHub workflows: <https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows>
diff --git a/dev/proofs/bridge.py b/dev/proofs/bridge.py
new file mode 100644
index 0000000..c8ad5e1
--- /dev/null
+++ b/dev/proofs/bridge.py
@@ -0,0 +1,177 @@
+"""Compare audited model cases with a specifically selected installed native wheel.
+
+The public calls cover ordered source injection and cumulative offers beyond 2^64.
+No claim of universal native refinement follows from these finite comparisons.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.metadata
+import importlib.util
+import json
+import sys
+import tomllib
+import zipfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def sha(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def exact(actual: object, expected: object, label: str) -> None:
+    if type(actual) is not type(expected):
+        raise ValueError(f"{label}: scalar/container type differs")
+    if isinstance(expected, list):
+        if len(actual) != len(expected):
+            raise ValueError(f"{label}: length differs")
+        for i, (left, right) in enumerate(zip(actual, expected, strict=True)):
+            exact(left, right, f"{label}[{i}]")
+    elif actual != expected:
+        raise ValueError(f"{label}: {actual!r} != {expected!r}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--proof-report", type=Path, required=True)
+    parser.add_argument("--wheel", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    spec = importlib.util.spec_from_file_location(
+        "proof_audit", ROOT / "proofs/Checks/audit.py"
+    )
+    audit = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(audit)
+    inventory = audit.read_json(ROOT / "proofs/theorems.json")
+    inputs = audit.preflight(inventory)
+    inputs["proofs/cases.json"] = sha((ROOT / "proofs/cases.json").read_bytes())
+    proof = audit.read_json(args.proof_report)
+    if (
+        proof.get("status") != "PASS"
+        or proof.get("inventory_sha256") != audit.digest(audit.canonical(inventory))
+        or proof.get("source_inputs") != dict(sorted(inputs.items()))
+        or proof.get("accepted") != [r["id"] for r in inventory["theorems"]]
+    ):
+        raise ValueError("bridge requires complete current proof evidence")
+
+    import _netgraph_core as native
+
+    import netgraph_core as ngc
+
+    expected_version = tomllib.loads((ROOT / "pyproject.toml").read_text())["project"][
+        "version"
+    ]
+    if importlib.metadata.version("netgraph-core") != expected_version:
+        raise ValueError("installed package version differs from this source tree")
+    # Check bytes, not just a version string: the selected wheel is the one under test.
+    with zipfile.ZipFile(args.wheel) as archive:
+        for module in (ngc, native):
+            path = Path(module.__file__).resolve()
+            if not path.is_relative_to(Path(sys.prefix).resolve()):
+                raise ValueError(
+                    f"module is not installed in the selected environment: {path}"
+                )
+            member = "netgraph_core/__init__.py" if module is ngc else path.name
+            if sha(path.read_bytes()) != sha(archive.read(member)):
+                raise ValueError(
+                    f"installed module differs from selected wheel: {member}"
+                )
+    cases = audit.read_json(ROOT / "proofs/cases.json")
+    checked = []
+    for case in cases["cases"]:
+        if case["kind"] != "rr":
+            continue
+        k = case["members"]
+        graph = ngc.Graph(k + 1, list(range(k)), [k] * k, [100] * k, [1] * k, 1.0)
+        policy = ngc.FlowPolicy(
+            ngc.FlowLedger(graph),
+            list(reversed(range(k))),
+            k,
+            ngc.FlowPolicyConfig(
+                routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY
+            ),
+        )
+        result = policy.place(case["total"])
+        exact(
+            [row.source for row in result.by_source],
+            list(range(k)),
+            case["id"] + " source order",
+        )
+        exact([row.offered for row in result.by_source], case["expected"], case["id"])
+        checked.append(case["id"])
+
+    graph = ngc.Graph(4, [0, 1, 2], [3, 3, 3], [1, 1, 1], [1, 2, 3], 1.0)
+    sp = ngc.FlowPolicy(
+        ngc.FlowLedger(graph),
+        [2, 0, 1],
+        3,
+        ngc.FlowPolicyConfig(
+            routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY
+        ),
+    )
+    program = sp.replace(0).program
+    pinned = ngc.FlowPolicy(
+        ngc.FlowLedger(graph),
+        [2, 0, 1],
+        3,
+        ngc.FlowPolicyConfig(
+            routing=ngc.Pinned(program), admission=ngc.Admission.LOSSY
+        ),
+    )
+    policies = [("ShortestPaths", sp), ("Pinned", pinned)]
+    for kind, policy in policies:
+        previous = [0, 0, 0]
+        for index, case in enumerate(cases["public_sequence"]):
+            result = policy.place(case["offer"])
+            exact(
+                [row.source for row in result.by_source],
+                [0, 1, 2],
+                f"{kind} source order {index}",
+            )
+            actual = [row.offered for row in result.by_source]
+            exact(result.offered, case["total"], f"{kind} total {index}")
+            exact(actual, case["expected"], f"{kind} shares {index}")
+            if index == 1:
+                exact(
+                    [a - b for a, b in zip(actual, previous, strict=True)],
+                    [0, 0, 1],
+                    f"{kind} continues the circle",
+                )
+            previous = actual
+    if cases["public_sequence"][-1]["total"] <= 2**64:
+        raise ValueError("public sequence no longer exercises the high word")
+    report = {
+        "status": "PASS",
+        "scope": "finite native comparisons, no universal refinement",
+        "proof_report_sha256": sha(args.proof_report.read_bytes()),
+        "inventory_sha256": proof["inventory_sha256"],
+        "source_inputs": proof["source_inputs"],
+        "interpreter": sys.executable,
+        "package": ngc.__file__,
+        "extension": native.__file__,
+        "version": importlib.metadata.version("netgraph-core"),
+        "extension_sha256": sha(Path(native.__file__).read_bytes()),
+        "wheel_sha256": sha(args.wheel.read_bytes()),
+        "round_robin_cases": checked,
+        "public_policies": [kind for kind, _ in policies],
+        "sequence_steps_per_policy": len(cases["public_sequence"]),
+        "largest_cumulative_offer": cases["public_sequence"][-1]["total"],
+        "not_covered": [
+            "all machine inputs",
+            "mod_u128 refinement",
+            "near-2^127 native execution",
+        ],
+    }
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
+    print(
+        f"Native bridge: PASS ({len(checked)} RR cases, {len(policies)} policies, {len(cases['public_sequence'])} steps each)"
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/proofs/package.py b/dev/proofs/package.py
new file mode 100644
index 0000000..761127c
--- /dev/null
+++ b/dev/proofs/package.py
@@ -0,0 +1,95 @@
+"""Check exact source/wheel payloads and bind release evidence to published bytes."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.util
+import json
+import tarfile
+import zipfile
+from pathlib import Path, PurePosixPath
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def sha(path: Path) -> str:
+    return hashlib.file_digest(path.open("rb"), "sha256").hexdigest()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--sdist", type=Path, required=True)
+    parser.add_argument("--wheel", type=Path, action="append", default=[])
+    parser.add_argument("--receipt", type=Path, required=True)
+    parser.add_argument("--extract", type=Path)
+    parser.add_argument("--verify", action="store_true")
+    args = parser.parse_args()
+    if args.verify:
+        report = json.loads(args.receipt.read_text())
+        if report["sdist"] != {"name": args.sdist.name, "sha256": sha(args.sdist)}:
+            raise ValueError(
+                "published sdist differs from the archive whose proofs were checked"
+            )
+        if {path.name: sha(path) for path in args.wheel} != report["wheels"]:
+            raise ValueError("published wheels differ from the checked release wheels")
+        print("Published artifact identities: PASS")
+        return
+    spec = importlib.util.spec_from_file_location(
+        "contents", ROOT / "dev/stubs/check_contents.py"
+    )
+    contents = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(contents)
+    with tarfile.open(args.sdist) as archive:
+        members = [member for member in archive if not member.isdir()]
+        tops = {PurePosixPath(member.name).parts[0] for member in members}
+        if len(tops) != 1:
+            raise ValueError("sdist has no single root")
+        source_names = []
+        for member in members:
+            name = PurePosixPath(member.name)
+            if (
+                not member.isfile()
+                or ".." in name.parts
+                or name.is_absolute()
+                or len(name.parts) < 2
+            ):
+                raise ValueError(f"unsafe/nonregular sdist entry: {member.name}")
+            source_names.append(str(PurePosixPath(*name.parts[1:])))
+        if len(set(source_names)) != len(source_names):
+            raise ValueError("duplicate sdist entry")
+        intended = contents.checkout_files(ROOT)
+        expected = {name for name in intended if contents.shipped(name)} | {"PKG-INFO"}
+        if set(source_names) != expected:
+            raise ValueError(
+                f"sdist payload differs: missing={sorted(expected - set(source_names))}, extra={sorted(set(source_names) - expected)}"
+            )
+        if args.extract:
+            if args.extract.exists() and any(args.extract.iterdir()):
+                raise ValueError("extract destination must be empty")
+            args.extract.mkdir(parents=True, exist_ok=True)
+            for member, relative in zip(members, source_names, strict=True):
+                output = args.extract / relative
+                output.parent.mkdir(parents=True, exist_ok=True)
+                output.write_bytes(archive.extractfile(member).read())
+                output.chmod(member.mode & 0o777)
+    for wheel in args.wheel:
+        with zipfile.ZipFile(wheel) as archive:
+            names = [name for name in archive.namelist() if not name.endswith("/")]
+        problems = contents.problems(names, source_names, intended)
+        if problems:
+            raise ValueError("; ".join(problems))
+    report = {
+        "sdist": {"name": args.sdist.name, "sha256": sha(args.sdist)},
+        "wheels": {path.name: sha(path) for path in args.wheel},
+        "sdist_members": sorted(source_names),
+    }
+    args.receipt.parent.mkdir(parents=True, exist_ok=True)
+    args.receipt.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
+    print(
+        f"Proof distribution payload: PASS ({len(source_names)} source files; {len(args.wheel)} wheels)"
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/proofs/replay_report.py b/dev/proofs/replay_report.py
new file mode 100644
index 0000000..9f89f43
--- /dev/null
+++ b/dev/proofs/replay_report.py
@@ -0,0 +1,26 @@
+"""Bind a successful standalone kernel replay to its current model-check evidence."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+work = Path(sys.argv[1])
+check = json.loads((work / "check.json").read_text())
+assert check["status"] == "PASS" and check["accepted"]
+assert check["dependency_origin"] in {"cache+local", "source", "mixed"}, (
+    "State PROOFS_DEPENDENCY_ORIGIN=cache+local|source|mixed truthfully before release replay"
+)
+report = {
+    "status": "PASS",
+    "checker": f"Lean {check['lean_version']} leanchecker --fresh Checks (same Lean kernel)",
+    "check_sha256": hashlib.sha256((work / "check.json").read_bytes()).hexdigest(),
+    "log_sha256": hashlib.sha256((work / "replay.log").read_bytes()).hexdigest(),
+    "inventory_sha256": check["inventory_sha256"],
+    "source_inputs": check["source_inputs"],
+    "dependency_builds": check["dependency_origin"],
+}
+(work / "replay.json").write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
+print(f"Standalone kernel replay: {work / 'replay.json'}")
diff --git a/dev/proofs/run.sh b/dev/proofs/run.sh
new file mode 100644
index 0000000..3720a5f
--- /dev/null
+++ b/dev/proofs/run.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Explicit Lean checks. Normal Python/CMake builds never call this script.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+proof_root=$PWD
+proof_python=${PROOFS_PYTHON:-python3}
+proof_python=$("$proof_python" -I -c 'import sys; print(sys.executable)')
+proof_mode=${1:-}
+proof_output=${PROOFS_OUTPUT:-"$proof_root/build/proofs"}
+mkdir -p "$proof_output"
+proof_output=$(cd "$proof_output" && pwd)
+export PROOFS_PYTHON="$proof_python"
+
+check() {
+    "$proof_python" -I -B proofs/Checks/audit.py --preflight
+    command -v lake >/dev/null || { echo 'Install the toolchain in proofs/lean-toolchain and put lake on PATH.' >&2; return 1; }
+    rm -f "$proof_output/check.json"
+    (cd proofs && lake --wfail build && lake exe proof-audit --output "$proof_output/check.json") \
+        > "$proof_output/check.log" 2>&1 \
+        || { tail -60 "$proof_output/check.log" >&2; return 1; }
+    "$proof_python" -I -B proofs/Checks/audit.py --verify-report "$proof_output/check.json"
+    echo "Lean model check: $proof_output/check.json"
+}
+
+case "$proof_mode" in
+    check) check ;;
+    record)
+        [[ -z ${CI:-} ]] || { echo 'Do not record reviewed bindings in CI.' >&2; exit 1; }
+        (cd proofs && lake --wfail build && PROOFS_RECORD=1 lake exe proof-audit --record)
+        ;;
+    replay)
+        check
+        (cd proofs && lake env leanchecker --fresh Checks) > "$proof_output/replay.log" 2>&1 \
+            || { tail -60 "$proof_output/replay.log" >&2; exit 1; }
+        "$proof_python" -I -B proofs/Checks/audit.py --verify-report "$proof_output/check.json"
+        "$proof_python" -I -B dev/proofs/replay_report.py "$proof_output"
+        ;;
+    test)
+        "$proof_python" -I -B dev/proofs/test_tool.py
+        ;;
+    bridge)
+        : "${PROOFS_NATIVE_PYTHON:?Set PROOFS_NATIVE_PYTHON to the interpreter with the selected wheel installed}"
+        : "${PROOFS_WHEEL:?Set PROOFS_WHEEL to that exact wheel file}"
+        "$proof_python" -I -B proofs/Checks/audit.py --verify-report "$proof_output/check.json"
+        "$PROOFS_NATIVE_PYTHON" -I -B dev/proofs/bridge.py \
+            --proof-report "$proof_output/check.json" --wheel "$PROOFS_WHEEL" \
+            --output "$proof_output/bridge.json"
+        ;;
+    *) echo 'Usage: bash dev/proofs/run.sh check|record|replay|test|bridge' >&2; exit 2 ;;
+esac
diff --git a/dev/proofs/test_tool.py b/dev/proofs/test_tool.py
new file mode 100644
index 0000000..e451560
--- /dev/null
+++ b/dev/proofs/test_tool.py
@@ -0,0 +1,432 @@
+"""Real-discovery negative controls for the proof acceptance entry point.
+
+Each mutation is made in a disposable copy. Dependencies are shared read-only by convention;
+their checked-out revisions and clean state are checked by the audit. Product inputs are not
+modified. Compilable weakened statements/definitions must fail the reviewed-binding check.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+PROOFS = ROOT / "proofs"
+MODEL = "proofs/NetGraphCore/Apportionment/RoundRobin.lean"
+
+
+def load(path: Path, name: str):
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def main() -> None:
+    inventory = json.loads((PROOFS / "theorems.json").read_text())
+    tracked = {MODEL: (ROOT / MODEL).read_bytes()}
+    for record in inventory["theorems"]:
+        for ref in [
+            *record["semantics"],
+            *record["implementation"]["sources"],
+            record["explanation"],
+        ]:
+            tracked[ref["file"]] = (ROOT / ref["file"]).read_bytes()
+    work_parent = ROOT / "build/proofs"
+    work_parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix="controls-", dir=work_parent) as temporary:
+        root = Path(temporary)
+        shutil.copytree(PROOFS, root / "proofs", ignore=shutil.ignore_patterns(".lake"))
+        shutil.copytree(ROOT / "dev/proofs", root / "dev/proofs")
+        for name, data in tracked.items():
+            path = root / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(data)
+        (root / "proofs/.lake").mkdir()
+        (root / "proofs/.lake/packages").symlink_to(
+            PROOFS / ".lake/packages", target_is_directory=True
+        )
+        baseline = {
+            str(path.relative_to(root)): path.read_bytes()
+            for path in root.rglob("*")
+            if path.is_file() and ".lake" not in path.parts
+        }
+        environment = {
+            **os.environ,
+            "PROOFS_PYTHON": sys.executable,
+            "PROOFS_OUTPUT": str(root / "evidence"),
+        }
+        environment.pop("PROOFS_RECORD", None)
+
+        def run(label: str, expected: str | None = None, mode: str = "check") -> None:
+            result = subprocess.run(
+                ["bash", "dev/proofs/run.sh", mode],
+                cwd=root,
+                env=environment,
+                capture_output=True,
+                text=True,
+                timeout=300,
+            )
+            output = result.stdout + result.stderr
+            (work_parent / f"control-{label}.log").write_text(output)
+            if expected is None:
+                if result.returncode:
+                    raise AssertionError(f"clean control failed: {output[-6000:]}")
+            elif result.returncode == 0 or expected not in output:
+                raise AssertionError(
+                    f"{label}: wrong gate outcome; wanted {expected!r}: {output[-6000:]}"
+                )
+            print(
+                f"{label}: {'PASS' if expected is None else 'rejected as required'}",
+                flush=True,
+            )
+
+        def restore() -> None:
+            for path in root.rglob("*"):
+                if (
+                    path.is_file()
+                    and ".lake" not in path.parts
+                    and not path.is_relative_to(root / "evidence")
+                ):
+                    if str(path.relative_to(root)) not in baseline:
+                        path.unlink()
+            for name, data in baseline.items():
+                (root / name).write_bytes(data)
+
+        def edit(name: str, old: str, new: str) -> None:
+            path = root / name
+            text = path.read_text()
+            if old not in text:
+                raise AssertionError(f"plant not applied: {name}: {old}")
+            path.write_text(text.replace(old, new, 1))
+
+        def save_inventory(data: dict) -> None:
+            (root / "proofs/theorems.json").write_text(
+                json.dumps(data, indent=2) + "\n"
+            )
+
+        run("clean")
+        edit(
+            MODEL,
+            "@[expose] def amountLimit : Nat := 2 ^ 62",
+            "@[expose] def amountLimit : Nat := 2 ^ 61",
+        )
+        run("weakened-definition", "reviewed statement/definition digest drift")
+        restore()
+        edit(
+            MODEL,
+            "previous % members + extra < 2 ^ 63 ∧\n      0 ≤ increments previous extra members recipient ∧\n      increments previous extra members recipient < (amountLimit : Int)",
+            "previous % members + extra < 2 ^ 63 ∧\n      0 ≤ increments previous extra members recipient",
+        )
+        run("weakened-statement", "reviewed statement/definition digest drift")
+        restore()
+        # An equivalent synthetic candidate imports a mathematical constant from an
+        # owned checker module, outside the mathematical namespace. Its definition
+        # must enter the fingerprint too. Candidate fingerprints are test setup in
+        # this disposable directory; the repository's reviewed inventory is untouched.
+        (root / "proofs/Checks/Scalar.lean").write_text(
+            "module\npublic section\nnamespace Support\n"
+            "/-- The synthetic candidate uses the same amount limit as the real model. -/\n"
+            "@[expose] def importedLimit : Nat := 2 ^ 62\nend Support\nend\n"
+        )
+        edit(MODEL, "module\n", "module\npublic import Checks.Scalar\n")
+        edit(
+            MODEL,
+            "def amountLimit : Nat := 2 ^ 62",
+            "def amountLimit : Nat := Support.importedLimit",
+        )
+        edit(
+            MODEL,
+            "norm_num [amountLimit]",
+            "norm_num [amountLimit, Support.importedLimit]",
+        )
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["modules"].append("Checks/Scalar.lean")
+        save_inventory(changed)
+        edit(
+            "proofs/Checks.lean",
+            "public import Checks.Main",
+            "public import Checks.Main\npublic import Checks.Scalar",
+        )
+        built = subprocess.run(
+            ["lake", "--wfail", "build"],
+            cwd=root / "proofs",
+            env=environment,
+            capture_output=True,
+            text=True,
+            timeout=300,
+        )
+        (work_parent / "control-imported-definition-setup.log").write_text(
+            built.stdout + built.stderr
+        )
+        built.check_returncode()
+        exported = subprocess.run(
+            ["lake", "exe", "proof-audit", "--metadata"],
+            cwd=root / "proofs",
+            env=environment,
+            capture_output=True,
+            text=True,
+            check=True,
+            timeout=300,
+        )
+        metadata = {
+            item["name"]: item for item in json.loads(exported.stdout)["declarations"]
+        }
+        audit = load(root / "proofs/Checks/audit.py", "imported_definition_controls")
+        for record in changed["theorems"]:
+            record["binding"] = audit.binding(record["declaration"], metadata)
+        if not any(
+            "Support.importedLimit" in r["binding"]["local_closure"]
+            for r in changed["theorems"]
+        ):
+            raise AssertionError(
+                "owned imported definition omitted from actual constant closure"
+            )
+        save_inventory(changed)
+        run("imported-definition-clean")
+        edit("proofs/Checks/Scalar.lean", "2 ^ 62", "2 ^ 61")
+        run(
+            "imported-definition-weakened", "reviewed statement/definition digest drift"
+        )
+        restore()
+        (root / "proofs/Checks/Scalar.lean").write_text(
+            "module\npublic def undocumentedImported : Nat := 0\n"
+        )
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["modules"].append("Checks/Scalar.lean")
+        save_inventory(changed)
+        edit(
+            "proofs/Checks.lean",
+            "public import Checks.Main",
+            "public import Checks.Main\npublic import Checks.Scalar",
+        )
+        run("checker-helper-doc", "missing declaration doc comment")
+        restore()
+        edit(
+            MODEL,
+            "namespace NetGraphCore.Apportionment",
+            "namespace NetGraphCore.Apportionment\nset_option debug.skipKernelTC true",
+        )
+        run("kernel-skip", "forbidden proof command or kernel bypass")
+        restore()
+        # An imported postulate is deliberately outside the mathematical source scanner.
+        # Transitive axiom inspection must reject its use even though Lean accepts it.
+        (root / "proofs/Checks/Untrusted.lean").write_text(
+            "module\npublic section\nnamespace Untrusted\n"
+            "/-- A deliberately untrusted postulate for the transitive-axiom control. -/\n"
+            "axiom forge {p : Prop} : p\nend Untrusted\nend\n"
+        )
+        edit(MODEL, "module\n", "module\nimport Checks.Untrusted\n")
+        path = root / MODEL
+        text = path.read_text()
+        start = text.index("theorem native_increment_bounds")
+        body = text.index(" := by", start) + len(" := by")
+        path.write_text(
+            text[:body]
+            + "\n  have _ := hm\n  have _ := hi\n  have _ := hk\n  have _ := hv\n  exact Untrusted.forge\n\nend\nend NetGraphCore.Apportionment\n"
+        )
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["modules"].append("Checks/Untrusted.lean")
+        save_inventory(changed)
+        edit(
+            "proofs/Checks.lean",
+            "public import Checks.Main",
+            "public import Checks.Main\npublic import Checks.Untrusted",
+        )
+        run("imported-axiom", "unaccepted transitive axioms")
+        restore()
+        (root / "proofs/Checks/Untrusted.lean").write_text(
+            "module\npublic theorem unfinished : True := by sorry\n"
+        )
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["modules"].append("Checks/Untrusted.lean")
+        save_inventory(changed)
+        edit(
+            "proofs/Checks.lean",
+            "public import Checks.Main",
+            "public import Checks.Main\npublic import Checks.Untrusted",
+        )
+        run("imported-sorry", "declaration uses `sorry`")
+        restore()
+        # A trusted-looking axiom list cannot establish kernel validity. Deliberately
+        # corrupt an imported environment outside the mathematical-source scanner.
+        # The ordinary audit succeeds, but fresh replay must reject the false proof.
+        (root / "proofs/Checks/Untrusted.lean").write_text(
+            "module\npublic import Lean\nopen Lean Elab Command\n"
+            "set_option debug.skipKernelTC true in\n"
+            "run_cmd liftCoreM <| addDecl (.thmDecl {\n"
+            "  name := `Untrusted.bad, levelParams := [], type := .const ``False [],\n"
+            "  value := .const ``True.intro [] })\n"
+        )
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["modules"].append("Checks/Untrusted.lean")
+        save_inventory(changed)
+        edit(
+            "proofs/Checks.lean",
+            "public import Checks.Main",
+            "public import Checks.Main\npublic import Checks.Untrusted",
+        )
+        run("kernel-plant-audit")
+        run("kernel-plant-replay", "declaration type mismatch", mode="replay")
+        restore()
+        (root / "proofs/Checks/Forgotten.lean").write_text("module\n")
+        run("unimported-module", "module inventory differs")
+        restore()
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["theorems"] = []
+        save_inventory(changed)
+        run("empty-inventory", "empty or unsupported theorem inventory")
+        restore()
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["theorems"].pop()
+        save_inventory(changed)
+        run("missing-theorem", "inventory differs from theorem ID markers")
+        restore()
+        with (root / "src/route_kernels.cpp").open("a") as stream:
+            stream.write("\n// changed mapped input\n")
+        run("native-drift", "applicability digest drift")
+        restore()
+        explanation = "docs/formal/theorems/round-robin.md"
+        edit(explanation, '<a id="NGC-AP-004"></a>', "")
+        run("missing-explanation-anchor", "missing explanation anchor")
+        restore()
+        text = (root / MODEL).read_text()
+        start = text.index("/-- The share computed")
+        end = text.index("-/", start) + 2
+        (root / MODEL).write_text(text[:start] + text[end:])
+        run("missing-doc-comment", "missing declaration doc comment")
+        restore()
+        edit(
+            MODEL,
+            "end\nend NetGraphCore.Apportionment",
+            "private def forgotten : Nat := 0\n\nend\nend NetGraphCore.Apportionment",
+        )
+        run("private-helper-doc", "missing declaration doc comment")
+        restore()
+        for label, declaration in [
+            (
+                "protected-helper-doc",
+                "protected theorem undocumented : (1 : Nat) = 1 := rfl",
+            ),
+            ("indented-helper-doc", "  theorem undocumented : (1 : Nat) = 1 := rfl"),
+            ("instance-doc", "instance undocumented : Inhabited (Fin 1) := ⟨0⟩"),
+            ("structure-doc", "structure Undocumented where\n  value : Nat"),
+            ("opaque-doc", "opaque undocumented : Nat := 0"),
+            (
+                "where-helper-doc",
+                "/-- The outer value has a doc, but its written helper does not. -/\ndef undocumentedWhere : Nat := aux 1\nwhere\n  aux (n : Nat) : Nat := n",
+            ),
+        ]:
+            edit(
+                MODEL,
+                "end\nend NetGraphCore.Apportionment",
+                declaration + "\n\nend\nend NetGraphCore.Apportionment",
+            )
+            run(label, "missing declaration doc comment")
+            restore()
+        with (root / "proofs/NetGraphCore.lean").open("a") as stream:
+            stream.write(
+                "\nnamespace NetGraphCore\npublic def undocumented : Nat := 0\nend NetGraphCore\n"
+            )
+        run("root-helper-doc", "missing declaration doc comment")
+        restore()
+        with (root / MODEL).open("a") as stream:
+            stream.write(
+                "\nnamespace Elsewhere\n/-- An owned helper in the wrong namespace. -/\npublic def misplaced : Nat := 0\nend Elsewhere\n"
+            )
+        run("misplaced-namespace", "mathematical declaration outside project namespace")
+        restore()
+        edit(
+            MODEL,
+            "end\nend NetGraphCore.Apportionment",
+            "/-- A documented protected helper, referencing NGC-AP-001 in prose. -/\n"
+            "protected theorem documented : (1 : Nat) = 1 := rfl\n"
+            "  /-- An indented helper with its own explanation. -/\n"
+            "  theorem documentedIndented : (1 : Nat) = 1 := rfl\n\n"
+            "/-- A documented record; its constructor is generated by Lean. -/\n"
+            "structure Documented where\n  /-- The stored whole-unit count. -/\n  value : Nat\n\n"
+            "/-- A documented value with a written local helper. -/\n"
+            "def documentedWhere : Nat := aux 1\nwhere\n"
+            "  /-- Return the supplied whole-unit count unchanged. -/\n"
+            "  aux (n : Nat) : Nat := n\n\n"
+            "end\nend NetGraphCore.Apportionment",
+        )
+        run("documented-variants")
+        restore()
+        main_path = root / "proofs/Checks/Main.lean"
+        text = main_path.read_text()
+        start = text.index("public unsafe def main")
+        main_path.write_text(
+            text[:start]
+            + "public unsafe def main (_args : List String) : IO UInt32 := pure 0\n"
+        )
+        # Even an explicitly rebound, disabled audit must not turn a missing report into green.
+        changed = json.loads((root / "proofs/theorems.json").read_text())
+        changed["audit_sources"]["Checks/Main.lean"] = hashlib.sha256(
+            main_path.read_bytes()
+        ).hexdigest()
+        save_inventory(changed)
+        run("disabled-audit", "missing proof evidence file")
+        restore()
+        run("restored-clean")
+    for name, data in tracked.items():
+        if (ROOT / name).read_bytes() != data:
+            raise AssertionError(f"control changed product input: {name}")
+    bridge = load(ROOT / "dev/proofs/bridge.py", "bridge_controls")
+    for wrong in ([3, 3, 4], [4.0, 3, 3], [10, 0, 0]):
+        try:
+            bridge.exact(wrong, [4, 3, 3], "negative control")
+        except ValueError:
+            continue
+        raise AssertionError(f"bridge accepted wrong result {wrong}")
+    # The publish-time verifier must reject changed bytes of the already checked archive.
+    with tempfile.TemporaryDirectory(
+        prefix="artifact-identity-", dir=work_parent
+    ) as temporary:
+        work = Path(temporary)
+        archive = work / "candidate.tar.gz"
+        archive.write_bytes(b"identity-control fixture; not a real source archive")
+        receipt = work / "receipt.json"
+        receipt.write_text(
+            json.dumps(
+                {
+                    "sdist": {
+                        "name": archive.name,
+                        "sha256": hashlib.sha256(archive.read_bytes()).hexdigest(),
+                    },
+                    "wheels": {},
+                }
+            )
+        )
+        command = [
+            sys.executable,
+            "-I",
+            "-B",
+            str(ROOT / "dev/proofs/package.py"),
+            "--verify",
+            "--sdist",
+            str(archive),
+            "--receipt",
+            str(receipt),
+        ]
+        subprocess.run(command, check=True, capture_output=True)
+        archive.write_bytes(archive.read_bytes() + b"changed")
+        wrong = subprocess.run(command, capture_output=True, text=True)
+        if wrong.returncode == 0 or "published sdist differs" not in wrong.stderr:
+            raise AssertionError(
+                "publish identity check accepted changed archive bytes"
+            )
+    print(
+        "Proof gate controls: PASS; original mapped inputs unchanged; bridge rejects wrong order, type and distribution."
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/pytest_guard.py b/dev/pytest_guard.py
new file mode 100644
index 0000000..88bb73d
--- /dev/null
+++ b/dev/pytest_guard.py
@@ -0,0 +1,469 @@
+"""The Python suite with the check of what it imported and skipped: dev/run-checks.sh runs it for
+`pytest on` and `pytest off`, and the Windows CI jobs run it directly (no shell there):
+
+    python dev/pytest_guard.py on|off [PYTEST_ARGS...]
+
+on: the extension carries the private hooks (the editable development build). On a GIL build
+no test skips; on a free-threaded build exactly GIL_PROOF_SKIPS skip with reason GIL-proof-only.
+off: an installation without them (a wheel, or a build from the sdist), imported from outside
+the source tree, and exactly the tests that need a hook skip (EXPECTED_OFF_SKIPS, and every
+replay of the reference fixtures). A small plugin records the skipped node ids (tests, and modules
+or classes skipped while collected) and the imported modules; the arguments are pytest's. Exit status: pytest's when it fails, else 1 when a check
+fails (each problem printed), else 0."""
+
+from __future__ import annotations
+
+import os
+import sys
+import sysconfig
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+# The Python tests that need the private hooks and skip without them, by pytest node id; every
+# replay of the fixtures produced by the reference under tests/reference/policy/ (the
+# parametrizations of test_fixture) skips as well.
+EXPECTED_OFF_SKIPS = [
+    "tests/py/test_epoch_static.py::test_reused_prepare_trace_is_non_null_and_equal_to_fresh[False]",
+    "tests/py/test_epoch_static.py::test_reused_prepare_trace_is_non_null_and_equal_to_fresh[True]",
+    "tests/py/test_integer_array_allocation.py::test_integer_array_readers_propagate_allocation_failure_in_separate_processes",
+    "tests/py/test_apportionment.py::test_apportionment_entries",
+    (
+        "tests/py/test_shortest_path_cache.py::test_frozen_statistics_survive_python_allocation_failures"
+    ),
+    "tests/py/test_shortest_path_cache.py::test_the_frozen_sweep_rejects_a_wrong_call",
+    "tests/py/test_flow_ledger.py::test_a_flow_id_read_passes_an_allocation_failure_through",
+    "tests/py/test_flow_policy.py::test_evaluator_results_survive_python_allocation_failures",
+    "tests/py/test_flow_policy.py::test_owner_hook_is_the_owner_of_the_records",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[False-shortest_paths]",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[False-global]",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[True-shortest_paths]",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[True-global]",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[False-weighted]",
+    "tests/py/test_flow_policy.py::test_python_publication_is_all_or_nothing[True-weighted]",
+    "tests/py/test_flow_policy_fixtures.py::test_a_corrupted_expectation_fails[ledger]",
+    "tests/py/test_flow_policy_fixtures.py::test_a_corrupted_expectation_fails[policy]",
+    "tests/py/test_flow_policy_fixtures.py::test_a_corrupted_expectation_fails[result]",
+    "tests/py/test_flow_policy_fixtures.py::test_a_corrupted_expectation_fails[trace]",
+    (
+        "tests/py/test_flow_policy_fixtures.py::test_an_expected_value_of_another_type_fails[bool as integer]"
+    ),
+    (
+        "tests/py/test_flow_policy_fixtures.py::test_an_expected_value_of_another_type_fails[integer as float]"
+    ),
+    "tests/py/test_flow_policy_fixtures.py::test_every_other_replay_clause_reports_its_operation",
+    "tests/py/test_getter_allocation.py::test_every_read_survives_python_allocation_failures",
+    "tests/py/test_getter_allocation.py::test_every_number_read_raises_memory_error",
+    "tests/py/test_getter_allocation.py::test_a_failed_integer_read_raises_memory_error",
+    "tests/py/test_ksp.py::test_python_result_lists_are_all_or_nothing",
+    (
+        "tests/py/test_number_types.py::test_the_converter_raises_memory_error_on_every_python_allocation_failure"
+    ),
+    "tests/py/test_number_types.py::test_a_cold_conversion_raises_memory_error",
+    "tests/py/test_native_allocation.py::test_allocation_hooks_preserve_exception_identity",
+    "tests/py/test_native_allocation.py::test_python_allocation_hook_runs_the_call_untraced",
+    "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate_pairs.t1]",
+    "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate_pairs.t2]",
+    "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate_pairs.t2_support]",
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[Eligibility.intersect]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[FlowLedger.reset]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[FlowRecord.route]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[PlacementResult.program]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate_pairs.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate_pairs.global_equal]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[capacity.frozen_cache]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[capacity.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[capacity.pinned_lossy]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[evaluate.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[forward.shortest_paths_pooled_lossy_black_holes]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[from_dag]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[from_routes]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[ksp]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place.shortest_paths]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place.shortest_paths_pooled_lossy]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place.global_equal]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place.pinned_split_route]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[place_traced.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[replace.global_support]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[replace.pinned_tunnels_lossy]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[resolve_to_paths]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[to_units.list]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[sensitivity.global]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[sensitivity.pinned]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[spf.full]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[spf.single_path]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[spf.targets_residual]"
+    ),
+    "tests/py/test_native_allocation.py::test_the_row_checks_reject_a_wrong_call",
+    "tests/py/test_programs.py::test_from_routes_and_getters_survive_python_allocation_failures",
+    "tests/py/test_programs.py::test_operations_are_all_or_nothing[shortest_paths forward]",
+    "tests/py/test_programs.py::test_operations_are_all_or_nothing[shortest_paths replace]",
+    "tests/py/test_programs.py::test_operations_are_all_or_nothing[global evaluate]",
+    "tests/py/test_programs.py::test_operations_are_all_or_nothing[pinned replace]",
+    "tests/py/test_search.py::test_python_result_construction_is_all_or_nothing",
+    "tests/py/test_search.py::test_the_python_allocation_sweep_rejects_a_wrong_call",
+    "tests/py/test_distributed_te.py::test_traced_place_checks_the_operation_first",
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[ca.tunnel_count]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[fg.record(fid)]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[fg.records()]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[fg.reserved()]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[fg.unreserved()]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[p.record(fid)]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[p.records()]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[r.plan.design_by_head]"
+    ),
+    "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[r.plan]",
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[r.program.tunnels]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[type(abs3).__repr__(abs3)]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[type(st2).__repr__(st2)]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[st2.cost_ceiling.factor]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[st2.cost_ceiling]"
+    ),
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[cfg.routing]"
+    ),
+    "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[type(r).__repr__(r)]",
+    "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[type(sp).__repr__(sp)]",
+    (
+        "tests/py/test_distributed_te.py::test_t1_getters_survive_python_allocation_failures[t0.status]"
+    ),
+    "tests/py/test_distributed_te.py::test_t1_results_survive_python_allocation_failures[evaluate]",
+    "tests/py/test_distributed_te.py::test_t1_results_survive_python_allocation_failures[forward]",
+    "tests/py/test_distributed_te.py::test_t1_results_survive_python_allocation_failures[replace]",
+    "tests/py/test_centralized_te_tunnels.py::test_traced_place_checks_the_operation_first",
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[gl.tunnel_count]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[type(r).__repr__(r)]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.plan.max_fractional_bandwidth_per_tunnel]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.plan.headroom_penalty]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.plan.heads_with_capacity]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.plan.total_tunnel_cost]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.plan]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_getters_survive_python_allocation_failures[r.program.tunnels]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_results_survive_python_allocation_failures[evaluate]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_results_survive_python_allocation_failures[forward]"
+    ),
+    (
+        "tests/py/test_centralized_te_tunnels.py::test_t2_results_survive_python_allocation_failures[replace]"
+    ),
+    "tests/py/test_apply_actions.py::test_forwarding_bounds",
+    "tests/py/test_apply_actions.py::test_lists_are_all_or_nothing",
+    "tests/py/test_contract_examples.py::test_contract_example[ERR-forwarding-limit]",
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[apply_actions.ordered]"
+    ),
+    (
+        "tests/py/test_native_allocation.py::test_native_allocation_failure_raises_and_changes_nothing[apply_actions.simultaneous]"
+    ),
+]
+# Every new hooks-only node is explicit; a module-level skip cannot hide a public race.
+EXPECTED_OFF_SKIPS += [
+    "tests/py/test_concurrency.py::test_conversions_run_before_native_locks",
+    "tests/py/test_concurrency.py::test_batch_first_pass_uses_one_detach_and_no_computation_event",
+    "tests/py/test_concurrency.py::test_inputs_are_copied_before_native_work",
+    "tests/py/test_concurrency.py::test_options_snapshot_at_entry",
+    "tests/py/test_concurrency.py::test_initializing_policy_is_not_exposed",
+    "tests/py/test_concurrency.py::test_native_phase_allows_heartbeat",
+    "tests/py/test_concurrency.py::test_cache_before_gate_order",
+    "tests/py/test_concurrency.py::test_cached_policies_ignore_busy_original_cache",
+    "tests/py/test_concurrency.py::test_record_and_workers_do_not_deadlock",
+    "tests/py/test_concurrency.py::test_same_ledger_calls_serialize",
+    "tests/py/test_concurrency.py::test_every_ledger_reader_waits_without_gil",
+    "tests/py/test_concurrency.py::test_immutable_readers_do_not_wait",
+    "tests/py/test_concurrency.py::test_two_ledgers_enter_together",
+    "tests/py/test_concurrency.py::test_full_calls_and_reads_serialize",
+    "tests/py/test_concurrency.py::test_list_publication_is_atomic",
+    "tests/py/test_concurrency.py::test_reservations_and_program_are_atomic",
+    "tests/py/test_concurrency.py::test_building_cache_serializes_native_calls",
+    "tests/py/test_concurrency.py::test_frozen_cache_allows_overlapping_calls",
+    "tests/py/test_concurrency.py::test_cache_fifo_admission",
+    "tests/py/test_concurrency.py::test_workers_borrow_outer_lease",
+    "tests/py/test_concurrency.py::test_failed_waiter_unblocks_lifecycle",
+    "tests/py/test_concurrency.py::test_worker_validation_uses_leased_mode",
+    "tests/py/test_concurrency.py::test_frozen_tally_finishes_before_lifecycle",
+    "tests/py/test_concurrency.py::test_cache_lifetime_is_pinned_during_wait",
+    "tests/py/test_concurrency.py::test_policy_destructor_cannot_deadlock",
+    "tests/py/test_concurrency.py::test_waiters_pin_every_dependency",
+    "tests/py/test_concurrency.py::test_identity_order_is_a_serial_order",
+    "tests/py/test_concurrency.py::test_bind_copy_reset_races",
+    "tests/py/test_concurrency.py::test_failed_acquisition_releases_waiters",
+    "tests/py/test_concurrency.py::test_lowest_worker_exception_survives_overlap",
+    "tests/py/test_concurrency.py::test_failure_does_not_strand_waiters",
+    "tests/py/test_concurrency.py::test_zero_empty_and_masked_calls",
+    "tests/py/test_concurrency.py::test_immutable_native_operations_overlap_heartbeat",
+    "tests/py/test_concurrency.py::test_trace_conversion_is_separate_read",
+    "tests/py/test_getter_allocation.py::test_native_trace_conversion_allocation_failures",
+    "tests/py/test_getter_allocation.py::test_policy_shell_native_failures_leave_no_binding",
+    "tests/py/test_concurrency.py::test_daemon_exit_releases_native_resources",
+    "tests/py/test_concurrency.py::test_every_program_representation_uses_the_transaction_gate",
+    "tests/py/test_contract_examples.py::test_contract_example[F-publication-locked]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-publication-unlocked]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-publish-result-first]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-publish-result-after]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-read-result-failure]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-read-result-under-gate]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-frozen-hits]",
+    "tests/py/test_contract_examples.py::test_contract_example[F-frozen-hits-after-lease]",
+    "tests/py/test_contract_examples.py::test_contract_example[LIST-state-second]",
+]
+GIL_PROOF_SKIPS = {
+    "tests/py/test_concurrency.py::test_native_phase_allows_heartbeat",
+    "tests/py/test_concurrency.py::test_immutable_native_operations_overlap_heartbeat",
+}
+CONCURRENCY_PUBLIC = {
+    "tests/py/test_concurrency_public.py::test_shared_policy_increments",
+    "tests/py/test_concurrency_public.py::test_replacements_replay_by_flow_id",
+    "tests/py/test_concurrency_public.py::test_independent_ledgers",
+    "tests/py/test_concurrency_public.py::test_immutable_configuration_and_snapshots",
+    "tests/py/test_concurrency_public.py::test_cache_lifecycle_and_retained_values",
+    "tests/py/test_concurrency_public.py::test_public_policy_teardown",
+    "tests/py/test_concurrency_public.py::test_final_policy_rejects_swallowed_constructor_error",
+    "tests/py/test_contract_examples.py::test_contract_example[CALL-state-second]",
+}
+EXPECTED_OFF_SKIPPED_PREFIX = "tests/py/test_flow_policy_fixtures.py::test_fixture["
+
+
+class Record:
+    """The run as the checks read it: the node ids seen, the skipped ones with their reasons."""
+
+    def __init__(self):
+        self.seen, self.skipped = set(), {}
+
+    def skip(self, report):
+        r = report.longrepr
+        self.skipped[report.nodeid] = str(r[-1] if isinstance(r, tuple) else r)
+
+    def pytest_runtest_logreport(self, report):
+        self.seen.add(report.nodeid)
+        if report.skipped:
+            self.skip(report)
+
+    def pytest_collectreport(self, report):
+        # A module or a class skipped while collected (pytest.skip(allow_module_level=True),
+        # pytest.importorskip) runs no test: its collection report is its only record.
+        if report.skipped:
+            self.skip(report)
+
+
+def problems(
+    hooks,
+    has_hooks,
+    modules,
+    seen,
+    skipped,
+    root=ROOT,
+    *,
+    free_threaded=False,
+    runtime_gil=None,
+    require_concurrency=False,
+):
+    """The checks of one run (hooks: "on" or "off"; modules: the files of _netgraph_core and
+    netgraph_core as imported, None when not imported); returns the problems found."""
+    out = []
+    if runtime_gil is not None and runtime_gil == free_threaded:
+        out.append(
+            "Python ABI/runtime mismatch: free-threaded ABI must run without the GIL"
+        )
+    if require_concurrency:
+        out += [
+            f"required public concurrency test did not run: {node}"
+            for node in sorted(CONCURRENCY_PUBLIC - seen)
+        ]
+    if None in modules:
+        out.append(f"netgraph_core or _netgraph_core was not imported: {modules}")
+    if hooks == "on":
+        if not has_hooks:
+            out.append(
+                "the extension lacks the private hooks (expected the editable build)"
+            )
+        allowed = GIL_PROOF_SKIPS if free_threaded else set()
+        unexpected = sorted(set(skipped) - allowed)
+        if unexpected:
+            out.append(
+                f"{len(unexpected)} tests skipped in a hooks-on run: {unexpected}"
+            )
+        if free_threaded:
+            out += [
+                f"expected GIL-only skip did not occur: {n}"
+                for n in sorted((allowed & seen) - set(skipped))
+            ]
+            out += [
+                f"wrong GIL-only skip reason: {n}: {reason}"
+                for n, reason in sorted(skipped.items())
+                if n in allowed and "GIL-proof-only" not in reason
+            ]
+        return out
+    if has_hooks:
+        out.append(
+            "the extension carries the private hooks (expected a wheel or sdist build)"
+        )
+    inside = [
+        m
+        for m in modules
+        if m and os.path.realpath(m).startswith(os.path.realpath(root) + os.sep)
+    ]
+    if inside:
+        out.append(f"imported from the source tree, not an installation: {inside}")
+    replays = {n for n in seen if n.startswith(EXPECTED_OFF_SKIPPED_PREFIX)}
+    if not replays:
+        out.append(f"no test {EXPECTED_OFF_SKIPPED_PREFIX}...] ran")
+    want = set(EXPECTED_OFF_SKIPS) | replays
+    got = set(skipped)
+    out += [f"expected to skip, did not: {n}" for n in sorted(want - got)]
+    out += [f"skipped, not a known hook-only test: {n}" for n in sorted(got - want)]
+    out += [
+        f"skipped for another reason: {n}: {r}"
+        for n, r in sorted(skipped.items())
+        if "needs the private hooks" not in r
+        and not (free_threaded and n in GIL_PROOF_SKIPS and "GIL-proof-only" in r)
+    ]
+    return out
+
+
+def main(argv):
+    if not argv or argv[0] not in ("on", "off"):
+        print(
+            "usage: python dev/pytest_guard.py on|off [PYTEST_ARGS...]", file=sys.stderr
+        )
+        return 2
+    import pytest
+
+    hooks, record = argv[0], Record()
+    status = pytest.main(argv[1:], plugins=[record])
+    if status != 0:
+        return int(status)
+    ext = sys.modules.get("_netgraph_core")
+    pkg = sys.modules.get("netgraph_core")
+    modules = [getattr(ext, "__file__", None), getattr(pkg, "__file__", None)]
+    found = problems(
+        hooks,
+        hasattr(ext, "_fail_native_allocation"),
+        modules,
+        record.seen,
+        record.skipped,
+        free_threaded=bool(sysconfig.get_config_var("Py_GIL_DISABLED")),
+        runtime_gil=getattr(sys, "_is_gil_enabled", lambda: True)(),
+        require_concurrency=(
+            not any(not arg.startswith("-") for arg in argv[1:])
+            or any(node.startswith("tests/py/") for node in record.seen)
+        )
+        and not any("::" in arg or arg.endswith(".py") for arg in argv[1:]),
+    )
+    for p in found:
+        print(f"dev/pytest_guard.py: {p}", file=sys.stderr)
+    if found:
+        return 1
+    if hooks == "off":
+        print(
+            f"hooks off: exactly the {len(record.skipped)} expected hook-only tests skipped;"
+            f" imported {modules[0]}"
+        )
+    else:
+        print(
+            f"hooks on: {len(record.skipped)} exact build-specific skips; imported {modules[0]}"
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/dev/research/README.md b/dev/research/README.md
deleted file mode 100644
index 9bc2e5d..0000000
--- a/dev/research/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Research record
-
-Investigations whose outcome informed the code but whose prototypes are not
-part of the library. They are kept for the evidence and the dead ends they
-document, not as maintained tools.
-
-- [`metal_pathfinding/`](metal_pathfinding/): Apple Metal GPU shortest-path
-  prototypes (two phases, with raw measurements and validation audits). Their
-  conclusion, that a better CPU queue should come first, led to the work in
-  [`../perf/spf_queue/`](../perf/spf_queue/). Objective-C++ and Metal; builds
-  only on macOS with Xcode.
diff --git a/dev/research/metal_pathfinding/README.md b/dev/research/metal_pathfinding/README.md
deleted file mode 100644
index 65d7de3..0000000
--- a/dev/research/metal_pathfinding/README.md
+++ /dev/null
@@ -1,293 +0,0 @@
-# Metal pathfinding investigation
-
-**Follow-up:** the [optimization research](optimization/README.md) tests active
-frontiers, buckets, batch layout and improved result construction. It finds
-substantially better batch results, so the initial timings below must not be
-treated as a GPU performance ceiling. Both rounds remain exploratory because
-the desktop was not isolated for measurement.
-
-The [consolidated CPU optimisation plan](../../perf/spf_queue/PLAN.md) now governs
-implementation order and acceptance. The backend integration notes below remain
-relevant to a later Metal follow-up.
-
-Research against NetGraph-Core `fbab119` on 26–27 September 2026, using an
-Apple M4 Max (14 CPU cores, 32 GPU cores, 36 GB unified memory).
-This directory contains standalone experiments. It does not register a backend,
-change the Python API, or modify production algorithms.
-
-**Answer:** adding a Metal implementation is technically feasible, and the host
-integration is fairly small. A useful, compatible replacement for `Backend.cpu()`
-is a substantially larger task. The candidate interface is **distances on an
-immutable graph, with optional batches**, particularly for large low-hop
-full-source searches, and explicit CPU fallback. It is premature
-to make Metal the default SPF implementation or promise faster flow simulation.
-
-**What the current backend gets right.** `StrictMultiDiGraph` already has immutable
-forward and reverse CSR, stable internal edge IDs, nonnegative int64 costs, and
-a constructor bound on the sum of costs that prevents path-cost overflow.
-These are useful GPU inputs. `Backend` and `Algorithms` provide a dispatch seam;
-`FlowPolicy` calls that seam. The CPU implementation is native C++ Dijkstra,
-with flat predecessor storage and Python GIL release. Its existing memoization
-and reverse SPF also avoid computations that a GPU would otherwise repeat.
-The appropriate comparison is this implementation, including parallel CPU
-queries, not a Python Dijkstra loop.
-
-**Where the abstraction needs work.** These are verified properties of the
-current source, not newly claimed correctness defects:
-
-| Area | Current behavior | Consequence for Metal |
-|---|---|---|
-| Graph ownership | `GraphHandle` contains only `shared_ptr<const StrictMultiDiGraph>`. CPU construction is non-owning; Python separately keeps the graph alive. | No place for a typed device representation or backend identity. Add owned device state and preserve topology lifetime. |
-| Query interface | `spf` / `spf_to` are synchronous, single-query calls returning host vectors and a `PredDAG`. There is no batched SPF or distances-only API. | Cannot amortize dispatch across independent queries through the current interface. Every call produces a host DAG even if the caller only needs distances. |
-| Cost semantics | Internal distances are int64; Python offers int64 explicitly and defaults to float64 conversion. | A float32 GPU implementation would change path selection. Keep exact integer arithmetic. |
-| Predecessors | Positive-cost ECMP keeps all equal alternatives; zero-cost edges use settle order to remain acyclic. Parallel-edge selection and capacity ties are configurable. | A distance kernel plus tight-edge extraction is insufficient to reproduce the full contract. |
-| Result order | Predecessor arrays follow CPU discovery order. Path enumeration consumes that order, including when capped by `max_paths`. | The prototype's deterministic edge-ID order has equivalent positive-cost edge sets, but is not byte-identical or necessarily enumeration-identical. |
-| Residuals and masks | Borrowed per-call spans; capacities and residuals are double; a residual span forces capacity gating. Python currently copies residual/mask input. | Compute exact eligibility on the CPU or reproduce these semantics explicitly. Static topology upload does not remove changing-mask work. |
-| Max-flow | `calc_max_flow` calls the free `shortest_paths` function directly between residual updates. | Overriding `Backend::spf` does not accelerate `Backend::max_flow`, batch max-flow, or sensitivity when those delegate to the existing CPU functions. |
-| KSP | Yen-style enumeration has its own Dijkstra helper and directly calls free SPF for spurs. | Overriding backend SPF does not make KSP run on the GPU. It is also sequentially dependent across accepted paths. |
-| FlowPolicy | Calls `ctx_.algorithms->spf`, generally with `dst` and changing flow state; caches some SPF results. | It can use a new backend, but single-call latency, early exit, cache hits, and residual invalidation matter. Batching across dependent placements would change semantics. |
-| Downstream selection | NetGraph's context builder explicitly constructs `Backend.cpu()`. | Shipping a factory alone would not enable acceleration downstream. |
-
-Source pointers: [backend.hpp](../../../include/netgraph/core/backend.hpp),
-[algorithms.hpp](../../../include/netgraph/core/algorithms.hpp),
-[shortest_paths.hpp](../../../include/netgraph/core/shortest_paths.hpp),
-[shortest_paths.cpp](../../../src/shortest_paths.cpp),
-[flow_policy.cpp](../../../src/flow_policy.cpp), [max_flow.cpp](../../../src/max_flow.cpp),
-[k_shortest_paths.cpp](../../../src/k_shortest_paths.cpp),
-[bindings](../../../bindings/python/module.cpp).
-Downstream inspection was read-only: `ngraph/analysis/context.py`,
-`ngraph/analysis/placement.py`, and `dev/perf/profiles.py` in the sibling NetGraph
-checkout. No downstream behavior or integration speedup was tested.
-
-**What the external research establishes.** Apple supplies a direct C++ Metal
-interface, so there is no need to introduce Swift or a tensor framework just to
-call compute kernels. An isolated Objective-C++ translation unit also works;
-that is what this experiment builds using Command Line Tools and the system
-Foundation/Metal frameworks. [Apple Metal-cpp](https://developer.apple.com/metal/cpp/)
-
-The current Metal language specification supports 64-bit `long`/`ulong`, but
-does not support `double`. Its 64-bit atomics are limited: void-returning
-`atomic_min_explicit` / `atomic_max_explicit` exist; a general 64-bit atomic
-fetch-min/load API is not available. This is a reason to choose a suitable
-algorithm, not a reason to abandon exact costs. Apple lists 64-bit atomics from
-Apple9 hardware, whereas 64-bit integer math has broader availability. Capability
-checks must cover the target hardware family.
-[MSL specification, sections 2.1 and 6.16.4.6](https://developer.apple.com/metal/Metal-Shading-Language-Specification.pdf),
-[Apple feature tables](https://developer.apple.com/metal/Metal-Feature-Set-Tables.pdf).
-The [local compiler probes](results/capabilities.txt) confirm all of these
-distinctions on this M4 Max, including successful void-returning 64-bit minimum.
-Compilation alone is not a performance test of that atomic operation.
-
-MPSGraph is a graph of tensor operations, not an off-the-shelf implementation of
-NetGraph's routing semantics. MLX offers custom Metal kernels, which is useful
-for prototyping, but still leaves the graph algorithm and correctness contract
-to us. I found no drop-in implementation of this API in these libraries.
-[Apple MPSGraph](https://developer.apple.com/documentation/metalperformanceshadersgraph?changes=__5_7),
-[MLX custom Metal kernels](https://ml-explore.github.io/mlx/build/html/dev/custom_metal_kernels.html).
-
-Gunrock provides useful GPU graph-processing designs based on frontiers and
-load balancing, but its advertised backends are CUDA and HIP, not Metal.
-cuGraph likewise depends on NVIDIA's CUDA stack. Neither is a library switch
-for an Apple GPU. Their existence does suggest a more ambitious implementation
-direction: frontier compaction and work-efficient SSSP rather than repeatedly
-scanning every edge. That direction was researched, not implemented or timed.
-[Gunrock](https://github.com/gunrock/gunrock),
-[cuGraph installation](https://docs.nvidia.com/cugraph/26.10/installation/getting_cugraph/).
-
-**The experiments.** All three kernels compute exact int64 distances with
-double-buffered Bellman–Ford-style pull relaxation over incoming CSR. Reverse
-routing uses outgoing CSR. They do not race on distance writes and do not need
-64-bit atomics. Per-edge eligibility is prepared on the host from finite double
-residuals, node masks, and edge masks. The cost of this preparation and buffer
-allocation is recorded as `upload_ms`; each warm query reuses that snapshot.
-All prototypes currently model capacity-gated, multipath, multi-edge, full-source
-queries. General selection options and changing eligibility are not benchmarked.
-Every query in a batch shares the same mask/residual snapshot; this is not a
-benchmark of independent failure scenarios with different masks per query.
-
-| Method | Execution | Intended experiment |
-|---|---|---|
-| `metal_pull` | One thread per query/vertex, separate dependent dispatches; up to eight rounds per command buffer before checking convergence. | Spread one large query across the GPU; measure repeated launch/synchronization costs. |
-| `metal_group` | One threadgroup per query, convergence inside the kernel, global-memory ping-pong distance arrays. | Amortize dispatch across many independent sources without a grid-wide barrier. |
-| `metal_shared` | One threadgroup per query, with distance arrays in threadgroup memory. | Reduce memory/barrier overhead for small graphs; enabled only when runtime scratch-memory limits permit. |
-
-Each returns host distance vectors. The measured full result then scans edges
-on the CPU and constructs a positive-cost ECMP DAG. **That full timing includes
-DAG construction**, but its order differs from the current CPU implementation.
-`distance_wall_ms` ends before DAG construction; `gpu_ms` contains command-buffer
-GPU timestamps, not end-to-end API latency. Neither should be presented as the
-speed of a compatible `Algorithms.spf` replacement.
-
-The pull algorithms perform `O(Q * H * (V + E))` work, where `H` is
-the number of relaxation rounds (up to `V`), versus heap Dijkstra's usual
-`O((V + E) log V)` per source. This makes hop depth and degree as important as
-vertex count. These kernels are feasibility baselines, not an optimized
-frontier/delta-stepping implementation or a bound on what Metal can achieve.
-Two int64 distance buffers require `16 * V * Q` bytes: 64 MiB at 65,536 vertices
-and 64 sources, before host outputs and DAGs. A dense int64 matrix at the same
-vertex count would itself require 32 GiB. An all-pairs approach therefore needs
-an explicit memory/work analysis and batching on this 36 GB machine.
-
-The CPU controls use the actual current `shortest_paths` / `shortest_paths_to`
-sources, built with `-O3 -flto -funroll-loops`. Controls include serial full SPF,
-an independent distances-only Dijkstra, and both full SPF and distances-only
-Dijkstra through ten reusable worker threads. Pool startup is outside timing;
-task submission and result allocation
-are inside. Profiling is disabled. The experiment does not exercise Python
-binding overhead or an integrated flow-placement workload.
-
-The full suite covers 27 graph/batch configurations: 128–65,536 vertices,
-up to 524,288 directed edges, batches of 1–256 queries, nonuniform random costs,
-parallel edges/self-loops, leaf–spine fabrics, 32x32 / 100x100 / 200x200 grids,
-directed chains, and masked reverse queries with costs above 32 bits. The Clos
-and grid shapes were selected after inspecting NetGraph's own benchmark catalogue;
-these remain generated fixtures, not a replay of a user's production topology.
-
-**Correctness evidence.** Every timed sample, including warmups, compares every
-distance and the canonical `(child, parent, edge-id)` predecessor multiset to the
-current C++ result. The independent CPU Dijkstra is also checked against that
-result. Timing excludes verification. Twelve seeded small masked multigraphs
-exercise all three GPU methods in both normal and sanitizer/Metal validation
-runs. Hand-derived witnesses additionally check:
-
-- Diamond ECMP, equal-cost parallel edges, positive self-loop exclusion, and an isolated node.
-- Reverse distances and forward-oriented predecessor edges.
-- Masked source, masked transit node, and combined residual/edge masks.
-- A residual just below `kMinCap` versus exactly at the threshold.
-- Int64 costs above 2^53, including a one-unit difference between candidate paths.
-
-The witnesses also deliberately reproduce unsupported simplifications:
-
-- Float32 equates 16,777,216 and 16,777,217 and rounds a residual immediately below
-  `kMinCap` up to the threshold. It also erases a `1` versus `1 + 1e-8` capacity tie.
-- On a zero-cost `0 -> 1 -> 2 -> 1` graph, distances agree but naive tight-edge
-  reconstruction contains a cycle; the CPU DAG correctly retains only two edges.
-- Full-suite CSVs record how many query DAGs retain exactly the CPU's array order.
-  Canonical equality is not silently reported as byte-for-byte parity.
-
-An initial long run exposed a convergence-flag race in the research kernels:
-after the end-of-round barrier, a fast lane could reset the flag for the next
-round before every lane had read it. An additional barrier after the reads
-fixes that ordering. The rejected run is retained under
-[results/rejected-race](results/rejected-race/), and is excluded from conclusions.
-After correction, each of two 64-query stress cases passed 100 timed repetitions
-plus two warmups for each of three kernels (39,168 complete query comparisons).
-An additional 20 timed repetitions plus two warmups per case/kernel passed with
-ASan/UBSan and Metal API/shader validation (8,448 query comparisons).
-These checks found and then exercised the fix; they are not a proof of every
-possible shader interleaving. See [stress.csv](results/stress.csv),
-[stress-sanitized.csv](results/stress-sanitized.csv),
-[validation log](results/stress-validation.txt), and
-[witnesses](results/witnesses-sanitized.txt).
-
-**Performance acceptance remains separate from correctness.** The script uses
-fresh processes in CPU / GPU / CPU order on this Mac, nine timed samples per row
-after two warmups, and records each raw sample, pipeline startup, upload cost,
-CPU load, and GPU utilization. Builds and test suites do not overlap those runs.
-The desktop has active background work. These observations must be labelled
-exploratory; the repository's quiet-machine requirement is not yet satisfied.
-No production speedup or universal CPU/GPU crossover is established by them.
-See [A/B/A data](results/aba/) and the generated
-[timing table](results/aba/summary.md), including CPU-control drift.
-
-The final run's second CPU-load snapshots were 90.7%, 90.75%, and 73.37% idle
-before A1, B, and A2. Some tiny-query CPU controls drifted substantially
-(up to 67% between phase medians), so an automatic dispatch threshold cannot
-be justified from this run. Selected raw observations below are milliseconds
-for distances **plus DAG construction**; CPU batches use ten workers:
-
-| Generated graph | Queries | CPU A1 | Metal B | CPU A2 |
-|---|---:|---:|---:|---:|
-| Random, 1,024 vertices / 8,192 edges | 1 | 0.145 | 0.707 | 0.115 |
-| Random, 65,536 vertices / 524,288 edges | 1 | 20.762 | 4.922 | 22.345 |
-| Random, 16,384 vertices / 131,072 edges | 64 | 28.290 | 54.004 | 28.429 |
-| Clos, 800 vertices / 320,000 edges | 64 | 17.462 | 72.452 | 17.634 |
-| Grid, 40,000 vertices / 159,200 edges | 1 | 2.913 | 8.408 | 2.937 |
-
-These observations identify follow-up candidates rather than establish a
-validated speedup. Large low-hop full-source searches deserve a quiet repeat;
-small graphs and deep grids/chains do not provide a general reason to offload
-with these algorithms. Dropping the DAG changes the experiment materially:
-at 16,384 random vertices and 64 queries, CPU distances-only controls were
-14.898 / 15.059 ms, with 9.176 ms for the GPU distance stage. Conversely,
-the 800-vertex Clos batch was 2.672 / 2.661 ms on the CPU versus 5.681 ms for
-the GPU distance stage. Batching alone is not a sufficient selection rule.
-Pipeline startup in this repeat was 24.135 ms; the shader cache had already
-been exercised, so this is not a cold-install startup measurement.
-
-**Implementation sequence, revised after the CPU experiments.** Follow the
-[CPU plan](../../perf/spf_queue/PLAN.md) before selecting a GPU backend. Its
-[queue-substitution experiment](../../perf/spf_queue/) showed that an ordered
-bucket queue inside the existing search reproduces the native result contract
-bit-exactly and runs 1.3–1.9x faster on weighted graphs; BFS and
-bounded-integer buckets are its special cases, with a width limit and heap
-fallback. It is implemented in the working tree and measured old/new/old at the
-Core level and through NetGraph. A batch or distances-only API is conditional
-on demonstrated callers.
-Reuse reverse SPF and caches before increasing the query count, and measure
-representative NetGraph workloads end to end.
-
-Then, if a quiet benchmark justifies it, add an opt-in `Backend.metal()` or an
-explicit batch accelerator. Store owned CSR buffers and a backend identity in
-the graph handle; keep the graph immutable and the masks versioned or copied per
-request. A macOS-only Objective-C++ file and optional CMake Metal/Foundation
-linkage are sufficient for the host layer. Keep per-request scratch state safe
-under concurrent GIL-released callers. Runtime device/pipeline failures need a
-documented policy, and non-Apple builds must retain the CPU-only path.
-A first adapter can hold `make_cpu_backend()` and delegate its unimplemented
-virtual methods there; it does not require rewriting every algorithm at once.
-That is a straightforward way to add a selectable factory, but it must expose
-which operations actually execute on the GPU rather than imply that delegating
-max-flow or KSP became accelerated.
-
-For the first compatible SPF implementation, retain int64 arithmetic and exact
-CPU eligibility; keep zero-cost DAGs, single-path capacity tie-breaking,
-fanout-edge semantics, and any unimplemented selection modes on CPU. Preserve
-existing predecessor order before declaring parity for the existing result API,
-as required by the consolidated CPU plan. A new distances-only batch API avoids most DAG-specific compatibility
-work. It must still distinguish supported options from silently ignored ones.
-
-The [follow-up](optimization/README.md) has since tested frontier/bucket methods,
-GPU predecessor extraction and guarded 32-bit paths. Production adoption still
-requires a compatible result contract and a measured win over the improved CPU.
-Directly moving the existing heap-based Dijkstra loop to a GPU is unlikely to
-expose useful parallel work. Dense all-pairs tensor formulations change the
-memory/work complexity and are not the straightforward default for sparse
-network graphs. These are engineering judgments, not measured claims about
-unimplemented algorithms.
-
-Keep max-flow, KSP, and placement on the CPU initially. Accelerating their SPF
-internals requires additional dispatch plumbing and end-to-end validation of
-flow amounts, feasibility, conservation, cuts, costs, masks, and cost factors;
-the present distance experiment provides no such validation. Bindings and
-`python/netgraph_core/_docs.py` must change together if public APIs are added.
-Metal runtime tests need a real Apple GPU CI runner. Local success does not
-replace CI.
-
-**Reproduction.** Run from the repository root on a Mac with a Metal device:
-
-```bash
-bash dev/research/metal_pathfinding/build.sh
-build/metal_pathfinding/capabilities
-build/metal_pathfinding/experiment gpu dev/research/metal_pathfinding/sssp.metal witnesses 1
-build/metal_pathfinding/experiment gpu dev/research/metal_pathfinding/sssp.metal correctness 2
-build/metal_pathfinding/experiment gpu dev/research/metal_pathfinding/sssp.metal stress 100
-
-# Close out other compute work before making performance claims.
-# Use a fresh output directory to preserve the recorded run.
-bash dev/research/metal_pathfinding/run_aba.sh /tmp/netgraph-metal-aba
-venv/bin/python dev/research/metal_pathfinding/summarize.py /tmp/netgraph-metal-aba
-
-bash dev/research/metal_pathfinding/build.sh sanitize
-MTL_DEBUG_LAYER=1 MTL_SHADER_VALIDATION=1 ASAN_OPTIONS=detect_leaks=0 \
-  build/metal_pathfinding/experiment-sanitize gpu \
-  dev/research/metal_pathfinding/sssp.metal stress 20
-```
-
-Repository validation also ran `bash .superset/workspace.sh check` (extension
-rebuilt; lint/types clean; 170 C++ tests and 465 Python tests passed) and
-`make sanitize-test` (170 C++ tests passed). No production C++ source, binding,
-or downstream code was modified. No CI run, commit, or push was made.
-The [workspace check log](results/workspace-check.txt),
-[core sanitizer log](results/sanitize-test.txt), and
-[prototype CPU sanitizer results](results/cpu-sanitized.csv) are retained.
diff --git a/dev/research/metal_pathfinding/build.sh b/dev/research/metal_pathfinding/build.sh
deleted file mode 100644
index 15f5b24..0000000
--- a/dev/research/metal_pathfinding/build.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")/../.."
-mkdir -p build/metal_pathfinding
-flags=(-std=c++20 -O3 -flto -funroll-loops -fno-math-errno -fno-trapping-math)
-if [[ ${1:-} == sanitize ]]; then
-  flags=(-std=c++20 -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
-fi
-xcrun clang++ "${flags[@]}" -fobjc-arc -Iinclude \
-  dev/research/metal_pathfinding/experiment.mm src/strict_multidigraph.cpp \
-  src/shortest_paths.cpp src/profiling.cpp -framework Foundation -framework Metal \
-  -o "build/metal_pathfinding/experiment${1:+-$1}"
-xcrun clang++ -std=c++20 -O3 -fobjc-arc dev/research/metal_pathfinding/capabilities.mm \
-  -framework Foundation -framework Metal -o build/metal_pathfinding/capabilities
diff --git a/dev/research/metal_pathfinding/capabilities.mm b/dev/research/metal_pathfinding/capabilities.mm
deleted file mode 100644
index bbef385..0000000
--- a/dev/research/metal_pathfinding/capabilities.mm
+++ /dev/null
@@ -1,28 +0,0 @@
-#import <Foundation/Foundation.h>
-#import <Metal/Metal.h>
-#include <iostream>
-
-int main() {
-  @autoreleasepool {
-    id<MTLDevice> device = MTLCreateSystemDefaultDevice();
-    if (!device) return 1;
-    std::cout << "device=" << device.name.UTF8String
-              << " unified=" << device.hasUnifiedMemory
-              << " max_buffer=" << device.maxBufferLength << '\n';
-    NSArray<NSString*>* bodies = @[
-      @"kernel void test(device long* x [[buffer(0)]], uint i [[thread_position_in_grid]]) { x[i] += 1; }",
-      @"kernel void test(device double* x [[buffer(0)]], uint i [[thread_position_in_grid]]) { x[i] += 1.0; }",
-      @"kernel void test(device atomic_ulong* x [[buffer(0)]]) { atomic_fetch_min_explicit(x, 1ul, memory_order_relaxed); }",
-      @"kernel void test(device atomic_uint* x [[buffer(0)]]) { atomic_fetch_min_explicit(x, 1u, memory_order_relaxed); }",
-      @"kernel void test(device atomic_ulong* x [[buffer(0)]]) { atomic_min_explicit(x, 1ul, memory_order_relaxed); }",
-      @"kernel void test(device atomic_ulong* x [[buffer(0)]], device ulong* y [[buffer(1)]]) { y[0] = atomic_load_explicit(x, memory_order_relaxed); }"
-    ];
-    for (NSUInteger i = 0; i < bodies.count; ++i) {
-      NSError* error = nil;
-      NSString* source = [@"#include <metal_stdlib>\nusing namespace metal;\n" stringByAppendingString:bodies[i]];
-      id<MTLLibrary> library = [device newLibraryWithSource:source options:nil error:&error];
-      std::cout << "probe=" << i << " compiled=" << (library != nil) << '\n';
-      if (!library) std::cout << error.localizedDescription.UTF8String << '\n';
-    }
-  }
-}
diff --git a/dev/research/metal_pathfinding/experiment.mm b/dev/research/metal_pathfinding/experiment.mm
deleted file mode 100644
index 671cbcb..0000000
--- a/dev/research/metal_pathfinding/experiment.mm
+++ /dev/null
@@ -1,526 +0,0 @@
-// Standalone research harness, not a registered NetGraph backend.
-#import <Foundation/Foundation.h>
-#import <Metal/Metal.h>
-
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/constants.hpp"
-#include <algorithm>
-#include <atomic>
-#include <chrono>
-#include <cmath>
-#include <condition_variable>
-#include <cstring>
-#include <functional>
-#include <iomanip>
-#include <iostream>
-#include <limits>
-#include <memory>
-#include <mutex>
-#include <numeric>
-#include <queue>
-#include <random>
-#include <stdexcept>
-#include <string>
-#include <thread>
-
-using namespace netgraph::core;
-using Result = std::pair<std::vector<Cost>, PredDAG>;
-using Clock = std::chrono::steady_clock;
-constexpr Cost INF = std::numeric_limits<Cost>::max();
-double ms(Clock::time_point start) {
-  return std::chrono::duration<double, std::milli>(Clock::now() - start).count();
-}
-
-struct Case {
-  std::string name;
-  StrictMultiDiGraph graph;
-  std::unique_ptr<bool[]> node_mask, edge_mask;
-  std::vector<Cap> residual;
-  bool reverse = false;
-  std::span<const bool> nm() const { return {node_mask.get(), size_t(graph.num_nodes())}; }
-  std::span<const bool> em() const { return {edge_mask.get(), size_t(graph.num_edges())}; }
-};
-
-Case make_case(std::string kind, int n, int degree = 8, bool masked = false,
-               bool large = false, bool reverse = false, unsigned seed = 1729) {
-  std::vector<NodeId> src, dst;
-  std::vector<Cost> costs;
-  std::vector<Cap> caps;
-  std::mt19937 rng(seed);
-  auto add = [&](int u, int v, Cost c) {
-    src.push_back(u); dst.push_back(v);
-    costs.push_back(c + (large ? (Cost(1) << 34) : 0));
-    caps.push_back(1.0 + double(rng() % 100) / 7.0);
-  };
-  if (kind == "chain") {
-    for (int i = 0; i < n - 1; ++i) add(i, i + 1, 1 + rng() % 31);
-  } else if (kind == "grid") {
-    int side = int(std::sqrt(n));
-    if (side * side != n) throw std::runtime_error("grid must be square");
-    for (int u = 0; u < n; ++u) {
-      if (u % side + 1 < side) { add(u, u + 1, 1); add(u + 1, u, 1); }
-      if (u + side < n) { add(u, u + side, 1); add(u + side, u, 1); }
-    }
-  } else if (kind == "fabric" || kind == "clos") {
-    int spines = kind == "clos" ? n / 2 : 32;
-    for (int u = 0; u < n - spines; ++u) for (int v = n - spines; v < n; ++v) {
-      add(u, v, 1); add(v, u, 1);
-    }
-  } else {
-    for (int u = 0; u < n; ++u) {
-      add(u, (u + 1) % n, 1 + rng() % 31);
-      for (int k = 1; k < degree; ++k) add(u, rng() % n, 1 + rng() % 31);
-    }
-  }
-  Case c{kind + (masked ? "_masked" : "") + (large ? "_int64" : "") +
-             (reverse ? "_reverse" : ""),
-         StrictMultiDiGraph::from_arrays(n, src, dst, caps, costs)};
-  c.reverse = reverse;
-  int e = c.graph.num_edges();
-  c.node_mask = std::make_unique<bool[]>(n);
-  c.edge_mask = std::make_unique<bool[]>(e);
-  c.residual.assign(c.graph.capacity_view().begin(), c.graph.capacity_view().end());
-  for (int i = 0; i < n; ++i) c.node_mask[i] = !masked || rng() % 23 != 0;
-  for (int i = 0; i < e; ++i) {
-    c.edge_mask[i] = !masked || rng() % 11 != 0;
-    if (masked && rng() % 13 == 0) c.residual[i] = 0;
-  }
-  return c;
-}
-
-Result cpu(const Case& c, NodeId source) {
-  if (c.reverse)
-    return shortest_paths_to(c.graph, source, true, EdgeSelection{}, c.residual, c.nm(), c.em());
-  return shortest_paths(c.graph, source, {}, true, EdgeSelection{}, c.residual, c.nm(), c.em());
-}
-
-// Stronger CPU comparator: no DAG allocation and no capacity tie-breaking.
-std::vector<Cost> cpu_distance(const Case& c, NodeId source) {
-  auto& g = c.graph;
-  auto row = c.reverse ? g.in_row_offsets_view() : g.row_offsets_view();
-  auto col = c.reverse ? g.in_col_indices_view() : g.col_indices_view();
-  auto ids = c.reverse ? g.in_adj_edge_index_view() : g.adj_edge_index_view();
-  auto costs = g.cost_view();
-  std::vector<Cost> dist(g.num_nodes(), INF);
-  if (!c.node_mask[source]) return dist;
-  using Item = std::pair<Cost, NodeId>;
-  std::priority_queue<Item, std::vector<Item>, std::greater<Item>> queue;
-  dist[source] = 0; queue.emplace(0, source);
-  while (!queue.empty()) {
-    auto [d, u] = queue.top(); queue.pop();
-    if (d != dist[u]) continue;
-    for (int j = row[u]; j < row[u + 1]; ++j) {
-      int v = col[j], e = ids[j];
-      if (!c.node_mask[v] || !c.edge_mask[e] || c.residual[e] < kMinCap) continue;
-      Cost next = d + costs[e];
-      if (next < dist[v]) { dist[v] = next; queue.emplace(next, v); }
-    }
-  }
-  return dist;
-}
-
-// Reusable workers: CPU batch baseline does not pay thread creation per sample.
-class Pool {
-  std::mutex mutex;
-  std::condition_variable start, done;
-  std::vector<std::thread> workers;
-  std::function<void(int)> task;
-  std::atomic<int> next{0};
-  int count = 0, pending = 0, generation = 0;
-  bool stop = false;
-public:
-  explicit Pool(int n) {
-    for (int i = 0; i < n; ++i) workers.emplace_back([this] {
-      int seen = 0;
-      for (;;) {
-        std::unique_lock lock(mutex);
-        start.wait(lock, [&] { return stop || generation != seen; });
-        if (stop) return;
-        seen = generation;
-        lock.unlock();
-        for (int i; (i = next.fetch_add(1)) < count;) task(i);
-        lock.lock();
-        if (--pending == 0) done.notify_one();
-      }
-    });
-  }
-  void run(int n, std::function<void(int)> f) {
-    std::unique_lock lock(mutex);
-    task = std::move(f); count = n; next = 0; pending = int(workers.size()); ++generation;
-    start.notify_all();
-    done.wait(lock, [&] { return pending == 0; });
-  }
-  ~Pool() {
-    { std::lock_guard lock(mutex); stop = true; }
-    start.notify_all();
-    for (auto& t : workers) t.join();
-  }
-};
-
-struct Metal {
-  id<MTLDevice> device;
-  id<MTLCommandQueue> queue;
-  id<MTLComputePipelineState> pull, group, shared;
-  double setup_ms;
-  Metal(const char* path) {
-    auto t = Clock::now();
-    device = MTLCreateSystemDefaultDevice();
-    if (!device) throw std::runtime_error("No Metal device");
-    queue = [device newCommandQueue];
-    NSError* error = nil;
-    NSString* code = [NSString stringWithContentsOfFile:[NSString stringWithUTF8String:path]
-                                              encoding:NSUTF8StringEncoding error:&error];
-    if (!code) throw std::runtime_error(error.localizedDescription.UTF8String);
-    id<MTLLibrary> library = [device newLibraryWithSource:code options:nil error:&error];
-    if (!library) throw std::runtime_error(error.localizedDescription.UTF8String);
-    pull = [device newComputePipelineStateWithFunction:[library newFunctionWithName:@"relax_pull"] error:&error];
-    group = [device newComputePipelineStateWithFunction:[library newFunctionWithName:@"solve_group"] error:&error];
-    shared = [device newComputePipelineStateWithFunction:[library newFunctionWithName:@"solve_shared"] error:&error];
-    if (!pull || !group || !shared) throw std::runtime_error(error.localizedDescription.UTF8String);
-    setup_ms = ms(t);
-    std::cerr << "device=" << device.name.UTF8String << " setup_ms=" << setup_ms
-              << " execution_width=" << pull.threadExecutionWidth << '\n';
-  }
-  id<MTLBuffer> buffer(const void* ptr, size_t size) {
-    auto b = [device newBufferWithLength:std::max(size_t(4), size) options:MTLResourceStorageModeShared];
-    if (!b) throw std::runtime_error("Metal allocation failed");
-    if (ptr && size) std::memcpy(b.contents, ptr, size);
-    return b;
-  }
-};
-
-struct GpuGraph {
-  const Case& c;
-  Metal& m;
-  id<MTLBuffer> row, col, cost, allowed, a, b, changed, sources;
-  std::vector<uint8_t> enabled;
-  std::vector<int> valid_sources;
-  size_t n, q;
-  double upload_ms = 0, gpu_ms = 0, distance_ms = 0;
-  int rounds = 0;
-  GpuGraph(const Case& testcase, Metal& metal, const std::vector<NodeId>& query_sources)
-      : c(testcase), m(metal), n(c.graph.num_nodes()), q(query_sources.size()) {
-    auto t = Clock::now();
-    auto& g = c.graph;
-    // Reverse SSSP pulls from outgoing CSR. Eligibility uses original edge IDs.
-    auto rows = c.reverse ? g.row_offsets_view() : g.in_row_offsets_view();
-    auto cols = c.reverse ? g.col_indices_view() : g.in_col_indices_view();
-    auto ids = c.reverse ? g.adj_edge_index_view() : g.in_adj_edge_index_view();
-    std::vector<Cost> costs(ids.size());
-    enabled.resize(ids.size());
-    for (size_t j = 0; j < ids.size(); ++j) {
-      int e = ids[j];
-      enabled[j] = c.node_mask[g.edge_src_view()[e]] && c.node_mask[g.edge_dst_view()[e]] &&
-                   c.edge_mask[e] && c.residual[e] >= kMinCap;
-      costs[j] = g.cost_view()[e];
-    }
-    valid_sources = query_sources;
-    for (auto& source : valid_sources) if (!c.node_mask[source]) source = -1;
-    row = m.buffer(rows.data(), rows.size_bytes());
-    col = m.buffer(cols.data(), cols.size_bytes());
-    cost = m.buffer(costs.data(), costs.size() * sizeof(Cost));
-    allowed = m.buffer(enabled.data(), enabled.size());
-    a = m.buffer(nullptr, n * q * sizeof(Cost));
-    b = m.buffer(nullptr, n * q * sizeof(Cost));
-    changed = m.buffer(nullptr, std::max(size_t(8), q) * sizeof(uint32_t));
-    sources = m.buffer(valid_sources.data(), q * sizeof(int));
-    upload_ms = ms(t);
-  }
-
-  void bind(id<MTLComputeCommandEncoder> encoder, id<MTLBuffer> before, id<MTLBuffer> after) {
-    [encoder setBuffer:row offset:0 atIndex:0];
-    [encoder setBuffer:col offset:0 atIndex:1];
-    [encoder setBuffer:cost offset:0 atIndex:2];
-    [encoder setBuffer:allowed offset:0 atIndex:3];
-    [encoder setBuffer:before offset:0 atIndex:4];
-    [encoder setBuffer:after offset:0 atIndex:5];
-    [encoder setBuffer:changed offset:0 atIndex:6];
-  }
-  void wait(id<MTLCommandBuffer> command) {
-    [command commit]; [command waitUntilCompleted];
-    if (command.status == MTLCommandBufferStatusError)
-      throw std::runtime_error(command.error.localizedDescription.UTF8String);
-    gpu_ms += (command.GPUEndTime - command.GPUStartTime) * 1000;
-  }
-  std::vector<Result> run(bool persistent, bool materialize = true, bool shared = false) {
-    auto begin = Clock::now();
-    gpu_ms = 0; rounds = 0;
-    struct Params { uint32_t n, queries, round, unused; } p{uint32_t(n), uint32_t(q), 0, 0};
-    std::vector<const Cost*> outputs(q);
-    if (persistent) {
-      id<MTLCommandBuffer> command = [m.queue commandBuffer];
-      auto encoder = [command computeCommandEncoder];
-      [encoder setComputePipelineState:shared ? m.shared : m.group];
-      bind(encoder, a, b);
-      [encoder setBytes:&p length:sizeof(p) atIndex:7];
-      [encoder setBuffer:sources offset:0 atIndex:8];
-      if (shared) {
-        if (n * 16 + m.shared.staticThreadgroupMemoryLength > m.device.maxThreadgroupMemoryLength)
-          throw std::runtime_error("threadgroup scratch too large");
-        [encoder setThreadgroupMemoryLength:n * 16 atIndex:0];
-      }
-      [encoder dispatchThreadgroups:MTLSizeMake(q, 1, 1) threadsPerThreadgroup:MTLSizeMake(256, 1, 1)];
-      [encoder endEncoding]; wait(command);
-      auto counts = static_cast<const uint32_t*>(changed.contents);
-      for (size_t i = 0; i < q; ++i) {
-        rounds = std::max(rounds, int(counts[i]));
-        outputs[i] = static_cast<const Cost*>((!shared && counts[i] % 2 ? b : a).contents) + i * n;
-      }
-    } else {
-      auto initial = static_cast<Cost*>(a.contents);
-      std::fill(initial, initial + n * q, INF);
-      for (size_t i = 0; i < q; ++i) if (valid_sources[i] >= 0) initial[i * n + valid_sources[i]] = 0;
-      id<MTLBuffer> before = a, after = b;
-      while (rounds < int(n)) {
-        int steps = std::min(8, int(n) - rounds);
-        std::memset(changed.contents, 0, 8 * sizeof(uint32_t));
-        id<MTLCommandBuffer> command = [m.queue commandBuffer];
-        for (int j = 0; j < steps; ++j) {
-          // Separate encoders with tracked resources establish the round dependency.
-          auto encoder = [command computeCommandEncoder];
-          [encoder setComputePipelineState:m.pull]; bind(encoder, before, after);
-          p.round = j;
-          [encoder setBytes:&p length:sizeof(p) atIndex:7];
-          [encoder dispatchThreads:MTLSizeMake(n * q, 1, 1) threadsPerThreadgroup:MTLSizeMake(256, 1, 1)];
-          [encoder endEncoding]; std::swap(before, after);
-        }
-        wait(command); rounds += steps;
-        if (static_cast<const uint32_t*>(changed.contents)[steps - 1] == 0) break;
-      }
-      for (size_t i = 0; i < q; ++i) outputs[i] = static_cast<const Cost*>(before.contents) + i * n;
-    }
-    std::vector<Result> results(q);
-    for (size_t i = 0; i < q; ++i) results[i].first.assign(outputs[i], outputs[i] + n);
-    distance_ms = ms(begin);
-    if (!materialize) return results;
-    for (size_t query = 0; query < q; ++query) {
-      auto& d = results[query].first;
-      auto& dag = results[query].second;
-      auto& g = c.graph;
-      // Positive-cost ECMP reconstruction. Zero costs intentionally require fallback.
-      auto esrc = g.edge_src_view(); auto edst = g.edge_dst_view(); auto costs = g.cost_view();
-      auto tight = [&](size_t e) {
-        int u = esrc[e], v = edst[e];
-        return c.node_mask[u] && c.node_mask[v] && c.edge_mask[e] && c.residual[e] >= kMinCap &&
-               (c.reverse ? (d[v] != INF && d[u] == d[v] + costs[e]) :
-                            (d[u] != INF && d[v] == d[u] + costs[e]));
-      };
-      dag.parent_offsets.assign(n + 1, 0);
-      for (size_t e = 0; e < costs.size(); ++e) if (tight(e)) ++dag.parent_offsets[edst[e] + 1];
-      std::partial_sum(dag.parent_offsets.begin(), dag.parent_offsets.end(), dag.parent_offsets.begin());
-      dag.parents.resize(dag.parent_offsets.back()); dag.via_edges.resize(dag.parents.size());
-      auto cursor = dag.parent_offsets;
-      for (size_t e = 0; e < costs.size(); ++e) if (tight(e)) {
-        int pos = cursor[edst[e]]++; dag.parents[pos] = esrc[e]; dag.via_edges[pos] = int(e);
-      }
-    }
-    return results;
-  }
-};
-
-std::vector<std::tuple<int, int, int>> canonical(const PredDAG& dag) {
-  std::vector<std::tuple<int, int, int>> entries;
-  for (size_t v = 0; v + 1 < dag.parent_offsets.size(); ++v)
-    for (int j = dag.parent_offsets[v]; j < dag.parent_offsets[v + 1]; ++j)
-      entries.emplace_back(v, dag.parents[j], dag.via_edges[j]);
-  std::sort(entries.begin(), entries.end()); return entries;
-}
-
-void verify(const std::vector<Result>& expected, const std::vector<Result>& actual) {
-  if (expected.size() != actual.size()) throw std::runtime_error("query size mismatch");
-  for (size_t q = 0; q < expected.size(); ++q) {
-    if (expected[q].first != actual[q].first) {
-      auto mismatch = std::mismatch(expected[q].first.begin(), expected[q].first.end(), actual[q].first.begin());
-      throw std::runtime_error("distance mismatch at query " + std::to_string(q) + " node " +
-          std::to_string(mismatch.first - expected[q].first.begin()) + " expected " +
-          std::to_string(*mismatch.first) + " actual " + std::to_string(*mismatch.second));
-    }
-    if (canonical(expected[q].second) != canonical(actual[q].second))
-      throw std::runtime_error("DAG edge set mismatch at query " + std::to_string(q));
-  }
-}
-
-double median(std::vector<double> x) { std::sort(x.begin(), x.end()); return x[x.size() / 2]; }
-
-void witnesses(Metal& metal) {
-  auto fixture = [](int n, std::vector<NodeId> src, std::vector<NodeId> dst,
-                    std::vector<Cost> costs, std::vector<Cap> caps) {
-    Case c{"witness", StrictMultiDiGraph::from_arrays(n, src, dst, caps, costs)};
-    c.node_mask = std::make_unique<bool[]>(n);
-    c.edge_mask = std::make_unique<bool[]>(costs.size());
-    std::fill_n(c.node_mask.get(), n, true);
-    std::fill_n(c.edge_mask.get(), costs.size(), true);
-    c.residual.assign(c.graph.capacity_view().begin(), c.graph.capacity_view().end());
-    return c;
-  };
-  auto check = [&](Case& c, NodeId source, const std::vector<Cost>& distances, size_t edges) {
-    auto expected = cpu(c, source);
-    if (expected.first != distances || expected.second.via_edges.size() != edges)
-      throw std::runtime_error("hand-derived witness mismatch");
-    GpuGraph gpu(c, metal, {source});
-    for (int method = 0; method < 3; ++method)
-      verify({expected}, gpu.run(method != 0, true, method == 2));
-  };
-  auto c = fixture(5, {0, 0, 0, 1, 2, 1}, {1, 1, 2, 3, 3, 1},
-                   {1, 1, 1, 1, 1, 1}, {1, 1, 1, 1, 1, 1});
-  check(c, 0, {0, 1, 1, 2, INF}, 5);
-  std::cout << "PASS diamond: all ECMP alternatives, parallel edges, positive self-loop excluded, isolated node\n";
-  c.reverse = true;
-  check(c, 3, {2, 1, 1, 0, INF}, 5);
-  c.reverse = false;
-  std::cout << "PASS reverse diamond: hand-derived distances and forward DAG\n";
-  c.node_mask[0] = false;
-  check(c, 0, {INF, INF, INF, INF, INF}, 0);
-  c.node_mask[0] = true;
-  c.node_mask[1] = false;
-  check(c, 0, {0, INF, 1, 2, INF}, 2);
-  c.node_mask[1] = true;
-  std::cout << "PASS masked source and transit node\n";
-  // All costs equal, graph order is (src,dst), making edge 0 the first parallel edge.
-  c.residual[0] = std::nextafter(kMinCap, 0.0);
-  c.residual[1] = kMinCap;
-  check(c, 0, {0, 1, 1, 2, INF}, 4);
-  std::cout << "PASS double capacity threshold: below rejected, exact threshold admitted\n";
-  c.edge_mask[1] = false;
-  check(c, 0, {0, INF, 1, 2, INF}, 2);
-  std::cout << "PASS edge mask and residual gate combined\n";
-
-  Cost big = Cost(1) << 54;
-  auto wide = fixture(5, {0, 0, 1, 2}, {1, 2, 3, 3},
-                      {big, big, big + 1, big + 2}, {1, 1, 1, 1});
-  check(wide, 0, {0, big, big, 2 * big + 1, INF}, 3);
-  std::cout << "PASS exact int64 costs above 2^53 and one-unit path difference\n";
-
-  auto zero = fixture(3, {0, 1, 2}, {1, 2, 1}, {0, 0, 0}, {1, 1, 1});
-  auto expected = cpu(zero, 0);
-  GpuGraph zg(zero, metal, {0});
-  auto actual = zg.run(true);
-  if (actual[0].first != expected.first || expected.second.via_edges.size() != 2 ||
-      actual[0].second.via_edges.size() != 3)
-    throw std::runtime_error("zero-cost gap witness changed");
-  std::cout << "PASS expected gap: zero-cost distances agree, tight-edge GPU DAG has 1->2->1 cycle; CPU DAG has 2 edges\n";
-  if (float(16777216) != float(16777217) ||
-      float(std::nextafter(kMinCap, 0.0)) != float(kMinCap))
-    throw std::runtime_error("precision gap witness changed");
-  std::cout << "PASS precision gaps: float32 collapses 16777216/16777217 and admits nextafter(kMinCap,0)\n";
-
-  auto tie = fixture(2, {0, 0}, {1, 1}, {1, 1}, {1, 1 + 1e-8});
-  EdgeSelection sel;
-  sel.multi_edge = false; sel.tie_break = EdgeTieBreak::PreferHigherResidual;
-  auto t = shortest_paths(tie.graph, 0, {}, false, sel);
-  if (t.second.via_edges != std::vector<EdgeId>{1} || float(1 + 1e-8) != float(1))
-    throw std::runtime_error("capacity tie witness changed");
-  std::cout << "PASS capacity tie gap: CPU chooses edge 1 at 1+1e-8; float32 collapses both capacities\n";
-}
-
-void benchmark(Case& c, int queries, const std::string& mode, Metal* metal, Pool& pool, int samples) {
-  std::vector<NodeId> sources(queries);
-  for (int i = 0; i < queries; ++i) sources[i] = (i * 997) % c.graph.num_nodes();
-  std::vector<Result> expected(queries);
-  for (int i = 0; i < queries; ++i) expected[i] = cpu(c, sources[i]);
-  std::unique_ptr<GpuGraph> gpu;
-  if (metal) gpu = std::make_unique<GpuGraph>(c, *metal, sources);
-  std::vector<std::string> methods = mode == "cpu" ?
-    std::vector<std::string>{"cpu_full", "cpu_distance", "cpu_pool10", "cpu_pool10_distance"} :
-    std::vector<std::string>{"metal_pull", "metal_group"};
-  if (metal && size_t(c.graph.num_nodes()) * 16 + metal->shared.staticThreadgroupMemoryLength <= metal->device.maxThreadgroupMemoryLength)
-    methods.push_back("metal_shared");
-  for (const auto& method : methods) {
-    std::vector<double> times, device_times, distance_times;
-    int exact_order = 0;
-    for (int rep = -2; rep < samples; ++rep) {
-      @autoreleasepool {
-        auto start = Clock::now();
-        std::vector<Result> actual;
-        if (method == "cpu_full") {
-          actual.resize(queries);
-          for (int i = 0; i < queries; ++i) actual[i] = cpu(c, sources[i]);
-        } else if (method == "cpu_pool10") {
-          actual.resize(queries);
-          pool.run(queries, [&](int i) { actual[i] = cpu(c, sources[i]); });
-        } else if (method == "cpu_distance" || method == "cpu_pool10_distance") {
-          actual.resize(queries);
-          auto task = [&](int i) { actual[i].first = cpu_distance(c, sources[i]); };
-          if (method == "cpu_distance") {
-            for (int i = 0; i < queries; ++i) task(i);
-          } else pool.run(queries, task);
-        } else actual = gpu->run(method != "metal_pull", true, method == "metal_shared");
-        double elapsed = ms(start);
-        // Full validation is outside timing, on every sample, not just warmup.
-        if (method == "cpu_distance" || method == "cpu_pool10_distance") {
-          for (int i = 0; i < queries; ++i) if (actual[i].first != expected[i].first)
-            throw std::runtime_error("CPU distance baseline mismatch");
-        } else {
-          verify(expected, actual);
-          exact_order = 0;
-          for (int i = 0; i < queries; ++i)
-            if (expected[i].second.parents == actual[i].second.parents &&
-                expected[i].second.via_edges == actual[i].second.via_edges) ++exact_order;
-        }
-        if (rep >= 0) {
-          times.push_back(elapsed);
-          device_times.push_back(gpu ? gpu->gpu_ms : 0);
-          distance_times.push_back(gpu ? gpu->distance_ms : elapsed);
-        }
-      }
-    }
-    std::cout << c.name << ',' << c.graph.num_nodes() << ',' << c.graph.num_edges() << ',' << queries
-              << ',' << method << ',' << std::fixed << std::setprecision(6) << median(times)
-              << ',' << median(device_times) << ',' << median(distance_times) << ','
-              << (gpu ? gpu->upload_ms : 0) << ',' << (gpu ? gpu->rounds : 0) << ',' << samples
-              << ",pass," << exact_order << ',';
-    for (size_t i = 0; i < times.size(); ++i) std::cout << (i ? ";" : "") << times[i];
-    std::cout << '\n' << std::flush;
-  }
-}
-
-int main(int argc, char** argv) {
-  @autoreleasepool {
-    try {
-      if (argc < 4) throw std::runtime_error("usage: experiment cpu|gpu kernel-path smoke|full|correctness [samples]");
-      std::string mode = argv[1], suite = argv[3];
-      if (mode != "cpu" && mode != "gpu") throw std::runtime_error("invalid mode");
-      int samples = argc > 4 ? std::stoi(argv[4]) : 7;
-      if (samples < 1) throw std::runtime_error("samples must be positive");
-      Pool pool(10);
-      std::unique_ptr<Metal> metal;
-      if (mode == "gpu") metal = std::make_unique<Metal>(argv[2]);
-      if (suite == "witnesses") {
-        if (!metal) throw std::runtime_error("witnesses require gpu mode");
-        witnesses(*metal); return 0;
-      }
-      std::cout << "case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms\n";
-      auto run = [&](Case c, std::initializer_list<int> qs) {
-        for (int q : qs) benchmark(c, q, mode, metal.get(), pool, samples);
-      };
-      if (suite == "stress") {
-        run(make_case("grid", 1024), {64});
-        run(make_case("random", 1024, 8, true, true, true), {64});
-      } else if (suite == "correctness") {
-        for (unsigned seed = 1; seed <= 12; ++seed) {
-          run(make_case("random", 37 + seed * 3, 6, true, seed % 2, seed % 3 == 0, seed), {8});
-        }
-      } else {
-        run(make_case("random", 128), {1, 64});
-        run(make_case("random", 1024), {1, 64});
-        run(make_case("fabric", 288), {1, 64});
-        run(make_case("grid", 1024), {1, 64});
-        run(make_case("chain", 256), {1});
-        run(make_case("random", 1024, 8, true, true, true), {8});
-        if (suite == "full") {
-          run(make_case("random", 4096), {1, 64, 256});
-          run(make_case("random", 16384), {1, 64});
-          run(make_case("random", 65536), {1, 64});
-          run(make_case("chain", 2048), {1});
-          run(make_case("random", 4096, 32), {1, 64});
-          run(make_case("clos", 200), {1, 64});
-          run(make_case("clos", 800), {1, 64});
-          run(make_case("grid", 10000), {1, 8});
-          run(make_case("grid", 40000), {1});
-        } else if (suite != "smoke") throw std::runtime_error("invalid suite");
-      }
-    } catch (const std::exception& e) {
-      std::cerr << "FAIL: " << e.what() << '\n'; return 1;
-    }
-  }
-}
diff --git a/dev/research/metal_pathfinding/optimization/README.md b/dev/research/metal_pathfinding/optimization/README.md
deleted file mode 100644
index 010b28c..0000000
--- a/dev/research/metal_pathfinding/optimization/README.md
+++ /dev/null
@@ -1,279 +0,0 @@
-# GPU optimization follow-up
-
-27 September 2026, NetGraph-Core `fbab119`, Apple M4 Max, 32 GPU cores,
-14 CPU cores, 36 GiB unified memory. Standalone research; no backend registration
-or production algorithm changes.
-
-**Yes, the first investigation missed important optimizations.** Its poor batch
-results were partly an implementation limitation, especially serial CPU
-predecessor construction. They are not evidence of a GPU performance ceiling.
-The experiments also show why changing to a frontier or bucket algorithm alone
-does not guarantee improvement. Work organization, result construction and the
-CPU comparison algorithm matter together.
-
-**The CPU algorithm comparison also changes the decision.** A follow-up CPU
-Dial-style bucket implementation brings the 16k weighted batch from the native
-CPU's 27.7 ms to 7.7 ms. GPU results across two passes are 3.9–7.5 ms. On the
-65k single-query case the stronger CPU takes 4.4 ms and GPU takes 1.2–1.4 ms.
-Improve CPU specialization first; pursue GPU acceleration selectively.
-
-The consolidated [CPU optimisation plan](../../../perf/spf_queue/PLAN.md) is the implementation
-source of truth. After the [ordered bucket queue experiment](../../../perf/spf_queue/) it
-specifies one queue substitution inside the existing search (BFS and Dial are
-its special cases), verified bit-exact against the production result contract,
-with a hybrid-reset workspace, a width-based dispatch rule and fallback, and
-downstream acceptance requirements. That change is now implemented in
-`src/shortest_paths.cpp`; the plan records its old/new/old measurements at the
-Core level and through NetGraph.
-
-## What changed in the evidence
-
-Fresh processes ran sequentially: CPU A1, original GPU A1, optimized GPU B,
-original GPU A2, CPU A2. Seven measured samples plus two warmups per row;
-every result was checked outside the timed interval. CPU batches use ten
-reusable workers. Times include host distances and positive-cost predecessor
-DAG construction, but exclude graph preparation and pipeline creation.
-
-| Workload | Native CPU A1 / A2, ms | Original GPU A1 / A2, ms | Best tested optimized GPU, ms | Observation |
-|---|---:|---:|---:|---|
-| Weighted random, 1,024 nodes / 8,192 edges, one query | 0.086 / 0.097 | 0.915 / 0.972 | 0.599 | CPU still wins small individual queries |
-| Weighted random, 4,096 / 32,768, 256 queries | 21.391 / 21.281 | 47.812 / 49.310 | 7.003 | Interleaved 64-bit pull makes batching promising |
-| Weighted random, 16,384 / 131,072, 64 queries | 27.693 / 27.721 | 57.748 / 53.106 | 7.473 | Earlier batch pessimism is no longer supported |
-| Weighted random, 65,536 / 524,288, one query | 19.316 / 19.240 | 5.184 / 5.854 | 1.373 | Guarded 32-bit pull plus GPU DAG extraction helps |
-| Unit-cost fabric, 800 / 320,000, 64 queries | 17.042 / 16.525 | 69.896 / 70.228 | 8.185 | CPU BFS plus optimized DAG is already 8.296 / 7.885 ms |
-| Unit-cost grid, 10,000 / 39,600, one query | 0.570 / 0.582 | 3.836 / 5.874 | 3.378 | CPU BFS plus DAG is 0.089 / 0.088 ms |
-| Weighted chain, 2,048 / 2,047, one query | 0.017 / 0.017 | 4.834 / 4.908 | 4.847 | Almost no useful parallel work per frontier |
-
-These are **exploratory measurements, not accepted performance claims**. The
-desktop was not isolated: pre-phase CPU idle readings ranged from 73.28% to
-87.88%, with nonzero background GPU activity. The original GPU grid result
-drifted substantially between A1 and A2. A quiet-machine repeat is still required
-by this repository's performance standard. Nothing was stopped or altered in
-the user's other sessions to obtain these measurements.
-
-The best method is selected after measurement, not by a working runtime
-dispatcher. Original GPU columns select between the original pull and persistent
-group methods; the original shared-memory method was not rerun. The complete
-[18-case table and all 216 optimized rows](results/aba/summary.md),
-[raw samples](results/aba/optimized-b.csv), and
-[environment/source hashes](results/aba/environment.txt) preserve the scope.
-
-## Stronger CPU comparisons
-
-The first table compares against the current native backend. A second A/B/A
-compares GPU with CPU heap and Dial-style cyclic-bucket searches using cached
-eligibility and one-pass DAG assembly. Each CPU worker completes both search and
-DAG for a query, retaining locality. This is a comparable experimental contract
-to the GPU: exact distances and canonical-equivalent positive-cost DAG edge sets,
-without CPU discovery-order parity. Both devices exclude eligibility preparation.
-The weighted random graphs have integer costs 1–31; the CPU Dial prototype is
-explicitly limited to maximum edge weight at most 1,024, and retains int64 sums.
-
-| Workload | CPU cached heap + DAG A1 / A2, ms | CPU Dial + DAG A1 / A2, ms | Best GPU first / second B, ms |
-|---|---:|---:|---:|
-| Random 1,024 / 8,192, one query | 0.053 / 0.059 | 0.028 / 0.030 | 0.599 / 0.634 |
-| Random 4,096 / 32,768, 256 queries | 13.030 / 13.024 | 7.056 / 6.925 | 7.003 / 4.001 |
-| Random 16,384 / 131,072, 64 queries | 17.500 / 17.268 | 7.696 / 7.677 | 7.473 / 3.851 |
-| Random 65,536 / 524,288, one query | 11.474 / 11.530 | 4.384 / 4.372 | 1.373 / 1.244 |
-| Random 4,096 / 131,072, 64 queries | 6.672 / 6.662 | 3.854 / 3.865 | 2.051 / 2.215 |
-| Unit-cost fabric 800 / 320,000, 64 queries | 5.125 / 5.391 | 5.421 / 5.537 | 8.185 / 8.372 |
-
-The second B repeated all 216 optimized GPU rows, unchanged binary, between
-CPU alternative A1/A2. [All second-pass results](results/cpu-algorithms-aba/summary.md)
-and [raw GPU samples](results/cpu-algorithms-aba/b.csv) are retained. The winning
-GPU method changed on the 4k/256 and 16k/64 batches: 32-bit pull plus GPU DAG
-beat the first pass's winning 64-bit pull. Background CPU idle reached 59.82%
-before one phase. We have not attributed this variability to a specific cause;
-it prevents a precise crossover rule or a stable speedup claim.
-
-This strengthens the practical recommendation: CPU optimizations are worthwhile
-independently of GPU support. GPU remains promising for large single-source and
-some batch workloads, but comparisons only against the existing CPU heap backend
-overstate the advantage over a better CPU implementation. On the dense fabric,
-the fused cached CPU heap + DAG is faster than either GPU pass. On the grid,
-the earlier CPU BFS result remains faster than the heap and Dial alternatives.
-
-## Optimizations we missed
-
-1. **Result construction on the CPU.** The first prototype scanned every edge
-   twice and built every query's DAG serially, while the CPU search comparator
-   already had ten workers. A cached-eligibility, one-pass incoming-CSR DAG
-   builder, parallel across queries, reduced the 16k/64-query persistent-group
-   case from approximately 53–58 ms to 13.239 ms without changing the GPU search
-   algorithm. This variant bundles three changes; it does not isolate the
-   contribution of threading from one-pass construction or cached eligibility.
-2. **Batch memory layout.** Making query the contiguous dimension reduced the
-   same workload from 15.959 ms with the query-major 64-bit pull to 7.473 ms.
-   Device time fell from 10.305 to 1.950 ms. Both versions use the same CPU DAG
-   builder and identical relaxation counts. This improvement does not require
-   narrowing distances or a new graph algorithm.
-3. **Device-side DAG extraction.** Counting tight incoming edges, host prefix
-   sums, then GPU filling helped the large single-query and higher-degree batch
-   cases. It is not universally better: query-major frontier plus GPU DAG took
-   15.944 ms on the 800-node fabric batch, versus 9.324 ms with CPU DAG assembly.
-   Layout and output volume require their own decision, separate from SSSP.
-4. **Exact 32-bit specialization.** Narrow distances only when
-   `max_edge_cost * node_count < UINT32_MAX`; otherwise run the 64-bit pull.
-   This conservatively proves that the sentinel cannot collide with finite
-   shortest distances. No floating-point conversion is used. It helped some
-   cases, but 64-bit pull beat 32-bit pull on the 16k batch, so narrower is not
-   automatically faster. Eligibility still uses CPU double-precision residuals.
-5. **Command and host overhead.** Multiple dispatches share a compute encoder
-   with explicit buffer barriers; convergence flags are aggregated by SIMD
-   group. These changes were tested as a bundle. An initial screening defect
-   repeatedly invoked the Objective-C buffer accessor inside the conversion
-   loop. Hoisting it removed large batch host overhead before final timings.
-   The retained [screening notes](results/screen-known-limitations.txt) distinguish
-   those preliminary measurements from the final matrix.
-
-Apple's compute documentation supports batching dispatches and respecting
-resource synchronization. Its Metal 4 command allocators and reusable command
-infrastructure offer another way to reduce encoding overhead. Metal 4 itself
-was **not implemented or timed** here.
-[Metal calculations](https://developer.apple.com/documentation/metal/performing-calculations-on-a-gpu),
-[Metal 4 command management](https://developer.apple.com/videos/play/wwdc2025/254/).
-
-## Should we change algorithms?
-
-**Weighted, general graphs: retain both pull and frontier candidates.**
-Davidson et al. study Workfront Sweep, Near-Far and Bucketing as different
-balances between redundant edge work and scheduling overhead. That is the right
-comparison space for this problem; ordinary parallel Dijkstra is not an obvious
-GPU default. Their NVIDIA results are not M4 speed predictions.
-[2014 SSSP paper](https://escholarship.org/uc/item/8qr166v2).
-
-The new active-frontier implementation supports one thread or one SIMD group
-per active vertex, indirect dispatch and queue deduplication. It reduced the
-16k/64-query relaxation work from 201.327 million adjacency entries to about
-21–22 million. Yet its best full time was 10.144 ms, versus 7.473 ms for
-interleaved pull. On the 10k grid it reduced edge scans from 7.920 million to
-39,600, but still took 4.040 ms versus pull's 3.378 ms. It retained 200 rounds
-and 25 host waits. Less edge work is real; the latency win is not automatic.
-
-**Distance buckets remain worth investigating, but our simple version is not a
-win.** The delta-4 experiment reduced the 16k batch to 8.451 million edge visits,
-but needed 72 rounds and 16.825 ms. Delta-16 and delta-64 were also slower than
-the best pull. This implementation scans all pending vertex slots to find and
-select each bucket, uses a batch-wide minimum and bulk synchronization, and has
-neither a light/heavy edge split nor a sophisticated asynchronous queue.
-These results reject this implementation as the default, not delta-stepping.
-
-ADDS specifically addresses bucket management, asynchronous work scheduling
-and dynamic delta selection. It is a plausible next algorithmic investigation,
-but a correct Metal port needs a progress-safe queue and synchronization design;
-copying CUDA persistent-worker assumptions would not establish correctness.
-Its published RTX 2080 Ti speedups do not establish gains on Apple hardware.
-[ADDS, PPoPP 2021](https://www.cs.utexas.edu/~lin/papers/ppopp21.pdf).
-
-**Uniform positive costs: test BFS on the CPU as well as the GPU.** The new CPU
-BFS comparator was checked against native Dijkstra and uses the same cached
-eligibility and optimized DAG construction as the GPU variants. It is a major
-improvement on grids and removes most of the apparent GPU advantage on the
-dense fabric. Direction-optimizing BFS can switch between sparse frontiers and
-pulling from unvisited vertices. Its early exit after finding one parent applies
-to distance discovery; all ECMP predecessors still require extraction.
-[Direction-optimizing BFS](https://people.eecs.berkeley.edu/~krste/papers/beamer-sc2012.pdf).
-
-The CPU plan now preserves predecessor order by construction: the ordered
-bucket queue reproduces the heap's pop order exactly, and the unit-cost case is
-its `W = 2` instance. Under that full contract the sequential gain on uniform-cost
-graphs is 1.1–1.3x and inconclusive on the dense fabric, where edge scanning
-dominates; the larger research BFS numbers came from the relaxed contract.
-
-**Stable, road-like graphs with many repeated queries: consider preprocessing.**
-PHAST uses contraction-hierarchy preprocessing followed by an ordered sweep.
-The paper explicitly requires enough queries to amortize preprocessing and
-focuses on low-highway-dimension graphs. For NetGraph, changing masks, residual
-eligibility and weights mean shortcut validity or customization must be handled;
-that applicability assessment is our inference, not a measured PHAST result.
-It is not the first choice for arbitrary changing network simulations.
-[PHAST](https://www.microsoft.com/en-us/research/wp-content/uploads/2011/01/phast_ipdps.pdf).
-
-**Small or destination-limited searches: keep the CPU path.** These tests are
-full-source searches; they do not compare against target-early-exit Dijkstra.
-Bidirectional search or A* with a proven admissible lower bound can be relevant
-to point-to-point workloads, but neither was implemented or timed here. Likewise,
-CPU radix queues for wider integer costs remain an unmeasured stronger comparator;
-the bounded-weight Dial alternative is measured above.
-
-## Recommended implementation order
-
-Follow the [CPU plan](../../../perf/spf_queue/PLAN.md): add the differential parity test with a
-forced heap route, land the ordered bucket queue and hybrid-reset workspace in
-the forward search as one change gated on the existing output hashes, extend to
-the reverse search, freeze the width limit, then validate downstream. Batching
-and a new distance-only API are conditional on actual callers, not prerequisites
-for single-query CPU gains.
-
-After those gates, revisit the GPU candidates against the accepted CPU baseline:
-interleaved exact 64-bit pull, guarded 32-bit paths, and separately selected result
-construction. Adaptive frontier/pull selection and improved bucket scheduling
-remain later GPU research. The existing evidence does not establish full-backend
-compatibility or justify automatic CPU/GPU dispatch.
-
-## Validation and remaining limits
-
-- Final A/B/A: 384 rows, 124,704 checked query results including warmups.
-- Correctness: 12 seeded masked graphs and 12 boundary fixtures, all 14 variants,
-  11,760 checked query results. Fixtures exercise forward/reverse traversal,
-  parallel edges, self-loops, blocked sources, unreachable nodes, residuals just
-  below and at `kMinCap`, distances near the 32-bit boundary, guarded fallback,
-  and integer costs greater than `2^53`.
-- Normal stress: 39,424 checked results. ASan/UBSan plus Metal API and GPU shader
-  validation: another 11,760 correctness and 8,960 stress results. No reported
-  sanitizer or validation errors. These repetitions are not independent graphs.
-- The separate CPU comparison repeats masked positive-cost checks against native
-  Dijkstra, and runs ASan/UBSan over both its masked fixtures and all seven
-  performance workloads. See the [audit](results/audit.json) for exact counts.
-- Across both final timing sequences and the listed correctness/stress runs:
-  290,192 checked query results, including CPU comparator rows and warmups.
-- Final repository check rebuilt the Python extension and passed lint, types,
-  170 C++ tests and 465 Python tests. `make sanitize-test` passed all 170 C++
-  tests. An initial formatting failure in the new summarizer was corrected and
-  both subsequent workspace checks passed. These are local checks; CI was not
-  run. No production tracked files changed, and no commit or push was made.
-- All distances compare exactly. Positive-cost predecessor edge sets compare
-  canonically to native CPU results; CPU discovery order is not reproduced.
-- Graphs are synthetic and modest in size. No realistic demand traces, cold
-  production latency, concurrent calls, per-query mask batches, cost-factor flows,
-  zero-cost DAG parity or complete backend compatibility were established.
-- GPU buffers and cached eligibility are prepared before timing. `upload_ms`
-  includes the superset of buffers needed by all experimental variants, not a
-  minimal production upload. Printed `setup_ms` is inherited phase-one pipeline
-  setup and excludes the additional optimization library; it is not total cold
-  initialization. GPU timestamps and distance timing are diagnostic subsets,
-  not substitutes for full wall time. Do not subtract separate medians to claim
-  an exact component cost.
-- Queue atomics, bucket scans, vertex initialization and DAG extraction are not
-  included in the `edge_visits` counter. The counter measures SSSP adjacency work.
-- The prototype requires SIMD width 32 and 256-thread groups, checked at runtime,
-  and imposes experimental size limits. It is not a portable library implementation.
-
-Reproduce from the repository root:
-
-```sh
-bash dev/research/metal_pathfinding/optimization/build.sh
-build/metal_pathfinding/optimized all correctness 3
-build/metal_pathfinding/optimized all stress 20
-bash dev/research/metal_pathfinding/optimization/run_aba.sh
-python3 dev/research/metal_pathfinding/optimization/summarize.py
-bash dev/research/metal_pathfinding/optimization/build.sh sanitize
-MTL_DEBUG_LAYER=1 MTL_SHADER_VALIDATION=1 ASAN_OPTIONS=detect_leaks=0 \
-  build/metal_pathfinding/optimized-sanitize all correctness 3
-MTL_DEBUG_LAYER=1 MTL_SHADER_VALIDATION=1 ASAN_OPTIONS=detect_leaks=0 \
-  build/metal_pathfinding/optimized-sanitize all stress 3
-bash dev/research/metal_pathfinding/optimization/build_cpu.sh
-build/metal_pathfinding/cpu-algorithms 3 correctness
-bash dev/research/metal_pathfinding/optimization/run_cpu_aba.sh
-python3 dev/research/metal_pathfinding/optimization/summarize_cpu.py
-bash dev/research/metal_pathfinding/optimization/build_cpu.sh sanitize
-ASAN_OPTIONS=detect_leaks=0 build/metal_pathfinding/cpu-algorithms-sanitize 3 correctness
-ASAN_OPTIONS=detect_leaks=0 build/metal_pathfinding/cpu-algorithms-sanitize 2
-make sanitize-test
-bash .superset/workspace.sh check
-```
-
-Run timings sequentially without builds or tests in parallel. The compiler emits
-one known warning because the reused phase-one `main` is renamed for inclusion;
-that unused helper lacks an explicit return after its success path. It is not
-called by this harness. The original experiment and shader hashes are unchanged.
diff --git a/dev/research/metal_pathfinding/optimization/build.sh b/dev/research/metal_pathfinding/optimization/build.sh
deleted file mode 100644
index d3cd00a..0000000
--- a/dev/research/metal_pathfinding/optimization/build.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-mkdir -p build/metal_pathfinding
-flags=(-std=c++20 -O3 -flto -funroll-loops -fno-math-errno -fno-trapping-math)
-if [[ ${1:-} == sanitize ]]; then
-  flags=(-std=c++20 -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
-fi
-xcrun clang++ "${flags[@]}" -fobjc-arc -Iinclude \
-  dev/research/metal_pathfinding/optimization/experiment.mm src/strict_multidigraph.cpp \
-  src/shortest_paths.cpp src/profiling.cpp -framework Foundation -framework Metal \
-  -o "build/metal_pathfinding/optimized${1:+-$1}"
diff --git a/dev/research/metal_pathfinding/optimization/build_cpu.sh b/dev/research/metal_pathfinding/optimization/build_cpu.sh
deleted file mode 100644
index e8b95a1..0000000
--- a/dev/research/metal_pathfinding/optimization/build_cpu.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-flags=(-std=c++20 -O3 -flto -funroll-loops -fno-math-errno -fno-trapping-math)
-if [[ ${1:-} == sanitize ]]; then
-  flags=(-std=c++20 -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
-fi
-xcrun clang++ "${flags[@]}" -fobjc-arc -Iinclude \
-  dev/research/metal_pathfinding/optimization/cpu_algorithms.mm src/strict_multidigraph.cpp \
-  src/shortest_paths.cpp src/profiling.cpp -framework Foundation -framework Metal \
-  -o "build/metal_pathfinding/cpu-algorithms${1:+-$1}"
diff --git a/dev/research/metal_pathfinding/optimization/cpu_algorithms.mm b/dev/research/metal_pathfinding/optimization/cpu_algorithms.mm
deleted file mode 100644
index 58dc6ae..0000000
--- a/dev/research/metal_pathfinding/optimization/cpu_algorithms.mm
+++ /dev/null
@@ -1,102 +0,0 @@
-// Stronger CPU algorithm comparators for the same positive-cost result contract.
-#define main phase_one_main
-#include "../experiment.mm"
-#undef main
-
-struct PreparedCpu {
-  const Case& c;
-  std::vector<uint8_t> enabled;
-  Cost max_weight=0;
-  explicit PreparedCpu(const Case& graph):c(graph),enabled(graph.graph.num_edges()) {
-    const auto& g=c.graph;
-    for(int e=0;e<g.num_edges();++e) {
-      enabled[e]=c.node_mask[g.edge_src_view()[e]] && c.node_mask[g.edge_dst_view()[e]] &&
-                 c.edge_mask[e] && c.residual[e]>=kMinCap;
-      max_weight=std::max(max_weight,g.cost_view()[e]);
-    }
-  }
-  Result solve(NodeId source,bool dial) const {
-    const auto& g=c.graph; int n=g.num_nodes();
-    auto row=g.row_offsets_view(),col=g.col_indices_view(),ids=g.adj_edge_index_view();
-    auto costs=g.cost_view();
-    Result result; auto& dist=result.first; auto& dag=result.second;
-    dist.assign(n,INF);
-    using Item=std::pair<Cost,NodeId>;
-    auto visit=[&](Cost d,NodeId u,auto&& push) {
-      if(d!=dist[u]) return;
-      for(int j=row[u];j<row[u+1];++j) {
-        int v=col[j],e=ids[j]; if(!enabled[e]) continue;
-        Cost next=d+costs[e];
-        if(next<dist[v]) {dist[v]=next;push(Item{next,v});}
-      }
-    };
-    if(c.node_mask[source]) {
-      dist[source]=0;
-      if(dial) {
-        if(max_weight>1024) throw std::runtime_error("Dial comparison requires max weight <= 1024");
-        size_t width=size_t(max_weight)+1,pending=1;
-        std::vector<std::vector<Item>> buckets(width);
-        buckets[0].emplace_back(0,source); Cost current=0;
-        auto push=[&](Item x){buckets[size_t(x.first)%width].push_back(x);++pending;};
-        while(pending) {
-          auto& bucket=buckets[size_t(current)%width];
-          if(bucket.empty()) {++current;continue;}
-          auto [d,u]=bucket.back();bucket.pop_back();--pending;
-          if(d!=current) throw std::runtime_error("Dial ordering invariant failed");
-          visit(d,u,push);
-        }
-      } else {
-        std::priority_queue<Item,std::vector<Item>,std::greater<Item>> heap;
-        heap.emplace(0,source);
-        auto push=[&](Item x){heap.push(x);};
-        while(!heap.empty()) {auto [d,u]=heap.top();heap.pop();visit(d,u,push);}
-      }
-    }
-    auto inrow=g.in_row_offsets_view(),incol=g.in_col_indices_view(),inids=g.in_adj_edge_index_view();
-    dag.parent_offsets.resize(n+1);dag.parents.reserve(n);dag.via_edges.reserve(n);
-    for(int v=0;v<n;++v) {
-      dag.parent_offsets[v]=int(dag.parents.size());
-      for(int j=inrow[v];j<inrow[v+1];++j) {
-        int u=incol[j],e=inids[j];
-        if(enabled[e] && dist[u]!=INF && dist[v]==dist[u]+costs[e]) {
-          dag.parents.push_back(u);dag.via_edges.push_back(e);
-        }
-      }
-    }
-    dag.parent_offsets[n]=int(dag.parents.size());return result;
-  }
-};
-
-int main(int argc,char** argv) {
-  try {
-    int samples=argc>1 ? std::stoi(argv[1]) : 7; bool correctness=argc>2;
-    Pool pool(10);
-    std::cout<<"case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms\n";
-    auto run=[&](Case c,int q) {
-      std::vector<Result> expected(q); std::vector<NodeId> sources(q);
-      for(int i=0;i<q;++i) {sources[i]=(i*997)%c.graph.num_nodes();expected[i]=cpu(c,sources[i]);}
-      PreparedCpu prepared(c);
-      for(bool dial:{false,true}) {
-        std::vector<double> times;
-        for(int rep=-2;rep<samples;++rep) {
-          auto start=Clock::now(); std::vector<Result> actual(q);
-          auto query=[&](int i){actual[i]=prepared.solve(sources[i],dial);};
-          if(q==1) query(0);else pool.run(q,query);
-          double elapsed=ms(start);verify(expected,actual);if(rep>=0)times.push_back(elapsed);
-        }
-        std::cout<<c.name<<','<<c.graph.num_nodes()<<','<<c.graph.num_edges()<<','<<q<<','
-          <<(dial ? "cpu_dial_full" : "cpu_heap_cached_full")<<','<<std::fixed<<std::setprecision(6)
-          <<median(times)<<','<<samples<<",pass,";
-        for(size_t j=0;j<times.size();++j)std::cout<<(j ? ";" : "")<<times[j];
-        std::cout<<'\n'<<std::flush;
-      }
-    };
-    if(correctness) {
-      for(unsigned seed=1;seed<=12;++seed)run(make_case("random",37+seed*3,6,true,false,false,seed),8);
-    } else {
-      run(make_case("random",1024),1);run(make_case("random",4096),256);
-      run(make_case("random",16384),64);run(make_case("random",65536),1);
-      run(make_case("random",4096,32),64);run(make_case("clos",800),64);run(make_case("grid",10000),1);
-    }
-  } catch(const std::exception& e) {std::cerr<<"FAIL: "<<e.what()<<'\n';return 1;}
-}
diff --git a/dev/research/metal_pathfinding/optimization/experiment.mm b/dev/research/metal_pathfinding/optimization/experiment.mm
deleted file mode 100644
index fcdea1a..0000000
--- a/dev/research/metal_pathfinding/optimization/experiment.mm
+++ /dev/null
@@ -1,439 +0,0 @@
-// Reuse the audited phase-one generators, CPU implementations and validation.
-// The original source/kernel files remain unchanged, preserving their hashes.
-#define main phase_one_main
-#include "../experiment.mm"
-#undef main
-#include <map>
-
-struct OptimizedMetal : Metal {
-  std::map<std::string, id<MTLComputePipelineState>> pipelines;
-  OptimizedMetal() : Metal("dev/research/metal_pathfinding/sssp.metal") {
-    NSError* error = nil;
-    NSString* code = [NSString stringWithContentsOfFile:@"dev/research/metal_pathfinding/optimization/kernels.metal"
-                                             encoding:NSUTF8StringEncoding error:&error];
-    auto lib = [device newLibraryWithSource:code options:nil error:&error];
-    if (!lib) throw std::runtime_error(error.localizedDescription.UTF8String);
-    for (const char* name : {"pull64","pull32","prepare","expand","bucket_reset",
-                            "bucket_min","bucket_select","dag_count64","dag_fill64",
-                            "dag_count32","dag_fill32"}) {
-      auto fn = [lib newFunctionWithName:[NSString stringWithUTF8String:name]];
-      auto pipeline = [device newComputePipelineStateWithFunction:fn error:&error];
-      if (!pipeline) throw std::runtime_error(error.localizedDescription.UTF8String);
-      if (pipeline.threadExecutionWidth != 32 || pipeline.maxTotalThreadsPerThreadgroup < 256)
-        throw std::runtime_error("this research configuration requires SIMD32 and 256-thread groups");
-      pipelines.emplace(name, pipeline);
-    }
-  }
-};
-
-struct Config {
-  std::string name, solver;
-  bool layout = false, narrow = false, gpu_dag = false;
-  int lanes = 1, delta = 0;
-};
-
-struct OptimizedGraph {
-  const Case& c;
-  OptimizedMetal& m;
-  Pool& pool;
-  GpuGraph old;
-  std::vector<NodeId> sources;
-  std::vector<Cost> in_costs;
-  std::vector<uint8_t> in_enabled;
-  id<MTLBuffer> a64,b64,a32,b32,weights32;
-  id<MTLBuffer> outrow,outcol,outcost,outenabled,queueA,queueB,counts,marks,args,work,minimum;
-  id<MTLBuffer> inrow,incol,incost,inids,inenabled,offsets,parents,via;
-  size_t n, q, e;
-  bool fits32;
-  double upload_ms=0, distance_ms=0, gpu_ms=0;
-  uint64_t edge_visits=0;
-  int rounds=0, waits=0;
-  bool fallback=false;
-  struct P { uint32_t n,q,round,layout,current,epoch,lanes,delta; };
-
-  OptimizedGraph(const Case& testcase, OptimizedMetal& metal, Pool& workers,
-                 std::vector<NodeId> query_sources)
-      : c(testcase),m(metal),pool(workers),old(c,m,query_sources),sources(std::move(query_sources)),
-        n(c.graph.num_nodes()),q(sources.size()),e(c.graph.num_edges()) {
-    auto begin=Clock::now();
-    if (!n || n*q>UINT32_MAX/32 || e*q>UINT32_MAX/8) throw std::runtime_error("experiment size limit");
-    auto& g=c.graph;
-    Cost largest=0;
-    for (Cost cost:g.cost_view()) largest=std::max(largest,cost);
-    // Strictly less than the sentinel; the multiplication is bounded in uint64.
-    fits32=largest < Cost(UINT32_MAX) && uint64_t(largest)*n < UINT32_MAX;
-    a64=m.buffer(nullptr,n*q*8); b64=m.buffer(nullptr,n*q*8);
-    a32=m.buffer(nullptr,n*q*4); b32=m.buffer(nullptr,n*q*4);
-    std::vector<uint32_t> ws(e);
-    auto pull_ids=c.reverse ? g.adj_edge_index_view() : g.in_adj_edge_index_view();
-    for(size_t j=0;j<e;++j) ws[j]=fits32 ? uint32_t(g.cost_view()[pull_ids[j]]) : 0;
-    weights32=m.buffer(ws.data(),e*4);
-    auto orow=c.reverse ? g.in_row_offsets_view() : g.row_offsets_view();
-    auto ocol=c.reverse ? g.in_col_indices_view() : g.col_indices_view();
-    auto oids=c.reverse ? g.in_adj_edge_index_view() : g.adj_edge_index_view();
-    std::vector<uint8_t> oe(e);
-    for(size_t j=0;j<e;++j) {
-      size_t id=oids[j];
-      ws[j]=fits32 ? uint32_t(g.cost_view()[id]) : 0;
-      oe[j]=c.node_mask[g.edge_src_view()[id]] && c.node_mask[g.edge_dst_view()[id]] &&
-            c.edge_mask[id] && c.residual[id]>=kMinCap;
-    }
-    outrow=m.buffer(orow.data(),orow.size_bytes()); outcol=m.buffer(ocol.data(),ocol.size_bytes());
-    outcost=m.buffer(ws.data(),e*4); outenabled=m.buffer(oe.data(),e);
-    queueA=m.buffer(nullptr,n*q*4); queueB=m.buffer(nullptr,n*q*4);
-    counts=m.buffer(nullptr,8); marks=m.buffer(nullptr,n*q*4);
-    args=m.buffer(nullptr,12); work=m.buffer(nullptr,32); minimum=m.buffer(nullptr,4);
-    in_costs.resize(e); in_enabled.resize(e);
-    auto ids=g.in_adj_edge_index_view();
-    for(size_t j=0;j<e;++j) {
-      size_t id=ids[j];
-      in_costs[j]=g.cost_view()[id];
-      in_enabled[j]=c.node_mask[g.edge_src_view()[id]] && c.node_mask[g.edge_dst_view()[id]] &&
-                    c.edge_mask[id] && c.residual[id]>=kMinCap;
-    }
-    inrow=m.buffer(g.in_row_offsets_view().data(),g.in_row_offsets_view().size_bytes());
-    incol=m.buffer(g.in_col_indices_view().data(),g.in_col_indices_view().size_bytes());
-    inids=m.buffer(ids.data(),ids.size_bytes()); incost=m.buffer(in_costs.data(),e*8);
-    inenabled=m.buffer(in_enabled.data(),e); offsets=m.buffer(nullptr,(n+1)*q*4);
-    // Reserve output capacity once; only actual DAG entries are copied to host.
-    parents=m.buffer(nullptr,e*q*4); via=m.buffer(nullptr,e*q*4);
-    upload_ms=old.upload_ms+ms(begin);
-  }
-
-  void wait(id<MTLCommandBuffer> cb) {
-    [cb commit]; [cb waitUntilCompleted]; ++waits;
-    if(cb.status==MTLCommandBufferStatusError) throw std::runtime_error(cb.error.localizedDescription.UTF8String);
-    gpu_ms+=(cb.GPUEndTime-cb.GPUStartTime)*1000;
-  }
-  void pipeline(id<MTLComputeCommandEncoder> enc,const char* name) {
-    [enc setComputePipelineState:m.pipelines.at(name)];
-  }
-  void dispatch(id<MTLComputeCommandEncoder> enc,size_t size) {
-    [enc dispatchThreads:MTLSizeMake(size,1,1) threadsPerThreadgroup:MTLSizeMake(256,1,1)];
-    [enc memoryBarrierWithScope:MTLBarrierScopeBuffers];
-  }
-  void one(id<MTLComputeCommandEncoder> enc) {
-    [enc dispatchThreadgroups:MTLSizeMake(1,1,1) threadsPerThreadgroup:MTLSizeMake(1,1,1)];
-    [enc memoryBarrierWithScope:MTLBarrierScopeBuffers];
-  }
-
-  void cpu_dags(std::vector<Result>& results) {
-    auto row=c.graph.in_row_offsets_view(); auto col=c.graph.in_col_indices_view();
-    auto ids=c.graph.in_adj_edge_index_view();
-    auto build=[&](int query) {
-      auto& d=results[query].first; auto& dag=results[query].second;
-      dag.parent_offsets.resize(n+1);
-      // Append in incoming-CSR order in one scan. Eligibility was cached at upload.
-      dag.parents.reserve(n); dag.via_edges.reserve(n);
-      for(size_t v=0;v<n;++v) {
-        dag.parent_offsets[v]=int(dag.parents.size());
-        for(int j=row[v];j<row[v+1];++j) {
-          int u=col[j]; Cost w=in_costs[j];
-          bool tight=in_enabled[j] && (c.reverse ? (d[v]!=INF && d[u]==d[v]+w) :
-                                                       (d[u]!=INF && d[v]==d[u]+w));
-          if(tight) { dag.parents.push_back(u); dag.via_edges.push_back(ids[j]); }
-        }
-      }
-      dag.parent_offsets[n]=int(dag.parents.size());
-    };
-    if(q==1) build(0); else pool.run(int(q),build);
-  }
-
-  id<MTLBuffer> pull(Config cfg) {
-    id<MTLBuffer> before=cfg.narrow ? a32 : a64, after=cfg.narrow ? b32 : b64;
-    if(cfg.narrow) std::fill_n(static_cast<uint32_t*>(before.contents),n*q,UINT32_MAX);
-    else std::fill_n(static_cast<Cost*>(before.contents),n*q,INF);
-    for(size_t i=0;i<q;++i) if(c.node_mask[sources[i]]) {
-      size_t index=cfg.layout ? size_t(sources[i])*q+i : i*n+sources[i];
-      if(cfg.narrow) static_cast<uint32_t*>(before.contents)[index]=0;
-      else static_cast<Cost*>(before.contents)[index]=0;
-    }
-    P p{uint32_t(n),uint32_t(q),0,uint32_t(cfg.layout),0,0,1,0};
-    while(rounds<int(n)) {
-      int steps=std::min(8,int(n)-rounds);
-      std::memset(old.changed.contents,0,32);
-      auto cb=[m.queue commandBuffer]; auto enc=[cb computeCommandEncoder];
-      pipeline(enc,cfg.narrow ? "pull32" : "pull64");
-      [enc setBuffer:old.row offset:0 atIndex:0]; [enc setBuffer:old.col offset:0 atIndex:1];
-      [enc setBuffer:cfg.narrow ? weights32 : old.cost offset:0 atIndex:2];
-      [enc setBuffer:old.allowed offset:0 atIndex:3]; [enc setBuffer:old.changed offset:0 atIndex:6];
-      for(int j=0;j<steps;++j) {
-        p.round=j; [enc setBytes:&p length:sizeof(p) atIndex:7];
-        [enc setBuffer:before offset:0 atIndex:4]; [enc setBuffer:after offset:0 atIndex:5];
-        dispatch(enc,n*q); std::swap(before,after);
-      }
-      [enc endEncoding]; wait(cb); rounds+=steps; edge_visits+=uint64_t(steps)*e*q;
-      if(static_cast<uint32_t*>(old.changed.contents)[steps-1]==0) break;
-    }
-    return before;
-  }
-
-  id<MTLBuffer> frontier(Config cfg) {
-    std::fill_n(static_cast<uint32_t*>(a32.contents),n*q,UINT32_MAX);
-    std::memset(marks.contents,0,n*q*4); std::memset(counts.contents,0,8);
-    uint32_t active=0;
-    for(size_t query=0;query<q;++query) if(c.node_mask[sources[query]]) {
-      uint32_t index=uint32_t(query*n+sources[query]);
-      static_cast<uint32_t*>(a32.contents)[index]=0;
-      static_cast<uint32_t*>(queueA.contents)[active++]=index;
-      if(cfg.delta) static_cast<uint32_t*>(marks.contents)[index]=1;
-    }
-    static_cast<uint32_t*>(counts.contents)[0]=active;
-    uint32_t current=0;
-    id<MTLBuffer> input=queueA, output=queueB;
-    P p{uint32_t(n),uint32_t(q),0,0,0,1,uint32_t(cfg.lanes),uint32_t(cfg.delta)};
-    // Fail rather than returning unconverged data if an implementation bug or
-    // pathological scheduler exceeds this research harness's operational limit.
-    while(rounds<1000000) {
-      std::memset(work.contents,0,32);
-      auto cb=[m.queue commandBuffer]; auto enc=[cb computeCommandEncoder];
-      for(int j=0;j<8;++j) {
-        p.round=j; p.current=cfg.delta ? 0 : current; p.epoch=uint32_t(rounds+j+1);
-        [enc setBytes:&p length:sizeof(p) atIndex:7];
-        if(cfg.delta) {
-          input=queueA; output=queueB;
-          pipeline(enc,"bucket_reset");
-          [enc setBuffer:counts offset:0 atIndex:0]; [enc setBuffer:minimum offset:0 atIndex:1]; one(enc);
-          pipeline(enc,"bucket_min");
-          [enc setBuffer:a32 offset:0 atIndex:0]; [enc setBuffer:marks offset:0 atIndex:1];
-          [enc setBuffer:minimum offset:0 atIndex:2]; dispatch(enc,n*q);
-          pipeline(enc,"bucket_select");
-          [enc setBuffer:a32 offset:0 atIndex:0]; [enc setBuffer:marks offset:0 atIndex:1];
-          [enc setBuffer:minimum offset:0 atIndex:2]; [enc setBuffer:input offset:0 atIndex:3];
-          [enc setBuffer:counts offset:0 atIndex:4]; dispatch(enc,n*q);
-        }
-        pipeline(enc,"prepare");
-        [enc setBuffer:counts offset:0 atIndex:0]; [enc setBuffer:args offset:0 atIndex:1]; one(enc);
-        pipeline(enc,"expand");
-        [enc setBuffer:outrow offset:0 atIndex:0]; [enc setBuffer:outcol offset:0 atIndex:1];
-        [enc setBuffer:outcost offset:0 atIndex:2]; [enc setBuffer:outenabled offset:0 atIndex:3];
-        [enc setBuffer:a32 offset:0 atIndex:4]; [enc setBuffer:input offset:0 atIndex:5];
-        [enc setBuffer:output offset:0 atIndex:6]; [enc setBuffer:counts offset:0 atIndex:8];
-        [enc setBuffer:marks offset:0 atIndex:9]; [enc setBuffer:work offset:0 atIndex:10];
-        [enc dispatchThreadgroupsWithIndirectBuffer:args indirectBufferOffset:0 threadsPerThreadgroup:MTLSizeMake(256,1,1)];
-        [enc memoryBarrierWithScope:MTLBarrierScopeBuffers];
-        if(!cfg.delta) { std::swap(input,output); current=1-current; }
-      }
-      [enc endEncoding]; wait(cb); rounds+=8;
-      for(int j=0;j<8;++j) edge_visits+=static_cast<uint32_t*>(work.contents)[j];
-      if(static_cast<uint32_t*>(counts.contents)[cfg.delta ? 0 : current]==0) return a32;
-    }
-    throw std::runtime_error("frontier failed to converge");
-  }
-
-  void gpu_dags(std::vector<Result>& results,id<MTLBuffer> distances,bool narrow,bool layout) {
-    struct DP { uint32_t n,q,e,layout,reverse,a,b,c; } p{uint32_t(n),uint32_t(q),uint32_t(e),uint32_t(layout),uint32_t(c.reverse),0,0,0};
-    auto encode=[&](bool fill) {
-      auto cb=[m.queue commandBuffer]; auto enc=[cb computeCommandEncoder];
-      pipeline(enc,fill ? (narrow ? "dag_fill32" : "dag_fill64") : (narrow ? "dag_count32" : "dag_count64"));
-      [enc setBuffer:inrow offset:0 atIndex:0]; [enc setBuffer:incol offset:0 atIndex:1];
-      [enc setBuffer:incost offset:0 atIndex:2]; [enc setBuffer:inids offset:0 atIndex:3];
-      [enc setBuffer:inenabled offset:0 atIndex:4]; [enc setBuffer:distances offset:0 atIndex:5];
-      [enc setBuffer:offsets offset:0 atIndex:6]; [enc setBytes:&p length:sizeof(p) atIndex:7];
-      [enc setBuffer:parents offset:0 atIndex:8]; [enc setBuffer:via offset:0 atIndex:9];
-      dispatch(enc,n*q); [enc endEncoding]; wait(cb);
-    };
-    encode(false);
-    pool.run(int(q),[&](int query) {
-      auto ptr=static_cast<int*>(offsets.contents)+query*(n+1);
-      ptr[0]=0; std::partial_sum(ptr,ptr+n+1,ptr);
-      results[query].second.parent_offsets.assign(ptr,ptr+n+1);
-    });
-    encode(true);
-    pool.run(int(q),[&](int query) {
-      auto& dag=results[query].second; int size=dag.parent_offsets.back();
-      auto ps=static_cast<int*>(parents.contents)+query*e;
-      auto es=static_cast<int*>(via.contents)+query*e;
-      dag.parents.assign(ps,ps+size); dag.via_edges.assign(es,es+size);
-    });
-  }
-
-  std::vector<Result> run(Config cfg) {
-    auto begin=Clock::now(); gpu_ms=0; waits=0; rounds=0; edge_visits=0; fallback=false;
-    if(cfg.solver=="old_pull" || cfg.solver=="old_group") {
-      auto results=old.run(cfg.solver=="old_group",cfg.name.ends_with("serial"));
-      gpu_ms=old.gpu_ms; distance_ms=old.distance_ms; rounds=old.rounds;
-      waits=cfg.solver=="old_pull" ? (rounds+7)/8 : 1;
-      // For persistent groups, per-query round counts can differ.
-      if(cfg.solver=="old_pull") edge_visits=uint64_t(rounds)*e*q;
-      else for(size_t i=0;i<q;++i) edge_visits+=uint64_t(static_cast<uint32_t*>(old.changed.contents)[i])*e;
-      if(!cfg.name.ends_with("serial")) cpu_dags(results);
-      return results;
-    }
-    if(cfg.narrow && !fits32) { cfg.narrow=false; cfg.solver="pull"; fallback=true; }
-    if(cfg.solver!="pull") cfg.layout=false;
-    auto data=cfg.solver=="pull" ? pull(cfg) : frontier(cfg);
-    std::vector<Result> results(q);
-    // Hoist Objective-C accessors out of the per-distance conversion loop.
-    // Calling .contents for every element dominated large-batch host time.
-    auto data32=static_cast<const uint32_t*>(data.contents);
-    auto data64=static_cast<const Cost*>(data.contents);
-    auto copy=[&](int query) {
-      auto& dist=results[query].first; dist.resize(n);
-      if(!cfg.layout && !cfg.narrow) {
-        auto ptr=data64+query*n;
-        std::copy_n(ptr,n,dist.begin());
-      } else for(size_t v=0;v<n;++v) {
-        size_t index=cfg.layout ? v*q+query : query*n+v;
-        if(cfg.narrow) {
-          auto d=data32[index];
-          dist[v]=d==UINT32_MAX ? INF : Cost(d);
-        } else dist[v]=data64[index];
-      }
-    };
-    if(q==1) copy(0); else pool.run(int(q),copy);
-    distance_ms=ms(begin);
-    if(cfg.gpu_dag) gpu_dags(results,data,cfg.narrow,cfg.layout); else cpu_dags(results);
-    return results;
-  }
-};
-
-std::vector<Config> configurations() {
-  return {
-    {"old_pull_serial","old_pull"}, {"old_group_serial","old_group"},
-    {"old_pull_parallel_dag","old_pull"}, {"old_group_parallel_dag","old_group"},
-    {"pull64_barrier","pull"}, {"pull64_interleaved","pull",true},
-    {"pull32_interleaved","pull",true,true},
-    {"pull32_gpu_dag","pull",true,true,true},
-    {"frontier32_vertex","frontier",false,true,false,1},
-    {"frontier32_simd","frontier",false,true,false,32},
-    {"frontier32_gpu_dag","frontier",false,true,true,32},
-    {"bucket32_d4","frontier",false,true,false,32,4},
-    {"bucket32_d16","frontier",false,true,false,32,16},
-    {"bucket32_d64","frontier",false,true,false,32,64}
-  };
-}
-
-Case hub_case(int n) {
-  std::vector<NodeId> a,b; std::vector<Cost> w; std::vector<Cap> cap;
-  auto add=[&](int u,int v,int cost) {a.push_back(u);b.push_back(v);w.push_back(cost);cap.push_back(1);};
-  for(int i=0;i<n;++i) add(i,(i+1)%n,1);
-  for(int i=1;i<n;++i) {add(0,i,1+i%31);add(i,0,1+(i*13)%31);}
-  auto c=make_case("random",n);
-  c.name="hub"; c.graph=StrictMultiDiGraph::from_arrays(n,a,b,cap,w);
-  c.edge_mask=std::make_unique<bool[]>(w.size()); std::fill_n(c.edge_mask.get(),w.size(),true);
-  c.residual.assign(w.size(),1); return c;
-}
-
-// A stronger comparator for the uniform positive-weight grid/fabric workloads.
-// This uses the same cached eligibility and one-pass parallel DAG builder as
-// the optimized GPU variants. All output is checked against native Dijkstra.
-std::vector<Cost> cpu_bfs(const Case& c, const OptimizedGraph& gpu, NodeId source) {
-  int n=c.graph.num_nodes();
-  auto row=c.reverse ? c.graph.in_row_offsets_view() : c.graph.row_offsets_view();
-  auto col=c.reverse ? c.graph.in_col_indices_view() : c.graph.col_indices_view();
-  auto enabled=static_cast<const uint8_t*>(gpu.outenabled.contents);
-  Cost weight=c.graph.cost_view()[0];
-  std::vector<Cost> dist(n,INF);
-  if(!c.node_mask[source]) return dist;
-  std::vector<NodeId> queue(n); size_t head=0,tail=0;
-  dist[source]=0; queue[tail++]=source;
-  while(head<tail) {
-    NodeId u=queue[head++];
-    for(int j=row[u];j<row[u+1];++j) {
-      NodeId v=col[j];
-      if(enabled[j] && dist[v]==INF) {dist[v]=dist[u]+weight;queue[tail++]=v;}
-    }
-  }
-  return dist;
-}
-
-Case boundary_case(Cost weight, bool reverse, bool blocked) {
-  constexpr int n=6;
-  std::vector<NodeId> a{0,0,1,1,2,3,4,0,1,2},b{1,1,2,2,3,4,5,5,1,5};
-  std::vector<Cost> w(a.size(),weight);
-  std::vector<Cap> cap(a.size(),1);
-  auto c=make_case("random",n);
-  c.name="boundary_"+std::to_string(weight)+(reverse ? "_reverse" : "")+(blocked ? "_masked" : "");
-  c.graph=StrictMultiDiGraph::from_arrays(n,a,b,cap,w);
-  c.edge_mask=std::make_unique<bool[]>(w.size()); std::fill_n(c.edge_mask.get(),w.size(),true);
-  c.residual.assign(w.size(),1); c.reverse=reverse;
-  // Competing direct/parallel edges, a self-loop, threshold-adjacent residuals,
-  // and blocked sources/unreachable nodes. Eligibility is evaluated in double.
-  c.residual[1]=std::nextafter(kMinCap,0.0); c.residual[3]=kMinCap;
-  c.edge_mask[7]=false; c.edge_mask[9]=false;
-  if(blocked) c.node_mask[2]=false;
-  return c;
-}
-
-void run_case(Case c,int queries,std::string mode,int samples,OptimizedMetal& metal,Pool& pool) {
-  std::vector<NodeId> sources(queries);
-  std::vector<Result> expected(queries);
-  for(int i=0;i<queries;++i) { sources[i]=(i*997)%c.graph.num_nodes(); expected[i]=cpu(c,sources[i]); }
-  OptimizedGraph gpu(c,metal,pool,sources);
-  auto configs=configurations();
-  if(mode=="base") configs.resize(2);
-  else if(mode=="cpu") {
-    configs={{"cpu_full","cpu"},{"cpu_distance","cpu"}};
-    auto costs=c.graph.cost_view();
-    if(!costs.empty() && costs[0]>0 && std::all_of(costs.begin(),costs.end(),[&](Cost w){return w==costs[0];})) {
-      configs.push_back({"cpu_bfs_full","cpu"}); configs.push_back({"cpu_bfs_distance","cpu"});
-    }
-  }
-  else if(mode=="optimized") configs.erase(configs.begin(),configs.begin()+2);
-  else if(mode!="all") throw std::runtime_error("bad mode");
-  for(auto cfg:configs) {
-    std::vector<double> times,dt,gt,work,rounds,waits;
-    int fallback=0;
-    for(int rep=-2;rep<samples;++rep) @autoreleasepool {
-      auto begin=Clock::now(); std::vector<Result> result;
-      if(mode=="cpu") {
-        result.resize(queries);
-        auto query=[&](int i) {
-          if(cfg.name.starts_with("cpu_bfs")) result[i].first=cpu_bfs(c,gpu,sources[i]);
-          else if(cfg.name=="cpu_full") result[i]=cpu(c,sources[i]);
-          else result[i].first=cpu_distance(c,sources[i]);
-        };
-        if(queries==1) query(0); else pool.run(queries,query);
-        if(cfg.name=="cpu_bfs_full") gpu.cpu_dags(result);
-      } else result=gpu.run(cfg);
-      double elapsed=ms(begin);
-      if(cfg.name.ends_with("distance")) {
-        for(int i=0;i<queries;++i) if(result[i].first!=expected[i].first) throw std::runtime_error("CPU distance mismatch");
-      } else verify(expected,result);
-      if(rep>=0) {
-        times.push_back(elapsed); dt.push_back(mode=="cpu" ? elapsed : gpu.distance_ms);
-        gt.push_back(mode=="cpu" ? 0 : gpu.gpu_ms); work.push_back(mode=="cpu" ? 0 : double(gpu.edge_visits));
-        rounds.push_back(mode=="cpu" ? 0 : gpu.rounds); waits.push_back(mode=="cpu" ? 0 : gpu.waits);
-        fallback=mode=="cpu" ? 0 : gpu.fallback;
-      }
-    }
-    std::cout<<c.name<<','<<c.graph.num_nodes()<<','<<c.graph.num_edges()<<','<<queries<<','<<cfg.name
-      <<','<<std::fixed<<std::setprecision(6)<<median(times)<<','<<median(dt)<<','<<median(gt)
-      <<','<<uint64_t(median(work))<<','<<int(median(rounds))<<','<<int(median(waits))<<','<<fallback
-      <<','<<gpu.upload_ms<<','<<samples<<",pass,";
-    for(size_t j=0;j<times.size();++j) std::cout<<(j ? ";" : "")<<times[j];
-    std::cout<<'\n'<<std::flush;
-  }
-}
-
-int main(int argc,char** argv) {
-  @autoreleasepool { try {
-    if(argc<3) throw std::runtime_error("usage: optimized base|optimized|cpu|all smoke|full|correctness|stress [samples]");
-    std::string mode=argv[1],suite=argv[2]; int samples=argc>3 ? std::stoi(argv[3]) : 7;
-    if(samples<1) throw std::runtime_error("invalid samples");
-    OptimizedMetal metal; Pool pool(10);
-    std::cout<<"case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms\n";
-    auto run=[&](Case c,int q) { run_case(std::move(c),q,mode,samples,metal,pool); };
-    if(suite=="correctness") {
-      for(unsigned seed=1;seed<=12;++seed) run(make_case("random",37+seed*3,6,true,seed%2,seed%3==0,seed),8);
-      for(Cost weight:{Cost(700000000),Cost(715827883),(Cost(1)<<53)+1})
-        for(bool reverse:{false,true}) for(bool blocked:{false,true}) run(boundary_case(weight,reverse,blocked),6);
-    } else if(suite=="stress") {
-      run(make_case("grid",1024),64); run(make_case("random",1024,8,true,false,true),64);
-    } else {
-      run(make_case("random",1024),1); run(make_case("random",1024),64);
-      run(make_case("clos",200),64); run(make_case("grid",1024),1);
-      run(hub_case(1024),1); run(make_case("random",1024,8,true,true,true),8);
-      if(suite=="full") {
-        run(make_case("random",4096),256);
-        run(make_case("random",16384),1); run(make_case("random",16384),64);
-        run(make_case("random",65536),1);
-        run(make_case("clos",800),1); run(make_case("clos",800),64);
-        run(make_case("grid",10000),1); run(make_case("grid",10000),8);
-        run(make_case("chain",2048),1); run(hub_case(4096),64);
-        run(make_case("random",4096,32),1); run(make_case("random",4096,32),64);
-      } else if(suite!="smoke") throw std::runtime_error("bad suite");
-    }
-  } catch(const std::exception& e) {std::cerr<<"FAIL: "<<e.what()<<'\n';return 1;} }
-}
diff --git a/dev/research/metal_pathfinding/optimization/kernels.metal b/dev/research/metal_pathfinding/optimization/kernels.metal
deleted file mode 100644
index 8ac9cdc..0000000
--- a/dev/research/metal_pathfinding/optimization/kernels.metal
+++ /dev/null
@@ -1,166 +0,0 @@
-#include <metal_stdlib>
-using namespace metal;
-
-struct P {
-  uint n, q, round, layout;
-  uint current, epoch, lanes, delta;
-};
-constant long INF64 = 0x7fffffffffffffffL;
-constant uint INF32 = 0xffffffffu;
-
-// Same relaxation as phase one, with optional query-fast layout and 32-bit
-// distances only after the host proves the entire finite-distance domain fits.
-template<typename T>
-void pull(device const int* row, device const int* col,
-          device const T* weight, device const uchar* enabled,
-          device const T* a, device T* b, device atomic_uint* changed,
-          constant P& p, uint tid, uint lane, T inf) {
-  uint total = p.n * p.q;
-  bool dirty = false;
-  if (tid < total) {
-    uint v = p.layout ? tid / p.q : tid % p.n;
-    uint query = p.layout ? tid % p.q : tid / p.n;
-    T best = a[tid];
-    for (int j = row[v]; j < row[v + 1]; ++j) {
-      uint index = p.layout ? uint(col[j]) * p.q + query : query * p.n + uint(col[j]);
-      T d = a[index], w = weight[j];
-      if (enabled[j] && d != inf && d <= inf - w) best = min(best, T(d + w));
-    }
-    b[tid] = best;
-    dirty = best != a[tid];
-  }
-  // One flag operation per SIMD group, instead of per changed vertex.
-  if (simd_any(dirty) && lane == 0)
-    atomic_store_explicit(changed + p.round, 1u, memory_order_relaxed);
-}
-
-#define PULL_ARGS(T) device const int* row [[buffer(0)]], device const int* col [[buffer(1)]], \
- device const T* weight [[buffer(2)]], device const uchar* enabled [[buffer(3)]], \
- device const T* a [[buffer(4)]], device T* b [[buffer(5)]], \
- device atomic_uint* changed [[buffer(6)]], constant P& p [[buffer(7)]], \
- uint tid [[thread_position_in_grid]], uint lane [[thread_index_in_simdgroup]]
-kernel void pull64(PULL_ARGS(long)) { pull(row,col,weight,enabled,a,b,changed,p,tid,lane,INF64); }
-kernel void pull32(PULL_ARGS(uint)) { pull(row,col,weight,enabled,a,b,changed,p,tid,lane,INF32); }
-
-// Frontier queues contain flattened (query * N + node) IDs. Only 32-bit integer
-// atomics are required. All queue consumers run after producer dispatch barriers.
-kernel void prepare(device atomic_uint* counts [[buffer(0)]],
-                    device uint* indirect [[buffer(1)]],
-                    constant P& p [[buffer(7)]]) {
-  uint count = atomic_load_explicit(counts + p.current, memory_order_relaxed);
-  atomic_store_explicit(counts + (1 - p.current), 0u, memory_order_relaxed);
-  indirect[0] = max(1u, (count * p.lanes + 255) / 256);
-  indirect[1] = 1; indirect[2] = 1;
-}
-
-kernel void expand(device const int* row [[buffer(0)]],
-                   device const int* col [[buffer(1)]],
-                   device const uint* weight [[buffer(2)]],
-                   device const uchar* enabled [[buffer(3)]],
-                   device atomic_uint* dist [[buffer(4)]],
-                   device const uint* in_queue [[buffer(5)]],
-                   device uint* out_queue [[buffer(6)]],
-                   constant P& p [[buffer(7)]],
-                   device atomic_uint* counts [[buffer(8)]],
-                   device atomic_uint* marks [[buffer(9)]],
-                   device atomic_uint* work [[buffer(10)]],
-                   uint tid [[thread_position_in_grid]]) {
-  uint slot = tid / p.lanes, lane = tid % p.lanes;
-  uint count = atomic_load_explicit(counts + p.current, memory_order_relaxed);
-  if (slot >= count) return;
-  uint index = in_queue[slot], u = index % p.n, base = index - u;
-  uint d = atomic_load_explicit(dist + index, memory_order_relaxed);
-  if (lane == 0) atomic_fetch_add_explicit(work + p.round, uint(row[u+1]-row[u]), memory_order_relaxed);
-  for (uint j = uint(row[u]) + lane; j < uint(row[u+1]); j += p.lanes) {
-    uint w = weight[j];
-    if (!enabled[j] || d == INF32 || d > INF32 - w) continue;
-    uint target = base + uint(col[j]);
-    uint candidate = d + w;
-    uint old = atomic_fetch_min_explicit(dist + target, candidate, memory_order_relaxed);
-    if (candidate < old) {
-      if (p.delta) {
-        // Bucket mode: mark pending. Selection and clearing happen in a later
-        // dispatch, so a late improvement cannot be lost behind an early reset.
-        atomic_store_explicit(marks + target, 1u, memory_order_relaxed);
-      } else if (atomic_exchange_explicit(marks + target, p.epoch, memory_order_relaxed) != p.epoch) {
-        uint pos = atomic_fetch_add_explicit(counts + (1-p.current), 1u, memory_order_relaxed);
-        out_queue[pos] = target; // Epoch deduplication bounds this queue by N*Q.
-      }
-    }
-  }
-}
-
-// A simple bucketed label-correcting scheduler. This deliberately does not claim
-// the optimized light/heavy split or asynchronous scheduler of published ADDS.
-kernel void bucket_reset(device atomic_uint* counts [[buffer(0)]],
-                         device atomic_uint* min_distance [[buffer(1)]]) {
-  atomic_store_explicit(counts, 0u, memory_order_relaxed);
-  atomic_store_explicit(min_distance, INF32, memory_order_relaxed);
-}
-kernel void bucket_min(device const atomic_uint* dist [[buffer(0)]],
-                       device const atomic_uint* pending [[buffer(1)]],
-                       device atomic_uint* minimum [[buffer(2)]],
-                       constant P& p [[buffer(7)]], uint tid [[thread_position_in_grid]]) {
-  if (tid >= p.n*p.q) return;
-  if (atomic_load_explicit(pending+tid, memory_order_relaxed))
-    atomic_fetch_min_explicit(minimum, atomic_load_explicit(dist+tid, memory_order_relaxed), memory_order_relaxed);
-}
-kernel void bucket_select(device const atomic_uint* dist [[buffer(0)]],
-                          device atomic_uint* pending [[buffer(1)]],
-                          device const atomic_uint* minimum [[buffer(2)]],
-                          device uint* queue [[buffer(3)]],
-                          device atomic_uint* counts [[buffer(4)]],
-                          constant P& p [[buffer(7)]], uint tid [[thread_position_in_grid]]) {
-  if (tid >= p.n*p.q) return;
-  uint lowest = atomic_load_explicit(minimum, memory_order_relaxed);
-  if (lowest == INF32) return;
-  ulong upper = (ulong(lowest) / p.delta + 1) * p.delta;
-  if (atomic_load_explicit(pending+tid, memory_order_relaxed) &&
-      ulong(atomic_load_explicit(dist+tid, memory_order_relaxed)) < upper) {
-    atomic_store_explicit(pending+tid, 0u, memory_order_relaxed);
-    uint pos = atomic_fetch_add_explicit(counts, 1u, memory_order_relaxed);
-    queue[pos] = tid;
-  }
-}
-
-// Counts and fills are deterministic within each node's incoming CSR row.
-// The host prefix-sums N+1 counts per query; it never scans edges for GPU DAGs.
-struct DP { uint n, q, edges, layout, reverse, unused0, unused1, unused2; };
-template<typename T, bool Fill>
-void dag(device const int* row, device const int* col, device const long* costs,
-         device const int* ids, device const uchar* enabled, device const T* distances,
-         device int* offsets, device int* parents, device int* via,
-         constant DP& p, uint tid, T inf) {
-  if (tid >= p.n*p.q) return;
-  // Match distance layout. Query-major frontiers must not be read with a
-  // query-fast thread layout (which also scatters the output writes).
-  uint v = p.layout ? tid / p.q : tid % p.n;
-  uint query = p.layout ? tid % p.q : tid / p.n;
-  uint index = p.layout ? v*p.q+query : query*p.n+v;
-  T dv = distances[index];
-  uint count = 0;
-  for (int j=row[v]; j<row[v+1]; ++j) {
-    uint u=uint(col[j]);
-    T du=distances[p.layout ? u*p.q+query : query*p.n+u];
-    long w=costs[j];
-    bool tight=enabled[j] && (p.reverse ? (dv!=inf && long(du)==long(dv)+w) :
-                                                          (du!=inf && long(dv)==long(du)+w));
-    if (tight) {
-      if (Fill) {
-        uint pos=query*p.edges + uint(offsets[query*(p.n+1)+v]) + count;
-        parents[pos]=int(u); via[pos]=ids[j];
-      }
-      ++count;
-    }
-  }
-  if (!Fill) offsets[query*(p.n+1)+v+1]=int(count);
-}
-#define DAG_ARGS(T) device const int* row [[buffer(0)]], device const int* col [[buffer(1)]], \
- device const long* costs [[buffer(2)]], device const int* ids [[buffer(3)]], \
- device const uchar* enabled [[buffer(4)]], device const T* distances [[buffer(5)]], \
- device int* offsets [[buffer(6)]], constant DP& p [[buffer(7)]], \
- device int* parents [[buffer(8)]], device int* via [[buffer(9)]], uint tid [[thread_position_in_grid]]
-kernel void dag_count64(DAG_ARGS(long)) {dag<long,false>(row,col,costs,ids,enabled,distances,offsets,parents,via,p,tid,INF64);}
-kernel void dag_fill64(DAG_ARGS(long)) {dag<long,true>(row,col,costs,ids,enabled,distances,offsets,parents,via,p,tid,INF64);}
-kernel void dag_count32(DAG_ARGS(uint)) {dag<uint,false>(row,col,costs,ids,enabled,distances,offsets,parents,via,p,tid,INF32);}
-kernel void dag_fill32(DAG_ARGS(uint)) {dag<uint,true>(row,col,costs,ids,enabled,distances,offsets,parents,via,p,tid,INF32);}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/base-a1-stderr.txt b/dev/research/metal_pathfinding/optimization/results/aba/base-a1-stderr.txt
deleted file mode 100644
index 7bb0bd9..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/base-a1-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=22.61 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/base-a1.csv b/dev/research/metal_pathfinding/optimization/results/aba/base-a1.csv
deleted file mode 100644
index e5ad76f..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/base-a1.csv
+++ /dev/null
@@ -1,37 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_serial,1.218542,1.184500,0.434750,131072,16,2,0,0.163666,7,pass,1.000000;1.328541;1.493417;0.990875;1.405333;1.218542;0.689625
-random,1024,8192,1,old_group_serial,0.914792,0.838625,0.680833,106496,13,1,0,0.163666,7,pass,1.091958;1.201000;0.947125;0.901458;0.828708;0.911875;0.914792
-random,1024,8192,64,old_pull_serial,4.582958,2.376417,1.597625,12582912,24,3,0,0.191292,7,pass,4.323625;4.577125;4.633041;4.582291;4.727458;4.582958;4.598000
-random,1024,8192,64,old_group_serial,3.817917,1.374833,0.888208,7217152,17,1,0,0.191292,7,pass,3.695125;3.650917;3.798041;3.875042;3.905208;3.916333;3.817917
-clos,200,20000,64,old_pull_serial,5.426542,1.323042,1.016625,10240000,8,1,0,0.336458,7,pass,5.426542;6.071792;5.522958;5.353000;5.670708;5.278334;5.226583
-clos,200,20000,64,old_group_serial,4.768459,0.824667,0.297875,3840000,3,1,0,0.336458,7,pass,4.593416;4.673916;4.953792;4.768459;4.814791;4.615209;4.778209
-grid,1024,3968,1,old_pull_serial,2.331167,2.316292,0.674458,253952,64,8,0,0.136791,7,pass,2.582333;2.420166;3.165750;1.632958;2.331167;1.751666;2.164334
-grid,1024,3968,1,old_group_serial,1.177083,1.162041,1.011542,249984,63,1,0,0.136791,7,pass,1.177083;1.213291;1.289917;1.256459;0.749750;0.362417;0.363500
-hub,1024,3070,1,old_pull_serial,6.268542,6.232250,5.561125,98240,32,4,0,0.106126,7,pass,6.262917;6.289917;6.268542;6.305542;6.316250;6.211292;6.225167
-hub,1024,3070,1,old_group_serial,4.908083,4.871666,4.720917,95170,31,1,0,0.106126,7,pass,4.920042;4.880292;4.908083;4.920708;4.874500;4.864417;4.935875
-random_masked_int64_reverse,1024,8192,8,old_pull_serial,0.517667,0.177166,0.034542,524288,8,1,0,0.204624,7,pass,0.581375;0.517667;0.506875;0.530667;0.517625;0.515750;0.530000
-random_masked_int64_reverse,1024,8192,8,old_group_serial,0.540875,0.194500,0.053500,368640,8,1,0,0.204624,7,pass,0.528417;0.557417;0.540875;0.509500;0.529500;0.548333;0.542875
-random,4096,32768,256,old_pull_serial,49.824334,11.526875,10.145042,201326592,24,3,0,0.545166,7,pass,49.824334;48.800334;48.571958;50.309667;60.286459;59.534375;48.844875
-random,4096,32768,256,old_group_serial,47.811583,10.256667,9.388917,136544256,20,1,0,0.545166,7,pass,55.883000;48.061916;47.811583;46.029625;52.619583;44.779875;46.107125
-random,16384,131072,1,old_pull_serial,2.098167,1.418667,0.204500,3145728,24,3,0,1.713958,7,pass,2.129833;2.098167;1.690500;1.244875;1.214875;2.128125;2.209500
-random,16384,131072,1,old_group_serial,5.719417,5.032459,4.894625,2359296,18,1,0,1.713958,7,pass,6.076542;6.048834;5.709042;5.723250;5.613625;5.697458;5.719417
-random,16384,131072,64,old_pull_serial,58.904791,13.714458,11.617375,201326592,24,3,0,1.789209,7,pass,58.790875;58.904791;58.887125;59.272084;60.799708;57.959042;60.167875
-random,16384,131072,64,old_group_serial,57.747584,12.236500,11.485375,158203904,22,1,0,1.789209,7,pass,58.655667;57.747584;59.414083;57.772666;56.986792;54.688833;54.776958
-random,65536,524288,1,old_pull_serial,5.184250,2.258042,1.213708,12582912,24,3,0,7.745292,7,pass,4.513042;5.060667;5.293625;4.965250;5.271292;5.197875;5.184250
-random,65536,524288,1,old_group_serial,31.832791,28.881959,28.222000,11534336,22,1,0,7.745292,7,pass,31.485125;32.601083;31.832791;32.451750;31.760709;31.991375;31.556166
-clos,800,320000,1,old_pull_serial,1.914708,0.940584,0.731375,2560000,8,1,0,3.524250,7,pass,2.299041;1.914708;2.434625;1.906125;1.881542;1.843375;2.396875
-clos,800,320000,1,old_group_serial,2.133459,1.204000,0.911125,960000,3,1,0,3.524250,7,pass,2.036042;2.133459;2.484125;2.030542;2.462916;2.034041;2.559167
-clos,800,320000,64,old_pull_serial,80.507125,16.727542,16.177125,163840000,8,1,0,3.424624,7,pass,82.494541;80.253417;77.992667;81.233334;80.507125;79.556875;82.401250
-clos,800,320000,64,old_group_serial,69.896166,5.788917,5.249208,61440000,3,1,0,3.424624,7,pass,69.789625;70.156958;69.876959;69.579166;71.083958;70.201209;69.896166
-grid,10000,39600,1,old_pull_serial,3.836417,3.719583,0.559000,7920000,200,25,0,0.502708,7,pass,5.548333;3.887375;3.836417;3.699709;3.756375;4.001833;3.686625
-grid,10000,39600,1,old_group_serial,7.867833,7.721208,7.582500,7880400,199,1,0,0.502708,7,pass,7.953000;7.827709;7.980666;7.854667;7.867833;7.806167;7.943125
-grid,10000,39600,8,old_pull_serial,5.952708,4.955667,1.338125,63360000,200,25,0,0.507209,7,pass,5.595708;5.952708;6.127416;6.336792;6.075833;5.918666;5.732208
-grid,10000,39600,8,old_group_serial,9.001917,8.070500,7.435958,51480000,199,1,0,0.507209,7,pass,8.705167;8.996542;9.001917;9.232250;9.057666;8.974042;9.170042
-chain,2048,2047,1,old_pull_serial,30.622833,30.613000,4.401709,4192256,2048,256,0,0.106750,7,pass,30.267459;30.836959;30.523334;31.464417;30.622833;29.359666;30.867458
-chain,2048,2047,1,old_group_serial,4.834291,4.825792,4.700625,4192256,2048,1,0,0.106750,7,pass,4.829625;4.934042;4.834042;4.889959;4.834291;4.936625;4.812917
-hub,4096,12286,64,old_pull_serial,35.138250,32.326583,30.902083,31452160,40,5,0,0.252917,7,pass,35.515125;35.051541;35.533042;35.235333;35.138250;35.127750;34.555833
-hub,4096,12286,64,old_group_serial,28.558708,25.740416,24.993833,27176632,38,1,0,0.252917,7,pass,27.957792;28.558708;28.586458;28.663542;28.538000;28.549500;28.668834
-random,4096,131072,1,old_pull_serial,0.906250,0.525417,0.266958,2097152,16,2,0,1.621291,7,pass,0.935750;0.866084;0.857208;0.905250;0.920208;0.915709;0.906250
-random,4096,131072,1,old_group_serial,2.808042,2.361958,2.183542,1572864,12,1,0,1.621291,7,pass,2.680625;2.884875;2.723166;2.877167;2.812500;2.808042;2.712208
-random,4096,131072,64,old_pull_serial,34.709250,7.647459,6.259584,134217728,16,2,0,1.701542,7,pass,34.723375;34.123167;34.742875;34.709250;34.173084;34.822959;34.691500
-random,4096,131072,64,old_group_serial,31.930417,5.221542,4.481375,105644032,15,1,0,1.701542,7,pass,30.898458;31.379041;31.775500;31.930417;34.155750;35.345083;39.651000
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/base-a2-stderr.txt b/dev/research/metal_pathfinding/optimization/results/aba/base-a2-stderr.txt
deleted file mode 100644
index cb44dce..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/base-a2-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=23.7174 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/base-a2.csv b/dev/research/metal_pathfinding/optimization/results/aba/base-a2.csv
deleted file mode 100644
index fd30af0..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/base-a2.csv
+++ /dev/null
@@ -1,37 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_serial,0.994334,0.952458,0.399000,131072,16,2,0,0.171417,7,pass,1.577916;0.994334;0.656417;0.664875;0.658917;1.304083;1.546834
-random,1024,8192,1,old_group_serial,0.971833,0.906041,0.680458,106496,13,1,0,0.171417,7,pass,1.023334;1.103292;0.903125;0.840208;0.971833;1.167083;0.936791
-random,1024,8192,64,old_pull_serial,4.691209,2.347542,1.613625,12582912,24,3,0,0.210375,7,pass,4.444834;4.580166;4.754000;5.102500;4.831000;4.639291;4.691209
-random,1024,8192,64,old_group_serial,3.768791,1.364167,0.890125,7217152,17,1,0,0.210375,7,pass,3.744584;3.776792;3.828208;3.773291;3.758709;3.535167;3.768791
-clos,200,20000,64,old_pull_serial,5.650709,1.616708,1.020042,10240000,8,1,0,0.356209,7,pass,5.676875;5.621667;5.220125;6.236833;5.650709;6.217083;5.466333
-clos,200,20000,64,old_group_serial,4.869958,0.831250,0.297000,3840000,3,1,0,0.356209,7,pass,4.959333;4.867584;4.914292;4.869958;4.947166;4.766166;4.391625
-grid,1024,3968,1,old_pull_serial,1.665000,1.652209,0.655292,253952,64,8,0,0.141624,7,pass,1.644250;1.733125;1.603333;1.672625;1.665000;1.664375;1.721208
-grid,1024,3968,1,old_group_serial,1.165667,1.143208,1.005833,249984,63,1,0,0.141624,7,pass,1.263334;1.182333;1.165667;1.273125;0.885333;0.363959;0.362584
-hub,1024,3070,1,old_pull_serial,6.226792,6.189458,5.559000,98240,32,4,0,0.111583,7,pass,6.469750;6.205875;6.281875;6.313250;6.206291;6.226792;6.218000
-hub,1024,3070,1,old_group_serial,4.938125,4.898500,4.725042,95170,31,1,0,0.111583,7,pass,4.938125;4.984083;4.930291;5.019042;4.921959;4.917917;4.942417
-random_masked_int64_reverse,1024,8192,8,old_pull_serial,0.551250,0.183875,0.034625,524288,8,1,0,0.234124,7,pass,0.562916;0.611584;0.507541;0.584208;0.551250;0.545666;0.529500
-random_masked_int64_reverse,1024,8192,8,old_group_serial,0.545000,0.189625,0.053708,368640,8,1,0,0.234124,7,pass,0.550208;0.545000;0.559584;0.519125;0.599333;0.510333;0.538333
-random,4096,32768,256,old_pull_serial,50.688208,12.960833,11.693708,201326592,24,3,0,0.566458,7,pass,49.485708;50.688208;50.617541;52.575375;52.112584;51.623333;49.864333
-random,4096,32768,256,old_group_serial,49.310208,10.459583,9.632500,136544256,20,1,0,0.566458,7,pass,50.547542;49.310208;50.391084;48.556292;47.586917;48.562834;50.677916
-random,16384,131072,1,old_pull_serial,1.870458,1.257416,0.473583,3145728,24,3,0,1.747834,7,pass,1.870458;1.471084;2.038875;2.288666;2.138458;1.621583;1.435041
-random,16384,131072,1,old_group_serial,5.578000,4.954917,4.794625,2359296,18,1,0,1.747834,7,pass,5.681334;5.572917;5.537625;5.559917;5.578000;5.596708;5.730166
-random,16384,131072,64,old_pull_serial,57.437709,12.714583,11.452709,201326592,24,3,0,1.729083,7,pass,60.324959;56.396250;57.583125;56.772667;57.974125;57.437709;56.800125
-random,16384,131072,64,old_group_serial,53.105750,9.701208,8.881250,158203904,22,1,0,1.729083,7,pass,56.427459;54.848291;53.105750;52.603333;52.648291;53.011417;53.238417
-random,65536,524288,1,old_pull_serial,5.853750,3.010042,1.934167,12582912,24,3,0,7.061209,7,pass,5.853750;6.207166;7.395542;7.228292;4.723625;4.678916;4.148125
-random,65536,524288,1,old_group_serial,31.751625,28.941250,28.602500,11534336,22,1,0,7.061209,7,pass,32.139125;31.751625;31.628667;32.141583;31.560792;32.478667;31.455667
-clos,800,320000,1,old_pull_serial,2.377209,1.431583,0.753875,2560000,8,1,0,3.556167,7,pass,2.377209;1.955250;2.455833;2.367417;2.430083;2.385417;2.145208
-clos,800,320000,1,old_group_serial,2.556458,1.576792,0.968750,960000,3,1,0,3.556167,7,pass,2.589084;2.650250;2.526500;2.137334;2.679083;2.422542;2.556458
-clos,800,320000,64,old_pull_serial,83.521542,17.978958,17.478500,163840000,8,1,0,3.485250,7,pass,81.691167;84.700792;84.167000;81.558666;84.714084;83.126750;83.521542
-clos,800,320000,64,old_group_serial,70.227500,6.031083,5.390125,61440000,3,1,0,3.485250,7,pass,70.227500;70.059209;71.906542;69.788417;69.684208;71.298291;70.334458
-grid,10000,39600,1,old_pull_serial,5.873791,5.752500,2.571416,7920000,200,25,0,0.517166,7,pass,5.931959;5.884000;5.702542;6.143625;5.873791;4.747083;3.651417
-grid,10000,39600,1,old_group_serial,7.900583,7.766667,7.575625,7880400,199,1,0,0.517166,7,pass,7.784292;7.930583;7.900125;7.962542;7.925792;7.900583;7.879125
-grid,10000,39600,8,old_pull_serial,5.979167,5.041833,1.348542,63360000,200,25,0,0.506958,7,pass,5.915125;6.136083;6.013709;6.170083;5.979167;5.367833;5.483750
-grid,10000,39600,8,old_group_serial,8.833417,7.841084,7.497625,51480000,199,1,0,0.506958,7,pass,9.022208;8.728042;9.240834;8.833417;9.221417;8.709959;8.703625
-chain,2048,2047,1,old_pull_serial,28.500458,28.490334,4.103082,4192256,2048,256,0,0.107834,7,pass,28.967458;28.705334;28.500458;28.192459;28.413625;28.474459;29.089833
-chain,2048,2047,1,old_group_serial,4.908333,4.887208,4.718333,4192256,2048,1,0,0.107834,7,pass,4.940458;4.827959;4.908333;4.908542;4.900500;4.872958;4.930334
-hub,4096,12286,64,old_pull_serial,35.024208,32.034125,30.893042,31452160,40,5,0,0.415751,7,pass,35.024208;34.828667;34.493209;35.587167;35.316875;35.020542;35.557792
-hub,4096,12286,64,old_group_serial,28.801291,25.839084,25.138125,27176632,38,1,0,0.415751,7,pass,28.757334;28.801291;29.161167;28.600792;28.971625;29.009417;28.756875
-random,4096,131072,1,old_pull_serial,1.039917,0.523167,0.231750,2097152,16,2,0,1.780084,7,pass,0.989042;1.005208;1.085208;1.040166;1.076500;1.039917;0.952042
-random,4096,131072,1,old_group_serial,2.897000,2.410042,2.244375,1572864,12,1,0,1.780084,7,pass,2.997791;2.892875;2.918125;3.060042;2.897000;2.823458;2.822250
-random,4096,131072,64,old_pull_serial,36.476625,7.182083,6.285833,134217728,16,2,0,1.895875,7,pass,36.498208;36.726250;36.476625;36.892708;36.295291;35.935750;36.099417
-random,4096,131072,64,old_group_serial,37.791458,8.716333,8.064625,105644032,15,1,0,1.895875,7,pass,34.829667;37.791458;38.231041;40.189750;39.685208;34.319125;35.647958
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1-stderr.txt b/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1-stderr.txt
deleted file mode 100644
index 26cb375..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=28.925 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1.csv b/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1.csv
deleted file mode 100644
index c3fa171..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a1.csv
+++ /dev/null
@@ -1,49 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,cpu_full,0.085792,0.085792,0.000000,0,0,0,0,0.156042,7,pass,0.090042;0.086958;0.084917;0.085792;0.085166;0.084084;0.086291
-random,1024,8192,1,cpu_distance,0.050625,0.050625,0.000000,0,0,0,0,0.156042,7,pass,0.053458;0.050625;0.050750;0.050083;0.050833;0.049417;0.049792
-random,1024,8192,64,cpu_full,1.247667,1.247667,0.000000,0,0,0,0,0.179625,7,pass,1.311875;1.253000;1.283916;1.234333;1.247667;1.222625;1.230167
-random,1024,8192,64,cpu_distance,0.637834,0.637834,0.000000,0,0,0,0,0.179625,7,pass,0.659916;0.641583;0.637500;0.636542;0.635000;0.637834;0.673583
-clos,200,20000,64,cpu_full,1.072125,1.072125,0.000000,0,0,0,0,0.341708,7,pass,1.046542;1.066708;1.182333;1.086334;1.083958;1.070209;1.072125
-clos,200,20000,64,cpu_distance,0.236500,0.236500,0.000000,0,0,0,0,0.341708,7,pass,0.340000;0.352417;0.270083;0.211791;0.207666;0.210625;0.236500
-clos,200,20000,64,cpu_bfs_full,0.668917,0.668917,0.000000,0,0,0,0,0.341708,7,pass,0.584625;0.551000;0.668917;0.572917;1.059250;0.709625;0.824917
-clos,200,20000,64,cpu_bfs_distance,0.107959,0.107959,0.000000,0,0,0,0,0.341708,7,pass,0.121083;0.121792;0.125125;0.107959;0.098875;0.106792;0.099500
-grid,1024,3968,1,cpu_full,0.039042,0.039042,0.000000,0,0,0,0,0.131500,7,pass,0.042125;0.040916;0.039708;0.039000;0.039042;0.038708;0.038750
-grid,1024,3968,1,cpu_distance,0.012000,0.012000,0.000000,0,0,0,0,0.131500,7,pass,0.012334;0.012292;0.012000;0.011833;0.011834;0.011750;0.013917
-grid,1024,3968,1,cpu_bfs_full,0.009417,0.009417,0.000000,0,0,0,0,0.131500,7,pass,0.009667;0.009417;0.009333;0.011209;0.009375;0.009459;0.009416
-grid,1024,3968,1,cpu_bfs_distance,0.002250,0.002250,0.000000,0,0,0,0,0.131500,7,pass,0.002208;0.002250;0.002250;0.002250;0.002292;0.002250;0.002167
-hub,1024,3070,1,cpu_full,0.052333,0.052333,0.000000,0,0,0,0,0.088167,7,pass,0.054625;0.053500;0.052458;0.052250;0.051917;0.052250;0.052333
-hub,1024,3070,1,cpu_distance,0.024250,0.024250,0.000000,0,0,0,0,0.088167,7,pass,0.032333;0.027417;0.027333;0.024250;0.023000;0.022833;0.023333
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.160083,0.160083,0.000000,0,0,0,0,0.211583,7,pass,0.160083;0.176334;0.154083;0.136833;0.218792;0.161000;0.148417
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.097875,0.097875,0.000000,0,0,0,0,0.211583,7,pass,0.104167;0.102375;0.089417;0.097500;0.119042;0.097875;0.091625
-random,4096,32768,256,cpu_full,21.390792,21.390792,0.000000,0,0,0,0,0.522792,7,pass,21.548084;21.431583;21.365709;21.390792;21.338292;21.801750;21.308459
-random,4096,32768,256,cpu_distance,10.971792,10.971792,0.000000,0,0,0,0,0.522792,7,pass,10.941667;10.993375;10.984292;10.964500;10.961292;10.982416;10.971792
-random,16384,131072,1,cpu_full,3.661958,3.661958,0.000000,0,0,0,0,1.746959,7,pass,3.746667;3.661083;3.750292;3.732167;3.661958;3.647583;3.608417
-random,16384,131072,1,cpu_distance,1.892958,1.892958,0.000000,0,0,0,0,1.746959,7,pass,1.928917;1.904500;1.910375;1.871917;1.892958;1.860250;1.857916
-random,16384,131072,64,cpu_full,27.692792,27.692792,0.000000,0,0,0,0,1.649084,7,pass,27.658708;27.723542;27.748375;27.639459;27.587250;27.692792;27.800584
-random,16384,131072,64,cpu_distance,15.163333,15.163333,0.000000,0,0,0,0,1.649084,7,pass,15.208709;15.168833;15.147959;15.182041;15.112375;15.163333;15.138666
-random,65536,524288,1,cpu_full,19.316000,19.316000,0.000000,0,0,0,0,8.086334,7,pass,19.478875;19.102083;19.316000;18.730125;19.269000;19.888458;19.416750
-random,65536,524288,1,cpu_distance,9.973291,9.973291,0.000000,0,0,0,0,8.086334,7,pass,9.973291;9.828167;9.980083;9.915125;10.174167;9.670458;10.011000
-clos,800,320000,1,cpu_full,2.177875,2.177875,0.000000,0,0,0,0,3.236458,7,pass,2.187833;2.149125;2.179167;2.127750;2.174667;2.177875;2.179375
-clos,800,320000,1,cpu_distance,0.353375,0.353375,0.000000,0,0,0,0,3.236458,7,pass,0.349791;0.351583;0.355959;0.350875;0.353375;0.356084;0.358625
-clos,800,320000,1,cpu_bfs_full,0.908000,0.908000,0.000000,0,0,0,0,3.236458,7,pass,0.894250;0.924792;0.909333;0.897084;0.879083;0.908000;0.937042
-clos,800,320000,1,cpu_bfs_distance,0.113125,0.113125,0.000000,0,0,0,0,3.236458,7,pass,0.108000;0.117208;0.118334;0.118125;0.111917;0.113083;0.113125
-clos,800,320000,64,cpu_full,17.041958,17.041958,0.000000,0,0,0,0,3.481041,7,pass,16.388250;16.388000;16.345833;17.041958;17.097833;17.276417;17.355125
-clos,800,320000,64,cpu_distance,2.677875,2.677875,0.000000,0,0,0,0,3.481041,7,pass,2.692500;2.691917;2.692916;2.664458;2.666875;2.677875;2.672917
-clos,800,320000,64,cpu_bfs_full,8.295667,8.295667,0.000000,0,0,0,0,3.481041,7,pass,8.552542;8.295667;8.069958;8.153791;8.517708;9.268417;7.606500
-clos,800,320000,64,cpu_bfs_distance,0.860834,0.860834,0.000000,0,0,0,0,3.481041,7,pass,0.877208;0.856917;0.860834;0.852542;0.853625;0.865167;0.862500
-grid,10000,39600,1,cpu_full,0.570333,0.570333,0.000000,0,0,0,0,0.470375,7,pass,0.594125;0.580542;0.570333;0.581792;0.562917;0.567750;0.565416
-grid,10000,39600,1,cpu_distance,0.195500,0.195500,0.000000,0,0,0,0,0.470375,7,pass,0.196333;0.195500;0.204250;0.205834;0.178250;0.179542;0.178500
-grid,10000,39600,1,cpu_bfs_full,0.089292,0.089292,0.000000,0,0,0,0,0.470375,7,pass,0.096875;0.091833;0.094041;0.089000;0.088291;0.089292;0.088625
-grid,10000,39600,1,cpu_bfs_distance,0.022333,0.022333,0.000000,0,0,0,0,0.470375,7,pass,0.022250;0.022458;0.022375;0.022333;0.022292;0.022333;0.022417
-grid,10000,39600,8,cpu_full,0.834084,0.834084,0.000000,0,0,0,0,0.487875,7,pass,0.822042;0.837667;0.834084;0.824375;0.947250;0.820791;0.905875
-grid,10000,39600,8,cpu_distance,0.247208,0.247208,0.000000,0,0,0,0,0.487875,7,pass,0.312416;0.251083;0.242958;0.247208;0.249833;0.242250;0.241583
-grid,10000,39600,8,cpu_bfs_full,0.286042,0.286042,0.000000,0,0,0,0,0.487875,7,pass,0.208750;0.380291;0.228291;0.305208;0.289917;0.286042;0.280583
-grid,10000,39600,8,cpu_bfs_distance,0.073084,0.073084,0.000000,0,0,0,0,0.487875,7,pass,0.073084;0.080750;0.059917;0.073875;0.061250;0.070417;0.078917
-chain,2048,2047,1,cpu_full,0.017209,0.017209,0.000000,0,0,0,0,0.136084,7,pass,0.017417;0.017042;0.017292;0.017125;0.017209;0.017042;0.017333
-chain,2048,2047,1,cpu_distance,0.003875,0.003875,0.000000,0,0,0,0,0.136084,7,pass,0.004292;0.003791;0.003875;0.003625;0.003834;0.004250;0.004292
-hub,4096,12286,64,cpu_full,2.437875,2.437875,0.000000,0,0,0,0,0.237500,7,pass,2.619125;2.383792;2.399750;2.449375;2.437875;2.494959;2.427084
-hub,4096,12286,64,cpu_distance,1.061875,1.061875,0.000000,0,0,0,0,0.237500,7,pass,1.033625;1.061875;1.169542;1.037792;1.101834;1.179625;1.025375
-random,4096,131072,1,cpu_full,1.589583,1.589583,0.000000,0,0,0,0,1.789499,7,pass,1.588625;1.589583;1.700625;1.634417;1.570459;1.556250;1.602333
-random,4096,131072,1,cpu_distance,0.648334,0.648334,0.000000,0,0,0,0,1.789499,7,pass,0.680583;0.654458;0.646000;0.670125;0.646000;0.631709;0.648334
-random,4096,131072,64,cpu_full,12.301875,12.301875,0.000000,0,0,0,0,1.617916,7,pass,12.273209;12.301875;12.218958;12.418250;12.324125;12.225125;14.931792
-random,4096,131072,64,cpu_distance,6.966334,6.966334,0.000000,0,0,0,0,1.617916,7,pass,7.551125;6.966334;6.212750;7.608792;7.220041;6.408000;6.150125
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2-stderr.txt b/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2-stderr.txt
deleted file mode 100644
index 6703d2b..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=27.1879 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2.csv b/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2.csv
deleted file mode 100644
index 7a31e8d..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/cpu-a2.csv
+++ /dev/null
@@ -1,49 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,cpu_full,0.096875,0.096875,0.000000,0,0,0,0,0.174083,7,pass,0.102042;0.099000;0.096875;0.108042;0.094084;0.093875;0.095250
-random,1024,8192,1,cpu_distance,0.060958,0.060958,0.000000,0,0,0,0,0.174083,7,pass,0.071208;0.062958;0.064875;0.060958;0.057042;0.058167;0.058333
-random,1024,8192,64,cpu_full,1.340459,1.340459,0.000000,0,0,0,0,0.233833,7,pass,1.339292;1.340459;1.461292;1.366334;1.339458;1.339334;1.369500
-random,1024,8192,64,cpu_distance,0.663584,0.663584,0.000000,0,0,0,0,0.233833,7,pass,0.685834;0.674000;0.727500;0.663250;0.652916;0.639375;0.663584
-clos,200,20000,64,cpu_full,1.075958,1.075958,0.000000,0,0,0,0,0.372958,7,pass,1.282000;1.112375;1.074500;1.068083;1.078375;1.075958;1.045042
-clos,200,20000,64,cpu_distance,0.213417,0.213417,0.000000,0,0,0,0,0.372958,7,pass,0.221042;0.213417;0.207542;0.234416;0.213833;0.205459;0.213333
-clos,200,20000,64,cpu_bfs_full,0.633500,0.633500,0.000000,0,0,0,0,0.372958,7,pass,0.537833;0.574250;0.596792;0.647125;0.669458;0.633500;0.654042
-clos,200,20000,64,cpu_bfs_distance,0.086959,0.086959,0.000000,0,0,0,0,0.372958,7,pass,0.095250;0.097583;0.086166;0.086959;0.086875;0.119708;0.083708
-grid,1024,3968,1,cpu_full,0.038708,0.038708,0.000000,0,0,0,0,0.141166,7,pass,0.041292;0.039500;0.038708;0.038417;0.038209;0.041375;0.038584
-grid,1024,3968,1,cpu_distance,0.011750,0.011750,0.000000,0,0,0,0,0.141166,7,pass,0.012375;0.012125;0.011917;0.011750;0.011625;0.011458;0.011417
-grid,1024,3968,1,cpu_bfs_full,0.009375,0.009375,0.000000,0,0,0,0,0.141166,7,pass,0.011583;0.009375;0.009333;0.009375;0.009375;0.009250;0.009375
-grid,1024,3968,1,cpu_bfs_distance,0.002250,0.002250,0.000000,0,0,0,0,0.141166,7,pass,0.002417;0.002292;0.002209;0.002250;0.002208;0.002250;0.002208
-hub,1024,3070,1,cpu_full,0.052000,0.052000,0.000000,0,0,0,0,0.089875,7,pass,0.054083;0.052791;0.052584;0.052000;0.051250;0.050500;0.049667
-hub,1024,3070,1,cpu_distance,0.021875,0.021875,0.000000,0,0,0,0,0.089875,7,pass,0.023083;0.022209;0.021792;0.021875;0.021792;0.021708;0.021875
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.153250,0.153250,0.000000,0,0,0,0,0.195541,7,pass,0.146583;0.156583;0.153250;0.150208;0.152708;0.154500;0.161333
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.096792,0.096792,0.000000,0,0,0,0,0.195541,7,pass,0.096792;0.099792;0.098333;0.100208;0.091708;0.095875;0.096000
-random,4096,32768,256,cpu_full,21.281458,21.281458,0.000000,0,0,0,0,0.549125,7,pass,21.277042;21.258375;21.281458;21.314917;21.324333;21.278875;21.311791
-random,4096,32768,256,cpu_distance,11.067666,11.067666,0.000000,0,0,0,0,0.549125,7,pass,10.994334;11.005000;11.026500;11.067666;11.480084;11.362334;11.215292
-random,16384,131072,1,cpu_full,3.885666,3.885666,0.000000,0,0,0,0,1.800708,7,pass,3.967125;3.796625;3.860291;4.262833;3.917000;3.885666;3.851709
-random,16384,131072,1,cpu_distance,1.976417,1.976417,0.000000,0,0,0,0,1.800708,7,pass,2.147667;1.979625;1.973542;1.929709;1.987833;1.976417;1.926417
-random,16384,131072,64,cpu_full,27.721375,27.721375,0.000000,0,0,0,0,1.755499,7,pass,27.835834;27.645166;28.465958;27.722000;27.721375;27.572417;27.613583
-random,16384,131072,64,cpu_distance,15.114541,15.114541,0.000000,0,0,0,0,1.755499,7,pass,15.135625;15.110792;15.146000;15.110208;15.084625;15.162208;15.114541
-random,65536,524288,1,cpu_full,19.240125,19.240125,0.000000,0,0,0,0,7.505250,7,pass,18.942084;19.240125;19.137625;18.829333;23.886875;23.010209;19.430541
-random,65536,524288,1,cpu_distance,11.143334,11.143334,0.000000,0,0,0,0,7.505250,7,pass,11.894666;11.143334;11.423291;11.711209;10.922250;10.678833;10.548333
-clos,800,320000,1,cpu_full,2.226791,2.226791,0.000000,0,0,0,0,3.538083,7,pass,2.209250;2.216750;2.188458;2.298666;2.251083;2.226791;2.260083
-clos,800,320000,1,cpu_distance,0.355500,0.355500,0.000000,0,0,0,0,3.538083,7,pass,0.357458;0.365666;0.355209;0.360042;0.355041;0.355500;0.354166
-clos,800,320000,1,cpu_bfs_full,0.937625,0.937625,0.000000,0,0,0,0,3.538083,7,pass,0.936500;0.937625;0.945042;0.929250;0.915417;0.948750;0.957208
-clos,800,320000,1,cpu_bfs_distance,0.123750,0.123750,0.000000,0,0,0,0,3.538083,7,pass,0.123666;0.123750;0.124541;0.124209;0.123875;0.123708;0.123667
-clos,800,320000,64,cpu_full,16.524625,16.524625,0.000000,0,0,0,0,3.487750,7,pass,16.632500;16.422167;16.362041;16.524625;16.451709;16.538916;17.851792
-clos,800,320000,64,cpu_distance,2.695875,2.695875,0.000000,0,0,0,0,3.487750,7,pass,2.691334;2.695875;2.701042;2.697666;2.720417;2.685208;2.679041
-clos,800,320000,64,cpu_bfs_full,7.884833,7.884833,0.000000,0,0,0,0,3.487750,7,pass,8.302500;7.823334;7.566250;8.220417;8.318000;7.284708;7.884833
-clos,800,320000,64,cpu_bfs_distance,0.852750,0.852750,0.000000,0,0,0,0,3.487750,7,pass,0.852750;0.845167;0.850709;0.855333;0.866959;0.852250;0.856625
-grid,10000,39600,1,cpu_full,0.582250,0.582250,0.000000,0,0,0,0,0.491958,7,pass,0.607667;0.600166;0.618917;0.582250;0.578916;0.577333;0.576292
-grid,10000,39600,1,cpu_distance,0.180667,0.180667,0.000000,0,0,0,0,0.491958,7,pass,0.182792;0.183417;0.180667;0.180958;0.175250;0.180667;0.180458
-grid,10000,39600,1,cpu_bfs_full,0.088459,0.088459,0.000000,0,0,0,0,0.491958,7,pass,0.088291;0.088917;0.090834;0.088459;0.088792;0.088250;0.088458
-grid,10000,39600,1,cpu_bfs_distance,0.022917,0.022917,0.000000,0,0,0,0,0.491958,7,pass,0.023041;0.022958;0.022625;0.022917;0.023000;0.022833;0.022750
-grid,10000,39600,8,cpu_full,0.822667,0.822667,0.000000,0,0,0,0,0.511542,7,pass,0.832125;0.829417;0.827291;0.794500;0.813292;0.776792;0.822667
-grid,10000,39600,8,cpu_distance,0.276209,0.276209,0.000000,0,0,0,0,0.511542,7,pass,0.276209;0.304541;0.321125;0.287250;0.269333;0.243208;0.248250
-grid,10000,39600,8,cpu_bfs_full,0.311708,0.311708,0.000000,0,0,0,0,0.511542,7,pass,0.265791;0.314416;0.360625;0.248334;0.311708;0.313541;0.259708
-grid,10000,39600,8,cpu_bfs_distance,0.066208,0.066208,0.000000,0,0,0,0,0.511542,7,pass,0.067666;0.066208;0.068375;0.060500;0.061917;0.083833;0.063875
-chain,2048,2047,1,cpu_full,0.017375,0.017375,0.000000,0,0,0,0,0.145041,7,pass,0.017333;0.019333;0.019292;0.019292;0.017333;0.017375;0.017208
-chain,2048,2047,1,cpu_distance,0.004250,0.004250,0.000000,0,0,0,0,0.145041,7,pass,0.004292;0.004250;0.004209;0.003667;0.004250;0.004250;0.004208
-hub,4096,12286,64,cpu_full,2.338125,2.338125,0.000000,0,0,0,0,0.253291,7,pass,2.335292;2.332416;2.317459;2.338125;2.381084;2.358125;2.366458
-hub,4096,12286,64,cpu_distance,1.035625,1.035625,0.000000,0,0,0,0,0.253291,7,pass,1.045917;1.049042;1.030417;1.033500;1.035625;1.039625;1.031583
-random,4096,131072,1,cpu_full,1.517583,1.517583,0.000000,0,0,0,0,1.896875,7,pass,1.623958;1.576583;1.545917;1.489375;1.478709;1.517583;1.455083
-random,4096,131072,1,cpu_distance,0.688208,0.688208,0.000000,0,0,0,0,1.896875,7,pass,0.716000;0.710083;0.689833;0.688208;0.669541;0.657958;0.656333
-random,4096,131072,64,cpu_full,12.817167,12.817167,0.000000,0,0,0,0,1.777875,7,pass,12.910500;12.817167;12.927917;12.482625;13.703958;12.457333;12.349375
-random,4096,131072,64,cpu_distance,5.703500,5.703500,0.000000,0,0,0,0,1.777875,7,pass,5.703500;5.924666;5.729834;5.690042;5.765166;5.701958;5.690917
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/environment.txt b/dev/research/metal_pathfinding/optimization/results/aba/environment.txt
deleted file mode 100644
index 12e4344..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/environment.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-2026-09-26T23:29:08Z
-fbab119e794c843838f4f3f96d75cb7f32f06845
-ProductName:		macOS
-ProductVersion:		26.6.1
-BuildVersion:		25G76
-Apple M4 Max
-38654705664
-14
-Apple clang version 21.0.0 (clang-2100.1.1.101)
-Target: arm64-apple-darwin25.6.0
-Thread model: posix
-InstalledDir: /Library/Developer/CommandLineTools/usr/bin
-1da9ff77bd2ad97e95e951454821b25005859c6f75c27a3c56d925e5fc99f6fc  dev/research/metal_pathfinding/experiment.mm
-2e36b1623a3940bf1f19f5d81141bb1def14f5873fe2a98aab0101bbe68618a3  dev/research/metal_pathfinding/sssp.metal
-7717db8d791d17f7f0ef0b672461ad82afb2ae99cc2ab6c8cb8b33b35e74dd25  dev/research/metal_pathfinding/optimization/experiment.mm
-bed6c9a836e85520101659471c62b7c4c9eb6f4954cb7bb74c971f10c44f37ff  dev/research/metal_pathfinding/optimization/kernels.metal
-7bb649ffcd34e6be02ab14c35767b816b0b32ce3ee3c2fd91c199e4b37a837ce  build/metal_pathfinding/optimized
-Note: No thermal warning level has been recorded
-Note: No performance warning level has been recorded
-Note: No CPU power status has been recorded
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a1.txt
deleted file mode 100644
index e35f762..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a1.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11174330368,"Tiler Utilization %"=5,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=8,"TiledSceneBytes"=2228224,"Device Utilization %"=9,"SplitSceneCount"=0,"Allocated PB Size"=194379776,"In use system memory"=1583366144}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a2.txt
deleted file mode 100644
index 3dfce12..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-base-a2.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10970677248,"Tiler Utilization %"=3,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=5,"TiledSceneBytes"=1507328,"Device Utilization %"=63,"SplitSceneCount"=0,"Allocated PB Size"=189661184,"In use system memory"=1386561536}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a1.txt
deleted file mode 100644
index aff1c2d..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a1.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10953162752,"Tiler Utilization %"=4,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=6,"TiledSceneBytes"=2326528,"Device Utilization %"=30,"SplitSceneCount"=0,"Allocated PB Size"=191889408,"In use system memory"=1362182144}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a2.txt
deleted file mode 100644
index 191180b..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-cpu-a2.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11218386944,"Tiler Utilization %"=3,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=5,"TiledSceneBytes"=1441792,"Device Utilization %"=66,"SplitSceneCount"=0,"Allocated PB Size"=193069056,"In use system memory"=1351647232}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-optimized-b.txt b/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-optimized-b.txt
deleted file mode 100644
index 3a68cce..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/gpu-load-optimized-b.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10995400704,"Tiler Utilization %"=2,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=3,"TiledSceneBytes"=1474560,"Device Utilization %"=66,"SplitSceneCount"=0,"Allocated PB Size"=192282624,"In use system memory"=1355710464}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/load-base-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/load-base-a1.txt
deleted file mode 100644
index dd02bc0..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/load-base-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1024 total, 3 running, 1021 sleeping, 5250 threads 
-2026/09/27 00:29:21
-Load Avg: 3.21, 3.60, 4.27 
-CPU usage: 6.18% user, 11.61% sys, 82.20% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 638813 total, 10G resident, 741M private, 4389M shared.
-PhysMem: 34G used (4239M wired, 626M compressor), 1115M unused.
-VM: 453T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191126338/161G in, 146586979/163G out.
-Disks: 97827999/2477G read, 117446770/2100G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1025 total, 4 running, 1021 sleeping, 5258 threads 
-2026/09/27 00:29:22
-Load Avg: 3.21, 3.60, 4.27 
-CPU usage: 6.63% user, 5.47% sys, 87.88% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 152 total, 11M resident, 741M private, 4418M shared.
-PhysMem: 34G used (4196M wired, 626M compressor), 1089M unused.
-VM: 453T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191126514/161G in, 146587155/163G out.
-Disks: 97828002/2477G read, 117446910/2100G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     21.6 28/1  
-70968  Superset Helper  15.9 32    
-0      kernel_task      14.4 850/15
-7309   top              7.7  1/1   
-21666  2.1.283          7.3  27    
-70942  Superset Helper  7.2  19    
-70934  Superset         5.9  51    
-70969  Superset         5.2  21    
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/load-base-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/load-base-a2.txt
deleted file mode 100644
index d18990e..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/load-base-a2.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1019 total, 2 running, 1017 sleeping, 5187 threads 
-2026/09/27 00:30:29
-Load Avg: 3.19, 3.55, 4.19 
-CPU usage: 5.82% user, 8.66% sys, 85.51% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 638542 total, 10G resident, 736M private, 4366M shared.
-PhysMem: 34G used (3986M wired, 626M compressor), 1354M unused.
-VM: 451T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191149845/161G in, 146612635/163G out.
-Disks: 97828398/2477G read, 117449998/2100G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1019 total, 4 running, 1015 sleeping, 5180 threads 
-2026/09/27 00:30:30
-Load Avg: 3.19, 3.55, 4.19 
-CPU usage: 6.81% user, 6.18% sys, 86.99% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 0 total, 0B resident, 736M private, 4366M shared.
-PhysMem: 34G used (4002M wired, 626M compressor), 1357M unused.
-VM: 451T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191150177/161G in, 146613141/163G out.
-Disks: 97828398/2477G read, 117450254/2100G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     25.0 29/1  
-70968  Superset Helper  21.6 32/1  
-0      kernel_task      13.1 850/14
-1      launchd          11.9 3     
-15622  top              8.2  1/1   
-70942  Superset Helper  7.5  19    
-81804  2.1.283          6.7  27    
-70969  Superset         3.6  20    
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a1.txt
deleted file mode 100644
index 1c23bd6..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1032 total, 3 running, 1029 sleeping, 5281 threads 
-2026/09/27 00:29:09
-Load Avg: 3.51, 3.67, 4.30 
-CPU usage: 10.0% user, 9.68% sys, 80.31% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 639248 total, 10G resident, 749M private, 4360M shared.
-PhysMem: 34G used (3986M wired, 626M compressor), 1219M unused.
-VM: 456T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191122601/161G in, 146582691/163G out.
-Disks: 97827926/2477G read, 117446010/2100G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99553  mdworker_shared  0.0  4  
-99428  crashpad_handler 0.0  4  
-Processes: 1032 total, 4 running, 1028 sleeping, 5264 threads 
-2026/09/27 00:29:10
-Load Avg: 3.51, 3.67, 4.30 
-CPU usage: 11.73% user, 5.4% sys, 83.21% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 0 total, 0B resident, 749M private, 4360M shared.
-PhysMem: 34G used (3988M wired, 626M compressor), 1243M unused.
-VM: 456T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191123079/161G in, 146583230/163G out.
-Disks: 97827926/2477G read, 117446016/2100G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     20.6 28/1  
-70968  Superset Helper  17.5 32    
-0      kernel_task      12.2 850/14
-70942  Superset Helper  6.4  19    
-6126   top              6.1  1/1   
-21666  2.1.283          4.7  27    
-70969  Superset         2.5  20    
-70934  Superset         2.1  50    
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a2.txt
deleted file mode 100644
index f527810..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/load-cpu-a2.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1023 total, 6 running, 1017 sleeping, 5244 threads 
-2026/09/27 00:30:44
-Load Avg: 3.82, 3.67, 4.23 
-CPU usage: 13.90% user, 12.81% sys, 73.28% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 638887 total, 10G resident, 740M private, 4419M shared.
-PhysMem: 34G used (3984M wired, 626M compressor), 992M unused.
-VM: 452T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191155920/161G in, 146620711/163G out.
-Disks: 97828530/2477G read, 117450792/2100G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1029 total, 5 running, 1 stuck, 1023 sleeping, 5261 threads 
-2026/09/27 00:30:45
-Load Avg: 3.82, 3.67, 4.23 
-CPU usage: 16.69% user, 5.86% sys, 77.44% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 282 total, 10M resident, 740M private, 4464M shared.
-PhysMem: 34G used (3976M wired, 626M compressor), 1037M unused.
-VM: 455T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191156199/161G in, 146620961/163G out.
-Disks: 97828530/2477G read, 117450800/2100G written.
-
-PID    COMMAND          %CPU #TH   
-16594  Google Chrome He 55.7 25/1  
-1225   mediaanalysisd   36.4 18/2  
-590    WindowServer     27.7 29    
-70968  Superset Helper  25.0 32/1  
-95916  Google Chrome    17.5 46    
-0      kernel_task      15.2 850/14
-731    sysmond          10.4 3     
-70942  Superset Helper  9.3  19    
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/load-optimized-b.txt b/dev/research/metal_pathfinding/optimization/results/aba/load-optimized-b.txt
deleted file mode 100644
index 744da4d..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/load-optimized-b.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1023 total, 3 running, 1020 sleeping, 5207 threads 
-2026/09/27 00:29:35
-Load Avg: 3.30, 3.60, 4.25 
-CPU usage: 6.44% user, 8.69% sys, 84.86% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 625656 total, 10G resident, 740M private, 4353M shared.
-PhysMem: 34G used (3975M wired, 626M compressor), 1426M unused.
-VM: 451T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191131577/161G in, 146592177/163G out.
-Disks: 97828052/2477G read, 117447547/2100G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1024 total, 4 running, 1020 sleeping, 5206 threads 
-2026/09/27 00:29:37
-Load Avg: 3.30, 3.60, 4.25 
-CPU usage: 7.77% user, 5.29% sys, 86.92% idle 
-SharedLibs: 916M resident, 168M data, 136M linkedit.
-MemRegions: 33 total, 80K resident, 740M private, 4354M shared.
-PhysMem: 34G used (3977M wired, 626M compressor), 1411M unused.
-VM: 451T vsize, 6144M framework vsize, 2846220(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191131879/161G in, 146592477/163G out.
-Disks: 97828056/2477G read, 117447556/2100G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     24.9 28    
-70968  Superset Helper  16.7 32    
-0      kernel_task      12.6 850/14
-81804  2.1.283          10.9 27    
-9966   top              6.7  1/1   
-70942  Superset Helper  6.5  19    
-39757  codex            4.9  31    
-70969  Superset         2.8  20    
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/optimized-b-stderr.txt b/dev/research/metal_pathfinding/optimization/results/aba/optimized-b-stderr.txt
deleted file mode 100644
index fed94be..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/optimized-b-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=23.3475 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/optimized-b.csv b/dev/research/metal_pathfinding/optimization/results/aba/optimized-b.csv
deleted file mode 100644
index ceb3e3f..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/optimized-b.csv
+++ /dev/null
@@ -1,217 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_parallel_dag,1.422708,1.375584,0.424208,131072,16,2,0,0.152791,7,pass,1.540625;1.013375;1.422708;0.980167;1.441208;1.027458;1.449958
-random,1024,8192,1,old_group_parallel_dag,0.833500,0.818833,0.679958,106496,13,1,0,0.152791,7,pass,0.833500;0.817917;1.119042;0.831833;0.925708;0.827042;0.877000
-random,1024,8192,1,pull64_barrier,0.659084,0.646375,0.390667,131072,16,2,0,0.152791,7,pass,0.644416;0.664875;0.659084;0.643459;0.654750;0.659750;0.671792
-random,1024,8192,1,pull64_interleaved,0.655584,0.643000,0.375208,131072,16,2,0,0.152791,7,pass,0.660167;0.652250;0.655584;0.672125;0.650375;0.629083;0.677083
-random,1024,8192,1,pull32_interleaved,0.599333,0.586041,0.337667,131072,16,2,0,0.152791,7,pass,0.667083;0.607875;0.599333;0.571542;0.736667;0.583833;0.566542
-random,1024,8192,1,pull32_gpu_dag,0.960083,0.603666,0.406125,131072,16,4,0,0.152791,7,pass,1.014709;0.960083;0.982375;0.981250;0.949417;0.928375;0.958334
-random,1024,8192,1,frontier32_vertex,0.923583,0.909625,0.634334,21088,16,2,0,0.152791,7,pass,0.906208;0.964958;0.872292;0.874250;1.228792;0.930208;0.923583
-random,1024,8192,1,frontier32_simd,0.661125,0.647209,0.380375,20272,16,2,0,0.152791,7,pass,0.647583;0.661125;0.686791;0.653458;0.636375;0.679750;0.674833
-random,1024,8192,1,frontier32_gpu_dag,1.002750,0.652084,0.452250,20384,16,4,0,0.152791,7,pass,0.988750;0.968709;0.979666;1.002750;1.115041;1.082875;1.185666
-random,1024,8192,1,bucket32_d4,1.895167,1.880583,1.276084,8232,32,4,0,0.152791,7,pass,2.037416;2.476041;1.853333;1.785791;1.902334;1.888917;1.895167
-random,1024,8192,1,bucket32_d16,1.421542,1.407000,0.920208,9336,24,3,0,0.152791,7,pass,1.421542;1.436167;1.369375;1.347459;1.377084;1.460625;1.463417
-random,1024,8192,1,bucket32_d64,0.953750,0.939042,0.653708,19264,16,2,0,0.152791,7,pass,0.950916;0.940167;0.953750;0.954375;0.977375;1.016334;0.913959
-random,1024,8192,64,old_pull_parallel_dag,1.972792,1.703000,1.236416,12582912,24,3,0,0.238875,7,pass,2.379583;2.263125;1.972792;1.649750;1.554584;1.804167;2.017709
-random,1024,8192,64,old_group_parallel_dag,0.852750,0.566166,0.379500,7217152,17,1,0,0.238875,7,pass,0.972542;0.909042;0.773791;0.876500;0.773208;0.852750;0.821167
-random,1024,8192,64,pull64_barrier,1.223458,0.948625,0.470458,12582912,24,3,0,0.238875,7,pass,1.215166;1.266916;1.459875;1.254708;1.100250;1.223458;1.058542
-random,1024,8192,64,pull64_interleaved,0.940417,0.670542,0.268333,12582912,24,3,0,0.238875,7,pass,1.098459;0.940417;1.008292;1.048209;0.935416;0.862625;0.937292
-random,1024,8192,64,pull32_interleaved,0.863416,0.594792,0.197417,12582912,24,3,0,0.238875,7,pass,0.897167;0.847458;0.843917;0.856791;0.925958;0.885125;0.863416
-random,1024,8192,64,pull32_gpu_dag,0.998000,0.578542,0.199083,12582912,24,5,0,0.238875,7,pass,1.014750;0.831500;0.914292;1.005500;0.940167;0.998000;1.025125
-random,1024,8192,64,frontier32_vertex,0.869625,0.628834,0.239458,1289824,16,2,0,0.238875,7,pass,0.929916;1.029083;0.811167;0.964459;0.869625;0.779625;0.783875
-random,1024,8192,64,frontier32_simd,1.028500,0.795709,0.456417,1202328,16,2,0,0.238875,7,pass,1.156250;1.092875;1.028500;0.996917;0.985625;1.019916;1.121709
-random,1024,8192,64,frontier32_gpu_dag,1.197083,0.889625,0.508875,1201208,16,4,0,0.238875,7,pass,1.042417;1.254542;1.182167;1.197083;1.099917;1.569084;2.684750
-random,1024,8192,64,bucket32_d4,5.929458,5.638042,4.210875,528528,56,7,0,0.238875,7,pass,6.084667;5.929458;5.901834;6.615042;5.929458;2.489625;2.791458
-random,1024,8192,64,bucket32_d16,1.623792,1.347083,0.712083,601456,32,4,0,0.238875,7,pass,1.662291;1.614416;1.657709;1.623792;1.578500;1.475583;1.650417
-random,1024,8192,64,bucket32_d64,1.402750,1.126334,0.671125,1154720,24,3,0,0.238875,7,pass,1.349709;1.441667;1.314791;1.402750;1.365125;1.570500;1.408750
-clos,200,20000,64,old_pull_parallel_dag,2.136750,1.514125,1.015667,10240000,8,1,0,0.322125,7,pass,2.048625;2.183375;2.117792;1.920167;2.160875;2.136750;2.711125
-clos,200,20000,64,old_group_parallel_dag,1.460750,0.833416,0.303250,3840000,3,1,0,0.322125,7,pass,1.479875;1.528583;1.339875;1.338875;1.467208;1.426625;1.460750
-clos,200,20000,64,pull64_barrier,2.071916,1.523875,1.000375,10240000,8,1,0,0.322125,7,pass,2.033375;2.132917;2.115500;2.105750;1.921250;1.814041;2.071916
-clos,200,20000,64,pull64_interleaved,1.903375,1.332458,0.757208,10240000,8,1,0,0.322125,7,pass,1.586917;1.955417;1.903375;2.048458;1.910875;1.876500;1.902250
-clos,200,20000,64,pull32_interleaved,1.893500,1.311208,0.687708,10240000,8,1,0,0.322125,7,pass,1.853250;1.915167;1.809917;1.898334;1.949167;1.893500;1.792167
-clos,200,20000,64,pull32_gpu_dag,2.091666,1.226209,1.012708,10240000,8,3,0,0.322125,7,pass,2.159458;2.626458;1.675041;2.091666;1.743709;2.184375;2.028334
-clos,200,20000,64,frontier32_vertex,2.381875,1.556917,0.961125,1280000,8,1,0,0.322125,7,pass,2.020291;2.766500;2.041667;2.792125;2.084459;2.381875;2.471625
-clos,200,20000,64,frontier32_simd,1.552459,0.924500,0.317875,1280000,8,1,0,0.322125,7,pass,1.552459;1.569875;1.528791;1.653375;1.387708;1.480917;1.568750
-clos,200,20000,64,frontier32_gpu_dag,1.979166,0.982458,0.836500,1280000,8,3,0,0.322125,7,pass,2.080875;1.972042;1.933208;2.108042;1.548334;1.979166;2.014125
-clos,200,20000,64,bucket32_d4,1.572375,1.024583,0.480750,1280000,8,1,0,0.322125,7,pass,2.073625;1.344417;1.663959;1.754875;1.275500;1.452917;1.572375
-clos,200,20000,64,bucket32_d16,1.739292,1.165625,0.491667,1280000,8,1,0,0.322125,7,pass,1.775000;1.796583;1.739292;1.315750;1.685625;1.748541;1.637916
-clos,200,20000,64,bucket32_d64,1.692708,1.072250,0.489542,1280000,8,1,0,0.322125,7,pass,1.629041;1.683584;1.586167;1.839709;1.716250;1.692708;1.699208
-grid,1024,3968,1,old_pull_parallel_dag,1.747333,1.738833,0.651333,253952,64,8,0,0.124084,7,pass,1.754625;1.747333;1.919625;1.635333;1.795750;1.629333;1.627542
-grid,1024,3968,1,old_group_parallel_dag,0.365667,0.358792,0.227375,249984,63,1,0,0.124084,7,pass,1.116750;0.360041;0.365667;0.352625;0.396042;0.372000;0.363209
-grid,1024,3968,1,pull64_barrier,1.119292,1.111458,0.177083,253952,64,8,0,0.124084,7,pass,1.136458;1.122167;1.175458;1.103917;1.119292;1.113042;1.103334
-grid,1024,3968,1,pull64_interleaved,1.144083,1.136125,0.176751,253952,64,8,0,0.124084,7,pass,1.134375;1.313625;1.215166;1.160208;1.096416;1.144083;1.113833
-grid,1024,3968,1,pull32_interleaved,1.088542,1.080667,0.163666,253952,64,8,0,0.124084,7,pass,1.101875;1.104166;1.088542;1.119625;1.051041;0.916541;1.050417
-grid,1024,3968,1,pull32_gpu_dag,1.270833,0.918458,0.173167,253952,64,10,0,0.124084,7,pass,1.277166;1.248125;1.308083;1.206458;1.379875;1.122791;1.270833
-grid,1024,3968,1,frontier32_vertex,1.312625,1.304791,0.528083,3968,64,8,0,0.124084,7,pass,1.312625;1.423958;1.307792;1.312292;1.321584;1.309625;1.349500
-grid,1024,3968,1,frontier32_simd,1.179667,1.171750,0.396291,3968,64,8,0,0.124084,7,pass,1.224375;1.179125;1.179667;1.174000;1.176875;1.186250;1.278792
-grid,1024,3968,1,frontier32_gpu_dag,1.394125,1.178458,0.407416,3968,64,10,0,0.124084,7,pass,1.432250;1.562334;1.460583;1.370833;1.394125;1.385333;1.378958
-grid,1024,3968,1,bucket32_d4,1.450166,1.441333,0.637042,3968,64,8,0,0.124084,7,pass,1.622291;1.445083;1.459416;1.450166;1.399667;1.537458;1.438791
-grid,1024,3968,1,bucket32_d16,1.451125,1.443250,0.635917,3968,64,8,0,0.124084,7,pass,1.444458;1.551500;1.423000;1.435167;1.451125;1.456500;1.464833
-grid,1024,3968,1,bucket32_d64,1.466458,1.458667,0.637167,3968,64,8,0,0.124084,7,pass,1.429375;1.439417;1.466458;1.588042;1.638959;1.476583;1.456791
-hub,1024,3070,1,old_pull_parallel_dag,6.046292,6.030084,5.544375,98240,32,4,0,0.098834,7,pass,5.969208;6.158125;6.087291;6.000167;6.046292;6.013417;6.048458
-hub,1024,3070,1,old_group_parallel_dag,4.888250,4.865667,4.721042,95170,31,1,0,0.098834,7,pass,4.863875;4.938958;4.863792;4.881375;4.888250;5.117750;4.995041
-hub,1024,3070,1,pull64_barrier,5.015916,4.988250,4.313333,98240,32,4,0,0.098834,7,pass,4.957625;5.000166;5.193458;5.034583;5.015916;5.078375;4.889250
-hub,1024,3070,1,pull64_interleaved,4.985584,4.962042,4.320833,98240,32,4,0,0.098834,7,pass,4.985584;5.048916;5.110875;4.910750;4.974542;5.079959;4.959667
-hub,1024,3070,1,pull32_interleaved,4.396791,4.373584,3.683708,98240,32,4,0,0.098834,7,pass,4.324084;4.431084;4.344417;4.461542;4.414375;4.396791;4.393666
-hub,1024,3070,1,pull32_gpu_dag,5.115583,4.357708,4.101125,98240,32,6,0,0.098834,7,pass,5.115583;5.122334;5.007417;5.289875;5.065416;5.077334;5.281125
-hub,1024,3070,1,frontier32_vertex,1.436166,1.428458,0.852042,3128,32,4,0,0.098834,7,pass,1.510208;1.436166;1.386458;1.511958;1.404167;1.438709;1.412875
-hub,1024,3070,1,frontier32_simd,0.784458,0.776500,0.233250,3128,32,4,0,0.098834,7,pass,0.761209;0.730042;0.781167;0.861667;0.786834;0.795166;0.784458
-hub,1024,3070,1,frontier32_gpu_dag,1.467375,0.769666,0.649500,3128,32,6,0,0.098834,7,pass,1.490583;1.610666;1.444583;1.509500;1.438708;1.450458;1.467375
-hub,1024,3070,1,bucket32_d4,0.869375,0.860292,0.344792,3100,32,4,0,0.098834,7,pass,0.868792;0.897709;0.906917;0.852833;0.880541;0.804416;0.869375
-hub,1024,3070,1,bucket32_d16,0.851250,0.843000,0.337292,3124,32,4,0,0.098834,7,pass,0.851250;0.846875;0.847417;0.932916;0.857625;0.875333;0.850125
-hub,1024,3070,1,bucket32_d64,0.885584,0.877625,0.326958,3128,32,4,0,0.098834,7,pass,0.848208;0.818834;0.853667;0.956041;0.885584;0.912042;0.911250
-random_masked_int64_reverse,1024,8192,8,old_pull_parallel_dag,0.231584,0.167417,0.031625,524288,8,1,0,0.225500,7,pass,0.232959;0.231584;0.263750;0.244833;0.228166;0.217625;0.224417
-random_masked_int64_reverse,1024,8192,8,old_group_parallel_dag,0.252833,0.194208,0.053500,368640,8,1,0,0.225500,7,pass,0.235500;0.300042;0.265000;0.252833;0.253417;0.241000;0.235292
-random_masked_int64_reverse,1024,8192,8,pull64_barrier,0.248458,0.190334,0.028750,524288,8,1,0,0.225500,7,pass,0.232375;0.263291;0.248458;0.237625;0.234167;0.248958;0.254792
-random_masked_int64_reverse,1024,8192,8,pull64_interleaved,0.263750,0.196708,0.029083,524288,8,1,0,0.225500,7,pass,0.231750;0.251083;0.263750;0.314917;0.275708;0.277375;0.250750
-random_masked_int64_reverse,1024,8192,8,pull32_interleaved,0.252166,0.197709,0.028833,524288,8,1,1,0.225500,7,pass,0.246500;0.296791;0.377917;0.252166;0.253166;0.239334;0.234209
-random_masked_int64_reverse,1024,8192,8,pull32_gpu_dag,0.499334,0.173875,0.048708,524288,8,3,1,0.225500,7,pass,0.453000;0.509250;0.474667;0.491292;0.499334;0.505583;0.586458
-random_masked_int64_reverse,1024,8192,8,frontier32_vertex,0.238375,0.188375,0.029167,524288,8,1,1,0.225500,7,pass,0.267584;0.267791;0.238375;0.232083;0.255083;0.227250;0.222083
-random_masked_int64_reverse,1024,8192,8,frontier32_simd,0.255750,0.192125,0.028667,524288,8,1,1,0.225500,7,pass,0.203333;0.266166;0.315666;0.257458;0.255750;0.237375;0.245750
-random_masked_int64_reverse,1024,8192,8,frontier32_gpu_dag,0.504333,0.184083,0.047458,524288,8,3,1,0.225500,7,pass,0.528250;0.504458;0.574709;0.504333;0.476834;0.476833;0.454791
-random_masked_int64_reverse,1024,8192,8,bucket32_d4,0.243083,0.197583,0.028750,524288,8,1,1,0.225500,7,pass,0.269416;0.260916;0.267750;0.237458;0.235791;0.241416;0.243083
-random_masked_int64_reverse,1024,8192,8,bucket32_d16,0.223542,0.178000,0.028875,524288,8,1,1,0.225500,7,pass,0.222750;0.232791;0.237375;0.258250;0.223542;0.215333;0.210875
-random_masked_int64_reverse,1024,8192,8,bucket32_d64,0.260750,0.198542,0.028917,524288,8,1,1,0.225500,7,pass,0.229833;0.261834;0.302792;0.260917;0.247000;0.260750;0.247750
-random,4096,32768,256,old_pull_parallel_dag,14.954834,11.144167,9.933083,201326592,24,3,0,0.530167,7,pass,15.227708;14.739917;14.645041;14.434167;15.033875;14.956792;14.954834
-random,4096,32768,256,old_group_parallel_dag,11.269917,7.608250,6.915000,136544256,20,1,0,0.530167,7,pass,11.252208;11.493083;11.614375;11.162459;11.269917;11.043583;11.470666
-random,4096,32768,256,pull64_barrier,13.565209,9.762416,8.500917,201326592,24,3,0,0.530167,7,pass,13.685167;13.552875;13.587709;13.426042;13.565209;12.961916;13.579000
-random,4096,32768,256,pull64_interleaved,7.002542,3.340208,2.080917,201326592,24,3,0,0.530167,7,pass,6.459833;7.002542;6.970958;6.819791;8.010875;7.685500;7.589250
-random,4096,32768,256,pull32_interleaved,9.000125,5.200041,3.525458,201326592,24,3,0,0.530167,7,pass,9.000125;11.030083;8.075542;6.810625;11.745583;6.810833;11.157541
-random,4096,32768,256,pull32_gpu_dag,8.790333,6.949833,7.133875,201326592,24,5,0,0.530167,7,pass,9.671167;3.518834;8.790333;9.206042;3.936125;3.961042;9.220208
-random,4096,32768,256,frontier32_vertex,7.936292,4.093958,2.380125,19766184,24,3,0,0.530167,7,pass,14.160834;7.095291;7.936292;14.078500;6.887042;6.492417;8.011875
-random,4096,32768,256,frontier32_simd,11.324125,7.658917,6.414084,20599968,24,3,0,0.530167,7,pass,11.324125;11.230792;12.628625;10.989958;12.690250;10.503958;11.417833
-random,4096,32768,256,frontier32_gpu_dag,9.247000,7.874000,7.025417,20610776,24,5,0,0.530167,7,pass,9.247000;8.839625;10.159084;8.513125;9.098458;9.902667;12.254458
-random,4096,32768,256,bucket32_d4,16.328042,12.613875,10.131208,8454072,72,9,0,0.530167,7,pass,15.820875;15.743208;17.331208;17.372667;17.149292;16.328042;15.803333
-random,4096,32768,256,bucket32_d16,13.121000,9.300750,7.673208,9728592,48,6,0,0.530167,7,pass,12.592459;12.880667;13.311583;13.121000;12.540334;13.268125;13.189209
-random,4096,32768,256,bucket32_d64,14.196416,9.622542,8.263583,18345256,24,3,0,0.530167,7,pass,13.307666;13.243458;14.604250;14.721292;16.965625;14.196416;11.675209
-random,16384,131072,1,old_pull_parallel_dag,0.963792,0.658875,0.243542,3145728,24,3,0,1.641291,7,pass,1.004958;0.949750;0.963792;0.924292;1.072083;0.879500;0.969417
-random,16384,131072,1,old_group_parallel_dag,5.289583,4.968000,4.819125,2359296,18,1,0,1.641291,7,pass,5.441666;5.132583;5.298584;5.189291;5.167667;5.335500;5.289583
-random,16384,131072,1,pull64_barrier,0.760792,0.570916,0.163584,3145728,24,3,0,1.641291,7,pass,0.754833;0.774750;0.854375;0.782167;0.760792;0.759375;0.723417
-random,16384,131072,1,pull64_interleaved,0.828250,0.564041,0.163917,3145728,24,3,0,1.641291,7,pass,0.838583;0.961166;0.811000;0.853208;0.817333;0.828250;0.752583
-random,16384,131072,1,pull32_interleaved,0.705083,0.520875,0.136959,3145728,24,3,0,1.641291,7,pass,0.692583;0.711333;0.700666;0.706750;0.705083;0.703000;0.878958
-random,16384,131072,1,pull32_gpu_dag,0.880167,0.512875,0.158000,3145728,24,5,0,1.641291,7,pass,0.880167;0.828750;0.869708;0.906792;0.831750;0.944541;0.894834
-random,16384,131072,1,frontier32_vertex,0.831833,0.618959,0.258125,377056,24,3,0,1.641291,7,pass,0.849750;0.831833;0.841916;0.827792;0.873667;0.821125;0.814084
-random,16384,131072,1,frontier32_simd,0.806417,0.593083,0.237208,335680,24,3,0,1.641291,7,pass,0.824166;0.806417;0.694583;0.641750;0.808667;0.799250;0.844083
-random,16384,131072,1,frontier32_gpu_dag,0.982833,0.612417,0.268708,334824,24,5,0,1.641291,7,pass,0.991500;0.973042;1.006625;0.951167;0.982833;1.121125;0.797541
-random,16384,131072,1,bucket32_d4,1.832833,1.546042,0.654208,132016,56,7,0,1.641291,7,pass,1.779834;1.940750;1.879708;1.832833;1.795166;1.849667;1.734208
-random,16384,131072,1,bucket32_d16,1.148208,0.916666,0.397583,148256,32,4,0,1.641291,7,pass,1.118791;1.148208;1.278792;1.143833;1.283750;1.248500;1.113291
-random,16384,131072,1,bucket32_d64,0.936833,0.711500,0.339500,268728,24,3,0,1.641291,7,pass,0.928500;0.936833;0.949541;0.932791;0.940250;0.933167;0.946042
-random,16384,131072,64,old_pull_parallel_dag,16.913292,12.650625,11.412458,201326592,24,3,0,1.869208,7,pass,17.212875;16.913292;17.536708;16.731500;16.199708;16.913375;16.278333
-random,16384,131072,64,old_group_parallel_dag,13.239041,9.052417,8.276375,158203904,22,1,0,1.869208,7,pass,13.094375;13.914166;13.783125;13.407916;13.111125;13.058417;13.239041
-random,16384,131072,64,pull64_barrier,15.959375,11.386000,10.305167,201326592,24,3,0,1.869208,7,pass,15.514584;16.078958;15.892875;15.768500;16.169292;16.315750;15.959375
-random,16384,131072,64,pull64_interleaved,7.473334,3.322042,1.949625,201326592,24,3,0,1.869208,7,pass,7.977375;7.469666;7.993750;7.469959;7.340416;8.069541;7.473334
-random,16384,131072,64,pull32_interleaved,8.709917,3.948375,2.593083,201326592,24,3,0,1.869208,7,pass,7.568334;8.709917;9.042834;8.360834;9.779833;11.890542;7.645000
-random,16384,131072,64,pull32_gpu_dag,8.809875,7.334042,7.226667,201326592,24,5,0,1.869208,7,pass,8.327042;8.982250;9.166375;8.212792;9.129458;8.809875;8.644916
-random,16384,131072,64,frontier32_vertex,10.143542,5.759583,3.640500,21296680,24,3,0,1.869208,7,pass,10.647167;8.829458;10.953250;8.470875;8.924250;11.585834;10.143542
-random,16384,131072,64,frontier32_simd,12.189208,7.940750,6.799000,22006672,24,3,0,1.869208,7,pass,12.189208;17.371042;12.150166;11.824625;17.040958;12.901583;11.954250
-random,16384,131072,64,frontier32_gpu_dag,9.202917,7.809334,7.471417,21985376,24,5,0,1.869208,7,pass,9.202917;9.145375;9.333000;9.321417;8.679416;9.192583;9.217625
-random,16384,131072,64,bucket32_d4,16.825209,12.606541,10.280166,8451400,72,9,0,1.869208,7,pass,15.831792;16.931500;16.825209;16.989583;16.937500;16.726666;16.530875
-random,16384,131072,64,bucket32_d16,13.809292,9.686834,7.926208,9572312,48,6,0,1.869208,7,pass,14.031791;13.417000;13.809292;13.634833;13.956208;12.643542;14.687833
-random,16384,131072,64,bucket32_d64,12.602167,8.439250,7.400083,17413440,24,3,0,1.869208,7,pass,12.249792;12.602167;12.763000;11.981750;12.445291;13.342709;13.471250
-random,65536,524288,1,old_pull_parallel_dag,3.545291,2.038125,1.060917,12582912,24,3,0,7.557667,7,pass,4.174416;3.781042;3.698125;3.545291;3.297792;3.206292;3.322458
-random,65536,524288,1,old_group_parallel_dag,30.358375,28.977917,28.313750,11534336,22,1,0,7.557667,7,pass,30.101000;30.358375;30.286417;30.429125;30.627750;30.470958;30.242042
-random,65536,524288,1,pull64_barrier,3.163417,1.729375,0.758083,12582912,24,3,0,7.557667,7,pass,3.113500;2.616291;3.163417;3.279250;3.173625;3.383583;3.162375
-random,65536,524288,1,pull64_interleaved,3.048417,1.518750,0.702958,12582912,24,3,0,7.557667,7,pass,3.038333;2.940000;3.048417;3.174250;3.017125;3.103000;3.113208
-random,65536,524288,1,pull32_interleaved,2.913209,1.337792,0.501667,12582912,24,3,0,7.557667,7,pass,2.913209;2.430541;3.057667;2.519625;2.842875;2.994208;2.928625
-random,65536,524288,1,pull32_gpu_dag,1.373417,0.881667,0.570875,12582912,24,5,0,7.557667,7,pass,1.391584;1.373417;1.479292;1.291209;1.337833;1.320958;1.406750
-random,65536,524288,1,frontier32_vertex,2.737250,1.259292,0.435458,1734632,24,3,0,7.557667,7,pass,2.715333;2.737250;2.858583;2.871083;2.568667;2.928166;2.330750
-random,65536,524288,1,frontier32_simd,3.045416,1.576083,0.639792,1561768,24,3,0,7.557667,7,pass,3.041292;3.007917;3.045416;3.056084;2.611792;3.060625;3.113833
-random,65536,524288,1,frontier32_gpu_dag,1.461000,1.045334,0.686000,1558160,24,5,0,7.557667,7,pass,1.657208;1.494750;1.429000;1.461000;1.452083;1.487333;1.387208
-random,65536,524288,1,bucket32_d4,4.357292,2.761166,1.174042,528256,64,8,0,7.557667,7,pass,4.461625;4.147542;4.444375;3.817792;4.357292;3.730458;4.480750
-random,65536,524288,1,bucket32_d16,3.480542,2.046791,0.835833,599256,40,5,0,7.557667,7,pass,3.480542;3.618791;3.528458;3.040125;3.475000;2.936333;3.646042
-random,65536,524288,1,bucket32_d64,3.186959,1.681334,0.676709,1050376,24,3,0,7.557667,7,pass,2.972375;3.186959;3.069917;3.187000;3.276667;3.274542;3.125584
-clos,800,320000,1,old_pull_parallel_dag,2.141750,1.366208,0.743750,2560000,8,1,0,3.583584,7,pass,2.117375;2.169292;2.141750;2.208292;2.099459;2.102417;2.219875
-clos,800,320000,1,old_group_parallel_dag,2.325833,1.576542,0.904750,960000,3,1,0,3.583584,7,pass,1.803667;2.325833;2.423834;2.367833;2.283458;2.311875;2.412417
-clos,800,320000,1,pull64_barrier,2.017334,1.252542,0.699375,2560000,8,1,0,3.583584,7,pass,1.540042;1.974542;1.998791;2.017334;2.145250;2.049167;2.183834
-clos,800,320000,1,pull64_interleaved,2.265000,1.493125,0.878292,2560000,8,1,0,3.583584,7,pass,2.248084;2.265000;2.266583;2.184625;2.588416;1.812125;2.474416
-clos,800,320000,1,pull32_interleaved,2.800709,1.979625,1.363375,2560000,8,1,0,3.583584,7,pass,2.800709;2.480667;2.804250;2.902708;2.653584;1.981000;3.096791
-clos,800,320000,1,pull32_gpu_dag,2.132833,1.256042,0.994000,2560000,8,3,0,3.583584,7,pass,2.004875;2.039500;2.228625;2.610667;1.446750;2.132833;2.185042
-clos,800,320000,1,frontier32_vertex,2.375500,1.574833,0.933250,320000,8,1,0,3.583584,7,pass,1.813500;2.375500;1.851291;5.269584;3.758292;2.390250;2.215708
-clos,800,320000,1,frontier32_simd,1.604458,0.852083,0.361417,320000,8,1,0,3.583584,7,pass,1.724958;1.809125;1.589542;1.604458;1.514125;1.668583;1.587916
-clos,800,320000,1,frontier32_gpu_dag,1.714416,0.823959,0.606042,320000,8,3,0,3.583584,7,pass,3.397708;1.759291;2.480875;1.558125;1.714416;1.648958;1.076958
-clos,800,320000,1,bucket32_d4,1.660042,0.872958,0.445875,320000,8,1,0,3.583584,7,pass,1.463167;1.412583;1.748375;1.660042;1.712083;1.768875;1.587750
-clos,800,320000,1,bucket32_d16,1.716125,0.904208,0.443542,320000,8,1,0,3.583584,7,pass,1.814125;1.647500;1.722334;1.690042;1.764750;1.716125;1.629792
-clos,800,320000,1,bucket32_d64,1.697542,0.939166,0.453417,320000,8,1,0,3.583584,7,pass,1.726542;1.697542;1.673041;1.558833;1.790583;1.782500;1.680916
-clos,800,320000,64,old_pull_parallel_dag,26.734584,19.417958,18.854209,163840000,8,1,0,3.568791,7,pass,30.062917;26.734584;27.709875;23.844042;26.751083;24.652083;23.241250
-clos,800,320000,64,old_group_parallel_dag,12.636667,5.914625,5.412125,61440000,3,1,0,3.568791,7,pass,13.336750;12.226458;12.215542;12.019334;12.982541;12.636667;13.245083
-clos,800,320000,64,pull64_barrier,24.737250,18.165041,17.724875,163840000,8,1,0,3.568791,7,pass,26.038667;23.627875;23.828875;24.737250;25.138416;20.098750;25.549208
-clos,800,320000,64,pull64_interleaved,13.270458,6.121834,5.404917,163840000,8,1,0,3.568791,7,pass,13.665208;12.286459;13.418500;13.055084;12.553250;13.305834;13.270458
-clos,800,320000,64,pull32_interleaved,10.982708,4.274208,3.646792,163840000,8,1,0,3.568791,7,pass,10.804708;10.794208;10.982708;11.027542;10.547750;11.347166;11.442166
-clos,800,320000,64,pull32_gpu_dag,8.185208,4.307834,6.163833,163840000,8,3,0,3.568791,7,pass,7.631709;7.941417;8.661667;8.185208;8.311625;8.223667;7.750583
-clos,800,320000,64,frontier32_vertex,14.231292,7.148416,6.877042,20480000,8,1,0,3.568791,7,pass,14.506375;12.344792;13.874083;13.901542;14.231292;14.353875;15.082167
-clos,800,320000,64,frontier32_simd,9.324334,2.064667,1.458000,20480000,8,1,0,3.568791,7,pass,8.174041;8.823334;9.906666;8.897125;9.324334;9.981375;9.356125
-clos,800,320000,64,frontier32_gpu_dag,15.943917,2.088583,14.063458,20480000,8,3,0,3.568791,7,pass,17.334916;15.073292;12.642375;15.943917;12.171250;16.266166;17.346541
-clos,800,320000,64,bucket32_d4,10.000292,2.528500,2.040125,20480000,8,1,0,3.568791,7,pass,10.000292;10.508458;9.561208;8.825292;10.400125;10.141750;9.762250
-clos,800,320000,64,bucket32_d16,9.609833,2.183166,1.863208,20480000,8,1,0,3.568791,7,pass,8.653417;9.125125;8.935750;10.713417;9.609833;9.966375;10.069792
-clos,800,320000,64,bucket32_d64,9.988250,2.683542,2.106250,20480000,8,1,0,3.568791,7,pass,9.028250;9.988250;10.240792;9.182333;10.137083;9.899833;10.287375
-grid,10000,39600,1,old_pull_parallel_dag,4.013208,3.946834,0.706459,7920000,200,25,0,0.518084,7,pass,5.984209;3.982416;4.445583;3.987667;4.117083;3.956167;4.013208
-grid,10000,39600,1,old_group_parallel_dag,8.014000,7.948000,7.803667,7880400,199,1,0,0.518084,7,pass,8.141042;7.945375;8.093000;7.954000;8.046667;7.961459;8.014000
-grid,10000,39600,1,pull64_barrier,4.119917,3.996000,0.681501,7920000,200,25,0,0.518084,7,pass,4.068708;4.193167;3.904375;4.360166;3.813917;4.625583;4.119917
-grid,10000,39600,1,pull64_interleaved,3.962917,3.893959,0.656292,7920000,200,25,0,0.518084,7,pass,4.197584;3.962917;3.456708;3.196333;3.866459;4.134333;4.008166
-grid,10000,39600,1,pull32_interleaved,3.378208,3.313666,0.604292,7920000,200,25,0,0.518084,7,pass,3.861917;4.153500;3.086834;3.378208;3.201917;3.100208;3.562041
-grid,10000,39600,1,pull32_gpu_dag,3.492000,3.086416,0.615749,7920000,200,27,0,0.518084,7,pass,3.126625;3.581209;3.413750;3.492000;3.813209;3.413333;3.648042
-grid,10000,39600,1,frontier32_vertex,4.642292,4.568084,1.859291,39600,200,25,0,0.518084,7,pass,4.756792;4.409125;4.959792;4.430125;4.642292;4.346791;4.889625
-grid,10000,39600,1,frontier32_simd,4.039750,3.931208,1.337458,39600,200,25,0,0.518084,7,pass,3.751375;4.175583;3.843833;4.311875;4.072000;3.882458;4.039750
-grid,10000,39600,1,frontier32_gpu_dag,4.282875,3.993000,1.301917,39600,200,27,0,0.518084,7,pass,4.187125;4.407917;4.301333;4.592167;4.274375;4.282875;4.212167
-grid,10000,39600,1,bucket32_d4,4.910500,4.826209,2.155791,39600,200,25,0,0.518084,7,pass,4.898375;4.900875;4.938208;5.008292;4.910500;4.821916;4.910875
-grid,10000,39600,1,bucket32_d16,5.335708,5.270375,2.374709,39600,200,25,0,0.518084,7,pass,4.793250;5.374833;5.328916;5.439166;5.335708;5.208875;5.532833
-grid,10000,39600,1,bucket32_d64,5.192667,5.129416,2.312959,39600,200,25,0,0.518084,7,pass,4.957750;4.982166;5.317625;5.049916;5.437000;5.192667;5.370000
-grid,10000,39600,8,old_pull_parallel_dag,4.347417,4.145458,1.435583,63360000,200,25,0,0.528251,7,pass,4.347417;4.338417;4.487333;4.302209;4.475167;4.519666;4.080167
-grid,10000,39600,8,old_group_parallel_dag,8.291541,8.082208,7.571833,51480000,199,1,0,0.528251,7,pass,8.734208;8.870542;8.262292;8.272625;8.418083;7.921541;8.291541
-grid,10000,39600,8,pull64_barrier,4.480208,4.280041,1.391291,63360000,200,25,0,0.528251,7,pass,4.360291;4.329084;4.569167;4.219833;5.201625;4.875458;4.480208
-grid,10000,39600,8,pull64_interleaved,4.328209,4.166959,1.330291,63360000,200,25,0,0.528251,7,pass,4.562583;4.513084;4.328209;4.082875;4.086834;4.255666;4.698334
-grid,10000,39600,8,pull32_interleaved,4.287208,4.032167,1.367917,63360000,200,25,0,0.528251,7,pass,4.667750;4.214625;4.673917;4.141542;4.287208;4.964583;4.134417
-grid,10000,39600,8,pull32_gpu_dag,4.435666,4.109125,1.561792,63360000,200,27,0,0.528251,7,pass,4.435666;4.378209;4.491958;4.687208;4.528041;4.315750;4.168042
-grid,10000,39600,8,frontier32_vertex,5.906291,5.656709,2.501667,316800,200,25,0,0.528251,7,pass,5.856292;5.906291;5.931083;5.554916;5.907916;5.993083;5.641541
-grid,10000,39600,8,frontier32_simd,4.525792,4.257083,1.460875,316800,200,25,0,0.528251,7,pass,4.868125;4.279667;4.525792;4.542292;4.091500;4.727041;4.396708
-grid,10000,39600,8,frontier32_gpu_dag,4.150250,3.853458,1.370458,316800,200,27,0,0.528251,7,pass,4.059542;4.118750;4.193708;4.150250;4.252083;4.145625;4.603208
-grid,10000,39600,8,bucket32_d4,7.675750,7.433167,3.707208,316800,200,25,0,0.528251,7,pass,7.743958;7.661667;7.675750;7.370209;7.665250;7.730167;8.130750
-grid,10000,39600,8,bucket32_d16,7.595750,7.402000,3.678000,316800,200,25,0,0.528251,7,pass,7.406666;7.361167;7.621917;7.785791;7.595750;7.516958;8.536167
-grid,10000,39600,8,bucket32_d64,7.603292,7.390542,3.720709,316800,200,25,0,0.528251,7,pass,8.424708;7.603292;7.761958;7.373375;7.541583;7.803750;7.529333
-chain,2048,2047,1,old_pull_parallel_dag,30.065000,30.057834,4.364000,4192256,2048,256,0,0.129708,7,pass,29.512792;30.366375;30.389250;30.065000;30.101458;29.244334;29.885125
-chain,2048,2047,1,old_group_parallel_dag,4.847291,4.824625,4.695541,4192256,2048,1,0,0.129708,7,pass,4.847291;4.859959;4.876125;4.871750;4.808833;4.800125;4.805458
-chain,2048,2047,1,pull64_barrier,28.538917,28.531792,4.712458,4192256,2048,256,0,0.129708,7,pass,30.322167;30.520625;28.461958;28.538917;29.325958;28.512125;28.277875
-chain,2048,2047,1,pull64_interleaved,32.552250,32.545292,6.166164,4192256,2048,256,0,0.129708,7,pass,31.818375;32.998209;35.086208;32.552250;32.620042;31.513041;31.235625
-chain,2048,2047,1,pull32_interleaved,33.313166,33.304166,7.667876,4192256,2048,256,0,0.129708,7,pass,33.313166;43.665625;39.094500;38.145541;32.806958;31.240000;30.591459
-chain,2048,2047,1,pull32_gpu_dag,30.618833,30.342208,4.890750,4192256,2048,258,0,0.129708,7,pass,30.596375;30.812083;30.605458;30.618833;30.346917;30.645541;30.759833
-chain,2048,2047,1,frontier32_vertex,37.678875,37.671167,12.262455,2047,2048,256,0,0.129708,7,pass,36.267542;36.667167;36.211541;37.678875;39.911292;40.296834;39.982541
-chain,2048,2047,1,frontier32_simd,41.049750,41.041042,15.763669,2047,2048,256,0,0.129708,7,pass,39.360750;39.254583;73.469250;74.576250;64.359834;41.049750;36.961291
-chain,2048,2047,1,frontier32_gpu_dag,40.147666,39.758041,13.087249,2047,2048,258,0,0.129708,7,pass,40.656333;40.270834;39.919000;39.728292;41.459084;39.793791;40.147666
-chain,2048,2047,1,bucket32_d4,49.000625,48.994042,21.207666,2047,2056,257,0,0.129708,7,pass,49.068292;48.685000;49.196583;48.832041;49.202708;49.000625;48.010625
-chain,2048,2047,1,bucket32_d16,48.754500,48.747084,21.148585,2047,2056,257,0,0.129708,7,pass,49.436750;48.830625;48.754500;49.006875;47.837792;48.425667;48.685791
-chain,2048,2047,1,bucket32_d64,48.401417,48.394833,21.022250,2047,2056,257,0,0.129708,7,pass,49.229041;48.401417;45.143750;46.486666;48.204875;49.047709;48.606625
-hub,4096,12286,64,old_pull_parallel_dag,32.651875,32.266000,30.924958,31452160,40,5,0,0.293750,7,pass,32.054959;32.157959;31.730416;32.897583;32.651875;32.842042;32.749083
-hub,4096,12286,64,old_group_parallel_dag,26.146583,25.760750,25.031750,27176632,38,1,0,0.293750,7,pass,26.043708;26.014500;26.409292;26.222333;26.138041;26.146583;26.241000
-hub,4096,12286,64,pull64_barrier,25.409625,25.028833,23.755584,31452160,40,5,0,0.293750,7,pass,25.125583;25.728459;25.886083;25.626667;25.204167;25.409625;25.196334
-hub,4096,12286,64,pull64_interleaved,33.829875,33.457333,31.908083,31452160,40,5,0,0.293750,7,pass,33.290584;34.397667;33.919000;34.763459;32.469500;33.829875;33.066583
-hub,4096,12286,64,pull32_interleaved,29.085375,28.621209,27.390333,31452160,40,5,0,0.293750,7,pass,28.808208;29.127459;28.627500;29.358417;29.398125;28.602458;29.085375
-hub,4096,12286,64,pull32_gpu_dag,31.331333,28.777667,29.382458,31452160,40,7,0,0.293750,7,pass,31.544208;31.235792;31.331333;31.250667;31.366500;31.655459;31.235541
-hub,4096,12286,64,frontier32_vertex,20.164250,19.779333,18.439125,1847854,40,5,0,0.293750,7,pass,20.370750;20.164250;20.339500;20.267708;20.128208;17.858625;20.054792
-hub,4096,12286,64,frontier32_simd,3.679709,3.293959,1.977208,1683322,40,5,0,0.293750,7,pass,3.645583;3.193958;3.704875;3.761667;3.484667;3.679709;3.840292
-hub,4096,12286,64,frontier32_gpu_dag,5.438458,3.358500,3.574666,1683332,40,7,0,0.293750,7,pass,5.438458;5.484333;5.077625;5.436834;5.303625;5.554375;5.500500
-hub,4096,12286,64,bucket32_d4,5.120292,4.739584,3.072042,788342,48,6,0,0.293750,7,pass,5.120292;4.625500;4.994666;5.342250;5.237375;5.632667;5.067500
-hub,4096,12286,64,bucket32_d16,4.910875,4.544250,3.014125,1124798,48,6,0,0.293750,7,pass,4.009541;5.038875;5.070750;4.861667;4.542542;4.910875;4.955625
-hub,4096,12286,64,bucket32_d64,4.974250,4.580000,3.350917,1929942,40,5,0,0.293750,7,pass,5.005417;5.049500;4.529125;4.683875;5.371250;4.974250;4.864500
-random,4096,131072,1,old_pull_parallel_dag,0.700083,0.520875,0.268583,2097152,16,2,0,1.684833,7,pass,0.731166;0.711875;0.720916;0.700083;0.684917;0.682334;0.675125
-random,4096,131072,1,old_group_parallel_dag,2.531042,2.326500,2.178083,1572864,12,1,0,1.684833,7,pass,2.523791;2.531042;2.708208;2.518583;2.480875;2.536250;2.532084
-random,4096,131072,1,pull64_barrier,0.670083,0.484084,0.243542,2097152,16,2,0,1.684833,7,pass,0.658292;0.670083;0.670417;0.656458;0.705666;0.666084;0.683333
-random,4096,131072,1,pull64_interleaved,0.708375,0.538000,0.266292,2097152,16,2,0,1.684833,7,pass,0.754209;0.708375;0.727000;0.718875;0.667125;0.700375;0.688541
-random,4096,131072,1,pull32_interleaved,0.602708,0.417917,0.179833,2097152,16,2,0,1.684833,7,pass,0.621042;0.626125;0.591833;0.563875;0.568041;0.602708;0.610584
-random,4096,131072,1,pull32_gpu_dag,0.827708,0.458416,0.236792,2097152,16,4,0,1.684833,7,pass,0.828209;0.781000;0.802875;0.827708;0.820042;0.839417;0.889042
-random,4096,131072,1,frontier32_vertex,0.826666,0.637916,0.358083,421728,16,2,0,1.684833,7,pass,0.752500;0.788541;0.826666;0.793041;0.834708;0.845292;0.849417
-random,4096,131072,1,frontier32_simd,0.546833,0.381416,0.130042,385248,16,2,0,1.684833,7,pass,0.606166;0.614833;0.596666;0.532584;0.506333;0.517209;0.546833
-random,4096,131072,1,frontier32_gpu_dag,0.790125,0.403958,0.187833,385888,16,4,0,1.684833,7,pass,0.839625;0.868666;0.790125;0.731833;0.751625;0.765125;0.799542
-random,4096,131072,1,bucket32_d4,0.877584,0.692667,0.278500,138720,24,3,0,1.684833,7,pass,0.796125;0.814708;0.794500;0.887917;0.897584;0.887250;0.877584
-random,4096,131072,1,bucket32_d16,0.602042,0.418417,0.176083,177024,16,2,0,1.684833,7,pass,0.609792;0.595458;0.627042;0.687000;0.588708;0.600541;0.602042
-random,4096,131072,1,bucket32_d64,0.676292,0.489459,0.213125,379328,16,2,0,1.684833,7,pass,0.630916;0.676292;0.686500;0.650000;0.656292;0.682083;0.803250
-random,4096,131072,64,old_pull_parallel_dag,9.210958,7.184000,6.254250,134217728,16,2,0,1.632958,7,pass,9.210958;8.705500;9.369750;9.924625;9.088334;9.114250;9.439791
-random,4096,131072,64,old_group_parallel_dag,6.357125,3.995125,3.300500,105644032,15,1,0,1.632958,7,pass,5.947458;6.071417;8.561834;7.417583;5.757250;6.357125;6.392709
-random,4096,131072,64,pull64_barrier,11.065500,9.020000,8.131667,134217728,16,2,0,1.632958,7,pass,11.302500;11.148667;11.423375;10.809625;11.065500;10.187500;9.389333
-random,4096,131072,64,pull64_interleaved,4.038875,1.980792,1.106083,134217728,16,2,0,1.632958,7,pass,4.038875;3.599083;4.111542;4.356333;3.584625;3.627292;4.185792
-random,4096,131072,64,pull32_interleaved,3.814209,1.788000,1.030583,134217728,16,2,0,1.632958,7,pass,3.794375;3.316542;3.413625;3.836125;4.096958;4.530583;3.814209
-random,4096,131072,64,pull32_gpu_dag,2.051166,1.481834,0.860875,134217728,16,4,0,1.632958,7,pass,5.183500;1.808125;2.051166;1.508042;2.034416;2.400834;4.045375
-random,4096,131072,64,frontier32_vertex,5.418375,3.314583,2.452125,22442464,16,2,0,1.632958,7,pass,13.355792;5.418375;5.113042;5.392083;5.442250;5.494958;5.207167
-random,4096,131072,64,frontier32_simd,5.078208,2.991333,1.970125,22729248,16,2,0,1.632958,7,pass,4.876333;5.078208;5.086084;5.029666;4.357167;11.632250;5.217792
-random,4096,131072,64,frontier32_gpu_dag,4.086083,2.827833,2.683125,22826080,16,4,0,1.632958,7,pass,4.039375;4.086083;4.209583;4.054667;4.363042;4.104958;3.480333
-random,4096,131072,64,bucket32_d4,4.731500,2.704083,1.614958,8805184,24,3,0,1.632958,7,pass,4.731500;9.958708;4.957541;4.429834;4.167167;4.010625;8.756250
-random,4096,131072,64,bucket32_d16,4.925625,2.956292,1.858750,12113536,24,3,0,1.632958,7,pass,6.896625;5.068917;4.772583;4.428167;4.925625;4.905334;11.198667
-random,4096,131072,64,bucket32_d64,5.329667,3.309542,2.396333,23278880,16,2,0,1.632958,7,pass,5.089042;5.574291;4.751666;5.494875;5.421709;5.329667;5.243667
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/summary.json b/dev/research/metal_pathfinding/optimization/results/aba/summary.json
deleted file mode 100644
index b8bc023..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/summary.json
+++ /dev/null
@@ -1,570 +0,0 @@
-{
-  "phase_rows": {
-    "cpu-a1": 48,
-    "base-a1": 36,
-    "optimized-b": 216,
-    "base-a2": 36,
-    "cpu-a2": 48
-  },
-  "checked_query_results": 124704,
-  "summary": [
-    {
-      "case": [
-        "random",
-        "1024",
-        "8192",
-        "1"
-      ],
-      "cpu_a1": 0.085792,
-      "cpu_a2": 0.096875,
-      "old_method": "old_group_serial",
-      "old_a1": 0.914792,
-      "old_a2": 0.971833,
-      "best": {
-        "case": "random",
-        "n": "1024",
-        "e": "8192",
-        "queries": "1",
-        "method": "pull32_interleaved",
-        "wall_ms": "0.599333",
-        "distance_ms": "0.586041",
-        "gpu_ms": "0.337667",
-        "edge_visits": "131072",
-        "rounds": "16",
-        "waits": "2",
-        "fallback64": "0",
-        "upload_ms": "0.152791",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.667083;0.607875;0.599333;0.571542;0.736667;0.583833;0.566542"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "1024",
-        "8192",
-        "64"
-      ],
-      "cpu_a1": 1.247667,
-      "cpu_a2": 1.340459,
-      "old_method": "old_group_serial",
-      "old_a1": 3.817917,
-      "old_a2": 3.768791,
-      "best": {
-        "case": "random",
-        "n": "1024",
-        "e": "8192",
-        "queries": "64",
-        "method": "old_group_parallel_dag",
-        "wall_ms": "0.852750",
-        "distance_ms": "0.566166",
-        "gpu_ms": "0.379500",
-        "edge_visits": "7217152",
-        "rounds": "17",
-        "waits": "1",
-        "fallback64": "0",
-        "upload_ms": "0.238875",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.972542;0.909042;0.773791;0.876500;0.773208;0.852750;0.821167"
-      }
-    },
-    {
-      "case": [
-        "clos",
-        "200",
-        "20000",
-        "64"
-      ],
-      "cpu_a1": 1.072125,
-      "cpu_a2": 1.075958,
-      "old_method": "old_group_serial",
-      "old_a1": 4.768459,
-      "old_a2": 4.869958,
-      "best": {
-        "case": "clos",
-        "n": "200",
-        "e": "20000",
-        "queries": "64",
-        "method": "old_group_parallel_dag",
-        "wall_ms": "1.460750",
-        "distance_ms": "0.833416",
-        "gpu_ms": "0.303250",
-        "edge_visits": "3840000",
-        "rounds": "3",
-        "waits": "1",
-        "fallback64": "0",
-        "upload_ms": "0.322125",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "1.479875;1.528583;1.339875;1.338875;1.467208;1.426625;1.460750"
-      }
-    },
-    {
-      "case": [
-        "grid",
-        "1024",
-        "3968",
-        "1"
-      ],
-      "cpu_a1": 0.039042,
-      "cpu_a2": 0.038708,
-      "old_method": "old_group_serial",
-      "old_a1": 1.177083,
-      "old_a2": 1.165667,
-      "best": {
-        "case": "grid",
-        "n": "1024",
-        "e": "3968",
-        "queries": "1",
-        "method": "old_group_parallel_dag",
-        "wall_ms": "0.365667",
-        "distance_ms": "0.358792",
-        "gpu_ms": "0.227375",
-        "edge_visits": "249984",
-        "rounds": "63",
-        "waits": "1",
-        "fallback64": "0",
-        "upload_ms": "0.124084",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "1.116750;0.360041;0.365667;0.352625;0.396042;0.372000;0.363209"
-      }
-    },
-    {
-      "case": [
-        "hub",
-        "1024",
-        "3070",
-        "1"
-      ],
-      "cpu_a1": 0.052333,
-      "cpu_a2": 0.052,
-      "old_method": "old_group_serial",
-      "old_a1": 4.908083,
-      "old_a2": 4.938125,
-      "best": {
-        "case": "hub",
-        "n": "1024",
-        "e": "3070",
-        "queries": "1",
-        "method": "frontier32_simd",
-        "wall_ms": "0.784458",
-        "distance_ms": "0.776500",
-        "gpu_ms": "0.233250",
-        "edge_visits": "3128",
-        "rounds": "32",
-        "waits": "4",
-        "fallback64": "0",
-        "upload_ms": "0.098834",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.761209;0.730042;0.781167;0.861667;0.786834;0.795166;0.784458"
-      }
-    },
-    {
-      "case": [
-        "random_masked_int64_reverse",
-        "1024",
-        "8192",
-        "8"
-      ],
-      "cpu_a1": 0.160083,
-      "cpu_a2": 0.15325,
-      "old_method": "old_pull_serial",
-      "old_a1": 0.517667,
-      "old_a2": 0.55125,
-      "best": {
-        "case": "random_masked_int64_reverse",
-        "n": "1024",
-        "e": "8192",
-        "queries": "8",
-        "method": "bucket32_d16",
-        "wall_ms": "0.223542",
-        "distance_ms": "0.178000",
-        "gpu_ms": "0.028875",
-        "edge_visits": "524288",
-        "rounds": "8",
-        "waits": "1",
-        "fallback64": "1",
-        "upload_ms": "0.225500",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.222750;0.232791;0.237375;0.258250;0.223542;0.215333;0.210875"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "4096",
-        "32768",
-        "256"
-      ],
-      "cpu_a1": 21.390792,
-      "cpu_a2": 21.281458,
-      "old_method": "old_group_serial",
-      "old_a1": 47.811583,
-      "old_a2": 49.310208,
-      "best": {
-        "case": "random",
-        "n": "4096",
-        "e": "32768",
-        "queries": "256",
-        "method": "pull64_interleaved",
-        "wall_ms": "7.002542",
-        "distance_ms": "3.340208",
-        "gpu_ms": "2.080917",
-        "edge_visits": "201326592",
-        "rounds": "24",
-        "waits": "3",
-        "fallback64": "0",
-        "upload_ms": "0.530167",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "6.459833;7.002542;6.970958;6.819791;8.010875;7.685500;7.589250"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "16384",
-        "131072",
-        "1"
-      ],
-      "cpu_a1": 3.661958,
-      "cpu_a2": 3.885666,
-      "old_method": "old_pull_serial",
-      "old_a1": 2.098167,
-      "old_a2": 1.870458,
-      "best": {
-        "case": "random",
-        "n": "16384",
-        "e": "131072",
-        "queries": "1",
-        "method": "pull32_interleaved",
-        "wall_ms": "0.705083",
-        "distance_ms": "0.520875",
-        "gpu_ms": "0.136959",
-        "edge_visits": "3145728",
-        "rounds": "24",
-        "waits": "3",
-        "fallback64": "0",
-        "upload_ms": "1.641291",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.692583;0.711333;0.700666;0.706750;0.705083;0.703000;0.878958"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "16384",
-        "131072",
-        "64"
-      ],
-      "cpu_a1": 27.692792,
-      "cpu_a2": 27.721375,
-      "old_method": "old_group_serial",
-      "old_a1": 57.747584,
-      "old_a2": 53.10575,
-      "best": {
-        "case": "random",
-        "n": "16384",
-        "e": "131072",
-        "queries": "64",
-        "method": "pull64_interleaved",
-        "wall_ms": "7.473334",
-        "distance_ms": "3.322042",
-        "gpu_ms": "1.949625",
-        "edge_visits": "201326592",
-        "rounds": "24",
-        "waits": "3",
-        "fallback64": "0",
-        "upload_ms": "1.869208",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "7.977375;7.469666;7.993750;7.469959;7.340416;8.069541;7.473334"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "65536",
-        "524288",
-        "1"
-      ],
-      "cpu_a1": 19.316,
-      "cpu_a2": 19.240125,
-      "old_method": "old_pull_serial",
-      "old_a1": 5.18425,
-      "old_a2": 5.85375,
-      "best": {
-        "case": "random",
-        "n": "65536",
-        "e": "524288",
-        "queries": "1",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "1.373417",
-        "distance_ms": "0.881667",
-        "gpu_ms": "0.570875",
-        "edge_visits": "12582912",
-        "rounds": "24",
-        "waits": "5",
-        "fallback64": "0",
-        "upload_ms": "7.557667",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "1.391584;1.373417;1.479292;1.291209;1.337833;1.320958;1.406750"
-      }
-    },
-    {
-      "case": [
-        "clos",
-        "800",
-        "320000",
-        "1"
-      ],
-      "cpu_a1": 2.177875,
-      "cpu_a2": 2.226791,
-      "old_method": "old_pull_serial",
-      "old_a1": 1.914708,
-      "old_a2": 2.377209,
-      "best": {
-        "case": "clos",
-        "n": "800",
-        "e": "320000",
-        "queries": "1",
-        "method": "frontier32_simd",
-        "wall_ms": "1.604458",
-        "distance_ms": "0.852083",
-        "gpu_ms": "0.361417",
-        "edge_visits": "320000",
-        "rounds": "8",
-        "waits": "1",
-        "fallback64": "0",
-        "upload_ms": "3.583584",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "1.724958;1.809125;1.589542;1.604458;1.514125;1.668583;1.587916"
-      }
-    },
-    {
-      "case": [
-        "clos",
-        "800",
-        "320000",
-        "64"
-      ],
-      "cpu_a1": 17.041958,
-      "cpu_a2": 16.524625,
-      "old_method": "old_group_serial",
-      "old_a1": 69.896166,
-      "old_a2": 70.2275,
-      "best": {
-        "case": "clos",
-        "n": "800",
-        "e": "320000",
-        "queries": "64",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "8.185208",
-        "distance_ms": "4.307834",
-        "gpu_ms": "6.163833",
-        "edge_visits": "163840000",
-        "rounds": "8",
-        "waits": "3",
-        "fallback64": "0",
-        "upload_ms": "3.568791",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "7.631709;7.941417;8.661667;8.185208;8.311625;8.223667;7.750583"
-      }
-    },
-    {
-      "case": [
-        "grid",
-        "10000",
-        "39600",
-        "1"
-      ],
-      "cpu_a1": 0.570333,
-      "cpu_a2": 0.58225,
-      "old_method": "old_pull_serial",
-      "old_a1": 3.836417,
-      "old_a2": 5.873791,
-      "best": {
-        "case": "grid",
-        "n": "10000",
-        "e": "39600",
-        "queries": "1",
-        "method": "pull32_interleaved",
-        "wall_ms": "3.378208",
-        "distance_ms": "3.313666",
-        "gpu_ms": "0.604292",
-        "edge_visits": "7920000",
-        "rounds": "200",
-        "waits": "25",
-        "fallback64": "0",
-        "upload_ms": "0.518084",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "3.861917;4.153500;3.086834;3.378208;3.201917;3.100208;3.562041"
-      }
-    },
-    {
-      "case": [
-        "grid",
-        "10000",
-        "39600",
-        "8"
-      ],
-      "cpu_a1": 0.834084,
-      "cpu_a2": 0.822667,
-      "old_method": "old_pull_serial",
-      "old_a1": 5.952708,
-      "old_a2": 5.979167,
-      "best": {
-        "case": "grid",
-        "n": "10000",
-        "e": "39600",
-        "queries": "8",
-        "method": "frontier32_gpu_dag",
-        "wall_ms": "4.150250",
-        "distance_ms": "3.853458",
-        "gpu_ms": "1.370458",
-        "edge_visits": "316800",
-        "rounds": "200",
-        "waits": "27",
-        "fallback64": "0",
-        "upload_ms": "0.528251",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "4.059542;4.118750;4.193708;4.150250;4.252083;4.145625;4.603208"
-      }
-    },
-    {
-      "case": [
-        "chain",
-        "2048",
-        "2047",
-        "1"
-      ],
-      "cpu_a1": 0.017209,
-      "cpu_a2": 0.017375,
-      "old_method": "old_group_serial",
-      "old_a1": 4.834291,
-      "old_a2": 4.908333,
-      "best": {
-        "case": "chain",
-        "n": "2048",
-        "e": "2047",
-        "queries": "1",
-        "method": "old_group_parallel_dag",
-        "wall_ms": "4.847291",
-        "distance_ms": "4.824625",
-        "gpu_ms": "4.695541",
-        "edge_visits": "4192256",
-        "rounds": "2048",
-        "waits": "1",
-        "fallback64": "0",
-        "upload_ms": "0.129708",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "4.847291;4.859959;4.876125;4.871750;4.808833;4.800125;4.805458"
-      }
-    },
-    {
-      "case": [
-        "hub",
-        "4096",
-        "12286",
-        "64"
-      ],
-      "cpu_a1": 2.437875,
-      "cpu_a2": 2.338125,
-      "old_method": "old_group_serial",
-      "old_a1": 28.558708,
-      "old_a2": 28.801291,
-      "best": {
-        "case": "hub",
-        "n": "4096",
-        "e": "12286",
-        "queries": "64",
-        "method": "frontier32_simd",
-        "wall_ms": "3.679709",
-        "distance_ms": "3.293959",
-        "gpu_ms": "1.977208",
-        "edge_visits": "1683322",
-        "rounds": "40",
-        "waits": "5",
-        "fallback64": "0",
-        "upload_ms": "0.293750",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "3.645583;3.193958;3.704875;3.761667;3.484667;3.679709;3.840292"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "4096",
-        "131072",
-        "1"
-      ],
-      "cpu_a1": 1.589583,
-      "cpu_a2": 1.517583,
-      "old_method": "old_pull_serial",
-      "old_a1": 0.90625,
-      "old_a2": 1.039917,
-      "best": {
-        "case": "random",
-        "n": "4096",
-        "e": "131072",
-        "queries": "1",
-        "method": "frontier32_simd",
-        "wall_ms": "0.546833",
-        "distance_ms": "0.381416",
-        "gpu_ms": "0.130042",
-        "edge_visits": "385248",
-        "rounds": "16",
-        "waits": "2",
-        "fallback64": "0",
-        "upload_ms": "1.684833",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.606166;0.614833;0.596666;0.532584;0.506333;0.517209;0.546833"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "4096",
-        "131072",
-        "64"
-      ],
-      "cpu_a1": 12.301875,
-      "cpu_a2": 12.817167,
-      "old_method": "old_group_serial",
-      "old_a1": 31.930417,
-      "old_a2": 37.791458,
-      "best": {
-        "case": "random",
-        "n": "4096",
-        "e": "131072",
-        "queries": "64",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "2.051166",
-        "distance_ms": "1.481834",
-        "gpu_ms": "0.860875",
-        "edge_visits": "134217728",
-        "rounds": "16",
-        "waits": "4",
-        "fallback64": "0",
-        "upload_ms": "1.632958",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "5.183500;1.808125;2.051166;1.508042;2.034416;2.400834;4.045375"
-      }
-    }
-  ]
-}
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/summary.md b/dev/research/metal_pathfinding/optimization/results/aba/summary.md
deleted file mode 100644
index 8f1d0b6..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/summary.md
+++ /dev/null
@@ -1,317 +0,0 @@
-# Exploratory A/B/A measurements
-
-Warm full-result latency in ms, including host distances and positive-cost predecessor DAG. Seven measured samples plus two checked warmups per row. CPU batches use 10 reusable workers. Best variant is selected after measurement; this is an oracle comparison, not an implemented dispatcher. Old GPU columns cover the original pull and group variants; the shared-memory variant was not rerun. The machine was not isolated; these are not accepted performance claims.
-
-| Case | N / E / Q | CPU full A1 / A2 | Old GPU A1 / A2 | Best tested optimized GPU | ms | CPU BFS full A1 / A2 |
-|---|---:|---:|---:|---|---:|---:|
-| random | 1024 / 8192 / 1 | 0.086 / 0.097 | 0.915 / 0.972 | pull32_interleaved | 0.599 | — |
-| random | 1024 / 8192 / 64 | 1.248 / 1.340 | 3.818 / 3.769 | old_group_parallel_dag | 0.853 | — |
-| clos | 200 / 20000 / 64 | 1.072 / 1.076 | 4.768 / 4.870 | old_group_parallel_dag | 1.461 | 0.669 / 0.633 |
-| grid | 1024 / 3968 / 1 | 0.039 / 0.039 | 1.177 / 1.166 | old_group_parallel_dag | 0.366 | 0.009 / 0.009 |
-| hub | 1024 / 3070 / 1 | 0.052 / 0.052 | 4.908 / 4.938 | frontier32_simd | 0.784 | — |
-| random_masked_int64_reverse | 1024 / 8192 / 8 | 0.160 / 0.153 | 0.518 / 0.551 | bucket32_d16 (64-bit pull fallback) | 0.224 | — |
-| random | 4096 / 32768 / 256 | 21.391 / 21.281 | 47.812 / 49.310 | pull64_interleaved | 7.003 | — |
-| random | 16384 / 131072 / 1 | 3.662 / 3.886 | 2.098 / 1.870 | pull32_interleaved | 0.705 | — |
-| random | 16384 / 131072 / 64 | 27.693 / 27.721 | 57.748 / 53.106 | pull64_interleaved | 7.473 | — |
-| random | 65536 / 524288 / 1 | 19.316 / 19.240 | 5.184 / 5.854 | pull32_gpu_dag | 1.373 | — |
-| clos | 800 / 320000 / 1 | 2.178 / 2.227 | 1.915 / 2.377 | frontier32_simd | 1.604 | 0.908 / 0.938 |
-| clos | 800 / 320000 / 64 | 17.042 / 16.525 | 69.896 / 70.228 | pull32_gpu_dag | 8.185 | 8.296 / 7.885 |
-| grid | 10000 / 39600 / 1 | 0.570 / 0.582 | 3.836 / 5.874 | pull32_interleaved | 3.378 | 0.089 / 0.088 |
-| grid | 10000 / 39600 / 8 | 0.834 / 0.823 | 5.953 / 5.979 | frontier32_gpu_dag | 4.150 | 0.286 / 0.312 |
-| chain | 2048 / 2047 / 1 | 0.017 / 0.017 | 4.834 / 4.908 | old_group_parallel_dag | 4.847 | — |
-| hub | 4096 / 12286 / 64 | 2.438 / 2.338 | 28.559 / 28.801 | frontier32_simd | 3.680 | — |
-| random | 4096 / 131072 / 1 | 1.590 / 1.518 | 0.906 / 1.040 | frontier32_simd | 0.547 | — |
-| random | 4096 / 131072 / 64 | 12.302 / 12.817 | 31.930 / 37.791 | pull32_gpu_dag | 2.051 | — |
-
-## All optimized variants
-
-No variants omitted. Columns: full wall / distance wall / device work, ms. Device work includes DAG kernels where selected. Edge visits count SSSP adjacency entries, excluding bucket vertex scans, queue management and DAG extraction.
-
-### ('random', '1024', '8192', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 1.423 / 1.376 / 0.424 | 131072 | 16 | 2 | 0 |
-| old_group_parallel_dag | 0.834 / 0.819 / 0.680 | 106496 | 13 | 1 | 0 |
-| pull64_barrier | 0.659 / 0.646 / 0.391 | 131072 | 16 | 2 | 0 |
-| pull64_interleaved | 0.656 / 0.643 / 0.375 | 131072 | 16 | 2 | 0 |
-| pull32_interleaved | 0.599 / 0.586 / 0.338 | 131072 | 16 | 2 | 0 |
-| pull32_gpu_dag | 0.960 / 0.604 / 0.406 | 131072 | 16 | 4 | 0 |
-| frontier32_vertex | 0.924 / 0.910 / 0.634 | 21088 | 16 | 2 | 0 |
-| frontier32_simd | 0.661 / 0.647 / 0.380 | 20272 | 16 | 2 | 0 |
-| frontier32_gpu_dag | 1.003 / 0.652 / 0.452 | 20384 | 16 | 4 | 0 |
-| bucket32_d4 | 1.895 / 1.881 / 1.276 | 8232 | 32 | 4 | 0 |
-| bucket32_d16 | 1.422 / 1.407 / 0.920 | 9336 | 24 | 3 | 0 |
-| bucket32_d64 | 0.954 / 0.939 / 0.654 | 19264 | 16 | 2 | 0 |
-### ('random', '1024', '8192', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 1.973 / 1.703 / 1.236 | 12582912 | 24 | 3 | 0 |
-| old_group_parallel_dag | 0.853 / 0.566 / 0.380 | 7217152 | 17 | 1 | 0 |
-| pull64_barrier | 1.223 / 0.949 / 0.470 | 12582912 | 24 | 3 | 0 |
-| pull64_interleaved | 0.940 / 0.671 / 0.268 | 12582912 | 24 | 3 | 0 |
-| pull32_interleaved | 0.863 / 0.595 / 0.197 | 12582912 | 24 | 3 | 0 |
-| pull32_gpu_dag | 0.998 / 0.579 / 0.199 | 12582912 | 24 | 5 | 0 |
-| frontier32_vertex | 0.870 / 0.629 / 0.239 | 1289824 | 16 | 2 | 0 |
-| frontier32_simd | 1.028 / 0.796 / 0.456 | 1202328 | 16 | 2 | 0 |
-| frontier32_gpu_dag | 1.197 / 0.890 / 0.509 | 1201208 | 16 | 4 | 0 |
-| bucket32_d4 | 5.929 / 5.638 / 4.211 | 528528 | 56 | 7 | 0 |
-| bucket32_d16 | 1.624 / 1.347 / 0.712 | 601456 | 32 | 4 | 0 |
-| bucket32_d64 | 1.403 / 1.126 / 0.671 | 1154720 | 24 | 3 | 0 |
-### ('clos', '200', '20000', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 2.137 / 1.514 / 1.016 | 10240000 | 8 | 1 | 0 |
-| old_group_parallel_dag | 1.461 / 0.833 / 0.303 | 3840000 | 3 | 1 | 0 |
-| pull64_barrier | 2.072 / 1.524 / 1.000 | 10240000 | 8 | 1 | 0 |
-| pull64_interleaved | 1.903 / 1.332 / 0.757 | 10240000 | 8 | 1 | 0 |
-| pull32_interleaved | 1.893 / 1.311 / 0.688 | 10240000 | 8 | 1 | 0 |
-| pull32_gpu_dag | 2.092 / 1.226 / 1.013 | 10240000 | 8 | 3 | 0 |
-| frontier32_vertex | 2.382 / 1.557 / 0.961 | 1280000 | 8 | 1 | 0 |
-| frontier32_simd | 1.552 / 0.924 / 0.318 | 1280000 | 8 | 1 | 0 |
-| frontier32_gpu_dag | 1.979 / 0.982 / 0.837 | 1280000 | 8 | 3 | 0 |
-| bucket32_d4 | 1.572 / 1.025 / 0.481 | 1280000 | 8 | 1 | 0 |
-| bucket32_d16 | 1.739 / 1.166 / 0.492 | 1280000 | 8 | 1 | 0 |
-| bucket32_d64 | 1.693 / 1.072 / 0.490 | 1280000 | 8 | 1 | 0 |
-### ('grid', '1024', '3968', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 1.747 / 1.739 / 0.651 | 253952 | 64 | 8 | 0 |
-| old_group_parallel_dag | 0.366 / 0.359 / 0.227 | 249984 | 63 | 1 | 0 |
-| pull64_barrier | 1.119 / 1.111 / 0.177 | 253952 | 64 | 8 | 0 |
-| pull64_interleaved | 1.144 / 1.136 / 0.177 | 253952 | 64 | 8 | 0 |
-| pull32_interleaved | 1.089 / 1.081 / 0.164 | 253952 | 64 | 8 | 0 |
-| pull32_gpu_dag | 1.271 / 0.918 / 0.173 | 253952 | 64 | 10 | 0 |
-| frontier32_vertex | 1.313 / 1.305 / 0.528 | 3968 | 64 | 8 | 0 |
-| frontier32_simd | 1.180 / 1.172 / 0.396 | 3968 | 64 | 8 | 0 |
-| frontier32_gpu_dag | 1.394 / 1.178 / 0.407 | 3968 | 64 | 10 | 0 |
-| bucket32_d4 | 1.450 / 1.441 / 0.637 | 3968 | 64 | 8 | 0 |
-| bucket32_d16 | 1.451 / 1.443 / 0.636 | 3968 | 64 | 8 | 0 |
-| bucket32_d64 | 1.466 / 1.459 / 0.637 | 3968 | 64 | 8 | 0 |
-### ('hub', '1024', '3070', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 6.046 / 6.030 / 5.544 | 98240 | 32 | 4 | 0 |
-| old_group_parallel_dag | 4.888 / 4.866 / 4.721 | 95170 | 31 | 1 | 0 |
-| pull64_barrier | 5.016 / 4.988 / 4.313 | 98240 | 32 | 4 | 0 |
-| pull64_interleaved | 4.986 / 4.962 / 4.321 | 98240 | 32 | 4 | 0 |
-| pull32_interleaved | 4.397 / 4.374 / 3.684 | 98240 | 32 | 4 | 0 |
-| pull32_gpu_dag | 5.116 / 4.358 / 4.101 | 98240 | 32 | 6 | 0 |
-| frontier32_vertex | 1.436 / 1.428 / 0.852 | 3128 | 32 | 4 | 0 |
-| frontier32_simd | 0.784 / 0.776 / 0.233 | 3128 | 32 | 4 | 0 |
-| frontier32_gpu_dag | 1.467 / 0.770 / 0.649 | 3128 | 32 | 6 | 0 |
-| bucket32_d4 | 0.869 / 0.860 / 0.345 | 3100 | 32 | 4 | 0 |
-| bucket32_d16 | 0.851 / 0.843 / 0.337 | 3124 | 32 | 4 | 0 |
-| bucket32_d64 | 0.886 / 0.878 / 0.327 | 3128 | 32 | 4 | 0 |
-### ('random_masked_int64_reverse', '1024', '8192', '8')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 0.232 / 0.167 / 0.032 | 524288 | 8 | 1 | 0 |
-| old_group_parallel_dag | 0.253 / 0.194 / 0.053 | 368640 | 8 | 1 | 0 |
-| pull64_barrier | 0.248 / 0.190 / 0.029 | 524288 | 8 | 1 | 0 |
-| pull64_interleaved | 0.264 / 0.197 / 0.029 | 524288 | 8 | 1 | 0 |
-| pull32_interleaved | 0.252 / 0.198 / 0.029 | 524288 | 8 | 1 | 1 |
-| pull32_gpu_dag | 0.499 / 0.174 / 0.049 | 524288 | 8 | 3 | 1 |
-| frontier32_vertex | 0.238 / 0.188 / 0.029 | 524288 | 8 | 1 | 1 |
-| frontier32_simd | 0.256 / 0.192 / 0.029 | 524288 | 8 | 1 | 1 |
-| frontier32_gpu_dag | 0.504 / 0.184 / 0.047 | 524288 | 8 | 3 | 1 |
-| bucket32_d4 | 0.243 / 0.198 / 0.029 | 524288 | 8 | 1 | 1 |
-| bucket32_d16 | 0.224 / 0.178 / 0.029 | 524288 | 8 | 1 | 1 |
-| bucket32_d64 | 0.261 / 0.199 / 0.029 | 524288 | 8 | 1 | 1 |
-### ('random', '4096', '32768', '256')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 14.955 / 11.144 / 9.933 | 201326592 | 24 | 3 | 0 |
-| old_group_parallel_dag | 11.270 / 7.608 / 6.915 | 136544256 | 20 | 1 | 0 |
-| pull64_barrier | 13.565 / 9.762 / 8.501 | 201326592 | 24 | 3 | 0 |
-| pull64_interleaved | 7.003 / 3.340 / 2.081 | 201326592 | 24 | 3 | 0 |
-| pull32_interleaved | 9.000 / 5.200 / 3.525 | 201326592 | 24 | 3 | 0 |
-| pull32_gpu_dag | 8.790 / 6.950 / 7.134 | 201326592 | 24 | 5 | 0 |
-| frontier32_vertex | 7.936 / 4.094 / 2.380 | 19766184 | 24 | 3 | 0 |
-| frontier32_simd | 11.324 / 7.659 / 6.414 | 20599968 | 24 | 3 | 0 |
-| frontier32_gpu_dag | 9.247 / 7.874 / 7.025 | 20610776 | 24 | 5 | 0 |
-| bucket32_d4 | 16.328 / 12.614 / 10.131 | 8454072 | 72 | 9 | 0 |
-| bucket32_d16 | 13.121 / 9.301 / 7.673 | 9728592 | 48 | 6 | 0 |
-| bucket32_d64 | 14.196 / 9.623 / 8.264 | 18345256 | 24 | 3 | 0 |
-### ('random', '16384', '131072', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 0.964 / 0.659 / 0.244 | 3145728 | 24 | 3 | 0 |
-| old_group_parallel_dag | 5.290 / 4.968 / 4.819 | 2359296 | 18 | 1 | 0 |
-| pull64_barrier | 0.761 / 0.571 / 0.164 | 3145728 | 24 | 3 | 0 |
-| pull64_interleaved | 0.828 / 0.564 / 0.164 | 3145728 | 24 | 3 | 0 |
-| pull32_interleaved | 0.705 / 0.521 / 0.137 | 3145728 | 24 | 3 | 0 |
-| pull32_gpu_dag | 0.880 / 0.513 / 0.158 | 3145728 | 24 | 5 | 0 |
-| frontier32_vertex | 0.832 / 0.619 / 0.258 | 377056 | 24 | 3 | 0 |
-| frontier32_simd | 0.806 / 0.593 / 0.237 | 335680 | 24 | 3 | 0 |
-| frontier32_gpu_dag | 0.983 / 0.612 / 0.269 | 334824 | 24 | 5 | 0 |
-| bucket32_d4 | 1.833 / 1.546 / 0.654 | 132016 | 56 | 7 | 0 |
-| bucket32_d16 | 1.148 / 0.917 / 0.398 | 148256 | 32 | 4 | 0 |
-| bucket32_d64 | 0.937 / 0.712 / 0.340 | 268728 | 24 | 3 | 0 |
-### ('random', '16384', '131072', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 16.913 / 12.651 / 11.412 | 201326592 | 24 | 3 | 0 |
-| old_group_parallel_dag | 13.239 / 9.052 / 8.276 | 158203904 | 22 | 1 | 0 |
-| pull64_barrier | 15.959 / 11.386 / 10.305 | 201326592 | 24 | 3 | 0 |
-| pull64_interleaved | 7.473 / 3.322 / 1.950 | 201326592 | 24 | 3 | 0 |
-| pull32_interleaved | 8.710 / 3.948 / 2.593 | 201326592 | 24 | 3 | 0 |
-| pull32_gpu_dag | 8.810 / 7.334 / 7.227 | 201326592 | 24 | 5 | 0 |
-| frontier32_vertex | 10.144 / 5.760 / 3.640 | 21296680 | 24 | 3 | 0 |
-| frontier32_simd | 12.189 / 7.941 / 6.799 | 22006672 | 24 | 3 | 0 |
-| frontier32_gpu_dag | 9.203 / 7.809 / 7.471 | 21985376 | 24 | 5 | 0 |
-| bucket32_d4 | 16.825 / 12.607 / 10.280 | 8451400 | 72 | 9 | 0 |
-| bucket32_d16 | 13.809 / 9.687 / 7.926 | 9572312 | 48 | 6 | 0 |
-| bucket32_d64 | 12.602 / 8.439 / 7.400 | 17413440 | 24 | 3 | 0 |
-### ('random', '65536', '524288', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 3.545 / 2.038 / 1.061 | 12582912 | 24 | 3 | 0 |
-| old_group_parallel_dag | 30.358 / 28.978 / 28.314 | 11534336 | 22 | 1 | 0 |
-| pull64_barrier | 3.163 / 1.729 / 0.758 | 12582912 | 24 | 3 | 0 |
-| pull64_interleaved | 3.048 / 1.519 / 0.703 | 12582912 | 24 | 3 | 0 |
-| pull32_interleaved | 2.913 / 1.338 / 0.502 | 12582912 | 24 | 3 | 0 |
-| pull32_gpu_dag | 1.373 / 0.882 / 0.571 | 12582912 | 24 | 5 | 0 |
-| frontier32_vertex | 2.737 / 1.259 / 0.435 | 1734632 | 24 | 3 | 0 |
-| frontier32_simd | 3.045 / 1.576 / 0.640 | 1561768 | 24 | 3 | 0 |
-| frontier32_gpu_dag | 1.461 / 1.045 / 0.686 | 1558160 | 24 | 5 | 0 |
-| bucket32_d4 | 4.357 / 2.761 / 1.174 | 528256 | 64 | 8 | 0 |
-| bucket32_d16 | 3.481 / 2.047 / 0.836 | 599256 | 40 | 5 | 0 |
-| bucket32_d64 | 3.187 / 1.681 / 0.677 | 1050376 | 24 | 3 | 0 |
-### ('clos', '800', '320000', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 2.142 / 1.366 / 0.744 | 2560000 | 8 | 1 | 0 |
-| old_group_parallel_dag | 2.326 / 1.577 / 0.905 | 960000 | 3 | 1 | 0 |
-| pull64_barrier | 2.017 / 1.253 / 0.699 | 2560000 | 8 | 1 | 0 |
-| pull64_interleaved | 2.265 / 1.493 / 0.878 | 2560000 | 8 | 1 | 0 |
-| pull32_interleaved | 2.801 / 1.980 / 1.363 | 2560000 | 8 | 1 | 0 |
-| pull32_gpu_dag | 2.133 / 1.256 / 0.994 | 2560000 | 8 | 3 | 0 |
-| frontier32_vertex | 2.376 / 1.575 / 0.933 | 320000 | 8 | 1 | 0 |
-| frontier32_simd | 1.604 / 0.852 / 0.361 | 320000 | 8 | 1 | 0 |
-| frontier32_gpu_dag | 1.714 / 0.824 / 0.606 | 320000 | 8 | 3 | 0 |
-| bucket32_d4 | 1.660 / 0.873 / 0.446 | 320000 | 8 | 1 | 0 |
-| bucket32_d16 | 1.716 / 0.904 / 0.444 | 320000 | 8 | 1 | 0 |
-| bucket32_d64 | 1.698 / 0.939 / 0.453 | 320000 | 8 | 1 | 0 |
-### ('clos', '800', '320000', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 26.735 / 19.418 / 18.854 | 163840000 | 8 | 1 | 0 |
-| old_group_parallel_dag | 12.637 / 5.915 / 5.412 | 61440000 | 3 | 1 | 0 |
-| pull64_barrier | 24.737 / 18.165 / 17.725 | 163840000 | 8 | 1 | 0 |
-| pull64_interleaved | 13.270 / 6.122 / 5.405 | 163840000 | 8 | 1 | 0 |
-| pull32_interleaved | 10.983 / 4.274 / 3.647 | 163840000 | 8 | 1 | 0 |
-| pull32_gpu_dag | 8.185 / 4.308 / 6.164 | 163840000 | 8 | 3 | 0 |
-| frontier32_vertex | 14.231 / 7.148 / 6.877 | 20480000 | 8 | 1 | 0 |
-| frontier32_simd | 9.324 / 2.065 / 1.458 | 20480000 | 8 | 1 | 0 |
-| frontier32_gpu_dag | 15.944 / 2.089 / 14.063 | 20480000 | 8 | 3 | 0 |
-| bucket32_d4 | 10.000 / 2.529 / 2.040 | 20480000 | 8 | 1 | 0 |
-| bucket32_d16 | 9.610 / 2.183 / 1.863 | 20480000 | 8 | 1 | 0 |
-| bucket32_d64 | 9.988 / 2.684 / 2.106 | 20480000 | 8 | 1 | 0 |
-### ('grid', '10000', '39600', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 4.013 / 3.947 / 0.706 | 7920000 | 200 | 25 | 0 |
-| old_group_parallel_dag | 8.014 / 7.948 / 7.804 | 7880400 | 199 | 1 | 0 |
-| pull64_barrier | 4.120 / 3.996 / 0.682 | 7920000 | 200 | 25 | 0 |
-| pull64_interleaved | 3.963 / 3.894 / 0.656 | 7920000 | 200 | 25 | 0 |
-| pull32_interleaved | 3.378 / 3.314 / 0.604 | 7920000 | 200 | 25 | 0 |
-| pull32_gpu_dag | 3.492 / 3.086 / 0.616 | 7920000 | 200 | 27 | 0 |
-| frontier32_vertex | 4.642 / 4.568 / 1.859 | 39600 | 200 | 25 | 0 |
-| frontier32_simd | 4.040 / 3.931 / 1.337 | 39600 | 200 | 25 | 0 |
-| frontier32_gpu_dag | 4.283 / 3.993 / 1.302 | 39600 | 200 | 27 | 0 |
-| bucket32_d4 | 4.910 / 4.826 / 2.156 | 39600 | 200 | 25 | 0 |
-| bucket32_d16 | 5.336 / 5.270 / 2.375 | 39600 | 200 | 25 | 0 |
-| bucket32_d64 | 5.193 / 5.129 / 2.313 | 39600 | 200 | 25 | 0 |
-### ('grid', '10000', '39600', '8')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 4.347 / 4.145 / 1.436 | 63360000 | 200 | 25 | 0 |
-| old_group_parallel_dag | 8.292 / 8.082 / 7.572 | 51480000 | 199 | 1 | 0 |
-| pull64_barrier | 4.480 / 4.280 / 1.391 | 63360000 | 200 | 25 | 0 |
-| pull64_interleaved | 4.328 / 4.167 / 1.330 | 63360000 | 200 | 25 | 0 |
-| pull32_interleaved | 4.287 / 4.032 / 1.368 | 63360000 | 200 | 25 | 0 |
-| pull32_gpu_dag | 4.436 / 4.109 / 1.562 | 63360000 | 200 | 27 | 0 |
-| frontier32_vertex | 5.906 / 5.657 / 2.502 | 316800 | 200 | 25 | 0 |
-| frontier32_simd | 4.526 / 4.257 / 1.461 | 316800 | 200 | 25 | 0 |
-| frontier32_gpu_dag | 4.150 / 3.853 / 1.370 | 316800 | 200 | 27 | 0 |
-| bucket32_d4 | 7.676 / 7.433 / 3.707 | 316800 | 200 | 25 | 0 |
-| bucket32_d16 | 7.596 / 7.402 / 3.678 | 316800 | 200 | 25 | 0 |
-| bucket32_d64 | 7.603 / 7.391 / 3.721 | 316800 | 200 | 25 | 0 |
-### ('chain', '2048', '2047', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 30.065 / 30.058 / 4.364 | 4192256 | 2048 | 256 | 0 |
-| old_group_parallel_dag | 4.847 / 4.825 / 4.696 | 4192256 | 2048 | 1 | 0 |
-| pull64_barrier | 28.539 / 28.532 / 4.712 | 4192256 | 2048 | 256 | 0 |
-| pull64_interleaved | 32.552 / 32.545 / 6.166 | 4192256 | 2048 | 256 | 0 |
-| pull32_interleaved | 33.313 / 33.304 / 7.668 | 4192256 | 2048 | 256 | 0 |
-| pull32_gpu_dag | 30.619 / 30.342 / 4.891 | 4192256 | 2048 | 258 | 0 |
-| frontier32_vertex | 37.679 / 37.671 / 12.262 | 2047 | 2048 | 256 | 0 |
-| frontier32_simd | 41.050 / 41.041 / 15.764 | 2047 | 2048 | 256 | 0 |
-| frontier32_gpu_dag | 40.148 / 39.758 / 13.087 | 2047 | 2048 | 258 | 0 |
-| bucket32_d4 | 49.001 / 48.994 / 21.208 | 2047 | 2056 | 257 | 0 |
-| bucket32_d16 | 48.755 / 48.747 / 21.149 | 2047 | 2056 | 257 | 0 |
-| bucket32_d64 | 48.401 / 48.395 / 21.022 | 2047 | 2056 | 257 | 0 |
-### ('hub', '4096', '12286', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 32.652 / 32.266 / 30.925 | 31452160 | 40 | 5 | 0 |
-| old_group_parallel_dag | 26.147 / 25.761 / 25.032 | 27176632 | 38 | 1 | 0 |
-| pull64_barrier | 25.410 / 25.029 / 23.756 | 31452160 | 40 | 5 | 0 |
-| pull64_interleaved | 33.830 / 33.457 / 31.908 | 31452160 | 40 | 5 | 0 |
-| pull32_interleaved | 29.085 / 28.621 / 27.390 | 31452160 | 40 | 5 | 0 |
-| pull32_gpu_dag | 31.331 / 28.778 / 29.382 | 31452160 | 40 | 7 | 0 |
-| frontier32_vertex | 20.164 / 19.779 / 18.439 | 1847854 | 40 | 5 | 0 |
-| frontier32_simd | 3.680 / 3.294 / 1.977 | 1683322 | 40 | 5 | 0 |
-| frontier32_gpu_dag | 5.438 / 3.358 / 3.575 | 1683332 | 40 | 7 | 0 |
-| bucket32_d4 | 5.120 / 4.740 / 3.072 | 788342 | 48 | 6 | 0 |
-| bucket32_d16 | 4.911 / 4.544 / 3.014 | 1124798 | 48 | 6 | 0 |
-| bucket32_d64 | 4.974 / 4.580 / 3.351 | 1929942 | 40 | 5 | 0 |
-### ('random', '4096', '131072', '1')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 0.700 / 0.521 / 0.269 | 2097152 | 16 | 2 | 0 |
-| old_group_parallel_dag | 2.531 / 2.326 / 2.178 | 1572864 | 12 | 1 | 0 |
-| pull64_barrier | 0.670 / 0.484 / 0.244 | 2097152 | 16 | 2 | 0 |
-| pull64_interleaved | 0.708 / 0.538 / 0.266 | 2097152 | 16 | 2 | 0 |
-| pull32_interleaved | 0.603 / 0.418 / 0.180 | 2097152 | 16 | 2 | 0 |
-| pull32_gpu_dag | 0.828 / 0.458 / 0.237 | 2097152 | 16 | 4 | 0 |
-| frontier32_vertex | 0.827 / 0.638 / 0.358 | 421728 | 16 | 2 | 0 |
-| frontier32_simd | 0.547 / 0.381 / 0.130 | 385248 | 16 | 2 | 0 |
-| frontier32_gpu_dag | 0.790 / 0.404 / 0.188 | 385888 | 16 | 4 | 0 |
-| bucket32_d4 | 0.878 / 0.693 / 0.279 | 138720 | 24 | 3 | 0 |
-| bucket32_d16 | 0.602 / 0.418 / 0.176 | 177024 | 16 | 2 | 0 |
-| bucket32_d64 | 0.676 / 0.489 / 0.213 | 379328 | 16 | 2 | 0 |
-### ('random', '4096', '131072', '64')
-
-| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |
-|---|---:|---:|---:|---:|---|
-| old_pull_parallel_dag | 9.211 / 7.184 / 6.254 | 134217728 | 16 | 2 | 0 |
-| old_group_parallel_dag | 6.357 / 3.995 / 3.300 | 105644032 | 15 | 1 | 0 |
-| pull64_barrier | 11.066 / 9.020 / 8.132 | 134217728 | 16 | 2 | 0 |
-| pull64_interleaved | 4.039 / 1.981 / 1.106 | 134217728 | 16 | 2 | 0 |
-| pull32_interleaved | 3.814 / 1.788 / 1.031 | 134217728 | 16 | 2 | 0 |
-| pull32_gpu_dag | 2.051 / 1.482 / 0.861 | 134217728 | 16 | 4 | 0 |
-| frontier32_vertex | 5.418 / 3.315 / 2.452 | 22442464 | 16 | 2 | 0 |
-| frontier32_simd | 5.078 / 2.991 / 1.970 | 22729248 | 16 | 2 | 0 |
-| frontier32_gpu_dag | 4.086 / 2.828 / 2.683 | 22826080 | 16 | 4 | 0 |
-| bucket32_d4 | 4.731 / 2.704 / 1.615 | 8805184 | 24 | 3 | 0 |
-| bucket32_d16 | 4.926 / 2.956 / 1.859 | 12113536 | 24 | 3 | 0 |
-| bucket32_d64 | 5.330 / 3.310 / 2.396 | 23278880 | 16 | 2 | 0 |
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/time-base-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/time-base-a1.txt
deleted file mode 100644
index a1f056c..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/time-base-a1.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-2026-09-26T23:29:22Z
-2026-09-26T23:29:35Z
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/time-base-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/time-base-a2.txt
deleted file mode 100644
index c203e1a..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/time-base-a2.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-2026-09-26T23:30:30Z
-2026-09-26T23:30:43Z
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a1.txt b/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a1.txt
deleted file mode 100644
index 96d1d9c..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a1.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-2026-09-26T23:29:10Z
-2026-09-26T23:29:20Z
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a2.txt b/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a2.txt
deleted file mode 100644
index aa2e187..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/time-cpu-a2.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-2026-09-26T23:30:45Z
-2026-09-26T23:30:56Z
diff --git a/dev/research/metal_pathfinding/optimization/results/aba/time-optimized-b.txt b/dev/research/metal_pathfinding/optimization/results/aba/time-optimized-b.txt
deleted file mode 100644
index 9700df1..0000000
--- a/dev/research/metal_pathfinding/optimization/results/aba/time-optimized-b.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-2026-09-26T23:29:37Z
-2026-09-26T23:30:29Z
diff --git a/dev/research/metal_pathfinding/optimization/results/audit.json b/dev/research/metal_pathfinding/optimization/results/audit.json
deleted file mode 100644
index 99f87b6..0000000
--- a/dev/research/metal_pathfinding/optimization/results/audit.json
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "correctness-final.csv": {
-    "rows": 336,
-    "checked_query_results": 11760
-  },
-  "stress.csv": {
-    "rows": 28,
-    "checked_query_results": 39424
-  },
-  "correctness-sanitized.csv": {
-    "rows": 336,
-    "checked_query_results": 11760
-  },
-  "stress-sanitized.csv": {
-    "rows": 28,
-    "checked_query_results": 8960
-  },
-  "aba": {
-    "phase_rows": {
-      "cpu-a1": 48,
-      "base-a1": 36,
-      "optimized-b": 216,
-      "base-a2": 36,
-      "cpu-a2": 48
-    },
-    "checked_query_results": 124704
-  },
-  "total_checked_query_results": 290192,
-  "source_sha256": {
-    "dev/metal_pathfinding/experiment.mm": "1da9ff77bd2ad97e95e951454821b25005859c6f75c27a3c56d925e5fc99f6fc",
-    "dev/metal_pathfinding/sssp.metal": "2e36b1623a3940bf1f19f5d81141bb1def14f5873fe2a98aab0101bbe68618a3",
-    "dev/metal_pathfinding/optimization/experiment.mm": "7717db8d791d17f7f0ef0b672461ad82afb2ae99cc2ab6c8cb8b33b35e74dd25",
-    "dev/metal_pathfinding/optimization/kernels.metal": "bed6c9a836e85520101659471c62b7c4c9eb6f4954cb7bb74c971f10c44f37ff",
-    "dev/metal_pathfinding/optimization/cpu_algorithms.mm": "44962b5bd1dba6ecfc8d1449e324875e35ebe373e3f33aef779be12d9cb3fd65",
-    "dev/metal_pathfinding/optimization/summarize.py": "a08a937336abf0c30fbed82ac4cec970868f1d77469d5aca1a84a9407326578a",
-    "dev/metal_pathfinding/optimization/summarize_cpu.py": "b384cca4832b308694e1642020ef09cc5b0084c27df5ec20bd64ea793ead51a0"
-  },
-  "cpu-algorithms-correctness.csv": {
-    "rows": 24,
-    "checked_query_results": 960
-  },
-  "cpu-algorithms-sanitized.csv": {
-    "rows": 24,
-    "checked_query_results": 960
-  },
-  "cpu-algorithms-full-sanitized.csv": {
-    "rows": 14,
-    "checked_query_results": 3608
-  },
-  "cpu_algorithms_aba": {
-    "phase_rows": {
-      "a1": 14,
-      "b": 216,
-      "a2": 14
-    },
-    "checked_query_results": 88056
-  },
-  "repository_checks": {
-    "workspace_check": "passed: rebuilt extension, lint, types, 170 C++ and 465 Python tests",
-    "sanitize_test": "170 C++ tests passed",
-    "ci": "not run",
-    "production_tracked_changes": false,
-    "commit_created": false,
-    "pushed": false
-  }
-}
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness-final-stderr.txt b/dev/research/metal_pathfinding/optimization/results/correctness-final-stderr.txt
deleted file mode 100644
index 5d79ff7..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness-final-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=51.344 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness-final.csv b/dev/research/metal_pathfinding/optimization/results/correctness-final.csv
deleted file mode 100644
index 23c8fd2..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness-final.csv
+++ /dev/null
@@ -1,337 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random_masked_int64,40,240,8,old_pull_serial,0.295542,0.280167,0.122083,15360,8,1,0,0.093124,3,pass,0.295542;0.481375;0.254833
-random_masked_int64,40,240,8,old_group_serial,0.494583,0.487583,0.071625,9600,6,1,0,0.093124,3,pass,0.494583;0.218417;0.495042
-random_masked_int64,40,240,8,old_pull_parallel_dag,0.795000,0.716125,0.145833,15360,8,1,0,0.093124,3,pass,0.615625;0.805625;0.795000
-random_masked_int64,40,240,8,old_group_parallel_dag,0.240042,0.192250,0.068542,9600,6,1,0,0.093124,3,pass,0.227042;0.240042;0.242917
-random_masked_int64,40,240,8,pull64_barrier,0.335500,0.297875,0.112167,15360,8,1,0,0.093124,3,pass,0.354916;0.320250;0.335500
-random_masked_int64,40,240,8,pull64_interleaved,0.544875,0.511792,0.116292,15360,8,1,0,0.093124,3,pass,0.535125;0.544875;0.697958
-random_masked_int64,40,240,8,pull32_interleaved,0.321750,0.275625,0.113792,15360,8,1,1,0.093124,3,pass,0.684625;0.321750;0.294917
-random_masked_int64,40,240,8,pull32_gpu_dag,0.714125,0.310708,0.195750,15360,8,3,1,0.093124,3,pass,0.863417;0.676542;0.714125
-random_masked_int64,40,240,8,frontier32_vertex,0.313500,0.274208,0.112208,15360,8,1,1,0.093124,3,pass,0.313500;0.315958;0.307541
-random_masked_int64,40,240,8,frontier32_simd,0.448917,0.414458,0.134125,15360,8,1,1,0.093124,3,pass,0.622542;0.448917;0.341667
-random_masked_int64,40,240,8,frontier32_gpu_dag,0.730291,0.305292,0.195917,15360,8,3,1,0.093124,3,pass,0.638333;0.737416;0.730291
-random_masked_int64,40,240,8,bucket32_d4,0.335667,0.285709,0.112125,15360,8,1,1,0.093124,3,pass,0.335667;0.338542;0.313417
-random_masked_int64,40,240,8,bucket32_d16,0.346750,0.319792,0.141667,15360,8,1,1,0.093124,3,pass,0.364625;0.343333;0.346750
-random_masked_int64,40,240,8,bucket32_d64,0.295625,0.270000,0.113125,15360,8,1,1,0.093124,3,pass,0.300625;0.295625;0.295209
-random_masked,43,258,8,old_pull_serial,0.553208,0.537875,0.297833,33024,16,2,0,0.058250,3,pass,0.553208;0.532292;1.283709
-random_masked,43,258,8,old_group_serial,0.253708,0.245125,0.106625,14448,9,1,0,0.058250,3,pass,0.253708;0.254417;0.248625
-random_masked,43,258,8,old_pull_parallel_dag,0.659625,0.611375,0.315917,33024,16,2,0,0.058250,3,pass,0.659625;0.763875;0.653084
-random_masked,43,258,8,old_group_parallel_dag,0.264917,0.231916,0.105708,14448,9,1,0,0.058250,3,pass,0.279208;0.264917;0.260500
-random_masked,43,258,8,pull64_barrier,0.598083,0.582250,0.276708,33024,16,2,0,0.058250,3,pass,0.576291;0.598083;0.730833
-random_masked,43,258,8,pull64_interleaved,0.649584,0.619375,0.300167,33024,16,2,0,0.058250,3,pass,0.649584;0.693042;0.621250
-random_masked,43,258,8,pull32_interleaved,0.643791,0.610666,0.280375,33024,16,2,0,0.058250,3,pass,0.616875;1.234375;0.643791
-random_masked,43,258,8,pull32_gpu_dag,0.862916,0.498916,0.270583,33024,16,4,0,0.058250,3,pass,0.862916;0.851875;0.952791
-random_masked,43,258,8,frontier32_vertex,0.788458,0.755458,0.433333,3186,16,2,0,0.058250,3,pass,0.843375;0.745917;0.788458
-random_masked,43,258,8,frontier32_simd,0.648291,0.621291,0.322292,3186,16,2,0,0.058250,3,pass,0.648291;0.637833;0.685875
-random_masked,43,258,8,frontier32_gpu_dag,1.073125,0.610375,0.384208,3186,16,4,0,0.058250,3,pass,1.453292;1.073125;1.037708
-random_masked,43,258,8,bucket32_d4,1.775500,1.724792,1.121667,2016,32,4,0,0.058250,3,pass,1.748708;1.823084;1.775500
-random_masked,43,258,8,bucket32_d16,1.315042,1.288875,0.827166,2142,24,3,0,0.058250,3,pass,1.315042;1.332542;1.310125
-random_masked,43,258,8,bucket32_d64,0.967625,0.920750,0.555500,3096,16,2,0,0.058250,3,pass,0.967625;1.148250;0.876542
-random_masked_int64_reverse,46,276,8,old_pull_serial,0.228500,0.216209,0.095250,17664,8,1,0,0.062209,3,pass,0.227542;0.233708;0.228500
-random_masked_int64_reverse,46,276,8,old_group_serial,0.190666,0.173792,0.044500,9660,5,1,0,0.062209,3,pass,0.190666;0.191250;0.183416
-random_masked_int64_reverse,46,276,8,old_pull_parallel_dag,0.279041,0.234000,0.095750,17664,8,1,0,0.062209,3,pass,0.280542;0.277709;0.279041
-random_masked_int64_reverse,46,276,8,old_group_parallel_dag,0.215084,0.178417,0.044750,9660,5,1,0,0.062209,3,pass,0.223000;0.205708;0.215084
-random_masked_int64_reverse,46,276,8,pull64_barrier,0.297583,0.262625,0.093000,17664,8,1,0,0.062209,3,pass,0.297583;0.295959;0.299708
-random_masked_int64_reverse,46,276,8,pull64_interleaved,0.282500,0.247250,0.094750,17664,8,1,0,0.062209,3,pass,0.285875;0.282500;0.269042
-random_masked_int64_reverse,46,276,8,pull32_interleaved,0.293375,0.256125,0.095333,17664,8,1,1,0.062209,3,pass,0.276583;0.293375;0.723250
-random_masked_int64_reverse,46,276,8,pull32_gpu_dag,0.619291,0.257709,0.144750,17664,8,3,1,0.062209,3,pass,0.693292;0.619291;0.600458
-random_masked_int64_reverse,46,276,8,frontier32_vertex,0.285083,0.250750,0.092833,17664,8,1,1,0.062209,3,pass,0.279625;0.292667;0.285083
-random_masked_int64_reverse,46,276,8,frontier32_simd,0.294167,0.262416,0.094000,17664,8,1,1,0.062209,3,pass,0.294167;0.297875;0.293209
-random_masked_int64_reverse,46,276,8,frontier32_gpu_dag,0.626417,0.252917,0.144000,17664,8,3,1,0.062209,3,pass,0.626417;0.648291;0.621667
-random_masked_int64_reverse,46,276,8,bucket32_d4,0.299416,0.254583,0.092833,17664,8,1,1,0.062209,3,pass,0.299416;0.327750;0.296000
-random_masked_int64_reverse,46,276,8,bucket32_d16,0.298250,0.259125,0.093458,17664,8,1,1,0.062209,3,pass,0.298250;0.315625;0.291042
-random_masked_int64_reverse,46,276,8,bucket32_d64,0.271792,0.249875,0.093125,17664,8,1,1,0.062209,3,pass,0.302208;0.270667;0.271792
-random_masked,49,294,8,old_pull_serial,0.254500,0.245625,0.124375,18816,8,1,0,0.061041,3,pass,0.254500;0.265292;0.249375
-random_masked,49,294,8,old_group_serial,0.238708,0.229917,0.093250,14700,8,1,0,0.061041,3,pass,0.216625;0.239000;0.238708
-random_masked,49,294,8,old_pull_parallel_dag,0.299625,0.260792,0.124042,18816,8,1,0,0.061041,3,pass,0.306959;0.291250;0.299625
-random_masked,49,294,8,old_group_parallel_dag,0.266000,0.227791,0.093250,14700,8,1,0,0.061041,3,pass,0.253208;0.266000;0.305791
-random_masked,49,294,8,pull64_barrier,0.326084,0.287958,0.121875,18816,8,1,0,0.061041,3,pass,0.317208;0.333250;0.326084
-random_masked,49,294,8,pull64_interleaved,0.297000,0.266958,0.121417,18816,8,1,0,0.061041,3,pass,0.297000;0.272667;0.317333
-random_masked,49,294,8,pull32_interleaved,0.313584,0.278125,0.108625,18816,8,1,0,0.061041,3,pass,0.300375;0.947375;0.313584
-random_masked,49,294,8,pull32_gpu_dag,0.638875,0.268333,0.150750,18816,8,3,0,0.061041,3,pass,0.638875;0.636125;0.734292
-random_masked,49,294,8,frontier32_vertex,0.500083,0.467625,0.272750,3162,8,1,0,0.061041,3,pass,0.378791;0.637958;0.500083
-random_masked,49,294,8,frontier32_simd,0.368084,0.336083,0.180250,3162,8,1,0,0.061041,3,pass,0.383958;0.368084;0.357500
-random_masked,49,294,8,frontier32_gpu_dag,0.731333,0.351000,0.229584,3162,8,3,0,0.061041,3,pass,0.729833;0.842292;0.731333
-random_masked,49,294,8,bucket32_d4,1.551542,1.512250,0.792500,2022,40,5,0,0.061041,3,pass,1.533000;1.551542;1.629291
-random_masked,49,294,8,bucket32_d16,0.829375,0.768292,0.443917,2100,16,2,0,0.061041,3,pass,0.829375;0.911083;0.756209
-random_masked,49,294,8,bucket32_d64,0.655000,0.621375,0.319375,3036,16,2,0,0.061041,3,pass,0.654833;0.673291;0.655000
-random_masked_int64,52,312,8,old_pull_serial,0.206500,0.193792,0.074250,19968,8,1,0,0.089792,3,pass,0.206500;0.191000;0.219292
-random_masked_int64,52,312,8,old_group_serial,0.179167,0.169875,0.042417,12168,6,1,0,0.089792,3,pass,0.179167;0.187583;0.178459
-random_masked_int64,52,312,8,old_pull_parallel_dag,0.243125,0.207833,0.074833,19968,8,1,0,0.089792,3,pass,0.266375;0.243125;0.231208
-random_masked_int64,52,312,8,old_group_parallel_dag,0.192375,0.149375,0.033042,12168,6,1,0,0.089792,3,pass,0.201000;0.192375;0.177625
-random_masked_int64,52,312,8,pull64_barrier,0.222042,0.204000,0.054875,19968,8,1,0,0.089792,3,pass,0.222042;0.491792;0.211875
-random_masked_int64,52,312,8,pull64_interleaved,0.222875,0.206875,0.054417,19968,8,1,0,0.089792,3,pass,0.222875;0.212375;0.242667
-random_masked_int64,52,312,8,pull32_interleaved,0.243833,0.214167,0.054583,19968,8,1,1,0.089792,3,pass,0.257250;0.243833;0.235084
-random_masked_int64,52,312,8,pull32_gpu_dag,0.575083,0.218666,0.079208,19968,8,3,1,0.089792,3,pass,0.575083;0.553167;0.713500
-random_masked_int64,52,312,8,frontier32_vertex,0.236000,0.194250,0.055250,19968,8,1,1,0.089792,3,pass,0.254083;0.236000;0.205541
-random_masked_int64,52,312,8,frontier32_simd,0.231542,0.199750,0.055292,19968,8,1,1,0.089792,3,pass,0.245708;0.221708;0.231542
-random_masked_int64,52,312,8,frontier32_gpu_dag,0.565250,0.222584,0.081208,19968,8,3,1,0.089792,3,pass,0.607084;0.543250;0.565250
-random_masked_int64,52,312,8,bucket32_d4,0.274584,0.236750,0.054500,19968,8,1,1,0.089792,3,pass,0.274584;0.309834;0.267250
-random_masked_int64,52,312,8,bucket32_d16,0.244959,0.211750,0.054500,19968,8,1,1,0.089792,3,pass,0.244959;0.343625;0.226541
-random_masked_int64,52,312,8,bucket32_d64,0.229708,0.197500,0.047875,19968,8,1,1,0.089792,3,pass,0.213291;0.245875;0.229708
-random_masked_reverse,55,330,8,old_pull_serial,0.338000,0.329666,0.072125,42240,16,2,0,0.082751,3,pass,0.317459;0.338000;0.355708
-random_masked_reverse,55,330,8,old_group_serial,0.169334,0.160708,0.028000,20130,10,1,0,0.082751,3,pass,0.176292;0.169334;0.167542
-random_masked_reverse,55,330,8,old_pull_parallel_dag,0.372500,0.337959,0.062667,42240,16,2,0,0.082751,3,pass,0.413708;0.344792;0.372500
-random_masked_reverse,55,330,8,old_group_parallel_dag,0.196875,0.169125,0.024583,20130,10,1,0,0.082751,3,pass,0.206500;0.196875;0.193250
-random_masked_reverse,55,330,8,pull64_barrier,0.346083,0.325542,0.070250,42240,16,2,0,0.082751,3,pass,0.388542;0.346083;0.334208
-random_masked_reverse,55,330,8,pull64_interleaved,0.415000,0.376500,0.071708,42240,16,2,0,0.082751,3,pass,0.341334;0.415000;0.416750
-random_masked_reverse,55,330,8,pull32_interleaved,0.405333,0.352750,0.066125,42240,16,2,0,0.082751,3,pass,0.380375;0.405333;0.424959
-random_masked_reverse,55,330,8,pull32_gpu_dag,0.734834,0.375000,0.080750,42240,16,4,0,0.082751,3,pass,0.734834;0.758000;0.605875
-random_masked_reverse,55,330,8,frontier32_vertex,0.431750,0.409208,0.162250,3691,16,2,0,0.082751,3,pass,0.431750;0.427458;0.671500
-random_masked_reverse,55,330,8,frontier32_simd,0.458458,0.428500,0.120208,3691,16,2,0,0.082751,3,pass,0.432041;0.458458;0.473417
-random_masked_reverse,55,330,8,frontier32_gpu_dag,0.739958,0.433042,0.141708,3691,16,4,0,0.082751,3,pass,0.736334;0.961208;0.739958
-random_masked_reverse,55,330,8,bucket32_d4,1.017375,0.993458,0.364375,2455,32,4,0,0.082751,3,pass,0.925125;1.071250;1.017375
-random_masked_reverse,55,330,8,bucket32_d16,0.769625,0.744958,0.284083,2603,24,3,0,0.082751,3,pass,0.842375;0.769625;0.766042
-random_masked_reverse,55,330,8,bucket32_d64,0.488208,0.452667,0.167083,3605,16,2,0,0.082751,3,pass,0.490125;0.477292;0.488208
-random_masked_int64,58,348,8,old_pull_serial,0.186084,0.176958,0.033542,22272,8,1,0,0.072333,3,pass,0.190292;0.174250;0.186084
-random_masked_int64,58,348,8,old_group_serial,0.157625,0.148708,0.015125,13920,5,1,0,0.072333,3,pass,0.157917;0.148042;0.157625
-random_masked_int64,58,348,8,old_pull_parallel_dag,0.212583,0.181000,0.033375,22272,8,1,0,0.072333,3,pass,0.213917;0.209500;0.212583
-random_masked_int64,58,348,8,old_group_parallel_dag,0.189875,0.154458,0.014375,13920,5,1,0,0.072333,3,pass,0.191875;0.189875;0.188333
-random_masked_int64,58,348,8,pull64_barrier,0.226833,0.202958,0.031875,22272,8,1,0,0.072333,3,pass,0.246250;0.226833;0.221792
-random_masked_int64,58,348,8,pull64_interleaved,0.213041,0.177209,0.026792,22272,8,1,0,0.072333,3,pass,0.213041;0.217834;0.200459
-random_masked_int64,58,348,8,pull32_interleaved,0.200709,0.168250,0.027750,22272,8,1,1,0.072333,3,pass,0.200709;0.182541;0.231917
-random_masked_int64,58,348,8,pull32_gpu_dag,0.526250,0.199792,0.040250,22272,8,3,1,0.072333,3,pass,0.526250;0.513500;0.537750
-random_masked_int64,58,348,8,frontier32_vertex,0.257041,0.224708,0.031792,22272,8,1,1,0.072333,3,pass,0.253250;0.403083;0.257041
-random_masked_int64,58,348,8,frontier32_simd,0.213667,0.187792,0.027917,22272,8,1,1,0.072333,3,pass,0.222208;0.213667;0.197166
-random_masked_int64,58,348,8,frontier32_gpu_dag,0.481458,0.177333,0.041917,22272,8,3,1,0.072333,3,pass,0.487875;0.465292;0.481458
-random_masked_int64,58,348,8,bucket32_d4,0.295167,0.220041,0.026875,22272,8,1,1,0.072333,3,pass,0.184125;0.295167;0.303708
-random_masked_int64,58,348,8,bucket32_d16,0.229375,0.204917,0.030375,22272,8,1,1,0.072333,3,pass,0.228000;0.242292;0.229375
-random_masked_int64,58,348,8,bucket32_d64,0.200666,0.176000,0.026750,22272,8,1,1,0.072333,3,pass,0.218250;0.200666;0.199292
-random_masked,61,366,8,old_pull_serial,0.310042,0.300292,0.062833,46848,16,2,0,0.073625,3,pass,0.313791;0.309125;0.310042
-random_masked,61,366,8,old_group_serial,0.150208,0.140417,0.024625,23424,9,1,0,0.073625,3,pass,0.150208;0.148459;0.150875
-random_masked,61,366,8,old_pull_parallel_dag,0.322833,0.293125,0.062792,46848,16,2,0,0.073625,3,pass,0.328042;0.322833;0.313875
-random_masked,61,366,8,old_group_parallel_dag,0.171500,0.134458,0.024500,23424,9,1,0,0.073625,3,pass,0.177917;0.171500;0.163208
-random_masked,61,366,8,pull64_barrier,0.358458,0.323834,0.059333,46848,16,2,0,0.073625,3,pass,0.358667;0.351625;0.358458
-random_masked,61,366,8,pull64_interleaved,0.379750,0.353000,0.059208,46848,16,2,0,0.073625,3,pass,0.348709;0.379750;0.465916
-random_masked,61,366,8,pull32_interleaved,0.335250,0.308541,0.053625,46848,16,2,0,0.073625,3,pass,0.381041;0.330875;0.335250
-random_masked,61,366,8,pull32_gpu_dag,0.624791,0.326000,0.066625,46848,16,4,0,0.073625,3,pass,0.640166;0.619250;0.624791
-random_masked,61,366,8,frontier32_vertex,0.449708,0.419250,0.120375,4776,16,2,0,0.073625,3,pass,0.423417;0.489625;0.449708
-random_masked,61,366,8,frontier32_simd,0.393417,0.365250,0.089542,4776,16,2,0,0.073625,3,pass,0.509167;0.391625;0.393417
-random_masked,61,366,8,frontier32_gpu_dag,0.645000,0.351333,0.103791,4776,16,4,0,0.073625,3,pass,0.630083;0.659083;0.645000
-random_masked,61,366,8,bucket32_d4,1.162167,1.124208,0.384250,2760,40,5,0,0.073625,3,pass,1.162167;1.262625;1.139458
-random_masked,61,366,8,bucket32_d16,0.787250,0.722958,0.258000,2952,24,3,0,0.073625,3,pass,0.778125;0.842833;0.787250
-random_masked,61,366,8,bucket32_d64,0.569916,0.544083,0.182708,4596,16,2,0,0.073625,3,pass,0.532041;0.579167;0.569916
-random_masked_int64_reverse,64,384,8,old_pull_serial,0.166875,0.154833,0.024000,24576,8,1,0,0.073876,3,pass,0.160750;0.168750;0.166875
-random_masked_int64_reverse,64,384,8,old_group_serial,0.143667,0.133167,0.010917,13440,5,1,0,0.073876,3,pass,0.132459;0.143667;0.160542
-random_masked_int64_reverse,64,384,8,old_pull_parallel_dag,0.195500,0.166708,0.025875,24576,8,1,0,0.073876,3,pass,0.195500;0.202250;0.182875
-random_masked_int64_reverse,64,384,8,old_group_parallel_dag,0.197833,0.165125,0.010875,13440,5,1,0,0.073876,3,pass,0.207542;0.197833;0.190083
-random_masked_int64_reverse,64,384,8,pull64_barrier,0.197875,0.171750,0.022333,24576,8,1,0,0.073876,3,pass,0.190333;0.197875;0.244042
-random_masked_int64_reverse,64,384,8,pull64_interleaved,0.210333,0.168459,0.023500,24576,8,1,0,0.073876,3,pass,0.195041;0.229458;0.210333
-random_masked_int64_reverse,64,384,8,pull32_interleaved,0.197958,0.161917,0.023250,24576,8,1,1,0.073876,3,pass,0.197958;0.244083;0.178875
-random_masked_int64_reverse,64,384,8,pull32_gpu_dag,0.470333,0.161750,0.036292,24576,8,3,1,0.073876,3,pass,0.434792;0.470333;0.542959
-random_masked_int64_reverse,64,384,8,frontier32_vertex,0.222916,0.183333,0.022167,24576,8,1,1,0.073876,3,pass,0.210125;0.222916;0.240000
-random_masked_int64_reverse,64,384,8,frontier32_simd,0.227083,0.192000,0.026750,24576,8,1,1,0.073876,3,pass,0.227083;0.206833;0.236125
-random_masked_int64_reverse,64,384,8,frontier32_gpu_dag,0.524542,0.194917,0.041250,24576,8,3,1,0.073876,3,pass,0.537542;0.524542;0.522500
-random_masked_int64_reverse,64,384,8,bucket32_d4,0.219417,0.188417,0.026792,24576,8,1,1,0.073876,3,pass,0.219709;0.209292;0.219417
-random_masked_int64_reverse,64,384,8,bucket32_d16,0.205000,0.173625,0.023542,24576,8,1,1,0.073876,3,pass,0.205958;0.188167;0.205000
-random_masked_int64_reverse,64,384,8,bucket32_d64,0.224459,0.186917,0.024042,24576,8,1,1,0.073876,3,pass,0.224459;0.237625;0.203416
-random_masked,67,402,8,old_pull_serial,0.183167,0.171459,0.031000,25728,8,1,0,0.070917,3,pass,0.183167;0.187583;0.149917
-random_masked,67,402,8,old_group_serial,0.163500,0.152916,0.019458,24522,8,1,0,0.070917,3,pass,0.169500;0.160041;0.163500
-random_masked,67,402,8,old_pull_parallel_dag,0.199125,0.163417,0.028625,25728,8,1,0,0.070917,3,pass,0.224500;0.193625;0.199125
-random_masked,67,402,8,old_group_parallel_dag,0.186667,0.147834,0.019375,24522,8,1,0,0.070917,3,pass,0.186667;0.197125;0.172125
-random_masked,67,402,8,pull64_barrier,0.198917,0.174375,0.028000,25728,8,1,0,0.070917,3,pass,0.191625;0.198917;0.212833
-random_masked,67,402,8,pull64_interleaved,0.232125,0.185708,0.028458,25728,8,1,0,0.070917,3,pass,0.232125;0.275166;0.208959
-random_masked,67,402,8,pull32_interleaved,0.204667,0.174459,0.025583,25728,8,1,0,0.070917,3,pass,0.204667;0.213750;0.193791
-random_masked,67,402,8,pull32_gpu_dag,0.524541,0.201084,0.042500,25728,8,3,0,0.070917,3,pass,0.495500;0.524541;0.547167
-random_masked,67,402,8,frontier32_vertex,0.300584,0.270209,0.085750,5034,8,1,0,0.070917,3,pass,0.279500;0.300584;0.315542
-random_masked,67,402,8,frontier32_simd,0.254167,0.222250,0.057750,5004,8,1,0,0.070917,3,pass,0.214041;0.262958;0.254167
-random_masked,67,402,8,frontier32_gpu_dag,0.585250,0.250708,0.073500,5004,8,3,0,0.070917,3,pass,0.631083;0.585250;0.584417
-random_masked,67,402,8,bucket32_d4,0.964708,0.943833,0.351208,3120,32,4,0,0.070917,3,pass,0.964708;1.042791;0.926875
-random_masked,67,402,8,bucket32_d16,0.701542,0.673792,0.229458,3360,24,3,0,0.070917,3,pass,0.640625;0.701542;0.830541
-random_masked,67,402,8,bucket32_d64,0.527750,0.500917,0.165750,4908,16,2,0,0.070917,3,pass,0.527750;0.535917;0.492334
-random_masked_int64,70,420,8,old_pull_serial,0.163584,0.150708,0.031875,26880,8,1,0,0.089500,3,pass,0.180000;0.163584;0.157584
-random_masked_int64,70,420,8,old_group_serial,0.162792,0.151000,0.017500,15960,6,1,0,0.089500,3,pass,0.163125;0.162792;0.162417
-random_masked_int64,70,420,8,old_pull_parallel_dag,0.171458,0.148125,0.030958,26880,8,1,0,0.089500,3,pass,0.194000;0.171458;0.168500
-random_masked_int64,70,420,8,old_group_parallel_dag,0.167375,0.141542,0.017333,15960,6,1,0,0.089500,3,pass,0.167375;0.164500;0.169584
-random_masked_int64,70,420,8,pull64_barrier,0.247750,0.208084,0.033500,26880,8,1,0,0.089500,3,pass,0.247750;0.268042;0.236500
-random_masked_int64,70,420,8,pull64_interleaved,0.273250,0.241708,0.033458,26880,8,1,0,0.089500,3,pass,0.235541;0.282666;0.273250
-random_masked_int64,70,420,8,pull32_interleaved,0.241916,0.210000,0.033333,26880,8,1,1,0.089500,3,pass,0.234667;0.248334;0.241916
-random_masked_int64,70,420,8,pull32_gpu_dag,0.480542,0.172791,0.044000,26880,8,3,1,0.089500,3,pass,0.473417;0.480542;0.484875
-random_masked_int64,70,420,8,frontier32_vertex,0.243625,0.210542,0.033250,26880,8,1,1,0.089500,3,pass,0.220084;0.243625;0.263000
-random_masked_int64,70,420,8,frontier32_simd,0.219750,0.186459,0.030250,26880,8,1,1,0.089500,3,pass,0.265709;0.219750;0.198250
-random_masked_int64,70,420,8,frontier32_gpu_dag,0.506583,0.176333,0.045000,26880,8,3,1,0.089500,3,pass,0.506583;0.680959;0.472792
-random_masked_int64,70,420,8,bucket32_d4,0.243417,0.209584,0.029958,26880,8,1,1,0.089500,3,pass,0.243417;0.216875;0.244250
-random_masked_int64,70,420,8,bucket32_d16,0.198583,0.181292,0.031042,26880,8,1,1,0.089500,3,pass,0.207375;0.197958;0.198583
-random_masked_int64,70,420,8,bucket32_d64,0.218833,0.186375,0.031000,26880,8,1,1,0.089500,3,pass,0.218833;0.184583;0.227958
-random_masked_reverse,73,438,8,old_pull_serial,0.353750,0.341459,0.049209,56064,16,2,0,0.079167,3,pass,0.334792;0.494625;0.353750
-random_masked_reverse,73,438,8,old_group_serial,0.164125,0.153167,0.016917,30222,10,1,0,0.079167,3,pass,0.164125;0.169250;0.141750
-random_masked_reverse,73,438,8,old_pull_parallel_dag,0.366125,0.336333,0.054167,56064,16,2,0,0.079167,3,pass,0.320625;0.372000;0.366125
-random_masked_reverse,73,438,8,old_group_parallel_dag,0.186167,0.149833,0.017000,30222,10,1,0,0.079167,3,pass,0.196000;0.186167;0.170000
-random_masked_reverse,73,438,8,pull64_barrier,0.349334,0.315625,0.050958,56064,16,2,0,0.079167,3,pass,0.349334;0.371750;0.330417
-random_masked_reverse,73,438,8,pull64_interleaved,0.416208,0.388333,0.053083,56064,16,2,0,0.079167,3,pass,0.417041;0.416208;0.370042
-random_masked_reverse,73,438,8,pull32_interleaved,0.332625,0.313167,0.046292,56064,16,2,0,0.079167,3,pass,0.332625;0.380083;0.331584
-random_masked_reverse,73,438,8,pull32_gpu_dag,0.607125,0.322291,0.059750,56064,16,4,0,0.079167,3,pass,0.662083;0.607125;0.600292
-random_masked_reverse,73,438,8,frontier32_vertex,0.536875,0.491708,0.140375,5335,16,2,0,0.079167,3,pass,0.435709;0.544209;0.536875
-random_masked_reverse,73,438,8,frontier32_simd,0.399875,0.367125,0.093417,5335,16,2,0,0.079167,3,pass,0.417625;0.399875;0.374584
-random_masked_reverse,73,438,8,frontier32_gpu_dag,0.691875,0.401375,0.122375,5335,16,4,0,0.079167,3,pass,0.773583;0.691875;0.684083
-random_masked_reverse,73,438,8,bucket32_d4,0.993583,0.963916,0.359833,3179,32,4,0,0.079167,3,pass,0.953958;1.084750;0.993583
-random_masked_reverse,73,438,8,bucket32_d16,0.700041,0.663333,0.241959,3402,24,3,0,0.079167,3,pass,0.694917;0.700041;0.735375
-random_masked_reverse,73,438,8,bucket32_d64,0.539166,0.510458,0.181750,4984,16,2,0,0.079167,3,pass,0.512000;0.539166;0.542250
-boundary_700000000,6,10,6,old_pull_serial,0.152792,0.151916,0.015792,360,6,1,0,0.054751,3,pass,0.145750;0.152792;0.156417
-boundary_700000000,6,10,6,old_group_serial,0.138625,0.137875,0.007125,160,5,1,0,0.054751,3,pass,0.138625;0.138750;0.136042
-boundary_700000000,6,10,6,old_pull_parallel_dag,0.187500,0.157584,0.015625,360,6,1,0,0.054751,3,pass,0.187500;0.197583;0.167875
-boundary_700000000,6,10,6,old_group_parallel_dag,0.151583,0.121458,0.007083,160,5,1,0,0.054751,3,pass,0.151583;0.139625;0.169125
-boundary_700000000,6,10,6,pull64_barrier,0.184625,0.154042,0.015334,360,6,1,0,0.054751,3,pass,0.184625;0.178167;0.186042
-boundary_700000000,6,10,6,pull64_interleaved,0.189209,0.159333,0.016083,360,6,1,0,0.054751,3,pass,0.196167;0.189209;0.158250
-boundary_700000000,6,10,6,pull32_interleaved,0.219166,0.182416,0.017333,360,6,1,0,0.054751,3,pass,0.219166;0.276250;0.218333
-boundary_700000000,6,10,6,pull32_gpu_dag,0.541500,0.188541,0.028417,360,6,3,0,0.054751,3,pass,0.514666;0.643125;0.541500
-boundary_700000000,6,10,6,frontier32_vertex,0.250125,0.224375,0.052750,24,8,1,0,0.054751,3,pass,0.250125;0.258792;0.241292
-boundary_700000000,6,10,6,frontier32_simd,0.221708,0.195667,0.045625,24,8,1,0,0.054751,3,pass,0.212667;0.221708;0.243708
-boundary_700000000,6,10,6,frontier32_gpu_dag,0.532167,0.232834,0.061667,24,8,3,0,0.054751,3,pass,0.653500;0.532167;0.525250
-boundary_700000000,6,10,6,bucket32_d4,0.293459,0.266959,0.086500,24,8,1,0,0.054751,3,pass,0.289375;0.293459;0.297000
-boundary_700000000,6,10,6,bucket32_d16,0.323750,0.289917,0.087583,24,8,1,0,0.054751,3,pass,0.299417;0.375250;0.323750
-boundary_700000000,6,10,6,bucket32_d64,0.254333,0.230333,0.071125,24,8,1,0,0.054751,3,pass,0.254333;0.283417;0.251959
-boundary_700000000_masked,6,10,6,old_pull_serial,0.124792,0.124250,0.013125,360,6,1,0,0.045292,3,pass,0.122000;0.124792;0.278875
-boundary_700000000_masked,6,10,6,old_group_serial,0.112750,0.112125,0.004875,80,2,1,0,0.045292,3,pass,0.109500;0.112750;0.113500
-boundary_700000000_masked,6,10,6,old_pull_parallel_dag,0.199625,0.166042,0.015417,360,6,1,0,0.045292,3,pass,0.199625;0.252958;0.197333
-boundary_700000000_masked,6,10,6,old_group_parallel_dag,0.175334,0.133792,0.005000,80,2,1,0,0.045292,3,pass,0.175334;0.179041;0.153834
-boundary_700000000_masked,6,10,6,pull64_barrier,0.219209,0.191416,0.018875,360,6,1,0,0.045292,3,pass,0.219209;0.204625;0.222500
-boundary_700000000_masked,6,10,6,pull64_interleaved,0.225750,0.189542,0.018792,360,6,1,0,0.045292,3,pass,0.244375;0.225750;0.214625
-boundary_700000000_masked,6,10,6,pull32_interleaved,0.216959,0.192125,0.017458,360,6,1,0,0.045292,3,pass,0.216959;0.203875;0.235125
-boundary_700000000_masked,6,10,6,pull32_gpu_dag,0.451458,0.157875,0.025000,360,6,3,0,0.045292,3,pass,0.451458;0.471209;0.438125
-boundary_700000000_masked,6,10,6,frontier32_vertex,0.264417,0.223584,0.051167,12,8,1,0,0.045292,3,pass,0.264417;0.269000;0.252000
-boundary_700000000_masked,6,10,6,frontier32_simd,0.247542,0.221250,0.049125,12,8,1,0,0.045292,3,pass,0.253834;0.247542;0.234625
-boundary_700000000_masked,6,10,6,frontier32_gpu_dag,0.555208,0.226250,0.060417,12,8,3,0,0.045292,3,pass,0.555208;0.564708;0.530958
-boundary_700000000_masked,6,10,6,bucket32_d4,0.290042,0.257416,0.076167,12,8,1,0,0.045292,3,pass,0.290042;0.301375;0.262833
-boundary_700000000_masked,6,10,6,bucket32_d16,0.283500,0.245375,0.081125,12,8,1,0,0.045292,3,pass,0.293917;0.283500;0.276709
-boundary_700000000_masked,6,10,6,bucket32_d64,0.258958,0.222125,0.072375,12,8,1,0,0.045292,3,pass,0.263625;0.258958;0.229209
-boundary_700000000_reverse,6,10,6,old_pull_serial,0.143708,0.142041,0.014792,360,6,1,0,0.076417,3,pass,0.145041;0.143708;0.135000
-boundary_700000000_reverse,6,10,6,old_group_serial,0.126375,0.125542,0.007250,170,5,1,0,0.076417,3,pass,0.120667;0.134209;0.126375
-boundary_700000000_reverse,6,10,6,old_pull_parallel_dag,0.196500,0.159708,0.015375,360,6,1,0,0.076417,3,pass,0.231667;0.189625;0.196500
-boundary_700000000_reverse,6,10,6,old_group_parallel_dag,0.166208,0.132709,0.007333,170,5,1,0,0.076417,3,pass,0.164292;0.168125;0.166208
-boundary_700000000_reverse,6,10,6,pull64_barrier,0.246166,0.217583,0.017875,360,6,1,0,0.076417,3,pass,0.246166;0.223709;0.378167
-boundary_700000000_reverse,6,10,6,pull64_interleaved,0.175291,0.138500,0.014750,360,6,1,0,0.076417,3,pass,0.175291;0.158209;0.179625
-boundary_700000000_reverse,6,10,6,pull32_interleaved,0.176000,0.151166,0.014750,360,6,1,0,0.076417,3,pass,0.164792;0.176000;0.199208
-boundary_700000000_reverse,6,10,6,pull32_gpu_dag,0.473250,0.161208,0.024334,360,6,3,0,0.076417,3,pass,0.453500;0.529333;0.473250
-boundary_700000000_reverse,6,10,6,frontier32_vertex,0.244417,0.205125,0.053750,24,8,1,0,0.076417,3,pass,0.228750;0.244417;0.257000
-boundary_700000000_reverse,6,10,6,frontier32_simd,0.226667,0.198792,0.044042,24,8,1,0,0.076417,3,pass,0.268875;0.226667;0.218209
-boundary_700000000_reverse,6,10,6,frontier32_gpu_dag,0.500625,0.202250,0.053417,24,8,3,0,0.076417,3,pass,0.641458;0.500625;0.485167
-boundary_700000000_reverse,6,10,6,bucket32_d4,0.240000,0.218208,0.070667,24,8,1,0,0.076417,3,pass,0.233708;0.243291;0.240000
-boundary_700000000_reverse,6,10,6,bucket32_d16,0.247750,0.214792,0.070625,24,8,1,0,0.076417,3,pass,0.303042;0.247750;0.223167
-boundary_700000000_reverse,6,10,6,bucket32_d64,0.284000,0.258334,0.084417,24,8,1,0,0.076417,3,pass,0.284000;0.295583;0.280750
-boundary_700000000_reverse_masked,6,10,6,old_pull_serial,0.132916,0.132292,0.013125,360,6,1,0,0.047751,3,pass,0.134042;0.128667;0.132916
-boundary_700000000_reverse_masked,6,10,6,old_group_serial,0.121541,0.120916,0.004792,90,2,1,0,0.047751,3,pass,0.121541;0.119292;0.124375
-boundary_700000000_reverse_masked,6,10,6,old_pull_parallel_dag,0.168125,0.138584,0.013250,360,6,1,0,0.047751,3,pass,0.168833;0.168125;0.167500
-boundary_700000000_reverse_masked,6,10,6,old_group_parallel_dag,0.141583,0.111166,0.004458,90,2,1,0,0.047751,3,pass,0.160375;0.138833;0.141583
-boundary_700000000_reverse_masked,6,10,6,pull64_barrier,0.187000,0.158958,0.014708,360,6,1,0,0.047751,3,pass,0.187000;0.173541;0.189250
-boundary_700000000_reverse_masked,6,10,6,pull64_interleaved,0.192166,0.166916,0.015625,360,6,1,0,0.047751,3,pass,0.192166;0.181792;0.203958
-boundary_700000000_reverse_masked,6,10,6,pull32_interleaved,0.225291,0.188458,0.014459,360,6,1,0,0.047751,3,pass,0.263292;0.225291;0.206083
-boundary_700000000_reverse_masked,6,10,6,pull32_gpu_dag,0.485625,0.171291,0.025000,360,6,3,0,0.047751,3,pass,0.469583;0.489458;0.485625
-boundary_700000000_reverse_masked,6,10,6,frontier32_vertex,0.234334,0.204625,0.042500,9,8,1,0,0.047751,3,pass,0.234334;0.221208;0.236292
-boundary_700000000_reverse_masked,6,10,6,frontier32_simd,0.231166,0.199542,0.041958,9,8,1,0,0.047751,3,pass,0.231166;0.192791;0.239542
-boundary_700000000_reverse_masked,6,10,6,frontier32_gpu_dag,0.504916,0.207875,0.051542,9,8,3,0,0.047751,3,pass,0.467459;0.504916;0.528000
-boundary_700000000_reverse_masked,6,10,6,bucket32_d4,0.276167,0.238000,0.070000,9,8,1,0,0.047751,3,pass,0.260375;0.326041;0.276167
-boundary_700000000_reverse_masked,6,10,6,bucket32_d16,0.274875,0.248708,0.072708,9,8,1,0,0.047751,3,pass,0.274875;0.273958;0.310167
-boundary_700000000_reverse_masked,6,10,6,bucket32_d64,0.293083,0.265250,0.082750,9,8,1,0,0.047751,3,pass,0.287000;0.323625;0.293083
-boundary_715827883,6,10,6,old_pull_serial,0.138666,0.137959,0.013250,360,6,1,0,0.040916,3,pass,0.141625;0.138666;0.129000
-boundary_715827883,6,10,6,old_group_serial,0.135083,0.134416,0.007250,160,5,1,0,0.040916,3,pass,0.129958;0.135083;0.136334
-boundary_715827883,6,10,6,old_pull_parallel_dag,0.179750,0.154292,0.015875,360,6,1,0,0.040916,3,pass,0.179750;0.179458;0.269333
-boundary_715827883,6,10,6,old_group_parallel_dag,0.162583,0.132250,0.007125,160,5,1,0,0.040916,3,pass,0.158625;0.163708;0.162583
-boundary_715827883,6,10,6,pull64_barrier,0.206000,0.172750,0.018625,360,6,1,0,0.040916,3,pass,0.206000;0.199083;0.206917
-boundary_715827883,6,10,6,pull64_interleaved,0.175583,0.148791,0.014625,360,6,1,0,0.040916,3,pass,0.175583;0.176667;0.174500
-boundary_715827883,6,10,6,pull32_interleaved,0.213000,0.184167,0.016958,360,6,1,1,0.040916,3,pass,0.187083;0.213000;0.231541
-boundary_715827883,6,10,6,pull32_gpu_dag,0.478041,0.166792,0.025458,360,6,3,1,0.040916,3,pass,0.450334;0.478041;0.480208
-boundary_715827883,6,10,6,frontier32_vertex,0.205750,0.181292,0.015625,360,6,1,1,0.040916,3,pass,0.203667;0.233000;0.205750
-boundary_715827883,6,10,6,frontier32_simd,0.223875,0.177625,0.015375,360,6,1,1,0.040916,3,pass,0.190459;0.290500;0.223875
-boundary_715827883,6,10,6,frontier32_gpu_dag,0.444916,0.157208,0.025250,360,6,3,1,0.040916,3,pass,0.467583;0.444916;0.413292
-boundary_715827883,6,10,6,bucket32_d4,0.196333,0.172958,0.016125,360,6,1,1,0.040916,3,pass,0.184209;0.196333;0.215666
-boundary_715827883,6,10,6,bucket32_d16,0.242209,0.208958,0.018667,360,6,1,1,0.040916,3,pass,0.211667;0.299083;0.242209
-boundary_715827883,6,10,6,bucket32_d64,0.224458,0.195459,0.018375,360,6,1,1,0.040916,3,pass,0.210750;0.236125;0.224458
-boundary_715827883_masked,6,10,6,old_pull_serial,0.151083,0.150542,0.015625,360,6,1,0,0.050708,3,pass,0.148667;0.151083;0.152375
-boundary_715827883_masked,6,10,6,old_group_serial,0.115209,0.114500,0.004500,80,2,1,0,0.050708,3,pass,0.110166;0.115833;0.115209
-boundary_715827883_masked,6,10,6,old_pull_parallel_dag,0.161250,0.135084,0.012375,360,6,1,0,0.050708,3,pass,0.157542;0.161250;0.235291
-boundary_715827883_masked,6,10,6,old_group_parallel_dag,0.151542,0.117459,0.004583,80,2,1,0,0.050708,3,pass,0.151542;0.146416;0.166083
-boundary_715827883_masked,6,10,6,pull64_barrier,0.176667,0.157250,0.015167,360,6,1,0,0.050708,3,pass,0.170500;0.176667;0.180958
-boundary_715827883_masked,6,10,6,pull64_interleaved,0.197708,0.169916,0.018750,360,6,1,0,0.050708,3,pass,0.181917;0.371958;0.197708
-boundary_715827883_masked,6,10,6,pull32_interleaved,0.184625,0.165792,0.016000,360,6,1,1,0.050708,3,pass,0.202458;0.184625;0.152500
-boundary_715827883_masked,6,10,6,pull32_gpu_dag,0.514959,0.175000,0.027000,360,6,3,1,0.050708,3,pass,0.543917;0.514959;0.500959
-boundary_715827883_masked,6,10,6,frontier32_vertex,0.220292,0.190708,0.018667,360,6,1,1,0.050708,3,pass,0.220292;0.219792;0.224542
-boundary_715827883_masked,6,10,6,frontier32_simd,0.208333,0.178292,0.016875,360,6,1,1,0.050708,3,pass,0.208333;0.200000;0.220625
-boundary_715827883_masked,6,10,6,frontier32_gpu_dag,0.477083,0.166209,0.025792,360,6,3,1,0.050708,3,pass,0.452125;0.477083;0.483458
-boundary_715827883_masked,6,10,6,bucket32_d4,0.199750,0.170875,0.014625,360,6,1,1,0.050708,3,pass,0.207709;0.199750;0.194875
-boundary_715827883_masked,6,10,6,bucket32_d16,0.203542,0.176209,0.018458,360,6,1,1,0.050708,3,pass,0.203542;0.215333;0.194583
-boundary_715827883_masked,6,10,6,bucket32_d64,0.214750,0.187459,0.018708,360,6,1,1,0.050708,3,pass,0.214750;0.271042;0.200792
-boundary_715827883_reverse,6,10,6,old_pull_serial,0.142375,0.141583,0.015625,360,6,1,0,0.064542,3,pass,0.142375;0.141959;0.143292
-boundary_715827883_reverse,6,10,6,old_group_serial,0.131792,0.131083,0.007333,170,5,1,0,0.064542,3,pass,0.131875;0.124625;0.131792
-boundary_715827883_reverse,6,10,6,old_pull_parallel_dag,0.171792,0.147708,0.015375,360,6,1,0,0.064542,3,pass,0.171083;0.171792;0.212459
-boundary_715827883_reverse,6,10,6,old_group_parallel_dag,0.138209,0.110458,0.007375,170,5,1,0,0.064542,3,pass,0.138209;0.136042;0.163542
-boundary_715827883_reverse,6,10,6,pull64_barrier,0.197583,0.172958,0.018250,360,6,1,0,0.064542,3,pass,0.197583;0.222125;0.194500
-boundary_715827883_reverse,6,10,6,pull64_interleaved,0.165458,0.147709,0.014417,360,6,1,0,0.064542,3,pass,0.162375;0.165458;0.167875
-boundary_715827883_reverse,6,10,6,pull32_interleaved,0.198666,0.168375,0.014833,360,6,1,1,0.064542,3,pass,0.165500;0.198666;0.215500
-boundary_715827883_reverse,6,10,6,pull32_gpu_dag,0.467417,0.169875,0.025167,360,6,3,1,0.064542,3,pass,0.484209;0.463083;0.467417
-boundary_715827883_reverse,6,10,6,frontier32_vertex,0.191292,0.166917,0.015000,360,6,1,1,0.064542,3,pass,0.186208;0.191292;0.258750
-boundary_715827883_reverse,6,10,6,frontier32_simd,0.211083,0.182709,0.014833,360,6,1,1,0.064542,3,pass,0.188125;0.211083;0.254250
-boundary_715827883_reverse,6,10,6,frontier32_gpu_dag,0.491833,0.177916,0.030208,360,6,3,1,0.064542,3,pass,0.492708;0.471250;0.491833
-boundary_715827883_reverse,6,10,6,bucket32_d4,0.214209,0.183084,0.018250,360,6,1,1,0.064542,3,pass,0.220083;0.214209;0.213000
-boundary_715827883_reverse,6,10,6,bucket32_d16,0.198083,0.168416,0.015750,360,6,1,1,0.064542,3,pass,0.192959;0.201250;0.198083
-boundary_715827883_reverse,6,10,6,bucket32_d64,0.207708,0.171250,0.014625,360,6,1,1,0.064542,3,pass,0.169041;0.213625;0.207708
-boundary_715827883_reverse_masked,6,10,6,old_pull_serial,0.146167,0.145500,0.015542,360,6,1,0,0.050874,3,pass,0.146167;0.151125;0.144083
-boundary_715827883_reverse_masked,6,10,6,old_group_serial,0.121125,0.120500,0.004625,90,2,1,0,0.050874,3,pass,0.113875;0.125375;0.121125
-boundary_715827883_reverse_masked,6,10,6,old_pull_parallel_dag,0.178167,0.142541,0.015375,360,6,1,0,0.050874,3,pass,0.192833;0.178167;0.162709
-boundary_715827883_reverse_masked,6,10,6,old_group_parallel_dag,0.179375,0.116500,0.004750,90,2,1,0,0.050874,3,pass,0.260584;0.147875;0.179375
-boundary_715827883_reverse_masked,6,10,6,pull64_barrier,0.191292,0.164500,0.014750,360,6,1,0,0.050874,3,pass,0.188666;0.193417;0.191292
-boundary_715827883_reverse_masked,6,10,6,pull64_interleaved,0.185625,0.155208,0.014917,360,6,1,0,0.050874,3,pass,0.185625;0.185625;0.199875
-boundary_715827883_reverse_masked,6,10,6,pull32_interleaved,0.205125,0.184083,0.014708,360,6,1,1,0.050874,3,pass,0.205125;0.218167;0.152416
-boundary_715827883_reverse_masked,6,10,6,pull32_gpu_dag,0.456500,0.166667,0.025708,360,6,3,1,0.050874,3,pass,0.448250;0.456500;0.458416
-boundary_715827883_reverse_masked,6,10,6,frontier32_vertex,0.224834,0.192542,0.015500,360,6,1,1,0.050874,3,pass,0.196542;0.224834;0.225916
-boundary_715827883_reverse_masked,6,10,6,frontier32_simd,0.240625,0.216833,0.017708,360,6,1,1,0.050874,3,pass,0.266959;0.216208;0.240625
-boundary_715827883_reverse_masked,6,10,6,frontier32_gpu_dag,0.453500,0.159958,0.024583,360,6,3,1,0.050874,3,pass,0.492083;0.453500;0.440208
-boundary_715827883_reverse_masked,6,10,6,bucket32_d4,0.214875,0.172750,0.014792,360,6,1,1,0.050874,3,pass,0.247000;0.193750;0.214875
-boundary_715827883_reverse_masked,6,10,6,bucket32_d16,0.187625,0.160917,0.015458,360,6,1,1,0.050874,3,pass,0.187625;0.181125;0.195459
-boundary_715827883_reverse_masked,6,10,6,bucket32_d64,0.197041,0.165458,0.014458,360,6,1,1,0.050874,3,pass,0.218791;0.189042;0.197041
-boundary_9007199254740993,6,10,6,old_pull_serial,0.151375,0.150709,0.015500,360,6,1,0,0.076292,3,pass,0.151708;0.151375;0.139125
-boundary_9007199254740993,6,10,6,old_group_serial,0.130667,0.130000,0.007292,160,5,1,0,0.076292,3,pass,0.133083;0.130667;0.128084
-boundary_9007199254740993,6,10,6,old_pull_parallel_dag,0.158459,0.127875,0.013000,360,6,1,0,0.076292,3,pass,0.174083;0.158459;0.155833
-boundary_9007199254740993,6,10,6,old_group_parallel_dag,0.153917,0.114500,0.007250,160,5,1,0,0.076292,3,pass,0.139083;0.153917;0.216042
-boundary_9007199254740993,6,10,6,pull64_barrier,0.212041,0.185541,0.018250,360,6,1,0,0.076292,3,pass,0.222208;0.212041;0.211666
-boundary_9007199254740993,6,10,6,pull64_interleaved,0.220791,0.200791,0.018500,360,6,1,0,0.076292,3,pass,0.213500;0.225792;0.220791
-boundary_9007199254740993,6,10,6,pull32_interleaved,0.217666,0.176209,0.018500,360,6,1,1,0.076292,3,pass,0.219917;0.217666;0.196792
-boundary_9007199254740993,6,10,6,pull32_gpu_dag,0.463208,0.164083,0.025750,360,6,3,1,0.076292,3,pass,0.441750;0.509791;0.463208
-boundary_9007199254740993,6,10,6,frontier32_vertex,0.201125,0.172583,0.015042,360,6,1,1,0.076292,3,pass,0.201125;0.204333;0.196791
-boundary_9007199254740993,6,10,6,frontier32_simd,0.214166,0.189625,0.018167,360,6,1,1,0.076292,3,pass,0.189208;0.214166;0.248125
-boundary_9007199254740993,6,10,6,frontier32_gpu_dag,0.478042,0.168875,0.025083,360,6,3,1,0.076292,3,pass,0.478042;0.488375;0.465625
-boundary_9007199254740993,6,10,6,bucket32_d4,0.173833,0.150083,0.015000,360,6,1,1,0.076292,3,pass,0.178250;0.165500;0.173833
-boundary_9007199254740993,6,10,6,bucket32_d16,0.195291,0.176625,0.015875,360,6,1,1,0.076292,3,pass,0.195291;0.169709;0.214875
-boundary_9007199254740993,6,10,6,bucket32_d64,0.214458,0.185625,0.018375,360,6,1,1,0.076292,3,pass,0.214958;0.214458;0.209167
-boundary_9007199254740993_masked,6,10,6,old_pull_serial,0.134875,0.133917,0.013500,360,6,1,0,0.047375,3,pass,0.135166;0.131916;0.134875
-boundary_9007199254740993_masked,6,10,6,old_group_serial,0.115042,0.114542,0.004500,80,2,1,0,0.047375,3,pass,0.116834;0.115042;0.114791
-boundary_9007199254740993_masked,6,10,6,old_pull_parallel_dag,0.170084,0.138917,0.013500,360,6,1,0,0.047375,3,pass,0.176333;0.167167;0.170084
-boundary_9007199254740993_masked,6,10,6,old_group_parallel_dag,0.145709,0.115500,0.004542,80,2,1,0,0.047375,3,pass,0.150375;0.139542;0.145709
-boundary_9007199254740993_masked,6,10,6,pull64_barrier,0.190417,0.166334,0.015000,360,6,1,0,0.047375,3,pass,0.184792;0.190417;0.223041
-boundary_9007199254740993_masked,6,10,6,pull64_interleaved,0.203709,0.175542,0.015750,360,6,1,0,0.047375,3,pass,0.285042;0.176916;0.203709
-boundary_9007199254740993_masked,6,10,6,pull32_interleaved,0.203958,0.167292,0.015750,360,6,1,1,0.047375,3,pass,0.197000;0.203958;0.214125
-boundary_9007199254740993_masked,6,10,6,pull32_gpu_dag,0.539333,0.189458,0.029250,360,6,3,1,0.047375,3,pass,0.608375;0.518625;0.539333
-boundary_9007199254740993_masked,6,10,6,frontier32_vertex,0.232208,0.197458,0.018208,360,6,1,1,0.047375,3,pass,0.221042;0.240625;0.232208
-boundary_9007199254740993_masked,6,10,6,frontier32_simd,0.233917,0.196458,0.018125,360,6,1,1,0.047375,3,pass,0.223083;0.240792;0.233917
-boundary_9007199254740993_masked,6,10,6,frontier32_gpu_dag,0.422375,0.155167,0.024625,360,6,3,1,0.047375,3,pass,0.490000;0.414500;0.422375
-boundary_9007199254740993_masked,6,10,6,bucket32_d4,0.208042,0.167500,0.015833,360,6,1,1,0.047375,3,pass,0.171542;0.251167;0.208042
-boundary_9007199254740993_masked,6,10,6,bucket32_d16,0.211583,0.184792,0.018250,360,6,1,1,0.047375,3,pass,0.207250;0.211583;0.235791
-boundary_9007199254740993_masked,6,10,6,bucket32_d64,0.208375,0.179584,0.015500,360,6,1,1,0.047375,3,pass,0.218709;0.184000;0.208375
-boundary_9007199254740993_reverse,6,10,6,old_pull_serial,0.154083,0.153375,0.015792,360,6,1,0,0.049749,3,pass,0.153750;0.155167;0.154083
-boundary_9007199254740993_reverse,6,10,6,old_group_serial,0.128625,0.127917,0.007000,170,5,1,0,0.049749,3,pass,0.126834;0.128625;0.135833
-boundary_9007199254740993_reverse,6,10,6,old_pull_parallel_dag,0.193166,0.157292,0.015750,360,6,1,0,0.049749,3,pass,0.174334;0.200000;0.193166
-boundary_9007199254740993_reverse,6,10,6,old_group_parallel_dag,0.188292,0.145041,0.007125,170,5,1,0,0.049749,3,pass,0.188292;0.173708;0.291250
-boundary_9007199254740993_reverse,6,10,6,pull64_barrier,0.170083,0.155208,0.015625,360,6,1,0,0.049749,3,pass,0.170083;0.167583;0.223333
-boundary_9007199254740993_reverse,6,10,6,pull64_interleaved,0.201416,0.168208,0.015750,360,6,1,0,0.049749,3,pass,0.202792;0.188833;0.201416
-boundary_9007199254740993_reverse,6,10,6,pull32_interleaved,0.215625,0.186917,0.014750,360,6,1,1,0.049749,3,pass,0.215625;0.282458;0.209250
-boundary_9007199254740993_reverse,6,10,6,pull32_gpu_dag,0.476417,0.157792,0.024708,360,6,3,1,0.049749,3,pass,0.510917;0.476417;0.447250
-boundary_9007199254740993_reverse,6,10,6,frontier32_vertex,0.199833,0.172042,0.014625,360,6,1,1,0.049749,3,pass,0.199833;0.199333;0.214375
-boundary_9007199254740993_reverse,6,10,6,frontier32_simd,0.214166,0.186291,0.017625,360,6,1,1,0.049749,3,pass,0.214166;0.226250;0.209666
-boundary_9007199254740993_reverse,6,10,6,frontier32_gpu_dag,0.489500,0.175208,0.028917,360,6,3,1,0.049749,3,pass,0.490166;0.489500;0.489458
-boundary_9007199254740993_reverse,6,10,6,bucket32_d4,0.221417,0.177333,0.017583,360,6,1,1,0.049749,3,pass,0.224625;0.221417;0.211750
-boundary_9007199254740993_reverse,6,10,6,bucket32_d16,0.195875,0.165959,0.015583,360,6,1,1,0.049749,3,pass,0.202792;0.195875;0.184833
-boundary_9007199254740993_reverse,6,10,6,bucket32_d64,0.203959,0.175333,0.015542,360,6,1,1,0.049749,3,pass,0.217291;0.203959;0.190542
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_serial,0.133000,0.132334,0.013000,360,6,1,0,0.041167,3,pass,0.133000;0.133125;0.128958
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_serial,0.119083,0.118500,0.004750,90,2,1,0,0.041167,3,pass,0.119083;0.119792;0.114042
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_parallel_dag,0.159833,0.137375,0.013125,360,6,1,0,0.041167,3,pass,0.159833;0.146084;0.166167
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_parallel_dag,0.142542,0.113667,0.004625,90,2,1,0,0.041167,3,pass,0.142542;0.134041;0.152000
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_barrier,0.203000,0.176166,0.014958,360,6,1,0,0.041167,3,pass,0.203000;0.223417;0.194500
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_interleaved,0.216167,0.192375,0.018458,360,6,1,0,0.041167,3,pass,0.216167;0.239167;0.214833
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_interleaved,0.228000,0.199625,0.018500,360,6,1,1,0.041167,3,pass,0.212208;0.251917;0.228000
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_gpu_dag,0.477958,0.185875,0.028208,360,6,3,1,0.041167,3,pass,0.513500;0.477958;0.449834
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_vertex,0.200500,0.164375,0.015625,360,6,1,1,0.041167,3,pass,0.200500;0.201750;0.197334
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_simd,0.206292,0.181375,0.015500,360,6,1,1,0.041167,3,pass,0.177125;0.209125;0.206292
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_gpu_dag,0.460708,0.166541,0.024458,360,6,3,1,0.041167,3,pass,0.446750;0.543625;0.460708
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d4,0.198792,0.168667,0.015292,360,6,1,1,0.041167,3,pass,0.195500;0.385292;0.198792
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d16,0.194750,0.169750,0.018125,360,6,1,1,0.041167,3,pass,0.194750;0.219708;0.190083
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d64,0.185584,0.163667,0.015417,360,6,1,1,0.041167,3,pass,0.196542;0.185584;0.179292
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness-sanitized-stderr.txt b/dev/research/metal_pathfinding/optimization/results/correctness-sanitized-stderr.txt
deleted file mode 100644
index d582a21..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness-sanitized-stderr.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-2026-09-27 00:31:08.125 optimized-sanitize[19832:38715213] Metal API Validation Enabled
-2026-09-27 00:31:08.125 optimized-sanitize[19832:38715213] Metal GPU Validation Enabled
-device=Apple M4 Max setup_ms=39.7833 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness-sanitized.csv b/dev/research/metal_pathfinding/optimization/results/correctness-sanitized.csv
deleted file mode 100644
index 4837679..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness-sanitized.csv
+++ /dev/null
@@ -1,337 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random_masked_int64,40,240,8,old_pull_serial,1.305000,1.251917,0.388084,15360,8,1,0,0.187500,3,pass,1.305000;1.505917;1.293750
-random_masked_int64,40,240,8,old_group_serial,0.662375,0.612584,0.239000,9600,6,1,0,0.187500,3,pass,0.709584;0.649000;0.662375
-random_masked_int64,40,240,8,old_pull_parallel_dag,1.278583,1.221584,0.392333,15360,8,1,0,0.187500,3,pass,1.278583;1.620833;0.898625
-random_masked_int64,40,240,8,old_group_parallel_dag,0.944375,0.883166,0.242375,9600,6,1,0,0.187500,3,pass,0.684041;0.944375;0.968250
-random_masked_int64,40,240,8,pull64_barrier,0.858417,0.809750,0.387417,15360,8,1,0,0.187500,3,pass,0.840584;0.940000;0.858417
-random_masked_int64,40,240,8,pull64_interleaved,0.916834,0.887542,0.383708,15360,8,1,0,0.187500,3,pass,0.980791;0.914417;0.916834
-random_masked_int64,40,240,8,pull32_interleaved,0.893708,0.818250,0.384458,15360,8,1,1,0.187500,3,pass,0.893708;0.939958;0.780333
-random_masked_int64,40,240,8,pull32_gpu_dag,1.693708,0.810209,0.543750,15360,8,3,1,0.187500,3,pass,1.801291;1.693708;1.610209
-random_masked_int64,40,240,8,frontier32_vertex,0.870416,0.832084,0.388417,15360,8,1,1,0.187500,3,pass,0.866417;0.870416;1.194333
-random_masked_int64,40,240,8,frontier32_simd,0.861208,0.819958,0.387375,15360,8,1,1,0.187500,3,pass,0.861208;0.842833;0.864708
-random_masked_int64,40,240,8,frontier32_gpu_dag,1.861958,0.874417,0.545708,15360,8,3,1,0.187500,3,pass,1.861958;1.889208;1.675625
-random_masked_int64,40,240,8,bucket32_d4,0.833750,0.785333,0.387375,15360,8,1,1,0.187500,3,pass,0.830167;0.833750;0.892917
-random_masked_int64,40,240,8,bucket32_d16,0.863917,0.836792,0.387875,15360,8,1,1,0.187500,3,pass,0.863917;0.800167;1.445083
-random_masked_int64,40,240,8,bucket32_d64,0.807500,0.786333,0.388625,15360,8,1,1,0.187500,3,pass,0.807500;0.789000;0.919250
-random_masked,43,258,8,old_pull_serial,1.816417,1.765916,0.864583,33024,16,2,0,0.134667,3,pass,1.891250;1.752917;1.816417
-random_masked,43,258,8,old_group_serial,0.745500,0.697542,0.388875,14448,9,1,0,0.134667,3,pass,0.798208;0.745500;0.744750
-random_masked,43,258,8,old_pull_parallel_dag,1.871250,1.797750,0.864750,33024,16,2,0,0.134667,3,pass,1.871250;1.811917;1.984583
-random_masked,43,258,8,old_group_parallel_dag,0.810250,0.755792,0.389375,14448,9,1,0,0.134667,3,pass,0.793417;0.927500;0.810250
-random_masked,43,258,8,pull64_barrier,1.677125,1.634167,0.874458,33024,16,2,0,0.134667,3,pass,1.700375;1.677125;1.629541
-random_masked,43,258,8,pull64_interleaved,1.780833,1.706875,0.849500,33024,16,2,0,0.134667,3,pass,1.780833;2.399292;1.724625
-random_masked,43,258,8,pull32_interleaved,1.692917,1.629125,0.832417,33024,16,2,0,0.134667,3,pass,1.668875;1.946625;1.692917
-random_masked,43,258,8,pull32_gpu_dag,2.853875,1.804708,1.005667,33024,16,4,0,0.134667,3,pass,2.853875;2.712750;3.286375
-random_masked,43,258,8,frontier32_vertex,2.068750,2.032708,1.006875,3186,16,2,0,0.134667,3,pass,2.099875;2.068750;2.005750
-random_masked,43,258,8,frontier32_simd,1.752541,1.680541,0.715792,3186,16,2,0,0.134667,3,pass,1.767250;1.705959;1.752541
-random_masked,43,258,8,frontier32_gpu_dag,2.701125,1.739500,0.889792,3186,16,4,0,0.134667,3,pass,2.713208;2.701125;2.674958
-random_masked,43,258,8,bucket32_d4,5.472583,5.439167,2.785792,2016,32,4,0,0.134667,3,pass,5.472583;5.632459;5.401875
-random_masked,43,258,8,bucket32_d16,4.053875,4.000750,1.943625,2142,24,3,0,0.134667,3,pass,4.177917;4.053875;3.912167
-random_masked,43,258,8,bucket32_d64,2.552333,2.496084,1.264875,3096,16,2,0,0.134667,3,pass,2.517542;2.552333;2.737708
-random_masked_int64_reverse,46,276,8,old_pull_serial,0.725666,0.680958,0.277125,17664,8,1,0,0.114291,3,pass,0.725666;0.723708;0.774292
-random_masked_int64_reverse,46,276,8,old_group_serial,0.499333,0.453375,0.139292,9660,5,1,0,0.114291,3,pass,0.503500;0.499333;0.497209
-random_masked_int64_reverse,46,276,8,old_pull_parallel_dag,0.768667,0.727833,0.273125,17664,8,1,0,0.114291,3,pass,0.756125;0.768667;0.845458
-random_masked_int64_reverse,46,276,8,old_group_parallel_dag,0.537541,0.473708,0.139583,9660,5,1,0,0.114291,3,pass,0.488792;0.605750;0.537541
-random_masked_int64_reverse,46,276,8,pull64_barrier,0.699666,0.659833,0.279792,17664,8,1,0,0.114291,3,pass,0.690500;0.699666;0.770750
-random_masked_int64_reverse,46,276,8,pull64_interleaved,0.795000,0.759666,0.276500,17664,8,1,0,0.114291,3,pass,0.673833;0.795000;0.807875
-random_masked_int64_reverse,46,276,8,pull32_interleaved,0.701542,0.669667,0.277500,17664,8,1,1,0.114291,3,pass,0.738458;0.699833;0.701542
-random_masked_int64_reverse,46,276,8,pull32_gpu_dag,1.643583,0.757125,0.432958,17664,8,3,1,0.114291,3,pass,1.528334;1.643583;2.293166
-random_masked_int64_reverse,46,276,8,frontier32_vertex,0.812042,0.783500,0.278917,17664,8,1,1,0.114291,3,pass,0.789375;0.812042;0.827167
-random_masked_int64_reverse,46,276,8,frontier32_simd,0.686250,0.659958,0.278958,17664,8,1,1,0.114291,3,pass,0.769750;0.686250;0.677625
-random_masked_int64_reverse,46,276,8,frontier32_gpu_dag,1.673041,0.716709,0.444458,17664,8,3,1,0.114291,3,pass,1.672209;1.686333;1.673041
-random_masked_int64_reverse,46,276,8,bucket32_d4,0.763750,0.711875,0.279542,17664,8,1,1,0.114291,3,pass,0.850292;0.763750;0.711584
-random_masked_int64_reverse,46,276,8,bucket32_d16,0.714417,0.681666,0.279375,17664,8,1,1,0.114291,3,pass,0.730958;0.714417;0.696417
-random_masked_int64_reverse,46,276,8,bucket32_d64,0.819333,0.792500,0.287583,17664,8,1,1,0.114291,3,pass,0.708167;0.862708;0.819333
-random_masked,49,294,8,old_pull_serial,0.912166,0.849334,0.399792,18816,8,1,0,0.131500,3,pass,0.895625;0.912166;0.972667
-random_masked,49,294,8,old_group_serial,0.707958,0.650833,0.334708,14700,8,1,0,0.131500,3,pass,0.695959;0.707958;0.813875
-random_masked,49,294,8,old_pull_parallel_dag,0.953958,0.891208,0.400417,18816,8,1,0,0.131500,3,pass,0.953958;0.925708;0.999541
-random_masked,49,294,8,old_group_parallel_dag,0.732625,0.681541,0.336041,14700,8,1,0,0.131500,3,pass,0.840042;0.732625;0.710167
-random_masked,49,294,8,pull64_barrier,0.980833,0.928208,0.411917,18816,8,1,0,0.131500,3,pass,0.980833;1.019542;0.956458
-random_masked,49,294,8,pull64_interleaved,0.907834,0.873709,0.406750,18816,8,1,0,0.131500,3,pass,0.907834;0.824334;0.919709
-random_masked,49,294,8,pull32_interleaved,0.880542,0.835917,0.400792,18816,8,1,0,0.131500,3,pass,0.926958;0.865916;0.880542
-random_masked,49,294,8,pull32_gpu_dag,1.848041,0.831584,0.555000,18816,8,3,0,0.131500,3,pass,1.851708;1.848041;1.821375
-random_masked,49,294,8,frontier32_vertex,1.280584,1.250875,0.722167,3162,8,1,0,0.131500,3,pass,1.280584;1.279417;1.340833
-random_masked,49,294,8,frontier32_simd,1.044291,1.005875,0.445125,3162,8,1,0,0.131500,3,pass,1.044291;1.055583;1.007334
-random_masked,49,294,8,frontier32_gpu_dag,1.994708,1.010000,0.611417,3162,8,3,0,0.131500,3,pass,1.994708;1.904583;2.033125
-random_masked,49,294,8,bucket32_d4,6.611250,6.579000,3.411958,2022,40,5,0,0.131500,3,pass,6.611250;6.410583;6.744250
-random_masked,49,294,8,bucket32_d16,2.816417,2.782209,1.379792,2100,16,2,0,0.131500,3,pass,2.816417;2.825666;2.779209
-random_masked,49,294,8,bucket32_d64,2.587125,2.546291,1.261875,3042,16,2,0,0.131500,3,pass,2.662292;2.528083;2.587125
-random_masked_int64,52,312,8,old_pull_serial,1.008375,0.936208,0.431125,19968,8,1,0,0.130084,3,pass,0.977584;1.008375;1.090209
-random_masked_int64,52,312,8,old_group_serial,0.734125,0.678209,0.273083,12168,6,1,0,0.130084,3,pass,0.734125;0.675416;0.818375
-random_masked_int64,52,312,8,old_pull_parallel_dag,1.063833,0.981458,0.435875,19968,8,1,0,0.130084,3,pass,1.069209;1.063833;0.975292
-random_masked_int64,52,312,8,old_group_parallel_dag,0.686000,0.634333,0.273375,12168,6,1,0,0.130084,3,pass,0.686000;0.677208;0.706125
-random_masked_int64,52,312,8,pull64_barrier,0.988333,0.939583,0.442167,19968,8,1,0,0.130084,3,pass,1.042667;0.988333;0.958750
-random_masked_int64,52,312,8,pull64_interleaved,0.941458,0.907416,0.431375,19968,8,1,0,0.130084,3,pass,0.995000;0.941458;0.899333
-random_masked_int64,52,312,8,pull32_interleaved,0.905667,0.842833,0.432833,19968,8,1,1,0.130084,3,pass,0.884083;0.963625;0.905667
-random_masked_int64,52,312,8,pull32_gpu_dag,1.744917,0.859709,0.600709,19968,8,3,1,0.130084,3,pass,1.744917;1.952834;1.730417
-random_masked_int64,52,312,8,frontier32_vertex,0.942875,0.908416,0.443208,19968,8,1,1,0.130084,3,pass,1.126625;0.942875;0.903625
-random_masked_int64,52,312,8,frontier32_simd,0.930000,0.893125,0.444292,19968,8,1,1,0.130084,3,pass,1.035125;0.900375;0.930000
-random_masked_int64,52,312,8,frontier32_gpu_dag,1.817958,0.863041,0.621125,19968,8,3,1,0.130084,3,pass,1.817958;1.958042;1.713334
-random_masked_int64,52,312,8,bucket32_d4,1.009750,0.944959,0.444292,19968,8,1,1,0.130084,3,pass,1.009750;1.031416;0.967042
-random_masked_int64,52,312,8,bucket32_d16,0.990000,0.950875,0.441375,19968,8,1,1,0.130084,3,pass,0.946166;1.003458;0.990000
-random_masked_int64,52,312,8,bucket32_d64,0.956208,0.909084,0.444125,19968,8,1,1,0.130084,3,pass,0.956208;1.163417;0.916875
-random_masked_reverse,55,330,8,old_pull_serial,1.468792,1.411000,0.547750,42240,16,2,0,0.145874,3,pass,1.547333;1.468792;1.416917
-random_masked_reverse,55,330,8,old_group_serial,0.628292,0.555000,0.250792,20130,10,1,0,0.145874,3,pass,0.604167;0.628292;0.647167
-random_masked_reverse,55,330,8,old_pull_parallel_dag,1.589875,1.536666,0.563625,42240,16,2,0,0.145874,3,pass,1.558250;1.589875;1.648709
-random_masked_reverse,55,330,8,old_group_parallel_dag,0.655500,0.609875,0.254042,20130,10,1,0,0.145874,3,pass,0.655500;0.684291;0.620666
-random_masked_reverse,55,330,8,pull64_barrier,1.385209,1.349834,0.555958,42240,16,2,0,0.145874,3,pass,1.370375;1.420375;1.385209
-random_masked_reverse,55,330,8,pull64_interleaved,1.376791,1.336750,0.551458,42240,16,2,0,0.145874,3,pass,1.376791;1.485166;1.334750
-random_masked_reverse,55,330,8,pull32_interleaved,1.521625,1.473958,0.545167,42240,16,2,0,0.145874,3,pass,1.521625;1.556750;1.415291
-random_masked_reverse,55,330,8,pull32_gpu_dag,2.495833,1.471417,0.716917,42240,16,4,0,0.145874,3,pass,2.495833;2.549042;2.468584
-random_masked_reverse,55,330,8,frontier32_vertex,2.342125,2.304500,1.255875,3691,16,2,0,0.145874,3,pass,2.353792;2.315083;2.342125
-random_masked_reverse,55,330,8,frontier32_simd,1.787084,1.743208,0.743833,3691,16,2,0,0.145874,3,pass,1.787084;1.761209;2.490834
-random_masked_reverse,55,330,8,frontier32_gpu_dag,2.778750,1.799208,0.919250,3691,16,4,0,0.145874,3,pass,2.778750;2.952958;2.660834
-random_masked_reverse,55,330,8,bucket32_d4,5.850292,5.799500,2.949250,2455,32,4,0,0.145874,3,pass,5.722000;5.850292;6.357334
-random_masked_reverse,55,330,8,bucket32_d16,4.124625,4.079792,1.998667,2603,24,3,0,0.145874,3,pass,4.202209;3.872583;4.124625
-random_masked_reverse,55,330,8,bucket32_d64,2.865084,2.815584,1.337000,3605,16,2,0,0.145874,3,pass,2.865084;2.912375;2.795334
-random_masked_int64,58,348,8,old_pull_serial,0.872709,0.795709,0.367625,22272,8,1,0,0.140833,3,pass,0.872709;0.911750;0.861792
-random_masked_int64,58,348,8,old_group_serial,0.582042,0.518041,0.195208,13920,5,1,0,0.140833,3,pass,0.600833;0.582042;0.571458
-random_masked_int64,58,348,8,old_pull_parallel_dag,0.925708,0.859042,0.369625,22272,8,1,0,0.140833,3,pass,0.875667;0.925708;0.991000
-random_masked_int64,58,348,8,old_group_parallel_dag,0.591500,0.533333,0.195500,13920,5,1,0,0.140833,3,pass,0.570542;0.615000;0.591500
-random_masked_int64,58,348,8,pull64_barrier,0.888500,0.827500,0.373000,22272,8,1,0,0.140833,3,pass,0.888500;0.842500;0.918833
-random_masked_int64,58,348,8,pull64_interleaved,0.856625,0.803667,0.364000,22272,8,1,0,0.140833,3,pass,0.807459;0.856625;0.887834
-random_masked_int64,58,348,8,pull32_interleaved,0.867709,0.820791,0.365125,22272,8,1,1,0.140833,3,pass,0.867709;0.974041;0.866375
-random_masked_int64,58,348,8,pull32_gpu_dag,1.867583,0.887667,0.521750,22272,8,3,1,0.140833,3,pass,1.941917;1.784875;1.867583
-random_masked_int64,58,348,8,frontier32_vertex,0.856625,0.815334,0.371167,22272,8,1,1,0.140833,3,pass,0.856625;0.830417;0.954167
-random_masked_int64,58,348,8,frontier32_simd,0.849583,0.811958,0.373375,22272,8,1,1,0.140833,3,pass,0.831125;0.855291;0.849583
-random_masked_int64,58,348,8,frontier32_gpu_dag,1.659250,0.743042,0.533083,22272,8,3,1,0.140833,3,pass,1.560875;1.762667;1.659250
-random_masked_int64,58,348,8,bucket32_d4,0.899042,0.835083,0.373625,22272,8,1,1,0.140833,3,pass,0.966625;0.899042;0.873084
-random_masked_int64,58,348,8,bucket32_d16,0.910541,0.856459,0.373750,22272,8,1,1,0.140833,3,pass,0.910541;1.533667;0.883916
-random_masked_int64,58,348,8,bucket32_d64,0.893583,0.853333,0.372958,22272,8,1,1,0.140833,3,pass,0.803375;0.893583;0.899000
-random_masked,61,366,8,old_pull_serial,1.854125,1.769125,0.870042,46848,16,2,0,0.123125,3,pass,1.854125;1.937959;1.735333
-random_masked,61,366,8,old_group_serial,0.791958,0.719834,0.400583,23424,9,1,0,0.123125,3,pass,0.748750;0.791958;0.793584
-random_masked,61,366,8,old_pull_parallel_dag,1.979500,1.922542,0.870375,46848,16,2,0,0.123125,3,pass,1.889000;2.052833;1.979500
-random_masked,61,366,8,old_group_parallel_dag,0.820458,0.764166,0.425292,23424,9,1,0,0.123125,3,pass,0.820458;0.836709;0.781541
-random_masked,61,366,8,pull64_barrier,1.749375,1.692542,0.875958,46848,16,2,0,0.123125,3,pass,1.749375;1.930875;1.732417
-random_masked,61,366,8,pull64_interleaved,2.035125,1.985166,0.864833,46848,16,2,0,0.123125,3,pass,2.035125;2.042292;1.776708
-random_masked,61,366,8,pull32_interleaved,1.778542,1.701709,0.847667,46848,16,2,0,0.123125,3,pass,1.744000;1.778542;1.834250
-random_masked,61,366,8,pull32_gpu_dag,2.837875,1.714542,1.017125,46848,16,4,0,0.123125,3,pass,2.837875;2.750916;2.866750
-random_masked,61,366,8,frontier32_vertex,2.246167,2.191792,1.042292,4776,16,2,0,0.123125,3,pass,2.209041;2.247041;2.246167
-random_masked,61,366,8,frontier32_simd,1.770291,1.724917,0.722583,4776,16,2,0,0.123125,3,pass,1.730292;1.813792;1.770291
-random_masked,61,366,8,frontier32_gpu_dag,2.942834,1.920750,0.893500,4776,16,4,0,0.123125,3,pass,2.942834;3.091875;2.812417
-random_masked,61,366,8,bucket32_d4,6.850750,6.795292,3.736667,2760,40,5,0,0.123125,3,pass,7.512667;6.758334;6.850750
-random_masked,61,366,8,bucket32_d16,4.147667,4.106708,2.052875,2952,24,3,0,0.123125,3,pass,4.100166;4.667291;4.147667
-random_masked,61,366,8,bucket32_d64,2.798166,2.741958,1.319584,4596,16,2,0,0.123125,3,pass,2.756084;3.563709;2.798166
-random_masked_int64_reverse,64,384,8,old_pull_serial,0.886167,0.795042,0.279500,24576,8,1,0,0.147292,3,pass,0.886167;0.924708;0.759458
-random_masked_int64_reverse,64,384,8,old_group_serial,0.507208,0.449959,0.141625,13440,5,1,0,0.147292,3,pass,0.507208;0.502583;0.509542
-random_masked_int64_reverse,64,384,8,old_pull_parallel_dag,0.732416,0.688709,0.281375,24576,8,1,0,0.147292,3,pass,0.732416;1.318458;0.720583
-random_masked_int64_reverse,64,384,8,old_group_parallel_dag,0.466750,0.434750,0.142042,13440,5,1,0,0.147292,3,pass,0.491667;0.466750;0.456500
-random_masked_int64_reverse,64,384,8,pull64_barrier,0.677125,0.645208,0.289000,24576,8,1,0,0.147292,3,pass,0.678833;0.671916;0.677125
-random_masked_int64_reverse,64,384,8,pull64_interleaved,0.685625,0.651416,0.279750,24576,8,1,0,0.147292,3,pass,0.675625;0.718500;0.685625
-random_masked_int64_reverse,64,384,8,pull32_interleaved,0.719459,0.686375,0.279750,24576,8,1,1,0.147292,3,pass,0.718459;0.739583;0.719459
-random_masked_int64_reverse,64,384,8,pull32_gpu_dag,1.532500,0.645084,0.439208,24576,8,3,1,0.147292,3,pass,1.444958;1.578208;1.532500
-random_masked_int64_reverse,64,384,8,frontier32_vertex,1.130167,1.083291,0.283625,24576,8,1,1,0.147292,3,pass,0.664542;3.123333;1.130167
-random_masked_int64_reverse,64,384,8,frontier32_simd,0.741375,0.696458,0.286042,24576,8,1,1,0.147292,3,pass,0.741375;0.843708;0.697667
-random_masked_int64_reverse,64,384,8,frontier32_gpu_dag,1.513292,0.679583,0.447292,24576,8,3,1,0.147292,3,pass,1.513292;1.511542;4.620750
-random_masked_int64_reverse,64,384,8,bucket32_d4,0.714208,0.677750,0.282125,24576,8,1,1,0.147292,3,pass,0.689625;0.714208;1.098000
-random_masked_int64_reverse,64,384,8,bucket32_d16,0.723459,0.685500,0.281542,24576,8,1,1,0.147292,3,pass,0.718500;0.768875;0.723459
-random_masked_int64_reverse,64,384,8,bucket32_d64,0.729791,0.695958,0.284250,24576,8,1,1,0.147292,3,pass,0.796542;0.725416;0.729791
-random_masked,67,402,8,old_pull_serial,0.857292,0.785291,0.370417,25728,8,1,0,0.128293,3,pass,0.837916;0.857292;0.890875
-random_masked,67,402,8,old_group_serial,0.668833,0.594291,0.296083,24522,8,1,0,0.128293,3,pass,0.672292;0.664500;0.668833
-random_masked,67,402,8,old_pull_parallel_dag,0.928375,0.891000,0.373042,25728,8,1,0,0.128293,3,pass,0.888000;0.928375;0.974042
-random_masked,67,402,8,old_group_parallel_dag,0.723875,0.671833,0.297042,24522,8,1,0,0.128293,3,pass,0.723875;0.910833;0.642500
-random_masked,67,402,8,pull64_barrier,0.831834,0.788125,0.378083,25728,8,1,0,0.128293,3,pass,0.817416;0.855125;0.831834
-random_masked,67,402,8,pull64_interleaved,0.829583,0.785417,0.370458,25728,8,1,0,0.128293,3,pass,0.829583;0.820084;0.854083
-random_masked,67,402,8,pull32_interleaved,0.804083,0.767791,0.361458,25728,8,1,0,0.128293,3,pass,0.804083;0.839708;0.797292
-random_masked,67,402,8,pull32_gpu_dag,1.623708,0.745958,0.508833,25728,8,3,0,0.128293,3,pass,1.654500;1.565750;1.623708
-random_masked,67,402,8,frontier32_vertex,1.267000,1.217542,0.746125,5034,8,1,0,0.128293,3,pass,1.245000;1.289917;1.267000
-random_masked,67,402,8,frontier32_simd,1.016708,0.960041,0.448250,5034,8,1,0,0.128293,3,pass,1.627917;1.016708;1.000916
-random_masked,67,402,8,frontier32_gpu_dag,1.809334,0.957875,0.597875,5034,8,3,0,0.128293,3,pass,1.787542;1.809334;1.864500
-random_masked,67,402,8,bucket32_d4,5.585500,5.529125,2.872125,3120,32,4,0,0.128293,3,pass,5.370417;6.061667;5.585500
-random_masked,67,402,8,bucket32_d16,3.892917,3.851583,1.985375,3360,24,3,0,0.128293,3,pass,3.892917;4.481458;3.838959
-random_masked,67,402,8,bucket32_d64,2.534042,2.490375,1.256000,4914,16,2,0,0.128293,3,pass,2.534042;2.637875;2.526750
-random_masked_int64,70,420,8,old_pull_serial,0.912250,0.837084,0.427291,26880,8,1,0,0.124334,3,pass,0.898458;0.912250;0.922583
-random_masked_int64,70,420,8,old_group_serial,0.656833,0.587292,0.267500,15960,6,1,0,0.124334,3,pass,0.656833;0.635209;0.685292
-random_masked_int64,70,420,8,old_pull_parallel_dag,1.011333,0.946708,0.429375,26880,8,1,0,0.124334,3,pass,1.072625;1.011333;0.990667
-random_masked_int64,70,420,8,old_group_parallel_dag,0.727625,0.678417,0.267084,15960,6,1,0,0.124334,3,pass,0.691584;0.727625;0.745875
-random_masked_int64,70,420,8,pull64_barrier,1.078958,1.021458,0.458000,26880,8,1,0,0.124334,3,pass,1.012542;1.103167;1.078958
-random_masked_int64,70,420,8,pull64_interleaved,0.923167,0.876958,0.438125,26880,8,1,0,0.124334,3,pass,1.001875;0.923167;0.846208
-random_masked_int64,70,420,8,pull32_interleaved,1.027959,0.985125,0.443792,26880,8,1,1,0.124334,3,pass,0.960584;1.518167;1.027959
-random_masked_int64,70,420,8,pull32_gpu_dag,1.744000,0.867250,0.607000,26880,8,3,1,0.124334,3,pass,1.803875;1.744000;1.733875
-random_masked_int64,70,420,8,frontier32_vertex,0.913333,0.869584,0.444000,26880,8,1,1,0.124334,3,pass,0.849500;0.913333;1.494042
-random_masked_int64,70,420,8,frontier32_simd,1.054834,1.027084,0.473750,26880,8,1,1,0.124334,3,pass,1.054834;1.143834;0.988292
-random_masked_int64,70,420,8,frontier32_gpu_dag,1.867833,0.975291,0.639917,26880,8,3,1,0.124334,3,pass,1.995833;1.805875;1.867833
-random_masked_int64,70,420,8,bucket32_d4,0.923167,0.887625,0.468917,26880,8,1,1,0.124334,3,pass,0.840583;1.055541;0.923167
-random_masked_int64,70,420,8,bucket32_d16,0.996375,0.960125,0.446250,26880,8,1,1,0.124334,3,pass,1.016292;0.912750;0.996375
-random_masked_int64,70,420,8,bucket32_d64,0.946958,0.915833,0.462458,26880,8,1,1,0.124334,3,pass,0.946958;1.079209;0.843833
-random_masked_reverse,73,438,8,old_pull_serial,1.544708,1.479625,0.626833,56064,16,2,0,0.127917,3,pass,1.593958;1.537750;1.544708
-random_masked_reverse,73,438,8,old_group_serial,0.616500,0.552708,0.252333,30222,10,1,0,0.127917,3,pass,0.664708;0.616500;0.604208
-random_masked_reverse,73,438,8,old_pull_parallel_dag,1.573667,1.535500,0.613583,56064,16,2,0,0.127917,3,pass,1.573667;1.498833;1.613833
-random_masked_reverse,73,438,8,old_group_parallel_dag,0.605708,0.567584,0.256000,30222,10,1,0,0.127917,3,pass,0.636500;0.605708;0.572500
-random_masked_reverse,73,438,8,pull64_barrier,1.501625,1.458875,0.610542,56064,16,2,0,0.127917,3,pass,1.501625;1.509291;1.430958
-random_masked_reverse,73,438,8,pull64_interleaved,1.434334,1.403000,0.619042,56064,16,2,0,0.127917,3,pass,1.453458;1.405166;1.434334
-random_masked_reverse,73,438,8,pull32_interleaved,1.384458,1.352667,0.597333,56064,16,2,0,0.127917,3,pass,1.371959;1.692083;1.384458
-random_masked_reverse,73,438,8,pull32_gpu_dag,2.072333,1.277333,0.753209,56064,16,4,0,0.127917,3,pass,2.072333;1.848416;2.650459
-random_masked_reverse,73,438,8,frontier32_vertex,2.110666,2.066958,1.024083,5335,16,2,0,0.127917,3,pass,2.153834;2.110666;1.736583
-random_masked_reverse,73,438,8,frontier32_simd,1.530708,1.489292,0.361042,5335,16,2,0,0.127917,3,pass,1.555208;1.530708;1.270708
-random_masked_reverse,73,438,8,frontier32_gpu_dag,2.006667,1.291750,0.472458,5335,16,4,0,0.127917,3,pass,2.064667;1.931875;2.006667
-random_masked_reverse,73,438,8,bucket32_d4,3.628500,3.593417,1.164083,3179,32,4,0,0.127917,3,pass,3.628500;3.704042;3.569250
-random_masked_reverse,73,438,8,bucket32_d16,2.702375,2.656292,0.743625,3402,24,3,0,0.127917,3,pass,2.702375;2.782959;2.543667
-random_masked_reverse,73,438,8,bucket32_d64,1.697042,1.630166,0.391417,4984,16,2,0,0.127917,3,pass,1.697791;1.697042;1.622875
-boundary_700000000,6,10,6,old_pull_serial,0.450042,0.446083,0.050917,360,6,1,0,0.105417,3,pass,0.452375;0.431208;0.450042
-boundary_700000000,6,10,6,old_group_serial,0.330833,0.326875,0.025167,160,5,1,0,0.105417,3,pass,0.330833;0.332792;0.302000
-boundary_700000000,6,10,6,old_pull_parallel_dag,0.430000,0.400375,0.045375,360,6,1,0,0.105417,3,pass,0.486917;0.418167;0.430000
-boundary_700000000,6,10,6,old_group_parallel_dag,0.342333,0.314875,0.024750,160,5,1,0,0.105417,3,pass,0.322084;0.372750;0.342333
-boundary_700000000,6,10,6,pull64_barrier,0.689042,0.662291,0.044333,360,6,1,0,0.105417,3,pass,0.689042;0.763417;0.437542
-boundary_700000000,6,10,6,pull64_interleaved,0.395875,0.375292,0.042625,360,6,1,0,0.105417,3,pass,0.442584;0.395875;0.359333
-boundary_700000000,6,10,6,pull32_interleaved,0.455250,0.423209,0.046250,360,6,1,0,0.105417,3,pass,0.455250;0.649666;0.450333
-boundary_700000000,6,10,6,pull32_gpu_dag,1.057541,0.377000,0.075125,360,6,3,0,0.105417,3,pass,1.231958;1.057541;0.958209
-boundary_700000000,6,10,6,frontier32_vertex,0.632458,0.549625,0.107417,24,8,1,0,0.105417,3,pass,0.543541;0.632458;0.826583
-boundary_700000000,6,10,6,frontier32_simd,0.626792,0.597666,0.108833,24,8,1,0,0.105417,3,pass,0.626792;0.647666;0.575416
-boundary_700000000,6,10,6,frontier32_gpu_dag,1.233375,0.530292,0.134750,24,8,3,0,0.105417,3,pass,1.233375;1.230709;1.302791
-boundary_700000000,6,10,6,bucket32_d4,0.807208,0.783417,0.213333,24,8,1,0,0.105417,3,pass,0.840667;0.807208;0.804500
-boundary_700000000,6,10,6,bucket32_d16,0.702917,0.685959,0.179500,24,8,1,0,0.105417,3,pass,0.697541;0.702917;0.755500
-boundary_700000000,6,10,6,bucket32_d64,0.827875,0.783166,0.208208,24,8,1,0,0.105417,3,pass,0.827875;0.772708;0.840750
-boundary_700000000_masked,6,10,6,old_pull_serial,0.421041,0.416459,0.038000,360,6,1,0,0.080167,3,pass,0.421041;0.501542;0.378208
-boundary_700000000_masked,6,10,6,old_group_serial,0.305292,0.301667,0.014292,80,2,1,0,0.080167,3,pass,0.284583;0.305292;0.322459
-boundary_700000000_masked,6,10,6,old_pull_parallel_dag,0.439750,0.403625,0.042625,360,6,1,0,0.080167,3,pass,0.408709;0.439750;0.440084
-boundary_700000000_masked,6,10,6,old_group_parallel_dag,0.330541,0.295834,0.014417,80,2,1,0,0.080167,3,pass,0.343875;0.330541;0.304542
-boundary_700000000_masked,6,10,6,pull64_barrier,0.417709,0.383416,0.040542,360,6,1,0,0.080167,3,pass,0.417709;0.403792;0.528708
-boundary_700000000_masked,6,10,6,pull64_interleaved,0.416667,0.379250,0.040250,360,6,1,0,0.080167,3,pass,0.416667;0.397209;0.430666
-boundary_700000000_masked,6,10,6,pull32_interleaved,0.457500,0.430208,0.045333,360,6,1,0,0.080167,3,pass,0.457500;0.435708;0.598250
-boundary_700000000_masked,6,10,6,pull32_gpu_dag,1.022792,0.371750,0.067875,360,6,3,0,0.080167,3,pass,1.119458;1.022792;1.005625
-boundary_700000000_masked,6,10,6,frontier32_vertex,0.556292,0.530166,0.089250,12,8,1,0,0.080167,3,pass,0.648458;0.551208;0.556292
-boundary_700000000_masked,6,10,6,frontier32_simd,0.617417,0.551458,0.099875,12,8,1,0,0.080167,3,pass,0.628041;0.617417;0.596375
-boundary_700000000_masked,6,10,6,frontier32_gpu_dag,1.224500,0.539875,0.131542,12,8,3,0,0.080167,3,pass,1.226667;1.181042;1.224500
-boundary_700000000_masked,6,10,6,bucket32_d4,1.358083,1.303625,0.614208,12,8,1,0,0.080167,3,pass,1.364000;1.358083;1.184459
-boundary_700000000_masked,6,10,6,bucket32_d16,1.254834,1.239333,0.635208,12,8,1,0,0.080167,3,pass,1.313875;1.195792;1.254834
-boundary_700000000_masked,6,10,6,bucket32_d64,1.308541,1.216041,0.597167,12,8,1,0,0.080167,3,pass,1.308541;1.335791;0.780125
-boundary_700000000_reverse,6,10,6,old_pull_serial,0.387208,0.382958,0.039958,360,6,1,0,0.071958,3,pass,0.381959;0.389167;0.387208
-boundary_700000000_reverse,6,10,6,old_group_serial,0.310750,0.306458,0.023083,170,5,1,0,0.071958,3,pass,0.310750;0.307292;0.317333
-boundary_700000000_reverse,6,10,6,old_pull_parallel_dag,0.400125,0.378125,0.040125,360,6,1,0,0.071958,3,pass,0.406125;0.396292;0.400125
-boundary_700000000_reverse,6,10,6,old_group_parallel_dag,0.342708,0.317875,0.022125,170,5,1,0,0.071958,3,pass,0.342708;0.338833;0.484917
-boundary_700000000_reverse,6,10,6,pull64_barrier,0.374834,0.359541,0.041250,360,6,1,0,0.071958,3,pass,0.374834;0.356500;0.380417
-boundary_700000000_reverse,6,10,6,pull64_interleaved,0.420333,0.395584,0.042375,360,6,1,0,0.071958,3,pass,0.377083;0.420333;0.478541
-boundary_700000000_reverse,6,10,6,pull32_interleaved,0.458500,0.429958,0.045708,360,6,1,0,0.071958,3,pass,0.458500;0.479917;0.441708
-boundary_700000000_reverse,6,10,6,pull32_gpu_dag,1.066333,0.375875,0.073083,360,6,3,0,0.071958,3,pass,1.049834;1.066333;1.158167
-boundary_700000000_reverse,6,10,6,frontier32_vertex,0.626292,0.568834,0.109375,24,8,1,0,0.071958,3,pass,0.626292;0.847417;0.549584
-boundary_700000000_reverse,6,10,6,frontier32_simd,0.783334,0.758833,0.116333,24,8,1,0,0.071958,3,pass,0.598333;0.783334;0.790542
-boundary_700000000_reverse,6,10,6,frontier32_gpu_dag,1.511041,0.563125,0.136625,24,8,3,0,0.071958,3,pass,1.142917;1.753667;1.511041
-boundary_700000000_reverse,6,10,6,bucket32_d4,0.741583,0.723667,0.179625,24,8,1,0,0.071958,3,pass,0.767750;0.741583;0.718625
-boundary_700000000_reverse,6,10,6,bucket32_d16,0.799791,0.729834,0.179083,24,8,1,0,0.071958,3,pass,1.065958;0.799791;0.753792
-boundary_700000000_reverse,6,10,6,bucket32_d64,0.753458,0.731125,0.187875,24,8,1,0,0.071958,3,pass,0.753458;0.758500;0.740000
-boundary_700000000_reverse_masked,6,10,6,old_pull_serial,0.395500,0.391917,0.039583,360,6,1,0,0.085167,3,pass,0.363250;0.483334;0.395500
-boundary_700000000_reverse_masked,6,10,6,old_group_serial,0.307708,0.303958,0.016125,90,2,1,0,0.085167,3,pass,0.312625;0.305042;0.307708
-boundary_700000000_reverse_masked,6,10,6,old_pull_parallel_dag,0.461167,0.414625,0.043375,360,6,1,0,0.085167,3,pass,0.443875;0.461167;0.467666
-boundary_700000000_reverse_masked,6,10,6,old_group_parallel_dag,0.340417,0.297875,0.013750,90,2,1,0,0.085167,3,pass,0.340417;0.343625;0.318000
-boundary_700000000_reverse_masked,6,10,6,pull64_barrier,0.463666,0.419667,0.039750,360,6,1,0,0.085167,3,pass,0.407917;0.517917;0.463666
-boundary_700000000_reverse_masked,6,10,6,pull64_interleaved,0.455541,0.433167,0.045167,360,6,1,0,0.085167,3,pass,0.438958;0.455541;0.508042
-boundary_700000000_reverse_masked,6,10,6,pull32_interleaved,0.391958,0.371541,0.041125,360,6,1,0,0.085167,3,pass,0.426292;0.390334;0.391958
-boundary_700000000_reverse_masked,6,10,6,pull32_gpu_dag,1.347625,0.629500,0.252583,360,6,3,0,0.085167,3,pass,1.347625;1.216666;1.603875
-boundary_700000000_reverse_masked,6,10,6,frontier32_vertex,0.839042,0.817750,0.334250,9,8,1,0,0.085167,3,pass,0.833625;0.901042;0.839042
-boundary_700000000_reverse_masked,6,10,6,frontier32_simd,0.880916,0.857125,0.309667,9,8,1,0,0.085167,3,pass,0.872084;0.943459;0.880916
-boundary_700000000_reverse_masked,6,10,6,frontier32_gpu_dag,1.215042,0.522500,0.136833,9,8,3,0,0.085167,3,pass,1.459334;1.215042;1.182167
-boundary_700000000_reverse_masked,6,10,6,bucket32_d4,0.723666,0.701334,0.162125,9,8,1,0,0.085167,3,pass,0.719166;0.723666;0.868584
-boundary_700000000_reverse_masked,6,10,6,bucket32_d16,0.745666,0.728917,0.163375,9,8,1,0,0.085167,3,pass,0.695708;0.745666;0.770333
-boundary_700000000_reverse_masked,6,10,6,bucket32_d64,0.733333,0.705334,0.166125,9,8,1,0,0.085167,3,pass,0.742666;0.733333;0.720541
-boundary_715827883,6,10,6,old_pull_serial,0.377833,0.373833,0.040333,360,6,1,0,0.070542,3,pass,0.377833;0.414583;0.371959
-boundary_715827883,6,10,6,old_group_serial,0.297000,0.292750,0.022625,160,5,1,0,0.070542,3,pass,0.296334;0.304125;0.297000
-boundary_715827883,6,10,6,old_pull_parallel_dag,0.438208,0.403125,0.041333,360,6,1,0,0.070542,3,pass,0.438208;0.429416;0.459250
-boundary_715827883,6,10,6,old_group_parallel_dag,0.374375,0.335542,0.022667,160,5,1,0,0.070542,3,pass,0.468666;0.374375;0.372667
-boundary_715827883,6,10,6,pull64_barrier,0.379917,0.365583,0.041542,360,6,1,0,0.070542,3,pass,0.392208;0.379917;0.376791
-boundary_715827883,6,10,6,pull64_interleaved,0.393125,0.370625,0.041500,360,6,1,0,0.070542,3,pass,0.367208;0.393125;0.477167
-boundary_715827883,6,10,6,pull32_interleaved,0.612458,0.590750,0.047000,360,6,1,1,0.070542,3,pass,0.743291;0.438958;0.612458
-boundary_715827883,6,10,6,pull32_gpu_dag,1.074208,0.355250,0.068666,360,6,3,1,0.070542,3,pass,1.074208;0.986708;1.341750
-boundary_715827883,6,10,6,frontier32_vertex,0.412583,0.380292,0.042125,360,6,1,1,0.070542,3,pass,0.412583;0.405291;0.423417
-boundary_715827883,6,10,6,frontier32_simd,0.413166,0.384167,0.041625,360,6,1,1,0.070542,3,pass,0.413166;0.377958;0.458166
-boundary_715827883,6,10,6,frontier32_gpu_dag,1.384334,0.569333,0.282083,360,6,3,1,0.070542,3,pass,1.719209;1.384334;1.365250
-boundary_715827883,6,10,6,bucket32_d4,0.600750,0.571042,0.180750,360,6,1,1,0.070542,3,pass,0.642666;0.581958;0.600750
-boundary_715827883,6,10,6,bucket32_d16,0.668834,0.643750,0.181292,360,6,1,1,0.070542,3,pass,0.631583;0.668834;0.742334
-boundary_715827883,6,10,6,bucket32_d64,0.595917,0.559542,0.045292,360,6,1,1,0.070542,3,pass,0.631375;0.595917;0.441041
-boundary_715827883_masked,6,10,6,old_pull_serial,0.404792,0.401333,0.042542,360,6,1,0,0.082292,3,pass,0.392541;0.404792;0.415416
-boundary_715827883_masked,6,10,6,old_group_serial,0.306167,0.301917,0.013833,80,2,1,0,0.082292,3,pass,0.289250;0.306167;0.312125
-boundary_715827883_masked,6,10,6,old_pull_parallel_dag,0.438875,0.405791,0.041792,360,6,1,0,0.082292,3,pass,0.438875;0.413625;0.444334
-boundary_715827883_masked,6,10,6,old_group_parallel_dag,0.332792,0.303459,0.013875,80,2,1,0,0.082292,3,pass,0.348167;0.332792;0.306375
-boundary_715827883_masked,6,10,6,pull64_barrier,0.437084,0.401333,0.041667,360,6,1,0,0.082292,3,pass,0.437084;0.464041;0.417958
-boundary_715827883_masked,6,10,6,pull64_interleaved,0.463666,0.427625,0.045125,360,6,1,0,0.082292,3,pass,0.429875;0.469958;0.463666
-boundary_715827883_masked,6,10,6,pull32_interleaved,0.415291,0.387667,0.041375,360,6,1,1,0.082292,3,pass,0.425458;0.415291;0.401333
-boundary_715827883_masked,6,10,6,pull32_gpu_dag,1.047000,0.389375,0.070792,360,6,3,1,0.082292,3,pass,1.063250;1.047000;0.970833
-boundary_715827883_masked,6,10,6,frontier32_vertex,0.368166,0.350833,0.040250,360,6,1,1,0.082292,3,pass,0.366167;0.368166;0.414125
-boundary_715827883_masked,6,10,6,frontier32_simd,0.491625,0.463958,0.044000,360,6,1,1,0.082292,3,pass,0.436333;0.491625;0.650084
-boundary_715827883_masked,6,10,6,frontier32_gpu_dag,1.137000,0.406209,0.071458,360,6,3,1,0.082292,3,pass,1.277791;1.137000;1.065125
-boundary_715827883_masked,6,10,6,bucket32_d4,0.582667,0.549583,0.178500,360,6,1,1,0.082292,3,pass,0.582667;0.599250;0.575833
-boundary_715827883_masked,6,10,6,bucket32_d16,0.610792,0.579875,0.174542,360,6,1,1,0.082292,3,pass,0.610792;0.736708;0.537292
-boundary_715827883_masked,6,10,6,bucket32_d64,0.571958,0.552042,0.170167,360,6,1,1,0.082292,3,pass,0.579792;0.571958;0.564417
-boundary_715827883_reverse,6,10,6,old_pull_serial,0.564958,0.560750,0.177250,360,6,1,0,0.088167,3,pass,0.541583;0.576375;0.564958
-boundary_715827883_reverse,6,10,6,old_group_serial,0.376250,0.372000,0.091375,170,5,1,0,0.088167,3,pass,0.367375;0.376250;0.382041
-boundary_715827883_reverse,6,10,6,old_pull_parallel_dag,0.567417,0.539208,0.163583,360,6,1,0,0.088167,3,pass,0.573791;0.547458;0.567417
-boundary_715827883_reverse,6,10,6,old_group_parallel_dag,0.305291,0.288583,0.022750,170,5,1,0,0.088167,3,pass,0.305291;0.302125;0.309709
-boundary_715827883_reverse,6,10,6,pull64_barrier,0.460708,0.426208,0.045167,360,6,1,0,0.088167,3,pass,0.492458;0.421625;0.460708
-boundary_715827883_reverse,6,10,6,pull64_interleaved,0.435334,0.412333,0.042250,360,6,1,0,0.088167,3,pass,0.435334;0.454125;0.424500
-boundary_715827883_reverse,6,10,6,pull32_interleaved,0.385625,0.368458,0.040750,360,6,1,1,0.088167,3,pass,0.385625;0.387041;0.383000
-boundary_715827883_reverse,6,10,6,pull32_gpu_dag,1.081250,0.390458,0.075959,360,6,3,1,0.088167,3,pass,1.081250;1.069625;1.083667
-boundary_715827883_reverse,6,10,6,frontier32_vertex,0.425000,0.388166,0.040250,360,6,1,1,0.088167,3,pass,0.425000;0.412125;0.445916
-boundary_715827883_reverse,6,10,6,frontier32_simd,0.431416,0.398958,0.040792,360,6,1,1,0.088167,3,pass,0.405833;0.511792;0.431416
-boundary_715827883_reverse,6,10,6,frontier32_gpu_dag,1.369542,0.508833,0.071875,360,6,3,1,0.088167,3,pass,1.489667;1.369542;1.167458
-boundary_715827883_reverse,6,10,6,bucket32_d4,0.435250,0.395208,0.040750,360,6,1,1,0.088167,3,pass,0.445667;0.427834;0.435250
-boundary_715827883_reverse,6,10,6,bucket32_d16,0.418208,0.394292,0.041917,360,6,1,1,0.088167,3,pass,0.410542;0.448417;0.418208
-boundary_715827883_reverse,6,10,6,bucket32_d64,0.458000,0.432750,0.045125,360,6,1,1,0.088167,3,pass,0.458000;0.467375;0.439291
-boundary_715827883_reverse_masked,6,10,6,old_pull_serial,0.538584,0.534166,0.158500,360,6,1,0,0.078416,3,pass,0.578750;0.521167;0.538584
-boundary_715827883_reverse_masked,6,10,6,old_group_serial,0.358166,0.354541,0.051667,90,2,1,0,0.078416,3,pass,0.359292;0.347167;0.358166
-boundary_715827883_reverse_masked,6,10,6,old_pull_parallel_dag,0.556542,0.537291,0.158750,360,6,1,0,0.078416,3,pass,0.581250;0.556542;0.520875
-boundary_715827883_reverse_masked,6,10,6,old_group_parallel_dag,0.514667,0.475334,0.051458,90,2,1,0,0.078416,3,pass,0.514667;0.364625;0.626750
-boundary_715827883_reverse_masked,6,10,6,pull64_barrier,0.586833,0.558083,0.175083,360,6,1,0,0.078416,3,pass,0.586833;0.782458;0.585709
-boundary_715827883_reverse_masked,6,10,6,pull64_interleaved,0.609958,0.568333,0.172708,360,6,1,0,0.078416,3,pass,0.609958;0.616958;0.574458
-boundary_715827883_reverse_masked,6,10,6,pull32_interleaved,0.403750,0.376458,0.039375,360,6,1,1,0.078416,3,pass,0.393625;0.403750;0.409791
-boundary_715827883_reverse_masked,6,10,6,pull32_gpu_dag,1.112084,0.390542,0.071709,360,6,3,1,0.078416,3,pass,1.112084;1.158333;1.060042
-boundary_715827883_reverse_masked,6,10,6,frontier32_vertex,0.405625,0.376625,0.040125,360,6,1,1,0.078416,3,pass,0.397333;0.405625;0.425875
-boundary_715827883_reverse_masked,6,10,6,frontier32_simd,0.482541,0.449083,0.042833,360,6,1,1,0.078416,3,pass,0.710208;0.482541;0.406000
-boundary_715827883_reverse_masked,6,10,6,frontier32_gpu_dag,1.187208,0.422750,0.072208,360,6,3,1,0.078416,3,pass,1.187208;1.268459;1.112833
-boundary_715827883_reverse_masked,6,10,6,bucket32_d4,0.424709,0.407958,0.039625,360,6,1,1,0.078416,3,pass,0.424709;0.436584;0.367500
-boundary_715827883_reverse_masked,6,10,6,bucket32_d16,0.406375,0.381875,0.040500,360,6,1,1,0.078416,3,pass,0.406375;0.397542;0.432791
-boundary_715827883_reverse_masked,6,10,6,bucket32_d64,0.575792,0.537666,0.144083,360,6,1,1,0.078416,3,pass,0.406917;0.777833;0.575792
-boundary_9007199254740993,6,10,6,old_pull_serial,0.525500,0.521500,0.174542,360,6,1,0,0.096042,3,pass,0.521500;0.541750;0.525500
-boundary_9007199254740993,6,10,6,old_group_serial,0.387625,0.383541,0.094458,160,5,1,0,0.096042,3,pass,0.387625;0.387750;0.386791
-boundary_9007199254740993,6,10,6,old_pull_parallel_dag,0.610333,0.568208,0.175750,360,6,1,0,0.096042,3,pass,0.610333;0.697375;0.547167
-boundary_9007199254740993,6,10,6,old_group_parallel_dag,0.646583,0.606333,0.090667,160,5,1,0,0.096042,3,pass,0.427917;0.646583;1.133583
-boundary_9007199254740993,6,10,6,pull64_barrier,0.687000,0.651916,0.174125,360,6,1,0,0.096042,3,pass,0.730583;0.687000;0.581792
-boundary_9007199254740993,6,10,6,pull64_interleaved,0.377208,0.362625,0.041458,360,6,1,0,0.096042,3,pass,0.416625;0.362875;0.377208
-boundary_9007199254740993,6,10,6,pull32_interleaved,0.593708,0.549000,0.047375,360,6,1,1,0.096042,3,pass,0.413750;0.714334;0.593708
-boundary_9007199254740993,6,10,6,pull32_gpu_dag,1.076000,0.408375,0.081917,360,6,3,1,0.096042,3,pass,1.134958;1.076000;0.964667
-boundary_9007199254740993,6,10,6,frontier32_vertex,0.399500,0.367208,0.040625,360,6,1,1,0.096042,3,pass,0.429292;0.399500;0.399416
-boundary_9007199254740993,6,10,6,frontier32_simd,0.415125,0.372750,0.042375,360,6,1,1,0.096042,3,pass,0.415125;0.420542;0.406208
-boundary_9007199254740993,6,10,6,frontier32_gpu_dag,1.079083,0.393625,0.079042,360,6,3,1,0.096042,3,pass,1.150250;1.067292;1.079083
-boundary_9007199254740993,6,10,6,bucket32_d4,0.431958,0.392167,0.042083,360,6,1,1,0.096042,3,pass,0.394916;0.431958;0.539750
-boundary_9007199254740993,6,10,6,bucket32_d16,0.462542,0.422333,0.043000,360,6,1,1,0.096042,3,pass,0.374084;0.462542;0.531959
-boundary_9007199254740993,6,10,6,bucket32_d64,0.385042,0.363875,0.041333,360,6,1,1,0.096042,3,pass,0.385042;0.377375;0.395583
-boundary_9007199254740993_masked,6,10,6,old_pull_serial,0.394458,0.390833,0.041875,360,6,1,0,0.146083,3,pass,0.401709;0.384500;0.394458
-boundary_9007199254740993_masked,6,10,6,old_group_serial,0.280958,0.277500,0.013667,80,2,1,0,0.146083,3,pass,0.277625;0.280958;0.299125
-boundary_9007199254740993_masked,6,10,6,old_pull_parallel_dag,0.436292,0.417209,0.039917,360,6,1,0,0.146083,3,pass,0.436292;0.506750;0.436208
-boundary_9007199254740993_masked,6,10,6,old_group_parallel_dag,0.307708,0.285209,0.013833,80,2,1,0,0.146083,3,pass,0.387042;0.305416;0.307708
-boundary_9007199254740993_masked,6,10,6,pull64_barrier,0.420208,0.390959,0.042667,360,6,1,0,0.146083,3,pass,0.420208;0.747500;0.416834
-boundary_9007199254740993_masked,6,10,6,pull64_interleaved,0.398000,0.374541,0.040250,360,6,1,0,0.146083,3,pass,0.398000;0.392167;0.552042
-boundary_9007199254740993_masked,6,10,6,pull32_interleaved,0.387375,0.359708,0.040542,360,6,1,1,0.146083,3,pass,0.441042;0.387375;0.370584
-boundary_9007199254740993_masked,6,10,6,pull32_gpu_dag,1.014542,0.372792,0.070917,360,6,3,1,0.146083,3,pass,1.049416;1.014542;0.967250
-boundary_9007199254740993_masked,6,10,6,frontier32_vertex,0.385583,0.370250,0.040625,360,6,1,1,0.146083,3,pass,0.385583;0.359292;0.596291
-boundary_9007199254740993_masked,6,10,6,frontier32_simd,0.573042,0.536541,0.173000,360,6,1,1,0.146083,3,pass,0.611750;0.573042;0.544917
-boundary_9007199254740993_masked,6,10,6,frontier32_gpu_dag,1.241792,0.560958,0.259333,360,6,3,1,0.146083,3,pass,1.353917;1.241792;1.178917
-boundary_9007199254740993_masked,6,10,6,bucket32_d4,0.568167,0.533917,0.167250,360,6,1,1,0.146083,3,pass,0.616792;0.527041;0.568167
-boundary_9007199254740993_masked,6,10,6,bucket32_d16,0.784000,0.761333,0.048500,360,6,1,1,0.146083,3,pass,0.902250;0.784000;0.585834
-boundary_9007199254740993_masked,6,10,6,bucket32_d64,0.413292,0.393958,0.040125,360,6,1,1,0.146083,3,pass,0.459500;0.413292;0.405333
-boundary_9007199254740993_reverse,6,10,6,old_pull_serial,0.408625,0.404208,0.043375,360,6,1,0,0.099791,3,pass,0.408625;0.384708;0.412958
-boundary_9007199254740993_reverse,6,10,6,old_group_serial,0.295500,0.291250,0.022292,170,5,1,0,0.099791,3,pass,0.285750;0.349334;0.295500
-boundary_9007199254740993_reverse,6,10,6,old_pull_parallel_dag,0.406709,0.375333,0.039375,360,6,1,0,0.099791,3,pass,0.406709;0.397625;0.418583
-boundary_9007199254740993_reverse,6,10,6,old_group_parallel_dag,0.310584,0.288791,0.022250,170,5,1,0,0.099791,3,pass,0.307500;0.310584;0.383958
-boundary_9007199254740993_reverse,6,10,6,pull64_barrier,0.402291,0.370333,0.040458,360,6,1,0,0.099791,3,pass,0.402291;0.409167;0.400833
-boundary_9007199254740993_reverse,6,10,6,pull64_interleaved,0.417625,0.389083,0.040750,360,6,1,0,0.099791,3,pass,0.417625;0.407709;0.672666
-boundary_9007199254740993_reverse,6,10,6,pull32_interleaved,0.456750,0.422084,0.040875,360,6,1,1,0.099791,3,pass,0.457500;0.386250;0.456750
-boundary_9007199254740993_reverse,6,10,6,pull32_gpu_dag,1.081708,0.380083,0.074334,360,6,3,1,0.099791,3,pass,1.092959;1.081708;1.069709
-boundary_9007199254740993_reverse,6,10,6,frontier32_vertex,0.416292,0.387500,0.041125,360,6,1,1,0.099791,3,pass,0.422542;0.391916;0.416292
-boundary_9007199254740993_reverse,6,10,6,frontier32_simd,0.427916,0.387125,0.043458,360,6,1,1,0.099791,3,pass,0.427916;0.428250;0.423667
-boundary_9007199254740993_reverse,6,10,6,frontier32_gpu_dag,1.050666,0.410208,0.074458,360,6,3,1,0.099791,3,pass,1.050666;1.040667;1.417584
-boundary_9007199254740993_reverse,6,10,6,bucket32_d4,0.750875,0.705000,0.158292,360,6,1,1,0.099791,3,pass,0.750875;0.755708;0.628666
-boundary_9007199254740993_reverse,6,10,6,bucket32_d16,0.566208,0.532250,0.157958,360,6,1,1,0.099791,3,pass,0.577666;0.566208;0.550167
-boundary_9007199254740993_reverse,6,10,6,bucket32_d64,0.550459,0.522458,0.164792,360,6,1,1,0.099791,3,pass,0.809167;0.550459;0.511958
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_serial,0.526750,0.523167,0.161208,360,6,1,0,0.101250,3,pass,0.560709;0.508625;0.526750
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_serial,0.320792,0.317041,0.050625,90,2,1,0,0.101250,3,pass,0.347708;0.320792;0.320625
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_parallel_dag,0.595958,0.553167,0.158750,360,6,1,0,0.101250,3,pass,0.549417;0.595958;0.602375
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_parallel_dag,0.388416,0.357916,0.050125,90,2,1,0,0.101250,3,pass,0.377708;0.390167;0.388416
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_barrier,0.625292,0.599542,0.165167,360,6,1,0,0.101250,3,pass,0.625292;0.691584;0.555959
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_interleaved,0.379375,0.364792,0.039833,360,6,1,0,0.101250,3,pass,0.434708;0.360708;0.379375
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_interleaved,0.415042,0.378542,0.040500,360,6,1,1,0.101250,3,pass,0.396708;0.415042;0.425292
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_gpu_dag,1.095708,0.395375,0.069958,360,6,3,1,0.101250,3,pass,1.095708;1.093708;1.382084
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_vertex,0.426042,0.403375,0.041375,360,6,1,1,0.101250,3,pass,0.392542;0.553417;0.426042
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_simd,0.405584,0.383083,0.040500,360,6,1,1,0.101250,3,pass,0.405584;0.412833;0.404500
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_gpu_dag,1.210709,0.487375,0.256917,360,6,3,1,0.101250,3,pass,1.133708;1.210709;1.338417
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d4,0.601500,0.567208,0.175000,360,6,1,1,0.101250,3,pass,0.602167;0.572583;0.601500
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d16,0.529917,0.501708,0.154375,360,6,1,1,0.101250,3,pass,0.529917;0.620084;0.496500
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d64,0.555667,0.516125,0.155667,360,6,1,1,0.101250,3,pass,0.936292;0.505125;0.555667
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness-stderr.txt b/dev/research/metal_pathfinding/optimization/results/correctness-stderr.txt
deleted file mode 100644
index 47b95c6..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=50.79 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/correctness.csv b/dev/research/metal_pathfinding/optimization/results/correctness.csv
deleted file mode 100644
index 6ad6397..0000000
--- a/dev/research/metal_pathfinding/optimization/results/correctness.csv
+++ /dev/null
@@ -1,337 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random_masked_int64,40,240,8,old_pull_serial,0.562958,0.541375,0.122875,15360,8,1,0,0.116249,3,pass,0.568167;0.533500;0.562958
-random_masked_int64,40,240,8,old_group_serial,0.513500,0.491542,0.071625,9600,6,1,0,0.116249,3,pass,0.513500;0.487167;0.567333
-random_masked_int64,40,240,8,old_pull_parallel_dag,0.573333,0.491583,0.122958,15360,8,1,0,0.116249,3,pass,0.573333;0.548333;0.592250
-random_masked_int64,40,240,8,old_group_parallel_dag,0.519708,0.462291,0.071125,9600,6,1,0,0.116249,3,pass,0.500084;0.526209;0.519708
-random_masked_int64,40,240,8,pull64_barrier,0.567209,0.524583,0.113625,15360,8,1,0,0.116249,3,pass,0.567209;0.586667;0.326542
-random_masked_int64,40,240,8,pull64_interleaved,0.335166,0.294625,0.113125,15360,8,1,0,0.116249,3,pass,0.326833;0.338791;0.335166
-random_masked_int64,40,240,8,pull32_interleaved,0.329584,0.277209,0.113292,15360,8,1,1,0.116249,3,pass,0.329584;0.341041;0.309250
-random_masked_int64,40,240,8,pull32_gpu_dag,0.758416,0.296667,0.163916,15360,8,3,1,0.116249,3,pass,0.694417;0.758416;0.838375
-random_masked_int64,40,240,8,frontier32_vertex,0.323083,0.273417,0.112375,15360,8,1,1,0.116249,3,pass,0.365583;0.323083;0.298250
-random_masked_int64,40,240,8,frontier32_simd,0.329375,0.284292,0.112167,15360,8,1,1,0.116249,3,pass,0.327875;0.884416;0.329375
-random_masked_int64,40,240,8,frontier32_gpu_dag,0.657125,0.282000,0.160708,15360,8,3,1,0.116249,3,pass,0.657125;0.698167;0.640042
-random_masked_int64,40,240,8,bucket32_d4,0.394209,0.348916,0.129667,15360,8,1,1,0.116249,3,pass,0.467000;0.394209;0.361750
-random_masked_int64,40,240,8,bucket32_d16,0.333709,0.284834,0.112792,15360,8,1,1,0.116249,3,pass,0.333709;0.318917;0.335542
-random_masked_int64,40,240,8,bucket32_d64,0.317500,0.278125,0.112250,15360,8,1,1,0.116249,3,pass,0.323708;0.305125;0.317500
-random_masked,43,258,8,old_pull_serial,0.572584,0.552875,0.270417,33024,16,2,0,0.083291,3,pass,0.572584;0.578375;0.561625
-random_masked,43,258,8,old_group_serial,0.255458,0.243375,0.105375,14448,9,1,0,0.083291,3,pass,0.255458;0.305583;0.231875
-random_masked,43,258,8,old_pull_parallel_dag,0.577625,0.546834,0.273417,33024,16,2,0,0.083291,3,pass,0.577625;0.608875;0.559083
-random_masked,43,258,8,old_group_parallel_dag,0.281833,0.243709,0.105583,14448,9,1,0,0.083291,3,pass,0.269000;0.293583;0.281833
-random_masked,43,258,8,pull64_barrier,0.594875,0.526042,0.244875,33024,16,2,0,0.083291,3,pass,0.594875;0.600542;0.564625
-random_masked,43,258,8,pull64_interleaved,0.686125,0.652417,0.298292,33024,16,2,0,0.083291,3,pass,0.655416;0.730000;0.686125
-random_masked,43,258,8,pull32_interleaved,0.569958,0.533916,0.219208,33024,16,2,0,0.083291,3,pass,0.690500;0.569958;0.534750
-random_masked,43,258,8,pull32_gpu_dag,1.093000,0.672000,0.337000,33024,16,4,0,0.083291,3,pass,1.089750;1.138958;1.093000
-random_masked,43,258,8,frontier32_vertex,0.811167,0.763792,0.443250,3186,16,2,0,0.083291,3,pass,0.811167;0.769541;0.873292
-random_masked,43,258,8,frontier32_simd,0.662417,0.619000,0.325375,3186,16,2,0,0.083291,3,pass,0.653209;0.662417;1.329042
-random_masked,43,258,8,frontier32_gpu_dag,1.094500,0.664041,0.371958,3186,16,4,0,0.083291,3,pass,1.044250;1.094500;1.224167
-random_masked,43,258,8,bucket32_d4,2.167333,2.099083,1.255792,2016,32,4,0,0.083291,3,pass,2.198125;2.167333;2.011750
-random_masked,43,258,8,bucket32_d16,1.541041,1.509916,0.911334,2142,24,3,0,0.083291,3,pass,1.701416;1.541041;1.509917
-random_masked,43,258,8,bucket32_d64,1.098250,1.062792,0.618375,3096,16,2,0,0.083291,3,pass,1.088084;1.098250;1.138375
-random_masked_int64_reverse,46,276,8,old_pull_serial,0.320125,0.287208,0.119125,17664,8,1,0,0.109000,3,pass,0.320125;0.288375;0.330834
-random_masked_int64_reverse,46,276,8,old_group_serial,0.231167,0.215875,0.045500,9660,5,1,0,0.109000,3,pass,0.231709;0.228834;0.231167
-random_masked_int64_reverse,46,276,8,old_pull_parallel_dag,0.284459,0.242500,0.095250,17664,8,1,0,0.109000,3,pass,0.356084;0.284459;0.282208
-random_masked_int64_reverse,46,276,8,old_group_parallel_dag,0.222583,0.169041,0.044625,9660,5,1,0,0.109000,3,pass,0.222583;0.223209;0.213208
-random_masked_int64_reverse,46,276,8,pull64_barrier,0.361209,0.313625,0.109375,17664,8,1,0,0.109000,3,pass,0.361209;0.383542;0.313542
-random_masked_int64_reverse,46,276,8,pull64_interleaved,0.314208,0.274833,0.093750,17664,8,1,0,0.109000,3,pass,0.347709;0.314208;0.300500
-random_masked_int64_reverse,46,276,8,pull32_interleaved,0.370542,0.328166,0.111917,17664,8,1,1,0.109000,3,pass,0.350250;0.943084;0.370542
-random_masked_int64_reverse,46,276,8,pull32_gpu_dag,0.791459,0.327709,0.156083,17664,8,3,1,0.109000,3,pass,0.791459;0.806792;0.742833
-random_masked_int64_reverse,46,276,8,frontier32_vertex,0.369875,0.318917,0.104333,17664,8,1,1,0.109000,3,pass,0.343583;0.369875;0.378291
-random_masked_int64_reverse,46,276,8,frontier32_simd,0.341250,0.304667,0.107625,17664,8,1,1,0.109000,3,pass,0.336959;0.341250;0.354541
-random_masked_int64_reverse,46,276,8,frontier32_gpu_dag,0.782833,0.318333,0.157750,17664,8,3,1,0.109000,3,pass,0.802541;0.772208;0.782833
-random_masked_int64_reverse,46,276,8,bucket32_d4,0.378708,0.321791,0.101500,17664,8,1,1,0.109000,3,pass,0.426667;0.378708;0.349875
-random_masked_int64_reverse,46,276,8,bucket32_d16,0.366875,0.315208,0.105917,17664,8,1,1,0.109000,3,pass,0.376708;0.366875;0.345125
-random_masked_int64_reverse,46,276,8,bucket32_d64,0.375291,0.328750,0.104875,17664,8,1,1,0.109000,3,pass,0.355542;0.375291;0.380708
-random_masked,49,294,8,old_pull_serial,0.349167,0.330875,0.142625,18816,8,1,0,0.098416,3,pass,0.355041;0.349167;0.336417
-random_masked,49,294,8,old_group_serial,0.291625,0.279125,0.094042,14700,8,1,0,0.098416,3,pass,0.274917;0.291625;0.375291
-random_masked,49,294,8,old_pull_parallel_dag,0.394000,0.325875,0.148708,18816,8,1,0,0.098416,3,pass,0.394000;0.414875;0.355791
-random_masked,49,294,8,old_group_parallel_dag,0.321250,0.275959,0.093833,14700,8,1,0,0.098416,3,pass,0.321250;0.317416;0.348875
-random_masked,49,294,8,pull64_barrier,0.371584,0.324792,0.119250,18816,8,1,0,0.098416,3,pass,0.427208;0.371584;0.358792
-random_masked,49,294,8,pull64_interleaved,0.367875,0.317042,0.145625,18816,8,1,0,0.098416,3,pass,0.325000;0.367875;0.427334
-random_masked,49,294,8,pull32_interleaved,0.331500,0.293542,0.104583,18816,8,1,0,0.098416,3,pass,0.331500;0.368292;0.325250
-random_masked,49,294,8,pull32_gpu_dag,0.853708,0.354166,0.178292,18816,8,3,0,0.098416,3,pass,0.865458;0.810500;0.853708
-random_masked,49,294,8,frontier32_vertex,0.595250,0.561125,0.310875,3162,8,1,0,0.098416,3,pass,0.589541;0.595250;0.615666
-random_masked,49,294,8,frontier32_simd,0.426833,0.374167,0.180625,3156,8,1,0,0.098416,3,pass,0.426833;0.468625;0.403334
-random_masked,49,294,8,frontier32_gpu_dag,0.900792,0.407417,0.236917,3162,8,3,0,0.098416,3,pass,0.900792;0.924666;0.781917
-random_masked,49,294,8,bucket32_d4,2.018792,1.964250,0.991125,2022,40,5,0,0.098416,3,pass,2.461125;2.018792;1.864459
-random_masked,49,294,8,bucket32_d16,0.797750,0.762875,0.338708,2100,16,2,0,0.098416,3,pass,0.834750;0.759209;0.797750
-random_masked,49,294,8,bucket32_d64,0.719584,0.669417,0.273375,3042,16,2,0,0.098416,3,pass,0.847958;0.713667;0.719584
-random_masked_int64,52,312,8,old_pull_serial,0.251500,0.230167,0.061875,19968,8,1,0,0.132541,3,pass,0.251500;0.271667;0.246209
-random_masked_int64,52,312,8,old_group_serial,0.234042,0.204916,0.033833,12168,6,1,0,0.132541,3,pass,0.217834;0.234042;0.241666
-random_masked_int64,52,312,8,old_pull_parallel_dag,0.300750,0.252917,0.062500,19968,8,1,0,0.132541,3,pass,0.258250;0.300750;0.307166
-random_masked_int64,52,312,8,old_group_parallel_dag,0.277167,0.205667,0.033958,12168,6,1,0,0.132541,3,pass,0.256584;0.369375;0.277167
-random_masked_int64,52,312,8,pull64_barrier,0.335791,0.302083,0.060083,19968,8,1,0,0.132541,3,pass,0.347916;0.330959;0.335791
-random_masked_int64,52,312,8,pull64_interleaved,0.343042,0.290542,0.057959,19968,8,1,0,0.132541,3,pass,0.326000;0.357292;0.343042
-random_masked_int64,52,312,8,pull32_interleaved,0.349375,0.298750,0.057958,19968,8,1,1,0.132541,3,pass,0.361458;0.349375;0.335000
-random_masked_int64,52,312,8,pull32_gpu_dag,0.854458,0.312000,0.082459,19968,8,3,1,0.132541,3,pass,0.752042;1.220167;0.854458
-random_masked_int64,52,312,8,frontier32_vertex,0.358917,0.321792,0.058792,19968,8,1,1,0.132541,3,pass,0.369084;0.324000;0.358917
-random_masked_int64,52,312,8,frontier32_simd,0.371084,0.329958,0.058542,19968,8,1,1,0.132541,3,pass,0.371084;0.319417;0.386417
-random_masked_int64,52,312,8,frontier32_gpu_dag,0.591750,0.231083,0.061417,19968,8,3,1,0.132541,3,pass,0.534625;0.591750;0.640417
-random_masked_int64,52,312,8,bucket32_d4,0.324334,0.287292,0.053583,19968,8,1,1,0.132541,3,pass,0.296625;0.400583;0.324334
-random_masked_int64,52,312,8,bucket32_d16,0.321666,0.274500,0.051708,19968,8,1,1,0.132541,3,pass,0.321542;0.373166;0.321666
-random_masked_int64,52,312,8,bucket32_d64,0.330334,0.267000,0.048500,19968,8,1,1,0.132541,3,pass,0.330334;0.354292;0.300292
-random_masked_reverse,55,330,8,old_pull_serial,0.381583,0.369958,0.070083,42240,16,2,0,0.136458,3,pass,0.381583;0.404583;0.378750
-random_masked_reverse,55,330,8,old_group_serial,0.165125,0.149959,0.024333,20130,10,1,0,0.136458,3,pass,0.189000;0.157875;0.165125
-random_masked_reverse,55,330,8,old_pull_parallel_dag,0.330250,0.301334,0.058333,42240,16,2,0,0.136458,3,pass,0.364000;0.322041;0.330250
-random_masked_reverse,55,330,8,old_group_parallel_dag,0.188792,0.148584,0.021917,20130,10,1,0,0.136458,3,pass,0.223500;0.188792;0.181417
-random_masked_reverse,55,330,8,pull64_barrier,0.455958,0.432416,0.060250,42240,16,2,0,0.136458,3,pass,0.463333;0.455958;0.419792
-random_masked_reverse,55,330,8,pull64_interleaved,0.477458,0.446000,0.066375,42240,16,2,0,0.136458,3,pass,0.477458;0.438542;0.577083
-random_masked_reverse,55,330,8,pull32_interleaved,0.437209,0.390750,0.059500,42240,16,2,0,0.136458,3,pass,0.437209;0.439667;0.401416
-random_masked_reverse,55,330,8,pull32_gpu_dag,0.788167,0.410958,0.084000,42240,16,4,0,0.136458,3,pass,0.879083;0.780833;0.788167
-random_masked_reverse,55,330,8,frontier32_vertex,0.558375,0.525958,0.173792,3691,16,2,0,0.136458,3,pass,0.841542;0.558375;0.547000
-random_masked_reverse,55,330,8,frontier32_simd,0.471416,0.425250,0.108125,3691,16,2,0,0.136458,3,pass,0.451917;0.471416;0.482083
-random_masked_reverse,55,330,8,frontier32_gpu_dag,0.761666,0.416041,0.127125,3691,16,4,0,0.136458,3,pass,0.819375;0.761666;0.747625
-random_masked_reverse,55,330,8,bucket32_d4,1.046625,1.021750,0.349208,2455,32,4,0,0.136458,3,pass,1.042834;1.046625;1.100042
-random_masked_reverse,55,330,8,bucket32_d16,0.837417,0.805958,0.279000,2603,24,3,0,0.136458,3,pass,0.837417;0.884334;0.757500
-random_masked_reverse,55,330,8,bucket32_d64,0.521625,0.456666,0.159333,3605,16,2,0,0.136458,3,pass,0.453458;0.526417;0.521625
-random_masked_int64,58,348,8,old_pull_serial,0.186041,0.167958,0.030833,22272,8,1,0,0.058459,3,pass,0.189041;0.178792;0.186041
-random_masked_int64,58,348,8,old_group_serial,0.156000,0.139792,0.013250,13920,5,1,0,0.058459,3,pass,0.151125;0.160167;0.156000
-random_masked_int64,58,348,8,old_pull_parallel_dag,0.197250,0.157083,0.027333,22272,8,1,0,0.058459,3,pass,0.197250;0.200458;0.190459
-random_masked_int64,58,348,8,old_group_parallel_dag,0.165625,0.132291,0.013375,13920,5,1,0,0.058459,3,pass,0.167541;0.159458;0.165625
-random_masked_int64,58,348,8,pull64_barrier,0.208458,0.176250,0.026958,22272,8,1,0,0.058459,3,pass,0.283084;0.208458;0.198500
-random_masked_int64,58,348,8,pull64_interleaved,0.194334,0.174708,0.027958,22272,8,1,0,0.058459,3,pass,0.194334;0.191875;0.202292
-random_masked_int64,58,348,8,pull32_interleaved,0.191375,0.165916,0.027875,22272,8,1,1,0.058459,3,pass,0.198125;0.190583;0.191375
-random_masked_int64,58,348,8,pull32_gpu_dag,0.588458,0.211625,0.047000,22272,8,3,1,0.058459,3,pass,0.590250;0.506208;0.588458
-random_masked_int64,58,348,8,frontier32_vertex,0.225708,0.204667,0.030375,22272,8,1,1,0.058459,3,pass,0.245209;0.223583;0.225708
-random_masked_int64,58,348,8,frontier32_simd,0.244375,0.206250,0.030792,22272,8,1,1,0.058459,3,pass,0.226125;0.274500;0.244375
-random_masked_int64,58,348,8,frontier32_gpu_dag,0.520667,0.194583,0.043542,22272,8,3,1,0.058459,3,pass,0.517875;0.520667;0.547625
-random_masked_int64,58,348,8,bucket32_d4,0.217958,0.187000,0.027875,22272,8,1,1,0.058459,3,pass,0.211583;0.220375;0.217958
-random_masked_int64,58,348,8,bucket32_d16,0.230000,0.204833,0.030375,22272,8,1,1,0.058459,3,pass,0.188792;0.270042;0.230000
-random_masked_int64,58,348,8,bucket32_d64,0.209875,0.187709,0.027333,22272,8,1,1,0.058459,3,pass,0.264500;0.209875;0.203958
-random_masked,61,366,8,old_pull_serial,0.309291,0.298834,0.063375,46848,16,2,0,0.052416,3,pass,0.309291;0.308166;0.322417
-random_masked,61,366,8,old_group_serial,0.141500,0.131333,0.024708,23424,9,1,0,0.052416,3,pass,0.150833;0.141500;0.137000
-random_masked,61,366,8,old_pull_parallel_dag,0.342834,0.306125,0.064458,46848,16,2,0,0.052416,3,pass,0.406584;0.342834;0.339459
-random_masked,61,366,8,old_group_parallel_dag,0.177291,0.145333,0.024708,23424,9,1,0,0.052416,3,pass,0.177291;0.163500;0.191833
-random_masked,61,366,8,pull64_barrier,0.422167,0.395792,0.066667,46848,16,2,0,0.052416,3,pass,0.422167;0.390583;0.431209
-random_masked,61,366,8,pull64_interleaved,0.389083,0.365958,0.066667,46848,16,2,0,0.052416,3,pass,0.389083;0.365166;0.401083
-random_masked,61,366,8,pull32_interleaved,0.353250,0.319500,0.053750,46848,16,2,0,0.052416,3,pass,0.350166;0.353250;0.455584
-random_masked,61,366,8,pull32_gpu_dag,0.685375,0.349667,0.070417,46848,16,4,0,0.052416,3,pass,0.650041;0.834458;0.685375
-random_masked,61,366,8,frontier32_vertex,0.496416,0.460000,0.137750,4776,16,2,0,0.052416,3,pass,0.496416;0.497708;0.445875
-random_masked,61,366,8,frontier32_simd,0.431584,0.383167,0.092917,4776,16,2,0,0.052416,3,pass,0.378875;0.431584;0.512042
-random_masked,61,366,8,frontier32_gpu_dag,0.768958,0.425000,0.124625,4776,16,4,0,0.052416,3,pass,0.818959;0.743625;0.768958
-random_masked,61,366,8,bucket32_d4,1.126958,1.098000,0.409250,2760,40,5,0,0.052416,3,pass,1.126958;1.091500;1.168916
-random_masked,61,366,8,bucket32_d16,0.778042,0.751250,0.267750,2952,24,3,0,0.052416,3,pass,0.778042;0.807250;0.666792
-random_masked,61,366,8,bucket32_d64,0.449792,0.426417,0.157708,4590,16,2,0,0.052416,3,pass,0.443667;0.449792;0.465417
-random_masked_int64_reverse,64,384,8,old_pull_serial,0.179208,0.167667,0.026500,24576,8,1,0,0.046333,3,pass,0.171750;0.179208;0.182792
-random_masked_int64_reverse,64,384,8,old_group_serial,0.154708,0.144500,0.011125,13440,5,1,0,0.046333,3,pass,0.151625;0.154708;0.161958
-random_masked_int64_reverse,64,384,8,old_pull_parallel_dag,0.200458,0.170542,0.026167,24576,8,1,0,0.046333,3,pass,0.209667;0.200458;0.200000
-random_masked_int64_reverse,64,384,8,old_group_parallel_dag,0.175792,0.141084,0.011125,13440,5,1,0,0.046333,3,pass,0.179041;0.175792;0.174542
-random_masked_int64_reverse,64,384,8,pull64_barrier,0.228417,0.203125,0.026667,24576,8,1,0,0.046333,3,pass,0.228417;0.234625;0.225042
-random_masked_int64_reverse,64,384,8,pull64_interleaved,0.218542,0.189875,0.024458,24576,8,1,0,0.046333,3,pass,0.198458;0.251667;0.218542
-random_masked_int64_reverse,64,384,8,pull32_interleaved,0.223083,0.188250,0.024000,24576,8,1,1,0.046333,3,pass,0.197291;0.223083;0.267416
-random_masked_int64_reverse,64,384,8,pull32_gpu_dag,0.465292,0.176792,0.035500,24576,8,3,1,0.046333,3,pass,0.465292;0.442125;0.476250
-random_masked_int64_reverse,64,384,8,frontier32_vertex,0.221250,0.186667,0.022625,24576,8,1,1,0.046333,3,pass,0.221250;0.218417;0.378333
-random_masked_int64_reverse,64,384,8,frontier32_simd,0.213667,0.181542,0.022625,24576,8,1,1,0.046333,3,pass,0.197541;0.224833;0.213667
-random_masked_int64_reverse,64,384,8,frontier32_gpu_dag,0.405958,0.149291,0.034417,24576,8,3,1,0.046333,3,pass,0.401500;0.405958;0.486750
-random_masked_int64_reverse,64,384,8,bucket32_d4,0.194334,0.164583,0.023333,24576,8,1,1,0.046333,3,pass,0.190208;0.205375;0.194334
-random_masked_int64_reverse,64,384,8,bucket32_d16,0.227500,0.203625,0.026750,24576,8,1,1,0.046333,3,pass,0.215584;0.227500;0.354667
-random_masked_int64_reverse,64,384,8,bucket32_d64,0.204667,0.171833,0.022792,24576,8,1,1,0.046333,3,pass,0.204667;0.199625;0.216875
-random_masked,67,402,8,old_pull_serial,0.156208,0.145333,0.027917,25728,8,1,0,0.078416,3,pass,0.158250;0.156208;0.154292
-random_masked,67,402,8,old_group_serial,0.157000,0.146292,0.019708,24522,8,1,0,0.078416,3,pass,0.198042;0.153458;0.157000
-random_masked,67,402,8,old_pull_parallel_dag,0.187958,0.160625,0.028542,25728,8,1,0,0.078416,3,pass,0.180917;0.199084;0.187958
-random_masked,67,402,8,old_group_parallel_dag,0.153916,0.135416,0.019375,24522,8,1,0,0.078416,3,pass,0.163708;0.153916;0.144041
-random_masked,67,402,8,pull64_barrier,0.198750,0.171208,0.027625,25728,8,1,0,0.078416,3,pass,0.217750;0.198750;0.175833
-random_masked,67,402,8,pull64_interleaved,0.237833,0.201459,0.030625,25728,8,1,0,0.078416,3,pass,0.237584;0.310625;0.237833
-random_masked,67,402,8,pull32_interleaved,0.249375,0.202667,0.025375,25728,8,1,0,0.078416,3,pass,0.228958;0.315416;0.249375
-random_masked,67,402,8,pull32_gpu_dag,0.488833,0.179459,0.039125,25728,8,3,0,0.078416,3,pass,0.479541;0.488833;0.514375
-random_masked,67,402,8,frontier32_vertex,0.313167,0.276458,0.080125,5034,8,1,0,0.078416,3,pass,0.319041;0.265166;0.313167
-random_masked,67,402,8,frontier32_simd,0.249209,0.218042,0.051417,5034,8,1,0,0.078416,3,pass,0.233792;0.255833;0.249209
-random_masked,67,402,8,frontier32_gpu_dag,0.607250,0.210917,0.064250,4998,8,3,0,0.078416,3,pass,0.607250;0.494000;0.612541
-random_masked,67,402,8,bucket32_d4,0.935291,0.893959,0.331917,3120,32,4,0,0.078416,3,pass,0.935291;0.935666;0.911458
-random_masked,67,402,8,bucket32_d16,0.785333,0.745209,0.263125,3360,24,3,0,0.078416,3,pass,0.785333;0.732792;0.858959
-random_masked,67,402,8,bucket32_d64,0.456333,0.432458,0.151583,4914,16,2,0,0.078416,3,pass,0.446917;0.511209;0.456333
-random_masked_int64,70,420,8,old_pull_serial,0.172833,0.161834,0.033625,26880,8,1,0,0.111875,3,pass,0.152208;0.172833;0.183542
-random_masked_int64,70,420,8,old_group_serial,0.152167,0.141916,0.017417,15960,6,1,0,0.111875,3,pass,0.152167;0.157459;0.140167
-random_masked_int64,70,420,8,old_pull_parallel_dag,0.184084,0.156958,0.031333,26880,8,1,0,0.111875,3,pass,0.184084;0.183667;0.186000
-random_masked_int64,70,420,8,old_group_parallel_dag,0.172209,0.148625,0.017417,15960,6,1,0,0.111875,3,pass,0.165958;0.207458;0.172209
-random_masked_int64,70,420,8,pull64_barrier,0.222541,0.191167,0.032083,26880,8,1,0,0.111875,3,pass,0.299792;0.222541;0.215792
-random_masked_int64,70,420,8,pull64_interleaved,0.263458,0.214125,0.032958,26880,8,1,0,0.111875,3,pass,0.221292;0.263458;0.273541
-random_masked_int64,70,420,8,pull32_interleaved,0.259208,0.212417,0.033292,26880,8,1,1,0.111875,3,pass,0.264333;0.242292;0.259208
-random_masked_int64,70,420,8,pull32_gpu_dag,0.487792,0.185542,0.044083,26880,8,3,1,0.111875,3,pass,0.520042;0.487792;0.476084
-random_masked_int64,70,420,8,frontier32_vertex,0.228167,0.205667,0.033167,26880,8,1,1,0.111875,3,pass,0.228167;0.278209;0.213792
-random_masked_int64,70,420,8,frontier32_simd,0.235917,0.197334,0.029875,26880,8,1,1,0.111875,3,pass,0.249584;0.235917;0.206458
-random_masked_int64,70,420,8,frontier32_gpu_dag,0.552583,0.195792,0.047541,26880,8,3,1,0.111875,3,pass,0.552583;0.514250;0.567208
-random_masked_int64,70,420,8,bucket32_d4,0.213625,0.180917,0.031042,26880,8,1,1,0.111875,3,pass,0.189583;0.229083;0.213625
-random_masked_int64,70,420,8,bucket32_d16,0.200875,0.175083,0.030667,26880,8,1,1,0.111875,3,pass,0.199792;0.212792;0.200875
-random_masked_int64,70,420,8,bucket32_d64,0.226208,0.203666,0.033042,26880,8,1,1,0.111875,3,pass,0.226208;0.289750;0.209208
-random_masked_reverse,73,438,8,old_pull_serial,0.300875,0.279750,0.049167,56064,16,2,0,0.051958,3,pass,0.297583;0.322917;0.300875
-random_masked_reverse,73,438,8,old_group_serial,0.153167,0.131333,0.016917,30222,10,1,0,0.051958,3,pass,0.162833;0.153167;0.143875
-random_masked_reverse,73,438,8,old_pull_parallel_dag,0.357000,0.316083,0.052417,56064,16,2,0,0.051958,3,pass,0.357000;0.347458;0.368750
-random_masked_reverse,73,438,8,old_group_parallel_dag,0.172250,0.133250,0.017000,30222,10,1,0,0.051958,3,pass,0.161416;0.172250;0.179584
-random_masked_reverse,73,438,8,pull64_barrier,0.355208,0.325958,0.051917,56064,16,2,0,0.051958,3,pass,0.361458;0.338917;0.355208
-random_masked_reverse,73,438,8,pull64_interleaved,0.392041,0.358292,0.055250,56064,16,2,0,0.051958,3,pass,0.387334;0.392041;0.393834
-random_masked_reverse,73,438,8,pull32_interleaved,0.431125,0.388250,0.052375,56064,16,2,0,0.051958,3,pass,0.489459;0.376000;0.431125
-random_masked_reverse,73,438,8,pull32_gpu_dag,0.582458,0.309500,0.058208,56064,16,4,0,0.051958,3,pass,0.582458;0.564583;0.654625
-random_masked_reverse,73,438,8,frontier32_vertex,0.492000,0.452417,0.152417,5335,16,2,0,0.051958,3,pass,0.605959;0.474750;0.492000
-random_masked_reverse,73,438,8,frontier32_simd,0.459959,0.426417,0.108125,5335,16,2,0,0.051958,3,pass,0.473959;0.439375;0.459959
-random_masked_reverse,73,438,8,frontier32_gpu_dag,0.697459,0.393625,0.109375,5335,16,4,0,0.051958,3,pass,0.673333;0.697459;0.753833
-random_masked_reverse,73,438,8,bucket32_d4,0.955083,0.933583,0.309833,3179,32,4,0,0.051958,3,pass,1.078375;0.909541;0.955083
-random_masked_reverse,73,438,8,bucket32_d16,0.751875,0.705958,0.260042,3402,24,3,0,0.051958,3,pass,0.647541;0.751875;0.849292
-random_masked_reverse,73,438,8,bucket32_d64,0.562917,0.525875,0.168958,4984,16,2,0,0.051958,3,pass,0.564125;0.562917;0.562417
-boundary_700000000,6,10,6,old_pull_serial,0.153083,0.152292,0.015542,360,6,1,0,0.062626,3,pass,0.153083;0.153167;0.149625
-boundary_700000000,6,10,6,old_group_serial,0.116958,0.116291,0.007083,160,5,1,0,0.062626,3,pass,0.116958;0.116375;0.242875
-boundary_700000000,6,10,6,old_pull_parallel_dag,0.160958,0.133625,0.013250,360,6,1,0,0.062626,3,pass,0.160958;0.163917;0.160375
-boundary_700000000,6,10,6,old_group_parallel_dag,0.128709,0.114500,0.007042,160,5,1,0,0.062626,3,pass,0.132541;0.128666;0.128709
-boundary_700000000,6,10,6,pull64_barrier,0.170584,0.154583,0.015000,360,6,1,0,0.062626,3,pass,0.170584;0.153833;0.171750
-boundary_700000000,6,10,6,pull64_interleaved,0.190334,0.165417,0.015666,360,6,1,0,0.062626,3,pass,0.186125;0.199333;0.190334
-boundary_700000000,6,10,6,pull32_interleaved,0.209125,0.182333,0.017250,360,6,1,0,0.062626,3,pass,0.210917;0.208625;0.209125
-boundary_700000000,6,10,6,pull32_gpu_dag,0.464958,0.162958,0.024458,360,6,3,0,0.062626,3,pass,0.460833;0.464958;0.468666
-boundary_700000000,6,10,6,frontier32_vertex,0.206792,0.182250,0.045667,24,8,1,0,0.062626,3,pass,0.243416;0.187625;0.206792
-boundary_700000000,6,10,6,frontier32_simd,0.193166,0.173584,0.042917,24,8,1,0,0.062626,3,pass,0.192167;0.212625;0.193166
-boundary_700000000,6,10,6,frontier32_gpu_dag,0.534000,0.215708,0.059417,24,8,3,0,0.062626,3,pass,0.534000;0.603250;0.530958
-boundary_700000000,6,10,6,bucket32_d4,0.290250,0.259750,0.085292,24,8,1,0,0.062626,3,pass,0.274625;0.290250;0.293083
-boundary_700000000,6,10,6,bucket32_d16,0.269250,0.236084,0.071083,24,8,1,0,0.062626,3,pass,0.265084;0.269250;0.281958
-boundary_700000000,6,10,6,bucket32_d64,0.271583,0.238833,0.073458,24,8,1,0,0.062626,3,pass,0.271583;0.256542;0.276333
-boundary_700000000_masked,6,10,6,old_pull_serial,0.132750,0.132042,0.013667,360,6,1,0,0.047500,3,pass,0.132750;0.225500;0.121625
-boundary_700000000_masked,6,10,6,old_group_serial,0.111833,0.111250,0.004667,80,2,1,0,0.047500,3,pass,0.111833;0.112875;0.109333
-boundary_700000000_masked,6,10,6,old_pull_parallel_dag,0.168000,0.135250,0.012875,360,6,1,0,0.047500,3,pass,0.168000;0.158167;0.168750
-boundary_700000000_masked,6,10,6,old_group_parallel_dag,0.151708,0.120958,0.004750,80,2,1,0,0.047500,3,pass,0.151708;0.149333;0.182959
-boundary_700000000_masked,6,10,6,pull64_barrier,0.190958,0.166041,0.015125,360,6,1,0,0.047500,3,pass,0.192667;0.190958;0.189958
-boundary_700000000_masked,6,10,6,pull64_interleaved,0.225917,0.194458,0.018250,360,6,1,0,0.047500,3,pass,0.226292;0.225917;0.211375
-boundary_700000000_masked,6,10,6,pull32_interleaved,0.214167,0.182959,0.017125,360,6,1,0,0.047500,3,pass,0.203500;0.214167;0.214666
-boundary_700000000_masked,6,10,6,pull32_gpu_dag,0.430208,0.142292,0.023583,360,6,3,0,0.047500,3,pass,0.430208;0.390208;0.433958
-boundary_700000000_masked,6,10,6,frontier32_vertex,0.235250,0.204875,0.044042,12,8,1,0,0.047500,3,pass,0.200750;0.235250;0.336958
-boundary_700000000_masked,6,10,6,frontier32_simd,0.249875,0.226667,0.048375,12,8,1,0,0.047500,3,pass,0.229167;0.284334;0.249875
-boundary_700000000_masked,6,10,6,frontier32_gpu_dag,0.571417,0.221708,0.060708,12,8,3,0,0.047500,3,pass,0.590542;0.571417;0.537625
-boundary_700000000_masked,6,10,6,bucket32_d4,0.279708,0.235917,0.070375,12,8,1,0,0.047500,3,pass,0.288167;0.279708;0.246584
-boundary_700000000_masked,6,10,6,bucket32_d16,0.228500,0.209750,0.070083,12,8,1,0,0.047500,3,pass,0.230209;0.228500;0.226459
-boundary_700000000_masked,6,10,6,bucket32_d64,0.295334,0.261667,0.068250,12,8,1,0,0.047500,3,pass,0.273459;0.310292;0.295334
-boundary_700000000_reverse,6,10,6,old_pull_serial,0.152542,0.151750,0.015375,360,6,1,0,0.044708,3,pass,0.152542;0.150625;0.153958
-boundary_700000000_reverse,6,10,6,old_group_serial,0.129375,0.128625,0.007375,170,5,1,0,0.044708,3,pass,0.126500;0.129375;0.135750
-boundary_700000000_reverse,6,10,6,old_pull_parallel_dag,0.185333,0.156667,0.015708,360,6,1,0,0.044708,3,pass,0.180541;0.191708;0.185333
-boundary_700000000_reverse,6,10,6,old_group_parallel_dag,0.170542,0.140583,0.007250,170,5,1,0,0.044708,3,pass,0.187292;0.148292;0.170542
-boundary_700000000_reverse,6,10,6,pull64_barrier,0.214917,0.190417,0.017583,360,6,1,0,0.044708,3,pass,0.213458;0.214917;0.243917
-boundary_700000000_reverse,6,10,6,pull64_interleaved,0.220292,0.166458,0.014958,360,6,1,0,0.044708,3,pass,0.222792;0.175083;0.220292
-boundary_700000000_reverse,6,10,6,pull32_interleaved,0.183500,0.156458,0.015083,360,6,1,0,0.044708,3,pass,0.183500;0.189625;0.182834
-boundary_700000000_reverse,6,10,6,pull32_gpu_dag,0.519917,0.169750,0.024042,360,6,3,0,0.044708,3,pass,0.519917;0.465250;0.537625
-boundary_700000000_reverse,6,10,6,frontier32_vertex,0.216000,0.187417,0.045292,24,8,1,0,0.044708,3,pass,0.213500;0.216000;0.237334
-boundary_700000000_reverse,6,10,6,frontier32_simd,0.246041,0.220042,0.043667,24,8,1,0,0.044708,3,pass,0.229209;0.246041;0.273709
-boundary_700000000_reverse,6,10,6,frontier32_gpu_dag,0.523833,0.220750,0.060375,24,8,3,0,0.044708,3,pass,0.523833;0.498833;0.540417
-boundary_700000000_reverse,6,10,6,bucket32_d4,0.240041,0.214875,0.074250,24,8,1,0,0.044708,3,pass,0.240041;0.244500;0.230375
-boundary_700000000_reverse,6,10,6,bucket32_d16,0.362708,0.330541,0.084500,24,8,1,0,0.044708,3,pass,0.397958;0.301208;0.362708
-boundary_700000000_reverse,6,10,6,bucket32_d64,0.333583,0.250791,0.068667,24,8,1,0,0.044708,3,pass,0.347292;0.333583;0.265750
-boundary_700000000_reverse_masked,6,10,6,old_pull_serial,0.137542,0.136750,0.012625,360,6,1,0,0.065000,3,pass,0.137542;0.134292;0.138000
-boundary_700000000_reverse_masked,6,10,6,old_group_serial,0.120291,0.119625,0.004708,90,2,1,0,0.065000,3,pass,0.125916;0.119667;0.120291
-boundary_700000000_reverse_masked,6,10,6,old_pull_parallel_dag,0.176375,0.136833,0.012625,360,6,1,0,0.065000,3,pass,0.158458;0.181459;0.176375
-boundary_700000000_reverse_masked,6,10,6,old_group_parallel_dag,0.151667,0.128583,0.004750,90,2,1,0,0.065000,3,pass,0.167542;0.151667;0.147500
-boundary_700000000_reverse_masked,6,10,6,pull64_barrier,0.200709,0.166916,0.015167,360,6,1,0,0.065000,3,pass,0.200709;0.212041;0.181625
-boundary_700000000_reverse_masked,6,10,6,pull64_interleaved,0.226166,0.190208,0.017125,360,6,1,0,0.065000,3,pass,0.279458;0.226166;0.219291
-boundary_700000000_reverse_masked,6,10,6,pull32_interleaved,0.195708,0.164333,0.014333,360,6,1,0,0.065000,3,pass,0.306500;0.195708;0.174541
-boundary_700000000_reverse_masked,6,10,6,pull32_gpu_dag,0.511625,0.188000,0.027583,360,6,3,0,0.065000,3,pass,0.499792;0.511625;0.520417
-boundary_700000000_reverse_masked,6,10,6,frontier32_vertex,0.249584,0.218250,0.049750,9,8,1,0,0.065000,3,pass,0.260375;0.237958;0.249584
-boundary_700000000_reverse_masked,6,10,6,frontier32_simd,0.192000,0.174375,0.042500,9,8,1,0,0.065000,3,pass,0.222542;0.188917;0.192000
-boundary_700000000_reverse_masked,6,10,6,frontier32_gpu_dag,0.520750,0.196708,0.051583,9,8,3,0,0.065000,3,pass,0.499458;0.557625;0.520750
-boundary_700000000_reverse_masked,6,10,6,bucket32_d4,0.279375,0.251042,0.081875,9,8,1,0,0.065000,3,pass,0.264584;0.296875;0.279375
-boundary_700000000_reverse_masked,6,10,6,bucket32_d16,0.287792,0.265666,0.081750,9,8,1,0,0.065000,3,pass,0.274875;0.287792;0.295458
-boundary_700000000_reverse_masked,6,10,6,bucket32_d64,0.289625,0.255250,0.068125,9,8,1,0,0.065000,3,pass,0.312834;0.289625;0.250416
-boundary_715827883,6,10,6,old_pull_serial,0.120209,0.119500,0.013125,360,6,1,0,0.058791,3,pass,0.127541;0.120209;0.119917
-boundary_715827883,6,10,6,old_group_serial,0.107166,0.106500,0.006875,160,5,1,0,0.058791,3,pass,0.104417;0.107166;0.108041
-boundary_715827883,6,10,6,old_pull_parallel_dag,0.154000,0.125000,0.013250,360,6,1,0,0.058791,3,pass,0.144125;0.154000;0.171916
-boundary_715827883,6,10,6,old_group_parallel_dag,0.149500,0.114125,0.006875,160,5,1,0,0.058791,3,pass,0.149500;0.140417;0.221042
-boundary_715827883,6,10,6,pull64_barrier,0.222166,0.191750,0.018375,360,6,1,0,0.058791,3,pass,0.214458;0.222166;0.228209
-boundary_715827883,6,10,6,pull64_interleaved,0.189958,0.162959,0.015000,360,6,1,0,0.058791,3,pass,0.184833;0.189958;0.197084
-boundary_715827883,6,10,6,pull32_interleaved,0.192500,0.168000,0.015125,360,6,1,1,0.058791,3,pass,0.192500;0.184500;0.219584
-boundary_715827883,6,10,6,pull32_gpu_dag,0.479250,0.158583,0.024750,360,6,3,1,0.058791,3,pass,0.643291;0.422334;0.479250
-boundary_715827883,6,10,6,frontier32_vertex,0.198375,0.168625,0.015708,360,6,1,1,0.058791,3,pass,0.198375;0.200375;0.183875
-boundary_715827883,6,10,6,frontier32_simd,0.195458,0.156708,0.015750,360,6,1,1,0.058791,3,pass,0.195458;0.203875;0.169375
-boundary_715827883,6,10,6,frontier32_gpu_dag,0.538875,0.189083,0.028750,360,6,3,1,0.058791,3,pass,0.538875;0.638625;0.527042
-boundary_715827883,6,10,6,bucket32_d4,0.226209,0.195500,0.018375,360,6,1,1,0.058791,3,pass,0.226209;0.233750;0.219250
-boundary_715827883,6,10,6,bucket32_d16,0.195584,0.172416,0.015000,360,6,1,1,0.058791,3,pass,0.194333;0.195584;0.202875
-boundary_715827883,6,10,6,bucket32_d64,0.167458,0.142375,0.015125,360,6,1,1,0.058791,3,pass,0.156583;0.167458;0.173500
-boundary_715827883_masked,6,10,6,old_pull_serial,0.122709,0.122167,0.012750,360,6,1,0,0.041375,3,pass,0.124458;0.122709;0.118166
-boundary_715827883_masked,6,10,6,old_group_serial,0.114333,0.113750,0.004750,80,2,1,0,0.041375,3,pass,0.105541;0.117458;0.114333
-boundary_715827883_masked,6,10,6,old_pull_parallel_dag,0.189625,0.160583,0.012750,360,6,1,0,0.041375,3,pass,0.239917;0.189625;0.162708
-boundary_715827883_masked,6,10,6,old_group_parallel_dag,0.177833,0.145375,0.004750,80,2,1,0,0.041375,3,pass,0.204292;0.177833;0.157375
-boundary_715827883_masked,6,10,6,pull64_barrier,0.228125,0.197083,0.018375,360,6,1,0,0.041375,3,pass,0.251083;0.210958;0.228125
-boundary_715827883_masked,6,10,6,pull64_interleaved,0.184666,0.154875,0.015125,360,6,1,0,0.041375,3,pass,0.184666;0.182042;0.220166
-boundary_715827883_masked,6,10,6,pull32_interleaved,0.194125,0.165958,0.015375,360,6,1,1,0.041375,3,pass,0.187125;0.194125;0.205083
-boundary_715827883_masked,6,10,6,pull32_gpu_dag,0.492167,0.173541,0.025833,360,6,3,1,0.041375,3,pass,0.472000;0.507250;0.492167
-boundary_715827883_masked,6,10,6,frontier32_vertex,0.177375,0.156958,0.015334,360,6,1,1,0.041375,3,pass,0.177375;0.174542;0.179959
-boundary_715827883_masked,6,10,6,frontier32_simd,0.198167,0.164041,0.016083,360,6,1,1,0.041375,3,pass,0.183417;0.198167;0.200417
-boundary_715827883_masked,6,10,6,frontier32_gpu_dag,0.472833,0.168333,0.023292,360,6,3,1,0.041375,3,pass,0.462959;0.472833;0.561042
-boundary_715827883_masked,6,10,6,bucket32_d4,0.206875,0.162125,0.015000,360,6,1,1,0.041375,3,pass,0.206875;0.183792;0.220083
-boundary_715827883_masked,6,10,6,bucket32_d16,0.220500,0.186875,0.018250,360,6,1,1,0.041375,3,pass,0.223125;0.210041;0.220500
-boundary_715827883_masked,6,10,6,bucket32_d64,0.221208,0.187541,0.018250,360,6,1,1,0.041375,3,pass,0.221208;0.235125;0.213209
-boundary_715827883_reverse,6,10,6,old_pull_serial,0.133417,0.132625,0.012792,360,6,1,0,0.054333,3,pass,0.124125;0.133417;0.135875
-boundary_715827883_reverse,6,10,6,old_group_serial,0.118458,0.117417,0.006833,170,5,1,0,0.054333,3,pass,0.122917;0.118458;0.112583
-boundary_715827883_reverse,6,10,6,old_pull_parallel_dag,0.165083,0.128666,0.013000,360,6,1,0,0.054333,3,pass,0.169708;0.165083;0.153750
-boundary_715827883_reverse,6,10,6,old_group_parallel_dag,0.142916,0.115625,0.006833,170,5,1,0,0.054333,3,pass,0.133959;0.142916;0.147958
-boundary_715827883_reverse,6,10,6,pull64_barrier,0.178375,0.160750,0.014750,360,6,1,0,0.054333,3,pass,0.178208;0.178375;0.178792
-boundary_715827883_reverse,6,10,6,pull64_interleaved,0.158041,0.141666,0.014167,360,6,1,0,0.054333,3,pass,0.156916;0.254833;0.158041
-boundary_715827883_reverse,6,10,6,pull32_interleaved,0.164167,0.149250,0.014958,360,6,1,1,0.054333,3,pass,0.164042;0.189750;0.164167
-boundary_715827883_reverse,6,10,6,pull32_gpu_dag,0.538250,0.199834,0.027083,360,6,3,1,0.054333,3,pass,0.539208;0.538250;0.507209
-boundary_715827883_reverse,6,10,6,frontier32_vertex,0.203375,0.173375,0.014250,360,6,1,1,0.054333,3,pass,0.203375;0.195083;0.226000
-boundary_715827883_reverse,6,10,6,frontier32_simd,0.196125,0.162666,0.014417,360,6,1,1,0.054333,3,pass,0.185291;0.196125;0.244042
-boundary_715827883_reverse,6,10,6,frontier32_gpu_dag,0.488000,0.175500,0.027667,360,6,3,1,0.054333,3,pass,0.488000;0.462750;0.532166
-boundary_715827883_reverse,6,10,6,bucket32_d4,0.164000,0.148625,0.014542,360,6,1,1,0.054333,3,pass,0.164000;0.152834;0.167458
-boundary_715827883_reverse,6,10,6,bucket32_d16,0.195000,0.168500,0.014708,360,6,1,1,0.054333,3,pass,0.188333;0.256042;0.195000
-boundary_715827883_reverse,6,10,6,bucket32_d64,0.212875,0.184917,0.017666,360,6,1,1,0.054333,3,pass,0.208166;0.344916;0.212875
-boundary_715827883_reverse_masked,6,10,6,old_pull_serial,0.150292,0.149625,0.015375,360,6,1,0,0.052417,3,pass,0.126208;0.150458;0.150292
-boundary_715827883_reverse_masked,6,10,6,old_group_serial,0.127916,0.127333,0.004750,90,2,1,0,0.052417,3,pass,0.127916;0.134125;0.119375
-boundary_715827883_reverse_masked,6,10,6,old_pull_parallel_dag,0.164542,0.136541,0.013125,360,6,1,0,0.052417,3,pass,0.181750;0.164542;0.151083
-boundary_715827883_reverse_masked,6,10,6,old_group_parallel_dag,0.154042,0.127375,0.004875,90,2,1,0,0.052417,3,pass,0.154042;0.156250;0.153292
-boundary_715827883_reverse_masked,6,10,6,pull64_barrier,0.200333,0.165125,0.015125,360,6,1,0,0.052417,3,pass,0.200333;0.199875;0.204416
-boundary_715827883_reverse_masked,6,10,6,pull64_interleaved,0.210792,0.185334,0.017625,360,6,1,0,0.052417,3,pass,0.227500;0.210792;0.200375
-boundary_715827883_reverse_masked,6,10,6,pull32_interleaved,0.217375,0.185084,0.017625,360,6,1,1,0.052417,3,pass,0.217833;0.217375;0.195375
-boundary_715827883_reverse_masked,6,10,6,pull32_gpu_dag,0.515250,0.196792,0.027292,360,6,3,1,0.052417,3,pass,0.515250;0.479500;0.549708
-boundary_715827883_reverse_masked,6,10,6,frontier32_vertex,0.219458,0.190250,0.017667,360,6,1,1,0.052417,3,pass,0.219458;0.250125;0.216333
-boundary_715827883_reverse_masked,6,10,6,frontier32_simd,0.212375,0.181250,0.017625,360,6,1,1,0.052417,3,pass,0.194709;0.212375;0.214000
-boundary_715827883_reverse_masked,6,10,6,frontier32_gpu_dag,0.486708,0.177208,0.027583,360,6,3,1,0.052417,3,pass,0.479000;0.493500;0.486708
-boundary_715827883_reverse_masked,6,10,6,bucket32_d4,0.193167,0.156750,0.014750,360,6,1,1,0.052417,3,pass,0.193167;0.200750;0.182042
-boundary_715827883_reverse_masked,6,10,6,bucket32_d16,0.192625,0.164209,0.015333,360,6,1,1,0.052417,3,pass,0.192625;0.185167;0.198417
-boundary_715827883_reverse_masked,6,10,6,bucket32_d64,0.208375,0.186750,0.017542,360,6,1,1,0.052417,3,pass,0.200917;0.218917;0.208375
-boundary_9007199254740993,6,10,6,old_pull_serial,0.148291,0.147583,0.015875,360,6,1,0,0.073999,3,pass,0.148291;0.147667;0.150250
-boundary_9007199254740993,6,10,6,old_group_serial,0.111833,0.111167,0.006917,160,5,1,0,0.073999,3,pass,0.109625;0.111833;0.127792
-boundary_9007199254740993,6,10,6,old_pull_parallel_dag,0.181458,0.154458,0.015750,360,6,1,0,0.073999,3,pass,0.184667;0.181458;0.176167
-boundary_9007199254740993,6,10,6,old_group_parallel_dag,0.149375,0.119625,0.007125,160,5,1,0,0.073999,3,pass,0.164833;0.147291;0.149375
-boundary_9007199254740993,6,10,6,pull64_barrier,0.200917,0.170292,0.015292,360,6,1,0,0.073999,3,pass,0.199125;0.200917;0.205000
-boundary_9007199254740993,6,10,6,pull64_interleaved,0.212291,0.186167,0.015042,360,6,1,0,0.073999,3,pass,0.212291;0.209834;0.279417
-boundary_9007199254740993,6,10,6,pull32_interleaved,0.159792,0.142750,0.014667,360,6,1,1,0.073999,3,pass,0.167709;0.159042;0.159792
-boundary_9007199254740993,6,10,6,pull32_gpu_dag,0.554792,0.159666,0.029250,360,6,3,1,0.073999,3,pass,0.554792;0.493083;0.578709
-boundary_9007199254740993,6,10,6,frontier32_vertex,0.185416,0.153667,0.017792,360,6,1,1,0.073999,3,pass,0.176292;0.185416;0.188042
-boundary_9007199254740993,6,10,6,frontier32_simd,0.187125,0.155875,0.018250,360,6,1,1,0.073999,3,pass,0.174750;0.187125;0.191708
-boundary_9007199254740993,6,10,6,frontier32_gpu_dag,0.415458,0.156042,0.025916,360,6,3,1,0.073999,3,pass,0.415458;0.400750;0.484833
-boundary_9007199254740993,6,10,6,bucket32_d4,0.176666,0.146292,0.014875,360,6,1,1,0.073999,3,pass,0.210084;0.176666;0.135250
-boundary_9007199254740993,6,10,6,bucket32_d16,0.132542,0.115500,0.014917,360,6,1,1,0.073999,3,pass,0.136166;0.132542;0.130709
-boundary_9007199254740993,6,10,6,bucket32_d64,0.137417,0.121500,0.015042,360,6,1,1,0.073999,3,pass,0.137417;0.129125;0.195834
-boundary_9007199254740993_masked,6,10,6,old_pull_serial,0.105291,0.104750,0.012833,360,6,1,0,0.054125,3,pass,0.107125;0.104375;0.105291
-boundary_9007199254740993_masked,6,10,6,old_group_serial,0.095459,0.094708,0.005041,80,2,1,0,0.054125,3,pass,0.093375;0.174292;0.095459
-boundary_9007199254740993_masked,6,10,6,old_pull_parallel_dag,0.215208,0.159625,0.014791,360,6,1,0,0.054125,3,pass,0.219666;0.215208;0.155541
-boundary_9007199254740993_masked,6,10,6,old_group_parallel_dag,0.135333,0.106834,0.004625,80,2,1,0,0.054125,3,pass,0.133708;0.135625;0.135333
-boundary_9007199254740993_masked,6,10,6,pull64_barrier,0.188291,0.151667,0.018125,360,6,1,0,0.054125,3,pass,0.188291;0.192292;0.160167
-boundary_9007199254740993_masked,6,10,6,pull64_interleaved,0.179083,0.156084,0.018250,360,6,1,0,0.054125,3,pass,0.178208;0.197125;0.179083
-boundary_9007199254740993_masked,6,10,6,pull32_interleaved,0.179709,0.150083,0.018125,360,6,1,1,0.054125,3,pass,0.179709;0.174000;0.180917
-boundary_9007199254740993_masked,6,10,6,pull32_gpu_dag,0.349458,0.133792,0.023625,360,6,3,1,0.054125,3,pass,0.546208;0.344834;0.349458
-boundary_9007199254740993_masked,6,10,6,frontier32_vertex,0.131041,0.115417,0.014500,360,6,1,1,0.054125,3,pass,0.136250;0.131041;0.129208
-boundary_9007199254740993_masked,6,10,6,frontier32_simd,0.136125,0.119875,0.015000,360,6,1,1,0.054125,3,pass,0.136125;0.128042;0.141625
-boundary_9007199254740993_masked,6,10,6,frontier32_gpu_dag,0.478416,0.157208,0.027375,360,6,3,1,0.054125,3,pass,0.553709;0.478416;0.475792
-boundary_9007199254740993_masked,6,10,6,bucket32_d4,0.214250,0.193083,0.015500,360,6,1,1,0.054125,3,pass,0.163333;0.214250;0.219959
-boundary_9007199254740993_masked,6,10,6,bucket32_d16,0.168917,0.144875,0.015000,360,6,1,1,0.054125,3,pass,0.181250;0.156250;0.168917
-boundary_9007199254740993_masked,6,10,6,bucket32_d64,0.142958,0.125459,0.015375,360,6,1,1,0.054125,3,pass,0.129083;0.147166;0.142958
-boundary_9007199254740993_reverse,6,10,6,old_pull_serial,0.105875,0.105083,0.013125,360,6,1,0,0.050126,3,pass,0.102041;0.107958;0.105875
-boundary_9007199254740993_reverse,6,10,6,old_group_serial,0.092250,0.091500,0.006917,170,5,1,0,0.050126,3,pass,0.092250;0.097667;0.092209
-boundary_9007199254740993_reverse,6,10,6,old_pull_parallel_dag,0.123375,0.107333,0.013250,360,6,1,0,0.050126,3,pass,0.150458;0.118958;0.123375
-boundary_9007199254740993_reverse,6,10,6,old_group_parallel_dag,0.132916,0.101792,0.007125,170,5,1,0,0.050126,3,pass,0.132916;0.136167;0.130209
-boundary_9007199254740993_reverse,6,10,6,pull64_barrier,0.189875,0.154125,0.017500,360,6,1,0,0.050126,3,pass,0.189209;0.189875;0.196541
-boundary_9007199254740993_reverse,6,10,6,pull64_interleaved,0.183333,0.161208,0.017625,360,6,1,0,0.050126,3,pass,0.192208;0.182208;0.183333
-boundary_9007199254740993_reverse,6,10,6,pull32_interleaved,0.188125,0.153708,0.017625,360,6,1,1,0.050126,3,pass,0.178292;0.188125;0.288375
-boundary_9007199254740993_reverse,6,10,6,pull32_gpu_dag,0.359916,0.136875,0.023292,360,6,3,1,0.050126,3,pass,0.359916;0.428209;0.350042
-boundary_9007199254740993_reverse,6,10,6,frontier32_vertex,0.152250,0.128333,0.014125,360,6,1,1,0.050126,3,pass,0.152250;0.126959;0.154625
-boundary_9007199254740993_reverse,6,10,6,frontier32_simd,0.179542,0.141500,0.014250,360,6,1,1,0.050126,3,pass,0.168500;0.179542;0.238833
-boundary_9007199254740993_reverse,6,10,6,frontier32_gpu_dag,0.379959,0.137208,0.023500,360,6,3,1,0.050126,3,pass,0.380500;0.358625;0.379959
-boundary_9007199254740993_reverse,6,10,6,bucket32_d4,0.196292,0.171875,0.014500,360,6,1,1,0.050126,3,pass,0.163083;0.196292;0.347041
-boundary_9007199254740993_reverse,6,10,6,bucket32_d16,0.175666,0.155333,0.014958,360,6,1,1,0.050126,3,pass,0.157667;0.231708;0.175666
-boundary_9007199254740993_reverse,6,10,6,bucket32_d64,0.190459,0.151084,0.015333,360,6,1,1,0.050126,3,pass,0.240750;0.190459;0.167292
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_serial,0.124667,0.124083,0.015542,360,6,1,0,0.052000,3,pass,0.124750;0.124667;0.123667
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_serial,0.099584,0.098583,0.004750,90,2,1,0,0.052000,3,pass,0.100834;0.093209;0.099584
-boundary_9007199254740993_reverse_masked,6,10,6,old_pull_parallel_dag,0.153292,0.125583,0.015208,360,6,1,0,0.052000,3,pass,0.153292;0.151333;0.153875
-boundary_9007199254740993_reverse_masked,6,10,6,old_group_parallel_dag,0.127750,0.094666,0.004750,90,2,1,0,0.052000,3,pass,0.120042;0.129625;0.127750
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_barrier,0.219833,0.181916,0.015375,360,6,1,0,0.052000,3,pass,0.148166;0.282542;0.219833
-boundary_9007199254740993_reverse_masked,6,10,6,pull64_interleaved,0.188667,0.157459,0.017625,360,6,1,0,0.052000,3,pass,0.188667;0.161000;0.282667
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_interleaved,0.184958,0.157708,0.017792,360,6,1,1,0.052000,3,pass,0.199709;0.184958;0.184500
-boundary_9007199254740993_reverse_masked,6,10,6,pull32_gpu_dag,0.490041,0.163625,0.027375,360,6,3,1,0.052000,3,pass,0.540292;0.427375;0.490041
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_vertex,0.221041,0.194458,0.017542,360,6,1,1,0.052000,3,pass,0.221041;0.194292;0.230875
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_simd,0.172083,0.145625,0.015625,360,6,1,1,0.052000,3,pass,0.174542;0.172083;0.160959
-boundary_9007199254740993_reverse_masked,6,10,6,frontier32_gpu_dag,0.492375,0.153000,0.026167,360,6,3,1,0.052000,3,pass,0.492375;0.613458;0.419833
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d4,0.183167,0.154000,0.014375,360,6,1,1,0.052000,3,pass,0.183167;0.158125;0.202250
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d16,0.190542,0.156167,0.018000,360,6,1,1,0.052000,3,pass,0.190542;0.196500;0.181542
-boundary_9007199254740993_reverse_masked,6,10,6,bucket32_d64,0.186166,0.161334,0.017917,360,6,1,1,0.052000,3,pass,0.186166;0.183459;0.225917
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a1-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a1-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a1.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a1.csv
deleted file mode 100644
index fdbf690..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a1.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,cpu_heap_cached_full,0.052958,7,pass,0.055375;0.051625;0.052917;0.051458;0.052958;0.058583;0.058166
-random,1024,8192,1,cpu_dial_full,0.027667,7,pass,0.030167;0.030541;0.028125;0.027667;0.027250;0.026833;0.026375
-random,4096,32768,256,cpu_heap_cached_full,13.029500,7,pass,13.029500;13.040792;13.013792;13.009291;13.009958;13.036750;14.042792
-random,4096,32768,256,cpu_dial_full,7.056208,7,pass,7.469875;7.434375;7.234209;6.965958;6.996125;7.056208;7.033417
-random,16384,131072,64,cpu_heap_cached_full,17.500459,7,pass,17.562542;17.286708;17.264542;17.357083;17.652583;17.583833;17.500459
-random,16384,131072,64,cpu_dial_full,7.696333,7,pass,7.668375;7.706958;7.745167;7.718791;7.696333;7.663042;7.625000
-random,65536,524288,1,cpu_heap_cached_full,11.474125,7,pass,11.148208;11.188916;11.564208;11.558541;11.339750;11.482000;11.474125
-random,65536,524288,1,cpu_dial_full,4.384459,7,pass,4.454542;4.378833;4.385375;4.329667;4.531666;4.312333;4.384459
-random,4096,131072,64,cpu_heap_cached_full,6.672416,7,pass,6.661917;6.739334;6.643583;6.657541;6.681834;6.698125;6.672416
-random,4096,131072,64,cpu_dial_full,3.853958,7,pass,3.851458;3.853958;3.815916;3.857375;3.879833;3.874917;3.831292
-clos,800,320000,64,cpu_heap_cached_full,5.124625,7,pass,5.071875;5.124625;5.096666;5.870542;5.049958;5.355042;5.716333
-clos,800,320000,64,cpu_dial_full,5.421083,7,pass,5.830666;5.848000;5.917417;5.170042;5.150375;5.105084;5.421083
-grid,10000,39600,1,cpu_heap_cached_full,0.200833,7,pass,0.200833;0.257167;0.200416;0.202250;0.192083;0.180000;0.204292
-grid,10000,39600,1,cpu_dial_full,0.126041,7,pass,0.119416;0.116334;0.126041;0.115459;0.129583;0.129291;0.132166
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a2-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a2-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a2.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a2.csv
deleted file mode 100644
index 024e84a..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/a2.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,cpu_heap_cached_full,0.059333,7,pass,0.061000;0.064709;0.059916;0.058375;0.058000;0.059333;0.052125
-random,1024,8192,1,cpu_dial_full,0.030000,7,pass,0.034542;0.033125;0.031083;0.029209;0.027208;0.027000;0.030000
-random,4096,32768,256,cpu_heap_cached_full,13.024459,7,pass,13.041833;13.021250;13.009584;13.024459;13.033625;13.042542;12.991958
-random,4096,32768,256,cpu_dial_full,6.924667,7,pass,7.101083;6.924792;7.021833;6.864833;6.924667;6.870667;6.819209
-random,16384,131072,64,cpu_heap_cached_full,17.268250,7,pass,17.273042;17.266000;17.288208;17.268250;17.267209;17.275833;17.255375
-random,16384,131072,64,cpu_dial_full,7.677208,7,pass,7.677208;7.706875;7.657458;7.665875;7.719333;7.661292;7.683000
-random,65536,524288,1,cpu_heap_cached_full,11.530166,7,pass,11.564417;11.470750;11.483750;11.310125;11.569583;11.530166;11.626875
-random,65536,524288,1,cpu_dial_full,4.372167,7,pass,4.378333;4.454333;4.364667;4.227000;4.345917;4.372167;4.389167
-random,4096,131072,64,cpu_heap_cached_full,6.661792,7,pass,6.657041;6.646792;6.646166;6.707916;6.693375;6.663542;6.661792
-random,4096,131072,64,cpu_dial_full,3.865375,7,pass,3.805375;3.811917;3.905625;3.897042;3.809458;3.865375;3.871209
-clos,800,320000,64,cpu_heap_cached_full,5.390792,7,pass,5.126500;5.165833;15.349250;5.390792;5.835791;5.412709;5.085000
-clos,800,320000,64,cpu_dial_full,5.537125,7,pass,5.858500;5.165833;5.832709;5.052833;5.651083;5.096667;5.537125
-grid,10000,39600,1,cpu_heap_cached_full,0.193709,7,pass,0.196375;0.197750;0.194000;0.193083;0.193208;0.193500;0.193709
-grid,10000,39600,1,cpu_dial_full,0.128833,7,pass,0.125792;0.133583;0.128833;0.130583;0.127667;0.127958;0.137959
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b-stderr.txt
deleted file mode 100644
index 3f8d1ea..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=23.7095 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b.csv
deleted file mode 100644
index 0abc818..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/b.csv
+++ /dev/null
@@ -1,217 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_parallel_dag,0.735000,0.722250,0.424250,131072,16,2,0,0.152417,7,pass,1.450333;1.486334;0.967291;0.691833;0.685125;0.682417;0.735000
-random,1024,8192,1,old_group_parallel_dag,0.894458,0.850750,0.680500,106496,13,1,0,0.152417,7,pass,0.924500;0.981625;0.889666;0.890459;0.909083;0.894458;0.841666
-random,1024,8192,1,pull64_barrier,0.665000,0.652208,0.384125,131072,16,2,0,0.152417,7,pass,0.679666;0.653042;0.631167;0.737750;0.683292;0.665000;0.658708
-random,1024,8192,1,pull64_interleaved,0.659958,0.647541,0.378167,131072,16,2,0,0.152417,7,pass,0.666709;0.682333;0.666000;0.656667;0.631250;0.628625;0.659958
-random,1024,8192,1,pull32_interleaved,0.633625,0.621125,0.349458,131072,16,2,0,0.152417,7,pass,0.630000;0.633625;0.646917;0.592625;0.621542;0.675042;0.679750
-random,1024,8192,1,pull32_gpu_dag,0.990667,0.586750,0.402625,131072,16,4,0,0.152417,7,pass,0.929750;0.903791;1.223750;1.103542;0.990667;1.068833;0.932250
-random,1024,8192,1,frontier32_vertex,0.956250,0.942417,0.645375,21088,16,2,0,0.152417,7,pass,0.942042;0.919167;0.956250;0.913625;0.964292;0.977375;0.982875
-random,1024,8192,1,frontier32_simd,0.693166,0.679333,0.379875,20552,16,2,0,0.152417,7,pass,0.676959;0.682750;1.409167;0.693166;0.755167;0.726708;0.655709
-random,1024,8192,1,frontier32_gpu_dag,1.101792,0.705875,0.452875,20328,16,4,0,0.152417,7,pass,1.224167;1.188959;1.101708;1.075709;1.073083;1.115791;1.101792
-random,1024,8192,1,bucket32_d4,1.894708,1.866500,1.272125,8232,32,4,0,0.152417,7,pass,1.987625;1.809250;1.931750;1.894708;1.811083;1.865583;1.993666
-random,1024,8192,1,bucket32_d16,1.462625,1.450541,0.908583,9336,24,3,0,0.152417,7,pass,2.104125;1.320875;1.538500;1.462625;1.601084;1.308042;1.351917
-random,1024,8192,1,bucket32_d64,0.952167,0.937292,0.644333,19312,16,2,0,0.152417,7,pass,1.248750;0.942959;0.996125;1.000625;0.952167;0.918417;0.940625
-random,1024,8192,64,old_pull_parallel_dag,1.937417,1.589708,1.084625,12582912,24,3,0,0.208500,7,pass,2.420375;2.350666;1.955666;1.937417;1.594375;1.582541;1.730292
-random,1024,8192,64,old_group_parallel_dag,0.852708,0.603458,0.416792,7217152,17,1,0,0.208500,7,pass,0.899041;0.998958;0.968625;0.852708;0.836250;0.792500;0.839000
-random,1024,8192,64,pull64_barrier,1.220375,0.975833,0.486292,12582912,24,3,0,0.208500,7,pass,1.220375;1.225167;1.314583;1.287208;1.146875;1.154083;1.183792
-random,1024,8192,64,pull64_interleaved,1.019833,0.760458,0.291000,12582912,24,3,0,0.208500,7,pass,1.065083;1.019833;1.055625;1.020583;0.974209;0.890417;0.998166
-random,1024,8192,64,pull32_interleaved,0.898917,0.634625,0.200167,12582912,24,3,0,0.208500,7,pass,0.898917;0.960667;0.884000;0.879625;0.850791;0.908417;0.920541
-random,1024,8192,64,pull32_gpu_dag,0.969041,0.585417,0.211667,12582912,24,5,0,0.208500,7,pass,0.969041;0.922042;1.008667;0.936709;1.172417;0.945333;1.045625
-random,1024,8192,64,frontier32_vertex,0.813125,0.530375,0.237208,1291032,16,2,0,0.208500,7,pass,0.845167;0.832625;0.813125;0.760750;0.796042;0.843375;0.760958
-random,1024,8192,64,frontier32_simd,1.042375,0.767125,0.452000,1202792,16,2,0,0.208500,7,pass,1.040375;1.059958;0.977208;1.055125;1.042375;0.995208;1.095584
-random,1024,8192,64,frontier32_gpu_dag,1.139000,0.779834,0.484125,1201976,16,4,0,0.208500,7,pass,1.239666;1.290666;1.062875;1.191292;1.127000;1.139000;1.046209
-random,1024,8192,64,bucket32_d4,2.241625,1.943125,1.017667,528520,56,7,0,0.208500,7,pass,2.336875;2.171250;2.283750;2.244750;2.202083;2.176583;2.241625
-random,1024,8192,64,bucket32_d16,1.528958,1.240375,0.663416,601288,32,4,0,0.208500,7,pass,1.477458;1.556208;1.529250;1.455791;1.528958;1.506209;1.531625
-random,1024,8192,64,bucket32_d64,1.433209,1.182000,0.675708,1154152,24,3,0,0.208500,7,pass,1.433209;1.409208;1.480083;1.452917;1.396292;1.491125;1.332208
-clos,200,20000,64,old_pull_parallel_dag,1.969833,1.397334,0.992208,10240000,8,1,0,0.332250,7,pass,2.147375;1.969833;1.709542;2.082542;1.738042;1.786209;2.212375
-clos,200,20000,64,old_group_parallel_dag,1.303791,0.804000,0.299042,3840000,3,1,0,0.332250,7,pass,1.323042;1.303791;1.293500;1.411875;1.069792;1.187042;1.491250
-clos,200,20000,64,pull64_barrier,2.484167,1.863542,1.278250,10240000,8,1,0,0.332250,7,pass,1.892958;2.403958;2.889250;2.317666;2.823000;2.484167;2.843584
-clos,200,20000,64,pull64_interleaved,1.915375,1.354625,0.765750,10240000,8,1,0,0.332250,7,pass,2.070042;1.927292;1.970375;1.915375;1.735583;1.896833;1.832083
-clos,200,20000,64,pull32_interleaved,1.882875,1.271375,0.676375,10240000,8,1,0,0.332250,7,pass,1.980333;1.772375;2.333209;2.149583;1.880167;1.809750;1.882875
-clos,200,20000,64,pull32_gpu_dag,2.063542,1.271125,1.000041,10240000,8,3,0,0.332250,7,pass,2.062708;2.111917;1.881792;2.063542;2.313125;2.266500;1.893166
-clos,200,20000,64,frontier32_vertex,2.130125,1.556167,0.945083,1280000,8,1,0,0.332250,7,pass,2.216500;2.130125;2.210583;1.863375;2.020208;2.181958;2.088666
-clos,200,20000,64,frontier32_simd,1.526333,0.956416,0.331917,1280000,8,1,0,0.332250,7,pass,1.383833;1.526333;1.478875;1.852542;1.436500;1.554041;1.578417
-clos,200,20000,64,frontier32_gpu_dag,2.066125,0.959000,0.844250,1280000,8,3,0,0.332250,7,pass,2.224500;1.735458;1.906792;2.066125;2.169666;2.396917;1.847250
-clos,200,20000,64,bucket32_d4,1.608916,1.072709,0.487625,1280000,8,1,0,0.332250,7,pass,1.291333;1.464042;1.642750;1.661542;1.763500;1.594834;1.608916
-clos,200,20000,64,bucket32_d16,1.782834,1.158959,0.500250,1280000,8,1,0,0.332250,7,pass,1.782834;1.714834;1.623458;2.323750;1.886750;2.390166;1.669083
-clos,200,20000,64,bucket32_d64,1.644084,1.123167,0.491375,1280000,8,1,0,0.332250,7,pass,1.536000;1.733125;1.951083;1.288625;1.644084;1.687625;1.508750
-grid,1024,3968,1,old_pull_parallel_dag,1.988666,1.978791,0.655042,253952,64,8,0,0.126000,7,pass,2.192792;1.794083;1.711292;1.642333;2.324041;2.040042;1.988666
-grid,1024,3968,1,old_group_parallel_dag,0.354333,0.344792,0.227083,249984,63,1,0,0.126000,7,pass,0.357958;0.353500;0.348292;0.354667;0.367708;0.354333;0.352458
-grid,1024,3968,1,pull64_barrier,1.101208,1.092375,0.173458,253952,64,8,0,0.126000,7,pass,1.101208;1.075666;1.197417;1.305459;1.066333;1.098666;1.168958
-grid,1024,3968,1,pull64_interleaved,1.102667,1.094791,0.173334,253952,64,8,0,0.126000,7,pass,1.220083;1.096709;1.102667;1.070708;1.101917;1.107459;1.132750
-grid,1024,3968,1,pull32_interleaved,1.116333,1.109458,0.159500,253952,64,8,0,0.126000,7,pass,1.065125;1.116333;1.098625;1.164500;1.273792;1.174125;1.070041
-grid,1024,3968,1,pull32_gpu_dag,1.169000,0.897708,0.169125,253952,64,10,0,0.126000,7,pass,1.129959;1.169000;1.173791;1.234958;1.194917;1.142833;1.136208
-grid,1024,3968,1,frontier32_vertex,1.287959,1.279750,0.518750,3968,64,8,0,0.126000,7,pass,1.275167;1.336000;1.287959;1.266750;1.320542;1.339834;1.279000
-grid,1024,3968,1,frontier32_simd,1.186417,1.178375,0.389875,3968,64,8,0,0.126000,7,pass,1.234375;1.146250;1.186417;1.171416;1.193500;1.268916;1.171458
-grid,1024,3968,1,frontier32_gpu_dag,1.444166,1.178625,0.405291,3968,64,10,0,0.126000,7,pass,1.394750;1.443917;1.570542;1.444166;1.444042;1.468875;1.606291
-grid,1024,3968,1,bucket32_d4,1.458042,1.450000,0.641250,3968,64,8,0,0.126000,7,pass,1.458042;1.446916;1.443291;1.455125;1.572041;1.467250;1.462417
-grid,1024,3968,1,bucket32_d16,1.450417,1.442583,0.646250,3968,64,8,0,0.126000,7,pass,1.568000;1.441375;1.585875;1.439833;1.450417;1.446250;1.577625
-grid,1024,3968,1,bucket32_d64,1.462208,1.454292,0.645042,3968,64,8,0,0.126000,7,pass,1.447292;1.462208;1.581541;1.449167;1.615959;1.469667;1.437709
-hub,1024,3070,1,old_pull_parallel_dag,6.087125,6.074167,5.541583,98240,32,4,0,0.123417,7,pass,6.160125;6.074625;6.215417;6.087125;6.141625;5.971583;6.010708
-hub,1024,3070,1,old_group_parallel_dag,4.883667,4.859875,4.720875,95170,31,1,0,0.123417,7,pass,4.873500;4.835042;4.883667;4.900833;4.866416;5.016625;4.921584
-hub,1024,3070,1,pull64_barrier,5.015958,5.001833,4.312792,98240,32,4,0,0.123417,7,pass,5.015958;4.936375;5.042167;4.957958;5.001875;5.138125;5.110666
-hub,1024,3070,1,pull64_interleaved,4.968459,4.947375,4.313000,98240,32,4,0,0.123417,7,pass,4.968459;4.898000;5.044458;4.967958;5.057375;4.917041;4.992250
-hub,1024,3070,1,pull32_interleaved,4.399625,4.376083,3.663500,98240,32,4,0,0.123417,7,pass,4.327167;4.296584;4.399625;4.441292;4.519125;4.303584;4.557000
-hub,1024,3070,1,pull32_gpu_dag,5.252583,4.408625,4.077750,98240,32,6,0,0.123417,7,pass,5.259250;5.203416;5.021750;5.114791;5.252625;5.269875;5.252583
-hub,1024,3070,1,frontier32_vertex,1.449125,1.441083,0.861666,3128,32,4,0,0.123417,7,pass,1.366833;1.404125;1.549000;1.449125;1.427167;1.498209;1.453542
-hub,1024,3070,1,frontier32_simd,0.749834,0.741250,0.233000,3128,32,4,0,0.123417,7,pass,0.785000;0.743375;0.694084;0.702792;0.814916;0.749834;0.754667
-hub,1024,3070,1,frontier32_gpu_dag,1.518500,0.744417,0.639333,3128,32,6,0,0.123417,7,pass,1.538584;1.435000;1.477375;1.446750;1.518500;1.532209;1.567208
-hub,1024,3070,1,bucket32_d4,0.918084,0.909917,0.356500,3100,32,4,0,0.123417,7,pass,0.928541;0.925042;0.903959;0.880958;1.046625;0.918084;0.916542
-hub,1024,3070,1,bucket32_d16,0.839333,0.831125,0.341583,3124,32,4,0,0.123417,7,pass,1.026333;0.839333;0.839208;0.858334;1.002334;0.813667;0.822250
-hub,1024,3070,1,bucket32_d64,0.842500,0.834542,0.330958,3128,32,4,0,0.123417,7,pass,0.830083;0.836583;0.831417;0.847833;0.842500;0.995291;0.855042
-random_masked_int64_reverse,1024,8192,8,old_pull_parallel_dag,0.231750,0.154542,0.031792,524288,8,1,0,0.204542,7,pass,0.230500;0.220375;0.231750;0.216000;0.233416;0.288916;0.235958
-random_masked_int64_reverse,1024,8192,8,old_group_parallel_dag,0.252542,0.194250,0.053750,368640,8,1,0,0.204542,7,pass,0.236792;0.252542;0.229916;0.264084;0.240167;0.263500;0.261584
-random_masked_int64_reverse,1024,8192,8,pull64_barrier,0.257667,0.187209,0.028792,524288,8,1,0,0.204542,7,pass,0.257667;0.235125;0.238709;0.250959;0.308250;0.266958;0.260000
-random_masked_int64_reverse,1024,8192,8,pull64_interleaved,0.252833,0.195875,0.028875,524288,8,1,0,0.204542,7,pass,0.256500;0.252833;0.247791;0.248542;0.242375;0.336584;0.254375
-random_masked_int64_reverse,1024,8192,8,pull32_interleaved,0.230417,0.174959,0.029333,524288,8,1,1,0.204542,7,pass,0.241708;0.224875;0.227167;0.211125;0.296709;0.230417;0.262209
-random_masked_int64_reverse,1024,8192,8,pull32_gpu_dag,0.494833,0.182667,0.048458,524288,8,3,1,0.204542,7,pass,0.513375;0.494833;0.505500;0.482667;0.659791;0.474833;0.453875
-random_masked_int64_reverse,1024,8192,8,frontier32_vertex,0.261750,0.195208,0.029083,524288,8,1,1,0.204542,7,pass,0.251333;0.233000;0.221584;0.267291;0.300833;0.262417;0.261750
-random_masked_int64_reverse,1024,8192,8,frontier32_simd,0.247209,0.186625,0.028708,524288,8,1,1,0.204542,7,pass,0.251209;0.256500;0.234417;0.247209;0.251708;0.230375;0.246875
-random_masked_int64_reverse,1024,8192,8,frontier32_gpu_dag,0.497708,0.182250,0.047708,524288,8,3,1,0.204542,7,pass,0.480208;0.465209;0.500875;0.497708;0.503250;0.570834;0.482959
-random_masked_int64_reverse,1024,8192,8,bucket32_d4,0.252250,0.196583,0.028667,524288,8,1,1,0.204542,7,pass,0.252250;0.268500;0.232417;0.246125;0.252875;0.344208;0.244583
-random_masked_int64_reverse,1024,8192,8,bucket32_d16,0.249667,0.182000,0.028708,524288,8,1,1,0.204542,7,pass,0.216667;0.223792;0.213625;0.249667;0.295166;0.279000;0.251250
-random_masked_int64_reverse,1024,8192,8,bucket32_d64,0.251083,0.193833,0.029000,524288,8,1,1,0.204542,7,pass,0.252208;0.256959;0.260000;0.228000;0.235541;0.231000;0.251083
-random,4096,32768,256,old_pull_parallel_dag,14.830166,11.111167,9.874250,201326592,24,3,0,0.540417,7,pass,15.178958;14.550500;14.761417;14.979459;14.964792;14.391417;14.830166
-random,4096,32768,256,old_group_parallel_dag,11.281792,7.602458,6.686625,136544256,20,1,0,0.540417,7,pass,10.789875;11.281792;11.619375;11.280333;11.393125;11.590542;11.218959
-random,4096,32768,256,pull64_barrier,13.451167,9.799333,8.501000,201326592,24,3,0,0.540417,7,pass,13.391709;13.451167;13.661333;13.776250;13.298041;13.431167;13.605083
-random,4096,32768,256,pull64_interleaved,7.315959,3.659084,2.253750,201326592,24,3,0,0.540417,7,pass,6.690083;6.816459;6.842416;7.535833;7.315959;7.446084;8.355833
-random,4096,32768,256,pull32_interleaved,10.835792,7.102291,5.947375,201326592,24,3,0,0.540417,7,pass,10.835792;11.572667;6.765709;10.839125;10.506583;6.753209;11.634209
-random,4096,32768,256,pull32_gpu_dag,4.001000,3.291333,2.062708,201326592,24,5,0,0.540417,7,pass,3.925292;8.471750;4.001000;8.828083;3.363250;8.899209;3.259542
-random,4096,32768,256,frontier32_vertex,8.457208,4.745875,3.541042,19765352,24,3,0,0.540417,7,pass,13.252792;7.803167;8.457208;13.944833;6.756042;6.576625;13.206291
-random,4096,32768,256,frontier32_simd,13.882000,10.166542,8.939417,20629696,24,3,0,0.540417,7,pass,14.372958;15.367875;15.384750;13.882000;12.035083;11.831084;11.218875
-random,4096,32768,256,frontier32_gpu_dag,8.543291,7.328250,6.778500,20601952,24,5,0,0.540417,7,pass,8.543291;8.521875;8.733916;8.510375;9.335416;8.605625;8.068333
-random,4096,32768,256,bucket32_d4,15.935000,12.268334,10.134292,8454048,72,9,0,0.540417,7,pass,16.177500;15.780541;15.770917;15.839625;16.023709;15.935000;16.271625
-random,4096,32768,256,bucket32_d16,13.396000,9.696458,7.725625,9728112,48,6,0,0.540417,7,pass,12.596125;13.460833;13.158208;13.458334;13.019125;14.111666;13.396000
-random,4096,32768,256,bucket32_d64,12.571916,8.730500,7.507958,18505456,24,3,0,0.540417,7,pass,11.895375;13.142667;12.700083;12.617083;12.179083;12.571916;12.433042
-random,16384,131072,1,old_pull_parallel_dag,0.994042,0.627000,0.204333,3145728,24,3,0,1.768209,7,pass,0.993208;0.994042;1.341958;0.917791;0.912375;1.503042;1.060459
-random,16384,131072,1,old_group_parallel_dag,5.366000,5.017958,4.840375,2359296,18,1,0,1.768209,7,pass,5.798209;5.530958;5.321334;5.366000;5.353375;5.372917;5.332083
-random,16384,131072,1,pull64_barrier,0.816750,0.565125,0.164167,3145728,24,3,0,1.768209,7,pass,0.865958;0.962083;0.844750;0.816750;0.811042;0.800375;0.796875
-random,16384,131072,1,pull64_interleaved,0.813625,0.564333,0.166833,3145728,24,3,0,1.768209,7,pass,0.863166;0.939584;0.787834;0.795208;0.902917;0.805500;0.813625
-random,16384,131072,1,pull32_interleaved,0.756500,0.546042,0.141500,3145728,24,3,0,1.768209,7,pass,0.923166;0.722875;0.703750;0.756500;0.740125;0.906291;0.899500
-random,16384,131072,1,pull32_gpu_dag,0.942292,0.540000,0.164958,3145728,24,5,0,1.768209,7,pass,0.942292;0.910583;0.936042;0.956041;0.878083;0.976916;0.998791
-random,16384,131072,1,frontier32_vertex,0.931209,0.689375,0.274000,377624,24,3,0,1.768209,7,pass,0.892750;0.957458;0.894000;0.931209;0.942583;1.014958;0.892084
-random,16384,131072,1,frontier32_simd,0.906500,0.677625,0.260042,331880,24,3,0,1.768209,7,pass,0.890291;0.667916;0.906500;0.909291;0.989250;0.915625;0.724500
-random,16384,131072,1,frontier32_gpu_dag,0.965417,0.651792,0.270625,331616,24,5,0,1.768209,7,pass,0.969083;1.029875;0.945167;0.851666;0.873917;1.018416;0.965417
-random,16384,131072,1,bucket32_d4,1.929542,1.695917,0.702167,132008,56,7,0,1.768209,7,pass,1.996375;1.955291;1.796708;1.929542;1.764500;1.932792;1.741583
-random,16384,131072,1,bucket32_d16,1.202042,0.958541,0.418458,148224,32,4,0,1.768209,7,pass,1.134042;1.177041;1.210208;1.158875;1.202042;1.323416;1.255292
-random,16384,131072,1,bucket32_d64,0.969875,0.745333,0.347375,269208,24,3,0,1.768209,7,pass,0.949333;0.936333;0.969875;0.966208;0.995208;1.023459;1.016541
-random,16384,131072,64,old_pull_parallel_dag,16.722292,12.546667,11.352584,201326592,24,3,0,1.742166,7,pass,16.589625;16.782167;17.024875;16.351458;16.722292;16.532333;16.879709
-random,16384,131072,64,old_group_parallel_dag,13.326000,9.159083,8.322458,158203904,22,1,0,1.742166,7,pass,12.850500;13.103292;13.505583;13.326000;13.384959;13.249125;13.521625
-random,16384,131072,64,pull64_barrier,15.921334,11.512833,10.367083,201326592,24,3,0,1.742166,7,pass,16.106709;16.345667;15.252750;15.479000;15.981125;15.515625;15.921334
-random,16384,131072,64,pull64_interleaved,7.341541,2.985875,1.883792,201326592,24,3,0,1.742166,7,pass,7.593083;7.245708;7.427542;7.141041;7.341541;7.639042;7.271500
-random,16384,131072,64,pull32_interleaved,8.727125,4.219375,3.045833,201326592,24,3,0,1.742166,7,pass,7.861333;8.053417;8.727125;10.393375;11.416917;7.248166;11.526125
-random,16384,131072,64,pull32_gpu_dag,3.850875,3.175750,2.039125,201326592,24,5,0,1.742166,7,pass,8.952083;3.619292;3.631417;8.345083;3.803042;8.516625;3.850875
-random,16384,131072,64,frontier32_vertex,10.189167,5.571958,4.471875,21279416,24,3,0,1.742166,7,pass,10.520375;10.189167;9.001250;10.956875;8.920750;12.021917;8.927750
-random,16384,131072,64,frontier32_simd,12.411875,8.079709,7.035667,22001240,24,3,0,1.742166,7,pass,17.322791;12.816041;12.164000;12.411875;11.992167;13.813792;12.047625
-random,16384,131072,64,frontier32_gpu_dag,10.058792,8.398667,8.525333,21937792,24,5,0,1.742166,7,pass,11.663125;11.269959;11.136625;10.058792;9.125875;9.377250;9.200916
-random,16384,131072,64,bucket32_d4,16.470666,11.920958,9.881666,8451432,72,9,0,1.742166,7,pass,16.470666;16.941042;17.234083;16.376958;16.415000;16.823750;15.927083
-random,16384,131072,64,bucket32_d16,14.035834,9.407333,7.796500,9570560,48,6,0,1.742166,7,pass,14.439958;13.796667;14.274833;13.844209;14.089416;14.035834;13.437416
-random,16384,131072,64,bucket32_d64,15.618875,11.154958,10.232875,17319760,24,3,0,1.742166,7,pass,15.651209;15.288208;15.618875;16.924458;15.772500;15.598375;14.522792
-random,65536,524288,1,old_pull_parallel_dag,3.453041,1.911833,1.022000,12582912,24,3,0,7.594209,7,pass,3.374625;3.569542;3.453041;3.795125;3.498709;3.402541;2.875167
-random,65536,524288,1,old_group_parallel_dag,30.640458,28.988333,28.348000,11534336,22,1,0,7.594209,7,pass,30.396166;30.640458;30.423084;30.773792;30.675375;30.724167;30.427041
-random,65536,524288,1,pull64_barrier,3.064792,1.521959,0.700667,12582912,24,3,0,7.594209,7,pass,3.100041;3.064792;3.087541;3.007292;3.161708;2.970083;3.019500
-random,65536,524288,1,pull64_interleaved,3.002250,1.493667,0.701750,12582912,24,3,0,7.594209,7,pass,2.876709;3.019125;3.179917;3.076334;3.002250;2.974625;2.964250
-random,65536,524288,1,pull32_interleaved,2.775333,1.290542,0.500375,12582912,24,3,0,7.594209,7,pass,2.775333;2.718458;2.930792;2.810750;2.709500;2.773875;2.835042
-random,65536,524288,1,pull32_gpu_dag,1.243833,0.853000,0.567083,12582912,24,5,0,7.594209,7,pass,1.223708;1.245875;1.243833;1.338334;1.271584;1.204125;1.242625
-random,65536,524288,1,frontier32_vertex,2.706458,1.262083,0.431792,1731984,24,3,0,7.594209,7,pass,2.705084;2.798542;2.750750;2.287750;2.706458;2.682250;2.832583
-random,65536,524288,1,frontier32_simd,2.935042,1.411333,0.600541,1575616,24,3,0,7.594209,7,pass,2.868750;3.034250;2.883500;2.935042;2.851584;3.144042;3.044166
-random,65536,524288,1,frontier32_gpu_dag,1.353667,0.972709,0.677750,1567736,24,5,0,7.594209,7,pass,1.358833;1.353667;1.310958;1.462708;1.339167;1.294625;1.385500
-random,65536,524288,1,bucket32_d4,4.132292,2.583208,1.160792,528256,64,8,0,7.594209,7,pass,3.686083;4.242917;4.103209;4.106250;4.263250;4.141291;4.132292
-random,65536,524288,1,bucket32_d16,3.380042,1.838417,0.783500,599248,40,5,0,7.594209,7,pass,3.391417;2.991958;3.371750;3.412458;3.380042;3.350000;3.477709
-random,65536,524288,1,bucket32_d64,2.992250,1.473917,0.653375,1050648,24,3,0,7.594209,7,pass,3.033250;2.985792;2.895916;2.992250;3.102916;2.573667;3.099000
-clos,800,320000,1,old_pull_parallel_dag,2.085458,1.267584,0.711750,2560000,8,1,0,3.542958,7,pass,2.085458;2.114708;2.080291;2.062458;2.124833;2.068584;2.087458
-clos,800,320000,1,old_group_parallel_dag,2.281625,1.479250,0.902375,960000,3,1,0,3.542958,7,pass,1.877667;2.281625;2.305042;2.260417;2.320084;1.892458;2.320458
-clos,800,320000,1,pull64_barrier,2.020750,1.233084,0.651125,2560000,8,1,0,3.542958,7,pass,2.054792;2.014333;2.018458;2.080459;2.020750;2.032083;2.017792
-clos,800,320000,1,pull64_interleaved,2.234583,1.436416,0.885583,2560000,8,1,0,3.542958,7,pass,2.068292;2.148167;2.116125;2.469583;2.302792;2.264542;2.234583
-clos,800,320000,1,pull32_interleaved,2.611333,1.797583,1.339500,2560000,8,1,0,3.542958,7,pass,2.385750;2.671625;2.384958;2.611333;2.573208;3.723625;3.674125
-clos,800,320000,1,pull32_gpu_dag,5.207000,2.914291,4.404583,2560000,8,3,0,3.542958,7,pass,5.244041;5.231584;5.207000;5.068292;5.140417;5.302750;5.152917
-clos,800,320000,1,frontier32_vertex,5.258709,4.426625,3.977667,320000,8,1,0,3.542958,7,pass,5.258709;5.398167;5.131167;5.318000;5.253625;5.215083;5.520042
-clos,800,320000,1,frontier32_simd,1.697541,0.807708,0.318125,320000,8,1,0,3.542958,7,pass,1.290916;2.233917;1.697541;1.702208;1.604792;1.668750;2.286250
-clos,800,320000,1,frontier32_gpu_dag,3.076875,0.757875,2.224667,320000,8,3,0,3.542958,7,pass,3.078333;3.015333;3.076875;3.188792;3.013250;3.084209;3.005084
-clos,800,320000,1,bucket32_d4,1.701625,0.885750,0.410333,320000,8,1,0,3.542958,7,pass,1.666500;1.672584;1.763833;1.701625;1.749083;1.658750;1.714833
-clos,800,320000,1,bucket32_d16,1.668083,0.829166,0.417000,320000,8,1,0,3.542958,7,pass,1.432416;1.856250;1.767917;1.306834;1.348000;1.726250;1.668083
-clos,800,320000,1,bucket32_d64,1.683584,0.853250,0.411375,320000,8,1,0,3.542958,7,pass,1.704958;1.451916;1.686084;1.713750;1.683584;1.665166;1.667083
-clos,800,320000,64,old_pull_parallel_dag,27.135625,19.105583,18.632250,163840000,8,1,0,3.559834,7,pass,26.917833;27.135625;27.827833;32.153333;18.959167;27.720583;24.055417
-clos,800,320000,64,old_group_parallel_dag,12.835333,6.027625,5.311750,61440000,3,1,0,3.559834,7,pass,12.958500;12.734958;13.122792;12.778250;13.686958;12.603333;12.835333
-clos,800,320000,64,pull64_barrier,25.325959,18.258292,17.562750,163840000,8,1,0,3.559834,7,pass,24.298917;26.631375;24.368792;26.615584;24.855375;25.325959;25.410042
-clos,800,320000,64,pull64_interleaved,13.125084,6.035417,5.379583,163840000,8,1,0,3.559834,7,pass,13.326458;12.319792;13.903000;13.181250;13.125084;12.508125;12.685500
-clos,800,320000,64,pull32_interleaved,11.445000,4.363917,3.663417,163840000,8,1,0,3.559834,7,pass,12.150625;11.445000;11.930667;11.957709;10.537375;10.746750;11.351500
-clos,800,320000,64,pull32_gpu_dag,8.371875,4.354166,6.133375,163840000,8,3,0,3.559834,7,pass,7.950875;8.814666;8.371875;7.833334;8.577500;8.882584;6.996125
-clos,800,320000,64,frontier32_vertex,13.988541,7.017125,6.391750,20480000,8,1,0,3.559834,7,pass,14.034166;13.531417;13.871125;13.743541;14.692125;14.240292;13.988541
-clos,800,320000,64,frontier32_simd,9.446000,2.085000,1.444208,20480000,8,1,0,3.559834,7,pass,9.797833;9.376500;9.053084;9.446000;9.639584;9.742792;8.711625
-clos,800,320000,64,frontier32_gpu_dag,14.162083,2.178709,11.456334,20480000,8,3,0,3.559834,7,pass,13.846833;14.475709;13.987625;15.439458;13.093208;14.545959;14.162083
-clos,800,320000,64,bucket32_d4,9.695708,2.496041,1.822042,20480000,8,1,0,3.559834,7,pass,9.883500;9.820625;9.538500;9.682750;9.301291;9.897500;9.695708
-clos,800,320000,64,bucket32_d16,9.406167,2.549333,1.826625,20480000,8,1,0,3.559834,7,pass,8.794417;11.469291;9.967792;9.406167;9.324375;9.109042;9.914709
-clos,800,320000,64,bucket32_d64,9.566083,2.444625,1.837625,20480000,8,1,0,3.559834,7,pass,9.548208;10.232833;8.945042;8.924416;9.566083;16.288833;9.696625
-grid,10000,39600,1,old_pull_parallel_dag,4.192542,4.113917,0.597499,7920000,200,25,0,0.515708,7,pass,4.572333;4.194375;4.089208;4.373667;4.192542;4.166459;3.976875
-grid,10000,39600,1,old_group_parallel_dag,7.762375,7.668834,7.506125,7880400,199,1,0,0.515708,7,pass,7.792125;7.704583;7.700541;7.760000;7.817458;7.783375;7.762375
-grid,10000,39600,1,pull64_barrier,4.020833,3.951958,0.658292,7920000,200,25,0,0.515708,7,pass,3.833709;3.945542;3.954459;4.034000;4.020833;4.291834;4.056792
-grid,10000,39600,1,pull64_interleaved,4.062583,3.994833,0.661000,7920000,200,25,0,0.515708,7,pass,4.196833;3.920792;4.062583;3.845292;4.041584;4.162667;4.256709
-grid,10000,39600,1,pull32_interleaved,3.864167,3.799084,0.587875,7920000,200,25,0,0.515708,7,pass,4.174709;4.013875;3.711500;3.864167;3.757584;3.710666;4.065667
-grid,10000,39600,1,pull32_gpu_dag,3.250500,2.965875,0.577125,7920000,200,27,0,0.515708,7,pass,3.552583;3.289542;3.200750;2.978667;3.290000;3.250500;3.223000
-grid,10000,39600,1,frontier32_vertex,4.489625,4.426958,1.793416,39600,200,25,0,0.515708,7,pass,4.489625;4.444250;4.573167;4.792917;4.258459;4.404625;4.750875
-grid,10000,39600,1,frontier32_simd,4.186542,4.123625,1.378167,39600,200,25,0,0.515708,7,pass,4.386417;4.186542;4.302708;4.184458;4.260750;4.070584;4.179833
-grid,10000,39600,1,frontier32_gpu_dag,4.407875,4.018750,1.346292,39600,200,27,0,0.515708,7,pass,4.517459;4.274333;4.451167;4.378334;4.360333;4.407875;4.505625
-grid,10000,39600,1,bucket32_d4,5.179458,5.116791,2.345999,39600,200,25,0,0.515708,7,pass,5.431125;5.479208;5.013167;5.425500;5.179458;5.173708;5.173291
-grid,10000,39600,1,bucket32_d16,5.276833,5.214041,2.415250,39600,200,25,0,0.515708,7,pass,4.927291;5.050083;5.276833;5.366584;5.363833;5.166292;5.303750
-grid,10000,39600,1,bucket32_d64,5.224250,5.149959,2.362208,39600,200,25,0,0.515708,7,pass,4.964708;5.052042;5.710000;5.224250;5.281208;5.245250;4.885583
-grid,10000,39600,8,old_pull_parallel_dag,4.414333,4.189125,1.349916,63360000,200,25,0,0.520832,7,pass,4.465500;4.414333;4.455250;3.975583;4.589792;3.990375;4.386291
-grid,10000,39600,8,old_group_parallel_dag,8.339916,8.078167,7.476500,51480000,199,1,0,0.520832,7,pass,8.339916;8.429834;8.038333;8.367083;8.349417;7.842958;8.191167
-grid,10000,39600,8,pull64_barrier,5.276917,5.101834,1.466624,63360000,200,25,0,0.520832,7,pass,4.816458;5.794209;4.863750;5.935333;5.276917;5.306875;5.029750
-grid,10000,39600,8,pull64_interleaved,5.016375,4.816125,1.365750,63360000,200,25,0,0.520832,7,pass,5.232500;5.447875;5.016375;4.970041;4.848667;5.042666;4.967708
-grid,10000,39600,8,pull32_interleaved,4.915792,4.690125,1.285791,63360000,200,25,0,0.520832,7,pass,4.809417;5.023625;5.557250;4.915792;5.009958;4.751584;4.751125
-grid,10000,39600,8,pull32_gpu_dag,4.954083,4.625375,1.314542,63360000,200,27,0,0.520832,7,pass,4.815084;5.124208;5.269375;4.898458;4.947625;4.954083;5.022583
-grid,10000,39600,8,frontier32_vertex,5.589084,5.445542,1.953459,316800,200,25,0,0.520832,7,pass,5.582708;5.589084;5.674750;5.473625;5.573792;6.400167;5.717125
-grid,10000,39600,8,frontier32_simd,4.779667,4.539916,1.380791,316800,200,25,0,0.520832,7,pass,4.779667;4.719625;5.179417;4.631792;4.733250;5.285917;5.059000
-grid,10000,39600,8,frontier32_gpu_dag,5.082166,4.654750,1.477750,316800,200,27,0,0.520832,7,pass,5.017125;5.101084;5.184792;4.835041;5.082166;5.098625;4.936417
-grid,10000,39600,8,bucket32_d4,7.027917,6.850791,3.498083,316800,200,25,0,0.520832,7,pass,7.218000;7.175916;7.011250;6.907042;7.027917;7.004458;7.400208
-grid,10000,39600,8,bucket32_d16,7.438125,7.228875,3.634041,316800,200,25,0,0.520832,7,pass,7.169458;7.230125;7.647625;7.648666;7.636167;7.171459;7.438125
-grid,10000,39600,8,bucket32_d64,7.147333,6.930583,3.488042,316800,200,25,0,0.520832,7,pass,7.213916;7.047042;7.147458;7.072792;7.147333;7.110667;7.237083
-chain,2048,2047,1,old_pull_parallel_dag,30.552917,30.545834,4.321582,4192256,2048,256,0,0.125625,7,pass,30.441708;30.552917;31.920250;29.640667;30.868458;31.028000;29.277250
-chain,2048,2047,1,old_group_parallel_dag,4.833083,4.826542,4.695250,4192256,2048,1,0,0.125625,7,pass,4.804500;4.824500;4.816250;4.851208;4.856917;4.858541;4.833083
-chain,2048,2047,1,pull64_barrier,30.510625,30.503291,4.811082,4192256,2048,256,0,0.125625,7,pass,30.510625;30.138791;31.022291;31.066500;26.890709;30.860167;28.175541
-chain,2048,2047,1,pull64_interleaved,31.047791,31.040250,4.944002,4192256,2048,256,0,0.125625,7,pass,28.758083;30.971667;31.047791;31.266083;31.732750;31.417208;30.582792
-chain,2048,2047,1,pull32_interleaved,30.664125,30.657666,4.841290,4192256,2048,256,0,0.125625,7,pass,30.888709;30.521792;30.642750;30.218834;30.664125;31.991916;30.833417
-chain,2048,2047,1,pull32_gpu_dag,31.190750,30.903459,4.845919,4192256,2048,258,0,0.125625,7,pass,30.740917;32.332792;30.644417;31.678750;31.051166;31.380667;31.190750
-chain,2048,2047,1,frontier32_vertex,39.637750,39.628292,12.972585,2047,2048,256,0,0.125625,7,pass,38.372083;40.031083;39.313000;39.637750;40.304916;40.453458;39.255125
-chain,2048,2047,1,frontier32_simd,39.789917,39.782625,12.911460,2047,2048,256,0,0.125625,7,pass,39.902750;39.872792;39.987917;39.789917;39.650792;36.553375;36.089750
-chain,2048,2047,1,frontier32_gpu_dag,70.724250,70.461750,44.595246,2047,2048,258,0,0.125625,7,pass,43.906625;58.636625;70.313917;71.726083;70.724250;76.852417;73.861208
-chain,2048,2047,1,bucket32_d4,58.239375,58.233417,21.375416,2047,2056,257,0,0.125625,7,pass,62.646291;58.284083;58.239375;53.150791;53.433666;55.449542;58.410250
-chain,2048,2047,1,bucket32_d16,57.210791,57.204375,20.963166,2047,2056,257,0,0.125625,7,pass,59.173458;58.572625;55.714083;58.005042;56.776000;56.803584;57.210791
-chain,2048,2047,1,bucket32_d64,57.298833,57.291750,20.994749,2047,2056,257,0,0.125625,7,pass,58.199167;57.298833;57.227292;56.298000;57.819334;57.979250;57.193708
-hub,4096,12286,64,old_pull_parallel_dag,32.738459,32.377000,30.834542,31452160,40,5,0,0.298792,7,pass,32.488459;32.939417;32.738459;32.991250;32.959542;32.400500;32.294959
-hub,4096,12286,64,old_group_parallel_dag,26.029167,25.650958,24.950500,27176632,38,1,0,0.298792,7,pass,26.056500;25.595459;25.674875;26.214084;26.029167;25.727042;26.054042
-hub,4096,12286,64,pull64_barrier,25.705500,25.271334,23.640292,31452160,40,5,0,0.298792,7,pass,25.705500;25.445917;25.780125;25.710875;25.734959;25.565792;25.261959
-hub,4096,12286,64,pull64_interleaved,33.502333,33.108584,31.536709,31452160,40,5,0,0.298792,7,pass,33.577666;33.502333;33.523417;32.882208;33.813209;32.886458;32.949750
-hub,4096,12286,64,pull32_interleaved,28.909250,28.554916,26.900000,31452160,40,5,0,0.298792,7,pass,29.039750;29.081500;28.383209;28.651958;29.064083;28.784208;28.909250
-hub,4096,12286,64,pull32_gpu_dag,31.414959,28.520625,29.230000,31452160,40,7,0,0.298792,7,pass,31.416583;31.781542;31.181542;30.931833;30.765958;31.968583;31.414959
-hub,4096,12286,64,frontier32_vertex,20.297708,19.929541,18.721708,1860120,40,5,0,0.298792,7,pass,20.734375;20.408333;20.049834;20.663792;20.297708;20.041916;20.265708
-hub,4096,12286,64,frontier32_simd,3.727542,3.299791,1.927041,1683322,40,5,0,0.298792,7,pass,3.644167;3.743041;3.727542;3.766667;3.927708;3.695166;3.035375
-hub,4096,12286,64,frontier32_gpu_dag,4.851209,2.763917,3.502458,1683264,40,7,0,0.298792,7,pass,5.212083;5.300875;4.645584;5.398958;4.851209;4.829000;4.836417
-hub,4096,12286,64,bucket32_d4,5.104875,4.739583,3.097417,788342,48,6,0,0.298792,7,pass,5.103375;5.319250;4.142667;4.426417;5.111667;5.148000;5.104875
-hub,4096,12286,64,bucket32_d16,4.303667,3.919791,2.909334,1124798,48,6,0,0.298792,7,pass,4.303667;4.285250;4.624542;4.287916;5.023958;4.240125;4.605209
-hub,4096,12286,64,bucket32_d64,5.089709,4.662958,3.317292,1925862,40,5,0,0.298792,7,pass,5.089709;5.218125;4.996917;4.812292;5.010000;5.321542;5.098500
-random,4096,131072,1,old_pull_parallel_dag,0.658209,0.484209,0.253500,2097152,16,2,0,1.704166,7,pass,0.723083;0.796000;0.658209;0.628833;0.644125;0.789625;0.628666
-random,4096,131072,1,old_group_parallel_dag,2.587292,2.399042,2.250625,1572864,12,1,0,1.704166,7,pass,2.567417;2.631125;2.647459;2.869250;2.513167;2.540333;2.587292
-random,4096,131072,1,pull64_barrier,0.643792,0.480417,0.225417,2097152,16,2,0,1.704166,7,pass,0.735542;0.628042;0.658500;0.665917;0.606791;0.634125;0.643792
-random,4096,131072,1,pull64_interleaved,0.650875,0.473000,0.234000,2097152,16,2,0,1.704166,7,pass,0.683042;0.650875;0.649917;0.626042;0.676500;0.636708;0.745083
-random,4096,131072,1,pull32_interleaved,0.611750,0.425333,0.179125,2097152,16,2,0,1.704166,7,pass,0.597042;0.595916;0.700375;0.611750;0.666083;0.629375;0.580167
-random,4096,131072,1,pull32_gpu_dag,0.814708,0.427917,0.224333,2097152,16,4,0,1.704166,7,pass,0.887750;0.819917;0.814708;0.757125;0.782916;0.782916;0.876000
-random,4096,131072,1,frontier32_vertex,0.777709,0.585167,0.335250,421760,16,2,0,1.704166,7,pass,0.777709;0.797958;0.748917;0.738459;0.794458;0.812375;0.721792
-random,4096,131072,1,frontier32_simd,0.561292,0.368875,0.129875,380192,16,2,0,1.704166,7,pass,0.808000;0.621666;0.561292;0.586125;0.541750;0.528000;0.542708
-random,4096,131072,1,frontier32_gpu_dag,0.777250,0.385500,0.168708,383328,16,4,0,1.704166,7,pass,0.674667;0.689959;0.777250;0.722875;0.854583;0.851667;0.782792
-random,4096,131072,1,bucket32_d4,0.824625,0.642167,0.249917,138720,24,3,0,1.704166,7,pass,0.809458;0.865917;0.824625;0.797333;0.853083;0.871667;0.757959
-random,4096,131072,1,bucket32_d16,0.661125,0.483250,0.199875,177408,16,2,0,1.704166,7,pass,0.662167;0.594250;0.638917;0.688375;0.698750;0.661125;0.649625
-random,4096,131072,1,bucket32_d64,0.615709,0.447834,0.194416,379648,16,2,0,1.704166,7,pass,0.572500;0.579000;0.727541;0.596792;0.615709;0.641250;0.683708
-random,4096,131072,64,old_pull_parallel_dag,9.242792,7.142292,6.265125,134217728,16,2,0,1.900000,7,pass,9.382709;9.053834;9.288833;9.441250;9.242792;8.910334;8.492458
-random,4096,131072,64,old_group_parallel_dag,6.136250,4.016875,3.290875,105644032,15,1,0,1.900000,7,pass,6.136250;6.189875;6.174375;6.008625;6.319916;5.805792;6.047625
-random,4096,131072,64,pull64_barrier,9.428125,7.314208,6.387583,134217728,16,2,0,1.900000,7,pass,10.098667;9.488167;9.428125;9.195458;10.087334;9.325500;9.205917
-random,4096,131072,64,pull64_interleaved,4.731458,2.589250,1.742166,134217728,16,2,0,1.900000,7,pass,4.093542;4.623375;4.798500;4.829542;4.576750;4.731458;4.879333
-random,4096,131072,64,pull32_interleaved,4.225208,2.210041,1.545917,134217728,16,2,0,1.900000,7,pass,4.413500;4.056459;4.225208;5.849208;6.273542;3.443458;3.763917
-random,4096,131072,64,pull32_gpu_dag,2.215000,1.628334,0.809417,134217728,16,4,0,1.900000,7,pass,4.834667;2.066875;2.150542;2.482250;2.217375;2.215000;1.987125
-random,4096,131072,64,frontier32_vertex,5.298958,3.305375,2.517000,22687072,16,2,0,1.900000,7,pass,6.278583;5.896708;5.273833;5.298958;5.188625;5.321541;4.794333
-random,4096,131072,64,frontier32_simd,4.818459,2.921834,1.971000,22886848,16,2,0,1.900000,7,pass,4.792250;4.818459;4.646292;5.055042;5.800500;5.912625;4.697458
-random,4096,131072,64,frontier32_gpu_dag,4.070083,2.819250,2.716417,22966880,16,4,0,1.900000,7,pass,4.098292;3.579583;4.282125;4.248541;3.964916;4.070083;3.906708
-random,4096,131072,64,bucket32_d4,5.638750,3.371833,2.416875,8804704,24,3,0,1.900000,7,pass,5.033750;4.330250;5.638750;5.774958;4.382750;6.163708;5.996584
-random,4096,131072,64,bucket32_d16,6.013709,2.810958,1.843083,12114144,24,3,0,1.900000,7,pass,5.143208;6.767583;5.024625;7.537250;8.913666;5.057708;6.013709
-random,4096,131072,64,bucket32_d64,5.196750,3.178125,2.351542,23254592,16,2,0,1.900000,7,pass,4.848708;5.196750;12.365125;5.578958;5.030667;4.926417;5.383084
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/environment.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/environment.txt
deleted file mode 100644
index 0a72477..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/environment.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-2026-09-26T23:34:36Z
-fbab119e794c843838f4f3f96d75cb7f32f06845
-44962b5bd1dba6ecfc8d1449e324875e35ebe373e3f33aef779be12d9cb3fd65  dev/research/metal_pathfinding/optimization/cpu_algorithms.mm
-5336a17369edf018c33267e7765d20bffe8beaed3b8fb9f4e23053942cd3b73c  build/metal_pathfinding/cpu-algorithms
-7bb649ffcd34e6be02ab14c35767b816b0b32ce3ee3c2fd91c199e4b37a837ce  build/metal_pathfinding/optimized
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a1.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a1.txt
deleted file mode 100644
index bb14b8c..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a1.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10962583552,"Tiler Utilization %"=10,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=16,"TiledSceneBytes"=1507328,"Device Utilization %"=25,"SplitSceneCount"=0,"Allocated PB Size"=188219392,"In use system memory"=1329561600}
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a2.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a2.txt
deleted file mode 100644
index 75d8bdd..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-a2.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11424284672,"Tiler Utilization %"=2,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=4,"TiledSceneBytes"=1507328,"Device Utilization %"=63,"SplitSceneCount"=0,"Allocated PB Size"=191889408,"In use system memory"=1508343808}
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-b.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-b.txt
deleted file mode 100644
index 137719b..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/gpu-load-b.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11044798464,"Tiler Utilization %"=0,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=0,"TiledSceneBytes"=1507328,"Device Utilization %"=0,"SplitSceneCount"=0,"Allocated PB Size"=191496192,"In use system memory"=1353957376}
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a1.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a1.txt
deleted file mode 100644
index 087f07d..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1028 total, 2 running, 1026 sleeping, 5245 threads 
-2026/09/27 00:34:36
-Load Avg: 3.83, 3.81, 4.16 
-CPU usage: 5.4% user, 9.75% sys, 85.20% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 626142 total, 10G resident, 746M private, 4380M shared.
-PhysMem: 34G used (3950M wired, 625M compressor), 1287M unused.
-VM: 453T vsize, 6144M framework vsize, 2846254(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191220681/161G in, 146692457/164G out.
-Disks: 97851346/2478G read, 117478369/2101G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1028 total, 2 running, 1026 sleeping, 5225 threads 
-2026/09/27 00:34:37
-Load Avg: 3.83, 3.81, 4.16 
-CPU usage: 6.82% user, 4.74% sys, 88.43% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 0 total, 0B resident, 746M private, 4380M shared.
-PhysMem: 34G used (3956M wired, 625M compressor), 1290M unused.
-VM: 453T vsize, 6144M framework vsize, 2846254(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191220845/161G in, 146692617/164G out.
-Disks: 97851346/2478G read, 117478371/2101G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     28.7 28    
-70968  Superset Helper  21.6 32    
-0      kernel_task      12.1 850/14
-35069  top              9.0  1/1   
-21666  2.1.283          7.7  28    
-70942  Superset Helper  7.2  19    
-81804  2.1.283          5.2  21    
-621    airportd         3.7  9     
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a2.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a2.txt
deleted file mode 100644
index 07d79ae..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-a2.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1021 total, 3 running, 1018 sleeping, 5225 threads 
-2026/09/27 00:35:39
-Load Avg: 3.30, 3.68, 4.08 
-CPU usage: 23.58% user, 16.59% sys, 59.82% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 638937 total, 10G resident, 739M private, 4394M shared.
-PhysMem: 34G used (4923M wired, 625M compressor), 767M unused.
-VM: 451T vsize, 6144M framework vsize, 2846260(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191239397/161G in, 146716076/164G out.
-Disks: 97852171/2478G read, 117481152/2101G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1020 total, 7 running, 1013 sleeping, 5228 threads 
-2026/09/27 00:35:40
-Load Avg: 3.30, 3.68, 4.08 
-CPU usage: 14.96% user, 7.41% sys, 77.61% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 0 total, 0B resident, 739M private, 4394M shared.
-PhysMem: 34G used (4111M wired, 625M compressor), 910M unused.
-VM: 451T vsize, 6144M framework vsize, 2846260(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191239878/161G in, 146716829/164G out.
-Disks: 97852524/2478G read, 117481160/2101G written.
-
-PID    COMMAND          %CPU #TH   
-41532  Google Chrome He 54.7 26/1  
-590    WindowServer     26.7 28/1  
-95916  Google Chrome    17.7 46    
-0      kernel_task      17.2 850/14
-70968  Superset Helper  15.2 32    
-21666  2.1.283          9.4  27    
-41571  top              7.9  1/1   
-28991  Muse             6.2  29    
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-b.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-b.txt
deleted file mode 100644
index 5461de5..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/load-b.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1032 total, 5 running, 1027 sleeping, 5271 threads 
-2026/09/27 00:34:45
-Load Avg: 3.77, 3.80, 4.15 
-CPU usage: 19.63% user, 13.49% sys, 66.87% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 639550 total, 10G resident, 748M private, 4376M shared.
-PhysMem: 34G used (3953M wired, 625M compressor), 943M unused.
-VM: 456T vsize, 6144M framework vsize, 2846254(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191222619/161G in, 146695003/164G out.
-Disks: 97851375/2478G read, 117478676/2101G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1029 total, 4 running, 1025 sleeping, 5262 threads 
-2026/09/27 00:34:46
-Load Avg: 3.77, 3.80, 4.15 
-CPU usage: 17.4% user, 6.64% sys, 76.30% idle 
-SharedLibs: 924M resident, 170M data, 136M linkedit.
-MemRegions: 0 total, 0B resident, 748M private, 4376M shared.
-PhysMem: 34G used (3977M wired, 625M compressor), 1023M unused.
-VM: 455T vsize, 6144M framework vsize, 2846254(0) swapins, 4729331(0) swapouts.
-Networks: packets: 191223281/161G in, 146696242/164G out.
-Disks: 97851377/2478G read, 117478696/2101G written.
-
-PID    COMMAND          %CPU #TH   
-35242  Google Chrome He 59.1 25/1  
-590    WindowServer     29.1 27    
-95916  Google Chrome    18.9 46    
-70968  Superset Helper  15.9 32    
-0      kernel_task      15.0 850/15
-81804  2.1.283          7.7  27    
-35565  top              7.6  1/1   
-21666  2.1.283          7.3  27    
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.json b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.json
deleted file mode 100644
index 9ab7903..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.json
+++ /dev/null
@@ -1,248 +0,0 @@
-{
-  "phase_rows": {
-    "a1": 14,
-    "b": 216,
-    "a2": 14
-  },
-  "checked_query_results": 88056,
-  "summary": [
-    {
-      "case": [
-        "random",
-        "1024",
-        "8192",
-        "1"
-      ],
-      "heap_a1_a2": [
-        0.052958,
-        0.059333
-      ],
-      "dial_a1_a2": [
-        0.027667,
-        0.03
-      ],
-      "best_gpu": {
-        "case": "random",
-        "n": "1024",
-        "e": "8192",
-        "queries": "1",
-        "method": "pull32_interleaved",
-        "wall_ms": "0.633625",
-        "distance_ms": "0.621125",
-        "gpu_ms": "0.349458",
-        "edge_visits": "131072",
-        "rounds": "16",
-        "waits": "2",
-        "fallback64": "0",
-        "upload_ms": "0.152417",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "0.630000;0.633625;0.646917;0.592625;0.621542;0.675042;0.679750"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "4096",
-        "32768",
-        "256"
-      ],
-      "heap_a1_a2": [
-        13.0295,
-        13.024459
-      ],
-      "dial_a1_a2": [
-        7.056208,
-        6.924667
-      ],
-      "best_gpu": {
-        "case": "random",
-        "n": "4096",
-        "e": "32768",
-        "queries": "256",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "4.001000",
-        "distance_ms": "3.291333",
-        "gpu_ms": "2.062708",
-        "edge_visits": "201326592",
-        "rounds": "24",
-        "waits": "5",
-        "fallback64": "0",
-        "upload_ms": "0.540417",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "3.925292;8.471750;4.001000;8.828083;3.363250;8.899209;3.259542"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "16384",
-        "131072",
-        "64"
-      ],
-      "heap_a1_a2": [
-        17.500459,
-        17.26825
-      ],
-      "dial_a1_a2": [
-        7.696333,
-        7.677208
-      ],
-      "best_gpu": {
-        "case": "random",
-        "n": "16384",
-        "e": "131072",
-        "queries": "64",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "3.850875",
-        "distance_ms": "3.175750",
-        "gpu_ms": "2.039125",
-        "edge_visits": "201326592",
-        "rounds": "24",
-        "waits": "5",
-        "fallback64": "0",
-        "upload_ms": "1.742166",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "8.952083;3.619292;3.631417;8.345083;3.803042;8.516625;3.850875"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "65536",
-        "524288",
-        "1"
-      ],
-      "heap_a1_a2": [
-        11.474125,
-        11.530166
-      ],
-      "dial_a1_a2": [
-        4.384459,
-        4.372167
-      ],
-      "best_gpu": {
-        "case": "random",
-        "n": "65536",
-        "e": "524288",
-        "queries": "1",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "1.243833",
-        "distance_ms": "0.853000",
-        "gpu_ms": "0.567083",
-        "edge_visits": "12582912",
-        "rounds": "24",
-        "waits": "5",
-        "fallback64": "0",
-        "upload_ms": "7.594209",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "1.223708;1.245875;1.243833;1.338334;1.271584;1.204125;1.242625"
-      }
-    },
-    {
-      "case": [
-        "random",
-        "4096",
-        "131072",
-        "64"
-      ],
-      "heap_a1_a2": [
-        6.672416,
-        6.661792
-      ],
-      "dial_a1_a2": [
-        3.853958,
-        3.865375
-      ],
-      "best_gpu": {
-        "case": "random",
-        "n": "4096",
-        "e": "131072",
-        "queries": "64",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "2.215000",
-        "distance_ms": "1.628334",
-        "gpu_ms": "0.809417",
-        "edge_visits": "134217728",
-        "rounds": "16",
-        "waits": "4",
-        "fallback64": "0",
-        "upload_ms": "1.900000",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "4.834667;2.066875;2.150542;2.482250;2.217375;2.215000;1.987125"
-      }
-    },
-    {
-      "case": [
-        "clos",
-        "800",
-        "320000",
-        "64"
-      ],
-      "heap_a1_a2": [
-        5.124625,
-        5.390792
-      ],
-      "dial_a1_a2": [
-        5.421083,
-        5.537125
-      ],
-      "best_gpu": {
-        "case": "clos",
-        "n": "800",
-        "e": "320000",
-        "queries": "64",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "8.371875",
-        "distance_ms": "4.354166",
-        "gpu_ms": "6.133375",
-        "edge_visits": "163840000",
-        "rounds": "8",
-        "waits": "3",
-        "fallback64": "0",
-        "upload_ms": "3.559834",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "7.950875;8.814666;8.371875;7.833334;8.577500;8.882584;6.996125"
-      }
-    },
-    {
-      "case": [
-        "grid",
-        "10000",
-        "39600",
-        "1"
-      ],
-      "heap_a1_a2": [
-        0.200833,
-        0.193709
-      ],
-      "dial_a1_a2": [
-        0.126041,
-        0.128833
-      ],
-      "best_gpu": {
-        "case": "grid",
-        "n": "10000",
-        "e": "39600",
-        "queries": "1",
-        "method": "pull32_gpu_dag",
-        "wall_ms": "3.250500",
-        "distance_ms": "2.965875",
-        "gpu_ms": "0.577125",
-        "edge_visits": "7920000",
-        "rounds": "200",
-        "waits": "27",
-        "fallback64": "0",
-        "upload_ms": "0.515708",
-        "samples": "7",
-        "correct": "pass",
-        "wall_samples_ms": "3.552583;3.289542;3.200750;2.978667;3.290000;3.250500;3.223000"
-      }
-    }
-  ]
-}
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.md b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.md
deleted file mode 100644
index ae069d3..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba/summary.md
+++ /dev/null
@@ -1,13 +0,0 @@
-# Stronger CPU algorithm A/B/A
-
-All methods include exact distances and canonical-equivalent positive-cost DAG edge sets. CPU batches use 10 workers. Eligibility is cached outside timing for both devices. Seven measured samples and two checked warmups. These remain exploratory, non-isolated desktop measurements. GPU choice is an oracle across 12 tested variants.
-
-| Case / N / E / Q | Cached heap + DAG A1 / A2 ms | Dial + DAG A1 / A2 ms | Best GPU B ms | GPU method |
-|---|---:|---:|---:|---|
-| random / 1024 / 8192 / 1 | 0.053 / 0.059 | 0.028 / 0.030 | 0.634 | pull32_interleaved |
-| random / 4096 / 32768 / 256 | 13.030 / 13.024 | 7.056 / 6.925 | 4.001 | pull32_gpu_dag |
-| random / 16384 / 131072 / 64 | 17.500 / 17.268 | 7.696 / 7.677 | 3.851 | pull32_gpu_dag |
-| random / 65536 / 524288 / 1 | 11.474 / 11.530 | 4.384 / 4.372 | 1.244 | pull32_gpu_dag |
-| random / 4096 / 131072 / 64 | 6.672 / 6.662 | 3.854 / 3.865 | 2.215 | pull32_gpu_dag |
-| clos / 800 / 320000 / 64 | 5.125 / 5.391 | 5.421 / 5.537 | 8.372 | pull32_gpu_dag |
-| grid / 10000 / 39600 / 1 | 0.201 / 0.194 | 0.126 / 0.129 | 3.251 | pull32_gpu_dag |
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-correctness-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-correctness-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-correctness.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-correctness.csv
deleted file mode 100644
index e07f558..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-correctness.csv
+++ /dev/null
@@ -1,25 +0,0 @@
-case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms
-random_masked,40,240,8,cpu_heap_cached_full,0.071250,3,pass,0.071250;0.105375;0.068625
-random_masked,40,240,8,cpu_dial_full,0.098166,3,pass,0.098166;0.102000;0.074667
-random_masked,43,258,8,cpu_heap_cached_full,0.055875,3,pass,0.056250;0.055875;0.050292
-random_masked,43,258,8,cpu_dial_full,0.070917,3,pass,0.075584;0.066958;0.070917
-random_masked,46,276,8,cpu_heap_cached_full,0.046125,3,pass,0.046125;0.068375;0.039542
-random_masked,46,276,8,cpu_dial_full,0.047875,3,pass,0.047875;0.046584;0.048292
-random_masked,49,294,8,cpu_heap_cached_full,0.036167,3,pass,0.036792;0.036167;0.035959
-random_masked,49,294,8,cpu_dial_full,0.071708,3,pass,0.076000;0.066041;0.071708
-random_masked,52,312,8,cpu_heap_cached_full,0.043042,3,pass,0.043042;0.038292;0.045834
-random_masked,52,312,8,cpu_dial_full,0.073292,3,pass,0.073292;0.066792;0.132083
-random_masked,55,330,8,cpu_heap_cached_full,0.081459,3,pass,0.081459;0.110833;0.060291
-random_masked,55,330,8,cpu_dial_full,0.073916,3,pass,0.076041;0.072708;0.073916
-random_masked,58,348,8,cpu_heap_cached_full,0.051208,3,pass,0.050000;0.052500;0.051208
-random_masked,58,348,8,cpu_dial_full,0.076958,3,pass,0.072708;0.076958;0.080125
-random_masked,61,366,8,cpu_heap_cached_full,0.058750,3,pass,0.061791;0.058750;0.057625
-random_masked,61,366,8,cpu_dial_full,0.070542,3,pass,0.098166;0.070542;0.065000
-random_masked,64,384,8,cpu_heap_cached_full,0.039000,3,pass,0.042792;0.039000;0.038334
-random_masked,64,384,8,cpu_dial_full,0.050416,3,pass,0.053541;0.049709;0.050416
-random_masked,67,402,8,cpu_heap_cached_full,0.044000,3,pass,0.044000;0.046917;0.041500
-random_masked,67,402,8,cpu_dial_full,0.060459,3,pass,0.060459;0.064542;0.057333
-random_masked,70,420,8,cpu_heap_cached_full,0.042750,3,pass,0.039958;0.042750;0.046542
-random_masked,70,420,8,cpu_dial_full,0.056625,3,pass,0.056958;0.053167;0.056625
-random_masked,73,438,8,cpu_heap_cached_full,0.043666,3,pass,0.046833;0.043666;0.041209
-random_masked,73,438,8,cpu_dial_full,0.067417,3,pass,0.067417;0.065042;0.072167
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-full-sanitized-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-full-sanitized-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-full-sanitized.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-full-sanitized.csv
deleted file mode 100644
index 54cbd5e..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-full-sanitized.csv
+++ /dev/null
@@ -1,15 +0,0 @@
-case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,cpu_heap_cached_full,0.293125,2,pass,0.293125;0.276083
-random,1024,8192,1,cpu_dial_full,0.255416,2,pass,0.230334;0.255416
-random,4096,32768,256,cpu_heap_cached_full,36.254208,2,pass,35.992750;36.254208
-random,4096,32768,256,cpu_dial_full,25.138833,2,pass,25.138833;25.111958
-random,16384,131072,64,cpu_heap_cached_full,40.832542,2,pass,40.832542;40.449167
-random,16384,131072,64,cpu_dial_full,26.089500,2,pass,26.089500;25.896417
-random,65536,524288,1,cpu_heap_cached_full,31.633041,2,pass,31.633041;29.508083
-random,65536,524288,1,cpu_dial_full,18.166167,2,pass,17.720125;18.166167
-random,4096,131072,64,cpu_heap_cached_full,19.184083,2,pass,19.184083;19.154291
-random,4096,131072,64,cpu_dial_full,15.231375,2,pass,15.231375;14.640042
-clos,800,320000,64,cpu_heap_cached_full,43.773750,2,pass,43.773750;43.312208
-clos,800,320000,64,cpu_dial_full,43.499792,2,pass,43.499792;42.404333
-grid,10000,39600,1,cpu_heap_cached_full,1.385875,2,pass,1.385875;1.377625
-grid,10000,39600,1,cpu_dial_full,1.141959,2,pass,1.141959;1.111958
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-sanitized-stderr.txt b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-sanitized-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-sanitized.csv b/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-sanitized.csv
deleted file mode 100644
index d524588..0000000
--- a/dev/research/metal_pathfinding/optimization/results/cpu-algorithms-sanitized.csv
+++ /dev/null
@@ -1,25 +0,0 @@
-case,n,e,queries,method,wall_ms,samples,correct,wall_samples_ms
-random_masked,40,240,8,cpu_heap_cached_full,0.043625,3,pass,0.109250;0.043625;0.035917
-random_masked,40,240,8,cpu_dial_full,0.049208,3,pass,0.049208;0.050166;0.036667
-random_masked,43,258,8,cpu_heap_cached_full,0.038792,3,pass,0.035000;0.038792;0.054958
-random_masked,43,258,8,cpu_dial_full,0.046375,3,pass,0.039625;0.057541;0.046375
-random_masked,46,276,8,cpu_heap_cached_full,0.043917,3,pass,0.046292;0.037916;0.043917
-random_masked,46,276,8,cpu_dial_full,0.041042,3,pass,0.038416;0.042791;0.041042
-random_masked,49,294,8,cpu_heap_cached_full,0.037500,3,pass,0.038541;0.037500;0.035583
-random_masked,49,294,8,cpu_dial_full,0.049791,3,pass,0.049791;0.036833;0.064375
-random_masked,52,312,8,cpu_heap_cached_full,0.042708,3,pass,0.042708;0.046125;0.035916
-random_masked,52,312,8,cpu_dial_full,0.068458,3,pass,0.054041;0.072625;0.068458
-random_masked,55,330,8,cpu_heap_cached_full,0.066625,3,pass,0.057458;0.066625;0.068417
-random_masked,55,330,8,cpu_dial_full,0.065458,3,pass,0.076583;0.064750;0.065458
-random_masked,58,348,8,cpu_heap_cached_full,0.055541,3,pass,0.054750;0.055541;0.057458
-random_masked,58,348,8,cpu_dial_full,0.053125,3,pass,0.078167;0.053125;0.052375
-random_masked,61,366,8,cpu_heap_cached_full,0.050625,3,pass,0.050625;0.052167;0.039917
-random_masked,61,366,8,cpu_dial_full,0.058291,3,pass,0.058291;0.039958;0.058917
-random_masked,64,384,8,cpu_heap_cached_full,0.038958,3,pass,0.038958;0.044500;0.037500
-random_masked,64,384,8,cpu_dial_full,0.050000,3,pass,0.050000;0.058875;0.045875
-random_masked,67,402,8,cpu_heap_cached_full,0.042708,3,pass,0.042708;0.039458;0.051000
-random_masked,67,402,8,cpu_dial_full,0.046167,3,pass,0.050625;0.046167;0.045709
-random_masked,70,420,8,cpu_heap_cached_full,0.044000,3,pass,0.047750;0.040458;0.044000
-random_masked,70,420,8,cpu_dial_full,0.053875,3,pass,0.053875;0.053875;0.050334
-random_masked,73,438,8,cpu_heap_cached_full,0.054250,3,pass,0.056334;0.054250;0.046958
-random_masked,73,438,8,cpu_dial_full,0.065000,3,pass,0.069834;0.065000;0.060791
diff --git a/dev/research/metal_pathfinding/optimization/results/sanitize-test.txt b/dev/research/metal_pathfinding/optimization/results/sanitize-test.txt
deleted file mode 100644
index 7502c0a..0000000
--- a/dev/research/metal_pathfinding/optimization/results/sanitize-test.txt
+++ /dev/null
@@ -1,352 +0,0 @@
--- pybind11 not found via config; using FetchContent
--- pybind11 v3.0.0 
--- Enabling sanitizers (disables optimizations)
--- Configuring done (0.6s)
--- Generating done (0.0s)
--- Build files have been written to: /Users/networmix/ws/NetGraph-Core/build/cpp-sanitize
-ninja: no work to do.
-Test project /Users/networmix/ws/NetGraph-Core/build/cpp-sanitize
-        Start  51: ShortestPathsTo.DistancesMatchForwardDistancesToDst
-        Start  52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource
-        Start  77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission
-        Start  78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf
-  1/170 Test  #77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission ............................   Passed    0.08 sec
-  2/170 Test  #78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf .....................   Passed    0.08 sec
-        Start  54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads
-        Start  53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag
-  3/170 Test  #51: ShortestPathsTo.DistancesMatchForwardDistancesToDst ...............................   Passed    0.09 sec
-  4/170 Test  #52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource ..................   Passed    0.09 sec
-        Start  55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected
-        Start  56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode
-  5/170 Test  #54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads ..............................   Passed    0.05 sec
-        Start  80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream
-  6/170 Test  #53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag .............................   Passed    0.05 sec
-  7/170 Test  #55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected ..................................   Passed    0.05 sec
-        Start  79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops
-        Start  81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops
-  8/170 Test  #56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode ............................   Passed    0.05 sec
-        Start  82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger
-  9/170 Test  #80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream ..........................   Passed    0.05 sec
- 10/170 Test  #79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops ..............................   Passed    0.05 sec
- 11/170 Test  #81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops .....................   Passed    0.05 sec
-        Start  93: FlowGraphStamp.CopiesAndMovesGetFreshUids
-        Start  94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal
-        Start  16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping
- 12/170 Test  #82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger .......................   Passed    0.05 sec
-        Start  15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast
- 13/170 Test  #94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal ..........................   Passed    0.06 sec
-        Start  92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual
- 14/170 Test  #93: FlowGraphStamp.CopiesAndMovesGetFreshUids .........................................   Passed    0.06 sec
- 15/170 Test  #16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping ....   Passed    0.06 sec
- 16/170 Test  #15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast ...   Passed    0.06 sec
-        Start  47: ShortestPaths.ResolveToPathsWithMaxPathsLimit
-        Start 156: MaskingTests.CombinedNodeAndEdgeMasks
-        Start 169: MaskingTests.AlgorithmsAPIMaskedSource
- 17/170 Test  #47: ShortestPaths.ResolveToPathsWithMaxPathsLimit .....................................   Passed    0.06 sec
-        Start  46: ShortestPaths.ResolveToPathsSplittingParallelEdges
- 18/170 Test #156: MaskingTests.CombinedNodeAndEdgeMasks .............................................   Passed    0.06 sec
- 19/170 Test #169: MaskingTests.AlgorithmsAPIMaskedSource ............................................   Passed    0.06 sec
-        Start  48: ShortestPaths.LargeGraphStressTest
-        Start  86: FlowGraph.RemoveByClassFiltersCorrectly
- 20/170 Test  #92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual ................................   Passed    0.07 sec
-        Start  90: FlowGraph.CoalescesDuplicateEdgeIds
- 21/170 Test  #46: ShortestPaths.ResolveToPathsSplittingParallelEdges ................................   Passed    0.06 sec
-        Start 163: MaskingTests.MaxFlowWithEdgeMask
- 22/170 Test  #86: FlowGraph.RemoveByClassFiltersCorrectly ...........................................   Passed    0.06 sec
-        Start 125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest
- 23/170 Test  #48: ShortestPaths.LargeGraphStressTest ................................................   Passed    0.06 sec
-        Start 164: MaskingTests.MaxFlowAllPathsMasked
- 24/170 Test  #90: FlowGraph.CoalescesDuplicateEdgeIds ...............................................   Passed    0.06 sec
-        Start 128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths
- 25/170 Test #125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest ................................   Passed    0.06 sec
-        Start  98: MaxFlow.DegenerateCase_SourceEqualsSink
- 26/170 Test #163: MaskingTests.MaxFlowWithEdgeMask ..................................................   Passed    0.06 sec
-        Start 118: MaxFlow.OptionalOutputs_ResidualAndReachable
- 27/170 Test #164: MaskingTests.MaxFlowAllPathsMasked ................................................   Passed    0.06 sec
-        Start  69: FlowState.ApplyDeltasClampsWithinCapacityBounds
- 28/170 Test #128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths ................................   Passed    0.06 sec
-        Start  26: StrictMultiDiGraph.ZeroCostEdges
- 29/170 Test  #98: MaxFlow.DegenerateCase_SourceEqualsSink ...........................................   Passed    0.06 sec
- 30/170 Test #118: MaxFlow.OptionalOutputs_ResidualAndReachable ......................................   Passed    0.06 sec
- 31/170 Test  #69: FlowState.ApplyDeltasClampsWithinCapacityBounds ...................................   Passed    0.06 sec
-        Start  68: FlowState.ResetWithInvalidResidualThrows
-        Start 168: MaskingTests.AllEdgesMaskedNoReachability
-        Start 149: MaskingTests.MaskedSourceInComputeMinCut
- 32/170 Test  #26: StrictMultiDiGraph.ZeroCostEdges ..................................................   Passed    0.06 sec
-        Start 142: KShortestPaths.LooplessPaths
- 33/170 Test  #68: FlowState.ResetWithInvalidResidualThrows ..........................................   Passed    0.06 sec
-        Start 122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths
- 34/170 Test #168: MaskingTests.AllEdgesMaskedNoReachability .........................................   Passed    0.06 sec
- 35/170 Test #149: MaskingTests.MaskedSourceInComputeMinCut ..........................................   Passed    0.06 sec
-        Start  25: StrictMultiDiGraph.MaxCapacityEdges
-        Start 106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability
- 36/170 Test #142: KShortestPaths.LooplessPaths ......................................................   Passed    0.06 sec
-        Start 116: MaxFlow.MinCut_ValidEdgeIdentification
- 37/170 Test #122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths ......................................   Passed    0.06 sec
- 38/170 Test  #25: StrictMultiDiGraph.MaxCapacityEdges ...............................................   Passed    0.06 sec
-        Start 141: KShortestPaths.DisconnectedReturnsEmpty
-        Start  29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows
- 39/170 Test #106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability ...............................   Passed    0.06 sec
-        Start  96: MaxFlow.SinglePath_BottleneckConstraint
- 40/170 Test #116: MaxFlow.MinCut_ValidEdgeIdentification ............................................   Passed    0.06 sec
-        Start  60: FlowState.EqualBalancedDistribution
- 41/170 Test  #29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows ....................................   Passed    0.06 sec
- 42/170 Test  #96: MaxFlow.SinglePath_BottleneckConstraint ...........................................   Passed    0.06 sec
-        Start 154: MaskingTests.MaskedEdgeSelectsAlternativePath
-        Start  95: MaxFlow.SinglePath_BasicLinear
- 43/170 Test #141: KShortestPaths.DisconnectedReturnsEmpty ...........................................   Passed    0.06 sec
-        Start 121: MaxFlow.BatchMaxFlow_IndependentMaskApplication
- 44/170 Test  #60: FlowState.EqualBalancedDistribution ...............................................   Passed    0.06 sec
-        Start  39: ShortestPaths.ResidualAwareFiltering
- 45/170 Test  #95: MaxFlow.SinglePath_BasicLinear ....................................................   Passed    0.06 sec
- 46/170 Test #121: MaxFlow.BatchMaxFlow_IndependentMaskApplication ...................................   Passed    0.06 sec
-        Start  63: FlowState.ApplyDeltasSubtractive
-        Start 136: KShortestPaths.KEqualsZeroReturnsEmpty
- 47/170 Test #154: MaskingTests.MaskedEdgeSelectsAlternativePath .....................................   Passed    0.07 sec
- 48/170 Test  #39: ShortestPaths.ResidualAwareFiltering ..............................................   Passed    0.06 sec
-        Start 117: MaxFlow.CostDistribution_AccountsForAllFlow
-        Start  44: ShortestPaths.TieBreakingDeterminism
- 49/170 Test  #63: FlowState.ApplyDeltasSubtractive ..................................................   Passed    0.06 sec
-        Start 151: MaskingTests.MaskedDestinationUnreachable
- 50/170 Test #136: KShortestPaths.KEqualsZeroReturnsEmpty ............................................   Passed    0.06 sec
- 51/170 Test #117: MaxFlow.CostDistribution_AccountsForAllFlow .......................................   Passed    0.06 sec
- 52/170 Test  #44: ShortestPaths.TieBreakingDeterminism ..............................................   Passed    0.06 sec
-        Start 104: MaxFlow.ECMP_TenPaths_ScalabilityValidation
-        Start  85: FlowGraph.RemovalDeletesEntry
-        Start 138: KShortestPaths.UniqueModeFiltering
- 53/170 Test #104: MaxFlow.ECMP_TenPaths_ScalabilityValidation .......................................   Passed    0.06 sec
- 54/170 Test  #85: FlowGraph.RemovalDeletesEntry .....................................................   Passed    0.06 sec
-        Start 111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers
-        Start  14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles
- 55/170 Test #151: MaskingTests.MaskedDestinationUnreachable .........................................   Passed    0.06 sec
- 56/170 Test #138: KShortestPaths.UniqueModeFiltering ................................................   Passed    0.06 sec
-        Start 165: MaskingTests.EmptyNodeMaskAllowsAllNodes
-        Start 132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow
- 57/170 Test #111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers .........................................   Passed    0.06 sec
-        Start  37: ShortestPaths.DisconnectedComponents
- 58/170 Test  #14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles ...................   Passed    0.06 sec
- 59/170 Test #165: MaskingTests.EmptyNodeMaskAllowsAllNodes ..........................................   Passed    0.06 sec
- 60/170 Test #132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow .........................................   Passed    0.06 sec
-        Start  89: FlowGraph.GetFlowPathForDAGReturnsEmpty
-        Start 124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest
-        Start 129: MaxFlow.Sensitivity_SinglePath
- 61/170 Test #124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest .................................   Passed    0.06 sec
- 62/170 Test #129: MaxFlow.Sensitivity_SinglePath ....................................................   Passed    0.06 sec
-        Start  91: FlowGraph.LedgerHistory_RemovalRestoresResidual
-        Start  75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero
- 63/170 Test  #37: ShortestPaths.DisconnectedComponents ..............................................   Passed    0.06 sec
- 64/170 Test  #89: FlowGraph.GetFlowPathForDAGReturnsEmpty ...........................................   Passed    0.06 sec
-        Start  27: StrictMultiDiGraph.InvalidNumNodesThrows
-        Start  76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable
- 65/170 Test  #91: FlowGraph.LedgerHistory_RemovalRestoresResidual ...................................   Passed    0.07 sec
- 66/170 Test  #75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero .....................   Passed    0.07 sec
-        Start 153: MaskingTests.MaskedEdgeBlocksPath
-        Start  99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath
- 67/170 Test  #27: StrictMultiDiGraph.InvalidNumNodesThrows ..........................................   Passed    0.07 sec
- 68/170 Test  #76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable ............   Passed    0.07 sec
-        Start 120: MaxFlow.EdgeMask_SelectiveEdgeFiltering
-        Start 101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath
- 69/170 Test #120: MaxFlow.EdgeMask_SelectiveEdgeFiltering ...........................................   Passed    0.06 sec
-        Start  35: StrictMultiDiGraph.MultipleCostTiers
- 70/170 Test #153: MaskingTests.MaskedEdgeBlocksPath .................................................   Passed    0.06 sec
- 71/170 Test  #99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath ...................................   Passed    0.06 sec
- 72/170 Test #101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath ..................................   Passed    0.06 sec
-        Start 161: MaskingTests.KSPWithEdgeMask
-        Start 102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath
-        Start   2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath
- 73/170 Test  #35: StrictMultiDiGraph.MultipleCostTiers ..............................................   Passed    0.06 sec
-        Start 167: MaskingTests.AllNodesMaskedNoReachability
- 74/170 Test #161: MaskingTests.KSPWithEdgeMask ......................................................   Passed    0.06 sec
- 75/170 Test #102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath .................................   Passed    0.06 sec
- 76/170 Test   #2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath .........................   Passed    0.06 sec
-        Start  64: FlowState.MinCutComputation
-        Start 139: KShortestPaths.MaxCostFactorLimit
-        Start   3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths
- 77/170 Test #167: MaskingTests.AllNodesMaskedNoReachability .........................................   Passed    0.06 sec
-        Start  11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier
- 78/170 Test  #64: FlowState.MinCutComputation .......................................................   Passed    0.06 sec
- 79/170 Test #139: KShortestPaths.MaxCostFactorLimit .................................................   Passed    0.06 sec
- 80/170 Test   #3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths ............   Passed    0.06 sec
-        Start 133: MaxFlow.CompletionPhase_RecoversCancellation
-        Start  18: StrictMultiDiGraph.SingleNode
-        Start  49: ShortestPaths.RejectsMaskLengthMismatch
- 81/170 Test #133: MaxFlow.CompletionPhase_RecoversCancellation ......................................   Passed    0.07 sec
-        Start  13: FlowPolicyStatic.MaskedBundleIsDown
- 82/170 Test  #11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier ...................   Passed    0.07 sec
- 83/170 Test  #18: StrictMultiDiGraph.SingleNode .....................................................   Passed    0.07 sec
- 84/170 Test  #49: ShortestPaths.RejectsMaskLengthMismatch ...........................................   Passed    0.07 sec
-        Start 110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly
-        Start 100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow
-        Start  23: StrictMultiDiGraph.CSROffsetsMonotonicity
- 85/170 Test  #13: FlowPolicyStatic.MaskedBundleIsDown ...............................................   Passed    0.07 sec
- 86/170 Test #110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly ..................................   Passed    0.07 sec
- 87/170 Test #100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow ....................................   Passed    0.07 sec
-        Start  22: StrictMultiDiGraph.ExternalEdgeIdsPreserved
-        Start   7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths
-        Start 145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK
- 88/170 Test  #23: StrictMultiDiGraph.CSROffsetsMonotonicity .........................................   Passed    0.07 sec
-        Start 119: MaxFlow.NodeMask_BlocksFlowThroughNode
- 89/170 Test  #22: StrictMultiDiGraph.ExternalEdgeIdsPreserved .......................................   Passed    0.07 sec
- 90/170 Test #145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK .....................................   Passed    0.06 sec
-        Start  65: FlowState.ResetRestoresCapacity
-        Start 135: KShortestPaths.FindsKPaths
- 91/170 Test   #7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths ...........   Passed    0.07 sec
- 92/170 Test #119: MaxFlow.NodeMask_BlocksFlowThroughNode ............................................   Passed    0.07 sec
-        Start 143: KShortestPaths.OutOfOrderNodePredDAGSemantics
-        Start 134: MaxFlow.CompletionPhase_RespectsNodeMask
- 93/170 Test #143: KShortestPaths.OutOfOrderNodePredDAGSemantics .....................................   Passed    0.06 sec
-        Start  43: ShortestPaths.PredDAGIntegrity
- 94/170 Test  #65: FlowState.ResetRestoresCapacity ...................................................   Passed    0.06 sec
- 95/170 Test #135: KShortestPaths.FindsKPaths ........................................................   Passed    0.06 sec
- 96/170 Test #134: MaxFlow.CompletionPhase_RespectsNodeMask ..........................................   Passed    0.06 sec
-        Start  33: StrictMultiDiGraph.SelfLoopAllowed
-        Start  62: FlowState.ApplyDeltasAdditive
-        Start  32: StrictMultiDiGraph.NegativeCostThrows
- 97/170 Test  #43: ShortestPaths.PredDAGIntegrity ....................................................   Passed    0.07 sec
- 98/170 Test  #62: FlowState.ApplyDeltasAdditive .....................................................   Passed    0.07 sec
-        Start  19: StrictMultiDiGraph.SingleEdge
-        Start 144: KShortestPaths.LargerOutOfOrderTopology
- 99/170 Test  #33: StrictMultiDiGraph.SelfLoopAllowed ................................................   Passed    0.07 sec
-100/170 Test  #32: StrictMultiDiGraph.NegativeCostThrows .............................................   Passed    0.07 sec
-        Start  97: MaxFlow.SinglePath_ShortestPathEquivalence
-        Start 114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult
-101/170 Test  #19: StrictMultiDiGraph.SingleEdge .....................................................   Passed    0.06 sec
-        Start 170: MaskingTests.AlgorithmsAPIMaxFlowWithMask
-102/170 Test #144: KShortestPaths.LargerOutOfOrderTopology ...........................................   Passed    0.06 sec
-103/170 Test  #97: MaxFlow.SinglePath_ShortestPathEquivalence ........................................   Passed    0.06 sec
-104/170 Test #114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult ..............................   Passed    0.06 sec
-        Start   4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath
-        Start 131: MaxFlow.Sensitivity_PartialSaturation
-        Start  61: FlowState.ZeroCapacityHandling
-105/170 Test #170: MaskingTests.AlgorithmsAPIMaxFlowWithMask .........................................   Passed    0.07 sec
-106/170 Test #131: MaxFlow.Sensitivity_PartialSaturation .............................................   Passed    0.07 sec
-        Start 159: MaskingTests.ResidualAndNodeMaskCombined
-        Start 109: MaxFlow.ZeroCapacityPath_CorrectFiltering
-107/170 Test   #4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath .............   Passed    0.07 sec
-108/170 Test  #61: FlowState.ZeroCapacityHandling ....................................................   Passed    0.07 sec
-        Start  21: StrictMultiDiGraph.EdgeSortingByCost
-        Start  20: StrictMultiDiGraph.ParallelEdges
-109/170 Test #109: MaxFlow.ZeroCapacityPath_CorrectFiltering .........................................   Passed    0.06 sec
-        Start 115: MaxFlow.FlowConservation_IntermediateNodes
-110/170 Test #159: MaskingTests.ResidualAndNodeMaskCombined ..........................................   Passed    0.07 sec
-111/170 Test  #21: StrictMultiDiGraph.EdgeSortingByCost ..............................................   Passed    0.07 sec
-112/170 Test  #20: StrictMultiDiGraph.ParallelEdges ..................................................   Passed    0.07 sec
-        Start   8: FlowPolicyCore.DiminishingReturnsCutoff
-        Start 147: MaskingTests.MaskedSourceWithDestination
-        Start  45: ShortestPaths.PreferHigherResidualTieBreak
-113/170 Test #115: MaxFlow.FlowConservation_IntermediateNodes ........................................   Passed    0.07 sec
-114/170 Test #147: MaskingTests.MaskedSourceWithDestination ..........................................   Passed    0.06 sec
-115/170 Test  #45: ShortestPaths.PreferHigherResidualTieBreak ........................................   Passed    0.06 sec
-        Start 160: MaskingTests.KSPWithNodeMask
-        Start  74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero
-        Start  42: ShortestPaths.EarlyExitOptimization
-116/170 Test   #8: FlowPolicyCore.DiminishingReturnsCutoff ...........................................   Passed    0.07 sec
-        Start 126: MaxFlow.Triangle_Topology_Combine_Mode
-117/170 Test  #42: ShortestPaths.EarlyExitOptimization ...............................................   Passed    0.06 sec
-        Start  84: FlowGraph.PlacementCreatesEntry
-118/170 Test #160: MaskingTests.KSPWithNodeMask ......................................................   Passed    0.07 sec
-119/170 Test  #74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero ....................   Passed    0.07 sec
-120/170 Test #126: MaxFlow.Triangle_Topology_Combine_Mode ............................................   Passed    0.06 sec
-        Start 146: MaskingTests.MaskedSourceReturnsEmptyDAG
-        Start  88: FlowGraph.GetFlowPathForLinearFlow
-        Start  72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges
-121/170 Test  #84: FlowGraph.PlacementCreatesEntry ...................................................   Passed    0.07 sec
-        Start  67: FlowState.InvalidResidualInitThrows
-122/170 Test #146: MaskingTests.MaskedSourceReturnsEmptyDAG ..........................................   Passed    0.07 sec
-123/170 Test  #88: FlowGraph.GetFlowPathForLinearFlow ................................................   Passed    0.07 sec
-124/170 Test  #72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges ..............   Passed    0.07 sec
-        Start   6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution
-        Start  66: FlowState.CustomInitialResidual
-        Start  17: StrictMultiDiGraph.EmptyGraph
-125/170 Test  #66: FlowState.CustomInitialResidual ...................................................   Passed    0.07 sec
-        Start   1: GraphSmoke.ConstructAndRunSPF
-126/170 Test  #67: FlowState.InvalidResidualInitThrows ...............................................   Passed    0.07 sec
-127/170 Test   #6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution .........   Passed    0.07 sec
-128/170 Test  #17: StrictMultiDiGraph.EmptyGraph .....................................................   Passed    0.07 sec
-        Start 150: MaskingTests.OutOfRangeSourceInComputeMinCut
-        Start  83: FlowGraph.EmptyLedgerInitially
-        Start  70: FlowState.EqualBalancedReconvergentDAGPlacesAll
-129/170 Test   #1: GraphSmoke.ConstructAndRunSPF .....................................................   Passed    0.07 sec
-        Start 107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced
-130/170 Test #150: MaskingTests.OutOfRangeSourceInComputeMinCut ......................................   Passed    0.07 sec
-131/170 Test  #83: FlowGraph.EmptyLedgerInitially ....................................................   Passed    0.07 sec
-132/170 Test  #70: FlowState.EqualBalancedReconvergentDAGPlacesAll ...................................   Passed    0.07 sec
-        Start  24: StrictMultiDiGraph.CSRReverseAdjacency
-        Start  34: StrictMultiDiGraph.NegativeNodeIdThrows
-        Start 162: MaskingTests.MaxFlowWithNodeMask
-133/170 Test  #34: StrictMultiDiGraph.NegativeNodeIdThrows ...........................................   Passed    0.07 sec
-        Start  87: FlowGraph.GetFlowEdgesReturnsDeltas
-134/170 Test #107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced ...................................   Passed    0.07 sec
-135/170 Test  #24: StrictMultiDiGraph.CSRReverseAdjacency ............................................   Passed    0.07 sec
-136/170 Test #162: MaskingTests.MaxFlowWithNodeMask ..................................................   Passed    0.07 sec
-        Start 127: MaxFlow.SimpleParallelPaths_Topology
-        Start 166: MaskingTests.EmptyEdgeMaskAllowsAllEdges
-        Start 108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth
-137/170 Test #127: MaxFlow.SimpleParallelPaths_Topology ..............................................   Passed    0.07 sec
-        Start  59: FlowState.ProportionalDistribution
-138/170 Test  #87: FlowGraph.GetFlowEdgesReturnsDeltas ...............................................   Passed    0.07 sec
-139/170 Test #166: MaskingTests.EmptyEdgeMaskAllowsAllEdges ..........................................   Passed    0.07 sec
-140/170 Test #108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth ...................................   Passed    0.07 sec
-        Start 155: MaskingTests.MultipleEdgesMasked
-        Start 140: KShortestPaths.PathsSortedByCost
-        Start  50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic
-141/170 Test  #59: FlowState.ProportionalDistribution ................................................   Passed    0.07 sec
-        Start  36: ShortestPaths.SingleSourceAllNodes
-142/170 Test #155: MaskingTests.MultipleEdgesMasked ..................................................   Passed    0.07 sec
-143/170 Test #140: KShortestPaths.PathsSortedByCost ..................................................   Passed    0.07 sec
-144/170 Test  #50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic ......................................   Passed    0.07 sec
-        Start 105: MaxFlow.AsymmetricCapacity_1to100_Proportional
-        Start  30: StrictMultiDiGraph.OutOfRangeNodeThrows
-        Start   9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths
-145/170 Test  #36: ShortestPaths.SingleSourceAllNodes ................................................   Passed    0.07 sec
-        Start 103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation
-146/170 Test #105: MaxFlow.AsymmetricCapacity_1to100_Proportional ....................................   Passed    0.07 sec
-147/170 Test  #30: StrictMultiDiGraph.OutOfRangeNodeThrows ...........................................   Passed    0.07 sec
-148/170 Test   #9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths ........   Passed    0.07 sec
-        Start  31: StrictMultiDiGraph.NegativeCapacityThrows
-        Start 137: KShortestPaths.NodeMaskBlocksPaths
-        Start 130: MaxFlow.Sensitivity_TwoParallelPaths
-149/170 Test #103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation ......................................   Passed    0.07 sec
-150/170 Test  #31: StrictMultiDiGraph.NegativeCapacityThrows .........................................   Passed    0.07 sec
-151/170 Test #137: KShortestPaths.NodeMaskBlocksPaths ................................................   Passed    0.07 sec
-        Start  38: ShortestPaths.MultipleEqualCostPaths
-        Start  41: ShortestPaths.EdgeMaskFiltering
-        Start  73: FlowState.EqualBalanced_DownstreamSplitEqualization
-152/170 Test #130: MaxFlow.Sensitivity_TwoParallelPaths ..............................................   Passed    0.07 sec
-        Start  10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck
-153/170 Test  #10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck ......   Passed    0.07 sec
-        Start 123: MaxFlow.SharedBottleneck_MultiplePathsMerge
-154/170 Test  #38: ShortestPaths.MultipleEqualCostPaths ..............................................   Passed    0.07 sec
-155/170 Test  #41: ShortestPaths.EdgeMaskFiltering ...................................................   Passed    0.07 sec
-156/170 Test  #73: FlowState.EqualBalanced_DownstreamSplitEqualization ...............................   Passed    0.07 sec
-        Start  57: FlowState.InitialResidualEqualsCapacity
-        Start  40: ShortestPaths.NodeMaskIsolation
-        Start  71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization
-157/170 Test #123: MaxFlow.SharedBottleneck_MultiplePathsMerge .......................................   Passed    0.07 sec
-158/170 Test  #57: FlowState.InitialResidualEqualsCapacity ...........................................   Passed    0.07 sec
-        Start  28: StrictMultiDiGraph.MismatchedArrayLengthsThrow
-        Start 158: MaskingTests.MaskWithResidualCapacity
-159/170 Test  #40: ShortestPaths.NodeMaskIsolation ...................................................   Passed    0.07 sec
-160/170 Test  #71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization ................................   Passed    0.07 sec
-        Start 148: MaskingTests.MaskedSourceInMaxFlow
-        Start  58: FlowState.PlacementReducesResidual
-161/170 Test #158: MaskingTests.MaskWithResidualCapacity .............................................   Passed    0.07 sec
-        Start 113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly
-162/170 Test  #28: StrictMultiDiGraph.MismatchedArrayLengthsThrow ....................................   Passed    0.07 sec
-163/170 Test #148: MaskingTests.MaskedSourceInMaxFlow ................................................   Passed    0.07 sec
-164/170 Test  #58: FlowState.PlacementReducesResidual ................................................   Passed    0.07 sec
-        Start 152: MaskingTests.MaskedIntermediateNode
-        Start 157: MaskingTests.NodeMaskOverridesEdgeMask
-        Start 112: MaxFlow.EqualCost_ShortestVsFull_Equivalent
-165/170 Test #113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly ................................   Passed    0.07 sec
-        Start  12: FlowPolicyStatic.PerFlowBundleBinding
-166/170 Test #152: MaskingTests.MaskedIntermediateNode ...............................................   Passed    0.07 sec
-167/170 Test #157: MaskingTests.NodeMaskOverridesEdgeMask ............................................   Passed    0.07 sec
-168/170 Test #112: MaxFlow.EqualCost_ShortestVsFull_Equivalent .......................................   Passed    0.07 sec
-        Start   5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity
-169/170 Test  #12: FlowPolicyStatic.PerFlowBundleBinding .............................................   Passed    0.07 sec
-170/170 Test   #5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity ....   Passed    0.06 sec
-
-100% tests passed out of 170
-
-Total Test time (real) =   2.80 sec
diff --git a/dev/research/metal_pathfinding/optimization/results/screen-known-limitations.txt b/dev/research/metal_pathfinding/optimization/results/screen-known-limitations.txt
deleted file mode 100644
index 87ae6b9..0000000
--- a/dev/research/metal_pathfinding/optimization/results/screen-known-limitations.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Exploratory screen only, not the final timing matrix.
-The conversion loop invoked the Objective-C .contents accessor once per distance,
-inflating host copy/conversion time on large batches. Corrected before final A/B/A.
-GPU DAG thread mapping also initially used query-fast threads for query-major data.
-All correctness checks passed; these were performance defects, not wrong distances.
-Source hashes are in screen-source-sha256.txt. Final hashes are in aba/environment.txt.
diff --git a/dev/research/metal_pathfinding/optimization/results/screen-source-sha256.txt b/dev/research/metal_pathfinding/optimization/results/screen-source-sha256.txt
deleted file mode 100644
index a3f0393..0000000
--- a/dev/research/metal_pathfinding/optimization/results/screen-source-sha256.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-0dad0787fdcf08c58ed135e27290a8012865aa8b6a369cc679e8bca622f62b78  dev/research/metal_pathfinding/optimization/experiment.mm
-2cdeaf23d1f11dfd07c7092824d7e991ecd70c0c597e6e40ab84c663907a3e17  dev/research/metal_pathfinding/optimization/kernels.metal
diff --git a/dev/research/metal_pathfinding/optimization/results/screen-stderr.txt b/dev/research/metal_pathfinding/optimization/results/screen-stderr.txt
deleted file mode 100644
index b3f2aa5..0000000
--- a/dev/research/metal_pathfinding/optimization/results/screen-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=26.8109 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/screen.csv b/dev/research/metal_pathfinding/optimization/results/screen.csv
deleted file mode 100644
index 6e7c168..0000000
--- a/dev/research/metal_pathfinding/optimization/results/screen.csv
+++ /dev/null
@@ -1,253 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_serial,0.762542,0.722583,0.437500,131072,16,2,0,0.153791,2,pass,0.762542;0.745541
-random,1024,8192,1,old_group_serial,0.964084,0.894000,0.680958,106496,13,1,0,0.153791,2,pass,0.964084;0.849083
-random,1024,8192,1,old_pull_parallel_dag,0.657209,0.643500,0.419875,131072,16,2,0,0.153791,2,pass,0.657209;0.650417
-random,1024,8192,1,old_group_parallel_dag,0.939833,0.895459,0.681833,106496,13,1,0,0.153791,2,pass,0.908916;0.939833
-random,1024,8192,1,pull64_barrier,0.674375,0.661834,0.397458,131072,16,2,0,0.153791,2,pass,0.674375;0.648416
-random,1024,8192,1,pull64_interleaved,0.853959,0.841292,0.252500,131072,16,2,0,0.153791,2,pass,0.853959;0.363292
-random,1024,8192,1,pull32_interleaved,0.315500,0.302917,0.075167,131072,16,2,0,0.153791,2,pass,0.309917;0.315500
-random,1024,8192,1,pull32_gpu_dag,0.881333,0.556833,0.271792,131072,16,4,0,0.153791,2,pass,0.881333;0.724833
-random,1024,8192,1,frontier32_vertex,0.494250,0.481458,0.180125,21088,16,2,0,0.153791,2,pass,0.473500;0.494250
-random,1024,8192,1,frontier32_simd,0.547583,0.534834,0.114833,20192,16,2,0,0.153791,2,pass,0.547583;0.423667
-random,1024,8192,1,frontier32_gpu_dag,0.746000,0.396458,0.128042,20520,16,4,0,0.153791,2,pass,0.746000;0.704541
-random,1024,8192,1,bucket32_d4,0.875292,0.862667,0.336125,8232,32,4,0,0.153791,2,pass,0.875292;0.871333
-random,1024,8192,1,bucket32_d16,0.671459,0.648500,0.262375,9336,24,3,0,0.153791,2,pass,0.647792;0.671459
-random,1024,8192,1,bucket32_d64,0.512667,0.499750,0.194875,19232,16,2,0,0.153791,2,pass,0.512667;0.452000
-random,1024,8192,64,old_pull_serial,3.818625,1.461417,0.483667,12582912,24,3,0,0.240041,2,pass,3.185541;3.818625
-random,1024,8192,64,old_group_serial,3.211083,0.894833,0.200375,7217152,17,1,0,0.240041,2,pass,3.211083;2.918583
-random,1024,8192,64,old_pull_parallel_dag,3.350541,3.060875,2.247542,12582912,24,3,0,0.240041,2,pass,2.083833;3.350541
-random,1024,8192,64,old_group_parallel_dag,1.480583,1.169125,0.894125,7217152,17,1,0,0.240041,2,pass,1.480583;1.419917
-random,1024,8192,64,pull64_barrier,1.122625,0.860000,0.311584,12582912,24,3,0,0.240041,2,pass,1.011750;1.122625
-random,1024,8192,64,pull64_interleaved,6.522000,6.270875,0.893750,12582912,24,3,0,0.240041,2,pass,5.917709;6.522000
-random,1024,8192,64,pull32_interleaved,6.568875,6.294000,1.247000,12582912,24,3,0,0.240041,2,pass,6.010583;6.568875
-random,1024,8192,64,pull32_gpu_dag,6.263042,5.390250,0.853792,12582912,24,5,0,0.240041,2,pass,6.197125;6.263042
-random,1024,8192,64,frontier32_vertex,6.342208,6.096333,1.145750,1294872,24,3,0,0.240041,2,pass,6.061666;6.342208
-random,1024,8192,64,frontier32_simd,7.192625,6.939583,2.005833,1209280,24,3,0,0.240041,2,pass,6.974292;7.192625
-random,1024,8192,64,frontier32_gpu_dag,5.802583,5.041083,0.489583,1206928,16,4,0,0.240041,2,pass,5.443083;5.802583
-random,1024,8192,64,bucket32_d4,9.311792,9.060875,3.431875,528520,56,7,0,0.240041,2,pass,9.311792;7.144291
-random,1024,8192,64,bucket32_d16,6.371083,6.101125,0.695750,601784,32,4,0,0.240041,2,pass,6.371083;5.691750
-random,1024,8192,64,bucket32_d64,7.686834,7.451417,2.572083,1155632,24,3,0,0.240041,2,pass,7.686834;6.262291
-clos,200,20000,64,old_pull_serial,5.877250,1.938875,1.613708,10240000,8,1,0,0.352709,2,pass,5.877250;5.434792
-clos,200,20000,64,old_group_serial,4.889250,0.948583,0.307792,3840000,3,1,0,0.352709,2,pass,4.889250;4.813292
-clos,200,20000,64,old_pull_parallel_dag,2.647292,2.119125,1.659625,10240000,8,1,0,0.352709,2,pass,2.086042;2.647292
-clos,200,20000,64,old_group_parallel_dag,1.495584,0.891459,0.309875,3840000,3,1,0,0.352709,2,pass,1.448458;1.495584
-clos,200,20000,64,pull64_barrier,2.218833,1.683417,1.023042,10240000,8,1,0,0.352709,2,pass,2.176959;2.218833
-clos,200,20000,64,pull64_interleaved,2.864708,2.299625,0.759375,10240000,8,1,0,0.352709,2,pass,2.610125;2.864708
-clos,200,20000,64,pull32_interleaved,2.704166,2.207834,0.698500,10240000,8,1,0,0.352709,2,pass,2.192083;2.704166
-clos,200,20000,64,pull32_gpu_dag,3.827584,2.580125,1.040375,10240000,8,3,0,0.352709,2,pass,3.230459;3.827584
-clos,200,20000,64,frontier32_vertex,2.962125,2.466500,0.986083,1280000,8,1,0,0.352709,2,pass,2.831042;2.962125
-clos,200,20000,64,frontier32_simd,2.346458,1.829250,0.359958,1280000,8,1,0,0.352709,2,pass,2.346458;2.066292
-clos,200,20000,64,frontier32_gpu_dag,4.250750,2.648000,0.788458,1280000,8,3,0,0.352709,2,pass,3.753292;4.250750
-clos,200,20000,64,bucket32_d4,3.090458,2.563208,0.507375,1280000,8,1,0,0.352709,2,pass,3.090458;2.377792
-clos,200,20000,64,bucket32_d16,2.999750,2.475542,1.133083,1280000,8,1,0,0.352709,2,pass,2.999750;2.523084
-clos,200,20000,64,bucket32_d64,2.528875,1.963250,0.468000,1280000,8,1,0,0.352709,2,pass,2.084417;2.528875
-grid,1024,3968,1,old_pull_serial,1.939625,1.920792,0.651750,253952,64,8,0,0.236834,2,pass,1.939625;1.786750
-grid,1024,3968,1,old_group_serial,1.449167,1.431625,1.011500,249984,63,1,0,0.236834,2,pass,1.449167;1.185000
-grid,1024,3968,1,old_pull_parallel_dag,1.785625,1.775542,0.651499,253952,64,8,0,0.236834,2,pass,1.785625;1.649542
-grid,1024,3968,1,old_group_parallel_dag,1.162416,1.153500,1.008625,249984,63,1,0,0.236834,2,pass,1.162416;1.150083
-grid,1024,3968,1,pull64_barrier,1.762958,1.753834,0.694125,253952,64,8,0,0.236834,2,pass,1.686750;1.762958
-grid,1024,3968,1,pull64_interleaved,2.131792,2.124834,1.110167,253952,64,8,0,0.236834,2,pass,1.793583;2.131792
-grid,1024,3968,1,pull32_interleaved,1.673334,1.664458,0.629750,253952,64,8,0,0.236834,2,pass,1.673334;1.599167
-grid,1024,3968,1,pull32_gpu_dag,2.191500,1.854833,0.896833,253952,64,10,0,0.236834,2,pass,2.000917;2.191500
-grid,1024,3968,1,frontier32_vertex,3.608792,3.595083,2.566375,3968,64,8,0,0.236834,2,pass,3.608792;2.936166
-grid,1024,3968,1,frontier32_simd,2.444500,2.435167,1.407542,3968,64,8,0,0.236834,2,pass,2.444500;2.438000
-grid,1024,3968,1,frontier32_gpu_dag,2.885083,2.530792,1.446375,3968,64,10,0,0.236834,2,pass,2.885083;2.840000
-grid,1024,3968,1,bucket32_d4,3.526792,3.517083,2.379750,3968,64,8,0,0.236834,2,pass,3.444875;3.526792
-grid,1024,3968,1,bucket32_d16,4.111792,4.100167,3.000833,3968,64,8,0,0.236834,2,pass,4.111792;3.712666
-grid,1024,3968,1,bucket32_d64,4.321125,4.313125,3.175875,3968,64,8,0,0.236834,2,pass,3.525208;4.321125
-hub,1024,3070,1,old_pull_serial,6.219708,6.202666,5.564083,98240,32,4,0,0.127834,2,pass,6.219708;6.202208
-hub,1024,3070,1,old_group_serial,4.915291,4.884334,4.720250,95170,31,1,0,0.127834,2,pass,4.855542;4.915291
-hub,1024,3070,1,old_pull_parallel_dag,6.068750,6.050375,5.496250,98240,32,4,0,0.127834,2,pass,6.068750;6.043792
-hub,1024,3070,1,old_group_parallel_dag,4.942709,4.928333,4.755875,95170,31,1,0,0.127834,2,pass,4.900708;4.942709
-hub,1024,3070,1,pull64_barrier,4.900083,4.888000,4.318500,98240,32,4,0,0.127834,2,pass,4.900083;4.899708
-hub,1024,3070,1,pull64_interleaved,5.090459,5.077667,4.310625,98240,32,4,0,0.127834,2,pass,5.090459;5.011958
-hub,1024,3070,1,pull32_interleaved,4.329166,4.318959,3.718042,98240,32,4,0,0.127834,2,pass,4.329166;4.298375
-hub,1024,3070,1,pull32_gpu_dag,5.058875,4.330667,4.105667,98240,32,6,0,0.127834,2,pass,5.006209;5.058875
-hub,1024,3070,1,frontier32_vertex,1.372833,1.364084,0.840958,3128,32,4,0,0.127834,2,pass,1.372833;1.322834
-hub,1024,3070,1,frontier32_simd,0.758292,0.751125,0.233125,3128,32,4,0,0.127834,2,pass,0.752542;0.758292
-hub,1024,3070,1,frontier32_gpu_dag,1.443542,0.736125,0.653958,3128,32,6,0,0.127834,2,pass,1.382958;1.443542
-hub,1024,3070,1,bucket32_d4,0.879333,0.871000,0.348375,3100,32,4,0,0.127834,2,pass,0.879333;0.859334
-hub,1024,3070,1,bucket32_d16,0.852333,0.844083,0.342417,3124,32,4,0,0.127834,2,pass,0.843708;0.852333
-hub,1024,3070,1,bucket32_d64,1.001750,0.993250,0.334375,3128,32,4,0,0.127834,2,pass,1.001750;0.857750
-random_masked_int64_reverse,1024,8192,8,old_pull_serial,0.521375,0.157541,0.032000,524288,8,1,0,0.210333,2,pass,0.521375;0.520625
-random_masked_int64_reverse,1024,8192,8,old_group_serial,0.538292,0.183375,0.053583,368640,8,1,0,0.210333,2,pass,0.538292;0.518041
-random_masked_int64_reverse,1024,8192,8,old_pull_parallel_dag,0.232041,0.168375,0.031917,524288,8,1,0,0.210333,2,pass,0.232041;0.227625
-random_masked_int64_reverse,1024,8192,8,old_group_parallel_dag,0.282750,0.205292,0.053625,368640,8,1,0,0.210333,2,pass,0.257500;0.282750
-random_masked_int64_reverse,1024,8192,8,pull64_barrier,0.223709,0.158792,0.028750,524288,8,1,0,0.210333,2,pass,0.223709;0.214000
-random_masked_int64_reverse,1024,8192,8,pull64_interleaved,0.810750,0.752583,0.028875,524288,8,1,0,0.210333,2,pass,0.569833;0.810750
-random_masked_int64_reverse,1024,8192,8,pull32_interleaved,0.775500,0.697875,0.028875,524288,8,1,1,0.210333,2,pass,0.721208;0.775500
-random_masked_int64_reverse,1024,8192,8,pull32_gpu_dag,1.021792,0.675417,0.051667,524288,8,3,1,0.210333,2,pass,0.982083;1.021792
-random_masked_int64_reverse,1024,8192,8,frontier32_vertex,0.277333,0.223500,0.029000,524288,8,1,1,0.210333,2,pass,0.241625;0.277333
-random_masked_int64_reverse,1024,8192,8,frontier32_simd,0.243875,0.179000,0.028583,524288,8,1,1,0.210333,2,pass,0.243875;0.237500
-random_masked_int64_reverse,1024,8192,8,frontier32_gpu_dag,0.500167,0.189583,0.047458,524288,8,3,1,0.210333,2,pass,0.500167;0.488708
-random_masked_int64_reverse,1024,8192,8,bucket32_d4,0.236375,0.177042,0.028750,524288,8,1,1,0.210333,2,pass,0.228500;0.236375
-random_masked_int64_reverse,1024,8192,8,bucket32_d16,0.249125,0.192084,0.028625,524288,8,1,1,0.210333,2,pass,0.218500;0.249125
-random_masked_int64_reverse,1024,8192,8,bucket32_d64,0.335542,0.296125,0.028625,524288,8,1,1,0.210333,2,pass,0.240375;0.335542
-random,4096,32768,256,old_pull_serial,49.337625,12.467292,11.699833,201326592,24,3,0,0.540875,2,pass,48.524667;49.337625
-random,4096,32768,256,old_group_serial,49.802834,11.785459,10.993500,136544256,20,1,0,0.540875,2,pass,47.385167;49.802834
-random,4096,32768,256,old_pull_parallel_dag,19.919000,16.053916,14.734958,201326592,24,3,0,0.540875,2,pass,19.919000;15.861667
-random,4096,32768,256,old_group_parallel_dag,11.645708,7.757000,6.930917,136544256,20,1,0,0.540875,2,pass,11.483584;11.645708
-random,4096,32768,256,pull64_barrier,13.484083,9.335333,8.520750,201326592,24,3,0,0.540875,2,pass,13.484083;12.949500
-random,4096,32768,256,pull64_interleaved,90.054167,86.195000,8.617750,201326592,24,3,0,0.540875,2,pass,90.054167;86.703666
-random,4096,32768,256,pull32_interleaved,79.266000,75.508625,6.636458,201326592,24,3,0,0.540875,2,pass,78.284917;79.266000
-random,4096,32768,256,pull32_gpu_dag,98.656083,96.740417,7.475250,201326592,24,5,0,0.540875,2,pass,80.137083;98.656083
-random,4096,32768,256,frontier32_vertex,79.679042,75.814167,9.683000,19773312,24,3,0,0.540875,2,pass,79.679042;79.543375
-random,4096,32768,256,frontier32_simd,85.882083,82.195666,16.025708,20638048,24,3,0,0.540875,2,pass,85.882083;85.238500
-random,4096,32768,256,frontier32_gpu_dag,83.435958,80.312834,15.618542,20760840,24,5,0,0.540875,2,pass,79.330083;83.435958
-random,4096,32768,256,bucket32_d4,85.800500,82.027500,15.248208,8454032,72,9,0,0.540875,2,pass,85.800500;84.087875
-random,4096,32768,256,bucket32_d16,85.003125,81.021958,9.436334,9715464,48,6,0,0.540875,2,pass,79.442625;85.003125
-random,4096,32768,256,bucket32_d64,88.076375,84.327833,16.212208,18335896,24,3,0,0.540875,2,pass,88.076375;87.845292
-random,16384,131072,1,old_pull_serial,2.306125,1.628750,0.257125,3145728,24,3,0,1.669042,2,pass,2.306125;1.344208
-random,16384,131072,1,old_group_serial,6.196458,5.531125,5.320500,2359296,18,1,0,1.669042,2,pass,6.196458;5.822917
-random,16384,131072,1,old_pull_parallel_dag,0.998041,0.646917,0.200666,3145728,24,3,0,1.669042,2,pass,0.998041;0.985250
-random,16384,131072,1,old_group_parallel_dag,5.391875,5.119750,4.971208,2359296,18,1,0,1.669042,2,pass,5.391875;5.363250
-random,16384,131072,1,pull64_barrier,0.916583,0.623416,0.172917,3145728,24,3,0,1.669042,2,pass,0.916583;0.894583
-random,16384,131072,1,pull64_interleaved,0.941750,0.720250,0.172625,3145728,24,3,0,1.669042,2,pass,0.928459;0.941750
-random,16384,131072,1,pull32_interleaved,0.899875,0.689083,0.147708,3145728,24,3,0,1.669042,2,pass,0.899875;0.875000
-random,16384,131072,1,pull32_gpu_dag,1.075709,0.687333,0.166417,3145728,24,5,0,1.669042,2,pass,1.075709;1.058916
-random,16384,131072,1,frontier32_vertex,1.222458,0.879917,0.244208,377896,24,3,0,1.669042,2,pass,1.222458;1.058459
-random,16384,131072,1,frontier32_simd,1.140625,0.808417,0.237042,336576,24,3,0,1.669042,2,pass,1.036834;1.140625
-random,16384,131072,1,frontier32_gpu_dag,1.208625,0.863958,0.431667,336096,24,5,0,1.669042,2,pass,1.208625;1.090583
-random,16384,131072,1,bucket32_d4,1.975208,1.713916,0.650959,132024,56,7,0,1.669042,2,pass,1.928042;1.975208
-random,16384,131072,1,bucket32_d16,1.444792,1.120375,0.390458,148264,32,4,0,1.669042,2,pass,1.444792;1.338417
-random,16384,131072,1,bucket32_d64,1.217834,0.885958,0.336333,269064,24,3,0,1.669042,2,pass,1.217834;1.050000
-random,16384,131072,64,old_pull_serial,57.334750,14.082292,12.348333,201326592,24,3,0,1.645250,2,pass,57.334750;56.155875
-random,16384,131072,64,old_group_serial,53.978958,11.020083,10.026500,158203904,22,1,0,1.645250,2,pass,53.571042;53.978958
-random,16384,131072,64,old_pull_parallel_dag,16.908459,12.904958,11.456708,201326592,24,3,0,1.645250,2,pass,16.908459;16.703541
-random,16384,131072,64,old_group_parallel_dag,13.650125,9.371084,8.515875,158203904,22,1,0,1.645250,2,pass,13.650125;13.255167
-random,16384,131072,64,pull64_barrier,16.434583,11.461166,10.202375,201326592,24,3,0,1.645250,2,pass,16.434583;15.835125
-random,16384,131072,64,pull64_interleaved,77.366916,73.168167,2.877792,201326592,24,3,0,1.645250,2,pass,75.897916;77.366916
-random,16384,131072,64,pull32_interleaved,83.784041,79.621792,6.788625,201326592,24,3,0,1.645250,2,pass,83.784041;78.639667
-random,16384,131072,64,pull32_gpu_dag,75.935959,73.474041,7.671417,201326592,24,5,0,1.645250,2,pass,75.935959;75.331334
-random,16384,131072,64,frontier32_vertex,93.834292,88.800917,11.524583,21236872,24,3,0,1.645250,2,pass,80.318042;93.834292
-random,16384,131072,64,frontier32_simd,79.992292,75.712584,9.913500,21938424,24,3,0,1.645250,2,pass,79.992292;79.583166
-random,16384,131072,64,frontier32_gpu_dag,87.396667,84.738792,19.360333,21869744,24,5,0,1.645250,2,pass,79.213125;87.396667
-random,16384,131072,64,bucket32_d4,88.988834,84.024250,13.670625,8451432,72,9,0,1.645250,2,pass,88.988834;88.343833
-random,16384,131072,64,bucket32_d16,91.121792,86.761000,16.956541,9562072,48,6,0,1.645250,2,pass,91.121792;87.719000
-random,16384,131072,64,bucket32_d64,87.983750,83.874083,12.879167,17319032,24,3,0,1.645250,2,pass,87.983750;84.451458
-random,65536,524288,1,old_pull_serial,5.670625,2.852084,1.649333,12582912,24,3,0,7.477583,2,pass,5.572667;5.670625
-random,65536,524288,1,old_group_serial,31.835417,29.109750,28.416708,11534336,22,1,0,7.477583,2,pass,31.347666;31.835417
-random,65536,524288,1,old_pull_parallel_dag,3.276042,1.796917,0.846167,12582912,24,3,0,7.477583,2,pass,3.224125;3.276042
-random,65536,524288,1,old_group_parallel_dag,30.395334,28.999000,28.296250,11534336,22,1,0,7.477583,2,pass,30.395334;29.813041
-random,65536,524288,1,pull64_barrier,3.316500,1.854167,0.802250,12582912,24,3,0,7.477583,2,pass,3.150584;3.316500
-random,65536,524288,1,pull64_interleaved,3.792375,2.321250,0.784542,12582912,24,3,0,7.477583,2,pass,3.740834;3.792375
-random,65536,524288,1,pull32_interleaved,3.664250,2.216250,0.642667,12582912,24,3,0,7.477583,2,pass,3.664250;3.619208
-random,65536,524288,1,pull32_gpu_dag,1.946833,1.440542,0.574292,12582912,24,5,0,7.477583,2,pass,1.807458;1.946833
-random,65536,524288,1,frontier32_vertex,3.540500,2.012917,0.603250,1743784,24,3,0,7.477583,2,pass,3.064458;3.540500
-random,65536,524288,1,frontier32_simd,3.527958,2.002208,0.598125,1562256,24,3,0,7.477583,2,pass,3.527958;3.485750
-random,65536,524288,1,frontier32_gpu_dag,2.079917,1.688458,0.682125,1566928,24,5,0,7.477583,2,pass,2.079917;2.025916
-random,65536,524288,1,bucket32_d4,4.803667,3.281125,1.170083,528256,64,8,0,7.477583,2,pass,4.803667;4.388583
-random,65536,524288,1,bucket32_d16,3.979417,2.442791,0.794417,599384,40,5,0,7.477583,2,pass,3.611333;3.979417
-random,65536,524288,1,bucket32_d64,3.852667,2.205292,0.729333,1050680,24,3,0,7.477583,2,pass,3.614333;3.852667
-clos,800,320000,1,old_pull_serial,2.370625,1.339417,0.724000,2560000,8,1,0,3.496583,2,pass,2.324166;2.370625
-clos,800,320000,1,old_group_serial,2.508750,1.566834,0.924167,960000,3,1,0,3.496583,2,pass,2.038208;2.508750
-clos,800,320000,1,old_pull_parallel_dag,2.127417,1.358375,0.732417,2560000,8,1,0,3.496583,2,pass,2.127417;2.063958
-clos,800,320000,1,old_group_parallel_dag,2.450875,1.688250,1.007875,960000,3,1,0,3.496583,2,pass,2.450875;2.436166
-clos,800,320000,1,pull64_barrier,2.201333,1.408125,0.657125,2560000,8,1,0,3.496583,2,pass,2.201333;1.657750
-clos,800,320000,1,pull64_interleaved,2.063084,1.323375,0.640458,2560000,8,1,0,3.496583,2,pass,2.063084;2.047459
-clos,800,320000,1,pull32_interleaved,1.952042,1.171375,0.556000,2560000,8,1,0,3.496583,2,pass,1.952042;1.436667
-clos,800,320000,1,pull32_gpu_dag,2.170625,1.323375,1.010542,2560000,8,3,0,3.496583,2,pass,2.143209;2.170625
-clos,800,320000,1,frontier32_vertex,2.447125,1.644417,0.968083,320000,8,1,0,3.496583,2,pass,2.447125;2.101167
-clos,800,320000,1,frontier32_simd,1.531125,0.705500,0.095500,320000,8,1,0,3.496583,2,pass,1.531125;1.476083
-clos,800,320000,1,frontier32_gpu_dag,1.652708,0.837417,0.614917,320000,8,3,0,3.496583,2,pass,1.652708;1.008292
-clos,800,320000,1,bucket32_d4,1.741958,0.940916,0.191500,320000,8,1,0,3.496583,2,pass,1.622708;1.741958
-clos,800,320000,1,bucket32_d16,1.637250,0.860458,0.177750,320000,8,1,0,3.496583,2,pass,1.618125;1.637250
-clos,800,320000,1,bucket32_d64,1.648416,0.862959,0.200083,320000,8,1,0,3.496583,2,pass,1.648416;1.564459
-clos,800,320000,64,old_pull_serial,84.010917,20.151750,19.591375,163840000,8,1,0,3.460875,2,pass,79.696125;84.010917
-clos,800,320000,64,old_group_serial,70.853292,5.869375,5.387125,61440000,3,1,0,3.460875,2,pass,70.853292;69.814500
-clos,800,320000,64,old_pull_parallel_dag,25.874292,18.861542,18.216250,163840000,8,1,0,3.460875,2,pass,25.874292;23.185041
-clos,800,320000,64,old_group_parallel_dag,12.892292,5.977542,5.445750,61440000,3,1,0,3.460875,2,pass,12.794500;12.892292
-clos,800,320000,64,pull64_barrier,28.435834,21.288833,20.666500,163840000,8,1,0,3.460875,2,pass,23.741583;28.435834
-clos,800,320000,64,pull64_interleaved,17.237125,10.007500,6.063250,163840000,8,1,0,3.460875,2,pass,17.237125;17.069959
-clos,800,320000,64,pull32_interleaved,15.469333,8.212958,3.644584,163840000,8,1,0,3.460875,2,pass,14.657250;15.469333
-clos,800,320000,64,pull32_gpu_dag,12.177917,8.063667,6.185208,163840000,8,3,0,3.460875,2,pass,11.646000;12.177917
-clos,800,320000,64,frontier32_vertex,17.391792,10.431791,6.175083,20480000,8,1,0,3.460875,2,pass,17.200042;17.391792
-clos,800,320000,64,frontier32_simd,13.298500,6.201125,1.491583,20480000,8,1,0,3.460875,2,pass,11.929792;13.298500
-clos,800,320000,64,frontier32_gpu_dag,11.460292,5.960000,5.538625,20480000,8,3,0,3.460875,2,pass,10.272375;11.460292
-clos,800,320000,64,bucket32_d4,13.275834,6.647167,1.969875,20480000,8,1,0,3.460875,2,pass,13.145500;13.275834
-clos,800,320000,64,bucket32_d16,13.277042,5.984208,1.809625,20480000,8,1,0,3.460875,2,pass,13.277042;12.978417
-clos,800,320000,64,bucket32_d64,12.781000,5.587375,1.800917,20480000,8,1,0,3.460875,2,pass,12.781000;11.775459
-grid,10000,39600,1,old_pull_serial,6.308667,6.189375,2.474124,7920000,200,25,0,0.484791,2,pass,6.174667;6.308667
-grid,10000,39600,1,old_group_serial,7.964459,7.841209,7.579834,7880400,199,1,0,0.484791,2,pass,7.915500;7.964459
-grid,10000,39600,1,old_pull_parallel_dag,4.204917,4.140000,0.606917,7920000,200,25,0,0.484791,2,pass,4.204917;4.148666
-grid,10000,39600,1,old_group_parallel_dag,7.780208,7.685250,7.526250,7880400,199,1,0,0.484791,2,pass,7.773042;7.780208
-grid,10000,39600,1,pull64_barrier,3.893333,3.823000,0.630791,7920000,200,25,0,0.484791,2,pass,3.893333;3.591125
-grid,10000,39600,1,pull64_interleaved,4.129958,4.070667,0.852458,7920000,200,25,0,0.484791,2,pass,4.129958;4.114666
-grid,10000,39600,1,pull32_interleaved,4.162917,4.100792,0.642917,7920000,200,25,0,0.484791,2,pass,3.970334;4.162917
-grid,10000,39600,1,pull32_gpu_dag,4.198666,3.912834,0.646082,7920000,200,27,0,0.484791,2,pass,4.198666;3.817750
-grid,10000,39600,1,frontier32_vertex,5.159500,5.099500,1.914417,39600,200,25,0,0.484791,2,pass,5.159500;5.099333
-grid,10000,39600,1,frontier32_simd,4.911583,4.852292,1.346042,39600,200,25,0,0.484791,2,pass,4.688917;4.911583
-grid,10000,39600,1,frontier32_gpu_dag,5.137208,4.800875,1.375291,39600,200,27,0,0.484791,2,pass,5.102334;5.137208
-grid,10000,39600,1,bucket32_d4,6.035708,5.976458,2.449416,39600,200,25,0,0.484791,2,pass,6.035708;5.789417
-grid,10000,39600,1,bucket32_d16,5.723333,5.664083,2.392000,39600,200,25,0,0.484791,2,pass,5.497666;5.723333
-grid,10000,39600,1,bucket32_d64,6.215667,6.141917,2.437126,39600,200,25,0,0.484791,2,pass,5.774834;6.215667
-grid,10000,39600,8,old_pull_serial,6.342000,5.328667,1.417540,63360000,200,25,0,0.487626,2,pass,6.342000;6.058000
-grid,10000,39600,8,old_group_serial,9.010166,8.094333,7.525375,51480000,199,1,0,0.487626,2,pass,8.645000;9.010166
-grid,10000,39600,8,old_pull_parallel_dag,5.092541,4.901084,1.396958,63360000,200,25,0,0.487626,2,pass,5.022958;5.092541
-grid,10000,39600,8,old_group_parallel_dag,7.914250,7.706834,7.497542,51480000,199,1,0,0.487626,2,pass,7.893583;7.914250
-grid,10000,39600,8,pull64_barrier,5.068458,4.899667,1.411666,63360000,200,25,0,0.487626,2,pass,4.946417;5.068458
-grid,10000,39600,8,pull64_interleaved,10.357083,10.106334,1.521750,63360000,200,25,0,0.487626,2,pass,10.357083;10.304375
-grid,10000,39600,8,pull32_interleaved,11.089083,10.845167,1.357125,63360000,200,25,0,0.487626,2,pass,11.089083;10.573500
-grid,10000,39600,8,pull32_gpu_dag,10.887416,10.004708,1.333043,63360000,200,27,0,0.487626,2,pass,9.630375;10.887416
-grid,10000,39600,8,frontier32_vertex,10.730792,10.477209,1.984625,316800,200,25,0,0.487626,2,pass,10.730792;10.719541
-grid,10000,39600,8,frontier32_simd,10.836875,10.634917,1.851000,316800,200,25,0,0.487626,2,pass,10.836875;10.763708
-grid,10000,39600,8,frontier32_gpu_dag,10.641500,9.760208,1.575917,316800,200,27,0,0.487626,2,pass,10.641500;10.630333
-grid,10000,39600,8,bucket32_d4,13.203375,13.062583,3.960125,316800,200,25,0,0.487626,2,pass,13.203375;13.027500
-grid,10000,39600,8,bucket32_d16,12.623292,12.421500,3.885626,316800,200,25,0,0.487626,2,pass,12.198958;12.623292
-grid,10000,39600,8,bucket32_d64,13.461542,13.314167,3.911709,316800,200,25,0,0.487626,2,pass,13.461542;13.151334
-chain,2048,2047,1,old_pull_serial,31.251584,31.241000,4.493376,4192256,2048,256,0,0.124208,2,pass,29.572958;31.251584
-chain,2048,2047,1,old_group_serial,4.872125,4.846917,4.704000,4192256,2048,1,0,0.124208,2,pass,4.872125;4.816000
-chain,2048,2047,1,old_pull_parallel_dag,30.364166,30.357500,4.342086,4192256,2048,256,0,0.124208,2,pass,30.364166;29.797667
-chain,2048,2047,1,old_group_parallel_dag,4.862500,4.841709,4.696458,4192256,2048,1,0,0.124208,2,pass,4.821792;4.862500
-chain,2048,2047,1,pull64_barrier,31.394625,31.387958,5.149665,4192256,2048,256,0,0.124208,2,pass,31.394625;30.564667
-chain,2048,2047,1,pull64_interleaved,30.923291,30.917667,5.045705,4192256,2048,256,0,0.124208,2,pass,30.342292;30.923291
-chain,2048,2047,1,pull32_interleaved,30.950333,30.944750,5.049085,4192256,2048,256,0,0.124208,2,pass,30.950333;29.343292
-chain,2048,2047,1,pull32_gpu_dag,29.144625,28.787459,4.978918,4192256,2048,258,0,0.124208,2,pass,28.863709;29.144625
-chain,2048,2047,1,frontier32_vertex,54.826625,54.820042,27.490289,2047,2048,256,0,0.124208,2,pass,54.826625;43.290458
-chain,2048,2047,1,frontier32_simd,40.021500,40.015625,13.131166,2047,2048,256,0,0.124208,2,pass,40.021500;38.506333
-chain,2048,2047,1,frontier32_gpu_dag,39.300791,38.996459,12.897914,2047,2048,258,0,0.124208,2,pass,39.067750;39.300791
-chain,2048,2047,1,bucket32_d4,49.432875,49.426375,21.049543,2047,2056,257,0,0.124208,2,pass,47.271833;49.432875
-chain,2048,2047,1,bucket32_d16,109.948875,109.939375,79.102456,2047,2056,257,0,0.124208,2,pass,88.977000;109.948875
-chain,2048,2047,1,bucket32_d64,48.930458,48.922542,21.087253,2047,2056,257,0,0.124208,2,pass,48.352792;48.930458
-hub,4096,12286,64,old_pull_serial,35.106833,32.332625,30.932625,31452160,40,5,0,0.332584,2,pass,34.652083;35.106833
-hub,4096,12286,64,old_group_serial,28.499792,25.765708,25.115500,27176632,38,1,0,0.332584,2,pass,28.499792;28.071959
-hub,4096,12286,64,old_pull_parallel_dag,33.417042,32.452917,30.979041,31452160,40,5,0,0.332584,2,pass,33.417042;32.831750
-hub,4096,12286,64,old_group_parallel_dag,26.387625,26.007666,25.172542,27176632,38,1,0,0.332584,2,pass,26.018208;26.387625
-hub,4096,12286,64,pull64_barrier,25.788459,25.342083,23.820209,31452160,40,5,0,0.332584,2,pass,25.166291;25.788459
-hub,4096,12286,64,pull64_interleaved,49.636291,49.303542,31.618167,31452160,40,5,0,0.332584,2,pass,49.126041;49.636291
-hub,4096,12286,64,pull32_interleaved,45.148542,44.768041,27.223375,31452160,40,5,0,0.332584,2,pass,44.485166;45.148542
-hub,4096,12286,64,pull32_gpu_dag,47.747125,44.786709,29.190750,31452160,40,7,0,0.332584,2,pass,47.409125;47.747125
-hub,4096,12286,64,frontier32_vertex,36.510167,36.094917,18.531458,1872372,40,5,0,0.332584,2,pass,35.063875;36.510167
-hub,4096,12286,64,frontier32_simd,22.199209,21.820333,1.906625,1683322,40,5,0,0.332584,2,pass,22.199209;22.001000
-hub,4096,12286,64,frontier32_gpu_dag,25.051625,21.600917,4.480042,1683264,40,7,0,0.332584,2,pass,25.051625;24.298250
-hub,4096,12286,64,bucket32_d4,25.343542,24.950084,2.969750,788342,48,6,0,0.332584,2,pass,23.476292;25.343542
-hub,4096,12286,64,bucket32_d16,26.631250,26.198042,3.176833,1124810,48,6,0,0.332584,2,pass,26.631250;23.371583
-hub,4096,12286,64,bucket32_d64,25.833834,25.465917,5.076166,1913530,40,5,0,0.332584,2,pass,24.307000;25.833834
-random,4096,131072,1,old_pull_serial,1.648541,1.149500,0.571458,2097152,16,2,0,1.680791,2,pass,1.648541;1.249209
-random,4096,131072,1,old_group_serial,6.351458,5.917417,5.756042,1572864,12,1,0,1.680791,2,pass,6.351458;6.022333
-random,4096,131072,1,old_pull_parallel_dag,0.933000,0.714709,0.452875,2097152,16,2,0,1.680791,2,pass,0.933000;0.886000
-random,4096,131072,1,old_group_parallel_dag,4.209167,4.007625,3.836334,1572864,12,1,0,1.680791,2,pass,4.209167;3.968750
-random,4096,131072,1,pull64_barrier,0.788792,0.602917,0.327542,2097152,16,2,0,1.680791,2,pass,0.788792;0.780500
-random,4096,131072,1,pull64_interleaved,0.789375,0.596625,0.286000,2097152,16,2,0,1.680791,2,pass,0.789375;0.764042
-random,4096,131072,1,pull32_interleaved,0.754708,0.581125,0.278500,2097152,16,2,0,1.680791,2,pass,0.754708;0.704625
-random,4096,131072,1,pull32_gpu_dag,0.969125,0.573500,0.317292,2097152,16,4,0,1.680791,2,pass,0.969125;0.835333
-random,4096,131072,1,frontier32_vertex,0.959750,0.784708,0.448417,421824,16,2,0,1.680791,2,pass,0.959750;0.883166
-random,4096,131072,1,frontier32_simd,0.613042,0.433500,0.165208,388160,16,2,0,1.680791,2,pass,0.602375;0.613042
-random,4096,131072,1,frontier32_gpu_dag,0.792875,0.454500,0.215166,392576,16,4,0,1.680791,2,pass,0.792875;0.771708
-random,4096,131072,1,bucket32_d4,0.948833,0.779541,0.322375,138784,24,3,0,1.680791,2,pass,0.907583;0.948833
-random,4096,131072,1,bucket32_d16,0.668875,0.487292,0.205875,177152,16,2,0,1.680791,2,pass,0.668875;0.664958
-random,4096,131072,1,bucket32_d64,0.704125,0.522375,0.236958,387040,16,2,0,1.680791,2,pass,0.704125;0.692375
-random,4096,131072,64,old_pull_serial,39.707625,10.664917,9.875917,134217728,16,2,0,1.785041,2,pass,39.707625;38.615750
-random,4096,131072,64,old_group_serial,34.620125,5.432459,4.809875,105644032,15,1,0,1.785041,2,pass,33.889416;34.620125
-random,4096,131072,64,old_pull_parallel_dag,13.925708,11.805375,11.350958,134217728,16,2,0,1.785041,2,pass,13.718500;13.925708
-random,4096,131072,64,old_group_parallel_dag,6.589500,4.478333,3.871625,105644032,15,1,0,1.785041,2,pass,6.210000;6.589500
-random,4096,131072,64,pull64_barrier,11.746500,9.527458,8.613667,134217728,16,2,0,1.785041,2,pass,11.549875;11.746500
-random,4096,131072,64,pull64_interleaved,23.944917,21.617000,1.407083,134217728,16,2,0,1.785041,2,pass,23.944917;23.816000
-random,4096,131072,64,pull32_interleaved,24.723167,22.521417,2.845166,134217728,16,2,0,1.785041,2,pass,23.098042;24.723167
-random,4096,131072,64,pull32_gpu_dag,23.908541,22.219333,3.848333,134217728,16,4,0,1.785041,2,pass,23.908541;23.375417
-random,4096,131072,64,frontier32_vertex,27.957250,25.638000,4.482417,22831904,16,2,0,1.785041,2,pass,25.895125;27.957250
-random,4096,131072,64,frontier32_simd,30.802708,28.372875,8.748375,23054048,16,2,0,1.785041,2,pass,30.802708;30.681708
-random,4096,131072,64,frontier32_gpu_dag,30.596834,28.276833,5.482458,22947328,16,4,0,1.785041,2,pass,26.060875;30.596834
-random,4096,131072,64,bucket32_d4,28.980292,26.791458,7.614083,8805280,24,3,0,1.785041,2,pass,27.958958;28.980292
-random,4096,131072,64,bucket32_d16,25.097334,22.833958,2.722333,12090432,24,3,0,1.785041,2,pass,24.775834;25.097334
-random,4096,131072,64,bucket32_d64,29.428333,27.258291,7.370167,23020448,16,2,0,1.785041,2,pass,25.965250;29.428333
diff --git a/dev/research/metal_pathfinding/optimization/results/smoke-stderr.txt b/dev/research/metal_pathfinding/optimization/results/smoke-stderr.txt
deleted file mode 100644
index 4b20dd4..0000000
--- a/dev/research/metal_pathfinding/optimization/results/smoke-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=52.7973 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/smoke.csv b/dev/research/metal_pathfinding/optimization/results/smoke.csv
deleted file mode 100644
index b8c1539..0000000
--- a/dev/research/metal_pathfinding/optimization/results/smoke.csv
+++ /dev/null
@@ -1,85 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-random,1024,8192,1,old_pull_serial,0.690458,0.660208,0.399041,131072,16,2,0,0.232500,2,pass,0.690458;0.689292
-random,1024,8192,1,old_group_serial,0.918750,0.867792,0.684042,106496,13,1,0,0.232500,2,pass,0.918750;0.902958
-random,1024,8192,1,old_pull_parallel_dag,0.673667,0.658667,0.400125,131072,16,2,0,0.232500,2,pass,0.639000;0.673667
-random,1024,8192,1,old_group_parallel_dag,1.662917,1.644542,1.504458,106496,13,1,0,0.232500,2,pass,0.902583;1.662917
-random,1024,8192,1,pull64_barrier,0.635417,0.619083,0.358833,131072,16,2,0,0.232500,2,pass,0.635417;0.632209
-random,1024,8192,1,pull64_interleaved,0.691458,0.679500,0.358958,131072,16,2,0,0.232500,2,pass,0.662083;0.691458
-random,1024,8192,1,pull32_interleaved,1.027750,1.003250,0.736542,131072,16,2,0,0.232500,2,pass,1.027750;0.623042
-random,1024,8192,1,pull32_gpu_dag,0.965041,0.565708,0.383500,131072,16,4,0,0.232500,2,pass,0.965041;0.958458
-random,1024,8192,1,frontier32_vertex,1.215292,1.191917,0.921042,21088,16,2,0,0.232500,2,pass,1.215292;0.914417
-random,1024,8192,1,frontier32_simd,0.681375,0.663166,0.368917,20584,16,2,0,0.232500,2,pass,0.664417;0.681375
-random,1024,8192,1,frontier32_gpu_dag,1.127209,0.667792,0.435167,20512,16,4,0,0.232500,2,pass,1.127209;1.085459
-random,1024,8192,1,bucket32_d4,1.810625,1.790333,1.195875,8232,32,4,0,0.232500,2,pass,1.810625;1.789042
-random,1024,8192,1,bucket32_d16,1.298167,1.276541,0.864125,9344,24,3,0,0.232500,2,pass,1.281583;1.298167
-random,1024,8192,1,bucket32_d64,1.120875,1.108042,0.831375,19360,16,2,0,0.232500,2,pass,0.931625;1.120875
-random,1024,8192,64,old_pull_serial,4.363541,2.058709,1.582042,12582912,24,3,0,0.201166,2,pass,4.193209;4.363541
-random,1024,8192,64,old_group_serial,3.589666,1.344042,0.896042,7217152,17,1,0,0.201166,2,pass,3.573459;3.589666
-random,1024,8192,64,old_pull_parallel_dag,2.498625,2.249166,1.710833,12582912,24,3,0,0.201166,2,pass,2.332167;2.498625
-random,1024,8192,64,old_group_parallel_dag,1.373667,1.088042,0.889625,7217152,17,1,0,0.201166,2,pass,1.303750;1.373667
-random,1024,8192,64,pull64_barrier,2.200500,1.807125,1.382208,12582912,24,3,0,0.201166,2,pass,2.078292;2.200500
-random,1024,8192,64,pull64_interleaved,7.077875,6.808541,0.838292,12582912,24,3,0,0.201166,2,pass,7.077875;6.882042
-random,1024,8192,64,pull32_interleaved,6.222875,5.941417,0.684333,12582912,24,3,0,0.201166,2,pass,6.222875;6.170417
-random,1024,8192,64,pull32_gpu_dag,6.617083,5.848167,0.776542,12582912,24,5,0,0.201166,2,pass,6.617083;6.270000
-random,1024,8192,64,frontier32_vertex,6.192417,5.928291,0.991125,1294232,16,2,0,0.201166,2,pass,6.192417;5.873375
-random,1024,8192,64,frontier32_simd,7.073209,6.830167,1.888250,1209320,16,2,0,0.201166,2,pass,7.073209;6.179000
-random,1024,8192,64,frontier32_gpu_dag,7.573000,6.650750,2.009833,1200408,24,5,0,0.201166,2,pass,7.079666;7.573000
-random,1024,8192,64,bucket32_d4,7.151083,6.905833,1.128250,528520,56,7,0,0.201166,2,pass,7.096250;7.151083
-random,1024,8192,64,bucket32_d16,8.154791,7.893041,2.916583,601624,32,4,0,0.201166,2,pass,6.179417;8.154791
-random,1024,8192,64,bucket32_d64,8.615208,8.365000,3.017708,1152992,24,3,0,0.201166,2,pass,8.615208;7.997125
-clos,200,20000,64,old_pull_serial,5.706792,1.619292,1.043833,10240000,8,1,0,0.331916,2,pass,5.189416;5.706792
-clos,200,20000,64,old_group_serial,4.762833,0.842625,0.300750,3840000,3,1,0,0.331916,2,pass,4.762833;4.495333
-clos,200,20000,64,old_pull_parallel_dag,2.005375,1.468625,0.997625,10240000,8,1,0,0.331916,2,pass,2.005375;1.994625
-clos,200,20000,64,old_group_parallel_dag,1.347666,0.814917,0.300333,3840000,3,1,0,0.331916,2,pass,1.347666;1.050958
-clos,200,20000,64,pull64_barrier,2.337291,1.777542,1.019500,10240000,8,1,0,0.331916,2,pass,1.953625;2.337291
-clos,200,20000,64,pull64_interleaved,3.083042,2.474250,0.781917,10240000,8,1,0,0.331916,2,pass,3.083042;2.732916
-clos,200,20000,64,pull32_interleaved,3.211083,2.578416,0.691917,10240000,8,1,0,0.331916,2,pass,3.045292;3.211083
-clos,200,20000,64,pull32_gpu_dag,3.605125,2.331708,1.013250,10240000,8,3,0,0.331916,2,pass,3.605125;3.307625
-clos,200,20000,64,frontier32_vertex,3.004000,2.469083,0.974750,1280000,8,1,0,0.331916,2,pass,3.001875;3.004000
-clos,200,20000,64,frontier32_simd,2.437875,1.916541,0.362875,1280000,8,1,0,0.331916,2,pass,2.306875;2.437875
-clos,200,20000,64,frontier32_gpu_dag,2.945625,1.741792,0.670125,1280000,8,3,0,0.331916,2,pass,2.945625;2.463542
-clos,200,20000,64,bucket32_d4,2.549875,1.939375,0.487125,1280000,8,1,0,0.331916,2,pass,2.549875;2.447583
-clos,200,20000,64,bucket32_d16,2.159458,1.592041,0.524500,1280000,8,1,0,0.331916,2,pass,2.159458;2.139791
-clos,200,20000,64,bucket32_d64,3.199500,2.611750,0.527125,1280000,8,1,0,0.331916,2,pass,3.199500;2.366292
-grid,1024,3968,1,old_pull_serial,2.712167,2.696750,0.686625,253952,64,8,0,0.145582,2,pass,1.828792;2.712167
-grid,1024,3968,1,old_group_serial,1.282709,1.231000,1.012083,249984,63,1,0,0.145582,2,pass,1.229667;1.282709
-grid,1024,3968,1,old_pull_parallel_dag,1.768000,1.760166,0.187833,253952,64,8,0,0.145582,2,pass,1.345583;1.768000
-grid,1024,3968,1,old_group_parallel_dag,0.379875,0.371959,0.246208,249984,63,1,0,0.145582,2,pass,0.375625;0.379875
-grid,1024,3968,1,pull64_barrier,1.375250,1.367250,0.203750,253952,64,8,0,0.145582,2,pass,1.375250;1.315375
-grid,1024,3968,1,pull64_interleaved,1.326333,1.318167,0.201750,253952,64,8,0,0.145582,2,pass,1.326333;1.325542
-grid,1024,3968,1,pull32_interleaved,1.246292,1.237417,0.182542,253952,64,8,0,0.145582,2,pass,1.236292;1.246292
-grid,1024,3968,1,pull32_gpu_dag,1.628458,1.292333,0.202959,253952,64,10,0,0.145582,2,pass,1.628458;1.429875
-grid,1024,3968,1,frontier32_vertex,1.779750,1.772042,0.598750,3968,64,8,0,0.145582,2,pass,1.779750;1.696375
-grid,1024,3968,1,frontier32_simd,1.476417,1.468625,0.426625,3968,64,8,0,0.145582,2,pass,1.450834;1.476417
-grid,1024,3968,1,frontier32_gpu_dag,1.915375,1.583917,0.483375,3968,64,10,0,0.145582,2,pass,1.723792;1.915375
-grid,1024,3968,1,bucket32_d4,1.720042,1.711833,0.662750,3968,64,8,0,0.145582,2,pass,1.720042;1.676791
-grid,1024,3968,1,bucket32_d16,1.843500,1.835583,0.718250,3968,64,8,0,0.145582,2,pass,1.821583;1.843500
-grid,1024,3968,1,bucket32_d64,1.747583,1.739750,0.714041,3968,64,8,0,0.145582,2,pass,1.747583;1.700250
-hub,1024,3070,1,old_pull_serial,6.406708,6.369959,5.576208,98240,32,4,0,0.121500,2,pass,6.406708;6.319083
-hub,1024,3070,1,old_group_serial,5.014500,4.975250,4.745417,95170,31,1,0,0.121500,2,pass,5.014500;4.864000
-hub,1024,3070,1,old_pull_parallel_dag,6.516958,6.485750,5.764334,98240,32,4,0,0.121500,2,pass,6.261500;6.516958
-hub,1024,3070,1,old_group_parallel_dag,4.937042,4.912500,4.720833,95170,31,1,0,0.121500,2,pass,4.937042;4.885708
-hub,1024,3070,1,pull64_barrier,5.041500,5.016791,4.333042,98240,32,4,0,0.121500,2,pass,5.041500;5.025125
-hub,1024,3070,1,pull64_interleaved,5.097541,5.075000,4.344125,98240,32,4,0,0.121500,2,pass,5.097541;5.007375
-hub,1024,3070,1,pull32_interleaved,4.423209,4.413792,3.648959,98240,32,4,0,0.121500,2,pass,4.343750;4.423209
-hub,1024,3070,1,pull32_gpu_dag,5.119000,4.303000,4.076750,98240,32,6,0,0.121500,2,pass,4.981959;5.119000
-hub,1024,3070,1,frontier32_vertex,1.454292,1.445750,0.863709,3128,32,4,0,0.121500,2,pass,1.454292;1.402708
-hub,1024,3070,1,frontier32_simd,0.815875,0.807209,0.231791,3128,32,4,0,0.121500,2,pass,0.704792;0.815875
-hub,1024,3070,1,frontier32_gpu_dag,1.425708,0.726500,0.648833,3128,32,6,0,0.121500,2,pass,1.425708;1.421167
-hub,1024,3070,1,bucket32_d4,0.915708,0.906917,0.349667,3100,32,4,0,0.121500,2,pass,0.915708;0.836708
-hub,1024,3070,1,bucket32_d16,0.854042,0.845583,0.341000,3124,32,4,0,0.121500,2,pass,0.854042;0.837125
-hub,1024,3070,1,bucket32_d64,0.919958,0.911708,0.330000,3128,32,4,0,0.121500,2,pass,0.833583;0.919958
-random_masked_int64_reverse,1024,8192,8,old_pull_serial,0.575416,0.149542,0.031709,524288,8,1,0,0.203249,2,pass,0.575416;0.490708
-random_masked_int64_reverse,1024,8192,8,old_group_serial,0.507083,0.169958,0.053625,368640,8,1,0,0.203249,2,pass,0.507083;0.506209
-random_masked_int64_reverse,1024,8192,8,old_pull_parallel_dag,0.247417,0.183833,0.031917,524288,8,1,0,0.203249,2,pass,0.218750;0.247417
-random_masked_int64_reverse,1024,8192,8,old_group_parallel_dag,0.238708,0.178333,0.053625,368640,8,1,0,0.203249,2,pass,0.238708;0.229958
-random_masked_int64_reverse,1024,8192,8,pull64_barrier,0.242750,0.191708,0.028667,524288,8,1,0,0.203249,2,pass,0.242750;0.241417
-random_masked_int64_reverse,1024,8192,8,pull64_interleaved,0.806791,0.743125,0.028792,524288,8,1,0,0.203249,2,pass,0.614583;0.806791
-random_masked_int64_reverse,1024,8192,8,pull32_interleaved,0.789459,0.709250,0.028875,524288,8,1,1,0.203249,2,pass,0.789459;0.766166
-random_masked_int64_reverse,1024,8192,8,pull32_gpu_dag,0.975416,0.636041,0.051958,524288,8,3,1,0.203249,2,pass,0.955750;0.975416
-random_masked_int64_reverse,1024,8192,8,frontier32_vertex,0.243542,0.194917,0.029083,524288,8,1,1,0.203249,2,pass,0.240709;0.243542
-random_masked_int64_reverse,1024,8192,8,frontier32_simd,0.286791,0.227750,0.028625,524288,8,1,1,0.203249,2,pass,0.286791;0.234208
-random_masked_int64_reverse,1024,8192,8,frontier32_gpu_dag,0.494750,0.178541,0.046917,524288,8,3,1,0.203249,2,pass,0.468250;0.494750
-random_masked_int64_reverse,1024,8192,8,bucket32_d4,0.255792,0.205375,0.028875,524288,8,1,1,0.203249,2,pass,0.232625;0.255792
-random_masked_int64_reverse,1024,8192,8,bucket32_d16,0.242333,0.199541,0.028667,524288,8,1,1,0.203249,2,pass,0.242333;0.225833
-random_masked_int64_reverse,1024,8192,8,bucket32_d64,0.244958,0.195000,0.028875,524288,8,1,1,0.203249,2,pass,0.231417;0.244958
diff --git a/dev/research/metal_pathfinding/optimization/results/stress-sanitized-stderr.txt b/dev/research/metal_pathfinding/optimization/results/stress-sanitized-stderr.txt
deleted file mode 100644
index ecd2dc4..0000000
--- a/dev/research/metal_pathfinding/optimization/results/stress-sanitized-stderr.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-2026-09-27 00:31:10.901 optimized-sanitize[19987:38715567] Metal API Validation Enabled
-2026-09-27 00:31:10.902 optimized-sanitize[19987:38715567] Metal GPU Validation Enabled
-device=Apple M4 Max setup_ms=33.4889 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/stress-sanitized.csv b/dev/research/metal_pathfinding/optimization/results/stress-sanitized.csv
deleted file mode 100644
index 868411d..0000000
--- a/dev/research/metal_pathfinding/optimization/results/stress-sanitized.csv
+++ /dev/null
@@ -1,29 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-grid,1024,3968,64,old_pull_serial,15.422459,8.780792,4.421000,16252928,64,8,0,0.355707,3,pass,15.767625;12.079667;15.422459
-grid,1024,3968,64,old_group_serial,11.820416,4.917041,3.918292,12066688,63,1,0,0.355707,3,pass,11.266000;11.991708;11.820416
-grid,1024,3968,64,old_pull_parallel_dag,9.401541,8.708916,4.336000,16252928,64,8,0,0.355707,3,pass,5.894791;10.034959;9.401541
-grid,1024,3968,64,old_group_parallel_dag,3.223291,2.277167,1.718958,12066688,63,1,0,0.355707,3,pass,3.223291;6.094583;2.753959
-grid,1024,3968,64,pull64_barrier,9.744500,8.889250,4.838625,16252928,64,8,0,0.355707,3,pass,5.471708;9.744500;9.802958
-grid,1024,3968,64,pull64_interleaved,8.179959,7.435500,3.227125,16252928,64,8,0,0.355707,3,pass,8.179959;9.998542;5.224125
-grid,1024,3968,64,pull32_interleaved,6.581875,4.865416,1.325542,16252928,64,8,0,0.355707,3,pass,5.519000;9.256834;6.581875
-grid,1024,3968,64,pull32_gpu_dag,9.064958,7.880250,4.344791,16252928,64,10,0,0.355707,3,pass,9.542542;5.143375;9.064958
-grid,1024,3968,64,frontier32_vertex,6.553083,5.827417,1.606209,253952,64,8,0,0.355707,3,pass,6.535333;10.212125;6.553083
-grid,1024,3968,64,frontier32_simd,6.107459,5.438333,1.547667,253952,64,8,0,0.355707,3,pass,6.107459;10.554250;5.719167
-grid,1024,3968,64,frontier32_gpu_dag,9.948333,8.881708,4.683959,253952,64,10,0,0.355707,3,pass,5.949833;9.948333;10.264292
-grid,1024,3968,64,bucket32_d4,8.262958,7.353792,2.220125,253952,64,8,0,0.355707,3,pass,11.154000;7.720708;8.262958
-grid,1024,3968,64,bucket32_d16,7.660833,6.970500,2.238875,253952,64,8,0,0.355707,3,pass,8.266375;7.639000;7.660833
-grid,1024,3968,64,bucket32_d64,8.043542,7.205500,2.246292,253952,64,8,0,0.355707,3,pass,8.043542;8.121875;7.920583
-random_masked_reverse,1024,8192,64,old_pull_serial,16.570084,4.646042,2.783208,12582912,24,3,0,0.572584,3,pass,15.608625;16.570084;17.459917
-random_masked_reverse,1024,8192,64,old_group_serial,14.205167,3.149333,2.211167,7053312,19,1,0,0.572584,3,pass,14.687458;14.092833;14.205167
-random_masked_reverse,1024,8192,64,old_pull_parallel_dag,5.958625,5.081458,2.891292,12582912,24,3,0,0.572584,3,pass,5.958625;6.342875;5.587250
-random_masked_reverse,1024,8192,64,old_group_parallel_dag,4.081958,3.046750,2.223625,7053312,19,1,0,0.572584,3,pass,4.123334;4.081958;2.387042
-random_masked_reverse,1024,8192,64,pull64_barrier,3.941667,2.651792,0.613292,12582912,24,3,0,0.572584,3,pass,6.387167;3.941667;3.833542
-random_masked_reverse,1024,8192,64,pull64_interleaved,5.110292,4.362833,2.690750,12582912,24,3,0,0.572584,3,pass,5.082667;5.948709;5.110292
-random_masked_reverse,1024,8192,64,pull32_interleaved,5.086125,4.363625,2.562375,12582912,24,3,0,0.572584,3,pass,5.091459;5.086125;4.956417
-random_masked_reverse,1024,8192,64,pull32_gpu_dag,5.437875,4.244875,3.199833,12582912,24,5,0,0.572584,3,pass,5.315333;5.962417;5.437875
-random_masked_reverse,1024,8192,64,frontier32_vertex,6.363458,5.504500,3.278917,1097250,24,3,0,0.572584,3,pass,6.792125;6.197834;6.363458
-random_masked_reverse,1024,8192,64,frontier32_simd,6.249791,5.481917,3.753459,1014107,24,3,0,0.572584,3,pass,6.805167;6.204208;6.249791
-random_masked_reverse,1024,8192,64,frontier32_gpu_dag,7.568583,5.928750,4.430708,1014586,24,5,0,0.572584,3,pass,6.909084;8.284792;7.568583
-random_masked_reverse,1024,8192,64,bucket32_d4,15.467792,14.422750,8.644958,454224,64,8,0,0.572584,3,pass,15.524417;14.906917;15.467792
-random_masked_reverse,1024,8192,64,bucket32_d16,10.664084,9.545125,5.615625,510827,40,5,0,0.572584,3,pass,10.664084;11.253959;10.204459
-random_masked_reverse,1024,8192,64,bucket32_d64,8.033667,6.966500,4.823583,910477,24,3,0,0.572584,3,pass,8.232083;8.024584;8.033667
diff --git a/dev/research/metal_pathfinding/optimization/results/stress-stderr.txt b/dev/research/metal_pathfinding/optimization/results/stress-stderr.txt
deleted file mode 100644
index 3cd5381..0000000
--- a/dev/research/metal_pathfinding/optimization/results/stress-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=25.9229 execution_width=32
diff --git a/dev/research/metal_pathfinding/optimization/results/stress.csv b/dev/research/metal_pathfinding/optimization/results/stress.csv
deleted file mode 100644
index 8354fce..0000000
--- a/dev/research/metal_pathfinding/optimization/results/stress.csv
+++ /dev/null
@@ -1,29 +0,0 @@
-case,n,e,queries,method,wall_ms,distance_ms,gpu_ms,edge_visits,rounds,waits,fallback64,upload_ms,samples,correct,wall_samples_ms
-grid,1024,3968,64,old_pull_serial,4.089792,3.178458,1.539083,16252928,64,8,0,0.147000,20,pass,4.953459;4.561792;4.111417;3.969375;3.928708;4.098333;3.655541;4.089792;3.828166;4.460042;3.954084;3.793875;4.304750;4.094625;3.848875;3.618375;3.582916;4.091500;4.011042;4.603625
-grid,1024,3968,64,old_group_serial,2.049708,1.149625,0.723458,12066688,63,1,0,0.147000,20,pass,2.268917;2.055167;2.052042;2.374875;2.049708;2.363917;2.175417;2.370125;2.364458;2.134958;1.624000;2.040166;1.945542;1.940709;2.009708;1.442833;1.836541;1.865625;1.853000;1.448875
-grid,1024,3968,64,old_pull_parallel_dag,1.712792,1.547584,0.446167,16252928,64,8,0,0.147000,20,pass,1.840084;1.978375;1.690125;1.772375;1.885000;1.737750;1.577500;2.035459;1.716708;1.632125;1.987708;1.609333;1.494292;1.832333;1.700750;1.517792;1.659833;1.712792;1.610166;1.562125
-grid,1024,3968,64,old_group_parallel_dag,0.526708,0.374084,0.203625,12066688,63,1,0,0.147000,20,pass,0.530583;0.471917;0.559791;0.511625;0.482458;0.492542;0.479416;0.467708;0.482292;0.557958;0.506666;0.526708;0.461833;0.473834;0.789708;1.320042;1.248125;1.289875;1.233875;1.272292
-grid,1024,3968,64,pull64_barrier,1.628084,1.488833,0.407416,16252928,64,8,0,0.147000,20,pass,1.657917;1.549500;1.818042;1.596500;1.505667;1.643792;1.528208;1.576709;1.769042;1.764167;1.589500;1.591333;1.725667;1.624042;1.659500;1.628084;1.735958;1.571042;1.521709;1.657583
-grid,1024,3968,64,pull64_interleaved,1.632666,1.483417,0.382416,16252928,64,8,0,0.147000,20,pass,1.652083;1.606208;1.749042;1.648709;1.524667;1.578875;1.636000;1.632666;1.559583;1.668208;1.614084;1.573125;1.602250;1.683750;1.587083;1.657916;1.560500;1.488709;1.707916;1.844125
-grid,1024,3968,64,pull32_interleaved,1.582875,1.441625,0.362167,16252928,64,8,0,0.147000,20,pass,1.574292;1.582875;1.557667;1.794667;1.637125;1.539209;1.800500;1.498875;1.544625;1.634334;1.693666;1.379208;1.534833;1.592500;1.561708;1.472208;1.619458;1.573417;1.680500;1.666375
-grid,1024,3968,64,pull32_gpu_dag,1.834750,1.444292,0.387333,16252928,64,10,0,0.147000,20,pass,1.755042;1.845917;1.922625;1.923042;1.766792;1.818583;1.785292;1.853708;1.711834;2.019625;1.704416;1.824791;2.007458;1.839667;1.810709;1.881250;1.834750;1.772291;2.008792;1.815833
-grid,1024,3968,64,frontier32_vertex,1.841667,1.684000,0.571125,253952,64,8,0,0.147000,20,pass,1.899750;1.652584;1.945083;1.880250;1.692916;1.859542;1.871833;1.708083;1.917417;1.841667;1.914958;1.776750;1.699541;1.757333;1.975333;1.689292;1.753250;1.786292;1.894167;1.771041
-grid,1024,3968,64,frontier32_simd,1.809708,1.652416,0.558792,253952,64,8,0,0.147000,20,pass,1.804666;1.881291;1.820375;1.716083;2.049500;1.731542;1.742291;1.779792;1.809708;1.796458;1.887417;1.924208;1.640917;1.974542;1.877083;1.752584;1.892459;1.871708;1.649458;1.715084
-grid,1024,3968,64,frontier32_gpu_dag,1.883666,1.521208,0.550501,253952,64,10,0,0.147000,20,pass,1.853542;1.777416;1.955459;1.928625;1.870958;1.831166;1.801875;1.827708;1.883666;1.830833;1.827167;2.068084;1.886583;1.859041;1.891458;1.820416;1.944500;1.943500;1.907459;1.894792
-grid,1024,3968,64,bucket32_d4,2.419833,2.295292,1.195626,253952,64,8,0,0.147000,20,pass,2.394959;2.321208;2.272750;2.353125;2.377708;2.373667;2.402083;2.333958;2.419833;2.584083;2.565083;2.469291;2.569208;2.505083;2.290333;2.444084;2.406042;2.496458;2.426833;2.501042
-grid,1024,3968,64,bucket32_d16,2.418208,2.291250,1.193416,253952,64,8,0,0.147000,20,pass,2.527958;2.444500;2.298791;2.458541;2.418208;2.523250;2.407291;2.397042;2.581292;2.416000;2.600083;2.541709;2.422458;2.627208;2.386500;2.406708;2.318333;2.247709;2.413084;2.342416
-grid,1024,3968,64,bucket32_d64,6.132625,5.953208,4.671833,253952,64,8,0,0.147000,20,pass,2.698791;2.489500;2.409000;5.611875;6.176958;5.938083;6.222125;6.132625;6.057000;5.982167;6.731583;6.025333;5.934458;6.034459;6.339333;6.321000;7.091042;6.698084;7.285709;6.397250
-random_masked_reverse,1024,8192,64,old_pull_serial,5.141583,1.975875,1.167791,12582912,24,3,0,0.220624,20,pass,5.182417;4.845667;5.141583;5.061416;5.216667;5.116000;4.892583;5.019583;5.102292;5.079334;5.188291;5.694791;5.078084;5.269833;5.304208;4.971834;5.720209;5.066291;5.289042;5.186333
-random_masked_reverse,1024,8192,64,old_group_serial,4.292708,1.062416,0.590333,7053312,19,1,0,0.220624,20,pass,4.292708;3.832458;4.279750;4.245458;4.724750;5.119917;4.378208;4.438625;4.340041;4.412083;3.921083;4.287417;4.431000;4.262917;4.251250;4.246083;4.338083;3.993708;4.331333;4.264958
-random_masked_reverse,1024,8192,64,old_pull_parallel_dag,1.451333,1.212208,0.285250,12582912,24,3,0,0.220624,20,pass,1.908167;2.010541;2.503792;2.144875;1.389042;1.398459;1.607791;1.591958;1.266167;1.451333;1.415208;1.304375;1.118792;1.493541;0.874459;1.445292;1.447917;1.309208;1.493250;1.507125
-random_masked_reverse,1024,8192,64,old_group_parallel_dag,0.998083,0.775833,0.132333,7053312,19,1,0,0.220624,20,pass,0.979250;1.060583;0.551041;0.525416;0.971833;1.042917;0.529875;0.502917;0.998083;1.183958;0.959042;1.031166;1.199209;1.177500;0.983750;1.295125;1.232791;1.180709;0.984334;0.951708
-random_masked_reverse,1024,8192,64,pull64_barrier,1.291250,1.063333,0.206125,12582912,24,3,0,0.220624,20,pass,1.291250;1.395750;0.836208;1.290958;0.837125;1.189167;1.304625;1.352625;1.290166;1.416500;0.841333;0.867667;1.524709;1.542166;0.878209;0.886834;1.295416;0.852083;1.404292;1.415375
-random_masked_reverse,1024,8192,64,pull64_interleaved,1.374042,1.137334,0.190542,12582912,24,3,0,0.220624,20,pass,2.149167;1.813167;1.735083;1.695833;1.790167;1.884125;1.365292;1.297458;1.499500;1.288708;1.374042;0.861625;1.312417;0.889291;1.339084;1.458292;1.360417;1.260750;1.390708;0.919458
-random_masked_reverse,1024,8192,64,pull32_interleaved,1.282917,1.042333,0.159666,12582912,24,3,0,0.220624,20,pass,1.556209;1.153875;0.867083;1.373334;0.814375;1.282917;1.373042;1.280083;1.208750;1.409459;1.346167;1.277708;0.868333;1.497959;1.235084;1.431458;1.303000;0.885417;0.799916;1.435958
-random_masked_reverse,1024,8192,64,pull32_gpu_dag,1.035416,0.629125,0.190208,12582912,24,5,0,0.220624,20,pass,1.035416;1.046333;0.902708;0.911875;1.551500;1.599083;1.565958;1.568417;1.539000;1.734750;1.021750;0.998041;1.020667;0.967916;0.982083;0.976292;1.115375;0.888125;1.057042;0.971208
-random_masked_reverse,1024,8192,64,frontier32_vertex,1.570459,1.288500,0.412500,1072481,24,3,0,0.220624,20,pass,1.503792;1.633500;1.898250;1.644250;1.534917;1.365958;1.505667;1.105500;1.069958;1.658958;1.575375;1.457208;1.545750;1.205375;1.844875;1.639709;1.641959;1.533375;1.570459;1.642458
-random_masked_reverse,1024,8192,64,frontier32_simd,1.627334,1.355791,0.482417,997903,24,3,0,0.220624,20,pass,1.170250;1.702958;1.746458;1.552334;1.260917;1.627334;1.685833;1.570667;1.759292;1.580625;1.524500;1.693000;1.713500;1.553334;1.677291;1.241209;1.720833;1.476167;1.204750;1.671500
-random_masked_reverse,1024,8192,64,frontier32_gpu_dag,1.322917,0.915250,0.493250,999274,24,5,0,0.220624,20,pass,1.257667;1.398542;1.338167;1.158791;1.274125;1.322917;1.286250;1.569208;1.349292;1.142209;1.357542;1.414125;1.273791;1.240458;1.400250;1.258584;1.372958;1.232792;1.206208;1.336167
-random_masked_reverse,1024,8192,64,bucket32_d4,3.220708,2.936334,1.273167,454235,64,8,0,0.220624,20,pass,2.729834;3.051750;3.382959;3.244417;3.194125;3.178917;2.538958;3.416334;3.014291;3.245834;3.220708;3.263750;3.250875;3.423042;2.997125;3.231250;3.178459;2.711375;3.318209;3.145541
-random_masked_reverse,1024,8192,64,bucket32_d16,2.395875,2.110375,0.831208,509878,40,5,0,0.220624,20,pass,2.395875;2.372125;2.276792;2.404417;1.823500;2.501584;2.192125;2.579084;2.378500;2.543125;2.488792;2.434875;1.823542;2.254542;1.976667;2.757458;2.678667;2.147125;2.155334;2.437291
-random_masked_reverse,1024,8192,64,bucket32_d64,1.798709,1.538250,0.673417,904016,24,3,0,0.220624,20,pass,1.380583;1.801542;1.360542;1.311166;1.762375;1.827250;1.710291;2.149708;1.875625;1.807667;2.009209;1.820833;1.790875;1.500250;1.798709;1.776791;2.323041;1.768750;1.929041;1.412625
diff --git a/dev/research/metal_pathfinding/optimization/results/workspace-check-final.txt b/dev/research/metal_pathfinding/optimization/results/workspace-check-final.txt
deleted file mode 100644
index 0e84856..0000000
--- a/dev/research/metal_pathfinding/optimization/results/workspace-check-final.txt
+++ /dev/null
@@ -1,391 +0,0 @@
-📦 Installing package (editable, default optimizations)
-Obtaining file:///Users/networmix/ws/NetGraph-Core
-  Installing build dependencies: started
-  Installing build dependencies: finished with status 'done'
-  Checking if build backend supports build_editable: started
-  Checking if build backend supports build_editable: finished with status 'done'
-  Getting requirements to build editable: started
-  Getting requirements to build editable: finished with status 'done'
-  Installing backend dependencies: started
-  Installing backend dependencies: finished with status 'done'
-  Preparing editable metadata (pyproject.toml): started
-  Preparing editable metadata (pyproject.toml): finished with status 'done'
-Requirement already satisfied: numpy>=1.23.2 in ./venv/lib/python3.14/site-packages (from netgraph-core==0.10.0) (2.5.2)
-Building wheels for collected packages: netgraph-core
-  Building editable for netgraph-core (pyproject.toml): started
-  Building editable for netgraph-core (pyproject.toml): finished with status 'done'
-  Created wheel for netgraph-core: filename=netgraph_core-0.10.0-cp314-cp314-macosx_15_0_arm64.whl size=314893 sha256=d2510ae66a03f120aa34f71b3181e2c2bc61d37e63e6dee88b14292916e63b4e
-  Stored in directory: /private/var/folders/8q/438f_q5s0ys8nlnvjqkf953m0000gn/T/pip-ephem-wheel-cache-m73o7_bm/wheels/18/8c/1a/f701a43f4b69f7c794e11f1f5dd0c17e819d2c98bfd1285718
-Successfully built netgraph-core
-Installing collected packages: netgraph-core
-  Attempting uninstall: netgraph-core
-    Found existing installation: netgraph-core 0.10.0
-    Uninstalling netgraph-core-0.10.0:
-      Successfully uninstalled netgraph-core-0.10.0
-Successfully installed netgraph-core-0.10.0
-47 files already formatted
-All checks passed!
-0 errors, 0 warnings, 0 informations 
-WARNING: there is a new pyright version available (v1.1.401 -> v1.1.414).
-Please install the new version or set PYRIGHT_PYTHON_FORCE_VERSION to `latest`
-
--- pybind11 not found via config; using FetchContent
--- pybind11 v3.0.0 
--- LTO not supported: CMake doesn't support IPO for current C compiler
--- Configuring done (0.6s)
--- Generating done (0.0s)
--- Build files have been written to: /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-ninja: no work to do.
-Test project /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-        Start 141: KShortestPaths.DisconnectedReturnsEmpty
-        Start 132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow
-        Start  34: StrictMultiDiGraph.NegativeNodeIdThrows
-        Start  11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier
-  1/170 Test #141: KShortestPaths.DisconnectedReturnsEmpty ...........................................   Passed    0.00 sec
-        Start 152: MaskingTests.MaskedIntermediateNode
-  2/170 Test #132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow .........................................   Passed    0.00 sec
-  3/170 Test  #34: StrictMultiDiGraph.NegativeNodeIdThrows ...........................................   Passed    0.00 sec
-  4/170 Test  #11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier ...................   Passed    0.00 sec
-        Start   9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths
-        Start  10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck
-        Start 105: MaxFlow.AsymmetricCapacity_1to100_Proportional
-  5/170 Test #152: MaskingTests.MaskedIntermediateNode ...............................................   Passed    0.00 sec
-        Start 154: MaskingTests.MaskedEdgeSelectsAlternativePath
-  6/170 Test   #9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths ........   Passed    0.00 sec
-        Start 156: MaskingTests.CombinedNodeAndEdgeMasks
-  7/170 Test  #10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck ......   Passed    0.00 sec
-        Start 144: KShortestPaths.LargerOutOfOrderTopology
-  8/170 Test #105: MaxFlow.AsymmetricCapacity_1to100_Proportional ....................................   Passed    0.00 sec
-        Start  43: ShortestPaths.PredDAGIntegrity
-  9/170 Test #154: MaskingTests.MaskedEdgeSelectsAlternativePath .....................................   Passed    0.00 sec
-        Start 148: MaskingTests.MaskedSourceInMaxFlow
- 10/170 Test #156: MaskingTests.CombinedNodeAndEdgeMasks .............................................   Passed    0.00 sec
-        Start 118: MaxFlow.OptionalOutputs_ResidualAndReachable
- 11/170 Test #144: KShortestPaths.LargerOutOfOrderTopology ...........................................   Passed    0.00 sec
-        Start  33: StrictMultiDiGraph.SelfLoopAllowed
- 12/170 Test  #43: ShortestPaths.PredDAGIntegrity ....................................................   Passed    0.00 sec
-        Start   8: FlowPolicyCore.DiminishingReturnsCutoff
- 13/170 Test #148: MaskingTests.MaskedSourceInMaxFlow ................................................   Passed    0.00 sec
-        Start 138: KShortestPaths.UniqueModeFiltering
- 14/170 Test #118: MaxFlow.OptionalOutputs_ResidualAndReachable ......................................   Passed    0.00 sec
-        Start  92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual
- 15/170 Test  #33: StrictMultiDiGraph.SelfLoopAllowed ................................................   Passed    0.00 sec
-        Start  83: FlowGraph.EmptyLedgerInitially
- 16/170 Test   #8: FlowPolicyCore.DiminishingReturnsCutoff ...........................................   Passed    0.00 sec
-        Start  47: ShortestPaths.ResolveToPathsWithMaxPathsLimit
- 17/170 Test #138: KShortestPaths.UniqueModeFiltering ................................................   Passed    0.00 sec
-        Start  67: FlowState.InvalidResidualInitThrows
- 18/170 Test  #92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual ................................   Passed    0.00 sec
-        Start 106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability
- 19/170 Test  #83: FlowGraph.EmptyLedgerInitially ....................................................   Passed    0.00 sec
-        Start   1: GraphSmoke.ConstructAndRunSPF
- 20/170 Test  #47: ShortestPaths.ResolveToPathsWithMaxPathsLimit .....................................   Passed    0.00 sec
-        Start  17: StrictMultiDiGraph.EmptyGraph
- 21/170 Test  #67: FlowState.InvalidResidualInitThrows ...............................................   Passed    0.00 sec
-        Start  41: ShortestPaths.EdgeMaskFiltering
- 22/170 Test #106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability ...............................   Passed    0.00 sec
-        Start  89: FlowGraph.GetFlowPathForDAGReturnsEmpty
- 23/170 Test   #1: GraphSmoke.ConstructAndRunSPF .....................................................   Passed    0.00 sec
-        Start 104: MaxFlow.ECMP_TenPaths_ScalabilityValidation
- 24/170 Test  #17: StrictMultiDiGraph.EmptyGraph .....................................................   Passed    0.00 sec
-        Start  61: FlowState.ZeroCapacityHandling
- 25/170 Test  #41: ShortestPaths.EdgeMaskFiltering ...................................................   Passed    0.00 sec
-        Start  22: StrictMultiDiGraph.ExternalEdgeIdsPreserved
- 26/170 Test  #89: FlowGraph.GetFlowPathForDAGReturnsEmpty ...........................................   Passed    0.00 sec
-        Start 155: MaskingTests.MultipleEdgesMasked
- 27/170 Test #104: MaxFlow.ECMP_TenPaths_ScalabilityValidation .......................................   Passed    0.00 sec
-        Start 149: MaskingTests.MaskedSourceInComputeMinCut
- 28/170 Test  #61: FlowState.ZeroCapacityHandling ....................................................   Passed    0.00 sec
-        Start 109: MaxFlow.ZeroCapacityPath_CorrectFiltering
- 29/170 Test  #22: StrictMultiDiGraph.ExternalEdgeIdsPreserved .......................................   Passed    0.00 sec
-        Start 126: MaxFlow.Triangle_Topology_Combine_Mode
- 30/170 Test #155: MaskingTests.MultipleEdgesMasked ..................................................   Passed    0.00 sec
-        Start 122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths
- 31/170 Test #149: MaskingTests.MaskedSourceInComputeMinCut ..........................................   Passed    0.00 sec
-        Start 103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation
- 32/170 Test #109: MaxFlow.ZeroCapacityPath_CorrectFiltering .........................................   Passed    0.00 sec
-        Start 107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced
- 33/170 Test #126: MaxFlow.Triangle_Topology_Combine_Mode ............................................   Passed    0.00 sec
-        Start  42: ShortestPaths.EarlyExitOptimization
- 34/170 Test #122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths ......................................   Passed    0.00 sec
-        Start  64: FlowState.MinCutComputation
- 35/170 Test #103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation ......................................   Passed    0.00 sec
-        Start  75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero
- 36/170 Test #107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced ...................................   Passed    0.00 sec
-        Start  29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows
- 37/170 Test  #42: ShortestPaths.EarlyExitOptimization ...............................................   Passed    0.00 sec
-        Start 135: KShortestPaths.FindsKPaths
- 38/170 Test  #64: FlowState.MinCutComputation .......................................................   Passed    0.00 sec
-        Start  32: StrictMultiDiGraph.NegativeCostThrows
- 39/170 Test  #75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero .....................   Passed    0.00 sec
-        Start  99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath
- 40/170 Test  #29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows ....................................   Passed    0.00 sec
-        Start  21: StrictMultiDiGraph.EdgeSortingByCost
- 41/170 Test #135: KShortestPaths.FindsKPaths ........................................................   Passed    0.00 sec
-        Start   7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths
- 42/170 Test  #32: StrictMultiDiGraph.NegativeCostThrows .............................................   Passed    0.00 sec
-        Start  37: ShortestPaths.DisconnectedComponents
- 43/170 Test  #99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath ...................................   Passed    0.00 sec
-        Start  69: FlowState.ApplyDeltasClampsWithinCapacityBounds
- 44/170 Test  #21: StrictMultiDiGraph.EdgeSortingByCost ..............................................   Passed    0.00 sec
-        Start 143: KShortestPaths.OutOfOrderNodePredDAGSemantics
- 45/170 Test   #7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths ...........   Passed    0.00 sec
-        Start 134: MaxFlow.CompletionPhase_RespectsNodeMask
- 46/170 Test  #37: ShortestPaths.DisconnectedComponents ..............................................   Passed    0.00 sec
-        Start  68: FlowState.ResetWithInvalidResidualThrows
- 47/170 Test  #69: FlowState.ApplyDeltasClampsWithinCapacityBounds ...................................   Passed    0.00 sec
-        Start  46: ShortestPaths.ResolveToPathsSplittingParallelEdges
- 48/170 Test #143: KShortestPaths.OutOfOrderNodePredDAGSemantics .....................................   Passed    0.00 sec
-        Start 112: MaxFlow.EqualCost_ShortestVsFull_Equivalent
- 49/170 Test #134: MaxFlow.CompletionPhase_RespectsNodeMask ..........................................   Passed    0.00 sec
-        Start 157: MaskingTests.NodeMaskOverridesEdgeMask
- 50/170 Test  #68: FlowState.ResetWithInvalidResidualThrows ..........................................   Passed    0.00 sec
-        Start 133: MaxFlow.CompletionPhase_RecoversCancellation
- 51/170 Test  #46: ShortestPaths.ResolveToPathsSplittingParallelEdges ................................   Passed    0.00 sec
-        Start  35: StrictMultiDiGraph.MultipleCostTiers
- 52/170 Test #112: MaxFlow.EqualCost_ShortestVsFull_Equivalent .......................................   Passed    0.00 sec
-        Start 153: MaskingTests.MaskedEdgeBlocksPath
- 53/170 Test #157: MaskingTests.NodeMaskOverridesEdgeMask ............................................   Passed    0.00 sec
-        Start  27: StrictMultiDiGraph.InvalidNumNodesThrows
- 54/170 Test #133: MaxFlow.CompletionPhase_RecoversCancellation ......................................   Passed    0.00 sec
-        Start  71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization
- 55/170 Test  #35: StrictMultiDiGraph.MultipleCostTiers ..............................................   Passed    0.00 sec
-        Start 114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult
- 56/170 Test #153: MaskingTests.MaskedEdgeBlocksPath .................................................   Passed    0.00 sec
-        Start  91: FlowGraph.LedgerHistory_RemovalRestoresResidual
- 57/170 Test  #27: StrictMultiDiGraph.InvalidNumNodesThrows ..........................................   Passed    0.00 sec
-        Start  20: StrictMultiDiGraph.ParallelEdges
- 58/170 Test  #71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization ................................   Passed    0.00 sec
-        Start  63: FlowState.ApplyDeltasSubtractive
- 59/170 Test #114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult ..............................   Passed    0.00 sec
-        Start  31: StrictMultiDiGraph.NegativeCapacityThrows
- 60/170 Test  #91: FlowGraph.LedgerHistory_RemovalRestoresResidual ...................................   Passed    0.00 sec
-        Start   5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity
- 61/170 Test  #20: StrictMultiDiGraph.ParallelEdges ..................................................   Passed    0.00 sec
-        Start   2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath
- 62/170 Test  #63: FlowState.ApplyDeltasSubtractive ..................................................   Passed    0.00 sec
-        Start 121: MaxFlow.BatchMaxFlow_IndependentMaskApplication
- 63/170 Test  #31: StrictMultiDiGraph.NegativeCapacityThrows .........................................   Passed    0.00 sec
-        Start 150: MaskingTests.OutOfRangeSourceInComputeMinCut
- 64/170 Test   #5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity ....   Passed    0.00 sec
-        Start 117: MaxFlow.CostDistribution_AccountsForAllFlow
- 65/170 Test   #2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath .........................   Passed    0.00 sec
-        Start 100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow
- 66/170 Test #150: MaskingTests.OutOfRangeSourceInComputeMinCut ......................................   Passed    0.00 sec
-        Start 113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly
- 67/170 Test #121: MaxFlow.BatchMaxFlow_IndependentMaskApplication ...................................   Passed    0.00 sec
-        Start  76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable
- 68/170 Test #117: MaxFlow.CostDistribution_AccountsForAllFlow .......................................   Passed    0.00 sec
-        Start  23: StrictMultiDiGraph.CSROffsetsMonotonicity
- 69/170 Test #100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow ....................................   Passed    0.00 sec
-        Start   4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath
- 70/170 Test #113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly ................................   Passed    0.00 sec
-        Start  58: FlowState.PlacementReducesResidual
- 71/170 Test  #76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable ............   Passed    0.00 sec
-        Start  59: FlowState.ProportionalDistribution
- 72/170 Test  #23: StrictMultiDiGraph.CSROffsetsMonotonicity .........................................   Passed    0.00 sec
-        Start  48: ShortestPaths.LargeGraphStressTest
- 73/170 Test   #4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath .............   Passed    0.00 sec
-        Start 130: MaxFlow.Sensitivity_TwoParallelPaths
- 74/170 Test  #58: FlowState.PlacementReducesResidual ................................................   Passed    0.00 sec
-        Start   6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution
- 75/170 Test  #59: FlowState.ProportionalDistribution ................................................   Passed    0.00 sec
-        Start  44: ShortestPaths.TieBreakingDeterminism
- 76/170 Test  #48: ShortestPaths.LargeGraphStressTest ................................................   Passed    0.00 sec
-        Start 140: KShortestPaths.PathsSortedByCost
- 77/170 Test #130: MaxFlow.Sensitivity_TwoParallelPaths ..............................................   Passed    0.00 sec
-        Start 158: MaskingTests.MaskWithResidualCapacity
- 78/170 Test   #6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution .........   Passed    0.00 sec
-        Start  39: ShortestPaths.ResidualAwareFiltering
- 79/170 Test  #44: ShortestPaths.TieBreakingDeterminism ..............................................   Passed    0.00 sec
-        Start 161: MaskingTests.KSPWithEdgeMask
- 80/170 Test #140: KShortestPaths.PathsSortedByCost ..................................................   Passed    0.00 sec
-        Start  49: ShortestPaths.RejectsMaskLengthMismatch
- 81/170 Test #158: MaskingTests.MaskWithResidualCapacity .............................................   Passed    0.00 sec
-        Start 127: MaxFlow.SimpleParallelPaths_Topology
- 82/170 Test  #39: ShortestPaths.ResidualAwareFiltering ..............................................   Passed    0.00 sec
-        Start 162: MaskingTests.MaxFlowWithNodeMask
- 83/170 Test #161: MaskingTests.KSPWithEdgeMask ......................................................   Passed    0.00 sec
-        Start 137: KShortestPaths.NodeMaskBlocksPaths
- 84/170 Test  #49: ShortestPaths.RejectsMaskLengthMismatch ...........................................   Passed    0.00 sec
-        Start  18: StrictMultiDiGraph.SingleNode
- 85/170 Test #127: MaxFlow.SimpleParallelPaths_Topology ..............................................   Passed    0.00 sec
-        Start 108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth
- 86/170 Test #162: MaskingTests.MaxFlowWithNodeMask ..................................................   Passed    0.00 sec
-        Start  88: FlowGraph.GetFlowPathForLinearFlow
- 87/170 Test #137: KShortestPaths.NodeMaskBlocksPaths ................................................   Passed    0.00 sec
-        Start 160: MaskingTests.KSPWithNodeMask
- 88/170 Test  #18: StrictMultiDiGraph.SingleNode .....................................................   Passed    0.00 sec
-        Start  50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic
- 89/170 Test #108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth ...................................   Passed    0.00 sec
-        Start   3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths
- 90/170 Test  #88: FlowGraph.GetFlowPathForLinearFlow ................................................   Passed    0.00 sec
-        Start 142: KShortestPaths.LooplessPaths
- 91/170 Test #160: MaskingTests.KSPWithNodeMask ......................................................   Passed    0.00 sec
-        Start 116: MaxFlow.MinCut_ValidEdgeIdentification
- 92/170 Test  #50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic ......................................   Passed    0.00 sec
-        Start  36: ShortestPaths.SingleSourceAllNodes
- 93/170 Test   #3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths ............   Passed    0.00 sec
-        Start  38: ShortestPaths.MultipleEqualCostPaths
- 94/170 Test #142: KShortestPaths.LooplessPaths ......................................................   Passed    0.00 sec
-        Start 111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers
- 95/170 Test #116: MaxFlow.MinCut_ValidEdgeIdentification ............................................   Passed    0.00 sec
-        Start 136: KShortestPaths.KEqualsZeroReturnsEmpty
- 96/170 Test  #36: ShortestPaths.SingleSourceAllNodes ................................................   Passed    0.00 sec
-        Start  24: StrictMultiDiGraph.CSRReverseAdjacency
- 97/170 Test  #38: ShortestPaths.MultipleEqualCostPaths ..............................................   Passed    0.00 sec
-        Start  97: MaxFlow.SinglePath_ShortestPathEquivalence
- 98/170 Test #111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers .........................................   Passed    0.00 sec
-        Start 146: MaskingTests.MaskedSourceReturnsEmptyDAG
- 99/170 Test #136: KShortestPaths.KEqualsZeroReturnsEmpty ............................................   Passed    0.00 sec
-        Start  90: FlowGraph.CoalescesDuplicateEdgeIds
-100/170 Test  #24: StrictMultiDiGraph.CSRReverseAdjacency ............................................   Passed    0.00 sec
-        Start  28: StrictMultiDiGraph.MismatchedArrayLengthsThrow
-101/170 Test  #97: MaxFlow.SinglePath_ShortestPathEquivalence ........................................   Passed    0.00 sec
-        Start 129: MaxFlow.Sensitivity_SinglePath
-102/170 Test #146: MaskingTests.MaskedSourceReturnsEmptyDAG ..........................................   Passed    0.00 sec
-        Start 131: MaxFlow.Sensitivity_PartialSaturation
-103/170 Test  #90: FlowGraph.CoalescesDuplicateEdgeIds ...............................................   Passed    0.00 sec
-        Start 110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly
-104/170 Test  #28: StrictMultiDiGraph.MismatchedArrayLengthsThrow ....................................   Passed    0.00 sec
-        Start 124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest
-105/170 Test #129: MaxFlow.Sensitivity_SinglePath ....................................................   Passed    0.00 sec
-        Start 120: MaxFlow.EdgeMask_SelectiveEdgeFiltering
-106/170 Test #131: MaxFlow.Sensitivity_PartialSaturation .............................................   Passed    0.00 sec
-        Start  45: ShortestPaths.PreferHigherResidualTieBreak
-107/170 Test #124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest .................................   Passed    0.00 sec
-        Start 123: MaxFlow.SharedBottleneck_MultiplePathsMerge
-108/170 Test #110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly ..................................   Passed    0.00 sec
-        Start  57: FlowState.InitialResidualEqualsCapacity
-109/170 Test #120: MaxFlow.EdgeMask_SelectiveEdgeFiltering ...........................................   Passed    0.00 sec
-        Start  25: StrictMultiDiGraph.MaxCapacityEdges
-110/170 Test  #45: ShortestPaths.PreferHigherResidualTieBreak ........................................   Passed    0.00 sec
-        Start  40: ShortestPaths.NodeMaskIsolation
-111/170 Test #123: MaxFlow.SharedBottleneck_MultiplePathsMerge .......................................   Passed    0.00 sec
-        Start 125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest
-112/170 Test  #57: FlowState.InitialResidualEqualsCapacity ...........................................   Passed    0.00 sec
-        Start 128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths
-113/170 Test  #25: StrictMultiDiGraph.MaxCapacityEdges ...............................................   Passed    0.00 sec
-        Start  74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero
-114/170 Test  #40: ShortestPaths.NodeMaskIsolation ...................................................   Passed    0.00 sec
-        Start 159: MaskingTests.ResidualAndNodeMaskCombined
-115/170 Test #125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest ................................   Passed    0.00 sec
-        Start 147: MaskingTests.MaskedSourceWithDestination
-116/170 Test #128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths ................................   Passed    0.00 sec
-        Start  70: FlowState.EqualBalancedReconvergentDAGPlacesAll
-117/170 Test  #74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero ....................   Passed    0.00 sec
-        Start  84: FlowGraph.PlacementCreatesEntry
-118/170 Test #159: MaskingTests.ResidualAndNodeMaskCombined ..........................................   Passed    0.00 sec
-        Start  30: StrictMultiDiGraph.OutOfRangeNodeThrows
-119/170 Test #147: MaskingTests.MaskedSourceWithDestination ..........................................   Passed    0.00 sec
-        Start  62: FlowState.ApplyDeltasAdditive
-120/170 Test  #70: FlowState.EqualBalancedReconvergentDAGPlacesAll ...................................   Passed    0.00 sec
-        Start  65: FlowState.ResetRestoresCapacity
-121/170 Test  #84: FlowGraph.PlacementCreatesEntry ...................................................   Passed    0.00 sec
-        Start 151: MaskingTests.MaskedDestinationUnreachable
-122/170 Test  #30: StrictMultiDiGraph.OutOfRangeNodeThrows ...........................................   Passed    0.00 sec
-        Start  60: FlowState.EqualBalancedDistribution
-123/170 Test  #62: FlowState.ApplyDeltasAdditive .....................................................   Passed    0.00 sec
-        Start 139: KShortestPaths.MaxCostFactorLimit
-124/170 Test  #65: FlowState.ResetRestoresCapacity ...................................................   Passed    0.00 sec
-        Start  19: StrictMultiDiGraph.SingleEdge
-125/170 Test #151: MaskingTests.MaskedDestinationUnreachable .........................................   Passed    0.00 sec
-        Start  96: MaxFlow.SinglePath_BottleneckConstraint
-126/170 Test  #60: FlowState.EqualBalancedDistribution ...............................................   Passed    0.00 sec
-        Start  66: FlowState.CustomInitialResidual
-127/170 Test #139: KShortestPaths.MaxCostFactorLimit .................................................   Passed    0.00 sec
-        Start 115: MaxFlow.FlowConservation_IntermediateNodes
-128/170 Test  #19: StrictMultiDiGraph.SingleEdge .....................................................   Passed    0.00 sec
-        Start 101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath
-129/170 Test  #96: MaxFlow.SinglePath_BottleneckConstraint ...........................................   Passed    0.00 sec
-        Start 102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath
-130/170 Test  #66: FlowState.CustomInitialResidual ...................................................   Passed    0.00 sec
-        Start  26: StrictMultiDiGraph.ZeroCostEdges
-131/170 Test #115: MaxFlow.FlowConservation_IntermediateNodes ........................................   Passed    0.00 sec
-        Start  72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges
-132/170 Test #101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath ..................................   Passed    0.00 sec
-        Start  95: MaxFlow.SinglePath_BasicLinear
-133/170 Test #102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath .................................   Passed    0.00 sec
-        Start  98: MaxFlow.DegenerateCase_SourceEqualsSink
-134/170 Test  #26: StrictMultiDiGraph.ZeroCostEdges ..................................................   Passed    0.00 sec
-        Start  86: FlowGraph.RemoveByClassFiltersCorrectly
-135/170 Test  #72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges ..............   Passed    0.00 sec
-        Start  73: FlowState.EqualBalanced_DownstreamSplitEqualization
-136/170 Test  #95: MaxFlow.SinglePath_BasicLinear ....................................................   Passed    0.00 sec
-        Start 119: MaxFlow.NodeMask_BlocksFlowThroughNode
-137/170 Test  #98: MaxFlow.DegenerateCase_SourceEqualsSink ...........................................   Passed    0.00 sec
-        Start  85: FlowGraph.RemovalDeletesEntry
-138/170 Test  #86: FlowGraph.RemoveByClassFiltersCorrectly ...........................................   Passed    0.00 sec
-        Start  87: FlowGraph.GetFlowEdgesReturnsDeltas
-139/170 Test  #73: FlowState.EqualBalanced_DownstreamSplitEqualization ...............................   Passed    0.00 sec
-        Start 163: MaskingTests.MaxFlowWithEdgeMask
-140/170 Test #119: MaxFlow.NodeMask_BlocksFlowThroughNode ............................................   Passed    0.00 sec
-        Start 164: MaskingTests.MaxFlowAllPathsMasked
-141/170 Test  #85: FlowGraph.RemovalDeletesEntry .....................................................   Passed    0.00 sec
-        Start 165: MaskingTests.EmptyNodeMaskAllowsAllNodes
-142/170 Test  #87: FlowGraph.GetFlowEdgesReturnsDeltas ...............................................   Passed    0.00 sec
-        Start  12: FlowPolicyStatic.PerFlowBundleBinding
-143/170 Test #163: MaskingTests.MaxFlowWithEdgeMask ..................................................   Passed    0.00 sec
-        Start 169: MaskingTests.AlgorithmsAPIMaskedSource
-144/170 Test #164: MaskingTests.MaxFlowAllPathsMasked ................................................   Passed    0.00 sec
-        Start  13: FlowPolicyStatic.MaskedBundleIsDown
-145/170 Test #165: MaskingTests.EmptyNodeMaskAllowsAllNodes ..........................................   Passed    0.00 sec
-        Start  15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast
-146/170 Test  #12: FlowPolicyStatic.PerFlowBundleBinding .............................................   Passed    0.00 sec
-        Start  14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles
-147/170 Test #169: MaskingTests.AlgorithmsAPIMaskedSource ............................................   Passed    0.00 sec
-        Start  55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected
-148/170 Test  #13: FlowPolicyStatic.MaskedBundleIsDown ...............................................   Passed    0.00 sec
-        Start  52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource
-149/170 Test  #15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast ...   Passed    0.00 sec
-        Start 166: MaskingTests.EmptyEdgeMaskAllowsAllEdges
-150/170 Test  #14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles ...................   Passed    0.00 sec
-        Start  16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping
-151/170 Test  #55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected ..................................   Passed    0.00 sec
-        Start  51: ShortestPathsTo.DistancesMatchForwardDistancesToDst
-152/170 Test  #52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource ..................   Passed    0.00 sec
-        Start  94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal
-153/170 Test #166: MaskingTests.EmptyEdgeMaskAllowsAllEdges ..........................................   Passed    0.00 sec
-        Start  81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops
-154/170 Test  #16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping ....   Passed    0.00 sec
-        Start  79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops
-155/170 Test  #51: ShortestPathsTo.DistancesMatchForwardDistancesToDst ...............................   Passed    0.00 sec
-        Start 170: MaskingTests.AlgorithmsAPIMaxFlowWithMask
-156/170 Test  #94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal ..........................   Passed    0.00 sec
-        Start  82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger
-157/170 Test  #81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops .....................   Passed    0.00 sec
-        Start 167: MaskingTests.AllNodesMaskedNoReachability
-158/170 Test  #79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops ..............................   Passed    0.00 sec
-        Start 168: MaskingTests.AllEdgesMaskedNoReachability
-159/170 Test #170: MaskingTests.AlgorithmsAPIMaxFlowWithMask .........................................   Passed    0.00 sec
-        Start  80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream
-160/170 Test  #82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger .......................   Passed    0.00 sec
-        Start  53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag
-161/170 Test #167: MaskingTests.AllNodesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start  93: FlowGraphStamp.CopiesAndMovesGetFreshUids
-162/170 Test #168: MaskingTests.AllEdgesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start 145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK
-163/170 Test  #80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream ..........................   Passed    0.00 sec
-        Start  54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads
-164/170 Test  #53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag .............................   Passed    0.00 sec
-        Start  77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission
-165/170 Test  #93: FlowGraphStamp.CopiesAndMovesGetFreshUids .........................................   Passed    0.00 sec
-        Start  78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf
-166/170 Test #145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK .....................................   Passed    0.00 sec
-        Start  56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode
-167/170 Test  #54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads ..............................   Passed    0.00 sec
-168/170 Test  #77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission ............................   Passed    0.00 sec
-169/170 Test  #78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf .....................   Passed    0.00 sec
-170/170 Test  #56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode ............................   Passed    0.00 sec
-
-100% tests passed out of 170
-
-Total Test time (real) =   0.10 sec
-........................................................................ [ 15%]
-........................................................................ [ 30%]
-........................................................................ [ 46%]
-........................................................................ [ 61%]
-........................................................................ [ 77%]
-........................................................................ [ 92%]
-.................................                                        [100%]
-465 passed in 3.88s
diff --git a/dev/research/metal_pathfinding/optimization/results/workspace-check-format-failure.txt b/dev/research/metal_pathfinding/optimization/results/workspace-check-format-failure.txt
deleted file mode 100644
index 5ae98d9..0000000
--- a/dev/research/metal_pathfinding/optimization/results/workspace-check-format-failure.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-📦 Installing package (editable, default optimizations)
-Obtaining file:///Users/networmix/ws/NetGraph-Core
-  Installing build dependencies: started
-  Installing build dependencies: finished with status 'done'
-  Checking if build backend supports build_editable: started
-  Checking if build backend supports build_editable: finished with status 'done'
-  Getting requirements to build editable: started
-  Getting requirements to build editable: finished with status 'done'
-  Installing backend dependencies: started
-  Installing backend dependencies: finished with status 'done'
-  Preparing editable metadata (pyproject.toml): started
-  Preparing editable metadata (pyproject.toml): finished with status 'done'
-Requirement already satisfied: numpy>=1.23.2 in ./venv/lib/python3.14/site-packages (from netgraph-core==0.10.0) (2.5.2)
-Building wheels for collected packages: netgraph-core
-  Building editable for netgraph-core (pyproject.toml): started
-  Building editable for netgraph-core (pyproject.toml): finished with status 'done'
-  Created wheel for netgraph-core: filename=netgraph_core-0.10.0-cp314-cp314-macosx_15_0_arm64.whl size=314893 sha256=45dc943b94205d14b496b501ddece08674343bf5cd918dad537b691749b3e16c
-  Stored in directory: /private/var/folders/8q/438f_q5s0ys8nlnvjqkf953m0000gn/T/pip-ephem-wheel-cache-jhm8vyb3/wheels/18/8c/1a/f701a43f4b69f7c794e11f1f5dd0c17e819d2c98bfd1285718
-Successfully built netgraph-core
-Installing collected packages: netgraph-core
-  Attempting uninstall: netgraph-core
-    Found existing installation: netgraph-core 0.10.0
-    Uninstalling netgraph-core-0.10.0:
-      Successfully uninstalled netgraph-core-0.10.0
-Successfully installed netgraph-core-0.10.0
-Would reformat: dev/research/metal_pathfinding/optimization/summarize.py
-1 file would be reformatted, 45 files already formatted
-make[1]: *** [lint] Error 1
-make: *** [check-ci] Error 2
diff --git a/dev/research/metal_pathfinding/optimization/results/workspace-check.txt b/dev/research/metal_pathfinding/optimization/results/workspace-check.txt
deleted file mode 100644
index 63a2578..0000000
--- a/dev/research/metal_pathfinding/optimization/results/workspace-check.txt
+++ /dev/null
@@ -1,391 +0,0 @@
-📦 Installing package (editable, default optimizations)
-Obtaining file:///Users/networmix/ws/NetGraph-Core
-  Installing build dependencies: started
-  Installing build dependencies: finished with status 'done'
-  Checking if build backend supports build_editable: started
-  Checking if build backend supports build_editable: finished with status 'done'
-  Getting requirements to build editable: started
-  Getting requirements to build editable: finished with status 'done'
-  Installing backend dependencies: started
-  Installing backend dependencies: finished with status 'done'
-  Preparing editable metadata (pyproject.toml): started
-  Preparing editable metadata (pyproject.toml): finished with status 'done'
-Requirement already satisfied: numpy>=1.23.2 in ./venv/lib/python3.14/site-packages (from netgraph-core==0.10.0) (2.5.2)
-Building wheels for collected packages: netgraph-core
-  Building editable for netgraph-core (pyproject.toml): started
-  Building editable for netgraph-core (pyproject.toml): finished with status 'done'
-  Created wheel for netgraph-core: filename=netgraph_core-0.10.0-cp314-cp314-macosx_15_0_arm64.whl size=314893 sha256=d1b60157a21593b4395cd742e5e77836464e64204d8e6696eaad98b9b46fcad9
-  Stored in directory: /private/var/folders/8q/438f_q5s0ys8nlnvjqkf953m0000gn/T/pip-ephem-wheel-cache-pakafcm5/wheels/18/8c/1a/f701a43f4b69f7c794e11f1f5dd0c17e819d2c98bfd1285718
-Successfully built netgraph-core
-Installing collected packages: netgraph-core
-  Attempting uninstall: netgraph-core
-    Found existing installation: netgraph-core 0.10.0
-    Uninstalling netgraph-core-0.10.0:
-      Successfully uninstalled netgraph-core-0.10.0
-Successfully installed netgraph-core-0.10.0
-46 files already formatted
-All checks passed!
-0 errors, 0 warnings, 0 informations 
-WARNING: there is a new pyright version available (v1.1.401 -> v1.1.414).
-Please install the new version or set PYRIGHT_PYTHON_FORCE_VERSION to `latest`
-
--- pybind11 not found via config; using FetchContent
--- pybind11 v3.0.0 
--- LTO not supported: CMake doesn't support IPO for current C compiler
--- Configuring done (0.5s)
--- Generating done (0.0s)
--- Build files have been written to: /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-ninja: no work to do.
-Test project /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-        Start 141: KShortestPaths.DisconnectedReturnsEmpty
-        Start 132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow
-        Start  34: StrictMultiDiGraph.NegativeNodeIdThrows
-        Start  11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier
-  1/170 Test #141: KShortestPaths.DisconnectedReturnsEmpty ...........................................   Passed    0.04 sec
-  2/170 Test  #34: StrictMultiDiGraph.NegativeNodeIdThrows ...........................................   Passed    0.03 sec
-        Start 152: MaskingTests.MaskedIntermediateNode
-        Start   9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths
-  3/170 Test #132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow .........................................   Passed    0.04 sec
-  4/170 Test  #11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier ...................   Passed    0.04 sec
-        Start  10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck
-        Start 105: MaxFlow.AsymmetricCapacity_1to100_Proportional
-  5/170 Test #152: MaskingTests.MaskedIntermediateNode ...............................................   Passed    0.00 sec
-        Start 154: MaskingTests.MaskedEdgeSelectsAlternativePath
-  6/170 Test   #9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths ........   Passed    0.00 sec
-        Start 156: MaskingTests.CombinedNodeAndEdgeMasks
-  7/170 Test  #10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck ......   Passed    0.00 sec
-        Start 144: KShortestPaths.LargerOutOfOrderTopology
-  8/170 Test #105: MaxFlow.AsymmetricCapacity_1to100_Proportional ....................................   Passed    0.00 sec
-        Start  43: ShortestPaths.PredDAGIntegrity
-  9/170 Test #154: MaskingTests.MaskedEdgeSelectsAlternativePath .....................................   Passed    0.00 sec
-        Start 148: MaskingTests.MaskedSourceInMaxFlow
- 10/170 Test #156: MaskingTests.CombinedNodeAndEdgeMasks .............................................   Passed    0.00 sec
-        Start 118: MaxFlow.OptionalOutputs_ResidualAndReachable
- 11/170 Test #144: KShortestPaths.LargerOutOfOrderTopology ...........................................   Passed    0.00 sec
-        Start  33: StrictMultiDiGraph.SelfLoopAllowed
- 12/170 Test  #43: ShortestPaths.PredDAGIntegrity ....................................................   Passed    0.00 sec
-        Start   8: FlowPolicyCore.DiminishingReturnsCutoff
- 13/170 Test #148: MaskingTests.MaskedSourceInMaxFlow ................................................   Passed    0.00 sec
-        Start 138: KShortestPaths.UniqueModeFiltering
- 14/170 Test #118: MaxFlow.OptionalOutputs_ResidualAndReachable ......................................   Passed    0.00 sec
-        Start  92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual
- 15/170 Test  #33: StrictMultiDiGraph.SelfLoopAllowed ................................................   Passed    0.00 sec
-        Start  83: FlowGraph.EmptyLedgerInitially
- 16/170 Test   #8: FlowPolicyCore.DiminishingReturnsCutoff ...........................................   Passed    0.00 sec
-        Start  47: ShortestPaths.ResolveToPathsWithMaxPathsLimit
- 17/170 Test #138: KShortestPaths.UniqueModeFiltering ................................................   Passed    0.00 sec
-        Start  67: FlowState.InvalidResidualInitThrows
- 18/170 Test  #92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual ................................   Passed    0.00 sec
-        Start 106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability
- 19/170 Test  #83: FlowGraph.EmptyLedgerInitially ....................................................   Passed    0.00 sec
-        Start  17: StrictMultiDiGraph.EmptyGraph
- 20/170 Test  #47: ShortestPaths.ResolveToPathsWithMaxPathsLimit .....................................   Passed    0.00 sec
-        Start   1: GraphSmoke.ConstructAndRunSPF
- 21/170 Test  #67: FlowState.InvalidResidualInitThrows ...............................................   Passed    0.00 sec
-        Start  41: ShortestPaths.EdgeMaskFiltering
- 22/170 Test #106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability ...............................   Passed    0.00 sec
-        Start  89: FlowGraph.GetFlowPathForDAGReturnsEmpty
- 23/170 Test  #17: StrictMultiDiGraph.EmptyGraph .....................................................   Passed    0.00 sec
-        Start 104: MaxFlow.ECMP_TenPaths_ScalabilityValidation
- 24/170 Test   #1: GraphSmoke.ConstructAndRunSPF .....................................................   Passed    0.00 sec
-        Start  61: FlowState.ZeroCapacityHandling
- 25/170 Test  #41: ShortestPaths.EdgeMaskFiltering ...................................................   Passed    0.00 sec
-        Start  22: StrictMultiDiGraph.ExternalEdgeIdsPreserved
- 26/170 Test  #89: FlowGraph.GetFlowPathForDAGReturnsEmpty ...........................................   Passed    0.00 sec
-        Start 149: MaskingTests.MaskedSourceInComputeMinCut
- 27/170 Test #104: MaxFlow.ECMP_TenPaths_ScalabilityValidation .......................................   Passed    0.00 sec
-        Start 126: MaxFlow.Triangle_Topology_Combine_Mode
- 28/170 Test  #61: FlowState.ZeroCapacityHandling ....................................................   Passed    0.00 sec
-        Start 103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation
- 29/170 Test  #22: StrictMultiDiGraph.ExternalEdgeIdsPreserved .......................................   Passed    0.00 sec
-        Start 107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced
- 30/170 Test #149: MaskingTests.MaskedSourceInComputeMinCut ..........................................   Passed    0.00 sec
-        Start 109: MaxFlow.ZeroCapacityPath_CorrectFiltering
- 31/170 Test #126: MaxFlow.Triangle_Topology_Combine_Mode ............................................   Passed    0.00 sec
-        Start 155: MaskingTests.MultipleEdgesMasked
- 32/170 Test #103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation ......................................   Passed    0.00 sec
-        Start 122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths
- 33/170 Test #107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced ...................................   Passed    0.00 sec
-        Start  42: ShortestPaths.EarlyExitOptimization
- 34/170 Test #109: MaxFlow.ZeroCapacityPath_CorrectFiltering .........................................   Passed    0.00 sec
-        Start  64: FlowState.MinCutComputation
- 35/170 Test #155: MaskingTests.MultipleEdgesMasked ..................................................   Passed    0.00 sec
- 36/170 Test #122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths ......................................   Passed    0.00 sec
-        Start  75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero
-        Start  29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows
- 37/170 Test  #42: ShortestPaths.EarlyExitOptimization ...............................................   Passed    0.00 sec
-        Start  32: StrictMultiDiGraph.NegativeCostThrows
- 38/170 Test  #64: FlowState.MinCutComputation .......................................................   Passed    0.00 sec
-        Start 135: KShortestPaths.FindsKPaths
- 39/170 Test  #75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero .....................   Passed    0.00 sec
-        Start  99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath
- 40/170 Test  #29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows ....................................   Passed    0.00 sec
-        Start  21: StrictMultiDiGraph.EdgeSortingByCost
- 41/170 Test  #32: StrictMultiDiGraph.NegativeCostThrows .............................................   Passed    0.00 sec
-        Start   7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths
- 42/170 Test #135: KShortestPaths.FindsKPaths ........................................................   Passed    0.00 sec
-        Start  37: ShortestPaths.DisconnectedComponents
- 43/170 Test  #99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath ...................................   Passed    0.00 sec
-        Start  69: FlowState.ApplyDeltasClampsWithinCapacityBounds
- 44/170 Test  #21: StrictMultiDiGraph.EdgeSortingByCost ..............................................   Passed    0.00 sec
-        Start 143: KShortestPaths.OutOfOrderNodePredDAGSemantics
- 45/170 Test   #7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths ...........   Passed    0.00 sec
-        Start 134: MaxFlow.CompletionPhase_RespectsNodeMask
- 46/170 Test  #37: ShortestPaths.DisconnectedComponents ..............................................   Passed    0.00 sec
-        Start  68: FlowState.ResetWithInvalidResidualThrows
- 47/170 Test  #69: FlowState.ApplyDeltasClampsWithinCapacityBounds ...................................   Passed    0.00 sec
-        Start  46: ShortestPaths.ResolveToPathsSplittingParallelEdges
- 48/170 Test #143: KShortestPaths.OutOfOrderNodePredDAGSemantics .....................................   Passed    0.00 sec
-        Start 112: MaxFlow.EqualCost_ShortestVsFull_Equivalent
- 49/170 Test #134: MaxFlow.CompletionPhase_RespectsNodeMask ..........................................   Passed    0.00 sec
-        Start 157: MaskingTests.NodeMaskOverridesEdgeMask
- 50/170 Test  #68: FlowState.ResetWithInvalidResidualThrows ..........................................   Passed    0.00 sec
-        Start 153: MaskingTests.MaskedEdgeBlocksPath
- 51/170 Test  #46: ShortestPaths.ResolveToPathsSplittingParallelEdges ................................   Passed    0.00 sec
-        Start 133: MaxFlow.CompletionPhase_RecoversCancellation
- 52/170 Test #112: MaxFlow.EqualCost_ShortestVsFull_Equivalent .......................................   Passed    0.00 sec
-        Start  35: StrictMultiDiGraph.MultipleCostTiers
- 53/170 Test #157: MaskingTests.NodeMaskOverridesEdgeMask ............................................   Passed    0.00 sec
-        Start  71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization
- 54/170 Test #153: MaskingTests.MaskedEdgeBlocksPath .................................................   Passed    0.00 sec
-        Start  27: StrictMultiDiGraph.InvalidNumNodesThrows
- 55/170 Test #133: MaxFlow.CompletionPhase_RecoversCancellation ......................................   Passed    0.00 sec
-        Start 114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult
- 56/170 Test  #35: StrictMultiDiGraph.MultipleCostTiers ..............................................   Passed    0.00 sec
-        Start  91: FlowGraph.LedgerHistory_RemovalRestoresResidual
- 57/170 Test  #71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization ................................   Passed    0.00 sec
-        Start  20: StrictMultiDiGraph.ParallelEdges
- 58/170 Test  #27: StrictMultiDiGraph.InvalidNumNodesThrows ..........................................   Passed    0.00 sec
-        Start  63: FlowState.ApplyDeltasSubtractive
- 59/170 Test #114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult ..............................   Passed    0.00 sec
-        Start  31: StrictMultiDiGraph.NegativeCapacityThrows
- 60/170 Test  #91: FlowGraph.LedgerHistory_RemovalRestoresResidual ...................................   Passed    0.00 sec
-        Start   2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath
- 61/170 Test  #20: StrictMultiDiGraph.ParallelEdges ..................................................   Passed    0.00 sec
-        Start   5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity
- 62/170 Test  #63: FlowState.ApplyDeltasSubtractive ..................................................   Passed    0.00 sec
-        Start 150: MaskingTests.OutOfRangeSourceInComputeMinCut
- 63/170 Test  #31: StrictMultiDiGraph.NegativeCapacityThrows .........................................   Passed    0.00 sec
-        Start 100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow
- 64/170 Test   #2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath .........................   Passed    0.00 sec
-        Start  76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable
- 65/170 Test   #5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity ....   Passed    0.00 sec
-        Start 121: MaxFlow.BatchMaxFlow_IndependentMaskApplication
- 66/170 Test #150: MaskingTests.OutOfRangeSourceInComputeMinCut ......................................   Passed    0.00 sec
-        Start 117: MaxFlow.CostDistribution_AccountsForAllFlow
- 67/170 Test #100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow ....................................   Passed    0.00 sec
-        Start 113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly
- 68/170 Test  #76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable ............   Passed    0.00 sec
-        Start  23: StrictMultiDiGraph.CSROffsetsMonotonicity
- 69/170 Test #121: MaxFlow.BatchMaxFlow_IndependentMaskApplication ...................................   Passed    0.00 sec
-        Start  48: ShortestPaths.LargeGraphStressTest
- 70/170 Test #117: MaxFlow.CostDistribution_AccountsForAllFlow .......................................   Passed    0.00 sec
-        Start  58: FlowState.PlacementReducesResidual
- 71/170 Test #113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly ................................   Passed    0.00 sec
-        Start   4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath
- 72/170 Test  #23: StrictMultiDiGraph.CSROffsetsMonotonicity .........................................   Passed    0.00 sec
-        Start  59: FlowState.ProportionalDistribution
- 73/170 Test  #48: ShortestPaths.LargeGraphStressTest ................................................   Passed    0.00 sec
-        Start 130: MaxFlow.Sensitivity_TwoParallelPaths
- 74/170 Test  #58: FlowState.PlacementReducesResidual ................................................   Passed    0.00 sec
-        Start   6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution
- 75/170 Test   #4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath .............   Passed    0.00 sec
-        Start  44: ShortestPaths.TieBreakingDeterminism
- 76/170 Test  #59: FlowState.ProportionalDistribution ................................................   Passed    0.00 sec
-        Start 140: KShortestPaths.PathsSortedByCost
- 77/170 Test #130: MaxFlow.Sensitivity_TwoParallelPaths ..............................................   Passed    0.00 sec
-        Start 158: MaskingTests.MaskWithResidualCapacity
- 78/170 Test   #6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution .........   Passed    0.00 sec
-        Start  39: ShortestPaths.ResidualAwareFiltering
- 79/170 Test  #44: ShortestPaths.TieBreakingDeterminism ..............................................   Passed    0.00 sec
-        Start 161: MaskingTests.KSPWithEdgeMask
- 80/170 Test #140: KShortestPaths.PathsSortedByCost ..................................................   Passed    0.00 sec
-        Start 162: MaskingTests.MaxFlowWithNodeMask
- 81/170 Test #158: MaskingTests.MaskWithResidualCapacity .............................................   Passed    0.00 sec
-        Start 127: MaxFlow.SimpleParallelPaths_Topology
- 82/170 Test  #39: ShortestPaths.ResidualAwareFiltering ..............................................   Passed    0.00 sec
-        Start  49: ShortestPaths.RejectsMaskLengthMismatch
- 83/170 Test #161: MaskingTests.KSPWithEdgeMask ......................................................   Passed    0.00 sec
-        Start 137: KShortestPaths.NodeMaskBlocksPaths
- 84/170 Test #162: MaskingTests.MaxFlowWithNodeMask ..................................................   Passed    0.00 sec
-        Start  18: StrictMultiDiGraph.SingleNode
- 85/170 Test #127: MaxFlow.SimpleParallelPaths_Topology ..............................................   Passed    0.00 sec
-        Start 108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth
- 86/170 Test  #49: ShortestPaths.RejectsMaskLengthMismatch ...........................................   Passed    0.00 sec
-        Start  88: FlowGraph.GetFlowPathForLinearFlow
- 87/170 Test #137: KShortestPaths.NodeMaskBlocksPaths ................................................   Passed    0.00 sec
-        Start 160: MaskingTests.KSPWithNodeMask
- 88/170 Test  #18: StrictMultiDiGraph.SingleNode .....................................................   Passed    0.00 sec
-        Start  50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic
- 89/170 Test #108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth ...................................   Passed    0.00 sec
-        Start   3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths
- 90/170 Test  #88: FlowGraph.GetFlowPathForLinearFlow ................................................   Passed    0.00 sec
-        Start 142: KShortestPaths.LooplessPaths
- 91/170 Test #160: MaskingTests.KSPWithNodeMask ......................................................   Passed    0.00 sec
-        Start 116: MaxFlow.MinCut_ValidEdgeIdentification
- 92/170 Test  #50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic ......................................   Passed    0.00 sec
-        Start  36: ShortestPaths.SingleSourceAllNodes
- 93/170 Test   #3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths ............   Passed    0.00 sec
-        Start 136: KShortestPaths.KEqualsZeroReturnsEmpty
- 94/170 Test #142: KShortestPaths.LooplessPaths ......................................................   Passed    0.00 sec
-        Start  38: ShortestPaths.MultipleEqualCostPaths
- 95/170 Test #116: MaxFlow.MinCut_ValidEdgeIdentification ............................................   Passed    0.00 sec
-        Start 111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers
- 96/170 Test  #36: ShortestPaths.SingleSourceAllNodes ................................................   Passed    0.00 sec
-        Start  24: StrictMultiDiGraph.CSRReverseAdjacency
- 97/170 Test #136: KShortestPaths.KEqualsZeroReturnsEmpty ............................................   Passed    0.00 sec
-        Start  97: MaxFlow.SinglePath_ShortestPathEquivalence
- 98/170 Test  #38: ShortestPaths.MultipleEqualCostPaths ..............................................   Passed    0.00 sec
-        Start  90: FlowGraph.CoalescesDuplicateEdgeIds
- 99/170 Test #111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers .........................................   Passed    0.00 sec
-        Start 146: MaskingTests.MaskedSourceReturnsEmptyDAG
-100/170 Test  #24: StrictMultiDiGraph.CSRReverseAdjacency ............................................   Passed    0.00 sec
-        Start  28: StrictMultiDiGraph.MismatchedArrayLengthsThrow
-101/170 Test  #97: MaxFlow.SinglePath_ShortestPathEquivalence ........................................   Passed    0.00 sec
-        Start 124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest
-102/170 Test  #90: FlowGraph.CoalescesDuplicateEdgeIds ...............................................   Passed    0.00 sec
-        Start 131: MaxFlow.Sensitivity_PartialSaturation
-103/170 Test #146: MaskingTests.MaskedSourceReturnsEmptyDAG ..........................................   Passed    0.00 sec
-        Start 110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly
-104/170 Test  #28: StrictMultiDiGraph.MismatchedArrayLengthsThrow ....................................   Passed    0.00 sec
-        Start 129: MaxFlow.Sensitivity_SinglePath
-105/170 Test #124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest .................................   Passed    0.00 sec
-        Start 120: MaxFlow.EdgeMask_SelectiveEdgeFiltering
-106/170 Test #131: MaxFlow.Sensitivity_PartialSaturation .............................................   Passed    0.00 sec
-        Start  45: ShortestPaths.PreferHigherResidualTieBreak
-107/170 Test #110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly ..................................   Passed    0.00 sec
-        Start  25: StrictMultiDiGraph.MaxCapacityEdges
-108/170 Test #129: MaxFlow.Sensitivity_SinglePath ....................................................   Passed    0.00 sec
-        Start  57: FlowState.InitialResidualEqualsCapacity
-109/170 Test #120: MaxFlow.EdgeMask_SelectiveEdgeFiltering ...........................................   Passed    0.00 sec
-        Start 123: MaxFlow.SharedBottleneck_MultiplePathsMerge
-110/170 Test  #45: ShortestPaths.PreferHigherResidualTieBreak ........................................   Passed    0.00 sec
-        Start  40: ShortestPaths.NodeMaskIsolation
-111/170 Test  #25: StrictMultiDiGraph.MaxCapacityEdges ...............................................   Passed    0.00 sec
-        Start 125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest
-112/170 Test  #57: FlowState.InitialResidualEqualsCapacity ...........................................   Passed    0.00 sec
-        Start 128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths
-113/170 Test #123: MaxFlow.SharedBottleneck_MultiplePathsMerge .......................................   Passed    0.00 sec
-        Start 159: MaskingTests.ResidualAndNodeMaskCombined
-114/170 Test  #40: ShortestPaths.NodeMaskIsolation ...................................................   Passed    0.00 sec
-        Start  74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero
-115/170 Test #125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest ................................   Passed    0.00 sec
-        Start 147: MaskingTests.MaskedSourceWithDestination
-116/170 Test #128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths ................................   Passed    0.00 sec
-        Start  70: FlowState.EqualBalancedReconvergentDAGPlacesAll
-117/170 Test #159: MaskingTests.ResidualAndNodeMaskCombined ..........................................   Passed    0.00 sec
-        Start  84: FlowGraph.PlacementCreatesEntry
-118/170 Test  #74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero ....................   Passed    0.00 sec
-        Start  62: FlowState.ApplyDeltasAdditive
-119/170 Test #147: MaskingTests.MaskedSourceWithDestination ..........................................   Passed    0.00 sec
-        Start  65: FlowState.ResetRestoresCapacity
-120/170 Test  #70: FlowState.EqualBalancedReconvergentDAGPlacesAll ...................................   Passed    0.00 sec
-        Start  19: StrictMultiDiGraph.SingleEdge
-121/170 Test  #84: FlowGraph.PlacementCreatesEntry ...................................................   Passed    0.00 sec
-        Start 139: KShortestPaths.MaxCostFactorLimit
-122/170 Test  #62: FlowState.ApplyDeltasAdditive .....................................................   Passed    0.00 sec
-        Start  30: StrictMultiDiGraph.OutOfRangeNodeThrows
-123/170 Test  #65: FlowState.ResetRestoresCapacity ...................................................   Passed    0.00 sec
-        Start  60: FlowState.EqualBalancedDistribution
-124/170 Test  #19: StrictMultiDiGraph.SingleEdge .....................................................   Passed    0.00 sec
-        Start 151: MaskingTests.MaskedDestinationUnreachable
-125/170 Test #139: KShortestPaths.MaxCostFactorLimit .................................................   Passed    0.00 sec
-        Start  96: MaxFlow.SinglePath_BottleneckConstraint
-126/170 Test  #30: StrictMultiDiGraph.OutOfRangeNodeThrows ...........................................   Passed    0.00 sec
-        Start  66: FlowState.CustomInitialResidual
-127/170 Test  #60: FlowState.EqualBalancedDistribution ...............................................   Passed    0.00 sec
-        Start 101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath
-128/170 Test #151: MaskingTests.MaskedDestinationUnreachable .........................................   Passed    0.00 sec
-        Start 115: MaxFlow.FlowConservation_IntermediateNodes
-129/170 Test  #96: MaxFlow.SinglePath_BottleneckConstraint ...........................................   Passed    0.00 sec
-        Start 102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath
-130/170 Test  #66: FlowState.CustomInitialResidual ...................................................   Passed    0.00 sec
-        Start  26: StrictMultiDiGraph.ZeroCostEdges
-131/170 Test #101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath ..................................   Passed    0.00 sec
-        Start  95: MaxFlow.SinglePath_BasicLinear
-132/170 Test #115: MaxFlow.FlowConservation_IntermediateNodes ........................................   Passed    0.00 sec
-        Start  72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges
-133/170 Test #102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath .................................   Passed    0.00 sec
-        Start  98: MaxFlow.DegenerateCase_SourceEqualsSink
-134/170 Test  #26: StrictMultiDiGraph.ZeroCostEdges ..................................................   Passed    0.00 sec
-        Start  86: FlowGraph.RemoveByClassFiltersCorrectly
-135/170 Test  #95: MaxFlow.SinglePath_BasicLinear ....................................................   Passed    0.00 sec
-        Start  73: FlowState.EqualBalanced_DownstreamSplitEqualization
-136/170 Test  #72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges ..............   Passed    0.00 sec
-        Start 119: MaxFlow.NodeMask_BlocksFlowThroughNode
-137/170 Test  #98: MaxFlow.DegenerateCase_SourceEqualsSink ...........................................   Passed    0.00 sec
-        Start  85: FlowGraph.RemovalDeletesEntry
-138/170 Test  #86: FlowGraph.RemoveByClassFiltersCorrectly ...........................................   Passed    0.00 sec
-        Start  87: FlowGraph.GetFlowEdgesReturnsDeltas
-139/170 Test  #73: FlowState.EqualBalanced_DownstreamSplitEqualization ...............................   Passed    0.00 sec
-        Start 163: MaskingTests.MaxFlowWithEdgeMask
-140/170 Test #119: MaxFlow.NodeMask_BlocksFlowThroughNode ............................................   Passed    0.00 sec
-        Start 164: MaskingTests.MaxFlowAllPathsMasked
-141/170 Test  #85: FlowGraph.RemovalDeletesEntry .....................................................   Passed    0.00 sec
-        Start 165: MaskingTests.EmptyNodeMaskAllowsAllNodes
-142/170 Test  #87: FlowGraph.GetFlowEdgesReturnsDeltas ...............................................   Passed    0.00 sec
-        Start  12: FlowPolicyStatic.PerFlowBundleBinding
-143/170 Test #163: MaskingTests.MaxFlowWithEdgeMask ..................................................   Passed    0.00 sec
-        Start 169: MaskingTests.AlgorithmsAPIMaskedSource
-144/170 Test #164: MaskingTests.MaxFlowAllPathsMasked ................................................   Passed    0.00 sec
-        Start  13: FlowPolicyStatic.MaskedBundleIsDown
-145/170 Test #165: MaskingTests.EmptyNodeMaskAllowsAllNodes ..........................................   Passed    0.00 sec
-        Start  15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast
-146/170 Test  #12: FlowPolicyStatic.PerFlowBundleBinding .............................................   Passed    0.00 sec
-        Start  14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles
-147/170 Test #169: MaskingTests.AlgorithmsAPIMaskedSource ............................................   Passed    0.00 sec
-        Start  55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected
-148/170 Test  #13: FlowPolicyStatic.MaskedBundleIsDown ...............................................   Passed    0.00 sec
-        Start  51: ShortestPathsTo.DistancesMatchForwardDistancesToDst
-149/170 Test  #15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast ...   Passed    0.00 sec
-        Start 166: MaskingTests.EmptyEdgeMaskAllowsAllEdges
-150/170 Test  #14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles ...................   Passed    0.00 sec
-        Start  81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops
-151/170 Test  #55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected ..................................   Passed    0.00 sec
-        Start  79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops
-152/170 Test  #51: ShortestPathsTo.DistancesMatchForwardDistancesToDst ...............................   Passed    0.00 sec
-        Start  82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger
-153/170 Test #166: MaskingTests.EmptyEdgeMaskAllowsAllEdges ..........................................   Passed    0.00 sec
-        Start  16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping
-154/170 Test  #81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops .....................   Passed    0.00 sec
-        Start  52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource
-155/170 Test  #79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops ..............................   Passed    0.00 sec
-        Start 170: MaskingTests.AlgorithmsAPIMaxFlowWithMask
-156/170 Test  #82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger .......................   Passed    0.00 sec
-        Start  94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal
-157/170 Test  #16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping ....   Passed    0.00 sec
-        Start 167: MaskingTests.AllNodesMaskedNoReachability
-158/170 Test  #52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource ..................   Passed    0.00 sec
-        Start 168: MaskingTests.AllEdgesMaskedNoReachability
-159/170 Test #170: MaskingTests.AlgorithmsAPIMaxFlowWithMask .........................................   Passed    0.00 sec
-        Start  80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream
-160/170 Test  #94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal ..........................   Passed    0.00 sec
-        Start  53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag
-161/170 Test #167: MaskingTests.AllNodesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start  93: FlowGraphStamp.CopiesAndMovesGetFreshUids
-162/170 Test #168: MaskingTests.AllEdgesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start 145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK
-163/170 Test  #80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream ..........................   Passed    0.00 sec
-        Start  77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission
-164/170 Test  #53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag .............................   Passed    0.00 sec
-        Start  54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads
-165/170 Test  #93: FlowGraphStamp.CopiesAndMovesGetFreshUids .........................................   Passed    0.00 sec
-        Start  78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf
-166/170 Test #145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK .....................................   Passed    0.00 sec
-        Start  56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode
-167/170 Test  #77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission ............................   Passed    0.00 sec
-168/170 Test  #54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads ..............................   Passed    0.00 sec
-169/170 Test  #78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf .....................   Passed    0.00 sec
-170/170 Test  #56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode ............................   Passed    0.00 sec
-
-100% tests passed out of 170
-
-Total Test time (real) =   0.13 sec
-........................................................................ [ 15%]
-........................................................................ [ 30%]
-........................................................................ [ 46%]
-........................................................................ [ 61%]
-........................................................................ [ 77%]
-........................................................................ [ 92%]
-.................................                                        [100%]
-465 passed in 3.91s
diff --git a/dev/research/metal_pathfinding/optimization/run_aba.sh b/dev/research/metal_pathfinding/optimization/run_aba.sh
deleted file mode 100644
index 7c041d9..0000000
--- a/dev/research/metal_pathfinding/optimization/run_aba.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# Run sequentially on the same machine. Do not overlap with builds or tests.
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-out=${1:-dev/research/metal_pathfinding/optimization/results/aba}
-mkdir -p "$out"
-unset NGRAPH_CORE_PROFILE
-{
-  date -u '+%Y-%m-%dT%H:%M:%SZ'
-  git rev-parse HEAD
-  sw_vers
-  sysctl -n machdep.cpu.brand_string hw.memsize hw.ncpu
-  xcrun clang++ --version
-  shasum -a 256 dev/research/metal_pathfinding/experiment.mm dev/research/metal_pathfinding/sssp.metal \
-    dev/research/metal_pathfinding/optimization/experiment.mm dev/research/metal_pathfinding/optimization/kernels.metal \
-    build/metal_pathfinding/optimized
-  pmset -g therm
-} > "$out/environment.txt"
-for phase in cpu-a1 base-a1 optimized-b base-a2 cpu-a2; do
-  top -l 2 -n 8 -o cpu -stats pid,command,cpu,threads > "$out/load-$phase.txt"
-  ioreg -r -c AGXAccelerator -l | sed -n '/"PerformanceStatistics"/p' > "$out/gpu-load-$phase.txt"
-  case "$phase" in
-    cpu-*) mode=cpu ;;
-    base-*) mode=base ;;
-    optimized-b) mode=optimized ;;
-  esac
-  date -u '+%Y-%m-%dT%H:%M:%SZ' > "$out/time-$phase.txt"
-  build/metal_pathfinding/optimized "$mode" full 7 > "$out/$phase.csv" 2> "$out/$phase-stderr.txt"
-  date -u '+%Y-%m-%dT%H:%M:%SZ' >> "$out/time-$phase.txt"
-done
diff --git a/dev/research/metal_pathfinding/optimization/run_cpu_aba.sh b/dev/research/metal_pathfinding/optimization/run_cpu_aba.sh
deleted file mode 100644
index a15f747..0000000
--- a/dev/research/metal_pathfinding/optimization/run_cpu_aba.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")/../../.."
-out=dev/research/metal_pathfinding/optimization/results/cpu-algorithms-aba
-mkdir -p "$out"
-unset NGRAPH_CORE_PROFILE
-{
-  date -u '+%Y-%m-%dT%H:%M:%SZ'
-  git rev-parse HEAD
-  shasum -a 256 dev/research/metal_pathfinding/optimization/cpu_algorithms.mm \
-    build/metal_pathfinding/cpu-algorithms build/metal_pathfinding/optimized
-} > "$out/environment.txt"
-for phase in a1 b a2; do
-  top -l 2 -n 8 -o cpu -stats pid,command,cpu,threads > "$out/load-$phase.txt"
-  ioreg -r -c AGXAccelerator -l | sed -n '/"PerformanceStatistics"/p' > "$out/gpu-load-$phase.txt"
-  if [[ $phase == b ]]; then
-    build/metal_pathfinding/optimized optimized full 7 > "$out/$phase.csv" 2> "$out/$phase-stderr.txt"
-  else
-    build/metal_pathfinding/cpu-algorithms 7 > "$out/$phase.csv" 2> "$out/$phase-stderr.txt"
-  fi
-done
diff --git a/dev/research/metal_pathfinding/optimization/summarize.py b/dev/research/metal_pathfinding/optimization/summarize.py
deleted file mode 100644
index 2dd648f..0000000
--- a/dev/research/metal_pathfinding/optimization/summarize.py
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-"""Produce auditable tables from all five sequential benchmark phases."""
-
-import csv
-import json
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parent / "results" / "aba"
-PHASES = ("cpu-a1", "base-a1", "optimized-b", "base-a2", "cpu-a2")
-rows = {p: list(csv.DictReader((ROOT / f"{p}.csv").open())) for p in PHASES}
-assert [len(rows[p]) for p in PHASES] == [48, 36, 216, 36, 48]
-assert all(r["correct"] == "pass" for rs in rows.values() for r in rs)
-
-
-def key(r):
-    return tuple(r[k] for k in ("case", "n", "e", "queries"))
-
-
-def table(phase, case):
-    return {r["method"]: r for r in rows[phase] if key(r) == case}
-
-
-def elapsed(r):
-    return float(r["wall_ms"])
-
-
-keys = list(dict.fromkeys(key(r) for r in rows["optimized-b"]))
-lines = [
-    "# Exploratory A/B/A measurements",
-    "",
-    "Warm full-result latency in ms, including host distances and positive-cost predecessor DAG. "
-    "Seven measured samples plus two checked warmups per row. CPU batches use 10 reusable workers. "
-    "Best variant is selected after measurement; this is an oracle comparison, not an implemented dispatcher. "
-    "Old GPU columns cover the original pull and group variants; the shared-memory variant was not rerun. "
-    "The machine was not isolated; these are not accepted performance claims.",
-    "",
-    "| Case | N / E / Q | CPU full A1 / A2 | Old GPU A1 / A2 | Best tested optimized GPU | ms | CPU BFS full A1 / A2 |",
-    "|---|---:|---:|---:|---|---:|---:|",
-]
-summary = []
-for k in keys:
-    ca, cb, a, b, c = (
-        table(p, k) for p in ("cpu-a1", "cpu-a2", "base-a1", "optimized-b", "base-a2")
-    )
-    # Choose one old algorithm by its mean of A1/A2, then show both measurements.
-    old = min(a, key=lambda name: (elapsed(a[name]) + elapsed(c[name])) / 2)
-    best = min(b, key=lambda name: elapsed(b[name]))
-    best_label = best + (
-        " (64-bit pull fallback)" if b[best]["fallback64"] == "1" else ""
-    )
-    bfs = (
-        f"{elapsed(ca['cpu_bfs_full']):.3f} / {elapsed(cb['cpu_bfs_full']):.3f}"
-        if "cpu_bfs_full" in ca
-        else "—"
-    )
-    lines.append(
-        f"| {k[0]} | {' / '.join(k[1:])} | {elapsed(ca['cpu_full']):.3f} / {elapsed(cb['cpu_full']):.3f} | "
-        f"{elapsed(a[old]):.3f} / {elapsed(c[old]):.3f} | {best_label} | {elapsed(b[best]):.3f} | {bfs} |"
-    )
-    summary.append(
-        {
-            "case": k,
-            "cpu_a1": elapsed(ca["cpu_full"]),
-            "cpu_a2": elapsed(cb["cpu_full"]),
-            "old_method": old,
-            "old_a1": elapsed(a[old]),
-            "old_a2": elapsed(c[old]),
-            "best": b[best],
-        }
-    )
-
-lines += [
-    "",
-    "## All optimized variants",
-    "",
-    "No variants omitted. Columns: full wall / distance wall / device work, ms. "
-    "Device work includes DAG kernels where selected. Edge visits count SSSP adjacency entries, "
-    "excluding bucket vertex scans, queue management and DAG extraction.",
-    "",
-]
-for k in keys:
-    lines += [
-        f"### {k}",
-        "",
-        "| Variant | Full / distance / device ms | Edge visits | Rounds | Host waits | 64-bit fallback |",
-        "|---|---:|---:|---:|---:|---|",
-    ]
-    for r in table("optimized-b", k).values():
-        times = " / ".join(
-            f"{float(r[f]):.3f}" for f in ("wall_ms", "distance_ms", "gpu_ms")
-        )
-        lines.append(
-            f"| {r['method']} | {times} | {r['edge_visits']} | {r['rounds']} | {r['waits']} | {r['fallback64']} |"
-        )
-
-checks = sum(
-    (int(r["samples"]) + 2) * int(r["queries"]) for rs in rows.values() for r in rs
-)
-audit = {
-    "phase_rows": {p: len(rs) for p, rs in rows.items()},
-    "checked_query_results": checks,
-    "summary": summary,
-}
-(ROOT / "summary.md").write_text("\n".join(lines) + "\n")
-(ROOT / "summary.json").write_text(json.dumps(audit, indent=2) + "\n")
-print(json.dumps({k: v for k, v in audit.items() if k != "summary"}, indent=2))
diff --git a/dev/research/metal_pathfinding/optimization/summarize_cpu.py b/dev/research/metal_pathfinding/optimization/summarize_cpu.py
deleted file mode 100644
index b815c3d..0000000
--- a/dev/research/metal_pathfinding/optimization/summarize_cpu.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""Stronger CPU algorithm comparison; no production-dispatch claim."""
-
-import csv
-import json
-from pathlib import Path
-
-root = Path(__file__).resolve().parent / "results/cpu-algorithms-aba"
-data = {p: list(csv.DictReader((root / f"{p}.csv").open())) for p in ("a1", "b", "a2")}
-assert [len(v) for v in data.values()] == [14, 216, 14]
-assert all(r["correct"] == "pass" for rs in data.values() for r in rs)
-
-
-def key(row):
-    return tuple(row[k] for k in ("case", "n", "e", "queries"))
-
-
-lines = [
-    "# Stronger CPU algorithm A/B/A",
-    "",
-    "All methods include exact distances and canonical-equivalent positive-cost DAG edge sets. "
-    "CPU batches use 10 workers. Eligibility is cached outside timing for both devices. "
-    "Seven measured samples and two checked warmups. These remain exploratory, "
-    "non-isolated desktop measurements. GPU choice is an oracle across 12 tested variants.",
-    "",
-    "| Case / N / E / Q | Cached heap + DAG A1 / A2 ms | Dial + DAG A1 / A2 ms | Best GPU B ms | GPU method |",
-    "|---|---:|---:|---:|---|",
-]
-summary = []
-for k in dict.fromkeys(key(r) for r in data["a1"]):
-    phases = [
-        {r["method"]: r for r in data[p] if key(r) == k} for p in ("a1", "b", "a2")
-    ]
-    a, b, c = phases
-    best = min(b.values(), key=lambda r: float(r["wall_ms"]))
-    heap = [float(p["cpu_heap_cached_full"]["wall_ms"]) for p in (a, c)]
-    dial = [float(p["cpu_dial_full"]["wall_ms"]) for p in (a, c)]
-    lines.append(
-        f"| {' / '.join(k)} | {heap[0]:.3f} / {heap[1]:.3f} | {dial[0]:.3f} / {dial[1]:.3f} | "
-        f"{float(best['wall_ms']):.3f} | {best['method']} |"
-    )
-    summary.append(
-        {"case": k, "heap_a1_a2": heap, "dial_a1_a2": dial, "best_gpu": best}
-    )
-audit = {
-    "phase_rows": {p: len(v) for p, v in data.items()},
-    "checked_query_results": sum(
-        (int(r["samples"]) + 2) * int(r["queries"]) for rs in data.values() for r in rs
-    ),
-    "summary": summary,
-}
-(root / "summary.md").write_text("\n".join(lines) + "\n")
-(root / "summary.json").write_text(json.dumps(audit, indent=2) + "\n")
-print("\n".join(lines))
diff --git a/dev/research/metal_pathfinding/results/aba-initial/a1-stderr.txt b/dev/research/metal_pathfinding/results/aba-initial/a1-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/aba-initial/a1.csv b/dev/research/metal_pathfinding/results/aba-initial/a1.csv
deleted file mode 100644
index f250b80..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/a1.csv
+++ /dev/null
@@ -1,82 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.009625,0.000000,0.009625,0.000000,0,9,pass,1,0.009625;0.010542;0.010041;0.013500;0.010292;0.009458;0.009291;0.009250;0.009208
-random,128,1024,1,cpu_distance,0.004541,0.000000,0.004541,0.000000,0,9,pass,0,0.004583;0.005666;0.004417;0.004625;0.004250;0.006458;0.004541;0.004208;0.004167
-random,128,1024,1,cpu_pool10,0.029750,0.000000,0.029750,0.000000,0,9,pass,1,0.030792;0.043125;0.032708;0.027000;0.029750;0.026875;0.034250;0.027000;0.026625
-random,128,1024,64,cpu_full,0.955250,0.000000,0.955250,0.000000,0,9,pass,64,0.973292;0.945083;0.904875;0.882041;1.075791;0.956416;0.955250;0.977375;0.870959
-random,128,1024,64,cpu_distance,0.351959,0.000000,0.351959,0.000000,0,9,pass,0,0.401375;0.351959;0.340208;0.476250;0.456208;0.379709;0.338625;0.344334;0.308541
-random,128,1024,64,cpu_pool10,0.182417,0.000000,0.182417,0.000000,0,9,pass,64,0.182417;0.176833;0.174542;0.182917;0.191750;0.184291;0.197500;0.167458;0.162833
-random,1024,8192,1,cpu_full,0.103583,0.000000,0.103583,0.000000,0,9,pass,1,0.109833;0.110000;0.099291;0.105625;0.104000;0.102792;0.099458;0.102125;0.103583
-random,1024,8192,1,cpu_distance,0.055541,0.000000,0.055541,0.000000,0,9,pass,0,0.059083;0.051542;0.055333;0.055208;0.055541;0.055375;0.055625;0.055833;0.056209
-random,1024,8192,1,cpu_pool10,0.193125,0.000000,0.193125,0.000000,0,9,pass,1,0.200667;0.229666;0.191083;0.194792;0.193125;0.195459;0.165708;0.161917;0.173542
-random,1024,8192,64,cpu_full,10.685667,0.000000,10.685667,0.000000,0,9,pass,64,10.749791;10.777292;11.154708;10.834875;10.685667;10.563875;10.571209;10.589625;10.627750
-random,1024,8192,64,cpu_distance,5.053459,0.000000,5.053459,0.000000,0,9,pass,0,5.145083;5.053459;5.062084;4.993875;5.026833;5.019416;5.055542;4.969833;5.108583
-random,1024,8192,64,cpu_pool10,1.342375,0.000000,1.342375,0.000000,0,9,pass,64,1.372375;1.342916;1.342375;1.338708;1.318542;1.342916;1.354417;1.335167;1.315708
-fabric,288,16384,1,cpu_full,0.112333,0.000000,0.112333,0.000000,0,9,pass,1,0.115083;0.119833;0.110375;0.112667;0.112333;0.118125;0.109709;0.109792;0.109708
-fabric,288,16384,1,cpu_distance,0.023291,0.000000,0.023291,0.000000,0,9,pass,0,0.023709;0.023667;0.023291;0.023542;0.023291;0.023042;0.023208;0.023166;0.023166
-fabric,288,16384,1,cpu_pool10,0.137583,0.000000,0.137583,0.000000,0,9,pass,1,0.135875;0.135667;0.144417;0.132500;0.137583;0.156500;0.146000;0.136291;0.141125
-fabric,288,16384,64,cpu_full,7.318958,0.000000,7.318958,0.000000,0,9,pass,64,7.419667;7.295250;7.297250;7.489000;7.299334;7.340666;7.318958;7.284542;7.324916
-fabric,288,16384,64,cpu_distance,1.489125,0.000000,1.489125,0.000000,0,9,pass,0,1.489125;1.524542;1.487041;1.499584;1.499292;1.478625;1.510084;1.482750;1.483875
-fabric,288,16384,64,cpu_pool10,0.972167,0.000000,0.972167,0.000000,0,9,pass,64,1.685792;1.140875;0.951709;0.972167;0.977500;0.942208;0.959334;0.916959;0.985417
-grid,1024,3968,1,cpu_full,0.043667,0.000000,0.043667,0.000000,0,9,pass,1,0.045750;0.044542;0.043792;0.043459;0.043583;0.044042;0.043625;0.043541;0.043667
-grid,1024,3968,1,cpu_distance,0.011666,0.000000,0.011666,0.000000,0,9,pass,0,0.012583;0.012042;0.012041;0.011791;0.011666;0.011625;0.011500;0.011542;0.011542
-grid,1024,3968,1,cpu_pool10,0.077875,0.000000,0.077875,0.000000,0,9,pass,1,0.088542;0.068417;0.079375;0.062125;0.084667;0.065500;0.078959;0.077875;0.073916
-grid,1024,3968,64,cpu_full,4.005584,0.000000,4.005584,0.000000,0,9,pass,64,4.005584;3.977000;3.994834;3.970583;4.010875;3.966208;4.044791;4.030375;4.086625
-grid,1024,3968,64,cpu_distance,0.894833,0.000000,0.894833,0.000000,0,9,pass,0,0.925833;0.907000;0.899000;0.894833;0.883292;0.896833;0.878750;0.873041;0.874166
-grid,1024,3968,64,cpu_pool10,0.543500,0.000000,0.543500,0.000000,0,9,pass,64,0.584208;0.566875;0.534833;0.544125;0.531250;0.543500;0.529166;0.552875;0.524417
-chain,256,255,1,cpu_full,0.002542,0.000000,0.002542,0.000000,0,9,pass,1,0.002583;0.002542;0.002583;0.002542;0.003458;0.002667;0.002542;0.002500;0.002541
-chain,256,255,1,cpu_distance,0.000708,0.000000,0.000708,0.000000,0,9,pass,0,0.000708;0.000750;0.000708;0.000709;0.000708;0.000750;0.000708;0.000750;0.000708
-chain,256,255,1,cpu_pool10,0.033958,0.000000,0.033958,0.000000,0,9,pass,1,0.039125;0.039375;0.037292;0.036167;0.031041;0.033958;0.033625;0.027333;0.029000
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.581833,0.000000,0.581833,0.000000,0,9,pass,8,0.692791;0.630583;0.611625;0.585000;0.571125;0.565667;0.559791;0.581833;0.555459
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.303917,0.000000,0.303917,0.000000,0,9,pass,0,0.377291;0.438458;0.395125;0.336584;0.303917;0.289917;0.274959;0.279542;0.270875
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.155667,0.000000,0.155667,0.000000,0,9,pass,8,0.154292;0.167333;0.155667;0.155042;0.157458;0.156000;0.155875;0.147917;0.152875
-random,4096,32768,1,cpu_full,0.656542,0.000000,0.656542,0.000000,0,9,pass,1,0.689083;0.693500;0.656542;0.645666;0.662417;0.637500;0.638250;0.636042;0.790125
-random,4096,32768,1,cpu_distance,0.308542,0.000000,0.308542,0.000000,0,9,pass,0,0.338750;0.325250;0.317625;0.308542;0.304625;0.309916;0.303500;0.303042;0.303000
-random,4096,32768,1,cpu_pool10,0.814208,0.000000,0.814208,0.000000,0,9,pass,1,0.826042;0.869667;0.814208;0.765917;0.765084;0.855791;0.743833;0.829917;0.749625
-random,4096,32768,64,cpu_full,52.554875,0.000000,52.554875,0.000000,0,9,pass,64,52.386917;53.197958;52.959833;52.357667;52.261083;51.995125;59.360875;52.554875;52.678667
-random,4096,32768,64,cpu_distance,26.269750,0.000000,26.269750,0.000000,0,9,pass,0,25.927500;26.269750;26.294709;26.415583;26.370750;26.258458;26.318584;26.239250;26.028667
-random,4096,32768,64,cpu_pool10,5.992416,0.000000,5.992416,0.000000,0,9,pass,64,6.017250;6.053250;5.905542;5.941042;5.959459;5.969500;6.017750;6.285584;5.992416
-random,4096,32768,256,cpu_full,208.676542,0.000000,208.676542,0.000000,0,9,pass,256,208.676542;208.153584;208.156916;208.801833;208.602375;208.752792;208.467208;209.713875;210.652583
-random,4096,32768,256,cpu_distance,106.272833,0.000000,106.272833,0.000000,0,9,pass,0,107.689542;106.997833;106.701375;106.272833;105.206709;106.373917;105.998542;104.856041;104.854167
-random,4096,32768,256,cpu_pool10,23.000917,0.000000,23.000917,0.000000,0,9,pass,256,23.054250;23.179708;23.387250;23.000917;22.925084;23.250125;22.768375;22.927834;22.826625
-random,16384,131072,1,cpu_full,3.887250,0.000000,3.887250,0.000000,0,9,pass,1,3.887250;3.999084;3.780250;4.507709;3.907583;3.710875;3.958666;3.830917;3.877834
-random,16384,131072,1,cpu_distance,1.934458,0.000000,1.934458,0.000000,0,9,pass,0,1.934458;1.881542;1.868917;1.983458;2.134000;1.985167;1.920750;1.881125;1.985209
-random,16384,131072,1,cpu_pool10,3.823917,0.000000,3.823917,0.000000,0,9,pass,1,3.823917;3.839416;3.736166;3.679167;3.695708;3.719167;4.268541;3.980250;3.967292
-random,16384,131072,64,cpu_full,256.127917,0.000000,256.127917,0.000000,0,9,pass,64,259.340500;260.231959;254.190417;252.847166;253.639917;258.855125;261.257792;256.016375;256.127917
-random,16384,131072,64,cpu_distance,134.498459,0.000000,134.498459,0.000000,0,9,pass,0,135.160625;136.307417;137.394250;133.758792;133.098583;134.069500;135.485167;133.665375;134.498459
-random,16384,131072,64,cpu_pool10,28.586375,0.000000,28.586375,0.000000,0,9,pass,64,30.187666;28.698666;28.505708;28.563916;28.892208;28.586375;28.463583;28.565541;28.662417
-random,65536,524288,1,cpu_full,22.864166,0.000000,22.864166,0.000000,0,9,pass,1,21.392875;21.666875;22.864166;23.888750;23.744625;23.006084;24.381000;22.531041;22.057541
-random,65536,524288,1,cpu_distance,12.154417,0.000000,12.154417,0.000000,0,9,pass,0,12.221916;13.038792;11.681125;11.504500;12.697750;12.154417;11.320417;11.733250;12.544542
-random,65536,524288,1,cpu_pool10,22.800125,0.000000,22.800125,0.000000,0,9,pass,1,21.551917;21.493292;23.056834;25.353791;23.876125;22.366334;22.800125;23.572000;22.615292
-random,65536,524288,64,cpu_full,1421.675417,0.000000,1421.675417,0.000000,0,9,pass,64,1543.694875;1501.052792;1482.006208;1432.981166;1320.893792;1328.868667;1355.810834;1421.675417;1337.125625
-random,65536,524288,64,cpu_distance,703.276375,0.000000,703.276375,0.000000,0,9,pass,0,703.276375;719.258750;726.684250;682.657208;697.282959;699.636458;698.637625;704.775709;735.197208
-random,65536,524288,64,cpu_pool10,181.873958,0.000000,181.873958,0.000000,0,9,pass,64,216.777750;186.447958;180.352792;178.576708;181.873958;181.106500;200.742167;186.728833;179.152250
-chain,2048,2047,1,cpu_full,0.019667,0.000000,0.019667,0.000000,0,9,pass,1,0.020125;0.019708;0.019792;0.019459;0.019666;0.019667;0.019542;0.019792;0.019625
-chain,2048,2047,1,cpu_distance,0.004792,0.000000,0.004792,0.000000,0,9,pass,0,0.004958;0.004958;0.004750;0.004792;0.004750;0.004875;0.004792;0.004750;0.004792
-chain,2048,2047,1,cpu_pool10,0.039333,0.000000,0.039333,0.000000,0,9,pass,1,0.041000;0.039125;0.041083;0.039333;0.040666;0.037292;0.039333;0.046417;0.036500
-random,4096,131072,1,cpu_full,1.539625,0.000000,1.539625,0.000000,0,9,pass,1,1.592417;1.600542;1.556292;1.554000;1.539625;1.523500;1.516333;1.535500;1.528833
-random,4096,131072,1,cpu_distance,0.666250,0.000000,0.666250,0.000000,0,9,pass,0,0.706750;0.693500;0.686750;0.677958;0.666250;0.652625;0.647209;0.664459;0.643875
-random,4096,131072,1,cpu_pool10,1.721000,0.000000,1.721000,0.000000,0,9,pass,1,1.796875;1.732167;1.728875;1.721000;1.672791;1.717584;1.651584;1.774958;1.618333
-random,4096,131072,64,cpu_full,112.114083,0.000000,112.114083,0.000000,0,9,pass,64,111.754667;111.104792;111.502500;113.248167;112.114083;112.117750;111.657959;114.661000;112.451209
-random,4096,131072,64,cpu_distance,51.198125,0.000000,51.198125,0.000000,0,9,pass,0,49.981584;50.728417;51.871583;51.198125;51.291833;51.193459;51.875625;51.237041;50.593625
-random,4096,131072,64,cpu_pool10,12.856917,0.000000,12.856917,0.000000,0,9,pass,64,12.974625;12.898958;12.780333;12.824459;12.889000;12.811291;12.853333;12.886750;12.856917
-clos,200,20000,1,cpu_full,0.138708,0.000000,0.138708,0.000000,0,9,pass,1,0.138708;0.149834;0.137584;0.154875;0.147750;0.136250;0.147416;0.135417;0.138166
-clos,200,20000,1,cpu_distance,0.026292,0.000000,0.026292,0.000000,0,9,pass,0,0.026792;0.026375;0.026500;0.026292;0.026500;0.026167;0.026084;0.026042;0.026041
-clos,200,20000,1,cpu_pool10,0.178667,0.000000,0.178667,0.000000,0,9,pass,1,0.177917;0.182833;0.184334;0.175625;0.177000;0.183333;0.175875;0.190459;0.178667
-clos,200,20000,64,cpu_full,9.340000,0.000000,9.340000,0.000000,0,9,pass,64,9.371333;9.260542;9.368500;9.340000;9.502042;9.128083;9.156166;9.015542;9.563584
-clos,200,20000,64,cpu_distance,1.710250,0.000000,1.710250,0.000000,0,9,pass,0,1.794083;1.683042;1.691042;1.641416;1.694916;1.710250;1.843750;1.870708;1.763125
-clos,200,20000,64,cpu_pool10,1.167167,0.000000,1.167167,0.000000,0,9,pass,64,1.182834;1.245250;1.187375;1.099833;1.137916;1.167167;1.148208;1.165625;1.731666
-clos,800,320000,1,cpu_full,2.314167,0.000000,2.314167,0.000000,0,9,pass,1,2.304125;2.335583;2.282750;2.279792;2.288334;2.317416;2.326666;2.346875;2.314167
-clos,800,320000,1,cpu_distance,0.390042,0.000000,0.390042,0.000000,0,9,pass,0,0.390083;0.390042;0.398333;0.388583;0.392167;0.391667;0.388792;0.388875;0.388125
-clos,800,320000,1,cpu_pool10,2.355708,0.000000,2.355708,0.000000,0,9,pass,1,2.373750;2.368833;2.333166;2.329875;2.329166;2.355708;2.335834;2.391833;2.362042
-clos,800,320000,64,cpu_full,148.903625,0.000000,148.903625,0.000000,0,9,pass,64,149.844708;148.332833;150.863708;148.481791;151.271416;148.695625;148.903625;152.917459;148.691292
-clos,800,320000,64,cpu_distance,25.264916,0.000000,25.264916,0.000000,0,9,pass,0,25.148333;25.201625;25.167250;25.264916;25.292417;25.266916;25.295417;25.364708;25.206833
-clos,800,320000,64,cpu_pool10,17.328375,0.000000,17.328375,0.000000,0,9,pass,64,18.354167;17.193458;17.347083;17.145083;17.328375;17.167541;19.327292;17.145500;18.241875
-grid,10000,39600,1,cpu_full,0.631166,0.000000,0.631166,0.000000,0,9,pass,1,0.641042;0.623083;0.630083;0.616125;0.680375;0.640584;0.621459;0.631166;0.754208
-grid,10000,39600,1,cpu_distance,0.182417,0.000000,0.182417,0.000000,0,9,pass,0,0.188542;0.196792;0.183292;0.181959;0.179708;0.177833;0.181458;0.182417;0.195750
-grid,10000,39600,1,cpu_pool10,0.714292,0.000000,0.714292,0.000000,0,9,pass,1,0.722417;0.714292;0.669083;0.710083;0.645125;0.737000;0.663958;0.759166;0.755875
-grid,10000,39600,8,cpu_full,5.696250,0.000000,5.696250,0.000000,0,9,pass,8,5.774709;5.671333;5.712750;5.640375;5.724584;5.615833;5.616584;5.876000;5.696250
-grid,10000,39600,8,cpu_distance,1.624167,0.000000,1.624167,0.000000,0,9,pass,0,1.595875;1.640416;1.586875;1.601542;1.711625;1.624167;1.673875;1.597875;1.698792
-grid,10000,39600,8,cpu_pool10,0.852250,0.000000,0.852250,0.000000,0,9,pass,8,0.852250;1.229500;0.813333;0.819625;1.231458;0.918666;1.240458;0.833500;0.845583
-grid,40000,159200,1,cpu_full,2.919000,0.000000,2.919000,0.000000,0,9,pass,1,3.025375;2.919000;2.934042;2.914209;2.914000;2.943083;2.907625;2.919334;2.887459
-grid,40000,159200,1,cpu_distance,0.868708,0.000000,0.868708,0.000000,0,9,pass,0,0.874583;0.868708;0.870375;0.888666;0.860333;0.874084;0.859917;0.863583;0.862333
-grid,40000,159200,1,cpu_pool10,2.959542,0.000000,2.959542,0.000000,0,9,pass,1,2.970542;2.959542;2.984000;2.926583;2.999500;2.947292;2.928833;2.920292;2.966541
diff --git a/dev/research/metal_pathfinding/results/aba-initial/a2-stderr.txt b/dev/research/metal_pathfinding/results/aba-initial/a2-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/aba-initial/a2.csv b/dev/research/metal_pathfinding/results/aba-initial/a2.csv
deleted file mode 100644
index a32d157..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/a2.csv
+++ /dev/null
@@ -1,82 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.010833,0.000000,0.010833,0.000000,0,9,pass,1,0.010250;0.011834;0.009916;0.012334;0.010833;0.011042;0.011292;0.009750;0.009667
-random,128,1024,1,cpu_distance,0.004750,0.000000,0.004750,0.000000,0,9,pass,0,0.004958;0.004750;0.005959;0.004750;0.005458;0.004542;0.005750;0.004500;0.004291
-random,128,1024,1,cpu_pool10,0.028584,0.000000,0.028584,0.000000,0,9,pass,1,0.031333;0.026833;0.030334;0.026333;0.028584;0.026792;0.027500;0.053792;0.048500
-random,128,1024,64,cpu_full,0.821042,0.000000,0.821042,0.000000,0,9,pass,64,0.943291;0.913167;0.870250;0.846167;0.815083;0.821042;0.783792;0.781375;0.776500
-random,128,1024,64,cpu_distance,0.354125,0.000000,0.354125,0.000000,0,9,pass,0,0.433667;0.409125;0.553959;0.420167;0.354125;0.328792;0.306791;0.305459;0.314708
-random,128,1024,64,cpu_pool10,0.156750,0.000000,0.156750,0.000000,0,9,pass,64,0.168125;0.150292;0.156750;0.161125;0.158459;0.150417;0.157667;0.151417;0.146792
-random,1024,8192,1,cpu_full,0.108875,0.000000,0.108875,0.000000,0,9,pass,1,0.111291;0.108875;0.119667;0.111750;0.112375;0.106750;0.103709;0.102334;0.103500
-random,1024,8192,1,cpu_distance,0.057209,0.000000,0.057209,0.000000,0,9,pass,0,0.063500;0.057542;0.057209;0.059500;0.056084;0.059375;0.056875;0.056375;0.055542
-random,1024,8192,1,cpu_pool10,0.179500,0.000000,0.179500,0.000000,0,9,pass,1,0.228584;0.179500;0.216458;0.193375;0.191875;0.167125;0.155417;0.147375;0.160541
-random,1024,8192,64,cpu_full,10.334500,0.000000,10.334500,0.000000,0,9,pass,64,10.415083;10.460125;10.626542;10.342084;10.307166;10.334500;10.297541;10.276292;10.295166
-random,1024,8192,64,cpu_distance,5.089208,0.000000,5.089208,0.000000,0,9,pass,0,5.206541;5.264583;5.280083;5.034667;5.027584;5.015459;5.023583;5.089208;5.108458
-random,1024,8192,64,cpu_pool10,1.276542,0.000000,1.276542,0.000000,0,9,pass,64,1.276542;1.276583;1.278167;1.277375;1.272875;1.242417;1.238208;1.255791;1.294458
-fabric,288,16384,1,cpu_full,0.109542,0.000000,0.109542,0.000000,0,9,pass,1,0.109333;0.108167;0.114042;0.109875;0.109542;0.108625;0.111084;0.108625;0.109834
-fabric,288,16384,1,cpu_distance,0.023459,0.000000,0.023459,0.000000,0,9,pass,0,0.023958;0.024042;0.023708;0.023750;0.023459;0.023125;0.023334;0.023375;0.023083
-fabric,288,16384,1,cpu_pool10,0.140417,0.000000,0.140417,0.000000,0,9,pass,1,0.138917;0.130916;0.142334;0.134833;0.157834;0.160833;0.144708;0.139833;0.140417
-fabric,288,16384,64,cpu_full,7.335417,0.000000,7.335417,0.000000,0,9,pass,64,7.348833;7.351291;7.497708;7.468834;7.281000;7.286833;7.261375;7.335417;7.292000
-fabric,288,16384,64,cpu_distance,1.490792,0.000000,1.490792,0.000000,0,9,pass,0,1.497667;1.484791;1.556166;1.481334;1.489250;1.496291;1.471959;1.490792;1.500042
-fabric,288,16384,64,cpu_pool10,0.994500,0.000000,0.994500,0.000000,0,9,pass,64,1.310167;0.994500;0.885167;1.440208;0.924667;1.369250;0.911375;0.882166;1.262000
-grid,1024,3968,1,cpu_full,0.042708,0.000000,0.042708,0.000000,0,9,pass,1,0.045042;0.043250;0.042667;0.042667;0.042708;0.042834;0.042583;0.042500;0.042750
-grid,1024,3968,1,cpu_distance,0.011792,0.000000,0.011792,0.000000,0,9,pass,0,0.012125;0.011875;0.011917;0.011792;0.011708;0.011709;0.011792;0.011709;0.011750
-grid,1024,3968,1,cpu_pool10,0.078000,0.000000,0.078000,0.000000,0,9,pass,1,0.104375;0.078000;0.062959;0.081000;0.077959;0.069292;0.080084;0.099417;0.067792
-grid,1024,3968,64,cpu_full,3.969708,0.000000,3.969708,0.000000,0,9,pass,64,3.927417;3.982416;4.061667;3.961958;4.054167;3.911708;3.969708;3.937333;3.989291
-grid,1024,3968,64,cpu_distance,0.919125,0.000000,0.919125,0.000000,0,9,pass,0,0.962375;0.942292;0.919125;0.895500;0.881917;1.024958;0.925625;0.898084;0.872708
-grid,1024,3968,64,cpu_pool10,0.545958,0.000000,0.545958,0.000000,0,9,pass,64,0.597417;0.661041;0.519917;0.521167;0.677583;0.545958;0.507708;0.515125;0.678208
-chain,256,255,1,cpu_full,0.002541,0.000000,0.002541,0.000000,0,9,pass,1,0.002542;0.002458;0.002541;0.002583;0.002667;0.002500;0.002708;0.002500;0.002500
-chain,256,255,1,cpu_distance,0.000667,0.000000,0.000667,0.000000,0,9,pass,0,0.000708;0.000708;0.000667;0.000667;0.000667;0.000625;0.000667;0.000667;0.000625
-chain,256,255,1,cpu_pool10,0.030291,0.000000,0.030291,0.000000,0,9,pass,1,0.040666;0.027042;0.030291;0.020500;0.027792;0.025250;0.030375;0.035666;0.036166
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.597541,0.000000,0.597541,0.000000,0,9,pass,8,0.664167;0.636250;0.607958;0.597541;0.581709;0.579417;0.597958;0.566125;0.567250
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.289750,0.000000,0.289750,0.000000,0,9,pass,0,0.364125;0.346917;0.320291;0.304583;0.289750;0.277959;0.269708;0.270709;0.269083
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.203375,0.000000,0.203375,0.000000,0,9,pass,8,0.154459;0.156792;0.230833;0.214083;0.201875;0.203375;0.201375;0.214167;0.273875
-random,4096,32768,1,cpu_full,0.712917,0.000000,0.712917,0.000000,0,9,pass,1,0.681042;0.659792;0.821583;0.779833;0.756666;0.737833;0.712917;0.691500;0.686209
-random,4096,32768,1,cpu_distance,0.309000,0.000000,0.309000,0.000000,0,9,pass,0,0.337875;0.318042;0.305958;0.309000;0.298542;0.341459;0.311000;0.303333;0.301958
-random,4096,32768,1,cpu_pool10,0.785625,0.000000,0.785625,0.000000,0,9,pass,1,0.844916;0.802291;0.791417;0.789125;0.785625;0.780541;0.729375;0.745541;0.746208
-random,4096,32768,64,cpu_full,52.727708,0.000000,52.727708,0.000000,0,9,pass,64,52.664666;52.541958;52.493167;52.884583;53.811209;55.433792;52.673542;53.223542;52.727708
-random,4096,32768,64,cpu_distance,25.830208,0.000000,25.830208,0.000000,0,9,pass,0,26.109875;26.458750;26.554584;25.830208;25.906208;25.789167;25.734000;25.723875;25.792500
-random,4096,32768,64,cpu_pool10,5.860083,0.000000,5.860083,0.000000,0,9,pass,64,5.935000;5.859958;5.821042;5.833000;5.901000;5.850250;5.860083;5.966084;5.929959
-random,4096,32768,256,cpu_full,207.992250,0.000000,207.992250,0.000000,0,9,pass,256,206.724000;208.200708;207.499625;206.872708;210.280083;213.188875;208.143708;206.021542;207.992250
-random,4096,32768,256,cpu_distance,104.051583,0.000000,104.051583,0.000000,0,9,pass,0,104.128959;105.184459;103.591917;103.345583;104.051583;104.073125;103.631084;103.562375;106.041209
-random,4096,32768,256,cpu_pool10,22.650792,0.000000,22.650792,0.000000,0,9,pass,256,23.191209;22.046667;33.122375;23.513166;22.648375;22.679792;22.127083;22.033000;22.650792
-random,16384,131072,1,cpu_full,3.929417,0.000000,3.929417,0.000000,0,9,pass,1,4.274125;3.899833;3.929417;4.422709;3.847792;4.645000;3.848333;4.002333;3.903083
-random,16384,131072,1,cpu_distance,2.171583,0.000000,2.171583,0.000000,0,9,pass,0,2.268166;2.171583;2.203000;2.184500;2.164416;2.150791;2.200750;1.966792;1.933916
-random,16384,131072,1,cpu_pool10,4.152458,0.000000,4.152458,0.000000,0,9,pass,1,4.705584;4.494792;4.191875;4.127666;4.152458;4.026250;3.900041;4.111959;4.444541
-random,16384,131072,64,cpu_full,247.691375,0.000000,247.691375,0.000000,0,9,pass,64,247.384417;248.870041;247.608084;247.486917;246.857833;247.691375;257.440917;250.836500;248.646583
-random,16384,131072,64,cpu_distance,131.827250,0.000000,131.827250,0.000000,0,9,pass,0,131.827250;132.225917;131.814417;131.767875;132.610542;131.409583;130.953708;135.935042;133.253334
-random,16384,131072,64,cpu_pool10,28.359041,0.000000,28.359041,0.000000,0,9,pass,64,28.115292;28.119084;28.112792;28.127334;28.368166;29.834500;29.085750;28.359041;30.483792
-random,65536,524288,1,cpu_full,22.647375,0.000000,22.647375,0.000000,0,9,pass,1,20.932000;23.518000;20.834416;24.593625;22.648875;22.647375;21.936583;22.682208;22.441333
-random,65536,524288,1,cpu_distance,11.794042,0.000000,11.794042,0.000000,0,9,pass,0,11.654459;12.429667;11.794042;11.909250;12.420542;12.983708;11.474417;10.956250;10.923417
-random,65536,524288,1,cpu_pool10,20.695417,0.000000,20.695417,0.000000,0,9,pass,1,20.689834;23.461167;20.695417;24.155625;22.147958;20.718083;20.171959;20.259875;19.568000
-random,65536,524288,64,cpu_full,1320.231250,0.000000,1320.231250,0.000000,0,9,pass,64,1342.003417;1308.543208;1329.705792;1330.231416;1315.563250;1302.226667;1320.231250;1351.369583;1294.068167
-random,65536,524288,64,cpu_distance,703.172916,0.000000,703.172916,0.000000,0,9,pass,0,696.462167;703.172916;729.499542;686.473125;723.540625;727.089417;694.442000;684.076291;730.469000
-random,65536,524288,64,cpu_pool10,190.623000,0.000000,190.623000,0.000000,0,9,pass,64,182.424666;192.549833;182.596875;191.734167;182.435666;193.379583;190.623000;178.277209;193.851375
-chain,2048,2047,1,cpu_full,0.019416,0.000000,0.019416,0.000000,0,9,pass,1,0.019625;0.019500;0.019458;0.019333;0.019375;0.019375;0.019542;0.019375;0.019416
-chain,2048,2047,1,cpu_distance,0.004792,0.000000,0.004792,0.000000,0,9,pass,0,0.004917;0.004750;0.004833;0.004792;0.004750;0.004792;0.004792;0.004708;0.004708
-chain,2048,2047,1,cpu_pool10,0.036834,0.000000,0.036834,0.000000,0,9,pass,1,0.036125;0.037875;0.036834;0.037875;0.037375;0.037583;0.035667;0.034875;0.035000
-random,4096,131072,1,cpu_full,1.679541,0.000000,1.679541,0.000000,0,9,pass,1,1.679541;1.643167;1.592084;1.694542;1.711875;1.677125;1.824875;1.698875;1.639500
-random,4096,131072,1,cpu_distance,0.691209,0.000000,0.691209,0.000000,0,9,pass,0,0.691209;0.674375;0.664250;0.662916;0.655750;0.889125;0.861542;0.732416;0.701209
-random,4096,131072,1,cpu_pool10,1.669292,0.000000,1.669292,0.000000,0,9,pass,1,1.698375;1.669292;1.648959;1.632208;1.717542;1.666333;1.649166;1.786166;1.750334
-random,4096,131072,64,cpu_full,111.530709,0.000000,111.530709,0.000000,0,9,pass,64,111.036208;111.092000;111.208375;111.335500;111.607834;111.530709;111.897333;123.337000;115.064042
-random,4096,131072,64,cpu_distance,49.874000,0.000000,49.874000,0.000000,0,9,pass,0,49.730958;49.667250;50.174584;49.874000;49.732041;49.854875;50.297125;51.777667;50.203834
-random,4096,131072,64,cpu_pool10,12.770500,0.000000,12.770500,0.000000,0,9,pass,64,12.853708;12.836916;12.777666;12.832250;12.754167;12.754208;12.725750;12.692792;12.770500
-clos,200,20000,1,cpu_full,0.144458,0.000000,0.144458,0.000000,0,9,pass,1,0.147125;0.149083;0.159583;0.143958;0.144000;0.144458;0.145500;0.143250;0.143833
-clos,200,20000,1,cpu_distance,0.029417,0.000000,0.029417,0.000000,0,9,pass,0,0.029500;0.029417;0.040209;0.026291;0.026250;0.027125;0.032500;0.032459;0.026417
-clos,200,20000,1,cpu_pool10,0.172209,0.000000,0.172209,0.000000,0,9,pass,1,0.177833;0.169000;0.184208;0.170542;0.170958;0.182333;0.172209;0.176916;0.169833
-clos,200,20000,64,cpu_full,9.344917,0.000000,9.344917,0.000000,0,9,pass,64,9.405083;9.327375;9.344917;9.256375;9.225166;9.460750;9.049167;9.419000;9.451500
-clos,200,20000,64,cpu_distance,1.703708,0.000000,1.703708,0.000000,0,9,pass,0,1.703708;1.771625;1.681083;1.686333;1.807333;1.656834;1.673250;1.711208;1.817500
-clos,200,20000,64,cpu_pool10,1.280458,0.000000,1.280458,0.000000,0,9,pass,64,1.468250;1.114291;1.538709;1.113000;1.129417;1.671500;1.280458;1.133958;1.785375
-clos,800,320000,1,cpu_full,2.456709,0.000000,2.456709,0.000000,0,9,pass,1,2.517875;2.386333;2.496791;2.554583;2.397208;2.427000;2.356875;2.456709;2.576250
-clos,800,320000,1,cpu_distance,0.394584,0.000000,0.394584,0.000000,0,9,pass,0,0.401958;0.389458;0.390875;0.397500;0.394584;0.393417;0.394917;0.397875;0.394500
-clos,800,320000,1,cpu_pool10,2.421333,0.000000,2.421333,0.000000,0,9,pass,1,2.361458;2.418500;2.669208;2.568208;2.395041;2.423167;2.493458;2.421333;2.412875
-clos,800,320000,64,cpu_full,150.211750,0.000000,150.211750,0.000000,0,9,pass,64,150.774000;149.614458;151.205917;149.062583;154.468125;149.091542;150.351875;149.293875;150.211750
-clos,800,320000,64,cpu_distance,25.404750,0.000000,25.404750,0.000000,0,9,pass,0,25.297542;25.404750;25.432334;25.347625;25.474333;25.363375;25.391333;25.542125;25.405834
-clos,800,320000,64,cpu_pool10,17.443042,0.000000,17.443042,0.000000,0,9,pass,64,17.723500;17.432708;18.498708;17.201500;17.314417;18.956917;17.443042;17.232667;18.136750
-grid,10000,39600,1,cpu_full,0.617416,0.000000,0.617416,0.000000,0,9,pass,1,0.637833;0.636542;0.617875;0.618792;0.617416;0.616791;0.612584;0.616750;0.611334
-grid,10000,39600,1,cpu_distance,0.179916,0.000000,0.179916,0.000000,0,9,pass,0,0.182250;0.179167;0.179000;0.179916;0.188250;0.185375;0.177833;0.179375;0.179958
-grid,10000,39600,1,cpu_pool10,0.686959,0.000000,0.686959,0.000000,0,9,pass,1,0.734417;0.711292;0.691458;0.686959;0.706042;0.685584;0.680833;0.677750;0.675167
-grid,10000,39600,8,cpu_full,5.587958,0.000000,5.587958,0.000000,0,9,pass,8,5.609542;5.540458;5.564500;5.599791;5.587958;5.604417;5.595583;5.556542;5.536167
-grid,10000,39600,8,cpu_distance,1.579834,0.000000,1.579834,0.000000,0,9,pass,0,1.598125;1.579834;1.561709;1.566750;1.563667;1.595083;1.588584;1.592917;1.559584
-grid,10000,39600,8,cpu_pool10,0.874125,0.000000,0.874125,0.000000,0,9,pass,8,1.307167;0.874125;0.840250;1.379708;0.871708;1.267542;0.834500;0.831583;1.212583
-grid,40000,159200,1,cpu_full,2.918042,0.000000,2.918042,0.000000,0,9,pass,1,2.908458;2.902584;2.863542;2.918042;2.936250;2.902583;2.953000;3.064666;3.009292
-grid,40000,159200,1,cpu_distance,0.900709,0.000000,0.900709,0.000000,0,9,pass,0,0.889459;0.930333;0.906083;0.909250;0.916958;0.887542;0.876750;0.878583;0.900709
-grid,40000,159200,1,cpu_pool10,3.041500,0.000000,3.041500,0.000000,0,9,pass,1,3.047042;3.043250;3.013167;3.027833;3.012417;3.099708;3.140125;3.041500;3.038209
diff --git a/dev/research/metal_pathfinding/results/aba-initial/b-stderr.txt b/dev/research/metal_pathfinding/results/aba-initial/b-stderr.txt
deleted file mode 100644
index ac7eefb..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/b-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=29.7193 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/aba-initial/b.csv b/dev/research/metal_pathfinding/results/aba-initial/b.csv
deleted file mode 100644
index 3f62dd7..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/b.csv
+++ /dev/null
@@ -1,69 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,metal_pull,0.694333,0.305875,0.688416,0.040542,16,9,pass,0,0.824625;0.880667;0.672541;0.714917;0.599375;0.591625;0.694333;0.808792;0.585333
-random,128,1024,1,metal_group,0.272125,0.130750,0.267833,0.040542,9,9,pass,0,0.753375;0.279375;0.267000;0.271958;0.271667;0.272125;0.500250;0.279209;0.263250
-random,128,1024,1,metal_shared,0.264750,0.123500,0.259625,0.040542,9,9,pass,0,0.267167;0.253583;0.264750;0.258417;0.246916;0.258500;0.287166;0.325875;0.362208
-random,128,1024,64,metal_pull,0.898834,0.346917,0.615667,0.060333,16,9,pass,0,1.087958;0.891333;0.974625;0.898834;0.940333;0.880416;0.842291;0.879875;0.907375
-random,128,1024,64,metal_group,0.597708,0.179375,0.323167,0.060333,13,9,pass,0,0.614250;0.678208;0.597708;0.597000;0.625875;0.600250;0.578042;0.571208;0.577208
-random,128,1024,64,metal_shared,0.598917,0.168542,0.314542,0.060333,13,9,pass,0,0.610708;0.607666;0.602542;0.608167;0.598917;0.583041;0.574083;0.558667;0.559542
-random,1024,8192,1,metal_pull,0.751708,0.398583,0.708791,0.082709,16,9,pass,0,0.788250;0.716333;0.715667;0.831709;0.762541;0.751708;0.716250;1.371375;0.701542
-random,1024,8192,1,metal_group,0.857958,0.678792,0.820333,0.082709,13,9,pass,0,0.861750;0.857458;0.853125;0.854958;0.857958;0.869708;0.900250;0.862750;0.851250
-random,1024,8192,1,metal_shared,0.822459,0.639208,0.780792,0.082709,13,9,pass,0,0.916292;0.802667;0.815750;0.840333;0.820834;0.838583;0.819125;0.822459;0.845916
-random,1024,8192,64,metal_pull,4.666000,1.543917,2.176875,0.114500,24,9,pass,0,4.584042;4.518958;5.016250;5.419500;4.748625;4.529042;4.565292;4.666000;4.892125
-random,1024,8192,64,metal_group,3.842875,0.893625,1.354458,0.114500,17,9,pass,0,3.842875;3.535417;3.878875;3.977333;3.835958;3.829125;3.878708;3.709792;3.910750
-random,1024,8192,64,metal_shared,3.773791,0.828458,1.284917,0.114500,17,9,pass,0,3.734166;3.713583;3.813542;3.809833;3.755083;3.695125;3.798167;3.937292;3.773791
-fabric,288,16384,1,metal_pull,1.859625,1.648625,1.806375,0.116000,8,9,pass,0,1.839917;1.864375;1.995041;1.859625;1.868375;1.937417;1.834584;1.844208;1.766292
-fabric,288,16384,1,metal_group,0.776375,0.576500,0.716917,0.116000,3,9,pass,0,0.786958;0.764250;0.845375;0.818083;0.774375;0.777167;0.776375;0.510167;0.555875
-fabric,288,16384,1,metal_shared,0.733292,0.546875,0.674250,0.116000,3,9,pass,0,0.730417;0.733292;0.786042;0.810708;0.739416;0.695333;0.488541;0.478875;0.892958
-fabric,288,16384,64,metal_pull,5.846791,1.800375,2.335667,0.145292,8,9,pass,0,5.086083;5.870000;5.846791;5.543417;5.846542;6.396292;5.965208;5.897375;5.826000
-fabric,288,16384,64,metal_group,4.629250,0.644375,1.190291,0.145292,3,9,pass,0,4.395458;4.694042;4.700083;4.629250;4.676292;4.376625;4.693042;4.293042;4.586375
-fabric,288,16384,64,metal_shared,4.801458,0.622000,1.157084,0.145292,3,9,pass,0,4.661208;4.952084;4.857542;4.645917;4.805500;4.682250;4.801458;6.446500;4.696791
-grid,1024,3968,1,metal_pull,1.846125,0.651292,1.827084,0.065416,64,9,pass,0,2.019292;1.846125;2.021708;1.716792;1.929959;1.710000;1.883416;1.696250;1.706834
-grid,1024,3968,1,metal_group,1.176292,1.008250,1.158542,0.065416,63,9,pass,0,1.164791;1.182625;1.161584;1.162708;1.213208;1.260084;1.171792;1.179334;1.176292
-grid,1024,3968,1,metal_shared,0.487541,0.348875,0.471292,0.065416,63,9,pass,0,0.505459;0.487541;0.486458;0.504208;0.512792;0.488416;0.461667;0.456291;0.466333
-grid,1024,3968,64,metal_pull,3.045875,0.567583,2.132125,0.080500,64,9,pass,0,2.971500;2.829791;3.048500;2.852875;3.045875;2.905750;3.125083;3.216166;3.372708
-grid,1024,3968,64,metal_group,1.864042,0.405958,0.949125,0.080500,63,9,pass,0,1.852166;1.796541;1.882167;1.836917;1.864042;1.955917;1.558459;1.924375;1.948792
-grid,1024,3968,64,metal_shared,1.958083,0.487208,1.013500,0.080500,63,9,pass,0,1.963458;1.958083;1.495541;2.055667;1.936667;1.975791;1.935166;1.944042;2.318917
-chain,256,255,1,metal_pull,5.824792,1.927375,5.822250,0.052833,256,9,pass,1,6.102125;5.943208;6.338167;5.852500;5.273083;5.824792;5.505208;5.067875;5.153459
-chain,256,255,1,metal_group,0.714667,0.608625,0.713083,0.052833,256,9,pass,1,0.711209;0.720959;0.709417;0.711916;0.716583;0.714667;0.708125;0.717959;0.815000
-chain,256,255,1,metal_shared,0.658709,0.552125,0.657209,0.052833,256,9,pass,1,0.658709;0.654916;0.653791;0.739209;0.801459;0.673667;0.663959;0.653000;0.649500
-random_masked_int64_reverse,1024,8192,8,metal_pull,0.682125,0.133708,0.245708,0.085083,8,9,pass,1,0.740958;0.668292;0.736208;0.661167;0.692542;0.682125;0.667625;0.685750;0.660917
-random_masked_int64_reverse,1024,8192,8,metal_group,0.749041,0.241083,0.338250,0.085083,8,9,pass,1,0.767500;0.754917;0.756750;0.745125;0.749041;0.626875;0.746833;0.751167;0.732333
-random_masked_int64_reverse,1024,8192,8,metal_shared,0.741709,0.224625,0.328917,0.085083,8,9,pass,1,0.723625;0.720375;0.715209;0.741709;0.728000;0.803041;0.774625;0.753041;0.768542
-random,4096,32768,1,metal_pull,0.812833,0.413625,0.660625,0.196375,16,9,pass,0,0.801458;0.806833;0.811333;0.814834;0.816083;0.812833;0.793167;0.860833;0.816417
-random,4096,32768,1,metal_group,1.505875,1.226583,1.358042,0.196375,16,9,pass,0,2.224875;1.505875;1.510208;1.338542;1.329209;1.352791;1.476209;1.584875;1.555541
-random,4096,32768,64,metal_pull,14.598084,3.937250,4.753209,0.208583,24,9,pass,0,14.252500;14.598084;15.751167;17.473250;14.592417;13.591042;17.424500;14.417500;18.520500
-random,4096,32768,64,metal_group,14.066250,4.080833,4.463417,0.208583,19,9,pass,0,14.129583;14.038459;11.394417;14.478125;14.066250;13.967625;14.229542;14.124334;11.212583
-random,4096,32768,256,metal_pull,52.239208,11.306291,13.131667,0.215541,24,9,pass,0,49.794333;49.768167;52.239208;51.144625;52.841292;51.508875;53.434292;53.943542;53.808208
-random,4096,32768,256,metal_group,49.850250,9.712792,10.485541,0.215541,20,9,pass,0,47.301833;48.041792;48.523375;51.754625;52.943792;51.925625;49.809875;49.850250;51.073500
-random,16384,131072,1,metal_pull,1.386041,0.270917,0.696084,0.583583,24,9,pass,0,1.349833;1.344791;1.398750;1.883167;1.773000;1.312167;1.368083;1.459333;1.386041
-random,16384,131072,1,metal_group,5.660333,4.802667,4.988333,0.583583,18,9,pass,0,5.774875;5.682834;5.790833;5.646959;5.583334;5.649250;5.620167;5.790166;5.660333
-random,16384,131072,64,metal_pull,57.259666,11.632292,12.902417,0.623375,24,9,pass,0,57.422542;57.092416;57.618708;57.291917;57.259666;56.624625;56.584416;57.963625;56.911000
-random,16384,131072,64,metal_group,54.493208,9.480500,10.270834,0.623375,22,9,pass,0,53.254667;53.490625;54.070542;54.493208;56.920459;56.394708;54.439875;54.946792;55.627125
-random,65536,524288,1,metal_pull,5.859042,1.942875,2.819833,2.711292,24,9,pass,0,5.889208;5.976292;6.990375;6.082208;5.859042;4.821625;4.951208;4.638042;4.792333
-random,65536,524288,1,metal_group,32.303250,28.469375,29.047916,2.711292,22,9,pass,0,31.766250;31.845500;31.635042;31.586375;32.434666;32.359458;32.305917;32.303250;32.318417
-random,65536,524288,64,metal_pull,269.299583,69.087833,71.201500,2.622333,32,9,pass,0,268.115458;271.970875;269.941292;268.528541;269.299583;269.076750;268.627791;269.599125;272.598000
-random,65536,524288,64,metal_group,274.914833,75.469958,76.650542,2.622333,25,9,pass,0,273.356208;272.365000;274.351291;274.330250;274.914833;277.346917;277.881250;276.976584;276.145209
-chain,2048,2047,1,metal_pull,29.862084,4.310752,29.851875,0.070834,2048,9,pass,1,29.859000;28.595000;29.774000;29.862084;30.292084;29.960708;30.157125;29.597333;30.245000
-chain,2048,2047,1,metal_group,4.815750,4.698792,4.806500,0.070834,2048,9,pass,1,4.798125;4.865583;4.803041;4.799208;4.910500;4.826875;4.881500;4.815625;4.815750
-random,4096,131072,1,metal_pull,0.896667,0.267792,0.483708,0.588333,16,9,pass,0,0.875625;0.890458;0.899750;0.896667;0.916875;0.904833;0.877958;0.906667;0.853708
-random,4096,131072,1,metal_group,2.694958,2.174167,2.280334,0.588333,12,9,pass,0,2.671709;2.646250;2.697916;2.805750;2.669416;2.684459;2.925000;2.738292;2.694958
-random,4096,131072,64,metal_pull,37.135333,8.692458,9.196958,0.675541,16,9,pass,0,35.238334;36.093709;35.691375;35.662584;37.135333;39.312250;39.152625;38.276667;38.420625
-random,4096,131072,64,metal_group,36.557458,7.510292,7.880583,0.675541,15,9,pass,0,34.011792;34.412958;38.154083;41.139291;34.516083;35.256750;36.557458;37.278875;36.584917
-clos,200,20000,1,metal_pull,0.669667,0.443375,0.599625,0.127375,8,9,pass,0,0.991167;0.672042;0.669667;0.674875;0.879750;0.652208;0.656792;0.666916;0.640167
-clos,200,20000,1,metal_group,0.366875,0.151917,0.297084,0.127375,3,9,pass,0,0.366875;0.384750;0.342125;0.357500;0.366042;0.383125;0.485541;0.479500;0.342416
-clos,200,20000,1,metal_shared,0.352542,0.142750,0.281125,0.127375,3,9,pass,0,0.407584;0.346917;0.357959;0.352542;0.342917;0.347167;0.347292;0.403458;0.358833
-clos,200,20000,64,metal_pull,5.845584,1.017542,1.578750,0.162000,8,9,pass,0,5.916459;5.769833;5.835500;5.656750;5.845959;5.728583;6.488792;5.845584;5.853792
-clos,200,20000,64,metal_group,5.049667,0.309625,0.890291,0.162000,3,9,pass,0,5.133958;4.883875;5.132000;5.048208;5.071291;5.049667;5.043708;5.150125;4.778417
-clos,200,20000,64,metal_shared,5.062500,0.293833,0.850083,0.162000,3,9,pass,0,5.062500;5.012500;4.969167;4.868250;5.078416;5.152583;5.033167;5.128291;5.161792
-clos,800,320000,1,metal_pull,4.467084,3.168541,3.390333,1.307417,8,9,pass,0,4.739125;4.467084;4.451583;4.742625;4.750208;4.833000;2.988708;1.954417;2.435167
-clos,800,320000,1,metal_group,2.647917,0.946375,1.618458,1.307417,3,9,pass,0,2.143583;5.294334;3.724166;2.616750;2.647917;5.521750;4.269459;2.507334;2.601250
-clos,800,320000,1,metal_shared,2.639667,0.905000,1.565042,1.307417,3,9,pass,0,2.636542;2.500625;2.630250;2.660500;4.998333;5.397416;4.654375;2.564250;2.639667
-clos,800,320000,64,metal_pull,84.884084,16.348833,16.846000,1.254500,8,9,pass,0,84.918625;83.551292;84.269958;83.793166;85.337916;88.659791;83.283542;88.303542;84.884084
-clos,800,320000,64,metal_group,73.596917,5.233958,5.823625,1.254500,3,9,pass,0,73.978875;73.856000;73.987333;73.942958;73.596917;73.378708;73.150542;73.522083;72.589416
-clos,800,320000,64,metal_shared,73.488333,5.098667,5.715750,1.254500,3,9,pass,0,73.912000;73.938666;72.677167;73.085209;72.850625;75.111209;74.153959;72.633250;73.488333
-grid,10000,39600,1,metal_pull,4.066792,0.588250,3.935042,0.170583,200,9,pass,0,5.971916;4.407667;3.591625;4.066792;4.094125;3.673125;3.720167;4.068667;3.871167
-grid,10000,39600,1,metal_group,7.897958,7.570500,7.738625,0.170583,199,9,pass,0,7.841042;7.899084;7.943167;7.855458;7.873667;7.914667;7.897958;7.891959;8.008416
-grid,10000,39600,8,metal_pull,6.015875,1.397917,5.012500,0.167167,200,9,pass,0,6.379375;5.981750;6.565208;5.743083;6.015875;5.603667;6.220792;5.636583;6.580167
-grid,10000,39600,8,metal_group,9.084958,7.487958,8.109417,0.167167,199,9,pass,0,8.986459;9.386500;9.080083;9.138000;9.178042;9.223667;8.955833;9.082250;9.084958
-grid,40000,159200,1,metal_pull,8.366125,1.756501,7.870792,0.498500,400,9,pass,0,8.677875;9.271667;8.710083;8.543291;8.366125;7.339959;7.248500;7.223375;7.600666
-grid,40000,159200,1,metal_group,65.593041,64.849167,65.113958,0.498500,399,9,pass,0,65.552584;65.564333;65.593041;65.452333;66.461167;66.104959;65.226667;65.833166;65.986167
diff --git a/dev/research/metal_pathfinding/results/aba-initial/environment.txt b/dev/research/metal_pathfinding/results/aba-initial/environment.txt
deleted file mode 100644
index a449a5e..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/environment.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-2026-09-26T23:02:54Z
-fbab119e794c843838f4f3f96d75cb7f32f06845
-ProductName:		macOS
-ProductVersion:		26.6.1
-BuildVersion:		25G76
-Apple M4 Max
-38654705664
-14
-Apple clang version 21.0.0 (clang-2100.1.1.101)
-Target: arm64-apple-darwin25.6.0
-Thread model: posix
-InstalledDir: /Library/Developer/CommandLineTools/usr/bin
-0ea7d865d0d979f1ed79612cff1270bbf2d45425a7548cf7c7fa9595f5f1463b  dev/research/metal_pathfinding/experiment.mm
-2e36b1623a3940bf1f19f5d81141bb1def14f5873fe2a98aab0101bbe68618a3  dev/research/metal_pathfinding/sssp.metal
-Note: No thermal warning level has been recorded
-Note: No performance warning level has been recorded
-Note: No CPU power status has been recorded
diff --git a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a1.txt b/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a1.txt
deleted file mode 100644
index 2a9fdd8..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a1.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10844422144,"Tiler Utilization %"=5,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=8,"TiledSceneBytes"=1441792,"Device Utilization %"=23,"SplitSceneCount"=0,"Allocated PB Size"=187301888,"In use system memory"=1340784640}
diff --git a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a2.txt b/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a2.txt
deleted file mode 100644
index fb2f6fe..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-a2.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10848157696,"Tiler Utilization %"=2,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=5,"TiledSceneBytes"=1441792,"Device Utilization %"=75,"SplitSceneCount"=0,"Allocated PB Size"=187301888,"In use system memory"=1341440000}
diff --git a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-b.txt b/dev/research/metal_pathfinding/results/aba-initial/gpu-load-b.txt
deleted file mode 100644
index 67b7835..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/gpu-load-b.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=10846322688,"Tiler Utilization %"=6,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=10,"TiledSceneBytes"=1441792,"Device Utilization %"=10,"SplitSceneCount"=0,"Allocated PB Size"=187301888,"In use system memory"=1391755264}
diff --git a/dev/research/metal_pathfinding/results/aba-initial/load-a1.txt b/dev/research/metal_pathfinding/results/aba-initial/load-a1.txt
deleted file mode 100644
index afe6af8..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/load-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1029 total, 3 running, 1026 sleeping, 5267 threads 
-2026/09/27 00:02:55
-Load Avg: 3.44, 4.22, 4.55 
-CPU usage: 12.78% user, 9.58% sys, 77.62% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 640562 total, 10G resident, 741M private, 4397M shared.
-PhysMem: 34G used (3993M wired, 633M compressor), 1623M unused.
-VM: 455T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190112204/161G in, 145523736/163G out.
-Disks: 97543153/2475G read, 117275070/2097G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1030 total, 4 running, 1026 sleeping, 5290 threads 
-2026/09/27 00:02:56
-Load Avg: 3.56, 4.24, 4.55 
-CPU usage: 16.1% user, 6.20% sys, 77.77% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 1440 total, 222M resident, 741M private, 4390M shared.
-PhysMem: 34G used (3993M wired, 633M compressor), 1565M unused.
-VM: 455T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190112459/161G in, 145523987/163G out.
-Disks: 97543153/2475G read, 117275092/2097G written.
-
-PID    COMMAND          %CPU #TH   
-1225   mediaanalysisd   33.3 18/2  
-590    WindowServer     30.9 28    
-70968  Superset Helper  20.4 32    
-0      kernel_task      13.0 850/14
-70942  Superset Helper  7.2  19    
-59318  top              5.9  1/1   
-65401  codex            3.4  38    
-70934  Superset         3.1  50    
diff --git a/dev/research/metal_pathfinding/results/aba-initial/load-a2.txt b/dev/research/metal_pathfinding/results/aba-initial/load-a2.txt
deleted file mode 100644
index 7d011ae..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/load-a2.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1029 total, 3 running, 1026 sleeping, 5318 threads 
-2026/09/27 00:04:25
-Load Avg: 4.06, 4.30, 4.55 
-CPU usage: 11.52% user, 15.65% sys, 72.82% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 638423 total, 10G resident, 742M private, 4205M shared.
-PhysMem: 33G used (4028M wired, 633M compressor), 1920M unused.
-VM: 455T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190145627/161G in, 145557848/163G out.
-Disks: 97548223/2475G read, 117280135/2097G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1029 total, 2 running, 1027 sleeping, 5313 threads 
-2026/09/27 00:04:27
-Load Avg: 4.70, 4.43, 4.59 
-CPU usage: 7.48% user, 5.9% sys, 87.41% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 0 total, 0B resident, 742M private, 4205M shared.
-PhysMem: 33G used (3992M wired, 633M compressor), 1918M unused.
-VM: 455T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190145997/161G in, 145558207/163G out.
-Disks: 97548250/2475G read, 117280139/2097G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     36.6 28    
-70968  Superset Helper  23.2 33    
-594    runningboardd    21.0 7     
-0      kernel_task      15.7 850/14
-66135  top              8.9  1/1   
-70942  Superset Helper  7.7  18    
-21666  2.1.283          6.3  27    
-39196  PerfPowerService 5.7  13    
diff --git a/dev/research/metal_pathfinding/results/aba-initial/load-b.txt b/dev/research/metal_pathfinding/results/aba-initial/load-b.txt
deleted file mode 100644
index a06f45c..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/load-b.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1038 total, 4 running, 1034 sleeping, 5297 threads 
-2026/09/27 00:03:54
-Load Avg: 4.38, 4.36, 4.57 
-CPU usage: 6.7% user, 9.19% sys, 84.73% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 638679 total, 10G resident, 752M private, 4206M shared.
-PhysMem: 33G used (3994M wired, 633M compressor), 1786M unused.
-VM: 458T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190133303/161G in, 145544526/163G out.
-Disks: 97547513/2475G read, 117278580/2097G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1044 total, 4 running, 1040 sleeping, 5315 threads 
-2026/09/27 00:03:55
-Load Avg: 4.38, 4.36, 4.57 
-CPU usage: 15.9% user, 8.23% sys, 76.66% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 1073 total, 191M resident, 752M private, 4208M shared.
-PhysMem: 34G used (4060M wired, 633M compressor), 1564M unused.
-VM: 461T vsize, 6144M framework vsize, 2843901(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190134081/161G in, 145545447/163G out.
-Disks: 97547534/2475G read, 117278594/2097G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     29.1 28    
-70968  Superset Helper  24.8 32/1  
-1225   mediaanalysisd   24.0 18    
-0      kernel_task      14.2 850/14
-517    fseventsd        10.7 16    
-81804  2.1.283          9.4  27    
-70942  Superset Helper  8.5  18    
-63750  top              6.4  1/1   
diff --git a/dev/research/metal_pathfinding/results/aba-initial/summary.md b/dev/research/metal_pathfinding/results/aba-initial/summary.md
deleted file mode 100644
index 09724ff..0000000
--- a/dev/research/metal_pathfinding/results/aba-initial/summary.md
+++ /dev/null
@@ -1,38 +0,0 @@
-All times are medians in milliseconds per batch, with nine timed samples.
-CPU A columns use serial SPF for Q=1 and the 10-worker pool otherwise.
-GPU includes host distance copies and serial CPU ECMP DAG reconstruction.
-Upload and pipeline setup are excluded and recorded separately in raw data.
-The table picks the fastest measured GPU method for each case.
-
-| Case | V / E | Q | CPU A1 | GPU B | CPU A2 | GPU method | Distance-only B | CPU drift |
-|---|---:|---:|---:|---:|---:|---|---:|---:|
-| random | 128 / 1,024 | 1 | 0.010 | 0.265 | 0.011 | metal_shared | 0.260 | +12.6% |
-| random | 128 / 1,024 | 64 | 0.182 | 0.598 | 0.157 | metal_group | 0.323 | -14.1% |
-| random | 1,024 / 8,192 | 1 | 0.104 | 0.752 | 0.109 | metal_pull | 0.709 | +5.1% |
-| random | 1,024 / 8,192 | 64 | 1.342 | 3.774 | 1.277 | metal_shared | 1.285 | -4.9% |
-| fabric | 288 / 16,384 | 1 | 0.112 | 0.733 | 0.110 | metal_shared | 0.674 | -2.5% |
-| fabric | 288 / 16,384 | 64 | 0.972 | 4.629 | 0.995 | metal_group | 1.190 | +2.3% |
-| grid | 1,024 / 3,968 | 1 | 0.044 | 0.488 | 0.043 | metal_shared | 0.471 | -2.2% |
-| grid | 1,024 / 3,968 | 64 | 0.543 | 1.864 | 0.546 | metal_group | 0.949 | +0.5% |
-| chain | 256 / 255 | 1 | 0.003 | 0.659 | 0.003 | metal_shared | 0.657 | -0.0% |
-| random_masked_int64_reverse | 1,024 / 8,192 | 8 | 0.156 | 0.682 | 0.203 | metal_pull | 0.246 | +30.6% |
-| random | 4,096 / 32,768 | 1 | 0.657 | 0.813 | 0.713 | metal_pull | 0.661 | +8.6% |
-| random | 4,096 / 32,768 | 64 | 5.992 | 14.066 | 5.860 | metal_group | 4.463 | -2.2% |
-| random | 4,096 / 32,768 | 256 | 23.001 | 49.850 | 22.651 | metal_group | 10.486 | -1.5% |
-| random | 16,384 / 131,072 | 1 | 3.887 | 1.386 | 3.929 | metal_pull | 0.696 | +1.1% |
-| random | 16,384 / 131,072 | 64 | 28.586 | 54.493 | 28.359 | metal_group | 10.271 | -0.8% |
-| random | 65,536 / 524,288 | 1 | 22.864 | 5.859 | 22.647 | metal_pull | 2.820 | -0.9% |
-| random | 65,536 / 524,288 | 64 | 181.874 | 269.300 | 190.623 | metal_pull | 71.201 | +4.8% |
-| chain | 2,048 / 2,047 | 1 | 0.020 | 4.816 | 0.019 | metal_group | 4.806 | -1.3% |
-| random | 4,096 / 131,072 | 1 | 1.540 | 0.897 | 1.680 | metal_pull | 0.484 | +9.1% |
-| random | 4,096 / 131,072 | 64 | 12.857 | 36.557 | 12.771 | metal_group | 7.881 | -0.7% |
-| clos | 200 / 20,000 | 1 | 0.139 | 0.353 | 0.144 | metal_shared | 0.281 | +4.1% |
-| clos | 200 / 20,000 | 64 | 1.167 | 5.050 | 1.280 | metal_group | 0.890 | +9.7% |
-| clos | 800 / 320,000 | 1 | 2.314 | 2.640 | 2.457 | metal_shared | 1.565 | +6.2% |
-| clos | 800 / 320,000 | 64 | 17.328 | 73.488 | 17.443 | metal_shared | 5.716 | +0.7% |
-| grid | 10,000 / 39,600 | 1 | 0.631 | 4.067 | 0.617 | metal_pull | 3.935 | -2.2% |
-| grid | 10,000 / 39,600 | 8 | 0.852 | 6.016 | 0.874 | metal_pull | 5.013 | +2.6% |
-| grid | 40,000 / 159,200 | 1 | 2.919 | 8.366 | 2.918 | metal_pull | 7.871 | -0.0% |
-
-Distance-only timings stop before DAG reconstruction; they are not SPF API timings.
-CPU distance-only and serial full-batch controls are also available in a1/a2.csv.
diff --git a/dev/research/metal_pathfinding/results/aba/a1-stderr.txt b/dev/research/metal_pathfinding/results/aba/a1-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/aba/a1.csv b/dev/research/metal_pathfinding/results/aba/a1.csv
deleted file mode 100644
index 85a75b7..0000000
--- a/dev/research/metal_pathfinding/results/aba/a1.csv
+++ /dev/null
@@ -1,109 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.031083,0.000000,0.031083,0.000000,0,9,pass,1,0.025959;0.047458;0.031083;0.025458;0.089375;0.046875;0.027416;0.042458;0.027167
-random,128,1024,1,cpu_distance,0.010625,0.000000,0.010625,0.000000,0,9,pass,0,0.010625;0.010083;0.053000;0.028416;0.012625;0.010750;0.010250;0.009917;0.009917
-random,128,1024,1,cpu_pool10,0.065334,0.000000,0.065334,0.000000,0,9,pass,1,0.072125;0.134959;0.047291;0.041166;0.047625;0.065334;0.108833;0.065334;0.039959
-random,128,1024,1,cpu_pool10_distance,0.031291,0.000000,0.031291,0.000000,0,9,pass,0,0.069500;0.029708;0.031500;0.034125;0.031291;0.036583;0.029125;0.026166;0.027500
-random,128,1024,64,cpu_full,2.259334,0.000000,2.259334,0.000000,0,9,pass,64,2.880125;2.602792;2.582041;2.345583;2.175084;2.259334;2.142166;1.871250;1.849166
-random,128,1024,64,cpu_distance,0.604334,0.000000,0.604334,0.000000,0,9,pass,0,0.777792;0.734917;0.664542;0.613875;0.604334;0.593916;0.557875;0.527708;0.496709
-random,128,1024,64,cpu_pool10,0.234125,0.000000,0.234125,0.000000,0,9,pass,64,0.336750;0.342667;0.316625;0.254000;0.223584;0.234125;0.198583;0.190167;0.206083
-random,128,1024,64,cpu_pool10_distance,0.126417,0.000000,0.126417,0.000000,0,9,pass,0,0.131541;0.137000;0.126417;0.129334;0.111583;0.122541;0.128042;0.108500;0.113791
-random,1024,8192,1,cpu_full,0.145417,0.000000,0.145417,0.000000,0,9,pass,1,0.168083;0.164667;0.152583;0.147458;0.144750;0.145417;0.145333;0.144000;0.144834
-random,1024,8192,1,cpu_distance,0.080125,0.000000,0.080125,0.000000,0,9,pass,0,0.083250;0.080750;0.079959;0.080333;0.079334;0.079584;0.079541;0.081667;0.080125
-random,1024,8192,1,cpu_pool10,0.228792,0.000000,0.228792,0.000000,0,9,pass,1,0.265000;0.228792;0.263084;0.261959;0.227500;0.220083;0.220208;0.195542;0.237208
-random,1024,8192,1,cpu_pool10_distance,0.134708,0.000000,0.134708,0.000000,0,9,pass,0,0.140625;0.138291;0.116250;0.142541;0.134708;0.110167;0.100417;0.150417;0.111000
-random,1024,8192,64,cpu_full,10.256834,0.000000,10.256834,0.000000,0,9,pass,64,10.220708;10.174458;10.082500;10.185167;10.265750;10.277833;10.256834;10.274708;10.452625
-random,1024,8192,64,cpu_distance,5.040292,0.000000,5.040292,0.000000,0,9,pass,0,5.296791;5.411084;5.040292;5.061084;5.073833;4.945042;4.947209;5.020833;4.953291
-random,1024,8192,64,cpu_pool10,1.273334,0.000000,1.273334,0.000000,0,9,pass,64,1.261917;1.254709;1.264208;1.274875;1.273334;1.289083;1.297209;1.288209;1.251541
-random,1024,8192,64,cpu_pool10_distance,0.633542,0.000000,0.633542,0.000000,0,9,pass,0,0.646750;0.634292;0.633542;0.642042;0.639000;0.627834;0.626209;0.630625;0.617000
-fabric,288,16384,1,cpu_full,0.106625,0.000000,0.106625,0.000000,0,9,pass,1,0.103000;0.111958;0.103875;0.109167;0.103208;0.109958;0.103458;0.108709;0.106625
-fabric,288,16384,1,cpu_distance,0.022209,0.000000,0.022209,0.000000,0,9,pass,0,0.022542;0.022375;0.022292;0.022209;0.022042;0.022125;0.022083;0.022041;0.022209
-fabric,288,16384,1,cpu_pool10,0.136416,0.000000,0.136416,0.000000,0,9,pass,1,0.144084;0.130041;0.140500;0.131666;0.137458;0.136416;0.133250;0.129459;0.141334
-fabric,288,16384,1,cpu_pool10_distance,0.051583,0.000000,0.051583,0.000000,0,9,pass,0,0.043250;0.040625;0.052750;0.044667;0.058000;0.053625;0.047084;0.063917;0.051583
-fabric,288,16384,64,cpu_full,7.037208,0.000000,7.037208,0.000000,0,9,pass,64,7.154417;7.377959;7.160000;6.919500;7.004708;7.303625;7.037208;6.997208;7.035792
-fabric,288,16384,64,cpu_distance,1.361708,0.000000,1.361708,0.000000,0,9,pass,0,1.336542;1.394208;1.345500;1.334958;1.364208;1.410250;1.361000;1.369667;1.361708
-fabric,288,16384,64,cpu_pool10,1.010542,0.000000,1.010542,0.000000,0,9,pass,64,0.891250;1.371208;1.054042;0.880958;1.157417;1.010542;0.909041;1.264625;0.965167
-fabric,288,16384,64,cpu_pool10_distance,0.194375,0.000000,0.194375,0.000000,0,9,pass,0,0.209667;0.195750;0.213708;0.207041;0.194250;0.193041;0.188792;0.190834;0.194375
-grid,1024,3968,1,cpu_full,0.037042,0.000000,0.037042,0.000000,0,9,pass,1,0.038875;0.037542;0.037042;0.037250;0.037209;0.036791;0.036917;0.036875;0.036916
-grid,1024,3968,1,cpu_distance,0.010250,0.000000,0.010250,0.000000,0,9,pass,0,0.010792;0.010500;0.010375;0.010375;0.010167;0.010250;0.010125;0.009917;0.010000
-grid,1024,3968,1,cpu_pool10,0.072834,0.000000,0.072834,0.000000,0,9,pass,1,0.082750;0.064583;0.077709;0.063250;0.082875;0.072834;0.070625;0.063208;0.078708
-grid,1024,3968,1,cpu_pool10_distance,0.029667,0.000000,0.029667,0.000000,0,9,pass,0,0.031583;0.028041;0.028125;0.035917;0.029667;0.030750;0.029500;0.026959;0.031833
-grid,1024,3968,64,cpu_full,3.824709,0.000000,3.824709,0.000000,0,9,pass,64,3.806875;3.924791;3.797833;3.863083;3.824709;3.822500;3.807833;3.827250;3.879416
-grid,1024,3968,64,cpu_distance,0.853125,0.000000,0.853125,0.000000,0,9,pass,0,0.887958;0.871792;0.859042;0.873250;0.842917;0.853125;0.849041;0.839958;0.845458
-grid,1024,3968,64,cpu_pool10,0.498458,0.000000,0.498458,0.000000,0,9,pass,64,0.486167;0.522625;0.487375;0.493542;0.521041;0.498458;0.512292;0.498917;0.481625
-grid,1024,3968,64,cpu_pool10_distance,0.146458,0.000000,0.146458,0.000000,0,9,pass,0,0.148833;0.140667;0.145375;0.160292;0.149875;0.139458;0.172917;0.146458;0.141541
-chain,256,255,1,cpu_full,0.002250,0.000000,0.002250,0.000000,0,9,pass,1,0.003500;0.002292;0.002250;0.002291;0.002250;0.002208;0.002250;0.002291;0.002209
-chain,256,255,1,cpu_distance,0.000500,0.000000,0.000500,0.000000,0,9,pass,0,0.000583;0.000459;0.000542;0.000500;0.000458;0.000459;0.000500;0.000459;0.000583
-chain,256,255,1,cpu_pool10,0.033416,0.000000,0.033416,0.000000,0,9,pass,1,0.031625;0.035916;0.026833;0.033416;0.027625;0.024667;0.033708;0.034708;0.036959
-chain,256,255,1,cpu_pool10_distance,0.032375,0.000000,0.032375,0.000000,0,9,pass,0,0.033750;0.033000;0.030500;0.024583;0.043792;0.019459;0.032375;0.032750;0.026333
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.585459,0.000000,0.585459,0.000000,0,9,pass,8,0.634625;0.620333;0.607833;0.610125;0.585459;0.575459;0.583375;0.570917;0.562458
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.279667,0.000000,0.279667,0.000000,0,9,pass,0,0.336250;0.315000;0.279667;0.277041;0.278250;0.280958;0.286333;0.267625;0.273000
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.149667,0.000000,0.149667,0.000000,0,9,pass,8,0.147333;0.155041;0.152666;0.154875;0.149667;0.143208;0.138250;0.151125;0.131666
-random_masked_int64_reverse,1024,8192,8,cpu_pool10_distance,0.092750,0.000000,0.092750,0.000000,0,9,pass,0,0.093708;0.096667;0.091667;0.088125;0.092083;0.090250;0.097916;0.099708;0.092750
-random,4096,32768,1,cpu_full,0.640750,0.000000,0.640750,0.000000,0,9,pass,1,0.654125;0.672584;0.635750;0.640750;0.630541;0.715625;0.663917;0.620958;0.638875
-random,4096,32768,1,cpu_distance,0.305042,0.000000,0.305042,0.000000,0,9,pass,0,0.318834;0.383000;0.356625;0.305042;0.285792;0.279584;0.276209;0.281125;0.308542
-random,4096,32768,1,cpu_pool10,0.750792,0.000000,0.750792,0.000000,0,9,pass,1,0.732959;0.763292;0.765875;0.765083;0.750291;0.750792;0.697250;0.738625;0.866042
-random,4096,32768,1,cpu_pool10_distance,0.396125,0.000000,0.396125,0.000000,0,9,pass,0,0.391083;0.399042;0.400041;0.445875;0.352625;0.396125;0.416417;0.368375;0.364292
-random,4096,32768,64,cpu_full,50.551959,0.000000,50.551959,0.000000,0,9,pass,64,50.982291;50.381667;51.224250;50.245000;49.884125;50.077625;50.921250;50.551959;51.063625
-random,4096,32768,64,cpu_distance,25.068208,0.000000,25.068208,0.000000,0,9,pass,0,24.892083;25.225875;25.305542;24.956250;25.502416;25.652625;24.782041;25.068208;24.635917
-random,4096,32768,64,cpu_pool10,5.984083,0.000000,5.984083,0.000000,0,9,pass,64,6.019500;6.024709;5.952959;5.948666;5.984083;6.007625;5.921583;5.963333;6.381042
-random,4096,32768,64,cpu_pool10_distance,2.967750,0.000000,2.967750,0.000000,0,9,pass,0,2.974166;2.993208;2.954208;2.951584;2.963167;2.988542;2.967750;2.972125;2.958500
-random,4096,32768,256,cpu_full,203.524291,0.000000,203.524291,0.000000,0,9,pass,256,201.889458;203.077667;202.445916;205.140292;207.688792;203.452125;204.337834;203.558833;203.524291
-random,4096,32768,256,cpu_distance,100.870916,0.000000,100.870916,0.000000,0,9,pass,0,102.179417;100.391417;99.621458;99.962083;100.870916;100.120167;102.712666;103.321958;103.868375
-random,4096,32768,256,cpu_pool10,23.461417,0.000000,23.461417,0.000000,0,9,pass,256,23.404958;23.153542;23.566042;22.393541;23.576000;23.669625;28.794875;23.461417;23.088458
-random,4096,32768,256,cpu_pool10_distance,12.019459,0.000000,12.019459,0.000000,0,9,pass,0,11.456875;11.726541;12.966375;12.238042;12.717875;12.019459;11.796125;12.376375;11.948333
-random,16384,131072,1,cpu_full,4.095417,0.000000,4.095417,0.000000,0,9,pass,1,4.290250;3.940416;4.150417;3.954583;3.887333;4.095417;3.985083;4.162667;4.295334
-random,16384,131072,1,cpu_distance,2.076458,0.000000,2.076458,0.000000,0,9,pass,0,2.369584;2.076458;1.996792;2.022250;2.259167;2.148209;2.015833;2.012167;2.160583
-random,16384,131072,1,cpu_pool10,3.907000,0.000000,3.907000,0.000000,0,9,pass,1,3.736125;3.756166;4.311583;4.175125;3.876833;3.907000;4.442625;3.681041;4.181042
-random,16384,131072,1,cpu_pool10_distance,1.988250,0.000000,1.988250,0.000000,0,9,pass,0,1.939375;1.947750;1.892166;1.988250;1.939125;1.997125;2.016583;2.086959;2.044542
-random,16384,131072,64,cpu_full,246.791250,0.000000,246.791250,0.000000,0,9,pass,64,247.174041;257.095833;248.073500;242.532542;244.690333;241.950875;242.319083;246.791250;248.494458
-random,16384,131072,64,cpu_distance,128.259375,0.000000,128.259375,0.000000,0,9,pass,0,128.418500;127.874875;128.259375;128.375083;129.444958;127.964208;128.118000;128.115125;128.568334
-random,16384,131072,64,cpu_pool10,28.289500,0.000000,28.289500,0.000000,0,9,pass,64,28.152417;28.391750;28.205000;28.321167;28.289500;28.210041;28.201417;28.320125;28.388750
-random,16384,131072,64,cpu_pool10_distance,14.897583,0.000000,14.897583,0.000000,0,9,pass,0,14.930292;14.903167;14.878917;14.855125;14.861167;14.889166;14.897583;14.933375;14.931750
-random,65536,524288,1,cpu_full,20.761667,0.000000,20.761667,0.000000,0,9,pass,1,20.893041;20.761667;21.248417;22.771708;19.348959;21.047583;20.342500;19.837625;20.622167
-random,65536,524288,1,cpu_distance,10.450375,0.000000,10.450375,0.000000,0,9,pass,0,10.685375;10.484542;10.293209;10.711500;10.304833;10.450375;10.329542;10.734417;10.264709
-random,65536,524288,1,cpu_pool10,21.484917,0.000000,21.484917,0.000000,0,9,pass,1,18.160875;18.542833;18.610750;19.389750;22.475417;22.478750;21.749084;21.484917;21.888666
-random,65536,524288,1,cpu_pool10_distance,10.246625,0.000000,10.246625,0.000000,0,9,pass,0,11.192042;10.267166;9.973292;10.866416;10.246625;10.542208;10.197125;10.197459;9.896917
-random,65536,524288,64,cpu_full,1257.924209,0.000000,1257.924209,0.000000,0,9,pass,64,1282.247375;1223.090292;1257.924209;1239.818375;1313.894125;1432.189959;1278.728875;1241.412875;1243.033125
-random,65536,524288,64,cpu_distance,665.201250,0.000000,665.201250,0.000000,0,9,pass,0,662.326750;666.337417;657.751459;704.184958;697.644750;659.886125;673.242417;661.982917;665.201250
-random,65536,524288,64,cpu_pool10,174.081708,0.000000,174.081708,0.000000,0,9,pass,64,172.784166;174.081708;191.587583;188.869292;171.705625;172.985750;174.222334;173.790417;176.710000
-random,65536,524288,64,cpu_pool10_distance,85.845625,0.000000,85.845625,0.000000,0,9,pass,0,85.845625;85.446458;85.561875;85.000792;84.927542;86.648500;86.624791;86.942667;86.348917
-chain,2048,2047,1,cpu_full,0.019875,0.000000,0.019875,0.000000,0,9,pass,1,0.020458;0.019959;0.019875;0.019583;0.020208;0.019667;0.019459;0.019625;0.020042
-chain,2048,2047,1,cpu_distance,0.004125,0.000000,0.004125,0.000000,0,9,pass,0,0.004125;0.004084;0.004791;0.006167;0.004167;0.004125;0.004208;0.004125;0.004125
-chain,2048,2047,1,cpu_pool10,0.047125,0.000000,0.047125,0.000000,0,9,pass,1,0.046833;0.050542;0.047125;0.052875;0.048833;0.043500;0.047750;0.046042;0.045958
-chain,2048,2047,1,cpu_pool10_distance,0.038333,0.000000,0.038333,0.000000,0,9,pass,0,0.040375;0.035459;0.067417;0.054459;0.036875;0.033208;0.037333;0.039625;0.038333
-random,4096,131072,1,cpu_full,1.762250,0.000000,1.762250,0.000000,0,9,pass,1,1.806584;1.750208;1.770750;1.810833;1.762250;1.677250;1.621583;1.615750;1.778292
-random,4096,131072,1,cpu_distance,0.664917,0.000000,0.664917,0.000000,0,9,pass,0,0.857084;0.738708;0.715458;0.683333;0.664917;0.663708;0.659416;0.646792;0.643541
-random,4096,131072,1,cpu_pool10,1.889833,0.000000,1.889833,0.000000,0,9,pass,1,2.152625;1.844084;1.923250;1.834959;3.235375;1.889833;1.780667;1.750917;1.954125
-random,4096,131072,1,cpu_pool10_distance,0.804916,0.000000,0.804916,0.000000,0,9,pass,0,0.804916;0.831125;0.772208;0.863541;0.727250;0.842625;0.810208;0.785750;0.799167
-random,4096,131072,64,cpu_full,111.141125,0.000000,111.141125,0.000000,0,9,pass,64,110.630292;111.750125;111.395709;110.963250;112.158667;110.807166;115.478417;111.141125;110.905125
-random,4096,131072,64,cpu_distance,49.129500,0.000000,49.129500,0.000000,0,9,pass,0,49.369208;49.268292;49.148708;48.819417;48.989750;49.011250;49.129500;49.123375;49.282917
-random,4096,131072,64,cpu_pool10,12.773541,0.000000,12.773541,0.000000,0,9,pass,64,12.743708;12.746417;12.784667;12.899042;12.785000;12.787333;12.773541;12.744042;12.745292
-random,4096,131072,64,cpu_pool10_distance,5.610042,0.000000,5.610042,0.000000,0,9,pass,0,5.610042;5.667416;5.604791;5.622333;5.622292;5.609708;5.594958;5.616958;5.591208
-clos,200,20000,1,cpu_full,0.146333,0.000000,0.146333,0.000000,0,9,pass,1,0.155084;0.150416;0.158791;0.145667;0.143875;0.146333;0.147833;0.145000;0.145083
-clos,200,20000,1,cpu_distance,0.024083,0.000000,0.024083,0.000000,0,9,pass,0,0.024459;0.024500;0.024459;0.024292;0.024083;0.023958;0.023916;0.023916;0.023833
-clos,200,20000,1,cpu_pool10,0.170166,0.000000,0.170166,0.000000,0,9,pass,1,0.180250;0.168541;0.179459;0.169875;0.181375;0.166083;0.172709;0.170166;0.163959
-clos,200,20000,1,cpu_pool10_distance,0.049459,0.000000,0.049459,0.000000,0,9,pass,0,0.049458;0.054750;0.042083;0.050958;0.047250;0.049792;0.043166;0.049459;0.050333
-clos,200,20000,64,cpu_full,9.367041,0.000000,9.367041,0.000000,0,9,pass,64,9.367041;9.242792;9.226125;9.416416;9.313959;9.471959;9.546000;9.554458;9.346500
-clos,200,20000,64,cpu_distance,1.571458,0.000000,1.571458,0.000000,0,9,pass,0,1.547375;1.586542;1.571458;1.591250;1.581791;1.544750;1.563000;1.727667;1.547708
-clos,200,20000,64,cpu_pool10,1.180583,0.000000,1.180583,0.000000,0,9,pass,64,1.180583;1.425375;1.678916;1.141583;1.178625;1.772750;1.123250;1.115709;1.238625
-clos,200,20000,64,cpu_pool10_distance,0.210666,0.000000,0.210666,0.000000,0,9,pass,0,0.210666;0.210167;0.210791;0.213917;0.212750;0.209541;0.208833;0.222125;0.209959
-clos,800,320000,1,cpu_full,2.329667,0.000000,2.329667,0.000000,0,9,pass,1,2.286500;2.305791;2.298750;2.346875;2.329667;2.382750;2.380916;2.264417;2.339750
-clos,800,320000,1,cpu_distance,0.356042,0.000000,0.356042,0.000000,0,9,pass,0,0.355584;0.363375;0.355792;0.355042;0.358042;0.354375;0.369792;0.356042;0.356083
-clos,800,320000,1,cpu_pool10,2.282875,0.000000,2.282875,0.000000,0,9,pass,1,2.323791;2.271917;2.281042;2.342584;2.281667;2.282875;2.308708;2.378000;2.273750
-clos,800,320000,1,cpu_pool10_distance,0.353625,0.000000,0.353625,0.000000,0,9,pass,0,0.352834;0.357209;0.353625;0.343166;0.347125;0.376250;0.361042;0.350583;0.377083
-clos,800,320000,64,cpu_full,149.821292,0.000000,149.821292,0.000000,0,9,pass,64,153.024458;148.259167;148.473541;147.598584;150.283417;149.821292;152.691250;151.819917;149.421125
-clos,800,320000,64,cpu_distance,23.226250,0.000000,23.226250,0.000000,0,9,pass,0,23.181583;23.269459;23.226250;23.155542;23.227333;23.171541;23.268875;23.184708;23.296417
-clos,800,320000,64,cpu_pool10,17.461541,0.000000,17.461541,0.000000,0,9,pass,64,17.357208;17.461541;17.265958;18.456042;17.167833;18.505625;18.100083;17.112291;17.978709
-clos,800,320000,64,cpu_pool10_distance,2.672125,0.000000,2.672125,0.000000,0,9,pass,0,2.659791;2.670333;2.681541;2.679541;2.675000;2.728833;2.665083;2.668416;2.672125
-grid,10000,39600,1,cpu_full,0.613750,0.000000,0.613750,0.000000,0,9,pass,1,0.622750;0.618000;0.613750;0.612417;0.615000;0.608000;0.611792;0.607708;0.645042
-grid,10000,39600,1,cpu_distance,0.175083,0.000000,0.175083,0.000000,0,9,pass,0,0.182917;0.172292;0.174584;0.178042;0.175083;0.177042;0.174958;0.176834;0.173000
-grid,10000,39600,1,cpu_pool10,0.669667,0.000000,0.669667,0.000000,0,9,pass,1,0.701208;0.654875;0.704833;0.664958;0.683667;0.685791;0.669667;0.635500;0.627875
-grid,10000,39600,1,cpu_pool10_distance,0.198375,0.000000,0.198375,0.000000,0,9,pass,0,0.198375;0.200542;0.189542;0.197417;0.203625;0.207292;0.197625;0.185166;0.207542
-grid,10000,39600,8,cpu_full,5.544583,0.000000,5.544583,0.000000,0,9,pass,8,5.634791;5.632250;5.544583;5.519792;5.581667;5.498625;5.532291;5.510583;5.655459
-grid,10000,39600,8,cpu_distance,1.551083,0.000000,1.551083,0.000000,0,9,pass,0,1.551083;1.545959;1.550084;1.538041;1.562667;1.553583;1.550583;1.559500;1.551958
-grid,10000,39600,8,cpu_pool10,0.828792,0.000000,0.828792,0.000000,0,9,pass,8,0.829458;0.826417;0.816667;0.841541;0.828792;0.840833;0.818709;0.849666;0.807209
-grid,10000,39600,8,cpu_pool10_distance,0.246709,0.000000,0.246709,0.000000,0,9,pass,0,0.252792;0.247292;0.246709;0.250959;0.243625;0.241375;0.250417;0.245958;0.237708
-grid,40000,159200,1,cpu_full,2.912625,0.000000,2.912625,0.000000,0,9,pass,1,2.956292;2.945167;2.898708;2.920250;2.897166;2.912625;2.900000;2.877417;2.937083
-grid,40000,159200,1,cpu_distance,0.862709,0.000000,0.862709,0.000000,0,9,pass,0,0.866083;0.862709;0.859791;0.868292;0.861792;0.854458;0.858000;0.891958;0.880750
-grid,40000,159200,1,cpu_pool10,2.922000,0.000000,2.922000,0.000000,0,9,pass,1,2.913416;3.005208;2.922000;2.959416;2.880500;2.921209;2.976625;2.863500;2.943000
-grid,40000,159200,1,cpu_pool10_distance,0.859875,0.000000,0.859875,0.000000,0,9,pass,0,0.871416;0.871500;0.890875;0.859875;0.857583;0.859875;0.851917;0.858750;0.884625
diff --git a/dev/research/metal_pathfinding/results/aba/a2-stderr.txt b/dev/research/metal_pathfinding/results/aba/a2-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/aba/a2.csv b/dev/research/metal_pathfinding/results/aba/a2.csv
deleted file mode 100644
index c09febd..0000000
--- a/dev/research/metal_pathfinding/results/aba/a2.csv
+++ /dev/null
@@ -1,109 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.010125,0.000000,0.010125,0.000000,0,9,pass,1,0.011291;0.010208;0.009417;0.009834;0.010125;0.010667;0.009375;0.010708;0.009500
-random,128,1024,1,cpu_distance,0.004542,0.000000,0.004542,0.000000,0,9,pass,0,0.007583;0.004542;0.004209;0.006084;0.005083;0.004250;0.005041;0.004125;0.004083
-random,128,1024,1,cpu_pool10,0.038500,0.000000,0.038500,0.000000,0,9,pass,1,0.043292;0.032917;0.043125;0.028500;0.041667;0.029708;0.027125;0.045875;0.038500
-random,128,1024,1,cpu_pool10_distance,0.032458,0.000000,0.032458,0.000000,0,9,pass,0,0.028416;0.034125;0.028625;0.040542;0.036459;0.031792;0.032458;0.046292;0.029625
-random,128,1024,64,cpu_full,0.882084,0.000000,0.882084,0.000000,0,9,pass,64,0.943708;0.939166;0.898167;0.865625;0.835250;0.817583;0.808000;0.981042;0.882084
-random,128,1024,64,cpu_distance,0.352750,0.000000,0.352750,0.000000,0,9,pass,0,0.396292;0.383500;0.370208;0.364500;0.352750;0.319208;0.299125;0.288833;0.281458
-random,128,1024,64,cpu_pool10,0.162250,0.000000,0.162250,0.000000,0,9,pass,64,0.186542;0.160833;0.162250;0.166667;0.178041;0.168500;0.157208;0.155042;0.145833
-random,128,1024,64,cpu_pool10_distance,0.101625,0.000000,0.101625,0.000000,0,9,pass,0,0.120959;0.109750;0.105459;0.100958;0.101625;0.098250;0.090542;0.097292;0.111625
-random,1024,8192,1,cpu_full,0.114917,0.000000,0.114917,0.000000,0,9,pass,1,0.115166;0.182417;0.159666;0.129625;0.114917;0.104542;0.107958;0.114625;0.109583
-random,1024,8192,1,cpu_distance,0.056041,0.000000,0.056041,0.000000,0,9,pass,0,0.059250;0.057125;0.056875;0.056292;0.055458;0.055625;0.055584;0.055750;0.056041
-random,1024,8192,1,cpu_pool10,0.176208,0.000000,0.176208,0.000000,0,9,pass,1,0.226166;0.199125;0.176375;0.176208;0.186917;0.144625;0.122041;0.161459;0.117833
-random,1024,8192,1,cpu_pool10_distance,0.081084,0.000000,0.081084,0.000000,0,9,pass,0,0.093458;0.083833;0.079416;0.075917;0.089958;0.077500;0.081084;0.077875;0.102834
-random,1024,8192,64,cpu_full,10.597708,0.000000,10.597708,0.000000,0,9,pass,64,10.453250;10.597708;10.592875;10.643083;10.582625;10.578917;10.603500;10.599333;10.665834
-random,1024,8192,64,cpu_distance,5.116292,0.000000,5.116292,0.000000,0,9,pass,0,5.129709;5.086792;5.078084;5.113291;4.995542;5.247625;5.135333;5.178792;5.116292
-random,1024,8192,64,cpu_pool10,1.330416,0.000000,1.330416,0.000000,0,9,pass,64,1.344375;1.330416;1.368250;1.355459;1.320791;1.322667;1.316250;1.328917;1.334500
-random,1024,8192,64,cpu_pool10_distance,0.657208,0.000000,0.657208,0.000000,0,9,pass,0,0.699125;0.687958;0.645250;0.685584;0.656208;0.638084;0.657792;0.654250;0.657208
-fabric,288,16384,1,cpu_full,0.109875,0.000000,0.109875,0.000000,0,9,pass,1,0.110875;0.110875;0.109834;0.109708;0.109875;0.109500;0.109541;0.113917;0.116625
-fabric,288,16384,1,cpu_distance,0.021542,0.000000,0.021542,0.000000,0,9,pass,0,0.022208;0.021625;0.021750;0.021667;0.021542;0.021500;0.021458;0.021375;0.021375
-fabric,288,16384,1,cpu_pool10,0.135458,0.000000,0.135458,0.000000,0,9,pass,1,0.133584;0.135666;0.133667;0.133542;0.137292;0.141667;0.135458;0.136208;0.130291
-fabric,288,16384,1,cpu_pool10_distance,0.039583,0.000000,0.039583,0.000000,0,9,pass,0,0.036625;0.038750;0.036875;0.041333;0.040791;0.041500;0.039583;0.040666;0.037458
-fabric,288,16384,64,cpu_full,7.310750,0.000000,7.310750,0.000000,0,9,pass,64,7.344708;7.291375;7.259292;7.500875;7.443000;7.251542;7.310750;7.236333;7.320583
-fabric,288,16384,64,cpu_distance,1.393958,0.000000,1.393958,0.000000,0,9,pass,0,1.388542;1.386750;1.402250;1.364583;1.427250;1.416834;1.427416;1.393917;1.393958
-fabric,288,16384,64,cpu_pool10,0.991791,0.000000,0.991791,0.000000,0,9,pass,64,1.373958;0.994750;0.972667;0.947500;1.129792;1.035750;0.958875;0.953333;0.991791
-fabric,288,16384,64,cpu_pool10_distance,0.219167,0.000000,0.219167,0.000000,0,9,pass,0,0.218291;0.221500;0.250875;0.233959;0.234083;0.219167;0.216541;0.212542;0.204333
-grid,1024,3968,1,cpu_full,0.045500,0.000000,0.045500,0.000000,0,9,pass,1,0.047542;0.044041;0.042958;0.044708;0.045500;0.045750;0.045042;0.045583;0.045833
-grid,1024,3968,1,cpu_distance,0.011750,0.000000,0.011750,0.000000,0,9,pass,0,0.012250;0.012083;0.012000;0.011834;0.011750;0.011708;0.011750;0.011750;0.011750
-grid,1024,3968,1,cpu_pool10,0.084417,0.000000,0.084417,0.000000,0,9,pass,1,0.094708;0.087625;0.076625;0.061000;0.084417;0.067833;0.096875;0.117792;0.078792
-grid,1024,3968,1,cpu_pool10_distance,0.045500,0.000000,0.045500,0.000000,0,9,pass,0,0.064333;0.045667;0.031125;0.033708;0.035250;0.053875;0.045500;0.041792;0.057500
-grid,1024,3968,64,cpu_full,4.000542,0.000000,4.000542,0.000000,0,9,pass,64,3.861917;4.025167;3.945917;3.903083;3.850167;4.000542;4.054667;4.033458;4.074458
-grid,1024,3968,64,cpu_distance,0.911416,0.000000,0.911416,0.000000,0,9,pass,0,0.911416;0.948042;1.001584;0.923792;0.934333;0.881667;0.869666;0.863375;0.878458
-grid,1024,3968,64,cpu_pool10,0.556209,0.000000,0.556209,0.000000,0,9,pass,64,0.582292;0.556209;0.572125;0.576792;0.514250;0.520333;0.565041;0.535541;0.523625
-grid,1024,3968,64,cpu_pool10_distance,0.157333,0.000000,0.157333,0.000000,0,9,pass,0,0.159250;0.156500;0.148250;0.157333;0.149000;0.169417;0.172209;0.159416;0.156792
-chain,256,255,1,cpu_full,0.002542,0.000000,0.002542,0.000000,0,9,pass,1,0.002667;0.002542;0.002584;0.002542;0.002542;0.002541;0.002583;0.002500;0.002500
-chain,256,255,1,cpu_distance,0.000958,0.000000,0.000958,0.000000,0,9,pass,0,0.000875;0.000958;0.000917;0.000958;0.001000;0.001000;0.000917;0.000959;0.000667
-chain,256,255,1,cpu_pool10,0.038084,0.000000,0.038084,0.000000,0,9,pass,1,0.049917;0.022958;0.059167;0.026500;0.041958;0.038084;0.036959;0.032916;0.039875
-chain,256,255,1,cpu_pool10_distance,0.032084,0.000000,0.032084,0.000000,0,9,pass,0,0.034417;0.027541;0.024833;0.059083;0.032084;0.036416;0.031375;0.035792;0.031709
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.622542,0.000000,0.622542,0.000000,0,9,pass,8,0.656083;0.637375;0.623500;0.618166;0.612250;0.638208;0.621334;0.622542;0.615333
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.313375,0.000000,0.313375,0.000000,0,9,pass,0,0.455750;0.416334;0.353042;0.336416;0.311333;0.313375;0.298417;0.294709;0.274708
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.149333,0.000000,0.149333,0.000000,0,9,pass,8,0.161500;0.170125;0.149333;0.148958;0.164959;0.147667;0.152334;0.145125;0.147209
-random_masked_int64_reverse,1024,8192,8,cpu_pool10_distance,0.094875,0.000000,0.094875,0.000000,0,9,pass,0,0.098500;0.094875;0.090916;0.093625;0.098708;0.092167;0.097417;0.095833;0.086709
-random,4096,32768,1,cpu_full,0.665250,0.000000,0.665250,0.000000,0,9,pass,1,0.705917;0.685375;0.671708;0.665250;0.653375;0.651750;0.648125;0.643875;0.835666
-random,4096,32768,1,cpu_distance,0.321708,0.000000,0.321708,0.000000,0,9,pass,0,0.410750;0.405125;0.388500;0.354875;0.321708;0.306916;0.311333;0.304709;0.306125
-random,4096,32768,1,cpu_pool10,0.846916,0.000000,0.846916,0.000000,0,9,pass,1,0.846916;0.862333;0.751875;0.909917;0.887167;0.744667;0.925958;0.837833;0.797042
-random,4096,32768,1,cpu_pool10_distance,0.419167,0.000000,0.419167,0.000000,0,9,pass,0,0.497750;0.422541;0.426500;0.419167;0.427625;0.391417;0.366791;0.368958;0.339334
-random,4096,32768,64,cpu_full,52.102750,0.000000,52.102750,0.000000,0,9,pass,64,54.203292;52.887375;53.023041;52.102750;52.049958;52.098542;51.865416;52.029500;52.275167
-random,4096,32768,64,cpu_distance,25.658708,0.000000,25.658708,0.000000,0,9,pass,0,25.682333;25.592583;25.472083;25.676084;25.588542;25.605833;25.926083;25.931125;25.658708
-random,4096,32768,64,cpu_pool10,5.952500,0.000000,5.952500,0.000000,0,9,pass,64,5.960083;5.958084;5.952500;5.969125;5.916334;5.945459;5.953625;5.943708;5.924416
-random,4096,32768,64,cpu_pool10_distance,2.946417,0.000000,2.946417,0.000000,0,9,pass,0,2.963708;2.961416;2.946417;2.949209;2.940333;2.938209;2.953708;2.929417;2.940166
-random,4096,32768,256,cpu_full,207.033042,0.000000,207.033042,0.000000,0,9,pass,256,208.565333;207.732417;206.951125;206.977250;206.746375;206.994000;207.033042;207.599666;207.870500
-random,4096,32768,256,cpu_distance,104.569458,0.000000,104.569458,0.000000,0,9,pass,0,105.489166;105.644292;104.210667;102.589875;104.569458;105.916375;103.105292;102.977125;107.510125
-random,4096,32768,256,cpu_pool10,23.386500,0.000000,23.386500,0.000000,0,9,pass,256,40.046458;23.359125;23.306292;23.386500;24.774417;23.782250;22.939459;22.685208;23.506417
-random,4096,32768,256,cpu_pool10_distance,11.367917,0.000000,11.367917,0.000000,0,9,pass,0,11.047292;10.975666;11.068375;11.096125;11.459875;11.367917;11.371333;11.403250;11.463708
-random,16384,131072,1,cpu_full,3.915167,0.000000,3.915167,0.000000,0,9,pass,1,3.871459;4.099250;4.174833;3.915167;4.067542;3.926667;3.831250;3.879667;3.870000
-random,16384,131072,1,cpu_distance,1.960417,0.000000,1.960417,0.000000,0,9,pass,0,2.021875;1.960417;1.889875;1.857792;2.170125;2.063458;2.063166;1.951458;1.904583
-random,16384,131072,1,cpu_pool10,3.940500,0.000000,3.940500,0.000000,0,9,pass,1,3.966375;3.874167;3.981292;4.094000;3.940500;4.023542;3.924041;3.918916;3.782834
-random,16384,131072,1,cpu_pool10_distance,2.005583,0.000000,2.005583,0.000000,0,9,pass,0,2.005583;2.140833;2.080500;2.099291;1.932666;2.019334;1.991167;1.966417;1.891875
-random,16384,131072,64,cpu_full,249.146417,0.000000,249.146417,0.000000,0,9,pass,64,252.116875;249.126041;248.933209;249.146417;248.897333;248.611000;260.195000;253.889292;251.157125
-random,16384,131072,64,cpu_distance,132.024792,0.000000,132.024792,0.000000,0,9,pass,0,131.589042;132.093459;131.786375;132.343417;132.024792;131.772916;131.826667;132.098333;135.958042
-random,16384,131072,64,cpu_pool10,28.429458,0.000000,28.429458,0.000000,0,9,pass,64,28.800875;29.234250;28.369500;28.398458;28.653125;28.380084;28.296458;29.236500;28.429458
-random,16384,131072,64,cpu_pool10_distance,15.058709,0.000000,15.058709,0.000000,0,9,pass,0,15.146458;15.097000;15.004334;15.058709;15.114167;15.033833;15.072750;14.995417;14.993083
-random,65536,524288,1,cpu_full,22.344958,0.000000,22.344958,0.000000,0,9,pass,1,20.957625;24.492167;21.762292;22.567791;23.338708;23.546042;22.344958;20.185500;20.875542
-random,65536,524288,1,cpu_distance,11.777084,0.000000,11.777084,0.000000,0,9,pass,0,10.724750;10.590250;10.794833;11.777084;12.048833;13.794083;19.637375;12.146958;11.220417
-random,65536,524288,1,cpu_pool10,21.763875,0.000000,21.763875,0.000000,0,9,pass,1,20.818541;20.408583;21.249875;21.763875;22.344583;21.183208;22.291542;22.923167;22.071500
-random,65536,524288,1,cpu_pool10_distance,10.599042,0.000000,10.599042,0.000000,0,9,pass,0,11.239875;11.393583;10.554125;10.913917;10.701125;10.246333;10.511791;10.435750;10.599042
-random,65536,524288,64,cpu_full,1286.349583,0.000000,1286.349583,0.000000,0,9,pass,64,1436.236750;1242.607958;1309.405000;1284.448917;1317.436833;1286.349583;1280.854542;1304.641916;1262.528792
-random,65536,524288,64,cpu_distance,687.072041,0.000000,687.072041,0.000000,0,9,pass,0,684.747959;695.653708;779.019209;761.691542;753.222334;687.072041;685.139583;682.279667;676.369750
-random,65536,524288,64,cpu_pool10,189.990250,0.000000,189.990250,0.000000,0,9,pass,64,185.822458;179.728458;185.915209;182.268708;189.990250;192.153125;192.239500;198.405625;190.860042
-random,65536,524288,64,cpu_pool10_distance,93.937500,0.000000,93.937500,0.000000,0,9,pass,0,99.322250;93.374583;93.937500;94.460250;87.558167;89.512333;88.269208;104.313125;95.677000
-chain,2048,2047,1,cpu_full,0.019666,0.000000,0.019666,0.000000,0,9,pass,1,0.019541;0.019542;0.019666;0.019791;0.019708;0.019791;0.019625;0.019625;0.019666
-chain,2048,2047,1,cpu_distance,0.004042,0.000000,0.004042,0.000000,0,9,pass,0,0.004209;0.004083;0.004042;0.004083;0.004042;0.004000;0.004042;0.004041;0.004209
-chain,2048,2047,1,cpu_pool10,0.048500,0.000000,0.048500,0.000000,0,9,pass,1,0.050000;0.044166;0.051875;0.049250;0.048500;0.044291;0.041708;0.047042;0.072375
-chain,2048,2047,1,cpu_pool10_distance,0.042333,0.000000,0.042333,0.000000,0,9,pass,0,0.062625;0.052375;0.035417;0.041667;0.042333;0.039750;0.045375;0.040334;0.063042
-random,4096,131072,1,cpu_full,1.762667,0.000000,1.762667,0.000000,0,9,pass,1,1.783083;1.739791;1.677667;1.630625;1.836959;1.791583;1.798959;1.762667;1.697500
-random,4096,131072,1,cpu_distance,0.680958,0.000000,0.680958,0.000000,0,9,pass,0,0.821875;0.748750;0.696833;0.677666;0.680958;0.664792;0.675959;0.692125;0.670458
-random,4096,131072,1,cpu_pool10,1.771417,0.000000,1.771417,0.000000,0,9,pass,1,1.784500;1.758750;1.775333;1.712750;1.894250;1.771417;1.747083;1.638625;1.985833
-random,4096,131072,1,cpu_pool10_distance,0.768625,0.000000,0.768625,0.000000,0,9,pass,0,0.760541;0.750709;0.868917;0.747375;0.830375;0.832375;0.811041;0.748417;0.768625
-random,4096,131072,64,cpu_full,114.166208,0.000000,114.166208,0.000000,0,9,pass,64,114.166208;116.409167;117.530542;116.397459;113.341167;114.552042;112.884375;113.846000;112.957667
-random,4096,131072,64,cpu_distance,50.983000,0.000000,50.983000,0.000000,0,9,pass,0,49.911458;52.691959;51.868542;51.245250;50.838875;50.500250;51.579291;50.983000;49.495584
-random,4096,131072,64,cpu_pool10,12.922583,0.000000,12.922583,0.000000,0,9,pass,64,12.922583;13.513000;12.838000;12.768708;12.765625;12.907458;12.986166;13.330500;12.955583
-random,4096,131072,64,cpu_pool10_distance,5.637750,0.000000,5.637750,0.000000,0,9,pass,0,5.667166;5.637750;5.624833;5.653125;5.619750;5.603500;5.658417;5.609250;5.802792
-clos,200,20000,1,cpu_full,0.144333,0.000000,0.144333,0.000000,0,9,pass,1,0.148333;0.146667;0.143875;0.144333;0.143083;0.142916;0.145292;0.143083;0.144583
-clos,200,20000,1,cpu_distance,0.023875,0.000000,0.023875,0.000000,0,9,pass,0,0.024500;0.024583;0.025375;0.023916;0.023875;0.023625;0.023709;0.023833;0.023708
-clos,200,20000,1,cpu_pool10,0.181708,0.000000,0.181708,0.000000,0,9,pass,1,0.195084;0.181834;0.174416;0.181708;0.185958;0.175625;0.172917;0.182959;0.177958
-clos,200,20000,1,cpu_pool10_distance,0.045791,0.000000,0.045791,0.000000,0,9,pass,0,0.045125;0.044042;0.045959;0.044208;0.044125;0.045791;0.051208;0.053792;0.047958
-clos,200,20000,64,cpu_full,9.353375,0.000000,9.353375,0.000000,0,9,pass,64,9.553375;9.510625;9.461208;9.351667;9.505875;9.271583;9.353375;9.296625;9.265625
-clos,200,20000,64,cpu_distance,1.548583,0.000000,1.548583,0.000000,0,9,pass,0,1.557625;1.542666;1.548583;1.566084;1.550334;1.554500;1.535959;1.540042;1.542584
-clos,200,20000,64,cpu_pool10,1.698750,0.000000,1.698750,0.000000,0,9,pass,64,1.173084;2.027625;1.917583;1.160792;1.453625;1.748917;1.155959;1.698750;1.717292
-clos,200,20000,64,cpu_pool10_distance,0.208292,0.000000,0.208292,0.000000,0,9,pass,0,0.202125;0.205000;0.210625;0.208292;0.209000;0.211875;0.209833;0.204000;0.205084
-clos,800,320000,1,cpu_full,2.367500,0.000000,2.367500,0.000000,0,9,pass,1,2.290667;2.292958;2.367500;2.330167;2.377042;2.379000;2.437042;2.441333;2.338166
-clos,800,320000,1,cpu_distance,0.354709,0.000000,0.354709,0.000000,0,9,pass,0,0.354416;0.354709;0.368084;0.354375;0.354916;0.354459;0.355250;0.354125;0.354833
-clos,800,320000,1,cpu_pool10,2.355459,0.000000,2.355459,0.000000,0,9,pass,1,2.333708;2.340416;2.323208;2.343625;2.355459;2.450958;2.476583;2.390417;2.366000
-clos,800,320000,1,cpu_pool10_distance,0.384625,0.000000,0.384625,0.000000,0,9,pass,0,0.390750;0.377542;0.374417;0.393666;0.384625;0.371542;0.365750;0.433833;0.465958
-clos,800,320000,64,cpu_full,150.499083,0.000000,150.499083,0.000000,0,9,pass,64,150.015333;149.947166;150.499083;156.703375;152.934333;149.782625;148.341584;150.854583;152.985292
-clos,800,320000,64,cpu_distance,23.215333,0.000000,23.215333,0.000000,0,9,pass,0,23.143708;23.199416;23.217792;23.347208;23.196417;23.255250;23.228292;23.215333;23.190166
-clos,800,320000,64,cpu_pool10,17.633500,0.000000,17.633500,0.000000,0,9,pass,64,18.064708;17.153916;17.209292;17.633500;18.146959;17.173000;17.843000;17.199125;18.153375
-clos,800,320000,64,cpu_pool10_distance,2.661125,0.000000,2.661125,0.000000,0,9,pass,0,2.661792;2.661125;2.652542;2.656709;2.671125;2.672625;2.656959;2.663500;2.651500
-grid,10000,39600,1,cpu_full,0.616459,0.000000,0.616459,0.000000,0,9,pass,1,0.626625;0.616459;0.613167;0.613625;0.625416;0.613000;0.608542;0.639750;0.714666
-grid,10000,39600,1,cpu_distance,0.183167,0.000000,0.183167,0.000000,0,9,pass,0,0.196583;0.182042;0.193041;0.183167;0.183584;0.199417;0.177208;0.178875;0.180833
-grid,10000,39600,1,cpu_pool10,0.698583,0.000000,0.698583,0.000000,0,9,pass,1,0.721334;0.700833;0.734208;0.698333;0.704459;0.686333;0.682375;0.698583;0.695333
-grid,10000,39600,1,cpu_pool10_distance,0.203416,0.000000,0.203416,0.000000,0,9,pass,0,0.205958;0.199667;0.214250;0.198750;0.205666;0.203416;0.192709;0.208667;0.193792
-grid,10000,39600,8,cpu_full,5.581208,0.000000,5.581208,0.000000,0,9,pass,8,5.578792;5.599916;5.618333;5.582417;5.581208;5.543958;5.535083;5.537709;5.587084
-grid,10000,39600,8,cpu_distance,1.567875,0.000000,1.567875,0.000000,0,9,pass,0,1.580000;1.576542;1.555958;1.555125;1.567875;1.579667;1.546834;1.552584;1.587292
-grid,10000,39600,8,cpu_pool10,0.817917,0.000000,0.817917,0.000000,0,9,pass,8,0.801417;0.817917;0.823250;0.824500;0.808833;0.838833;0.810916;0.840542;0.804375
-grid,10000,39600,8,cpu_pool10_distance,0.246125,0.000000,0.246125,0.000000,0,9,pass,0,0.253875;0.246125;0.244458;0.240583;0.246709;0.250500;0.241417;0.254875;0.241833
-grid,40000,159200,1,cpu_full,2.937459,0.000000,2.937459,0.000000,0,9,pass,1,2.965208;2.922333;2.901166;2.931000;2.937459;2.923958;2.956375;2.958417;3.028584
-grid,40000,159200,1,cpu_distance,0.877667,0.000000,0.877667,0.000000,0,9,pass,0,0.877667;0.871375;0.900625;0.874333;0.858875;0.877792;0.873958;0.895041;0.924417
-grid,40000,159200,1,cpu_pool10,3.069875,0.000000,3.069875,0.000000,0,9,pass,1,3.066875;3.098083;3.105208;3.176875;3.069875;3.004583;3.026041;3.023792;3.222750
-grid,40000,159200,1,cpu_pool10_distance,0.924708,0.000000,0.924708,0.000000,0,9,pass,0,0.936292;0.924708;0.929125;0.915334;0.884375;0.945375;0.927125;0.899667;0.890125
diff --git a/dev/research/metal_pathfinding/results/aba/b-stderr.txt b/dev/research/metal_pathfinding/results/aba/b-stderr.txt
deleted file mode 100644
index 5985671..0000000
--- a/dev/research/metal_pathfinding/results/aba/b-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=24.1354 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/aba/b.csv b/dev/research/metal_pathfinding/results/aba/b.csv
deleted file mode 100644
index 9be0375..0000000
--- a/dev/research/metal_pathfinding/results/aba/b.csv
+++ /dev/null
@@ -1,69 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,metal_pull,0.567417,0.322166,0.563459,0.019916,16,9,pass,0,0.602750;0.587458;0.567417;0.556208;0.548792;0.569833;0.601416;0.558500;0.566750
-random,128,1024,1,metal_group,0.251042,0.130875,0.247458,0.019916,9,9,pass,0,0.252625;0.251042;0.251041;0.251083;0.250791;0.250458;0.267250;0.280500;0.243125
-random,128,1024,1,metal_shared,0.242250,0.123542,0.238708,0.019916,9,9,pass,0,0.244125;0.240792;0.243250;0.242209;0.247542;0.370625;0.242250;0.240250;0.242042
-random,128,1024,64,metal_pull,0.857625,0.380292,0.638500,0.031459,16,9,pass,0,0.866750;0.833917;0.866208;0.857625;0.854625;0.869375;0.850458;0.844500;0.870542
-random,128,1024,64,metal_group,0.585250,0.179333,0.323750,0.031459,13,9,pass,0,0.516250;0.630916;0.534417;0.511167;0.585250;0.585291;0.586250;0.577042;1.320875
-random,128,1024,64,metal_shared,0.526625,0.168792,0.290916,0.031459,13,9,pass,0,0.526625;0.530375;0.533208;0.516334;0.532167;0.540000;0.520250;0.520958;0.524625
-random,1024,8192,1,metal_pull,0.706541,0.431458,0.672833,0.063792,16,9,pass,0,0.708958;0.706541;0.683500;0.696333;0.716708;0.703208;0.702042;0.706542;0.709250
-random,1024,8192,1,metal_group,0.898959,0.679542,0.828542,0.063792,13,9,pass,0,0.874041;0.952625;0.835417;0.958875;0.956334;0.957792;0.836917;0.834667;0.898959
-random,1024,8192,1,metal_shared,0.855917,0.640000,0.787083,0.063792,13,9,pass,0,0.795708;0.898333;0.792708;0.855917;0.934083;0.924583;0.848958;0.892709;0.798875
-random,1024,8192,64,metal_pull,4.632416,1.600792,2.329459,0.066041,24,9,pass,0,4.332500;4.367000;4.657500;4.592333;4.674958;4.290750;4.916542;4.632416;4.770708
-random,1024,8192,64,metal_group,3.383708,0.822625,1.053875,0.066041,17,9,pass,0,3.680667;3.598500;3.752959;3.733166;3.379375;3.383708;3.346375;3.052459;3.109458
-random,1024,8192,64,metal_shared,3.647125,0.827375,1.293500,0.066041,17,9,pass,0,2.843375;3.248042;3.677583;3.657959;3.652542;3.647125;3.590833;3.698167;3.128125
-fabric,288,16384,1,metal_pull,0.584500,0.408625,0.523791,0.100625,8,9,pass,0,0.611375;0.592875;0.576625;0.585417;0.584500;0.579167;0.918042;0.567042;0.565459
-fabric,288,16384,1,metal_group,0.773084,0.583125,0.709625,0.100625,3,9,pass,0,0.327667;0.503125;0.767875;0.773084;0.791375;0.774750;0.777583;0.780084;0.761833
-fabric,288,16384,1,metal_shared,0.737875,0.555167,0.679958,0.100625,3,9,pass,0,0.739417;0.739875;0.736542;0.761292;0.918042;0.733042;0.737875;0.731083;0.726666
-fabric,288,16384,64,metal_pull,5.875333,1.801583,2.368750,0.132416,8,9,pass,0,6.109209;5.987041;5.790292;5.954583;5.768875;5.917583;5.761416;5.875333;5.816042
-fabric,288,16384,64,metal_group,4.538083,0.652000,1.189125,0.132416,3,9,pass,0,4.560458;4.799042;4.693917;4.400916;4.460208;4.538083;4.538041;4.492500;4.595333
-fabric,288,16384,64,metal_shared,4.551917,0.631000,1.168166,0.132416,3,9,pass,0,4.407250;4.394208;4.624959;4.553750;4.580375;4.241083;4.558125;4.551917;4.439542
-grid,1024,3968,1,metal_pull,1.681000,0.651333,1.668041,0.069500,64,9,pass,0,3.145792;1.681000;1.832667;1.848833;1.864125;1.546333;1.373083;1.407792;1.178375
-grid,1024,3968,1,metal_group,0.388208,0.227000,0.373083,0.069500,63,9,pass,0,0.387292;0.388208;0.388583;0.388750;0.385500;0.440667;0.387792;0.388583;0.387209
-grid,1024,3968,1,metal_shared,0.374459,0.213375,0.359417,0.069500,63,9,pass,0,0.365709;0.375708;0.376375;0.374459;0.374375;0.369500;0.375667;0.372625;0.378083
-grid,1024,3968,64,metal_pull,2.805208,0.405750,1.965292,0.049083,64,9,pass,0,3.028000;3.075959;2.952958;2.663000;2.846458;2.737833;2.370708;2.250000;2.805208
-grid,1024,3968,64,metal_group,1.723750,0.206625,0.854125,0.049083,63,9,pass,0,1.723750;1.217917;1.237792;1.618083;1.954292;1.625958;1.766209;1.758125;1.827375
-grid,1024,3968,64,metal_shared,1.775500,0.195250,0.870750,0.049083,63,9,pass,0,1.726416;1.202875;1.847292;1.667541;1.777375;1.775500;1.795250;1.679000;1.792250
-chain,256,255,1,metal_pull,4.188292,0.508375,4.186625,0.062958,256,9,pass,1,4.498417;4.636458;4.241791;4.533875;4.188292;3.823209;3.755125;3.775666;3.508791
-chain,256,255,1,metal_group,0.225292,0.132750,0.224000,0.062958,256,9,pass,1,0.224542;0.229375;0.228458;0.227375;0.225292;0.223292;0.222709;0.224208;0.324750
-chain,256,255,1,metal_shared,0.229792,0.122250,0.228458,0.062958,256,9,pass,1,0.230500;0.227917;0.228000;0.218333;0.235750;0.229792;0.231167;0.230375;0.222041
-random_masked_int64_reverse,1024,8192,8,metal_pull,0.522875,0.032125,0.135209,0.090500,8,9,pass,1,0.511834;0.544083;0.563459;0.534917;0.562042;0.507209;0.522875;0.520583;0.507917
-random_masked_int64_reverse,1024,8192,8,metal_group,0.531875,0.053625,0.158542,0.090500,8,9,pass,1,0.527416;0.562709;0.514000;0.537875;0.531875;0.519292;0.523708;0.546541;0.538459
-random_masked_int64_reverse,1024,8192,8,metal_shared,0.526041,0.049917,0.159333,0.090500,8,9,pass,1,0.514334;0.539375;0.533833;0.518833;0.512709;0.557000;0.524750;0.526041;0.547541
-random,4096,32768,1,metal_pull,0.458167,0.106292,0.325875,0.184875,16,9,pass,0,0.458042;0.453625;0.463291;0.451416;0.457791;0.462958;0.458167;0.465000;0.529708
-random,4096,32768,1,metal_group,1.031083,0.737750,0.873125,0.184875,16,9,pass,0,1.038458;1.004667;0.969208;0.976291;1.031083;1.036333;1.075125;0.979417;1.085459
-random,4096,32768,64,metal_pull,13.708083,2.607750,3.892709,0.228209,24,9,pass,0,19.328916;12.469084;12.552083;18.668167;13.211458;18.690625;13.948333;13.708083;12.846250
-random,4096,32768,64,metal_group,12.983292,2.521375,3.123333,0.228209,19,9,pass,0,11.323000;11.705708;12.151083;12.648958;12.983292;13.544500;13.467916;14.265500;14.300583
-random,4096,32768,256,metal_pull,49.690584,9.834250,11.281292,0.220667,24,9,pass,0,49.880458;49.319875;49.208292;49.690584;50.530375;49.900583;49.381000;49.333916;50.406125
-random,4096,32768,256,metal_group,47.235458,8.198500,8.931625,0.220667,20,9,pass,0,48.244833;48.005541;46.817625;46.219417;46.147375;46.081250;47.235458;56.480959;51.777709
-random,16384,131072,1,metal_pull,1.529042,0.427750,0.892000,0.595375,24,9,pass,0,2.015375;1.495250;1.529042;1.527875;1.600917;1.563125;1.599542;1.528292;1.519417
-random,16384,131072,1,metal_group,5.643083,4.789500,4.978750,0.595375,18,9,pass,0,5.749875;5.666792;5.650041;5.599667;5.643083;5.604333;5.611708;5.601166;5.683917
-random,16384,131072,64,metal_pull,58.410458,11.548458,13.326750,0.663209,24,9,pass,0,67.121166;57.667833;58.470167;57.913459;58.156250;58.410458;59.990625;61.279500;58.239084
-random,16384,131072,64,metal_group,54.004166,8.331625,9.176375,0.663209,22,9,pass,0,54.397292;54.004166;53.502291;53.214125;52.934375;66.739042;54.280541;54.790833;53.420042
-random,65536,524288,1,metal_pull,4.921875,0.846833,1.920917,2.726125,24,9,pass,0,6.001291;5.252834;4.935458;4.593417;4.787125;4.773958;4.849458;4.921875;5.000417
-random,65536,524288,1,metal_group,31.772208,28.237500,28.881750,2.726125,22,9,pass,0,31.775041;31.772208;31.570917;31.932708;31.588333;31.742625;32.067125;31.611333;32.124917
-random,65536,524288,64,metal_pull,278.466208,78.681083,80.713958,2.758750,32,9,pass,0,281.715833;280.435583;278.466208;281.948125;277.973000;277.116458;281.096833;266.919750;276.584625
-random,65536,524288,64,metal_group,277.240041,77.399292,78.233042,2.758750,25,9,pass,0,278.460875;277.240041;273.348500;274.964750;277.577750;281.394417;273.737042;273.665000;280.961666
-chain,2048,2047,1,metal_pull,28.527166,4.077999,28.517125,0.065792,2048,9,pass,1,29.465125;29.033125;28.804292;28.516417;28.424041;28.197667;28.328708;28.647750;28.527166
-chain,2048,2047,1,metal_group,4.803792,4.693375,4.793333,0.065792,2048,9,pass,1,4.799833;4.803792;4.848750;4.903459;4.850958;4.797625;4.800458;4.854666;4.799416
-random,4096,131072,1,metal_pull,0.842792,0.254458,0.451708,0.581791,16,9,pass,0,0.838875;0.832625;0.823042;0.842792;0.843417;0.834083;0.854458;0.886917;0.861834
-random,4096,131072,1,metal_group,2.677375,2.169000,2.272500,0.581791,12,9,pass,0,2.698875;2.772292;2.643875;2.677375;2.720708;2.809459;2.660750;2.642417;2.643792
-random,4096,131072,64,metal_pull,35.841000,6.486458,8.086625,0.641875,16,9,pass,0,35.841000;35.529625;35.501708;35.851209;34.786084;35.420083;37.314042;38.495375;38.841625
-random,4096,131072,64,metal_group,35.625625,7.266500,7.957042,0.641875,15,9,pass,0,32.706541;33.508083;33.932792;37.469041;35.970166;35.835375;35.625625;35.057250;35.728792
-clos,200,20000,1,metal_pull,0.928583,0.457833,0.859500,0.122584,8,9,pass,0,1.622417;1.091250;0.843625;1.078542;1.037583;0.765958;0.783041;0.928583;0.390333
-clos,200,20000,1,metal_group,0.260833,0.063333,0.197625,0.122584,3,9,pass,0,0.234208;0.237334;0.251208;0.250708;0.282042;0.268625;0.260833;0.291875;0.268208
-clos,200,20000,1,metal_shared,0.253875,0.059500,0.190000,0.122584,3,9,pass,0,0.254834;0.253083;0.253125;0.252833;0.255250;0.253875;0.257084;0.253667;0.256458
-clos,200,20000,64,metal_pull,5.757625,1.018167,1.556333,0.129209,8,9,pass,0,5.767959;5.609834;5.724250;5.673250;5.757625;5.656250;5.840625;5.759333;5.932584
-clos,200,20000,64,metal_group,5.121500,0.300292,0.831667,0.129209,3,9,pass,0,5.121500;5.192666;5.247041;5.146750;5.005208;4.946208;5.251791;5.036250;4.973417
-clos,200,20000,64,metal_shared,5.014750,0.294792,0.884542,0.129209,3,9,pass,0,5.155125;5.007708;5.014750;5.007417;5.045417;5.119459;5.008125;5.027000;4.946958
-clos,800,320000,1,metal_pull,2.688750,1.320875,1.690291,1.198250,8,9,pass,0,5.262625;4.836667;2.426042;1.908625;2.955417;4.635917;2.688750;1.943125;2.464041
-clos,800,320000,1,metal_group,3.609042,2.091917,2.558959,1.198250,3,9,pass,0,2.589541;5.534292;5.195666;3.609042;2.121750;2.612750;2.684584;5.583500;4.444583
-clos,800,320000,1,metal_shared,2.589500,0.886333,1.607250,1.198250,3,9,pass,0,2.055708;2.589500;5.415708;5.412917;2.020792;2.759542;2.584042;2.544167;3.905959
-clos,800,320000,64,metal_pull,84.243334,17.155875,17.769125,1.222459,8,9,pass,0,85.693292;82.820583;84.810666;85.224834;85.088417;84.171083;83.663167;82.692000;84.243334
-clos,800,320000,64,metal_group,72.947292,5.246625,5.806292,1.222459,3,9,pass,0,73.739000;72.666209;72.213333;73.495000;73.113167;72.947292;72.646917;72.817208;73.371959
-clos,800,320000,64,metal_shared,72.451792,5.047375,5.681500,1.222459,3,9,pass,0,72.509583;73.012750;72.451792;71.838583;72.226000;71.746875;72.920042;71.717500;73.992291
-grid,10000,39600,1,metal_pull,5.348750,2.243750,5.217083,0.188000,200,9,pass,0,5.705000;5.633250;5.483041;5.417042;5.337041;5.326500;5.348750;5.246000;5.313625
-grid,10000,39600,1,metal_group,7.826000,7.551000,7.692791,0.188000,199,9,pass,0,7.837625;7.825416;7.803542;7.800167;7.832833;7.832208;7.836458;7.812709;7.826000
-grid,10000,39600,8,metal_pull,6.016250,1.352667,4.932792,0.180625,200,9,pass,0,6.059625;5.488791;5.902791;6.103208;5.938250;6.325250;6.016250;5.983042;6.140208
-grid,10000,39600,8,metal_group,9.135500,7.427292,8.073792,0.180625,199,9,pass,0,8.722000;8.678750;9.158917;9.133459;9.125792;9.135500;9.266750;9.217875;9.343875
-grid,40000,159200,1,metal_pull,8.408041,1.743417,7.867500,0.554416,400,9,pass,0,9.057583;9.127500;8.940416;8.546416;8.408041;7.482041;7.682875;7.581166;7.693792
-grid,40000,159200,1,metal_group,65.239125,64.260458,64.756208,0.554416,399,9,pass,0,64.734541;65.239125;65.375083;64.894917;65.609625;66.268041;65.783375;64.778250;64.975083
diff --git a/dev/research/metal_pathfinding/results/aba/environment.txt b/dev/research/metal_pathfinding/results/aba/environment.txt
deleted file mode 100644
index b039362..0000000
--- a/dev/research/metal_pathfinding/results/aba/environment.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-2026-09-26T23:07:34Z
-fbab119e794c843838f4f3f96d75cb7f32f06845
-ProductName:		macOS
-ProductVersion:		26.6.1
-BuildVersion:		25G76
-Apple M4 Max
-38654705664
-14
-Apple clang version 21.0.0 (clang-2100.1.1.101)
-Target: arm64-apple-darwin25.6.0
-Thread model: posix
-InstalledDir: /Library/Developer/CommandLineTools/usr/bin
-1da9ff77bd2ad97e95e951454821b25005859c6f75c27a3c56d925e5fc99f6fc  dev/research/metal_pathfinding/experiment.mm
-2e36b1623a3940bf1f19f5d81141bb1def14f5873fe2a98aab0101bbe68618a3  dev/research/metal_pathfinding/sssp.metal
-Note: No thermal warning level has been recorded
-Note: No performance warning level has been recorded
-Note: No CPU power status has been recorded
diff --git a/dev/research/metal_pathfinding/results/aba/gpu-load-a1.txt b/dev/research/metal_pathfinding/results/aba/gpu-load-a1.txt
deleted file mode 100644
index 7b19971..0000000
--- a/dev/research/metal_pathfinding/results/aba/gpu-load-a1.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11028365312,"Tiler Utilization %"=5,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=8,"TiledSceneBytes"=2326528,"Device Utilization %"=8,"SplitSceneCount"=0,"Allocated PB Size"=190316544,"In use system memory"=1562312704}
diff --git a/dev/research/metal_pathfinding/results/aba/gpu-load-a2.txt b/dev/research/metal_pathfinding/results/aba/gpu-load-a2.txt
deleted file mode 100644
index 63385cb..0000000
--- a/dev/research/metal_pathfinding/results/aba/gpu-load-a2.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11064967168,"Tiler Utilization %"=1,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=3,"TiledSceneBytes"=1736704,"Device Utilization %"=75,"SplitSceneCount"=0,"Allocated PB Size"=192806912,"In use system memory"=1753808896}
diff --git a/dev/research/metal_pathfinding/results/aba/gpu-load-b.txt b/dev/research/metal_pathfinding/results/aba/gpu-load-b.txt
deleted file mode 100644
index 7edec31..0000000
--- a/dev/research/metal_pathfinding/results/aba/gpu-load-b.txt
+++ /dev/null
@@ -1 +0,0 @@
-  |   "PerformanceStatistics" = {"In use system memory (driver)"=0,"Alloc system memory"=11040063488,"Tiler Utilization %"=3,"recoveryCount"=0,"lastRecoveryTime"=0,"Renderer Utilization %"=5,"TiledSceneBytes"=2326528,"Device Utilization %"=5,"SplitSceneCount"=0,"Allocated PB Size"=191889408,"In use system memory"=1626095616}
diff --git a/dev/research/metal_pathfinding/results/aba/load-a1.txt b/dev/research/metal_pathfinding/results/aba/load-a1.txt
deleted file mode 100644
index dad8c67..0000000
--- a/dev/research/metal_pathfinding/results/aba/load-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1026 total, 3 running, 1023 sleeping, 5227 threads 
-2026/09/27 00:07:35
-Load Avg: 2.50, 3.63, 4.23 
-CPU usage: 3.63% user, 8.76% sys, 87.60% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 625179 total, 9927M resident, 739M private, 4203M shared.
-PhysMem: 33G used (4233M wired, 633M compressor), 1868M unused.
-VM: 452T vsize, 6144M framework vsize, 2843905(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190194634/161G in, 145611011/163G out.
-Disks: 97549297/2475G read, 117292342/2098G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1026 total, 2 running, 1024 sleeping, 5225 threads 
-2026/09/27 00:07:36
-Load Avg: 2.54, 3.62, 4.22 
-CPU usage: 5.65% user, 4.27% sys, 90.7% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 0 total, 0B resident, 739M private, 4203M shared.
-PhysMem: 33G used (4198M wired, 633M compressor), 1875M unused.
-VM: 452T vsize, 6144M framework vsize, 2843905(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190194809/161G in, 145611193/163G out.
-Disks: 97549297/2475G read, 117292347/2098G written.
-
-PID    COMMAND          %CPU #TH   
-70968  Superset Helper  22.2 32    
-590    WindowServer     16.0 30    
-0      kernel_task      10.7 850/14
-80307  top              8.9  1/1   
-65401  codex            6.0  38    
-70942  Superset Helper  5.4  18    
-21666  2.1.283          4.7  28    
-70934  Superset         4.3  51    
diff --git a/dev/research/metal_pathfinding/results/aba/load-a2.txt b/dev/research/metal_pathfinding/results/aba/load-a2.txt
deleted file mode 100644
index 153a0a0..0000000
--- a/dev/research/metal_pathfinding/results/aba/load-a2.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1028 total, 2 running, 1026 sleeping, 5254 threads 
-2026/09/27 00:09:05
-Load Avg: 2.84, 3.47, 4.10 
-CPU usage: 11.34% user, 14.82% sys, 73.82% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 638481 total, 10G resident, 741M private, 4225M shared.
-PhysMem: 34G used (4167M wired, 632M compressor), 1555M unused.
-VM: 454T vsize, 6144M framework vsize, 2843921(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190245179/161G in, 145633207/163G out.
-Disks: 97561084/2475G read, 117298099/2098G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1029 total, 9 running, 1020 sleeping, 5311 threads 
-2026/09/27 00:09:06
-Load Avg: 2.84, 3.47, 4.10 
-CPU usage: 15.54% user, 11.8% sys, 73.37% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 33 total, 80K resident, 741M private, 4226M shared.
-PhysMem: 34G used (4371M wired, 632M compressor), 1526M unused.
-VM: 455T vsize, 6144M framework vsize, 2843921(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190245522/161G in, 145633548/163G out.
-Disks: 97561090/2475G read, 117298104/2098G written.
-
-PID    COMMAND          %CPU #TH   
-70968  Superset Helper  33.8 32    
-590    WindowServer     31.2 29/1  
-0      kernel_task      15.1 850/14
-70969  Superset         14.9 23    
-70942  Superset Helper  9.4  18    
-70934  Superset         7.9  51    
-89777  top              6.0  1/1   
-554    opendirectoryd   4.5  9/1   
diff --git a/dev/research/metal_pathfinding/results/aba/load-b.txt b/dev/research/metal_pathfinding/results/aba/load-b.txt
deleted file mode 100644
index c761959..0000000
--- a/dev/research/metal_pathfinding/results/aba/load-b.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1028 total, 2 running, 1026 sleeping, 5258 threads 
-2026/09/27 00:08:33
-Load Avg: 2.69, 3.51, 4.14 
-CPU usage: 4.4% user, 9.48% sys, 86.46% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 638285 total, 10G resident, 741M private, 4228M shared.
-PhysMem: 34G used (4218M wired, 632M compressor), 1622M unused.
-VM: 454T vsize, 6144M framework vsize, 2843921(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190237774/161G in, 145624667/163G out.
-Disks: 97549658/2475G read, 117296556/2098G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1027 total, 2 running, 1025 sleeping, 5243 threads 
-2026/09/27 00:08:34
-Load Avg: 2.69, 3.51, 4.14 
-CPU usage: 5.44% user, 3.79% sys, 90.75% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 0 total, 0B resident, 741M private, 4228M shared.
-PhysMem: 33G used (4259M wired, 632M compressor), 1761M unused.
-VM: 452T vsize, 6144M framework vsize, 2843921(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190237907/161G in, 145624794/163G out.
-Disks: 97549658/2475G read, 117296557/2098G written.
-
-PID    COMMAND          %CPU #TH   
-70968  Superset Helper  18.0 32    
-590    WindowServer     17.7 29    
-0      kernel_task      11.5 850/14
-81804  2.1.283          8.8  27    
-84786  top              8.5  1/1   
-70942  Superset Helper  7.0  19    
-39757  codex            4.0  36    
-21666  2.1.283          3.5  28    
diff --git a/dev/research/metal_pathfinding/results/aba/summary.md b/dev/research/metal_pathfinding/results/aba/summary.md
deleted file mode 100644
index 3f5a20f..0000000
--- a/dev/research/metal_pathfinding/results/aba/summary.md
+++ /dev/null
@@ -1,74 +0,0 @@
-Exploratory observations, not a production performance acceptance result.
-Inspect load-*.txt and gpu-load-*.txt; speedup claims require a quiet machine.
-The prototype matches supported DAG edge sets, not CPU predecessor order.
-
-All times are medians in milliseconds per batch, with nine timed samples.
-CPU A columns use serial SPF for Q=1 and the 10-worker pool otherwise.
-GPU includes host distance copies and serial CPU ECMP DAG reconstruction.
-Upload and pipeline setup are excluded and recorded separately in raw data.
-The table picks the fastest measured GPU method for each case.
-
-| Case | V / E | Q | CPU A1 | GPU B | CPU A2 | GPU method | Distance-only B | CPU drift |
-|---|---:|---:|---:|---:|---:|---|---:|---:|
-| random | 128 / 1,024 | 1 | 0.031 | 0.242 | 0.010 | metal_shared | 0.239 | -67.4% |
-| random | 128 / 1,024 | 64 | 0.234 | 0.527 | 0.162 | metal_shared | 0.291 | -30.7% |
-| random | 1,024 / 8,192 | 1 | 0.145 | 0.707 | 0.115 | metal_pull | 0.673 | -21.0% |
-| random | 1,024 / 8,192 | 64 | 1.273 | 3.384 | 1.330 | metal_group | 1.054 | +4.5% |
-| fabric | 288 / 16,384 | 1 | 0.107 | 0.585 | 0.110 | metal_pull | 0.524 | +3.0% |
-| fabric | 288 / 16,384 | 64 | 1.011 | 4.538 | 0.992 | metal_group | 1.189 | -1.9% |
-| grid | 1,024 / 3,968 | 1 | 0.037 | 0.374 | 0.045 | metal_shared | 0.359 | +22.8% |
-| grid | 1,024 / 3,968 | 64 | 0.498 | 1.724 | 0.556 | metal_group | 0.854 | +11.6% |
-| chain | 256 / 255 | 1 | 0.002 | 0.225 | 0.003 | metal_group | 0.224 | +13.0% |
-| random_masked_int64_reverse | 1,024 / 8,192 | 8 | 0.150 | 0.523 | 0.149 | metal_pull | 0.135 | -0.2% |
-| random | 4,096 / 32,768 | 1 | 0.641 | 0.458 | 0.665 | metal_pull | 0.326 | +3.8% |
-| random | 4,096 / 32,768 | 64 | 5.984 | 12.983 | 5.952 | metal_group | 3.123 | -0.5% |
-| random | 4,096 / 32,768 | 256 | 23.461 | 47.235 | 23.387 | metal_group | 8.932 | -0.3% |
-| random | 16,384 / 131,072 | 1 | 4.095 | 1.529 | 3.915 | metal_pull | 0.892 | -4.4% |
-| random | 16,384 / 131,072 | 64 | 28.290 | 54.004 | 28.429 | metal_group | 9.176 | +0.5% |
-| random | 65,536 / 524,288 | 1 | 20.762 | 4.922 | 22.345 | metal_pull | 1.921 | +7.6% |
-| random | 65,536 / 524,288 | 64 | 174.082 | 277.240 | 189.990 | metal_group | 78.233 | +9.1% |
-| chain | 2,048 / 2,047 | 1 | 0.020 | 4.804 | 0.020 | metal_group | 4.793 | -1.1% |
-| random | 4,096 / 131,072 | 1 | 1.762 | 0.843 | 1.763 | metal_pull | 0.452 | +0.0% |
-| random | 4,096 / 131,072 | 64 | 12.774 | 35.626 | 12.923 | metal_group | 7.957 | +1.2% |
-| clos | 200 / 20,000 | 1 | 0.146 | 0.254 | 0.144 | metal_shared | 0.190 | -1.4% |
-| clos | 200 / 20,000 | 64 | 1.181 | 5.015 | 1.699 | metal_shared | 0.885 | +43.9% |
-| clos | 800 / 320,000 | 1 | 2.330 | 2.590 | 2.368 | metal_shared | 1.607 | +1.6% |
-| clos | 800 / 320,000 | 64 | 17.462 | 72.452 | 17.634 | metal_shared | 5.681 | +1.0% |
-| grid | 10,000 / 39,600 | 1 | 0.614 | 5.349 | 0.616 | metal_pull | 5.217 | +0.4% |
-| grid | 10,000 / 39,600 | 8 | 0.829 | 6.016 | 0.818 | metal_pull | 4.933 | -1.3% |
-| grid | 40,000 / 159,200 | 1 | 2.913 | 8.408 | 2.937 | metal_pull | 7.867 | +0.9% |
-
-Distance-only timings stop before DAG reconstruction; they are not SPF API timings.
-CPU distance-only and serial full-batch controls are also available in a1/a2.csv.
-
-Distances-only comparison (both sides omit DAG construction):
-
-| Case | V / E | Q | CPU A1 | GPU B | CPU A2 | GPU method |
-|---|---:|---:|---:|---:|---:|---|
-| random | 128 / 1,024 | 1 | 0.011 | 0.239 | 0.005 | metal_shared |
-| random | 128 / 1,024 | 64 | 0.126 | 0.291 | 0.102 | metal_shared |
-| random | 1,024 / 8,192 | 1 | 0.080 | 0.673 | 0.056 | metal_pull |
-| random | 1,024 / 8,192 | 64 | 0.634 | 1.054 | 0.657 | metal_group |
-| fabric | 288 / 16,384 | 1 | 0.022 | 0.524 | 0.022 | metal_pull |
-| fabric | 288 / 16,384 | 64 | 0.194 | 1.168 | 0.219 | metal_shared |
-| grid | 1,024 / 3,968 | 1 | 0.010 | 0.359 | 0.012 | metal_shared |
-| grid | 1,024 / 3,968 | 64 | 0.146 | 0.854 | 0.157 | metal_group |
-| chain | 256 / 255 | 1 | 0.001 | 0.224 | 0.001 | metal_group |
-| random_masked_int64_reverse | 1,024 / 8,192 | 8 | 0.093 | 0.135 | 0.095 | metal_pull |
-| random | 4,096 / 32,768 | 1 | 0.305 | 0.326 | 0.322 | metal_pull |
-| random | 4,096 / 32,768 | 64 | 2.968 | 3.123 | 2.946 | metal_group |
-| random | 4,096 / 32,768 | 256 | 12.019 | 8.932 | 11.368 | metal_group |
-| random | 16,384 / 131,072 | 1 | 2.076 | 0.892 | 1.960 | metal_pull |
-| random | 16,384 / 131,072 | 64 | 14.898 | 9.176 | 15.059 | metal_group |
-| random | 65,536 / 524,288 | 1 | 10.450 | 1.921 | 11.777 | metal_pull |
-| random | 65,536 / 524,288 | 64 | 85.846 | 78.233 | 93.938 | metal_group |
-| chain | 2,048 / 2,047 | 1 | 0.004 | 4.793 | 0.004 | metal_group |
-| random | 4,096 / 131,072 | 1 | 0.665 | 0.452 | 0.681 | metal_pull |
-| random | 4,096 / 131,072 | 64 | 5.610 | 7.957 | 5.638 | metal_group |
-| clos | 200 / 20,000 | 1 | 0.024 | 0.190 | 0.024 | metal_shared |
-| clos | 200 / 20,000 | 64 | 0.211 | 0.832 | 0.208 | metal_group |
-| clos | 800 / 320,000 | 1 | 0.356 | 1.607 | 0.355 | metal_shared |
-| clos | 800 / 320,000 | 64 | 2.672 | 5.681 | 2.661 | metal_shared |
-| grid | 10,000 / 39,600 | 1 | 0.175 | 5.217 | 0.183 | metal_pull |
-| grid | 10,000 / 39,600 | 8 | 0.247 | 4.933 | 0.246 | metal_pull |
-| grid | 40,000 / 159,200 | 1 | 0.863 | 7.867 | 0.878 | metal_pull |
diff --git a/dev/research/metal_pathfinding/results/audit.json b/dev/research/metal_pathfinding/results/audit.json
deleted file mode 100644
index a218315..0000000
--- a/dev/research/metal_pathfinding/results/audit.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "a1": {
-    "rows": 108,
-    "queries_checked_including_warmups": 40744
-  },
-  "b": {
-    "rows": 68,
-    "queries_checked_including_warmups": 24761
-  },
-  "a2": {
-    "rows": 108,
-    "queries_checked_including_warmups": 40744
-  },
-  "correctness.csv": {
-    "rows": 36,
-    "queries_checked_including_warmups": 1152
-  },
-  "correctness-sanitized.csv": {
-    "rows": 36,
-    "queries_checked_including_warmups": 1152
-  },
-  "stress.csv": {
-    "rows": 6,
-    "queries_checked_including_warmups": 39168
-  },
-  "stress-sanitized.csv": {
-    "rows": 6,
-    "queries_checked_including_warmups": 8448
-  },
-  "cpu-sanitized.csv": {
-    "rows": 40,
-    "queries_checked_including_warmups": 3228
-  },
-  "experiment.mm_sha256": "1da9ff77bd2ad97e95e951454821b25005859c6f75c27a3c56d925e5fc99f6fc",
-  "sssp.metal_sha256": "2e36b1623a3940bf1f19f5d81141bb1def14f5873fe2a98aab0101bbe68618a3",
-  "core_commit": "fbab119e794c843838f4f3f96d75cb7f32f06845",
-  "quiet_machine_gate_passed": false,
-  "performance_claim_approved": false,
-  "ci_run": false,
-  "production_backend_added": false,
-  "core_cpp_tests": 170,
-  "core_python_tests": 465,
-  "core_sanitizer_tests": 170
-}
diff --git a/dev/research/metal_pathfinding/results/capabilities.txt b/dev/research/metal_pathfinding/results/capabilities.txt
deleted file mode 100644
index 95b9ad1..0000000
--- a/dev/research/metal_pathfinding/results/capabilities.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-device=Apple M4 Max unified=1 max_buffer=22613000192
-probe=0 compiled=1
-probe=1 compiled=0
-program_source:3:25: error: 'double' is not supported in Metal
-kernel void test(device double* x [[buffer(0)]], uint i [[thread_position_in_grid]]) { x[i] += 1.0; }
-                        ^
-
-probe=2 compiled=0
-program_source:3:58: error: no matching function for call to 'atomic_fetch_min_explicit'
-kernel void test(device atomic_ulong* x [[buffer(0)]]) { atomic_fetch_min_explicit(x, 1ul, memory_order_relaxed); }
-                                                         ^~~~~~~~~~~~~~~~~~~~~~~~~
-/System/Library/PrivateFrameworks/GPUCompiler.framework/Versions/32023/Libraries/lib/clang/32023.886/include/metal/metal_atomic:552:14: note: candidate template ignored: requirement '_valid_fetch_min_type<threadgroup unsigned long *, void>::value' was not satisfied [with T = unsigned long, U = unsigned long]
-METAL_FUNC T atomic_fetch_min_explicit(
-             ^
-/System/Library/PrivateFrameworks/GPUCompiler.framework/Versions/32023/Libraries/lib/clang/32023.886/include/metal/metal_atomic:560:14: note: candidate template ignored: requirement '_valid_fetch_min_type<device unsigned long *, void>::value' was not satisfied [with T = unsigned long, U = unsigned long]
-METAL_FUNC T atomic_fetch_min_explicit(
-             ^
-
-probe=3 compiled=1
-probe=4 compiled=1
-probe=5 compiled=0
-program_source:3:96: error: no matching function for call to 'atomic_load_explicit'
-kernel void test(device atomic_ulong* x [[buffer(0)]], device ulong* y [[buffer(1)]]) { y[0] = atomic_load_explicit(x, memory_order_relaxed); }
-                                                                                               ^~~~~~~~~~~~~~~~~~~~
-/System/Library/PrivateFrameworks/GPUCompiler.framework/Versions/32023/Libraries/lib/clang/32023.886/include/metal/metal_atomic:240:14: note: candidate template ignored: requirement '_valid_load_type<threadgroup unsigned long *, void>::value' was not satisfied [with T = unsigned long]
-METAL_FUNC T atomic_load_explicit(
-             ^
-/System/Library/PrivateFrameworks/GPUCompiler.framework/Versions/32023/Libraries/lib/clang/32023.886/include/metal/metal_atomic:247:14: note: candidate template ignored: requirement '_valid_load_type<device unsigned long *, void>::value' was not satisfied [with T = unsigned long]
-METAL_FUNC T atomic_load_explicit(
-             ^
-
diff --git a/dev/research/metal_pathfinding/results/correctness-sanitized.csv b/dev/research/metal_pathfinding/results/correctness-sanitized.csv
deleted file mode 100644
index a77e150..0000000
--- a/dev/research/metal_pathfinding/results/correctness-sanitized.csv
+++ /dev/null
@@ -1,37 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random_masked_int64,40,240,8,metal_pull,1.263750,0.395000,1.205458,0.053958,8,2,pass,7,1.263750;0.901542
-random_masked_int64,40,240,8,metal_group,0.652583,0.283916,0.607084,0.053958,6,2,pass,7,0.617708;0.652583
-random_masked_int64,40,240,8,metal_shared,0.951500,0.198250,0.906541,0.053958,6,2,pass,7,0.860042;0.951500
-random_masked,43,258,8,metal_pull,1.944458,0.886917,1.892250,0.033375,16,2,pass,0,1.755792;1.944458
-random_masked,43,258,8,metal_group,0.756125,0.419417,0.707625,0.033375,9,2,pass,0,0.756125;0.754584
-random_masked,43,258,8,metal_shared,0.661750,0.313667,0.615750,0.033375,9,2,pass,0,0.661750;0.640542
-random_masked_int64_reverse,46,276,8,metal_pull,0.567792,0.068875,0.519583,0.023333,8,2,pass,1,0.567792;0.486209
-random_masked_int64_reverse,46,276,8,metal_group,0.468083,0.033042,0.422375,0.023333,5,2,pass,1,0.393167;0.468083
-random_masked_int64_reverse,46,276,8,metal_shared,0.370541,0.027708,0.323542,0.023333,5,2,pass,1,0.363958;0.370541
-random_masked,49,294,8,metal_pull,0.528250,0.096292,0.480834,0.022084,8,2,pass,2,0.528250;0.518416
-random_masked,49,294,8,metal_group,0.450542,0.078042,0.397875,0.022084,8,2,pass,2,0.430209;0.450542
-random_masked,49,294,8,metal_shared,0.382750,0.060834,0.333750,0.022084,8,2,pass,2,0.382750;0.373667
-random_masked_int64,52,312,8,metal_pull,0.583250,0.108417,0.531208,0.024708,8,2,pass,7,0.583250;0.549291
-random_masked_int64,52,312,8,metal_group,0.568667,0.062125,0.516500,0.024708,6,2,pass,7,0.568667;0.434666
-random_masked_int64,52,312,8,metal_shared,0.390209,0.050000,0.336334,0.024708,6,2,pass,7,0.390209;0.381666
-random_masked_reverse,55,330,8,metal_pull,0.955500,0.137167,0.904750,0.024250,16,2,pass,0,0.932875;0.955500
-random_masked_reverse,55,330,8,metal_group,0.400375,0.056750,0.342417,0.024250,10,2,pass,0,0.388125;0.400375
-random_masked_reverse,55,330,8,metal_shared,0.516750,0.046250,0.459417,0.024250,10,2,pass,0,0.498875;0.516750
-random_masked_int64,58,348,8,metal_pull,0.521208,0.088875,0.463542,0.028666,8,2,pass,7,0.521208;0.514292
-random_masked_int64,58,348,8,metal_group,0.375292,0.045500,0.314708,0.028666,5,2,pass,7,0.375292;0.371792
-random_masked_int64,58,348,8,metal_shared,0.372625,0.039250,0.314083,0.028666,5,2,pass,7,0.369333;0.372625
-random_masked,61,366,8,metal_pull,1.079708,0.210875,1.013334,0.021459,16,2,pass,1,1.034542;1.079708
-random_masked,61,366,8,metal_group,0.427291,0.089750,0.367750,0.021459,9,2,pass,1,0.427291;0.422917
-random_masked,61,366,8,metal_shared,0.399166,0.071916,0.342667,0.021459,9,2,pass,1,0.399166;0.389709
-random_masked_int64_reverse,64,384,8,metal_pull,0.487667,0.070375,0.426917,0.023333,8,2,pass,1,0.483333;0.487667
-random_masked_int64_reverse,64,384,8,metal_group,0.373917,0.033750,0.314708,0.023333,5,2,pass,1,0.364750;0.373917
-random_masked_int64_reverse,64,384,8,metal_shared,0.374791,0.027750,0.315333,0.023333,5,2,pass,1,0.374791;0.344833
-random_masked,67,402,8,metal_pull,0.648583,0.089542,0.517833,0.027542,8,2,pass,0,0.523500;0.648583
-random_masked,67,402,8,metal_group,0.459166,0.066708,0.391292,0.027542,8,2,pass,0,0.459166;0.427208
-random_masked,67,402,8,metal_shared,0.461292,0.123750,0.397750,0.027542,8,2,pass,0,0.441083;0.461292
-random_masked_int64,70,420,8,metal_pull,0.568167,0.100208,0.484084,0.023667,8,2,pass,3,0.568167;0.519291
-random_masked_int64,70,420,8,metal_group,0.412083,0.060250,0.350416,0.023667,6,2,pass,3,0.400500;0.412083
-random_masked_int64,70,420,8,metal_shared,0.675834,0.206875,0.605291,0.023667,6,2,pass,3,0.675834;0.557083
-random_masked_reverse,73,438,8,metal_pull,1.424125,0.585833,1.358291,0.028083,16,2,pass,0,1.424125;1.365500
-random_masked_reverse,73,438,8,metal_group,0.718042,0.249750,0.652875,0.028083,10,2,pass,0,0.623667;0.718042
-random_masked_reverse,73,438,8,metal_shared,0.596708,0.202250,0.526333,0.028083,10,2,pass,0,0.596708;0.561417
diff --git a/dev/research/metal_pathfinding/results/correctness-stderr.txt b/dev/research/metal_pathfinding/results/correctness-stderr.txt
deleted file mode 100644
index 0c58358..0000000
--- a/dev/research/metal_pathfinding/results/correctness-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=23.9988 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/correctness.csv b/dev/research/metal_pathfinding/results/correctness.csv
deleted file mode 100644
index ab8100c..0000000
--- a/dev/research/metal_pathfinding/results/correctness.csv
+++ /dev/null
@@ -1,37 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random_masked_int64,40,240,8,metal_pull,0.295708,0.129833,0.277459,0.016125,8,2,pass,7,0.295708;0.284042
-random_masked_int64,40,240,8,metal_group,0.210458,0.068708,0.203291,0.016125,6,2,pass,7,0.191750;0.210458
-random_masked_int64,40,240,8,metal_shared,0.587333,0.074583,0.580834,0.016125,6,2,pass,7,0.495125;0.587333
-random_masked,43,258,8,metal_pull,0.841500,0.289833,0.833625,0.023083,16,2,pass,0,0.841500;0.760584
-random_masked,43,258,8,metal_group,0.232041,0.105375,0.223667,0.023083,9,2,pass,0,0.232041;0.230958
-random_masked,43,258,8,metal_shared,0.225208,0.099375,0.218333,0.023083,9,2,pass,0,0.223292;0.225208
-random_masked_int64_reverse,46,276,8,metal_pull,0.547208,0.104125,0.527583,0.027750,8,2,pass,1,0.232750;0.547208
-random_masked_int64_reverse,46,276,8,metal_group,0.175709,0.044708,0.168125,0.027750,5,2,pass,1,0.172292;0.175709
-random_masked_int64_reverse,46,276,8,metal_shared,0.180708,0.042125,0.173916,0.027750,5,2,pass,1,0.180708;0.180334
-random_masked,49,294,8,metal_pull,0.273208,0.125083,0.253625,0.018125,8,2,pass,2,0.261041;0.273208
-random_masked,49,294,8,metal_group,0.236250,0.093750,0.227083,0.018125,8,2,pass,2,0.226666;0.236250
-random_masked,49,294,8,metal_shared,0.222125,0.088000,0.213500,0.018125,8,2,pass,2,0.222125;0.222125
-random_masked_int64,52,312,8,metal_pull,0.289833,0.150542,0.280541,0.017708,8,2,pass,7,0.276834;0.289833
-random_masked_int64,52,312,8,metal_group,0.212750,0.077125,0.194041,0.017708,6,2,pass,7,0.212750;0.205125
-random_masked_int64,52,312,8,metal_shared,0.204459,0.072667,0.196167,0.017708,6,2,pass,7,0.203125;0.204459
-random_masked_reverse,55,330,8,metal_pull,0.457667,0.212375,0.447292,0.017084,16,2,pass,0,0.457667;0.437583
-random_masked_reverse,55,330,8,metal_group,0.200458,0.074208,0.192000,0.017084,10,2,pass,0,0.200458;0.193541
-random_masked_reverse,55,330,8,metal_shared,0.184667,0.069417,0.176000,0.017084,10,2,pass,0,0.184667;0.183125
-random_masked_int64,58,348,8,metal_pull,0.266375,0.117667,0.256625,0.013333,8,2,pass,7,0.250167;0.266375
-random_masked_int64,58,348,8,metal_group,0.180209,0.057667,0.170667,0.013333,5,2,pass,7,0.180209;0.177625
-random_masked_int64,58,348,8,metal_shared,0.248583,0.142375,0.239083,0.013333,5,2,pass,7,0.248583;0.183667
-random_masked,61,366,8,metal_pull,0.525791,0.273333,0.515166,0.015292,16,2,pass,1,0.525791;0.515458
-random_masked,61,366,8,metal_group,0.236833,0.110000,0.226958,0.015292,9,2,pass,1,0.233750;0.236833
-random_masked,61,366,8,metal_shared,0.227042,0.103208,0.217375,0.015292,9,2,pass,1,0.227042;0.225792
-random_masked_int64_reverse,64,384,8,metal_pull,0.374125,0.102208,0.359166,0.012708,8,2,pass,1,0.374125;0.239125
-random_masked_int64_reverse,64,384,8,metal_group,0.222541,0.045000,0.167750,0.012708,5,2,pass,1,0.222541;0.190041
-random_masked_int64_reverse,64,384,8,metal_shared,0.187667,0.042625,0.173541,0.012708,5,2,pass,1,0.183959;0.187667
-random_masked,67,402,8,metal_pull,0.260875,0.118875,0.248459,0.019167,8,2,pass,0,0.248834;0.260875
-random_masked,67,402,8,metal_group,0.250791,0.084792,0.227666,0.019167,8,2,pass,0,0.223333;0.250791
-random_masked,67,402,8,metal_shared,0.267833,0.079750,0.256333,0.019167,8,2,pass,0,0.267833;0.215541
-random_masked_int64,70,420,8,metal_pull,0.397708,0.232000,0.379083,0.020375,8,2,pass,3,0.390583;0.397708
-random_masked_int64,70,420,8,metal_group,0.253125,0.075250,0.220625,0.020375,6,2,pass,3,0.242750;0.253125
-random_masked_int64,70,420,8,metal_shared,0.242166,0.071083,0.213625,0.020375,6,2,pass,3,0.221834;0.242166
-random_masked_reverse,73,438,8,metal_pull,1.053542,0.734042,1.034042,0.031625,16,2,pass,0,1.053542;0.504542
-random_masked_reverse,73,438,8,metal_group,0.240750,0.073791,0.227708,0.031625,10,2,pass,0,0.240750;0.221834
-random_masked_reverse,73,438,8,metal_shared,0.269792,0.069167,0.226000,0.031625,10,2,pass,0,0.269792;0.250833
diff --git a/dev/research/metal_pathfinding/results/cpu-sanitized.csv b/dev/research/metal_pathfinding/results/cpu-sanitized.csv
deleted file mode 100644
index 84f0bcf..0000000
--- a/dev/research/metal_pathfinding/results/cpu-sanitized.csv
+++ /dev/null
@@ -1,41 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.097375,0.000000,0.097375,0.000000,0,1,pass,1,0.097375
-random,128,1024,1,cpu_distance,0.030375,0.000000,0.030375,0.000000,0,1,pass,0,0.030375
-random,128,1024,1,cpu_pool10,0.166000,0.000000,0.166000,0.000000,0,1,pass,1,0.166000
-random,128,1024,1,cpu_pool10_distance,0.077291,0.000000,0.077291,0.000000,0,1,pass,0,0.077291
-random,128,1024,64,cpu_full,4.778583,0.000000,4.778583,0.000000,0,1,pass,64,4.778583
-random,128,1024,64,cpu_distance,1.507292,0.000000,1.507292,0.000000,0,1,pass,0,1.507292
-random,128,1024,64,cpu_pool10,0.686542,0.000000,0.686542,0.000000,0,1,pass,64,0.686542
-random,128,1024,64,cpu_pool10_distance,0.330625,0.000000,0.330625,0.000000,0,1,pass,0,0.330625
-random,1024,8192,1,cpu_full,0.539375,0.000000,0.539375,0.000000,0,1,pass,1,0.539375
-random,1024,8192,1,cpu_distance,0.188375,0.000000,0.188375,0.000000,0,1,pass,0,0.188375
-random,1024,8192,1,cpu_pool10,0.586917,0.000000,0.586917,0.000000,0,1,pass,1,0.586917
-random,1024,8192,1,cpu_pool10_distance,0.240834,0.000000,0.240834,0.000000,0,1,pass,0,0.240834
-random,1024,8192,64,cpu_full,34.944792,0.000000,34.944792,0.000000,0,1,pass,64,34.944792
-random,1024,8192,64,cpu_distance,13.138375,0.000000,13.138375,0.000000,0,1,pass,0,13.138375
-random,1024,8192,64,cpu_pool10,4.126666,0.000000,4.126666,0.000000,0,1,pass,64,4.126666
-random,1024,8192,64,cpu_pool10_distance,1.569333,0.000000,1.569333,0.000000,0,1,pass,0,1.569333
-fabric,288,16384,1,cpu_full,0.859542,0.000000,0.859542,0.000000,0,1,pass,1,0.859542
-fabric,288,16384,1,cpu_distance,0.116792,0.000000,0.116792,0.000000,0,1,pass,0,0.116792
-fabric,288,16384,1,cpu_pool10,0.838292,0.000000,0.838292,0.000000,0,1,pass,1,0.838292
-fabric,288,16384,1,cpu_pool10_distance,0.132208,0.000000,0.132208,0.000000,0,1,pass,0,0.132208
-fabric,288,16384,64,cpu_full,55.711541,0.000000,55.711541,0.000000,0,1,pass,64,55.711541
-fabric,288,16384,64,cpu_distance,8.051041,0.000000,8.051041,0.000000,0,1,pass,0,8.051041
-fabric,288,16384,64,cpu_pool10,6.186542,0.000000,6.186542,0.000000,0,1,pass,64,6.186542
-fabric,288,16384,64,cpu_pool10_distance,0.728208,0.000000,0.728208,0.000000,0,1,pass,0,0.728208
-grid,1024,3968,1,cpu_full,0.292625,0.000000,0.292625,0.000000,0,1,pass,1,0.292625
-grid,1024,3968,1,cpu_distance,0.067333,0.000000,0.067333,0.000000,0,1,pass,0,0.067333
-grid,1024,3968,1,cpu_pool10,0.291583,0.000000,0.291583,0.000000,0,1,pass,1,0.291583
-grid,1024,3968,1,cpu_pool10_distance,0.096125,0.000000,0.096125,0.000000,0,1,pass,0,0.096125
-grid,1024,3968,64,cpu_full,18.959167,0.000000,18.959167,0.000000,0,1,pass,64,18.959167
-grid,1024,3968,64,cpu_distance,4.468167,0.000000,4.468167,0.000000,0,1,pass,0,4.468167
-grid,1024,3968,64,cpu_pool10,2.241042,0.000000,2.241042,0.000000,0,1,pass,64,2.241042
-grid,1024,3968,64,cpu_pool10_distance,0.553875,0.000000,0.553875,0.000000,0,1,pass,0,0.553875
-chain,256,255,1,cpu_full,0.026584,0.000000,0.026584,0.000000,0,1,pass,1,0.026584
-chain,256,255,1,cpu_distance,0.007542,0.000000,0.007542,0.000000,0,1,pass,0,0.007542
-chain,256,255,1,cpu_pool10,0.055416,0.000000,0.055416,0.000000,0,1,pass,1,0.055416
-chain,256,255,1,cpu_pool10_distance,0.031166,0.000000,0.031166,0.000000,0,1,pass,0,0.031166
-random_masked_int64_reverse,1024,8192,8,cpu_full,2.706625,0.000000,2.706625,0.000000,0,1,pass,8,2.706625
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.929791,0.000000,0.929791,0.000000,0,1,pass,0,0.929791
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.434375,0.000000,0.434375,0.000000,0,1,pass,8,0.434375
-random_masked_int64_reverse,1024,8192,8,cpu_pool10_distance,0.197500,0.000000,0.197500,0.000000,0,1,pass,0,0.197500
diff --git a/dev/research/metal_pathfinding/results/cpu-validation.txt b/dev/research/metal_pathfinding/results/cpu-validation.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/rejected-race/a1-stderr.txt b/dev/research/metal_pathfinding/results/rejected-race/a1-stderr.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/dev/research/metal_pathfinding/results/rejected-race/a1.csv b/dev/research/metal_pathfinding/results/rejected-race/a1.csv
deleted file mode 100644
index 40a48a5..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/a1.csv
+++ /dev/null
@@ -1,82 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,cpu_full,0.009666,0.000000,0.009666,0.000000,0,9,pass,1,0.010500;0.011750;0.010709;0.009666;0.009375;0.010292;0.009458;0.009292;0.009375
-random,128,1024,1,cpu_distance,0.004750,0.000000,0.004750,0.000000,0,9,pass,0,0.004750;0.004875;0.006167;0.004583;0.004333;0.006292;0.005542;0.004583;0.004458
-random,128,1024,1,cpu_pool10,0.038167,0.000000,0.038167,0.000000,0,9,pass,1,0.062375;0.040667;0.050667;0.038167;0.043250;0.036875;0.035292;0.028667;0.034958
-random,128,1024,64,cpu_full,0.800000,0.000000,0.800000,0.000000,0,9,pass,64,0.907541;0.878042;0.845291;0.835625;0.800000;0.788042;0.781792;0.784208;0.773458
-random,128,1024,64,cpu_distance,0.396125,0.000000,0.396125,0.000000,0,9,pass,0,0.442208;0.424833;0.404792;0.394959;0.390000;0.399083;0.396125;0.387125;0.386542
-random,128,1024,64,cpu_pool10,0.170208,0.000000,0.170208,0.000000,0,9,pass,64,0.172209;0.167500;0.174958;0.158834;0.170208;0.166500;0.161167;0.198625;0.181000
-random,1024,8192,1,cpu_full,0.099084,0.000000,0.099084,0.000000,0,9,pass,1,0.103500;0.101375;0.098542;0.099209;0.097667;0.099417;0.099041;0.097583;0.099084
-random,1024,8192,1,cpu_distance,0.058041,0.000000,0.058041,0.000000,0,9,pass,0,0.060750;0.058041;0.056750;0.057167;0.056333;0.059542;0.062833;0.059875;0.056875
-random,1024,8192,1,cpu_pool10,0.165833,0.000000,0.165833,0.000000,0,9,pass,1,0.172125;0.203542;0.148416;0.124917;0.191000;0.166625;0.143292;0.165833;0.137583
-random,1024,8192,64,cpu_full,10.543584,0.000000,10.543584,0.000000,0,9,pass,64,10.571083;10.583583;10.586917;10.594250;10.498959;10.348333;10.482750;10.392041;10.543584
-random,1024,8192,64,cpu_distance,5.130416,0.000000,5.130416,0.000000,0,9,pass,0,5.130416;5.089708;5.094791;5.078417;5.263458;5.194500;5.156167;5.122708;5.251958
-random,1024,8192,64,cpu_pool10,1.302667,0.000000,1.302667,0.000000,0,9,pass,64,1.297875;1.289334;1.334458;1.313875;1.291750;1.302667;1.320209;1.273375;1.380250
-fabric,288,16384,1,cpu_full,0.111042,0.000000,0.111042,0.000000,0,9,pass,1,0.116416;0.114041;0.111042;0.115458;0.110375;0.110000;0.110709;0.111708;0.109916
-fabric,288,16384,1,cpu_distance,0.023375,0.000000,0.023375,0.000000,0,9,pass,0,0.023833;0.023792;0.023375;0.023459;0.023416;0.023167;0.023333;0.023250;0.023250
-fabric,288,16384,1,cpu_pool10,0.136584,0.000000,0.136584,0.000000,0,9,pass,1,0.139375;0.149417;0.133875;0.134542;0.136584;0.132542;0.150708;0.135167;0.144917
-fabric,288,16384,64,cpu_full,7.296542,0.000000,7.296542,0.000000,0,9,pass,64,7.296542;7.249084;7.306250;7.259250;7.382000;7.404750;7.204834;7.289084;7.365292
-fabric,288,16384,64,cpu_distance,1.513458,0.000000,1.513458,0.000000,0,9,pass,0,1.482000;1.522833;1.501708;1.522166;1.513458;1.513333;1.503958;1.553209;1.569583
-fabric,288,16384,64,cpu_pool10,0.958250,0.000000,0.958250,0.000000,0,9,pass,64,1.064625;0.943042;0.958250;0.963417;0.960708;0.981125;0.951500;0.927750;0.946458
-grid,1024,3968,1,cpu_full,0.042166,0.000000,0.042166,0.000000,0,9,pass,1,0.047375;0.045667;0.044083;0.042166;0.041458;0.043333;0.041167;0.041292;0.040875
-grid,1024,3968,1,cpu_distance,0.011958,0.000000,0.011958,0.000000,0,9,pass,0,0.012584;0.012167;0.012125;0.012167;0.011792;0.011792;0.011958;0.011750;0.011709
-grid,1024,3968,1,cpu_pool10,0.073917,0.000000,0.073917,0.000000,0,9,pass,1,0.086125;0.073917;0.087500;0.077750;0.067458;0.074667;0.070042;0.068750;0.066125
-grid,1024,3968,64,cpu_full,3.898167,0.000000,3.898167,0.000000,0,9,pass,64,3.895625;3.931583;3.898167;3.892791;3.934375;3.910291;3.882542;3.895417;3.907417
-grid,1024,3968,64,cpu_distance,0.937667,0.000000,0.937667,0.000000,0,9,pass,0,0.953584;0.920083;0.906583;0.896791;1.014416;0.992750;0.958250;0.937667;0.928916
-grid,1024,3968,64,cpu_pool10,0.528625,0.000000,0.528625,0.000000,0,9,pass,64,0.520500;0.554000;0.528625;0.520209;0.517667;0.490542;0.536000;0.590291;0.531209
-chain,256,255,1,cpu_full,0.002750,0.000000,0.002750,0.000000,0,9,pass,1,0.004250;0.002792;0.002708;0.002708;0.002750;0.002792;0.002709;0.002750;0.002667
-chain,256,255,1,cpu_distance,0.000666,0.000000,0.000666,0.000000,0,9,pass,0,0.000625;0.000583;0.000583;0.000542;0.000666;0.000708;0.000709;0.000709;0.000667
-chain,256,255,1,cpu_pool10,0.036333,0.000000,0.036333,0.000000,0,9,pass,1,0.022791;0.036333;0.039916;0.033958;0.034875;0.039209;0.040292;0.026375;0.037625
-random_masked_int64_reverse,1024,8192,8,cpu_full,0.637292,0.000000,0.637292,0.000000,0,9,pass,8,0.667833;0.637292;0.610000;0.586250;0.574125;0.568834;0.684500;0.703167;0.666542
-random_masked_int64_reverse,1024,8192,8,cpu_distance,0.300208,0.000000,0.300208,0.000000,0,9,pass,0,0.459750;0.389292;0.344250;0.303167;0.300208;0.288250;0.285292;0.279416;0.282959
-random_masked_int64_reverse,1024,8192,8,cpu_pool10,0.156000,0.000000,0.156000,0.000000,0,9,pass,8,0.159459;0.161625;0.149458;0.158792;0.152625;0.156000;0.159417;0.151959;0.150167
-random,4096,32768,1,cpu_full,0.631667,0.000000,0.631667,0.000000,0,9,pass,1,0.706459;0.669375;0.644166;0.631667;0.620542;0.617000;0.617833;0.601292;0.727000
-random,4096,32768,1,cpu_distance,0.329750,0.000000,0.329750,0.000000,0,9,pass,0,0.329750;0.340834;0.336292;0.338250;0.327792;0.317375;0.330875;0.304542;0.304708
-random,4096,32768,1,cpu_pool10,0.817667,0.000000,0.817667,0.000000,0,9,pass,1,0.845333;0.823416;0.817667;0.842500;0.807292;0.770000;0.722583;0.818916;0.761541
-random,4096,32768,64,cpu_full,52.210125,0.000000,52.210125,0.000000,0,9,pass,64,52.438458;52.412625;52.033666;52.333375;52.210125;51.993958;52.123292;52.159083;52.419041
-random,4096,32768,64,cpu_distance,26.296916,0.000000,26.296916,0.000000,0,9,pass,0,26.418875;26.417792;26.296916;26.482583;26.288958;26.609667;26.009667;26.031875;26.104125
-random,4096,32768,64,cpu_pool10,6.491792,0.000000,6.491792,0.000000,0,9,pass,64,6.491792;6.342875;6.799208;6.762459;6.705875;6.170292;6.229750;6.722625;6.462917
-random,4096,32768,256,cpu_full,209.806250,0.000000,209.806250,0.000000,0,9,pass,256,209.554292;211.988208;210.116500;209.288583;209.680917;209.828375;209.806250;209.382167;217.385875
-random,4096,32768,256,cpu_distance,105.298583,0.000000,105.298583,0.000000,0,9,pass,0,105.078250;105.298583;105.704542;105.054000;105.176084;105.098709;105.568833;105.914917;106.202334
-random,4096,32768,256,cpu_pool10,22.902917,0.000000,22.902917,0.000000,0,9,pass,256,22.643541;22.909667;22.902917;22.651667;23.214542;22.817000;23.036292;22.723583;22.937291
-random,16384,131072,1,cpu_full,3.829959,0.000000,3.829959,0.000000,0,9,pass,1,3.758083;4.336333;3.799417;3.741708;3.829959;3.751625;3.870791;3.908833;3.859792
-random,16384,131072,1,cpu_distance,1.911000,0.000000,1.911000,0.000000,0,9,pass,0,2.010083;1.909125;1.899250;1.850917;2.113667;2.056375;1.960000;1.911000;1.884875
-random,16384,131072,1,cpu_pool10,3.920375,0.000000,3.920375,0.000000,0,9,pass,1,3.819708;3.773125;4.272791;3.939208;3.692208;4.034500;3.920375;4.013833;3.866792
-random,16384,131072,64,cpu_full,251.553583,0.000000,251.553583,0.000000,0,9,pass,64,252.180500;251.192875;246.819666;251.553583;248.245708;246.188208;252.333084;252.777417;257.578000
-random,16384,131072,64,cpu_distance,132.990000,0.000000,132.990000,0.000000,0,9,pass,0,132.707583;134.917958;133.056834;132.915500;132.990000;132.365792;133.342708;133.048167;132.554875
-random,16384,131072,64,cpu_pool10,28.447375,0.000000,28.447375,0.000000,0,9,pass,64,28.610000;28.458042;28.357791;28.447375;28.609708;28.349416;28.265208;28.702541;28.418541
-random,65536,524288,1,cpu_full,20.940041,0.000000,20.940041,0.000000,0,9,pass,1,21.304334;20.860834;21.335416;20.838250;21.789875;20.292334;21.301250;20.940041;20.917500
-random,65536,524288,1,cpu_distance,11.158625,0.000000,11.158625,0.000000,0,9,pass,0,11.319166;10.996000;10.906125;11.023625;11.190708;10.960709;11.158625;11.208667;11.261834
-random,65536,524288,1,cpu_pool10,23.570334,0.000000,23.570334,0.000000,0,9,pass,1,21.283542;20.398708;22.447709;24.142625;24.654791;24.214250;23.570334;24.476750;22.815583
-random,65536,524288,64,cpu_full,1475.197459,0.000000,1475.197459,0.000000,0,9,pass,64,1384.978917;1475.197459;1464.451459;1485.729083;1612.075042;1686.816042;1673.231417;1429.034000;1386.365083
-random,65536,524288,64,cpu_distance,758.485125,0.000000,758.485125,0.000000,0,9,pass,0,762.178042;763.873042;766.125500;780.269292;758.485125;737.577708;741.359667;744.495709;755.063458
-random,65536,524288,64,cpu_pool10,199.161041,0.000000,199.161041,0.000000,0,9,pass,64,203.127916;199.161041;200.671042;200.809458;198.845500;198.417584;195.237833;199.019000;200.340792
-chain,2048,2047,1,cpu_full,0.019667,0.000000,0.019667,0.000000,0,9,pass,1,0.019459;0.019750;0.020000;0.019584;0.019542;0.019584;0.019708;0.019791;0.019667
-chain,2048,2047,1,cpu_distance,0.004042,0.000000,0.004042,0.000000,0,9,pass,0,0.004958;0.004917;0.004042;0.004416;0.003917;0.004000;0.003958;0.004875;0.004000
-chain,2048,2047,1,cpu_pool10,0.039084,0.000000,0.039084,0.000000,0,9,pass,1,0.043542;0.043291;0.037541;0.039084;0.037917;0.041167;0.033708;0.040000;0.036666
-random,4096,131072,1,cpu_full,1.723084,0.000000,1.723084,0.000000,0,9,pass,1,1.723084;1.816458;1.822000;1.715708;2.010917;1.749500;1.692459;1.691292;1.674250
-random,4096,131072,1,cpu_distance,0.712000,0.000000,0.712000,0.000000,0,9,pass,0,0.738875;0.716959;0.712000;0.700250;0.676166;0.678875;0.682958;0.762375;0.823833
-random,4096,131072,1,cpu_pool10,1.769500,0.000000,1.769500,0.000000,0,9,pass,1,1.757375;1.769500;1.803625;1.661250;1.808917;1.693666;1.652417;1.815417;2.108958
-random,4096,131072,64,cpu_full,114.542416,0.000000,114.542416,0.000000,0,9,pass,64,113.662709;114.371875;113.470208;113.180125;117.370209;114.542416;118.531125;118.463875;121.422042
-random,4096,131072,64,cpu_distance,52.960208,0.000000,52.960208,0.000000,0,9,pass,0,54.235500;54.562542;52.976500;52.960208;51.147458;50.654209;51.172625;52.637000;53.555875
-random,4096,131072,64,cpu_pool10,16.696333,0.000000,16.696333,0.000000,0,9,pass,64,17.632417;16.696333;17.935500;17.066958;16.540042;14.694666;23.514875;14.485291;13.440750
-clos,200,20000,1,cpu_full,0.147125,0.000000,0.147125,0.000000,0,9,pass,1,0.147375;0.146416;0.147000;0.146959;0.153333;0.147583;0.151167;0.147125;0.147000
-clos,200,20000,1,cpu_distance,0.026167,0.000000,0.026167,0.000000,0,9,pass,0,0.026750;0.026708;0.029041;0.026167;0.026167;0.029041;0.025834;0.026000;0.026125
-clos,200,20000,1,cpu_pool10,0.176417,0.000000,0.176417,0.000000,0,9,pass,1,0.202625;0.176417;0.178792;0.191833;0.176125;0.169833;0.169042;0.173541;0.188042
-clos,200,20000,64,cpu_full,9.558125,0.000000,9.558125,0.000000,0,9,pass,64,9.327083;9.558125;9.654875;9.680333;9.408292;9.393375;9.611375;9.525917;9.592459
-clos,200,20000,64,cpu_distance,1.738709,0.000000,1.738709,0.000000,0,9,pass,0,1.729000;1.729417;1.792625;1.745458;1.730167;1.869125;2.065958;1.738709;1.725625
-clos,200,20000,64,cpu_pool10,1.869167,0.000000,1.869167,0.000000,0,9,pass,64,2.808834;2.692000;2.343250;2.577292;1.869167;1.174959;1.203708;1.285250;1.219667
-clos,800,320000,1,cpu_full,2.567583,0.000000,2.567583,0.000000,0,9,pass,1,2.635000;2.553959;2.598042;2.565666;2.537542;2.567583;2.579542;2.595208;2.566083
-clos,800,320000,1,cpu_distance,0.407708,0.000000,0.407708,0.000000,0,9,pass,0,0.407042;0.407583;0.408167;0.407125;0.407708;0.410375;0.424583;0.415833;0.407334
-clos,800,320000,1,cpu_pool10,2.464458,0.000000,2.464458,0.000000,0,9,pass,1,2.607250;2.708625;2.449125;2.464458;2.431584;2.487958;2.421458;2.426583;2.499208
-clos,800,320000,64,cpu_full,155.384917,0.000000,155.384917,0.000000,0,9,pass,64,163.952083;155.384917;155.413125;151.858083;156.446167;155.488000;151.541084;151.281583;151.429750
-clos,800,320000,64,cpu_distance,25.811833,0.000000,25.811833,0.000000,0,9,pass,0,25.656209;25.709083;25.892292;25.811833;25.767625;25.899542;25.672500;26.257709;26.174416
-clos,800,320000,64,cpu_pool10,18.125041,0.000000,18.125041,0.000000,0,9,pass,64,19.433500;18.233833;17.844333;17.857167;17.345709;18.285458;17.183667;19.231542;18.125041
-grid,10000,39600,1,cpu_full,0.622375,0.000000,0.622375,0.000000,0,9,pass,1,0.625916;0.622375;0.615208;0.611750;0.614209;0.612917;0.682500;0.666667;0.656125
-grid,10000,39600,1,cpu_distance,0.181792,0.000000,0.181792,0.000000,0,9,pass,0,0.184250;0.183375;0.182917;0.181792;0.183083;0.180834;0.179042;0.179750;0.180209
-grid,10000,39600,1,cpu_pool10,0.709500,0.000000,0.709500,0.000000,0,9,pass,1,0.648792;0.709500;0.644084;0.637708;0.703416;0.730292;0.742167;0.750208;0.759833
-grid,10000,39600,8,cpu_full,5.845667,0.000000,5.845667,0.000000,0,9,pass,8,5.580833;5.744125;6.192083;5.945000;6.019250;6.081042;5.845667;5.556583;5.503542
-grid,10000,39600,8,cpu_distance,1.600833,0.000000,1.600833,0.000000,0,9,pass,0,1.679667;1.590959;1.575791;1.578458;1.564791;1.768875;1.621541;1.605458;1.600833
-grid,10000,39600,8,cpu_pool10,1.225333,0.000000,1.225333,0.000000,0,9,pass,8,0.858459;0.821167;0.901125;1.336292;1.225333;1.265792;1.339875;1.428417;1.167250
-grid,40000,159200,1,cpu_full,3.005208,0.000000,3.005208,0.000000,0,9,pass,1,3.052750;3.039291;3.014625;2.943125;2.901375;2.935542;3.052791;2.982208;3.005208
-grid,40000,159200,1,cpu_distance,0.861333,0.000000,0.861333,0.000000,0,9,pass,0,0.865708;0.860334;0.861333;0.857000;0.863750;0.860375;0.859708;0.953250;0.933792
-grid,40000,159200,1,cpu_pool10,3.089417,0.000000,3.089417,0.000000,0,9,pass,1,3.089417;2.962667;2.994000;3.129125;3.048042;3.150875;3.102834;2.986583;3.166417
diff --git a/dev/research/metal_pathfinding/results/rejected-race/b-stderr.txt b/dev/research/metal_pathfinding/results/rejected-race/b-stderr.txt
deleted file mode 100644
index 7806da3..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/b-stderr.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-device=Apple M4 Max setup_ms=29.6173 execution_width=32
-FAIL: distance mismatch at query 59
diff --git a/dev/research/metal_pathfinding/results/rejected-race/b.csv b/dev/research/metal_pathfinding/results/rejected-race/b.csv
deleted file mode 100644
index 9126f3c..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/b.csv
+++ /dev/null
@@ -1,23 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-random,128,1024,1,metal_pull,0.816458,0.307250,0.812917,0.019833,16,9,pass,0,0.592208;0.819542;0.819458;0.816458;0.901334;0.811084;0.817583;0.560375;0.555250
-random,128,1024,1,metal_group,0.249250,0.129500,0.245459,0.019833,9,9,pass,0,0.269541;0.249250;0.257125;0.247125;0.242083;0.247875;0.248792;0.251792;0.253833
-random,128,1024,1,metal_shared,0.271792,0.122250,0.267583,0.019833,9,9,pass,0,0.268500;0.485333;0.264667;0.495959;0.361625;0.271792;0.494625;0.270625;0.244917
-random,128,1024,64,metal_pull,0.878042,0.346833,0.616208,0.061167,16,9,pass,0,0.898375;0.871459;0.857708;0.866667;0.878208;0.863583;0.878042;0.909083;0.938750
-random,128,1024,64,metal_group,0.569875,0.178625,0.308000,0.061167,13,9,pass,0,0.555916;0.559583;0.596000;0.651334;0.581583;0.575791;0.569875;0.567708;0.563708
-random,128,1024,64,metal_shared,0.537708,0.168042,0.295042,0.061167,13,9,pass,0,0.548917;0.549375;0.567167;0.531750;0.537708;0.601708;0.531583;0.516333;0.532208
-random,1024,8192,1,metal_pull,0.676250,0.397875,0.641792,0.083584,16,9,pass,0,0.703584;0.701583;0.679083;0.676250;0.663709;0.722417;0.666791;0.667666;0.656167
-random,1024,8192,1,metal_group,0.842583,0.678083,0.809167,0.083584,13,9,pass,0,1.298250;0.830208;0.842583;0.845167;0.841125;0.837417;0.840041;0.845750;0.852083
-random,1024,8192,1,metal_shared,0.811125,0.637792,0.775833,0.083584,13,9,pass,0,0.819959;0.808292;0.812000;0.811125;0.798291;0.811250;0.809458;0.813041;0.801084
-random,1024,8192,64,metal_pull,4.685833,1.546416,2.311167,0.097167,24,9,pass,0,4.668167;4.401916;5.264625;4.813000;4.743792;4.685833;4.779792;4.610958;4.660625
-random,1024,8192,64,metal_group,3.703708,0.886125,1.335375,0.097167,17,9,pass,0,3.703708;3.667417;3.495459;3.551833;3.825667;3.801500;3.883542;3.540250;3.747000
-random,1024,8192,64,metal_shared,3.640583,0.831125,1.256917,0.097167,17,9,pass,0,3.393333;3.665417;3.607333;3.547959;3.653458;3.624833;3.640583;3.653792;3.644208
-fabric,288,16384,1,metal_pull,1.831416,1.649458,1.774709,0.121750,8,9,pass,0,1.831416;1.898416;1.873500;1.825333;1.838958;1.826833;1.808167;2.394584;1.186584
-fabric,288,16384,1,metal_group,0.754041,0.575708,0.697125,0.121750,3,9,pass,0,0.759167;0.756791;0.754041;0.866458;0.763750;0.600625;0.514000;0.504291;0.568208
-fabric,288,16384,1,metal_shared,0.700750,0.507750,0.643667,0.121750,3,9,pass,0,0.749250;0.750541;0.729708;0.735500;0.700750;0.500625;0.499959;0.504042;0.564667
-fabric,288,16384,64,metal_pull,5.854333,1.801583,2.349125,0.128458,8,9,pass,0,5.230666;5.573292;6.165708;5.854333;5.898959;5.926500;5.789875;6.005459;5.788750
-fabric,288,16384,64,metal_group,4.626000,0.643250,1.182875,0.128458,3,9,pass,0,4.626000;4.593708;4.322292;4.596375;4.634209;4.741584;4.599625;4.722167;4.693709
-fabric,288,16384,64,metal_shared,4.613333,0.621375,1.159000,0.128458,3,9,pass,0,4.405417;4.666458;4.603375;4.603334;4.613333;4.720250;4.403458;4.680416;4.707125
-grid,1024,3968,1,metal_pull,1.759875,0.653875,1.743750,0.060083,64,9,pass,0,2.030541;1.759875;1.747459;2.255083;1.600958;2.206875;1.709500;1.800334;1.600042
-grid,1024,3968,1,metal_group,1.156208,1.000000,1.139875,0.060083,63,9,pass,0,1.154667;1.164959;1.157417;1.147209;1.134917;1.148125;1.156208;1.665167;1.197417
-grid,1024,3968,1,metal_shared,0.486500,0.345750,0.469042,0.060083,63,9,pass,0,0.498750;0.507834;0.482208;0.486500;0.488375;0.488166;0.465291;0.485917;0.467125
-grid,1024,3968,64,metal_pull,3.018000,0.569042,2.047500,0.095667,64,9,pass,0,3.018000;2.953667;3.431208;2.733709;2.995208;2.668375;3.199958;3.169250;3.109583
diff --git a/dev/research/metal_pathfinding/results/rejected-race/environment.txt b/dev/research/metal_pathfinding/results/rejected-race/environment.txt
deleted file mode 100644
index 6fc5908..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/environment.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-2026-09-26T23:00:02Z
-fbab119e794c843838f4f3f96d75cb7f32f06845
-ProductName:		macOS
-ProductVersion:		26.6.1
-BuildVersion:		25G76
-Apple M4 Max
-38654705664
-14
-Apple clang version 21.0.0 (clang-2100.1.1.101)
-Target: arm64-apple-darwin25.6.0
-Thread model: posix
-InstalledDir: /Library/Developer/CommandLineTools/usr/bin
-c7d33ce878a8f0f1a6822efff641c8fdf0514edabcb521cfe7ae3044e56170d7  dev/research/metal_pathfinding/experiment.mm
-bd5f14bdb079c40a4e0ef26ab4d48e16b8c63b830858a53a18445a2addc2b480  dev/research/metal_pathfinding/sssp.metal
-Note: No thermal warning level has been recorded
-Note: No performance warning level has been recorded
-Note: No CPU power status has been recorded
diff --git a/dev/research/metal_pathfinding/results/rejected-race/load-a1.txt b/dev/research/metal_pathfinding/results/rejected-race/load-a1.txt
deleted file mode 100644
index 9e27631..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/load-a1.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1025 total, 4 running, 1021 sleeping, 5327 threads 
-2026/09/27 00:00:02
-Load Avg: 3.96, 4.55, 4.69 
-CPU usage: 16.11% user, 13.13% sys, 70.74% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 639741 total, 10G resident, 737M private, 4343M shared.
-PhysMem: 35G used (4508M wired, 633M compressor), 577M unused.
-VM: 453T vsize, 6144M framework vsize, 2843881(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190075863/161G in, 145485402/163G out.
-Disks: 97533882/2474G read, 117262731/2097G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1027 total, 3 running, 1024 sleeping, 5343 threads 
-2026/09/27 00:00:03
-Load Avg: 3.96, 4.55, 4.69 
-CPU usage: 11.46% user, 5.96% sys, 82.56% idle 
-SharedLibs: 914M resident, 168M data, 135M linkedit.
-MemRegions: 204 total, 26M resident, 737M private, 4344M shared.
-PhysMem: 34G used (4463M wired, 633M compressor), 634M unused.
-VM: 454T vsize, 6144M framework vsize, 2843881(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190075966/161G in, 145485507/163G out.
-Disks: 97534168/2474G read, 117262748/2097G written.
-
-PID    COMMAND          %CPU #TH   
-590    WindowServer     30.6 28    
-1331   NotificationCent 17.7 17    
-70968  Superset Helper  16.5 32    
-0      kernel_task      15.9 850/14
-70942  Superset Helper  6.2  19    
-45949  top              5.9  1/1   
-39196  PerfPowerService 5.3  8     
-70934  Superset         3.4  51    
diff --git a/dev/research/metal_pathfinding/results/rejected-race/load-b.txt b/dev/research/metal_pathfinding/results/rejected-race/load-b.txt
deleted file mode 100644
index 592e523..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/load-b.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Processes: 1026 total, 4 running, 1022 sleeping, 5280 threads 
-2026/09/27 00:01:03
-Load Avg: 4.62, 4.67, 4.73 
-CPU usage: 14.6% user, 9.18% sys, 76.75% idle 
-SharedLibs: 914M resident, 167M data, 135M linkedit.
-MemRegions: 676023 total, 10G resident, 736M private, 4305M shared.
-PhysMem: 34G used (4015M wired, 633M compressor), 891M unused.
-VM: 458T vsize, 6144M framework vsize, 2843881(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190086917/161G in, 145497019/163G out.
-Disks: 97535297/2474G read, 117266119/2097G written.
-
-PID    COMMAND          %CPU #TH
-99753  mscamerad-xpc    0.0  2  
-99752  PlugInLibrarySer 0.0  2  
-99750  QuickLookUIServi 0.0  3  
-99749  com.apple.appkit 0.0  3  
-99710  PlugInLibrarySer 0.0  2  
-99709  Preview          0.0  4  
-99428  crashpad_handler 0.0  4  
-98995  crashpad_handler 0.0  4  
-Processes: 1026 total, 3 running, 1023 sleeping, 5287 threads 
-2026/09/27 00:01:04
-Load Avg: 4.62, 4.67, 4.73 
-CPU usage: 12.45% user, 3.0% sys, 84.54% idle 
-SharedLibs: 914M resident, 167M data, 135M linkedit.
-MemRegions: 0 total, 0B resident, 736M private, 4305M shared.
-PhysMem: 34G used (4054M wired, 633M compressor), 911M unused.
-VM: 458T vsize, 6144M framework vsize, 2843881(0) swapins, 4729331(0) swapouts.
-Networks: packets: 190087017/161G in, 145497121/163G out.
-Disks: 97535298/2474G read, 117266121/2097G written.
-
-PID    COMMAND          %CPU #TH   
-48825  Python           73.0 1/1   
-590    WindowServer     25.5 28    
-70968  Superset Helper  20.9 32    
-0      kernel_task      10.0 850/15
-70942  Superset Helper  7.6  18    
-21666  2.1.283          6.5  28    
-48902  top              6.3  1/1   
-70934  Superset         3.8  51    
diff --git a/dev/research/metal_pathfinding/results/rejected-race/pre-fix-smoke.csv b/dev/research/metal_pathfinding/results/rejected-race/pre-fix-smoke.csv
deleted file mode 100644
index bbcfc40..0000000
--- a/dev/research/metal_pathfinding/results/rejected-race/pre-fix-smoke.csv
+++ /dev/null
@@ -1,21 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct
-random,128,1024,1,metal_pull,0.614208,0.304625,0.606959,0.053541,16,3,pass
-random,128,1024,1,metal_group,0.310458,0.129667,0.307333,0.053541,9,3,pass
-random,128,1024,64,metal_pull,0.886292,0.347083,0.624083,0.055542,16,3,pass
-random,128,1024,64,metal_group,0.570625,0.177500,0.315042,0.055542,13,3,pass
-random,1024,8192,1,metal_pull,0.704750,0.398333,0.662834,0.078125,16,3,pass
-random,1024,8192,1,metal_group,0.862250,0.722333,0.827125,0.078125,13,3,pass
-random,1024,8192,64,metal_pull,4.660125,1.654750,2.257041,0.088125,24,3,pass
-random,1024,8192,64,metal_group,3.771334,0.891792,1.350084,0.088125,17,3,pass
-fabric,288,16384,1,metal_pull,1.844583,1.652417,1.794125,0.118167,8,3,pass
-fabric,288,16384,1,metal_group,0.790083,0.583125,0.732959,0.118167,3,3,pass
-fabric,288,16384,64,metal_pull,5.691166,1.800708,2.326167,0.114166,8,3,pass
-fabric,288,16384,64,metal_group,4.476125,0.652125,1.174042,0.114166,3,3,pass
-grid,1024,3968,1,metal_pull,1.953792,0.654417,1.936833,0.073500,64,3,pass
-grid,1024,3968,1,metal_group,1.172875,1.000375,1.159500,0.073500,63,3,pass
-grid,1024,3968,64,metal_pull,3.767584,1.438375,2.877834,0.084959,64,3,pass
-grid,1024,3968,64,metal_group,2.245667,0.944250,1.384000,0.084959,63,3,pass
-chain,256,255,1,metal_pull,6.148250,1.919250,6.146208,0.065667,256,3,pass
-chain,256,255,1,metal_group,0.701417,0.575583,0.699959,0.065667,256,3,pass
-random_masked_int64_reverse,1024,8192,8,metal_pull,0.689167,0.133750,0.271792,0.088000,8,3,pass
-random_masked_int64_reverse,1024,8192,8,metal_group,0.792458,0.241500,0.385917,0.088000,8,3,pass
diff --git a/dev/research/metal_pathfinding/results/sanitize-test.txt b/dev/research/metal_pathfinding/results/sanitize-test.txt
deleted file mode 100644
index 20e81e8..0000000
--- a/dev/research/metal_pathfinding/results/sanitize-test.txt
+++ /dev/null
@@ -1,372 +0,0 @@
--- pybind11 not found via config; using FetchContent
--- pybind11 v3.0.0 
--- Enabling sanitizers (disables optimizations)
--- Configuring done (0.6s)
--- Generating done (0.0s)
--- Build files have been written to: /Users/networmix/ws/NetGraph-Core/build/cpp-sanitize
-[1/21] Building CXX object CMakeFiles/netgraph_core.dir/src/strict_multidigraph.cpp.o
-[2/21] Building CXX object CMakeFiles/netgraph_core.dir/src/k_shortest_paths.cpp.o
-[3/21] Building CXX object CMakeFiles/netgraph_core.dir/src/shortest_paths.cpp.o
-[4/21] Building CXX object CMakeFiles/netgraph_core.dir/src/max_flow.cpp.o
-[5/21] Building CXX object CMakeFiles/netgraph_core.dir/src/cpu_backend.cpp.o
-[6/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_state.cpp.o
-[7/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_graph.cpp.o
-[8/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_policy.cpp.o
-[9/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/smoke_test.cpp.o
-[10/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/strict_multidigraph_tests.cpp.o
-[11/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_policy_tests.cpp.o
-[12/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/shortest_paths_tests.cpp.o
-[13/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_state_tests.cpp.o
-[14/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_graph_tests.cpp.o
-[15/21] Linking CXX static library libnetgraph_core.a
-[16/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/max_flow_tests.cpp.o
-[17/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/k_shortest_paths_tests.cpp.o
-[18/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/masking_tests.cpp.o
-[19/21] Linking CXX executable netgraph_core_tests
-[20/21] Building CXX object CMakeFiles/_netgraph_core.dir/bindings/python/module.cpp.o
-[21/21] Linking CXX shared module _netgraph_core.cpython-314-darwin.so
-Test project /Users/networmix/ws/NetGraph-Core/build/cpp-sanitize
-        Start  93: FlowGraphStamp.CopiesAndMovesGetFreshUids
-        Start  94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal
-        Start  16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping
-        Start  15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast
-  1/170 Test  #93: FlowGraphStamp.CopiesAndMovesGetFreshUids .........................................   Passed    0.06 sec
-  2/170 Test  #94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal ..........................   Passed    0.06 sec
-  3/170 Test  #16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping ....   Passed    0.06 sec
-        Start  47: ShortestPaths.ResolveToPathsWithMaxPathsLimit
-        Start  46: ShortestPaths.ResolveToPathsSplittingParallelEdges
-        Start  11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier
-  4/170 Test  #15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast ...   Passed    0.06 sec
-        Start  43: ShortestPaths.PredDAGIntegrity
-  5/170 Test  #11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier ...................   Passed    0.06 sec
-        Start  18: StrictMultiDiGraph.SingleNode
-  6/170 Test  #46: ShortestPaths.ResolveToPathsSplittingParallelEdges ................................   Passed    0.06 sec
-  7/170 Test  #43: ShortestPaths.PredDAGIntegrity ....................................................   Passed    0.06 sec
-        Start  45: ShortestPaths.PreferHigherResidualTieBreak
-        Start  30: StrictMultiDiGraph.OutOfRangeNodeThrows
-  8/170 Test  #47: ShortestPaths.ResolveToPathsWithMaxPathsLimit .....................................   Passed    0.06 sec
-        Start  38: ShortestPaths.MultipleEqualCostPaths
-  9/170 Test  #45: ShortestPaths.PreferHigherResidualTieBreak ........................................   Passed    0.06 sec
-        Start  41: ShortestPaths.EdgeMaskFiltering
- 10/170 Test  #18: StrictMultiDiGraph.SingleNode .....................................................   Passed    0.06 sec
- 11/170 Test  #30: StrictMultiDiGraph.OutOfRangeNodeThrows ...........................................   Passed    0.06 sec
- 12/170 Test  #38: ShortestPaths.MultipleEqualCostPaths ..............................................   Passed    0.06 sec
-        Start 130: MaxFlow.Sensitivity_TwoParallelPaths
-        Start 103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation
-        Start  31: StrictMultiDiGraph.NegativeCapacityThrows
- 13/170 Test  #41: ShortestPaths.EdgeMaskFiltering ...................................................   Passed    0.06 sec
-        Start  28: StrictMultiDiGraph.MismatchedArrayLengthsThrow
- 14/170 Test #130: MaxFlow.Sensitivity_TwoParallelPaths ..............................................   Passed    0.06 sec
-        Start  71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization
- 15/170 Test #103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation ......................................   Passed    0.06 sec
- 16/170 Test  #31: StrictMultiDiGraph.NegativeCapacityThrows .........................................   Passed    0.06 sec
-        Start 109: MaxFlow.ZeroCapacityPath_CorrectFiltering
-        Start 147: MaskingTests.MaskedSourceWithDestination
- 17/170 Test  #28: StrictMultiDiGraph.MismatchedArrayLengthsThrow ....................................   Passed    0.06 sec
-        Start 152: MaskingTests.MaskedIntermediateNode
- 18/170 Test  #71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization ................................   Passed    0.06 sec
- 19/170 Test #109: MaxFlow.ZeroCapacityPath_CorrectFiltering .........................................   Passed    0.06 sec
- 20/170 Test #147: MaskingTests.MaskedSourceWithDestination ..........................................   Passed    0.06 sec
-        Start  12: FlowPolicyStatic.PerFlowBundleBinding
-        Start 112: MaxFlow.EqualCost_ShortestVsFull_Equivalent
-        Start   5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity
- 21/170 Test #152: MaskingTests.MaskedIntermediateNode ...............................................   Passed    0.06 sec
-        Start 122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths
- 22/170 Test  #12: FlowPolicyStatic.PerFlowBundleBinding .............................................   Passed    0.06 sec
-        Start  68: FlowState.ResetWithInvalidResidualThrows
- 23/170 Test #112: MaxFlow.EqualCost_ShortestVsFull_Equivalent .......................................   Passed    0.06 sec
- 24/170 Test   #5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity ....   Passed    0.06 sec
-        Start  44: ShortestPaths.TieBreakingDeterminism
-        Start  39: ShortestPaths.ResidualAwareFiltering
- 25/170 Test #122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths ......................................   Passed    0.07 sec
-        Start   4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath
- 26/170 Test  #44: ShortestPaths.TieBreakingDeterminism ..............................................   Passed    0.07 sec
-        Start 108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth
- 27/170 Test  #39: ShortestPaths.ResidualAwareFiltering ..............................................   Passed    0.07 sec
-        Start  73: FlowState.EqualBalanced_DownstreamSplitEqualization
- 28/170 Test  #68: FlowState.ResetWithInvalidResidualThrows ..........................................   Passed    0.07 sec
-        Start 137: KShortestPaths.NodeMaskBlocksPaths
- 29/170 Test   #4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath .............   Passed    0.07 sec
-        Start  72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges
- 30/170 Test  #73: FlowState.EqualBalanced_DownstreamSplitEqualization ...............................   Passed    0.06 sec
-        Start 107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced
- 31/170 Test #108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth ...................................   Passed    0.06 sec
- 32/170 Test #137: KShortestPaths.NodeMaskBlocksPaths ................................................   Passed    0.06 sec
-        Start 140: KShortestPaths.PathsSortedByCost
-        Start  36: ShortestPaths.SingleSourceAllNodes
- 33/170 Test  #72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges ..............   Passed    0.06 sec
-        Start 158: MaskingTests.MaskWithResidualCapacity
- 34/170 Test #107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced ...................................   Passed    0.06 sec
- 35/170 Test #140: KShortestPaths.PathsSortedByCost ..................................................   Passed    0.06 sec
- 36/170 Test  #36: ShortestPaths.SingleSourceAllNodes ................................................   Passed    0.06 sec
-        Start 148: MaskingTests.MaskedSourceInMaxFlow
-        Start 113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly
-        Start 157: MaskingTests.NodeMaskOverridesEdgeMask
- 37/170 Test #158: MaskingTests.MaskWithResidualCapacity .............................................   Passed    0.06 sec
-        Start 146: MaskingTests.MaskedSourceReturnsEmptyDAG
- 38/170 Test #148: MaskingTests.MaskedSourceInMaxFlow ................................................   Passed    0.06 sec
- 39/170 Test #113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly ................................   Passed    0.06 sec
- 40/170 Test #157: MaskingTests.NodeMaskOverridesEdgeMask ............................................   Passed    0.06 sec
-        Start   1: GraphSmoke.ConstructAndRunSPF
-        Start  24: StrictMultiDiGraph.CSRReverseAdjacency
-        Start  67: FlowState.InvalidResidualInitThrows
- 41/170 Test #146: MaskingTests.MaskedSourceReturnsEmptyDAG ..........................................   Passed    0.07 sec
- 42/170 Test   #1: GraphSmoke.ConstructAndRunSPF .....................................................   Passed    0.06 sec
- 43/170 Test  #24: StrictMultiDiGraph.CSRReverseAdjacency ............................................   Passed    0.06 sec
-        Start  92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual
-        Start  10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck
-        Start  40: ShortestPaths.NodeMaskIsolation
- 44/170 Test  #67: FlowState.InvalidResidualInitThrows ...............................................   Passed    0.07 sec
-        Start 123: MaxFlow.SharedBottleneck_MultiplePathsMerge
- 45/170 Test  #40: ShortestPaths.NodeMaskIsolation ...................................................   Passed    0.06 sec
-        Start  22: StrictMultiDiGraph.ExternalEdgeIdsPreserved
- 46/170 Test  #10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck ......   Passed    0.06 sec
- 47/170 Test #123: MaxFlow.SharedBottleneck_MultiplePathsMerge .......................................   Passed    0.06 sec
-        Start  74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero
-        Start  20: StrictMultiDiGraph.ParallelEdges
- 48/170 Test  #92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual ................................   Passed    0.07 sec
-        Start 115: MaxFlow.FlowConservation_IntermediateNodes
- 49/170 Test  #74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero ....................   Passed    0.07 sec
-        Start  91: FlowGraph.LedgerHistory_RemovalRestoresResidual
- 50/170 Test  #22: StrictMultiDiGraph.ExternalEdgeIdsPreserved .......................................   Passed    0.07 sec
- 51/170 Test  #20: StrictMultiDiGraph.ParallelEdges ..................................................   Passed    0.07 sec
-        Start  35: StrictMultiDiGraph.MultipleCostTiers
-        Start  33: StrictMultiDiGraph.SelfLoopAllowed
- 52/170 Test #115: MaxFlow.FlowConservation_IntermediateNodes ........................................   Passed    0.07 sec
-        Start   9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths
- 53/170 Test  #33: StrictMultiDiGraph.SelfLoopAllowed ................................................   Passed    0.07 sec
-        Start  29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows
- 54/170 Test  #91: FlowGraph.LedgerHistory_RemovalRestoresResidual ...................................   Passed    0.07 sec
- 55/170 Test  #35: StrictMultiDiGraph.MultipleCostTiers ..............................................   Passed    0.07 sec
-        Start   2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath
-        Start  75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero
- 56/170 Test   #9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths ........   Passed    0.06 sec
-        Start 101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath
- 57/170 Test   #2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath .........................   Passed    0.07 sec
-        Start 145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK
- 58/170 Test  #29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows ....................................   Passed    0.07 sec
- 59/170 Test  #75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero .....................   Passed    0.07 sec
-        Start 119: MaxFlow.NodeMask_BlocksFlowThroughNode
-        Start 134: MaxFlow.CompletionPhase_RespectsNodeMask
- 60/170 Test #101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath ..................................   Passed    0.07 sec
-        Start 126: MaxFlow.Triangle_Topology_Combine_Mode
- 61/170 Test #145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK .....................................   Passed    0.07 sec
-        Start 167: MaskingTests.AllNodesMaskedNoReachability
- 62/170 Test #119: MaxFlow.NodeMask_BlocksFlowThroughNode ............................................   Passed    0.07 sec
- 63/170 Test #134: MaxFlow.CompletionPhase_RespectsNodeMask ..........................................   Passed    0.07 sec
-        Start  21: StrictMultiDiGraph.EdgeSortingByCost
-        Start  19: StrictMultiDiGraph.SingleEdge
- 64/170 Test #126: MaxFlow.Triangle_Topology_Combine_Mode ............................................   Passed    0.07 sec
-        Start  17: StrictMultiDiGraph.EmptyGraph
- 65/170 Test  #21: StrictMultiDiGraph.EdgeSortingByCost ..............................................   Passed    0.07 sec
-        Start  14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles
- 66/170 Test #167: MaskingTests.AllNodesMaskedNoReachability .........................................   Passed    0.07 sec
- 67/170 Test  #19: StrictMultiDiGraph.SingleEdge .....................................................   Passed    0.07 sec
-        Start 151: MaskingTests.MaskedDestinationUnreachable
-        Start  37: ShortestPaths.DisconnectedComponents
- 68/170 Test  #17: StrictMultiDiGraph.EmptyGraph .....................................................   Passed    0.07 sec
-        Start 100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow
- 69/170 Test  #14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles ...................   Passed    0.07 sec
-        Start 106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability
- 70/170 Test #151: MaskingTests.MaskedDestinationUnreachable .........................................   Passed    0.07 sec
- 71/170 Test  #37: ShortestPaths.DisconnectedComponents ..............................................   Passed    0.07 sec
-        Start  99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath
-        Start  85: FlowGraph.RemovalDeletesEntry
- 72/170 Test #100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow ....................................   Passed    0.07 sec
-        Start 114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult
- 73/170 Test  #99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath ...................................   Passed    0.07 sec
-        Start  89: FlowGraph.GetFlowPathForDAGReturnsEmpty
- 74/170 Test #106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability ...............................   Passed    0.07 sec
- 75/170 Test  #85: FlowGraph.RemovalDeletesEntry .....................................................   Passed    0.07 sec
-        Start  13: FlowPolicyStatic.MaskedBundleIsDown
-        Start 139: KShortestPaths.MaxCostFactorLimit
- 76/170 Test #114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult ..............................   Passed    0.07 sec
-        Start 135: KShortestPaths.FindsKPaths
- 77/170 Test  #13: FlowPolicyStatic.MaskedBundleIsDown ...............................................   Passed    0.07 sec
-        Start 149: MaskingTests.MaskedSourceInComputeMinCut
- 78/170 Test  #89: FlowGraph.GetFlowPathForDAGReturnsEmpty ...........................................   Passed    0.07 sec
- 79/170 Test #139: KShortestPaths.MaxCostFactorLimit .................................................   Passed    0.07 sec
- 80/170 Test #135: KShortestPaths.FindsKPaths ........................................................   Passed    0.07 sec
-        Start  96: MaxFlow.SinglePath_BottleneckConstraint
-        Start  27: StrictMultiDiGraph.InvalidNumNodesThrows
-        Start  63: FlowState.ApplyDeltasSubtractive
- 81/170 Test  #27: StrictMultiDiGraph.InvalidNumNodesThrows ..........................................   Passed    0.07 sec
-        Start 170: MaskingTests.AlgorithmsAPIMaxFlowWithMask
- 82/170 Test #149: MaskingTests.MaskedSourceInComputeMinCut ..........................................   Passed    0.07 sec
- 83/170 Test  #96: MaxFlow.SinglePath_BottleneckConstraint ...........................................   Passed    0.07 sec
- 84/170 Test  #63: FlowState.ApplyDeltasSubtractive ..................................................   Passed    0.07 sec
-        Start 110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly
-        Start 160: MaskingTests.KSPWithNodeMask
-        Start   6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution
- 85/170 Test #170: MaskingTests.AlgorithmsAPIMaxFlowWithMask .........................................   Passed    0.07 sec
- 86/170 Test #160: MaskingTests.KSPWithNodeMask ......................................................   Passed    0.07 sec
- 87/170 Test   #6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution .........   Passed    0.07 sec
-        Start 144: KShortestPaths.LargerOutOfOrderTopology
-        Start  23: StrictMultiDiGraph.CSROffsetsMonotonicity
-        Start   8: FlowPolicyCore.DiminishingReturnsCutoff
- 88/170 Test #110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly ..................................   Passed    0.07 sec
-        Start  97: MaxFlow.SinglePath_ShortestPathEquivalence
- 89/170 Test #144: KShortestPaths.LargerOutOfOrderTopology ...........................................   Passed    0.07 sec
- 90/170 Test   #8: FlowPolicyCore.DiminishingReturnsCutoff ...........................................   Passed    0.07 sec
-        Start 156: MaskingTests.CombinedNodeAndEdgeMasks
-        Start 169: MaskingTests.AlgorithmsAPIMaskedSource
- 91/170 Test  #23: StrictMultiDiGraph.CSROffsetsMonotonicity .........................................   Passed    0.07 sec
- 92/170 Test  #97: MaxFlow.SinglePath_ShortestPathEquivalence ........................................   Passed    0.07 sec
-        Start 117: MaxFlow.CostDistribution_AccountsForAllFlow
-        Start  86: FlowGraph.RemoveByClassFiltersCorrectly
- 93/170 Test #117: MaxFlow.CostDistribution_AccountsForAllFlow .......................................   Passed    0.07 sec
-        Start 136: KShortestPaths.KEqualsZeroReturnsEmpty
- 94/170 Test #156: MaskingTests.CombinedNodeAndEdgeMasks .............................................   Passed    0.08 sec
- 95/170 Test #169: MaskingTests.AlgorithmsAPIMaskedSource ............................................   Passed    0.08 sec
- 96/170 Test  #86: FlowGraph.RemoveByClassFiltersCorrectly ...........................................   Passed    0.08 sec
-        Start 104: MaxFlow.ECMP_TenPaths_ScalabilityValidation
-        Start 132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow
-        Start 120: MaxFlow.EdgeMask_SelectiveEdgeFiltering
- 97/170 Test #136: KShortestPaths.KEqualsZeroReturnsEmpty ............................................   Passed    0.07 sec
-        Start 124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest
- 98/170 Test #104: MaxFlow.ECMP_TenPaths_ScalabilityValidation .......................................   Passed    0.07 sec
- 99/170 Test #132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow .........................................   Passed    0.07 sec
-100/170 Test #120: MaxFlow.EdgeMask_SelectiveEdgeFiltering ...........................................   Passed    0.07 sec
-        Start  65: FlowState.ResetRestoresCapacity
-        Start  49: ShortestPaths.RejectsMaskLengthMismatch
-        Start 133: MaxFlow.CompletionPhase_RecoversCancellation
-101/170 Test  #65: FlowState.ResetRestoresCapacity ...................................................   Passed    0.07 sec
-        Start 165: MaskingTests.EmptyNodeMaskAllowsAllNodes
-102/170 Test #124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest .................................   Passed    0.07 sec
-103/170 Test  #49: ShortestPaths.RejectsMaskLengthMismatch ...........................................   Passed    0.07 sec
-        Start 111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers
-        Start 129: MaxFlow.Sensitivity_SinglePath
-104/170 Test #133: MaxFlow.CompletionPhase_RecoversCancellation ......................................   Passed    0.07 sec
-        Start 161: MaskingTests.KSPWithEdgeMask
-105/170 Test #165: MaskingTests.EmptyNodeMaskAllowsAllNodes ..........................................   Passed    0.07 sec
-        Start  32: StrictMultiDiGraph.NegativeCostThrows
-106/170 Test #111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers .........................................   Passed    0.07 sec
-107/170 Test #129: MaxFlow.Sensitivity_SinglePath ....................................................   Passed    0.07 sec
-108/170 Test #161: MaskingTests.KSPWithEdgeMask ......................................................   Passed    0.07 sec
-        Start  66: FlowState.CustomInitialResidual
-        Start  42: ShortestPaths.EarlyExitOptimization
-        Start  88: FlowGraph.GetFlowPathForLinearFlow
-109/170 Test  #66: FlowState.CustomInitialResidual ...................................................   Passed    0.07 sec
-        Start  25: StrictMultiDiGraph.MaxCapacityEdges
-110/170 Test  #32: StrictMultiDiGraph.NegativeCostThrows .............................................   Passed    0.07 sec
-111/170 Test  #42: ShortestPaths.EarlyExitOptimization ...............................................   Passed    0.07 sec
-112/170 Test  #88: FlowGraph.GetFlowPathForLinearFlow ................................................   Passed    0.07 sec
-        Start 168: MaskingTests.AllEdgesMaskedNoReachability
-        Start 142: KShortestPaths.LooplessPaths
-        Start 138: KShortestPaths.UniqueModeFiltering
-113/170 Test  #25: StrictMultiDiGraph.MaxCapacityEdges ...............................................   Passed    0.07 sec
-114/170 Test #138: KShortestPaths.UniqueModeFiltering ................................................   Passed    0.07 sec
-        Start   7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths
-        Start   3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths
-115/170 Test #168: MaskingTests.AllEdgesMaskedNoReachability .........................................   Passed    0.07 sec
-116/170 Test #142: KShortestPaths.LooplessPaths ......................................................   Passed    0.07 sec
-        Start 159: MaskingTests.ResidualAndNodeMaskCombined
-        Start 143: KShortestPaths.OutOfOrderNodePredDAGSemantics
-117/170 Test   #7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths ...........   Passed    0.07 sec
-118/170 Test #159: MaskingTests.ResidualAndNodeMaskCombined ..........................................   Passed    0.07 sec
-        Start  62: FlowState.ApplyDeltasAdditive
-        Start 131: MaxFlow.Sensitivity_PartialSaturation
-119/170 Test   #3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths ............   Passed    0.07 sec
-120/170 Test #143: KShortestPaths.OutOfOrderNodePredDAGSemantics .....................................   Passed    0.07 sec
-        Start  83: FlowGraph.EmptyLedgerInitially
-        Start  84: FlowGraph.PlacementCreatesEntry
-121/170 Test  #83: FlowGraph.EmptyLedgerInitially ....................................................   Passed    0.07 sec
-        Start  76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable
-122/170 Test  #62: FlowState.ApplyDeltasAdditive .....................................................   Passed    0.07 sec
-123/170 Test #131: MaxFlow.Sensitivity_PartialSaturation .............................................   Passed    0.07 sec
-124/170 Test  #84: FlowGraph.PlacementCreatesEntry ...................................................   Passed    0.07 sec
-        Start 153: MaskingTests.MaskedEdgeBlocksPath
-        Start 102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath
-        Start  64: FlowState.MinCutComputation
-125/170 Test  #76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable ............   Passed    0.07 sec
-        Start  69: FlowState.ApplyDeltasClampsWithinCapacityBounds
-126/170 Test #153: MaskingTests.MaskedEdgeBlocksPath .................................................   Passed    0.07 sec
-127/170 Test #102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath .................................   Passed    0.07 sec
-128/170 Test  #64: FlowState.MinCutComputation .......................................................   Passed    0.07 sec
-        Start  95: MaxFlow.SinglePath_BasicLinear
-        Start 121: MaxFlow.BatchMaxFlow_IndependentMaskApplication
-        Start 116: MaxFlow.MinCut_ValidEdgeIdentification
-129/170 Test  #95: MaxFlow.SinglePath_BasicLinear ....................................................   Passed    0.07 sec
-130/170 Test #121: MaxFlow.BatchMaxFlow_IndependentMaskApplication ...................................   Passed    0.07 sec
-        Start  34: StrictMultiDiGraph.NegativeNodeIdThrows
-        Start  87: FlowGraph.GetFlowEdgesReturnsDeltas
-131/170 Test  #69: FlowState.ApplyDeltasClampsWithinCapacityBounds ...................................   Passed    0.08 sec
-132/170 Test #116: MaxFlow.MinCut_ValidEdgeIdentification ............................................   Passed    0.07 sec
-        Start  50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic
-        Start 105: MaxFlow.AsymmetricCapacity_1to100_Proportional
-133/170 Test  #34: StrictMultiDiGraph.NegativeNodeIdThrows ...........................................   Passed    0.07 sec
-134/170 Test  #87: FlowGraph.GetFlowEdgesReturnsDeltas ...............................................   Passed    0.07 sec
-135/170 Test  #50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic ......................................   Passed    0.07 sec
-136/170 Test #105: MaxFlow.AsymmetricCapacity_1to100_Proportional ....................................   Passed    0.07 sec
-        Start 128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths
-        Start 125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest
-        Start  98: MaxFlow.DegenerateCase_SourceEqualsSink
-        Start 118: MaxFlow.OptionalOutputs_ResidualAndReachable
-137/170 Test #128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths ................................   Passed    0.08 sec
-        Start  90: FlowGraph.CoalescesDuplicateEdgeIds
-138/170 Test #125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest ................................   Passed    0.08 sec
-139/170 Test  #98: MaxFlow.DegenerateCase_SourceEqualsSink ...........................................   Passed    0.08 sec
-140/170 Test #118: MaxFlow.OptionalOutputs_ResidualAndReachable ......................................   Passed    0.08 sec
-        Start  48: ShortestPaths.LargeGraphStressTest
-        Start 163: MaskingTests.MaxFlowWithEdgeMask
-        Start 164: MaskingTests.MaxFlowAllPathsMasked
-141/170 Test  #90: FlowGraph.CoalescesDuplicateEdgeIds ...............................................   Passed    0.08 sec
-        Start  26: StrictMultiDiGraph.ZeroCostEdges
-142/170 Test #163: MaskingTests.MaxFlowWithEdgeMask ..................................................   Passed    0.08 sec
-143/170 Test #164: MaskingTests.MaxFlowAllPathsMasked ................................................   Passed    0.08 sec
-        Start  60: FlowState.EqualBalancedDistribution
-        Start 141: KShortestPaths.DisconnectedReturnsEmpty
-144/170 Test  #48: ShortestPaths.LargeGraphStressTest ................................................   Passed    0.08 sec
-        Start 154: MaskingTests.MaskedEdgeSelectsAlternativePath
-145/170 Test  #60: FlowState.EqualBalancedDistribution ...............................................   Passed    0.08 sec
-        Start 150: MaskingTests.OutOfRangeSourceInComputeMinCut
-146/170 Test  #26: StrictMultiDiGraph.ZeroCostEdges ..................................................   Passed    0.08 sec
-147/170 Test #141: KShortestPaths.DisconnectedReturnsEmpty ...........................................   Passed    0.08 sec
-148/170 Test #154: MaskingTests.MaskedEdgeSelectsAlternativePath .....................................   Passed    0.08 sec
-        Start 166: MaskingTests.EmptyEdgeMaskAllowsAllEdges
-        Start  70: FlowState.EqualBalancedReconvergentDAGPlacesAll
-        Start 162: MaskingTests.MaxFlowWithNodeMask
-149/170 Test #150: MaskingTests.OutOfRangeSourceInComputeMinCut ......................................   Passed    0.07 sec
-150/170 Test #166: MaskingTests.EmptyEdgeMaskAllowsAllEdges ..........................................   Passed    0.07 sec
-        Start  61: FlowState.ZeroCapacityHandling
-        Start  59: FlowState.ProportionalDistribution
-151/170 Test  #70: FlowState.EqualBalancedReconvergentDAGPlacesAll ...................................   Passed    0.07 sec
-152/170 Test #162: MaskingTests.MaxFlowWithNodeMask ..................................................   Passed    0.07 sec
-        Start 155: MaskingTests.MultipleEdgesMasked
-        Start  57: FlowState.InitialResidualEqualsCapacity
-153/170 Test  #59: FlowState.ProportionalDistribution ................................................   Passed    0.07 sec
-        Start 127: MaxFlow.SimpleParallelPaths_Topology
-154/170 Test  #61: FlowState.ZeroCapacityHandling ....................................................   Passed    0.07 sec
-155/170 Test #155: MaskingTests.MultipleEdgesMasked ..................................................   Passed    0.07 sec
-156/170 Test  #57: FlowState.InitialResidualEqualsCapacity ...........................................   Passed    0.07 sec
-        Start  58: FlowState.PlacementReducesResidual
-        Start  51: ShortestPathsTo.DistancesMatchForwardDistancesToDst
-        Start  52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource
-157/170 Test  #58: FlowState.PlacementReducesResidual ................................................   Passed    0.07 sec
-        Start  53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag
-158/170 Test #127: MaxFlow.SimpleParallelPaths_Topology ..............................................   Passed    0.07 sec
-159/170 Test  #51: ShortestPathsTo.DistancesMatchForwardDistancesToDst ...............................   Passed    0.07 sec
-160/170 Test  #52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource ..................   Passed    0.07 sec
-        Start  54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads
-        Start  55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected
-        Start  56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode
-161/170 Test  #53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag .............................   Passed    0.07 sec
-        Start  77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission
-162/170 Test  #54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads ..............................   Passed    0.07 sec
-163/170 Test  #55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected ..................................   Passed    0.07 sec
-164/170 Test  #56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode ............................   Passed    0.07 sec
-        Start  78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf
-        Start  79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops
-        Start  80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream
-165/170 Test  #79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops ..............................   Passed    0.07 sec
-        Start  81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops
-166/170 Test  #77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission ............................   Passed    0.07 sec
-167/170 Test  #78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf .....................   Passed    0.07 sec
-168/170 Test  #80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream ..........................   Passed    0.07 sec
-        Start  82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger
-169/170 Test  #81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops .....................   Passed    0.07 sec
-170/170 Test  #82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger .......................   Passed    0.07 sec
-
-100% tests passed out of 170
-
-Total Test time (real) =   3.00 sec
diff --git a/dev/research/metal_pathfinding/results/stress-sanitized.csv b/dev/research/metal_pathfinding/results/stress-sanitized.csv
deleted file mode 100644
index c9d9fb1..0000000
--- a/dev/research/metal_pathfinding/results/stress-sanitized.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-grid,1024,3968,64,metal_pull,15.530167,4.484500,9.108750,0.188375,64,20,pass,0,16.700250;15.530167;15.417208;14.727875;14.057000;15.392333;16.472042;15.792750;15.891250;11.988333;15.802375;15.560042;16.590166;15.518750;11.375958;16.363709;17.054667;15.159750;15.207500;15.467084
-grid,1024,3968,64,metal_group,11.060208,3.933417,4.879000,0.188375,63,20,pass,0,11.942000;7.964375;11.096834;10.917458;11.153459;8.798208;11.295417;11.240333;10.839417;11.959583;11.143958;11.022000;10.818417;11.017167;8.111667;11.060208;11.184917;10.825750;11.167166;10.949792
-grid,1024,3968,64,metal_shared,10.228625,3.022375,3.916833,0.188375,63,20,pass,0,9.921208;10.004083;9.822125;9.661958;10.228625;11.134167;10.203042;10.252459;10.255542;10.094833;10.453375;10.557041;10.717250;9.984875;10.313458;10.648125;10.205625;10.073000;10.538500;10.068917
-random_masked_int64_reverse,1024,8192,64,metal_pull,13.439750,0.905375,1.931417,0.195667,8,20,pass,6,13.597583;13.481542;13.092833;13.398708;13.384584;13.448375;14.449125;15.040625;13.340542;13.603958;13.039250;13.253625;13.401208;13.473250;13.170750;13.203708;13.391417;13.586667;15.356334;13.439750
-random_masked_int64_reverse,1024,8192,64,metal_group,13.348292,0.879917,1.800458,0.195667,8,20,pass,6,13.703917;13.791375;13.181167;13.526292;13.570083;13.179875;13.348292;13.530625;13.278459;13.327250;13.056458;13.275542;14.277209;13.365333;13.212542;13.166417;12.992666;12.752334;13.547125;14.419541
-random_masked_int64_reverse,1024,8192,64,metal_shared,13.334542,0.695792,1.711416,0.195667,8,20,pass,6,13.044125;13.625292;14.034959;13.278042;14.283083;14.222250;13.571042;13.812625;13.348125;14.462250;13.157583;12.979958;13.194167;13.043500;13.855750;13.129500;13.334542;12.628834;12.541375;13.082375
diff --git a/dev/research/metal_pathfinding/results/stress-stderr.txt b/dev/research/metal_pathfinding/results/stress-stderr.txt
deleted file mode 100644
index 8052255..0000000
--- a/dev/research/metal_pathfinding/results/stress-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=98.9218 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/stress-validation.txt b/dev/research/metal_pathfinding/results/stress-validation.txt
deleted file mode 100644
index c87a5f1..0000000
--- a/dev/research/metal_pathfinding/results/stress-validation.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-2026-09-27 00:02:38.195 experiment-sanitize[57642:38285138] Metal API Validation Enabled
-2026-09-27 00:02:38.195 experiment-sanitize[57642:38285138] Metal GPU Validation Enabled
-device=Apple M4 Max setup_ms=223.541 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/stress.csv b/dev/research/metal_pathfinding/results/stress.csv
deleted file mode 100644
index 59e8274..0000000
--- a/dev/research/metal_pathfinding/results/stress.csv
+++ /dev/null
@@ -1,7 +0,0 @@
-case,n,e,queries,method,wall_ms,gpu_ms,distance_wall_ms,upload_ms,rounds,samples,correct,exact_order_queries,wall_samples_ms
-grid,1024,3968,64,metal_pull,2.893875,0.425792,2.019709,0.078417,64,100,pass,0,4.494667;4.062667;4.002000;3.562250;3.658292;3.957500;3.817125;3.879208;4.127208;3.733583;3.796667;3.714583;3.924333;4.171167;3.697167;4.234458;3.981083;4.905542;3.749833;3.651375;3.933417;3.802250;4.545875;3.511667;3.961000;3.879709;3.730875;3.300042;3.143708;3.516167;3.528167;3.266792;3.355542;2.673291;3.135584;3.154791;3.013542;2.940125;2.839459;2.471667;3.009083;2.916875;2.351375;3.027959;2.859958;2.249584;2.713750;2.853708;2.942916;2.976084;2.883708;2.293750;2.909208;2.350291;2.887291;2.889542;2.879709;2.956083;2.806000;2.873542;2.270250;2.895084;2.823958;2.835458;2.635125;2.893375;2.209375;2.224666;3.001459;2.193958;2.865291;2.849334;2.713083;2.704917;2.349458;2.787459;2.347500;2.919917;2.832500;2.252667;2.293708;2.299542;2.930000;2.809125;2.607875;2.154125;2.661750;2.835375;2.214000;2.893875;2.839666;2.221583;2.192500;2.323375;2.456792;2.335750;2.697167;2.229375;2.864916;3.039958
-grid,1024,3968,64,metal_group,2.067916,0.943375,1.156792,0.078417,63,100,pass,0,1.222208;1.703584;1.525334;1.843750;1.220291;1.866208;1.850000;1.772125;1.237916;1.877125;1.660875;1.669625;1.827416;1.852958;1.781875;1.837208;1.869250;1.172917;1.594416;2.365458;2.554708;2.298959;2.377958;2.293208;1.330625;1.203458;1.702000;1.770416;1.217500;1.702458;1.827042;2.313958;1.974291;2.381541;2.276708;2.289041;1.233959;1.722250;1.691166;1.880875;1.246125;1.601250;1.355666;2.275250;2.019166;2.305542;2.237250;2.303208;2.269292;2.261667;2.271166;2.288416;2.285459;2.386250;2.067916;2.284542;2.339292;2.054292;2.208500;2.065125;2.321167;2.278708;2.346000;2.342958;2.289416;2.306541;2.283458;2.056000;2.273750;1.973334;2.322375;2.281417;2.016667;2.242208;2.006250;2.290208;2.322584;2.174125;2.274917;2.294291;2.330667;2.292000;2.628000;2.086458;2.317583;2.328709;1.567959;1.733708;1.753625;1.792584;1.828083;1.726375;1.306916;2.292541;2.073167;2.431583;2.308167;2.337917;1.889792;1.825292
-grid,1024,3968,64,metal_shared,1.748708,0.194750,0.873834,0.078417,63,100,pass,0,1.833000;1.229542;1.731500;1.226667;1.749833;1.360959;1.781084;1.281334;1.243667;2.318000;1.971333;2.212125;2.285458;2.207833;1.792750;1.802042;1.796000;1.777417;1.533959;1.195459;1.818208;1.806666;1.810291;1.678708;1.785708;1.711917;1.671625;1.780625;1.780208;1.677208;1.704709;1.198375;1.743000;1.746542;1.808875;1.270416;2.439500;2.051083;2.253208;2.199917;2.006209;2.074958;2.267041;2.015084;2.284958;2.247500;2.188542;1.660917;1.655208;1.228000;1.673292;1.323083;1.648625;1.705459;1.497542;1.635709;1.679042;1.681250;1.265291;1.663875;2.260708;2.035417;1.929333;2.587208;1.982041;1.679209;1.204375;1.643542;1.670334;1.625000;1.618125;1.735833;1.605792;1.632875;1.602917;2.221916;2.270500;1.966791;2.231417;2.152958;1.751167;1.204500;1.677833;1.891417;1.779500;1.690167;1.708208;1.707584;1.644125;1.264458;1.793792;1.272667;1.186375;2.311500;2.077917;2.057791;2.246125;2.278958;1.748708;1.746708
-random_masked_int64_reverse,1024,8192,64,metal_pull,4.320500,0.411000,0.942125,0.098667,8,100,pass,6,3.915584;3.984333;4.290417;4.201541;4.721584;4.304333;3.936375;3.948584;4.342250;4.290167;4.296041;4.371125;4.213667;4.409000;4.367542;4.160125;4.006542;4.411709;4.427792;4.432417;4.385458;4.346709;4.013458;4.421708;4.260875;4.200708;4.396167;4.359709;4.305542;4.258334;4.253750;4.311791;3.961292;4.247125;3.931042;3.962000;4.304584;3.920083;4.041000;4.367583;4.228875;4.334459;4.284000;4.374584;4.071542;4.312375;4.656291;4.328000;3.946334;4.320500;4.079333;4.190416;4.930666;3.979875;4.378458;4.446834;4.385833;4.225792;4.216667;4.382917;4.363083;4.369875;4.332917;4.398625;3.892083;4.374167;4.355875;3.985459;4.380292;4.356917;4.203583;4.345500;4.419958;3.965208;4.269792;4.254334;4.234917;4.338792;3.941584;4.135791;4.342584;4.314334;4.395084;4.393708;4.362541;4.325458;4.271375;4.331833;4.662667;4.429875;4.387000;4.061250;4.395959;4.346167;4.068583;4.460083;4.419750;4.284042;4.372291;4.326500
-random_masked_int64_reverse,1024,8192,64,metal_group,4.130833,0.240250,0.757125,0.098667,8,100,pass,6,4.159792;4.163750;4.188959;4.129250;3.907334;3.927416;4.088083;3.847333;4.244208;4.168333;4.101375;4.115000;4.250917;4.249542;4.077417;4.133125;3.820667;4.157292;3.801416;4.237917;4.132083;3.737250;4.185458;4.106667;4.181875;4.294000;4.160042;4.162167;4.141166;4.067666;4.287959;4.048417;4.080208;4.074666;4.122000;3.814500;4.130166;3.799666;3.773208;4.202458;4.118959;4.077041;4.130833;3.951708;4.453959;3.985458;3.756459;4.193500;4.245542;4.392292;4.224667;4.173541;4.192459;3.817833;3.784459;4.228708;4.218500;3.784750;4.124833;4.093875;4.086666;4.084334;4.235750;3.813291;4.238541;4.105792;3.827084;4.104416;4.121208;4.295375;4.366209;4.095417;4.200125;3.931375;4.102583;4.208416;4.233666;4.141541;4.237000;4.259541;4.127334;4.149750;3.713833;3.788292;4.195959;4.113458;4.112209;3.820500;3.793334;4.329583;4.180000;4.204083;4.143041;4.254959;4.079416;4.259917;4.167875;4.093000;4.297709;4.166625
-random_masked_int64_reverse,1024,8192,64,metal_shared,4.154125,0.221417,0.721583,0.098667,8,100,pass,6,3.756917;3.782208;4.299417;4.174375;4.168166;4.101584;4.228833;3.782625;4.102625;4.134833;4.242875;4.193500;4.115209;4.191000;4.190875;4.146167;4.107166;4.026375;4.243250;4.117167;4.027459;3.831667;4.176167;4.154125;4.148583;4.222792;4.025041;4.497167;4.314084;4.296291;3.930791;4.316917;4.131417;4.165375;3.806875;3.835833;4.255666;4.048333;4.141417;4.261666;3.805750;3.877667;4.506167;4.162500;4.181750;4.146666;3.890250;3.849875;4.116166;4.118083;4.208167;3.950000;4.283625;4.089875;4.224333;4.217750;4.234625;4.166709;4.066666;4.212584;4.336375;4.250292;4.180875;4.222458;4.219125;4.060125;4.200833;3.887084;4.454250;4.179708;4.046416;4.045667;4.104625;3.936666;4.128667;4.157583;4.193084;3.881291;4.401875;3.909542;4.126500;4.319250;4.151291;4.130417;4.142500;4.205666;4.290834;4.397625;4.086833;4.155250;4.330625;4.169792;4.146333;3.774916;4.187500;3.773834;3.897834;4.243042;3.813334;4.321792
diff --git a/dev/research/metal_pathfinding/results/validation.txt b/dev/research/metal_pathfinding/results/validation.txt
deleted file mode 100644
index a0d4adc..0000000
--- a/dev/research/metal_pathfinding/results/validation.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-2026-09-27 00:02:40.947 experiment-sanitize[57855:38285628] Metal API Validation Enabled
-2026-09-27 00:02:40.947 experiment-sanitize[57855:38285628] Metal GPU Validation Enabled
-device=Apple M4 Max setup_ms=28.2634 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/witnesses-sanitized.txt b/dev/research/metal_pathfinding/results/witnesses-sanitized.txt
deleted file mode 100644
index 6159e5d..0000000
--- a/dev/research/metal_pathfinding/results/witnesses-sanitized.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-PASS diamond: all ECMP alternatives, parallel edges, positive self-loop excluded, isolated node
-PASS reverse diamond: hand-derived distances and forward DAG
-PASS masked source and transit node
-PASS double capacity threshold: below rejected, exact threshold admitted
-PASS edge mask and residual gate combined
-PASS exact int64 costs above 2^53 and one-unit path difference
-PASS expected gap: zero-cost distances agree, tight-edge GPU DAG has 1->2->1 cycle; CPU DAG has 2 edges
-PASS precision gaps: float32 collapses 16777216/16777217 and admits nextafter(kMinCap,0)
-PASS capacity tie gap: CPU chooses edge 1 at 1+1e-8; float32 collapses both capacities
diff --git a/dev/research/metal_pathfinding/results/witnesses-stderr.txt b/dev/research/metal_pathfinding/results/witnesses-stderr.txt
deleted file mode 100644
index 6958d46..0000000
--- a/dev/research/metal_pathfinding/results/witnesses-stderr.txt
+++ /dev/null
@@ -1 +0,0 @@
-device=Apple M4 Max setup_ms=25.3313 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/witnesses-validation.txt b/dev/research/metal_pathfinding/results/witnesses-validation.txt
deleted file mode 100644
index eb1391c..0000000
--- a/dev/research/metal_pathfinding/results/witnesses-validation.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-2026-09-27 00:02:41.134 experiment-sanitize[57187:38285642] Metal API Validation Enabled
-2026-09-27 00:02:41.134 experiment-sanitize[57187:38285642] Metal GPU Validation Enabled
-device=Apple M4 Max setup_ms=33.3338 execution_width=32
diff --git a/dev/research/metal_pathfinding/results/witnesses.txt b/dev/research/metal_pathfinding/results/witnesses.txt
deleted file mode 100644
index 6159e5d..0000000
--- a/dev/research/metal_pathfinding/results/witnesses.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-PASS diamond: all ECMP alternatives, parallel edges, positive self-loop excluded, isolated node
-PASS reverse diamond: hand-derived distances and forward DAG
-PASS masked source and transit node
-PASS double capacity threshold: below rejected, exact threshold admitted
-PASS edge mask and residual gate combined
-PASS exact int64 costs above 2^53 and one-unit path difference
-PASS expected gap: zero-cost distances agree, tight-edge GPU DAG has 1->2->1 cycle; CPU DAG has 2 edges
-PASS precision gaps: float32 collapses 16777216/16777217 and admits nextafter(kMinCap,0)
-PASS capacity tie gap: CPU chooses edge 1 at 1+1e-8; float32 collapses both capacities
diff --git a/dev/research/metal_pathfinding/results/workspace-check.txt b/dev/research/metal_pathfinding/results/workspace-check.txt
deleted file mode 100644
index 7f3aec6..0000000
--- a/dev/research/metal_pathfinding/results/workspace-check.txt
+++ /dev/null
@@ -1,411 +0,0 @@
-📦 Installing package (editable, default optimizations)
-Obtaining file:///Users/networmix/ws/NetGraph-Core
-  Installing build dependencies: started
-  Installing build dependencies: finished with status 'done'
-  Checking if build backend supports build_editable: started
-  Checking if build backend supports build_editable: finished with status 'done'
-  Getting requirements to build editable: started
-  Getting requirements to build editable: finished with status 'done'
-  Installing backend dependencies: started
-  Installing backend dependencies: finished with status 'done'
-  Preparing editable metadata (pyproject.toml): started
-  Preparing editable metadata (pyproject.toml): finished with status 'done'
-Requirement already satisfied: numpy>=1.23.2 in ./venv/lib/python3.14/site-packages (from netgraph-core==0.10.0) (2.5.2)
-Building wheels for collected packages: netgraph-core
-  Building editable for netgraph-core (pyproject.toml): started
-  Building editable for netgraph-core (pyproject.toml): finished with status 'done'
-  Created wheel for netgraph-core: filename=netgraph_core-0.10.0-cp314-cp314-macosx_15_0_arm64.whl size=314893 sha256=4dbd81d69e154acb7b436937ec9e484f0a6e31c56787e8ac028619002e4fa1f9
-  Stored in directory: /private/var/folders/8q/438f_q5s0ys8nlnvjqkf953m0000gn/T/pip-ephem-wheel-cache-lpf_6ry7/wheels/18/8c/1a/f701a43f4b69f7c794e11f1f5dd0c17e819d2c98bfd1285718
-Successfully built netgraph-core
-Installing collected packages: netgraph-core
-  Attempting uninstall: netgraph-core
-    Found existing installation: netgraph-core 0.10.0
-    Uninstalling netgraph-core-0.10.0:
-      Successfully uninstalled netgraph-core-0.10.0
-Successfully installed netgraph-core-0.10.0
-44 files already formatted
-All checks passed!
-0 errors, 0 warnings, 0 informations 
-WARNING: there is a new pyright version available (v1.1.401 -> v1.1.414).
-Please install the new version or set PYRIGHT_PYTHON_FORCE_VERSION to `latest`
-
--- pybind11 not found via config; using FetchContent
--- pybind11 v3.0.0 
--- LTO not supported: CMake doesn't support IPO for current C compiler
--- Configuring done (0.6s)
--- Generating done (0.0s)
--- Build files have been written to: /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-[1/21] Building CXX object CMakeFiles/netgraph_core.dir/src/strict_multidigraph.cpp.o
-[2/21] Building CXX object CMakeFiles/netgraph_core.dir/src/k_shortest_paths.cpp.o
-[3/21] Building CXX object CMakeFiles/netgraph_core.dir/src/shortest_paths.cpp.o
-[4/21] Building CXX object CMakeFiles/netgraph_core.dir/src/max_flow.cpp.o
-[5/21] Building CXX object CMakeFiles/netgraph_core.dir/src/cpu_backend.cpp.o
-[6/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_state.cpp.o
-[7/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_graph.cpp.o
-[8/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/smoke_test.cpp.o
-[9/21] Building CXX object CMakeFiles/netgraph_core.dir/src/flow_policy.cpp.o
-[10/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/strict_multidigraph_tests.cpp.o
-[11/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_policy_tests.cpp.o
-[12/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/shortest_paths_tests.cpp.o
-[13/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_state_tests.cpp.o
-[14/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/flow_graph_tests.cpp.o
-[15/21] Linking CXX static library libnetgraph_core.a
-[16/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/max_flow_tests.cpp.o
-[17/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/k_shortest_paths_tests.cpp.o
-[18/21] Building CXX object CMakeFiles/netgraph_core_tests.dir/tests/cpp/masking_tests.cpp.o
-[19/21] Linking CXX executable netgraph_core_tests
-[20/21] Building CXX object CMakeFiles/_netgraph_core.dir/bindings/python/module.cpp.o
-[21/21] Linking CXX shared module _netgraph_core.cpython-314-darwin.so
-Test project /Users/networmix/ws/NetGraph-Core/build/cpp-tests
-        Start 141: KShortestPaths.DisconnectedReturnsEmpty
-        Start 132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow
-        Start  34: StrictMultiDiGraph.NegativeNodeIdThrows
-        Start  11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier
-  1/170 Test #141: KShortestPaths.DisconnectedReturnsEmpty ...........................................   Passed    0.00 sec
-        Start 152: MaskingTests.MaskedIntermediateNode
-  2/170 Test #132: MaxFlow.Sensitivity_ShortestPathVsMaxFlow .........................................   Passed    0.00 sec
-        Start   9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths
-  3/170 Test  #34: StrictMultiDiGraph.NegativeNodeIdThrows ...........................................   Passed    0.00 sec
-  4/170 Test  #11: FlowPolicyCore.EqualBalanced_ShortestPath_IgnoresHigherCostTier ...................   Passed    0.00 sec
-        Start 105: MaxFlow.AsymmetricCapacity_1to100_Proportional
-        Start  10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck
-  5/170 Test #152: MaskingTests.MaskedIntermediateNode ...............................................   Passed    0.00 sec
-        Start 154: MaskingTests.MaskedEdgeSelectsAlternativePath
-  6/170 Test   #9: FlowPolicyCore.EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths ........   Passed    0.00 sec
-        Start 156: MaskingTests.CombinedNodeAndEdgeMasks
-  7/170 Test #105: MaxFlow.AsymmetricCapacity_1to100_Proportional ....................................   Passed    0.00 sec
-        Start 144: KShortestPaths.LargerOutOfOrderTopology
-  8/170 Test  #10: FlowPolicyCore.EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck ......   Passed    0.00 sec
-        Start  43: ShortestPaths.PredDAGIntegrity
-  9/170 Test #154: MaskingTests.MaskedEdgeSelectsAlternativePath .....................................   Passed    0.00 sec
-        Start 148: MaskingTests.MaskedSourceInMaxFlow
- 10/170 Test #156: MaskingTests.CombinedNodeAndEdgeMasks .............................................   Passed    0.00 sec
-        Start 118: MaxFlow.OptionalOutputs_ResidualAndReachable
- 11/170 Test #144: KShortestPaths.LargerOutOfOrderTopology ...........................................   Passed    0.00 sec
-        Start  33: StrictMultiDiGraph.SelfLoopAllowed
- 12/170 Test  #43: ShortestPaths.PredDAGIntegrity ....................................................   Passed    0.00 sec
-        Start   8: FlowPolicyCore.DiminishingReturnsCutoff
- 13/170 Test #148: MaskingTests.MaskedSourceInMaxFlow ................................................   Passed    0.00 sec
-        Start 138: KShortestPaths.UniqueModeFiltering
- 14/170 Test #118: MaxFlow.OptionalOutputs_ResidualAndReachable ......................................   Passed    0.00 sec
-        Start  92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual
- 15/170 Test  #33: StrictMultiDiGraph.SelfLoopAllowed ................................................   Passed    0.00 sec
-        Start  47: ShortestPaths.ResolveToPathsWithMaxPathsLimit
- 16/170 Test   #8: FlowPolicyCore.DiminishingReturnsCutoff ...........................................   Passed    0.00 sec
-        Start  83: FlowGraph.EmptyLedgerInitially
- 17/170 Test #138: KShortestPaths.UniqueModeFiltering ................................................   Passed    0.00 sec
-        Start  67: FlowState.InvalidResidualInitThrows
- 18/170 Test  #47: ShortestPaths.ResolveToPathsWithMaxPathsLimit .....................................   Passed    0.00 sec
-        Start  17: StrictMultiDiGraph.EmptyGraph
- 19/170 Test  #92: FlowGraph.LedgerMicroFlows_RemovalRestoresResidual ................................   Passed    0.00 sec
-        Start 106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability
- 20/170 Test  #83: FlowGraph.EmptyLedgerInitially ....................................................   Passed    0.00 sec
-        Start   1: GraphSmoke.ConstructAndRunSPF
- 21/170 Test  #67: FlowState.InvalidResidualInitThrows ...............................................   Passed    0.00 sec
-        Start  41: ShortestPaths.EdgeMaskFiltering
- 22/170 Test  #17: StrictMultiDiGraph.EmptyGraph .....................................................   Passed    0.00 sec
-        Start  89: FlowGraph.GetFlowPathForDAGReturnsEmpty
- 23/170 Test #106: MaxFlow.AsymmetricCapacity_1to1M_NumericalStability ...............................   Passed    0.00 sec
-        Start 104: MaxFlow.ECMP_TenPaths_ScalabilityValidation
- 24/170 Test   #1: GraphSmoke.ConstructAndRunSPF .....................................................   Passed    0.00 sec
-        Start  61: FlowState.ZeroCapacityHandling
- 25/170 Test  #41: ShortestPaths.EdgeMaskFiltering ...................................................   Passed    0.00 sec
-        Start  22: StrictMultiDiGraph.ExternalEdgeIdsPreserved
- 26/170 Test  #89: FlowGraph.GetFlowPathForDAGReturnsEmpty ...........................................   Passed    0.00 sec
-        Start 149: MaskingTests.MaskedSourceInComputeMinCut
- 27/170 Test #104: MaxFlow.ECMP_TenPaths_ScalabilityValidation .......................................   Passed    0.00 sec
-        Start 103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation
- 28/170 Test  #61: FlowState.ZeroCapacityHandling ....................................................   Passed    0.00 sec
-        Start 155: MaskingTests.MultipleEdgesMasked
- 29/170 Test  #22: StrictMultiDiGraph.ExternalEdgeIdsPreserved .......................................   Passed    0.00 sec
-        Start 109: MaxFlow.ZeroCapacityPath_CorrectFiltering
- 30/170 Test #149: MaskingTests.MaskedSourceInComputeMinCut ..........................................   Passed    0.00 sec
-        Start 126: MaxFlow.Triangle_Topology_Combine_Mode
- 31/170 Test #103: MaxFlow.ECMP_FourPaths_ClosFabric_Simulation ......................................   Passed    0.00 sec
-        Start 107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced
- 32/170 Test #155: MaskingTests.MultipleEdgesMasked ..................................................   Passed    0.00 sec
-        Start 122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths
- 33/170 Test #109: MaxFlow.ZeroCapacityPath_CorrectFiltering .........................................   Passed    0.00 sec
-        Start  42: ShortestPaths.EarlyExitOptimization
- 34/170 Test #126: MaxFlow.Triangle_Topology_Combine_Mode ............................................   Passed    0.00 sec
-        Start  64: FlowState.MinCutComputation
- 35/170 Test #107: MaxFlow.AsymmetricCapacity_1to100_EqualBalanced ...................................   Passed    0.00 sec
-        Start  75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero
- 36/170 Test #122: MaxFlow.GridGraph_3x3_MultipleEqualCostPaths ......................................   Passed    0.00 sec
-        Start  29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows
- 37/170 Test  #42: ShortestPaths.EarlyExitOptimization ...............................................   Passed    0.00 sec
-        Start  32: StrictMultiDiGraph.NegativeCostThrows
- 38/170 Test  #64: FlowState.MinCutComputation .......................................................   Passed    0.00 sec
-        Start 135: KShortestPaths.FindsKPaths
- 39/170 Test  #75: FlowState.Proportional_ZeroCapacityOnShortestPath_ReturnsZero .....................   Passed    0.00 sec
-        Start  99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath
- 40/170 Test  #29: StrictMultiDiGraph.ExtEdgeIdsWrongLengthThrows ....................................   Passed    0.00 sec
-        Start  21: StrictMultiDiGraph.EdgeSortingByCost
- 41/170 Test  #32: StrictMultiDiGraph.NegativeCostThrows .............................................   Passed    0.00 sec
-        Start 143: KShortestPaths.OutOfOrderNodePredDAGSemantics
- 42/170 Test #135: KShortestPaths.FindsKPaths ........................................................   Passed    0.00 sec
-        Start  37: ShortestPaths.DisconnectedComponents
- 43/170 Test  #99: MaxFlow.ECMP_TwoPaths_Proportional_ShortestPath ...................................   Passed    0.00 sec
-        Start   7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths
- 44/170 Test  #21: StrictMultiDiGraph.EdgeSortingByCost ..............................................   Passed    0.00 sec
-        Start  69: FlowState.ApplyDeltasClampsWithinCapacityBounds
- 45/170 Test #143: KShortestPaths.OutOfOrderNodePredDAGSemantics .....................................   Passed    0.00 sec
-        Start 134: MaxFlow.CompletionPhase_RespectsNodeMask
- 46/170 Test  #37: ShortestPaths.DisconnectedComponents ..............................................   Passed    0.00 sec
-        Start  68: FlowState.ResetWithInvalidResidualThrows
- 47/170 Test   #7: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths ...........   Passed    0.00 sec
-        Start 112: MaxFlow.EqualCost_ShortestVsFull_Equivalent
- 48/170 Test  #69: FlowState.ApplyDeltasClampsWithinCapacityBounds ...................................   Passed    0.00 sec
-        Start 157: MaskingTests.NodeMaskOverridesEdgeMask
- 49/170 Test #134: MaxFlow.CompletionPhase_RespectsNodeMask ..........................................   Passed    0.00 sec
-        Start  46: ShortestPaths.ResolveToPathsSplittingParallelEdges
- 50/170 Test  #68: FlowState.ResetWithInvalidResidualThrows ..........................................   Passed    0.00 sec
-        Start  35: StrictMultiDiGraph.MultipleCostTiers
- 51/170 Test #112: MaxFlow.EqualCost_ShortestVsFull_Equivalent .......................................   Passed    0.00 sec
-        Start 133: MaxFlow.CompletionPhase_RecoversCancellation
- 52/170 Test #157: MaskingTests.NodeMaskOverridesEdgeMask ............................................   Passed    0.00 sec
-        Start 153: MaskingTests.MaskedEdgeBlocksPath
- 53/170 Test  #46: ShortestPaths.ResolveToPathsSplittingParallelEdges ................................   Passed    0.00 sec
-        Start 114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult
- 54/170 Test  #35: StrictMultiDiGraph.MultipleCostTiers ..............................................   Passed    0.00 sec
-        Start  27: StrictMultiDiGraph.InvalidNumNodesThrows
- 55/170 Test #133: MaxFlow.CompletionPhase_RecoversCancellation ......................................   Passed    0.00 sec
-        Start  91: FlowGraph.LedgerHistory_RemovalRestoresResidual
- 56/170 Test #153: MaskingTests.MaskedEdgeBlocksPath .................................................   Passed    0.00 sec
-        Start  20: StrictMultiDiGraph.ParallelEdges
- 57/170 Test #114: MaxFlow.PlacementModes_EqualCapacity_IdenticalResult ..............................   Passed    0.00 sec
-        Start  71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization
- 58/170 Test  #27: StrictMultiDiGraph.InvalidNumNodesThrows ..........................................   Passed    0.00 sec
-        Start  63: FlowState.ApplyDeltasSubtractive
- 59/170 Test  #91: FlowGraph.LedgerHistory_RemovalRestoresResidual ...................................   Passed    0.00 sec
-        Start  31: StrictMultiDiGraph.NegativeCapacityThrows
- 60/170 Test  #20: StrictMultiDiGraph.ParallelEdges ..................................................   Passed    0.00 sec
-        Start   2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath
- 61/170 Test  #71: FlowState.EqualBalanced_ECMP3_FirstHopEqualization ................................   Passed    0.00 sec
-        Start 100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow
- 62/170 Test  #63: FlowState.ApplyDeltasSubtractive ..................................................   Passed    0.00 sec
-        Start   5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity
- 63/170 Test  #31: StrictMultiDiGraph.NegativeCapacityThrows .........................................   Passed    0.00 sec
-        Start 150: MaskingTests.OutOfRangeSourceInComputeMinCut
- 64/170 Test   #2: FlowPolicyCore.Proportional_SingleDemand_UsesShortestPath .........................   Passed    0.00 sec
-        Start  76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable
- 65/170 Test #100: MaxFlow.ECMP_TwoPaths_Proportional_FullMaxFlow ....................................   Passed    0.00 sec
-        Start 121: MaxFlow.BatchMaxFlow_IndependentMaskApplication
- 66/170 Test   #5: FlowPolicyCore.Proportional_SingleDemand_PartialPlacement_InsufficientCapacity ....   Passed    0.00 sec
-        Start 117: MaxFlow.CostDistribution_AccountsForAllFlow
- 67/170 Test #150: MaskingTests.OutOfRangeSourceInComputeMinCut ......................................   Passed    0.00 sec
-        Start 113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly
- 68/170 Test  #76: FlowState.RepeatedPlacementAfterResetAndIndependentInstancesStayStable ............   Passed    0.00 sec
-        Start  23: StrictMultiDiGraph.CSROffsetsMonotonicity
- 69/170 Test #121: MaxFlow.BatchMaxFlow_IndependentMaskApplication ...................................   Passed    0.00 sec
-        Start  48: ShortestPaths.LargeGraphStressTest
- 70/170 Test #117: MaxFlow.CostDistribution_AccountsForAllFlow .......................................   Passed    0.00 sec
-        Start  59: FlowState.ProportionalDistribution
- 71/170 Test #113: MaxFlow.ThreeCostTiers_ShortestPath_LowestTierOnly ................................   Passed    0.00 sec
-        Start   6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution
- 72/170 Test  #23: StrictMultiDiGraph.CSROffsetsMonotonicity .........................................   Passed    0.00 sec
-        Start  58: FlowState.PlacementReducesResidual
- 73/170 Test  #48: ShortestPaths.LargeGraphStressTest ................................................   Passed    0.00 sec
-        Start   4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath
- 74/170 Test  #59: FlowState.ProportionalDistribution ................................................   Passed    0.00 sec
-        Start 130: MaxFlow.Sensitivity_TwoParallelPaths
- 75/170 Test   #6: FlowPolicyCore.EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution .........   Passed    0.00 sec
-        Start  44: ShortestPaths.TieBreakingDeterminism
- 76/170 Test  #58: FlowState.PlacementReducesResidual ................................................   Passed    0.00 sec
-        Start 140: KShortestPaths.PathsSortedByCost
- 77/170 Test   #4: FlowPolicyCore.Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath .............   Passed    0.00 sec
-        Start 158: MaskingTests.MaskWithResidualCapacity
- 78/170 Test #130: MaxFlow.Sensitivity_TwoParallelPaths ..............................................   Passed    0.00 sec
-        Start 161: MaskingTests.KSPWithEdgeMask
- 79/170 Test  #44: ShortestPaths.TieBreakingDeterminism ..............................................   Passed    0.00 sec
-        Start  18: StrictMultiDiGraph.SingleNode
- 80/170 Test #140: KShortestPaths.PathsSortedByCost ..................................................   Passed    0.00 sec
-        Start 127: MaxFlow.SimpleParallelPaths_Topology
- 81/170 Test #158: MaskingTests.MaskWithResidualCapacity .............................................   Passed    0.00 sec
-        Start  39: ShortestPaths.ResidualAwareFiltering
- 82/170 Test #161: MaskingTests.KSPWithEdgeMask ......................................................   Passed    0.00 sec
-        Start 162: MaskingTests.MaxFlowWithNodeMask
- 83/170 Test  #18: StrictMultiDiGraph.SingleNode .....................................................   Passed    0.00 sec
-        Start  49: ShortestPaths.RejectsMaskLengthMismatch
- 84/170 Test #127: MaxFlow.SimpleParallelPaths_Topology ..............................................   Passed    0.00 sec
-        Start 137: KShortestPaths.NodeMaskBlocksPaths
- 85/170 Test  #39: ShortestPaths.ResidualAwareFiltering ..............................................   Passed    0.00 sec
-        Start   3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths
- 86/170 Test #162: MaskingTests.MaxFlowWithNodeMask ..................................................   Passed    0.00 sec
-        Start 160: MaskingTests.KSPWithNodeMask
- 87/170 Test  #49: ShortestPaths.RejectsMaskLengthMismatch ...........................................   Passed    0.00 sec
-        Start 116: MaxFlow.MinCut_ValidEdgeIdentification
- 88/170 Test #137: KShortestPaths.NodeMaskBlocksPaths ................................................   Passed    0.00 sec
-        Start 142: KShortestPaths.LooplessPaths
- 89/170 Test   #3: FlowPolicyCore.Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths ............   Passed    0.00 sec
-        Start  88: FlowGraph.GetFlowPathForLinearFlow
- 90/170 Test #160: MaskingTests.KSPWithNodeMask ......................................................   Passed    0.00 sec
-        Start 108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth
- 91/170 Test #116: MaxFlow.MinCut_ValidEdgeIdentification ............................................   Passed    0.00 sec
-        Start  50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic
- 92/170 Test #142: KShortestPaths.LooplessPaths ......................................................   Passed    0.00 sec
-        Start  36: ShortestPaths.SingleSourceAllNodes
- 93/170 Test  #88: FlowGraph.GetFlowPathForLinearFlow ................................................   Passed    0.00 sec
-        Start 136: KShortestPaths.KEqualsZeroReturnsEmpty
- 94/170 Test #108: MaxFlow.EqualBalanced_NodeMask_ReducesECMPWidth ...................................   Passed    0.00 sec
-        Start  38: ShortestPaths.MultipleEqualCostPaths
- 95/170 Test  #50: ShortestPaths.ZeroCostEdges_PredDAGIsAcyclic ......................................   Passed    0.00 sec
-        Start  97: MaxFlow.SinglePath_ShortestPathEquivalence
- 96/170 Test  #36: ShortestPaths.SingleSourceAllNodes ................................................   Passed    0.00 sec
-        Start  90: FlowGraph.CoalescesDuplicateEdgeIds
- 97/170 Test #136: KShortestPaths.KEqualsZeroReturnsEmpty ............................................   Passed    0.00 sec
-        Start 131: MaxFlow.Sensitivity_PartialSaturation
- 98/170 Test  #38: ShortestPaths.MultipleEqualCostPaths ..............................................   Passed    0.00 sec
-        Start  45: ShortestPaths.PreferHigherResidualTieBreak
- 99/170 Test  #97: MaxFlow.SinglePath_ShortestPathEquivalence ........................................   Passed    0.00 sec
-        Start 129: MaxFlow.Sensitivity_SinglePath
-100/170 Test  #90: FlowGraph.CoalescesDuplicateEdgeIds ...............................................   Passed    0.00 sec
-        Start 110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly
-101/170 Test #131: MaxFlow.Sensitivity_PartialSaturation .............................................   Passed    0.00 sec
-        Start  28: StrictMultiDiGraph.MismatchedArrayLengthsThrow
-102/170 Test  #45: ShortestPaths.PreferHigherResidualTieBreak ........................................   Passed    0.00 sec
-        Start 111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers
-103/170 Test #129: MaxFlow.Sensitivity_SinglePath ....................................................   Passed    0.00 sec
-        Start 146: MaskingTests.MaskedSourceReturnsEmptyDAG
-104/170 Test #110: MaxFlow.TwoCostTiers_ShortestPath_SingleTierOnly ..................................   Passed    0.00 sec
-        Start  24: StrictMultiDiGraph.CSRReverseAdjacency
-105/170 Test  #28: StrictMultiDiGraph.MismatchedArrayLengthsThrow ....................................   Passed    0.00 sec
-        Start 124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest
-106/170 Test #111: MaxFlow.TwoCostTiers_FullMaxFlow_AllTiers .........................................   Passed    0.00 sec
-        Start 120: MaxFlow.EdgeMask_SelectiveEdgeFiltering
-107/170 Test #146: MaskingTests.MaskedSourceReturnsEmptyDAG ..........................................   Passed    0.00 sec
-        Start  25: StrictMultiDiGraph.MaxCapacityEdges
-108/170 Test  #24: StrictMultiDiGraph.CSRReverseAdjacency ............................................   Passed    0.00 sec
-        Start  57: FlowState.InitialResidualEqualsCapacity
-109/170 Test #124: MaxFlow.Clos_3Tier_Topology_Proportional_Shortest .................................   Passed    0.00 sec
-        Start 123: MaxFlow.SharedBottleneck_MultiplePathsMerge
-110/170 Test #120: MaxFlow.EdgeMask_SelectiveEdgeFiltering ...........................................   Passed    0.00 sec
-        Start  40: ShortestPaths.NodeMaskIsolation
-111/170 Test  #25: StrictMultiDiGraph.MaxCapacityEdges ...............................................   Passed    0.00 sec
-        Start 125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest
-112/170 Test  #57: FlowState.InitialResidualEqualsCapacity ...........................................   Passed    0.00 sec
-        Start 128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths
-113/170 Test #123: MaxFlow.SharedBottleneck_MultiplePathsMerge .......................................   Passed    0.00 sec
-        Start  74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero
-114/170 Test  #40: ShortestPaths.NodeMaskIsolation ...................................................   Passed    0.00 sec
-        Start  70: FlowState.EqualBalancedReconvergentDAGPlacesAll
-115/170 Test #125: MaxFlow.Clos_3Tier_Topology_EqualBalanced_Shortest ................................   Passed    0.00 sec
-        Start 147: MaskingTests.MaskedSourceWithDestination
-116/170 Test #128: MaxFlow.ShortestPath_MustSaturateAllEqualCostPaths ................................   Passed    0.00 sec
-        Start 159: MaskingTests.ResidualAndNodeMaskCombined
-117/170 Test  #74: FlowState.EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero ....................   Passed    0.00 sec
-        Start  84: FlowGraph.PlacementCreatesEntry
-118/170 Test  #70: FlowState.EqualBalancedReconvergentDAGPlacesAll ...................................   Passed    0.00 sec
-        Start  62: FlowState.ApplyDeltasAdditive
-119/170 Test #147: MaskingTests.MaskedSourceWithDestination ..........................................   Passed    0.00 sec
-        Start  30: StrictMultiDiGraph.OutOfRangeNodeThrows
-120/170 Test #159: MaskingTests.ResidualAndNodeMaskCombined ..........................................   Passed    0.00 sec
-        Start 139: KShortestPaths.MaxCostFactorLimit
-121/170 Test  #84: FlowGraph.PlacementCreatesEntry ...................................................   Passed    0.00 sec
-        Start  65: FlowState.ResetRestoresCapacity
-122/170 Test  #62: FlowState.ApplyDeltasAdditive .....................................................   Passed    0.00 sec
-        Start  19: StrictMultiDiGraph.SingleEdge
-123/170 Test  #30: StrictMultiDiGraph.OutOfRangeNodeThrows ...........................................   Passed    0.00 sec
-        Start 151: MaskingTests.MaskedDestinationUnreachable
-124/170 Test #139: KShortestPaths.MaxCostFactorLimit .................................................   Passed    0.00 sec
-        Start  60: FlowState.EqualBalancedDistribution
-125/170 Test  #65: FlowState.ResetRestoresCapacity ...................................................   Passed    0.00 sec
-        Start  96: MaxFlow.SinglePath_BottleneckConstraint
-126/170 Test  #19: StrictMultiDiGraph.SingleEdge .....................................................   Passed    0.00 sec
-        Start  26: StrictMultiDiGraph.ZeroCostEdges
-127/170 Test #151: MaskingTests.MaskedDestinationUnreachable .........................................   Passed    0.00 sec
-        Start 115: MaxFlow.FlowConservation_IntermediateNodes
-128/170 Test  #60: FlowState.EqualBalancedDistribution ...............................................   Passed    0.00 sec
-        Start  72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges
-129/170 Test  #96: MaxFlow.SinglePath_BottleneckConstraint ...........................................   Passed    0.00 sec
-        Start  66: FlowState.CustomInitialResidual
-130/170 Test  #26: StrictMultiDiGraph.ZeroCostEdges ..................................................   Passed    0.00 sec
-        Start 102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath
-131/170 Test #115: MaxFlow.FlowConservation_IntermediateNodes ........................................   Passed    0.00 sec
-        Start 101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath
-132/170 Test  #72: FlowState.EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges ..............   Passed    0.00 sec
-        Start  95: MaxFlow.SinglePath_BasicLinear
-133/170 Test  #66: FlowState.CustomInitialResidual ...................................................   Passed    0.00 sec
-        Start  98: MaxFlow.DegenerateCase_SourceEqualsSink
-134/170 Test #102: MaxFlow.ECMP_ThreePaths_Proportional_ShortestPath .................................   Passed    0.00 sec
-        Start  86: FlowGraph.RemoveByClassFiltersCorrectly
-135/170 Test #101: MaxFlow.ECMP_TwoPaths_EqualBalanced_ShortestPath ..................................   Passed    0.00 sec
-        Start  73: FlowState.EqualBalanced_DownstreamSplitEqualization
-136/170 Test  #95: MaxFlow.SinglePath_BasicLinear ....................................................   Passed    0.00 sec
-        Start 119: MaxFlow.NodeMask_BlocksFlowThroughNode
-137/170 Test  #98: MaxFlow.DegenerateCase_SourceEqualsSink ...........................................   Passed    0.00 sec
-        Start  85: FlowGraph.RemovalDeletesEntry
-138/170 Test  #86: FlowGraph.RemoveByClassFiltersCorrectly ...........................................   Passed    0.00 sec
-        Start  87: FlowGraph.GetFlowEdgesReturnsDeltas
-139/170 Test  #73: FlowState.EqualBalanced_DownstreamSplitEqualization ...............................   Passed    0.00 sec
-        Start 163: MaskingTests.MaxFlowWithEdgeMask
-140/170 Test #119: MaxFlow.NodeMask_BlocksFlowThroughNode ............................................   Passed    0.00 sec
-        Start 164: MaskingTests.MaxFlowAllPathsMasked
-141/170 Test  #85: FlowGraph.RemovalDeletesEntry .....................................................   Passed    0.00 sec
-        Start 165: MaskingTests.EmptyNodeMaskAllowsAllNodes
-142/170 Test  #87: FlowGraph.GetFlowEdgesReturnsDeltas ...............................................   Passed    0.00 sec
-        Start  12: FlowPolicyStatic.PerFlowBundleBinding
-143/170 Test #163: MaskingTests.MaxFlowWithEdgeMask ..................................................   Passed    0.00 sec
-        Start 169: MaskingTests.AlgorithmsAPIMaskedSource
-144/170 Test #164: MaskingTests.MaxFlowAllPathsMasked ................................................   Passed    0.00 sec
-        Start  13: FlowPolicyStatic.MaskedBundleIsDown
-145/170 Test #165: MaskingTests.EmptyNodeMaskAllowsAllNodes ..........................................   Passed    0.00 sec
-        Start  15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast
-146/170 Test  #12: FlowPolicyStatic.PerFlowBundleBinding .............................................   Passed    0.00 sec
-        Start  14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles
-147/170 Test #169: MaskingTests.AlgorithmsAPIMaskedSource ............................................   Passed    0.00 sec
-        Start  55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected
-148/170 Test  #13: FlowPolicyStatic.MaskedBundleIsDown ...............................................   Passed    0.00 sec
-        Start 166: MaskingTests.EmptyEdgeMaskAllowsAllEdges
-149/170 Test  #15: FlowPolicyCostBounds.MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast ...   Passed    0.00 sec
-        Start  81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops
-150/170 Test  #14: FlowPolicyStatic.ValidationRejectsForeignAndDisconnectedBundles ...................   Passed    0.00 sec
-        Start  16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping
-151/170 Test  #55: ShortestPathsTo.FanoutFromInteriorNodeIsRejected ..................................   Passed    0.00 sec
-        Start  52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource
-152/170 Test #166: MaskingTests.EmptyEdgeMaskAllowsAllEdges ..........................................   Passed    0.00 sec
-        Start  51: ShortestPathsTo.DistancesMatchForwardDistancesToDst
-153/170 Test  #81: FlowState.EqualBalancedLossy_InfiniteRequestFillsWithoutDrops .....................   Passed    0.00 sec
-        Start 170: MaskingTests.AlgorithmsAPIMaxFlowWithMask
-154/170 Test  #16: FlowPolicyCostBounds.MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping ....   Passed    0.00 sec
-        Start  82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger
-155/170 Test  #52: ShortestPathsTo.ForwardSpfFromPseudoSourceKeepsOnlyNearestSource ..................   Passed    0.00 sec
-        Start 167: MaskingTests.AllNodesMaskedNoReachability
-156/170 Test  #51: ShortestPathsTo.DistancesMatchForwardDistancesToDst ...............................   Passed    0.00 sec
-        Start 168: MaskingTests.AllEdgesMaskedNoReachability
-157/170 Test #170: MaskingTests.AlgorithmsAPIMaxFlowWithMask .........................................   Passed    0.00 sec
-        Start  94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal
-158/170 Test  #82: FlowGraph.LossyPlacementIsReversibleAndDropsStayOutOfLedger .......................   Passed    0.00 sec
-        Start  79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops
-159/170 Test #167: MaskingTests.AllNodesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start  53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag
-160/170 Test #168: MaskingTests.AllEdgesMaskedNoReachability .........................................   Passed    0.00 sec
-        Start  80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream
-161/170 Test  #94: FlowGraphStamp.EqualVersionDivergentCopiesCompareUnequal ..........................   Passed    0.00 sec
-        Start  93: FlowGraphStamp.CopiesAndMovesGetFreshUids
-162/170 Test  #79: FlowState.EqualBalancedLossy_FillAndDropReportsDrops ..............................   Passed    0.00 sec
-163/170 Test  #53: ShortestPathsTo.FanoutEdgesForceEverySourceIntoTheDag .............................   Passed    0.00 sec
-        Start 145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK
-        Start  54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads
-164/170 Test  #80: FlowState.EqualBalancedLossy_DeficitPropagatesDownstream ..........................   Passed    0.00 sec
-        Start  77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission
-165/170 Test  #93: FlowGraphStamp.CopiesAndMovesGetFreshUids .........................................   Passed    0.00 sec
-        Start  56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode
-166/170 Test #145: KSP.MaxCostFactorBelowOne_ReturnsEmptyForAllK .....................................   Passed    0.00 sec
-        Start  78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf
-167/170 Test  #54: ShortestPathsTo.FanoutSkipsUnreachableAndMaskedHeads ..............................   Passed    0.00 sec
-168/170 Test  #77: FlowState.EqualBalanced_SaturatedMemberBlocksAdmission ............................   Passed    0.00 sec
-169/170 Test  #56: ShortestPathsTo.SinglePathModeKeepsOneSuccessorPerNode ............................   Passed    0.00 sec
-170/170 Test  #78: FlowState.EqualBalanced_ProgressesOnlyThroughResidualAwareSpf .....................   Passed    0.00 sec
-
-100% tests passed out of 170
-
-Total Test time (real) =   0.10 sec
-........................................................................ [ 15%]
-........................................................................ [ 30%]
-........................................................................ [ 46%]
-........................................................................ [ 61%]
-........................................................................ [ 77%]
-........................................................................ [ 92%]
-.................................                                        [100%]
-465 passed in 4.07s
diff --git a/dev/research/metal_pathfinding/run_aba.sh b/dev/research/metal_pathfinding/run_aba.sh
deleted file mode 100644
index 70f8f25..0000000
--- a/dev/research/metal_pathfinding/run_aba.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-# Serial fresh-process CPU / Metal / CPU runs. Do not overlap with builds/tests.
-set -euo pipefail
-cd "$(dirname "$0")/../.."
-out=${1:-dev/research/metal_pathfinding/results}
-mkdir -p "$out"
-unset NGRAPH_CORE_PROFILE
-{
-  date -u '+%Y-%m-%dT%H:%M:%SZ'
-  git rev-parse HEAD
-  sw_vers
-  sysctl -n machdep.cpu.brand_string hw.memsize hw.ncpu
-  xcrun clang++ --version
-  shasum -a 256 dev/research/metal_pathfinding/experiment.mm dev/research/metal_pathfinding/sssp.metal
-  pmset -g therm
-} > "$out/environment.txt"
-for phase in a1 b a2; do
-  top -l 2 -n 8 -o cpu -stats pid,command,cpu,threads > "$out/load-$phase.txt"
-  ioreg -r -c AGXAccelerator -l | sed -n '/"PerformanceStatistics"/p' > "$out/gpu-load-$phase.txt"
-  mode=cpu
-  [[ $phase != b ]] || mode=gpu
-  build/metal_pathfinding/experiment "$mode" dev/research/metal_pathfinding/sssp.metal full 9 \
-    > "$out/$phase.csv" 2> "$out/$phase-stderr.txt"
-done
diff --git a/dev/research/metal_pathfinding/sssp.metal b/dev/research/metal_pathfinding/sssp.metal
deleted file mode 100644
index c8e486c..0000000
--- a/dev/research/metal_pathfinding/sssp.metal
+++ /dev/null
@@ -1,122 +0,0 @@
-#include <metal_stdlib>
-using namespace metal;
-
-// Research kernels: exact int64, nonnegative costs, one writer per distance.
-// Incoming CSR includes a host-computed edge eligibility byte, so double
-// capacity comparisons keep their CPU semantics.
-constant long INF = 0x7fffffffffffffffL;
-struct Params { uint n; uint queries; uint round; uint unused; };
-
-kernel void relax_pull(device const int* row [[buffer(0)]],
-                       device const int* col [[buffer(1)]],
-                       device const long* cost [[buffer(2)]],
-                       device const uchar* allowed [[buffer(3)]],
-                       device const long* before [[buffer(4)]],
-                       device long* after [[buffer(5)]],
-                       device atomic_uint* changed [[buffer(6)]],
-                       constant Params& p [[buffer(7)]],
-                       uint tid [[thread_position_in_grid]]) {
-  if (tid >= p.n * p.queries) return;
-  uint v = tid % p.n;
-  uint base = tid - v;
-  long best = before[tid];
-  for (int j = row[v]; j < row[v + 1]; ++j) {
-    long d = before[base + col[j]];
-    if (allowed[j] && d != INF) best = min(best, d + cost[j]);
-  }
-  after[tid] = best;
-  if (best != before[tid])
-    atomic_store_explicit(changed + p.round, 1u, memory_order_relaxed);
-}
-
-// A whole SSSP in one threadgroup, with independent queries across groups.
-// Each group owns both of its N-element distance arrays. Device-memory barriers
-// are local to that group; no unsafe grid-wide barrier or in-place data race.
-kernel void solve_group(device const int* row [[buffer(0)]],
-                        device const int* col [[buffer(1)]],
-                        device const long* cost [[buffer(2)]],
-                        device const uchar* allowed [[buffer(3)]],
-                        device long* a [[buffer(4)]],
-                        device long* b [[buffer(5)]],
-                        device uint* rounds [[buffer(6)]],
-                        constant Params& p [[buffer(7)]],
-                        device const int* sources [[buffer(8)]],
-                        uint lane [[thread_index_in_threadgroup]],
-                        uint width [[threads_per_threadgroup]],
-                        uint query [[threadgroup_position_in_grid]]) {
-  uint base = query * p.n;
-  for (uint v = lane; v < p.n; v += width)
-    a[base + v] = (int(v) == sources[query]) ? 0L : INF;
-  threadgroup atomic_uint changed;
-  threadgroup_barrier(mem_flags::mem_device);
-  uint step = 0;
-  for (; step < p.n; ++step) {
-    if (lane == 0) atomic_store_explicit(&changed, 0u, memory_order_relaxed);
-    threadgroup_barrier(mem_flags::mem_threadgroup);
-    for (uint v = lane; v < p.n; v += width) {
-      long best = a[base + v];
-      for (int j = row[v]; j < row[v + 1]; ++j) {
-        long d = a[base + col[j]];
-        if (allowed[j] && d != INF) best = min(best, d + cost[j]);
-      }
-      b[base + v] = best;
-      if (best != a[base + v])
-        atomic_store_explicit(&changed, 1u, memory_order_relaxed);
-    }
-    threadgroup_barrier(mem_flags::mem_device | mem_flags::mem_threadgroup);
-    uint any_changed = atomic_load_explicit(&changed, memory_order_relaxed);
-    // Every lane must observe this round before lane 0 resets the flag for the
-    // next one. A barrier *before* the loads alone does not prevent that race.
-    threadgroup_barrier(mem_flags::mem_threadgroup);
-    if (any_changed == 0) break;
-    device long* tmp = a; a = b; b = tmp;
-  }
-  // Host selects the output buffer by round parity; convergence leaves a == b.
-  if (lane == 0) rounds[query] = min(step + 1, p.n);
-}
-
-// Small-graph variant: 2 * N * 8 bytes of threadgroup memory, N <= 2048 on
-// this device. Removes repeated device-memory accesses and barriers per round.
-kernel void solve_shared(device const int* row [[buffer(0)]],
-                         device const int* col [[buffer(1)]],
-                         device const long* cost [[buffer(2)]],
-                         device const uchar* allowed [[buffer(3)]],
-                         device long* output [[buffer(4)]],
-                         device uint* rounds [[buffer(6)]],
-                         constant Params& p [[buffer(7)]],
-                         device const int* sources [[buffer(8)]],
-                         threadgroup long* scratch [[threadgroup(0)]],
-                         uint lane [[thread_index_in_threadgroup]],
-                         uint width [[threads_per_threadgroup]],
-                         uint query [[threadgroup_position_in_grid]]) {
-  threadgroup long* a = scratch;
-  threadgroup long* b = scratch + p.n;
-  for (uint v = lane; v < p.n; v += width)
-    a[v] = (int(v) == sources[query]) ? 0L : INF;
-  threadgroup atomic_uint changed;
-  threadgroup_barrier(mem_flags::mem_threadgroup);
-  uint step = 0;
-  for (; step < p.n; ++step) {
-    if (lane == 0) atomic_store_explicit(&changed, 0u, memory_order_relaxed);
-    threadgroup_barrier(mem_flags::mem_threadgroup);
-    bool lane_changed = false;
-    for (uint v = lane; v < p.n; v += width) {
-      long best = a[v];
-      for (int j = row[v]; j < row[v + 1]; ++j) {
-        long d = a[col[j]];
-        if (allowed[j] && d != INF) best = min(best, d + cost[j]);
-      }
-      b[v] = best;
-      lane_changed |= best != a[v];
-    }
-    if (simd_any(lane_changed) && (lane % 32 == 0))
-      atomic_store_explicit(&changed, 1u, memory_order_relaxed);
-    threadgroup_barrier(mem_flags::mem_threadgroup);
-    threadgroup long* tmp = a; a = b; b = tmp;
-    uint any_changed = atomic_load_explicit(&changed, memory_order_relaxed);
-    threadgroup_barrier(mem_flags::mem_threadgroup);
-    if (any_changed == 0) break;
-  }
-  for (uint v = lane; v < p.n; v += width) output[query * p.n + v] = a[v];
-  if (lane == 0) rounds[query] = min(step + 1, p.n);
-}
diff --git a/dev/research/metal_pathfinding/summarize.py b/dev/research/metal_pathfinding/summarize.py
deleted file mode 100644
index 217d582..0000000
--- a/dev/research/metal_pathfinding/summarize.py
+++ /dev/null
@@ -1,74 +0,0 @@
-"""Summarize fresh-process A/B/A CSVs; timings are milliseconds per whole batch."""
-
-from __future__ import annotations
-
-import csv
-import sys
-from pathlib import Path
-
-
-def read(path: Path) -> dict[tuple[str, int, int, int], dict[str, dict[str, str]]]:
-    cases: dict[tuple[str, int, int, int], dict[str, dict[str, str]]] = {}
-    with path.open() as file:
-        for row in csv.DictReader(file):
-            assert row["correct"] == "pass", row
-            key = (row["case"], int(row["n"]), int(row["e"]), int(row["queries"]))
-            cases.setdefault(key, {})[row["method"]] = row
-    return cases
-
-
-def main() -> None:
-    root = Path(sys.argv[1])
-    a1, b, a2 = (read(root / name) for name in ("a1.csv", "b.csv", "a2.csv"))
-    assert a1.keys() == b.keys() == a2.keys()
-    print("Exploratory observations, not a production performance acceptance result.")
-    print(
-        "Inspect load-*.txt and gpu-load-*.txt; speedup claims require a quiet machine."
-    )
-    print("The prototype matches supported DAG edge sets, not CPU predecessor order.\n")
-    print("All times are medians in milliseconds per batch, with nine timed samples.")
-    print("CPU A columns use serial SPF for Q=1 and the 10-worker pool otherwise.")
-    print("GPU includes host distance copies and serial CPU ECMP DAG reconstruction.")
-    print("Upload and pipeline setup are excluded and recorded separately in raw data.")
-    print("The table picks the fastest measured GPU method for each case.\n")
-    print(
-        "| Case | V / E | Q | CPU A1 | GPU B | CPU A2 | GPU method | "
-        "Distance-only B | CPU drift |"
-    )
-    print("|---|---:|---:|---:|---:|---:|---|---:|---:|")
-    for key, runs in b.items():
-        name, n, e, q = key
-        baseline = "cpu_full" if q == 1 else "cpu_pool10"
-        left = float(a1[key][baseline]["wall_ms"])
-        right = float(a2[key][baseline]["wall_ms"])
-        best = min(runs.values(), key=lambda row: float(row["wall_ms"]))
-        dist = float(best["distance_wall_ms"])
-        drift = 100 * (right / left - 1)
-        print(
-            f"| {name} | {n:,} / {e:,} | {q} | {left:.3f} | "
-            f"{float(best['wall_ms']):.3f} | {right:.3f} | {best['method']} | "
-            f"{dist:.3f} | {drift:+.1f}% |"
-        )
-    print(
-        "\nDistance-only timings stop before DAG reconstruction; they are not SPF API timings."
-    )
-    print(
-        "CPU distance-only and serial full-batch controls are also available in a1/a2.csv."
-    )
-    print("\nDistances-only comparison (both sides omit DAG construction):\n")
-    print("| Case | V / E | Q | CPU A1 | GPU B | CPU A2 | GPU method |")
-    print("|---|---:|---:|---:|---:|---:|---|")
-    for key, runs in b.items():
-        name, n, e, q = key
-        baseline = "cpu_distance" if q == 1 else "cpu_pool10_distance"
-        left = float(a1[key][baseline]["wall_ms"])
-        right = float(a2[key][baseline]["wall_ms"])
-        best = min(runs.values(), key=lambda row: float(row["distance_wall_ms"]))
-        print(
-            f"| {name} | {n:,} / {e:,} | {q} | {left:.3f} | "
-            f"{float(best['distance_wall_ms']):.3f} | {right:.3f} | {best['method']} |"
-        )
-
-
-if __name__ == "__main__":
-    main()
diff --git a/dev/run-checks.sh b/dev/run-checks.sh
index b3f50d4..b1ec515 100755
--- a/dev/run-checks.sh
+++ b/dev/run-checks.sh
@@ -1,138 +1,108 @@
-#!/bin/bash
-# NetGraph-Core: Comprehensive checks and tests
-# - Pre-commit (auto-fix, then verify)
-# - C++ tests via ctest (optional, if cmake is available)
-# - Python tests (with coverage if pytest-cov is available)
-
-set -e
-set -u
-set -o pipefail
-
-# Prefer provided PYTHON env (passed from Makefile), fallback to python3
+#!/usr/bin/env bash
+# The Python-side check entrypoints. Each one only reads the tree: formatting and fixes are
+# `make format` and `make hooks`.
+#
+#   bash dev/run-checks.sh pytest on [PYTEST_ARGS...]
+#       The Python suite against the netgraph_core that $PYTHON imports, which must carry the
+#       private hooks (the editable development build): no test may skip on a GIL build;
+#       only the GIL-proof tests skip on a free-threaded build. (make check-ci)
+#   bash dev/run-checks.sh pytest off [PYTEST_ARGS...]
+#       The Python suite against an installed, non-editable netgraph_core without the hooks (a
+#       wheel, or a build from the sdist): exactly the tests that need a hook skip, listed in
+#       dev/pytest_guard.py, which runs and checks both modes. (release CI)
+#   bash dev/run-checks.sh cov
+#       C++ and Python coverage (make cov): a coverage venv of its own (build/coverage-venv, pinned
+#       by .github/ci-constraints.txt; the development venv is not touched), the extension and the
+#       C++ tests built with coverage in their own build directories, every build, test and
+#       report failure fails the run, and so does coverage that was not measured: no profile
+#       data written in either build directory, no file of the C++ report under one of its
+#       filters, or a report that counts no line. Reports in build/coverage/.
+#
+# PYTHON names the interpreter (default python3); CMAKE_BUILD_PARALLEL_LEVEL bounds the builds,
+# ctest and gcovr (default 4; exported, so it also reaches the extension's build under pip); GCOV
+# names the gcov command gcovr runs (default: xcrun llvm-cov gcov on macOS, llvm-cov gcov when CXX
+# is clang, gcov otherwise).
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+ROOT=$PWD
 PYTHON=${PYTHON:-python3}
-# Prepend the directory of the configured Python (usually venv/bin) to PATH
-PY_BIN_DIR=$(dirname "$PYTHON")
-export PATH="$PY_BIN_DIR:$PATH"
-# If running within project venv, also prepend its bin to PATH so cmake/ninja resolve from venv
-if [ -n "${VIRTUAL_ENV:-}" ] && [ -x "$VIRTUAL_ENV/bin/python" ]; then
-    export PATH="$VIRTUAL_ENV/bin:$PATH"
-fi
-
-# Prefer Apple Command Line Tools compilers to avoid Homebrew libc++ ABI mismatches
-APPLE_CLANG=$(xcrun --find clang 2>/dev/null || true)
-APPLE_CLANGXX=$(xcrun --find clang++ 2>/dev/null || true)
-DEFAULT_MACOSX=15.0
-if [ -n "$APPLE_CLANG" ] && [ -n "$APPLE_CLANGXX" ]; then
-    export CC="$APPLE_CLANG"
-    export CXX="$APPLE_CLANGXX"
-    export CMAKE_ARGS="${CMAKE_ARGS:-} -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX"
-fi
-export MACOSX_DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-$DEFAULT_MACOSX}"
-
-# Ensure required tools are present
-if ! "$PYTHON" -m pre_commit --version &> /dev/null; then
-    echo "❌ pre-commit is not installed. Please run 'make dev' first."
-    exit 1
-fi
-
-if ! "$PYTHON" -m pytest --version &> /dev/null; then
-    echo "❌ pytest is not installed. Please run 'make dev' first."
-    exit 1
-fi
-
-# Ensure pre-commit hooks are installed (if in a git repo)
-if [ -d .git ] && [ ! -f .git/hooks/pre-commit ]; then
-    echo "⚠️  Pre-commit hooks not installed. Installing now..."
-    "$PYTHON" -m pre_commit install
-    echo ""
-fi
-
-# First pass: allow auto-fixes
-echo "🏃 Running pre-commit (first pass: apply auto-fixes if needed)..."
-set +e
-"$PYTHON" -m pre_commit run --all-files
-first_pass_status=$?
-set -e
+JOBS=${CMAKE_BUILD_PARALLEL_LEVEL:-4}
+case "$JOBS" in ''|*[!0-9]*|0) echo 'CMAKE_BUILD_PARALLEL_LEVEL must be positive.' >&2; exit 2 ;; esac
+export CMAKE_BUILD_PARALLEL_LEVEL=$JOBS
 
-if [ $first_pass_status -ne 0 ]; then
-    echo "ℹ️  Some hooks modified files or reported issues. Re-running checks..."
-fi
-
-# Second pass: verify all checks
-echo "🏃 Running pre-commit (second pass: verify all checks)..."
-if ! "$PYTHON" -m pre_commit run --all-files; then
-    echo ""
-    echo "❌ Pre-commit checks failed after applying fixes. Please address the issues above."
-    exit 1
-fi
+die() { echo "dev/run-checks.sh: $*" >&2; exit 1; }
 
-autofixed=0
-if [ $first_pass_status -ne 0 ]; then
-    autofixed=1
+if [[ "$(uname -s)" == Darwin ]]; then
+    CC=$(xcrun --find clang)
+    CXX=$(xcrun --find clang++)
+    export CC CXX
+    export MACOSX_DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-15.0}"
 fi
 
-echo ""
-echo "✅ Pre-commit checks passed!"
-echo ""
+# run_pytest on|off [PYTEST_ARGS...]: the suite, then the check of what was imported and skipped
+# (dev/pytest_guard.py, which the Windows CI jobs run directly; PYTEST_ADDOPTS and its reports stay
+# the caller's).
+run_pytest() {
+    "$PYTHON" "$ROOT/dev/pytest_guard.py" "$@"
+}
 
-# Optional: Run C++ tests via ctest if cmake is available (and not skipped)
-if [ "${SKIP_CPP_TESTS:-0}" = "1" ]; then
-    echo "⏭️  SKIP_CPP_TESTS=1 set. Skipping C++ tests."
-else
-    echo "🔧 Checking for CMake to run C++ tests..."
-    if command -v cmake >/dev/null 2>&1; then
-        if [ "${SKIP_CPP_TESTS:-0}" != "1" ]; then
-            echo "🧪 Running C++ tests (ctest)..."
-            BUILD_DIR="build/cpp-tests"
-            mkdir -p "$BUILD_DIR"
-            GEN_ARGS=""
-            if command -v ninja >/dev/null 2>&1; then
-                GEN_ARGS="-G Ninja"
-            fi
-            cmake -S . -B "$BUILD_DIR" -DNETGRAPH_CORE_BUILD_TESTS=ON -DCMAKE_BUILD_TYPE=Release $GEN_ARGS
-            cmake --build "$BUILD_DIR" --config Release -j
-            # Determine parallelism
-            if command -v sysctl >/dev/null 2>&1; then
-                NPROC=$(sysctl -n hw.ncpu 2>/dev/null || echo 2)
-            elif command -v nproc >/dev/null 2>&1; then
-                NPROC=$(nproc)
-            else
-                NPROC=2
-            fi
-            # Add per-test timeout to avoid hangs
-            ctest --test-dir "$BUILD_DIR" --output-on-failure -j "$NPROC" --timeout 120
-        fi
+coverage() {
+    local cvenv=build/coverage-venv ext=build/coverage-ext cpp=build/cpp-tests-cov out=build/coverage
+    local gcov dir root filters=(include/ src/ bindings/)
+    rm -rf "$cvenv" "$out"
+    mkdir -p "$out"
+    echo "== coverage venv $cvenv (pins: .github/ci-constraints.txt)"
+    "$PYTHON" -m venv "$cvenv"
+    local cpy=$ROOT/$cvenv/bin/python
+    "$cpy" -m pip install --disable-pip-version-check -q -U -c .github/ci-constraints.txt pip
+    "$cpy" -m pip install --disable-pip-version-check -q -c .github/ci-constraints.txt \
+        scikit-build-core pybind11 cmake ninja numpy pytest pytest-cov gcovr
+    export PATH="$ROOT/$cvenv/bin:$PATH"
+    echo "== the extension with coverage (editable, hooks on, Debug) in $ext"
+    "$cpy" -m pip install --disable-pip-version-check --no-build-isolation --no-deps -e . \
+        -C build-dir="$ext" -C cmake.build-type=Debug \
+        -C cmake.define.NETGRAPH_CORE_COVERAGE=ON -C cmake.define.NETGRAPH_CORE_PRIVATE_HOOKS=ON
+    # gcovr reads every profile (.gcda file) it finds and reports no data, or old data, without
+    # failing: the profiles of earlier runs go first, and each build directory must then hold
+    # profiles that this run's tests wrote.
+    find "$ext" -name '*.gcda' -delete
+    [[ ! -d "$cpp" ]] || find "$cpp" -name '*.gcda' -delete
+    echo "== Python tests with coverage"
+    PYTHON=$cpy run_pytest on --cov=netgraph_core --cov-report=term-missing \
+        --cov-report=xml:"$out/coverage-python.xml"
+    echo "== C++ tests with coverage"
+    bash dev/cpp-tests.sh coverage
+    for dir in "$ext" "$cpp"; do
+        [[ -n "$(find "$dir" -name '*.gcda' -print -quit)" ]] ||
+            die "no C++ profile data in $dir: the tests that ran wrote no coverage there"
+    done
+    echo "== C++ coverage report (gcovr: the library, the bindings and the headers)"
+    if [[ "$(uname -s)" == Darwin ]]; then
+        gcov="xcrun llvm-cov gcov"
+    elif [[ "${CXX:-}" == *clang* ]]; then
+        gcov="llvm-cov gcov"
     else
-        echo "⚠️  CMake not found. Skipping C++ tests."
+        gcov=gcov
     fi
-fi
-
-echo ""
-
-# Run Python tests (with coverage if available)
-echo "🧪 Running Python tests..."
-# Ensure the extension is built for the active Python and importable
-echo "🔧 Installing project in editable mode for current Python..."
-"$PYTHON" -m pip install -e . >/dev/null
-if "$PYTHON" -c "import pytest_cov" >/dev/null 2>&1; then
-    "$PYTHON" -m pytest --cov=netgraph_core --cov-report=term-missing
-else
-    "$PYTHON" -m pytest
-fi
+    gcov=${GCOV:-$gcov}
+    "$cpy" -m gcovr --root . --gcov-executable "$gcov" -j "$JOBS" \
+        "${filters[@]/#/--filter=}" --xml-pretty -o "$out/coverage-cpp.xml" "$ext" "$cpp"
+    "$cpy" dev/coverage_summary.py "$out/coverage-python.xml" "$out/coverage-cpp.xml" \
+        --html="$out/coverage-combined.html"
+    # A filter that matches no file (a moved directory) would leave that part out silently.
+    for root in "${filters[@]}"; do
+        grep -q "filename=\"$root" "$out/coverage-cpp.xml" ||
+            die "the C++ coverage report has no file under $root"
+    done
+    echo "Coverage ready in $out/: coverage-python.xml, coverage-cpp.xml, coverage-combined.html"
+}
 
-if [ $? -eq 0 ]; then
-    echo ""
-    if [ $autofixed -eq 1 ]; then
-        echo "🎉 All checks and tests passed. Auto-fixes were applied by pre-commit."
-    else
-        echo "🎉 All checks and tests passed."
-    fi
-else
-    echo ""
-    if [ $autofixed -eq 1 ]; then
-        echo "❌ Some tests failed. Note: auto-fixes were applied earlier by pre-commit."
-    else
-        echo "❌ Some tests failed."
-    fi
-    exit 1
-fi
+case "${1:-}" in
+    pytest)
+        case "${2:-}" in on|off) ;; *) die "usage: dev/run-checks.sh pytest on|off [PYTEST_ARGS...]" ;; esac
+        hooks=$2; shift 2
+        run_pytest "$hooks" "$@"
+        ;;
+    cov) coverage ;;
+    *) echo 'Usage: bash dev/run-checks.sh pytest on|off [PYTEST_ARGS...] | cov' >&2; exit 2 ;;
+esac
diff --git a/dev/stubs/check_clients.py b/dev/stubs/check_clients.py
new file mode 100644
index 0000000..8fa3c63
--- /dev/null
+++ b/dev/stubs/check_clients.py
@@ -0,0 +1,248 @@
+"""Type-check the client programs of tests/typing against the installed netgraph_core.
+
+Run by ``bash dev/stubs/run.sh check`` with the interpreter of an environment holding an
+installed netgraph_core (a wheel, or an installation built from the sdist) and pinned Pyright:
+
+* the installation is the one checked: netgraph_core is imported from this interpreter's
+  site-packages, its __init__.pyi equals the committed stub byte for byte, py.typed is there and
+  _docs.py is not; Pyright's search paths (its verbose log) hold that site-packages and not the
+  source tree's python/ directory, and the clients run from a copy outside the source tree;
+* tests/typing/valid_client.py: zero Pyright diagnostics of any severity, and it runs;
+* tests/typing/invalid_client.py: the diagnostics are exactly the lines marked
+  ``# expect: RULE[, RULE...]`` (one diagnostic of each rule listed), at least one per typing
+  case of REQUIRED below;
+* a control: a copy of the valid client with one wrong line appended gets exactly that one
+  diagnostic (the valid client is analysed, its zero is not vacuous);
+* every Pyright run ends normally (``pyright`` below); one that does not stops the check.
+
+Usage: python -I dev/stubs/check_clients.py LABEL WORK_DIR
+"""
+
+from __future__ import annotations
+
+import collections
+import importlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import sysconfig
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+CLIENTS = ROOT / "tests/typing"
+STUB = ROOT / "python/netgraph_core/__init__.pyi"
+EXPECT = re.compile(r"#\s*expect:\s*(\w+(?:\s*,\s*\w+)*)\s*$")
+# The typing cases the invalid client must keep, one per marked line (the result classes the
+# module refuses to construct, wrong dtypes, wrong argument types, missing Optional checks; a
+# line containing the text, marked): a marked line deleted with its mark is caught.
+REQUIRED = [
+    "ng.Eligibility()",
+    "ng.PredecessorDAG()",
+    "ng.FlowRecord()",
+    "ng.PlacementResult()",
+    "ng.SourceFlow()",
+    "ng.ShortestPathCacheStats()",
+    "ng.SensitivityEntry()",
+    "ng.SensitivityResult()",
+    "ng.SpfResult()",
+    "ng.ForwardingProgram()",
+    "ng.Tunnel()",
+    "ng.TunnelFlow()",
+    "ng.Pinned([dag])",
+    "npt.NDArray[np.float64] = g.edge_capacity_units()",
+    "text: str = g.edge_capacity_units().item(0)",
+    'ng.Graph("wrong"',
+    "ng.Graph(2, [0], [1], [1.5]",
+    "ng.FlowLedger(g, service_baseline=np.zeros(1, dtype=np.float64))",
+    "ng.spf(g, 0, ng.KspOptions(1))",
+    "ng.SpfOptions(ng.Direction.FORWARD, multipath=None)",
+    'ng.CostStretch("1.2")',
+    "ng.evaluate_demand(g, 0, 1, cfg)",
+    'ng.EvaluationOptions(cfg, offer="4")',
+    "ng.DistributedTE(guard, cost_ceiling=guard)",
+    'ng.to_units("1.5", 1.0)',
+    "ng.FlowPolicyConfig(ng.CentralizedTE(source_allocation=opt))",
+    "ng.CentralizedTE()",
+    "source_weights=[1.5]",
+    "ng.FlowPolicyConfig(routing=sp, placement=None)",
+    "ng.Path(g, np.zeros((1, 1), dtype=np.float64))",
+    "ng.evaluate_pairs(g, float_pairs,",
+    "cost: int = result.target_cost",
+    "first = result.costs[0]",
+    "total = flows.sum()",
+    "cost_total: int = best.total_cost",
+    "weights = best.program.source_weights",
+]
+
+
+def fail(label: str, problems: list[str]) -> int:
+    for p in problems:
+        print(f"dev/stubs/check_clients.py [{label}]: {p}", file=sys.stderr)
+    return 1
+
+
+def installation(problems: list[str]) -> Path:
+    pkg = importlib.import_module("netgraph_core")
+    where = Path(os.path.realpath(pkg.__file__ or "")).parent
+    roots = {os.path.realpath(sysconfig.get_paths()[k]) for k in ("purelib", "platlib")}
+    if not any(str(where).startswith(r + os.sep) for r in roots):
+        problems.append(f"netgraph_core imported from {where}, not this site-packages")
+    stub = where / "__init__.pyi"
+    if not stub.is_file():
+        problems.append(f"the installation has no {stub.name}")
+    elif stub.read_bytes() != STUB.read_bytes():
+        problems.append(f"{stub} differs from the committed {STUB.relative_to(ROOT)}")
+    if not (where / "py.typed").is_file():
+        problems.append("the installation has no py.typed")
+    if (where / "_docs.py").exists():
+        problems.append("the installation still carries _docs.py")
+    return where
+
+
+def pyright(work: Path, verbose: bool = False) -> dict:
+    """Pyright on the project in ``work``: its verbose log, or its JSON report. Exits with the
+    reason unless Pyright ended normally: exit status 0 (no error) or 1 (errors reported), not
+    a signal or another status (a fatal error, a bad configuration or command line), and for
+    the report, standard output that is one JSON report whose error count agrees with the
+    status."""
+    cmd = [sys.executable, "-m", "pyright", "--pythonpath", sys.executable]
+    cmd += ["--project", str(work), "--verbose" if verbose else "--outputjson"]
+    proc = subprocess.run(cmd, capture_output=True, text=True, cwd=work)
+    out = proc.stdout + proc.stderr
+    (work / ("pyright-verbose.log" if verbose else "pyright.json")).write_text(out)
+    if proc.returncode < 0:
+        sys.exit(f"pyright was killed by signal {-proc.returncode} on {work}:\n{out}")
+    if proc.returncode not in (0, 1):
+        sys.exit(f"pyright failed (exit {proc.returncode}) on {work}:\n{out}")
+    if verbose:
+        return {"log": out}
+    try:
+        report = json.loads(proc.stdout)
+    except json.JSONDecodeError:
+        sys.exit(f"pyright gave no JSON (exit {proc.returncode}):\n{out}")
+    if not isinstance(report, dict):
+        report = {}
+    summary = report.get("summary")
+    errors = summary.get("errorCount") if isinstance(summary, dict) else None
+    if (
+        not isinstance(report.get("generalDiagnostics"), list)
+        or type(errors) is not int
+        or proc.returncode != (errors > 0)
+    ):
+        sys.exit(
+            f"pyright's report is not one of a complete run (exit {proc.returncode}):\n{out}"
+        )
+    return report
+
+
+def diagnostics(report: dict) -> dict[str, collections.Counter]:
+    got: dict[str, collections.Counter] = collections.defaultdict(collections.Counter)
+    for d in report.get("generalDiagnostics", []):
+        line = d["range"]["start"]["line"] + 1
+        got[Path(d["file"]).name][(line, d.get("rule", d["severity"]))] += 1
+    return got
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        sys.exit("usage: check_clients.py LABEL WORK_DIR")
+    label, work = sys.argv[1], Path(sys.argv[2]).resolve()
+    problems: list[str] = []
+    site = installation(problems)
+    shutil.rmtree(work, ignore_errors=True)
+    work.mkdir(parents=True)
+    names = ["valid_client.py", "invalid_client.py"]
+    for name in names:
+        shutil.copyfile(CLIENTS / name, work / name)
+    version = f"{sys.version_info.major}.{sys.version_info.minor}"
+    (work / "pyrightconfig.json").write_text(
+        json.dumps(
+            {
+                "include": names,
+                "typeCheckingMode": "standard",
+                "pythonVersion": version,
+            },
+            indent=2,
+        )
+    )
+
+    log = pyright(work, verbose=True)["log"]
+    paths = [ln.strip() for ln in log.splitlines() if ln.startswith("  ")]
+    if not any(
+        os.path.realpath(p) == str(site.parent) for p in paths if os.path.isdir(p)
+    ):
+        problems.append(
+            f"Pyright's search paths do not hold {site.parent} (pyright-verbose.log)"
+        )
+    source = os.path.realpath(ROOT / "python")
+    if any(os.path.realpath(p) == source for p in paths if os.path.isdir(p)):
+        problems.append("Pyright searches the source tree's python/ directory")
+
+    report = pyright(work)
+    got = diagnostics(report)
+    if got["valid_client.py"]:
+        for (line, rule), n in sorted(got["valid_client.py"].items()):
+            problems.append(
+                f"valid_client.py:{line}: {n} unexpected diagnostic(s) {rule}"
+            )
+
+    lines = (work / "invalid_client.py").read_text().splitlines()
+    want: collections.Counter = collections.Counter()
+    for i, text in enumerate(lines, 1):
+        m = EXPECT.search(text)
+        if m:
+            for rule in re.split(r"\s*,\s*", m.group(1)):
+                want[(i, rule)] += 1
+    for case in REQUIRED:
+        if not any(case in t and EXPECT.search(t) for t in lines):
+            problems.append(f"invalid_client.py lost the marked case {case!r}")
+    for key in sorted(set(want) | set(got["invalid_client.py"])):
+        w, g = want[key], got["invalid_client.py"][key]
+        if w != g:
+            problems.append(
+                f"invalid_client.py:{key[0]}: {key[1]} expected {w}, got {g}"
+            )
+    details = {
+        (d["range"]["start"]["line"] + 1, d.get("rule")): d["message"].splitlines()[0]
+        for d in report.get("generalDiagnostics", [])
+        if Path(d["file"]).name == "invalid_client.py"
+    }
+
+    # The control: one wrong line appended to a copy of the valid client.
+    control = work / "control"
+    control.mkdir()
+    planted = (CLIENTS / "valid_client.py").read_text() + "oops: str = g.num_edges()\n"
+    (control / "valid_client.py").write_text(planted)
+    (control / "pyrightconfig.json").write_text(
+        json.dumps({"include": ["valid_client.py"], "typeCheckingMode": "standard"})
+    )
+    seen = diagnostics(pyright(control))["valid_client.py"]
+    last = len(planted.splitlines())
+    if seen != collections.Counter({(last, "reportAssignmentType"): 1}):
+        problems.append(f"control: the planted line {last} gave {dict(seen)}")
+
+    run = subprocess.run(
+        [sys.executable, "-I", str(work / "valid_client.py")],
+        capture_output=True,
+        text=True,
+    )
+    if run.returncode != 0:
+        problems.append(f"valid_client.py does not run:\n{run.stderr}")
+
+    if problems:
+        return fail(label, problems)
+    print(
+        f"[{label}] {site}: stub identical to the committed one; valid client: 0 "
+        f"diagnostics and it runs (control: a planted line caught); invalid client: "
+        f"{sum(want.values())} expected diagnostics on {len({k[0] for k in want})} lines, no other"
+    )
+    for (line, rule), message in sorted(details.items()):
+        print(f"  invalid_client.py:{line}: {rule}: {message}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/dev/stubs/check_contents.py b/dev/stubs/check_contents.py
new file mode 100644
index 0000000..1470eee
--- /dev/null
+++ b/dev/stubs/check_contents.py
@@ -0,0 +1,170 @@
+"""Check the files of the wheel and the sdist against the files intended for them.
+
+Run by ``bash dev/stubs/run.sh check`` with the wheel and the sdist it built from this checkout:
+
+* the sdist holds exactly the intended source files, plus the PKG-INFO the backend writes. The
+  intended files are the checkout's files that git tracks or would track (new files git does
+  not ignore) under the top-level entries of SDIST_TOP, without tests/reference/ or
+  proofs/.lake/. That rule is the one of pyproject.toml's sdist.include and sdist.exclude,
+  repeated here so that a change to that list is caught. A file git ignores (a cache, a
+  compiled module, a local tool's output) or a file outside those entries is refused, and so is
+  an intended file left out;
+* the wheel holds exactly the package files of the sdist's python/netgraph_core/ under
+  netgraph_core/, one compiled extension module, and its .dist-info directory with the
+  metadata files and both licence notices (the project's and pybind11's);
+* both carry the stub, py.typed and the licence notices, and neither carries a _docs.py.
+
+The one file git cannot tell apart from an intended one is a new file it does not ignore inside
+a shipped directory: ``git status`` lists it, and CI builds from a clean checkout.
+
+Usage: python -I dev/stubs/check_contents.py WHEEL SDIST WORK_DIR
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+import tarfile
+import zipfile
+from collections.abc import Iterable
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+# The top-level files and directories the sdist ships (a directory ends with "/") and the
+# directories under them it leaves out.
+SDIST_TOP = (
+    ".coveragerc",
+    ".gitignore",
+    "CHANGELOG.md",
+    "CMakeLists.txt",
+    "CONTRIBUTING.md",
+    "LICENSE",
+    "README.md",
+    "pyproject.toml",
+    "bindings/",
+    "docs/",
+    "include/",
+    "proofs/",
+    "python/",
+    "src/",
+    "tests/",
+    "third_party/",
+)
+SDIST_LEFT_OUT = ("tests/reference/", "proofs/.lake/")
+PACKAGE = "python/netgraph_core/"
+NEED = {
+    "wheel": [
+        "netgraph_core/__init__.py",
+        "netgraph_core/__init__.pyi",
+        "netgraph_core/py.typed",
+    ],
+    "sdist": [
+        "python/netgraph_core/__init__.py",
+        "python/netgraph_core/__init__.pyi",
+        "python/netgraph_core/py.typed",
+        "LICENSE",
+        "third_party/pybind11/LICENSE",
+    ],
+}
+EXTENSION = re.compile(r"_netgraph_core\.[^/]+\.(so|pyd)")
+DIST_INFO = re.compile(r"netgraph_core-[^/]+\.dist-info/")
+DIST_INFO_FILES = {
+    "METADATA",
+    "WHEEL",
+    "RECORD",
+    "licenses/LICENSE",
+    "licenses/third_party/pybind11/LICENSE",
+}
+
+
+def shipped(name: str) -> bool:
+    """Whether the sdist rule selects the checkout path ``name``."""
+    if name.startswith(SDIST_LEFT_OUT):
+        return False
+    return any(
+        name.startswith(top) if top.endswith("/") else name == top for top in SDIST_TOP
+    )
+
+
+def checkout_files(root: Path) -> list[str]:
+    """The checkout's files that git tracks or would track (a new file it does not ignore),
+    as they are on disk now: a tracked file deleted from the work tree is not one."""
+    cmd = ["git", "-C", str(root), "ls-files", "-z", "--cached", "--others"]
+    try:
+        out = subprocess.run(
+            [*cmd, "--exclude-standard"], capture_output=True, check=True
+        ).stdout
+    except (OSError, subprocess.CalledProcessError) as exc:
+        sys.exit(
+            f"dev/stubs/check_contents.py: cannot list the checkout's files ({exc})"
+        )
+    names = {n for n in out.decode("utf-8").split("\0") if n}
+    return sorted(n for n in names if (root / n).is_file())
+
+
+def problems(
+    wheel: Iterable[str], sdist: Iterable[str], intended: Iterable[str]
+) -> list[str]:
+    """What is wrong with the member names of the wheel and of the sdist (the sdist's without
+    their top directory), given the checkout files ``intended`` for the sdist."""
+    wheel, sdist = set(wheel), set(sdist)
+    want_sdist = {n for n in intended if shipped(n)} | {"PKG-INFO"}
+    package = {n[len(PACKAGE) :] for n in want_sdist if n.startswith(PACKAGE)}
+    out = []
+    for kind, names in (("wheel", wheel), ("sdist", sdist)):
+        out += [f"the {kind} lacks {n}" for n in NEED[kind] if n not in names]
+        out += [
+            f"the {kind} carries {n}" for n in sorted(names) if n.endswith("_docs.py")
+        ]
+    out += [
+        f"the sdist carries {n}, not an intended file"
+        for n in sorted(sdist - want_sdist)
+    ]
+    out += [f"the sdist lacks {n}" for n in sorted(want_sdist - sdist)]
+
+    extensions = sorted(n for n in wheel if EXTENSION.fullmatch(n))
+    if len(extensions) != 1:
+        out.append(f"the wheel holds {len(extensions)} extension modules: {extensions}")
+    infos = {m.group(0) for n in wheel if (m := DIST_INFO.match(n))}
+    if len(infos) != 1:
+        out.append(
+            f"the wheel holds {len(infos)} .dist-info directories: {sorted(infos)}"
+        )
+    want_wheel = {f"netgraph_core/{n}" for n in package} | set(extensions)
+    want_wheel |= {i + n for i in infos for n in DIST_INFO_FILES}
+    out += [
+        f"the wheel carries {n}, not an intended file"
+        for n in sorted(wheel - want_wheel)
+    ]
+    out += [f"the wheel lacks {n}" for n in sorted(want_wheel - wheel)]
+    return out
+
+
+def main() -> int:
+    if len(sys.argv) != 4:
+        sys.exit("usage: check_contents.py WHEEL SDIST WORK_DIR")
+    wheel, sdist, work = sys.argv[1], sys.argv[2], Path(sys.argv[3])
+    with zipfile.ZipFile(wheel) as z:
+        wheel_names = sorted(n for n in z.namelist() if not n.endswith("/"))
+    with tarfile.open(sdist) as t:
+        members = [m for m in t if not m.isdir()]
+    tops = {m.name.split("/", 1)[0] for m in members}
+    sdist_names = sorted(m.name.split("/", 1)[1] for m in members if "/" in m.name)
+    found = list(problems(wheel_names, sdist_names, checkout_files(ROOT)))
+    if len(tops) != 1 or len(sdist_names) != len(members):
+        found.append(
+            f"the sdist's files are not all under one top directory: {sorted(tops)}"
+        )
+    for kind, names in (("wheel", wheel_names), ("sdist", sdist_names)):
+        (work / f"contents-{kind}.txt").write_text("\n".join(names) + "\n")
+        print(f"{kind}: {len(names)} files ({work}/contents-{kind}.txt)")
+    if found:
+        for p in found:
+            print(f"dev/stubs/check_contents.py: {p}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/dev/stubs/generate.py b/dev/stubs/generate.py
new file mode 100644
index 0000000..86ce127
--- /dev/null
+++ b/dev/stubs/generate.py
@@ -0,0 +1,618 @@
+"""Generate the package's type stub, python/netgraph_core/__init__.pyi, or check it for drift.
+
+Run by ``bash dev/stubs/run.sh`` with the interpreter of an environment holding an installed,
+non-editable netgraph_core (a wheel or an sdist build: the shipped configuration, without the
+private hooks) and the pinned pybind11-stubgen and ruff of pyproject.toml's ``dev`` extra.
+
+The steps, each failing loudly:
+
+1. pybind11-stubgen writes the stub of the compiled module ``_netgraph_core``.
+2. The package stub keeps the declarations of ``netgraph_core.__all__`` (the private names of the
+   compiled module and private members are not part of the package), under the package's own
+   docstring, ``__all__`` and ``__version__``.
+3. The reviewed overrides of dev/stubs/overrides.pyi replace generated declarations. An override
+   may change annotations only: its parameter names, kinds and defaults must equal the generated
+   ones, the exact generated line it replaces is quoted above it (``# generated:``) with its
+   reason (``# reason:``), and a changed generated line fails until the override is reviewed
+   again. Overloads replace one generated declaration. The one addition allowed is the marker
+   of a class the module refuses to construct (``def __init__(self, _no_public_constructor:
+   typing.Never, /)``): a type checker then rejects ``Cls()``; the marker must match the runtime
+   both ways.
+4. No ``typing.Any`` remains, except where the module accepts any object: the operand of
+   ``__eq__``/``__ne__`` and the memo of ``__deepcopy__``.
+5. The module's positional-only parameters (``/`` in its signatures, which pybind11-stubgen
+   3.0.0 drops) are positional-only in the stub too, wherever a parameter other than the
+   receiver is affected (the enums' comparison operand and ``__setstate__``'s state).
+   Native classes that refuse subclassing (their CPython type has no BASETYPE flag)
+   carry ``@typing.final``; this is read from the installed class, not an override.
+6. ruff (pinned) formats the result; ``--write`` writes it, ``--check`` compares it with the
+   committed stub and prints the difference.
+
+Usage: python -I dev/stubs/generate.py (--write | --check) [--raw DIR]
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import copy
+import difflib
+import importlib
+import inspect
+import os
+import subprocess
+import sys
+import sysconfig
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+STUB = ROOT / "python/netgraph_core/__init__.pyi"
+OVERRIDES = ROOT / "dev/stubs/overrides.pyi"
+HEADER = "# Generated from the compiled module; do not edit.\n"
+# The imports, grouped as ruff's isort rules want them (ast.unparse keeps no blank lines).
+IMPORTS = """from __future__ import annotations
+
+import collections.abc
+import fractions
+import typing
+
+import numpy
+import numpy.typing
+"""
+MARKER_PARAM = "_no_public_constructor"
+# Where the module accepts any object, typing.Any is the exact domain: the comparison operand
+# (pybind11 names it "other" on enums, "arg0" on the value classes, which define __eq__ only)
+# and copy.deepcopy's memo.
+ANY_ALLOWED = {
+    ("__eq__", "other"),
+    ("__eq__", "arg0"),
+    ("__ne__", "other"),
+    ("__deepcopy__", "memo"),
+}
+
+
+class Failure(Exception):
+    pass
+
+
+def installed_package():
+    """netgraph_core and _netgraph_core, imported from this interpreter's site-packages (an
+    installation, not the source tree or an editable build's redirect)."""
+    pkg = importlib.import_module("netgraph_core")
+    ext = importlib.import_module("_netgraph_core")
+    roots = {os.path.realpath(sysconfig.get_paths()[k]) for k in ("purelib", "platlib")}
+    for mod in (pkg, ext):
+        where = os.path.realpath(mod.__file__ or "")
+        if not any(where.startswith(r + os.sep) for r in roots):
+            raise Failure(
+                f"{mod.__name__} is imported from {where}, not from an installation in "
+                "this interpreter's site-packages (build a wheel: bash dev/stubs/run.sh)"
+            )
+    if hasattr(ext, "_fail_native_allocation"):
+        raise Failure(
+            "the installed extension carries the private hooks; generate from the "
+            "shipped configuration (a wheel or an sdist build)"
+        )
+    return pkg, ext
+
+
+def run_stubgen(raw_dir: Path) -> str:
+    cmd = [
+        sys.executable,
+        "-I",
+        "-m",
+        "pybind11_stubgen",
+        "--exit-code",
+        "-o",
+        str(raw_dir),
+        "_netgraph_core",
+    ]
+    proc = subprocess.run(cmd, capture_output=True, text=True)
+    if proc.returncode != 0 or proc.stderr.strip():
+        raise Failure(
+            f"pybind11-stubgen failed ({proc.returncode}):\n{proc.stderr}{proc.stdout}"
+        )
+    return (raw_dir / "_netgraph_core.pyi").read_text(encoding="utf-8")
+
+
+def is_private(name: str) -> bool:
+    return name.startswith("_") and not (name.startswith("__") and name.endswith("__"))
+
+
+def params(fn: ast.FunctionDef) -> list[tuple[str, str, str | None]]:
+    """(name, kind, default) of every parameter, annotations left out."""
+    a = fn.args
+    pos = [*a.posonlyargs, *a.args]
+    defaults: list[ast.expr | None] = [None] * (len(pos) - len(a.defaults))
+    defaults += list(a.defaults)
+    out = []
+    for i, (arg, d) in enumerate(zip(pos, defaults, strict=True)):
+        kind = "positional-only" if i < len(a.posonlyargs) else "positional"
+        out.append((arg.arg, kind, None if d is None else ast.unparse(d)))
+    if a.vararg:
+        out.append((a.vararg.arg, "*args", None))
+    for arg, d in zip(a.kwonlyargs, a.kw_defaults, strict=True):
+        out.append((arg.arg, "keyword-only", None if d is None else ast.unparse(d)))
+    if a.kwarg:
+        out.append((a.kwarg.arg, "**kwargs", None))
+    return out
+
+
+def is_marker(fn: ast.FunctionDef) -> bool:
+    a = fn.args
+    return (
+        fn.name == "__init__"
+        and not fn.decorator_list
+        and [x.arg for x in a.posonlyargs] == ["self", MARKER_PARAM]
+        and not (a.args or a.vararg or a.kwonlyargs or a.kwarg or a.defaults)
+        and ast.unparse(a.posonlyargs[1].annotation or ast.Constant(None))
+        == "typing.Never"
+        and ast.unparse(fn.returns or ast.Constant(None)) == "None"
+    )
+
+
+def comment_block(lines: list[str], first_line: int) -> list[str]:
+    """The comment lines directly above line ``first_line`` (1-based)."""
+    out: list[str] = []
+    i = first_line - 2
+    while i >= 0 and lines[i].strip().startswith("#"):
+        out.insert(0, lines[i].strip())
+        i -= 1
+    return out
+
+
+class Override:
+    def __init__(self, qual: str, defs: list[ast.FunctionDef], lines: list[str]):
+        self.qual = qual
+        self.defs = defs
+        first = defs[0]
+        start = min([first.lineno, *(d.lineno for d in first.decorator_list)])
+        comments = comment_block(lines, start)
+        self.reasons = [
+            c.removeprefix("# reason:").strip()
+            for c in comments
+            if c.startswith("# reason:")
+        ]
+        gen = [
+            c.removeprefix("# generated:").strip()
+            for c in comments
+            if c.startswith("# generated:")
+        ]
+        where = f"{OVERRIDES.relative_to(ROOT)}:{first.lineno} {qual}"
+        if not self.reasons or not all(self.reasons):
+            raise Failure(f"{where}: an override needs a '# reason:' line above it")
+        if len(gen) != 1:
+            raise Failure(
+                f"{where}: an override needs exactly one '# generated:' line above it "
+                "(the generated line it replaces, or '(none)' for the constructor marker)"
+            )
+        self.generated = gen[0]
+        for d in defs[1:]:
+            stray = comment_block(
+                lines, min([d.lineno, *(x.lineno for x in d.decorator_list)])
+            )
+            if any(c.startswith(("# reason:", "# generated:")) for c in stray):
+                raise Failure(
+                    f"{where}: '# reason:'/'# generated:' belong above the first overload only"
+                )
+        if len(defs) > 1 and not all(
+            any(ast.unparse(x) == "typing.overload" for x in d.decorator_list)
+            for d in defs
+        ):
+            raise Failure(
+                f"{where}: repeated declarations must all be @typing.overload"
+            )
+
+
+def load_overrides() -> dict[str, Override]:
+    text = OVERRIDES.read_text(encoding="utf-8")
+    lines = text.splitlines()
+    tree = ast.parse(text)
+    groups: dict[str, list[ast.FunctionDef]] = {}
+    order: list[str] = []
+
+    def add(qual: str, fn: ast.FunctionDef) -> None:
+        if qual in groups and order[-1] != qual:
+            raise Failure(
+                f"{OVERRIDES.name}:{fn.lineno} {qual}: overloads must be adjacent"
+            )
+        if qual not in groups:
+            order.append(qual)
+        groups.setdefault(qual, []).append(fn)
+
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef):
+            add(node.name, node)
+        elif isinstance(node, ast.ClassDef):
+            for item in node.body:
+                if isinstance(item, ast.FunctionDef):
+                    add(f"{node.name}.{item.name}", item)
+                elif not (
+                    isinstance(item, ast.Expr) and isinstance(item.value, ast.Constant)
+                ):
+                    raise Failure(
+                        f"{OVERRIDES.name}:{item.lineno}: only method overrides inside a class"
+                    )
+        elif not isinstance(node, (ast.Import, ast.ImportFrom)) and not (
+            isinstance(node, ast.Expr) and isinstance(node.value, ast.Constant)
+        ):
+            raise Failure(f"{OVERRIDES.name}:{node.lineno}: unexpected statement")
+    return {q: Override(q, groups[q], lines) for q in order}
+
+
+def generated_line(raw_lines: list[str], fn: ast.FunctionDef) -> str:
+    return raw_lines[fn.lineno - 1].strip()
+
+
+def body_of(fn: ast.FunctionDef) -> list[ast.stmt]:
+    """The generated body (the docstring or ``...``)."""
+    return copy.deepcopy(fn.body)
+
+
+def with_body(fn: ast.FunctionDef, body: list[ast.stmt]) -> ast.FunctionDef:
+    new = copy.deepcopy(fn)
+    new.body = body
+    return new
+
+
+def apply_overrides(
+    container: list[ast.stmt],
+    owner: str,
+    raw_lines: list[str],
+    overrides: dict[str, Override],
+    used: set[str],
+) -> list[ast.stmt]:
+    out: list[ast.stmt] = []
+    funcs = [n for n in container if isinstance(n, ast.FunctionDef)]
+    for node in container:
+        if not isinstance(node, ast.FunctionDef):
+            out.append(node)
+            continue
+        qual = f"{owner}.{node.name}" if owner else node.name
+        ov = overrides.get(qual)
+        if ov is None:
+            out.append(node)
+            continue
+        if sum(n.name == node.name for n in funcs) > 1:
+            raise Failure(
+                f"{qual}: generated as overloads; an override replaces one declaration"
+            )
+        used.add(qual)
+        if ov.generated == "(none)":
+            raise Failure(
+                f"{qual}: the override says '(none)', but {qual} is generated"
+            )
+        got = generated_line(raw_lines, node)
+        if got != ov.generated:
+            raise Failure(
+                f"{qual}: the generated declaration changed; review the override again\n"
+                f"  override quotes: {ov.generated}\n  generated now:   {got}"
+            )
+        want = params(node)
+        for d in ov.defs:
+            if params(d) != want:
+                raise Failure(
+                    f"{qual}: an override changes only annotations; parameters "
+                    f"{params(d)} differ from the generated {want}"
+                )
+        decos = {ast.unparse(x) for x in node.decorator_list}
+        for d in ov.defs:
+            have = {ast.unparse(x) for x in d.decorator_list} - {"typing.overload"}
+            if have != decos:
+                raise Failure(
+                    f"{qual}: decorators {sorted(have)} differ from the generated {sorted(decos)}"
+                )
+        for i, d in enumerate(ov.defs):
+            body = body_of(node) if i == 0 else [ast.Expr(ast.Constant(Ellipsis))]
+            out.append(with_body(d, body))
+    return out
+
+
+def add_markers(
+    cls: ast.ClassDef, overrides: dict[str, Override], used: set[str]
+) -> None:
+    qual = f"{cls.name}.__init__"
+    ov = overrides.get(qual)
+    if ov is None or any(
+        isinstance(n, ast.FunctionDef) and n.name == "__init__" for n in cls.body
+    ):
+        return
+    used.add(qual)
+    if ov.generated != "(none)" or len(ov.defs) != 1 or not is_marker(ov.defs[0]):
+        raise Failure(
+            f"{qual}: not generated; the only addition allowed is the constructor marker "
+            f"'def __init__(self, {MARKER_PARAM}: typing.Never, /) -> None' "
+            "with '# generated: (none)'"
+        )
+    marker = with_body(ov.defs[0], [ast.Expr(ast.Constant(Ellipsis))])
+    # After the class docstring, before the first member (the generated order is kept).
+    at = (
+        1
+        if cls.body
+        and isinstance(cls.body[0], ast.Expr)
+        and isinstance(cls.body[0].value, ast.Constant)
+        else 0
+    )
+    cls.body.insert(at, marker)
+
+
+def refuses_construction(cls: type) -> bool:
+    try:
+        cls()
+    except TypeError as exc:
+        return "No constructor defined" in str(exc)
+    return False
+
+
+def positional_only(doc: str | None) -> list[list[str]]:
+    """Per pybind11 signature of a docstring, the names its ``/`` makes positional-only."""
+    lines = (doc or "").strip("\n").split("\n")
+    if len(lines) > 1 and lines[1].strip() == "Overloaded function.":
+        sigs = [ln.split(". ", 1)[1] for ln in lines if ln[:1].isdigit() and ". " in ln]
+    else:
+        sigs = lines[:1]
+    out = []
+    for sig in sigs:
+        if "(" not in sig or ")" not in sig:
+            out.append([])
+            continue
+        inner = sig[sig.index("(") + 1 : sig.rindex(")")]
+        parts, depth, cur = [], 0, ""
+        for ch in inner:
+            depth += ch in "([{"
+            depth -= ch in ")]}"
+            if ch == "," and depth == 0:
+                parts.append(cur.strip())
+                cur = ""
+            else:
+                cur += ch
+        parts.append(cur.strip())
+        names = [p.split(":")[0].split("=")[0].strip() for p in parts]
+        out.append(names[: names.index("/")] if "/" in names else [])
+    return out
+
+
+def restore_positional_only(defs: list[ast.FunctionDef], obj, qual: str) -> None:
+    """pybind11-stubgen 3.0.0 drops the ``/`` of the module's signatures. Where the module makes
+    a parameter other than the receiver positional-only, the stub declares the same leading
+    parameters positional-only (the enums' ``__eq__``/``__ne__`` operand, ``__setstate__``'s
+    state); a lone positional-only receiver is left as generated."""
+    sigs = positional_only(getattr(obj, "__doc__", None))
+    if not any(set(names) - {"self"} for names in sigs):
+        return
+    if len(sigs) == 1:
+        sigs = sigs * len(defs)
+    if len(sigs) != len(defs):
+        raise Failure(
+            f"{qual}: {len(sigs)} module signatures, {len(defs)} stub declarations"
+        )
+    for names, fn in zip(sigs, defs, strict=True):
+        a = fn.args
+        pos = [*a.posonlyargs, *a.args]
+        if [x.arg for x in pos[: len(names)]] != names:
+            raise Failure(
+                f"{qual}: the module makes {names} positional-only; the stub starts with "
+                f"{[x.arg for x in pos[: len(names)]]}"
+            )
+        a.posonlyargs, a.args = pos[: len(names)], pos[len(names) :]
+
+
+def apply_positional_only(decls: list[ast.stmt], pkg) -> None:
+    def groups(body: list[ast.stmt]) -> dict[str, list[ast.FunctionDef]]:
+        out: dict[str, list[ast.FunctionDef]] = {}
+        for n in body:
+            if isinstance(n, ast.FunctionDef) and "property" not in {
+                ast.unparse(d) for d in n.decorator_list
+            }:
+                out.setdefault(n.name, []).append(n)
+        return out
+
+    for name, defs in groups(decls).items():
+        restore_positional_only(defs, getattr(pkg, name), name)
+    for node in decls:
+        if isinstance(node, ast.ClassDef):
+            cls = getattr(pkg, node.name)
+            for name, defs in groups(node.body).items():
+                if name in vars(cls) and not any(is_marker(d) for d in defs):
+                    restore_positional_only(
+                        defs, getattr(cls, name), f"{node.name}.{name}"
+                    )
+
+
+def check_markers(classes: dict[str, ast.ClassDef], pkg) -> None:
+    for name, node in classes.items():
+        runtime = getattr(pkg, name)
+        if issubclass(runtime, BaseException):
+            continue
+        marked = any(isinstance(n, ast.FunctionDef) and is_marker(n) for n in node.body)
+        refuses = refuses_construction(runtime)
+        if marked and not refuses:
+            raise Failure(
+                f"{name}: marked not constructible, but the module constructs it"
+            )
+        if refuses and not marked:
+            raise Failure(
+                f"{name}: the module refuses to construct it (No constructor defined); "
+                "add the constructor marker to dev/stubs/overrides.pyi"
+            )
+
+
+def check_no_any(tree: ast.Module) -> None:
+    problems = []
+
+    def visit(fn: ast.FunctionDef, owner: str) -> None:
+        a = fn.args
+        # Every place a parameter can be annotated: positional-only, positional, *args,
+        # keyword-only and **kwargs.
+        every = [*a.posonlyargs, *a.args, a.vararg, *a.kwonlyargs, a.kwarg]
+        for arg in (x for x in every if x is not None):
+            if arg.annotation is not None and "typing.Any" in ast.unparse(
+                arg.annotation
+            ):
+                if (fn.name, arg.arg) not in ANY_ALLOWED:
+                    problems.append(f"{owner}{fn.name}({arg.arg})")
+        if fn.returns is not None and "typing.Any" in ast.unparse(fn.returns):
+            problems.append(f"{owner}{fn.name} -> ...")
+
+    def scan(body: list[ast.stmt], owner: str) -> None:
+        for node in body:
+            if isinstance(node, ast.FunctionDef):
+                visit(node, owner)
+            elif isinstance(node, ast.ClassDef):
+                scan(node.body, f"{owner}{node.name}.")
+            elif isinstance(node, ast.AnnAssign) and "typing.Any" in ast.unparse(
+                node.annotation
+            ):
+                problems.append(f"{owner}{ast.unparse(node.target)}")
+
+    scan(tree.body, "")
+    if problems:
+        raise Failure(
+            "typing.Any left in the stub (add a reviewed override): "
+            + ", ".join(problems)
+        )
+
+
+def apply_final_classes(classes: dict[str, ast.ClassDef], pkg) -> None:
+    # Py_TPFLAGS_BASETYPE is CPython's public flag for whether a type can be
+    # subclassed. Read it without creating classes or running __init_subclass__.
+    base_type = 1 << 10
+    for name, node in classes.items():
+        runtime = getattr(pkg, name)
+        if not runtime.__flags__ & base_type:
+            if not any(ast.unparse(d) == "typing.final" for d in node.decorator_list):
+                node.decorator_list.append(ast.parse("typing.final", mode="eval").body)
+
+
+def build_stub(raw: str, pkg) -> str:
+    raw_lines = raw.splitlines()
+    tree = ast.parse(raw)
+    exported = list(pkg.__all__)
+    overrides = load_overrides()
+    used: set[str] = set()
+    decls: list[ast.stmt] = []
+    seen: set[str] = set()
+    classes: dict[str, ast.ClassDef] = {}
+    for node in tree.body:
+        if isinstance(node, (ast.ClassDef, ast.FunctionDef)):
+            name = node.name
+        elif isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+            name = node.target.id
+        else:
+            continue  # the module docstring, imports and the module's own __all__
+        if name == "__all__":
+            continue
+        if name not in exported:
+            if not is_private(name):
+                raise Failure(
+                    f"_netgraph_core.{name} is public but not exported by netgraph_core"
+                )
+            continue
+        seen.add(name)
+        if isinstance(node, ast.ClassDef):
+            node.body = [
+                n
+                for n in node.body
+                if not (isinstance(n, (ast.FunctionDef,)) and is_private(n.name))
+                and not (
+                    isinstance(n, ast.AnnAssign)
+                    and isinstance(n.target, ast.Name)
+                    and is_private(n.target.id)
+                )
+            ]
+            node.body = apply_overrides(
+                node.body, node.name, raw_lines, overrides, used
+            )
+            add_markers(node, overrides, used)
+            classes[name] = node
+        decls.append(node)
+    decls = apply_overrides(decls, "", raw_lines, overrides, used)
+    missing = [n for n in exported if n != "__version__" and n not in seen]
+    if missing:
+        raise Failure(f"exported by netgraph_core, not generated: {missing}")
+    unused = [q for q in overrides if q not in used]
+    if unused:
+        raise Failure(f"overrides without a generated declaration: {unused}")
+    check_markers(classes, pkg)
+    apply_positional_only(decls, pkg)
+    apply_final_classes(classes, pkg)
+
+    doc = ast.Expr(ast.Constant(inspect.cleandoc(pkg.__doc__ or "")))
+    body: list[ast.stmt] = ast.parse(f"__all__: list[str] = {exported!r}").body
+    body += ast.parse("__version__: str").body
+    body += decls
+    module = ast.Module(body=body, type_ignores=[])
+    check_no_any(module)
+    return f"{HEADER}{ast.unparse(ast.Module([doc], []))}\n\n{IMPORTS}\n{ast.unparse(module)}\n"
+
+
+def ruff_format(text: str) -> str:
+    proc = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "ruff",
+            "format",
+            "--stdin-filename",
+            str(STUB.relative_to(ROOT)),
+            "-",
+        ],
+        input=text,
+        capture_output=True,
+        text=True,
+        cwd=ROOT,
+    )
+    if proc.returncode != 0:
+        raise Failure(f"ruff format failed:\n{proc.stderr}")
+    return proc.stdout
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__.split("\n", 1)[0])
+    mode = ap.add_mutually_exclusive_group(required=True)
+    mode.add_argument("--write", action="store_true", help="write the stub")
+    mode.add_argument("--check", action="store_true", help="fail on drift")
+    ap.add_argument(
+        "--raw", type=Path, help="keep the raw pybind11-stubgen output here"
+    )
+    args = ap.parse_args()
+    try:
+        pkg, ext = installed_package()
+        print(f"generating from {ext.__file__}")
+        with tempfile.TemporaryDirectory() as tmp:
+            raw_dir = args.raw or Path(tmp)
+            raw = run_stubgen(raw_dir)
+        stub = ruff_format(build_stub(raw, pkg))
+    except Failure as exc:
+        print(f"dev/stubs/generate.py: {exc}", file=sys.stderr)
+        return 1
+    if args.write:
+        STUB.write_text(stub, encoding="utf-8")
+        print(f"wrote {STUB.relative_to(ROOT)} ({len(stub.splitlines())} lines)")
+        return 0
+    committed = STUB.read_text(encoding="utf-8") if STUB.exists() else ""
+    if committed == stub:
+        print(
+            f"{STUB.relative_to(ROOT)} is up to date ({len(stub.splitlines())} lines)"
+        )
+        return 0
+    rel = str(STUB.relative_to(ROOT))
+    sys.stdout.writelines(
+        difflib.unified_diff(
+            committed.splitlines(keepends=True),
+            stub.splitlines(keepends=True),
+            f"{rel} (committed)",
+            f"{rel} (generated)",
+        )
+    )
+    print(
+        f"dev/stubs/generate.py: {rel} differs from a fresh generation "
+        "(regenerate: bash dev/stubs/run.sh generate)",
+        file=sys.stderr,
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/dev/stubs/overrides.pyi b/dev/stubs/overrides.pyi
new file mode 100644
index 0000000..d18b3ba
--- /dev/null
+++ b/dev/stubs/overrides.pyi
@@ -0,0 +1,885 @@
+# Reviewed overrides of the generated stub python/netgraph_core/__init__.pyi (applied by
+# dev/stubs/generate.py; regenerate with bash dev/stubs/run.sh generate).
+#
+# pybind11-stubgen can only write what the compiled signatures show. The bindings take most
+# integer arguments as Python objects (to validate exact, unnarrowed values themselves), return
+# NumPy arrays without a declared dtype and optional values as plain objects, so the raw stub
+# says typing.Any, numpy.ndarray or a bare list there. Each override below restores the domain
+# the binding code accepts and the type it returns, read from bindings/python/*.cpp and checked
+# on the built module.
+#
+# Rules (enforced by the generator): an override changes annotations only (its parameter names,
+# kinds and defaults are the generated ones); "# reason:" says why; "# generated:" quotes the
+# exact generated line it replaces, and the generation fails when that line changes, so a
+# changed binding is reviewed again. Overloads replace one generated declaration. The one
+# addition is the marker of a class the module refuses to construct ("No constructor defined"):
+# __init__(self, _no_public_constructor: typing.Never, /), so a type checker rejects Cls().
+#
+# The domains, written out in full (a stub has no private aliases):
+# - an integer: typing.SupportsIndex, a Python int or a NumPy integer scalar (any object with
+#   __index__; a bool is rejected at run time, which a type cannot express);
+# - integers: collections.abc.Sequence[typing.SupportsIndex] | numpy.typing.NDArray[numpy.integer],
+#   one-dimensional (the rank and the values are checked at run time);
+# - a node set: one integer or integers;
+# - a physical number or resolution: int | float | numpy.integer | numpy.floating.
+# Arrays that the module returns carry their exact dtype; their shape (one-dimensional) and
+# whether they are read-only views are in the docstrings.
+#
+# The overrides name the classes of the generated stub, which this file does not declare.
+# ruff: noqa: F821
+
+import collections.abc
+import fractions
+import typing
+
+import numpy
+import numpy.typing
+
+class Eligibility:
+    # reason: no constructor: built by Graph.eligibility and Eligibility.intersect
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: a read-only view of the bool flags, one per edge
+    # generated: def edge_allowed(self) -> numpy.ndarray:
+    def edge_allowed(self) -> numpy.typing.NDArray[numpy.bool_]: ...
+    # reason: a read-only view of the bool flags, one per node
+    # generated: def node_allowed(self) -> numpy.ndarray:
+    def node_allowed(self) -> numpy.typing.NDArray[numpy.bool_]: ...
+
+class Graph:
+    # reason: num_nodes is an integer, the four edge arrays are integers (exact values checked by the binding)
+    # generated: def __init__(self, num_nodes: typing.Any, edge_sources: typing.Any, edge_destinations: typing.Any, edge_capacity_units: typing.Any, edge_costs: typing.Any, resolution: int | float | numpy.integer | numpy.floating) -> None:
+    def __init__(
+        self,
+        num_nodes: typing.SupportsIndex,
+        edge_sources: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_destinations: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_capacity_units: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_costs: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        resolution: int | float | numpy.integer | numpy.floating,
+    ) -> None: ...
+    # reason: a read-only int64 view
+    # generated: def edge_capacity_units(self) -> numpy.ndarray:
+    def edge_capacity_units(self) -> numpy.typing.NDArray[numpy.int64]: ...
+    # reason: a read-only int64 view
+    # generated: def edge_costs(self) -> numpy.ndarray:
+    def edge_costs(self) -> numpy.typing.NDArray[numpy.int64]: ...
+    # reason: a read-only int32 view
+    # generated: def edge_destinations(self) -> numpy.ndarray:
+    def edge_destinations(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: a read-only int32 view
+    # generated: def edge_sources(self) -> numpy.ndarray:
+    def edge_sources(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: the excluded node ids and EdgeIds are integers
+    # generated: def eligibility(self, excluded_nodes: typing.Any = (), excluded_edges: typing.Any = ()) -> Eligibility:
+    def eligibility(
+        self,
+        excluded_nodes: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer] = (),
+        excluded_edges: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer] = (),
+    ) -> Eligibility: ...
+    # reason: a read-only int32 view
+    # generated: def incoming_edges(self) -> numpy.ndarray:
+    def incoming_edges(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: a read-only int32 view
+    # generated: def incoming_offsets(self) -> numpy.ndarray:
+    def incoming_offsets(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: a read-only int32 view
+    # generated: def input_positions(self) -> numpy.ndarray:
+    def input_positions(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: a read-only int32 view
+    # generated: def outgoing_offsets(self) -> numpy.ndarray:
+    def outgoing_offsets(self) -> numpy.typing.NDArray[numpy.int32]: ...
+
+class PredecessorDAG:
+    # reason: no constructor: built by PredecessorDAG.from_csr, Path.to_dag and the searches
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: parent_offsets, parents and via_edges are integers
+    # generated: def from_csr(graph: Graph, parent_offsets: typing.Any, parents: typing.Any, via_edges: typing.Any) -> PredecessorDAG:
+    @staticmethod
+    def from_csr(
+        graph: Graph,
+        parent_offsets: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        parents: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        via_edges: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+    ) -> PredecessorDAG: ...
+    # reason: a read-only int32 view
+    # generated: def parents(self) -> numpy.ndarray:
+    def parents(self) -> numpy.typing.NDArray[numpy.int32]: ...
+    # reason: a read-only int32 view
+    # generated: def via_edges(self) -> numpy.ndarray:
+    def via_edges(self) -> numpy.typing.NDArray[numpy.int32]: ...
+
+class Path:
+    # reason: hops is a sequence of hops, each one integers (EdgeIds); a two-dimensional integer
+    # array is such a sequence too (one row per hop)
+    # generated: def __init__(self, graph: Graph, hops: typing.Any) -> None:
+    def __init__(
+        self,
+        graph: Graph,
+        hops: collections.abc.Sequence[
+            collections.abc.Sequence[typing.SupportsIndex]
+            | numpy.typing.NDArray[numpy.integer]
+        ]
+        | numpy.typing.NDArray[numpy.integer],
+    ) -> None: ...
+
+class FlowRecord:
+    # reason: no constructor: snapshots come from FlowLedger.records/record and FlowPolicy.records/record
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: a list of (EdgeId, units) pairs; units are exact Python ints
+    # generated: def edge_drops(self) -> list:
+    @property
+    def edge_drops(self) -> list[tuple[int, int]]: ...
+    # reason: a list of (EdgeId, units) pairs
+    # generated: def edge_flows(self) -> list:
+    @property
+    def edge_flows(self) -> list[tuple[int, int]]: ...
+    # reason: a list of (EdgeId, units) pairs
+    # generated: def edge_reservations(self) -> list:
+    @property
+    def edge_reservations(self) -> list[tuple[int, int]]: ...
+    # reason: an exact Python int for a Lossy flow, None otherwise
+    # generated: def offered(self) -> typing.Any:
+    @property
+    def offered(self) -> int | None: ...
+    # reason: an int, None when the route is empty
+    # generated: def min_route_cost(self) -> typing.Any:
+    @property
+    def min_route_cost(self) -> int | None: ...
+
+class FlowLedger:
+    # reason: the service and reservation baselines are integers, or None for the capacities
+    # generated: def __init__(self, graph: Graph, service_baseline: typing.Any = None, *, reservation_baseline: typing.Any = None) -> None:
+    def __init__(
+        self,
+        graph: Graph,
+        service_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        *,
+        reservation_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> None: ...
+    # reason: sources is a node set; eligibility may be None (all allowed)
+    # generated: def saturated_boundary_edges(self, sources: typing.Any, eligibility: Eligibility = None) -> list[int]:
+    def saturated_boundary_edges(
+        self,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        eligibility: Eligibility | None = None,
+    ) -> list[int]: ...
+    # reason: a read-only int64 view
+    # generated: def edge_capacity_units(self) -> numpy.ndarray:
+    def edge_capacity_units(self) -> numpy.typing.NDArray[numpy.int64]: ...
+    # reason: a FlowId is a tuple (ledger uid, id) of integers
+    # generated: def record(self, flow_id: typing.Any) -> FlowRecord:
+    def record(
+        self, flow_id: tuple[typing.SupportsIndex, typing.SupportsIndex]
+    ) -> FlowRecord: ...
+    # reason: the new baselines are integers, or None for the capacities
+    # generated: def reset(self, service_baseline: typing.Any = None, *, reservation_baseline: typing.Any = None) -> None:
+    def reset(
+        self,
+        service_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        *,
+        reservation_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> None: ...
+
+class AbsoluteCost:
+    # reason: cost is an integer
+    # generated: def __init__(self, cost: typing.Any) -> None:
+    def __init__(self, cost: typing.SupportsIndex) -> None: ...
+
+class CostStretch:
+    # reason: factor is a Fraction, a float, a NumPy floating scalar or an integer (a bool is rejected at run time)
+    # generated: def __init__(self, factor: typing.Any) -> None:
+    def __init__(
+        self,
+        factor: fractions.Fraction | float | numpy.floating | typing.SupportsIndex,
+    ) -> None: ...
+    # reason: the exact factor, a fractions.Fraction built on each access
+    # generated: def factor(self) -> typing.Any:
+    @property
+    def factor(self) -> fractions.Fraction: ...
+
+class TunnelCount:
+    # reason: per_head is an integer
+    # generated: def __init__(self, per_head: typing.Any, *, up_to: bool = False) -> None:
+    def __init__(
+        self, per_head: typing.SupportsIndex, *, up_to: bool = False
+    ) -> None: ...
+
+class DistributedTE:
+    # reason: the ceiling is AbsoluteCost, CostStretch or None; the search minimum is an integer
+    # generated: def __init__(self, tunnel_count: TunnelCount, *, cost_ceiling: typing.Any = None, min_unreserved_bandwidth: typing.Any = 0, tie_break: RouteTieBreak = ..., parallel_edges: bool = True) -> None:
+    def __init__(
+        self,
+        tunnel_count: TunnelCount,
+        *,
+        cost_ceiling: AbsoluteCost | CostStretch | None = None,
+        min_unreserved_bandwidth: typing.SupportsIndex = 0,
+        tie_break: RouteTieBreak = ...,
+        parallel_edges: bool = True,
+    ) -> None: ...
+    # reason: the ceiling given at construction: AbsoluteCost, CostStretch or None
+    # generated: def cost_ceiling(self) -> typing.Any:
+    @property
+    def cost_ceiling(self) -> AbsoluteCost | CostStretch | None: ...
+
+class Tunnel:
+    # reason: no constructor: a tunnel of ForwardingProgram.tunnels
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: the path's EdgeIds in path order, None for a tunnel that is down
+    # generated: def edges(self) -> typing.Any:
+    @property
+    def edges(self) -> tuple[int, ...] | None: ...
+
+class RouteDefinition:
+    # reason: head and weight are integers (weight checked by from_routes); route a Path or a PredecessorDAG (TypeError otherwise)
+    # generated: def __init__(self, head: typing.Any, route: typing.Any, *, weight: typing.Any = 1) -> None:
+    def __init__(
+        self,
+        head: typing.SupportsIndex,
+        route: Path | PredecessorDAG,
+        *,
+        weight: typing.SupportsIndex = 1,
+    ) -> None: ...
+
+class ForwardingProgram:
+    # reason: no constructor: made by from_routes or from_dag and returned by the policies
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: sources and destinations are node sets; routes a sequence of RouteDefinition; edge_weights and residual integers or None
+    # generated: def from_routes(graph: Graph, sources: typing.Any, destinations: typing.Any, routes: typing.Any, *, allocation: RouteAllocation | None = None, weight_basis: WeightBasis | None = None, edge_weights: typing.Any = None, residual: typing.Any = None) -> ForwardingProgram:
+    @staticmethod
+    def from_routes(
+        graph: Graph,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        routes: collections.abc.Sequence[RouteDefinition],
+        *,
+        allocation: RouteAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> ForwardingProgram: ...
+    # reason: sources and destinations are node sets; dag a PredecessorDAG; edge_weights and residual integers or None
+    # generated: def from_dag(graph: Graph, sources: typing.Any, destinations: typing.Any, dag: typing.Any, *, allocation: RouteAllocation | None = None, weight_basis: WeightBasis | None = None, edge_weights: typing.Any = None, residual: typing.Any = None) -> ForwardingProgram:
+    @staticmethod
+    def from_dag(
+        graph: Graph,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        dag: PredecessorDAG,
+        *,
+        allocation: RouteAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> ForwardingProgram: ...
+    # reason: the destination set, ascending
+    # generated: def destinations(self) -> tuple:
+    @property
+    def destinations(self) -> tuple[int, ...]: ...
+    # reason: (source, weight) pairs, or None for equal sources
+    # generated: def source_weights(self) -> typing.Any:
+    @property
+    def source_weights(self) -> tuple[tuple[int, int], ...] | None: ...
+    # reason: the source set, ascending
+    # generated: def sources(self) -> tuple:
+    @property
+    def sources(self) -> tuple[int, ...]: ...
+    # reason: the program's tunnels, ascending index
+    # generated: def tunnels(self) -> tuple:
+    @property
+    def tunnels(self) -> tuple[Tunnel, ...]: ...
+
+class ShortestPaths:
+    # reason: edge_weights one integer per edge (a sequence or an integer array) or None
+    # generated: def __init__(self, *, allocation: RouteAllocation = ..., source_allocation: SourceAllocation | None = None, weight_basis: WeightBasis | None = None, edge_weights: typing.Any = None, tie_break: RouteTieBreak = ..., multipath: bool = True, parallel_edges: bool = True) -> None:
+    def __init__(
+        self,
+        *,
+        allocation: RouteAllocation = ...,
+        source_allocation: SourceAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        tie_break: RouteTieBreak = ...,
+        multipath: bool = True,
+        parallel_edges: bool = True,
+    ) -> None: ...
+    # reason: the explicit weights, one int per edge, or None
+    # generated: def edge_weights(self) -> typing.Any:
+    @property
+    def edge_weights(self) -> tuple[int, ...] | None: ...
+
+class CentralizedTE:
+    # reason: node-indexed source weights; typed support and tunnel count
+    # generated: def __init__(self, *, source_allocation: SourceAllocation, source_weights: typing.Any = None, support: typing.Any = None, tunnel_count: typing.Any = None, prefer_headroom: bool = False) -> None:
+    def __init__(
+        self,
+        *,
+        source_allocation: SourceAllocation,
+        source_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        support: PredecessorDAG | None = None,
+        tunnel_count: TunnelCount | None = None,
+        prefer_headroom: bool = False,
+    ) -> None: ...
+    # reason: owned immutable node-indexed weights
+    # generated: def source_weights(self) -> typing.Any:
+    @property
+    def source_weights(self) -> tuple[int, ...] | None: ...
+
+class Pinned:
+    # reason: black_holes may be None
+    # generated: def __init__(self, program: ForwardingProgram, *, black_holes: Eligibility = None) -> None:
+    def __init__(
+        self, program: ForwardingProgram, *, black_holes: Eligibility | None = None
+    ) -> None: ...
+
+class FlowPolicyConfig:
+    # reason: routing is one of the four routing modes (TypeError otherwise)
+    # generated: def __init__(self, *, routing: typing.Any, admission: Admission = ...) -> None:
+    def __init__(
+        self,
+        *,
+        routing: ShortestPaths | DistributedTE | CentralizedTE | Pinned,
+        admission: Admission = ...,
+    ) -> None: ...
+    # reason: the routing mode given at construction
+    # generated: def routing(self) -> typing.Any:
+    @property
+    def routing(self) -> ShortestPaths | DistributedTE | CentralizedTE | Pinned: ...
+
+class SourceFlow:
+    # reason: no constructor: one row of PlacementResult.by_source
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def admitted(self) -> typing.Any:
+    @property
+    def admitted(self) -> int: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def total_edge_drops(self) -> typing.Any:
+    @property
+    def total_edge_drops(self) -> int: ...
+    # reason: an exact int when LOSSY, None when LOSSLESS
+    # generated: def offered(self) -> typing.Any:
+    @property
+    def offered(self) -> int | None: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def source_drops(self) -> typing.Any:
+    @property
+    def source_drops(self) -> int: ...
+
+class TunnelFlow:
+    # reason: no constructor: one row of PlacementResult.by_tunnel
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def assigned(self) -> typing.Any:
+    @property
+    def assigned(self) -> int: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def total_edge_drops(self) -> typing.Any:
+    @property
+    def total_edge_drops(self) -> int: ...
+
+class PlacementResult:
+    # reason: no constructor: returned by FlowPolicy.place and the evaluators
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def admitted(self) -> typing.Any:
+    @property
+    def admitted(self) -> int: ...
+    # reason: one SourceFlow per input source
+    # generated: def by_source(self) -> tuple:
+    @property
+    def by_source(self) -> tuple[SourceFlow, ...]: ...
+    # reason: one TunnelFlow per program tunnel
+    # generated: def by_tunnel(self) -> tuple:
+    @property
+    def by_tunnel(self) -> tuple[TunnelFlow, ...]: ...
+    # reason: a list of (EdgeId, units) pairs
+    # generated: def call_edge_drops(self) -> list:
+    @property
+    def call_edge_drops(self) -> list[tuple[int, int]]: ...
+    # reason: an exact int when LOSSY, None when LOSSLESS
+    # generated: def offered(self) -> typing.Any:
+    @property
+    def offered(self) -> int | None: ...
+    # reason: an exact int, or float('inf') after an infinite request
+    # generated: def requested(self) -> typing.Any:
+    @property
+    def requested(self) -> int | float: ...
+    # reason: an exact int (a 128-bit counter)
+    # generated: def source_drops(self) -> typing.Any:
+    @property
+    def source_drops(self) -> int: ...
+    # reason: an exact int for the controllers, None otherwise
+    # generated: def total_cost(self) -> typing.Any:
+    @property
+    def total_cost(self) -> int | None: ...
+    # reason: an exact int, None after an unlimited LOSSLESS request
+    # generated: def unadmitted(self) -> typing.Any:
+    @property
+    def unadmitted(self) -> int | None: ...
+    # reason: a list of (EdgeId, units) pairs; units are exact Python ints
+    # generated: def edge_drops(self) -> list:
+    @property
+    def edge_drops(self) -> list[tuple[int, int]]: ...
+    # reason: an int64 array when requested, else None
+    # generated: def edge_flows(self) -> typing.Any:
+    @property
+    def edge_flows(self) -> numpy.typing.NDArray[numpy.int64] | None: ...
+    # reason: an int, or float('inf') after an infinite request
+    # generated: def call_undelivered(self) -> typing.Any:
+    @property
+    def call_undelivered(self) -> int | float: ...
+    # reason: an int64 array when requested, else None
+    # generated: def residual(self) -> typing.Any:
+    @property
+    def residual(self) -> numpy.typing.NDArray[numpy.int64] | None: ...
+    # reason: an int64 array when requested, else None
+    # generated: def edge_reservations(self) -> typing.Any:
+    @property
+    def edge_reservations(self) -> numpy.typing.NDArray[numpy.int64] | None: ...
+
+class TunnelPlan:
+    # reason: no constructor: the plan of a T1 or T2 result
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: an int, or float('inf') for an unlimited design
+    # generated: def design_demand(self) -> typing.Any:
+    @property
+    def design_demand(self) -> int | float: ...
+    # reason: an exact Fraction (T2), or None for T1
+    # generated: def max_fractional_bandwidth_per_tunnel(self) -> typing.Any:
+    @property
+    def max_fractional_bandwidth_per_tunnel(self) -> fractions.Fraction | None: ...
+    # reason: (head, share) pairs
+    # generated: def design_by_head(self) -> tuple:
+    @property
+    def design_by_head(self) -> tuple[tuple[int, int], ...]: ...
+    # reason: an exact int, possibly above 2^64 (T2 with prefer_headroom), or None
+    # generated: def headroom_penalty(self) -> typing.Any:
+    @property
+    def headroom_penalty(self) -> int | None: ...
+    # reason: the live heads, ascending (T2), or None for T1
+    # generated: def heads_with_capacity(self) -> typing.Any:
+    @property
+    def heads_with_capacity(self) -> tuple[int, ...] | None: ...
+    # reason: an exact int, possibly above 2^64 (T2), or None for T1
+    # generated: def total_tunnel_cost(self) -> typing.Any:
+    @property
+    def total_tunnel_cost(self) -> int | None: ...
+
+class ShortestPathCacheStats:
+    # reason: no constructor: returned by ShortestPathCache.stats
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+
+class FlowPolicy:
+    # reason: sources and destinations are node sets; eligibility and cache may be None
+    # generated: def __init__(self, ledger: FlowLedger, sources: typing.Any, destinations: typing.Any, config: FlowPolicyConfig, eligibility: Eligibility = None, cache: ShortestPathCache = None) -> None:
+    def __init__(
+        self,
+        ledger: FlowLedger,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        config: FlowPolicyConfig,
+        eligibility: Eligibility | None = None,
+        cache: ShortestPathCache | None = None,
+    ) -> None: ...
+    # reason: offer is integer units or float('inf') (a NumPy floating +inf too); outputs may be None; the result is a PlacementResult
+    # generated: def place(self, offer: typing.Any, outputs: typing.Any = None) -> typing.Any:
+    def place(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult: ...
+    # reason: offer and design_demand are integer units or float('inf') (design_demand may be None); outputs may be None; the result is a PlacementResult
+    # generated: def evaluate(self, offer: typing.Any, *, design_demand: typing.Any = None, outputs: typing.Any = None) -> typing.Any:
+    def evaluate(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult: ...
+    # reason: offer is integer units or float('inf'); black_holes and outputs may be None; the result is a PlacementResult
+    # generated: def forward(self, offer: typing.Any, *, black_holes: typing.Any = None, outputs: typing.Any = None) -> typing.Any:
+    def forward(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        black_holes: Eligibility | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult: ...
+    # reason: offer and design_demand are integer units or float('inf') (design_demand may be None); outputs may be None; the result is a PlacementResult
+    # generated: def replace(self, offer: typing.Any, *, design_demand: typing.Any = None, outputs: typing.Any = None) -> typing.Any:
+    def replace(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult: ...
+    # reason: a FlowId is a tuple (ledger uid, id) of integers
+    # generated: def record(self, flow_id: typing.Any) -> FlowRecord:
+    def record(
+        self, flow_id: tuple[typing.SupportsIndex, typing.SupportsIndex]
+    ) -> FlowRecord: ...
+
+class Place:
+    # reason: policy is a FlowPolicy; offer is integer units or a float (a NumPy floating value too), kept as given
+    # generated: def __init__(self, policy: typing.Any, offer: typing.Any) -> None:
+    def __init__(
+        self, policy: FlowPolicy, offer: typing.SupportsIndex | float | numpy.floating
+    ) -> None: ...
+    # reason: the offer as given, an int or a float
+    # generated: def offer(self) -> typing.Any:
+    @property
+    def offer(self) -> int | float: ...
+    # reason: the FlowPolicy given
+    # generated: def policy(self) -> typing.Any:
+    @property
+    def policy(self) -> FlowPolicy: ...
+
+class Replace:
+    # reason: policy is a FlowPolicy; offer and design_demand are integer units or a float (a NumPy floating value too), kept as given; design_demand may be None
+    # generated: def __init__(self, policy: typing.Any, offer: typing.Any, *, design_demand: typing.Any = None) -> None:
+    def __init__(
+        self,
+        policy: FlowPolicy,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+    ) -> None: ...
+    # reason: the design as given, an int or a float, or None
+    # generated: def design_demand(self) -> typing.Any:
+    @property
+    def design_demand(self) -> int | float | None: ...
+    # reason: the offer as given, an int or a float
+    # generated: def offer(self) -> typing.Any:
+    @property
+    def offer(self) -> int | float: ...
+    # reason: the FlowPolicy given
+    # generated: def policy(self) -> typing.Any:
+    @property
+    def policy(self) -> FlowPolicy: ...
+
+class Forward:
+    # reason: policy is a FlowPolicy; offer is integer units or a float (a NumPy floating value too), kept as given; black_holes may be None
+    # generated: def __init__(self, policy: typing.Any, offer: typing.Any, *, black_holes: typing.Any = None) -> None:
+    def __init__(
+        self,
+        policy: FlowPolicy,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        black_holes: Eligibility | None = None,
+    ) -> None: ...
+    # reason: the Eligibility given, or None
+    # generated: def black_holes(self) -> typing.Any:
+    @property
+    def black_holes(self) -> Eligibility | None: ...
+    # reason: the offer as given, an int or a float
+    # generated: def offer(self) -> typing.Any:
+    @property
+    def offer(self) -> int | float: ...
+    # reason: the FlowPolicy given
+    # generated: def policy(self) -> typing.Any:
+    @property
+    def policy(self) -> FlowPolicy: ...
+
+class EvaluationOptions:
+    # reason: eligibility, cache, outputs, design_demand and offer may be None; design_demand and offer are integer units or a float, kept as given
+    # generated: def __init__(self, config: FlowPolicyConfig, *, eligibility: Eligibility = None, cache: ShortestPathCache = None, outputs: typing.Any = None, design_demand: typing.Any = None, offer: typing.Any = None) -> None:
+    def __init__(
+        self,
+        config: FlowPolicyConfig,
+        *,
+        eligibility: Eligibility | None = None,
+        cache: ShortestPathCache | None = None,
+        outputs: OutputOptions | None = None,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        offer: typing.SupportsIndex | float | numpy.floating | None = None,
+    ) -> None: ...
+    # reason: the design as given, an int or a float, or None
+    # generated: def design_demand(self) -> typing.Any:
+    @property
+    def design_demand(self) -> int | float | None: ...
+    # reason: the offer as given, an int or a float, or None
+    # generated: def offer(self) -> typing.Any:
+    @property
+    def offer(self) -> int | float | None: ...
+
+class SensitivityEntry:
+    # reason: no constructor: the entries of a SensitivityResult
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+
+class SensitivityResult:
+    # reason: no constructor: returned by evaluate_edge_failures
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+
+class KspOptions:
+    # reason: k is an integer; the ceiling is AbsoluteCost, CostStretch or None; residual is integers or None; eligibility may be None (each validated by ksp)
+    # generated: def __init__(self, k: typing.Any, *, tie_break: RouteTieBreak = ..., parallel_edges: bool = True, cost_ceiling: typing.Any = None, residual: typing.Any = None, eligibility: Eligibility = None) -> None:
+    def __init__(
+        self,
+        k: typing.SupportsIndex,
+        *,
+        tie_break: RouteTieBreak = ...,
+        parallel_edges: bool = True,
+        cost_ceiling: AbsoluteCost | CostStretch | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        eligibility: Eligibility | None = None,
+    ) -> None: ...
+    # reason: the k given at construction (an integer)
+    # generated: def k(self) -> typing.Any:
+    @property
+    def k(self) -> typing.SupportsIndex: ...
+    # reason: the ceiling given at construction
+    # generated: def cost_ceiling(self) -> typing.Any:
+    @property
+    def cost_ceiling(self) -> AbsoluteCost | CostStretch | None: ...
+    # reason: the residual given at construction (the same object)
+    # generated: def residual(self) -> typing.Any:
+    @property
+    def residual(
+        self,
+    ) -> (
+        collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ): ...
+
+class SpfOptions:
+    # reason: targets is a node set or None; residual is integers or None; min_residual is an integer; eligibility may be None (each validated by spf)
+    # generated: def __init__(self, direction: Direction, *, targets: typing.Any = None, tie_break: RouteTieBreak = ..., multipath: bool = True, parallel_edges: bool = True, residual: typing.Any = None, min_residual: typing.Any = 1, eligibility: Eligibility = None) -> None:
+    def __init__(
+        self,
+        direction: Direction,
+        *,
+        targets: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        tie_break: RouteTieBreak = ...,
+        multipath: bool = True,
+        parallel_edges: bool = True,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        min_residual: typing.SupportsIndex = 1,
+        eligibility: Eligibility | None = None,
+    ) -> None: ...
+    # reason: the min_residual given at construction (an integer)
+    # generated: def min_residual(self) -> typing.Any:
+    @property
+    def min_residual(self) -> typing.SupportsIndex: ...
+    # reason: the residual given at construction (the same object)
+    # generated: def residual(self) -> typing.Any:
+    @property
+    def residual(
+        self,
+    ) -> (
+        collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ): ...
+    # reason: the targets given at construction (the same object)
+    # generated: def targets(self) -> typing.Any:
+    @property
+    def targets(
+        self,
+    ) -> (
+        typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ): ...
+
+class SpfResult:
+    # reason: no constructor: returned by spf
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    # reason: a read-only int64 array for a full search, None with targets
+    # generated: def costs(self) -> typing.Any:
+    @property
+    def costs(self) -> numpy.typing.NDArray[numpy.int64] | None: ...
+    # reason: always a PredecessorDAG
+    # generated: def dag(self) -> typing.Any:
+    @property
+    def dag(self) -> PredecessorDAG: ...
+    # reason: the nearest targets' cost, None when no target is reached and for a full search
+    # generated: def target_cost(self) -> typing.Any:
+    @property
+    def target_cost(self) -> int | None: ...
+
+# reason: vectors give float64 arrays; int and NumPy integer scalars give float; another index protocol may also be a sequence
+# generated: def as_float(x: typing.Any, resolution: int | float | numpy.integer | numpy.floating) -> typing.Any:
+@typing.overload
+def as_float(
+    x: collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> numpy.typing.NDArray[numpy.float64]: ...
+@typing.overload
+def as_float(
+    x: int | numpy.integer, resolution: int | float | numpy.integer | numpy.floating
+) -> float: ...
+@typing.overload
+def as_float(
+    x: typing.SupportsIndex, resolution: int | float | numpy.integer | numpy.floating
+) -> float | numpy.typing.NDArray[numpy.float64]: ...
+
+# reason: pairs of node sets, each pair a length-2 sequence (sources, destinations), an integer array included (so pairs may be an integer array of shape (k, 2), or (k, 2, m) for sets of m nodes); options is EvaluationOptions; per_pair_eligibility has one Eligibility or None per pair; workers is an integer or None; one PlacementResult per pair
+# generated: def evaluate_pairs(graph: Graph, pairs: typing.Any, options: typing.Any, per_pair_eligibility: typing.Any = None, workers: typing.Any = None) -> list:
+def evaluate_pairs(
+    graph: Graph,
+    pairs: collections.abc.Sequence[
+        collections.abc.Sequence[
+            typing.SupportsIndex
+            | collections.abc.Sequence[typing.SupportsIndex]
+            | numpy.typing.NDArray[numpy.integer]
+        ]
+        | numpy.typing.NDArray[numpy.integer]
+    ]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+    per_pair_eligibility: collections.abc.Sequence[Eligibility | None] | None = None,
+    workers: typing.SupportsIndex | None = None,
+) -> list[PlacementResult]: ...
+
+# reason: ledger is a FlowLedger; actions a sequence of Place, Replace and Forward; mode a BatchMode; outputs may be None (TypeError otherwise)
+# generated: def apply_actions(ledger: typing.Any, actions: typing.Any, *, mode: typing.Any = ..., outputs: typing.Any = None) -> list[PlacementResult]:
+def apply_actions(
+    ledger: FlowLedger,
+    actions: collections.abc.Sequence[Place | Replace | Forward],
+    *,
+    mode: BatchMode = ...,
+    outputs: OutputOptions | None = None,
+) -> list[PlacementResult]: ...
+
+# reason: sources and destinations are node sets; options is EvaluationOptions (TypeError otherwise)
+# generated: def evaluate_demand(graph: Graph, sources: typing.Any, destinations: typing.Any, options: typing.Any) -> typing.Any:
+def evaluate_demand(
+    graph: Graph,
+    sources: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    destinations: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+) -> PlacementResult: ...
+
+# reason: source and destination are integers; options is KspOptions; a list of (cost, Path)
+# generated: def ksp(graph: Graph, source: typing.Any, destination: typing.Any, options: typing.Any) -> list:
+def ksp(
+    graph: Graph,
+    source: typing.SupportsIndex,
+    destination: typing.SupportsIndex,
+    options: KspOptions,
+) -> list[tuple[int, Path]]: ...
+
+# reason: source, destination and max_paths are integers (max_paths may be None); a list of Path
+# generated: def resolve_to_paths(graph: Graph, dag: PredecessorDAG, source: typing.Any, destination: typing.Any, split_parallel_edges: bool = False, max_paths: typing.Any = None) -> list:
+def resolve_to_paths(
+    graph: Graph,
+    dag: PredecessorDAG,
+    source: typing.SupportsIndex,
+    destination: typing.SupportsIndex,
+    split_parallel_edges: bool = False,
+    max_paths: typing.SupportsIndex | None = None,
+) -> list[Path]: ...
+
+# reason: sources and destinations are node sets; options is EvaluationOptions; workers is an integer or None
+# generated: def evaluate_edge_failures(graph: Graph, sources: typing.Any, destinations: typing.Any, options: typing.Any, workers: typing.Any = None) -> typing.Any:
+def evaluate_edge_failures(
+    graph: Graph,
+    sources: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    destinations: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+    workers: typing.SupportsIndex | None = None,
+) -> SensitivityResult: ...
+
+# reason: roots is a node set; options is SpfOptions (TypeError otherwise)
+# generated: def spf(graph: Graph, roots: typing.Any, options: typing.Any) -> typing.Any:
+def spf(
+    graph: Graph,
+    roots: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: SpfOptions,
+) -> SpfResult: ...
+
+# reason: scalars give int, Python sequences int64 arrays; unknown-rank arrays may be 0-d (int) or 1-d (array)
+# generated: def to_units(x: typing.Any, resolution: int | float | numpy.integer | numpy.floating) -> typing.Any:
+@typing.overload
+def to_units(
+    x: int | float | numpy.floating | numpy.integer,
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> int: ...
+@typing.overload
+def to_units(
+    x: collections.abc.Sequence[int | float | numpy.floating | numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> numpy.typing.NDArray[numpy.int64]: ...
+@typing.overload
+def to_units(
+    x: numpy.typing.NDArray[numpy.floating | numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> int | numpy.typing.NDArray[numpy.int64]: ...
diff --git a/dev/stubs/run.sh b/dev/stubs/run.sh
new file mode 100755
index 0000000..3eec41c
--- /dev/null
+++ b/dev/stubs/run.sh
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# The generated type stub python/netgraph_core/__init__.pyi: regenerate it, or check it.
+#
+#   bash dev/stubs/run.sh generate
+#       Build a wheel of this checkout (the shipped configuration, without the private hooks),
+#       install it into a fresh venv and rewrite the stub from it (dev/stubs/generate.py:
+#       pybind11-stubgen, the reviewed overrides of dev/stubs/overrides.pyi, ruff format).
+#       Run after any change to a binding's signature or docstring, then commit the stub.
+#   bash dev/stubs/run.sh check                                         (make stubs-check, CI)
+#       0. the tools' rules (no build, a few seconds): dev/stubs/test_generate.py provokes each
+#          refusal of generate.py once on a small synthetic stub and expects its message, and
+#          runs its --write and --check on it; dev/stubs/test_checks.py provokes each refusal of
+#          the contents check (step 1) on synthetic file lists, and each abnormal end of Pyright
+#          and each comparison rule of the client check (step 3) on a fake Pyright;
+#       1. contents: the sdist holds exactly the intended source files of this checkout (the
+#          rule of pyproject.toml's sdist.include, applied to the files git tracks or would
+#          track) and the wheel exactly the package, its extension and its metadata; both carry
+#          the stub, py.typed and both licence notices, and no _docs.py
+#          (dev/stubs/check_contents.py);
+#       2. drift: the committed stub equals a fresh generation from the wheel;
+#       3. clients, against the installed wheel and against an installation built from the
+#          sdist: tests/typing/valid_client.py type-checks without a diagnostic and runs, and
+#          every marked line of tests/typing/invalid_client.py gets exactly its expected Pyright
+#          diagnostic (dev/stubs/check_clients.py).
+#
+# Everything happens in STUBS_DIR (default build/stubs, emptied first): its own venvs with the
+# pinned tools of pyproject.toml's dev extra (pybind11-stubgen, pyright, ruff, build) and the
+# pins of .github/ci-constraints.txt, its own build directory. The development venv and the
+# shared build directory are not touched. PYTHON names the interpreter (default python3, 3.11
+# or newer); CMAKE_BUILD_PARALLEL_LEVEL bounds the builds.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+ROOT=$PWD
+PYTHON=${PYTHON:-python3}
+mode=${1:-}
+case "$mode" in
+    generate|check) ;;
+    *) echo 'Usage: bash dev/stubs/run.sh generate|check' >&2; exit 2 ;;
+esac
+die() { echo "dev/stubs/run.sh: $*" >&2; exit 1; }
+
+"$PYTHON" -c 'import sys; sys.exit(sys.version_info < (3, 11))' \
+    || die "$PYTHON is older than Python 3.11"
+if [[ "$mode" == check ]]; then
+    echo "== the tools' rules"
+    "$PYTHON" -I -B dev/stubs/test_generate.py
+    "$PYTHON" -I -B dev/stubs/test_checks.py
+fi
+if [[ "$(uname -s)" == Darwin ]]; then
+    CC=$(xcrun --find clang)
+    CXX=$(xcrun --find clang++)
+    export CC CXX
+    export MACOSX_DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-15.0}"
+fi
+# The pins reach every pip call and every build environment: PIP_CONSTRAINT the direct installs
+# and the environments of `python -m build` (which fills them with a direct install),
+# PIP_BUILD_CONSTRAINT the environment pip makes itself to build the sdist (pip 26.2 and newer
+# apply only build constraints there; a pip older than 25.3 ignores the variable and passes
+# PIP_CONSTRAINT on).
+export PIP_CONSTRAINT="$ROOT/.github/ci-constraints.txt"
+export PIP_BUILD_CONSTRAINT="$ROOT/.github/ci-constraints.txt"
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORK=${STUBS_DIR:-build/stubs}
+rm -rf "$WORK"
+mkdir -p "$WORK"
+WORK=$(cd "$WORK" && pwd)
+
+# The tools as pinned in pyproject.toml's dev extra.
+TOOLS=$("$PYTHON" - <<'PY'
+import re
+import tomllib
+
+with open("pyproject.toml", "rb") as f:
+    dev = tomllib.load(f)["project"]["optional-dependencies"]["dev"]
+want = {"pybind11-stubgen", "pyright", "ruff", "build"}
+found = {re.split(r"[\s=<>!~;\[]", r, maxsplit=1)[0].lower(): r for r in dev}
+missing = want - set(found)
+if missing:
+    raise SystemExit(f"pyproject.toml's dev extra lacks {sorted(missing)}")
+# The shell splits the printed list on spaces.
+spaced = [found[name] for name in sorted(want) if any(c.isspace() for c in found[name])]
+if spaced:
+    raise SystemExit(f"pyproject.toml's dev extra writes {spaced} with a space; remove it")
+print(" ".join(found[name] for name in sorted(want)))
+PY
+)
+
+# new_env NAME: a fresh venv with NumPy and the tools; prints its interpreter. It runs inside
+# $(...), where bash turns set -e off, so every step returns its own failure: the caller's
+# assignment then fails and stops the run.
+new_env() {
+    "$PYTHON" -m venv "$WORK/$1" || return
+    "$WORK/$1/bin/python" -m pip install -q -U pip >&2 || return  # the pinned pip (PIP_CONSTRAINT)
+    # shellcheck disable=SC2086  # TOOLS: requirement strings without spaces (checked above)
+    "$WORK/$1/bin/python" -m pip install -q numpy $TOOLS >&2 || return
+    echo "$WORK/$1/bin/python"
+}
+
+echo "== tools: $TOOLS"
+WPY=$(new_env wheel-env)
+echo "== the wheel of this checkout (hooks off; build directory $WORK/wheel-build)"
+"$WPY" -m build --wheel --outdir "$WORK/dist" --config-setting=build-dir="$WORK/wheel-build" . \
+    > "$WORK/build-wheel.log" 2>&1 || { tail -40 "$WORK/build-wheel.log" >&2; die "the wheel build failed"; }
+wheels=("$WORK"/dist/*.whl)
+[[ ${#wheels[@]} -eq 1 && -f ${wheels[0]} ]] || die "expected one wheel in $WORK/dist"
+"$WPY" -m pip install -q --no-index --no-deps "${wheels[0]}"
+
+if [[ "$mode" == generate ]]; then
+    "$WPY" -I dev/stubs/generate.py --write --raw "$WORK/raw"
+    echo "Regenerated; check it with: bash dev/stubs/run.sh check"
+    exit 0
+fi
+
+echo "== the sdist"
+"$WPY" -m build --sdist --outdir "$WORK/dist" . > "$WORK/build-sdist.log" 2>&1 \
+    || { tail -40 "$WORK/build-sdist.log" >&2; die "the sdist build failed"; }
+sdists=("$WORK"/dist/*.tar.gz)
+[[ ${#sdists[@]} -eq 1 && -f ${sdists[0]} ]] || die "expected one sdist in $WORK/dist"
+
+echo "== contents"
+"$WPY" -I dev/stubs/check_contents.py "${wheels[0]}" "${sdists[0]}" "$WORK"
+
+echo "== drift"
+"$WPY" -I dev/stubs/generate.py --check --raw "$WORK/raw"
+
+echo "== clients against the installed wheel"
+"$WPY" -I dev/stubs/check_clients.py wheel "$WORK/clients-wheel"
+
+echo "== clients against an installation built from the sdist"
+SPY=$(new_env sdist-env)
+"$SPY" -m pip install -q --no-deps "${sdists[0]}" > "$WORK/install-sdist.log" 2>&1 \
+    || { tail -40 "$WORK/install-sdist.log" >&2; die "installing the sdist failed"; }
+"$SPY" -I dev/stubs/check_clients.py sdist "$WORK/clients-sdist"
+echo "Stub, package contents and typed clients: OK"
diff --git a/dev/stubs/test_checks.py b/dev/stubs/test_checks.py
new file mode 100644
index 0000000..49b7f1f
--- /dev/null
+++ b/dev/stubs/test_checks.py
@@ -0,0 +1,439 @@
+"""Negative controls of the two package checks of ``bash dev/stubs/run.sh check``.
+
+* check_contents.py: its sdist rule equals pyproject.toml's file list; the files of a checkout
+  it takes as intended are the ones git tracks or would track; and on synthetic member lists,
+  every kind of file it must refuse (a stray or ignored file, a left-out developer file, a
+  missing file, a second extension module, ...) is refused, while the intended lists pass.
+* check_clients.py: Pyright is replaced by a small program that prints a real run's output for
+  the clients and then ends abnormally in one of its runs (killed by a signal, a fatal exit
+  status, output that is not its report, a report that disagrees with the status); each must
+  stop the check, and the same program ending normally must pass it. The same program also
+  breaks each comparison rule in turn (search paths without the installation or with the source
+  tree, a diagnostic on the valid client, a required case without its mark, a diagnostic count
+  differing from the marks, a control line with no diagnostic, a valid client that does not
+  run): each must fail the check with that rule's message and no other.
+
+Nothing is built or installed. Run by ``bash dev/stubs/run.sh check``, or directly:
+
+    python -I -B dev/stubs/test_checks.py
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import tomllib
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import check_clients
+import check_contents
+
+ROOT = Path(__file__).resolve().parents[2]
+
+# A checkout's files as git lists them: the intended sdist files and every kind it leaves out.
+SHIPPED = [
+    ".coveragerc",
+    ".gitignore",
+    "CHANGELOG.md",
+    "CMakeLists.txt",
+    "CONTRIBUTING.md",
+    "LICENSE",
+    "README.md",
+    "pyproject.toml",
+    "bindings/python/module.cpp",
+    "docs/semantics.md",
+    "docs/formal/theorems/round-robin.md",
+    "include/netgraph/core/graph.hpp",
+    "proofs/lean-toolchain",
+    "proofs/lake-manifest.json",
+    "proofs/NetGraphCore.lean",
+    "proofs/Checks/audit.py",
+    "python/netgraph_core/__init__.py",
+    "python/netgraph_core/__init__.pyi",
+    "python/netgraph_core/py.typed",
+    "src/graph.cpp",
+    "tests/py/test_graph.py",
+    "tests/data/policy_fixtures.json",
+    "third_party/pybind11/LICENSE",
+]
+LEFT_OUT = [
+    "AGENTS.md",
+    "CMakeLists.txt.user",
+    "CLAUDE.md",
+    "Makefile",
+    ".pre-commit-config.yaml",
+    ".github/workflows/tests.yml",
+    ".superset/config.json",
+    "dev/run-checks.sh",
+    "dev/proofs/README.md",
+    "tests/reference/policy/README.md",
+    "proofs/.lake/build/lib/lean/NetGraphCore.olean",
+    "proofs/.lake/packages/mathlib/Mathlib.lean",
+]
+INFO = "netgraph_core-0.12.0.dist-info/"
+WHEEL = [
+    "_netgraph_core.cpython-314-darwin.so",
+    "netgraph_core/__init__.py",
+    "netgraph_core/__init__.pyi",
+    "netgraph_core/py.typed",
+] + [INFO + n for n in sorted(check_contents.DIST_INFO_FILES)]
+SDIST = SHIPPED + ["PKG-INFO"]
+
+
+class Contents(unittest.TestCase):
+    def problems(self, wheel=WHEEL, sdist=SDIST, intended=SHIPPED + LEFT_OUT):
+        return check_contents.problems(wheel, sdist, intended)
+
+    def refused(self, want: str, **lists) -> None:
+        got = self.problems(**lists)
+        self.assertIn(want, got)
+
+    def test_the_rule_is_pyproject_toml_s(self):
+        with open(ROOT / "pyproject.toml", "rb") as f:
+            sdist = tomllib.load(f)["tool"]["scikit-build"]["sdist"]
+        self.assertEqual(sdist["inclusion-mode"], "explicit")
+        self.assertEqual(
+            sorted(p.lstrip("/") for p in sdist["include"]),
+            sorted(check_contents.SDIST_TOP),
+        )
+        left_out = [p.lstrip("/") for p in sdist["exclude"] if p.startswith("/")]
+        self.assertEqual(sorted(left_out), sorted(check_contents.SDIST_LEFT_OUT))
+
+    def test_the_intended_lists_pass(self):
+        self.assertEqual(self.problems(), [])
+        self.assertEqual(
+            [n for n in SHIPPED + LEFT_OUT if check_contents.shipped(n)], SHIPPED
+        )
+
+    def test_the_sdist_refuses_every_other_file(self):
+        for stray in (
+            ".playwright-mcp/console.log",
+            "notes.txt",
+            "tests/py/__pycache__/test_graph.cpython-314.pyc",
+            "python/netgraph_core/_netgraph_core.cpython-314-darwin.so",
+            *LEFT_OUT,
+        ):
+            self.refused(
+                f"the sdist carries {stray}, not an intended file",
+                sdist=SDIST + [stray],
+            )
+        # A stray file the checkout holds: only the files the rule ships are intended.
+        self.refused(
+            "the sdist carries notes.txt, not an intended file",
+            sdist=SDIST + ["notes.txt"],
+            intended=SHIPPED + LEFT_OUT + ["notes.txt"],
+        )
+
+    def test_the_sdist_refuses_a_missing_file(self):
+        for name in SDIST:
+            rest = [n for n in SDIST if n != name]
+            self.refused(f"the sdist lacks {name}", sdist=rest)
+        # Required even when the checkout lost it.
+        self.refused(
+            "the sdist lacks python/netgraph_core/py.typed",
+            sdist=[n for n in SDIST if not n.endswith("py.typed")],
+            intended=[n for n in SHIPPED if not n.endswith("py.typed")],
+        )
+
+    def test_the_wheel_refuses_every_other_file(self):
+        for stray in (
+            "netgraph_core/notes.txt",
+            "netgraph_core/__pycache__/__init__.cpython-314.pyc",
+            INFO + "entry_points.txt",
+            "tests/py/test_graph.py",
+        ):
+            self.refused(
+                f"the wheel carries {stray}, not an intended file",
+                wheel=WHEEL + [stray],
+            )
+        for name in WHEEL:
+            if name.startswith("netgraph_core/") or name.startswith(INFO):
+                rest = [n for n in WHEEL if n != name]
+                self.refused(f"the wheel lacks {name}", wheel=rest)
+        two = WHEEL + ["_netgraph_core.cpython-313-darwin.so"]
+        self.assertTrue(
+            any("2 extension modules" in p for p in self.problems(wheel=two))
+        )
+        none = [n for n in WHEEL if not n.startswith("_netgraph_core.")]
+        self.assertTrue(
+            any("0 extension modules" in p for p in self.problems(wheel=none))
+        )
+        other = WHEEL + ["netgraph_core-0.11.0.dist-info/METADATA"]
+        self.assertTrue(any("2 .dist-info" in p for p in self.problems(wheel=other)))
+
+    def test_no_docs_module(self):
+        self.refused(
+            "the wheel carries netgraph_core/_docs.py",
+            wheel=WHEEL + ["netgraph_core/_docs.py"],
+        )
+        docs = "python/netgraph_core/_docs.py"
+        self.refused(
+            f"the sdist carries {docs}",
+            sdist=SDIST + [docs],
+            wheel=WHEEL + ["netgraph_core/_docs.py"],
+            intended=SHIPPED + [docs],
+        )
+
+    def test_checkout_files(self):
+        """Tracked files and new files git does not ignore; not an ignored file, nor a tracked
+        file deleted from the work tree."""
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+
+            def git(*args: str) -> None:
+                subprocess.run(
+                    ["git", "-C", tmp, *args], check=True, capture_output=True
+                )
+
+            git("init", "-q")
+            files = {
+                ".gitignore": "__pycache__/\n",
+                "src/a.cpp": "",
+                "src/gone.cpp": "",
+                "a dir/with space.txt": "",
+            }
+            for name, text in files.items():
+                (root / name).parent.mkdir(parents=True, exist_ok=True)
+                (root / name).write_text(text)
+            git("add", "-A")
+            (root / "src/gone.cpp").unlink()
+            (root / "src/new.cpp").write_text("")
+            (root / "src/__pycache__").mkdir()
+            (root / "src/__pycache__/m.pyc").write_text("")
+            self.assertEqual(
+                check_contents.checkout_files(root),
+                [".gitignore", "a dir/with space.txt", "src/a.cpp", "src/new.cpp"],
+            )
+
+
+# Stands in for Pyright: in the project directory it is given, it reports one diagnostic per
+# rule of each "# expect:" marker and one for the control's planted line, as a real run does,
+# and prints the search paths of FAKE_PATHS (os.pathsep-separated). FAKE_BREAK names the run
+# that ends abnormally or reports wrongly (verbose, report or control) and FAKE_HOW how: "drop"
+# loses the run's first diagnostic, "extra-valid" and "extra-invalid" add one on line 1 of that
+# client.
+FAKE_PYRIGHT = r"""
+import json, os, re, signal, sys
+from pathlib import Path
+
+args = sys.argv[1:]
+work = Path(args[args.index("--project") + 1])
+run = "verbose" if "--verbose" in args else ("control" if work.name == "control" else "report")
+how = os.environ["FAKE_HOW"] if run == os.environ["FAKE_BREAK"] else "normal"
+def diag(f, n, rule):
+    span = {"line": n, "character": 0}
+    return {"file": str(f), "severity": "error", "rule": rule,
+            "message": "a diagnostic", "range": {"start": span, "end": span}}
+diags = []
+for f in sorted(work.glob("*client.py")):
+    for n, line in enumerate(f.read_text().splitlines()):
+        m = re.search(r"#\s*expect:\s*(\w+(?:\s*,\s*\w+)*)\s*$", line)
+        rules = re.split(r"\s*,\s*", m.group(1)) if m else []
+        if line == "oops: str = g.num_edges()":
+            rules = ["reportAssignmentType"]
+        diags += [diag(f, n, rule) for rule in rules]
+if how == "drop":
+    del diags[0]
+if how.startswith("extra-"):
+    diags.append(diag(work / (how[len("extra-"):] + "_client.py"), 0, "reportExtra"))
+errors = len(diags)
+status = 1 if errors else 0
+if run == "verbose":
+    paths = os.environ["FAKE_PATHS"].split(os.pathsep)
+    print("Search paths for file:///\n" + "\n".join("  " + p for p in paths))
+else:
+    report = {"generalDiagnostics": diags, "summary": {"errorCount": errors}}
+    if how == "no-diagnostics":
+        del report["generalDiagnostics"]
+    if how == "no-count":
+        del report["summary"]["errorCount"]
+    if how == "text-count":
+        report["summary"]["errorCount"] = str(errors)
+    if how == "disagree":
+        status = 1 - status
+    print("[1, 2]" if how == "list" else
+          "Pyright crashed" if how == "not-json" else json.dumps(report))
+sys.stdout.flush()
+if how == "signal":
+    os.kill(os.getpid(), signal.SIGTERM)
+sys.exit({"exit-2": 2, "exit-3": 3, "exit-4": 4}.get(how, status))
+"""
+
+
+class Pyright(unittest.TestCase):
+    """``check_clients.main`` with Pyright replaced by FAKE_PYRIGHT (a real child process) and
+    the installation by a directory of its own; the valid client's run ends as `client_run`
+    says (status, stderr), and the clients come from `clients` (tests/typing by default)."""
+
+    def setUp(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        self.tmp = Path(os.path.realpath(tmp.name))
+        self.site = self.tmp / "site"
+        (self.site / "netgraph_core").mkdir(parents=True)
+        self.fake = self.tmp / "fake_pyright.py"
+        self.fake.write_text(FAKE_PYRIGHT)
+
+    def main(
+        self,
+        brk: str = "none",
+        how: str = "normal",
+        paths: list[Path] | None = None,
+        clients: Path = check_clients.CLIENTS,
+        client_run: tuple[int, str] = (0, ""),
+    ) -> tuple[int | str | None, str]:
+        real_run = subprocess.run
+
+        def run(cmd, **kwargs):
+            if cmd[1:3] == ["-m", "pyright"]:
+                return real_run(
+                    [sys.executable, "-I", str(self.fake), *cmd[3:]], **kwargs
+                )
+            return subprocess.CompletedProcess(cmd, client_run[0], "", client_run[1])
+
+        searched = os.pathsep.join(str(p) for p in (paths or [self.site]))
+        env = {"FAKE_BREAK": brk, "FAKE_HOW": how, "FAKE_PATHS": searched}
+        out, err = io.StringIO(), io.StringIO()
+        with (
+            mock.patch.object(
+                check_clients, "installation", lambda p: self.site / "netgraph_core"
+            ),
+            mock.patch.object(check_clients, "CLIENTS", clients),
+            mock.patch.object(check_clients.subprocess, "run", run),
+            mock.patch.dict(os.environ, env),
+            mock.patch.object(
+                sys, "argv", ["check_clients.py", "t", str(self.tmp / "w")]
+            ),
+            contextlib.redirect_stdout(out),
+            contextlib.redirect_stderr(err),
+        ):
+            try:
+                status = check_clients.main()
+            except SystemExit as exc:
+                status = exc.code
+        return status, out.getvalue() + err.getvalue()
+
+    def test_a_normal_end_passes(self):
+        status, out = self.main("none", "normal")
+        self.assertEqual(status, 0, out)
+        self.assertIn("invalid client: ", out)
+
+    def test_every_abnormal_end_stops_the_check(self):
+        cases = {
+            "signal": "pyright was killed by signal 15",
+            "exit-2": "pyright failed (exit 2)",
+            "exit-3": "pyright failed (exit 3)",
+            "exit-4": "pyright failed (exit 4)",
+            "not-json": "pyright gave no JSON (exit ",
+            "list": "pyright's report is not one of a complete run",
+            "no-diagnostics": "pyright's report is not one of a complete run",
+            "no-count": "pyright's report is not one of a complete run",
+            "text-count": "pyright's report is not one of a complete run",
+            "disagree": "pyright's report is not one of a complete run",
+        }
+        for brk in ("verbose", "report", "control"):
+            for how, message in cases.items():
+                if brk == "verbose" and how not in (
+                    "signal",
+                    "exit-2",
+                    "exit-3",
+                    "exit-4",
+                ):
+                    continue  # the verbose run prints a log, not a report
+                with self.subTest(run=brk, how=how):
+                    status, out = self.main(brk, how)
+                    self.assertIsInstance(status, str, out)
+                    self.assertIn(message, status)
+
+    def refused(self, problem: str, **kwargs) -> None:
+        """The check fails with exactly this one problem."""
+        status, out = self.main(**kwargs)
+        self.assertEqual(status, 1, out)
+        self.assertEqual(out, f"dev/stubs/check_clients.py [t]: {problem}\n")
+
+    def test_the_search_paths_must_hold_the_installation(self):
+        elsewhere = self.tmp / "elsewhere"
+        elsewhere.mkdir()
+        self.refused(
+            f"Pyright's search paths do not hold {self.site} (pyright-verbose.log)",
+            paths=[elsewhere],
+        )
+
+    def test_the_search_paths_must_not_hold_the_source_tree(self):
+        self.refused(
+            "Pyright searches the source tree's python/ directory",
+            paths=[self.site, check_clients.ROOT / "python"],
+        )
+
+    def test_a_diagnostic_on_the_valid_client_fails(self):
+        self.refused(
+            "valid_client.py:1: 1 unexpected diagnostic(s) reportExtra",
+            brk="report",
+            how="extra-valid",
+        )
+
+    def test_a_required_case_without_its_mark_fails(self):
+        # a copy of the clients in which the first required case's line lost its mark (and
+        # so, from the fake as from Pyright, its diagnostic)
+        case = check_clients.REQUIRED[0]
+        clients = self.tmp / "clients"
+        clients.mkdir()
+        for name in ("valid_client.py", "invalid_client.py"):
+            lines = (check_clients.CLIENTS / name).read_text().splitlines()
+            if name == "invalid_client.py":
+                lines = [
+                    check_clients.EXPECT.sub("", t) if case in t else t for t in lines
+                ]
+            (clients / name).write_text("\n".join(lines) + "\n")
+        self.refused(
+            f"invalid_client.py lost the marked case {case!r}", clients=clients
+        )
+
+    def test_a_count_differing_from_the_marks_fails(self):
+        # the fake's first diagnostic is the first rule of the invalid client's first mark
+        lines = (check_clients.CLIENTS / "invalid_client.py").read_text().splitlines()
+        line, mark = next(
+            (i, m)
+            for i, t in enumerate(lines, 1)
+            if (m := check_clients.EXPECT.search(t))
+        )
+        rules = re.split(r"\s*,\s*", mark.group(1))
+        n = rules.count(rules[0])
+        with self.subTest("a marked diagnostic missing"):
+            self.refused(
+                f"invalid_client.py:{line}: {rules[0]} expected {n}, got {n - 1}",
+                brk="report",
+                how="drop",
+            )
+        with self.subTest("an unmarked diagnostic"):
+            self.refused(
+                "invalid_client.py:1: reportExtra expected 0, got 1",
+                brk="report",
+                how="extra-invalid",
+            )
+
+    def test_the_control_line_must_give_its_one_diagnostic(self):
+        planted = (check_clients.CLIENTS / "valid_client.py").read_text()
+        last = len(planted.splitlines()) + 1
+        self.refused(
+            f"control: the planted line {last} gave {{}}", brk="control", how="drop"
+        )
+
+    def test_the_valid_client_must_run(self):
+        self.refused(
+            "valid_client.py does not run:\nTraceback: boom\n",
+            client_run=(1, "Traceback: boom\n"),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/dev/stubs/test_generate.py b/dev/stubs/test_generate.py
new file mode 100644
index 0000000..7c50ee3
--- /dev/null
+++ b/dev/stubs/test_generate.py
@@ -0,0 +1,445 @@
+"""Negative controls of generate.py's rules (its module docstring, steps 2 to 6) and of its
+check of the installation.
+
+A small synthetic module stands in for the compiled one: a raw stub as pybind11-stubgen writes
+it, the module objects it describes and reviewed overrides. The stub built from them is checked
+once, then each refusal of steps 2 to 5 is provoked once and ``build_stub`` must refuse with its
+message. ``--write`` and ``--check`` run on that module (step 6: a changed, shortened, longer,
+empty or missing stub fails the check with the difference), and the installation check refuses a
+package or an extension outside site-packages and an extension with the private hooks. Nothing
+is built or installed. Run by ``bash dev/stubs/run.sh check``, or directly:
+
+    python -I -B dev/stubs/test_generate.py
+"""
+
+from __future__ import annotations
+
+import ast
+import contextlib
+import io
+import os
+import sys
+import sysconfig
+import tempfile
+import types
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import generate
+
+
+class FinalClasses(unittest.TestCase):
+    def test_only_native_final_types_are_marked(self):
+        class Open:
+            pass
+
+        package = types.SimpleNamespace(Final=bool, Open=Open)
+        nodes = ast.parse("class Final: pass\nclass Open: pass").body
+        generate.apply_final_classes({node.name: node for node in nodes}, package)
+        self.assertEqual(
+            [ast.unparse(d) for d in nodes[0].decorator_list], ["typing.final"]
+        )
+        self.assertEqual(nodes[1].decorator_list, [])
+        with self.assertRaises(TypeError):
+            type("Forbidden", (bool,), {})
+        self.assertTrue(issubclass(type("Allowed", (Open,), {}), Open))
+
+
+RAW = '''"""raw"""
+from __future__ import annotations
+import typing
+__all__: list[str] = ["Graph", "Result", "f"]
+class Graph:
+    def __init__(self, n: typing.Any) -> None:
+        """Graph doc"""
+    def __eq__(self, other: typing.Any) -> bool:
+        ...
+    def _hook(self) -> None:
+        ...
+class Result:
+    def value(self) -> int:
+        ...
+def f(x: typing.Any, y: int = 1) -> typing.Any:
+    ...
+def _private() -> None:
+    ...
+'''
+
+OVERRIDES = """import typing
+
+class Graph:
+    # reason: an integer
+    # generated: def __init__(self, n: typing.Any) -> None:
+    def __init__(self, n: typing.SupportsIndex) -> None: ...
+
+class Result:
+    # reason: built by the module only
+    # generated: (none)
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+
+# reason: integers in and out
+# generated: def f(x: typing.Any, y: int = 1) -> typing.Any:
+def f(x: int, y: int = 1) -> int: ...
+"""
+
+
+EQ_DOC = "__eq__(self: Graph, other: object, /) -> bool"
+
+
+def module(
+    result_constructible: bool = False, eq_doc: str = EQ_DOC
+) -> types.ModuleType:
+    """The runtime side: __eq__ takes its operand positional-only (``eq_doc``, pybind11's
+    signature line), Result has no constructor (pybind11's TypeError) unless
+    ``result_constructible``."""
+
+    class Graph:
+        def __init__(self, n):
+            self.n = n
+
+        def __eq__(self, other):
+            return self is other
+
+        __eq__.__doc__ = eq_doc
+
+    class Result:
+        def __init__(self):
+            if not result_constructible:
+                raise TypeError("Result: No constructor defined!")
+
+        def value(self):
+            return 0
+
+    def f(x, y=1):
+        return x
+
+    pkg = types.ModuleType("fake", "The package docstring.")
+    pkg.__dict__.update(
+        Graph=Graph, Result=Result, f=f, __all__=["Graph", "Result", "f"]
+    )
+    return pkg
+
+
+class Rules(unittest.TestCase):
+    def setUp(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        root = Path(tmp.name)
+        saved = generate.ROOT, generate.OVERRIDES
+        self.addCleanup(lambda: setattr(generate, "ROOT", saved[0]))
+        self.addCleanup(lambda: setattr(generate, "OVERRIDES", saved[1]))
+        generate.ROOT, generate.OVERRIDES = root, root / "overrides.pyi"
+
+    def build(self, raw=RAW, overrides=OVERRIDES, pkg=None) -> str:
+        generate.OVERRIDES.write_text(overrides)
+        return generate.build_stub(raw, pkg or module())
+
+    def refused(self, why: str, **kwargs) -> None:
+        with self.assertRaises(generate.Failure) as ctx:
+            self.build(**kwargs)
+        self.assertIn(why, str(ctx.exception))
+
+    def test_the_valid_stub(self):
+        stub = self.build()
+        for line in (
+            "def __init__(self, n: typing.SupportsIndex) -> None:",  # an override
+            "def __init__(self, _no_public_constructor: typing.Never, /) -> None:",  # marker
+            "def __eq__(self, other: typing.Any, /) -> bool:",  # positional-only restored
+            "def f(x: int, y: int=1) -> int:",  # before ruff formats it
+        ):
+            self.assertIn(line, stub)
+        self.assertIn('"""Graph doc"""', stub)  # the generated body kept
+        self.assertNotIn("_hook", stub)  # private members and names left out
+        self.assertNotIn("_private", stub)
+
+    def test_an_override_changes_annotations_only(self):
+        for changed in ("def f(z: int, y: int = 1)", "def f(x: int, y: int = 2)"):
+            overrides = OVERRIDES.replace("def f(x: int, y: int = 1)", changed)
+            self.refused("an override changes only annotations", overrides=overrides)
+
+    def test_the_quoted_generated_line(self):
+        raw = RAW.replace("y: int = 1) -> typing.Any", "y: float = 1) -> typing.Any")
+        self.refused("the generated declaration changed", raw=raw)
+        no_reason = OVERRIDES.replace("# reason: integers in and out\n", "")
+        self.refused("an override needs a '# reason:' line", overrides=no_reason)
+        stale = (
+            OVERRIDES
+            + "\n# reason: gone\n# generated: def g() -> None:\ndef g() -> None: ...\n"
+        )
+        self.refused(
+            "overrides without a generated declaration: ['g']", overrides=stale
+        )
+
+    def test_the_marker_matches_the_runtime_both_ways(self):
+        pkg = module(result_constructible=True)
+        self.refused(
+            "Result: marked not constructible, but the module constructs it", pkg=pkg
+        )
+        start = OVERRIDES.index("class Result:")
+        unmarked = (
+            OVERRIDES[:start] + OVERRIDES[OVERRIDES.index("# reason: integers") :]
+        )
+        self.refused("Result: the module refuses to construct it", overrides=unmarked)
+
+    def test_no_any_outside_its_domain(self):
+        overrides = OVERRIDES.replace("y: int = 1) -> int", "y: int = 1) -> typing.Any")
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): f -> ...",
+            overrides=overrides,
+        )
+
+    def test_positional_only_names_match(self):
+        raw = RAW.replace(
+            "__eq__(self, other: typing.Any)", "__eq__(self, rhs: typing.Any)"
+        )
+        self.refused("the module makes ['self', 'other'] positional-only", raw=raw)
+
+    def test_the_overrides_file(self):
+        f_line = "# generated: def f(x: typing.Any, y: int = 1) -> typing.Any:\n"
+        f_def = "def f(x: int, y: int = 1) -> int: ..."
+        overload = f"@typing.overload\n{f_def}\n"
+        for overrides, why in (
+            (OVERRIDES.replace(f_line, ""), "needs exactly one '# generated:' line"),
+            (OVERRIDES.replace(f_line, f_line * 2), "needs exactly one '# generated:'"),
+            (
+                OVERRIDES.replace(
+                    f"{f_def}\n", overload + "# reason: again\n" + overload
+                ),
+                "'# reason:'/'# generated:' belong above the first overload only",
+            ),
+            (
+                OVERRIDES.replace(f"{f_def}\n", overload + f"{f_def}\n"),
+                "repeated declarations must all be @typing.overload",
+            ),
+            (
+                OVERRIDES.replace("class Graph:", f"{overload}\nclass Graph:"),
+                "f: overloads must be adjacent",
+            ),
+            (
+                OVERRIDES.replace("class Result:\n", "class Result:\n    x: int\n"),
+                "only method overrides inside a class",
+            ),
+            (OVERRIDES + "x = 1\n", "unexpected statement"),
+        ):
+            self.refused(why, overrides=overrides)
+
+    def test_what_an_override_replaces(self):
+        overloads = RAW.replace(
+            "def f(x: typing.Any, y: int = 1) -> typing.Any:\n    ...\n",
+            "@typing.overload\ndef f(x: typing.Any, y: int = 1) -> typing.Any:\n    ...\n"
+            "@typing.overload\ndef f(x: str) -> str:\n    ...\n",
+        )
+        self.refused(
+            "f: generated as overloads; an override replaces one declaration",
+            raw=overloads,
+        )
+        none = OVERRIDES.replace(
+            "# generated: def __init__(self, n: typing.Any) -> None:",
+            "# generated: (none)",
+        )
+        self.refused(
+            "Graph.__init__: the override says '(none)', but Graph.__init__ is generated",
+            overrides=none,
+        )
+        decorated = OVERRIDES.replace("def f(x: int", "@staticmethod\ndef f(x: int")
+        self.refused(
+            "f: decorators ['staticmethod'] differ from the generated []",
+            overrides=decorated,
+        )
+        marker = OVERRIDES.replace(
+            "_no_public_constructor: typing.Never", "_no_public_constructor: int"
+        )
+        self.refused(
+            "Result.__init__: not generated; the only addition allowed is the constructor"
+            " marker",
+            overrides=marker,
+        )
+
+    def test_positional_only_signature_count(self):
+        doc = (
+            "__eq__(*args, **kwargs)\nOverloaded function.\n\n"
+            "1. __eq__(self: Graph, other: object, /) -> bool\n\n"
+            "2. __eq__(self: Graph, other: int, /) -> bool\n"
+        )
+        self.refused(
+            "Graph.__eq__: 2 module signatures, 1 stub declarations",
+            pkg=module(eq_doc=doc),
+        )
+
+    def test_no_any_in_parameters_or_attributes(self):
+        raw = RAW.replace(
+            "def value(self) -> int:", "def value(self, x: typing.Any) -> int:"
+        )
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): Result.value(x)",
+            raw=raw,
+        )
+        raw = RAW.replace("class Result:\n", "class Result:\n    y: typing.Any\n")
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): Result.y", raw=raw
+        )
+        # a module attribute, exported
+        pkg = module()
+        pkg.__all__ = [*pkg.__all__, "z"]
+        pkg.z = 0
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): z",
+            raw=RAW + "z: typing.Any\n",
+            pkg=pkg,
+        )
+
+    def test_no_any_in_any_parameter_position(self):
+        pkg = module()
+        pkg.__all__ = [*pkg.__all__, "g"]
+        pkg.g = lambda *args, **kwargs: 0
+        for signature, where in (
+            ("x: typing.Any, /", "g(x)"),  # positional-only
+            ("x: typing.Any", "g(x)"),  # positional
+            ("*args: typing.Any", "g(args)"),
+            ("*, x: typing.Any", "g(x)"),  # keyword-only
+            ("**kwargs: typing.Any", "g(kwargs)"),
+        ):
+            with self.subTest(signature):
+                self.refused(
+                    f"typing.Any left in the stub (add a reviewed override): {where}",
+                    raw=RAW + f"def g({signature}) -> int:\n    ...\n",
+                    pkg=pkg,
+                )
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): g -> ...",
+            raw=RAW + "def g(*args: int) -> typing.Any:\n    ...\n",
+            pkg=pkg,
+        )
+        # typed variadic parameters are kept as generated
+        stub = self.build(
+            raw=RAW + "def g(*args: int, **kwargs: str) -> int:\n    ...\n", pkg=pkg
+        )
+        self.assertIn("def g(*args: int, **kwargs: str) -> int:", stub)
+
+    def test_no_any_in_a_nested_class(self):
+        raw = RAW.replace(
+            "class Result:\n",
+            "class Result:\n    class Part:\n"
+            "        def h(self, x: typing.Any) -> int:\n            ...\n",
+        )
+        self.refused(
+            "typing.Any left in the stub (add a reviewed override): Result.Part.h(x)",
+            raw=raw,
+        )
+
+    def test_exports_match(self):
+        self.refused(
+            "_netgraph_core.g is public but not exported",
+            raw=RAW + "def g() -> None:\n    ...\n",
+        )
+        raw = RAW.replace("def f(", "def _f(")
+        self.refused("exported by netgraph_core, not generated: ['f']", raw=raw)
+
+
+class CommandLine(unittest.TestCase):
+    """``main`` on the synthetic module (the installation, pybind11-stubgen and ruff replaced):
+    ``--write`` writes the stub, ``--check`` passes on an equal stub and fails on any other
+    with the difference."""
+
+    def setUp(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        root = Path(tmp.name)
+        names = ("ROOT", "STUB", "OVERRIDES", "installed_package", "run_stubgen")
+        saved = {name: getattr(generate, name) for name in names + ("ruff_format",)}
+        self.addCleanup(lambda: [setattr(generate, n, v) for n, v in saved.items()])
+        generate.ROOT, generate.STUB = root, root / "stub.pyi"
+        generate.OVERRIDES = root / "overrides.pyi"
+        generate.OVERRIDES.write_text(OVERRIDES)
+        ext = types.SimpleNamespace(__file__="the compiled module")
+        generate.installed_package = lambda: (module(), ext)
+        generate.run_stubgen = lambda raw_dir: RAW
+        generate.ruff_format = lambda text: text
+        self.want = generate.build_stub(RAW, module())
+
+    def main(self, *argv: str) -> tuple[int, str, str]:
+        out, err = io.StringIO(), io.StringIO()
+        with (
+            mock.patch.object(sys, "argv", ["generate.py", *argv]),
+            contextlib.redirect_stdout(out),
+            contextlib.redirect_stderr(err),
+        ):
+            status = generate.main()
+        return status, out.getvalue(), err.getvalue()
+
+    def drift(self, committed: str | None) -> str:
+        if committed is None:
+            generate.STUB.unlink(missing_ok=True)
+        else:
+            generate.STUB.write_text(committed)
+        status, out, err = self.main("--check")
+        self.assertEqual(status, 1, out)
+        self.assertIn("stub.pyi differs from a fresh generation", err)
+        return out
+
+    def test_write_then_check(self):
+        status, out, _ = self.main("--write")
+        self.assertEqual(status, 0)
+        self.assertEqual(generate.STUB.read_text(), self.want)
+        status, out, _ = self.main("--check")
+        self.assertEqual(status, 0)
+        self.assertIn("stub.pyi is up to date", out)
+
+    def test_check_fails_on_any_difference(self):
+        changed = self.want.replace("-> int:", "-> str:", 1)
+        self.assertNotEqual(changed, self.want)
+        out = self.drift(changed)
+        self.assertIn("\n-", out)
+        self.assertIn("\n+", out)
+        self.assertIn("-> str:", out)
+        self.drift(self.want + "\n")
+        self.drift(self.want[:-1])
+        self.drift("")
+        self.assertIn("(generated)", self.drift(None))
+
+
+class InstalledPackage(unittest.TestCase):
+    """``installed_package``: both modules imported from this interpreter's site-packages and
+    the extension without the private hooks, else a Failure."""
+
+    def check(self, pkg_file: str, ext_file: str, hooks: bool = False):
+        pkg = types.ModuleType("netgraph_core")
+        ext = types.ModuleType("_netgraph_core")
+        pkg.__file__, ext.__file__ = pkg_file, ext_file
+        if hooks:
+            ext._fail_native_allocation = lambda: 0
+        with mock.patch.dict(
+            sys.modules, {"netgraph_core": pkg, "_netgraph_core": ext}
+        ):
+            return generate.installed_package()
+
+    def test_refusals(self):
+        site = os.path.realpath(sysconfig.get_paths()["platlib"])
+        inside = os.path.join(site, "netgraph_core", "__init__.py")
+        ext = os.path.join(site, "_netgraph_core.so")
+        with tempfile.TemporaryDirectory() as tmp:
+            outside = os.path.join(os.path.realpath(tmp), "python", "netgraph_core.py")
+            for pkg_file, ext_file, name in (
+                (outside, ext, "netgraph_core"),
+                (inside, outside, "_netgraph_core"),
+            ):
+                with self.assertRaises(generate.Failure) as ctx:
+                    self.check(pkg_file, ext_file)
+                self.assertIn(
+                    f"{name} is imported from {outside}, not from an installation",
+                    str(ctx.exception),
+                )
+        with self.assertRaises(generate.Failure) as ctx:
+            self.check(inside, ext, hooks=True)
+        self.assertIn(
+            "the installed extension carries the private hooks", str(ctx.exception)
+        )
+        pkg, got = self.check(inside, ext)
+        self.assertEqual((pkg.__file__, got.__file__), (inside, ext))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/dev/test_coverage_summary.py b/dev/test_coverage_summary.py
new file mode 100644
index 0000000..8cfcd61
--- /dev/null
+++ b/dev/test_coverage_summary.py
@@ -0,0 +1,165 @@
+"""The rules of ``dev/coverage_summary.py``: what it accepts, every report it refuses, and its
+exit status, on small synthetic Cobertura reports.
+
+Nothing is built. Run first by ``make cov``, or directly:
+
+    python -I -B dev/test_coverage_summary.py
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import coverage_summary as cs
+
+
+def report(**totals: str) -> str:
+    attrs = "".join(f' {k.replace("_", "-")}="{v}"' for k, v in totals.items())
+    return (
+        f'<?xml version="1.0" ?>\n<coverage{attrs} version="7"><packages/></coverage>\n'
+    )
+
+
+class Summary(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name)
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def write(self, name: str, text: str) -> str:
+        path = self.dir / name
+        path.write_text(text)
+        return str(path)
+
+    def main(self, *argv: str) -> tuple[int, str, str]:
+        out, err = io.StringIO(), io.StringIO()
+        with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+            status = cs.main(list(argv))
+        return status, out.getvalue(), err.getvalue()
+
+    def test_totals_read_exactly(self):
+        for totals, want in (
+            (dict(lines_valid="10", lines_covered="7"), (10, 7, None, None)),
+            (
+                dict(
+                    lines_valid="12.0",
+                    lines_covered="0012",
+                    branches_valid="4.00",
+                    branches_covered="0",
+                ),
+                (12, 12, 4, 0),
+            ),
+            # the largest count, and one below: compared exactly, not as floats
+            (
+                dict(lines_valid=str(2**63 - 1), lines_covered=str(2**63 - 2)),
+                (2**63 - 1, 2**63 - 2, None, None),
+            ),
+        ):
+            path = self.write("r.xml", report(**totals))
+            self.assertEqual(cs.parse_cobertura_totals(path), want, totals)
+
+    def test_refusals(self):
+        good = dict(lines_valid="10", lines_covered="7")
+        for name, text, why in (
+            ("missing", None, "cannot read the report"),
+            ("not xml", "<coverage", "cannot read the report"),
+            ("other root", "<report/>", "not a Cobertura report (root <report>)"),
+            ("no lines-valid", report(lines_covered="1"), "no lines-valid total"),
+            ("no lines-covered", report(lines_valid="1"), "no lines-covered total"),
+            (
+                "zero lines",
+                report(lines_valid="0", lines_covered="0"),
+                "counts no line",
+            ),
+            (
+                "lines above",
+                report(lines_valid="7", lines_covered="8"),
+                "8 lines covered of 7",
+            ),
+            (
+                "branches above",
+                report(**good, branches_valid="2", branches_covered="3"),
+                "3 branches covered of 2",
+            ),
+            (
+                "one branch total",
+                report(**good, branches_valid="2"),
+                "must both be present or both absent",
+            ),
+            (
+                "the other branch total",
+                report(**good, branches_covered="0"),
+                "must both be present or both absent",
+            ),
+            (
+                "above the largest count",
+                report(lines_valid=str(2**63), lines_covered="1"),
+                "above the largest count",
+            ),
+            *(
+                (
+                    f"spelling {value}",
+                    report(lines_valid=value, lines_covered="1"),
+                    f"lines-valid={value!r} is not a count",
+                )
+                for value in ("-1", "+1", "1.5", "1e3", "nan", "inf", "", " 1", "0x10")
+            ),
+        ):
+            path = (
+                str(self.dir / "absent.xml")
+                if text is None
+                else self.write(f"{len(name)}.xml", text)
+            )
+            with self.assertRaises(cs.ReportError, msg=name) as ctx:
+                cs.parse_cobertura_totals(path)
+            self.assertIn(why, str(ctx.exception), name)
+            self.assertTrue(str(ctx.exception).startswith(path), name)
+
+    def test_exit_status_and_outputs(self):
+        py = self.write("py.xml", report(lines_valid="10", lines_covered="5"))
+        cpp = self.write("cpp.xml", report(lines_valid="30", lines_covered="29"))
+        bad = self.write("bad.xml", report(lines_valid="0", lines_covered="0"))
+        html = self.dir / "sub" / "c.html"
+        status, out, err = self.main(py, cpp, f"--html={html}")
+        self.assertEqual((status, err), (0, ""))
+        rows = out.splitlines()
+        self.assertEqual(rows[3].split(), ["python", "10", "5", "50%"])
+        self.assertEqual(rows[4].split(), ["c++", "30", "1", "97%"])
+        self.assertEqual(rows[6].split(), ["TOTAL", "40", "6", "85%"])
+        self.assertIn("TOTAL", html.read_text())
+        # branch columns when one report has branch totals; the other counts 0 of 0
+        branched = self.write(
+            "br.xml",
+            report(
+                lines_valid="10",
+                lines_covered="5",
+                branches_valid="4",
+                branches_covered="1",
+            ),
+        )
+        status, out, err = self.main(branched, cpp)
+        self.assertEqual(status, 0, err)
+        self.assertEqual(out.splitlines()[6].split()[-3:], ["4", "3", "25%"])
+        # any refused report: exit 1, the reason on stderr, no table
+        for argv in ((bad, cpp), (py, bad), (py, str(self.dir / "absent.xml"))):
+            status, out, err = self.main(*argv)
+            self.assertEqual((status, out), (1, ""), argv)
+            self.assertTrue(err.startswith("coverage_summary.py: "), argv)
+        # an HTML output that cannot be written: exit 1
+        blocker = self.write("file", "")
+        status, out, err = self.main(py, cpp, f"--html={blocker}/c.html")
+        self.assertEqual(status, 1)
+        self.assertIn(f"cannot write {blocker}/c.html", err)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/dev/test_pytest_guard.py b/dev/test_pytest_guard.py
new file mode 100644
index 0000000..e945ca9
--- /dev/null
+++ b/dev/test_pytest_guard.py
@@ -0,0 +1,220 @@
+"""The rules of ``dev/pytest_guard.py``: every check it makes on a run (the hook setting, the
+imported modules, the skipped tests and their reasons) refuses its defect on a synthetic record;
+real runs pass when clean (an unrelated plugin's warning on stderr included) and fail on one
+unexpected skip, of a test or of a whole module while collected.
+
+Run by ``make check-ci``, or directly (the end-to-end controls need the development build):
+
+    python -I -B dev/test_pytest_guard.py
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import pytest_guard as guard
+
+OUTSIDE = ["/elsewhere/_netgraph_core.so", "/elsewhere/netgraph_core/__init__.py"]
+REPLAY = guard.EXPECTED_OFF_SKIPPED_PREFIX + "x]"
+REASON = "Skipped: needs the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS)"
+
+
+def off_run(**change):
+    """A correct hooks-off record, with `change` applied."""
+    skipped = {name: REASON for name in guard.EXPECTED_OFF_SKIPS}
+    skipped[REPLAY] = REASON
+    record = dict(
+        has_hooks=False,
+        modules=list(OUTSIDE),
+        seen=set(skipped) | {"tests/py/test_units.py::test_ok"},
+        skipped=skipped,
+    )
+    record.update(change)
+    return record
+
+
+class Checks(unittest.TestCase):
+    def test_free_threaded_skip_policy_and_public_population(self):
+        record = dict(
+            has_hooks=True,
+            modules=OUTSIDE,
+            seen=set(guard.CONCURRENCY_PUBLIC) | guard.GIL_PROOF_SKIPS,
+            skipped={n: "Skipped: GIL-proof-only" for n in guard.GIL_PROOF_SKIPS},
+            free_threaded=True,
+            runtime_gil=False,
+            require_concurrency=True,
+        )
+        self.assertEqual(guard.problems("on", **record), [])
+        broken = dict(
+            record, seen=record["seen"] - {next(iter(guard.CONCURRENCY_PUBLIC))}
+        )
+        self.assertTrue(
+            any("required public" in p for p in guard.problems("on", **broken))
+        )
+        self.assertTrue(guard.problems("on", **dict(record, runtime_gil=True)))
+        self.assertTrue(guard.problems("on", **dict(record, skipped={})))
+        wrong_reason = {n: REASON for n in guard.GIL_PROOF_SKIPS}
+        self.assertTrue(guard.problems("on", **dict(record, skipped=wrong_reason)))
+        unknown = dict(record["skipped"], unknown="Skipped: GIL-proof-only")
+        self.assertTrue(guard.problems("on", **dict(record, skipped=unknown)))
+
+    def test_free_threaded_hooks_off_still_runs_public_races(self):
+        record = off_run()
+        record["seen"] |= guard.CONCURRENCY_PUBLIC
+        record.update(free_threaded=True, runtime_gil=False, require_concurrency=True)
+        for node in guard.GIL_PROOF_SKIPS:
+            record["skipped"][node] = "Skipped: GIL-proof-only"
+        self.assertEqual(guard.problems("off", **record), [])
+        record["skipped"][next(iter(guard.CONCURRENCY_PUBLIC))] = REASON
+        self.assertTrue(guard.problems("off", **record))
+
+    def test_hooks_on(self):
+        ok = dict(has_hooks=True, modules=OUTSIDE, seen={"a"}, skipped={})
+        self.assertEqual(guard.problems("on", **ok), [])
+        self.assertEqual(
+            guard.problems("on", **{**ok, "skipped": {"a": REASON}}),
+            ["1 tests skipped in a hooks-on run: ['a']"],
+        )
+        self.assertEqual(
+            guard.problems("on", **{**ok, "has_hooks": False}),
+            ["the extension lacks the private hooks (expected the editable build)"],
+        )
+        self.assertEqual(
+            guard.problems("on", **{**ok, "modules": [None, OUTSIDE[1]]}),
+            [f"netgraph_core or _netgraph_core was not imported: {[None, OUTSIDE[1]]}"],
+        )
+
+    def test_hooks_off(self):
+        self.assertEqual(guard.problems("off", **off_run()), [])
+        unexpected = off_run()
+        unexpected["skipped"] = {**unexpected["skipped"], "tests/py/t.py::u": REASON}
+        self.assertEqual(
+            guard.problems("off", **unexpected),
+            ["skipped, not a known hook-only test: tests/py/t.py::u"],
+        )
+        missing = off_run()
+        first = guard.EXPECTED_OFF_SKIPS[0]
+        del missing["skipped"][first]
+        self.assertEqual(
+            guard.problems("off", **missing), [f"expected to skip, did not: {first}"]
+        )
+        other = off_run()
+        other["skipped"][first] = "Skipped: something else"
+        self.assertEqual(
+            guard.problems("off", **other),
+            [f"skipped for another reason: {first}: Skipped: something else"],
+        )
+        no_replay = off_run()
+        del no_replay["skipped"][REPLAY]
+        no_replay["seen"].discard(REPLAY)
+        self.assertEqual(
+            guard.problems("off", **no_replay),
+            [f"no test {guard.EXPECTED_OFF_SKIPPED_PREFIX}...] ran"],
+        )
+        self.assertEqual(
+            guard.problems("off", **off_run(has_hooks=True)),
+            [
+                "the extension carries the private hooks (expected a wheel or sdist build)"
+            ],
+        )
+        inside = [str(guard.ROOT / "python" / "_netgraph_core.so"), OUTSIDE[1]]
+        self.assertEqual(
+            guard.problems("off", **off_run(modules=inside)),
+            [f"imported from the source tree, not an installation: {inside[:1]}"],
+        )
+
+    def test_usage(self):
+        with contextlib.redirect_stderr(io.StringIO()):
+            self.assertEqual(guard.main([]), 2)
+            self.assertEqual(guard.main(["both"]), 2)
+
+
+def development_build():
+    try:
+        import _netgraph_core
+    except ImportError:
+        return False
+    return hasattr(_netgraph_core, "_fail_native_allocation")
+
+
+HEADER = "import _netgraph_core\nimport netgraph_core\nimport pytest\n\n"
+PASSING = HEADER + "def test_ok():\n    assert True\n"
+# A plugin of the environment that writes a warning when loaded (as an installed pytest plugin
+# may): stderr of a clean run is not the guard's.
+UNRELATED_PLUGIN = "import sys\n\nsys.stderr.write('an unrelated plugin warns\\n')\n"
+
+
+@unittest.skipUnless(development_build(), "needs the development build (private hooks)")
+class Runs(unittest.TestCase):
+    """Real runs of the guard in hooks-on mode on small test files: clean, then one test that
+    skips (as a test that silently needs a hook would on Windows), then one module skipped while
+    collected (as a module-level platform skip would)."""
+
+    def run_guard(self, files):
+        """The guard's status and stderr on a directory of `files` (name: text), with the plugin
+        guard_unrelated_plugin loaded. The directory is the run's rootdir, so a node id starts at the
+        module's file name wherever the temporary directory is. Each test module's name is used
+        once in this file: the runs share one interpreter, which keeps an imported test module."""
+        with tempfile.TemporaryDirectory() as tmp:
+            for name, text in {
+                **files,
+                "guard_unrelated_plugin.py": UNRELATED_PLUGIN,
+            }.items():
+                (Path(tmp) / name).write_text(text)
+            err = io.StringIO()
+            sys.path.insert(0, tmp)
+            try:
+                with (
+                    contextlib.redirect_stdout(io.StringIO()),
+                    contextlib.redirect_stderr(err),
+                ):
+                    status = guard.main(
+                        ["on", tmp, "--rootdir", tmp, "-q", "-p", "no:cacheprovider"]
+                        + ["-p", "guard_unrelated_plugin"]
+                    )
+            finally:
+                sys.path.remove(tmp)
+                sys.modules.pop("guard_unrelated_plugin", None)
+            return status, err.getvalue()
+
+    def guard_lines(self, err):
+        return [ln for ln in err.splitlines() if ln.startswith("dev/pytest_guard.py")]
+
+    def test_a_clean_run_passes(self):
+        status, err = self.run_guard(
+            {"test_guard_clean.py": PASSING, "test_guard_other.py": PASSING}
+        )
+        self.assertEqual((status, self.guard_lines(err)), (0, []))
+        self.assertIn("an unrelated plugin warns", err)
+
+    def test_an_unexpected_skip_fails(self):
+        body = (
+            HEADER
+            + "def test_ok():\n    pass\n\n\ndef test_skips():\n    pytest.skip('planted')\n"
+        )
+        status, err = self.run_guard({"test_guard_skip.py": body})
+        self.assertEqual(status, 1)
+        self.assertEqual(len(self.guard_lines(err)), 1)
+        self.assertIn("1 tests skipped in a hooks-on run", err)
+        self.assertIn("test_guard_skip.py::test_skips", err)
+
+    def test_a_module_skipped_while_collected_fails(self):
+        module = "import pytest\n\npytest.skip('planted', allow_module_level=True)\n"
+        status, err = self.run_guard(
+            {"test_guard_kept.py": PASSING, "test_guard_platform.py": module}
+        )
+        self.assertEqual(status, 1)
+        self.assertEqual(len(self.guard_lines(err)), 1)
+        self.assertIn("1 tests skipped in a hooks-on run", err)
+        self.assertIn("['test_guard_platform.py']", err)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/docs/formal/theorems/round-robin.md b/docs/formal/theorems/round-robin.md
new file mode 100644
index 0000000..71356ef
--- /dev/null
+++ b/docs/formal/theorems/round-robin.md
@@ -0,0 +1,196 @@
+# Round robin and traffic that arrives in several calls
+
+Status: mathematical model proofs. Native comparisons cover stated finite cases; they do not
+prove that the C++ implementation agrees for every machine input.
+
+## The question and the quantities
+
+Suppose three sources take turns sending whole units. The first unit belongs to source 0,
+the second to source 1, the third to source 2, and the fourth starts the circle again at 0.
+If traffic arrives in several calls, the next call must continue that circle.
+
+Here `total` is the number of units distributed so far, `members` is the number of sources,
+and `recipient` is a source's position in the fixed order, starting at zero. The same arithmetic
+can describe ordered outgoing links or tunnel entries. One unit is the graph's resolution `q`;
+all calculations here count units, rather than rounded physical rates. For example, five units
+at `q = 0.25` are a physical quantity of `1.25`.
+
+`total / members` means the number of complete circles. `total % members` is the number of
+units left after those circles. All theorem statements require `members > 0`; statements about
+one recipient also state when its index must be below `members`. Zero recipients have no valid
+index: that case is handled by the calling operation's empty-roster rules, not by dividing by
+zero or claiming that a positive offer has been distributed.
+
+The Lean definitions live in `proofs/NetGraphCore/Apportionment/RoundRobin.lean`:
+
+- `sequential` counts how often one recipient is selected by the circle, one unit at a time.
+- `roundRobin` uses division once: complete circles, plus one for each early leftover recipient.
+- `increments` computes the extra share from the old remainder and the new offer, using a
+  signed subtraction. Its nonnegativity is proved, rather than assumed by using a natural type.
+- `amountLimit` is `2^62`, the exclusive bound on one native traffic amount.
+
+Examples are checked by Lean in `Checks/Examples.lean` and compared with independently recorded
+exact inputs and outputs in `proofs/cases.json`. The sequence example is also used by the native
+bridge on both `ShortestPaths` and replay through `Pinned`.
+
+<a id="NGC-AP-001"></a>
+## NGC-AP-001: the formula describes the actual circle
+
+Claim (`sequential_eq_roundRobin`): for any number of units and any valid recipient, distributing
+units one at a time around the circle gives exactly the count from the division formula.
+
+For ten units and three recipients, units 1, 4, 7 and 10 go to source 0; units 2, 5 and 8 go to
+source 1; units 3, 6 and 9 go to source 2. The counts are `[4, 3, 3]`. Division gives three complete
+circles (three units each), followed by one unit for the first source. This is case `rr-ten`.
+
+Boundary cases: zero units give `[0, 0, 0]` (`rr-zero`); two units give `[1, 1, 0]` (`rr-short`);
+exactly three units give `[1, 1, 1]` (`rr-circle`). One recipient gets every unit (`rr-one`).
+
+The valid-index restriction matters. With three recipients and three units, nonexistent
+position 5 is never selected by the circle, so its count is zero. The division formula would
+give it `3 / 3 = 1` unit. The restriction excludes such phantom recipients; this contrast is
+also checked in `Checks/Examples.lean`.
+
+<a id="roundRobin_succ"></a>
+Proof steps:
+
+1. With zero units, both methods give every recipient zero.
+2. Assume both methods agree after some total. The next sequential recipient is the old remainder.
+3. Helper `roundRobin_succ` shows that the division formula changes the same recipient only.
+   If the leftover count has not reached the end, the quotient stays fixed and just one more
+   recipient enters the leftover group. At the end, the quotient rises by one and the leftover
+   group becomes empty. Earlier recipients exchange their old leftover unit for a full-circle
+   unit; the last recipient gains one. Therefore both methods make the same next step.
+4. Repeating that argument covers every nonnegative total. This reasoning technique is called
+   induction: prove the start and prove that every correct step gives a correct next step.
+
+Why order matters: `[3, 3, 4]` also sums to ten and is almost equal, but puts the leftover unit
+on the last recipient. Conservation alone would accept it; the circle-equivalence claim rejects
+that rule. Reordering recipients changes who owns each turn, so membership and order are fixed.
+
+<a id="NGC-AP-002"></a>
+## NGC-AP-002: adding traffic cannot take a unit away
+
+Claim (`roundRobin_mono`): increasing the total by a nonnegative amount never decreases a valid
+recipient's share, while the recipient set and order stay fixed.
+
+After five units, shares are `[2, 2, 1]`; after six they are `[2, 2, 2]`. Source 2 gains one and
+the others keep their counts (`inc-continue`). Adding zero changes nothing (`inc-zero`).
+
+The proof starts with an addition of zero. Helper `roundRobin_succ` says each following unit
+adds either zero or one to a recipient. Combining those steps proves the claim for any addition.
+This is the arithmetic monotonicity needed for later no-drop load arguments. It says nothing
+about a roster change: five units over two members give `[3, 2]`, while five over three give
+`[2, 2, 1]`, reducing the first member's share. It also does not by itself prove admission search.
+
+<a id="NGC-AP-003"></a>
+## NGC-AP-003: all input units are accounted for
+
+Claim (`roundRobin_conservation`): adding the shares of all valid recipients gives the original
+total exactly. The `Finset.range members` in Lean is just the finite list of valid positions
+`0` through `members - 1`; the sum does not include any other indices.
+
+For `rr-ten`, `4 + 3 + 3 = 10`; for `rr-short`, `1 + 1 + 0 = 2`; for `rr-zero`, all terms are zero.
+The proof begins with the zero sum. At each new unit, `roundRobin_succ` describes every share's
+change. Exactly one valid index equals the old remainder, so the sum rises by exactly one.
+
+The imported finite-sum facts distribute a sum over additions and count the one index selected
+by an equality. They do not impose a traffic model. This result rules out dropped or duplicated
+units in the model, but permits a wrong allocation such as `[10, 0, 0]` if used alone; use it with
+NGC-AP-001. A positive offer with no recipients is outside the theorem's stated domain.
+
+<a id="NGC-AP-004"></a>
+## NGC-AP-004: continue from the previous call using only its remainder
+
+Claim (`increments_eq_difference`): the signed increment formula equals the new cumulative share
+minus the previous cumulative share. The previous total can be arbitrarily large in this model.
+
+With three sources, five units leave counts `[2, 2, 1]`. The previous remainder is two. Adding one
+makes `2 + 1 = 3`: one complete circle and no leftovers. For each recipient the increment is
+one full-circle unit, minus whether that recipient already had a leftover unit. That gives
+`[1-1, 1-1, 1-0] = [0, 0, 1]`, so the final counts are `[2, 2, 2]` (`inc-continue`).
+
+If the addition is zero, the old leftover flags are subtracted from themselves and every change
+is zero (`inc-zero`). Starting from two units and adding two crosses a circle boundary: counts
+change from `[1, 1, 0]` to `[2, 1, 1]`, an increment of `[1, 0, 1]` (`inc-wrap`).
+
+The same argument works beyond 64 bits. `2^64 = 18446744073709551616` leaves remainder one when
+divided by three. Adding two therefore assigns one to source 1 and one to source 2, yielding
+`[0, 1, 1]` (`inc-wide`). Near the public cumulative limit, `2^127-1` leaves remainder one on
+division by seven. Adding nine gives one new full circle and leftovers on the first three
+positions; subtracting the old leftover on position 0 gives `[1, 2, 2, 1, 1, 1, 1]` (`inc-limit`).
+That addition crosses the public cumulative-counter limit: it illustrates the unrestricted
+mathematical identity, and is not an example of a public call the library must accept.
+
+Proof steps:
+
+1. Split the previous total into complete circles and a remainder. The imported division fact
+   `Nat.mod_add_div` is the exact identity "remainder + members * quotient = original total".
+2. <a id="roundRobin_periodic"></a>Helper `roundRobin_periodic` shows that adding complete circles increases every count equally.
+   Division changes the quotient; its remainder and therefore leftover positions stay the same.
+   For example, `16 = 10 + 3 * 2` units give `[6, 5, 5]`: the ten-unit shares `[4, 3, 3]`
+   plus two complete circles, adding two to each source. This is checked in `Checks/Examples.lean`.
+3. The complete circles of the old total occur in both cumulative counts and cancel in their
+   difference. Only the old remainder, the extra offer and the two leftover flags remain.
+4. That remaining expression is precisely `increments`, including its signed subtraction.
+
+A wrong rule that restarts each call assigns the sixth unit to source 0, producing `[3, 2, 1]`.
+The total still adds up, so this example exposes a mistake that conservation cannot detect.
+The identity applies to equal round robin. It does not justify replacing weighted allocation
+with equal allocation or forgetting the high word when computing a large total's remainder.
+
+<a id="NGC-AP-005"></a>
+## NGC-AP-005: an increment is a real part of the new offer
+
+Claim (`increments_bounds`): a valid recipient's increment is between zero and the extra offer,
+inclusive. This gives meaning to converting the signed expression back into a traffic amount.
+
+Adding two units after total two gives `[1, 0, 1]` (`inc-wrap`): each entry is nonnegative and no
+larger than two. Adding zero gives exactly zero (`inc-zero`). With one recipient an addition
+belongs entirely to it, reaching the upper bound.
+
+NGC-AP-004 expresses the increment as a difference. NGC-AP-002 bounds that difference below by
+zero. <a id="roundRobin_add_le"></a>Helper `roundRobin_add_le` bounds it above: every sequential step can give this recipient
+at most one, so an addition of `extra` cannot increase its share by more than `extra`. Combining
+those facts yields both inequalities. This proves the output bound; it does not yet establish
+the behaviour of a particular C++ subtraction instruction.
+
+For example, the `inc-wrap` addition raises source 0's count from one to two. Its gain is one,
+which is no more than the two added units. Source 1 gains zero and source 2 gains one; neither
+can gain more than the whole offer. With a single source, its gain equals the offer.
+
+<a id="NGC-AP-006"></a>
+## NGC-AP-006: the remainder calculation has room in the native amount domain
+
+Claim (`native_increment_bounds`): if there are fewer than `2^31` recipients and an offer smaller
+than `2^62`, then "old remainder + offer" is below `2^63`. The resulting signed increment is
+nonnegative and below `2^62`. The recipient must be valid; the count must be positive.
+
+For a source split, the count bound follows from the graph's signed 32-bit node IDs: it has
+fewer than `2^31` possible source members. Other uses of the arithmetic must establish their
+own count bound; this theorem does not infer it from the word "recipient".
+
+For `inc-wrap`, the remainder is two, the offer is two and their sum is four. The increment
+`[1, 0, 1]` fits the claimed bounds. For `inc-limit`, the previous total is huge but its remainder
+is only one. Thus the intermediate for offer nine is ten: the size of the previous total does
+not make this addition large. At the upper input boundary, offer `2^62-1` and remainder at most
+`2^31-2` still sum to less than `2^63`. An offer equal to `2^62` is outside the native domain,
+even when this particular arithmetic calculation would fit; that is a contract restriction.
+
+The proof uses the division rule that a remainder is smaller than its positive divisor. Add
+the stated upper bounds on recipient count and offer to bound the intermediate. NGC-AP-005
+then bounds each final increment by the offer. Numeric normalization computes the fixed powers
+of two inside a checked proof; it does not approximate them with floating point.
+
+The model does not prove the implementation of `mod_u128`, the representation of `Counter128`,
+pointer accesses or exception safety. The native bridge exercises cumulative offers past `2^64`
+through actual public calls, and records that finite coverage explicitly. Values near `2^127`
+are model examples here, not a claim that the public bridge reaches that total in a few calls.
+
+## How these results help the next stages
+
+These proofs establish a precise arithmetic building block for source injection and ordered
+equal splits. To prove a forwarding bound, we still need fixed-program load definitions and
+their composition rules. To cover WCMP, we need separate highest-averages proofs. To certify
+native behaviour for every input, we need a further refinement argument relating the model to
+the actual program and its machine representation.
diff --git a/docs/semantics.md b/docs/semantics.md
new file mode 100644
index 0000000..cb9edde
--- /dev/null
+++ b/docs/semantics.md
@@ -0,0 +1,3162 @@
+# NetGraph-Core semantics
+
+This document says exactly what NetGraph-Core computes: how amounts are counted, how edges are
+numbered, which route a search returns, how each routing model spreads traffic, what a call reports
+and when it fails, how the shortest-path cache behaves, and what the evaluators mean. It is the full
+reference behind the API docstrings. For installation and a first example, see the
+[README](../README.md#installation).
+
+Each section starts with a short explanation in plain words and then gives the exact rules. When
+the two seem to differ, the exact rules are the authority. Names are the Python spellings
+(`import netgraph_core as ngc`); [the last section](#11-c-names) lists the C++ spellings. Names that
+start with an underscore are private test and verification entries, not part of the API.
+
+Every Python example below is run by the test suite, in order and in one namespace, and must print
+exactly the output block that follows it.
+
+Contents:
+
+- [How the engine works](#how-the-engine-works)
+- [Terms](#terms)
+
+1. [Units: the one numeric domain](#1-units-the-one-numeric-domain)
+2. [The graph](#2-the-graph)
+3. [Route values: PredecessorDAG and Path](#3-route-values-predecessordag-and-path)
+4. [Search](#4-search)
+5. [Route allocations and admission](#5-route-allocations-and-admission)
+6. [The ledger](#6-the-ledger)
+7. [Policies](#7-policies)
+8. [Failures, threads and lifetimes](#8-failures-threads-and-lifetimes)
+9. [The shortest-path cache](#9-the-shortest-path-cache)
+10. [Evaluators](#10-evaluators)
+11. [C++ names](#11-c-names)
+
+## How the engine works
+
+A demand is traffic from a set of source nodes to a set of destination nodes. The engine follows it
+through six things:
+
+1. A **graph** (`Graph`): nodes and directed edges, each edge with an integer capacity and a
+   positive integer cost. Capacities are counted in whole **units**; the graph fixes how big a unit
+   is.
+2. A **ledger** (`FlowLedger`): what the edges of one graph carry now, and the bandwidth that
+   tunnels hold on them.
+3. A **policy** (`FlowPolicy`): one demand on one ledger, with a configuration: a **routing model**
+   (how routes are chosen) and an **admission** (what to do with traffic that does not fit).
+4. A **program** (`ForwardingProgram`): the routes the model chose and the integer weights that say
+   how traffic is split over them.
+5. **Forwarding**: the call's offer is split over the program's routes in whole units. `LOSSLESS`
+   admits only what goes through without loss; `LOSSY` sends everything and records where it is
+   lost.
+6. A **result** (`PlacementResult`): what the call delivered, what was lost and where, the program,
+   and the demand's totals.
+
+One demand, routed like IGP routers with equal-cost multipath (ECMP), on a network of two branches:
+
+```python
+import netgraph_core as ngc
+
+# Node 0 reaches node 3 over 0 -> 1 -> 3 (capacity 10) and 0 -> 2 -> 3 (capacity 2), every cost 1.
+g = ngc.Graph(4, [0, 1, 0, 2], [1, 3, 2, 3], [10, 10, 2, 2], [1, 1, 1, 1], 1.0)
+ledger = ngc.FlowLedger(g)
+ecmp = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+policy = ngc.FlowPolicy(ledger, 0, 3, ecmp)
+r = policy.place(10)
+print(r.call_delivered, r.call_edge_drops, r.termination.name)
+print(ledger.carried().tolist(), ledger.residual().tolist())
+```
+
+```text
+7 [(1, 3)] COMPLETE
+[5, 2, 5, 2] [5, 0, 5, 0]
+```
+
+The edges are numbered by source, cost and destination, so 0 -> 1 is edge 0, 0 -> 2 edge 1,
+1 -> 3 edge 2 and 2 -> 3 edge 3. Node 0 splits the 10 units equally over its two next hops, 5 and 5.
+Edge 1 carries 2 of its 5 and drops 3, so 7 arrive. `LOSSY` sends the whole offer, so the call is
+`COMPLETE` although 3 units were lost; with `LOSSLESS` the same policy would admit only 5, the
+largest offer whose equal split overloads no edge.
+
+## Terms
+
+Each term in one sentence, in the order the later terms need them; the section named after it
+gives the exact rule.
+
+- **Unit, resolution `q`.** Traffic is counted in whole units; one unit is `q` of a physical
+  quantity (for example `q = 2**-12` Gbit/s). The graph fixes `q` when it is built
+  ([section 1](#1-units-the-one-numeric-domain)).
+- **Amount.** A whole number of units: a capacity, a residual, an offer, a delivery or a drop.
+- **EdgeId.** The public number of an edge: its rank when the edges are sorted by source, cost and
+  destination. It is not the edge's position in the input arrays ([section 2](#2-the-graph)).
+- **Eligibility (a mask).** Which nodes and edges of a graph a call may use. A failed link or router
+  is modelled by an Eligibility that excludes it ([Eligibility](#eligibility)).
+- **Static.** Depending only on the graph, its costs and the Eligibility, not on traffic.
+- **Residual.** The free capacity of an edge: in a ledger, its service baseline minus the traffic
+  it carries; in a search, the array the caller supplies.
+- **Tight edge.** An edge `u -> v` that lies on a shortest walk of a search. Searching from the
+  roots, the distance of `u` plus the edge's cost equals the distance of `v`; searching toward
+  them (reverse), where a distance is the distance to the roots, the distance of `v` plus the
+  cost equals the distance of `u`.
+- **Shortest-path DAG.** The set of all tight edges: every shortest route at once. A DAG (directed
+  acyclic graph) is a directed graph with no directed cycle.
+- **Parallel members.** Several edges between the same two nodes in the same direction.
+- **Route choice.** The tie rule (`RouteTieBreak`), `multipath` and `parallel_edges` of a model or
+  a search ([section 4](#the-route-choice)): cost always comes first, and the tie rule only
+  orders equal-cost choices.
+- **Member graph.** The edges a search may use: eligible (and, when a residual is supplied, at
+  least the search's residual threshold), whatever their capacity, and one member per pair with
+  `parallel_edges=False`.
+- **Canonical path.** The one walk a search returns when a single path is asked for, chosen by
+  the fixed order of [section 4](#the-canonical-single-path).
+- **Bottleneck of a walk.** Under a `HIGHER_*` tie rule, the smallest edge score along the walk:
+  static capacity, availability, or their exact ratio (headroom), as the rule names
+  ([the route choice](#the-route-choice)).
+- **Demand.** The traffic from a set of sources to a set of destinations; a route ends at the first
+  destination it reaches.
+- **Policy.** A `FlowPolicy`: one demand on one ledger, with its configuration. It computes the
+  demand's routes, forwards its traffic over them and removes it again.
+- **Routing model.** `ShortestPaths`, `DistributedTE` (T1), `CentralizedTE` (with a tunnel count:
+  T2) or `Pinned`; each holds the options it reads ([configuration](#configuration)).
+- **Roster.** The sources of a policy that can reach an allowed destination over allowed nodes and
+  edges, whatever the capacities, in ascending node id; fixed when the policy is built
+  ([the source roster](#the-source-roster)).
+- **Head.** A roster source, as the start of the routes it sends on.
+- **Source allocation.** How a demand's total enters at its roster sources: in equal round-robin
+  shares (`SourceAllocation.EQUAL`), highest-averages shares of declared weights (`WEIGHTED`),
+  or as a controller chooses (`OPTIMIZED`).
+- **Route allocation.** How a demand's traffic is split at every router of its routes
+  (`RouteAllocation`): equally (`EQUAL`, ECMP), by integer weights (`WEIGHTED`, WCMP), or as a
+  controller restricted to those routes chooses (`OPTIMIZED`).
+- **Round robin `RR(x, k, i)`.** `x` units over `k` members: `x // k` each, and one more for the
+  first `x % k` members.
+- **Highest averages `H(x, w)`.** `x` units over members with integer weights `w`, given one at a
+  time to the member with the largest `w[i] / (assigned[i] + 1)`, ties to the earlier member; a
+  zero weight gets nothing.
+- **Admission.** `LOSSLESS` admits the largest total that the program, splitting by its own rules,
+  carries with no edge overloaded and no share left without a route; the rest is refused before it
+  enters. `LOSSY` sends the whole offer and records where it is lost ([section
+  5](#5-route-allocations-and-admission)).
+- **Offer.** The traffic a call asks a policy to carry (`place(offer)`, `replace(offer)`, ...).
+- **Controller.** A routing that solves a flow problem for the whole demand: `CentralizedTE`
+  without a tunnel count, and `ShortestPaths` with `allocation=OPTIMIZED`.
+- **Support.** The DAG a `CentralizedTE` policy may be restricted to (`support=`); every other edge
+  then carries nothing.
+- **Service view.** The ledger's residual plus this policy's own carried traffic: the capacity a
+  solve or a full-offer call of the policy may use.
+- **Setup view (T1).** The ledger's unreserved capacity plus this policy's own holds: what T1's
+  tunnel setup may reserve. The service view and the setup view are never added together.
+- **Program.** A `ForwardingProgram`: the routes and integer weights of one demand and the rule
+  that injects its traffic at the sources. Every computing model produces one; `Pinned` forwards a
+  given one without computing anything ([forwarding programs](#forwarding-programs)).
+- **Entry.** One route of a program: a **tunnel** (one path, one edge per hop) or a **split
+  route** (a DAG whose routers split by fixed rules). Each entry has an integer identifier, its
+  `entry_id`, and a weight: its share among its head's entries.
+- **Split context.** The traffic a router splits as one amount. A `ShortestPaths` `EQUAL` or
+  `WEIGHTED` program and a `from_dag` program add up all their sources' traffic at a shared router
+  and split it once; each split route given to `from_routes` splits only its own share. The two can
+  round differently ([example](#supplied-dags-from_dag)).
+- **T1.** `DistributedTE(TunnelCount(N))`: every head sets up its own N strict-bandwidth tunnels by
+  CSPF (constrained shortest path first: a shortest path among the links with enough unreserved
+  bandwidth), with no controller ([T1](#t1-tunnels-set-up-by-their-heads)).
+- **Hold.** Bandwidth an up T1 tunnel reserves on every link of its path. Holds are the ledger's
+  second projection (`reserved`, `unreserved`), kept apart from the carried traffic (`carried`,
+  `residual`); they never police or queue traffic.
+- **T2.** `CentralizedTE(source_allocation=..., tunnel_count=TunnelCount(N))`: a central
+  controller lays out N single-path tunnels for every live head with one common whole-unit planned
+  bandwidth ([T2](#t2-the-controllers-equal-tunnels)).
+- **Live head, dead head (T2).** A head is live when it reaches an allowed destination over links
+  with at least 1 unit of free capacity; a dead head keeps its share of the traffic and loses it.
+- **Design demand.** The volume T1 and T2 size their tunnels for (`design_demand`), separately
+  from the offer they forward. T2's planned bandwidth is metadata, never a hold.
+- **Epoch.** The period from a policy's construction, a `remove()`, a `replace()` or a `forward()`
+  to the next of these; the offers of `place` add up within it.
+- **Black hole.** A node or edge that fails silently: forwarding goes on unchanged and traffic
+  that reaches it disappears there (stale forwarding).
+- **First-hop experiment.** A `LOSSY` `place(float('inf'))` of `ShortestPaths`: each source puts
+  exactly each first link's free capacity on it, which measures how much the sources can push into
+  their first links at once ([section 5](#5-route-allocations-and-admission)).
+- **Record.** A `FlowRecord`: one routed amount of a policy in the ledger, kept per roster source
+  or per program entry ([section 6](#6-the-ledger)).
+- **Gate.** The single native lock of a ledger: calls on one ledger take effect one at a time
+  ([section 8](#8-failures-threads-and-lifetimes)).
+- **Lease.** A call's admission to a `ShortestPathCache`: exclusive while the cache is building,
+  shared while it is frozen ([section 9](#9-the-shortest-path-cache)).
+- **Minimum cut.** For the optimized controller: the edges that leave the nodes the sources can
+  still reach once its solve is maximal, the minimum cut closest to the sources
+  ([the result](#the-result)).
+- **Marginal cost curve.** `(cost, units)` pairs in ascending cost: delivering `units` more units
+  raises the minimum total cost of the flow by `cost` per unit. Delivering more can reroute flow
+  already placed, so the pairs are not the costs of the paths in the final allocation.
+
+The examples from here on share these two helpers:
+
+```python
+import netgraph_core as ngc
+
+def graph(num_nodes, edges, q=1.0):
+    """edges: (source, destination, capacity units, cost) tuples in input order."""
+    sources, destinations, capacities, costs = zip(*edges)
+    return ngc.Graph(num_nodes, list(sources), list(destinations), list(capacities), list(costs), q)
+
+def config(routing, admission=ngc.Admission.LOSSLESS):
+    """A configuration: the routing model and the admission."""
+    return ngc.FlowPolicyConfig(routing=routing, admission=admission)
+```
+
+## 1. Units: the one numeric domain
+
+**In plain words.** Every amount of traffic is a whole number of units, and the graph says how
+big a unit is: its resolution `q`. Physical numbers enter through `to_units` and leave through
+`as_float`; nothing in between is a float, so totals add up exactly and nothing is lost to rounding.
+Costs are a separate kind of number: positive integers that are never converted.
+
+`to_units(x, q)` works in two steps. It first reads `x` as the binary64 value `b` it holds: a float
+is its own value, and an integer becomes the nearest double. It then rounds `b / q` to a whole
+number of units, half up, exactly. Converted back, the result differs from `b` by at most `q / 2`,
+and a tie (exactly half a unit) goes up. Reading an integer above `2^53` as `b` can add an error of
+its own.
+
+At `q = 1/4` (a quarter of a Gbit/s, say):
+
+```python
+print(ngc.to_units([2.6, 0.375, 0.125, 0.1], 0.25).tolist())
+print(ngc.as_float([10, 2], 0.25).tolist())
+```
+
+```text
+[10, 2, 1, 0]
+[2.5, 0.5]
+```
+
+2.6 is about 10.4 units and rounds down to 10, which is 2.5 again. 0.375 is exactly 1.5 units, a
+tie, and goes up to 2, which is 0.5: more than the input. 0.125 is the tie 0.5 and gives 1, and 0.1
+(about 0.4 units) gives 0. A link of 2.6 therefore has a capacity of 2.5 in this graph.
+
+### Splitting whole units
+
+When `I` units are split over `k` members, every member gets whole units. The members have a
+fixed order, which decides every remainder and every tie: a router's next-hop edges in ascending
+EdgeId, a demand's sources in ascending node id, and a head's entries in the program's entry
+order. There are two rules:
+
+- **Round robin** (`EQUAL`): every member gets `I // k` units, and the first `I % k` members in
+  that order get one more. `RR(10, 3) = (4, 3, 3)`.
+- **Highest averages** (`WEIGHTED`, the D'Hondt rule): the units are handed out one at a time,
+  each to the member with the largest `w / (a + 1)` (its weight `w` over its current count `a`
+  plus one), ties to the earlier member in that order. Equal positive weights give round robin.
+
+Highest averages with weights 2 and 1, unit by unit:
+
+| Unit | `w / (a + 1)`: member 0, member 1 | Goes to | Counts after |
+| --- | --- | --- | --- |
+| 1 | 2/1, 1/1 | 0 | 1, 0 |
+| 2 | 2/2, 1/1 (a tie) | 0 | 2, 0 |
+| 3 | 2/3, 1/1 | 1 | 2, 1 |
+| 4 | 2/3, 1/2 | 0 | 3, 1 |
+| 5 | 2/4, 1/2 (a tie) | 0 | 4, 1 |
+| 6 | 2/5, 1/2 | 1 | 4, 2 |
+
+So `H(5, [2, 1]) = (4, 1)`, not the proportional 10/3 and 5/3, and `H(6, [2, 1]) = (4, 2)`: highest
+averages gives a remainder to the larger weight first.
+
+```python
+# Three parallel links of 10 share 10 units by round robin; two links weighted 2:1 share 5, then 6.
+g = graph(2, [(0, 1, 10, 1)] * 3)
+ledger = ngc.FlowLedger(g)
+ngc.FlowPolicy(ledger, 0, 1, config(ngc.ShortestPaths())).place(10)
+print("RR(10, 3):", ledger.carried().tolist())
+g = graph(2, [(0, 1, 100, 1), (0, 1, 100, 1)])
+wcmp = ngc.ShortestPaths(allocation=ngc.RouteAllocation.WEIGHTED,
+                         weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[2, 1])
+for x in (5, 6):
+    ledger = ngc.FlowLedger(g)
+    ngc.FlowPolicy(ledger, 0, 1, config(wcmp)).place(x)
+    print(f"H({x}, [2, 1]):", ledger.carried().tolist())
+```
+
+```text
+RR(10, 3): [4, 3, 3]
+H(5, [2, 1]): [4, 1]
+H(6, [2, 1]): [4, 2]
+```
+
+**Exact rules.**
+
+- Both rules are exact: every unit goes to some member, unless every weight is 0, and then no
+  unit is assigned (a proportional share is undefined). A share that rounds down to zero leaves
+  its unit to a sibling.
+- Both are monotone: when `I` grows, no member's share shrinks.
+- **The local rounding bound.** For one split into `k` members, each member's absolute rounding
+  error, relative to that split's actual integer input and effective weights, is below `k` units
+  (`k * q` physically), and below one unit for equal positive weights. This is a local bound, not
+  an end-to-end delivery bound.
+- Highest averages is not the closest proportional rounding: weights `[100, 1, 1, 1]` and 50 units
+  give `[50, 0, 0, 0]` (total absolute error `300/103` against the exact shares
+  `[5000/103, 50/103, 50/103, 50/103]`, where `[49, 1, 0, 0]` would have `200/103`).
+
+### The conversion exactly
+
+- **Resolution.** A graph's resolution `q` is a power of two in `[2^-32, 2^32]`, given
+  explicitly when the graph is built; there is no default. The resolution is the precision of
+  every result: there is no finer grid. A model that needs finer splits uses a smaller `q`.
+- **Amounts.** Capacities, residuals, allocations, requests, deliveries, offers and drops are
+  integers in units of `q`. In Python they are `int` (exact, unbounded); per-edge arrays are
+  NumPy `int64[E]`. Cumulative counters that are sums over many calls (a Lossy record's
+  `offered` and its per-edge `edge_drops`) may exceed 64 bits; Python returns them as exact `int`.
+  Cumulative counters must remain below `2^127`. A call that would reach that limit raises
+  `ValueError('<counter> limit exceeded')` and publishes nothing; the cumulative request is
+  checked before computation.
+- **Domain.** Every edge capacity, and the sum of all capacities, is below `2^62` units. Edge
+  costs are integers of at least 1 and their sum is below `2^62`, so no path cost reaches the
+  sentinel `UNREACHABLE` (the largest `int64`). An offer is an integer in `[0, 2^62)` units or
+  positive infinity (`float('inf')`, "as much as possible"). Everything outside the domain is a
+  `ValueError` raised before anything changes. The limits on the sizes of a call are in
+  [section 8](#limits-that-refuse-a-call).
+- **`to_units(x, q)`** reads each physical input as its binary64 value `b`: Python floats and
+  NumPy float64 keep their exact value, float32 widens exactly, and integers become the nearest
+  double, ties to even (`2^53 + 1` becomes `2^53`, `2^53 + 3` becomes `2^53 + 4`). It returns
+  `floor(b/q + 1/2)`, evaluated exactly on rational numbers, not by floating addition of `1/2`.
+  A scalar or 0-d NumPy array gives an `int`; a Python sequence or 1-d NumPy array gives an
+  `int64` array. Negative zero gives 0. NaN, infinity, negative values and results at or above
+  `2^62` units raise `ValueError`. This is the only entry for physical numbers.
+- **Ties.** The ties are exactly the accepted `b = (2*n + 1)*q/2` for integers `0 <= n < 2^52`
+  (at and above `2^52 * q`, `b/q` is an integer). Every tie gives `n + 1`, never the even
+  neighbour. At `q = 1`, `0.5` gives 1, `2.5` gives 3, `3.5` gives 4, and the last tie
+  `2^52 - 1/2` gives `2^52`.
+- **Binary values and precision.** A float is never read through its printed decimal; conversion
+  cannot recover a source literal. `2^53` is the limit of consecutive integers among doubles,
+  not a size below which decimal fractions are exact. A decimal is exactly a double only if
+  its reduced denominator is a power of two and it fits binary64; even `0.1` is rounded on
+  parsing. A decimal and its parsed double give the same units exactly when both lie in the
+  same cell `[(n - 1/2)*q, (n + 1/2)*q)`. No magnitude or unit count guarantees this: a parse
+  error can cross or land on a boundary at an ordinary size. At `q = 2^-21`, `5501195.1796`
+  denotes the exact binary tie `11536842473288.5` units, giving `11536842473289`; the typed
+  decimal would be `11536842473288.4992` units. At `q = 2^-18`, the computed `400 + 2^-19`
+  is the tie `104857600.5` and gives `104857601`, although its printed decimal
+  `400.00000190734863` is just below the tie. `np.float32(0.1)` is exactly
+  `13421773/134217728`, giving `429496736` units at `q = 2^-32`; decimal `0.1` would give
+  `429496730`. `CostStretch` deliberately uses the printed decimal instead: a stretch is a
+  ratio a person writes (`1.2` means `6/5`), compared exactly with ratios of integer costs.
+  A physical amount is the measured or computed double the caller holds.
+- **`as_float(u, q)`** returns the correctly rounded binary64 value of the exact product `u*q`
+  (nearest, ties to even). Here `u` may be any signed, unbounded integer, unlike graph and
+  flow amounts. An integer scalar gives a `float`, an integer vector a `float64` array.
+  An int or NumPy integer, a subclass included, is never read as a sequence.
+  The result is finite exactly when `abs(u*q) < 2^1024 - 2^970`; otherwise it raises
+  `ValueError('as_float: <u> units times the resolution exceed the largest finite double')`.
+  Every `abs(u) <= 2^53`, including the endpoint, converts exactly. Beyond `2^53`, an integer
+  of binary length `L` converts exactly iff it is divisible by `2^(L - 53)`; `2^53 + 1`
+  gives `2^53*q`, and `2^53 + 3` gives `(2^53 + 4)*q`. Costs are never converted.
+- **Round trip.** `to_units(as_float(u, q), q) == u` for every `u` in `[0, 2^53]` at every
+  resolution, and for larger `u` in `[0, 2^62)` exactly when `u` is a double. Otherwise the
+  result is the units of the rounded value. The first failure, `2^53 + 1`, comes back as
+  `2^53`; `2^62 - 1` becomes `2^62*q`, which `to_units` refuses.
+- **The error against `b`.** Every successful `to_units` result `u` is itself a double, so
+  `as_float` adds no error: `e = as_float(to_units(b, q), q) - b` satisfies `-q/2 < e <= q/2`,
+  with equality at the upper end exactly at ties. Against an argument `a` changed by promotion (a
+  large integer, or a wider NumPy float where the platform has one), the error is `e + (b - a)`:
+  `2^53 + 1` at `q = 1` has error 0 against `b`, but -1 against the integer passed. There is no
+  exact-integer path for physical inputs.
+- **Sums.** Rounding `N` values separately gives a total error in `(-N*q/2, N*q/2]`. Ties
+  contribute `+q/2` each; other errors go either way, so a sum has no promised sign. At `q = 1`,
+  `[0.5, 0.5]` gives `[1, 1]` (2 units for a total of 1), while `[0.25, 0.25]` gives `[0, 0]`
+  (0 units for a total of 0.5). When non-tie fractional parts are symmetric about `1/2`, their
+  mean error cancels and the mean error per value is `(q/2)*P(tie)`; a continuous uniform
+  fractional part has none. The Core assumes no distribution. Round a demand once, then split
+  whole units to preserve its total: rounding `1.0` once gives 1 unit.
+- **Choosing `q`.** Choose one `q` before graph construction and use the constructed graph's
+  `resolution()` afterwards. Choosing `q` and reporting rounding belong to the caller (NetGraph's
+  units report); the Core converts and validates, without a selector or rounding report.
+- **Routability.** An edge of capacity 0 carries nothing, but it stays in routing: searches,
+  routes and rosters treat it like any other edge. Zero capacity alone never excludes an edge: an
+  Eligibility excludes it, the route choice can keep another of its parallel members
+  ([section 4](#the-route-choice)), and a supplied residual adds a capacity threshold. An equal
+  split still sends such an edge its share, which it cannot carry
+  ([section 5](#5-route-allocations-and-admission)). A physical offer below `q / 2` converts to
+  0 units. A `place(0)` (in a model that has `place`) is accepted after validation and does
+  nothing; its result is `COMPLETE`. A full zero offer (`evaluate(0)`, `replace(0)`, `forward(0)`)
+  is a whole computation or forwarding of nothing, and `replace(0)` publishes it
+  ([operations](#operations-evaluate-replace-and-forward)). Neither is a removal: `remove()` is.
+- **Conservation.** At every node, the traffic that arrives plus what the node injects equals what
+  it sends on plus what it delivers plus what it loses there, exactly; an edge carries what it is
+  sent minus what it drops. The ledger's totals are exactly the sums of its records.
+
+```python
+print(ngc.to_units([1.5, 2.5, 0.4, 0.5], 1.0).tolist())   # half up
+print(ngc.to_units(10.0, 2.0**-12), ngc.as_float(40960, 2.0**-12))
+```
+
+```text
+[2, 3, 0, 1]
+40960 10.0
+```
+
+## 2. The graph
+
+**In plain words.** A `Graph` is built once from arrays and never changes. Every edge gets a
+public number, its EdgeId, by sorting the edges by source, cost and destination; only edges
+that agree on all three keep their input order among themselves. A map gives back each edge's
+input position. All per-edge arrays the library reads or returns are in EdgeId order, and every
+tie rule of the library ("the lowest EdgeId") refers to this order. A caller who keeps per-edge
+values in input order (explicit weights, a residual, exclusions) maps them through
+`input_positions()` first.
+
+**Exact rules.**
+
+- **Construction.** `Graph(num_nodes, edge_sources, edge_destinations, edge_capacity_units,
+  edge_costs, resolution)` builds an immutable directed multigraph: parallel edges and self-loops
+  are allowed. The arrays are in input order (the caller's). Capacities are already in units; use
+  `to_units` for physical values.
+- **Validation order.** When an input has several defects, the first in this order is reported (a
+  wrong type as a `TypeError`, a value outside its domain as a `ValueError`): the resolution (a
+  bool is a `TypeError`); the capacity values (each an integer in `[0, 2^62)`; floats and booleans
+  are rejected with `TypeError`, not rounded); the array shapes; a zero or negative cost; the remaining
+  bounds (node ids in range, then the capacity and cost sums below `2^62`, both added up edge by
+  edge in input order: the first edge at which a running sum reaches `2^62` reports that sum, the
+  capacity sum before the cost sum at the same edge). Integers are read
+  without narrowing, so the reported error does not depend on how the same input is represented.
+- **Size.** Node ids and EdgeIds are `int32`: a graph has at most `INT32_MAX` (`2^31 - 1`) nodes
+  and at most as many edges. The constructor accepts every graph within these bounds, and the
+  searches and route values work on all of them. A flow solve has slightly smaller limits
+  ([section 8](#limits-that-refuse-a-call)).
+- **EdgeId.** The EdgeId of an edge is its rank in the stable order `(source, cost, destination,
+  input position)`. `input_positions()[e]` is the input position of edge `e`; the inverse map is
+  the caller's to build (one pass over `E`).
+- **EdgeId order is the coordinate of every per-edge value.** Residual arrays, explicit weights,
+  Eligibility exclusions, DAG and Path edges, flows, records, `saturated_boundary_edges`, `min_cut`
+  and the entries of `evaluate_edge_failures` all use EdgeIds. A caller that keeps per-edge data in
+  input order translates it first: an in-range id in the wrong coordinate is silently a different
+  edge, and no check can catch that.
+- **Layout guarantees.** The out-edges of node `u` are exactly the ids
+  `outgoing_offsets()[u]` to `outgoing_offsets()[u + 1] - 1`, in `(cost, destination, input)`
+  order, and `edge_destinations()[e]` is the head of `e`. The in-edges of node `v` are
+  `incoming_edges()[incoming_offsets()[v]:incoming_offsets()[v + 1]]`, as EdgeIds in
+  `(cost, source, input)` order. Both offset arrays have `N + 1` entries, starting at 0 and ending
+  at `E`, also for an empty graph.
+- **Accessors.** `edge_capacity_units()`, `edge_costs()` (`int64[E]`), `edge_sources()`,
+  `edge_destinations()`, `input_positions()`, `outgoing_offsets()`, `incoming_offsets()` and
+  `incoming_edges()` (`int32`) are read-only NumPy views that keep the graph alive;
+  `max_edge_cost()` and `edge_cost_gcd()` are 0 for a graph without edges; `num_nodes()`,
+  `num_edges()` and `resolution()` read the sizes; `uid()` is a process-unique number, never
+  reused.
+- **Ids belong to one graph.** Building a graph from different arrays, or with another release of
+  the library, may renumber the edges. Every value bound to a graph (Eligibility, PredecessorDAG,
+  Path, program, ledger, cache) is rejected with another graph.
+
+The three edges below, sorted by (source, cost, destination), are 0 -> 1 (cost 1), 0 -> 2 (cost 5)
+and 1 -> 2: EdgeIds 0, 1 and 2, from input positions 2, 1 and 0.
+
+```python
+# Input order: edge 0 = 1->2, edge 1 = 0->2 (cost 5), edge 2 = 0->1.
+g = ngc.Graph(3, [1, 0, 0], [2, 2, 1], [7, 8, 9], [1, 5, 1], 1.0)
+print("sources", g.edge_sources().tolist(), "destinations", g.edge_destinations().tolist(), "costs", g.edge_costs().tolist())
+print("input_positions", g.input_positions().tolist(), "outgoing_offsets", g.outgoing_offsets().tolist())
+```
+
+```text
+sources [0, 0, 1] destinations [1, 2, 2] costs [1, 5, 1]
+input_positions [2, 1, 0] outgoing_offsets [0, 2, 3, 3]
+```
+
+### Eligibility
+
+**In plain words.** An `Eligibility` says which nodes and edges of one graph may be used, for
+example to model a failure or a maintenance window. It is built from lists of exclusions and
+never changes.
+
+**Exact rules.**
+
+- `graph.eligibility(excluded_nodes=(), excluded_edges=())` builds the value. Duplicates and
+  unsorted lists are accepted; out-of-range ids raise `ValueError`. An edge is allowed when it is
+  not excluded and both its endpoints are allowed. `node_allowed()` and `edge_allowed()` are
+  read-only boolean views.
+- Empty lists give the all-allowed value, whose `uid()` is 0. Every other value has a fresh uid;
+  equal lists built twice give two different uids. Wherever an Eligibility is optional, `None`
+  means everything is allowed.
+- `Eligibility.intersect(a, b)` allows what both allow. When the result equals one operand, that
+  operand is returned (same uid); otherwise the result is a new value with a new uid. Both
+  operands must belong to the same graph.
+- Uids matter for the [shortest-path cache](#9-the-shortest-path-cache): its key contains the
+  Eligibility uid, so build each state once and reuse the value.
+- An excluded endpoint takes no part in a search or a policy: an excluded root or target in a
+  set is skipped, and an excluded single endpoint gives an empty result.
+
+Excluding node 2 of the graph above also excludes the two edges that touch it:
+
+```python
+mask = g.eligibility(excluded_nodes=[2])
+print(mask.node_allowed().tolist(), mask.edge_allowed().tolist(), mask.uid() != 0)
+```
+
+```text
+[True, True, False] [True, False, False] True
+```
+
+## 3. Route values: PredecessorDAG and Path
+
+**In plain words.** A route is either a DAG of predecessor edges (the shape a search returns:
+possibly many equal-cost walks) or a `Path` (one explicit walk, each hop one edge or several
+parallel edges). Both are immutable, bound to their graph and checked once when built.
+
+**Exact rules.**
+
+- **`PredecessorDAG`.** For node `v`, its entries are `parents()[k]` (the parent node) and
+  `via_edges()[k]` (the edge from that parent) for `k` from `parent_offsets()[v]` to
+  `parent_offsets()[v + 1] - 1`, in strictly ascending EdgeId. This is the one canonical form:
+  two DAGs of the same graph are equal exactly when their entries are equal; DAGs of different
+  graphs are never equal. `parents()` and `via_edges()` are read-only views; `parent_offsets()`
+  is built on demand.
+- **`PredecessorDAG.from_csr(graph, parent_offsets, parents, via_edges)`** validates, before
+  reading any structure: `parent_offsets` has `N + 1` entries, starts at 0, never decreases and
+  ends at `len(parents) == len(via_edges)`; then every id is in range, every via edge joins its
+  parent to its
+  node, no `(node, via)` pair repeats, the DAG has no cycle and every node's entries are in
+  ascending via EdgeId. A wrong type raises `TypeError`; structural and range defects raise
+  `ValueError`, in the order above.
+- **`Path(graph, hops)`.** `hops` is a list of hops, each a non-empty list of EdgeIds that share
+  one `(u, v)` pair (parallel members). Validation, in order: every member id in range, no
+  member twice, at least one hop, no empty hop, the members of a hop share `(u, v)`, consecutive
+  hops connect, no node is visited twice. The members keep the caller's order. `cost()` is the
+  sum over the hops of each hop's cheapest member; `source()`, `destination()` and `hops()` read
+  the walk;
+  `to_dag()` gives the equivalent `PredecessorDAG`. A single-member walk is `[[e1], [e2], ...]`.
+- **`resolve_to_paths(graph, dag, source, destination, split_parallel_edges=False,
+  max_paths=None)`** lists the `source -> destination` walks of a DAG as `Path` values in
+  increasing `(cost, hop count, edge-id
+  sequence)`, where a hop costs its cheapest member and is represented in the key by its lowest
+  member id. With `split_parallel_edges=False` the parallel members of a pair stay together in
+  one hop (ascending); with `True` every member combination is a separate path, and the paths are
+  sorted by each path's own `(cost, hop count, edge-id sequence)`. `max_paths` (at least 1) keeps
+  the first paths of that order. `source == destination`, a DAG of another graph or
+  `max_paths < 1` raise `ValueError`; an endpoint outside the DAG, or no walk, gives `[]`.
+
+
+Two parallel edges 0 -> 1 of costs 1 and 3 (EdgeIds 0 and 1), then 1 -> 2 (EdgeId 2). A hop that
+holds both parallel edges costs its cheapest member, so the path costs 1 + 1. The same route as a
+DAG lists node 1's two entries and node 2's one; listing its walks with the parallel members
+split gives the cost-2 and the cost-4 path:
+
+```python
+g = graph(3, [(0, 1, 5, 1), (0, 1, 5, 3), (1, 2, 5, 1)])
+path = ngc.Path(g, [[0, 1], [2]])
+dag = ngc.PredecessorDAG.from_csr(g, [0, 0, 2, 3], [0, 0, 1], [0, 1, 2])
+print(path.cost(), path.to_dag() == dag, dag.via_edges().tolist())
+print([(p.cost(), p.hops()) for p in ngc.resolve_to_paths(g, dag, 0, 2)],
+      [(p.cost(), p.hops()) for p in ngc.resolve_to_paths(g, dag, 0, 2, split_parallel_edges=True)])
+```
+
+```text
+2 True [0, 1, 2]
+[(2, [[0, 1], [2]])] [(2, [[0], [2]]), (4, [[1], [2]])]
+```
+
+## 4. Search
+
+**In plain words.** `spf` finds shortest paths from a set of roots, forward or in reverse,
+either to every node or only to the nearest of a set of targets. It returns the shortest-path
+DAG, which contains every shortest route at once, or, on request, one canonical path chosen by a
+fixed rule. `ksp` lists the K shortest simple paths in a fixed order. Capacity alone never
+removes an edge from a search: an eligible edge of capacity 0 is a route like any other. The route
+choice can keep one of several parallel members (below), and only a supplied residual adds a
+capacity threshold.
+
+### The route choice
+
+The searches and the models that choose routes (`ShortestPaths`, T1's CSPF) share one rule set.
+Cost always comes first; the rest only orders equal-cost choices.
+
+- **`tie_break: RouteTieBreak`**, one of four values: `FEWER_HOPS` (the default: cost, then fewer
+  hops, then the smaller EdgeId sequence), `HIGHER_CAPACITY`, `HIGHER_AVAILABLE_CAPACITY` and
+  `HIGHER_HEADROOM` (cost, then the larger bottleneck of the named edge score, then fewer hops,
+  then the smaller EdgeId sequence).
+- **Edge scores.** `HIGHER_CAPACITY` reads the static capacity; `HIGHER_AVAILABLE_CAPACITY` the
+  availability of the current search; `HIGHER_HEADROOM` the availability divided by the static
+  capacity, compared exactly as a fraction (an edge of capacity 0 scores 0). The availability
+  depends on the caller:
+
+  | Caller | Availability |
+  | --- | --- |
+  | `spf`, `ksp` with a `residual` | the supplied `residual` |
+  | `spf`, `ksp` without one | the static capacity (`HIGHER_HEADROOM` then reads 1 on an edge of positive capacity and 0 on an edge of capacity 0) |
+  | `ShortestPaths` | its service view when the program is prepared ([routing models](#routing-models)) |
+  | T1's CSPF | its setup view, minus the requests of the tunnels already up in the same setup ([T1](#t1-tunnels-set-up-by-their-heads)) |
+- **`multipath: bool`** (`ShortestPaths` and `spf` only; default `True`): `True` keeps every
+  equal-cost route (a DAG), `False` the one canonical path. `None` is not a value. T1 always
+  builds single-path tunnels; `ksp` always returns individual paths.
+- **`parallel_edges: bool`** (default `True`): `True` keeps every eligible parallel member of a
+  `(u, v)` pair; `False` keeps one per pair by the member rule.
+- **The member rule** (`parallel_edges=False`). Of the eligible parallel members of a pair, keep
+  the one with the lowest cost; among those, under a `HIGHER_*` rule, the one with the highest
+  score; then the lowest EdgeId. This choice happens before any route is searched, so it can
+  change which walks exist.
+- **No silent no-op.** With `multipath=True` and `parallel_edges=True` a tie rule has nothing to
+  choose, so a `HIGHER_*` value there is rejected: `spf tie_break requires multipath=False or
+  parallel_edges=False` (and `ShortestPaths tie_break requires multipath=False or
+  parallel_edges=False` for a model). `FEWER_HOPS` is always valid and never prunes the all-routes
+  DAG by hop count. T1 and `ksp` always order paths and need no such rule.
+- **The tie rule never supplies weights** (`ShortestPaths` `WEIGHTED` reads a `WeightBasis`) and
+  never enables a controller objective (T2's headroom objective is its own option).
+- **Static eligibility** (always): the Eligibility. Capacity is never a condition: an edge of
+  capacity 0 is searched like any other.
+- **Residual gating** (only when a `residual` array is supplied): `residual` is an `int64` array
+  in EdgeId order with every entry in `[0, edge_capacity_units[e]]`. It excludes edges whose
+  residual is below the threshold (`min_residual` units for `spf`, 1 unit for `ksp`) and supplies
+  the availability of the tie scores. It is read during the call only and must not change during
+  it.
+
+### Shortest paths
+
+`spf(graph, roots, SpfOptions(direction, *, targets=None, tie_break=FEWER_HOPS, multipath=True,
+parallel_edges=True, residual=None, min_residual=1, eligibility=None))` returns an `SpfResult` with
+`costs`, `dag` and `target_cost`.
+
+- **Roots and targets** are one node id or a sequence. Every root starts at distance 0.
+  Duplicates are removed. Validated in this order before any work (`ValueError`): the roots
+  (non-empty, ids in range), the targets (the same), a node in both sets, `multipath=False`
+  without targets (`multipath = false requires targets (the single path joins a root to a
+  target)`), the ineffective tie rule above, the residual (length, then every entry),
+  `min_residual` (an integer of at least 1), a foreign Eligibility. Excluded roots and targets are
+  skipped; when every root is excluded the result is empty, not an error.
+- **Direction.** `FORWARD` searches from the roots along the edges. `REVERSE` searches toward the
+  roots against the edges, but the DAG it returns keeps the edges' own orientation: its walks
+  run from a target toward a root. A forward and a reverse search with the roles of roots and
+  targets exchanged describe the same shortest walks.
+- **Without targets** every reachable node gets its final distance: `costs` is a read-only
+  `int64[N]` array with `UNREACHABLE` for the nodes not reached, `dag` holds every tight edge,
+  `target_cost` is `None`.
+- **With targets** the search stops at the cost of the nearest targets (anycast: the nearest of
+  a set). `target_cost` is that cost (`None` when no target is reached), `dag` keeps only the
+  walks that end in a target at that cost, and `costs` is `None`.
+- **The DAG is unique.** With `multipath=True`, costs are positive, so the member graph, the
+  roots, the direction and the targets (or their absence) determine one DAG. The member graph
+  changes through `parallel_edges`, the member rule, static eligibility and residual gating; with
+  the member graph fixed, the tie rule, the capacity and residual values and the C++ queue choice
+  do not change the DAG. A forward search with targets and a reverse search with the
+  roots and the targets exchanged return the same DAG. Without targets the two directions can
+  return different DAGs, also when the reverse search is rooted at a node the forward search
+  reaches: each keeps the edges tight in its own direction.
+
+### The canonical single path
+
+With `multipath=False` (targets required), `spf` returns the one walk from a root to a target
+that is first in this order:
+
+1. the lowest **cost**;
+2. under a `HIGHER_*` tie rule only: the highest **bottleneck**, the smallest edge score along
+   the walk (`FEWER_HOPS` skips this step);
+3. the fewest **hops**;
+4. the lexicographically smallest **sequence of EdgeIds** along the walk.
+
+The order is total, so the walk is unique. The same walk is returned by a forward search, by a
+reverse search with the roles exchanged, and by `ksp` with `k=1`. Note the order of steps 3 and
+4: a walk with fewer hops wins even when its first EdgeId is larger. These steps compare whole
+walks, never their first edge alone. The member rule above is a separate, earlier choice: with
+`parallel_edges=False` each pair is first reduced to one member, and the canonical path is then
+chosen among the walks that remain.
+
+```python
+F = ngc.Direction.FORWARD
+# Two equal-cost walks 0->1->3 (capacity 1) and 0->2->3 (capacity 5).
+g = graph(4, [(0, 1, 1, 1), (0, 2, 5, 1), (1, 3, 1, 1), (2, 3, 5, 1)])
+for tie in (ngc.RouteTieBreak.FEWER_HOPS, ngc.RouteTieBreak.HIGHER_CAPACITY):
+    r = ngc.spf(g, 0, ngc.SpfOptions(F, targets=3, tie_break=tie, multipath=False))
+    print(tie.name, r.target_cost, r.dag.via_edges().tolist())
+
+# Equal cost 2: the direct edge (EdgeId 1) against the two-hop walk [0, 2].
+g = graph(3, [(0, 1, 1, 1), (1, 2, 1, 1), (0, 2, 1, 2)])
+r = ngc.spf(g, 0, ngc.SpfOptions(F, targets=2, multipath=False))
+print("fewest hops:", [p.hops() for p in ngc.resolve_to_paths(g, r.dag, 0, 2)])
+full = ngc.spf(g, 0, ngc.SpfOptions(F))
+print("costs", full.costs.tolist(), "dag", full.dag.via_edges().tolist())
+```
+
+```text
+FEWER_HOPS 2 [0, 2]
+HIGHER_CAPACITY 2 [1, 3]
+fewest hops: [[[1]]]
+costs [0, 1, 2] dag [0, 1, 2]
+```
+
+The bottleneck is the whole walk's, not its first edge's. Below, a direct link 0 -> 2 of capacity 3
+and cost 2 (EdgeId 1) competes with 0 -> 1 -> 2, cost 1 + 1 (EdgeIds 0 and 2), whose first link has
+capacity 10. With the second hop at 10, `HIGHER_CAPACITY` takes the two hops (bottleneck 10 against
+3); with it at 1, the two-hop bottleneck is 1, and every rule takes the direct link:
+
+```python
+for second in (10, 1):
+    g = graph(3, [(0, 1, 10, 1), (1, 2, second, 1), (0, 2, 3, 2)])
+    picks = []
+    for tie in (ngc.RouteTieBreak.FEWER_HOPS, ngc.RouteTieBreak.HIGHER_CAPACITY):
+        r = ngc.spf(g, 0, ngc.SpfOptions(F, targets=2, tie_break=tie, multipath=False))
+        picks.append(r.dag.via_edges().tolist())
+    print("second hop", second, picks)
+```
+
+```text
+second hop 10 [[1], [0, 2]]
+second hop 1 [[1], [1]]
+```
+
+### K shortest paths
+
+`ksp(graph, source, destination, KspOptions(k, *, tie_break=FEWER_HOPS, parallel_edges=True,
+cost_ceiling=None, residual=None, eligibility=None))`
+returns a list of `(cost, Path)` pairs; every hop of every Path has one member.
+
+- **Order.** The simple `source -> destination` paths of the member graph in increasing `(cost,
+  -bottleneck under a HIGHER_* rule, hop count, edge-id sequence)`: the canonical order above
+  applied to whole paths. The result is the first `k` paths of that order that are within the
+  ceiling.
+- **Parallel members.** `parallel_edges=True` makes every eligible member a separate path;
+  `parallel_edges=False` keeps one member per pair by the member rule. `ksp` has no `multipath`.
+- **Ceiling.** `cost_ceiling` is `None`, `AbsoluteCost(c)` (cost at most `c`; `AbsoluteCost(0)` is
+  a valid budget) or `CostStretch(f)` (cost at most `f` times the static shortest cost of the
+  member graph under the Eligibility, residual ignored, edges of capacity 0 included). Both are
+  inclusive and compared exactly ([CostStretch](#cost-ceilings-and-the-exact-stretch)). With a
+  stretch, no static route gives `[]`.
+- **Residual gating** at 1 unit when a residual is supplied.
+- Validated in this order before any work (`ValueError` unless stated): `source` and
+  `destination` in range, `source == destination` (`node <v> is in both endpoint sets: source and
+  destination must not overlap`), `k >= 1` (`k must be >= 1 (got <k>)`), the ceiling (a value of
+  another type: `TypeError("cost_ceiling must be AbsoluteCost, CostStretch or None")`; then
+  `cost_ceiling AbsoluteCost cost must be >= 0 (got <c>)` or `cost_ceiling CostStretch factor must
+  be >= 1 (got <n>/<d>)`), the residual (length, then every entry), a foreign Eligibility.
+  `KspOptions` keeps the ceiling as given; `ksp` checks it in this place. An excluded endpoint or
+  no path gives `[]`.
+
+```python
+g = graph(3, [(0, 1, 3, 1), (0, 1, 5, 1), (1, 2, 9, 1)])   # parallel members 0 and 1
+higher = ngc.RouteTieBreak.HIGHER_CAPACITY
+for options in (ngc.KspOptions(5), ngc.KspOptions(5, tie_break=higher),
+                ngc.KspOptions(5, tie_break=higher, parallel_edges=False)):
+    print([(c, p.hops()) for c, p in ngc.ksp(g, 0, 2, options)])
+r = ngc.spf(g, 0, ngc.SpfOptions(F, targets=2))
+print([p.hops() for p in ngc.resolve_to_paths(g, r.dag, 0, 2)],
+      [p.hops() for p in ngc.resolve_to_paths(g, r.dag, 0, 2, split_parallel_edges=True)])
+```
+
+```text
+[(2, [[0], [2]]), (2, [[1], [2]])]
+[(2, [[1], [2]]), (2, [[0], [2]])]
+[(2, [[1], [2]])]
+[[[0, 1], [2]]] [[[0], [2]], [[1], [2]]]
+```
+
+### Cost ceilings and the exact stretch
+
+`AbsoluteCost(cost)` is an inclusive cost bound, an integer (`AbsoluteCost cost must be an integer
+(got <type>)`, `TypeError`); a negative cost constructs and is refused where it is used.
+`CostStretch(factor)` is one exact reduced fraction `n/d` with `d >= 1`, converted in this order:
+
+1. a boolean (Python `bool` or `numpy.bool_`) raises `TypeError`;
+2. a `fractions.Fraction` is taken as it is;
+3. a float (a Python `float` or any NumPy floating value) is `Fraction(str(f))`, the shortest
+   decimal that value's own type prints: `CostStretch(1.2)`, `CostStretch(numpy.float32(1.2))` and
+   `CostStretch(Fraction(6, 5))` are all exactly 6/5, never the binary value of the float. A NaN
+   or an infinity raises `ValueError` (`CostStretch factor must be finite (got <value>)`);
+4. an integer (an `int`, a NumPy integer, any object with `__index__`) is `n/1`;
+5. anything else raises `TypeError` (`CostStretch factor must be a Fraction, a float or an integer
+   (got <type>)`).
+
+Then the reduced components are checked: `CostStretch fraction numerator must be in [-2^63, 2^63)`,
+then `CostStretch fraction denominator must be in [1, 2^63)` (`Fraction(2**64, 2**62)` reduces to
+4/1 and is accepted). `factor` returns the `Fraction`; equality, `hash` and `repr` follow it. A
+factor below 1 is a valid value, refused where the ceiling is used. A path of cost `c` passes
+`CostStretch(n/d)` against a baseline `c0` exactly when `c * d <= n * c0`, both products computed
+exactly in 128 bits. For `ksp` the baseline is the static shortest cost; for T1 it is one baseline
+for the whole pool of heads ([T1](#t1-tunnels-set-up-by-their-heads)).
+
+```python
+from fractions import Fraction
+print(ngc.CostStretch(1.2).factor, ngc.CostStretch(1.2) == ngc.CostStretch(Fraction(6, 5)),
+      ngc.CostStretch(Fraction(2**64, 2**62)))
+# Two links 0 -> 1 of cost 5 and 6: a stretch of 1.2 admits the cost-6 link at equality, 11/10 does not.
+g = graph(2, [(0, 1, 1, 5), (0, 1, 1, 6)])
+for factor in (1.2, Fraction(11, 10)):
+    paths = ngc.ksp(g, 0, 1, ngc.KspOptions(2, cost_ceiling=ngc.CostStretch(factor)))
+    print(factor, [cost for cost, _ in paths])
+```
+
+```text
+6/5 True CostStretch(Fraction(4, 1))
+1.2 [5, 6]
+11/10 [5]
+```
+
+## 5. Route allocations and admission
+
+**In plain words.** A route allocation decides how a demand's traffic is split at every router of
+its routes. `EQUAL` splits equally (ECMP); `WEIGHTED` splits by fixed integer weights (WCMP);
+`OPTIMIZED` is a controller that sends as much as the routes can carry, the cheapest way.
+Admission is a separate choice. `LOSSLESS` admits the largest total that the split carries with no
+edge overloaded and no share left without a route, and refuses the rest before it enters. `LOSSY`
+forwards the whole offer hop by hop, as routers do, and drops on each edge what does not fit.
+
+**Exact rules.**
+
+- **Members.** A demand uses the part of its route (a DAG or a path) that reaches its destination
+  set through the edges its allocation may use: its members.
+  - `EQUAL`: every edge of the route, an edge of capacity 0 included. A router splits over every
+    next hop it has, so such an edge receives its round-robin share and carries none of it
+    (`LOSSLESS` then admits only totals that give it nothing; `LOSSY` drops the share there).
+  - `WEIGHTED`: the edges of positive weight (below). A branch left without such an edge is
+    dropped from the route, inside the existing route only: it never takes a longer bypass.
+  - `OPTIMIZED`: every edge of the route, an edge of capacity 0 included, so a zero-capacity
+    shortest route is never bypassed; the solve can put flow only where its service view has free
+    capacity.
+  - `LOSSY` forwards over the same members as `LOSSLESS`.
+- **`OPTIMIZED`** solves the minimum-cost flow of the demand's cumulative amount on its route,
+  over its service view (the free capacity plus the policy's own current allocation). It may move
+  the policy's own earlier allocation (that is what lets it reach the maximum); it never moves
+  another policy's. It fills the cheapest walks of a mixed-cost route first. Per-edge changes
+  between calls can be negative. With `ShortestPaths` it solves the whole demand at once, over the
+  union of its sources' routes ([section 7](#routing-models)). `OPTIMIZED` is Lossless only: a
+  controller never drops. A solve beyond the flow core's size limits raises `ValueError`
+  ([section 8](#limits-that-refuse-a-call)).
+- **`WEIGHTED`** splits at every node by highest averages over integer weights frozen when the
+  route is prepared. The **weight basis** (`WeightBasis`) says where they come from:
+
+  | `weight_basis` | A member's weight |
+  | --- | --- |
+  | `CAPACITY` (the default) | the static capacity of the outgoing link, not of the branch behind it |
+  | `EXPLICIT` | `edge_weights[e]`: one integer per edge in EdgeId order, each in `[0, 2^62)`, validated in full; a positive weight on an edge of capacity 0 becomes 0 |
+  | `RESIDUAL_SNAPSHOT` | the member's free capacity, read once when the program is prepared: for a policy, its service view at that call's entry (the ledger's residual, plus the policy's own traffic for `evaluate` and `replace`); for `from_routes` and `from_dag`, the `residual` they are given |
+
+  The tie rule never chooses weights. Weights are never renormalised: a member whose residual
+  later shrinks limits the demand. Equal positive weights give exactly round robin:
+  `H(x, [w] * k) = RR(x, k)`.
+- **`EQUAL`** splits at every node by round robin over its members, which are frozen when the
+  program is prepared.
+- **The lossless bound** (`EQUAL`, `WEIGHTED` and every fixed program). A total fits when its
+  forwarding from zero, by the program's own splits and with no drops, puts no edge above its free
+  capacity and leaves no share without a route (a router or source whose members all have weight
+  0, a head with no usable entry). Because the split rules are monotone, raising a total never
+  takes units away from an edge, so the totals that fit are exactly `0` to some largest `T_max`. A
+  `LOSSLESS` call raises the demand's delivered amount `T` to the smaller of `T` plus the call's
+  offer and `T_max`. When a capacity is what stops it, that edge is exactly full at `T_max`: there
+  is no safety margin. A share without a route can stop it earlier, with every edge below its
+  capacity (the example of two sources below).
+- **Lossy forwarding** (`ShortestPaths` with `WEIGHTED` or `EQUAL`, T1, T2 and `Pinned`). Each
+  call's offer is split at every node by the allocation's rule; each edge carries the smaller of
+  what reaches it and its residual, and the rest is dropped on that edge (where several routes of
+  one program, or of several demands forwarded together, meet on an edge,
+  [the loss rule](#losses-on-shared-edges) divides what it carries). The delivery is what reaches
+  the destination set. A share that has no edge to go on (a `WEIGHTED` node whose members all have
+  weight 0) is lost where it is: at a source it is a source drop (`source_drops`). Records keep
+  `offered`, `delivered` and per-edge `edge_drops`. Lossy calls are independent: nothing is
+  offered again and two calls are not equivalent to one. An infinite Lossy offer is refused
+  (`LOSSY forwarding requires a finite offer`) except for `ShortestPaths` `place(float('inf'))`.
+- **The first-hop experiment** is that one exception. It asks how much the sources can push into
+  their first links at once: every source injects on each of its first edges exactly that edge's
+  free capacity, all at once, and forwarding then runs as usual from the next node on. The
+  injection is per edge, never one total split over the members:
+
+```python
+# Two parallel links of 4 and 10. The experiment puts 4 on one and 10 on the other; an ECMP
+# offer of the same 14 splits it 7 and 7 and drops 3 on the 4-unit link.
+g = graph(2, [(0, 1, 4, 1), (0, 1, 10, 1)])
+lossy = config(ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+for offer in (float("inf"), 14):
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, lossy).place(offer)
+    print(offer, r.offered, r.call_delivered, r.call_edge_drops, r.termination.name)
+```
+
+```text
+inf 14 14 [] EXHAUSTED
+14 14 11 [(0, 3)] COMPLETE
+```
+
+On a diamond with paths of capacity 10 and 2, equal-share forwarding stops at 5 units. Node 0's
+members are EdgeId 0 (toward node 1, capacity 10) and EdgeId 1 (toward node 2, capacity 2).
+`RR(5, 2) = (3, 2)` fits; `RR(6, 2) = (3, 3)` would put 3 units on the 2-unit path. The weighted
+allocation splits by the capacities 10 and 2, and the optimized one solves the flow; both carry
+12:
+
+```python
+g = graph(4, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 2, 1), (2, 3, 2, 1)])
+allocations = ngc.RouteAllocation.EQUAL, ngc.RouteAllocation.WEIGHTED, ngc.RouteAllocation.OPTIMIZED
+for allocation in allocations:
+    ledger = ngc.FlowLedger(g)
+    r = ngc.FlowPolicy(ledger, 0, 3, config(ngc.ShortestPaths(allocation=allocation))).place(100)
+    print(allocation.name, r.call_delivered, r.call_undelivered, r.termination.name, ledger.carried().tolist())
+
+ledger = ngc.FlowLedger(g)
+pol = ngc.FlowPolicy(ledger, 0, 3, config(ngc.ShortestPaths(), admission=ngc.Admission.LOSSY))
+r = pol.place(10)
+print("LOSSY", r.call_delivered, r.call_undelivered, r.termination.name, "drops", r.call_edge_drops)
+rec = pol.records()[0]
+print("record", rec.offered, rec.delivered, rec.edge_drops)
+```
+
+```text
+EQUAL 5 95 EXHAUSTED [3, 2, 3, 2]
+WEIGHTED 12 88 EXHAUSTED [10, 2, 10, 2]
+OPTIMIZED 12 88 EXHAUSTED [10, 2, 10, 2]
+LOSSY 7 3 COMPLETE drops [(1, 3)]
+record 10 7 [(1, 3)]
+```
+
+The Lossy call is `COMPLETE` although 3 units were dropped: the whole offer of 10 was forwarded,
+and what did not fit is accounted as drops, not as a shortfall ([section 7](#termination)).
+
+An edge of capacity 0 on the only shortest route is still that route. Equal splitting sends it
+the whole offer: Lossless places nothing, Lossy drops all of it there. Weighted splitting gives
+it weight 0 and has no other edge in its route, so nothing can be sent (`NO_ACTIVE_WEIGHT`) and
+a Lossy offer is lost at the source; neither takes the costlier detour. A controller
+(`CentralizedTE`) uses the detour:
+
+```python
+# Edge 0: 0 -> 1 of capacity 0 (cost 1); the detour 0 -> 2 -> 1 (5 units, cost 2).
+g = graph(3, [(0, 1, 0, 1), (0, 2, 5, 1), (2, 1, 5, 1)])
+r = ngc.spf(g, 0, ngc.SpfOptions(F, targets=1))
+print("spf", r.target_cost, r.dag.via_edges().tolist())
+for allocation in (ngc.RouteAllocation.EQUAL, ngc.RouteAllocation.WEIGHTED):
+    for admission in (ngc.Admission.LOSSLESS, ngc.Admission.LOSSY):
+        cfg = config(ngc.ShortestPaths(allocation=allocation), admission=admission)
+        r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(5)
+        print(allocation.name, admission.name, r.call_delivered, r.call_edge_drops, r.call_source_drops,
+              r.termination.name)
+cfg = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED))
+print("CentralizedTE", ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(5).call_delivered)
+```
+
+```text
+spf 1 [0]
+EQUAL LOSSLESS 0 [] 0 EXHAUSTED
+EQUAL LOSSY 0 [(0, 5)] 0 COMPLETE
+WEIGHTED LOSSLESS 0 [] 0 NO_ACTIVE_WEIGHT
+WEIGHTED LOSSY 0 [] 5 NO_ACTIVE_WEIGHT
+CentralizedTE 5
+```
+
+Weights: two parallel links of 10 and an offer of 12. Capacity weights split it 6 and 6, explicit
+weights 1 and 2 give 4 and 8. With only 2 units free on the first link (a service baseline of 2
+and 10), equal splitting admits 4, while weights snapshot from the free capacity (2 and 10) admit
+all 12:
+
+```python
+g = graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)])
+W = ngc.RouteAllocation.WEIGHTED
+for model in (ngc.ShortestPaths(allocation=W),
+              ngc.ShortestPaths(allocation=W, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[1, 2])):
+    ledger = ngc.FlowLedger(g)
+    pol = ngc.FlowPolicy(ledger, 0, 1, config(model))
+    print(pol.config.routing.weight_basis.name, pol.place(12).call_delivered, ledger.carried().tolist())
+snapshot = ngc.ShortestPaths(allocation=W, weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT)
+for model in (ngc.ShortestPaths(), snapshot):
+    print(model.allocation.name, ngc.FlowPolicy(ngc.FlowLedger(g, [2, 10]), 0, 1, config(model)).place(12).call_delivered)
+```
+
+```text
+CAPACITY 12 [6, 6]
+EXPLICIT 12 [4, 8]
+EQUAL 4
+WEIGHTED 12
+```
+
+Two sources share a total equally, the first unit to source 0. Source 0's only link has capacity
+0, so `WEIGHTED` gives it weight 0 and source 0's share has no route. `LOSSLESS` must give source 0
+nothing, which only the total 0 does, although source 1's link is entirely free:
+
+```python
+g = graph(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+ledger = ngc.FlowLedger(g)
+r = ngc.FlowPolicy(ledger, [0, 1], 2, config(ngc.ShortestPaths(allocation=W))).place(float("inf"))
+print(r.call_delivered, r.termination.name, ledger.residual().tolist())
+```
+
+```text
+0 EXHAUSTED [0, 10]
+```
+
+## 6. The ledger
+
+**In plain words.** A `FlowLedger` holds what is placed on one graph, in two projections that are
+never added together. The **carried traffic** is a service baseline (the starting residual) and
+one record per flow; its residual is always the baseline minus everything the records carry. The
+**strict holds** are a reservation baseline and the bandwidth that up T1 tunnels reserve on their
+paths; its unreserved capacity is that baseline minus every hold. A hold never polices traffic:
+traffic may use bandwidth that is held, and a tunnel may carry more than it holds. Policies
+place, hold and remove; the ledger has no public placement, reservation or removal of its own.
+Its own `reset()`, rejected while a policy is bound, replaces both baselines and clears the
+records.
+
+**Exact rules.**
+
+- **`FlowLedger(graph, service_baseline=None, *, reservation_baseline=None)`.** The service
+  baseline B and the reservation baseline R0 are each an integer array in EdgeId order with every
+  entry in `[0, edge_capacity_units[e]]` (a physical baseline goes through `to_units` first;
+  anything above the capacity is rejected); `None` means the capacities. `service_baseline` is
+  checked first, then `reservation_baseline`, with the same messages naming each
+  (`service_baseline has length <n>, expected <E> (one entry per edge)`, then
+  `service_baseline[<e>] = <v> is outside [0, edge_capacity_units[<e>] = <c>]`). The baselines
+  never change except through `reset`. A ledger that should model load from outside the library
+  starts from reduced baselines.
+- **Snapshots.** `carried()` L is the exact sum of every record's `edge_flows` and `residual()` is
+  `B - L`; `reserved()` S is the exact sum of every record's `edge_reservations` and
+  `unreserved()` is `R0 - S`; all four are `int64[E]` copies. Each projection keeps its own bound
+  on every edge (`0 <= L <= B`, `0 <= S <= R0`); L and S are never added, and `max(L, S)` is no
+  occupancy. T1's setup reads `unreserved` (other owners' holds included); every forwarding, every
+  `CentralizedTE` solve and T2's layout read `residual` (a T2 plan books no hold). Traffic without
+  a hold can use bandwidth that T1 holds: there is no priority queueing, preemption or policing.
+  `edge_capacity_units()` is the graph's view and `graph()` returns the graph.
+- **Records.** `records()` lists the live records (of bound policies and orphans) as snapshots
+  in FlowId order; `record(flow_id)` reads one. A FlowId is the pair `(ledger uid, id)`; ids are
+  never reused. A FlowId of another ledger, or a retired or unknown id, raises `ValueError`.
+- **`FlowRecord`** fields: `flow_id`; `policy_id` (the ledger-local creation-order identifier of
+  the policy, kept after it becomes an orphan); `sources` and `destinations` (node sets);
+  `admission`; `entry_id` (a T1, T2 or `Pinned` record: the identifier of the program entry it
+  carries; `None` for the records kept per roster source); `route` (the record's route as a
+  `PredecessorDAG`); `min_route_cost` (the cheapest walk of the route, cached; `None` for an empty
+  route); `offered` (Lossy records only, else `None`); `delivered`; `edge_flows`
+  (`[(EdgeId, units)]`, ascending, the carried traffic), `edge_drops` (`[(EdgeId, units)]`,
+  cumulative, ascending) and `edge_reservations` (`[(EdgeId, units)]`, ascending: an up T1
+  tunnel's request on every edge of its path; `[]` for every other record). A record has no
+  allocation field: the policy's configuration says how its traffic was computed and the program
+  how it is forwarded.
+- **`saturated_boundary_edges(sources, eligibility=None)`** is a saturation report of the carried
+  traffic (holds play no part): the edges (eligible, at least 1 unit of capacity) that leave the
+  set of nodes reachable from the allowed sources over edges with at least 1 unit of residual, in
+  ascending EdgeId. It follows edges forward only. It ignores the destinations, so it is not a
+  source-destination cut, and it can be empty while a route exists.
+- **Lifetimes.** The graph outlives the ledger and the ledger outlives its policies (Python keeps
+  them alive for you).
+
+| Ledger state | Reached by | `reset(service_baseline=None, *, reservation_baseline=None)` | `copy()` |
+| --- | --- | --- | --- |
+| a policy is bound | building a policy on it | `ValueError` | `ValueError` |
+| no policy bound | no policy built yet, or every policy destroyed | allowed: orphaned records with their allocations and holds are cleared, their ids retired, the new baselines set (`None`: the capacities) | a new ledger with a new uid and the same baselines, records, holds and ids |
+
+A policy destroyed without `remove()` leaves its records, allocations and holds in the ledger as
+**orphans**: readable, never changed again, cleared only by `reset`.
+
+The two projections of one link of 10, where a T1 tunnel holds 6 and
+carries 4; a second demand on the same ledger places the residual 6, whatever is held:
+
+```python
+g = graph(2, [(0, 1, 10, 1)])
+ledger = ngc.FlowLedger(g)
+t1 = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1))))
+t1.replace(4, design_demand=6)
+print(ledger.carried().tolist(), ledger.residual().tolist(),
+      ledger.reserved().tolist(), ledger.unreserved().tolist())
+print(ngc.FlowPolicy(ledger, 0, 1, config(ngc.ShortestPaths())).place(10).call_delivered)
+```
+
+```text
+[4] [6] [6] [4]
+6
+```
+
+The tunnel holds 6 and carries 4, so the residual is 10 - 4 = 6 and the unreserved capacity
+10 - 6 = 4. The second demand reads the residual alone and places 6.
+
+## 7. Policies
+
+**In plain words.** A `FlowPolicy` is one demand between a set of sources and a set of
+destinations, routed by one model. `place(offer)` asks it to carry more: it computes or forwards,
+commits everything at once, and reports what was delivered, what stopped it, where traffic was
+lost and what each source carried. T1 and T2 size their tunnels for a design demand and take whole
+offers only. `evaluate`, `replace` and `forward` work on a whole new offer: `evaluate` computes it
+and publishes nothing, `replace` computes it and publishes it, `forward` sends it over the routes
+already installed. `remove()` takes all of the policy's traffic back out. A demand with several
+sources is one demand, not several: how its traffic enters at the sources is its **source
+allocation**, and with `ShortestPaths` `EQUAL` or `WEIGHTED`, where the routes of its sources meet,
+their traffic is added and split once.
+Several policies of one ledger can act in one operation, `apply_actions`: one after another, or
+all at the same time with their losses shared ([several demands at once](#several-demands-at-once)).
+
+The subsections follow a demand's life: its configuration, its roster and source allocation, the
+routing models (T1 and T2 in detail), the programs they produce, the losses where traffic meets,
+the calls and what they report, several demands at once, and last the
+[configuration and call errors](#configuration-and-call-errors).
+
+### Configuration
+
+    FlowPolicyConfig(*, routing, admission=Admission.LOSSLESS)
+    ShortestPaths(*, allocation=RouteAllocation.EQUAL, source_allocation=None, weight_basis=None,
+                  edge_weights=None, tie_break=RouteTieBreak.FEWER_HOPS, multipath=True,
+                  parallel_edges=True)
+    DistributedTE(tunnel_count, *, cost_ceiling=None, min_unreserved_bandwidth=0,
+                  tie_break=RouteTieBreak.FEWER_HOPS, parallel_edges=True)          # T1
+    CentralizedTE(*, source_allocation, source_weights=None, support=None, tunnel_count=None,
+                  prefer_headroom=False)                                          # T2 with tunnel_count
+    Pinned(program, *, black_holes=None)
+    TunnelCount(per_head, *, up_to=False)
+
+`FlowPolicyConfig` holds only the routing model and the admission; every other option belongs to
+the model that reads it. Every value takes keywords only after its required arguments, and every
+field is read-only (a model is an immutable value; its arrays are shared by reference, so policies
+built from one model read one `edge_weights` array).
+
+| Routing | Models | Fields |
+| --- | --- | --- |
+| `ShortestPaths()` | IGP forwarding (as OSPF or IS-IS routers do): static shortest paths, never refreshed. `ShortestPaths()` is ECMP; `allocation=WEIGHTED` is WCMP; `allocation=OPTIMIZED` is a controller restricted to those paths | `allocation`, `source_allocation`, `weight_basis`, `edge_weights` and the route choice (`tie_break`, `multipath`, `parallel_edges`) |
+| `DistributedTE(TunnelCount(N))` (T1) | distributed strict-bandwidth tunnels, as RSVP-TE head ends set them up: every head runs CSPF for its own tunnels, no controller ([T1](#t1-tunnels-set-up-by-their-heads)) | `tunnel_count`; `cost_ceiling`: `None`, `AbsoluteCost(c)` or `CostStretch(f)`; `min_unreserved_bandwidth`: a search minimum in units; `tie_break`, `parallel_edges` |
+| `CentralizedTE(source_allocation=...)` | an ideal controller that sees the whole network, or only the edges of `support`; with `tunnel_count`, T2: the controller lays out equal tunnels for every head ([T2](#t2-the-controllers-equal-tunnels)) | `source_allocation` (required); `source_weights`: one integer per graph node, required exactly for `WEIGHTED` without tunnels; `support`: a `PredecessorDAG` of the graph, or `None` for every eligible edge; `tunnel_count`: a `TunnelCount(N)` or `TunnelCount(L, up_to=True)`, or `None`; `prefer_headroom`: T2's headroom objective after route cost |
+| `Pinned(program)` | forwarding over a given program, computing nothing | `program`: a `ForwardingProgram`; `black_holes`: an `Eligibility` whose excluded nodes and edges are black holes, or `None` |
+
+**Two stages of validation.** A constructor converts its arguments. A wrong type, a missing
+required argument, `None` where none is allowed and an unknown keyword (an option of another model
+included, such as `allocation` on `FlowPolicyConfig`) raise `TypeError` before any policy exists.
+Every other check of a well-typed configuration raises `ValueError` when a policy or an evaluator
+uses it, before any work, a zero offer included. The texts and their order are in
+[configuration and call errors](#configuration-and-call-errors).
+
+**The model matrix.** The options belong to each row's model; any other well-typed combination
+raises `ValueError`:
+
+| Model | route allocation | source allocation: default / allowed | `admission` | route choice | weights |
+| --- | --- | --- | --- | --- | --- |
+| `ShortestPaths()` | `EQUAL` (ECMP, the default) | `EQUAL` / `EQUAL` | `LOSSLESS`, `LOSSY` | `tie_break`, `multipath`, `parallel_edges` | none |
+| `ShortestPaths(allocation=WEIGHTED)` | `WEIGHTED` (WCMP) | `EQUAL` / `EQUAL` | `LOSSLESS`, `LOSSY` | the same | `weight_basis`: `CAPACITY` (default), `EXPLICIT`, `RESIDUAL_SNAPSHOT` |
+| `ShortestPaths(allocation=OPTIMIZED)` | `OPTIMIZED` | `OPTIMIZED` / `EQUAL`, `OPTIMIZED` | `LOSSLESS` | the same | none |
+| `CentralizedTE(source_allocation=...)`, optionally `support` | optimal | required / EQUAL, OPTIMIZED, WEIGHTED | `LOSSLESS` | none | `source_weights` exactly with WEIGHTED |
+| T1: `DistributedTE(TunnelCount(N))` | tunnels | `EQUAL`, fixed | `LOSSLESS`, `LOSSY` | `tie_break`, `parallel_edges` | none |
+| T2: `CentralizedTE(source_allocation=..., tunnel_count=...)`, optionally `support` | tunnels | required; `EQUAL`; `OPTIMIZED` only with one source; never `WEIGHTED` | `LOSSLESS`, `LOSSY` | none (`prefer_headroom`) | none |
+| `Pinned(program)` | the program's | the program's | `LOSSLESS`, `LOSSY` | none | none |
+
+`ShortestPaths`' `source_allocation=None` resolves to the allocation's default and its
+`weight_basis=None` to `CAPACITY` for `WEIGHTED`; a policy's `config` is the configuration it was
+built with, these two fields resolved (the model value itself never changes).
+
+`FlowPolicy(ledger, sources, destinations, config, eligibility=None, cache=None)` binds the policy
+to its ledger. `sources` and `destinations` are one node id or a sequence; the two sets must not
+overlap. Construction validates everything before the policy binds.
+
+### The source roster
+
+The roster is the set of sources that take part: they receive shares of the traffic. It is fixed
+when the policy is built.
+
+- For `ShortestPaths`, T1, T2 and `CentralizedTE` it is the allowed sources that have a static walk
+  to an allowed destination over allowed edges, whatever their capacity, in ascending node id. A
+  source whose only routes cross an edge of capacity 0 is in the roster, receives its share and
+  cannot place it; a failure is expressed with an Eligibility, which removes the source.
+  `CentralizedTE` with a support counts only walks inside the support.
+- For `Pinned` it is the program's heads that still reach a destination under the policy's
+  Eligibility ([replay](#replay-under-a-failure)).
+- The roster decides which sources receive shares. For the computing models it also decides which
+  records exist (T1 and T2: its heads' entries); `Pinned` keeps one record per configured program
+  entry even when no head survives the replay (such a record stays at zero).
+- `by_source` reports every input source, a source outside the roster with a zero row.
+- A positive offer with an empty roster ends `NO_ROUTE`: a computing model creates no record, and
+  `Pinned` creates or keeps its per-entry records at zero.
+
+### The source allocation
+
+The source allocation says how a demand's total enters at its roster sources, separately from how
+it is routed:
+
+- **`EQUAL`**: a total `x` enters as the round robin `RR(x, k, i) = x // k + (1 if i < x % k else
+  0)` at roster member `i` (`k` members, ascending node id): the first members get one extra
+  unit. A source whose share cannot go anywhere keeps it and loses it; the share is never moved
+  to another source. Lossless therefore admits only totals that give such a source nothing, and
+  Lossy loses its share.
+- **`OPTIMIZED`** (controllers only): the controller chooses how much enters at each source (one
+  virtual source joined to every roster source), whatever maximises the delivery and then
+  minimises its cost.
+- **`WEIGHTED`** (`CentralizedTE` without `tunnel_count` only): a total `x` enters as the
+  highest-averages shares `H(x, w)`, `w` being the declared `source_weights` of the roster sources
+  in node id order. `source_weights` is one integer per graph node in `[0, 2^62)`, copied once and
+  exposed as an immutable tuple; every entry is validated, unused and masked nodes included, but
+  only the roster's weights are read. A zero weight receives nothing; when every roster weight is
+  0 nothing enters, with no equal fallback ([termination](#termination)). The other source
+  allocations refuse the vector, and `ShortestPaths` and every tunnel configuration refuse
+  `WEIGHTED`.
+
+`DistributedTE` always allocates equally and `Pinned` takes its program's injection; neither
+accepts the keyword.
+
+Source 0 below reaches node 3 over one link of 2, and source 1 over two links of 10 (costs 1 and
+2). Equal shares stop at 4: source 0 can take only 2, so source 1 gets 2 as well, at a cost of
+2 x 1 + 2 x 3 = 8. The optimized controller sends 2 from source 0 and 10 from source 1, at a cost
+of 2 + 30 = 32. Weights 1, 1 and 2 over three private links of 4 give `H(8, [1, 1, 2]) =
+[2, 2, 4]`; a ninth unit would go to the third source, beyond its 4:
+
+```python
+S = ngc.SourceAllocation
+g = graph(4, [(0, 3, 2, 1), (1, 2, 10, 1), (2, 3, 10, 2)])
+for sa in (S.EQUAL, S.OPTIMIZED):
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config(ngc.CentralizedTE(source_allocation=sa))).place(12)
+    print(sa.name, r.call_delivered, r.total_cost, [(row.source, row.delivered) for row in r.by_source])
+g = graph(4, [(0, 3, 4, 1), (1, 3, 4, 1), (2, 3, 4, 1)])
+weighted = ngc.CentralizedTE(source_allocation=S.WEIGHTED, source_weights=[1, 1, 2, 0])
+r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1, 2], 3, config(weighted)).place(float("inf"))
+print("WEIGHTED", r.call_delivered, [(row.source, row.delivered) for row in r.by_source])
+```
+
+```text
+EQUAL 4 8 [(0, 2), (1, 2)]
+OPTIMIZED 12 32 [(0, 2), (1, 10)]
+WEIGHTED 8 [(0, 2), (1, 2), (2, 4)]
+```
+
+### Routing models
+
+**When a model computes.** A positive `place` prepares the program of an epoch that has none yet.
+Every `evaluate` and every `replace`, a zero offer included, computes a whole offer afresh; only
+`replace` installs what it computed. `place(0)` prepares nothing.
+
+- **`ShortestPaths` with `EQUAL` or `WEIGHTED`** forwards like IGP routers. Its program holds the
+  routes and splits used for the whole epoch, never refreshed within it:
+  - each roster source's route is its static shortest-path DAG toward the destination set (with
+    `multipath=False`, its canonical path), read from the
+    [shortest-path cache](#9-the-shortest-path-cache);
+  - the route choice is applied on the policy's service view when the program is prepared (the
+    `HIGHER_AVAILABLE_CAPACITY` and `HIGHER_HEADROOM` scores read it), and `WEIGHTED` freezes its
+    weights from its weight basis there ([section 5](#5-route-allocations-and-admission));
+  - the program is the union of these selected routes, built exactly as
+    [`ForwardingProgram.from_dag`](#supplied-dags-from_dag) builds one: at a router several
+    sources pass, their traffic for the demand is added (with the router's own injection when it
+    is a source) and split once over its members, by round robin (`EQUAL`) or by highest averages
+    over the weights (`WEIGHTED`). Every source that passes a router has the same continuation
+    there, so the union lends no source a link outside its own route;
+  - it is the policy's `program`: one split context pooled over the roster, one split route per
+    roster source (entry identifier = roster position, weight 1), equal sources; it lists no
+    tunnel.
+
+  Each epoch prepares on that epoch's view. With `FEWER_HOPS` or `HIGHER_CAPACITY` and `EQUAL`,
+  `CAPACITY` or `EXPLICIT` weights nothing a preparation reads changes while the policy lives, so
+  every epoch gets the program a fresh preparation gives; `HIGHER_AVAILABLE_CAPACITY`,
+  `HIGHER_HEADROOM` and `RESIDUAL_SNAPSHOT` read the view of each preparation.
+- **`ShortestPaths` with `OPTIMIZED`** is a controller restricted to shortest paths: it solves like
+  `CentralizedTE` (below), but only over the union of the roster sources' routes prepared as
+  above, edges of capacity 0 included (so a zero-capacity shortest route is never bypassed).
+- **`DistributedTE` (T1)** sets up its tunnels for a design demand on every `replace` and
+  `evaluate` and forwards them as its program; it has no incremental `place`
+  ([T1](#t1-tunnels-set-up-by-their-heads)).
+- **`CentralizedTE(tunnel_count=...)` (T2)** lays out its tunnels for a design demand on every
+  `replace` and `evaluate` and forwards them as its program; it has no incremental `place`
+  ([T2](#t2-the-controllers-equal-tunnels)). The controller rules below are `CentralizedTE`'s
+  without a tunnel count.
+- **`CentralizedTE`** solves the minimum-cost flow from its roster to its whole destination set
+  over every eligible edge, on its service view: it may move its own traffic, never another
+  owner's. The result is the largest delivery up to the target, and among those the cheapest. The
+  target depends on the call:
+  - a positive `place` re-solves the amount the policy already delivers plus this call's offer
+    (`delivered()` plus the offer: what an earlier call could not place is not offered again). With
+    the rest of the network unchanged, `place(a)` followed by `place(b)` therefore ends in the same
+    allocation as `place(a + b)`;
+  - `evaluate` and `replace` solve their whole offer afresh, a zero offer included;
+  - `forward` solves nothing: it sends its offer over the installed paths by their weights.
+  - For the same target total and service view, the final solve from zero fixes the allocation;
+    the search for the largest total that fits does not affect it.
+  - With `EQUAL` source allocation the virtual source's arc to roster source `i` carries exactly
+    `RR(T, k, i)`: the delivered total `T` is the largest whose equal shares all fit (a total fits
+    only when the solve reaches it). With `WEIGHTED` the shares are `H(T, w)`, and every source
+    must send exactly its share. Each share grows with `T`, so the totals that fit are 0 to a
+    largest one.
+  - With `EQUAL` or `WEIGHTED` sources the result has no `min_cut` and no `marginal_cost_curve`:
+    a flow with prescribed shares is not the unrestricted maximum a cut certifies, and the
+    marginal costs of an equal flow need not increase.
+  - A positive call on a network beyond the flow core's size limits raises `ValueError`
+    ([section 8](#limits-that-refuse-a-call)).
+- **`CentralizedTE(support=dag)`** is the same controller restricted to the edges of `dag`,
+  trimmed to the walks from the sources to the allowed destinations inside it (an edge that leads
+  nowhere inside the support is never used; a mask removes its edges as usual). It reports
+  `total_cost` but neither `marginal_cost_curve` nor `min_cut`, and `evaluate_edge_failures`
+  solves each deletion afresh.
+- **The controllers' programs.** After every solve (a positive `place`, an `evaluate`, a `replace`)
+  a controller decomposes its solved flow into paths, each roster source's share in a canonical
+  order (for each source in node id order, walk the smallest positive EdgeId to the first
+  destination, take the bottleneck or the remaining supply, subtract, repeat), one tunnel per path
+  with its solved amount as weight (identifiers in decomposition order), also with a single source.
+  With the `OPTIMIZED` source allocation the program keeps the solved supplies as **captured source
+  weights** (`source_weights`: every roster source, a zero supply included). With `WEIGHTED` it
+  instead keeps each roster source's declared weight, zeros included; with `EQUAL` it injects by
+  round robin. Forwarded on the same service view, the program reproduces the solve exactly.
+- **Records of the controllers** (`CentralizedTE`, `ShortestPaths` with `OPTIMIZED`): one record
+  per roster source, holding that source's share of the solved flow (its edges and its delivery),
+  extracted in a canonical order. A `CentralizedTE` record's route is the set of edges that carry
+  the share, rebuilt on every positive `place` under the same FlowId (a `replace` or a `forward`
+  publishes new records with new ids); a source with no share has an empty route and
+  `min_route_cost` `None`. A `ShortestPaths` `OPTIMIZED` record's route is its
+  source's prepared route, and the share stays inside it.
+- **`Pinned`** forwards its program as given, computing nothing: injection, entries, weights and
+  split tables are the program's, replayed under the policy's Eligibility and with its black
+  holes ([forwarding programs](#forwarding-programs)). It keeps one record per program entry
+  (`entry_id` is the entry's identifier), created when the epoch's program is first forwarded (a
+  positive `place`, or any `replace`), a record of weight 0 or of a `FAILED` tunnel included (that
+  one with an empty route and `min_route_cost` `None`). A positive offer with an empty replay
+  roster ends `NO_ROUTE`.
+
+### T1: tunnels set up by their heads
+
+**In plain words.** `DistributedTE(TunnelCount(N))` models distributed RSVP-TE: there is no
+controller, and each head (a roster source) sets up its own N tunnels. A design demand D is split
+equally over the heads and each head's share equally over its N tunnels; each tunnel asks for
+that bandwidth. One tunnel at a time, in rounds over the heads, the head keeps the links with
+enough unreserved bandwidth and takes the shortest path: the tunnel comes up and holds exactly its
+request on every link of its path, or it stays down and holds nothing. Real traffic then enters
+equally at the heads and splits equally over each head's tunnels that are up; a head with no
+tunnel up loses its share, and no one moves it elsewhere. Holds are the ledger's second
+projection ([section 6](#6-the-ledger)): they decide which tunnels come up, never what traffic
+gets through.
+
+**Exact rules.**
+
+- **Sizing.** `H` roster heads in ascending node id, `N = tunnel_count.per_head` (an "up to" count
+  is refused). Head `i`'s design share is `RR(D, H, i)` (`plan.design_by_head`), its tunnel `j`'s
+  request `RR(share, N, j)`: the tunnels of one head differ by at most one unit. Tunnels are
+  numbered in round order (round `j = 0..N-1`, the heads ascending within a round): entry
+  identifier `j * H + i`, local index `j`; this is also the setup order. An empty roster gives an
+  empty program.
+- **Small shares and zero requests.** When a head's share is below N units, some requests are 0.
+  All N tunnels are still set up: a tunnel with request 0 comes up holding nothing, like an
+  RSVP-TE tunnel with no bandwidth; its search has no bandwidth filter (unless
+  `min_unreserved_bandwidth` is positive), so it may cross an edge of capacity 0, where the
+  traffic later sent on it is lost on that edge. A design of 0 is the extreme case: every request
+  is 0 and an offer is forwarded over the tunnels.
+- **The setup view U** of an edge is the ledger's unreserved capacity with this policy's own holds
+  released (never above the capacity). Every attempt runs, also after failures, on U minus the
+  requests of the tunnels already up in this setup.
+- **One attempt (CSPF)** with request `b` keeps the allowed edges with `U >= max(b,
+  min_unreserved_bandwidth)` (a request of 0 with a minimum of 0 keeps every allowed edge, one of
+  capacity 0 included), then with `parallel_edges=False` one member per pair by the member rule
+  (the filter first, then the member rule, at every attempt), then takes the canonical single path
+  of [section 4](#the-canonical-single-path) on static costs toward the allowed destinations: the
+  lowest cost; under a `HIGHER_*` rule the larger bottleneck score; fewer hops; the smaller EdgeId
+  sequence. The scores read the setup view: `HIGHER_AVAILABLE_CAPACITY` reads U,
+  `HIGHER_HEADROOM` U divided by the capacity (exactly; 0 on an edge of capacity 0),
+  `HIGHER_CAPACITY` the capacity.
+- **The ceiling.** `AbsoluteCost(c)` admits a path of cost at most `c`. `CostStretch(n/d)` admits
+  a cost `c` exactly when `c * d <= n * c0`, `c0` the smallest static shortest cost over all
+  roster heads under the policy's Eligibility, edges of capacity 0 included, before any bandwidth
+  filter: one baseline for the whole pool, not per head (a head whose own shortest cost is 3 can
+  fail `CostStretch(2)` because another head has a zero-capacity shortest route of cost 1), fixed
+  when the policy is built.
+- **Statuses.** `UP`: the tunnel holds `b` on every edge of its path (its record's
+  `edge_reservations`) and has weight 1. `INSUFFICIENT_BANDWIDTH`: no path passes the filter.
+  `COST_CEILING_EXCEEDED`: the cheapest filtered path exceeds the ceiling. A down tunnel keeps its
+  request, has no destination, path or cost (`None`), has weight 0 and holds nothing. There is no
+  partial hold, retry, growth or count reduction; `min_unreserved_bandwidth` filters searches and
+  is never held. A tunnel count is a number of setup attempts per head, not a number of tunnels
+  guaranteed up, and two tunnels may take the same links.
+- **Forwarding** is the program's: a total `x` enters as `RR(x, H, i)` at head `i`, then round
+  robin over that head's up tunnels in local order. A head with no up tunnel keeps its share and
+  loses it (Lossy: a source drop; Lossless admits only totals that give it nothing,
+  [equal source allocation](#equal-source-allocation-and-a-source-that-cannot-pass-anything)); the
+  demand is never renormalised over the heads that have tunnels. Changing only the offer never
+  changes the setup. When every tunnel is up and U is at most the residual on every edge, D itself
+  is carried losslessly. Holds do not police: a tunnel carries what forwarding gives it within the
+  residual, more than its hold when the edges have room, and its traffic meets every other
+  demand's on the residual. T1 reports no `total_cost`, `min_cut` or `marginal_cost_curve`.
+- **Operations.** No `place` (`DistributedTE does not support incremental placement`, `place(0)`
+  too). `replace(offer, design_demand=D)` releases the policy's own holds and traffic, sets up
+  again and forwards; `evaluate` computes the same and publishes nothing (no record, no hold);
+  `forward(offer)` forwards the installed program and keeps its tunnels and holds (the new records
+  carry the same `edge_reservations`). `design_demand=None` means `D = offer`; an infinite offer
+  needs a finite design (`DistributedTE requires a finite design demand`). To study a change of
+  the offer alone, keep D explicit: `replace(offer + 1)` without it designs again for the new
+  offer. A full zero offer such as `replace(0, design_demand=D)` still sets up and books the
+  holds. `remove()` releases both projections. T1 is not monotone in D: more design demand can
+  bring more tunnels up or fewer.
+- **Records and rows.** One record per program entry in identifier order (`entry_id`), a down
+  tunnel's included (zero, an empty route, `min_route_cost` `None`). `by_tunnel` shows a down
+  tunnel's setup status and `UP`, or `BLACKHOLED` in stale forwarding; a `Pinned` replay of a T1
+  program shows `FAILED` for an up tunnel its mask touches, keeps a down tunnel down and holds
+  nothing.
+- **The plan.** `result.plan` is a `TunnelPlan` of the program after the call:
+  `tunnels_per_head` (N), `design_demand` (D), `design_by_head` (`(head, RR(D, H, i))` for every
+  roster head) and `total_reserved_bandwidth` (the up tunnels' requests, each counted once). The
+  plan describes the setup that installed the tunnels; `forward` keeps it unchanged.
+  T2 also returns a `TunnelPlan`, with the fields described below; all other routings, including
+  `Pinned` over a T1 program, return `None`.
+
+A T1 call: head 0's only edge has 2 units, head 1's has 10, two tunnels per head:
+
+```python
+g = graph(3, [(0, 2, 2, 1), (1, 2, 10, 1)])
+ledger = ngc.FlowLedger(g)
+lossy_t1 = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(2)),
+                                admission=ngc.Admission.LOSSY)
+pol = ngc.FlowPolicy(ledger, [0, 1], 2, lossy_t1)
+r = pol.replace(12, design_demand=12)
+print([t.status.name for t in r.program.tunnels])
+print([(t.entry_id, t.head, t.requested_bandwidth, t.reserved_bandwidth, t.edges) for t in r.program.tunnels])
+print(r.call_delivered, r.call_source_drops, r.plan.total_reserved_bandwidth, r.plan.design_by_head)
+print(ledger.reserved().tolist(), ledger.unreserved().tolist(), ledger.residual().tolist())
+r = pol.forward(8)
+print(r.call_delivered, r.call_source_drops, r.reservations_changed, ledger.reserved().tolist())
+```
+
+```text
+['INSUFFICIENT_BANDWIDTH', 'UP', 'INSUFFICIENT_BANDWIDTH', 'UP']
+[(0, 0, 3, 0, None), (1, 1, 3, 3, (1,)), (2, 0, 3, 0, None), (3, 1, 3, 3, (1,))]
+6 6 6 ((0, 6), (1, 6))
+[0, 6] [2, 4] [2, 4]
+4 4 False [0, 6]
+```
+
+Each head's share is 6, so every tunnel asks for 3. Head 0's edge has 2 units unreserved: both of
+its tunnels are down. Head 1's two tunnels come up on edge 1 and hold 6 of its 10. The offer of 12
+enters as 6 and 6: head 0 loses its 6, head 1's tunnels carry 3 and 3. `forward(8)` keeps the
+tunnels and the holds; head 0 still loses its share, now 4.
+
+The cost ceiling's stretch baseline is one for the whole pool of heads. Below, head 0 reaches node
+2 only over a link of capacity 0 and cost 1, head 1 over a link of 8 and cost 3; each head's share
+of the design 4 is 2. Head 0's tunnel finds no link with 2 units unreserved. The baseline is the
+smallest static shortest cost over all heads, 1 (head 0's zero-capacity route), so
+`CostStretch(2)` admits a cost of at most 2 and refuses head 1's path of cost 3; an absolute
+ceiling of 3 admits it:
+
+```python
+g = graph(3, [(0, 2, 0, 1), (1, 2, 8, 3)])
+for ceiling in (ngc.CostStretch(2), ngc.AbsoluteCost(3)):
+    t1 = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1), cost_ceiling=ceiling),
+                              admission=ngc.Admission.LOSSY)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, t1).replace(4, design_demand=4)
+    print(repr(ceiling), [t.status.name for t in r.program.tunnels], r.call_delivered)
+```
+
+```text
+CostStretch(Fraction(2, 1)) ['INSUFFICIENT_BANDWIDTH', 'COST_CEILING_EXCEEDED'] 0
+AbsoluteCost(3) ['INSUFFICIENT_BANDWIDTH', 'UP'] 2
+```
+
+### T2: the controller's equal tunnels
+
+**In plain words.** `CentralizedTE(source_allocation=..., tunnel_count=TunnelCount(N))` models a
+central controller (a PCE or an SDN controller) that programs, for every head, the same number of
+single-path tunnels, all planned with one common whole-unit bandwidth. The controller chooses, in
+this order:
+
+1. the largest common bandwidth;
+2. for a finite design demand, no larger than the design needs;
+3. the cheapest routes;
+4. with `prefer_headroom=True`, the routes that leave the most spare capacity;
+5. one fixed unit-by-unit procedure for any remaining tie.
+
+Real traffic then splits equally over the heads and over each head's tunnels. A tunnel carries
+what forwarding gives it wherever the links have room, more than its planned bandwidth included.
+A planned bandwidth is metadata: the ledger holds nothing for it. `TunnelCount(L, up_to=True)`
+gives every head one common count `k <= L`: the smallest whose program carries the live heads'
+design shares; if none does, the largest live-share score, then the smallest count. It does not
+promise whole-demand lossless delivery. A head that cannot reach a destination over free capacity
+is dead: it keeps its share and loses it. A weak but live head limits the common size of every
+tunnel, by design (heads that must not limit each other are separate demands). A `support` DAG
+restricts every step to its edges.
+
+The sizing on one head with four tunnels and two branches, of capacity 4 and 10:
+
+```python
+g = graph(4, [(0, 1, 4, 1), (0, 2, 10, 1), (1, 3, 4, 1), (2, 3, 10, 1)])
+four = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                      tunnel_count=ngc.TunnelCount(4)),
+                            admission=ngc.Admission.LOSSY)
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, four).replace(16)
+p = r.plan
+print(p.max_fractional_bandwidth_per_tunnel, p.max_bandwidth_per_tunnel, p.total_planned_bandwidth,
+      p.max_lossless_offer)
+print([t.edges for t in r.program.tunnels], [row.assigned for row in r.by_tunnel], r.call_delivered,
+      r.call_edge_drops)
+```
+
+```text
+10/3 3 12 14
+[(0, 2), (1, 3), (1, 3), (1, 3)] [4, 4, 4, 4] 14 [(1, 2)]
+```
+
+With `j` of the 4 tunnels on the narrow branch, the common size is at most `4 / j` there and
+`10 / (4 - j)` on the wide branch: 5/2, 10/3, 2, 4/3 and 1 for `j` = 0 to 4. The best is 10/3,
+with one tunnel on the narrow branch and three on the wide one, and the largest whole-unit size
+is `U = 3`; the plan is 4 x 3 = 12. The lossless bound `F` is 14: `RR(14, 4) = (4, 4, 3, 3)` gives
+the narrow tunnel 4 and the three wide ones 10 together, while `RR(15, 4)` would put 11 on the
+wide branch. The offer 16 gives every tunnel 4, more than its plan of 3: the narrow branch carries
+its 4, and the wide branch carries 10 of its 12 and drops 2.
+
+**Exact rules.**
+
+- **Heads.** The roster (`H` heads in ascending node id) is topological, as for T1. A head is
+  **live** if it reaches an allowed destination over allowed links with free capacity `V >= 1`,
+  `V` the residual with this policy's own traffic released (`plan.heads_with_capacity`); the
+  others are **dead**: they keep their roster position and their share, get no tunnel and lose
+  the share. `a` live heads, `k` tunnels each (`N`, or the chosen count), `K = a * k` tunnels.
+- **On a support.** `CentralizedTE(source_allocation=..., support=dag, tunnel_count=...)` is T2
+  with the allowed links restricted to the edges of `dag`, intersected with the policy's
+  Eligibility. Every step (roster, live heads, sizing, count choice, both objectives, the
+  decomposition, the program's replay basis) uses this one allowed set, and the amounts, plans,
+  routes and flags equal those of the same configuration without a support and with the DAG's
+  edge set composed into the Eligibility. Parallel members and EdgeIds are kept; the DAG is not
+  read as separate routes.
+- **Sizing.** Tunnels of a common size `s > 0` exist exactly when `K` path units flow from a
+  virtual root (an arc of capacity `k` to every live head) to the destinations with link
+  capacities `min(K, floor(V / s))` (paths stop at the first destination).
+  `max_bandwidth_per_tunnel` U is the largest integer size that passes (0 when none does);
+  `max_fractional_bandwidth_per_tunnel` is the exact fluid optimum `s*` (a `Fraction` `V[e] / j`
+  with `j <= K`; `U = floor(s*)`).
+- **Working size.** For a finite design D, `planned_bandwidth_per_tunnel` u is `min(U, max(1, max
+  over live heads of ceil(RR(D, H, i) / k)))`, the shares taken over the whole roster, dead heads
+  included; an unlimited design uses `u = U`. Every tunnel is planned at u;
+  `total_planned_bandwidth` is `K * u`. Once U >= 1, every live head keeps all k tunnels even when
+  its share is below k units, including a design of 0 (the tunnels are planned at 1 and carry what
+  forwarding gives them).
+- **Routes.** At u, the count vectors `x` (the tunnels on each link) that route `k` tunnels per
+  live head with `x[e] <= min(K, floor(V[e] / u))` are compared in three steps:
+  1. the smallest route-cost sum `J = sum of cost[e] * x[e]` (`total_tunnel_cost`; idle tunnels
+     count);
+  2. with `prefer_headroom=True`, the smallest `headroom_penalty` `Phi`: each link with static
+     capacity `B > 0` charges its `j`-th tunnel `floor(2^32 * (B - V + j * u) / B)`, the fraction
+     of the link then occupied, rounded down to 2^-32;
+  3. the canonical augmentation: `K` single units from zero, each on the residual path from the
+     root to the sink of the smallest `(J, Phi)` price, then the fewest arcs, then the smallest
+     sequence of arc keys (`(0, EdgeId, direction)` for links, `(1, head, direction)` for root
+     arcs, `(2, destination, direction)` for sink arcs; forward 0, reverse 1); a reverse arc
+     undoes an earlier unit. Without `prefer_headroom` the second price is 0.
+
+  `J` and `Phi` are exact Python integers and can exceed 64 bits.
+- **The program.** `x` is cut, live head by live head in ascending node id, into unit walks along
+  the smallest positive EdgeId to a destination; each head's `k` walks are sorted by EdgeId
+  sequence (duplicates are separate tunnels). The tunnels are in round order: local index `j`,
+  then roster position `i`, with the entry identifier `j * H + i` (`H` counts dead heads too, so
+  a dead head leaves holes). Every tunnel is `UP` with weight 1, `planned_bandwidth = u` and
+  `requested_bandwidth = reserved_bandwidth = 0`; a plan books no hold.
+- **Up to L.** For each `k` in `1..L` the program at `U(k)` scores `G(min(D, F'(k)))`: `G(z)` is
+  the part of a round-robin total `z` that the live heads receive, `F'(k)` the largest total whose
+  live shares fit on that program (dead shares ignored); an unlimited design scores `G(F'(k))`.
+  The smallest `k` whose score is the live part of D wins; if none, the largest score, then the
+  smallest `k`; the chosen `k` is then laid out at its own u (`plan.tunnels_per_head`). Delivery
+  is not monotone in `k`, so only two proved bounds skip a `k`: with `M = H * k` roster positions
+  the score lies between `G(min(D, M * U(k)))` and `G(min(D, M * (U(k) + 1) - 1))`, and `U(k)`
+  never grows with `k` (once it is 0, every later count scores 0). "Up to L" finds the smallest
+  common count that carries the live heads' design shares (or the best score); it does not
+  promise lossless delivery of the whole demand and does not optimise an arbitrary offer.
+- **Count outcomes.** An empty roster gives an empty program (`NO_ROUTE` for a positive offer).
+  No live head, or live heads with `U = 0` (`insufficient_resolution` True,
+  `max_bandwidth_per_tunnel` 0, `max_fractional_bandwidth_per_tunnel` positive), give a program
+  **without tunnels that keeps the roster**: `policy.program` is set, `forward` works and every
+  head's share is lost at its head (Lossy `COMPLETE`, Lossless `EXHAUSTED` for a positive offer).
+  Otherwise every live head has `k` tunnels. No partial program is made for one head; check the
+  plan before assuming `len(tunnels) == N * H`.
+- **Forwarding** is the program's: a total `x` enters as `RR(x, H, i)` over the whole roster,
+  then round robin over the head's `k` tunnels in local order; a dead head's share is lost.
+  `max_lossless_offer` F is the program's lossless maximum on the view it was planned on (a dead
+  head's share blocks every total that gives it a unit: F is then 0 or a few remainder units).
+  With `u = U` and every head live, `0 <= F - K * U < K`.
+- **Configuration.** `source_allocation` is stated: `EQUAL` with any number of heads; `OPTIMIZED`
+  only with one input source, the same calculation (`CentralizedTE with tunnel_count and several
+  sources requires source_allocation=EQUAL`, counted before any Eligibility). `prefer_headroom`
+  (`False` by default) switches the headroom objective on; T2 has no route choice of its own:
+  it always keeps every parallel link, uses single-path tunnels and the canonical final tie.
+  Admission `LOSSLESS` or `LOSSY`. No path-cost ceiling. The tunnel count and the tunnel limit as
+  for T1 (`L` counts for "up to").
+- **Operations.** No `place` (`CentralizedTE with tunnel_count does not support incremental
+  placement`, `place(0)` too). `replace(offer, design_demand=D)` releases the policy's own traffic,
+  lays the tunnels out again for D and forwards; `design_demand=None` means `D = offer`, and
+  `float('inf')` (or an infinite Lossless offer) is an unlimited design. `evaluate` computes the
+  same and publishes nothing; `forward(offer)` forwards the installed program and keeps its plan
+  unchanged: its bounds and headroom values still describe the planning view, not the new offer,
+  load or black holes. A planned size change over the same routes sets no flag. T2 reports no
+  `total_cost`, `min_cut` or `marginal_cost_curve`.
+- **Records and rows.** One record per tunnel in identifier order (a dead head has no entry and no
+  record).
+- **The plan.** `tunnels_per_head`, `design_demand`, `design_by_head` (empty for an unlimited
+  design) and `total_reserved_bandwidth` (0), then T2's own fields: `heads_with_capacity`,
+  `insufficient_resolution`, `max_fractional_bandwidth_per_tunnel`, `max_bandwidth_per_tunnel`,
+  `planned_bandwidth_per_tunnel`, `total_planned_bandwidth`, `total_tunnel_cost`,
+  `headroom_penalty` (`None` without `prefer_headroom`) and `max_lossless_offer`. With no live head
+  every amount is 0 (`tunnels_per_head` is N, or 1 for "up to"). A plan is metadata of the
+  computation that installed the tunnels, neither the installed program nor its delivery.
+
+Two heads behind private links of 3 and 8 to node 2, two tunnels each, design 6:
+
+```python
+g = graph(3, [(0, 2, 3, 1), (1, 2, 8, 1)])
+two = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                     tunnel_count=ngc.TunnelCount(2)))
+r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, two).replace(6)
+p = r.plan
+print(p.max_fractional_bandwidth_per_tunnel, p.max_bandwidth_per_tunnel, p.planned_bandwidth_per_tunnel,
+      p.max_lossless_offer)
+print([(t.entry_id, t.head, t.local_index) for t in r.program.tunnels], r.call_delivered)
+```
+
+```text
+3/2 1 1 6
+[(0, 0, 0), (1, 1, 0), (2, 0, 1), (3, 1, 1)] 6
+```
+
+Head 0's two tunnels share its link of 3, so the common size is at most 3/2 (head 1 alone would
+allow 4): `s* = 3/2` and `U = 1`. The design 6 gives each head 3, so `u = min(1, ceil(3/2)) = 1`.
+The tunnels are numbered in rounds: identifiers 0 and 1 are the two heads' first tunnels, 2 and 3
+their second ones. `F = 6`: a total of 6 gives head 0 the 3 its link carries; 7 would give it 4.
+
+A T2 call at a finer resolution: two branches from node 0 to node 3 of 2 and 10 (at q = 2^-12: 8192
+and 40960 units), 16 tunnels, `prefer_headroom=True`, then the same program replayed with the 2-unit
+branch's second link down:
+
+```python
+q = 2.0 ** -12
+g = ngc.Graph(4, edge_sources=[0, 0, 1, 2], edge_destinations=[1, 2, 3, 3], edge_capacity_units=ngc.to_units([2, 10, 2, 10], q),
+              edge_costs=[1, 1, 1, 1], resolution=q)
+te16 = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                     tunnel_count=ngc.TunnelCount(16), prefer_headroom=True),
+                            admission=ngc.Admission.LOSSY)
+pol = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, te16)
+r = pol.replace(49152)
+p = r.plan
+print(p.max_bandwidth_per_tunnel, p.planned_bandwidth_per_tunnel, p.max_fractional_bandwidth_per_tunnel, p.max_lossless_offer, r.call_delivered)
+print(p.total_planned_bandwidth, p.total_tunnel_cost, p.headroom_penalty, p.heads_with_capacity, p.insufficient_resolution)
+print([t.edges for t in r.program.tunnels][:3], [t.planned_bandwidth for t in r.program.tunnels][:3])
+fail = g.eligibility(excluded_edges=[2])
+replay = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3,
+                        ngc.FlowPolicyConfig(routing=ngc.Pinned(pol.program), admission=ngc.Admission.LOSSY),
+                        eligibility=fail)
+s = replay.replace(49152)
+print([t.status.name for t in s.by_tunnel][:3], s.call_delivered)
+```
+
+```text
+2925 2925 20480/7 46812 47104
+46800 32 73610035200 (0,) False
+[(0, 2), (0, 2), (1, 3)] [2925, 2925, 2925]
+['FAILED', 'FAILED', 'UP'] 40960
+```
+
+With 2 tunnels on the 8192-unit branch and 14 on the 40960-unit one, the wide branch limits the
+common size to 40960/14 = 20480/7; the narrow branch would allow 4096. The whole-unit size is 2925,
+and the plan is 16 x 2925 = 46800. The lossless bound is 46812 = 16 x 2925 + 12: twelve tunnels
+take one unit more, and the wide branch still carries exactly 40960. The offer 49152 gives every
+tunnel 3072, more than its plan: the narrow branch carries its 6144, and the wide branch is
+offered 43008, carries 40960 and drops 2048, so 6144 + 40960 = 47104 arrive. In the replay the two
+tunnels on the failed branch are `FAILED` and the head splits its whole share over the other 14.
+
+A dead head, a head too weak for one unit per tunnel, and "up to":
+
+```python
+lossy_t2 = lambda tunnel_count: ngc.FlowPolicyConfig(
+    routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL, tunnel_count=tunnel_count),
+    admission=ngc.Admission.LOSSY)
+dead = graph(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+r = ngc.FlowPolicy(ngc.FlowLedger(dead), [0, 1], 2, lossy_t2(ngc.TunnelCount(2))).replace(10)
+print(r.plan.heads_with_capacity, [t.entry_id for t in r.program.tunnels], r.plan.planned_bandwidth_per_tunnel, r.call_delivered, r.call_source_drops)
+tiny = graph(3, [(0, 2, 1, 1), (1, 2, 100, 1)])
+r = ngc.FlowPolicy(ngc.FlowLedger(tiny), [0, 1], 2, lossy_t2(ngc.TunnelCount(16))).replace(200)
+print(r.plan.insufficient_resolution, r.plan.max_fractional_bandwidth_per_tunnel, r.program.tunnels, r.call_source_drops)
+r = ngc.FlowPolicy(ngc.FlowLedger(tiny), [0, 1], 2, lossy_t2(ngc.TunnelCount(3, up_to=True))).replace(200)
+print(r.plan.tunnels_per_head, [t.edges for t in r.program.tunnels], r.call_delivered)
+```
+
+```text
+(1,) [1, 3] 3 5 5
+True 1/16 () 200
+1 [(0,), (1,)] 101
+```
+
+Head 0's only link has no free capacity: it is dead, keeps its share of 5 and loses it, and its
+positions 0 and 2 are holes. Behind links of 1 and 100, 16 tunnels per head fit no whole unit
+(`s*` = 1/16): the program has no tunnels and the whole offer is lost at the heads. Up to 3, one
+tunnel per head fits a unit; it carries 1 of head 0's 100 and all of head 1's.
+
+"Up to" compares the counts by what their programs carry of the design. Head 0 below reaches node
+2 over one link of 6, head 1 over two parallel links of 3, and the design is 12. With one tunnel
+per head, head 1's tunnel takes one link of 3, so the equal shares fit up to 7 (4 and 3), below the
+design. With two, head 0's tunnels share its 6 and head 1's take one link each, so 12 fits, and
+"up to 2" chooses 2:
+
+```python
+g = graph(3, [(0, 2, 6, 1), (1, 2, 3, 1), (1, 2, 3, 1)])
+for limit in (1, 2):
+    up_to = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                           tunnel_count=ngc.TunnelCount(limit, up_to=True)))
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, up_to).replace(12)
+    print(limit, r.plan.tunnels_per_head, r.call_delivered)
+```
+
+```text
+1 1 7
+2 2 12
+```
+
+The headroom objective on two equal-cost parallel links of 10, two tunnels for a design of 2:
+
+```python
+par = graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)])
+for on in (False, True):
+    cfg = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                         tunnel_count=ngc.TunnelCount(2), prefer_headroom=on),
+                               admission=ngc.Admission.LOSSY)
+    r = ngc.FlowPolicy(ngc.FlowLedger(par), 0, 1, cfg).replace(12, design_demand=2)
+    print(on, [t.edges for t in r.program.tunnels], r.plan.headroom_penalty, r.plan.max_lossless_offer, r.call_delivered)
+```
+
+```text
+False [(0,), (0,)] None 10 10
+True [(0,), (1,)] 858993458 20 12
+```
+
+Both plans size the tunnels at 1 unit (U = 10). Without the objective the cost tie goes to the
+smallest keys: both tunnels on link 0, which then bounds forwarding at 10. With it, a second slot
+on link 0 would pay `floor(2^32 * 2 / 10)` against `floor(2^32 / 10)` on link 1, so the tunnels
+spread and the program forwards 20.
+
+T2 on a support: three parallel links from node 0 to node 1 of (capacity, cost) (6, 1), (6, 1) and
+(100, 2); the support holds the first two. The cheap pair carries one tunnel each and the third
+link is never used; with the second link masked, both tunnels share the first:
+
+```python
+sup = graph(2, [(0, 1, 6, 1), (0, 1, 6, 1), (0, 1, 100, 2)])
+support = ngc.PredecessorDAG.from_csr(sup, [0, 0, 2], [0, 0], [0, 1])
+on_support = ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL, support=support,
+                               tunnel_count=ngc.TunnelCount(2))
+for mask in (None, sup.eligibility(excluded_edges=[1])):
+    pol = ngc.FlowPolicy(ngc.FlowLedger(sup), 0, 1, ngc.FlowPolicyConfig(routing=on_support), mask)
+    r = pol.replace(float("inf"))
+    print(r.plan.max_bandwidth_per_tunnel, [t.edges for t in r.program.tunnels], r.plan.max_lossless_offer)
+```
+
+```text
+6 [(0,), (1,)] 12
+3 [(0,), (0,)] 6
+```
+
+The plan describes the view it was computed on. Below, T2 plans its two tunnels on one link of 10
+for an unlimited design while it carries nothing yet; another demand then takes 8 of the link.
+`forward(10)` delivers what the link still has, 2, and returns the installed plan unchanged:
+
+```python
+g = graph(2, [(0, 1, 10, 1)])
+ledger = ngc.FlowLedger(g)
+t2 = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(
+    source_allocation=ngc.SourceAllocation.EQUAL, tunnel_count=ngc.TunnelCount(2))))
+print(t2.replace(0, design_demand=float("inf")).plan.max_lossless_offer)
+ngc.FlowPolicy(ledger, 0, 1, config(ngc.ShortestPaths())).place(8)
+r = t2.forward(10)
+print(r.call_delivered, r.plan.max_lossless_offer)
+```
+
+```text
+10
+2 10
+```
+
+### Several sources and destinations
+
+- **A route ends at the first destination it reaches.** A walk that meets a destination stops
+  there and never passes through it toward another destination. Passing through another source of
+  the same demand is allowed and adds no traffic.
+- **Destinations** (`ShortestPaths`): a route goes to the nearest destinations, and one record may
+  deliver to several of them at that cost (a T1 tunnel is one path, to the allowed destination its
+  CSPF reaches first). A record's `delivered` is its total; the delivery to one destination is the
+  sum of the record's `edge_flows` entering it.
+- **`ShortestPaths` split routing pools its sources.** Each record (one per roster source) holds the
+  part of the program's traffic that is that source's. At every router the members' amounts are
+  given back to the sources member by member, in member order, by highest averages over what each
+  source still holds there; on an edge that drops traffic (Lossy), what the edge carries is
+  divided by highest averages over what each source brought to it
+  ([splitting whole units](#splitting-whole-units)). So the records sum exactly to the totals, and
+  a source's record uses only edges of its own route.
+- **The controllers** (`CentralizedTE`, `ShortestPaths` with `OPTIMIZED`) optimise the whole
+  roster and destination set together; `CentralizedTE` may use a costlier destination to carry
+  more.
+- **T1 and T2 heads** share the design and the offer by round robin over the roster in ascending
+  node id; a head's share goes only to its own tunnels, and what one head cannot carry is lost at
+  that head, never moved to another.
+- **`Pinned`** follows its program: its injection over the replay roster, then each head's entries.
+
+Two sources with one unit each meet at node 2, whose two members lead to the destination. Pooled,
+node 2 splits the two units once, one per member, and gives one member to each source; split
+separately, each source would send its unit to the first member:
+
+```python
+# Edges 0: 0 -> 2, 1: 1 -> 2, then the two members 2: 2 -> 3 and 3: 2 -> 3.
+g = graph(4, [(0, 2, 5, 1), (1, 2, 5, 1), (2, 3, 1, 1), (2, 3, 1, 1)])
+pol = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config(ngc.ShortestPaths()))
+r = pol.place(2)
+print(r.call_delivered, r.termination.name, [(row.source, row.delivered) for row in r.by_source])
+print([(rec.sources, rec.edge_flows) for rec in pol.records()])
+```
+
+```text
+2 COMPLETE [(0, 1), (1, 1)]
+[([0], [(0, 1), (2, 1)]), ([1], [(1, 1), (3, 1)])]
+```
+
+### Equal source allocation and a source that cannot pass anything
+
+A roster source whose every route crosses an edge with no free capacity stays in the roster: it
+receives its share and loses it. Lossless admits only totals that give it nothing, which is the
+number of roster sources before it, because the first remainder units go to the lowest node ids: 0
+when it is the first source, 1 when it is the second (`RR(1, 2) = (1, 0)` gives it nothing,
+`RR(2, 2) = (1, 1)` gives it a unit). This holds in every model. Lossy loses its share where its program
+puts it: on the edge that limits it (`edge_drops`), or at the source when it has no member to send
+it on (`source_drops`). An Eligibility that excludes the source or the edge removes it from the
+roster instead.
+
+```python
+# Source 0 reaches node 2 only over the 0-unit edge 0; source 1 over the 10-unit edge 1.
+g = graph(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+equal = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL))
+optimized = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED))
+for name, cfg in (("ShortestPaths", config(ngc.ShortestPaths())),
+                  ("CentralizedTE EQUAL", equal),
+                  ("CentralizedTE OPTIMIZED", optimized)):
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg).place(10)
+    print(name, r.call_delivered, r.termination.name)
+lossy = config(ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, lossy).place(10)
+print("LOSSY", r.call_delivered, r.call_edge_drops, [(row.source, row.total_edge_drops) for row in r.by_source])
+r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, config(ngc.ShortestPaths()),
+                   g.eligibility(excluded_nodes=[0])).place(10)
+print("source 0 excluded", r.call_delivered)
+g = graph(3, [(0, 2, 10, 1), (1, 2, 0, 1)])   # now source 1 is the one behind the 0-unit edge
+print("source 1 blocked", ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, config(ngc.ShortestPaths())).place(10).call_delivered)
+```
+
+```text
+ShortestPaths 0 EXHAUSTED
+CentralizedTE EQUAL 0 EXHAUSTED
+CentralizedTE OPTIMIZED 10 COMPLETE
+LOSSY 5 [(0, 5)] [(0, 5), (1, 0)]
+source 0 excluded 10
+source 1 blocked 1
+```
+
+### Forwarding programs
+
+**In plain words.** A program is what a routing decided, written down: which routes each source
+uses and in which integer proportions. Every computing model produces one (`policy.program`,
+`result.program`). `Pinned(program)` forwards a program without computing anything: to replay a
+solution on another ledger, to study a failure (the routers drop the failed routes and split over
+the survivors) or to study the moment before anyone reacts (the failed elements swallow what
+reaches them). `ForwardingProgram.from_routes` builds a program from routes you give, each its own
+entry; `ForwardingProgram.from_dag` builds one shared hop-by-hop program on a DAG you give, its
+sources pooled exactly as `ShortestPaths` pools them.
+
+**Exact rules.**
+
+- **The value.** A `ForwardingProgram` is immutable and shared by reference: `sources` and
+  `destinations` (the normalised input sets), `tunnels` (the tunnel entries in ascending
+  `entry_id`; split routes are not listed) and `source_weights` (`None` for equal sources). A
+  `Tunnel` has `entry_id`, `head`, `local_index` (its position among its head's entries of both
+  kinds), `destination`, `edges` (in path order), `path_cost` (these three `None` for a tunnel
+  T1's setup left down), `status` (`UP`, or a down tunnel's `INSUFFICIENT_BANDWIDTH` or
+  `COST_CEILING_EXCEEDED`), `requested_bandwidth` and `reserved_bandwidth` (T1's request and what
+  it holds on every edge of its path: the request when up, else 0; 0 for the other producers),
+  `planned_bandwidth` (T2's planned bandwidth u, never held; 0 for the other producers) and
+  `weight`. It has no public constructor.
+- **What a program shows.** A program can be replayed without exporting its tables. The public
+  value does not expose per-router effective weights, the split tables or a reachable-source list
+  (its `sources` are the normalised input sources); a split program may have no tunnels while it
+  carries traffic. Records and `OutputOptions` give the carried and dropped amounts per edge.
+- **Injection.** A total `x` enters at the roster (the heads with an entry; for T1 and T2 the
+  policy's roster, a head without an up tunnel or without any tunnel included) either by round
+  robin (**equal sources**) or by highest averages over the captured source weights; each head
+  then splits its share by highest averages over its entries' weights (equal weights give round
+  robin). A head whose entries all have weight 0 loses its share at the source. Identical routes
+  are never merged: each entry takes its own share. `ShortestPaths` split routing, `from_dag`, T1,
+  T2, equal controllers and supplied routes use equal sources; optimized controllers use their
+  solved supplies.
+- **Entry identifiers.** Every entry has an integer `entry_id` that identifies it within one
+  program (not across recomputations): T1 and T2 tunnels are numbered `j * H + i` (round `j`,
+  roster position `i`, `H` heads; T2's dead heads leave holes); controller paths are numbered in
+  decomposition order; a `ShortestPaths` split program and a `from_dag` program number their routes
+  by roster position; supplied routes keep their position in the `routes` list (a split route uses
+  its position too, so tunnel identifiers can skip it). Records (`FlowRecord.entry_id`) and
+  `by_tunnel` rows (`TunnelFlow.entry_id`) use the same identifier.
+- **Split contexts.** A split route given to `from_routes` is its own context: its routers split
+  only that route's share, even where another split route reaches the same router with the same
+  members. A `ShortestPaths` `EQUAL` or `WEIGHTED` program and a `from_dag` program pool all
+  their sources in one context. A controller's program (`ShortestPaths` `OPTIMIZED` included) is
+  weighted path tunnels: its sources were solved jointly, and forwarding them splits no pooled
+  router.
+- **`ForwardingProgram.from_routes(graph, sources, destinations, routes, *, allocation=None,
+  weight_basis=None, edge_weights=None, residual=None)`** with `RouteDefinition(head, route, *,
+  weight=1)` (`route` a `Path` with one edge per hop, a tunnel, or a `PredecessorDAG`, a split
+  route). Order and duplicates are kept; the roster is the sources with a route. `allocation` is
+  the interior split of the `PredecessorDAG` routes, `EQUAL` (`None`) or `WEIGHTED`, whose weights
+  `weight_basis`, `edge_weights` and `residual` choose as in
+  [section 5](#5-route-allocations-and-admission) (`residual` is the free capacity
+  `RESIDUAL_SNAPSHOT` reads; it has no default). A split route keeps the edges of its DAG on the
+  walks from its head to a destination. A route of weight 0 is validated in full and carries
+  nothing. The first failure, in this order, raises `ValueError`:
+  1. the endpoint sets;
+  2. `routes must not be empty`;
+  3. when no route is a `PredecessorDAG`, any option given: `<allocation, weight_basis,
+     edge_weights or residual> applies only to PredecessorDAG routes`;
+  4. `OPTIMIZED`: `from_routes allocation must be EQUAL or WEIGHTED`;
+  5. the weights' combination: `weight_basis requires allocation=WEIGHTED`,
+     `weight_basis=EXPLICIT requires edge_weights`, `edge_weights require weight_basis=EXPLICIT`,
+     `weight_basis=RESIDUAL_SNAPSHOT requires residual`, `residual requires
+     weight_basis=RESIDUAL_SNAPSHOT`;
+  6. `edge_weights`' length and entries, then `residual`'s (the ledger's baseline messages);
+  7. each route in list order: `routes[<i>]: route belongs to another graph`, `routes[<i>]: head
+     <h> is not a source`; for a `Path`, `routes[<i>]: a tunnel has one edge per hop`,
+     `routes[<i>]: the path starts at <v>, not at head <h>`, `routes[<i>]: the path ends at <v>,
+     not at a destination`, `routes[<i>]: the path meets destination <v> before its end`; for a
+     `PredecessorDAG`, `routes[<i>]: no walk from head <h> to a destination`; then
+     `routes[<i>]: weight must be an integer in [0, 2^62)`.
+- **The lossless bound** of a program is the one of
+  [section 5](#5-route-allocations-and-admission): each entry's share forwarded without drops,
+  the loads added per edge, the largest total that leaves no share without a route and puts no
+  edge above its free capacity.
+
+#### Supplied DAGs: from_dag
+
+`ForwardingProgram.from_dag(graph, sources, destinations, dag, *, allocation=None,
+weight_basis=None, edge_weights=None, residual=None)` builds one shared hop-by-hop program on a
+`PredecessorDAG` of the graph, trimmed to the walks from each source to its first destinations.
+It is the mechanism `ShortestPaths` `EQUAL`/`WEIGHTED` uses for its own routes (one builder):
+sources are allocated equally and pooled at every shared router with exactly the same splitting
+and attribution, in one split context. `allocation` is `EQUAL` (`None`) or `WEIGHTED`; the weights
+and the snapshot follow [section 5](#5-route-allocations-and-admission), and `RESIDUAL_SNAPSHOT`
+needs an explicit `residual`. The roster is the sources that reach a destination in the DAG,
+ignoring capacity and weights; an empty roster is allowed (an empty program). There is one split
+route per roster source, identified by roster position, and no tunnel; a `Pinned` policy keeps one
+record per route, attributed to its source. A replay rebuilds the roster on the DAG and keeps the
+pooled context; stale forwarding keeps the tables and the roster. The first failure, in this
+order, raises `ValueError`: the endpoint sets; `dag belongs to another graph`; the allocation
+(`from_dag allocation must be EQUAL or WEIGHTED`) and the weights' combination as for
+`from_routes`; `edge_weights`' and `residual`'s lengths and entries. A `dag` of another type is a
+`TypeError` (`dag must be a PredecessorDAG (got <type>)`).
+
+Two sources whose routes meet at node 2, which has two links of 1 to the destination. `from_dag`
+pools the two arrivals and splits them once, one per link; two separate split routes of
+`from_routes` each send their unit to the first link:
+
+```python
+g = graph(4, [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 1, 1)])
+dag = ngc.PredecessorDAG.from_csr(g, [0, 0, 0, 2, 4], [0, 1, 2, 2], [0, 1, 2, 3])
+pooled = ngc.ForwardingProgram.from_dag(g, [0, 1], 3, dag)
+separate = ngc.ForwardingProgram.from_routes(g, [0, 1], 3, [ngc.RouteDefinition(0, dag), ngc.RouteDefinition(1, dag)])
+for name, prog in (("from_dag", pooled), ("from_routes", separate)):
+    cfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(prog))
+    print(name, prog.tunnels, ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, cfg).place(float("inf")).call_delivered)
+sp = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config(ngc.ShortestPaths())).place(float("inf"))
+print("ShortestPaths", sp.call_delivered)
+```
+
+```text
+from_dag () 2
+from_routes () 1
+ShortestPaths 2
+```
+
+#### Replay under a failure
+
+A `Pinned` policy's Eligibility is the failure being studied (local repair):
+
+- A tunnel that touches an excluded node or edge is `FAILED` and gets nothing; replay never
+  computes a replacement path. A tunnel T1's setup left down stays down with its status: replay
+  never brings one up.
+- A split route loses its excluded members and the branches left without a destination; members
+  of capacity 0 stay (`EQUAL` still sends them their share).
+- The roster is rebuilt from the program's **basis**, together with the replaying policy's
+  exclusions, ignoring capacities and weights:
+
+  | Producer of the program | Basis |
+  | --- | --- |
+  | unrestricted `CentralizedTE`; T1; T2 without a support | the topology, under the producing policy's exclusions |
+  | `ShortestPaths`; `from_dag`; `CentralizedTE` with a support (with or without a tunnel count); `from_routes` | the original routes or support |
+
+- A head that no longer reaches a destination leaves the pool: with equal sources its share moves
+  to the others. A head that still reaches one but has no surviving entry keeps its share and
+  loses it.
+- Captured source weights keep the remaining heads' saved weights. When all of them are 0, a
+  positive offer is lost at the sources, and the call ends `NO_ACTIVE_WEIGHT` when the program has
+  an entry with a path. A program without one (the program of a controller that sent nothing, such
+  as an all-zero `WEIGHTED` one) ends `COMPLETE` under `LOSSY`, the offer counted in the demand's
+  `source_drops` while every per-source row stays zero; under `LOSSLESS` it admits nothing and ends
+  `EXHAUSTED`.
+- An edge whose capacity is now 0 is not a failure: its traffic is lost on that edge, the tunnel
+  stays `UP`. Weights stay as the program froze them.
+
+#### Stale forwarding: black holes
+
+`Pinned(program, black_holes=e)` and `forward(offer, black_holes=e)` forward the program unchanged
+while the nodes and edges that `e` excludes swallow what reaches them (`None`, or an all-allowed
+value, means none):
+
+- **The program is unchanged.** Nothing is pruned, re-split or reweighted: every router keeps its
+  members and weights and applies the program's whole-unit rule to the traffic that actually
+  arrives.
+- **Where traffic disappears.** A black-holed edge carries nothing: all that arrives is dropped
+  there. A black-holed node acts the same on every edge entering it. A black-holed source loses its
+  own share as a source drop.
+- **`LOSSY`** drops what reaches a black hole where it arrives. That traffic takes no part in
+  sharing an edge ([the loss rule](#losses-on-shared-edges)) and makes no edge wait, and the
+  traffic behind it can carry nothing.
+- **`LOSSLESS`** admits only totals that put nothing on a black hole (a black-holed edge serves 0).
+- **Statuses.** A tunnel that is up but whose path reaches a black hole is `BLACKHOLED` in
+  `by_tunnel`, its traffic dropped at the first black hole on its path. A down tunnel keeps its
+  setup status.
+- **With a mask.** The policy's Eligibility applies first: an element both excluded and
+  black-holed is excluded.
+- A program forwarded by `Pinned` books no hold, whatever its producer.
+
+```python
+# Two parallel edges of 4 and 8: the duplicate tunnel takes its own share.
+g = graph(2, [(0, 1, 4, 1), (0, 1, 8, 1)])
+def tunnel(g, head, edges, weight=1):
+    return ngc.RouteDefinition(head, ngc.Path(g, [[e] for e in edges]), weight=weight)
+def pinned(program, admission=ngc.Admission.LOSSLESS, black_holes=None):
+    return ngc.FlowPolicyConfig(routing=ngc.Pinned(program, black_holes=black_holes),
+                                admission=admission)
+for routes in ([tunnel(g, 0, [0]), tunnel(g, 0, [1]), tunnel(g, 0, [1])],
+               [tunnel(g, 0, [0]), tunnel(g, 0, [1])]):
+    prog = ngc.ForwardingProgram.from_routes(g, 0, 1, routes)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, pinned(prog)).place(float("inf"))
+    print(r.call_delivered, [(t.entry_id, t.assigned) for t in r.by_tunnel])
+
+# Two tunnels 0 -> 1 -> 3 and 0 -> 2 -> 3, every edge 10: node 2 fails.
+g = graph(4, [(0, 1, 10, 1), (0, 2, 10, 1), (1, 3, 10, 1), (2, 3, 10, 1)])
+prog = ngc.ForwardingProgram.from_routes(g, 0, 3, [tunnel(g, 0, [0, 2]), tunnel(g, 0, [1, 3])])
+down = g.eligibility(excluded_nodes=[2])
+lossy = pinned(prog, ngc.Admission.LOSSY)
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, lossy, down).replace(10)
+print("repair", r.call_delivered, [(t.status.name, t.assigned) for t in r.by_tunnel])
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned(prog, ngc.Admission.LOSSY, down)).replace(10)
+print("stale", r.call_delivered, r.call_edge_drops, [(t.status.name, t.assigned) for t in r.by_tunnel])
+print("stale lossless", ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned(prog, black_holes=down))
+      .place(float("inf")).call_delivered)
+```
+
+```text
+12 [(0, 4), (1, 4), (2, 4)]
+8 [(0, 4), (1, 4)]
+repair 10 [('UP', 10), ('FAILED', 0)]
+stale 5 [(1, 5)] [('UP', 5), ('BLACKHOLED', 5)]
+stale lossless 1
+```
+
+The repaired head sends all 10 over its surviving tunnel. Stale, node 0 still splits 5 and 5 and
+the second tunnel's 5 are dropped on edge 1, the edge entering node 2; Lossless admits 1 unit (2
+units would put one on the black hole).
+
+A program of a controller replays its solve; under a mask its failed tunnel's share moves to the
+head's surviving tunnel:
+
+```python
+g = graph(4, [(0, 1, 2, 1), (0, 2, 10, 1), (1, 3, 2, 1), (2, 3, 10, 1)])
+solved = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)))
+prog = solved.replace(12).program
+print([(t.entry_id, list(t.edges), t.weight) for t in prog.tunnels], prog.source_weights)
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned(prog, ngc.Admission.LOSSY),
+                   g.eligibility(excluded_edges=[2])).replace(12)
+print(r.call_delivered, r.call_edge_drops, [(t.status.name, t.assigned, t.delivered) for t in r.by_tunnel])
+```
+
+```text
+[(0, [0, 2], 2), (1, [1, 3], 10)] ((0, 12),)
+10 [(1, 2)] [('FAILED', 0, 0), ('UP', 12, 10)]
+```
+
+The first tunnel is `FAILED`; the head's 12 go to its other tunnel by its weight 10 alone, which
+carries 10 and drops 2 on edge 1.
+
+#### Failure studies
+
+A failure has three states, all built from these primitives: **stale forwarding** (no router has
+reacted yet: the black holes above), **local repair** (the routers drop the failed routes and split
+over the survivors: the mask of a `Pinned` policy) and **converged routing** (a new computation on
+the failed network: a new policy with that mask). Save the baseline program before the failure.
+`evaluate_edge_failures` recomputes or repairs under each deletion
+([section 10](#10-evaluators)); it never turns a deletion into a black hole, so a stale study of
+every link is a loop over `Pinned(base, black_holes=...)`. A failure never changes the graph or
+another policy's mask; on a shared ledger, the old owner is removed or replaced before its
+replacement is modelled, since a new policy is a different demand that does not release the old
+one's traffic or holds.
+
+### Losses on shared edges
+
+**In plain words.** Where `LOSSY` traffic meets on an edge that cannot carry it all, the edge
+carries as much as it can and shares that amount out by highest averages: first between the
+demands, by what each brings, then within a demand between its sources, then within a source
+between its entries. Each part goes on with its share; the rest is dropped on that edge. Sharing
+demand by demand first means that a demand gains nothing by spreading its traffic over more
+tunnels.
+
+Two demands of 8 and 4 meet on a link of 9: the link carries `T = min(9, 12) = 9`, and
+`H(9, [8, 4]) = (6, 3)`, so they lose 2 and 1. Offers of 5, 1 and 1 on a link of 3 give
+`H(3, [5, 1, 1]) = (3, 0, 0)`: the first offer's quotients 5, 5/2 and 5/3 all exceed the others'
+1. On a link of 1, demand A with two tunnels of 1 unit and demand B with one tunnel of 2 tie at
+the demand level, 2 against 2. Ties go to the demand created first, A, whatever the order of the
+list, and within A to its first tunnel:
+
+```python
+def at_once(capacity, offers):
+    """One link 0 -> 1; each offer is its own ECMP demand, all forwarded at the same time."""
+    g = graph(2, [(0, 1, capacity, 1)])
+    ledger = ngc.FlowLedger(g)
+    demands = [ngc.FlowPolicy(ledger, 0, 1, config(ngc.ShortestPaths(), admission=ngc.Admission.LOSSY))
+               for _ in offers]
+    results = ngc.apply_actions(ledger, [ngc.Replace(d, x) for d, x in zip(demands, offers)],
+                                mode=ngc.BatchMode.SIMULTANEOUS)
+    return [r.call_delivered for r in results]
+
+print(at_once(9, [8, 4]), at_once(3, [5, 1, 1]))
+g = graph(2, [(0, 1, 1, 1)])
+ledger = ngc.FlowLedger(g)
+a_program = ngc.ForwardingProgram.from_routes(g, 0, 1, [tunnel(g, 0, [0]), tunnel(g, 0, [0])])
+b_program = ngc.ForwardingProgram.from_routes(g, 0, 1, [tunnel(g, 0, [0])])
+a = ngc.FlowPolicy(ledger, 0, 1, pinned(a_program, ngc.Admission.LOSSY))   # created first
+b = ngc.FlowPolicy(ledger, 0, 1, pinned(b_program, ngc.Admission.LOSSY))
+rb, ra = ngc.apply_actions(ledger, [ngc.Replace(b, 2), ngc.Replace(a, 2)], mode=ngc.BatchMode.SIMULTANEOUS)
+print(ra.call_delivered, [t.delivered for t in ra.by_tunnel], rb.call_delivered)
+```
+
+```text
+[6, 3] [3, 0, 0]
+1 [1, 0] 0
+```
+
+**Exact rules.**
+
+- **The local rule.** At an edge `e` that receives more than its free capacity `V[e]`, with
+  arrivals `a[d, s, t]` by demand `d`, source `s` and entry `t`, the edge carries
+  `T = min(V[e], sum of a)`. Each demand gets its share of `H(T, arrivals by demand)`, the demands
+  taken in the order their policies were created in the ledger, never by list position (one
+  program is one demand; in a `SIMULTANEOUS` list each policy is a demand). Within a demand its
+  sources share by `H` over their arrivals, and within a source its entries the same way. Each
+  part carries only its share onward; the rest is dropped on this edge. A pooled `ShortestPaths`
+  demand has no entry level: it splits its total once at each router, and each member's amount
+  is shared among the sources by highest averages over what each still brings.
+- **The whole forwarding state** is evaluated at once:
+  1. Every demand is forwarded with its fixed injections and splits, sharing no edge and dropping
+     its traffic only at its own black holes, and the loads are added. Traffic that carries
+     nothing in this forward is **dead**: an entry, a split member or a pooled source whose
+     whole-unit share is 0, or traffic that can only come through its own demand's black hole.
+     Dead traffic takes no part in what follows: it loads no edge, makes no edge wait and joins no
+     series of edges below. So adding a demand that can carry nothing never changes another
+     demand's result, error or round count.
+  2. **Edges in series.** Two consecutive edges of equal free capacity that all the live traffic
+     crosses together (nothing enters, ends, merges, branches or is re-attributed between them)
+     act as one: in a chain of such edges only the first keeps its service, and the others pass
+     traffic through and report no drops (the records keep every physical edge). So splitting an
+     edge into two in series with the same capacity changes nothing (a black hole on it becomes
+     one on its first part, or on both).
+  3. An edge whose load fits its free capacity can never drop: it passes traffic through and
+     waits for nothing. Every other shared edge waits for all the traffic that can reach it, and a
+     router waits for what it receives.
+  4. The edges are evaluated once each, in dependency order, by the local rule; the order of
+     independent edges does not change the result.
+  5. Edges that wait on each other in a cycle are solved as a group (below).
+
+  Traffic that reaches its own demand's black hole is dropped there and takes no part in the
+  sharing. This is a steady proportional-sharing convention, not a packet, buffer or
+  retransmission simulation.
+- **Cycles.** When edges wait on each other in a cycle (one tunnel meets edge X before Y, another
+  Y before X, and both can drop; the tunnels may belong to different demands), only that group is
+  recalculated, round by round. Round 1 starts from nothing carried. Every round re-injects the
+  full offers, recomputes all the group's edges at once from what the previous round carried, and
+  never offers dropped traffic again. Each round's carried amounts are compared with the earlier
+  rounds', and the first case that applies ends the group:
+
+  | After a round | Outcome |
+  | --- | --- |
+  | it carries exactly what the round before carried | the group is solved |
+  | it carries what the round two before carried (the rounds alternate between two states) | `ValueError("lossy forwarding iteration entered a period-2 cycle")` |
+  | the group has used 64 rounds per waiting edge in it | `ValueError("lossy forwarding iteration did not reach a fixed point within the round limit")` |
+
+  A solved answer is checked independently against the rule before anything is published; a
+  failed check, an implementation fault, raises `RuntimeError("lossy forwarding fixed-point
+  verification failed")`. Each error publishes nothing and does not claim that no answer exists.
+
+```python
+# Two tunnels of one head share the second edge of 2 on tunnel 0 only.
+g = graph(4, [(0, 1, 10, 1), (0, 2, 10, 1), (1, 3, 2, 1), (2, 3, 10, 1)])
+prog = ngc.ForwardingProgram.from_routes(g, 0, 3, [tunnel(g, 0, [0, 2]), tunnel(g, 0, [1, 3])])
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned(prog, ngc.Admission.LOSSY)).place(12)
+print(r.call_delivered, r.call_edge_drops, [(t.assigned, t.delivered, t.total_edge_drops) for t in r.by_tunnel])
+
+# One edge of 9 shared by two tunnels of weights 2 and 1: the offer splits 8 and 4, the edge 6 and 3.
+g = graph(2, [(0, 1, 9, 1)])
+prog = ngc.ForwardingProgram.from_routes(g, 0, 1, [tunnel(g, 0, [0], 2), tunnel(g, 0, [0], 1)])
+r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, pinned(prog, ngc.Admission.LOSSY)).place(12)
+print(r.call_delivered, [(t.assigned, t.delivered, t.total_edge_drops) for t in r.by_tunnel])
+
+# Two tunnels cross edges X (e0, 1 unit) and Y (e3, 2 units) in opposite orders, weights 1 and 2.
+g = graph(6, [(0, 1, 1, 1), (1, 2, 1000, 1), (1, 5, 1000, 1), (2, 3, 2, 1), (3, 0, 1000, 1),
+              (3, 5, 1000, 1), (4, 0, 1000, 1), (4, 2, 1000, 1)])
+prog = ngc.ForwardingProgram.from_routes(
+    g, 4, 5, [tunnel(g, 4, [6, 0, 1, 3, 5], 1), tunnel(g, 4, [7, 3, 4, 0, 2], 2)])
+try:
+    ngc.FlowPolicy(ngc.FlowLedger(g), 4, 5, pinned(prog, ngc.Admission.LOSSY)).place(3)
+except ValueError as error:
+    print(error)
+```
+
+```text
+8 [(2, 4)] [(6, 2, 4), (6, 6, 0)]
+9 [(8, 6, 2), (4, 3, 1)]
+lossy forwarding iteration entered a period-2 cycle
+```
+
+In the first program the second edge of 2 on tunnel 0 drops 4 of its 6. In the cycle, tunnel 0
+sends 1 unit over X (edge 0, capacity 1) and then Y (edge 3, capacity 2), and tunnel 1 sends 2
+units over Y and then X. What tunnel 0 keeps on X decides what reaches Y, and what tunnel 1 keeps
+on Y decides what reaches X. Shares are by highest averages over the arrivals, ties to tunnel 0:
+
+| Round | At X: arrivals of tunnels 0, 1 | X carries | At Y: arrivals of tunnels 0, 1 | Y carries |
+| --- | --- | --- | --- | --- |
+| 1 | 1, 0 | 1, 0 | 0, 2 | 0, 2 |
+| 2 | 1, 2 | 0, 1 | 1, 2 | 1, 1 |
+| 3 | 1, 1 | 1, 0 | 0, 2 | 0, 2 |
+
+Round 3 repeats round 1, so the call raises the period-2 error and publishes nothing.
+
+### The placement call
+
+`place(offer, outputs=None)` takes an offer in units (an `int`) or `float('inf')`.
+
+1. **Validation** happens before anything changes. Within an epoch, a finite offer after an
+   infinite one is rejected (`finite placement after infinite placement requires a new epoch`, the
+   cumulative request would be undefined), `place(0)` included.
+2. **An offer of 0** is `COMPLETE` and does nothing: it creates no flow and prepares nothing.
+   Before any program exists (a new policy, or after `remove()`) its result is all zeros, every
+   flag false; with a program installed it reports the demand's current state with every flag
+   false. It is not a removal: `remove()` is.
+3. **`ShortestPaths` split routing and `Pinned`.** `ShortestPaths` prepares the program at the
+   epoch's first positive call (one record per roster source, also at zero delivery); `Pinned`
+   creates its records, one per entry, there. The two admissions count the new offer differently:
+   - **Lossless** re-solves the whole target: it admits the largest total `a` between what it
+     already delivers and that plus the offer that fits on its service view
+     ([the lossless bound](#5-route-allocations-and-admission)), forwarded from zero. A unit
+     refused by an earlier call is not offered again: the next call targets what is delivered
+     plus its own offer.
+   - **Lossy** sends only the new units: the sources inject this call's increase of the
+     injection, `RR(offered + v) - RR(offered)`, and it is forwarded hop by hop on the free
+     capacity; each edge carries the smaller of what reaches it and its residual and drops the
+     rest, and old drops are never offered again. With captured source weights the increase is
+     `H(offered + v, w) - H(offered, w)`, so after any number of calls the sources have received
+     exactly `H(total offered, w)`.
+
+   An infinite Lossy offer is rejected for `Pinned` (`LOSSY forwarding requires a finite offer`);
+   for `ShortestPaths` it is the first-hop experiment of
+   [section 5](#5-route-allocations-and-admission).
+4. **The controllers** re-solve as described above.
+5. **T1 and T2** have no `place`: every call raises `DistributedTE does not support incremental
+   placement` or `CentralizedTE with tunnel_count does not support incremental placement`, before
+   anything else (an offer of 0 too); their calls are `replace`, `evaluate` and `forward`.
+6. **Commit.** All changes to the ledger and the policy are committed together at the end, or
+   none are ([section 8](#8-failures-threads-and-lifetimes)).
+
+What the call guarantees:
+
+- `call_delivered` is the increase in delivery made by this call, and `0 <= call_delivered <=
+  offer`. For Lossy it is this call's delivery. `call_undelivered = offer - call_delivered`
+  (`float('inf')` for an infinite offer; for Lossy it includes what was lost); it is never a
+  backlog to retry.
+- A `place` call never reduces `delivered()`, the sum of `delivered` over the policy's records.
+- The first positive offer creates the policy's records even when none of them can deliver
+  anything yet. Such a zero-delivery record keeps its FlowId for the rest of the epoch and can fill
+  on a later call.
+- **Additivity.** With the rest of the network unchanged between the calls, `place(a); place(b)`
+  equals `place(a + b)` exactly for Lossless `ShortestPaths` split routing, the controllers (value,
+  allocation and cost curve) and Lossless `Pinned`. Lossy calls are not additive: each forwards its
+  own injection on the free capacity the earlier calls left, and nothing is offered again.
+
+Two sources behind private links of 1 and 3, and calls of 3 and then 1. Lossless: the first call
+tries 3, split (2, 1), but source 0's link carries only 1, so it admits 2, split (1, 1). The
+second call targets what is delivered plus its offer, 2 + 1 = 3 again, which still does not fit,
+and delivers 0. Lossy: the first call sends (2, 1) and drops 1 on source 0's link; the second sends
+only the new units, `RR(4, 2) - RR(3, 2) = (2, 2) - (2, 1) = (0, 1)`, and delivers that 1:
+
+```python
+g = graph(3, [(0, 2, 1, 1), (1, 2, 3, 1)])
+for admission in (ngc.Admission.LOSSLESS, ngc.Admission.LOSSY):
+    pol = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, config(ngc.ShortestPaths(), admission=admission))
+    calls = [pol.place(v) for v in (3, 1)]
+    print(admission.name, [(r.call_delivered, r.call_edge_drops) for r in calls], calls[-1].delivered)
+```
+
+```text
+LOSSLESS [(2, []), (0, [])] 2
+LOSSY [(2, [(0, 1)]), (1, [])] 3
+```
+
+### Epochs
+
+`remove()` takes every flow of the policy out of the ledger (allocations reverted, records gone,
+ids retired), clears the installed program and starts a new epoch: the cumulative request, the
+round-robin position of the source split and the finite-or-infinite state are reset. The next
+positive offer prepares again and creates new records with new ids; ids are never reused. After
+`remove()` the policy's `program` reads `None` until the next preparation. A repeated `remove()`
+does nothing. A policy destroyed without `remove()` leaves its traffic and holds in the ledger as
+orphans until `FlowLedger.reset()`; nothing is redistributed.
+`replace` and `forward` also start a new epoch (below).
+
+```python
+g = graph(4, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 2, 1), (2, 3, 2, 1)])
+ledger = ngc.FlowLedger(g)
+pol = ngc.FlowPolicy(ledger, [0, 1], 3, config(ngc.ShortestPaths()))
+for v in (1, 1, 0):
+    r = pol.place(v)
+    print(v, r.call_delivered, r.routes_changed, [(x.flow_id[1], x.delivered) for x in pol.records()])
+pol.remove()
+r = pol.place(1)
+print(1, r.call_delivered, r.routes_changed, [(x.flow_id[1], x.delivered) for x in pol.records()])
+```
+
+```text
+1 1 True [(0, 1), (1, 0)]
+1 1 False [(0, 1), (1, 1)]
+0 0 False [(0, 1), (1, 1)]
+1 1 True [(2, 1), (3, 0)]
+```
+
+The first unit goes to source 0 and the second to source 1 (round robin of the cumulative
+offer); the first call creates both records, source 1's at zero delivery. After `remove()` the
+split starts again at source 0, under new ids.
+
+### Operations: evaluate, replace and forward
+
+Besides `place`, a policy has three full-offer calls. Each starts from the policy's **released
+view**: its service view, the ledger's residual with the policy's own traffic given back (T1's
+setup uses its setup view, with its own holds given back).
+
+| Call | What it does | Routings |
+| --- | --- | --- |
+| `evaluate(offer, *, design_demand=None, outputs=None)` | computes and forwards `offer` from the released view as a fresh epoch would (T1: sets up on its setup view), and reports it, the computed program included; publishes nothing: no record, no hold, and the policy's program and epoch stay as they were | all |
+| `replace(offer, *, design_demand=None, outputs=None)` | the same computation, then published at once: the old records and holds are retired, new ones created, the new program installed, a new epoch begun with `requested = offer`; delivery may go down | all |
+| `forward(offer, *, black_holes=None, outputs=None)` | forwards a full new offer over the installed program with no route computation and no setup (weights stay frozen, a controller does not re-solve, T1 keeps its tunnels and holds, T2 its tunnels and plan), on the released view, then publishes like `replace`; `black_holes` forwards it stale for this call | every computing model with an installed program; `Pinned` uses `replace` |
+
+- `call_delivered` of a full-offer call is its whole new delivery and `delivery_delta` the new delivery
+  minus the old (it may be negative). A later `place` continues the epoch a `replace` or a
+  `forward` began (its records keep their ids).
+- With other owners fixed, identical full inputs give identical results, except fresh record ids.
+- **`design_demand`** belongs to T1 and T2 alone: an integer in `[0, 2^62)` or `float('inf')`;
+  `None` means equal to the offer. T1 needs it finite, also for an infinite offer; T2 takes an
+  unlimited one (its largest common size). It never accumulates. The texts of these checks and of
+  `forward`'s are in [configuration and call errors](#configuration-and-call-errors).
+- A program reused elsewhere, or read again under a different mask, goes through a new `Pinned`
+  policy; a program forwarded by `Pinned` never books holds, whatever its producer (read a
+  result's `edge_reservations` or the ledger for actual holds).
+
+```python
+g = graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)])
+ledger = ngc.FlowLedger(g)
+pol = ngc.FlowPolicy(ledger, 0, 1, config(ngc.ShortestPaths()))
+r = pol.replace(6)
+print(r.call_delivered, [x.flow_id[1] for x in pol.records()])
+r = pol.evaluate(12)
+print(r.call_delivered, r.delivery_delta, ledger.carried().tolist())
+r = pol.replace(4)
+print(r.call_delivered, r.delivery_delta, [x.flow_id[1] for x in pol.records()])
+r = pol.forward(7)
+print(r.call_delivered, r.routes_changed, r.weights_changed, ledger.carried().tolist())
+```
+
+```text
+6 [0]
+12 6 [3, 3]
+4 -2 [1]
+7 False False [4, 3]
+```
+
+### Termination
+
+The call's `termination` (of `place` and of the full-offer calls alike) is the first row that
+applies (an invalid call raises instead):
+
+| Termination | When |
+| --- | --- |
+| `COMPLETE` | the offer is 0 |
+| `NO_ROUTE` | the offer is positive and the roster is empty (`Pinned`: the replay roster) |
+| `NO_ACTIVE_WEIGHT` | the program has an entry with a path (an up tunnel, a controller path or a split route), but nothing can be sent anywhere: every `WEIGHTED` member has weight 0, or no head with a positive injection weight has a surviving entry of positive weight (routes of weight 0, every up tunnel failed). A program whose tunnels are all down (T1) or that has no tunnels (T2 with every head dead, or U = 0) is not this case: it goes on to the rows below, every share lost at its head |
+| `NO_ACTIVE_WEIGHT` | a live `WEIGHTED` controller whose roster weights are all 0: nothing enters, nothing is delivered and a finite offer is wholly unadmitted; its program has captured weights that are all 0 and no tunnel |
+| `COMPLETE` | Lossy with a finite offer: the whole offer was forwarded, and delivery and losses account for all of it (it does not mean nothing was lost) |
+| `COMPLETE` | Lossless: the whole offer was admitted |
+| `EXHAUSTED` | otherwise: Lossless below the offer, any infinite offer (the first-hop experiment included), a controller whose maximum is 0 over existing routes |
+
+`call_undelivered` is an amount, never a status: a Lossy call can be `COMPLETE` with a positive
+`call_undelivered`. A `Pinned` replay of the all-zero `WEIGHTED` controller's program follows the
+rows of a fixed program instead ([replay](#replay-under-a-failure)): Lossy `COMPLETE` with the
+whole offer lost at the sources, Lossless `EXHAUSTED`. That is the one case in which a live call
+and its replay end differently.
+
+```python
+def show(r):
+    print(r.call_delivered, r.termination.name, [(row.source, row.delivered) for row in r.by_source])
+
+# Every tunnel down: five edges, the design 14 asks 7 per tunnel and no path has 7.
+g = graph(4, [(0, 1, 6, 1), (0, 2, 6, 3), (1, 2, 4, 1), (1, 3, 6, 3), (2, 3, 6, 1)])
+for admission in (ngc.Admission.LOSSY, ngc.Admission.LOSSLESS):
+    all_down = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=admission)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, all_down).replace(14, design_demand=14)
+    print(admission.name, [t.status.name for t in r.by_tunnel], r.call_source_drops, end=" ")
+    show(r)
+
+# One edge for source 1 to node 4.
+g = graph(5, [(0, 2, 1, 1), (0, 3, 1, 1), (2, 4, 1, 1), (3, 4, 1, 1), (1, 4, 1, 1)])
+
+# Weights from the residual where another demand holds the only edge: no positive weight.
+ledger = ngc.FlowLedger(g)
+ngc.FlowPolicy(ledger, 1, 4, config(ngc.ShortestPaths())).place(1)
+weighted = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(allocation=ngc.RouteAllocation.WEIGHTED,
+                                                          weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT))
+show(ngc.FlowPolicy(ledger, 1, 4, weighted).place(1))
+```
+
+```text
+LOSSY ['INSUFFICIENT_BANDWIDTH', 'INSUFFICIENT_BANDWIDTH'] 14 0 COMPLETE [(0, 0)]
+LOSSLESS ['INSUFFICIENT_BANDWIDTH', 'INSUFFICIENT_BANDWIDTH'] 0 0 EXHAUSTED [(0, 0)]
+0 NO_ACTIVE_WEIGHT [(1, 0)]
+```
+
+Both of T1's tunnels are down, so the program has no entry with a path: Lossy forwards the whole
+offer and loses it at the head (`COMPLETE`), Lossless admits nothing (`EXHAUSTED`). The Weighted
+route has an entry with a path whose only member has weight 0: `NO_ACTIVE_WEIGHT`.
+
+### Flags
+
+`routes_changed`, `weights_changed` and `reservations_changed` start false in every call and
+record only changes that were committed; a call that raises publishes nothing (`evaluate` reports
+what `replace` would set). They compare the installed program before and after the call (no
+program counts as an empty one): `routes_changed` the ordered heads, each entry's kind and route
+(a tunnel's path, a split route's members), duplicates included; `weights_changed` the injection
+(equal or the captured weights, by value) and every entry and split-table weight, an entry absent
+from one program counting as weight 0; `reservations_changed` every tunnel's `requested_bandwidth`
+and `reserved_bandwidth` by identifier, an absent tunnel counting as 0 (only T1 sets it: T2's planned
+bandwidth is no reservation, and a T2 layout over the same routes at another planned size sets
+no flag). Hence:
+
+| Committed change | `routes_changed` | `weights_changed` |
+| --- | --- | --- |
+| the epoch's first nonempty program (`ShortestPaths` and the controllers' first positive call, a `replace`, `replace(0)` included) | true | true when some entry has a positive weight (a T1 program whose tunnels are all down: false) |
+| a T1 setup whose paths or up and down tunnels differ from the installed one's (requests changed too: `reservations_changed`) | true | true when a tunnel came up or went down |
+| an empty program over no program or an empty one (a call with an empty roster, `replace(0)` included) | false | false |
+| a controller's re-solve that moves a source's share to other edges, also with `call_delivered == 0` | true | true unless the entries keep their number and amounts |
+| a controller's re-solve that changes only a path's amount (`CentralizedTE` `place(5)` then `place(5)` on one path) | false | true |
+| an offer-only call over an unchanged program: `forward`, `Pinned`, `ShortestPaths` increments, an identical `replace` (new ids) | false | false |
+| nothing of the above: `place(0)` (an offer of 0, which prepares and installs nothing, unlike a full zero offer such as `replace(0)`, which follows the rows above), rejected candidates only | unchanged | unchanged |
+
+`reservations_changed` is true exactly when some tunnel's requested or reserved amount changed by
+identifier: a T1 `replace` (or `evaluate`) whose design or setup differs, even over unchanged
+paths; it is never set by `forward`, by `Pinned` or by the other routings. The flags describe
+routes, weights and holds only: delivered and dropped amounts can change with all three false.
+
+```python
+# A first offer on a route whose only unit another demand holds.
+g = graph(5, [(0, 2, 1, 1), (0, 3, 1, 1), (2, 4, 1, 1), (3, 4, 1, 1), (1, 4, 1, 1)])
+ledger = ngc.FlowLedger(g)
+ngc.FlowPolicy(ledger, 1, 4, config(ngc.ShortestPaths())).place(1)
+pol = ngc.FlowPolicy(ledger, 1, 4, config(ngc.ShortestPaths()))
+r = pol.place(1)
+print(r.call_delivered, r.termination.name, r.routes_changed, r.weights_changed,
+      [x.delivered for x in pol.records()])
+```
+
+```text
+0 EXHAUSTED True True [0]
+```
+
+### The result
+
+`place`, `evaluate`, `replace` and `forward` (and every evaluator) return a `PlacementResult`. Its
+fields describe either this call or the demand's state after it (totals over the epoch); a
+per-call loss field carries the `call_` prefix, a state field does not, so the two are never
+confused.
+
+- **This call**: `call_delivered`, `call_undelivered`, `termination`, `routes_changed`,
+  `weights_changed` and `reservations_changed` as above; `delivery_delta`, the change of the
+  delivery (for `place` it equals `call_delivered`); `call_edge_drops`, this call's drops per edge
+  as `[(EdgeId, units)]`; `call_source_drops`, the units this call lost at sources.
+- **The demand's state**: `program` (the installed `ForwardingProgram`, `evaluate`'s computed one;
+  `None` before the epoch's first preparation and after `remove()`), `plan` (T1 and T2: the
+  `TunnelPlan` of that program, [T1](#t1-tunnels-set-up-by-their-heads),
+  [T2](#t2-the-controllers-equal-tunnels); `None` for every other routing, `Pinned` included),
+  `requested` (the sum of the offers, `float('inf')` after an infinite one), `offered`,
+  `admitted`, `delivered`, `unadmitted`, `source_drops`, `edge_drops` (per edge, as
+  `[(EdgeId, units)]`), `by_source`, `by_tunnel` and `total_cost`. Every amount is an exact Python
+  integer and may exceed 64 bits.
+- **Accounting.** Lossless: `offered` is `None`, `source_drops` 0, no edge drops, `admitted =
+  delivered`, and `requested = unadmitted + delivered` for a finite offer (`unadmitted` is `None`
+  after an infinite one). Lossy: `offered` is the traffic actually sent, `admitted = offered`,
+  `unadmitted = 0`, and `offered = source_drops + sum(edge_drops) + delivered`; `offered =
+  requested` except in the first-hop experiment, where `requested` is infinite and `offered` the
+  finite injection. `delivered + sum(edge_drops)` is what entered the network. `edge_flows` are
+  carried loads per edge: summing them counts every hop, not the delivery.
+- **`by_source`** is a tuple of `SourceFlow` rows, one per input source in ascending node id, a
+  source outside the roster included (a zero row): `source`, `offered` (`None` when Lossless),
+  `admitted`, `delivered`, `source_drops` and `total_edge_drops` (its share of `edge_drops`). The
+  rows sum to the totals, with two exceptions, both Lossy with a positive offer: an empty roster,
+  and a forwarding whose remaining captured source weights are all 0 (the program of a controller
+  that sent nothing, such as an all-zero `WEIGHTED` one, or a mask that left only zero-weight
+  heads). In both the whole offer is the demand's `source_drops`, lost before entering, while every
+  row stays zero; read the demand's totals from the result's own fields, not from the rows.
+- **`by_tunnel`** is a tuple of `TunnelFlow` rows, one per program tunnel in ascending `entry_id`
+  (empty without tunnels): `entry_id`, `head`, `status` (`UP`; `INSUFFICIENT_BANDWIDTH` or
+  `COST_CEILING_EXCEEDED` for a tunnel T1's setup left down; `FAILED` or `BLACKHOLED` in this
+  forwarding), `assigned` (its injected share), `delivered` and `total_edge_drops`. It is another
+  view of the same traffic as `by_source`, never added to it; a head's source drops are not
+  attributed to one of its down tunnels.
+- **`total_cost`**: the controllers only, the exact `sum(cost[e] * flow[e])` of the policy's
+  allocation; `None` otherwise (T1, T2 and `Pinned` included).
+- **`marginal_cost_curve` and `min_cut`** exist only for unrestricted `CentralizedTE` with
+  `OPTIMIZED` source allocation. For every other model, for `EQUAL` or `WEIGHTED` sources and with
+  a supplied support both are `None`: the marginal costs of a flow with prescribed shares need not
+  increase, and such a flow is not the unrestricted maximum a cut certifies. For that controller
+  the call decides what is reported:
+
+  | Call | `marginal_cost_curve` | `min_cut` (when requested) |
+  | --- | --- | --- |
+  | a positive `place`, an `evaluate` or a `replace`, a zero offer included | the curve of the call's solve: of the policy's cumulative flow for `place`, of the whole offer for `evaluate` and `replace` | the cut, when the solve reached the maximum on its view; `None` when the offer stopped it below |
+  | `place(0)` | the stored curve unchanged: `None` before the epoch's first solve or forward; after a `forward`, `None` for a nonempty roster and `[]` for an empty one; otherwise the last solve's | `None` |
+  | `forward` with a nonempty roster | `None`: nothing is solved | `None` |
+  | any of these but `place(0)`, with an empty roster | `[]` (the flow is 0 and maximal) | `[]` |
+
+- **Histograms for the other models.** The sum of `(min_route_cost, delivered)` over the records is
+  a histogram of delivery by each record's cheapest walk cost: the cost every unit travels at for
+  `ShortestPaths` split routing, T1 and T2, whose routes have one cost, but not for a split route
+  whose walks differ in cost.
+- **Optional outputs**, `None` unless requested through `OutputOptions(edge_flows=False,
+  residual=False, saturated_boundary_edges=False, edge_reservations=False, min_cut=False)`:
+  `edge_flows` is the policy's own allocation per edge after the call (the ledger's total is
+  `carried()`); `residual` and `saturated_boundary_edges` are the ledger's after the call;
+  `edge_reservations` is the policy's own holds per edge after the call (zeros for a routing
+  without holds; the ledger's total is `reserved()`); `min_cut` is described below.
+- **`saturated_boundary_edges` and `min_cut` are different things.** `saturated_boundary_edges` is
+  the saturation report of [section 6](#6-the-ledger), available in every model. `min_cut`
+  (requested by `OutputOptions(min_cut=True)`, reported as the table above says) is the edges of a
+  minimum cut of the policy's service view, the one on the sources' side: the allowed edges that
+  leave the nodes the sources can still reach once the flow is maximal (counting the option to undo
+  flow on an edge), in ascending EdgeId. An edge with nothing free in the view (capacity 0, or held
+  by other policies) is included: it adds 0 to the cut's value and is listed because every allowed
+  edge leaving that set is listed. An edge the policy's Eligibility excludes is never listed.
+
+```python
+g = graph(4, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 5, 2), (2, 3, 5, 2)])
+ledger = ngc.FlowLedger(g)
+pol = ngc.FlowPolicy(ledger, 0, 3, ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)))
+want = ngc.OutputOptions(saturated_boundary_edges=True, min_cut=True)
+r = pol.place(12, want)
+print(r.call_delivered, r.marginal_cost_curve, r.min_cut, r.saturated_boundary_edges, r.termination.name)
+r = pol.place(float("inf"), want)
+print(r.call_delivered, r.marginal_cost_curve, r.min_cut, r.saturated_boundary_edges, r.termination.name)
+print(r.requested, r.admitted, r.unadmitted, r.total_cost)
+r = pol.forward(5, outputs=want)
+print(r.call_delivered, r.total_cost, r.marginal_cost_curve, r.min_cut)
+```
+
+```text
+12 [(2, 10), (4, 2)] None [0] COMPLETE
+3 [(2, 10), (4, 5)] [0, 1] [0, 1] EXHAUSTED
+inf 15 None 40
+5 12 None None
+```
+
+After 12 units the cheap path (cost 2) is full and the solve stopped below the maximum, so there is
+no cut; `saturated_boundary_edges` already reports the full edge 0. The second call adds 3 units at
+cost 4 and reaches the maximum of 15, at a total cost of 10 x 2 + 5 x 4 = 40. `forward(5)` sends 5
+over the installed paths by their weights 10 and 5, `H(5, [10, 5]) = (4, 1)`, at a cost of 4 x 2 + 1
+x 4 = 12; it solves nothing, so it reports no curve and no cut.
+
+### Several demands at once
+
+    apply_actions(ledger, actions, *, mode=BatchMode.ORDERED, outputs=None) -> list[PlacementResult]
+    Place(policy, offer)
+    Replace(policy, offer, *, design_demand=None)
+    Forward(policy, offer, *, black_holes=None)
+
+`apply_actions` runs the actions of several policies of one ledger as one operation and returns
+one `PlacementResult` per action, in input order, each with the fields of that policy's scalar
+call (`place`, `replace` or `forward`). The whole list is validated first and published once: if
+anything fails, the ledger and every policy are as they were. A policy appears at most once, and
+every policy belongs to `ledger`. An action is an immutable value that keeps its policy (and its
+black holes) alive; its offer and design demand are kept as given (an int or a float: another type
+raises `TypeError` when the action is built), and the call checks their domain.
+
+- **`BatchMode.ORDERED`** runs each action in list order exactly as its scalar call would, on the
+  state the earlier actions left (their traffic and their holds); the policies not reached yet keep
+  their old state. Normal outcomes (exhaustion, source drops, a down tunnel) are kept. Earlier
+  actions are served first: on one edge of 10, an ECMP replace of 10 and then a T1 tunnel's replace
+  of 10 deliver 10 and 0, though the tunnel holds its 10, because a hold reserves setup bandwidth,
+  not service. New records take FlowIds in list order.
+- **`BatchMode.SIMULTANEOUS`** forwards every action at the same time on fixed routes, the losses
+  shared across the demands by [the loss rule](#losses-on-shared-edges). It takes `Replace` of
+  `ShortestPaths` `EQUAL` or `WEIGHTED` (its routes prepared on the list's view) and of `Pinned`,
+  and `Forward` of any policy with an installed program; every participant is LOSSY with a finite
+  offer. Controllers compute nothing here and T1 sets nothing up: prepare them first (scalar calls
+  or an ORDERED list), then forward them; a T1 owner keeps its holds. The view is the residual
+  plus every participant's old traffic, released together: owners outside the list and orphans
+  stay as fixed load, and holds are never added. Repeating a list with the same outside load gives
+  the same state, and permuting it changes nothing. Each participant's black holes are its own:
+  what reaches one is dropped there and takes no part in sharing that edge, while the others share
+  it as usual. Removing a participant later frees only its own traffic; the others do not
+  rebalance until they are forwarded again.
+- **Outputs.** `outputs` applies to every entry. `residual` and `saturated_boundary_edges` read the
+  ledger after that action (ORDERED) or after the whole list (SIMULTANEOUS: one residual for every
+  entry, each entry's boundary from its own sources and Eligibility).
+- **Validation, in this order:** the arguments' types (`TypeError`: `ledger must be a FlowLedger`,
+  `actions must be a sequence of Place, Replace or Forward (got <type>)`, `actions[<i>] must be a
+  Place, Replace or Forward (got <type>)`, `mode must be a BatchMode (got <type>)`, `outputs must be
+  an OutputOptions (got <type>)`); the mode's value (`mode: <v> is not a value of BatchMode`); an
+  empty list checks ledger usability under the gate before returning `[]`. Each action's argument
+  checks run in list order: `list policy belongs to another ledger`, `duplicate policy in list`, the
+  SIMULTANEOUS rules (`SIMULTANEOUS does not accept Place`, `SIMULTANEOUS Replace requires
+  ShortestPaths EQUAL or WEIGHTED, or Pinned`, `SIMULTANEOUS requires admission=LOSSY`,
+  `SIMULTANEOUS requires finite offers`), then the scalar call's argument checks. After all actions
+  pass, check ledger usability and every action's mutable state under the gate, in list order. Only
+  then compute anything. An error of the computation (a loss cycle that does not settle, a solver or
+  forwarding size limit, an allocation failure) publishes nothing.
+
+```python
+# Two ECMP demands of 10 on one edge of 10, at the same time and one after the other.
+g = graph(2, [(0, 1, 10, 1)])
+ecmp = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+for mode in (ngc.BatchMode.SIMULTANEOUS, ngc.BatchMode.ORDERED):
+    led = ngc.FlowLedger(g)
+    a = ngc.FlowPolicy(led, 0, 1, ecmp)
+    b = ngc.FlowPolicy(led, 0, 1, ecmp)
+    res = ngc.apply_actions(led, [ngc.Replace(a, 10), ngc.Replace(b, 10)], mode=mode)
+    print(mode.name, [r.call_delivered for r in res], [r.call_edge_drops for r in res])
+
+# Edges 0: 0 -> 2 of 5, 1: 1 -> 2 of 10, 2: 2 -> 3 of 10; a from 0 and b from 1, 5 each.
+g = graph(4, [(0, 2, 5, 1), (1, 2, 10, 1), (2, 3, 10, 1)])
+led = ngc.FlowLedger(g)
+a, b = (ngc.FlowPolicy(led, s, 3, ecmp) for s in (0, 1))
+out = ngc.OutputOptions(residual=True, saturated_boundary_edges=True)
+for r in ngc.apply_actions(led, [ngc.Replace(a, 5), ngc.Replace(b, 5)],
+                           mode=ngc.BatchMode.SIMULTANEOUS, outputs=out):
+    print(r.call_delivered, r.residual.tolist(), r.saturated_boundary_edges)
+```
+
+```text
+SIMULTANEOUS [5, 5] [[(0, 5)], [(0, 5)]]
+ORDERED [10, 0] [[], [(0, 10)]]
+5 [0, 5, 0] [0]
+5 [0, 5, 0] [2]
+```
+
+At the same time the edge shares its 10 between the two demands; one after the other the first
+takes it all. In the second list both entries report the residual after the whole list, and each
+its own boundary: a's source reaches nothing beyond its full edge 0, b's reaches node 2, whose exit
+is full.
+
+### Configuration and call errors
+
+These are the checks of a configuration and of a call, with their texts, in the order they run.
+The first that fails is reported, before any work and with nothing changed, a zero offer included.
+[Exception classes](#exception-classes) gives the rule for `TypeError` and `ValueError`.
+
+**At construction** (`TypeError` unless stated):
+
+- An unknown keyword (also every field that belongs to another model, such as `allocation` on
+  `FlowPolicyConfig` or `source_allocation` on `DistributedTE`), a missing required argument
+  (`routing`, `tunnel_count`, `CentralizedTE`'s `source_allocation`, `program`), `None` where none
+  is allowed, and a value of the wrong type raise `TypeError` before any policy exists.
+- A bool field (and a bool search option) takes only a `bool` or a `numpy.bool_`, known by its
+  type: `multipath=None`, `multipath=1` and an object with `__bool__` are `TypeError`.
+- An integer field of a configuration value (`TunnelCount` `per_head`, `AbsoluteCost` `cost`,
+  `min_unreserved_bandwidth`, a `RouteDefinition`'s `head` and `weight`) given a value of another
+  type raises `TypeError` (`TunnelCount per_head must be an integer (got bool)`); an integer
+  outside 64 bits raises `ValueError` (`TunnelCount per_head = <v> is out of range [...]`).
+- An `edge_weights` that is not a 1-D sequence of integers (a scalar, a string, a 2-D array, a
+  bool or float array, a bool or float entry) raises `TypeError`
+  (`edge_weights[0] must be an integer (got bool)`); an entry beyond 64 bits raises
+  `ValueError('edge_weights[<i>] must be an integer in [0, 2^62)')`.
+- `source_weights` is converted as `edge_weights` is, in three passes over the whole vector, each
+  reporting its first defect. First the shape: an array of another rank, a string, bytes or a
+  non-sequence, then an entry that is itself a sequence. Then the entry types:
+  `source_weights[<i>] must be an integer (got <type>)` (`TypeError`). Last, an integer that does
+  not fit in signed 64 bits: `source_weights[<i>] must be an integer in [0, 2^62)` (`ValueError`;
+  an unsigned array is checked like any other). So `[1.5, [1]]` fails on entry 1's shape, and
+  `[2**64, 1.5]` on entry 1's type. Any sequence of integers is accepted, a `range` or a tuple
+  too.
+
+**When a policy or an evaluator uses the configuration** (`ValueError`). The model matrix, in the
+order checked:
+
+1. the enumeration values (`admission`, then the model's `allocation`, `source_allocation`,
+   `weight_basis`, `tie_break`), each `<field>: <v> is not a value of <Enum>` (reachable with a
+   value built from an integer);
+2. the route allocation and the source allocation: first `source_allocation=WEIGHTED requires
+   CentralizedTE without tunnel_count`; then `ShortestPaths with EQUAL or WEIGHTED requires
+   source_allocation=EQUAL`; for T2, `CentralizedTE with tunnel_count and several sources requires
+   source_allocation=EQUAL` (`OPTIMIZED` with more than one input source, counted after removing
+   repeats and before any Eligibility; with one source it is the same calculation as `EQUAL`);
+3. the admission: `ShortestPaths OPTIMIZED requires admission=LOSSLESS`; `CentralizedTE without
+   tunnel_count requires admission=LOSSLESS`;
+4. the route choice: `ShortestPaths tie_break requires multipath=False or parallel_edges=False` (a
+   `HIGHER_*` rule with every route and every parallel edge kept, also for `OPTIMIZED`, whose route
+   the rule selects); then the **pooled single-path rule**: `ShortestPaths with multiple input
+   sources requires tie_break=FEWER_HOPS when multipath=False` (more than one input source, counted
+   after removing repeats and before any Eligibility: a bottleneck choice could differ per source
+   at a router the sources share);
+5. `prefer_headroom requires tunnel_count`;
+6. the weights: `weight_basis requires allocation=WEIGHTED`; `weight_basis=EXPLICIT requires
+   edge_weights`; `edge_weights require weight_basis=EXPLICIT`; for CentralizedTE,
+   `source_allocation=WEIGHTED requires source_weights` and `source_weights require
+   source_allocation=WEIGHTED`;
+7. last, a cache given to a model that does not read one: `<DistributedTE or CentralizedTE or
+   Pinned> does not use ShortestPathCache` (only `ShortestPaths` reads a `ShortestPathCache`).
+
+Then each model's own fields: the tunnel count in `[1, 10000]` (`tunnel count must be in [1,
+10000]`; `TunnelCount(per_head)` itself takes any 64-bit integer); for T1 an "up to" count
+(`DistributedTE requires an exact tunnel count`), then the ceiling (`cost_ceiling AbsoluteCost
+cost must be >= 0 (got <c>)`, `cost_ceiling CostStretch factor must be >= 1 (got <n>/<d>)`), then
+`min_unreserved_bandwidth must be an integer in [0, 2^62)`; `edge_weights`' length and entries
+(`edge_weights: expected <E> entries`, `edge_weights[<i>] must be an integer in [0, 2^62)`).
+Then `source_weights`: its length against the graph's node count
+(`source_weights: expected <N> entries`), then every entry in node id order
+(`source_weights[<i>] must be an integer in [0, 2^62)`). Each weight is bounded; their sum may
+exceed 64 bits.
+
+**`FlowPolicy` construction**, in this order:
+
+1. the endpoint sets (empty, out of range, the lowest node in both);
+2. the graph of each object the policy is given: the `Eligibility` (`foreign Eligibility: built
+   for another graph`), the program (`program belongs to another graph`), the support (`support
+   belongs to another graph`, with or without a tunnel count, an empty support included), the
+   `ShortestPathCache` (`foreign ShortestPathCache: bound to another graph`), the black holes
+   (`black_holes belongs to another graph`);
+3. the model matrix and the models' fields above;
+4. the tunnel limit (T1, T2: the roster's heads times the tunnel count, for "up to" the largest
+   count, is at most 2^30 - 1: `tunnel limit exceeded: <H> heads x <N> tunnels > 1073741823`; no
+   tunnel is made at construction);
+5. `Pinned`'s endpoints (`program endpoints do not match policy endpoints`; any number of each).
+
+**Calls.**
+
+- `evaluate` and `replace` check the offer (`offer must be an integer in [0, 2^62) or permitted
+  +inf`), then a Lossy `+inf` (`LOSSY forwarding requires a finite offer`), then the design
+  demand: the routing (`<model> does not accept design_demand`, the model `ShortestPaths`,
+  `CentralizedTE` or `Pinned`), its domain (`design_demand must be an integer in [0, 2^62) or
+  permitted +inf`), its finiteness for T1 (`DistributedTE requires a finite design demand`, also
+  for an infinite offer without a design).
+- `forward` checks, in order: `Pinned forwards with replace`; the offer; a Lossy `+inf`
+  (`LOSSY forwarding requires a finite offer`, as for `evaluate`, `replace` and Lossy `Pinned`);
+  the black holes' type and graph (`black_holes belongs to another graph`); then, under the ledger
+  gate, `forward requires an installed program` (also after `remove()`).
+- `place`'s checks are in [the placement call](#the-placement-call), and a list's in
+  [several demands at once](#several-demands-at-once).
+
+## 8. Failures, threads and lifetimes
+
+**In plain words.** A call either does everything or changes nothing: if it fails, for any
+reason, every ledger, policy and cache is as it was and you get one exception. There are two
+stated exceptions to this, described below. Immutable values can be shared freely between
+threads. Calls on one ledger serialize; different ledgers run in parallel. Cache leases serialize
+building calls and admit frozen readers together.
+
+**Exact rules.**
+
+- **All or nothing.** A failure anywhere in a public call (validation, memory allocation, a
+  worker thread, the construction of the Python result) leaves every ledger, policy, cache and
+  internal buffer as it was before the call and raises one exception in the caller's thread.
+  Worker threads are always joined first; an exception never escapes a worker. When several pairs
+  or candidates of an evaluator fail, the exception of the lowest index is raised.
+- **Limit 1: pybind11's own object machinery.** Constructing a bound object from Python (any of
+  the library's classes), parsing the arguments of a call that passes keywords, and converting the
+  result of a method into a new Python object outside the library's checked construction (for
+  example `PredecessorDAG.from_csr`, `Graph.eligibility`) use pybind11's own allocation paths,
+  which do not all check for failure. A memory failure at exactly that point may crash the process
+  instead of raising. Library state is never left half-changed by it. The results of `spf`, `ksp`,
+  `resolve_to_paths`, `ForwardingProgram.from_routes` and `from_dag`, `FlowPolicy.place`,
+  `evaluate`, `replace` and `forward`, `apply_actions`, `evaluate_demand`, `evaluate_pairs` and
+  `evaluate_edge_failures` are built through a checked path and stay inside the guarantee, and so
+  is every read of a field or property and every `repr` of the library's values (the configuration
+  values and their enumerations, `FlowPolicy.config`, `program`, `plan`, `by_source`, `by_tunnel`,
+  `tunnels`, `termination`, a tunnel's `status`, a record's `route`, `SensitivityResult.baseline`
+  and `entries`, among others), and `records()` and `record()` of a policy and a ledger,
+  `FlowLedger.graph` and `Eligibility.intersect`.
+- **Limit 2: a `ShortestPathCache` passed to the call.** A building cache is a memo: when a call fails
+  after some cache lookups succeeded (a policy constructor failing after its lookup, an evaluator
+  failing midway), the cache keeps those complete entries and their statistics. It never holds a
+  partial entry, every value it handed out stays valid, and a kept entry never changes any later
+  result. A failed lookup counts one miss. A frozen cache never changes its entries; a failed
+  call changes none of its statistics, except one miss when the call raised `ShortestPathCacheMiss`.
+- **Threads and the GIL.** Each ledger has one native gate protecting its projections and every
+  bound policy, including reads, lists, removal and policy destruction. Calls on one ledger take
+  effect one at a time; different ledgers can compute in parallel. Native work releases the GIL,
+  including policy calls, searches, factories and array conversions. Immutable reads keep the GIL
+  and take no gate: graph, mask, route, program, configuration and result fields, `policy.config`,
+  cache `graph_uid()` and `stats()`. Each statistics field is read atomically, without promising a
+  consistent snapshot of all fields.
+- **Python and the native locks.** Python conversions and callbacks (an argument's `__index__`,
+  `__eq__`, `__hash__`, `repr`) run with no native lock held. Waiting for a ledger gate or a cache
+  lease releases the GIL, or detaches the thread state on free-threaded Python. Native checks that
+  grow with the input release the GIL too: the tunnel-limit roster search of policy construction and
+  of the evaluators (once per pair of `evaluate_pairs`), and `from_routes`' walk of each supplied
+  `PredecessorDAG`. A call takes at most one cache lease, then the ledger gate.
+- **Results and publication.** A call that publishes (a scalar call, a list, an evaluator, a
+  policy's construction) builds every Python result object it returns before it changes
+  anything, so a failure there (`MemoryError`) never leaves a published change behind. A call that
+  publishes nothing (a read, a search, a factory) builds its result after releasing every lock,
+  from a copy it owns.
+- **Validation passes.** In the documented validation order, all argument and immutable checks
+  precede all mutable-state checks. Thus an invalid offer or foreign black holes precede
+  `forward requires an installed program`; a later invalid list action precedes an earlier
+  action's epoch error. Installed programs, finite `place` calls after infinity, requested limits,
+  cache mode, ledger usability and identity availability are checked under the gate or lease,
+  in their documented order, action by action. No list action computes before both passes finish.
+- **Free-threaded Python.** The cp314t build follows the same concurrency rules. It detaches its
+  Python thread state before waiting for a gate or lease. A call still converts its arguments and
+  copies every borrowed array before taking any lock; changing an argument object from another
+  thread while a call converts it is the caller's race.
+- **Lifetimes.** The graph outlives the ledger, the ledger outlives its policies; Python keeps
+  the graph, ledger, Eligibility and cache alive while a policy needs them.
+- **Immutable values.** The configuration values (`FlowPolicyConfig`, the four models,
+  `TunnelCount`, `AbsoluteCost`, `CostStretch`, `OutputOptions`, `EvaluationOptions`,
+  `RouteDefinition`), the search options (`SpfOptions`, `KspOptions`) and the actions of a list
+  (`Place`, `Replace`, `Forward`) have read-only fields: no option object changes after it is
+  built. A policy validates its configuration once and keeps that snapshot (`policy.config`); an
+  evaluator validates and copies its options at call entry, and `apply_actions` its actions.
+```python
+g = graph(4, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 2, 1), (2, 3, 2, 1)])
+ledger = ngc.FlowLedger(g)
+pol = ngc.FlowPolicy(ledger, 0, 3, config(ngc.ShortestPaths()))
+print(pol.place(float("inf")).call_delivered)
+try:
+    pol.place(1)          # a finite offer after +inf in the same epoch
+except ValueError:
+    print("ValueError; unchanged:", pol.delivered(), ledger.carried().tolist())
+```
+
+```text
+5
+ValueError; unchanged: 5 [3, 2, 3, 2]
+```
+
+### Exception classes
+
+One rule for the class of an input error, at every public entry (constructors, search options,
+call arguments, evaluator options): a Python type the position never takes is a `TypeError`; an
+accepted type whose value is outside its domain is a `ValueError`. The text is the same either
+way; a text that covers both causes (`offer must be an integer in [0, 2^62) or permitted +inf`,
+`a FlowId is a tuple (ledger uid, id)`, `each pair must be (sources, destinations)`) takes the
+class of its cause.
+
+| Position | Takes | `TypeError` | `ValueError` |
+| --- | --- | --- | --- |
+| an integer (a count, a node or edge id, an entry of an edge array, a FlowId part, `as_float`'s amounts) | any object with `__index__`, read exactly; a NumPy integer; an `int` at or above `2^63` is an integer | a bool (Python's or `numpy.bool_`); a float, `k=1.0` and `k=float('inf')` included; a string; `None` where none is allowed; an object of another class | out of range; beyond 64 bits where the range is bounded |
+| an offer, a design demand | an integer, or `float('inf')` where the call allows it | a bool, a string, `None` where one is required, another non-number | a finite float, NaN, `-inf`, an integer out of range, `+inf` where the call refuses it (an evaluator's `offer`) |
+| a non-integer number: a `resolution` (`Graph`, `to_units`, `as_float`) and `to_units`' values | exactly an `int` (not a bool), a `float`, a NumPy integer or floating scalar, an `int` or `float` subclass by its value (never through its own `__int__`, `__float__` or `__array__`); for `to_units` also an array of an integer or floating dtype or a sequence of those scalars | a `Decimal`, a `Fraction`, an object known by `__float__`, `__index__` or `__array__`, a 0-d array as a resolution; a bool entry beside numbers in `to_units` (NumPy would read it as a number; an all-bool sequence keeps its dtype text) | NaN, an infinity, a negative amount, a result at or above `2^62` units, a resolution that is not a power of two in `[2^-32, 2^32]` (an integer beyond the float range included: `resolution must be a power of two in [2^-32, 2^32]`), an integer too large for NumPy beside numbers |
+| a bool field or option | a `bool` or a `numpy.bool_` | anything else | - |
+| a vector | a 1-D sequence or NumPy array of integers | a non-sequence, a string, a nested entry, a NumPy array of another rank or of a non-integer dtype, an entry of a wrong type | a wrong length, an entry out of range |
+| a `fractions.Fraction` | only by `CostStretch` ([cost ceilings](#cost-ceilings-and-the-exact-stretch)) | everywhere else | - |
+
+The other classes:
+
+- `ValueError` also for an invalid combination, a foreign object (a value of another graph,
+  ledger or policy) or a call in the wrong state.
+- `TypeError` also for a field or option that does not exist (for example
+  `ShortestPaths(tunnel_count=ngc.TunnelCount(2))`), a missing required argument, an argument
+  that cannot be converted to its parameter's type, a bool field given anything but a `bool` or
+  `numpy.bool_`, and an integer field or `edge_weights` of a configuration value given a
+  non-integer.
+- Every converted value passes on unchanged any exception raised by the value's own conversion
+  (its `__float__` or `__index__`), whatever its class.
+- `ShortestPathCacheMiss` for a miss in a frozen cache (its own class, neither a `ValueError` nor
+  a `RuntimeError`); `MemoryError` for an allocation failure (everything rolled back);
+  `RuntimeError` for an internal invariant failure and for an exhausted identity counter.
+
+### Limits that refuse a call
+
+Each of these raises before anything changes.
+
+| Limit | What it counts | Error |
+| --- | --- | --- |
+| a flow solve (`CentralizedTE` routing, the `OPTIMIZED` allocation and the evaluators that use them) | at most `INT32_MAX - 2` nodes, and at most `2^30 - 1` edges, sources and destinations together. A `CentralizedTE` solve counts the graph's nodes, the eligible edges, the roster sources and the eligible destinations; a `ShortestPaths` `OPTIMIZED` solve counts the nodes of its route's edges and endpoints, those edges, its sources and its destinations | `ValueError('flow solver node limit exceeded')`, `ValueError('flow solver arc limit exceeded')` |
+| a `LOSSY` forwarding | each at most `2^31 - 1`, checked in this order: `entry` (the forwarded program entries), `occurrence` (every link visit of every entry: a tunnel's path length, a split route's member links), `router` (the routers of split routes), `event` (the links that can drop plus the routers, counted on the actual traffic, each demand's stopped at its own black holes) and `dependency` (the arcs between events). A list of several demands counts its one joint network, every participant together | `ValueError('forwarding <counter> limit exceeded: <n> > 2147483647')` with the exact count `<n>` |
+| cumulative counters (requests, `offered`, drops) | below `2^127` ([section 1](#the-conversion-exactly)) | `ValueError('<counter> limit exceeded')` |
+| policy identifiers of a ledger | at most `2^63 - 1` | `RuntimeError('policy identity limit exceeded')` |
+| FlowId counters of a ledger | at most `2^63 - 1`; a publication's new records counted together, a list's included | `RuntimeError('record identity limit exceeded')` |
+| identities of graphs, ledgers and masks in the process | at most `2^63 - 1` (0, the all-allowed mask's, is never issued) | `RuntimeError('object identity limit exceeded')` |
+
+Only graphs of billions of nodes or about a billion edges reach the flow-solve limits.
+
+## 9. The shortest-path cache
+
+**In plain words.** Many placements need the same static shortest-path DAG toward the same
+destinations. A `ShortestPathCache` remembers those DAGs for one graph. It stores the full DAG and
+applies each caller's route choice afterwards, so one entry serves every route choice. A cache is either
+building (one writer adds entries) or frozen (read-only, shared by many threads, and a miss is an
+error).
+
+**Exact rules.**
+
+- **Binding and key.** `ShortestPathCache(graph)` is bound to one graph (`graph_uid()`). The key is
+  `(the root set as a sorted set, the direction, the Eligibility uid)`. The value is the full
+  static shortest-path DAG: the DAG of every equal-cost walk (`multipath=True`,
+  `parallel_edges=True`) with no residual, edges of capacity 0 included. Values are
+  immutable and stay valid after `clear()` and after the cache is destroyed.
+- **The route choice is never cached.** The single path and the member rule are applied when a
+  program is prepared, on the cached DAG, reading the scores of `HIGHER_AVAILABLE_CAPACITY` and
+  `HIGHER_HEADROOM` from the residual at that moment and `HIGHER_CAPACITY` from static capacities.
+  Because the cached DAG keeps every equal-cost parallel member, a member that a static choice
+  would have dropped is still available when its residual makes it the right one.
+- **Who reads it.** `ShortestPaths` policy construction reads the cache (keyed by its destination
+  set, reverse direction, and Eligibility uid) and retains the support DAG. Later scalar calls and
+  lists use that retained support without a cache lease. The evaluators read their supplied cache
+  when they run a `ShortestPaths` configuration. The other models do not read it and reject a
+  supplied cache (`ValueError`, for example `CentralizedTE does not use ShortestPathCache`), as the
+  last check of the model matrix.
+
+| Operation | Building | Frozen |
+| --- | --- | --- |
+| lookup hit | returns the value | returns the value; safe from many threads |
+| lookup miss | searches, inserts, returns | raises `ShortestPathCacheMiss` |
+| `freeze()` | becomes frozen | no effect |
+| `clear()` | empties the cache; hit and miss counters persist | `ValueError` |
+| `thaw()` | no effect | waits for active calls, then becomes building |
+| destruction | callers keep it alive during calls | callers keep it alive during calls; returned values stay valid |
+
+- **Leases.** Each building call owns one exclusive lease for its whole computation; frozen
+  calls own shared leases. `freeze()`, `thaw()` and `clear()` take exclusive admission and wait
+  for active calls. Admission is FIFO: a queued lifecycle call cannot be overtaken by later
+  builders or readers. Evaluator workers borrow their outer call's lease and never acquire it
+  again. The cache lease precedes any ledger gate.
+- **Statistics.** `stats()` returns `hits`, `misses`, `entries`, `bytes` (the entries' retained
+  arrays, without container overhead) and `live_values` (values alive anywhere, cache entries
+  included). Each field is atomic; together they are not one consistent snapshot. An invalid
+  query (foreign graph, bad root) counts nothing. A frozen cache's statistics follow the public
+  call: its hits count only when the call succeeds, its Python result included; a failed call
+  changes no statistic, except one miss for a call that raises `ShortestPathCacheMiss`.
+- **Workers.** A supplied building cache is accepted only with `workers == 1` (`ValueError`
+  otherwise). A frozen cache may be shared by every worker. Without a supplied cache, each
+  worker uses its own private building cache.
+- **Uids and frozen caches.** A per-pair Eligibility that the evaluator must intersect with a
+  common one gets a new uid when the result differs from both, and that key cannot be in a
+  frozen cache. To reuse prefilled entries, pass already-combined per-pair values with
+  `eligibility=None`, or a common value that contains them (so the intersection returns the
+  prefilled operand).
+- **Scope.** Use one cache per series of analyses on one graph, and drop it at the end of the
+  series.
+
+```python
+g = graph(5, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 2, 1), (2, 3, 2, 1), (3, 4, 9, 1)])
+cache = ngc.ShortestPathCache(g)
+opts = ngc.EvaluationOptions(config(ngc.ShortestPaths()), cache=cache)
+rs = ngc.evaluate_pairs(g, [(0, 3), (1, 3)], opts)          # building: workers defaults to 1
+print([r.call_delivered for r in rs], cache.stats().hits, cache.stats().misses)
+cache.freeze()
+rs = ngc.evaluate_pairs(g, [(0, 3), (1, 3)], opts, workers=2)  # frozen: shared by 2 workers
+print([r.call_delivered for r in rs], cache.stats().hits, cache.stats().misses)
+try:
+    ngc.evaluate_demand(g, 0, 4, opts)                # destination 4: not in the cache
+except ngc.ShortestPathCacheMiss:
+    print("ShortestPathCacheMiss; misses =", cache.stats().misses)
+```
+
+```text
+[5, 10] 1 1
+[5, 10] 3 1
+ShortestPathCacheMiss; misses = 2
+```
+
+Both pairs go to destination 3, so they read one key (destination 3, reverse search, the
+all-allowed Eligibility). Building, the first pair misses and fills it and the second hits: 1 hit,
+1 miss. Frozen, both pairs hit: 3 hits. Destination 4 has no entry, so the frozen cache raises and
+counts one more miss.
+
+## 10. Evaluators
+
+**In plain words.** The evaluators answer questions about a model without touching your ledgers.
+`evaluate_demand` asks how much one model carries between two node sets on a fresh, empty ledger,
+either as much as possible or at a given offer. `evaluate_pairs` asks that for many independent
+pairs. `evaluate_edge_failures` asks, for each link, how much the answer drops when that link is
+removed, at the same offer. A fresh ledger means these answers can differ from placing into a
+ledger that other demands already occupy: to ask about a loaded network, use `FlowPolicy.evaluate`
+on a ledger with that load.
+
+**Exact rules.**
+
+- **`EvaluationOptions(config, *, eligibility=None, cache=None, outputs=None, design_demand=None,
+  offer=None)`** is the one options type of the three evaluators: the configuration, the static
+  Eligibility (`None`: everything allowed), the `ShortestPathCache` (`None`: a private cache per
+  worker), the optional outputs of each result (`evaluate_edge_failures`: of its baseline), the
+  tunnel models' design (`design_demand`) and the `offer`. The design and the offer are kept as
+  given (an `int` or a float; another type, a `bool` or a string, raises `TypeError` at
+  construction); the evaluator checks them.
+- **A finite offer for every model.** `offer`, when given, is a finite integer in `[0, 2^62)` for
+  every model under each admission it supports, in all three evaluators: the offer of every pair,
+  of the baseline and of every failed network. Each evaluation computes the same amounts as a
+  fresh policy's `evaluate(offer, design_demand=...)`: Lossless delivers up to the offer, Lossy
+  accounts for exactly that offer. An absent offer is the uncapped Lossless question or, only for
+  `ShortestPaths` `EQUAL`/`WEIGHTED` with Lossy, the first-hop experiment.
+
+  | Model | Lossless | Lossy |
+  | --- | --- | --- |
+  | `ShortestPaths` `EQUAL` / `WEIGHTED` | `offer` `None`: the uncapped bound; finite: delivery up to it | `offer` finite: that offer; `None`: the first-hop experiment |
+  | `ShortestPaths` `OPTIMIZED`, `CentralizedTE` without a tunnel count | `offer` `None`: the uncapped optimum; finite: the optimum up to it | refused by the matrix |
+  | T1 | `design_demand` required and finite; `offer` `None`: the lossless bound of those tunnels; finite: up to it | `design_demand` required and finite; `offer` required |
+  | T2 | `design_demand` `None`: the offer if it is finite, else unlimited; `offer` `None`: the bound at that design | `offer` finite; `None`: the design if finite, else an error |
+  | `Pinned` | `offer` `None`: the fixed-program bound; finite: up to it | `offer` required |
+
+- **Validation order** (before any worker starts): the policy's construction checks (the
+  configuration, [section 7](#configuration)); then an explicitly given offer (`offer must be an
+  integer in [0, 2^62)`, an explicit `float('inf')` included); then the design: only T1 and T2
+  take one (`<model> does not accept design_demand`, checked before its range), in `[0, 2^62)` or
+  `float('inf')` (`design_demand must be an integer in [0, 2^62) or permitted +inf`), T1's finite
+  (`DistributedTE requires a finite design demand`); then T1's missing design (`DistributedTE
+  evaluation requires design_demand`); then the missing Lossy offer (`DistributedTE LOSSY
+  evaluation requires a finite offer`, `Pinned LOSSY evaluation requires a finite offer`, and
+  `CentralizedTE LOSSY evaluation requires a finite offer` for T2 when no finite design gives one).
+  The model in these texts is the class name, T2 included.
+- **`evaluate_demand(graph, sources, destinations, options)`** evaluates a `FlowPolicy` with
+  `options.config` on a fresh ledger of the graph and returns its `PlacementResult`; it commits
+  nothing anywhere. Without an offer (the uncapped question) the configuration
+  `CentralizedTE(source_allocation=OPTIMIZED)` gives the exact maximum flow: its result carries the
+  marginal cost curve and, with `OutputOptions(min_cut=True)`, the minimum cut. A finite offer
+  below the maximum stops the solve there, with no cut ([the result](#the-result)). With `EQUAL`
+  source allocation it is the largest total whose equal shares all fit.
+- **`evaluate_pairs(graph, pairs, options, per_pair_eligibility=None, workers=None)`** runs
+  `evaluate_demand` for each `(sources, destinations)` pair and returns the results in pair order.
+  Nothing is shared between pairs (no reservations, no capacity): the results are independent
+  capacities, not allocations that coexist; demands that share capacity are policies on one ledger.
+  Pair `i` uses `options.eligibility` intersected with `per_pair_eligibility[i]` (entries may be
+  `None`; a given list has one entry per pair). All checks finish before evaluation workers start:
+  first the arguments (the worker count, the graph of `options.eligibility` and of the cache,
+  `Pinned`, which is rejected because a program fixes its endpoints (`evaluate_pairs does not accept
+  Pinned`), the configuration, the offer and design rules above, then the length of
+  `per_pair_eligibility`), then each pair completely (its endpoint sets, their overlap, its
+  Eligibility's graph, the pooled single-path rule of [section 7](#configuration), T2's
+  several-sources rule and, for the tunnel models, the tunnel limit for its sources) in pair order,
+  so the error of the lowest failing pair is the one raised. A supplied building cache's `workers ==
+  1` rule reads the cache's mode and comes last, under the cache's lease. An empty batch returns
+  `[]`.
+- **`evaluate_edge_failures(graph, sources, destinations, options, workers=None)`** returns a
+  `SensitivityResult`: `baseline` (the result of `evaluate_demand`, with the requested outputs)
+  and `entries`, one `SensitivityEntry(edge, delivery_reduction)` per candidate edge, in ascending
+  EdgeId.
+  - **Candidates.** The edges that get an entry depend on the configuration; an edge without an
+    entry has reduction 0:
+
+    | Configuration | Edges with an entry |
+    | --- | --- |
+    | unrestricted `CentralizedTE` with `OPTIMIZED` sources | the edges that carry flow in the baseline: removing any other edge keeps the baseline feasible, so the delivery stays, at any offer |
+    | every other configuration (`EQUAL` or `WEIGHTED` sources, a support, `ShortestPaths`, T1, T2, `Pinned`) | every allowed edge, whatever its capacity: an edge of capacity 0 can carry a route and keep a source in the roster, so deleting it can change the result either way. `ShortestPaths` gives an edge outside the static shortest-path support reachable from the roster sources reduction 0 without recomputing (no route can use it) |
+
+  - **`delivery_reduction`** is `baseline.delivered` minus the delivery of a fresh
+    `evaluate_demand` with that edge also excluded, at the same offer, design and other options,
+    in units, signed and never rounded or thresholded. It is not the traffic the deleted edge
+    carried. A negative value means the model carries more without the edge (for example, equal
+    splitting no longer sends a share down a thin path, or a source behind it no longer holds the
+    equal allocation back). The test suite compares every reduction of the optimized controller
+    with such a fresh evaluation, on small networks whose expected values are written out in the
+    tests.
+  - **Each deletion.** T1 sets up again for the same design under each deletion; T2 redoes its
+    sizing, count choice and objectives, on the same supplied support when there is one.
+    `CentralizedTE` with a support solves each deletion afresh. `Pinned` replays the same program
+    under each deletion (a repaired fixed-route question, not a new optimum and not stale
+    forwarding): deleting an edge of a tunnel fails that tunnel.
+  - **Cache.** Each deletion uses a new Eligibility uid, so a `ShortestPaths` deletion that has to
+    be placed raises `ShortestPathCacheMiss` through a frozen cache. The other models reject a
+    supplied cache. Private caches are cleared between candidates.
+- **Workers.** An explicit `workers` (an integer of at least 1) is always honoured; the
+  evaluator uses at most one thread per pair or candidate. With `workers=None` the default is 1
+  when a cache is supplied, and otherwise comes from the environment:
+
+  | Variable | Default worker count of | Accepted values |
+  | --- | --- | --- |
+  | `NGRAPH_CORE_BATCH_THREADS` | `evaluate_pairs` | an integer in `[1, 4096]`; unset or anything else means 1 |
+  | `NGRAPH_CORE_SENSITIVITY_THREADS` | `evaluate_edge_failures` | the same |
+
+  The variables only supply defaults; they never override an explicit `workers`. The C++
+  functions take the worker count as an explicit argument.
+- **Failures** follow [section 8](#8-failures-threads-and-lifetimes): a failed evaluator call raises
+  (also a solve beyond the flow core's size limits of [section 8](#limits-that-refuse-a-call), with
+  `CentralizedTE` or `OPTIMIZED`), and a failed deletion fails the whole call (the exception of the
+  lowest failing candidate; no entry is returned); a supplied building cache keeps the entries of
+  the lookups that succeeded before the failure; a supplied frozen cache's statistics are unchanged,
+  except one miss when the call raises `ShortestPathCacheMiss`.
+
+```python
+g = graph(4, [(0, 1, 10, 1), (1, 3, 10, 1), (0, 2, 2, 1), (2, 3, 2, 1)])
+for name, cfg in (("ShortestPaths", config(ngc.ShortestPaths())),
+                  ("CentralizedTE", ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)))):
+    s = ngc.evaluate_edge_failures(g, 0, 3, ngc.EvaluationOptions(cfg))
+    print(name, s.baseline.call_delivered, [(e.edge, e.delivery_reduction) for e in s.entries])
+```
+
+```text
+ShortestPaths 5 [(0, 3), (1, -5), (2, 3), (3, -5)]
+CentralizedTE 12 [(0, 10), (1, 2), (2, 10), (3, 2)]
+```
+
+Under equal splitting the thin path (edges 1 and 3) holds the whole diamond back to 5 units;
+without it the wide path alone carries 10, a reduction of -5.
+
+A failure study at a fixed offer, against the [first-hop
+experiment](#5-route-allocations-and-admission): two parallel links, ECMP, Lossy. On links of 10 and
+10, an offer of 4 is delivered by every network; without an offer the experiment injects each
+remaining link's capacity, 20 before a deletion and 10 after, a different question. On links of 4
+and 10 without an offer, the experiment delivers 14 and the deletions leave 10 or 4: reductions 4
+and 10. With an offer of 12 each link is offered 6, the 4-unit link drops 2 and the baseline
+delivers 10; the deletions deliver 10 and 4: reductions 0 and 6:
+
+```python
+lossy = config(ngc.ShortestPaths(), admission=ngc.Admission.LOSSY)
+for capacities, offers in (((10, 10), (4, None)), ((4, 10), (None, 12))):
+    g = graph(2, [(0, 1, c, 1) for c in capacities])
+    for offer in offers:
+        s = ngc.evaluate_edge_failures(g, 0, 1, ngc.EvaluationOptions(lossy, offer=offer))
+        print(capacities, offer, s.baseline.call_delivered, [e.delivery_reduction for e in s.entries])
+try:
+    ngc.evaluate_demand(g, 0, 1, ngc.EvaluationOptions(lossy, offer=float("inf")))
+except ValueError as error:
+    print(error)
+```
+
+```text
+(10, 10) 4 4 [0, 0]
+(10, 10) None 20 [10, 10]
+(4, 10) None 14 [4, 10]
+(4, 10) 12 10 [0, 6]
+offer must be an integer in [0, 2^62)
+```
+
+### Limits
+
+- **One route allocation per program.** A program applies one route allocation at every router.
+  Weighted ingress above routers that should split equally is expressible exactly when every
+  member of those downstream equal splits has positive static capacity: give each member of such a
+  split the same positive `EXPLICIT` weight, since `H(x, [w] * k) = RR(x, k)` for any positive `w`.
+  A downstream equal split with a zero-capacity member differs (`WEIGHTED` prunes that member,
+  `EQUAL` keeps it) and is not expressible.
+- **Certificates and exports.** The public optimality certificates are `min_cut` and
+  `marginal_cost_curve` of unrestricted optimized `CentralizedTE`. A program has no serialized
+  form for moving it between processes, and its per-router tables are not exported.
+- **Not modelled:** traffic classes and priority queues, RSVP setup and holding priorities and
+  preemption, bandwidth policing, automatically disjoint or SRLG-diverse tunnels, a stretch
+  baseline per head inside one pooled T1 demand, growth of a tunnel count over time, and a joint
+  optimum or joint bound over several demands. Per-pair offers, designs or configurations are
+  separate `evaluate_demand` calls, and a study of the three failure states is a loop of the
+  caller's.
+
+## 11. C++ names
+
+The C++ library (namespace `netgraph::core`) has the same semantics. Its public headers are
+self-contained:
+
+| Header | Declares |
+| --- | --- |
+| `netgraph/core/types.hpp` | `NodeId`, `EdgeId` (`int32`), the cost and amount aliases (`int64`), `kDomainLimit` (`2^62`), `kUnreachable` |
+| `netgraph/core/graph.hpp` | `Graph`, `to_units`, `as_float` |
+| `netgraph/core/eligibility.hpp` | `Eligibility` (`allows_node`, `allows_edge`) |
+| `netgraph/core/route_structures.hpp` | `PredecessorDAG`, `Path` |
+| `netgraph/core/options.hpp` | `Direction`, `AbsoluteCost`, `CostStretch`, `RouteTieBreak`, `RouteAllocation`, `WeightBasis`, `Admission`, `SourceAllocation` |
+| `netgraph/core/forwarding_program.hpp` | `ForwardingProgram` (`from_routes`, `from_dag`), `Tunnel`, `TunnelStatus`, `RouteDefinition`, `RouteOptions` (the options of `from_routes` and `from_dag`) |
+| `netgraph/core/search.hpp` | `spf`, `ksp`, `resolve_to_paths`, `SpfOptions`, `SpfResult`, `KspOptions`, `SpfQueue` |
+| `netgraph/core/flow_record.hpp` | `FlowId`, `Counter128` (the 128-bit cumulative counter), `FlowRecord` |
+| `netgraph/core/flow_ledger.hpp` | `FlowLedger` |
+| `netgraph/core/flow_policy.hpp` | `FlowPolicy`, its configuration (`FlowPolicyConfig`, `ShortestPaths`, `DistributedTE`, `CentralizedTE`, `Pinned`, `TunnelCount`, `OutputOptions`) and result types (`PlacementResult`, `SourceFlow`, `TunnelFlow`, `TunnelPlan`), `Termination`; the lists: `apply_actions`, `BatchMode`, `Place`, `Replace`, `Forward`, `Action` |
+| `netgraph/core/shortest_path_cache.hpp` | `ShortestPathCache`, `ShortestPathCacheMiss` |
+| `netgraph/core/evaluators.hpp` | `evaluate_demand`, `evaluate_pairs`, `evaluate_edge_failures`, `EvaluationOptions`, `SensitivityEntry`, `SensitivityResult` |
+
+Spelling differences: Python enum members and constants are upper case
+(`RouteTieBreak.FEWER_HOPS`, `UNREACHABLE`), C++ enumerators are the same words in PascalCase
+(`RouteTieBreak::FewerHops`, `RouteAllocation::Optimized`) and C++ constants carry a `k` prefix
+(`kUnreachable`). Where Python returns `None` for an unreachable cost (`target_cost`,
+`min_route_cost`), C++ returns `kUnreachable`; an infinite offer is an empty `std::optional`, and
+its `call_undelivered` and `requested` are empty too. An optional field that Python reports as
+`None` (`ShortestPaths`' `source_allocation` and `weight_basis` before resolution, `offered`,
+`unadmitted`, `total_cost`, `marginal_cost_curve`, `plan` and T2's fields of a `TunnelPlan`,
+`CentralizedTE`'s `tunnel_count`, `FlowRecord.entry_id`, a down tunnel's `destination`, `edges`
+and `path_cost`, the optional outputs) is an empty `std::optional` in C++;
+`max_fractional_bandwidth_per_tunnel` is a reduced `(numerator, denominator)` pair,
+`total_tunnel_cost` and `headroom_penalty` are `Counter128`; `CostStretch` is constructed from a
+numerator and a denominator (reduced on construction, `numerator()` and `denominator()`); a
+`design_demand` or an evaluator's `offer` is a `std::optional<std::optional<Amount>>`, absent for
+`None` and an empty inner value for `float('inf')`; and a `None` program, support or black holes
+a null `std::shared_ptr` (`edge_weights` and `source_weights` are shared arrays, `std::shared_ptr<const
+std::vector<Amount>>`). `CentralizedTE` has no default constructor: it is built from its
+`SourceAllocation`. The epoch's amounts are `Counter128` values. A Python `ValueError` is a
+`std::invalid_argument` in C++. `spf` takes a trailing C++-only `SpfQueue` argument that chooses
+the search's internal queue; the results never depend on it. `apply_actions` takes a
+`std::span<const Action>`, where `Action` is a `std::variant<Place, Replace, Forward>` whose
+values borrow their policy (a `std::reference_wrapper<FlowPolicy>`) and black holes (a `const
+Eligibility*`, null for none), which must outlive the call.
diff --git a/include/netgraph/core/algorithms.hpp b/include/netgraph/core/algorithms.hpp
deleted file mode 100644
index 0f22bfd..0000000
--- a/include/netgraph/core/algorithms.hpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/* Algorithms façade that forwards to a selected Backend implementation. */
-#pragma once
-
-#include <memory>
-
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/options.hpp"
-
-namespace netgraph::core {
-
-class Algorithms {
-public:
-  explicit Algorithms(BackendPtr backend) : backend_(std::move(backend)) {}
-
-  [[nodiscard]] GraphHandle build_graph(const StrictMultiDiGraph& g) const {
-    return backend_->build_graph(g);
-  }
-
-  [[nodiscard]] std::pair<std::vector<Cost>, PredDAG>
-  spf(const GraphHandle& gh, NodeId src, const SpfOptions& opts) const {
-    return backend_->spf(gh, src, opts);
-  }
-
-  [[nodiscard]] std::pair<std::vector<Cost>, PredDAG>
-  spf_to(const GraphHandle& gh, NodeId dst, const SpfToOptions& opts) const {
-    return backend_->spf_to(gh, dst, opts);
-  }
-
-  [[nodiscard]] std::vector<std::pair<std::vector<Cost>, PredDAG>>
-  ksp(const GraphHandle& gh, NodeId src, NodeId dst, const KspOptions& opts) const {
-    return backend_->ksp(gh, src, dst, opts);
-  }
-
-  [[nodiscard]] std::pair<Flow, FlowSummary>
-  max_flow(const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) const {
-    return backend_->max_flow(gh, src, dst, opts);
-  }
-
-  [[nodiscard]] std::vector<FlowSummary>
-  batch_max_flow(const GraphHandle& gh,
-                 const std::vector<std::pair<NodeId,NodeId>>& pairs,
-                 const MaxFlowOptions& opts,
-                 const std::vector<std::span<const bool>>& node_masks = {},
-                 const std::vector<std::span<const bool>>& edge_masks = {}) const {
-    return backend_->batch_max_flow(gh, pairs, opts, node_masks, edge_masks);
-  }
-
-  [[nodiscard]] std::vector<std::pair<EdgeId, Flow>>
-  sensitivity_analysis(const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) const {
-    return backend_->sensitivity_analysis(gh, src, dst, opts);
-  }
-
-private:
-  BackendPtr backend_;
-};
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/backend.hpp b/include/netgraph/core/backend.hpp
deleted file mode 100644
index 724de2b..0000000
--- a/include/netgraph/core/backend.hpp
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
-  Backend interface — abstracts SPF/MaxFlow/KSP implementations.
-
-  The default CPU backend delegates to in-process algorithm implementations.
-  All execution flows through this interface via an Algorithms façade.
-*/
-#pragma once
-
-#include <memory>
-#include <utility>
-#include <vector>
-#include <span>
-
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/options.hpp"
-
-namespace netgraph::core {
-
-// GraphHandle: opaque handle to a backend-owned graph.
-// Uses shared_ptr for automatic lifetime management.
-struct GraphHandle {
-  std::shared_ptr<const StrictMultiDiGraph> graph {};
-};
-
-class Backend {
-public:
-  virtual ~Backend() noexcept = default;
-
-  // Prepares a backend-specific graph handle from an existing graph reference.
-  //
-  // The CPU backend creates a non-owning shared_ptr with a no-op deleter, so the
-  // caller must keep `g` alive for as long as the handle is used. To hand the
-  // handle shared ownership instead, construct it directly: GraphHandle{my_sp}.
-  //
-  // Arguments:
-  //   g: The source graph to wrap.
-  //
-  // Returns:
-  //   A GraphHandle containing the backend-specific graph representation.
-  [[nodiscard]] virtual GraphHandle build_graph(const StrictMultiDiGraph& g) = 0;
-
-  // Computes shortest paths from a source node.
-  //
-  // Arguments:
-  //   gh: The graph handle.
-  //   src: The source node ID.
-  //   opts: Configuration options for SPF (e.g., multipath, edge selection).
-  //
-  // Returns:
-  //   A pair containing:
-  //     - A vector of costs (distances) from src to all nodes.
-  //     - A predecessor DAG encoding the shortest paths.
-  [[nodiscard]] virtual std::pair<std::vector<Cost>, PredDAG> spf(
-      const GraphHandle& gh, NodeId src, const SpfOptions& opts) = 0;
-
-  // Computes shortest paths from every node to dst (reverse SPF); see
-  // shortest_paths_to() in shortest_paths.hpp. Returns distances to dst and a
-  // forward-oriented predecessor DAG valid for placement from any node toward dst.
-  [[nodiscard]] virtual std::pair<std::vector<Cost>, PredDAG> spf_to(
-      const GraphHandle& gh, NodeId dst, const SpfToOptions& opts) = 0;
-
-  // Computes maximum flow between a source and destination node.
-  //
-  // Arguments:
-  //   gh: The graph handle.
-  //   src: The source node ID.
-  //   dst: The destination node ID.
-  //   opts: Configuration options for max flow (e.g., algorithm, capacity constraints).
-  //
-  // Returns:
-  //   A pair containing:
-  //     - The total flow amount.
-  //     - A FlowSummary struct with detailed results.
-  [[nodiscard]] virtual std::pair<Flow, FlowSummary> max_flow(
-      const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) = 0;
-
-  // Computes K-shortest paths between a source and destination node.
-  //
-  // Arguments:
-  //   gh: The graph handle.
-  //   src: The source node ID.
-  //   dst: The destination node ID.
-  //   opts: Configuration options for KSP (e.g., K, cost constraints).
-  //
-  // Returns:
-  //   A vector of pairs, each representing a path:
-  //     - A vector of costs along the path.
-  //     - A predecessor DAG representing the path.
-  [[nodiscard]] virtual std::vector<std::pair<std::vector<Cost>, PredDAG>> ksp(
-      const GraphHandle& gh, NodeId src, NodeId dst, const KspOptions& opts) = 0;
-
-  // Computes maximum flow for a batch of source-destination pairs.
-  //
-  // Arguments:
-  //   gh: The graph handle.
-  //   pairs: A vector of (source, destination) pairs.
-  //   opts: Common configuration options for all pairs.
-  //   node_masks: Optional vector of node masks, one per pair.
-  //   edge_masks: Optional vector of edge masks, one per pair.
-  //
-  // Returns:
-  //   A vector of FlowSummary structs, one for each pair.
-  [[nodiscard]] virtual std::vector<FlowSummary> batch_max_flow(
-      const GraphHandle& gh,
-      const std::vector<std::pair<NodeId,NodeId>>& pairs,
-      const MaxFlowOptions& opts,
-      const std::vector<std::span<const bool>>& node_masks = {},
-      const std::vector<std::span<const bool>>& edge_masks = {}) = 0;
-
-  // Performs sensitivity analysis to identify edges that constrain flow.
-  //
-  // Arguments:
-  //   gh: The graph handle.
-  //   src: The source node ID.
-  //   dst: The destination node ID.
-  //   opts: Configuration options.
-  //
-  // Returns:
-  //   A vector of pairs (EdgeId, FlowDelta) for edges whose removal reduces
-  //   total flow, where FlowDelta is how much flow is LOST without that edge.
-  //   This is a criticality measure, not the gain from relaxing capacity.
-  [[nodiscard]] virtual std::vector<std::pair<EdgeId, Flow>> sensitivity_analysis(
-      const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) = 0;
-};
-
-using BackendPtr = std::shared_ptr<Backend>;
-
-[[nodiscard]] BackendPtr make_cpu_backend();
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/constants.hpp b/include/netgraph/core/constants.hpp
deleted file mode 100644
index 5099619..0000000
--- a/include/netgraph/core/constants.hpp
+++ /dev/null
@@ -1,13 +0,0 @@
-/* Numeric thresholds shared by SPF and flow placement. */
-#pragma once
-
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// Global numeric thresholds used across SPF and flow placement
-inline constexpr Cap  kMinCap  = static_cast<Cap>(1.0 / 4096.0);   // minimum effective remaining capacity
-inline constexpr Flow kMinFlow = static_cast<Flow>(1.0 / 4096.0);  // minimum meaningful flow when augmenting
-inline constexpr double kEpsilon = 1e-12;                           // numeric clamp
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/detail/cache_access.hpp b/include/netgraph/core/detail/cache_access.hpp
new file mode 100644
index 0000000..255282c
--- /dev/null
+++ b/include/netgraph/core/detail/cache_access.hpp
@@ -0,0 +1,93 @@
+/* Internal access to a ShortestPathCache: its mode (the evaluators' rule for a supplied cache) and the
+   frozen statistics of one public call. */
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <span>
+#include <type_traits>
+#include <utility>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/cache_gate.hpp"
+
+namespace netgraph::core::detail {
+
+class FrozenCacheHitTally;
+
+struct DagCacheAccess {
+  // Whether the cache is frozen (a frozen cache may be shared by every worker).
+  [[nodiscard]] static bool frozen(const ShortestPathCache& cache) noexcept { return cache.gate_->frozen(); }
+  [[nodiscard]] static CacheGate& gate(ShortestPathCache& cache) noexcept { return *cache.gate_; }
+  // Only for a worker's own building cache, never a caller-supplied cache. Its
+  // owner is the sole accessing thread; no worker enrolls a lifecycle lease.
+  static void clear_private(ShortestPathCache& cache) noexcept { cache.clear_contents(); }
+  // A lookup inside a public call (FrozenCacheHitTally): a frozen hit is recorded in `tally` instead of
+  // the cache, a frozen miss is counted by the call's boundary (frozen_call); a building cache
+  // counts at once, as ShortestPathCache::lookup does.
+  [[nodiscard]] static std::shared_ptr<const PredecessorDAG> lookup(ShortestPathCache& cache, const Graph& graph,
+                                                             std::span<const NodeId> roots, Direction direction,
+                                                             const Eligibility* eligibility, FrozenCacheHitTally& tally) {
+    return cache.lookup_in_call(graph, roots, direction, eligibility, &tally);
+  }
+  static void add_hits(ShortestPathCache& cache, std::int64_t n) noexcept {
+    cache.hits_.fetch_add(n, std::memory_order_relaxed);
+  }
+  static void add_miss(ShortestPathCache& cache) noexcept { cache.misses_.fetch_add(1, std::memory_order_relaxed); }
+};
+
+// Collect one public call's frozen-cache hits here; publish them only after all fallible work,
+// succeeds. Publishing Python calls allocate their result shells before taking the lease.
+// Failure discards the hits, except that ShortestPathCacheMiss
+// records one miss regardless of its workers' lookups. A building cache keeps its statistics
+// even on failure. Workers share this call's atomic tally; separate calls have separate
+// tallies, so concurrent successful calls keep all their increments.
+class FrozenCacheHitTally {
+public:
+  explicit FrozenCacheHitTally(ShortestPathCache* cache) noexcept : cache_(cache) {}
+  FrozenCacheHitTally(const FrozenCacheHitTally&) = delete;
+  FrozenCacheHitTally& operator=(const FrozenCacheHitTally&) = delete;
+  ~FrozenCacheHitTally() = default;
+
+  [[nodiscard]] const ShortestPathCache* cache() const noexcept { return cache_; }
+  void hit() noexcept { hits_.fetch_add(1, std::memory_order_relaxed); }
+  // The call succeeded: its hits reach the cache (one atomic addition, cannot fail).
+  void publish() noexcept {
+    const auto n = hits_.exchange(0, std::memory_order_relaxed);
+    if (cache_ != nullptr && n != 0) DagCacheAccess::add_hits(*cache_, n);
+  }
+  // The call raises ShortestPathCacheMiss: one miss; its hits are dropped.
+  void miss() noexcept {
+    if (cache_ != nullptr) DagCacheAccess::add_miss(*cache_);
+  }
+
+private:
+  ShortestPathCache* cache_;
+  std::atomic<std::int64_t> hits_ {0};
+};
+
+// Runs body(tally) as one public call on `cache` (the supplied cache, or null): publishes the
+// recorded hits once the native body has returned, while its lease is still held. Python
+// result shells already exist; body fills their native values. Its return value moves without failing; when
+// body throws, nothing is published, except one miss for a ShortestPathCacheMiss.
+template <class Body>
+auto frozen_call(ShortestPathCache* cache, Body&& body) -> decltype(std::forward<Body>(body)(std::declval<FrozenCacheHitTally&>())) {
+  using Result = decltype(std::forward<Body>(body)(std::declval<FrozenCacheHitTally&>()));
+  static_assert(std::is_nothrow_move_constructible_v<Result>, "the result moves out after the publication");
+  FrozenCacheHitTally tally(cache);
+  std::optional<CacheGate::Lease> lease;
+  if (cache != nullptr) lease.emplace(DagCacheAccess::gate(*cache));
+  try {
+    Result result = std::forward<Body>(body)(tally);
+    tally.publish();
+    publication_event(ConcurrentStage::CacheTallyComplete, cache);
+    return result;
+  } catch (const ShortestPathCacheMiss&) {
+    tally.miss();
+    throw;
+  }
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/cache_gate.hpp b/include/netgraph/core/detail/cache_gate.hpp
new file mode 100644
index 0000000..ea14faa
--- /dev/null
+++ b/include/netgraph/core/detail/cache_gate.hpp
@@ -0,0 +1,108 @@
+/* FIFO admission for one cache. A call owns one shared (frozen) or exclusive (building)
+   lease; lifecycle operations always request exclusive admission. Workers borrow the call's
+   lease instead of enrolling again. No Python code belongs in this machinery. */
+#pragma once
+
+#include <condition_variable>
+#include <cstddef>
+#include <mutex>
+
+#include "netgraph/core/detail/concurrency.hpp"
+
+namespace netgraph::core::detail {
+
+class CacheGate {
+  struct Waiter {
+    Waiter* next {nullptr};
+  };
+
+public:
+  CacheGate() = default;
+  CacheGate(const CacheGate&) = delete;
+  CacheGate& operator=(const CacheGate&) = delete;
+
+  class Lease {
+  public:
+    explicit Lease(CacheGate& gate, bool lifecycle = false) : gate_(gate) {
+      Waiter waiter;
+      std::unique_lock lock(gate_.mutex_);
+      if (gate_.tail_ != nullptr) gate_.tail_->next = &waiter;
+      else gate_.head_ = &waiter;
+      gate_.tail_ = &waiter;
+      try {
+        concurrent_event(ConcurrentStage::CacheQueued, &gate_);
+        gate_.ready_.wait(lock, [&] {
+          if (gate_.head_ != &waiter || gate_.writer_) return false;
+          // The mode cannot change while a reader is active. A writer's mode change
+          // happens before it releases this same admission mutex in ~Lease().
+          return (!lifecycle && gate_.frozen_) || gate_.readers_ == 0;
+        });
+      } catch (...) {
+        // The waiting node belongs to this stack frame; it must never remain queued
+        // when wait throws. Removing it admits the next eligible prefix.
+        Waiter** link = &gate_.head_;
+        Waiter* previous = nullptr;
+        while (*link != &waiter) {
+          previous = *link;
+          link = &(*link)->next;
+        }
+        *link = waiter.next;
+        if (gate_.tail_ == &waiter) gate_.tail_ = previous;
+        gate_.ready_.notify_all();
+        throw;
+      }
+      gate_.head_ = waiter.next;
+      if (gate_.head_ == nullptr) gate_.tail_ = nullptr;
+      exclusive_ = lifecycle || !gate_.frozen_;
+      if (exclusive_) gate_.writer_ = true;
+      else ++gate_.readers_;
+      // Consecutive frozen readers may enter together; a queued lifecycle request
+      // stops that prefix and cannot be overtaken by any later reader or builder.
+      gate_.ready_.notify_all();
+      lock.unlock();
+      try {
+        concurrent_event(ConcurrentStage::CacheAcquired, &gate_);
+      } catch (...) {
+        release();
+        throw;
+      }
+    }
+    Lease(const Lease&) = delete;
+    Lease& operator=(const Lease&) = delete;
+    ~Lease() noexcept { release(); }
+
+  private:
+    void release() noexcept {
+      const std::lock_guard lock(gate_.mutex_);
+      if (exclusive_) gate_.writer_ = false;
+      else --gate_.readers_;
+      gate_.ready_.notify_all();
+    }
+
+    CacheGate& gate_;
+    bool exclusive_ {false};
+  };
+
+  // These mode accesses require the caller's lease. A shared lease permits only
+  // frozen(); setting the mode requires exclusive lifecycle admission.
+  [[nodiscard]] bool frozen() const noexcept { return frozen_; }
+  void freeze(bool frozen) noexcept { frozen_ = frozen; }
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  [[nodiscard]] bool has_waiters() {
+    const std::lock_guard lock(mutex_);
+    return head_ != nullptr || tail_ != nullptr;
+  }
+#endif
+
+private:
+  std::mutex mutex_;
+  std::condition_variable ready_;
+  Waiter* head_ {nullptr};
+  Waiter* tail_ {nullptr};
+  std::size_t readers_ {0};
+  bool writer_ {false};
+  bool frozen_ {false};
+};
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/concurrency.hpp b/include/netgraph/core/detail/concurrency.hpp
new file mode 100644
index 0000000..0e7fda7
--- /dev/null
+++ b/include/netgraph/core/detail/concurrency.hpp
@@ -0,0 +1,52 @@
+/* Native-only rendezvous and failure probes of a hooks build. The caller owns the
+   probe and its context; callbacks must never use Python or allocate at publication. */
+#pragma once
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+
+namespace netgraph::core::detail {
+
+enum class ConcurrentStage {
+  LedgerWait,
+  LedgerAcquired,
+  CacheQueued,
+  CacheAcquired,
+  BeforePublication,
+  AfterLedgerExchange,
+  NativeComplete,
+  WorkerBegin,
+  ThreadLaunch,
+  NativeBegin,
+  CacheTallyComplete,
+  PolicyEngineInstalled,
+  TunnelRosterSearch,
+  RouteDefinitionCheck,
+  RouteWalk,
+  ArgumentBegin,
+  Count,
+};
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+struct ConcurrentProbe {
+  void (*notify)(void*, ConcurrentStage, const void*);
+  void* context;
+};
+[[nodiscard]] const ConcurrentProbe* current_concurrent_probe() noexcept;
+void set_concurrent_probe(const ConcurrentProbe* probe) noexcept;
+struct ScopedConcurrentProbe {
+  const ConcurrentProbe* previous;
+  explicit ScopedConcurrentProbe(const ConcurrentProbe* probe) noexcept : previous(current_concurrent_probe()) { set_concurrent_probe(probe); }
+  ~ScopedConcurrentProbe() { set_concurrent_probe(previous); }
+};
+void concurrent_event(ConcurrentStage stage, const void* object);
+#else
+inline void concurrent_event(ConcurrentStage, const void*) noexcept {}
+#endif
+
+// Publication probes observe a no-fail tail. A throwing test observer is a broken
+// observer, never an exception the public operation can translate after committing.
+inline void publication_event(ConcurrentStage stage, const void* object) noexcept {
+  concurrent_event(stage, object);
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/concurrency_models.hpp b/include/netgraph/core/detail/concurrency_models.hpp
new file mode 100644
index 0000000..83db3dc
--- /dev/null
+++ b/include/netgraph/core/detail/concurrency_models.hpp
@@ -0,0 +1,129 @@
+// Finite-state test controls. These models never disable synchronization in the
+// library or create an unsynchronized native data race.
+#pragma once
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <set>
+#include <stdexcept>
+#include <string_view>
+#include <vector>
+
+namespace netgraph::core::detail {
+
+struct PublicationModelResult {
+  std::size_t states {0}, mixed {0};
+};
+inline PublicationModelResult publication_model(bool locked) {
+  // pc(writer), pc(reader), owner, load, reservation, program.
+  using State = std::array<int, 6>;
+  const State initial {0, 0, -1, 0, 0, 0};
+  std::set<State> visited;
+  std::vector<State> pending {initial};
+  PublicationModelResult out;
+  for (std::size_t n = 0; n < pending.size(); ++n) {
+    const auto current = pending[n];
+    for (std::size_t thread = 0; thread < 2; ++thread) {
+      State next = current;
+      const int pc = current[thread];
+      const int end = thread == 0 ? 5 : 3;
+      if (pc == end) continue;
+      if (pc == 0) {
+        if (locked && current[2] != -1) continue;
+        if (locked) next[2] = static_cast<int>(thread);
+      } else if (pc == end - 1) {
+        if (locked) next[2] = -1;
+      } else if (thread == 0) {
+        next[static_cast<std::size_t>(pc + 2)] = 6;
+      } else if (!(current[3] == current[4] && current[4] == current[5])) {
+        ++out.mixed;
+      }
+      ++next[thread];
+      if (visited.insert(next).second) pending.push_back(next);
+    }
+  }
+  out.states = visited.size();
+  return out;
+}
+
+struct PhaseModelResult {
+  std::size_t states {0}, partial {0}, python_under_lock {0}, late_hits {0};
+};
+inline PhaseModelResult phase_model(std::string_view protocol) {
+  enum Op { Py, Gate, Ungate, Compute, Publish, Snapshot, Shared, Unshare, Lookup, Hits, Exclusive, Thaw, Unexclusive, Read };
+  std::vector<Op> a;
+  if (protocol == "publish-result-first") a = {Py, Gate, Compute, Publish, Ungate};
+  else if (protocol == "publish-result-after") a = {Gate, Compute, Publish, Ungate, Py};
+  else if (protocol == "read-result-failure") a = {Gate, Snapshot, Ungate, Py};
+  else if (protocol == "read-result-under-gate") a = {Gate, Snapshot, Py, Ungate};
+  else if (protocol == "frozen-hits") a = {Py, Shared, Lookup, Lookup, Hits, Unshare};
+  else if (protocol == "frozen-hits-after-lease") a = {Py, Shared, Lookup, Lookup, Unshare, Hits};
+  else throw std::invalid_argument("unknown phase protocol");
+  const std::vector<Op> b = std::find(a.begin(), a.end(), Shared) != a.end()
+      ? std::vector<Op>{Exclusive, Thaw, Unexclusive} : std::vector<Op>{Gate, Read, Ungate};
+  // pc A/B, gate owner, exclusive owner, shared count, mode, ledger,
+  // published hits, private hits, failed, mode at lease acquisition.
+  using State = std::array<int, 11>;
+  const State initial {0, 0, -1, -1, 0, 0, 0, 0, 0, 0, -1};
+  std::set<State> seen {initial};
+  std::vector<State> pending {initial};
+  PhaseModelResult out;
+  while (!pending.empty()) {
+    const State current = pending.back();
+    pending.pop_back();
+    bool advances = false;
+    auto enqueue = [&](const State& next) {
+      advances = true;
+      if (seen.insert(next).second) pending.push_back(next);
+    };
+    for (std::size_t t = 0; t < 2; ++t) {
+      const auto& code = t == 0 ? a : b;
+      if (static_cast<std::size_t>(current[t]) == code.size()) continue;
+      const Op op = code[static_cast<std::size_t>(current[t])];
+      State next = current;
+      ++next[t];
+      switch (op) {
+        case Py: {
+          if (current[2] == 0 || current[4] > 0) ++out.python_under_lock;
+          enqueue(next);
+          next = current;
+          next[0] = static_cast<int>(a.size());
+          if (next[2] == 0) next[2] = -1;
+          next[4] = 0;
+          next[9] = 1;
+          enqueue(next);
+          break;
+        }
+        case Gate:
+          if (current[2] == -1) { next[2] = static_cast<int>(t); enqueue(next); }
+          break;
+        case Ungate: next[2] = -1; enqueue(next); break;
+        case Shared:
+          if (current[3] == -1) { ++next[4]; next[10] = current[5]; enqueue(next); }
+          break;
+        case Unshare: --next[4]; enqueue(next); break;
+        case Publish: next[6] = 1; enqueue(next); break;
+        case Lookup: ++next[8]; enqueue(next); break;
+        case Hits:
+          if (current[5] != current[10]) ++out.late_hits;
+          next[7] += current[8]; next[8] = 0; enqueue(next); break;
+        case Exclusive:
+          if (current[3] == -1 && current[4] == 0) { next[3] = 1; enqueue(next); }
+          break;
+        case Unexclusive: next[3] = -1; enqueue(next); break;
+        case Thaw: next[5] = 1; enqueue(next); break;
+        case Compute: case Snapshot: case Read: enqueue(next); break;
+      }
+    }
+    if (!advances) {
+      if (static_cast<std::size_t>(current[0]) != a.size() || static_cast<std::size_t>(current[1]) != b.size()) {
+        throw std::logic_error("phase model deadlocked");
+      }
+      if (current[9] != 0 && (current[6] != 0 || current[7] != 0)) ++out.partial;
+    }
+  }
+  out.states = seen.size();
+  return out;
+}
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/edge_amounts.hpp b/include/netgraph/core/detail/edge_amounts.hpp
new file mode 100644
index 0000000..98dfa85
--- /dev/null
+++ b/include/netgraph/core/detail/edge_amounts.hpp
@@ -0,0 +1,34 @@
+/* Per-edge amount arrays (internal): one check and one pair of messages for an array of
+   units indexed by EdgeId (a search's residual, the ledger's baseline, the flow core's view).
+   The bindings check unnarrowed Python integers with their own labels before calling in. */
+#pragma once
+
+#include <cstddef>
+#include <span>
+#include <stdexcept>
+#include <string>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+// std::invalid_argument unless `amounts` has one entry per edge of graph, each in
+// [0, the edge's capacity]: the length first, then the first entry outside, in EdgeId order. `label`
+// names the array in the message ("residual", "view").
+inline void check_edge_amounts(const Graph& graph, std::span<const Amount> amounts, const char* label) {
+  const auto capacity = graph.edge_capacity_units();
+  if (amounts.size() != capacity.size()) {
+    throw std::invalid_argument(std::string(label) + " has length " + std::to_string(amounts.size()) + ", expected " +
+                                std::to_string(capacity.size()) + " (one entry per edge)");
+  }
+  for (std::size_t e = 0; e < amounts.size(); ++e) {
+    if (amounts[e] < 0 || amounts[e] > capacity[e]) {
+      throw std::invalid_argument(std::string(label) + "[" + std::to_string(e) + "] = " + std::to_string(amounts[e]) +
+                                  " is outside [0, edge_capacity_units[" + std::to_string(e) + "] = " +
+                                  std::to_string(capacity[e]) + "]");
+    }
+  }
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/endpoints.hpp b/include/netgraph/core/detail/endpoints.hpp
new file mode 100644
index 0000000..a783b91
--- /dev/null
+++ b/include/netgraph/core/detail/endpoints.hpp
@@ -0,0 +1,61 @@
+/* Endpoint and root sets (internal): one normalisation, one
+   overlap check and one message for each defect, shared by the flow core, the searches, the
+   ledger's saturation report, the policies, the evaluators and the bindings (which check unnarrowed
+   Python integers and report the same texts). */
+#pragma once
+
+#include <algorithm>
+#include <cstdint>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+inline std::string empty_set_error(const char* name) { return std::string(name) + ": the node set is empty"; }
+
+inline std::string node_range_error(const char* name, const std::string& node, std::int32_t num_nodes) {
+  return std::string(name) + ": node " + node + " out of node range [0, " + std::to_string(num_nodes) + ")";
+}
+
+inline std::string overlap_error(NodeId v, const char* a, const char* b) {
+  return "node " + std::to_string(v) + " is in both endpoint sets: " + a + " and " + b + " must not overlap";
+}
+
+// node_set's checks without the set: std::invalid_argument for an empty set or an id out of range
+// (the first one, in input order; `name` labels the message).
+inline void check_range(std::span<const NodeId> nodes, std::int32_t num_nodes, const char* name) {
+  if (nodes.empty()) throw std::invalid_argument(empty_set_error(name));
+  for (NodeId v : nodes) {
+    if (v < 0 || v >= num_nodes) throw std::invalid_argument(node_range_error(name, std::to_string(v), num_nodes));
+  }
+}
+
+// The sorted, duplicate-free node set; std::invalid_argument for an empty set or an id out of
+// range (`name` labels the message).
+[[nodiscard]] inline std::vector<NodeId> node_set(std::span<const NodeId> nodes, std::int32_t num_nodes,
+                                                  const char* name) {
+  check_range(nodes, num_nodes, name);
+  std::vector<NodeId> out(nodes.begin(), nodes.end());
+  std::sort(out.begin(), out.end());
+  out.erase(std::unique(out.begin(), out.end()), out.end());
+  return out;
+}
+
+// std::invalid_argument when the two sorted sets share a vertex (the first shared one).
+inline void check_disjoint(std::span<const NodeId> a, std::span<const NodeId> b, const char* a_name,
+                           const char* b_name) {
+  for (std::size_t i = 0, k = 0; i < a.size() && k < b.size();) {
+    if (a[i] == b[k]) throw std::invalid_argument(overlap_error(a[i], a_name, b_name));
+    if (a[i] < b[k]) {
+      ++i;
+    } else {
+      ++k;
+    }
+  }
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/enum_domain.hpp b/include/netgraph/core/detail/enum_domain.hpp
new file mode 100644
index 0000000..7ed60b6
--- /dev/null
+++ b/include/netgraph/core/detail/enum_domain.hpp
@@ -0,0 +1,80 @@
+/* Membership of enumeration values (internal). An enum-typed field can hold a value
+   outside its enumeration (a C++ cast, a Python enum built from an integer); such a value is
+   outside the domain and is rejected (std::invalid_argument naming the field) before it
+   reaches any rule or record. */
+#pragma once
+
+#include <stdexcept>
+#include <string>
+
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/search.hpp"
+
+namespace netgraph::core::detail {
+
+[[noreturn]] inline void not_a_member(const char* field, int value, const char* enumeration) {
+  throw std::invalid_argument(std::string(field) + ": " + std::to_string(value) + " is not a value of " + enumeration);
+}
+
+inline void check_member(RouteAllocation v, const char* field) {
+  switch (v) {
+    case RouteAllocation::Equal:
+    case RouteAllocation::Weighted:
+    case RouteAllocation::Optimized: return;
+  }
+  not_a_member(field, static_cast<int>(v), "RouteAllocation");
+}
+
+inline void check_member(Admission v, const char* field) {
+  switch (v) {
+    case Admission::Lossless:
+    case Admission::Lossy: return;
+  }
+  not_a_member(field, static_cast<int>(v), "Admission");
+}
+
+inline void check_member(SourceAllocation v, const char* field) {
+  switch (v) {
+    case SourceAllocation::Equal:
+    case SourceAllocation::Optimized:
+    case SourceAllocation::Weighted: return;
+  }
+  not_a_member(field, static_cast<int>(v), "SourceAllocation");
+}
+
+inline void check_member(WeightBasis v, const char* field) {
+  switch (v) {
+    case WeightBasis::Capacity:
+    case WeightBasis::Explicit:
+    case WeightBasis::ResidualSnapshot: return;
+  }
+  not_a_member(field, static_cast<int>(v), "WeightBasis");
+}
+
+inline void check_member(RouteTieBreak v, const char* field) {
+  switch (v) {
+    case RouteTieBreak::FewerHops:
+    case RouteTieBreak::HigherCapacity:
+    case RouteTieBreak::HigherAvailableCapacity:
+    case RouteTieBreak::HigherHeadroom: return;
+  }
+  not_a_member(field, static_cast<int>(v), "RouteTieBreak");
+}
+
+inline void check_member(Direction v, const char* field) {
+  switch (v) {
+    case Direction::Forward:
+    case Direction::Reverse: return;
+  }
+  not_a_member(field, static_cast<int>(v), "Direction");
+}
+
+inline void check_member(SpfQueue v, const char* field) {
+  switch (v) {
+    case SpfQueue::Auto:
+    case SpfQueue::Heap: return;
+  }
+  not_a_member(field, static_cast<int>(v), "SpfQueue");
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/evaluator_checks.hpp b/include/netgraph/core/detail/evaluator_checks.hpp
new file mode 100644
index 0000000..06a6735
--- /dev/null
+++ b/include/netgraph/core/detail/evaluator_checks.hpp
@@ -0,0 +1,81 @@
+/* The evaluators' argument checks, worker default and in-call forms (internal), shared with the
+   Python binding so that both report the same first error and publish a frozen cache's
+   statistics at the same boundary. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/cache_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Native-only controls for comparing edge-failure shortcuts with complete repairs.
+// The caller owns the probe through all worker joins; observers may not use Python.
+enum class SensitivityWork { FullRepair, FirstRepair, Cut };
+struct SensitivityProbe {
+  bool full_repair {false};
+  bool cut_edges {true};
+  void (*observe)(void*, EdgeId, SensitivityWork) {nullptr};
+  void* context {nullptr};
+};
+[[nodiscard]] const SensitivityProbe* current_edge_failure_probe() noexcept;
+void set_edge_failure_probe(const SensitivityProbe* probe) noexcept;
+struct ScopedSensitivityProbe {
+  const SensitivityProbe* previous;
+  explicit ScopedSensitivityProbe(const SensitivityProbe* probe) noexcept : previous(current_edge_failure_probe()) { set_edge_failure_probe(probe); }
+  ~ScopedSensitivityProbe() { set_edge_failure_probe(previous); }
+  ScopedSensitivityProbe(const ScopedSensitivityProbe&) = delete;
+  ScopedSensitivityProbe& operator=(const ScopedSensitivityProbe&) = delete;
+};
+#endif
+
+// evaluate_pairs's validation in its two parts: the arguments (workers, foreign objects, the
+// Pinned, the configuration), then one pair (its endpoint sets, their overlap, its
+// Eligibility's graph, the pooled single-path rule for its source count), the pairs in index
+// order. Graph searches for the valid prefix run in one parallel native phase,
+// before any later pair's check error is rethrown. Their rosters are reused by workers.
+void check_batch_arguments(const Graph& graph, const EvaluationOptions& options, std::int32_t workers);
+void check_batch_pair(const Graph& graph, const FlowPolicyConfig& config, std::span<const NodeId> sources,
+                      std::span<const NodeId> destinations, const Eligibility* eligibility, std::size_t index);
+std::vector<TunnelRoster> prepare_batch_rosters(const Graph& graph,
+    std::span<const std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs,
+    const EvaluationOptions& options, std::span<const Eligibility* const> per_pair, std::int32_t workers,
+    ArgumentWork search = nullptr);
+std::optional<TunnelRoster> check_demand_arguments(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const EvaluationOptions& options, ArgumentWork search = nullptr);
+std::optional<TunnelRoster> check_edge_failure_arguments(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const EvaluationOptions& options, std::int32_t workers, ArgumentWork search = nullptr);
+
+// The evaluators' default worker count from the environment (NGRAPH_CORE_BATCH_THREADS for
+// evaluate_pairs, NGRAPH_CORE_SENSITIVITY_THREADS for evaluate_edge_failures): an integer in [1, 4096],
+// else 1. An explicit workers >= 1 is always honoured; the environment supplies defaults only.
+std::int32_t default_workers(bool edge_failures) noexcept;
+
+// The evaluators inside a public call, after all argument/immutable checks above and with the
+// supplied cache's lease held: as evaluate_demand, evaluate_pairs and evaluate_edge_failures, with a
+// supplied frozen cache's hits recorded in `tally` and nothing published. The public evaluators
+// are frozen_call over these; the Python binding allocates its result shells first, then runs
+// frozen_call over these and fills the shells' native values before the hits are published.
+// A nonempty roster span has one checked tunnel roster per pair, for the same
+// config/endpoints/effective mask. It lives through every worker join; a single
+// roster pointer applies only to the matching demand or evaluate_edge_failures baseline.
+PlacementResult evaluate_demand_in_call(const Graph& graph, std::span<const NodeId> sources,
+                                 std::span<const NodeId> destinations, const EvaluationOptions& options, FrozenCacheHitTally& tally, const TunnelRoster* roster = nullptr);
+std::vector<PlacementResult> evaluate_pairs_in_call(
+    const Graph& graph, const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>>& pairs,
+    const EvaluationOptions& options, std::span<const Eligibility* const> per_pair_eligibility, std::int32_t workers,
+    FrozenCacheHitTally& tally, std::span<const TunnelRoster> rosters = {});
+SensitivityResult evaluate_edge_failures_in_call(const Graph& graph, std::span<const NodeId> sources,
+                                      std::span<const NodeId> destinations, const EvaluationOptions& options,
+                                      std::int32_t workers, FrozenCacheHitTally& tally, const TunnelRoster* roster = nullptr);
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/forwarding.hpp b/include/netgraph/core/detail/forwarding.hpp
new file mode 100644
index 0000000..6b658a2
--- /dev/null
+++ b/include/netgraph/core/detail/forwarding.hpp
@@ -0,0 +1,241 @@
+/* The forwarding of a program (internal): one engine for every model that forwards a program
+   (ShortestPaths's own pooled program, a controller's paths through forward(), and Pinned).
+
+   A view is the program as one forwarding sees it: its replay under the forwarding policy's mask
+   (docs/semantics.md, "Replay under a failure": failed tunnels, split routes without their excluded
+   members, the roster rebuilt from the program's basis) and the black holes laid over it ("Stale
+   forwarding": they change no split; traffic reaching one is dropped there, a black-holed head
+   loses its own share at the source).
+
+   Injection: a total enters as round robin over the view's heads (equal sources) or by highest
+   averages over their captured weights; each head splits its share by highest averages over its
+   surviving entries' weights. A head without a surviving entry of positive weight, or a
+   black-holed head, keeps its share and loses it at the source; an entry whose route has no
+   member left (a Weighted route of weights 0) loses what it receives at the source too.
+
+   Lossless: the largest total in an interval whose no-drop loads fit the free capacity with
+   no share lost at a source or on a black hole; the loads are monotone in the total (round robin
+   and highest averages are house-monotone), so integer bisection is exact.
+   Lossy ("Losses on shared edges", "Several demands at once"): the one evaluator of the loss
+   rule, for one program or several demands at once (a SIMULTANEOUS list). A link that receives
+   more than its free capacity V shares T = min(V, arrivals) by highest averages over the demands'
+   arrivals (in their creation order), then within a demand over its sources', then within a source
+   over its entries'; A+ forwards the loads U0 first (no link shared, each demand's traffic stopped
+   at its own black holes), makes every link with U0 <= V a pass-through and evaluates the other
+   links (barriers) and the split routes' routers once each in dependency order; barriers that wait
+   on each other in a cycle are iterated from zero (serial normalization first, then rounds, 64 b
+   rounds for b barriers, the period-two and round-limit errors, the independent check of the whole
+   result before anything is returned). What reaches a black hole of its own demand is dropped there
+   and makes no barrier (b counts physical links); an occurrence that carries 0 in U0's forward (a
+   share of 0, a member whose whole-unit share is 0, traffic behind its own black hole) is dead and
+   takes no part in U0, the waits or serial normalization. A
+   pooled program (one split context: a ShortestPaths program, one supplied split route) called
+   alone is forwarded by its plan's kernels, which are this rule for one acyclic context; in a list
+   it joins the evaluator with one amount per source on each member.
+*/
+#pragma once
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+
+namespace netgraph::core::detail {
+
+struct ForwardingView {
+  std::shared_ptr<const ForwardingProgram> program {};
+  const ProgramData* data {nullptr};
+  // A borrowed view is the program's own state (no mask, no black holes, no record route to
+  // make): every head of the roster injects, every entry is up with the program's route, cost and
+  // plan, and the vectors below stay empty (the accessors read the program). Otherwise they hold
+  // the replay:
+  bool borrowed {false};
+  // The heads that inject (the replay roster, ascending NodeId) as roster slots; their captured
+  // weights (empty: equal sources); black-holed heads.
+  std::vector<std::int32_t> source_indices_ {};
+  std::vector<Amount> source_weights_ {};
+  std::vector<std::uint8_t> blackholed_sources_ {};
+  // Per program entry: Failed (excluded by the mask, or a head outside the replay roster),
+  // Blackholed (a tunnel whose path reaches a black hole), a down tunnel's setup status
+  // (InsufficientBandwidth, CostCeilingExceeded) or Up; its route under the mask (the record's route; an empty DAG
+  // when it failed or is down) and that route's cost.
+  std::vector<TunnelStatus> status_ {};
+  std::vector<std::shared_ptr<const PredecessorDAG>> routes_ {};
+  std::vector<Cost> min_route_costs_ {};
+  // Per view head: its surviving entries (positions in data->entries, ascending index).
+  std::vector<std::int32_t> source_entry_offsets_ {};
+  std::vector<std::int32_t> source_entry_positions_ {};
+  // The split contexts as forwarded (restricted to the mask; the program's plan when nothing is
+  // removed) and per entry of a context its root's index in that plan's roots (-1 otherwise).
+  std::vector<std::shared_ptr<const PreparedRoute>> prepared_routes_ {};
+  std::vector<std::int32_t> context_source_indices_ {};
+  // Black holes: the nodes and edges this Eligibility excludes (null: none).
+  const Eligibility* black_holes {nullptr};
+  // The pooled form: one context, one root per view head (equal sources, every entry weight
+  // positive). Its plan is plan(0), its roots the view's heads in order.
+  bool pooled {false};
+  // The immutable view's effective captured weights may be declared proportions,
+  // whose sum need not satisfy the solved-supply bound below 2^62.
+  bool wide_source_weights {false};
+
+  [[nodiscard]] std::size_t num_sources() const noexcept { return borrowed ? data->reachable_sources.size() : source_indices_.size(); }
+  [[nodiscard]] std::int32_t source_index(std::size_t h) const noexcept {
+    return borrowed ? static_cast<std::int32_t>(h) : source_indices_[h];
+  }
+  [[nodiscard]] NodeId source(std::size_t h) const noexcept { return data->reachable_sources[static_cast<std::size_t>(source_index(h))]; }
+  [[nodiscard]] std::span<const Amount> source_weights() const noexcept {
+    return borrowed ? std::span<const Amount>(data->source_weight_values) : std::span<const Amount>(source_weights_);
+  }
+  [[nodiscard]] bool is_blackholed_source(std::size_t h) const noexcept { return !blackholed_sources_.empty() && blackholed_sources_[h] != 0; }
+  // Entry e's status: a borrowed view's are the program's own (Up, or a down tunnel's setup status).
+  [[nodiscard]] TunnelStatus status(std::size_t e) const noexcept {
+    if (!borrowed) return status_[e];
+    const auto t = data->entries[e].tunnel_position;
+    return t < 0 ? TunnelStatus::Up : data->tunnels[static_cast<std::size_t>(t)].status;
+  }
+  [[nodiscard]] const std::shared_ptr<const PredecessorDAG>& route(std::size_t e) const noexcept {
+    return borrowed ? data->entries[e].route : routes_[e];
+  }
+  [[nodiscard]] Cost min_route_cost(std::size_t e) const noexcept { return borrowed ? data->entries[e].min_route_cost : min_route_costs_[e]; }
+  [[nodiscard]] const std::shared_ptr<const PreparedRoute>& prepared_route(std::size_t c) const noexcept {
+    return borrowed ? data->split_contexts[c].prepared_route : prepared_routes_[c];
+  }
+  // Entry e's root in its context's plan (-1 for a tunnel or a root the mask removed).
+  [[nodiscard]] std::int32_t context_source_index(std::size_t e) const noexcept {
+    if (!borrowed) return context_source_indices_[e];
+    const auto c = data->entries[e].split_context_position;
+    if (c < 0) return -1;
+    const auto& roots = data->split_contexts[static_cast<std::size_t>(c)].source_entry_positions;
+    if (e < roots.size() && static_cast<std::size_t>(roots[e]) == e) return static_cast<std::int32_t>(e);  // pooled
+    for (std::size_t r = 0; r < roots.size(); ++r) {
+      if (static_cast<std::size_t>(roots[r]) == e) return static_cast<std::int32_t>(r);
+    }
+    return -1;
+  }
+  // View head h's surviving entries, ascending index.
+  [[nodiscard]] std::span<const std::int32_t> entries_for_source(std::size_t h) const noexcept {
+    if (borrowed) return data->entries_for_source(h);
+    const auto b = static_cast<std::size_t>(source_entry_offsets_[h]);
+    return {source_entry_positions_.data() + b, static_cast<std::size_t>(source_entry_offsets_[h + 1]) - b};
+  }
+};
+
+// The view of `program` under the forwarding policy's mask `mask` (null: the program's own
+// state, nothing replayed) with `dests` the allowed destinations (ascending), and the black holes
+// `dark` (null or an all-allowed value: none; it must outlive the view). With `records`, every
+// entry's route under the mask is made (a Pinned policy's record routes); without, a tunnel's
+// route stays null.
+[[nodiscard]] ForwardingView make_forwarding_view(const Graph& graph, std::shared_ptr<const ForwardingProgram> program,
+                                       const Eligibility* mask, std::span<const NodeId> destinations,
+                                       const Eligibility* dark, bool records = false);
+// The same view with other black holes (the program, its replay and its structure shared).
+[[nodiscard]] ForwardingView with_black_holes(const ForwardingView& view, const Eligibility* dark);
+
+// One entry's part of a forwarding: its share (assigned), what it delivered, what it lost at the
+// source (a route without a member), what it carried and dropped per edge (ascending EdgeId,
+// positive entries).
+struct EntryFlow {
+  Amount assigned {0};
+  Amount delivered {0};
+  Amount source_drops {0};
+  std::vector<std::pair<EdgeId, Amount>> edge_flows {};
+  std::vector<std::pair<EdgeId, Amount>> edge_drops {};
+};
+
+// A forwarding's outcome: the heads' injections (offered; with captured weights all 0 a total
+// can exceed it: the rest is lost at the sources, outside every head), lost at the sources,
+// delivered; per view head its injection and (Lossy only: empty for Lossless, which loses
+// nothing) the part it lost itself (black-holed, or no surviving entry of positive weight); per
+// program entry its EntryFlow (zero for entries that receive nothing).
+struct ProgramFlow {
+  Amount admitted {0};
+  Amount offered {0};
+  Amount source_drops {0};
+  Amount delivered {0};
+  std::vector<Amount> offered_by_source {};
+  std::vector<Amount> source_drops_by_source {};
+  std::vector<EntryFlow> entries {};
+};
+
+// A forwarding's network numbers its positions in 32 bits. Its counts, in the order they are
+// checked: the forwarded entries, the occurrences (every tunnel hop and split-route member), the
+// routers of the split routes, the lossy rule's events (the links that can drop plus the routers)
+// and their dependency arcs. Each is computed exactly in 64 bits: at most kForwardingLimit, else
+// std::invalid_argument `forwarding <counter> limit exceeded: <n> > 2147483647`. The entry,
+// occurrence and router counts are checked after validation and before the network is allocated;
+// the event and dependency counts, known only after the no-drop loads, before the event
+// structures are allocated. Either refusal changes nothing.
+inline constexpr std::int64_t kForwardingLimit = std::numeric_limits<std::int32_t>::max();
+// Head labels include destinations as well as roots and member occurrences: their count is
+// at most entries + occurrences, which can exceed the signed 32-bit occurrence limit.
+using HeadLabelOffset = std::size_t;
+
+enum class ForwardingCounter { Entry, Occurrence, Router, Event, Dependency };
+void check_forwarding_count(ForwardingCounter counter, std::int64_t n);
+
+// The free capacity of each of `edges` in the forwarding, into `out` (aligned; before black
+// holes, which the engine applies): one call per evaluation, not per edge.
+using AvailableCapacityFn = std::function<void(std::span<const EdgeId> edges, std::span<Amount> out)>;
+
+// The heads' injections of a total x: round robin over the heads, or highest averages over the
+// captured weights.
+void source_shares(const ForwardingView& view, Amount x, std::span<Amount> out);
+// The heads' increments when a cumulative 128-bit offer X grows by v (a Lossy place): RR(X + v) -
+// RR(X) or H(X + v) - H(X), each below 2^62.
+void source_offer_increments(const ForwardingView& view, const Counter128& X, Amount v, std::span<Amount> out);
+
+// Lossless: the largest total in [lo, hi] (hi nullopt: unbounded) whose no-drop forwarding fits
+// `free`, with its loads; `lo` must fit.
+[[nodiscard]] ProgramFlow lossless(const ForwardingView& view, const AvailableCapacityFn& free, Amount lo, std::optional<Amount> hi);
+// Lossy: the loss rule over per-head injections (aligned with the view's heads) on `free`.
+[[nodiscard]] ProgramFlow lossy(const ForwardingView& view, const AvailableCapacityFn& free, std::span<const Amount> injections);
+// One demand of a joint forwarding (a SIMULTANEOUS list's participant): its view and its per-head
+// injections (aligned with the view's heads).
+struct ForwardingDemand {
+  const ForwardingView* view {nullptr};
+  std::span<const Amount> injections {};
+};
+// Lossy over several demands at once on one shared `free` (the loss rule with its demand level:
+// the demands in the given order, their policies' creation order; the cycle rule across them): one
+// ProgramFlow per demand.
+// Each demand's black holes are its own (dark occurrences). One non-pooled demand is lossy()'s own
+// evaluation; a pooled demand joins as a context with per-head amounts.
+[[nodiscard]] std::vector<ProgramFlow> lossy(std::span<const ForwardingDemand> demands, const AvailableCapacityFn& free);
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Test controls (hooks builds only): how many cyclic groups the last lossy() on this thread
+// iterated and its rounds; its barrier links (EdgeIds, ascending: the links that wait, after serial
+// normalization) and its dependency arcs; how many times it sized the event structures (after the
+// event and dependency counts passed); two corruptions of the iterated result before its check (the check's
+// planted faults, RuntimeError expected): `corrupt` lowers one carried amount after the rounds,
+// `shift` moves one unit between two occurrences of one barrier before the final forwarding (every
+// continuation consistent, only that link's loss rule wrong).
+struct LossyCounters {
+  std::int64_t groups {0};
+  std::int64_t rounds {0};
+  std::vector<EdgeId> barriers {};
+  std::int64_t dependencies {0};
+  std::int64_t event_structures {0};
+  bool corrupt {false};
+  bool shift {false};
+};
+LossyCounters& thread_lossy_counters() noexcept;
+// Lower limits for this thread's forwardings, per ForwardingCounter (0: kForwardingLimit), so a
+// test reaches each refusal with a small program.
+std::array<std::int64_t, 5>& thread_forwarding_limits() noexcept;
+#endif
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/graph_access.hpp b/include/netgraph/core/detail/graph_access.hpp
new file mode 100644
index 0000000..a6b6ba1
--- /dev/null
+++ b/include/netgraph/core/detail/graph_access.hpp
@@ -0,0 +1,80 @@
+/* Internal graph access for reverse searches and tests. The stored reverse-source array
+   avoids fetching each source through a second array; tests also read retained array bytes.
+   Everything is inline, with no Python name. Construction counters exist only in private-hooks
+   builds (their accessor, the one library symbol, is defined in graph.cpp) and let C++ tests
+   observe which construction branches ran. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <type_traits>
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+#include "netgraph/core/graph.hpp"
+
+namespace netgraph::core::detail {
+
+// The fixed hash of the distinct-cost table (splitmix64's finalizer; the table index is its low
+// bits). The construction uses it; the tests build colliding costs from it.
+[[nodiscard]] inline std::uint64_t cost_hash(Cost c) noexcept {
+  auto x = static_cast<std::uint64_t>(c);
+  x ^= x >> 30;
+  x *= 0xbf58476d1ce4e5b9ULL;
+  x ^= x >> 27;
+  x *= 0x94d049bb133111ebULL;
+  x ^= x >> 31;
+  return x;
+}
+
+struct GraphAccess {
+  // incoming_edge_sources[slot] = edge_sources()[incoming_edges()[slot]], filled before the graph is
+  // published and never written after.
+  [[nodiscard]] static std::span<const NodeId> incoming_edge_sources(const Graph& graph) noexcept { return graph.incoming_edge_sources_; }
+
+  // The retained arrays' heap payload: capacity() and size() times the element size, summed.
+  struct Retained {
+    std::size_t capacity_bytes {0};
+    std::size_t size_bytes {0};
+    std::size_t arrays {0};
+  };
+  [[nodiscard]] static Retained retained(const Graph& graph) noexcept {
+    Retained r;
+    auto add = [&r](const auto& v) {
+      using T = typename std::remove_cvref_t<decltype(v)>::value_type;
+      r.capacity_bytes += v.capacity() * sizeof(T);
+      r.size_bytes += v.size() * sizeof(T);
+      ++r.arrays;
+    };
+    add(graph.edge_capacity_units_);
+    add(graph.edge_costs_);
+    add(graph.edge_sources_);
+    add(graph.edge_destinations_);
+    add(graph.input_positions_);
+    add(graph.outgoing_offsets_);
+    add(graph.incoming_offsets_);
+    add(graph.incoming_edges_);
+    add(graph.incoming_edge_sources_);
+    return r;
+  }
+};
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Test evidence (C++ tests, hooks builds only): this thread's construction counts so far, and
+// what its last construction did (the last_* fields).
+struct ConstructionCounts {
+  std::int64_t hashed {0};                // constructions whose ranks came from the hash table
+  std::int64_t fallback {0};              // constructions whose ranks came from the sort of all costs
+  std::int64_t distinct_limit {0};        // fallbacks at the (L + 1)th distinct cost
+  std::int64_t exhausted_collection {0};  // fallbacks: the probe budget ran out at an input lookup
+  std::int64_t exhausted_growth {0};      // fallbacks: the probe budget ran out during a table growth
+  std::int64_t last_distinct {0};         // K of the last construction
+  std::int64_t last_table_slots {0};
+  std::int64_t last_probes {0};           // probes examined by the last construction (<= last_budget)
+  std::int64_t last_budget {0};           // its B = 8E + 8 x 65,536
+  std::int64_t fused {0};                 // constructions taking the combined-key passes (N K < E)
+};
+ConstructionCounts& thread_construction_counts() noexcept;
+#endif
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/hooks_flag.hpp b/include/netgraph/core/detail/hooks_flag.hpp
new file mode 100644
index 0000000..785865e
--- /dev/null
+++ b/include/netgraph/core/detail/hooks_flag.hpp
@@ -0,0 +1,11 @@
+/* The build flag of the private hooks (internal): NETGRAPH_CORE_PRIVATE_HOOKS, 1 when the test
+   controls of private_hooks.hpp are compiled in. CMake defines it for the library and, through
+   the library target, for the extension and the tests (ON for the editable development build
+   and the test suites, OFF for an installed wheel); a native caller compiling without that
+   definition gets OFF. Code that only asks whether the hooks exist includes this header, not the
+   hook declarations, which reach the policy and the trace. */
+#pragma once
+
+#ifndef NETGRAPH_CORE_PRIVATE_HOOKS
+#define NETGRAPH_CORE_PRIVATE_HOOKS 0
+#endif
diff --git a/include/netgraph/core/detail/int128.hpp b/include/netgraph/core/detail/int128.hpp
new file mode 100644
index 0000000..1ddd137
--- /dev/null
+++ b/include/netgraph/core/detail/int128.hpp
@@ -0,0 +1,194 @@
+/* Portable 128-bit arithmetic (internal).
+
+   U128 holds unsigned values for exact allocation shares, priorities and factor comparisons
+   (Counter128 keeps its own two words). Compare fractions a/b and c/d by comparing a*d and
+   c*b; compute a lower quota as floor(I*w/W), where I is the total, w one weight and W the sum
+   of weights.
+   A cost-stretch factor is an exact fraction n/d.
+   Ordinary Amount operations have operands below 2^63, products below 2^126 and
+   64-bit quotients; cumulative apportionment uses the U192 operations below.
+   Use __int128 when available; otherwise split products into 32-bit parts (limbs).
+
+   I128 holds signed costs for deletion repairs: vertex cost offsets (potentials), distance
+   keys and sums of each shortest-path search's largest distance (tier maxima). These stay
+   within (22 n + 15) C for n vertices and cost sum C < 2^62. Only addition, subtraction and
+   comparison are needed, always using two 64-bit parts.
+*/
+#pragma once
+
+#include <bit>
+#include <compare>
+#include <cstdint>
+
+namespace netgraph::core::detail {
+
+struct U128 {
+  std::uint64_t hi {0};
+  std::uint64_t lo {0};
+};
+
+inline bool operator==(U128 a, U128 b) noexcept { return a.hi == b.hi && a.lo == b.lo; }
+inline bool operator<(U128 a, U128 b) noexcept { return a.hi != b.hi ? a.hi < b.hi : a.lo < b.lo; }
+inline bool operator>(U128 a, U128 b) noexcept { return b < a; }
+
+#if defined(__SIZEOF_INT128__)
+
+inline U128 mul_u64(std::uint64_t a, std::uint64_t b) noexcept {
+  const unsigned __int128 p = static_cast<unsigned __int128>(a) * b;
+  return {static_cast<std::uint64_t>(p >> 64), static_cast<std::uint64_t>(p)};
+}
+
+// floor(n / d) for d > 0 and a quotient below 2^64 (n.hi < d).
+inline std::uint64_t div_u128(U128 n, std::uint64_t d) noexcept {
+  // A dividend below 2^64 (the common lower quota) takes the 64-bit division: the same quotient
+  // without the 128-bit division helper.
+  if (n.hi == 0) return n.lo / d;
+  const unsigned __int128 x = (static_cast<unsigned __int128>(n.hi) << 64) | n.lo;
+  return static_cast<std::uint64_t>(x / d);
+}
+
+#else
+
+inline U128 mul_u64(std::uint64_t a, std::uint64_t b) noexcept {
+  const std::uint64_t a0 = a & 0xffffffffULL, a1 = a >> 32;
+  const std::uint64_t b0 = b & 0xffffffffULL, b1 = b >> 32;
+  const std::uint64_t p00 = a0 * b0, p01 = a0 * b1, p10 = a1 * b0, p11 = a1 * b1;
+  const std::uint64_t mid = (p00 >> 32) + (p01 & 0xffffffffULL) + (p10 & 0xffffffffULL);
+  U128 r;
+  r.lo = (mid << 32) | (p00 & 0xffffffffULL);
+  r.hi = p11 + (p01 >> 32) + (p10 >> 32) + (mid >> 32);
+  return r;
+}
+
+// floor(n / d), with d > 0 and quotient < 2^64 (n.hi < d). Build one quotient bit per step:
+// shift in the next dividend bit, then subtract d if the current remainder is large enough.
+inline std::uint64_t div_u128(U128 n, std::uint64_t d) noexcept {
+  std::uint64_t rem = n.hi;
+  std::uint64_t q = 0;
+  for (int i = 63; i >= 0; --i) {
+    const bool carry = (rem >> 63) != 0;
+    rem = (rem << 1) | ((n.lo >> i) & 1U);
+    if (carry || rem >= d) {
+      rem -= d;
+      q |= std::uint64_t{1} << i;
+    }
+  }
+  return q;
+}
+
+#endif
+
+// x mod d for d > 0 (any 128-bit x): the remainder of (x.hi mod d) * 2^64 + x.lo, whose quotient
+// fits 64 bits.
+inline std::uint64_t mod_u128(U128 x, std::uint64_t d) noexcept {
+  const std::uint64_t q = div_u128(U128 {x.hi % d, x.lo}, d);
+  return x.lo - q * d;
+}
+
+// a + b and a - b (a >= b), exactly; the caller keeps a + b below 2^128.
+inline U128 add(U128 a, U128 b) noexcept {
+  U128 r {a.hi + b.hi, a.lo + b.lo};
+  if (r.lo < a.lo) ++r.hi;
+  return r;
+}
+inline U128 sub(U128 a, U128 b) noexcept {
+  U128 r {a.hi - b.hi, a.lo - b.lo};
+  if (a.lo < b.lo) --r.hi;
+  return r;
+}
+
+// The number of significant bits of v (0 for 0).
+inline int bits(U128 v) noexcept { return v.hi != 0 ? 64 + std::bit_width(v.hi) : std::bit_width(v.lo); }
+
+// v * 2^k for 0 <= k < 128; the caller keeps the result below 2^128 (bits(v) + k <= 128).
+inline U128 shl(U128 v, int k) noexcept {
+  if (k == 0) return v;
+  if (k >= 64) return {v.lo << (k - 64), 0};
+  return {(v.hi << k) | (v.lo >> (64 - k)), v.lo << k};
+}
+
+// floor(n / d) for d > 0 and a quotient below 2^64 (a lower quota floor(I*w/W) with w <= W: at
+// most I). A divisor below 2^64 takes div_u128 above; a larger one (a weight sum of 2^64 or more)
+// the long division, one quotient bit per step from the highest that can be set.
+inline std::uint64_t div_u128(U128 n, U128 d) noexcept {
+  if (d.hi == 0) return div_u128(n, d.lo);
+  std::uint64_t q = 0;
+  for (int s = bits(n) - bits(d); s >= 0; --s) {
+    const U128 ds = shl(d, s);
+    if (!(n < ds)) {
+      n = sub(n, ds);
+      q |= std::uint64_t {1} << s;
+    }
+  }
+  return q;
+}
+
+// Cumulative source apportionment: total < 2^127, individual weight < 2^62, so a
+// quota numerator or priority cross-product is below 2^189. Three portable words
+// hold it without extending the ordinary Amount arithmetic's cost.
+struct U192 {
+  std::uint64_t hi {0}, mid {0}, lo {0};
+  friend auto operator<=>(const U192&, const U192&) = default;
+};
+
+inline U192 mul_wide(U128 a, std::uint64_t b) noexcept {
+  const U128 low = mul_u64(a.lo, b), high = mul_u64(a.hi, b);
+  const std::uint64_t mid = low.hi + high.lo;
+  return {high.hi + (mid < low.hi ? 1U : 0U), mid, low.lo};
+}
+
+// floor(n / d), quotient < 2^128 and 0 < d < 2^127. Source-weight sums
+// are below 2^93, so shifting a remainder (always < d) cannot overflow U128.
+inline U128 div_wide(U192 n, U128 d) noexcept {
+  U128 q {}, r {};
+  for (int i = 191; i >= 0; --i) {
+    const auto word = i >= 128 ? n.hi : i >= 64 ? n.mid : n.lo;
+    r = add(shl(r, 1), U128 {0, (word >> (i % 64)) & 1U});
+    q = shl(q, 1);
+    if (!(r < d)) {
+      r = sub(r, d);
+      q.lo |= 1;
+    }
+  }
+  return q;
+}
+
+// A signed 128-bit integer in two's complement, value = hi * 2^64 + lo. The member order makes
+// the defaulted comparison (hi signed, then lo unsigned) the numeric order.
+struct I128 {
+  std::int64_t hi {0};
+  std::uint64_t lo {0};
+
+  constexpr I128() noexcept = default;
+  // Implicit, so int64 costs and amounts enter the arithmetic directly.
+  constexpr I128(std::int64_t v) noexcept : hi(v < 0 ? -1 : 0), lo(static_cast<std::uint64_t>(v)) {}
+
+  friend constexpr bool operator==(const I128&, const I128&) noexcept = default;
+  friend constexpr std::strong_ordering operator<=>(const I128&, const I128&) noexcept = default;
+
+  friend constexpr I128 operator+(I128 a, I128 b) noexcept {
+    I128 r;
+    r.lo = a.lo + b.lo;
+    const std::uint64_t carry = r.lo < a.lo ? 1U : 0U;
+    r.hi = static_cast<std::int64_t>(static_cast<std::uint64_t>(a.hi) + static_cast<std::uint64_t>(b.hi) + carry);
+    return r;
+  }
+  friend constexpr I128 operator-(I128 a, I128 b) noexcept {
+    I128 r;
+    r.lo = a.lo - b.lo;
+    const std::uint64_t borrow = a.lo < b.lo ? 1U : 0U;
+    r.hi = static_cast<std::int64_t>(static_cast<std::uint64_t>(a.hi) - static_cast<std::uint64_t>(b.hi) - borrow);
+    return r;
+  }
+  constexpr I128& operator+=(I128 b) noexcept { return *this = *this + b; }
+};
+
+// cost <= (n / d) * base, exactly (the CostStretch cost ceiling): cost * d <= n * base, for cost and
+// base in [0, 2^63) and a reduced factor n / d >= 1 (so n >= d >= 1). Each product is below 2^126.
+inline bool stretch_le(std::int64_t cost, std::int64_t base, std::int64_t n, std::int64_t d) noexcept {
+  const U128 lhs = mul_u64(static_cast<std::uint64_t>(cost), static_cast<std::uint64_t>(d));
+  const U128 rhs = mul_u64(static_cast<std::uint64_t>(base), static_cast<std::uint64_t>(n));
+  return !(rhs < lhs);
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/ledger_access.hpp b/include/netgraph/core/detail/ledger_access.hpp
new file mode 100644
index 0000000..dd8e0dd
--- /dev/null
+++ b/include/netgraph/core/detail/ledger_access.hpp
@@ -0,0 +1,106 @@
+/* The ledger's internal entry points: what a policy uses to place on and remove from it.
+
+   Policies place and remove flows through these entry points; an unbound ledger can also be
+   reset, through its public reset(), which is not one of them. A policy binds (an owner id),
+   then every call ends with one atomic exchange of all of its records (`commit`); remove()
+   reverts its allocations and retires its ids (`detach`); a policy destroyed without remove()
+   leaves its records as orphans (`release`). None of this is public API.
+*/
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/detail/concurrency.hpp"
+
+namespace netgraph::core::detail {
+
+// A record proposed by a policy for the commit: `id` nullopt is a new flow (its id is assigned
+// at the commit, in draft order); the commit sets the record's flow_id and policy_id. The record's
+// `edge_flows`, `edge_drops` and `edge_reservations` ascend by EdgeId; zero entries are dropped.
+struct RecordDraft {
+  std::optional<std::int64_t> record_counter {};
+  FlowRecord record {};
+};
+
+// One owner's part of a batch exchange (LedgerAccess::commit_batch).
+struct OwnerDrafts {
+  std::int64_t owner {0};
+  std::span<RecordDraft> drafts {};
+  bool retire {false};
+};
+
+// The saturation diagnostic of FlowLedger::saturated_boundary_edges on a given residual (the sources already a
+// validated set): the edges (statically eligible, capacity >= 1 unit) leaving the set reachable
+// from the allowed sources over eligible forward arcs with residual >= 1 unit, ascending EdgeId.
+[[nodiscard]] std::vector<EdgeId> saturated_boundary_edges_of(const Graph& graph, std::span<const Amount> residual,
+                                                std::span<const NodeId> sources, const Eligibility* eligibility);
+
+struct LedgerAccess {
+  [[nodiscard]] static std::unique_lock<std::mutex> lock(const FlowLedger& ledger) {
+    concurrent_event(ConcurrentStage::LedgerWait, &ledger);
+    std::unique_lock guard(ledger.gate_);
+    concurrent_event(ConcurrentStage::LedgerAcquired, &ledger);
+    return guard;
+  }
+  // Immutable metadata; no mutable-state check or lock. All other internal access below
+  // requires the ledger gate, except release(), which acquires it for destruction.
+  [[nodiscard]] static const std::shared_ptr<const Graph>& graph(const FlowLedger& ledger) noexcept { return ledger.graph_; }
+  [[nodiscard]] static FlowRecord record(const FlowLedger& ledger, const FlowId& id);
+  // A new owner id (0, 1, ... per ledger, below the largest int64: std::runtime_error `policy
+  // identity limit exceeded` there, nothing changed). Throws on a moved-from ledger.
+  [[nodiscard]] static std::int64_t bind(FlowLedger& ledger);
+  // The owner's policy is destroyed without remove(): its records stay as orphans (an owner
+  // without records is forgotten).
+  static void release(FlowLedger& ledger, std::int64_t owner) noexcept;
+  // remove(): the owner's records are deleted (allocations and holds reverted), their ids retired.
+  // Throws only before any change (a moved-from ledger, an unbound owner).
+  static std::vector<std::int64_t> detach(FlowLedger& ledger, std::int64_t owner);
+  // One atomic exchange: `drafts` must carry every live record of the owner (by id) plus the
+  // new ones; the new aggregates must stay within [0, baseline] on every edge (carried loads
+  // within the service baseline, holds within the reservation baseline). Throws (and
+  // changes nothing) otherwise, an allocation failure included: every allocation happens
+  // before a publication step that cannot throw, and the new ids running past the largest int64
+  // (std::runtime_error `record identity limit exceeded`). Returns the FlowIds of the new records in
+  // draft order. The drafts' vectors are moved from.
+  static std::vector<FlowId> commit(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts);
+  // The exchange of replace() and forward(): every live record of the owner is retired (its
+  // allocation reverted, its id never live again) and `drafts` (new records only) are created, in
+  // one atomic step with commit's checks and guarantee. Returns the new FlowIds in draft order.
+  static std::vector<FlowId> exchange(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts);
+  // commit (retire false) and exchange (retire true).
+  static std::vector<FlowId> commit_drafts(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts, bool retire);
+  // One atomic exchange for several distinct owners (apply_actions): each owner's drafts with
+  // commit's (retire false) or exchange's (retire true) rule, the aggregates checked once over
+  // every owner, the new ids counted for the whole batch first and assigned in owner order, then
+  // draft order. Throws (and changes nothing) as commit does. `created` (one per owner) receives
+  // each owner's new FlowIds; the drafts' vectors are moved from.
+  static void commit_batch(FlowLedger& ledger, std::span<OwnerDrafts> owners, std::span<std::vector<FlowId>> created);
+  // A live record by id (throws std::invalid_argument for an unknown or retired id).
+  [[nodiscard]] static const FlowRecord& live(const FlowLedger& ledger, std::int64_t id);
+  // The working residual service baseline - carried() into `out` (resized to E).
+  static void residual_into(const FlowLedger& ledger, std::vector<Amount>& out);
+  [[nodiscard]] static std::span<const Amount> baseline(const FlowLedger& ledger);
+  // The aggregate allocation (borrowed; valid until the next commit, detach or reset).
+  [[nodiscard]] static std::span<const Amount> carried(const FlowLedger& ledger);
+  // The reservation baseline R0 and the aggregate holds S (borrowed, as above). S is empty until a
+  // commit with holds stages it as zeros (a commit that fails after that leaves it staged); empty
+  // and staged S read as all zero.
+  [[nodiscard]] static std::span<const Amount> reservation_baseline(const FlowLedger& fg);
+  [[nodiscard]] static std::span<const Amount> reserved(const FlowLedger& fg);
+  // S as stored, made E zeros first when nothing has been held (the tests' state checks write
+  // through it).
+  static std::vector<Amount>& reserved_storage(FlowLedger& fg);
+  // Diagnostics (the tests and the private bindings).
+  [[nodiscard]] static std::int64_t next_record_counter(const FlowLedger& ledger);
+  // The next record and owner ids, set (the tests' checks of the identity limits).
+  static void set_next_ids(FlowLedger& ledger, std::int64_t next_record_counter, std::int64_t next_policy_id);
+  [[nodiscard]] static std::vector<std::int64_t> bound_policy_ids(const FlowLedger& ledger);
+  [[nodiscard]] static std::vector<std::int64_t> orphan_policy_ids(const FlowLedger& ledger);
+};
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/min_cost_flow.hpp b/include/netgraph/core/detail/min_cost_flow.hpp
new file mode 100644
index 0000000..473d635
--- /dev/null
+++ b/include/netgraph/core/detail/min_cost_flow.hpp
@@ -0,0 +1,288 @@
+/* Integer minimum-cost flow (internal): CentralizedTE and the recorder use the eligible graph;
+   Optimized uses an edge subset; exact sensitivity repairs a solved flow after deleting an edge.
+   A view gives each edge's available capacity. The residual network has forward arcs for
+   adding flow and reverse arcs for cancelling it. A potential pi is a vertex cost offset:
+   reduced cost on u -> v is cost + pi(u) - pi(v). Non-negative reduced costs allow
+   Dijkstra search, which finalises the nearest pending vertex first. A tier is one
+   such search followed by pushes on paths whose reduced cost is zero. Dinic phases assign hop
+   levels with breadth-first search (BFS), then fill paths through increasing levels with
+   depth-first search (DFS). The full residual closure of the real sources is the set they reach
+   through positive residual arcs, including reverse and virtual arcs. Virtual source/sink
+   vertices join the real source/destination sets. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <span>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/hooks_flag.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+// Potential of a vertex that no Dijkstra run of the call settled. Potentials are otherwise
+// non-negative path costs, so the sentinel never collides.
+inline constexpr Cost kNeverReached = -1;
+// Upper bound of the internal value cap; also the capacity of the virtual source and sink arcs,
+// strictly above every attainable value (below 2^62), so a virtual arc never saturates.
+inline constexpr Amount kMaxFlowCap = INT64_MAX - 1;
+
+// Repeatable work counters for one call; they detect changes in work, not correctness.
+// Virtual vertices and arcs count like real ones.
+struct MinCostFlowCounters {
+  std::int64_t dijkstra_runs {0};  // every run, the final failed one included
+  std::int64_t dijkstra_pops {0};  // heap pops, stale ones included
+  std::int64_t settled {0};        // vertices finalised, summed over runs
+  std::int64_t arc_scans {0};      // arcs examined by Dijkstra, Dinic BFS and DFS advance
+  std::int64_t dinic_phases {0};   // BFS level builds, the last unsuccessful one of a tier included
+  std::int64_t augmentations {0};  // DFS paths pushed
+};
+
+// The payload of a solve on a graph (the recorder's _solve_min_cost_flow, CentralizedTE routing).
+struct MinCostFlowResult {
+  Amount flow_value {0};
+  // Marginal cost curve: (cost, units) pairs in ascending cost, where delivering `units` more
+  // units raises the minimum total cost of the flow by `cost` per unit. Delivering more can
+  // reroute flow already placed, so the pairs are not the costs of the paths in the final
+  // allocation. Costs strictly increase; units are positive.
+  std::vector<std::pair<Cost, Amount>> marginal_cost_curve {};
+  std::vector<Amount> edge_flows {};  // per edge, id order
+  // Edges from the full residual closure of the real sources to its complement, whatever their
+  // view (an edge of view 0 adds 0 to the value), ascending id; nullopt while the destinations
+  // stay connected (a cap stopped the solve) and on an input cap of 0.
+  std::optional<std::vector<EdgeId>> min_cut {};
+  std::vector<Cost> potentials {};  // per node; kNeverReached when never settled
+  MinCostFlowCounters counters {};
+};
+
+// A solve's network in local coordinates: real vertices 0..num_nodes-1, s* = num_nodes,
+// t* = num_nodes + 1. The input is the view's edges in ascending EdgeId (tail, head, cost and
+// view capacity per edge) and the endpoint sets in ascending NodeId; the arcs are slots in
+// adjacency order (the slots of x are [off[x], off[x + 1])), each with its head, its cost and
+// the slot of its partner, in the flow core's arc order (min_cost_flow.cpp, "Arc identity"). Every
+// solver's network is within the limits of network_vertices().
+struct ResidualNetwork {
+  std::int32_t num_nodes {0};
+  std::vector<EdgeId> edges {};
+  std::vector<std::int32_t> edge_sources {};
+  std::vector<std::int32_t> edge_destinations {};
+  std::vector<Cost> cost {};
+  std::vector<Amount> edge_capacities {};
+  std::vector<std::int32_t> sources {};
+  std::vector<Amount> source_capacities {};  // per source: its virtual arc's capacity; empty: kMaxFlowCap
+  std::vector<std::int32_t> destinations {};
+  std::vector<std::int32_t> arc_offsets {};
+  std::vector<std::int32_t> arc_destinations {};
+  std::vector<std::int32_t> reverse_arcs {};
+  std::vector<Cost> arc_cost {};
+  std::vector<std::int32_t> edge_forward_arcs {};  // per edge: its forward slot (at the tail)
+  std::vector<std::int32_t> source_reverse_arcs {};    // per source: the reverse slot of its virtual arc (at the source)
+  std::vector<std::int32_t> destination_forward_arcs {};    // per destination: the forward slot of its virtual arc
+};
+
+// The number of vertices of a solve's network, num_nodes + 2 (the real vertices, then s* and
+// t*), for num_nodes >= 0. Vertex ids, arc slots and slot offsets are int32, so the vertices need
+// num_nodes <= INT32_MAX - 2, and the two slots (forward and reverse) of every edge and of every
+// virtual arc, one per source and one per destination, need
+// num_edges + num_sources + num_destinations <= 2^30 - 1 (twice that, 2^31 - 2, is the largest
+// even int32). Throws std::invalid_argument for a larger network, the node limit first ("flow
+// solver node limit exceeded", then "flow solver arc limit exceeded"). Every
+// solver takes its vertex count from here before it sizes or allocates anything of its own.
+[[nodiscard]] std::int32_t network_vertices(std::int32_t num_nodes, std::size_t num_edges,
+                                            std::size_t num_sources, std::size_t num_destinations);
+
+// The final state of a solve, captured for the deletion re-solve: bound to the
+// solve's graph (whose owner it holds), effective view and endpoint sets (copied into its
+// network, shared immutable between copies); the residual capacities, the attained value, the
+// working potentials of all N + 2 vertices, the maximum certificate and the solve's counters.
+// A copyable value: copies share the network only. Every field belongs to the one solve, so an
+// assignment is all or nothing: the copy is built aside, then exchanged by moves,
+// which never throw; a failed copy assignment leaves the target as it was.
+class DeletionState {
+public:
+  DeletionState() = default;
+  DeletionState(const DeletionState&) = default;
+  DeletionState(DeletionState&&) = default;
+  DeletionState& operator=(const DeletionState& other);
+  DeletionState& operator=(DeletionState&&) = default;
+  ~DeletionState() = default;
+
+  [[nodiscard]] const Graph& graph() const noexcept { return *graph_; }
+  [[nodiscard]] const ResidualNetwork& network() const noexcept { return *network_; }
+  [[nodiscard]] std::span<const Amount> residual() const noexcept { return arc_residual_; }  // per slot
+  [[nodiscard]] Amount value() const noexcept { return value_; }
+  // The working potentials per local vertex: the published potential plus the tier maxima of
+  // the later tiers; numeric for every vertex (never the published sentinel).
+  [[nodiscard]] std::span<const I128> potentials() const noexcept { return potentials_; }
+  // The maximum certificate: the destinations are outside the full residual closure of the
+  // real sources.
+  [[nodiscard]] bool maximum() const noexcept { return maximum_; }
+  [[nodiscard]] const MinCostFlowCounters& counters() const noexcept { return counters_; }
+  [[nodiscard]] std::vector<Amount> edge_flows() const;  // per EdgeId of the graph
+
+private:
+  friend class MinCostFlowSolver;
+  friend class DeletionResolver;
+  std::shared_ptr<const Graph> graph_ {};
+  std::shared_ptr<const ResidualNetwork> network_ {};
+  std::vector<Amount> arc_residual_ {};
+  std::vector<I128> potentials_ {};
+  Amount value_ {0};
+  bool maximum_ {false};
+  MinCostFlowCounters counters_ {};
+};
+
+// The exchange of the copy assignment, and every move, must not throw.
+static_assert(std::is_nothrow_move_constructible_v<DeletionState> && std::is_nothrow_move_assignable_v<DeletionState>);
+
+// The internal capture request of a solve: solve_min_cost_flow stores its final state in
+// `state`, bound to `graph`, the shared owner of the solve's graph. The ordinary payload does
+// not change. A request, not a value: movable, never copied.
+struct DeletionCapture {
+  DeletionCapture() = default;
+  DeletionCapture(const DeletionCapture&) = delete;
+  DeletionCapture(DeletionCapture&&) = default;
+  DeletionCapture& operator=(const DeletionCapture&) = delete;
+  DeletionCapture& operator=(DeletionCapture&&) = default;
+  ~DeletionCapture() = default;
+
+  std::shared_ptr<const Graph> graph {};
+  std::optional<DeletionState> state {};
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  // The tests' view of the solve: every Dijkstra's distances per local vertex (INT64_MAX when
+  // not reached), before its potential update.
+  std::function<void(std::span<const Cost>)> on_search {};
+#endif
+};
+static_assert(std::is_nothrow_move_constructible_v<DeletionCapture> &&
+              std::is_nothrow_move_assignable_v<DeletionCapture>);
+
+// The result of one deletion re-solve: the repaired value and its certificates.
+struct DeletionResult {
+  Amount value {0};
+  // The working potentials of all real and virtual vertices (local coordinates, s* = N and
+  // t* = N + 1), valid on every positive residual arc.
+  std::vector<I128> potentials {};
+  // The edges from the full residual closure of the real sources to its complement on the
+  // deleted view, whatever their view capacity, ascending EdgeId: value == sum(view
+  // capacity[cut]).
+  std::vector<EdgeId> min_cut {};
+  std::vector<Amount> edge_flows {};  // the final flow per EdgeId (the deleted edge 0)
+  MinCostFlowCounters counters {};       // this call's, from zero
+};
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// The tests' observation of a re-solve: the state right after the deletion (repair 0), after
+// every potential update and every push of repairs 1 to 3, and at completion (repair 4).
+struct DeletionEvent {
+  int repair {0};
+  bool push {false};
+  Amount moved {0};  // by the current repair so far
+  std::span<const Amount> residual {};
+  std::span<const I128> potentials {};
+  const MinCostFlowCounters* counters {nullptr};
+};
+struct DeletionProbe {
+  std::function<void(const DeletionEvent&)> observe {};
+  // The control of the search reuse: repair 2 reruns repair 1's failed search.
+  bool rerun_failed_search {false};
+};
+#endif
+
+class MinCostFlowSolver;
+
+// Positive-flow saturated edges crossing residual strongly connected components have
+// deletion loss equal to their baseline flow. One classification on the complete augmented
+// network, virtual arcs included; bits are per graph EdgeId. Requires a certified maximum.
+[[nodiscard]] std::vector<std::uint8_t> deletion_cut_edges(const DeletionState& state);
+
+// Deletions on one worker's copy of a captured state: every call resets the residuals and
+// potentials and deletes a real arc e = (u, v) carrying a positive amount. Full resolve() uses
+// up to three repairs with fixed endpoints (u -> v for that amount; u -> s*, then t* -> v for the remainder).
+// Scalar loss() stops after the first. The network is shared read-only with every copy of
+// the state, which keeps it alive; working buffers belong to the resolver and grow as needed.
+class DeletionResolver {
+public:
+  explicit DeletionResolver(const DeletionState& state);
+  ~DeletionResolver();
+  DeletionResolver(DeletionResolver&&) noexcept;
+  DeletionResolver& operator=(DeletionResolver&&) noexcept;
+  DeletionResolver(const DeletionResolver&) = delete;
+  DeletionResolver& operator=(const DeletionResolver&) = delete;
+
+  // Throws std::invalid_argument before any change when the state is not certified maximum or
+  // e is not an edge of the view with positive flow.
+  [[nodiscard]] DeletionResult resolve(EdgeId e);
+  // Scalar deletion loss after the first u -> v repair only, with the same preconditions
+  // and independent baseline reset as resolve(). The private intermediate amounts may be
+  // unbalanced and are never returned as an allocation.
+  [[nodiscard]] Amount loss(EdgeId e);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  [[nodiscard]] DeletionResult resolve(EdgeId e, const DeletionProbe& probe);
+  [[nodiscard]] Amount loss(EdgeId e, const DeletionProbe& probe);
+#endif
+
+private:
+  // The input index of e after the precondition checks above.
+  [[nodiscard]] std::size_t index_of(EdgeId e) const;
+  DeletionState state_;
+  std::unique_ptr<MinCostFlowSolver> solver_;
+};
+
+// Minimum-cost flow of the maximum value attainable under `cap` from the source set to the
+// destination set over the eligible edges, on the capacities `view` (units, id order). Every
+// solve starts from zero flow. `cap` nullopt is uncapped; an input cap of 0 returns the zero
+// payload without running a search. Throws std::invalid_argument before any work, in this
+// order, for a view of the wrong length or with an entry outside [0, the edge's capacity], an
+// empty or out-of-range endpoint set, a vertex in both sets, a cap outside [0, 2^63 - 2], or a
+// foreign Eligibility. Excluded endpoints are skipped. With `capture`, the final state is
+// stored there as well. A solve (a cap other than 0, or a capture) then throws
+// std::invalid_argument, before the solver sizes anything, for a network beyond the limits of
+// network_vertices(): the graph's nodes, the eligible edges, the eligible sources and
+// destinations. `source_caps` (aligned with `sources`; empty: unlimited) gives each source's
+// virtual arc its capacity, the equal source allocation's round-robin shares; it is not captured.
+[[nodiscard]] MinCostFlowResult solve_min_cost_flow(const Graph& graph, std::span<const Amount> view,
+                                                std::span<const NodeId> sources,
+                                                std::span<const NodeId> destinations, const Eligibility* eligibility,
+                                                std::optional<Amount> cap, DeletionCapture* capture = nullptr,
+                                                std::span<const Amount> source_caps = {});
+
+// The solve on an edge subset (the Optimized kernel's replacement on V_i = W + own_i over a
+// flow's split graph): flows aligned with the input edges, the value and the marginal curve.
+struct SubsetFlow {
+  Amount flow_value {0};
+  std::vector<Amount> edge_flows {};
+  std::vector<std::pair<Cost, Amount>> marginal_cost_curve {};
+};
+
+// The minimum-cost flow of the maximum value under `cap` (nullopt: uncapped) from `sources` to
+// `destinations` over the edges `edges` (ascending EdgeId, distinct) with capacities `caps`
+// (aligned with `edges`, each in [0, 2^62)). The same core and arc order as
+// solve_min_cost_flow (ascending EdgeId at every node, the virtual arc first, virtual arcs by
+// ascending endpoint NodeId), from zero flow; the vertices are compressed to the ones the edges
+// and endpoints touch, which changes no flow, curve or augmenting path. The endpoint sets are
+// ascending, distinct and disjoint; the caller validated every input. A solve (a cap other than
+// 0) throws std::invalid_argument, before the solver sizes anything, for a network beyond the
+// limits of network_vertices(): the touched vertices, the edges and the endpoints.
+// `source_caps` as in solve_min_cost_flow.
+[[nodiscard]] SubsetFlow solve_subset(const Graph& graph, std::span<const EdgeId> edges,
+                                      std::span<const Amount> caps, std::span<const NodeId> sources,
+                                      std::span<const NodeId> destinations, std::optional<Amount> cap,
+                                      std::span<const Amount> source_caps = {});
+
+// The value of solve_subset's flow with every arc's cost taken as 0: one search, then blocking
+// flows over every arc with residual capacity, a maximum flow under `cap` with no cost order (T2's
+// feasibility tests of a size). The same inputs, limits and errors as solve_subset.
+[[nodiscard]] Amount max_flow_subset(const Graph& g, std::span<const EdgeId> edges, std::span<const Amount> caps,
+                                     std::span<const NodeId> sources, std::span<const NodeId> destinations, Amount cap,
+                                     std::span<const Amount> source_caps = {});
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/node_map.hpp b/include/netgraph/core/detail/node_map.hpp
new file mode 100644
index 0000000..55afbd3
--- /dev/null
+++ b/include/netgraph/core/detail/node_map.hpp
@@ -0,0 +1,57 @@
+/* A reusable NodeId -> local index map for work on a small part of a large graph (internal). */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+#if defined(__GNUC__) || defined(__clang__)
+#define NETGRAPH_CORE_ALWAYS_INLINE __attribute__((always_inline)) inline
+#else
+#define NETGRAPH_CORE_ALWAYS_INLINE inline
+#endif
+
+namespace netgraph::core::detail {
+
+// Local indices 0.. in first-touch order, backed by dense arrays of the graph's node count
+// that are reset through the touched entries only, so a call costs O(touched) after the first
+// use. One instance per thread (`local()`); not reentrant: a caller holding it must not call
+// another routine that uses it.
+//
+// reset() sizes both arrays for the graph, so add() never allocates and is noexcept.
+// Keep add() inline: it runs in the callers' per-edge loops, where call overhead matters.
+class NodeMap {
+public:
+  void reset(std::size_t num_nodes) {
+    for (std::size_t i = 0; i < count_; ++i) slot_[static_cast<std::size_t>(nodes_[i])] = -1;
+    count_ = 0;
+    // Each array is checked against its own size: a failed growth leaves no array short of a
+    // size the other one promises.
+    if (slot_.size() < num_nodes) slot_.resize(num_nodes, -1);
+    if (nodes_.size() < num_nodes) nodes_.resize(num_nodes);
+  }
+  NETGRAPH_CORE_ALWAYS_INLINE std::int32_t add(NodeId v) noexcept {
+    auto& s = slot_[static_cast<std::size_t>(v)];
+    if (s < 0) {
+      s = static_cast<std::int32_t>(count_);
+      nodes_[count_++] = v;
+    }
+    return s;
+  }
+  [[nodiscard]] std::int32_t of(NodeId v) const noexcept { return slot_[static_cast<std::size_t>(v)]; }
+  [[nodiscard]] std::size_t size() const noexcept { return count_; }
+
+  static NodeMap& local() {
+    thread_local NodeMap map;
+    return map;
+  }
+
+private:
+  std::vector<std::int32_t> slot_ {};
+  std::vector<NodeId> nodes_ {};
+  std::size_t count_ {0};
+};
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/policy_engine.hpp b/include/netgraph/core/detail/policy_engine.hpp
new file mode 100644
index 0000000..ae8077f
--- /dev/null
+++ b/include/netgraph/core/detail/policy_engine.hpp
@@ -0,0 +1,176 @@
+/* The state of a FlowPolicy (internal). The transaction lives in
+   src/flow_policy.cpp; the evaluators, the private bindings and the tests read this state
+   through PolicyAccess. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+
+namespace netgraph::core::detail {
+
+struct DeletionCapture;
+// A detached argument search may be run by the binding; the callback and its
+// context are native stack values, invoked synchronously before any lock.
+using ArgumentWork = void (*)(void (*)(void*), void*);
+struct TunnelRoster {
+  std::vector<NodeId> heads;
+  Cost c0 {0};
+};
+enum class PolicyOperation { Place, Evaluate, Replace, Forward };
+
+// A live flow of the policy between calls. Its amounts are its ledger record (delivered; edge flows;
+// Lossy offered and edge drops; T1's holds). The flows of ShortestPaths and CentralizedTE are one per roster
+// source (ShortestPaths's sources share the epoch's program); a T1, T2 or Pinned policy's are one per
+// program entry (`entry_id`).
+struct LiveFlow {
+  std::int64_t record_counter {-1};
+  NodeId source {0};
+  std::shared_ptr<const PredecessorDAG> route {};
+  Cost min_route_cost {kUnreachable};
+  std::int32_t entry_id {-1};
+};
+
+// The state accumulated since construction or the last remove(), replace() or forward() (the
+// policy epoch): a value, so a full-offer call builds its own and publishes it whole.
+struct PolicyEpoch {
+  // The live flows: per roster index (ShortestPaths and CentralizedTE: one per source), or per program entry
+  // (T1, T2, Pinned).
+  std::vector<std::vector<LiveFlow>> record_groups {};
+  // The installed program (null before the first preparation) and, for T1 and T2, its setup summary
+  // (shared, never changed: a policy without tunnels carries a null pointer, not a TunnelPlan).
+  std::shared_ptr<const ForwardingProgram> program {};
+  std::shared_ptr<const TunnelPlan> plan {};
+  // ShortestPaths Optimized: the union of the roster's routes, the controller's support (ascending).
+  std::vector<EdgeId> support {};
+  // Unrestricted CentralizedTE with the optimized source allocation: the cumulative marginal curve of the last solve
+  // (absent before one, and after a forward).
+  std::optional<std::vector<std::pair<Cost, Amount>>> marginal_cost_curve {};
+  // Pinned, Lossy: per view head, the shares it lost itself (black-holed, no surviving entry).
+  std::vector<Counter128> source_drops_by_source {};
+  // The by_tunnel rows of the state (a zero call reports them).
+  std::vector<TunnelFlow> by_tunnel {};
+  Counter128 requested {};
+  Counter128 offered {};  // Lossy: the traffic sent (with an empty roster: lost at the sources)
+  bool infinite {false};
+  bool prepared {false};  // the epoch's first positive call (or a full-offer call) has run
+};
+
+struct PolicyEngine {
+  PolicyEngine(FlowLedger& ledger, FlowPolicyConfig&& config) : ledger(ledger), config(std::move(config)) {}
+
+  FlowLedger& ledger;
+  std::shared_ptr<const Graph> graph {};
+  FlowPolicyConfig config;       // validated, source allocation and weight basis resolved
+  // The model's route choice: ShortestPaths' fields, DistributedTE's tie rule and parallel_edges as
+  // a single path, the default for CentralizedTE and Pinned (unread).
+  RouteChoice route_choice {};
+  SourceAllocation source_allocation {SourceAllocation::Equal};  // source_allocation_of(routing), or Equal for Pinned (unread)
+  const Eligibility* eligibility {nullptr};
+  // T2 on a support: the policy's mask with every edge outside the support excluded too (the
+  // one allowed set of every T2 step); `eligibility` points to it.
+  std::unique_ptr<const Eligibility> support_mask {};
+  std::vector<NodeId> sources {};       // the normalised sets
+  std::vector<NodeId> destinations {};
+  std::vector<NodeId> allowed_destinations {};      // the allowed destinations (the records' destination set)
+  std::vector<NodeId> reachable_sources {};        // fixed at construction, ascending
+  Cost c0 {0};                          // T1 with a CostStretch ceiling: the smallest static shortest cost
+                                        // over the roster heads (the pool baseline)
+  std::shared_ptr<const PredecessorDAG> support {};  // ShortestPaths: the full static support
+  // CentralizedTE with a support: the trimmed support (ascending), shared with its programs' replay basis.
+  std::shared_ptr<const std::vector<EdgeId>> centralized_te_support {};
+  // Unrestricted CentralizedTE, T1 and T2: the mask's excluded nodes and edges (ascending), their programs'
+  // replay basis.
+  std::vector<NodeId> excluded_nodes {};
+  std::vector<EdgeId> excluded_edges {};
+  // Pinned: its program as this policy forwards it (the replay under the mask, the black holes),
+  // and whether any head can place traffic (some head with a positive injection weight and a
+  // surviving entry of positive weight with a usable route).
+  ForwardingView view {};
+  bool can_forward {false};
+  std::int64_t policy_id {0};
+  PolicyEpoch epoch {};
+  // Argument-only classification, fixed at construction. A successful static split
+  // preparation is owned across epochs, separately from the visible installed program.
+  bool static_preparation {false};
+  std::shared_ptr<const ForwardingProgram> kept_program {};
+  // CentralizedTE: a capture request for the next solve's final state (the exact sensitivity model's
+  // baseline); set and cleared by the evaluator.
+  DeletionCapture* capture {nullptr};
+};
+
+// The internal access to a policy's engine (the pattern of LedgerAccess): FlowPolicy's public
+// interface is the documented API; everything else reaches the state here.
+struct PolicyAccess {
+  [[nodiscard]] static bool constructed(const FlowPolicy& policy) noexcept { return policy.ready_.load(std::memory_order_acquire); }
+  [[nodiscard]] static const PolicyEngine& engine(const FlowPolicy& policy) noexcept { return *policy.engine_; }
+  [[nodiscard]] static PolicyEngine& engine(FlowPolicy& policy) noexcept { return *policy.engine_; }
+  // Argument-only construction work, performed before a cache lease or ledger gate.
+  [[nodiscard]] static std::unique_ptr<PolicyEngine> prepare(FlowLedger& ledger, std::span<const NodeId> sources,
+      std::span<const NodeId> destinations, FlowPolicyConfig config, const Eligibility* eligibility, ShortestPathCache* cache,
+      const TunnelRoster* roster = nullptr, ArgumentWork search = nullptr);
+  // An unbound, destructible shell; installation is the only publishing step.
+  [[nodiscard]] static std::unique_ptr<FlowPolicy> shell();
+  static void construct(FlowPolicy& policy, std::unique_ptr<PolicyEngine> prepared, ShortestPathCache* cache);
+  // A policy constructed inside another public call, whose tally records a supplied frozen
+  // cache's hits; returned as a prvalue (FlowPolicy does not move).
+  [[nodiscard]] static FlowPolicy make(FlowLedger& ledger, std::span<const NodeId> sources,
+                                       std::span<const NodeId> destinations, FlowPolicyConfig config,
+                                       const Eligibility* eligibility, ShortestPathCache* cache, FrozenCacheHitTally& tally, const TunnelRoster* roster = nullptr) {
+    return FlowPolicy(ledger, sources, destinations, std::move(config), eligibility, cache, tally, roster);
+  }
+};
+
+// The configuration checks of FlowPolicy, shared with the evaluators' argument checks, in
+// FlowPolicyConfig's order (flow_policy.hpp): the enumeration values, the model matrix with a
+// supplied ShortestPathCache last (`cache` says whether one is supplied), the tunnel models'
+// parameters, edge_weights against num_edges and source_weights against num_nodes. With num_sources (the
+// normalized input sources) the two source-count rules run at their places in the matrix (T2's
+// several-sources rule first, the pooled single-path rule after the ineffective tie rule);
+// evaluate_pairs checks them per pair with check_source_count. Then, with the roster size, the
+// tunnel limit (check_tunnel_limit).
+void check_config(const FlowPolicyConfig& config, bool cache, std::int32_t num_nodes, std::int32_t num_edges, std::optional<std::size_t> num_sources);
+void check_source_count(const FlowPolicyConfig& config, std::size_t num_sources);
+// The policy's snapshot: ShortestPaths' absent source_allocation and an absent weight_basis of
+// Weighted resolved.
+[[nodiscard]] FlowPolicyConfig resolved_config(FlowPolicyConfig config);
+// The resolved source allocation of a computing model; none for Pinned (its program has one).
+[[nodiscard]] std::optional<SourceAllocation> source_allocation_of(const Routing& r) noexcept;
+void check_tunnel_limit(const FlowPolicyConfig& cfg, std::size_t num_heads);
+// Construction's immutable checks, shared with evaluator preflight. Endpoints are
+// normalized here before graph ownership and model checks.
+std::optional<TunnelRoster> check_policy_construction(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const FlowPolicyConfig& config,
+    const Eligibility* eligibility, const ShortestPathCache* cache, ArgumentWork search = nullptr);
+// place()'s first check, before its offer is read (the binding runs it before converting it): T1
+// and T2 raise `<model> does not support incremental placement`.
+void check_place_operation(const PolicyEngine& pe);
+// forward()'s first check, before its offer is read (the binding runs it before converting
+// it): `Pinned forwards with replace`. The installed program is checked under the
+// gate, after every argument check.
+void check_forward_operation(const PolicyEngine& pe);
+void check_policy_offer(const PolicyEngine& pe, PolicyOperation operation, std::optional<Amount> offer);
+void check_policy_design_model(const PolicyEngine& pe);
+// All argument/immutable checks of a scalar call. No epoch or ledger state is read.
+void check_policy_arguments(const PolicyEngine& pe, PolicyOperation operation, std::optional<Amount> offer,
+    const std::optional<std::optional<Amount>>& design = {}, const Eligibility* black_holes = nullptr);
+void check_list_arguments(FlowLedger& ledger, std::span<const Action> actions, BatchMode mode, const OutputOptions& outputs);
+// The model's name in messages: ShortestPaths, CentralizedTE, T1 (DistributedTE), T2 (CentralizedTE with tunnel_count) or
+// Pinned.
+[[nodiscard]] const char* model_name(const Routing& r) noexcept;
+// The model's class name, T2 included (CentralizedTE): the cache rule and the evaluators' texts.
+[[nodiscard]] const char* model_class(const Routing& r) noexcept;
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/private_hooks.hpp b/include/netgraph/core/detail/private_hooks.hpp
new file mode 100644
index 0000000..5308574
--- /dev/null
+++ b/include/netgraph/core/detail/private_hooks.hpp
@@ -0,0 +1,33 @@
+/* The private hooks of the development build (internal). CMake option NETGRAPH_CORE_PRIVATE_HOOKS:
+   ON for the editable development build and the test suites, OFF for an installed wheel. The
+   hooks declared here are test controls and diagnostics the tests compare with their
+   independent model of the policy; none of them is public API: the transaction trace.
+   Without the option it is not built: every trace write is a compile-time-dead branch (kTraced),
+   so only empty trace values are built. */
+#pragma once
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+
+namespace netgraph::core::detail {
+
+// Whether this build traces placement calls (the private hooks).
+inline constexpr bool kTraced = NETGRAPH_CORE_PRIVATE_HOOKS != 0;
+
+} // namespace netgraph::core::detail
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+
+#include <optional>
+
+#include "netgraph/core/detail/trace.hpp"
+#include "netgraph/core/flow_policy.hpp"
+
+namespace netgraph::core::detail {
+
+// FlowPolicy::place with a native trace. Python conversion is a separate read,
+// after the operation has released the ledger gate.
+PlacementResult place_traced(FlowPolicy& policy, std::optional<Amount> offer, const OutputOptions& outputs, Trace& trace);
+
+} // namespace netgraph::core::detail
+
+#endif
diff --git a/include/netgraph/core/detail/program_data.hpp b/include/netgraph/core/detail/program_data.hpp
new file mode 100644
index 0000000..fb3b6fc
--- /dev/null
+++ b/include/netgraph/core/detail/program_data.hpp
@@ -0,0 +1,264 @@
+/* The inside of a ForwardingProgram (internal): its entries, split contexts, injection and replay
+   basis, the builders the models use, and the comparisons of the change flags. The public value
+   (forwarding_program.hpp) shows only the endpoints, the tunnels and the source weights. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+
+namespace netgraph::core::detail {
+
+// A tunnel's path in walk order (empty for a tunnel that is down).
+[[nodiscard]] inline std::span<const EdgeId> path_of(const Tunnel& t) noexcept {
+  return t.edges.has_value() ? std::span<const EdgeId>(*t.edges) : std::span<const EdgeId> {};
+}
+
+// One entry: a tunnel (tunnels()[tunnel_position]) or a split route (a root of
+// split_contexts[split_context_position]). `roster_index` is the head's position in the roster;
+// `route` the entry's route as a DAG (a split route's edges before weight pruning; null for a
+// tunnel, whose path the record's route is made from when a Pinned policy needs it) and
+// `min_route_cost` its minimum walk cost.
+struct ProgramEntry {
+  std::int32_t entry_id {0};
+  NodeId head {0};
+  std::int32_t roster_index {0};
+  std::int32_t local_index {0};
+  Amount weight {0};
+  std::int32_t tunnel_position {-1};
+  std::int32_t split_context_position {-1};
+  std::shared_ptr<const PredecessorDAG> route {};
+  Cost min_route_cost {kUnreachable};
+};
+
+// A split context: one plan whose roots are the heads it serves (a ShortestPaths program: the whole
+// roster, pooled; a supplied split route: its head alone), and per root the entry it carries.
+// `route` (ascending) is the context's edges before weight pruning, the replay basis of its
+// members.
+struct SplitContext {
+  std::shared_ptr<const PreparedRoute> prepared_route {};  // its route: the context's edges before weight pruning
+  // Per plan root: its entry's position in entries (every root has one), in the program's block
+  // (initialize_storage).
+  std::span<const std::int32_t> source_entry_positions {};
+};
+
+struct ProgramData {
+  ProgramData() = default;
+  // The lists below are views of the data's own block (initialize_storage): a copy would read the
+  // original's block, so there is none; a move keeps the block and with it the views.
+  ProgramData(const ProgramData&) = delete;
+  ProgramData& operator=(const ProgramData&) = delete;
+  ProgramData(ProgramData&&) noexcept = default;
+  ProgramData& operator=(ProgramData&&) noexcept = default;
+  ~ProgramData() = default;
+
+  std::uint64_t graph_uid {0};
+  std::span<const NodeId> sources {};       // ascending
+  std::span<const NodeId> destinations {};  // ascending
+  std::vector<Tunnel> tunnels {};
+  std::optional<std::vector<std::pair<NodeId, Amount>>> source_weights {};
+  // The injection: the roster (the heads with an entry, ascending; T1, T2: the policy's roster), its
+  // captured weights (empty: equal sources), every entry in ascending index, per roster slot its
+  // entries (ascending index).
+  std::span<const NodeId> reachable_sources {};
+  std::vector<Amount> source_weight_values {};
+  std::vector<ProgramEntry> entries {};
+  // Per roster slot its entries (entries_for_source): slot s's are source_entry_positions[source_entry_offsets[s]..source_entry_offsets[s+1]),
+  // ascending index; both empty for a pooled program.
+  std::span<const std::int32_t> source_entry_offsets {};
+  std::span<const std::int32_t> source_entry_positions {};
+  std::span<const std::int32_t> tunnel_entry_positions {};  // per tunnel: its entry
+  std::vector<SplitContext> split_contexts {};
+  // The replay basis: the topology under the producer's exclusions (topology: unrestricted
+  // CentralizedTE), or per roster slot the edges of its original routes (basis_parts).
+  bool uses_topology_basis {false};
+  std::span<const NodeId> excluded_nodes {};  // ascending
+  std::span<const EdgeId> excluded_edges {};  // ascending (an edge whose endpoint is excluded included)
+  std::shared_ptr<const std::vector<EdgeId>> common_replay_support {};  // every slot's (a supported CentralizedTE)
+  std::vector<std::shared_ptr<const PredecessorDAG>> source_supports {};    // per slot its route (ShortestPaths Optimized)
+  // A slot's replay basis as edge sets, appended to `out` (each ascending, except a tunnel's path,
+  // in walk order: `second` false): the shared route or edge set above, else (supplied and ShortestPaths
+  // split programs) the slot's own entries' routes: a tunnel's edges, a split route's route DAG (its
+  // edges before weight pruning). Nothing is copied.
+  void basis_parts(std::size_t slot, std::vector<std::pair<std::span<const EdgeId>, bool>>& out) const;
+  // One pooled context carries every entry: a single context whose roots are the roster, one entry
+  // of positive weight per head, equal sources (a ShortestPaths program; a supplied program of one
+  // split route of positive weight). Its forwarding is the plan's own kernels.
+  bool pools_source_inflows {false};
+  // A slot's entries, ascending index: a pooled program's slot carries the one entry its context
+  // root carries (no per-slot lists are kept).
+  [[nodiscard]] std::span<const std::int32_t> entries_for_source(std::size_t slot) const noexcept {
+    if (pools_source_inflows) return {&split_contexts.front().source_entry_positions[slot], 1};
+    const auto first = static_cast<std::size_t>(source_entry_offsets[slot]);
+    return {source_entry_positions.data() + first, static_cast<std::size_t>(source_entry_offsets[slot + 1]) - first};
+  }
+  // The last step of every producer, after its entries, tunnels, contexts and `pooled` are set:
+  // the lists above copied into one block (one allocation; a failure leaves the data without
+  // lists, to be discarded), the roster (given, or the entries' heads, ascending and distinct),
+  // each entry's slot and local index (its position among its slot's entries), each tunnel's
+  // local index, the per-slot lists (a stable counting sort by slot), the per-tunnel entries and
+  // each context's root entries (the entry whose head is the root).
+  void initialize_storage(std::span<const NodeId> sources, std::span<const NodeId> destinations,
+               std::optional<std::span<const NodeId>> reachable_sources, std::span<const NodeId> excluded_nodes = {},
+               std::span<const EdgeId> excluded_edges = {});
+  // The block the lists view (the ownership tests).
+  [[nodiscard]] std::span<const std::int32_t> block() const noexcept { return store_; }
+  // Some entry has a path: an up tunnel or a split route (the condition of termination rule (3);
+  // a program of down tunnels only, or without entries, has none).
+  [[nodiscard]] bool has_path() const noexcept {
+    for (const auto& entry : entries) {
+      if (entry.tunnel_position < 0 || tunnels[static_cast<std::size_t>(entry.tunnel_position)].edges.has_value()) return true;
+    }
+    return false;
+  }
+
+private:
+  std::vector<std::int32_t> store_ {};
+};
+
+// A program and its data in one allocation (ProgramAccess::make).
+struct ProgramBlock {
+  explicit ProgramBlock(ProgramData&& d) : data(std::move(d)), program(&data) {}
+  ProgramData data;
+  ForwardingProgram program;
+};
+
+struct ProgramAccess {
+  [[nodiscard]] static const ProgramData& data(const ForwardingProgram& p) noexcept { return *p.data_; }
+  [[nodiscard]] static std::shared_ptr<const ForwardingProgram> make(ProgramData&& data);
+  // Endpoints/options/entries have all passed their ordered checks. Construction
+  // does not repeat route validation; native and Python entries share this builder.
+  [[nodiscard]] static std::shared_ptr<const ForwardingProgram> from_checked_routes(
+      std::span<const NodeId> sources, std::span<const NodeId> destinations,
+      std::span<const RouteDefinition> routes, ProgramData&& data);
+};
+
+// Check each supplied entry in order, preparing its private storage in the same
+// pass. A later refusal discards it all. Endpoints/options have already passed
+// their checks; no program is published until from_checked_routes finishes it.
+[[nodiscard]] ProgramData check_route_definitions(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, std::span<const RouteDefinition> routes, const RouteOptions& options);
+
+// A controller's path (CentralizedTE, ShortestPaths Optimized): its source's roster position, its edges in walk
+// order, its amount.
+struct OptimizedFlowPath {
+  std::int32_t roster_index {0};
+  std::vector<EdgeId> edges {};
+  Amount weight {0};
+};
+
+// A flow cut into paths, source by source in ascending NodeId: while a source has supply
+// left (its net outflow), take the smallest EdgeId sequence with positive remaining flow, stopping
+// at the first destination; assign min(supply left, smallest remaining edge flow on that walk),
+// subtract it, record the walk as one path (`slot`: the source's position in `roster`). `edges`
+// (ascending) are the flow's edges and `rem` is aligned with them, or `edges` is empty and `rem`
+// has one entry per EdgeId. Per source also its share (the edges and amounts its paths use,
+// ascending) and its supply. A unit flow cut this way gives the unit walks of T2's program (each
+// path repeated `amount` times). std::logic_error when the flow is not conserved, has a positive
+// cycle or is not covered by the walks.
+struct Decomposition {
+  std::vector<OptimizedFlowPath> paths {};
+  std::vector<std::vector<std::pair<EdgeId, Amount>>> shares {};
+  std::vector<Amount> supplies {};
+};
+[[nodiscard]] Decomposition decompose(const Graph& g, std::span<const EdgeId> edges, std::vector<Amount> rem,
+                                      std::span<const NodeId> roster, std::span<const NodeId> dests);
+
+// A controller program's replay basis: the topology under the producer's exclusions (its excluded
+// nodes and edges, ascending), per roster source its route, or one edge set for every source
+// (both shared, not copied).
+struct ReplayBasis {
+  bool uses_topology_basis {false};
+  std::span<const NodeId> excluded_nodes {};
+  std::span<const EdgeId> excluded_edges {};
+  std::vector<std::shared_ptr<const PredecessorDAG>> source_supports {};
+  std::shared_ptr<const std::vector<EdgeId>> common_support {};
+};
+
+// The program of a controller: one tunnel per path in decomposition order (index = position),
+// weight = amount. `supplies` holds captured per-roster weights: solved supplies for Optimized,
+// declared weights for Weighted CentralizedTE; empty selects equal source allocation.
+[[nodiscard]] std::shared_ptr<const ForwardingProgram> optimized_flow_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> reachable_sources, std::vector<OptimizedFlowPath> paths, std::span<const Amount> supplies,
+    ReplayBasis basis);
+
+// The program of a pooled split demand: one split route per roster source in the one pooled
+// context `plan` (rooted at the roster); `entries` one per roster source in roster order (its
+// record route, the source's route before weight pruning and its replay basis, and its route cost
+// set; index, slot, weight 1 and context are set here).
+[[nodiscard]] std::shared_ptr<const ForwardingProgram> shortest_path_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> reachable_sources, std::shared_ptr<const PreparedRoute> plan, std::vector<ProgramEntry> entries);
+
+// The one pooled DAG builder, shared by ShortestPaths Equal/Weighted and from_dag: the plan of
+// `dag` rooted at the roster (the allocation, Equal or Weighted, and the weight source: explicit
+// weights edge-aligned, a snapshot aligned with the DAG's ascending edges), then the program of
+// shortest_path_program. A plan does not depend on the admission. ShortestPaths with one roster
+// source, multipath and a static weight basis builds its plan in one pass instead
+// (prepare_shortest_paths, the same plan as this builder's of that source's route) and passes it to
+// shortest_path_program directly.
+[[nodiscard]] std::shared_ptr<const ForwardingProgram> pooled_dag_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> roster, const PredecessorDAG& dag, RouteAllocation allocation,
+    const WeightSource& weights, std::vector<ProgramEntry> entries);
+
+// A T1 or T2 tunnel as its computation leaves it: its roster slot and round, T1's request, its
+// status and (up) its path in walk order with its cost, T2's planned bandwidth (0 for T1).
+struct TunnelSetupResult {
+  std::int32_t roster_index {0};
+  std::int32_t local_index {0};
+  Amount requested_bandwidth {0};
+  TunnelStatus status {TunnelStatus::Up};
+  std::vector<EdgeId> edges {};
+  Cost path_cost {0};
+  Amount planned {0};
+};
+
+// The program of T1 or T2: the policy's roster (every head, an entry or not: T2's dead heads have
+// none), its tunnels in round order (`tunnels`: round-major, heads in roster order, so index =
+// round * H + slot, a dead head's positions left as holes), weight 1 up and 0 down, reserved =
+// requested up and 0 down, planned as given; equal sources; the replay basis the topology under
+// the policy's exclusions (ascending).
+[[nodiscard]] std::shared_ptr<const ForwardingProgram> distributed_te_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> reachable_sources, std::vector<TunnelSetupResult> tunnels, std::span<const NodeId> excluded_nodes,
+    std::span<const EdgeId> excluded_edges);
+
+// The empty program of an empty roster (no entry).
+[[nodiscard]] std::shared_ptr<const ForwardingProgram> empty_program(std::uint64_t graph_uid,
+                                                                    std::span<const NodeId> sources,
+                                                                    std::span<const NodeId> destinations,
+                                                                    bool captured);
+
+// The change flags (routes_changed, weights_changed, reservations_changed) between an old program (null: none) and a new one: routes (the ordered
+// heads, the entries' kinds and routes, split tables, duplicates), weights (the injection, every
+// entry and split-table weight, an absent entry counting as weight 0) and reservations (every
+// tunnel's requested and reserved amounts by index, an absent tunnel counting as (0, 0)). Two
+// programs without an entry are equal. With `reservations` false (a call that books no holds) the
+// reservation comparison is skipped and reported as no change.
+struct ProgramChange {
+  bool routes {false};
+  bool weights {false};
+  bool reservations {false};
+};
+[[nodiscard]] ProgramChange compare_programs(const ForwardingProgram* before, const ForwardingProgram* after,
+                                             bool reservations = true) noexcept;
+
+// Validation of the options of from_routes and from_dag (`function`) before any route is read
+// (in order: options on a list of paths only, the allocation, the weight basis's combination), shared with the binding, which reads the entries of edge_weights and residual itself
+// after these checks.
+void check_route_options(const char* function, bool any_dag, std::optional<RouteAllocation> allocation,
+                         std::optional<WeightBasis> weight_basis, bool edge_weights, bool residual);
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/route_builders.hpp b/include/netgraph/core/detail/route_builders.hpp
new file mode 100644
index 0000000..dd8ce42
--- /dev/null
+++ b/include/netgraph/core/detail/route_builders.hpp
@@ -0,0 +1,59 @@
+/* Internal construction of PredecessorDAG values from trusted inputs (search output, flow routes,
+   Path::to_dag) and read access to their sparse storage. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/route_structures.hpp"
+
+namespace netgraph::core::detail {
+
+// Input checks shared by native factories and Python's attached argument pass.
+void check_csr(const Graph& graph, std::span<const std::int32_t> offsets,
+               std::span<const NodeId> parents, std::span<const EdgeId> via);
+void check_hops(const Graph& graph, const std::vector<std::vector<EdgeId>>& hops);
+
+struct PredecessorDAGBuilder {
+  // The same arrays after check_csr; builds owned storage without repeating validation.
+  [[nodiscard]] static PredecessorDAG of_csr(const Graph& graph, std::span<const std::int32_t> offsets,
+      std::span<const NodeId> parents, std::span<const EdgeId> via);
+  // Build a DAG from acyclic, duplicate-free edges; callers guarantee these preconditions.
+  // Group predecessor entries (edge source, e) by node, with ascending EdgeId within each node.
+  // For graph node count N and 8 |edges| < N, sort in O(|edges| log |edges|) without graph-sized
+  // scratch. Otherwise use stable counting sort with an N + 1 temporary in O(|edges| + N),
+  // sorting first if edges are not ascending. Retained storage never scales with graph size.
+  [[nodiscard]] static PredecessorDAG of_edges(const Graph& graph, std::span<const EdgeId> edges);
+  // The DAG without entries.
+  [[nodiscard]] static PredecessorDAG empty(const Graph& graph);
+  // A DAG from its finished parts (the searches' emission): `nodes` the children with entries
+  // (ascending), `offsets` their entry ranges (nodes.size() + 1, from 0), `parents` and `via` the
+  // entries (ascending via within a child), `ascending` the via in ascending EdgeId.
+  [[nodiscard]] static PredecessorDAG of_parts(const Graph& graph, std::vector<NodeId> nodes, std::vector<std::int32_t> offsets,
+                                        std::vector<NodeId> parents, std::vector<EdgeId> via,
+                                        std::vector<EdgeId> ascending);
+  // A Path's DAG: hop h's members (ascending) are the entries of child nodes[h + 1], all with
+  // the parent nodes[h]; the nodes are distinct.
+  [[nodiscard]] static PredecessorDAG of_path(std::uint64_t graph_uid, std::int32_t num_nodes,
+                                       const std::vector<std::vector<EdgeId>>& hops, const std::vector<NodeId>& nodes);
+  // The DAG's edges in ascending EdgeId, without a copy (kept by the DAG since construction).
+  [[nodiscard]] static std::span<const EdgeId> ascending(const PredecessorDAG& dag) noexcept;
+  // The sparse storage: the member nodes (ascending) and their entry offsets (size + 1).
+  [[nodiscard]] static std::span<const NodeId> member_nodes(const PredecessorDAG& dag) noexcept;
+  [[nodiscard]] static std::span<const std::int32_t> member_offsets(const PredecessorDAG& dag) noexcept;
+  // The retained payload in bytes (every stored array; the ShortestPathCache's `bytes` statistic).
+  [[nodiscard]] static std::size_t payload_bytes(const PredecessorDAG& dag) noexcept;
+};
+
+// Internal construction of Path values from trusted walks (the searches' results): the checks of
+// Path's constructor hold by construction, so none is repeated (no per-path O(E) scan).
+struct PathBuilder {
+  // A walk of single-member hops [[e1], [e2], ...].
+  [[nodiscard]] static Path of_walk(const Graph& graph, std::span<const EdgeId> walk);
+  // Contiguous hops of parallel members (each hop's members share (u, v); no node repeats).
+  [[nodiscard]] static Path of_hops(const Graph& graph, std::vector<std::vector<EdgeId>> hops);
+};
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/route_kernels.hpp b/include/netgraph/core/detail/route_kernels.hpp
new file mode 100644
index 0000000..727f5c2
--- /dev/null
+++ b/include/netgraph/core/detail/route_kernels.hpp
@@ -0,0 +1,319 @@
+/* Placement kernels assign the amounts of a plan's injections to route edges. Apportionment
+   splits an integer total among recipients.
+
+   A plan freezes the route, its split graph and any Weighted weights at creation. It has one or
+   more roots: the sources that inject (one for a flow of a single source; a ShortestPaths demand's
+   roster for its pooled program). The split graph keeps edges allowed by the kernel that lie on
+   a walk from a root to a destination; it removes edges leaving destinations. Its edges are the
+   plan's members. A router reached by several roots adds their traffic and splits it once.
+   A member-aligned array has one entry per member, in the same order as plan.forwarding_edges. Policies
+   combine these allocations; the ledger commits them.
+*/
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+// ---------------------------------------------------------------- apportionment
+
+// Round robin: give floor(total / k) to each of k recipients, plus one to the first
+// total mod k in caller order. Edge shares use ascending EdgeId; shares among a source's
+// flows use flow order. Used by Equal (Lossless and Lossy) at every node and to split a
+// source's amount over its flows.
+// Visit only the n positive shares (n = min(total, k)); later entries stay 0 in a zeroed output.
+// The callback form computes the split once and calls share(i, x) in index order for i in
+// [0, n). Stop if it returns false; return the accepted count: n, or that rejected index i.
+// The span form writes out[0 .. n), where k = out.size(), and returns n. round_robin_share is the
+// rule itself: the share of recipient i in [0, k) (T1's head designs and tunnel requests use it).
+constexpr Amount round_robin_share(Amount total, Amount k, Amount i) noexcept {
+  return total / k + (i < total % k ? 1 : 0);
+}
+
+template <class Share>
+inline std::size_t round_robin(Amount total, std::size_t k, Share&& share) {
+  const auto kk = static_cast<Amount>(k);
+  const std::size_t n = total / kk == 0 ? static_cast<std::size_t>(total % kk) : k;
+  for (std::size_t i = 0; i < n; ++i) {
+    if (!share(i, round_robin_share(total, kk, static_cast<Amount>(i)))) return i;
+  }
+  return n;
+}
+
+// The round-robin increments when a cumulative total X (any 128-bit count) grows by v over k =
+// out.size() recipients: out[i] = RR(X + v, k, i) - RR(X, k, i). They depend only on r = X mod k:
+// floor((r + v) / k) + [i < (r + v) mod k] - [i < r] (ShortestPaths' Lossy offers and a program's
+// equal sources).
+void round_robin_increments(const Counter128& total, Amount v, std::span<Amount> out) noexcept;
+
+inline std::size_t round_robin(Amount total, std::span<Amount> out) noexcept {
+  return round_robin(total, out.size(), [&](std::size_t i, Amount x) noexcept {
+    out[i] = x;
+    return true;
+  });
+}
+
+// Highest averages H(total, w) (Jefferson/D'Hondt; Weighted splits and the attribution of
+// pooled traffic to sources): give each next unit to the member with largest w / (a + 1), where w
+// is its weight and a its allocation so far. Break ties by lower member index. Start each member
+// at its lower quota floor(total * w / W), where W is the weight sum; then assign the fewer than k
+// remaining units by those quotients, comparing with exact 128-bit cross products. Weights are
+// in [0, 2^62) (their sum is exact, any size), total < 2^63: a zero weight gets nothing, and all-zero weights give
+// nothing (out all 0). Equal positive weights give round robin. Increasing total never reduces
+// any member's allocation (house monotonicity).
+void highest_averages(Amount total, std::span<const Amount> weights, std::span<Amount> out);
+
+// The same rule for cumulative offered totals below 2^127. Weight sums stay
+// below 2^93 (fewer than 2^31 members). Quotas/priorities use exact 192-bit products.
+struct U128;
+void highest_averages(U128 total, std::span<const Amount> weights, std::span<U128> out);
+
+// ---------------------------------------------------------------- plans
+
+// Throws std::invalid_argument for a value outside its enumeration and for the unsupported
+// combination (Lossy with Optimized: "OPTIMIZED requires admission=LOSSLESS").
+void check_kernel(RouteAllocation allocation, Admission admission);
+// The combination rule of check_kernel alone, for a caller that has already checked the
+// enumerations (check_config).
+void check_kernel_combination(RouteAllocation allocation, Admission admission);
+
+// Where a Weighted plan's member weights come from (ignored by the other kernels): Capacity, the
+// static capacity; Explicit, `values` per EdgeId (one entry per edge; a positive weight on an edge
+// of capacity 0 is 0); ResidualSnapshot, `values` aligned with the route's edges in ascending
+// EdgeId (the free capacity read on the creation view). A route edge of weight 0 is no member.
+struct WeightSource {
+  WeightBasis basis {WeightBasis::Capacity};
+  std::span<const Amount> values {};
+};
+
+struct PreparedRoute {
+  RouteAllocation allocation {RouteAllocation::Optimized};
+  std::vector<EdgeId> support_edges {};      // ascending: the plan's route (a single flow's record route)
+  std::vector<EdgeId> forwarding_edges {};    // ascending: the split graph
+  std::vector<Amount> weights {};    // Weighted: per member (positive), frozen; else empty
+  // Destinations ascend. Nodes have a topological order: every member's tail precedes its head
+  // (a single root comes first). Position p's out-members are members[outgoing_begin[p] ..
+  // outgoing_end[p]); they are consecutive in ascending EdgeId because EdgeIds sort by source first.
+  // Each member also stores its head's position. Empty split graph means empty structure. The
+  // roots (ascending: the sources that inject) and per root its position, or -1 when it has no
+  // member. All views share one block owned by the plan (layout()), so the structure takes one
+  // allocation whatever the number of roots.
+  std::span<const NodeId> sources {};
+  std::span<const std::int32_t> source_positions {};
+  std::span<const NodeId> destinations {};
+  std::span<const NodeId> topological_order {};
+  std::span<const std::int32_t> outgoing_begin {};
+  std::span<const std::int32_t> outgoing_end {};
+  std::span<const std::int32_t> edge_destination_positions {};
+  std::span<const std::uint8_t> is_destination {};
+
+  PreparedRoute() = default;
+  PreparedRoute(const PreparedRoute& other);
+  PreparedRoute(PreparedRoute&& other) noexcept;
+  PreparedRoute& operator=(const PreparedRoute& other);
+  PreparedRoute& operator=(PreparedRoute&& other) noexcept;
+  ~PreparedRoute() = default;
+
+  // The writable views of a new block: the roots and the destinations copied in, every root's
+  // position -1, the structure for `positions` nodes and `num_members` members zeroed. One
+  // allocation, made before anything changes (a failure leaves the plan as it was); the previous
+  // block is released.
+  struct Layout {
+    std::span<std::int32_t> source_positions;
+    std::span<NodeId> topological_order;
+    std::span<std::int32_t> outgoing_begin;
+    std::span<std::int32_t> outgoing_end;
+    std::span<std::int32_t> edge_destination_positions;
+    std::span<std::uint8_t> is_destination;
+  };
+  Layout layout(std::span<const NodeId> roots, std::span<const NodeId> destinations, std::size_t positions,
+                std::size_t num_members);
+
+private:
+  // Points the views into store_ for these sizes (the layout's order: sources, source_positions,
+  // destinations, topological_order, outgoing_begin, outgoing_end, edge_destination_positions,
+  // then is_destination as bytes).
+  Layout point(std::size_t num_roots, std::size_t num_dsts, std::size_t positions, std::size_t num_members) noexcept;
+  std::vector<std::int32_t> store_ {};
+};
+
+// The edges of `dag` that `eligibility` allows (every one when null) and that lie on some walk from
+// `source` to the destination set (edges leaving a destination removed: destinations are terminal),
+// ascending.
+[[nodiscard]] std::vector<EdgeId> prune(const Graph& graph, const PredecessorDAG& dag, NodeId source,
+                                        std::span<const NodeId> destinations, const Eligibility* eligibility = nullptr);
+
+// The minimum walk cost from `source` to the destination set over `route` (a record's route:
+// its min_route_cost); kUnreachable when the route has no such walk. The split-graph builder's
+// cost pass alone: no plan is built.
+[[nodiscard]] Cost min_route_cost(const Graph& graph, const PredecessorDAG& route, NodeId source,
+                              std::span<const NodeId> destinations);
+
+// The plan of a new flow on `route` (acyclic; the flow's DAG or path, its record's route), its
+// Weighted weights from `weights` (a WeightSource; its creation view aligned with the route's edges
+// in ascending EdgeId): Optimized and Equal every route edge (an edge of capacity 0 is a
+// member that carries nothing: Equal still gives it its round-robin share), Weighted the
+// edges of positive weight, with those weights; Lossy keeps its kernel's membership. The members
+// are pruned to the walks from `source` to the destination set (none leaving a destination) and
+// given their topological structure, in one pass. With `cost`, the route's minimum walk cost
+// (min_route_cost) is computed in the same pass when every route edge is a member. `destinations`
+// ascending and disjoint from `source`.
+[[nodiscard]] PreparedRoute prepare_route(const Graph& graph, RouteAllocation allocation, Admission admission,
+                                   const WeightSource& weights, NodeId source, std::span<const NodeId> destinations,
+                                   const PredecessorDAG& route, Cost* cost = nullptr);
+// The same plan with several roots (a ShortestPaths demand's pooled program): the members are pruned to
+// the walks from any root to the destination set; `roots` ascending and disjoint from `destinations`.
+[[nodiscard]] PreparedRoute prepare_route(const Graph& graph, RouteAllocation allocation, Admission admission,
+                                   const WeightSource& weights, std::span<const NodeId> roots,
+                                   std::span<const NodeId> destinations, const PredecessorDAG& route);
+
+// The plan of a supplied split route (from_routes): `dag` pruned to the walks from `source` to the
+// destination set (the plan's route, ascending), its members every route edge (Equal) or
+// the route edges of positive weight (Weighted: `basis` with `edge_values` one entry per edge, the
+// explicit weights or the residual snapshot; a weight on an edge of capacity 0 is 0 unless the
+// basis is the snapshot), with `cost` the route's minimum walk cost. One pass over `dag`, and a
+// second only when a Weighted route edge has weight 0. Equal to prepare_route on the pruned route.
+[[nodiscard]] PreparedRoute prepare_supplied_route(const Graph& graph, RouteAllocation allocation, WeightBasis basis,
+                                         std::span<const Amount> edge_values, NodeId source,
+                                         std::span<const NodeId> destinations, const PredecessorDAG& dag, Cost* cost);
+
+// A plan's replay under a mask: its members that `eligibility` allows (every one when null),
+// pruned to the walks from `roots` (ascending) to `destinations` (ascending; the allowed ones), with the
+// members' frozen weights; members of capacity 0 stay (an Equal member keeps its share).
+// The route is the plan's.
+[[nodiscard]] PreparedRoute restrict_prepared_route(const Graph& graph, const PreparedRoute& plan, std::span<const NodeId> roots,
+                                       std::span<const NodeId> destinations, const Eligibility* eligibility);
+
+// ---------------------------------------------------------------- ShortestPaths creation
+
+// std::lower_bound(a, x) on an ascending `a`, found from position `hint` (the creation walk's
+// previous range): a galloping probe toward x (steps of 1, 2, 4, ... between probes), then a
+// binary search inside the last step. The answer is std::lower_bound's whatever the hint (the first
+// position holding a value >= x, a.size() when none); only the probes differ.
+[[nodiscard]] std::size_t lower_bound_from(std::span<const EdgeId> a, std::size_t hint, EdgeId x) noexcept;
+
+// The creation products of a ShortestPaths flow: its record route, its plan and its route cost.
+struct PreparedRouteResult {
+  std::shared_ptr<const PredecessorDAG> route {};
+  PreparedRoute prepared_route {};
+  Cost min_route_cost {kUnreachable};
+};
+
+// Build a ShortestPaths flow's route, record route DAG, plan and cost in one pass. `support` contains
+// all static shortest paths to the sorted `destinations`; start at `source` and apply the route
+// choice on `view`. The result matches support_route, the route's construction and prepare_route:
+// reuse `support` if it is the whole route, otherwise build the route with
+// PredecessorDAGBuilder::of_edges.
+// Requires multipath and static membership (all kernels except Weighted with ResidualSnapshot
+// weights; a Weighted route edge of weight 0 also returns nullopt).
+// While building, check: every route edge can be a member; none leaves a destination; every
+// route node reaches a destination; the source is first in topological order; no cycle exists;
+// and each tail's members are consecutive. These checks ensure members == route.
+// Return nullopt on a failed condition or if `source` reaches no destination; the caller then uses
+// the separate routines. No per-call allocation is proportional to the whole graph's size.
+[[nodiscard]] std::optional<PreparedRouteResult> prepare_shortest_paths(const Graph& graph,
+                                                                 const std::shared_ptr<const PredecessorDAG>& support,
+                                                                 NodeId source, std::span<const NodeId> destinations,
+                                                                 const RouteChoice& choice, PriorityReader view,
+                                                                 RouteAllocation allocation, Admission admission,
+                                                                 const WeightSource& weights);
+
+// ---------------------------------------------------------------- allocation
+
+// The cumulative allocation alloc(T) of a Weighted or Equal plan, member-aligned: T
+// enters as round robin over the roots (all of it for one root); node by node in topological
+// order, a node's inflow (its own injection plus the sum of its in-member allocations) is split
+// by round robin or highest averages. With `limit` (member-aligned) it stops at the first member
+// above its limit and returns false. A positive share of a root without a member (a share with no
+// route) is a logic error: the Lossless searches stay at or below the number of roots before the
+// first such root.
+bool allocate(const PreparedRoute& plan, Amount total, std::span<Amount> out, std::span<const Amount> limit = {});
+
+// Find the largest T whose allocation fits each entry of member-aligned view_m. The upper
+// bound is the sum of the view on the roots' members, and at most the number of roots before the
+// first root without a member. Each member's allocation never decreases as
+// T grows, so a fitting and a failing T bound the answer. A floating-point estimate chooses
+// the first probe only; then double the step size to narrow the bounds and bisect them.
+// All fit checks, bounds, the returned value and allocation are exact. `iterations` counts
+// at most 62 search probes (enough to bisect the units domain below 2^62); throw std::logic_error
+// if that bound is exceeded. Evaluating the upper bound first, or a Lossless step's target,
+// is an allocation evaluation and is not counted as a search probe.
+struct LosslessBound {
+  Amount value {0};
+  std::int32_t probes {0};
+};
+[[nodiscard]] LosslessBound max_lossless_offer(const PreparedRoute& plan, std::span<const Amount> view_m);
+
+// One Lossless step of one flow on an Equal or Weighted plan (the amounts stage): T_new = max(T,
+// min(T + request, T_max(V))) on the replacement view V = W + own (member-aligned `view_m`), with
+// `own_m` the flow's committed allocation alloc(T) (member-aligned). The step probes T + request
+// first and searches T_max (as max_lossless_offer does) only when it does not fit. `request`
+// nullopt is +inf. `edge_flows` is the new member-aligned allocation (own_m itself when T is
+// unchanged).
+struct LosslessStep {
+  Amount admitted {0};
+  std::vector<Amount> edge_flows {};
+  std::int32_t probes {0};  // probes of this step's T_max search (at most 62)
+};
+[[nodiscard]] LosslessStep lossless_step(const PreparedRoute& plan, Amount total, std::span<const Amount> view_m,
+                                         std::span<const Amount> own_m, std::optional<Amount> request);
+
+// The injection of one forwarding: per root (aligned with plan.sources), the amount it injects; or
+// (first_hop, the experiment of a Lossy +inf placement) every root's out-members, each injected
+// with exactly its own view, while traffic reaching a root from another root is split as usual.
+struct Injection {
+  std::span<const Amount> per_root {};
+  bool first_hop {false};
+};
+
+// The per-root part of a forwarding: what each root offered (first hop: injected), lost at the
+// source (a root without a member keeps its injection and loses it), delivered, and its (member,
+// carried, dropped)
+// entries in ascending member order. At a router the members' amounts are attributed to the roots
+// by highest averages over the roots' remaining inflows, member by member in member order; on a
+// member that drops, its carried amount is attributed by highest averages over the roots'
+// arrivals on it, the rest being each root's drop there.
+struct Attribution {
+  struct Entry {
+    std::int32_t edge_position {0};
+    Amount carried {0};
+    Amount drops {0};
+  };
+  std::vector<Amount> offered {};
+  std::vector<Amount> source_drops_by_source {};
+  std::vector<Amount> delivered {};
+  std::vector<std::vector<Entry>> entries {};
+};
+
+// One forwarding of `in` over the plan on the member-aligned view `w_m` (the working residual;
+// empty: no capacity limit, the no-drop forwarding of an admitted total): every node splits its
+// inflow (own injection plus carried arrivals) once by the kernel's rule, each member carries
+// min(arrivals, view) and drops the rest; with `attr`, the per-root part as well. `offered` is
+// the sum of the injections (first_hop: what was injected), `source_drops` the injections of roots
+// without a member.
+struct Forwarding {
+  Amount offered {0};
+  Amount network_entered {0};
+  Amount source_drops {0};
+  Amount delivered {0};
+  std::vector<Amount> edge_flows {};  // member-aligned
+  std::vector<Amount> edge_drops {};    // member-aligned
+};
+[[nodiscard]] Forwarding forward(const PreparedRoute& plan, const Injection& in, std::span<const Amount> w_m,
+                                 Attribution* attr = nullptr);
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/search_detail.hpp b/include/netgraph/core/detail/search_detail.hpp
new file mode 100644
index 0000000..d22bec5
--- /dev/null
+++ b/include/netgraph/core/detail/search_detail.hpp
@@ -0,0 +1,197 @@
+/* Shared traversal for spf, policy routes, cached shortest-path supports and KSP alternatives.
+   A support contains every edge on the eligible shortest paths. A KSP spur search finds an
+   alternative suffix from a node on an earlier path.
+
+   Dijkstra finalises the nearest pending node, scanning out-edges for Forward and in-edges
+   for Reverse. Both heap and cyclic distance-bucket queues pop in (distance, node) order;
+   buckets are used when the graph's costs fit 65,536 buckets. A candidate must pass static
+   eligibility and any residual-capacity threshold; its capacity is never read (an edge of
+   capacity 0 is searched like any other).
+   A tight edge extends a shortest path exactly: d(u) + cost(e) = d(v) in traversal direction.
+   Positive costs make these edges unique for a fixed member graph regardless of equal-distance
+   pop order. Record them in per-node lists; on output, parallel_edges = false (Collapse) selects
+   one member per (u, v) by replaces(), without changing distances.
+   With targets, stop when the first target at distance d* is popped. Every nearer node is
+   already final, so positive costs ensure every target at d* has its final distance too.
+   Keep only tight edges on walks to these nearest targets (anycast pruning).
+   Extract the single path from that DAG by bottleneck under a Higher* tie rule (largest
+   minimum edge score), then fewest hops, then smallest EdgeId sequence. Increasing search
+   distance orders every predecessor before its child, so no second traversal is needed.
+   Each call exclusively borrows the thread's workspace (a lease). Reset it on every exit,
+   including exceptions: the touched nodes only, or the whole arrays when a quarter or more of
+   the nodes were touched; refuse overlapping leases.
+*/
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/detail/hooks_flag.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Native-only full-Yen comparator and observations. The caller owns the probe throughout
+// the call; observers run between workspace leases and may throw to test cleanup.
+struct KspProbe {
+  bool full_yen {false};
+  void (*spur)(void*, std::size_t deviation, std::size_t index) {nullptr};
+  void (*duplicate)(void*, std::size_t old_deviation, std::size_t new_deviation) {nullptr};
+  void* context {nullptr};
+};
+[[nodiscard]] const KspProbe* current_ksp_probe() noexcept;
+void set_ksp_probe(const KspProbe* probe) noexcept;
+struct ScopedKspProbe {
+  const KspProbe* previous;
+  explicit ScopedKspProbe(const KspProbe* probe) noexcept : previous(current_ksp_probe()) { set_ksp_probe(probe); }
+  ~ScopedKspProbe() { set_ksp_probe(previous); }
+  ScopedKspProbe(const ScopedKspProbe&) = delete;
+  ScopedKspProbe& operator=(const ScopedKspProbe&) = delete;
+};
+#endif
+
+// A route choice as the searches read it: the tie rule, all equal-cost walks (multipath) or the
+// canonical single path, and whether every parallel edge of a (u, v) pair is kept (parallel_edges).
+// The public options (SpfOptions, KspOptions, ShortestPaths, DistributedTE) each give it its fields:
+// KspOptions and DistributedTE always order single paths.
+struct RouteChoice {
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool multipath {true};
+  bool parallel_edges {true};
+  // A Higher* tie rule: the edge score breaks cost ties.
+  [[nodiscard]] bool prefers_score() const noexcept { return tie_break != RouteTieBreak::FewerHops; }
+  // The ineffective tie rule (ShortestPaths and spf): a Higher* tie rule over every equal-cost walk
+  // and every parallel edge has nothing to choose.
+  [[nodiscard]] bool tie_is_ineffective() const noexcept { return prefers_score() && multipath && parallel_edges; }
+  [[nodiscard]] bool single_path() const noexcept { return !multipath; }
+  friend bool operator==(const RouteChoice&, const RouteChoice&) = default;
+};
+
+// An exact edge score: num / den with den >= 1 (den == 1 for the capacity and the availability,
+// the capacity for the headroom on a positive edge); `infinite` above every finite value (the
+// bottleneck of an empty walk).
+struct Priority {
+  Amount num {0};
+  Amount den {1};
+  bool infinite {false};
+};
+[[nodiscard]] int compare(const Priority& a, const Priority& b) noexcept;  // -1, 0, 1
+
+// The score of an edge with `residual` units available of `capacity` under a Higher* tie rule: the
+// capacity units (HigherCapacity), the residual units (HigherAvailableCapacity) or the rational
+// residual / capacity (HigherHeadroom; 0 on an edge of capacity 0). FewerHops reads no score (the
+// capacity is returned and never compared).
+[[nodiscard]] Priority priority_value(RouteTieBreak tie_break, Amount residual, Amount capacity) noexcept;
+
+// The per-edge scores a search reads: priority_value on `residual`, or, when it is empty (no
+// residual), on the static capacity as the residual (HigherCapacity and HigherAvailableCapacity read
+// the capacity, HigherHeadroom 1 on a positive edge and 0 on an edge of capacity 0).
+struct PriorityValues {
+  const Graph* graph {nullptr};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  std::span<const Amount> residual {};
+  [[nodiscard]] Priority of(EdgeId e) const noexcept;
+};
+
+// Any source of per-edge priority values (a search's PriorityValues, a policy's working view),
+// without a virtual call or an allocation.
+struct PriorityReader {
+  const void* context {nullptr};
+  Priority (*function)(const void*, EdgeId) noexcept {nullptr};
+  [[nodiscard]] Priority operator()(EdgeId e) const noexcept { return function(context, e); }
+  [[nodiscard]] static PriorityReader of(const PriorityValues& values) noexcept;
+};
+
+// replaces: whether member `e` replaces `cur`, the choice so far among the
+// eligible members of one (u, v) pair seen in ascending EdgeId (cur < e): the lower cost, then
+// under a Higher* tie rule (`prefer`) the higher score; on a tie the lower EdgeId (cur) stays.
+// `value(e)` reads the score of an edge on the view of the route choice.
+template <class Value>
+[[nodiscard]] bool replaces(const Graph& graph, EdgeId e, EdgeId cur, bool prefer, const Value& value) {
+  const auto cost = graph.edge_costs();
+  const Cost ce = cost[static_cast<std::size_t>(e)];
+  const Cost cc = cost[static_cast<std::size_t>(cur)];
+  if (ce != cc) return ce < cc;
+  return prefer && compare(value(e), value(cur)) > 0;
+}
+
+// ---------------------------------------------------------------- queue dispatch
+
+// The bucket queue's limit (an engineering cap, not a proven crossover): Auto takes the buckets
+// when W = max_edge_cost / max(1, edge_cost_gcd) + 1 <= kMaxBucketWidth.
+inline constexpr std::int64_t kMaxBucketWidth = std::int64_t {1} << 16;
+// W of graph (1 on a graph without edges: max_edge_cost and edge_cost_gcd are 0 there).
+[[nodiscard]] std::int64_t bucket_width(const Graph& graph) noexcept;
+// Whether a search on graph with `queue` runs on the buckets (Heap never does).
+[[nodiscard]] bool uses_buckets(const Graph& graph, SpfQueue queue) noexcept;
+
+// ---------------------------------------------------------------- searches of validated inputs
+
+// The candidates of a search (validated by the caller): the static Eligibility (null:
+// everything allowed) and a residual gate (`residual` empty: none; else E entries, an edge needs
+// residual >= min_residual >= 1). Capacity is not a condition.
+struct SearchFilter {
+  const Eligibility* eligibility {nullptr};
+  std::span<const Amount> residual {};
+  Amount min_residual {1};
+};
+
+// A policy's route and the cost of its walks: its edges in ascending EdgeId (support_route), or
+// a single path's in walk order (route_search).
+struct SearchRoute {
+  std::vector<EdgeId> edges {};
+  Cost cost {kUnreachable};
+};
+
+// T1's CSPF: forward from `source` toward the destination set (allowed ones; disjoint from it) over
+// the candidates of `gate` (min_residual 0: no bandwidth filter), Collapse and the staged single
+// path by `choice` (its multipath is not read) with the scores on `gate.residual`;
+// the path's edges in walk order, nullopt when no destination is reached.
+[[nodiscard]] std::optional<SearchRoute> route_search(const Graph& graph, const SearchFilter& gate, const RouteChoice& choice,
+                                                      NodeId source, std::span<const NodeId> destinations);
+
+// ShortestPaths's projection of a cached full static support: the support edges
+// reachable from `source` (ascending `support`: a reverse multipath DAG rooted at the destination
+// set), Collapse by `choice` on the scores `view` (no residual gating), and for
+// multipath = false the staged canonical single path on that part, its distances derived from the
+// support itself. An empty route when `source` reaches no destination in the support.
+[[nodiscard]] SearchRoute support_route(const Graph& graph, std::span<const EdgeId> support, NodeId source,
+                                        std::span<const NodeId> destinations, const RouteChoice& choice, PriorityReader view);
+
+// The full static support of a search from (Forward) or toward (Reverse) the root set (a
+// normalised set: nonempty, in range, ascending, no duplicates; excluded roots skipped): every
+// tight edge of the statically eligible member graph (multipath, parallel edges, no residual) over the
+// nodes it reaches, forward-oriented (the ShortestPathCache's value, and a ShortestPaths policy's DAG when it has
+// no cache). The empty DAG when no root is allowed.
+[[nodiscard]] PredecessorDAG static_support(const Graph& graph, std::span<const NodeId> roots, Direction direction,
+                                     const Eligibility* eligibility);
+
+// The static cost from each of `sources` to the nearest of `destinations` (in range, ascending, no
+// duplicates, possibly empty; allowed ones) over the statically eligible edges, whatever their
+// capacity, kUnreachable where there is no walk, and everywhere when no destination is allowed
+// (the T1 and CentralizedTE rosters and T1's CostStretch baseline).
+[[nodiscard]] std::vector<Cost> static_costs(const Graph& graph, const Eligibility* eligibility, std::span<const NodeId> destinations,
+                                             std::span<const NodeId> sources);
+
+// The validation of a cost ceiling at use (ksp and T1): an AbsoluteCost's cost >= 0, a
+// CostStretch's factor >= 1; std::invalid_argument naming cost_ceiling.
+void check_ceiling(const std::optional<CostCeiling>& ceiling);
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Test evidence (C++ tests, hooks builds only): how many of this thread's searches ran on the
+// bucket queue; a search that leaves the count unchanged ran on the heap.
+struct QueueCounts {
+  std::int64_t buckets {0};
+};
+QueueCounts& thread_queue_counts() noexcept;
+#endif
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/sparse.hpp b/include/netgraph/core/detail/sparse.hpp
new file mode 100644
index 0000000..d69d7b7
--- /dev/null
+++ b/include/netgraph/core/detail/sparse.hpp
@@ -0,0 +1,23 @@
+// The nonzero entries of a member-aligned array, preserving member order and owning the result.
+#pragma once
+
+#include <algorithm>
+#include <cstddef>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+inline std::vector<std::pair<EdgeId, Amount>> nonzero_pairs(std::span<const EdgeId> members, std::span<const Amount> amounts) {
+  std::vector<std::pair<EdgeId, Amount>> out;
+  out.reserve(static_cast<std::size_t>(std::count_if(amounts.begin(), amounts.end(), [](Amount x) { return x != 0; })));
+  for (std::size_t m = 0; m < members.size(); ++m) {
+    if (amounts[m] != 0) out.emplace_back(members[m], amounts[m]);
+  }
+  return out;
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/strong_components.hpp b/include/netgraph/core/detail/strong_components.hpp
new file mode 100644
index 0000000..010f834
--- /dev/null
+++ b/include/netgraph/core/detail/strong_components.hpp
@@ -0,0 +1,73 @@
+#pragma once
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <utility>
+#include <vector>
+
+namespace netgraph::core::detail {
+
+// Iterative Tarjan over a validated CSR graph: offsets has n + 1 entries, heads are
+// vertex indices, and both vertices and arc positions fit int32. usable(a) selects
+// arcs without copying the adjacency. Labels are assigned in component completion
+// order; the return value is their count. The predicate is inlined at each call site.
+template <class Usable>
+std::int32_t strong_components(std::span<const std::int32_t> offsets,
+                               std::span<const std::int32_t> heads, Usable usable,
+                               std::vector<std::int32_t>& labels) {
+  const auto n = offsets.size() - 1;
+  labels.assign(n, -1);
+  std::vector<std::int32_t> index(n, -1);
+  std::vector<std::int32_t> low(n, 0);
+  std::vector<std::uint8_t> on(n, 0);
+  std::vector<std::int32_t> stack;
+  std::vector<std::pair<std::int32_t, std::int32_t>> work;  // (vertex, next adjacency position)
+  std::int32_t counter = 0;
+  std::int32_t num_components = 0;
+  for (std::size_t s = 0; s < n; ++s) {
+    if (index[s] >= 0) continue;
+    work.emplace_back(static_cast<std::int32_t>(s), offsets[s]);
+    index[s] = low[s] = counter++;
+    stack.push_back(static_cast<std::int32_t>(s));
+    on[s] = 1;
+    while (!work.empty()) {
+      auto& [v, k] = work.back();
+      const auto vi = static_cast<std::size_t>(v);
+      if (k < offsets[vi + 1]) {
+        const auto a = static_cast<std::size_t>(k++);
+        if (!usable(a)) continue;
+        const auto w = static_cast<std::size_t>(heads[a]);
+        if (index[w] < 0) {
+          index[w] = low[w] = counter++;
+          stack.push_back(static_cast<std::int32_t>(w));
+          on[w] = 1;
+          work.emplace_back(static_cast<std::int32_t>(w), offsets[w]);
+        } else if (on[w] != 0) {
+          low[vi] = std::min(low[vi], index[w]);
+        }
+        continue;
+      }
+      if (low[vi] == index[vi]) {
+        while (true) {
+          const auto w = static_cast<std::size_t>(stack.back());
+          stack.pop_back();
+          on[w] = 0;
+          labels[w] = num_components;
+          if (w == vi) break;
+        }
+        ++num_components;
+      }
+      const auto done = v;
+      work.pop_back();
+      if (!work.empty()) {
+        const auto u = static_cast<std::size_t>(work.back().first);
+        low[u] = std::min(low[u], low[static_cast<std::size_t>(done)]);
+      }
+    }
+  }
+  return num_components;
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/trace.hpp b/include/netgraph/core/detail/trace.hpp
new file mode 100644
index 0000000..23eb818
--- /dev/null
+++ b/include/netgraph/core/detail/trace.hpp
@@ -0,0 +1,94 @@
+/* The transaction trace of a placement call (internal diagnostics for the tests, which compare
+   it key by key with the same trace of their independent model of the policy): a small
+   JSON-like value of the call's intermediate values: the roster, the routes prepared at the
+   epoch's first positive call, ShortestPaths's offers or bound, and for the controllers the
+   bisection probes, the solve's view and capacities, the flow core's values and the shares.
+   Filled only in a build with the private hooks, when a call asks for it (detail::place_traced);
+   other calls build only empty values. */
+#pragma once
+
+#include <cstdint>
+#include <span>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace netgraph::core::detail {
+
+struct Trace {
+  enum class Kind : std::uint8_t { Null, Int, Str, List, Map };
+  Kind kind {Kind::Null};
+  std::int64_t i {0};
+  std::string s {};
+  std::vector<Trace> items {};                           // List
+  std::vector<std::pair<std::string, Trace>> fields {};  // Map, in insertion order
+
+  static Trace null() { return {}; }
+  static Trace integer(std::int64_t v) {
+    Trace t;
+    t.kind = Kind::Int;
+    t.i = v;
+    return t;
+  }
+  static Trace str(std::string v) {
+    Trace t;
+    t.kind = Kind::Str;
+    t.s = std::move(v);
+    return t;
+  }
+  static Trace list() {
+    Trace t;
+    t.kind = Kind::List;
+    return t;
+  }
+  static Trace map() {
+    Trace t;
+    t.kind = Kind::Map;
+    return t;
+  }
+  template <class T>
+  static Trace ints(std::span<const T> v) {
+    Trace t = list();
+    t.items.reserve(v.size());
+    for (const auto& x : v) t.items.push_back(integer(static_cast<std::int64_t>(x)));
+    return t;
+  }
+  template <class T>
+  static Trace ints(const std::vector<T>& v) {
+    return ints(std::span<const T>(v));
+  }
+  // [[a, b], ...] from pairs.
+  template <class A, class B>
+  static Trace pairs(const std::vector<std::pair<A, B>>& v) {
+    Trace t = list();
+    for (const auto& [a, x] : v) {
+      Trace p = list();
+      p.items.push_back(integer(static_cast<std::int64_t>(a)));
+      p.items.push_back(integer(static_cast<std::int64_t>(x)));
+      t.items.push_back(std::move(p));
+    }
+    return t;
+  }
+
+  // Map: set (replacing an existing key).
+  Trace& set(std::string_view key, Trace v) {
+    kind = Kind::Map;
+    for (auto& [k, x] : fields) {
+      if (k == key) {
+        x = std::move(v);
+        return x;
+      }
+    }
+    fields.emplace_back(std::string(key), std::move(v));
+    return fields.back().second;
+  }
+  // List: append.
+  Trace& push(Trace v) {
+    kind = Kind::List;
+    items.push_back(std::move(v));
+    return items.back();
+  }
+};
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/tunnel_setup.hpp b/include/netgraph/core/detail/tunnel_setup.hpp
new file mode 100644
index 0000000..ec9aab7
--- /dev/null
+++ b/include/netgraph/core/detail/tunnel_setup.hpp
@@ -0,0 +1,78 @@
+/* The tunnel models' computations (internal). T1 (distributed_te.cpp): every head sets up its own
+   tunnels by CSPF on the reservation view. T2 (centralized_te_tunnels.cpp): a controller lays out the same
+   number of tunnels with one common planned bandwidth for every live head. Both programs are built
+   by distributed_te_program (program_data.hpp) and forwarded by the forwarding engine like any other
+   program. */
+#pragma once
+
+#include <optional>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+// T1's setup for the design volume D (< 2^62) over the roster's H heads (ascending)
+// with N = ca.tunnel_count.per_head tunnels each: head i's share RR(D, H, i), its tunnel j's request
+// RR(share, N, j); the attempts in round order (round j, heads ascending), every one even after
+// failures, each on `U` (dense, E entries: the unreserved capacity with this policy's own holds
+// released, each entry in [0, capacity]) minus the requests of the tunnels already up in this
+// setup. An attempt keeps the allowed edges (`eligibility`) with U >= max(request,
+// min_unreserved_bandwidth) (a threshold of 0 keeps every allowed edge), collapses parallel edges
+// (ca.parallel_edges = false) and takes the single path in the order of ca.tie_break on static
+// costs toward the allowed `destinations` (its scores read U); then the ceiling:
+// AbsoluteCost(c) inclusive, CostStretch(f) as cost <= f * c0 exactly (`c0`: the pool baseline, read only
+// for CostStretch). Up: the request is subtracted from U on every edge of the path (U is consumed).
+// The tunnels come in round order (index = position: round * H + slot).
+[[nodiscard]] std::vector<TunnelSetupResult> setup_distributed_te_tunnels(const Graph& graph, const Eligibility* eligibility, std::span<const NodeId> reachable_sources,
+                                                std::span<const NodeId> destinations, const DistributedTE& ca, Cost c0, Amount D, std::vector<Amount> U);
+
+// T2's layout on V (dense, E entries: the free capacity with this policy's own
+// traffic released) for the roster's H heads (ascending) toward the allowed `destinations`
+// under `eligibility`: the live heads (those reaching a destination over links with V >= 1), the count k
+// (tunnels.per_head, or the chosen count of "up to"), U (the largest common whole-unit size of k
+// tunnels per live head: common), the exact fluid optimum s* = fluid_num / fluid_den (reduced; 0 / 1
+// without a live head), the working size u (planned: min(U, max(1, max live ceil(RR(D, H, i) / k)))
+// for a finite design D, U for an unlimited one), and at u (U >= 1) the tunnels in round order
+// (slot: the roster position, round: the local index, planned u) with their route-cost sum J and
+// (with `headroom`) their headroom penalty Phi (t2_objectives). No live head: count N (1 for "up
+// to") and nothing else; U = 0 with live heads: no tunnels.
+struct T2Layout {
+  std::int64_t count {0};
+  std::vector<NodeId> live {};
+  Amount common {0};
+  Amount planned {0};
+  Amount fluid_num {0};
+  Amount fluid_den {1};
+  std::vector<TunnelSetupResult> tunnels {};
+  Counter128 route_cost {};
+  Counter128 headroom_penalty {};
+};
+[[nodiscard]] T2Layout t2_layout(const Graph& g, const Eligibility* eligibility, std::span<const NodeId> roster,
+                                 std::span<const NodeId> destinations, const TunnelCount& tunnels, bool headroom,
+                                 std::optional<Amount> design, std::span<const Amount> V);
+
+// T2's objectives of a count vector x over `edges` (x[i] tunnels on edges[i]) at size u >= 1
+// on V (dense, E entries): the route cost J = sum cost x and, with `headroom`, the headroom penalty
+// Phi = the sum over links of capacity B > 0 of floor(2^32 (B - V + j u) / B) for j = 1..x (each
+// link's sum in closed form). Exact 128-bit: J < K (cost sum) < 2^92; Phi <= 2^32 sum x, where
+// sum x counts every link of every tunnel (sum x < 2^62; Phi itself can pass 2^64 for valid
+// inputs), so Phi < 2^94. With `headroom`, a link of capacity B > 0 requires V <= B and x u <= V
+// (std::logic_error otherwise).
+struct T2Objectives {
+  Counter128 route_cost {};
+  Counter128 headroom_penalty {};
+};
+[[nodiscard]] T2Objectives t2_objectives(const Graph& g, std::span<const EdgeId> edges, std::span<const Amount> x,
+                                         std::span<const Amount> V, Amount u, bool headroom);
+
+// The heads' design shares RR(D, H, i) as (head, share) in roster order (TunnelPlan::design_by_head).
+[[nodiscard]] std::vector<std::pair<NodeId, Amount>> design_by_head(std::span<const NodeId> reachable_sources, Amount D);
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/uid.hpp b/include/netgraph/core/detail/uid.hpp
new file mode 100644
index 0000000..bee5cc0
--- /dev/null
+++ b/include/netgraph/core/detail/uid.hpp
@@ -0,0 +1,16 @@
+/* The process-wide uid counter of graphs, Eligibility values and ledgers (internal). */
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+
+namespace netgraph::core::detail {
+
+// A fresh uid from one process-wide 64-bit counter: never 0, never reused, at most the largest
+// int64 (2^63 - 1 identities); after it the counter is spent: std::runtime_error `object identity
+// limit exceeded`, nothing changed.
+[[nodiscard]] std::uint64_t next_uid();
+// The rule of next_uid on a given counter (the counter holds the last uid taken, 0 for none).
+[[nodiscard]] std::uint64_t take_uid(std::atomic<std::uint64_t>& counter);
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/detail/unit_conversion.hpp b/include/netgraph/core/detail/unit_conversion.hpp
new file mode 100644
index 0000000..451243d
--- /dev/null
+++ b/include/netgraph/core/detail/unit_conversion.hpp
@@ -0,0 +1,25 @@
+// Numeric kernels after validation of the resolution and physical argument.
+#pragma once
+
+#include <cmath>
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::detail {
+
+// q = 2^k. The caller has checked finite, nonnegative x and the resolution.
+// Keep the rounded value as a double until its caller has checked the unit bound.
+inline double rounded_units(double x, int k) noexcept {
+  // x / q is exact (q is a power of two) unless it overflows to infinity or falls below the
+  // normal range (below 2^-1022 it may lose low bits; it then rounds to 0 units either way).
+  const double y = std::ldexp(x, -k);
+  constexpr double kTwo52 = 4503599627370496.0;  // 2^52: doubles at or above it are integers
+  if (y >= kTwo52) return y;
+  const double f = std::floor(y);
+  return (y - f >= 0.5) ? f + 1.0 : f;  // y - f is exact below 2^52: round half up
+}
+
+inline double scaled_units(Amount x, int k) noexcept {
+  return std::ldexp(static_cast<double>(x), k);
+}
+
+} // namespace netgraph::core::detail
diff --git a/include/netgraph/core/eligibility.hpp b/include/netgraph/core/eligibility.hpp
new file mode 100644
index 0000000..70fb66a
--- /dev/null
+++ b/include/netgraph/core/eligibility.hpp
@@ -0,0 +1,47 @@
+/* Eligibility: which nodes and edges of one graph may be used.
+   Built only by Graph::eligibility(excluded_nodes, excluded_edges) (graph.hpp, which includes
+   this header) and by intersect, which combines two values of one graph. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+class Graph;
+
+// Immutable, graph-bound static eligibility: dense node and edge flags. An edge is allowed when
+// it is not excluded and both of its endpoints are allowed.
+class Eligibility {
+public:
+  [[nodiscard]] std::uint64_t graph_uid() const noexcept { return graph_uid_; }
+  // 0 for the all-allowed value; a fresh uid otherwise.
+  [[nodiscard]] std::uint64_t uid() const noexcept { return uid_; }
+  [[nodiscard]] std::span<const std::uint8_t> node_allowed() const noexcept { return node_allowed_; }
+  [[nodiscard]] std::span<const std::uint8_t> edge_allowed() const noexcept { return edge_allowed_; }
+  [[nodiscard]] bool allows_node(NodeId v) const noexcept {
+    return node_allowed_[static_cast<std::size_t>(v)] != 0;
+  }
+  [[nodiscard]] bool allows_edge(EdgeId e) const noexcept {
+    return edge_allowed_[static_cast<std::size_t>(e)] != 0;
+  }
+  // The intersection of two values of one graph (std::invalid_argument for values of different
+  // graphs): an operand when the result equals it (a first, then b), keeping that operand's
+  // uid, so a consumer builds each state once and reuses it; otherwise a new value with a fresh
+  // uid (equal intersections built separately get distinct uids).
+  [[nodiscard]] static Eligibility intersect(const Eligibility& a, const Eligibility& b);
+
+private:
+  friend class Graph;
+  Eligibility() = default;
+  std::uint64_t graph_uid_ {0};
+  std::uint64_t uid_ {0};
+  std::vector<std::uint8_t> node_allowed_ {};
+  std::vector<std::uint8_t> edge_allowed_ {};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/evaluators.hpp b/include/netgraph/core/evaluators.hpp
new file mode 100644
index 0000000..ff82317
--- /dev/null
+++ b/include/netgraph/core/evaluators.hpp
@@ -0,0 +1,121 @@
+/* The evaluators: evaluate_demand (a fresh FlowPolicy's evaluation on a fresh ledger, at the offer;
+   the exact maximum flow is evaluate_demand of CentralizedTE with the optimized source allocation),
+   evaluate_pairs (evaluate_demand per pair) and evaluate_edge_failures (the delivery reduction of
+   deleting each candidate edge). */
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+// The options of every evaluator: the configuration, the static Eligibility, the ShortestPathCache, the
+// optional outputs of each result (evaluate_edge_failures: of its baseline), `design_demand` (T1's design,
+// required and finite; T2's, absent meaning the offer when it is finite, else unlimited; every
+// other model rejects one) and `offer`, a finite offer for every model (absent: the uncapped
+// Lossless question, or the first-hop experiment of ShortestPaths Equal/Weighted Lossy; an inner
+// nullopt is an explicit +inf, which the evaluators reject). The Eligibility and the cache outlive
+// the call.
+// | model                                | Lossless                                     | Lossy |
+// | ShortestPaths Equal/Weighted         | no offer: the uncapped bound; finite: up to it | finite: that offer; none: the first-hop experiment |
+// | ShortestPaths Optimized, CentralizedTE | no offer: the uncapped optimum; finite: up to it | rejected |
+// | T1                                   | design required; no offer: the tunnels' lossless bound; finite: up to it | design and offer required |
+// | T2                                   | design absent: the offer if finite, else unlimited; no offer: the bound at that design | finite offer; none: the design if finite |
+// | Pinned                               | no offer: the fixed-program bound; finite: up to it | offer required |
+struct EvaluationOptions {
+  FlowPolicyConfig config;
+  const Eligibility* eligibility {nullptr};
+  ShortestPathCache* cache {nullptr};
+  OutputOptions outputs {};
+  std::optional<std::optional<Amount>> design_demand {};
+  std::optional<std::optional<Amount>> offer {};
+};
+
+// One candidate edge: delivery_reduction = the baseline's call_delivered - call_delivered without
+// the edge (signed, in units, never thresholded).
+struct SensitivityEntry {
+  EdgeId edge {0};
+  Amount delivery_reduction {0};
+};
+
+struct SensitivityResult {
+  PlacementResult baseline {};
+  std::vector<SensitivityEntry> entries {};  // ascending EdgeId; an absent edge has delivery_reduction 0
+};
+
+// Each evaluator is one public call on a supplied frozen cache's statistics (shortest_path_cache.hpp): its
+// hits count when it returns; a failed call changes no statistic, except one miss when it raises
+// ShortestPathCacheMiss.
+
+// The evaluation of a fresh FlowPolicy with options.config on a fresh ledger of graph (its capacities):
+// place(offer) (absent: +inf), or for T1 and T2 evaluate(offer, design). Checked in this order:
+// the policy's construction (the configuration, in the model matrix's order); then an explicitly given offer (`offer must
+// be an integer in [0, 2^62)`, +inf included); then the design demand: only T1 and T2 take one
+// (`<model> does not accept design_demand`), in [0, 2^62) or +inf (`design_demand must be an
+// integer in [0, 2^62) or permitted +inf`), T1's finite (`DistributedTE requires a finite design
+// demand`); then T1's missing design (`DistributedTE evaluation requires design_demand`); then the
+// missing Lossy offer: T1 and Pinned require one, T2 takes its finite design instead
+// (`<DistributedTE or CentralizedTE or Pinned> LOSSY evaluation requires a finite offer`).
+[[nodiscard]] PlacementResult evaluate_demand(const Graph& graph, std::span<const NodeId> sources,
+                                       std::span<const NodeId> destinations, const EvaluationOptions& options);
+
+// Run evaluate_demand() per pair, returning results in pair order. Intersect options.eligibility with
+// per_pair_eligibility[i]; null entries are allowed, and an empty span supplies no per-pair values.
+// The Python binding checks the length of every supplied sequence.
+// Before evaluation workers start, validate in order: workers >= 1;
+// options.eligibility's and the cache's graph; Pinned (rejected: a program has fixed endpoints); the configuration;
+// offer and design_demand (the rules of evaluate_demand); and per_pair_eligibility's length. Then validate each pair
+// completely in index order: endpoint sets, overlap, Eligibility's graph, the pooled single-path rule for its sources
+// and, for the tunnel models, the tunnel limit. This reports the lowest failing pair index. Last, under the cache's
+// lease: a supplied building cache requires workers == 1. First-pass tunnel searches run in parallel
+// over the checked prefix, before any lease; their immutable rosters are retained for evaluation.
+// A supplied building cache requires workers == 1 because it allows one writer. Workers share
+// a supplied frozen cache, and the one worker uses a supplied building cache; without a supplied
+// cache each worker gets a private building cache before threads start.
+// A worker exception aborts the batch; rethrow the exception from the lowest pair index.
+// An empty batch returns an empty list. ShortestPathCacheMiss always propagates unchanged.
+// An intersection equal to an operand reuses its uid and any prepopulated cache entry.
+// Otherwise it gets a fresh uid, absent from a frozen cache. To reuse entries, supply already
+// effective per-pair values with no common Eligibility, or one that contains them.
+[[nodiscard]] std::vector<PlacementResult> evaluate_pairs(
+    const Graph& graph, const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>>& pairs,
+    const EvaluationOptions& options, std::span<const Eligibility* const> per_pair_eligibility, std::int32_t workers);
+
+// Return the baseline evaluate_demand() and one entry per candidate edge. Unrestricted CentralizedTE
+// with the optimized source allocation: the candidates carry positive baseline flow (deleting any
+// other edge keeps the baseline feasible, at any offer); otherwise every edge options.eligibility
+// allows, whatever its capacity (deleting an edge of capacity 0 can change routes and rosters, so
+// its delivery_reduction can be nonzero; with the equal source allocation, a deletion that removes a
+// source from the roster can raise the total, a negative delivery_reduction). delivery_reduction is
+// the baseline's call_delivered minus the call_delivered with that edge deleted, using the same
+// config, offer, design and cache. When the unrestricted optimized CentralizedTE baseline is a
+// maximum flow (no offer, or an offer above what it delivers), a saturated edge whose endpoints
+// lie in different strongly connected components of the residual network loses its whole flow.
+// Any other candidate loses its flow minus what can be rerouted between its endpoints.
+// These shortcuts preserve the complete baseline result and candidate order.
+// At an offer the baseline delivers (it binds, perhaps below the maximum), each deletion is
+// solved afresh at the offer. CentralizedTE with a support solves every deletion afresh.
+// T1 sets up again for the same design under each deletion, T2 redoes its sizing, count selection
+// and objectives; Pinned replays the same program under
+// each deletion (a fixed-route failure question).
+// ShortestPaths skips a deletion when no roster source's reachable part of the static shortest-path
+// support contains the edge: no route uses it, so its delivery_reduction is 0. All other deletions use a fresh
+// ledger. A failed deletion fails the call (no partial result), raising the exception of the
+// lowest failing candidate index.
+// Worker and cache rules are as in evaluate_pairs. Clear each worker's private cache per
+// candidate because deletion Eligibility uids are fresh and cannot reuse entries.
+// Only ShortestPaths reads the cache. A deletion that needs placement with a frozen cache raises
+// ShortestPathCacheMiss for its fresh uid.
+[[nodiscard]] SensitivityResult evaluate_edge_failures(const Graph& graph, std::span<const NodeId> sources,
+                                            std::span<const NodeId> destinations, const EvaluationOptions& options,
+                                            std::int32_t workers);
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/flow.hpp b/include/netgraph/core/flow.hpp
deleted file mode 100644
index c956186..0000000
--- a/include/netgraph/core/flow.hpp
+++ /dev/null
@@ -1,28 +0,0 @@
-/* FlowRecord — immutable identity + current path DAG and placed amount. */
-#pragma once
-
-#include <cstdint>
-#include <utility>
-
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// FlowRecord is a logical unit of routed demand. It stores identity, current
-// path (as a PredDAG), path cost, and the volume placed so far. It does not
-// mutate any graph state; placement is performed via FlowGraph.
-struct FlowRecord {
-  FlowIndex index {};
-  NodeId src { -1 };
-  NodeId dst { -1 };
-  PredDAG dag {};
-  Cost cost { 0 };
-  double placed_flow { 0.0 };
-
-  FlowRecord() noexcept = default;
-  FlowRecord(FlowIndex idx, NodeId src, NodeId dst, PredDAG d, Cost c)
-      : index(idx), src(src), dst(dst), dag(std::move(d)), cost(c), placed_flow(0.0) {}
-};
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/flow_graph.hpp b/include/netgraph/core/flow_graph.hpp
deleted file mode 100644
index 8687d36..0000000
--- a/include/netgraph/core/flow_graph.hpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/* FlowGraph manages per-flow edge allocations over FlowState. */
-#pragma once
-
-#include <cstdint>
-#include <span>
-#include <unordered_map>
-#include <utility>
-#include <vector>
-
-#include "netgraph/core/flow_state.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// FlowGraph manages per-flow edge allocations over a StrictMultiDiGraph.
-// Composes FlowState for residual/aggregate edge flow management.
-class FlowGraph {
-public:
-  explicit FlowGraph(const StrictMultiDiGraph& g);
-  ~FlowGraph() noexcept = default;
-
-  // Copies and moves take a FRESH uid (and version 0). uid must be unique per
-  // reachable instance: a shared uid would let two objects that diverge after
-  // copying present equal StateStamps over different residual content, and
-  // FlowPolicy's memo fast path would then serve a DAG cached for the other
-  // object's state. Moved-from objects stay valid and mutable, so moves must
-  // not share the uid either; the one-time cache miss this costs is nothing.
-  FlowGraph(const FlowGraph& other);
-  FlowGraph& operator=(const FlowGraph& other);
-  FlowGraph(FlowGraph&& other) noexcept;
-  FlowGraph& operator=(FlowGraph&& other) noexcept;
-
-  // Views
-  [[nodiscard]] std::span<const Cap> capacity_view() const noexcept { return fs_.capacity_view(); }
-  [[nodiscard]] std::span<const Cap> residual_view() const noexcept { return fs_.residual_view(); }
-  [[nodiscard]] std::span<const Flow> edge_flow_view() const noexcept { return fs_.edge_flow_view(); }
-
-  // Access underlying graph (const)
-  [[nodiscard]] const StrictMultiDiGraph& graph() const noexcept { return *g_; }
-
-  // Apply placement and record per-edge allocations for this flow. Returns placed
-  // amount. `drops`, when given, receives the per-edge dropped volume of an
-  // EqualBalancedLossy placement (see FlowState::place_on_dag); other placements
-  // leave it untouched. Dropped volume is not part of the ledger: it never
-  // occupied an edge, so removing the flow reverts only what was carried.
-  [[nodiscard]] Flow place(const FlowIndex& idx, NodeId src, NodeId dst,
-             const PredDAG& dag, Flow amount,
-             FlowPlacement placement,
-             std::vector<std::pair<EdgeId, Flow>>* drops = nullptr);
-
-  // Remove a specific flow, reverting its edge allocations from the ledger.
-  void remove(const FlowIndex& idx);
-
-  // Remove all flows belonging to a given flowClass.
-  void remove_by_class(FlowClass flowClass);
-
-  // Reset all state to initial capacity and clear ledger.
-  void reset() noexcept;
-
-  // Inspect: return a copy of the flow's edges and amounts.
-  [[nodiscard]] std::vector<std::pair<EdgeId, Flow>> get_flow_edges(const FlowIndex& idx) const;
-
-  // Monotonic stamp identifying the exact residual state of this FlowGraph.
-  // uid is process-unique per instance (never reused across FlowGraph
-  // lifetimes); version bumps on every mutation that can change residuals.
-  // Equal stamps from two observations therefore guarantee identical residual
-  // content, which FlowPolicy uses to elide repeated identical SPF runs.
-  struct StateStamp {
-    std::uint64_t uid;
-    std::uint64_t version;
-    bool operator==(const StateStamp&) const noexcept = default;
-  };
-  [[nodiscard]] StateStamp state_stamp() const noexcept { return {uid_, version_}; }
-
-// Reconstruct single path for this flow from ledger.
-// Returns empty vector if flow uses multipath/proportional splitting.
-  [[nodiscard]] std::vector<EdgeId> get_flow_path(const FlowIndex& idx) const;
-
-private:
-  const StrictMultiDiGraph* g_ {nullptr};
-  FlowState fs_;
-  // Per-flow ledger: stores only edges with non-zero flow
-  std::unordered_map<FlowIndex, std::vector<std::pair<EdgeId, Flow>>, FlowIndexHash> ledger_;
-  // See state_stamp(). fs_ is private and every mutation path (place, remove,
-  // remove_by_class, reset) bumps version_, so the stamp cannot go stale.
-  std::uint64_t uid_ {0};
-  std::uint64_t version_ {0};
-};
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/flow_ledger.hpp b/include/netgraph/core/flow_ledger.hpp
new file mode 100644
index 0000000..193a552
--- /dev/null
+++ b/include/netgraph/core/flow_ledger.hpp
@@ -0,0 +1,112 @@
+/* The integer ledger FlowLedger. */
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+struct LedgerAccess;
+} // namespace detail
+
+// A ledger tracks the flows placed on one graph in two projections that are never added: the
+// carried traffic (the service baseline B, the available capacity in units before these flows;
+// carried() L, the exact sum of all records' edge_flows; residual() = B - L) and the strict
+// holds of T1 tunnels (the reservation baseline R0; reserved() S, the exact sum of all records'
+// edge_reservations; unreserved() = R0 - S). Each projection keeps its own bound (0 <= L <= B,
+// 0 <= S <= R0 per edge); max(L, S) is no occupancy, and traffic may use bandwidth that is held.
+// Policies alone place, hold or remove through detail::LedgerAccess; there is no public
+// placement, removal or reservation. All four return int64[E] snapshots in EdgeId order.
+// One gate protects every mutable read, lifecycle operation and bound policy publication.
+//
+// Lifetime: the graph outlives the ledger (shared pointer), the ledger outlives its policies.
+// A ledger with bound policies cannot be copied, moved or reset. A copy of an unbound ledger
+// is a new ledger (new uid) holding the same baselines, records, ids and holds under the new uid;
+// a moved-from ledger retains its immutable graph owner but its mutable state is empty and
+// unusable (every public call throws std::logic_error). A policy
+// destroyed without remove() leaves its records, allocations and holds as orphans (readable,
+// never changed again) until reset().
+class FlowLedger {
+public:
+  // `service_baseline` and `reservation_baseline`: the baselines in units, each one entry per
+  // edge in [0, the edge's capacity] (std::invalid_argument naming the array, service_baseline
+  // checked first); absent: the capacities.
+  explicit FlowLedger(std::shared_ptr<const Graph> graph);
+  FlowLedger(std::shared_ptr<const Graph> graph, std::span<const Amount> service_baseline);
+  FlowLedger(std::shared_ptr<const Graph> graph, std::span<const Amount> service_baseline, std::span<const Amount> reservation_baseline);
+  FlowLedger(const FlowLedger& other);
+  FlowLedger(FlowLedger&& other);
+  FlowLedger& operator=(const FlowLedger&) = delete;
+  FlowLedger& operator=(FlowLedger&&) = delete;
+  ~FlowLedger() = default;
+
+  [[nodiscard]] std::uint64_t uid() const;
+  [[nodiscard]] const std::shared_ptr<const Graph>& graph() const;
+  // The graph's static capacities (the ledger's view of them).
+  [[nodiscard]] std::span<const Amount> edge_capacity_units() const;
+  [[nodiscard]] std::vector<Amount> residual() const;
+  [[nodiscard]] std::vector<Amount> carried() const;
+  [[nodiscard]] std::vector<Amount> reserved() const;
+  [[nodiscard]] std::vector<Amount> unreserved() const;
+  // Live records (bound and orphaned) as snapshots in FlowId order.
+  [[nodiscard]] std::vector<FlowRecord> records() const;
+  // One record; a FlowId of another ledger, a retired id or an unknown id throws
+  // std::invalid_argument.
+  [[nodiscard]] FlowRecord record(const FlowId& flow_id) const;
+  // Saturation diagnostic: follow eligible forward edges with residual >= 1 unit from the
+  // allowed sources. Return statically eligible edges with capacity >= 1 unit leaving that
+  // reachable set, in ascending EdgeId; empty if no such edge remains. This is not a minimum-cut
+  // certificate: it does not follow reverse arcs that could cancel existing flow.
+  [[nodiscard]] std::vector<EdgeId> saturated_boundary_edges(std::span<const NodeId> sources, const Eligibility* eligibility = nullptr) const;
+  // New baselines (the capacities when absent); orphaned records with their allocations and holds
+  // are cleared and their ids retired. Rejected (std::invalid_argument) while a policy is bound.
+  void reset();
+  void reset(std::span<const Amount> service_baseline);
+  void reset(std::span<const Amount> service_baseline, std::span<const Amount> reservation_baseline);
+
+private:
+  friend struct detail::LedgerAccess;
+  void check_usable() const;
+  std::vector<Amount> checked_baseline(std::span<const Amount> amounts, const char* label) const;
+  void check_resettable() const;
+  void install(std::vector<Amount> baseline, std::vector<Amount> reservation);
+  // The reservation projection costs nothing until something holds: an empty reserved_ is all
+  // zero, an empty reservation_baseline_ is the static capacity.
+  [[nodiscard]] Amount reservation_at(std::size_t e) const noexcept {
+    return reservation_baseline_.empty() ? graph_->edge_capacity_units()[e] : reservation_baseline_[e];
+  }
+  [[nodiscard]] Amount reserved_at(std::size_t e) const noexcept { return reserved_.empty() ? 0 : reserved_[e]; }
+
+  // Never changed after construction, including when moving this ledger. Internal argument
+  // checks can safely pin graph metadata before acquiring the gate; public reads still gate
+  // their usability check. The gate itself stays with its object across copy/move.
+  std::shared_ptr<const Graph> graph_ {};
+  mutable std::mutex gate_;
+  std::uint64_t uid_ {0};
+  bool usable_ {true};
+  std::vector<Amount> service_baseline_ {};
+  std::vector<Amount> carried_ {};
+  std::vector<Amount> reservation_baseline_ {};
+  std::vector<Amount> reserved_ {};
+  std::map<std::int64_t, FlowRecord> records_ {};
+  std::map<std::int64_t, std::vector<std::int64_t>> policy_record_counters_ {};  // owner -> live ids, ascending
+  std::int64_t next_record_counter_ {0};
+  std::int64_t next_policy_id_ {0};
+  // The bound owners (true) and the orphaned owners of live records (false), since the last
+  // reset: release() flips the flag, or erases an owner without records, so it never allocates.
+  std::map<std::int64_t, bool> policy_bindings_ {};
+  std::size_t num_bound_policies_ {0};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/flow_policy.hpp b/include/netgraph/core/flow_policy.hpp
index ccc8384..b77df16 100644
--- a/include/netgraph/core/flow_policy.hpp
+++ b/include/netgraph/core/flow_policy.hpp
@@ -1,258 +1,483 @@
-/* FlowPolicy manages flows for a single demand. */
+/* The policy engine FlowPolicy. */
 #pragma once
 
+#include <atomic>
 #include <cstdint>
-#include <limits>
+#include <functional>
+#include <memory>
 #include <optional>
-#include <unordered_map>
+#include <span>
 #include <utility>
+#include <variant>
 #include <vector>
-#include <stdexcept>
 
-#include "netgraph/core/flow.hpp"
-#include "netgraph/core/flow_graph.hpp"
-#include "netgraph/core/algorithms.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/graph.hpp"
 #include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
 #include "netgraph/core/types.hpp"
 
 namespace netgraph::core {
 
-enum class PathAlg : std::int32_t { SPF = 1 };
+namespace detail {
+struct TunnelRoster;
+struct PolicyEngine;
+struct PolicyAccess;
+class FrozenCacheHitTally;
+} // namespace detail
 
-// Execution context with algorithms and graph handle
-struct ExecutionContext {
-  std::shared_ptr<Algorithms> algorithms;
-  GraphHandle graph;
+// The tunnel count of the tunnel models, per head: `per_head` in [1, 10000] (checked where a policy
+// or an evaluator uses it); `up_to` (T2 only; T1 rejects it): one common count k in 1..per_head for
+// every head, the smallest whose program carries the live heads' design shares (else the largest
+// live-share score, then the smallest count; no promise of whole-demand lossless delivery).
+struct TunnelCount {
+  std::int64_t per_head {1};
+  bool up_to {false};
+  friend bool operator==(const TunnelCount&, const TunnelCount&) = default;
+};
 
-  ExecutionContext(std::shared_ptr<Algorithms> algs, const GraphHandle& gh) noexcept
-      : algorithms(std::move(algs)), graph(gh) {}
+// Each routing mode has only the fields it uses.
+// ShortestPaths: hop-by-hop routing on each roster source's static shortest routes (all shortest
+//   paths, with no directed cycles, edges of capacity 0 included, or the canonical single
+//   path), fixed for an epoch. With FewerHops or HigherCapacity and static weights the policy
+//   keeps its first program and uses it again at later epochs (values equal a fresh preparation).
+//   The sources of the demand are pooled: a
+//   router shared by several sources adds their traffic and splits it once. Equal and Weighted forward the equal source allocation; Optimized is a controller
+//   restricted to the union of those routes. Its program: one split route per roster source,
+//   pooled into one split context (Equal, Weighted), or the controller's paths (Optimized). Its
+//   route choice: tie_break (RouteTieBreak), multipath (false: the canonical single path) and
+//   parallel_edges (false: one member of each (u, v) pair).
+// DistributedTE (T1): every roster head sets up its own tunnel_count.per_head strict tunnels by CSPF, no
+//   controller. A design volume D is split RR(D, H, h) over the heads and each head's share
+//   RR(d, N, j) over its tunnels; in round order (round j, heads ascending: index j * H + i) each
+//   tunnel keeps the allowed links whose unreserved capacity U (the ledger's, this policy's own
+//   holds released, minus this setup's earlier up tunnels) is at least max(request,
+//   min_unreserved_bandwidth) (a request of 0 with a minimum of 0 has no filter), collapses
+//   parallel links (parallel_edges = false), and takes the single path in the order of tie_break
+//   on static costs (scores read U: HigherAvailableCapacity U, HigherHeadroom U / C, HigherCapacity
+//   C); it is Up, holding its
+//   request on every link, unless no path passes the filter (InsufficientBandwidth) or the cheapest
+//   exceeds cost_ceiling (CostCeilingExceeded): AbsoluteCost inclusive, CostStretch(f) times c0, the
+//   smallest static
+//   shortest cost over the roster heads under the mask, zero-capacity links included. Forwarding
+//   is the program's: round robin over the heads, then over a head's up tunnels; a head without
+//   one loses its share. Its program: those tunnels, weight 1 up and 0 down.
+// CentralizedTE: the ideal controller, a minimum-cost maximum flow over the whole eligible graph, or
+//   exactly over `support` (a DAG of the policy's graph, trimmed to the walks from the sources to
+//   the allowed destinations under the Eligibility), of what the policy already delivers plus this
+//   call's request (what the policy delivers plus the offer: what an earlier call could not place is not
+//   requested again). Its program: the solved flow cut into paths per source, each path a tunnel
+//   weighted by its amount.
+// CentralizedTE with `tunnel_count` (T2; with `support`, the allowed links are the support's edges
+//   intersected with the Eligibility, in every step below): a controller lays out, for every live
+//   roster head (one reaching an allowed destination over links with free capacity V >= 1, V the
+//   residual with this policy's own traffic released; the other heads are dead: they keep their
+//   roster position and lose their share), k single-path tunnels with one common whole-unit planned
+//   bandwidth: first the largest common size U (quota flows of K = a k path units, a live heads),
+//   then for a finite design D the working size u = min(U, max(1, max live ceil(RR(D, H, i) / k)))
+//   (unlimited: U), then the cheapest routes (the route-cost sum J), then with prefer_headroom
+//   the smallest headroom penalty (each tunnel on a link pays floor(2^32 (B - V + j u) / B) for its
+//   slot j, B the static capacity), then one fixed unit-by-unit augmentation (fewest arcs, then the
+//   smallest arc keys). k = tunnel_count.per_head, or with up_to the smallest count in 1..per_head whose
+//   program carries the live part of D (else the best, then the smallest count). U = 0 with live
+//   heads, or no live head, gives a program without tunnels that keeps the roster. Forwarding is
+//   the program's: round robin over the heads, then over a head's tunnels. Its program: the
+//   tunnels (index j * H + i, weight 1, planned u); the plan names U, u, s* and the objectives.
+// Pinned: forwarding over a given program, computing nothing; the program's endpoints are the
+//   policy's. Its Eligibility repairs failures (a tunnel touching an excluded element is Failed, a
+//   split route loses its excluded members, the roster is rebuilt from the program's basis); the
+//   nodes and edges `black_holes` excludes are black holes (stale forwarding: the program is
+//   forwarded unchanged and traffic reaching one is dropped there). One record per program entry.
+struct ShortestPaths {
+  RouteAllocation allocation {RouteAllocation::Equal};
+  std::optional<SourceAllocation> source_allocation {};
+  std::optional<WeightBasis> weight_basis {};
+  std::shared_ptr<const std::vector<Amount>> edge_weights {};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool multipath {true};
+  bool parallel_edges {true};
+};
+struct DistributedTE {
+  TunnelCount tunnel_count {};
+  std::optional<CostCeiling> cost_ceiling {};
+  Amount min_unreserved_bandwidth {0};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool parallel_edges {true};
+};
+// CentralizedTE requires its source allocation: there is no default constructor.
+struct CentralizedTE {
+  explicit CentralizedTE(SourceAllocation source_allocation_) : source_allocation(source_allocation_) {}
+  SourceAllocation source_allocation;
+  bool prefer_headroom {false};
+  // Required exactly for Weighted, without tunnels: one immutable weight per graph node,
+  // each in [0, 2^62). Only capacity-blind roster members participate; every entry is validated.
+  std::shared_ptr<const std::vector<Amount>> source_weights {};
+  std::shared_ptr<const PredecessorDAG> support {};
+  std::optional<TunnelCount> tunnel_count {};
+  friend bool operator==(const CentralizedTE&, const CentralizedTE&) = default;
 };
+struct Pinned {
+  std::shared_ptr<const ForwardingProgram> program {};
+  std::shared_ptr<const Eligibility> black_holes {};
+};
+using Routing = std::variant<ShortestPaths, DistributedTE, CentralizedTE, Pinned>;
 
-// Configuration struct for FlowPolicy behavior
+// One demand's settings: the routing model, which holds every option it reads, and the admission.
+// A policy or an evaluator checks the configuration when it uses it (the fields remain
+// assignable), in this order: the enumeration values; then the model matrix below, in the order
+// route and source allocation (ShortestPaths EQUAL or WEIGHTED takes only the equal source
+// allocation; T2 with several input sources only the equal one), admission, the route-choice
+// controls (the ineffective tie rule, then the pooled single-path rule), prefer_headroom, the
+// weight combinations and, last, a ShortestPathCache on a model that does not read it; then the
+// tunnel count, an "up to" count for DistributedTE, the ceilings, min_unreserved_bandwidth and
+// edge_weights' and source_weights' lengths and entries; then the tunnel limit; then a Pinned program's endpoints.
+//
+// | model                             | allocation    | source allocation (default / allowed)  | admission       | route choice                            | weights |
+// | ShortestPaths                     | Equal         | Equal / Equal                          | Lossless, Lossy | tie_break, multipath, parallel_edges    | none |
+// | ShortestPaths                     | Weighted      | Equal / Equal                          | Lossless, Lossy | tie_break, multipath, parallel_edges    | Capacity (default), Explicit, ResidualSnapshot |
+// | ShortestPaths                     | Optimized     | Optimized / Equal, Optimized                       | Lossless        | tie_break, multipath, parallel_edges    | none |
+// | CentralizedTE                     | optimal       | required / Equal, Optimized, Weighted   | Lossless        | none                                    | source_weights exactly with Weighted |
+// | DistributedTE (T1)                | tunnels       | Equal, fixed                           | Lossless, Lossy | tie_break, parallel_edges (single path) | none |
+// | CentralizedTE with tunnels (T2)   | tunnels       | required; Optimized only with one source | Lossless, Lossy | none                                  | none |
+// | Pinned                            | the program's | the program's                          | Lossless, Lossy | none                                    | none |
+//
+// A Higher* tie_break of ShortestPaths with multipath and parallel_edges both true has nothing to
+// choose and is rejected. The policy's snapshot (config()) resolves ShortestPaths' absent
+// source_allocation (Optimized for Optimized, else Equal) and an absent weight_basis of Weighted
+// (Capacity). edge_weights (one integer per edge in [0, 2^62), shared by every configuration
+// copied from this one) is given exactly when weight_basis is Explicit and must not change while a policy holds it. T2's headroom objective is
+// CentralizedTE's prefer_headroom (true needs tunnels); a tie rule never enables a controller
+// objective. Pooled single-path rule: ShortestPaths with more than one input source (normalized,
+// before any Eligibility) and multipath = false requires tie_break = FewerHops. The tunnel limit
+// (T1, T2): roster heads times the tunnel count (the largest count for up_to) at most 2^30 - 1.
 struct FlowPolicyConfig {
-  PathAlg path_alg { PathAlg::SPF };
-  FlowPlacement flow_placement { FlowPlacement::Proportional };
-  EdgeSelection selection { EdgeSelection{} };
-  bool require_capacity { true };  // Require edges to have capacity (software-defined/traffic engineering).
-                                   // Set false for cost-only routing (traditional IP/IGP shortest-paths).
-  bool multipath { true };         // Enable individual flows to split across multiple equal-cost paths.
-                                   // When true: each flow uses a DAG containing all equal-cost paths (hash-based ECMP).
-                                   // When false: each flow uses a single path (tunnel-based ECMP, MPLS LSP semantics).
-  int min_flow_count { 1 };
-  std::optional<int> max_flow_count { std::nullopt };
-  std::optional<Cost> max_path_cost { std::nullopt };
-  std::optional<double> max_path_cost_factor { std::nullopt };
-  bool shortest_path { false };
-  bool reoptimize_flows_on_each_placement { false };
-  int max_no_progress_iterations { 100 };
-  int max_total_iterations { 10000 };
-  bool diminishing_returns_enabled { true };
-  int diminishing_returns_window { 8 };
-  double diminishing_returns_epsilon_frac { 1e-3 };
-  std::span<const bool> node_mask {};  // Optional node mask for failure exclusions (True = include)
-  std::span<const bool> edge_mask {};  // Optional edge mask for failure exclusions (True = include)
+  Routing routing {ShortestPaths {}};
+  Admission admission {Admission::Lossless};
 };
 
-// FlowPolicy manages flow creation, placement, reoptimization for a single demand
-class FlowPolicy {
-public:
-  // Constructor accepting configuration struct
-  FlowPolicy(const ExecutionContext& ctx, const FlowPolicyConfig& cfg)
-    : ctx_(ctx),
-      path_alg_(cfg.path_alg), flow_placement_(cfg.flow_placement), selection_(cfg.selection),
-      require_capacity_(cfg.require_capacity), multipath_(cfg.multipath), shortest_path_(cfg.shortest_path),
-      min_flow_count_(cfg.min_flow_count), max_flow_count_(cfg.max_flow_count), max_path_cost_(cfg.max_path_cost),
-      max_path_cost_factor_(cfg.max_path_cost_factor), reoptimize_flows_on_each_placement_(cfg.reoptimize_flows_on_each_placement),
-      max_no_progress_iterations_(cfg.max_no_progress_iterations), max_total_iterations_(cfg.max_total_iterations),
-      diminishing_returns_enabled_(cfg.diminishing_returns_enabled), diminishing_returns_window_(cfg.diminishing_returns_window),
-      diminishing_returns_epsilon_frac_(cfg.diminishing_returns_epsilon_frac)
-  {
-    // Validate mask sizes early for clearer error messages
-    const auto* g = ctx_.graph.graph.get();
-    if (g) {
-      if (!cfg.node_mask.empty() && cfg.node_mask.size() != static_cast<std::size_t>(g->num_nodes())) {
-        throw std::invalid_argument("FlowPolicy: node_mask length mismatch");
-      }
-      if (!cfg.edge_mask.empty() && cfg.edge_mask.size() != static_cast<std::size_t>(g->num_edges())) {
-        throw std::invalid_argument("FlowPolicy: edge_mask length mismatch");
-      }
-    }
-
-    // Copy mask data if provided
-    if (!cfg.node_mask.empty()) {
-      node_mask_storage_.reset(new bool[cfg.node_mask.size()]);
-      std::copy(cfg.node_mask.begin(), cfg.node_mask.end(), node_mask_storage_.get());
-      node_mask_ = std::span<const bool>(node_mask_storage_.get(), cfg.node_mask.size());
-    }
-    if (!cfg.edge_mask.empty()) {
-      edge_mask_storage_.reset(new bool[cfg.edge_mask.size()]);
-      std::copy(cfg.edge_mask.begin(), cfg.edge_mask.end(), edge_mask_storage_.get());
-      edge_mask_ = std::span<const bool>(edge_mask_storage_.get(), cfg.edge_mask.size());
-    }
-  }
+// Optional outputs of a placement (absent unless requested): edge_flows (this policy's own
+// allocation per edge after the call), residual and saturated_boundary_edges (the ledger's after
+// the call), min_cut (CentralizedTE with the optimized source allocation; see
+// PlacementResult::min_cut) and edge_reservations (this policy's strict holds per edge after the
+// call, zeros for a model without holds).
+struct OutputOptions {
+  bool edge_flows {false};
+  bool residual {false};
+  bool saturated_boundary_edges {false};
+  bool min_cut {false};
+  bool edge_reservations {false};
+};
 
-  ~FlowPolicy() noexcept = default;
+// The call's outcome, the first that applies: Complete for a zero request; NoRoute for a
+// positive request with an empty roster (no eligible source statically reaches an allowed
+// destination); NoActiveWeight when the program has an entry with a path (an up tunnel, a
+// controller path or a split route) but no roster source has both a positive injection weight and
+// an entry of positive weight with a usable route (Weighted over edges of capacity 0 only, all
+// entry weights 0, every remaining captured weight 0, every up tunnel failed); a program whose
+// tunnels are all down is not this case. A live CentralizedTE Weighted call without tunnel_count
+// with a positive offer and a nonempty all-zero source-weight roster is also NoActiveWeight,
+// with no tunnels; Pinned replay of that empty program follows the remaining rules.
+// Then a Lossy finite request: Complete (delivery and
+// losses account for the whole offer, which does not mean nothing was lost); otherwise Complete
+// when the whole request was delivered, else Exhausted (an infinite request is Exhausted). A
+// controller whose maximum is 0 over existing routes is Exhausted, not NoRoute.
+enum class Termination { Complete, NoRoute, Exhausted, NoActiveWeight };
 
-  [[nodiscard]] int flow_count() const noexcept { return static_cast<int>(flows_.size()); }
-  [[nodiscard]] double placed_demand() const noexcept;
+// One normalized input source's forwarding in the epoch (zero rows included: a masked or
+// unreachable source): offered (Lossy only: its injections), admitted (Lossless: what it
+// delivers; Lossy: offered), delivered, source_drops (offered shares lost at the source for lack
+// of a usable route) and total_edge_drops (its losses on links). Lossy: offered = delivered +
+// source_drops + total_edge_drops.
+struct SourceFlow {
+  NodeId source {0};
+  std::optional<Counter128> offered {};
+  Counter128 admitted {};
+  Amount delivered {0};
+  Counter128 source_drops {};
+  Counter128 total_edge_drops {};
+  friend bool operator==(const SourceFlow&, const SourceFlow&) = default;
+};
 
-  // Core operations.
-  //
-  // A FlowPolicy manages the flows of a SINGLE demand. Once it holds flows, calling
-  // place_demand() with a different (src, dst) throws std::invalid_argument, because
-  // the round-robin loop routes using the src/dst stored on the existing flow records.
-  // Use one policy per demand, or call remove_demand() first to retarget it.
-  //
-  // `fg` must wrap the same StrictMultiDiGraph as the policy's own graph handle;
-  // placing onto a FlowGraph built from a different graph is rejected.
-  //
-  // Returns (placed, remaining). NOTE for EqualBalanced: when the equalizing
-  // rebalance runs, `placed` is the policy's TOTAL placed demand (cumulative
-  // across calls, since rebalancing re-places previously placed volume too) and
-  // `placed + remaining` can therefore exceed this call's `volume`. Use
-  // placed_demand() deltas for strict per-call accounting.
-  [[nodiscard]] std::pair<double,double> place_demand(FlowGraph& fg,
-                                        NodeId src, NodeId dst,
-                                        FlowClass flowClass,
-                                        double volume,
-                                        std::optional<double> target_per_flow = std::nullopt,
-                                        std::optional<double> min_flow = std::nullopt);
+// One program tunnel's forwarding in the epoch: its entry identifier and head, its status in this
+// forwarding (Up, Failed, Blackholed), assigned (its share of the injections: Lossy the shares sent
+// to it, Lossless what it carries), delivered and total_edge_drops (its losses on links).
+struct TunnelFlow {
+  std::int32_t entry_id {0};
+  NodeId head {0};
+  TunnelStatus status {TunnelStatus::Up};
+  Counter128 assigned {};
+  Amount delivered {0};
+  Counter128 total_edge_drops {};
+  friend bool operator==(const TunnelFlow&, const TunnelFlow&) = default;
+};
 
-  // Re-places the currently placed volume so each flow carries ~target_per_flow.
-  // (src, dst) must match the demand this policy already manages.
-  [[nodiscard]] std::pair<double,double> rebalance_demand(FlowGraph& fg,
-                                            NodeId src, NodeId dst,
-                                            FlowClass flowClass,
-                                            double target_per_flow);
+// The tunnel models' setup summary (PlacementResult::plan): tunnels_per_head (T2 up to: the
+// chosen count), design_demand (nullopt: unlimited), design_by_head ((head, RR(D, H, i)) for every
+// roster head in ascending NodeId; empty for an unlimited design) and total_reserved_bandwidth
+// (T1's strict holds, counted once per up tunnel: the sum of their requests; 0 for T2). T2 only
+// (nullopt for T1): heads_with_capacity (ascending), insufficient_resolution (heads with capacity
+// exist but U = 0: the program has no tunnels), max_fractional_bandwidth_per_tunnel (the exact
+// fluid optimum s* as a reduced fraction (numerator, denominator); 0 / 1 without such a head),
+// max_bandwidth_per_tunnel (U), planned_bandwidth_per_tunnel (u), total_planned_bandwidth (K u),
+// total_tunnel_cost (J, below 2^92), headroom_penalty (Phi, below 2^94; with prefer_headroom only)
+// and max_lossless_offer (F: the program's lossless maximum on the call's view, a dead head's
+// share blocking).
+struct TunnelPlan {
+  std::int64_t tunnels_per_head {0};
+  std::optional<Amount> design_demand {};
+  std::vector<std::pair<NodeId, Amount>> design_by_head {};
+  Amount total_reserved_bandwidth {0};
+  std::optional<std::vector<NodeId>> heads_with_capacity {};
+  std::optional<bool> insufficient_resolution {};
+  std::optional<std::pair<Amount, Amount>> max_fractional_bandwidth_per_tunnel {};
+  std::optional<Amount> max_bandwidth_per_tunnel {};
+  std::optional<Amount> planned_bandwidth_per_tunnel {};
+  std::optional<Amount> total_planned_bandwidth {};
+  std::optional<Counter128> total_tunnel_cost {};
+  std::optional<Counter128> headroom_penalty {};
+  std::optional<Amount> max_lossless_offer {};
+  friend bool operator==(const TunnelPlan&, const TunnelPlan&) = default;
+};
 
-  void remove_demand(FlowGraph& fg);
+// The result of one call: this call's values, then the demand's state after it (totals of the
+// epoch), then the optional outputs.
+// This call: call_delivered (units delivered by the call; replace, forward and evaluate: the full
+// new delivery), call_undelivered = request - call_delivered (nullopt for +inf), delivery_delta
+// (new minus old delivery; call_delivered for a placement, may be negative for replace),
+// call_edge_drops (this call's drops per edge, ascending EdgeId), call_source_drops, termination
+// and the change flags, which compare
+// the program before and after the call ("no program" is the empty program; two programs without
+// an entry are equal): routes_changed the ordered heads, paths, split tables and duplicates;
+// weights_changed the injection (the source weights) and every entry and split-table weight (an
+// absent entry weighs 0); reservations_changed every tunnel's requested and reserved amounts by
+// index (an absent tunnel holds (0, 0); only T1 sets it: T2's planned bandwidth is no
+// reservation). An offer-only change to a program that
+// is not recomputed (forward, Pinned, ShortestPaths increments) sets none of them; a controller's
+// re-solve that changes a path's amount is a weight change; an identical replace sets none.
+// State: program (the installed program after the call; evaluate: the computed one; null before
+// the epoch's first preparation), plan (T1 and T2: the setup of that program; nullopt for every
+// other model, Pinned over a tunnel program too), requested (the sum of the requests;
+// nullopt after +inf), offered (Lossy only: the traffic actually sent; the first-hop injection of a
+// Lossy +inf), admitted (Lossless: the total carried; Lossy: offered), delivered, unadmitted
+// (Lossless: requested - delivered, nullopt after +inf; Lossy: 0), source_drops and edge_drops
+// (per edge). Lossy: offered = source_drops + sum(edge_drops) + delivered. by_source has one row per
+// normalized input source in ascending NodeId; the rows sum to the totals except for Lossy with an
+// empty roster, where the whole offer is source loss of the demand and every row is zero.
+// by_tunnel has one row per program tunnel in ascending index (empty without tunnels); it is an
+// alternative view of the same traffic, never added to by_source. total_cost (controllers: CentralizedTE
+// and ShortestPaths Optimized) is the exact sum of cost * flow over the policy's allocation (below 2^124;
+// nullopt for the tunnel models and Pinned).
+// marginal_cost_curve: unrestricted CentralizedTE with the optimized source allocation only, the cumulative marginal
+// cost curve: (cost, units) pairs in ascending cost, where delivering `units` more units raised the
+// minimum total cost of the flow by `cost` per unit (more delivery can reroute flow already placed,
+// so the pairs are not the costs of the paths in the final allocation); empty for an empty roster,
+// and absent before the epoch's first positive call. Optional outputs describe the same state as
+// the rest of the result (evaluate: the evaluated state).
+struct PlacementResult {
+  Amount call_delivered {0};
+  std::optional<Amount> call_undelivered {};
+  Amount delivery_delta {0};
+  std::vector<std::pair<EdgeId, Amount>> call_edge_drops {};
+  Amount call_source_drops {0};
+  Termination termination {Termination::Complete};
+  bool routes_changed {false};
+  bool weights_changed {false};
+  bool reservations_changed {false};
+  std::shared_ptr<const ForwardingProgram> program {};
+  std::optional<TunnelPlan> plan {};
+  std::optional<Counter128> requested {};
+  std::optional<Counter128> offered {};
+  Counter128 admitted {};
+  Amount delivered {0};
+  std::optional<Counter128> unadmitted {};
+  Counter128 source_drops {};
+  std::vector<std::pair<EdgeId, Counter128>> edge_drops {};
+  std::vector<SourceFlow> by_source {};
+  std::vector<TunnelFlow> by_tunnel {};
+  std::optional<Counter128> total_cost {};
+  std::optional<std::vector<std::pair<Cost, Amount>>> marginal_cost_curve {};
+  std::optional<std::vector<Amount>> edge_flows {};
+  std::optional<std::vector<Amount>> residual {};
+  std::optional<std::vector<EdgeId>> saturated_boundary_edges {};
+  std::optional<std::vector<Amount>> edge_reservations {};
+  // Requested by OutputOptions::min_cut; unrestricted CentralizedTE with the optimized source allocation only, when
+  // the solve reached the maximum flow: the edges leaving the set of nodes the roster sources reach
+  // through residual arcs (free capacity plus this policy's own load, reverse arcs that cancel flow
+  // included), whatever their free capacity (an allowed edge of capacity 0 is listed; an excluded
+  // edge is not an edge here), ascending EdgeId. That is the minimum cut closest to the sources; an
+  // empty roster returns an empty cut. nullopt otherwise (another model, prescribed Equal/Weighted sources, a
+  // support, a call below the maximum, a zero call, forward).
+  std::optional<std::vector<EdgeId>> min_cut {};
+};
 
-  [[nodiscard]] const std::unordered_map<FlowIndex, FlowRecord, FlowIndexHash>& flows() const noexcept { return flows_; }
+// A policy binds to its ledger at construction. Every call validates, then computes on working
+// copies and publishes all changes together, or none. The ledger's single gate covers
+// every policy call and mutable read; config() is immutable and lock-free.
+// place(offer) adds offer to the epoch: ShortestPaths prepares its program at the epoch's first positive call
+// (every roster source's shortest routes on the ledger's residual at that call's entry) and keeps
+// it for the epoch. Equal/Weighted with FewerHops or HigherCapacity and static weights retain
+// that immutable preparation across epochs, with fresh-equivalent values. evaluate reads an
+// already retained preparation but never installs one; remove still clears the visible program.
+// Equal and Weighted forward the equal source allocation over the pooled routes:
+// Lossless admits the largest total a in [admitted, admitted + offer] whose no-drop forwarding fits
+// the residual plus the policy's own load (a refused unit is not offered again), Lossy forwards
+// the new round-robin injections on the residual at call entry (earlier drops are not offered
+// again). The controllers (CentralizedTE, ShortestPaths Optimized) re-solve admitted + offer from zero on the
+// residual plus their own allocation and export the solve as their program; the equal source allocation admits
+// the largest total whose round-robin supplies are all carried. Pinned forwards its program the
+// same way (Lossless: the largest total in [admitted, admitted + offer]; Lossy: the round-robin
+// or captured-weight increments of the injection, each head splitting its increment afresh).
+// T1 and T2 have no place (rejected, also for 0).
+// evaluate(offer, design_demand) is a full, independent computation and forwarding of the offer
+// from the policy's own released view (the residual plus its own carried load; T1 sets up on the
+// unreserved capacity with its own holds released): it publishes nothing, creates no record and
+// leaves the epoch as it was. replace(offer, design_demand) is the same, published atomically: the
+// old records and holds are retired, new ones created, and a new epoch starts at this offer
+// (delivery may go down). design_demand (T1 and T2; every other model rejects it): absent means D
+// = offer, an inner nullopt +inf; T1 needs a finite D, T2 takes an unlimited one (u = U). T2 lays
+// out its tunnels on the residual with its own traffic released. forward(offer, black_holes) forwards a full
+// new offer over the installed program with no route computation and no setup (Lossless: the
+// fixed program's lossless bound; Lossy: the offer's injections) on the released view, starts a
+// new epoch like replace, and keeps the program, its plan and T1's holds; with black_holes, the nodes and
+// edges it excludes are black holes for that call. A Lossy replace, forward or evaluate needs a
+// finite offer; a Lossy +inf is ShortestPaths place's first-hop experiment only. remove() releases
+// every policy flow and hold, retires their ids, clears the program and starts a new epoch: the
+// period since construction, the last remove(), replace() or forward() over which requests and
+// flows accumulate. Destroying a policy without remove() leaves its records and holds in the
+// ledger as orphans.
+//
+// Validation (std::invalid_argument, before anything binds), in this order: the endpoint sets
+// (non-empty, ids in range, disjoint), the ownership of the Eligibility, the program, the support,
+// the ShortestPathCache and the black holes by the ledger's graph, the configuration (FlowPolicyConfig's
+// order), then the roster and count rules (the pooled single-path rule; T2's several-sources
+// rule; the tunnel limit; a Pinned program's endpoints equal to the policy's). A call validates the
+// operation for the model (T1's and T2's place), the request ([0,
+// 2^62) units or +inf), a Lossy full offer's finiteness, the design demand (the model accepts one,
+// [0, 2^62) or +inf, T1 finite), a finite place after +inf in the epoch (rejected, also 0) and the black holes' graph
+// (forward) before any change. Argument/immutable checks run first; installed-program, epoch
+// and counter checks then run under the gate, in that order. A solve of the flow core (CentralizedTE, ShortestPaths Optimized, a Optimized flow) whose
+// network exceeds the core's int32 numbering throws std::invalid_argument, and the call changes
+// nothing: more than INT32_MAX - 2 nodes, or more than 2^30 - 1 edges, sources and destinations
+// together. A Lossy forwarding whose losses wait on each other in a cycle that alternates between
+// two states or does not settle within its round limit throws std::invalid_argument; a failed
+// check of an iterated forwarding throws std::runtime_error; neither publishes anything.
+//
+// Lifetime: the ledger and Eligibility outlive the policy. A cache is read during
+// construction; the support DAG is retained by the policy. A Pinned policy shares its program and black holes. The roster (the eligible
+// sources that statically reach an allowed destination, over allowed edges whatever their
+// capacity, the tunnel models' heads; Pinned: the program's roster heads that reach an allowed destination over
+// its basis under the Eligibility) is fixed at construction.
+class FlowPolicy {
+public:
+  FlowPolicy(FlowLedger& ledger, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+             FlowPolicyConfig config, const Eligibility* eligibility = nullptr, ShortestPathCache* cache = nullptr);
+  FlowPolicy(const FlowPolicy&) = delete;
+  FlowPolicy& operator=(const FlowPolicy&) = delete;
+  FlowPolicy(FlowPolicy&&) = delete;
+  FlowPolicy& operator=(FlowPolicy&&) = delete;
+  ~FlowPolicy() noexcept;
 
-  // Pin this policy's demand to explicit path bundles (MPLS-style routing).
-  //
-  // One flow is created per USABLE bundle at the next placement, in supply order,
-  // each permanently bound to its own bundle. A single-path bundle (e.g. from
-  // make_path_dag / PredDAG.from_edges or ksp) models a strict-ERO LSP: any failed
-  // hop takes it down. A multi-walk bundle (e.g. an SPF DAG) models a pinned DAG /
-  // SR-TE-style policy that renormalizes over its surviving walks.
-  //
-  // Each bundle is validated against the policy's graph (shape, id ranges,
-  // edge-endpoint consistency, acyclicity, and an src->dst walk), then pruned
-  // against the policy's node/edge masks. A bundle with no surviving src->dst walk
-  // is DOWN: it creates no flow and carries nothing (a pinned path does not
-  // reroute around failures). Each flow's cost is the min-cost src->dst walk of
-  // its PRUNED bundle, computed from the graph's edge costs.
-  //
-  // With static paths configured the policy neither creates additional flows nor
-  // reoptimizes: max_path_cost, max_path_cost_factor, min_flow_count and
-  // reoptimize_flows_on_each_placement are inert. EqualBalanced spreads over the
-  // usable (up) bundles only and equalizes the carried volume per bundle;
-  // EqualBalancedLossy offers each up bundle an equal
-  // share and lets it carry what fits (no equalizing rebalance), so placed is the
-  // delivered total. flow_count() reports the usable count U; the supplied count
-  // N is the caller's, so down LSPs = N - flow_count().
-  //
-  // Throws std::invalid_argument if bundles is empty, the policy already holds
-  // flows (remove_demand() first), shortest_path=true is configured (single-
-  // augmentation IP semantics contradict pinned multi-LSP placement), src/dst is
-  // invalid or src == dst, a user-supplied max_flow_count differs from
-  // bundles.size(), or any bundle is malformed. Calling again before placement
-  // replaces the previous pinning.
-  void set_static_paths(NodeId src, NodeId dst, std::vector<PredDAG> bundles);
+  // offer and an inner design_demand: units, nullopt is +inf; an absent design_demand is
+  // the offer.
+  PlacementResult place(std::optional<Amount> offer, const OutputOptions& outputs = {});
+  [[nodiscard]] PlacementResult evaluate(std::optional<Amount> offer,
+                                         const std::optional<std::optional<Amount>>& design_demand = std::nullopt,
+                                         const OutputOptions& outputs = {}) const;
+  PlacementResult replace(std::optional<Amount> offer,
+                          const std::optional<std::optional<Amount>>& design_demand = std::nullopt,
+                          const OutputOptions& outputs = {});
+  // black_holes: an Eligibility of the policy's graph, or null for none (Pinned: rejected, its
+  // black holes are part of its configuration).
+  PlacementResult forward(std::optional<Amount> offer, const Eligibility* black_holes = nullptr,
+                          const OutputOptions& outputs = {});
+  void remove();
+  // The sum of delivered over this policy's live records.
+  [[nodiscard]] Amount delivered() const;
+  // This policy's live records as snapshots in FlowId order.
+  [[nodiscard]] std::vector<FlowRecord> records() const;
+  // One of this policy's live records; a FlowId of another ledger or policy, a retired or an
+  // unknown id throws std::invalid_argument.
+  [[nodiscard]] FlowRecord record(const FlowId& flow_id) const;
+  // A gated snapshot of the installed program: null before preparation and after remove().
+  [[nodiscard]] std::shared_ptr<const ForwardingProgram> program() const;
+  // The configuration as validated at construction: a copy whose absent source_allocation and
+  // weight_basis are resolved to the model's defaults (FlowPolicyConfig).
+  [[nodiscard]] const FlowPolicyConfig& config() const noexcept;
 
 private:
-  // Helpers
-  // Throws std::invalid_argument if fg wraps a different graph than this policy, or if
-  // (src, dst) differs from the demand already managed here. `what` names the caller.
-  void check_demand_target(const FlowGraph& fg, NodeId src, NodeId dst, const char* what) const;
-  // Placement core: target computation, flow creation, round-robin placement, and
-  // the optional post-placement reoptimization. The public place_demand() wraps it
-  // with the iterative EqualBalanced rebalance rounds.
-  [[nodiscard]] std::pair<double,double> place_demand_body(FlowGraph& fg,
-                                             NodeId src, NodeId dst,
-                                             FlowClass flowClass,
-                                             double volume,
-                                             std::optional<double> target_per_flow,
-                                             std::optional<double> min_flow);
-  [[nodiscard]] std::optional<std::pair<PredDAG, Cost>> get_path_bundle(const FlowGraph& fg,
-                                                          NodeId src, NodeId dst,
-                                                          std::optional<double> min_flow);
-  [[nodiscard]] FlowRecord* create_flow(FlowGraph& fg, NodeId src, NodeId dst, FlowClass flowClass,
-                    std::optional<double> min_flow);
-  [[nodiscard]] FlowRecord* reoptimize_flow(FlowGraph& fg, const FlowIndex& idx, double headroom);
-
-  // Config
-  ExecutionContext ctx_;
-  PathAlg path_alg_ { PathAlg::SPF };
-  FlowPlacement flow_placement_ { FlowPlacement::Proportional };
-  EdgeSelection selection_ { EdgeSelection{} };
-  bool require_capacity_ { true };
-  bool multipath_ { true };
-  bool shortest_path_ { false };
-  int min_flow_count_ { 1 };
-  std::optional<int> max_flow_count_ {};
-  std::optional<Cost> max_path_cost_ {};
-  std::optional<double> max_path_cost_factor_ {};
-  bool reoptimize_flows_on_each_placement_ { false };
-  int max_no_progress_iterations_ { 100 };
-  int max_total_iterations_ { 10000 };
-  bool diminishing_returns_enabled_ { true };
-  int diminishing_returns_window_ { 8 };
-  double diminishing_returns_epsilon_frac_ { 1e-3 };
-
-  // Mask storage and views for failure exclusions
-  std::unique_ptr<bool[]> node_mask_storage_;
-  std::unique_ptr<bool[]> edge_mask_storage_;
-  std::span<const bool> node_mask_ {};
-  std::span<const bool> edge_mask_ {};
-
-  // State
-  std::unordered_map<FlowIndex, FlowRecord, FlowIndexHash> flows_;
-  Cost best_path_cost_ { std::numeric_limits<Cost>::max() };
-  FlowId next_flow_id_ { 0 };
+  friend struct detail::PolicyAccess;
+  FlowPolicy() noexcept;
+  // Construction inside another public call (an evaluator): a supplied frozen cache's hits are
+  // recorded in that call's tally.
+  FlowPolicy(FlowLedger& ledger, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+             FlowPolicyConfig config, const Eligibility* eligibility, ShortestPathCache* cache, detail::FrozenCacheHitTally& tally, const detail::TunnelRoster* roster);
+  std::unique_ptr<detail::PolicyEngine> engine_;
+  // A Python __new__ shell can be visible while __init__ is detached. The engine
+  // stays at the same address after this release publication under its gate.
+  std::atomic<bool> ready_ {false};
+};
 
-  // Memo of recent raw SPF results computed by get_path_bundle(), used only in
-  // EqualBalanced mode. SPF is a pure function of (graph, selection, multipath,
-  // node_mask, src, dst, residual, edge_mask); in EB mode everything except
-  // (src, dst, residual, min_flow) is fixed for the lifetime of the policy (the
-  // min_flow-derived edge mask is Proportional-only), so those four ARE the key.
-  // EB placement and rebalance rounds re-request bundles against residual
-  // content that repeats -- 94% of SPF calls in a measured place/rebalance
-  // cycle were exact input repeats, largely remove+place round-trips that
-  // restore identical bytes -- and the memo elides those calls without changing
-  // any output. Matching is exact: a (uid, version) StateStamp equality is the
-  // fast path (unchanged FlowGraph implies unchanged content), with a full
-  // residual memcmp as the content path (catches the round-trips). Proportional
-  // mode measured 0% repeats, so it skips the memo and pays nothing. Cost gates
-  // and best_path_cost_ updates still run on every call, hit or miss: they
-  // depend on mutable policy state.
-  struct SpfMemoEntry {
-    NodeId src = -1, dst = -1;
-    bool with_residual = false;
-    FlowGraph::StateStamp stamp {0, 0};
-    std::vector<Cap> residual;  // key copy; empty when SPF ran residual-blind
-    bool has_min_flow = false;  // toggles require_residual; the value is Proportional-only
-    PredDAG dag;
-    Cost dst_cost = 0;
-  };
-  // MRU order: front = most recent. Entry count adapts to graph size so the
-  // memo stays under ~512 KiB per policy regardless of edge count.
-  static constexpr std::size_t kSpfMemoMaxEntries = 24;
-  static constexpr std::size_t kSpfMemoMaxBytes = 512 * 1024;
-  std::vector<SpfMemoEntry> spf_memo_;
+// ---------------------------------------------------------------- several demands at once
 
-  // Static paths (optional): usable (mask-pruned) bundles, one flow per bundle.
-  struct StaticBundle {
-    PredDAG dag;   // pruned to mask-surviving entries
-    Cost cost {0}; // min-cost src->dst walk within the pruned bundle
-  };
-  NodeId static_src_ {-1};
-  NodeId static_dst_ {-1};
-  int static_supplied_count_ {0};  // N as supplied; usable U = static_bundles_.size()
-  std::vector<StaticBundle> static_bundles_;
+// How apply_actions runs its list: Ordered, each action as its scalar call on the state the earlier
+// ones left; Simultaneous, every action forwarded at once with the loss rule across demands.
+enum class BatchMode { Ordered, Simultaneous };
 
-  [[nodiscard]] bool has_static_paths() const noexcept { return !static_bundles_.empty() || static_supplied_count_ > 0; }
+// The actions of a list. Offers are as in FlowPolicy::place (nullopt: +inf); Replace's design demand
+// as in FlowPolicy::replace (outer nullopt absent, inner nullopt +inf); Forward's black holes an
+// Eligibility of the policy's graph or null. They borrow the policy and the black holes, which must
+// outlive the call.
+struct Place {
+  std::reference_wrapper<FlowPolicy> policy;
+  std::optional<Amount> offer;
+};
+struct Replace {
+  std::reference_wrapper<FlowPolicy> policy;
+  std::optional<Amount> offer;
+  std::optional<std::optional<Amount>> design_demand {};
 };
+struct Forward {
+  std::reference_wrapper<FlowPolicy> policy;
+  std::optional<Amount> offer;
+  const Eligibility* black_holes {nullptr};
+};
+using Action = std::variant<Place, Replace, Forward>;
+
+// Several policies of one ledger in one operation, validated whole, then computed, then published
+// once (one atomic exchange of every policy's records, then their epochs): an exception leaves the
+// ledger and every policy unchanged. Results in list order, each the scalar call's fields for its
+// policy.
+//
+// Ordered: each action runs in list order on a private working state (the ledger's carried loads and
+// holds as the earlier actions left them) exactly as its scalar call would; its outputs (residual,
+// saturated_boundary_edges) read the state after it; new records take FlowIds in list order, then in
+// each call's draft order. Simultaneous: Replace of ShortestPaths Equal or Weighted (its program
+// prepared on the view) and of Pinned, Forward of any policy with an installed program, every one
+// Lossy with a finite offer, forwarded at once on one view (the ledger's residual plus every
+// participant's old carried load; outside owners and orphans fixed, holds never added) by the loss
+// rule across demands: at a link that cannot carry its arrivals, highest averages over the demands
+// (ties by policy creation order, not list position), then within a demand over its sources, then
+// its entries; a pooled ShortestPaths demand splits once at each router and attributes each member's
+// amount to its sources; each participant's black holes are its own (what reaches one is dropped
+// there); losses that wait on each other in a cycle across demands are iterated as for one program,
+// with its two errors. Every entry reports the one residual after the list and its own
+// saturated_boundary_edges on it. An empty list returns nothing after checking the ledger and mode.
+//
+// Validation has two passes in the order below: arguments/immutable objects first, then mutable
+// state under the gate. Nothing computes before both passes finish. The ledger (a moved-from one:
+// std::logic_error), `mode` a BatchMode value (`mode: <v> is not a value of BatchMode`); then each
+// action's argument checks in list order: `list policy belongs to another
+// ledger`; `duplicate policy in list` (at the second occurrence); Simultaneous only, in this order,
+// `SIMULTANEOUS does not accept Place`, `SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED,
+// or Pinned`, `SIMULTANEOUS requires admission=LOSSY`, `SIMULTANEOUS requires finite offers`; then
+// the scalar call's argument checks. Ledger usability and every action's mutable checks run
+// under the gate, in list order. A computation error (the loss iteration's errors, a
+// solver or forwarding size, the record identity limit counted for the whole list) also changes
+// nothing.
+std::vector<PlacementResult> apply_actions(FlowLedger& ledger, std::span<const Action> actions,
+                                           BatchMode mode = BatchMode::Ordered, const OutputOptions& outputs = {});
 
 } // namespace netgraph::core
diff --git a/include/netgraph/core/flow_record.hpp b/include/netgraph/core/flow_record.hpp
new file mode 100644
index 0000000..55e6e51
--- /dev/null
+++ b/include/netgraph/core/flow_record.hpp
@@ -0,0 +1,63 @@
+/* Flow identities, the 128-bit counter and the ledger records. */
+#pragma once
+
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+// (ledger uid, id): ids are assigned by the ledger in creation order and never reused.
+using FlowId = std::pair<std::uint64_t, std::int64_t>;
+
+// A cumulative counter (offered, per-edge drops): a sum over calls, the 128-bit value
+// hi * 2^64 + lo, always below 2^127. Such sums over many calls may exceed 64 bits; the
+// Python binding returns them as exact int.
+struct Counter128 {
+  std::uint64_t hi {0};
+  std::uint64_t lo {0};
+  friend bool operator==(const Counter128&, const Counter128&) = default;
+  [[nodiscard]] bool is_zero() const noexcept { return hi == 0 && lo == 0; }
+  // The sum with a non-negative amount; false (and no change) when the sum reaches 2^127.
+  bool add(Amount x) noexcept {
+    const auto ux = static_cast<std::uint64_t>(x);
+    const std::uint64_t lo2 = lo + ux;
+    const std::uint64_t hi2 = hi + (lo2 < lo ? 1U : 0U);
+    if (hi2 >= (std::uint64_t{1} << 63)) return false;
+    hi = hi2;
+    lo = lo2;
+    return true;
+  }
+};
+
+// A snapshot of one ledger flow, returned by records() or record(id). `route` is its route
+// structure; `min_route_cost` is the minimum walk cost from its sources to its destinations over
+// that route, or kUnreachable if none exists. `entry_id` is the program entry the record carries
+// (T1, T2 and Pinned: one record per entry, the entry identifier of its program); absent for the
+// records kept per roster source (ShortestPaths, CentralizedTE). Lossy records alone have `offered`: the
+// cumulative amount submitted to this flow before any drops. `edge_flows` (carried load), `edge_drops`
+// and `edge_reservations` (the strict holds of an up T1 tunnel: its request on every link of its path)
+// contain positive values in ascending EdgeId; per-call and cumulative drop totals are derived.
+struct FlowRecord {
+  FlowId flow_id {};
+  std::int64_t policy_id {0};
+  std::vector<NodeId> sources {};
+  std::vector<NodeId> destinations {};
+  Admission admission {Admission::Lossless};
+  std::optional<std::int32_t> entry_id {};
+  std::shared_ptr<const PredecessorDAG> route {};
+  Cost min_route_cost {kUnreachable};
+  std::optional<Counter128> offered {};
+  Amount delivered {0};
+  std::vector<std::pair<EdgeId, Amount>> edge_flows {};
+  std::vector<std::pair<EdgeId, Counter128>> edge_drops {};
+  std::vector<std::pair<EdgeId, Amount>> edge_reservations {};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/flow_state.hpp b/include/netgraph/core/flow_state.hpp
deleted file mode 100644
index 6fe9c20..0000000
--- a/include/netgraph/core/flow_state.hpp
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
-  FlowState — per-edge residual/flow tracking and placement helpers.
-  Implements proportional (WCMP-like) and equal-balanced (ECMP) placements
-  over shortest-path (Dijkstra) predecessor DAGs.
-  ECMP = Equal-Cost Multi-Path; WCMP = Weighted-Cost Multi-Path.
-*/
-#pragma once
-
-#include <cstdint>
-#include <span>
-#include <utility>
-#include <vector>
-
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
-#include "netgraph/core/max_flow.hpp"
-
-namespace netgraph::core {
-
-// FlowState maintains per-edge residual capacity and per-edge placed flow for a
-// given immutable StrictMultiDiGraph. It places flow on a predecessor DAG (PredDAG)
-// using either proportional or equal-balanced strategies, updating internal
-// residuals deterministically.
-class FlowState {
-public:
-  explicit FlowState(const StrictMultiDiGraph& g);
-  FlowState(const StrictMultiDiGraph& g, std::span<const Cap> residual_init);
-  ~FlowState() noexcept = default;
-
-  // Reset residual to the graph's initial capacities and clear edge_flow.
-  void reset() noexcept;
-  void reset(std::span<const Cap> residual_init);
-
-  // Views over internal buffers (length == g.num_edges()).
-  [[nodiscard]] std::span<const Cap> capacity_view() const noexcept { return g_->capacity_view(); }
-  [[nodiscard]] std::span<const Cap> residual_view() const noexcept { return residual_; }
-  [[nodiscard]] std::span<const Flow> edge_flow_view() const noexcept { return edge_flow_; }
-
-  // Access underlying graph (const).
-  [[nodiscard]] const StrictMultiDiGraph& graph() const noexcept { return *g_; }
-
-  // Mutating placement along a given PredDAG tier between src and dst.
-  // requested_flow may be +inf. Returns the amount actually placed.
-  //
-  // EqualBalanced semantics here are *single-pass ECMP admission*:
-  //  - Use the supplied DAG and fixed equal per-edge splits per (u->v) group.
-  //  - Compute one global scale:  min_g cap_rev[g] / assigned[g],
-  //      where cap_rev[g] = min_edge_residual(g) * |E_g|
-  //        (enforces equal per-edge shares),
-  //            assigned[g] = unit-demand load on group g under equal splits.
-  //  - Place once and return. The split set is every DAG edge with capacity,
-  //    so a member filled since the DAG was built yields scale 0 and nothing
-  //    is placed; progression past a full member comes from recomputing the
-  //    DAG with a residual-aware SPF, not from re-invoking this on a stale one.
-  //
-  // EqualBalancedLossy splits over the same capacity-based set without scaling:
-  // each edge carries min(share, residual), the excess is dropped, and the
-  // returned amount is what reaches dst. When `drops` is given it receives one
-  // (edge, dropped) entry per edge that dropped flow. Drops are recorded only
-  // for finite requested_flow; an infinite request fills every source edge and
-  // records no drops. Other placements never write to `drops`.
-  [[nodiscard]] Flow place_on_dag(NodeId src, NodeId dst,
-                    const PredDAG& dag,
-                    Flow requested_flow,
-                    FlowPlacement placement,
-                    // Optional trace collector to record per-edge allocations applied by this call
-                    std::vector<std::pair<EdgeId, Flow>>* trace = nullptr,
-                    // Optional collector for per-edge dropped volume (EqualBalancedLossy only)
-                    std::vector<std::pair<EdgeId, Flow>>* drops = nullptr);
-
-  // Convenience: run repeated placements until exhaustion (or single tier when
-  // shortest_path=true). Returns total placed flow. Uses internal residual.
-  //
-  // require_capacity: Whether to require edges to have capacity.
-  //   - true (default): Routes adapt to residuals (SDN/TE behavior).
-  //   - false: Routes based on costs only (IP/IGP behavior).
-  //
-  // NOTE: With FlowPlacement::EqualBalanced + require_capacity=true, this behaves as a
-  // progressive "fill": it recomputes the SPF DAG after each saturation. That is *not*
-  // the single-pass ECMP admission used by place_on_dag(). For IP ECMP, use
-  // require_capacity=false + shortest_path=true + EqualBalanced.
-  [[nodiscard]] Flow place_max_flow(NodeId src, NodeId dst,
-                      FlowPlacement placement,
-                      bool shortest_path = false,
-                      bool require_capacity = true,
-                      std::span<const bool> node_mask = {},
-                      std::span<const bool> edge_mask = {});
-
-  // Compute min-cut (edges crossing from reachable set S to unreachable set T)
-  // based on reachability in the current residual graph.
-  // Reachability starts from source s; forward arcs allowed if residual > kMinCap,
-  // reverse arcs allowed if flow > kMinFlow.
-  [[nodiscard]] MinCut compute_min_cut(NodeId src,
-                         std::span<const bool> node_mask = {},
-                         std::span<const bool> edge_mask = {}) const;
-
-  // Apply or revert a set of edge flow allocations directly.
-  // When add==true, treats each (eid, flow) as additional placed flow on the edge.
-  // When add==false, removes placed flow (reverts allocations), clamping to [0, capacity].
-  // NOTE: residual is recomputed as capacity - edge_flow, so for a FlowState built with
-  // a custom residual_init this discards the initial offset. Entries with flow <= 0 and
-  // out-of-range edge ids are ignored.
-  void apply_deltas(std::span<const std::pair<EdgeId, Flow>> deltas, bool add) noexcept;
-
-private:
-  const StrictMultiDiGraph* g_ {nullptr};
-  std::vector<Cap> residual_;
-  std::vector<Flow> edge_flow_;
-};
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/forwarding_program.hpp b/include/netgraph/core/forwarding_program.hpp
new file mode 100644
index 0000000..cecc006
--- /dev/null
+++ b/include/netgraph/core/forwarding_program.hpp
@@ -0,0 +1,144 @@
+/* Forwarding programs: the routes and integer weights a computation produces and forwarding moves
+   an offer over (Tunnel, RouteDefinition, ForwardingProgram). */
+#pragma once
+
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+struct ProgramData;
+struct ProgramAccess;
+struct ProgramBlock;
+} // namespace detail
+
+// A tunnel's state: Up; InsufficientBandwidth and CostCeilingExceeded (T1 setup found no path passing the bandwidth
+// filter, or the cheapest one exceeds the cost ceiling: the tunnel is down, has no path and weight
+// 0, and stays down in every forwarding of its program); and, in one forwarding only (a by_tunnel
+// row), Failed (the path touches a node or an edge the forwarding policy's Eligibility excludes:
+// the tunnel gets nothing and its head splits over its other entries) and Blackholed (up, but its
+// path reaches a black hole of stale forwarding: its traffic is dropped on the first link that is
+// one or enters one).
+enum class TunnelStatus { Up, InsufficientBandwidth, CostCeilingExceeded, Failed, Blackholed };
+
+// One tunnel (a path entry) of a program. entry_id: the entry identifier (T1 and T2: j * H + i for
+// round j and roster position i, T2's dead heads leaving holes; CentralizedTE and ShortestPaths Optimized: the
+// path's position in the decomposition order; supplied routes: the route's position in the list),
+// never a position in tunnels();
+// local_index: its position among its head's entries of both kinds in ascending entry_id;
+// destination: where its path ends; edges in path order; path_cost: the sum of their costs (all
+// three absent for a tunnel that is down); status: Up, InsufficientBandwidth or CostCeilingExceeded;
+// requested_bandwidth and reserved_bandwidth: T1's strict bandwidth (its request, and the request
+// held on every link of its path when it is up, else 0; 0 for the other models);
+// planned_bandwidth: T2's planned bandwidth u (metadata,
+// never held; 0 for the other models); weight: its integer share among the head's entries (T1:
+// 1 up, 0 down; T2: 1; a controller path: its solved amount).
+struct Tunnel {
+  std::int32_t entry_id {0};
+  NodeId head {0};
+  std::int32_t local_index {0};
+  std::optional<NodeId> destination {};
+  std::optional<std::vector<EdgeId>> edges {};
+  std::optional<Cost> path_cost {};
+  TunnelStatus status {TunnelStatus::Up};
+  Amount requested_bandwidth {0};
+  Amount reserved_bandwidth {0};
+  Amount planned_bandwidth {0};
+  Amount weight {0};
+  friend bool operator==(const Tunnel&, const Tunnel&) = default;
+};
+
+// A supplied route of ForwardingProgram::from_routes: a Path with one edge per hop (a tunnel) or
+// a PredecessorDAG (a split route, its own split context) starting at `head`, with its integer weight
+// among the head's routes (0 allowed: it carries nothing).
+struct RouteDefinition {
+  NodeId head {0};
+  std::variant<std::shared_ptr<const Path>, std::shared_ptr<const PredecessorDAG>> route {};
+  Amount weight {1};
+};
+
+// The interior split of the PredecessorDAG routes of from_routes and of from_dag's DAG: allocation
+// Equal (absent) or Weighted, whose weights come from `weight_basis` (absent: Capacity), `edge_weights` (Explicit: one
+// entry per edge) or `residual` (ResidualSnapshot: the free-capacity vector it reads, one entry
+// per edge in [0, capacity]; it has no default).
+struct RouteOptions {
+  std::optional<RouteAllocation> allocation {};
+  std::optional<WeightBasis> weight_basis {};
+  std::optional<std::vector<Amount>> edge_weights {};
+  std::optional<std::vector<Amount>> residual {};
+};
+
+// An immutable value: one demand's sources and destinations (normalized sets), its entries and
+// its injection rule. Entries are tunnels (listed in tunnels(), ascending index) and split routes
+// (a DAG with per-router split tables; not listed). Injection: equal sources (round robin over the
+// roster: the sources with an entry, or for T1 and T2 the policy's roster, heads without an up
+// tunnel included) or captured source weights (source_weights(): highest
+// averages over every roster source's saved supply, zero included); then each head splits its
+// share by highest averages over its entries' weights. Identical routes are never merged.
+// A program also keeps what a replay under a failure rebuilds its roster from (its basis: the
+// topology under the producing policy's exclusions, or each head's original routes). Shared by
+// std::shared_ptr<const ForwardingProgram>; every policy that forwards it keeps that reference.
+class ForwardingProgram {
+public:
+  // Validates and freezes supplied routes, std::invalid_argument for the first failure, in this
+  // order: the endpoint sets (empty, range, lowest overlap); `routes must not be empty`; when no
+  // route is a PredecessorDAG, any option given (`<allocation, weight_basis, edge_weights or residual>
+  // applies only to PredecessorDAG routes`); allocation Optimized; the weights' combination;
+  // edge_weights' length and entries and residual's (the ledger's baseline messages); then each
+  // route in list order: its route's graph, its head a source, a Path's shape (one edge per hop, starting at the head,
+  // ending at a destination and meeting none before), a PredecessorDAG's walk from the head to a
+  // destination, then its weight in [0, 2^62). Order and duplicates are kept; a route of weight 0 is
+  // validated in full. Every split route is its own split context.
+  [[nodiscard]] static std::shared_ptr<const ForwardingProgram> from_routes(const Graph& graph,
+                                                                           std::span<const NodeId> sources,
+                                                                           std::span<const NodeId> destinations,
+                                                                           std::span<const RouteDefinition> routes,
+                                                                           const RouteOptions& options = {});
+
+  // One shared hop-by-hop program on a supplied DAG of `graph`: its sources allocated equally
+  // and pooled at every shared router exactly as ShortestPaths Equal/Weighted (the one pooled
+  // builder), the DAG trimmed to the walks from each source to its first destinations.
+  // std::invalid_argument for the first failure, in this order: the endpoint sets; `dag belongs to
+  // another graph`; options.allocation Optimized (`from_dag allocation must be EQUAL or WEIGHTED`);
+  // the weights' combination; edge_weights' and residual's lengths and entries. The roster is the
+  // sources that reach a destination in the DAG (possibly none): one split route per roster source,
+  // identified by roster position, and no tunnel; a replay rebuilds the roster on the DAG.
+  [[nodiscard]] static std::shared_ptr<const ForwardingProgram> from_dag(const Graph& graph, std::span<const NodeId> sources,
+                                                                        std::span<const NodeId> destinations,
+                                                                        const std::shared_ptr<const PredecessorDAG>& dag,
+                                                                        const RouteOptions& options = {});
+
+  ForwardingProgram(const ForwardingProgram&) = delete;
+  ForwardingProgram& operator=(const ForwardingProgram&) = delete;
+  ~ForwardingProgram();
+
+  [[nodiscard]] std::uint64_t graph_uid() const noexcept;
+  [[nodiscard]] std::span<const NodeId> sources() const noexcept;
+  [[nodiscard]] std::span<const NodeId> destinations() const noexcept;
+  [[nodiscard]] std::span<const Tunnel> tunnels() const noexcept;
+  // The captured source weights (roster source, weight) in ascending NodeId, every roster
+  // source listed, zeros included: solved supplies for Optimized, declared weights for
+  // Weighted CentralizedTE. nullopt for equal sources; an empty captured roster is engaged.
+  [[nodiscard]] const std::optional<std::vector<std::pair<NodeId, Amount>>>& source_weights() const noexcept;
+
+private:
+  friend struct detail::ProgramAccess;
+  friend struct detail::ProgramBlock;
+  explicit ForwardingProgram(const detail::ProgramData* data) noexcept;
+  // The program's data, in the same allocation as the program (detail::ProgramBlock): the
+  // program's owner owns both.
+  const detail::ProgramData* data_;
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/graph.hpp b/include/netgraph/core/graph.hpp
new file mode 100644
index 0000000..5046317
--- /dev/null
+++ b/include/netgraph/core/graph.hpp
@@ -0,0 +1,130 @@
+/* An immutable directed graph that allows several edges between the same ordered node pair.
+   Capacities use integer units. */
+#pragma once
+
+#include <cstdint>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+struct GraphAccess;
+} // namespace detail
+
+// Convert a physical value to units of resolution q (the physical size of one unit).
+// Round to the nearest integer, with exact halves rounded up. This is the only way a physical
+// value enters Core. Throw std::invalid_argument for NaN, infinity, a negative value, a result
+// >= 2^62, or a resolution that is not a power of two in [2^-32, 2^32].
+[[nodiscard]] Amount to_units(double x, double resolution);
+// Units to a physical double (x * q): exact below 2^53 units.
+[[nodiscard]] double as_float(Amount x, double resolution);
+
+// Edges arrive in input order. Their public EdgeIds are their positions after sorting by
+// (source, cost, destination, input). Node u's out-edges are
+// [outgoing_offsets()[u], outgoing_offsets()[u + 1]), ordered by (cost, destination, input);
+// input_positions()[e] gives e's input position. All other per-edge arrays use EdgeId order, except incoming_edges() (reverse-CSR slot order). CSR (compressed
+// sparse row) stores each node's edges in a flat array and uses offsets to mark its range.
+// Reverse CSR lists v's in-edges in (cost, source, input) order.
+//
+// The constructor validates in this order and reports the first defect (std::invalid_argument):
+// the resolution (a power of two in [2^-32, 2^32]); the unit values (every capacity in
+// [0, 2^62)); the array shapes (num_nodes >= 0, equal lengths, at most INT32_MAX edges); zero
+// or negative costs (costs are positive); the remaining bounds (endpoints in
+// [0, num_nodes), then the capacity and cost sums below 2^62, so no path cost overflows int64:
+// both are added up edge by edge in input order, and the first edge at which a running sum
+// reaches 2^62 reports that sum, the capacity sum before the cost sum at the same edge). The
+// order is part of the interface: a language binding validates in the same order before
+// narrowing any value, so the reported defect does not depend on the representation of the
+// input.
+//
+// Construction uses N nodes, E edges and K distinct costs. A cost's rank is its position among
+// the sorted distinct costs. Stable counting passes group by each key without changing ties:
+// destination, cost rank, source give EdgeId order; cost rank, destination give reverse CSR.
+// When N K < E, use destination then (source, rank) forward, and (destination, rank) reverse.
+// With no edges, only validation and two
+// zero-filled offset arrays are needed. Rank costs through a hash table up to 65,536 distinct
+// costs and 8E + 8 x 65,536 examined slots; otherwise sort all costs. Both give the same ranks.
+// Expected O(E + N) for bounded K; O(N + E log(E + 1)) worst case.
+// Retained arrays: 36 bytes per edge plus 8 (N + 1) bytes of offsets.
+//
+// A copy is a new graph: same ids and input map, a new uid. Uids come from one process-wide
+// 64-bit counter and are never reused. A move transfers every array and the uid without
+// allocation. The source retains its resolution, has uid, node count, edge count, maximum cost and
+// cost GCD zero, exposes empty edge arrays, and exposes one zero in each offset view. Its empty
+// offset vectors use an immutable static zero for those views.
+class Graph {
+public:
+  Graph(std::int32_t num_nodes,
+        std::span<const NodeId> edge_sources,
+        std::span<const NodeId> edge_destinations,
+        std::span<const Amount> edge_capacity_units,
+        std::span<const Cost> edge_costs,
+        double resolution);
+  Graph(const Graph& other);
+  Graph(Graph&& other) noexcept;
+  Graph& operator=(const Graph&) = delete;
+  Graph& operator=(Graph&&) = delete;
+  ~Graph() noexcept = default;
+
+  [[nodiscard]] std::uint64_t uid() const noexcept { return uid_; }
+  [[nodiscard]] double resolution() const noexcept { return resolution_; }
+  [[nodiscard]] std::int32_t num_nodes() const noexcept { return num_nodes_; }
+  [[nodiscard]] std::int32_t num_edges() const noexcept {
+    return static_cast<std::int32_t>(edge_capacity_units_.size());
+  }
+  [[nodiscard]] std::span<const Amount> edge_capacity_units() const noexcept { return edge_capacity_units_; }
+  [[nodiscard]] std::span<const Cost> edge_costs() const noexcept { return edge_costs_; }
+  [[nodiscard]] std::span<const NodeId> edge_sources() const noexcept { return edge_sources_; }
+  [[nodiscard]] std::span<const NodeId> edge_destinations() const noexcept { return edge_destinations_; }
+  // Maximum edge cost and greatest common divisor of all edge costs, computed by full scans
+  // at construction; both are 0 on a graph without edges.
+  [[nodiscard]] Cost max_edge_cost() const noexcept { return max_edge_cost_; }
+  [[nodiscard]] Cost edge_cost_gcd() const noexcept { return edge_cost_gcd_; }
+  // id -> input position. The inverse permutation is the caller's (one O(E) scatter).
+  [[nodiscard]] std::span<const std::int32_t> input_positions() const noexcept { return input_positions_; }
+  // Forward CSR offsets (N + 1 entries, [0] = 0, [N] = E): the id ranges of the out-edges.
+  [[nodiscard]] std::span<const std::int32_t> outgoing_offsets() const noexcept { return offsets(outgoing_offsets_); }
+  // Reverse CSR: the in-edges of v are incoming_edges()[incoming_offsets()[v] ..
+  // incoming_offsets()[v + 1]) (public EdgeIds); the reverse column is
+  // edge_sources()[incoming_edges()[slot]].
+  [[nodiscard]] std::span<const std::int32_t> incoming_offsets() const noexcept { return offsets(incoming_offsets_); }
+  [[nodiscard]] std::span<const EdgeId> incoming_edges() const noexcept { return incoming_edges_; }
+
+  // Static eligibility from excluded ids (duplicates and unsorted lists accepted, out-of-range
+  // ids rejected). Empty lists mean all allowed (uid 0). The one public construction of an
+  // Eligibility from excluded ids (Eligibility::intersect combines two values).
+  [[nodiscard]] Eligibility eligibility(std::span<const NodeId> excluded_nodes = {},
+                                        std::span<const EdgeId> excluded_edges = {}) const;
+
+private:
+  friend struct detail::GraphAccess;
+
+  // The offsets of a moved-from graph (its vectors are empty): one zero.
+  static constexpr std::int32_t kNoOffsets[1] {0};
+  [[nodiscard]] static std::span<const std::int32_t> offsets(const std::vector<std::int32_t>& v) noexcept {
+    return v.empty() ? std::span<const std::int32_t>(kNoOffsets) : std::span<const std::int32_t>(v);
+  }
+
+  std::uint64_t uid_ {0};
+  double resolution_ {1.0};
+  std::int32_t num_nodes_ {0};
+  Cost max_edge_cost_ {0};
+  Cost edge_cost_gcd_ {0};
+  std::vector<Amount> edge_capacity_units_ {};
+  std::vector<Cost> edge_costs_ {};
+  std::vector<NodeId> edge_sources_ {};
+  std::vector<NodeId> edge_destinations_ {};
+  std::vector<std::int32_t> input_positions_ {};
+  std::vector<std::int32_t> outgoing_offsets_ {};
+  std::vector<std::int32_t> incoming_offsets_ {};
+  std::vector<EdgeId> incoming_edges_ {};
+  // The source of each reverse slot (edge_sources()[incoming_edges()[slot]]), stored for the
+  // reverse search's locality; internal (detail::GraphAccess).
+  std::vector<NodeId> incoming_edge_sources_ {};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/k_shortest_paths.hpp b/include/netgraph/core/k_shortest_paths.hpp
deleted file mode 100644
index 0af8f20..0000000
--- a/include/netgraph/core/k_shortest_paths.hpp
+++ /dev/null
@@ -1,26 +0,0 @@
-/* Yen-like K-shortest paths with SPF-compatible outputs per-path. */
-#pragma once
-
-#include <optional>
-#include <vector>
-
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// Compute up to k shortest paths from s to t (Yen-like) and return
-// SPF-compatible outputs per path: (distances, predecessor DAG).
-// Distances are Cost[N] (int64); unreachable entries are set to
-// std::numeric_limits<Cost>::max(). PredDAG encodes one concrete path with a
-// single parent per node along the path; other nodes have no parents.
-// Deterministic tie-breaking across equal-cost edges uses compacted edge order.
-[[nodiscard]] std::vector<std::pair<std::vector<Cost>, PredDAG>> k_shortest_paths(
-    const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-    int k, std::optional<double> max_cost_factor,
-    bool unique,
-    std::span<const bool> node_mask = {},
-    std::span<const bool> edge_mask = {});
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/max_flow.hpp b/include/netgraph/core/max_flow.hpp
deleted file mode 100644
index 347b30d..0000000
--- a/include/netgraph/core/max_flow.hpp
+++ /dev/null
@@ -1,89 +0,0 @@
-/* Max-flow utility APIs with summaries and batch evaluation. */
-#pragma once
-
-#include <cstdint>
-#include <utility>
-#include <vector>
-
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-struct MinCut { std::vector<EdgeId> edges; };
-
-struct FlowSummary {
-  Flow total_flow {0.0};
-  MinCut min_cut {};
-  // Parallel arrays: costs[i] carries placed flow flows[i]. Costs are ascending and
-  // unique; flows are raw volumes (not normalized).
-  //
-  // Entries from the SPF tier loop are the total cost of the shortest-path DAG used.
-  // Entries produced by the residual completion phase are MARGINAL costs: the cost of
-  // the augmenting path's forward edges minus the cost of the flow it cancelled. Such
-  // an entry need not correspond to any traversable s-t path, so treat costs[] as a
-  // cost-weighted breakdown of the total flow rather than a list of path costs.
-  std::vector<Cost> costs;
-  std::vector<Flow> flows;
-  std::vector<Flow> edge_flows; // filled if requested
-  // Optional large arrays; populated only when requested via API flags
-  std::vector<Cap> residual_capacity; // length == g.num_edges()
-  std::vector<std::uint8_t> reachable_nodes; // length == g.num_nodes(); 0/1 flags
-};
-
-// Computes maximum flow from src to dst.
-//
-// The SPF tier loop augments along forward shortest-path DAGs only. For
-// FlowPlacement::Proportional with require_capacity=true and shortest_path=false a
-// residual completion phase then augments with reverse arcs, so the result is a true
-// maximum flow and summary.min_cut satisfies max-flow/min-cut duality.
-//
-// The other configurations are placement models rather than max-flow computations and
-// may report less than the maximum: EqualBalanced models single-pass ECMP admission,
-// require_capacity=false models fixed cost-only IP routing, and shortest_path=true
-// restricts flow to the first cost tier.
-[[nodiscard]] std::pair<Flow, FlowSummary>
-calc_max_flow(const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-              FlowPlacement placement, bool shortest_path,
-              bool require_capacity,
-              bool with_edge_flows,
-              bool with_reachable,
-              bool with_residuals,
-              std::span<const bool> node_mask = {},
-              std::span<const bool> edge_mask = {});
-
-[[nodiscard]] std::vector<FlowSummary>
-batch_max_flow(const StrictMultiDiGraph& g,
-               const std::vector<std::pair<NodeId,NodeId>>& pairs,
-               FlowPlacement placement, bool shortest_path,
-               bool require_capacity,
-               bool with_edge_flows,
-               bool with_reachable,
-               bool with_residuals,
-               const std::vector<std::span<const bool>>& node_masks = {},
-               const std::vector<std::span<const bool>>& edge_masks = {});
-
-// Performs sensitivity analysis to identify edges that constrain flow.
-//
-// Computes baseline flow (using full max-flow or shortest-path-only mode),
-// then tests removing each saturated edge to measure its criticality.
-//
-// Arguments:
-//   g: The input graph.
-//   src, dst: Source and destination nodes.
-//   placement: Flow placement strategy.
-//   shortest_path: If true, uses single-pass shortest-path flow (IP/IGP mode).
-//                  If false, uses full iterative max-flow (SDN/TE mode).
-//   require_capacity: If true, excludes saturated edges from routing.
-//   node_mask, edge_mask: Optional masks to exclude nodes/edges.
-//
-// Returns:
-//   Pairs of (EdgeId, FlowDelta) for edges whose removal reduces flow.
-[[nodiscard]] std::vector<std::pair<EdgeId, Flow>>
-sensitivity_analysis(const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-                     FlowPlacement placement, bool shortest_path,
-                     bool require_capacity,
-                     std::span<const bool> node_mask = {},
-                     std::span<const bool> edge_mask = {});
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/options.hpp b/include/netgraph/core/options.hpp
index c084e4b..93cc091 100644
--- a/include/netgraph/core/options.hpp
+++ b/include/netgraph/core/options.hpp
@@ -1,50 +1,96 @@
-/* Option structs for algorithm invocations to keep interfaces concise. */
+/* The shared small option types: the tie rule of the searches and the policies, the route
+   allocations of the kernels, their weight bases and the admissions. Component configurations and result statuses stay with their
+   component. */
 #pragma once
 
-#include <optional>
-#include <span>
+#include <cstdint>
+#include <numeric>
+#include <stdexcept>
+#include <variant>
 
 #include "netgraph/core/types.hpp"
 
 namespace netgraph::core {
 
-struct SpfOptions {
-  bool multipath { true };
-  EdgeSelection selection {};
-  std::optional<NodeId> dst {};
-  std::span<const Cap> residual {};
-  std::span<const bool> node_mask {};
-  std::span<const bool> edge_mask {};
-};
+// Forward follows edges from the roots; Reverse follows them backwards toward the roots.
+// The returned DAG (a directed graph with no cycles) keeps the edges' original orientation.
+enum class Direction { Forward, Reverse };
 
-// Options for shortest_paths_to (reverse SPF toward one destination). See
-// shortest_paths.hpp for the semantics of fanout_edges.
-struct SpfToOptions {
-  bool multipath { true };
-  EdgeSelection selection {};
-  std::span<const Cap> residual {};
-  std::span<const bool> node_mask {};
-  std::span<const bool> edge_mask {};
-  std::span<const EdgeId> fanout_edges {};
+// Inclusive cost ceiling: AbsoluteCost gives a budget >= 0; CostStretch multiplies the static
+// shortest cost under the given Eligibility by an exact factor n/d >= 1: a path of cost c
+// qualifies when c * d <= n * base, compared exactly. Both are checked where they are used.
+struct AbsoluteCost {
+  Cost cost {0};
+  friend bool operator==(const AbsoluteCost&, const AbsoluteCost&) = default;
 };
 
-struct KspOptions {
-  int k { 1 };
-  std::optional<double> max_cost_factor {};
-  bool unique { true };
-  std::span<const bool> node_mask {};
-  std::span<const bool> edge_mask {};
-};
+// The factor as one reduced fraction numerator / denominator with a denominator in [1, 2^63);
+// any numerator is a valid value (below 1 is refused where the ceiling is used).
+class CostStretch {
+ public:
+  // Reduces numerator / denominator; a denominator <= 0 throws std::invalid_argument.
+  explicit CostStretch(std::int64_t numerator, std::int64_t denominator = 1) : numerator_(numerator), denominator_(denominator) {
+    if (denominator < 1) throw std::invalid_argument("CostStretch fraction denominator must be in [1, 2^63)");
+    // The magnitude as unsigned: -2^63 has no int64 negation.
+    const std::uint64_t magnitude =
+        numerator < 0 ? std::uint64_t {0} - static_cast<std::uint64_t>(numerator) : static_cast<std::uint64_t>(numerator);
+    const std::uint64_t g = std::gcd(magnitude, static_cast<std::uint64_t>(denominator));
+    if (g > 1) {
+      // g divides the denominator (< 2^63), so g < 2^63 and the quotients fit int64.
+      numerator_ = numerator < 0 ? -static_cast<std::int64_t>(magnitude / g) : static_cast<std::int64_t>(magnitude / g);
+      denominator_ = static_cast<std::int64_t>(static_cast<std::uint64_t>(denominator) / g);
+    }
+  }
+  [[nodiscard]] std::int64_t numerator() const noexcept { return numerator_; }
+  [[nodiscard]] std::int64_t denominator() const noexcept { return denominator_; }
+  friend bool operator==(const CostStretch&, const CostStretch&) = default;
 
-struct MaxFlowOptions {
-  FlowPlacement placement { FlowPlacement::Proportional };
-  bool shortest_path { false };
-  bool require_capacity { true };  // Require edges to have capacity (SDN/TE). Set false for cost-only routing (IP/IGP)
-  bool with_edge_flows { false };
-  bool with_reachable { false };
-  bool with_residuals { false };
-  std::span<const bool> node_mask {};
-  std::span<const bool> edge_mask {};
+ private:
+  std::int64_t numerator_;
+  std::int64_t denominator_;
 };
+using CostCeiling = std::variant<AbsoluteCost, CostStretch>;
+
+// How a route choice breaks a cost tie; cost always comes first. FewerHops: then fewer hops, then the
+// lexicographically smallest EdgeId sequence (compared at the first differing edge). The other three
+// first prefer the larger bottleneck (the smallest value along the path) of an edge score, then
+// fewer hops, then the EdgeId sequence: HigherCapacity scores static capacity, HigherAvailableCapacity
+// the availability of the search's view, HigherHeadroom availability / static capacity as an exact
+// ratio (0 on an edge of static capacity 0). Availability is the unreserved capacity for
+// DistributedTE's CSPF, the service view for ShortestPaths, the supplied residual for spf and ksp,
+// and the static capacity where no view is supplied (HigherHeadroom then reads 1 on a positive edge).
+// The same order chooses among parallel edges of one (u, v) pair when parallel_edges is false (the
+// cheapest member, then the higher score, then the lowest EdgeId). The tie rule never supplies
+// weights and never enables a controller objective (CentralizedTE::prefer_headroom is T2's).
+enum class RouteTieBreak { FewerHops, HigherCapacity, HigherAvailableCapacity, HigherHeadroom };
+
+// A route allocation (a kernel) assigns one flow's amounts to its usable route edges (its split graph).
+// Equal splits equally at each node, giving leftover units to edges in ascending EdgeId order.
+// Weighted splits at each node using weights fixed at creation: give each next unit to the edge
+// with largest w / (a + 1), where w is its weight and a its share so far; ties use lower EdgeId.
+// Optimized replaces its allocation with a minimum-cost flow on the split graph over
+// V = W + own, where W is unused capacity and own is this flow's current allocation.
+enum class RouteAllocation { Equal, Weighted, Optimized };
+
+// Where the Weighted kernel's member weights come from (ShortestPaths Weighted and supplied split
+// routes): Capacity, each member's static capacity; Explicit, one integer per edge given with the
+// configuration (edge_weights; a positive weight on an edge of capacity 0 becomes 0);
+// ResidualSnapshot, each member's free capacity read once when the routes are prepared, against
+// one common view, and frozen for the epoch. A member of weight 0 is pruned, together with the
+// branches it leaves without a destination, inside the route only (no longer bypass is created).
+// The tie rule's edge score never chooses weights.
+enum class WeightBasis { Capacity, Explicit, ResidualSnapshot };
+
+// Lossless admits only the largest total that the routes carry with no loss at all; Lossy
+// forwards the whole finite offer hop by hop and records where it is lost (every model except the
+// optimizing ones: ShortestPaths Optimized and CentralizedTE without a tunnel count).
+enum class Admission { Lossless, Lossy };
+
+// How a demand's traffic enters at its sources, separately from how it is routed. Equal: a total
+// x enters as round robin over the roster (ascending NodeId, the first x mod H sources one unit
+// more); a source whose share cannot go anywhere keeps it and loses it, it never moves to another
+// source. Optimized: the controller chooses the integer injections (one virtual source).
+// Weighted: CentralizedTE without tunnels prescribes H(total, source_weights) instead of RR.
+enum class SourceAllocation { Equal, Optimized, Weighted };
 
 } // namespace netgraph::core
diff --git a/include/netgraph/core/profiling.hpp b/include/netgraph/core/profiling.hpp
deleted file mode 100644
index 40eb9ea..0000000
--- a/include/netgraph/core/profiling.hpp
+++ /dev/null
@@ -1,120 +0,0 @@
-/* Simple profiling utilities for performance analysis.
-
-Enable via environment variable: NGRAPH_CORE_PROFILE=1
-
-When disabled (default), each instrumented scope costs one cached-bool check.
-
-Usage:
-    #include "netgraph/core/profiling.hpp"
-
-    void my_function() {
-        NGRAPH_PROFILE_SCOPE("my_function");
-        // ... function body ...
-    }
-
-From Python:
-    import netgraph_core as ngc
-    # Run with NGRAPH_CORE_PROFILE=1 python script.py
-    if ngc.profiling_enabled():
-        ngc.profiling_dump()   # Print stats to stderr
-        ngc.profiling_reset()  # Clear stats
-*/
-#pragma once
-
-#include <chrono>
-#include <cstdint>
-#include <iostream>
-#include <mutex>
-#include <ostream>
-#include <string>
-#include <unordered_map>
-#include <vector>
-
-namespace netgraph::core {
-
-// Check once at startup, cache result. Returns true if NGRAPH_CORE_PROFILE=1.
-// Defined in profiling.cpp to avoid ODR violations with static library linking.
-bool profiling_enabled() noexcept;
-
-// Singleton collecting profiling statistics.
-class ProfilingStats {
-public:
-    // Defined in profiling.cpp to avoid ODR violations with static library linking.
-    static ProfilingStats& instance();
-
-    void record(const char* name, double micros);
-    void dump() const { dump(std::cerr); }
-    void dump(std::ostream& out) const;
-    void reset();
-
-private:
-    ProfilingStats() = default;
-    struct Entry {
-        double total_us = 0;
-        int64_t count = 0;
-        double min_us = 1e18;
-        double max_us = 0;
-    };
-
-    class LocalStats {
-    public:
-        explicit LocalStats(ProfilingStats& owner);
-        ~LocalStats();
-
-        void record(const char* name, double micros);
-        void append_to(std::unordered_map<std::string, Entry>& out) const;
-        void clear();
-
-    private:
-        ProfilingStats& owner_;
-        mutable std::mutex mutex_;
-        std::unordered_map<std::string, Entry> stats_;
-    };
-
-    LocalStats& local_stats();
-    void register_local(LocalStats* local);
-    void finalize_local(LocalStats* local);
-    static void merge_entry(Entry& dst, const Entry& src);
-    std::unordered_map<std::string, Entry> snapshot_unlocked() const;
-
-    mutable std::mutex mutex_;
-    std::vector<LocalStats*> active_locals_;
-    std::unordered_map<std::string, Entry> finished_stats_;
-};
-
-// RAII timer. Does nothing if name is nullptr.
-class ScopedTimer {
-public:
-    explicit ScopedTimer(const char* name) noexcept : name_(name) {
-        if (name_) {
-            start_ = std::chrono::high_resolution_clock::now();
-        }
-    }
-
-    ~ScopedTimer() {
-        if (name_) {
-            auto end = std::chrono::high_resolution_clock::now();
-            double us = std::chrono::duration<double, std::micro>(end - start_).count();
-            ProfilingStats::instance().record(name_, us);
-        }
-    }
-
-    ScopedTimer(const ScopedTimer&) = delete;
-    ScopedTimer& operator=(const ScopedTimer&) = delete;
-
-private:
-    const char* name_;
-    std::chrono::high_resolution_clock::time_point start_;
-};
-
-// Concatenate tokens for unique variable names
-#define NGRAPH_CONCAT_IMPL(a, b) a##b
-#define NGRAPH_CONCAT(a, b) NGRAPH_CONCAT_IMPL(a, b)
-
-// Main profiling macro. Expands to a ScopedTimer only if profiling is enabled;
-// when disabled the timer is constructed with a null name and does no work.
-#define NGRAPH_PROFILE_SCOPE(name) \
-    ::netgraph::core::ScopedTimer NGRAPH_CONCAT(_ngraph_timer_, __LINE__)( \
-        ::netgraph::core::profiling_enabled() ? (name) : nullptr)
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/route_structures.hpp b/include/netgraph/core/route_structures.hpp
new file mode 100644
index 0000000..57f2c6f
--- /dev/null
+++ b/include/netgraph/core/route_structures.hpp
@@ -0,0 +1,95 @@
+/* Route structures: the immutable predecessor DAG and the explicit Path. */
+#pragma once
+
+#include <cstdint>
+#include <span>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+struct PredecessorDAGBuilder;
+struct PathBuilder;
+} // namespace detail
+
+// An immutable predecessor DAG: a directed graph with no cycles, recording each node's
+// incoming edges. It belongs to one graph. CSR (compressed sparse row) groups entries in flat
+// arrays: node v uses parents()[k] and via_edges()[k] for
+// k in [parent_offsets()[v], parent_offsets()[v + 1]); (u, e) means edge e = u -> v is included.
+// Entries per node have strictly ascending via EdgeId, giving one canonical form. Equality
+// means the same graph and CSR. Route APIs take PredecessorDAG and reject one from another graph.
+//
+// Storage is sparse: the entries are kept per member node (the nodes
+// with at least one entry, ascending, and their offsets), never as an N + 1 offsets array, so a
+// flow's route costs O(its entries) whatever the graph's size. parent_offsets() presents the
+// from_csr shape on demand (a fresh N + 1 array); parents() and via_edges() are the stored
+// entries (grouped by node in ascending NodeId), which are the same arrays in both forms.
+class PredecessorDAG {
+public:
+  // Validates, in this order, before any traversal (std::invalid_argument on the first defect):
+  // parent_offsets of length N + 1, parent_offsets[0] == 0, monotone, parent_offsets[N] ==
+  // len(parents) == len(via_edges); then every parent and via edge in range, every via edge joining
+  // (parent, child), no duplicate (child, via edge), acyclic; within a node the entries in
+  // ascending via EdgeId.
+  [[nodiscard]] static PredecessorDAG from_csr(const Graph& graph, std::span<const std::int32_t> parent_offsets,
+                                        std::span<const NodeId> parents, std::span<const EdgeId> via);
+
+  [[nodiscard]] std::uint64_t graph_uid() const noexcept { return graph_uid_; }
+  // The from_csr parent_offsets (N + 1 entries), built on demand from the sparse storage.
+  [[nodiscard]] std::vector<std::int32_t> parent_offsets() const;
+  [[nodiscard]] std::span<const NodeId> parents() const noexcept { return parents_; }
+  [[nodiscard]] std::span<const EdgeId> via_edges() const noexcept { return via_edges_; }
+
+  friend bool operator==(const PredecessorDAG& a, const PredecessorDAG& b) noexcept {
+    return a.graph_uid_ == b.graph_uid_ && a.num_nodes_ == b.num_nodes_ && a.nodes_ == b.nodes_ &&
+           a.node_offsets_ == b.node_offsets_ && a.parents_ == b.parents_ && a.via_edges_ == b.via_edges_;
+  }
+
+private:
+  friend struct detail::PredecessorDAGBuilder;
+  PredecessorDAG() = default;
+  std::uint64_t graph_uid_ {0};
+  std::int32_t num_nodes_ {0};
+  std::vector<NodeId> nodes_ {};                // nodes with entries, ascending
+  std::vector<std::int32_t> node_offsets_ {0};  // nodes_.size() + 1: the entries of nodes_[i]
+  std::vector<NodeId> parents_ {};
+  std::vector<EdgeId> via_edges_ {};
+  std::vector<EdgeId> edges_ {};  // via_edges_ in ascending EdgeId (derived once, at construction)
+};
+
+// An explicit walk of hops; a hop holds one or more parallel members of one (u, v) pair, in
+// the caller's order. source(), destination() and cost() (the sum over hops of the minimum member
+// cost) are derived at construction. A single-member walk is [[e1], [e2], ...].
+class Path {
+public:
+  // Validates, in this order (std::invalid_argument on the first defect): every member id in
+  // range (before any endpoint is read), no duplicate member, a non-empty hop list, every hop
+  // non-empty, the members of a hop sharing (u, v), contiguous hops, no repeated node.
+  Path(const Graph& graph, std::vector<std::vector<EdgeId>> hops);
+
+  [[nodiscard]] std::uint64_t graph_uid() const noexcept { return graph_uid_; }
+  [[nodiscard]] const std::vector<std::vector<EdgeId>>& hops() const noexcept { return hops_; }
+  [[nodiscard]] NodeId source() const noexcept { return nodes_.front(); }
+  [[nodiscard]] NodeId destination() const noexcept { return nodes_.back(); }
+  [[nodiscard]] Cost cost() const noexcept { return cost_; }
+  // The equivalent PredecessorDAG (every member of every hop; entries in ascending via EdgeId).
+  [[nodiscard]] PredecessorDAG to_dag() const;
+
+  friend bool operator==(const Path& a, const Path& b) noexcept {
+    return a.graph_uid_ == b.graph_uid_ && a.hops_ == b.hops_;
+  }
+
+private:
+  friend struct detail::PathBuilder;
+  Path() = default;
+  std::uint64_t graph_uid_ {0};
+  std::int32_t num_nodes_ {0};
+  std::vector<std::vector<EdgeId>> hops_ {};
+  std::vector<NodeId> nodes_ {};
+  Cost cost_ {0};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/search.hpp b/include/netgraph/core/search.hpp
new file mode 100644
index 0000000..a6ad3f8
--- /dev/null
+++ b/include/netgraph/core/search.hpp
@@ -0,0 +1,116 @@
+/* The public search: spf from a set of roots, forward or reverse,
+   with an optional set of targets (anycast); ksp, the K shortest paths in the canonical order;
+   and resolve_to_paths, a DAG unfolded into explicit paths. */
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+// The queue holds nodes waiting for their shortest distance to be finalised (C++ only).
+// Auto groups them into cyclic distance buckets if max_edge_cost / max(1, edge_cost_gcd) + 1 <= 65,536;
+// edge_cost_gcd is the greatest common divisor of edge costs. Otherwise use a binary heap, which
+// keeps the smallest key first; Heap always uses it. Both pop in (distance, node) order and
+// give identical results. The bucket limit bounds bucket storage.
+enum class SpfQueue { Auto, Heap };
+
+// spf requires a direction. Without targets, finalise every reachable node's shortest distance;
+// with targets, stop at the nearest targets (anycast). multipath = true returns every equal-cost
+// walk as a DAG, false the one canonical path (targets required); parallel_edges = false keeps one
+// member of each (u, v) pair by the tie rule; tie_break orders equal-cost choices (RouteTieBreak).
+// A Higher* tie rule with multipath and parallel_edges both true has nothing to choose and is
+// rejected. A supplied residual gives unused capacity: int64[E] in EdgeId order, each in
+// [0, edge_capacity_units], borrowed for this call. Only edges with residual >= min_residual are
+// usable, and these values also supply the availability scores. min_residual must be >= 1 and
+// applies only when residual is supplied. The Eligibility always applies. Without a residual no
+// edge is skipped for its capacity: an edge of capacity 0 is searched like any other. Invalid
+// enum values throw std::invalid_argument naming the field. Fields remain assignable, so spf
+// validates them again.
+struct SpfOptions {
+  explicit SpfOptions(Direction direction_);
+  Direction direction;
+  std::optional<std::vector<NodeId>> targets {};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool multipath {true};
+  bool parallel_edges {true};
+  std::optional<std::span<const Amount>> residual {};
+  Amount min_residual {1};
+  const Eligibility* eligibility {nullptr};
+};
+
+// The result of spf. costs: full searches only (no targets), one entry per node, kUnreachable
+// for the nodes the search did not reach. dag: the unique DAG of the member graph's edges that
+// are tight in the traversal direction, returned in their original orientation u -> v (d the
+// search's distance: d(u) + cost = d(v) for a forward search, d(v) + cost = d(u) for a reverse
+// one); with targets, pruned to the walks between the roots and a nearest target (forward: from a
+// root to the target; reverse: from the target to a root), or the canonical single path for
+// multipath = false. target_cost: searches with targets only, the nearest targets' cost, or
+// kUnreachable when no target is reached.
+struct SpfResult {
+  std::optional<std::vector<Cost>> costs;
+  PredecessorDAG dag;
+  std::optional<Cost> target_cost;
+};
+
+// Validates in this order before any work (std::invalid_argument): the enumerations (direction,
+// tie_break, the queue), the root set (non-empty, ids in range; duplicates removed), the target
+// set when given (the same), a vertex in both sets, multipath = false without targets, a Higher*
+// tie_break with multipath and parallel_edges both true ("spf tie_break requires multipath=False or
+// parallel_edges=False"), the residual (length E, then every entry in [0, edge_capacity_units]),
+// min_residual >= 1, a foreign Eligibility. A root or target excluded by the Eligibility is skipped; all roots excluded gives
+// an empty result (no error).
+[[nodiscard]] SpfResult spf(const Graph& graph, std::span<const NodeId> roots, const SpfOptions& options,
+                            SpfQueue queue = SpfQueue::Auto);
+
+// ksp requires k >= 1. parallel_edges = true keeps all eligible parallel edges; false keeps one
+// per (u, v) pair by the tie rule. tie_break orders paths of equal cost; the paths are always
+// single (k sets their number).
+// cost_ceiling is inclusive: AbsoluteCost(c), c >= 0, or CostStretch(f), finite f in [1, inf), times
+// the static shortest cost under the Eligibility (edges of capacity 0 included, residual
+// ignored). f is compared exactly, as for CostCeiling.
+// A residual is validated as for spf and borrowed for the call; edges need at least 1 unused
+// unit, and it supplies the availability scores. Without a residual no edge is skipped for its capacity.
+// Fields remain assignable, so ksp validates them.
+struct KspOptions {
+  explicit KspOptions(std::int64_t k_);
+  std::int64_t k;
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool parallel_edges {true};
+  std::optional<CostCeiling> cost_ceiling {};
+  std::optional<std::span<const Amount>> residual {};
+  const Eligibility* eligibility {nullptr};
+};
+
+// The K shortest source -> destination paths with no repeated node, ordered by (cost, -bottleneck
+// under a Higher* tie rule, hops, edge-id sequence), the bottleneck being the minimum edge score
+// along a path: the minimal prefix of that order, truncated at k and at the ceiling. Each
+// path is a Path of single-member hops with its cost. Validates in this order before any work
+// (std::invalid_argument): tie_break, source and destination in range, source == destination, k >= 1,
+// the ceiling, the residual, a foreign Eligibility. An excluded endpoint, no static route under a
+// CostStretch ceiling, or no path gives an empty list.
+// Each alternative remembers the spur index that produced it (Lawler's partition) and is
+// expanded from there; the index is not part of the path key, and those searches still count
+// the whole prefix's cost and bottleneck and exclude its vertices.
+[[nodiscard]] std::vector<std::pair<Cost, Path>> ksp(const Graph& graph, NodeId source, NodeId destination, const KspOptions& options);
+
+// The source -> destination walks of a DAG in increasing (cost, hops, edge-id sequence): a hop's
+// cost is its cheapest member's, and a grouped hop is represented in the key by its lowest member
+// id. split_parallel_edges = false keeps every parallel member of the DAG's (u, v) pair in one hop
+// (members ascending); true gives one path per member combination, sorted by that path's own
+// (cost, hops, edge-id sequence). max_paths (>= 1) truncates the sorted list; absent, every walk.
+// Validates (std::invalid_argument): the DAG's graph, source and destination in range, source !=
+// destination, max_paths >= 1. An endpoint outside the DAG, or no walk, gives an empty list.
+[[nodiscard]] std::vector<Path> resolve_to_paths(const Graph& graph, const PredecessorDAG& dag, NodeId source, NodeId destination,
+                                                 bool split_parallel_edges = false,
+                                                 std::optional<std::int64_t> max_paths = std::nullopt);
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/shortest_path_cache.hpp b/include/netgraph/core/shortest_path_cache.hpp
new file mode 100644
index 0000000..be5f08b
--- /dev/null
+++ b/include/netgraph/core/shortest_path_cache.hpp
@@ -0,0 +1,133 @@
+/* The ShortestPathCache: building and frozen modes, the dedicated frozen-miss exception. */
+#pragma once
+
+#include <algorithm>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <exception>
+#include <map>
+#include <memory>
+#include <span>
+#include <string>
+#include <tuple>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+struct DagCacheAccess;
+class FrozenCacheHitTally;
+class CacheGate;
+} // namespace detail
+
+// A frozen-cache lookup with no matching key throws ShortestPathCacheMiss. The shared message can be
+// copied without allocation. Keep what() out of line: this gives the exception one vtable and
+// type_info, so the binding can reliably catch it.
+class ShortestPathCacheMiss : public std::exception {
+public:
+  explicit ShortestPathCacheMiss(const std::string& what) : what_(std::make_shared<const std::string>(what)) {}
+  [[nodiscard]] const char* what() const noexcept override;
+
+private:
+  std::shared_ptr<const std::string> what_;
+};
+
+// A cache of static shortest-path supports bound to one graph uid. A support contains every
+// statically eligible edge, whatever its capacity, on a shortest path from the roots (Forward)
+// or to them (Reverse), ignoring residual capacity. It keeps every equal-cost path and every
+// parallel edge. The key is (sorted root set, direction, Eligibility uid; 0 for no Eligibility).
+// Values are immutable shared PredecessorDAGs; reverse searches keep the original edge orientation.
+// Values remain valid after clear() or cache destruction. The route choice is applied when a policy
+// creates a flow and is never cached.
+//
+// Building mode (a new cache): one exclusive lease per call. A hit returns the value; a miss
+// runs the search, inserts and returns (a failed search counts one miss and inserts nothing); an
+// invalid query (a graph or Eligibility of another graph, an empty root set, a root out of range,
+// a direction outside its enumeration) throws std::invalid_argument and counts nothing. clear()
+// empties the cache; the hit and miss counters persist.
+//
+// Frozen mode (after freeze()): read-only and shareable; lookups from several threads at once are
+// safe. A hit returns the value; a miss counts one miss and throws ShortestPathCacheMiss (nothing is
+// inserted); clear() throws std::invalid_argument; freeze() again has no effect; thaw() returns to
+// building mode after outstanding calls release their leases. Lifecycle calls take exclusive
+// admission, in FIFO order with lookups, so later building calls and frozen readers cannot
+// starve them. Callers keep the cache alive throughout every call; returned values own their data.
+//
+// Each statistic is atomic, but reading several fields need not give one consistent snapshot.
+// `bytes` counts the entries' stored DAG arrays; `live_values` counts values alive anywhere,
+// including in the cache. A building cache keeps completed entries and lookup statistics even
+// if the enclosing public call fails. Entries are always complete; keeping them changes no
+// later result. This is the exception to public calls' all-or-nothing state guarantee.
+// For a frozen cache, hits count only after the whole public call succeeds, including its
+// Python result. A failed call counts nothing, except one miss if it raises ShortestPathCacheMiss.
+// Direct lookup() follows the same rule: one hit on success, one miss on ShortestPathCacheMiss.
+class ShortestPathCache {
+public:
+  struct Stats {
+    std::int64_t hits {0};
+    std::int64_t misses {0};
+    std::int64_t entries {0};
+    std::int64_t bytes {0};
+    std::int64_t live_values {0};
+  };
+
+  explicit ShortestPathCache(const Graph& graph);
+  ShortestPathCache(const ShortestPathCache&) = delete;
+  ShortestPathCache& operator=(const ShortestPathCache&) = delete;
+  ~ShortestPathCache();
+
+  [[nodiscard]] std::uint64_t graph_uid() const noexcept { return graph_uid_; }
+  [[nodiscard]] std::shared_ptr<const PredecessorDAG> lookup(const Graph& graph, std::span<const NodeId> roots,
+                                                      Direction direction, const Eligibility* eligibility);
+  void freeze();
+  void thaw();
+  void clear();
+  [[nodiscard]] Stats stats() const noexcept;
+
+private:
+  friend struct detail::DagCacheAccess;
+  // Caller owns the lifecycle lease, or this cache is exclusive to one worker.
+  void clear_contents() noexcept;
+  // lookup() inside a public call: with a tally of this cache, a frozen hit is recorded in it and a
+  // frozen miss counts nothing here (the call's boundary counts it).
+  std::shared_ptr<const PredecessorDAG> lookup_in_call(const Graph& graph, std::span<const NodeId> roots, Direction direction,
+                                                const Eligibility* eligibility, detail::FrozenCacheHitTally* tally);
+  std::unique_ptr<detail::CacheGate> gate_;
+  using Key = std::tuple<std::vector<NodeId>, Direction, std::uint64_t>;
+  // A lookup's key over borrowed roots (a validated sorted, duplicate-free span): a hit needs no copy.
+  using KeyView = std::tuple<std::span<const NodeId>, Direction, std::uint64_t>;
+  // The order of Key (lexicographic roots, then direction, then Eligibility uid), also between a Key
+  // and a KeyView.
+  struct KeyLess {
+    using is_transparent = void;
+    static bool less(std::span<const NodeId> ra, Direction da, std::uint64_t ua, std::span<const NodeId> rb,
+                     Direction db, std::uint64_t ub) noexcept {
+      const std::size_t n = std::min(ra.size(), rb.size());
+      for (std::size_t i = 0; i < n; ++i) {
+        if (ra[i] != rb[i]) return ra[i] < rb[i];
+      }
+      if (ra.size() != rb.size()) return ra.size() < rb.size();
+      return da != db ? da < db : ua < ub;
+    }
+    template <class A, class B>
+    bool operator()(const A& a, const B& b) const noexcept {
+      return less(std::get<0>(a), std::get<1>(a), std::get<2>(a), std::get<0>(b), std::get<1>(b), std::get<2>(b));
+    }
+  };
+  std::uint64_t graph_uid_ {0};
+  std::map<Key, std::shared_ptr<const PredecessorDAG>, KeyLess> entries_ {};
+  std::atomic<std::int64_t> hits_ {0};
+  std::atomic<std::int64_t> misses_ {0};
+  std::atomic<std::int64_t> num_entries_ {0};
+  std::atomic<std::int64_t> bytes_ {0};
+  // Shared with every value's deleter, so it outlives the cache while values live.
+  std::shared_ptr<std::atomic<std::int64_t>> live_ {std::make_shared<std::atomic<std::int64_t>>(0)};
+};
+
+} // namespace netgraph::core
diff --git a/include/netgraph/core/shortest_paths.hpp b/include/netgraph/core/shortest_paths.hpp
deleted file mode 100644
index 30bcd9d..0000000
--- a/include/netgraph/core/shortest_paths.hpp
+++ /dev/null
@@ -1,144 +0,0 @@
-/* Shortest paths (Dijkstra) with multipath predecessor DAG support. */
-#pragma once
-
-#include <optional>
-#include <span>
-#include <utility>
-#include <vector>
-
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// PredDAG (Predecessor Directed Acyclic Graph): compact representation of the equal-cost
-// shortest paths from a source node. Stored in CSR format for efficiency.
-//
-// The DAG is always acyclic. With strictly positive edge costs it captures *every*
-// equal-cost shortest path. Zero-cost edges are the one exception: a predecessor is
-// recorded only while the child is still unsettled, so among nodes that are mutually
-// reachable at equal distance the settle order decides which alternatives are kept.
-// Without that rule a zero-cost pair u<->v would record each node as the other's
-// parent, making the structure cyclic and path enumeration non-terminating.
-//
-// For each node v, predecessors are stored in parents[parent_offsets[v]:parent_offsets[v+1]]
-// with corresponding EdgeIds in via_edges[parent_offsets[v]:parent_offsets[v+1]].
-// Multiple parallel edges are represented by multiple entries with the same parent.
-// parent_offsets has length N+1 (like CSR row pointers).
-struct PredDAG {
-  std::vector<std::int32_t> parent_offsets;  // Length N+1 (CSR row pointers)
-  std::vector<NodeId> parents;                // Predecessor node IDs
-  std::vector<EdgeId> via_edges;              // EdgeId used to reach node from predecessor
-};
-
-// Frontier queue used by shortest_paths / shortest_paths_to. Both queues pop in
-// the same (cost, -bottleneck, node) order and produce bit-identical results;
-// the bucket queue is faster when the graph's costs fit a bounded number of
-// buckets (max_cost / gcd(costs) + 1 <= 65536), and the heap is used otherwise.
-// Auto (the default) applies that rule, or the process-wide override
-// NGRAPH_CORE_SPF_QUEUE=heap|bucket read once from the environment. Heap forces
-// the reference binary heap; Bucket prefers the bucket queue when the graph is
-// eligible. This parameter exists for tests and benchmarks; the Python bindings
-// do not expose it.
-enum class SpfQueue { Auto, Heap, Bucket };
-
-// Compute shortest paths from src using Dijkstra's algorithm.
-// Returns (distances, predecessor_dag) where distances[v] is the shortest cost to reach v
-// (or inf if unreachable), and predecessor_dag encodes the shortest path structure.
-//
-// Parameters:
-// - dst: if provided, algorithm may exit early once destination is reached
-// - multipath: if true, keep all equal-cost predecessors; if false, keep one per node
-//   (in single-path mode, ties are broken by preferring higher bottleneck capacity)
-// - selection: edge selection policy (multi-edge, capacity filtering, tie-breaking)
-// - residual: if provided, use these capacities instead of graph's original capacities.
-//   Passing a non-empty 'residual' span forces capacity gating:
-//   edges with residual < kMinCap are excluded from exploration.
-//   For EB semantics this means re-running SPF on updated residuals
-//   will remove saturated next-hops and therefore *change* the fixed
-//   equal-split set (progressive behavior).
-// - node_mask: if provided, node_mask[v]==true means node v is allowed (false excludes it).
-//   If the source node is masked (node_mask[src]==false), returns an empty predecessor DAG
-//   with all distances at infinity, as no traversal can begin from an excluded source.
-// - edge_mask: if provided, edge_mask[e]==true means edge e is allowed (false excludes it)
-[[nodiscard]] std::pair<std::vector<Cost>, PredDAG>
-shortest_paths(const StrictMultiDiGraph& g, NodeId src,
-               std::optional<NodeId> dst,
-               bool multipath,
-               const EdgeSelection& selection,
-               std::span<const Cap> residual = {},
-               std::span<const bool> node_mask = {},
-               std::span<const bool> edge_mask = {},
-               SpfQueue queue = SpfQueue::Auto);
-
-// Build the SPF-compatible (distances, PredDAG) pair for one concrete path given
-// as node/edge sequences (nodes[i] -> nodes[i+1] via edges[i]; so nodes.size() ==
-// edges.size() + 1, or a single node with no edges). Distances are cumulative edge
-// costs along the path, INT64_MAX elsewhere; the DAG stores one parent per visited
-// node. Inputs are trusted (no validation) -- used by KSP's result conversion.
-[[nodiscard]] std::pair<std::vector<Cost>, PredDAG>
-path_to_pred_dag(const StrictMultiDiGraph& g,
-                 std::span<const NodeId> nodes,
-                 std::span<const EdgeId> edges);
-
-// Build a single-path PredDAG from a contiguous edge sequence (the missing
-// constructor for operator-defined explicit paths; PredDAGs from SPF/KSP work
-// directly wherever a PredDAG is accepted).
-//
-// Throws std::invalid_argument if edges is empty, any id is out of range, the
-// sequence is not contiguous (dst(e_i) != src(e_{i+1})), or the walk repeats a
-// node (a repeated node cannot be represented as one-parent-per-node, and a
-// pinned path is a simple path by definition).
-[[nodiscard]] PredDAG make_path_dag(const StrictMultiDiGraph& g,
-                                    std::span<const EdgeId> edges);
-
-// Enumerate concrete paths represented by a PredDAG from src to dst.
-// Each path is returned as a sequence of (node_id, (edge_ids...)) pairs ending with (dst, ()).
-// When split_parallel_edges=false, parallel edges per hop are grouped in the tuple.
-// When true, the cartesian product over parallel edges is enumerated, yielding one
-// concrete single-edge path per combination; cap it with max_paths.
-// Enumeration is exponential in the DAG's branching, so pass max_paths on wide ECMP DAGs.
-// NOTE: this function does not release the Python GIL when called through the bindings.
-[[nodiscard]] std::vector<std::vector<std::pair<NodeId, std::vector<EdgeId>>>>
-resolve_to_paths(const PredDAG& dag, NodeId src, NodeId dst,
-                 bool split_parallel_edges = false,
-                 std::optional<std::int64_t> max_paths = std::nullopt);
-
-} // namespace netgraph::core
-
-namespace netgraph::core {
-
-// Compute shortest paths *to* dst from every node (Dijkstra over the in-adjacency).
-// Returns (distances, dag) where distances[u] is the cost of a shortest u -> dst walk
-// (INT64_MAX if none) and dag is a forward-oriented PredDAG: parents[v] holds (u, e)
-// for every edge e = u -> v that lies on a shortest u -> dst walk. Unlike a DAG from
-// shortest_paths(), which is rooted at one source, this DAG is valid for placement
-// from *any* node toward dst, and every walk it contains from a node u to dst has
-// cost distances[u]. It is the union of the per-source shortest-path DAGs toward dst.
-//
-// Parameters mirror shortest_paths(): multipath keeps every equal-cost successor per
-// node (false keeps one, preferring higher bottleneck capacity toward dst);
-// selection, residual, node_mask and edge_mask apply as there. Zero-cost edges get
-// the same acyclicity guard (a successor is recorded only while its node is
-// unsettled).
-//
-// fanout_edges: edges to add to the DAG regardless of cost, modelling an origin
-// whose first hop is decided by a traffic split rather than by routing (e.g. a
-// pseudo source whose demand originates evenly at every attached real source).
-// Each edge u -> v is added as a parent entry of v when it passes the masks and
-// capacity gate and v has a finite distance; entries the SPF already recorded are
-// not duplicated, and distances[u] is set to cost(e) + distances[v] if u was
-// unreachable. Every fanout edge must leave a node that has no incoming DAG entry,
-// so the result stays acyclic; a violating edge throws std::invalid_argument, as
-// does an out-of-range edge id.
-[[nodiscard]] std::pair<std::vector<Cost>, PredDAG>
-shortest_paths_to(const StrictMultiDiGraph& g, NodeId dst,
-                  bool multipath,
-                  const EdgeSelection& selection,
-                  std::span<const Cap> residual = {},
-                  std::span<const bool> node_mask = {},
-                  std::span<const bool> edge_mask = {},
-                  std::span<const EdgeId> fanout_edges = {},
-                  SpfQueue queue = SpfQueue::Auto);
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/strict_multidigraph.hpp b/include/netgraph/core/strict_multidigraph.hpp
deleted file mode 100644
index 42531bc..0000000
--- a/include/netgraph/core/strict_multidigraph.hpp
+++ /dev/null
@@ -1,88 +0,0 @@
-/* Immutable directed multigraph with CSR and reverse CSR adjacency. */
-#pragma once
-
-#include <cstdint>
-#include <span>
-#include <vector>
-
-#include "netgraph/core/types.hpp"
-
-namespace netgraph::core {
-
-// Edge identifiers:
-// - EdgeId: index into the graph's internal edge arrays (0-based).
-//   Edges are reordered during construction by (cost, src, dst) for deterministic traversal.
-// - External edge IDs (ext_edge_ids): optional user-provided identifiers (e.g., your database IDs)
-//   that are reordered alongside edges, allowing results to reference edges using stable,
-//   application-level IDs instead of internal EdgeId indices.
-
-class StrictMultiDiGraph {
-public:
-  // Builds a graph from parallel edge arrays, which must all have the same length.
-  // Edges are reordered by (cost, src, dst); ext_edge_ids is permuted alongside them.
-  // Self-loops and duplicate (src, dst) pairs are permitted (this is a multigraph).
-  //
-  // Throws std::invalid_argument or std::out_of_range if:
-  //   - the arrays differ in length, or ext_edge_ids is neither empty nor that length
-  //   - num_nodes < 0, or any src/dst falls outside [0, num_nodes)
-  //   - any capacity < 0, or any cost < 0
-  //   - the number of edges exceeds INT32_MAX
-  //   - the TOTAL of all edge costs reaches 2^62. SPF accumulates path costs as int64
-  //     and uses INT64_MAX as the unreachable sentinel, so a larger total could wrap
-  //     negative and silently corrupt results.
-  [[nodiscard]] static StrictMultiDiGraph from_arrays(
-      std::int32_t num_nodes,
-      std::span<const std::int32_t> src,
-      std::span<const std::int32_t> dst,
-      std::span<const Cap> capacity,
-      std::span<const Cost> cost,
-      std::span<const std::int64_t> ext_edge_ids = {});
-  ~StrictMultiDiGraph() noexcept = default;
-
-  [[nodiscard]] std::int32_t num_nodes() const noexcept { return num_nodes_; }
-  [[nodiscard]] std::int32_t num_edges() const noexcept { return static_cast<std::int32_t>(edges_); }
-
-  [[nodiscard]] std::span<const Cap> capacity_view() const noexcept { return capacity_; }
-  [[nodiscard]] std::span<const Cost> cost_view() const noexcept { return cost_; }
-  // Cost summary recorded at construction (0 for a graph without edges):
-  // the largest edge cost, and the gcd of all edge costs (0 when every cost is
-  // 0). SPF uses them to size its bucket queue; see shortest_paths.cpp.
-  [[nodiscard]] Cost max_cost() const noexcept { return max_cost_; }
-  [[nodiscard]] Cost cost_gcd() const noexcept { return cost_gcd_; }
-  [[nodiscard]] std::span<const NodeId> edge_src_view() const noexcept { return src_; }
-  [[nodiscard]] std::span<const NodeId> edge_dst_view() const noexcept { return dst_; }
-  [[nodiscard]] std::span<const std::int64_t> ext_edge_ids_view() const noexcept { return ext_edge_ids_; }
-  // CSR (Compressed Sparse Row) adjacency: for each node u, outgoing edges are in
-  // col_indices[row_offsets[u]:row_offsets[u+1]] with corresponding EdgeIds in adj_edge_index.
-  [[nodiscard]] std::span<const std::int32_t> row_offsets_view() const noexcept { return row_offsets_; }
-  [[nodiscard]] std::span<const NodeId> col_indices_view() const noexcept { return col_indices_; }
-  [[nodiscard]] std::span<const EdgeId> adj_edge_index_view() const noexcept { return adj_edge_index_; }
-  // Reverse CSR (incoming edges): for each node v, incoming edges are in
-  // in_col_indices[in_row_offsets[v]:in_row_offsets[v+1]] with EdgeIds in in_adj_edge_index.
-  [[nodiscard]] std::span<const std::int32_t> in_row_offsets_view() const noexcept { return in_row_offsets_; }
-  [[nodiscard]] std::span<const NodeId> in_col_indices_view() const noexcept { return in_col_indices_; }
-  [[nodiscard]] std::span<const EdgeId> in_adj_edge_index_view() const noexcept { return in_adj_edge_index_; }
-
-private:
-  // Core storage (edges may be reordered in compact form)
-  std::int32_t num_nodes_ {0};
-  std::size_t edges_ {0};
-  Cost max_cost_ {0};
-  Cost cost_gcd_ {0};
-  std::vector<Cap> capacity_ {};
-  std::vector<Cost> cost_ {};
-  std::vector<NodeId> src_ {};
-  std::vector<NodeId> dst_ {};
-  std::vector<std::int64_t> ext_edge_ids_ {};  // External edge IDs (reordered with edges)
-
-  // CSR adjacency for deterministic traversal (always built deterministically)
-  std::vector<std::int32_t> row_offsets_ {};
-  std::vector<NodeId> col_indices_ {};
-  std::vector<EdgeId> adj_edge_index_ {}; // map CSR entry -> EdgeId
-  // Reverse CSR (incoming adjacency)
-  std::vector<std::int32_t> in_row_offsets_ {};
-  std::vector<NodeId> in_col_indices_ {};
-  std::vector<EdgeId> in_adj_edge_index_ {};
-};
-
-} // namespace netgraph::core
diff --git a/include/netgraph/core/types.hpp b/include/netgraph/core/types.hpp
index 9835920..b466572 100644
--- a/include/netgraph/core/types.hpp
+++ b/include/netgraph/core/types.hpp
@@ -1,94 +1,31 @@
-/* Core type aliases and helper structs. */
+/* Core type aliases and the bounds of the units domain. */
 #pragma once
 
 #include <cstdint>
-#include <functional>
+#include <limits>
 
 namespace netgraph::core {
 
-// Node and edge identifiers are signed 32-bit integers.
+// Node and edge identifiers are signed 32-bit integers. An EdgeId is the rank of the edge in
+// the stable order (source, cost, destination, input) of its graph; the input position of an
+// edge is Graph::input_positions()[e].
 using NodeId = std::int32_t;
 using EdgeId = std::int32_t;
-using Cost   = std::int64_t;  // Path cost (64-bit for large accumulations)
-using Cap    = double;         // Edge capacity
-using Flow = double;           // Flow amount (same unit as capacity)
-
-using FlowClass = std::int32_t;  // Flow priority/class bucket
-using FlowId = std::int64_t;     // Unique flow identifier
-
-// FlowIndex uniquely identifies a flow: (src, dst, class, id).
-// Used as a key in unordered_map.
-struct FlowIndex {
-  NodeId src;
-  NodeId dst;
-  FlowClass flowClass;  // Priority bucket (e.g., for QoS classes)
-  FlowId    flowId;     // Unique ID within a FlowPolicy
-  friend bool operator==(const FlowIndex& a, const FlowIndex& b) noexcept {
-    return a.src==b.src && a.dst==b.dst && a.flowClass==b.flowClass && a.flowId==b.flowId;
-  }
-};
-
-// Hash function for FlowIndex (enables use in std::unordered_map).
-struct FlowIndexHash {
-  std::size_t operator()(const FlowIndex& k) const noexcept {
-    std::size_t h = 0;
-    auto combine = [&h](std::size_t v) {
-      // Hash combine formula
-      h ^= v + 0x9e3779b97f4a7c15ULL + (h << 6) + (h >> 2);
-    };
-    combine(std::hash<NodeId>{}(k.src));
-    combine(std::hash<NodeId>{}(k.dst));
-    combine(std::hash<FlowClass>{}(k.flowClass));
-    combine(std::hash<FlowId>{}(k.flowId));
-    return h;
-  }
-};
-
-// Flow placement strategy for distributing demand across multiple paths.
-//
-// IMPORTANT SEMANTICS:
-//
-// - EqualBalanced models *ECMP admission on a fixed SPF DAG* ("one-shot ECMP").
-//   We compute a single global scale so that no edge is oversubscribed under
-//   equal per-edge splits within each (u->v) group, place once, and stop.
-//   If you keep injecting after the first bottleneck saturates, you would
-//   change the split set (or oversubscribe and drop), which is intentionally
-//   out of scope for EqualBalanced.
-//
-// - Proportional may be used iteratively (e.g., for max-flow).
-//
-// - EqualBalanced takes its split set from the DAG edges that have *capacity*
-//   (the topology's next-hop set) and admits with one global scale computed
-//   from residual headroom. A member filled since the DAG was built therefore
-//   blocks admission (scale 0): a forwarding table does not react to load.
-//   Callers that want to progress past a full member recompute the DAG with a
-//   residual-aware SPF, as place_max_flow and FlowPolicy do.
-//
-// - EqualBalancedLossy splits over the same next-hop set without a scale:
-//   every edge carries min(share, residual) and the excess is dropped,
-//   deficits propagate downstream, and the placed amount is the volume that
-//   reaches dst. This is best-effort hash-ECMP forwarding; the dropped share
-//   per edge is available through the drop trace of place_on_dag.
-enum class FlowPlacement {
-  Proportional = 1,        // Distribute flow proportionally to residual capacity (like ECMP with weights)
-  EqualBalanced = 2,       // Equal split over the topology next-hop set, one lossless admission scale
-  EqualBalancedLossy = 3   // Equal split over the topology next-hop set; excess over residual is dropped
-};
-
-// Tie-breaking rule when multiple equal-cost edges exist between the same (u,v) pair.
-enum class EdgeTieBreak {
-  Deterministic = 1,         // Use edge order from graph construction (reproducible)
-  PreferHigherResidual = 2   // Prefer edge with more available capacity
-};
-
-// Edge selection policy for shortest path algorithms.
-struct EdgeSelection {
-  // multi_edge: if true, keep all equal-cost parallel edges per (u,v) pair.
-  //             if false, select one edge per (u,v) using tie_break rule.
-  bool multi_edge { true };
-  // require_capacity: if true, only consider edges with residual capacity > kMinCap.
-  bool require_capacity { false };
-  EdgeTieBreak tie_break { EdgeTieBreak::Deterministic };
-};
+// Costs: integers, never converted. An edge cost is at least 1, so a path's cost is positive; a
+// search's distance is 0 at its roots, and kUnreachable (below) marks no path.
+using Cost = std::int64_t;
+// An amount: an integer number of units of the graph's resolution. Capacities, views, flows and
+// requests are amounts; there is no finer grid.
+using Amount = std::int64_t;
+
+// Exclusive bound of the units domain: every capacity, the sum of all capacities and the sum of
+// all edge costs stay below 2^62.
+inline constexpr std::int64_t kDomainLimit = std::int64_t{1} << 62;
+
+// The path-cost sentinel of an unreachable node or an empty route. Python keeps this value itself
+// in the integer distance array SpfResult.costs and shows a single unreachable cost
+// (SpfResult.target_cost, FlowRecord.min_route_cost) as None. Costs are positive and their sum is
+// below 2^62, so no path cost reaches it.
+inline constexpr Cost kUnreachable = std::numeric_limits<Cost>::max();
 
 } // namespace netgraph::core
diff --git a/proofs/Checks.lean b/proofs/Checks.lean
new file mode 100644
index 0000000..01b835a
--- /dev/null
+++ b/proofs/Checks.lean
@@ -0,0 +1,4 @@
+module
+
+public import Checks.Examples
+public import Checks.Main
diff --git a/proofs/Checks/Examples.lean b/proofs/Checks/Examples.lean
new file mode 100644
index 0000000..f9bcbfe
--- /dev/null
+++ b/proofs/Checks/Examples.lean
@@ -0,0 +1,73 @@
+module
+
+public import NetGraphCore
+
+/-! Executable examples of the formal model; these do not run the native implementation. -/
+
+namespace NetGraphCore.Checks
+
+public section
+
+/-- Ten units give the first recipient the single leftover unit. -/
+example : (List.range 3).map (Apportionment.roundRobin 10 3) = [4, 3, 3] := by decide
+
+/-- Zero traffic, fewer units than recipients, and one complete circle are separate cases. -/
+example : (List.range 3).map (Apportionment.roundRobin 0 3) = [0, 0, 0] ∧
+    (List.range 3).map (Apportionment.roundRobin 2 3) = [1, 1, 0] ∧
+    (List.range 3).map (Apportionment.roundRobin 3 3) = [1, 1, 1] := by decide
+
+/-- The sixth unit continues the circle and goes to recipient 2, not recipient 0. -/
+example : (List.range 3).map (Apportionment.increments 5 1 3) = [0, 0, 1] := by decide
+
+/-- A nonexistent recipient is excluded: the direct formula would invent a full-circle share. -/
+example : Apportionment.sequential 3 3 5 = 0 ∧
+    Apportionment.roundRobin 3 3 5 = 1 := by decide
+
+/-- Adding complete circles adds the same amount to each share. -/
+example : (List.range 3).map (Apportionment.roundRobin (10 + 3 * 2) 3) =
+    [6, 5, 5] := by decide
+
+/-- A high word changes the remainder: 2^64 leaves remainder 1 on division by 3. -/
+example : (List.range 3).map (Apportionment.increments (2^64) 2 3) = [0, 1, 1] := by decide
+
+/-- This model-only addition crosses the public counter limit; the identity still holds. -/
+example : (List.range 7).map (Apportionment.increments (2^127-1) 9 7) =
+    [1, 2, 2, 1, 1, 1, 1] := by decide
+
+/-- Inputs whose exact outputs are compared to independently recorded expected values. -/
+def roundRobinCases : List (String × Nat × Nat) :=
+  [("rr-ten", 10, 3), ("rr-zero", 0, 3), ("rr-short", 2, 3),
+   ("rr-circle", 3, 3), ("rr-one", 7, 1)]
+
+/-- Increment cases exercise circle boundaries and totals that do not fit 64 bits. -/
+def incrementCases : List (String × Nat × Nat × Nat) :=
+  [("inc-continue", 5, 1, 3), ("inc-zero", 5, 0, 3),
+   ("inc-wrap", 2, 2, 3), ("inc-wide", 2^64, 2, 3),
+   ("inc-limit", 2^127-1, 9, 7)]
+
+/-- These actual offers exercise public ShortestPaths and Pinned calls beyond 2^64 in the bridge. -/
+def publicOffers : List Nat := [5, 1, 2^62-1, 2^62-1, 2^62-1, 2^62-1, 2^62-1, 4, 1]
+
+/-- Export model computations so the native bridge can compare exact values and inputs. -/
+def caseJson : Lean.Json :=
+  let rr := roundRobinCases.map fun (name, total, members) => Lean.Json.mkObj [
+    ("id", Lean.toJson name), ("kind", Lean.toJson "rr"),
+    ("total", Lean.toJson total), ("members", Lean.toJson members),
+    ("expected", Lean.toJson ((List.range members).map
+      (Apportionment.roundRobin total members)))]
+  let inc := incrementCases.map fun (name, previous, extra, members) => Lean.Json.mkObj [
+    ("id", Lean.toJson name), ("kind", Lean.toJson "increment"),
+    ("previous", Lean.toJson previous), ("extra", Lean.toJson extra),
+    ("members", Lean.toJson members),
+    ("expected", Lean.toJson ((List.range members).map
+      (Apportionment.increments previous extra members)))]
+  let seq := publicOffers.foldl (fun (state : Nat × List Lean.Json) offer =>
+    let total := state.1 + offer
+    (total, state.2 ++ [Lean.Json.mkObj [
+      ("offer", Lean.toJson offer), ("total", Lean.toJson total),
+      ("expected", Lean.toJson ((List.range 3).map (Apportionment.roundRobin total 3)))]]))
+    (0, [])
+  Lean.Json.mkObj [("cases", Lean.toJson (rr ++ inc)), ("public_sequence", Lean.toJson seq.2)]
+
+end
+end NetGraphCore.Checks
diff --git a/proofs/Checks/Main.lean b/proofs/Checks/Main.lean
new file mode 100644
index 0000000..30b5e53
--- /dev/null
+++ b/proofs/Checks/Main.lean
@@ -0,0 +1,84 @@
+module
+
+import Lean
+import Checks.Examples
+
+open Lean
+
+namespace ProofAudit
+
+/-- Export structural expressions, not human pretty-printing that could hide a changed type. -/
+def declarationJson (env : Environment) (sourceModule name : Name)
+    (info : ConstantInfo) : IO Json := do
+  let axioms ← (collectAxioms name : CoreM (Array Name)).toIO'
+    { fileName := "proof-audit", fileMap := default } { env := env }
+  let doc ← findDocString? env name
+  -- Direct ranges do not borrow a parent's location for generated recursors or
+  -- auxiliary proofs. Structure constructors still have direct ranges, so identify
+  -- their generated construction rule using Lean's structure metadata as well.
+  let ranges ← (findDeclarationRangesCore? name : CoreM _).toIO'
+    { fileName := "proof-audit", fileMap := default } { env := env }
+  let structureConstructor := match info with
+    | .ctorInfo ctor => isStructure env ctor.induct
+    | _ => false
+  let kind := match info with
+    | .thmInfo _ => "theorem"
+    | .defnInfo _ => "definition"
+    | .axiomInfo _ => "axiom"
+    | .opaqueInfo _ => "opaque"
+    | .inductInfo _ => "inductive"
+    | .ctorInfo _ => "constructor"
+    | .recInfo _ => "recursor"
+    | .quotInfo _ => "quotient"
+  return Json.mkObj [
+    ("name", toJson name.toString),
+    ("user_name", toJson (privateToUserName name).toString),
+    ("source_module", toJson sourceModule.toString),
+    ("authored", toJson (ranges.isSome && !structureConstructor)),
+    ("kind", toJson kind),
+    ("type", toJson (reprStr info.type)),
+    ("value", toJson (info.value? (allowOpaque := true) |>.map reprStr)),
+    ("uses", toJson (info.getUsedConstantsAsSet.toArray.map Name.toString)),
+    ("axioms", toJson (axioms.map Name.toString)),
+    ("doc", toJson doc)]
+
+/-- Load the actual built mathematical modules and export their checked declarations. -/
+unsafe def metadata : IO Json := do
+  initSearchPath (← findSysroot)
+  enableInitializersExecution
+  let inventory ← IO.FS.readFile "theorems.json"
+  let json ← IO.ofExcept (Json.parse inventory)
+  let modules ← IO.ofExcept (json.getObjValAs? (Array String) "modules")
+  let imports : Array Import := modules.map fun source =>
+    { module := (source.dropEnd 5 |>.toString.replace "/" ".").toName, importAll := true }
+  let env ← importModules imports {} (loadExts := true)
+  let mut declarations := #[]
+  for (name, info) in env.constants.toList do
+    if let some idx := env.getModuleIdxFor? name then
+      let sourceModule := env.header.moduleNames[idx]!
+      -- Ownership follows every maintained module, including checker modules that a
+      -- model might import. Keep generated constants for transitive fingerprints too.
+      if imports.any (·.module == sourceModule) then
+        declarations := declarations.push (← declarationJson env sourceModule name info)
+  return Json.mkObj [
+    ("lean_version", toJson Lean.versionString),
+    ("examples", NetGraphCore.Checks.caseJson),
+    ("declarations", toJson declarations)]
+
+end ProofAudit
+
+/-- Run the packaged audit with metadata produced from Lean's real environment.
+Python supplies SHA-256, filesystem and JSON checks; it does not prove theorems. -/
+public unsafe def main (args : List String) : IO UInt32 := do
+  let data ← ProofAudit.metadata
+  if args == ["--metadata"] then
+    (← IO.getStdout).putStrLn data.compress
+    return 0
+  let python := (← IO.getEnv "PROOFS_PYTHON").getD "python3"
+  let out ← IO.Process.output {
+    cmd := python
+    args := #["-I", "-B", "Checks/audit.py"] ++ args.toArray
+  } (some data.compress)
+  (← IO.getStdout).putStr out.stdout
+  (← IO.getStderr).putStr out.stderr
+  return out.exitCode
diff --git a/proofs/Checks/audit.py b/proofs/Checks/audit.py
new file mode 100644
index 0000000..06991a6
--- /dev/null
+++ b/proofs/Checks/audit.py
@@ -0,0 +1,439 @@
+"""Packaged proof inventory and evidence checks. Python never proves a theorem.
+
+Lean supplies structural declarations and transitive axioms from its built environment.
+This file binds them to reviewed inputs, explanations and independently recorded examples.
+It uses only Python's standard library and works without Git or repository developer tools.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+PROOFS = Path(__file__).resolve().parents[1]
+ROOT = PROOFS.parent
+ALLOWED_AXIOMS = {"propext", "Classical.choice", "Quot.sound"}
+AUDIT_INPUTS = ["Checks/Main.lean", "Checks/Examples.lean", "Checks/audit.py"]
+
+
+def fail(message: str) -> None:
+    raise ValueError(message)
+
+
+def digest(data: bytes | str) -> str:
+    return hashlib.sha256(data.encode() if isinstance(data, str) else data).hexdigest()
+
+
+def canonical(value: object) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+
+
+def unique_object(pairs: list[tuple[str, object]]) -> dict:
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            fail(f"duplicate JSON key: {key}")
+        result[key] = value
+    return result
+
+
+def read_json(path: Path) -> dict:
+    return json.loads(path.read_text(), object_pairs_hook=unique_object)
+
+
+def source_file(name: str) -> Path:
+    path = ROOT / name
+    if (
+        not path.is_file()
+        or path.is_symlink()
+        or not path.resolve().is_relative_to(ROOT.resolve())
+    ):
+        fail(f"missing or external mapped input: {name}")
+    return path
+
+
+def section_text(name: str, heading: str) -> str:
+    lines = source_file(name).read_text().splitlines(keepends=True)
+    starts = [i for i, line in enumerate(lines) if line.rstrip() == heading]
+    if len(starts) != 1:
+        fail(f"semantic heading missing or ambiguous: {name}: {heading}")
+    start = starts[0]
+    level = len(heading) - len(heading.lstrip("#"))
+    end = len(lines)
+    fence = None
+    for i in range(start + 1, len(lines)):
+        marker = re.match(r"^ {0,3}(`{3,}|~{3,})", lines[i])
+        if fence:
+            if re.fullmatch(
+                r" {0,3}" + re.escape(fence[0]) + "{" + str(fence[1]) + r",}\s*",
+                lines[i],
+            ):
+                fence = None
+            continue
+        if marker:
+            fence = (marker[1][0], len(marker[1]))
+            continue
+        match = re.match(r"^ {0,3}(#+) ", lines[i])
+        if match and len(match[1]) <= level:
+            end = i
+            break
+    return "".join(lines[start:end])
+
+
+def lean_sources() -> list[str]:
+    result = []
+    for directory, children, files in os.walk(PROOFS):
+        children[:] = [name for name in children if name != ".lake"]
+        for name in files:
+            if name.endswith(".lean"):
+                result.append(str((Path(directory) / name).relative_to(PROOFS)))
+    return sorted(result)
+
+
+def stripped_lean(text: str) -> str:
+    """Remove strings and nested comments before checking source commands."""
+    result, i, depth = [], 0, 0
+    while i < len(text):
+        if depth:
+            if text.startswith("/-", i):
+                depth += 1
+                i += 2
+            elif text.startswith("-/", i):
+                depth -= 1
+                i += 2
+            else:
+                result.append("\n" if text[i] == "\n" else " ")
+                i += 1
+        elif text.startswith("/-", i):
+            depth, i = 1, i + 2
+        elif text.startswith("--", i):
+            end = text.find("\n", i)
+            i = len(text) if end < 0 else end
+        elif text[i] == '"':
+            i += 1
+            while i < len(text):
+                if text[i] == "\\":
+                    i += 2
+                elif text[i] == '"':
+                    i += 1
+                    break
+                else:
+                    i += 1
+            result.append(" ")
+        else:
+            result.append(text[i])
+            i += 1
+    if depth:
+        fail("unclosed Lean comment")
+    return "".join(result)
+
+
+def input_state(inventory: dict) -> dict:
+    if inventory.get("schema") != 1 or not inventory.get("theorems"):
+        fail("empty or unsupported theorem inventory")
+    if lean_sources() != sorted(inventory["modules"]):
+        fail("maintained Lean module inventory differs (including unimported sources)")
+    # Every maintained library module must be explicitly imported by its aggregation root.
+    for root, prefix in [
+        ("NetGraphCore.lean", "NetGraphCore/"),
+        ("Checks.lean", "Checks/"),
+    ]:
+        expected = sorted(
+            name[:-5].replace("/", ".")
+            for name in inventory["modules"]
+            if name.startswith(prefix)
+        )
+        imports = re.findall(
+            r"^(?:public )?import ([A-Za-z0-9_.]+)\s*$",
+            (PROOFS / root).read_text(),
+            re.M,
+        )
+        if sorted(imports) != expected:
+            fail(f"aggregation root does not cover maintained modules: {root}")
+    inputs = {}
+    for name in [
+        "lean-toolchain",
+        "lakefile.toml",
+        "lake-manifest.json",
+        *AUDIT_INPUTS,
+    ]:
+        inputs[f"proofs/{name}"] = digest((PROOFS / name).read_bytes())
+    for name in inventory["modules"]:
+        path = PROOFS / name
+        inputs[f"proofs/{name}"] = digest(path.read_bytes())
+        if name.startswith("NetGraphCore") or name == "Checks/Examples.lean":
+            code = stripped_lean(path.read_text())
+            if re.search(
+                r"\b(sorry|admit|axiom|unsafe|native_decide)\b|\bdebug\.|#eval\b|^\s*(?:set_option|initialize|run_cmd|elab|macro|attribute)\b",
+                code,
+                re.M,
+            ):
+                fail(f"forbidden proof command or kernel bypass: {name}")
+            if any(
+                value.strip() != "expose"
+                for value in re.findall(r"@\[([^\]]*)\]", code)
+            ):
+                fail(f"unreviewed mathematical declaration attribute: {name}")
+    return inputs
+
+
+def record_inputs(record: dict, inputs: dict) -> dict:
+    result = {"semantics": [], "implementation": [], "explanation": {}}
+    for ref in record["semantics"]:
+        section_text(ref["file"], ref["heading"])
+        result["semantics"].append(dict(ref))
+    for ref in record["implementation"]["sources"]:
+        value = digest(source_file(ref["file"]).read_bytes())
+        result["implementation"].append({**ref, "sha256": value})
+        inputs[ref["file"]] = value
+    ref = record["explanation"]
+    text = source_file(ref["file"]).read_text()
+    if f'<a id="{ref["anchor"]}"></a>' not in text:
+        fail(f"missing explanation anchor: {ref['anchor']}")
+    result["explanation"] = dict(ref)
+    return result
+
+
+def preflight(inventory: dict, recording: bool = False) -> dict:
+    inputs = input_state(inventory)
+    pins = {
+        name: inputs[f"proofs/{name}"]
+        for name in ["lean-toolchain", "lakefile.toml", "lake-manifest.json"]
+    }
+    tools = {name: inputs[f"proofs/{name}"] for name in AUDIT_INPUTS}
+    if not recording and (
+        inventory.get("pins") != pins or inventory.get("audit_sources") != tools
+    ):
+        fail("toolchain/dependency/audit-source digest drift")
+    ids, names = set(), set()
+    for record in inventory["theorems"]:
+        if not record["semantics"]:
+            fail(f"accepted theorem has no semantic contract reference: {record['id']}")
+        if record["id"] in ids or record["declaration"] in names:
+            fail("duplicate accepted ID or declaration")
+        ids.add(record["id"])
+        names.add(record["declaration"])
+        for field in ("module", "claim", "domain"):
+            if not isinstance(record.get(field), str) or not record[field].strip():
+                fail(f"missing theorem {field}: {record['id']}")
+        mapping = record_inputs(record, inputs)
+        if not recording and mapping != record.get("mapped_inputs"):
+            fail(f"explanation or applicability digest drift: {record['id']}")
+        if recording:
+            record["mapped_inputs"] = mapping
+        if record["implementation"]["status"] not in {"unconnected", "tested"}:
+            fail("unsupported native connection claim; no refinement is supplied")
+        if (
+            record["implementation"]["status"] == "tested"
+            and record["implementation"].get("bridge") != "round-robin"
+        ):
+            fail("connected declaration has no supported bridge")
+    if recording:
+        inventory["pins"], inventory["audit_sources"] = pins, tools
+    return inputs
+
+
+def binding(declaration: str, metadata: dict) -> dict:
+    if declaration not in metadata:
+        fail(f"unresolved Lean declaration: {declaration}")
+    root = metadata[declaration]
+    if root["value"] is None:
+        fail(f"proof body unavailable to audit: {declaration}")
+    axioms = sorted(root["axioms"])
+    if set(axioms) - ALLOWED_AXIOMS:
+        fail(f"unaccepted transitive axioms: {declaration}: {axioms}")
+    todo, seen, closure = [declaration], set(), {}
+    while todo:
+        name = todo.pop()
+        if name in seen or name not in metadata:
+            continue
+        seen.add(name)
+        item = metadata[name]
+        fields = {"kind": item["kind"], "type": item["type"]}
+        if item["kind"] != "theorem":
+            if item["value"] is None:
+                fail(f"definition body unavailable to audit: {name}")
+            fields["value"] = item["value"]
+        closure[name] = digest(canonical(fields))
+        todo.extend(item["uses"])
+    if root["kind"] != "theorem":
+        fail(f"accepted declaration is not a theorem: {declaration}")
+    return {
+        "type_sha256": digest(root["type"]),
+        "local_closure": closure,
+        "axioms": axioms,
+    }
+
+
+def audit(data: dict, inventory: dict, recording: bool) -> dict:
+    inputs = preflight(inventory, recording)
+    toolchain = (PROOFS / "lean-toolchain").read_text().strip()
+    if not re.fullmatch(r"leanprover/lean4:v\d+\.\d+\.\d+", toolchain) or data[
+        "lean_version"
+    ] != toolchain.removeprefix("leanprover/lean4:v"):
+        fail("unexpected Lean runtime or toolchain")
+    dependencies = read_json(PROOFS / "lake-manifest.json")["packages"]
+    for package in dependencies:
+        directory = PROOFS / ".lake/packages" / package["name"]
+        actual = subprocess.run(
+            ["git", "-C", str(directory), "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=True,
+        ).stdout.strip()
+        dirty = subprocess.run(
+            [
+                "git",
+                "-C",
+                str(directory),
+                "status",
+                "--porcelain",
+                "--untracked-files=normal",
+            ],
+            capture_output=True,
+            text=True,
+            check=True,
+        ).stdout
+        if actual != package["rev"] or dirty:
+            fail(f"dependency source drift: {package['name']}")
+    metadata = {item["name"]: item for item in data["declarations"]}
+    mathematical_modules = {
+        name[:-5].replace("/", ".")
+        for name in inventory["modules"]
+        if name == "NetGraphCore.lean" or name.startswith("NetGraphCore/")
+    }
+    tagged = []
+    for item in data["declarations"]:
+        if not item["authored"]:
+            continue
+        name = item["user_name"]
+        if not item["doc"] or not item["doc"].strip():
+            fail(f"missing declaration doc comment: {name}")
+        if item["source_module"] not in mathematical_modules:
+            continue
+        if not name.startswith("NetGraphCore."):
+            fail(f"mathematical declaration outside project namespace: {name}")
+        marker = re.match(r"^(NGC-[A-Z]+-\d{3}):", item["doc"].strip())
+        if marker:
+            tagged.append((marker[1], item["name"]))
+    expected = [(r["id"], r["declaration"]) for r in inventory["theorems"]]
+    if sorted(tagged) != sorted(expected):
+        fail("accepted inventory differs from theorem ID markers in built declarations")
+    expected_examples = read_json(PROOFS / "cases.json")
+    if canonical(data["examples"]) != canonical(expected_examples):
+        fail("model example inputs or exact outputs differ from independent cases")
+    inputs["proofs/cases.json"] = digest((PROOFS / "cases.json").read_bytes())
+    case_ids = {item["id"] for item in expected_examples["cases"]}
+    if len(case_ids) != len(expected_examples["cases"]):
+        fail("duplicate executable example ID")
+    for record in inventory["theorems"]:
+        if not record["examples"] or set(record["examples"]) - case_ids:
+            fail(f"missing executable explanation example: {record['id']}")
+        if record["module"] != metadata[record["declaration"]]["source_module"]:
+            fail(f"theorem module differs from built declaration: {record['id']}")
+        actual = binding(record["declaration"], metadata)
+        if recording:
+            record["binding"] = actual
+        elif actual != record.get("binding"):
+            fail(f"reviewed statement/definition digest drift: {record['id']}")
+    revision, dirty = None, None
+    if (ROOT / ".git").exists():
+        revision = subprocess.run(
+            ["git", "-C", str(ROOT), "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=True,
+        ).stdout.strip()
+        dirty = bool(
+            subprocess.run(
+                [
+                    "git",
+                    "-C",
+                    str(ROOT),
+                    "status",
+                    "--porcelain",
+                    "--untracked-files=normal",
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            ).stdout
+        )
+    return {
+        "status": "PASS",
+        "scope": "model proofs; no native refinement",
+        "lean_version": data["lean_version"],
+        "inventory_sha256": digest(canonical(inventory)),
+        "source_revision": revision,
+        "worktree_dirty": dirty,
+        "source_inputs": dict(sorted(inputs.items())),
+        "modules": inventory["modules"],
+        "accepted": [record["id"] for record in inventory["theorems"]],
+        "bindings": {
+            record["id"]: record["binding"] for record in inventory["theorems"]
+        },
+        "example_count": len(case_ids),
+        "public_sequence_steps": len(expected_examples["public_sequence"]),
+        "dependencies": {p["name"]: p["rev"] for p in dependencies},
+        "dependency_origin": os.environ.get("PROOFS_DEPENDENCY_ORIGIN", "unrecorded"),
+        "native_bridge": "not run here",
+        "kernel_replay": "not run by this command",
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--preflight", action="store_true")
+    parser.add_argument("--record", action="store_true")
+    parser.add_argument("--verify-report", type=Path)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+    inventory_path = PROOFS / "theorems.json"
+    inventory = read_json(inventory_path)
+    if args.verify_report:
+        if not args.verify_report.is_file():
+            fail("missing proof evidence file")
+        inputs = preflight(inventory)
+        inputs["proofs/cases.json"] = digest((PROOFS / "cases.json").read_bytes())
+        report = read_json(args.verify_report)
+        if (
+            report.get("status") != "PASS"
+            or report.get("accepted") != [r["id"] for r in inventory["theorems"]]
+            or report.get("inventory_sha256") != digest(canonical(inventory))
+            or report.get("source_inputs") != dict(sorted(inputs.items()))
+        ):
+            fail("missing, incomplete or stale proof evidence")
+        print("Current proof evidence: PASS")
+        return
+    if args.preflight:
+        preflight(inventory)
+        print("Proof input preflight: PASS")
+        return
+    if args.record and (os.environ.get("CI") or os.environ.get("PROOFS_RECORD") != "1"):
+        fail("recording requires explicit PROOFS_RECORD=1 outside CI")
+    data = json.load(sys.stdin, object_pairs_hook=unique_object)
+    report = audit(data, inventory, args.record)
+    if args.record:
+        inventory_path.write_text(
+            json.dumps(inventory, indent=2, sort_keys=True) + "\n"
+        )
+        print("Recorded candidate bindings; independent review is still required.")
+        return
+    if args.output:
+        args.output.parent.mkdir(parents=True, exist_ok=True)
+        args.output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
+    print(json.dumps(report, sort_keys=True))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (ValueError, KeyError, TypeError, OSError) as error:
+        print(f"proof-audit: {error}", file=sys.stderr)
+        sys.exit(1)
diff --git a/proofs/NetGraphCore.lean b/proofs/NetGraphCore.lean
new file mode 100644
index 0000000..7a70cd8
--- /dev/null
+++ b/proofs/NetGraphCore.lean
@@ -0,0 +1,3 @@
+module
+
+public import NetGraphCore.Apportionment.RoundRobin
diff --git a/proofs/NetGraphCore/Apportionment/RoundRobin.lean b/proofs/NetGraphCore/Apportionment/RoundRobin.lean
new file mode 100644
index 0000000..239f510
--- /dev/null
+++ b/proofs/NetGraphCore/Apportionment/RoundRobin.lean
@@ -0,0 +1,170 @@
+module
+
+public import Mathlib.Data.Nat.ModEq
+public import Mathlib.Algebra.BigOperators.Group.Finset.Basic
+public import Mathlib.Algebra.BigOperators.Group.Finset.Piecewise
+public import Mathlib.Tactic.NormNum
+import Lean.Elab.Tactic.Omega
+
+/-!+# Whole-unit round robin
+
+This model has ordered recipients numbered from zero. Giving the next unit to
+`total % members` means continuing the same circle, rather than restarting it.
+The closed formula is introduced independently and then proved to agree with
+that sequence. See `docs/formal/theorems/round-robin.md` for the worked argument.
+All arithmetic here is unbounded natural arithmetic; native bounds are separate.
+-/
+
+namespace NetGraphCore.Apportionment
+
+public section
+
+/-- The share computed in one division: a full-round share and a possible leftover unit.
+Only indices below a positive `members` count describe a recipient. -/
+@[expose] def roundRobin (total members recipient : Nat) : Nat :=
+  total / members + if recipient < total % members then 1 else 0
+
+/-- Count units given to one recipient by handing them out in a circle, one at a time. -/
+@[expose] def sequential (total members recipient : Nat) : Nat :=
+  match total with
+  | 0 => 0
+  | n + 1 => sequential n members recipient + if n % members = recipient then 1 else 0
+
+/-- Increasing the total by one changes precisely the share of the next recipient.
+When the remainder wraps, a complete round replaces every previous leftover unit. -/
+theorem roundRobin_succ (total members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members) :
+    roundRobin (total + 1) members recipient = roundRobin total members recipient +
+      if total % members = recipient then 1 else 0 := by
+  have hr := Nat.mod_lt total hm
+  -- A remainder advances by one, or returns to zero after the final recipient.
+  have hs : (total + 1) % members =
+      if total % members + 1 = members then 0 else total % members + 1 := by
+    rw [← Nat.add_mod_eq_add_mod_right 1 (Nat.mod_mod total members)]
+    by_cases h : total % members + 1 = members
+    · simp [h]
+    · rw [Nat.mod_eq_of_lt (by omega)]
+      simp [h]
+  -- The full-round count changes only on that wrap. The remaining comparisons
+  -- distinguish the chosen recipient, earlier recipients and later recipients.
+  by_cases hw : total % members + 1 = members
+  · simp [roundRobin, Nat.succ_div, Nat.dvd_iff_mod_eq_zero, hs, hw]
+    split_ifs <;> omega
+  · simp [roundRobin, Nat.succ_div, Nat.dvd_iff_mod_eq_zero, hs, hw]
+    split_ifs <;> omega
+
+/-- NGC-AP-001: the direct formula gives exactly the counts of the unit-by-unit circle.
+The induction follows one real assignment, not an assumed conservation equation. -/
+theorem sequential_eq_roundRobin (total members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members) :
+    sequential total members recipient = roundRobin total members recipient := by
+  induction total with
+  | zero => simp [sequential, roundRobin]
+  | succ n ih =>
+      -- The sequential process and formula add one to the same recipient.
+      simpa [sequential, ih] using (roundRobin_succ n members recipient hm hi).symm
+
+/-- NGC-AP-002: adding traffic never takes a previously assigned unit from a recipient. -/
+theorem roundRobin_mono (total extra members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members) :
+    roundRobin total members recipient ≤ roundRobin (total + extra) members recipient := by
+  induction extra with
+  | zero => simp
+  | succ v ih =>
+      -- Each next step adds either zero or one to this recipient's count.
+      have h := roundRobin_succ (total + v) members recipient hm hi
+      rw [show total + (v + 1) = total + v + 1 by omega, h]
+      omega
+
+/-- NGC-AP-003: the ordered shares account for every input unit exactly once. -/
+theorem roundRobin_conservation (total members : Nat) (hm : 0 < members) :
+    ∑ i ∈ Finset.range members, roundRobin total members i = total := by
+  induction total with
+  | zero => simp [roundRobin]
+  | succ n ih =>
+      -- Sum the one-step equation over every valid recipient.
+      have h : (∑ i ∈ Finset.range members, roundRobin (n + 1) members i) =
+          ∑ i ∈ Finset.range members,
+            (roundRobin n members i + if n % members = i then 1 else 0) := by
+        apply Finset.sum_congr rfl
+        intro i hi
+        exact roundRobin_succ n members i hm (Finset.mem_range.mp hi)
+      rw [h, Finset.sum_add_distrib, ih]
+      -- The remainder names exactly one member of this finite set.
+      simp [Finset.mem_range, Nat.mod_lt n hm]
+
+/-- Adding complete circles increases every share by the number of circles. -/
+theorem roundRobin_periodic (total circles members recipient : Nat) (hm : 0 < members) :
+    roundRobin (total + members * circles) members recipient =
+      roundRobin total members recipient + circles := by
+  -- Complete circles change the quotient, leaving the leftover recipients unchanged.
+  simp only [roundRobin, Nat.add_mul_div_left _ _ hm, Nat.add_mul_mod_self_left]
+  omega
+
+/-- The signed arithmetic used for an increment, using only the previous remainder.
+Using integers keeps the subtraction honest; nonnegativity is proved below. -/
+@[expose] def increments (previous extra members recipient : Nat) : Int :=
+  ((previous % members + extra) / members : Nat) +
+    (if recipient < (previous % members + extra) % members then 1 else 0) -
+    (if recipient < previous % members then 1 else 0)
+
+/-- NGC-AP-004: continuing a circle is computed from the old remainder alone.
+This is the mathematical identity used by Core's round_robin_increments. -/
+theorem increments_eq_difference (previous extra members recipient : Nat) (hm : 0 < members) :
+    increments previous extra members recipient =
+      (roundRobin (previous + extra) members recipient : Int) -
+      (roundRobin previous members recipient : Int) := by
+  -- Write the old total as complete circles plus a remainder; the circles cancel.
+  have hx := Nat.mod_add_div previous members
+  have h : previous + extra = previous % members + extra + members * (previous / members) := by
+    omega
+  conv_rhs => lhs; rw [h, roundRobin_periodic _ _ _ _ hm]
+  unfold increments roundRobin
+  simp only [Nat.cast_add]
+  split_ifs <;> omega
+
+/-- A recipient cannot receive more than the number of units added in this call. -/
+theorem roundRobin_add_le (total extra members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members) :
+    roundRobin (total + extra) members recipient ≤ roundRobin total members recipient + extra := by
+  induction extra with
+  | zero => simp
+  | succ v ih =>
+      -- Each new unit raises this recipient's count by at most one.
+      have h := roundRobin_succ (total + v) members recipient hm hi
+      rw [show total + (v + 1) = total + v + 1 by omega, h]
+      split_ifs <;> omega
+
+/-- NGC-AP-005: the signed increment is nonnegative and no larger than the added traffic. -/
+theorem increments_bounds (previous extra members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members) :
+    0 ≤ increments previous extra members recipient ∧
+      increments previous extra members recipient ≤ (extra : Int) := by
+  -- Translate the difference identity using the lower and upper bounds on a share's growth.
+  rw [increments_eq_difference _ _ _ _ hm]
+  have lower := roundRobin_mono previous extra members recipient hm hi
+  have upper := roundRobin_add_le previous extra members recipient hm hi
+  omega
+
+/-- The exclusive bound on one native traffic amount, in integer units. -/
+@[expose] def amountLimit : Nat := 2 ^ 62
+
+/-- NGC-AP-006: the remainder-plus-offer intermediate fits unsigned 64-bit arithmetic,
+and the final signed increment fits Amount. This does not verify the C++ implementation
+of 128-bit remainder; that connection is explicitly tested, not formally refined. -/
+theorem native_increment_bounds (previous extra members recipient : Nat)
+    (hm : 0 < members) (hi : recipient < members)
+    (hk : members < 2 ^ 31) (hv : extra < amountLimit) :
+    previous % members + extra < 2 ^ 63 ∧
+      0 ≤ increments previous extra members recipient ∧
+      increments previous extra members recipient < (amountLimit : Int) := by
+  -- The remainder is smaller than the recipient count. Combining the two stated
+  -- input bounds leaves room for their sum, independently of the old total's size.
+  have hr := Nat.mod_lt previous hm
+  have hb := increments_bounds previous extra members recipient hm hi
+  norm_num [amountLimit] at hv ⊢
+  norm_num at hk
+  omega
+
+end
+end NetGraphCore.Apportionment
diff --git a/proofs/README.md b/proofs/README.md
new file mode 100644
index 0000000..71550e4
--- /dev/null
+++ b/proofs/README.md
@@ -0,0 +1,89 @@
+# NetGraph-Core proofs
+
+This is a Lean 4 project. Lean is a proof assistant: a program that checks a mathematical proof
+step by step. The project proves properties of the library's round-robin rule, which splits a
+number of whole units among members in order (10 units over 3 members give 4, 3 and 3), and of
+the increments it gives when an offer grows over several calls. Each theorem and its proof are
+explained in plain words, with worked examples, in
+[docs/formal/theorems/round-robin.md](../docs/formal/theorems/round-robin.md).
+
+The proofs are about the mathematical rule. Separate tests compare it exactly with the native
+package on chosen inputs; nothing here proves that the C++ code implements the rule on every
+input. Installing, building or running the package never needs Lean, and the wheel contains
+none of this directory.
+
+## What you need
+
+- Lean's toolchain manager, [Elan](https://lean-lang.org/install/). It installs the Lean version
+  named in `lean-toolchain`; keep that file as it is.
+- Git, which Lake (Lean's build tool) uses to fetch mathlib, the mathematics library the proofs
+  use. `lakefile.toml` pins mathlib to one Git revision and `lake-manifest.json` pins every
+  dependency of it, so every check uses the same sources.
+- Python 3.11 or newer, for the inventory checker `Checks/audit.py` (standard library only).
+
+No native build and no Git history of this repository are needed.
+
+## Checking the proofs from the source archive
+
+From the root of the extracted source archive (sdist), with an absolute output directory of
+your choice:
+
+```bash
+cd proofs
+lake exe cache get
+lake --wfail build
+lake exe proof-audit --output /absolute/output/check.json
+python3 -I -B Checks/audit.py --verify-report /absolute/output/check.json
+lake env leanchecker --fresh Checks
+```
+
+- `lake exe cache get` downloads mathlib's prebuilt files for the pinned revision, so the build
+  does not recompile mathlib; it only saves time.
+- `lake --wfail build` checks every proof, treating warnings as errors.
+- `lake exe proof-audit` compares each theorem in the built project with its record in
+  `theorems.json`: the exact statement, the definitions it depends on, the axioms it rests on
+  (only `propext`, `Classical.choice` and `Quot.sound` are accepted), its explanation, the
+  sections of `docs/semantics.md` and the native source files it describes, and the pinned
+  toolchain and dependencies. It also runs the examples against the expected results in
+  `cases.json`. Any difference fails the check. `Checks/audit.py --verify-report` checks that the
+  report is complete and matches these inputs.
+- `lake env leanchecker --fresh Checks` checks every declaration again in a fresh environment
+  with Lean's kernel, the small core that accepts proofs.
+
+The archive holds every local file these commands read; Lean and mathlib are downloaded.
+
+## Checking in a Git checkout
+
+The repository wraps the same commands in `dev/proofs/run.sh` (the `dev/` directory is not in the
+source archive). From the repository root, after `cd proofs && lake exe cache get`:
+
+```bash
+bash dev/proofs/run.sh check     # build, audit and examples; writes build/proofs/check.json
+PROOFS_DEPENDENCY_ORIGIN=cache+local bash dev/proofs/run.sh replay   # check, then the fresh replay
+bash dev/proofs/run.sh test      # the gate refuses planted errors, in a disposable copy
+```
+
+`PROOFS_DEPENDENCY_ORIGIN` records where mathlib's built files came from: `cache+local` for the
+downloaded cache plus local builds, `source` for a build from source, `mixed` for both. Set
+`PROOFS_PYTHON` to an absolute interpreter path if `python3` is not the one to use.
+
+To compare the rule with a native wheel, install that wheel in a clean environment first:
+
+```bash
+PROOFS_NATIVE_PYTHON=/absolute/path/to/venv/bin/python \
+PROOFS_WHEEL=/absolute/path/to/netgraph_core.whl \
+bash dev/proofs/run.sh bridge
+```
+
+The bridge checks that the installed package is that wheel, then compares results exactly with
+`cases.json`: sources passed out of node order come back in canonical order, and repeated calls
+through `ShortestPaths` and `Pinned` add the right increments, including after the total offer
+passes 2^64. Cases near 2^127 are checked on the model only; the public calls cannot reach that
+total. The report is `build/proofs/bridge.json`.
+
+## Changing a theorem
+
+`theorems.json` is a reviewed record, not a list of whatever compiles: a changed statement,
+definition, explanation or mapped input fails the audit until the change is reviewed and its
+digests are recorded again. The rules for adding or changing a theorem are in the Git
+repository's `dev/proofs/README.md`.
diff --git a/proofs/cases.json b/proofs/cases.json
new file mode 100644
index 0000000..03dae3b
--- /dev/null
+++ b/proofs/cases.json
@@ -0,0 +1,204 @@
+{
+  "cases": [
+    {
+      "id": "rr-ten",
+      "kind": "rr",
+      "total": 10,
+      "members": 3,
+      "expected": [
+        4,
+        3,
+        3
+      ]
+    },
+    {
+      "id": "rr-zero",
+      "kind": "rr",
+      "total": 0,
+      "members": 3,
+      "expected": [
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "id": "rr-short",
+      "kind": "rr",
+      "total": 2,
+      "members": 3,
+      "expected": [
+        1,
+        1,
+        0
+      ]
+    },
+    {
+      "id": "rr-circle",
+      "kind": "rr",
+      "total": 3,
+      "members": 3,
+      "expected": [
+        1,
+        1,
+        1
+      ]
+    },
+    {
+      "id": "rr-one",
+      "kind": "rr",
+      "total": 7,
+      "members": 1,
+      "expected": [
+        7
+      ]
+    },
+    {
+      "id": "inc-continue",
+      "kind": "increment",
+      "previous": 5,
+      "extra": 1,
+      "members": 3,
+      "expected": [
+        0,
+        0,
+        1
+      ]
+    },
+    {
+      "id": "inc-zero",
+      "kind": "increment",
+      "previous": 5,
+      "extra": 0,
+      "members": 3,
+      "expected": [
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "id": "inc-wrap",
+      "kind": "increment",
+      "previous": 2,
+      "extra": 2,
+      "members": 3,
+      "expected": [
+        1,
+        0,
+        1
+      ]
+    },
+    {
+      "id": "inc-wide",
+      "kind": "increment",
+      "previous": 18446744073709551616,
+      "extra": 2,
+      "members": 3,
+      "expected": [
+        0,
+        1,
+        1
+      ]
+    },
+    {
+      "id": "inc-limit",
+      "kind": "increment",
+      "previous": 170141183460469231731687303715884105727,
+      "extra": 9,
+      "members": 7,
+      "expected": [
+        1,
+        2,
+        2,
+        1,
+        1,
+        1,
+        1
+      ]
+    }
+  ],
+  "public_sequence": [
+    {
+      "offer": 5,
+      "total": 5,
+      "expected": [
+        2,
+        2,
+        1
+      ]
+    },
+    {
+      "offer": 1,
+      "total": 6,
+      "expected": [
+        2,
+        2,
+        2
+      ]
+    },
+    {
+      "offer": 4611686018427387903,
+      "total": 4611686018427387909,
+      "expected": [
+        1537228672809129303,
+        1537228672809129303,
+        1537228672809129303
+      ]
+    },
+    {
+      "offer": 4611686018427387903,
+      "total": 9223372036854775812,
+      "expected": [
+        3074457345618258604,
+        3074457345618258604,
+        3074457345618258604
+      ]
+    },
+    {
+      "offer": 4611686018427387903,
+      "total": 13835058055282163715,
+      "expected": [
+        4611686018427387905,
+        4611686018427387905,
+        4611686018427387905
+      ]
+    },
+    {
+      "offer": 4611686018427387903,
+      "total": 18446744073709551618,
+      "expected": [
+        6148914691236517206,
+        6148914691236517206,
+        6148914691236517206
+      ]
+    },
+    {
+      "offer": 4611686018427387903,
+      "total": 23058430092136939521,
+      "expected": [
+        7686143364045646507,
+        7686143364045646507,
+        7686143364045646507
+      ]
+    },
+    {
+      "offer": 4,
+      "total": 23058430092136939525,
+      "expected": [
+        7686143364045646509,
+        7686143364045646508,
+        7686143364045646508
+      ]
+    },
+    {
+      "offer": 1,
+      "total": 23058430092136939526,
+      "expected": [
+        7686143364045646509,
+        7686143364045646509,
+        7686143364045646508
+      ]
+    }
+  ]
+}
diff --git a/proofs/lake-manifest.json b/proofs/lake-manifest.json
new file mode 100644
index 0000000..e2493f2
--- /dev/null
+++ b/proofs/lake-manifest.json
@@ -0,0 +1,96 @@
+{"version": "1.3.0",
+ "packagesDir": ".lake/packages",
+ "packages":
+ [{"url": "https://github.com/leanprover-community/mathlib4.git",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "56a005855ea17e0b0958f73ec801ae140b0a1679",
+   "name": "mathlib",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "56a005855ea17e0b0958f73ec801ae140b0a1679",
+   "inherited": false,
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/leanprover-community/plausible",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "dfa4f38190d07c37e315953e08b90fe2d95b3c24",
+   "name": "plausible",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/LeanSearchClient",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "d6b4c7be5be75ec4917c873ac50c756dc1436372",
+   "name": "LeanSearchClient",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/import-graph",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "a41f0e9a4dea23188ea9cc1c41ac9f8bbafe0b93",
+   "name": "importGraph",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/ProofWidgets4",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "df72b022e558978a1c50264cfc4d7fec86fa8e04",
+   "name": "proofwidgets",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/leanprover-community/aesop",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "4a174c490d8707121c4a9290800489f105d85e07",
+   "name": "aesop",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "master",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/quote4",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "dce0ad79c486cb1fb504af04f953c3466b0c6db8",
+   "name": "Qq",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "master",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/batteries",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "66e469188fe07963e5cf666c7d4433f45b8131c5",
+   "name": "batteries",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover/lean4-cli",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover",
+   "rev": "c24fe6078c630e89b489bffe59b3e20ac30d12c8",
+   "name": "Cli",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "v4.35.0",
+   "inherited": true,
+   "configFile": "lakefile.toml"}],
+ "name": "netgraph_core_proofs",
+ "lakeDir": ".lake",
+ "fixedToolchain": false}
diff --git a/proofs/lakefile.toml b/proofs/lakefile.toml
new file mode 100644
index 0000000..9d99344
--- /dev/null
+++ b/proofs/lakefile.toml
@@ -0,0 +1,18 @@
+name = "netgraph_core_proofs"
+defaultTargets = ["NetGraphCore", "Checks", "proof-audit"]
+
+[[require]]
+name = "mathlib"
+git = "https://github.com/leanprover-community/mathlib4.git"
+rev = "56a005855ea17e0b0958f73ec801ae140b0a1679"
+
+[[lean_lib]]
+name = "NetGraphCore"
+
+[[lean_lib]]
+name = "Checks"
+
+[[lean_exe]]
+name = "proof-audit"
+root = "Checks.Main"
+supportInterpreter = true
diff --git a/proofs/lean-toolchain b/proofs/lean-toolchain
new file mode 100644
index 0000000..a6aff06
--- /dev/null
+++ b/proofs/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:v4.35.0
diff --git a/proofs/theorems.json b/proofs/theorems.json
new file mode 100644
index 0000000..6fb2b44
--- /dev/null
+++ b/proofs/theorems.json
@@ -0,0 +1,822 @@
+{
+  "audit_sources": {
+    "Checks/Examples.lean": "b0529783d314ea0f8ef553d5e2b2851f52020f325596a99897d8d217fdaad686",
+    "Checks/Main.lean": "e4914f8f1cf7baee4b0b8d587ae8266fa1d78511839a63e7d9fb0442040d29db",
+    "Checks/audit.py": "a1e089faf88d01651ff877580dac13d2758cd1f067cce5a5dc8b3e0c6ba77c16"
+  },
+  "modules": [
+    "NetGraphCore.lean",
+    "NetGraphCore/Apportionment/RoundRobin.lean",
+    "Checks.lean",
+    "Checks/Examples.lean",
+    "Checks/Main.lean"
+  ],
+  "pins": {
+    "lake-manifest.json": "46c58fbac02a956ef4ef542d3e40bdd1c38cbec200e441509577966f5cf30e16",
+    "lakefile.toml": "9cef8962297498de2978401676cfa6cb640c6eef403b705ba21c67215d2b5fde",
+    "lean-toolchain": "ca5f1f601d34c49079e38d7e7041eb0f2a9c227fbc1df0f404820069a052330c"
+  },
+  "schema": 1,
+  "theorems": [
+    {
+      "binding": {
+        "axioms": [
+          "Classical.choice",
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_succ": "6b1823356caa1c0d70c5a12cc072a7aa571d6a597201cec7654ac26163959b35",
+          "NetGraphCore.Apportionment.sequential": "990dc0bc227d2d11a2abebbf679aafc1e4a2acc5ae0cd2c2361d2a342406148a",
+          "NetGraphCore.Apportionment.sequential._f": "0709e65e4e8266af94d460c77935c5f42172c7f72a0336556f5300abf4b28d4c",
+          "NetGraphCore.Apportionment.sequential.match_1": "c4cfd22dd3ba33f63f8ec7346bc1921e58258965e094900c9ad0e30aa33adf6e",
+          "NetGraphCore.Apportionment.sequential_eq_roundRobin": "8c3be82f108d7caec6542ccadad33800dd84346d7170f0479dddb4a0f609ae65",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_1": "780b5c06f72403eeac317af4edfd676d169d0a737301581a5b28cf1eab138373",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_10": "f9f4ce42ccdf9635edd5004033d8bdc5431b9882052f3b8871cc923930014609",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_11": "15fc502818e4568cf53410206b5e3cc9cb2a5715a9d81fd4b918284ca8550212",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_4": "42dbc1929ce8d93917ce04c7f05003442b78d5cfc3bc089c1caba5996e9294df",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_5": "46064f3cf69d1f1a2b3ee9c7eb5bc9c62461ffcc88dd958b8feb727ef98c37cc",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_6": "e7668e8b2eb0b3a4c0628ad25dac5a0b6b13fb658c53f73a4ee2599f6696e578",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_7": "3d848f854d4eabc3c26d316c701aeb16126a01e84eae966accdfc7bbaafe7181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_8": "6486cea51fc4d24ce105eb56d4e8cd5718c67e9e4f32a1655d8982b6fdec804c",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_9": "0c0e6cf21f118ba73e99205e355ac1d1442f24f11473c0bcad8fd9a8be5ec26f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._simp_1_3": "ef44910ff7d236788555912069667d77bcc9fe7ce2aedc7a1a6e5ceaa4574796"
+        },
+        "type_sha256": "35ba6fffd546dd366925103ec80b07c0021bf65fe5484136fec0e02b32928336"
+      },
+      "claim": "The unit-by-unit circle equals the direct division formula.",
+      "declaration": "NetGraphCore.Apportionment.sequential_eq_roundRobin",
+      "domain": "Nonnegative total; positive member count; recipient index below the member count.",
+      "examples": [
+        "rr-ten",
+        "rr-zero",
+        "rr-short",
+        "rr-circle"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-001",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-001",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-001",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    },
+    {
+      "binding": {
+        "axioms": [
+          "Classical.choice",
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_mono": "d58697c4e5eddb1f32fbf5d2483003acfe0f7b40a76080cb9bdc7650f964c490",
+          "NetGraphCore.Apportionment.roundRobin_succ": "6b1823356caa1c0d70c5a12cc072a7aa571d6a597201cec7654ac26163959b35",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_1": "b5c1ba46ddbc8b13c0542a024a4d591ff90ce51745ee54c67eac7b8456b21d47",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_2": "047e4b753a0c5a810c5f70f00fbeb2321d8d965117139e99ebf582b9809146b1",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_1": "780b5c06f72403eeac317af4edfd676d169d0a737301581a5b28cf1eab138373",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_10": "f9f4ce42ccdf9635edd5004033d8bdc5431b9882052f3b8871cc923930014609",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_11": "15fc502818e4568cf53410206b5e3cc9cb2a5715a9d81fd4b918284ca8550212",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_4": "42dbc1929ce8d93917ce04c7f05003442b78d5cfc3bc089c1caba5996e9294df",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_5": "46064f3cf69d1f1a2b3ee9c7eb5bc9c62461ffcc88dd958b8feb727ef98c37cc",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_6": "e7668e8b2eb0b3a4c0628ad25dac5a0b6b13fb658c53f73a4ee2599f6696e578",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_7": "3d848f854d4eabc3c26d316c701aeb16126a01e84eae966accdfc7bbaafe7181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_8": "6486cea51fc4d24ce105eb56d4e8cd5718c67e9e4f32a1655d8982b6fdec804c",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_9": "0c0e6cf21f118ba73e99205e355ac1d1442f24f11473c0bcad8fd9a8be5ec26f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._simp_1_3": "ef44910ff7d236788555912069667d77bcc9fe7ce2aedc7a1a6e5ceaa4574796"
+        },
+        "type_sha256": "901305bb6ca743a16179b8a4d6fb27ee98229507f9201f53a799fbb4b7fc427d"
+      },
+      "claim": "Adding units never decreases a recipient share.",
+      "declaration": "NetGraphCore.Apportionment.roundRobin_mono",
+      "domain": "Nonnegative total and addition; positive fixed member count and valid recipient index.",
+      "examples": [
+        "inc-continue",
+        "inc-zero"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-002",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-002",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-002",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    },
+    {
+      "binding": {
+        "axioms": [
+          "Classical.choice",
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_conservation": "a8e2a740aafce826a542120865ed72933d2299bd85de5b3f5f3b047078212408",
+          "NetGraphCore.Apportionment.roundRobin_succ": "6b1823356caa1c0d70c5a12cc072a7aa571d6a597201cec7654ac26163959b35",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_1": "780b5c06f72403eeac317af4edfd676d169d0a737301581a5b28cf1eab138373",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_10": "f9f4ce42ccdf9635edd5004033d8bdc5431b9882052f3b8871cc923930014609",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_11": "15fc502818e4568cf53410206b5e3cc9cb2a5715a9d81fd4b918284ca8550212",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_4": "42dbc1929ce8d93917ce04c7f05003442b78d5cfc3bc089c1caba5996e9294df",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_5": "46064f3cf69d1f1a2b3ee9c7eb5bc9c62461ffcc88dd958b8feb727ef98c37cc",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_6": "e7668e8b2eb0b3a4c0628ad25dac5a0b6b13fb658c53f73a4ee2599f6696e578",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_7": "3d848f854d4eabc3c26d316c701aeb16126a01e84eae966accdfc7bbaafe7181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_8": "6486cea51fc4d24ce105eb56d4e8cd5718c67e9e4f32a1655d8982b6fdec804c",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_9": "0c0e6cf21f118ba73e99205e355ac1d1442f24f11473c0bcad8fd9a8be5ec26f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._simp_1_3": "ef44910ff7d236788555912069667d77bcc9fe7ce2aedc7a1a6e5ceaa4574796"
+        },
+        "type_sha256": "3a259d9c5d52afcb3cff79c6c0fca0fcb7f694f758808fd8914f615a4918ea6d"
+      },
+      "claim": "The sum over all valid recipient shares equals the input total.",
+      "declaration": "NetGraphCore.Apportionment.roundRobin_conservation",
+      "domain": "Nonnegative total; positive member count; sum over exactly the valid recipient indices.",
+      "examples": [
+        "rr-ten",
+        "rr-zero",
+        "rr-short"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-003",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-003",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-003",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    },
+    {
+      "binding": {
+        "axioms": [
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.increments": "0bb02814920d7c71f82b8e86bf08a47aeb4912a7727749e55ffc247d34bc579e",
+          "NetGraphCore.Apportionment.increments_eq_difference": "95a1e4b309e3af2410f06c5a774a40662eee392a4ceeb3c72956669bd20b6580",
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_periodic": "18861b48b8af2aeeb4cb5193401def6fd065763861cefb2f3fc2c197b46e7211",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_1": "90afa03d554ba0c06c708ca144a51bf32b86bb1bb49f7d4eb1f73f5ba1707116",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_2": "31412041e5648e0aa5810c9b66617f08f22f15872c9c69b69979e080f7cc2405",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_3": "e215ee348f6ee72394d21c97f32309284105d50c2ad6db8224340938c2d38f65",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_4": "74a111449c6f46e75217a604b37a67064dd543b3965e654be29582b157cac181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_5": "dea610db31b9b4bd0486ad9cbca1b5178faac44f53f847c0631cdd386855a9d4",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_periodic._proof_1_2": "1803e0e1b3807a6bc7574def5c49d448fe4fbd4fe5e6ee3ebd81c87f3954ea94"
+        },
+        "type_sha256": "a2a41386dd10fc3b9b695cd2f9cb2ce3448d902914af40b6b3942f647fa7f471"
+      },
+      "claim": "The remainder-only increment equals the difference of cumulative shares.",
+      "declaration": "NetGraphCore.Apportionment.increments_eq_difference",
+      "domain": "Nonnegative previous total, addition and recipient index; positive member count. This identity alone does not require a valid recipient index.",
+      "examples": [
+        "inc-continue",
+        "inc-zero",
+        "inc-wrap",
+        "inc-wide",
+        "inc-limit"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-004",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-004",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-004",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    },
+    {
+      "binding": {
+        "axioms": [
+          "Classical.choice",
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.increments": "0bb02814920d7c71f82b8e86bf08a47aeb4912a7727749e55ffc247d34bc579e",
+          "NetGraphCore.Apportionment.increments_bounds": "bf939c74db8afaa9569a6912675ffb5862d1ac6a2bd180fa258d89b5be12a513",
+          "NetGraphCore.Apportionment.increments_eq_difference": "95a1e4b309e3af2410f06c5a774a40662eee392a4ceeb3c72956669bd20b6580",
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_add_le": "bb14437fd83fc0377ab0a21f36d304acb08953ae48d425f0ff10618bec0b7721",
+          "NetGraphCore.Apportionment.roundRobin_mono": "d58697c4e5eddb1f32fbf5d2483003acfe0f7b40a76080cb9bdc7650f964c490",
+          "NetGraphCore.Apportionment.roundRobin_periodic": "18861b48b8af2aeeb4cb5193401def6fd065763861cefb2f3fc2c197b46e7211",
+          "NetGraphCore.Apportionment.roundRobin_succ": "6b1823356caa1c0d70c5a12cc072a7aa571d6a597201cec7654ac26163959b35",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_bounds._proof_1_1": "1e5dfefaa0b8c6103694878f55965e06875f4686a7e1406d3bd26b2573bb3b1f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_1": "90afa03d554ba0c06c708ca144a51bf32b86bb1bb49f7d4eb1f73f5ba1707116",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_2": "31412041e5648e0aa5810c9b66617f08f22f15872c9c69b69979e080f7cc2405",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_3": "e215ee348f6ee72394d21c97f32309284105d50c2ad6db8224340938c2d38f65",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_4": "74a111449c6f46e75217a604b37a67064dd543b3965e654be29582b157cac181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_5": "dea610db31b9b4bd0486ad9cbca1b5178faac44f53f847c0631cdd386855a9d4",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_1": "07e35fee1e85c51ecda9e82861dab0d2f1bbf08d4f131551c1e16212a04af3c9",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_2": "5b9e706a14a8a61631e1ad32391c6e9fbe8b676fa6cb942a68b2231063f5fa10",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_3": "42d22dd170abb7fc328a0a3a70950d7f67c199b785287c1b707f2c44dc8f79f4",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_1": "b5c1ba46ddbc8b13c0542a024a4d591ff90ce51745ee54c67eac7b8456b21d47",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_2": "047e4b753a0c5a810c5f70f00fbeb2321d8d965117139e99ebf582b9809146b1",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_periodic._proof_1_2": "1803e0e1b3807a6bc7574def5c49d448fe4fbd4fe5e6ee3ebd81c87f3954ea94",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_1": "780b5c06f72403eeac317af4edfd676d169d0a737301581a5b28cf1eab138373",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_10": "f9f4ce42ccdf9635edd5004033d8bdc5431b9882052f3b8871cc923930014609",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_11": "15fc502818e4568cf53410206b5e3cc9cb2a5715a9d81fd4b918284ca8550212",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_4": "42dbc1929ce8d93917ce04c7f05003442b78d5cfc3bc089c1caba5996e9294df",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_5": "46064f3cf69d1f1a2b3ee9c7eb5bc9c62461ffcc88dd958b8feb727ef98c37cc",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_6": "e7668e8b2eb0b3a4c0628ad25dac5a0b6b13fb658c53f73a4ee2599f6696e578",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_7": "3d848f854d4eabc3c26d316c701aeb16126a01e84eae966accdfc7bbaafe7181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_8": "6486cea51fc4d24ce105eb56d4e8cd5718c67e9e4f32a1655d8982b6fdec804c",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_9": "0c0e6cf21f118ba73e99205e355ac1d1442f24f11473c0bcad8fd9a8be5ec26f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._simp_1_3": "ef44910ff7d236788555912069667d77bcc9fe7ce2aedc7a1a6e5ceaa4574796"
+        },
+        "type_sha256": "e71c526aa3664b8a18209b6e5674c0fee8ea74f1381c92a3a277a653da9e4e91"
+      },
+      "claim": "A valid recipient increment is nonnegative and at most the added offer.",
+      "declaration": "NetGraphCore.Apportionment.increments_bounds",
+      "domain": "Nonnegative previous total and addition; positive fixed member count and valid recipient index.",
+      "examples": [
+        "inc-wrap",
+        "inc-zero"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-005",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-005",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-005",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    },
+    {
+      "binding": {
+        "axioms": [
+          "Classical.choice",
+          "Quot.sound",
+          "propext"
+        ],
+        "local_closure": {
+          "NetGraphCore.Apportionment.amountLimit": "2861fe4aa660d49998c59e11ec15641d72a372cdfed34a39de4592feca784577",
+          "NetGraphCore.Apportionment.increments": "0bb02814920d7c71f82b8e86bf08a47aeb4912a7727749e55ffc247d34bc579e",
+          "NetGraphCore.Apportionment.increments_bounds": "bf939c74db8afaa9569a6912675ffb5862d1ac6a2bd180fa258d89b5be12a513",
+          "NetGraphCore.Apportionment.increments_eq_difference": "95a1e4b309e3af2410f06c5a774a40662eee392a4ceeb3c72956669bd20b6580",
+          "NetGraphCore.Apportionment.native_increment_bounds": "c5e069e7693881f890a82290542a6c08ca87fd3e04ba9c332208ebd1e7e0f80f",
+          "NetGraphCore.Apportionment.roundRobin": "dc749bd9bd63572c3386bec4e1714076996a3bb4593ad8112c20b9d06c450da9",
+          "NetGraphCore.Apportionment.roundRobin_add_le": "bb14437fd83fc0377ab0a21f36d304acb08953ae48d425f0ff10618bec0b7721",
+          "NetGraphCore.Apportionment.roundRobin_mono": "d58697c4e5eddb1f32fbf5d2483003acfe0f7b40a76080cb9bdc7650f964c490",
+          "NetGraphCore.Apportionment.roundRobin_periodic": "18861b48b8af2aeeb4cb5193401def6fd065763861cefb2f3fc2c197b46e7211",
+          "NetGraphCore.Apportionment.roundRobin_succ": "6b1823356caa1c0d70c5a12cc072a7aa571d6a597201cec7654ac26163959b35",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_bounds._proof_1_1": "1e5dfefaa0b8c6103694878f55965e06875f4686a7e1406d3bd26b2573bb3b1f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_1": "90afa03d554ba0c06c708ca144a51bf32b86bb1bb49f7d4eb1f73f5ba1707116",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_2": "31412041e5648e0aa5810c9b66617f08f22f15872c9c69b69979e080f7cc2405",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_3": "e215ee348f6ee72394d21c97f32309284105d50c2ad6db8224340938c2d38f65",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_4": "74a111449c6f46e75217a604b37a67064dd543b3965e654be29582b157cac181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.increments_eq_difference._proof_1_5": "dea610db31b9b4bd0486ad9cbca1b5178faac44f53f847c0631cdd386855a9d4",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.native_increment_bounds._proof_1_2": "c0f4cda41d1434e6c814e0954851eec47fc1de51da2ff222df9b261ecda3ec9a",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_1": "07e35fee1e85c51ecda9e82861dab0d2f1bbf08d4f131551c1e16212a04af3c9",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_2": "5b9e706a14a8a61631e1ad32391c6e9fbe8b676fa6cb942a68b2231063f5fa10",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_add_le._proof_1_3": "42d22dd170abb7fc328a0a3a70950d7f67c199b785287c1b707f2c44dc8f79f4",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_1": "b5c1ba46ddbc8b13c0542a024a4d591ff90ce51745ee54c67eac7b8456b21d47",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_mono._proof_1_2": "047e4b753a0c5a810c5f70f00fbeb2321d8d965117139e99ebf582b9809146b1",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_periodic._proof_1_2": "1803e0e1b3807a6bc7574def5c49d448fe4fbd4fe5e6ee3ebd81c87f3954ea94",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_1": "780b5c06f72403eeac317af4edfd676d169d0a737301581a5b28cf1eab138373",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_10": "f9f4ce42ccdf9635edd5004033d8bdc5431b9882052f3b8871cc923930014609",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_11": "15fc502818e4568cf53410206b5e3cc9cb2a5715a9d81fd4b918284ca8550212",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_4": "42dbc1929ce8d93917ce04c7f05003442b78d5cfc3bc089c1caba5996e9294df",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_5": "46064f3cf69d1f1a2b3ee9c7eb5bc9c62461ffcc88dd958b8feb727ef98c37cc",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_6": "e7668e8b2eb0b3a4c0628ad25dac5a0b6b13fb658c53f73a4ee2599f6696e578",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_7": "3d848f854d4eabc3c26d316c701aeb16126a01e84eae966accdfc7bbaafe7181",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_8": "6486cea51fc4d24ce105eb56d4e8cd5718c67e9e4f32a1655d8982b6fdec804c",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._proof_1_9": "0c0e6cf21f118ba73e99205e355ac1d1442f24f11473c0bcad8fd9a8be5ec26f",
+          "_private.NetGraphCore.Apportionment.RoundRobin.0.NetGraphCore.Apportionment.roundRobin_succ._simp_1_3": "ef44910ff7d236788555912069667d77bcc9fe7ce2aedc7a1a6e5ceaa4574796"
+        },
+        "type_sha256": "6e9ef2e07a5ec58cee900fe9a7b58bc307f54764cdd21bc6cdff40a462687997"
+      },
+      "claim": "The remainder-plus-offer intermediate and final increment fit the stated amount bounds.",
+      "declaration": "NetGraphCore.Apportionment.native_increment_bounds",
+      "domain": "Positive member count below 2^31; valid recipient index; nonnegative offer below 2^62; unrestricted nonnegative previous total. No mod_u128 refinement is asserted.",
+      "examples": [
+        "inc-wrap",
+        "inc-limit"
+      ],
+      "explanation": {
+        "anchor": "NGC-AP-006",
+        "file": "docs/formal/theorems/round-robin.md"
+      },
+      "id": "NGC-AP-006",
+      "implementation": {
+        "bridge": "round-robin",
+        "sources": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "status": "tested"
+      },
+      "mapped_inputs": {
+        "explanation": {
+          "anchor": "NGC-AP-006",
+          "file": "docs/formal/theorems/round-robin.md"
+        },
+        "implementation": [
+          {
+            "file": "include/netgraph/core/detail/route_kernels.hpp",
+            "sha256": "c44e37d755d80182b074e6a34179e8aa5b172a9c94b4931ce4f69a67be636224",
+            "symbols": [
+              "round_robin_share",
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/route_kernels.cpp",
+            "sha256": "00d5cc2df8dbe2f831dc9b7a01c0bf900ca65f2f08617447d8af8b242ade46db",
+            "symbols": [
+              "round_robin_increments"
+            ]
+          },
+          {
+            "file": "src/forwarding.cpp",
+            "sha256": "2428b4dadaec9c3acd0fe3f9b87520ec1a0e46751e5271f999d211a4e514f592",
+            "symbols": [
+              "source_offer_increments"
+            ]
+          },
+          {
+            "file": "include/netgraph/core/types.hpp",
+            "sha256": "9d4cc4c6055dea36e3cb28cd8167ed996c0ae3c081746d4d77c5309de11f7823",
+            "symbols": [
+              "kDomainLimit"
+            ]
+          }
+        ],
+        "semantics": [
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Splitting whole units"
+          },
+          {
+            "file": "docs/semantics.md",
+            "heading": "### Epochs"
+          }
+        ]
+      },
+      "module": "NetGraphCore.Apportionment.RoundRobin",
+      "semantics": [
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Splitting whole units"
+        },
+        {
+          "file": "docs/semantics.md",
+          "heading": "### Epochs"
+        }
+      ]
+    }
+  ]
+}
diff --git a/pyproject.toml b/pyproject.toml
index 82f3e35..f1f6416 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,14 +1,19 @@
 [build-system]
-requires = ["scikit-build-core>=0.10", "pybind11>=3", "numpy>=1.23.2"]
+# scikit-build-core 1.0 introduced the "explicit" sdist file selection used below. pybind11 is
+# pinned: the wheel ships its licence notice (third_party/pybind11/LICENSE, this version's) and
+# CMakeLists.txt requires the same version. NumPy is a run-time dependency only.
+requires = ["scikit-build-core>=1.0", "pybind11==3.1.0"]
 build-backend = "scikit_build_core.build"
 
 [project]
 name = "netgraph-core"
-version = "0.11.0"
+version = "0.12.0"
 description = "C++ implementation of graph algorithms for network flow analysis and traffic engineering with Python bindings"
 readme = "README.md"
 requires-python = ">=3.11"
 license = "MIT"
+# The wheel contains compiled pybind11 code, whose BSD-3-Clause licence asks for its notice.
+license-files = ["LICENSE", "third_party/pybind11/LICENSE"]
 authors = [{ name = "Project Contributors" }]
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -31,11 +36,11 @@ dependencies = ["numpy>=1.23.2"]
 [project.optional-dependencies]
 dev = [
     "pytest>=8",
-    "pytest-cov",
-    "pytest-benchmark",
-    "gcovr>=7",
     "ruff==0.11.13",
     "pyright==1.1.401",
+    # Generates python/netgraph_core/__init__.pyi (bash dev/stubs/run.sh generate); a new
+    # version can change the generated text, so it is pinned and updated deliberately.
+    "pybind11-stubgen==3.0.0",
     "pre-commit",
     "build",
     "twine",
@@ -50,17 +55,78 @@ Homepage = "https://github.com/networmix/NetGraph-Core"
 wheel.expand-macos-universal-tags = true
 build-dir = "build/{wheel_tag}"
 cmake.version = ">=3.23"
-# Developer tooling and research records are not part of the distribution.
-sdist.exclude = ["dev/"]
-# Include Python sources from the "python/" directory
+# The sdist holds exactly the files listed here ("explicit": nothing outside them is taken, so a
+# local file elsewhere in the checkout never ships): the build's sources, the package, the tests
+# with their data, the documents, the Lean proofs and the licence notices. Left out: the
+# developer tooling (dev/), the entrypoints that only run it (the Makefile, the CI workflows, the
+# pre-commit configuration), the agent/workspace configuration, Lake's downloaded dependencies and
+# build products (proofs/.lake/), and the frozen reference that regenerates
+# tests/data/policy_fixtures.json (tests/reference/, see its README; no test reads it). Release
+# CI runs the same commit's tests from its checkout against an installation built from the
+# sdist. This mode does not read .gitignore, so the local by-products it names that appear
+# inside the listed directories (Python caches, compiled modules, Finder files, the backup and
+# reject files of `patch`) are excluded here. The wheel takes its package files
+# (python/netgraph_core) by the same rule.
+# dev/stubs/check_contents.py repeats the list and refuses any other file, and any file git
+# ignores.
+sdist.inclusion-mode = "explicit"
+sdist.include = [
+    "/.coveragerc",
+    "/.gitignore",
+    "/CHANGELOG.md",
+    "/CMakeLists.txt",
+    "/CONTRIBUTING.md",
+    "/LICENSE",
+    "/README.md",
+    "/pyproject.toml",
+    "/bindings/",
+    "/docs/",
+    "/include/",
+    "/proofs/",
+    "/python/",
+    "/src/",
+    "/tests/",
+    "/third_party/",
+]
+sdist.exclude = [
+    "/tests/reference/",
+    "/proofs/.lake/",
+    "__pycache__/",
+    "*.py[codz]",
+    "*.so",
+    ".DS_Store",
+    "*.orig",
+    "*.rej",
+]
+# The package directory ships whole: __init__.py, the generated type stub __init__.pyi and the
+# py.typed marker (dev/stubs/run.sh check lists the wheel and the sdist and requires them).
 wheel.packages = ["python/netgraph_core"]
 
+# Every project option is stated for every build: the build directory above is shared, CMake keeps
+# an option's cached value when a later configure does not name it, and so a coverage, native or
+# hooks setting of one build would otherwise leak into the next. A variant overrides one value on
+# the command line (`pip install -C cmake.define.NETGRAPH_CORE_NATIVE=ON ...`, see the Makefile).
 [tool.scikit-build.cmake.define]
-# No optional backends yet; defaults are built-in CPU-only
+NETGRAPH_CORE_PRIVATE_HOOKS = "OFF"
+NETGRAPH_CORE_BUILD_TESTS = "OFF"
+NETGRAPH_CORE_COVERAGE = "OFF"
+NETGRAPH_CORE_SANITIZE = "OFF"
+NETGRAPH_CORE_TSAN = "OFF"
+NETGRAPH_CORE_NATIVE = "OFF"
+
+[[tool.scikit-build.overrides]]
+# The editable development build carries the private test hooks (CMake option
+# NETGRAPH_CORE_PRIVATE_HOOKS); a wheel or sdist build does not. "append": the override changes
+# this one value and keeps the other explicit defaults above (it would otherwise replace them).
+if.state = "^editable$"
+inherit.cmake.define = "append"
+cmake.define.NETGRAPH_CORE_PRIVATE_HOOKS = "ON"
 
 [tool.pytest.ini_options]
 addopts = "-q"
-markers = ["slow: marks tests as slow (deselect with '-m \"not slow\"')"]
+# pytest without arguments collects the repository tests only, not the timing tool's own tests
+# (dev/perf/test_tool.py, run by make perf-tool-test).
+testpaths = ["tests"]
 
 [tool.ruff]
 line-length = 88
@@ -87,10 +153,8 @@ exclude = [
     "build/**",
     "dist/**",
     "dev/**",
+    "proofs/.lake/**",
     "**/__pycache__/**",
     "**/*.egg-info/**",
 ]
 reportMissingTypeStubs = "warning"
-reportUnknownMemberType = "none"
-reportUnknownVariableType = "none"
-reportUnknownArgumentType = "none"
diff --git a/python/netgraph_core/__init__.py b/python/netgraph_core/__init__.py
index 3bb8a27..0818657 100644
--- a/python/netgraph_core/__init__.py
+++ b/python/netgraph_core/__init__.py
@@ -1,86 +1,153 @@
-"""Runtime package surface for :mod:`netgraph_core`.
+"""NetGraph-Core: graph, flow and placement models on exact integer units.
 
-All public symbols are re-exported from the compiled ``_netgraph_core`` module so
-downstream users import everything from a single place. Typing shims supplied in
-``_docs.py`` keep editors happy without affecting runtime behavior.
-"""
+Every public name is re-exported from the compiled ``_netgraph_core`` module, so users
+import everything from here. Type checkers read the generated stub ``__init__.pyi`` next
+to this file (``py.typed`` marks the package as typed).
+
+- The graph on integer units: ``Graph``, ``Eligibility``, ``to_units``, ``as_float``.
+- Route structures: ``PredecessorDAG``, ``Path``.
+- Route choice and placement settings: ``RouteTieBreak``, ``RouteAllocation``, ``Admission``,
+  ``SourceAllocation``, ``WeightBasis``.
+- The ledger of placed traffic: ``FlowLedger`` and its ``FlowRecord`` snapshots.
+- Forwarding programs: ``ForwardingProgram`` (with its ``Tunnel`` entries,
+  ``ForwardingProgram.from_routes`` over ``RouteDefinition`` values and
+  ``ForwardingProgram.from_dag``), ``TunnelStatus``.
+- The policy engine: ``FlowPolicy``, ``FlowPolicyConfig``, the routings ``ShortestPaths``,
+  ``DistributedTE`` (T1, with ``TunnelCount``), ``CentralizedTE`` (with ``tunnel_count``: T2), ``Pinned``, and
+  ``PlacementResult`` (with its ``SourceFlow`` and ``TunnelFlow`` rows and its ``TunnelPlan``),
+  ``OutputOptions``, ``Termination``.
+- Several policies in one operation: ``apply_actions`` over ``Place``, ``Replace`` and ``Forward``
+  actions, in a ``BatchMode`` (ORDERED or SIMULTANEOUS).
+- The shortest-path cache: ``ShortestPathCache`` (building and frozen modes), ``ShortestPathCacheMiss``.
+- The evaluators: ``evaluate_demand``, ``evaluate_pairs``, ``evaluate_edge_failures``.
+- The searches: ``spf`` (``Direction``, ``SpfOptions``, ``SpfResult``, ``UNREACHABLE``),
+  ``ksp`` (``KspOptions``), ``resolve_to_paths``.
 
-# pyright: reportMissingImports=false
+Every public call either completes or raises and leaves the library's state as it was, with two
+limits: (1) pybind11 does not check every allocation when it constructs a bound object from
+Python, parses the arguments of a call that passes keywords, or converts an attribute or a
+returned value into a new Python object outside the library's checked result construction;
+running out of memory exactly there may crash the process, with the library's state unchanged.
+(2) A ``ShortestPathCache`` passed to the call: a building one keeps the complete entries and
+statistics of the lookups that succeeded before the call failed; a frozen one counts one miss
+when the call raised ``ShortestPathCacheMiss``. docs/semantics.md states every rule exactly.
+"""
 
-from importlib.metadata import version
-from typing import TYPE_CHECKING
+from importlib.metadata import version as _version
 
 from _netgraph_core import (
-    Algorithms,
-    Backend,
-    EdgeSelection,
-    EdgeTieBreak,
-    FlowGraph,
-    FlowIndex,
-    FlowPlacement,
+    UNREACHABLE,
+    AbsoluteCost,
+    Admission,
+    BatchMode,
+    CentralizedTE,
+    CostStretch,
+    Direction,
+    DistributedTE,
+    Eligibility,
+    EvaluationOptions,
+    FlowLedger,
     FlowPolicy,
     FlowPolicyConfig,
-    FlowState,
-    FlowSummary,
+    FlowRecord,
+    Forward,
+    ForwardingProgram,
     Graph,
-    MinCut,
-    PathAlg,
-    PredDAG,
-    StrictMultiDiGraph,
-    profiling_dump,
-    profiling_enabled,
-    profiling_reset,
+    KspOptions,
+    OutputOptions,
+    Path,
+    Pinned,
+    Place,
+    PlacementResult,
+    PredecessorDAG,
+    Replace,
+    RouteAllocation,
+    RouteDefinition,
+    RouteTieBreak,
+    SensitivityEntry,
+    SensitivityResult,
+    ShortestPathCache,
+    ShortestPathCacheMiss,
+    ShortestPathCacheStats,
+    ShortestPaths,
+    SourceAllocation,
+    SourceFlow,
+    SpfOptions,
+    SpfResult,
+    Termination,
+    Tunnel,
+    TunnelCount,
+    TunnelFlow,
+    TunnelPlan,
+    TunnelStatus,
+    WeightBasis,
+    apply_actions,
+    as_float,
+    evaluate_demand,
+    evaluate_edge_failures,
+    evaluate_pairs,
+    ksp,
+    resolve_to_paths,
+    spf,
+    to_units,
 )
 
-__version__ = version("netgraph-core")
-
-# Provide richer type information for editors/type-checkers without affecting runtime.
-# Every name here must also appear in the runtime import above; the aliases only
-# change what a type checker sees. Keep this list in sync with _docs.py, and keep
-# _docs.py in sync with the bindings -- a wrong stub is worse than a missing one,
-# because it turns "unchecked" into "confidently wrong".
-if TYPE_CHECKING:  # pragma: no cover - typing-only
-    from ._docs import (  # noqa: I001
-        Algorithms as Algorithms,
-        Backend as Backend,
-        EdgeSelection as EdgeSelection,
-        EdgeTieBreak as EdgeTieBreak,
-        FlowGraph as FlowGraph,
-        FlowIndex as FlowIndex,
-        FlowPlacement as FlowPlacement,
-        FlowPolicy as FlowPolicy,
-        FlowPolicyConfig as FlowPolicyConfig,
-        FlowState as FlowState,
-        FlowSummary as FlowSummary,
-        Graph as Graph,
-        MinCut as MinCut,
-        PathAlg as PathAlg,
-        PredDAG as PredDAG,
-        StrictMultiDiGraph as StrictMultiDiGraph,
-        profiling_dump as profiling_dump,
-        profiling_enabled as profiling_enabled,
-        profiling_reset as profiling_reset,
-    )
+__version__ = _version("netgraph-core")
 
 __all__ = [
     "__version__",
-    "StrictMultiDiGraph",
-    "FlowGraph",
     "Graph",
-    "EdgeSelection",
-    "EdgeTieBreak",
-    "PathAlg",
-    "FlowPlacement",
-    "FlowPolicy",
+    "Eligibility",
+    "to_units",
+    "as_float",
+    "PredecessorDAG",
+    "Path",
+    "RouteTieBreak",
+    "RouteAllocation",
+    "Admission",
+    "SourceAllocation",
+    "WeightBasis",
+    "FlowLedger",
+    "FlowRecord",
+    "TunnelStatus",
+    "Tunnel",
+    "RouteDefinition",
+    "ForwardingProgram",
+    "AbsoluteCost",
+    "CostStretch",
+    "TunnelCount",
+    "ShortestPaths",
+    "DistributedTE",
+    "CentralizedTE",
+    "Pinned",
     "FlowPolicyConfig",
-    "PredDAG",
-    "FlowIndex",
-    "FlowState",
-    "MinCut",
-    "FlowSummary",
-    "Backend",
-    "Algorithms",
-    "profiling_enabled",
-    "profiling_dump",
-    "profiling_reset",
+    "OutputOptions",
+    "Termination",
+    "PlacementResult",
+    "SourceFlow",
+    "TunnelFlow",
+    "TunnelPlan",
+    "FlowPolicy",
+    "Place",
+    "Replace",
+    "Forward",
+    "BatchMode",
+    "apply_actions",
+    "ShortestPathCache",
+    "ShortestPathCacheMiss",
+    "ShortestPathCacheStats",
+    "EvaluationOptions",
+    "SensitivityEntry",
+    "SensitivityResult",
+    "evaluate_demand",
+    "evaluate_pairs",
+    "evaluate_edge_failures",
+    "Direction",
+    "SpfOptions",
+    "SpfResult",
+    "UNREACHABLE",
+    "spf",
+    "KspOptions",
+    "ksp",
+    "resolve_to_paths",
 ]
diff --git a/python/netgraph_core/__init__.pyi b/python/netgraph_core/__init__.pyi
new file mode 100644
index 0000000..72b4b7c
--- /dev/null
+++ b/python/netgraph_core/__init__.pyi
@@ -0,0 +1,2902 @@
+# Generated from the compiled module; do not edit.
+"""NetGraph-Core: graph, flow and placement models on exact integer units.
+
+Every public name is re-exported from the compiled ``_netgraph_core`` module, so users
+import everything from here. Type checkers read the generated stub ``__init__.pyi`` next
+to this file (``py.typed`` marks the package as typed).
+
+- The graph on integer units: ``Graph``, ``Eligibility``, ``to_units``, ``as_float``.
+- Route structures: ``PredecessorDAG``, ``Path``.
+- Route choice and placement settings: ``RouteTieBreak``, ``RouteAllocation``, ``Admission``,
+  ``SourceAllocation``, ``WeightBasis``.
+- The ledger of placed traffic: ``FlowLedger`` and its ``FlowRecord`` snapshots.
+- Forwarding programs: ``ForwardingProgram`` (with its ``Tunnel`` entries,
+  ``ForwardingProgram.from_routes`` over ``RouteDefinition`` values and
+  ``ForwardingProgram.from_dag``), ``TunnelStatus``.
+- The policy engine: ``FlowPolicy``, ``FlowPolicyConfig``, the routings ``ShortestPaths``,
+  ``DistributedTE`` (T1, with ``TunnelCount``), ``CentralizedTE`` (with ``tunnel_count``: T2), ``Pinned``, and
+  ``PlacementResult`` (with its ``SourceFlow`` and ``TunnelFlow`` rows and its ``TunnelPlan``),
+  ``OutputOptions``, ``Termination``.
+- Several policies in one operation: ``apply_actions`` over ``Place``, ``Replace`` and ``Forward``
+  actions, in a ``BatchMode`` (ORDERED or SIMULTANEOUS).
+- The shortest-path cache: ``ShortestPathCache`` (building and frozen modes), ``ShortestPathCacheMiss``.
+- The evaluators: ``evaluate_demand``, ``evaluate_pairs``, ``evaluate_edge_failures``.
+- The searches: ``spf`` (``Direction``, ``SpfOptions``, ``SpfResult``, ``UNREACHABLE``),
+  ``ksp`` (``KspOptions``), ``resolve_to_paths``.
+
+Every public call either completes or raises and leaves the library's state as it was, with two
+limits: (1) pybind11 does not check every allocation when it constructs a bound object from
+Python, parses the arguments of a call that passes keywords, or converts an attribute or a
+returned value into a new Python object outside the library's checked result construction;
+running out of memory exactly there may crash the process, with the library's state unchanged.
+(2) A ``ShortestPathCache`` passed to the call: a building one keeps the complete entries and
+statistics of the lookups that succeeded before the call failed; a frozen one counts one miss
+when the call raised ``ShortestPathCacheMiss``. docs/semantics.md states every rule exactly."""
+
+from __future__ import annotations
+
+import collections.abc
+import fractions
+import typing
+
+import numpy
+import numpy.typing
+
+__all__: list[str] = [
+    "__version__",
+    "Graph",
+    "Eligibility",
+    "to_units",
+    "as_float",
+    "PredecessorDAG",
+    "Path",
+    "RouteTieBreak",
+    "RouteAllocation",
+    "Admission",
+    "SourceAllocation",
+    "WeightBasis",
+    "FlowLedger",
+    "FlowRecord",
+    "TunnelStatus",
+    "Tunnel",
+    "RouteDefinition",
+    "ForwardingProgram",
+    "AbsoluteCost",
+    "CostStretch",
+    "TunnelCount",
+    "ShortestPaths",
+    "DistributedTE",
+    "CentralizedTE",
+    "Pinned",
+    "FlowPolicyConfig",
+    "OutputOptions",
+    "Termination",
+    "PlacementResult",
+    "SourceFlow",
+    "TunnelFlow",
+    "TunnelPlan",
+    "FlowPolicy",
+    "Place",
+    "Replace",
+    "Forward",
+    "BatchMode",
+    "apply_actions",
+    "ShortestPathCache",
+    "ShortestPathCacheMiss",
+    "ShortestPathCacheStats",
+    "EvaluationOptions",
+    "SensitivityEntry",
+    "SensitivityResult",
+    "evaluate_demand",
+    "evaluate_pairs",
+    "evaluate_edge_failures",
+    "Direction",
+    "SpfOptions",
+    "SpfResult",
+    "UNREACHABLE",
+    "spf",
+    "KspOptions",
+    "ksp",
+    "resolve_to_paths",
+]
+__version__: str
+
+class RouteAllocation:
+    """
+    How a demand's traffic is split at every router of its routes (ShortestPaths; also the interior split
+    of supplied PredecessorDAG routes, EQUAL or WEIGHTED).
+    OPTIMIZED: the minimum-cost flow core over the routes (a controller restricted to them), re-solved
+    over the free capacity plus the policy's own allocation (it may move its own earlier placement,
+    never another's). WEIGHTED (WCMP, weighted-cost multipath): every node splits in proportion to
+    weights fixed when the routes are prepared (highest averages (D'Hondt): assign each next unit
+    to the largest weight / (assigned + 1), ties to the lower EdgeId; the weights come from
+    WeightBasis). EQUAL (ECMP, equal-cost
+    multipath): every node splits equally, by round robin.
+
+    Members:
+
+      EQUAL
+
+      WEIGHTED
+
+      OPTIMIZED
+    """
+
+    EQUAL: typing.ClassVar[RouteAllocation]
+    OPTIMIZED: typing.ClassVar[RouteAllocation]
+    WEIGHTED: typing.ClassVar[RouteAllocation]
+    __members__: typing.ClassVar[dict[str, RouteAllocation]]
+
+    @typing.overload
+    def __eq__(self, other: RouteAllocation, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: RouteAllocation, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class Admission:
+    """
+    LOSSLESS admits the largest total the routes carry with no loss at all; LOSSY sends the whole
+    finite offer hop by hop and records where it is lost (every model except the optimizing ones:
+    ShortestPaths OPTIMIZED and CentralizedTE without tunnel_count).
+
+    Members:
+
+      LOSSLESS
+
+      LOSSY
+    """
+
+    LOSSLESS: typing.ClassVar[Admission]
+    LOSSY: typing.ClassVar[Admission]
+    __members__: typing.ClassVar[dict[str, Admission]]
+
+    @typing.overload
+    def __eq__(self, other: Admission, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: Admission, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class SourceAllocation:
+    """
+    How a demand's traffic enters at its sources, separately from how it is routed. EQUAL: round
+    robin over the roster (ascending NodeId, the first sources one unit more); a source whose share
+    cannot go anywhere keeps it and loses it (LOSSLESS then admits only totals that give it
+    nothing). OPTIMIZED: the controller chooses the injections (one virtual source). WEIGHTED:
+    CentralizedTE without tunnels prescribes highest-averages shares of declared source_weights.
+
+    Members:
+
+      EQUAL
+
+      OPTIMIZED
+
+      WEIGHTED
+    """
+
+    EQUAL: typing.ClassVar[SourceAllocation]
+    OPTIMIZED: typing.ClassVar[SourceAllocation]
+    WEIGHTED: typing.ClassVar[SourceAllocation]
+    __members__: typing.ClassVar[dict[str, SourceAllocation]]
+
+    @typing.overload
+    def __eq__(self, other: SourceAllocation, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: SourceAllocation, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class WeightBasis:
+    """
+    Where WEIGHTED member weights come from (ShortestPaths WEIGHTED and supplied PredecessorDAG routes).
+    CAPACITY (the default): each member's static capacity. EXPLICIT: edge_weights, one integer per
+    edge (a positive weight on an edge of capacity 0 becomes 0). RESIDUAL_SNAPSHOT: each member's free
+    capacity read once when the routes are prepared, against one common view, and frozen for the
+    epoch. A member of weight 0 is pruned with the branches it leaves without a destination, inside
+    the route only. The tie rule never chooses weights.
+
+    Members:
+
+      CAPACITY
+
+      EXPLICIT
+
+      RESIDUAL_SNAPSHOT
+    """
+
+    CAPACITY: typing.ClassVar[WeightBasis]
+    EXPLICIT: typing.ClassVar[WeightBasis]
+    RESIDUAL_SNAPSHOT: typing.ClassVar[WeightBasis]
+    __members__: typing.ClassVar[dict[str, WeightBasis]]
+
+    @typing.overload
+    def __eq__(self, other: WeightBasis, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: WeightBasis, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class RouteTieBreak:
+    """
+    How a route choice breaks a cost tie; cost always comes first. FEWER_HOPS: then fewer hops,
+    then the smaller EdgeId sequence. HIGHER_CAPACITY / HIGHER_AVAILABLE_CAPACITY /
+    HIGHER_HEADROOM: then the larger path bottleneck of static capacity / availability /
+    availability over static capacity (exact; 0 at static capacity 0), then fewer hops, then the
+    EdgeId sequence. Availability: unreserved bandwidth for DistributedTE, the service view for
+    ShortestPaths, the residual for spf and ksp, static capacity without one. The same order
+    keeps one of each (u, v) pair's parallel edges when parallel_edges is False. It never
+    supplies weights and never enables a controller objective.
+
+    Members:
+
+      FEWER_HOPS
+
+      HIGHER_CAPACITY
+
+      HIGHER_AVAILABLE_CAPACITY
+
+      HIGHER_HEADROOM
+    """
+
+    FEWER_HOPS: typing.ClassVar[RouteTieBreak]
+    HIGHER_AVAILABLE_CAPACITY: typing.ClassVar[RouteTieBreak]
+    HIGHER_CAPACITY: typing.ClassVar[RouteTieBreak]
+    HIGHER_HEADROOM: typing.ClassVar[RouteTieBreak]
+    __members__: typing.ClassVar[dict[str, RouteTieBreak]]
+
+    @typing.overload
+    def __eq__(self, other: RouteTieBreak, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: RouteTieBreak, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class Direction:
+    """
+    The orientation of a search: FORWARD from the roots along the edges, or REVERSE toward the roots
+    against the edges (the DAG it returns keeps the edges' own direction, so its walks lead to the
+    roots).
+
+    Members:
+
+      FORWARD
+
+      REVERSE
+    """
+
+    FORWARD: typing.ClassVar[Direction]
+    REVERSE: typing.ClassVar[Direction]
+    __members__: typing.ClassVar[dict[str, Direction]]
+
+    @typing.overload
+    def __eq__(self, other: Direction, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: Direction, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class Eligibility:
+    """
+    Which nodes and edges of one graph may be used: one flag per node and per edge, fixed when built
+    (it does not depend on traffic). Built by Graph.eligibility(excluded_nodes, excluded_edges) and
+    Eligibility.intersect.
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @staticmethod
+    def intersect(a: Eligibility, b: Eligibility) -> Eligibility:
+        """
+        The intersection of two values of one graph (ValueError for values of different graphs):
+        an operand itself when the result equals it (a first, then b), otherwise a new value with a
+        fresh uid; equal intersections built separately get distinct uids.
+        """
+
+    def edge_allowed(self) -> numpy.typing.NDArray[numpy.bool_]:
+        """
+        bool[E] read-only view (not excluded and both endpoints allowed)
+        """
+
+    def graph_uid(self) -> int:
+        """
+        uid of the graph this value belongs to
+        """
+
+    def node_allowed(self) -> numpy.typing.NDArray[numpy.bool_]:
+        """
+        bool[N] read-only view
+        """
+
+    def uid(self) -> int:
+        """
+        0 for the all-allowed value, a fresh uid otherwise
+        """
+
+class Graph:
+    """
+    Immutable directed multigraph on integer units (parallel edges and self-loops allowed). Edges are
+    given in input order and numbered by sorting on (source, cost, destination), ties kept in input
+    order: that number is the public EdgeId. input_positions()[e] is the input position of edge e.
+    Per-edge values use EdgeId order; incoming_edges() instead lists EdgeIds in incoming-slot order.
+    Costs are positive integers; capacities are int64 units of the explicit resolution q (a power of
+    two in [2^-32, 2^32]); physical capacities enter through to_units.
+    """
+
+    def __init__(
+        self,
+        num_nodes: typing.SupportsIndex,
+        edge_sources: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_destinations: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_capacity_units: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        edge_costs: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        resolution: int | float | numpy.integer | numpy.floating,
+    ) -> None:
+        """
+        Validates, in order, and reports the first defect: the resolution (a power of two in
+        [2^-32, 2^32]; a bool is a TypeError), the unit values (every capacity in [0, 2^62)), the array
+        shapes, zero or negative costs, the remaining bounds (endpoints in range, then the capacity
+        and cost sums below 2^62); a value of a wrong type (a bool or a float for an integer, a
+        non-sequence, an array of another rank or dtype) raises TypeError, a value outside its domain
+        ValueError. Integers are read without narrowing, so the error does not depend on how the
+        input is represented.
+        """
+
+    def edge_capacity_units(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] capacities in units, id order (read-only view)
+        """
+
+    def edge_cost_gcd(self) -> int:
+        """
+        gcd of the edge costs (0 without edges)
+        """
+
+    def edge_costs(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] costs, id order (read-only view)
+        """
+
+    def edge_destinations(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[E] destination node per edge (read-only view)
+        """
+
+    def edge_sources(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[E] source node per edge (read-only view)
+        """
+
+    def eligibility(
+        self,
+        excluded_nodes: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer] = (),
+        excluded_edges: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer] = (),
+    ) -> Eligibility:
+        """
+        Static eligibility from excluded node ids and EdgeIds (duplicates and unsorted lists
+        accepted, out-of-range ids rejected); an edge is allowed when it is not excluded and
+        both endpoints are allowed. Empty lists mean all allowed (uid 0).
+        """
+
+    def incoming_edges(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[E]: the in-edges of v in (cost, source, input) order, as EdgeIds
+        """
+
+    def incoming_offsets(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[N + 1]: the in-edges of v are incoming_edges()[incoming_offsets()[v] : incoming_offsets()[v + 1]]
+        """
+
+    def input_positions(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[E]: EdgeId -> input position (read-only view); build the inverse yourself if needed
+        """
+
+    def max_edge_cost(self) -> int:
+        """
+        largest edge cost (0 without edges)
+        """
+
+    def num_edges(self) -> int:
+        """
+        E: EdgeIds are 0 .. E - 1
+        """
+
+    def num_nodes(self) -> int:
+        """
+        N: node ids are 0 .. N - 1
+        """
+
+    def outgoing_offsets(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[N + 1]: the out-edges of u are the ids [outgoing_offsets()[u], outgoing_offsets()[u + 1])
+        """
+
+    def resolution(self) -> float:
+        """
+        the resolution q (units of capacity)
+        """
+
+    def uid(self) -> int:
+        """
+        process-unique id (never reused)
+        """
+
+class PredecessorDAG:
+    """
+    Immutable route structure of one graph, a predecessor DAG (directed, no cycle): for each node v,
+    the edges that reach v on the route and the node each comes from (its parent). The entries of v
+    are parents()[k], via_edges()[k] for k in [parent_offsets()[v], parent_offsets()[v + 1]), in
+    strictly ascending EdgeId, so two DAGs of the same graph with the same entries have equal arrays
+    and compare equal; DAGs of different graphs never compare equal.
+    parents() and via_edges() are read-only views that keep the DAG alive; parent_offsets() is a new
+    read-only array on each call (the DAG stores only the nodes that have entries). Built by
+    PredecessorDAG.from_csr, Path.to_dag(), the searches and the policies (FlowRecord.route).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @staticmethod
+    def from_csr(
+        graph: Graph,
+        parent_offsets: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        parents: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        via_edges: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+    ) -> PredecessorDAG:
+        """
+        A wrong type raises TypeError; structural and range defects raise ValueError. Validates, in order,
+        before any traversal: parent_offsets of
+        length N + 1, parent_offsets[0] == 0, monotone, parent_offsets[N] == len(parents) ==
+        len(via_edges); then every parent and via edge in range, every via edge joining (parent, child),
+        no duplicate (child, via edge), acyclic; within a node the entries in ascending via EdgeId.
+        """
+
+    def __eq__(self, arg0: typing.Any) -> bool: ...
+    def __hash__(self) -> int: ...
+    def __repr__(self) -> str: ...
+    def graph_uid(self) -> int:
+        """
+        uid of the graph this DAG belongs to
+        """
+
+    def parent_offsets(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32[N + 1]: the entries of node v are [parent_offsets[v], parent_offsets[v + 1]); a new read-only array per call
+        """
+
+    def parents(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32 parent NodeId per entry (read-only view)
+        """
+
+    def via_edges(self) -> numpy.typing.NDArray[numpy.int32]:
+        """
+        int32 via EdgeId per entry (read-only view)
+        """
+
+class Path:
+    """
+    Immutable route of one graph, hop by hop: each hop lists one or more parallel edges (members)
+    from the same u to the same v, in the caller's order. cost = the sum over hops of the cost of
+    each hop's cheapest member.
+    """
+
+    def __eq__(self, arg0: typing.Any) -> bool: ...
+    def __hash__(self) -> int: ...
+    def __init__(
+        self,
+        graph: Graph,
+        hops: collections.abc.Sequence[
+            collections.abc.Sequence[typing.SupportsIndex]
+            | numpy.typing.NDArray[numpy.integer]
+        ]
+        | numpy.typing.NDArray[numpy.integer],
+    ) -> None:
+        """
+        A wrong type raises TypeError; structural and range defects raise ValueError. Validates, in order:
+        every member id in range, no duplicate
+        member, a non-empty hop list, every hop non-empty, the members of a hop sharing (u, v),
+        contiguous hops, no repeated node.
+        """
+
+    def __repr__(self) -> str: ...
+    def cost(self) -> int:
+        """
+        sum over hops of the minimum member cost
+        """
+
+    def destination(self) -> int:
+        """
+        the last node of the walk
+        """
+
+    def graph_uid(self) -> int:
+        """
+        uid of the graph this path belongs to
+        """
+
+    def hops(self) -> list[list[int]]:
+        """
+        the hops as lists of EdgeIds (the caller's member order)
+        """
+
+    def source(self) -> int:
+        """
+        the first node of the walk
+        """
+
+    def to_dag(self) -> PredecessorDAG:
+        """
+        the equivalent PredecessorDAG (every member of every hop)
+        """
+
+class FlowRecord:
+    """
+    One flow of a ledger, as a snapshot: flow_id (ledger uid, id), policy_id (the policy's id),
+    sources, destinations, admission, entry_id (a T1, T2 or Pinned policy's program entry, else None),
+    route (PredecessorDAG: the flow's route), min_route_cost (its minimum walk cost; None when empty),
+    offered (Lossy only, else None), delivered, edge_flows [(EdgeId, units)] (carried load) and
+    edge_drops [(EdgeId, units)] (cumulative, ascending EdgeId), edge_reservations [(EdgeId, units)]
+    (T1's strict holds, ascending EdgeId). offered and the edge_drops units are exact Python ints (they
+    may exceed 64 bits).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def admission(self) -> Admission:
+        """
+        LOSSLESS or LOSSY
+        """
+
+    @property
+    def delivered(self) -> int:
+        """
+        the units the flow delivers to its destinations (its total)
+        """
+
+    @property
+    def destinations(self) -> list[int]:
+        """
+        the flow's destination node ids, ascending
+        """
+
+    @property
+    def edge_drops(self) -> list[tuple[int, int]]:
+        """
+        Lossy: the units dropped per edge [(EdgeId, units)], summed over calls, positive entries in
+        ascending EdgeId (exact ints); empty for a Lossless flow
+        """
+
+    @property
+    def edge_flows(self) -> list[tuple[int, int]]:
+        """
+        the flow's allocation [(EdgeId, units)], positive entries in ascending EdgeId
+        """
+
+    @property
+    def edge_reservations(self) -> list[tuple[int, int]]:
+        """
+        T1: the strict holds of an up tunnel [(EdgeId, units)], its request on every link of its path,
+        ascending EdgeId; empty for every other record (holds never police traffic)
+        """
+
+    @property
+    def entry_id(self) -> int | None:
+        """
+        the program entry the record carries (T1, T2 and Pinned: the entry identifier); None for the
+        records kept per roster source (ShortestPaths, CentralizedTE)
+        """
+
+    @property
+    def flow_id(self) -> tuple[int, int]:
+        """
+        (ledger uid, id): ids are assigned in creation order and never reused in the ledger
+        """
+
+    @property
+    def min_route_cost(self) -> int | None:
+        """
+        the cost of the cheapest walk of the route from the sources to the destinations; None when
+        the route has no such walk
+        """
+
+    @property
+    def offered(self) -> int | None:
+        """
+        Lossy: the units offered to the flow, summed over calls (an exact int, may exceed 64 bits);
+        None for a Lossless flow
+        """
+
+    @property
+    def policy_id(self) -> int:
+        """
+        the ledger-local id of the policy that created the flow
+        """
+
+    @property
+    def route(self) -> PredecessorDAG:
+        """
+        the flow's route (an immutable PredecessorDAG shared with the ledger)
+        """
+
+    @property
+    def sources(self) -> list[int]:
+        """
+        the flow's source node ids, ascending
+        """
+
+class FlowLedger:
+    """
+    The integer ledger of one graph, in two projections that are never added: carried traffic (the
+    service baseline; carried() is the sum of every record's edge_flows and residual() = baseline -
+    carried()) and the strict holds of T1 tunnels (the reservation baseline; reserved() is the sum of
+    every record's edge_reservations and unreserved() = reservation baseline - reserved()), all int64[E]
+    snapshots. Traffic may use bandwidth that is held: holds never police. The baselines are replaced
+    only by reset(); the records are the flows placed on it by policies (the ledger has no public
+    placement, removal or reservation). reset() and copy() are rejected while a policy is bound (a
+    FlowPolicy built on this ledger still exists).
+    """
+
+    def __copy__(self) -> FlowLedger: ...
+    def __deepcopy__(self, memo: typing.Any) -> FlowLedger: ...
+    def __init__(
+        self,
+        graph: Graph,
+        service_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        *,
+        reservation_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> None:
+        """
+        service_baseline and reservation_baseline: the baselines as integer units, one entry per edge in
+        [0, the edge's capacity] (a physical baseline goes through to_units first; service_baseline
+        checked first); None: the capacities. A wrong type (not a 1-D sequence of integers, a non-integer
+        entry) raises TypeError, a wrong length or an entry outside its range ValueError.
+        """
+
+    def carried(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] snapshot: the sum of every record's edge_flows
+        """
+
+    def copy(self) -> FlowLedger:
+        """
+        a new ledger (new uid) with the same baselines, records and holds, ids kept under the new uid;
+        ValueError while a policy is bound
+        """
+
+    def edge_capacity_units(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] the graph's capacities in units (read-only view)
+        """
+
+    def graph(self) -> Graph:
+        """
+        the ledger's graph
+        """
+
+    def record(
+        self, flow_id: tuple[typing.SupportsIndex, typing.SupportsIndex]
+    ) -> FlowRecord:
+        """
+        one record by FlowId (ValueError for a FlowId of another ledger, a retired or an unknown id)
+        """
+
+    def records(self) -> list[FlowRecord]:
+        """
+        live records as snapshots in FlowId order: those of bound policies and orphans (records left by a
+        policy destroyed without remove())
+        """
+
+    def reserved(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] snapshot: strict holds per edge (T1), the sum of every record's edge_reservations
+        """
+
+    def reset(
+        self,
+        service_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        *,
+        reservation_baseline: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> None:
+        """
+        New baselines (None: the capacities); orphaned records with their allocations and holds are
+        cleared and their ids retired (ids are never reused). ValueError while a policy is bound.
+        """
+
+    def residual(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] snapshot: service_baseline - carried()
+        """
+
+    def saturated_boundary_edges(
+        self,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        eligibility: Eligibility | None = None,
+    ) -> list[int]:
+        """
+        Saturation report: the eligible edges with capacity >= 1 unit that leave the set of nodes the
+        allowed sources can reach (following eligible edges forward with residual >= 1 unit), in
+        ascending EdgeId. It ignores the destinations, so it is not a source-destination cut.
+        """
+
+    def uid(self) -> int:
+        """
+        process-unique ledger uid (the first half of every FlowId)
+        """
+
+    def unreserved(self) -> numpy.typing.NDArray[numpy.int64]:
+        """
+        int64[E] snapshot: reservation baseline minus strict holds, per edge
+        """
+
+class TunnelStatus:
+    """
+    A tunnel's state. UP; INSUFFICIENT_BANDWIDTH and COST_CEILING_EXCEEDED: T1's setup left it down (no path
+    passes the bandwidth filter, or the cheapest exceeds the cost ceiling): no path, weight 0, and it
+    stays down in every forwarding of its program; and in one forwarding only (a by_tunnel row)
+    FAILED: its path touches a node or an edge the forwarding policy's Eligibility excludes, so it
+    gets nothing and its head splits over its other entries (replay), and BLACKHOLED: up, but its
+    path reaches a black hole of stale forwarding, where its traffic is dropped.
+
+    Members:
+
+      UP
+
+      INSUFFICIENT_BANDWIDTH
+
+      COST_CEILING_EXCEEDED
+
+      FAILED
+
+      BLACKHOLED
+    """
+
+    BLACKHOLED: typing.ClassVar[TunnelStatus]
+    COST_CEILING_EXCEEDED: typing.ClassVar[TunnelStatus]
+    FAILED: typing.ClassVar[TunnelStatus]
+    INSUFFICIENT_BANDWIDTH: typing.ClassVar[TunnelStatus]
+    UP: typing.ClassVar[TunnelStatus]
+    __members__: typing.ClassVar[dict[str, TunnelStatus]]
+
+    @typing.overload
+    def __eq__(self, other: TunnelStatus, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: TunnelStatus, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class Tunnel:
+    """
+    One tunnel (a path entry) of a ForwardingProgram, read-only. entry_id: the entry identifier (T1 and
+    T2: j*H + i for round j and roster position i, T2's dead heads leaving holes; CentralizedTE and ShortestPaths
+    OPTIMIZED: the path's position in the decomposition order; supplied routes: the route's position in
+    the list), never a position in program.tunnels; head; local_index: its position among the head's entries of both kinds;
+    destination: where its path ends; edges: its EdgeIds in path order; path_cost: the sum of their
+    costs (all three None for a tunnel that is down); status: UP, INSUFFICIENT_BANDWIDTH or
+    COST_CEILING_EXCEEDED; requested_bandwidth and reserved_bandwidth: T1's strict bandwidth (its request,
+    and what it holds on every link of its path: the request when UP, else 0; 0 for the other models);
+    planned_bandwidth: T2's planned bandwidth
+    u (metadata, never held; 0 for the other models); weight: its integer share among the head's
+    entries (T1: 1 up, 0 down; T2: 1; a controller path: its solved amount).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def destination(self) -> int | None: ...
+    @property
+    def edges(self) -> tuple[int, ...] | None:
+        """
+        the path's EdgeIds in path order; None for a tunnel that is down
+        """
+
+    @property
+    def entry_id(self) -> int: ...
+    @property
+    def head(self) -> int: ...
+    @property
+    def local_index(self) -> int: ...
+    @property
+    def path_cost(self) -> int | None: ...
+    @property
+    def planned_bandwidth(self) -> int: ...
+    @property
+    def requested_bandwidth(self) -> int: ...
+    @property
+    def reserved_bandwidth(self) -> int: ...
+    @property
+    def status(self) -> TunnelStatus: ...
+    @property
+    def weight(self) -> int: ...
+
+class RouteDefinition:
+    """
+    A supplied route for ForwardingProgram.from_routes: a Path with one edge per hop (a tunnel) or a
+    PredecessorDAG (a split route) starting at `head`; weight is its integer share among the head's routes
+    (0 allowed: it carries nothing). from_routes validates it.
+    """
+
+    def __init__(
+        self,
+        head: typing.SupportsIndex,
+        route: Path | PredecessorDAG,
+        *,
+        weight: typing.SupportsIndex = 1,
+    ) -> None:
+        """
+        RouteDefinition(head, route, *, weight=1): head a NodeId, route a Path or a PredecessorDAG (TypeError
+        otherwise), weight an integer (checked in [0, 2^62) by from_routes).
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def head(self) -> int:
+        """
+        the route's head (a source of the program)
+        """
+
+    @property
+    def route(self) -> Path | PredecessorDAG:
+        """
+        the Path (a tunnel) or the PredecessorDAG (a split route)
+        """
+
+    @property
+    def weight(self) -> int:
+        """
+        the route's integer share among the head's routes
+        """
+
+class ForwardingProgram:
+    """
+    An immutable value: one demand's routes and integer weights. sources and destinations (the normalized
+    sets); tunnels: the path entries in ascending entry_id (split routes are not listed); source_weights: the
+    captured weights ((source, weight) for every roster source, ascending): optimized controllers' solved
+    supplies, weighted CentralizedTE's declared weights, or None for equal sources (round robin). Each head splits its share by
+    highest averages over its entries' weights; identical routes are never merged. ShortestPaths and CentralizedTE
+    produce one (FlowPolicy.program, PlacementResult.program), and so do T1 and T2 (their tunnels);
+    from_routes builds one from given routes and from_dag one shared hop-by-hop program on a DAG; Pinned
+    forwards one. No public constructor.
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @staticmethod
+    def from_dag(
+        graph: Graph,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        dag: PredecessorDAG,
+        *,
+        allocation: RouteAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> ForwardingProgram:
+        """
+        One shared hop-by-hop program on a supplied PredecessorDAG of the graph -> ForwardingProgram: the sources
+        allocated equally and pooled at every shared router exactly as ShortestPaths EQUAL/WEIGHTED (one
+        split context), the DAG trimmed to the walks from each source to its first destinations. A wrong type
+        raises TypeError; structural, range and combination defects raise ValueError, in this order: the endpoint sets; `dag belongs to another graph`; allocation OPTIMIZED
+        (`from_dag allocation must be EQUAL or WEIGHTED`); weight_basis only with allocation=WEIGHTED, EXPLICIT
+        with edge_weights, RESIDUAL_SNAPSHOT with residual; edge_weights' length and entries in [0, 2^62) and
+        residual's (one entry per edge in [0, capacity]). A dag of another type raises TypeError. The roster is
+        the sources that reach a destination in the DAG (possibly none): one split route per roster source,
+        identified by roster position, no tunnel; a replay rebuilds the roster on the DAG.
+        """
+
+    @staticmethod
+    def from_routes(
+        graph: Graph,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        routes: collections.abc.Sequence[RouteDefinition],
+        *,
+        allocation: RouteAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+    ) -> ForwardingProgram:
+        """
+        Validate and freeze supplied routes -> ForwardingProgram. A wrong type raises TypeError; structural,
+        range and combination defects raise ValueError, in this order: the endpoint sets; `routes must not be empty`; when no route is a PredecessorDAG, any option given
+        (`<allocation, weight_basis, edge_weights or residual> applies only to PredecessorDAG routes`); allocation
+        OPTIMIZED (`from_routes allocation must be EQUAL or WEIGHTED`); weight_basis only with allocation=WEIGHTED,
+        EXPLICIT with edge_weights, RESIDUAL_SNAPSHOT with residual; edge_weights' length and entries in [0,
+        2^62) and residual's (one entry per edge in [0, capacity]); then each route in list order: its
+        route's graph, its head a source, a Path with one edge per hop that starts at the head, ends at a
+        destination and meets none before, a PredecessorDAG with a walk from the head to a destination, its weight
+        in [0, 2^62). Order and duplicates are kept; a route of weight 0 is validated in full. allocation
+        (None: EQUAL) is the interior split of the PredecessorDAG routes; each split route is its own
+        split context (a router splits only that route's share). The roster is the sources with a route.
+        """
+
+    @property
+    def destinations(self) -> tuple[int, ...]:
+        """
+        the destination set, ascending
+        """
+
+    @property
+    def source_weights(self) -> tuple[tuple[int, int], ...] | None:
+        """
+        the captured source weights ((source, weight), ascending), or None for equal sources
+        """
+
+    @property
+    def sources(self) -> tuple[int, ...]:
+        """
+        the source set, ascending
+        """
+
+    @property
+    def tunnels(self) -> tuple[Tunnel, ...]:
+        """
+        the program's tunnels (Tunnel), ascending entry_id
+        """
+
+class AbsoluteCost:
+    """
+    Cost ceiling: an absolute, inclusive path-cost budget (cost >= 0).
+    """
+
+    def __eq__(self, arg0: typing.Any) -> bool: ...
+    def __hash__(self) -> int: ...
+    def __init__(self, cost: typing.SupportsIndex) -> None:
+        """
+        AbsoluteCost(cost): a 64-bit integer budget in cost units (checked >= 0 where it is used)
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def cost(self) -> int:
+        """
+        the budget: a path qualifies when its cost is at most this
+        """
+
+class CostStretch:
+    """
+    Cost ceiling: a path qualifies when cost * d <= n * base, exactly, where n/d is the factor as
+    one reduced fraction and base the static shortest cost under the Eligibility (T1: the smallest
+    over all roster heads).
+    """
+
+    def __eq__(self, arg0: typing.Any) -> bool: ...
+    def __hash__(self) -> int: ...
+    def __init__(
+        self, factor: fractions.Fraction | float | numpy.floating | typing.SupportsIndex
+    ) -> None:
+        """
+        CostStretch(factor): in this order, a bool (or numpy.bool_) raises TypeError; a fractions.Fraction
+        is taken as it is; a Python float or any NumPy floating value is Fraction(str(f)), the shortest
+        decimal its own type prints (1.2, np.float64(1.2) and np.float32(1.2) are all 6/5), and a NaN or
+        an infinity raises ValueError; an integer, NumPy integer or any __index__ object is n/1 exactly;
+        anything else raises TypeError. Then a reduced numerator outside [-2^63, 2^63) or denominator
+        outside [1, 2^63) raises ValueError. A factor below 1 is valid here and refused where the
+        ceiling is used.
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def factor(self) -> fractions.Fraction:
+        """
+        the factor as a fractions.Fraction (built on each access)
+        """
+
+class TunnelCount:
+    """
+    The tunnel count of T1 (DistributedTE) and T2, per head: per_head in [1, 10000] (checked when a
+    policy or an evaluator uses it). up_to=True (T2 only; T1 rejects it): one common count k in
+    1..per_head for every head: the smallest common count whose program carries the live heads'
+    design shares; if none does, the largest live-share score, then the smallest count. It does not
+    promise whole-demand lossless delivery.
+    """
+
+    def __eq__(self, arg0: typing.Any) -> bool: ...
+    def __hash__(self) -> int: ...
+    def __init__(self, per_head: typing.SupportsIndex, *, up_to: bool = False) -> None:
+        """
+        TunnelCount(per_head, *, up_to=False): a 64-bit integer per_head (a bool, a float or None raises
+        TypeError and an integer outside 64 bits ValueError here; [1, 10000] is checked where it is
+        used) and a bool
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def per_head(self) -> int:
+        """
+        the tunnels per head (the largest count for up_to)
+        """
+
+    @property
+    def up_to(self) -> bool:
+        """
+        True: the smallest count up to per_head whose program carries the live heads' design shares (else the
+        best live-share score, then the smallest); T2 only
+        """
+
+class ShortestPaths:
+    """
+    Routing like IGP forwarding (OSPF, IS-IS routers) on each roster source's static shortest-path
+    DAG (read from the ShortestPathCache; the route choice is applied when the program is prepared:
+    a positive place of an epoch without one, or any replace or evaluate), fixed for the epoch;
+    one record per roster source. EQUAL (ECMP, the default) and WEIGHTED
+    (WCMP) pool the sources (source allocation EQUAL): where their routes meet, a router splits
+    their traffic once. OPTIMIZED is a controller on the union of those routes (source allocation
+    OPTIMIZED by default, or EQUAL). An edge of capacity 0 stays in the DAG: EQUAL still sends it
+    its share, which it cannot carry, and WEIGHTED gives it weight 0.
+    """
+
+    def __init__(
+        self,
+        *,
+        allocation: RouteAllocation = ...,
+        source_allocation: SourceAllocation | None = None,
+        weight_basis: WeightBasis | None = None,
+        edge_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        tie_break: RouteTieBreak = ...,
+        multipath: bool = True,
+        parallel_edges: bool = True,
+    ) -> None:
+        """
+        ShortestPaths(*, allocation=EQUAL, source_allocation=None, weight_basis=None, edge_weights=None,
+        tie_break=FEWER_HOPS, multipath=True, parallel_edges=True): ShortestPaths() is ECMP.
+        source_allocation None resolves to EQUAL for EQUAL and WEIGHTED (the only allowed value) and to
+        OPTIMIZED for OPTIMIZED; weight_basis (WEIGHTED only; None: CAPACITY) and edge_weights (one
+        integer per edge, given exactly when weight_basis=EXPLICIT; one array shared by every policy
+        built from this model). The combination is checked when a policy or an evaluator uses the model
+        (ValueError, in the order of the model matrix). Here, a value of the wrong type (a multipath or parallel_edges that
+        is not a bool, an enumeration of another class, an edge_weights that is not a 1-D sequence of
+        integers or has a bool or a float entry) raises TypeError, and an edge_weights entry beyond
+        int64 ValueError.
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def allocation(self) -> RouteAllocation:
+        """
+        the RouteAllocation: EQUAL, WEIGHTED or OPTIMIZED
+        """
+
+    @property
+    def edge_weights(self) -> tuple[int, ...] | None:
+        """
+        the explicit weights (one int per edge, a tuple), or None
+        """
+
+    @property
+    def multipath(self) -> bool:
+        """
+        True: every equal-cost route; False: one canonical path per roster source toward the destination set
+        """
+
+    @property
+    def parallel_edges(self) -> bool:
+        """
+        True: every eligible parallel edge; False: one per (u, v) pair by the tie rule
+        """
+
+    @property
+    def source_allocation(self) -> SourceAllocation | None:
+        """
+        the SourceAllocation, or None (a policy's config: resolved to the allocation's default)
+        """
+
+    @property
+    def tie_break(self) -> RouteTieBreak:
+        """
+        the RouteTieBreak of equal-cost choices
+        """
+
+    @property
+    def weight_basis(self) -> WeightBasis | None:
+        """
+        the WeightBasis, or None (a policy's config: CAPACITY resolved for WEIGHTED)
+        """
+
+class DistributedTE:
+    """
+    T1: every head sets up its own strict tunnels by CSPF, no controller (like RSVP-TE head ends).
+    The design volume D is split equally over the roster heads and each head's share equally over its
+    tunnel_count.per_head tunnels; in round order (round j, heads ascending: entry_id j*H + i) each tunnel
+    keeps the allowed links whose unreserved capacity (the ledger's, minus the holds of every other
+    owner and of this setup's earlier tunnels) is at least max(request, min_unreserved_bandwidth) (a
+    request of 0 with a minimum of 0 has no filter) and takes the shortest path in the tie_break's
+    single-path order; it comes up holding exactly its request on every link (UP), or stays down
+    holding nothing: INSUFFICIENT_BANDWIDTH (no path passes the filter) or COST_CEILING_EXCEEDED (the cheapest exceeds
+    cost_ceiling: AbsoluteCost is inclusive; CostStretch(f) is f times the smallest static shortest cost over
+    all roster heads). Traffic enters equally at the heads and splits equally over each head's up
+    tunnels; a head with no tunnel up loses its share. Holds never police traffic.
+    """
+
+    def __init__(
+        self,
+        tunnel_count: TunnelCount,
+        *,
+        cost_ceiling: AbsoluteCost | CostStretch | None = None,
+        min_unreserved_bandwidth: typing.SupportsIndex = 0,
+        tie_break: RouteTieBreak = ...,
+        parallel_edges: bool = True,
+    ) -> None:
+        """
+        DistributedTE(tunnel_count, *, cost_ceiling=None, min_unreserved_bandwidth=0, tie_break=FEWER_HOPS,
+        parallel_edges=True): the fields are checked when a policy is built with them (the count in
+        [1, 10000] and exact, the ceiling, min_unreserved_bandwidth in [0, 2^62) units). tie_break and
+        parallel_edges are the CSPF choice, scored on unreserved bandwidth. Here, a
+        min_unreserved_bandwidth outside 64 bits raises ValueError; one of the wrong type, a tunnel_count
+        that is not a TunnelCount, a ceiling of the wrong class, a parallel_edges that is not a bool and an
+        unknown keyword raise TypeError.
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def cost_ceiling(self) -> AbsoluteCost | CostStretch | None:
+        """
+        the inclusive route cost ceiling (AbsoluteCost or CostStretch); None: no ceiling
+        """
+
+    @property
+    def min_unreserved_bandwidth(self) -> int:
+        """
+        units in [0, 2^62): a search minimum only (each attempt keeps the links with at least
+        max(request, this) unreserved units), never a reservation
+        """
+
+    @property
+    def parallel_edges(self) -> bool:
+        """
+        True: every eligible parallel edge; False: one per (u, v) pair by the tie rule
+        """
+
+    @property
+    def tie_break(self) -> RouteTieBreak:
+        """
+        the RouteTieBreak of the CSPF choice
+        """
+
+    @property
+    def tunnel_count(self) -> TunnelCount:
+        """
+        the tunnel count per head (a TunnelCount)
+        """
+
+class CentralizedTE:
+    """
+    Routing: an ideal central controller that sees the whole network, or only a support DAG. It takes
+    no route choice, and its source_allocation is required.
+    Without tunnel_count: a positive place re-solves the minimum-cost flow of what the policy
+    already delivers plus this call's request (delivered() + offer; what an earlier call could not
+    place is not requested again); evaluate and replace solve their whole offer afresh, and forward
+    sends its offer over the installed paths without a solve. A solve runs over the eligible graph,
+    or exactly over `support` (a
+    PredecessorDAG of the policy's graph, trimmed to the walks from the sources to the allowed
+    destinations under the Eligibility; every other edge carries nothing), on the free capacity
+    plus its own allocation: it may move its own traffic, never another's. OPTIMIZED: the controller
+    chooses how much enters at each source. EQUAL: every roster source sends its round-robin share
+    of the largest total whose shares all fit. WEIGHTED: highest-averages shares of the declared
+    source_weights; zero weights receive nothing, and all-zero roster weights end NO_ACTIVE_WEIGHT
+    on a positive live call. The program is the solve cut into paths per source, each a tunnel
+    weighted by its amount; it keeps the declared weights for weighted sources and the solved
+    supplies for optimized ones. A positive call on a network beyond the flow core's int32
+    numbering raises ValueError (see FlowPolicy.place).
+    With tunnel_count=TunnelCount(N) (T2; with support, every step uses only the support's edges
+    allowed by the policy's mask): a controller (like a PCE) lays out, for every live head (one
+    reaching a destination over links with free capacity >= 1; the other heads are dead and lose
+    their share), N single-path tunnels with one common whole-unit planned bandwidth: first as
+    large as possible (U), then for a finite design no larger than needed (u), then the cheapest
+    routes, then with prefer_headroom=True the routes that leave the most spare capacity, then one
+    fixed unit-by-unit tie. TunnelCount(L, up_to=True): the smallest common count k <= L whose
+    program carries the live heads' design shares (else the largest live-share score, then the
+    smallest count); no promise of whole-demand lossless delivery. Traffic splits equally over the
+    heads and over each head's tunnels; planned bandwidth is never held.
+    """
+
+    def __init__(
+        self,
+        *,
+        source_allocation: SourceAllocation,
+        source_weights: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        support: PredecessorDAG | None = None,
+        tunnel_count: TunnelCount | None = None,
+        prefer_headroom: bool = False,
+    ) -> None:
+        """
+        CentralizedTE(*, source_allocation, source_weights=None, support=None, tunnel_count=None, prefer_headroom=False):
+        source_allocation is required (EQUAL, OPTIMIZED or WEIGHTED; None or a missing argument raises TypeError).
+        WEIGHTED requires source_weights and no tunnel_count: one integer per graph node in [0, 2^62),
+        copied once and exposed as an immutable tuple. Other source allocations refuse source_weights.
+        support a PredecessorDAG of the policy's graph (checked when a policy is built with it: `support
+        belongs to another graph`) or None for every eligible edge; tunnel_count a TunnelCount (T2;
+        the count in [1, 10000] is checked when a policy is built with it) or None; prefer_headroom (T2
+        only; True without tunnel_count raises `prefer_headroom requires tunnel_count` when a policy is
+        built with it): the headroom penalty as T2's objective after route cost
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def prefer_headroom(self) -> bool:
+        """
+        True: T2 minimizes the headroom penalty after route cost (T2 only)
+        """
+
+    @property
+    def source_allocation(self) -> SourceAllocation:
+        """
+        the SourceAllocation: EQUAL, OPTIMIZED or WEIGHTED
+        """
+
+    @property
+    def source_weights(self) -> tuple[int, ...] | None:
+        """
+        declared node-indexed source weights as an immutable tuple, or None
+        """
+
+    @property
+    def support(self) -> PredecessorDAG | None:
+        """
+        the supplied support (a PredecessorDAG), or None
+        """
+
+    @property
+    def tunnel_count(self) -> TunnelCount | None:
+        """
+        T2's tunnel count per head (a TunnelCount), or None
+        """
+
+class Pinned:
+    """
+    Routing: forwarding over a given program, computing nothing (the program's endpoints must be
+    the policy's). The policy's Eligibility repairs failures: a tunnel touching an excluded element is
+    FAILED, a split route loses its excluded members, and the roster is rebuilt from the program's
+    basis (a head that no longer reaches a destination leaves the equal pool). black_holes: the nodes
+    and edges this Eligibility excludes are silent failures; the program is forwarded unchanged and
+    traffic reaching them is dropped there (stale forwarding; None: no black holes). One record per
+    program entry.
+    """
+
+    def __init__(
+        self, program: ForwardingProgram, *, black_holes: Eligibility | None = None
+    ) -> None:
+        """
+        Pinned(program, *, black_holes=None): a ForwardingProgram and an Eligibility of the same graph (both
+        kept by reference; checked when a policy is built with them)
+        """
+
+    def __repr__(self) -> str: ...
+    @property
+    def black_holes(self) -> Eligibility | None:
+        """
+        the black holes (an Eligibility), or None
+        """
+
+    @property
+    def program(self) -> ForwardingProgram:
+        """
+        the forwarded program (shared, immutable)
+        """
+
+class FlowPolicyConfig:
+    """
+    One demand's settings: the routing model, which holds every option it reads (ShortestPaths,
+    DistributedTE (T1), CentralizedTE, CentralizedTE(tunnel_count=...) (T2) or Pinned), and the admission
+    (LOSSLESS by default; LOSSY for ShortestPaths EQUAL and WEIGHTED, T1, T2 and Pinned). The
+    combination is checked when a policy or an evaluator uses the configuration (ValueError), in
+    this order: the enumeration values; the model matrix (route and source allocation, admission,
+    the ineffective tie rule, the pooled single-path rule, prefer_headroom, the weight combinations,
+    and last a ShortestPathCache on a model that does not read it); the tunnel count, an up_to count
+    for DistributedTE, the ceilings, min_unreserved_bandwidth and edge_weights' length and entries;
+    the tunnel limit (roster heads times the tunnel count at most 2^30 - 1); a Pinned program's
+    endpoints.
+    """
+
+    def __init__(
+        self,
+        *,
+        routing: ShortestPaths | DistributedTE | CentralizedTE | Pinned,
+        admission: Admission = ...,
+    ) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def admission(self) -> Admission:
+        """
+        LOSSLESS or LOSSY
+        """
+
+    @property
+    def routing(self) -> ShortestPaths | DistributedTE | CentralizedTE | Pinned:
+        """
+        the routing model: ShortestPaths, DistributedTE, CentralizedTE or Pinned
+        """
+
+class OutputOptions:
+    """
+    Optional outputs of a placement (all false by default; absent outputs are None):
+    edge_flows (the policy's own allocation per edge after the call), residual and
+    saturated_boundary_edges (the ledger's after the call), edge_reservations (the policy's own
+    strict holds per edge after the call; zeros for a model without holds), and min_cut (unrestricted
+    CentralizedTE with the optimized source allocation, when the call's solve reached the maximum
+    flow; [] for an empty roster, place(0) excepted; None for every other model or source allocation,
+    for place(0) and for a forward with a nonempty roster).
+    """
+
+    def __init__(
+        self,
+        *,
+        edge_flows: bool = False,
+        residual: bool = False,
+        saturated_boundary_edges: bool = False,
+        edge_reservations: bool = False,
+        min_cut: bool = False,
+    ) -> None: ...
+    @property
+    def edge_flows(self) -> bool:
+        """
+        request PlacementResult.edge_flows
+        """
+
+    @property
+    def edge_reservations(self) -> bool:
+        """
+        request PlacementResult.edge_reservations
+        """
+
+    @property
+    def min_cut(self) -> bool:
+        """
+        request PlacementResult.min_cut
+        """
+
+    @property
+    def residual(self) -> bool:
+        """
+        request PlacementResult.residual
+        """
+
+    @property
+    def saturated_boundary_edges(self) -> bool:
+        """
+        request PlacementResult.saturated_boundary_edges
+        """
+
+class Termination:
+    """
+    How a call ended, the first that applies: COMPLETE for a zero request; NO_ROUTE for a positive
+    request with an empty roster (no eligible source statically reaches an allowed destination);
+    NO_ACTIVE_WEIGHT when the program has an entry with a path (an up tunnel, a controller path or
+    a split route) but no head can use one (no positive weight: WEIGHTED over edges of capacity 0
+    only, routes of weight 0, every up tunnel failed); a program whose tunnels are all down is not
+    this case. A live CentralizedTE WEIGHTED call without tunnel_count with a positive offer
+    and a nonempty all-zero source-weight roster is also NO_ACTIVE_WEIGHT, with no tunnels;
+    Pinned replay of that empty program follows the remaining rules. A LOSSY finite request: COMPLETE (delivery and losses account for the whole offer,
+    which does not mean nothing was lost); otherwise COMPLETE when the whole request was delivered,
+    else EXHAUSTED (an infinite request is EXHAUSTED). A controller whose maximum is 0 over existing
+    routes is EXHAUSTED, not NO_ROUTE.
+
+    Members:
+
+      COMPLETE
+
+      NO_ROUTE
+
+      EXHAUSTED
+
+      NO_ACTIVE_WEIGHT
+    """
+
+    COMPLETE: typing.ClassVar[Termination]
+    EXHAUSTED: typing.ClassVar[Termination]
+    NO_ACTIVE_WEIGHT: typing.ClassVar[Termination]
+    NO_ROUTE: typing.ClassVar[Termination]
+    __members__: typing.ClassVar[dict[str, Termination]]
+
+    @typing.overload
+    def __eq__(self, other: Termination, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: Termination, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class SourceFlow:
+    """
+    One normalized input source's forwarding in the epoch (read-only; zero rows included: a
+    masked or unreachable source): source, offered (LOSSY: its injections; None when
+    LOSSLESS), admitted (LOSSLESS: what it delivers; LOSSY: offered), delivered, source_drops
+    (offered units lost at the source for lack of a usable route) and total_edge_drops (its losses
+    on links). LOSSY: offered = delivered + source_drops + total_edge_drops. Exact ints.
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def admitted(self) -> int:
+        """
+        LOSSLESS: the units it delivers; LOSSY: offered
+        """
+
+    @property
+    def delivered(self) -> int:
+        """
+        the units it delivers to the destinations
+        """
+
+    @property
+    def offered(self) -> int | None:
+        """
+        LOSSY: the units this source injected; None when LOSSLESS
+        """
+
+    @property
+    def source(self) -> int:
+        """
+        the source node id
+        """
+
+    @property
+    def source_drops(self) -> int:
+        """
+        LOSSY: its offered units lost at the source (no usable route); 0 when LOSSLESS
+        """
+
+    @property
+    def total_edge_drops(self) -> int:
+        """
+        LOSSY: its units dropped on links; 0 when LOSSLESS
+        """
+
+class TunnelFlow:
+    """
+    One program tunnel's forwarding in the epoch (read-only): entry_id (its entry identifier) and
+    head, status (TunnelStatus: UP; INSUFFICIENT_BANDWIDTH or COST_CEILING_EXCEEDED for a tunnel
+    T1's setup left down; FAILED, BLACKHOLED in this forwarding), assigned (its share of the
+    injections: LOSSY the shares sent to it, LOSSLESS what it carries), delivered and
+    total_edge_drops (its losses on links). Exact ints (assigned and total_edge_drops may exceed 64
+    bits).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def assigned(self) -> int:
+        """
+        its share of the injections in the epoch (LOSSY: sent to it; LOSSLESS: what it carries)
+        """
+
+    @property
+    def delivered(self) -> int:
+        """
+        the units it delivers
+        """
+
+    @property
+    def entry_id(self) -> int:
+        """
+        the tunnel's entry identifier
+        """
+
+    @property
+    def head(self) -> int:
+        """
+        the tunnel's head
+        """
+
+    @property
+    def status(self) -> TunnelStatus:
+        """
+        UP, a down tunnel's setup status (INSUFFICIENT_BANDWIDTH, COST_CEILING_EXCEEDED), FAILED or
+        BLACKHOLED in this forwarding
+        """
+
+    @property
+    def total_edge_drops(self) -> int:
+        """
+        its units dropped on links
+        """
+
+class TunnelPlan:
+    """
+    The tunnel models' setup summary (read-only): tunnels_per_head (T2 up to: the chosen count),
+    design_demand (the design demand D in units), design_by_head ((head, RR(D, H, i)) for every
+    roster head in ascending NodeId) and total_reserved_bandwidth (T1's strict holds, counted once
+    per up tunnel: the sum of their requests; 0 for T2). T2 only (None for T1): heads_with_capacity,
+    insufficient_resolution (live heads exist but no whole unit per tunnel fits, U == 0: the
+    program has no tunnels), max_fractional_bandwidth_per_tunnel (the exact fluid optimum s*, a
+    Fraction), max_bandwidth_per_tunnel (U), planned_bandwidth_per_tunnel (u),
+    total_planned_bandwidth (K*u), total_tunnel_cost (the route-cost sum, can exceed 2^64),
+    headroom_penalty (with prefer_headroom only) and max_lossless_offer (the program's lossless
+    maximum on the view it was planned on; a dead head's share blocks it). Exact ints. A plan
+    describes the computation that installed the tunnels: forward returns it unchanged, its
+    bounds not recomputed for the new offer, load or black holes.
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def design_by_head(self) -> tuple[tuple[int, int], ...]:
+        """
+        ((head, share), ...): every roster head's share RR(D, H, i), ascending NodeId
+        """
+
+    @property
+    def design_demand(self) -> int | float:
+        """
+        the design volume D in units; float('inf') when unlimited
+        """
+
+    @property
+    def headroom_penalty(self) -> int | None:
+        """
+        T2 with prefer_headroom: the sum over the links' tunnel slots j of floor(2^32 (B - V + j*u) / B)
+        (B: static capacity; V: free capacity); None without prefer_headroom and for T1
+        """
+
+    @property
+    def heads_with_capacity(self) -> tuple[int, ...] | None:
+        """
+        T2: the heads that reach a destination over links with free capacity >= 1 (ascending); None for T1
+        """
+
+    @property
+    def insufficient_resolution(self) -> bool | None:
+        """
+        T2: True when live heads exist but no whole unit per tunnel fits (max_bandwidth_per_tunnel 0,
+        no tunnels)
+        """
+
+    @property
+    def max_bandwidth_per_tunnel(self) -> int | None:
+        """
+        T2: U, the largest common whole-unit size
+        """
+
+    @property
+    def max_fractional_bandwidth_per_tunnel(self) -> fractions.Fraction | None:
+        """
+        T2: the exact fluid optimum s* (a fractions.Fraction; 0 without a live head); None for T1
+        """
+
+    @property
+    def max_lossless_offer(self) -> int | None:
+        """
+        T2: F, the program's lossless maximum on the view it was planned on (a dead head's share blocks
+        it); forward keeps the plan unchanged
+        """
+
+    @property
+    def planned_bandwidth_per_tunnel(self) -> int | None:
+        """
+        T2: u, every tunnel's planned bandwidth
+        """
+
+    @property
+    def total_planned_bandwidth(self) -> int | None:
+        """
+        T2: K*u over the K tunnels
+        """
+
+    @property
+    def total_reserved_bandwidth(self) -> int:
+        """
+        the strict holds of the up tunnels, each tunnel's request counted once
+        """
+
+    @property
+    def total_tunnel_cost(self) -> int | None:
+        """
+        T2: the sum of cost * tunnel count over the links (exact; can exceed 2^64)
+        """
+
+    @property
+    def tunnels_per_head(self) -> int:
+        """
+        the tunnels per head (T2 up to: the chosen count)
+        """
+
+class PlacementResult:
+    """
+    The result of one call. This call: call_delivered (units delivered by the call; replace, forward
+    and evaluate: the full new delivery), call_undelivered (request - call_delivered; float('inf') for
+    an infinite request), delivery_delta (new minus old delivery, may be negative), call_edge_drops
+    [(EdgeId, units)], call_source_drops, termination, routes_changed, weights_changed and
+    reservations_changed. The
+    demand's state after the call (totals of the epoch): program (the installed ForwardingProgram;
+    evaluate: the computed one; None before the first preparation), plan (a TunnelPlan for T1 and T2;
+    None for every other model), requested (float('inf') after an infinite request), offered (LOSSY: the traffic sent; None when LOSSLESS), admitted, delivered, unadmitted
+    (LOSSLESS: requested - delivered, None after an infinite request; LOSSY: 0), source_drops,
+    edge_drops [(EdgeId, units)], by_source (one SourceFlow per normalized input source, ascending
+    NodeId), by_tunnel (one TunnelFlow per program tunnel, ascending entry_id; an alternative view, never
+    added to by_source), total_cost (controllers: CentralizedTE and ShortestPaths OPTIMIZED; else None)
+    and marginal_cost_curve (unrestricted CentralizedTE with the optimized source allocation only).
+    LOSSY: offered = source_drops + sum(edge_drops) + delivered. The rows sum to the totals, except, under
+    LOSSY, for an empty roster and for a forwarding whose remaining captured source weights are all 0
+    (a controller program that sent nothing, or a mask that left only zero-weight heads): the whole
+    offer is then the demand's source drops and every row is zero. Optional outputs, None unless requested: edge_flows, residual and edge_reservations
+    (int64[E]), saturated_boundary_edges, min_cut (they describe the same
+    state; evaluate: the evaluated one). Amounts that accumulate are exact ints (they may exceed 64 bits).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def admitted(self) -> int:
+        """
+        LOSSLESS: the total carried; LOSSY: offered
+        """
+
+    @property
+    def by_source(self) -> tuple[SourceFlow, ...]:
+        """
+        one SourceFlow per normalized input source, ascending NodeId (zero rows included)
+        """
+
+    @property
+    def by_tunnel(self) -> tuple[TunnelFlow, ...]:
+        """
+        one TunnelFlow per program tunnel, ascending entry_id (empty without tunnels)
+        """
+
+    @property
+    def call_delivered(self) -> int:
+        """
+        the units placed (delivered) by this call
+        """
+
+    @property
+    def call_edge_drops(self) -> list[tuple[int, int]]:
+        """
+        this call's drops on links [(EdgeId, units)], ascending EdgeId (empty unless LOSSY)
+        """
+
+    @property
+    def call_source_drops(self) -> int:
+        """
+        this call's offered units lost at sources without a usable route (LOSSY)
+        """
+
+    @property
+    def call_undelivered(self) -> int | float:
+        """
+        the request minus call_delivered, in units (an amount, not a status); float('inf') for an infinite
+        request
+        """
+
+    @property
+    def delivered(self) -> int:
+        """
+        the units the demand delivers
+        """
+
+    @property
+    def delivery_delta(self) -> int:
+        """
+        the delivery after the call minus before it (call_delivered for a placement; may be negative
+        for a full-offer call)
+        """
+
+    @property
+    def edge_drops(self) -> list[tuple[int, int]]:
+        """
+        the epoch's drops on links [(EdgeId, units)], ascending EdgeId (empty unless LOSSY)
+        """
+
+    @property
+    def edge_flows(self) -> numpy.typing.NDArray[numpy.int64] | None:
+        """
+        if requested: the policy's own allocation per edge after the call (int64[E], EdgeId order),
+        else None
+        """
+
+    @property
+    def edge_reservations(self) -> numpy.typing.NDArray[numpy.int64] | None:
+        """
+        if requested: the policy's own strict holds per edge after the call (int64[E], EdgeId order; zeros
+        for a model without holds), else None
+        """
+
+    @property
+    def marginal_cost_curve(self) -> list[tuple[int, int]] | None:
+        """
+        unrestricted CentralizedTE with the optimized source allocation: the marginal cost curve [(cost, units)] of the policy's
+        flow as the call's solve computed it (a positive place: the cumulative flow; evaluate and replace,
+        a zero offer included: the whole offer); place(0) keeps the stored curve (None before the epoch's
+        first solve or forward; after a forward, None for a nonempty roster and [] for an empty one);
+        a forward with a nonempty roster solves nothing and reports None; with an empty roster every
+        call but place(0) reports []; in ascending cost, delivering `units` more raised the minimum total flow cost by `cost`
+        per unit (more delivery can reroute earlier flow, so these are not the costs of the final
+        paths). None for the other models and prescribed (EQUAL or WEIGHTED) sources
+        """
+
+    @property
+    def min_cut(self) -> list[int] | None:
+        """
+        if requested (OutputOptions(min_cut=True)), unrestricted CentralizedTE with the optimized source allocation, when the solve
+        reached the maximum flow: the minimum cut closest to the sources, every allowed edge leaving
+        the nodes the roster sources reach in the residual network (free capacity plus the policy's
+        own allocation), an edge with nothing free (capacity 0, or held by others) included,
+        ascending EdgeId; [] for an empty roster, place(0) excepted. None otherwise (another model,
+        prescribed EQUAL or WEIGHTED sources, a support, a solve stopped below the maximum, place(0),
+        a forward with a nonempty roster)
+        """
+
+    @property
+    def offered(self) -> int | None:
+        """
+        LOSSY: the traffic sent in the epoch (the first-hop injection of an infinite request); None
+        when LOSSLESS
+        """
+
+    @property
+    def plan(self) -> TunnelPlan | None:
+        """
+        T1 and T2: the TunnelPlan of the program after the call; None for every other model (Pinned over
+        a tunnel program too)
+        """
+
+    @property
+    def program(self) -> ForwardingProgram | None:
+        """
+        the installed ForwardingProgram after the call (evaluate: the computed one); None before the first
+        preparation
+        """
+
+    @property
+    def requested(self) -> int | float:
+        """
+        the sum of the epoch's requests; float('inf') after an infinite one
+        """
+
+    @property
+    def reservations_changed(self) -> bool:
+        """
+        True when a tunnel's requested or reserved amount differs from the installed program's, by
+        entry_id (an absent tunnel holds 0): only T1 sets it; forward and Pinned never do
+        """
+
+    @property
+    def residual(self) -> numpy.typing.NDArray[numpy.int64] | None:
+        """
+        if requested: the ledger's residual after the call (int64[E], EdgeId order), else None
+        """
+
+    @property
+    def routes_changed(self) -> bool:
+        """
+        True when the call's program differs from the installed one in its ordered heads, paths, split
+        tables or duplicates (no program counts as the empty program; two programs without an entry
+        are equal). An offer-only change (forward, Pinned, ShortestPaths increments) and an identical
+        replace set nothing
+        """
+
+    @property
+    def saturated_boundary_edges(self) -> list[int] | None:
+        """
+        if requested: the ledger's saturation report after the call
+        (FlowLedger.saturated_boundary_edges of the policy's sources and Eligibility), else None
+        """
+
+    @property
+    def source_drops(self) -> int:
+        """
+        LOSSY: the offered units lost at sources (no usable route, or an empty roster); 0 when LOSSLESS
+        """
+
+    @property
+    def termination(self) -> Termination:
+        """
+        the call's outcome (Termination)
+        """
+
+    @property
+    def total_cost(self) -> int | None:
+        """
+        controllers (CentralizedTE, ShortestPaths OPTIMIZED): the exact sum of cost * flow over the policy's
+        allocation; None for the other models (T1, T2, Pinned)
+        """
+
+    @property
+    def unadmitted(self) -> int | None:
+        """
+        LOSSLESS: requested - delivered, None after an infinite request; LOSSY: 0
+        """
+
+    @property
+    def weights_changed(self) -> bool:
+        """
+        True when the call's program differs from the installed one in its injection (source weights)
+        or any entry or split-table weight (a controller's re-solve that changes a path's amount; an
+        absent entry weighs 0)
+        """
+
+class ShortestPathCacheStats:
+    """
+    ShortestPathCache statistics (atomic per field, not a consistent snapshot): hits, misses,
+    entries, bytes (the entries' retained payload), live_values (values alive anywhere).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @property
+    def bytes(self) -> int:
+        """
+        the retained payload of the entries (their DAGs' stored arrays)
+        """
+
+    @property
+    def entries(self) -> int:
+        """
+        the entries held
+        """
+
+    @property
+    def hits(self) -> int:
+        """
+        lookups answered from an entry (they persist across clear())
+        """
+
+    @property
+    def live_values(self) -> int:
+        """
+        the cached values alive anywhere, entries included
+        """
+
+    @property
+    def misses(self) -> int:
+        """
+        lookups without an entry: a building cache searched, a frozen one raised ShortestPathCacheMiss
+        """
+
+class ShortestPathCacheMiss(Exception):
+    """
+    A lookup in a frozen ShortestPathCache whose key is absent: a dedicated exception (not a
+    RuntimeError or ValueError); the evaluators propagate it unchanged.
+    """
+
+class ShortestPathCache:
+    """
+    A cache of static shortest-path DAGs (from costs and the Eligibility only) for one graph, keyed by
+    (the root set, the direction, the Eligibility uid). It stores the full DAG and applies each
+    caller's route choice afterwards, so the route choice is never cached. ShortestPaths policies and the
+    evaluators read it.
+    Building mode (a new cache): one exclusive lease per call; a miss searches and inserts;
+    clear() empties it (the hit and miss counters persist), and values already handed out stay valid.
+    Frozen mode (freeze()): read-only and shareable by every worker; a miss counts one miss and raises
+    ShortestPathCacheMiss; clear() raises ValueError; thaw() waits for active calls, then returns to building.
+    Lifecycle calls take exclusive FIFO admission and cannot be overtaken by later calls.
+    When a public call fails: a building cache passed to it keeps the complete entries and statistics
+    of the lookups that succeeded before the failure (never a partial entry; a kept entry never
+    changes a result); a frozen cache's statistics stay unchanged, except one miss when the call
+    raised ShortestPathCacheMiss. A frozen cache counts its hits only when the call succeeds, Python result
+    included.
+    """
+
+    def __init__(self, graph: Graph) -> None:
+        """
+        An empty cache in building mode, bound to graph (by its uid).
+        """
+
+    def clear(self) -> None:
+        """
+        empty a building cache; ValueError when frozen
+        """
+
+    def freeze(self) -> None:
+        """
+        wait for active calls and enter frozen mode (no effect when frozen)
+        """
+
+    def graph_uid(self) -> int:
+        """
+        uid of the graph this cache is bound to
+        """
+
+    def stats(self) -> ShortestPathCacheStats:
+        """
+        the current ShortestPathCacheStats (each field read atomically)
+        """
+
+    def thaw(self) -> None:
+        """
+        wait for active calls and return to building mode (no effect when building)
+        """
+
+@typing.final
+class FlowPolicy:
+    """
+    The placement engine for one demand, bound to its ledger at construction. A final Python class.
+    Native computation releases the GIL; one ledger gate serializes calls and mutable reads. Every call (place,
+    evaluate, replace, forward) is all-or-nothing: a failed call raises and leaves the ledger and the
+    policy as they were (with the two limits stated in the package docstring). remove()
+    takes every flow of the policy back out, clears its program and starts a new epoch (the request
+    total starts again from 0); replace and forward start one too. A policy dropped without remove()
+    leaves its records in the ledger as orphans: readable, never changed again, cleared by
+    FlowLedger.reset(). sources and destinations are one NodeId or a sequence; the two sets must not
+    overlap. ValueError for invalid endpoints, configurations and requests and for objects of another
+    graph, ledger or policy; TypeError for a ledger (None included), config, eligibility, cache or
+    outputs of the wrong class, a node id or a request of a wrong type (a bool, a float node id, a
+    string) and an unknown keyword.
+    """
+
+    def __init__(
+        self,
+        ledger: FlowLedger,
+        sources: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        destinations: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer],
+        config: FlowPolicyConfig,
+        eligibility: Eligibility | None = None,
+        cache: ShortestPathCache | None = None,
+    ) -> None:
+        """
+        Bind a policy to ledger. eligibility (None: everything allowed) and cache (None: none; only ShortestPaths
+        routing reads it, another model rejects it) belong to the ledger's graph; the policy keeps the
+        ledger, eligibility and cache alive (a Pinned policy shares its program and black holes). The roster
+        (the sources that statically reach an allowed destination, over allowed edges whatever their
+        capacity, the tunnel models' heads; Pinned: the program's heads that reach an allowed destination over its basis
+        under eligibility) is fixed here. Everything is validated before the policy binds, in this order: the endpoints, the
+        graph of eligibility, the program, the support, the cache and the black holes (`foreign Eligibility:
+        built for another graph`, `program belongs to another graph`, `support belongs to another graph`,
+        `foreign ShortestPathCache: bound to another graph`, `black_holes belongs to another graph`), the
+        configuration (FlowPolicyConfig's order, the pooled single-path rule and T2's several-sources rule
+        included), the tunnel limit (`tunnel limit exceeded:
+        <H> heads x <N> tunnels > 1073741823`) and a Pinned program's endpoints (`program endpoints do not
+        match policy endpoints`).
+        """
+
+    def delivered(self) -> int:
+        """
+        the sum of delivered over the policy's live records
+        """
+
+    def evaluate(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult:
+        """
+        A full, independent computation and forwarding of offer (int units or float('inf')) from the
+        policy's own released view (the residual plus its own carried load; T1 sets up on the unreserved
+        capacity with its own holds released; T2 lays out on the released residual), as replace would do it -> PlacementResult (the computed
+        program and plan, the flags replace would set, the outputs of the evaluated state); publishes
+        nothing, creates no record, books no hold and leaves the epoch as it was. design_demand as for
+        replace. LOSSY requires a finite offer.
+        """
+
+    def forward(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        black_holes: Eligibility | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult:
+        """
+        Forward a full new offer over the installed program, with no route computation and no setup, on the
+        released view -> PlacementResult; a new epoch like replace, the program, its plan and T1's holds
+        kept (no flag; T1's records are recreated with the same edge_reservations). LOSSLESS admits the
+        program's lossless bound up to the offer; LOSSY sends the offer. black_holes (an Eligibility of the
+        graph): the nodes and edges it excludes are black holes for this call (stale forwarding: traffic
+        reaching one is dropped there; a black-holed source loses its share). In this order: Pinned raises
+        `Pinned forwards with replace`; the offer; LOSSY +inf `LOSSY forwarding requires a finite offer`;
+        black_holes of another graph `black_holes belongs to another graph`; then, under the gate,
+        no installed program `forward requires an installed program`.
+        """
+
+    def place(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult:
+        """
+        Place offer (int units in [0, 2^62), or float('inf')) all or nothing -> PlacementResult. T1 and T2
+        raise `<DistributedTE or CentralizedTE with tunnel_count> does not support incremental placement`
+        (also for 0).
+        Requests add up within an epoch (from construction, the last remove(), replace() or forward());
+        after float('inf') any finite request is rejected, 0 included. A request of 0 places nothing and
+        reports the current state. ShortestPaths prepares its program at the epoch's first positive request.
+        LOSSLESS admits the largest total in [admitted, admitted + offer] that the program carries with no
+        loss (a refused unit is not offered again); LOSSY forwards the new round-robin (or captured-weight)
+        injections, each head splitting its increment afresh (earlier drops are not offered again); a
+        controller re-solves admitted + offer. A LOSSY float('inf') is ShortestPaths's first-hop experiment;
+        Pinned raises `LOSSY forwarding requires a finite offer`. outputs (OutputOptions; None: none)
+        requests edge_flows, residual, saturated_boundary_edges, edge_reservations and min_cut. Everything is
+        validated before any change; a
+        failed call raises with the ledger and the policy unchanged. A solve of the flow core (CentralizedTE
+        or ShortestPaths OPTIMIZED) on a network beyond its int32 numbering raises ValueError:
+        more than INT32_MAX - 2 nodes, or more than 2^30 - 1 edges, sources and destinations together. A
+        LOSSY forwarding whose losses wait on each other in a cycle raises ValueError when its rounds
+        alternate between two states or reach the round limit, RuntimeError when the result's check fails.
+        """
+
+    def record(
+        self, flow_id: tuple[typing.SupportsIndex, typing.SupportsIndex]
+    ) -> FlowRecord:
+        """
+        one of the policy's live records by FlowId (ValueError for a FlowId of another ledger or policy, a
+        retired or an unknown id)
+        """
+
+    def records(self) -> list[FlowRecord]:
+        """
+        the policy's live records as snapshots in FlowId order
+        """
+
+    def remove(self) -> None:
+        """
+        revert every flow and hold of the policy, retire the ids, clear the program, open a new epoch
+        """
+
+    def replace(
+        self,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        outputs: OutputOptions | None = None,
+    ) -> PlacementResult:
+        """
+        Recompute from the policy's own released view and forward the full offer, published atomically ->
+        PlacementResult: the old records and holds are retired (their ids never live again), new ones
+        created, and a new epoch starts at this offer (delivery may go down: delivery_delta). ShortestPaths
+        prepares its routes again on that view; a
+        controller re-solves; T1 sets its tunnels up again for the design and books their holds; T2 lays its
+        tunnels out again for the design (planned bandwidth, never held);
+        Pinned forwards its program. design_demand (T1 and T2: int units, or float('inf'); None: equal to
+        the offer): T1 needs a finite design (`DistributedTE requires a finite design demand`), T2 takes an unlimited
+        one (its largest common size); every other model raises `<model> does not accept design_demand`.
+        In this order: the offer, LOSSY's finite offer, then the design demand (the model, its domain,
+        finiteness).
+        """
+
+    @property
+    def config(self) -> FlowPolicyConfig:
+        """
+        the configuration as validated at construction, ShortestPaths' absent
+        source_allocation and weight_basis resolved to the allocation's defaults
+        """
+
+    @property
+    def program(self) -> ForwardingProgram | None:
+        """
+        the installed ForwardingProgram; None before the first preparation and after remove()
+        """
+
+class BatchMode:
+    """
+    How apply_actions runs its list. ORDERED: each action as its scalar call, in list order, on the
+    state the earlier actions left (earlier actions are served first). SIMULTANEOUS: every action forwarded at
+    the same time on one view, losses shared on links across the demands.
+
+    Members:
+
+      ORDERED
+
+      SIMULTANEOUS
+    """
+
+    ORDERED: typing.ClassVar[BatchMode]
+    SIMULTANEOUS: typing.ClassVar[BatchMode]
+    __members__: typing.ClassVar[dict[str, BatchMode]]
+
+    @typing.overload
+    def __eq__(self, other: BatchMode, /) -> bool: ...
+    @typing.overload
+    def __eq__(self, other: typing.Any, /) -> bool: ...
+    def __getstate__(self) -> int: ...
+    def __hash__(self) -> int: ...
+    def __index__(self) -> int: ...
+    def __init__(self, value: typing.SupportsInt | typing.SupportsIndex) -> None: ...
+    def __int__(self) -> int: ...
+    @typing.overload
+    def __ne__(self, other: BatchMode, /) -> bool: ...
+    @typing.overload
+    def __ne__(self, other: typing.Any, /) -> bool: ...
+    def __repr__(self) -> str: ...
+    def __setstate__(
+        self, state: typing.SupportsInt | typing.SupportsIndex, /
+    ) -> None: ...
+    def __str__(self) -> str: ...
+    @property
+    def name(self) -> str: ...
+    @property
+    def value(self) -> int: ...
+
+class Place:
+    """
+    An incremental place(offer) of policy in an apply_actions list (ORDERED only). An immutable value:
+    policy (a FlowPolicy, kept alive) and offer (int units or a float, kept as given; another type
+    raises TypeError here, a value outside the domain raises the call's ValueError at apply_actions).
+    """
+
+    def __init__(
+        self, policy: FlowPolicy, offer: typing.SupportsIndex | float | numpy.floating
+    ) -> None: ...
+    @property
+    def offer(self) -> int | float:
+        """
+        the offer as given (int units or a float)
+        """
+
+    @property
+    def policy(self) -> FlowPolicy:
+        """
+        the FlowPolicy
+        """
+
+class Replace:
+    """
+    A replace(offer, design_demand) of policy in an apply_actions list; SIMULTANEOUS takes it only for
+    ShortestPaths EQUAL or WEIGHTED and for Pinned. An immutable value: policy (kept alive), offer and
+    design_demand (int units or a float, kept as given; None: absent; another type raises TypeError
+    here, a value outside the domain raises the call's ValueError at apply_actions).
+    """
+
+    def __init__(
+        self,
+        policy: FlowPolicy,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+    ) -> None: ...
+    @property
+    def design_demand(self) -> int | float | None:
+        """
+        the design demand as given (int units or a float); None: absent
+        """
+
+    @property
+    def offer(self) -> int | float:
+        """
+        the offer as given (int units or a float)
+        """
+
+    @property
+    def policy(self) -> FlowPolicy:
+        """
+        the FlowPolicy
+        """
+
+class Forward:
+    """
+    A forward(offer, black_holes) of policy over its installed program in an apply_actions list. An
+    immutable value: policy and black_holes (an Eligibility of the policy's graph or None) kept alive,
+    offer (int units or a float, kept as given; another type raises TypeError here, a value outside
+    the domain raises the call's ValueError at apply_actions).
+    """
+
+    def __init__(
+        self,
+        policy: FlowPolicy,
+        offer: typing.SupportsIndex | float | numpy.floating,
+        *,
+        black_holes: Eligibility | None = None,
+    ) -> None: ...
+    @property
+    def black_holes(self) -> Eligibility | None:
+        """
+        the black holes (an Eligibility); None: none
+        """
+
+    @property
+    def offer(self) -> int | float:
+        """
+        the offer as given (int units or a float)
+        """
+
+    @property
+    def policy(self) -> FlowPolicy:
+        """
+        the FlowPolicy
+        """
+
+class EvaluationOptions:
+    """
+    The options of every evaluator (evaluate_demand, evaluate_pairs, evaluate_edge_failures): config
+    (the configuration), eligibility (the static Eligibility; None: all allowed), cache (the
+    ShortestPathCache; None: private per worker), outputs (the optional outputs of each result;
+    evaluate_edge_failures: of its baseline), design_demand and
+    offer (int units or a float, kept as given; another type raises TypeError). offer: a finite offer
+    for every model (None: the uncapped LOSSLESS question, or for ShortestPaths EQUAL/WEIGHTED with
+    LOSSY the first-hop experiment; required for DistributedTE, Pinned and, without a finite design,
+    CentralizedTE with tunnel_count under LOSSY). design_demand: DistributedTE always, required and
+    finite; CentralizedTE with tunnel_count: None means the offer when it is finite, else unlimited;
+    every other model leaves it None. The evaluators check both after the configuration, in this order:
+    an explicit offer (`offer must be an integer in [0, 2^62)`, +inf included), the design
+    (`<model> does not accept design_demand`, `design_demand must be an integer in [0, 2^62) or
+    permitted +inf`, `DistributedTE requires a finite design demand`), DistributedTE's missing design
+    (`DistributedTE evaluation requires design_demand`), the missing LOSSY offer (`<DistributedTE or
+    CentralizedTE or Pinned> LOSSY evaluation requires a finite offer`).
+    """
+
+    def __init__(
+        self,
+        config: FlowPolicyConfig,
+        *,
+        eligibility: Eligibility | None = None,
+        cache: ShortestPathCache | None = None,
+        outputs: OutputOptions | None = None,
+        design_demand: typing.SupportsIndex | float | numpy.floating | None = None,
+        offer: typing.SupportsIndex | float | numpy.floating | None = None,
+    ) -> None: ...
+    @property
+    def cache(self) -> ShortestPathCache | None:
+        """
+        the supplied ShortestPathCache; None: a private cache per worker
+        """
+
+    @property
+    def config(self) -> FlowPolicyConfig:
+        """
+        the FlowPolicyConfig of every evaluated policy (evaluate_edge_failures: the baseline and every deletion)
+        """
+
+    @property
+    def design_demand(self) -> int | float | None:
+        """
+        the tunnel models' design volume as given (int units or a float); None: absent
+        """
+
+    @property
+    def eligibility(self) -> Eligibility | None:
+        """
+        the static Eligibility; None: everything allowed
+        """
+
+    @property
+    def offer(self) -> int | float | None:
+        """
+        the offer as given (int units or a float); None: absent
+        """
+
+    @property
+    def outputs(self) -> OutputOptions:
+        """
+        the OutputOptions of every result (evaluate_edge_failures: of the baseline)
+        """
+
+class SensitivityEntry:
+    """
+    One candidate edge: edge and delivery_reduction (int units: the baseline's delivery minus the
+    delivery without the edge; signed).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @property
+    def delivery_reduction(self) -> int: ...
+    @property
+    def edge(self) -> int: ...
+
+class SensitivityResult:
+    """
+    baseline (the PlacementResult of evaluate_demand()) and entries (ascending EdgeId; an
+    absent edge has reduction 0).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    @property
+    def baseline(self) -> PlacementResult: ...
+    @property
+    def entries(self) -> list[SensitivityEntry]: ...
+
+class KspOptions:
+    """
+    The options of ksp: k (>= 1); tie_break (RouteTieBreak) orders paths of equal cost;
+    parallel_edges = True lists each parallel edge as a separate path, False keeps one per (u, v)
+    pair by the tie rule (no multipath field: k sets the number of paths); cost_ceiling (None,
+    AbsoluteCost(c) with c >= 0, or CostStretch(n/d) with n/d >= 1 times the static shortest
+    cost under the eligibility, compared exactly, residual ignored; inclusive); residual (int64 units per
+    EdgeId, each in [0, edge_capacity_units]: edges with less than 1 unit are skipped, and the values
+    feed the availability; it is the only capacity threshold, and without it an edge of capacity 0 is
+    searched like any other); eligibility (None: everything allowed). A parallel_edges that is not a
+    bool raises TypeError here; the other fields are validated by ksp, in the order its docstring
+    gives.
+    """
+
+    def __init__(
+        self,
+        k: typing.SupportsIndex,
+        *,
+        tie_break: RouteTieBreak = ...,
+        parallel_edges: bool = True,
+        cost_ceiling: AbsoluteCost | CostStretch | None = None,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        eligibility: Eligibility | None = None,
+    ) -> None: ...
+    @property
+    def cost_ceiling(self) -> AbsoluteCost | CostStretch | None:
+        """
+        the inclusive cost ceiling as given: None, AbsoluteCost or CostStretch (validated by ksp)
+        """
+
+    @property
+    def eligibility(self) -> Eligibility | None:
+        """
+        the static Eligibility; None: everything allowed
+        """
+
+    @property
+    def k(self) -> typing.SupportsIndex:
+        """
+        the number of paths as given (validated by ksp: an integer >= 1)
+        """
+
+    @property
+    def parallel_edges(self) -> bool:
+        """
+        True: each parallel edge a separate path; False: one per (u, v) pair by the tie rule
+        """
+
+    @property
+    def residual(
+        self,
+    ) -> (
+        collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ):
+        """
+        the residual units per EdgeId as given (validated by ksp); None: no capacity filter;
+        the tie scores read static capacity
+        """
+
+    @property
+    def tie_break(self) -> RouteTieBreak:
+        """
+        the RouteTieBreak of paths of equal cost
+        """
+
+class SpfOptions:
+    """
+    The options of spf: the direction; targets (one NodeId or a sequence; None: a full search)
+    stops the search at the nearest targets (anycast: any nearest target will do); tie_break
+    (RouteTieBreak) orders equal-cost choices; multipath (True: every equal-cost walk as a DAG,
+    False: the one canonical path, targets required); parallel_edges (True: every eligible parallel
+    edge, False: one per (u, v) pair by the tie rule); a HIGHER_* tie_break with multipath and
+    parallel_edges both True is rejected by spf; residual (int64 units per EdgeId, each in [0,
+    edge_capacity_units]) makes the search skip edges with fewer than min_residual residual units
+    (an integer >= 1; without a residual it has no effect) and supplies the availability: it is the
+    only capacity threshold, and without it an edge of capacity 0 is searched like any other;
+    eligibility (None: everything allowed). A direction outside its enumeration raises ValueError
+    here, a multipath or parallel_edges that is not a bool TypeError; the other fields are validated
+    by spf, in the order its docstring gives.
+    """
+
+    def __init__(
+        self,
+        direction: Direction,
+        *,
+        targets: typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        tie_break: RouteTieBreak = ...,
+        multipath: bool = True,
+        parallel_edges: bool = True,
+        residual: collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None = None,
+        min_residual: typing.SupportsIndex = 1,
+        eligibility: Eligibility | None = None,
+    ) -> None: ...
+    @property
+    def direction(self) -> Direction:
+        """
+        FORWARD or REVERSE
+        """
+
+    @property
+    def eligibility(self) -> Eligibility | None:
+        """
+        the static Eligibility; None: everything allowed
+        """
+
+    @property
+    def min_residual(self) -> typing.SupportsIndex:
+        """
+        the gating threshold in units as given (validated by spf: an integer >= 1)
+        """
+
+    @property
+    def multipath(self) -> bool:
+        """
+        True: every equal-cost walk (a DAG); False: the canonical single path
+        """
+
+    @property
+    def parallel_edges(self) -> bool:
+        """
+        True: every eligible parallel edge; False: one per (u, v) pair by the tie rule
+        """
+
+    @property
+    def residual(
+        self,
+    ) -> (
+        collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ):
+        """
+        the residual units per EdgeId as given (validated by spf); None: no capacity filter;
+        the tie scores read static capacity
+        """
+
+    @property
+    def targets(
+        self,
+    ) -> (
+        typing.SupportsIndex
+        | collections.abc.Sequence[typing.SupportsIndex]
+        | numpy.typing.NDArray[numpy.integer]
+        | None
+    ):
+        """
+        the targets as given (validated by spf); None: a full search
+        """
+
+    @property
+    def tie_break(self) -> RouteTieBreak:
+        """
+        the RouteTieBreak of equal-cost choices
+        """
+
+class SpfResult:
+    """
+    The result of spf: costs (full searches: a read-only int64 array, UNREACHABLE for the nodes not
+    reached; None with targets), dag (PredecessorDAG of the tight edges, the edges on some shortest walk,
+    one per (u, v) pair with parallel_edges = False, each in its own direction; with targets only the
+    walks between the roots and a nearest target, for REVERSE from the target to a root; for
+    multipath = False the canonical single path) and
+    target_cost (with targets: the nearest targets' cost, None when no target is reached; None for a
+    full search).
+    """
+
+    def __init__(self, _no_public_constructor: typing.Never, /) -> None: ...
+    def __repr__(self) -> str: ...
+    @property
+    def costs(self) -> numpy.typing.NDArray[numpy.int64] | None:
+        """
+        full search: each node's distance from the roots for FORWARD, or to the roots for REVERSE
+        (read-only int64[N], UNREACHABLE for nodes not reached); None with targets
+        """
+
+    @property
+    def dag(self) -> PredecessorDAG:
+        """
+        the PredecessorDAG of the result, in the edges' original orientation
+        """
+
+    @property
+    def target_cost(self) -> int | None:
+        """
+        with targets: the cost of the nearest targets, None when no target is reached; None for a
+        full search
+        """
+
+def apply_actions(
+    ledger: FlowLedger,
+    actions: collections.abc.Sequence[Place | Replace | Forward],
+    *,
+    mode: BatchMode = ...,
+    outputs: OutputOptions | None = None,
+) -> list[PlacementResult]:
+    """
+    Run the actions of several policies of ledger (a sequence of Place, Replace and Forward) as one
+    transaction -> list[PlacementResult], one per action in input order, each the scalar call's fields
+    for its policy. The whole list is validated first, then computed, then published once (one exchange
+    of every policy's records, then their epochs): a failed call raises with the ledger and every
+    policy unchanged (with the two limits stated in the package docstring). A policy appears
+    at most once, and every policy belongs to ledger.
+    mode ORDERED: each action runs in list order on a private working state exactly as its scalar call
+    would on the state the earlier actions left (their carried load and holds); new records take
+    FlowIds in list order. Earlier actions are served first: a reservation gives no protection. mode SIMULTANEOUS:
+    Replace of ShortestPaths EQUAL or WEIGHTED (routes prepared on the view) and of Pinned, Forward of
+    any policy with an installed program, every one LOSSY with a finite offer, forwarded at the same
+    time on one view: the residual plus every participant's old carried load (outside owners and orphans
+    stay; holds are never added). At a link that cannot carry its arrivals the loss is shared by highest
+    averages over the demands (ties by policy creation order, never by list position), then over each
+    demand's sources, then its tunnels; each participant's black holes are its own. Permuting the list
+    changes nothing. outputs (OutputOptions; None: none) as for the scalar calls: residual and
+    saturated_boundary_edges read the state after that action (ORDERED) or after the whole list
+    (SIMULTANEOUS, one residual for every entry, each entry's boundary from its own sources and mask).
+    Checked in this order: the arguments' types (TypeError: `ledger must be a FlowLedger`, `actions must
+    be a sequence of Place, Replace or Forward (got <type>)`, `actions[<i>] must be a Place, Replace or
+    Forward (got <type>)`, `mode must be a BatchMode (got <type>)`, `outputs must be an OutputOptions
+    (got <type>)`); mode's value (`mode: <v> is not a value of BatchMode`); then each action's
+    argument/immutable checks in list order: `list policy belongs
+    to another ledger`, `duplicate policy in list`, SIMULTANEOUS's own rules (`SIMULTANEOUS does not
+    accept Place`, `SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned`,
+    `SIMULTANEOUS requires admission=LOSSY`, `SIMULTANEOUS requires finite offers`), then the scalar
+    call's argument checks. Ledger usability and every action's mutable state are then checked under
+    the gate, in list order, before any computation. An empty list checks usability and mode, then
+    returns []. An error of the computation (a
+    loss-iteration error, a solver or forwarding size limit, the record identity limit counted for the
+    whole list) publishes nothing.
+    """
+
+@typing.overload
+def as_float(
+    x: collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> numpy.typing.NDArray[numpy.float64]:
+    """
+    Units to physical value(s): the exact product x*q correctly rounded to binary64, nearest
+    with ties to even; exact for abs(x) <= 2^53. x is any signed, unbounded integer: an int or NumPy integer gives a
+    float, an integer vector a float64 array. An int or NumPy integer, a subclass included,
+    is never read as a sequence. An integer position accepts __index__, never
+    a bool; other types raise TypeError. q is a power of two in [2^-32, 2^32] (float, NumPy
+    float or integer). The result is finite iff abs(x*q) < 2^1024 - 2^970; otherwise raise
+    ValueError('as_float: <x> units times the resolution exceed the largest finite double').
+    Exact for abs(x) <= 2^53 inclusive. Above 2^53 an integer of binary length L is exact
+    iff divisible by 2^(L-53); 2^53+1 rounds to 2^53, 2^53+3 to 2^53+4, times q.
+    to_units(as_float(x,q),q)==x holds for x in [0,2^53] at every q, and for larger x in
+    [0,2^62) exactly when x is a double. The first failure is 2^53+1; 2^62-1 rounds to
+    2^62*q and reconversion raises the to_units domain ValueError. A successful to_units
+    result is always exact here; its error against the promoted binary64 input is in
+    (-q/2,q/2]. Choose q before Graph construction, then use Graph.resolution().
+    """
+
+@typing.overload
+def as_float(
+    x: int | numpy.integer, resolution: int | float | numpy.integer | numpy.floating
+) -> float: ...
+@typing.overload
+def as_float(
+    x: typing.SupportsIndex, resolution: int | float | numpy.integer | numpy.floating
+) -> float | numpy.typing.NDArray[numpy.float64]: ...
+def evaluate_demand(
+    graph: Graph,
+    sources: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    destinations: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+) -> PlacementResult:
+    """
+    The evaluation of a fresh FlowPolicy with options.config on a fresh ledger of graph at options.offer
+    (None: +inf; DistributedTE and CentralizedTE with tunnel_count: evaluate(offer, design_demand=...))
+    -> PlacementResult. LOSSLESS delivers up to a finite offer; LOSSY accounts for exactly that offer
+    (ShortestPaths EQUAL/WEIGHTED LOSSY without an offer: the first-hop experiment). The options are checked as
+    the EvaluationOptions docstring states.
+    Without an offer, CentralizedTE(source_allocation=OPTIMIZED) gives the exact maximum flow (a finite offer below
+    it stops the solve there, with no cut); with source_allocation=EQUAL, the largest
+    total whose round-robin source shares are all carried; with WEIGHTED (CentralizedTE without tunnel_count),
+    the largest total whose highest-averages shares of source_weights are all carried.
+    A supplied frozen cache raises ShortestPathCacheMiss
+    for an absent key, unchanged.
+    A failed call raises; a supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.
+    """
+
+def evaluate_edge_failures(
+    graph: Graph,
+    sources: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    destinations: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+    workers: typing.SupportsIndex | None = None,
+) -> SensitivityResult:
+    """
+    The baseline evaluate_demand() and one SensitivityEntry per candidate edge. Candidates: with unrestricted
+    CentralizedTE and the optimized source allocation, the edges that carry flow in the baseline (removing any
+    other edge keeps the baseline feasible, at any offer); otherwise every allowed edge, whatever its capacity (an edge of capacity 0
+    can carry a route, so deleting it can change the result, and with the equal source allocation a deletion that
+    removes a source from the roster can raise the total: a negative reduction). delivery_reduction =
+    baseline.call_delivered minus the call_delivered of a fresh evaluate_demand() without the edge, at the
+    same offer, design and other options, in signed units, never thresholded; it is not the traffic the
+    edge carried. ShortestPaths
+    gives reduction 0 without placing to an edge outside the static shortest-path support reachable from
+    the roster sources (no route can use it). CentralizedTE with a support solves every deletion afresh; Pinned
+    replays the same program under each deletion. workers as evaluate_pairs
+    (NGRAPH_CORE_SENSITIVITY_THREADS). Only ShortestPaths reads the cache, and each placed deletion uses a
+    new Eligibility uid, so a frozen cache raises ShortestPathCacheMiss there.
+    A failed deletion fails the call (the lowest failing candidate's exception, no partial result); a
+    supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.
+    """
+
+def evaluate_pairs(
+    graph: Graph,
+    pairs: collections.abc.Sequence[
+        collections.abc.Sequence[
+            typing.SupportsIndex
+            | collections.abc.Sequence[typing.SupportsIndex]
+            | numpy.typing.NDArray[numpy.integer]
+        ]
+        | numpy.typing.NDArray[numpy.integer]
+    ]
+    | numpy.typing.NDArray[numpy.integer],
+    options: EvaluationOptions,
+    per_pair_eligibility: collections.abc.Sequence[Eligibility | None] | None = None,
+    workers: typing.SupportsIndex | None = None,
+) -> list[PlacementResult]:
+    """
+    evaluate_demand() for each (sources, destinations) pair, results in pair order. Pair i uses
+    options.eligibility intersected with per_pair_eligibility[i] (None entries allowed; a given sequence has one entry per pair,
+    also when empty). workers >= 1; None: NGRAPH_CORE_BATCH_THREADS or 1, and 1 when a cache is
+    supplied. All checks finish before evaluation workers start: the arguments first, then each pair
+    completely in pair order, so the error of the lowest failing pair is raised. First-pass tunnel
+    searches run in parallel under one GIL release, before any lease or gate. Pinned is rejected
+    (`evaluate_pairs does not accept Pinned`: a program has fixed endpoints);
+    an empty batch returns [].
+    Caches: a supplied building cache needs workers == 1; a frozen cache is shared by every worker
+    (pass workers explicitly), and its ShortestPathCacheMiss reaches the caller unchanged (the lowest failing
+    pair's). An intersection that differs from both operands gets a new Eligibility uid, which a
+    frozen cache cannot hold: pass the combined per-pair values with eligibility None, or a common value
+    that contains them.
+    A failed call raises; a supplied ShortestPathCache then behaves as the ShortestPathCache docstring states.
+    """
+
+def ksp(
+    graph: Graph,
+    source: typing.SupportsIndex,
+    destination: typing.SupportsIndex,
+    options: KspOptions,
+) -> list[tuple[int, Path]]:
+    """
+    The k shortest simple source -> destination paths over the eligible edges (only those with residual >= 1 when
+    a residual is given; an edge of capacity 0 is searched like any other) -> [(cost, Path)], each hop
+    a single edge. Order: lowest cost; then, under a HIGHER_* tie_break only, the highest bottleneck
+    (the smallest edge score along the path); then fewest hops; then the smallest EdgeId
+    sequence. The result is the first k paths of that order
+    within the inclusive cost ceiling. A wrong type raises TypeError; structural, range and combination
+    defects raise ValueError. Validated in this order before any work: source and
+    destination in range, source == destination, k >= 1, the ceiling, the residual (length, then every
+    entry), a foreign Eligibility. An excluded endpoint, no static route under a CostStretch ceiling, or
+    no path gives [].
+    """
+
+def resolve_to_paths(
+    graph: Graph,
+    dag: PredecessorDAG,
+    source: typing.SupportsIndex,
+    destination: typing.SupportsIndex,
+    split_parallel_edges: bool = False,
+    max_paths: typing.SupportsIndex | None = None,
+) -> list[Path]:
+    """
+    The source -> destination walks of a DAG -> [Path], in increasing (cost, hops, edge-id sequence):
+    a hop costs its cheapest member and is keyed by its lowest member id. split_parallel_edges = False
+    keeps every parallel member of a (u, v) pair in one hop (members ascending); True gives one path
+    per member combination, sorted by that path's own (cost, hops, edge-id sequence). max_paths
+    (>= 1) truncates; None lists every walk.
+    ValueError: a DAG of another graph, source or destination out of range, source == destination,
+    max_paths < 1. An endpoint outside the DAG, or no walk, gives [].
+    """
+
+def spf(
+    graph: Graph,
+    roots: typing.SupportsIndex
+    | collections.abc.Sequence[typing.SupportsIndex]
+    | numpy.typing.NDArray[numpy.integer],
+    options: SpfOptions,
+) -> SpfResult:
+    """
+    Shortest paths from the roots for FORWARD, or to the roots for REVERSE (one NodeId or a sequence;
+    every root at distance 0), over the eligible edges (only those with residual >= min_residual when
+    a residual is given; an edge of capacity 0 is searched like any other) -> SpfResult. Without
+    targets every reachable node gets its distance: costs and the full DAG of tight edges (the edges
+    on some shortest walk; one per (u, v) pair with parallel_edges = False). With targets the search
+    stops at the nearest targets' cost:
+    target_cost and the DAG of the walks between the roots and a nearest target (for REVERSE, from
+    the target to a root, in the edges' own direction);
+    with multipath = False, instead the canonical single path, the walk minimising (cost, -bottleneck
+    under a HIGHER_* tie_break, hops, EdgeId sequence). Validated in this order before any work
+    (ValueError): the roots (non-empty, ids in range), the targets (the same), a node in both sets,
+    multipath = False without targets, a HIGHER_* tie_break with multipath and parallel_edges both
+    True ('spf tie_break requires multipath=False or parallel_edges=False'), the residual (length,
+    then every entry in [0, edge_capacity_units]),
+    min_residual >= 1, a foreign Eligibility. Excluded roots and targets are skipped; all roots
+    excluded gives an empty result.
+    """
+
+@typing.overload
+def to_units(
+    x: int | float | numpy.floating | numpy.integer,
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> int:
+    """
+    Physical value(s) to whole units of the resolution q: each input is read as its binary64 value b,
+    and b/q is rounded half up to an integer, exactly. Converted back, a result differs from b by at
+    most q/2 (+q/2 exactly at a tie, which goes up).
+    float32 widens exactly; integers become the nearest double, ties to even, so an integer above 2^53
+    can change before the rounding (2^53+1 at q=1 gives 2^53). The result is floor(b/q + 1/2),
+    evaluated exactly, never by floating addition of 1/2 or by reading the printed decimal. Ties are
+    b=(2n+1)*q/2, 0 <= n < 2^52; each gives n+1, never the even neighbour.
+    A scalar or 0-d array gives an int; a sequence or 1-d array gives an int64 array. Negative
+    zero gives 0. NaN, infinity, negative values, an integer too large for NumPy and results
+    at or above 2^62 units raise ValueError. A bool, string, wrong dtype/rank or type other
+    than int, float or NumPy numbers raises TypeError; int/float subclasses use stored values.
+    q must be a power of two in [2^-32, 2^32]: a float, NumPy float or integer (another type
+    raises TypeError, an integer beyond the float range ValueError).
+    N separately rounded values have a total error in (-N*q/2, N*q/2], with no promised sign: round a
+    demand once, then split whole units. A decimal and the double it parses to give the same units
+    only when both lie in the same half-up cell: 5501195.1796 at q=2^-21 gives 11536842473289, whereas
+    its decimal reading would give 11536842473288 (docs/semantics.md, section 1, has the full rule).
+    CostStretch deliberately reads printed decimals for ratios; physical amounts use b.
+    """
+
+@typing.overload
+def to_units(
+    x: collections.abc.Sequence[int | float | numpy.floating | numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> numpy.typing.NDArray[numpy.int64]: ...
+@typing.overload
+def to_units(
+    x: numpy.typing.NDArray[numpy.floating | numpy.integer],
+    resolution: int | float | numpy.integer | numpy.floating,
+) -> int | numpy.typing.NDArray[numpy.int64]: ...
+
+UNREACHABLE: int = 9223372036854775807
diff --git a/python/netgraph_core/_docs.py b/python/netgraph_core/_docs.py
deleted file mode 100644
index 984b099..0000000
--- a/python/netgraph_core/_docs.py
+++ /dev/null
@@ -1,908 +0,0 @@
-"""Typing and docstrings for netgraph_core public API.
-
-This module is intentionally light; runtime implementations live in the
-compiled extension. The goal is to provide type hints and help text.
-
-TODO: replace this hand-written stub with generated `.pyi` (e.g. via
-pybind11-stubgen) to prevent drift from the runtime bindings.
-"""
-
-from __future__ import annotations
-
-from typing import TYPE_CHECKING, ClassVar, Optional, Sequence
-
-if TYPE_CHECKING:  # only for typing; runtime comes from extension
-    import numpy as np  # type: ignore[reportMissingImports]
-    # Use forward references (strings) below; avoid importing from the package
-    # to prevent circular imports during type checking.
-
-
-class EdgeTieBreak:
-    """Tie-break rule among equal-cost parallel edges (pybind11 enum)."""
-
-    DETERMINISTIC: ClassVar[EdgeTieBreak]
-    PREFER_HIGHER_RESIDUAL: ClassVar[EdgeTieBreak]
-    __members__: ClassVar[dict[str, EdgeTieBreak]]
-
-    def __init__(self, value: int) -> None: ...
-
-    @property
-    def name(self) -> str: ...
-    @property
-    def value(self) -> int: ...
-
-
-class EdgeSelection:
-    """Edge selection policy. The constructor is keyword-only."""
-
-    multi_edge: bool
-    require_capacity: bool
-    tie_break: EdgeTieBreak
-
-    def __init__(
-        self,
-        *,
-        multi_edge: bool = True,
-        require_capacity: bool = False,
-        tie_break: EdgeTieBreak = ...,
-    ) -> None: ...
-
-
-class FlowPlacement:
-    """How to place flow across equal-cost predecessors during augmentation.
-
-    PROPORTIONAL (WCMP-like): Distributes flow proportionally to available capacity.
-        May be used iteratively (e.g., for max-flow).
-
-    EQUAL_BALANCED (ECMP): Single-pass admission on a fixed shortest-path DAG (Dijkstra).
-        The split set is the DAG's edges with capacity (the topology's next-hop
-        set). Computes one global scale so no edge is oversubscribed under
-        equal per-edge splits, places once, and stops; a member filled since
-        the DAG was computed drives the scale to 0, because a forwarding table
-        does not react to load. Progress past a full member by recomputing the
-        DAG with a residual-aware SPF (place_max_flow and FlowPolicy do).
-        ECMP = Equal-Cost Multi-Path; WCMP = Weighted-Cost Multi-Path.
-
-    EQUAL_BALANCED_LOSSY: Equal split over the same capacity-based set with no
-        scaling: each edge carries min(share, residual) and drops the excess,
-        deficits propagate downstream, and the placed amount is what reaches
-        the destination. Models best-effort hash-ECMP forwarding; per-edge
-        drops are available from FlowGraph.place_with_drops.
-    """
-
-    PROPORTIONAL: ClassVar[FlowPlacement]
-    EQUAL_BALANCED: ClassVar[FlowPlacement]
-    EQUAL_BALANCED_LOSSY: ClassVar[FlowPlacement]
-    __members__: ClassVar[dict[str, FlowPlacement]]
-
-    def __init__(self, value: int) -> None: ...
-
-    @property
-    def name(self) -> str: ...
-    @property
-    def value(self) -> int: ...
-
-
-class PredDAG:
-    """Compact predecessor DAG representation.
-
-    Arrays are int32; offsets has length N+1.
-    """
-
-    parent_offsets: np.ndarray
-    parents: np.ndarray
-    via_edges: np.ndarray
-
-    @staticmethod
-    def from_edges(graph: "StrictMultiDiGraph", edges: "Sequence[int]") -> "PredDAG":
-        """Build a single-path PredDAG from a contiguous edge-id sequence.
-
-        The missing constructor for operator-defined explicit paths; PredDAGs
-        returned by Algorithms.spf/ksp work directly wherever a PredDAG is
-        accepted (FlowState.place_on_dag, FlowGraph.place,
-        FlowPolicy.set_static_paths).
-
-        Raises:
-            ValueError: If edges is empty, an id is out of range, consecutive
-                edges do not connect, or the walk revisits a node (a pinned
-                path must be a simple path).
-        """
-        ...
-
-    def resolve_to_paths(
-        self,
-        src: int,
-        dst: int,
-        *,
-        split_parallel_edges: bool = False,
-        max_paths: Optional[int] = None,
-    ) -> list[tuple[tuple[int, tuple[int, ...]], ...]]: ...
-
-
-class PathAlg:
-    SPF: ClassVar[PathAlg]
-    __members__: ClassVar[dict[str, PathAlg]]
-
-    def __init__(self, value: int) -> None: ...
-
-    @property
-    def name(self) -> str: ...
-    @property
-    def value(self) -> int: ...
-
-
-class Backend:
-    """Backend for algorithm execution (typing stub only)."""
-
-    @staticmethod
-    def cpu() -> "Backend":
-        """Create a CPU backend."""
-        ...
-
-
-class Graph:
-    """Opaque backend graph handle produced by Algorithms.build_graph.
-
-    Keeps the underlying StrictMultiDiGraph alive for as long as it is used.
-    """
-
-    @property
-    def num_nodes(self) -> int: ...
-    @property
-    def num_edges(self) -> int: ...
-
-
-class FlowGraph:
-    """Flow graph for multi-commodity flow tracking.
-
-    Views return read-only NumPy arrays referencing internal C++ memory.
-    The FlowGraph must remain alive while views are in use.
-    """
-
-    def __init__(self, graph: "StrictMultiDiGraph") -> None: ...
-
-    def capacity_view(self) -> "np.ndarray":
-        """Return read-only float64 view of edge capacities."""
-        ...
-
-    def residual_view(self) -> "np.ndarray":
-        """Return read-only float64 view of residual capacities."""
-        ...
-
-    def edge_flow_view(self) -> "np.ndarray":
-        """Return read-only float64 view of placed flows."""
-        ...
-
-    @property
-    def graph(self) -> "StrictMultiDiGraph": ...
-
-    def place(
-        self,
-        index: "FlowIndex",
-        src: int,
-        dst: int,
-        dag: "PredDAG",
-        amount: float,
-        flow_placement: FlowPlacement = ...,
-    ) -> float: ...
-
-    def place_with_drops(
-        self,
-        index: "FlowIndex",
-        src: int,
-        dst: int,
-        dag: "PredDAG",
-        amount: float,
-        flow_placement: FlowPlacement = ...,
-    ) -> tuple[float, list[tuple[int, float]]]:
-        """Like place(), returning (placed, drops).
-
-        `drops` lists (edge_id, dropped_volume) for every edge that dropped
-        flow under EQUAL_BALANCED_LOSSY; other placements return an empty
-        list. Dropped volume never enters the ledger, so remove() reverts only
-        what was carried.
-        """
-        ...
-
-    def remove(self, index: "FlowIndex") -> None: ...
-    def remove_by_class(self, cls: int) -> None: ...
-    def reset(self) -> None: ...
-    def get_flow_edges(self, index: "FlowIndex") -> list[tuple[int, float]]: ...
-    def get_flow_path(self, index: "FlowIndex") -> list[int]: ...
-
-
-class FlowState:
-    """Flow state tracker for a single-commodity flow problem.
-
-    Tracks per-edge residual capacity and flow placement for a graph.
-
-    **Lifetime & Memory Safety:**
-    - Views (capacity_view, residual_view, edge_flow_view) return read-only
-      NumPy arrays that directly reference internal C++ memory (zero-copy).
-    - The FlowState must remain alive while these views are in use.
-    - Arrays passed as 'residual' to __init__ or reset() are **copied** internally.
-    - Masks passed to compute_min_cut() are **copied** before releasing GIL (thread-safe).
-
-    **Array Requirements:**
-    - All arrays must be 1-D, C-contiguous, and have correct dtype (float64 for
-      residual, bool for masks).
-    - Mask lengths must match num_nodes/num_edges exactly or TypeError is raised.
-    """
-
-    def __init__(
-        self, graph: "StrictMultiDiGraph", residual: "Optional[np.ndarray]" = None
-    ) -> None:
-        """Initialize FlowState with a graph and optional residual capacities.
-
-        Args:
-            graph: The network graph (kept alive automatically)
-            residual: Optional 1-D float64 array of initial residual capacities.
-                     If not provided, uses graph capacities. **Array is copied.**
-
-        Raises:
-            TypeError: If residual has wrong dtype, ndim, or length.
-        """
-        ...
-
-    def reset(self, residual: "Optional[np.ndarray]" = None) -> None:
-        """Reset flow state to initial capacities.
-
-        Args:
-            residual: Optional 1-D float64 array. **Array is copied.**
-        """
-        ...
-
-    def capacity_view(self) -> "np.ndarray":
-        """Return read-only float64 view of edge capacities (zero-copy)."""
-        ...
-
-    def residual_view(self) -> "np.ndarray":
-        """Return read-only float64 view of residual capacities (zero-copy)."""
-        ...
-
-    def edge_flow_view(self) -> "np.ndarray":
-        """Return read-only float64 view of placed flows (zero-copy)."""
-        ...
-
-    def place_on_dag(
-        self,
-        src: int,
-        dst: int,
-        dag: "PredDAG",
-        requested_flow: float = float("inf"),
-        flow_placement: FlowPlacement = ...,
-    ) -> float:
-        """Place flow along a predecessor DAG.
-
-        EqualBalanced is **single-pass ECMP admission** on the provided DAG:
-        we compute one global scale so no edge is oversubscribed under equal per-edge
-        splits, apply it once, and return. The split set is the topology's
-        next-hop set, so a member already full yields scale 0; progress past it
-        by recomputing the DAG with residuals. EQUAL_BALANCED_LOSSY forwards
-        best-effort over the same set (see FlowPlacement).
-
-        Returns:
-            Amount of flow actually placed (may be less than requested).
-        """
-        ...
-
-    def place_max_flow(
-        self,
-        src: int,
-        dst: int,
-        flow_placement: FlowPlacement = ...,
-        shortest_path: bool = False,
-        require_capacity: bool = True,
-        *,
-        node_mask: "Optional[np.ndarray]" = None,
-        edge_mask: "Optional[np.ndarray]" = None,
-    ) -> float:
-        """Place maximum flow from src to dst.
-
-        Args:
-            require_capacity: Whether to require edges to have capacity.
-                - True (default): Routes adapt to residuals (SDN/TE, progressive fill).
-                - False: Routes based on costs only (IP/IGP, fixed routing).
-            node_mask: Optional 1-D bool array (True=allowed). Copied for thread safety.
-            edge_mask: Optional 1-D bool array (True=allowed). Copied for thread safety.
-
-        For *IP-style ECMP* max-flow, use: require_capacity=False, shortest_path=True,
-        flow_placement=EQUAL_BALANCED.
-
-        Caution: with require_capacity=True + EQUAL_BALANCED, this method iterates shortest-path +
-        placement (progressive fill), which differs from single-pass ECMP admission.
-
-        Returns:
-            Total flow placed.
-        """
-        ...
-
-    def compute_min_cut(
-        self,
-        src: int,
-        *,
-        node_mask: "Optional[np.ndarray]" = None,
-        edge_mask: "Optional[np.ndarray]" = None,
-    ) -> "MinCut":
-        """Compute minimum cut from source based on current residual.
-
-        Args:
-            src: Source node for reachability analysis
-            node_mask: Optional 1-D bool array of length num_nodes. **Copied for thread safety.**
-            edge_mask: Optional 1-D bool array of length num_edges. **Copied for thread safety.**
-
-        Returns:
-            MinCut object with edges in the cut set.
-
-        Raises:
-            TypeError: If masks have wrong dtype, ndim, or length.
-        """
-        ...
-
-
-class StrictMultiDiGraph:
-    """Immutable directed multigraph with CSR and reverse-CSR adjacency.
-
-    Edges are reordered by (cost, src, dst) at construction, so EdgeId values are
-    positions in that canonical order rather than the caller's input order. Use
-    `ext_edge_ids` to map results back to caller-side identifiers.
-
-    Every `*_view()` method returns a fresh, writable COPY of the internal buffer,
-    so mutating the result cannot violate the graph's immutability. (This differs
-    from `FlowState`/`FlowGraph` views, which are live read-only views.)
-    """
-
-    @staticmethod
-    def from_arrays(
-        num_nodes: int,
-        src: "np.ndarray",
-        dst: "np.ndarray",
-        capacity: "np.ndarray",
-        cost: "np.ndarray",
-        ext_edge_ids: "np.ndarray",
-    ) -> "StrictMultiDiGraph":
-        """Build a graph from parallel edge arrays (all must be 1-D, C-contiguous).
-
-        Args:
-            num_nodes: Node count; every src/dst must lie in [0, num_nodes).
-            src: int32[E] source node ids.
-            dst: int32[E] destination node ids.
-            capacity: float64[E] capacities, each >= 0.
-            cost: int64[E] costs, each >= 0. Their TOTAL must stay below 2**62,
-                since SPF accumulates path costs as int64.
-            ext_edge_ids: int64[E] caller-side ids, permuted alongside the edges.
-
-        Raises:
-            TypeError: On a wrong dtype, a non-contiguous array, or a wrong shape.
-            ValueError: On a negative capacity/cost, a node id out of range, a
-                length mismatch, or a total cost at or above 2**62.
-        """
-        ...
-
-    def num_nodes(self) -> int: ...
-    def num_edges(self) -> int: ...
-    def capacity_view(self) -> "np.ndarray":
-        """Copy of per-edge capacities, float64[E]."""
-        ...
-
-    def cost_view(self) -> "np.ndarray":
-        """Copy of per-edge costs, int64[E]."""
-        ...
-
-    def edge_src_view(self) -> "np.ndarray":
-        """Copy of per-edge source node ids, int32[E]."""
-        ...
-
-    def edge_dst_view(self) -> "np.ndarray":
-        """Copy of per-edge destination node ids, int32[E]."""
-        ...
-
-    def ext_edge_ids_view(self) -> "np.ndarray":
-        """Copy of caller-supplied external edge ids, int64[E]."""
-        ...
-
-    def row_offsets_view(self) -> "np.ndarray":
-        """CSR row offsets over outgoing edges, int32[num_nodes + 1]."""
-        ...
-
-    def col_indices_view(self) -> "np.ndarray":
-        """CSR neighbour node ids for outgoing edges, int32[E]."""
-        ...
-
-    def adj_edge_index_view(self) -> "np.ndarray":
-        """EdgeId for each CSR outgoing entry, int32[E]."""
-        ...
-
-    def in_row_offsets_view(self) -> "np.ndarray":
-        """Reverse-CSR row offsets over incoming edges, int32[num_nodes + 1]."""
-        ...
-
-    def in_col_indices_view(self) -> "np.ndarray":
-        """Reverse-CSR predecessor node ids, int32[E]."""
-        ...
-
-    def in_adj_edge_index_view(self) -> "np.ndarray":
-        """EdgeId for each reverse-CSR entry, int32[E]."""
-        ...
-
-
-class FlowIndex:
-    """Identity of one flow: (src, dst, flowClass, flowId).
-
-    The constructor takes exactly four POSITIONAL arguments (the binding
-    declares no argument names), and the attributes are read-only.
-    """
-
-    def __init__(self, src: int, dst: int, flowClass: int, flowId: int, /) -> None: ...
-    @property
-    def src(self) -> int: ...
-    @property
-    def dst(self) -> int: ...
-    @property
-    def flowClass(self) -> int: ...
-    @property
-    def flowId(self) -> int: ...
-
-
-class FlowPolicyConfig:
-    """Configuration for FlowPolicy behavior.
-
-    Key Parameters:
-        multipath: Controls whether individual flows split across multiple equal-cost paths.
-            - True (default): Hash-based ECMP - each flow uses a DAG with ALL equal-cost paths.
-              Flow volume is split across these paths according to flow_placement strategy.
-              This models router ECMP behavior where packets are hashed across next-hops.
-            - False: Tunnel-based ECMP - each flow uses a SINGLE path (one tunnel/LSP).
-              Multiple flows can share the same path. This models MPLS LSP semantics where
-              each LSP follows one specific path, and ECMP means balancing ACROSS LSPs.
-    """
-
-    path_alg: PathAlg
-    flow_placement: FlowPlacement
-    selection: EdgeSelection
-    require_capacity: bool
-    multipath: bool
-    min_flow_count: int
-    max_flow_count: Optional[int]
-    max_path_cost: Optional[int]
-    max_path_cost_factor: Optional[float]
-    shortest_path: bool
-    reoptimize_flows_on_each_placement: bool
-    max_no_progress_iterations: int
-    max_total_iterations: int
-    diminishing_returns_enabled: bool
-    diminishing_returns_window: int
-    diminishing_returns_epsilon_frac: float
-
-    def __init__(
-        self,
-        *,
-        path_alg: PathAlg = ...,
-        flow_placement: FlowPlacement = ...,
-        selection: EdgeSelection = ...,
-        require_capacity: bool = True,
-        multipath: bool = True,
-        min_flow_count: int = 1,
-        max_flow_count: Optional[int] = None,
-        max_path_cost: Optional[int] = None,
-        max_path_cost_factor: Optional[float] = None,
-        shortest_path: bool = False,
-        reoptimize_flows_on_each_placement: bool = False,
-        max_no_progress_iterations: int = 100,
-        max_total_iterations: int = 10000,
-        diminishing_returns_enabled: bool = True,
-        diminishing_returns_window: int = 8,
-        diminishing_returns_epsilon_frac: float = 1e-3,
-    ) -> None:
-        """All parameters are keyword-only; the no-argument form is also valid."""
-        ...
-
-
-class FlowPolicy:
-    """Flow policy for demand placement.
-
-    Dynamic policies may refresh the DAG per round using residual-aware
-    shortest paths, progressively pruning saturated next-hops (traffic-
-    engineering style), which differs from one-shot ECMP admission.
-
-    A policy can instead be pinned to explicit path bundles with
-    set_static_paths(); see that method for the pinned semantics.
-
-    Args:
-        algorithms: Algorithms instance (kept alive by FlowPolicy)
-        graph: Graph handle (kept alive by FlowPolicy)
-        config: FlowPolicyConfig with all policy parameters
-        node_mask: Optional 1-D bool array (True=allowed). **Copied for thread safety.**
-        edge_mask: Optional 1-D bool array (True=allowed). **Copied for thread safety.**
-
-    Raises:
-        TypeError: If masks have wrong dtype, ndim, or length.
-    """
-
-    def __init__(
-        self,
-        algorithms: "Algorithms",
-        graph: "Graph",
-        config: "FlowPolicyConfig",
-        *,
-        node_mask: "Optional[np.ndarray]" = None,
-        edge_mask: "Optional[np.ndarray]" = None,
-    ) -> None: ...
-
-    def flow_count(self) -> int: ...
-    def placed_demand(self) -> float: ...
-    def place_demand(
-        self,
-        flow_graph: "FlowGraph",
-        src: int,
-        dst: int,
-        flowClass: int,
-        volume: float,
-        target_per_flow: Optional[float] = None,
-        min_flow: Optional[float] = None,
-    ) -> tuple[float, float]:
-        """Place `volume` of demand; returns (placed, remaining).
-
-        Raises:
-            ValueError: If this policy already manages a different (src, dst)
-                pair (call remove_demand() first, or use one policy per
-                demand), or if `flow_graph` wraps a different
-                StrictMultiDiGraph than the policy's own graph handle.
-
-        EQUAL_BALANCED note: when the equalizing rebalance runs, `placed` is
-        the policy's TOTAL placed demand (cumulative across calls, because
-        rebalancing re-places previously placed volume too), so
-        `placed + remaining` can exceed this call's `volume`. Use
-        placed_demand() deltas for strict per-call accounting. EB placement is
-        also not incremental: each call's volume defines the per-flow target,
-        so a second, smaller call may place nothing.
-        """
-        ...
-
-    def rebalance_demand(
-        self,
-        flow_graph: "FlowGraph",
-        src: int,
-        dst: int,
-        flowClass: int,
-        target: float,
-    ) -> tuple[float, float]: ...
-
-    def remove_demand(self, flow_graph: "FlowGraph") -> None:
-        """Remove all of this policy's flows, releasing its (src, dst) binding."""
-        ...
-
-    def set_static_paths(self, src: int, dst: int, paths: "Sequence[PredDAG]") -> None:
-        """Pin this policy's demand to explicit path bundles (MPLS-style).
-
-        One flow is created per USABLE bundle at the next placement, in supply
-        order, each permanently bound to its own bundle. A single-path bundle
-        (from PredDAG.from_edges or ksp) models a strict-ERO LSP: any failed
-        hop takes it down. A multi-walk bundle (an SPF DAG) models a pinned
-        DAG / SR-TE-style policy that renormalizes over surviving walks.
-
-        Bundles are validated against the policy's graph, then pruned against
-        the policy's node/edge masks; a bundle with no surviving src->dst walk
-        is DOWN and creates no flow (pinned paths do not reroute around
-        failures). Each flow's cost is the min-cost src->dst walk of its
-        PRUNED bundle. EqualBalanced spreads over the usable (up) bundles
-        only; down LSPs = len(paths) - flow_count().
-
-        With static paths configured the policy neither creates additional
-        flows nor reoptimizes: max_path_cost, max_path_cost_factor,
-        min_flow_count and reoptimize_flows_on_each_placement are inert.
-        Placement is not incremental across place_demand calls for
-        EqualBalanced (each call's volume defines the per-flow target).
-
-        Raises:
-            ValueError: If paths is empty; the policy already holds flows
-                (call remove_demand() first); shortest_path=True is
-                configured; src/dst is out of range or equal; a user-supplied
-                max_flow_count differs from len(paths); or a bundle is
-                malformed (wrong shape, out-of-range ids, an edge that does
-                not connect its parent to its node in this graph, a cycle, or
-                no src->dst walk). Calling again before placement replaces
-                the previous pinning.
-        """
-        ...
-
-    @property
-    def flows(self) -> dict[tuple[int, int, int, int], tuple[int, int, int, float]]: ...
-
-
-class MinCut:
-    edges: "np.ndarray"  # int32[K], copy of the cut edge ids
-
-
-class FlowSummary:
-    total_flow: float
-    min_cut: MinCut
-    # Cost-weighted breakdown of total_flow, ascending and unique. Entries from
-    # the SPF tier loop are shortest-path-DAG costs; entries from the residual
-    # completion phase are MARGINAL costs (forward edge costs minus the cost of
-    # the flow they cancel) and need not match any traversable src->dst path.
-    costs: "np.ndarray"  # int64[K]
-    flows: "np.ndarray"  # float64[K]
-    edge_flows: "np.ndarray"
-    residual_capacity: "np.ndarray"
-    reachable_nodes: "np.ndarray"
-
-
-class Algorithms:
-    """Core graph algorithms with thread-safe bindings.
-
-    **Thread Safety & Array Handling:**
-    - All input arrays (residual, node_mask, edge_mask) are **copied** before
-      releasing the GIL, ensuring thread safety even if Python code mutates
-      the arrays concurrently.
-    - All arrays must be 1-D, C-contiguous, with correct dtype.
-    - Mask lengths must match num_nodes/num_edges exactly or TypeError is raised.
-
-    **Lifetime Management:**
-    - Algorithms instances must be kept alive while Graph handles derived from
-      them are in use (automatic via Python reference counting in normal usage).
-    """
-
-    def __init__(self, backend: "Backend") -> None: ...
-
-    def build_graph(self, graph: "StrictMultiDiGraph") -> "Graph":
-        """Build a graph handle from StrictMultiDiGraph.
-
-        The graph object is kept alive automatically.
-        """
-        ...
-
-    def spf(
-        self,
-        graph: "Graph",
-        src: int,
-        dst: Optional[int] = None,
-        *,
-        selection: Optional[EdgeSelection] = None,
-        residual: Optional["np.ndarray"] = None,
-        node_mask: Optional["np.ndarray"] = None,
-        edge_mask: Optional["np.ndarray"] = None,
-        multipath: bool = True,
-        dtype: str = "float64",
-    ) -> tuple["np.ndarray", "PredDAG"]:
-        """Shortest path first algorithm.
-
-        Args:
-            graph: Graph handle
-            src: Source node
-            dst: Optional destination (if None, compute from source to all)
-            selection: Edge selection policy
-            residual: Optional 1-D float64 array of residuals. **Copied for thread safety.**
-            node_mask: Optional 1-D bool mask (length num_nodes). **Copied for thread safety.**
-                       True = node allowed, False = node excluded.
-                       **If source node is masked (False), returns empty DAG with all distances at infinity.**
-            edge_mask: Optional 1-D bool mask (length num_edges). **Copied for thread safety.**
-                       True = edge allowed, False = edge excluded.
-            multipath: Whether to track multiple equal-cost paths
-            dtype: "float64" (inf for unreachable) or "int64" (max for unreachable)
-
-        Returns:
-            (distances, predecessor_dag)
-
-        Note:
-            When the source node is masked out (node_mask[src] == False), the algorithm
-            immediately returns an empty predecessor DAG with all distances set to infinity,
-            as no traversal can begin from an excluded source.
-
-        Raises:
-            TypeError: If arrays have wrong dtype, ndim, or length
-                (residual must have length num_edges; masks must match
-                num_nodes / num_edges).
-            ValueError: If src/dst out of range.
-        """
-        ...
-
-    def spf_to(
-        self,
-        graph: "Graph",
-        dst: int,
-        *,
-        selection: Optional[EdgeSelection] = None,
-        residual: Optional["np.ndarray"] = None,
-        node_mask: Optional["np.ndarray"] = None,
-        edge_mask: Optional["np.ndarray"] = None,
-        multipath: bool = True,
-        fanout_edges: Optional[Sequence[int]] = None,
-        dtype: str = "float64",
-    ) -> tuple["np.ndarray", "PredDAG"]:
-        """Shortest paths from every node *to* dst (reverse SPF).
-
-        Returns ``(distances_to_dst, dag)``. ``distances_to_dst[u]`` is the cost
-        of a shortest ``u -> dst`` walk (inf / int64 max if none). The DAG is
-        forward-oriented, so it works anywhere a PredDAG is accepted, and is
-        valid for placement from *any* node toward ``dst``: every walk it
-        holds from a node ``u`` to ``dst`` costs ``distances_to_dst[u]``. It is
-        the union of the per-source shortest-path DAGs toward ``dst``.
-
-        Args:
-            graph: Graph handle
-            dst: Destination node
-            selection: Edge selection policy (as for spf)
-            residual: Optional 1-D float64 array of residuals (copied); forces
-                capacity gating as for spf
-            node_mask: Optional 1-D bool mask (length num_nodes), copied
-            edge_mask: Optional 1-D bool mask (length num_edges), copied
-            multipath: Keep every equal-cost successor per node; False keeps
-                one, preferring higher bottleneck capacity toward dst
-            fanout_edges: Edge ids added to the DAG regardless of cost, for an
-                origin whose first hop is a traffic split rather than a
-                routing decision (a pseudo source fanning out over every
-                attached real source). Each edge is added when it passes the
-                masks and capacity gate and its head has a finite distance;
-                its tail must have no incoming DAG entry
-            dtype: "float64" (inf for unreachable) or "int64" (max for unreachable)
-
-        Raises:
-            TypeError: If arrays have wrong dtype, ndim, or length.
-            ValueError: If dst or a fanout edge id is out of range, or a
-                fanout edge leaves a node that already has an incoming DAG
-                entry.
-        """
-        ...
-
-    def ksp(
-        self,
-        graph: "Graph",
-        src: int,
-        dst: int,
-        *,
-        k: int,
-        max_cost_factor: Optional[float] = None,
-        unique: bool = True,
-        node_mask: Optional["np.ndarray"] = None,
-        edge_mask: Optional["np.ndarray"] = None,
-        dtype: str = "float64",
-    ) -> list[tuple["np.ndarray", "PredDAG"]]:
-        """K shortest paths algorithm.
-
-        Args:
-            k: Number of paths to find
-            max_cost_factor: Optional maximum cost factor relative to shortest
-            node_mask: Optional 1-D bool mask. **Copied for thread safety.**
-            edge_mask: Optional 1-D bool mask. **Copied for thread safety.**
-
-        Returns:
-            List of (distances, dag) tuples, up to k paths.
-
-        Note:
-            Tie-breaking is deterministic by edge ID. EdgeSelection policy is not used.
-        """
-        ...
-
-    def max_flow(
-        self,
-        graph: "Graph",
-        src: int,
-        dst: int,
-        *,
-        flow_placement: FlowPlacement = ...,
-        shortest_path: bool = False,
-        require_capacity: bool = True,
-        with_edge_flows: bool = False,
-        with_reachable: bool = False,
-        with_residuals: bool = False,
-        node_mask: Optional["np.ndarray"] = None,
-        edge_mask: Optional["np.ndarray"] = None,
-    ) -> tuple[float, "FlowSummary"]:
-        """Maximum flow algorithm.
-
-        Behavior depends on require_capacity parameter:
-
-        - require_capacity=True (default): "True max-flow" - require edges to have capacity,
-          exclude saturated links (SDN/TE behavior). Uses all available paths.
-
-        - require_capacity=False: "IP ECMP" - routes based on costs only (IP/IGP behavior).
-          Routes computed once from topology, ignoring capacity. Models OSPF/IS-IS routing.
-
-        Common configurations:
-
-        1. True max-flow (SDN/TE):
-           require_capacity=True, shortest_path=False
-
-        2. IP ECMP max-flow:
-           require_capacity=False, shortest_path=True, flow_placement=EQUAL_BALANCED
-
-        3. IP WCMP max-flow:
-           require_capacity=False, shortest_path=True, flow_placement=PROPORTIONAL
-
-        Args:
-            require_capacity: Whether to require edges to have capacity.
-            shortest_path: Whether to restrict to lowest-cost tier only.
-            flow_placement: How to split flow across parallel edges (ECMP vs WCMP).
-            node_mask: Optional 1-D bool mask. **Copied for thread safety.**
-            edge_mask: Optional 1-D bool mask. **Copied for thread safety.**
-
-        Returns:
-            (total_flow, flow_summary)
-        """
-        ...
-
-    def batch_max_flow(
-        self,
-        graph: "Graph",
-        pairs: "np.ndarray",
-        *,
-        node_masks: Optional[list["np.ndarray"]] = None,
-        edge_masks: Optional[list["np.ndarray"]] = None,
-        flow_placement: FlowPlacement = ...,
-        shortest_path: bool = False,
-        require_capacity: bool = True,
-        with_edge_flows: bool = False,
-        with_reachable: bool = False,
-        with_residuals: bool = False,
-    ) -> list[FlowSummary]:
-        """Batch maximum flow for multiple (src,dst) pairs.
-
-        Args:
-            pairs: int32 array of shape [B, 2] with (src, dst) pairs
-            node_masks: Optional list of B bool masks. **Each copied for thread safety.**
-            edge_masks: Optional list of B bool masks. **Each copied for thread safety.**
-            require_capacity: If True, exclude saturated edges (SDN/TE). If False, route by cost only (IP/IGP).
-
-        Returns:
-            List of FlowSummary objects, one per pair.
-        """
-        ...
-
-    def sensitivity_analysis(
-        self,
-        graph: "Graph",
-        src: int,
-        dst: int,
-        *,
-        flow_placement: FlowPlacement = ...,
-        shortest_path: bool = False,
-        require_capacity: bool = True,
-        node_mask: Optional["np.ndarray"] = None,
-        edge_mask: Optional["np.ndarray"] = None,
-    ) -> list[tuple[int, float]]:
-        """Sensitivity analysis to identify critical edges that constrain flow.
-
-        Computes baseline flow, then tests removing each saturated edge to
-        measure how much the total flow would be reduced.
-
-        The `shortest_path` parameter controls the routing semantics:
-
-        - shortest_path=False (default): Full max-flow analysis (SDN/TE mode).
-          Identifies edges critical for achieving maximum possible flow.
-
-        - shortest_path=True: Shortest-path-only analysis (IP/IGP mode).
-          Identifies edges critical for flow under ECMP routing. Edges on
-          unused longer paths are not reported as critical.
-
-        Args:
-            graph: Graph handle
-            src: Source node
-            dst: Destination node
-            flow_placement: Flow placement strategy
-            shortest_path: If True, use single-pass shortest-path flow (IP/IGP).
-                          If False, use full iterative max-flow (SDN/TE).
-            require_capacity: If True, exclude saturated edges from routing.
-            node_mask: Optional 1-D bool mask. **Copied for thread safety.**
-            edge_mask: Optional 1-D bool mask. **Copied for thread safety.**
-
-        Returns:
-            List of (edge_id, flow_delta) tuples. Each edge_id is an edge
-            whose removal would reduce total flow by flow_delta.
-        """
-        ...
-
-
-def profiling_enabled() -> bool:
-    """True if profiling is enabled (NGRAPH_CORE_PROFILE=1 in the environment)."""
-    ...
-
-
-def profiling_dump() -> None:
-    """Print collected profiling statistics to stderr."""
-    ...
-
-
-def profiling_reset() -> None:
-    """Clear all collected profiling statistics."""
-    ...
diff --git a/src/centralized_te_tunnels.cpp b/src/centralized_te_tunnels.cpp
new file mode 100644
index 0000000..757e5f0
--- /dev/null
+++ b/src/centralized_te_tunnels.cpp
@@ -0,0 +1,771 @@
+/*
+  T2 layout: a controller gives every live head the same number k of
+  single-path tunnels with one common whole-unit planned bandwidth.
+
+  The network: the allowed edges (an edge and both endpoints allowed) that do not leave a
+  destination (a path stops at the first destination it meets), on V, the free capacity with this
+  policy's own traffic released. A head is live when it reaches a destination over edges with
+  V >= 1 (one reverse traversal); the other roster heads are dead: they keep their place in the
+  roster (their positions j * H + i are holes) and get no tunnel. a live heads, K = a * k tunnels.
+
+  Sizing. Tunnels of a common size s > 0 exist exactly when K path units flow from a virtual root
+  (an arc of capacity k to each live head) to the destinations with edge capacities
+  min(K, floor(V / s)): the quota flow, a maximum flow of the flow core with costs ignored
+  (max_flow_subset: its value capped at K, each live head's virtual arc capped at k; a
+  destination's virtual arc never binds, the value being at most K). The quota network keeps
+  only the edges with V >= 1 on a walk from a live head to a destination. U, the largest integer size that passes, by integer bisection below the bounds
+  every feasible size obeys: max V, floor(sum of a live head's out-edges' V / k), floor(sum of the
+  destinations' in-edges' V / K) (and, for "up to", U(k - 1)). The exact fluid optimum s* (a
+  fraction V[e] / j with j <= K) by bisection over dyadic sizes N / 2^t, t = 2 * bit_width(K) bits
+  (two such fractions differ by at least 1 / K^2 > 2^-t), from [U, U + 1) (or [2^-bit_width(K), 1)
+  when U = 0, where every edge with V >= 1 has capacity K), then the one breakpoint in the final
+  interval. Capacities are exact: V * 2^t < 2^123, and min(K, .) is decided by a product below 2^92
+  before a division whose quotient fits 64 bits.
+
+  Working size (finite design D): u = min(U, max(1, max over live heads of ceil(RR(D, H, i) / k)))
+  with i the head's roster position (dead heads' shares stay in the round robin); unlimited: U.
+
+  Routes at u: count vectors x with x[e] <= b[e] = min(K, floor(V[e] / u)); minimum
+  J = sum cost * x, then (prefer_headroom) minimum Phi = sum over slots of floor(2^32 (B - V + j u) / B)
+  (B: static capacity; j u <= V, so a slot price is an integer in [0, 2^32]), then the canonical
+  unit augmentation: K units from zero flow, each on the residual root-to-sink path of minimum
+  (J, Phi) price, then fewest arcs, then the smallest sequence of arc keys ((0, EdgeId, direction)
+  for links, (1, head, direction) for root arcs, (2, destination, direction) for sink arcs). One
+  Dijkstra per unit with pair-valued potentials (signed 128-bit pairs, compared
+  lexicographically): it settles every vertex up to the sink's distance; the arcs whose reduced
+  price closes a distance exactly are tight; a BFS from the sink over reversed tight arcs counts
+  hops; the walk from the root takes, at each vertex, the smallest-key tight arc that lowers the
+  hop count. Settled vertices add their distance to their potential, the others the sink's
+  (reduced prices stay non-negative: a negative one is an internal error). Per link at most two
+  residual arcs: forward at slot x + 1 (x < b), reverse at slot x (x > 0); reverse root and sink
+  arcs never lie on a simple root-to-sink path and are not kept. J < K * (cost sum) < 2^92 and
+  Phi <= 2^32 * sum x < 2^94 (sum x counts every link of every tunnel, so Phi can pass 2^64): 128-bit,
+  each link's slot prices summed in closed form (t2_objectives).
+
+  Program: x cut into unit paths per live head in ascending NodeId, each the walk along the
+  smallest positive EdgeId (decompose(), the controllers' cut, its paths expanded into units);
+  each head's k paths sorted by EdgeId sequence; tunnels in round order (round j, then roster
+  position i), index j * H + i.
+
+  Up to L: k = 1..L upwards; U(k) never increases with k (a feasible (k + 1)-layout minus one
+  tunnel per head is feasible), so U(k) = 0 ends the scan (every later score is 0). With M = H k
+  roster positions the score G(min(D, F'(k))) (G: the live heads' part of a round-robin total;
+  F'(k): the largest total whose live shares fit on the program at U(k), dead shares ignored, in
+  [M U, M (U + 1)); unlimited D: G(F'(k))) lies between G(min(D, M U)) and G(min(D, M (U + 1) - 1)):
+  a lower bound equal to G(D) selects k without its program, an upper bound at most the
+  incumbent's skips k; nothing else is skipped. The smallest k reaching G(D) wins, else the
+  largest score, then the smallest k; it is then laid out at its own u. F'(k), M (U + 1) and the
+  bounds reach 2^92 (dead heads make M larger than K): 128-bit.
+*/
+#include <algorithm>
+#include <bit>
+#include <numeric>
+#include <optional>
+#include <queue>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <utility>
+
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/tunnel_setup.hpp"
+
+namespace netgraph::core::detail {
+
+namespace {
+
+[[noreturn]] void internal(const char* what) { throw std::logic_error(std::string("T2: ") + what); }
+
+U128 u128(std::uint64_t x) noexcept { return U128 {0, x}; }
+U128 half(U128 v) noexcept { return U128 {v.hi >> 1, (v.lo >> 1) | (v.hi << 63)}; }
+// floor(z / d) and z mod d for d >= 1 and a quotient below 2^64.
+std::pair<std::uint64_t, std::uint64_t> divmod(U128 z, std::uint64_t d) noexcept {
+  const std::uint64_t q = div_u128(z, d);
+  return {q, sub(z, mul_u64(q, d)).lo};
+}
+
+// The edges T2 may use and the endpoints, on the free capacity V.
+struct Base {
+  const Graph& g;
+  std::span<const NodeId> roster;
+  std::span<const NodeId> dests;
+  std::span<const Amount> V;
+  std::vector<std::uint8_t> usable {};  // per edge: allowed and not leaving a destination
+  std::vector<std::uint8_t> back {};    // per node: reaches a destination over usable edges with V >= 1
+};
+
+Base make_base(const Graph& g, const Eligibility* elig, std::span<const NodeId> roster, std::span<const NodeId> dests,
+               std::span<const Amount> V) {
+  Base b {g, roster, dests, V};
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  const auto src = g.edge_sources();
+  const auto dst = g.edge_destinations();
+  std::vector<std::uint8_t> is_dst(n, 0);
+  for (NodeId d : dests) is_dst[static_cast<std::size_t>(d)] = 1;
+  b.usable.assign(m, 0);
+  for (std::size_t e = 0; e < m; ++e) {
+    const auto u = src[e];
+    const auto v = dst[e];
+    if (is_dst[static_cast<std::size_t>(u)] != 0) continue;
+    if (elig != nullptr && (!elig->allows_edge(static_cast<EdgeId>(e)) || !elig->allows_node(u) || !elig->allows_node(v))) continue;
+    b.usable[e] = 1;
+  }
+  // The reverse traversal from the destinations over usable edges with V >= 1.
+  b.back.assign(n, 0);
+  std::vector<NodeId> stack(dests.begin(), dests.end());
+  for (NodeId d : dests) b.back[static_cast<std::size_t>(d)] = 1;
+  const auto in_row = g.incoming_offsets();
+  const auto in_edge = g.incoming_edges();
+  while (!stack.empty()) {
+    const auto v = static_cast<std::size_t>(stack.back());
+    stack.pop_back();
+    for (auto s = in_row[v]; s < in_row[v + 1]; ++s) {
+      const auto e = static_cast<std::size_t>(in_edge[static_cast<std::size_t>(s)]);
+      if (b.usable[e] == 0 || V[e] < 1) continue;
+      const auto u = static_cast<std::size_t>(src[e]);
+      if (b.back[u] == 0) {
+        b.back[u] = 1;
+        stack.push_back(static_cast<NodeId>(u));
+      }
+    }
+  }
+  return b;
+}
+
+// The quota network of the live heads: the usable edges with V >= 1 on a walk from a live head to
+// a destination (ascending EdgeId), and the heads' roster positions.
+struct Quota {
+  std::vector<NodeId> live {};
+  std::vector<std::int64_t> live_pos {};  // roster position of each live head
+  std::vector<EdgeId> edges {};
+  std::vector<Amount> cap_v {};           // V of each edge
+  Amount max_v {0};
+};
+
+Quota make_quota(const Base& b) {
+  Quota q;
+  for (std::size_t i = 0; i < b.roster.size(); ++i) {
+    if (b.back[static_cast<std::size_t>(b.roster[i])] == 0) continue;
+    q.live.push_back(b.roster[i]);
+    q.live_pos.push_back(static_cast<std::int64_t>(i));
+  }
+  const auto& g = b.g;
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  const auto row = g.outgoing_offsets();
+  const auto dst = g.edge_destinations();
+  std::vector<std::uint8_t> fwd(n, 0);
+  std::vector<NodeId> stack(q.live.begin(), q.live.end());
+  for (NodeId h : q.live) fwd[static_cast<std::size_t>(h)] = 1;
+  while (!stack.empty()) {
+    const auto u = static_cast<std::size_t>(stack.back());
+    stack.pop_back();
+    for (auto e = static_cast<std::size_t>(row[u]); e < static_cast<std::size_t>(row[u + 1]); ++e) {
+      if (b.usable[e] == 0 || b.V[e] < 1) continue;
+      const auto v = static_cast<std::size_t>(dst[e]);
+      if (b.back[v] == 0 || fwd[v] != 0) continue;
+      fwd[v] = 1;
+      stack.push_back(static_cast<NodeId>(v));
+    }
+  }
+  const auto src = g.edge_sources();
+  for (std::size_t e = 0; e < static_cast<std::size_t>(g.num_edges()); ++e) {
+    if (b.usable[e] == 0 || b.V[e] < 1) continue;
+    if (fwd[static_cast<std::size_t>(src[e])] == 0 || b.back[static_cast<std::size_t>(dst[e])] == 0) continue;
+    q.edges.push_back(static_cast<EdgeId>(e));
+    q.cap_v.push_back(b.V[e]);
+    q.max_v = std::max(q.max_v, b.V[e]);
+  }
+  return q;
+}
+
+// min(K, floor(V / s)) for the size s = N / 2^t (N >= 1, t <= 61, V < 2^62): V * 2^t < 2^123; a
+// quotient that may exceed K is first compared with K * N (below 2^92 when N < 2^64; otherwise
+// the quotient is below 2^59).
+Amount slots(Amount v, U128 N, int t, Amount K) noexcept {
+  const U128 num = shl(u128(static_cast<std::uint64_t>(v)), t);
+  if (N.hi == 0) {
+    if (!(num < mul_u64(static_cast<std::uint64_t>(K), N.lo))) return K;
+    return static_cast<Amount>(div_u128(num, N.lo));
+  }
+  return std::min<Amount>(K, static_cast<Amount>(div_u128(num, N)));
+}
+
+// One count k: the quota flows of its sizes.
+struct Sizing {
+  const Base& b;
+  const Quota& q;
+  std::int64_t k;
+  Amount K;
+  std::vector<Amount> caps {};
+  std::vector<Amount> head_caps {};
+
+  Sizing(const Base& base, const Quota& quota, std::int64_t count)
+      : b(base), q(quota), k(count), K(static_cast<Amount>(quota.live.size()) * count), caps(quota.edges.size()),
+        head_caps(quota.live.size(), count) {}
+
+  // Do K unit paths fit at the size N / 2^t?
+  bool feasible(U128 N, int t) {
+    for (std::size_t i = 0; i < q.edges.size(); ++i) caps[i] = slots(q.cap_v[i], N, t, K);
+    return max_flow_subset(b.g, q.edges, caps, q.live, b.dests, K, head_caps) == K;
+  }
+
+  // U: the largest integer size that fits (0 when none), at most `limit`.
+  Amount common(Amount limit) {
+    const auto src = b.g.edge_sources();
+    const auto dst = b.g.edge_destinations();
+    std::vector<Amount> out(q.live.size(), 0);
+    Amount in = 0;
+    std::vector<std::uint8_t> is_dst(static_cast<std::size_t>(b.g.num_nodes()), 0);
+    for (NodeId d : b.dests) is_dst[static_cast<std::size_t>(d)] = 1;
+    for (std::size_t i = 0; i < q.edges.size(); ++i) {
+      const auto e = static_cast<std::size_t>(q.edges[i]);
+      const auto h = std::lower_bound(q.live.begin(), q.live.end(), src[e]);
+      if (h != q.live.end() && *h == src[e]) out[static_cast<std::size_t>(h - q.live.begin())] += q.cap_v[i];
+      if (is_dst[static_cast<std::size_t>(dst[e])] != 0) in += q.cap_v[i];
+    }
+    // Every size that fits obeys these: k tunnels of size s leave each live head on edges with
+    // floor(V / s) >= 1 summing to at least k, and K enter the destinations.
+    Amount hi = std::min(limit, q.max_v);
+    for (Amount x : out) hi = std::min(hi, x / k);
+    hi = std::min(hi, in / K);
+    if (hi < 1 || !feasible(u128(1), 0)) return 0;
+    if (feasible(u128(static_cast<std::uint64_t>(hi)), 0)) return hi;
+    Amount lo = 1;  // fits; hi does not
+    while (hi - lo > 1) {
+      const Amount mid = lo + (hi - lo) / 2;
+      if (feasible(u128(static_cast<std::uint64_t>(mid)), 0)) {
+        lo = mid;
+      } else {
+        hi = mid;
+      }
+    }
+    return lo;
+  }
+
+  // s* as a reduced fraction (numerator, denominator), given U (live heads exist).
+  std::pair<Amount, Amount> fluid(Amount U) {
+    const int w = std::bit_width(static_cast<std::uint64_t>(K));  // K < 2^w
+    const int t = 2 * w;                                          // 2^-t < 1 / K^2
+    const U128 base = shl(u128(static_cast<std::uint64_t>(U)), t);
+    // Fractional numerators over 2^t: base + lo fits, base + hi does not.
+    U128 lo = U >= 1 ? U128 {} : shl(u128(1), t - w);
+    U128 hi = shl(u128(1), t);
+    while (sub(hi, lo) > u128(1)) {
+      const U128 mid = add(lo, half(sub(hi, lo)));
+      if (feasible(add(base, mid), t)) {
+        lo = mid;
+      } else {
+        hi = mid;
+      }
+    }
+    // The one breakpoint V[e] / j in [base + lo, base + hi) / 2^t.
+    Amount num = 0;
+    Amount den = 0;
+    for (std::size_t i = 0; i < q.edges.size(); ++i) {
+      const Amount v = q.cap_v[i];
+      const Amount jmax = slots(v, add(base, lo), t, K);
+      const Amount jmin = slots(v, add(base, hi), t, K) + 1;
+      if (jmin > jmax) continue;
+      if (jmin != jmax) internal("two breakpoints closer than 1 / K^2");
+      if (den == 0) {
+        num = v;
+        den = jmax;
+      } else if (!(mul_u64(static_cast<std::uint64_t>(num), static_cast<std::uint64_t>(jmax)) ==
+                   mul_u64(static_cast<std::uint64_t>(v), static_cast<std::uint64_t>(den)))) {
+        internal("two fluid sizes in one interval");
+      }
+    }
+    if (den == 0) internal("no fluid breakpoint");
+    const Amount d = std::gcd(num, den);
+    return {num / d, den / d};
+  }
+};
+
+// ---------------------------------------------------------------- the canonical augmentation
+
+// A (J, Phi) price, compared lexicographically.
+struct Pair {
+  I128 j {};
+  I128 p {};
+  friend bool operator==(const Pair&, const Pair&) = default;
+  friend bool operator<(const Pair& a, const Pair& b) noexcept { return a.j != b.j ? a.j < b.j : a.p < b.p; }
+  friend Pair operator+(const Pair& a, const Pair& b) noexcept { return {a.j + b.j, a.p + b.p}; }
+  friend Pair operator-(const Pair& a, const Pair& b) noexcept { return {a.j - b.j, a.p - b.p}; }
+};
+
+// The headroom price of slot j (j u <= V <= B): floor(2^32 (B - V + j u) / B), at most 2^32.
+Amount slot_price(Amount B, Amount V, Amount j, Amount u) noexcept {
+  const auto occupied = static_cast<std::uint64_t>(B - V + j * u);
+  return static_cast<Amount>(div_u128(mul_u64(occupied, std::uint64_t {1} << 32), static_cast<std::uint64_t>(B)));
+}
+
+// The low 128 bits of v q (exact when the product is below 2^128).
+U128 mul_lo(U128 v, std::uint64_t q) noexcept {
+  const U128 low = mul_u64(v.lo, q);
+  return U128 {low.hi + v.hi * q, low.lo};
+}
+
+// n (n - 1) / 2 for n >= 1.
+U128 pairs_below(std::uint64_t n) noexcept { return half(mul_u64(n, n - 1)); }
+
+// The sum of slot_price(B, V, j, u) over j = 1..x (x u <= V <= B, u >= 1) in closed form: with
+// a = 2^32 u and b = 2^32 (B - V + u), the floor sum of (a i + b) / B over i = 0..x-1, by Euclid's
+// reduction (O(log B) steps, so a link's x never needs a loop). a / B and b / B are at most 2^32
+// (u <= V <= B and B - V + u <= B); after them every value is below 2^62 except a n + b, below
+// 2^124, whose quotient by m is below n + 1. Every term is part of the sum, at most 2^32 x < 2^94.
+U128 slot_price_sum(Amount B, Amount V, Amount u, Amount x) noexcept {
+  U128 sum {};
+  if (x <= 0) return sum;
+  auto n = static_cast<std::uint64_t>(x);
+  auto m = static_cast<std::uint64_t>(B);
+  const auto [qa, a0] = divmod(shl(u128(static_cast<std::uint64_t>(u)), 32), m);
+  const auto [qb, b0] = divmod(shl(u128(static_cast<std::uint64_t>(B - V + u)), 32), m);
+  sum = add(mul_lo(pairs_below(n), qa), mul_u64(n, qb));
+  std::uint64_t a = a0;
+  std::uint64_t c = b0;
+  while (true) {
+    if (a >= m) {
+      sum = add(sum, mul_lo(pairs_below(n), a / m));
+      a %= m;
+    }
+    if (c >= m) {
+      sum = add(sum, mul_u64(n, c / m));
+      c %= m;
+    }
+    const U128 y = add(mul_u64(a, n), u128(c));
+    if (y < u128(m)) return sum;
+    std::tie(n, c) = divmod(y, m);
+    std::swap(m, a);
+  }
+}
+
+// An arc's key: (type, id, direction), compared lexicographically.
+struct Key {
+  int type {0};
+  std::int64_t id {0};
+  int dir {0};
+  friend auto operator<=>(const Key&, const Key&) = default;
+};
+
+// The count vector of the canonical augmentation (aligned with q.edges) for k tunnels per live
+// head at size u.
+std::vector<Amount> canonical(const Base& b, const Quota& q, std::int64_t k, Amount u, bool headroom) {
+  const auto& g = b.g;
+  const Amount K = static_cast<Amount>(q.live.size()) * k;
+  const auto src = g.edge_sources();
+  const auto dst = g.edge_destinations();
+  const auto cost = g.edge_costs();
+  const auto cap = g.edge_capacity_units();
+  // The links with a slot at u, their local endpoints; root = L, sink = L + 1.
+  std::vector<std::int32_t> local(static_cast<std::size_t>(g.num_nodes()), -1);
+  std::vector<NodeId> node_of;
+  auto add_node = [&](NodeId v) {
+    auto& s = local[static_cast<std::size_t>(v)];
+    if (s < 0) {
+      s = static_cast<std::int32_t>(node_of.size());
+      node_of.push_back(v);
+    }
+    return s;
+  };
+  struct Link {
+    std::size_t q {0};  // position in q.edges
+    EdgeId e {0};
+    std::int32_t tail {0};
+    std::int32_t head {0};
+    Amount slots {0};
+    Amount x {0};
+    Pair fwd {};  // the price of slot x + 1
+    Pair rev {};  // minus the price of slot x
+  };
+  std::vector<Link> links;
+  for (NodeId h : q.live) add_node(h);
+  for (std::size_t i = 0; i < q.edges.size(); ++i) {
+    const Amount s = std::min(K, q.cap_v[i] / u);
+    if (s == 0) continue;
+    const auto e = static_cast<std::size_t>(q.edges[i]);
+    links.push_back(Link {i, q.edges[i], add_node(src[e]), add_node(dst[e]), s});
+  }
+  const auto L = static_cast<std::int32_t>(node_of.size());
+  const std::int32_t root = L;
+  const std::int32_t sink = L + 1;
+  const auto N = static_cast<std::size_t>(L + 2);
+  std::vector<std::uint8_t> is_dst(N, 0);
+  for (NodeId d : b.dests) {
+    const auto s = local[static_cast<std::size_t>(d)];
+    if (s >= 0) is_dst[static_cast<std::size_t>(s)] = 1;
+  }
+  auto price = [&](const Link& l, Amount j) -> Pair {
+    const auto ei = static_cast<std::size_t>(l.e);
+    const Amount B = cap[ei];
+    return {I128(cost[ei]), I128(headroom && B > 0 ? slot_price(B, b.V[ei], j, u) : 0)};
+  };
+  auto reprice = [&](Link& l) {
+    if (l.x < l.slots) l.fwd = price(l, l.x + 1);
+    if (l.x > 0) l.rev = Pair {} - price(l, l.x);
+  };
+  for (auto& l : links) reprice(l);
+  // Per local node its forward links (by tail) and reverse links (by head), CSR.
+  std::vector<std::int32_t> out_first(N + 1, 0);
+  std::vector<std::int32_t> in_first(N + 1, 0);
+  for (const auto& l : links) {
+    ++out_first[static_cast<std::size_t>(l.tail) + 1];
+    ++in_first[static_cast<std::size_t>(l.head) + 1];
+  }
+  for (std::size_t v = 0; v < N; ++v) {
+    out_first[v + 1] += out_first[v];
+    in_first[v + 1] += in_first[v];
+  }
+  std::vector<std::int32_t> out_links(links.size());
+  std::vector<std::int32_t> in_links(links.size());
+  {
+    std::vector<std::int32_t> o(out_first.begin(), out_first.end() - 1);
+    std::vector<std::int32_t> n(in_first.begin(), in_first.end() - 1);
+    for (std::size_t i = 0; i < links.size(); ++i) {
+      out_links[static_cast<std::size_t>(o[static_cast<std::size_t>(links[i].tail)]++)] = static_cast<std::int32_t>(i);
+      in_links[static_cast<std::size_t>(n[static_cast<std::size_t>(links[i].head)]++)] = static_cast<std::int32_t>(i);
+    }
+  }
+  std::vector<std::int64_t> root_flow(q.live.size(), 0);
+  std::vector<Pair> pi(N);
+  std::vector<Pair> dist(N);
+  std::vector<std::uint8_t> reached(N, 0);
+  std::vector<std::uint8_t> settled(N, 0);
+  std::vector<std::int32_t> order;  // the settled vertices
+  // A residual arc out of a vertex: its head, reduced price, key and what an augmentation does
+  // (kind 0 a link forward, 1 a link reverse, 2 a root arc, 3 a sink arc; index).
+  struct Arc {
+    std::int32_t to {0};
+    Pair rp {};
+    Key key {};
+    int kind {0};
+    std::int32_t index {0};
+  };
+  auto arcs_of = [&](std::int32_t v, auto&& visit) {
+    if (v == root) {
+      for (std::size_t h = 0; h < q.live.size(); ++h) {
+        if (root_flow[h] >= k) continue;
+        const auto to = static_cast<std::int32_t>(h);  // live heads are the first local nodes
+        visit(Arc {to, pi[static_cast<std::size_t>(root)] - pi[static_cast<std::size_t>(to)], Key {1, q.live[h], 0}, 2,
+                   static_cast<std::int32_t>(h)});
+      }
+      return;
+    }
+    const auto vi = static_cast<std::size_t>(v);
+    for (auto s = out_first[vi]; s < out_first[vi + 1]; ++s) {
+      const auto i = out_links[static_cast<std::size_t>(s)];
+      const auto& l = links[static_cast<std::size_t>(i)];
+      if (l.x >= l.slots) continue;
+      visit(Arc {l.head, l.fwd + pi[vi] - pi[static_cast<std::size_t>(l.head)], Key {0, l.e, 0}, 0, i});
+    }
+    for (auto s = in_first[vi]; s < in_first[vi + 1]; ++s) {
+      const auto i = in_links[static_cast<std::size_t>(s)];
+      const auto& l = links[static_cast<std::size_t>(i)];
+      if (l.x <= 0) continue;
+      visit(Arc {l.tail, l.rev + pi[vi] - pi[static_cast<std::size_t>(l.tail)], Key {0, l.e, 1}, 1, i});
+    }
+    if (is_dst[vi] != 0) {
+      visit(Arc {sink, pi[vi] - pi[static_cast<std::size_t>(sink)], Key {2, node_of[vi], 0}, 3, v});
+    }
+  };
+  // The residual arcs into a vertex: visit(tail, reduced price) (none into the root).
+  std::vector<std::int32_t> dest_local;
+  for (std::size_t v = 0; v < N; ++v) {
+    if (is_dst[v] != 0) dest_local.push_back(static_cast<std::int32_t>(v));
+  }
+  auto in_arcs_of = [&](std::int32_t w, auto&& visit) {
+    const auto wi = static_cast<std::size_t>(w);
+    if (w == sink) {
+      for (std::int32_t d : dest_local) visit(d, pi[static_cast<std::size_t>(d)] - pi[wi]);
+      return;
+    }
+    if (w == root) return;
+    for (auto s = in_first[wi]; s < in_first[wi + 1]; ++s) {
+      const auto& l = links[static_cast<std::size_t>(in_links[static_cast<std::size_t>(s)])];
+      if (l.x < l.slots) visit(l.tail, l.fwd + pi[static_cast<std::size_t>(l.tail)] - pi[wi]);
+    }
+    for (auto s = out_first[wi]; s < out_first[wi + 1]; ++s) {
+      const auto& l = links[static_cast<std::size_t>(out_links[static_cast<std::size_t>(s)])];
+      if (l.x > 0) visit(l.head, l.rev + pi[static_cast<std::size_t>(l.head)] - pi[wi]);
+    }
+    if (wi < q.live.size() && root_flow[wi] < k) visit(root, pi[static_cast<std::size_t>(root)] - pi[wi]);
+  };
+  using Entry = std::pair<Pair, std::int32_t>;
+  auto later = [](const Entry& a, const Entry& b) { return b.first < a.first; };
+  std::priority_queue<Entry, std::vector<Entry>, decltype(later)> heap(later);
+  std::vector<std::int32_t> hop(N, -1);
+  std::vector<std::int32_t> frontier;
+  for (Amount unit = 0; unit < K; ++unit) {
+    std::fill(reached.begin(), reached.end(), 0);
+    std::fill(settled.begin(), settled.end(), 0);
+    order.clear();
+    dist[static_cast<std::size_t>(root)] = Pair {};
+    reached[static_cast<std::size_t>(root)] = 1;
+    heap.push({Pair {}, root});
+    while (!heap.empty()) {
+      const auto [d, v] = heap.top();
+      const auto vi = static_cast<std::size_t>(v);
+      if (settled[vi] != 0 || dist[vi] < d) {
+        heap.pop();
+        continue;
+      }
+      // Every vertex at the sink's distance or nearer is settled; the rest is not on a shortest path.
+      if (settled[static_cast<std::size_t>(sink)] != 0 && dist[static_cast<std::size_t>(sink)] < d) break;
+      heap.pop();
+      settled[vi] = 1;
+      order.push_back(v);
+      if (v == sink) continue;
+      arcs_of(v, [&](const Arc& a) {
+        if (a.rp < Pair {}) internal("a negative reduced price");
+        const auto w = static_cast<std::size_t>(a.to);
+        const Pair nd = d + a.rp;
+        if (settled[w] != 0) return;
+        if (reached[w] == 0 || nd < dist[w]) {
+          reached[w] = 1;
+          dist[w] = nd;
+          heap.push({nd, a.to});
+        }
+      });
+    }
+    while (!heap.empty()) heap.pop();
+    if (settled[static_cast<std::size_t>(sink)] == 0) internal("no augmenting path below K units");
+    const Pair dt = dist[static_cast<std::size_t>(sink)];
+    // The hop counts back from the sink over the tight arcs (settled at both ends, the reduced
+    // price closing the distances exactly): a breadth-first search over the arcs into each vertex,
+    // so only vertices on shortest paths are reached.
+    for (std::int32_t v : order) hop[static_cast<std::size_t>(v)] = -1;
+    hop[static_cast<std::size_t>(sink)] = 0;
+    frontier.assign(1, sink);
+    for (std::size_t f = 0; f < frontier.size(); ++f) {
+      const std::int32_t w = frontier[f];
+      const auto wi = static_cast<std::size_t>(w);
+      in_arcs_of(w, [&](std::int32_t a, const Pair& rp) {
+        const auto ai = static_cast<std::size_t>(a);
+        if (settled[ai] == 0 || hop[ai] >= 0 || !(dist[ai] + rp == dist[wi])) return;
+        hop[ai] = hop[wi] + 1;
+        frontier.push_back(a);
+      });
+    }
+    if (hop[static_cast<std::size_t>(root)] < 0) internal("the sink is not reached over tight arcs");
+    // The walk: at each vertex the smallest-key tight arc one hop nearer the sink; one unit along it.
+    std::int32_t v = root;
+    while (v != sink) {
+      const auto vi = static_cast<std::size_t>(v);
+      std::optional<Arc> best;
+      arcs_of(v, [&](const Arc& arc) {
+        const auto w = static_cast<std::size_t>(arc.to);
+        if (settled[w] == 0 || hop[w] != hop[vi] - 1 || !(dist[vi] + arc.rp == dist[w])) return;
+        if (!best || arc.key < best->key) best = arc;
+      });
+      if (!best) internal("the walk found no tight arc");
+      if (best->kind == 0) {
+        ++links[static_cast<std::size_t>(best->index)].x;
+        reprice(links[static_cast<std::size_t>(best->index)]);
+      } else if (best->kind == 1) {
+        --links[static_cast<std::size_t>(best->index)].x;
+        reprice(links[static_cast<std::size_t>(best->index)]);
+      } else if (best->kind == 2) {
+        ++root_flow[static_cast<std::size_t>(best->index)];
+      }
+      v = best->to;
+    }
+    for (std::size_t w = 0; w < N; ++w) pi[w] = pi[w] + (settled[w] != 0 ? dist[w] : dt);
+  }
+  for (std::int64_t f : root_flow) {
+    if (f != k) internal("a live head without its k tunnels");
+  }
+  std::vector<Amount> x(q.edges.size(), 0);
+  for (const auto& l : links) x[l.q] = l.x;
+  return x;
+}
+
+// ---------------------------------------------------------------- programs and budgets
+
+// A layout at one count and size: the tunnels in round order and the objectives.
+struct Laid {
+  std::vector<TunnelSetupResult> tunnels {};
+  Counter128 route_cost {};
+  Counter128 headroom_penalty {};
+};
+
+Laid lay(const Base& b, const Quota& q, std::int64_t k, Amount u, bool headroom) {
+  const auto& g = b.g;
+  const auto x = canonical(b, q, k, u, headroom);
+  std::vector<Amount> dense(static_cast<std::size_t>(g.num_edges()), 0);
+  for (std::size_t i = 0; i < q.edges.size(); ++i) dense[static_cast<std::size_t>(q.edges[i])] = x[i];
+  const auto objectives = t2_objectives(g, q.edges, x, b.V, u, headroom);
+  const auto cost = g.edge_costs();
+  // Unit paths per live head (the controllers' cut, each path expanded), sorted by EdgeId sequence.
+  auto dec = decompose(g, {}, std::move(dense), q.live, b.dests);
+  std::vector<std::vector<std::vector<EdgeId>>> per_head(q.live.size());
+  for (auto& p : dec.paths) {
+    auto& rows = per_head[static_cast<std::size_t>(p.roster_index)];
+    for (Amount n = 0; n < p.weight; ++n) rows.push_back(p.edges);
+  }
+  for (auto& rows : per_head) {
+    if (static_cast<std::int64_t>(rows.size()) != k) internal("a live head's paths are not k");
+    std::sort(rows.begin(), rows.end());
+  }
+  Laid out;
+  out.route_cost = objectives.route_cost;
+  out.headroom_penalty = objectives.headroom_penalty;
+  out.tunnels.reserve(q.live.size() * static_cast<std::size_t>(k));
+  for (std::int64_t j = 0; j < k; ++j) {
+    for (std::size_t h = 0; h < q.live.size(); ++h) {
+      TunnelSetupResult t;
+      t.roster_index = static_cast<std::int32_t>(q.live_pos[h]);
+      t.local_index = static_cast<std::int32_t>(j);
+      t.planned = u;
+      t.edges = per_head[h][static_cast<std::size_t>(j)];
+      for (EdgeId e : t.edges) t.path_cost += cost[static_cast<std::size_t>(e)];
+      out.tunnels.push_back(std::move(t));
+    }
+  }
+  return out;
+}
+
+// G(z): the live heads' part of a round-robin total z over the H roster positions.
+U128 live_part(const Quota& q, std::int64_t H, U128 z) noexcept {
+  const auto [per, rest] = divmod(z, static_cast<std::uint64_t>(H));
+  U128 g = mul_u64(per, q.live.size());
+  for (std::int64_t i : q.live_pos) {
+    if (static_cast<std::uint64_t>(i) < rest) g = add(g, u128(1));
+  }
+  return g;
+}
+
+// F'(k): the largest total z whose live shares fit on the tunnels of the program at U (each tunnel
+// at position j H + i receives RR(z, M, j H + i); dead positions ignored), in [M U, M (U + 1)).
+U128 live_budget(const Base& b, const std::vector<TunnelSetupResult>& tunnels, std::int64_t H, std::int64_t k, Amount U) {
+  const auto M = static_cast<std::uint64_t>(H * k);
+  std::vector<Amount> load(static_cast<std::size_t>(b.g.num_edges()), 0);
+  std::vector<EdgeId> touched;
+  auto fits = [&](U128 z) {
+    const auto [per, rest] = divmod(z, M);
+    for (const auto& t : tunnels) {
+      const auto pos = static_cast<std::uint64_t>(t.local_index * H + t.roster_index);  // below H k <= 2^30
+      const auto amount = static_cast<Amount>(per) + (pos < rest ? 1 : 0);
+      for (EdgeId e : t.edges) {
+        auto& x = load[static_cast<std::size_t>(e)];
+        if (x == 0) touched.push_back(e);
+        x += amount;
+      }
+    }
+    bool ok = true;
+    for (EdgeId e : touched) {
+      ok = ok && load[static_cast<std::size_t>(e)] <= b.V[static_cast<std::size_t>(e)];
+      load[static_cast<std::size_t>(e)] = 0;
+    }
+    touched.clear();
+    return ok;
+  };
+  U128 lo = mul_u64(M, static_cast<std::uint64_t>(U));  // fits: every tunnel gets U
+  U128 hi = add(lo, u128(M));                           // does not: every tunnel would get U + 1
+  while (sub(hi, lo) > u128(1)) {
+    const U128 mid = add(lo, half(sub(hi, lo)));
+    if (fits(mid)) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  return lo;
+}
+
+// The working size of a finite design D at count k: the largest live design share per tunnel,
+// at least 1, at most U.
+Amount working_size(const Quota& q, std::int64_t H, std::int64_t k, Amount U, std::optional<Amount> design) {
+  if (!design.has_value()) return U;
+  Amount need = 1;
+  for (std::int64_t i : q.live_pos) need = std::max(need, (round_robin_share(*design, H, i) + k - 1) / k);
+  return std::min(U, need);
+}
+
+} // namespace
+
+T2Layout t2_layout(const Graph& g, const Eligibility* elig, std::span<const NodeId> roster,
+                   std::span<const NodeId> dests, const TunnelCount& tunnels, bool headroom, std::optional<Amount> design,
+                   std::span<const Amount> V) {
+  const Base b = make_base(g, elig, roster, dests, V);
+  const Quota q = make_quota(b);
+  const auto H = static_cast<std::int64_t>(roster.size());
+  T2Layout out;
+  out.live = q.live;
+  out.count = tunnels.up_to ? 1 : tunnels.per_head;
+  if (q.live.empty()) return out;
+  std::int64_t k = tunnels.per_head;
+  Amount U = 0;
+  std::optional<Laid> cached;  // the chosen count's program at U(k), when "up to" built it
+  if (!tunnels.up_to) {
+    U = Sizing(b, q, k).common(q.max_v);
+  } else {
+    // Scores are live parts of totals (below 2^63); `target` is G(D) for a finite design.
+    const std::optional<U128> D = design.has_value() ? std::optional<U128>(u128(static_cast<std::uint64_t>(*design)))
+                                                     : std::nullopt;
+    const std::optional<U128> target = D.has_value() ? std::optional<U128>(live_part(q, H, *D)) : std::nullopt;
+    auto capped = [&](U128 z) { return D.has_value() && *D < z ? *D : z; };
+    k = 1;
+    U128 best {};
+    Amount limit = q.max_v;
+    for (std::int64_t c = 1; c <= tunnels.per_head; ++c) {
+      Sizing sz(b, q, c);
+      const Amount Uc = sz.common(limit);
+      if (Uc == 0) break;  // every later count fits no unit either: score 0
+      limit = Uc;
+      if (c == 1) U = Uc;  // the incumbent's size until a better count
+      const auto M = static_cast<std::uint64_t>(H * c);
+      const U128 lower = live_part(q, H, capped(mul_u64(M, static_cast<std::uint64_t>(Uc))));
+      const U128 upper = live_part(q, H, capped(sub(mul_u64(M, static_cast<std::uint64_t>(Uc) + 1), u128(1))));
+      if (target.has_value() && lower == *target) {
+        k = c;
+        U = Uc;
+        cached.reset();
+        break;
+      }
+      if (!(best < upper)) continue;
+      Laid at_u = lay(b, q, c, Uc, headroom);
+      const U128 score = live_part(q, H, capped(live_budget(b, at_u.tunnels, H, c, Uc)));
+      if (best < score) {
+        best = score;
+        k = c;
+        U = Uc;
+        cached = std::move(at_u);
+      }
+      if (target.has_value() && score == *target) break;
+    }
+  }
+  out.count = k;
+  out.common = U;
+  if (U == 0) {
+    // No whole unit per tunnel fits (live heads exist): no tunnels; the fluid size names the cause.
+    std::tie(out.fluid_num, out.fluid_den) = Sizing(b, q, k).fluid(0);
+    return out;
+  }
+  std::tie(out.fluid_num, out.fluid_den) = Sizing(b, q, k).fluid(U);
+  out.planned = working_size(q, H, k, U, design);
+  Laid laid = cached.has_value() && out.planned == U ? std::move(*cached) : lay(b, q, k, out.planned, headroom);
+  out.tunnels = std::move(laid.tunnels);
+  out.route_cost = laid.route_cost;
+  out.headroom_penalty = laid.headroom_penalty;
+  return out;
+}
+
+T2Objectives t2_objectives(const Graph& g, std::span<const EdgeId> edges, std::span<const Amount> x,
+                           std::span<const Amount> V, Amount u, bool headroom) {
+  const auto cost = g.edge_costs();
+  const auto cap = g.edge_capacity_units();
+  U128 J {};
+  U128 Phi {};
+  for (std::size_t i = 0; i < edges.size(); ++i) {
+    if (x[i] == 0) continue;
+    const auto e = static_cast<std::size_t>(edges[i]);
+    J = add(J, mul_u64(static_cast<std::uint64_t>(cost[e]), static_cast<std::uint64_t>(x[i])));
+    if (!headroom || cap[e] == 0) continue;
+    if (V[e] > cap[e] || x[i] > V[e] / u) internal("a link's slots exceed its free capacity");
+    Phi = add(Phi, slot_price_sum(cap[e], V[e], u, x[i]));
+  }
+  return {Counter128 {J.hi, J.lo}, Counter128 {Phi.hi, Phi.lo}};
+}
+
+} // namespace netgraph::core::detail
diff --git a/src/concurrency.cpp b/src/concurrency.cpp
new file mode 100644
index 0000000..8be89e0
--- /dev/null
+++ b/src/concurrency.cpp
@@ -0,0 +1,15 @@
+// One probe slot shared by the native library and its Python bindings. Keeping the
+// TLS behind functions also makes its identity independent of TU visibility/LTO.
+#include "netgraph/core/detail/concurrency.hpp"
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+namespace netgraph::core::detail {
+namespace {
+thread_local const ConcurrentProbe* probe_slot = nullptr;
+}
+const ConcurrentProbe* current_concurrent_probe() noexcept { return probe_slot; }
+void set_concurrent_probe(const ConcurrentProbe* probe) noexcept { probe_slot = probe; }
+void concurrent_event(ConcurrentStage stage, const void* object) {
+  if (probe_slot != nullptr) probe_slot->notify(probe_slot->context, stage, object);
+}
+} // namespace netgraph::core::detail
+#endif
diff --git a/src/cpu_backend.cpp b/src/cpu_backend.cpp
deleted file mode 100644
index b173d7d..0000000
--- a/src/cpu_backend.cpp
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
-  CPU Backend — thin adapter that delegates to in-process algorithms.
-*/
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/k_shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-
-#include <stdexcept>
-
-namespace netgraph::core {
-
-namespace {
-class CpuBackend final : public Backend {
-public:
-  GraphHandle build_graph(const StrictMultiDiGraph& g) override {
-    // Create a non-owning shared_ptr with no-op deleter; lifetime is managed by caller
-    return GraphHandle{ std::shared_ptr<const StrictMultiDiGraph>(&g, [](const StrictMultiDiGraph*){}) };
-  }
-
-  std::pair<std::vector<Cost>, PredDAG> spf(
-      const GraphHandle& gh, NodeId src, const SpfOptions& opts) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    // Validate mask lengths strictly; mismatches are user errors.
-    // NOTE: this check is deliberately duplicated with the one inside
-    // shortest_paths(): the backend layer produces a caller-facing message, and the
-    // algorithm layer must stand on its own because it is also part of the public
-    // C++ API and callable without going through a Backend.
-    if (!opts.node_mask.empty() && opts.node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("CpuBackend::spf: node_mask length mismatch");
-    }
-    if (!opts.edge_mask.empty() && opts.edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("CpuBackend::spf: edge_mask length mismatch");
-    }
-    // Forward spans directly (already validated above)
-    return netgraph::core::shortest_paths(g, src, opts.dst, opts.multipath, opts.selection,
-                                          opts.residual, opts.node_mask, opts.edge_mask);
-  }
-
-  std::pair<std::vector<Cost>, PredDAG> spf_to(
-      const GraphHandle& gh, NodeId dst, const SpfToOptions& opts) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    if (!opts.node_mask.empty() && opts.node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("CpuBackend::spf_to: node_mask length mismatch");
-    }
-    if (!opts.edge_mask.empty() && opts.edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("CpuBackend::spf_to: edge_mask length mismatch");
-    }
-    return netgraph::core::shortest_paths_to(g, dst, opts.multipath, opts.selection,
-                                             opts.residual, opts.node_mask, opts.edge_mask,
-                                             opts.fanout_edges);
-  }
-
-  std::pair<Flow, FlowSummary> max_flow(
-      const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    // Validate mask lengths strictly.
-    if (!opts.node_mask.empty() && opts.node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("CpuBackend::max_flow: node_mask length mismatch");
-    }
-    if (!opts.edge_mask.empty() && opts.edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("CpuBackend::max_flow: edge_mask length mismatch");
-    }
-    // Forward spans directly (already validated above)
-    return netgraph::core::calc_max_flow(
-        g, src, dst,
-        opts.placement, opts.shortest_path,
-        opts.require_capacity,
-        opts.with_edge_flows,
-        opts.with_reachable,
-        opts.with_residuals,
-        opts.node_mask, opts.edge_mask);
-  }
-
-  std::vector<std::pair<std::vector<Cost>, PredDAG>> ksp(
-      const GraphHandle& gh, NodeId src, NodeId dst, const KspOptions& opts) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    if (opts.k <= 0) { return {}; }
-    // Validate mask lengths strictly.
-    if (!opts.node_mask.empty() && opts.node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("CpuBackend::ksp: node_mask length mismatch");
-    }
-    if (!opts.edge_mask.empty() && opts.edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("CpuBackend::ksp: edge_mask length mismatch");
-    }
-    // Forward spans directly (already validated above)
-    return netgraph::core::k_shortest_paths(g, src, dst, opts.k, opts.max_cost_factor,
-                                            opts.unique, opts.node_mask, opts.edge_mask);
-  }
-
-  std::vector<FlowSummary> batch_max_flow(
-      const GraphHandle& gh,
-      const std::vector<std::pair<NodeId,NodeId>>& pairs,
-      const MaxFlowOptions& opts,
-      const std::vector<std::span<const bool>>& node_masks,
-      const std::vector<std::span<const bool>>& edge_masks) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    // Validate batch mask lengths strictly.
-    for (const auto& span : node_masks) {
-      if (!span.empty() && span.size() != static_cast<std::size_t>(g.num_nodes())) {
-        throw std::invalid_argument("CpuBackend::batch_max_flow: node_mask length mismatch");
-      }
-    }
-    for (const auto& span : edge_masks) {
-      if (!span.empty() && span.size() != static_cast<std::size_t>(g.num_edges())) {
-        throw std::invalid_argument("CpuBackend::batch_max_flow: edge_mask length mismatch");
-      }
-    }
-    // Forward spans directly (already validated above)
-    return netgraph::core::batch_max_flow(g, pairs,
-                                          opts.placement, opts.shortest_path,
-                                          opts.require_capacity,
-                                          opts.with_edge_flows, opts.with_reachable, opts.with_residuals,
-                                          node_masks, edge_masks);
-  }
-
-  std::vector<std::pair<EdgeId, Flow>> sensitivity_analysis(
-      const GraphHandle& gh, NodeId src, NodeId dst, const MaxFlowOptions& opts) override {
-    const StrictMultiDiGraph& g = *gh.graph;
-    // Validate mask lengths strictly.
-    if (!opts.node_mask.empty() && opts.node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("CpuBackend::sensitivity_analysis: node_mask length mismatch");
-    }
-    if (!opts.edge_mask.empty() && opts.edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("CpuBackend::sensitivity_analysis: edge_mask length mismatch");
-    }
-    return netgraph::core::sensitivity_analysis(g, src, dst,
-                                                opts.placement, opts.shortest_path,
-                                                opts.require_capacity,
-                                                opts.node_mask, opts.edge_mask);
-  }
-};
-} // namespace
-
-BackendPtr make_cpu_backend() {
-  return std::make_shared<CpuBackend>();
-}
-
-} // namespace netgraph::core
diff --git a/src/distributed_te.cpp b/src/distributed_te.cpp
new file mode 100644
index 0000000..3edf756
--- /dev/null
+++ b/src/distributed_te.cpp
@@ -0,0 +1,76 @@
+/*
+  T1 setup: every head sets up its own strict tunnels, no controller.
+
+  The design volume D is split RR(D, H, i) over the heads and each head's share RR(d, N, j) over
+  its N tunnels, so tunnels of one head differ by at most one unit. The attempts run in round
+  order (round j = 0..N-1, the heads ascending within a round), which is also the entry order
+  j * H + i of the program; every attempt runs even after failures, on the reservation view U
+  minus the requests of the tunnels already up in this setup. An attempt is one CSPF
+  (route_search): the allowed edges with U >= max(b, min_unreserved_bandwidth) (no filter at a
+  threshold of 0), Collapse of parallel members on the filtered candidates, the canonical single
+  path on static costs (cost, then the bottleneck score of a Higher* tie rule, fewer hops, the
+  smaller EdgeId sequence), the scores reading U. Then the cost ceiling. An up tunnel holds
+  exactly b on every edge of its path; a down one holds nothing. There is no partial reservation,
+  retry, growth or count reduction.
+
+  Amounts: U[e] <= capacity < 2^62 and an up tunnel's request is at most U[e] on its edges, so U
+  stays in [0, 2^62); the requests of one setup sum to D < 2^62.
+*/
+#include "netgraph/core/detail/tunnel_setup.hpp"
+
+#include <algorithm>
+#include <utility>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+
+namespace netgraph::core::detail {
+
+std::vector<std::pair<NodeId, Amount>> design_by_head(std::span<const NodeId> reachable_sources, Amount D) {
+  std::vector<std::pair<NodeId, Amount>> out;
+  out.reserve(reachable_sources.size());
+  const auto H = static_cast<std::int64_t>(reachable_sources.size());
+  for (std::int64_t i = 0; i < H; ++i) {
+    out.emplace_back(reachable_sources[static_cast<std::size_t>(i)], round_robin_share(D, H, i));
+  }
+  return out;
+}
+
+std::vector<TunnelSetupResult> setup_distributed_te_tunnels(const Graph& graph, const Eligibility* eligibility, std::span<const NodeId> reachable_sources,
+                                  std::span<const NodeId> destinations, const DistributedTE& ca, Cost c0, Amount D,
+                                  std::vector<Amount> U) {
+  // A tunnel is one path: the CSPF orders single paths by the model's tie rule.
+  const RouteChoice choice {ca.tie_break, false, ca.parallel_edges};
+  const auto H = static_cast<std::int64_t>(reachable_sources.size());
+  const std::int64_t N = ca.tunnel_count.per_head;
+  std::vector<TunnelSetupResult> out;
+  out.reserve(static_cast<std::size_t>(H * N));
+  for (std::int64_t j = 0; j < N; ++j) {
+    for (std::int64_t i = 0; i < H; ++i) {
+      TunnelSetupResult t;
+      t.roster_index = static_cast<std::int32_t>(i);
+      t.local_index = static_cast<std::int32_t>(j);
+      t.requested_bandwidth = round_robin_share(round_robin_share(D, H, i), N, j);
+      const SearchFilter gate {eligibility, U, std::max(t.requested_bandwidth, ca.min_unreserved_bandwidth)};
+      auto found = route_search(graph, gate, choice, reachable_sources[static_cast<std::size_t>(i)], destinations);
+      if (!found.has_value()) {
+        t.status = TunnelStatus::InsufficientBandwidth;
+      } else if (ca.cost_ceiling.has_value() &&
+                 (std::holds_alternative<AbsoluteCost>(*ca.cost_ceiling)
+                      ? found->cost > std::get<AbsoluteCost>(*ca.cost_ceiling).cost
+                      : !stretch_le(found->cost, c0, std::get<CostStretch>(*ca.cost_ceiling).numerator(),
+                                  std::get<CostStretch>(*ca.cost_ceiling).denominator()))) {
+        t.status = TunnelStatus::CostCeilingExceeded;
+      } else {
+        t.edges = std::move(found->edges);
+        t.path_cost = found->cost;
+        for (EdgeId e : t.edges) U[static_cast<std::size_t>(e)] -= t.requested_bandwidth;
+      }
+      out.push_back(std::move(t));
+    }
+  }
+  return out;
+}
+
+} // namespace netgraph::core::detail
diff --git a/src/eligibility.cpp b/src/eligibility.cpp
new file mode 100644
index 0000000..c11190a
--- /dev/null
+++ b/src/eligibility.cpp
@@ -0,0 +1,81 @@
+/*
+  Eligibility: the static node and edge flags of one graph, its one public construction from
+  excluded ids, Graph::eligibility(excluded_nodes, excluded_edges), and intersect. An excluded
+  node excludes its incident edges (its out-edge id range and its reverse-CSR in-edges);
+  intersect keeps an operand, and its uid, when the result equals it.
+*/
+#include "netgraph/core/eligibility.hpp"
+
+#include <cstddef>
+#include <cstdint>
+#include <stdexcept>
+#include <string>
+
+#include "netgraph/core/detail/uid.hpp"
+#include "netgraph/core/graph.hpp"
+
+namespace netgraph::core {
+
+namespace {
+
+using detail::next_uid;
+
+} // namespace
+
+Eligibility Graph::eligibility(std::span<const NodeId> excluded_nodes,
+                               std::span<const EdgeId> excluded_edges) const {
+  const auto n = static_cast<std::size_t>(num_nodes_);
+  const auto m = edge_capacity_units_.size();
+  for (NodeId v : excluded_nodes) {
+    if (v < 0 || static_cast<std::size_t>(v) >= n) {
+      throw std::invalid_argument("excluded node " + std::to_string(v) + " out of node range [0, " +
+                                  std::to_string(n) + ")");
+    }
+  }
+  for (EdgeId e : excluded_edges) {
+    if (e < 0 || static_cast<std::size_t>(e) >= m) {
+      throw std::invalid_argument("excluded edge " + std::to_string(e) + " out of edge range [0, " +
+                                  std::to_string(m) + ")");
+    }
+  }
+  Eligibility el;
+  el.graph_uid_ = uid_;
+  el.node_allowed_.assign(n, 1);
+  el.edge_allowed_.assign(m, 1);
+  for (EdgeId e : excluded_edges) el.edge_allowed_[static_cast<std::size_t>(e)] = 0;
+  for (NodeId v : excluded_nodes) {
+    const auto vi = static_cast<std::size_t>(v);
+    if (el.node_allowed_[vi] == 0) continue;  // duplicate
+    el.node_allowed_[vi] = 0;
+    for (auto e = outgoing_offsets_[vi]; e < outgoing_offsets_[vi + 1]; ++e) {
+      el.edge_allowed_[static_cast<std::size_t>(e)] = 0;
+    }
+    for (auto s = incoming_offsets_[vi]; s < incoming_offsets_[vi + 1]; ++s) {
+      el.edge_allowed_[static_cast<std::size_t>(incoming_edges_[static_cast<std::size_t>(s)])] = 0;
+    }
+  }
+  el.uid_ = (excluded_nodes.empty() && excluded_edges.empty()) ? 0 : next_uid();
+  return el;
+}
+
+Eligibility Eligibility::intersect(const Eligibility& a, const Eligibility& b) {
+  if (a.graph_uid_ != b.graph_uid_) {
+    throw std::invalid_argument("Eligibility.intersect: the two values belong to different graphs");
+  }
+  Eligibility out;
+  out.graph_uid_ = a.graph_uid_;
+  out.node_allowed_.resize(a.node_allowed_.size());
+  out.edge_allowed_.resize(a.edge_allowed_.size());
+  for (std::size_t v = 0; v < out.node_allowed_.size(); ++v) {
+    out.node_allowed_[v] = static_cast<std::uint8_t>(a.node_allowed_[v] & b.node_allowed_[v]);
+  }
+  for (std::size_t e = 0; e < out.edge_allowed_.size(); ++e) {
+    out.edge_allowed_[e] = static_cast<std::uint8_t>(a.edge_allowed_[e] & b.edge_allowed_[e]);
+  }
+  if (out.node_allowed_ == a.node_allowed_ && out.edge_allowed_ == a.edge_allowed_) return a;
+  if (out.node_allowed_ == b.node_allowed_ && out.edge_allowed_ == b.edge_allowed_) return b;
+  out.uid_ = next_uid();
+  return out;
+}
+
+} // namespace netgraph::core
diff --git a/src/evaluators.cpp b/src/evaluators.cpp
new file mode 100644
index 0000000..589c3dc
--- /dev/null
+++ b/src/evaluators.cpp
@@ -0,0 +1,525 @@
+/*
+  evaluate_demand() is a fresh policy's place(offer) on a fresh ledger (absent: +inf; T1 and T2:
+  evaluate(offer, design)). evaluate_pairs() runs it per pair and evaluate_edge_failures() per candidate
+  deletion on `workers` threads; results follow
+  input order and the lowest failing index supplies the exception. Unrestricted CentralizedTE with the
+  optimized source allocation deletes only the edges its baseline loads. At a maximum baseline it
+  derives scalar losses from residual component certificates or the first deletion repair,
+  resetting each worker's private state independently, and solves afresh at a binding
+  offer. ShortestPaths skips an edge that no
+  roster source's reachable part of the static shortest-path support contains: removing it
+  changes no route or amount. Other deletions (the equal source allocation of CentralizedTE among them: a deletion
+  can raise its maximum; CentralizedTE with a support; T1 and T2, which set up or lay out again; Pinned,
+  which replays its program under each deletion) use fresh ledgers. Only ShortestPaths reads a
+  ShortestPathCache.
+*/
+#include "netgraph/core/evaluators.hpp"
+
+#include <algorithm>
+#include <atomic>
+#include <cstdint>
+#include <cstdlib>
+#include <exception>
+#include <memory>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <thread>
+
+#include "netgraph/core/detail/cache_access.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/evaluator_checks.hpp"
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+
+namespace netgraph::core {
+
+namespace {
+
+// A ledger of graph for one evaluation: the graph is borrowed (the ledger dies within the call).
+std::shared_ptr<const Graph> borrowed(const Graph& graph) {
+  return std::shared_ptr<const Graph>(std::shared_ptr<const void> {}, &graph);
+}
+
+// The call an evaluator makes on its fresh policy: place(offer), or for T1 and T2
+// evaluate(offer, design) (`full`).
+struct EvaluatorCall {
+  std::optional<Amount> offer {};   // nullopt: +inf (no offer, or the first-hop experiment)
+  std::optional<Amount> design {};  // the tunnel models' design D (nullopt: unlimited)
+  bool full {false};
+};
+
+bool in_domain(Amount x) noexcept { return x >= 0 && x < kDomainLimit; }
+
+// The evaluators' amounts, after the policy's construction checked the configuration: an
+// explicitly given offer (finite, in its domain); the design demand (its model, its domain, T1's
+// finite); T1's missing design; then the absent values resolved and the missing Lossy offer.
+EvaluatorCall evaluator_call(const FlowPolicyConfig& config, const std::optional<std::optional<Amount>>& offer,
+                             const std::optional<std::optional<Amount>>& design) {
+  const auto& r = config.routing;
+  if (offer.has_value() && (!offer->has_value() || !in_domain(**offer))) {
+    throw std::invalid_argument("offer must be an integer in [0, 2^62)");
+  }
+  const std::string model = detail::model_class(r);
+  const bool t1 = std::holds_alternative<DistributedTE>(r);
+  const auto* gl = std::get_if<CentralizedTE>(&r);
+  const bool t2 = gl != nullptr && gl->tunnel_count.has_value();
+  if (design.has_value()) {
+    if (!t1 && !t2) throw std::invalid_argument(model + " does not accept design_demand");
+    if (design->has_value() && !in_domain(**design)) {
+      throw std::invalid_argument("design_demand must be an integer in [0, 2^62) or permitted +inf");
+    }
+    if (t1 && !design->has_value()) throw std::invalid_argument("DistributedTE requires a finite design demand");
+  }
+  if (t1 && !design.has_value()) throw std::invalid_argument("DistributedTE evaluation requires design_demand");
+  EvaluatorCall call;
+  if (offer.has_value()) call.offer = **offer;
+  if (t1 || t2) {
+    call.full = true;
+    // T2's absent design is the offer when it is finite, else unlimited.
+    call.design = design.has_value() ? *design : call.offer;
+  }
+  if (config.admission == Admission::Lossy && !offer.has_value()) {
+    if (t2 && call.design.has_value()) {
+      call.offer = call.design;
+    } else if (t1 || t2 || std::holds_alternative<Pinned>(r)) {
+      throw std::invalid_argument(model + " LOSSY evaluation requires a finite offer");
+    }
+    // ShortestPaths Equal/Weighted: the first-hop experiment (place(+inf)).
+  }
+  return call;
+}
+
+// The evaluation of a fresh policy.
+PlacementResult run(FlowPolicy& policy, const EvaluatorCall& call, const OutputOptions& outputs) {
+  if (call.full) return policy.evaluate(call.offer, std::optional<std::optional<Amount>>(std::in_place, call.design), outputs);
+  return policy.place(call.offer, outputs);
+}
+
+// One evaluation inside a public call: a supplied frozen cache's hit goes to the call's tally.
+PlacementResult evaluate(const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+                         const EvaluationOptions& opts, const Eligibility* eligibility, ShortestPathCache* cache,
+                         const OutputOptions& outputs, detail::FrozenCacheHitTally& tally, const detail::TunnelRoster* roster = nullptr) {
+  FlowLedger fg(borrowed(graph));
+  FlowPolicy policy = detail::PolicyAccess::make(fg, sources, destinations, opts.config, eligibility, cache, tally, roster);
+  return run(policy, evaluator_call(policy.config(), opts.offer, opts.design_demand), outputs);
+}
+
+void check_common(const Graph& graph, const Eligibility* eligibility, const ShortestPathCache* cache, std::int32_t workers) {
+  if (workers < 1) throw std::invalid_argument("workers must be >= 1 (got " + std::to_string(workers) + ")");
+  if (eligibility != nullptr && eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  if (cache != nullptr && cache->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign ShortestPathCache: bound to another graph");
+  }
+}
+
+// Called only while the evaluator's single supplied-cache lease is held.
+void check_cache_mode(const ShortestPathCache* cache, std::int32_t workers) {
+  if (cache != nullptr && workers != 1 && !detail::DagCacheAccess::frozen(*cache)) {
+    throw std::invalid_argument(
+        "a supplied building ShortestPathCache has one writer: it is rejected unless workers == 1 (got workers = " +
+        std::to_string(workers) + "; a frozen cache may be shared by every worker)");
+  }
+}
+
+// The number of threads run_indexed uses for n tasks.
+std::size_t worker_threads(std::size_t n, std::int32_t workers) {
+  return std::max<std::size_t>(1, static_cast<std::size_t>(std::min<std::int64_t>(workers, static_cast<std::int64_t>(n))));
+}
+
+// A worker's cache for one evaluation: only ShortestPaths reads one (the other models reject a cache,
+// and the caller's was validated before the workers started).
+ShortestPathCache* worker_cache(const FlowPolicyConfig& config, ShortestPathCache& cache) noexcept {
+  return std::holds_alternative<ShortestPaths>(config.routing) ? &cache : nullptr;
+}
+
+// Increasing indices ensure every task below a failing index has already been taken.
+// Taken tasks finish even after an abort. Each exception has its own slot, and every
+// launched thread is joined before the lowest-index exception is rethrown.
+// The caller allocates result slots before entering; error and thread storage is private here.
+template <class Task>
+void run_tasks(std::size_t n, std::int32_t workers, Task task) {
+  if (n == 0) return;
+  const auto threads = worker_threads(n, workers);
+  std::vector<std::exception_ptr> errors(n);
+  std::atomic<std::size_t> next {0};
+  std::atomic<bool> abort {false};
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto* caller_probe = detail::current_concurrent_probe();
+#endif
+  auto worker = [&](std::size_t t) noexcept {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const detail::ScopedConcurrentProbe inherited(caller_probe);
+#endif
+    while (!abort.load(std::memory_order_relaxed)) {
+      const std::size_t i = next.fetch_add(1, std::memory_order_relaxed);
+      if (i >= n) break;
+      try {
+        detail::concurrent_event(detail::ConcurrentStage::WorkerBegin, &i);
+        task(i, t);
+      } catch (...) {
+        errors[i] = std::current_exception();
+        abort.store(true, std::memory_order_relaxed);
+      }
+    }
+  };
+  if (threads == 1) {
+    worker(0);
+  } else {
+    std::vector<std::thread> pool;
+    pool.reserve(threads);
+    try {
+      for (std::size_t t = 0; t < threads; ++t) {
+        detail::concurrent_event(detail::ConcurrentStage::ThreadLaunch, &t);
+        pool.emplace_back(worker, t);
+      }
+    } catch (...) {
+      abort.store(true);
+      for (auto& th : pool) th.join();
+      throw;
+    }
+    for (auto& th : pool) th.join();
+  }
+  for (const auto& e : errors) {
+    if (e) std::rethrow_exception(e);
+  }
+}
+
+// Evaluation workers borrow the supplied cache or own one private building cache each.
+// First-pass roster checks use run_tasks directly and need no cache or lease.
+template <class Task>
+void run_indexed(std::size_t n, std::int32_t workers, const Graph& graph, ShortestPathCache* shared, Task task) {
+  if (n == 0) return;
+  std::vector<std::unique_ptr<ShortestPathCache>> own;
+  if (shared == nullptr) {
+    const auto threads = worker_threads(n, workers);
+    own.reserve(threads);
+    for (std::size_t t = 0; t < threads; ++t) own.push_back(std::make_unique<ShortestPathCache>(graph));
+  }
+  run_tasks(n, workers, [&](std::size_t i, std::size_t t) {
+    task(i, shared != nullptr ? *shared : *own[t], t);
+  });
+}
+
+// ShortestPaths sensitivity: the edges of the full static support (every edge on a static shortest
+// path to the destination set) reachable from the roster sources through support edges. This is
+// not only the baseline's selected routes. Each source's route is read from the part of this set
+// reachable from it, then selected on the priority values of the residual at the preparing call's
+// entry (a fresh ledger's capacities). Deleting an edge outside the set leaves every reachable
+// node's distance and support edges as they were (distances only grow, and no shortest path of a
+// reachable node used the edge), and the roster as it was (a roster source keeps its support
+// edges; a deletion never connects a source). The support ignores capacity, so this holds for
+// edges of capacity 0 too. So every source's route, the pooled program (or the controller's
+// support) built from them, and the view they are read on are unchanged, and so is every amount:
+// the loss is exactly 0 and the deletion is not re-evaluated.
+std::vector<std::uint8_t> reachable_support(const Graph& graph, const detail::PolicyEngine& pe) {
+  const auto num_edges = static_cast<std::size_t>(graph.num_edges());
+  std::vector<std::uint8_t> in_support(num_edges, 0);
+  for (EdgeId e : detail::PredecessorDAGBuilder::ascending(*pe.support)) in_support[static_cast<std::size_t>(e)] = 1;
+  std::vector<std::uint8_t> reached(num_edges, 0);
+  std::vector<std::uint8_t> seen(static_cast<std::size_t>(graph.num_nodes()), 0);
+  const auto row = graph.outgoing_offsets();
+  const auto edge_destinations = graph.edge_destinations();
+  std::vector<NodeId> stack(pe.reachable_sources.begin(), pe.reachable_sources.end());
+  for (NodeId s : stack) seen[static_cast<std::size_t>(s)] = 1;
+  while (!stack.empty()) {
+    const auto u = static_cast<std::size_t>(stack.back());
+    stack.pop_back();
+    for (auto e = static_cast<std::size_t>(row[u]); e < static_cast<std::size_t>(row[u + 1]); ++e) {
+      if (in_support[e] == 0) continue;
+      reached[e] = 1;
+      const auto v = static_cast<std::size_t>(edge_destinations[e]);
+      if (seen[v] == 0) {
+        seen[v] = 1;
+        stack.push_back(static_cast<NodeId>(v));
+      }
+    }
+  }
+  return reached;
+}
+
+} // namespace
+
+namespace detail {
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+namespace {
+thread_local const SensitivityProbe* edge_failure_probe = nullptr;
+}
+const SensitivityProbe* current_edge_failure_probe() noexcept { return edge_failure_probe; }
+void set_edge_failure_probe(const SensitivityProbe* probe) noexcept { edge_failure_probe = probe; }
+#endif
+
+std::optional<TunnelRoster> check_demand_arguments(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const EvaluationOptions& options, ArgumentWork search) {
+  auto roster = check_policy_construction(graph, sources, destinations, options.config, options.eligibility, options.cache, search);
+  (void)evaluator_call(options.config, options.offer, options.design_demand);
+  return roster;
+}
+
+std::optional<TunnelRoster> check_edge_failure_arguments(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const EvaluationOptions& options, std::int32_t workers, ArgumentWork search) {
+  check_common(graph, options.eligibility, options.cache, workers);
+  return check_demand_arguments(graph, sources, destinations, options, search);
+}
+
+void check_batch_arguments(const Graph& graph, const EvaluationOptions& options, std::int32_t workers) {
+  check_common(graph, options.eligibility, options.cache, workers);
+  if (std::holds_alternative<Pinned>(options.config.routing)) throw std::invalid_argument("evaluate_pairs does not accept Pinned");
+  if (const auto* global = std::get_if<CentralizedTE>(&options.config.routing); global != nullptr && global->support &&
+                                                                       global->support->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("support belongs to another graph");
+  }
+  check_config(options.config, options.cache != nullptr, graph.num_nodes(), graph.num_edges(), std::nullopt);
+  (void)evaluator_call(options.config, options.offer, options.design_demand);
+}
+
+void check_batch_pair(const Graph& graph, const FlowPolicyConfig& config, std::span<const NodeId> sources,
+                      std::span<const NodeId> destinations, const Eligibility* eligibility, std::size_t index) {
+  const auto s = node_set(sources, graph.num_nodes(), "sources");
+  const auto t = node_set(destinations, graph.num_nodes(), "destinations");
+  check_disjoint(s, t, "sources", "destinations");
+  if (eligibility != nullptr && eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: per_pair_eligibility[" + std::to_string(index) +
+                                "] built for another graph");
+  }
+  check_source_count(config, s.size());
+}
+
+std::vector<TunnelRoster> prepare_batch_rosters(const Graph& graph,
+    std::span<const std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs,
+    const EvaluationOptions& options, std::span<const Eligibility* const> per_pair, std::int32_t workers,
+    ArgumentWork search) {
+  const auto* centralized = std::get_if<CentralizedTE>(&options.config.routing);
+  if (pairs.empty() || !(std::holds_alternative<DistributedTE>(options.config.routing) ||
+                        (centralized && centralized->tunnel_count.has_value()))) return {};
+  std::vector<TunnelRoster> rosters;
+  auto work = [&] {
+    rosters.resize(pairs.size());
+    run_tasks(pairs.size(), workers, [&](std::size_t i, std::size_t /*t*/) {
+      const auto* common = options.eligibility;
+      const auto* eligibility = per_pair.empty() ? nullptr : per_pair[i];
+      std::optional<Eligibility> both;
+      if (common && eligibility) both = Eligibility::intersect(*common, *eligibility);
+      const auto* mask = both ? &*both : (common ? common : eligibility);
+      rosters[i] = *check_policy_construction(graph, pairs[i].first, pairs[i].second, options.config, mask, nullptr);
+    });
+  };
+  if (search != nullptr) search([](void* context) { (*static_cast<decltype(work)*>(context))(); }, &work);
+  else work();
+  return rosters;
+}
+
+PlacementResult evaluate_demand_in_call(const Graph& graph, std::span<const NodeId> sources,
+                                 std::span<const NodeId> destinations, const EvaluationOptions& options, FrozenCacheHitTally& tally, const TunnelRoster* roster) {
+  return evaluate(graph, sources, destinations, options, options.eligibility, options.cache, options.outputs, tally, roster);
+}
+
+std::vector<PlacementResult> evaluate_pairs_in_call(
+    const Graph& graph, const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>>& pairs,
+    const EvaluationOptions& options, std::span<const Eligibility* const> per_pair_eligibility, std::int32_t workers,
+    FrozenCacheHitTally& tally, std::span<const TunnelRoster> rosters) {
+  check_cache_mode(options.cache, workers);
+  std::vector<std::optional<PlacementResult>> results(pairs.size());
+  run_indexed(pairs.size(), workers, graph, options.cache, [&](std::size_t i, ShortestPathCache& cache, std::size_t /*t*/) {
+    const Eligibility* extra = per_pair_eligibility.empty() ? nullptr : per_pair_eligibility[i];
+    std::optional<Eligibility> both;
+    const Eligibility* elig = options.eligibility;
+    if (extra != nullptr) {
+      if (elig == nullptr) {
+        elig = extra;
+      } else {
+        both = Eligibility::intersect(*options.eligibility, *extra);
+        elig = &*both;
+      }
+    }
+    results[i] = evaluate(graph, pairs[i].first, pairs[i].second, options, elig, worker_cache(options.config, cache),
+                          options.outputs, tally, rosters.empty() ? nullptr : &rosters[i]);
+  });
+  std::vector<PlacementResult> out;
+  out.reserve(results.size());
+  for (auto& r : results) out.push_back(std::move(*r));
+  return out;
+}
+
+SensitivityResult evaluate_edge_failures_in_call(const Graph& graph, std::span<const NodeId> sources,
+                                      std::span<const NodeId> destinations, const EvaluationOptions& options,
+                                      std::int32_t workers, FrozenCacheHitTally& tally, const TunnelRoster* roster) {
+  check_cache_mode(options.cache, workers);
+  // Unrestricted CentralizedTE with the optimized source allocation skips the links its baseline leaves without
+  // flow (deleting one keeps the baseline feasible, so the delivery stays). When the baseline is a maximum flow (no
+  // offer, or a finite offer above what it delivers) each loss uses a certificate or the first
+  // repair from an independent baseline reset; no partial allocation is published. When the offer
+  // binds (the baseline delivers it, perhaps below the maximum) each deletion is solved afresh at the offer. The
+  // equal source allocation, a support and T2 solve every allowed deletion afresh.
+  const auto* global_routing = std::get_if<CentralizedTE>(&options.config.routing);
+  const bool global = global_routing != nullptr && !global_routing->support && !global_routing->tunnel_count.has_value() &&
+                      global_routing->source_allocation == SourceAllocation::Optimized;
+  const bool shortest_paths = std::holds_alternative<ShortestPaths>(options.config.routing);
+  SensitivityResult out;
+  std::vector<std::uint8_t> on_route;  // ShortestPaths: the baseline's reachable support
+  detail::DeletionCapture capture;     // optimized CentralizedTE: the baseline solve's final state
+  {
+    std::unique_ptr<ShortestPathCache> own;
+    ShortestPathCache* cache = options.cache;
+    if (cache == nullptr && shortest_paths) {
+      own = std::make_unique<ShortestPathCache>(graph);
+      cache = own.get();
+    }
+    FlowLedger fg(borrowed(graph));
+    FlowPolicy policy = PolicyAccess::make(fg, sources, destinations, options.config, options.eligibility, cache, tally, roster);
+    auto& pe = PolicyAccess::engine(policy);
+    if (global) pe.capture = &capture;
+    out.baseline = run(policy, evaluator_call(policy.config(), options.offer, options.design_demand), options.outputs);
+    pe.capture = nullptr;
+    if (shortest_paths) on_route = reachable_support(graph, pe);
+  }
+  std::vector<EdgeId> candidates;
+  std::vector<Amount> baseline_flows;
+  if (global) {
+    // The baseline's positive-flow edges; no state, and no candidate, when no roster source
+    // reaches an allowed destination (nothing is placed).
+    if (capture.state.has_value()) {
+      if (capture.state->value() != out.baseline.call_delivered) {
+        throw std::logic_error("evaluate_edge_failures: the captured state differs from the baseline");
+      }
+      baseline_flows = capture.state->edge_flows();
+      for (EdgeId e = 0; e < graph.num_edges(); ++e) {
+        if (baseline_flows[static_cast<std::size_t>(e)] > 0) candidates.push_back(e);
+      }
+    }
+  } else {
+    // Every allowed edge: an edge of capacity 0 can carry a route (and a roster source), and a
+    // deletion can raise an equal source allocation's total (its source then leaves the roster).
+    for (EdgeId e = 0; e < graph.num_edges(); ++e) {
+      if (options.eligibility == nullptr || options.eligibility->allows_edge(e)) candidates.push_back(e);
+    }
+  }
+  const Amount base = out.baseline.call_delivered;
+  const bool repair = global && (!options.offer.has_value() || base < **options.offer);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto* probe = current_edge_failure_probe();
+  const bool full_repair = probe != nullptr && probe->full_repair;
+  const bool classify = !full_repair && (probe == nullptr || probe->cut_edges);
+#else
+  constexpr bool full_repair = false;
+  constexpr bool classify = true;
+#endif
+  out.entries.resize(candidates.size());
+  std::vector<std::uint8_t> cut_edges;
+  if (repair && !candidates.empty() && classify) cut_edges = detail::deletion_cut_edges(*capture.state);
+  const bool needs_resolver = repair && std::any_of(candidates.begin(), candidates.end(), [&](EdgeId e) {
+    return cut_edges.empty() || cut_edges[static_cast<std::size_t>(e)] == 0;
+  });
+  // CentralizedTE: one resolver per worker (its copy of the state and its working storage), made here.
+  std::vector<detail::DeletionResolver> resolvers;
+  if (needs_resolver) {
+    const auto threads = worker_threads(candidates.size(), workers);
+    resolvers.reserve(threads);
+    for (std::size_t t = 0; t < threads; ++t) resolvers.emplace_back(*capture.state);
+  }
+  run_indexed(candidates.size(), workers, graph, options.cache, [&](std::size_t i, ShortestPathCache& cache, std::size_t t) {
+    const EdgeId e = candidates[i];
+    auto& entry = out.entries[i];
+    entry.edge = e;
+    // A failed deletion fails the call: run_indexed raises the lowest failing candidate's exception.
+    if (repair) {
+      const auto k = static_cast<std::size_t>(e);
+      const bool cut = !cut_edges.empty() && cut_edges[k] != 0;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      if (probe != nullptr && probe->observe != nullptr) {
+        probe->observe(probe->context, e, full_repair ? SensitivityWork::FullRepair : cut ? SensitivityWork::Cut : SensitivityWork::FirstRepair);
+      }
+#endif
+      if (cut) entry.delivery_reduction = baseline_flows[k];
+      else if (full_repair) entry.delivery_reduction = base - resolvers[t].resolve(e).value;
+      else entry.delivery_reduction = resolvers[t].loss(e);
+      return;
+    }
+    if (shortest_paths && on_route[static_cast<std::size_t>(e)] == 0) {
+      entry.delivery_reduction = 0;
+    } else {
+      const EdgeId one[1] = {e};
+      Eligibility deleted = graph.eligibility({}, one);
+      if (options.eligibility != nullptr) deleted = Eligibility::intersect(*options.eligibility, deleted);
+      const auto r = evaluate(graph, sources, destinations, options, &deleted, worker_cache(options.config, cache),
+                              OutputOptions {}, tally);
+      entry.delivery_reduction = base - r.call_delivered;
+    }
+    if (&cache != options.cache) detail::DagCacheAccess::clear_private(cache);
+  });
+  return out;
+}
+
+std::int32_t default_workers(bool edge_failures) noexcept {
+  const char* v = edge_failures ? std::getenv("NGRAPH_CORE_SENSITIVITY_THREADS") : std::getenv("NGRAPH_CORE_BATCH_THREADS");
+  if (v == nullptr) return 1;
+  char* end = nullptr;
+  const long n = std::strtol(v, &end, 10);
+  if (end == v || *end != '\0' || n < 1 || n > 4096) return 1;
+  return static_cast<std::int32_t>(n);
+}
+
+} // namespace detail
+
+// Each evaluator is one public call on a supplied frozen cache's statistics.
+PlacementResult evaluate_demand(const Graph& graph, std::span<const NodeId> input_sources,
+                         std::span<const NodeId> input_destinations, const EvaluationOptions& input_options) {
+  const EvaluationOptions options = input_options;
+  const std::vector<NodeId> sources(input_sources.begin(), input_sources.end());
+  const std::vector<NodeId> destinations(input_destinations.begin(), input_destinations.end());
+  const auto roster = detail::check_demand_arguments(graph, sources, destinations, options);
+  return detail::frozen_call(options.cache, [&](detail::FrozenCacheHitTally& tally) {
+    return detail::evaluate_demand_in_call(graph, sources, destinations, options, tally, roster ? &*roster : nullptr);
+  });
+}
+
+std::vector<PlacementResult> evaluate_pairs(
+    const Graph& graph, const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>>& input_pairs,
+    const EvaluationOptions& input_options, std::span<const Eligibility* const> input_per_pair, std::int32_t workers) {
+  const EvaluationOptions options = input_options;
+  const auto pairs = input_pairs;
+  const std::vector<const Eligibility*> per_pair_eligibility(input_per_pair.begin(), input_per_pair.end());
+  detail::check_batch_arguments(graph, options, workers);
+  if (!per_pair_eligibility.empty() && per_pair_eligibility.size() != pairs.size()) {
+    throw std::invalid_argument("per_pair_eligibility has " + std::to_string(per_pair_eligibility.size()) + " entries for " +
+                                std::to_string(pairs.size()) + " pairs");
+  }
+  std::exception_ptr pending;
+  std::size_t valid = 0;
+  for (std::size_t i = 0; i < pairs.size(); ++i) {
+    try {
+      detail::check_batch_pair(graph, options.config, pairs[i].first, pairs[i].second,
+          per_pair_eligibility.empty() ? nullptr : per_pair_eligibility[i], i);
+      ++valid;
+    } catch (...) {
+      pending = std::current_exception();
+      break;
+    }
+  }
+  // Searches of the valid prefix precede the later pair's attached-check error.
+  // The search workers themselves report the lowest failing pair and are joined here.
+  const auto rosters = detail::prepare_batch_rosters(graph, std::span(pairs).first(valid), options, per_pair_eligibility, workers);
+  if (pending) std::rethrow_exception(pending);
+  return detail::frozen_call(options.cache, [&](detail::FrozenCacheHitTally& tally) {
+    return detail::evaluate_pairs_in_call(graph, pairs, options, per_pair_eligibility, workers, tally, rosters);
+  });
+}
+
+SensitivityResult evaluate_edge_failures(const Graph& graph, std::span<const NodeId> input_sources,
+                              std::span<const NodeId> input_destinations, const EvaluationOptions& input_options,
+                              std::int32_t workers) {
+  const EvaluationOptions options = input_options;
+  const std::vector<NodeId> sources(input_sources.begin(), input_sources.end());
+  const std::vector<NodeId> destinations(input_destinations.begin(), input_destinations.end());
+  const auto roster = detail::check_edge_failure_arguments(graph, sources, destinations, options, workers);
+  return detail::frozen_call(options.cache, [&](detail::FrozenCacheHitTally& tally) {
+    return detail::evaluate_edge_failures_in_call(graph, sources, destinations, options, workers, tally, roster ? &*roster : nullptr);
+  });
+}
+
+} // namespace netgraph::core
diff --git a/src/flow_graph.cpp b/src/flow_graph.cpp
deleted file mode 100644
index 44ac4ae..0000000
--- a/src/flow_graph.cpp
+++ /dev/null
@@ -1,185 +0,0 @@
-/*
-  FlowGraph — authoritative flow ledger layered over FlowState.
-
-  Tracks per-flow edge allocations to support exact removal and path inspection,
-  while delegating residual and aggregate flow management to FlowState.
-*/
-#include "netgraph/core/flow_graph.hpp"
-#include "netgraph/core/constants.hpp"
-
-#include <algorithm>
-#include <atomic>
-#include <utility>
-
-namespace netgraph::core {
-
-namespace {
-// Process-unique instance ids for state_stamp(); never reused, so a stamp
-// taken from one FlowGraph can never match a different (or later) instance.
-std::uint64_t fresh_flow_graph_uid() noexcept {
-  static std::atomic<std::uint64_t> next_uid{1};
-  return next_uid.fetch_add(1, std::memory_order_relaxed);
-}
-} // namespace
-
-FlowGraph::FlowGraph(const StrictMultiDiGraph& g)
-  : g_(&g), fs_(g), uid_(fresh_flow_graph_uid()) {
-}
-
-// See the header: copies and moves must not share the source's uid, or two
-// diverging objects could present equal stamps over different residuals.
-FlowGraph::FlowGraph(const FlowGraph& other)
-  : g_(other.g_), fs_(other.fs_), ledger_(other.ledger_),
-    uid_(fresh_flow_graph_uid()), version_(0) {
-}
-
-FlowGraph& FlowGraph::operator=(const FlowGraph& other) {
-  if (this != &other) {
-    g_ = other.g_;
-    fs_ = other.fs_;
-    ledger_ = other.ledger_;
-    uid_ = fresh_flow_graph_uid();
-    version_ = 0;
-  }
-  return *this;
-}
-
-FlowGraph::FlowGraph(FlowGraph&& other) noexcept
-  : g_(other.g_), fs_(std::move(other.fs_)), ledger_(std::move(other.ledger_)),
-    uid_(fresh_flow_graph_uid()), version_(0) {
-}
-
-FlowGraph& FlowGraph::operator=(FlowGraph&& other) noexcept {
-  if (this != &other) {
-    g_ = other.g_;
-    fs_ = std::move(other.fs_);
-    ledger_ = std::move(other.ledger_);
-    uid_ = fresh_flow_graph_uid();
-    version_ = 0;
-  }
-  return *this;
-}
-
-Flow FlowGraph::place(const FlowIndex& idx, NodeId src, NodeId dst,
-                      const PredDAG& dag, Flow amount,
-                      FlowPlacement placement,
-                      std::vector<std::pair<EdgeId, Flow>>* drops) {
-  if (amount <= 0.0) return 0.0;
-  ++version_;  // residuals may change from here on
-
-  // Get or create ledger entry for this flow. The ledger tracks per-edge
-  // cumulative amounts contributed by this flow (not just last placement).
-  // We append fresh deltas to the existing bucket, then coalesce by EdgeId.
-  auto& bucket = ledger_[idx];
-
-  // Delegate placement to FlowState, which returns the actual placed flow and
-  // populates bucket with per-edge allocations (EdgeId, Flow) pairs.
-  Flow placed = fs_.place_on_dag(src, dst, dag, amount, placement, &bucket, drops);
-
-  // Coalesce and filter: merge duplicate EdgeIds. Keep any positive totals
-  // (do not drop sub-kMinFlow amounts) to preserve exact reversibility.
-  if (!bucket.empty()) {
-    std::vector<std::pair<EdgeId, Flow>> compact;
-    compact.reserve(bucket.size());
-    // Sort by EdgeId to group duplicates together.
-    std::sort(bucket.begin(), bucket.end(), [](auto const& a, auto const& b){ return a.first < b.first; });
-    // Merge consecutive entries with the same EdgeId.
-    for (std::size_t i=0;i<bucket.size();) {
-      EdgeId e = bucket[i].first; double sum = 0.0; std::size_t j=i;
-      while (j<bucket.size() && bucket[j].first==e) { sum += bucket[j].second; ++j; }
-      if (sum > 0.0) compact.emplace_back(e, static_cast<Flow>(sum));
-      i=j;
-    }
-    bucket.swap(compact);  // replace bucket with compacted version
-  }
-
-  // Clean up if no meaningful flow was placed.
-  if (bucket.empty() && placed < kMinFlow) {
-    ledger_.erase(idx);
-    return 0.0;
-  }
-  return placed;
-}
-
-void FlowGraph::remove(const FlowIndex& idx) {
-  auto it = ledger_.find(idx);
-  if (it == ledger_.end()) return;  // flow not found
-  ++version_;
-  const auto& deltas = it->second;
-  // Revert this flow's allocations from the FlowState by subtracting them.
-  if (!deltas.empty()) {
-    fs_.apply_deltas(deltas, /*add=*/false);  // false = subtract
-  }
-  ledger_.erase(it);
-}
-
-void FlowGraph::remove_by_class(FlowClass flowClass) {
-  std::vector<FlowIndex> to_rm;
-  to_rm.reserve(ledger_.size());
-  for (auto const& kv : ledger_) if (kv.first.flowClass == flowClass) to_rm.push_back(kv.first);
-  for (auto const& idx : to_rm) remove(idx);
-}
-
-void FlowGraph::reset() noexcept {
-  ++version_;
-  fs_.reset();
-  ledger_.clear();
-}
-
-std::vector<std::pair<EdgeId, Flow>> FlowGraph::get_flow_edges(const FlowIndex& idx) const {
-  auto it = ledger_.find(idx);
-  if (it == ledger_.end()) return {};
-  return it->second;
-}
-
-std::vector<EdgeId> FlowGraph::get_flow_path(const FlowIndex& idx) const {
-  auto it = ledger_.find(idx);
-  if (it == ledger_.end()) return {};
-  const auto& deltas = it->second;
-
-  // Reconstruct a simple path from the flow's edge allocations.
-  // This only succeeds if the flow forms a single path (not a DAG).
-
-  // Step 1: Build adjacency map from edges with positive flow.
-  std::unordered_map<NodeId, std::vector<std::pair<NodeId, EdgeId>>> adj;
-  // Build adjacency list from allocations using cached src/dst.
-  for (auto const& pr : deltas) {
-    if (pr.second < kEpsilon) continue;
-    auto eid = static_cast<std::size_t>(pr.first);
-    NodeId u = g_->edge_src_view()[eid]; NodeId v = g_->edge_dst_view()[eid];
-    adj[u].emplace_back(v, pr.first);
-  }
-
-  // Step 2: Find starting node (out-degree == 1, in-degree == 0).
-  std::unordered_map<NodeId, int> indeg;
-  for (auto const& kv : adj)
-    for (auto const& pr : kv.second)
-      indeg[pr.first]++;
-
-  NodeId start = -1;
-  for (auto const& kv : adj) {
-    // Candidate: has exactly one outgoing edge and zero incoming edges.
-    if (kv.second.size() == 1) {
-      if (indeg.find(kv.first) == indeg.end()) {
-        start = kv.first;
-        break;
-      }
-    }
-  }
-  if (start < 0) return {};  // no clear start node
-
-  // Step 3: Walk the path from start, collecting edges.
-  std::vector<EdgeId> path;
-  NodeId cur = start;
-  std::size_t guard = 0;  // prevent infinite loops
-  while (adj.count(cur)) {
-    if (adj[cur].size() != 1) return {};  // branching detected, not a simple path
-    auto [nxt, eid] = adj[cur][0];
-    path.push_back(eid);
-    cur = nxt;
-    if (++guard > static_cast<std::size_t>(g_->num_edges())) return {};  // cycle detected
-  }
-  return path;
-}
-
-} // namespace netgraph::core
diff --git a/src/flow_ledger.cpp b/src/flow_ledger.cpp
new file mode 100644
index 0000000..a024e46
--- /dev/null
+++ b/src/flow_ledger.cpp
@@ -0,0 +1,720 @@
+/*
+  The integer ledger FlowLedger.
+
+  The aggregate allocation and the aggregate holds are kept exactly (integers) and changed only by
+  an atomic commit, a detach or a reset (which zeroes them); residual() and unreserved() are
+  derived from them (each baseline minus its aggregate). The two projections are never added.
+  Records are kept by id (FlowId order); ids come from a per-ledger counter and are never
+  reused, also across reset().
+*/
+#include "netgraph/core/flow_ledger.hpp"
+
+#include <algorithm>
+#include <cstdint>
+#include <limits>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+
+#include "netgraph/core/detail/edge_amounts.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/uid.hpp"
+
+namespace netgraph::core {
+
+FlowLedger::FlowLedger(std::shared_ptr<const Graph> graph) {
+  if (!graph) throw std::invalid_argument("FlowLedger: graph is null");
+  graph_ = std::move(graph);
+  service_baseline_.assign(graph_->edge_capacity_units().begin(), graph_->edge_capacity_units().end());
+  carried_.assign(service_baseline_.size(), 0);
+  uid_ = detail::next_uid();
+}
+
+FlowLedger::FlowLedger(std::shared_ptr<const Graph> graph, std::span<const Amount> service_baseline) {
+  if (!graph) throw std::invalid_argument("FlowLedger: graph is null");
+  graph_ = std::move(graph);
+  service_baseline_ = checked_baseline(service_baseline, "service_baseline");
+  carried_.assign(service_baseline_.size(), 0);
+  uid_ = detail::next_uid();
+}
+
+FlowLedger::FlowLedger(std::shared_ptr<const Graph> graph, std::span<const Amount> service_baseline,
+                       std::span<const Amount> reservation_baseline) {
+  if (!graph) throw std::invalid_argument("FlowLedger: graph is null");
+  graph_ = std::move(graph);
+  service_baseline_ = checked_baseline(service_baseline, "service_baseline");
+  reservation_baseline_ = checked_baseline(reservation_baseline, "reservation_baseline");
+  carried_.assign(service_baseline_.size(), 0);
+  uid_ = detail::next_uid();
+}
+
+FlowLedger::FlowLedger(const FlowLedger& other) {
+  const auto guard = detail::LedgerAccess::lock(other);
+  other.check_usable();
+  if (other.num_bound_policies_ != 0) {
+    throw std::invalid_argument("FlowLedger: a ledger with bound policies cannot be copied");
+  }
+  graph_ = other.graph_;
+  uid_ = detail::next_uid();
+  service_baseline_ = other.service_baseline_;
+  carried_ = other.carried_;
+  reservation_baseline_ = other.reservation_baseline_;
+  reserved_ = other.reserved_;
+  records_ = other.records_;
+  policy_record_counters_ = other.policy_record_counters_;
+  for (auto& [id, rec] : records_) rec.flow_id = FlowId {uid_, id};
+  next_record_counter_ = other.next_record_counter_;
+  next_policy_id_ = other.next_policy_id_;
+  policy_bindings_ = other.policy_bindings_;  // orphans only
+}
+
+FlowLedger::FlowLedger(FlowLedger&& other) {
+  const auto guard = detail::LedgerAccess::lock(other);
+  other.check_usable();
+  if (other.num_bound_policies_ != 0) {
+    throw std::invalid_argument("FlowLedger: a ledger with bound policies cannot be moved");
+  }
+  graph_ = other.graph_;
+  uid_ = other.uid_;
+  service_baseline_ = std::move(other.service_baseline_);
+  carried_ = std::move(other.carried_);
+  reservation_baseline_ = std::move(other.reservation_baseline_);
+  reserved_ = std::move(other.reserved_);
+  records_ = std::move(other.records_);
+  policy_record_counters_ = std::move(other.policy_record_counters_);
+  next_record_counter_ = other.next_record_counter_;
+  next_policy_id_ = other.next_policy_id_;
+  policy_bindings_ = std::move(other.policy_bindings_);
+  other.usable_ = false;
+  other.service_baseline_.clear();
+  other.carried_.clear();
+  other.reservation_baseline_.clear();
+  other.reserved_.clear();
+  other.records_.clear();
+  other.policy_record_counters_.clear();
+  other.policy_bindings_.clear();
+}
+
+void FlowLedger::check_usable() const {
+  if (!usable_) throw std::logic_error("FlowLedger: a moved-from ledger is empty and unusable");
+}
+
+std::vector<Amount> FlowLedger::checked_baseline(std::span<const Amount> amounts, const char* label) const {
+  detail::check_edge_amounts(*graph_, amounts, label);
+  return std::vector<Amount>(amounts.begin(), amounts.end());
+}
+
+std::uint64_t FlowLedger::uid() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  return uid_;
+}
+
+const std::shared_ptr<const Graph>& FlowLedger::graph() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  return graph_;
+}
+
+std::span<const Amount> FlowLedger::edge_capacity_units() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  return graph_->edge_capacity_units();
+}
+
+std::vector<Amount> FlowLedger::residual() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  std::vector<Amount> out(service_baseline_.size());
+  for (std::size_t e = 0; e < out.size(); ++e) out[e] = service_baseline_[e] - carried_[e];
+  return out;
+}
+
+std::vector<Amount> FlowLedger::carried() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  return carried_;
+}
+
+std::vector<Amount> FlowLedger::reserved() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  return reserved_.empty() ? std::vector<Amount>(service_baseline_.size(), 0) : reserved_;
+}
+
+std::vector<Amount> FlowLedger::unreserved() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  std::vector<Amount> out(service_baseline_.size());
+  for (std::size_t e = 0; e < out.size(); ++e) out[e] = reservation_at(e) - reserved_at(e);
+  return out;
+}
+
+std::vector<FlowRecord> FlowLedger::records() const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  std::vector<FlowRecord> out;
+  out.reserve(records_.size());
+  for (const auto& [id, rec] : records_) out.push_back(rec);
+  return out;
+}
+
+FlowRecord FlowLedger::record(const FlowId& flow_id) const {
+  const auto guard = detail::LedgerAccess::lock(*this);
+  return detail::LedgerAccess::record(*this, flow_id);
+}
+
+FlowRecord detail::LedgerAccess::record(const FlowLedger& ledger, const FlowId& flow_id) {
+  ledger.check_usable();
+  if (flow_id.first != ledger.uid_) {
+    throw std::invalid_argument("FlowId (" + std::to_string(flow_id.first) + ", " + std::to_string(flow_id.second) +
+                                ") belongs to another ledger (uid " + std::to_string(ledger.uid_) + ")");
+  }
+  const auto it = ledger.records_.find(flow_id.second);
+  if (it == ledger.records_.end()) {
+    throw std::invalid_argument("FlowId (" + std::to_string(flow_id.first) + ", " + std::to_string(flow_id.second) +
+                                ") is retired or unknown");
+  }
+  return it->second;
+}
+
+std::vector<EdgeId> FlowLedger::saturated_boundary_edges(std::span<const NodeId> sources, const Eligibility* eligibility) const {
+  const auto& g = *graph_;
+  const auto srcs = detail::node_set(sources, g.num_nodes(), "sources");
+  if (eligibility != nullptr && eligibility->graph_uid() != g.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  const auto guard = detail::LedgerAccess::lock(*this);
+  std::vector<Amount> residual;
+  detail::LedgerAccess::residual_into(*this, residual);
+  return detail::saturated_boundary_edges_of(g, residual, srcs, eligibility);
+}
+
+namespace detail {
+
+std::vector<EdgeId> saturated_boundary_edges_of(const Graph& graph, std::span<const Amount> residual,
+                                  std::span<const NodeId> sources, const Eligibility* eligibility) {
+  const auto n = static_cast<std::size_t>(graph.num_nodes());
+  const auto m = static_cast<std::size_t>(graph.num_edges());
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  const auto capacity = graph.edge_capacity_units();
+  const auto row = graph.outgoing_offsets();
+  std::vector<std::uint8_t> seen(n, 0);
+  std::vector<NodeId> stack;
+  for (NodeId s : sources) {
+    if (eligibility != nullptr && !eligibility->allows_node(s)) continue;
+    if (seen[static_cast<std::size_t>(s)] != 0) continue;
+    seen[static_cast<std::size_t>(s)] = 1;
+    stack.push_back(s);
+  }
+  while (!stack.empty()) {
+    const auto u = static_cast<std::size_t>(stack.back());
+    stack.pop_back();
+    for (auto e = row[u]; e < row[u + 1]; ++e) {
+      const auto ei = static_cast<std::size_t>(e);
+      if (eligibility != nullptr && !eligibility->allows_edge(e)) continue;
+      if (residual[ei] < 1) continue;
+      const auto v = static_cast<std::size_t>(edge_destinations[ei]);
+      if (seen[v] == 0) {
+        seen[v] = 1;
+        stack.push_back(static_cast<NodeId>(v));
+      }
+    }
+  }
+  std::vector<EdgeId> out;
+  for (std::size_t e = 0; e < m; ++e) {
+    if (seen[static_cast<std::size_t>(edge_sources[e])] == 0 || seen[static_cast<std::size_t>(edge_destinations[e])] != 0) continue;
+    if (eligibility != nullptr && !eligibility->allows_edge(static_cast<EdgeId>(e))) continue;
+    if (capacity[e] < 1) continue;
+    out.push_back(static_cast<EdgeId>(e));
+  }
+  return out;
+}
+
+} // namespace detail
+
+void FlowLedger::reset() {
+  reset(graph_->edge_capacity_units());
+}
+
+void FlowLedger::reset(std::span<const Amount> service_baseline) {
+  auto baseline = checked_baseline(service_baseline, "service_baseline");
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  check_resettable();
+  install(std::move(baseline), {});
+}
+
+void FlowLedger::reset(std::span<const Amount> service_baseline, std::span<const Amount> reservation_baseline) {
+  auto baseline = checked_baseline(service_baseline, "service_baseline");
+  auto reservation = checked_baseline(reservation_baseline, "reservation_baseline");
+  const auto guard = detail::LedgerAccess::lock(*this);
+  check_usable();
+  check_resettable();
+  install(std::move(baseline), std::move(reservation));
+}
+
+void FlowLedger::check_resettable() const {
+  if (num_bound_policies_ != 0) {
+    throw std::invalid_argument("FlowLedger.reset is rejected while a policy is bound (" +
+                                std::to_string(num_bound_policies_) + " bound)");
+  }
+}
+
+// The new baselines (an empty reservation: the capacities) and no records; carried_ keeps its
+// size, so nothing here allocates.
+void FlowLedger::install(std::vector<Amount> baseline, std::vector<Amount> reservation) {
+  carried_.assign(baseline.size(), 0);
+  reserved_.clear();
+  service_baseline_ = std::move(baseline);
+  reservation_baseline_ = std::move(reservation);
+  records_.clear();
+  policy_record_counters_.clear();
+  policy_bindings_.clear();
+}
+
+namespace detail {
+
+namespace {
+
+bool is_bound(const std::map<std::int64_t, bool>& owners, std::int64_t owner) {
+  const auto it = owners.find(owner);
+  return it != owners.end() && it->second;
+}
+
+// Per-thread deltas indexed by EdgeId. Each commit advances an epoch (a numeric stamp).
+// A matching slot stamp means the edge is already in the touched list, even if its delta
+// returned to zero (-1, then +1), so each edge is published once. Reset a slot on first touch;
+// later commits ignore old stamps, including after an exception. Only stamp wraparound (after
+// 2^32 commits on one thread, which a long-running process reaches) needs a full stamp clear.
+// Delta and stamp share one array: failed growth leaves the old array intact (the strong
+// guarantee). One scratch per projection (Projection 0: carried loads, 1: holds).
+template <int Projection>
+class DeltaScratch {
+public:
+  explicit DeltaScratch(std::size_t num_edges) : storage_(storage()) {
+    storage_.touched.clear();
+    if (storage_.slot.size() < num_edges) storage_.slot.resize(num_edges);  // strong guarantee; new stamps 0
+    if (++storage_.generation == 0) {
+      for (auto& x : storage_.slot) x.stamp = 0;
+      storage_.generation = 1;
+    }
+  }
+  DeltaScratch(const DeltaScratch&) = delete;
+  DeltaScratch& operator=(const DeltaScratch&) = delete;
+  ~DeltaScratch() { storage_.touched.clear(); }
+  void add(EdgeId e, Amount x) {
+    auto& slot = storage_.slot[static_cast<std::size_t>(e)];
+    if (slot.stamp != storage_.generation) {
+      storage_.touched.push_back(e);  // may throw: the slot is left untouched in this commit
+      slot.stamp = storage_.generation;
+      slot.delta = 0;
+    }
+    slot.delta += x;
+  }
+  // Each touched edge once, in first-touch order.
+  [[nodiscard]] const std::vector<EdgeId>& touched() const noexcept { return storage_.touched; }
+  [[nodiscard]] Amount at(EdgeId e) const noexcept { return storage_.slot[static_cast<std::size_t>(e)].delta; }
+
+private:
+  struct Slot {
+    Amount delta {0};
+    std::uint32_t stamp {0};
+  };
+  struct Storage {
+    std::vector<Slot> slot;
+    std::vector<EdgeId> touched;
+    std::uint32_t generation {0};
+  };
+  static Storage& storage() {
+    thread_local Storage st;
+    return st;
+  }
+  Storage& storage_;
+};
+
+FlowRecord record_of(std::uint64_t uid, std::int64_t id, std::int64_t owner, RecordDraft& d) {
+  FlowRecord rec = std::move(d.record);
+  rec.flow_id = FlowId {uid, id};
+  rec.policy_id = owner;
+  std::erase_if(rec.edge_flows, [](const auto& p) { return p.second == 0; });
+  std::erase_if(rec.edge_drops, [](const auto& p) { return p.second.is_zero(); });
+  std::erase_if(rec.edge_reservations, [](const auto& p) { return p.second == 0; });
+  return rec;
+}
+
+// The publication step moves staged records into place; it must not throw.
+static_assert(std::is_nothrow_move_assignable_v<FlowRecord>);
+static_assert(std::is_nothrow_swappable_v<std::vector<std::int64_t>>);
+
+} // namespace
+
+std::int64_t LedgerAccess::bind(FlowLedger& ledger) {
+  ledger.check_usable();
+  if (ledger.next_policy_id_ == std::numeric_limits<std::int64_t>::max()) throw std::runtime_error("policy identity limit exceeded");
+  const std::int64_t owner = ledger.next_policy_id_;
+  ledger.policy_bindings_.emplace(owner, true);  // the only allocation: nothing changes if it throws
+  ++ledger.next_policy_id_;
+  ++ledger.num_bound_policies_;
+  return owner;
+}
+
+void LedgerAccess::release(FlowLedger& ledger, std::int64_t owner) noexcept {
+  const auto guard = lock(ledger);
+  const auto it = ledger.policy_bindings_.find(owner);
+  if (it == ledger.policy_bindings_.end() || !it->second) return;
+  --ledger.num_bound_policies_;
+  // An owner with live records stays as their orphaned owner; one without leaves nothing to keep
+  // (its id is never issued again either way). Neither step allocates.
+  const auto records = ledger.policy_record_counters_.find(owner);
+  if (records != ledger.policy_record_counters_.end() && !records->second.empty()) {
+    it->second = false;
+  } else {
+    ledger.policy_bindings_.erase(it);
+  }
+}
+
+std::vector<std::int64_t> LedgerAccess::detach(FlowLedger& ledger, std::int64_t owner) {
+  ledger.check_usable();
+  if (!is_bound(ledger.policy_bindings_, owner)) throw std::logic_error("ledger: detach by an unbound owner");
+  std::vector<std::int64_t> ids;
+  const auto it = ledger.policy_record_counters_.find(owner);
+  if (it == ledger.policy_record_counters_.end()) return ids;
+  // Nothing below allocates: the index vector moves out, its node and the records are erased.
+  ids = std::move(it->second);
+  ledger.policy_record_counters_.erase(it);
+  for (std::int64_t id : ids) {
+    const auto rec = ledger.records_.find(id);
+    for (const auto& [e, x] : rec->second.edge_flows) ledger.carried_[static_cast<std::size_t>(e)] -= x;
+    for (const auto& [e, x] : rec->second.edge_reservations) ledger.reserved_[static_cast<std::size_t>(e)] -= x;
+    ledger.records_.erase(rec);
+  }
+  return ids;
+}
+
+std::vector<FlowId> LedgerAccess::commit(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts) {
+  return commit_drafts(ledger, owner, drafts, false);
+}
+
+std::vector<FlowId> LedgerAccess::exchange(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts) {
+  return commit_drafts(ledger, owner, drafts, true);
+}
+
+std::vector<FlowId> LedgerAccess::commit_drafts(FlowLedger& ledger, std::int64_t owner, std::span<RecordDraft> drafts,
+                                                bool retire) {
+  ledger.check_usable();
+  if (!is_bound(ledger.policy_bindings_, owner)) throw std::logic_error("ledger: commit by an unbound owner");
+  // Every new record's id, checked as one batch before anything changes: ids stay below the
+  // largest int64.
+  const auto num_new = static_cast<std::size_t>(
+      std::count_if(drafts.begin(), drafts.end(), [](const RecordDraft& d) { return !d.record_counter.has_value(); }));
+  if (num_new > static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max() - ledger.next_record_counter_)) {
+    throw std::runtime_error("record identity limit exceeded");
+  }
+  const auto owned = ledger.policy_record_counters_.find(owner);
+  if (owned == ledger.policy_record_counters_.end() && drafts.size() == 1 && !drafts[0].record_counter.has_value() &&
+      drafts[0].record.edge_reservations.empty() &&
+      std::adjacent_find(drafts[0].record.edge_flows.begin(), drafts[0].record.edge_flows.end(),
+                         [](const auto& a, const auto& b) { return a.first >= b.first; }) ==
+          drafts[0].record.edge_flows.end()) {
+    // One new record without holds for an owner without live records (a fresh placement), its
+    // edges strictly ascending: each touched edge's delta is the draft's own amount, touched in the draft's order,
+    // so the checks below run on the draft itself, in the general path's order and with its
+    // messages (negative amounts first, then feasibility edge by edge); the staging and the
+    // publication are the general path's for one new record.
+    RecordDraft& d = drafts[0];
+    for (const auto& [e, x] : d.record.edge_flows) {
+      if (x < 0) throw std::logic_error("ledger: a negative allocation in a commit");
+    }
+    for (const auto& [e, x] : d.record.edge_flows) {
+      const auto ei = static_cast<std::size_t>(e);
+      const Amount next = ledger.carried_[ei] + x;
+      if (next < 0 || next > ledger.service_baseline_[ei]) {
+        throw std::logic_error("ledger: infeasible commit on edge " + std::to_string(e) + " (" +
+                               std::to_string(next) + " of " + std::to_string(ledger.service_baseline_[ei]) + ")");
+      }
+    }
+    std::vector<FlowId> created;
+    created.reserve(1);
+    std::vector<std::int64_t> live;
+    live.reserve(1);
+    const std::int64_t id = ledger.next_record_counter_;
+    std::map<std::int64_t, FlowRecord> fresh;
+    const auto node = fresh.emplace_hint(fresh.end(), id, record_of(ledger.uid_, id, owner, d));
+    created.emplace_back(ledger.uid_, id);
+    live.push_back(id);
+    std::map<std::int64_t, std::vector<std::int64_t>> index_node;
+    index_node.emplace(owner, std::move(live));
+    // Publication: nothing below allocates or throws (the record's dropped zero entries add
+    // nothing).
+    for (const auto& [e, x] : node->second.edge_flows) ledger.carried_[static_cast<std::size_t>(e)] += x;
+    ledger.records_.merge(fresh);
+    ledger.policy_record_counters_.merge(index_node);
+    ledger.next_record_counter_ = id + 1;
+    return created;
+  }
+  std::vector<FlowId> created;
+  OwnerDrafts one {owner, drafts, retire};
+  commit_batch(ledger, std::span<OwnerDrafts>(&one, 1), std::span<std::vector<FlowId>>(&created, 1));
+  return created;
+}
+
+void LedgerAccess::commit_batch(FlowLedger& ledger, std::span<OwnerDrafts> owners, std::span<std::vector<FlowId>> created) {
+  ledger.check_usable();
+  if (created.size() != owners.size()) throw std::logic_error("ledger: a batch needs one id list per owner");
+  for (const auto& o : owners) {
+    if (!is_bound(ledger.policy_bindings_, o.owner)) throw std::logic_error("ledger: commit by an unbound owner");
+  }
+  if (owners.size() > 1) {
+    std::vector<std::int64_t> ids;
+    ids.reserve(owners.size());
+    for (const auto& o : owners) ids.push_back(o.owner);
+    std::sort(ids.begin(), ids.end());
+    if (std::adjacent_find(ids.begin(), ids.end()) != ids.end()) throw std::logic_error("ledger: an owner twice in a batch");
+  }
+  // Every new record's id, counted over the whole batch before anything changes: ids stay below
+  // the largest int64.
+  std::uint64_t num_new = 0;
+  for (const auto& o : owners) {
+    num_new += static_cast<std::uint64_t>(std::count_if(o.drafts.begin(), o.drafts.end(),
+                                                        [](const RecordDraft& d) { return !d.record_counter.has_value(); }));
+  }
+  if (num_new > static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max() - ledger.next_record_counter_)) {
+    throw std::runtime_error("record identity limit exceeded");
+  }
+  // Per owner: its index entry and the live records its drafts keep. The drafts carry exactly the
+  // owner's live records plus new ones (retire: only new ones, every live record is retired).
+  struct OwnerState {
+    std::map<std::int64_t, std::vector<std::int64_t>>::iterator owned;
+    std::size_t num_current {0};
+    std::size_t num_new {0};
+    std::vector<std::int64_t> kept;
+  };
+  std::vector<OwnerState> state(owners.size());
+  for (std::size_t i = 0; i < owners.size(); ++i) {
+    const auto& o = owners[i];
+    auto& st = state[i];
+    st.owned = ledger.policy_record_counters_.find(o.owner);
+    const bool indexed = st.owned != ledger.policy_record_counters_.end();
+    st.num_current = indexed ? st.owned->second.size() : 0;
+    for (const auto& d : o.drafts) {
+      if (d.record_counter.has_value()) {
+        st.kept.push_back(*d.record_counter);
+      } else {
+        ++st.num_new;
+      }
+    }
+    std::sort(st.kept.begin(), st.kept.end());
+    if (o.retire ? !st.kept.empty()
+                 : (st.kept.size() != st.num_current || (st.num_current != 0 && st.kept != st.owned->second))) {
+      throw std::logic_error(o.retire ? "ledger: an exchange carries only new records"
+                                      : "ledger: a commit must carry every live record of its policy");
+    }
+  }
+
+  // 1. The new aggregates on every touched edge (every owner's old allocation and holds out, its
+  // new drafts in), checked before anything changes: carried loads against the service baseline,
+  // then holds against the reservation baseline (each below 2^62, so a sum of two stays below
+  // 2^63: every owner's records fit the baseline before and after). Holds are gathered only when
+  // some record has one.
+  DeltaScratch<0> delta(ledger.carried_.size());
+  bool holds = false;
+  bool negative = false;
+  for (std::size_t i = 0; i < owners.size(); ++i) {
+    if (state[i].num_current != 0) {
+      for (std::int64_t id : state[i].owned->second) {
+        const FlowRecord& r = ledger.records_.at(id);
+        for (const auto& [e, x] : r.edge_flows) delta.add(e, -x);
+        holds = holds || !r.edge_reservations.empty();
+      }
+    }
+    for (const auto& d : owners[i].drafts) {
+      for (const auto& [e, x] : d.record.edge_flows) {
+        negative = negative || x < 0;
+        delta.add(e, x);
+      }
+      holds = holds || !d.record.edge_reservations.empty();
+    }
+  }
+  if (negative) throw std::logic_error("ledger: a negative allocation in a commit");
+  for (EdgeId e : delta.touched()) {
+    const auto ei = static_cast<std::size_t>(e);
+    const Amount next = ledger.carried_[ei] + delta.at(e);
+    if (next < 0 || next > ledger.service_baseline_[ei]) {
+      throw std::logic_error("ledger: infeasible commit on edge " + std::to_string(e) + " (" + std::to_string(next) +
+                             " of " + std::to_string(ledger.service_baseline_[ei]) + ")");
+    }
+  }
+  std::optional<DeltaScratch<1>> held;
+  if (holds) {
+    held.emplace(ledger.carried_.size());
+    bool negative_hold = false;
+    for (std::size_t i = 0; i < owners.size(); ++i) {
+      if (state[i].num_current != 0) {
+        for (std::int64_t id : state[i].owned->second) {
+          for (const auto& [e, x] : ledger.records_.at(id).edge_reservations) held->add(e, -x);
+        }
+      }
+      for (const auto& d : owners[i].drafts) {
+        for (const auto& [e, x] : d.record.edge_reservations) {
+          negative_hold = negative_hold || x < 0;
+          held->add(e, x);
+        }
+      }
+    }
+    if (negative_hold) throw std::logic_error("ledger: a negative hold in a commit");
+    for (EdgeId e : held->touched()) {
+      const auto ei = static_cast<std::size_t>(e);
+      const Amount next = ledger.reserved_at(ei) + held->at(e);
+      if (next < 0 || next > ledger.reservation_at(ei)) {
+        throw std::logic_error("ledger: infeasible reservation on edge " + std::to_string(e) + " (" +
+                               std::to_string(next) + " of " + std::to_string(ledger.reservation_at(ei)) + ")");
+      }
+    }
+  }
+
+  // 2. Every allocation of the publication, staged: the holds' storage on the first hold (all
+  // zero, as the empty storage reads), the records (new ones as map nodes), the owners' index
+  // nodes, the returned ids and the next id. A throw here changes nothing.
+  if (held.has_value() && ledger.reserved_.empty()) ledger.reserved_.assign(ledger.carried_.size(), 0);
+  std::vector<std::vector<std::int64_t>> live(owners.size());  // an owner's new index, when it gains ids
+  std::size_t num_retired = 0;
+  std::size_t num_kept = 0;
+  for (std::size_t i = 0; i < owners.size(); ++i) {
+    auto& st = state[i];
+    created[i].clear();
+    created[i].reserve(st.num_new);
+    if (st.num_new != 0) {
+      live[i].reserve(st.kept.size() + st.num_new);
+      live[i].assign(st.kept.begin(), st.kept.end());  // ascending; new ids are larger than every kept id
+    }
+    if (owners[i].retire) num_retired += st.num_current;
+    num_kept += st.kept.size();
+  }
+  // An exchange retires the owner's live records: their map nodes leave the map before the new
+  // ones are spliced in (an erase neither allocates nor throws).
+  std::vector<std::map<std::int64_t, FlowRecord>::iterator> retired;
+  retired.reserve(num_retired);
+  std::vector<std::map<std::int64_t, FlowRecord>::iterator> targets;
+  std::vector<FlowRecord> updated;
+  targets.reserve(num_kept);
+  updated.reserve(num_kept);
+  std::map<std::int64_t, FlowRecord> fresh;
+  std::map<std::int64_t, std::vector<std::int64_t>> index_nodes;
+  std::int64_t next_id = ledger.next_record_counter_;
+  for (std::size_t i = 0; i < owners.size(); ++i) {
+    const auto& o = owners[i];
+    auto& st = state[i];
+    if (o.retire && st.num_current != 0) {
+      for (std::int64_t id : st.owned->second) retired.push_back(ledger.records_.find(id));
+    }
+    for (auto& d : o.drafts) {
+      if (d.record_counter.has_value()) {
+        targets.push_back(ledger.records_.find(*d.record_counter));
+        updated.push_back(record_of(ledger.uid_, *d.record_counter, o.owner, d));
+      } else {
+        const std::int64_t id = next_id++;
+        fresh.emplace_hint(fresh.end(), id, record_of(ledger.uid_, id, o.owner, d));
+        created[i].emplace_back(ledger.uid_, id);
+        live[i].push_back(id);
+      }
+    }
+    if (st.owned == ledger.policy_record_counters_.end() && !live[i].empty()) {
+      index_nodes.emplace_hint(index_nodes.end(), o.owner, std::move(live[i]));
+    }
+  }
+
+  // 3. Publication: nothing below allocates or throws (map nodes are spliced, not copied).
+  for (EdgeId e : delta.touched()) ledger.carried_[static_cast<std::size_t>(e)] += delta.at(e);
+  if (held.has_value()) {
+    for (EdgeId e : held->touched()) ledger.reserved_[static_cast<std::size_t>(e)] += held->at(e);
+  }
+  for (std::size_t i = 0; i < targets.size(); ++i) targets[i]->second = std::move(updated[i]);
+  for (const auto& it : retired) ledger.records_.erase(it);
+  ledger.records_.merge(fresh);
+  for (std::size_t i = 0; i < owners.size(); ++i) {
+    auto& st = state[i];
+    if (st.owned == ledger.policy_record_counters_.end()) continue;
+    if (st.num_new != 0) {
+      st.owned->second.swap(live[i]);
+    } else if (owners[i].retire) {
+      ledger.policy_record_counters_.erase(st.owned);
+    }
+  }
+  ledger.policy_record_counters_.merge(index_nodes);
+  ledger.next_record_counter_ = next_id;
+}
+
+const FlowRecord& LedgerAccess::live(const FlowLedger& ledger, std::int64_t id) {
+  const auto it = ledger.records_.find(id);
+  if (it == ledger.records_.end()) throw std::invalid_argument("ledger: retired or unknown flow id " + std::to_string(id));
+  return it->second;
+}
+
+void LedgerAccess::residual_into(const FlowLedger& ledger, std::vector<Amount>& out) {
+  ledger.check_usable();
+  out.resize(ledger.service_baseline_.size());
+  for (std::size_t e = 0; e < out.size(); ++e) out[e] = ledger.service_baseline_[e] - ledger.carried_[e];
+}
+
+std::span<const Amount> LedgerAccess::baseline(const FlowLedger& ledger) {
+  ledger.check_usable();
+  return ledger.service_baseline_;
+}
+
+std::span<const Amount> LedgerAccess::carried(const FlowLedger& ledger) {
+  ledger.check_usable();
+  return ledger.carried_;
+}
+
+std::span<const Amount> LedgerAccess::reservation_baseline(const FlowLedger& fg) {
+  fg.check_usable();
+  if (fg.reservation_baseline_.empty()) return fg.graph_->edge_capacity_units();
+  return fg.reservation_baseline_;
+}
+
+std::span<const Amount> LedgerAccess::reserved(const FlowLedger& fg) {
+  fg.check_usable();
+  return fg.reserved_;
+}
+
+std::vector<Amount>& LedgerAccess::reserved_storage(FlowLedger& fg) {
+  fg.check_usable();
+  if (fg.reserved_.empty()) fg.reserved_.assign(fg.carried_.size(), 0);
+  return fg.reserved_;
+}
+
+void LedgerAccess::set_next_ids(FlowLedger& ledger, std::int64_t next_record_counter, std::int64_t next_policy_id) {
+  ledger.next_record_counter_ = next_record_counter;
+  ledger.next_policy_id_ = next_policy_id;
+}
+
+std::int64_t LedgerAccess::next_record_counter(const FlowLedger& ledger) {
+  ledger.check_usable();
+  return ledger.next_record_counter_;
+}
+
+std::vector<std::int64_t> LedgerAccess::bound_policy_ids(const FlowLedger& ledger) {
+  ledger.check_usable();
+  std::vector<std::int64_t> out;
+  for (const auto& [owner, bound] : ledger.policy_bindings_) {
+    if (bound) out.push_back(owner);
+  }
+  return out;
+}
+
+std::vector<std::int64_t> LedgerAccess::orphan_policy_ids(const FlowLedger& ledger) {
+  ledger.check_usable();
+  std::vector<std::int64_t> out;
+  for (const auto& [owner, bound] : ledger.policy_bindings_) {
+    if (!bound) out.push_back(owner);
+  }
+  return out;
+}
+
+} // namespace detail
+
+} // namespace netgraph::core
diff --git a/src/flow_policy.cpp b/src/flow_policy.cpp
index 001da5d..1384d0e 100644
--- a/src/flow_policy.cpp
+++ b/src/flow_policy.cpp
@@ -1,840 +1,2709 @@
 /*
-  FlowPolicy — manages path selection and flow placement for a single demand.
-
-  Responsibilities:
-    - Select shortest-path predecessors (SPF) per policy via `shortest_paths`.
-    - Create and track flows with their current DAG and path cost.
-    - Place volumes using `FlowPlacement` (Proportional or EqualBalanced).
-    - Optionally re-optimize flows and enforce path-cost constraints.
-
-  Notes:
-    - "Residual-aware" SPF considers current remaining capacity (or a per-flow
-      threshold) when exploring edges.
-    - Edge selection (multipath vs single-path) is handled natively by the SPF algorithm.
+  The policy engine FlowPolicy: one transaction for every routing mode and operation, published
+  through the ledger as one atomic exchange per call.
+
+  A call computes from the epoch it continues (place) or a fresh one (evaluate, replace and
+  forward, on the residual with the policy's own load released) into a staged value: the result,
+  the drafts of the commit and the epoch after it. place, replace and forward publish it (the
+  ledger commit, then the epoch); evaluate discards it. The change flags compare the program the
+  policy had installed with the call's.
+
+  * ShortestPaths Equal and Weighted (place_pooled): the epoch's first positive call (or a
+    replace) prepares every roster source's route on the working residual at its entry and joins
+    them into the program's one pooled split context, a plan rooted at the whole roster (a router
+    reached by several sources splits their added traffic once). Weighted weights come from the
+    configured basis (capacity, explicit edge weights, or the free capacity read then and frozen).
+    Lossless admits the largest total of the equal source allocation whose no-drop forwarding fits V = W +
+    own; Lossy forwards the round-robin increments of the offer on W. The amounts are attributed
+    back to the sources (kernels' forward()).
+  * The controllers (place_optimized_flow): unrestricted CentralizedTE over every eligible edge, CentralizedTE with a
+    support over that support trimmed, ShortestPaths Optimized over the union of the roster's routes
+    (prepared as above). A minimum-cost flow of the cumulative value on V = W + own, from one
+    virtual source (the optimized source allocation) or with source i's arc capped at its RR or H share of
+    the largest total whose shares all fit (equal or weighted source allocation, integer bisection), cut into paths
+    per source (decompose()): the program, each path a tunnel weighted by its amount; each source's
+    record is the sum of its paths.
+  * Pinned (place_pinned): forwarding its program as the policy's view replays it under its mask
+    with its black holes, through the forwarding engine (forwarding.hpp), one record per program
+    entry (forward_entries); forward() (forward_installed) forwards a computing model's installed
+    program the same way, with records per roster source.
+  * T1 (apply_distributed_te_call): replace and evaluate set up the tunnels (distributed_te.cpp) on the unreserved view
+    with the policy's own holds released, build the tunnel program and forward it like a Pinned
+    program, one record per entry, each up tunnel's record holding its request on its path.
+  * T2 (place_t2): replace and evaluate lay out the tunnels (centralized_te_tunnels.cpp) on the residual with
+    the policy's own traffic released, build the tunnel program (dead heads keep their roster
+    place), take its lossless bound as the plan's forwarding bound and forward it the same way; a
+    plan books nothing.
+  * The tunnel models' forward() (forward_tunnels) forwards the installed program the same way,
+    keeping its plan and T1's holds.
+
+  apply_actions (several policies of one ledger): the list is validated whole, then computed (ORDERED:
+  each action's call on a working copy of the ledger's totals; SIMULTANEOUS: every participant
+  prepared on one view, forwarded by one joint evaluation, finished as its call), then published
+  as one exchange of every owner's records followed by their epochs.
+
+  Work on copies and publish all changes together; an exception leaves ledger and policy intact.
+  Store only changes to ledger residual in per-thread slots. Unrestricted CentralizedTE reads a dense
+  residual and solves over every edge (its view and flows per EdgeId); the other controllers
+  gather their view over their support and keep their flows aligned with it. T1's setup reads a
+  dense unreserved view; ShortestPaths preparation reads the working residual edge by edge.
+
+  The transaction trace (the call's intermediate values, keyed as the tests' model of the policy
+  keys them) exists in a build with the private hooks only: every
+  trace block is guarded by kTraced and is compile-time dead without them.
 */
 #include "netgraph/core/flow_policy.hpp"
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/options.hpp"
-#include "netgraph/core/profiling.hpp"
 
 #include <algorithm>
-#include <cstring>
-#include <deque>
+#include <functional>
 #include <limits>
-#include <optional>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+#include "netgraph/core/detail/cache_access.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/sparse.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/detail/trace.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/detail/tunnel_setup.hpp"
 
 namespace netgraph::core {
 
+namespace detail {
+
 namespace {
-// The equal-balanced placements share FlowPolicy's per-flow target and DAG
-// refresh logic (and, except for the lossy mode, the equalizing rebalance in
-// place_demand); they differ only inside FlowState::place_on_dag.
-constexpr bool is_equal_balanced(FlowPlacement p) noexcept {
-  return p == FlowPlacement::EqualBalanced || p == FlowPlacement::EqualBalancedLossy;
+
+// ================================================================ working residual
+
+// The ledger's totals a call reads: the ledger's own (a scalar call), or a list's working copy
+// (apply_actions: ORDERED's totals after the earlier actions, SIMULTANEOUS's with every
+// participant's load released), which outlives every reader. `reservation_baseline` is the
+// ledger's (the capacities when it has none); an empty `held` reads as all zero, as the ledger's
+// unstaged holds do.
+struct LedgerTotals {
+  std::span<const Amount> service_baseline;
+  std::span<const Amount> carried;
+  std::span<const Amount> reservation_baseline;
+  std::span<const Amount> held;
+};
+
+LedgerTotals totals_of(const FlowLedger& ledger) {
+  return {LedgerAccess::baseline(ledger), LedgerAccess::carried(ledger), LedgerAccess::reservation_baseline(ledger),
+          LedgerAccess::reserved(ledger)};
+}
+
+// W = service baseline - carried() + delta; delta holds this call's releases and new allocations.
+// Each call advances a scratch epoch (a numeric stamp, separate from the policy epoch).
+// Read a slot only when its stamp matches; later calls ignore stale slots even after a throw.
+// Clear all stamps only on wraparound (after 2^32 calls on one thread, which a long-running
+// process reaches). Slots share one per-thread array, so failed growth leaves the old array
+// intact.
+class ServiceCapacityWorkspace {
+public:
+  explicit ServiceCapacityWorkspace(const LedgerTotals& totals)
+      : storage_(storage()), service_baseline_(totals.service_baseline), carried_(totals.carried) {
+    if (storage_.slot.size() < service_baseline_.size()) storage_.slot.resize(service_baseline_.size());
+    if (++storage_.generation == 0) {
+      for (auto& x : storage_.slot) x.stamp = 0;
+      storage_.generation = 1;
+    }
+  }
+  ServiceCapacityWorkspace(const ServiceCapacityWorkspace&) = delete;
+  ServiceCapacityWorkspace& operator=(const ServiceCapacityWorkspace&) = delete;
+
+  [[nodiscard]] Amount at(EdgeId e) const noexcept {
+    const auto ei = static_cast<std::size_t>(e);
+    const auto& x = storage_.slot[ei];
+    return service_baseline_[ei] - carried_[ei] + (x.stamp == storage_.generation ? x.delta : 0);
+  }
+  void add(EdgeId e, Amount v) noexcept {
+    auto& x = storage_.slot[static_cast<std::size_t>(e)];
+    if (x.stamp != storage_.generation) {
+      x.stamp = storage_.generation;
+      x.delta = 0;
+    }
+    x.delta += v;
+  }
+  // Unused capacity for each edge of `members`, in the same order (member-aligned).
+  void gather(std::span<const EdgeId> members, std::vector<Amount>& out) const {
+    out.resize(members.size());
+    for (std::size_t m = 0; m < members.size(); ++m) out[m] = at(members[m]);
+  }
+  // The dense working residual (searches, CentralizedTE, traces).
+  void dense(std::vector<Amount>& out) const {
+    out.resize(service_baseline_.size());
+    for (std::size_t e = 0; e < out.size(); ++e) {
+      const auto& x = storage_.slot[e];
+      out[e] = service_baseline_[e] - carried_[e] + (x.stamp == storage_.generation ? x.delta : 0);
+    }
+  }
+  // The policy's own carried load released (the view of a full-offer call): its live records'
+  // edges added back.
+  void release_records(std::span<const FlowRecord* const> records) noexcept {
+    for (const FlowRecord* r : records) {
+      for (const auto& [e, x] : r->edge_flows) add(e, x);
+    }
+  }
+
+private:
+  struct Slot {
+    Amount delta {0};
+    std::uint32_t stamp {0};
+  };
+  struct Storage {
+    std::vector<Slot> slot;
+    std::uint32_t generation {0};
+  };
+  static Storage& storage() {
+    thread_local Storage st;
+    return st;
+  }
+  Storage& storage_;
+  std::span<const Amount> service_baseline_;
+  std::span<const Amount> carried_;
+};
+
+// ================================================================ small helpers
+
+[[noreturn]] void invalid(const std::string& what) { throw std::invalid_argument(what); }
+
+// The tunnel count per head and the tunnels of one program (H x N, int32 entry indices).
+constexpr std::int64_t kMaxTunnelCount = 10000;
+constexpr std::int64_t kMaxTunnels = (std::int64_t {1} << 30) - 1;
+
+// The policy's routing mode (the tag of the Routing variant).
+template <class R>
+bool is(const PolicyEngine& pe) noexcept {
+  return std::holds_alternative<R>(pe.config.routing);
+}
+
+std::string str(std::int64_t v) { return std::to_string(v); }
+
+// The member-aligned amounts of a record's (EdgeId, amount) pairs (both ascending).
+template <class T>
+void align(std::span<const EdgeId> members, const std::vector<std::pair<EdgeId, T>>& pairs, std::vector<T>& out) {
+  out.assign(members.size(), T {});
+  std::size_t m = 0;
+  for (const auto& [e, x] : pairs) {
+    while (m < members.size() && members[m] < e) ++m;
+    if (m == members.size() || members[m] != e) {
+      throw std::logic_error("policy: a record's allocation lies outside its flow's split graph");
+    }
+    out[m] = x;
+  }
+}
+
+// A ShortestPaths preparation's inputs: the policy, its graph and the call's working residual.
+struct PolicyCallContext {
+  const PolicyEngine& engine;
+  const Graph& graph;
+  ServiceCapacityWorkspace& service_capacity;
+};
+
+// ================================================================ routes and plans
+
+struct RouteSupport {
+  std::vector<EdgeId> edges {};  // ascending
+  Cost cost {kUnreachable};
+};
+
+// The edge scores of the creation view W, as the route choice reads them (ShortestPaths). The
+// PriorityReader of `as_priority_reader` points at this view: it must outlive every call through it.
+struct WorkingPriority {
+  const ServiceCapacityWorkspace* service_capacity;
+  std::span<const Amount> capacity;
+  RouteTieBreak tie_break;
+  [[nodiscard]] PriorityReader as_priority_reader() const noexcept {
+    return {this, [](const void* ctx, EdgeId e) noexcept {
+              const auto& v = *static_cast<const WorkingPriority*>(ctx);
+              return priority_value(v.tie_break, v.service_capacity->at(e), v.capacity[static_cast<std::size_t>(e)]);
+            }};
+  }
+};
+
+// The record route of a route: `share` itself when it is the whole route, else a new DAG.
+std::shared_ptr<const PredecessorDAG> record_route_of(const Graph& graph, std::span<const EdgeId> route,
+                                         const std::shared_ptr<const PredecessorDAG>& share) {
+  if (share && PredecessorDAGBuilder::ascending(*share).size() == route.size()) return share;
+  return std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(graph, route));
+}
+
+// ShortestPaths: keep static shortest-path support reachable from source, then apply the route choice on W.
+// For parallel_edges = false (Collapse), choose one edge per (u, v) by (cost, higher tie value under
+// a HIGHER_* tie_break, lowest EdgeId). For multipath = false, choose the canonical single
+// path in stages. Both use W's tie values without excluding edges for low residual.
+RouteSupport shortest_path_support(const PolicyCallContext& c, NodeId source) {
+  const auto& g = c.graph;
+  const auto& pe = c.engine;
+  const auto& choice = pe.route_choice;
+  const WorkingPriority view {&c.service_capacity, g.edge_capacity_units(), choice.tie_break};
+  auto r = support_route(g, PredecessorDAGBuilder::ascending(*pe.support), source, pe.allowed_destinations, choice, view.as_priority_reader());
+  RouteSupport out;
+  out.edges = std::move(r.edges);
+  if (choice.single_path() && !out.edges.empty()) out.cost = r.cost;
+  return out;
+}
+
+// ShortestPaths Weighted's static weight source (Capacity or Explicit; ResidualSnapshot reads the view
+// at preparation and is made there).
+WeightSource shortest_path_weight_source(const PolicyEngine& pe) noexcept {
+  const auto& sp = std::get<ShortestPaths>(pe.config.routing);
+  if (sp.weight_basis == WeightBasis::Explicit) return {WeightBasis::Explicit, *sp.edge_weights};
+  return {sp.weight_basis.value_or(WeightBasis::Capacity), {}};
+}
+
+// ShortestPaths's creation products in one pass (prepare_shortest_paths, identical to
+// shortest_path_support, record_route_of and the plan where it applies); nullopt elsewhere.
+std::optional<PreparedRouteResult> creation_products(const PolicyCallContext& c, NodeId source) {
+  const auto& pe = c.engine;
+  const auto& choice = pe.route_choice;
+  const WorkingPriority view {&c.service_capacity, c.graph.edge_capacity_units(), choice.tie_break};
+  return prepare_shortest_paths(c.graph, pe.support, source, pe.allowed_destinations, choice, view.as_priority_reader(), std::get<ShortestPaths>(pe.config.routing).allocation,
+                            pe.config.admission, shortest_path_weight_source(pe));
+}
+
+// ---------------------------------------------------------------- outputs
+
+// The optional outputs of a call whose policy records become `after`, computed before the commit
+// (so nothing allocates once the ledger changed): edge_flows = the policy's own allocation after
+// the call, residual = the ledger's after it (the totals' service baseline - carried + own before -
+// own after), saturated_boundary_edges on that residual, edge_reservations = the policy's own holds
+// after the call.
+// `totals`: the totals the call read (nullptr: the ledger's, read only for these two outputs).
+void prepare_outputs(const PolicyEngine& pe, const LedgerTotals* totals, const OutputOptions& outputs,
+                     std::span<const FlowRecord* const> after, PlacementResult& out) {
+  const auto m = static_cast<std::size_t>(pe.graph->num_edges());
+  if (outputs.edge_reservations) {
+    std::vector<Amount> held(m, 0);
+    for (const FlowRecord* r : after) {
+      for (const auto& [e, x] : r->edge_reservations) held[static_cast<std::size_t>(e)] += x;
+    }
+    out.edge_reservations = std::move(held);
+  }
+  if (!outputs.edge_flows && !outputs.residual && !outputs.saturated_boundary_edges) return;
+  std::vector<Amount> own(m, 0);
+  for (const FlowRecord* r : after) {
+    for (const auto& [e, x] : r->edge_flows) own[static_cast<std::size_t>(e)] += x;
+  }
+  if (outputs.residual || outputs.saturated_boundary_edges) {
+    const LedgerTotals t = totals != nullptr ? *totals : totals_of(pe.ledger);
+    std::vector<Amount> res(m);
+    for (std::size_t e = 0; e < m; ++e) res[e] = t.service_baseline[e] - t.carried[e];
+    for (const auto& record_group : pe.epoch.record_groups) {
+      for (const auto& s : record_group) {
+        for (const auto& [e, x] : LedgerAccess::live(pe.ledger, s.record_counter).edge_flows) res[static_cast<std::size_t>(e)] += x;
+      }
+    }
+    for (std::size_t e = 0; e < m; ++e) res[e] -= own[e];
+    if (outputs.saturated_boundary_edges) out.saturated_boundary_edges = saturated_boundary_edges_of(*pe.graph, res, pe.sources, pe.eligibility);
+    if (outputs.residual) out.residual = std::move(res);
+  }
+  if (outputs.edge_flows) out.edge_flows = std::move(own);
+}
+
+bool any_output(const OutputOptions& outputs) noexcept {
+  return outputs.edge_flows || outputs.residual || outputs.saturated_boundary_edges || outputs.edge_reservations;
 }
+
+// ---------------------------------------------------------------- the demand's state
+
+// The result's 128-bit amounts (Counter128 values stay below 2^127).
+Counter128 c128(Amount x) noexcept { return Counter128 {0, static_cast<std::uint64_t>(x)}; }
+
+// a += b, or std::invalid_argument("<what> limit exceeded") when the sum reaches 2^127.
+void accumulate(Counter128& a, const Counter128& b, const char* what) {
+  const std::uint64_t lo = a.lo + b.lo;
+  const std::uint64_t hi = a.hi + b.hi + (lo < a.lo ? 1U : 0U);
+  if (hi >= (std::uint64_t {1} << 63)) throw std::invalid_argument(std::string(what) + " limit exceeded");
+  a = Counter128 {hi, lo};
+}
+
+// a - b, for a >= b.
+Counter128 minus(const Counter128& a, const Counter128& b) noexcept {
+  return Counter128 {a.hi - b.hi - (a.lo < b.lo ? 1U : 0U), a.lo - b.lo};
+}
+
+// The demand's state after a call: its records after the call (`after`: one per flow, per roster
+// source or per program entry; the record's source names its row), the shares a Pinned head lost
+// itself (`lost`: per source, outside every record) and the epoch's counters after it. Lossy: a
+// row's source loss is what its source was offered and neither delivered nor dropped; the
+// demand's is its offered total minus delivery and drops, which with an empty roster is the
+// whole offer while every row stays zero.
+void fill_state(const PolicyEngine& pe, std::span<const FlowRecord* const> after, const Counter128& requested,
+                bool infinite, const Counter128& offered, PlacementResult& out,
+                std::span<const std::pair<NodeId, Counter128>> lost = {}) {
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  if (!infinite) out.requested = requested;
+  out.by_source.resize(pe.sources.size());
+  for (std::size_t i = 0; i < pe.sources.size(); ++i) {
+    out.by_source[i].source = pe.sources[i];
+    if (lossy) out.by_source[i].offered = Counter128 {};
+  }
+  // The records' drops, gathered for one merge (one record's are already ascending and unique).
+  std::vector<std::pair<EdgeId, Counter128>> drops;
+  std::size_t dropping = 0;
+  if (lossy) {
+    std::size_t n = 0;
+    for (const FlowRecord* r : after) {
+      n += r->edge_drops.size();
+      dropping += r->edge_drops.empty() ? 0 : 1;
+    }
+    drops.reserve(n);
+  }
+  for (const FlowRecord* r : after) {
+    const auto it = std::lower_bound(pe.sources.begin(), pe.sources.end(), r->sources.front());
+    auto& row = out.by_source[static_cast<std::size_t>(it - pe.sources.begin())];
+    row.delivered += r->delivered;
+    out.delivered += r->delivered;
+    if (!lossy) continue;
+    accumulate(*row.offered, r->offered.value_or(Counter128 {}), "offered");
+    for (const auto& [e, x] : r->edge_drops) {
+      accumulate(row.total_edge_drops, x, "drops");
+      drops.emplace_back(e, x);
+    }
+  }
+  for (const auto& [s, x] : lost) {
+    const auto it = std::lower_bound(pe.sources.begin(), pe.sources.end(), s);
+    accumulate(*out.by_source[static_cast<std::size_t>(it - pe.sources.begin())].offered, x, "offered");
+  }
+  if (!lossy) {
+    for (auto& row : out.by_source) row.admitted = c128(row.delivered);
+    out.admitted = c128(out.delivered);
+    if (!infinite) out.unadmitted = minus(requested, out.admitted);
+    return;
+  }
+  for (auto& row : out.by_source) {
+    row.admitted = *row.offered;
+    row.source_drops = minus(minus(*row.offered, c128(row.delivered)), row.total_edge_drops);
+  }
+  if (dropping > 1) std::sort(drops.begin(), drops.end(), [](const auto& a, const auto& b) { return a.first < b.first; });
+  out.edge_drops.reserve(drops.size());
+  Counter128 dropped {};
+  for (const auto& [e, x] : drops) {
+    if (out.edge_drops.empty() || out.edge_drops.back().first != e) out.edge_drops.emplace_back(e, Counter128 {});
+    accumulate(out.edge_drops.back().second, x, "drops");
+    accumulate(dropped, x, "drops");
+  }
+  out.offered = offered;
+  out.admitted = offered;
+  out.unadmitted = Counter128 {};
+  out.source_drops = minus(minus(offered, c128(out.delivered)), dropped);
+}
+
+// The exact sum of cost * flow over the records' edges (a controller's total cost; below 2^124:
+// the costs and the capacities each sum below 2^62).
+Counter128 total_cost_of(const Graph& graph, std::span<const FlowRecord* const> after) {
+  const auto cost = graph.edge_costs();
+  U128 sum {};
+  for (const FlowRecord* r : after) {
+    for (const auto& [e, x] : r->edge_flows) {
+      const U128 p = mul_u64(static_cast<std::uint64_t>(cost[static_cast<std::size_t>(e)]), static_cast<std::uint64_t>(x));
+      const std::uint64_t lo = sum.lo + p.lo;
+      sum = U128 {sum.hi + p.hi + (lo < sum.lo ? 1U : 0U), lo};
+    }
+  }
+  return Counter128 {sum.hi, sum.lo};
+}
+
+// The records of the policy's live flows (a call that commits nothing).
+std::vector<const FlowRecord*> current_records(const PolicyEngine& pe) {
+  std::vector<const FlowRecord*> out;
+  for (const auto& record_group : pe.epoch.record_groups) {
+    for (const auto& s : record_group) out.push_back(&LedgerAccess::live(pe.ledger, s.record_counter));
+  }
+  return out;
+}
+
+// The drafts' records as a list, in per-thread storage reused by every call (valid until this
+// thread's next draft_records; it grows before any commit).
+std::span<const FlowRecord* const> draft_records(const std::vector<RecordDraft>& drafts) {
+  thread_local std::vector<const FlowRecord*> out;
+  out.clear();
+  for (const auto& d : drafts) out.push_back(&d.record);
+  return out;
+}
+
+// T2: CentralizedTE with a tunnel count.
+bool is_t2(const Routing& r) noexcept {
+  const auto* gl = std::get_if<CentralizedTE>(&r);
+  return gl != nullptr && gl->tunnel_count.has_value();
+}
+bool t2(const PolicyEngine& pe) noexcept { return is_t2(pe.config.routing); }
+
+// The tunnel models: T1 and T2 (one record per program entry; a full-offer call is their only
+// computation).
+bool tunnel_model(const PolicyEngine& pe) noexcept { return is<DistributedTE>(pe) || t2(pe); }
+
+// CentralizedTE without tunnels (with or without a support), or ShortestPaths Optimized: a controller.
+bool uses_optimized_flow(const PolicyEngine& pe) noexcept {
+  return (is<CentralizedTE>(pe) && !t2(pe)) || (is<ShortestPaths>(pe) && std::get<ShortestPaths>(pe.config.routing).allocation == RouteAllocation::Optimized);
+}
+
+// Unrestricted CentralizedTE: the controller over every eligible edge (dense arrays, the curve, the cut).
+bool is_unrestricted_centralized_te(const PolicyEngine& pe) noexcept {
+  return uses_optimized_flow(pe) && is<CentralizedTE>(pe) && !std::get<CentralizedTE>(pe.config.routing).support;
+}
+
+// ================================================================ the transaction
+
+Trace route_trace(std::span<const EdgeId> edges) { return Trace::ints(edges); }
+
+std::string key(NodeId v) { return std::to_string(v); }
+// ================================================================ calls
+
+// What a call computes. place(v) continues the epoch `cur` (the policy's); evaluate, replace and
+// forward start from a fresh epoch (forward keeps the installed program) on the released view.
+struct PolicyCall {
+  PolicyOperation operation {PolicyOperation::Place};
+  std::optional<Amount> offer {};          // nullopt: +inf
+  std::optional<std::optional<Amount>> design {};  // evaluate and replace: absent, or a design (nullopt: +inf)
+  const Eligibility* black_holes {nullptr};   // forward's black holes
+  const OutputOptions* outputs {nullptr};
+  Trace* trace {nullptr};
+  const LedgerTotals* totals {nullptr};  // the totals the call reads (nullptr: the ledger's)
+  [[nodiscard]] bool is_full_offer() const noexcept { return operation != PolicyOperation::Place; }
+};
+
+LedgerTotals totals_of(const PolicyEngine& pe, const PolicyCall& rq) { return rq.totals != nullptr ? *rq.totals : totals_of(pe.ledger); }
+
+// A computed call, published or discarded whole: its result, the drafts of its commit (a place:
+// every live record plus the new ones; a full-offer call: only new ones, the live ones retired),
+// the epoch after it, and per new draft (in draft order) its flow in that epoch.
+struct PendingPolicyUpdate {
+  PlacementResult result {};
+  std::vector<RecordDraft> drafts {};
+  PolicyEpoch next_epoch {};
+  std::vector<std::pair<std::size_t, std::size_t>> fresh {};
+};
+
+// The requested total after the call (a full-offer call: its offer alone) and whether it is
+// infinite.
+Counter128 requested_after(const PolicyEpoch& cur, std::optional<Amount> v) noexcept {
+  Counter128 r = cur.requested;
+  if (v.has_value()) (void)r.add(*v);  // checked at the call's entry
+  return r;
+}
+
+// The epoch a full-offer call starts: one empty record_group per roster source (or program entry);
+// forward keeps the installed program and ShortestPaths Optimized's support.
+PolicyEpoch fresh_epoch(const PolicyEngine& pe, bool keep_program) {
+  PolicyEpoch e;
+  e.record_groups.resize(pe.epoch.record_groups.size());
+  if (keep_program) {
+    e.program = pe.epoch.program;
+    e.plan = pe.epoch.plan;
+    e.support = pe.epoch.support;
+  }
+  return e;
+}
+
+// The termination of a forwarding call (Termination's rule after the empty roster): rule (3) when
+// the program has an entry with a path (`has_path`) and no head can use one (`active` false).
+Termination forwarding_termination(bool active, bool has_path, bool lossy, std::optional<Amount> v,
+                                   Amount call_delivered) noexcept {
+  if (has_path && !active) return Termination::NoActiveWeight;
+  if (lossy) return v.has_value() ? Termination::Complete : Termination::Exhausted;
+  return v.has_value() && call_delivered == *v ? Termination::Complete : Termination::Exhausted;
+}
+
+// ---------------------------------------------------------------- the controllers' paths
+
+// decompose() (program_data.hpp): each node's out-edge cursor only advances, remaining flow never
+// increasing.
+// decompose()'s per-thread scratch: per node its cursor and its range's end (the positions of its
+// positive out-edges; cursor -1: none), the destination marks, its roster slot (-1: none), the
+// nodes whose cursor is set, the walk and a source's path pieces. A call resets what it set (also when it throws), so it costs O(the nodes
+// it walks and the flow's positions), not O(N).
+struct DecomposeScratch {
+  std::vector<std::int64_t> cur;
+  std::vector<std::size_t> end;
+  std::vector<std::uint8_t> is_dst;
+  std::vector<std::int32_t> slot;
+  std::vector<NodeId> touched;
+  std::vector<std::size_t> walk;
+  std::vector<std::pair<EdgeId, Amount>> acc;
+};
+
 } // namespace
 
-/* Reject uses that would silently produce a wrong answer:
-   - a FlowGraph wrapping a different graph than the policy routes on (SPF would run
-     on one topology while flow is placed on another);
-   - a (src, dst) pair different from the demand this policy already manages (the
-     round-robin loop routes using src/dst from the existing flow records). */
-void FlowPolicy::check_demand_target(const FlowGraph& fg, NodeId src, NodeId dst,
-                                     const char* what) const {
-  const auto* policy_graph = ctx_.graph.graph.get();
-  if (policy_graph != nullptr && policy_graph != &fg.graph()) {
-    throw std::invalid_argument(
-        std::string("FlowPolicy::") + what +
-        ": the FlowGraph wraps a different StrictMultiDiGraph than this policy; "
-        "paths would be selected on one topology and placed on another");
-  }
-  if (!flows_.empty()) {
-    const auto& existing = flows_.begin()->second;
-    if (existing.src != src || existing.dst != dst) {
-      throw std::invalid_argument(
-          std::string("FlowPolicy::") + what +
-          ": this policy already manages a demand for a different (src, dst) pair; "
-          "use a separate FlowPolicy per demand or call remove_demand() first");
-    }
-  }
-}
-
-double FlowPolicy::placed_demand() const noexcept {
-  double s = 0.0;
-  for (auto const& kv : flows_) s += kv.second.placed_flow;
-  return s;
+Decomposition decompose(const Graph& graph, std::span<const EdgeId> edges, std::vector<Amount> rem,
+                        std::span<const NodeId> reachable_sources, std::span<const NodeId> destinations) {
+  const bool dense = edges.empty() && rem.size() == static_cast<std::size_t>(graph.num_edges());
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  // Position p of the flows: EdgeId p (dense) or edges[p]. Out-edges have consecutive EdgeIds, so
+  // a node's positions are one range.
+  auto edge_at = [&](std::size_t p) { return dense ? static_cast<EdgeId>(p) : edges[p]; };
+  thread_local DecomposeScratch sc;
+  const auto n = static_cast<std::size_t>(graph.num_nodes());
+  // Each grown on its own (a failed growth leaves the others' sizes as they were).
+  if (sc.cur.size() < n) sc.cur.resize(n, -1);
+  if (sc.end.size() < n) sc.end.resize(n, 0);
+  if (sc.is_dst.size() < n) sc.is_dst.resize(n, 0);
+  if (sc.slot.size() < n) sc.slot.resize(n, -1);
+  struct Reset {
+    DecomposeScratch& sc;
+    std::span<const NodeId> dests;
+    std::span<const NodeId> roster;
+    ~Reset() {
+      for (NodeId u : sc.touched) sc.cur[static_cast<std::size_t>(u)] = -1;
+      sc.touched.clear();
+      for (NodeId d : dests) sc.is_dst[static_cast<std::size_t>(d)] = 0;
+      for (NodeId s : roster) sc.slot[static_cast<std::size_t>(s)] = -1;
+    }
+  } reset {sc, destinations, reachable_sources};
+  for (NodeId d : destinations) sc.is_dst[static_cast<std::size_t>(d)] = 1;
+  for (std::size_t i = 0; i < reachable_sources.size(); ++i) sc.slot[static_cast<std::size_t>(reachable_sources[i])] = static_cast<std::int32_t>(i);
+  // A node without positive out-edges has an empty range.
+  auto cursor = [&](NodeId u) -> std::int64_t& {
+    auto& c = sc.cur[static_cast<std::size_t>(u)];
+    if (c < 0) {
+      sc.touched.push_back(u);
+      c = 0;
+      sc.end[static_cast<std::size_t>(u)] = 0;
+    }
+    return c;
+  };
+  Decomposition out;
+  out.shares.resize(reachable_sources.size());
+  out.supplies.resize(reachable_sources.size());
+  // One pass over the flow's positions before any walk: each node's range of positive out-edges
+  // (the zero positions around them are skipped by the walks anyway); each source's supply, its
+  // net outflow (transit through it from another source is not supply; a walk through another
+  // source lowers its in- and outflow alike, as sources are never destinations); the number of
+  // positive positions.
+  std::size_t positive = 0;
+  for (std::size_t p = 0; p < rem.size(); ++p) {
+    if (rem[p] == 0) continue;
+    ++positive;
+    const auto e = static_cast<std::size_t>(edge_at(p));
+    const auto u = static_cast<std::size_t>(edge_sources[e]);
+    if (sc.cur[u] < 0) {
+      sc.touched.push_back(edge_sources[e]);
+      sc.cur[u] = static_cast<std::int64_t>(p);
+    }
+    sc.end[u] = p + 1;
+    const auto from = sc.slot[u];
+    const auto to = sc.slot[static_cast<std::size_t>(edge_destinations[e])];
+    if (from >= 0) out.supplies[static_cast<std::size_t>(from)] += rem[p];
+    if (to >= 0) out.supplies[static_cast<std::size_t>(to)] -= rem[p];
+  }
+  // A one-source flow is all that source's share: the walks cover the flow (checked below), so the
+  // sum of its paths is the flow's positive positions, ascending (the per-path sum's degenerate
+  // form).
+  const bool one = reachable_sources.size() == 1;
+  // Every path zeroes a position or ends a source's supply.
+  out.paths.reserve(positive + reachable_sources.size());
+  if (one) {
+    out.shares[0].reserve(positive);
+    for (std::size_t p = 0; p < rem.size(); ++p) {
+      if (rem[p] != 0) out.shares[0].emplace_back(edge_at(p), rem[p]);
+    }
+  }
+  auto& walk = sc.walk;
+  auto& acc = sc.acc;
+  for (std::size_t i = 0; i < reachable_sources.size(); ++i) {
+    const NodeId s = reachable_sources[i];
+    Amount left = out.supplies[i];
+    acc.clear();
+    while (left > 0) {
+      walk.clear();
+      NodeId u = s;
+      while (walk.empty() || sc.is_dst[static_cast<std::size_t>(u)] == 0) {
+        auto& p = cursor(u);
+        const auto stop = sc.end[static_cast<std::size_t>(u)];
+        while (static_cast<std::size_t>(p) < stop && rem[static_cast<std::size_t>(p)] == 0) ++p;
+        if (static_cast<std::size_t>(p) == stop) {
+          throw std::logic_error("CentralizedTE decomposition: flow conservation broken (no continuation)");
+        }
+        walk.push_back(static_cast<std::size_t>(p));
+        u = edge_destinations[static_cast<std::size_t>(edge_at(static_cast<std::size_t>(p)))];
+        if (walk.size() > n) throw std::logic_error("CentralizedTE decomposition: a cycle with positive flow");
+      }
+      Amount amount = left;
+      for (std::size_t p : walk) amount = std::min(amount, rem[p]);
+      OptimizedFlowPath path;
+      path.roster_index = static_cast<std::int32_t>(i);
+      path.weight = amount;
+      path.edges.reserve(walk.size());
+      for (std::size_t p : walk) {
+        rem[p] -= amount;
+        path.edges.push_back(edge_at(p));
+        if (!one) acc.emplace_back(edge_at(p), amount);
+      }
+      out.paths.push_back(std::move(path));
+      left -= amount;
+    }
+    if (one) continue;
+    std::sort(acc.begin(), acc.end());
+    auto& res = out.shares[i];
+    for (const auto& [e, x] : acc) {
+      if (!res.empty() && res.back().first == e) {
+        res.back().second += x;
+      } else {
+        res.emplace_back(e, x);
+      }
+    }
+  }
+  for (Amount x : rem) {
+    if (x != 0) throw std::logic_error("CentralizedTE decomposition: the walks do not cover the flow");
+  }
+  return out;
 }
 
-/* Compute an SPF predecessor DAG and its destination cost under the current
-   policy configuration. Honors static paths, residual capacity, and edge/node masks. */
-std::optional<std::pair<PredDAG, Cost>> FlowPolicy::get_path_bundle(const FlowGraph& fg,
-                                                                    NodeId src, NodeId dst,
-                                                                    std::optional<double> min_flow) {
-  // With static paths, flows are created directly from the pinned bundles in
-  // place_demand_body and never reoptimized, so no dynamic bundle exists to hand
-  // out. Callers reaching here with static paths configured get nothing.
-  if (has_static_paths()) return std::nullopt;
-  if (path_alg_ != PathAlg::SPF) return std::nullopt;
-
-  // Use configured selection for per-adjacency edge behavior (multi-edge, tie-breaking).
-  EdgeSelection sel = selection_;
-
-  // Enforce semantic consistency between multipath and multi_edge:
-  // - Tunnel mode (multipath=false): force single edge per hop for true single-path semantics
-  // - Hash-ECMP with EqualBalanced: use all equal-cost edges to maximize fanout
-  if (!multipath_) {
-    sel.multi_edge = false;
-  } else if (is_equal_balanced(flow_placement_)) {
-    sel.multi_edge = true;
-  }
-
-  // Respect capacity requirements from both config sources
-  sel.require_capacity = (selection_.require_capacity || require_capacity_);
-  // Decide whether we need residual-aware SPF.
-  // Residual awareness is controlled by require_capacity_:
-  //   - require_capacity=true: Require edges to have capacity, routes adapt to residuals (SDN/TE behavior)
-  //   - require_capacity=false: Routes based on costs only (IP/IGP behavior)
-  // Passing a residual to SPF forces capacity-aware selection, so a cost-only
-  // policy must not pass one even when an equal-balanced per-flow target is
-  // set; the target only shapes how much is requested per flow, not the route.
-  const bool require_residual = require_capacity_;
-  const auto residual = fg.residual_view();
-
-  // Edge mask: combine user-provided mask with minimum residual capacity threshold.
-  // For Proportional mode with min_flow threshold and max_flow_count limit, we filter edges
-  // by minimum capacity to ensure paths can accommodate the required flow. This prevents
-  // selecting low-capacity paths when limited to a single flow (max_flow_count=1).
-  // For EqualBalanced mode, we skip per-edge thresholds since group-based semantics mean
-  // per-edge thresholds can over-prune; capacity gating via residual + kMinCap is sufficient.
-  std::unique_ptr<bool[]> combined_edge_mask;
-  std::span<const bool> final_edge_mask;
-
-  if (require_residual && min_flow.has_value() && !is_equal_balanced(flow_placement_)) {
-    // Need to filter by min_flow threshold for Proportional mode
-    combined_edge_mask.reset(new bool[residual.size()]);
-    double thr = *min_flow;
-
-    if (!edge_mask_.empty()) {
-      // Combine user mask with min_flow mask: both must be true
-      for (std::size_t i=0; i<residual.size(); ++i) {
-        combined_edge_mask[i] = edge_mask_[i] && (static_cast<double>(residual[i]) >= thr);
+namespace {
+
+// ---------------------------------------------------------------- ShortestPaths preparation
+
+// A ShortestPaths demand's routes for the epoch, prepared at its first positive call (or a replace)
+// on the working residual at that call's entry: per roster source its route (the record's route
+// and route cost), and its program (Equal, Weighted: one split route per source in one
+// plan rooted at the roster) or the routes' union (Optimized, the controller's support).
+struct PreparedShortestPaths {
+  std::vector<LiveFlow> flows {};  // per roster source, new (id -1)
+  std::shared_ptr<const ForwardingProgram> program {};
+  std::vector<EdgeId> edges {};    // ascending: the union of the routes
+};
+
+PreparedShortestPaths prepare_shortest_path_program(PolicyCallContext& c) {
+  const auto& pe = c.engine;
+  const auto& g = c.graph;
+  const std::size_t k = pe.reachable_sources.size();
+  const RouteAllocation allocation = std::get<ShortestPaths>(pe.config.routing).allocation;
+  PreparedShortestPaths out;
+  out.flows.resize(k);
+  if (pe.kept_program) {
+    // Static split programs own each source's unpruned route and cost as well as
+    // the plan. Only fresh descriptors are needed; no retired record id is kept.
+    const auto& entries = ProgramAccess::data(*pe.kept_program).entries;
+    for (std::size_t i = 0; i < k; ++i) {
+      out.flows[i].source = pe.reachable_sources[i];
+      out.flows[i].route = entries[i].route;
+      out.flows[i].min_route_cost = entries[i].min_route_cost;
+    }
+    out.program = pe.kept_program;
+    return out;
+  }
+  std::vector<std::vector<EdgeId>> routes(k);
+  std::shared_ptr<const PreparedRoute> single;  // one source's plan from its one-pass creation
+  for (std::size_t i = 0; i < k; ++i) {
+    const NodeId s = pe.reachable_sources[i];
+    auto& f = out.flows[i];
+    f.source = s;
+    if (auto made = creation_products(c, s)) {
+      f.route = std::move(made->route);
+      f.min_route_cost = made->min_route_cost;
+      if (k == 1 && allocation != RouteAllocation::Optimized) {
+        single = std::make_shared<const PreparedRoute>(std::move(made->prepared_route));
+      } else {
+        routes[i] = std::move(made->prepared_route.support_edges);
       }
     } else {
-      // Only min_flow mask
-      for (std::size_t i=0; i<residual.size(); ++i) {
-        combined_edge_mask[i] = static_cast<double>(residual[i]) >= thr;
-      }
+      RouteSupport r = shortest_path_support(c, s);
+      f.route = record_route_of(g, r.edges, pe.support);
+      f.min_route_cost = r.cost != kUnreachable ? r.cost : min_route_cost(g, *f.route, s, pe.allowed_destinations);
+      routes[i] = std::move(r.edges);
     }
-    final_edge_mask = std::span<const bool>(combined_edge_mask.get(), residual.size());
-  } else if (!edge_mask_.empty()) {
-    // Only user-provided mask
-    final_edge_mask = edge_mask_;
-  }
-
-  SpfOptions opts;
-  opts.multipath = multipath_;  // Use configured multipath value (enables/disables flow splitting across equal-cost paths)
-  opts.selection = sel;
-  opts.dst = dst;
-  opts.residual = require_residual ? residual : std::span<const Cap>();
-  opts.node_mask = node_mask_;  // Use user-provided node mask
-  opts.edge_mask = final_edge_mask;
-  // dist.size() == num_nodes() for every SPF result, so the range check does
-  // not depend on the SPF output; hoisting it lets the memo skip the call.
-  if (dst < 0 || dst >= ctx_.graph.graph->num_nodes()) return std::nullopt;
-
-  PredDAG dag;
-  Cost dst_cost;
-  const bool use_memo = (is_equal_balanced(flow_placement_));
-  const auto stamp = fg.state_stamp();
-  const bool with_residual = !opts.residual.empty();
-  std::size_t hit_idx = spf_memo_.size();
-  if (use_memo) {
-    for (std::size_t i = 0; i < spf_memo_.size(); ++i) {
-      const auto& e = spf_memo_[i];
-      // min_flow's VALUE never reaches SPF in EB mode (the value-derived edge
-      // mask is Proportional-only); only has_value() matters, via
-      // require_residual. Keying on the value caused misses whenever rebalance
-      // rounds adjusted the per-flow target against unchanged residuals.
-      if (e.src != src || e.dst != dst || e.with_residual != with_residual ||
-          e.has_min_flow != min_flow.has_value()) {
-        continue;
+  }
+  // One split-routing source: its one-pass creation plan (the pooled builder's plan of its route,
+  // rooted at it) is the program; its route is the union.
+  if (single) {
+    std::vector<ProgramEntry> entries(1);
+    entries[0].route = out.flows[0].route;
+    entries[0].min_route_cost = out.flows[0].min_route_cost;
+    out.program = shortest_path_program(g, pe.sources, pe.destinations, pe.reachable_sources, std::move(single), std::move(entries));
+    return out;
+  }
+  for (const auto& r : routes) out.edges.insert(out.edges.end(), r.begin(), r.end());
+  std::sort(out.edges.begin(), out.edges.end());
+  out.edges.erase(std::unique(out.edges.begin(), out.edges.end()), out.edges.end());
+  // One continuation per router: every source's route leaves each of its routers by all the
+  // union's edges there. The routes are read on one view under one mask, so a router's
+  // continuation depends on the router alone (a single path's suffix is the canonical path of
+  // its first node; the rejected multipath = false with a HIGHER_* tie_break is the exception).
+  // One route is its own union: nothing to check.
+  const auto row = g.outgoing_offsets();
+  const auto edge_sources = g.edge_sources();
+  for (std::size_t i = 0; k > 1 && i < k; ++i) {
+    const auto& r = routes[i];
+    for (std::size_t a = 0; a < r.size();) {
+      const auto u = static_cast<std::size_t>(edge_sources[static_cast<std::size_t>(r[a])]);
+      std::size_t b = a;
+      while (b < r.size() && static_cast<std::size_t>(edge_sources[static_cast<std::size_t>(r[b])]) == u) ++b;
+      const auto lo = std::lower_bound(out.edges.begin(), out.edges.end(), row[u]);
+      const auto hi = std::lower_bound(lo, out.edges.end(), row[u + 1]);
+      if (static_cast<std::size_t>(hi - lo) != b - a) {
+        throw std::logic_error("ShortestPaths: two roster sources continue differently at node " + std::to_string(u));
       }
-      // Fast path: same FlowGraph, no mutation since the entry was stored.
-      // Content path: byte-identical residuals (rebalance remove+place
-      // round-trips restore content while the version keeps advancing).
-      const bool same = !with_residual || e.stamp == stamp ||
-          (e.residual.size() == opts.residual.size() &&
-           std::memcmp(e.residual.data(), opts.residual.data(),
-                       opts.residual.size() * sizeof(Cap)) == 0);
-      if (same) { hit_idx = i; break; }
-    }
-  }
-  if (hit_idx < spf_memo_.size()) {
-    dag = spf_memo_[hit_idx].dag;
-    dst_cost = spf_memo_[hit_idx].dst_cost;
-    // MRU: move the hit to the front so hot entries stay cheap to find.
-    if (hit_idx != 0) {
-      std::rotate(spf_memo_.begin(), spf_memo_.begin() + hit_idx,
-                  spf_memo_.begin() + hit_idx + 1);
+      a = b;
+    }
+  }
+  if (allocation == RouteAllocation::Optimized) return out;
+  const auto support = PredecessorDAGBuilder::ascending(*pe.support);
+  const auto dag = std::equal(out.edges.begin(), out.edges.end(), support.begin(), support.end())
+                       ? pe.support
+                       : std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(g, out.edges));
+  // Weighted weights: the static source, or the free capacity read now (ResidualSnapshot, frozen
+  // for the epoch).
+  std::vector<Amount> creation;
+  WeightSource weights = shortest_path_weight_source(pe);
+  if (allocation == RouteAllocation::Weighted && weights.basis == WeightBasis::ResidualSnapshot) {
+    creation.resize(out.edges.size());
+    for (std::size_t i = 0; i < out.edges.size(); ++i) creation[i] = c.service_capacity.at(out.edges[i]);
+    weights.values = creation;
+  }
+  std::vector<ProgramEntry> entries(k);
+  for (std::size_t i = 0; i < k; ++i) {
+    entries[i].route = out.flows[i].route;
+    entries[i].min_route_cost = out.flows[i].min_route_cost;
+  }
+  out.program = pooled_dag_program(g, pe.sources, pe.destinations, pe.reachable_sources, *dag, allocation, weights,
+                                   std::move(entries));
+  return out;
+}
+
+Trace routes_trace(const PreparedShortestPaths& p) {
+  Trace t = Trace::map();
+  for (const auto& f : p.flows) t.set(key(f.source), route_trace(PredecessorDAGBuilder::ascending(*f.route)));
+  return t;
+}
+
+// A record of one roster source of ShortestPaths or CentralizedTE (its route, its route cost).
+FlowRecord source_record(const PolicyEngine& pe, const LiveFlow& f) {
+  FlowRecord r;
+  r.sources = {f.source};
+  r.destinations = pe.allowed_destinations;
+  r.admission = pe.config.admission;
+  r.route = f.route;
+  r.min_route_cost = f.min_route_cost;
+  return r;
+}
+
+// `base` plus `add` (both ascending by EdgeId, positive entries): the record's cumulative edge
+// amounts (Amount) or drops (Counter128).
+std::vector<std::pair<EdgeId, Amount>> plus(const std::vector<std::pair<EdgeId, Amount>>& base,
+                                            const std::vector<std::pair<EdgeId, Amount>>& add) {
+  std::vector<std::pair<EdgeId, Amount>> out;
+  out.reserve(base.size() + add.size());
+  std::size_t i = 0;
+  for (const auto& [e, x] : add) {
+    while (i < base.size() && base[i].first < e) out.push_back(base[i++]);
+    if (i < base.size() && base[i].first == e) {
+      out.emplace_back(e, base[i++].second + x);
+    } else {
+      out.emplace_back(e, x);
+    }
+  }
+  out.insert(out.end(), base.begin() + static_cast<std::ptrdiff_t>(i), base.end());
+  return out;
+}
+
+std::vector<std::pair<EdgeId, Counter128>> plus(const std::vector<std::pair<EdgeId, Counter128>>& base,
+                                                const std::vector<std::pair<EdgeId, Amount>>& add) {
+  std::vector<std::pair<EdgeId, Counter128>> out;
+  out.reserve(base.size() + add.size());
+  std::size_t i = 0;
+  for (const auto& [e, x] : add) {
+    while (i < base.size() && base[i].first < e) out.push_back(base[i++]);
+    Counter128 sum = i < base.size() && base[i].first == e ? base[i++].second : Counter128 {};
+    accumulate(sum, c128(x), "drops");
+    out.emplace_back(e, sum);
+  }
+  out.insert(out.end(), base.begin() + static_cast<std::ptrdiff_t>(i), base.end());
+  return out;
+}
+
+// The sum of several ascending (EdgeId, amount) lists.
+std::vector<std::pair<EdgeId, Amount>> merged(std::vector<std::pair<EdgeId, Amount>> all) {
+  std::sort(all.begin(), all.end(), [](const auto& a, const auto& b) { return a.first < b.first; });
+  std::vector<std::pair<EdgeId, Amount>> out;
+  out.reserve(all.size());
+  for (const auto& [e, x] : all) {
+    if (!out.empty() && out.back().first == e) {
+      out.back().second += x;
+    } else {
+      out.emplace_back(e, x);
     }
+  }
+  return out;
+}
+
+// One record per roster source (ShortestPaths, CentralizedTE): the drafts in roster order, kept ids when
+// the epoch already has them, else new (with their place in the next epoch).
+void source_drafts(const PolicyEngine& pe, const std::vector<LiveFlow>& flows, PendingPolicyUpdate& s) {
+  const std::size_t k = flows.size();
+  s.drafts.resize(k);
+  s.next_epoch.record_groups.assign(k, {});
+  for (std::size_t i = 0; i < k; ++i) {
+    if (flows[i].record_counter >= 0) {
+      s.drafts[i].record_counter = flows[i].record_counter;
+    } else {
+      s.fresh.emplace_back(i, 0);
+    }
+    s.drafts[i].record = source_record(pe, flows[i]);
+    s.next_epoch.record_groups[i].push_back(flows[i]);
+  }
+}
+
+// The programs of a call and the flags they give. Only T1's own setup books holds, so only it
+// reports a reservation change; Pinned over a T1 program keeps the imported amounts and books none.
+void set_flags(PlacementResult& out, const ForwardingProgram* before, const ForwardingProgram* after,
+               bool reserves) noexcept {
+  const auto change = compare_programs(before, after, reserves);
+  out.routes_changed = change.routes;
+  out.weights_changed = change.weights;
+  out.reservations_changed = change.reservations;
+}
+
+// The by_tunnel rows of a controller's program: every path up, assigned = delivered = its amount.
+std::vector<TunnelFlow> optimized_flow_tunnel_rows(const ForwardingProgram& program) {
+  std::vector<TunnelFlow> rows;
+  rows.reserve(program.tunnels().size());
+  for (const auto& t : program.tunnels()) rows.push_back(TunnelFlow {t.entry_id, t.head, TunnelStatus::Up, c128(t.weight), t.weight, {}});
+  return rows;
+}
+
+// ---------------------------------------------------------------- ShortestPaths Equal and Weighted
+
+PendingPolicyUpdate place_pooled(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                    const ForwardingProgram* before_program) {
+  const auto& g = *pe.graph;
+  const auto v = rq.offer;
+  Trace* trace = rq.trace;
+  PolicyCallContext c {pe, g, W};
+  const std::size_t k = pe.reachable_sources.size();
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  const bool created = cur.record_groups.front().empty();
+  PreparedShortestPaths prep;
+  std::vector<LiveFlow> flows(k);
+  if (created) {
+    prep = prepare_shortest_path_program(c);
+    flows = prep.flows;
   } else {
-    auto res = ctx_.algorithms->spf(ctx_.graph, src, opts);
-    dag = std::move(res.second);
-    dst_cost = res.first[static_cast<std::size_t>(dst)];
-    if (use_memo) {
-      SpfMemoEntry entry;
-      entry.src = src;
-      entry.dst = dst;
-      entry.with_residual = with_residual;
-      entry.stamp = stamp;
-      entry.residual.assign(opts.residual.begin(), opts.residual.end());
-      entry.has_min_flow = min_flow.has_value();
-      entry.dag = dag;
-      entry.dst_cost = dst_cost;
-      const std::size_t entry_bytes =
-          entry.residual.size() * sizeof(Cap) +
-          entry.dag.parent_offsets.size() * sizeof(std::int32_t) +
-          entry.dag.parents.size() * (sizeof(NodeId) + sizeof(EdgeId)) +
-          sizeof(SpfMemoEntry);
-      const std::size_t cap = std::clamp<std::size_t>(
-          kSpfMemoMaxBytes / std::max<std::size_t>(entry_bytes, 1), 1,
-          kSpfMemoMaxEntries);
-      spf_memo_.insert(spf_memo_.begin(), std::move(entry));
-      if (spf_memo_.size() > cap) spf_memo_.resize(cap);
-    }
-  }
-  if (dst_cost < best_path_cost_) best_path_cost_ = dst_cost;
-
-  // Enforce path cost constraints:
-  // 1. In shortest_path mode, only allow paths with cost equal to best discovered cost.
-  //    This prevents the policy from stepping up to higher-cost tiers incrementally.
-  if (shortest_path_ && dst_cost > best_path_cost_) {
-    return std::nullopt;
-  }
-
-  // 2. Check absolute and relative path cost limits.
-  //    max_path_cost: absolute upper bound on path cost.
-  //    max_path_cost_factor: relative multiplier on best path cost (e.g. 1.5 = allow 50% longer).
-  if (max_path_cost_.has_value() || max_path_cost_factor_.has_value()) {
-    const Cost absmax = max_path_cost_.value_or(std::numeric_limits<Cost>::max());
-    // Apply the relative bound only when a best cost exists: multiplying the
-    // INT64_MAX "no best yet" sentinel by the factor and casting back is
-    // undefined behavior (the product exceeds the int64 range).
-    Cost factor_bound = std::numeric_limits<Cost>::max();
-    if (max_path_cost_factor_.has_value() &&
-        best_path_cost_ != std::numeric_limits<Cost>::max()) {
-      const double prod = static_cast<double>(best_path_cost_) * *max_path_cost_factor_;
-      if (prod < static_cast<double>(std::numeric_limits<Cost>::max())) {
-        factor_bound = static_cast<Cost>(prod);
+    for (std::size_t i = 0; i < k; ++i) flows[i] = cur.record_groups[i].front();
+  }
+  const auto program = created ? prep.program : cur.program;
+  const PreparedRoute& plan = *ProgramAccess::data(*program).split_contexts.front().prepared_route;
+  const auto members = std::span<const EdgeId>(plan.forwarding_edges);
+  std::vector<const FlowRecord*> before(k, nullptr);
+  if (!created) {
+    for (std::size_t i = 0; i < k; ++i) before[i] = &LedgerAccess::live(pe.ledger, flows[i].record_counter);
+  }
+  PendingPolicyUpdate s;
+  source_drafts(pe, flows, s);
+  auto& drafts = s.drafts;
+  // A one-source program is its own attribution.
+  Attribution attr;
+  Attribution* per_source = k > 1 ? &attr : nullptr;
+  std::vector<Amount> inject(k, 0);
+  Forwarding fw;
+  Amount call_delivered = 0;
+  Counter128 offered = cur.offered;
+  Trace step_tr = Trace::map();
+  if (!lossy) {
+    // The largest total in [admitted, admitted + v] whose no-drop forwarding fits V = W + own.
+    std::vector<Amount> own(members.size(), 0);
+    std::vector<Amount> part;
+    Amount admitted = 0;
+    for (const FlowRecord* r : before) {
+      if (r == nullptr) continue;
+      admitted += r->delivered;
+      align(members, r->edge_flows, part);
+      for (std::size_t m = 0; m < members.size(); ++m) own[m] += part[m];
+    }
+    std::vector<Amount> view;
+    W.gather(members, view);
+    for (std::size_t m = 0; m < members.size(); ++m) view[m] += own[m];
+    auto step = lossless_step(plan, admitted, view, own, v);
+    call_delivered = step.admitted - admitted;
+    if (per_source == nullptr) {
+      // One source holds the whole admitted allocation (the attribution's degenerate form): it
+      // delivers all of it, with no second forwarding.
+      auto& r = drafts.front().record;
+      r.edge_flows = nonzero_pairs(members, step.edge_flows);
+      r.delivered = step.admitted;
+    } else {
+      // Several sources: forward the admitted total again to attribute it.
+      round_robin(step.admitted, inject);
+      fw = forward(plan, Injection {inject, false}, {}, per_source);
+      if (fw.edge_flows != step.edge_flows) {
+        throw std::logic_error("ShortestPaths: the attributed forwarding differs from the admitted allocation");
+      }
+      for (std::size_t i = 0; i < k; ++i) {
+        auto& r = drafts[i].record;
+        for (const auto& x : attr.entries[i]) {
+          if (x.carried != 0) r.edge_flows.emplace_back(members[static_cast<std::size_t>(x.edge_position)], x.carried);
+        }
+        r.delivered = attr.delivered[i];
       }
     }
-    if (dst_cost > std::min<Cost>(absmax, factor_bound)) return std::nullopt;
-  }
-  // Ensure there is at least one predecessor for dst
-  if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size()-1) return std::nullopt;
-  if (dag.parent_offsets[static_cast<std::size_t>(dst)] == dag.parent_offsets[static_cast<std::size_t>(dst)+1]) return std::nullopt;
-  // Return DAG and cost as-is; placement logic decides proportional vs equal-balanced behavior.
-  return std::make_optional(std::make_pair(std::move(dag), dst_cost));
-}
-
-/* Create a new flow using the current path bundle. Returns nullptr if no
-   admissible path is available given constraints. */
-FlowRecord* FlowPolicy::create_flow(FlowGraph& fg, NodeId src, NodeId dst, FlowClass flowClass,
-                              std::optional<double> min_flow) {
-  // Generate a unique flow index.
-  FlowIndex idx{src, dst, flowClass, next_flow_id_++};
-
-  // Request a path DAG from shortest paths algorithm.
-  auto pb = get_path_bundle(fg, src, dst, min_flow);
-  if (!pb.has_value()) return nullptr;  // No admissible path found
-
-  // Destructure the returned pair (DAG, cost).
-  auto [dag, cost] = std::move(pb.value());
-
-  // Create flow record and insert into flows_ map.
-  FlowRecord f(idx, src, dst, std::move(dag), cost);
-  auto [it, ok] = flows_.emplace(idx, std::move(f));  // emplace returns (iterator, success_flag)
-  (void)ok;  // suppress unused variable warning
-  return &it->second;
-}
-
-/* Re-select a path for an existing flow, requesting at least (current+headroom)
-   residual. On failure, restores the flow on its original DAG.
-
-   Reoptimization is useful when a flow's current path becomes suboptimal due to
-   network changes or when seeking additional capacity. */
-FlowRecord* FlowPolicy::reoptimize_flow(FlowGraph& fg, const FlowIndex& idx, double headroom) {
-  // Pinned means pinned: a static-path flow is never rerouted. (Deliberate
-  // divergence from the original Python port, where reoptimization could
-  // silently move a pinned flow onto an SPF path.) Must precede any
-  // remove/re-place churn below.
-  if (has_static_paths()) return nullptr;
-  auto it = flows_.find(idx);
-  if (it == flows_.end()) return nullptr;
-  FlowRecord& cur = it->second;
-  const double current = cur.placed_flow;
-  const double new_min = current + headroom;
-
-  // Temporarily remove this flow's deltas from the graph to compute a path
-  // based on available capacity (excluding this flow's own usage).
-  fg.remove(idx);
-  auto pb = get_path_bundle(fg, cur.src, cur.dst, new_min);
-  if (!pb.has_value()) {
-    // Reoptimization failed: restore flow on original DAG.
-    Flow placed = fg.place(idx, cur.src, cur.dst, cur.dag, current, flow_placement_);
-    cur.placed_flow = placed; // may be slightly less if capacity changed; acceptable
-    return nullptr;
-  }
-
-  // Reoptimization succeeded: update flow to use new DAG.
-  auto [dag, cost] = std::move(pb.value());
-  cur.dag = std::move(dag);
-  cur.cost = cost;
-  Flow placed = fg.place(idx, cur.src, cur.dst, cur.dag, current, flow_placement_);
-  cur.placed_flow = placed;
-  return &cur;
-}
-
-/* Place `volume` of demand according to the policy. When `target_per_flow`
-   is provided (e.g., during rebalancing), each flow aims for that target.
-   Returns (total_placed, leftover). */
-std::pair<double,double> FlowPolicy::place_demand(FlowGraph& fg,
-                                                  NodeId src, NodeId dst,
-                                                  FlowClass flowClass,
-                                                  double volume,
-                                                  std::optional<double> target_per_flow,
-                                                  std::optional<double> min_flow) {
-  NGRAPH_PROFILE_SCOPE("place_demand");
-
-  check_demand_target(fg, src, dst, "place_demand");
-
-  auto [total_placed, remaining] = place_demand_body(fg, src, dst, flowClass, volume,
-                                                     target_per_flow, min_flow);
-
-  // For EQUAL_BALANCED placement, rebalance flows to maintain equal volumes.
-  //
-  // Iterative on purpose: the previous implementation recursed
-  // place_demand -> rebalance_demand -> place_demand until balanced, and with many
-  // pinned bundles of heterogeneous capacity the depth grows like
-  // U * ln(imbalance / kMinFlow) -- a stack-overflow risk on worker threads. Each
-  // round below performs exactly what one recursion level performed (re-place the
-  // currently placed volume at the equal-share target), and the recursion's return
-  // value telescoped to (placed_demand(), pre-rebalance leftover + volume lost in
-  // rebalancing), which is reproduced after the loop.
-  // Lossy placement is best-effort: each flow is offered its share and carries
-  // what fits, so equalizing what was *carried* would contradict the model
-  // (it would throttle the healthy flows down to the congested one).
-  if (is_equal_balanced(flow_placement_) &&
-      flow_placement_ != FlowPlacement::EqualBalancedLossy && !flows_.empty()) {
-    // Restore the reoptimize flag even if a round throws (bad_alloc is the only
-    // realistic thrower here); otherwise the policy would stay permanently
-    // non-reoptimizing.
-    struct ReoptRestore {
-      bool& flag;
-      bool prev;
-      ~ReoptRestore() { flag = prev; }
-    } reopt_restore{reoptimize_flows_on_each_placement_, reoptimize_flows_on_each_placement_};
-    reoptimize_flows_on_each_placement_ = false;
-    const double pre_rounds_placed = placed_demand();
-    bool rebalanced = false;
-    // Backstop only; each round strictly reduces the imbalance in practice.
-    constexpr int kMaxRebalanceRounds = 65536;
-    for (int round = 0; round < kMaxRebalanceRounds && !flows_.empty(); ++round) {
-      const double target_eq = placed_demand() / static_cast<double>(flows_.size());
-      bool unbalanced = false;
-      for (auto const& kv : flows_) {
-        if (std::abs(target_eq - kv.second.placed_flow) >= kMinFlow) { unbalanced = true; break; }
+    if (kTraced && trace) step_tr = Trace::ints(std::vector<Amount> {admitted, step.admitted});
+  } else {
+    // The new round-robin injections of the offer (or the first-hop experiment) on W.
+    Injection in;
+    if (v.has_value()) {
+      round_robin_increments(cur.offered, *v, inject);
+      in.per_root = inject;
+    } else {
+      in.first_hop = true;
+    }
+    std::vector<Amount> w;
+    W.gather(members, w);
+    fw = forward(plan, in, w, per_source);
+    call_delivered = fw.delivered;
+    for (std::size_t i = 0; i < k; ++i) {
+      auto& r = drafts[i].record;
+      std::vector<std::pair<EdgeId, Amount>> carried;
+      std::vector<std::pair<EdgeId, Amount>> dropped;
+      Amount offer = fw.offered;
+      Amount delivered = fw.delivered;
+      if (per_source == nullptr) {
+        carried = nonzero_pairs(members, fw.edge_flows);
+        dropped = nonzero_pairs(members, fw.edge_drops);
+      } else {
+        for (const auto& x : attr.entries[i]) {
+          const EdgeId e = members[static_cast<std::size_t>(x.edge_position)];
+          if (x.carried != 0) carried.emplace_back(e, x.carried);
+          if (x.drops != 0) dropped.emplace_back(e, x.drops);
+        }
+        offer = attr.offered[i];
+        delivered = attr.delivered[i];
       }
-      if (!unbalanced) break;
-      rebalanced = true;
-      const double vol = placed_demand();
-      remove_demand(fg);
-      (void)place_demand_body(fg, src, dst, flowClass, vol, target_eq, std::nullopt);
-    }
-    if (rebalanced) {
-      const double final_placed = placed_demand();
-      remaining += pre_rounds_placed - final_placed;  // volume shed while rebalancing
-      total_placed = final_placed;
-    }
-  }
-  return { total_placed, remaining };
-}
-
-/* Placement core; see place_demand for the public contract. */
-std::pair<double,double> FlowPolicy::place_demand_body(FlowGraph& fg,
-                                                       NodeId src, NodeId dst,
-                                                       FlowClass flowClass,
-                                                       double volume,
-                                                       std::optional<double> target_per_flow,
-                                                       std::optional<double> min_flow) {
-  const bool is_static = has_static_paths();
-
-  // Compute target flow per flow-record.
-  // target: the volume to place per flow (or globally if target_per_flow is unset).
-  // per_target: refined target for EqualBalanced mode (considers source capacity).
-  double target = target_per_flow.value_or(volume);
-  double per_target = target;
-
-  // EqualBalanced divisor: the number of flows the volume is split across. For a
-  // pinned policy that is the number of USABLE bundles (a head-end hashes over up
-  // LSPs only); dynamically it is the configured max_flow_count.
-  int eb_divisor = 0;
-  if (is_equal_balanced(flow_placement_)) {
-    if (is_static) eb_divisor = static_cast<int>(static_bundles_.size());
-    else if (max_flow_count_.has_value()) eb_divisor = *max_flow_count_;
-  }
-
-  // For EqualBalanced, compute a per-flow target based on available source
-  // capacity and the requested volume, divided by the number of flows.
-  if (eb_divisor > 0) {
-    const auto& g = fg.graph();
-    auto row = g.row_offsets_view();
-    auto aei = g.adj_edge_index_view();
-    auto residual = fg.residual_view();
-
-    // Compute total residual capacity on edges leaving src.
-    double src_cap = 0.0;
-    if (src >= 0 && src < g.num_nodes()) {
-      auto s = static_cast<std::size_t>(row[static_cast<std::size_t>(src)]);
-      auto e = static_cast<std::size_t>(row[static_cast<std::size_t>(src)+1]);
-      for (std::size_t j = s; j < e; ++j) {
-        auto eid = static_cast<std::size_t>(aei[j]);
-        src_cap += static_cast<double>(residual[eid]);
+      // The counters' 2^127 checks: a drop counter first, then the offered ones.
+      const FlowRecord* b = before[i];
+      r.edge_drops = plus(b != nullptr ? b->edge_drops : std::vector<std::pair<EdgeId, Counter128>> {}, dropped);
+      r.offered = b != nullptr ? b->offered.value_or(Counter128 {}) : Counter128 {};
+      accumulate(*r.offered, c128(offer), "offered");
+      r.delivered = (b != nullptr ? b->delivered : 0) + delivered;
+      r.edge_flows = b != nullptr ? plus(b->edge_flows, carried) : std::move(carried);
+    }
+    accumulate(offered, c128(fw.offered), "offered");
+    if (kTraced && trace) {
+      step_tr = Trace::map();
+      for (std::size_t i = 0; i < k; ++i) {
+        step_tr.set(key(pe.reachable_sources[i]), v.has_value() ? Trace::integer(inject[i]) : Trace::str("inf"));
       }
     }
-    // Per-flow target: min of requested volume and source capacity, per flow.
-    double per_req = target / static_cast<double>(eb_divisor);
-    double per_src = src_cap / static_cast<double>(eb_divisor);
-    per_target = std::max(kMinFlow, std::min(per_req, per_src));
   }
+  const Counter128 requested = requested_after(cur, v);
+  PlacementResult& out = s.result;
+  out.call_delivered = call_delivered;
+  if (v.has_value()) out.call_undelivered = *v - call_delivered;
+  out.delivery_delta = call_delivered;
+  if (lossy) out.call_edge_drops = nonzero_pairs(members, fw.edge_drops);
+  out.call_source_drops = fw.source_drops;
+  if (members.empty()) {
+    out.termination = Termination::NoActiveWeight;
+  } else if (lossy) {
+    out.termination = v.has_value() ? Termination::Complete : Termination::Exhausted;
+  } else {
+    out.termination = v.has_value() && call_delivered == *v ? Termination::Complete : Termination::Exhausted;
+  }
+  if (created) set_flags(out, before_program, program.get(), false);
+  out.program = program;
+  fill_state(pe, draft_records(drafts), requested, cur.infinite || !v.has_value(), offered, out);
+  if (kTraced && trace) {
+    trace->set("prepare", created ? routes_trace(prep) : Trace::null());
+    trace->set(lossy ? "offers" : "T", std::move(step_tr));
+  }
+  s.next_epoch.program = program;
+  s.next_epoch.requested = requested;
+  s.next_epoch.offered = offered;
+  s.next_epoch.prepared = true;
+  s.next_epoch.infinite = cur.infinite || !v.has_value();
+  return s;
+}
+
+// ---------------------------------------------------------------- the controllers
+
+// One solve of a controller from zero on the view V with value cap `cap` (nullopt: uncapped);
+// `caps` (prescribed source allocation) caps source i's arc at caps[i]. Unrestricted CentralizedTE solves over every
+// eligible edge, its V and flows per EdgeId; CentralizedTE with a support and ShortestPaths Optimized over
+// `support`, their V and flows aligned with it.
+struct OptimizedFlowResult {
+  Amount flow_value {0};
+  std::vector<Amount> edge_flows {};
+  MinCostFlowResult payload {};  // unrestricted CentralizedTE: the flow core's payload (the curve, the cut, the trace's values)
+};
+
+OptimizedFlowResult solve(const PolicyEngine& pe, std::span<const EdgeId> support, std::span<const Amount> V,
+            std::optional<Amount> cap, std::span<const Amount> caps) {
+  const auto& g = *pe.graph;
+  OptimizedFlowResult out;
+  if (is_unrestricted_centralized_te(pe)) {
+    out.payload = solve_min_cost_flow(g, V, pe.reachable_sources, pe.allowed_destinations, pe.eligibility, cap, caps.empty() ? pe.capture : nullptr, caps);
+    out.flow_value = out.payload.flow_value;
+    out.edge_flows = out.payload.edge_flows;
+    return out;
+  }
+  auto r = solve_subset(g, support, V, pe.reachable_sources, pe.allowed_destinations, cap, caps);
+  out.flow_value = r.flow_value;
+  out.edge_flows = std::move(r.edge_flows);
+  return out;
+}
+
+// Prescribed source allocation: the largest total T in [lo, hi] whose RR or H supplies are all
+// carried (a solve capped at T with source i's arc capped at its share reaches T), given that lo's
+// are. Feasible totals form a prefix (each share never decreases in T, and a smaller supply
+// vector stays feasible), so integer bisection is exact; T's solve from zero is returned, so the
+// result does not depend on the probes.
+OptimizedFlowResult solve_prescribed(const PolicyEngine& pe, std::span<const EdgeId> support, std::span<const Amount> V, Amount lo,
+                  Amount hi, std::span<const Amount> weights, Trace* probes) {
+  std::vector<Amount> caps(pe.reachable_sources.size());
+  auto attempt = [&](Amount t) -> std::optional<OptimizedFlowResult> {
+    std::fill(caps.begin(), caps.end(), 0);
+    if (weights.empty()) round_robin(t, caps);
+    else highest_averages(t, weights, caps);
+    auto s = solve(pe, support, V, t, caps);
+    if (kTraced && probes != nullptr) probes->push(Trace::integer(t));
+    if (s.flow_value != t) return std::nullopt;
+    return s;
+  };
+  if (auto s = attempt(hi)) return std::move(*s);
+  std::optional<OptimizedFlowResult> best;
+  while (hi - lo > 1) {
+    const Amount mid = lo + (hi - lo) / 2;
+    if (auto s = attempt(mid)) {
+      lo = mid;
+      best = std::move(s);
+    } else {
+      hi = mid;
+    }
+  }
+  if (!best) best = attempt(lo);
+  if (!best) throw std::logic_error("prescribed source allocation: the admitted total is no longer carried");
+  return std::move(*best);
+}
 
-  // Initialize flows if none exist yet.
-  if (flows_.empty()) {
-    if (is_static) {
-      // Pinned bundles: one flow per usable bundle, in supply order, each bound to
-      // its own (pruned) DAG and post-prune cost.
-      if (src != static_src_ || dst != static_dst_) {
-        throw std::invalid_argument(
-            "Source and destination nodes of static paths do not match demand.");
+// The upper end of a prescribed-supply search: the view summed over the edges leaving the roster sources
+// (unrestricted CentralizedTE: the eligible ones, V per EdgeId; otherwise the support's, V aligned with
+// it); the supplies leave through them.
+Amount source_outgoing_capacity_bound(const PolicyEngine& pe, std::span<const EdgeId> support, std::span<const Amount> V) {
+  const auto row = pe.graph->outgoing_offsets();
+  const bool dense = is_unrestricted_centralized_te(pe);
+  Amount sum = 0;
+  for (NodeId s : pe.reachable_sources) {
+    const auto si = static_cast<std::size_t>(s);
+    if (dense) {
+      for (auto e = row[si]; e < row[si + 1]; ++e) {
+        if (pe.eligibility == nullptr || pe.eligibility->allows_edge(e)) sum += V[static_cast<std::size_t>(e)];
       }
-      for (auto const& b : static_bundles_) {
-        FlowIndex idx{src, dst, flowClass, next_flow_id_++};
-        flows_.emplace(idx, FlowRecord(idx, src, dst, b.dag, b.cost));
+    } else {
+      for (auto it = std::lower_bound(support.begin(), support.end(), row[si]);
+           it != support.end() && *it < row[si + 1]; ++it) {
+        sum += V[static_cast<std::size_t>(it - support.begin())];
       }
+    }
+  }
+  return sum;
+}
+
+// The program basis of a controller: unrestricted CentralizedTE the topology under its mask; CentralizedTE with
+// a support that support; ShortestPaths Optimized each source's route.
+ReplayBasis optimized_flow_replay_basis(const PolicyEngine& pe, const std::vector<LiveFlow>& flows) {
+  ReplayBasis b;
+  if (is_unrestricted_centralized_te(pe)) {
+    b.uses_topology_basis = true;
+    b.excluded_nodes = pe.excluded_nodes;
+    b.excluded_edges = pe.excluded_edges;
+  } else if (is<CentralizedTE>(pe)) {
+    b.common_support = pe.centralized_te_support;
+  } else {
+    b.source_supports.reserve(flows.size());
+    for (const auto& f : flows) b.source_supports.push_back(f.route);
+  }
+  return b;
+}
+
+PendingPolicyUpdate place_optimized_flow(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                        const ForwardingProgram* before_program) {
+  const auto& g = *pe.graph;
+  const auto v = rq.offer;
+  Trace* trace = rq.trace;
+  const bool dense = is_unrestricted_centralized_te(pe);
+  const bool global = is<CentralizedTE>(pe);
+  const bool prescribed = pe.source_allocation != SourceAllocation::Optimized;
+  const bool weighted = pe.source_allocation == SourceAllocation::Weighted;
+  const std::size_t k = pe.reachable_sources.size();
+  std::vector<Amount> source_weights;
+  if (weighted) {
+    const auto& declared = *std::get<CentralizedTE>(pe.config.routing).source_weights;
+    source_weights.reserve(k);
+    for (NodeId src : pe.reachable_sources) source_weights.push_back(declared[static_cast<std::size_t>(src)]);
+  }
+  const bool no_active_source_weight = weighted && std::none_of(source_weights.begin(), source_weights.end(), [](Amount w) { return w != 0; });
+  const bool created = cur.record_groups.front().empty();
+  // ShortestPaths Optimized: the support of the epoch (its routes, prepared at its first call).
+  PreparedShortestPaths prep;
+  if (!global && created) {
+    PolicyCallContext c {pe, g, W};
+    prep = prepare_shortest_path_program(c);
+  }
+  const std::span<const EdgeId> support = dense      ? std::span<const EdgeId> {}
+                                          : global   ? std::span<const EdgeId>(*pe.centralized_te_support)
+                                          : created  ? std::span<const EdgeId>(prep.edges)
+                                                     : std::span<const EdgeId>(cur.support);
+  std::vector<LiveFlow> flows(k);
+  for (std::size_t i = 0; i < k; ++i) {
+    if (!created) {
+      flows[i] = cur.record_groups[i].front();
+    } else if (!global) {
+      flows[i] = prep.flows[i];
     } else {
-      // Dynamic paths: seed initial flows.
-      int initial = min_flow_count_;
-      if (max_flow_count_.has_value()) {
-        initial = std::min(initial, *max_flow_count_);
+      flows[i].source = pe.reachable_sources[i];
+    }
+  }
+  // V = W + own: the working residual plus the policy's own allocation (its live records, or none
+  // in a full-offer call, whose view already holds them released), per EdgeId (unrestricted
+  // CentralizedTE) or aligned with the support (a record's edges lie in it, both ascending).
+  std::vector<Amount> V;
+  if (dense) {
+    W.dense(V);
+  } else {
+    W.gather(support, V);
+  }
+  Amount P = 0;
+  for (const auto& f : flows) {
+    if (f.record_counter < 0) continue;
+    const FlowRecord& rec = LedgerAccess::live(pe.ledger, f.record_counter);
+    P += rec.delivered;
+    std::size_t p = 0;
+    for (const auto& [e, x] : rec.edge_flows) {
+      if (dense) {
+        V[static_cast<std::size_t>(e)] += x;
+        continue;
       }
-      auto min_req = (is_equal_balanced(flow_placement_) && max_flow_count_.has_value())
-                       ? std::optional<double>(per_target)
-                       : min_flow;
-      // Seeding places no flow, so residuals do not change between iterations and
-      // every create_flow() here would recompute the identical SPF. Compute the
-      // bundle once and copy it into each seeded flow.
-      if (initial > 0) {
-        if (auto pb = get_path_bundle(fg, src, dst, min_req)) {
-          for (int i = 0; i < initial; ++i) {
-            FlowIndex idx{src, dst, flowClass, next_flow_id_++};
-            FlowRecord f(idx, src, dst, pb->first, pb->second);
-            flows_.emplace(idx, std::move(f));
-          }
-        }
+      while (p < support.size() && support[p] < e) ++p;
+      if (p == support.size() || support[p] != e) throw std::logic_error("controller: a record edge outside the support");
+      V[p] += x;
+    }
+  }
+  const std::optional<Amount> cap = v.has_value() ? std::optional<Amount>(P + *v) : std::nullopt;
+  if (pe.capture != nullptr) {
+    if (prescribed || !dense) throw std::logic_error("a deletion capture of a controller other than optimized CentralizedTE");
+    pe.capture->graph = pe.graph;
+  }
+  Trace probes = Trace::list();
+  OptimizedFlowResult sol;
+  if (prescribed) {
+    const Amount top = no_active_source_weight ? 0 : source_outgoing_capacity_bound(pe, support, V);
+    sol = solve_prescribed(pe, support, V, P, cap.has_value() ? std::min(*cap, top) : top, source_weights, &probes);
+  } else {
+    sol = solve(pe, support, V, cap, {});
+  }
+  if (sol.flow_value < P) throw std::logic_error("controller: a call reduced delivered()");
+  // The program: each source's supply cut into paths; each source's share is the sum of its
+  // paths.
+  // The solved flows move into the decomposition (a trace reads them afterwards: a copy).
+  const bool traced = kTraced && trace != nullptr;
+  auto dec = decompose(g, support, traced ? sol.edge_flows : std::move(sol.edge_flows), pe.reachable_sources, pe.allowed_destinations);
+  PendingPolicyUpdate s;
+  // A supplied support, which a share that uses every one of its edges reuses as its route (a
+  // PredecessorDAG is fixed by its graph and edge set: the same value).
+  const auto* gl = std::get_if<CentralizedTE>(&pe.config.routing);
+  const std::shared_ptr<const PredecessorDAG> supplied = gl != nullptr ? gl->support : nullptr;
+  for (std::size_t i = 0; i < k; ++i) {
+    const NodeId src = pe.reachable_sources[i];
+    auto& f = flows[i];
+    if (global) {
+      // CentralizedTE's record route is the edges its share uses.
+      const auto& share = dec.shares[i];
+      auto same = [&](std::span<const EdgeId> edges) {
+        return std::equal(share.begin(), share.end(), edges.begin(), edges.end(),
+                          [](const auto& ex, EdgeId e) { return ex.first == e; });
+      };
+      if (f.route && same(PredecessorDAGBuilder::ascending(*f.route))) continue;
+      if (supplied && same(PredecessorDAGBuilder::ascending(*supplied))) {
+        f.route = supplied;
+      } else {
+        std::vector<EdgeId> route;
+        route.reserve(share.size());
+        for (const auto& [e, x] : share) route.push_back(e);
+        f.route = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(g, route));
       }
+      f.min_route_cost = share.empty() ? kUnreachable : min_route_cost(g, *f.route, src, pe.allowed_destinations);
     }
   }
-  // Round-robin placement: iterate over flows and try to place volume on each.
-  std::deque<FlowIndex> q;
-  for (auto const& kv : flows_) q.push_back(kv.first);
-  if (is_static) {
-    // Pinned bundles have a documented precedence: bundle-supply order. Flow ids
-    // are assigned in that order, so sorting makes the visit order deterministic
-    // across platforms (unordered_map iteration order is not).
-    std::sort(q.begin(), q.end(),
-              [](const FlowIndex& a, const FlowIndex& b) { return a.flowId < b.flowId; });
-  }
-  double total_placed = 0.0;
-  int no_progress = 0;  // counter for consecutive iterations with no progress
-  int iters = 0;
-
-  // Diminishing-returns tracking for early exit.
-  std::deque<double> recent;
-  const double initial_request = volume;
-
-  while (volume >= kMinFlow && !q.empty()) {
-    FlowIndex cur_idx = q.front(); q.pop_front();
-    auto it_cur = flows_.find(cur_idx);
-    if (it_cur == flows_.end()) continue;  // flow removed during iteration
-    FlowRecord* f = &it_cur->second;
-
-    // Must have a DAG to place; skip otherwise.
-    if (f->dag.parent_offsets.empty()) {
-      ++no_progress;
-      if (no_progress>=max_no_progress_iterations_) break;
-      continue;
+  source_drafts(pe, flows, s);
+  for (std::size_t i = 0; i < k; ++i) {
+    s.drafts[i].record.delivered = dec.supplies[i];
+    s.drafts[i].record.edge_flows = std::move(dec.shares[i]);
+  }
+  const auto& supplies = dec.supplies;
+  auto program = optimized_flow_program(g, pe.sources, pe.destinations, pe.reachable_sources, std::move(dec.paths),
+                                    weighted ? std::span<const Amount>(source_weights) : prescribed ? std::span<const Amount> {} : std::span<const Amount>(supplies),
+                                    optimized_flow_replay_basis(pe, flows));
+  const Counter128 requested = requested_after(cur, v);
+  PlacementResult& out = s.result;
+  out.call_delivered = sol.flow_value - P;
+  if (v.has_value()) out.call_undelivered = *v - out.call_delivered;
+  out.delivery_delta = out.call_delivered;
+  out.termination = v.has_value() && out.call_delivered == *v ? Termination::Complete : Termination::Exhausted;
+  if (no_active_source_weight && (!v.has_value() || *v != 0)) {
+    out.termination = Termination::NoActiveWeight;
+  }
+  set_flags(out, before_program, program.get(), false);
+  out.program = program;
+  out.by_tunnel = optimized_flow_tunnel_rows(*program);
+  const auto after = draft_records(s.drafts);
+  fill_state(pe, after, requested, cur.infinite || !v.has_value(), Counter128 {}, out);
+  out.total_cost = total_cost_of(g, after);
+  const bool curve = dense && !prescribed;
+  if (curve) out.marginal_cost_curve = sol.payload.marginal_cost_curve;
+  if (curve && rq.outputs != nullptr && rq.outputs->min_cut) out.min_cut = sol.payload.min_cut;
+  if (kTraced && trace) {
+    if (!global) trace->set("prepare", created ? routes_trace(prep) : Trace::null());
+    if (prescribed) trace->set("probes", std::move(probes));
+    if (dense) trace->set("V", Trace::ints(V));
+    trace->set("cap", cap.has_value() ? Trace::integer(*cap) : Trace::null());
+    Trace fc = Trace::map();
+    fc.set("placed", Trace::integer(sol.flow_value));
+    if (dense) {
+      const auto& r = sol.payload;
+      fc.set("cost_distribution", Trace::pairs(r.marginal_cost_curve));
+      fc.set("edge_flows", Trace::ints(r.edge_flows));
+      fc.set("min_cut", r.min_cut.has_value() ? Trace::ints(*r.min_cut) : Trace::null());
+      fc.set("potentials", Trace::ints(r.potentials));
+      Trace counters = Trace::map();
+      counters.set("dijkstra_runs", Trace::integer(r.counters.dijkstra_runs));
+      counters.set("dijkstra_pops", Trace::integer(r.counters.dijkstra_pops));
+      counters.set("settled", Trace::integer(r.counters.settled));
+      counters.set("arc_scans", Trace::integer(r.counters.arc_scans));
+      counters.set("dinic_phases", Trace::integer(r.counters.dinic_phases));
+      counters.set("augmentations", Trace::integer(r.counters.augmentations));
+      fc.set("counters", std::move(counters));
+    } else {
+      std::vector<Amount> flows_dense(static_cast<std::size_t>(g.num_edges()), 0);
+      for (std::size_t p = 0; p < support.size(); ++p) flows_dense[static_cast<std::size_t>(support[p])] = sol.edge_flows[p];
+      fc.set("edge_flows", Trace::ints(flows_dense));
     }
-    // Refresh DAG based on current residuals for dynamic path selection.
-    // This prunes saturated next-hops and updates path selection.
-    // For multipath flows, this tracks saturated edges within the DAG.
-    // For tunnel flows, this allows different tunnels to discover different paths
-    // as residuals change, enabling natural fan-out across equal-cost paths.
-    if (is_equal_balanced(flow_placement_) && !is_static) {
-      if (auto pb = get_path_bundle(fg, f->src, f->dst, std::optional<double>(per_target))) {
-        f->dag = std::move(pb->first);
-        f->cost = pb->second;
-      }
+    Trace supply = Trace::map();
+    Trace shares_tr = Trace::map();
+    for (std::size_t i = 0; i < k; ++i) {
+      supply.set(key(pe.reachable_sources[i]), Trace::integer(supplies[i]));
+      shares_tr.set(key(pe.reachable_sources[i]), Trace::pairs(s.drafts[i].record.edge_flows));
+    }
+    fc.set("supply", std::move(supply));
+    trace->set("flow_core", std::move(fc));
+    trace->set("shares", std::move(shares_tr));
+  }
+  if (curve) s.next_epoch.marginal_cost_curve = *out.marginal_cost_curve;  // the cumulative curve a later zero call reports
+  if (!global) s.next_epoch.support = created ? prep.edges : cur.support;
+  s.next_epoch.program = program;
+  s.next_epoch.by_tunnel = out.by_tunnel;
+  s.next_epoch.requested = requested;
+  s.next_epoch.prepared = true;
+  s.next_epoch.infinite = cur.infinite || !v.has_value();
+  return s;
+}
+
+// ---------------------------------------------------------------- forwarding a program
+
+// The by_tunnel rows of a forwarding: per tunnel its status in the view and its amounts
+// (assigned, delivered and dropped amounts per program entry).
+std::vector<TunnelFlow> tunnel_rows(const ForwardingView& view, std::span<const Counter128> assigned,
+                                    std::span<const Amount> delivered, std::span<const Counter128> dropped) {
+  const ProgramData& p = *view.data;
+  std::vector<TunnelFlow> rows;
+  rows.reserve(p.tunnels.size());
+  for (std::size_t t = 0; t < p.tunnels.size(); ++t) {
+    const auto e = static_cast<std::size_t>(p.tunnel_entry_positions[t]);
+    rows.push_back(TunnelFlow {p.tunnels[t].entry_id, p.tunnels[t].head, view.status(e), assigned[e], delivered[e], dropped[e]});
+  }
+  return rows;
+}
+
+// The free capacity of the forwarding's edges in the call's working residual.
+AvailableCapacityFn available_capacity_reader(const ServiceCapacityWorkspace& W) {
+  return [&W](std::span<const EdgeId> edges, std::span<Amount> out) {
+    for (std::size_t i = 0; i < edges.size(); ++i) out[i] = W.at(edges[i]);
+  };
+}
+
+// Some head of the view can place traffic: a positive injection weight and a surviving entry of
+// positive weight whose route has a member.
+bool view_active(const ForwardingView& v) {
+  const auto& p = *v.data;
+  for (std::size_t h = 0; h < v.num_sources(); ++h) {
+    if (!v.source_weights().empty() && v.source_weights()[h] == 0) continue;
+    for (const std::int32_t ei : v.entries_for_source(h)) {
+      const auto e = static_cast<std::size_t>(ei);
+      const auto& entry = p.entries[e];
+      if (entry.weight == 0) continue;
+      if (entry.tunnel_position >= 0) return true;
+      const auto r = v.context_source_index(e);
+      if (r >= 0 && v.prepared_route(static_cast<std::size_t>(entry.split_context_position))->source_positions[static_cast<std::size_t>(r)] >= 0) return true;
+    }
+  }
+  return false;
+}
+
+// A program forwarded as `view` sees it, one record per program entry (Pinned: its replay, every
+// call; T1: its own program, after setup or installed): place, evaluate, replace and T1's
+// forward. `active`: some head can place traffic (view_active). With `holds` (a T1 policy's own
+// program), each up tunnel's record holds its request on every edge of its path; `plan` is the
+// result's and the epoch's. `given` (Lossy, a full offer): the forwarding already computed with the
+// heads' shares of the offer (a SIMULTANEOUS list's joint evaluation), moved from.
+PendingPolicyUpdate forward_entries(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                       const ForwardingProgram* before_program, const ForwardingView& view, bool active, bool holds,
+                       std::shared_ptr<const TunnelPlan> plan, ProgramFlow* given = nullptr) {
+  const auto v = rq.offer;
+  const ProgramData& p = *view.data;
+  const std::size_t n = p.entries.size();
+  const std::size_t k = view.num_sources();
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  const bool created = !cur.prepared;
+  // The entries' live records (none before the first call).
+  std::vector<const FlowRecord*> before;
+  if (!created) {
+    before.resize(n);
+    for (std::size_t e = 0; e < n; ++e) before[e] = &LedgerAccess::live(pe.ledger, cur.record_groups[e].front().record_counter);
+  }
+  ProgramFlow flow;
+  Amount call_delivered = 0;
+  Counter128 offered = cur.offered;
+  if (!lossy) {
+    // The largest total in [admitted, admitted + v] on the residual plus the policy's own load.
+    Amount admitted = 0;
+    for (const FlowRecord* r : before) {
+      if (r == nullptr) continue;
+      admitted += r->delivered;
     }
-    double need;
-    if (target_per_flow.has_value()) {
-      // When a per-flow target is specified (e.g., during rebalancing), cap by remaining per-flow target.
-      need = std::max(0.0, target - f->placed_flow);
-    } else if (eb_divisor > 0) {
-      // For EqualBalanced, request only the remaining deficit toward per-target for this flow.
-      need = std::max(0.0, per_target - f->placed_flow);
+    if (!created) W.release_records(before);
+    const std::optional<Amount> hi = v.has_value() ? std::optional<Amount>(admitted + *v) : std::nullopt;
+    flow = detail::lossless(view, available_capacity_reader(W), admitted, hi);
+    call_delivered = flow.admitted - admitted;
+  } else if (given != nullptr) {
+    flow = std::move(*given);
+    call_delivered = flow.delivered;
+    flow.source_drops += *v - flow.offered;
+    accumulate(offered, c128(*v), "offered");
+  } else {
+    std::vector<Amount> inject(k, 0);
+    if (rq.is_full_offer()) {
+      source_shares(view, *v, inject);
     } else {
-      // Default behavior uses the global target amount.
-      need = target;
-    }
-    const double request = std::min(need, volume);
-    Flow placed = fg.place(f->index, f->src, f->dst, f->dag, request, flow_placement_);
-    f->placed_flow += placed;
-    volume -= placed;
-    total_placed += placed;
-    ++iters;
-    // IP-like mode: perform a single augmentation over the current SPF DAG
-    if (shortest_path_) {
-      break;
-    }
-    // Track recent placements. For a pinned policy, arm the window only once every
-    // flow has been visited: with more bundles than the window, the early rounds of
-    // small per-flow placements must not starve the bundles not yet visited.
-    if (diminishing_returns_enabled_ &&
-        (!is_static || iters >= static_cast<int>(flows_.size()))) {
-      recent.push_back(placed);
-      if (static_cast<int>(recent.size()) > diminishing_returns_window_) recent.pop_front();
-      if (static_cast<int>(recent.size()) == diminishing_returns_window_) {
-        double sum_recent = 0.0; for (double x : recent) sum_recent += x;
-        const double threshold = std::max(kMinFlow, diminishing_returns_epsilon_frac_ * initial_request);
-        if (sum_recent < threshold) {
-          break; // graceful cutoff
-        }
-      }
+      source_offer_increments(view, cur.offered, *v, inject);
     }
-    if (placed < kMinFlow) {
-      ++no_progress; if (no_progress>=max_no_progress_iterations_) break;
+    flow = detail::lossy(view, available_capacity_reader(W), inject);
+    call_delivered = flow.delivered;
+    // The whole offer is sent: what no head receives (every remaining captured weight 0) is lost at
+    // the sources, outside every row.
+    flow.source_drops += *v - flow.offered;
+    accumulate(offered, c128(*v), "offered");
+  }
+  PendingPolicyUpdate s;
+  s.drafts.resize(n);
+  s.next_epoch.record_groups.assign(n, {});
+  // The by_tunnel amounts per entry, kept only when the program has tunnels (only they have rows).
+  const bool rows = !p.tunnels.empty();
+  std::vector<Counter128> assigned(rows ? n : 0);
+  std::vector<Amount> delivered(rows ? n : 0, 0);
+  std::vector<Counter128> dropped(rows ? n : 0);
+  std::vector<std::pair<EdgeId, Amount>> call_edge_drops;
+  for (std::size_t e = 0; e < n; ++e) {
+    const auto& entry = p.entries[e];
+    auto& f = flow.entries[e];
+    LiveFlow live;
+    live.source = entry.head;
+    live.route = view.route(e);
+    live.min_route_cost = view.min_route_cost(e);
+    live.entry_id = entry.entry_id;
+    if (!created) {
+      live.record_counter = cur.record_groups[e].front().record_counter;
+      s.drafts[e].record_counter = live.record_counter;
     } else {
-      no_progress = 0;
-    }
-    // A pinned policy neither grows its flow set nor reoptimizes: the pinned-ness
-    // guard is explicit, never inferred from flow-count arithmetic.
-    if (!is_static) {
-      if (is_equal_balanced(flow_placement_)) {
-        if (max_flow_count_.has_value()) {
-          // Bounded EB: add flows up to configured maximum.
-          if (static_cast<int>(flows_.size()) < *max_flow_count_) {
-            if (auto* nf = create_flow(fg, src, dst, flowClass, std::optional<double>(per_target))) q.push_back(nf->index);
-          }
-        } else {
-          // Unbounded EB: rely on a single flow to equalize over the DAG.
-          // Do not create additional flows implicitly.
-        }
-      } else {
-        if (target - f->placed_flow >= kMinFlow) {
-          if (!max_flow_count_ || static_cast<int>(flows_.size()) < *max_flow_count_) {
-            if (auto* nf = create_flow(fg, src, dst, flowClass, std::nullopt)) q.push_back(nf->index);
-          } else {
-            if (auto* rf = reoptimize_flow(fg, f->index, kMinFlow)) q.push_back(rf->index);
-          }
-        }
+      s.fresh.emplace_back(e, 0);
+    }
+    s.next_epoch.record_groups[e].push_back(live);
+    FlowRecord& r = s.drafts[e].record;
+    r.sources = {entry.head};
+    r.destinations = pe.allowed_destinations;
+    r.admission = pe.config.admission;
+    r.route = live.route;
+    r.min_route_cost = live.min_route_cost;
+    r.entry_id = entry.entry_id;
+    if (holds && entry.tunnel_position >= 0) {
+      const auto& t = p.tunnels[static_cast<std::size_t>(entry.tunnel_position)];
+      if (t.reserved_bandwidth != 0) {
+        const auto path = path_of(t);
+        r.edge_reservations.reserve(path.size());
+        for (EdgeId x : path) r.edge_reservations.emplace_back(x, t.reserved_bandwidth);
+        std::sort(r.edge_reservations.begin(), r.edge_reservations.end());
+      }
+    }
+    const FlowRecord* b = created ? nullptr : before[e];
+    if (!lossy) {
+      r.edge_flows = std::move(f.edge_flows);
+      r.delivered = f.delivered;
+      if (rows) {
+        assigned[e] = c128(f.delivered);
+        delivered[e] = f.delivered;
       }
+      continue;
+    }
+    r.edge_drops = plus(b != nullptr ? b->edge_drops : std::vector<std::pair<EdgeId, Counter128>> {}, f.edge_drops);
+    r.offered = b != nullptr ? b->offered.value_or(Counter128 {}) : Counter128 {};
+    accumulate(*r.offered, c128(f.assigned), "offered");
+    r.delivered = (b != nullptr ? b->delivered : 0) + f.delivered;
+    r.edge_flows = b != nullptr ? plus(b->edge_flows, f.edge_flows) : std::move(f.edge_flows);
+    call_edge_drops.insert(call_edge_drops.end(), f.edge_drops.begin(), f.edge_drops.end());
+    Counter128 drops;
+    for (const auto& [x, d] : r.edge_drops) accumulate(drops, d, "drops");
+    if (rows) {
+      assigned[e] = *r.offered;
+      delivered[e] = r.delivered;
+      dropped[e] = drops;
+    }
+  }
+  // The shares the heads lost themselves (Lossy): per view head, cumulative.
+  std::vector<std::pair<NodeId, Counter128>> lost;
+  if (lossy) {
+    s.next_epoch.source_drops_by_source = cur.source_drops_by_source.empty() ? std::vector<Counter128>(k) : cur.source_drops_by_source;
+    for (std::size_t h = 0; h < k; ++h) {
+      accumulate(s.next_epoch.source_drops_by_source[h], c128(flow.source_drops_by_source[h]), "offered");
+      if (!s.next_epoch.source_drops_by_source[h].is_zero()) lost.emplace_back(view.source(h), s.next_epoch.source_drops_by_source[h]);
+    }
+  }
+  const Counter128 requested = requested_after(cur, v);
+  PlacementResult& out = s.result;
+  out.call_delivered = call_delivered;
+  if (v.has_value()) out.call_undelivered = *v - call_delivered;
+  out.delivery_delta = call_delivered;
+  if (lossy) out.call_edge_drops = merged(std::move(call_edge_drops));
+  out.call_source_drops = flow.source_drops;
+  // No head reaches a destination (every entry failed): NO_ROUTE, the records kept per entry.
+  out.termination = k == 0 ? Termination::NoRoute : forwarding_termination(active, p.has_path(), lossy, v, call_delivered);
+  set_flags(out, before_program, view.program.get(), is<DistributedTE>(pe));
+  out.program = view.program;
+  if (plan) out.plan = *plan;
+  out.by_tunnel = tunnel_rows(view, assigned, delivered, dropped);
+  fill_state(pe, draft_records(s.drafts), requested, cur.infinite || !v.has_value(), offered, out, lost);
+  s.next_epoch.program = view.program;
+  s.next_epoch.plan = std::move(plan);
+  s.next_epoch.by_tunnel = out.by_tunnel;
+  s.next_epoch.requested = requested;
+  s.next_epoch.offered = offered;
+  s.next_epoch.prepared = true;
+  s.next_epoch.infinite = cur.infinite || !v.has_value();
+  return s;
+}
+
+// Pinned: forwarding its program as the policy replays it (place, evaluate, replace); no holds.
+PendingPolicyUpdate place_pinned(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                    const ForwardingProgram* before_program) {
+  return forward_entries(pe, cur, W, rq, before_program, pe.view, pe.can_forward, false, nullptr);
+}
+
+// T1's setup view U: the reservation baseline minus every hold, this policy's own holds released
+// (never above static capacity: R0 <= capacity and the own holds are part of S).
+std::vector<Amount> reservation_view(const PolicyEngine& pe, const LedgerTotals& totals) {
+  const auto r0 = totals.reservation_baseline;
+  const auto held = totals.held;
+  std::vector<Amount> U(r0.begin(), r0.end());
+  if (!held.empty()) {
+    for (std::size_t e = 0; e < U.size(); ++e) U[e] -= held[e];
+  }
+  for (const FlowRecord* r : current_records(pe)) {
+    for (const auto& [e, x] : r->edge_reservations) U[static_cast<std::size_t>(e)] += x;
+  }
+  return U;
+}
+
+// The design volume of a tunnel model's call: the explicit design, or the offer (nullopt:
+// unlimited; T1's is finite, checked by check_policy_arguments).
+std::optional<Amount> design_of(const PolicyCall& rq) noexcept { return rq.design.has_value() ? *rq.design : rq.offer; }
+
+// The plan of a T1 setup for the design D: the tunnel count, D, the heads' shares and the holds
+// of the up tunnels counted once each.
+TunnelPlan distributed_te_plan(const PolicyEngine& pe, Amount D, const ForwardingProgram* program) {
+  TunnelPlan plan;
+  plan.tunnels_per_head = std::get<DistributedTE>(pe.config.routing).tunnel_count.per_head;
+  plan.design_demand = D;
+  plan.design_by_head = design_by_head(pe.reachable_sources, D);
+  if (program != nullptr) {
+    for (const auto& t : program->tunnels()) plan.total_reserved_bandwidth += t.reserved_bandwidth;
+  }
+  return plan;
+}
+
+// The tunnel models' forward(): the installed program forwarded with its plan (and the call's
+// black holes), records per program entry, T1's holds kept.
+PendingPolicyUpdate forward_tunnels(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                       const ForwardingProgram* before_program) {
+  const ForwardingView view = make_forwarding_view(*pe.graph, pe.epoch.program, nullptr, pe.allowed_destinations, rq.black_holes, true);
+  return forward_entries(pe, cur, W, rq, before_program, view, view_active(view), is<DistributedTE>(pe), pe.epoch.plan);
+}
+
+// T1: replace and evaluate set up the tunnels for the design on the unreserved view and forward
+// the new program, one record per entry.
+PendingPolicyUpdate apply_distributed_te_call(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                const ForwardingProgram* before_program) {
+  const auto& g = *pe.graph;
+  const Amount D = *design_of(rq);
+  const auto& ca = std::get<DistributedTE>(pe.config.routing);
+  auto tunnels = setup_distributed_te_tunnels(g, pe.eligibility, pe.reachable_sources, pe.allowed_destinations, ca, pe.c0, D, reservation_view(pe, totals_of(pe, rq)));
+  const auto program = distributed_te_program(g, pe.sources, pe.destinations, pe.reachable_sources, std::move(tunnels),
+                                      pe.excluded_nodes, pe.excluded_edges);
+  const ForwardingView view = make_forwarding_view(g, program, nullptr, pe.allowed_destinations, nullptr, true);
+  return forward_entries(pe, cur, W, rq, before_program, view, view_active(view), true,
+                         std::make_shared<const TunnelPlan>(distributed_te_plan(pe, D, program.get())));
+}
+
+// The plan of a T2 layout (zeros without a tunnel) for the design D (nullopt: unlimited), with its
+// K tunnels and its program's forwarding bound F.
+TunnelPlan t2_plan(const PolicyEngine& pe, std::optional<Amount> D, const T2Layout& lay, std::size_t K, Amount F) {
+  TunnelPlan plan;
+  plan.tunnels_per_head = lay.count;
+  plan.design_demand = D;
+  if (D.has_value()) plan.design_by_head = design_by_head(pe.reachable_sources, *D);
+  plan.heads_with_capacity = lay.live;
+  plan.insufficient_resolution = !lay.live.empty() && lay.common == 0;
+  plan.max_fractional_bandwidth_per_tunnel = std::pair<Amount, Amount> {lay.fluid_num, lay.fluid_den};
+  plan.max_bandwidth_per_tunnel = lay.common;
+  plan.planned_bandwidth_per_tunnel = lay.planned;
+  plan.total_planned_bandwidth = static_cast<Amount>(K) * lay.planned;
+  plan.total_tunnel_cost = lay.route_cost;
+  if (std::get<CentralizedTE>(pe.config.routing).prefer_headroom) plan.headroom_penalty = lay.headroom_penalty;
+  plan.max_lossless_offer = F;
+  return plan;
+}
+
+// T2: replace and evaluate lay out the tunnels for the design on the released residual and
+// forward the new program, one record per entry; the plan's forwarding bound is the program's
+// lossless maximum on that view.
+PendingPolicyUpdate place_t2(const PolicyEngine& pe, const PolicyEpoch& cur, ServiceCapacityWorkspace& W, const PolicyCall& rq,
+                const ForwardingProgram* before_program) {
+  const auto& g = *pe.graph;
+  const std::optional<Amount> D = design_of(rq);
+  std::vector<Amount> V;
+  W.dense(V);
+  const auto& gl = std::get<CentralizedTE>(pe.config.routing);
+  auto lay = t2_layout(g, pe.eligibility, pe.reachable_sources, pe.allowed_destinations, *gl.tunnel_count, gl.prefer_headroom, D, V);
+  const auto program = distributed_te_program(g, pe.sources, pe.destinations, pe.reachable_sources, std::move(lay.tunnels),
+                                      pe.excluded_nodes, pe.excluded_edges);
+  const ForwardingView view = make_forwarding_view(g, program, nullptr, pe.allowed_destinations, nullptr, true);
+  const Amount F = detail::lossless(view, available_capacity_reader(W), 0, std::nullopt).admitted;
+  return forward_entries(pe, cur, W, rq, before_program, view, view_active(view), false,
+                         std::make_shared<const TunnelPlan>(t2_plan(pe, D, lay, program->tunnels().size(), F)));
+}
+
+// The view forward() forwards a computing model's installed program on (its roster, the call's
+// black holes).
+ForwardingView installed_view(const PolicyEngine& pe, const PolicyCall& rq) {
+  return make_forwarding_view(*pe.graph, pe.epoch.program, nullptr, pe.allowed_destinations, rq.black_holes);
+}
+
+// A SIMULTANEOUS ShortestPaths replace (EQUAL or WEIGHTED): its program prepared on the list's view,
+// its per-source flows (routes and costs, new ids) and the program installed before, for the flags.
+struct PreparedReplace {
+  std::shared_ptr<const ForwardingProgram> program {};
+  std::vector<LiveFlow> flows {};
+  const ForwardingProgram* before {nullptr};
+};
+
+// A forwarding of a computing model's program as `view` (its roster) sees it, finished into records
+// per roster source: forward() of the installed program, or (`replaced`) a SIMULTANEOUS ShortestPaths
+// replace of its newly prepared one (its routes and costs, its flags, its termination).
+PendingPolicyUpdate finish_by_source(const PolicyEngine& pe, const PolicyCall& rq, const ForwardingView& view, ProgramFlow& flow,
+                                     const PreparedReplace* replaced) {
+  const auto& g = *pe.graph;
+  const auto v = rq.offer;
+  const auto& program = replaced != nullptr ? replaced->program : pe.epoch.program;
+  const ProgramData& p = *view.data;
+  const std::size_t k = pe.reachable_sources.size();
+  const std::size_t n = p.entries.size();
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  PendingPolicyUpdate s;
+  s.next_epoch = fresh_epoch(pe, replaced == nullptr);
+  s.next_epoch.program = program;
+  std::vector<LiveFlow> flows(k);
+  // Per roster source: its entries' carried, drops and deliveries summed (the view's heads are the
+  // roster: nothing is replayed).
+  std::vector<std::vector<std::pair<EdgeId, Amount>>> carried(k);
+  std::vector<std::vector<std::pair<EdgeId, Amount>>> drops(k);
+  std::vector<Amount> got(k, 0);
+  for (std::size_t e = 0; e < n; ++e) {
+    const auto slot = static_cast<std::size_t>(p.entries[e].roster_index);
+    const auto& f = flow.entries[e];
+    carried[slot].insert(carried[slot].end(), f.edge_flows.begin(), f.edge_flows.end());
+    drops[slot].insert(drops[slot].end(), f.edge_drops.begin(), f.edge_drops.end());
+    got[slot] += f.delivered;
+  }
+  for (std::size_t i = 0; i < k; ++i) {
+    flows[i] = replaced != nullptr ? replaced->flows[i] : pe.epoch.record_groups[i].front();
+    flows[i].record_counter = -1;
+    carried[i] = merged(std::move(carried[i]));
+    drops[i] = merged(std::move(drops[i]));
+    if (is<CentralizedTE>(pe)) {
+      // CentralizedTE's record route is the edges its share uses.
+      std::vector<EdgeId> route;
+      route.reserve(carried[i].size());
+      for (const auto& [e, x] : carried[i]) route.push_back(e);
+      flows[i].route = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(g, route));
+      flows[i].min_route_cost = route.empty() ? kUnreachable : min_route_cost(g, *flows[i].route, pe.reachable_sources[i], pe.allowed_destinations);
+    }
+  }
+  source_drafts(pe, flows, s);
+  std::vector<std::pair<EdgeId, Amount>> call_edge_drops;
+  for (std::size_t i = 0; i < k; ++i) {
+    FlowRecord& r = s.drafts[i].record;
+    r.edge_flows = carried[i];
+    r.delivered = got[i];
+    if (!lossy) continue;
+    r.edge_drops = plus(std::vector<std::pair<EdgeId, Counter128>> {}, drops[i]);
+    r.offered = c128(flow.offered_by_source[i]);
+    call_edge_drops.insert(call_edge_drops.end(), drops[i].begin(), drops[i].end());
+  }
+  std::vector<Counter128> assigned(n);
+  std::vector<Amount> delivered(n, 0);
+  std::vector<Counter128> dropped(n);
+  for (std::size_t e = 0; e < n; ++e) {
+    const auto& f = flow.entries[e];
+    assigned[e] = c128(lossy ? f.assigned : f.delivered);
+    delivered[e] = f.delivered;
+    for (const auto& [x, d] : f.edge_drops) accumulate(dropped[e], c128(d), "drops");
+  }
+  const Counter128 requested = v.has_value() ? c128(*v) : Counter128 {};
+  const Counter128 offered = lossy ? c128(flow.offered) : Counter128 {};
+  PlacementResult& out = s.result;
+  out.call_delivered = lossy ? flow.delivered : flow.admitted;
+  if (v.has_value()) out.call_undelivered = *v - out.call_delivered;
+  out.call_edge_drops = merged(std::move(call_edge_drops));
+  out.call_source_drops = flow.source_drops;
+  bool active = false;
+  for (std::size_t h = 0; h < view.num_sources() && !active; ++h) {
+    for (const std::int32_t e : view.entries_for_source(h)) active = active || p.entries[static_cast<std::size_t>(e)].weight > 0;
+  }
+  if (p.pools_source_inflows) active = !view.prepared_route(0)->forwarding_edges.empty();
+  out.termination = forwarding_termination(active, p.has_path(), lossy, v, out.call_delivered);
+  if (replaced != nullptr) {
+    // A replace's own rule (place_pooled's): no member, no active weight; else the Lossy offer
+    // is sent whole.
+    out.termination = view.prepared_route(0)->forwarding_edges.empty() ? Termination::NoActiveWeight : Termination::Complete;
+    set_flags(out, replaced->before, program.get(), false);
+  }
+  out.program = program;
+  out.by_tunnel = tunnel_rows(view, assigned, delivered, dropped);
+  const auto after = draft_records(s.drafts);
+  fill_state(pe, after, requested, !v.has_value(), offered, out);
+  if (uses_optimized_flow(pe)) out.total_cost = total_cost_of(g, after);
+  s.next_epoch.by_tunnel = out.by_tunnel;
+  s.next_epoch.requested = requested;
+  s.next_epoch.offered = offered;
+  s.next_epoch.prepared = true;
+  s.next_epoch.infinite = !v.has_value();
+  return s;
+}
+
+// forward(): a computing model's installed program forwarded with no route computation, on the
+// released view, records per roster source (ShortestPaths and CentralizedTE).
+PendingPolicyUpdate forward_installed(const PolicyEngine& pe, ServiceCapacityWorkspace& W, const PolicyCall& rq) {
+  const auto v = rq.offer;
+  const ForwardingView view = installed_view(pe, rq);
+  ProgramFlow flow;
+  if (pe.config.admission != Admission::Lossy) {
+    flow = detail::lossless(view, available_capacity_reader(W), 0, v);
+  } else {
+    std::vector<Amount> inject(pe.reachable_sources.size(), 0);
+    source_shares(view, *v, inject);
+    flow = detail::lossy(view, available_capacity_reader(W), inject);
+  }
+  return finish_by_source(pe, rq, view, flow, nullptr);
+}
+
+// ---------------------------------------------------------------- construction
+
+} // namespace
+
+const char* model_name(const Routing& r) noexcept {
+  if (std::holds_alternative<ShortestPaths>(r)) return "ShortestPaths";
+  if (is_t2(r)) return "CentralizedTE with tunnel_count";
+  if (std::holds_alternative<CentralizedTE>(r)) return "CentralizedTE";
+  if (std::holds_alternative<DistributedTE>(r)) return "DistributedTE";
+  return "Pinned";
+}
+
+const char* model_class(const Routing& r) noexcept {
+  if (std::holds_alternative<ShortestPaths>(r)) return "ShortestPaths";
+  if (std::holds_alternative<CentralizedTE>(r)) return "CentralizedTE";
+  if (std::holds_alternative<DistributedTE>(r)) return "DistributedTE";
+  return "Pinned";
+}
+
+namespace {
+
+// T2's several-sources rule: OPTIMIZED with one input source is the equal calculation; with several
+// it would be another (strongly NP-hard) problem.
+void check_t2_sources(const Routing& r, std::size_t num_sources) {
+  const auto* gl = std::get_if<CentralizedTE>(&r);
+  if (gl != nullptr && gl->tunnel_count.has_value() && num_sources > 1 && gl->source_allocation == SourceAllocation::Optimized) {
+    invalid("CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL");
+  }
+}
+
+// The pooled single-path rule: a bottleneck choice would differ per source at a shared router.
+void check_pooled_single_path(const Routing& r, std::size_t num_sources) {
+  const auto* sp = std::get_if<ShortestPaths>(&r);
+  if (sp != nullptr && num_sources > 1 && !sp->multipath && detail::RouteChoice {sp->tie_break}.prefers_score()) {
+    invalid("ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False");
+  }
+}
+
+} // namespace
+
+void check_config(const FlowPolicyConfig& config, bool cache, std::int32_t num_nodes, std::int32_t num_edges, std::optional<std::size_t> num_sources) {
+  const auto& r = config.routing;
+  if (r.valueless_by_exception()) invalid("routing: the variant holds no routing mode");
+  // The enumeration values.
+  check_member(config.admission, "admission");
+  const auto* sp = std::get_if<ShortestPaths>(&r);
+  const auto* gl = std::get_if<CentralizedTE>(&r);
+  const auto* t1 = std::get_if<DistributedTE>(&r);
+  if (sp != nullptr) {
+    check_member(sp->allocation, "allocation");
+    if (sp->source_allocation.has_value()) check_member(*sp->source_allocation, "source_allocation");
+    if (sp->weight_basis.has_value()) check_member(*sp->weight_basis, "weight_basis");
+    check_member(sp->tie_break, "tie_break");
+  }
+  if (gl != nullptr) check_member(gl->source_allocation, "source_allocation");
+  if (t1 != nullptr) check_member(t1->tie_break, "tie_break");
+  const bool t2 = is_t2(r);
+  const bool lossy = config.admission == Admission::Lossy;
+  // The model matrix in its order: route and source allocation, admission, the route-choice
+  // controls, prefer_headroom, the weight combinations, then a cache on a model that does not read it.
+  if ((sp != nullptr && sp->source_allocation == SourceAllocation::Weighted) ||
+      (gl != nullptr && t2 && gl->source_allocation == SourceAllocation::Weighted)) {
+    invalid("source_allocation=WEIGHTED requires CentralizedTE without tunnel_count");
+  }
+  if (sp != nullptr) {
+    const bool optimized = sp->allocation == RouteAllocation::Optimized;
+    if (!optimized && sp->source_allocation == SourceAllocation::Optimized) {
+      invalid("ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL");
     }
-    if (iters >= max_total_iterations_) break;
+    if (optimized && lossy) invalid("ShortestPaths OPTIMIZED requires admission=LOSSLESS");
+    if (detail::RouteChoice {sp->tie_break, sp->multipath, sp->parallel_edges}.tie_is_ineffective()) {
+      invalid("ShortestPaths tie_break requires multipath=False or parallel_edges=False");
+    }
+    if (num_sources.has_value()) check_pooled_single_path(r, *num_sources);
+    const bool weighted = sp->allocation == RouteAllocation::Weighted;
+    if (sp->weight_basis.has_value() && !weighted) invalid("weight_basis requires allocation=WEIGHTED");
+    if (sp->weight_basis == WeightBasis::Explicit && !sp->edge_weights) invalid("weight_basis=EXPLICIT requires edge_weights");
+    if (sp->edge_weights && sp->weight_basis != WeightBasis::Explicit) invalid("edge_weights require weight_basis=EXPLICIT");
+  }
+  if (gl != nullptr) {
+    if (num_sources.has_value()) check_t2_sources(r, *num_sources);
+    if (!t2 && lossy) invalid("CentralizedTE without tunnel_count requires admission=LOSSLESS");
+    if (gl->prefer_headroom && !t2) invalid("prefer_headroom requires tunnel_count");
+    if (gl->source_allocation == SourceAllocation::Weighted && !gl->source_weights) invalid("source_allocation=WEIGHTED requires source_weights");
+    if (gl->source_allocation != SourceAllocation::Weighted && gl->source_weights) invalid("source_weights require source_allocation=WEIGHTED");
   }
+  if (cache && sp == nullptr) invalid(std::string(model_class(r)) + " does not use ShortestPathCache");
+  // Then the tunnel count, an "up to" count for DistributedTE, the ceilings, the search minimum and
+  // edge_weights' length and entries (they need the graph).
+  if (t2 && (gl->tunnel_count->per_head < 1 || gl->tunnel_count->per_head > kMaxTunnelCount)) invalid("tunnel count must be in [1, 10000]");
+  if (t1 != nullptr) {
+    if (t1->tunnel_count.per_head < 1 || t1->tunnel_count.per_head > kMaxTunnelCount) invalid("tunnel count must be in [1, 10000]");
+    if (t1->tunnel_count.up_to) invalid("DistributedTE requires an exact tunnel count");
+    check_ceiling(t1->cost_ceiling);
+    if (t1->min_unreserved_bandwidth < 0 || t1->min_unreserved_bandwidth >= kDomainLimit) {
+      invalid("min_unreserved_bandwidth must be an integer in [0, 2^62)");
+    }
+  }
+  if (sp != nullptr && sp->allocation == RouteAllocation::Weighted && sp->edge_weights) {
+    const auto& w = *sp->edge_weights;
+    if (w.size() != static_cast<std::size_t>(num_edges)) invalid("edge_weights: expected " + str(num_edges) + " entries");
+    for (std::size_t e = 0; e < w.size(); ++e) {
+      if (w[e] < 0 || w[e] >= kDomainLimit) invalid("edge_weights[" + std::to_string(e) + "] must be an integer in [0, 2^62)");
+    }
+  }
+  if (gl != nullptr && gl->source_weights) {
+    const auto& w = *gl->source_weights;
+    if (w.size() != static_cast<std::size_t>(num_nodes)) invalid("source_weights: expected " + str(num_nodes) + " entries");
+    for (std::size_t i = 0; i < w.size(); ++i) {
+      if (w[i] < 0 || w[i] >= kDomainLimit) invalid("source_weights[" + std::to_string(i) + "] must be an integer in [0, 2^62)");
+    }
+  }
+}
 
-  // Reoptimize all flows after placement if enabled (no-op for pinned policies:
-  // reoptimize_flow returns immediately when static paths are configured).
-  if (reoptimize_flows_on_each_placement_) {
-    for (auto& kv : flows_) {
-      (void)reoptimize_flow(fg, kv.first, kMinFlow);
+void check_source_count(const FlowPolicyConfig& config, std::size_t num_sources) {
+  check_pooled_single_path(config.routing, num_sources);
+  check_t2_sources(config.routing, num_sources);
+}
+
+FlowPolicyConfig resolved_config(FlowPolicyConfig config) {
+  if (auto* sp = std::get_if<ShortestPaths>(&config.routing)) {
+    if (!sp->source_allocation.has_value()) {
+      sp->source_allocation = sp->allocation == RouteAllocation::Optimized ? SourceAllocation::Optimized : SourceAllocation::Equal;
     }
+    if (sp->allocation == RouteAllocation::Weighted && !sp->weight_basis.has_value()) sp->weight_basis = WeightBasis::Capacity;
   }
-  return { total_placed, volume };
+  return config;
 }
 
-/* Rebalance existing placed demand such that each flow carries approximately
-   `target_per_flow`. Internally removes and re-places the same total volume. */
-std::pair<double,double> FlowPolicy::rebalance_demand(FlowGraph& fg,
-                                                      NodeId src, NodeId dst,
-                                                      FlowClass flowClass,
-                                                      double target_per_flow) {
-  // Must run before remove_demand() empties flows_, or the check inside
-  // place_demand() would have nothing left to compare against and would
-  // silently retarget this policy's volume onto a different node pair.
-  check_demand_target(fg, src, dst, "rebalance_demand");
-  double vol = placed_demand();
-  remove_demand(fg);
-  return place_demand(fg, src, dst, flowClass, vol, target_per_flow, std::nullopt);
+std::optional<SourceAllocation> source_allocation_of(const Routing& r) noexcept {
+  if (const auto* sp = std::get_if<ShortestPaths>(&r)) {
+    return sp->source_allocation.value_or(sp->allocation == RouteAllocation::Optimized ? SourceAllocation::Optimized
+                                                                                          : SourceAllocation::Equal);
+  }
+  if (const auto* gl = std::get_if<CentralizedTE>(&r)) return gl->source_allocation;
+  if (std::holds_alternative<DistributedTE>(r)) return SourceAllocation::Equal;
+  return std::nullopt;
 }
 
-/* Remove all placed flows for this policy from the FlowGraph and reset
-   per-flow placed volumes. */
-void FlowPolicy::remove_demand(FlowGraph& fg) {
-  for (auto const& kv : flows_) {
-    fg.remove(kv.first);
+void check_tunnel_limit(const FlowPolicyConfig& cfg, std::size_t num_heads) {
+  const auto* t1 = std::get_if<DistributedTE>(&cfg.routing);
+  const auto* gl = std::get_if<CentralizedTE>(&cfg.routing);
+  if (t1 == nullptr && (gl == nullptr || !gl->tunnel_count.has_value())) return;
+  // The count (the largest for "up to") is in [1, 10000] (check_config) and H < 2^31: the
+  // product fits 64 bits.
+  const std::int64_t count = t1 != nullptr ? t1->tunnel_count.per_head : gl->tunnel_count->per_head;
+  const auto heads = static_cast<std::int64_t>(num_heads);
+  if (heads * count > kMaxTunnels) {
+    invalid("tunnel limit exceeded: " + str(heads) + " heads x " + str(count) + " tunnels > " + str(kMaxTunnels));
   }
-  flows_.clear();
-  best_path_cost_ = std::numeric_limits<Cost>::max();
 }
 
+} // namespace detail
+
+// ================================================================ FlowPolicy
+
+using detail::LedgerAccess;
+using detail::PolicyEngine;
+
 namespace {
 
-/* Validate one pinned bundle against the graph, prune it against the policy's
-   masks, and compute its post-prune min cost. Throws std::invalid_argument on a
-   malformed bundle; returns nullopt for a structurally valid bundle that has no
-   surviving src->dst walk under the masks (a DOWN LSP). */
-std::optional<std::pair<PredDAG, Cost>>
-prepare_static_bundle(const StrictMultiDiGraph& g, const PredDAG& dag,
-                      NodeId src, NodeId dst,
-                      std::span<const bool> node_mask,
-                      std::span<const bool> edge_mask) {
-  const auto N = static_cast<std::size_t>(g.num_nodes());
-  const auto E = static_cast<std::size_t>(g.num_edges());
-  const auto& off = dag.parent_offsets;
-  const auto& par = dag.parents;
-  const auto& via = dag.via_edges;
-
-  // Shape: CSR offsets over N nodes, entry arrays sized by the final offset.
-  if (off.size() != N + 1 || off.front() != 0) {
-    throw std::invalid_argument("static path bundle: parent_offsets must have length num_nodes + 1 and start at 0");
-  }
-  for (std::size_t v = 0; v + 1 < off.size(); ++v) {
-    if (off[v] > off[v + 1]) {
-      throw std::invalid_argument("static path bundle: parent_offsets must be non-decreasing");
-    }
-  }
-  const auto entries = static_cast<std::size_t>(off.back());
-  if (par.size() != entries || via.size() != entries) {
-    throw std::invalid_argument("static path bundle: parents/via_edges size must equal parent_offsets.back()");
-  }
-
-  // Entries: ids in range, and each via edge must actually connect parent -> child
-  // in THIS graph. Without the endpoint check, a well-shaped DAG built for a
-  // different graph (or with shuffled edge ids) would silently place flow on
-  // arbitrary edges.
-  const auto esrc = g.edge_src_view();
-  const auto edst = g.edge_dst_view();
-  for (std::size_t v = 0; v < N; ++v) {
-    for (auto i = static_cast<std::size_t>(off[v]); i < static_cast<std::size_t>(off[v + 1]); ++i) {
-      const auto pnode = par[i];
-      const auto e = via[i];
-      if (pnode < 0 || static_cast<std::size_t>(pnode) >= N) {
-        throw std::invalid_argument("static path bundle: parent node id out of range");
+// The engine of a new policy, bound to its ledger as the last step. A supplied frozen cache's hit
+// is recorded in `tally`: the public constructor publishes it once construction has
+// succeeded, an evaluator once its whole call has.
+struct ConstructionInputs {
+  FlowPolicyConfig config;
+  std::vector<NodeId> sources, destinations, reachable_sources;
+  const Eligibility* eligibility {nullptr};
+  std::unique_ptr<const Eligibility> support_mask;
+  Cost c0 {0};
+};
+
+template<class Prepared>
+void prepare_arguments(Prepared& pe, const Graph& g, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const Eligibility* eligibility, const ShortestPathCache* cache,
+    const detail::TunnelRoster* roster = nullptr, detail::ArgumentWork search = nullptr) {
+  // The endpoints, then the ownership of the mask, the program, the support, the cache and the
+  // black holes, then the configuration.
+  pe.sources = detail::node_set(sources, g.num_nodes(), "sources");
+  pe.destinations = detail::node_set(destinations, g.num_nodes(), "destinations");
+  detail::check_disjoint(pe.sources, pe.destinations, "sources", "destinations");
+  if (eligibility != nullptr && eligibility->graph_uid() != g.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  const auto* pinned = std::get_if<Pinned>(&pe.config.routing);
+  const auto* global = std::get_if<CentralizedTE>(&pe.config.routing);
+  if (pinned != nullptr) {
+    if (!pinned->program) throw std::invalid_argument("Pinned requires a program");
+    if (pinned->program->graph_uid() != g.uid()) throw std::invalid_argument("program belongs to another graph");
+  }
+  if (global != nullptr && global->support && global->support->graph_uid() != g.uid()) {
+    throw std::invalid_argument("support belongs to another graph");
+  }
+  if (cache != nullptr && cache->graph_uid() != g.uid()) {
+    throw std::invalid_argument("foreign ShortestPathCache: bound to another graph");
+  }
+  if (pinned != nullptr && pinned->black_holes && pinned->black_holes->graph_uid() != g.uid()) {
+    throw std::invalid_argument("black_holes belongs to another graph");
+  }
+  pe.eligibility = eligibility;
+  detail::check_config(pe.config, cache != nullptr, g.num_nodes(), g.num_edges(), pe.sources.size());
+  // Only ShortestPaths has absent defaults to resolve. The other models keep
+  // their already-validated snapshot without moving the routing variant.
+  if (std::holds_alternative<ShortestPaths>(pe.config.routing)) {
+    pe.config = detail::resolved_config(std::move(pe.config));
+  }
+  if (pinned != nullptr) {
+    const auto& prog = *pinned->program;
+    if (!std::equal(prog.sources().begin(), prog.sources().end(), pe.sources.begin(), pe.sources.end()) ||
+        !std::equal(prog.destinations().begin(), prog.destinations().end(), pe.destinations.begin(), pe.destinations.end())) {
+      throw std::invalid_argument("program endpoints do not match policy endpoints");
+    }
+  }
+  if (std::holds_alternative<DistributedTE>(pe.config.routing) || (global != nullptr && global->tunnel_count.has_value())) {
+    auto work = [&] {
+      if (global != nullptr && global->support && global->tunnel_count.has_value()) {
+        // T2 on a support: the support's edges intersected with the mask are the allowed links of every
+        // step (roster, sizing, objectives, decomposition, the programs' replay basis).
+        std::vector<NodeId> xn;
+        std::vector<EdgeId> xe;
+        const auto kept = detail::PredecessorDAGBuilder::ascending(*global->support);
+        for (NodeId v = 0; v < g.num_nodes(); ++v) {
+          if (eligibility != nullptr && !eligibility->allows_node(v)) xn.push_back(v);
+        }
+        for (EdgeId e = 0; e < g.num_edges(); ++e) {
+          const bool in_support = std::binary_search(kept.begin(), kept.end(), e);
+          if (!in_support || (eligibility != nullptr && !eligibility->allows_edge(e))) xe.push_back(e);
+        }
+        pe.support_mask = std::make_unique<const Eligibility>(g.eligibility(xn, xe));
+        eligibility = pe.support_mask.get();
+        pe.eligibility = eligibility;
       }
-      if (e < 0 || static_cast<std::size_t>(e) >= E) {
-        throw std::invalid_argument("static path bundle: via edge id out of range");
+      // The tunnel count's roster is immutable. Validate it in the argument pass, without
+      // consulting a cache or ledger state; retain the roster for native construction.
+      {
+        if (roster != nullptr) {
+          pe.reachable_sources = roster->heads;
+          pe.c0 = roster->c0;
+        } else {
+          std::vector<NodeId> allowed;
+          for (NodeId d : pe.destinations) if (eligibility == nullptr || eligibility->allows_node(d)) allowed.push_back(d);
+          detail::concurrent_event(detail::ConcurrentStage::TunnelRosterSearch, &g);
+          const auto dist = detail::static_costs(g, eligibility, allowed, pe.sources);
+          pe.c0 = kUnreachable;
+          for (std::size_t i = 0; i < pe.sources.size(); ++i) {
+            if ((eligibility == nullptr || eligibility->allows_node(pe.sources[i])) && dist[i] != kUnreachable) {
+              pe.reachable_sources.push_back(pe.sources[i]);
+              pe.c0 = std::min(pe.c0, dist[i]);
+            }
+          }
+          detail::check_tunnel_limit(pe.config, pe.reachable_sources.size());
+        }
       }
-      if (esrc[static_cast<std::size_t>(e)] != pnode ||
-          edst[static_cast<std::size_t>(e)] != static_cast<NodeId>(v)) {
-        throw std::invalid_argument(
-            "static path bundle: via edge does not connect its parent to its node in "
-            "this graph (bundle built for a different graph?)");
+    };
+    if (search != nullptr) {
+      search([](void* context) { (*static_cast<decltype(work)*>(context))(); }, &work);
+    } else work();
+  }
+}
+
+std::unique_ptr<PolicyEngine> finish_engine(std::unique_ptr<PolicyEngine> pe, ShortestPathCache* cache,
+                                           detail::FrozenCacheHitTally& tally) {
+  auto& ledger = pe->ledger;
+  (void)LedgerAccess::baseline(ledger);  // mutable usability, after all immutable checks
+  const auto& g = *pe->graph;
+  auto* eligibility = pe->eligibility;
+  const auto* pinned = std::get_if<Pinned>(&pe->config.routing);
+  const auto* global = std::get_if<CentralizedTE>(&pe->config.routing);
+  if (const auto* sp = std::get_if<ShortestPaths>(&pe->config.routing)) {
+    pe->route_choice = detail::RouteChoice {sp->tie_break, sp->multipath, sp->parallel_edges};
+  } else if (const auto* ca = std::get_if<DistributedTE>(&pe->config.routing)) {
+    pe->route_choice = detail::RouteChoice {ca->tie_break, false, ca->parallel_edges};
+  }
+  if (const auto s = detail::source_allocation_of(pe->config.routing)) pe->source_allocation = *s;
+  auto node_allowed = [&](NodeId v) { return eligibility == nullptr || eligibility->allows_node(v); };
+  for (NodeId d : pe->destinations) {
+    if (node_allowed(d)) pe->allowed_destinations.push_back(d);
+  }
+  if (pinned != nullptr) {
+    // The program as this policy forwards it: replayed under the mask, the black holes laid over.
+    pe->view = detail::make_forwarding_view(g, pinned->program, eligibility, pe->allowed_destinations, pinned->black_holes.get(), true);
+    for (std::size_t h = 0; h < pe->view.num_sources(); ++h) pe->reachable_sources.push_back(pe->view.source(h));
+    pe->can_forward = detail::view_active(pe->view);
+    pe->epoch.record_groups.resize(detail::ProgramAccess::data(*pinned->program).entries.size());
+    pe->policy_id = LedgerAccess::bind(ledger);
+    return pe;
+  }
+  if (detail::is<ShortestPaths>(*pe)) {
+    pe->support = cache != nullptr
+                      ? detail::DagCacheAccess::lookup(*cache, g, pe->destinations, Direction::Reverse, eligibility, tally)
+                      : std::make_shared<const PredecessorDAG>(detail::static_support(g, pe->destinations, Direction::Reverse, eligibility));
+    const auto edges = detail::PredecessorDAGBuilder::ascending(*pe->support);
+    const auto row = g.outgoing_offsets();
+    for (NodeId s : pe->sources) {
+      if (!node_allowed(s)) continue;
+      const auto it = std::lower_bound(edges.begin(), edges.end(), row[static_cast<std::size_t>(s)]);
+      if (it != edges.end() && *it < row[static_cast<std::size_t>(s) + 1]) pe->reachable_sources.push_back(s);
+    }
+  } else if (global != nullptr && global->support && !global->tunnel_count.has_value()) {
+    // The support trimmed to the walks from the sources to the allowed destinations under the mask;
+    // the roster is the sources that reach one inside it.
+    std::vector<EdgeId> trimmed;
+    for (NodeId s : pe->sources) {
+      if (!node_allowed(s)) continue;
+      auto part = detail::prune(g, *global->support, s, pe->allowed_destinations, eligibility);
+      if (part.empty()) continue;
+      pe->reachable_sources.push_back(s);
+      trimmed.insert(trimmed.end(), part.begin(), part.end());
+    }
+    std::sort(trimmed.begin(), trimmed.end());
+    trimmed.erase(std::unique(trimmed.begin(), trimmed.end()), trimmed.end());
+    pe->centralized_te_support = std::make_shared<const std::vector<EdgeId>>(std::move(trimmed));
+  } else {
+    // The static costs fix the roster (unrestricted CentralizedTE, T1 and T2); T1's CostStretch baseline c0
+    // is their minimum over the roster heads (zero-capacity edges included, before any filter).
+    if (!detail::tunnel_model(*pe)) {
+    const auto dist = detail::static_costs(g, eligibility, pe->allowed_destinations, pe->sources);
+    pe->c0 = kUnreachable;
+    for (std::size_t i = 0; i < pe->sources.size(); ++i) {
+      const NodeId s = pe->sources[i];
+      if (!node_allowed(s) || dist[i] == kUnreachable) continue;
+      pe->reachable_sources.push_back(s);
+      pe->c0 = std::min(pe->c0, dist[i]);
+    }
+    }
+    detail::check_tunnel_limit(pe->config, pe->reachable_sources.size());
+    if (eligibility != nullptr && eligibility->uid() != 0) {
+      // Its programs' replay basis: the topology under this mask.
+      for (NodeId v = 0; v < g.num_nodes(); ++v) {
+        if (!eligibility->allows_node(v)) pe->excluded_nodes.push_back(v);
+      }
+      for (EdgeId e = 0; e < g.num_edges(); ++e) {
+        if (!eligibility->allows_edge(e)) pe->excluded_edges.push_back(e);
       }
     }
   }
+  // The tunnel models' record_groups are per program entry, sized by their first call.
+  if (!detail::tunnel_model(*pe)) pe->epoch.record_groups.resize(pe->reachable_sources.size());
+  pe->policy_id = LedgerAccess::bind(ledger);  // last: nothing is bound when construction fails
+  return pe;
+}
+
+} // namespace
+
+std::optional<detail::TunnelRoster> detail::check_policy_construction(const Graph& graph, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, const FlowPolicyConfig& config,
+    const Eligibility* eligibility, const ShortestPathCache* cache, detail::ArgumentWork search) {
+  ConstructionInputs prepared {config, {}, {}, {}, nullptr, {}, 0};
+  prepare_arguments(prepared, graph, sources, destinations, eligibility, cache, nullptr, search);
+  const auto* global = std::get_if<CentralizedTE>(&config.routing);
+  if (std::holds_alternative<DistributedTE>(config.routing) || (global && global->tunnel_count.has_value())) {
+    return detail::TunnelRoster {std::move(prepared.reachable_sources), prepared.c0};
+  }
+  return std::nullopt;
+}
+
+std::unique_ptr<PolicyEngine> detail::PolicyAccess::prepare(FlowLedger& ledger, std::span<const NodeId> sources,
+    std::span<const NodeId> destinations, FlowPolicyConfig config, const Eligibility* eligibility, ShortestPathCache* cache, const detail::TunnelRoster* roster, detail::ArgumentWork search) {
+  auto pe = std::make_unique<PolicyEngine>(ledger, std::move(config));
+  pe->graph = LedgerAccess::graph(ledger);
+  prepare_arguments(*pe, *pe->graph, sources, destinations, eligibility, cache, roster, search);
+  if (const auto* sp = std::get_if<ShortestPaths>(&pe->config.routing)) {
+    pe->static_preparation = sp->allocation != RouteAllocation::Optimized &&
+        (sp->tie_break == RouteTieBreak::FewerHops || sp->tie_break == RouteTieBreak::HigherCapacity) &&
+        sp->weight_basis != WeightBasis::ResidualSnapshot;
+  }
+  return pe;
+}
+
+FlowPolicy::FlowPolicy() noexcept = default;
+std::unique_ptr<FlowPolicy> detail::PolicyAccess::shell() { return std::unique_ptr<FlowPolicy>(new FlowPolicy); }
+
+void detail::PolicyAccess::construct(FlowPolicy& policy, std::unique_ptr<PolicyEngine> prepared, ShortestPathCache* cache) {
+  (void)detail::frozen_call(cache, [&](detail::FrozenCacheHitTally& tally) {
+    const auto gate = LedgerAccess::lock(prepared->ledger);
+    policy.engine_ = finish_engine(std::move(prepared), cache, tally);
+    detail::publication_event(detail::ConcurrentStage::PolicyEngineInstalled, &policy);
+    policy.ready_.store(true, std::memory_order_release);
+    return true;
+  });
+}
+
+FlowPolicy::FlowPolicy(FlowLedger& ledger, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+                       FlowPolicyConfig config, const Eligibility* eligibility, ShortestPathCache* cache) {
+  auto prepared = detail::PolicyAccess::prepare(ledger, sources, destinations, std::move(config), eligibility, cache);
+  detail::PolicyAccess::construct(*this, std::move(prepared), cache);
+}
+
+FlowPolicy::FlowPolicy(FlowLedger& ledger, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+                       FlowPolicyConfig config, const Eligibility* eligibility, ShortestPathCache* cache, detail::FrozenCacheHitTally& tally, const detail::TunnelRoster* roster) {
+  auto prepared = detail::PolicyAccess::prepare(ledger, sources, destinations, std::move(config), eligibility, cache, roster);
+  const auto gate = LedgerAccess::lock(ledger);
+  engine_ = finish_engine(std::move(prepared), cache, tally);
+  detail::publication_event(detail::ConcurrentStage::PolicyEngineInstalled, this);
+  ready_.store(true, std::memory_order_release);
+}
+
+// The destruction law: the records stay in the ledger as orphans. A failed shell owns none.
+FlowPolicy::~FlowPolicy() noexcept { if (engine_) LedgerAccess::release(engine_->ledger, engine_->policy_id); }
+
+namespace detail {
+namespace {
+
+// The program a computing model installs for an empty roster: an empty one. Pinned never
+// comes here: its forwarding with no head is place_pinned's.
+std::shared_ptr<const ForwardingProgram> empty_roster_program(const PolicyEngine& pe) {
+  return empty_program(pe.graph->uid(), pe.sources, pe.destinations, uses_optimized_flow(pe) && pe.source_allocation != SourceAllocation::Equal);
+}
+
+// The current state of a zero call: its records, its program and rows, every flag false; before
+// the epoch's first preparation all zeros (no records, no program, no curve). A zero call solves
+// nothing, so it claims no cut.
+PlacementResult zero_state(const PolicyEngine& pe, const LedgerTotals* totals, const OutputOptions& outputs) {
+  PlacementResult out;
+  out.call_undelivered = 0;
+  const auto& ep = pe.epoch;
+  const auto records = current_records(pe);
+  std::vector<std::pair<NodeId, Counter128>> lost;
+  for (std::size_t h = 0; h < ep.source_drops_by_source.size(); ++h) {
+    if (!ep.source_drops_by_source[h].is_zero()) lost.emplace_back(pe.view.source(h), ep.source_drops_by_source[h]);
+  }
+  fill_state(pe, records, ep.requested, ep.infinite, ep.offered, out, lost);
+  if (uses_optimized_flow(pe)) out.total_cost = total_cost_of(*pe.graph, records);
+  if (is_unrestricted_centralized_te(pe) && pe.source_allocation == SourceAllocation::Optimized && ep.prepared && ep.marginal_cost_curve.has_value()) out.marginal_cost_curve = *ep.marginal_cost_curve;
+  out.program = ep.program;
+  out.by_tunnel = ep.by_tunnel;
+  prepare_outputs(pe, totals, outputs, records, out);
+  return out;
+}
+
+// A computing model's call when no source reaches an allowed destination (Pinned with no head
+// forwards through place_pinned, keeping its per-entry records): nothing is forwarded. A Lossy
+// offer is lost before it enters (the demand's source loss; no source's row has it). CentralizedTE's flow
+// is 0 and maximal: its curve is empty and its cut is empty (no roster source, so the closure is
+// empty).
+PendingPolicyUpdate empty_roster(const PolicyEngine& pe, const PolicyEpoch& cur, const PolicyCall& rq, const ForwardingProgram* before) {
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  const bool optimized_global = is_unrestricted_centralized_te(pe) && pe.source_allocation == SourceAllocation::Optimized;
+  const auto v = rq.offer;
+  PendingPolicyUpdate s;
+  s.next_epoch.record_groups.resize(cur.record_groups.size());
+  s.next_epoch.requested = requested_after(cur, v);
+  s.next_epoch.offered = cur.offered;
+  if (lossy && v.has_value()) (void)s.next_epoch.offered.add(*v);  // offered <= requested
+  s.next_epoch.prepared = true;
+  s.next_epoch.infinite = cur.infinite || !v.has_value();
+  s.next_epoch.program = cur.program ? cur.program : empty_roster_program(pe);
+  // The tunnel models: forward keeps the installed plan; a setup plans no head.
+  if (rq.operation == PolicyOperation::Forward) {
+    s.next_epoch.plan = cur.plan;
+  } else if (is<DistributedTE>(pe)) {
+    s.next_epoch.plan = std::make_shared<const TunnelPlan>(distributed_te_plan(pe, *design_of(rq), nullptr));
+  } else if (t2(pe)) {
+    T2Layout none;
+    none.count = std::get<CentralizedTE>(pe.config.routing).tunnel_count->up_to ? 1 : std::get<CentralizedTE>(pe.config.routing).tunnel_count->per_head;
+    s.next_epoch.plan = std::make_shared<const TunnelPlan>(t2_plan(pe, design_of(rq), none, 0, 0));
+  }
+  PlacementResult& out = s.result;
+  out.call_undelivered = v;
+  out.delivery_delta = 0;
+  out.termination = Termination::NoRoute;
+  if (lossy && v.has_value()) out.call_source_drops = *v;
+  set_flags(out, before, s.next_epoch.program.get(), is<DistributedTE>(pe));
+  out.program = s.next_epoch.program;
+  if (s.next_epoch.plan) out.plan = *s.next_epoch.plan;
+  fill_state(pe, {}, s.next_epoch.requested, s.next_epoch.infinite, s.next_epoch.offered, out);
+  if (uses_optimized_flow(pe)) out.total_cost = Counter128 {};
+  if (optimized_global) {
+    out.marginal_cost_curve.emplace();
+    if (rq.outputs != nullptr && rq.outputs->min_cut) out.min_cut.emplace();
+    s.next_epoch.marginal_cost_curve.emplace();
+  }
+  if (kTraced && rq.trace) rq.trace->set("roster", Trace::list());
+  return s;
+}
+
+} // namespace
+
+void check_place_operation(const PolicyEngine& pe) {
+  if (tunnel_model(pe)) invalid(std::string(model_name(pe.config.routing)) + " does not support incremental placement");
+}
+
+void check_forward_operation(const PolicyEngine& pe) {
+  if (is<Pinned>(pe)) invalid("Pinned forwards with replace");
+}
 
-  // Acyclicity (Kahn over parent -> child entries).
-  {
-    std::vector<int> indeg(N, 0);
-    for (std::size_t v = 0; v < N; ++v) {
-      indeg[v] = static_cast<int>(off[v + 1] - off[v]);
+void check_policy_offer(const PolicyEngine& pe, PolicyOperation operation, std::optional<Amount> offer) {
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  if (operation == PolicyOperation::Place) check_place_operation(pe);
+  if (operation == PolicyOperation::Forward) check_forward_operation(pe);
+  if (offer.has_value() && (*offer < 0 || *offer >= kDomainLimit)) {
+    invalid("offer must be an integer in [0, 2^62) or permitted +inf");
+  }
+  // A Lossy full offer is finite; ShortestPaths's place(+inf) is its first-hop experiment.
+  if (lossy && !offer.has_value() && ((operation != PolicyOperation::Place) || is<Pinned>(pe))) invalid("LOSSY forwarding requires a finite offer");
+}
+void check_policy_design_model(const PolicyEngine& pe) {
+  if (!tunnel_model(pe)) invalid(std::string(model_name(pe.config.routing)) + " does not accept design_demand");
+}
+
+void check_policy_arguments(const PolicyEngine& pe, PolicyOperation operation, std::optional<Amount> offer,
+    const std::optional<std::optional<Amount>>& design, const Eligibility* black_holes) {
+  const PolicyCall rq {operation, offer, design, black_holes};
+  check_policy_offer(pe, operation, offer);
+  const bool t1 = is<DistributedTE>(pe);
+  // The design demand: the tunnel models' alone, in its domain, T1's finite (absent: the offer).
+  if (rq.design.has_value()) {
+    check_policy_design_model(pe);
+    if (rq.design->has_value() && (**rq.design < 0 || **rq.design >= kDomainLimit)) {
+      invalid("design_demand must be an integer in [0, 2^62) or permitted +inf");
     }
-    std::vector<NodeId> stack;
-    stack.reserve(N);
-    for (std::size_t v = 0; v < N; ++v) {
-      if (indeg[v] == 0) stack.push_back(static_cast<NodeId>(v));
+  }
+  if (t1 && rq.operation != PolicyOperation::Forward && (rq.design.has_value() ? !rq.design->has_value() : !rq.offer.has_value())) {
+    invalid("DistributedTE requires a finite design demand");
+  }
+  if (rq.operation == PolicyOperation::Forward && rq.black_holes != nullptr && rq.black_holes->graph_uid() != pe.graph->uid()) {
+    invalid("black_holes belongs to another graph");
+  }
+}
+
+namespace {
+void check_call_state(const PolicyEngine& pe, const PolicyCall& rq) {
+  if (rq.operation == PolicyOperation::Forward && !pe.epoch.program) invalid("forward requires an installed program");
+  if (rq.operation == PolicyOperation::Place) {
+    if (pe.epoch.infinite && rq.offer.has_value()) invalid("finite placement after infinite placement requires a new epoch");
+    // The only check of the cumulative request: nothing changes the requested total between here
+    // and the call's publication, so the later additions repeat this sum and cannot fail.
+    if (rq.offer.has_value()) {
+      Counter128 probe = pe.epoch.requested;
+      if (!probe.add(*rq.offer)) invalid("requested limit exceeded");
     }
-    std::size_t seen = 0;
-    // Child adjacency: parent -> list of children, derived on the fly.
-    std::vector<std::vector<NodeId>> children(N);
-    for (std::size_t v = 0; v < N; ++v) {
-      for (auto i = static_cast<std::size_t>(off[v]); i < static_cast<std::size_t>(off[v + 1]); ++i) {
-        children[static_cast<std::size_t>(par[i])].push_back(static_cast<NodeId>(v));
+  }
+}
+
+// The computation of a call: nothing published. A full-offer call works on the residual with
+// the policy's own load released, from a fresh epoch.
+PendingPolicyUpdate compute(const PolicyEngine& pe, const PolicyCall& rq) {
+  const LedgerTotals totals = totals_of(pe, rq);
+  ServiceCapacityWorkspace W(totals);
+  if (rq.is_full_offer()) W.release_records(current_records(pe));
+  const PolicyEpoch fresh = rq.is_full_offer() ? fresh_epoch(pe, rq.operation == PolicyOperation::Forward) : PolicyEpoch {};
+  const PolicyEpoch& cur = rq.is_full_offer() ? fresh : pe.epoch;
+  // The flags compare the program the policy has installed now.
+  const ForwardingProgram* before = pe.epoch.program.get();
+  PendingPolicyUpdate s;
+  if (pe.reachable_sources.empty() && !is<Pinned>(pe)) {
+    // No roster source (a computing model): nothing is computed. A Pinned policy whose heads all
+    // fail keeps its per-entry records and forwards nothing (place_pinned).
+    s = empty_roster(pe, cur, rq, before);
+  } else if (tunnel_model(pe) && rq.operation == PolicyOperation::Forward) {
+    s = forward_tunnels(pe, cur, W, rq, before);
+  } else if (is<DistributedTE>(pe)) {
+    s = apply_distributed_te_call(pe, cur, W, rq, before);
+  } else if (t2(pe)) {
+    s = place_t2(pe, cur, W, rq, before);
+  } else if (rq.operation == PolicyOperation::Forward) {
+    s = forward_installed(pe, W, rq);
+  } else if (is<Pinned>(pe)) {
+    s = place_pinned(pe, cur, W, rq, before);
+  } else if (uses_optimized_flow(pe)) {
+    s = place_optimized_flow(pe, cur, W, rq, before);
+  } else {
+    s = place_pooled(pe, cur, W, rq, before);
+  }
+  // A full-offer call: its call_delivered is the whole new delivery, compared with the old one.
+  if (rq.is_full_offer()) {
+    Amount old = 0;
+    for (const FlowRecord* r : current_records(pe)) old += r->delivered;
+    s.result.call_delivered = s.result.delivered;
+    s.result.delivery_delta = s.result.delivered - old;
+    if (rq.offer.has_value()) s.result.call_undelivered = *rq.offer - s.result.call_delivered;
+  }
+  // The first termination row: a request of 0 is COMPLETE, also for a full-offer call, which
+  // still prepared and publishes what it computed.
+  if (rq.offer == Amount {0}) s.result.termination = Termination::Complete;
+  if (rq.outputs != nullptr && any_output(*rq.outputs)) prepare_outputs(pe, rq.totals, *rq.outputs, draft_records(s.drafts), s.result);
+  return s;
+}
+
+// Only publication acquires the retained owner. The program and its control block
+// already exist; these moves/owner copies cannot allocate or fail. evaluate never
+// reaches this step. Empty-roster programs keep their existing separate path.
+void publish_epoch(PolicyEngine& pe, PolicyEpoch&& epoch) noexcept {
+  if (pe.static_preparation && !pe.kept_program && !pe.reachable_sources.empty()) pe.kept_program = epoch.program;
+  pe.epoch = std::move(epoch);
+}
+
+// The publication: the ledger's one atomic exchange (a place commits every live record and the new
+// ones; a full-offer call retires the live ones and creates the new ones), then the epoch.
+void publish(PolicyEngine& pe, PendingPolicyUpdate& s, bool full) {
+  concurrent_event(ConcurrentStage::BeforePublication, &pe.ledger);
+  const auto ids = full ? LedgerAccess::exchange(pe.ledger, pe.policy_id, s.drafts) : LedgerAccess::commit(pe.ledger, pe.policy_id, s.drafts);
+  publication_event(ConcurrentStage::AfterLedgerExchange, &pe.ledger);
+  // Committed: the epoch state follows (nothing below throws).
+  for (std::size_t n = 0; n < s.fresh.size(); ++n) s.next_epoch.record_groups[s.fresh[n].first][s.fresh[n].second].record_counter = ids[n].second;
+  publish_epoch(pe, std::move(s.next_epoch));
+}
+
+// A publishing call: compute and finish every fallible result/trace step before
+// the ledger exchange. The gate remains held through the complete epoch update.
+PlacementResult run_call(PolicyEngine& pe, const PolicyCall& rq) {
+  check_policy_arguments(pe, rq.operation, rq.offer, rq.design, rq.black_holes);
+  const auto gate = LedgerAccess::lock(pe.ledger);
+  check_call_state(pe, rq);
+  if (rq.operation == PolicyOperation::Place && rq.offer.has_value() && *rq.offer == 0) {
+    PlacementResult out = zero_state(pe, rq.totals, *rq.outputs);
+    return out;
+  }
+  PendingPolicyUpdate s = compute(pe, rq);
+  PlacementResult out = std::move(s.result);
+  publish(pe, s, rq.is_full_offer());
+  return out;
+}
+
+// ================================================================ lists (apply_actions)
+
+// One action of a list, validated: its policy's engine and the scalar call it stands for.
+struct ListAction {
+  PolicyEngine* engine {nullptr};
+  PolicyCall call {};
+};
+
+// The list's validation, before anything is computed: the ledger, the mode, then each
+// action's argument/immutable checks in list order (ownership, the duplicate rule,
+// the SIMULTANEOUS rules, the scalar call's immutable checks). Mutable checks run
+// in list order under the gate, after this entire first pass succeeds.
+std::vector<ListAction> validate_list(FlowLedger& ledger, std::span<const Action> actions, BatchMode mode, const OutputOptions& outputs) {
+  switch (mode) {
+    case BatchMode::Ordered:
+    case BatchMode::Simultaneous: break;
+    default: not_a_member("mode", static_cast<int>(mode), "BatchMode");
+  }
+  std::vector<ListAction> out;
+  out.reserve(actions.size());
+  std::set<const FlowPolicy*> seen;
+  for (const Action& a : actions) {
+    ListAction x;
+    FlowPolicy* policy = nullptr;
+    std::visit(
+        [&](const auto& act) {
+          using T = std::decay_t<decltype(act)>;
+          policy = &act.policy.get();
+          x.call.offer = act.offer;
+          x.call.outputs = &outputs;
+          if constexpr (std::is_same_v<T, Place>) {
+            x.call.operation = PolicyOperation::Place;
+          } else if constexpr (std::is_same_v<T, Replace>) {
+            x.call.operation = PolicyOperation::Replace;
+            x.call.design = act.design_demand;
+          } else {
+            x.call.operation = PolicyOperation::Forward;
+            x.call.black_holes = act.black_holes;
+          }
+        },
+        a);
+    PolicyEngine& pe = PolicyAccess::engine(*policy);
+    x.engine = &pe;
+    if (&pe.ledger != &ledger) invalid("list policy belongs to another ledger");
+    if (!seen.insert(policy).second) invalid("duplicate policy in list");
+    if (mode == BatchMode::Simultaneous) {
+      if (x.call.operation == PolicyOperation::Place) invalid("SIMULTANEOUS does not accept Place");
+      if (x.call.operation == PolicyOperation::Replace && !is<Pinned>(pe) &&
+          !(is<ShortestPaths>(pe) && std::get<ShortestPaths>(pe.config.routing).allocation != RouteAllocation::Optimized)) {
+        invalid("SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned");
       }
+      if (pe.config.admission != Admission::Lossy) invalid("SIMULTANEOUS requires admission=LOSSY");
+      if (!x.call.offer.has_value()) invalid("SIMULTANEOUS requires finite offers");
     }
-    while (!stack.empty()) {
-      auto u = stack.back(); stack.pop_back();
-      ++seen;
-      for (auto v : children[static_cast<std::size_t>(u)]) {
-        if (--indeg[static_cast<std::size_t>(v)] == 0) stack.push_back(v);
-      }
+    check_policy_arguments(pe, x.call.operation, x.call.offer, x.call.design, x.call.black_holes);
+    out.push_back(x);
+  }
+  return out;
+}
+
+// The list's one publication: one atomic exchange of every publishing policy's records (new ids in
+// list order, then draft order), then their epochs (nothing after the exchange throws).
+void publish_list(FlowLedger& ledger, std::span<ListAction> list, std::span<PendingPolicyUpdate> pending, const std::vector<std::uint8_t>& publishes) {
+  std::vector<OwnerDrafts> owners;
+  std::vector<std::size_t> which;
+  for (std::size_t i = 0; i < list.size(); ++i) {
+    if (publishes[i] == 0) continue;
+    owners.push_back({list[i].engine->policy_id, pending[i].drafts, list[i].call.is_full_offer()});
+    which.push_back(i);
+  }
+  std::vector<std::vector<FlowId>> created(owners.size());
+  concurrent_event(ConcurrentStage::BeforePublication, &ledger);
+  LedgerAccess::commit_batch(ledger, owners, created);
+  publication_event(ConcurrentStage::AfterLedgerExchange, &ledger);
+  for (std::size_t k = 0; k < which.size(); ++k) {
+    PendingPolicyUpdate& s = pending[which[k]];
+    for (std::size_t n = 0; n < s.fresh.size(); ++n) s.next_epoch.record_groups[s.fresh[n].first][s.fresh[n].second].record_counter = created[k][n].second;
+    publish_epoch(*list[which[k]].engine, std::move(s.next_epoch));
+  }
+}
+
+// ORDERED: each action as its scalar call on the working totals the earlier ones left (their
+// carried loads and holds exchanged for the drafts), its outputs after it.
+std::vector<PlacementResult> run_ordered(FlowLedger& ledger, std::span<ListAction> list, const OutputOptions& outputs) {
+  const auto c = LedgerAccess::carried(ledger);
+  const auto h = LedgerAccess::reserved(ledger);
+  std::vector<Amount> carried(c.begin(), c.end());
+  std::vector<Amount> held(h.begin(), h.end());
+  LedgerTotals totals {LedgerAccess::baseline(ledger), carried, LedgerAccess::reservation_baseline(ledger), held};
+  std::vector<PendingPolicyUpdate> pending(list.size());
+  std::vector<std::uint8_t> publishes(list.size(), 0);
+  std::vector<PlacementResult> results(list.size());
+  for (std::size_t i = 0; i < list.size(); ++i) {
+    PolicyEngine& pe = *list[i].engine;
+    PolicyCall& rq = list[i].call;
+    rq.totals = &totals;
+    if (rq.operation == PolicyOperation::Place && rq.offer == Amount {0}) {
+      results[i] = zero_state(pe, &totals, outputs);
+      continue;
     }
-    if (seen != N) {
-      throw std::invalid_argument("static path bundle: predecessor structure contains a cycle");
-    }
-  }
-
-  // Structural src->dst connectivity ignoring masks: a bundle that never had an
-  // src->dst walk is malformed for this demand, distinct from being down.
-  auto backward_reaches_src = [&](auto&& admit_entry) {
-    std::vector<char> reach(N, 0);
-    std::vector<NodeId> bfs;
-    bfs.push_back(dst);
-    reach[static_cast<std::size_t>(dst)] = 1;
-    for (std::size_t head = 0; head < bfs.size(); ++head) {
-      const auto v = static_cast<std::size_t>(bfs[head]);
-      for (auto i = static_cast<std::size_t>(off[v]); i < static_cast<std::size_t>(off[v + 1]); ++i) {
-        if (!admit_entry(i)) continue;
-        const auto pnode = par[i];
-        if (!reach[static_cast<std::size_t>(pnode)]) {
-          reach[static_cast<std::size_t>(pnode)] = 1;
-          bfs.push_back(pnode);
-        }
+    pending[i] = compute(pe, rq);
+    publishes[i] = 1;
+    // The working totals after it: the policy's live records out, its drafts in.
+    auto exchange = [&](const FlowRecord& r, Amount sign) {
+      for (const auto& [e, x] : r.edge_flows) carried[static_cast<std::size_t>(e)] += sign * x;
+      if (r.edge_reservations.empty()) return;
+      if (held.empty()) {
+        held.assign(carried.size(), 0);
+        totals.held = held;
       }
+      for (const auto& [e, x] : r.edge_reservations) held[static_cast<std::size_t>(e)] += sign * x;
+    };
+    for (const FlowRecord* r : current_records(pe)) exchange(*r, -1);
+    for (const auto& d : pending[i].drafts) exchange(d.record, 1);
+    results[i] = std::move(pending[i].result);
+  }
+  publish_list(ledger, list, pending, publishes);
+  return results;
+}
+
+// SIMULTANEOUS: every participant prepared and forwarded on one view (the ledger's residual plus
+// every participant's old carried load) by one joint evaluation, demands in creation order; each
+// finished as its scalar call finishes; the outputs after the whole list.
+std::vector<PlacementResult> run_simultaneous(FlowLedger& ledger, std::span<ListAction> list, const OutputOptions& outputs) {
+  const std::size_t n = list.size();
+  const auto c = LedgerAccess::carried(ledger);
+  std::vector<Amount> carried(c.begin(), c.end());
+  for (const auto& x : list) {
+    for (const FlowRecord* r : current_records(*x.engine)) {
+      for (const auto& [e, a] : r->edge_flows) carried[static_cast<std::size_t>(e)] -= a;
     }
-    return reach[static_cast<std::size_t>(src)] != 0;
-  };
-  if (!backward_reaches_src([](std::size_t) { return true; })) {
-    throw std::invalid_argument("static path bundle: no src->dst walk exists in the bundle");
-  }
-
-  // Prune against the policy's masks (failure exclusions), then re-check
-  // connectivity: no surviving walk means the LSP is DOWN.
-  const bool use_nm = !node_mask.empty();
-  const bool use_em = !edge_mask.empty();
-  auto entry_up = [&](std::size_t i) {
-    const auto pnode = static_cast<std::size_t>(par[i]);
-    const auto e = static_cast<std::size_t>(via[i]);
-    if (use_em && !edge_mask[e]) return false;
-    if (use_nm && !node_mask[pnode]) return false;
-    return true;
+  }
+  const LedgerTotals totals {LedgerAccess::baseline(ledger), carried, LedgerAccess::reservation_baseline(ledger), LedgerAccess::reserved(ledger)};
+  // One workspace for the whole computation: a second one on this thread would void its deltas.
+  ServiceCapacityWorkspace W(totals);
+  enum class Kind { EmptyRoster, Entries, BySource, ShortestPathsReplace };
+  struct Participant {
+    Kind kind {Kind::EmptyRoster};
+    PolicyEpoch fresh {};
+    std::optional<ForwardingView> view {};  // its own (a Pinned replace forwards the policy's)
+    PreparedShortestPaths prep {};
+    std::vector<Amount> inject {};
+    ProgramFlow flow {};
+    [[nodiscard]] const ForwardingView* forwarded(const PolicyEngine& pe) const noexcept { return view ? &*view : &pe.view; }
   };
-  auto node_up = [&](NodeId v) { return !use_nm || node_mask[static_cast<std::size_t>(v)]; };
-  if (!node_up(src) || !node_up(dst)) return std::nullopt;
-
-  PredDAG pruned;
-  pruned.parent_offsets.assign(N + 1, 0);
-  for (std::size_t v = 0; v < N; ++v) {
-    std::int32_t c = 0;
-    if (node_up(static_cast<NodeId>(v))) {
-      for (auto i = static_cast<std::size_t>(off[v]); i < static_cast<std::size_t>(off[v + 1]); ++i) {
-        if (entry_up(i)) ++c;
-      }
+  std::vector<Participant> parts(n);
+  std::vector<std::size_t> forwarding;
+  for (std::size_t i = 0; i < n; ++i) {
+    PolicyEngine& pe = *list[i].engine;
+    const PolicyCall& rq = list[i].call;
+    auto& part = parts[i];
+    part.fresh = fresh_epoch(pe, rq.operation == PolicyOperation::Forward);
+    if (pe.reachable_sources.empty() && !is<Pinned>(pe)) continue;
+    if (rq.operation == PolicyOperation::Replace && is<Pinned>(pe)) {
+      part.kind = Kind::Entries;
+    } else if (rq.operation == PolicyOperation::Replace) {
+      PolicyCallContext ctx {pe, *pe.graph, W};
+      part.prep = prepare_shortest_path_program(ctx);
+      part.view.emplace(make_forwarding_view(*pe.graph, part.prep.program, nullptr, pe.allowed_destinations, nullptr));
+      part.kind = Kind::ShortestPathsReplace;
+    } else if (tunnel_model(pe)) {
+      part.view.emplace(make_forwarding_view(*pe.graph, pe.epoch.program, nullptr, pe.allowed_destinations, rq.black_holes, true));
+      part.kind = Kind::Entries;
+    } else {
+      part.view.emplace(installed_view(pe, rq));
+      part.kind = Kind::BySource;
     }
-    pruned.parent_offsets[v + 1] = pruned.parent_offsets[v] + c;
-  }
-  pruned.parents.resize(static_cast<std::size_t>(pruned.parent_offsets.back()));
-  pruned.via_edges.resize(static_cast<std::size_t>(pruned.parent_offsets.back()));
-  for (std::size_t v = 0; v < N; ++v) {
-    auto w = static_cast<std::size_t>(pruned.parent_offsets[v]);
-    if (!node_up(static_cast<NodeId>(v))) continue;
-    for (auto i = static_cast<std::size_t>(off[v]); i < static_cast<std::size_t>(off[v + 1]); ++i) {
-      if (!entry_up(i)) continue;
-      pruned.parents[w] = par[i];
-      pruned.via_edges[w] = via[i];
-      ++w;
-    }
-  }
-
-  const auto& poff = pruned.parent_offsets;
-  {
-    std::vector<char> reach(N, 0);
-    std::vector<NodeId> bfs;
-    bfs.push_back(dst);
-    reach[static_cast<std::size_t>(dst)] = 1;
-    for (std::size_t head = 0; head < bfs.size(); ++head) {
-      const auto v = static_cast<std::size_t>(bfs[head]);
-      for (auto i = static_cast<std::size_t>(poff[v]); i < static_cast<std::size_t>(poff[v + 1]); ++i) {
-        const auto pnode = pruned.parents[i];
-        if (!reach[static_cast<std::size_t>(pnode)]) {
-          reach[static_cast<std::size_t>(pnode)] = 1;
-          bfs.push_back(pnode);
+    const ForwardingView& view = *part.forwarded(pe);
+    part.inject.assign(view.num_sources(), 0);
+    source_shares(view, *rq.offer, part.inject);
+    forwarding.push_back(i);
+  }
+  // The joint forwarding: the demands in their policies' creation order.
+  std::sort(forwarding.begin(), forwarding.end(),
+            [&](std::size_t a, std::size_t b) { return list[a].engine->policy_id < list[b].engine->policy_id; });
+  std::vector<ForwardingDemand> demands;
+  demands.reserve(forwarding.size());
+  for (auto i : forwarding) demands.push_back({parts[i].forwarded(*list[i].engine), parts[i].inject});
+  auto flows = detail::lossy(demands, available_capacity_reader(W));
+  for (std::size_t k = 0; k < forwarding.size(); ++k) parts[forwarding[k]].flow = std::move(flows[k]);
+  // Each participant finished as its scalar call finishes.
+  std::vector<PendingPolicyUpdate> pending(n);
+  for (std::size_t i = 0; i < n; ++i) {
+    PolicyEngine& pe = *list[i].engine;
+    const PolicyCall& rq = list[i].call;
+    auto& part = parts[i];
+    const ForwardingProgram* before = pe.epoch.program.get();
+    PendingPolicyUpdate& s = pending[i];
+    switch (part.kind) {
+      case Kind::EmptyRoster: s = empty_roster(pe, part.fresh, rq, before); break;
+      case Kind::Entries:
+        if (rq.operation == PolicyOperation::Replace) {
+          s = forward_entries(pe, part.fresh, W, rq, before, pe.view, pe.can_forward, false, nullptr, &part.flow);
+        } else {
+          s = forward_entries(pe, part.fresh, W, rq, before, *part.view, view_active(*part.view), is<DistributedTE>(pe), pe.epoch.plan,
+                              &part.flow);
         }
+        break;
+      case Kind::BySource: s = finish_by_source(pe, rq, *part.view, part.flow, nullptr); break;
+      case Kind::ShortestPathsReplace: {
+        const PreparedReplace replaced {part.prep.program, part.prep.flows, before};
+        s = finish_by_source(pe, rq, *part.view, part.flow, &replaced);
+        break;
       }
     }
-    if (!reach[static_cast<std::size_t>(src)]) return std::nullopt;  // DOWN
-  }
-
-  // Cost: min-cost src->dst walk within the PRUNED bundle, so the flow reports the
-  // metric of a walk it can actually use. DP in a topological order of the pruned
-  // DAG (acyclicity established above; pruning cannot introduce cycles).
-  Cost best = std::numeric_limits<Cost>::max();
-  {
-    const auto costs = g.cost_view();
-    std::vector<Cost> dist(N, std::numeric_limits<Cost>::max());
-    dist[static_cast<std::size_t>(src)] = 0;
-    std::vector<int> indeg(N, 0);
-    std::vector<std::vector<std::pair<NodeId, EdgeId>>> children(N);
-    for (std::size_t v = 0; v < N; ++v) {
-      indeg[v] = static_cast<int>(poff[v + 1] - poff[v]);
-      for (auto i = static_cast<std::size_t>(poff[v]); i < static_cast<std::size_t>(poff[v + 1]); ++i) {
-        children[static_cast<std::size_t>(pruned.parents[i])].emplace_back(
-            static_cast<NodeId>(v), pruned.via_edges[i]);
+    // A full-offer call: its call_delivered is the whole new delivery, compared with the old one.
+    Amount old = 0;
+    for (const FlowRecord* r : current_records(pe)) old += r->delivered;
+    s.result.call_delivered = s.result.delivered;
+    s.result.delivery_delta = s.result.delivered - old;
+    s.result.call_undelivered = *rq.offer - s.result.call_delivered;
+    if (*rq.offer == 0) s.result.termination = Termination::Complete;
+  }
+  // The outputs after the whole list: one residual for every entry, each entry's boundary from its
+  // own sources and mask on it.
+  if (any_output(outputs)) {
+    std::vector<Amount> after(carried);
+    for (const auto& s : pending) {
+      for (const auto& d : s.drafts) {
+        for (const auto& [e, x] : d.record.edge_flows) after[static_cast<std::size_t>(e)] += x;
       }
     }
-    std::vector<NodeId> stack;
-    for (std::size_t v = 0; v < N; ++v) {
-      if (indeg[v] == 0) stack.push_back(static_cast<NodeId>(v));
-    }
-    while (!stack.empty()) {
-      auto u = stack.back(); stack.pop_back();
-      const auto du = dist[static_cast<std::size_t>(u)];
-      for (auto [v, e] : children[static_cast<std::size_t>(u)]) {
-        if (du != std::numeric_limits<Cost>::max()) {
-          const Cost cand = du + costs[static_cast<std::size_t>(e)];
-          if (cand < dist[static_cast<std::size_t>(v)]) dist[static_cast<std::size_t>(v)] = cand;
+    const auto baseline = LedgerAccess::baseline(ledger);
+    std::vector<Amount> residual(after.size());
+    for (std::size_t e = 0; e < residual.size(); ++e) residual[e] = baseline[e] - after[e];
+    for (std::size_t i = 0; i < n; ++i) {
+      const PolicyEngine& pe = *list[i].engine;
+      PlacementResult& out = pending[i].result;
+      const auto m = residual.size();
+      if (outputs.edge_reservations) {
+        std::vector<Amount> held(m, 0);
+        for (const auto& d : pending[i].drafts) {
+          for (const auto& [e, x] : d.record.edge_reservations) held[static_cast<std::size_t>(e)] += x;
         }
-        if (--indeg[static_cast<std::size_t>(v)] == 0) stack.push_back(v);
+        out.edge_reservations = std::move(held);
       }
+      if (outputs.edge_flows) {
+        std::vector<Amount> own(m, 0);
+        for (const auto& d : pending[i].drafts) {
+          for (const auto& [e, x] : d.record.edge_flows) own[static_cast<std::size_t>(e)] += x;
+        }
+        out.edge_flows = std::move(own);
+      }
+      if (outputs.saturated_boundary_edges) out.saturated_boundary_edges = saturated_boundary_edges_of(*pe.graph, residual, pe.sources, pe.eligibility);
+      if (outputs.residual) out.residual = residual;
     }
-    best = dist[static_cast<std::size_t>(dst)];
   }
-  return std::make_optional(std::make_pair(std::move(pruned), best));
+  std::vector<PlacementResult> results(n);
+  for (std::size_t i = 0; i < n; ++i) results[i] = std::move(pending[i].result);
+  publish_list(ledger, list, pending, std::vector<std::uint8_t>(n, 1));
+  return results;
 }
 
 } // namespace
+} // namespace detail
 
-/* See flow_policy.hpp for the contract. */
-void FlowPolicy::set_static_paths(NodeId src, NodeId dst, std::vector<PredDAG> bundles) {
-  const auto* g = ctx_.graph.graph.get();
-  if (g == nullptr) {
-    throw std::invalid_argument("FlowPolicy::set_static_paths: policy has no graph");
-  }
-  if (!flows_.empty()) {
-    throw std::invalid_argument(
-        "FlowPolicy::set_static_paths: policy already holds flows; call remove_demand() first");
-  }
-  if (bundles.empty()) {
-    throw std::invalid_argument("FlowPolicy::set_static_paths: bundles must be non-empty");
-  }
-  if (shortest_path_) {
-    throw std::invalid_argument(
-        "FlowPolicy::set_static_paths: incompatible with shortest_path=true (single-"
-        "augmentation IP semantics contradict pinned multi-LSP placement)");
-  }
-  const auto N = g->num_nodes();
-  if (src < 0 || src >= N || dst < 0 || dst >= N || src == dst) {
-    throw std::invalid_argument("FlowPolicy::set_static_paths: src/dst out of range or equal");
+void detail::check_list_arguments(FlowLedger& ledger, std::span<const Action> actions, BatchMode mode, const OutputOptions& outputs) {
+  (void)validate_list(ledger, actions, mode, outputs);
+}
+
+PlacementResult FlowPolicy::place(std::optional<Amount> offer, const OutputOptions& input_outputs) {
+  const OutputOptions outputs = input_outputs;
+  return detail::run_call(*engine_, detail::PolicyCall {detail::PolicyOperation::Place, offer, {}, nullptr, &outputs, nullptr});
+}
+
+PlacementResult FlowPolicy::evaluate(std::optional<Amount> offer, const std::optional<std::optional<Amount>>& design_demand,
+                                     const OutputOptions& input_outputs) const {
+  const OutputOptions outputs = input_outputs;
+  const detail::PolicyCall rq {detail::PolicyOperation::Evaluate, offer, design_demand, nullptr, &outputs, nullptr};
+  detail::check_policy_arguments(*engine_, rq.operation, rq.offer, rq.design, rq.black_holes);
+  const auto gate = LedgerAccess::lock(engine_->ledger);
+  detail::check_call_state(*engine_, rq);
+  return std::move(detail::compute(*engine_, rq).result);
+}
+
+PlacementResult FlowPolicy::replace(std::optional<Amount> offer, const std::optional<std::optional<Amount>>& design_demand,
+                                    const OutputOptions& input_outputs) {
+  const OutputOptions outputs = input_outputs;
+  return detail::run_call(*engine_, detail::PolicyCall {detail::PolicyOperation::Replace, offer, design_demand, nullptr, &outputs, nullptr});
+}
+
+PlacementResult FlowPolicy::forward(std::optional<Amount> offer, const Eligibility* black_holes,
+                                    const OutputOptions& input_outputs) {
+  const OutputOptions outputs = input_outputs;
+  return detail::run_call(*engine_, detail::PolicyCall {detail::PolicyOperation::Forward, offer, {}, black_holes, &outputs, nullptr});
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+PlacementResult detail::place_traced(FlowPolicy& policy, std::optional<Amount> offer, const OutputOptions& input_outputs,
+                                     Trace& trace) {
+  const OutputOptions outputs = input_outputs;
+  trace = Trace::map();
+  return run_call(PolicyAccess::engine(policy), PolicyCall {PolicyOperation::Place, offer, {}, nullptr, &outputs, &trace});
+}
+#endif
+
+std::vector<PlacementResult> apply_actions(FlowLedger& ledger, std::span<const Action> actions, BatchMode mode, const OutputOptions& input_outputs) {
+  const OutputOptions outputs = input_outputs;
+  auto list = detail::validate_list(ledger, actions, mode, outputs);
+  const auto gate = LedgerAccess::lock(ledger);
+  (void)LedgerAccess::baseline(ledger);
+  for (const auto& action : list) detail::check_call_state(*action.engine, action.call);
+  if (list.empty()) return {};
+  return mode == BatchMode::Ordered ? detail::run_ordered(ledger, list, outputs) : detail::run_simultaneous(ledger, list, outputs);
+}
+
+void FlowPolicy::remove() {
+  auto& pe = *engine_;
+  const auto gate = LedgerAccess::lock(pe.ledger);
+  (void)LedgerAccess::detach(pe.ledger, pe.policy_id);
+  // A new epoch (nothing below throws): the same number of record_groups, every one empty.
+  for (auto& c : pe.epoch.record_groups) c.clear();
+  pe.epoch.program.reset();
+  pe.epoch.plan.reset();
+  pe.epoch.support.clear();
+  pe.epoch.marginal_cost_curve.reset();
+  pe.epoch.source_drops_by_source.clear();
+  pe.epoch.by_tunnel.clear();
+  pe.epoch.requested = Counter128 {};
+  pe.epoch.offered = Counter128 {};
+  pe.epoch.infinite = false;
+  pe.epoch.prepared = false;
+}
+
+Amount FlowPolicy::delivered() const {
+  const auto& pe = *engine_;
+  const auto gate = LedgerAccess::lock(pe.ledger);
+  Amount total = 0;
+  for (const auto& c : pe.epoch.record_groups) {
+    for (const auto& s : c) total += LedgerAccess::live(pe.ledger, s.record_counter).delivered;
   }
-  // Validate the USER's max_flow_count against the supplied bundle count. The
-  // configured value is never overwritten: the usable (up) count U drives the
-  // per-flow math at placement time, and N - flow_count() is the down-LSP count.
-  if (max_flow_count_.has_value() && *max_flow_count_ != static_cast<int>(bundles.size())) {
-    throw std::invalid_argument("If set, max_flow_count must be equal to the number of static paths.");
+  return total;
+}
+
+std::vector<FlowRecord> FlowPolicy::records() const {
+  const auto& pe = *engine_;
+  const auto gate = LedgerAccess::lock(pe.ledger);
+  std::vector<std::int64_t> ids;
+  for (const auto& c : pe.epoch.record_groups) {
+    for (const auto& s : c) ids.push_back(s.record_counter);
   }
+  std::sort(ids.begin(), ids.end());
+  std::vector<FlowRecord> out;
+  out.reserve(ids.size());
+  for (std::int64_t id : ids) out.push_back(LedgerAccess::live(pe.ledger, id));
+  return out;
+}
 
-  std::vector<StaticBundle> usable;
-  usable.reserve(bundles.size());
-  for (auto const& dag : bundles) {
-    if (auto prepared = prepare_static_bundle(*g, dag, src, dst, node_mask_, edge_mask_)) {
-      usable.push_back(StaticBundle{std::move(prepared->first), prepared->second});
-    }
+FlowRecord FlowPolicy::record(const FlowId& flow_id) const {
+  const auto& pe = *engine_;
+  const auto gate = LedgerAccess::lock(pe.ledger);
+  const FlowLedger& fg = pe.ledger;
+  // The ledger's checks first (another ledger, a retired or unknown id), then the owner.
+  FlowRecord rec = LedgerAccess::record(fg, flow_id);
+  if (rec.policy_id != pe.policy_id) {
+    throw std::invalid_argument("FlowId (" + std::to_string(flow_id.first) + ", " + std::to_string(flow_id.second) +
+                                ") is not a record of this policy");
   }
-  static_src_ = src;
-  static_dst_ = dst;
-  static_supplied_count_ = static_cast<int>(bundles.size());
-  static_bundles_ = std::move(usable);
+  return rec;
 }
 
+std::shared_ptr<const ForwardingProgram> FlowPolicy::program() const {
+  const auto gate = LedgerAccess::lock(engine_->ledger);
+  return engine_->epoch.program;
+}
+
+const FlowPolicyConfig& FlowPolicy::config() const noexcept { return engine_->config; }
+
 } // namespace netgraph::core
diff --git a/src/flow_state.cpp b/src/flow_state.cpp
deleted file mode 100644
index 3262a1b..0000000
--- a/src/flow_state.cpp
+++ /dev/null
@@ -1,674 +0,0 @@
-/*
-  FlowState — residual capacities and placement over a fixed graph.
-
-  Maintains per-edge residual capacity and cumulative edge flows. Supports
-  three placement strategies when pushing flow along an SPF DAG:
-    - Proportional: distribute flow proportionally to residual capacity,
-      processing nodes in topological order from source to destination.
-    - EqualBalanced: *single-pass ECMP admission* on a fixed DAG. The split set
-      is the DAG's edges with capacity (the topology's next-hop set); we
-      compute a single global scale so no edge is oversubscribed, then return.
-      A member filled since the DAG was built yields scale 0: a forwarding
-      table does not react to load. place_max_flow() progresses by recomputing
-      the DAG with a residual-aware SPF.
-    - EqualBalancedLossy: equal split over the same capacity-based set with no
-      scaling; each edge carries min(share, residual) and drops the excess,
-      deficits propagate downstream, and the placed amount is what reaches
-      dst (best-effort hash-ECMP forwarding).
-*/
-#include "netgraph/core/flow_state.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/profiling.hpp"
-
-#include <algorithm>
-#include <cmath>
-#include <limits>
-#include <queue>
-#include <span>
-#include <utility>
-#include <vector>
-#include <stdexcept>
-
-namespace netgraph::core {
-namespace {
-
-// Dinic-style edge for the reversed residual graph (used in Proportional placement).
-// Each edge u->v represents a group of parallel forward edges with aggregated capacity.
-struct DinicEdge {
-  std::int32_t to;        // destination node
-  std::int32_t rev;       // index of reverse edge in adj[to]
-  double cap;             // current residual capacity
-  double init_cap;        // initial capacity (snapshot at augmentation start)
-  std::int32_t group;     // index into groups array (-1 if reverse edge)
-};
-
-// Workspace for Dinic-like augmentations on the reversed residual graph.
-// We reverse the DAG (dst becomes source) to enable topological flow placement.
-struct FlowWorkspace {
-  std::vector<std::vector<DinicEdge>> adj; // reversed residual graph
-  std::vector<std::int32_t> level;         // BFS level for level graph
-  std::vector<std::int32_t> it;            // DFS iteration pointer per node
-
-  void reset(std::int32_t n) {
-    adj.assign(static_cast<std::size_t>(n), {});
-    level.assign(static_cast<std::size_t>(n), -1);
-    it.assign(static_cast<std::size_t>(n), 0);
-  }
-  void add_edge(std::int32_t u, std::int32_t v, double c, std::int32_t group_idx) {
-    // Add forward edge u->v and its reverse v->u (with zero initial capacity).
-    // Forward edge stores the group index for later proportional distribution.
-    DinicEdge a{v, static_cast<std::int32_t>(adj[static_cast<std::size_t>(v)].size()), c, c, group_idx};
-    DinicEdge b{u, static_cast<std::int32_t>(adj[static_cast<std::size_t>(u)].size()), 0.0, 0.0, -1};
-    adj[static_cast<std::size_t>(u)].push_back(a);
-    adj[static_cast<std::size_t>(v)].push_back(b);
-  }
-  bool bfs(std::int32_t s, std::int32_t t) {
-    std::fill(level.begin(), level.end(), -1);
-    std::queue<std::int32_t> q;
-    level[static_cast<std::size_t>(s)] = 0;
-    q.push(s);
-    while (!q.empty()) {
-      auto u = q.front(); q.pop();
-      for (auto const& e : adj[static_cast<std::size_t>(u)]) {
-        if (e.cap >= kMinCap && level[static_cast<std::size_t>(e.to)] < 0) {
-          level[static_cast<std::size_t>(e.to)] = level[static_cast<std::size_t>(u)] + 1;
-          q.push(e.to);
-        }
-      }
-    }
-    return level[static_cast<std::size_t>(t)] >= 0;
-  }
-  double dfs(std::int32_t u, std::int32_t t, double f) {
-    if (u == t) return f;
-    for (auto& i = it[static_cast<std::size_t>(u)]; i < static_cast<std::int32_t>(adj[static_cast<std::size_t>(u)].size()); ++i) {
-      DinicEdge& e = adj[static_cast<std::size_t>(u)][static_cast<std::size_t>(i)];
-      if (e.cap < kMinCap) continue;
-      if (level[static_cast<std::size_t>(e.to)] != level[static_cast<std::size_t>(u)] + 1) continue;
-      double d = dfs(e.to, t, std::min(f, e.cap));
-      if (d >= kMinFlow) {
-        e.cap -= d;
-        DinicEdge& r = adj[static_cast<std::size_t>(e.to)][static_cast<std::size_t>(e.rev)];
-        r.cap += d;
-        return d;
-      }
-    }
-    return 0.0;
-  }
-};
-
-// Edges from parent u to child v grouped by (u,v) for proportional/EB logic.
-// In the DAG, parent u is a predecessor of child v on a shortest path.
-struct EdgeGroup {
-  std::int32_t from; // child v (destination of grouped edges)
-  std::int32_t to;   // parent u (source of grouped edges)
-  // Underlying forward edges u->v (parallel edges) as a slice of GroupSet::eids.
-  // Storing a slice rather than a std::vector keeps group building allocation-free;
-  // rebuilding groups after every augmentation used to dominate place_on_dag.
-  std::int32_t eid_begin {0};
-  std::int32_t eid_count {0};
-  Cap sum_cap {0.0};  // sum of residual capacities for Proportional placement
-  Cap min_cap {0.0};  // min residual capacity for EqualBalanced placement
-};
-
-// Groups plus the arena backing their edge slices, and the scratch used to build
-// them. One instance is reused across every rebuild within a place_on_dag call so
-// the buffers keep their capacity.
-struct GroupSet {
-  std::vector<EdgeGroup> groups;
-  std::vector<EdgeId> eids;            // arena: group gi owns [eid_begin, +eid_count)
-  std::vector<char> reach;             // scratch: backward reachability from t
-  std::vector<std::int32_t> uniq;      // scratch: distinct parents of one node
-  std::vector<std::int32_t> bfs;       // scratch: BFS queue
-
-  [[nodiscard]] std::span<const EdgeId> edges_of(const EdgeGroup& gr) const noexcept {
-    return std::span<const EdgeId>(eids.data() + gr.eid_begin,
-                                   static_cast<std::size_t>(gr.eid_count));
-  }
-};
-
-// Build grouped edges by (parent u, child v) that can reach destination t.
-// Membership is decided by residual (edges that can still carry flow) for
-// Proportional placement, or by capacity when members_by_capacity is set: every
-// DAG edge with capacity is a member and sum_cap/min_cap still reflect the
-// current residual, so a member filled since the DAG was built contributes
-// min_cap = 0. The equal-balanced placements use the latter to model a
-// forwarding table that does not react to load.
-static void build_groups_residual(const StrictMultiDiGraph& g,
-                                  const PredDAG& dag, NodeId t,
-                                  const std::vector<Cap>& residual,
-                                  bool members_by_capacity,
-                                  GroupSet& gs) {
-  const auto capacity = g.capacity_view();
-  gs.groups.clear();
-  gs.eids.clear();
-  const auto& offsets = dag.parent_offsets;
-  const auto& parents = dag.parents;
-  const auto& via     = dag.via_edges;
-  const auto N = g.num_nodes();
-  // Compute reachability: BFS backward from destination t to identify nodes on SPF DAG.
-  gs.reach.assign(static_cast<std::size_t>(N), 0);
-  if (t >= 0 && t < N) {
-    gs.bfs.clear();
-    gs.bfs.push_back(t);
-    gs.reach[static_cast<std::size_t>(t)] = 1;
-    for (std::size_t head = 0; head < gs.bfs.size(); ++head) {
-      const auto v = gs.bfs[head];
-      // Iterate over v's predecessors (parents in the DAG).
-      std::size_t s = static_cast<std::size_t>(offsets[static_cast<std::size_t>(v)]);
-      std::size_t e = static_cast<std::size_t>(offsets[static_cast<std::size_t>(v + 1)]);
-      for (std::size_t i = s; i < e; ++i) {
-        auto u = parents[i];
-        if (!gs.reach[static_cast<std::size_t>(u)]) { gs.reach[static_cast<std::size_t>(u)] = 1; gs.bfs.push_back(u); }
-      }
-    }
-  }
-  // For each reachable node v, group its incoming DAG edges by parent node u.
-  // This creates one group per (u, v) pair, aggregating parallel edges.
-  // Two passes per node (collect distinct parents, then gather each parent's edges)
-  // keep every group's edges contiguous in the arena without any allocation.
-  for (std::int32_t v = 0; v < N; ++v) {
-    if (!gs.reach[static_cast<std::size_t>(v)]) continue;
-    const std::size_t s = static_cast<std::size_t>(offsets[static_cast<std::size_t>(v)]);
-    const std::size_t e = static_cast<std::size_t>(offsets[static_cast<std::size_t>(v + 1)]);
-    // Pass 1: distinct parents, in first-appearance order (matches the previous
-    // by_parent ordering, so emitted groups keep the same order as before).
-    gs.uniq.clear();
-    for (std::size_t i = s; i < e; ++i) {
-      const auto u = parents[i];
-      bool found = false;
-      for (auto pu : gs.uniq) { if (pu == u) { found = true; break; } }
-      if (!found) gs.uniq.push_back(u);
-    }
-    // Pass 2: gather each parent's admissible parallel edges contiguously.
-    for (auto u : gs.uniq) {
-      EdgeGroup gr;
-      gr.from = v; gr.to = u;
-      gr.eid_begin = static_cast<std::int32_t>(gs.eids.size());
-      gr.sum_cap = static_cast<Cap>(0.0); gr.min_cap = std::numeric_limits<Cap>::infinity();
-      for (std::size_t i = s; i < e; ++i) {
-        if (parents[i] != u) continue;
-        const auto eid0 = via[i];
-        const Cap c = residual[static_cast<std::size_t>(eid0)];
-        const Cap gate = members_by_capacity ? capacity[static_cast<std::size_t>(eid0)] : c;
-        if (gate >= kMinCap) {
-          gs.eids.push_back(eid0);
-          gr.sum_cap += c;
-          gr.min_cap = std::min(gr.min_cap, c);
-        }
-      }
-      gr.eid_count = static_cast<std::int32_t>(gs.eids.size()) - gr.eid_begin;
-      if (gr.min_cap == std::numeric_limits<Cap>::infinity()) gr.min_cap = static_cast<Cap>(0.0);
-      if (gr.eid_count > 0) gs.groups.push_back(gr);
-      // else: nothing was appended, so the arena is already back at eid_begin.
-    }
-  }
-}
-
-// Construct reversed residual graph for Dinic BFS/DFS using group capacities.
-static void build_reversed_residual(FlowWorkspace& ws, std::int32_t N, const std::vector<EdgeGroup>& groups) {
-  ws.reset(N);
-  for (std::int32_t idx = 0; idx < static_cast<std::int32_t>(groups.size()); ++idx) {
-    const auto& gr = groups[static_cast<std::size_t>(idx)];
-    if (gr.sum_cap >= kMinCap) {
-      ws.add_edge(gr.from, gr.to, gr.sum_cap, idx);
-    }
-  }
-}
-
-// Note: equal-balanced logic is implemented inline in place_on_dag to avoid
-// maintaining a separate assignment routine. This keeps behavior explicit and
-// consistent with the documented reference behavior.
-
-} // namespace
-
-FlowState::FlowState(const StrictMultiDiGraph& g) : g_(&g) {
-  residual_.assign(static_cast<std::size_t>(g.num_edges()), 0.0);
-  edge_flow_.assign(static_cast<std::size_t>(g.num_edges()), 0.0);
-  // initialize residual to capacity
-  auto cap = g.capacity_view();
-  for (std::size_t i=0;i<residual_.size();++i) residual_[i] = cap[i];
-}
-
-FlowState::FlowState(const StrictMultiDiGraph& g, std::span<const Cap> residual_init) : g_(&g) {
-  if (static_cast<std::size_t>(g.num_edges()) != residual_init.size()) {
-    throw std::invalid_argument("FlowState: residual_init length must equal num_edges");
-  }
-  residual_.assign(residual_init.begin(), residual_init.end());
-  edge_flow_.assign(static_cast<std::size_t>(g.num_edges()), 0.0);
-}
-
-void FlowState::reset() noexcept {
-  auto cap = g_->capacity_view();
-  for (std::size_t i=0;i<residual_.size();++i) residual_[i] = cap[i];
-  std::fill(edge_flow_.begin(), edge_flow_.end(), 0.0);
-}
-
-void FlowState::reset(std::span<const Cap> residual_init) {
-  if (residual_init.size() != residual_.size()) {
-    throw std::invalid_argument("FlowState::reset: residual_init length must equal num_edges");
-  }
-  std::copy(residual_init.begin(), residual_init.end(), residual_.begin());
-  std::fill(edge_flow_.begin(), edge_flow_.end(), 0.0);
-}
-
-Flow FlowState::place_on_dag(NodeId src, NodeId dst, const PredDAG& dag,
-                             Flow requested_flow, FlowPlacement placement,
-                             std::vector<std::pair<EdgeId, Flow>>* trace,
-                             std::vector<std::pair<EdgeId, Flow>>* drops) {
-  NGRAPH_PROFILE_SCOPE("place_on_dag");
-  const auto N = g_->num_nodes();
-  if (src < 0 || src >= N || dst < 0 || dst >= N || src == dst) return 0.0;
-
-  // The equal-balanced placements model a forwarding table that does not
-  // react to load: their split set is every DAG edge with capacity, full or not.
-  const bool fixed_members = (placement != FlowPlacement::Proportional);
-
-  // Build groups using current residual. `gs` is reused across rebuilds so its
-  // buffers keep their capacity for the whole call.
-  GroupSet gs;
-  build_groups_residual(*g_, dag, dst, residual_, fixed_members, gs);
-  const auto& groups = gs.groups;
-
-  Flow placed = static_cast<Flow>(0.0);
-  double remaining = static_cast<double>(requested_flow);
-
-  if (placement == FlowPlacement::Proportional) {
-    // Proportional placement: use Dinic-like augmentation on reversed DAG.
-    // We reverse the DAG (dst -> src) so flow propagates topologically from dst.
-    FlowWorkspace ws;
-    build_reversed_residual(ws, N, groups);
-    while (remaining > kMinFlow && ws.bfs(dst, src)) {
-      std::fill(ws.it.begin(), ws.it.end(), 0);
-      Flow pushed_layer = static_cast<Flow>(0.0);
-      while (true) {
-        double pushed = ws.dfs(dst, src, remaining);
-        if (pushed < kMinFlow) break;
-        pushed_layer += static_cast<Flow>(pushed);
-        remaining -= pushed;
-        if (remaining <= kMinFlow) break;
-      }
-      if (pushed_layer < kMinFlow) break;
-      placed += pushed_layer;
-
-      // Distribute the pushed flow onto the underlying parallel edges.
-      // For each group, divide the flow proportionally to residual capacity.
-      // This ensures fair load balancing across parallel edges.
-      for (std::size_t u = 0; u < ws.adj.size(); ++u) {
-        for (const auto& e : ws.adj[u]) {
-          if (e.group < 0) continue;  // skip reverse edges
-          double sent = e.init_cap - e.cap; if (sent < kMinFlow) continue;
-          const auto& gr = groups[static_cast<std::size_t>(e.group)];
-          // Guard against division by zero when group capacity is numerically zero.
-          double denom = gr.sum_cap > kMinCap ? gr.sum_cap : 1.0;
-          // Proportional split: each edge gets share = sent * (edge_residual / sum_residual).
-          for (auto eid : gs.edges_of(gr)) {
-            Cap base = residual_[static_cast<std::size_t>(eid)];
-            double share = sent * (static_cast<double>(base) / denom);
-            edge_flow_[static_cast<std::size_t>(eid)] += static_cast<Cap>(share);
-            residual_[static_cast<std::size_t>(eid)] = std::max(static_cast<Cap>(0.0), static_cast<Cap>(base - share));
-            if (trace) { trace->emplace_back(eid, static_cast<Flow>(share)); }
-          }
-        }
-      }
-      // Rebuild groups for next tier using updated residual
-      build_groups_residual(*g_, dag, dst, residual_, /*members_by_capacity=*/false, gs);
-      build_reversed_residual(ws, N, groups);
-    }
-  } else if (placement == FlowPlacement::EqualBalancedLossy) {
-    // EqualBalancedLossy: best-effort hash-ECMP forwarding. Every node splits
-    // what it received equally over its outgoing member edges; each edge carries
-    // min(share, residual) and drops the rest, so a deficit propagates downstream
-    // and the placed amount is what arrives at dst. No global scale.
-    const bool record_drops = (drops != nullptr) && std::isfinite(static_cast<double>(requested_flow));
-
-    std::vector<std::vector<std::size_t>> succ(static_cast<std::size_t>(N));
-    for (std::size_t gi = 0; gi < groups.size(); ++gi) {
-      const auto& gr = groups[gi];
-      if (gr.eid_count == 0) continue;
-      succ[static_cast<std::size_t>(gr.to)].push_back(gi); // u -> v (group index)
-    }
-
-    // Reachability from src over the member graph; nodes outside it never see flow.
-    std::vector<char> reach(static_cast<std::size_t>(N), 0);
-    {
-      std::queue<std::int32_t> q; q.push(src); reach[static_cast<std::size_t>(src)] = 1;
-      while (!q.empty()) {
-        auto u = q.front(); q.pop();
-        for (auto gi : succ[static_cast<std::size_t>(u)]) {
-          auto v = groups[gi].from;
-          if (!reach[static_cast<std::size_t>(v)]) { reach[static_cast<std::size_t>(v)] = 1; q.push(v); }
-        }
-      }
-    }
-    if (!reach[static_cast<std::size_t>(dst)]) return static_cast<Flow>(0.0);
-
-    // Per-node fan-out (number of member edges) for the equal per-edge split.
-    std::vector<int> node_split(static_cast<std::size_t>(N), 0);
-    std::vector<int> indeg(static_cast<std::size_t>(N), 0);
-    for (std::size_t u = 0; u < succ.size(); ++u) {
-      if (!reach[u]) continue;
-      int s = 0;
-      for (auto gi : succ[u]) {
-        s += static_cast<int>(groups[gi].eid_count);
-        auto v = static_cast<std::size_t>(groups[gi].from);
-        if (reach[v]) indeg[v] += 1;
-      }
-      node_split[u] = s;
-    }
-
-    // Kahn's algorithm carrying actual volumes. Nodes are released once every
-    // parent has forwarded, so inflow[u] is final when u is processed.
-    std::queue<std::int32_t> q;
-    std::vector<double> inflow(static_cast<std::size_t>(N), 0.0);
-    q.push(src);
-    inflow[static_cast<std::size_t>(src)] = static_cast<double>(requested_flow);
-    while (!q.empty()) {
-      auto u = q.front(); q.pop();
-      const double f_in = inflow[static_cast<std::size_t>(u)];
-      const int split = node_split[static_cast<std::size_t>(u)];
-      // Even a node that received nothing must release its children, or a
-      // reconvergent child stays blocked behind an unreachable parent.
-      const double per_edge = (split > 0 && f_in >= kEpsilon) ? f_in / static_cast<double>(split) : 0.0;
-      for (auto gi : succ[static_cast<std::size_t>(u)]) {
-        const auto& gr = groups[gi];
-        if (per_edge > 0.0) {
-          for (auto eid : gs.edges_of(gr)) {
-            const auto ei = static_cast<std::size_t>(eid);
-            const double res = static_cast<double>(residual_[ei]);
-            const double carried = std::max(0.0, std::min(per_edge, res));
-            if (carried > 0.0) {
-              edge_flow_[ei] += static_cast<Flow>(carried);
-              residual_[ei] = static_cast<Cap>(std::max(0.0, res - carried));
-              inflow[static_cast<std::size_t>(gr.from)] += carried;
-              if (trace) trace->emplace_back(eid, static_cast<Flow>(carried));
-            }
-            const double dropped = per_edge - carried;
-            if (record_drops && dropped >= kEpsilon) drops->emplace_back(eid, static_cast<Flow>(dropped));
-          }
-        }
-        auto v = static_cast<std::size_t>(gr.from);
-        if (reach[v] && --indeg[v] == 0) q.push(static_cast<std::int32_t>(v));
-      }
-    }
-    placed = static_cast<Flow>(inflow[static_cast<std::size_t>(dst)]);
-  } else {
-    // EqualBalanced placement: split flow equally across parallel edges, with
-    // topological accumulation to correctly handle reconvergent DAGs. Every
-    // group with capacity stays in the split, so a full member drives the
-    // global scale to 0.
-
-    // Build forward adjacency from parent u to child v for each group and
-    // compute aggregated reverse capacities per group.
-    std::vector<std::vector<std::size_t>> succ(static_cast<std::size_t>(N));
-    std::vector<double> rev_cap(groups.size(), 0.0);
-    for (std::size_t gi = 0; gi < groups.size(); ++gi) {
-      const auto& gr = groups[gi];
-      if (gr.eid_count == 0) continue;
-      // EB: group admissible total = min_edge_residual * |edges|
-      const double cap_rev = static_cast<double>(gr.min_cap) * static_cast<double>(gr.eid_count);
-      succ[static_cast<std::size_t>(gr.to)].push_back(gi); // u -> v (group index)
-      rev_cap[gi] = cap_rev >= kMinCap ? cap_rev : 0.0;
-    }
-
-    // Compute reachability from src on this succ graph (to ignore disconnected parts).
-    std::vector<char> reach(static_cast<std::size_t>(N), 0);
-    if (src >= 0 && src < N) {
-      std::queue<std::int32_t> q; q.push(src); reach[static_cast<std::size_t>(src)] = 1;
-      while (!q.empty()) {
-        auto u = q.front(); q.pop();
-        for (auto gi : succ[static_cast<std::size_t>(u)]) {
-          auto v = groups[gi].from;
-          if (!reach[static_cast<std::size_t>(v)]) { reach[static_cast<std::size_t>(v)] = 1; q.push(v); }
-        }
-      }
-    }
-
-    // Precompute total outgoing per-edge count per node for equal split.
-    std::vector<int> node_split(static_cast<std::size_t>(N), 0);
-    for (std::size_t u = 0; u < succ.size(); ++u) {
-      if (!reach[u]) continue;
-      int s = 0;
-      for (auto gi : succ[u]) s += static_cast<int>(groups[gi].eid_count);
-      node_split[u] = s;
-    }
-
-    // Topological accumulation: indegree counts over reachable subgraph.
-    std::vector<int> indeg(static_cast<std::size_t>(N), 0);
-    for (std::size_t u = 0; u < succ.size(); ++u) {
-      if (!reach[u]) continue;
-      for (auto gi : succ[u]) {
-        auto v = static_cast<std::size_t>(groups[gi].from);
-        if (reach[v]) indeg[v] += 1;
-      }
-    }
-
-    // Kahn's algorithm over reachable nodes starting from src.
-    std::queue<std::int32_t> q;
-    std::vector<double> inflow(static_cast<std::size_t>(N), 0.0);
-    std::vector<double> assigned(groups.size(), 0.0);
-    if (src >= 0 && src < N && reach[static_cast<std::size_t>(src)]) {
-      q.push(src);
-      inflow[static_cast<std::size_t>(src)] = 1.0; // unit flow
-    }
-
-    while (!q.empty()) {
-      auto u = q.front(); q.pop();
-      double f_in = inflow[static_cast<std::size_t>(u)];
-      if (f_in < kEpsilon) continue;
-      int split = node_split[static_cast<std::size_t>(u)];
-      if (split <= 0) continue;
-      for (auto gi : succ[static_cast<std::size_t>(u)]) {
-        const auto& gr = groups[gi];
-        if (gr.eid_count == 0) continue;
-        // Group share proportional to number of edges (equal per-edge split).
-        double push = f_in * (static_cast<double>(gr.eid_count) / static_cast<double>(split));
-        if (push < kEpsilon) continue;
-        assigned[gi] += push;
-        auto v = static_cast<std::size_t>(gr.from);
-        inflow[v] += push;
-        // Decrement indegree and enqueue child when all parents processed.
-        if (--indeg[v] == 0) q.push(static_cast<std::int32_t>(v));
-      }
-    }
-
-    // Early exit if destination is not reachable with capacity.
-    // With require_capacity=false, SPF includes zero-capacity edges in the DAG,
-    // but those edges are filtered out during group building. If no path with
-    // capacity reaches the destination, return 0.
-    if (inflow[static_cast<std::size_t>(dst)] < kEpsilon) {
-      return static_cast<Flow>(0.0);
-    }
-
-    // Single-pass ECMP admission: scale the unit assignment by the smallest
-    // per-group headroom so that no edge is oversubscribed under *fixed equal
-    // per-edge splits*. Any further injection with the same splits would violate
-    // the saturated group(s).
-    double ratio = std::numeric_limits<double>::infinity();
-    for (std::size_t gi = 0; gi < groups.size(); ++gi) {
-      if (assigned[gi] > 0.0) {
-        double r = rev_cap[gi] / assigned[gi];
-        if (r < ratio) ratio = r;
-      }
-    }
-    if (!std::isfinite(ratio)) ratio = 0.0;
-
-    // Place up to requested amount.
-    Flow use = static_cast<Flow>(std::min(ratio, static_cast<double>(remaining)));
-    if (use >= kMinFlow) {
-      placed += use;
-      // Apply scaled group assignments equally over parallel edges.
-      for (std::size_t gi = 0; gi < groups.size(); ++gi) {
-        const auto& gr = groups[gi]; if (gr.eid_count == 0) continue;
-        double flow_scaled = assigned[gi] * static_cast<double>(use);
-        if (flow_scaled < kMinFlow) continue;
-        double per_edge = flow_scaled / static_cast<double>(gr.eid_count);
-        for (auto eid : gs.edges_of(gr)) {
-          edge_flow_[static_cast<std::size_t>(eid)] += static_cast<Flow>(per_edge);
-          double base = static_cast<double>(residual_[static_cast<std::size_t>(eid)]);
-          residual_[static_cast<std::size_t>(eid)] = static_cast<Cap>(std::max(0.0, base - per_edge));
-          if (trace) trace->emplace_back(eid, static_cast<Flow>(per_edge));
-        }
-      }
-    }
-  }
-  return placed;
-}
-
-Flow FlowState::place_max_flow(NodeId src, NodeId dst, FlowPlacement placement,
-                               bool shortest_path, bool require_capacity,
-                               std::span<const bool> node_mask,
-                               std::span<const bool> edge_mask) {
-  // require_capacity controls routing behavior:
-  //   - true: Require edges to have capacity, exclude saturated links (SDN/TE, progressive)
-  //   - false: Routes based on costs only, ignore capacity (IP/IGP, fixed routing)
-  //
-  // NOTE: With FlowPlacement::EqualBalanced + require_capacity=true, this behaves as a
-  // progressive "fill". For IP ECMP, use require_capacity=false + shortest_path=true.
-
-  // Validate mask lengths
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(g_->num_nodes())) {
-    throw std::invalid_argument("FlowState::place_max_flow: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g_->num_edges())) {
-    throw std::invalid_argument("FlowState::place_max_flow: edge_mask length mismatch");
-  }
-
-  Flow total = static_cast<Flow>(0.0);
-  // With require_capacity=false the search ignores residuals, so its inputs
-  // are identical on every pass: compute it once and reuse the result.
-  std::pair<std::vector<Cost>, PredDAG> path_result;
-  bool have_path_result = false;
-  while (true) {
-    EdgeSelection sel;
-    sel.multi_edge = true;
-    sel.require_capacity = require_capacity;
-    sel.tie_break = EdgeTieBreak::Deterministic;
-    if (require_capacity || !have_path_result) {
-      path_result = shortest_paths(*g_, src, dst, /*multipath=*/true, sel,
-                                   require_capacity ? residual_ : std::span<const Cap>{},
-                                   node_mask, edge_mask);
-      have_path_result = true;
-    }
-    const auto& [dist, dag] = path_result;
-    if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size()-1 || dag.parent_offsets[static_cast<std::size_t>(dst)] == dag.parent_offsets[static_cast<std::size_t>(dst)+1]) {
-      break;
-    }
-    Flow placed = place_on_dag(src, dst, dag, std::numeric_limits<double>::infinity(), placement);
-    if (placed < kMinFlow) break;
-    total += placed;
-    if (shortest_path) break;
-  }
-  return total;
-}
-
-MinCut FlowState::compute_min_cut(NodeId src, std::span<const bool> node_mask, std::span<const bool> edge_mask) const {
-  MinCut out;
-  const auto N = g_->num_nodes();
-
-  // Early return if source is out of range
-  if (!(src >= 0 && src < N)) return out;
-
-  // Validate mask lengths
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(N)) {
-    throw std::invalid_argument("FlowState::compute_min_cut: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g_->num_edges())) {
-    throw std::invalid_argument("FlowState::compute_min_cut: edge_mask length mismatch");
-  }
-
-  const auto row = g_->row_offsets_view();
-  const auto col = g_->col_indices_view();
-  const auto aei = g_->adj_edge_index_view();
-  const auto in_row = g_->in_row_offsets_view();
-  const auto in_col = g_->in_col_indices_view();
-  const auto in_aei = g_->in_adj_edge_index_view();
-  const bool use_node_mask = !node_mask.empty();
-  const bool use_edge_mask = !edge_mask.empty();
-
-  // Early return if source is masked out
-  if (use_node_mask && !node_mask[static_cast<std::size_t>(src)]) return out;
-
-  std::vector<char> visited(static_cast<std::size_t>(N), 0);
-  std::queue<std::int32_t> q;
-  visited[static_cast<std::size_t>(src)] = 1;
-  q.push(src);
-  while (!q.empty()) {
-    auto u = q.front(); q.pop();
-    if (use_node_mask && !node_mask[static_cast<std::size_t>(u)]) continue;
-    // Forward residual arcs
-    auto start = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto end   = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    for (std::size_t j = start; j < end; ++j) {
-      auto v = static_cast<std::int32_t>(col[j]);
-      auto eid = static_cast<std::size_t>(aei[j]);
-      if (use_edge_mask && !edge_mask[eid]) continue;
-      if (use_node_mask && !node_mask[static_cast<std::size_t>(v)]) continue;
-      if (residual_[eid] > kMinCap && !visited[static_cast<std::size_t>(v)]) {
-        visited[static_cast<std::size_t>(v)] = 1;
-        q.push(v);
-      }
-    }
-    // Reverse residual arcs
-    auto rs = static_cast<std::size_t>(in_row[static_cast<std::size_t>(u)]);
-    auto re = static_cast<std::size_t>(in_row[static_cast<std::size_t>(u)+1]);
-    for (std::size_t j = rs; j < re; ++j) {
-      auto w = static_cast<std::int32_t>(in_col[j]);
-      auto eid = static_cast<std::size_t>(in_aei[j]);
-      if (use_edge_mask && !edge_mask[eid]) continue;
-      if (use_node_mask && !node_mask[static_cast<std::size_t>(w)]) continue;
-      // Reverse arcs exist where THIS state has placed cancellable flow. Using
-      // edge_flow_ (not capacity - residual) keeps the traversal correct when
-      // the state was constructed with a custom residual_init, where
-      // capacity - residual also counts pre-existing usage this state never
-      // placed and cannot cancel.
-      if (edge_flow_[eid] > kMinFlow && !visited[static_cast<std::size_t>(w)]) {
-        visited[static_cast<std::size_t>(w)] = 1;
-        q.push(w);
-      }
-    }
-  }
-  // Collect cut edges
-  for (std::int32_t u = 0; u < N; ++u) {
-    if (!visited[static_cast<std::size_t>(u)]) continue;
-    if (use_node_mask && !node_mask[static_cast<std::size_t>(u)]) continue;
-    auto s3 = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto e3 = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    for (std::size_t j = s3; j < e3; ++j) {
-      auto v = static_cast<std::int32_t>(col[j]);
-      if (use_node_mask && !node_mask[static_cast<std::size_t>(v)]) continue;
-      if (visited[static_cast<std::size_t>(v)]) continue;
-      auto eid = static_cast<std::size_t>(aei[j]);
-      if (use_edge_mask && !edge_mask[eid]) continue;
-      if (residual_[eid] <= kMinCap) {
-        out.edges.push_back(static_cast<EdgeId>(eid));
-      }
-    }
-  }
-  return out;
-}
-
-void FlowState::apply_deltas(std::span<const std::pair<EdgeId, Flow>> deltas, bool add) noexcept {
-  const auto cap = g_->capacity_view();
-  for (const auto& pr : deltas) {
-    std::size_t eid = static_cast<std::size_t>(pr.first);
-    double df = static_cast<double>(pr.second);
-    if (df <= 0.0) continue;
-    if (eid >= residual_.size()) continue;
-    // base_res is not needed; use base_flow and cap directly
-    double base_flow = edge_flow_[eid];
-    if (add) {
-      edge_flow_[eid] = static_cast<Flow>(base_flow + df);
-      double new_res = std::max(0.0, static_cast<double>(cap[eid]) - edge_flow_[eid]);
-      residual_[eid] = static_cast<Cap>(new_res);
-    } else {
-      // Clamp flow into [0, cap] and set residual accordingly.
-      double unclamped = base_flow - df;
-      double clamped = std::min(static_cast<double>(cap[eid]), std::max(0.0, unclamped));
-      edge_flow_[eid] = static_cast<Flow>(clamped);
-      residual_[eid] = static_cast<Cap>(std::max(0.0, static_cast<double>(cap[eid]) - clamped));
-    }
-  }
-}
-
-} // namespace netgraph::core
diff --git a/src/forwarding.cpp b/src/forwarding.cpp
new file mode 100644
index 0000000..269b257
--- /dev/null
+++ b/src/forwarding.cpp
@@ -0,0 +1,2280 @@
+/*
+  The forwarding engine of programs (forwarding.hpp): views, the injection, the lossless bound
+  and the loss rule.
+
+  A pooled program (one split context) called alone runs on its plan's kernels: allocate and the
+  T_max search for the bound, forward() with its attribution for the losses. Every other program
+  (tunnels and supplied split routes, each split route a one-root context), and every demand of a
+  SIMULTANEOUS list (lossy() over ForwardingDemand values, pooled ones included), runs on the
+  general network of one call: the union of the demands' live entries' links, each link with its
+  occurrences (a tunnel's hop, a split route's member; a pooled context's member once per source
+  whose traffic reaches it), and per split route its routers (a pooled router keeps one inflow per
+  source and attributes each member's amount to them by highest averages over their remaining
+  inflows). Each occurrence belongs to one demand, one source and one entry, so the loss rule
+  at a link is three levels of highest averages: demands (in creation order), sources, entries. A
+  demand's black holes make its occurrences there dark: what reaches one is dropped at once; a
+  dark occurrence shares, loads and waits on no link (Lossless reads a black-holed link as serving
+  0 instead).
+
+  The evaluation (A+): the loads U0 first, every demand forwarded with no link shared and its
+  traffic stopped at its own black holes; an occurrence that carries 0 there (a share of 0, a member
+  whose whole-unit share is 0, traffic behind its own black hole) is dead and takes no part in what
+  follows. Serial normalization marks the second link of every transparent pair (equal free
+  capacity, every live occurrence of the first continuing on the second and every live occurrence
+  of the second coming from the first, with nothing injected, absorbed, merged or split between
+  them, counting only the routers' live members) as a pass-through; every other link with U0 > V
+  is a barrier. The events are the barriers and the routers; an event waits for its predecessors
+  (a router for its in-members' carried amounts, a barrier for all its live arrivals, a tunnel's
+  next barrier for its previous one). Tarjan's algorithm groups them into strongly connected
+  components (SCCs), which run in dependency order, the smallest key first among the ready ones
+  ((0, smallest barrier EdgeId) for a group with a barrier, else (1, its first event)). A cyclic
+  group of b barriers is iterated from zero carried: one round replays the group's private
+  forwarding from the previous carried state x, then computes every new carry with the loss rule
+  into a separate state; equal states solve it, a state equal to the one two rounds before raises
+  the period-two error, and 64 b rounds without either raise the round-limit error. Once every
+  group is solved, a call that iterated checks the whole result independently (every router's
+  split, every link's rule and capacity, every continuation, the conservation of every entry)
+  before anything is returned.
+
+  Amounts are int64 units below 2^62: a demand's offer bounds its every arrival and load. A link's
+  sum over several demands is only compared with a free capacity below 2^62, so it saturates at
+  2^62. The per-thread scratch of the general network is rebuilt by every call before it is read.
+*/
+#include "netgraph/core/detail/forwarding.hpp"
+
+#include <algorithm>
+#include <limits>
+#include <queue>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <utility>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/sparse.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/strong_components.hpp"
+
+namespace netgraph::core::detail {
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+LossyCounters& thread_lossy_counters() noexcept {
+  thread_local LossyCounters c;
+  return c;
+}
+
+std::array<std::int64_t, 5>& thread_forwarding_limits() noexcept {
+  thread_local std::array<std::int64_t, 5> limits {};
+  return limits;
+}
+#endif
+
+void check_forwarding_count(ForwardingCounter counter, std::int64_t n) {
+  std::int64_t limit = kForwardingLimit;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  if (const auto lower = thread_forwarding_limits()[static_cast<std::size_t>(counter)]; lower > 0) limit = lower;
+#endif
+  if (n <= limit) return;
+  static constexpr const char* kNames[] = {"entry", "occurrence", "router", "event", "dependency"};
+  throw std::invalid_argument(std::string("forwarding ") + kNames[static_cast<std::size_t>(counter)] + " limit exceeded: " +
+                              std::to_string(n) + " > " + std::to_string(limit));
+}
+
+namespace {
+
+// ================================================================ the view
+
+bool has_black_holes(const Eligibility* dark) noexcept { return dark != nullptr && dark->uid() != 0; }
+
+// The roster slots that reach an allowed destination over their basis under the mask: one
+// reverse search from the allowed destinations over every allowed edge (topology), or per slot a
+// forward search over its own allowed basis edges.
+std::vector<std::uint8_t> replay_roster(const Graph& graph, const ProgramData& p, const std::vector<std::uint8_t>& edge_allowed,
+                                        const std::vector<std::uint8_t>& node_allowed,
+                                        const std::vector<std::uint8_t>& is_dst) {
+  const std::size_t k = p.reachable_sources.size();
+  std::vector<std::uint8_t> keep(k, 0);
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  if (p.uses_topology_basis) {
+    const auto in_row = graph.incoming_offsets();
+    const auto in_adj = graph.incoming_edges();
+    std::vector<std::uint8_t> seen(static_cast<std::size_t>(graph.num_nodes()), 0);
+    std::vector<NodeId> stack;
+    for (std::size_t v = 0; v < is_dst.size(); ++v) {
+      if (is_dst[v] != 0) {
+        seen[v] = 1;
+        stack.push_back(static_cast<NodeId>(v));
+      }
+    }
+    while (!stack.empty()) {
+      const auto v = static_cast<std::size_t>(stack.back());
+      stack.pop_back();
+      for (auto i = in_row[v]; i < in_row[v + 1]; ++i) {
+        const auto e = static_cast<std::size_t>(in_adj[static_cast<std::size_t>(i)]);
+        if (edge_allowed[e] == 0) continue;
+        const auto u = static_cast<std::size_t>(edge_sources[e]);
+        // A path stops at the first destination: a destination is not passed through.
+        if (seen[u] != 0 || is_dst[u] != 0) continue;
+        seen[u] = 1;
+        stack.push_back(static_cast<NodeId>(u));
+      }
+    }
+    for (std::size_t s = 0; s < k; ++s) {
+      const auto h = static_cast<std::size_t>(p.reachable_sources[s]);
+      keep[s] = node_allowed[h] != 0 && seen[h] != 0 ? 1 : 0;
+    }
+    return keep;
+  }
+  std::vector<std::uint8_t> seen(static_cast<std::size_t>(graph.num_nodes()), 0);
+  std::vector<NodeId> touched;
+  std::vector<NodeId> stack;
+  std::vector<std::pair<std::span<const EdgeId>, bool>> parts;
+  const auto row = graph.outgoing_offsets();
+  for (std::size_t s = 0; s < k; ++s) {
+    const NodeId h = p.reachable_sources[s];
+    if (node_allowed[static_cast<std::size_t>(h)] == 0) continue;
+    parts.clear();
+    p.basis_parts(s, parts);
+    // A forward search over the slot's allowed basis edges (an ascending part's edges of one tail
+    // are consecutive; a tunnel's path is scanned whole).
+    touched.assign(1, h);
+    stack.assign(1, h);
+    seen[static_cast<std::size_t>(h)] = 1;
+    bool reached = false;
+    auto visit = [&](EdgeId x) {
+      const auto e = static_cast<std::size_t>(x);
+      if (edge_allowed[e] == 0) return;
+      const auto v = static_cast<std::size_t>(edge_destinations[e]);
+      if (is_dst[v] != 0) {
+        reached = true;
+        return;
+      }
+      if (seen[v] != 0) return;
+      seen[v] = 1;
+      touched.push_back(static_cast<NodeId>(v));
+      stack.push_back(static_cast<NodeId>(v));
+    };
+    while (!stack.empty() && !reached) {
+      const NodeId u = stack.back();
+      stack.pop_back();
+      const auto lo = row[static_cast<std::size_t>(u)];
+      const auto hi = row[static_cast<std::size_t>(u) + 1];
+      for (const auto& [part, ascending] : parts) {
+        if (ascending) {
+          for (auto it = std::lower_bound(part.begin(), part.end(), lo); it != part.end() && *it < hi && !reached; ++it) visit(*it);
+        } else {
+          for (EdgeId x : part) {
+            if (x >= lo && x < hi && !reached) visit(x);
+          }
+        }
+      }
+    }
+    for (NodeId v : touched) seen[static_cast<std::size_t>(v)] = 0;
+    keep[s] = reached ? 1 : 0;
+  }
+  return keep;
+}
+
+// An edge set under the mask, pruned to the walks from `source` to the allowed destinations, as a
+// record route with its cost (an empty DAG and kUnreachable when nothing remains).
+std::pair<std::shared_ptr<const PredecessorDAG>, Cost> masked_route(const Graph& graph, std::span<const EdgeId> edges, NodeId source,
+                                                             std::span<const NodeId> destinations, const Eligibility* eligibility) {
+  const PredecessorDAG dag = PredecessorDAGBuilder::of_edges(graph, edges);
+  auto kept = prune(graph, dag, source, destinations, eligibility);
+  if (kept.empty()) return {std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::empty(graph)), kUnreachable};
+  auto out = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(graph, kept));
+  return {out, min_route_cost(graph, *out, source, destinations)};
+}
+
+void source_weight_width(ForwardingView& v) noexcept {
+  U128 sum {};
+  for (Amount w : v.source_weights()) sum = add(sum, U128 {0, static_cast<std::uint64_t>(w)});
+  v.wide_source_weights = sum.hi != 0 || sum.lo >= static_cast<std::uint64_t>(kDomainLimit);
+}
+
+void finish_view(ForwardingView& v) {
+  source_weight_width(v);
+  const ProgramData& p = *v.data;
+  // The surviving entries per view head, ascending index.
+  v.source_entry_offsets_.assign(v.source_indices_.size() + 1, 0);
+  v.source_entry_positions_.clear();
+  for (std::size_t h = 0; h < v.source_indices_.size(); ++h) {
+    for (std::int32_t e : p.entries_for_source(static_cast<std::size_t>(v.source_indices_[h]))) {
+      if (v.status_[static_cast<std::size_t>(e)] != TunnelStatus::Failed) v.source_entry_positions_.push_back(e);
+    }
+    v.source_entry_offsets_[h + 1] = static_cast<std::int32_t>(v.source_entry_positions_.size());
+  }
+  // Black holes: the black-holed heads, and every up tunnel whose path reaches one.
+  v.blackholed_sources_.clear();
+  if (v.black_holes != nullptr) {
+    v.blackholed_sources_.assign(v.source_indices_.size(), 0);
+    for (std::size_t h = 0; h < v.source_indices_.size(); ++h) v.blackholed_sources_[h] = v.black_holes->allows_node(v.source(h)) ? 0 : 1;
+    for (std::size_t t = 0; t < p.tunnels.size(); ++t) {
+      const auto e = static_cast<std::size_t>(p.tunnel_entry_positions[t]);
+      if (v.status_[e] != TunnelStatus::Up) continue;
+      // An edge is black-holed when the Eligibility disallows it (itself or an endpoint).
+      for (EdgeId x : path_of(p.tunnels[t])) {
+        if (!v.black_holes->allows_edge(x)) {
+          v.status_[e] = TunnelStatus::Blackholed;
+          break;
+        }
+      }
+    }
+  }
+}
+
+// A borrowed view's state written out (the program's own: every head, every entry up), for a
+// view that then changes it (black holes).
+void materialize(ForwardingView& v) {
+  if (!v.borrowed) return;
+  const ProgramData& p = *v.data;
+  const std::size_t n = p.entries.size();
+  v.source_indices_.resize(p.reachable_sources.size());
+  for (std::size_t s = 0; s < p.reachable_sources.size(); ++s) v.source_indices_[s] = static_cast<std::int32_t>(s);
+  v.source_weights_ = p.source_weight_values;
+  v.status_.resize(n);
+  v.routes_.resize(n);
+  v.min_route_costs_.resize(n);
+  v.context_source_indices_.resize(n);
+  for (std::size_t e = 0; e < n; ++e) {
+    v.status_[e] = v.status(e);
+    v.routes_[e] = p.entries[e].route;
+    v.min_route_costs_[e] = p.entries[e].min_route_cost;
+    v.context_source_indices_[e] = v.context_source_index(e);
+  }
+  v.prepared_routes_.clear();
+  for (const auto& c : p.split_contexts) v.prepared_routes_.push_back(c.prepared_route);
+  v.borrowed = false;
+}
+
+} // namespace
+
+ForwardingView make_forwarding_view(const Graph& graph, std::shared_ptr<const ForwardingProgram> program, const Eligibility* mask,
+                         std::span<const NodeId> destinations, const Eligibility* dark, bool records) {
+  ForwardingView v;
+  v.data = &ProgramAccess::data(*program);
+  v.program = std::move(program);
+  v.black_holes = has_black_holes(dark) ? dark : nullptr;
+  const ProgramData& p = *v.data;
+  const std::size_t n = p.entries.size();
+  v.pooled = p.pools_source_inflows;
+  if (mask == nullptr || mask->uid() == 0) {
+    // The program's own state: its roster, its routes and plans, borrowed from the program (a
+    // tunnel's record route is made here; black holes change the statuses).
+    v.borrowed = true;
+    if (v.black_holes == nullptr && !(records && !p.tunnels.empty())) {
+      source_weight_width(v);
+      return v;
+    }
+    materialize(v);
+    for (std::size_t e = 0; records && e < n; ++e) {
+      if (p.entries[e].tunnel_position < 0) continue;
+      const auto path = path_of(p.tunnels[static_cast<std::size_t>(p.entries[e].tunnel_position)]);
+      v.routes_[e] = std::make_shared<const PredecessorDAG>(path.empty() ? PredecessorDAGBuilder::empty(graph) : PredecessorDAGBuilder::of_edges(graph, path));
+    }
+    finish_view(v);
+    return v;
+  }
+  v.status_.assign(n, TunnelStatus::Up);
+  v.routes_.resize(n);
+  v.min_route_costs_.assign(n, kUnreachable);
+  v.context_source_indices_.assign(n, -1);
+  // The replay: the mask and the program's own exclusions together.
+  const auto num_nodes = static_cast<std::size_t>(graph.num_nodes());
+  const auto num_edges = static_cast<std::size_t>(graph.num_edges());
+  std::vector<std::uint8_t> node_allowed(num_nodes, 0);
+  std::vector<std::uint8_t> edge_allowed(num_edges, 0);
+  for (std::size_t x = 0; x < num_nodes; ++x) node_allowed[x] = mask->allows_node(static_cast<NodeId>(x)) ? 1 : 0;
+  for (NodeId x : p.excluded_nodes) node_allowed[static_cast<std::size_t>(x)] = 0;
+  for (std::size_t e = 0; e < num_edges; ++e) edge_allowed[e] = mask->allows_edge(static_cast<EdgeId>(e)) ? 1 : 0;
+  for (EdgeId e : p.excluded_edges) edge_allowed[static_cast<std::size_t>(e)] = 0;
+  std::vector<NodeId> live_dests;
+  std::vector<std::uint8_t> is_dst(num_nodes, 0);
+  for (NodeId d : destinations) {
+    if (node_allowed[static_cast<std::size_t>(d)] == 0) continue;
+    live_dests.push_back(d);
+    is_dst[static_cast<std::size_t>(d)] = 1;
+  }
+  // The program's exclusions as an Eligibility of the replay (null when the program has none).
+  std::optional<Eligibility> both;
+  const Eligibility* replay = mask;
+  if (!p.excluded_nodes.empty() || !p.excluded_edges.empty()) {
+    both = Eligibility::intersect(*mask, graph.eligibility(p.excluded_nodes, p.excluded_edges));
+    replay = &*both;
+  }
+  const auto keep = replay_roster(graph, p, edge_allowed, node_allowed, is_dst);
+  for (std::size_t s = 0; s < p.reachable_sources.size(); ++s) {
+    if (keep[s] == 0) continue;
+    v.source_indices_.push_back(static_cast<std::int32_t>(s));
+    if (!p.source_weight_values.empty()) v.source_weights_.push_back(p.source_weight_values[s]);
+  }
+  std::vector<std::int32_t> view_head(p.reachable_sources.size(), -1);
+  for (std::size_t h = 0; h < v.source_indices_.size(); ++h) view_head[static_cast<std::size_t>(v.source_indices_[h])] = static_cast<std::int32_t>(h);
+  // Entries: a tunnel fails when it touches an excluded node or edge (an edge is excluded with its
+  // endpoints); a split route keeps its allowed edges on the walks from its head to an allowed
+  // destination and fails when none remains. Every entry of a head outside the replay roster fails.
+  // A tunnel that setup left down stays down with its status (replay never brings one up).
+  for (std::size_t e = 0; e < n; ++e) {
+    const auto& entry = p.entries[e];
+    bool failed = view_head[static_cast<std::size_t>(entry.roster_index)] < 0;
+    if (entry.tunnel_position >= 0) {
+      const auto& t = p.tunnels[static_cast<std::size_t>(entry.tunnel_position)];
+      if (t.status != TunnelStatus::Up) {
+        v.status_[e] = t.status;
+        if (records) v.routes_[e] = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::empty(graph));
+        continue;
+      }
+      for (EdgeId x : path_of(t)) failed = failed || edge_allowed[static_cast<std::size_t>(x)] == 0;
+      if (!failed) {
+        if (records) v.routes_[e] = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_edges(graph, path_of(t)));
+        v.min_route_costs_[e] = entry.min_route_cost;
+      }
+    } else if (!failed) {
+      // A split route's route under the mask (its edges before weight pruning).
+      const auto edges = PredecessorDAGBuilder::ascending(*entry.route);
+      auto [route, cost] = masked_route(graph, edges, entry.head, live_dests, replay);
+      failed = cost == kUnreachable;
+      v.routes_[e] = std::move(route);
+      v.min_route_costs_[e] = cost;
+    }
+    if (failed) {
+      v.status_[e] = TunnelStatus::Failed;
+      v.routes_[e] = records ? std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::empty(graph)) : nullptr;
+      v.min_route_costs_[e] = kUnreachable;
+    }
+  }
+  // The split contexts restricted to the mask, rooted at their surviving entries' heads.
+  v.prepared_routes_.reserve(p.split_contexts.size());
+  std::vector<NodeId> roots;
+  std::vector<std::int32_t> entries;
+  for (const auto& c : p.split_contexts) {
+    roots.clear();
+    entries.clear();
+    for (std::size_t r = 0; r < c.source_entry_positions.size(); ++r) {
+      const auto e = static_cast<std::size_t>(c.source_entry_positions[r]);
+      if (v.status_[e] == TunnelStatus::Failed) continue;
+      roots.push_back(c.prepared_route->sources[r]);
+      entries.push_back(c.source_entry_positions[r]);
+    }
+    v.prepared_routes_.push_back(std::make_shared<const PreparedRoute>(restrict_prepared_route(graph, *c.prepared_route, roots, live_dests, replay)));
+    for (std::size_t r = 0; r < entries.size(); ++r) v.context_source_indices_[static_cast<std::size_t>(entries[r])] = static_cast<std::int32_t>(r);
+  }
+  finish_view(v);
+  return v;
+}
+
+ForwardingView with_black_holes(const ForwardingView& view, const Eligibility* dark) {
+  ForwardingView v = view;
+  v.black_holes = has_black_holes(dark) ? dark : nullptr;
+  if (v.borrowed && v.black_holes == nullptr) return v;
+  materialize(v);
+  // The statuses again from the replay's (a black hole never fails a tunnel; a mask does).
+  for (std::size_t t = 0; t < v.data->tunnels.size(); ++t) {
+    const auto e = static_cast<std::size_t>(v.data->tunnel_entry_positions[t]);
+    if (v.status_[e] == TunnelStatus::Blackholed) v.status_[e] = TunnelStatus::Up;
+  }
+  finish_view(v);
+  return v;
+}
+
+// ================================================================ the injection
+
+void source_shares(const ForwardingView& view, Amount x, std::span<Amount> out) {
+  std::fill(out.begin(), out.end(), 0);
+  if (out.empty()) return;
+  if (view.source_weights().empty()) {
+    (void)round_robin(x, out);
+  } else {
+    highest_averages(x, view.source_weights(), out);
+  }
+}
+
+void source_offer_increments(const ForwardingView& view, const Counter128& X, Amount v, std::span<Amount> out) {
+  const std::size_t k = out.size();
+  std::fill(out.begin(), out.end(), 0);
+  if (k == 0) return;
+  const auto weights = view.source_weights();
+  if (weights.empty()) {
+    round_robin_increments(X, v, out);
+    return;
+  }
+  if (view.wide_source_weights) {
+    const U128 x {X.hi, X.lo};
+    std::vector<U128> a(k), b(k);
+    highest_averages(x, weights, a);
+    highest_averages(add(x, U128 {0, static_cast<std::uint64_t>(v)}), weights, b);
+    // House monotonicity: every difference is nonnegative and at most v < 2^62.
+    for (std::size_t i = 0; i < k; ++i) out[i] = static_cast<Amount>(sub(b[i], a[i]).lo);
+    return;
+  }
+  // H(X + c W) = H(X) + c w (the divisor rule's thresholds shift by c), so only r = X mod W and
+  // r + v enter: H(X + v) - H(X) = floor((r + v) / W) w + H((r + v) mod W) - H(r). Captured
+  // weights here have sum W < 2^62 (in particular every optimized controller's
+  // solved supplies), so W, r + v and c w fit 64 bits. Declared weights with a
+  // larger sum take the wide branch above; no narrowing of their sum is allowed.
+  std::uint64_t W = 0;
+  for (Amount w : weights) W += static_cast<std::uint64_t>(w);
+  if (W == 0) return;
+  const std::uint64_t r = mod_u128(U128 {X.hi, X.lo}, W);
+  const std::uint64_t t = r + static_cast<std::uint64_t>(v);
+  const auto c = static_cast<Amount>(t / W);
+  std::vector<Amount> a(k);
+  std::vector<Amount> b(k);
+  highest_averages(static_cast<Amount>(r), weights, a);
+  highest_averages(static_cast<Amount>(t % W), weights, b);
+  for (std::size_t i = 0; i < k; ++i) out[i] = c * weights[i] + b[i] - a[i];
+}
+
+namespace {
+
+// Each head's share over its surviving entries (highest averages by weight) into `share` (per
+// program entry); what a head cannot place (black-holed, no surviving entry of positive weight)
+// goes to `source_drops_by_source`.
+void entry_shares(const ForwardingView& view, std::span<const Amount> heads, std::vector<Amount>& share,
+                  std::vector<Amount>& source_drops_by_source, std::vector<Amount>& w, std::vector<Amount>& part) {
+  const ProgramData& p = *view.data;
+  share.assign(p.entries.size(), 0);
+  source_drops_by_source.assign(heads.size(), 0);
+  for (std::size_t h = 0; h < heads.size(); ++h) {
+    const Amount x = heads[h];
+    if (x == 0) continue;
+    if (view.is_blackholed_source(h)) {
+      source_drops_by_source[h] = x;
+      continue;
+    }
+    const auto entries = view.entries_for_source(h);
+    w.resize(entries.size());
+    bool positive = false;  // a weight sum may exceed 2^63: only whether one weight is positive
+    for (std::size_t i = 0; i < entries.size(); ++i) {
+      w[i] = p.entries[static_cast<std::size_t>(entries[i])].weight;
+      positive = positive || w[i] > 0;
+    }
+    if (!positive) {
+      source_drops_by_source[h] = x;
+      continue;
+    }
+    part.resize(entries.size());
+    highest_averages(x, w, part);
+    for (std::size_t i = 0; i < entries.size(); ++i) share[static_cast<std::size_t>(entries[i])] = part[i];
+  }
+}
+
+void sort_pairs(std::vector<std::pair<EdgeId, Amount>>& v) {
+  std::sort(v.begin(), v.end(), [](const auto& a, const auto& b) { return a.first < b.first; });
+}
+
+// A forwarding's outcome before anything is sent; the heads' own losses only for Lossy (no
+// Lossless forwarding loses anything).
+ProgramFlow empty_flow(const ForwardingView& view, bool lossy) {
+  ProgramFlow out;
+  out.entries.resize(view.data->entries.size());
+  out.offered_by_source.assign(view.num_sources(), 0);
+  if (lossy) out.source_drops_by_source.assign(view.num_sources(), 0);
+  return out;
+}
+
+// ================================================================ the pooled form
+
+// The free capacity of the pooled plan's members with the black holes at 0.
+void pooled_view(const PreparedRoute& plan, const ForwardingView& view, const AvailableCapacityFn& free, std::vector<Amount>& out) {
+  out.resize(plan.forwarding_edges.size());
+  free(plan.forwarding_edges, out);
+  if (view.black_holes == nullptr) return;
+  for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+    if (!view.black_holes->allows_edge(plan.forwarding_edges[m])) out[m] = 0;
+  }
+}
+
+// The pooled form's per-root amounts as entry flows (root r carries entry source_entry_positions[r]).
+void pooled_entries(const ForwardingView& view, const PreparedRoute& plan, const Attribution* attr,
+                    std::span<const Amount> alloc, std::span<const Amount> drops, ProgramFlow& out) {
+  for (std::size_t h = 0; h < view.num_sources(); ++h) {
+    const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+    auto& f = out.entries[e];
+    if (attr == nullptr) {
+      // One root holds the whole forwarding (the attribution's degenerate form).
+      f.edge_flows = nonzero_pairs(plan.forwarding_edges, alloc);
+      if (!drops.empty()) f.edge_drops = nonzero_pairs(plan.forwarding_edges, drops);
+      continue;
+    }
+    for (const auto& x : attr->entries[h]) {
+      const EdgeId edge = plan.forwarding_edges[static_cast<std::size_t>(x.edge_position)];
+      if (x.carried != 0) f.edge_flows.emplace_back(edge, x.carried);
+      if (x.drops != 0) f.edge_drops.emplace_back(edge, x.drops);
+    }
+  }
+}
+
+// The first black-holed head's index (the equal injection gives head i a unit from total i + 1),
+// or the number of heads.
+Amount black_hole_offer_cap(const ForwardingView& view) {
+  for (std::size_t h = 0; h < view.num_sources(); ++h) {
+    if (view.is_blackholed_source(h)) return static_cast<Amount>(h);
+  }
+  return std::numeric_limits<Amount>::max();
+}
+
+ProgramFlow pooled_lossless(const ForwardingView& view, const AvailableCapacityFn& free, Amount lo, std::optional<Amount> hi) {
+  const PreparedRoute& plan = *view.prepared_route(0);
+  ProgramFlow out = empty_flow(view, false);
+  const std::size_t k = view.num_sources();
+  // A black-holed head may receive nothing: the total stays at most its index.
+  const Amount cap = std::min(hi.value_or(std::numeric_limits<Amount>::max()), black_hole_offer_cap(view));
+  std::vector<Amount> V;
+  pooled_view(plan, view, free, V);
+  std::vector<Amount> own(plan.forwarding_edges.size(), 0);
+  if (lo != 0 && !allocate(plan, lo, own)) throw std::logic_error("forwarding: the admitted total does not fit");
+  Amount total = lo;
+  if (cap > lo && !plan.forwarding_edges.empty()) {
+    const std::optional<Amount> request =
+        cap == std::numeric_limits<Amount>::max() ? std::nullopt : std::optional<Amount>(cap - lo);
+    auto step = lossless_step(plan, lo, V, own, request);
+    total = step.admitted;
+    own = std::move(step.edge_flows);
+  }
+  out.admitted = total;
+  source_shares(view, total, out.offered_by_source);
+  out.offered = total;
+  out.delivered = total;
+  for (std::size_t h = 0; h < k; ++h) {
+    const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+    out.entries[e].assigned = out.offered_by_source[h];
+    out.entries[e].delivered = out.offered_by_source[h];
+  }
+  if (k > 1 && total > 0) {
+    // Several roots: forward the total again to attribute it.
+    Attribution attr;
+    const auto fw = forward(plan, Injection {out.offered_by_source, false}, {}, &attr);
+    if (fw.edge_flows != own) throw std::logic_error("forwarding: the attributed loads differ from the admitted ones");
+    pooled_entries(view, plan, &attr, {}, {}, out);
+  } else if (k == 1) {
+    pooled_entries(view, plan, nullptr, own, {}, out);
+  }
+  return out;
+}
+
+ProgramFlow pooled_lossy(const ForwardingView& view, const AvailableCapacityFn& free, std::span<const Amount> injections) {
+  const PreparedRoute& plan = *view.prepared_route(0);
+  ProgramFlow out = empty_flow(view, true);
+  const std::size_t k = view.num_sources();
+  std::vector<Amount> inject(injections.begin(), injections.end());
+  for (std::size_t h = 0; h < k; ++h) {
+    out.offered_by_source[h] = injections[h];
+    out.offered += injections[h];
+    if (view.is_blackholed_source(h)) {
+      // A black-holed head loses its own share at the source.
+      out.source_drops_by_source[h] = injections[h];
+      out.source_drops += injections[h];
+      inject[h] = 0;
+    }
+  }
+  out.admitted = out.offered;
+  std::vector<Amount> V;
+  pooled_view(plan, view, free, V);
+  Attribution attr;
+  const auto fw = forward(plan, Injection {inject, false}, V, k > 1 ? &attr : nullptr);
+  out.source_drops += fw.source_drops;
+  out.delivered = fw.delivered;
+  for (std::size_t h = 0; h < k; ++h) {
+    const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+    auto& f = out.entries[e];
+    f.assigned = inject[h];
+    if (k > 1) {
+      f.delivered = attr.delivered[h];
+      f.source_drops = attr.source_drops_by_source[h];
+    } else {
+      f.delivered = fw.delivered;
+      f.source_drops = fw.source_drops;
+    }
+  }
+  pooled_entries(view, plan, k > 1 ? &attr : nullptr, fw.edge_flows, fw.edge_drops, out);
+  return out;
+}
+
+// ================================================================ the general network
+
+// A link sum over several demands can pass 2^63 (each demand's arrivals at a link stay below its
+// offer, below 2^62); every such sum is only compared with a free capacity below 2^62, so it
+// saturates at 2^62, exact for every comparison.
+constexpr Amount kSumCap = Amount {1} << 62;
+Amount saturating_add(Amount a, Amount b) noexcept { return b >= kSumCap - a ? kSumCap : a + b; }
+
+// The live entries of one forwarding of one or more demands (each surviving, of positive weight,
+// with a usable route) and the union of their links. An item is a tunnel (its occurrences are its
+// hops in path order), a one-root split route (its plan's members), or a pooled context (one item
+// for the whole context: an occurrence per member and per head whose traffic can reach that
+// member, by member then head, and per router position that is no destination a slot per head
+// reaching it, which holds that head's inflow there). Items are ordered by (demand, head, entry
+// index), so each link's occurrences come out in the loss rule's order. An occurrence on a link
+// its demand's black holes exclude is dark (LOSSY only): it belongs to no link's list, so it never
+// shares, loads or blocks that link; what reaches it is dropped there. LOSSLESS keeps no dark
+// occurrence: a black-holed link serves 0 (the lossless bound).
+struct ForwardingNetwork {
+  struct Item {
+    std::int32_t demand {0};
+    std::int32_t entry_position {-1};  // its program entry (a pooled context: -1, one entry per head)
+    std::int32_t source_index {0};     // view head (a pooled context: its first)
+    std::int32_t tunnel_position {-1};
+    const PreparedRoute* prepared_route {nullptr};
+    std::int32_t source_position {-1};  // a one-root split route: its root's plan position
+    bool pooled {false};
+    std::int32_t first_occurrence {0};      // its first occurrence
+    std::int32_t num_occurrences {0};
+    std::int32_t first_router_position {0};  // its first router (split routes: one per plan position)
+    std::size_t first_member {0};    // pooled: its members' entries in member_occurrence_offsets (members + 1)
+    std::size_t first_position {0};  // pooled: its positions' entries in slot_offsets (positions + 1)
+    // A one-root split route's entry whose root is not in its plan: its share has no route.
+    [[nodiscard]] bool routeless() const noexcept { return tunnel_position < 0 && !pooled && source_position < 0; }
+    [[nodiscard]] std::int32_t num_routers() const noexcept {
+      return prepared_route == nullptr ? 0 : static_cast<std::int32_t>(prepared_route->topological_order.size());
+    }
+  };
+  std::vector<const ForwardingView*> views;  // per demand
+  std::vector<Item> entry_occurrences;
+  // Per demand, per program entry: its item, or -1 (not forwarded), or -2 (a share with no route).
+  std::vector<std::vector<std::int32_t>> entry_occurrence_positions;
+  std::vector<EdgeId> edges;          // ascending
+  std::vector<Amount> available_capacity;              // per link
+  std::vector<std::int32_t> occurrence_edge_positions; // per occurrence
+  std::vector<std::int32_t> occurrence_entry_positions;  // per occurrence: its item
+  std::vector<std::int32_t> occurrence_route_positions;  // tunnel: hop; split route: member
+  std::vector<std::int32_t> occurrence_heads;            // per occurrence: its view head
+  std::vector<std::uint8_t> occurrence_dark;             // per occurrence: dropped where it arrives (empty: none can be)
+  bool any_dark {false};                                 // some occurrence is dark
+  std::int64_t max_link_occurrences {0};                 // the most sharing occurrences of one link
+  std::vector<std::int32_t> edge_occurrence_offsets;  // per link + 1 into occurrences_by_edge
+  std::vector<std::int32_t> occurrences_by_edge;     // the sharing occurrences, by (demand, head, entry)
+  std::int32_t num_router_positions {0};
+  std::vector<std::int32_t> router_entry_positions;    // per router position: its item
+  // Pooled contexts: per member its first occurrence (members + 1 per item); per position its
+  // first slot (positions + 1 per item; a destination has none); per slot its head; per
+  // occurrence of a pooled item the slot of its member's head position for its head (-1 at a
+  // destination; -1 for other items).
+  std::vector<std::int32_t> member_occurrence_offsets;
+  std::vector<std::int32_t> slot_offsets;
+  std::vector<std::int32_t> slot_heads;
+  std::vector<std::int32_t> occurrence_slots;  // empty without a pooled context
+  [[nodiscard]] bool dark(std::size_t o) const noexcept { return any_dark && occurrence_dark[o] != 0; }
+  std::vector<std::int32_t> member_tail_positions;  // pooled: per member (aligned with member_occurrence_offsets) its tail position
+};
+
+std::int32_t edge_position(const ForwardingNetwork& net, EdgeId e) {
+  return static_cast<std::int32_t>(std::lower_bound(net.edges.begin(), net.edges.end(), e) - net.edges.begin());
+}
+
+// A pooled view's heads as roots of its plan: per view head, its root's plan position (-1: no
+// member, its share has no route).
+std::vector<std::int32_t> pooled_root_positions(const ForwardingView& view) {
+  const PreparedRoute& plan = *view.prepared_route(0);
+  std::vector<std::int32_t> out(view.num_sources(), -1);
+  for (std::size_t h = 0; h < out.size(); ++h) {
+    const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+    const auto r = view.context_source_index(e);
+    if (r >= 0) out[h] = plan.source_positions[static_cast<std::size_t>(r)];
+  }
+  return out;
+}
+
+// Every entry of a non-pooled forwarding with a positive weight, by (head, entry index), to
+// `visit` as its item before its positions in the network are set (first_occurrence,
+// first_router_position): a tunnel with its hops, or a split route with its root's position in
+// the plan and its members (none when routeless).
+template <class Visit>
+void for_each_forwarded_entry(const ForwardingView& view, Visit&& visit) {
+  const ProgramData& p = *view.data;
+  for (std::size_t h = 0; h < view.num_sources(); ++h) {
+    for (const std::int32_t ei : view.entries_for_source(h)) {
+      const auto e = static_cast<std::size_t>(ei);
+      const auto& entry = p.entries[e];
+      if (entry.weight == 0) continue;
+      ForwardingNetwork::Item it;
+      it.entry_position = ei;
+      it.source_index = static_cast<std::int32_t>(h);
+      if (entry.tunnel_position >= 0) {
+        it.tunnel_position = entry.tunnel_position;
+        it.num_occurrences = static_cast<std::int32_t>(path_of(p.tunnels[static_cast<std::size_t>(entry.tunnel_position)]).size());
+      } else {
+        it.prepared_route = view.prepared_route(static_cast<std::size_t>(entry.split_context_position)).get();
+        const auto r = view.context_source_index(e);
+        it.source_position = r < 0 ? -1 : it.prepared_route->source_positions[static_cast<std::size_t>(r)];
+        if (it.source_position >= 0) it.num_occurrences = static_cast<std::int32_t>(it.prepared_route->forwarding_edges.size());
+      }
+      visit(it);
+    }
+  }
+}
+
+// A pooled plan's per-member tails (each member's tail position).
+std::vector<std::int32_t> member_tails(const PreparedRoute& plan) {
+  std::vector<std::int32_t> tail(plan.forwarding_edges.size(), -1);
+  for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+    for (auto m = plan.outgoing_begin[pos]; m < plan.outgoing_end[pos]; ++m) tail[static_cast<std::size_t>(m)] = static_cast<std::int32_t>(pos);
+  }
+  return tail;
+}
+
+// A pooled context's counts before anything of the network is allocated: its forwarded entries
+// (the heads with a route) and its occurrences (per such head, the members its traffic can reach:
+// the members whose tail it reaches in the plan). Exact, in 64 bits.
+std::pair<std::int64_t, std::int64_t> pooled_counts(const ForwardingView& view) {
+  const PreparedRoute& plan = *view.prepared_route(0);
+  const auto roots = pooled_root_positions(view);
+  const std::size_t P = plan.topological_order.size();
+  std::vector<std::int32_t> seen(P, -1);
+  std::vector<std::int32_t> stack;
+  std::int64_t entries = 0;
+  std::int64_t occurrences = 0;
+  for (std::size_t h = 0; h < roots.size(); ++h) {
+    if (roots[h] < 0) continue;
+    ++entries;
+    stack.assign(1, roots[h]);
+    seen[static_cast<std::size_t>(roots[h])] = static_cast<std::int32_t>(h);
+    while (!stack.empty()) {
+      const auto pos = static_cast<std::size_t>(stack.back());
+      stack.pop_back();
+      occurrences += plan.outgoing_end[pos] - plan.outgoing_begin[pos];
+      for (auto m = plan.outgoing_begin[pos]; m < plan.outgoing_end[pos]; ++m) {
+        const auto q = static_cast<std::size_t>(plan.edge_destination_positions[static_cast<std::size_t>(m)]);
+        if (seen[q] == static_cast<std::int32_t>(h)) continue;
+        seen[q] = static_cast<std::int32_t>(h);
+        stack.push_back(static_cast<std::int32_t>(q));
+      }
+    }
+  }
+  return {entries, occurrences};
+}
+
+// The network of `views` (one per demand, in the loss rule's demand order) on `free`. `lossy`: black
+// holes make dark occurrences; otherwise a black-holed link serves 0 (the lossless bound).
+ForwardingNetwork build_forwarding_network(std::span<const ForwardingView* const> views, const AvailableCapacityFn& free,
+                                           bool lossy) {
+  // The network's counts, exactly, after validation and before any of its arrays is sized: the
+  // forwarded entries (positive weight, with a route; a pooled context's heads with a route), their
+  // occurrences and the split routes' routers (a pooled context's once). A refusal changes nothing.
+  std::int64_t num_entries = 0;
+  std::int64_t num_occurrences = 0;
+  std::int64_t num_routers = 0;
+  for (const ForwardingView* view : views) {
+    if (view->pooled) {
+      const auto [e, o] = pooled_counts(*view);
+      num_entries += e;
+      num_occurrences += o;
+      num_routers += static_cast<std::int64_t>(view->prepared_route(0)->topological_order.size());
+      continue;
+    }
+    for_each_forwarded_entry(*view, [&](const ForwardingNetwork::Item& it) {
+      if (it.routeless()) return;
+      ++num_entries;
+      num_occurrences += it.num_occurrences;
+      num_routers += it.num_routers();
+    });
+  }
+  check_forwarding_count(ForwardingCounter::Entry, num_entries);
+  check_forwarding_count(ForwardingCounter::Occurrence, num_occurrences);
+  check_forwarding_count(ForwardingCounter::Router, num_routers);
+  ForwardingNetwork net;
+  net.views.assign(views.begin(), views.end());
+  net.entry_occurrence_positions.resize(views.size());
+  for (std::size_t d = 0; d < views.size(); ++d) {
+    const ForwardingView& view = *views[d];
+    auto& positions = net.entry_occurrence_positions[d];
+    positions.assign(view.data->entries.size(), -1);
+    if (view.pooled) {
+      ForwardingNetwork::Item it;
+      it.demand = static_cast<std::int32_t>(d);
+      it.pooled = true;
+      it.prepared_route = view.prepared_route(0).get();
+      it.first_router_position = net.num_router_positions;
+      net.num_router_positions += it.num_routers();
+      const auto roots = pooled_root_positions(view);
+      bool any = false;
+      for (std::size_t h = 0; h < roots.size(); ++h) {
+        const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+        if (roots[h] < 0) {
+          positions[e] = -2;  // its share has no route: lost at the source
+          continue;
+        }
+        if (!any) it.source_index = static_cast<std::int32_t>(h);
+        any = true;
+        positions[e] = static_cast<std::int32_t>(net.entry_occurrences.size());
+      }
+      net.entry_occurrences.push_back(it);
+      continue;
+    }
+    for_each_forwarded_entry(view, [&](ForwardingNetwork::Item it) {
+      it.demand = static_cast<std::int32_t>(d);
+      const auto e = static_cast<std::size_t>(it.entry_position);
+      if (it.routeless()) {
+        positions[e] = -2;  // its share has no route: lost at the source
+        return;
+      }
+      if (it.prepared_route != nullptr) {
+        it.first_router_position = net.num_router_positions;
+        net.num_router_positions += it.num_routers();
+      }
+      positions[e] = static_cast<std::int32_t>(net.entry_occurrences.size());
+      net.entry_occurrences.push_back(it);
+    });
+  }
+  // Pooled contexts: the heads reaching each position (in topological order: its roots and the
+  // heads of its in-members' tails), the members' occurrences and the positions' slots.
+  std::vector<HeadLabelOffset> heads_offsets;  // per position of the current item + 1
+  std::vector<std::int32_t> heads;          // the heads per position, ascending
+  std::vector<std::int32_t> stamp;
+  std::vector<std::int32_t> in_offsets;
+  std::vector<std::int32_t> in_members;
+  std::int32_t nocc = 0;
+  for (auto& it : net.entry_occurrences) {
+    it.first_occurrence = nocc;
+    if (!it.pooled) {
+      nocc += it.num_occurrences;
+      continue;
+    }
+    const ForwardingView& view = *net.views[static_cast<std::size_t>(it.demand)];
+    const PreparedRoute& plan = *it.prepared_route;
+    const std::size_t P = plan.topological_order.size();
+    const std::size_t M = plan.forwarding_edges.size();
+    const auto roots = pooled_root_positions(view);
+    const auto tails = member_tails(plan);
+    in_offsets.assign(P + 1, 0);
+    for (std::size_t m = 0; m < M; ++m) ++in_offsets[static_cast<std::size_t>(plan.edge_destination_positions[m]) + 1];
+    for (std::size_t q = 0; q < P; ++q) in_offsets[q + 1] += in_offsets[q];
+    in_members.resize(M);
+    {
+      std::vector<std::int32_t> fill(in_offsets.begin(), in_offsets.end() - 1);
+      for (std::size_t m = 0; m < M; ++m) in_members[static_cast<std::size_t>(fill[static_cast<std::size_t>(plan.edge_destination_positions[m])]++)] = static_cast<std::int32_t>(m);
+    }
+    std::vector<std::vector<std::int32_t>> roots_at(P);
+    for (std::size_t h = 0; h < roots.size(); ++h) {
+      if (roots[h] >= 0) roots_at[static_cast<std::size_t>(roots[h])].push_back(static_cast<std::int32_t>(h));
+    }
+    stamp.assign(roots.size(), -1);
+    heads_offsets.assign(P + 1, 0);
+    heads.clear();
+    for (std::size_t q = 0; q < P; ++q) {
+      const auto first = heads.size();
+      auto add = [&](std::int32_t h) {
+        if (stamp[static_cast<std::size_t>(h)] == static_cast<std::int32_t>(q)) return;
+        stamp[static_cast<std::size_t>(h)] = static_cast<std::int32_t>(q);
+        heads.push_back(h);
+      };
+      for (auto h : roots_at[q]) add(h);
+      for (auto i = in_offsets[q]; i < in_offsets[q + 1]; ++i) {
+        const auto t = static_cast<std::size_t>(tails[static_cast<std::size_t>(in_members[static_cast<std::size_t>(i)])]);
+        for (auto k = heads_offsets[t]; k < heads_offsets[t + 1]; ++k) add(heads[static_cast<std::size_t>(k)]);
+      }
+      std::sort(heads.begin() + static_cast<std::ptrdiff_t>(first), heads.end());
+      heads_offsets[q + 1] = heads.size();
+    }
+    it.first_member = net.member_occurrence_offsets.size();
+    std::int32_t count = 0;
+    for (std::size_t m = 0; m < M; ++m) {
+      net.member_occurrence_offsets.push_back(nocc + count);
+      net.member_tail_positions.push_back(tails[m]);
+      const auto t = static_cast<std::size_t>(tails[m]);
+      // This range contributes to the preflight-checked occurrence total, unlike the
+      // cumulative label offset (which also includes labels at destinations).
+      count += static_cast<std::int32_t>(heads_offsets[t + 1] - heads_offsets[t]);
+    }
+    net.member_occurrence_offsets.push_back(nocc + count);
+    net.member_tail_positions.push_back(-1);
+    it.num_occurrences = count;
+    it.first_position = net.slot_offsets.size();
+    for (std::size_t q = 0; q < P; ++q) {
+      net.slot_offsets.push_back(static_cast<std::int32_t>(net.slot_heads.size()));
+      if (plan.is_destination[q] != 0) continue;
+      for (auto k = heads_offsets[q]; k < heads_offsets[q + 1]; ++k) net.slot_heads.push_back(heads[static_cast<std::size_t>(k)]);
+    }
+    net.slot_offsets.push_back(static_cast<std::int32_t>(net.slot_heads.size()));
+    nocc += count;
+  }
+  if (nocc != num_occurrences) throw std::logic_error("forwarding: the network's occurrences differ from their count");
+  for (const auto& it : net.entry_occurrences) {
+    if (it.tunnel_position >= 0) {
+      const auto edges = path_of(net.views[static_cast<std::size_t>(it.demand)]->data->tunnels[static_cast<std::size_t>(it.tunnel_position)]);
+      net.edges.insert(net.edges.end(), edges.begin(), edges.end());
+    } else if (it.num_occurrences != 0) {
+      net.edges.insert(net.edges.end(), it.prepared_route->forwarding_edges.begin(), it.prepared_route->forwarding_edges.end());
+    }
+  }
+  std::sort(net.edges.begin(), net.edges.end());
+  net.edges.erase(std::unique(net.edges.begin(), net.edges.end()), net.edges.end());
+  net.available_capacity.resize(net.edges.size());
+  free(net.edges, net.available_capacity);
+  if (!lossy) {
+    // The lossless bound reads a black-holed link as serving 0 (one view: lossless has no list).
+    for (const ForwardingView* view : views) {
+      for (std::size_t l = 0; view->black_holes != nullptr && l < net.edges.size(); ++l) {
+        if (!view->black_holes->allows_edge(net.edges[l])) net.available_capacity[l] = 0;
+      }
+    }
+  }
+  const auto n = static_cast<std::size_t>(nocc);
+  net.occurrence_edge_positions.resize(n);
+  net.occurrence_entry_positions.resize(n);
+  net.occurrence_route_positions.resize(n);
+  net.occurrence_heads.resize(n);
+  // The dark flags only where a black hole can apply (LOSSY), the slots only for pooled contexts.
+  bool can_be_dark = false;
+  bool any_pooled = false;
+  for (const ForwardingView* v : net.views) {
+    can_be_dark = can_be_dark || (lossy && v->black_holes != nullptr);
+    any_pooled = any_pooled || v->pooled;
+  }
+  if (can_be_dark) net.occurrence_dark.assign(n, 0);
+  if (any_pooled) net.occurrence_slots.assign(n, -1);
+  for (std::size_t i = 0; i < net.entry_occurrences.size(); ++i) {
+    const auto& it = net.entry_occurrences[i];
+    const ForwardingView& view = *net.views[static_cast<std::size_t>(it.demand)];
+    const Eligibility* dark = lossy ? view.black_holes : nullptr;
+    auto set = [&](std::size_t o, EdgeId e, std::int32_t j, std::int32_t head) {
+      net.occurrence_edge_positions[o] = edge_position(net, e);
+      net.occurrence_entry_positions[o] = static_cast<std::int32_t>(i);
+      net.occurrence_route_positions[o] = j;
+      net.occurrence_heads[o] = head;
+      if (dark != nullptr && !dark->allows_edge(e)) {
+        net.occurrence_dark[o] = 1;
+        net.any_dark = true;
+      }
+    };
+    if (!it.pooled) {
+      for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+        const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+        const EdgeId e = it.tunnel_position >= 0 ? path_of(view.data->tunnels[static_cast<std::size_t>(it.tunnel_position)])[static_cast<std::size_t>(j)]
+                                                 : it.prepared_route->forwarding_edges[static_cast<std::size_t>(j)];
+        set(o, e, j, it.source_index);
+      }
+      continue;
+    }
+    const PreparedRoute& plan = *it.prepared_route;
+    const std::size_t M = plan.forwarding_edges.size();
+    for (std::size_t m = 0; m < M; ++m) {
+      const auto t = static_cast<std::size_t>(net.member_tail_positions[it.first_member + m]);
+      const auto q = static_cast<std::size_t>(plan.edge_destination_positions[m]);
+      const auto first = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m]);
+      const auto tail_slots = static_cast<std::size_t>(net.slot_offsets[it.first_position + t]);
+      const auto num = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m + 1]) - first;
+      const auto head_slots = std::span<const std::int32_t>(net.slot_heads).subspan(
+          static_cast<std::size_t>(net.slot_offsets[it.first_position + q]),
+          static_cast<std::size_t>(net.slot_offsets[it.first_position + q + 1] - net.slot_offsets[it.first_position + q]));
+      for (std::size_t k = 0; k < num; ++k) {
+        const auto o = first + k;
+        const auto head = net.slot_heads[tail_slots + k];  // the heads of the tail, ascending
+        set(o, plan.forwarding_edges[m], static_cast<std::int32_t>(m), head);
+        if (plan.is_destination[q] == 0) {
+          const auto at = std::lower_bound(head_slots.begin(), head_slots.end(), head);
+          net.occurrence_slots[o] = net.slot_offsets[it.first_position + q] + static_cast<std::int32_t>(at - head_slots.begin());
+        }
+      }
+    }
+  }
+  net.router_entry_positions.resize(static_cast<std::size_t>(net.num_router_positions));
+  for (std::size_t i = 0; i < net.entry_occurrences.size(); ++i) {
+    const auto& it = net.entry_occurrences[i];
+    if (it.tunnel_position >= 0) continue;
+    const auto& plan = *it.prepared_route;
+    for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) net.router_entry_positions[static_cast<std::size_t>(it.first_router_position) + pos] = static_cast<std::int32_t>(i);
+  }
+  net.edge_occurrence_offsets.assign(net.edges.size() + 1, 0);
+  for (std::size_t o = 0; o < n; ++o) {
+    if (!net.dark(o)) ++net.edge_occurrence_offsets[static_cast<std::size_t>(net.occurrence_edge_positions[o]) + 1];
+  }
+  for (std::size_t l = 0; l < net.edges.size(); ++l) {
+    net.max_link_occurrences = std::max<std::int64_t>(net.max_link_occurrences, net.edge_occurrence_offsets[l + 1]);
+    net.edge_occurrence_offsets[l + 1] += net.edge_occurrence_offsets[l];
+  }
+  net.occurrences_by_edge.resize(static_cast<std::size_t>(net.edge_occurrence_offsets.back()));
+  std::vector<std::int32_t> fill(net.edge_occurrence_offsets.begin(), net.edge_occurrence_offsets.end() - 1);
+  // Occurrences are numbered by item, items by (demand, head, entry index), a pooled item's by
+  // member then head: each link's list comes out in the loss rule's order (demands, then heads
+  // ascending, then entries ascending).
+  for (std::size_t o = 0; o < n; ++o) {
+    if (net.dark(o)) continue;
+    net.occurrences_by_edge[static_cast<std::size_t>(fill[static_cast<std::size_t>(net.occurrence_edge_positions[o])]++)] = static_cast<std::int32_t>(o);
+  }
+  return net;
+}
+
+// One no-drop pass; Checked: dark occurrences stop their traffic and link sums saturate, else plain
+// sums (no_drop takes the plain pass only where nothing is dark and no sum can reach kSumCap, where
+// both give the same loads).
+template <bool Checked>
+void no_drop_pass(const ForwardingNetwork& net, std::span<const std::vector<Amount>> shares, std::vector<Amount>& load,
+                  std::vector<Amount>* occ, std::vector<Amount>& scratch) {
+  auto add = [&](std::size_t o, Amount x) {
+    if constexpr (Checked) {
+      if (net.dark(o)) return;
+      auto& y = load[static_cast<std::size_t>(net.occurrence_edge_positions[o])];
+      y = saturating_add(y, x);
+    } else {
+      load[static_cast<std::size_t>(net.occurrence_edge_positions[o])] += x;
+    }
+  };
+  // A split route's plan with a dark member: forwarded with those members' view at 0, so what
+  // they receive goes no further and the routers split only what arrives. Per member its arrival
+  // (in scratch); false without a dark member (the forward is not needed).
+  std::vector<Amount> view_m;
+  auto dark_forward = [&](const ForwardingNetwork::Item& it, std::span<const Amount> inject) {
+    if constexpr (Checked) {
+      if (!net.any_dark) return false;
+      const PreparedRoute& plan = *it.prepared_route;
+      const std::size_t M = plan.forwarding_edges.size();
+      view_m.assign(M, std::numeric_limits<Amount>::max());
+      bool any = false;
+      for (std::size_t m = 0; m < M; ++m) {
+        const auto o = it.pooled ? static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m])
+                                 : static_cast<std::size_t>(it.first_occurrence) + m;
+        if (it.pooled && o == static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m + 1])) continue;  // no head reaches it
+        if (net.dark(o)) {
+          view_m[m] = 0;
+          any = true;
+        }
+      }
+      if (!any) return false;
+      const auto fw = forward(plan, Injection {inject, false}, view_m);
+      scratch.resize(M);
+      for (std::size_t m = 0; m < M; ++m) scratch[m] = fw.edge_flows[m] + fw.edge_drops[m];
+      return true;
+    } else {
+      (void)it;
+      (void)inject;
+      return false;
+    }
+  };
+  std::vector<Amount> inject;
+  std::vector<std::int32_t> head_root;   // a pooled context: per view head, its root's position (-1: no share)
+  std::vector<std::uint8_t> slot_live;   // a pooled context: per slot, its head's traffic can reach it
+  for (const auto& it : net.entry_occurrences) {
+    const auto& share = shares[static_cast<std::size_t>(it.demand)];
+    if (it.pooled) {
+      const ForwardingView& view = *net.views[static_cast<std::size_t>(it.demand)];
+      const PreparedRoute& plan = *it.prepared_route;
+      inject.assign(plan.sources.size(), 0);
+      head_root.assign(view.num_sources(), -1);
+      bool any = false;
+      for (std::size_t h = 0; h < view.num_sources(); ++h) {
+        const auto e = static_cast<std::size_t>(view.entries_for_source(h).front());
+        const auto r = view.context_source_index(e);
+        if (r < 0 || plan.source_positions[static_cast<std::size_t>(r)] < 0) continue;
+        inject[static_cast<std::size_t>(r)] = share[e];
+        if (share[e] != 0) head_root[h] = plan.source_positions[static_cast<std::size_t>(r)];
+        any = any || share[e] != 0;
+      }
+      if (!any) continue;
+      if (!dark_forward(it, inject)) scratch = forward(plan, Injection {inject, false}, {}).edge_flows;
+      for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+        const auto o = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m]);
+        const auto end = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m + 1]);
+        if (scratch[m] == 0 || o == end) continue;
+        add(o, scratch[m]);
+      }
+      if (occ == nullptr) continue;
+      // Per head: its occurrence on a member can carry something when the member's amount is
+      // positive and the head's traffic reaches the member's tail, from its own root (a positive
+      // share) or over a member it can carry something on that is not dark (what reaches a dark
+      // member goes no further). Positions run in topological order; a member's occurrences and its
+      // tail's slots are the heads reaching that tail, both ascending.
+      const auto first_slot = net.slot_offsets[it.first_position];
+      slot_live.assign(static_cast<std::size_t>(net.slot_offsets[it.first_position + plan.topological_order.size()] - first_slot), 0);
+      for (std::size_t h = 0; h < head_root.size(); ++h) {
+        if (head_root[h] < 0 || plan.is_destination[static_cast<std::size_t>(head_root[h])] != 0) continue;
+        const auto q = it.first_position + static_cast<std::size_t>(head_root[h]);
+        const auto b = net.slot_heads.begin();
+        const auto at = std::lower_bound(b + net.slot_offsets[q], b + net.slot_offsets[q + 1], static_cast<std::int32_t>(h));
+        slot_live[static_cast<std::size_t>(at - b - first_slot)] = 1;
+      }
+      for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+        if (plan.is_destination[pos] != 0) continue;
+        const auto tail_slot = static_cast<std::size_t>(net.slot_offsets[it.first_position + pos] - first_slot);
+        for (auto m = static_cast<std::size_t>(plan.outgoing_begin[pos]); m < static_cast<std::size_t>(plan.outgoing_end[pos]); ++m) {
+          if (scratch[m] == 0) continue;
+          const auto o = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m]);
+          const auto end = static_cast<std::size_t>(net.member_occurrence_offsets[it.first_member + m + 1]);
+          for (auto x = o; x < end; ++x) {
+            if (slot_live[tail_slot + (x - o)] == 0) continue;
+            (*occ)[x] = scratch[m];
+            const auto head_slot = net.occurrence_slots[x];
+            if (head_slot >= 0 && !net.dark(x)) slot_live[static_cast<std::size_t>(head_slot - first_slot)] = 1;
+          }
+        }
+      }
+      continue;
+    }
+    const Amount s = share[static_cast<std::size_t>(it.entry_position)];
+    if (s == 0) continue;
+    if (it.tunnel_position >= 0) {
+      for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+        const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+        if (occ != nullptr) (*occ)[o] = s;
+        add(o, s);
+        // What reaches its own black hole goes no further: the later hops carry nothing.
+        if (Checked && net.dark(o)) break;
+      }
+      continue;
+    }
+    const PreparedRoute& plan = *it.prepared_route;
+    bool forwarded = false;
+    if (Checked && net.any_dark) {
+      inject.assign(plan.sources.size(), 0);
+      for (std::size_t r = 0; r < plan.sources.size(); ++r) {
+        if (plan.source_positions[r] == it.source_position) inject[r] = s;
+      }
+      forwarded = dark_forward(it, inject);
+    }
+    if (!forwarded) {
+      scratch.resize(plan.forwarding_edges.size());
+      (void)allocate(plan, s, scratch);
+    }
+    for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+      const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+      if (occ != nullptr) (*occ)[o] = scratch[static_cast<std::size_t>(j)];
+      add(o, scratch[static_cast<std::size_t>(j)]);
+    }
+  }
+}
+
+// The no-drop loads per link of every demand's shares (`shares[d]`: per program entry of demand
+// d), each demand's traffic dropped only at its own black holes, and per occurrence when `occ` is
+// given its possible amount (a pooled context's occurrence: its member's flow where its head's
+// traffic can reach the member, else 0). A split route allocates its share over its plan from its root; a pooled
+// context forwards its heads' shares over its plan without a limit; a tunnel's hops after a dark
+// one, and a dark member's onward traffic, carry nothing. A dark occurrence (its arrival as its
+// amount) loads no link; link sums saturate (kSumCap). An occurrence whose amount is 0 can carry
+// nothing in any evaluation (splits never give less for more): it is dead, and takes no part in
+// the waits or in serial normalization.
+void no_drop(const ForwardingNetwork& net, std::span<const std::vector<Amount>> shares, std::vector<Amount>& load,
+             std::vector<Amount>* occ, std::vector<Amount>& scratch) {
+  load.assign(net.edges.size(), 0);
+  if (occ != nullptr) occ->assign(net.occurrence_edge_positions.size(), 0);
+  // Every occurrence carries at most the sum of all shares (a pooled member at most its demand's),
+  // so a link's sum stays below total * max_link_occurrences: below kSumCap, plain sums are exact.
+  Amount total = 0;
+  for (const auto& share : shares) {
+    for (Amount x : share) total = saturating_add(total, x);
+  }
+  const bool plain = !net.any_dark && (net.max_link_occurrences == 0 || total < kSumCap / net.max_link_occurrences);
+  if (plain) {
+    no_drop_pass<false>(net, shares, load, occ, scratch);
+  } else {
+    no_drop_pass<true>(net, shares, load, occ, scratch);
+  }
+}
+
+// The router split of a split route's plan position p: round robin or highest averages over
+// its out-members.
+void split_at(const PreparedRoute& plan, std::size_t pos, Amount amount, std::span<Amount> out) {
+  const auto b = static_cast<std::size_t>(plan.outgoing_begin[pos]);
+  const auto e = static_cast<std::size_t>(plan.outgoing_end[pos]);
+  std::fill(out.begin(), out.end(), 0);
+  if (amount == 0 || e == b) return;
+  if (plan.allocation == RouteAllocation::Weighted) {
+    highest_averages(amount, std::span<const Amount>(plan.weights.data() + b, e - b), out);
+  } else {
+    (void)round_robin(amount, out);
+  }
+}
+
+// The loss rule's scratch (per call).
+struct LossScratch {
+  std::vector<Amount> wd;  // per demand run: its arrivals
+  std::vector<Amount> td;  // per demand run: its share of T
+  std::vector<std::size_t> demand_run;
+  std::vector<Amount> wa;
+  std::vector<Amount> wb;
+  std::vector<std::size_t> run;
+  std::vector<Amount> w;
+  std::vector<Amount> c;
+};
+
+// Within one demand's run occs[b, e): highest averages of T over its sources' arrivals, then
+// within a source over its entries'.
+void source_levels(const ForwardingNetwork& net, std::span<const std::int32_t> occs, std::size_t b, std::size_t e, Amount T,
+                   std::span<const Amount> arrival, std::span<Amount> carried, LossScratch& s) {
+  // One positive arrival takes T whole (highest averages over one positive weight).
+  if (e - b == 1 && arrival[static_cast<std::size_t>(occs[b])] > 0) {
+    carried[static_cast<std::size_t>(occs[b])] = T;
+    return;
+  }
+  s.wa.clear();
+  s.run.clear();  // the first index of each source's run
+  for (std::size_t i = b; i < e; ++i) {
+    const auto head = net.occurrence_heads[static_cast<std::size_t>(occs[i])];
+    if (i == b || head != net.occurrence_heads[static_cast<std::size_t>(occs[i - 1])]) {
+      s.run.push_back(i);
+      s.wa.push_back(0);
+    }
+    s.wa.back() += arrival[static_cast<std::size_t>(occs[i])];
+  }
+  s.run.push_back(e);
+  s.wb.resize(s.wa.size());
+  highest_averages(T, s.wa, s.wb);
+  for (std::size_t k = 0; k + 1 < s.run.size(); ++k) {
+    const std::size_t rb = s.run[k];
+    const std::size_t re = s.run[k + 1];
+    if (re - rb == 1 && arrival[static_cast<std::size_t>(occs[rb])] > 0) {
+      carried[static_cast<std::size_t>(occs[rb])] = s.wb[k];
+      continue;
+    }
+    s.w.resize(re - rb);
+    s.c.resize(re - rb);
+    for (std::size_t i = rb; i < re; ++i) s.w[i - rb] = arrival[static_cast<std::size_t>(occs[i])];
+    highest_averages(s.wb[k], s.w, s.c);
+    for (std::size_t i = rb; i < re; ++i) carried[static_cast<std::size_t>(occs[i])] = s.c[i - rb];
+  }
+}
+
+// The loss rule at one link: T = min(V, sum of the arrivals); highest averages over the
+// demands' arrivals (one demand takes T whole), then within a demand over its sources', then
+// within a source over its entries'. `occs` lists the link's sharing occurrences by (demand,
+// source, entry); writes their carried amounts.
+void loss_rule(const ForwardingNetwork& net, std::span<const std::int32_t> occs, Amount V, std::span<const Amount> arrival,
+               std::span<Amount> carried, LossScratch& s) {
+  Amount sum = 0;
+  for (auto o : occs) sum = saturating_add(sum, arrival[static_cast<std::size_t>(o)]);
+  if (sum <= V) {
+    for (auto o : occs) carried[static_cast<std::size_t>(o)] = arrival[static_cast<std::size_t>(o)];
+    return;
+  }
+  // The demand runs: consecutive runs of one demand (each demand's arrivals sum below 2^62).
+  s.wd.clear();
+  s.demand_run.clear();
+  for (std::size_t i = 0; i < occs.size(); ++i) {
+    const auto d = net.entry_occurrences[static_cast<std::size_t>(net.occurrence_entry_positions[static_cast<std::size_t>(occs[i])])].demand;
+    if (i == 0 || d != net.entry_occurrences[static_cast<std::size_t>(net.occurrence_entry_positions[static_cast<std::size_t>(occs[i - 1])])].demand) {
+      s.demand_run.push_back(i);
+      s.wd.push_back(0);
+    }
+    s.wd.back() += arrival[static_cast<std::size_t>(occs[i])];
+  }
+  s.demand_run.push_back(occs.size());
+  if (s.wd.size() == 1) {
+    source_levels(net, occs, 0, occs.size(), V, arrival, carried, s);
+    return;
+  }
+  s.td.resize(s.wd.size());
+  highest_averages(V, s.wd, s.td);
+  // source_levels uses none of the demand level's scratch.
+  for (std::size_t k = 0; k + 1 < s.demand_run.size(); ++k) {
+    source_levels(net, occs, s.demand_run[k], s.demand_run[k + 1], s.td[k], arrival, carried, s);
+  }
+}
+
+// ---------------------------------------------------------------- the general lossless bound
+
+ProgramFlow general_lossless(const ForwardingView& view, const AvailableCapacityFn& free, Amount lo, std::optional<Amount> hi) {
+  const ForwardingView* const views[] = {&view};
+  const ForwardingNetwork net = build_forwarding_network(views, free, false);
+  const auto& positions = net.entry_occurrence_positions.front();
+  const std::size_t k = view.num_sources();
+  std::vector<Amount> heads(k);
+  std::vector<std::vector<Amount>> shares(1);
+  auto& share = shares.front();
+  std::vector<Amount> source_drops_by_source;
+  std::vector<Amount> w;
+  std::vector<Amount> part;
+  std::vector<Amount> load;
+  std::vector<Amount> scratch;
+  auto fits = [&](Amount t) {
+    source_shares(view, t, heads);
+    // Units no head receives (every captured weight 0) have no route.
+    Amount given = 0;
+    for (Amount x : heads) given += x;
+    if (given != t) return false;
+    entry_shares(view, heads, share, source_drops_by_source, w, part);
+    for (Amount x : source_drops_by_source) {
+      if (x != 0) return false;
+    }
+    for (std::size_t e = 0; e < share.size(); ++e) {
+      if (share[e] != 0 && positions[e] == -2) return false;  // a share with no route
+    }
+    no_drop(net, shares, load, nullptr, scratch);
+    for (std::size_t l = 0; l < load.size(); ++l) {
+      if (load[l] > net.available_capacity[l]) return false;
+    }
+    return true;
+  };
+  // An upper bound: every unit leaves on an entry's first link, which carries it without a drop;
+  // with no head, nothing enters.
+  Amount top = 0;
+  {
+    std::vector<std::uint8_t> first(net.edges.size(), 0);
+    for (const auto& it : net.entry_occurrences) {
+      if (it.tunnel_position >= 0) {
+        first[static_cast<std::size_t>(net.occurrence_edge_positions[static_cast<std::size_t>(it.first_occurrence)])] = 1;
+      } else {
+        const auto rp = static_cast<std::size_t>(it.source_position);
+        for (auto m = it.prepared_route->outgoing_begin[rp]; m < it.prepared_route->outgoing_end[rp]; ++m) {
+          first[static_cast<std::size_t>(net.occurrence_edge_positions[static_cast<std::size_t>(it.first_occurrence + m)])] = 1;
+        }
+      }
+    }
+    for (std::size_t l = 0; l < first.size(); ++l) {
+      if (first[l] != 0) top += net.available_capacity[l];
+    }
+  }
+  Amount upper = hi.has_value() ? std::min(*hi, std::max(top, lo)) : std::max(top, lo);
+  Amount best = lo;
+  if (upper > lo) {
+    if (fits(upper)) {
+      best = upper;
+    } else {
+      // The largest fitting total in [lo, upper - 1]: lo fits and upper does not (a prefix).
+      Amount a = lo;
+      Amount b = upper;
+      while (b - a > 1) {
+        const Amount mid = a + (b - a) / 2;
+        if (fits(mid)) {
+          a = mid;
+        } else {
+          b = mid;
+        }
+      }
+      best = a;
+    }
+  }
+  // The loads of the admitted total.
+  ProgramFlow out = empty_flow(view, false);
+  out.admitted = best;
+  source_shares(view, best, out.offered_by_source);
+  entry_shares(view, out.offered_by_source, share, source_drops_by_source, w, part);
+  std::vector<Amount> occ;
+  no_drop(net, shares, load, &occ, scratch);
+  for (std::size_t l = 0; l < load.size(); ++l) {
+    if (load[l] > net.available_capacity[l]) throw std::logic_error("forwarding: the admitted total does not fit");
+  }
+  for (Amount x : out.offered_by_source) out.offered += x;
+  out.delivered = out.offered;
+  for (const auto& it : net.entry_occurrences) {
+    auto& f = out.entries[static_cast<std::size_t>(it.entry_position)];
+    f.assigned = share[static_cast<std::size_t>(it.entry_position)];
+    f.delivered = f.assigned;
+    for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+      const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+      if (occ[o] != 0) f.edge_flows.emplace_back(net.edges[static_cast<std::size_t>(net.occurrence_edge_positions[o])], occ[o]);
+    }
+    if (it.tunnel_position >= 0) sort_pairs(f.edge_flows);
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- the general loss rule (A+)
+
+// The loss rule over every demand of one network at once: A+ where arrivals are
+// determined, the cyclic groups iterated, an independent check of an iterated result. One demand
+// of a non-pooled program is the scalar call's evaluation.
+class LossyForwardingEvaluator {
+public:
+  explicit LossyForwardingEvaluator(const ForwardingNetwork& net) : net_(net) {}
+
+  // Per demand its per-head injections; one ProgramFlow per demand.
+  std::vector<ProgramFlow> run(std::span<const std::span<const Amount>> injections);
+
+private:
+  // Event ids: barriers [0, nb), routers [nb, nb + num_pos).
+  [[nodiscard]] std::int32_t router(const ForwardingNetwork::Item& it, std::int32_t pos) const noexcept {
+    return num_barriers_ + it.first_router_position + pos;
+  }
+  [[nodiscard]] bool dark(std::int32_t o) const noexcept { return net_.dark(static_cast<std::size_t>(o)); }
+  // A dark occurrence is no event (what reaches it is dropped at once).
+  [[nodiscard]] std::int32_t event_of_occ(std::int32_t o) const noexcept {
+    if (dark(o)) return -1;
+    return barrier_[static_cast<std::size_t>(net_.occurrence_edge_positions[static_cast<std::size_t>(o)])];
+  }
+  // A push into event `ev` is suppressed while a group iterates and ev lies outside it.
+  [[nodiscard]] bool blocked(std::int32_t ev) const noexcept { return iterating_ && scc_[static_cast<std::size_t>(ev)] != current_component_; }
+  [[nodiscard]] const ForwardingNetwork::Item& item_of(std::int32_t o) const noexcept {
+    return net_.entry_occurrences[static_cast<std::size_t>(net_.occurrence_entry_positions[static_cast<std::size_t>(o)])];
+  }
+  // A pooled item's slots at position pos (a destination: none).
+  [[nodiscard]] std::pair<std::int32_t, std::int32_t> slots(const ForwardingNetwork::Item& it, std::size_t pos) const noexcept {
+    return {net_.slot_offsets[it.first_position + pos], net_.slot_offsets[it.first_position + pos + 1]};
+  }
+  [[nodiscard]] std::int32_t member_occurrence(const ForwardingNetwork::Item& it, std::size_t m) const noexcept {
+    return net_.member_occurrence_offsets[it.first_member + m];
+  }
+
+  void normalize_serial_links(std::span<const Amount> U0);
+  void build_events();
+  void find_strong_components();
+  void reach(std::int32_t o, Amount x);
+  void carry(std::int32_t o, Amount c);
+  void split(std::int32_t ev);
+  void evaluate_barrier(std::int32_t ev);
+  void iterate(std::int32_t scc);
+  void verify() const;
+
+  const ForwardingNetwork& net_;
+  std::vector<std::vector<Amount>> shares_;  // per demand, per program entry
+  std::vector<std::int32_t> occurrence_source_positions_;  // per occurrence of a split route: its member's tail position
+  std::vector<std::uint8_t> root_position_;  // per router position: a root of its item's heads
+  std::vector<std::uint8_t> transparent_;  // per link: the second link of a transparent pair
+  std::vector<std::int32_t> barrier_;      // per link: its event, or -1 (a pass-through)
+  std::vector<std::int32_t> barrier_link_;
+  std::int32_t num_barriers_ {0};
+  std::int32_t num_events_ {0};
+  std::vector<std::int32_t> dependency_offsets_;
+  std::vector<std::int32_t> dependencies_;
+  std::vector<std::int32_t> scc_;
+  std::int32_t num_scc_ {0};
+  bool iterating_ {false};
+  std::int32_t current_component_ {-1};
+  std::vector<Amount> possible_;  // per occurrence: its possible amount (0: dead)
+  std::vector<Amount> arrival_;
+  std::vector<Amount> carried_;
+  std::vector<Amount> inflow_;       // per router position (one-root split routes)
+  std::vector<Amount> slot_inflow_;  // per slot (pooled contexts)
+  std::vector<Amount> delivered_;    // per item (tunnels and one-root split routes)
+  std::vector<std::vector<Amount>> head_delivered_;  // per demand: a pooled context's per head
+  std::vector<Amount> outgoing_shares_;
+  std::vector<Amount> remaining_;
+  std::vector<Amount> row_;
+  LossScratch loss_;
+  bool iterated_ {false};
+};
+
+void LossyForwardingEvaluator::normalize_serial_links(std::span<const Amount> U0) {
+  const std::size_t L = net_.edges.size();
+  transparent_.assign(L, 0);
+  // Per link: the one link every sharing occurrence continues on, and the one every sharing
+  // occurrence comes from (-1: none yet; -2: they differ, or an occurrence is injected, absorbed,
+  // merged or split there, or its neighbour on its route is dark). Only what can carry something
+  // counts: a dead occurrence counts for neither link, and a router's merges and branches are
+  // those of its live members.
+  std::vector<std::int32_t> next(L, -1);
+  std::vector<std::int32_t> prev(L, -1);
+  auto merge = [](std::int32_t& slot, std::int32_t v) {
+    if (slot == -1) {
+      slot = v;
+    } else if (slot != v) {
+      slot = -2;
+    }
+  };
+  // The link of occurrence o, or -2 when it is dark.
+  auto link_of = [&](std::int32_t o) { return dark(o) ? -2 : net_.occurrence_edge_positions[static_cast<std::size_t>(o)]; };
+  // Per router position, over the live members only (an occurrence of the member can carry
+  // something): its one in-member (-1 none, -2 several) and its out-members (their count, and the
+  // one when there is one). A dark member takes its share out of its tail but brings nothing into
+  // its head (what reaches it is dropped there).
+  const auto R = static_cast<std::size_t>(net_.num_router_positions);
+  std::vector<std::int32_t> live_in(R, -1);
+  std::vector<std::int32_t> live_out(R, -1);
+  std::vector<std::int32_t> live_outs(R, 0);
+  for (const auto& it : net_.entry_occurrences) {
+    if (it.tunnel_position >= 0 || it.num_occurrences == 0) continue;
+    const auto& plan = *it.prepared_route;
+    const auto base = static_cast<std::size_t>(it.first_router_position);
+    for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+      for (auto m = plan.outgoing_begin[pos]; m < plan.outgoing_end[pos]; ++m) {
+        const auto first = it.pooled ? member_occurrence(it, static_cast<std::size_t>(m)) : it.first_occurrence + m;
+        const auto end = it.pooled ? member_occurrence(it, static_cast<std::size_t>(m) + 1) : first + 1;
+        bool live = false;
+        for (auto x = first; x < end && !live; ++x) live = possible_[static_cast<std::size_t>(x)] != 0;
+        if (!live) continue;
+        ++live_outs[base + pos];
+        live_out[base + pos] = m;
+        if (dark(first)) continue;
+        auto& slot = live_in[base + static_cast<std::size_t>(plan.edge_destination_positions[static_cast<std::size_t>(m)])];
+        slot = slot == -1 ? m : -2;
+      }
+    }
+  }
+  for (std::size_t o = 0; o < net_.occurrence_edge_positions.size(); ++o) {
+    if (net_.dark(o) || possible_[o] == 0) continue;
+    const auto l = static_cast<std::size_t>(net_.occurrence_edge_positions[o]);
+    const auto& it = net_.entry_occurrences[static_cast<std::size_t>(net_.occurrence_entry_positions[o])];
+    const std::int32_t j = net_.occurrence_route_positions[o];
+    std::int32_t succ = -2;
+    std::int32_t pred = -2;
+    if (it.tunnel_position >= 0) {
+      if (j + 1 < it.num_occurrences) succ = link_of(static_cast<std::int32_t>(o) + 1);
+      if (j > 0) pred = link_of(static_cast<std::int32_t>(o) - 1);
+    } else {
+      const auto& plan = *it.prepared_route;
+      const auto base = static_cast<std::size_t>(it.first_router_position);
+      // The occurrence of member m on this occurrence's route (a pooled context: the same head's).
+      auto on_member = [&](std::int32_t m) -> std::int32_t {
+        if (!it.pooled) return it.first_occurrence + m;
+        // A member's occurrences ascend by head.
+        const auto b = net_.occurrence_heads.begin();
+        const auto first = b + member_occurrence(it, static_cast<std::size_t>(m));
+        const auto last = b + member_occurrence(it, static_cast<std::size_t>(m) + 1);
+        const auto at = std::lower_bound(first, last, net_.occurrence_heads[o]);
+        return at != last && *at == net_.occurrence_heads[o] ? static_cast<std::int32_t>(at - b) : -1;
+      };
+      // Continues: its head is no destination and no root, holds this member alone as its live
+      // in-member and has one live out-member.
+      const auto q = static_cast<std::size_t>(plan.edge_destination_positions[static_cast<std::size_t>(j)]);
+      if (plan.is_destination[q] == 0 && root_position_[base + q] == 0 && live_outs[base + q] == 1 && live_in[base + q] == j) {
+        const auto x = on_member(live_out[base + q]);
+        if (x >= 0) succ = link_of(x);
+      }
+      // Comes from: its tail is no root, has one live in-member and this one live out-member.
+      const auto t = static_cast<std::size_t>(occurrence_source_positions_[o]);
+      const auto in = live_in[base + t];
+      if (root_position_[base + t] == 0 && in >= 0 && live_outs[base + t] == 1) {
+        const auto x = on_member(in);
+        if (x >= 0) pred = link_of(x);
+      }
+    }
+    merge(next[l], succ);
+    merge(prev[l], pred);
+  }
+  for (std::size_t l = 0; l < L; ++l) {
+    const auto n = next[l];
+    if (n < 0) continue;
+    const auto ni = static_cast<std::size_t>(n);
+    if (prev[ni] != static_cast<std::int32_t>(l) || net_.available_capacity[l] != net_.available_capacity[ni]) continue;
+    transparent_[ni] = 1;
+  }
+  barrier_.assign(L, -1);
+  barrier_link_.clear();
+  for (std::size_t l = 0; l < L; ++l) {
+    if (transparent_[l] == 0 && U0[l] > net_.available_capacity[l]) {
+      barrier_[l] = static_cast<std::int32_t>(barrier_link_.size());
+      barrier_link_.push_back(static_cast<std::int32_t>(l));
+    }
+  }
+  num_barriers_ = static_cast<std::int32_t>(barrier_link_.size());
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  thread_lossy_counters().barriers.clear();
+  for (auto l : barrier_link_) thread_lossy_counters().barriers.push_back(net_.edges[static_cast<std::size_t>(l)]);
+#endif
+  // The events are known only after the no-drop loads: checked before the event structures are
+  // sized (the network is built; a refusal changes nothing).
+  check_forwarding_count(ForwardingCounter::Event, std::int64_t {num_barriers_} + net_.num_router_positions);
+  num_events_ = num_barriers_ + net_.num_router_positions;
+}
+
+void LossyForwardingEvaluator::build_events() {
+  // Every dependency arc, to `emit`: an event before the next one on its tunnel; on a split route
+  // (a pooled context: per member, whatever its heads) a member's tail router before its event (a
+  // member that can drop) and that event before the head router, or the tail before the head.
+  // Only through an occurrence that can carry something: a dead occurrence (a tunnel's hop whose
+  // share is 0 or that lies behind its own black hole, a member no head can carry anything on)
+  // adds no arc, so it makes no link wait and joins no group.
+  auto arcs = [&](auto&& emit) {
+    for (const auto& it : net_.entry_occurrences) {
+      if (it.tunnel_position >= 0) {
+        std::int32_t last = -1;
+        for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+          if (possible_[static_cast<std::size_t>(it.first_occurrence + j)] == 0) break;  // the rest are dead too
+          const auto ev = event_of_occ(it.first_occurrence + j);
+          if (ev < 0) continue;
+          if (last >= 0) emit(last, ev);
+          last = ev;
+        }
+        continue;
+      }
+      if (it.num_occurrences == 0) continue;
+      const auto& plan = *it.prepared_route;
+      for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+        for (auto m = plan.outgoing_begin[pos]; m < plan.outgoing_end[pos]; ++m) {
+          std::int32_t o = it.first_occurrence + m;
+          if (it.pooled) {
+            // Its first occurrence that can carry something (none: no head reaches it, or none
+            // can carry anything on it).
+            const auto end = member_occurrence(it, static_cast<std::size_t>(m) + 1);
+            o = member_occurrence(it, static_cast<std::size_t>(m));
+            while (o < end && possible_[static_cast<std::size_t>(o)] == 0) ++o;
+            if (o == end) continue;
+          }
+          if (possible_[static_cast<std::size_t>(o)] == 0) continue;
+          const auto from = router(it, static_cast<std::int32_t>(pos));
+          const auto to = router(it, plan.edge_destination_positions[static_cast<std::size_t>(m)]);
+          const auto ev = event_of_occ(o);
+          if (ev >= 0) {
+            emit(from, ev);
+            emit(ev, to);
+          } else {
+            emit(from, to);
+          }
+        }
+      }
+    }
+  };
+  std::int64_t count = 0;
+  arcs([&](std::int32_t, std::int32_t) { ++count; });
+  check_forwarding_count(ForwardingCounter::Dependency, count);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  ++thread_lossy_counters().event_structures;
+  thread_lossy_counters().dependencies = count;
+#endif
+  std::vector<std::pair<std::int32_t, std::int32_t>> edges;
+  edges.reserve(static_cast<std::size_t>(count));
+  arcs([&](std::int32_t from, std::int32_t to) { edges.emplace_back(from, to); });
+  dependency_offsets_.assign(static_cast<std::size_t>(num_events_) + 1, 0);
+  for (const auto& [a, b] : edges) ++dependency_offsets_[static_cast<std::size_t>(a) + 1];
+  for (std::size_t v = 0; v < static_cast<std::size_t>(num_events_); ++v) dependency_offsets_[v + 1] += dependency_offsets_[v];
+  dependencies_.resize(edges.size());
+  std::vector<std::int32_t> fill(dependency_offsets_.begin(), dependency_offsets_.end() - 1);
+  for (const auto& [a, b] : edges) dependencies_[static_cast<std::size_t>(fill[static_cast<std::size_t>(a)]++)] = b;
+}
+
+void LossyForwardingEvaluator::find_strong_components() {
+  num_scc_ = strong_components(dependency_offsets_, dependencies_,
+                               [](std::size_t) { return true; }, scc_);
+}
+
+// Amount x reaches occurrence o (a router's split, or a tunnel's injection): a dark occurrence
+// drops it there and passes nothing on; a barrier's waits for its link's rule; a pass-through
+// carries it on at once.
+void LossyForwardingEvaluator::reach(std::int32_t o, Amount x) {
+  const auto oi = static_cast<std::size_t>(o);
+  if (dark(o)) {
+    arrival_[oi] = x;
+    carry(o, 0);
+    return;
+  }
+  const auto ev = event_of_occ(o);
+  if (ev >= 0) {
+    if (!blocked(ev)) arrival_[oi] = x;
+    return;
+  }
+  arrival_[oi] = x;
+  carry(o, x);
+}
+
+// Occurrence o now carries c: forward it to what it feeds (a split route's head router, a pooled
+// context's slot of its head there, a tunnel's next hops up to its next barrier or its end; a dark
+// hop drops what reaches it).
+void LossyForwardingEvaluator::carry(std::int32_t o, Amount c) {
+  carried_[static_cast<std::size_t>(o)] = c;
+  const auto& it = item_of(o);
+  const std::int32_t j = net_.occurrence_route_positions[static_cast<std::size_t>(o)];
+  if (it.tunnel_position < 0) {
+    const auto q = it.prepared_route->edge_destination_positions[static_cast<std::size_t>(j)];
+    const auto ev = router(it, q);
+    if (it.pooled) {
+      // A pooled destination's deliveries are read from the carried amounts at the end.
+      if (it.prepared_route->is_destination[static_cast<std::size_t>(q)] != 0) return;
+      if (!blocked(ev)) slot_inflow_[static_cast<std::size_t>(net_.occurrence_slots[static_cast<std::size_t>(o)])] += c;
+      return;
+    }
+    if (!blocked(ev)) inflow_[static_cast<std::size_t>(it.first_router_position + q)] += c;
+    return;
+  }
+  for (std::int32_t h = j + 1;; ++h) {
+    if (h == it.num_occurrences) {
+      // The tunnel's end is no event of a group.
+      if (!iterating_) delivered_[static_cast<std::size_t>(net_.occurrence_entry_positions[static_cast<std::size_t>(o)])] = c;
+      return;
+    }
+    const auto o2 = it.first_occurrence + h;
+    const auto o2i = static_cast<std::size_t>(o2);
+    if (dark(o2)) {
+      arrival_[o2i] = c;
+      carried_[o2i] = 0;
+      c = 0;
+      continue;
+    }
+    const auto ev = event_of_occ(o2);
+    if (ev >= 0) {
+      if (!blocked(ev)) arrival_[o2i] = c;
+      return;
+    }
+    arrival_[o2i] = c;
+    carried_[o2i] = c;
+  }
+}
+
+// A router splits what it holds once over its out-members; a pass-through member carries its
+// whole arrival on at once. A pooled router splits its heads' inflows' total and attributes each
+// member's amount to the heads by highest averages over their remaining inflows, member by member
+// in member order (the pooled kernel's attribution).
+void LossyForwardingEvaluator::split(std::int32_t ev) {
+  const auto pos_global = ev - num_barriers_;
+  const auto& it = net_.entry_occurrences[static_cast<std::size_t>(net_.router_entry_positions[static_cast<std::size_t>(pos_global)])];
+  const auto& plan = *it.prepared_route;
+  const auto pos = static_cast<std::size_t>(pos_global - it.first_router_position);
+  if (plan.is_destination[pos] != 0) return;
+  const auto b = static_cast<std::size_t>(plan.outgoing_begin[pos]);
+  const auto e = static_cast<std::size_t>(plan.outgoing_end[pos]);
+  outgoing_shares_.resize(e - b);
+  if (!it.pooled) {
+    split_at(plan, pos, inflow_[static_cast<std::size_t>(pos_global)], outgoing_shares_);
+    for (std::size_t m = b; m < e; ++m) reach(it.first_occurrence + static_cast<std::int32_t>(m), outgoing_shares_[m - b]);
+    return;
+  }
+  const auto [s0, s1] = slots(it, pos);
+  const auto k = static_cast<std::size_t>(s1 - s0);
+  remaining_.assign(slot_inflow_.begin() + s0, slot_inflow_.begin() + s1);
+  Amount total = 0;
+  for (Amount x : remaining_) total += x;
+  split_at(plan, pos, total, outgoing_shares_);
+  row_.resize(k);
+  for (std::size_t m = b; m < e; ++m) {
+    highest_averages(outgoing_shares_[m - b], remaining_, row_);
+    const auto first = member_occurrence(it, m);
+    for (std::size_t i = 0; i < k; ++i) {
+      remaining_[i] -= row_[i];
+      reach(first + static_cast<std::int32_t>(i), row_[i]);
+    }
+  }
+}
+
+void LossyForwardingEvaluator::evaluate_barrier(std::int32_t ev) {
+  const auto l = static_cast<std::size_t>(barrier_link_[static_cast<std::size_t>(ev)]);
+  const auto occs = std::span<const std::int32_t>(net_.occurrences_by_edge).subspan(
+      static_cast<std::size_t>(net_.edge_occurrence_offsets[l]), static_cast<std::size_t>(net_.edge_occurrence_offsets[l + 1] - net_.edge_occurrence_offsets[l]));
+  loss_rule(net_, occs, net_.available_capacity[l], arrival_, carried_, loss_);
+  for (auto o : occs) carry(o, carried_[static_cast<std::size_t>(o)]);
+}
+
+// A cyclic group: rounds from zero carried at its barriers.
+void LossyForwardingEvaluator::iterate(std::int32_t scc) {
+  iterated_ = true;
+  current_component_ = scc;
+  std::vector<std::int32_t> barriers;
+  std::vector<std::int32_t> routers;
+  for (std::int32_t ev = 0; ev < num_events_; ++ev) {
+    if (scc_[static_cast<std::size_t>(ev)] != scc) continue;
+    (ev < num_barriers_ ? barriers : routers).push_back(ev);
+  }
+  // The group's routers in an order that respects router -> router edges (barriers cut).
+  {
+    std::vector<std::int32_t> indeg(static_cast<std::size_t>(num_events_), 0);
+    for (auto r : routers) {
+      for (auto k = dependency_offsets_[static_cast<std::size_t>(r)]; k < dependency_offsets_[static_cast<std::size_t>(r) + 1]; ++k) {
+        const auto w = dependencies_[static_cast<std::size_t>(k)];
+        if (w >= num_barriers_ && scc_[static_cast<std::size_t>(w)] == scc) ++indeg[static_cast<std::size_t>(w)];
+      }
+    }
+    std::vector<std::int32_t> order;
+    std::vector<std::int32_t> ready;
+    for (auto r : routers) {
+      if (indeg[static_cast<std::size_t>(r)] == 0) ready.push_back(r);
+    }
+    while (!ready.empty()) {
+      const auto r = ready.back();
+      ready.pop_back();
+      order.push_back(r);
+      for (auto k = dependency_offsets_[static_cast<std::size_t>(r)]; k < dependency_offsets_[static_cast<std::size_t>(r) + 1]; ++k) {
+        const auto w = dependencies_[static_cast<std::size_t>(k)];
+        if (w >= num_barriers_ && scc_[static_cast<std::size_t>(w)] == scc && --indeg[static_cast<std::size_t>(w)] == 0) ready.push_back(w);
+      }
+    }
+    routers.swap(order);
+  }
+  // The state x: every carried amount at the group's barriers, by EdgeId then demand, source and
+  // entry (the barriers ascend by EdgeId; a link's sharing occurrences are in that order; a pooled
+  // context's keep one coordinate per head).
+  std::vector<std::int32_t> occs;
+  for (auto b : barriers) {
+    const auto l = static_cast<std::size_t>(barrier_link_[static_cast<std::size_t>(b)]);
+    for (auto i = net_.edge_occurrence_offsets[l]; i < net_.edge_occurrence_offsets[l + 1]; ++i) occs.push_back(net_.occurrences_by_edge[static_cast<std::size_t>(i)]);
+  }
+  // What the group's routers hold before the rounds (from outside the group): a one-root split
+  // route's inflow, a pooled router's slots.
+  std::vector<std::pair<std::size_t, Amount>> inflow0;
+  std::vector<std::pair<std::size_t, Amount>> slots0;
+  for (auto r : routers) {
+    const auto pos_global = static_cast<std::size_t>(r - num_barriers_);
+    const auto& it = net_.entry_occurrences[static_cast<std::size_t>(net_.router_entry_positions[pos_global])];
+    if (!it.pooled) {
+      inflow0.emplace_back(pos_global, inflow_[pos_global]);
+      continue;
+    }
+    const auto [s0, s1] = slots(it, pos_global - static_cast<std::size_t>(it.first_router_position));
+    for (auto s = s0; s < s1; ++s) slots0.emplace_back(static_cast<std::size_t>(s), slot_inflow_[static_cast<std::size_t>(s)]);
+  }
+  auto restore = [&] {
+    for (const auto& [i, x] : inflow0) inflow_[i] = x;
+    for (const auto& [i, x] : slots0) slot_inflow_[i] = x;
+  };
+  std::vector<Amount> x(occs.size(), 0);
+  std::vector<Amount> next(occs.size(), 0);
+  std::vector<Amount> before(occs.size(), 0);  // x(r - 2)
+  const auto limit = static_cast<std::int64_t>(64) * static_cast<std::int64_t>(barriers.size());
+  auto replay = [&]() {
+    restore();
+    for (std::size_t i = 0; i < occs.size(); ++i) carry(occs[i], x[i]);
+    for (auto r : routers) split(r);
+  };
+  iterating_ = true;
+  bool solved = false;
+  for (std::int64_t round = 1; round <= limit; ++round) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    ++thread_lossy_counters().rounds;
+#endif
+    replay();
+    // Every new carry into a separate state.
+    for (auto b : barriers) {
+      const auto l = static_cast<std::size_t>(barrier_link_[static_cast<std::size_t>(b)]);
+      const auto span = std::span<const std::int32_t>(net_.occurrences_by_edge).subspan(
+          static_cast<std::size_t>(net_.edge_occurrence_offsets[l]), static_cast<std::size_t>(net_.edge_occurrence_offsets[l + 1] - net_.edge_occurrence_offsets[l]));
+      loss_rule(net_, span, net_.available_capacity[l], arrival_, carried_, loss_);
+    }
+    for (std::size_t i = 0; i < occs.size(); ++i) next[i] = carried_[static_cast<std::size_t>(occs[i])];
+    if (next == x) {
+      solved = true;
+      break;
+    }
+    if (round >= 2 && next == before) {
+      iterating_ = false;
+      throw std::invalid_argument("lossy forwarding iteration entered a period-2 cycle");
+    }
+    before.swap(x);
+    x.swap(next);
+  }
+  if (!solved) {
+    iterating_ = false;
+    throw std::invalid_argument("lossy forwarding iteration did not reach a fixed point within the round limit");
+  }
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  if (thread_lossy_counters().shift) {
+    // The second planted fault of the check's test: one unit moved between two occurrences of one
+    // barrier, from one whose tunnel meets no later barrier to one that dropped something, so the
+    // link's total and every continuation stay consistent and only its loss rule is wrong.
+    auto last_barrier = [&](std::int32_t o) {
+      const auto& it = item_of(o);
+      if (it.tunnel_position < 0) return false;
+      for (auto k = o + 1; k < it.first_occurrence + it.num_occurrences; ++k) {
+        if (event_of_occ(k) >= 0) return false;
+      }
+      return true;
+    };
+    std::size_t at = 0;
+    bool moved = false;
+    for (auto b : barriers) {
+      const auto l = static_cast<std::size_t>(barrier_link_[static_cast<std::size_t>(b)]);
+      const auto n = static_cast<std::size_t>(net_.edge_occurrence_offsets[l + 1] - net_.edge_occurrence_offsets[l]);
+      for (std::size_t i = at; i < at + n && !moved; ++i) {
+        for (std::size_t j = at; j < at + n && !moved; ++j) {
+          if (i == j || x[i] == 0 || !last_barrier(occs[i]) || arrival_[static_cast<std::size_t>(occs[j])] <= x[j]) continue;
+          --x[i];
+          ++x[j];
+          moved = true;
+        }
+      }
+      at += n;
+    }
+  }
+#endif
+  // The solved state's forwarding, now also into the group's successors.
+  iterating_ = false;
+  current_component_ = -1;
+  restore();
+  for (std::size_t i = 0; i < occs.size(); ++i) carry(occs[i], x[i]);
+  for (auto r : routers) split(r);
+}
+
+// The independent check of an iterated result (docs/semantics.md, "Losses on shared edges"):
+// every entry's injection, every router's split of what reaches it (a pooled router's attribution
+// to its heads too), every dark occurrence's drop, every link's loss rule and capacity, every
+// continuation, and the conservation of each entry (each head of a pooled context: delivered +
+// drops = its share).
+void LossyForwardingEvaluator::verify() const {
+  const auto fail = [] { throw std::runtime_error("lossy forwarding fixed-point verification failed"); };
+  auto check_occ = [&](std::size_t o, Amount arrives) {
+    if (arrival_[o] != arrives || carried_[o] > arrival_[o] || carried_[o] < 0) fail();
+    if (net_.dark(o) && carried_[o] != 0) fail();
+  };
+  // Continuations and splits.
+  std::vector<Amount> in(static_cast<std::size_t>(net_.num_router_positions), 0);
+  std::vector<Amount> slot_in(net_.slot_heads.size(), 0);
+  std::vector<Amount> part;
+  std::vector<Amount> remaining;
+  std::vector<Amount> row;
+  for (std::size_t i = 0; i < net_.entry_occurrences.size(); ++i) {
+    const auto& it = net_.entry_occurrences[i];
+    const auto& share = shares_[static_cast<std::size_t>(it.demand)];
+    if (it.tunnel_position >= 0) {
+      const Amount s = share[static_cast<std::size_t>(it.entry_position)];
+      Amount prev = s;
+      Amount dropped = 0;
+      for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+        const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+        check_occ(o, prev);
+        dropped += arrival_[o] - carried_[o];
+        prev = carried_[o];
+      }
+      if (delivered_[i] != prev || delivered_[i] + dropped != s) fail();
+      continue;
+    }
+    const auto& plan = *it.prepared_route;
+    const auto base = static_cast<std::size_t>(it.first_router_position);
+    if (!it.pooled) {
+      const Amount s = share[static_cast<std::size_t>(it.entry_position)];
+      in[base + static_cast<std::size_t>(it.source_position)] += s;
+      Amount dropped = 0;
+      Amount reached = 0;
+      for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+        const Amount amount = in[base + pos];
+        if (plan.is_destination[pos] != 0) {
+          reached += amount;
+          continue;
+        }
+        const auto b = static_cast<std::size_t>(plan.outgoing_begin[pos]);
+        const auto e = static_cast<std::size_t>(plan.outgoing_end[pos]);
+        part.resize(e - b);
+        split_at(plan, pos, amount, part);
+        for (std::size_t m = b; m < e; ++m) {
+          const auto o = static_cast<std::size_t>(it.first_occurrence) + m;
+          check_occ(o, part[m - b]);
+          dropped += arrival_[o] - carried_[o];
+          in[base + static_cast<std::size_t>(plan.edge_destination_positions[m])] += carried_[o];
+        }
+      }
+      if (delivered_[i] != reached || reached + dropped != s) fail();
+      continue;
+    }
+    // A pooled context: per head its injection at its root's slot, its drops and what reaches the
+    // destinations.
+    const ForwardingView& view = *net_.views[static_cast<std::size_t>(it.demand)];
+    const auto roots = pooled_root_positions(view);
+    std::vector<Amount> dropped(roots.size(), 0);
+    std::vector<Amount> reached(roots.size(), 0);
+    auto slot_of = [&](std::size_t pos, std::int32_t head) {
+      const auto [s0, s1] = slots(it, pos);
+      const auto b = net_.slot_heads.begin();
+      const auto at = std::lower_bound(b + s0, b + s1, head);
+      if (at == b + s1 || *at != head) fail();
+      return static_cast<std::size_t>(at - b);
+    };
+    for (std::size_t h = 0; h < roots.size(); ++h) {
+      if (roots[h] < 0) continue;
+      slot_in[slot_of(static_cast<std::size_t>(roots[h]), static_cast<std::int32_t>(h))] +=
+          share[static_cast<std::size_t>(view.entries_for_source(h).front())];
+    }
+    for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+      if (plan.is_destination[pos] != 0) continue;
+      const auto [s0, s1] = slots(it, pos);
+      remaining.assign(slot_in.begin() + s0, slot_in.begin() + s1);
+      Amount total = 0;
+      for (Amount x : remaining) total += x;
+      const auto b = static_cast<std::size_t>(plan.outgoing_begin[pos]);
+      const auto e = static_cast<std::size_t>(plan.outgoing_end[pos]);
+      part.resize(e - b);
+      split_at(plan, pos, total, part);
+      row.resize(remaining.size());
+      for (std::size_t m = b; m < e; ++m) {
+        highest_averages(part[m - b], remaining, row);
+        const auto first = static_cast<std::size_t>(member_occurrence(it, m));
+        const auto q = static_cast<std::size_t>(plan.edge_destination_positions[m]);
+        for (std::size_t k = 0; k < row.size(); ++k) {
+          remaining[k] -= row[k];
+          const auto o = first + k;
+          const auto head = static_cast<std::size_t>(net_.slot_heads[static_cast<std::size_t>(s0) + k]);
+          check_occ(o, row[k]);
+          dropped[head] += arrival_[o] - carried_[o];
+          if (plan.is_destination[q] != 0) {
+            reached[head] += carried_[o];
+          } else {
+            slot_in[static_cast<std::size_t>(net_.occurrence_slots[o])] += carried_[o];
+          }
+        }
+      }
+    }
+    const auto& delivered = head_delivered_[static_cast<std::size_t>(it.demand)];
+    for (std::size_t h = 0; h < roots.size(); ++h) {
+      if (roots[h] < 0) continue;
+      const Amount s = share[static_cast<std::size_t>(view.entries_for_source(h).front())];
+      if (delivered[h] != reached[h] || reached[h] + dropped[h] != s) fail();
+    }
+  }
+  // Every link: its loss rule over the sharing arrivals (a transparent link passes everything on)
+  // and its capacity.
+  std::vector<Amount> expect(carried_.size(), 0);
+  LossScratch scratch;
+  for (std::size_t l = 0; l < net_.edges.size(); ++l) {
+    const auto occs = std::span<const std::int32_t>(net_.occurrences_by_edge).subspan(
+        static_cast<std::size_t>(net_.edge_occurrence_offsets[l]), static_cast<std::size_t>(net_.edge_occurrence_offsets[l + 1] - net_.edge_occurrence_offsets[l]));
+    Amount sum = 0;
+    for (auto o : occs) sum = saturating_add(sum, carried_[static_cast<std::size_t>(o)]);
+    if (sum > net_.available_capacity[l]) fail();
+    if (transparent_[l] != 0) {
+      for (auto o : occs) {
+        if (carried_[static_cast<std::size_t>(o)] != arrival_[static_cast<std::size_t>(o)]) fail();
+      }
+      continue;
+    }
+    loss_rule(net_, occs, net_.available_capacity[l], arrival_, expect, scratch);
+    for (auto o : occs) {
+      if (expect[static_cast<std::size_t>(o)] != carried_[static_cast<std::size_t>(o)]) fail();
+    }
+  }
+}
+
+std::vector<ProgramFlow> LossyForwardingEvaluator::run(std::span<const std::span<const Amount>> injections) {
+  const std::size_t D = net_.views.size();
+  std::vector<ProgramFlow> outs(D);
+  shares_.resize(D);
+  head_delivered_.resize(D);
+  std::vector<Amount> source_drops_by_source;
+  std::vector<Amount> w;
+  std::vector<Amount> part;
+  for (std::size_t d = 0; d < D; ++d) {
+    const ForwardingView& view = *net_.views[d];
+    const std::size_t k = view.num_sources();
+    auto& out = outs[d];
+    out = empty_flow(view, true);
+    for (std::size_t h = 0; h < k; ++h) {
+      out.offered_by_source[h] = injections[d][h];
+      out.offered += injections[d][h];
+    }
+    out.admitted = out.offered;
+    auto& share = shares_[d];
+    entry_shares(view, injections[d], share, source_drops_by_source, w, part);
+    for (std::size_t h = 0; h < k; ++h) {
+      out.source_drops_by_source[h] = source_drops_by_source[h];
+      out.source_drops += source_drops_by_source[h];
+    }
+    const auto& positions = net_.entry_occurrence_positions[d];
+    for (std::size_t e = 0; e < share.size(); ++e) {
+      out.entries[e].assigned = share[e];
+      if (share[e] != 0 && positions[e] == -2) {
+        out.entries[e].source_drops = share[e];
+        out.source_drops += share[e];
+      }
+    }
+    if (view.pooled) head_delivered_[d].assign(k, 0);
+  }
+  // A+: the no-drop loads first, then the barriers.
+  std::vector<Amount> U0;
+  std::vector<Amount> scratch;
+  no_drop(net_, shares_, U0, &possible_, scratch);
+  occurrence_source_positions_.assign(net_.occurrence_edge_positions.size(), -1);
+  root_position_.assign(static_cast<std::size_t>(net_.num_router_positions), 0);
+  for (const auto& it : net_.entry_occurrences) {
+    if (it.tunnel_position >= 0) continue;
+    const auto base = static_cast<std::size_t>(it.first_router_position);
+    if (!it.pooled) {
+      root_position_[base + static_cast<std::size_t>(it.source_position)] = 1;
+      for (std::size_t pos = 0; pos < it.prepared_route->topological_order.size(); ++pos) {
+        for (auto m = it.prepared_route->outgoing_begin[pos]; m < it.prepared_route->outgoing_end[pos]; ++m) occurrence_source_positions_[static_cast<std::size_t>(it.first_occurrence + m)] = static_cast<std::int32_t>(pos);
+      }
+      continue;
+    }
+    // A head whose share is 0 injects nothing.
+    const ForwardingView& view = *net_.views[static_cast<std::size_t>(it.demand)];
+    const auto roots = pooled_root_positions(view);
+    for (std::size_t h = 0; h < roots.size(); ++h) {
+      const Amount s = shares_[static_cast<std::size_t>(it.demand)][static_cast<std::size_t>(view.entries_for_source(h).front())];
+      if (roots[h] >= 0 && s != 0) root_position_[base + static_cast<std::size_t>(roots[h])] = 1;
+    }
+    for (std::size_t m = 0; m < it.prepared_route->forwarding_edges.size(); ++m) {
+      const auto tail = net_.member_tail_positions[it.first_member + m];
+      for (auto o = member_occurrence(it, m); o < member_occurrence(it, m + 1); ++o) occurrence_source_positions_[static_cast<std::size_t>(o)] = tail;
+    }
+  }
+  normalize_serial_links(U0);
+  const auto n = net_.occurrence_edge_positions.size();
+  arrival_.assign(n, 0);
+  carried_.assign(n, 0);
+  inflow_.assign(static_cast<std::size_t>(net_.num_router_positions), 0);
+  slot_inflow_.assign(net_.slot_heads.size(), 0);
+  delivered_.assign(net_.entry_occurrences.size(), 0);
+  build_events();
+  find_strong_components();
+  // The injections: a tunnel's share enters its first hop, a split route's its root router, a
+  // pooled context's heads' shares their roots' slots.
+  for (std::size_t i = 0; i < net_.entry_occurrences.size(); ++i) {
+    const auto& it = net_.entry_occurrences[i];
+    const auto& share = shares_[static_cast<std::size_t>(it.demand)];
+    if (it.tunnel_position >= 0) {
+      reach(it.first_occurrence, share[static_cast<std::size_t>(it.entry_position)]);
+    } else if (!it.pooled) {
+      inflow_[static_cast<std::size_t>(it.first_router_position + it.source_position)] += share[static_cast<std::size_t>(it.entry_position)];
+    } else {
+      const ForwardingView& view = *net_.views[static_cast<std::size_t>(it.demand)];
+      const auto roots = pooled_root_positions(view);
+      for (std::size_t h = 0; h < roots.size(); ++h) {
+        if (roots[h] < 0) continue;
+        const auto [s0, s1] = slots(it, static_cast<std::size_t>(roots[h]));
+        const auto b = net_.slot_heads.begin();
+        const auto at = std::lower_bound(b + s0, b + s1, static_cast<std::int32_t>(h));
+        slot_inflow_[static_cast<std::size_t>(at - b)] += share[static_cast<std::size_t>(view.entries_for_source(h).front())];
+      }
+    }
+  }
+  // The groups in dependency order, the smallest key first among the ready ones. Each group's
+  // events, ascending, in one array (a group per offset range: a pooled plan has a group per router).
+  const auto ns = static_cast<std::size_t>(num_scc_);
+  std::vector<std::int32_t> member_offsets(ns + 1, 0);
+  for (std::int32_t ev = 0; ev < num_events_; ++ev) ++member_offsets[static_cast<std::size_t>(scc_[static_cast<std::size_t>(ev)]) + 1];
+  for (std::size_t g = 0; g < ns; ++g) member_offsets[g + 1] += member_offsets[g];
+  std::vector<std::int32_t> member_events(static_cast<std::size_t>(num_events_));
+  {
+    std::vector<std::int32_t> fill(member_offsets.begin(), member_offsets.end() - 1);
+    for (std::int32_t ev = 0; ev < num_events_; ++ev) member_events[static_cast<std::size_t>(fill[static_cast<std::size_t>(scc_[static_cast<std::size_t>(ev)])]++)] = ev;
+  }
+  auto members = [&](std::int32_t g) {
+    const auto b = static_cast<std::size_t>(member_offsets[static_cast<std::size_t>(g)]);
+    return std::span<const std::int32_t>(member_events).subspan(b, static_cast<std::size_t>(member_offsets[static_cast<std::size_t>(g) + 1]) - b);
+  };
+  std::vector<std::int32_t> indeg(ns, 0);
+  std::vector<std::uint8_t> cyclic(ns, 0);
+  for (std::int32_t ev = 0; ev < num_events_; ++ev) {
+    const auto a = scc_[static_cast<std::size_t>(ev)];
+    for (auto kk = dependency_offsets_[static_cast<std::size_t>(ev)]; kk < dependency_offsets_[static_cast<std::size_t>(ev) + 1]; ++kk) {
+      const auto b = scc_[static_cast<std::size_t>(dependencies_[static_cast<std::size_t>(kk)])];
+      if (a == b) {
+        cyclic[static_cast<std::size_t>(a)] = 1;
+      } else {
+        ++indeg[static_cast<std::size_t>(b)];
+      }
+    }
+  }
+  using Key = std::tuple<int, std::int64_t, std::int32_t>;
+  auto key = [&](std::int32_t s) -> Key {
+    const auto m = members(s);
+    std::int64_t edge = std::numeric_limits<std::int64_t>::max();
+    for (auto ev : m) {
+      if (ev < num_barriers_) edge = std::min<std::int64_t>(edge, net_.edges[static_cast<std::size_t>(barrier_link_[static_cast<std::size_t>(ev)])]);
+    }
+    if (edge != std::numeric_limits<std::int64_t>::max()) return {0, edge, s};
+    return {1, m.front(), s};
+  };
+  std::priority_queue<Key, std::vector<Key>, std::greater<>> ready;
+  for (std::size_t s = 0; s < ns; ++s) {
+    if (indeg[s] == 0) ready.push(key(static_cast<std::int32_t>(s)));
+  }
+  while (!ready.empty()) {
+    const auto s = std::get<2>(ready.top());
+    ready.pop();
+    const auto m = members(s);
+    if (cyclic[static_cast<std::size_t>(s)] != 0) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      ++thread_lossy_counters().groups;
+#endif
+      iterate(s);
+    } else if (m.front() < num_barriers_) {
+      evaluate_barrier(m.front());
+    } else {
+      split(m.front());
+    }
+    for (auto ev : m) {
+      for (auto kk = dependency_offsets_[static_cast<std::size_t>(ev)]; kk < dependency_offsets_[static_cast<std::size_t>(ev) + 1]; ++kk) {
+        const auto b = scc_[static_cast<std::size_t>(dependencies_[static_cast<std::size_t>(kk)])];
+        if (b != s && --indeg[static_cast<std::size_t>(b)] == 0) ready.push(key(b));
+      }
+    }
+  }
+  // Split routes deliver what reaches their destinations (a pooled context per head).
+  for (std::size_t i = 0; i < net_.entry_occurrences.size(); ++i) {
+    const auto& it = net_.entry_occurrences[i];
+    if (it.tunnel_position >= 0) continue;
+    const auto& plan = *it.prepared_route;
+    if (it.pooled) {
+      auto& delivered = head_delivered_[static_cast<std::size_t>(it.demand)];
+      for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+        const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+        const auto m = static_cast<std::size_t>(net_.occurrence_route_positions[o]);
+        if (plan.is_destination[static_cast<std::size_t>(plan.edge_destination_positions[m])] != 0) {
+          delivered[static_cast<std::size_t>(net_.occurrence_heads[o])] += carried_[o];
+        }
+      }
+      continue;
+    }
+    Amount d = 0;
+    for (std::size_t pos = 0; pos < plan.topological_order.size(); ++pos) {
+      if (plan.is_destination[pos] != 0) d += inflow_[static_cast<std::size_t>(it.first_router_position) + pos];
+    }
+    delivered_[i] = d;
+  }
+  if (iterated_) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    if (thread_lossy_counters().corrupt && !carried_.empty()) {
+      // The planted fault of the check's test: one carried amount changed after the rounds.
+      for (auto& c : carried_) {
+        if (c > 0) {
+          --c;
+          break;
+        }
+      }
+    }
+#endif
+    verify();
+  }
+  for (std::size_t i = 0; i < net_.entry_occurrences.size(); ++i) {
+    const auto& it = net_.entry_occurrences[i];
+    auto& out = outs[static_cast<std::size_t>(it.demand)];
+    if (it.pooled) {
+      const ForwardingView& view = *net_.views[static_cast<std::size_t>(it.demand)];
+      const auto& delivered = head_delivered_[static_cast<std::size_t>(it.demand)];
+      for (std::size_t h = 0; h < view.num_sources(); ++h) {
+        auto& f = out.entries[static_cast<std::size_t>(view.entries_for_source(h).front())];
+        f.delivered = delivered[h];
+        out.delivered += delivered[h];
+      }
+      // By member (ascending EdgeId), each occurrence to its head's entry.
+      for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+        const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+        auto& f = out.entries[static_cast<std::size_t>(view.entries_for_source(static_cast<std::size_t>(net_.occurrence_heads[o])).front())];
+        const EdgeId e = net_.edges[static_cast<std::size_t>(net_.occurrence_edge_positions[o])];
+        if (carried_[o] != 0) f.edge_flows.emplace_back(e, carried_[o]);
+        if (arrival_[o] != carried_[o]) f.edge_drops.emplace_back(e, arrival_[o] - carried_[o]);
+      }
+      continue;
+    }
+    auto& f = out.entries[static_cast<std::size_t>(it.entry_position)];
+    f.delivered = delivered_[i];
+    out.delivered += delivered_[i];
+    for (std::int32_t j = 0; j < it.num_occurrences; ++j) {
+      const auto o = static_cast<std::size_t>(it.first_occurrence + j);
+      const EdgeId e = net_.edges[static_cast<std::size_t>(net_.occurrence_edge_positions[o])];
+      if (carried_[o] != 0) f.edge_flows.emplace_back(e, carried_[o]);
+      if (arrival_[o] != carried_[o]) f.edge_drops.emplace_back(e, arrival_[o] - carried_[o]);
+    }
+    if (it.tunnel_position >= 0) {
+      sort_pairs(f.edge_flows);
+      sort_pairs(f.edge_drops);
+    }
+  }
+  return outs;
+}
+
+// The joint evaluation of demands (one network, one evaluator), the hooks' counters reset.
+std::vector<ProgramFlow> joint_lossy(std::span<const ForwardingView* const> views, std::span<const std::span<const Amount>> injections,
+                                     const AvailableCapacityFn& free) {
+  const ForwardingNetwork net = build_forwarding_network(views, free, true);
+  LossyForwardingEvaluator run(net);
+  return run.run(injections);
+}
+
+} // namespace
+
+ProgramFlow lossless(const ForwardingView& view, const AvailableCapacityFn& free, Amount lo, std::optional<Amount> hi) {
+  if (view.pooled) return pooled_lossless(view, free, lo, hi);
+  return general_lossless(view, free, lo, hi);
+}
+
+ProgramFlow lossy(const ForwardingView& view, const AvailableCapacityFn& free, std::span<const Amount> injections) {
+  if (injections.size() != view.num_sources()) throw std::logic_error("forwarding: the injections are not head-aligned");
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  thread_lossy_counters().groups = 0;
+  thread_lossy_counters().rounds = 0;
+  thread_lossy_counters().event_structures = 0;
+  thread_lossy_counters().barriers.clear();
+  thread_lossy_counters().dependencies = 0;
+#endif
+  if (view.pooled) return pooled_lossy(view, free, injections);
+  const ForwardingView* const views[] = {&view};
+  const std::span<const Amount> inject[] = {injections};
+  return std::move(joint_lossy(views, inject, free).front());
+}
+
+std::vector<ProgramFlow> lossy(std::span<const ForwardingDemand> demands, const AvailableCapacityFn& free) {
+  std::vector<const ForwardingView*> views;
+  std::vector<std::span<const Amount>> injections;
+  views.reserve(demands.size());
+  injections.reserve(demands.size());
+  for (const auto& d : demands) {
+    if (d.view == nullptr || d.injections.size() != d.view->num_sources()) {
+      throw std::logic_error("forwarding: a demand's injections are not head-aligned");
+    }
+    views.push_back(d.view);
+    injections.push_back(d.injections);
+  }
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  thread_lossy_counters().groups = 0;
+  thread_lossy_counters().rounds = 0;
+  thread_lossy_counters().event_structures = 0;
+  thread_lossy_counters().barriers.clear();
+  thread_lossy_counters().dependencies = 0;
+#endif
+  return joint_lossy(views, injections, free);
+}
+
+} // namespace netgraph::core::detail
diff --git a/src/forwarding_program.cpp b/src/forwarding_program.cpp
new file mode 100644
index 0000000..e18e720
--- /dev/null
+++ b/src/forwarding_program.cpp
@@ -0,0 +1,579 @@
+/*
+  ForwardingProgram: the value, from_routes, the programs of the computing models and the
+  comparison of the change flags.
+
+  Every program keeps its entries in ascending index, per roster slot its entries, its split
+  contexts (one plan each; a ShortestPaths program's is pooled over its roster) and its replay basis.
+  Nothing in a program changes after construction; policies share it by reference.
+*/
+#include "netgraph/core/forwarding_program.hpp"
+
+#include <algorithm>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+#include "netgraph/core/detail/edge_amounts.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/detail/concurrency.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+
+namespace netgraph::core {
+
+ForwardingProgram::ForwardingProgram(const detail::ProgramData* data) noexcept : data_(data) {}
+ForwardingProgram::~ForwardingProgram() = default;
+
+std::uint64_t ForwardingProgram::graph_uid() const noexcept { return data_->graph_uid; }
+std::span<const NodeId> ForwardingProgram::sources() const noexcept { return data_->sources; }
+std::span<const NodeId> ForwardingProgram::destinations() const noexcept { return data_->destinations; }
+std::span<const Tunnel> ForwardingProgram::tunnels() const noexcept { return data_->tunnels; }
+const std::optional<std::vector<std::pair<NodeId, Amount>>>& ForwardingProgram::source_weights() const noexcept {
+  return data_->source_weights;
+}
+
+namespace detail {
+
+namespace {
+
+[[noreturn]] void invalid(const std::string& what) { throw std::invalid_argument(what); }
+
+std::string route_at(std::size_t i) { return "routes[" + std::to_string(i) + "]: "; }
+
+} // namespace
+
+void ProgramData::initialize_storage(std::span<const NodeId> source, std::span<const NodeId> destination,
+                          std::optional<std::span<const NodeId>> given, std::span<const NodeId> xn,
+                          std::span<const EdgeId> xe) {
+  const std::size_t n = entries.size();
+  const std::size_t room = given.has_value() ? given->size() : n;  // the roster's room
+  const std::size_t lists = pools_source_inflows ? 0 : room + 2 + n;              // source_entry_offsets (counting sort) + source_entry_positions
+  std::size_t roots = 0;
+  for (const auto& c : split_contexts) roots += c.prepared_route->sources.size();
+  // The block, in this order: sources, destinations, roster, excluded nodes and edges, the per-slot
+  // lists, the per-tunnel entries, the contexts' root entries.
+  std::vector<std::int32_t> store(source.size() + destination.size() + room + xn.size() + xe.size() + lists + tunnels.size() +
+                                  roots);
+  std::int32_t* at = store.data();
+  auto put = [&at](auto list) {
+    std::int32_t* first = at;
+    at = std::copy(list.begin(), list.end(), at);
+    return first;
+  };
+  NodeId* s0 = put(source);
+  NodeId* d0 = put(destination);
+  NodeId* r0 = at;
+  std::size_t k = 0;
+  if (given.has_value()) {
+    put(*given);
+    k = given->size();
+  } else {
+    for (const auto& entry : entries) *at++ = entry.head;
+    std::sort(r0, at);
+    k = static_cast<std::size_t>(std::unique(r0, at) - r0);
+    at = r0 + room;
+  }
+  NodeId* xn0 = put(xn);
+  EdgeId* xe0 = put(xe);
+  std::int32_t* first = at;
+  std::int32_t* order = first + (pools_source_inflows ? 0 : room + 2);
+  std::int32_t* by_tunnel = first + lists;
+  const std::span<const NodeId> ros(r0, k);
+  for (auto& entry : entries) {
+    entry.roster_index = static_cast<std::int32_t>(std::lower_bound(ros.begin(), ros.end(), entry.head) - ros.begin());
+  }
+  if (pools_source_inflows) {
+    // A pooled program's slots carry one entry each (entries_for_source): no lists, local index 0.
+    for (auto& entry : entries) entry.local_index = 0;
+  } else {
+    // A stable counting sort by slot: counted at slot + 2, summed, placed through slot + 1 (which
+    // then holds the slot's end, the next slot's start); ascending index within a slot.
+    for (const auto& entry : entries) ++first[static_cast<std::size_t>(entry.roster_index) + 2];
+    for (std::size_t x = 2; x < k + 2; ++x) first[x] += first[x - 1];
+    for (std::size_t e = 0; e < n; ++e) order[first[static_cast<std::size_t>(entries[e].roster_index) + 1]++] = static_cast<std::int32_t>(e);
+    for (std::size_t x = 0; x < k; ++x) {
+      for (auto j = first[x]; j < first[x + 1]; ++j) {
+        auto& entry = entries[static_cast<std::size_t>(order[j])];
+        entry.local_index = j - first[x];
+        if (entry.tunnel_position >= 0) tunnels[static_cast<std::size_t>(entry.tunnel_position)].local_index = entry.local_index;
+      }
+    }
+  }
+  std::fill(by_tunnel, by_tunnel + tunnels.size() + roots, -1);
+  for (std::size_t e = 0; e < n; ++e) {
+    if (entries[e].tunnel_position >= 0) by_tunnel[entries[e].tunnel_position] = static_cast<std::int32_t>(e);
+  }
+  // Each context's root entries: the entry of that context whose head is the root (a ShortestPaths
+  // plan's roots are its roster, each with its entry; a supplied split route's is its head).
+  std::int32_t* root0 = by_tunnel + tunnels.size();
+  for (std::size_t c = 0, at_root = 0; c < split_contexts.size(); ++c) {
+    split_contexts[c].source_entry_positions = {root0 + at_root, split_contexts[c].prepared_route->sources.size()};
+    at_root += split_contexts[c].prepared_route->sources.size();
+  }
+  for (std::size_t e = 0; e < n; ++e) {
+    const auto c = entries[e].split_context_position;
+    if (c < 0) continue;
+    const auto& ctx = split_contexts[static_cast<std::size_t>(c)];
+    const auto& plan_roots = ctx.prepared_route->sources;
+    const auto r = std::lower_bound(plan_roots.begin(), plan_roots.end(), entries[e].head) - plan_roots.begin();
+    root0[(ctx.source_entry_positions.data() - root0) + r] = static_cast<std::int32_t>(e);
+  }
+  // The views, into the block now owned (a vector's move keeps its elements where they are).
+  store_ = std::move(store);
+  sources = {s0, source.size()};
+  destinations = {d0, destination.size()};
+  reachable_sources = ros;
+  excluded_nodes = {xn0, xn.size()};
+  excluded_edges = {xe0, xe.size()};
+  source_entry_offsets = pools_source_inflows ? std::span<const std::int32_t> {} : std::span<const std::int32_t>(first, k + 1);
+  source_entry_positions = pools_source_inflows ? std::span<const std::int32_t> {} : std::span<const std::int32_t>(order, n);
+  tunnel_entry_positions = {by_tunnel, tunnels.size()};
+}
+
+std::shared_ptr<const ForwardingProgram> ProgramAccess::make(ProgramData&& data) {
+  auto block = std::make_shared<const ProgramBlock>(std::move(data));
+  return {block, &block->program};
+}
+
+void check_route_options(const char* function, bool any_dag, std::optional<RouteAllocation> allocation,
+                         std::optional<WeightBasis> weight_basis, bool edge_weights, bool residual) {
+  if (!any_dag) {
+    if (allocation.has_value()) invalid("allocation applies only to PredecessorDAG routes");
+    if (weight_basis.has_value()) invalid("weight_basis applies only to PredecessorDAG routes");
+    if (edge_weights) invalid("edge_weights applies only to PredecessorDAG routes");
+    if (residual) invalid("residual applies only to PredecessorDAG routes");
+    return;
+  }
+  if (allocation.has_value()) check_member(*allocation, "allocation");
+  if (weight_basis.has_value()) check_member(*weight_basis, "weight_basis");
+  if (allocation == RouteAllocation::Optimized) invalid(std::string(function) + " allocation must be EQUAL or WEIGHTED");
+  const bool weighted = allocation == RouteAllocation::Weighted;
+  if (weight_basis.has_value() && !weighted) invalid("weight_basis requires allocation=WEIGHTED");
+  if (weight_basis == WeightBasis::Explicit && !edge_weights) invalid("weight_basis=EXPLICIT requires edge_weights");
+  if (edge_weights && weight_basis != WeightBasis::Explicit) invalid("edge_weights require weight_basis=EXPLICIT");
+  if (weight_basis == WeightBasis::ResidualSnapshot && !residual) invalid("weight_basis=RESIDUAL_SNAPSHOT requires residual");
+  if (residual && weight_basis != WeightBasis::ResidualSnapshot) invalid("residual requires weight_basis=RESIDUAL_SNAPSHOT");
+}
+
+// ---------------------------------------------------------------- the models' programs
+
+std::shared_ptr<const ForwardingProgram> optimized_flow_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> reachable_sources, std::vector<OptimizedFlowPath> paths, std::span<const Amount> supplies,
+    ReplayBasis basis) {
+  ProgramData data;
+  ProgramData* p = &data;
+  p->graph_uid = graph.uid();
+  if (!supplies.empty()) {
+    p->source_weight_values.assign(supplies.begin(), supplies.end());
+    p->source_weights.emplace();
+    p->source_weights->reserve(reachable_sources.size());
+    for (std::size_t i = 0; i < reachable_sources.size(); ++i) p->source_weights->emplace_back(reachable_sources[i], supplies[i]);
+  }
+  const auto cost = graph.edge_costs();
+  const auto edge_destinations = graph.edge_destinations();
+  p->tunnels.reserve(paths.size());
+  p->entries.reserve(paths.size());
+  for (std::size_t i = 0; i < paths.size(); ++i) {
+    auto& path = paths[i];
+    Tunnel t;
+    t.entry_id = static_cast<std::int32_t>(i);
+    t.head = reachable_sources[static_cast<std::size_t>(path.roster_index)];
+    t.destination = edge_destinations[static_cast<std::size_t>(path.edges.back())];
+    Cost route_cost = 0;
+    for (EdgeId e : path.edges) route_cost += cost[static_cast<std::size_t>(e)];
+    t.path_cost = route_cost;
+    t.weight = path.weight;
+    ProgramEntry entry;
+    entry.entry_id = t.entry_id;
+    entry.head = t.head;
+    entry.roster_index = path.roster_index;
+    entry.weight = path.weight;
+    entry.tunnel_position = static_cast<std::int32_t>(i);
+    entry.min_route_cost = route_cost;
+    t.edges = std::move(path.edges);
+    p->tunnels.push_back(std::move(t));
+    p->entries.push_back(std::move(entry));
+  }
+  p->uses_topology_basis = basis.uses_topology_basis;
+  p->source_supports = std::move(basis.source_supports);
+  p->common_replay_support = std::move(basis.common_support);
+  p->initialize_storage(sources, destinations, reachable_sources, basis.excluded_nodes, basis.excluded_edges);
+  return ProgramAccess::make(std::move(data));
+}
+
+std::shared_ptr<const ForwardingProgram> shortest_path_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> reachable_sources, std::shared_ptr<const PreparedRoute> plan, std::vector<ProgramEntry> entries) {
+  ProgramData data;
+  ProgramData* p = &data;
+  p->graph_uid = graph.uid();
+  SplitContext ctx;
+  ctx.prepared_route = std::move(plan);
+  p->entries = std::move(entries);
+  for (std::size_t i = 0; i < reachable_sources.size(); ++i) {
+    auto& entry = p->entries[i];
+    entry.entry_id = static_cast<std::int32_t>(i);
+    entry.head = reachable_sources[i];
+    entry.roster_index = static_cast<std::int32_t>(i);
+    entry.weight = 1;
+    entry.split_context_position = 0;
+  }
+  p->split_contexts.push_back(std::move(ctx));
+  p->pools_source_inflows = true;
+  p->initialize_storage(sources, destinations, reachable_sources);
+  return ProgramAccess::make(std::move(data));
+}
+
+std::shared_ptr<const ForwardingProgram> pooled_dag_program(
+    const Graph& graph, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> roster, const PredecessorDAG& dag, RouteAllocation allocation,
+    const WeightSource& weights, std::vector<ProgramEntry> entries) {
+  // Equal and Weighted take either admission: the plan is the same for both.
+  auto plan = std::make_shared<const PreparedRoute>(
+      prepare_route(graph, allocation, Admission::Lossless, weights, roster, destinations, dag));
+  return shortest_path_program(graph, sources, destinations, roster, std::move(plan), std::move(entries));
+}
+
+std::shared_ptr<const ForwardingProgram> distributed_te_program(
+    const Graph& g, std::span<const NodeId> sources, std::span<const NodeId> destinations,
+    std::span<const NodeId> roster, std::vector<TunnelSetupResult> tunnels, std::span<const NodeId> excluded_nodes,
+    std::span<const EdgeId> excluded_edges) {
+  ProgramData data;
+  ProgramData* p = &data;
+  p->graph_uid = g.uid();
+  const auto edge_destinations = g.edge_destinations();
+  const auto H = static_cast<std::int32_t>(roster.size());
+  p->tunnels.reserve(tunnels.size());
+  p->entries.reserve(tunnels.size());
+  for (std::size_t i = 0; i < tunnels.size(); ++i) {
+    auto& s = tunnels[i];
+    const bool up = s.status == TunnelStatus::Up;
+    Tunnel t;
+    t.entry_id = s.local_index * H + s.roster_index;
+    t.head = roster[static_cast<std::size_t>(s.roster_index)];
+    t.status = s.status;
+    t.requested_bandwidth = s.requested_bandwidth;
+    t.reserved_bandwidth = up ? s.requested_bandwidth : 0;
+    t.planned_bandwidth = s.planned;
+    t.weight = up ? 1 : 0;
+    ProgramEntry entry;
+    entry.entry_id = t.entry_id;
+    entry.head = t.head;
+    entry.roster_index = s.roster_index;
+    entry.weight = t.weight;
+    entry.tunnel_position = static_cast<std::int32_t>(i);
+    entry.min_route_cost = up ? s.path_cost : kUnreachable;
+    if (up) {
+      t.destination = edge_destinations[static_cast<std::size_t>(s.edges.back())];
+      t.path_cost = s.path_cost;
+      t.edges = std::move(s.edges);
+    }
+    p->tunnels.push_back(std::move(t));
+    p->entries.push_back(std::move(entry));
+  }
+  p->uses_topology_basis = true;
+  p->initialize_storage(sources, destinations, roster, excluded_nodes, excluded_edges);
+  return ProgramAccess::make(std::move(data));
+}
+
+std::shared_ptr<const ForwardingProgram> empty_program(std::uint64_t graph_uid, std::span<const NodeId> sources,
+                                                       std::span<const NodeId> destinations, bool captured) {
+  ProgramData data;
+  ProgramData* p = &data;
+  p->graph_uid = graph_uid;
+  if (captured) p->source_weights.emplace();
+  p->initialize_storage(sources, destinations, std::span<const NodeId> {});
+  return ProgramAccess::make(std::move(data));
+}
+
+// ---------------------------------------------------------------- the change flags
+
+namespace {
+
+bool same_plan_structure(const PreparedRoute& a, const PreparedRoute& b) noexcept {
+  return a.allocation == b.allocation && a.forwarding_edges == b.forwarding_edges && std::equal(a.sources.begin(), a.sources.end(), b.sources.begin(), b.sources.end());
+}
+
+} // namespace
+
+void ProgramData::basis_parts(std::size_t slot, std::vector<std::pair<std::span<const EdgeId>, bool>>& out) const {
+  if (common_replay_support) {
+    out.emplace_back(*common_replay_support, true);
+    return;
+  }
+  if (!source_supports.empty()) {
+    out.emplace_back(PredecessorDAGBuilder::ascending(*source_supports[slot]), true);
+    return;
+  }
+  for (std::int32_t e : entries_for_source(slot)) {
+    const auto& entry = entries[static_cast<std::size_t>(e)];
+    if (entry.tunnel_position >= 0) {
+      out.emplace_back(path_of(tunnels[static_cast<std::size_t>(entry.tunnel_position)]), false);
+    } else {
+      out.emplace_back(PredecessorDAGBuilder::ascending(*entry.route), true);
+    }
+  }
+}
+
+ProgramChange compare_programs(const ForwardingProgram* before, const ForwardingProgram* after,
+                               bool reservations) noexcept {
+  static const ProgramData kNone {};
+  const ProgramData& a = before != nullptr ? ProgramAccess::data(*before) : kNone;
+  const ProgramData& b = after != nullptr ? ProgramAccess::data(*after) : kNone;
+  if (a.entries.empty() && b.entries.empty()) return {};
+  ProgramChange out;
+  // Routes: the ordered heads, each entry's kind and route (a tunnel's path, a split route's
+  // context), duplicates included (entries are compared one by one).
+  out.routes = !std::ranges::equal(a.reachable_sources, b.reachable_sources) || a.entries.size() != b.entries.size() ||
+               a.split_contexts.size() != b.split_contexts.size();
+  for (std::size_t i = 0; !out.routes && i < a.entries.size(); ++i) {
+    const auto& x = a.entries[i];
+    const auto& y = b.entries[i];
+    if (x.entry_id != y.entry_id || x.head != y.head || (x.tunnel_position < 0) != (y.tunnel_position < 0)) {
+      out.routes = true;
+    } else if (x.tunnel_position >= 0) {
+      out.routes = a.tunnels[static_cast<std::size_t>(x.tunnel_position)].edges != b.tunnels[static_cast<std::size_t>(y.tunnel_position)].edges;
+    } else {
+      out.routes = x.split_context_position != y.split_context_position;
+    }
+  }
+  for (std::size_t c = 0; !out.routes && c < a.split_contexts.size(); ++c) {
+    out.routes = !same_plan_structure(*a.split_contexts[c].prepared_route, *b.split_contexts[c].prepared_route);
+  }
+  // Weights: the injection (equal or the captured weights) and every entry and split-table weight,
+  // an entry absent from one program counting as weight 0 there.
+  out.weights = a.source_weights.has_value() != b.source_weights.has_value() || a.source_weight_values != b.source_weight_values ||
+                a.split_contexts.size() != b.split_contexts.size();
+  const std::size_t n = std::max(a.entries.size(), b.entries.size());
+  auto weight = [](const ProgramData& p, std::size_t i) { return i < p.entries.size() ? p.entries[i].weight : Amount {0}; };
+  for (std::size_t i = 0; !out.weights && i < n; ++i) out.weights = weight(a, i) != weight(b, i);
+  for (std::size_t c = 0; !out.weights && c < a.split_contexts.size(); ++c) {
+    out.weights = a.split_contexts[c].prepared_route->weights != b.split_contexts[c].prepared_route->weights;
+  }
+  // Reservations: every tunnel's (requested, reserved) by index (both lists ascend), a tunnel
+  // absent from one program counting as (0, 0) there (only T1 tunnels have them).
+  if (!reservations) return out;
+  auto held = [](const Tunnel& t) { return t.requested_bandwidth != 0 || t.reserved_bandwidth != 0; };
+  std::size_t i = 0;
+  std::size_t j = 0;
+  while (!out.reservations && (i < a.tunnels.size() || j < b.tunnels.size())) {
+    const Tunnel* x = i < a.tunnels.size() ? &a.tunnels[i] : nullptr;
+    const Tunnel* y = j < b.tunnels.size() ? &b.tunnels[j] : nullptr;
+    if (x != nullptr && (y == nullptr || x->entry_id < y->entry_id)) {
+      out.reservations = held(*x);
+      ++i;
+    } else if (y != nullptr && (x == nullptr || y->entry_id < x->entry_id)) {
+      out.reservations = held(*y);
+      ++j;
+    } else {
+      out.reservations = x->requested_bandwidth != y->requested_bandwidth || x->reserved_bandwidth != y->reserved_bandwidth;
+      ++i;
+      ++j;
+    }
+  }
+  return out;
+}
+
+} // namespace detail
+
+// ---------------------------------------------------------------- from_routes
+
+namespace {
+
+// The last option step of from_routes and from_dag: edge_weights' length and entries, then residual's (the ledger's baseline messages).
+void check_route_vectors(const Graph& graph, const RouteOptions& options) {
+  const auto E = static_cast<std::size_t>(graph.num_edges());
+  if (options.edge_weights.has_value()) {
+    const auto& w = *options.edge_weights;
+    if (w.size() != E) detail::invalid("edge_weights: expected " + std::to_string(E) + " entries");
+    for (std::size_t e = 0; e < E; ++e) {
+      if (w[e] < 0 || w[e] >= kDomainLimit) detail::invalid("edge_weights[" + std::to_string(e) + "] must be an integer in [0, 2^62)");
+    }
+  }
+  if (options.residual.has_value()) detail::check_edge_amounts(graph, *options.residual, "residual");
+}
+
+} // namespace
+
+detail::ProgramData detail::check_route_definitions(const Graph& graph, std::span<const NodeId> src,
+    std::span<const NodeId> dst, std::span<const RouteDefinition> routes, const RouteOptions& options) {
+  using detail::invalid;
+  using detail::route_at;
+  // 7. Each route in list order, its entry made as soon as it is checked (a later route's failure
+  // discards the program being made). The roster is the sources with a route.
+  const auto edge_destinations = graph.edge_destinations();
+  const RouteAllocation allocation = options.allocation.value_or(RouteAllocation::Equal);
+  const WeightBasis basis = options.weight_basis.value_or(WeightBasis::Capacity);
+  // Weighted reads its weights per edge: the explicit weights or the residual snapshot.
+  std::span<const Amount> edge_values;
+  if (allocation == RouteAllocation::Weighted && basis == WeightBasis::Explicit) edge_values = *options.edge_weights;
+  if (allocation == RouteAllocation::Weighted && basis == WeightBasis::ResidualSnapshot) edge_values = *options.residual;
+  detail::ProgramData data;
+  detail::ProgramData* p = &data;
+  p->graph_uid = graph.uid();
+  std::size_t num_dags = 0;
+  for (const auto& r : routes) num_dags += std::holds_alternative<std::shared_ptr<const PredecessorDAG>>(r.route) ? 1 : 0;
+  p->entries.reserve(routes.size());
+  p->split_contexts.reserve(num_dags);
+  p->tunnels.reserve(routes.size() - num_dags);
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    const auto& r = routes[i];
+    detail::concurrent_event(detail::ConcurrentStage::RouteDefinitionCheck, &r);
+    const auto* path = std::get_if<std::shared_ptr<const Path>>(&r.route);
+    const auto* dag = std::get_if<std::shared_ptr<const PredecessorDAG>>(&r.route);
+    if ((path != nullptr && !*path) || (dag != nullptr && !*dag)) invalid(route_at(i) + "route is null");
+    const std::uint64_t uid = path != nullptr ? (*path)->graph_uid() : (*dag)->graph_uid();
+    if (uid != graph.uid()) invalid(route_at(i) + "route belongs to another graph");
+    if (!std::binary_search(src.begin(), src.end(), r.head)) {
+      invalid(route_at(i) + "head " + std::to_string(r.head) + " is not a source");
+    }
+    detail::ProgramEntry entry;
+    entry.entry_id = static_cast<std::int32_t>(i);
+    entry.head = r.head;
+    entry.weight = r.weight;
+    if (path != nullptr) {
+      const auto& hops = (*path)->hops();
+      for (const auto& hop : hops) {
+        if (hop.size() != 1) invalid(route_at(i) + "a tunnel has one edge per hop");
+      }
+      if ((*path)->source() != r.head) {
+        invalid(route_at(i) + "the path starts at " + std::to_string((*path)->source()) + ", not at head " + std::to_string(r.head));
+      }
+      if (!std::binary_search(dst.begin(), dst.end(), (*path)->destination())) {
+        invalid(route_at(i) + "the path ends at " + std::to_string((*path)->destination()) + ", not at a destination");
+      }
+      for (std::size_t h = 0; h + 1 < hops.size(); ++h) {
+        const NodeId v = edge_destinations[static_cast<std::size_t>(hops[h].front())];
+        if (std::binary_search(dst.begin(), dst.end(), v)) {
+          invalid(route_at(i) + "the path meets destination " + std::to_string(v) + " before its end");
+        }
+      }
+      if (r.weight < 0 || r.weight >= kDomainLimit) invalid(route_at(i) + "weight must be an integer in [0, 2^62)");
+      Tunnel t;
+      t.entry_id = entry.entry_id;
+      t.head = r.head;
+      t.destination = (*path)->destination();
+      t.path_cost = (*path)->cost();
+      t.weight = r.weight;
+      entry.tunnel_position = static_cast<std::int32_t>(p->tunnels.size());
+      entry.min_route_cost = (*path)->cost();
+      p->tunnels.push_back(std::move(t));
+    } else {
+      // The plan in one pass: its route (the DAG's edges on the walks from the head to a
+      // destination, before any weight pruning: the walk check) and the route's cost.
+      Cost cost = kUnreachable;
+      auto plan = detail::prepare_supplied_route(graph, allocation, basis, edge_values, r.head, dst, **dag, &cost);
+      if (plan.support_edges.empty()) invalid(route_at(i) + "no walk from head " + std::to_string(r.head) + " to a destination");
+      if (r.weight < 0 || r.weight >= kDomainLimit) invalid(route_at(i) + "weight must be an integer in [0, 2^62)");
+      // Its own split context; the record route is the supplied DAG itself when nothing was
+      // pruned (shared, never copied).
+      const auto route_dag = plan.support_edges.size() == detail::PredecessorDAGBuilder::ascending(**dag).size()
+                                 ? *dag
+                                 : std::make_shared<const PredecessorDAG>(detail::PredecessorDAGBuilder::of_edges(graph, plan.support_edges));
+      detail::SplitContext ctx;
+      ctx.prepared_route = std::make_shared<const detail::PreparedRoute>(std::move(plan));
+      entry.split_context_position = static_cast<std::int32_t>(p->split_contexts.size());
+      entry.route = route_dag;
+      entry.min_route_cost = cost;
+      p->split_contexts.push_back(std::move(ctx));
+    }
+    p->entries.push_back(std::move(entry));
+  }
+  // One split route of positive weight forwards in its pooled form (its plan's kernels). The
+  // roster: the heads with a route.
+  p->pools_source_inflows = p->entries.size() == 1 && p->tunnels.empty() && p->entries.front().weight > 0;
+  return data;
+}
+
+std::shared_ptr<const ForwardingProgram> ForwardingProgram::from_routes(const Graph& graph, std::span<const NodeId> sources,
+                                                                        std::span<const NodeId> destinations,
+                                                                        std::span<const RouteDefinition> routes,
+                                                                        const RouteOptions& options) {
+  using detail::invalid;
+  using detail::route_at;
+  // 1. The endpoint sets.
+  auto src = detail::node_set(sources, graph.num_nodes(), "sources");
+  auto dst = detail::node_set(destinations, graph.num_nodes(), "destinations");
+  detail::check_disjoint(src, dst, "sources", "destinations");
+  // 2. The list.
+  if (routes.empty()) invalid("routes must not be empty");
+  // 3 to 5. The options.
+  bool any_dag = false;
+  for (const auto& r : routes) any_dag = any_dag || std::holds_alternative<std::shared_ptr<const PredecessorDAG>>(r.route);
+  detail::check_route_options("from_routes", any_dag, options.allocation, options.weight_basis,
+                              options.edge_weights.has_value(), options.residual.has_value());
+  // 6. The vectors' lengths and entries.
+  check_route_vectors(graph, options);
+  auto checked = detail::check_route_definitions(graph, src, dst, routes, options);
+  return detail::ProgramAccess::from_checked_routes(src, dst, routes, std::move(checked));
+}
+
+std::shared_ptr<const ForwardingProgram> detail::ProgramAccess::from_checked_routes(
+    std::span<const NodeId> src, std::span<const NodeId> dst,
+    std::span<const RouteDefinition> routes, ProgramData&& data) {
+  // Path checks are complete; copy their hops in the construction phase. A
+  // DAG-only call already owns every plan and needs no second route dispatch.
+  if (!data.tunnels.empty()) {
+    std::size_t tunnel = 0;
+    for (const auto& r : routes) {
+      if (const auto* path = std::get_if<std::shared_ptr<const Path>>(&r.route)) {
+        const auto& hops = (*path)->hops();
+        auto& edges = data.tunnels[tunnel++].edges.emplace();
+        edges.reserve(hops.size());
+        for (const auto& hop : hops) edges.push_back(hop.front());
+      }
+    }
+  }
+  data.initialize_storage(src, dst, std::nullopt);
+  return detail::ProgramAccess::make(std::move(data));
+}
+
+std::shared_ptr<const ForwardingProgram> ForwardingProgram::from_dag(const Graph& graph, std::span<const NodeId> sources,
+                                                                     std::span<const NodeId> destinations,
+                                                                     const std::shared_ptr<const PredecessorDAG>& dag,
+                                                                     const RouteOptions& options) {
+  auto src = detail::node_set(sources, graph.num_nodes(), "sources");
+  auto dst = detail::node_set(destinations, graph.num_nodes(), "destinations");
+  detail::check_disjoint(src, dst, "sources", "destinations");
+  if (!dag || dag->graph_uid() != graph.uid()) detail::invalid("dag belongs to another graph");
+  detail::check_route_options("from_dag", true, options.allocation, options.weight_basis, options.edge_weights.has_value(),
+                              options.residual.has_value());
+  check_route_vectors(graph, options);
+  // The roster: the sources with a walk to a destination in the DAG (trimmed at the first
+  // destinations), each with its own walks as its record route and replay basis.
+  std::vector<NodeId> roster;
+  std::vector<detail::ProgramEntry> entries;
+  std::vector<EdgeId> all;
+  for (NodeId s : src) {
+    auto part = detail::prune(graph, *dag, s, dst, nullptr);
+    if (part.empty()) continue;
+    roster.push_back(s);
+    detail::ProgramEntry entry;
+    entry.route = std::make_shared<const PredecessorDAG>(detail::PredecessorDAGBuilder::of_edges(graph, part));
+    entry.min_route_cost = detail::min_route_cost(graph, *entry.route, s, dst);
+    entries.push_back(std::move(entry));
+    all.insert(all.end(), part.begin(), part.end());
+  }
+  if (roster.empty()) return detail::empty_program(graph.uid(), src, dst, false);
+  std::sort(all.begin(), all.end());
+  all.erase(std::unique(all.begin(), all.end()), all.end());
+  const auto supplied = detail::PredecessorDAGBuilder::ascending(*dag);
+  const auto pooled = std::equal(all.begin(), all.end(), supplied.begin(), supplied.end())
+                          ? dag
+                          : std::make_shared<const PredecessorDAG>(detail::PredecessorDAGBuilder::of_edges(graph, all));
+  // Weighted's weights: Explicit edge-aligned; the snapshot aligned with the pooled DAG's edges.
+  const RouteAllocation allocation = options.allocation.value_or(RouteAllocation::Equal);
+  detail::WeightSource weights {options.weight_basis.value_or(WeightBasis::Capacity), {}};
+  std::vector<Amount> snapshot;
+  if (allocation == RouteAllocation::Weighted && weights.basis == WeightBasis::Explicit) weights.values = *options.edge_weights;
+  if (allocation == RouteAllocation::Weighted && weights.basis == WeightBasis::ResidualSnapshot) {
+    snapshot.reserve(all.size());
+    for (EdgeId e : all) snapshot.push_back((*options.residual)[static_cast<std::size_t>(e)]);
+    weights.values = snapshot;
+  }
+  return detail::pooled_dag_program(graph, src, dst, roster, *pooled, allocation, weights, std::move(entries));
+}
+
+} // namespace netgraph::core
diff --git a/src/graph.cpp b/src/graph.cpp
new file mode 100644
index 0000000..b13bb61
--- /dev/null
+++ b/src/graph.cpp
@@ -0,0 +1,601 @@
+/*
+  Graph: the one graph type on integer units.
+
+  Validate inputs in the documented order, then build edge ids and CSR arrays. N is the node
+  count, E the edge count, and K the number of distinct costs. Stable counting passes group by
+  a small integer key while preserving order within each group. A cost's rank is its position
+  among sorted distinct costs. EdgeIds sort by (source, cost, destination, input); u's out-edges occupy
+  [outgoing_offsets[u], outgoing_offsets[u + 1]); v's in-edges sort by (cost, source, input).
+  An edgeless graph is its validation and two zero-filled offset arrays.
+  * N K >= E: three passes (destination, cost rank, source; least significant first) give the id order, and
+    two over the ids (cost rank, then destination) the reverse lists: within one (destination, cost) group the
+    id order is (source, input).
+  * N K < E (combined keys): a pass by destination, then one by (source, rank), give the id order, and one
+    pass over the ids by (destination, rank) the reverse lists; the two (N K + 1)-entry histograms live
+    in the not-yet-filled capacity and cost arrays.
+  The offset arrays serve as their own cursors; a pass that advances them is followed by one
+  that walks back, so no pass over the nodes restores them.
+
+  Assign each cost its first-appearance index (ordinal) with a hash table. Resolve collisions
+  by trying successive slots (linear probing). Use fixed mixing, at most 1/4 occupancy, and
+  double from 64 to 2^18 slots, rebuilding in distinct-cost order. Consecutive equal costs reuse
+  the previous ordinal without lookup. Radix-sort the K distinct costs, processing digits from
+  least to most significant. Stop hashing at the 65,537th distinct cost, or before examining
+  more than 8E + 8 x 65,536 slots. Count every examined slot, including the final slot, across
+  lookups and growths. On either limit, radix-sort all costs in 16-bit digits.
+  Both methods produce identical ranks.
+
+  Allocate all retained arrays at final size, then use them as scratch before filling them. Store ranks in
+  incoming_edge_sources_. While the hash table has <= E slots, edge_capacity_units_ holds its keys and
+  edge_sources_ its ordinals. edge_costs_ holds distinct costs; edge_destinations_, input_positions_ and
+  incoming_edges_ serve their sort. Counting passes use incoming_edges_ for the middle forward pass, and
+  edge_capacity_units_/edge_costs_ for K rank cursors or combined histograms. The fallback uses
+  input_positions_ and incoming_edges_. Extra buffers are limited to tables > E slots (old and new coexist
+  during growth) and the fallback's 2^16 digit counts. Smaller tables free no separate buffer that the
+  allocator could retain.
+*/
+#include "netgraph/core/graph.hpp"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cmath>
+#include <limits>
+#include <numeric>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+#include "netgraph/core/detail/graph_access.hpp"
+#include "netgraph/core/detail/hooks_flag.hpp"
+#include "netgraph/core/detail/uid.hpp"
+#include "netgraph/core/detail/unit_conversion.hpp"
+
+namespace netgraph::core {
+
+namespace detail {
+
+std::uint64_t take_uid(std::atomic<std::uint64_t>& counter) {
+  std::uint64_t last = counter.load(std::memory_order_relaxed);
+  do {
+    if (last >= static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max())) {
+      throw std::runtime_error("object identity limit exceeded");
+    }
+  } while (!counter.compare_exchange_weak(last, last + 1, std::memory_order_relaxed));
+  return last + 1;
+}
+
+std::uint64_t next_uid() {
+  static std::atomic<std::uint64_t> counter {0};
+  return take_uid(counter);
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+ConstructionCounts& thread_construction_counts() noexcept {
+  thread_local ConstructionCounts counts;
+  return counts;
+}
+#endif
+
+} // namespace detail
+
+namespace {
+
+using detail::next_uid;
+
+// The exponent k of a resolution q = 2^k with k in [-32, 32].
+int resolution_exponent(double q) {
+  if (!std::isfinite(q) || q <= 0.0) {
+    throw std::invalid_argument("resolution must be a power of two in [2^-32, 2^32]");
+  }
+  int exp = 0;
+  const double mantissa = std::frexp(q, &exp);  // q = mantissa * 2^exp, mantissa in [0.5, 1)
+  const int k = exp - 1;
+  if (mantissa != 0.5 || k < -32 || k > 32) {
+    throw std::invalid_argument("resolution must be a power of two in [2^-32, 2^32]");
+  }
+  return k;
+}
+
+// The cost ranks ---------------------------------------------------------------------------
+
+
+constexpr std::int64_t kMaxHashedCosts = 65536;  // L
+
+// The cumulative probe budget: take() runs before every table slot is examined and refuses the
+// probe that would exceed the limit.
+struct ProbeBudget {
+  std::int64_t used {0};
+  std::int64_t limit {0};
+  bool take() noexcept {
+    if (used == limit) return false;
+    ++used;
+    return true;
+  }
+};
+
+constexpr std::size_t kNoSlot = ~std::size_t {0};
+
+// The distinct-cost table: key 0 marks an empty slot (costs are >= 1 after validation).
+struct CostTable {
+  std::span<Cost> key;
+  std::span<std::int32_t> ordinals;  // the key's first-appearance ordinal
+  std::size_t mask {0};
+
+  // The slot holding c, or the empty slot where c belongs; kNoSlot when the budget refuses a
+  // probe. Every slot examined is one probe, the terminating one included.
+  std::size_t find(Cost c, ProbeBudget& b) const noexcept {
+    std::size_t s = static_cast<std::size_t>(detail::cost_hash(c)) & mask;
+    for (;;) {
+      if (!b.take()) return kNoSlot;
+      if (key[s] == 0 || key[s] == c) return s;
+      s = (s + 1) & mask;
+    }
+  }
+};
+
+// Where the table lives: the first `slots` entries of two retained arrays not yet filled (E slots
+// each), so the table allocates nothing and leaves no freed block behind (a freed block the
+// allocator keeps cached would count in the process's resident peak); only a table larger than E
+// slots gets vectors of its own. A new table is empty: growth rebuilds it from the distinct costs.
+struct CostTableStorage {
+  std::span<Cost> borrowed_keys;
+  std::span<std::int32_t> borrowed_ordinals;
+  std::vector<Cost> owned_keys {};
+  std::vector<std::int32_t> owned_ordinals {};
+
+  CostTable make(std::size_t slots) {
+    if (slots <= borrowed_keys.size()) {
+      const std::span<Cost> key = borrowed_keys.first(slots);
+      std::fill(key.begin(), key.end(), Cost {0});
+      return {key, borrowed_ordinals.first(slots), slots - 1};
+    }
+    owned_keys.assign(slots, 0);
+    owned_ordinals.resize(slots);
+    return {owned_keys, owned_ordinals, slots - 1};
+  }
+};
+
+// The retained arrays the hash path borrows before they are filled (each E entries, K <= E).
+struct CostRankBuffers {
+  std::span<Cost> keys;             // the table's keys while it has at most E slots
+  std::span<std::int32_t> ordinals;     // the table's ordinals, the same
+  std::span<Cost> distinct;         // the distinct costs in first-appearance order
+  std::span<std::int32_t> ordinal_to_rank, sort_positions, sort_scratch;  // the rank step: ordinal -> rank, and its two position arrays
+};
+
+enum class RankPath { Hashed, DistinctLimit, ExhaustedCollection, ExhaustedGrowth };
+
+struct RankOutcome {
+  RankPath path {RankPath::Hashed};
+  std::int64_t distinct {0};
+  std::int64_t table_slots {0};
+  std::int64_t probes {0};
+  std::int64_t budget {0};
+};
+
+// Ranks from a stable LSD radix sort of the positions of `cost` by cost, kBits bits per pass (all
+// E costs and 16 bits on the fallback path, the K distinct costs and 8 bits on the hashed path),
+// then one scan of the sorted positions. Digits above the largest cost's bit length are not
+// visited, and a pass whose digit is the same for every cost is skipped. `a` and `b`
+// (cost.size() slots each) hold the positions; `count` has 2^kBits entries. `cost` is never
+// empty: ranks_by_hash returns Hashed for an edgeless graph before calling this, a successful
+// collection of positive costs keeps at least one, and the fallback sort of all costs runs only
+// after hashing failed, which needs an edge.
+template <int kBits>
+std::int64_t ranks_by_sort(std::span<const Cost> cost, Cost max_edge_cost, std::span<std::int32_t> rank,
+                           std::span<std::int32_t> a, std::span<std::int32_t> b,
+                           std::span<std::int32_t> count) {
+  const std::size_t m = cost.size();
+  constexpr std::uint64_t kMask = (std::uint64_t {1} << kBits) - 1;
+  std::iota(a.begin(), a.end(), 0);
+  const auto top = static_cast<std::uint64_t>(max_edge_cost);
+  for (int shift = 0; shift < 64 && (top >> shift) != 0; shift += kBits) {
+    auto digit = [&](std::int32_t i) {
+      const auto c = static_cast<std::uint64_t>(cost[static_cast<std::size_t>(i)]);
+      return static_cast<std::size_t>((c >> shift) & kMask);
+    };
+    std::fill(count.begin(), count.end(), 0);
+    for (std::size_t j = 0; j < m; ++j) ++count[digit(static_cast<std::int32_t>(j))];
+    if (count[digit(0)] == static_cast<std::int32_t>(m)) continue;  // one digit value
+    for (std::size_t d = 0, sum = 0; d < count.size(); ++d) {
+      const auto c = static_cast<std::size_t>(count[d]);
+      count[d] = static_cast<std::int32_t>(sum);
+      sum += c;
+    }
+    for (std::size_t j = 0; j < m; ++j) b[static_cast<std::size_t>(count[digit(a[j])]++)] = a[j];
+    std::swap(a, b);
+  }
+  std::int32_t r = 0;
+  rank[static_cast<std::size_t>(a[0])] = 0;
+  for (std::size_t j = 1; j < m; ++j) {
+    const auto p = static_cast<std::size_t>(a[j]);
+    if (cost[p] != cost[static_cast<std::size_t>(a[j - 1])]) ++r;
+    rank[p] = r;
+  }
+  return std::int64_t {r} + 1;
+}
+
+// Ordinals into `rank` (input coordinates), then ranks. The table, the distinct costs and the rank
+// step live in `room` (retained arrays not yet filled); a table larger than E slots gets vectors of
+// its own, freed on return. Growth rebuilds the bigger table from the distinct costs in their
+// order, counting every probe. Any path other than Hashed leaves `rank` partly written for the
+// caller to overwrite.
+RankOutcome ranks_by_hash(std::span<const Cost> cost, std::span<std::int32_t> rank, const CostRankBuffers& room) {
+  const std::size_t m = cost.size();
+  RankOutcome out;
+  ProbeBudget b {0, 8 * static_cast<std::int64_t>(m) + 8 * kMaxHashedCosts};
+  out.budget = b.limit;
+  if (m == 0) return out;  // no cost, no table
+  std::size_t k = 0;       // the distinct costs so far: room.distinct[0, k)
+  {
+    CostTableStorage store {room.keys, room.ordinals};
+    CostTable t = store.make(64);
+    auto stop = [&](RankPath path) {
+      out.path = path;
+      out.probes = b.used;
+      out.table_slots = static_cast<std::int64_t>(t.key.size());
+      return out;
+    };
+    Cost prev = 0;  // a run of equal costs reuses the previous ordinal without a lookup
+    std::int32_t prev_ord = 0;
+    for (std::size_t i = 0; i < m; ++i) {
+      const Cost c = cost[i];
+      if (c == prev) {
+        rank[i] = prev_ord;
+        continue;
+      }
+      std::size_t s = t.find(c, b);
+      if (s == kNoSlot) return stop(RankPath::ExhaustedCollection);
+      if (t.key[s] == 0) {
+        if (static_cast<std::int64_t>(k) == kMaxHashedCosts) return stop(RankPath::DistinctLimit);
+        if (4 * (k + 1) > t.key.size()) {  // keep the load <= 1/4: grow first
+          t = store.make(t.key.size() * 2);
+          for (std::size_t j = 0; j < k; ++j) {
+            const std::size_t d = t.find(room.distinct[j], b);
+            if (d == kNoSlot) return stop(RankPath::ExhaustedGrowth);
+            t.key[d] = room.distinct[j];
+            t.ordinals[d] = static_cast<std::int32_t>(j);
+          }
+          s = t.find(c, b);
+          if (s == kNoSlot) return stop(RankPath::ExhaustedGrowth);
+        }
+        t.key[s] = c;
+        t.ordinals[s] = static_cast<std::int32_t>(k);
+        room.distinct[k++] = c;
+      }
+      rank[i] = t.ordinals[s];
+      prev = c;
+      prev_ord = t.ordinals[s];
+    }
+    out.table_slots = static_cast<std::int64_t>(t.key.size());
+  }
+  out.probes = b.used;
+  // Ordinal -> rank without the table: a radix sort of the K distinct costs.
+  const std::span<const Cost> by_ord = room.distinct.first(k);
+  const std::span<std::int32_t> rank_of_ord = room.ordinal_to_rank.first(k);
+  std::array<std::int32_t, std::size_t {1} << 8> count {};
+  ranks_by_sort<8>(by_ord, *std::max_element(by_ord.begin(), by_ord.end()), rank_of_ord, room.sort_positions.first(k),
+                   room.sort_scratch.first(k), count);
+  for (std::size_t i = 0; i < m; ++i) rank[i] = rank_of_ord[static_cast<std::size_t>(rank[i])];
+  out.distinct = static_cast<std::int64_t>(k);
+  return out;
+}
+
+// Convert counts in off[0, n) to cumulative ends; off[n] becomes the total. Scattering input
+// backwards while decrementing these cursors leaves group starts and preserves order within
+// each group. Forward scattering leaves ends; ends_to_starts below shifts those back to starts
+// (off[k] = off[k - 1] for every k >= 1, then off[0] = 0). Keep the running sum in a register so
+// each iteration does not wait for the previous store.
+void counts_to_ends(std::span<std::int32_t> off) noexcept {
+  std::int32_t sum = 0;
+  for (std::size_t k = 0; k + 1 < off.size(); ++k) {
+    sum += off[k];
+    off[k] = sum;
+  }
+  off.back() = sum;
+}
+
+// Counts in off[1, n] (node v's at v + 1) become the starts, off[0] = 0 (a running sum as above).
+void counts_to_starts(std::span<std::int32_t> off) noexcept {
+  std::int32_t sum = 0;
+  for (std::size_t k = 1; k < off.size(); ++k) {
+    sum += off[k];
+    off[k] = sum;
+  }
+}
+
+template <typename T>
+void ends_to_starts(std::span<T> off) noexcept {
+  for (std::size_t k = off.size(); k-- > 1;) off[k] = off[k - 1];
+  if (!off.empty()) off[0] = 0;
+}
+
+} // namespace
+
+Amount to_units(double x, double resolution) {
+  const int k = resolution_exponent(resolution);
+  if (std::isnan(x)) {
+    throw std::invalid_argument("to_units: NaN has no unit value");
+  }
+  if (std::isinf(x)) {
+    throw std::invalid_argument("to_units: an infinite amount is not finite and has no unit value");
+  }
+  if (x < 0.0) {
+    throw std::invalid_argument("to_units: a negative amount has no unit value");
+  }
+  constexpr double kLimit = 4611686018427387904.0;  // 2^62
+  const double r = detail::rounded_units(x, k);
+  if (!(r < kLimit)) {
+    throw std::invalid_argument(
+        "to_units: the amount is at or above the bound of the units domain (2^62 units)");
+  }
+  return static_cast<Amount>(r);
+}
+
+double as_float(Amount x, double resolution) {
+  const int k = resolution_exponent(resolution);
+  return detail::scaled_units(x, k);
+}
+
+Graph::Graph(std::int32_t num_nodes,
+             std::span<const NodeId> edge_sources,
+             std::span<const NodeId> edge_destinations,
+             std::span<const Amount> edge_capacity_units,
+             std::span<const Cost> edge_costs,
+             double resolution) {
+  (void)resolution_exponent(resolution);
+  // The unit values.
+  for (std::size_t i = 0; i < edge_capacity_units.size(); ++i) {
+    const Amount c = edge_capacity_units[i];
+    if (c < 0 || c >= kDomainLimit) {
+      throw std::invalid_argument("edge_capacity_units[" + std::to_string(i) + "] = " + std::to_string(c) +
+                                  " is outside the units domain [0, 2^62)");
+    }
+  }
+  // The array shapes.
+  if (num_nodes < 0) {
+    throw std::invalid_argument("num_nodes must be >= 0 (got " + std::to_string(num_nodes) + ")");
+  }
+  const std::size_t m = edge_sources.size();
+  if (edge_destinations.size() != m || edge_capacity_units.size() != m || edge_costs.size() != m) {
+    throw std::invalid_argument("edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got " +
+                                std::to_string(edge_sources.size()) + ", " + std::to_string(edge_destinations.size()) + ", " +
+                                std::to_string(edge_capacity_units.size()) + ", " +
+                                std::to_string(edge_costs.size()) + ")");
+  }
+  if (m > static_cast<std::size_t>(std::numeric_limits<std::int32_t>::max())) {
+    throw std::invalid_argument("the number of edges exceeds INT32_MAX (array length)");
+  }
+  // Zero or negative costs (costs are positive).
+  Cost max_edge_cost = 0;
+  Cost edge_cost_gcd = 0;
+  for (std::size_t i = 0; i < m; ++i) {
+    if (edge_costs[i] < 1) {
+      throw std::invalid_argument("edge_costs[" + std::to_string(i) + "] = " + std::to_string(edge_costs[i]) +
+                                  ": costs must be positive (edge_costs >= 1)");
+    }
+    max_edge_cost = std::max(max_edge_cost, edge_costs[i]);
+    // A running GCD of 1 stays 1 (gcd(1, c) = 1): the remaining edges are only checked.
+    if (edge_cost_gcd != 1) edge_cost_gcd = std::gcd(edge_cost_gcd, edge_costs[i]);
+  }
+  // The remaining bounds.
+  for (std::size_t i = 0; i < m; ++i) {
+    if (edge_sources[i] < 0 || edge_sources[i] >= num_nodes || edge_destinations[i] < 0 || edge_destinations[i] >= num_nodes) {
+      throw std::invalid_argument("edge " + std::to_string(i) + ": endpoint (" + std::to_string(edge_sources[i]) +
+                                  ", " + std::to_string(edge_destinations[i]) + ") out of node range [0, " +
+                                  std::to_string(num_nodes) + ")");
+    }
+  }
+  constexpr auto kLimit = static_cast<std::uint64_t>(kDomainLimit);
+  std::uint64_t cap_sum = 0;
+  std::uint64_t cost_sum = 0;
+  for (std::size_t i = 0; i < m; ++i) {
+    cap_sum += static_cast<std::uint64_t>(edge_capacity_units[i]);  // each < 2^62: no wrap before the check
+    if (cap_sum >= kLimit) {
+      throw std::invalid_argument("the sum of all capacities reaches the bound of the units domain (2^62 units)");
+    }
+    cost_sum += static_cast<std::uint64_t>(edge_costs[i]);
+    if (cost_sum >= kLimit) {
+      throw std::invalid_argument(
+          "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64");
+    }
+  }
+
+  uid_ = next_uid();
+  resolution_ = resolution;
+  num_nodes_ = num_nodes;
+  max_edge_cost_ = max_edge_cost;
+  edge_cost_gcd_ = edge_cost_gcd;
+  const auto n = static_cast<std::size_t>(num_nodes);
+
+  // Every retained array first (36 E + 8 (N + 1) bytes); until it is filled, each serves as
+  // scratch. The cost ranks go into the copy's array (by input position); the hash table, the
+  // distinct costs and the rank step borrow the others, so the hash path allocates nothing of its
+  // own while the table has at most E slots (no freed block stays behind in the allocator's cache).
+  edge_capacity_units_.resize(m);
+  edge_costs_.resize(m);
+  edge_sources_.resize(m);
+  edge_destinations_.resize(m);
+  input_positions_.resize(m);
+  incoming_edges_.resize(m);
+  incoming_edge_sources_.resize(m);
+  outgoing_offsets_.assign(n + 1, 0);
+  incoming_offsets_.assign(n + 1, 0);
+  const std::span<std::int32_t> rank(incoming_edge_sources_);
+  const RankOutcome ro =
+      ranks_by_hash(edge_costs, rank, CostRankBuffers {edge_capacity_units_, edge_sources_, edge_costs_, edge_destinations_, input_positions_, incoming_edges_});
+  const std::span<std::int32_t> order(input_positions_);      // forward passes 1 and 3 (final)
+  const std::span<std::int32_t> mid(incoming_edges_);  // forward pass 2
+  const std::span<Amount> bucket(edge_capacity_units_);              // the K rank cursors (K <= E)
+
+  // Any other path: the ranks from a sort of all costs (the same ranks).
+  std::int64_t k = ro.distinct;
+  if (ro.path != RankPath::Hashed) {
+    std::vector<std::int32_t> count(std::size_t {1} << 16);
+    k = ranks_by_sort<16>(edge_costs, max_edge_cost, rank, input_positions_, incoming_edges_, count);
+  }
+  const auto kk = static_cast<std::size_t>(k);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  {
+    auto& c = detail::thread_construction_counts();
+    ++(ro.path == RankPath::Hashed ? c.hashed : c.fallback);
+    if (ro.path == RankPath::DistinctLimit) ++c.distinct_limit;
+    if (ro.path == RankPath::ExhaustedCollection) ++c.exhausted_collection;
+    if (ro.path == RankPath::ExhaustedGrowth) ++c.exhausted_growth;
+    c.last_distinct = k;
+    c.last_table_slots = ro.table_slots;
+    c.last_probes = ro.probes;
+    c.last_budget = ro.budget;
+  }
+#endif
+  // An edgeless graph is its validation and its two zero-filled offset arrays.
+  if (m == 0) return;
+
+  // The passes. With few nodes times few costs (N K < E), the cost rank rides with an endpoint as
+  // one key: forward by destination, then by (source, rank); reverse by (destination, rank) over the ids.
+  // Otherwise the five single-key passes: forward by destination, rank, source; reverse by rank, then destination.
+  // Both give the same orders. The combined-key passes keep their two (N K + 1)-entry histograms
+  // in the not-yet-filled capacity and cost arrays (N K + 1 <= E), so their work is O(E).
+  const bool fused = n * kk < m;
+  const std::span<Amount> by_dst_rank(edge_capacity_units_);  // fused: (destination, rank) histogram, then cursors
+  const std::span<Cost> by_src_rank(edge_costs_);        // fused: (source, rank) histogram, then cursors
+  if (fused) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    ++detail::thread_construction_counts().fused;
+#endif
+    const std::size_t nk = n * kk;
+    std::fill(by_dst_rank.begin(), by_dst_rank.begin() + static_cast<std::ptrdiff_t>(nk + 1), 0);
+    std::fill(by_src_rank.begin(), by_src_rank.begin() + static_cast<std::ptrdiff_t>(nk + 1), 0);
+    // Keep the counter updates in separate loops for speed.
+    for (std::size_t i = 0; i < m; ++i) ++by_dst_rank[static_cast<std::size_t>(edge_destinations[i]) * kk + static_cast<std::size_t>(rank[i]) + 1];
+    for (std::size_t i = 0; i < m; ++i) ++by_src_rank[static_cast<std::size_t>(edge_sources[i]) * kk + static_cast<std::size_t>(rank[i]) + 1];
+    for (std::size_t x = 0, sum = 0; x <= nk; ++x) sum = static_cast<std::size_t>(by_dst_rank[x] += static_cast<Amount>(sum));
+    for (std::size_t x = 0, sum = 0; x <= nk; ++x) sum = static_cast<std::size_t>(by_src_rank[x] += static_cast<Cost>(sum));
+    for (std::size_t v = 0; v < n; ++v) {
+      incoming_offsets_[v] = static_cast<std::int32_t>(by_dst_rank[(v + 1) * kk]);  // ends: pass 1's cursors
+      outgoing_offsets_[v] = static_cast<std::int32_t>(by_src_rank[v * kk]);
+    }
+    incoming_offsets_[n] = outgoing_offsets_[n] = static_cast<std::int32_t>(m);
+  } else {
+    for (std::size_t i = 0; i < m; ++i) ++incoming_offsets_[static_cast<std::size_t>(edge_destinations[i]) + 1];
+    counts_to_starts(std::span<std::int32_t>(incoming_offsets_));
+  }
+
+  // Forward pass 1, by destination, from input order. The reverse offsets serve as cursors, so no pass
+  // over the nodes restores them: the combined-key passes walk the input backwards from the ends
+  // to the starts; the single-key passes walk it forwards from the starts to the ends, and
+  // reverse pass 2 walks back.
+  if (fused) {
+    for (std::size_t i = m; i-- > 0;) {
+      order[static_cast<std::size_t>(--incoming_offsets_[static_cast<std::size_t>(edge_destinations[i])])] = static_cast<std::int32_t>(i);
+    }
+  } else {
+    for (std::size_t i = 0; i < m; ++i) {
+      order[static_cast<std::size_t>(incoming_offsets_[static_cast<std::size_t>(edge_destinations[i])]++)] = static_cast<std::int32_t>(i);
+    }
+  }
+
+  if (fused) {
+    // Forward pass 2, by (source, rank), into `mid`: the final id order; the two arrays trade places.
+    for (std::size_t j = 0; j < m; ++j) {
+      const auto i = static_cast<std::size_t>(order[j]);
+      const std::size_t key = static_cast<std::size_t>(edge_sources[i]) * kk + static_cast<std::size_t>(rank[i]);
+      mid[static_cast<std::size_t>(by_src_rank[key]++)] = static_cast<std::int32_t>(i);
+    }
+    input_positions_.swap(incoming_edges_);
+    // Reverse, the ids by (destination, rank): within a key the id order gives (source, input).
+    for (std::size_t e = 0; e < m; ++e) {
+      const auto i = static_cast<std::size_t>(input_positions_[e]);
+      const std::size_t key = static_cast<std::size_t>(edge_destinations[i]) * kk + static_cast<std::size_t>(rank[i]);
+      incoming_edges_[static_cast<std::size_t>(by_dst_rank[key]++)] = static_cast<std::int32_t>(e);
+    }
+  } else {
+    // Forward pass 2, by cost rank; the cursors stay for reverse pass 1.
+    std::fill(bucket.begin(), bucket.begin() + static_cast<std::ptrdiff_t>(kk), 0);
+    for (std::size_t i = 0; i < m; ++i) ++bucket[static_cast<std::size_t>(rank[i])];
+    for (std::size_t r = 0, sum = 0; r < kk; ++r) {
+      const auto c = static_cast<std::size_t>(bucket[r]);
+      bucket[r] = static_cast<Amount>(sum);
+      sum += c;
+    }
+    for (std::size_t j = 0; j < m; ++j) {
+      const auto i = static_cast<std::size_t>(order[j]);
+      mid[static_cast<std::size_t>(bucket[static_cast<std::size_t>(rank[i])]++)] = static_cast<std::int32_t>(i);
+    }
+    ends_to_starts(bucket.first(kk));
+
+    // Forward pass 3, by source; the source histogram is the forward offsets.
+    for (std::size_t i = 0; i < m; ++i) ++outgoing_offsets_[static_cast<std::size_t>(edge_sources[i])];
+    counts_to_ends(std::span<std::int32_t>(outgoing_offsets_));
+    for (std::size_t j = m; j-- > 0;) {
+      const auto i = static_cast<std::size_t>(mid[j]);
+      order[static_cast<std::size_t>(--outgoing_offsets_[static_cast<std::size_t>(edge_sources[i])])] = static_cast<std::int32_t>(i);
+    }
+
+    // Reverse pass 1, by cost rank over the ids (the id order is (source, cost, destination, input)).
+    const std::span<std::int32_t> by_cost(incoming_edges_);  // free again after pass 3
+    for (std::size_t e = 0; e < m; ++e) {
+      const auto r = static_cast<std::size_t>(rank[static_cast<std::size_t>(order[e])]);
+      by_cost[static_cast<std::size_t>(bucket[r]++)] = static_cast<std::int32_t>(e);
+    }
+  }
+
+  // The per-edge values, permuted once (the cursors and the ranks are no longer read).
+  for (std::size_t e = 0; e < m; ++e) {
+    const auto i = static_cast<std::size_t>(input_positions_[e]);
+    edge_capacity_units_[e] = edge_capacity_units[i];
+    edge_costs_[e] = edge_costs[i];
+    edge_sources_[e] = edge_sources[i];
+    edge_destinations_[e] = edge_destinations[i];
+  }
+
+  if (!fused) {
+    // Reverse pass 2, by destination, into the ranks' array, walked backwards: the reverse offsets hold
+    // the ends after pass 1 and return to the starts. Then the two slot arrays trade places.
+    const std::span<std::int32_t> slots(incoming_edge_sources_);
+    const std::span<std::int32_t> by_cost(incoming_edges_);
+    for (std::size_t j = m; j-- > 0;) {
+      const auto e = static_cast<std::size_t>(by_cost[j]);
+      slots[static_cast<std::size_t>(--incoming_offsets_[static_cast<std::size_t>(edge_destinations_[e])])] = static_cast<std::int32_t>(e);
+    }
+    incoming_edges_.swap(incoming_edge_sources_);
+  }
+  // The source copy, over the ranks' (or the free) array.
+  for (std::size_t s = 0; s < m; ++s) incoming_edge_sources_[s] = edge_sources_[static_cast<std::size_t>(incoming_edges_[s])];
+}
+
+Graph::Graph(const Graph& other)
+    : uid_(next_uid()),
+      resolution_(other.resolution_),
+      num_nodes_(other.num_nodes_),
+      max_edge_cost_(other.max_edge_cost_),
+      edge_cost_gcd_(other.edge_cost_gcd_),
+      edge_capacity_units_(other.edge_capacity_units_),
+      edge_costs_(other.edge_costs_),
+      edge_sources_(other.edge_sources_),
+      edge_destinations_(other.edge_destinations_),
+      input_positions_(other.input_positions_),
+      outgoing_offsets_(other.outgoing_offsets_),
+      incoming_offsets_(other.incoming_offsets_),
+      incoming_edges_(other.incoming_edges_),
+      incoming_edge_sources_(other.incoming_edge_sources_) {}
+
+// No allocation: the source keeps empty vectors, and its offset views read the static zero.
+Graph::Graph(Graph&& other) noexcept
+    : uid_(std::exchange(other.uid_, 0)),
+      resolution_(other.resolution_),
+      num_nodes_(std::exchange(other.num_nodes_, 0)),
+      max_edge_cost_(std::exchange(other.max_edge_cost_, 0)),
+      edge_cost_gcd_(std::exchange(other.edge_cost_gcd_, 0)),
+      edge_capacity_units_(std::move(other.edge_capacity_units_)),
+      edge_costs_(std::move(other.edge_costs_)),
+      edge_sources_(std::move(other.edge_sources_)),
+      edge_destinations_(std::move(other.edge_destinations_)),
+      input_positions_(std::move(other.input_positions_)),
+      outgoing_offsets_(std::move(other.outgoing_offsets_)),
+      incoming_offsets_(std::move(other.incoming_offsets_)),
+      incoming_edges_(std::move(other.incoming_edges_)),
+      incoming_edge_sources_(std::move(other.incoming_edge_sources_)) {}
+
+} // namespace netgraph::core
diff --git a/src/k_shortest_paths.cpp b/src/k_shortest_paths.cpp
deleted file mode 100644
index ce410e6..0000000
--- a/src/k_shortest_paths.cpp
+++ /dev/null
@@ -1,349 +0,0 @@
-/*
-  k_shortest_paths — Yen-like enumeration with deterministic tie-breaking.
-
-  Returns SPF-compatible outputs for each path: full distance array and a
-  PredDAG that encodes a single concrete path as single-parent predecessors.
-*/
-#include "netgraph/core/k_shortest_paths.hpp"
-
-#include <algorithm>
-#include <cstdint>
-#include <limits>
-#include <memory>
-#include <optional>
-#include <queue>
-#include <stdexcept>
-#include <unordered_set>
-#include <utility>
-#include <vector>
-
-// Use multipath SPF DAG for spur enumeration
-#include "netgraph/core/shortest_paths.hpp"
-
-namespace netgraph::core {
-
-namespace {
-struct Path {
-  std::vector<std::int32_t> nodes;
-  std::vector<EdgeId> edges;
-  Cost cost{0};
-};
-struct Candidate {
-  Cost cost;
-  std::vector<std::int32_t> nodes;
-  std::vector<EdgeId> edges;
-  bool operator>(const Candidate& o) const { return cost > o.cost; }
-};
-
-struct VectorHash { size_t operator()(const std::vector<EdgeId>& v) const noexcept {
-  size_t h = 1469598103934665603ull;
-  for (auto x : v) { h ^= static_cast<size_t>(x + 0x9e3779b97f4a7c15ull); h *= 1099511628211ull; }
-  return h;
-}};
-using PathSet = std::unordered_set<std::vector<EdgeId>, VectorHash>;
-
-
-static std::optional<Path> dijkstra_single(const StrictMultiDiGraph& g, NodeId s, NodeId t,
-                                           const std::vector<std::uint8_t>* node_mask,
-                                           const std::vector<std::uint8_t>* edge_mask) {
-  const auto row = g.row_offsets_view();
-  const auto col = g.col_indices_view();
-  const auto aei = g.adj_edge_index_view();
-  const auto cost = g.cost_view();
-  const int N = g.num_nodes();
-  if (s < 0 || t < 0 || s >= N || t >= N) return std::nullopt;
-  auto ok_node = [&](std::int32_t v){ return (!node_mask) || (*node_mask)[static_cast<std::size_t>(v)] != 0; };
-  auto ok_edge = [&](std::size_t e){ return (!edge_mask) || (*edge_mask)[e] != 0; };
-  if (!ok_node(s) || !ok_node(t)) return std::nullopt;
-  std::vector<Cost> dist(static_cast<std::size_t>(N), std::numeric_limits<Cost>::max());
-  std::vector<std::int32_t> parent(static_cast<std::size_t>(N), -1);
-  std::vector<std::int32_t> via(static_cast<std::size_t>(N), -1);
-  using QItem = std::pair<Cost, std::int32_t>;
-  auto cmp = [](const QItem& a, const QItem& b){ return a.first > b.first; };
-  std::priority_queue<QItem, std::vector<QItem>, decltype(cmp)> pq(cmp);
-  dist[static_cast<std::size_t>(s)] = static_cast<Cost>(0);
-  pq.emplace(static_cast<Cost>(0), s);
-  while (!pq.empty()) {
-    auto [d_u, u] = pq.top(); pq.pop();
-    if (d_u > dist[static_cast<std::size_t>(u)]) continue;
-    if (u == t) break;
-    auto start = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto end   = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    std::size_t i = start;
-    while (i < end) {
-      std::int32_t v = col[i];
-      // Skip neighbor group if node masked
-      if (!ok_node(v)) { std::size_t j=i; while (j<end && col[j]==v) ++j; i=j; continue; }
-      // Find best edge u->v (min cost; tie-breaker: smallest edge id)
-      Cost min_edge_cost = std::numeric_limits<Cost>::max();
-      std::int32_t best_eid = -1;
-      std::size_t j = i;
-      for (; j < end && col[j] == v; ++j) {
-        auto eidx = static_cast<std::size_t>(aei[j]);
-        if (!ok_edge(eidx)) continue;
-        Cost ec = static_cast<Cost>(cost[eidx]);
-        if (ec < min_edge_cost || (ec == min_edge_cost && static_cast<std::int32_t>(eidx) < best_eid)) {
-          min_edge_cost = ec; best_eid = static_cast<std::int32_t>(eidx);
-        }
-      }
-      if (best_eid >= 0) {
-        Cost nd = static_cast<Cost>(d_u + min_edge_cost);
-        auto vi = static_cast<std::size_t>(v);
-        if (nd < dist[vi]) { dist[vi] = nd; parent[vi] = u; via[vi] = best_eid; pq.emplace(nd, v); }
-      }
-      i = j;
-    }
-  }
-  if (dist[static_cast<std::size_t>(t)] == std::numeric_limits<Cost>::max()) return std::nullopt;
-  // Reconstruct
-  std::vector<std::int32_t> nodes_rev;
-  std::vector<EdgeId> edges_rev;
-  for (std::int32_t v = t; v != s; v = parent[static_cast<std::size_t>(v)]) {
-    if (v < 0) return std::nullopt;
-    nodes_rev.push_back(v);
-    edges_rev.push_back(via[static_cast<std::size_t>(v)]);
-  }
-  Path p;
-  p.nodes.reserve(nodes_rev.size() + 1);
-  p.nodes.push_back(s);
-  for (auto it = nodes_rev.rbegin(); it != nodes_rev.rend(); ++it) p.nodes.push_back(*it);
-  p.edges.reserve(edges_rev.size());
-  for (auto it = edges_rev.rbegin(); it != edges_rev.rend(); ++it) p.edges.push_back(*it);
-  p.cost = dist[static_cast<std::size_t>(t)];
-  return p;
-}
-
-// Enumerate shortest spur paths from spur->t using the PredDAG produced by
-// shortest_paths(spur, ..., multipath=true), in deterministic DFS order.
-// All spur paths in the DAG share the same (shortest) cost, and at most
-// max_count candidates can ever be accepted downstream, so enumeration stops
-// after emitting max_count paths. Without the bound this walk materializes
-// every equal-cost path — exponential in ECMP fan-out (2^k paths on a k-stage
-// ladder). When dedup is supplied (unique mode), paths whose full edge
-// sequence (prefix + spur segment) was already visited are skipped without
-// consuming the bound, so the cap cannot starve fresh candidates.
-static void dfs_spur_paths(NodeId spur, NodeId v,
-                           const std::vector<std::int32_t>& off,
-                           const std::vector<std::int32_t>& parents,
-                           const std::vector<std::int32_t>& via,
-                           std::vector<std::int32_t>& nodes_rev,
-                           std::vector<EdgeId>& edges_rev,
-                           std::vector<std::vector<std::int32_t>>& out_nodes,
-                           std::vector<std::vector<EdgeId>>& out_edges,
-                           std::size_t max_count,
-                           const std::vector<EdgeId>* prefix_edges,
-                           const PathSet* dedup) {
-  if (out_nodes.size() >= max_count) return;
-  if (v == spur) {
-    // build forward
-    std::vector<std::int32_t> n; n.reserve(nodes_rev.size() + 1);
-    n.push_back(spur);
-    for (auto it = nodes_rev.rbegin(); it != nodes_rev.rend(); ++it) n.push_back(*it);
-    std::vector<EdgeId> e; e.reserve(edges_rev.size());
-    for (auto it = edges_rev.rbegin(); it != edges_rev.rend(); ++it) e.push_back(*it);
-    if (dedup != nullptr) {
-      std::vector<EdgeId> full;
-      full.reserve(prefix_edges->size() + e.size());
-      full.insert(full.end(), prefix_edges->begin(), prefix_edges->end());
-      full.insert(full.end(), e.begin(), e.end());
-      if (dedup->find(full) != dedup->end()) return;  // already visited; free the slot
-    }
-    out_nodes.push_back(std::move(n));
-    out_edges.push_back(std::move(e));
-    return;
-  }
-  auto s = off[static_cast<std::size_t>(v)];
-  auto e = off[static_cast<std::size_t>(v) + 1];
-  for (std::int32_t i = s; i < e; ++i) {
-    if (out_nodes.size() >= max_count) return;
-    auto u = parents[static_cast<std::size_t>(i)];
-    auto eid = via[static_cast<std::size_t>(i)];
-    edges_rev.push_back(static_cast<EdgeId>(eid));
-    nodes_rev.push_back(v);
-    dfs_spur_paths(spur, u, off, parents, via, nodes_rev, edges_rev, out_nodes, out_edges,
-                   max_count, prefix_edges, dedup);
-    nodes_rev.pop_back();
-    edges_rev.pop_back();
-  }
-}
-
-} // namespace
-
-std::vector<std::pair<std::vector<Cost>, PredDAG>> k_shortest_paths(
-    const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-    int k, std::optional<double> max_cost_factor,
-    bool unique,
-    std::span<const bool> node_mask,
-    std::span<const bool> edge_mask) {
-  std::vector<Path> paths;
-  if (k <= 0) return {};
-  if (src < 0 || dst < 0 || src >= g.num_nodes() || dst >= g.num_nodes()) return {};
-
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-    throw std::invalid_argument("k_shortest_paths: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("k_shortest_paths: edge_mask length mismatch");
-  }
-
-  // Base shortest path
-  std::vector<std::uint8_t> node_mask_vec;
-  std::vector<std::uint8_t> edge_mask_vec;
-  const std::vector<std::uint8_t>* nm_ptr = nullptr;
-  const std::vector<std::uint8_t>* em_ptr = nullptr;
-  if (node_mask.size() == static_cast<std::size_t>(g.num_nodes())) {
-    node_mask_vec.assign(static_cast<std::size_t>(g.num_nodes()), static_cast<std::uint8_t>(1));
-    for (std::size_t i=0;i<node_mask_vec.size();++i) node_mask_vec[i] = node_mask[i] ? 1u : 0u;
-    nm_ptr = &node_mask_vec;
-  }
-  if (edge_mask.size() == static_cast<std::size_t>(g.num_edges())) {
-    edge_mask_vec.assign(static_cast<std::size_t>(g.num_edges()), static_cast<std::uint8_t>(1));
-    for (std::size_t i=0;i<edge_mask_vec.size();++i) edge_mask_vec[i] = edge_mask[i] ? 1u : 0u;
-    em_ptr = &edge_mask_vec;
-  }
-  auto p0 = dijkstra_single(g, src, dst, nm_ptr, em_ptr);
-  if (!p0) return {};
-  double best_cost = static_cast<double>(p0->cost);
-  double max_cost = std::numeric_limits<double>::infinity();
-  if (max_cost_factor && *max_cost_factor > 0.0) {
-    max_cost = best_cost * (*max_cost_factor);
-  }
-  if (p0->cost <= max_cost) paths.push_back(*p0);
-  // A max_cost_factor below 1.0 puts the ceiling under the shortest path itself, so
-  // nothing was admitted. Return now: the k > 1 loop below opens with paths.back(),
-  // which is undefined behaviour on an empty vector. (The k == 1 branch would have
-  // masked this, so the guard must sit ahead of it.)
-  if (paths.empty()) return {};
-  if (k == 1) {
-    // Convert and return
-    std::vector<std::pair<std::vector<Cost>, PredDAG>> items;
-    items.reserve(paths.size());
-    for (auto const& P : paths) {
-      items.push_back(path_to_pred_dag(g, P.nodes, P.edges));
-    }
-    return items;
-  }
-
-  // Candidate heap across spur deviations
-  auto cost_view = g.cost_view();
-  std::priority_queue<Candidate, std::vector<Candidate>, std::greater<Candidate>> B;
-  auto path_signature = [&](const std::vector<EdgeId>& edges){ return edges; };
-  PathSet visited;
-  visited.insert(path_signature(p0->edges));
-
-  for (int i = 1; i < k; ++i) {
-    const Path& last = paths.back();
-    // Precompute prefix cumulative costs along last path to avoid re-summing
-    std::vector<Cost> prefix_cost;
-    prefix_cost.assign(last.nodes.size(), 0);
-    for (std::size_t idx = 1; idx < last.nodes.size(); ++idx) {
-      // edge at idx-1
-      auto e = last.edges[idx - 1];
-      prefix_cost[idx] = prefix_cost[idx - 1] + static_cast<Cost>(cost_view[static_cast<std::size_t>(e)]);
-    }
-    // Spur node positions 0..len-2
-    for (std::size_t j = 0; j + 1 < last.nodes.size(); ++j) {
-      std::int32_t spur_node = last.nodes[j];
-      // Build masks: exclude prefix nodes [0..j-1]
-      std::vector<std::uint8_t> node_mask_local;
-      node_mask_local.assign(static_cast<std::size_t>(g.num_nodes()), static_cast<std::uint8_t>(1));
-      for (std::size_t r = 0; r < j; ++r) node_mask_local[static_cast<std::size_t>(last.nodes[r])] = 0;
-      if (nm_ptr) {
-        for (std::size_t idx=0; idx<node_mask_local.size(); ++idx) node_mask_local[idx] = (node_mask_local[idx] && (*nm_ptr)[idx]) ? 1u : 0u;
-      }
-      // Edge mask: exclude next edges of already-accepted paths that share this prefix
-      std::vector<std::uint8_t> edge_mask_local;
-      edge_mask_local.assign(static_cast<std::size_t>(g.num_edges()), static_cast<std::uint8_t>(1));
-      for (auto const& P : paths) {
-        if (P.nodes.size() > j && std::equal(P.nodes.begin(), P.nodes.begin() + static_cast<std::ptrdiff_t>(j + 1), last.nodes.begin())) {
-          // Exclude edge at position j for this path
-          if (P.edges.size() > j) {
-            edge_mask_local[static_cast<std::size_t>(P.edges[j])] = 0;
-          }
-        }
-      }
-      if (em_ptr) {
-        for (std::size_t idx=0; idx<edge_mask_local.size(); ++idx) edge_mask_local[idx] = (edge_mask_local[idx] && (*em_ptr)[idx]) ? 1u : 0u;
-      }
-      // Multipath spur PredDAG from spur_node -> t
-      std::unique_ptr<bool[]> nm_buf2;
-      std::unique_ptr<bool[]> em_buf2;
-      std::span<const bool> nm, em;
-      if (!node_mask_local.empty()) {
-        nm_buf2 = std::unique_ptr<bool[]>(new bool[static_cast<std::size_t>(g.num_nodes())]);
-        for (std::size_t idx = 0; idx < static_cast<std::size_t>(g.num_nodes()); ++idx) nm_buf2[idx] = (node_mask_local[idx] != 0);
-        nm = std::span<const bool>(nm_buf2.get(), static_cast<std::size_t>(g.num_nodes()));
-      }
-      if (!edge_mask_local.empty()) {
-        em_buf2 = std::unique_ptr<bool[]>(new bool[static_cast<std::size_t>(g.num_edges())]);
-        for (std::size_t idx = 0; idx < static_cast<std::size_t>(g.num_edges()); ++idx) em_buf2[idx] = (edge_mask_local[idx] != 0);
-        em = std::span<const bool>(em_buf2.get(), static_cast<std::size_t>(g.num_edges()));
-      }
-      EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-      auto [dist_spur, dag_spur] = shortest_paths(g, spur_node, dst, /*multipath=*/true, sel, std::span<const Cap>(), nm, em);
-      // If no spur parents for t, skip
-      if (static_cast<std::size_t>(dst + 1) >= dag_spur.parent_offsets.size() ||
-          dag_spur.parent_offsets[static_cast<std::size_t>(dst)] == dag_spur.parent_offsets[static_cast<std::size_t>(dst + 1)]) {
-        continue;
-      }
-      // Every spur path in the DAG costs dist_spur[dst]; skip the whole family
-      // if the resulting candidates would exceed the cost ceiling.
-      if (static_cast<double>(prefix_cost[j]) + static_cast<double>(dist_spur[static_cast<std::size_t>(dst)]) > max_cost) {
-        continue;
-      }
-      // At most (k - accepted) further paths can ever be accepted, so that many
-      // fresh candidates from this spur family suffice.
-      const std::size_t want = static_cast<std::size_t>(k) - paths.size();
-      std::vector<EdgeId> prefix_edges(last.edges.begin(),
-                                       last.edges.begin() + static_cast<std::ptrdiff_t>(j));
-      std::vector<std::int32_t> nodes_rev;
-      std::vector<std::int32_t> edges_rev;
-      std::vector<std::vector<std::int32_t>> spur_nodes_list;
-      std::vector<std::vector<std::int32_t>> spur_edges_list;
-      dfs_spur_paths(spur_node, dst, dag_spur.parent_offsets, dag_spur.parents, dag_spur.via_edges,
-                     nodes_rev, edges_rev, spur_nodes_list, spur_edges_list,
-                     want, &prefix_edges, unique ? &visited : nullptr);
-      for (std::size_t si = 0; si < spur_nodes_list.size(); ++si) {
-        const auto& spur_nodes = spur_nodes_list[si];
-        const auto& spur_edges = spur_edges_list[si];
-        std::vector<std::int32_t> cand_nodes;
-        std::vector<std::int32_t> cand_edges;
-        cand_nodes.reserve(j + spur_nodes.size());
-        cand_edges.reserve(j + spur_edges.size());
-        for (std::size_t r = 0; r < j; ++r) cand_nodes.push_back(last.nodes[r]);
-        for (auto n : spur_nodes) cand_nodes.push_back(n);
-        for (std::size_t r = 0; r < j; ++r) cand_edges.push_back(last.edges[r]);
-        for (auto e : spur_edges) cand_edges.push_back(e);
-        // Compute candidate cost as prefix_cost[j] + sum(spur_edges)
-        Cost cand_cost = prefix_cost[j];
-        for (auto e : spur_edges) cand_cost += static_cast<Cost>(cost_view[static_cast<std::size_t>(e)]);
-        if (cand_cost > max_cost) continue;
-        auto sig = path_signature(cand_edges);
-        if (unique && visited.find(sig) != visited.end()) continue;
-        visited.insert(sig);
-        B.push(Candidate{cand_cost, std::move(cand_nodes), std::move(cand_edges)});
-      }
-    }
-    // Pick next best candidate not exceeding threshold
-    if (B.empty()) break;
-    bool accepted = false;
-    while (!B.empty()) {
-      auto c = B.top(); B.pop();
-      if (c.cost <= max_cost) {
-        paths.push_back(Path{std::move(c.nodes), std::move(c.edges), c.cost});
-        accepted = true;
-        break;
-      }
-    }
-    if (!accepted) break;
-  }
-  // Convert to SPF-compatible outputs
-  std::vector<std::pair<std::vector<Cost>, PredDAG>> items;
-  items.reserve(paths.size());
-  for (auto const& P : paths) {
-    items.push_back(path_to_pred_dag(g, P.nodes, P.edges));
-  }
-  return items;
-}
-
-} // namespace netgraph::core
diff --git a/src/max_flow.cpp b/src/max_flow.cpp
deleted file mode 100644
index 91ee426..0000000
--- a/src/max_flow.cpp
+++ /dev/null
@@ -1,488 +0,0 @@
-/*
-  calc_max_flow — incremental max-flow via repeated SPF tiers over residuals.
-
-  Uses FlowState to track residuals and place flow along SPF predecessor DAGs.
-  Accumulates total flow, optional per-edge flows, cost distribution, and
-  derives a min-cut from the final residual graph.
-
-  Algorithm: Iterative augmentation using Successive Shortest Path on residual graphs,
-  pushing flow across full ECMP/WCMP DAGs at each step.
-*/
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/flow_state.hpp"
-#include "netgraph/core/constants.hpp"
-
-#include <algorithm>
-#include <atomic>
-#include <cmath>
-#include <cstdint>
-#include <cstdlib>
-#include <future>
-#include <limits>
-#include <memory>
-#include <optional>
-#include <queue>
-#include <thread>
-#include <utility>
-#include <vector>
-
-namespace netgraph::core {
-
-namespace {
-
-std::size_t thread_budget_from_env(const char* env_name, std::size_t candidate_count) {
-  if (candidate_count <= 1) {
-    return 1;
-  }
-
-  const char* env = std::getenv(env_name);
-  if (env != nullptr && env[0] != '\0') {
-    char* end = nullptr;
-    unsigned long parsed = std::strtoul(env, &end, 10);
-    if (end != env) {
-      if (parsed == 0ul) {
-        return 1;
-      }
-      return std::min<std::size_t>(static_cast<std::size_t>(parsed), candidate_count);
-    }
-  }
-
-  const auto hw = std::thread::hardware_concurrency();
-  const auto budget = hw > 0 ? static_cast<std::size_t>(hw) : 1u;
-  return std::min<std::size_t>(budget, candidate_count);
-}
-
-std::optional<std::pair<EdgeId, Flow>>
-evaluate_sensitivity_candidate(const StrictMultiDiGraph& g,
-                               NodeId src,
-                               NodeId dst,
-                               FlowPlacement placement,
-                               bool shortest_path,
-                               bool require_capacity,
-                               Flow baseline_flow,
-                               std::span<const bool> node_mask,
-                               EdgeId eid,
-                               bool* local_mask,
-                               std::size_t mask_size) {
-  local_mask[static_cast<std::size_t>(eid)] = false;
-
-  auto [new_flow, _] = calc_max_flow(
-      g, src, dst, placement,
-      shortest_path,
-      require_capacity,
-      /*with_edge_flows=*/false,
-      /*with_reachable=*/false,
-      /*with_residuals=*/false,
-      node_mask, std::span<const bool>(local_mask, mask_size));
-
-  local_mask[static_cast<std::size_t>(eid)] = true;
-
-  double delta = baseline_flow - new_flow;
-  if (delta > kMinFlow) {
-    return std::pair<EdgeId, Flow>{eid, delta};
-  }
-  return std::nullopt;
-}
-
-} // namespace
-
-std::pair<Flow, FlowSummary>
-calc_max_flow(const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-              FlowPlacement placement, bool shortest_path,
-              bool require_capacity,
-              bool with_edge_flows,
-              bool with_reachable,
-              bool with_residuals,
-              std::span<const bool> node_mask, std::span<const bool> edge_mask) {
-  FlowSummary summary;
-  const auto N = g.num_nodes();
-  if (src < 0 || src >= N || dst < 0 || dst >= N || src == dst) {
-    return {0.0, std::move(summary)};
-  }
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-    throw std::invalid_argument("calc_max_flow: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("calc_max_flow: edge_mask length mismatch");
-  }
-  const bool use_node_mask = !node_mask.empty();
-  const bool use_edge_mask = !edge_mask.empty();
-  if ((use_node_mask && !node_mask[static_cast<std::size_t>(src)]) ||
-      (use_node_mask && !node_mask[static_cast<std::size_t>(dst)])) {
-    return {0.0, std::move(summary)};
-  }
-  // Use FlowState for residual tracking and per-edge placement
-  FlowState fs(g);
-  Flow total = static_cast<Flow>(0.0);
-  std::vector<std::pair<Cost,Flow>> cost_dist; // (cost, flow)
-
-  // Iterate tiers: SPF over current residual or costs only
-  // require_capacity=true: Require edges to have capacity, exclude saturated links (SDN/TE behavior)
-  // require_capacity=false: Routes based on costs only, ignore capacity (IP/IGP behavior)
-  // With require_capacity=false the search ignores residuals, so its inputs
-  // are identical on every tier: compute it once and reuse the result.
-  std::pair<std::vector<Cost>, PredDAG> path_result;
-  bool have_path_result = false;
-  while (true) {
-    EdgeSelection sel;
-    sel.multi_edge = true;
-    sel.require_capacity = require_capacity;
-    sel.tie_break = EdgeTieBreak::Deterministic;
-    if (require_capacity || !have_path_result) {
-      path_result = shortest_paths(
-          g, src, dst,
-          /*multipath=*/true,
-          sel,
-          require_capacity ? fs.residual_view() : std::span<const Cap>{},
-          use_node_mask ? node_mask : std::span<const bool>{},
-          use_edge_mask ? edge_mask : std::span<const bool>{});
-      have_path_result = true;
-    }
-    const auto& [dist, dag] = path_result;
-
-    // No path if t has no parents in DAG
-    if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size() - 1 ||
-        dag.parent_offsets[static_cast<std::size_t>(dst)] == dag.parent_offsets[static_cast<std::size_t>(dst) + 1]) {
-      break;
-    }
-
-    Cost path_cost = dist[static_cast<std::size_t>(dst)];
-    Flow placed = fs.place_on_dag(src, dst, dag, std::numeric_limits<double>::infinity(), placement);
-
-    if (placed < kMinFlow) break;
-    total += placed;
-    // Merge by exact cost (integer)
-    bool merged = false;
-    for (auto& pr : cost_dist) { if (pr.first == path_cost) { pr.second += placed; merged = true; break; } }
-    if (!merged) cost_dist.emplace_back(path_cost, placed);
-    if (shortest_path) break;
-  }
-
-  // Completion phase. The tier loop above augments only along forward SPF DAGs
-  // and can never cancel an earlier placement, so it may terminate below the
-  // true maximum (its own min-cut then contradicts total_flow). Finish with
-  // BFS augmentation on the full residual graph, where traversing an edge
-  // backwards returns previously placed flow. Only meaningful for Proportional
-  // max-flow semantics: EqualBalanced models ECMP admission and
-  // require_capacity=false models fixed-cost IP routing, both of which are
-  // placement models rather than max-flow computations.
-  if (placement == FlowPlacement::Proportional && !shortest_path && require_capacity) {
-    const auto row = g.row_offsets_view();
-    const auto col = g.col_indices_view();
-    const auto aei = g.adj_edge_index_view();
-    const auto irow = g.in_row_offsets_view();
-    const auto icol = g.in_col_indices_view();
-    const auto iaei = g.in_adj_edge_index_view();
-    const auto costv = g.cost_view();
-    const auto residual = fs.residual_view();
-    const auto eflow = fs.edge_flow_view();
-    std::vector<std::int32_t> prev_node(static_cast<std::size_t>(N));
-    std::vector<EdgeId> prev_edge(static_cast<std::size_t>(N));
-    std::vector<char> prev_fwd(static_cast<std::size_t>(N));
-    std::vector<char> seen(static_cast<std::size_t>(N));
-    std::vector<std::pair<EdgeId, Flow>> fwd_deltas, rev_deltas;
-    while (true) {
-      std::fill(seen.begin(), seen.end(), 0);
-      std::queue<std::int32_t> bfs;
-      seen[static_cast<std::size_t>(src)] = 1;
-      bfs.push(src);
-      bool found = false;
-      while (!bfs.empty() && !found) {
-        auto u = bfs.front(); bfs.pop();
-        auto us = static_cast<std::size_t>(u);
-        // Forward residual arcs u -> v.
-        for (auto j = static_cast<std::size_t>(row[us]); j < static_cast<std::size_t>(row[us + 1]); ++j) {
-          auto v = static_cast<std::size_t>(col[j]);
-          auto eid = static_cast<std::size_t>(aei[j]);
-          if (use_edge_mask && !edge_mask[eid]) continue;
-          if (use_node_mask && !node_mask[v]) continue;
-          if (seen[v] || residual[eid] <= kMinCap) continue;
-          seen[v] = 1; prev_node[v] = u; prev_edge[v] = static_cast<EdgeId>(eid); prev_fwd[v] = 1;
-          if (static_cast<NodeId>(v) == dst) { found = true; break; }
-          bfs.push(static_cast<std::int32_t>(v));
-        }
-        if (found) break;
-        // Reverse residual arcs u -> w along edges w -> u carrying flow.
-        for (auto j = static_cast<std::size_t>(irow[us]); j < static_cast<std::size_t>(irow[us + 1]); ++j) {
-          auto w = static_cast<std::size_t>(icol[j]);
-          auto eid = static_cast<std::size_t>(iaei[j]);
-          if (use_edge_mask && !edge_mask[eid]) continue;
-          if (use_node_mask && !node_mask[w]) continue;
-          if (seen[w] || eflow[eid] <= kMinFlow) continue;
-          seen[w] = 1; prev_node[w] = u; prev_edge[w] = static_cast<EdgeId>(eid); prev_fwd[w] = 0;
-          if (static_cast<NodeId>(w) == dst) { found = true; break; }
-          bfs.push(static_cast<std::int32_t>(w));
-        }
-      }
-      if (!found) break;
-      // Bottleneck and marginal path cost (forward costs minus cancelled costs).
-      double bottleneck = std::numeric_limits<double>::infinity();
-      Cost path_cost = 0;
-      for (auto v = dst; v != src; v = prev_node[static_cast<std::size_t>(v)]) {
-        auto vs = static_cast<std::size_t>(v);
-        auto eid = static_cast<std::size_t>(prev_edge[vs]);
-        if (prev_fwd[vs]) {
-          bottleneck = std::min(bottleneck, static_cast<double>(residual[eid]));
-          path_cost += costv[eid];
-        } else {
-          bottleneck = std::min(bottleneck, static_cast<double>(eflow[eid]));
-          path_cost -= costv[eid];
-        }
-      }
-      if (!(bottleneck >= kMinFlow)) break;
-      fwd_deltas.clear(); rev_deltas.clear();
-      for (auto v = dst; v != src; v = prev_node[static_cast<std::size_t>(v)]) {
-        auto vs = static_cast<std::size_t>(v);
-        if (prev_fwd[vs]) fwd_deltas.emplace_back(prev_edge[vs], static_cast<Flow>(bottleneck));
-        else rev_deltas.emplace_back(prev_edge[vs], static_cast<Flow>(bottleneck));
-      }
-      fs.apply_deltas(fwd_deltas, /*add=*/true);
-      fs.apply_deltas(rev_deltas, /*add=*/false);
-      total += static_cast<Flow>(bottleneck);
-      bool merged2 = false;
-      for (auto& pr : cost_dist) { if (pr.first == path_cost) { pr.second += bottleneck; merged2 = true; break; } }
-      if (!merged2) cost_dist.emplace_back(path_cost, static_cast<Flow>(bottleneck));
-    }
-  }
-
-  summary.total_flow = total;
-  if (with_edge_flows) {
-    auto ef = fs.edge_flow_view();
-    summary.edge_flows.assign(ef.begin(), ef.end());
-  }
-  if (with_residuals) {
-    auto res = fs.residual_view();
-    summary.residual_capacity.resize(static_cast<std::size_t>(g.num_edges()));
-    for (std::size_t i = 0; i < summary.residual_capacity.size(); ++i) {
-      summary.residual_capacity[i] = static_cast<Cap>(res[i]);
-    }
-  }
-  if (!cost_dist.empty()) {
-    std::sort(cost_dist.begin(), cost_dist.end(), [](auto const& a, auto const& b){ return a.first < b.first; });
-    summary.costs.reserve(cost_dist.size());
-    summary.flows.reserve(cost_dist.size());
-    for (auto const& pr : cost_dist) { summary.costs.push_back(pr.first); summary.flows.push_back(pr.second); }
-  }
-  // Min-Cut: Set of edges crossing from the reachable set (S) to the unreachable set (T).
-  // Computed by finding all nodes reachable from src in the residual graph.
-  if (total >= kMinFlow) {
-    auto mc = fs.compute_min_cut(src, node_mask, edge_mask);
-    summary.min_cut = mc;
-    if (with_reachable) {
-      summary.reachable_nodes.assign(static_cast<std::size_t>(g.num_nodes()), 0u);
-      auto residual = fs.residual_view();
-      auto eflows = fs.edge_flow_view();
-      const bool reach_use_node_mask = use_node_mask;
-      const bool reach_use_edge_mask = use_edge_mask;
-      const auto N = static_cast<std::size_t>(g.num_nodes());
-      std::vector<std::int32_t> stack;
-      stack.reserve(N);
-      stack.push_back(src);
-      while (!stack.empty()) {
-        auto n = static_cast<std::size_t>(stack.back());
-        stack.pop_back();
-        if (summary.reachable_nodes[n]) continue;
-        if (reach_use_node_mask && !node_mask[n]) continue;
-        summary.reachable_nodes[n] = 1u;
-        auto ro = g.row_offsets_view();
-        auto ci = g.col_indices_view();
-        auto ae = g.adj_edge_index_view();
-        auto s = static_cast<std::size_t>(ro[n]);
-        auto e = static_cast<std::size_t>(ro[n+1]);
-        for (std::size_t p = s; p < e; ++p) {
-          auto v = static_cast<std::size_t>(ci[p]);
-          auto eid = static_cast<std::size_t>(ae[p]);
-          if (reach_use_edge_mask && !edge_mask[eid]) continue;
-          if (reach_use_node_mask && !node_mask[v]) continue;
-          if (residual[eid] > kMinCap && !summary.reachable_nodes[v]) {
-            stack.push_back(static_cast<std::int32_t>(v));
-          }
-        }
-        auto iro = g.in_row_offsets_view();
-        auto ici = g.in_col_indices_view();
-        auto iae = g.in_adj_edge_index_view();
-        auto rs = static_cast<std::size_t>(iro[n]);
-        auto re = static_cast<std::size_t>(iro[n+1]);
-        for (std::size_t p = rs; p < re; ++p) {
-          auto u = static_cast<std::size_t>(ici[p]);
-          auto eid = static_cast<std::size_t>(iae[p]);
-          if (reach_use_edge_mask && !edge_mask[eid]) continue;
-          if (reach_use_node_mask && !node_mask[u]) continue;
-          if (eflows[eid] > kMinFlow && !summary.reachable_nodes[u]) {
-            stack.push_back(static_cast<std::int32_t>(u));
-          }
-        }
-      }
-    }
-  }
-  return {summary.total_flow, std::move(summary)};
-}
-
-std::vector<FlowSummary>
-batch_max_flow(const StrictMultiDiGraph& g,
-               const std::vector<std::pair<NodeId,NodeId>>& pairs,
-               FlowPlacement placement, bool shortest_path,
-               bool require_capacity,
-               bool with_edge_flows,
-               bool with_reachable,
-               bool with_residuals,
-               const std::vector<std::span<const bool>>& node_masks,
-               const std::vector<std::span<const bool>>& edge_masks) {
-  // Validate all masks upfront
-  for (const auto& nm : node_masks) {
-    if (!nm.empty() && nm.size() != static_cast<std::size_t>(g.num_nodes())) {
-      throw std::invalid_argument("batch_max_flow: node_mask length mismatch");
-    }
-  }
-  for (const auto& em : edge_masks) {
-    if (!em.empty() && em.size() != static_cast<std::size_t>(g.num_edges())) {
-      throw std::invalid_argument("batch_max_flow: edge_mask length mismatch");
-    }
-  }
-
-  std::vector<FlowSummary> out(pairs.size());
-  auto run_range = [&](std::size_t begin, std::size_t end) {
-    for (std::size_t i = begin; i < end; ++i) {
-      auto pr = pairs[i];
-      std::span<const bool> nm = (i < node_masks.size() ? node_masks[i] : std::span<const bool>{});
-      std::span<const bool> em = (i < edge_masks.size() ? edge_masks[i] : std::span<const bool>{});
-      auto [val, summary] = calc_max_flow(g, pr.first, pr.second,
-                                          placement, shortest_path,
-                                          require_capacity,
-                                          with_edge_flows,
-                                          with_reachable,
-                                          with_residuals,
-                                          nm, em);
-      out[i] = std::move(summary);
-    }
-  };
-  // Pairs are independent over an immutable graph; evaluate chunks in parallel.
-  // Thread count from NGRAPH_CORE_BATCH_THREADS env or hardware concurrency.
-  const auto thread_budget = thread_budget_from_env("NGRAPH_CORE_BATCH_THREADS", pairs.size());
-  if (thread_budget <= 1) {
-    run_range(0, pairs.size());
-    return out;
-  }
-  // Claim pairs one at a time from a shared counter rather than handing each worker a
-  // fixed contiguous chunk. Per-pair cost varies by orders of magnitude (a dense
-  // cross-fabric pair versus a disconnected one), so static chunking leaves workers
-  // idle whenever the expensive pairs happen to land in the same chunk.
-  std::atomic<std::size_t> next_pair{0};
-  auto run_dynamic = [&]() {
-    for (;;) {
-      const std::size_t i = next_pair.fetch_add(1, std::memory_order_relaxed);
-      if (i >= pairs.size()) break;
-      run_range(i, i + 1);
-    }
-  };
-  std::vector<std::future<void>> futures;
-  futures.reserve(thread_budget);
-  for (std::size_t w = 0; w < thread_budget; ++w) {
-    futures.emplace_back(std::async(std::launch::async, run_dynamic));
-  }
-  for (auto& f : futures) f.get();
-  return out;
-}
-
-std::vector<std::pair<EdgeId, Flow>>
-sensitivity_analysis(const StrictMultiDiGraph& g, NodeId src, NodeId dst,
-                     FlowPlacement placement, bool shortest_path,
-                     bool require_capacity,
-                     std::span<const bool> node_mask,
-                     std::span<const bool> edge_mask) {
-  // Step 1: Baseline analysis to identify saturated edges
-  // Uses shortest_path mode to match the routing semantics being analyzed.
-  auto [baseline_flow, summary] = calc_max_flow(
-      g, src, dst, placement,
-      shortest_path,
-      require_capacity,
-      /*with_edge_flows=*/false,
-      /*with_reachable=*/false,
-      /*with_residuals=*/true,
-      node_mask, edge_mask);
-
-  if (baseline_flow < kMinFlow || summary.residual_capacity.empty()) {
-    return {};
-  }
-
-  std::vector<EdgeId> candidates;
-  // Identify saturated edges (residual <= kMinCap)
-  // Only consider edges that are not already masked out
-  for (EdgeId eid = 0; eid < static_cast<EdgeId>(summary.residual_capacity.size()); ++eid) {
-    if (!edge_mask.empty() && !edge_mask[eid]) continue; // Already masked
-    if (summary.residual_capacity[eid] <= kMinCap) {
-      candidates.push_back(eid);
-    }
-  }
-
-  if (candidates.empty()) {
-    return {};
-  }
-
-  // Prepare mutable mask buffer
-  const auto N = static_cast<std::size_t>(g.num_edges());
-  std::unique_ptr<bool[]> test_mask_buf(new bool[N]);
-  if (edge_mask.empty()) {
-    std::fill(test_mask_buf.get(), test_mask_buf.get() + N, true);
-  } else {
-    std::copy(edge_mask.begin(), edge_mask.end(), test_mask_buf.get());
-  }
-  std::vector<std::pair<EdgeId, Flow>> results;
-  results.reserve(candidates.size());
-
-  // Step 2: Iterate candidates, testing flow reduction when each is removed
-  const auto thread_budget = thread_budget_from_env("NGRAPH_CORE_SENSITIVITY_THREADS", candidates.size());
-  if (thread_budget <= 1) {
-    for (EdgeId eid : candidates) {
-      auto maybe_result = evaluate_sensitivity_candidate(
-          g, src, dst, placement,
-          shortest_path, require_capacity,
-          baseline_flow, node_mask,
-          eid, test_mask_buf.get(), N);
-      if (maybe_result.has_value()) {
-        results.push_back(*maybe_result);
-      }
-    }
-    return results;
-  }
-
-  const auto chunk_size = (candidates.size() + thread_budget - 1) / thread_budget;
-  std::vector<std::future<std::vector<std::pair<EdgeId, Flow>>>> futures;
-  futures.reserve(thread_budget);
-
-  for (std::size_t begin = 0; begin < candidates.size(); begin += chunk_size) {
-    const std::size_t end = std::min<std::size_t>(begin + chunk_size, candidates.size());
-    futures.emplace_back(std::async(std::launch::async, [&, begin, end]() {
-      std::unique_ptr<bool[]> local_mask_buf(new bool[N]);
-      if (!edge_mask.empty()) {
-        std::copy(edge_mask.begin(), edge_mask.end(), local_mask_buf.get());
-      } else {
-        std::fill(local_mask_buf.get(), local_mask_buf.get() + N, true);
-      }
-
-      std::vector<std::pair<EdgeId, Flow>> local_results;
-      local_results.reserve(end - begin);
-      for (std::size_t idx = begin; idx < end; ++idx) {
-        auto maybe_result = evaluate_sensitivity_candidate(
-            g, src, dst, placement,
-            shortest_path, require_capacity,
-            baseline_flow, node_mask,
-            candidates[idx], local_mask_buf.get(), N);
-        if (maybe_result.has_value()) {
-          local_results.push_back(*maybe_result);
-        }
-      }
-      return local_results;
-    }));
-  }
-
-  for (auto& future : futures) {
-    auto local_results = future.get();
-    results.insert(results.end(), local_results.begin(), local_results.end());
-  }
-
-  return results;
-}
-
-} // namespace netgraph::core
diff --git a/src/min_cost_flow.cpp b/src/min_cost_flow.cpp
new file mode 100644
index 0000000..bacf064
--- /dev/null
+++ b/src/min_cost_flow.cpp
@@ -0,0 +1,1012 @@
+/*
+  The one integer minimum-cost flow core.
+
+  Find the maximum flow allowed by the cap at minimum cost. The residual network records how
+  much flow a forward arc can add and how much its reverse arc can cancel. A potential pi is
+  a vertex cost offset; the reduced cost of u -> v is cost(e) + pi(u) - pi(v). These offsets
+  make searchable arc costs non-negative without changing which path between two endpoints
+  is cheapest. Each tier runs Dijkstra, which finalises the nearest pending vertex first,
+  over all residual vertices reachable from virtual source s*, through sink t* and onward.
+  Add the final distances to settled vertices' potentials. Arcs on shortest paths now have
+  zero reduced cost; those with positive residual capacity form the admissible subgraph.
+  Dinic phases push flow through it: breadth-first search (BFS) assigns minimum-hop levels;
+  depth-first search (DFS) follows level-increasing paths, keeping each node's next arc to try.
+  A blocking flow fills these paths until none can take more. Repeat phases until no admissible
+  augmenting path (a residual source-to-sink path) remains, or the cap is reached. Repetition is
+  needed because a phase's level graph keeps only the admissible paths with the fewest arcs.
+  Start the next tier; stop when Dijkstra cannot reach t* or the cap is reached. No completion
+  phase follows.
+
+  Arc identity: each eligible edge has a forward arc with the view capacity and a reverse arc
+  with its flow. At each node, visit forward out-arcs and reverse in-arcs together by ascending
+  EdgeId; for a self-loop visit forward before reverse. Virtual vertices s* and t* connect the
+  real source and destination sets. A real endpoint's virtual arc comes first; s* visits
+  sources and t* visits destinations by ascending NodeId. Virtual arcs cost 0 and carry
+  2^63 - 2 units, above every attainable value, unless the solve gives the sources' arcs their own
+  capacities (the equal source allocation: source i's arc carries at most its round-robin share). Starting
+  from zero flow makes zero potentials valid: usable real arcs have positive costs and virtual
+  arcs cost 0.
+
+  Deletion re-solves start from a captured final state. During capture, track working
+  potentials without changing the original searches. Keep the sum of tier maxima D_k and
+  each settled vertex's last such sum; D_k is that search's largest finite distance.
+  Working potential = published potential + tier maxima accumulated since its last settlement.
+  For a never-settled vertex, start at zero and add the whole sum. This equals updating every
+  vertex after every Dijkstra: reached vertices by their distance, the others by D_k.
+  Thus every positive residual arc, real or virtual, has non-negative reduced cost.
+  Delete e = (u, v), with flow f_e > 0, from a copy and run three repairs, each with a fixed
+  origin and target and that all-vertex update before Dinic phases. First move up to f_e from
+  u to v; call the amount moved m. If r = f_e - m > 0, move r from u to s*, then from t* to v.
+  The u -> s* repair reuses the first repair's failed search because nothing has changed.
+  The result has maximum value (the solved value minus r) and minimum cost on the view without e. Working
+  potentials certify its cost; the real sources' full residual closure certifies its value.
+  There are at most m + 2 r Dijkstra runs.
+
+  Dijkstra's queue is a radix heap: keys pop in increasing order and entries with equal keys pop
+  in a fixed order (last pushed first within the lowest bucket), so the settle order, and with it
+  every counter, is a function of the input alone. Equal-key order affects only the counters,
+  never a distance, a potential or an augmenting path. The solve runs to the cap or to
+  disconnection; there is no clamp of the cap.
+
+  Arithmetic. A solve from zero stays in int64: each true residual distance is the cost of a
+  simple path (no repeated vertex), below the cost sum bound 2^62; potentials are such distances.
+  A path's bottleneck is its smallest residual capacity. It includes a real arc because sources
+  and destinations are disjoint, so every amount is below 2^62. The deletion mode's working
+  potentials, distance keys, tentative distances and sums of tier maxima are signed 128-bit
+  (I128; reachability kept apart from the value by a stamp): they stay within (n + 1) C at
+  capture and (22 n + 15) C across the repairs for n vertices and the cost sum C < 2^62, and its
+  heap takes 128-bit keys. Amounts stay int64.
+
+  Size. Vertex ids, arc slots and slot offsets are int32. A network of N real vertices has
+  N + 2 vertices, and every edge and every virtual arc has two slots (forward and reverse), so
+  N <= INT32_MAX - 2 and edges + sources + destinations <= 2^30 - 1 (twice that is the largest
+  even int32). network_vertices() refuses a larger network; both ways of sizing the solver (a
+  solve from zero, a captured state's re-solves) take their vertex count from it before anything
+  else, so every vertex id, slot and offset fits.
+*/
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/strong_components.hpp"
+
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <limits>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+
+#include "netgraph/core/detail/edge_amounts.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/node_map.hpp"
+
+namespace netgraph::core::detail {
+
+namespace {
+
+constexpr Cost kInfDist = std::numeric_limits<Cost>::max();
+constexpr Amount kUncapped = std::numeric_limits<Amount>::max();
+
+// The bucket of a key: the number of the highest bit in which it differs from the last popped
+// key (keys are non-negative). A 128-bit key differs in its high word from 2^64 on, which the
+// deletion mode's bound (22 n + 15) C allows (see Arithmetic above).
+std::size_t bucket_of(Cost key, Cost last) noexcept {
+  return static_cast<std::size_t>(std::bit_width(static_cast<std::uint64_t>(key) ^ static_cast<std::uint64_t>(last)));
+}
+std::size_t bucket_of(I128 key, I128 last) noexcept {
+  return static_cast<std::size_t>(bits(U128 {static_cast<std::uint64_t>(key.hi ^ last.hi), key.lo ^ last.lo}));
+}
+
+// Monotone priority queue for Dijkstra on non-negative integer keys (a radix heap): a key goes
+// to the bucket of the highest bit in which it differs from the last popped key, and a pop
+// redistributes the first non-empty bucket below its minimum. Entries are (key, vertex); equal
+// keys pop in a fixed order, so every run is a function of its input. Keys are int64 (a solve
+// from zero) or I128 (the deletion mode).
+template <class Key>
+class RadixHeap {
+public:
+  void clear() {
+    for (auto& b : buckets_) b.clear();
+    last_ = 0;
+    size_ = 0;
+  }
+  [[nodiscard]] bool empty() const noexcept { return size_ == 0; }
+  void push(Key key, std::int32_t v) {
+    buckets_[bucket_of(key, last_)].emplace_back(key, v);
+    ++size_;
+  }
+  std::pair<Key, std::int32_t> pop() {
+    if (buckets_[0].empty()) {
+      std::size_t i = 1;
+      while (buckets_[i].empty()) ++i;
+      auto& from = buckets_[i];
+      Key lowest = from.front().first;
+      for (const auto& entry : from) lowest = std::min(lowest, entry.first);
+      last_ = lowest;
+      for (const auto& entry : from) buckets_[bucket_of(entry.first, last_)].push_back(entry);
+      from.clear();
+    }
+    const auto top = buckets_[0].back();
+    buckets_[0].pop_back();
+    --size_;
+    return top;
+  }
+
+private:
+  std::array<std::vector<std::pair<Key, std::int32_t>>, 8 * sizeof(Key) + 1> buckets_ {};
+  Key last_ {0};
+  std::size_t size_ {0};
+};
+
+template <class P>
+inline constexpr bool kWide = std::is_same_v<P, I128>;
+
+} // namespace
+
+std::int32_t network_vertices(std::int32_t num_nodes, std::size_t num_edges, std::size_t num_sources,
+                              std::size_t num_destinations) {
+  constexpr std::int32_t kMax = std::numeric_limits<std::int32_t>::max();
+  if (num_nodes > kMax - 2) {
+    throw std::invalid_argument("flow solver node limit exceeded");
+  }
+  // Each term is compared with what the earlier ones leave, so no sum of counts can wrap.
+  constexpr auto kPairs = static_cast<std::size_t>(kMax / 2);  // 2^30 - 1
+  if (num_edges > kPairs || num_sources > kPairs - num_edges || num_destinations > kPairs - num_edges - num_sources) {
+    throw std::invalid_argument("flow solver arc limit exceeded");
+  }
+  return num_nodes + 2;
+}
+
+// The residual network of one solve (ResidualNetwork: real vertices 0..N-1, s* = N, t* = N + 1) with
+// its flow, potentials and scratch; also the working storage of a deletion re-solve.
+class MinCostFlowSolver {
+public:
+  // One reusable instance per thread (`local()`) for the solves from zero: build() resizes every
+  // buffer for the input, keeping capacity across calls, so the solver's own buffers are not
+  // reallocated once warm (each solve still allocates its outputs). Not reentrant (a solve never
+  // starts another). A deletion resolver owns its own.
+  static MinCostFlowSolver& local() {
+    thread_local MinCostFlowSolver solver;
+    return solver;
+  }
+
+  MinCostFlowSolver() = default;
+  // Never copied or moved: network_ may point at owned_network_.
+  MinCostFlowSolver(const MinCostFlowSolver&) = delete;
+  MinCostFlowSolver& operator=(const MinCostFlowSolver&) = delete;
+
+  // The input part of the network (num_nodes, the edges, the endpoint sets) is the caller's to
+  // fill; build() adds the arcs.
+  ResidualNetwork& network() noexcept { return owned_network_; }
+
+  // The arcs of the input, zero flow and zero potentials. `shadow`: record the working
+  // potentials for a capture.
+  void build(bool shadow) {
+    auto& in = owned_network_;
+    size(in);
+    network_ = &owned_network_;
+    const auto n = static_cast<std::size_t>(num_vertices_);
+    in.arc_offsets.assign(n + 1, 0);
+    auto deg = [&](std::int32_t v) { ++in.arc_offsets[static_cast<std::size_t>(v) + 1]; };
+    for (std::size_t k = 0; k < in.edges.size(); ++k) {
+      deg(in.edge_sources[k]);
+      deg(in.edge_destinations[k]);
+    }
+    for (std::int32_t s : in.sources) { deg(s); deg(virtual_source_); }
+    for (std::int32_t d : in.destinations) { deg(d); deg(virtual_sink_); }
+    for (std::size_t v = 0; v < n; ++v) in.arc_offsets[v + 1] += in.arc_offsets[v];
+    const auto num_slots = static_cast<std::size_t>(in.arc_offsets[n]);
+    in.arc_destinations.resize(num_slots);
+    in.reverse_arcs.resize(num_slots);
+    in.arc_cost.resize(num_slots);
+    arc_residual_.resize(num_slots);
+    arc_fill_positions_.assign(in.arc_offsets.begin(), in.arc_offsets.end() - 1);
+    auto take = [&](std::int32_t v) { return arc_fill_positions_[static_cast<std::size_t>(v)]++; };
+    auto link = [&](std::int32_t a, std::int32_t to_a, Amount cap, Cost w, std::int32_t b, std::int32_t to_b) {
+      const auto ai = static_cast<std::size_t>(a);
+      const auto bi = static_cast<std::size_t>(b);
+      in.arc_destinations[ai] = to_a;
+      in.reverse_arcs[ai] = b;
+      in.arc_cost[ai] = w;
+      arc_residual_[ai] = cap;
+      in.arc_destinations[bi] = to_b;
+      in.reverse_arcs[bi] = a;
+      in.arc_cost[bi] = -w;
+      arc_residual_[bi] = 0;
+    };
+    // Virtual arcs first at the real endpoints, then the real arcs by ascending EdgeId (forward
+    // slot at the tail, reverse slot at the head), then the slots of s* and t*.
+    in.source_reverse_arcs.resize(in.sources.size());
+    in.destination_forward_arcs.resize(in.destinations.size());
+    for (std::size_t i = 0; i < in.sources.size(); ++i) in.source_reverse_arcs[i] = take(in.sources[i]);
+    for (std::size_t i = 0; i < in.destinations.size(); ++i) in.destination_forward_arcs[i] = take(in.destinations[i]);
+    in.edge_forward_arcs.resize(in.edges.size());
+    for (std::size_t k = 0; k < in.edges.size(); ++k) {
+      const std::int32_t u = in.edge_sources[k];
+      const std::int32_t v = in.edge_destinations[k];
+      const std::int32_t fwd = take(u);
+      const std::int32_t bwd = take(v);
+      link(fwd, v, in.edge_capacities[k], in.cost[k], bwd, u);
+      in.edge_forward_arcs[k] = fwd;
+    }
+    for (std::size_t i = 0; i < in.sources.size(); ++i) {
+      link(take(virtual_source_), in.sources[i], in.source_capacities.empty() ? kMaxFlowCap : in.source_capacities[i], 0, in.source_reverse_arcs[i], virtual_source_);
+    }
+    for (std::size_t i = 0; i < in.destinations.size(); ++i) {
+      link(in.destination_forward_arcs[i], virtual_sink_, kMaxFlowCap, 0, take(virtual_sink_), in.destinations[i]);
+    }
+    potentials_.assign(n, 0);
+    ever_settled_.assign(n, 0);
+    distances_.resize(n);
+    shadow_ = shadow;
+    if (shadow) {
+      tier_sum_ = 0;
+      checkpoint_.assign(n, I128 {});
+    }
+  }
+
+  // A captured state's network, read in place by its deletion re-solves (never written; the
+  // caller keeps it alive while this solver uses it). The residual, the potentials and the
+  // scratch stay this solver's own.
+  void load(const ResidualNetwork& net) {
+    size(net);
+    network_ = &net;
+    arc_residual_.resize(network_->arc_destinations.size());
+    repair_potentials_.resize(static_cast<std::size_t>(num_vertices_));
+    repair_distances_.resize(static_cast<std::size_t>(num_vertices_));
+    repair_seen_generations_.assign(static_cast<std::size_t>(num_vertices_), 0);
+    repair_generation_ = 0;
+  }
+
+  // The solve to the cap or to disconnection. Output in local coordinates: `flows` aligned with
+  // the input edges, `cut` as input edge indices (every edge from the full residual closure of
+  // the real sources to its complement, ascending EdgeId) when the destinations are
+  // outside the closure, potentials per local vertex (kNeverReached when never settled).
+  struct Output {
+    Amount flow_value {0};
+    std::vector<std::pair<Cost, Amount>> marginal_cost_curve {};
+    std::vector<Amount> edge_flows {};
+    std::optional<std::vector<std::int32_t>> min_cut_positions {};
+    std::vector<Cost> potentials {};
+    MinCostFlowCounters counters {};
+  };
+
+  // `closure` adds the cut; `potentials` the per-vertex potentials (the edge-subset entry
+  // needs neither).
+  Output run(Amount limit, bool closure, bool potentials = true) {
+    Output out;
+    auto& c = out.counters;
+    Amount total = 0;
+    search_source_ = virtual_source_;
+    search_target_ = virtual_sink_;
+    while (total < limit) {
+      const bool reached = dijkstra<Cost>(c);
+      settle();
+      if (!reached) break;
+      const Cost tier_cost = potentials_[static_cast<std::size_t>(virtual_sink_)] - potentials_[static_cast<std::size_t>(virtual_source_)];
+      const Amount before = total;
+      total = drain<Cost>(c, limit, total, [](Amount) {});
+      // A successful Dijkstra reaches t* over arcs with positive residual and zero reduced cost
+      // along its shortest paths, so the drain moves at least one unit.
+      if (total == before) {
+        throw std::logic_error("flow core: a successful Dijkstra drained nothing");
+      }
+      out.marginal_cost_curve.emplace_back(tier_cost, total - before);
+    }
+    out.flow_value = total;
+
+    out.edge_flows.resize(network_->edges.size());
+    for (std::size_t k = 0; k < network_->edges.size(); ++k) out.edge_flows[k] = flow_of(k);
+    if (closure && close_sources()) out.min_cut_positions = cut_edges(-1);
+    if (potentials) {
+      out.potentials.resize(static_cast<std::size_t>(network_->num_nodes));
+      for (std::size_t v = 0; v < out.potentials.size(); ++v) {
+        out.potentials[v] = ever_settled_[v] != 0 ? potentials_[v] : kNeverReached;
+      }
+    }
+    return out;
+  }
+
+  // The final state of the last solve (its value and counters given) into `req`.
+  void capture(DeletionCapture& req, Amount value, const MinCostFlowCounters& counters) {
+    DeletionState state;
+    state.graph_ = req.graph;
+    state.network_ = std::make_shared<const ResidualNetwork>(*network_);
+    state.arc_residual_ = arc_residual_;
+    state.potentials_.resize(static_cast<std::size_t>(num_vertices_));
+    for (std::size_t v = 0; v < state.potentials_.size(); ++v) state.potentials_[v] = I128 {potentials_[v]} + (tier_sum_ - checkpoint_[v]);
+    state.value_ = value;
+    state.maximum_ = close_sources();
+    state.counters_ = counters;
+    req.state = std::move(state);
+  }
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  void observe(const std::function<void(std::span<const Cost>)>* on_search) noexcept { on_search_ = on_search; }
+  // The tests' probe of the re-solves until reset (nullptr: none).
+  void probe(const DeletionProbe* p) noexcept { probe_ = p; }
+#endif
+
+  // The deletion re-solve of input edge k (a real arc with positive flow) from `state`, whose
+  // network this solver holds (load()).
+  DeletionResult resolve(const DeletionState& state, std::size_t k) {
+    DeletionResult out;
+    auto& c = out.counters;
+    const Amount r = begin_deletion(state, k, c);
+    const std::int32_t u = network_->edge_sources[k];
+    const std::int32_t v = network_->edge_destinations[k];
+    if (r > 0) {
+      bool reuse = true;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      if (probe_ != nullptr && probe_->rerun_failed_search) reuse = false;
+#endif
+      if (repair(2, u, virtual_source_, r, reuse, c) != r) {
+        throw std::logic_error("deletion re-solve: the remainder has no residual path back to the sources");
+      }
+      if (repair(3, virtual_sink_, v, r, false, c) != r) {
+        throw std::logic_error("deletion re-solve: the deficit has no residual path from the destinations");
+      }
+    }
+    emit(4, false, 0, c);
+    if (!close_sources()) {
+      throw std::logic_error("deletion re-solve: the destinations stay connected to the sources");
+    }
+    out.value = state.value() - r;
+    out.potentials = repair_potentials_;
+    for (std::int32_t j : cut_edges(static_cast<std::int64_t>(k))) out.min_cut.push_back(network_->edges[static_cast<std::size_t>(j)]);
+    out.edge_flows.assign(static_cast<std::size_t>(state.graph().num_edges()), 0);
+    for (std::size_t j = 0; j < network_->edges.size(); ++j) {
+      out.edge_flows[static_cast<std::size_t>(network_->edges[j])] = j == k ? 0 : flow_of(j);
+    }
+    return out;
+  }
+
+  Amount loss(const DeletionState& state, std::size_t k) {
+    MinCostFlowCounters counters;
+    // Loss = deleted flow minus the capped u -> v reroute. Later cancellation stages
+    // restore conservation but cannot change this value.
+    return begin_deletion(state, k, counters);
+  }
+
+private:
+  // Both full and scalar repair start from the captured maximum, never from the
+  // previous call's potentially unbalanced intermediate state.
+  Amount begin_deletion(const DeletionState& state, std::size_t k, MinCostFlowCounters& c) {
+    std::copy(state.residual().begin(), state.residual().end(), arc_residual_.begin());
+    std::copy(state.potentials().begin(), state.potentials().end(), repair_potentials_.begin());
+    const auto fwd = static_cast<std::size_t>(network_->edge_forward_arcs[k]);
+    const auto bwd = static_cast<std::size_t>(network_->reverse_arcs[fwd]);
+    const Amount f = arc_residual_[bwd];
+    const std::int32_t u = network_->edge_sources[k];
+    const std::int32_t v = network_->edge_destinations[k];
+    // Removing e leaves f extra units at u and f missing units at v; conservation is broken
+    // until repairs reconnect or cancel them. Remove both residual arcs of e.
+    arc_residual_[fwd] = 0;
+    arc_residual_[bwd] = 0;
+    emit(0, false, 0, c);
+    const Amount m = repair(1, u, v, f, false, c);
+    return f - m;
+  }
+
+  // The vertex count and the virtual vertices of `net` (refused beyond the limits of
+  // network_vertices(), before any change), then the scratch of that many vertices.
+  void size(const ResidualNetwork& net) {
+    num_vertices_ = network_vertices(net.num_nodes, net.edges.size(), net.sources.size(), net.destinations.size());
+    virtual_source_ = num_vertices_ - 2;
+    virtual_sink_ = num_vertices_ - 1;
+    const auto n = static_cast<std::size_t>(num_vertices_);
+    level_.resize(n);
+    reach_.assign(n, 0);
+    reachability_generation_ = 0;
+    current_arcs_.resize(n);
+  }
+
+  // The flow of input edge k: the residual of its reverse slot.
+  [[nodiscard]] Amount flow_of(std::size_t k) const {
+    return arc_residual_[static_cast<std::size_t>(network_->reverse_arcs[static_cast<std::size_t>(network_->edge_forward_arcs[k])])];
+  }
+
+  template <class P>
+  std::vector<P>& potentials() {
+    if constexpr (kWide<P>) {
+      return repair_potentials_;
+    } else {
+      return potentials_;
+    }
+  }
+  template <class P>
+  std::vector<P>& distances() {
+    if constexpr (kWide<P>) {
+      return repair_distances_;
+    } else {
+      return distances_;
+    }
+  }
+  template <class P>
+  RadixHeap<P>& heap() {
+    if constexpr (kWide<P>) {
+      return repair_heap_;
+    } else {
+      return heap_;
+    }
+  }
+  // Whether the last search of the mode reached x (int64: a finite distance; I128: the stamp).
+  template <class P>
+  [[nodiscard]] bool reached(std::int32_t x) const {
+    const auto xi = static_cast<std::size_t>(x);
+    if constexpr (kWide<P>) {
+      return repair_seen_generations_[xi] == repair_generation_;
+    } else {
+      return distances_[xi] != kInfDist;
+    }
+  }
+
+  // Dijkstra on reduced costs from search_source_ to completion over the residual network. Returns
+  // whether search_target_ was reached; settled_ lists the vertices it settled.
+  template <class P>
+  bool dijkstra(MinCostFlowCounters& c) {
+    auto& pi = potentials<P>();
+    auto& dist = distances<P>();
+    auto& queue = heap<P>();
+    // The network is never resized during a search: raw pointers keep the compiler from
+    // reloading network_ and the vector bases around every store into the solver's own buffers.
+    const std::int32_t* const off = network_->arc_offsets.data();
+    const std::int32_t* const arc_destinations = network_->arc_destinations.data();
+    const Cost* const arc_cost = network_->arc_cost.data();
+    ++c.dijkstra_runs;
+    if constexpr (kWide<P>) {
+      // Wraparound after 2^32 wide searches since load(): one resolver's searches over all its
+      // deletions, which no stated limit keeps below 2^32.
+      if (++repair_generation_ == 0) {
+        std::fill(repair_seen_generations_.begin(), repair_seen_generations_.end(), 0);
+        repair_generation_ = 1;
+      }
+    } else {
+      std::fill(dist.begin(), dist.end(), kInfDist);
+    }
+    settled_.clear();
+    queue.clear();
+    const auto o = static_cast<std::size_t>(search_source_);
+    dist[o] = P {0};
+    if constexpr (kWide<P>) repair_seen_generations_[o] = repair_generation_;
+    queue.push(P {0}, search_source_);
+    while (!queue.empty()) {
+      const auto [du, ui] = queue.pop();
+      ++c.dijkstra_pops;
+      const auto u = static_cast<std::size_t>(ui);
+      if (du != dist[u]) continue;
+      settled_.push_back(ui);
+      ++c.settled;
+      const P base = du + pi[u];
+      const auto end = off[u + 1];
+      c.arc_scans += end - off[u];
+      for (auto p = off[u]; p < end; ++p) {
+        const auto a = static_cast<std::size_t>(p);
+        if (arc_residual_[a] <= 0) continue;
+        const auto v = static_cast<std::size_t>(arc_destinations[a]);
+        const P nd = base + arc_cost[a] - pi[v];
+        if constexpr (kWide<P>) {
+          if (repair_seen_generations_[v] != repair_generation_ || nd < dist[v]) {
+            repair_seen_generations_[v] = repair_generation_;
+            dist[v] = nd;
+            queue.push(nd, static_cast<std::int32_t>(v));
+          }
+        } else if (nd < dist[v]) {
+          dist[v] = nd;
+          queue.push(nd, static_cast<std::int32_t>(v));
+        }
+      }
+    }
+    return reached<P>(search_target_);
+  }
+
+  // The update of a solve from zero: the settled vertices' potentials by their distances; with
+  // a capture, the running sum of the tier maxima and the settled vertices' checkpoints.
+  void settle() {
+    for (std::int32_t v : settled_) {
+      const auto vi = static_cast<std::size_t>(v);
+      potentials_[vi] += distances_[vi];
+      ever_settled_[vi] = 1;
+    }
+    if (shadow_) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      if (on_search_ != nullptr && *on_search_) (*on_search_)(distances_);
+#endif
+      Cost top = 0;
+      for (std::int32_t v : settled_) top = std::max(top, distances_[static_cast<std::size_t>(v)]);
+      tier_sum_ += top;
+      for (std::int32_t v : settled_) checkpoint_[static_cast<std::size_t>(v)] = tier_sum_;
+    }
+  }
+
+  // The update of the deletion mode: every vertex, the reached ones by their distance and the
+  // others by the tier's largest finite distance.
+  void update_all() {
+    I128 top = 0;
+    for (std::int32_t v : settled_) top = std::max(top, repair_distances_[static_cast<std::size_t>(v)]);
+    for (std::size_t v = 0; v < repair_potentials_.size(); ++v) repair_potentials_[v] += repair_seen_generations_[v] == repair_generation_ ? repair_distances_[v] : top;
+  }
+
+  // The Dinic phases from search_source_ to search_target_ over the admissible subgraph (positive residual,
+  // zero reduced cost) until no admissible path remains or `limit` is reached; on_push(total)
+  // after every push.
+  template <class P, class OnPush>
+  Amount drain(MinCostFlowCounters& c, Amount limit, Amount total, OnPush on_push) {
+    const std::int32_t* const rev = network_->reverse_arcs.data();
+    while (total < limit) {
+      if (!build_levels<P>(c)) break;
+      std::copy(network_->arc_offsets.begin(), network_->arc_offsets.end() - 1, current_arcs_.begin());
+      while (total < limit) {
+        if (!find_path<P>(c)) break;
+        Amount amount = limit - total;
+        for (std::int32_t a : path_) amount = std::min(amount, arc_residual_[static_cast<std::size_t>(a)]);
+        for (std::int32_t a : path_) {
+          arc_residual_[static_cast<std::size_t>(a)] -= amount;
+          arc_residual_[static_cast<std::size_t>(rev[static_cast<std::size_t>(a)])] += amount;
+        }
+        total += amount;
+        ++c.augmentations;
+        on_push(total);
+      }
+    }
+    return total;
+  }
+
+  // BFS levels over admissible arcs (positive residual, zero reduced cost). Counts one phase.
+  // Only vertices that can reach search_target_ over admissible arcs are levelled: every vertex on a
+  // shortest admissible path from search_source_ to such a vertex reaches the target too, so their
+  // levels equal the levels of a full BFS, and the other vertices are dead ends that the DFS
+  // would only enter and leave. The forward search also stops once the target's level is
+  // complete. The augmenting paths are therefore the ones a full BFS gives.
+  template <class P>
+  bool build_levels(MinCostFlowCounters& c) {
+    const auto& pi = potentials<P>();
+    const std::int32_t* const off = network_->arc_offsets.data();
+    const std::int32_t* const arc_destinations = network_->arc_destinations.data();
+    const std::int32_t* const rev = network_->reverse_arcs.data();
+    const Cost* const arc_cost = network_->arc_cost.data();
+    const auto t = static_cast<std::size_t>(search_target_);
+    // Wraparound after 2^32 phases since size(): one solve from zero, or one resolver's phases
+    // over all its deletions, which no stated limit keeps below 2^32.
+    if (++reachability_generation_ == 0) {
+      std::fill(reach_.begin(), reach_.end(), 0);
+      reachability_generation_ = 1;
+    }
+    // Reverse search from the target: the arc into v from arc_destinations[p] is the partner of v's slot p.
+    queue_.clear();
+    reach_[t] = reachability_generation_;
+    queue_.push_back(search_target_);
+    for (std::size_t qi = 0; qi < queue_.size(); ++qi) {
+      const auto v = static_cast<std::size_t>(queue_[qi]);
+      const P pv = pi[v];
+      const auto end = off[v + 1];
+      c.arc_scans += end - off[v];
+      for (auto p = off[v]; p < end; ++p) {
+        const auto a = static_cast<std::size_t>(p);
+        const auto u = static_cast<std::size_t>(arc_destinations[a]);
+        if (reach_[u] == reachability_generation_) continue;
+        const auto in = static_cast<std::size_t>(rev[a]);
+        if (arc_residual_[in] > 0 && arc_cost[in] + pi[u] == pv) {
+          reach_[u] = reachability_generation_;
+          queue_.push_back(static_cast<std::int32_t>(u));
+        }
+      }
+    }
+    std::fill(level_.begin(), level_.end(), -1);
+    ++c.dinic_phases;
+    const auto s = static_cast<std::size_t>(search_source_);
+    if (reach_[s] != reachability_generation_) return false;
+    queue_.clear();
+    level_[s] = 0;
+    queue_.push_back(search_source_);
+    for (std::size_t qi = 0; qi < queue_.size(); ++qi) {
+      const auto u = static_cast<std::size_t>(queue_[qi]);
+      if (level_[t] >= 0 && level_[u] >= level_[t]) break;
+      const P pu = pi[u];
+      const auto next = level_[u] + 1;
+      const auto end = off[u + 1];
+      c.arc_scans += end - off[u];
+      for (auto p = off[u]; p < end; ++p) {
+        const auto a = static_cast<std::size_t>(p);
+        const auto v = static_cast<std::size_t>(arc_destinations[a]);
+        if (level_[v] < 0 && reach_[v] == reachability_generation_ && arc_residual_[a] > 0 && arc_cost[a] + pu == pi[v]) {
+          level_[v] = next;
+          queue_.push_back(static_cast<std::int32_t>(v));
+        }
+      }
+    }
+    return level_[t] >= 0;
+  }
+
+  // One augmenting path search_source_ -> search_target_ in the level graph into path_ (current-arc pointers
+  // kept: an arc that is pushed through stays current; a dead end advances its parent's pointer).
+  template <class P>
+  bool find_path(MinCostFlowCounters& c) {
+    const auto& pi = potentials<P>();
+    const std::int32_t* const off = network_->arc_offsets.data();
+    const std::int32_t* const arc_destinations = network_->arc_destinations.data();
+    const Cost* const arc_cost = network_->arc_cost.data();
+    stack_.clear();
+    path_.clear();
+    stack_.push_back(search_source_);
+    while (!stack_.empty()) {
+      const auto u = static_cast<std::size_t>(stack_.back());
+      if (static_cast<std::int32_t>(u) == search_target_) return true;
+      bool advanced = false;
+      const auto end = off[u + 1];
+      const auto next = level_[u] + 1;
+      const P pu = pi[u];
+      while (current_arcs_[u] < end) {
+        ++c.arc_scans;
+        const auto a = static_cast<std::size_t>(current_arcs_[u]);
+        const auto v = static_cast<std::size_t>(arc_destinations[a]);
+        if (arc_residual_[a] > 0 && level_[v] == next && arc_cost[a] + pu == pi[v]) {
+          stack_.push_back(static_cast<std::int32_t>(v));
+          path_.push_back(static_cast<std::int32_t>(a));
+          advanced = true;
+          break;
+        }
+        ++current_arcs_[u];
+      }
+      if (!advanced) {
+        stack_.pop_back();
+        if (!path_.empty()) {
+          path_.pop_back();
+          ++current_arcs_[static_cast<std::size_t>(stack_.back())];
+        }
+      }
+    }
+    return false;
+  }
+
+  // One fixed-origin repair of the deletion re-solve: tiers from `origin` to `target` until
+  // `amount` is moved or the target is unreachable; with `reuse`, the first tier reuses the
+  // last search (from the same origin, nothing changed since). Returns the amount moved.
+  Amount repair(int index, std::int32_t origin, std::int32_t target, Amount amount, bool reuse, MinCostFlowCounters& c) {
+    search_source_ = origin;
+    search_target_ = target;
+    Amount moved = 0;
+    bool search = !reuse;
+    while (moved < amount) {
+      if (search) {
+        const bool hit = dijkstra<I128>(c);
+        update_all();
+        emit(index, false, moved, c);
+        if (!hit) break;
+      } else if (!reached<I128>(search_target_)) {
+        throw std::logic_error("deletion re-solve: the reused search did not reach the repair's target");
+      }
+      search = true;
+      const Amount before = moved;
+      moved = drain<I128>(c, amount, moved, [&](Amount total) { emit(index, true, total, c); });
+      if (moved == before) throw std::logic_error("flow core: a successful Dijkstra drained nothing");
+    }
+    return moved;
+  }
+
+  // The full residual closure of the real sources (reverse and virtual arcs included) into
+  // seen_. Returns whether t* is outside it.
+  bool close_sources() {
+    const std::int32_t* const off = network_->arc_offsets.data();
+    const std::int32_t* const arc_destinations = network_->arc_destinations.data();
+    seen_.assign(static_cast<std::size_t>(num_vertices_), 0);
+    queue_.clear();
+    for (std::int32_t s : network_->sources) {
+      seen_[static_cast<std::size_t>(s)] = 1;
+      queue_.push_back(s);
+    }
+    for (std::size_t qi = 0; qi < queue_.size(); ++qi) {
+      const auto u = static_cast<std::size_t>(queue_[qi]);
+      for (auto p = off[u]; p < off[u + 1]; ++p) {
+        const auto a = static_cast<std::size_t>(p);
+        const auto v = static_cast<std::size_t>(arc_destinations[a]);
+        if (arc_residual_[a] > 0 && seen_[v] == 0) {
+          seen_[v] = 1;
+          queue_.push_back(static_cast<std::int32_t>(v));
+        }
+      }
+    }
+    return seen_[static_cast<std::size_t>(virtual_sink_)] == 0;
+  }
+
+  // The input edges from the closure to its complement (ascending), whatever their view
+  // capacity: an edge of view 0 there adds nothing to the cut's value and is listed because every
+  // edge leaving the closure is; the input edge `skip` (a deleted edge) left out.
+  [[nodiscard]] std::vector<std::int32_t> cut_edges(std::int64_t skip) const {
+    const std::int32_t* const tail = network_->edge_sources.data();
+    const std::int32_t* const head = network_->edge_destinations.data();
+    std::vector<std::int32_t> cut;
+    for (std::size_t k = 0; k < network_->edges.size(); ++k) {
+      if (static_cast<std::int64_t>(k) != skip && seen_[static_cast<std::size_t>(tail[k])] != 0 &&
+          seen_[static_cast<std::size_t>(head[k])] == 0) {
+        cut.push_back(static_cast<std::int32_t>(k));
+      }
+    }
+    return cut;
+  }
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  void emit(int repair, bool push, Amount moved, const MinCostFlowCounters& c) const {
+    if (probe_ != nullptr && probe_->observe) probe_->observe(DeletionEvent {repair, push, moved, arc_residual_, repair_potentials_, &c});
+  }
+#else
+  void emit(int /*repair*/, bool /*push*/, Amount /*moved*/, const MinCostFlowCounters& /*c*/) const noexcept {}
+#endif
+
+  ResidualNetwork owned_network_ {};              // a solve from zero's network (build())
+  const ResidualNetwork* network_ {&owned_network_};  // the network the searches read: owned_network_, or a captured one (load())
+  std::int32_t num_vertices_ {0};
+  std::int32_t virtual_source_ {0};
+  std::int32_t virtual_sink_ {0};
+  std::int32_t search_source_ {0};
+  std::int32_t search_target_ {0};
+  std::vector<std::int32_t> arc_fill_positions_ {};
+  std::vector<Amount> arc_residual_ {};
+  // A solve from zero.
+  std::vector<Cost> potentials_ {};
+  std::vector<std::uint8_t> ever_settled_ {};
+  std::vector<Cost> distances_ {};
+  RadixHeap<Cost> heap_ {};
+  bool shadow_ {false};
+  I128 tier_sum_ {};
+  std::vector<I128> checkpoint_ {};
+  // The deletion mode.
+  std::vector<I128> repair_potentials_ {};
+  std::vector<I128> repair_distances_ {};
+  std::vector<std::uint32_t> repair_seen_generations_ {};
+  std::uint32_t repair_generation_ {0};
+  RadixHeap<I128> repair_heap_ {};
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const DeletionProbe* probe_ {nullptr};
+  const std::function<void(std::span<const Cost>)>* on_search_ {nullptr};
+#endif
+  // Shared scratch.
+  std::vector<std::int32_t> settled_ {};
+  std::vector<std::int32_t> level_ {};
+  std::vector<std::uint32_t> reach_ {};
+  std::uint32_t reachability_generation_ {0};
+  std::vector<std::int32_t> queue_ {};
+  std::vector<std::int32_t> current_arcs_ {};
+  std::vector<std::int32_t> stack_ {};
+  std::vector<std::int32_t> path_ {};
+  std::vector<std::uint8_t> seen_ {};
+};
+
+std::vector<Amount> DeletionState::edge_flows() const {
+  std::vector<Amount> flows(static_cast<std::size_t>(graph_->num_edges()), 0);
+  for (std::size_t k = 0; k < network_->edges.size(); ++k) {
+    const auto fwd = static_cast<std::size_t>(network_->edge_forward_arcs[k]);
+    flows[static_cast<std::size_t>(network_->edges[k])] = arc_residual_[static_cast<std::size_t>(network_->reverse_arcs[fwd])];
+  }
+  return flows;
+}
+
+DeletionState& DeletionState::operator=(const DeletionState& other) {
+  DeletionState copy(other);  // every allocation; *this is untouched until it succeeds
+  return *this = std::move(copy);
+}
+
+// The solver reads the network that state_ shares: it lives as long as state_, a move included
+// (a move transfers the owner, the network stays where it is).
+DeletionResolver::DeletionResolver(const DeletionState& state) : state_(state), solver_(std::make_unique<MinCostFlowSolver>()) {
+  if (state_.network_ == nullptr) throw std::invalid_argument("deletion re-solve: an empty state (no solve captured it)");
+  solver_->load(state_.network());
+}
+
+DeletionResolver::~DeletionResolver() = default;
+DeletionResolver::DeletionResolver(DeletionResolver&&) noexcept = default;
+DeletionResolver& DeletionResolver::operator=(DeletionResolver&&) noexcept = default;
+
+DeletionResult DeletionResolver::resolve(EdgeId e) { return solver_->resolve(state_, index_of(e)); }
+
+Amount DeletionResolver::loss(EdgeId e) { return solver_->loss(state_, index_of(e)); }
+
+std::vector<std::uint8_t> deletion_cut_edges(const DeletionState& state) {
+  if (!state.maximum()) {
+    throw std::invalid_argument("deletion cut classification requires a certified maximum");
+  }
+  const auto& net = state.network();
+  const auto residual = state.residual();
+  std::vector<std::int32_t> component;
+  strong_components(net.arc_offsets, net.arc_destinations,
+                    [residual](std::size_t a) { return residual[a] > 0; }, component);
+  std::vector<std::uint8_t> cut(static_cast<std::size_t>(state.graph().num_edges()), 0);
+  for (std::size_t k = 0; k < net.edges.size(); ++k) {
+    const auto a = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+    if (residual[a] == 0 && residual[static_cast<std::size_t>(net.reverse_arcs[a])] > 0 &&
+        component[static_cast<std::size_t>(net.edge_sources[k])] != component[static_cast<std::size_t>(net.edge_destinations[k])]) {
+      cut[static_cast<std::size_t>(net.edges[k])] = 1;
+    }
+  }
+  return cut;
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+DeletionResult DeletionResolver::resolve(EdgeId e, const DeletionProbe& probe) {
+  const std::size_t k = index_of(e);
+  struct Reset {
+    MinCostFlowSolver& solver;
+    ~Reset() { solver.probe(nullptr); }
+  } reset {*solver_};
+  solver_->probe(&probe);
+  return solver_->resolve(state_, k);
+}
+
+Amount DeletionResolver::loss(EdgeId e, const DeletionProbe& probe) {
+  struct Reset {
+    MinCostFlowSolver& solver;
+    ~Reset() { solver.probe(nullptr); }
+  } reset {*solver_};
+  solver_->probe(&probe);
+  return loss(e);
+}
+#endif
+
+std::size_t DeletionResolver::index_of(EdgeId e) const {
+  if (!state_.maximum()) {
+    throw std::invalid_argument(
+        "deletion re-solve: the state is not certified maximum (a residual path from the sources to the "
+        "destinations remains)");
+  }
+  const ResidualNetwork& net = state_.network();
+  const auto it = std::lower_bound(net.edges.begin(), net.edges.end(), e);
+  if (it == net.edges.end() || *it != e) {
+    throw std::invalid_argument("deletion re-solve: edge " + std::to_string(e) + " is not in the solve's view");
+  }
+  const auto k = static_cast<std::size_t>(it - net.edges.begin());
+  const auto fwd = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+  if (state_.residual()[static_cast<std::size_t>(net.reverse_arcs[fwd])] <= 0) {
+    throw std::invalid_argument("deletion re-solve: edge " + std::to_string(e) + " carries no flow");
+  }
+  return k;
+}
+
+MinCostFlowResult solve_min_cost_flow(const Graph& graph,
+                                  std::span<const Amount> view,
+                                  std::span<const NodeId> sources,
+                                  std::span<const NodeId> destinations,
+                                  const Eligibility* eligibility,
+                                  std::optional<Amount> cap,
+                                  DeletionCapture* capture,
+                                  std::span<const Amount> source_caps) {
+  const auto num_edges = static_cast<std::size_t>(graph.num_edges());
+  check_edge_amounts(graph, view, "view");
+  const auto srcs = node_set(sources, graph.num_nodes(), "sources");
+  const auto dsts = node_set(destinations, graph.num_nodes(), "destinations");
+  check_disjoint(srcs, dsts, "sources", "destinations");
+  if (cap.has_value() && (*cap < 0 || *cap > kMaxFlowCap)) {
+    throw std::invalid_argument("cap " + std::to_string(*cap) + " is outside [0, 2^63 - 2]");
+  }
+  if (eligibility != nullptr && eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  if (capture != nullptr && capture->graph.get() != &graph) {
+    throw std::logic_error("flow core: a capture request bound to another graph");
+  }
+  if (!source_caps.empty() && (source_caps.size() != srcs.size() || capture != nullptr)) {
+    throw std::logic_error("flow core: source capacities not aligned with the sources, or captured");
+  }
+  MinCostFlowResult out;
+  const bool zero = cap.has_value() && *cap == 0;
+  if (zero) {
+    // The input cap 0 runs nothing: the prescribed zero payload.
+    out.edge_flows.assign(num_edges, 0);
+    out.potentials.assign(static_cast<std::size_t>(graph.num_nodes()), kNeverReached);
+    if (capture == nullptr) return out;
+  }
+  // Identity coordinates: every real vertex, the allowed edges and endpoints.
+  MinCostFlowSolver& solver = MinCostFlowSolver::local();
+  ResidualNetwork& in = solver.network();
+  in.num_nodes = graph.num_nodes();
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  const auto cost = graph.edge_costs();
+  in.edges.clear();
+  in.edge_sources.clear();
+  in.edge_destinations.clear();
+  in.cost.clear();
+  in.edge_capacities.clear();
+  in.sources.clear();
+  in.source_capacities.clear();
+  in.destinations.clear();
+  in.edges.reserve(num_edges);
+  for (std::size_t e = 0; e < num_edges; ++e) {
+    if (eligibility != nullptr && !eligibility->allows_edge(static_cast<EdgeId>(e))) continue;
+    in.edges.push_back(static_cast<EdgeId>(e));
+    in.edge_sources.push_back(edge_sources[e]);
+    in.edge_destinations.push_back(edge_destinations[e]);
+    in.cost.push_back(cost[e]);
+    in.edge_capacities.push_back(view[e]);
+  }
+  for (std::size_t i = 0; i < srcs.size(); ++i) {
+    if (eligibility != nullptr && !eligibility->allows_node(srcs[i])) continue;
+    in.sources.push_back(srcs[i]);
+    if (!source_caps.empty()) in.source_capacities.push_back(source_caps[i]);
+  }
+  for (NodeId d : dsts) {
+    if (eligibility == nullptr || eligibility->allows_node(d)) in.destinations.push_back(d);
+  }
+  solver.build(capture != nullptr);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  solver.observe(capture != nullptr ? &capture->on_search : nullptr);
+#endif
+  if (!zero) {
+    auto r = solver.run(cap.value_or(kUncapped), /*closure=*/true);
+    out.flow_value = r.flow_value;
+    out.marginal_cost_curve = std::move(r.marginal_cost_curve);
+    out.edge_flows.assign(num_edges, 0);
+    for (std::size_t k = 0; k < in.edges.size(); ++k) {
+      out.edge_flows[static_cast<std::size_t>(in.edges[k])] = r.edge_flows[k];
+    }
+    if (r.min_cut_positions.has_value()) {
+      std::vector<EdgeId> cut;
+      cut.reserve(r.min_cut_positions->size());
+      for (std::int32_t k : *r.min_cut_positions) cut.push_back(in.edges[static_cast<std::size_t>(k)]);
+      out.min_cut = std::move(cut);
+    }
+    out.potentials = std::move(r.potentials);
+    out.counters = r.counters;
+  }
+  if (capture != nullptr) solver.capture(*capture, out.flow_value, out.counters);
+  return out;
+}
+
+namespace {
+
+// solve_subset's body; `by_cost` false takes every arc's cost as 0 (max_flow_subset).
+SubsetFlow subset_flow(const Graph& g, std::span<const EdgeId> edges, std::span<const Amount> caps,
+                       std::span<const NodeId> sources, std::span<const NodeId> destinations, std::optional<Amount> cap,
+                       std::span<const Amount> source_caps, bool by_cost) {
+  SubsetFlow out;
+  out.edge_flows.assign(edges.size(), 0);
+  if (cap.has_value() && *cap == 0) return out;
+  const auto edge_sources = g.edge_sources();
+  const auto edge_destinations = g.edge_destinations();
+  const auto cost = g.edge_costs();
+  // Compressed vertices in first-touch order. The numbering changes no flow, curve or path:
+  // the arc order at every vertex is by EdgeId (virtual arc first) and the virtual arcs of s*
+  // and t* follow the endpoint lists, which stay in ascending NodeId.
+  NodeMap& map = NodeMap::local();
+  map.reset(static_cast<std::size_t>(g.num_nodes()));
+  // The input's storage is the thread's solver's (every field is rewritten here).
+  MinCostFlowSolver& solver = MinCostFlowSolver::local();
+  ResidualNetwork& in = solver.network();
+  in.edges.assign(edges.begin(), edges.end());
+  in.edge_sources.clear();
+  in.edge_destinations.clear();
+  in.cost.clear();
+  in.sources.clear();
+  in.destinations.clear();
+  for (EdgeId e : edges) {
+    const auto ei = static_cast<std::size_t>(e);
+    in.edge_sources.push_back(map.add(edge_sources[ei]));
+    in.edge_destinations.push_back(map.add(edge_destinations[ei]));
+    in.cost.push_back(by_cost ? cost[ei] : 0);
+  }
+  for (NodeId v : sources) in.sources.push_back(map.add(v));
+  in.source_capacities.assign(source_caps.begin(), source_caps.end());
+  for (NodeId v : destinations) in.destinations.push_back(map.add(v));
+  in.num_nodes = static_cast<std::int32_t>(map.size());
+  in.edge_capacities.assign(caps.begin(), caps.end());
+  solver.build(false);
+  auto r = solver.run(cap.value_or(kUncapped), /*closure=*/false, /*potentials=*/false);
+  out.flow_value = r.flow_value;
+  out.edge_flows = std::move(r.edge_flows);
+  out.marginal_cost_curve = std::move(r.marginal_cost_curve);
+  return out;
+}
+
+} // namespace
+
+SubsetFlow solve_subset(const Graph& graph, std::span<const EdgeId> edges, std::span<const Amount> caps,
+                        std::span<const NodeId> sources, std::span<const NodeId> destinations,
+                        std::optional<Amount> cap, std::span<const Amount> source_caps) {
+  return subset_flow(graph, edges, caps, sources, destinations, cap, source_caps, true);
+}
+
+Amount max_flow_subset(const Graph& g, std::span<const EdgeId> edges, std::span<const Amount> caps,
+                       std::span<const NodeId> sources, std::span<const NodeId> destinations, Amount cap,
+                       std::span<const Amount> source_caps) {
+  return subset_flow(g, edges, caps, sources, destinations, cap, source_caps, false).flow_value;
+}
+
+} // namespace netgraph::core::detail
diff --git a/src/profiling.cpp b/src/profiling.cpp
deleted file mode 100644
index 7acfed9..0000000
--- a/src/profiling.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
-  Profiling implementation - singleton definitions.
-
-  These are defined in a .cpp file (not inline in the header) to avoid ODR
-  violations when linking a static library into a shared library (Python module).
-  With inline definitions, separate static variable instances can exist in each
-  translation unit, causing profiling data to be recorded in one instance while
-  being read from another.
-*/
-#include "netgraph/core/profiling.hpp"
-
-#include <algorithm>  // std::sort in dump()
-#include <cstdlib>
-
-namespace netgraph::core {
-
-bool profiling_enabled() noexcept {
-    static const bool enabled = [] {
-        const char* env = std::getenv("NGRAPH_CORE_PROFILE");
-        return env && env[0] == '1';
-    }();
-    return enabled;
-}
-
-ProfilingStats& ProfilingStats::instance() {
-    static auto* inst = new ProfilingStats();
-    return *inst;
-}
-
-ProfilingStats::LocalStats::LocalStats(ProfilingStats& owner) : owner_(owner) {
-    owner_.register_local(this);
-}
-
-ProfilingStats::LocalStats::~LocalStats() {
-    owner_.finalize_local(this);
-}
-
-void ProfilingStats::LocalStats::record(const char* name, double micros) {
-    std::lock_guard<std::mutex> lock(mutex_);
-    auto& e = stats_[name];
-    e.total_us += micros;
-    e.count++;
-    if (micros < e.min_us) e.min_us = micros;
-    if (micros > e.max_us) e.max_us = micros;
-}
-
-void ProfilingStats::LocalStats::append_to(std::unordered_map<std::string, Entry>& out) const {
-    std::lock_guard<std::mutex> lock(mutex_);
-    for (const auto& [name, entry] : stats_) {
-        merge_entry(out[name], entry);
-    }
-}
-
-void ProfilingStats::LocalStats::clear() {
-    std::lock_guard<std::mutex> lock(mutex_);
-    stats_.clear();
-}
-
-ProfilingStats::LocalStats& ProfilingStats::local_stats() {
-    static thread_local LocalStats local(*this);
-    return local;
-}
-
-void ProfilingStats::register_local(LocalStats* local) {
-    std::lock_guard<std::mutex> lock(mutex_);
-    active_locals_.push_back(local);
-}
-
-void ProfilingStats::finalize_local(LocalStats* local) {
-    std::lock_guard<std::mutex> lock(mutex_);
-    local->append_to(finished_stats_);
-    auto it = std::find(active_locals_.begin(), active_locals_.end(), local);
-    if (it != active_locals_.end()) {
-        active_locals_.erase(it);
-    }
-}
-
-void ProfilingStats::merge_entry(Entry& dst, const Entry& src) {
-    if (src.count == 0) {
-        return;
-    }
-    dst.total_us += src.total_us;
-    dst.count += src.count;
-    dst.min_us = std::min(dst.min_us, src.min_us);
-    dst.max_us = std::max(dst.max_us, src.max_us);
-}
-
-std::unordered_map<std::string, ProfilingStats::Entry> ProfilingStats::snapshot_unlocked() const {
-    auto snapshot = finished_stats_;
-    for (const LocalStats* local : active_locals_) {
-        local->append_to(snapshot);
-    }
-    return snapshot;
-}
-
-void ProfilingStats::record(const char* name, double micros) {
-    local_stats().record(name, micros);
-}
-
-void ProfilingStats::dump(std::ostream& out) const {
-    std::lock_guard<std::mutex> lock(mutex_);
-    const auto snapshot = snapshot_unlocked();
-    std::vector<std::pair<std::string, Entry>> ordered(snapshot.begin(), snapshot.end());
-    std::sort(
-        ordered.begin(),
-        ordered.end(),
-        [](const auto& left, const auto& right) { return left.first < right.first; }
-    );
-
-    out << "\n=== NetGraph-Core Profiling Stats ===\n";
-    for (const auto& [name, entry] : ordered) {
-        const double avg = entry.count > 0 ? entry.total_us / static_cast<double>(entry.count) : 0.0;
-        out << name << ":\n"
-            << "  calls: " << entry.count << "\n"
-            << "  total: " << entry.total_us / 1000.0 << " ms\n"
-            << "  avg:   " << avg << " us\n"
-            << "  min:   " << entry.min_us << " us\n"
-            << "  max:   " << entry.max_us << " us\n";
-    }
-    out << "=====================================\n";
-}
-
-void ProfilingStats::reset() {
-    std::lock_guard<std::mutex> lock(mutex_);
-    finished_stats_.clear();
-    for (LocalStats* local : active_locals_) {
-        local->clear();
-    }
-}
-
-} // namespace netgraph::core
diff --git a/src/route_kernels.cpp b/src/route_kernels.cpp
new file mode 100644
index 0000000..1c2a8b6
--- /dev/null
+++ b/src/route_kernels.cpp
@@ -0,0 +1,1314 @@
+/*
+  Apportionment and the placement kernels in units. T is a plan's total injection.
+
+  Every forwarded Amount is an int64 number of units below 2^62: T is bounded by the view on the roots'
+  members (the graph's capacities sum below 2^62), each node's inflow by T, and each share by that
+  inflow. Highest averages compares
+  w_i/d_i and w_j/d_j through w_i*d_j and w_j*d_i (operands < 2^63, products < 2^126). The
+  lower quota floor(I*w/W) uses a 128-bit product, with inflow I, weight w < 2^62 and the exact
+  128-bit weight sum W (explicit weights are each below 2^62, not their sum).
+  Cumulative source apportionment instead uses totals below 2^127 and 192-bit products.
+*/
+#include "netgraph/core/detail/route_kernels.hpp"
+
+#include <algorithm>
+#include <bit>
+#include <limits>
+#include <memory>
+#include <numeric>
+#include <stdexcept>
+#include <string>
+
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/concurrency.hpp"
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+
+namespace netgraph::core::detail {
+
+// ---------------------------------------------------------------- apportionment
+
+namespace {
+
+// w_i / d_i > w_j / d_j, ties by the lower index: the next unit's recipient order.
+bool before(std::uint64_t wi, std::uint64_t di, std::size_t i, std::uint64_t wj, std::uint64_t dj, std::size_t j) {
+  const U128 left = mul_u64(wi, dj);
+  const U128 right = mul_u64(wj, di);
+  if (!(left == right)) return left > right;
+  return i < j;
+}
+
+Amount quota(Amount total, Amount w, U128 sum) noexcept {
+  return static_cast<Amount>(div_u128(mul_u64(static_cast<std::uint64_t>(total), static_cast<std::uint64_t>(w)), sum));
+}
+U128 quota(U128 total, Amount w, U128 sum) noexcept {
+  return div_wide(mul_wide(total, static_cast<std::uint64_t>(w)), sum);
+}
+Amount plus(Amount a, Amount b) noexcept { return a + b; }
+U128 plus(U128 a, U128 b) noexcept { return add(a, b); }
+Amount remainder(Amount a, Amount b) noexcept { return a - b; }
+Amount remainder(U128 a, U128 b) noexcept { return static_cast<Amount>(sub(a, b).lo); }
+void award(Amount& a) noexcept { ++a; }
+void award(U128& a) noexcept { a = add(a, U128 {0, 1}); }
+bool next_before(Amount wi, Amount ai, std::size_t i, Amount wj, Amount aj, std::size_t j) noexcept {
+  return before(static_cast<std::uint64_t>(wi), static_cast<std::uint64_t>(ai) + 1, i,
+                static_cast<std::uint64_t>(wj), static_cast<std::uint64_t>(aj) + 1, j);
+}
+bool next_before(Amount wi, U128 ai, std::size_t i, Amount wj, U128 aj, std::size_t j) noexcept {
+  const auto left = mul_wide(add(aj, U128 {0, 1}), static_cast<std::uint64_t>(wi));
+  const auto right = mul_wide(add(ai, U128 {0, 1}), static_cast<std::uint64_t>(wj));
+  return left != right ? left > right : i < j;
+}
+
+// One rule for both widths: only quota and priority arithmetic differ. The
+// unassigned remainder is less than k, even for a cumulative 127-bit total.
+template<class Share>
+void apportion(Share total, std::span<const Amount> weights, std::span<Share> out) {
+  const std::size_t k = weights.size();
+  U128 wsum {};
+  for (Amount w : weights) wsum = add(wsum, U128 {0, static_cast<std::uint64_t>(w)});
+  if (wsum == U128 {}) {  // all-zero weights give nothing
+    std::fill(out.begin(), out.begin() + static_cast<std::ptrdiff_t>(k), Share {});
+    return;
+  }
+  Share given {};
+  for (std::size_t m = 0; m < k; ++m) {
+    // Lower quota floor(total * w / W): exactly the quotients w / j >= W / total.
+    out[m] = quota(total, weights[m], wsum);
+    given = plus(given, out[m]);
+  }
+  // Fewer than k (the positive weights' count) units are left; a zero weight's quotient 0 never
+  // beats a positive one, so it gets none of them.
+  Amount left = remainder(total, given);
+  if (left == 0) return;
+  if (k <= 16) {
+    while (left-- > 0) {
+      std::size_t best = 0;
+      for (std::size_t m = 1; m < k; ++m) {
+        if (next_before(weights[m], out[m], m, weights[best], out[best], best)) {
+          best = m;
+        }
+      }
+      award(out[best]);
+    }
+    return;
+  }
+  std::vector<std::size_t> heap(k);
+  std::iota(heap.begin(), heap.end(), std::size_t{0});
+  // std heaps put the largest first: "a < b" when b goes first.
+  auto later = [&](std::size_t a, std::size_t b) {
+    return next_before(weights[b], out[b], b, weights[a], out[a], a);
+  };
+  std::make_heap(heap.begin(), heap.end(), later);
+  while (left-- > 0) {
+    std::pop_heap(heap.begin(), heap.end(), later);
+    award(out[heap.back()]);
+    std::push_heap(heap.begin(), heap.end(), later);
+  }
+}
+
+} // namespace
+
+void highest_averages(Amount total, std::span<const Amount> weights, std::span<Amount> out) {
+  apportion(total, weights, out);
+}
+
+void highest_averages(U128 total, std::span<const Amount> weights, std::span<U128> out) {
+  apportion(total, weights, out);
+}
+
+void round_robin_increments(const Counter128& total, Amount v, std::span<Amount> out) noexcept {
+  const auto k = static_cast<std::uint64_t>(out.size());
+  if (k == 0) return;
+  const std::uint64_t r = mod_u128(U128 {total.hi, total.lo}, k);
+  const std::uint64_t t = static_cast<std::uint64_t>(v) + r;
+  const auto base = static_cast<Amount>(t / k);
+  const std::uint64_t extra = t % k;
+  for (std::size_t i = 0; i < out.size(); ++i) out[i] = base + (i < extra ? 1 : 0) - (i < r ? 1 : 0);
+}
+
+// ---------------------------------------------------------------- plans
+
+void check_kernel_combination(RouteAllocation allocation, Admission admission) {
+  if (admission == Admission::Lossy && allocation == RouteAllocation::Optimized) {
+    throw std::invalid_argument("OPTIMIZED requires admission=LOSSLESS");
+  }
+}
+
+void check_kernel(RouteAllocation allocation, Admission admission) {
+  check_member(allocation, "allocation");
+  check_member(admission, "admission");
+  check_kernel_combination(allocation, admission);
+}
+
+PreparedRoute::Layout PreparedRoute::point(std::size_t num_roots, std::size_t num_dsts, std::size_t positions,
+                                     std::size_t num_members) noexcept {
+  std::int32_t* at = store_.data();
+  Layout w;
+  sources = std::span<const NodeId>(at, num_roots);
+  at += num_roots;
+  w.source_positions = std::span<std::int32_t>(at, num_roots);
+  source_positions = w.source_positions;
+  at += num_roots;
+  destinations = std::span<const NodeId>(at, num_dsts);
+  at += num_dsts;
+  w.topological_order = std::span<NodeId>(at, positions);
+  at += positions;
+  w.outgoing_begin = std::span<std::int32_t>(at, positions);
+  at += positions;
+  w.outgoing_end = std::span<std::int32_t>(at, positions);
+  at += positions;
+  w.edge_destination_positions = std::span<std::int32_t>(at, num_members);
+  at += num_members;
+  w.is_destination = std::span<std::uint8_t>(reinterpret_cast<std::uint8_t*>(at), positions);
+  topological_order = w.topological_order;
+  outgoing_begin = w.outgoing_begin;
+  outgoing_end = w.outgoing_end;
+  edge_destination_positions = w.edge_destination_positions;
+  is_destination = w.is_destination;
+  return w;
+}
+
+PreparedRoute::Layout PreparedRoute::layout(std::span<const NodeId> roots_in, std::span<const NodeId> destinations,
+                                      std::size_t positions, std::size_t num_members) {
+  const std::size_t words =
+      2 * roots_in.size() + destinations.size() + 3 * positions + num_members + (positions + 3) / 4;
+  std::vector<std::int32_t> store(words, 0);  // the one allocation
+  store_.swap(store);
+  const Layout w = point(roots_in.size(), destinations.size(), positions, num_members);
+  std::copy(roots_in.begin(), roots_in.end(), store_.begin());
+  std::fill(w.source_positions.begin(), w.source_positions.end(), -1);
+  std::copy(destinations.begin(), destinations.end(), store_.begin() + static_cast<std::ptrdiff_t>(2 * roots_in.size()));
+  return w;
+}
+
+PreparedRoute::PreparedRoute(const PreparedRoute& other)
+    : allocation(other.allocation), support_edges(other.support_edges), forwarding_edges(other.forwarding_edges),
+      weights(other.weights), store_(other.store_) {
+  (void)point(other.sources.size(), other.destinations.size(), other.topological_order.size(), other.edge_destination_positions.size());
+}
+
+PreparedRoute::PreparedRoute(PreparedRoute&& other) noexcept
+    : allocation(other.allocation), support_edges(std::move(other.support_edges)),
+      forwarding_edges(std::move(other.forwarding_edges)), weights(std::move(other.weights)), store_(std::move(other.store_)) {
+  (void)point(other.sources.size(), other.destinations.size(), other.topological_order.size(), other.edge_destination_positions.size());
+  (void)other.point(0, 0, 0, 0);
+}
+
+PreparedRoute& PreparedRoute::operator=(const PreparedRoute& other) {
+  if (this != &other) {
+    PreparedRoute copy(other);
+    *this = std::move(copy);
+  }
+  return *this;
+}
+
+PreparedRoute& PreparedRoute::operator=(PreparedRoute&& other) noexcept {
+  if (this != &other) {
+    allocation = other.allocation;
+    support_edges = std::move(other.support_edges);
+    forwarding_edges = std::move(other.forwarding_edges);
+    weights = std::move(other.weights);
+    const std::size_t nr = other.sources.size();
+    const std::size_t nd = other.destinations.size();
+    const std::size_t np = other.topological_order.size();
+    const std::size_t nm = other.edge_destination_positions.size();
+    store_ = std::move(other.store_);
+    (void)point(nr, nd, np, nm);
+    (void)other.point(0, 0, 0, 0);
+  }
+  return *this;
+}
+
+namespace {
+
+// Per-thread build_split state, by NodeId, for its backward depth-first search (DFS) and
+// forward pass. A call advances an epoch (a numeric stamp); a slot is valid only if its stamp
+// matches. Later calls ignore stale entries, including after exceptions; only stamp wraparound
+// (after 2^32 calls on one thread, which a long-running process reaches) clears all stamps. One
+// array holds every node's fields, so a failed growth leaves the old array intact (the strong
+// guarantee); separate arrays could end at mismatched sizes.
+struct DagScratch {
+  struct Node {
+    std::uint32_t stamp {0};
+    std::uint8_t state {0};   // backward DFS: 1 open, 2 done (reaches a destination)
+    std::uint8_t fwd {0};     // reached from the source
+    std::uint8_t target {0};  // a destination
+    std::uint8_t root {0};    // a root of the plan
+    std::int32_t position {0};
+    std::int32_t first {0};   // the node's first member
+    std::int32_t count {0};   // the node's number of members
+    std::int32_t entry_begin {0};  // the node's predecessor entries in the DAG's sparse storage
+    std::int32_t entry_end {0};
+    Cost dist {0};
+  };
+  std::uint32_t generation {0};
+  std::vector<Node> node;
+  std::vector<NodeId> order;
+  std::vector<std::pair<NodeId, std::int32_t>> stack;
+  std::vector<NodeId> member_tail;
+  std::vector<NodeId> member_head;
+
+  void begin(std::size_t n) {
+    if (node.size() < n) node.resize(n);  // strong guarantee; new slots carry stamp 0
+    if (++generation == 0) {
+      for (auto& v : node) v.stamp = 0;
+      generation = 1;
+    }
+  }
+  [[nodiscard]] bool seen(NodeId v) const noexcept { return node[static_cast<std::size_t>(v)].stamp == generation; }
+  Node& at(NodeId v) noexcept { return node[static_cast<std::size_t>(v)]; }
+  void touch(NodeId v) noexcept {
+    auto& x = at(v);
+    x = Node {};
+    x.stamp = generation;
+  }
+};
+
+DagScratch& dag_scratch() {
+  thread_local DagScratch s;
+  return s;
+}
+
+// Build plan.forwarding_edges from the DAG's incoming-edge lists: keep edges accepted by keep(e) that
+// lie on a walk from a root to a destination; exclude edges leaving destinations. No node
+// renumbering, extra arc arrays or adjacency offsets are needed. A backward DFS from destinations
+// lists each node after its parents (postorder, also a topological order here).
+// A forward pass then marks nodes reachable from the roots. Members ascend by EdgeId, so one
+// tail's members are consecutive. Any topological order gives the same allocation because each
+// node splits only after receiving all its inflow.
+// With `cost`, the forward pass computes minimum cost to each node from its parents' costs
+// (dynamic programming, DP), giving the minimum root-to-destination cost over members, or
+// kUnreachable if none exist. Without `out` (min_route_cost), stop there and build no plan.
+template <class Keep>
+void build_split(const Graph& graph, const PredecessorDAG& dag, std::span<const NodeId> roots, std::span<const NodeId> destinations,
+                 Keep keep, PreparedRoute* out, Cost* cost) {
+  concurrent_event(ConcurrentStage::RouteWalk, &dag);
+  if (cost != nullptr) *cost = kUnreachable;
+  const auto parents = dag.parents();
+  const auto via = dag.via_edges();
+  DagScratch& s = dag_scratch();
+  s.begin(static_cast<std::size_t>(graph.num_nodes()));
+  // The DAG's sparse storage scattered into the per-node slots (O(member nodes)); a node outside
+  // it has no entries when first touched (a destination, source or a parent the search meets).
+  {
+    const auto nodes = PredecessorDAGBuilder::member_nodes(dag);
+    const auto offs = PredecessorDAGBuilder::member_offsets(dag);
+    for (std::size_t i = 0; i < nodes.size(); ++i) {
+      s.touch(nodes[i]);
+      s.at(nodes[i]).entry_begin = offs[i];
+      s.at(nodes[i]).entry_end = offs[i + 1];
+    }
+  }
+  for (NodeId d : destinations) {
+    if (!s.seen(d)) s.touch(d);
+    s.at(d).target = 1;
+  }
+  for (NodeId r : roots) {
+    if (!s.seen(r)) s.touch(r);
+    s.at(r).root = 1;
+  }
+  auto is_dst = [&](NodeId u) { return s.seen(u) && s.at(u).target != 0; };
+  // Backward DFS from the destinations, postorder (every node after all of its parents), over
+  // the entries (u, e) that `keep` accepts and whose parent is not a destination.
+  s.order.clear();
+  for (NodeId d : destinations) {
+    if (s.at(d).state != 0) continue;
+    s.at(d).state = 1;
+    s.stack.clear();
+    s.stack.emplace_back(d, s.at(d).entry_begin);
+    while (!s.stack.empty()) {
+      const auto [v, k] = s.stack.back();
+      if (k < s.at(v).entry_end) {
+        s.stack.back().second = k + 1;
+        const auto ki = static_cast<std::size_t>(k);
+        const NodeId u = parents[ki];
+        if (is_dst(u) || !keep(via[ki])) continue;
+        if (!s.seen(u)) s.touch(u);
+        const auto su = s.at(u).state;
+        if (su == 0) {
+          s.at(u).state = 1;
+          s.stack.emplace_back(u, s.at(u).entry_begin);
+        } else if (su == 1) {
+          throw std::logic_error("kernel plan: the route is cyclic");
+        }
+      } else {
+        s.at(v).state = 2;
+        s.order.push_back(v);
+        s.stack.pop_back();
+      }
+    }
+  }
+  // Forward over the postorder, with the cost DP when asked.
+  const auto edge_cost = graph.edge_costs();
+  Cost best = kUnreachable;
+  for (NodeId r : roots) {
+    if (s.at(r).state == 2) {
+      s.at(r).fwd = 1;
+      s.at(r).dist = 0;
+    }
+  }
+  for (NodeId v : s.order) {
+    auto& nv = s.at(v);
+    if (nv.root == 0) {
+      Cost dv = kUnreachable;
+      bool reached = false;
+      for (auto k = nv.entry_begin; k < nv.entry_end; ++k) {
+        const auto ki = static_cast<std::size_t>(k);
+        const NodeId u = parents[ki];
+        if (!s.seen(u)) continue;
+        const auto& nu = s.at(u);
+        if (nu.fwd == 0 || nu.target != 0 || !keep(via[ki])) continue;
+        reached = true;
+        if (cost == nullptr) break;
+        dv = std::min(dv, nu.dist + edge_cost[static_cast<std::size_t>(via[ki])]);
+      }
+      if (!reached) continue;
+      nv.fwd = 1;
+      nv.dist = dv;
+    }
+    if (cost != nullptr && nv.fwd != 0 && nv.target != 0) best = std::min(best, nv.dist);
+  }
+  if (cost != nullptr) *cost = best;
+  if (out == nullptr) return;
+  PreparedRoute& plan = *out;
+  plan.forwarding_edges.clear();
+  // Members, ascending: the DAG's edges kept, from a reached tail (not a destination) to a head
+  // that reaches a destination.
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  // Size vectors to known bounds (DAG edges here, reached nodes below), then write by index
+  // to avoid push_back overhead in these loops.
+  const auto asc = PredecessorDAGBuilder::ascending(dag);
+  const std::size_t bound = asc.size();
+  plan.forwarding_edges.resize(bound);
+  s.member_tail.resize(bound);
+  s.member_head.resize(bound);
+  std::size_t n_members = 0;
+  for (EdgeId e : asc) {
+    const auto ei = static_cast<std::size_t>(e);
+    const NodeId u = edge_sources[ei];
+    const NodeId v = edge_destinations[ei];
+    if (!s.seen(u) || s.at(u).fwd == 0 || s.at(u).target != 0) continue;
+    if (!s.seen(v) || s.at(v).state != 2 || !keep(e)) continue;
+    plan.forwarding_edges[n_members] = e;
+    s.member_tail[n_members] = u;
+    s.member_head[n_members] = v;
+    ++n_members;
+  }
+  plan.forwarding_edges.resize(n_members);
+  s.member_tail.resize(n_members);
+  s.member_head.resize(n_members);
+  const std::size_t num_members = n_members;
+  if (num_members == 0) {
+    (void)plan.layout(roots, destinations, 0, 0);  // every root without a member
+    return;
+  }
+  std::int32_t num_pos = 0;
+  for (NodeId v : s.order) {
+    if (s.at(v).fwd != 0) s.at(v).position = num_pos++;
+  }
+  for (std::size_t m = 0; m < num_members; ++m) {
+    auto& nt = s.at(s.member_tail[m]);
+    if (nt.count == 0) {
+      nt.first = static_cast<std::int32_t>(m);
+    } else if (static_cast<std::size_t>(nt.first + nt.count) != m) {
+      throw std::logic_error("kernel plan: the members of a node are not consecutive (member EdgeIds not grouped by source node)");
+    }
+    ++nt.count;
+  }
+  const auto P = static_cast<std::size_t>(num_pos);
+  const PreparedRoute::Layout w = plan.layout(roots, destinations, P, num_members);
+  std::size_t pos = 0;
+  for (NodeId v : s.order) {
+    const auto& nv = s.at(v);
+    if (nv.fwd == 0) continue;
+    w.topological_order[pos] = v;
+    w.is_destination[pos] = nv.target;
+    const std::int32_t b = nv.count == 0 ? 0 : nv.first;
+    w.outgoing_begin[pos] = b;
+    w.outgoing_end[pos] = b + nv.count;
+    ++pos;
+  }
+  // Positions follow the postorder (every node after its parents; the DFS rejected cycles), so a
+  // member's tail precedes its head.
+  for (std::size_t m = 0; m < num_members; ++m) w.edge_destination_positions[m] = s.at(s.member_head[m]).position;
+  // A root with a member has a position (it reaches a destination and is reached); a root
+  // without one keeps -1.
+  for (std::size_t i = 0; i < roots.size(); ++i) {
+    const auto& nr = s.at(roots[i]);
+    if (nr.fwd != 0 && nr.target == 0) w.source_positions[i] = nr.position;
+  }
+}
+
+} // namespace
+
+std::vector<EdgeId> prune(const Graph& graph, const PredecessorDAG& dag, NodeId source, std::span<const NodeId> destinations,
+                          const Eligibility* eligibility) {
+  PreparedRoute plan;
+  build_split(graph, dag, {&source, 1}, destinations, [&](EdgeId e) { return eligibility == nullptr || eligibility->allows_edge(e); }, &plan, nullptr);
+  return std::move(plan.forwarding_edges);
+}
+
+Cost min_route_cost(const Graph& graph, const PredecessorDAG& route, NodeId source, std::span<const NodeId> destinations) {
+  Cost cost = kUnreachable;
+  build_split(graph, route, {&source, 1}, destinations, [](EdgeId) { return true; }, nullptr, &cost);
+  return cost;
+}
+
+namespace {
+
+PreparedRoute plan_of(const Graph& graph, RouteAllocation allocation, Admission admission, const WeightSource& weights,
+                   std::span<const NodeId> roots, std::span<const NodeId> destinations, const PredecessorDAG& route, Cost* cost) {
+  check_kernel(allocation, admission);
+  const auto edges = PredecessorDAGBuilder::ascending(route);
+  const bool weighted = allocation == RouteAllocation::Weighted;
+  const bool by_view = weighted && weights.basis == WeightBasis::ResidualSnapshot;
+  if (by_view && weights.values.size() != edges.size()) {
+    throw std::logic_error("prepare_route: the creation view is not route-aligned");
+  }
+  if (weighted && weights.basis == WeightBasis::Explicit &&
+      weights.values.size() != static_cast<std::size_t>(graph.num_edges())) {
+    throw std::logic_error("prepare_route: the explicit weights are not edge-aligned");
+  }
+  const auto capacity = graph.edge_capacity_units();
+  PreparedRoute plan;
+  plan.allocation = allocation;
+  plan.support_edges.assign(edges.begin(), edges.end());
+  // A route edge's Weighted weight: its static capacity, its explicit weight (0 on an edge of
+  // capacity 0) or its creation view (the route ascends: a binary search).
+  auto weight = [&](EdgeId e) -> Amount {
+    const auto ei = static_cast<std::size_t>(e);
+    switch (weights.basis) {
+      case WeightBasis::Capacity: return capacity[ei];
+      case WeightBasis::Explicit: return capacity[ei] >= 1 ? weights.values[ei] : 0;
+      case WeightBasis::ResidualSnapshot:
+        return weights.values[static_cast<std::size_t>(std::lower_bound(edges.begin(), edges.end(), e) - edges.begin())];
+    }
+    return 0;
+  };
+  // Membership: Optimized and Equal every route edge (an edge of capacity 0 is a member
+  // that carries nothing), Weighted the edges of positive weight.
+  auto member = [&](EdgeId e) { return !weighted || weight(e) >= 1; };
+  build_split(graph, route, roots, destinations, member, &plan, cost);
+  // The route's cost is the members' only when every route edge is a member.
+  if (cost != nullptr && plan.forwarding_edges.size() != plan.support_edges.size()) *cost = min_route_cost(graph, route, roots[0], destinations);
+  if (weighted) {
+    plan.weights.reserve(plan.forwarding_edges.size());
+    for (EdgeId e : plan.forwarding_edges) plan.weights.push_back(weight(e));
+  }
+  return plan;
+}
+
+} // namespace
+
+PreparedRoute prepare_route(const Graph& graph, RouteAllocation allocation, Admission admission, const WeightSource& weights,
+                     NodeId source, std::span<const NodeId> destinations, const PredecessorDAG& route, Cost* cost) {
+  return plan_of(graph, allocation, admission, weights, {&source, 1}, destinations, route, cost);
+}
+
+PreparedRoute prepare_route(const Graph& graph, RouteAllocation allocation, Admission admission, const WeightSource& weights,
+                     std::span<const NodeId> roots, std::span<const NodeId> destinations, const PredecessorDAG& route) {
+  return plan_of(graph, allocation, admission, weights, roots, destinations, route, nullptr);
+}
+
+PreparedRoute prepare_supplied_route(const Graph& graph, RouteAllocation allocation, WeightBasis basis, std::span<const Amount> edge_values,
+                           NodeId source, std::span<const NodeId> destinations, const PredecessorDAG& dag, Cost* cost) {
+  check_kernel(allocation, Admission::Lossless);
+  const auto capacity = graph.edge_capacity_units();
+  PreparedRoute plan;
+  plan.allocation = allocation;
+  build_split(graph, dag, {&source, 1}, destinations, [](EdgeId) { return true; }, &plan, cost);
+  plan.support_edges = plan.forwarding_edges;
+  if (allocation != RouteAllocation::Weighted) return plan;
+  auto weight = [&](EdgeId e) -> Amount {
+    const auto ei = static_cast<std::size_t>(e);
+    switch (basis) {
+      case WeightBasis::Capacity: return capacity[ei];
+      case WeightBasis::Explicit: return capacity[ei] >= 1 ? edge_values[ei] : 0;
+      case WeightBasis::ResidualSnapshot: return edge_values[ei];
+    }
+    return 0;
+  };
+  // When every route edge has a positive weight the members are the route itself; otherwise a
+  // second pass keeps the walks over the positive ones (the route and its cost stay).
+  if (std::all_of(plan.support_edges.begin(), plan.support_edges.end(), [&](EdgeId e) { return weight(e) >= 1; })) {
+    plan.weights.reserve(plan.forwarding_edges.size());
+    for (EdgeId e : plan.forwarding_edges) plan.weights.push_back(weight(e));
+    return plan;
+  }
+  PreparedRoute weighted;
+  build_split(graph, dag, {&source, 1}, destinations, [&](EdgeId e) { return weight(e) >= 1; }, &weighted, nullptr);
+  weighted.allocation = allocation;
+  weighted.support_edges = std::move(plan.support_edges);
+  weighted.weights.reserve(weighted.forwarding_edges.size());
+  for (EdgeId e : weighted.forwarding_edges) weighted.weights.push_back(weight(e));
+  return weighted;
+}
+
+PreparedRoute restrict_prepared_route(const Graph& graph, const PreparedRoute& plan, std::span<const NodeId> roots,
+                         std::span<const NodeId> destinations, const Eligibility* eligibility) {
+  PreparedRoute out;
+  out.allocation = plan.allocation;
+  const PredecessorDAG members = PredecessorDAGBuilder::of_edges(graph, plan.forwarding_edges);
+  build_split(graph, members, roots, destinations, [&](EdgeId e) { return eligibility == nullptr || eligibility->allows_edge(e); }, &out, nullptr);
+  out.support_edges = plan.support_edges;
+  if (plan.allocation == RouteAllocation::Weighted) {
+    // The kept members' frozen weights (both member lists ascend).
+    out.weights.resize(out.forwarding_edges.size());
+    std::size_t k = 0;
+    for (std::size_t m = 0; m < out.forwarding_edges.size(); ++m) {
+      while (plan.forwarding_edges[k] != out.forwarding_edges[m]) ++k;
+      out.weights[m] = plan.weights[k];
+    }
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- ShortestPaths creation
+
+namespace {
+
+// Per-thread state of prepare_shortest_paths. Per node (by NodeId) a slot valid only under the
+// current epoch (DagScratch's pattern: nothing is cleared between calls except on stamp
+// wraparound, a call that throws leaves stale slots behind an old epoch, and the one array of
+// slots grows whole or not at all); every other buffer is indexed by the reached nodes' local
+// indices (their rank in ascending NodeId) or by route position, and is rewritten before it is
+// read.
+struct CreationScratch {
+  struct Node {
+    std::uint32_t stamp {0};
+    std::uint8_t reached {0};
+    std::uint8_t target {0};
+    std::int32_t local {0};  // rank among the reached nodes (ascending NodeId)
+    std::int32_t lo {0};     // the node's support out-edges: support[lo, hi)
+    std::int32_t hi {0};
+  };
+  std::uint32_t generation {0};
+  std::vector<Node> node;
+  std::vector<NodeId> reached;  // the walk's nodes (its queue), then ascending
+  std::vector<EdgeId> route;                               // ascending
+  std::vector<std::int32_t> tail;                          // per route edge: its tail's local index
+  std::vector<std::int32_t> head;                          // per route edge: its head's local index
+  std::vector<std::int32_t> parent;                        // per entry: its parent's local index
+  std::vector<std::int32_t> entry;                         // per local node + 1: its entries (by child)
+  std::vector<std::int32_t> fill;
+  std::vector<EdgeId> via;                                 // the entries: by child, ascending via
+  std::vector<std::uint8_t> state;                         // per local node: DFS 1 open, 2 done
+  std::vector<std::pair<std::int32_t, std::int32_t>> dfs;  // (local node, next entry)
+  std::vector<std::int32_t> order;                         // local nodes, every one after its parents
+  std::vector<std::int32_t> position;                      // per local node
+  std::vector<std::int32_t> first;                         // per local node: its first member
+  std::vector<std::int32_t> count;                         // per local node: its number of members
+  std::vector<Cost> dist;                                  // per local node
+
+  void begin(std::size_t n) {
+    if (node.size() < n) node.resize(n);  // strong guarantee; new slots carry stamp 0
+    if (++generation == 0) {
+      for (auto& v : node) v.stamp = 0;
+      generation = 1;
+    }
+  }
+  Node& at(NodeId v) noexcept { return node[static_cast<std::size_t>(v)]; }
+  // The slot of v, reset on its first use in this call.
+  Node& touch(NodeId v) noexcept {
+    auto& x = at(v);
+    if (x.stamp != generation) {
+      x = Node {};
+      x.stamp = generation;
+    }
+    return x;
+  }
+};
+
+CreationScratch& creation_scratch() {
+  thread_local CreationScratch s;
+  return s;
+}
+
+} // namespace
+
+std::size_t lower_bound_from(std::span<const EdgeId> a, std::size_t hint, EdgeId x) noexcept {
+  const std::size_t n = a.size();
+  std::size_t lo = 0;
+  std::size_t hi = 0;
+  if (hint < n && a[hint] < x) {
+    // The answer lies in (hint, n]: a[lo - 1] < x throughout.
+    lo = hint + 1;
+    hi = lo;
+    for (std::size_t step = 1; hi < n && a[hi] < x; step <<= 1) {
+      lo = hi + 1;
+      hi = lo + step;
+    }
+    hi = std::min(hi, n);
+  } else {
+    // The answer lies in [0, min(hint, n)] (hint >= n, or a[hint] >= x): a[hi] >= x or hi == n
+    // throughout.
+    hi = std::min(hint, n);
+    for (std::size_t step = 1;; step <<= 1) {
+      if (hi < step) {
+        lo = 0;
+        break;
+      }
+      const std::size_t probe = hi - step;
+      if (a[probe] < x) {
+        lo = probe + 1;
+        break;
+      }
+      hi = probe;
+    }
+  }
+  return static_cast<std::size_t>(std::lower_bound(a.begin() + static_cast<std::ptrdiff_t>(lo),
+                                                   a.begin() + static_cast<std::ptrdiff_t>(hi), x) -
+                                  a.begin());
+}
+
+std::optional<PreparedRouteResult> prepare_shortest_paths(const Graph& graph, const std::shared_ptr<const PredecessorDAG>& support,
+                                                   NodeId source, std::span<const NodeId> destinations,
+                                                   const RouteChoice& choice, PriorityReader view,
+                                                   RouteAllocation allocation, Admission admission,
+                                                   const WeightSource& weights) {
+  const bool weighted = allocation == RouteAllocation::Weighted;
+  if (choice.single_path() || (weighted && weights.basis == WeightBasis::ResidualSnapshot)) return std::nullopt;
+  check_kernel(allocation, admission);
+  // A Weighted route edge's weight (static membership: Capacity or Explicit).
+  auto weight = [&](EdgeId e) -> Amount {
+    const auto ei = static_cast<std::size_t>(e);
+    const Amount cap = graph.edge_capacity_units()[ei];
+    if (weights.basis == WeightBasis::Explicit) return cap >= 1 ? weights.values[ei] : 0;
+    return cap;
+  };
+  const auto sup = PredecessorDAGBuilder::ascending(*support);
+  const auto row = graph.outgoing_offsets();
+  const auto edst = graph.edge_destinations();
+  const auto edge_cost = graph.edge_costs();
+  CreationScratch& s = creation_scratch();
+  s.begin(static_cast<std::size_t>(graph.num_nodes()));
+  for (NodeId d : destinations) s.touch(d).target = 1;
+  // support_route's walk over the support from source: every reached node keeps its support
+  // out-edges as one range (EdgeIds rank edges by source first: one tail's edges are consecutive).
+  s.reached.clear();
+  s.touch(source).reached = 1;
+  s.reached.push_back(source);
+  bool any_target = false;
+  std::size_t m = 0;
+  std::size_t hint = 0;
+  for (std::size_t q = 0; q < s.reached.size(); ++q) {  // the reached list is the walk's queue
+    const NodeId u = s.reached[q];
+    const auto ui = static_cast<std::size_t>(u);
+    const std::size_t lo = lower_bound_from(sup, hint, row[ui]);
+    std::size_t hi = lo;
+    for (; hi < sup.size() && sup[hi] < row[ui + 1]; ++hi) {
+      const NodeId v = edst[static_cast<std::size_t>(sup[hi])];
+      auto& nv = s.touch(v);
+      if (nv.reached != 0) continue;
+      nv.reached = 1;
+      s.reached.push_back(v);
+    }
+    auto& nu = s.at(u);
+    any_target = any_target || nu.target != 0;
+    nu.lo = static_cast<std::int32_t>(lo);
+    nu.hi = static_cast<std::int32_t>(hi);
+    m += hi - lo;
+    hint = lo;
+  }
+  if (!any_target || m == 0) return std::nullopt;
+  // The route in ascending EdgeId: the reached nodes' ranges in ascending NodeId (ascending in the
+  // support, checked), each with Collapse when parallel_edges is false (support_route's: one member per
+  // (u, v) by replaces() on the view), every route edge with its tail's local index. A
+  // destination with route edges, or a route edge that is no member candidate, means build_split
+  // would not keep the whole route: the caller's path then runs.
+  std::sort(s.reached.begin(), s.reached.end());
+  const std::size_t r = s.reached.size();
+  for (std::size_t i = 0; i < r; ++i) s.at(s.reached[i]).local = static_cast<std::int32_t>(i);
+  s.route.resize(m);
+  s.tail.resize(m);
+  s.first.resize(r);
+  s.count.resize(r);
+  const bool collapse = !choice.parallel_edges;
+  const bool prefer = choice.prefers_score();
+  std::size_t w = 0;
+  std::int32_t prev_hi = 0;
+  for (std::size_t i = 0; i < r; ++i) {
+    const auto& nu = s.at(s.reached[i]);
+    s.first[i] = static_cast<std::int32_t>(w);
+    if (nu.hi > nu.lo) {
+      if (nu.lo < prev_hi || nu.target != 0) return std::nullopt;
+      prev_hi = nu.hi;
+    }
+    for (auto k = nu.lo; k < nu.hi;) {
+      EdgeId best = sup[static_cast<std::size_t>(k)];
+      auto j = k + 1;
+      if (collapse) {
+        const NodeId v = edst[static_cast<std::size_t>(best)];
+        for (; j < nu.hi && edst[static_cast<std::size_t>(sup[static_cast<std::size_t>(j)])] == v; ++j) {
+          if (replaces(graph, sup[static_cast<std::size_t>(j)], best, prefer, view)) best = sup[static_cast<std::size_t>(j)];
+        }
+      }
+      if (weighted && weight(best) < 1) return std::nullopt;
+      s.route[w] = best;
+      s.tail[w] = static_cast<std::int32_t>(i);
+      ++w;
+      k = j;
+    }
+    s.count[i] = static_cast<std::int32_t>(w) - s.first[i];
+  }
+  const std::span<const EdgeId> route(s.route.data(), w);
+  // The entries grouped by child (ascending NodeId), ascending via within a child: a counting pass
+  // over the heads' local indices, the route scattered in ascending order with each entry's parent.
+  s.head.resize(w);
+  s.entry.assign(r + 1, 0);
+  for (std::size_t k = 0; k < w; ++k) {
+    const auto h = s.at(edst[static_cast<std::size_t>(route[k])]).local;
+    s.head[k] = h;
+    ++s.entry[static_cast<std::size_t>(h) + 1];
+  }
+  std::size_t children = 0;
+  for (std::size_t i = 0; i < r; ++i) {
+    if (s.entry[i + 1] != 0) ++children;
+    s.entry[i + 1] += s.entry[i];
+  }
+  s.fill.assign(s.entry.begin(), s.entry.end() - 1);
+  s.via.resize(w);
+  s.parent.resize(w);
+  for (std::size_t k = 0; k < w; ++k) {
+    const auto at = static_cast<std::size_t>(s.fill[static_cast<std::size_t>(s.head[k])]++);
+    s.via[at] = route[k];
+    s.parent[at] = s.tail[k];
+  }
+  // build_split's order: a backward DFS from the destinations, in their order, over the entries,
+  // listing every node after its parents (postorder). A destination the walk did not reach has no
+  // entry and no position there, so it is skipped.
+  s.state.assign(r, 0);
+  s.order.clear();
+  for (NodeId d : destinations) {
+    const auto& nd = s.at(d);
+    if (nd.reached == 0) continue;
+    const auto di = nd.local;
+    if (s.state[static_cast<std::size_t>(di)] != 0) continue;
+    s.state[static_cast<std::size_t>(di)] = 1;
+    s.dfs.clear();
+    s.dfs.emplace_back(di, s.entry[static_cast<std::size_t>(di)]);
+    while (!s.dfs.empty()) {
+      const auto [v, k] = s.dfs.back();
+      if (k < s.entry[static_cast<std::size_t>(v) + 1]) {
+        s.dfs.back().second = k + 1;
+        const auto u = s.parent[static_cast<std::size_t>(k)];
+        const auto su = s.state[static_cast<std::size_t>(u)];
+        if (su == 0) {
+          s.state[static_cast<std::size_t>(u)] = 1;
+          s.dfs.emplace_back(u, s.entry[static_cast<std::size_t>(u)]);
+        } else if (su == 1) {
+          return std::nullopt;  // a cycle (build_split throws)
+        }
+      } else {
+        s.state[static_cast<std::size_t>(v)] = 2;
+        s.order.push_back(v);
+        s.dfs.pop_back();
+      }
+    }
+  }
+  const auto src_local = s.at(source).local;
+  if (s.order.size() != r || s.order.front() != src_local) return std::nullopt;
+  s.position.resize(r);
+  for (std::size_t p = 0; p < r; ++p) s.position[static_cast<std::size_t>(s.order[p])] = static_cast<std::int32_t>(p);
+  // prepare_route's cost: the minimum walk cost from source to a destination over the members, by the
+  // order (every member is a route edge, so min_route_cost is not called).
+  s.dist.resize(r);
+  Cost best = kUnreachable;
+  for (const auto v : s.order) {
+    const auto vi = static_cast<std::size_t>(v);
+    Cost dv = 0;
+    if (v != src_local) {
+      dv = kUnreachable;
+      for (auto k = s.entry[vi]; k < s.entry[vi + 1]; ++k) {
+        const auto ki = static_cast<std::size_t>(k);
+        dv = std::min(dv, s.dist[static_cast<std::size_t>(s.parent[ki])] + edge_cost[static_cast<std::size_t>(s.via[ki])]);
+      }
+    }
+    s.dist[vi] = dv;
+    if (s.at(s.reached[vi]).target != 0) best = std::min(best, dv);
+  }
+  PreparedRouteResult out;
+  out.min_route_cost = best;
+  PreparedRoute& plan = out.prepared_route;
+  plan.allocation = allocation;
+  plan.support_edges.assign(route.begin(), route.end());
+  plan.forwarding_edges.assign(route.begin(), route.end());
+  if (weighted) {
+    plan.weights.resize(route.size());
+    for (std::size_t k = 0; k < route.size(); ++k) plan.weights[k] = weight(route[k]);
+  }
+  const PreparedRoute::Layout lay = plan.layout({&source, 1}, destinations, r, route.size());
+  lay.source_positions[0] = 0;  // source comes first in the order
+  for (std::size_t p = 0; p < r; ++p) {
+    const auto v = static_cast<std::size_t>(s.order[p]);
+    const NodeId x = s.reached[v];
+    lay.topological_order[p] = x;
+    lay.is_destination[p] = s.at(x).target;
+    const std::int32_t b = s.count[v] == 0 ? 0 : s.first[v];
+    lay.outgoing_begin[p] = b;
+    lay.outgoing_end[p] = b + s.count[v];
+  }
+  for (std::size_t k = 0; k < route.size(); ++k) lay.edge_destination_positions[k] = s.position[static_cast<std::size_t>(s.head[k])];
+  // The record route: the support itself when the route is all of it (record_route_of's share).
+  if (route.size() == sup.size()) {
+    out.route = support;
+  } else {
+    std::vector<NodeId> nodes(children);
+    std::vector<std::int32_t> offsets(children + 1);
+    offsets[0] = 0;
+    for (std::size_t i = 0, c = 0; i < r; ++i) {
+      if (s.entry[i + 1] == s.entry[i]) continue;
+      nodes[c] = s.reached[i];
+      offsets[++c] = s.entry[i + 1];
+    }
+    std::vector<EdgeId> via(s.via.begin(), s.via.begin() + static_cast<std::ptrdiff_t>(w));
+    std::vector<NodeId> parents(w);
+    for (std::size_t k = 0; k < w; ++k) parents[k] = s.reached[static_cast<std::size_t>(s.parent[k])];
+    std::vector<EdgeId> asc(route.begin(), route.end());
+    out.route = std::make_shared<const PredecessorDAG>(PredecessorDAGBuilder::of_parts(
+        graph, std::move(nodes), std::move(offsets), std::move(parents), std::move(via), std::move(asc)));
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- allocation
+
+namespace {
+
+// The view summed over the roots' out-members, and at most the number of roots before the first
+// root without a member: no larger total fits (that root would receive a share with no route).
+Amount total_bound(const PreparedRoute& plan, std::span<const Amount> view_m) {
+  Amount hi = 0;
+  for (std::size_t i = 0; i < plan.sources.size(); ++i) {
+    const auto p = plan.source_positions[i];
+    if (p < 0) return std::min(hi, static_cast<Amount>(i));
+    for (auto m = plan.outgoing_begin[static_cast<std::size_t>(p)]; m < plan.outgoing_end[static_cast<std::size_t>(p)]; ++m) {
+      hi += view_m[static_cast<std::size_t>(m)];
+    }
+  }
+  return hi;
+}
+
+} // namespace
+
+bool allocate(const PreparedRoute& plan, Amount total, std::span<Amount> out, std::span<const Amount> limit) {
+  std::fill(out.begin(), out.end(), 0);
+  if (total == 0) return true;
+  const bool weighted = plan.allocation == RouteAllocation::Weighted;
+  const bool limited = !limit.empty();
+  thread_local std::vector<Amount> inflow;
+  inflow.assign(plan.topological_order.size(), 0);
+  // The roots' round-robin shares (only the positive ones are visited). A positive share of a
+  // root without a member has no route; every caller stays at or below total_bound, which no such
+  // share reaches.
+  bool routed = true;
+  round_robin(total, plan.sources.size(), [&](std::size_t i, Amount x) {
+    const auto p = plan.source_positions[i];
+    if (p < 0) {
+      routed = false;
+      return false;
+    }
+    inflow[static_cast<std::size_t>(p)] += x;
+    return true;
+  });
+  if (!routed) throw std::logic_error("allocate: a root without a member receives a share");
+  for (std::size_t p = 0; p < plan.topological_order.size(); ++p) {
+    const Amount amount = inflow[p];
+    if (amount == 0 || plan.is_destination[p] != 0) continue;
+    const auto b = static_cast<std::size_t>(plan.outgoing_begin[p]);
+    const auto e = static_cast<std::size_t>(plan.outgoing_end[p]);
+    const std::size_t k = e - b;
+    if (weighted) {
+      highest_averages(amount, std::span<const Amount>(plan.weights.data() + b, k), out.subspan(b, k));
+      for (std::size_t m = b; m < e; ++m) {
+        const Amount x = out[m];
+        if (limited && x > limit[m]) return false;
+        inflow[static_cast<std::size_t>(plan.edge_destination_positions[m])] += x;
+      }
+    } else {
+      // Only the members with a positive share are written and visited (the rest stay 0).
+      bool fits = true;
+      round_robin(amount, k, [&](std::size_t i, Amount x) {
+        const std::size_t m = b + i;
+        if (limited && x > limit[m]) {
+          fits = false;
+          return false;
+        }
+        out[m] = x;
+        inflow[static_cast<std::size_t>(plan.edge_destination_positions[m])] += x;
+        return true;
+      });
+      if (!fits) return false;
+    }
+  }
+  return true;
+}
+
+namespace {
+
+// A floating-point estimate of T_max: the fraction f of the total that each member carries
+// under the plan's split (1/H at each of H roots, 1/k per round-robin member, w/W per Weighted
+// member), then min over members of view / f. It only chooses the first probe of the exact
+// search below (approximate arithmetic may choose probes, nothing else).
+double estimate_max_lossless_offer(const PreparedRoute& plan, std::span<const Amount> view_m) {
+  thread_local std::vector<double> f;
+  f.assign(plan.topological_order.size(), 0.0);
+  for (auto p : plan.source_positions) {
+    if (p >= 0) f[static_cast<std::size_t>(p)] += 1.0 / static_cast<double>(plan.sources.size());
+  }
+  const bool weighted = plan.allocation == RouteAllocation::Weighted;
+  double best = std::numeric_limits<double>::infinity();
+  for (std::size_t p = 0; p < plan.topological_order.size(); ++p) {
+    if (f[p] == 0.0 || plan.is_destination[p] != 0) continue;
+    const auto b = static_cast<std::size_t>(plan.outgoing_begin[p]);
+    const auto e = static_cast<std::size_t>(plan.outgoing_end[p]);
+    double wsum = 0.0;
+    if (weighted) {
+      for (std::size_t m = b; m < e; ++m) wsum += static_cast<double>(plan.weights[m]);
+    }
+    for (std::size_t m = b; m < e; ++m) {
+      const double share = weighted ? f[p] * static_cast<double>(plan.weights[m]) / wsum
+                                    : f[p] / static_cast<double>(e - b);
+      if (share <= 0.0) continue;
+      best = std::min(best, static_cast<double>(view_m[m]) / share);
+      f[static_cast<std::size_t>(plan.edge_destination_positions[m])] += share;
+    }
+  }
+  return best;
+}
+
+constexpr std::int32_t kProbeBudget = 62;  // a plain bisection over units below 2^62
+
+// Find the largest fitting T in [lo, hi): alloc(lo) fits view_m; alloc(hi) does not.
+// Fit checks compare integer amounts per member exactly. Increasing T never reduces a
+// member's allocation, so these bounds remain valid regardless of probe choices.
+// First try a floating-point estimate, then double step sizes to narrow the bounds, then
+// bisect. Only probe choice is approximate; bounds always come from exact checks or the given
+// ends. Allow an estimate or doubling probe only if it and the worst-case remaining bisection
+// fit within kProbeBudget = 62, counting probes already made. Check the budget on return.
+// Swap each fitting allocation into `best` when supplied; on return it holds alloc(result)
+// whenever result is greater than the original lo.
+Amount largest_fit(const PreparedRoute& plan, std::span<const Amount> view_m, Amount lo, Amount hi,
+                   std::vector<Amount>& probe, std::vector<Amount>* best, std::int32_t& probes) {
+  auto fits = [&](Amount t) {
+    ++probes;
+    if (!allocate(plan, t, probe, view_m)) return false;
+    if (best != nullptr) std::swap(probe, *best);
+    return true;
+  };
+  auto bisection_steps = [](Amount a, Amount b) {  // probes a plain bisection of (a, b) needs
+    return static_cast<std::int32_t>(std::bit_width(static_cast<std::uint64_t>(b - a - 1)));
+  };
+  const std::int32_t start = probes;
+  auto spare = [&](Amount a, Amount b) { return kProbeBudget - (probes - start) - bisection_steps(a, b) - 1; };
+  if (hi - lo > 2 && spare(lo, hi) >= 0) {
+    const double est = estimate_max_lossless_offer(plan, view_m);
+    Amount t = lo + 1;
+    if (est > static_cast<double>(lo) + 1.0) {
+      t = est >= static_cast<double>(hi) - 1.0 ? hi - 1 : static_cast<Amount>(est);
+    }
+    if (fits(t)) {
+      lo = t;
+      for (Amount step = 1; hi - lo > 1 && spare(lo, hi) >= 0; step *= 2) {
+        const Amount next = hi - lo > step ? lo + step : hi - 1;
+        if (fits(next)) {
+          lo = next;
+        } else {
+          hi = next;
+          break;
+        }
+      }
+    } else {
+      hi = t;
+      for (Amount step = 1; hi - lo > 1 && spare(lo, hi) >= 0; step *= 2) {
+        const Amount next = hi - lo > step ? hi - step : lo + 1;
+        if (fits(next)) {
+          lo = next;
+          break;
+        }
+        hi = next;
+      }
+    }
+  }
+  while (hi - lo > 1) {
+    const Amount mid = lo + (hi - lo) / 2;
+    if (fits(mid)) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  if (probes - start > kProbeBudget) {
+    throw std::logic_error("T_max search: " + std::to_string(probes - start) + " probes, above the bisection bound 62");
+  }
+  return lo;
+}
+
+std::vector<Amount>& probe_scratch(std::size_t size) {
+  thread_local std::vector<Amount> v;
+  v.resize(size);
+  return v;
+}
+
+} // namespace
+
+LosslessBound max_lossless_offer(const PreparedRoute& plan, std::span<const Amount> view_m) {
+  LosslessBound out;
+  if (plan.forwarding_edges.empty()) return out;
+  const Amount hi = total_bound(plan, view_m);
+  auto& probe = probe_scratch(plan.forwarding_edges.size());
+  // alloc(hi) fits only when every member can take it; else search below hi (the search's
+  // probes are counted, this one is not, like the target probe of a Lossless step).
+  if (allocate(plan, hi, probe, view_m)) {
+    out.value = hi;
+    return out;
+  }
+  out.value = largest_fit(plan, view_m, 0, hi, probe, nullptr, out.probes);
+  return out;
+}
+
+LosslessStep lossless_step(const PreparedRoute& plan, Amount total, std::span<const Amount> view_m,
+                           std::span<const Amount> own_m, std::optional<Amount> request) {
+  LosslessStep out;
+  if (plan.forwarding_edges.empty()) {
+    out.edge_flows.assign(own_m.begin(), own_m.end());
+    out.admitted = total;
+    return out;
+  }
+  const Amount hi = total_bound(plan, view_m);
+  const Amount target = request.has_value() ? std::min(total + *request, hi) : hi;
+  if (target <= total) {
+    out.admitted = total;
+    out.edge_flows.assign(own_m.begin(), own_m.end());
+    return out;
+  }
+  out.edge_flows.assign(plan.forwarding_edges.size(), 0);
+  if (allocate(plan, target, out.edge_flows, view_m)) {
+    out.admitted = target;
+    return out;
+  }
+  // T_max in [total, target - 1]: alloc(total) = own_m fits, alloc(target) does not. Every
+  // fitting probe leaves its allocation in out.edge_flows, so a result above total needs no further
+  // evaluation.
+  auto& probe = probe_scratch(plan.forwarding_edges.size());
+  const Amount lo = largest_fit(plan, view_m, total, target, probe, &out.edge_flows, out.probes);
+  out.admitted = lo;
+  if (lo == total) out.edge_flows.assign(own_m.begin(), own_m.end());
+  return out;
+}
+
+namespace {
+
+// The per-root bookkeeping of an attributed forwarding (per thread): each position's arrivals as
+// a list of (root, amount) entries, and a dense per-root accumulator with its touched roots.
+struct Arrivals {
+  std::vector<std::int32_t> arrival_list_heads;  // per position: its first entry, -1 none
+  std::vector<std::int32_t> source_indices;  // per entry
+  std::vector<Amount> amount;
+  std::vector<std::int32_t> next;
+  std::vector<Amount> source_totals;  // per root
+  std::vector<std::int32_t> touched;
+  std::vector<Amount> source_weights;  // per touched root
+  std::vector<Amount> row;
+  std::vector<Amount> arrive;
+  std::vector<Amount> keep;
+
+  void begin(std::size_t positions, std::size_t roots) {
+    arrival_list_heads.assign(positions, -1);
+    source_indices.clear();
+    amount.clear();
+    next.clear();
+    source_totals.assign(roots, 0);
+  }
+  void push(std::int32_t p, std::int32_t r, Amount x) {
+    source_indices.push_back(r);
+    amount.push_back(x);
+    next.push_back(arrival_list_heads[static_cast<std::size_t>(p)]);
+    arrival_list_heads[static_cast<std::size_t>(p)] = static_cast<std::int32_t>(source_indices.size()) - 1;
+  }
+  // The roots arriving at position p (plus `own`, a root injecting there, when >= 0) with their
+  // amounts in `acc`, in ascending root order.
+  void gather(std::int32_t p, std::int32_t own) {
+    touched.clear();
+    for (auto k = arrival_list_heads[static_cast<std::size_t>(p)]; k >= 0; k = next[static_cast<std::size_t>(k)]) {
+      const auto r = static_cast<std::size_t>(source_indices[static_cast<std::size_t>(k)]);
+      if (source_totals[r] == 0) touched.push_back(static_cast<std::int32_t>(r));
+      source_totals[r] += amount[static_cast<std::size_t>(k)];
+    }
+    if (own >= 0 && source_totals[static_cast<std::size_t>(own)] == 0) touched.push_back(own);
+    std::sort(touched.begin(), touched.end());
+  }
+  void clear_touched() {
+    for (auto r : touched) source_totals[static_cast<std::size_t>(r)] = 0;
+  }
+};
+
+Arrivals& arrivals_scratch() {
+  thread_local Arrivals a;
+  return a;
+}
+
+} // namespace
+
+namespace {
+
+// The forwarding, compiled with and without the attribution (kAttribute: attr is non-null), so the
+// one-source and Pinned calls carry none of its code.
+template <bool kAttribute>
+Forwarding forward_on(const PreparedRoute& plan, const Injection& in, std::span<const Amount> w_m, Attribution* attr) {
+  const std::size_t H = plan.sources.size();
+  const std::size_t P = plan.topological_order.size();
+  const bool capped = !w_m.empty();
+  if (!in.first_hop && in.per_root.size() != H) throw std::logic_error("forward: the injection is not root-aligned");
+  // The first-hop experiment reads the view of the roots' members (a program without a member
+  // injects nothing).
+  if (in.first_hop && !capped && !plan.forwarding_edges.empty()) {
+    throw std::logic_error("forward: the first-hop injection needs a view");
+  }
+  Forwarding out;
+  out.edge_flows.assign(plan.forwarding_edges.size(), 0);
+  out.edge_drops.assign(plan.forwarding_edges.size(), 0);
+  if constexpr (kAttribute) {
+    attr->offered.assign(H, 0);
+    attr->source_drops_by_source.assign(H, 0);
+    attr->delivered.assign(H, 0);
+    attr->entries.assign(H, {});
+  }
+  const bool weighted = plan.allocation == RouteAllocation::Weighted;
+  thread_local std::vector<Amount> inflow;
+  thread_local std::vector<Amount> part;
+  thread_local std::vector<std::int32_t> own_at;  // first hop: the root injecting at each position
+  inflow.assign(P, 0);
+  Arrivals& a = arrivals_scratch();
+  if constexpr (kAttribute) a.begin(P, H);
+  if (in.first_hop) own_at.assign(P, -1);
+  // The roots' injections: a root without a member loses its own (none in the first-hop
+  // experiment, where a root injects only on its members).
+  for (std::size_t i = 0; i < H; ++i) {
+    const auto p = plan.source_positions[i];
+    const auto ri = static_cast<std::int32_t>(i);
+    if (in.first_hop) {
+      if (p < 0) continue;
+      own_at[static_cast<std::size_t>(p)] = ri;
+      Amount x = 0;
+      for (auto m = plan.outgoing_begin[static_cast<std::size_t>(p)]; m < plan.outgoing_end[static_cast<std::size_t>(p)]; ++m) {
+        x += w_m[static_cast<std::size_t>(m)];
+      }
+      out.offered += x;
+      out.network_entered += x;
+      if constexpr (kAttribute) attr->offered[i] = x;
+      continue;
+    }
+    const Amount x = in.per_root[i];
+    out.offered += x;
+    if constexpr (kAttribute) attr->offered[i] = x;
+    if (x == 0) continue;
+    if (p < 0) {
+      out.source_drops += x;
+      if constexpr (kAttribute) attr->source_drops_by_source[i] = x;
+      continue;
+    }
+    out.network_entered += x;
+    inflow[static_cast<std::size_t>(p)] += x;
+    if constexpr (kAttribute) a.push(p, ri, x);
+  }
+  for (std::size_t p = 0; p < P; ++p) {
+    const auto pi = static_cast<std::int32_t>(p);
+    const std::int32_t own = in.first_hop ? own_at[p] : -1;
+    const Amount amount = inflow[p];
+    if (plan.is_destination[p] != 0) {
+      out.delivered += amount;
+      if (kAttribute && amount != 0) {
+        a.gather(pi, -1);
+        for (auto r : a.touched) attr->delivered[static_cast<std::size_t>(r)] += a.source_totals[static_cast<std::size_t>(r)];
+        a.clear_touched();
+      }
+      continue;
+    }
+    if (amount == 0 && own < 0) continue;
+    const auto b = static_cast<std::size_t>(plan.outgoing_begin[p]);
+    const auto e = static_cast<std::size_t>(plan.outgoing_end[p]);
+    const std::size_t k = e - b;
+    // The members with a share: round robin writes the first n (the rest receive nothing),
+    // highest averages all k; a root of the first-hop experiment injects on every member.
+    part.resize(k);
+    std::size_t n = 0;
+    if (amount != 0) {
+      if (weighted) {
+        highest_averages(amount, std::span<const Amount>(plan.weights.data() + b, k), part);
+        n = k;
+      } else {
+        n = round_robin(amount, part);
+      }
+    }
+    if (own >= 0) {
+      std::fill(part.begin() + static_cast<std::ptrdiff_t>(n), part.end(), Amount {0});
+      n = k;
+    }
+    if constexpr (kAttribute) {
+      a.gather(pi, own);
+      a.source_weights.resize(a.touched.size());
+      a.row.resize(a.touched.size());
+      a.arrive.resize(a.touched.size());
+      a.keep.resize(a.touched.size());
+    }
+    for (std::size_t i = 0; i < n; ++i) {
+      const std::size_t m = b + i;
+      const Amount mine = own >= 0 ? w_m[m] : 0;
+      const Amount x = part[i] + mine;
+      if (x == 0) continue;
+      const Amount c = capped ? std::min(x, w_m[m]) : x;
+      out.edge_flows[m] = c;
+      out.edge_drops[m] = x - c;
+      const auto head = plan.edge_destination_positions[m];
+      inflow[static_cast<std::size_t>(head)] += c;
+      if constexpr (!kAttribute) continue;
+      // The member's amount by highest averages over the remaining inflows (then the root's own
+      // first-hop injection on it), and what it carries by highest averages over those arrivals.
+      const std::size_t t = a.touched.size();
+      for (std::size_t j = 0; j < t; ++j) a.source_weights[j] = a.source_totals[static_cast<std::size_t>(a.touched[j])];
+      highest_averages(part[i], a.source_weights, a.row);
+      for (std::size_t j = 0; j < t; ++j) {
+        const auto r = a.touched[j];
+        a.source_totals[static_cast<std::size_t>(r)] -= a.row[j];
+        a.arrive[j] = a.row[j] + (r == own ? mine : 0);
+      }
+      if (c == x) {
+        std::copy(a.arrive.begin(), a.arrive.end(), a.keep.begin());
+      } else {
+        highest_averages(c, a.arrive, a.keep);
+      }
+      for (std::size_t j = 0; j < t; ++j) {
+        if (a.arrive[j] == 0) continue;
+        const auto r = a.touched[j];
+        attr->entries[static_cast<std::size_t>(r)].push_back(
+            Attribution::Entry {static_cast<std::int32_t>(m), a.keep[j], a.arrive[j] - a.keep[j]});
+        if (a.keep[j] != 0) a.push(head, r, a.keep[j]);
+      }
+    }
+    if constexpr (kAttribute) {
+      for (auto r : a.touched) {
+        if (a.source_totals[static_cast<std::size_t>(r)] != 0) {
+          throw std::logic_error("forward: a router's inflow is not fully attributed");
+        }
+      }
+    }
+  }
+  if (in.first_hop) out.offered = out.network_entered;
+  if constexpr (kAttribute) {
+    for (auto& rows : attr->entries) {
+      std::sort(rows.begin(), rows.end(), [](const auto& x, const auto& y) { return x.edge_position < y.edge_position; });
+    }
+  }
+  return out;
+}
+
+} // namespace
+
+Forwarding forward(const PreparedRoute& plan, const Injection& in, std::span<const Amount> w_m, Attribution* attr) {
+  return attr != nullptr ? forward_on<true>(plan, in, w_m, attr) : forward_on<false>(plan, in, w_m, attr);
+}
+
+} // namespace netgraph::core::detail
diff --git a/src/route_structures.cpp b/src/route_structures.cpp
new file mode 100644
index 0000000..89d1cb5
--- /dev/null
+++ b/src/route_structures.cpp
@@ -0,0 +1,370 @@
+/*
+  PredecessorDAG and Path: immutable, graph-bound route structures validated once at
+  construction, in the documented order, before any traversal.
+*/
+#include "netgraph/core/route_structures.hpp"
+
+#include <algorithm>
+#include <stdexcept>
+#include <string>
+
+#include "netgraph/core/detail/route_builders.hpp"
+
+namespace netgraph::core {
+
+namespace {
+
+std::string idx(std::size_t i) { return std::to_string(i); }
+
+} // namespace
+
+void detail::check_csr(const Graph& graph, std::span<const std::int32_t> offsets,
+                          std::span<const NodeId> parents, std::span<const EdgeId> via) {
+  const auto n = static_cast<std::size_t>(graph.num_nodes());
+  const auto m = static_cast<std::int64_t>(graph.num_edges());
+  // Shape: offsets of length N + 1, from 0, monotone, ending at len(parents) == len(via).
+  if (offsets.size() != n + 1) {
+    throw std::invalid_argument("PredecessorDAG.from_csr: parent_offsets has length " + idx(offsets.size()) + ", expected N + 1 = " +
+                                idx(n + 1));
+  }
+  if (offsets[0] != 0) {
+    throw std::invalid_argument("PredecessorDAG.from_csr: parent_offsets[0] = " + std::to_string(offsets[0]) + ", expected 0");
+  }
+  for (std::size_t v = 0; v < n; ++v) {
+    if (offsets[v + 1] < offsets[v]) {
+      throw std::invalid_argument("PredecessorDAG.from_csr: parent_offsets are not monotone at " + idx(v + 1) + " (" +
+                                  std::to_string(offsets[v]) + " > " + std::to_string(offsets[v + 1]) + ")");
+    }
+  }
+  const auto total = static_cast<std::size_t>(offsets[n]);
+  if (parents.size() != total || via.size() != total) {
+    throw std::invalid_argument("PredecessorDAG.from_csr: parent_offsets[N] = " + idx(total) + " but parents has " +
+                                idx(parents.size()) + " and via_edges has " + idx(via.size()) + " entries");
+  }
+  // Entries: ids in range, then each via joining (parent, child).
+  for (std::size_t k = 0; k < total; ++k) {
+    if (parents[k] < 0 || static_cast<std::size_t>(parents[k]) >= n) {
+      throw std::invalid_argument("PredecessorDAG.from_csr: parents[" + idx(k) + "] = " + std::to_string(parents[k]) +
+                                  " out of node range [0, " + idx(n) + ")");
+    }
+    if (via[k] < 0 || via[k] >= m) {
+      throw std::invalid_argument("PredecessorDAG.from_csr: via_edges[" + idx(k) + "] = " + std::to_string(via[k]) +
+                                  " out of edge range [0, " + std::to_string(m) + ")");
+    }
+  }
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  for (std::size_t v = 0; v < n; ++v) {
+    for (auto k = static_cast<std::size_t>(offsets[v]); k < static_cast<std::size_t>(offsets[v + 1]); ++k) {
+      const auto e = static_cast<std::size_t>(via[k]);
+      if (edge_sources[e] != parents[k] || static_cast<std::size_t>(edge_destinations[e]) != v) {
+        throw std::invalid_argument("PredecessorDAG.from_csr: entry " + idx(k) + " of node " + idx(v) + ": via edge " +
+                                    idx(e) + " joins (" + std::to_string(edge_sources[e]) + ", " +
+                                    std::to_string(edge_destinations[e]) + "), not (" + std::to_string(parents[k]) + ", " +
+                                    idx(v) + ")");
+      }
+    }
+  }
+  // No duplicate (child, via): an edge has one child, so a duplicate is a repeated via.
+  {
+    std::vector<std::uint8_t> seen(static_cast<std::size_t>(m), 0);
+    for (std::size_t k = 0; k < total; ++k) {
+      const auto e = static_cast<std::size_t>(via[k]);
+      if (seen[e] != 0) {
+        throw std::invalid_argument("PredecessorDAG.from_csr: duplicate entry (child " + std::to_string(edge_destinations[e]) +
+                                    ", via " + idx(e) + ")");
+      }
+      seen[e] = 1;
+    }
+  }
+  // Repeatedly remove nodes with no remaining predecessors, with their outgoing entries
+  // (Kahn's algorithm). Entries left over mean a cycle; a self-loop is one.
+  {
+    std::vector<std::int32_t> out_count(n + 1, 0);
+    std::vector<std::int32_t> indeg(n, 0);
+    for (std::size_t v = 0; v < n; ++v) {
+      indeg[v] = offsets[v + 1] - offsets[v];
+      for (auto k = static_cast<std::size_t>(offsets[v]); k < static_cast<std::size_t>(offsets[v + 1]); ++k) {
+        ++out_count[static_cast<std::size_t>(parents[k]) + 1];
+      }
+    }
+    for (std::size_t v = 0; v < n; ++v) out_count[v + 1] += out_count[v];
+    std::vector<std::int32_t> children(total);
+    std::vector<std::int32_t> pos(out_count.begin(), out_count.end() - 1);
+    for (std::size_t v = 0; v < n; ++v) {
+      for (auto k = static_cast<std::size_t>(offsets[v]); k < static_cast<std::size_t>(offsets[v + 1]); ++k) {
+        children[static_cast<std::size_t>(pos[static_cast<std::size_t>(parents[k])]++)] = static_cast<std::int32_t>(v);
+      }
+    }
+    std::vector<std::int32_t> ready;
+    for (std::size_t v = 0; v < n; ++v) {
+      if (indeg[v] == 0) ready.push_back(static_cast<std::int32_t>(v));
+    }
+    std::size_t done = 0;
+    while (!ready.empty()) {
+      const auto u = static_cast<std::size_t>(ready.back());
+      ready.pop_back();
+      ++done;
+      for (auto k = out_count[u]; k < out_count[u + 1]; ++k) {
+        const auto c = static_cast<std::size_t>(children[static_cast<std::size_t>(k)]);
+        if (--indeg[c] == 0) ready.push_back(static_cast<std::int32_t>(c));
+      }
+    }
+    if (done != n) throw std::invalid_argument("PredecessorDAG.from_csr: the entries contain a cycle");
+  }
+  // Canonical form: within a node, ascending via EdgeId.
+  for (std::size_t v = 0; v < n; ++v) {
+    for (auto k = static_cast<std::size_t>(offsets[v]) + 1; k < static_cast<std::size_t>(offsets[v + 1]); ++k) {
+      if (via[k] <= via[k - 1]) {
+        throw std::invalid_argument("PredecessorDAG.from_csr: the entries of node " + idx(v) +
+                                    " are not in ascending via EdgeId (" + std::to_string(via[k - 1]) + " then " +
+                                    std::to_string(via[k]) + ")");
+      }
+    }
+  }
+}
+
+PredecessorDAG PredecessorDAG::from_csr(const Graph& graph, std::span<const std::int32_t> offsets,
+    std::span<const NodeId> parents, std::span<const EdgeId> via) {
+  detail::check_csr(graph, offsets, parents, via);
+  return detail::PredecessorDAGBuilder::of_csr(graph, offsets, parents, via);
+}
+
+PredecessorDAG detail::PredecessorDAGBuilder::of_csr(const Graph& graph, std::span<const std::int32_t> offsets,
+    std::span<const NodeId> parents, std::span<const EdgeId> via) {
+  const auto n = static_cast<std::size_t>(graph.num_nodes());
+  PredecessorDAG out;
+  out.graph_uid_ = graph.uid();
+  out.num_nodes_ = graph.num_nodes();
+  for (std::size_t v = 0; v < n; ++v) {
+    if (offsets[v + 1] != offsets[v]) {
+      out.nodes_.push_back(static_cast<NodeId>(v));
+      out.node_offsets_.push_back(offsets[v + 1]);
+    }
+  }
+  out.parents_.assign(parents.begin(), parents.end());
+  out.via_edges_.assign(via.begin(), via.end());
+  out.edges_ = out.via_edges_;
+  std::sort(out.edges_.begin(), out.edges_.end());
+  return out;
+}
+
+std::vector<std::int32_t> PredecessorDAG::parent_offsets() const {
+  std::vector<std::int32_t> out(static_cast<std::size_t>(num_nodes_) + 1, 0);
+  std::size_t i = 0;
+  for (std::size_t v = 0; v < static_cast<std::size_t>(num_nodes_); ++v) {
+    if (i < nodes_.size() && static_cast<std::size_t>(nodes_[i]) == v) ++i;
+    out[v + 1] = node_offsets_[i];
+  }
+  return out;
+}
+
+namespace detail {
+
+PredecessorDAG PredecessorDAGBuilder::of_edges(const Graph& graph, std::span<const EdgeId> edges) {
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  PredecessorDAG out;
+  out.graph_uid_ = graph.uid();
+  out.num_nodes_ = graph.num_nodes();
+  std::vector<EdgeId> sorted(edges.begin(), edges.end());
+  if (!std::is_sorted(sorted.begin(), sorted.end())) std::sort(sorted.begin(), sorted.end());
+  // The entries' via edges grouped by child (ascending NodeId), ascending within a child, built in
+  // place: a small set by sorting on (child, via), a larger one by a stable counting sort of the
+  // ascending edges by their child over an N + 1 temporary.
+  auto& via = out.via_edges_;
+  if (sorted.size() * 8 < static_cast<std::size_t>(out.num_nodes_)) {
+    std::vector<std::pair<NodeId, EdgeId>> keyed(sorted.size());
+    for (std::size_t k = 0; k < sorted.size(); ++k) keyed[k] = {edge_destinations[static_cast<std::size_t>(sorted[k])], sorted[k]};
+    std::sort(keyed.begin(), keyed.end());
+    via.resize(keyed.size());
+    for (std::size_t k = 0; k < keyed.size(); ++k) via[k] = keyed[k].second;
+  } else {
+    via.resize(sorted.size());
+    std::vector<std::int32_t> slot(static_cast<std::size_t>(out.num_nodes_) + 1, 0);
+    for (EdgeId e : sorted) ++slot[static_cast<std::size_t>(edge_destinations[static_cast<std::size_t>(e)]) + 1];
+    for (std::size_t v = 1; v < slot.size(); ++v) slot[v] += slot[v - 1];
+    for (EdgeId e : sorted) via[static_cast<std::size_t>(slot[static_cast<std::size_t>(edge_destinations[static_cast<std::size_t>(e)])]++)] = e;
+  }
+  // The member nodes counted first, so their lists are sized once.
+  std::size_t members = 0;
+  for (std::size_t k = 0; k < via.size(); ++k) {
+    if (k == 0 || edge_destinations[static_cast<std::size_t>(via[k])] != edge_destinations[static_cast<std::size_t>(via[k - 1])]) ++members;
+  }
+  out.nodes_.reserve(members);
+  out.node_offsets_.reserve(members + 1);
+  out.parents_.resize(via.size());
+  for (std::size_t k = 0; k < via.size(); ++k) {
+    const auto ei = static_cast<std::size_t>(via[k]);
+    const NodeId child = edge_destinations[ei];
+    if (out.nodes_.empty() || out.nodes_.back() != child) {
+      if (!out.nodes_.empty()) out.node_offsets_.push_back(static_cast<std::int32_t>(k));
+      out.nodes_.push_back(child);
+    }
+    out.parents_[k] = edge_sources[ei];
+  }
+  if (!out.nodes_.empty()) out.node_offsets_.push_back(static_cast<std::int32_t>(via.size()));
+  out.edges_ = std::move(sorted);
+  return out;
+}
+
+PredecessorDAG PredecessorDAGBuilder::empty(const Graph& graph) {
+  PredecessorDAG out;
+  out.graph_uid_ = graph.uid();
+  out.num_nodes_ = graph.num_nodes();
+  return out;
+}
+
+PredecessorDAG PredecessorDAGBuilder::of_parts(const Graph& graph, std::vector<NodeId> nodes, std::vector<std::int32_t> offsets,
+                                 std::vector<NodeId> parents, std::vector<EdgeId> via,
+                                 std::vector<EdgeId> ascending) {
+  PredecessorDAG out;
+  out.graph_uid_ = graph.uid();
+  out.num_nodes_ = graph.num_nodes();
+  out.nodes_ = std::move(nodes);
+  out.node_offsets_ = std::move(offsets);
+  out.parents_ = std::move(parents);
+  out.via_edges_ = std::move(via);
+  out.edges_ = std::move(ascending);
+  return out;
+}
+
+PredecessorDAG PredecessorDAGBuilder::of_path(std::uint64_t graph_uid, std::int32_t num_nodes,
+                                  const std::vector<std::vector<EdgeId>>& hops, const std::vector<NodeId>& nodes) {
+  // Hop h's child is nodes[h + 1]; the children are distinct, so ordering the hops by child
+  // gives the grouped entries.
+  std::vector<std::size_t> order(hops.size());
+  for (std::size_t h = 0; h < hops.size(); ++h) order[h] = h;
+  std::sort(order.begin(), order.end(), [&](std::size_t a, std::size_t b) { return nodes[a + 1] < nodes[b + 1]; });
+  PredecessorDAG out;
+  out.graph_uid_ = graph_uid;
+  out.num_nodes_ = num_nodes;
+  for (std::size_t h : order) {
+    std::vector<EdgeId> members(hops[h]);
+    std::sort(members.begin(), members.end());
+    out.nodes_.push_back(nodes[h + 1]);
+    for (EdgeId e : members) {
+      out.parents_.push_back(nodes[h]);
+      out.via_edges_.push_back(e);
+    }
+    out.node_offsets_.push_back(static_cast<std::int32_t>(out.via_edges_.size()));
+  }
+  out.edges_ = out.via_edges_;
+  std::sort(out.edges_.begin(), out.edges_.end());
+  return out;
+}
+
+Path PathBuilder::of_walk(const Graph& graph, std::span<const EdgeId> walk) {
+  std::vector<std::vector<EdgeId>> hops;
+  hops.reserve(walk.size());
+  for (EdgeId e : walk) hops.push_back({e});
+  return of_hops(graph, std::move(hops));
+}
+
+Path PathBuilder::of_hops(const Graph& graph, std::vector<std::vector<EdgeId>> hops) {
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  const auto cost = graph.edge_costs();
+  Path out;
+  out.nodes_.reserve(hops.size() + 1);
+  out.nodes_.push_back(edge_sources[static_cast<std::size_t>(hops.front().front())]);
+  for (const auto& hop : hops) {
+    out.nodes_.push_back(edge_destinations[static_cast<std::size_t>(hop.front())]);
+    Cost best = cost[static_cast<std::size_t>(hop.front())];
+    for (EdgeId e : hop) best = std::min(best, cost[static_cast<std::size_t>(e)]);
+    out.cost_ += best;
+  }
+  out.graph_uid_ = graph.uid();
+  out.num_nodes_ = graph.num_nodes();
+  out.hops_ = std::move(hops);
+  return out;
+}
+
+std::span<const EdgeId> PredecessorDAGBuilder::ascending(const PredecessorDAG& dag) noexcept { return dag.edges_; }
+
+std::span<const NodeId> PredecessorDAGBuilder::member_nodes(const PredecessorDAG& dag) noexcept { return dag.nodes_; }
+
+std::span<const std::int32_t> PredecessorDAGBuilder::member_offsets(const PredecessorDAG& dag) noexcept { return dag.node_offsets_; }
+
+std::size_t PredecessorDAGBuilder::payload_bytes(const PredecessorDAG& dag) noexcept {
+  return sizeof(NodeId) * (dag.nodes_.size() + dag.parents_.size()) + sizeof(std::int32_t) * dag.node_offsets_.size() +
+         sizeof(EdgeId) * (dag.via_edges_.size() + dag.edges_.size());
+}
+
+} // namespace detail
+
+void detail::check_hops(const Graph& graph, const std::vector<std::vector<EdgeId>>& hops) {
+  const auto m = static_cast<std::int64_t>(graph.num_edges());
+  // Every member in range before any endpoint is read.
+  for (std::size_t h = 0; h < hops.size(); ++h) {
+    for (EdgeId e : hops[h]) {
+      if (e < 0 || e >= m) {
+        throw std::invalid_argument("Path: hop " + idx(h) + " member " + std::to_string(e) +
+                                    " out of edge range [0, " + std::to_string(m) + ")");
+      }
+    }
+  }
+  {
+    std::vector<std::uint8_t> seen(static_cast<std::size_t>(m), 0);
+    for (const auto& hop : hops) {
+      for (EdgeId e : hop) {
+        if (seen[static_cast<std::size_t>(e)] != 0) {
+          throw std::invalid_argument("Path: duplicate member " + std::to_string(e));
+        }
+        seen[static_cast<std::size_t>(e)] = 1;
+      }
+    }
+  }
+  if (hops.empty()) throw std::invalid_argument("Path: the hop list is empty");
+  for (std::size_t h = 0; h < hops.size(); ++h) {
+    if (hops[h].empty()) throw std::invalid_argument("Path: hop " + idx(h) + " is empty");
+  }
+  const auto edge_sources = graph.edge_sources();
+  const auto edge_destinations = graph.edge_destinations();
+  for (std::size_t h = 0; h < hops.size(); ++h) {
+    const auto first = static_cast<std::size_t>(hops[h].front());
+    for (EdgeId e : hops[h]) {
+      const auto ei = static_cast<std::size_t>(e);
+      if (edge_sources[ei] != edge_sources[first] || edge_destinations[ei] != edge_destinations[first]) {
+        throw std::invalid_argument("Path: the members of hop " + idx(h) + " do not share (u, v): edge " +
+                                    std::to_string(e) + " joins (" + std::to_string(edge_sources[ei]) + ", " +
+                                    std::to_string(edge_destinations[ei]) + "), edge " + idx(first) + " joins (" +
+                                    std::to_string(edge_sources[first]) + ", " + std::to_string(edge_destinations[first]) + ")");
+      }
+    }
+  }
+  for (std::size_t h = 1; h < hops.size(); ++h) {
+    const NodeId prev = edge_destinations[static_cast<std::size_t>(hops[h - 1].front())];
+    const NodeId next = edge_sources[static_cast<std::size_t>(hops[h].front())];
+    if (prev != next) {
+      throw std::invalid_argument("Path: hops " + idx(h - 1) + " and " + idx(h) + " are not contiguous (" +
+                                  std::to_string(prev) + " then " + std::to_string(next) + ")");
+    }
+  }
+  std::vector<NodeId> nodes;
+  nodes.reserve(hops.size() + 1);
+  nodes.push_back(edge_sources[static_cast<std::size_t>(hops.front().front())]);
+  for (const auto& hop : hops) {
+    nodes.push_back(edge_destinations[static_cast<std::size_t>(hop.front())]);
+  }
+  {
+    std::vector<NodeId> sorted(nodes);
+    std::sort(sorted.begin(), sorted.end());
+    const auto dup = std::adjacent_find(sorted.begin(), sorted.end());
+    if (dup != sorted.end()) throw std::invalid_argument("Path: node " + std::to_string(*dup) + " is repeated");
+  }
+}
+
+Path::Path(const Graph& graph, std::vector<std::vector<EdgeId>> hops) {
+  detail::check_hops(graph, hops);
+  *this = detail::PathBuilder::of_hops(graph, std::move(hops));
+}
+
+PredecessorDAG Path::to_dag() const {
+  // From the hops and the visited nodes, as a Path keeps no graph reference: the parent of every
+  // member of hop h is nodes_[h], its child nodes_[h + 1]; no node repeats, so each node holds
+  // the members of at most one hop.
+  return detail::PredecessorDAGBuilder::of_path(graph_uid_, num_nodes_, hops_, nodes_);
+}
+
+} // namespace netgraph::core
diff --git a/src/search.cpp b/src/search.cpp
new file mode 100644
index 0000000..72761f4
--- /dev/null
+++ b/src/search.cpp
@@ -0,0 +1,1468 @@
+/*
+  The one traversal core of every search (detail/search_detail.hpp), the public
+  spf, and the constructors of the search options.
+
+  Distances are int64 path costs: every cost is positive and the sum of all costs is below 2^62,
+  so no simple path cost overflows and kUnreachable (INT64_MAX) never collides.
+
+  Both queues pop in (distance, node) order: the heap by its key, the cyclic buckets because
+  each holds one distance at a time and the active bucket is sorted by node. After popping
+  distance d, pending distances lie in [d, d + max_edge_cost], all multiples of edge_cost_gcd. A node is
+  pushed only on a strict improvement, so it appears at most once per bucket. Equal-distance pop
+  order cannot change the result: positive costs make every tight predecessor of a node
+  strictly nearer, so it is finalised first.
+*/
+#include "netgraph/core/search.hpp"
+
+#include <algorithm>
+#include <bit>
+#include <cmath>
+#include <functional>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+#include "netgraph/core/detail/edge_amounts.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/graph_access.hpp"
+#include "netgraph/core/detail/hooks_flag.hpp"
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+
+namespace netgraph::core::detail {
+
+int compare(const Priority& a, const Priority& b) noexcept {
+  if (a.infinite || b.infinite) return a.infinite == b.infinite ? 0 : (a.infinite ? 1 : -1);
+  if (a.den == 1 && b.den == 1) return a.num == b.num ? 0 : (a.num < b.num ? -1 : 1);
+  const U128 left = mul_u64(static_cast<std::uint64_t>(a.num), static_cast<std::uint64_t>(b.den));
+  const U128 right = mul_u64(static_cast<std::uint64_t>(b.num), static_cast<std::uint64_t>(a.den));
+  if (left == right) return 0;
+  return left < right ? -1 : 1;
+}
+
+Priority priority_value(RouteTieBreak tie_break, Amount residual, Amount capacity) noexcept {
+  if (tie_break == RouteTieBreak::HigherAvailableCapacity) return {residual, 1, false};
+  if (tie_break != RouteTieBreak::HigherHeadroom) return {capacity, 1, false};
+  if (capacity == 0) return {0, 1, false};  // a zero-capacity edge has headroom 0
+  return {residual, capacity, false};
+}
+
+Priority PriorityValues::of(EdgeId e) const noexcept {
+  const auto ei = static_cast<std::size_t>(e);
+  const Amount cap = graph->edge_capacity_units()[ei];
+  return priority_value(tie_break, residual.empty() ? cap : residual[ei], cap);
+}
+
+PriorityReader PriorityReader::of(const PriorityValues& values) noexcept {
+  return {&values, [](const void* ctx, EdgeId e) noexcept { return static_cast<const PriorityValues*>(ctx)->of(e); }};
+}
+
+std::int64_t bucket_width(const Graph& graph) noexcept {
+  const Cost stride = std::max<Cost>(1, graph.edge_cost_gcd());
+  return graph.max_edge_cost() / stride + 1;  // max_edge_cost < 2^62: no overflow
+}
+
+bool uses_buckets(const Graph& graph, SpfQueue queue) noexcept {
+  return queue == SpfQueue::Auto && bucket_width(graph) <= kMaxBucketWidth;
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+namespace {
+thread_local const KspProbe* ksp_probe = nullptr;
+}
+const KspProbe* current_ksp_probe() noexcept { return ksp_probe; }
+void set_ksp_probe(const KspProbe* probe) noexcept { ksp_probe = probe; }
+
+QueueCounts& thread_queue_counts() noexcept {
+  thread_local QueueCounts counts;
+  return counts;
+}
+#endif
+
+namespace {
+
+constexpr Cost kInf = kUnreachable;
+
+// Node marks of the workspace (one byte per node, zero between leases).
+enum : std::uint8_t {
+  kTarget = 1,      // a live target of the current search, or a destination of a support route
+  kExcluded = 2,    // a KSP spur's excluded prefix node
+  kKeep = 4,        // a node of the pruned DAG (the walk back from the targets) or of a support route
+  kBannedHead = 8,  // a KSP Collapse ban: the spur node's transition to this node
+};
+
+// Releases a buffer whose retained capacity exceeds a small multiple of what the last use
+// needed, so a thread's workspace does not keep the high-water mark of every graph it saw.
+template <class Vec>
+void trim(Vec& v, std::size_t used) noexcept {
+  if (v.capacity() > 4 * used + 65536) {
+    Vec fresh;
+    v.swap(fresh);
+  }
+}
+
+// The reference queue: a binary heap on (distance, node).
+class HeapQueue {
+public:
+  void begin(std::span<const NodeId> roots) {
+    heap_.clear();
+    peak_ = 0;
+    for (NodeId r : roots) push(0, r);
+  }
+  void push(Cost c, NodeId v) {
+    heap_.emplace_back(c, v);  // strong guarantee: a failed growth leaves the heap as it was
+    std::push_heap(heap_.begin(), heap_.end(), std::greater<> {});
+    if (heap_.size() > peak_) peak_ = heap_.size();
+  }
+  bool pop(Cost& c, NodeId& v) noexcept {
+    if (heap_.empty()) return false;
+    std::pop_heap(heap_.begin(), heap_.end(), std::greater<> {});
+    c = heap_.back().first;
+    v = heap_.back().second;
+    heap_.pop_back();
+    return true;
+  }
+  void end() noexcept {
+    heap_.clear();
+    trim(heap_, peak_);
+  }
+
+private:
+  std::vector<std::pair<Cost, NodeId>> heap_ {};
+  std::size_t peak_ {0};
+};
+
+// Monotone cyclic buckets (see the file comment): W' = bit_ceil(W) >= 64 buckets, each an
+// intrusive list into one item pool, an occupancy bit per bucket and the words set during the
+// search; the active bucket is copied out and sorted by node. A frontier of exactly one item is
+// held inline (chain-like stretches pay no bucket bookkeeping); a second push promotes it.
+// Between searches every head is -1 and every occupancy bit 0.
+class BucketQueue {
+public:
+  void begin(std::int64_t width, Cost stride, std::size_t num_nodes, std::span<const NodeId> roots) {
+    const std::size_t w2 = std::max<std::size_t>(64, std::bit_ceil(static_cast<std::size_t>(width)));
+    const std::size_t words = w2 / 64;
+    // Each growth keeps the invariant of the existing part (heads -1, bits 0), and none can leave
+    // the queue unusable: every later use reads only up to the sizes reached.
+    if (head_.size() < w2) head_.resize(w2, -1);
+    if (occ_.size() < words) occ_.resize(words, 0);
+    if (dirty_flag_.size() < words) dirty_flag_.resize(words, 0);
+    if (dirty_.capacity() < words) dirty_.reserve(words);       // one entry per word: never grows
+    if (active_.capacity() < num_nodes) active_.reserve(num_nodes);  // a bucket holds a node once
+    mask_ = w2 - 1;
+    words_ = words;
+    stride_ = stride;
+    shift_ = std::has_single_bit(static_cast<std::uint64_t>(stride)) ? std::countr_zero(static_cast<std::uint64_t>(stride)) : -1;
+    cur_ = 0;
+    cur_b_ = 0;
+    pending_ = 0;
+    held_ = false;
+    items_.clear();
+    peak_ = 0;
+    active_.assign(roots.begin(), roots.end());  // distance 0, sorted; within the reserved capacity
+    pos_ = 0;
+  }
+  void push(Cost c, NodeId v) {
+    if (!held_ && pending_ == 0 && pos_ == active_.size()) {
+      held_ = true;
+      held_cost_ = c;
+      held_node_ = v;
+      return;
+    }
+    if (held_) {
+      put(held_cost_, held_node_);
+      held_ = false;
+    }
+    put(c, v);
+  }
+  bool pop(Cost& c, NodeId& v) noexcept {
+    if (pos_ < active_.size()) {
+      c = cur_;
+      v = active_[pos_++];
+      return true;
+    }
+    if (held_) {
+      held_ = false;
+      cur_ = held_cost_;
+      cur_b_ = index(cur_);
+      c = cur_;
+      v = held_node_;
+      return true;
+    }
+    if (pending_ == 0) return false;
+    activate();
+    c = cur_;
+    v = active_[pos_++];
+    return true;
+  }
+  void end() noexcept {
+    for (const std::uint32_t w : dirty_) {
+      std::uint64_t word = occ_[w];
+      while (word != 0) {
+        head_[(static_cast<std::size_t>(w) << 6) + static_cast<std::size_t>(std::countr_zero(word))] = -1;
+        word &= word - 1;
+      }
+      occ_[w] = 0;
+      dirty_flag_[w] = 0;
+    }
+    dirty_.clear();
+    items_.clear();
+    active_.clear();
+    pos_ = 0;
+    pending_ = 0;
+    held_ = false;
+    trim(items_, peak_);
+  }
+
+private:
+  struct Item {
+    NodeId node;
+    std::int32_t next;
+  };
+  [[nodiscard]] std::size_t index(Cost c) const noexcept {
+    const Cost q = shift_ >= 0 ? (c >> shift_) : c / stride_;
+    return static_cast<std::size_t>(q) & mask_;
+  }
+  void put(Cost c, NodeId v) {
+    const std::size_t b = index(c);
+    items_.push_back({v, head_[b]});  // the only allocation; a failure changes nothing
+    head_[b] = static_cast<std::int32_t>(items_.size() - 1);
+    const std::size_t w = b >> 6;
+    if (dirty_flag_[w] == 0) {
+      dirty_flag_[w] = 1;
+      dirty_.push_back(static_cast<std::uint32_t>(w));  // reserved for every word
+    }
+    occ_[w] |= std::uint64_t {1} << (b & 63);
+    ++pending_;
+    if (items_.size() > peak_) peak_ = items_.size();
+  }
+  // The next non-empty bucket after the active one, cyclically (pending_ > 0): its items become
+  // the active bucket, sorted by node.
+  void activate() noexcept {
+    std::size_t i = (cur_b_ + 1) & mask_;
+    std::size_t w = i >> 6;
+    std::uint64_t word = occ_[w] & (~std::uint64_t {0} << (i & 63));
+    while (word == 0) {
+      w = w + 1 == words_ ? 0 : w + 1;
+      word = occ_[w];
+    }
+    const std::size_t f = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
+    cur_ += static_cast<Cost>((f - cur_b_) & mask_) * stride_;
+    cur_b_ = f;
+    active_.clear();
+    pos_ = 0;
+    for (std::int32_t k = head_[f]; k >= 0; k = items_[static_cast<std::size_t>(k)].next) {
+      active_.push_back(items_[static_cast<std::size_t>(k)].node);  // within the reserved capacity
+    }
+    head_[f] = -1;
+    occ_[w] &= ~(std::uint64_t {1} << (f & 63));
+    pending_ -= active_.size();
+    if (active_.size() > 1) std::sort(active_.begin(), active_.end());
+  }
+
+  std::vector<std::int32_t> head_ {};
+  std::vector<std::uint64_t> occ_ {};
+  std::vector<std::uint8_t> dirty_flag_ {};
+  std::vector<std::uint32_t> dirty_ {};
+  std::vector<Item> items_ {};
+  std::vector<NodeId> active_ {};
+  std::size_t pos_ {0};
+  std::size_t mask_ {0};
+  std::size_t words_ {0};
+  Cost stride_ {1};
+  int shift_ {0};
+  Cost cur_ {0};
+  std::size_t cur_b_ {0};
+  std::size_t pending_ {0};
+  std::size_t peak_ {0};
+  bool held_ {false};
+  Cost held_cost_ {0};
+  NodeId held_node_ {0};
+};
+
+struct PoolEntry {
+  EdgeId edge;
+  std::int32_t next;
+};
+
+// The per-thread search workspace. Between leases: dist == kInf, head == -1, loc == -1 and
+// flags == 0 for every node; touched, marked, the pool and both queues empty. touched and marked
+// have the capacity of the node arrays, so recording a node never allocates; scratch buffers are
+// rewritten before every use.
+struct SearchWorkspace {
+  std::vector<Cost> distances {};
+  std::vector<std::int32_t> predecessor_list_heads {};
+  std::vector<std::int32_t> local_positions {};
+  std::vector<std::uint8_t> flags {};
+  std::vector<NodeId> touched {};  // the nodes whose dist (and head) a lease wrote
+  std::vector<NodeId> marked {};   // the nodes whose flags (and loc) a lease wrote
+  std::vector<PoolEntry> pool {};  // the tight-edge lists
+  std::size_t pool_peak {0};
+  HeapQueue heap {};
+  BucketQueue buckets {};
+  // scratch
+  std::vector<EdgeId> list {};
+  std::vector<EdgeId> pruned {};
+  std::vector<NodeId> kept {};
+  std::vector<NodeId> stack {};
+  std::vector<std::int32_t> outgoing_offsets {};
+  std::vector<std::int32_t> incoming_offsets {};
+  std::vector<std::int32_t> outgoing_edge_positions {};
+  std::vector<std::int32_t> incoming_edge_positions {};
+  std::vector<std::int32_t> hops {};
+  std::vector<std::uint8_t> keep_edge {};
+  std::vector<std::uint8_t> has_best {};
+  std::vector<Priority> best {};
+  bool leased {false};
+};
+
+thread_local SearchWorkspace tls_workspace;
+
+// The lease of the thread's workspace for one search (and its extraction): sizes the node arrays
+// for the graph, refuses an overlapping lease, and restores the workspace's invariant on every
+// exit, exceptions included. A failed acquisition changes nothing (the arrays are replaced
+// together or not at all). The workspace holds no pointer into a graph, a residual or an
+// Eligibility between leases.
+class SearchWorkspaceLease {
+public:
+  explicit SearchWorkspaceLease(std::size_t n) : workspace_(tls_workspace) {
+    if (workspace_.leased) throw std::logic_error("search: the thread's workspace is already leased (overlapping searches)");
+    if (workspace_.distances.size() < n || workspace_.distances.size() > 4 * n + 4096) {
+      std::vector<Cost> dist(n, kInf);
+      std::vector<std::int32_t> head(n, -1);
+      std::vector<std::int32_t> loc(n, -1);
+      std::vector<std::uint8_t> flags(n, 0);
+      std::vector<NodeId> touched;
+      std::vector<NodeId> marked;
+      touched.reserve(n);
+      marked.reserve(n);
+      workspace_.distances.swap(dist);
+      workspace_.predecessor_list_heads.swap(head);
+      workspace_.local_positions.swap(loc);
+      workspace_.flags.swap(flags);
+      workspace_.touched.swap(touched);
+      workspace_.marked.swap(marked);
+    }
+    workspace_.leased = true;
+  }
+  SearchWorkspaceLease(const SearchWorkspaceLease&) = delete;
+  SearchWorkspaceLease& operator=(const SearchWorkspaceLease&) = delete;
+  ~SearchWorkspaceLease() { release(); }
+  [[nodiscard]] SearchWorkspace& workspace() noexcept { return workspace_; }
+
+private:
+  void release() noexcept {
+    auto& w = workspace_;
+    const std::size_t n = w.distances.size();
+    if (w.touched.size() * 4 >= n) {
+      std::fill(w.distances.begin(), w.distances.end(), kInf);
+      std::fill(w.predecessor_list_heads.begin(), w.predecessor_list_heads.end(), -1);
+    } else {
+      for (NodeId v : w.touched) {
+        w.distances[static_cast<std::size_t>(v)] = kInf;
+        w.predecessor_list_heads[static_cast<std::size_t>(v)] = -1;
+      }
+    }
+    if (w.marked.size() * 4 >= n) {
+      std::fill(w.flags.begin(), w.flags.end(), std::uint8_t {0});
+      std::fill(w.local_positions.begin(), w.local_positions.end(), -1);
+    } else {
+      for (NodeId v : w.marked) {
+        w.flags[static_cast<std::size_t>(v)] = 0;
+        w.local_positions[static_cast<std::size_t>(v)] = -1;
+      }
+    }
+    w.touched.clear();
+    w.marked.clear();
+    w.pool_peak = std::max(w.pool_peak, w.pool.size());
+    w.pool.clear();
+    trim(w.pool, w.pool_peak);
+    w.pool_peak = 0;
+    w.heap.end();
+    w.buckets.end();
+    w.leased = false;
+  }
+  SearchWorkspace& workspace_;
+};
+
+void mark(SearchWorkspace& ws, NodeId v, std::uint8_t bit) noexcept {
+  auto& f = ws.flags[static_cast<std::size_t>(v)];
+  if (f == 0) ws.marked.push_back(v);  // within the reserved capacity
+  f = static_cast<std::uint8_t>(f | bit);
+}
+
+// A KSP spur is the node where an alternative path leaves an earlier path's prefix. Spur rules
+// apply to forward searches only: excluded prefix nodes (kExcluded) prevent cycles. At the spur,
+// parallel_edges = true (Expand) bans the listed edges; false (Collapse) bans every edge to a head
+// marked kBannedHead.
+struct Spur {
+  NodeId node {-1};
+  std::span<const EdgeId> banned_edges {};
+  bool ban_heads {false};
+};
+
+// One search over validated inputs. `roots`: allowed, sorted, unique, non-empty; with `targets`
+// the live targets carry kTarget and the search stops at the first one popped.
+struct SearchInput {
+  const Graph* graph {nullptr};
+  SearchFilter filter {};
+  Direction direction {Direction::Forward};
+  SpfQueue queue {SpfQueue::Auto};
+  std::span<const NodeId> roots {};
+  bool targets {false};
+  bool collect_predecessors {true};
+  const Spur* spur {nullptr};
+};
+
+template <Direction D, class Q>
+Cost run_dijkstra(SearchWorkspace& ws, Q& q, const SearchInput& in) {
+  const Graph& g = *in.graph;
+  const Cost* const cost = g.edge_costs().data();
+  const NodeId* const edst = g.edge_destinations().data();
+  const std::int32_t* const row = g.outgoing_offsets().data();
+  const std::int32_t* const in_row = g.incoming_offsets().data();
+  const EdgeId* const in_adj = g.incoming_edges().data();
+  const NodeId* const in_col = detail::GraphAccess::incoming_edge_sources(g).data();  // in_col[s] = esrc[in_adj[s]]
+  const std::uint8_t* const allowed = in.filter.eligibility != nullptr ? in.filter.eligibility->edge_allowed().data() : nullptr;
+  const Amount* const res = in.filter.residual.empty() ? nullptr : in.filter.residual.data();
+  const Amount minr = in.filter.min_residual;
+  // The node arrays are not resized during a lease: raw pointers keep the compiler from
+  // reloading the vector bases around every store into the thread-local workspace.
+  Cost* const dist = ws.distances.data();
+  std::int32_t* const head = ws.predecessor_list_heads.data();
+  const std::uint8_t* const flags = ws.flags.data();
+  const bool targets = in.targets;
+  const bool lists = in.collect_predecessors;
+  const Spur* const spur = in.spur;
+  auto candidate = [&](std::size_t e) noexcept {
+    return (allowed == nullptr || allowed[e] != 0) && (res == nullptr || res[e] >= minr);
+  };
+  // Records a node in `touched` before its first write (never allocates) and a tight edge in the
+  // pool before it is linked (a failed growth changes nothing).
+  auto relax = [&](NodeId x, Cost nd, EdgeId e) {
+    const auto xi = static_cast<std::size_t>(x);
+    const Cost dx = dist[xi];
+    if (nd < dx) {
+      if (lists) ws.pool.push_back({e, -1});
+      if (dx == kInf) ws.touched.push_back(x);
+      if (lists) head[xi] = static_cast<std::int32_t>(ws.pool.size() - 1);
+      dist[xi] = nd;
+      q.push(nd, x);
+    } else if (lists && nd == dx) {
+      ws.pool.push_back({e, head[xi]});
+      head[xi] = static_cast<std::int32_t>(ws.pool.size() - 1);
+    }
+  };
+  Cost d = 0;
+  NodeId u = 0;
+  while (q.pop(d, u)) {
+    const auto ui = static_cast<std::size_t>(u);
+    if (d != dist[ui]) continue;  // a stale entry: the node improved after this push
+    if (targets && (flags[ui] & kTarget) != 0) return d;  // the nearest targets' distance
+    if constexpr (D == Direction::Forward) {
+      const bool at_spur = spur != nullptr && u == spur->node;
+      for (auto e = static_cast<std::size_t>(row[ui]); e < static_cast<std::size_t>(row[ui + 1]); ++e) {
+        if (!candidate(e)) continue;
+        const NodeId v = edst[e];
+        if (spur != nullptr) {
+          const std::uint8_t fv = flags[static_cast<std::size_t>(v)];
+          if ((fv & kExcluded) != 0) continue;
+          if (at_spur) {
+            if (spur->ban_heads ? (fv & kBannedHead) != 0
+                                : std::find(spur->banned_edges.begin(), spur->banned_edges.end(),
+                                            static_cast<EdgeId>(e)) != spur->banned_edges.end()) {
+              continue;
+            }
+          }
+        }
+        relax(v, d + cost[e], static_cast<EdgeId>(e));
+      }
+    } else {
+      for (auto s = static_cast<std::size_t>(in_row[ui]); s < static_cast<std::size_t>(in_row[ui + 1]); ++s) {
+        const auto e = static_cast<std::size_t>(in_adj[s]);
+        if (!candidate(e)) continue;
+        relax(in_col[s], d + cost[e], static_cast<EdgeId>(e));
+      }
+    }
+  }
+  return kInf;
+}
+
+// Runs one search into the leased workspace; returns the nearest targets' distance d* (kInf
+// without targets or when none is reached).
+Cost run_search(SearchWorkspace& ws, const SearchInput& in) {
+  for (NodeId r : in.roots) {
+    ws.touched.push_back(r);  // before the write; within the reserved capacity
+    ws.distances[static_cast<std::size_t>(r)] = 0;
+  }
+  const Graph& g = *in.graph;
+  const bool forward = in.direction == Direction::Forward;
+  if (uses_buckets(g, in.queue)) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    ++thread_queue_counts().buckets;
+#endif
+    ws.buckets.begin(bucket_width(g), std::max<Cost>(1, g.edge_cost_gcd()), ws.distances.size(), in.roots);
+    return forward ? run_dijkstra<Direction::Forward>(ws, ws.buckets, in) : run_dijkstra<Direction::Reverse>(ws, ws.buckets, in);
+  }
+  ws.heap.begin(in.roots);
+  return forward ? run_dijkstra<Direction::Forward>(ws, ws.heap, in) : run_dijkstra<Direction::Reverse>(ws, ws.heap, in);
+}
+
+// How a list's entries are read after a search: the list of a node holds its tight in-edges
+// (Forward: the other endpoint is the edge's source) or its tight out-edges toward the roots
+// (Reverse: the other endpoint is the edge's destination); Collapse keeps one member per pair.
+struct SearchOutputOptions {
+  const Graph* graph {nullptr};
+  bool forward {true};
+  bool collapse_parallel_edges {false};
+  bool prefer_priority {false};
+  PriorityReader priority {};
+};
+
+// Appends node x's list to `out` with Collapse applied. The entries of one pair are consecutive
+// in the list (each node's scan inserts them one after another; they are the pair's cheapest
+// candidates, consecutive in both adjacency orders), so one pass groups them by the other endpoint.
+void read_list(const SearchWorkspace& ws, const SearchOutputOptions& em, NodeId x, std::vector<EdgeId>& out) {
+  const NodeId* const other = em.forward ? em.graph->edge_sources().data() : em.graph->edge_destinations().data();
+  std::int32_t k = ws.predecessor_list_heads[static_cast<std::size_t>(x)];
+  if (!em.collapse_parallel_edges) {
+    for (; k >= 0; k = ws.pool[static_cast<std::size_t>(k)].next) out.push_back(ws.pool[static_cast<std::size_t>(k)].edge);
+    return;
+  }
+  while (k >= 0) {
+    EdgeId best = ws.pool[static_cast<std::size_t>(k)].edge;
+    const NodeId y = other[static_cast<std::size_t>(best)];
+    k = ws.pool[static_cast<std::size_t>(k)].next;
+    for (; k >= 0; k = ws.pool[static_cast<std::size_t>(k)].next) {
+      const EdgeId e = ws.pool[static_cast<std::size_t>(k)].edge;
+      if (other[static_cast<std::size_t>(e)] != y) break;
+      if (em.prefer_priority) {
+        const int c = compare(em.priority(e), em.priority(best));
+        if (c > 0 || (c == 0 && e < best)) best = e;
+      } else if (e < best) {
+        best = e;
+      }
+    }
+    out.push_back(best);
+  }
+}
+
+// Sorts a short run ascending (a node's list).
+void sort_small(std::vector<EdgeId>& v, std::size_t from) {
+  if (v.size() - from > 1) std::sort(v.begin() + static_cast<std::ptrdiff_t>(from), v.end());
+}
+
+// The full search's DAG from the lists (one dense pass over the nodes; a full search costs O(N)
+// for its costs anyway): Forward lists are per child, so the entries come grouped by child and
+// the ascending order by a counting pass over the parents; Reverse lists are per parent, so the
+// ascending order comes directly and the grouping by a counting pass over the children.
+PredecessorDAG emit_full(SearchWorkspace& ws, const SearchOutputOptions& em) {
+  const Graph& g = *em.graph;
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  const auto esrc = g.edge_sources();
+  const auto edst = g.edge_destinations();
+  std::vector<NodeId> nodes;
+  std::vector<std::int32_t> offsets {0};
+  std::vector<NodeId> parents;
+  std::vector<EdgeId> via;
+  std::vector<EdgeId> asc;
+  auto& list = ws.list;
+  list.clear();
+  if (em.forward) {
+    for (std::size_t v = 0; v < n; ++v) {
+      if (ws.predecessor_list_heads[v] < 0) continue;
+      const std::size_t from = list.size();
+      read_list(ws, em, static_cast<NodeId>(v), list);
+      sort_small(list, from);
+      nodes.push_back(static_cast<NodeId>(v));
+      offsets.push_back(static_cast<std::int32_t>(list.size()));
+    }
+    via = list;
+    parents.resize(via.size());
+    for (std::size_t k = 0; k < via.size(); ++k) parents[k] = esrc[static_cast<std::size_t>(via[k])];
+    // Ascending EdgeId = grouped by source (EdgeIds rank by source first), ascending within one.
+    std::vector<std::int32_t> slot(n + 1, 0);
+    for (NodeId p : parents) ++slot[static_cast<std::size_t>(p) + 1];
+    for (std::size_t v = 1; v <= n; ++v) slot[v] += slot[v - 1];
+    asc.resize(via.size());
+    for (std::size_t k = 0; k < via.size(); ++k) {
+      asc[static_cast<std::size_t>(slot[static_cast<std::size_t>(parents[k])]++)] = via[k];
+    }
+    for (std::size_t v = 0, from = 0; v < n; ++v) {
+      const auto to = static_cast<std::size_t>(slot[v]);
+      if (to - from > 1) std::sort(asc.begin() + static_cast<std::ptrdiff_t>(from), asc.begin() + static_cast<std::ptrdiff_t>(to));
+      from = to;
+    }
+  } else {
+    const auto row = g.outgoing_offsets();
+    for (std::size_t u = 0; u < n; ++u) {
+      if (ws.predecessor_list_heads[u] < 0) continue;
+      if (!em.collapse_parallel_edges && row[u + 1] - row[u] <= 64) {
+        // The list holds distinct out-edges of u, ids in [row[u], row[u + 1]): one bit per id gives
+        // them in ascending order without a sort.
+        std::uint64_t bits = 0;
+        for (std::int32_t k = ws.predecessor_list_heads[u]; k >= 0; k = ws.pool[static_cast<std::size_t>(k)].next) {
+          bits |= std::uint64_t {1} << (ws.pool[static_cast<std::size_t>(k)].edge - row[u]);
+        }
+        for (; bits != 0; bits &= bits - 1) list.push_back(row[u] + std::countr_zero(bits));
+        continue;
+      }
+      const std::size_t from = list.size();
+      read_list(ws, em, static_cast<NodeId>(u), list);
+      sort_small(list, from);
+    }
+    asc = list;  // grouped by source in ascending NodeId, ascending within each: ascending EdgeId
+    std::vector<std::int32_t> slot(n + 1, 0);
+    for (EdgeId e : asc) ++slot[static_cast<std::size_t>(edst[static_cast<std::size_t>(e)]) + 1];
+    for (std::size_t v = 1; v <= n; ++v) slot[v] += slot[v - 1];
+    via.resize(asc.size());
+    for (EdgeId e : asc) via[static_cast<std::size_t>(slot[static_cast<std::size_t>(edst[static_cast<std::size_t>(e)])]++)] = e;
+    parents.resize(via.size());
+    for (std::size_t k = 0; k < via.size(); ++k) parents[k] = esrc[static_cast<std::size_t>(via[k])];
+    for (std::size_t v = 0, from = 0; v < n; ++v) {
+      const auto to = static_cast<std::size_t>(slot[v]);  // the end of child v's entries
+      if (to > from) {
+        nodes.push_back(static_cast<NodeId>(v));
+        offsets.push_back(static_cast<std::int32_t>(to));
+      }
+      from = to;
+    }
+  }
+  return PredecessorDAGBuilder::of_parts(g, std::move(nodes), std::move(offsets), std::move(parents), std::move(via),
+                                  std::move(asc));
+}
+
+// The walk back from the targets at d* along the lists (anycast pruning): every tight edge on a
+// walk from a root to a nearest target, Collapse applied, into ws.pruned (any order); the nodes on
+// those walks carry kKeep and are listed in ws.kept.
+void prune(SearchWorkspace& ws, const SearchOutputOptions& em, std::span<const NodeId> targets, Cost dstar) {
+  const NodeId* const other = em.forward ? em.graph->edge_sources().data() : em.graph->edge_destinations().data();
+  ws.pruned.clear();
+  ws.kept.clear();
+  ws.stack.clear();
+  for (NodeId t : targets) {
+    if (ws.distances[static_cast<std::size_t>(t)] != dstar) continue;
+    mark(ws, t, kKeep);
+    ws.kept.push_back(t);
+    ws.stack.push_back(t);
+  }
+  while (!ws.stack.empty()) {
+    const NodeId x = ws.stack.back();
+    ws.stack.pop_back();
+    const std::size_t from = ws.pruned.size();
+    read_list(ws, em, x, ws.pruned);
+    for (std::size_t k = from; k < ws.pruned.size(); ++k) {
+      const NodeId y = other[static_cast<std::size_t>(ws.pruned[k])];
+      if ((ws.flags[static_cast<std::size_t>(y)] & kKeep) != 0) continue;
+      mark(ws, y, kKeep);
+      ws.kept.push_back(y);
+      ws.stack.push_back(y);
+    }
+  }
+}
+
+// Choose one path from tight DAG `edges` (ws.pruned, any order) and `nodes` (ws.kept, kKeep).
+// pot(v) is distance from the starts: 0 there, `total` at the ends. Increasing pot orders
+// every predecessor before its child (topological order).
+// Under a HIGHER_* tie_break (`prio`), first maximise the smallest tie value on a walk
+// (its bottleneck), capped by `cap` for a KSP prefix; call this B*. Keep edges with priority >= B*.
+// Then compute minimum remaining hops h from the ends. Start where h is smallest and repeatedly
+// take the lowest EdgeId with h(v) = h(u) - 1. Decreasing h prevents cycles; choosing the smallest
+// eligible id at each position gives the smallest EdgeId sequence among minimum-hop paths.
+struct Walk {
+  std::vector<EdgeId> edges {};  // in walk order
+  Cost cost {0};
+  Priority bottleneck {0, 1, true};  // the minimum priority along the walk (prio given)
+};
+
+template <class Pot>
+Walk extract(SearchWorkspace& ws, const Graph& graph, Pot pot, Cost total, const PriorityReader* prio, const Priority* cap) {
+  auto& nodes = ws.kept;
+  auto& edges = ws.pruned;
+  const auto esrc = graph.edge_sources();
+  const auto edst = graph.edge_destinations();
+  const auto cost = graph.edge_costs();
+  std::sort(nodes.begin(), nodes.end(), [&](NodeId a, NodeId b) {
+    const Cost pa = pot(a);
+    const Cost pb = pot(b);
+    return pa != pb ? pa < pb : a < b;
+  });
+  std::sort(edges.begin(), edges.end());
+  const std::size_t k = nodes.size();
+  for (std::size_t i = 0; i < k; ++i) ws.local_positions[static_cast<std::size_t>(nodes[i])] = static_cast<std::int32_t>(i);
+  auto local = [&](NodeId v) { return static_cast<std::size_t>(ws.local_positions[static_cast<std::size_t>(v)]); };
+  // Local CSRs over the edges in ascending EdgeId: out-lists by tail, in-lists by head.
+  ws.outgoing_offsets.assign(k + 1, 0);
+  ws.incoming_offsets.assign(k + 1, 0);
+  for (EdgeId e : edges) {
+    ++ws.outgoing_offsets[local(esrc[static_cast<std::size_t>(e)]) + 1];
+    ++ws.incoming_offsets[local(edst[static_cast<std::size_t>(e)]) + 1];
+  }
+  for (std::size_t i = 1; i <= k; ++i) {
+    ws.outgoing_offsets[i] += ws.outgoing_offsets[i - 1];
+    ws.incoming_offsets[i] += ws.incoming_offsets[i - 1];
+  }
+  ws.outgoing_edge_positions.resize(edges.size());
+  ws.incoming_edge_positions.resize(edges.size());
+  ws.hops.assign(k, 0);  // reused as the fill cursors, then as h
+  for (std::size_t p = 0; p < edges.size(); ++p) {
+    const std::size_t t = local(esrc[static_cast<std::size_t>(edges[p])]);
+    ws.outgoing_edge_positions[static_cast<std::size_t>(ws.outgoing_offsets[t] + ws.hops[t]++)] = static_cast<std::int32_t>(p);
+  }
+  std::fill(ws.hops.begin(), ws.hops.end(), 0);
+  for (std::size_t p = 0; p < edges.size(); ++p) {
+    const std::size_t h = local(edst[static_cast<std::size_t>(edges[p])]);
+    ws.incoming_edge_positions[static_cast<std::size_t>(ws.incoming_offsets[h] + ws.hops[h]++)] = static_cast<std::int32_t>(p);
+  }
+  ws.keep_edge.assign(edges.size(), 1);
+  if (prio != nullptr) {
+    ws.best.assign(k, Priority {});
+    ws.has_best.assign(k, 0);
+    for (std::size_t i = 0; i < k && pot(nodes[i]) == 0; ++i) {
+      ws.best[i] = Priority {0, 1, true};
+      ws.has_best[i] = 1;
+    }
+    for (std::size_t i = 0; i < k; ++i) {
+      if (ws.has_best[i] == 0) continue;
+      for (auto s = ws.outgoing_offsets[i]; s < ws.outgoing_offsets[i + 1]; ++s) {
+        const EdgeId e = edges[static_cast<std::size_t>(ws.outgoing_edge_positions[static_cast<std::size_t>(s)])];
+        Priority c = (*prio)(e);
+        if (compare(ws.best[i], c) < 0) c = ws.best[i];
+        const std::size_t j = local(edst[static_cast<std::size_t>(e)]);
+        if (ws.has_best[j] == 0 || compare(c, ws.best[j]) > 0) {
+          ws.best[j] = c;
+          ws.has_best[j] = 1;
+        }
+      }
+    }
+    std::optional<Priority> b_star;
+    for (std::size_t i = k; i-- > 0 && pot(nodes[i]) == total;) {
+      if (ws.has_best[i] != 0 && (!b_star.has_value() || compare(ws.best[i], *b_star) > 0)) b_star = ws.best[i];
+    }
+    if (!b_star.has_value()) throw std::logic_error("canonical path: no walk reaches an end of the tight DAG");
+    if (cap != nullptr && compare(*cap, *b_star) < 0) b_star = *cap;
+    for (std::size_t p = 0; p < edges.size(); ++p) ws.keep_edge[p] = compare((*prio)(edges[p]), *b_star) >= 0 ? 1 : 0;
+  }
+  // h: the hop count to the nearest end inside the (restricted) DAG; -1 where none is reached.
+  auto& h = ws.hops;
+  std::fill(h.begin(), h.end(), -1);
+  auto& queue = ws.stack;
+  queue.clear();
+  for (std::size_t i = k; i-- > 0 && pot(nodes[i]) == total;) {
+    h[i] = 0;
+    queue.push_back(nodes[i]);
+  }
+  for (std::size_t qi = 0; qi < queue.size(); ++qi) {
+    const std::size_t x = local(queue[qi]);
+    for (auto s = ws.incoming_offsets[x]; s < ws.incoming_offsets[x + 1]; ++s) {
+      const auto p = static_cast<std::size_t>(ws.incoming_edge_positions[static_cast<std::size_t>(s)]);
+      if (ws.keep_edge[p] == 0) continue;
+      const std::size_t y = local(esrc[static_cast<std::size_t>(edges[p])]);
+      if (h[y] < 0) {
+        h[y] = h[x] + 1;
+        queue.push_back(nodes[y]);
+      }
+    }
+  }
+  // The first qualifying out-edge of a node (out-lists ascending: its smallest), or -1.
+  auto next_edge = [&](std::size_t x) -> EdgeId {
+    for (auto s = ws.outgoing_offsets[x]; s < ws.outgoing_offsets[x + 1]; ++s) {
+      const auto p = static_cast<std::size_t>(ws.outgoing_edge_positions[static_cast<std::size_t>(s)]);
+      if (ws.keep_edge[p] == 0) continue;
+      const EdgeId e = edges[p];
+      if (h[local(edst[static_cast<std::size_t>(e)])] == h[x] - 1) return e;
+    }
+    return -1;
+  };
+  std::int32_t hmin = -1;
+  for (std::size_t i = 0; i < k && pot(nodes[i]) == 0; ++i) {
+    if (h[i] >= 0 && (hmin < 0 || h[i] < hmin)) hmin = h[i];
+  }
+  if (hmin <= 0) throw std::logic_error("canonical path: no start reaches an end of the restricted DAG");
+  EdgeId pick = -1;
+  for (std::size_t i = 0; i < k && pot(nodes[i]) == 0; ++i) {
+    if (h[i] != hmin) continue;
+    const EdgeId e = next_edge(i);
+    if (e >= 0 && (pick < 0 || e < pick)) pick = e;
+  }
+  Walk out;
+  out.edges.reserve(static_cast<std::size_t>(hmin));
+  while (pick >= 0) {
+    out.edges.push_back(pick);
+    out.cost += cost[static_cast<std::size_t>(pick)];
+    if (prio != nullptr) {
+      const Priority p = (*prio)(pick);
+      if (compare(p, out.bottleneck) < 0) out.bottleneck = p;
+    }
+    const std::size_t v = local(edst[static_cast<std::size_t>(pick)]);
+    if (h[v] == 0) break;
+    pick = next_edge(v);
+  }
+  if (out.edges.size() != static_cast<std::size_t>(hmin) || out.cost != total) {
+    throw std::logic_error("canonical path: the greedy walk is not a shortest walk of the DAG");
+  }
+  return out;
+}
+
+// The live (allowed) members of a sorted node set.
+std::vector<NodeId> allowed_nodes(std::span<const NodeId> set, const Eligibility* eligibility) {
+  std::vector<NodeId> out;
+  out.reserve(set.size());
+  for (NodeId v : set) {
+    if (eligibility == nullptr || eligibility->allows_node(v)) out.push_back(v);
+  }
+  return out;
+}
+
+SearchOutputOptions emit_of(const Graph& graph, Direction direction, const RouteChoice& choice, const PriorityReader& prio) {
+  SearchOutputOptions em;
+  em.graph = &graph;
+  em.forward = direction == Direction::Forward;
+  em.collapse_parallel_edges = !choice.parallel_edges;
+  em.prefer_priority = choice.prefers_score();
+  em.priority = prio;
+  return em;
+}
+
+// One KSP spur search: the canonical walk from `spur` to `destination` over the
+// candidates of `gate`, without the excluded prefix nodes, with the spur node's banned
+// transitions (Expand: the banned edges; Collapse: every edge to a banned head, no re-selection),
+// B* capped by `cap` (the root prefix's bottleneck). nullopt when `destination` is unreachable.
+std::optional<Walk> spur_walk(const Graph& graph, const SearchFilter& gate, const RouteChoice& choice, const PriorityReader& prio,
+                              NodeId spur, NodeId destination, std::span<const NodeId> excluded, std::span<const EdgeId> banned,
+                              const Priority* cap) {
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  mark(ws, destination, kTarget);
+  for (NodeId v : excluded) mark(ws, v, kExcluded);
+  Spur rule;
+  rule.node = spur;
+  if (choice.parallel_edges) {
+    rule.banned_edges = banned;
+  } else {
+    rule.ban_heads = true;
+    for (EdgeId e : banned) mark(ws, graph.edge_destinations()[static_cast<std::size_t>(e)], kBannedHead);
+  }
+  const NodeId roots[1] = {spur};
+  SearchInput in;
+  in.graph = &graph;
+  in.filter = gate;
+  in.roots = roots;
+  in.targets = true;
+  in.spur = &rule;
+  const Cost dstar = run_search(ws, in);
+  if (dstar == kInf) return std::nullopt;
+  const SearchOutputOptions em = emit_of(graph, Direction::Forward, choice, prio);
+  const NodeId targets[1] = {destination};
+  prune(ws, em, targets, dstar);
+  const bool prefer = choice.prefers_score();
+  return extract(ws, graph, [&](NodeId v) { return ws.distances[static_cast<std::size_t>(v)]; }, dstar,
+                 prefer ? &prio : nullptr, cap);
+}
+
+
+// The walks of resolve_to_paths (validated inputs): see the public function.
+std::vector<Path> enumerate_paths(const Graph& graph, const PredecessorDAG& dag, NodeId source, NodeId destination, bool split,
+                                  std::optional<std::int64_t> max_paths) {
+  const auto children = PredecessorDAGBuilder::member_nodes(dag);
+  const auto offsets = PredecessorDAGBuilder::member_offsets(dag);
+  const auto parents = dag.parents();
+  const auto via = dag.via_edges();
+  const auto cost = graph.edge_costs();
+  std::vector<Path> out;
+  // The entries of a child: [offsets[i], offsets[i + 1]) for children[i], none for another node.
+  auto entries_of = [&](NodeId v) -> std::pair<std::int32_t, std::int32_t> {
+    const auto it = std::lower_bound(children.begin(), children.end(), v);
+    if (it == children.end() || *it != v) return {0, 0};
+    const auto i = static_cast<std::size_t>(it - children.begin());
+    return {offsets[i], offsets[i + 1]};
+  };
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  // The nodes that reach destination inside the DAG (the walk back over the entries), local index by
+  // discovery.
+  auto& kept = ws.kept;
+  kept.clear();
+  ws.stack.clear();
+  mark(ws, destination, kKeep);
+  kept.push_back(destination);
+  ws.stack.push_back(destination);
+  while (!ws.stack.empty()) {
+    const NodeId v = ws.stack.back();
+    ws.stack.pop_back();
+    const auto [lo, hi] = entries_of(v);
+    for (auto k = lo; k < hi; ++k) {
+      const NodeId u = parents[static_cast<std::size_t>(k)];
+      if ((ws.flags[static_cast<std::size_t>(u)] & kKeep) != 0) continue;
+      mark(ws, u, kKeep);
+      kept.push_back(u);
+      ws.stack.push_back(u);
+    }
+  }
+  if ((ws.flags[static_cast<std::size_t>(source)] & kKeep) == 0) return out;  // source is not on a walk to destination
+  for (std::size_t i = 0; i < kept.size(); ++i) ws.local_positions[static_cast<std::size_t>(kept[i])] = static_cast<std::int32_t>(i);
+  auto local = [&](NodeId v) { return static_cast<std::size_t>(ws.local_positions[static_cast<std::size_t>(v)]); };
+  // The hops: per child, its entries come in ascending via, so grouped by parent (EdgeIds rank by
+  // source first); a hop is one parent's run (its members ascending, its cost the cheapest, its
+  // key the lowest id), or one member when split.
+  struct Hop {
+    std::int32_t tail;
+    std::int32_t head;
+    std::int32_t first;  // the members are via[first .. first + count)
+    std::int32_t count;
+    Cost cost;
+    EdgeId key;
+  };
+  std::vector<Hop> hops;
+  for (NodeId v : kept) {
+    const auto [lo, hi] = entries_of(v);
+    for (auto k = lo; k < hi;) {
+      const NodeId u = parents[static_cast<std::size_t>(k)];
+      auto end = k + 1;
+      while (end < hi && parents[static_cast<std::size_t>(end)] == u) ++end;
+      if (split) {
+        for (auto m = k; m < end; ++m) {
+          const EdgeId e = via[static_cast<std::size_t>(m)];
+          hops.push_back({static_cast<std::int32_t>(local(u)), static_cast<std::int32_t>(local(v)), m, 1,
+                          cost[static_cast<std::size_t>(e)], e});
+        }
+      } else {
+        Cost c = cost[static_cast<std::size_t>(via[static_cast<std::size_t>(k)])];
+        for (auto m = k + 1; m < end; ++m) c = std::min(c, cost[static_cast<std::size_t>(via[static_cast<std::size_t>(m)])]);
+        hops.push_back({static_cast<std::int32_t>(local(u)), static_cast<std::int32_t>(local(v)), k, end - k, c,
+                        via[static_cast<std::size_t>(k)]});
+      }
+      k = end;
+    }
+  }
+  const std::size_t n = kept.size();
+  std::vector<std::int32_t> out_off(n + 1, 0);
+  for (const auto& h : hops) ++out_off[static_cast<std::size_t>(h.tail) + 1];
+  for (std::size_t i = 1; i <= n; ++i) out_off[i] += out_off[i - 1];
+  std::vector<std::int32_t> out_hop(hops.size());
+  {
+    std::vector<std::int32_t> fill(out_off.begin(), out_off.end() - 1);
+    for (std::size_t h = 0; h < hops.size(); ++h) {
+      out_hop[static_cast<std::size_t>(fill[static_cast<std::size_t>(hops[h].tail)]++)] = static_cast<std::int32_t>(h);
+    }
+  }
+  // A completion is a walk suffix from a node to destination. Per node: the completions found so far
+  // (sorted) and a heap holding the next completion through each hop.
+  struct PathCompletion {
+    Cost cost;
+    std::int64_t hops;
+    std::int32_t hop;   // -1: the empty completion of destination
+    std::int64_t rank;  // the completion of the hop's head this one extends
+  };
+  struct CompletionCandidate {
+    Cost cost;
+    std::int64_t hops;
+    EdgeId key;
+    std::int32_t hop;
+    std::int64_t rank;
+  };
+  auto after = [](const CompletionCandidate& a, const CompletionCandidate& b) {  // a pops after b: (cost, hops, key) ascending
+    if (a.cost != b.cost) return a.cost > b.cost;
+    if (a.hops != b.hops) return a.hops > b.hops;
+    return a.key > b.key;
+  };
+  std::vector<std::vector<PathCompletion>> list(n);
+  std::vector<std::vector<CompletionCandidate>> heap(n);
+  std::vector<std::uint8_t> ready(n, 0);
+  const std::size_t t = local(destination);
+  list[t].push_back({0, 0, -1, -1});
+  ready[t] = 1;  // a walk ends at destination: its out-hops never extend a completion
+  auto offer = [&](std::size_t x, std::int32_t h, std::int64_t rank) {
+    const auto& s = list[static_cast<std::size_t>(hops[static_cast<std::size_t>(h)].head)][static_cast<std::size_t>(rank)];
+    heap[x].push_back({hops[static_cast<std::size_t>(h)].cost + s.cost, s.hops + 1, hops[static_cast<std::size_t>(h)].key, h, rank});
+    std::push_heap(heap[x].begin(), heap[x].end(), after);
+  };
+  // get(x, i): whether node x has an i-th completion (computing it if needed), with an explicit
+  // frame stack. Stages: 0 entry, 1 the next hop to initialise, 2 back from initialising one,
+  // 3 pop the next completion, 4 back from extending the popped hop.
+  struct Frame {
+    std::size_t x;
+    std::int64_t i;
+    int stage;
+    std::int32_t k;
+    std::int64_t r;
+  };
+  std::vector<Frame> frames;
+  auto get = [&](std::size_t x0, std::int64_t i0) {
+    frames.assign(1, Frame {x0, i0, 0, 0, 0});
+    bool ret = false;
+    while (!frames.empty()) {
+      const std::size_t top = frames.size() - 1;
+      Frame f = frames[top];
+      switch (f.stage) {
+        case 0:
+          if (static_cast<std::int64_t>(list[f.x].size()) > f.i) {
+            ret = true;
+            frames.pop_back();
+          } else if (ready[f.x] == 0) {
+            frames[top].stage = 1;
+            frames[top].k = out_off[f.x];
+          } else {
+            frames[top].stage = 3;
+          }
+          break;
+        case 1:
+          if (f.k == out_off[f.x + 1]) {
+            ready[f.x] = 1;
+            frames[top].stage = 3;
+          } else {
+            frames[top].stage = 2;
+            frames.push_back({static_cast<std::size_t>(hops[static_cast<std::size_t>(out_hop[static_cast<std::size_t>(f.k)])].head), 0,
+                              0, 0, 0});
+          }
+          break;
+        case 2:
+          if (ret) offer(f.x, out_hop[static_cast<std::size_t>(f.k)], 0);
+          frames[top].k = f.k + 1;
+          frames[top].stage = 1;
+          break;
+        case 3: {
+          auto& hx = heap[f.x];
+          if (hx.empty()) {
+            ret = false;
+            frames.pop_back();
+            break;
+          }
+          std::pop_heap(hx.begin(), hx.end(), after);
+          const CompletionCandidate c = hx.back();
+          hx.pop_back();
+          list[f.x].push_back({c.cost, c.hops, c.hop, c.rank});
+          frames[top].stage = 4;
+          frames[top].k = c.hop;
+          frames[top].r = c.rank + 1;
+          frames.push_back({static_cast<std::size_t>(hops[static_cast<std::size_t>(c.hop)].head), c.rank + 1, 0, 0, 0});
+          break;
+        }
+        default:  // 4
+          if (ret) offer(f.x, f.k, f.r);
+          frames[top].stage = 0;
+          break;
+      }
+    }
+    return ret;
+  };
+  const std::size_t s = local(source);
+  for (std::int64_t j = 0; !max_paths.has_value() || j < *max_paths; ++j) {
+    if (!get(s, j)) break;
+    std::vector<std::vector<EdgeId>> walk;
+    std::size_t x = s;
+    std::int64_t idx = j;
+    while (x != t) {
+      const PathCompletion& e = list[x][static_cast<std::size_t>(idx)];
+      const Hop& h = hops[static_cast<std::size_t>(e.hop)];
+      walk.emplace_back(via.begin() + h.first, via.begin() + h.first + h.count);
+      x = static_cast<std::size_t>(h.head);
+      idx = e.rank;
+    }
+    out.push_back(PathBuilder::of_hops(graph, std::move(walk)));
+  }
+  return out;
+}
+
+} // namespace
+
+std::optional<SearchRoute> route_search(const Graph& graph, const SearchFilter& gate, const RouteChoice& choice, NodeId source,
+                                        std::span<const NodeId> destinations) {
+  if (destinations.empty()) return std::nullopt;
+  const PriorityValues values {&graph, choice.tie_break, gate.residual};
+  const PriorityReader prio = PriorityReader::of(values);
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  for (NodeId t : destinations) mark(ws, t, kTarget);
+  const NodeId roots[1] = {source};
+  SearchInput in;
+  in.graph = &graph;
+  in.filter = gate;
+  in.roots = roots;
+  in.targets = true;
+  const Cost dstar = run_search(ws, in);
+  if (dstar == kInf) return std::nullopt;
+  const SearchOutputOptions em = emit_of(graph, Direction::Forward, choice, prio);
+  prune(ws, em, destinations, dstar);
+  SearchRoute out;
+  out.cost = dstar;
+  const bool prefer = choice.prefers_score();
+  auto walk = extract(ws, graph, [&](NodeId v) { return ws.distances[static_cast<std::size_t>(v)]; }, dstar,
+                      prefer ? &prio : nullptr, nullptr);
+  out.edges = std::move(walk.edges);
+  return out;
+}
+
+SearchRoute support_route(const Graph& graph, std::span<const EdgeId> support, NodeId source, std::span<const NodeId> destinations,
+                          const RouteChoice& choice, PriorityReader view) {
+  const auto row = graph.outgoing_offsets();
+  const auto edst = graph.edge_destinations();
+  const auto esrc = graph.edge_sources();
+  const auto cost = graph.edge_costs();
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  for (NodeId t : destinations) mark(ws, t, kTarget);
+  // The part of the support reachable from source: every walk of a support from one node has one
+  // cost to each node it reaches (the support is a reverse multipath DAG), so the order of the
+  // walk assigns each node its distance from source exactly.
+  auto& route = ws.pruned;
+  route.clear();
+  ws.kept.clear();
+  ws.stack.clear();
+  mark(ws, source, kKeep);
+  ws.kept.push_back(source);
+  ws.touched.push_back(source);
+  ws.distances[static_cast<std::size_t>(source)] = 0;
+  ws.stack.push_back(source);
+  Cost total = kInf;
+  while (!ws.stack.empty()) {
+    const NodeId u = ws.stack.back();
+    ws.stack.pop_back();
+    const auto ui = static_cast<std::size_t>(u);
+    if ((ws.flags[ui] & kTarget) != 0) total = ws.distances[ui];
+    auto it = std::lower_bound(support.begin(), support.end(), row[ui]);
+    for (; it != support.end() && *it < row[ui + 1]; ++it) {
+      route.push_back(*it);
+      const NodeId v = edst[static_cast<std::size_t>(*it)];
+      const auto vi = static_cast<std::size_t>(v);
+      if ((ws.flags[vi] & kKeep) != 0) continue;
+      mark(ws, v, kKeep);
+      ws.kept.push_back(v);
+      ws.touched.push_back(v);
+      ws.distances[vi] = ws.distances[ui] + cost[static_cast<std::size_t>(*it)];
+      ws.stack.push_back(v);
+    }
+  }
+  SearchRoute out;
+  if (total == kInf) return out;  // no destination reached (the roster excludes such a source)
+  std::sort(route.begin(), route.end());
+  const bool prefer = choice.prefers_score();
+  if (!choice.parallel_edges) {
+    // One member per (u, v) by replaces() on the view (no gating: the support's members are
+    // all statically eligible). The members of a pair in the support have one cost, so they are
+    // consecutive in id order (EdgeIds rank by (source, cost, destination, input)).
+    std::size_t w = 0;
+    for (std::size_t i = 0; i < route.size();) {
+      const auto ei = static_cast<std::size_t>(route[i]);
+      EdgeId best = route[i];
+      std::size_t j = i + 1;
+      for (; j < route.size() && esrc[static_cast<std::size_t>(route[j])] == esrc[ei] &&
+             edst[static_cast<std::size_t>(route[j])] == edst[ei];
+           ++j) {
+        if (replaces(graph, route[j], best, prefer, view)) best = route[j];
+      }
+      route[w++] = best;
+      i = j;
+    }
+    route.resize(w);
+  }
+  out.cost = total;
+  if (!choice.single_path()) {
+    out.edges = route;
+    return out;
+  }
+  auto walk = extract(ws, graph, [&](NodeId v) { return ws.distances[static_cast<std::size_t>(v)]; }, total,
+                      prefer ? &view : nullptr, nullptr);
+  out.edges = std::move(walk.edges);
+  std::sort(out.edges.begin(), out.edges.end());
+  return out;
+}
+
+PredecessorDAG static_support(const Graph& graph, std::span<const NodeId> roots, Direction direction, const Eligibility* eligibility) {
+  const auto live_roots = allowed_nodes(roots, eligibility);
+  if (live_roots.empty()) return PredecessorDAGBuilder::empty(graph);
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  SearchInput in;
+  in.graph = &graph;
+  in.filter.eligibility = eligibility;
+  in.direction = direction;
+  in.roots = live_roots;
+  (void)run_search(ws, in);
+  SearchOutputOptions em;
+  em.graph = &graph;
+  em.forward = direction == Direction::Forward;
+  return emit_full(ws, em);
+}
+
+std::vector<Cost> static_costs(const Graph& graph, const Eligibility* eligibility, std::span<const NodeId> destinations,
+                               std::span<const NodeId> sources) {
+  std::vector<Cost> out(sources.size(), kInf);
+  const auto roots = allowed_nodes(destinations, eligibility);
+  if (roots.empty()) return out;
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  SearchInput in;
+  in.graph = &graph;
+  in.filter.eligibility = eligibility;
+  in.direction = Direction::Reverse;
+  in.roots = roots;
+  in.collect_predecessors = false;
+  (void)run_search(ws, in);
+  for (std::size_t i = 0; i < sources.size(); ++i) out[i] = ws.distances[static_cast<std::size_t>(sources[i])];
+  return out;
+}
+
+void check_ceiling(const std::optional<CostCeiling>& ceiling) {
+  if (!ceiling.has_value()) return;
+  if (const auto* a = std::get_if<AbsoluteCost>(&*ceiling)) {
+    if (a->cost < 0) throw std::invalid_argument("cost_ceiling AbsoluteCost cost must be >= 0 (got " + std::to_string(a->cost) + ")");
+    return;
+  }
+  const auto& f = std::get<CostStretch>(*ceiling);
+  if (f.numerator() < f.denominator()) {
+    throw std::invalid_argument("cost_ceiling CostStretch factor must be >= 1 (got " + std::to_string(f.numerator()) + "/" +
+                                std::to_string(f.denominator()) + ")");
+  }
+}
+
+} // namespace netgraph::core::detail
+
+namespace netgraph::core {
+
+SpfOptions::SpfOptions(Direction direction_) : direction(direction_) {
+  detail::check_member(direction, "direction");
+}
+
+SpfResult spf(const Graph& graph, std::span<const NodeId> roots, const SpfOptions& options, SpfQueue queue) {
+  using namespace detail;
+  check_member(options.direction, "direction");
+  check_member(options.tie_break, "tie_break");
+  check_member(queue, "queue");
+  const auto root_set = node_set(roots, graph.num_nodes(), "roots");
+  std::vector<NodeId> target_set;
+  if (options.targets.has_value()) {
+    target_set = node_set(*options.targets, graph.num_nodes(), "targets");
+    check_disjoint(root_set, target_set, "roots", "targets");
+  } else if (!options.multipath) {
+    throw std::invalid_argument("multipath = false requires targets (the single path joins a root to a target)");
+  }
+  const RouteChoice choice {options.tie_break, options.multipath, options.parallel_edges};
+  if (choice.tie_is_ineffective()) {
+    throw std::invalid_argument("spf tie_break requires multipath=False or parallel_edges=False");
+  }
+  const std::span<const Amount> residual = options.residual.value_or(std::span<const Amount> {});
+  if (options.residual.has_value()) check_edge_amounts(graph, residual, "residual");
+  if (options.min_residual < 1) {
+    throw std::invalid_argument("min_residual must be at least 1 unit (got " + std::to_string(options.min_residual) + ")");
+  }
+  if (options.eligibility != nullptr && options.eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  const PriorityValues values {&graph, choice.tie_break, residual};
+  const PriorityReader prio = PriorityReader::of(values);
+  const SearchOutputOptions em = emit_of(graph, options.direction, choice, prio);
+  const auto live_roots = allowed_nodes(root_set, options.eligibility);
+  SearchInput in;
+  in.graph = &graph;
+  in.filter = SearchFilter {options.eligibility, residual, options.min_residual};
+  in.direction = options.direction;
+  in.queue = queue;
+  in.roots = live_roots;
+  if (!options.targets.has_value()) {
+    const auto n = static_cast<std::size_t>(graph.num_nodes());
+    if (live_roots.empty()) {
+      return SpfResult {std::vector<Cost>(n, kUnreachable), PredecessorDAGBuilder::empty(graph), std::nullopt};
+    }
+    SearchWorkspaceLease lease(n);
+    SearchWorkspace& ws = lease.workspace();
+    (void)run_search(ws, in);
+    std::vector<Cost> costs(ws.distances.begin(), ws.distances.begin() + static_cast<std::ptrdiff_t>(n));
+    PredecessorDAG dag = emit_full(ws, em);
+    return SpfResult {std::move(costs), std::move(dag), std::nullopt};
+  }
+  const auto live_targets = allowed_nodes(target_set, options.eligibility);
+  if (live_roots.empty() || live_targets.empty()) return SpfResult {std::nullopt, PredecessorDAGBuilder::empty(graph), kUnreachable};
+  SearchWorkspaceLease lease(static_cast<std::size_t>(graph.num_nodes()));
+  SearchWorkspace& ws = lease.workspace();
+  for (NodeId t : live_targets) mark(ws, t, kTarget);
+  in.targets = true;
+  const Cost dstar = run_search(ws, in);
+  if (dstar == kInf) return SpfResult {std::nullopt, PredecessorDAGBuilder::empty(graph), kUnreachable};
+  prune(ws, em, live_targets, dstar);
+  if (!choice.single_path()) return SpfResult {std::nullopt, PredecessorDAGBuilder::of_edges(graph, ws.pruned), dstar};
+  // The walks run from the walk starts (Forward: the roots; Reverse: the targets) to the ends;
+  // the potential is the forward distance from the starts (Reverse: d* - the distance to the roots).
+  const bool prefer = choice.prefers_score();
+  Walk walk;
+  if (options.direction == Direction::Forward) {
+    walk = extract(ws, graph, [&](NodeId v) { return ws.distances[static_cast<std::size_t>(v)]; }, dstar,
+                   prefer ? &prio : nullptr, nullptr);
+  } else {
+    walk = extract(ws, graph, [&](NodeId v) { return dstar - ws.distances[static_cast<std::size_t>(v)]; }, dstar,
+                   prefer ? &prio : nullptr, nullptr);
+  }
+  return SpfResult {std::nullopt, PredecessorDAGBuilder::of_edges(graph, walk.edges), dstar};
+}
+
+
+KspOptions::KspOptions(std::int64_t k_) : k(k_) {}
+
+std::vector<std::pair<Cost, Path>> ksp(const Graph& graph, NodeId source, NodeId destination, const KspOptions& options) {
+  using namespace detail;
+  check_member(options.tie_break, "tie_break");
+  const NodeId s1[1] = {source};
+  const NodeId t1[1] = {destination};
+  check_range(s1, graph.num_nodes(), "source");
+  check_range(t1, graph.num_nodes(), "destination");
+  check_disjoint(s1, t1, "source", "destination");
+  if (options.k < 1) throw std::invalid_argument("k must be >= 1 (got " + std::to_string(options.k) + ")");
+  check_ceiling(options.cost_ceiling);
+  const std::span<const Amount> residual = options.residual.value_or(std::span<const Amount> {});
+  if (options.residual.has_value()) check_edge_amounts(graph, residual, "residual");
+  if (options.eligibility != nullptr && options.eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  std::vector<std::pair<Cost, Path>> out;
+  if (options.eligibility != nullptr && (!options.eligibility->allows_node(source) || !options.eligibility->allows_node(destination))) return out;
+  // The ceiling: AbsoluteCost(c), or CostStretch(f) times the static shortest cost of the member graph
+  // under the Eligibility (residual ignored, as for T1's ceiling); no static route
+  // gives [].
+  const auto* absolute = options.cost_ceiling.has_value() ? std::get_if<AbsoluteCost>(&*options.cost_ceiling) : nullptr;
+  const auto* stretch = options.cost_ceiling.has_value() ? std::get_if<CostStretch>(&*options.cost_ceiling) : nullptr;
+  Cost base = 0;
+  if (stretch != nullptr) {
+    base = static_costs(graph, options.eligibility, t1, s1)[0];
+    if (base == kUnreachable) return out;
+  }
+  auto within = [&](Cost c) {
+    if (absolute != nullptr) return c <= absolute->cost;
+    if (stretch != nullptr) return stretch_le(c, base, stretch->numerator(), stretch->denominator());
+    return true;
+  };
+  const SearchFilter gate {options.eligibility, residual, 1};  // KSP gates a supplied residual at 1 unit
+  // ksp always orders single paths: multipath is not one of its options.
+  const RouteChoice choice {options.tie_break, false, options.parallel_edges};
+  const PriorityValues values {&graph, choice.tie_break, residual};
+  const PriorityReader prio = PriorityReader::of(values);
+  const bool prefer = choice.prefers_score();
+  // Lawler's partition of Yen's alternatives: a path generated at spur d needs expansion
+  // only at j >= d (inclusive). Earlier prefix regions already have their exact pending
+  // minima. Each suffix is the minimum whole prefixed path, including its prefix bottleneck.
+  // The first path and each spur suffix use the canonical search with that spur's exclusions.
+  // Match prefixes by EdgeId sequence. Ban the next edge of every accepted matching path
+  // (Expand), or its entire (u, v) transition (Collapse); exclude earlier prefix vertices to
+  // prevent cycles. Store candidates once in a set ordered by (cost, decreasing bottleneck
+  // under a HIGHER_* tie_break, hops, EdgeId sequence).
+  struct PathCandidate {
+    Cost cost {0};
+    Priority bottleneck {0, 1, true};
+    std::vector<EdgeId> edges {};
+    // Not part of the key. Mutable only so duplicate insertion can retain the lower index
+    // without copying a path or changing the ordering of the set.
+    mutable std::size_t deviation {0};
+  };
+  struct PathCandidateOrder {
+    bool prefer;
+    bool operator()(const PathCandidate& a, const PathCandidate& b) const {
+      if (a.cost != b.cost) return a.cost < b.cost;
+      if (prefer) {
+        const int c = compare(a.bottleneck, b.bottleneck);
+        if (c != 0) return c > 0;
+      }
+      if (a.edges.size() != b.edges.size()) return a.edges.size() < b.edges.size();
+      return a.edges < b.edges;
+    }
+  };
+  auto first = spur_walk(graph, gate, choice, prio, source, destination, {}, {}, nullptr);
+  if (!first.has_value() || !within(first->cost)) return out;
+  std::vector<PathCandidate> accepted;
+  accepted.push_back(PathCandidate {first->cost, first->bottleneck, std::move(first->edges)});
+  std::set<PathCandidate, PathCandidateOrder> candidates(PathCandidateOrder {prefer});
+  const auto edst = graph.edge_destinations();
+  const auto cost = graph.edge_costs();
+  std::vector<NodeId> nodes;
+  std::vector<EdgeId> banned;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const KspProbe* probe = current_ksp_probe();
+#endif
+  while (static_cast<std::int64_t>(accepted.size()) < options.k) {
+    const std::size_t deviation = accepted.back().deviation;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const std::size_t start = probe != nullptr && probe->full_yen ? 0 : deviation;
+#else
+    const std::size_t start = deviation;
+#endif
+    const std::vector<EdgeId> last = accepted.back().edges;
+    nodes.assign(1, source);
+    for (EdgeId e : last) nodes.push_back(edst[static_cast<std::size_t>(e)]);
+    Cost prefix_cost = 0;
+    Priority prefix_bottleneck {0, 1, true};
+    // Skipping searches must not skip the cost or score of any prefix edge.
+    for (std::size_t j = 0; j < start; ++j) {
+      prefix_cost += cost[static_cast<std::size_t>(last[j])];
+      if (prefer) {
+        const Priority pj = prio(last[j]);
+        if (compare(pj, prefix_bottleneck) < 0) prefix_bottleneck = pj;
+      }
+    }
+    for (std::size_t j = start; j < last.size(); ++j) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      if (probe != nullptr && probe->spur != nullptr) probe->spur(probe->context, deviation, j);
+#endif
+      banned.clear();
+      for (const auto& p : accepted) {
+        if (p.edges.size() > j && std::equal(last.begin(), last.begin() + static_cast<std::ptrdiff_t>(j), p.edges.begin())) {
+          banned.push_back(p.edges[j]);
+        }
+      }
+      const std::span<const NodeId> excluded(nodes.data(), j);
+      auto sp = spur_walk(graph, gate, choice, prio, nodes[j], destination, excluded, banned,
+                          prefer && j > 0 ? &prefix_bottleneck : nullptr);
+      if (sp.has_value()) {
+        PathCandidate c;
+        c.cost = prefix_cost + sp->cost;
+        c.bottleneck = compare(sp->bottleneck, prefix_bottleneck) < 0 ? sp->bottleneck : prefix_bottleneck;
+        c.edges.assign(last.begin(), last.begin() + static_cast<std::ptrdiff_t>(j));
+        c.edges.insert(c.edges.end(), sp->edges.begin(), sp->edges.end());
+        c.deviation = j;
+        // Never an accepted path: every accepted path with this prefix has its next edge (Expand)
+        // or its next transition (Collapse) banned at the spur, and the candidate's next edge is
+        // the spur walk's first. Only a pending candidate can be equal; the set keeps one.
+        const auto [pending, inserted] = candidates.insert(std::move(c));
+        if (!inserted) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+          if (probe != nullptr && probe->duplicate != nullptr) probe->duplicate(probe->context, pending->deviation, j);
+#endif
+          // A region is searched only when it is created or its pending minimum is accepted,
+          // so no spur regenerates a pending path. Duplicates arise only under the private
+          // full-Yen control, with equal indices. min keeps the index safe either way.
+          pending->deviation = std::min(pending->deviation, j);
+        }
+      }
+      prefix_cost += cost[static_cast<std::size_t>(last[j])];
+      if (prefer) {
+        const Priority pj = prio(last[j]);
+        if (compare(pj, prefix_bottleneck) < 0) prefix_bottleneck = pj;
+      }
+    }
+    if (candidates.empty()) break;
+    auto best = candidates.begin();
+    if (!within(best->cost)) break;  // every later path costs at least as much
+    accepted.push_back(*best);
+    candidates.erase(best);
+  }
+  out.reserve(accepted.size());
+  for (auto& p : accepted) out.emplace_back(p.cost, PathBuilder::of_walk(graph, p.edges));
+  return out;
+}
+
+std::vector<Path> resolve_to_paths(const Graph& graph, const PredecessorDAG& dag, NodeId source, NodeId destination, bool split_parallel_edges,
+                                   std::optional<std::int64_t> max_paths) {
+  using namespace detail;
+  if (dag.graph_uid() != graph.uid()) throw std::invalid_argument("foreign PredecessorDAG: built for another graph");
+  const NodeId s1[1] = {source};
+  const NodeId t1[1] = {destination};
+  check_range(s1, graph.num_nodes(), "source");
+  check_range(t1, graph.num_nodes(), "destination");
+  check_disjoint(s1, t1, "source", "destination");
+  if (max_paths.has_value() && *max_paths < 1) {
+    throw std::invalid_argument("max_paths must be >= 1 (got " + std::to_string(*max_paths) + ")");
+  }
+  return enumerate_paths(graph, dag, source, destination, split_parallel_edges, max_paths);
+}
+
+} // namespace netgraph::core
diff --git a/src/shortest_path_cache.cpp b/src/shortest_path_cache.cpp
new file mode 100644
index 0000000..e76ee85
--- /dev/null
+++ b/src/shortest_path_cache.cpp
@@ -0,0 +1,162 @@
+/*
+  The ShortestPathCache: a map from (roots, direction, Eligibility uid) to the full static
+  support of that search, with atomic statistics; building mode (a miss searches and inserts) and
+  frozen mode (read-only: concurrent hits read the map and bump atomic counters, a miss throws).
+*/
+#include "netgraph/core/shortest_path_cache.hpp"
+
+#include <algorithm>
+#include <array>
+#include <stdexcept>
+#include <string>
+#include <utility>
+
+#include "netgraph/core/detail/cache_access.hpp"
+#include "netgraph/core/detail/endpoints.hpp"
+#include "netgraph/core/detail/enum_domain.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+
+namespace netgraph::core {
+
+namespace {
+
+// Decrements the live-value counter when the last holder of a value lets it go.
+struct LiveDeleter {
+  std::shared_ptr<std::atomic<std::int64_t>> live;
+  void operator()(const PredecessorDAG* dag) const noexcept {
+    live->fetch_sub(1, std::memory_order_relaxed);
+    delete dag;
+  }
+};
+
+} // namespace
+
+// The key function of ShortestPathCacheMiss (shortest_path_cache.hpp): its vtable and type_info live here only.
+const char* ShortestPathCacheMiss::what() const noexcept { return what_->c_str(); }
+
+ShortestPathCache::ShortestPathCache(const Graph& graph)
+    : gate_(std::make_unique<detail::CacheGate>()), graph_uid_(graph.uid()) {}
+
+ShortestPathCache::~ShortestPathCache() = default;
+
+std::shared_ptr<const PredecessorDAG> ShortestPathCache::lookup(const Graph& graph, std::span<const NodeId> roots,
+                                                Direction direction, const Eligibility* eligibility) {
+  if (graph.uid() != graph_uid_) throw std::invalid_argument("ShortestPathCache: the graph is not the cache's graph (foreign graph)");
+  if (eligibility != nullptr && eligibility->graph_uid() != graph.uid()) throw std::invalid_argument("foreign Eligibility: built for another graph");
+  // Copy borrowed roots before waiting. Small direct hits need no heap allocation.
+  std::array<NodeId, 8> small;
+  std::vector<NodeId> large;
+  std::span<NodeId> owned;
+  if (roots.size() <= small.size()) {
+    owned = std::span(small).first(roots.size());
+    std::copy(roots.begin(), roots.end(), owned.begin());
+  } else {
+    large.assign(roots.begin(), roots.end());
+    owned = large;
+  }
+  if (owned.empty()) (void)detail::node_set(owned, graph.num_nodes(), "roots");
+  detail::check_range(owned, graph.num_nodes(), "roots");
+  std::sort(owned.begin(), owned.end());
+  const auto count = static_cast<std::size_t>(std::unique(owned.begin(), owned.end()) - owned.begin());
+  detail::check_member(direction, "direction");
+  const detail::CacheGate::Lease lease(*gate_);
+  return lookup_in_call(graph, owned.first(count), direction, eligibility, nullptr);
+}
+
+std::shared_ptr<const PredecessorDAG> ShortestPathCache::lookup_in_call(const Graph& graph, std::span<const NodeId> roots,
+                                                        Direction direction, const Eligibility* eligibility,
+                                                        detail::FrozenCacheHitTally* tally) {
+  // Inside a public call a frozen cache's statistics wait for the call's boundary.
+  const bool staged = gate_->frozen() && tally != nullptr && tally->cache() == this;
+  // Invalid queries throw before anything is counted.
+  if (graph.uid() != graph_uid_) throw std::invalid_argument("ShortestPathCache: the graph is not the cache's graph (foreign graph)");
+  if (eligibility != nullptr && eligibility->graph_uid() != graph.uid()) {
+    throw std::invalid_argument("foreign Eligibility: built for another graph");
+  }
+  // The roots as a sorted set: borrowed when the caller's span already is one (a hit then copies
+  // nothing), else normalised (node_set's checks either way, in its order).
+  std::vector<NodeId> normalised;
+  std::span<const NodeId> key_roots = roots;
+  if (roots.empty() || !std::is_sorted(roots.begin(), roots.end()) ||
+      std::adjacent_find(roots.begin(), roots.end()) != roots.end()) {
+    normalised = detail::node_set(roots, graph.num_nodes(), "roots");
+    key_roots = normalised;
+  } else {
+    detail::check_range(roots, graph.num_nodes(), "roots");
+  }
+  detail::check_member(direction, "direction");
+  const std::uint64_t elig_uid = eligibility != nullptr ? eligibility->uid() : 0;
+  const auto it = entries_.find(KeyView {key_roots, direction, elig_uid});
+  if (it != entries_.end()) {
+    if (staged) {
+      tally->hit();
+    } else {
+      hits_.fetch_add(1, std::memory_order_relaxed);
+    }
+    return it->second;
+  }
+  if (gate_->frozen()) {
+    // A frozen miss counts one miss (the lookup found no entry; inside a call, the boundary
+    // counts it) and inserts nothing; the exception is built first, so a failed allocation there
+    // counts nothing.
+    std::string roots_text;
+    for (NodeId r : key_roots) roots_text += (roots_text.empty() ? "" : ", ") + std::to_string(r);
+    const ShortestPathCacheMiss miss("ShortestPathCache: the frozen cache has no entry for roots {" + roots_text + "}, direction " +
+                            (direction == Direction::Forward ? "Forward" : "Reverse") + ", Eligibility uid " +
+                            std::to_string(elig_uid) + " (a frozen cache never searches)");
+    if (!staged) misses_.fetch_add(1, std::memory_order_relaxed);
+    throw miss;
+  }
+  // The entry's owned key first (the borrowed roots copied): a failed copy counts nothing, like a
+  // failed normalisation. Then a failed search (or a failed insertion) inserts nothing and the miss
+  // stays counted.
+  Key key {normalised.empty() ? std::vector<NodeId>(key_roots.begin(), key_roots.end()) : std::move(normalised),
+           direction, elig_uid};
+  misses_.fetch_add(1, std::memory_order_relaxed);
+  auto value = std::make_unique<PredecessorDAG>(detail::static_support(graph, std::get<0>(key), direction, eligibility));
+  const auto bytes = static_cast<std::int64_t>(detail::PredecessorDAGBuilder::payload_bytes(*value));
+  live_->fetch_add(1, std::memory_order_relaxed);  // the deleter runs even if the control block fails
+  std::shared_ptr<const PredecessorDAG> shared(value.release(), LiveDeleter {live_});
+  entries_.emplace(std::move(key), shared);  // strong guarantee: a throw leaves the map unchanged
+  num_entries_.fetch_add(1, std::memory_order_relaxed);
+  bytes_.fetch_add(bytes, std::memory_order_relaxed);
+  return shared;
+}
+
+void ShortestPathCache::freeze() {
+  const detail::CacheGate::Lease lease(*gate_, true);
+  gate_->freeze(true);
+}
+
+void ShortestPathCache::thaw() {
+  const detail::CacheGate::Lease lease(*gate_, true);
+  gate_->freeze(false);
+}
+
+void ShortestPathCache::clear() {
+  const detail::CacheGate::Lease lease(*gate_, true);
+  if (gate_->frozen()) {
+    throw std::invalid_argument(
+        "ShortestPathCache.clear is rejected while the cache is frozen (thaw() it, then clear())");
+  }
+  clear_contents();
+}
+
+void ShortestPathCache::clear_contents() noexcept {
+  entries_.clear();
+  num_entries_.store(0, std::memory_order_relaxed);
+  bytes_.store(0, std::memory_order_relaxed);
+}
+
+ShortestPathCache::Stats ShortestPathCache::stats() const noexcept {
+  Stats s;
+  s.hits = hits_.load(std::memory_order_relaxed);
+  s.misses = misses_.load(std::memory_order_relaxed);
+  s.entries = num_entries_.load(std::memory_order_relaxed);
+  s.bytes = bytes_.load(std::memory_order_relaxed);
+  s.live_values = live_->load(std::memory_order_relaxed);
+  return s;
+}
+
+} // namespace netgraph::core
diff --git a/src/shortest_paths.cpp b/src/shortest_paths.cpp
deleted file mode 100644
index 16a40e5..0000000
--- a/src/shortest_paths.cpp
+++ /dev/null
@@ -1,1130 +0,0 @@
-/* Path enumeration from PredDAG (resolve_to_paths). */
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/profiling.hpp"
-
-#include <algorithm>
-#include <bit>
-#include <cmath>
-#include <cstdint>
-#include <cstdlib>
-#include <limits>
-#include <optional>
-#include <stdexcept>
-#include <string>
-#include <tuple>
-#include <utility>
-#include <vector>
-
-namespace netgraph::core {
-
-static inline void group_parents(const PredDAG& dag, NodeId v,
-                                 std::vector<std::pair<NodeId, std::vector<EdgeId>>>& out) {
-  out.clear();
-  const auto start = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v)]);
-  const auto end   = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v) + 1]);
-  if (start >= end) return;
-  // Collect entries, grouping by parent id
-  // PredDAG does not guarantee sorted by parent; aggregate via map-like linear scan
-  for (std::size_t i = start; i < end; ++i) {
-    auto p = dag.parents[i];
-    auto e = dag.via_edges[i];
-    // find or append group
-    bool found = false;
-    for (auto& pr : out) {
-      if (pr.first == p) { pr.second.push_back(e); found = true; break; }
-    }
-    if (!found) out.emplace_back(p, std::vector<EdgeId>{e});
-  }
-}
-
-std::pair<std::vector<Cost>, PredDAG>
-path_to_pred_dag(const StrictMultiDiGraph& g,
-                 std::span<const NodeId> nodes,
-                 std::span<const EdgeId> edges) {
-  const auto cost_view = g.cost_view();
-  std::vector<Cost> dist(static_cast<std::size_t>(g.num_nodes()),
-                         std::numeric_limits<Cost>::max());
-  PredDAG dag;
-  dag.parent_offsets.assign(static_cast<std::size_t>(g.num_nodes() + 1), 0);
-  if (!nodes.empty()) {
-    dist[static_cast<std::size_t>(nodes.front())] = 0;
-    for (std::size_t i = 1; i < nodes.size(); ++i) {
-      auto u = nodes[i - 1]; auto v = nodes[i]; auto e = edges[i - 1];
-      dist[static_cast<std::size_t>(v)] =
-          dist[static_cast<std::size_t>(u)] + cost_view[static_cast<std::size_t>(e)];
-      dag.parent_offsets[static_cast<std::size_t>(v + 1)] = 1;
-    }
-    for (std::size_t v = 1; v < dag.parent_offsets.size(); ++v)
-      dag.parent_offsets[v] += dag.parent_offsets[v - 1];
-    dag.parents.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-    dag.via_edges.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-    for (std::size_t i = 1; i < nodes.size(); ++i) {
-      auto v = nodes[i];
-      auto base = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v)]);
-      dag.parents[base] = nodes[i - 1];
-      dag.via_edges[base] = edges[i - 1];
-    }
-  }
-  return {std::move(dist), std::move(dag)};
-}
-
-PredDAG make_path_dag(const StrictMultiDiGraph& g, std::span<const EdgeId> edges) {
-  if (edges.empty()) {
-    throw std::invalid_argument("make_path_dag: edges must be non-empty");
-  }
-  const auto E = static_cast<std::size_t>(g.num_edges());
-  const auto esrc = g.edge_src_view();
-  const auto edst = g.edge_dst_view();
-  std::vector<NodeId> nodes;
-  nodes.reserve(edges.size() + 1);
-  std::vector<char> seen(static_cast<std::size_t>(g.num_nodes()), 0);
-  for (std::size_t i = 0; i < edges.size(); ++i) {
-    const auto e = edges[i];
-    if (e < 0 || static_cast<std::size_t>(e) >= E) {
-      throw std::invalid_argument("make_path_dag: edge id out of range");
-    }
-    const auto u = esrc[static_cast<std::size_t>(e)];
-    const auto v = edst[static_cast<std::size_t>(e)];
-    if (i == 0) {
-      nodes.push_back(u);
-      seen[static_cast<std::size_t>(u)] = 1;
-    } else if (u != nodes.back()) {
-      throw std::invalid_argument(
-          "make_path_dag: edges are not contiguous (edge source does not match the "
-          "previous edge's destination)");
-    }
-    if (seen[static_cast<std::size_t>(v)]) {
-      throw std::invalid_argument("make_path_dag: path revisits a node (must be a simple path)");
-    }
-    seen[static_cast<std::size_t>(v)] = 1;
-    nodes.push_back(v);
-  }
-  return path_to_pred_dag(g, nodes, edges).second;
-}
-
-std::vector<std::vector<std::pair<NodeId, std::vector<EdgeId>>>>
-resolve_to_paths(const PredDAG& dag, NodeId src, NodeId dst,
-                 bool split_parallel_edges,
-                 std::optional<std::int64_t> max_paths) {
-  std::vector<std::vector<std::pair<NodeId, std::vector<EdgeId>>>> paths;
-  if (src == dst) {
-    // Trivial path: ((src, ()))
-    std::vector<std::pair<NodeId, std::vector<EdgeId>>> p;
-    p.emplace_back(src, std::vector<EdgeId>{});
-    paths.push_back(std::move(p));
-    return paths;
-  }
-  if (static_cast<std::size_t>(dst) >= dag.parent_offsets.size() - 1) return paths;
-  if (dag.parent_offsets[static_cast<std::size_t>(dst)] == dag.parent_offsets[static_cast<std::size_t>(dst) + 1]) return paths;
-
-  // Iterative DFS stack: each frame holds current node and index into its parent-groups.
-  struct Frame { NodeId node; std::size_t idx; std::vector<std::pair<NodeId, std::vector<EdgeId>>> groups; };
-  std::vector<Frame> stack;
-  stack.reserve(16);
-  // on_path[v] marks nodes on the current DFS stack. A well-formed PredDAG is
-  // acyclic, but zero-cost edges (or a caller-supplied DAG) can contain cycles;
-  // without this guard the enumeration below would walk them forever.
-  std::vector<char> on_path(dag.parent_offsets.size() > 0 ? dag.parent_offsets.size() - 1 : 0, 0);
-  // start from dst
-  Frame start; start.node = dst; start.idx = 0; group_parents(dag, dst, start.groups);
-  stack.push_back(std::move(start));
-  on_path[static_cast<std::size_t>(dst)] = 1;
-
-  std::vector<std::pair<NodeId, std::vector<EdgeId>>> current; // reversed path accum
-
-  while (!stack.empty()) {
-    auto& top = stack.back();
-    if (top.idx >= top.groups.size()) {
-      // backtrack
-      on_path[static_cast<std::size_t>(top.node)] = 0;
-      stack.pop_back();
-      if (!current.empty()) current.pop_back();
-      continue;
-    }
-    auto [parent, edges] = top.groups[top.idx++];
-    // Skip parents already on the current path (cycle in the input DAG).
-    if (parent != src && on_path[static_cast<std::size_t>(parent)]) continue;
-    current.emplace_back(top.node, std::move(edges));
-    if (parent == src) {
-      // reached src; build forward segments: for each hop prev->next store (next, edges)
-      std::vector<std::pair<NodeId, std::vector<EdgeId>>> segments;
-      segments.reserve(current.size());
-      for (auto it = current.rbegin(); it != current.rend(); ++it) {
-        segments.emplace_back(it->first, it->second);
-      }
-      // Build path tuples: (src, edges for src->n1), (n1, edges for n1->n2), ..., (dst, ())
-      std::vector<std::pair<NodeId, std::vector<EdgeId>>> path;
-      path.reserve(segments.size() + 1);
-      if (!segments.empty()) {
-        // src element
-        path.emplace_back(src, segments[0].second);
-        // intermediate elements (attach next hop's edges to current node)
-        for (std::size_t j = 1; j < segments.size(); ++j) {
-          path.emplace_back(segments[j - 1].first, segments[j].second);
-        }
-        // dst element
-        path.emplace_back(segments.back().first, std::vector<EdgeId>{});
-      } else {
-        // Degenerate: src==dst should be handled earlier, but keep form
-        path.emplace_back(src, std::vector<EdgeId>{});
-      }
-      if (!split_parallel_edges) {
-        paths.push_back(std::move(path));
-      } else {
-        // expand cartesian product over edge sets excluding last (dst has empty edges)
-        // collect ranges
-        std::vector<std::size_t> idxs(path.size(), 0);
-        // Enumerate over all elements except the final dst (which has empty edges)
-        const std::size_t start_i = 0;
-        const std::size_t end_i = path.size() - 2; // last index before dst
-        // initialize counters
-        bool done = false;
-        while (!done) {
-          // build one concrete path
-          std::vector<std::pair<NodeId, std::vector<EdgeId>>> concrete;
-          concrete.reserve(path.size());
-          for (std::size_t i = start_i; i <= end_i; ++i) {
-            const auto& node = path[i].first;
-            const auto& eds = path[i].second;
-            if (!eds.empty()) {
-              std::size_t sel = std::min(idxs[i], eds.size() - 1);
-              concrete.emplace_back(node, std::vector<EdgeId>{ eds[sel] });
-            } else {
-              concrete.emplace_back(node, std::vector<EdgeId>{});
-            }
-          }
-          // append dst with empty edges
-          concrete.emplace_back(path.back().first, std::vector<EdgeId>{});
-          paths.push_back(std::move(concrete));
-          if (max_paths && static_cast<std::int64_t>(paths.size()) >= *max_paths) return paths;
-          // increment counters (mixed radix)
-          std::ptrdiff_t k = static_cast<std::ptrdiff_t>(end_i);
-          while (k >= static_cast<std::ptrdiff_t>(start_i)) {
-            if (path[static_cast<std::size_t>(k)].second.empty()) { --k; continue; }
-            idxs[static_cast<std::size_t>(k)]++;
-            if (idxs[static_cast<std::size_t>(k)] < path[static_cast<std::size_t>(k)].second.size()) break;
-            idxs[static_cast<std::size_t>(k)] = 0;
-            if (k == static_cast<std::ptrdiff_t>(start_i)) { done = true; break; }
-            --k;
-          }
-          if (k < static_cast<std::ptrdiff_t>(start_i)) done = true;
-        }
-      }
-      if (max_paths && static_cast<std::int64_t>(paths.size()) >= *max_paths) return paths;
-      current.pop_back();
-      continue;
-    }
-    // descend
-    Frame next; next.node = parent; next.idx = 0; group_parents(dag, parent, next.groups);
-    if (next.groups.empty()) {
-      // dead end, backtrack
-      current.pop_back();
-      continue;
-    }
-    on_path[static_cast<std::size_t>(parent)] = 1;
-    stack.push_back(std::move(next));
-  }
-
-  return paths;
-}
-
-} // namespace netgraph::core
-
-/*
-  Dijkstra shortest path algorithm with capacity-aware tie-breaking.
-
-  Features:
-    - Residual-aware traversal: uses dynamic residuals if provided, otherwise static capacity
-    - Multipath mode: collects all equal-cost predecessor edges per node
-    - Single-path mode: selects one edge per adjacency using:
-      * Edge-level tie-breaking for parallel edges (PreferHigherResidual or Deterministic)
-      * Node-level tie-breaking for equal-cost nodes (prefers higher bottleneck capacity)
-    - Early exit when specific destination is reached
-
-  Frontier queue. The reference queue is a binary heap on (cost, -bottleneck,
-  node). When the graph's costs fit a bounded number of buckets
-  (W = max_cost / gcd(costs) + 1 <= kMaxBucketWidth) the search uses a monotone
-  bucket queue instead: Dijkstra pops costs in non-decreasing order and every
-  push is at least the cost being popped, so with W cyclic buckets each bucket
-  holds exactly one cost value at a time. The active bucket is itself a small
-  heap on (-bottleneck, node), so the pop sequence is identical to the heap's,
-  including zero-cost pushes into the active bucket, single-path re-pushes,
-  stale entries and destination early exit. The two queues therefore produce
-  bit-identical results; ShortestPaths.QueueDifferential_* enforce that.
-
-  Scratch state lives in a thread-local workspace that is reset after each
-  search: only the touched nodes when few were touched, the whole arrays
-  otherwise. This removes the O(N) per-query initialisation that dominated small
-  destination-limited searches on large graphs. A workspace holds no pointer
-  into any graph, residual or mask; see ForwardWorkspace for what it retains
-  between searches and when it shrinks.
-*/
-namespace netgraph::core {
-
-namespace {
-
-constexpr Cost kInf = std::numeric_limits<Cost>::max();
-constexpr std::size_t kMaxBucketWidth = std::size_t{1} << 16;
-
-using QItem = std::tuple<Cost, Cap, NodeId>;
-
-// Reference queue: binary heap on (cost, -bottleneck, node). Keys are unique per
-// push (a node is re-pushed only with a strictly smaller cost or a strictly
-// larger bottleneck), so the pop order is fully determined by the key.
-struct HeapQueue {
-  // Functor, not a function pointer: std::push_heap / pop_heap inline it.
-  struct Greater { bool operator()(const QItem& a, const QItem& b) const { return a > b; } };
-  std::vector<QItem> h;
-  void begin(std::size_t, Cost) { h.clear(); }
-  void end() { h.clear(); }
-  void drop_storage() { std::vector<QItem> fresh; h.swap(fresh); }
-  bool empty() const { return h.empty(); }
-  Cost top_cost() const { return std::get<0>(h.front()); }
-  QItem pop() {
-    std::pop_heap(h.begin(), h.end(), Greater{});
-    QItem t = h.back(); h.pop_back(); return t;
-  }
-  void push(Cost c, Cap nr, NodeId v) {
-    h.emplace_back(c, nr, v);
-    std::push_heap(h.begin(), h.end(), Greater{});
-  }
-};
-
-// Monotone bucket queue with ordered buckets (see the file comment).
-struct BucketQueue {
-  struct Item { Cap neg_res; NodeId node; };
-  struct Greater {
-    bool operator()(const Item& a, const Item& b) const {
-      return a.neg_res != b.neg_res ? a.neg_res > b.neg_res : a.node > b.node;
-    }
-  };
-  std::vector<std::vector<Item>> buckets;
-  std::vector<std::uint64_t> occ;     // one bit per non-empty bucket; all zero between searches
-  std::vector<std::uint32_t> dirty;   // occupancy words set during the current search
-  std::size_t W = 0, cur_b = 0, pending = 0;
-  std::size_t item_capacity = 0;      // sum of the buckets' retained capacities
-  std::size_t peak_pending = 0;       // largest frontier of the current search
-  Cost cur = 0, stride = 1;
-  // A frontier of exactly one item is held inline rather than in a bucket, so
-  // chain-like stretches pay no bucket bookkeeping; a second push promotes it.
-  bool inline_item = false;
-  QItem single;
-
-  void begin(std::size_t width, Cost stride_) {
-    stride = stride_;
-    W = width;
-    if (buckets.size() < W) buckets.resize(W);
-    const std::size_t words = (W + 63) / 64;
-    if (occ.size() < words) occ.resize(words, 0);   // existing words are already zero
-    cur = 0; cur_b = 0; pending = 0; peak_pending = 0; inline_item = false;
-  }
-  // Early exit can leave items behind: clear the buckets of the words this
-  // search set (O(buckets used), not O(W)). Retained item storage is dropped
-  // when it exceeds a small multiple of what this search needed, so the
-  // workspace does not accumulate the high-water marks of every bucket ever
-  // used across differently shaped graphs.
-  void end() {
-    for (auto w : dirty) {
-      std::uint64_t word = occ[w];
-      while (word) {
-        const std::size_t b = (static_cast<std::size_t>(w) << 6) + static_cast<std::size_t>(std::countr_zero(word));
-        buckets[b].clear();
-        word &= word - 1;
-      }
-      occ[w] = 0;
-    }
-    dirty.clear();
-    pending = 0; inline_item = false;
-    if (item_capacity > 4 * peak_pending + 4096) drop_storage();
-  }
-  void drop_storage() {
-    for (auto& b : buckets) { std::vector<Item> fresh; b.swap(fresh); }
-    item_capacity = 0;
-  }
-  bool empty() const { return pending == 0; }
-  std::size_t bucket_of(Cost c) const {
-    const Cost q = stride == 1 ? c : c / stride;
-    return static_cast<std::size_t>(q % static_cast<Cost>(W));
-  }
-  void push_bucket(Cost c, Cap nr, NodeId v) {
-    const std::size_t b = bucket_of(c);
-    auto& vec = buckets[b];
-    if (vec.empty()) {
-      const std::size_t w = b >> 6;
-      if (occ[w] == 0) dirty.push_back(static_cast<std::uint32_t>(w));
-      occ[w] |= (std::uint64_t{1} << (b & 63));
-    }
-    const std::size_t cap_before = vec.capacity();
-    vec.push_back({nr, v});
-    if (vec.capacity() != cap_before) item_capacity += vec.capacity() - cap_before;
-    if (b == cur_b) std::push_heap(vec.begin(), vec.end(), Greater{});
-    ++pending;
-    if (pending > peak_pending) peak_pending = pending;
-  }
-  void push(Cost c, Cap nr, NodeId v) {
-    if (pending == 0) {
-      single = {c, nr, v}; inline_item = true; pending = 1;
-      if (peak_pending == 0) peak_pending = 1;
-      return;
-    }
-    if (inline_item) {
-      // Promote the inline item into the buckets. cur is the cost of the last
-      // popped item, so every pending cost lies in [cur, cur + max_cost] and
-      // the cyclic bucket invariant holds from cur_b = bucket_of(cur).
-      inline_item = false; pending = 0;
-      cur_b = bucket_of(cur);
-      push_bucket(std::get<0>(single), std::get<1>(single), std::get<2>(single));
-    }
-    push_bucket(c, nr, v);
-  }
-  // Advance to the next non-empty bucket when the active one is exhausted.
-  // Precondition: pending > 0 and no inline item.
-  void settle_active() {
-    if (!buckets[cur_b].empty()) return;
-    std::size_t i = cur_b + 1; if (i == W) i = 0;
-    std::size_t w = i >> 6;
-    std::uint64_t word = occ[w] & (~std::uint64_t{0} << (i & 63));
-    const std::size_t nwords = (W + 63) / 64;
-    while (!word) { w = (w + 1 == nwords) ? 0 : w + 1; word = occ[w]; }
-    const std::size_t f = (w << 6) + static_cast<std::size_t>(std::countr_zero(word));
-    const std::size_t steps = f > cur_b ? f - cur_b : f + W - cur_b;
-    cur += static_cast<Cost>(steps) * stride; cur_b = f;
-    std::make_heap(buckets[f].begin(), buckets[f].end(), Greater{});
-  }
-  Cost top_cost() {
-    if (inline_item) return std::get<0>(single);
-    settle_active(); return cur;
-  }
-  QItem pop() {
-    if (inline_item) {
-      inline_item = false; pending = 0;
-      cur = std::get<0>(single);   // cur_b keeps the last activation; promotion recomputes it
-      return single;
-    }
-    settle_active();
-    auto& vec = buckets[cur_b];
-    std::pop_heap(vec.begin(), vec.end(), Greater{});
-    const Item it = vec.back(); vec.pop_back(); --pending;
-    if (vec.empty()) occ[cur_b >> 6] &= ~(std::uint64_t{1} << (cur_b & 63));
-    return {cur, it.neg_res, it.node};
-  }
-};
-
-struct BucketPlan { bool eligible = false; std::size_t width = 0; Cost stride = 1; };
-
-BucketPlan plan_buckets(const StrictMultiDiGraph& g) {
-  BucketPlan p;
-  p.stride = g.cost_gcd() > 0 ? g.cost_gcd() : 1;
-  const Cost w = g.max_cost() / p.stride + 1;   // max_cost < 2^62, no overflow
-  p.eligible = w <= static_cast<Cost>(kMaxBucketWidth);
-  p.width = p.eligible ? static_cast<std::size_t>(w) : 0;
-  return p;
-}
-
-SpfQueue env_queue_override() {
-  static const SpfQueue q = [] {
-    const char* v = std::getenv("NGRAPH_CORE_SPF_QUEUE");
-    if (!v) return SpfQueue::Auto;
-    const std::string s(v);
-    if (s == "heap") return SpfQueue::Heap;
-    if (s == "bucket") return SpfQueue::Bucket;
-    return SpfQueue::Auto;
-  }();
-  return q;
-}
-
-bool use_bucket_queue(const StrictMultiDiGraph& g, SpfQueue requested, BucketPlan& plan) {
-  const SpfQueue q = requested == SpfQueue::Auto ? env_queue_override() : requested;
-  if (q == SpfQueue::Heap) return false;
-  plan = plan_buckets(g);
-  return plan.eligible;
-}
-
-// Shared reset policy: sparse when few nodes were touched, wholesale otherwise.
-// The same predicate decides how outputs are materialised, so the two agree.
-template <class WS>
-bool sparse_reset(const WS& ws) { return ws.touched.size() * 4 < ws.dist.size(); }
-
-// Resizes a fixed-size scratch array; returns true when a much larger buffer
-// was released because the graph shrank.
-template <class Vec>
-bool ensure_sized(Vec& v, std::size_t n, typename Vec::value_type init) {
-  if (v.size() == n) return false;
-  bool released = false;
-  if (n * 4 < v.capacity()) { Vec fresh; v.swap(fresh); released = true; }
-  v.assign(n, init);
-  return released;
-}
-
-template <class Vec>
-void drop(Vec& v) { Vec fresh; v.swap(fresh); }
-
-// Forward search scratch. Invariant between searches: dist == kInf,
-// min_res == 0, pred_head/pred_tail == -1, pred_count == 0, settled == 0 for
-// every node; the entry arrays, touched list and queues are empty.
-//
-// Retention: the node arrays are sized to the current graph and released when
-// a graph less than a quarter the size is searched; at that point the entry
-// arrays, touched list, heap and bucket storage are released too. Otherwise
-// those growable buffers keep their high-water capacity, except that the
-// bucket queue drops its item storage when it exceeds a small multiple of the
-// last search's peak frontier. The searches are synchronous and do not call
-// back into user code, so a workspace is never re-entered on its thread.
-struct ForwardWorkspace {
-  std::vector<Cost> dist;
-  std::vector<Cap> min_res;
-  std::vector<std::int32_t> pred_head, pred_tail, pred_count;
-  std::vector<char> settled;
-  std::vector<NodeId> ent_parent;
-  std::vector<EdgeId> ent_edge;
-  std::vector<std::int32_t> ent_next;
-  std::vector<NodeId> touched;
-  std::vector<EdgeId> sel_buf;
-  HeapQueue heap;
-  BucketQueue bucket;
-
-  void acquire(std::size_t n) {
-    const bool shrank = ensure_sized(dist, n, kInf);
-    ensure_sized(min_res, n, static_cast<Cap>(0));
-    ensure_sized(pred_head, n, -1);
-    ensure_sized(pred_tail, n, -1);
-    ensure_sized(pred_count, n, 0);
-    ensure_sized(settled, n, 0);
-    if (shrank) {
-      drop(ent_parent); drop(ent_edge); drop(ent_next); drop(touched); drop(sel_buf);
-      heap.drop_storage(); bucket.drop_storage();
-    }
-    ent_parent.clear(); ent_edge.clear(); ent_next.clear(); touched.clear();
-  }
-  void release() {
-    if (sparse_reset(*this)) {
-      for (auto v : touched) {
-        const auto i = static_cast<std::size_t>(v);
-        dist[i] = kInf; min_res[i] = 0; pred_head[i] = -1; pred_tail[i] = -1; pred_count[i] = 0; settled[i] = 0;
-      }
-    } else {
-      std::fill(dist.begin(), dist.end(), kInf);
-      std::fill(min_res.begin(), min_res.end(), static_cast<Cap>(0));
-      std::fill(pred_head.begin(), pred_head.end(), -1);
-      std::fill(pred_tail.begin(), pred_tail.end(), -1);
-      std::fill(pred_count.begin(), pred_count.end(), 0);
-      std::fill(settled.begin(), settled.end(), 0);
-    }
-    touched.clear();
-    heap.end(); bucket.end();
-  }
-};
-
-// Reverse search scratch; same invariant. Successor lists per tail node u are
-// a flat intrusive list of (v, e) entries (succ_head/succ_tail into ent_*).
-// has_in_entry[v]: some DAG entry u -> v exists; a fanout edge may not leave
-// such a node.
-struct ReverseWorkspace {
-  std::vector<Cost> dist;
-  std::vector<Cap> min_res;
-  std::vector<std::int32_t> succ_head, succ_tail;
-  std::vector<char> settled;
-  std::vector<char> has_in_entry;
-  std::vector<NodeId> ent_node;
-  std::vector<EdgeId> ent_edge;
-  std::vector<std::int32_t> ent_next;
-  std::vector<NodeId> touched;
-  std::vector<EdgeId> sel_buf;
-  HeapQueue heap;
-  BucketQueue bucket;
-
-  void acquire(std::size_t n) {
-    const bool shrank = ensure_sized(dist, n, kInf);
-    ensure_sized(min_res, n, static_cast<Cap>(0));
-    ensure_sized(succ_head, n, -1);
-    ensure_sized(succ_tail, n, -1);
-    ensure_sized(settled, n, 0);
-    ensure_sized(has_in_entry, n, 0);
-    if (shrank) {
-      drop(ent_node); drop(ent_edge); drop(ent_next); drop(touched); drop(sel_buf);
-      heap.drop_storage(); bucket.drop_storage();
-    }
-    ent_node.clear(); ent_edge.clear(); ent_next.clear(); touched.clear();
-  }
-  void release() {
-    if (sparse_reset(*this)) {
-      for (auto v : touched) {
-        const auto i = static_cast<std::size_t>(v);
-        dist[i] = kInf; min_res[i] = 0; succ_head[i] = -1; succ_tail[i] = -1;
-        settled[i] = 0; has_in_entry[i] = 0;
-      }
-    } else {
-      std::fill(dist.begin(), dist.end(), kInf);
-      std::fill(min_res.begin(), min_res.end(), static_cast<Cap>(0));
-      std::fill(succ_head.begin(), succ_head.end(), -1);
-      std::fill(succ_tail.begin(), succ_tail.end(), -1);
-      std::fill(settled.begin(), settled.end(), 0);
-      std::fill(has_in_entry.begin(), has_in_entry.end(), 0);
-    }
-    touched.clear();
-    heap.end(); bucket.end();
-  }
-};
-
-thread_local ForwardWorkspace tls_forward;
-thread_local ReverseWorkspace tls_reverse;
-
-// Restores the workspace invariant on every exit path, including exceptions.
-// Callers must record a node in `touched` before writing its scratch entries,
-// so that a throwing push_back cannot leave an unrecorded modification behind.
-template <class WS>
-struct WorkspaceLease {
-  WS& ws;
-  ~WorkspaceLease() { ws.release(); }
-};
-
-// The search loop, shared by both queues. Precondition: src is allowed and
-// initialised in ws (dist 0, min_res max, touched).
-template <class Queue>
-void run_forward(Queue& pq, ForwardWorkspace& ws, const StrictMultiDiGraph& g, NodeId src,
-                 std::optional<NodeId> dst, bool multipath, const EdgeSelection& selection,
-                 std::span<const Cap> residual, std::span<const bool> node_mask,
-                 std::span<const bool> edge_mask, const BucketPlan& plan) {
-  const auto N = g.num_nodes();
-  const auto row = g.row_offsets_view();
-  const auto col = g.col_indices_view();
-  const auto aei = g.adj_edge_index_view();
-  const auto cost = g.cost_view();
-  const auto cap  = g.capacity_view();
-  // Raw pointers into the fixed-size arrays: they are not resized during the
-  // search, and hoisting them keeps the compiler from reloading the vector
-  // bases around every store (the workspace is a thread-local object).
-  Cost* const dist = ws.dist.data();
-  Cap* const min_residual_to_node = ws.min_res.data();
-  std::int32_t* const pred_head = ws.pred_head.data();
-  std::int32_t* const pred_tail = ws.pred_tail.data();
-  std::int32_t* const pred_count = ws.pred_count.data();
-  char* const settled = ws.settled.data();
-  auto& ent_parent = ws.ent_parent;
-  auto& ent_edge = ws.ent_edge;
-  auto& ent_next = ws.ent_next;
-
-  const bool use_node_mask = (node_mask.size() == static_cast<std::size_t>(N));
-  const bool use_edge_mask = (edge_mask.size() == static_cast<std::size_t>(g.num_edges()));
-  const bool has_residual = (residual.size() == static_cast<std::size_t>(g.num_edges()));
-  const bool require_cap = selection.require_capacity || has_residual;
-
-  // Predecessor storage as a flat intrusive list: pred_head/pred_tail index into
-  // the ent_* arrays, whose entries are (parent, via_edge) pairs appended in
-  // discovery order. pred_count tracks the live length of each list so the
-  // result can be sized without walking the lists twice.
-  auto pred_clear = [&](std::size_t v){ pred_head[v] = -1; pred_tail[v] = -1; pred_count[v] = 0; };
-  auto pred_append = [&](std::size_t v, NodeId p, EdgeId e){
-    const auto idx = static_cast<std::int32_t>(ent_parent.size());
-    ent_parent.push_back(p); ent_edge.push_back(e); ent_next.push_back(-1);
-    if (pred_head[v] < 0) { pred_head[v] = idx; }
-    else { ent_next[static_cast<std::size_t>(pred_tail[v])] = idx; }
-    pred_tail[v] = idx;
-    ++pred_count[v];
-  };
-
-  // Queue items are (cost, -residual, node): cost (minimize) -> residual
-  // (maximize) -> node (deterministic). This naturally distributes flows across
-  // equal-cost paths based on available capacity.
-  pq.begin(plan.width, plan.stride);
-  pq.push(static_cast<Cost>(0), -std::numeric_limits<Cap>::max(), src);
-  Cost best_dst_cost = kInf;
-  bool have_best_dst = false;
-  const bool early_exit = dst.has_value();
-  const NodeId dst_node = dst.value_or(-1);
-
-  // settled[v] is set once v is popped at its final distance. Equal-cost
-  // predecessor updates are only accepted while v is unsettled: with positive
-  // edge costs every equal-cost parent is discovered before v settles, and with
-  // zero-cost edges this guard is what keeps the PredDAG acyclic (previously a
-  // zero-cost pair u<->v recorded each node as the other's parent).
-  std::vector<EdgeId>& selected_edges = ws.sel_buf;
-  while (!pq.empty()) {
-    auto [d_u, neg_res_u, u] = pq.pop();
-    if (u < 0 || u >= N) continue;
-    // Skip stale entries (node already processed at a lower cost).
-    if (d_u > dist[static_cast<std::size_t>(u)]) continue;
-    // Skip residual-stale entries in single-path mode (same cost but outdated residual).
-    if (!multipath && d_u == dist[static_cast<std::size_t>(u)] &&
-        -neg_res_u < min_residual_to_node[static_cast<std::size_t>(u)] - kEpsilon) continue;
-    settled[static_cast<std::size_t>(u)] = 1;
-
-    if (early_exit && u == dst_node && !have_best_dst) { best_dst_cost = d_u; have_best_dst = true; }
-    if (early_exit && u == dst_node) {
-      if (pq.empty() || pq.top_cost() > best_dst_cost) break; else continue;
-    }
-
-    auto start = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto end   = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    std::size_t i = start;
-    // Process edges grouped by destination node (parallel edges are consecutive in CSR).
-    // A settled neighbour cannot be improved (costs are non-negative) and no
-    // longer accepts equal-cost or capacity-tie updates, so its whole parallel
-    // group is skipped before any edge is examined.
-    while (i < end) {
-      NodeId v = col[i];
-      if (settled[static_cast<std::size_t>(v)] || (use_node_mask && !node_mask[static_cast<std::size_t>(v)])) {
-        std::size_t j_skip = i; while (j_skip < end && col[j_skip] == v) ++j_skip; i = j_skip; continue;
-      }
-
-      // Select best edge(s) from u to v according to policy.
-      Cost min_edge_cost = kInf;
-      selected_edges.clear();
-      double best_rem_for_min_cost = -1.0;
-      std::size_t j = i;
-      int best_edge_id = -1;
-      for (; j < end && col[j] == v; ++j) {
-        auto e = static_cast<std::size_t>(aei[j]);
-        if (use_edge_mask && !edge_mask[e]) continue;
-        const Cap rem = has_residual ? residual[e] : cap[e];
-        if (require_cap && rem < kMinCap) continue;
-        const Cost ecost = static_cast<Cost>(cost[e]);
-        if (ecost < min_edge_cost) {
-          min_edge_cost = ecost;
-          selected_edges.clear();
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(aei[j]));
-          } else {
-            best_edge_id = static_cast<int>(e);
-            best_rem_for_min_cost = static_cast<double>(rem);
-          }
-        } else if (ecost == min_edge_cost) {
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(aei[j]));
-          } else {
-            // tie-break among equal-cost edges
-            if (selection.tie_break == EdgeTieBreak::PreferHigherResidual) {
-              if (static_cast<double>(rem) > best_rem_for_min_cost + kEpsilon) {
-                best_edge_id = static_cast<int>(e);
-                best_rem_for_min_cost = static_cast<double>(rem);
-              } else if (std::abs(static_cast<double>(rem) - best_rem_for_min_cost) <= kEpsilon) {
-                // further tie-break deterministically by smaller edge id
-                if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) {
-                  best_edge_id = static_cast<int>(e);
-                }
-              }
-            } else {
-              // Deterministic: smallest edge id
-              if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) {
-                best_edge_id = static_cast<int>(e);
-              }
-            }
-          }
-        }
-      }
-      if (!selection.multi_edge && best_edge_id >= 0) {
-        selected_edges.clear();
-        selected_edges.push_back(static_cast<EdgeId>(best_edge_id));
-      }
-      if (!selected_edges.empty()) {
-        Cost new_cost = static_cast<Cost>(d_u + min_edge_cost);
-        auto v_idx = static_cast<std::size_t>(v);
-        // Bottleneck capacity along the path to v through u (node-level tie-breaking).
-        Cap max_edge_residual = static_cast<Cap>(0);
-        for (auto edge_id : selected_edges) {
-          const Cap rem = has_residual ? residual[static_cast<std::size_t>(edge_id)]
-                                        : cap[static_cast<std::size_t>(edge_id)];
-          if (rem > max_edge_residual) max_edge_residual = rem;
-        }
-        Cap path_residual = std::min(min_residual_to_node[static_cast<std::size_t>(u)], max_edge_residual);
-        // Relaxation: shorter path, or equal-cost path with better capacity (single-path mode).
-        if (new_cost < dist[v_idx] ||
-            (!multipath && new_cost == dist[v_idx] && !settled[v_idx] &&
-             path_residual > min_residual_to_node[v_idx] + kEpsilon)) {
-          if (dist[v_idx] == kInf) ws.touched.push_back(v);
-          dist[v_idx] = new_cost;
-          min_residual_to_node[v_idx] = path_residual;
-          pred_clear(v_idx);
-          for (auto sel_e : selected_edges) pred_append(v_idx, u, sel_e);
-          pq.push(new_cost, -path_residual, v);
-        }
-        // Multipath: equal-cost alternative (only while v is unsettled; see above).
-        // min_residual_to_node is not updated here: all equal-cost paths are kept,
-        // none is chosen by residual.
-        else if (multipath && new_cost == dist[v_idx] && !settled[v_idx]) {
-          for (auto sel_e : selected_edges) pred_append(v_idx, u, sel_e);
-        }
-      }
-      i = j;
-    }
-    if (have_best_dst) { if (pq.empty() || pq.top_cost() > best_dst_cost) break; }
-  }
-}
-
-// Materialise (distances, PredDAG) from the forward workspace. Per-node
-// predecessor lists are independent, so visiting only touched nodes yields the
-// same arrays as visiting every node.
-std::pair<std::vector<Cost>, PredDAG> finish_forward(ForwardWorkspace& ws, std::int32_t N) {
-  const bool sparse = sparse_reset(ws);
-  std::vector<Cost> dist;
-  if (sparse) {
-    dist.assign(static_cast<std::size_t>(N), kInf);
-    for (auto v : ws.touched) dist[static_cast<std::size_t>(v)] = ws.dist[static_cast<std::size_t>(v)];
-  } else {
-    dist = ws.dist;
-  }
-  PredDAG dag;
-  dag.parent_offsets.assign(static_cast<std::size_t>(N+1), 0);
-  if (sparse) {
-    for (auto v : ws.touched) dag.parent_offsets[static_cast<std::size_t>(v) + 1] = ws.pred_count[static_cast<std::size_t>(v)];
-  } else {
-    for (std::int32_t v = 0; v < N; ++v) dag.parent_offsets[static_cast<std::size_t>(v) + 1] = ws.pred_count[static_cast<std::size_t>(v)];
-  }
-  for (std::size_t k = 1; k < dag.parent_offsets.size(); ++k)
-    dag.parent_offsets[k] += dag.parent_offsets[k-1];
-  dag.parents.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  dag.via_edges.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  auto fill = [&](std::int32_t v) {
-    auto base = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v)]);
-    std::size_t k = 0;
-    for (std::int32_t i = ws.pred_head[static_cast<std::size_t>(v)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) {
-      dag.parents[base+k] = ws.ent_parent[static_cast<std::size_t>(i)];
-      dag.via_edges[base+k] = ws.ent_edge[static_cast<std::size_t>(i)];
-      ++k;
-    }
-  };
-  if (sparse) { for (auto v : ws.touched) fill(v); }
-  else { for (std::int32_t v = 0; v < N; ++v) fill(v); }
-  return {std::move(dist), std::move(dag)};
-}
-
-std::pair<std::vector<Cost>, PredDAG>
-shortest_paths_core(const StrictMultiDiGraph& g, NodeId src,
-                    std::optional<NodeId> dst,
-                    bool multipath,
-                    const EdgeSelection& selection,
-                    std::span<const Cap> residual,
-                    std::span<const bool> node_mask,
-                    std::span<const bool> edge_mask,
-                    SpfQueue queue) {
-  NGRAPH_PROFILE_SCOPE("shortest_paths_core");
-  const auto N = g.num_nodes();
-  const bool use_node_mask = (node_mask.size() == static_cast<std::size_t>(N));
-  const bool src_allowed = (src >= 0 && src < N && (!use_node_mask || node_mask[static_cast<std::size_t>(src)]));
-  if (!src_allowed) {
-    // Source is out of range or masked out: no traversal, return empty DAG.
-    PredDAG dag;
-    dag.parent_offsets.assign(static_cast<std::size_t>(N + 1), 0);
-    return {std::vector<Cost>(static_cast<std::size_t>(N), kInf), std::move(dag)};
-  }
-  ForwardWorkspace& ws = tls_forward;
-  ws.acquire(static_cast<std::size_t>(N));
-  WorkspaceLease<ForwardWorkspace> lease{ws};
-  ws.touched.push_back(src);   // before the writes: see WorkspaceLease
-  ws.dist[static_cast<std::size_t>(src)] = static_cast<Cost>(0);
-  ws.min_res[static_cast<std::size_t>(src)] = std::numeric_limits<Cap>::max();
-  BucketPlan plan;
-  if (use_bucket_queue(g, queue, plan)) {
-    run_forward(ws.bucket, ws, g, src, dst, multipath, selection, residual, node_mask, edge_mask, plan);
-  } else {
-    run_forward(ws.heap, ws, g, src, dst, multipath, selection, residual, node_mask, edge_mask, plan);
-  }
-  return finish_forward(ws, N);
-}
-
-} // namespace
-
-std::pair<std::vector<Cost>, PredDAG>
-shortest_paths(const StrictMultiDiGraph& g, NodeId src,
-               std::optional<NodeId> dst,
-               bool multipath,
-               const EdgeSelection& selection,
-               std::span<const Cap> residual,
-               std::span<const bool> node_mask,
-               std::span<const bool> edge_mask,
-               SpfQueue queue) {
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-    throw std::invalid_argument("shortest_paths: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("shortest_paths: edge_mask length mismatch");
-  }
-  if (!residual.empty() && residual.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("shortest_paths: residual length mismatch");
-  }
-  return shortest_paths_core(g, src, dst, multipath, selection, residual, node_mask, edge_mask, queue);
-}
-
-} // namespace netgraph::core
-
-/*
-  Reverse Dijkstra: shortest paths from every node *to* one destination.
-
-  Mirrors the forward search over the in-adjacency (in_row_offsets /
-  in_col_indices / in_adj_edge_index): the queue settles nodes by their distance
-  to dst, edge selection runs per (u -> v) parallel group exactly as in the
-  forward variant, and node-level tie-breaking in single-path mode prefers the
-  higher bottleneck capacity toward dst. Successor entries (v, e) are kept per
-  tail node u while u is unsettled, then bucketed by v into the forward PredDAG
-  layout that placement consumes. The same two queues apply.
-*/
-namespace netgraph::core {
-
-namespace {
-
-template <class Queue>
-void run_reverse(Queue& pq, ReverseWorkspace& ws, const StrictMultiDiGraph& g, NodeId target,
-                 bool multipath, const EdgeSelection& selection,
-                 std::span<const Cap> residual, std::span<const bool> node_mask,
-                 std::span<const bool> edge_mask, const BucketPlan& plan) {
-  const auto N = g.num_nodes();
-  const auto E = g.num_edges();
-  const auto irow = g.in_row_offsets_view();
-  const auto icol = g.in_col_indices_view();
-  const auto iaei = g.in_adj_edge_index_view();
-  const auto cost = g.cost_view();
-  const auto cap  = g.capacity_view();
-  Cost* const dist = ws.dist.data();
-  Cap* const min_residual_to_dst = ws.min_res.data();
-  std::int32_t* const succ_head = ws.succ_head.data();
-  std::int32_t* const succ_tail = ws.succ_tail.data();
-  char* const settled = ws.settled.data();
-  char* const has_in_entry = ws.has_in_entry.data();
-  auto& ent_node = ws.ent_node;
-  auto& ent_edge = ws.ent_edge;
-  auto& ent_next = ws.ent_next;
-
-  const bool use_node_mask = (node_mask.size() == static_cast<std::size_t>(N));
-  const bool use_edge_mask = (edge_mask.size() == static_cast<std::size_t>(E));
-  const bool has_residual = (residual.size() == static_cast<std::size_t>(E));
-  const bool require_cap = selection.require_capacity || has_residual;
-
-  auto succ_clear = [&](std::size_t u){ succ_head[u] = -1; succ_tail[u] = -1; };
-  auto succ_append = [&](std::size_t u, NodeId v, EdgeId e){
-    const auto idx = static_cast<std::int32_t>(ent_node.size());
-    ent_node.push_back(v); ent_edge.push_back(e); ent_next.push_back(-1);
-    if (succ_head[u] < 0) { succ_head[u] = idx; }
-    else { ent_next[static_cast<std::size_t>(succ_tail[u])] = idx; }
-    succ_tail[u] = idx;
-  };
-
-  pq.begin(plan.width, plan.stride);
-  pq.push(static_cast<Cost>(0), -std::numeric_limits<Cap>::max(), target);
-  std::vector<EdgeId>& selected_edges = ws.sel_buf;
-
-  while (!pq.empty()) {
-    auto [d_v, neg_res_v, v] = pq.pop();
-    if (v < 0 || v >= N) continue;
-    if (d_v > dist[static_cast<std::size_t>(v)]) continue;
-    if (!multipath && d_v == dist[static_cast<std::size_t>(v)] &&
-        -neg_res_v < min_residual_to_dst[static_cast<std::size_t>(v)] - kEpsilon) continue;
-    settled[static_cast<std::size_t>(v)] = 1;
-
-    // In-edges of v, clustered by tail node u (edges are sorted by (src, dst)).
-    auto start = static_cast<std::size_t>(irow[static_cast<std::size_t>(v)]);
-    auto end   = static_cast<std::size_t>(irow[static_cast<std::size_t>(v)+1]);
-    std::size_t i = start;
-    while (i < end) {
-      NodeId u = icol[i];
-      if (settled[static_cast<std::size_t>(u)] || (use_node_mask && !node_mask[static_cast<std::size_t>(u)])) {
-        std::size_t j_skip = i; while (j_skip < end && icol[j_skip] == u) ++j_skip; i = j_skip; continue;
-      }
-      Cost min_edge_cost = kInf;
-      selected_edges.clear();
-      double best_rem_for_min_cost = -1.0;
-      std::size_t j = i;
-      int best_edge_id = -1;
-      for (; j < end && icol[j] == u; ++j) {
-        auto e = static_cast<std::size_t>(iaei[j]);
-        if (use_edge_mask && !edge_mask[e]) continue;
-        const Cap rem = has_residual ? residual[e] : cap[e];
-        if (require_cap && rem < kMinCap) continue;
-        const Cost ecost = static_cast<Cost>(cost[e]);
-        if (ecost < min_edge_cost) {
-          min_edge_cost = ecost;
-          selected_edges.clear();
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(iaei[j]));
-          } else {
-            best_edge_id = static_cast<int>(e);
-            best_rem_for_min_cost = static_cast<double>(rem);
-          }
-        } else if (ecost == min_edge_cost) {
-          if (selection.multi_edge) {
-            selected_edges.push_back(static_cast<EdgeId>(iaei[j]));
-          } else if (selection.tie_break == EdgeTieBreak::PreferHigherResidual) {
-            if (static_cast<double>(rem) > best_rem_for_min_cost + kEpsilon) {
-              best_edge_id = static_cast<int>(e);
-              best_rem_for_min_cost = static_cast<double>(rem);
-            } else if (std::abs(static_cast<double>(rem) - best_rem_for_min_cost) <= kEpsilon) {
-              if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) best_edge_id = static_cast<int>(e);
-            }
-          } else {
-            if (best_edge_id < 0 || static_cast<int>(e) < best_edge_id) best_edge_id = static_cast<int>(e);
-          }
-        }
-      }
-      if (!selection.multi_edge && best_edge_id >= 0) {
-        selected_edges.clear();
-        selected_edges.push_back(static_cast<EdgeId>(best_edge_id));
-      }
-      if (!selected_edges.empty()) {
-        const Cost new_cost = static_cast<Cost>(d_v + min_edge_cost);
-        const auto u_idx = static_cast<std::size_t>(u);
-        Cap max_edge_residual = static_cast<Cap>(0);
-        for (auto edge_id : selected_edges) {
-          const Cap rem = has_residual ? residual[static_cast<std::size_t>(edge_id)]
-                                       : cap[static_cast<std::size_t>(edge_id)];
-          if (rem > max_edge_residual) max_edge_residual = rem;
-        }
-        const Cap path_residual = std::min(min_residual_to_dst[static_cast<std::size_t>(v)], max_edge_residual);
-        if (new_cost < dist[u_idx] ||
-            (!multipath && new_cost == dist[u_idx] && !settled[u_idx] &&
-             path_residual > min_residual_to_dst[u_idx] + kEpsilon)) {
-          if (dist[u_idx] == kInf) ws.touched.push_back(u);
-          dist[u_idx] = new_cost;
-          min_residual_to_dst[u_idx] = path_residual;
-          succ_clear(u_idx);
-          for (auto sel_e : selected_edges) succ_append(u_idx, v, sel_e);
-          has_in_entry[static_cast<std::size_t>(v)] = 1;
-          pq.push(new_cost, -path_residual, u);
-        } else if (multipath && new_cost == dist[u_idx] && !settled[u_idx]) {
-          for (auto sel_e : selected_edges) succ_append(u_idx, v, sel_e);
-          has_in_entry[static_cast<std::size_t>(v)] = 1;
-        }
-      }
-      i = j;
-    }
-  }
-}
-
-std::pair<std::vector<Cost>, PredDAG>
-shortest_paths_to_core(const StrictMultiDiGraph& g, NodeId target,
-                       bool multipath,
-                       const EdgeSelection& selection,
-                       std::span<const Cap> residual,
-                       std::span<const bool> node_mask,
-                       std::span<const bool> edge_mask,
-                       std::span<const EdgeId> fanout_edges,
-                       SpfQueue queue) {
-  NGRAPH_PROFILE_SCOPE("shortest_paths_to_core");
-  const auto N = g.num_nodes();
-  const auto E = g.num_edges();
-  const auto esrc = g.edge_src_view();
-  const auto edst = g.edge_dst_view();
-  const auto cost = g.cost_view();
-  const auto cap  = g.capacity_view();
-  const bool use_node_mask = (node_mask.size() == static_cast<std::size_t>(N));
-  const bool use_edge_mask = (edge_mask.size() == static_cast<std::size_t>(E));
-  const bool has_residual = (residual.size() == static_cast<std::size_t>(E));
-  const bool require_cap = selection.require_capacity || has_residual;
-  const bool target_allowed = (target >= 0 && target < N &&
-                               (!use_node_mask || node_mask[static_cast<std::size_t>(target)]));
-
-  ReverseWorkspace& ws = tls_reverse;
-  ws.acquire(static_cast<std::size_t>(N));
-  WorkspaceLease<ReverseWorkspace> lease{ws};
-
-  if (target_allowed) {
-    ws.touched.push_back(target);   // before the writes: see WorkspaceLease
-    ws.dist[static_cast<std::size_t>(target)] = static_cast<Cost>(0);
-    ws.min_res[static_cast<std::size_t>(target)] = std::numeric_limits<Cap>::max();
-    BucketPlan plan;
-    if (use_bucket_queue(g, queue, plan)) {
-      run_reverse(ws.bucket, ws, g, target, multipath, selection, residual, node_mask, edge_mask, plan);
-    } else {
-      run_reverse(ws.heap, ws, g, target, multipath, selection, residual, node_mask, edge_mask, plan);
-    }
-  }
-
-  auto succ_append = [&](std::size_t u, NodeId v, EdgeId e){
-    const auto idx = static_cast<std::int32_t>(ws.ent_node.size());
-    ws.ent_node.push_back(v); ws.ent_edge.push_back(e); ws.ent_next.push_back(-1);
-    if (ws.succ_head[u] < 0) { ws.succ_head[u] = idx; }
-    else { ws.ent_next[static_cast<std::size_t>(ws.succ_tail[u])] = idx; }
-    ws.succ_tail[u] = idx;
-  };
-
-  // Forced fan-out entries (see the header).
-  for (auto e_raw : fanout_edges) {
-    if (e_raw < 0 || e_raw >= E) {
-      throw std::invalid_argument("shortest_paths_to: fanout edge id out of range");
-    }
-    const auto e = static_cast<std::size_t>(e_raw);
-    const NodeId u = esrc[e];
-    const NodeId v = edst[e];
-    if (ws.has_in_entry[static_cast<std::size_t>(u)]) {
-      throw std::invalid_argument(
-          "shortest_paths_to: a fanout edge must leave a node with no incoming DAG entry "
-          "(otherwise the DAG could contain a cycle)");
-    }
-    if (use_edge_mask && !edge_mask[e]) continue;
-    if (use_node_mask && (!node_mask[static_cast<std::size_t>(u)] || !node_mask[static_cast<std::size_t>(v)])) continue;
-    const Cap rem = has_residual ? residual[e] : cap[e];
-    if (require_cap && rem < kMinCap) continue;
-    if (ws.dist[static_cast<std::size_t>(v)] == kInf) continue;
-    bool present = false;
-    for (std::int32_t i = ws.succ_head[static_cast<std::size_t>(u)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) {
-      if (ws.ent_edge[static_cast<std::size_t>(i)] == e_raw) { present = true; break; }
-    }
-    if (present) continue;
-    if (ws.dist[static_cast<std::size_t>(u)] == kInf) ws.touched.push_back(u);
-    succ_append(static_cast<std::size_t>(u), v, e_raw);
-    if (ws.dist[static_cast<std::size_t>(u)] == kInf) {
-      ws.dist[static_cast<std::size_t>(u)] = static_cast<Cost>(cost[e]) + ws.dist[static_cast<std::size_t>(v)];
-    }
-  }
-
-  // Bucket successor entries (u -> v via e) by v into the forward PredDAG
-  // layout. Entries within a v range are ordered by ascending tail node, so a
-  // sparse pass must visit the touched tails in ascending order.
-  const bool sparse = sparse_reset(ws);
-  std::vector<Cost> dist;
-  if (sparse) {
-    std::sort(ws.touched.begin(), ws.touched.end());
-    dist.assign(static_cast<std::size_t>(N), kInf);
-    for (auto v : ws.touched) dist[static_cast<std::size_t>(v)] = ws.dist[static_cast<std::size_t>(v)];
-  } else {
-    dist = ws.dist;
-  }
-  PredDAG dag;
-  dag.parent_offsets.assign(static_cast<std::size_t>(N+1), 0);
-  auto count = [&](std::int32_t u) {
-    for (std::int32_t i = ws.succ_head[static_cast<std::size_t>(u)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) {
-      dag.parent_offsets[static_cast<std::size_t>(ws.ent_node[static_cast<std::size_t>(i)]) + 1] += 1;
-    }
-  };
-  if (sparse) { for (auto u : ws.touched) count(u); }
-  else { for (std::int32_t u = 0; u < N; ++u) count(u); }
-  for (std::size_t k = 1; k < dag.parent_offsets.size(); ++k) dag.parent_offsets[k] += dag.parent_offsets[k-1];
-  dag.parents.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  dag.via_edges.resize(static_cast<std::size_t>(dag.parent_offsets.back()));
-  std::vector<std::int32_t> cursor(dag.parent_offsets.begin(), dag.parent_offsets.end() - 1);
-  auto fill = [&](std::int32_t u) {
-    for (std::int32_t i = ws.succ_head[static_cast<std::size_t>(u)]; i >= 0; i = ws.ent_next[static_cast<std::size_t>(i)]) {
-      const auto v = static_cast<std::size_t>(ws.ent_node[static_cast<std::size_t>(i)]);
-      const auto pos = static_cast<std::size_t>(cursor[v]++);
-      dag.parents[pos] = u;
-      dag.via_edges[pos] = ws.ent_edge[static_cast<std::size_t>(i)];
-    }
-  };
-  if (sparse) { for (auto u : ws.touched) fill(u); }
-  else { for (std::int32_t u = 0; u < N; ++u) fill(u); }
-  return {std::move(dist), std::move(dag)};
-}
-
-} // namespace
-
-std::pair<std::vector<Cost>, PredDAG>
-shortest_paths_to(const StrictMultiDiGraph& g, NodeId dst,
-                  bool multipath,
-                  const EdgeSelection& selection,
-                  std::span<const Cap> residual,
-                  std::span<const bool> node_mask,
-                  std::span<const bool> edge_mask,
-                  std::span<const EdgeId> fanout_edges,
-                  SpfQueue queue) {
-  if (!node_mask.empty() && node_mask.size() != static_cast<std::size_t>(g.num_nodes())) {
-    throw std::invalid_argument("shortest_paths_to: node_mask length mismatch");
-  }
-  if (!edge_mask.empty() && edge_mask.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("shortest_paths_to: edge_mask length mismatch");
-  }
-  if (!residual.empty() && residual.size() != static_cast<std::size_t>(g.num_edges())) {
-    throw std::invalid_argument("shortest_paths_to: residual length mismatch");
-  }
-  return shortest_paths_to_core(g, dst, multipath, selection, residual, node_mask, edge_mask, fanout_edges, queue);
-}
-
-} // namespace netgraph::core
diff --git a/src/strict_multidigraph.cpp b/src/strict_multidigraph.cpp
deleted file mode 100644
index 546b5cf..0000000
--- a/src/strict_multidigraph.cpp
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
-  StrictMultiDiGraph — immutable directed multigraph with deterministic layout.
-
-  Construction from arrays validates inputs and builds CSR and reverse CSR
-  adjacency structures. Edges are reordered by (cost, src, dst) to cluster
-  equal-cost tiers for deterministic traversal.
-*/
-#include "netgraph/core/strict_multidigraph.hpp"
-
-#include <algorithm>
-#include <numeric>
-#include <stdexcept>
-
-namespace netgraph::core {
-
-StrictMultiDiGraph StrictMultiDiGraph::from_arrays(
-    std::int32_t num_nodes,
-    std::span<const std::int32_t> src,
-    std::span<const std::int32_t> dst,
-    std::span<const Cap> capacity,
-    std::span<const Cost> cost,
-    std::span<const std::int64_t> ext_edge_ids) {
-
-  if (num_nodes < 0) {
-    throw std::invalid_argument("num_nodes must be >= 0");
-  }
-  if (src.size() != dst.size() || src.size() != capacity.size() || src.size() != cost.size()) {
-    throw std::invalid_argument("src, dst, capacity, and cost must have the same length");
-  }
-  if (!ext_edge_ids.empty() && ext_edge_ids.size() != src.size()) {
-    throw std::invalid_argument("ext_edge_ids must be empty or have the same length as src/dst/capacity/cost");
-  }
-  StrictMultiDiGraph g;
-  g.num_nodes_ = num_nodes;
-  std::size_t m = src.size();
-  if (m > static_cast<std::size_t>(std::numeric_limits<std::int32_t>::max())) {
-    throw std::invalid_argument("number of edges exceeds INT32_MAX");
-  }
-
-  // Invariants: ids within [0, num_nodes), non-negative weights.
-  // SPF accumulates path costs as int64 without overflow checks and uses
-  // INT64_MAX as the unreachable sentinel, so the total of all edge costs
-  // (an upper bound on any simple path, and on one reverse-edge bounce) must
-  // stay below 2^62 or accumulated costs could wrap negative and silently
-  // corrupt results.
-  constexpr std::uint64_t kMaxTotalCost = (std::uint64_t{1} << 62);
-  std::uint64_t total_cost = 0;
-  Cost max_cost = 0;
-  Cost cost_gcd = 0;
-  for (std::size_t i = 0; i < m; ++i) {
-    if (src[i] < 0 || dst[i] < 0 || src[i] >= num_nodes || dst[i] >= num_nodes) {
-      throw std::out_of_range("edge index out of range of num_nodes");
-    }
-    if (capacity[i] < 0.0) {
-      throw std::invalid_argument("capacity must be >= 0");
-    }
-    if (cost[i] < 0) { throw std::invalid_argument("cost must be >= 0"); }
-    const auto c = static_cast<std::uint64_t>(cost[i]);
-    if (c >= kMaxTotalCost - total_cost) {
-      throw std::invalid_argument(
-          "total edge cost must stay below 2^62: larger accumulated path costs "
-          "overflow int64 cost arithmetic and silently corrupt results");
-    }
-    total_cost += c;
-    if (cost[i] > max_cost) max_cost = cost[i];
-    cost_gcd = std::gcd(cost_gcd, cost[i]);
-  }
-  g.max_cost_ = max_cost;
-  g.cost_gcd_ = cost_gcd;
-  // Gather initial arrays
-  std::vector<NodeId> src_v(src.begin(), src.end());
-  std::vector<NodeId> dst_v(dst.begin(), dst.end());
-  std::vector<Cap> cap_v(capacity.begin(), capacity.end());
-  std::vector<Cost> cost_v(cost.begin(), cost.end());
-  std::vector<std::int64_t> ext_v;
-  if (!ext_edge_ids.empty()) {
-    ext_v.assign(ext_edge_ids.begin(), ext_edge_ids.end());
-  }
-
-  // Sort edges by (cost, src, dst) to cluster equal-cost tiers for deterministic traversal.
-  // Create an index array [0, 1, 2, ..., m-1] that we'll permute to define the reordering.
-  std::vector<std::size_t> idx(m);
-  std::iota(idx.begin(), idx.end(), 0);  // iota fills with sequential values
-
-  // Cost-first ordering keeps equal-cost tiers clustered; within the same
-  // cost, maintain stable source/destination ordering for reproducibility.
-  // stable_sort preserves relative order of equal elements, ensuring determinism.
-  // Lambda comparator: [&] captures variables by reference, (a, b) are indices to compare.
-  std::stable_sort(idx.begin(), idx.end(), [&](std::size_t a, std::size_t b) {
-    if (cost_v[a] != cost_v[b]) return cost_v[a] < cost_v[b];
-    if (src_v[a] != src_v[b]) return src_v[a] < src_v[b];
-    return dst_v[a] < dst_v[b];
-  });
-
-  // Reorder all edge arrays using the computed permutation.
-  // Generic lambda (auto parameters) works with any vector type.
-  auto apply_perm = [&](auto& out_vec, const auto& in_vec) {
-    out_vec.resize(m);
-    for (std::size_t i = 0; i < m; ++i) out_vec[i] = in_vec[idx[i]];
-  };
-  apply_perm(g.src_, src_v);
-  apply_perm(g.dst_, dst_v);
-  apply_perm(g.capacity_, cap_v);
-  apply_perm(g.cost_, cost_v);
-  if (!ext_v.empty()) {
-    apply_perm(g.ext_edge_ids_, ext_v);
-  }
-  g.edges_ = m;
-
-  // Build CSR (Compressed Sparse Row) adjacency structure.
-  // For each node u, row_offsets_[u]:row_offsets_[u+1] gives the range in col_indices_
-  // that stores u's outgoing neighbors, and adj_edge_index_ stores the corresponding EdgeIds.
-
-  // Step 1: Count outgoing edges per node (histogram).
-  g.row_offsets_.assign(static_cast<std::size_t>(num_nodes) + 1, 0);
-  for (std::size_t i = 0; i < m; ++i) {
-    g.row_offsets_[static_cast<std::size_t>(g.src_[i]) + 1]++;
-  }
-
-  // Step 2: Convert counts to cumulative offsets (prefix sum).
-  // row_offsets_[u] is the starting index for node u's adjacency list.
-  for (std::size_t i = 1; i < g.row_offsets_.size(); ++i) {
-    g.row_offsets_[i] += g.row_offsets_[i - 1];
-  }
-
-  // Step 3: Fill col_indices_ and adj_edge_index_ arrays.
-  g.col_indices_.resize(m);
-  g.adj_edge_index_.resize(m);
-  // cursor tracks the current write position for each node's adjacency list.
-  std::vector<std::int32_t> cursor = g.row_offsets_;  // copy for in-place filling
-  for (std::size_t e = 0; e < m; ++e) {
-    auto u = g.src_[e];
-    auto pos = static_cast<std::size_t>(cursor[static_cast<std::size_t>(u)]++);
-    g.col_indices_[pos] = g.dst_[e];        // neighbor node
-    g.adj_edge_index_[pos] = static_cast<EdgeId>(e);  // edge index
-  }
-  // Build reverse CSR (incoming adjacency) for predecessor tracking.
-  // Same CSR construction algorithm, but keyed by destination node instead of source.
-  // This enables efficient lookup of incoming edges for any node.
-
-  // Step 1: Count incoming edges per node.
-  g.in_row_offsets_.assign(static_cast<std::size_t>(num_nodes) + 1, 0);
-  for (std::size_t i = 0; i < m; ++i) {
-    g.in_row_offsets_[static_cast<std::size_t>(g.dst_[i]) + 1]++;
-  }
-
-  // Step 2: Convert counts to cumulative offsets.
-  for (std::size_t i = 1; i < g.in_row_offsets_.size(); ++i) {
-    g.in_row_offsets_[i] += g.in_row_offsets_[i - 1];
-  }
-
-  // Step 3: Fill reverse adjacency arrays.
-  g.in_col_indices_.resize(m);
-  g.in_adj_edge_index_.resize(m);
-  std::vector<std::int32_t> rcursor = g.in_row_offsets_;
-  for (std::size_t e = 0; e < m; ++e) {
-    auto v = g.dst_[e];
-    auto pos = static_cast<std::size_t>(rcursor[static_cast<std::size_t>(v)]++);
-    g.in_col_indices_[pos] = g.src_[e];     // predecessor node
-    g.in_adj_edge_index_[pos] = static_cast<EdgeId>(e);
-  }
-  return g;
-}
-
-} // namespace netgraph::core
diff --git a/tests/cpp/apply_actions_fault_tests.cpp b/tests/cpp/apply_actions_fault_tests.cpp
new file mode 100644
index 0000000..9b4a97b
--- /dev/null
+++ b/tests/cpp/apply_actions_fault_tests.cpp
@@ -0,0 +1,390 @@
+// apply_actions under allocation failures (the fault-injection executable, fault_injection.cpp):
+// every allocation of an ORDERED list mixing every model and of a SIMULTANEOUS list (a pooled
+// ShortestPaths replace, a Pinned tunnel program, a T1 forward with holds and black holes, a cyclic
+// group across demands) fails once in turn; after each failure the ledger and every listed policy's
+// epoch are as before the call, the aggregate is balanced, nothing is left allocated, and a clean
+// retry gives the reference's results, ledger and epochs. Because the sweep reaches every allocation
+// of the call, a publication that allocated after the ledger's exchange would show as a changed
+// state here: the publication allocates nothing. The batch exchange is swept on its own (owners that
+// retire and keep records, holds), and both modes are swept on a fresh thread whose scratch grows
+// from a 3-node to a 3,000-node graph, the retry on that thread equal to the reference.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "fault_injection.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::LedgerAccess;
+
+namespace {
+
+using Actions = std::vector<Action>;
+
+const OutputOptions kAll {.edge_flows = true, .residual = true, .saturated_boundary_edges = true, .edge_reservations = true};
+
+// What a list sweep stages on a fresh ledger: the policies (kept alive), their earlier calls, the
+// list and its mode.
+struct ListScenario {
+  std::vector<std::shared_ptr<const Eligibility>> masks;
+  std::vector<std::unique_ptr<FlowPolicy>> policies;
+  Actions actions;
+  BatchMode mode {BatchMode::Ordered};
+};
+
+EdgeId edge(const Graph& g, NodeId u, NodeId v) {
+  for (EdgeId e = 0; e < g.num_edges(); ++e) {
+    if (g.edge_sources()[static_cast<std::size_t>(e)] == u && g.edge_destinations()[static_cast<std::size_t>(e)] == v) return e;
+  }
+  ADD_FAILURE() << "no edge " << u << " -> " << v;
+  return 0;
+}
+
+std::shared_ptr<const ForwardingProgram> tunnels(const Graph& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+                                                 const std::vector<std::pair<NodeId, std::vector<NodeId>>>& walks) {
+  std::vector<RouteDefinition> routes;
+  for (const auto& [h, nodes] : walks) {
+    std::vector<std::vector<EdgeId>> hops;
+    for (std::size_t i = 0; i + 1 < nodes.size(); ++i) hops.push_back({edge(g, nodes[i], nodes[i + 1])});
+    routes.push_back(RouteDefinition {h, std::make_shared<const Path>(g, hops), 1});
+  }
+  return ForwardingProgram::from_routes(g, s, d, routes);
+}
+
+std::vector<Epoch> epochs(const ListScenario& s) {
+  std::vector<Epoch> out;
+  for (const auto& p : s.policies) out.push_back(epoch(*p));
+  return out;
+}
+
+void expect_same_epochs(const std::vector<Epoch>& a, const std::vector<Epoch>& b, const std::string& where) {
+  ASSERT_EQ(a.size(), b.size()) << where;
+  for (std::size_t i = 0; i < a.size(); ++i) expect_same(a[i], b[i], where + ", policy " + std::to_string(i));
+}
+
+// The list sweep (as sweep_placement for one call): returns the failures injected.
+long sweep_list(const std::shared_ptr<const Graph>& g, const std::string& where, const std::function<ListScenario(FlowLedger&)>& setup) {
+  FlowLedger ref(g);
+  ListScenario sref = setup(ref);
+  const LedgerState initial = ledger_state(ref);
+  const auto initial_epochs = epochs(sref);
+  const auto want = apply_actions(ref, sref.actions, sref.mode, kAll);
+  const LedgerState after = ledger_state(ref);
+  const auto want_epochs = epochs(sref);
+  long injected = 0;
+  for (long at = 0;; ++at) {
+    const std::string w = where + " allocation " + std::to_string(at);
+    const long live = g_live.load();
+    bool completed = false;
+    {
+      FlowLedger fg(g);
+      ListScenario s = setup(fg);
+      expect_same(ledger_state(fg), initial, w + " (setup)");
+      expect_same_epochs(epochs(s), initial_epochs, w + " (setup)");
+      std::vector<PlacementResult> got;
+      if (!fails_at(at, [&] { got = apply_actions(fg, s.actions, s.mode, kAll); })) {
+        EXPECT_EQ(got.size(), want.size()) << w;
+        for (std::size_t k = 0; k < std::min(got.size(), want.size()); ++k) expect_same(got[k], want[k], w + " entry " + std::to_string(k));
+        expect_same(ledger_state(fg), after, w + " (no failure)");
+        expect_same_epochs(epochs(s), want_epochs, w + " (no failure)");
+        completed = true;
+      } else {
+        ++injected;
+        expect_same(ledger_state(fg), initial, w + " (failed list)");
+        expect_same_epochs(epochs(s), initial_epochs, w + " (failed list)");
+        expect_balanced(fg, w + " (failed list)");
+        const auto retry = apply_actions(fg, s.actions, s.mode, kAll);
+        for (std::size_t k = 0; k < std::min(retry.size(), want.size()); ++k) expect_same(retry[k], want[k], w + " retry " + std::to_string(k));
+        expect_same(ledger_state(fg), after, w + " (retry)");
+        expect_same_epochs(epochs(s), want_epochs, w + " (retry)");
+      }
+    }
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    if (completed || ::testing::Test::HasFailure()) break;
+  }
+  return injected;
+}
+
+// Nodes 0..5 (sources 0 and 1, destination 5) and a separate link 6 -> 7.
+std::shared_ptr<const Graph> mixed_graph() {
+  return shared(make_graph(8, {{0, 2, 6, 1}, {0, 3, 4, 2}, {1, 2, 5, 1}, {1, 3, 3, 1}, {2, 4, 5, 1}, {3, 4, 6, 2}, {2, 5, 4, 3},
+                               {4, 5, 8, 1}, {3, 5, 2, 1}, {6, 7, 10, 1}}));
+}
+
+const std::vector<NodeId> kS {0, 1};
+const std::vector<NodeId> kD {5};
+
+FlowPolicyConfig ecmp(Admission a = Admission::Lossy) { return FlowPolicyConfig {.routing = shortest_paths(), .admission = a}; }
+FlowPolicyConfig pinned_config(std::shared_ptr<const ForwardingProgram> prog, std::shared_ptr<const Eligibility> black = nullptr) {
+  return FlowPolicyConfig {.routing = Pinned {std::move(prog), std::move(black)}, .admission = Admission::Lossy};
+}
+
+// An ORDERED list over every model: a ShortestPaths place, a LOSSLESS replace(+inf), a
+// controller's place, T1 and T2 replaces, a Pinned replace, a forward with black holes of an
+// installed program, and a zero place.
+TEST(PolicyFaults, EveryAllocationOfAnOrderedListFailsAtomically) {
+  const auto g = mixed_graph();
+  const auto prog = tunnels(*g, kS, kD, {{0, {0, 2, 4, 5}}, {1, {1, 3, 5}}});
+  const auto injected = sweep_list(g, "ordered", [&](FlowLedger& fg) {
+    ListScenario s;
+    auto add = [&](FlowPolicyConfig cfg, std::vector<NodeId> src = kS) -> FlowPolicy& {
+      s.policies.push_back(std::make_unique<FlowPolicy>(fg, src, kD, std::move(cfg)));
+      return *s.policies.back();
+    };
+    auto& sp = add(ecmp());
+    auto& ll = add(ecmp(Admission::Lossless), {0});
+    auto& ctl = add(FlowPolicyConfig {.routing = centralized()});
+    auto& t1 = add(FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}, .admission = Admission::Lossy});
+    auto& t2 = add(FlowPolicyConfig {.routing = centralized(SourceAllocation::Equal, nullptr, TunnelCount {1}), .admission = Admission::Lossy});
+    auto& pin = add(pinned_config(prog));
+    auto& fw = add(ecmp());
+    auto& zero = add(ecmp());
+    (void)sp.place(2);
+    (void)fw.replace(2);
+    (void)t1.replace(2, std::optional<Amount> {2});
+    const std::vector<EdgeId> black {edge(*g, 2, 4)};
+    s.masks.push_back(std::make_shared<const Eligibility>(g->eligibility({}, black)));
+    s.actions = {Place {sp, 4},
+                 Replace {ll, std::nullopt},
+                 Place {ctl, 3},
+                 Replace {t1, 3, std::optional<Amount> {3}},
+                 Replace {t2, 2},
+                 Replace {pin, 4},
+                 Forward {fw, 3, s.masks.back().get()},
+                 Place {zero, 0}};
+    s.mode = BatchMode::Ordered;
+    return s;
+  });
+  EXPECT_GT(injected, 100);
+}
+
+// A SIMULTANEOUS list: a pooled ShortestPaths replace, a Pinned tunnel program, a T1 forward with
+// holds and black holes, and (on its own graph) a cyclic group across two demands.
+TEST(PolicyFaults, EveryAllocationOfASimultaneousListFailsAtomically) {
+  const auto g = mixed_graph();
+  const auto prog = tunnels(*g, kS, kD, {{0, {0, 2, 5}}, {1, {1, 2, 4, 5}}});
+  const auto injected = sweep_list(g, "simultaneous", [&](FlowLedger& fg) {
+    ListScenario s;
+    auto add = [&](FlowPolicyConfig cfg) -> FlowPolicy& {
+      s.policies.push_back(std::make_unique<FlowPolicy>(fg, kS, kD, std::move(cfg)));
+      return *s.policies.back();
+    };
+    auto& sp = add(ecmp());
+    auto& pin = add(pinned_config(prog));
+    auto& t1 = add(FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}, .admission = Admission::Lossy});
+    (void)sp.place(3);
+    (void)t1.replace(3, std::optional<Amount> {3});
+    const std::vector<EdgeId> black {edge(*g, 3, 5)};
+    s.masks.push_back(std::make_shared<const Eligibility>(g->eligibility({}, black)));
+    s.actions = {Replace {sp, 5}, Replace {pin, 6}, Forward {t1, 4, s.masks.back().get()}};
+    s.mode = BatchMode::Simultaneous;
+    return s;
+  });
+  EXPECT_GT(injected, 100);
+  // The cyclic group: two demands crossing X (e0) and Y (e3) in opposite orders, settling at round 3.
+  const auto cyc = shared(make_graph(6, {{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 1, 1}, {3, 0, 1000, 1},
+                                         {3, 5, 1000, 1}, {4, 0, 1000, 1}, {4, 2, 1000, 1}}));
+  const auto a = tunnels(*cyc, {4}, {5}, {{4, {4, 0, 1, 2, 3, 5}}});
+  const auto b = tunnels(*cyc, {4}, {5}, {{4, {4, 2, 3, 0, 1, 5}}});
+  const auto cyclic = sweep_list(cyc, "cyclic", [&](FlowLedger& fg) {
+    ListScenario s;
+    s.policies.push_back(std::make_unique<FlowPolicy>(fg, std::vector<NodeId> {4}, std::vector<NodeId> {5}, pinned_config(a)));
+    s.policies.push_back(std::make_unique<FlowPolicy>(fg, std::vector<NodeId> {4}, std::vector<NodeId> {5}, pinned_config(b)));
+    s.actions = {Replace {*s.policies[0], 1}, Replace {*s.policies[1], 1}};
+    s.mode = BatchMode::Simultaneous;
+    return s;
+  });
+  EXPECT_GT(cyclic, 50);
+}
+
+TEST(PolicyFaults, WeightedSourceListsPublishAllOwnersOrNone) {
+  const auto g=mixed_graph();
+  CentralizedTE model(SourceAllocation::Weighted);
+  model.source_weights=std::make_shared<const std::vector<Amount>>(std::vector<Amount>{2,1,0,0,0,0,0,0});
+  FlowLedger producer(g);
+  FlowPolicy p(producer,kS,kD,FlowPolicyConfig{model});
+  const auto program=p.replace(6).program;
+  for(auto mode:{BatchMode::Ordered,BatchMode::Simultaneous})for(bool warm:{false,true}) {
+    const auto injected=sweep_list(g,"weighted list",[&](FlowLedger& ledger) {
+      ListScenario s;
+      for(int i=0;i<2;++i) {
+        FlowPolicyConfig cfg=mode==BatchMode::Ordered ? FlowPolicyConfig{model} : pinned_config(program);
+        s.policies.push_back(std::make_unique<FlowPolicy>(ledger,kS,kD,cfg));
+        if(warm)(void)s.policies.back()->replace(2);
+        s.actions.push_back(Replace{*s.policies.back(),6});
+      }
+      s.mode=mode;return s;
+    });
+    EXPECT_GT(injected,10);
+    if(::testing::Test::HasFailure())return;
+  }
+}
+
+// Both modes on a fresh thread, the scratch grown from a 3-node to a 3,000-node chain, each
+// allocation failing once; the retry on that thread equals the reference.
+TEST(PolicyFaults, ListScratchGrowthFailureLeavesNothingHalfGrown) {
+  for (BatchMode mode : {BatchMode::Ordered, BatchMode::Simultaneous}) {
+    const std::string name = mode == BatchMode::Ordered ? "ordered" : "simultaneous";
+    SCOPED_TRACE(name);
+    const auto small = chain_graph(3, 5);
+    const auto large = chain_graph(3000, 5);
+    auto chain = [](const Graph& g) {
+      std::vector<std::vector<EdgeId>> hops;
+      for (EdgeId e = 0; e < g.num_edges(); ++e) hops.push_back({e});
+      const std::vector<RouteDefinition> routes {RouteDefinition {0, std::make_shared<const Path>(g, hops), 1}};
+      return ForwardingProgram::from_routes(g, std::vector<NodeId> {0}, std::vector<NodeId> {g.num_nodes() - 1}, routes);
+    };
+    struct Run {
+      std::vector<PlacementResult> results;
+      LedgerState state;
+    };
+    auto list_on = [&](const std::shared_ptr<const Graph>& g, FlowLedger& fg, std::unique_ptr<FlowPolicy>& a,
+                       std::unique_ptr<FlowPolicy>& b) {
+      const std::vector<NodeId> s {0};
+      const std::vector<NodeId> d {g->num_nodes() - 1};
+      a = std::make_unique<FlowPolicy>(fg, s, d, ecmp());
+      b = std::make_unique<FlowPolicy>(fg, s, d, pinned_config(chain(*g)));
+      return Actions {Replace {*a, 2}, Replace {*b, 1}};
+    };
+    Run want;
+    {
+      FlowLedger fg(large);
+      std::unique_ptr<FlowPolicy> a;
+      std::unique_ptr<FlowPolicy> b;
+      const auto list = list_on(large, fg, a, b);
+      want.results = apply_actions(fg, list, mode, kAll);
+      want.state = ledger_state(fg);
+    }
+    ASSERT_EQ(want.results[0].call_delivered, 2);
+    sweep_scratch_growth(
+        name,
+        [&] {
+          FlowLedger fg(small);
+          std::unique_ptr<FlowPolicy> a;
+          std::unique_ptr<FlowPolicy> b;
+          const auto list = list_on(small, fg, a, b);
+          EXPECT_EQ(apply_actions(fg, list, mode, kAll).size(), 2U);
+        },
+        [&](long at, const std::string& w) {
+          FlowLedger fg(large);
+          std::unique_ptr<FlowPolicy> a;
+          std::unique_ptr<FlowPolicy> b;
+          const auto list = list_on(large, fg, a, b);
+          const LedgerState before = ledger_state(fg);
+          std::vector<PlacementResult> got;
+          const bool failed = fails_at(at, [&] { got = apply_actions(fg, list, mode, kAll); });
+          if (failed) {
+            expect_same(ledger_state(fg), before, w);
+            got = apply_actions(fg, list, mode, kAll);
+          }
+          for (std::size_t k = 0; k < got.size(); ++k) expect_same(got[k], want.results[k], w);
+          expect_same(ledger_state(fg), want.state, w);
+          return failed;
+        },
+        [&] {
+          FlowLedger fg(large);
+          std::unique_ptr<FlowPolicy> a;
+          std::unique_ptr<FlowPolicy> b;
+          const auto list = list_on(large, fg, a, b);
+          (void)apply_actions(fg, list, mode, kAll);  // the scratch grows to the large graph
+          long warm = 0;
+          while (fails_at(warm, [&] { (void)apply_actions(fg, list, mode, kAll); })) ++warm;
+          return warm;
+        });
+    if (::testing::Test::HasFailure()) return;
+  }
+}
+
+// The batch exchange: every allocation of a two-owner and a three-owner commit_batch (an owner
+// that retires its records, one that keeps them, holds) fails once; the ledger is unchanged after
+// each failure, and the completing exchange equals the reference.
+TEST(LedgerFaults, EveryAllocationOfABatchExchangeFailsAtomically) {
+  const auto g = shared(make_graph(3, {{0, 1, 10, 1}, {1, 2, 10, 1}}));
+  const auto dag = all_edges(*g);
+  auto draft = [&](std::vector<std::pair<EdgeId, Amount>> flows, std::optional<std::int64_t> id = std::nullopt, Amount hold = 0) {
+    detail::RecordDraft d;
+    d.record_counter = id;
+    d.record.sources = {0};
+    d.record.destinations = {2};
+    d.record.route = dag;
+    d.record.min_route_cost = 2;
+    for (const auto& [e, x] : flows) d.record.delivered = std::max(d.record.delivered, x);
+    d.record.edge_flows = std::move(flows);
+    if (hold != 0) d.record.edge_reservations = {{0, hold}};
+    return d;
+  };
+  for (int owners : {2, 3}) {
+    const std::string where = std::to_string(owners) + " owners";
+    struct Staged {
+      std::vector<std::int64_t> ids;
+      std::vector<std::vector<detail::RecordDraft>> drafts;
+      std::vector<bool> retire;
+    };
+    auto stage = [&](FlowLedger& fg) {
+      Staged s;
+      for (int i = 0; i < owners; ++i) s.ids.push_back(LedgerAccess::bind(fg));
+      std::vector<detail::RecordDraft> first {draft({{0, 2}, {1, 2}}, std::nullopt, 3)};
+      const auto kept = LedgerAccess::commit(fg, s.ids[0], first);
+      std::vector<detail::RecordDraft> second {draft({{0, 1}})};
+      (void)LedgerAccess::commit(fg, s.ids[1], second);
+      s.drafts.push_back({draft({{0, 3}, {1, 3}}, kept[0].second, 2), draft({{1, 1}})});  // keeps and adds
+      s.drafts.push_back({draft({{0, 2}}, std::nullopt, 4)});                                // retires and adds a hold
+      s.retire = {false, true};
+      if (owners == 3) {
+        s.drafts.push_back({draft({{0, 1}, {1, 1}}), draft({{1, 2}})});
+        s.retire.push_back(true);
+      }
+      return s;
+    };
+    auto commit = [&](FlowLedger& fg, Staged& s) {
+      std::vector<detail::OwnerDrafts> parts;
+      for (std::size_t i = 0; i < s.ids.size(); ++i) parts.push_back({s.ids[i], s.drafts[i], s.retire[i]});
+      std::vector<std::vector<FlowId>> created(s.ids.size());
+      LedgerAccess::commit_batch(fg, parts, created);
+      return created;
+    };
+    FlowLedger ref(g);
+    Staged sref = stage(ref);
+    const LedgerState initial = ledger_state(ref);
+    const auto want_ids = commit(ref, sref);
+    const LedgerState after = ledger_state(ref);
+    long injected = 0;
+    for (long at = 0;; ++at) {
+      const std::string w = where + " allocation " + std::to_string(at);
+      const long live = g_live.load();
+      bool completed = false;
+      {
+        FlowLedger fg(g);
+        Staged s = stage(fg);
+        expect_same(ledger_state(fg), initial, w + " (setup)");
+        std::vector<std::vector<FlowId>> got;
+        if (!fails_at(at, [&] { got = commit(fg, s); })) {
+          EXPECT_EQ(got.size(), want_ids.size()) << w;
+          expect_same(ledger_state(fg), after, w + " (no failure)");
+          completed = true;
+        } else {
+          ++injected;
+          expect_same(ledger_state(fg), initial, w + " (failed)");
+          expect_balanced(fg, w + " (failed)");
+        }
+      }
+      EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+      if (completed || ::testing::Test::HasFailure()) break;
+    }
+    EXPECT_GT(injected, 5) << where;
+  }
+}
+
+} // namespace
diff --git a/tests/cpp/apply_actions_tests.cpp b/tests/cpp/apply_actions_tests.cpp
new file mode 100644
index 0000000..b5e3e9e
--- /dev/null
+++ b/tests/cpp/apply_actions_tests.cpp
@@ -0,0 +1,1819 @@
+// apply_actions, natively: the list's validation order (every refusal before anything is computed,
+// nothing changed), ORDERED as the scalar calls on a private working state (earlier actions first, FlowIds in
+// list order, outputs and holds after each action, normal outcomes, zero places, an abort
+// mid-list), SIMULTANEOUS on one view with the loss rule across demands (the view, preparation on
+// it, permutation, creation-order ties, pooled sources, the demand level, each participant's own
+// black holes, T1 holds, empty rosters, zero offers, repeats, orphans, iteration errors), link sums
+// beyond 2^63, counters beyond 2^64, per-entry outputs and every field of an entry. Hand-derived
+// values on small graphs (EdgeIds equal input positions unless mapped); the generators compare an
+// ORDERED list with the same scalar calls and a SIMULTANEOUS participant with its scalar call.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <functional>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::LedgerAccess;
+
+namespace {
+
+using Amounts = std::vector<Amount>;
+using Pairs = std::vector<std::pair<EdgeId, Amount>>;
+using Actions = std::vector<Action>;
+
+constexpr Admission LOSSY = Admission::Lossy;
+constexpr Admission LOSSLESS = Admission::Lossless;
+constexpr BatchMode ORDERED = BatchMode::Ordered;
+constexpr BatchMode SIMULTANEOUS = BatchMode::Simultaneous;
+const std::optional<Amount> INF;
+
+const std::string kPeriodTwo = "lossy forwarding iteration entered a period-2 cycle";
+const std::string kRoundLimit = "lossy forwarding iteration did not reach a fixed point within the round limit";
+const std::string kOffer = "offer must be an integer in [0, 2^62) or permitted +inf";
+
+Amount lo(const Counter128& x) {
+  EXPECT_EQ(x.hi, 0U);
+  return static_cast<Amount>(x.lo);
+}
+
+std::shared_ptr<const Graph> graph(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+
+FlowPolicyConfig ecmp(Admission admission = LOSSY) { return FlowPolicyConfig {.routing = shortest_paths(), .admission = admission}; }
+FlowPolicyConfig t1(Admission admission = LOSSY) { return FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}, .admission = admission}; }
+FlowPolicyConfig t2(Admission admission = LOSSY) {
+  return FlowPolicyConfig {.routing = centralized(SourceAllocation::Equal, nullptr, TunnelCount {1}), .admission = admission};
+}
+FlowPolicyConfig global(Admission admission = LOSSLESS) { return FlowPolicyConfig {.routing = centralized(), .admission = admission}; }
+FlowPolicyConfig pinned(std::shared_ptr<const ForwardingProgram> prog, Admission admission = LOSSY,
+                        std::shared_ptr<const Eligibility> black_holes = nullptr) {
+  return FlowPolicyConfig {.routing = Pinned {std::move(prog), std::move(black_holes)}, .admission = admission};
+}
+
+// A supplied program of tunnels: (head, EdgeIds in path order, weight).
+std::shared_ptr<const ForwardingProgram> tunnels(const Graph& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+                                                 const std::vector<std::tuple<NodeId, std::vector<EdgeId>, Amount>>& specs) {
+  std::vector<RouteDefinition> routes;
+  for (const auto& [h, es, w] : specs) {
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : es) hops.push_back({e});
+    routes.push_back(RouteDefinition {h, std::make_shared<const Path>(g, hops), w});
+  }
+  return ForwardingProgram::from_routes(g, s, d, routes);
+}
+std::shared_ptr<const ForwardingProgram> tunnel(const Graph& g, NodeId s, NodeId d, const std::vector<EdgeId>& path, Amount w = 1) {
+  return tunnels(g, {s}, {d}, {{s, path, w}});
+}
+
+std::shared_ptr<const Eligibility> no_edges(const Graph& g, const std::vector<EdgeId>& edges) {
+  return std::make_shared<const Eligibility>(g.eligibility({}, edges));
+}
+std::shared_ptr<const Eligibility> no_nodes(const Graph& g, const std::vector<NodeId>& nodes) {
+  return std::make_shared<const Eligibility>(g.eligibility(nodes, {}));
+}
+
+// A ledger with its policies (created in order) and what they point to (declared first).
+struct World {
+  std::shared_ptr<const Graph> g;
+  std::unique_ptr<FlowLedger> ledger;
+  std::vector<std::shared_ptr<const Eligibility>> keep;
+  std::vector<std::unique_ptr<FlowPolicy>> p;
+  explicit World(std::shared_ptr<const Graph> graph) : g(std::move(graph)), ledger(std::make_unique<FlowLedger>(g)) {}
+  World(std::shared_ptr<const Graph> graph, std::vector<Amount> service, std::vector<Amount> reservation)
+      : g(std::move(graph)), ledger(std::make_unique<FlowLedger>(g, service, reservation)) {}
+  FlowPolicy& add(const std::vector<NodeId>& s, const std::vector<NodeId>& d, FlowPolicyConfig cfg,
+                  std::shared_ptr<const Eligibility> elig = nullptr) {
+    keep.push_back(elig);
+    p.push_back(std::make_unique<FlowPolicy>(*ledger, s, d, std::move(cfg), elig.get()));
+    return *p.back();
+  }
+  FlowPolicy& pin(const std::shared_ptr<const ForwardingProgram>& prog, Admission admission = LOSSY,
+                  std::shared_ptr<const Eligibility> black_holes = nullptr, std::shared_ptr<const Eligibility> elig = nullptr) {
+    keep.push_back(black_holes);
+    return add(vec(prog->sources()), vec(prog->destinations()), pinned(prog, admission, black_holes), std::move(elig));
+  }
+  // The ledger and every policy's epoch.
+  struct State {
+    LedgerState ledger;
+    std::vector<Epoch> epochs;
+  };
+  [[nodiscard]] State state() const {
+    State s {ledger_state(*ledger), {}};
+    for (const auto& x : p) s.epochs.push_back(epoch(*x));
+    return s;
+  }
+};
+
+void expect_unchanged(const World& w, const World::State& before, const std::string& where) {
+  expect_same(ledger_state(*w.ledger), before.ledger, where);
+  ASSERT_EQ(w.p.size(), before.epochs.size());
+  for (std::size_t i = 0; i < w.p.size(); ++i) expect_unchanged(epoch(*w.p[i]), before.epochs[i], where + ", policy " + std::to_string(i));
+}
+
+// The message of the std::invalid_argument the list raises ("" for none), and that nothing changed.
+std::string refused(World& w, const Actions& actions, BatchMode mode, const OutputOptions& outputs = {}) {
+  const auto before = w.state();
+  const std::string what = error_of([&] { (void)apply_actions(*w.ledger, actions, mode, outputs); });
+  expect_unchanged(w, before, "refused: " + what);
+  return what;
+}
+
+std::vector<PlacementResult> run(World& w, const Actions& actions, BatchMode mode, const OutputOptions& outputs = {}) {
+  auto out = apply_actions(*w.ledger, actions, mode, outputs);
+  expect_balanced(*w.ledger, "after the list");
+  return out;
+}
+
+Amounts delivered(const std::vector<PlacementResult>& rs) {
+  Amounts out;
+  for (const auto& r : rs) out.push_back(r.call_delivered);
+  return out;
+}
+
+const OutputOptions kAll {.edge_flows = true, .residual = true, .saturated_boundary_edges = true, .edge_reservations = true};
+
+// The cycle Pc: CYC(1, 2), two tunnels crossing X (e0) and Y (e3) in opposite orders,
+// weights 1 and 2; its replace(3) enters a period-2 cycle.
+std::shared_ptr<const Graph> cyc12() {
+  return graph(6, {{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1}, {3, 5, 1000, 1}, {4, 0, 1000, 1},
+                   {4, 2, 1000, 1}});
+}
+std::shared_ptr<const ForwardingProgram> pc_program(const Graph& g) {
+  return tunnels(g, {4}, {5}, {{4, {6, 0, 1, 3, 5}, 1}, {4, {7, 3, 4, 0, 2}, 2}});
+}
+
+// ---------------------------------------------------------------- validation
+
+// An empty list returns nothing in both modes; a mode outside BatchMode is refused even then.
+TEST(ApplyActions, EmptyList) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  (void)e.place(3);
+  const auto before = w.state();
+  EXPECT_TRUE(run(w, {}, ORDERED).empty());
+  EXPECT_TRUE(run(w, {}, SIMULTANEOUS).empty());
+  expect_unchanged(w, before, "empty");
+  EXPECT_EQ(refused(w, {}, static_cast<BatchMode>(7)), "mode: 7 is not a value of BatchMode");
+  EXPECT_EQ(refused(w, {Place {e, 1}}, static_cast<BatchMode>(7)), "mode: 7 is not a value of BatchMode");
+}
+
+// Ownership, then the duplicate rule, per action in list order.
+TEST(ApplyActions, Duplicate) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  auto& e2 = w.add({0}, {1}, ecmp());
+  World other(graph(2, {{0, 1, 10, 1}}));
+  auto& x = other.add({0}, {1}, ecmp());
+  (void)e.place(2);
+  for (BatchMode mode : {ORDERED}) {
+    EXPECT_EQ(refused(w, {Place {e, 1}, Place {e, 2}}, mode), "duplicate policy in list");
+    EXPECT_EQ(refused(w, {Place {x, 1}}, mode), "list policy belongs to another ledger");
+    EXPECT_EQ(refused(w, {Place {x, 1}, Place {x, 1}}, mode), "list policy belongs to another ledger");
+    EXPECT_EQ(refused(w, {Place {e, 1}, Place {e, -1}}, mode), "duplicate policy in list");
+    EXPECT_EQ(refused(w, {Place {e, -1}, Place {e2, 1}}, mode), kOffer);
+    EXPECT_EQ(refused(w, {Place {e, -1}, Place {x, 1}}, mode), kOffer);
+  }
+  EXPECT_EQ(refused(w, {Replace {e, 1}, Forward {e, 1}}, SIMULTANEOUS), "duplicate policy in list");
+  EXPECT_EQ(refused(w, {Replace {e, 1}, Forward {e, 1}}, ORDERED), "duplicate policy in list");
+}
+
+// The SIMULTANEOUS rules in their order (kind, the Replace model, admission,
+// finiteness), then the scalar call's checks.
+TEST(ApplyActions, SimultaneousRefusals) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  auto& e2 = w.add({0}, {1}, ecmp());
+  auto& f = w.add({0}, {1}, ecmp(LOSSLESS));
+  auto& t = w.add({0}, {1}, t1());
+  auto& k = w.add({0}, {1}, global());
+  auto& opt = w.add({0}, {1}, FlowPolicyConfig {.routing = shortest_paths(RouteAllocation::Optimized), .admission = LOSSLESS});
+  auto& tt = w.add({0}, {1}, t2());
+  auto& p = w.pin(tunnel(*w.g, 0, 1, {0}));
+  auto& pll = w.pin(tunnel(*w.g, 0, 1, {0}), LOSSLESS);
+  (void)k.place(1);
+  EXPECT_EQ(refused(w, {Place {e, 1}}, SIMULTANEOUS), "SIMULTANEOUS does not accept Place");
+  const std::string model = "SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned";
+  EXPECT_EQ(refused(w, {Replace {t, 1}}, SIMULTANEOUS), model);
+  EXPECT_EQ(refused(w, {Replace {k, 1}}, SIMULTANEOUS), model);
+  EXPECT_EQ(refused(w, {Replace {opt, 1}}, SIMULTANEOUS), model);
+  EXPECT_EQ(refused(w, {Replace {tt, 1}}, SIMULTANEOUS), model);
+  const std::string lossy = "SIMULTANEOUS requires admission=LOSSY";
+  EXPECT_EQ(refused(w, {Replace {f, 1}}, SIMULTANEOUS), lossy);
+  EXPECT_EQ(refused(w, {Replace {pll, 1}}, SIMULTANEOUS), lossy);
+  EXPECT_EQ(refused(w, {Forward {k, 1}}, SIMULTANEOUS), lossy);
+  EXPECT_EQ(refused(w, {Replace {e, INF}}, SIMULTANEOUS), "SIMULTANEOUS requires finite offers");
+  EXPECT_EQ(refused(w, {Forward {p, 1}}, SIMULTANEOUS), "Pinned forwards with replace");
+  EXPECT_EQ(refused(w, {Forward {e2, 1}}, SIMULTANEOUS), "forward requires an installed program");
+  EXPECT_EQ(refused(w, {Replace {e, -1}}, SIMULTANEOUS), kOffer);
+  EXPECT_EQ(refused(w, {Replace {e, 1, std::optional<Amount> {1}}}, SIMULTANEOUS), "ShortestPaths does not accept design_demand");
+  // Several invalid parts in one action.
+  EXPECT_EQ(refused(w, {Forward {e2, INF}}, SIMULTANEOUS), "SIMULTANEOUS requires finite offers");
+  EXPECT_EQ(refused(w, {Forward {k, INF}}, SIMULTANEOUS), lossy);
+  EXPECT_EQ(refused(w, {Replace {t, -1}}, SIMULTANEOUS), model);
+}
+
+// ORDERED runs the scalar checks.
+TEST(ApplyActions, OrderedScalarChecks) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  World other(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  auto& t = w.add({0}, {1}, t1());
+  auto& tt = w.add({0}, {1}, t2());
+  auto& inf = w.add({0}, {1}, ecmp());
+  (void)inf.place(INF);
+  (void)e.place(1);
+  EXPECT_EQ(refused(w, {Place {t, 1}}, ORDERED), "DistributedTE does not support incremental placement");
+  EXPECT_EQ(refused(w, {Place {tt, 0}}, ORDERED), "CentralizedTE with tunnel_count does not support incremental placement");
+  const auto foreign = no_edges(*other.g, {0});
+  EXPECT_EQ(refused(w, {Forward {e, 1, foreign.get()}}, ORDERED), "black_holes belongs to another graph");
+  EXPECT_EQ(refused(w, {Place {inf, 1}}, ORDERED), "finite placement after infinite placement requires a new epoch");
+  EXPECT_EQ(refused(w, {Place {t, -1}}, ORDERED), "DistributedTE does not support incremental placement");
+}
+
+// An invalid last action of a long list: refused before anything is computed (not the
+// period-2 error the first action's computation raises).
+TEST(ApplyActions, InvalidLastActionChangesNothing) {
+  World w(cyc12());
+  auto& pc = w.pin(pc_program(*w.g));
+  auto& t = w.add({4}, {5}, t1());
+  std::vector<FlowPolicy*> fresh;
+  for (int i = 0; i < 48; ++i) fresh.push_back(&w.add({4}, {5}, ecmp()));
+  auto& e = w.add({4}, {5}, ecmp());
+  Actions ordered {Replace {pc, 3}};
+  for (auto* f : fresh) ordered.push_back(Place {*f, 1});
+  ordered.push_back(Place {t, 1});
+  EXPECT_EQ(refused(w, ordered, ORDERED), "DistributedTE does not support incremental placement");
+  Actions simultaneous {Replace {pc, 3}};
+  for (auto* f : fresh) simultaneous.push_back(Replace {*f, 1});
+  simultaneous.push_back(Place {e, 1});
+  EXPECT_EQ(refused(w, simultaneous, SIMULTANEOUS), "SIMULTANEOUS does not accept Place");
+  // Controls: the same lists without their last action reach the computation's error.
+  ordered.pop_back();
+  simultaneous.pop_back();
+  EXPECT_EQ(refused(w, ordered, ORDERED), kPeriodTwo);
+  EXPECT_EQ(refused(w, simultaneous, SIMULTANEOUS), kPeriodTwo);
+}
+
+// ---------------------------------------------------------------- ORDERED
+
+// Earlier actions are served first; a reservation protects nothing.
+TEST(ApplyActions, OrderIsPriority) {
+  for (bool tunnel_first : {false, true}) {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& e = w.add({0}, {1}, ecmp());
+    auto& t = w.add({0}, {1}, t1());
+    const Actions list = tunnel_first ? Actions {Replace {t, 10, std::optional<Amount> {10}}, Replace {e, 10}}
+                                      : Actions {Replace {e, 10}, Replace {t, 10, std::optional<Amount> {10}}};
+    const auto r = run(w, list, ORDERED);
+    const auto& er = tunnel_first ? r[1] : r[0];
+    const auto& tr = tunnel_first ? r[0] : r[1];
+    if (!tunnel_first) {
+      EXPECT_EQ(er.call_delivered, 10);
+      EXPECT_EQ(tr.call_delivered, 0);
+      EXPECT_EQ(tr.call_edge_drops, (Pairs {{0, 10}}));
+      ASSERT_EQ(tr.by_tunnel.size(), 1U);
+      EXPECT_EQ(tr.by_tunnel[0].status, TunnelStatus::Up);
+    } else {
+      EXPECT_EQ(tr.call_delivered, 10);
+      EXPECT_EQ(er.call_delivered, 0);
+      EXPECT_EQ(er.call_edge_drops, (Pairs {{0, 10}}));
+    }
+    EXPECT_EQ(w.ledger->carried(), (Amounts {10}));
+    EXPECT_EQ(w.ledger->reserved(), (Amounts {10}));
+    EXPECT_EQ(w.ledger->residual(), (Amounts {0}));
+    EXPECT_EQ(w.ledger->unreserved(), (Amounts {0}));
+  }
+}
+
+// New FlowIds follow list order (as the scalar sequence B, A), not creation order.
+TEST(ApplyActions, FlowIdsInListOrder) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& a = w.add({0}, {1}, ecmp());
+  auto& b = w.add({0}, {1}, ecmp());
+  (void)run(w, {Replace {b, 1}, Replace {a, 1}}, ORDERED);
+  ASSERT_EQ(b.records().size(), 1U);
+  ASSERT_EQ(a.records().size(), 1U);
+  EXPECT_EQ(b.records()[0].flow_id, (FlowId {w.ledger->uid(), 0}));
+  EXPECT_EQ(a.records()[0].flow_id, (FlowId {w.ledger->uid(), 1}));
+}
+
+// LIST-outputs-ordered: each action's outputs read the state after it.
+TEST(ApplyActions, OrderedOutputsAfterEachAction) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& a = w.add({0}, {1}, ecmp());
+  auto& b = w.add({0}, {1}, ecmp());
+  const OutputOptions o {.edge_flows = true, .residual = true, .saturated_boundary_edges = true};
+  const auto r = run(w, {Replace {a, 7}, Replace {b, 7}}, ORDERED, o);
+  EXPECT_EQ(r[0].call_delivered, 7);
+  EXPECT_EQ(*r[0].residual, (Amounts {3}));
+  EXPECT_EQ(*r[0].saturated_boundary_edges, (std::vector<EdgeId> {}));
+  EXPECT_EQ(*r[0].edge_flows, (Amounts {7}));
+  EXPECT_EQ(r[1].call_delivered, 3);
+  EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 4}}));
+  EXPECT_EQ(*r[1].residual, (Amounts {0}));
+  EXPECT_EQ(*r[1].saturated_boundary_edges, (std::vector<EdgeId> {0}));
+  EXPECT_EQ(*r[1].edge_flows, (Amounts {3}));
+}
+
+// Holds after each action: the second T1 sets up on the first's hold.
+TEST(ApplyActions, OrderedHoldsAfterEachAction) {
+  for (bool reversed : {false, true}) {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& t = w.add({0}, {1}, t1());
+    auto& u = w.add({0}, {1}, t1());
+    const OutputOptions o {.edge_reservations = true};
+    const Replace rt {t, 10, std::optional<Amount> {10}};
+    const Replace ru {u, 10, std::optional<Amount> {10}};
+    const auto r = run(w, reversed ? Actions {ru, rt} : Actions {rt, ru}, ORDERED, o);
+    const auto& first = r[0];
+    const auto& second = r[1];
+    ASSERT_EQ(first.by_tunnel.size(), 1U);
+    EXPECT_EQ(first.by_tunnel[0].status, TunnelStatus::Up);
+    EXPECT_EQ(first.call_delivered, 10);
+    EXPECT_EQ(*first.edge_reservations, (Amounts {10}));
+    ASSERT_EQ(second.by_tunnel.size(), 1U);
+    EXPECT_EQ(second.by_tunnel[0].status, TunnelStatus::InsufficientBandwidth);
+    EXPECT_EQ(second.call_source_drops, 10);
+    EXPECT_EQ(second.call_delivered, 0);
+    EXPECT_EQ(*second.edge_reservations, (Amounts {0}));
+    EXPECT_EQ(w.ledger->reserved(), (Amounts {10}));
+  }
+}
+
+// Normal outcomes commit; a zero place publishes nothing.
+TEST(ApplyActions, NormalOutcomesCommit) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  auto& f = w.add({0}, {1}, ecmp(LOSSLESS));
+  auto& e2 = w.add({0}, {1}, ecmp());
+  const auto r = run(w, {Replace {e, 10}, Replace {f, 5}}, ORDERED);
+  EXPECT_EQ(r[0].call_delivered, 10);
+  EXPECT_EQ(r[1].call_delivered, 0);
+  EXPECT_EQ(r[1].termination, Termination::Exhausted);
+  EXPECT_EQ(r[1].call_undelivered, 5);
+  ASSERT_EQ(f.records().size(), 1U);
+  EXPECT_EQ(f.records()[0].delivered, 0);
+  const auto before = w.state();
+  const auto z = run(w, {Place {e2, 0}}, ORDERED, OutputOptions {.residual = true});
+  EXPECT_EQ(z[0].call_delivered, 0);
+  EXPECT_EQ(z[0].program, nullptr);
+  EXPECT_FALSE(z[0].routes_changed);
+  EXPECT_EQ(*z[0].residual, (Amounts {0}));
+  expect_unchanged(w, before, "a zero place");
+}
+
+// An error mid-list publishes nothing (A, on its own link 6 -> 7, keeps its old record and id).
+TEST(ApplyActions, ErrorLeavesEverythingUnchanged) {
+  World w(graph(8, {{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1}, {3, 5, 1000, 1}, {4, 0, 1000, 1},
+                    {4, 2, 1000, 1}, {6, 7, 10, 1}}));
+  auto& a = w.add({6}, {7}, ecmp());
+  auto& pc = w.pin(pc_program(*w.g));
+  (void)a.place(2);
+  const auto id = a.records()[0].flow_id;
+  EXPECT_EQ(refused(w, {Replace {a, 5}, Replace {pc, 3}}, ORDERED), kPeriodTwo);
+  EXPECT_EQ(a.delivered(), 2);
+  EXPECT_EQ(a.records()[0].flow_id, id);
+}
+
+// Successful infinities in ORDERED lists and the first-hop experiment.
+TEST(ApplyActions, InfiniteOrderedActions) {
+  {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& f = w.add({0}, {1}, ecmp(LOSSLESS));
+    auto& e = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Replace {f, INF}, Replace {e, 1}}, ORDERED);
+    EXPECT_EQ(r[0].call_delivered, 10);
+    EXPECT_FALSE(r[0].requested.has_value());
+    EXPECT_FALSE(r[0].offered.has_value());
+    EXPECT_FALSE(r[0].unadmitted.has_value());
+    EXPECT_FALSE(r[0].call_undelivered.has_value());
+    EXPECT_EQ(r[0].termination, Termination::Exhausted);
+    EXPECT_EQ(r[1].call_delivered, 0);
+    EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 1}}));
+    EXPECT_EQ(r[1].termination, Termination::Complete);
+  }
+  const auto par = [] { return graph(2, {{0, 1, 4, 1}, {0, 1, 10, 1}}); };
+  {
+    World w(par());
+    auto& e = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Place {e, INF}}, ORDERED);
+    EXPECT_FALSE(r[0].requested.has_value());
+    EXPECT_EQ(lo(*r[0].offered), 14);
+    EXPECT_EQ(r[0].call_delivered, 14);
+    EXPECT_TRUE(r[0].call_edge_drops.empty());
+    EXPECT_EQ(r[0].termination, Termination::Exhausted);
+    EXPECT_EQ(refused(w, {Place {e, 0}}, ORDERED), "finite placement after infinite placement requires a new epoch");
+  }
+  {
+    World w(par());
+    auto& e = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Replace {e, 12}}, ORDERED);
+    EXPECT_EQ(r[0].call_delivered, 10);
+    EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 2}}));
+    const auto before = w.state();
+    (void)run(w, {Place {e, 0}}, ORDERED);
+    expect_unchanged(w, before, "a zero place after a finite replace");
+  }
+  {
+    World w(par());
+    auto& e = w.add({0}, {1}, ecmp());
+    (void)run(w, {Place {e, INF}}, ORDERED);
+    const auto r = run(w, {Replace {e, 12}}, ORDERED);
+    EXPECT_EQ(r[0].call_delivered, 10);
+    EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 2}}));
+    EXPECT_NO_THROW((void)run(w, {Place {e, 0}}, ORDERED));
+  }
+}
+
+// A returned counter crosses 2^64 (a place keeps its record's id).
+TEST(ApplyActions, CountersCrossTwoToThe64) {
+  const Amount w62 = kL62 - 1;
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& e = w.add({0}, {1}, ecmp());
+  for (int i = 0; i < 4; ++i) (void)e.place(w62);
+  const auto id = e.records()[0].flow_id;
+  const auto r = run(w, {Place {e, w62}}, ORDERED);
+  // 5w = 5 * (2^62 - 1) = 2^64 + 2^62 - 5.
+  const Counter128 want {1, (std::uint64_t {1} << 62) - 5};
+  EXPECT_EQ(r[0].requested, want);
+  EXPECT_EQ(r[0].offered, want);
+  EXPECT_EQ(r[0].admitted, want);
+  EXPECT_EQ(r[0].delivered, 10);
+  ASSERT_EQ(r[0].edge_drops.size(), 1U);
+  EXPECT_EQ(r[0].edge_drops[0].second, (Counter128 {1, (std::uint64_t {1} << 62) - 15}));
+  EXPECT_EQ(r[0].call_delivered, 0);
+  EXPECT_EQ(r[0].call_undelivered, w62);
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, w62}}));
+  EXPECT_EQ(e.records()[0].flow_id, id);
+}
+
+// ---------------------------------------------------------------- SIMULTANEOUS
+
+// D-simultaneous with its ORDERED contrast.
+TEST(ApplyActions, OrderedAgainstSimultaneous) {
+  for (BatchMode mode : {SIMULTANEOUS, ORDERED}) {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& a = w.add({0}, {1}, ecmp());
+    auto& b = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Replace {a, 10}, Replace {b, 10}}, mode);
+    if (mode == SIMULTANEOUS) {
+      EXPECT_EQ(delivered(r), (Amounts {5, 5}));
+      EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 5}}));
+      EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 5}}));
+    } else {
+      EXPECT_EQ(delivered(r), (Amounts {10, 0}));
+      EXPECT_TRUE(r[0].call_edge_drops.empty());
+      EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 10}}));
+    }
+  }
+}
+
+// The participants' old load is released together; permutation, repeat, removal.
+TEST(ApplyActions, SimultaneousViewReleasesTogether) {
+  auto setup = [](World& w) {
+    auto& o = w.add({0}, {1}, ecmp());
+    auto& a = w.add({0}, {1}, ecmp());
+    auto& b = w.add({0}, {1}, ecmp());
+    (void)o.place(4);
+    (void)a.place(1);
+    (void)b.place(5);
+    return std::tuple<FlowPolicy*, FlowPolicy*, FlowPolicy*> {&o, &a, &b};
+  };
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto [o, a, b] = setup(w);
+  const auto o_before = epoch(*o);
+  const auto r = run(w, {Replace {*a, 10}, Replace {*b, 10}}, SIMULTANEOUS);
+  EXPECT_EQ(delivered(r), (Amounts {3, 3}));
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 7}}));
+  EXPECT_EQ(r[0].delivery_delta, 2);
+  EXPECT_EQ(r[1].delivery_delta, -2);
+  EXPECT_EQ(w.ledger->carried(), (Amounts {10}));
+  expect_unchanged(epoch(*o), o_before, "the outside owner");
+  // Permuted, the same per-policy results in list order.
+  World w2(graph(2, {{0, 1, 10, 1}}));
+  auto [o2, a2, b2] = setup(w2);
+  const auto r2 = run(w2, {Replace {*b2, 10}, Replace {*a2, 10}}, SIMULTANEOUS);
+  expect_same(r2[0], r[1], "permuted B");
+  expect_same(r2[1], r[0], "permuted A");
+  // The same loads; the new records' FlowIds follow list order.
+  EXPECT_EQ(w2.ledger->carried(), w.ledger->carried());
+  EXPECT_EQ(a2->delivered(), a->delivered());
+  EXPECT_EQ(b2->delivered(), b->delivered());
+  EXPECT_EQ(b2->records()[0].flow_id.second + 1, a2->records()[0].flow_id.second);
+  // Repeated: the same amounts, delivery_delta 0, new FlowIds.
+  const auto ids = a->records()[0].flow_id;
+  const auto again = run(w, {Replace {*a, 10}, Replace {*b, 10}}, SIMULTANEOUS);
+  EXPECT_EQ(delivered(again), (Amounts {3, 3}));
+  EXPECT_EQ(again[0].delivery_delta, 0);
+  EXPECT_NE(a->records()[0].flow_id, ids);
+  // Removing A later frees only its traffic.
+  a->remove();
+  EXPECT_EQ(w.ledger->carried(), (Amounts {7}));
+  EXPECT_EQ(b->delivered(), 3);
+  // ORDERED the same list (the contrast): A on 0 + 1, B on 0 + 5.
+  World w3(graph(2, {{0, 1, 10, 1}}));
+  auto [o3, a3, b3] = setup(w3);
+  EXPECT_EQ(delivered(run(w3, {Replace {*a3, 10}, Replace {*b3, 10}}, ORDERED)), (Amounts {1, 5}));
+}
+
+// A ShortestPaths replace is prepared on the list's view (a residual snapshot reads it).
+TEST(ApplyActions, SimultaneousPreparationReadsTheView) {
+  for (BatchMode mode : {SIMULTANEOUS, ORDERED}) {
+    World w(graph(2, {{0, 1, 10, 1}, {0, 1, 10, 1}}));
+    ShortestPaths snap = shortest_paths(RouteAllocation::Weighted);
+    snap.weight_basis = WeightBasis::ResidualSnapshot;
+    auto& a = w.add({0}, {1}, FlowPolicyConfig {.routing = snap, .admission = LOSSY});
+    (void)a.replace(2);
+    auto& o = w.pin(tunnel(*w.g, 0, 1, {0}));
+    (void)o.place(8);
+    auto& b = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Replace {a, 12}, Replace {b, 4}}, mode);
+    if (mode == SIMULTANEOUS) {
+      EXPECT_TRUE(r[0].weights_changed);
+      EXPECT_FALSE(r[0].routes_changed);
+      EXPECT_EQ(r[0].call_delivered, 10);
+      EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 1}, {1, 1}}));
+      EXPECT_EQ(r[1].call_delivered, 2);
+      EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 1}, {1, 1}}));
+      EXPECT_EQ(w.ledger->carried(), (Amounts {10, 10}));
+    } else {
+      EXPECT_EQ(r[0].call_delivered, 12);
+      EXPECT_EQ(r[1].call_delivered, 0);
+      EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 2}, {1, 2}}));
+    }
+  }
+  // The other participant's old load is released before the preparation: B (a tunnel on edge 0)
+  // carries 8, the list replaces A (12) and B (8). On the list's view A's snapshot is (10, 10):
+  // A splits (6, 6), edge 0 shares 10 over A 6 and B 8 by highest averages, (4, 6) (A created
+  // first). On A's own view (B's 8 counted) it would be (2, 10), and nothing would drop. A single
+  // path by HIGHER_AVAILABLE_CAPACITY ties on the list's view and takes edge 0 (on A's own view,
+  // edge 1): edge 0 shares 10 over A 12 and B 8, (6, 4).
+  ShortestPaths snap = shortest_paths(RouteAllocation::Weighted);
+  snap.weight_basis = WeightBasis::ResidualSnapshot;
+  ShortestPaths single = shortest_paths();
+  single.tie_break = RouteTieBreak::HigherAvailableCapacity;
+  single.multipath = false;
+  single.parallel_edges = false;
+  for (const auto& [model, a_flows, want_delivered, want_carried] :
+       std::vector<std::tuple<ShortestPaths, Pairs, Amounts, Amounts>> {{snap, {{0, 4}, {1, 6}}, {10, 6}, {10, 6}},
+                                                                        {single, {{0, 6}}, {6, 4}, {10, 0}}}) {
+    World w(graph(2, {{0, 1, 10, 1}, {0, 1, 10, 1}}));
+    auto& a = w.add({0}, {1}, FlowPolicyConfig {.routing = model, .admission = LOSSY});
+    auto& b = w.pin(tunnel(*w.g, 0, 1, {0}));
+    (void)b.replace(8);
+    const auto r = run(w, {Replace {a, 12}, Replace {b, 8}}, SIMULTANEOUS);
+    ASSERT_EQ(a.records().size(), 1U);
+    EXPECT_EQ(a.records()[0].edge_flows, a_flows);
+    EXPECT_EQ(delivered(r), want_delivered);
+    EXPECT_EQ(w.ledger->carried(), want_carried);
+  }
+}
+
+// Ties follow creation order, never list position.
+TEST(ApplyActions, TiesFollowCreationOrder) {
+  World w(graph(2, {{0, 1, 1, 1}}));
+  const auto prog = tunnel(*w.g, 0, 1, {0});
+  auto& p0 = w.pin(prog);
+  auto& p1 = w.pin(prog);
+  const auto r = run(w, {Replace {p1, 1}, Replace {p0, 1}}, SIMULTANEOUS);
+  EXPECT_EQ(delivered(r), (Amounts {0, 1}));
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 1}}));
+  World w2(graph(2, {{0, 1, 1, 1}}));
+  const auto prog2 = tunnel(*w2.g, 0, 1, {0});
+  auto& q1 = w2.pin(prog2);
+  auto& q0 = w2.pin(prog2);
+  EXPECT_EQ(delivered(run(w2, {Replace {q1, 1}, Replace {q0, 1}}, SIMULTANEOUS)), (Amounts {1, 0}));
+}
+
+// A pooled demand shares a link; every field of both entries.
+TEST(ApplyActions, PooledDemandSharesALink) {
+  World w(graph(5, {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}, {2, 3, 1, 1}, {4, 2, 10, 1}}));
+  auto& a = w.add({0, 1}, {3}, ecmp());
+  auto& b = w.pin(tunnel(*w.g, 4, 3, {4, 2}));
+  const auto r = run(w, {Replace {a, 2}, Replace {b, 2}}, SIMULTANEOUS, kAll);
+  const auto& ra = r[0];
+  EXPECT_EQ(ra.call_delivered, 1);
+  EXPECT_EQ(ra.call_undelivered, 1);
+  EXPECT_EQ(ra.delivery_delta, 1);
+  EXPECT_EQ(ra.call_edge_drops, (Pairs {{2, 1}}));
+  EXPECT_EQ(ra.call_source_drops, 0);
+  EXPECT_EQ(ra.termination, Termination::Complete);
+  EXPECT_TRUE(ra.routes_changed);
+  EXPECT_TRUE(ra.weights_changed);
+  EXPECT_FALSE(ra.reservations_changed);
+  ASSERT_NE(ra.program, nullptr);
+  EXPECT_TRUE(ra.program->tunnels().empty());
+  EXPECT_FALSE(ra.plan.has_value());
+  EXPECT_EQ(lo(*ra.requested), 2);
+  EXPECT_EQ(lo(*ra.offered), 2);
+  EXPECT_EQ(lo(ra.admitted), 2);
+  EXPECT_EQ(ra.delivered, 1);
+  EXPECT_EQ(lo(*ra.unadmitted), 0);
+  EXPECT_EQ(lo(ra.source_drops), 0);
+  ASSERT_EQ(ra.edge_drops.size(), 1U);
+  EXPECT_EQ(ra.edge_drops[0].first, 2);
+  EXPECT_EQ(lo(ra.edge_drops[0].second), 1);
+  ASSERT_EQ(ra.by_source.size(), 2U);
+  EXPECT_EQ(ra.by_source[0].source, 0);
+  EXPECT_EQ(lo(*ra.by_source[0].offered), 1);
+  EXPECT_EQ(ra.by_source[0].delivered, 0);
+  EXPECT_EQ(lo(ra.by_source[0].total_edge_drops), 1);
+  EXPECT_EQ(ra.by_source[1].source, 1);
+  EXPECT_EQ(lo(*ra.by_source[1].offered), 1);
+  EXPECT_EQ(ra.by_source[1].delivered, 1);
+  EXPECT_TRUE(ra.by_tunnel.empty());
+  EXPECT_FALSE(ra.total_cost.has_value());
+  EXPECT_FALSE(ra.marginal_cost_curve.has_value());
+  EXPECT_EQ(*ra.edge_flows, (Amounts {1, 1, 0, 1, 0}));
+  EXPECT_EQ(*ra.residual, (Amounts {9, 9, 0, 0, 8}));
+  EXPECT_EQ(*ra.saturated_boundary_edges, (std::vector<EdgeId> {2, 3}));
+  EXPECT_EQ(*ra.edge_reservations, (Amounts {0, 0, 0, 0, 0}));
+  EXPECT_FALSE(ra.min_cut.has_value());
+  const auto recs = a.records();
+  ASSERT_EQ(recs.size(), 2U);
+  EXPECT_EQ(recs[0].edge_flows, (Pairs {{0, 1}}));
+  ASSERT_EQ(recs[0].edge_drops.size(), 1U);
+  EXPECT_EQ(recs[1].edge_flows, (Pairs {{1, 1}, {3, 1}}));
+  EXPECT_TRUE(recs[1].edge_drops.empty());
+  const auto& rb = r[1];
+  EXPECT_EQ(rb.call_delivered, 1);
+  EXPECT_EQ(rb.call_undelivered, 1);
+  EXPECT_EQ(rb.delivery_delta, 1);
+  EXPECT_EQ(rb.call_edge_drops, (Pairs {{2, 1}}));
+  EXPECT_EQ(rb.termination, Termination::Complete);
+  EXPECT_TRUE(rb.routes_changed);
+  EXPECT_TRUE(rb.weights_changed);
+  ASSERT_EQ(rb.by_tunnel.size(), 1U);
+  EXPECT_EQ(rb.by_tunnel[0].head, 4);
+  EXPECT_EQ(rb.by_tunnel[0].status, TunnelStatus::Up);
+  EXPECT_EQ(lo(rb.by_tunnel[0].assigned), 2);
+  EXPECT_EQ(rb.by_tunnel[0].delivered, 1);
+  EXPECT_EQ(lo(rb.by_tunnel[0].total_edge_drops), 1);
+  EXPECT_EQ(*rb.edge_flows, (Amounts {0, 0, 1, 0, 2}));
+  EXPECT_EQ(*rb.residual, (Amounts {9, 9, 0, 0, 8}));
+  EXPECT_EQ(w.ledger->carried(), (Amounts {1, 1, 1, 1, 2}));
+}
+
+// The list itself: n entries in input order.
+TEST(ApplyActions, ResultsInInputOrder) {
+  World w(graph(4, {{0, 1, 10, 1}, {2, 3, 10, 1}}));
+  auto& a = w.pin(tunnel(*w.g, 0, 1, {0}));
+  auto& b = w.pin(tunnel(*w.g, 2, 3, {1}));
+  for (BatchMode mode : {ORDERED, SIMULTANEOUS}) {
+    const auto r = run(w, {Replace {b, 7}, Replace {a, 3}}, mode);
+    ASSERT_EQ(r.size(), 2U);
+    EXPECT_EQ(delivered(r), (Amounts {7, 3}));
+    EXPECT_EQ(r[0].program->tunnels()[0].head, 2);
+  }
+}
+
+// The demand level above tunnels and sources.
+TEST(ApplyActions, DemandLevelAboveTunnels) {
+  World w(graph(2, {{0, 1, 1, 1}}));
+  auto& a = w.pin(tunnels(*w.g, {0}, {1}, {{0, {0}, 1}, {0, {0}, 1}}));
+  auto& b = w.pin(tunnel(*w.g, 0, 1, {0}));
+  const auto r = run(w, {Replace {a, 2}, Replace {b, 2}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].call_delivered, 1);
+  EXPECT_EQ(r[0].by_tunnel[0].delivered, 1);
+  EXPECT_EQ(r[0].by_tunnel[1].delivered, 0);
+  EXPECT_EQ(r[1].call_delivered, 0);
+  World w2(graph(2, {{0, 1, 1, 1}}));
+  auto& b2 = w2.pin(tunnel(*w2.g, 0, 1, {0}));
+  auto& a2 = w2.pin(tunnels(*w2.g, {0}, {1}, {{0, {0}, 1}, {0, {0}, 1}}));
+  EXPECT_EQ(delivered(run(w2, {Replace {a2, 2}, Replace {b2, 2}}, SIMULTANEOUS)), (Amounts {0, 1}));
+}
+
+TEST(ApplyActions, DemandLevelAboveSources) {
+  World w(graph(6, {{1, 3, 100, 1}, {2, 3, 100, 1}, {3, 4, 1, 1}, {5, 3, 100, 1}}));
+  auto& a = w.pin(tunnels(*w.g, {1, 2}, {4}, {{1, {0, 2}, 1}, {2, {1, 2}, 1}}));
+  auto& b = w.pin(tunnel(*w.g, 5, 4, {3, 2}));
+  const auto r = run(w, {Replace {a, 2}, Replace {b, 2}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].call_delivered, 1);
+  EXPECT_EQ(r[0].by_tunnel[0].delivered, 1);
+  EXPECT_EQ(r[1].call_delivered, 0);
+}
+
+// LIST-black-hole-own and a Forward with black holes: each participant's black holes are its own.
+TEST(ApplyActions, BlackHolesOfOneParticipant) {
+  {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& a = w.pin(tunnel(*w.g, 0, 1, {0}), LOSSY, no_edges(*w.g, {0}));
+    auto& b = w.add({0}, {1}, ecmp());
+    const auto r = run(w, {Replace {a, 10}, Replace {b, 10}}, SIMULTANEOUS, OutputOptions {.residual = true, .saturated_boundary_edges = true});
+    EXPECT_EQ(r[0].call_delivered, 0);
+    EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 10}}));
+    EXPECT_EQ(r[0].by_tunnel[0].status, TunnelStatus::Blackholed);
+    EXPECT_EQ(r[1].call_delivered, 10);
+    EXPECT_TRUE(r[1].call_edge_drops.empty());
+    EXPECT_EQ(*r[0].residual, (Amounts {0}));
+    EXPECT_EQ(*r[1].residual, (Amounts {0}));
+    EXPECT_EQ(*r[0].saturated_boundary_edges, (std::vector<EdgeId> {0}));
+  }
+  {
+    World w(graph(2, {{0, 1, 10, 1}, {0, 1, 10, 1}}));
+    auto& a = w.add({0}, {1}, ecmp());
+    auto& b = w.add({0}, {1}, ecmp());
+    (void)a.replace(2);
+    const auto bh = no_edges(*w.g, {1});
+    const auto r = run(w, {Forward {a, 10, bh.get()}, Replace {b, 10}}, SIMULTANEOUS);
+    EXPECT_EQ(r[0].call_delivered, 5);
+    EXPECT_EQ(r[0].call_edge_drops, (Pairs {{1, 5}}));
+    EXPECT_EQ(r[1].call_delivered, 10);
+    EXPECT_EQ(w.ledger->carried(), (Amounts {10, 5}));
+  }
+}
+
+// LIST-black-hole-upstream: a black hole downstream of a shared link; the two links are no
+// transparent pair.
+TEST(ApplyActions, BlackHoleDownstreamOfASharedLink) {
+  World w(graph(3, {{0, 1, 10, 1}, {1, 2, 10, 1}}));
+  auto& a = w.pin(tunnel(*w.g, 0, 2, {0, 1}), LOSSY, no_edges(*w.g, {1}));
+  auto& b = w.pin(tunnel(*w.g, 0, 2, {0, 1}));
+  const auto r = run(w, {Replace {a, 10}, Replace {b, 10}}, SIMULTANEOUS, OutputOptions {.residual = true, .saturated_boundary_edges = true});
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 5}, {1, 5}}));
+  EXPECT_EQ(r[0].by_tunnel[0].status, TunnelStatus::Blackholed);
+  EXPECT_EQ(r[1].call_delivered, 5);
+  EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 5}}));
+  EXPECT_EQ(*r[0].residual, (Amounts {0, 5}));
+  EXPECT_EQ(*r[0].saturated_boundary_edges, (std::vector<EdgeId> {0}));
+  EXPECT_EQ(*r[1].saturated_boundary_edges, (std::vector<EdgeId> {0}));
+}
+
+// A T1 Forward keeps its holds and plan.
+TEST(ApplyActions, ForwardKeepsHolds) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& t = w.add({0}, {1}, t1());
+  auto& e = w.add({0}, {1}, ecmp());
+  (void)t.replace(5, std::optional<Amount> {5});
+  const auto r = run(w, {Forward {t, 10}, Replace {e, 10}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].call_delivered, 5);
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 5}}));
+  EXPECT_FALSE(r[0].routes_changed);
+  EXPECT_FALSE(r[0].reservations_changed);
+  ASSERT_TRUE(r[0].plan.has_value());
+  EXPECT_EQ(r[0].plan->total_reserved_bandwidth, 5);
+  ASSERT_EQ(t.records().size(), 1U);
+  EXPECT_EQ(t.records()[0].edge_reservations, (Pairs {{0, 5}}));
+  EXPECT_EQ(r[1].call_delivered, 5);
+  EXPECT_EQ(w.ledger->carried(), (Amounts {10}));
+  EXPECT_EQ(w.ledger->reserved(), (Amounts {5}));
+}
+
+// Empty rosters and masked participants.
+TEST(ApplyActions, EmptyRosterParticipants) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  const auto mask = no_edges(*w.g, {0});
+  auto& m = w.add({0}, {1}, ecmp(), mask);
+  auto& e = w.add({0}, {1}, ecmp());
+  auto& p = w.pin(tunnel(*w.g, 0, 1, {0}), LOSSY, nullptr, mask);
+  const auto r = run(w, {Replace {m, 5}, Replace {e, 10}, Replace {p, 5}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].termination, Termination::NoRoute);
+  EXPECT_EQ(r[0].call_source_drops, 5);
+  EXPECT_EQ(lo(*r[0].offered), 5);
+  EXPECT_EQ(lo(r[0].source_drops), 5);
+  EXPECT_TRUE(m.records().empty());
+  EXPECT_EQ(r[1].call_delivered, 10);
+  EXPECT_EQ(r[2].termination, Termination::NoRoute);
+  EXPECT_EQ(r[2].call_source_drops, 5);
+  ASSERT_EQ(p.records().size(), 1U);
+  EXPECT_EQ(p.records()[0].delivered, 0);
+}
+
+TEST(ApplyActions, EverythingMasked) {
+  for (BatchMode mode : {ORDERED, SIMULTANEOUS}) {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    const auto mask = no_edges(*w.g, {0});
+    auto& m1 = w.add({0}, {1}, ecmp(), mask);
+    auto& m2 = w.add({0}, {1}, ecmp(), mask);
+    auto& p = w.pin(tunnel(*w.g, 0, 1, {0}), LOSSY, nullptr, mask);
+    const auto r = run(w, {Replace {m1, 5}, Replace {m2, 5}, Replace {p, 5}}, mode);
+    for (const auto& x : r) {
+      EXPECT_EQ(x.termination, Termination::NoRoute);
+      EXPECT_EQ(x.call_source_drops, 5);
+    }
+    EXPECT_TRUE(m1.records().empty());
+    EXPECT_TRUE(m2.records().empty());
+    ASSERT_EQ(p.records().size(), 1U);
+    EXPECT_EQ(w.ledger->carried(), (Amounts {0}));
+  }
+}
+
+// Zero offers prepare and record; an ORDERED zero place does not.
+TEST(ApplyActions, ZeroOffers) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& a = w.add({0}, {1}, ecmp());
+  auto& b = w.add({0}, {1}, ecmp());
+  const auto r = run(w, {Replace {a, 0}, Replace {b, 0}}, SIMULTANEOUS);
+  for (const auto& x : r) {
+    EXPECT_EQ(x.termination, Termination::Complete);
+    EXPECT_EQ(x.call_delivered, 0);
+    EXPECT_NE(x.program, nullptr);
+    EXPECT_TRUE(x.routes_changed);
+    EXPECT_TRUE(x.weights_changed);
+  }
+  EXPECT_EQ(a.records().size(), 1U);
+  EXPECT_EQ(b.records().size(), 1U);
+  EXPECT_EQ(w.ledger->carried(), (Amounts {0}));
+}
+
+// Holds never enter the view; orphans are fixed load.
+TEST(ApplyActions, HoldsAndOrphansStayOutside) {
+  {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    auto& t = w.add({0}, {1}, t1());
+    auto& e = w.add({0}, {1}, ecmp());
+    (void)t.replace(0, std::optional<Amount> {10});
+    EXPECT_EQ(run(w, {Replace {e, 10}}, SIMULTANEOUS)[0].call_delivered, 10);
+  }
+  {
+    World w(graph(2, {{0, 1, 10, 1}}));
+    w.add({0}, {1}, ecmp()).place(4);
+    w.p.pop_back();  // orphaned
+    auto& a = w.add({0}, {1}, ecmp());
+    auto& b = w.add({0}, {1}, ecmp());
+    EXPECT_EQ(delivered(run(w, {Replace {a, 10}, Replace {b, 10}}, SIMULTANEOUS)), (Amounts {3, 3}));
+    EXPECT_EQ(w.ledger->carried(), (Amounts {10}));
+  }
+}
+
+// An iteration error, and a failed check, publish nothing.
+TEST(ApplyActions, IterationErrorsChangeNothing) {
+  // D-C3 as three Pinned tunnels: A 0, 1 (1); B 1, 2 (1); C 2, 0 (2); V 1, 1, 2 (CYC-like layout:
+  // each link its own nodes, wide connectors).
+  World w(shared(make_graph(8, {{0, 1, 1, 1}, {2, 3, 1, 1}, {4, 5, 2, 1}, {1, 2, 1000, 1}, {3, 4, 1000, 1}, {5, 0, 1000, 1},
+                                {6, 0, 1000, 1}, {6, 2, 1000, 1}, {6, 4, 1000, 1}, {3, 7, 1000, 1}, {5, 7, 1000, 1}, {1, 7, 1000, 1}})));
+  // EdgeIds sort by tail: map the input rows.
+  const auto id = id_of_input(*w.g);
+  auto ids = [&](std::vector<int> in) {
+    std::vector<EdgeId> out;
+    for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  auto& a = w.pin(tunnel(*w.g, 6, 7, ids({6, 0, 3, 1, 9})));
+  auto& b = w.pin(tunnel(*w.g, 6, 7, ids({7, 1, 4, 2, 10})));
+  auto& c = w.pin(tunnel(*w.g, 6, 7, ids({8, 2, 5, 0, 11})));
+  (void)a.replace(1);
+  (void)b.replace(1);
+  (void)c.replace(1);
+  EXPECT_EQ(refused(w, {Replace {a, 1}, Replace {b, 1}, Replace {c, 2}}, SIMULTANEOUS), kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+  // The independent check across demands, through the hook (a settling cyclic list).
+  World s(graph(6, {{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 1, 1}, {3, 0, 1000, 1}, {3, 5, 1000, 1},
+                    {4, 0, 1000, 1}, {4, 2, 1000, 1}}));
+  auto& x = s.pin(tunnel(*s.g, 4, 5, {6, 0, 1, 3, 5}));
+  auto& y = s.pin(tunnel(*s.g, 4, 5, {7, 3, 4, 0, 2}));
+  const auto before = s.state();
+  detail::thread_lossy_counters().corrupt = true;
+  std::string what;
+  try {
+    (void)apply_actions(*s.ledger, Actions {Replace {x, 1}, Replace {y, 1}}, SIMULTANEOUS);
+  } catch (const std::runtime_error& e) {
+    what = e.what();
+  }
+  detail::thread_lossy_counters().corrupt = false;
+  EXPECT_EQ(what, "lossy forwarding fixed-point verification failed");
+  expect_unchanged(s, before, "the failed check");
+  // One unit moved between the two occurrences of one barrier before the final forwarding: every
+  // continuation stays consistent, only that link's loss rule is wrong.
+  const auto before_shift = s.state();
+  detail::thread_lossy_counters().shift = true;
+  what.clear();
+  try {
+    (void)apply_actions(*s.ledger, Actions {Replace {x, 1}, Replace {y, 1}}, SIMULTANEOUS);
+  } catch (const std::runtime_error& e) {
+    what = e.what();
+  }
+  detail::thread_lossy_counters().shift = false;
+  EXPECT_EQ(what, "lossy forwarding fixed-point verification failed");
+  expect_unchanged(s, before_shift, "the failed check of a moved unit");
+  EXPECT_EQ(delivered(run(s, {Replace {x, 1}, Replace {y, 1}}, SIMULTANEOUS)), (Amounts {1, 0}));
+#endif
+}
+
+// Link sums beyond 2^63 and 2^64; disjoint maximal participants.
+TEST(ApplyActions, MaximalOffersShareALink) {
+  const Amount w62 = kL62 - 1;
+  for (const auto& [n, cap, want] : std::vector<std::tuple<int, Amount, Amounts>> {
+           {2, 10, {5, 5}}, {3, 10, {4, 3, 3}}, {5, 10, {2, 2, 2, 2, 2}}, {5, 11, {3, 2, 2, 2, 2}}}) {
+    World w(graph(2, {{0, 1, cap, 1}}));
+    const auto prog = tunnel(*w.g, 0, 1, {0});
+    Actions list;
+    for (int i = 0; i < n; ++i) list.push_back(Replace {w.pin(prog), w62});
+    const auto r = run(w, list, SIMULTANEOUS);
+    EXPECT_EQ(delivered(r), want) << n << " demands";
+    for (int i = 0; i < n; ++i) EXPECT_EQ(r[static_cast<std::size_t>(i)].call_edge_drops, (Pairs {{0, w62 - want[static_cast<std::size_t>(i)]}}));
+  }
+}
+
+TEST(ApplyActions, DisjointMaximalParticipants) {
+  const Amount w62 = (kL62 - 1) / 5;  // the graph's capacity sum stays below 2^62
+  std::vector<InEdge> rows;
+  for (int i = 0; i < 5; ++i) rows.push_back({0, 1, w62, 1});
+  World w(graph(2, rows));
+  Actions list;
+  for (EdgeId e = 0; e < 5; ++e) list.push_back(Replace {w.pin(tunnel(*w.g, 0, 1, {e})), w62});
+  const auto r = run(w, list, SIMULTANEOUS);
+  EXPECT_EQ(delivered(r), Amounts(5, w62));
+  EXPECT_EQ(w.ledger->carried(), Amounts(5, w62));
+}
+
+// An imported T1 program beside its live owner, unequal baselines; the orphan variant.
+TEST(ApplyActions, ImportedTunnelsBookNoHolds) {
+  {
+    World w(graph(2, {{0, 1, 10, 1}}), {8}, {6});
+    auto& t = w.add({0}, {1}, t1());
+    (void)t.replace(0, std::optional<Amount> {6});
+    auto& p = w.pin(t.program());
+    const auto r = run(w, {Forward {t, 8}, Replace {p, 8}}, SIMULTANEOUS, OutputOptions {.edge_reservations = true});
+    EXPECT_EQ(delivered(r), (Amounts {4, 4}));
+    EXPECT_EQ(w.ledger->carried(), (Amounts {8}));
+    EXPECT_EQ(w.ledger->reserved(), (Amounts {6}));
+    EXPECT_EQ(*r[1].edge_reservations, (Amounts {0}));
+    EXPECT_FALSE(r[1].plan.has_value());
+    ASSERT_TRUE(r[0].plan.has_value());
+  }
+  {
+    World w(graph(2, {{0, 1, 10, 1}}), {8}, {6});
+    w.add({0}, {1}, t1()).replace(0, std::optional<Amount> {6});
+    const auto prog = w.p.back()->program();
+    w.p.pop_back();
+    auto& p = w.pin(prog);
+    EXPECT_EQ(run(w, {Replace {p, 8}}, SIMULTANEOUS)[0].call_delivered, 8);
+    EXPECT_EQ(w.ledger->reserved(), (Amounts {6}));
+  }
+}
+
+// A zero Forward keeps holds, plan and program, retires its old id.
+TEST(ApplyActions, ZeroForward) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& t = w.add({0}, {1}, t1());
+  auto& e = w.add({0}, {1}, ecmp());
+  (void)t.replace(6, std::optional<Amount> {6});
+  const auto old = t.records()[0].flow_id;
+  const auto prog = t.program();
+  const auto r = run(w, {Forward {t, 0}, Replace {e, 10}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].termination, Termination::Complete);
+  EXPECT_EQ(r[0].call_delivered, 0);
+  EXPECT_EQ(r[0].delivery_delta, -6);
+  EXPECT_EQ(lo(r[0].by_tunnel[0].assigned), 0);
+  EXPECT_EQ(t.program(), prog);
+  ASSERT_EQ(t.records().size(), 1U);
+  EXPECT_NE(t.records()[0].flow_id, old);
+  EXPECT_EQ(t.records()[0].edge_reservations, (Pairs {{0, 6}}));
+  EXPECT_EQ(r[1].call_delivered, 10);
+  const auto f = t.forward(8);
+  EXPECT_EQ(f.call_delivered, 0);
+  EXPECT_EQ(f.call_edge_drops, (Pairs {{0, 8}}));
+  EXPECT_EQ(w.ledger->reserved(), (Amounts {6}));
+}
+
+// Black-holed sources and nodes; a repair mask first.
+TEST(ApplyActions, BlackHoledSourcesAndNodes) {
+  World w(graph(5, {{0, 2, 10, 1}, {1, 2, 10, 1}, {3, 4, 10, 1}}));
+  auto& a = w.add({0, 1}, {2}, ecmp());
+  (void)a.replace(2);
+  auto& z = w.pin(tunnel(*w.g, 3, 4, {2}));
+  const auto bh = no_nodes(*w.g, {0});
+  const auto r = run(w, {Forward {a, 4, bh.get()}, Replace {z, 3}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].call_source_drops, 2);
+  EXPECT_TRUE(r[0].call_edge_drops.empty());
+  EXPECT_EQ(r[0].call_delivered, 2);
+  EXPECT_EQ(r[1].call_delivered, 3);
+  // A Pinned over A's program under a repair mask excluding node 0: source 1 takes the whole offer.
+  auto& q = w.pin(a.program(), LOSSY, nullptr, no_nodes(*w.g, {0}));
+  const auto rq = run(w, {Replace {q, 4}, Replace {z, 3}}, SIMULTANEOUS);
+  EXPECT_EQ(rq[0].call_delivered, 4);
+  EXPECT_EQ(rq[0].call_source_drops, 0);
+  // An internal black-holed node.
+  World w2(graph(3, {{0, 1, 10, 1}, {1, 2, 10, 1}}));
+  auto& n = w2.pin(tunnel(*w2.g, 0, 2, {0, 1}), LOSSY, no_nodes(*w2.g, {1}));
+  const auto rn = run(w2, {Replace {n, 6}}, SIMULTANEOUS);
+  EXPECT_EQ(rn[0].by_tunnel[0].status, TunnelStatus::Blackholed);
+  EXPECT_EQ(rn[0].call_edge_drops, (Pairs {{0, 6}}));
+}
+
+// Zero service against zero weight, beside a positive participant.
+TEST(ApplyActions, ZeroServiceAndZeroWeight) {
+  World w(graph(4, {{0, 1, 0, 1}, {2, 3, 10, 1}}));
+  auto& z = w.add({0}, {1}, ecmp());
+  auto& pos = w.pin(tunnel(*w.g, 2, 3, {1}));
+  const auto r = run(w, {Replace {z, 2}, Replace {pos, 4}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].termination, Termination::Complete);
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{0, 2}}));
+  EXPECT_EQ(r[1].call_delivered, 4);
+  World w2(graph(4, {{0, 1, 10, 1}, {2, 3, 10, 1}}));
+  auto& zw = w2.pin(tunnel(*w2.g, 0, 1, {0}, 0));
+  auto& pos2 = w2.pin(tunnel(*w2.g, 2, 3, {1}));
+  const auto r2 = run(w2, {Replace {zw, 2}, Replace {pos2, 4}}, SIMULTANEOUS);
+  EXPECT_EQ(r2[0].termination, Termination::NoActiveWeight);
+  EXPECT_EQ(r2[0].call_source_drops, 2);
+  EXPECT_EQ(zw.records().size(), 1U);
+  EXPECT_EQ(r2[1].call_delivered, 4);
+}
+
+// Every root of a pooled demand is an injection (alone, and beside a disjoint participant),
+// equal to the scalar replace.
+TEST(ApplyActions, PooledRootsBlockSerialPairs) {
+  auto make = [] { return graph(6, {{0, 1, 2, 1}, {1, 2, 2, 1}, {2, 3, 2, 1}, {4, 5, 10, 1}}); };
+  World scalar(make());
+  const auto want = scalar.add({0, 1, 2}, {3}, ecmp()).replace(6);
+  for (bool beside : {false, true}) {
+    World w(make());
+    auto& a = w.add({0, 1, 2}, {3}, ecmp());
+    auto& z = w.pin(tunnel(*w.g, 4, 5, {3}));
+    const auto r = run(w, beside ? Actions {Replace {a, 6}, Replace {z, 1}} : Actions {Replace {a, 6}}, SIMULTANEOUS);
+    expect_same(r[0], want, beside ? "beside" : "alone");
+    EXPECT_EQ(r[0].call_delivered, 2);
+    EXPECT_EQ(r[0].by_source[0].delivered, 1);
+    EXPECT_EQ(r[0].by_source[1].delivered, 0);
+    EXPECT_EQ(r[0].by_source[2].delivered, 1);
+  }
+}
+
+// A pooled cycle keeps per-source state (solved at round 3).
+TEST(ApplyActions, PooledCycleKeepsSourceState) {
+  World w(shared(make_graph(9, {{0, 1, 1, 1}, {2, 3, 1, 1}, {4, 0, 100, 1}, {1, 2, 100, 1}, {5, 2, 100, 1}, {3, 6, 100, 1},
+                                {7, 2, 100, 1}, {3, 0, 100, 1}, {1, 8, 100, 1}})));
+  const auto id = id_of_input(*w.g);
+  auto& a = w.add({4, 5}, {6}, ecmp());
+  auto& b = w.pin(tunnel(*w.g, 7, 8, {id[6], id[1], id[7], id[0], id[8]}));
+  const auto r = run(w, {Replace {a, 2}, Replace {b, 1}}, SIMULTANEOUS);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+  EXPECT_EQ(r[0].call_delivered, 1);
+  EXPECT_EQ(r[0].by_source[0].delivered, 1);
+  EXPECT_EQ(r[0].by_source[1].delivered, 0);
+  EXPECT_EQ(r[1].call_delivered, 0);
+  EXPECT_EQ(r[1].call_edge_drops, (Pairs {{id[1], 1}}));
+}
+
+// Dark arrivals add no barrier: the round-limit example's graph plus 16 -> 6, its three demands
+// (heads 12, 13, 14, offers 13, 11, 10; black holes {5}, used by head 12 only) and a fourth demand D
+// from 16 to 1 (offer 1) whose black holes {16, 11} drop its offer on its first link. The cyclic group
+// keeps its four physical links (0, 2, 7, 11): the round-limit error after 256 rounds, nothing
+// published (a dark copy of D's link 11 as a fifth barrier would allow 320).
+TEST(ApplyActions, DarkArrivalsAddNoBarrier) {
+  World w(shared(make_graph(17, {{0, 1, 12, 1},    {1, 6, 1000, 1},  {2, 3, 9, 1},     {3, 0, 1000, 1},  {3, 10, 1000, 1},
+                                 {4, 5, 7, 1},     {5, 6, 1000, 1},  {6, 7, 13, 1},    {7, 2, 1000, 1},  {7, 10, 1000, 1},
+                                 {8, 9, 1, 1},     {10, 11, 10, 1},  {11, 2, 1000, 1}, {12, 4, 1000, 1}, {13, 6, 1000, 1},
+                                 {14, 0, 1000, 1}, {16, 6, 1000, 1}})));
+  const auto id = id_of_input(*w.g);
+  auto ids = [&](std::vector<int> in) {
+    std::vector<EdgeId> out;
+    for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  auto& a = w.pin(tunnel(*w.g, 12, 11, ids({13, 5, 6, 7, 8, 2, 4, 11})), LOSSY, no_edges(*w.g, ids({5})));
+  auto& b = w.pin(tunnel(*w.g, 13, 1, ids({14, 7, 9, 11, 12, 2, 3, 0})));
+  auto& c = w.pin(tunnel(*w.g, 14, 7, ids({15, 0, 1, 7})));
+  const Actions three {Replace {a, 13}, Replace {b, 11}, Replace {c, 10}};
+  EXPECT_EQ(refused(w, three, SIMULTANEOUS), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 256);
+#endif
+  auto& d = w.pin(tunnel(*w.g, 16, 1, ids({16, 7, 9, 11, 12, 2, 3, 0})), LOSSY, no_edges(*w.g, ids({16, 11})));
+  Actions four = three;
+  four.push_back(Replace {d, 1});
+  EXPECT_EQ(refused(w, four, SIMULTANEOUS), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 256);
+#endif
+  // D alone: its offer dies on its first link.
+  const auto r = run(w, {Replace {d, 1}}, SIMULTANEOUS);
+  EXPECT_EQ(r[0].call_edge_drops, (Pairs {{id[16], 1}}));
+  EXPECT_EQ(r[0].by_tunnel[0].status, TunnelStatus::Blackholed);
+  // A dark arrival on a link that otherwise fits: E from 16 over a wide feeder to node 7, black-holed
+  // on the cycle's connector 7 -> 2 (1000 units, row 8), offers 1000. The connector carries only head
+  // 12's arrivals (at most 13): it stays no barrier, and the group fails after 256 rounds (counting
+  // E's 1000 in its no-drop load would make it a fifth barrier: 320).
+  World w2(shared(make_graph(17, {{0, 1, 12, 1},    {1, 6, 1000, 1},  {2, 3, 9, 1},     {3, 0, 1000, 1},  {3, 10, 1000, 1},
+                                  {4, 5, 7, 1},     {5, 6, 1000, 1},  {6, 7, 13, 1},    {7, 2, 1000, 1},  {7, 10, 1000, 1},
+                                  {8, 9, 1, 1},     {10, 11, 10, 1},  {11, 2, 1000, 1}, {12, 4, 1000, 1}, {13, 6, 1000, 1},
+                                  {14, 0, 1000, 1}, {16, 7, 2000, 1}})));
+  const auto id2 = id_of_input(*w2.g);
+  auto ids2 = [&](std::vector<int> in) {
+    std::vector<EdgeId> out;
+    for (int i : in) out.push_back(id2[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  auto& a2 = w2.pin(tunnel(*w2.g, 12, 11, ids2({13, 5, 6, 7, 8, 2, 4, 11})), LOSSY, no_edges(*w2.g, ids2({5})));
+  auto& b2 = w2.pin(tunnel(*w2.g, 13, 1, ids2({14, 7, 9, 11, 12, 2, 3, 0})));
+  auto& c2 = w2.pin(tunnel(*w2.g, 14, 7, ids2({15, 0, 1, 7})));
+  auto& e2 = w2.pin(tunnel(*w2.g, 16, 2, ids2({16, 8})), LOSSY, no_edges(*w2.g, ids2({8})));
+  EXPECT_EQ(refused(w2, {Replace {a2, 13}, Replace {b2, 11}, Replace {c2, 10}, Replace {e2, 1000}}, SIMULTANEOUS), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 256);
+#endif
+}
+
+// An entry whose share is 0 can carry nothing, so it makes no link wait and joins no group. Two
+// cycles (CYC(1, 2) twice, 4 -> 5 and 16 -> 17, offers 1 and 2 each) bridged by two Pinned
+// tunnels of offer 0 (4 -> 17 over the first cycle's X and the second's links, 16 -> 5 the other
+// way): the period-2 error at round 3 with or without the bridges (with arcs through them the two
+// groups merged and failed at the round limit). And a link X before a period-2 pair: A over X, L0,
+// L1, B over L1, L0, offers 2; Z over L0 then X offers 0, as a Pinned tunnel or a ShortestPaths
+// demand: the period-2 error at round 3 with or without Z.
+TEST(ApplyActions, ZeroSharesAddNoArc) {
+  auto ids_of = [](const std::vector<EdgeId>& id, std::vector<int> in) {
+    std::vector<EdgeId> out;
+    for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  const std::vector<InEdge> bridge_rows {{0, 1, 1, 1},       {1, 2, 1000, 1},   {1, 5, 1000, 1},   {2, 3, 2, 1},       {3, 0, 1000, 1},
+                                         {3, 5, 1000, 1},    {4, 0, 1000, 1},   {4, 2, 1000, 1},   {10, 11, 1, 1},     {11, 14, 1000, 1},
+                                         {12, 13, 2, 1},     {13, 10, 1000, 1}, {13, 17, 1000, 1}, {14, 15, 1, 1},     {15, 12, 1000, 1},
+                                         {15, 17, 1000, 1},  {16, 10, 1000, 1}, {16, 12, 1000, 1}, {1, 10, 1000, 1},   {11, 0, 1000, 1}};
+  const std::vector<std::tuple<NodeId, NodeId, std::vector<int>, Amount>> bridged {
+      {4, 5, {6, 0, 1, 3, 5}, 1},           {4, 5, {7, 3, 4, 0, 2}, 2},       {16, 17, {16, 8, 9, 13, 14, 10, 12}, 1},
+      {16, 17, {17, 10, 11, 8, 9, 13, 15}, 2}, {4, 17, {6, 0, 18, 8, 9, 13, 15}, 0}, {16, 5, {16, 8, 19, 0, 2}, 0}};
+  for (std::size_t count : {std::size_t {4}, std::size_t {6}}) {
+    World w(shared(make_graph(18, bridge_rows)));
+    const auto id = id_of_input(*w.g);
+    Actions list;
+    for (std::size_t i = 0; i < count; ++i) {
+      const auto& [s, d, path, offer] = bridged[i];
+      auto& p = w.pin(tunnel(*w.g, s, d, ids_of(id, path)));
+      (void)p.replace(1);
+      list.push_back(Replace {p, offer});
+    }
+    EXPECT_EQ(refused(w, list, SIMULTANEOUS), kPeriodTwo) << count << " demands";
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, 3) << count << " demands";
+#endif
+  }
+  // sA 0, sB 1, sZ 2, n1..n6 3..8, dA 9, dB 10, dZ 11; rows X, L0, L1 first.
+  const std::vector<InEdge> rows {{3, 4, 1, 1},   {5, 6, 1, 1},   {7, 8, 2, 1},    {0, 3, 100, 1}, {4, 5, 100, 1},
+                                  {6, 7, 100, 1}, {8, 9, 100, 1}, {1, 7, 100, 1},  {8, 5, 100, 1}, {6, 10, 100, 1},
+                                  {2, 5, 100, 1}, {6, 3, 100, 1}, {4, 11, 100, 1}};
+  for (int z : {0, 1, 2}) {  // without Z, Z as a tunnel, Z as a ShortestPaths demand
+    World w(shared(make_graph(12, rows)));
+    const auto id = id_of_input(*w.g);
+    auto& a = w.pin(tunnel(*w.g, 0, 9, ids_of(id, {3, 0, 4, 1, 5, 2, 6})));
+    auto& b = w.pin(tunnel(*w.g, 1, 10, ids_of(id, {7, 2, 8, 1, 9})));
+    Actions list {Replace {a, 2}, Replace {b, 2}};
+    if (z == 1) list.push_back(Replace {w.pin(tunnel(*w.g, 2, 11, ids_of(id, {10, 1, 11, 0, 12}))), 0});
+    if (z == 2) list.push_back(Replace {w.add({2}, {11}, ecmp()), 0});
+    EXPECT_EQ(refused(w, list, SIMULTANEOUS), kPeriodTwo) << "Z form " << z;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, 3) << "Z form " << z;
+#endif
+  }
+  // A member that can carry nothing in a program that is not pooled: Z's program from sZ has a
+  // supplied DAG route (sZ's exit to dZ0 below its L0 branch, L0 then X) and a tunnel over that
+  // exit; offer 2 gives each entry 1 and the DAG route's unit takes the exit (round robin at sZ,
+  // the lower EdgeId first), so the L0 branch never carries anything: the period-2 error at round 3,
+  // as without Z. sA 0, sB 1, sZ 2, dZ0 3, n1..n6 4..9, dA 10, dB 11, dZ 12; rows X, L0, L1 first.
+  {
+    World w(shared(make_graph(13, {{4, 5, 1, 1},   {6, 7, 1, 1},   {8, 9, 2, 1},   {0, 4, 100, 1}, {5, 6, 100, 1},
+                                   {7, 8, 100, 1}, {9, 10, 100, 1}, {1, 8, 100, 1}, {9, 6, 100, 1}, {7, 11, 100, 1},
+                                   {2, 6, 100, 1}, {7, 4, 100, 1}, {5, 12, 100, 1}, {2, 3, 100, 1}})));
+    const auto id = id_of_input(*w.g);
+    ASSERT_LT(id[13], id[10]);
+    auto& a = w.pin(tunnel(*w.g, 0, 10, ids_of(id, {3, 0, 4, 1, 5, 2, 6})));
+    auto& b = w.pin(tunnel(*w.g, 1, 11, ids_of(id, {7, 2, 8, 1, 9})));
+    const std::vector<RouteDefinition> routes {
+        RouteDefinition {2, dag_of(*w.g, ids_of(id, {10, 1, 11, 0, 12, 13})), 1},
+        RouteDefinition {2, std::make_shared<const Path>(*w.g, std::vector<std::vector<EdgeId>> {{id[13]}}), 1}};
+    auto& z = w.pin(ForwardingProgram::from_routes(*w.g, std::vector<NodeId> {2}, std::vector<NodeId> {3, 12}, routes));
+    EXPECT_EQ(refused(w, {Replace {a, 2}, Replace {b, 2}, Replace {z, 2}}, SIMULTANEOUS), kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+  }
+}
+
+// What can carry nothing changes nothing, a router's dead merges and branches included.
+// D-cycle-subdivision-after (A over links 1, 0, 2, 3 with offer 2; B over 2, 3, 0 with offer 1; C over
+// 2, 3, 0, 1 with offer 4; links of 2, 4, 2, 2; links 2 and 3 joined directly at node 10) delivers 0,
+// 0, 1 at round 4. B becomes a DAG program with a member that carries nothing at node 10:
+// - a second pooled source, node 12, whose own link (capacity 9) merges into node 10: with offer 1
+//   its share is 0; with offer 2 each source gets 1 and the new link is B's own black hole (it keeps
+//   its own router arc: one more arc);
+// - a branch from node 10 to a destination of its own, node 13: round robin sends B's unit to link 3
+//   (the lower EdgeId), so the branch carries nothing;
+// - a merge into node 10 from B's source over node 12: round robin sends B's unit to link 2's side
+//   (the lower EdgeId), so that path carries nothing;
+// the last two pooled (from_dag) and not (the DAG route beside a tunnel of weight 0 over B's links).
+// Links 2 and 3 stay a pair, and the outcome and the structure are those of B without the member.
+// sA 0, sB 1, sC 2, d 3; link e from 4 + 2e (link 2 into node 10).
+TEST(ApplyActions, MembersThatCarryNothingChangeNothing) {
+  const std::vector<InEdge> rows {{4, 5, 2, 1},    {6, 7, 4, 1},    {8, 10, 2, 1},   {10, 11, 2, 1},  {0, 6, 100, 1},
+                                  {7, 4, 100, 1},  {5, 8, 100, 1},  {11, 3, 100, 1}, {1, 8, 100, 1},  {11, 4, 100, 1},
+                                  {5, 3, 100, 1},  {2, 8, 100, 1},  {5, 6, 100, 1},  {7, 3, 100, 1},  {12, 10, 9, 1},
+                                  {10, 13, 100, 1}, {1, 12, 100, 1}};
+  struct Out {
+    std::string error;
+    Amounts delivered;
+    std::vector<Amount> carried;
+    std::int64_t rounds {-1};
+    std::int64_t groups {-1};
+    std::vector<EdgeId> barriers;
+    std::int64_t dependencies {-1};
+  };
+  enum Case { kWithout, kZeroShare, kBlackHoled, kDeadBranch, kDeadMerge };
+  auto call = [&](Case c, bool pooled) {
+    World w(shared(make_graph(14, rows)));
+    const auto id = id_of_input(*w.g);
+    auto ids = [&](std::vector<int> in) {
+      std::vector<EdgeId> out;
+      for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+      return out;
+    };
+    EXPECT_LT(id[3], id[15]);
+    EXPECT_LT(id[8], id[16]);
+    auto& a = w.pin(tunnel(*w.g, 0, 3, ids({4, 1, 5, 0, 6, 2, 3, 7})));
+    const auto path = ids({8, 2, 3, 9, 0, 10});
+    auto members = path;
+    std::vector<NodeId> sources {1};
+    std::vector<NodeId> dests {3};
+    if (c == kZeroShare || c == kBlackHoled) {
+      members.push_back(id[14]);
+      sources.push_back(12);
+    }
+    if (c == kDeadBranch) {
+      members.push_back(id[15]);
+      dests.push_back(13);
+    }
+    if (c == kDeadMerge) {
+      members.push_back(id[16]);
+      members.push_back(id[14]);
+    }
+    std::shared_ptr<const ForwardingProgram> prog;
+    if (pooled) {
+      prog = ForwardingProgram::from_dag(*w.g, sources, dests, dag_of(*w.g, members), RouteOptions {});
+    } else {
+      std::vector<std::vector<EdgeId>> hops;
+      for (EdgeId e : path) hops.push_back({e});
+      prog = ForwardingProgram::from_routes(*w.g, sources, dests,
+                                            std::vector<RouteDefinition> {RouteDefinition {1, dag_of(*w.g, members), 1},
+                                                                          RouteDefinition {1, std::make_shared<const Path>(*w.g, hops), 0}});
+    }
+    auto& b = w.pin(prog, LOSSY, c == kBlackHoled ? no_edges(*w.g, {id[14]}) : nullptr);
+    auto& cc = w.pin(tunnel(*w.g, 2, 3, ids({11, 2, 3, 9, 0, 12, 1, 13})));
+    Out out;
+    std::vector<PlacementResult> res;
+    out.error = error_of([&] { res = run(w, Actions {Replace {a, 2}, Replace {b, c == kBlackHoled ? 2 : 1}, Replace {cc, 4}}, SIMULTANEOUS); });
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const auto& k = detail::thread_lossy_counters();
+    out.rounds = k.rounds;
+    out.groups = k.groups;
+    out.barriers = k.barriers;
+    out.dependencies = k.dependencies;
+#endif
+    if (out.error.empty()) {
+      out.delivered = delivered(res);
+      for (int e : {0, 1, 2, 3}) out.carried.push_back(w.ledger->carried()[static_cast<std::size_t>(id[static_cast<std::size_t>(e)])]);
+    }
+    return out;
+  };
+  struct Row {
+    Case c;
+    bool pooled;
+    const char* where;
+  };
+  for (const auto& row : {Row {kZeroShare, true, "zero-share source"}, Row {kBlackHoled, true, "black-holed source"},
+                          Row {kDeadBranch, true, "dead branch, pooled"}, Row {kDeadBranch, false, "dead branch, not pooled"},
+                          Row {kDeadMerge, true, "dead merge, pooled"}, Row {kDeadMerge, false, "dead merge, not pooled"}}) {
+    const auto without = call(kWithout, row.pooled);
+    EXPECT_EQ(without.error, "") << row.where;
+    EXPECT_EQ(without.delivered, (Amounts {0, 0, 1})) << row.where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(without.rounds, 4) << row.where;
+#endif
+    const auto with = call(row.c, row.pooled);
+    EXPECT_EQ(with.error, without.error) << row.where;
+    EXPECT_EQ(with.delivered, without.delivered) << row.where;
+    EXPECT_EQ(with.carried, without.carried) << row.where;
+    EXPECT_EQ(with.rounds, without.rounds) << row.where;
+    EXPECT_EQ(with.groups, without.groups) << row.where;
+    EXPECT_EQ(with.barriers, without.barriers) << row.where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(with.dependencies, without.dependencies + (row.c == kBlackHoled ? 1 : 0)) << row.where;
+#endif
+  }
+}
+
+// Traffic behind a demand's own black hole can carry nothing: D-dead-tail (A over links 2, 0 with
+// offer 1; B over 1, 0, 2 with offer 2; links of 2, 2, 1, 9) gives the period-2 error at round 3
+// without Z, and with Z (its own black hole on link 3) over links 3, 0, 1 with offer 1 as a tunnel
+// or as a supplied DAG route (a pooled context), or with offer 2 as that DAG route beside a tunnel
+// on its own exit (a split route of a program that is not pooled; each entry gets 1): what reaches
+// the black hole goes no further down the plan. sA 0, sB 1, sZ 2, d 3; link e from 4 + 2e to
+// 5 + 2e (rows 0 to 3), joined by links of 100; Z's exit is row 15.
+TEST(ApplyActions, DeadTailsTakeNoPart) {
+  for (int z : {0, 1, 2, 3}) {  // without Z, a tunnel, a DAG route, a DAG route beside a tunnel
+    World w(shared(make_graph(12, {{4, 5, 2, 1},
+                                   {6, 7, 2, 1},
+                                   {8, 9, 1, 1},
+                                   {10, 11, 9, 1},
+                                   {0, 8, 100, 1},
+                                   {9, 4, 100, 1},
+                                   {5, 3, 100, 1},
+                                   {1, 6, 100, 1},
+                                   {7, 4, 100, 1},
+                                   {5, 8, 100, 1},
+                                   {9, 3, 100, 1},
+                                   {2, 10, 100, 1},
+                                   {11, 4, 100, 1},
+                                   {5, 6, 100, 1},
+                                   {7, 3, 100, 1},
+                                   {2, 3, 100, 1}})));
+    const auto id = id_of_input(*w.g);
+    auto ids = [&](std::vector<int> in) {
+      std::vector<EdgeId> out;
+      for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+      return out;
+    };
+    auto& a = w.pin(tunnel(*w.g, 0, 3, ids({4, 2, 5, 0, 6})));
+    auto& b = w.pin(tunnel(*w.g, 1, 3, ids({7, 1, 8, 0, 9, 2, 10})));
+    Actions list {Replace {a, 1}, Replace {b, 2}};
+    const auto zr = ids({11, 3, 12, 0, 13, 1, 14});
+    if (z == 1) list.push_back(Replace {w.pin(tunnel(*w.g, 2, 3, zr), LOSSY, no_edges(*w.g, ids({3}))), 1});
+    if (z >= 2) {
+      std::vector<RouteDefinition> routes {RouteDefinition {2, dag_of(*w.g, zr), 1}};
+      if (z == 3) routes.push_back(RouteDefinition {2, std::make_shared<const Path>(*w.g, std::vector<std::vector<EdgeId>> {{id[15]}}), 1});
+      const auto prog = ForwardingProgram::from_routes(*w.g, std::vector<NodeId> {2}, std::vector<NodeId> {3}, routes);
+      ASSERT_EQ(detail::ProgramAccess::data(*prog).pools_source_inflows, z == 2);
+      list.push_back(Replace {w.pin(prog, LOSSY, no_edges(*w.g, ids({3}))), z == 3 ? 2 : 1});
+    }
+    EXPECT_EQ(refused(w, list, SIMULTANEOUS), kPeriodTwo) << "Z form " << z;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, 3) << "Z form " << z;
+#endif
+  }
+}
+
+// Per-entry boundaries on the one residual.
+TEST(ApplyActions, OutputsPerEntry) {
+  World w(graph(4, {{0, 2, 10, 1}, {1, 2, 1, 1}, {2, 3, 10, 1}}));
+  auto& a = w.pin(tunnel(*w.g, 0, 3, {0, 2}));
+  auto& b = w.pin(tunnel(*w.g, 1, 3, {1, 2}));
+  const auto r = run(w, {Replace {a, 5}, Replace {b, 1}}, SIMULTANEOUS, OutputOptions {.residual = true, .saturated_boundary_edges = true});
+  EXPECT_EQ(*r[0].residual, (Amounts {5, 0, 4}));
+  EXPECT_EQ(*r[1].residual, (Amounts {5, 0, 4}));
+  EXPECT_EQ(*r[0].saturated_boundary_edges, (std::vector<EdgeId> {}));
+  EXPECT_EQ(*r[1].saturated_boundary_edges, (std::vector<EdgeId> {1}));
+}
+
+// A controller program's captured weights inject in a list.
+TEST(ApplyActions, CapturedWeightsInAList) {
+  auto g = graph(3, {{0, 2, 3, 1}, {1, 2, 1, 1}});
+  World solver(g);
+  const auto prog = solver.add({0, 1}, {2}, global()).replace(4).program;
+  World w(g);
+  auto& a = w.pin(prog);
+  auto& b = w.pin(tunnel(*w.g, 0, 2, {0}));
+  const auto r = run(w, {Replace {a, 4}, Replace {b, 1}}, SIMULTANEOUS);
+  EXPECT_EQ(delivered(r), (Amounts {4, 0}));
+  EXPECT_EQ(r[1].call_edge_drops, (Pairs {{0, 1}}));
+}
+
+// The record identities of the whole list are counted first.
+TEST(ApplyActions, BatchRecordIdentities) {
+  World w(graph(2, {{0, 1, 10, 1}}));
+  auto& a = w.add({0}, {1}, ecmp());
+  auto& b = w.add({0}, {1}, ecmp());
+  auto& c = w.add({0}, {1}, ecmp());
+  LedgerAccess::set_next_ids(*w.ledger, std::numeric_limits<std::int64_t>::max() - 2, 3);
+  const auto before = w.state();
+  std::string what;
+  try {
+    (void)apply_actions(*w.ledger, Actions {Replace {a, 1}, Replace {b, 1}, Replace {c, 1}}, ORDERED);
+  } catch (const std::runtime_error& e) {
+    what = e.what();
+  }
+  EXPECT_EQ(what, "record identity limit exceeded");
+  expect_unchanged(w, before, "three new records, two ids left");
+  EXPECT_EQ(run(w, {Replace {a, 1}, Replace {b, 1}}, SIMULTANEOUS).size(), 2U);
+  EXPECT_EQ(LedgerAccess::next_record_counter(*w.ledger), std::numeric_limits<std::int64_t>::max());
+}
+
+
+// A list's joint network counts every participant: a Pinned program of two one-edge routes on
+// PAR(6, 4) (2 entries, 2 occurrences, 4 routers; the 4-unit link drops: 1 barrier, 3 dependencies),
+// a Pinned program of two 2-hop tunnels on a diamond (2 entries, 4 occurrences) and a pooled
+// ShortestPaths demand of sources 6 and 7 over 6 -> 8, 7 -> 8, 8 -> 9 (2 entries; each source reaches
+// two members: 4 occurrences; 4 routers, counted once; 3 dependencies): 6 entries, 10 occurrences,
+// 8 routers, 9 events, 6 dependencies. With one limit lowered to its count less one the list is
+// refused with the joint count, nothing changed (each participant alone stays within); at the count
+// it runs; with every limit at 1 the entries come first. An event or dependency refusal comes before
+// the event structures are sized (the hooks' counter reads 0).
+TEST(ApplyActions, ForwardingSizesCountEveryParticipant) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  using detail::ForwardingCounter;
+  struct Restore {
+    ~Restore() { detail::thread_forwarding_limits() = {}; }
+  } restore;
+  World w(graph(10, {{0, 1, 6, 1}, {0, 1, 4, 1}, {2, 3, 100, 1}, {2, 4, 100, 1}, {3, 5, 100, 1}, {4, 5, 100, 1}, {6, 8, 100, 1},
+                     {7, 8, 100, 1}, {8, 9, 100, 1}}));
+  const std::vector<RouteDefinition> dags {RouteDefinition {0, dag_of(*w.g, {0}), 1}, RouteDefinition {0, dag_of(*w.g, {1}), 1}};
+  auto& a = w.pin(ForwardingProgram::from_routes(*w.g, std::vector<NodeId> {0}, std::vector<NodeId> {1}, dags));
+  auto& b = w.pin(tunnels(*w.g, {2}, {5}, {{2, {2, 4}, 1}, {2, {3, 5}, 1}}));
+  auto& c = w.add({6, 7}, {9}, ecmp());
+  const Actions list {Replace {a, 12}, Replace {b, 2}, Replace {c, 2}};
+  struct Count {
+    ForwardingCounter counter;
+    const char* name;
+    std::int64_t n;
+  };
+  for (const auto& k : std::vector<Count> {{ForwardingCounter::Entry, "entry", 6}, {ForwardingCounter::Occurrence, "occurrence", 10},
+                                           {ForwardingCounter::Router, "router", 8}, {ForwardingCounter::Event, "event", 9},
+                                           {ForwardingCounter::Dependency, "dependency", 6}}) {
+    auto& limits = detail::thread_forwarding_limits();
+    limits = {};
+    limits[static_cast<std::size_t>(k.counter)] = k.n - 1;
+    EXPECT_EQ(refused(w, list, SIMULTANEOUS), std::string("forwarding ") + k.name + " limit exceeded: " + std::to_string(k.n) + " > " +
+                                                 std::to_string(k.n - 1));
+    if (k.counter == ForwardingCounter::Event || k.counter == ForwardingCounter::Dependency) {
+      EXPECT_EQ(detail::thread_lossy_counters().event_structures, 0) << k.name;
+    }
+    // Each participant alone stays within.
+    for (const auto& one : list) EXPECT_NO_THROW((void)apply_actions(*w.ledger, Actions {one}, SIMULTANEOUS)) << k.name;
+    limits[static_cast<std::size_t>(k.counter)] = k.n;
+    EXPECT_NO_THROW((void)run(w, list, SIMULTANEOUS)) << k.name;
+    EXPECT_EQ(detail::thread_lossy_counters().event_structures, 1) << k.name;
+  }
+  detail::thread_forwarding_limits() = {1, 1, 1, 1, 1};
+  EXPECT_EQ(refused(w, list, SIMULTANEOUS), "forwarding entry limit exceeded: 6 > 1");
+#else
+  GTEST_SKIP() << "a lowered limit needs the private hooks";
+#endif
+}
+
+// The timing rows' ring: routers 0..63, ring links i -> i + 1 of 3 units, heads 64..127 with
+// wide feeders, wide exits to 128; tunnel i over ring links i and i + 1. Every link carries two
+// tunnels of 3: 64 barriers in one cyclic group. As one 64-head program (replace(192): 3 per head)
+// and as 64 one-tunnel policies in one SIMULTANEOUS list: both settle at round 6, every head
+// delivering 1, every link carrying 3.
+TEST(ApplyActions, RingSettlesAtRoundSix) {
+  constexpr int n = 64;
+  const Amount wide = Amount {1} << 40;
+  std::vector<InEdge> rows;
+  for (int i = 0; i < n; ++i) rows.push_back({i, (i + 1) % n, 3, 1});
+  for (int i = 0; i < n; ++i) rows.push_back({i, 2 * n, wide, 1});
+  for (int i = 0; i < n; ++i) rows.push_back({n + i, i, wide, 1});
+  const auto g = shared(make_graph(2 * n + 1, rows));
+  const auto id = id_of_input(*g);
+  auto tunnel_of = [&](int i) {
+    return std::tuple<NodeId, std::vector<EdgeId>, Amount> {
+        n + i, std::vector<EdgeId> {id[static_cast<std::size_t>(2 * n + i)], id[static_cast<std::size_t>(i)], id[static_cast<std::size_t>((i + 1) % n)],
+                                    id[static_cast<std::size_t>(n + (i + 2) % n)]},
+        1};
+  };
+  std::vector<NodeId> heads;
+  std::vector<std::tuple<NodeId, std::vector<EdgeId>, Amount>> all;
+  for (int i = 0; i < n; ++i) heads.push_back(n + i), all.push_back(tunnel_of(i));
+  World one(g);
+  auto& program = one.pin(tunnels(*g, heads, {2 * n}, all));
+  const auto r = program.replace(192);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 6);
+#endif
+  Amounts per_head;
+  for (const auto& t : r.by_tunnel) per_head.push_back(t.delivered);
+  EXPECT_EQ(per_head, Amounts(n, 1));
+  World many(g);
+  Actions list;
+  for (int i = 0; i < n; ++i) list.push_back(Replace {many.pin(tunnels(*g, {n + i}, {2 * n}, {tunnel_of(i)})), 3});
+  const auto res = run(many, list, SIMULTANEOUS);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 6);
+#endif
+  EXPECT_EQ(delivered(res), Amounts(n, 1));
+  EXPECT_EQ(many.ledger->carried(), one.ledger->carried());
+  for (int i = 0; i < n; ++i) EXPECT_EQ(one.ledger->carried()[static_cast<std::size_t>(id[static_cast<std::size_t>(i)])], 3);
+}
+
+// ---------------------------------------------------------------- generators
+
+// A world built from a seed (built twice, identically): a random DAG on nodes 0..5 (sources 0 and 1,
+// destination 5; nonuniform costs, capacities 0 to 8) plus a separate link 6 -> 7, and one policy of
+// each kind: ShortestPaths EQUAL LY (two sources), EQUAL LL, WEIGHTED LY with capacity, explicit and
+// residual-snapshot weights, EQUAL LY under a mask; OPTIMIZED LL; CentralizedTE LL; T1 LY (two tunnels
+// per head); T2 LY; Pinned LY over tunnels, over split routes, over from_dag under a mask, over a
+// controller program with black holes; Pinned LY on the separate link. Then scalar calls, an orphan
+// and an outside owner. Empty when a construction fails (both copies fail alike).
+struct Generated {
+  std::unique_ptr<World> w;
+  std::vector<std::size_t> lossy_replace;  // policies a SIMULTANEOUS Replace accepts
+  std::vector<std::size_t> forwardable;    // LOSSY computing policies (Forward after an install)
+  std::size_t separate {0};                // the Pinned policy on 6 -> 7
+};
+
+// `graph`: the first copy's graph, shared by the second (records compare their routes by graph).
+Generated generate(std::uint32_t seed, std::shared_ptr<const Graph> graph = nullptr) {
+  std::mt19937 rng(seed);
+  std::vector<InEdge> rows;
+  for (NodeId u = 0; u < 6; ++u) {
+    for (NodeId v = u + 1; v < 6; ++v) {
+      if (rng() % 3 != 0) rows.push_back({u, v, static_cast<Amount>(rng() % 9), 1 + static_cast<Cost>(rng() % 3)});
+    }
+  }
+  rows.push_back({6, 7, 10, 1});
+  Generated out;
+  try {
+    out.w = std::make_unique<World>(graph ? std::move(graph) : shared(make_graph(8, rows)));
+    World& w = *out.w;
+    const Graph& g = *w.g;
+    const auto E = static_cast<std::size_t>(g.num_edges());
+    const EdgeId sep = g.num_edges() - 1;  // 6 -> 7: the largest tail
+    auto random_edge = [&] { return static_cast<EdgeId>(rng() % (E - 1)); };
+    // A random path from h to 5 (empty when none).
+    auto path_from = [&](NodeId h) {
+      std::vector<EdgeId> path;
+      NodeId u = h;
+      while (u != 5) {
+        std::vector<EdgeId> outs;
+        for (EdgeId e = 0; e < sep; ++e) {
+          if (g.edge_sources()[static_cast<std::size_t>(e)] == u) outs.push_back(e);
+        }
+        if (outs.empty()) return std::vector<EdgeId> {};
+        const EdgeId e = outs[rng() % outs.size()];
+        path.push_back(e);
+        u = g.edge_destinations()[static_cast<std::size_t>(e)];
+      }
+      return path;
+    };
+    const std::vector<NodeId> S {0, 1};
+    const std::vector<NodeId> D {5};
+    w.add(S, D, ecmp());
+    out.lossy_replace.push_back(0);
+    out.forwardable.push_back(0);
+    w.add({0}, D, ecmp(LOSSLESS));
+    {
+      ShortestPaths cap = shortest_paths(RouteAllocation::Weighted);
+      w.add(S, D, FlowPolicyConfig {.routing = cap, .admission = LOSSY});
+      out.lossy_replace.push_back(2);
+      out.forwardable.push_back(2);
+      ShortestPaths ex = shortest_paths(RouteAllocation::Weighted);
+      ex.weight_basis = WeightBasis::Explicit;
+      std::vector<Amount> weights(E);
+      for (auto& x : weights) x = static_cast<Amount>(rng() % 4);
+      ex.edge_weights = std::make_shared<const std::vector<Amount>>(weights);
+      w.add(S, D, FlowPolicyConfig {.routing = ex, .admission = LOSSY});
+      out.lossy_replace.push_back(3);
+      out.forwardable.push_back(3);
+      ShortestPaths snap = shortest_paths(RouteAllocation::Weighted);
+      snap.weight_basis = WeightBasis::ResidualSnapshot;
+      w.add({0}, D, FlowPolicyConfig {.routing = snap, .admission = LOSSY});
+      out.lossy_replace.push_back(4);
+      out.forwardable.push_back(4);
+    }
+    w.add(S, D, ecmp(), no_edges(g, {random_edge()}));
+    out.lossy_replace.push_back(5);
+    out.forwardable.push_back(5);
+    w.add(S, D, FlowPolicyConfig {.routing = shortest_paths(RouteAllocation::Optimized), .admission = LOSSLESS});
+    w.add(S, D, global());
+    w.add(S, D, FlowPolicyConfig {.routing = DistributedTE {TunnelCount {2}}, .admission = LOSSY});
+    out.forwardable.push_back(8);
+    w.add(S, D, t2());
+    out.forwardable.push_back(9);
+    // Pinned programs.
+    std::vector<std::tuple<NodeId, std::vector<EdgeId>, Amount>> specs;
+    for (NodeId h : S) {
+      for (int k = 0; k < 2; ++k) {
+        auto path = path_from(h);
+        if (!path.empty()) specs.emplace_back(h, path, 1 + static_cast<Amount>(rng() % 3));
+      }
+    }
+    if (specs.empty()) return {};
+    std::vector<NodeId> heads;
+    for (const auto& x : specs) heads.push_back(std::get<0>(x));
+    std::sort(heads.begin(), heads.end());
+    heads.erase(std::unique(heads.begin(), heads.end()), heads.end());
+    w.pin(tunnels(g, heads, D, specs));
+    out.lossy_replace.push_back(10);
+    std::vector<RouteDefinition> split;
+    for (NodeId h : heads) split.push_back(RouteDefinition {h, all_edges(g), 1 + static_cast<Amount>(rng() % 2)});
+    w.pin(ForwardingProgram::from_routes(g, heads, D, split));
+    out.lossy_replace.push_back(11);
+    w.pin(ForwardingProgram::from_dag(g, S, D, all_edges(g), RouteOptions {}), LOSSY, nullptr, no_edges(g, {random_edge()}));
+    out.lossy_replace.push_back(12);
+    {
+      World solver(w.g);
+      const auto prog = solver.add(S, D, global()).replace(6).program;
+      w.pin(prog, LOSSY, no_edges(g, {random_edge()}));
+      out.lossy_replace.push_back(13);
+    }
+    w.pin(tunnel(g, 6, 7, {sep}));
+    out.separate = 14;
+    // State before the list: scalar calls, an orphan, an outside owner.
+    (void)w.p[0]->place(static_cast<Amount>(rng() % 6));
+    (void)w.p[2]->replace(static_cast<Amount>(rng() % 6));
+    (void)w.p[6]->place(static_cast<Amount>(rng() % 6));
+    (void)w.p[8]->replace(2, std::optional<Amount> {2});
+    (void)w.p[9]->replace(2);
+    (void)w.p[10]->replace(static_cast<Amount>(rng() % 6));
+    w.add(S, D, ecmp()).place(1 + static_cast<Amount>(rng() % 3));  // the outside owner (index 15)
+    auto& orphan = w.add({0}, D, ecmp());
+    (void)orphan.place(1 + static_cast<Amount>(rng() % 3));
+    w.p.pop_back();
+  } catch (const std::invalid_argument&) {
+    return {};
+  }
+  return out;
+}
+
+// One random valid ORDERED action on policy i of a generated world (a fresh draw of the generator).
+Action ordered_action(std::mt19937& rng, World& w, std::size_t i) {
+  FlowPolicy& p = *w.p[i];
+  const auto& cfg = p.config();
+  const bool tunnel_model = std::holds_alternative<DistributedTE>(cfg.routing) ||
+                            (std::holds_alternative<CentralizedTE>(cfg.routing) && std::get<CentralizedTE>(cfg.routing).tunnel_count);
+  const bool pinned_model = std::holds_alternative<Pinned>(cfg.routing);
+  const bool lossy = cfg.admission == LOSSY;
+  const Amount v = static_cast<Amount>(rng() % 13);
+  const auto kind = rng() % 3;
+  if (kind == 2 && !pinned_model && p.program() != nullptr) {
+    const Eligibility* bh = nullptr;
+    if (rng() % 3 == 0) {
+      w.keep.push_back(no_edges(*w.g, {static_cast<EdgeId>(rng() % (w.g->num_edges() - 1))}));
+      bh = w.keep.back().get();
+    }
+    return Forward {p, (!lossy && rng() % 4 == 0) ? INF : std::optional<Amount> {v}, bh};
+  }
+  if (kind == 0 && !tunnel_model && !detail::PolicyAccess::engine(p).epoch.infinite) return Place {p, v};
+  if (std::holds_alternative<DistributedTE>(cfg.routing)) return Replace {p, v, std::optional<Amount> {v + static_cast<Amount>(rng() % 3)}};
+  return Replace {p, (!lossy && rng() % 4 == 0) ? INF : std::optional<Amount> {v}};
+}
+
+// The same action as a scalar call.
+PlacementResult scalar(const Action& a, const OutputOptions& o) {
+  return std::visit(
+      [&](const auto& x) -> PlacementResult {
+        using T = std::decay_t<decltype(x)>;
+        if constexpr (std::is_same_v<T, Place>) return x.policy.get().place(x.offer, o);
+        if constexpr (std::is_same_v<T, Replace>) return x.policy.get().replace(x.offer, x.design_demand, o);
+        if constexpr (std::is_same_v<T, Forward>) return x.policy.get().forward(x.offer, x.black_holes, o);
+      },
+      a);
+}
+
+// The action `a` of world `from` aimed at the same policy (and black holes) of world `to`.
+Action retarget(const Action& a, World& from, World& to) {
+  auto index = [&](const FlowPolicy& p) {
+    for (std::size_t i = 0; i < from.p.size(); ++i) {
+      if (from.p[i].get() == &p) return i;
+    }
+    return from.p.size();
+  };
+  return std::visit(
+      [&](const auto& x) -> Action {
+        using T = std::decay_t<decltype(x)>;
+        T y = x;
+        y.policy = *to.p[index(x.policy.get())];
+        if constexpr (std::is_same_v<T, Forward>) {
+          if (x.black_holes != nullptr) {
+            to.keep.push_back(std::make_shared<const Eligibility>(*x.black_holes));
+            y.black_holes = to.keep.back().get();
+          }
+        }
+        return y;
+      },
+      a);
+}
+
+void expect_same_worlds(const World& a, const World& b, const std::string& where) {
+  expect_same(ledger_state(*a.ledger), ledger_state(*b.ledger), where);
+  ASSERT_EQ(a.p.size(), b.p.size()) << where;
+  for (std::size_t i = 0; i < a.p.size(); ++i) expect_same(epoch(*a.p[i]), epoch(*b.p[i]), where + ", policy " + std::to_string(i));
+}
+
+// An ORDERED list gives exactly the results, records (FlowIds included), ledger and epochs of
+// the same scalar calls in the same order on an identical world.
+TEST(ApplyActions, OrderedEqualsScalarCalls) {
+  int checked = 0;
+  int forwards = 0;
+  int holds = 0;
+  for (std::uint32_t seed = 1; seed <= 200; ++seed) {
+    auto a = generate(seed);
+    if (!a.w) continue;
+    auto b = generate(seed, a.w->g);
+    std::mt19937 rng(seed * 7919U);
+    std::vector<std::size_t> order(a.w->p.size());
+    for (std::size_t i = 0; i < order.size(); ++i) order[i] = i;
+    std::shuffle(order.begin(), order.end(), rng);
+    order.resize(2 + rng() % 6);
+    Actions list;
+    for (auto i : order) list.push_back(ordered_action(rng, *a.w, i));
+    const std::string where = "seed " + std::to_string(seed);
+    std::vector<PlacementResult> got;
+    std::string error;
+    try {
+      got = apply_actions(*a.w->ledger, list, ORDERED, kAll);
+    } catch (const std::invalid_argument& e) {
+      error = e.what();
+    }
+    std::string scalar_error;
+    std::vector<PlacementResult> want;
+    for (const auto& x : list) {
+      try {
+        want.push_back(scalar(retarget(x, *a.w, *b.w), kAll));
+      } catch (const std::invalid_argument& e) {
+        scalar_error = e.what();
+        break;
+      }
+    }
+    ASSERT_EQ(error, scalar_error) << where;
+    if (!error.empty()) continue;
+    ASSERT_EQ(got.size(), want.size()) << where;
+    for (std::size_t k = 0; k < got.size(); ++k) expect_same(got[k], want[k], where + ", action " + std::to_string(k));
+    expect_same_worlds(*a.w, *b.w, where);
+    for (const auto& x : list) forwards += std::holds_alternative<Forward>(x) ? 1 : 0;
+    holds += a.w->ledger->reserved() != Amounts(a.w->ledger->reserved().size(), 0) ? 1 : 0;
+    ++checked;
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("checked", checked);
+  EXPECT_GT(checked, 150);
+  EXPECT_GT(forwards, 80);
+  EXPECT_GT(holds, 30);
+}
+
+// One SIMULTANEOUS participant (and a second one on the separate link) equals its scalar
+// replace or forward on an identical world: results, records, ledger and epochs.
+TEST(ApplyActions, OneParticipantEqualsTheScalarCall) {
+  int checked = 0;
+  int pooled = 0;
+  int black = 0;
+  for (std::uint32_t seed = 1; seed <= 300; ++seed) {
+    auto a = generate(seed);
+    if (!a.w) continue;
+    auto b = generate(seed, a.w->g);
+    std::mt19937 rng(seed * 104729U);
+    const auto lossy_forward = a.forwardable;
+    const bool forward = rng() % 2 == 0;
+    const std::size_t i = forward ? lossy_forward[rng() % lossy_forward.size()] : a.lossy_replace[rng() % a.lossy_replace.size()];
+    const Amount v = static_cast<Amount>(rng() % 13);
+    Actions list;
+    FlowPolicy& p = *a.w->p[i];
+    if (forward) {
+      if (p.program() == nullptr) (void)p.replace(1), (void)b.w->p[i]->replace(1);
+      const Eligibility* bh = nullptr;
+      if (rng() % 2 == 0) {
+        a.w->keep.push_back(no_edges(*a.w->g, {static_cast<EdgeId>(rng() % (a.w->g->num_edges() - 1))}));
+        bh = a.w->keep.back().get();
+        ++black;
+      }
+      list.push_back(Forward {p, v, bh});
+    } else {
+      list.push_back(Replace {p, v});
+      pooled += i <= 5 ? 1 : 0;
+    }
+    const bool pair = rng() % 2 == 0;
+    if (pair) list.push_back(Replace {*a.w->p[a.separate], static_cast<Amount>(rng() % 13)});
+    const std::string where = "seed " + std::to_string(seed) + " policy " + std::to_string(i);
+    const auto got = apply_actions(*a.w->ledger, list, SIMULTANEOUS, kAll);
+    std::vector<PlacementResult> want;
+    for (const auto& x : list) want.push_back(scalar(retarget(x, *a.w, *b.w), kAll));
+    // The scalar calls' outputs read the ledger after each; the list's after both: with the pair,
+    // each entry's residual is the one after the list (the other participant is disjoint).
+    if (pair) {
+      want[0].residual = want[1].residual;
+      if (want[0].saturated_boundary_edges) {
+        const auto& pe = detail::PolicyAccess::engine(*b.w->p[i]);
+        want[0].saturated_boundary_edges = detail::saturated_boundary_edges_of(*b.w->g, *want[1].residual, pe.sources, pe.eligibility);
+      }
+    }
+    for (std::size_t k = 0; k < got.size(); ++k) expect_same(got[k], want[k], where + ", entry " + std::to_string(k));
+    expect_same_worlds(*a.w, *b.w, where);
+    ++checked;
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("checked", checked);
+  EXPECT_GT(checked, 200);
+  EXPECT_GT(pooled, 60);
+  EXPECT_GT(black, 40);
+}
+
+} // namespace
diff --git a/tests/cpp/centralized_te_tunnels_tests.cpp b/tests/cpp/centralized_te_tunnels_tests.cpp
new file mode 100644
index 0000000..d1799b4
--- /dev/null
+++ b/tests/cpp/centralized_te_tunnels_tests.cpp
@@ -0,0 +1,1385 @@
+// T2 (CentralizedTE(tunnel_count=TunnelCount(N)), TunnelCount(L, up_to)): a controller lays out, for every live head,
+// the same number of single-path tunnels with one common whole-unit planned bandwidth
+// (docs/semantics.md, "T2: the controller's equal tunnels"): the worked T2 examples and calls,
+// sizing, the objectives and the canonical tie, count selection, operations, programs, replays and
+// stale forwarding, records, rows, flags and terminations, T2's evaluators, the numeric ranges of
+// its sums, zero offers and everything masked. Every expected value is derived by hand from those
+// rules, never from a build;
+// the property test compares random small cases with t2_reference (test_utils.hpp), a brute force
+// over path multisets that calls none of the library's flow, search or apportionment code.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <random>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/tunnel_setup.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+constexpr Admission LOSSLESS = Admission::Lossless;
+constexpr Admission LOSSY = Admission::Lossy;
+constexpr TunnelStatus UP = TunnelStatus::Up;
+constexpr TunnelStatus FAILED = TunnelStatus::Failed;
+constexpr TunnelStatus BLACKHOLED = TunnelStatus::Blackholed;
+const std::optional<Amount> INF;  // +inf
+const std::optional<std::optional<Amount>> UNLIMITED {std::in_place, std::nullopt};  // design +inf
+
+using Amounts = std::vector<Amount>;
+using Edges = std::vector<EdgeId>;
+using Pairs = std::vector<std::pair<EdgeId, Amount>>;
+using SourceRow = std::tuple<NodeId, Amount, Amount, Amount, Amount, Amount>;
+
+std::shared_ptr<const Graph> ordered(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+
+// T2: CentralizedTE with N tunnels per head (the equal source allocation unless given).
+FlowPolicyConfig t2(std::int64_t n, Admission a = LOSSLESS, bool headroom = false, bool up_to = false,
+                    SourceAllocation source = SourceAllocation::Equal) {
+  return {.routing = centralized(source, {}, TunnelCount {n, up_to}, headroom), .admission = a};
+}
+
+Amount lo(const Counter128& c) {
+  EXPECT_EQ(c.hi, 0U);
+  return static_cast<Amount>(c.lo);
+}
+Amount lo(const std::optional<Counter128>& c) { return c.has_value() ? lo(*c) : -1; }
+Int128 wide(const Counter128& c) { return int128_of(static_cast<std::int64_t>(c.hi), c.lo); }
+
+std::vector<SourceRow> source_rows(const PlacementResult& r) {
+  std::vector<SourceRow> out;
+  for (const auto& s : r.by_source) out.emplace_back(s.source, lo(s.offered), lo(s.admitted), s.delivered, lo(s.source_drops), lo(s.total_edge_drops));
+  return out;
+}
+std::vector<Edges> routes(const ForwardingProgram& p) {
+  std::vector<Edges> out;
+  for (const auto& t : p.tunnels()) out.push_back(t.edges.value_or(Edges {}));
+  return out;
+}
+std::vector<std::int32_t> indices(const ForwardingProgram& p) {
+  std::vector<std::int32_t> out;
+  for (const auto& t : p.tunnels()) out.push_back(t.entry_id);
+  return out;
+}
+Amounts counts(const ForwardingProgram& p, std::size_t m) {
+  Amounts x(m, 0);
+  for (const auto& t : p.tunnels()) {
+    for (EdgeId e : *t.edges) ++x[static_cast<std::size_t>(e)];
+  }
+  return x;
+}
+std::vector<TunnelStatus> row_statuses(const PlacementResult& r) {
+  std::vector<TunnelStatus> out;
+  for (const auto& t : r.by_tunnel) out.push_back(t.status);
+  return out;
+}
+
+struct Pol {
+  std::shared_ptr<FlowLedger> ledger;
+  std::unique_ptr<FlowPolicy> p;
+  FlowPolicy* operator->() const { return p.get(); }
+};
+Pol make(const std::shared_ptr<const Graph>& g, std::vector<NodeId> s, std::vector<NodeId> d, const FlowPolicyConfig& c,
+         const Eligibility* elig = nullptr, std::shared_ptr<FlowLedger> ledger = nullptr) {
+  Pol out;
+  out.ledger = ledger ? std::move(ledger) : std::make_shared<FlowLedger>(g);
+  out.p = std::make_unique<FlowPolicy>(*out.ledger, s, d, c, elig);
+  return out;
+}
+
+const std::vector<InEdge> kG1 = {{0, 1, 8192, 1}, {0, 2, 40960, 1}, {1, 3, 8192, 1}, {2, 3, 40960, 1}};
+std::shared_ptr<const Graph> g1() { return ordered(4, kG1); }
+std::shared_ptr<const Graph> one10() { return ordered(2, {{0, 1, 10, 1}}); }
+std::shared_ptr<const Graph> twoh(Amount a, Amount b) { return ordered(3, {{0, 2, a, 1}, {1, 2, b, 1}}); }
+std::vector<Edges> g1_paths() {
+  std::vector<Edges> out(2, Edges {0, 2});
+  out.insert(out.end(), 14, Edges {1, 3});
+  return out;
+}
+
+// ---------------------------------------------------------------- the worked examples (X)
+
+struct Example {
+  std::string id;
+  std::int32_t n;
+  std::vector<InEdge> rows;
+  std::vector<NodeId> heads;
+  NodeId dst;
+  std::int64_t N;
+  std::optional<Amount> D;  // nullopt: unlimited
+  Amounts free;             // empty: the capacities
+  Amount U, u;
+  std::pair<Amount, Amount> fluid;
+  Amount F, total, cost;
+  std::optional<Amount> phi;
+  std::vector<Edges> routes;
+  std::optional<Amount> offer;  // Lossy
+  Amount delivery, loss;
+};
+
+std::vector<Example> examples() {
+  std::vector<InEdge> g4;
+  for (std::int32_t i = 1; i <= 15; ++i) g4.push_back({0, i, 4096, 1});
+  for (std::int32_t i = 1; i <= 15; ++i) g4.push_back({i, 16, 4096, 1});
+  std::vector<Edges> g4_routes(2, Edges {0, 15});
+  for (EdgeId i = 1; i <= 14; ++i) g4_routes.push_back({i, 15 + i});
+  const std::vector<InEdge> g10 = {
+      {0, 1, 40960, 1}, {0, 5, 40960, 1}, {0, 3, 24576, 2}, {1, 0, 40960, 1}, {1, 2, 40960, 1}, {1, 4, 16384, 2},
+      {2, 1, 40960, 1}, {2, 3, 40960, 1}, {2, 5, 20480, 2}, {3, 2, 40960, 1}, {3, 4, 40960, 1}, {3, 0, 24576, 2},
+      {4, 3, 40960, 1}, {4, 5, 40960, 1}, {4, 1, 16384, 2}, {5, 0, 40960, 1}, {5, 4, 40960, 1}, {5, 2, 20480, 2}};
+  auto rep = [](std::vector<std::pair<Edges, int>> parts) {
+    std::vector<Edges> out;
+    for (const auto& [p, c] : parts) out.insert(out.end(), static_cast<std::size_t>(c), p);
+    return out;
+  };
+  return {
+      {"G1 design 49152", 4, kG1, {0}, 3, 16, 49152, {}, 2925, 2925, {20480, 7}, 46812, 46800, 32, 73610035200, g1_paths(), 49152, 47104, 0},
+      {"G1 design 8192", 4, kG1, {0}, 3, 16, 8192, {}, 2925, 512, {20480, 7}, 46812, 8192, 32, 12884901876, g1_paths(), {}, 0, 0},
+      {"G4 design 61440", 17, g4, {0}, 16, 16, 61440, {}, 2048, 2048, {2048, 1}, 32768, 32768, 32, 73014444032, g4_routes, 61440, 57856, 0},
+      {"heads behind 3 and 8", 3, {{0, 2, 3, 1}, {1, 2, 8, 1}}, {0, 1}, 2, 2, 6, {}, 1, 1, {3, 2}, 6, 4, 4, 5905580031,
+       {{0}, {1}, {0}, {1}}, {}, 0, 0},
+      {"a cheap link of 2", 2, {{0, 1, 2, 1}, {0, 1, 10, 2}}, {0}, 1, 2, 2, {}, 5, 1, {5, 1}, 2, 2, 2, 6442450944, {{0}, {0}}, {}, 0, 0},
+      {"G10 head 0", 6, g10, {0}, 3, 16, 49152,
+       {40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480, 40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480},
+       6144, 3072, {6144, 1}, 49160, 49152, 40, 38654705652, rep({{{0, 4, 7}, 4}, {{1, 16, 12}, 4}, {{2}, 8}}), {}, 0, 0},
+      {"G10 head 1", 6, g10, {1}, 4, 16, 49152,
+       {28672, 28672, 0, 40960, 28672, 16384, 40960, 28672, 20480, 40960, 40960, 24576, 28672, 40960, 16384, 40960, 28672, 20480},
+       4096, 3072, {4096, 1}, 52431, 49152, 43, {}, rep({{{3, 1, 16}, 6}, {{4, 7, 10}, 5}, {{5}, 5}}), {}, 0, 0},
+      {"G10 head 2", 6, g10, {2}, 5, 16, 49152,
+       {28672, 10240, 0, 22528, 13312, 1024, 40960, 13312, 20480, 40960, 25600, 24576, 28672, 40960, 16384, 40960, 10240, 20480},
+       2560, 2560, {2560, 1}, 40960, 40960, 40, {}, rep({{{6, 3, 1}, 4}, {{7, 10, 13}, 4}, {{8}, 8}}), {}, 0, 0},
+      {"a dead head", 3, {{0, 2, 0, 1}, {1, 2, 10, 1}}, {0, 1}, 2, 2, 10, {}, 5, 3, {5, 1}, 0, 6, 2, 3865470565, {{1}, {1}}, 10, 5, 5},
+      {"heads behind 2 and 10", 3, {{0, 2, 2, 1}, {1, 2, 10, 1}}, {0, 1}, 2, 2, {}, {}, 1, 1, {1, 1}, 4, 4, 4, 7730941132,
+       {{0}, {1}, {0}, {1}}, {}, 0, 0},
+      {"an idle tunnel", 2, {{0, 1, 10, 1}}, {0}, 1, 4, 3, {}, 2, 1, {5, 2}, 10, 4, 4, 4294967294, {{0}, {0}, {0}, {0}}, 3, 3, 0},
+      {"a zero design", 2, {{0, 1, 10, 1}}, {0}, 1, 2, 0, {}, 5, 1, {5, 1}, 10, 2, 2, {}, {{0}, {0}}, 4, 4, 0},
+      {"the remainder on the first link", 2, {{0, 1, 3, 1}, {0, 1, 2, 1}}, {0}, 1, 2, 5, {}, 2, 2, {2, 1}, 5, 4, 2, {}, {{0}, {1}}, {}, 0, 0},
+      {"the remainder on the second link", 2, {{0, 1, 2, 1}, {0, 1, 3, 1}}, {0}, 1, 2, 5, {}, 2, 2, {2, 1}, 4, 4, 2, {}, {{0}, {1}}, {}, 0, 0},
+      {"a tiny head", 3, {{0, 2, 1, 1}, {1, 2, 100, 1}}, {0, 1}, 2, 16, {}, {}, 0, 0, {1, 16}, 0, 0, 0, 0, {}, {}, 0, 0},
+  };  // clang-format: the table stays one row per example
+}
+
+// Every worked T2 example, each with its own prefer_headroom.
+TEST(T2Objectives, ContractExamples) {
+  for (const auto& x : examples()) {
+    SCOPED_TRACE(x.id);
+    const auto g = ordered(x.n, x.rows);
+    auto ledger = x.free.empty() ? std::make_shared<FlowLedger>(g) : std::make_shared<FlowLedger>(g, x.free);
+    auto p = make(g, x.heads, {x.dst}, t2(x.N, LOSSLESS, true), nullptr, ledger);
+    const auto r = p->replace(INF, x.D.has_value() ? std::optional<std::optional<Amount>>(x.D) : UNLIMITED);
+    ASSERT_TRUE(r.plan.has_value());
+    const auto& pl = *r.plan;
+    EXPECT_EQ(pl.max_bandwidth_per_tunnel, x.U);
+    EXPECT_EQ(pl.planned_bandwidth_per_tunnel, x.u);
+    EXPECT_EQ(pl.max_fractional_bandwidth_per_tunnel, x.fluid);
+    EXPECT_EQ(pl.max_lossless_offer, x.F);
+    EXPECT_EQ(pl.total_planned_bandwidth, x.total);
+    EXPECT_EQ(lo(pl.total_tunnel_cost), x.cost);
+    if (x.phi.has_value()) EXPECT_EQ(lo(pl.headroom_penalty), *x.phi);
+    EXPECT_EQ(pl.insufficient_resolution, x.U == 0);
+    EXPECT_EQ(routes(*r.program), x.routes);
+    for (const auto& t : r.program->tunnels()) {
+      EXPECT_EQ(t.planned_bandwidth, x.u);
+      EXPECT_EQ(t.weight, 1);
+      EXPECT_EQ(t.status, UP);
+      EXPECT_EQ(t.requested_bandwidth, 0);
+      EXPECT_EQ(t.reserved_bandwidth, 0);
+    }
+    EXPECT_EQ(r.call_delivered, x.F);
+    EXPECT_EQ(r.termination, Termination::Exhausted);
+    if (!x.offer.has_value()) continue;
+    auto lossy_ledger = x.free.empty() ? std::make_shared<FlowLedger>(g) : std::make_shared<FlowLedger>(g, x.free);
+    auto q = make(g, x.heads, {x.dst}, t2(x.N, LOSSY, true), nullptr, lossy_ledger);
+    const auto s = q->replace(x.offer, x.D.has_value() ? std::optional<std::optional<Amount>>(x.D) : UNLIMITED);
+    EXPECT_EQ(s.call_delivered, x.delivery);
+    EXPECT_EQ(s.call_source_drops, x.loss);
+    EXPECT_EQ(routes(*s.program), x.routes);
+  }
+}
+
+// The G1 call (G1 at q = 2^-12, N = 16, prefer_headroom, Lossy replace(49152)).
+TEST(T2Objectives, ContractCall) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  const auto r = p->replace(Amount {49152});
+  ASSERT_TRUE(r.plan.has_value());
+  const auto& pl = *r.plan;
+  EXPECT_EQ(pl.tunnels_per_head, 16);
+  EXPECT_EQ(pl.design_demand, Amount {49152});
+  EXPECT_EQ(pl.design_by_head, (std::vector<std::pair<NodeId, Amount>> {{0, 49152}}));
+  EXPECT_EQ(pl.total_reserved_bandwidth, 0);
+  EXPECT_EQ(pl.heads_with_capacity, (std::vector<NodeId> {0}));
+  EXPECT_EQ(pl.insufficient_resolution, false);
+  EXPECT_EQ(pl.max_fractional_bandwidth_per_tunnel, (std::pair<Amount, Amount> {20480, 7}));
+  EXPECT_EQ(pl.max_bandwidth_per_tunnel, 2925);
+  EXPECT_EQ(pl.planned_bandwidth_per_tunnel, 2925);
+  EXPECT_EQ(pl.total_planned_bandwidth, 46800);
+  EXPECT_EQ(lo(pl.total_tunnel_cost), 32);
+  EXPECT_EQ(lo(pl.headroom_penalty), 73610035200);
+  EXPECT_EQ(pl.max_lossless_offer, 46812);
+  EXPECT_EQ(r.call_delivered, 47104);
+  EXPECT_EQ(routes(*r.program), g1_paths());
+  Amounts delivered;
+  for (const auto& t : r.by_tunnel) delivered.push_back(t.delivered);
+  Amounts want(2, 3072);
+  want.insert(want.end(), 10, 2926);
+  want.insert(want.end(), 4, 2925);
+  EXPECT_EQ(delivered, want);
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{1, 2048}}));
+  EXPECT_FALSE(r.reservations_changed);
+}
+
+// A plan books nothing: no hold, no edge_reservations.
+TEST(LedgerProjections, T2BooksNothing) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  (void)p->replace(Amount {49152});
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {0, 0, 0, 0}));
+  EXPECT_EQ(p.ledger->unreserved(), (Amounts {8192, 40960, 8192, 40960}));
+  for (const auto& rec : p->records()) EXPECT_TRUE(rec.edge_reservations.empty());
+  EXPECT_EQ(p->records().size(), 16U);
+}
+
+// Without prefer_headroom the cost tie goes to the smallest keys.
+TEST(T2Objectives, HeadroomOff) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY));
+  const auto r = p->replace(Amount {49152});
+  EXPECT_EQ(counts(*r.program, 4), (Amounts {2, 14, 2, 14}));
+  EXPECT_EQ(r.plan->max_lossless_offer, 46812);
+  EXPECT_EQ(r.call_delivered, 47104);
+  EXPECT_FALSE(r.plan->headroom_penalty.has_value());
+  auto q = make(g, {0}, {3}, t2(16));
+  const auto s = q->replace(INF, Amount {8192});
+  EXPECT_EQ(s.plan->planned_bandwidth_per_tunnel, 512);
+  EXPECT_EQ(counts(*s.program, 4), (Amounts {16, 0, 16, 0}));
+  EXPECT_EQ(s.plan->max_lossless_offer, 8192);
+  const auto par = ordered(2, {{0, 1, 4, 1}, {0, 1, 12, 1}});
+  auto h = make(par, {0}, {1}, t2(2, LOSSLESS, true));
+  const auto a = h->replace(INF, Amount {2});
+  EXPECT_EQ(a.plan->max_bandwidth_per_tunnel, 6);
+  EXPECT_EQ(a.plan->planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(routes(*a.program), (std::vector<Edges> {{1}, {1}}));
+  EXPECT_EQ(a.plan->max_lossless_offer, 12);
+  EXPECT_EQ(lo(a.plan->headroom_penalty), 1073741823);
+  auto c = make(par, {0}, {1}, t2(2));
+  const auto b = c->replace(INF, Amount {2});
+  EXPECT_EQ(routes(*b.program), (std::vector<Edges> {{0}, {0}}));
+  EXPECT_EQ(b.plan->max_lossless_offer, 4);
+}
+
+// prefer_headroom off and on: two equal-cost parallel links of 10, one head, N = 2, D = 2: U = 10,
+// u = 1. Off, the canonical tie puts both tunnels on link 0 (bound 10, Lossy 12 delivers 10); on,
+// the second tunnel pays floor(2^32 / 10) on link 1 against floor(2^32 2 / 10) for a second slot on
+// link 0 (Phi = 2 floor(2^32 / 10) = 858993458, bound 20, Lossy 12 delivers 12). Both plan 2.
+TEST(T2Objectives, PreferHeadroomExample) {
+  const auto g = ordered(2, {{0, 1, 10, 1}, {0, 1, 10, 1}});
+  for (const bool on : {false, true}) {
+    SCOPED_TRACE(on);
+    auto p = make(g, {0}, {1}, t2(2, LOSSY, on));
+    const auto r = p->replace(Amount {12}, Amount {2});
+    EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 10);
+    EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 1);
+    EXPECT_EQ(r.plan->total_planned_bandwidth, 2);
+    EXPECT_EQ(lo(r.plan->total_tunnel_cost), 2);
+    EXPECT_EQ(counts(*r.program, 2), on ? (Amounts {1, 1}) : (Amounts {2, 0}));
+    EXPECT_EQ(r.plan->headroom_penalty, on ? std::optional<Counter128>(Counter128 {0, 858993458}) : std::nullopt);
+    EXPECT_EQ(r.plan->max_lossless_offer, on ? 20 : 10);
+    EXPECT_EQ(r.call_delivered, on ? 12 : 10);
+  }
+}
+
+// A reverse arc (the second unit cancels the first unit's middle link) and a preload (the slot prices
+// read the static capacity B: ONE10 with 6 units free, N = 2, D = 4: U = 3, u = 2, Phi =
+// floor(2^32 6 / 10) + floor(2^32 8 / 10)).
+TEST(T2Objectives, ReverseArcsAndPreloadedPrices) {
+  const auto g = ordered(4, {{0, 1, 1, 1}, {0, 2, 1, 5}, {1, 2, 1, 1}, {1, 3, 1, 5}, {2, 3, 1, 1}});
+  auto p = make(g, {0}, {3}, t2(2));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(routes(*r.program), (std::vector<Edges> {{0, 3}, {1, 4}}));
+  EXPECT_EQ(lo(r.plan->total_tunnel_cost), 12);
+  const auto one = one10();
+  const Amounts six {6};
+  auto q = make(one, {0}, {1}, t2(2, LOSSLESS, true), nullptr, std::make_shared<FlowLedger>(one, six));
+  const auto s = q->replace(INF, Amount {4});
+  EXPECT_EQ(s.plan->max_bandwidth_per_tunnel, 3);
+  EXPECT_EQ(s.plan->planned_bandwidth_per_tunnel, 2);
+  EXPECT_EQ(lo(s.plan->headroom_penalty), 2576980377 + 3435973836);
+}
+
+// Heads behind 3 and 8: the tunnels in round order, local indices 0, 0, 1, 1.
+TEST(T2Objectives, RoundIndices) {
+  const auto g = ordered(3, {{0, 2, 3, 1}, {1, 2, 8, 1}});
+  auto p = make(g, {0, 1}, {2}, t2(2));
+  const auto r = p->replace(INF, Amount {6});
+  std::vector<std::tuple<std::int32_t, NodeId, std::int32_t, Edges>> got;
+  for (const auto& t : r.program->tunnels()) got.emplace_back(t.entry_id, t.head, t.local_index, *t.edges);
+  EXPECT_EQ(got, (std::vector<std::tuple<std::int32_t, NodeId, std::int32_t, Edges>> {
+                     {0, 0, 0, {0}}, {1, 1, 0, {1}}, {2, 0, 1, {0}}, {3, 1, 1, {1}}}));
+}
+
+std::vector<std::pair<NodeId, Edges>> head_routes(const ForwardingProgram& p) {
+  std::vector<std::pair<NodeId, Edges>> out;
+  for (const auto& t : p.tunnels()) out.emplace_back(t.head, t.edges.value_or(Edges {}));
+  return out;
+}
+
+// The root-arc keys (1, head NodeId, direction): when the heads' first walks tie (price 2, four arcs
+// each), the smaller head goes first. Every link capacity 1, cost 1, N = 1, U = u = 1, every slot
+// price 2^32, so prefer_headroom changes nothing. (a) e0 0-2, e1 0-4, e2 1-2, e3 1-5, e4 2-3, e5 4-3,
+// e6 5-3: head 0 takes e0 e4 (smallest link key at 0); head 1 then takes e3 e6 (four arcs) rather
+// than e2, e0 reversed, e1, e5 (six). Heads in descending order would give head 1 e2 e4 and head 0
+// e1 e5. (b) e0 0-2, e1 0-5, e2 1-2, e3 1-4, e4 2-3, e5 4-3, e6 5-3: head 0 e0 e4, head 1 e3 e5;
+// descending: head 1 e2 e4, head 0 e1 e6.
+TEST(T2Objectives, RootKeyTie) {
+  const auto a = ordered(6, {{0, 2, 1, 1}, {0, 4, 1, 1}, {1, 2, 1, 1}, {1, 5, 1, 1}, {2, 3, 1, 1}, {4, 3, 1, 1}, {5, 3, 1, 1}});
+  const auto b = ordered(6, {{0, 2, 1, 1}, {0, 5, 1, 1}, {1, 2, 1, 1}, {1, 4, 1, 1}, {2, 3, 1, 1}, {4, 3, 1, 1}, {5, 3, 1, 1}});
+  for (const bool headroom : {false, true}) {
+    auto p = make(a, {0, 1}, {3}, t2(1, LOSSLESS, headroom));
+    EXPECT_EQ(head_routes(*p->replace(INF).program), (std::vector<std::pair<NodeId, Edges>> {{0, {0, 4}}, {1, {3, 6}}}));
+    auto q = make(b, {0, 1}, {3}, t2(1, LOSSLESS, headroom));
+    EXPECT_EQ(head_routes(*q->replace(INF).program), (std::vector<std::pair<NodeId, Edges>> {{0, {0, 4}}, {1, {3, 5}}}));
+  }
+}
+
+// Fewest arcs before keys, prefer_headroom off: the direct link ties the longer walk on
+// cost and has fewer arcs; the smallest keys alone would take the walk. (a) e0 0-1 (cost 1), e1 0-2
+// (cost 2), e2 1-2 (cost 1): e1 (three arcs against four), keys alone e0 e2. (b) e0 0-1, e1 0-3
+// (cost 3), e2 1-2, e3 2-3 (cost 1 each): e1, keys alone e0 e2 e3. Capacities 1, N = 1.
+TEST(T2Objectives, FewestArcsBeforeKeys) {
+  auto p = make(ordered(3, {{0, 1, 1, 1}, {0, 2, 1, 2}, {1, 2, 1, 1}}), {0}, {2}, t2(1));
+  EXPECT_EQ(routes(*p->replace(INF).program), (std::vector<Edges> {{1}}));
+  auto q = make(ordered(4, {{0, 1, 1, 1}, {0, 3, 1, 3}, {1, 2, 1, 1}, {2, 3, 1, 1}}), {0}, {3}, t2(1));
+  EXPECT_EQ(routes(*q->replace(INF).program), (std::vector<Edges> {{1}}));
+}
+
+// The cut into unit walks: live heads ascending, each walk along the smallest positive EdgeId.
+// (a) e0 0-1 (capacity 2), e1 1-2 (2), e2 1-2 (3), cost 2 each, heads 0 and 1, N = 2, U = u = 1:
+// head 1's two units take e1 (cost 2 against head 0's 4), head 0's e0 then e2; x = (2, 2, 2). Head 0
+// cuts first: e0 e1 twice, leaving e2 twice to head 1 (the largest EdgeId would give head 0 e0 e2
+// and head 1 e1). (b) e0 0-2, e1 1-2, e2 2-3, e3 2-4, e4 3-5, e5 4-5, capacity 1, cost 1, N = 1:
+// x is all ones; head 0 takes e0 e2 e4, head 1 e1 e3 e5 (the largest EdgeId: e0 e3 e5 and e1 e2 e4).
+TEST(T2Objectives, CutIntoUnitWalks) {
+  auto p = make(ordered(3, {{0, 1, 2, 2}, {1, 2, 2, 2}, {1, 2, 3, 2}}), {0, 1}, {2}, t2(2));
+  EXPECT_EQ(head_routes(*p->replace(INF).program),
+            (std::vector<std::pair<NodeId, Edges>> {{0, {0, 1}}, {1, {2}}, {0, {0, 1}}, {1, {2}}}));
+  auto q = make(ordered(6, {{0, 2, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {2, 4, 1, 1}, {3, 5, 1, 1}, {4, 5, 1, 1}}), {0, 1},
+                {5}, t2(1));
+  EXPECT_EQ(head_routes(*q->replace(INF).program),
+            (std::vector<std::pair<NodeId, Edges>> {{0, {0, 2, 4}}, {1, {1, 3, 5}}}));
+}
+
+// The route cost above 2^64 (WIDE: one link of 16 at cost 2^61 + 1, N = 16, D = 16).
+TEST(T2Objectives, WideRouteCost) {
+  const auto g = ordered(2, {{0, 1, 16, (Cost {1} << 61) + 1}});
+  auto p = make(g, {0}, {1}, t2(16));
+  const auto r = p->replace(INF, Amount {16});
+  ASSERT_TRUE(r.plan->total_tunnel_cost.has_value());
+  EXPECT_EQ(wide(*r.plan->total_tunnel_cost), Int128(16) * Int128((std::int64_t {1} << 61) + 1));
+  EXPECT_EQ(r.plan->total_tunnel_cost->hi, 2U);
+}
+
+// A slot price is at most 2^32 (j u <= V): a full link of 10 with 10 tunnels at u = 1
+// pays floor(2^32 j / 10) for j = 1..10, the last exactly 2^32: 55 * 2^32 / 10 minus the dropped
+// fractions (0.6, 0.2, 0.8, 0.4, 0, 0.6, 0.2, 0.8, 0.4, 0: 4 in all) = 23622320124.
+TEST(T2Objectives, PenaltyBound) {
+  auto p = make(one10(), {0}, {1}, t2(10, LOSSLESS, true));
+  const auto r = p->replace(INF, Amount {10});
+  EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(lo(r.plan->headroom_penalty), 23622320124);
+}
+
+// floor(2^32 m / B) for 0 <= m <= B < 2^62, by binary long division in 64 bits (independent of the
+// library's 128-bit helpers).
+std::uint64_t slot_price_by_division(std::uint64_t m, std::uint64_t B) {
+  if (m == B) return std::uint64_t {1} << 32;
+  std::uint64_t rem = m;
+  std::uint64_t q = 0;
+  for (int bit = 0; bit < 32; ++bit) {
+    rem <<= 1;  // below 2 B < 2^63
+    q <<= 1;
+    if (rem >= B) {
+      rem -= B;
+      q |= 1;
+    }
+  }
+  return q;
+}
+
+// The closed-form penalty of t2_objectives equals the slot-by-slot sum of the headroom prices on one link (random
+// B up to 2^62 - 1, V <= B, u and x with x u <= V, x up to 3000), summed here with its own carry.
+TEST(T2Objectives, PenaltySumsEverySlot) {
+  std::mt19937_64 rng(4242);
+  const std::vector<EdgeId> edges {0};
+  for (int trial = 0; trial < 3000; ++trial) {
+    const int scale = trial % 4;
+    const Amount B = scale == 0   ? Amount(1 + rng() % 20)
+                     : scale == 1 ? Amount(1 + rng() % 100000)
+                     : scale == 2 ? Amount(1 + rng() % (Amount {1} << 40))
+                                  : kL62 - 1 - Amount(rng() % 1000);
+    const Amount V = Amount(rng() % static_cast<std::uint64_t>(B + 1));
+    if (V == 0) continue;
+    const Amount u = trial % 3 == 0 ? 1 : 1 + Amount(rng() % static_cast<std::uint64_t>(V));
+    const Amount x = std::min<Amount>(V / u, Amount(rng() % 3001));
+    std::uint64_t hi = 0;
+    std::uint64_t lo = 0;
+    for (Amount j = 1; j <= x; ++j) {
+      const std::uint64_t price = slot_price_by_division(static_cast<std::uint64_t>(B - V + j * u), static_cast<std::uint64_t>(B));
+      lo += price;
+      if (lo < price) ++hi;
+    }
+    const auto g = ordered(2, {{0, 1, B, 3}});
+    const std::vector<Amount> xs {x};
+    const std::vector<Amount> free {V};
+    const auto obj = detail::t2_objectives(*g, edges, xs, free, u, true);
+    ASSERT_EQ(obj.headroom_penalty, (Counter128 {hi, lo})) << "B " << B << " V " << V << " u " << u << " x " << x;
+    ASSERT_EQ(obj.route_cost, (Counter128 {0, static_cast<std::uint64_t>(3 * x)}));
+    ASSERT_EQ(detail::t2_objectives(*g, edges, xs, free, u, false).headroom_penalty, Counter128 {});
+  }
+}
+
+// The penalty past 2^64, with a carry into the high word, as a plan publishes it (no layout reaches
+// it in a test's time: it takes 2^32 slots). One link B = V = 2^33, u = 1, x = 2^33: slot j pays
+// floor(2^32 j / 2^33) = floor(j / 2), and the slots 2i - 1, 2i pay 2i - 1, so the sum is
+// (2^32)^2 = 2^64 exactly. Three links B = V = 2^32, u = 1, x = 2^32: slot j pays j, each link
+// 2^32 (2^32 + 1) / 2 = 2^63 + 2^31, the three 2^64 + 2^63 + 3 * 2^31; J = 3 * 2^32 (cost 1).
+TEST(T2Objectives, PenaltyAboveTwoTo64) {
+  const Amount p32 = Amount {1} << 32;
+  const auto one = ordered(2, {{0, 1, 2 * p32, 1}});
+  const std::vector<EdgeId> e0 {0};
+  const auto a = detail::t2_objectives(*one, e0, std::vector<Amount> {2 * p32}, std::vector<Amount> {2 * p32}, 1, true);
+  EXPECT_EQ(a.headroom_penalty, (Counter128 {1, 0}));
+  EXPECT_EQ(a.route_cost, (Counter128 {0, std::uint64_t {1} << 33}));
+  const auto three = ordered(4, {{0, 1, p32, 1}, {1, 2, p32, 1}, {2, 3, p32, 1}});
+  const std::vector<EdgeId> e012 {0, 1, 2};
+  const std::vector<Amount> x3 {p32, p32, p32};
+  const auto b = detail::t2_objectives(*three, e012, x3, x3, 1, true);
+  EXPECT_EQ(b.headroom_penalty, (Counter128 {1, (std::uint64_t {1} << 63) + 3 * (std::uint64_t {1} << 31)}));
+  EXPECT_EQ(b.route_cost, (Counter128 {0, 3 * static_cast<std::uint64_t>(p32)}));
+  // More slots than the free capacity holds is an internal contradiction.
+  EXPECT_THROW((void)detail::t2_objectives(*one, e0, std::vector<Amount> {3}, std::vector<Amount> {2}, 1, true),
+               std::logic_error);
+}
+
+// ---------------------------------------------------------------- up to L
+
+// Up to: G1 up to 6, a common size, a dead head, a tiny head: the chosen count,
+// the routes, the lossless delivery of D; with every head live, F'(k) is EXACT(k)'s bound.
+TEST(T2UpTo, ContractExamples) {
+  struct Case {
+    std::string id;
+    std::int32_t n;
+    std::vector<InEdge> rows;
+    std::vector<NodeId> heads;
+    NodeId dst;
+    std::int64_t L;
+    std::optional<Amount> D;
+    std::int64_t k;
+    std::vector<Edges> routes;
+    Amount delivered;
+    Amounts bounds;
+  };
+  std::vector<Edges> g1k6 {{0, 2}};
+  g1k6.insert(g1k6.end(), 5, Edges {1, 3});
+  const std::vector<Case> cases = {
+      {"G1 up to 6", 4, kG1, {0}, 3, 6, 49152, 6, g1k6, 49152, {40960, 40960, 40960, 40960, 40960, 49152}},
+      {"up to, a common size", 4, {{0, 3, 6, 1}, {1, 3, 3, 1}, {1, 3, 3, 1}}, {0, 1}, 3, 2, 12, 2, {{0}, {1}, {0}, {2}}, 12, {7, 12}},
+      {"up to, a dead head", 3, {{0, 2, 0, 1}, {1, 2, 10, 1}}, {0, 1}, 2, 2, 10, 1, {{1}}, 0, {}},
+      {"up to, a tiny head", 3, {{0, 2, 1, 1}, {1, 2, 100, 1}}, {0, 1}, 2, 3, {}, 1, {{0}, {1}}, 2, {2, 0, 0}},
+  };
+  for (const auto& c : cases) {
+    SCOPED_TRACE(c.id);
+    const auto g = ordered(c.n, c.rows);
+    auto p = make(g, c.heads, {c.dst}, t2(c.L, LOSSLESS, true, true));
+    const auto r = p->replace(c.D.has_value() ? c.D : INF);
+    EXPECT_EQ(r.plan->tunnels_per_head, c.k);
+    EXPECT_EQ(routes(*r.program), c.routes);
+    EXPECT_EQ(r.call_delivered, c.delivered);
+    for (std::size_t k = 1; k <= c.bounds.size(); ++k) {
+      auto q = make(g, c.heads, {c.dst}, t2(static_cast<std::int64_t>(k), LOSSLESS, true));
+      EXPECT_EQ(q->replace(INF).call_delivered, c.bounds[k - 1]) << k;
+    }
+  }
+}
+
+// Three parallel links of 6, 5 and 4, D = 11, up to 3. k = 1: U = 6, F'(1) = 6. k = 2: U = 5 (one
+// tunnel on the 6-link, one on the 5-link), the bounds 10 and 11 leave the score open, F'(2) = 11
+// (z = 11 gives 6 and 5) = D: chosen. k = 3: U = 4, its lower bound min(11, 3 * 4) already reaches
+// D, so a budget F'(2) one unit low would choose 3.
+TEST(T2UpTo, ReachesTheDesignExactly) {
+  const auto g = ordered(2, {{0, 1, 6, 1}, {0, 1, 5, 1}, {0, 1, 4, 1}});
+  auto p = make(g, {0}, {1}, t2(3, LOSSLESS, false, true));
+  const auto r = p->replace(Amount {11});
+  EXPECT_EQ(r.plan->tunnels_per_head, 2);
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 5);
+  EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 5);
+  EXPECT_EQ(routes(*r.program), (std::vector<Edges> {{0}, {1}}));
+  EXPECT_EQ(r.call_delivered, 11);
+}
+
+// G1, up to 6, Lossless replace(inf): count 6, call_delivered 49152.
+TEST(T2UpTo, Unlimited) {
+  auto p = make(g1(), {0}, {3}, t2(6, LOSSLESS, true, true));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->tunnels_per_head, 6);
+  EXPECT_EQ(r.call_delivered, 49152);
+  EXPECT_EQ(r.plan->design_demand, std::nullopt);
+  EXPECT_TRUE(r.plan->design_by_head.empty());
+}
+
+// ---------------------------------------------------------------- operations (U)
+
+// An unlimited design (D = offer = +inf): u = U.
+TEST(T2Operations, UnlimitedDesign) {
+  auto p = make(g1(), {0}, {3}, t2(16, LOSSLESS, true));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 2925);
+  EXPECT_TRUE(r.plan->design_by_head.empty());
+  EXPECT_EQ(r.plan->design_demand, std::nullopt);
+  EXPECT_EQ(r.call_delivered, 46812);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// Every head dead: no tunnel, a plan of zeros (count N, 1 for "up to"), the offer lost at
+// the heads (Lossy COMPLETE, Lossless EXHAUSTED); "up to" counts 1.
+TEST(T2Operations, AllDead) {
+  const auto g = twoh(0, 0);
+  for (const bool up : {false, true}) {
+    for (const auto a : {LOSSY, LOSSLESS}) {
+      auto p = make(g, {0, 1}, {2}, t2(up ? 3 : 2, a, false, up));
+      const auto r = p->replace(Amount {10}, Amount {10});
+      const auto& pl = *r.plan;
+      EXPECT_EQ(pl.tunnels_per_head, up ? 1 : 2);
+      EXPECT_EQ(pl.design_by_head, (std::vector<std::pair<NodeId, Amount>> {{0, 5}, {1, 5}}));
+      EXPECT_EQ(pl.heads_with_capacity, std::vector<NodeId> {});
+      EXPECT_EQ(pl.insufficient_resolution, false);
+      EXPECT_EQ(pl.max_fractional_bandwidth_per_tunnel, (std::pair<Amount, Amount> {0, 1}));
+      EXPECT_EQ(pl.max_bandwidth_per_tunnel, 0);
+      EXPECT_EQ(pl.planned_bandwidth_per_tunnel, 0);
+      EXPECT_EQ(pl.total_planned_bandwidth, 0);
+      EXPECT_EQ(lo(pl.total_tunnel_cost), 0);
+      EXPECT_FALSE(pl.headroom_penalty.has_value());
+      EXPECT_EQ(pl.max_lossless_offer, 0);
+      EXPECT_TRUE(r.program->tunnels().empty());
+      EXPECT_EQ(r.call_delivered, 0);
+      EXPECT_TRUE(p->records().empty());
+      if (a == LOSSY) {
+        EXPECT_EQ(r.call_source_drops, 10);
+        EXPECT_EQ(r.termination, Termination::Complete);
+        EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 0, 5, 0}}));
+      } else {
+        EXPECT_EQ(r.termination, Termination::Exhausted);
+      }
+    }
+  }
+}
+
+// A tiny head, forwarding without tunnels: U = 0 with live heads: no tunnel,
+// insufficient_resolution; an installed program keeping the roster that forward reuses.
+TEST(T2Operations, InsufficientResolution) {
+  const auto g = twoh(1, 100);
+  for (const auto a : {LOSSY, LOSSLESS}) {
+    auto p = make(g, {0, 1}, {2}, t2(16, a));
+    const auto r = p->replace(Amount {200}, Amount {200});
+    EXPECT_EQ(r.plan->insufficient_resolution, true);
+    EXPECT_EQ(r.plan->max_fractional_bandwidth_per_tunnel, (std::pair<Amount, Amount> {1, 16}));
+    EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 0);
+    EXPECT_EQ(r.plan->heads_with_capacity, (std::vector<NodeId> {0, 1}));
+    EXPECT_TRUE(r.program->tunnels().empty());
+    ASSERT_NE(p->program(), nullptr);
+    EXPECT_EQ(r.call_delivered, 0);
+    const auto f = p->forward(Amount {10});
+    if (a == LOSSY) {
+      EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 100, 100, 0, 100, 0}, {1, 100, 100, 0, 100, 0}}));
+      EXPECT_EQ(f.call_source_drops, 10);
+      EXPECT_EQ(f.termination, Termination::Complete);
+      EXPECT_EQ(source_rows(f), (std::vector<SourceRow> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 0, 5, 0}}));
+    } else {
+      EXPECT_EQ(r.termination, Termination::Exhausted);
+      EXPECT_EQ(f.call_delivered, 0);
+      EXPECT_EQ(f.termination, Termination::Exhausted);
+    }
+    EXPECT_EQ(f.plan, r.plan);
+  }
+}
+
+// A dead head: indices 1 and 3; the rows; two records (entries 1, 3).
+TEST(T2Operations, DeadHead) {
+  auto p = make(twoh(0, 10), {0, 1}, {2}, t2(2, LOSSY));
+  const auto r = p->replace(Amount {10}, Amount {10});
+  EXPECT_EQ(indices(*r.program), (std::vector<std::int32_t> {1, 3}));
+  EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 5, 0, 0}}));
+  std::vector<std::optional<std::int32_t>> entries;
+  for (const auto& rec : p->records()) entries.push_back(rec.entry_id);
+  std::sort(entries.begin(), entries.end());
+  EXPECT_EQ(entries, (std::vector<std::optional<std::int32_t>> {1, 3}));
+}
+
+// OPTIMIZED with one source is the EQUAL calculation; equal sources.
+TEST(T2Operations, OptimizedOneSource) {
+  const auto g = g1();
+  auto a = make(g, {0}, {3}, t2(16, LOSSY, true));
+  auto b = make(g, {0}, {3}, t2(16, LOSSY, true, false, SourceAllocation::Optimized));
+  const auto ra = a->replace(Amount {49152});
+  const auto rb = b->replace(Amount {49152});
+  EXPECT_EQ(ra.plan, rb.plan);
+  EXPECT_EQ(routes(*ra.program), routes(*rb.program));
+  EXPECT_EQ(ra.by_tunnel, rb.by_tunnel);
+  EXPECT_EQ(ra.call_edge_drops, rb.call_edge_drops);
+  EXPECT_EQ(std::get<CentralizedTE>(b->config().routing).source_allocation, SourceAllocation::Optimized);
+  EXPECT_FALSE(rb.program->source_weights().has_value());
+}
+
+// Heads behind 2 and 10 against the global optimum, N = 2: common size 1, lossless bound 4;
+// optimized CentralizedTE delivers 12 on the same network.
+TEST(T2Operations, TwoHeadsEqualAgainstGlobal) {
+  const auto g = twoh(2, 10);
+  auto p = make(g, {0, 1}, {2}, t2(2));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(evaluate_demand(*g, v({0, 1}), v({2}), EvaluationOptions {global_config()}).call_delivered, 12);
+}
+
+// An empty roster: NO_ROUTE, an empty program, a plan of zeros.
+TEST(T2Operations, EmptyRoster) {
+  const auto g = ordered(3, {{1, 2, 5, 1}});
+  for (const auto a : {LOSSY, LOSSLESS}) {
+    auto p = make(g, {0}, {2}, t2(2, a, true));
+    const auto r = p->replace(Amount {5}, Amount {5});
+    EXPECT_EQ(r.termination, Termination::NoRoute);
+    EXPECT_TRUE(r.program->tunnels().empty());
+    EXPECT_EQ(r.plan->tunnels_per_head, 2);
+    EXPECT_TRUE(r.plan->design_by_head.empty());
+    EXPECT_EQ(r.plan->heads_with_capacity, std::vector<NodeId> {});
+    EXPECT_EQ(lo(r.plan->headroom_penalty), 0);
+    EXPECT_EQ(r.plan->max_lossless_offer, 0);
+  }
+}
+
+// A zero design: D = 0 plans at u = 1.
+TEST(T2Operations, ZeroDesign) {
+  auto p = make(one10(), {0}, {1}, t2(2));
+  const auto r = p->replace(Amount {0});
+  EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.program->tunnels().size(), 2U);
+  for (const auto& t : r.program->tunnels()) EXPECT_EQ(t.planned_bandwidth, 1);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::Complete);
+}
+
+// Forward keeps the program and the plan, sets no flag.
+TEST(T2Operations, Forward) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  const auto first = p->replace(Amount {49152});
+  const auto f = p->forward(Amount {32768});
+  EXPECT_EQ(f.call_delivered, 32768);
+  EXPECT_FALSE(f.routes_changed || f.weights_changed || f.reservations_changed);
+  EXPECT_EQ(f.program, first.program);
+  EXPECT_EQ(f.plan, first.plan);
+  auto q = make(g, {0}, {3}, t2(16, LOSSLESS, true));
+  (void)q->replace(Amount {49152});
+  EXPECT_EQ(q->forward(INF).call_delivered, 46812);
+}
+
+// The same routes and weights with another planned size: no flag (a planned size is no
+// reservation).
+TEST(T2Operations, Flags) {
+  auto p = make(g1(), {0}, {3}, t2(16, LOSSY, true));
+  const auto a = p->replace(Amount {49152});
+  const auto b = p->replace(Amount {49152}, Amount {8192});
+  EXPECT_FALSE(b.routes_changed || b.weights_changed || b.reservations_changed);
+  EXPECT_EQ(a.plan->planned_bandwidth_per_tunnel, 2925);
+  EXPECT_EQ(b.plan->planned_bandwidth_per_tunnel, 512);
+}
+
+// ---------------------------------------------------------------- validation (V)
+
+// T2's row of the matrix, in order, at the policy and at an evaluator: the several-sources rule
+// (OPTIMIZED with several input sources), counted before the mask; prefer_headroom without a tunnel
+// count; then the cache (only ShortestPaths reads one). T2 accepts both admissions.
+TEST(TunnelValidation, T2Matrix) {
+  const auto g = twoh(10, 10);
+  FlowLedger fg(g);
+  const CentralizedTE tun = centralized(SourceAllocation::Equal, {}, TunnelCount {2});
+  auto rejects = [&](FlowPolicyConfig c, const std::string& text, ShortestPathCache* cache = nullptr) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0, 1}), v({2}), c, nullptr, cache); }), text);
+    EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty());
+    if (cache == nullptr) EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0, 1}), v({2}), EvaluationOptions {c}); }), text);
+  };
+  const std::string several = "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL";
+  const CentralizedTE optimized = centralized(SourceAllocation::Optimized, {}, TunnelCount {2});
+  rejects({.routing = optimized}, several);
+  rejects({.routing = centralized(SourceAllocation::Optimized, {}, TunnelCount {0})}, several);  // before the count
+  rejects({.routing = centralized(SourceAllocation::Equal, {}, std::nullopt, true)}, "prefer_headroom requires tunnel_count");
+  rejects({.routing = centralized(SourceAllocation::Equal, dag_of(*g, {0, 1}), std::nullopt, true)},
+          "prefer_headroom requires tunnel_count");
+  ShortestPathCache cache(*g);
+  rejects({.routing = tun}, "CentralizedTE does not use ShortestPathCache", &cache);
+  // The several-sources rule counts the input sources before the mask; one source with OPTIMIZED is
+  // accepted (the same calculation).
+  const auto mask = g->eligibility(std::vector<NodeId> {1}, {});
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0, 1}), v({2}), {.routing = optimized}, &mask); }), several);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0, 0}), v({2}), {.routing = optimized}); }), "");
+  // Accepted: both admissions, with and without prefer_headroom; the snapshot keeps the source
+  // allocation as given.
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    for (const bool h : {false, true}) EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0, 1}), v({2}), t2(2, a, h)); }), "");
+  }
+  FlowPolicy p(fg, v({0, 1}), v({2}), FlowPolicyConfig {.routing = tun});
+  EXPECT_EQ(std::get<CentralizedTE>(p.config().routing).source_allocation, SourceAllocation::Equal);
+  EXPECT_EQ(std::string(detail::model_name(p.config().routing)), "CentralizedTE with tunnel_count");
+}
+
+// The count range for N and L; the tunnel limit with L for "up to".
+TEST(TunnelValidation, T2CountAndLimit) {
+  const auto g = one10();
+  FlowLedger fg(g);
+  for (const std::int64_t n : {0, 10001, -1}) {
+    for (const bool up : {false, true}) {
+      EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), t2(n, LOSSLESS, false, up)); }),
+                "tunnel count must be in [1, 10000]");
+    }
+  }
+  const auto fan = [](std::int32_t h) {
+    std::vector<InEdge> rows;
+    rows.reserve(static_cast<std::size_t>(h));
+    for (std::int32_t i = 0; i < h; ++i) rows.push_back({i, h, 1, 1});
+    return shared(make_graph(h + 1, rows));
+  };
+  const auto heads = [](std::int32_t h) {
+    std::vector<NodeId> out(static_cast<std::size_t>(h));
+    for (std::int32_t i = 0; i < h; ++i) out[static_cast<std::size_t>(i)] = i;
+    return out;
+  };
+  const auto big = fan(107375);
+  FlowLedger fb(big);
+  for (const bool up : {false, true}) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fb, heads(107375), v({107375}), t2(10000, LOSSLESS, false, up)); }),
+              "tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823");
+  }
+  const auto ok = fan(107374);
+  FlowLedger fo(ok);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fo, heads(107374), v({107374}), t2(10000)); }), "");
+}
+
+// T2's operations and the design's domain, with their texts.
+TEST(TunnelOperations, T2CallValidation) {
+  auto p = make(one10(), {0}, {1}, t2(2));
+  // The operation before the offer: also for an offer outside the domain.
+  for (const Amount x : {Amount {5}, Amount {0}, Amount {-1}, kDomainLimit}) {
+    EXPECT_EQ(error_of([&] { (void)p->place(x); }), "CentralizedTE with tunnel_count does not support incremental placement") << x;
+  }
+  EXPECT_EQ(error_of([&] { (void)p->forward(Amount {5}); }), "forward requires an installed program");
+  for (const Amount d : {Amount {-1}, kL62}) {
+    EXPECT_EQ(error_of([&] { (void)p->replace(Amount {5}, d); }),
+              "design_demand must be an integer in [0, 2^62) or permitted +inf");
+  }
+  EXPECT_EQ(error_of([&] { (void)p->replace(Amount {-1}, Amount {-1}); }),
+            "offer must be an integer in [0, 2^62) or permitted +inf");
+  auto ly = make(one10(), {0}, {1}, t2(2, LOSSY));
+  EXPECT_EQ(error_of([&] { (void)ly->replace(INF); }), "LOSSY forwarding requires a finite offer");
+  EXPECT_EQ(error_of([&] { (void)p->replace(INF); }), "");
+  EXPECT_EQ(error_of([&] { (void)p->evaluate(INF, UNLIMITED); }), "");
+}
+
+// No certificates; the plan only for the tunnel models.
+TEST(TunnelOperations, T2NoCertificates) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16));
+  const auto r = p->replace(INF, std::nullopt, OutputOptions {.min_cut = true});
+  EXPECT_FALSE(r.total_cost.has_value());
+  EXPECT_FALSE(r.min_cut.has_value());
+  EXPECT_FALSE(r.marginal_cost_curve.has_value());
+  auto pin = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {r.program, nullptr}});
+  EXPECT_FALSE(pin->replace(Amount {10}).plan.has_value());
+  // An optimized-source-allocation T2 policy whose roster is empty (source 0 reaches nothing) reports no
+  // certificate either, never an empty cut or curve: replace(5) is NO_ROUTE, replace(0) COMPLETE.
+  auto empty = make(ordered(3, {{1, 2, 10, 1}}), {0}, {2}, t2(2, LOSSLESS, false, false, SourceAllocation::Optimized));
+  for (const Amount offer : {Amount {5}, Amount {0}}) {
+    SCOPED_TRACE(offer);
+    const auto e = empty->replace(offer, std::nullopt, OutputOptions {.min_cut = true});
+    EXPECT_EQ(e.termination, offer > 0 ? Termination::NoRoute : Termination::Complete);
+    EXPECT_EQ(e.call_delivered, 0);
+    EXPECT_FALSE(e.total_cost.has_value());
+    EXPECT_FALSE(e.min_cut.has_value());
+    EXPECT_FALSE(e.marginal_cost_curve.has_value());
+    ASSERT_TRUE(e.plan.has_value());
+  }
+}
+
+// ---------------------------------------------------------------- programs (P)
+
+// The masked-replay call: the G1 call's program replayed with e2 masked.
+TEST(TunnelPrograms, T2Replay) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  const auto base = p->replace(Amount {49152}).program;
+  const auto fail = g->eligibility({}, std::vector<EdgeId> {2});
+  auto replay = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {base, nullptr}, .admission = LOSSY}, &fail);
+  const auto r = replay->replace(Amount {49152});
+  auto st = row_statuses(r);
+  st.resize(3);
+  EXPECT_EQ(st, (std::vector<TunnelStatus> {FAILED, FAILED, UP}));
+  EXPECT_EQ(r.call_delivered, 40960);
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{1, 8192}}));
+}
+
+// The same program stale: e2 a black hole.
+TEST(TunnelPrograms, T2Stale) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  const auto base = p->replace(Amount {49152}).program;
+  const auto dark = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {2}));
+  auto stale = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {base, dark}, .admission = LOSSY});
+  const auto r = stale->replace(Amount {49152});
+  std::vector<TunnelStatus> want(2, BLACKHOLED);
+  want.insert(want.end(), 14, UP);
+  EXPECT_EQ(row_statuses(r), want);
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{1, 2048}, {2, 6144}}));
+  EXPECT_EQ(r.call_delivered, 40960);
+  for (const auto& t : base->tunnels()) EXPECT_EQ(t.status, UP);
+}
+
+// The G1 call's tunnels: requested 0, reserved 0, planned 2925, UP, weight 1; equal sources.
+TEST(TunnelPrograms, T2Fields) {
+  auto p = make(g1(), {0}, {3}, t2(16, LOSSY, true));
+  const auto r = p->replace(Amount {49152});
+  ASSERT_EQ(r.program->tunnels().size(), 16U);
+  for (const auto& t : r.program->tunnels()) {
+    EXPECT_EQ(t.requested_bandwidth, 0);
+    EXPECT_EQ(t.reserved_bandwidth, 0);
+    EXPECT_EQ(t.planned_bandwidth, 2925);
+    EXPECT_EQ(t.status, UP);
+    EXPECT_EQ(t.weight, 1);
+    EXPECT_EQ(t.destination, NodeId {3});
+    EXPECT_EQ(t.path_cost, Cost {2});
+  }
+  EXPECT_FALSE(r.program->source_weights().has_value());
+}
+
+// The planned bandwidth is T2's alone: 0 on T1's tunnels, on a controller's paths (CentralizedTE,
+// ShortestPaths Optimized) and on a supplied program's tunnels; Pinned over a T2 program keeps u.
+TEST(TunnelPrograms, PlannedOnlyOnT2) {
+  const auto g = twoh(2, 10);
+  auto planned = [](const PlacementResult& r) {
+    Amounts out;
+    for (const auto& t : r.program->tunnels()) out.push_back(t.planned_bandwidth);
+    return out;
+  };
+  auto t1 = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = DistributedTE {.tunnel_count = TunnelCount {2}}, .admission = LOSSY});
+  EXPECT_EQ(planned(t1->replace(12, 12)), (Amounts {0, 0, 0, 0}));
+  auto global = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = centralized()});
+  EXPECT_EQ(planned(global->place(12)), (Amounts {0, 0}));
+  auto max_flow = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = shortest_paths(RouteAllocation::Optimized)});
+  EXPECT_EQ(planned(max_flow->place(12)), (Amounts {0, 0}));
+  const std::vector<NodeId> s {0, 1};
+  const std::vector<NodeId> d {2};
+  const std::vector<RouteDefinition> routes {{0, std::make_shared<const Path>(*g, std::vector<std::vector<EdgeId>> {{0}}), 1},
+                                   {1, std::make_shared<const Path>(*g, std::vector<std::vector<EdgeId>> {{1}}), 1}};
+  const auto supplied = ForwardingProgram::from_routes(*g, s, d, routes);
+  auto pinned = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {.program = supplied}, .admission = LOSSY});
+  EXPECT_EQ(planned(pinned->replace(Amount {4})), (Amounts {0, 0}));
+  auto tun = make(g, {0, 1}, {2}, t2(2));
+  const auto laid = tun->replace(INF);
+  EXPECT_EQ(planned(laid), (Amounts {1, 1, 1, 1}));
+  auto replay = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {.program = laid.program}, .admission = LOSSY});
+  EXPECT_EQ(planned(replay->replace(Amount {4})), (Amounts {1, 1, 1, 1}));
+}
+
+// ---------------------------------------------------------------- evaluators (Q)
+
+// The design rule of the evaluators (T2's design: the offer when finite, else unlimited);
+// nothing shared between pairs.
+TEST(TunnelEvaluators, T2Capacity) {
+  const auto g = g1();
+  auto err = [&](const EvaluationOptions& o) { return error_of([&] { (void)evaluate_demand(*g, v({0}), v({3}), o); }); };
+  EvaluationOptions q {t2(16, LOSSLESS, true)};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({3}), q).call_delivered, 46812);
+  q.design_demand = Amount {8192};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({3}), q).call_delivered, 46812);
+  EvaluationOptions ly {t2(16, LOSSY, true)};
+  ly.design_demand = Amount {49152};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({3}), ly).call_delivered, 47104);
+  EvaluationOptions lo_ {t2(16, LOSSY, true)};
+  lo_.offer = Amount {49152};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({3}), lo_).call_delivered, 47104);
+  EXPECT_EQ(err(EvaluationOptions {t2(16, LOSSY, true)}), "CentralizedTE LOSSY evaluation requires a finite offer");
+  EvaluationOptions unlimited {t2(16, LOSSY, true)};
+  unlimited.design_demand = std::optional<Amount> {};
+  EXPECT_EQ(err(unlimited), "CentralizedTE LOSSY evaluation requires a finite offer");
+  // Lossless with a finite offer and no design: the design is the offer, the delivery up to it.
+  EvaluationOptions offered {t2(16, LOSSLESS, true)};
+  offered.offer = Amount {5};
+  const auto r5 = evaluate_demand(*g, v({0}), v({3}), offered);
+  EXPECT_EQ(r5.call_delivered, 5);
+  EXPECT_EQ(r5.plan->design_demand, Amount {5});
+  const auto one = one10();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({1})}, {v({0}), v({1})}};
+  for (const std::int32_t workers : {1, 2}) {
+    const auto rs = evaluate_pairs(*one, pairs, EvaluationOptions {t2(2)}, {}, workers);
+    ASSERT_EQ(rs.size(), 2U);
+    EXPECT_EQ(rs[0].call_delivered, 10);
+    EXPECT_EQ(rs[1].call_delivered, 10);
+  }
+}
+
+// T2 LOSSY's offer rule in all three evaluators: a finite offer is used as given, an absent
+// one is the design if finite, and an explicit +inf is an error whatever the design (the offer's
+// domain, checked before the design). One link of 10,
+// N = 2: both tunnels share the link, so the Lossy delivery is min(offer, 10).
+TEST(TunnelEvaluators, T2LossyOfferRule) {
+  const auto g = one10();
+  const std::optional<std::optional<Amount>> absent;
+  const std::optional<std::optional<Amount>> inf {std::in_place, std::nullopt};
+  const auto amount = [](Amount a) { return std::optional<std::optional<Amount>> {std::in_place, a}; };
+  const std::string missing = "CentralizedTE LOSSY evaluation requires a finite offer";
+  const std::string domain = "offer must be an integer in [0, 2^62)";
+  struct Row {
+    std::optional<std::optional<Amount>> design, offered;
+    std::optional<Amount> delivered;  // nullopt: the error
+    std::string text {};
+  };
+  const std::vector<Row> rows = {
+      {absent, absent, {}, missing}, {amount(0), absent, 0},       {amount(4), absent, 4},       {inf, absent, {}, missing},
+      {absent, inf, {}, domain},     {amount(0), inf, {}, domain}, {amount(4), inf, {}, domain}, {inf, inf, {}, domain},
+      {absent, amount(0), 0},   {amount(4), amount(0), 0}, {inf, amount(0), 0},     {absent, amount(7), 7},
+      {amount(0), amount(7), 7}, {amount(4), amount(7), 7}, {inf, amount(7), 7},
+  };
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({1})}, {v({0}), v({1})}};
+  for (const auto& row : rows) {
+    EvaluationOptions q {t2(2, LOSSY)};
+    q.design_demand = row.design;
+    q.offer = row.offered;
+    const std::string where = "design " + (row.design ? (*row.design ? std::to_string(**row.design) : "inf") : "absent") +
+                              ", offered " +
+                              (row.offered ? (*row.offered ? std::to_string(**row.offered) : "inf") : "absent");
+    SCOPED_TRACE(where);
+    if (!row.delivered) {
+      EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), q); }), row.text);
+      EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, pairs, q, {}, 2); }), row.text);
+      EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(*g, v({0}), v({1}), q, 2); }), row.text);
+      continue;
+    }
+    EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), q).call_delivered, *row.delivered);
+    const auto rs = evaluate_pairs(*g, pairs, q, {}, 2);
+    ASSERT_EQ(rs.size(), 2U);
+    EXPECT_EQ(rs[0].call_delivered, *row.delivered);
+    EXPECT_EQ(rs[1].call_delivered, *row.delivered);
+    EXPECT_EQ(evaluate_edge_failures(*g, v({0}), v({1}), q, 2).baseline.call_delivered, *row.delivered);
+  }
+}
+
+// Deleting dead head 0's zero link removes it from the roster (loss -10);
+// every allowed link is a candidate.
+TEST(TunnelEvaluators, T2Sensitivity) {
+  EvaluationOptions q {t2(2)};
+  q.design_demand = Amount {10};
+  for (const std::int32_t workers : {1, 2}) {
+    const auto s = evaluate_edge_failures(*twoh(0, 10), v({0, 1}), v({2}), q, workers);
+    EXPECT_EQ(s.baseline.call_delivered, 0);
+    std::vector<std::pair<EdgeId, Amount>> got;
+    for (const auto& e : s.entries) got.emplace_back(e.edge, e.delivery_reduction);
+    EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, -10}, {1, 0}}));
+  }
+  const auto g = ordered(3, {{0, 1, 10, 1}, {2, 1, 5, 1}});
+  const auto s = evaluate_edge_failures(*g, v({0}), v({1}), EvaluationOptions {t2(2)}, 1);
+  std::vector<std::pair<EdgeId, Amount>> got;
+  for (const auto& e : s.entries) got.emplace_back(e.edge, e.delivery_reduction);
+  EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, 10}, {1, 0}}));
+}
+
+// ---------------------------------------------------------------- a supplied support
+
+// SUP: three parallel links 0 -> 1 of (capacity, cost) (6, 1), (6, 1), (100, 2); the support holds
+// the first two.
+std::shared_ptr<const Graph> sup() { return ordered(2, {{0, 1, 6, 1}, {0, 1, 6, 1}, {0, 1, 100, 2}}); }
+FlowPolicyConfig t2_on(const Graph& g, std::vector<EdgeId> support, Admission a = LOSSLESS, bool headroom = false) {
+  return {.routing = centralized(SourceAllocation::Equal, dag_of(g, support), TunnelCount {2}, headroom), .admission = a};
+}
+
+// T2-support, -masked, -mask-outside: unlimited design, headroom off.
+TEST(T2Support, Examples) {
+  const auto g = sup();
+  {
+    auto p = make(g, {0}, {1}, t2_on(*g, {0, 1}));
+    const auto r = p->replace(INF);
+    EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 6);
+    EXPECT_EQ(counts(*p->program(), 3), (Amounts {1, 1, 0}));
+    EXPECT_EQ(r.plan->max_lossless_offer, 12);
+    EXPECT_EQ(r.call_delivered, 12);
+  }
+  {
+    const auto mask = g->eligibility({}, std::vector<EdgeId> {1});
+    auto p = make(g, {0}, {1}, t2_on(*g, {0, 1}), &mask);
+    const auto r = p->replace(INF);
+    EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 3);
+    EXPECT_EQ(counts(*p->program(), 3), (Amounts {2, 0, 0}));
+    EXPECT_EQ(routes(*p->program()), (std::vector<Edges> {{0}, {0}}));
+    EXPECT_EQ(indices(*p->program()), (std::vector<std::int32_t> {0, 1}));
+    EXPECT_EQ(r.plan->max_lossless_offer, 6);
+  }
+  {
+    const auto mask = g->eligibility({}, std::vector<EdgeId> {2});
+    auto p = make(g, {0}, {1}, t2_on(*g, {0, 1}), &mask);
+    const auto r = p->replace(INF);
+    EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 6);
+    EXPECT_EQ(routes(*p->program()), (std::vector<Edges> {{0}, {1}}));
+    EXPECT_EQ(r.plan->max_lossless_offer, 12);
+  }
+}
+
+// T2 on the support {e0, e1} equals T2 with a mask excluding e2: plans, tunnels, rows, deliveries,
+// drops and flags, Lossless and Lossy at offers 6, 12 and 13.
+TEST(T2Support, EqualsMask) {
+  const auto g = sup();
+  const auto outside = g->eligibility({}, std::vector<EdgeId> {2});
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    for (const Amount offer : {6, 12, 13}) {
+      auto on = make(g, {0}, {1}, t2_on(*g, {0, 1}, a));
+      auto masked = make(g, {0}, {1}, t2(2, a), &outside);
+      const auto x = on->replace(offer);
+      const auto y = masked->replace(offer);
+      const std::string where = std::to_string(static_cast<int>(a)) + "/" + std::to_string(offer);
+      EXPECT_EQ(*x.plan, *y.plan) << where;
+      const auto tx = on->program()->tunnels();
+      const auto ty = masked->program()->tunnels();
+      EXPECT_TRUE(std::ranges::equal(tx, ty)) << where;
+      EXPECT_EQ(x.by_tunnel, y.by_tunnel) << where;
+      EXPECT_EQ(source_rows(x), source_rows(y)) << where;
+      EXPECT_EQ(x.call_delivered, y.call_delivered) << where;
+      EXPECT_EQ(x.call_edge_drops, y.call_edge_drops) << where;
+      EXPECT_EQ(x.termination, y.termination) << where;
+      EXPECT_EQ(std::tuple(x.routes_changed, x.weights_changed, x.reservations_changed),
+                std::tuple(y.routes_changed, y.weights_changed, y.reservations_changed))
+          << where;
+    }
+  }
+}
+
+// ---------------------------------------------------------------- numeric ranges (W)
+
+// ONEMAX, N = 1, prefer_headroom, unlimited: U = u = 2^62 - 1, Phi = 2^32.
+TEST(TunnelRanges, T2OneMax) {
+  const Amount max = kL62 - 1;
+  auto p = make(ordered(2, {{0, 1, max, 1}}), {0}, {1}, t2(1, LOSSLESS, true));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, max);
+  EXPECT_EQ(r.plan->total_planned_bandwidth, max);
+  EXPECT_EQ(lo(r.plan->headroom_penalty), Amount {1} << 32);
+  EXPECT_EQ(r.plan->max_lossless_offer, max);
+  EXPECT_EQ(r.call_delivered, max);
+  EXPECT_EQ(r.plan->max_fractional_bandwidth_per_tunnel, (std::pair<Amount, Amount> {max, 1}));
+}
+
+// FAN4MAX, N = 16, unlimited: U = 2^56 - 1, planned total 2^62 - 64, F = 2^62 - 4.
+TEST(TunnelRanges, T2ManyTunnels) {
+  const Amount c = (Amount {1} << 60) - 1;
+  auto p = make(ordered(5, {{0, 4, c, 1}, {1, 4, c, 1}, {2, 4, c, 1}, {3, 4, c, 1}}), {0, 1, 2, 3}, {4}, t2(16));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, (Amount {1} << 56) - 1);
+  EXPECT_EQ(r.plan->total_planned_bandwidth, kL62 - 64);
+  EXPECT_EQ(r.plan->max_lossless_offer, kL62 - 4);
+  EXPECT_EQ(r.plan->max_fractional_bandwidth_per_tunnel, (std::pair<Amount, Amount> {c, 16}));
+}
+
+// DEAD100: the live budgets F'(1) = F'(2) = 101 2^61 + 100 above 2^63, equal scores
+// 2^61: count 1; F = 0; EXACT(1) Lossy replace(101) delivers 1 and loses 100 at the dead heads.
+TEST(TunnelRanges, T2DeadBudget) {
+  std::vector<InEdge> rows;
+  for (std::int32_t h = 0; h < 100; ++h) rows.push_back({h, 101, 0, 1});
+  rows.push_back({100, 101, Amount {1} << 61, 1});
+  const auto g = ordered(102, rows);
+  std::vector<NodeId> heads(101);
+  for (std::int32_t h = 0; h < 101; ++h) heads[static_cast<std::size_t>(h)] = h;
+  auto p = make(g, heads, {101}, t2(2, LOSSLESS, false, true));
+  const auto r = p->replace(INF);
+  EXPECT_EQ(r.plan->tunnels_per_head, 1);
+  EXPECT_EQ(r.plan->max_lossless_offer, 0);
+  EXPECT_EQ(r.plan->heads_with_capacity, (std::vector<NodeId> {100}));
+  auto q = make(g, heads, {101}, t2(1, LOSSY));
+  const auto s = q->replace(Amount {101});
+  EXPECT_EQ(s.call_delivered, 1);
+  EXPECT_EQ(s.call_source_drops, 100);
+}
+
+// COSTMAX (one link of 10000 at cost 2^62 - 1), N = 10000, prefer_headroom, D = 10000:
+// U = u = 1, J = 10000 (2^62 - 1), Phi = sum over j of floor(2^32 j / 10000).
+TEST(TunnelRanges, T2CostMax) {
+  auto p = make(ordered(2, {{0, 1, 10000, kL62 - 1}}), {0}, {1}, t2(10000, LOSSLESS, true));
+  const auto r = p->replace(INF, Amount {10000});
+  EXPECT_EQ(r.plan->max_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.plan->planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(wide(*r.plan->total_tunnel_cost), Int128(10000) * Int128(kL62 - 1));
+  EXPECT_EQ(lo(r.plan->headroom_penalty), 21476983958656);
+}
+
+// ---------------------------------------------------------------- zero offers and masks (E)
+
+// All dead: zero offers COMPLETE; a positive offer Lossy COMPLETE, Lossless EXHAUSTED.
+TEST(TunnelZero, T2AllDead) {
+  for (const auto a : {LOSSY, LOSSLESS}) {
+    auto p = make(twoh(0, 0), {0, 1}, {2}, t2(2, a));
+    EXPECT_EQ(p->replace(Amount {0}, Amount {10}).termination, Termination::Complete);
+    EXPECT_EQ(p->evaluate(Amount {0}, Amount {10}).termination, Termination::Complete);
+    EXPECT_EQ(p->forward(Amount {0}).termination, Termination::Complete);
+    const auto r = p->replace(Amount {10}, Amount {10});
+    EXPECT_EQ(r.termination, a == LOSSY ? Termination::Complete : Termination::Exhausted);
+    EXPECT_TRUE(r.program->tunnels().empty());
+    EXPECT_EQ(vec(r.program->sources()), v({0, 1}));
+    EXPECT_TRUE(p->records().empty());
+  }
+}
+
+// U = 0: replace(0) and forward(0) COMPLETE, forward(10) loses 5 at each head.
+TEST(TunnelZero, T2NoTunnels) {
+  auto p = make(twoh(1, 100), {0, 1}, {2}, t2(16, LOSSY));
+  EXPECT_EQ(p->replace(Amount {0}).termination, Termination::Complete);
+  EXPECT_EQ(p->forward(Amount {0}).termination, Termination::Complete);
+  const auto f = p->forward(Amount {10});
+  EXPECT_EQ(source_rows(f), (std::vector<SourceRow> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 0, 5, 0}}));
+}
+
+// ONE10, N = 2: zero calls COMPLETE; two tunnels planned 1; two zero records; evaluate
+// publishes nothing.
+TEST(TunnelZero, T2) {
+  for (const auto a : {LOSSY, LOSSLESS}) {
+    auto p = make(one10(), {0}, {1}, t2(2, a));
+    const auto r = p->replace(Amount {0});
+    EXPECT_EQ(r.termination, Termination::Complete);
+    ASSERT_EQ(r.program->tunnels().size(), 2U);
+    std::vector<FlowId> before;
+    for (const auto& rec : p->records()) {
+      EXPECT_EQ(rec.delivered, 0);
+      before.push_back(rec.flow_id);
+    }
+    ASSERT_EQ(before.size(), 2U);
+    EXPECT_EQ(p->evaluate(Amount {0}).termination, Termination::Complete);
+    std::vector<FlowId> after;
+    for (const auto& rec : p->records()) after.push_back(rec.flow_id);
+    EXPECT_EQ(after, before);
+    EXPECT_EQ(p->forward(Amount {0}).termination, Termination::Complete);
+    EXPECT_EQ(p->records().size(), 2U);
+  }
+}
+
+// The G1 call's program with e0 and e1 masked: no head reaches 3: NO_ROUTE, then COMPLETE;
+// sixteen zero records.
+TEST(TunnelZero, PinnedT2NoRoster) {
+  const auto g = g1();
+  auto p = make(g, {0}, {3}, t2(16, LOSSY, true));
+  const auto base = p->replace(Amount {49152}).program;
+  const auto mask = g->eligibility({}, std::vector<EdgeId> {0, 1});
+  auto pin = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {base, nullptr}, .admission = LOSSY}, &mask);
+  const auto r = pin->replace(Amount {49152});
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  EXPECT_EQ(pin->records().size(), 16U);
+  EXPECT_EQ(row_statuses(r), std::vector<TunnelStatus>(16, FAILED));
+  EXPECT_EQ(pin->replace(Amount {0}).termination, Termination::Complete);
+}
+
+// A zero offered; an Eligibility that excludes every edge.
+TEST(TunnelZero, T2Evaluators) {
+  const auto g = g1();
+  EvaluationOptions zero {t2(16, LOSSY, true)};
+  zero.offer = Amount {0};
+  const auto r = evaluate_demand(*g, v({0}), v({3}), zero);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(r.call_delivered, 0);
+  for (const auto& e : evaluate_edge_failures(*g, v({0}), v({3}), zero, 1).entries) EXPECT_EQ(e.delivery_reduction, 0);
+  const auto t = twoh(10, 10);
+  const auto none = t->eligibility({}, std::vector<EdgeId> {0, 1});
+  const auto c = evaluate_demand(*t, v({0, 1}), v({2}), EvaluationOptions {t2(2), &none});
+  EXPECT_EQ(c.termination, Termination::NoRoute);
+  EXPECT_EQ(c.call_delivered, 0);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0, 1}), v({2})}, {v({0}), v({2})}};
+  for (const auto& x : evaluate_pairs(*t, pairs, EvaluationOptions {t2(2), &none}, {}, 1)) EXPECT_EQ(x.termination, Termination::NoRoute);
+}
+
+// ---------------------------------------------------------------- the property test
+
+// Random small graphs (nonuniform costs, masks, zero-capacity links, preloaded residuals, one or two
+// heads): U, s* and the minimum (J, Phi) against the brute force; the program's objectives, k
+// tunnels per live head in round order with dead holes; F against the independent lossless bound;
+// the remainder bound 0 <= F - K U < K; "up to" against an unpruned selection over the EXACT(k) programs at U(k).
+TEST(T2Property, AgainstTheReference) {
+  std::mt19937 rng(20261019);
+  int checked = 0;
+  int optimal = 0;
+  int selections = 0;
+  for (int trial = 0; trial < 250; ++trial) {
+    SCOPED_TRACE(trial);
+    const int n = 3 + static_cast<int>(rng() % 3);
+    std::vector<InEdge> rows;
+    const Amount capacities[] = {0, 1, 2, 3, 4, 6, 8};
+    for (int i = 0; i + 1 < n; ++i) rows.push_back({i, i + 1, capacities[rng() % 7], 1 + static_cast<Cost>(rng() % 4)});
+    for (int x = 0, extra = 1 + static_cast<int>(rng() % 4); x < extra; ++x) {
+      const int a = static_cast<int>(rng() % static_cast<unsigned>(n - 1));
+      const int b = 1 + static_cast<int>(rng() % static_cast<unsigned>(n - 1));
+      if (a != b) rows.push_back({a, b, capacities[rng() % 7], 1 + static_cast<Cost>(rng() % 4)});
+    }
+    const auto g = shared(make_graph(n, rows));
+    std::vector<NodeId> heads {0};
+    if (n > 3 && rng() % 2 == 0) heads.push_back(1);
+    const std::vector<NodeId> dests {n - 1};
+    std::optional<Eligibility> mask;
+    if (rng() % 4 == 0) mask = g->eligibility({}, std::vector<EdgeId> {static_cast<EdgeId>(rng() % rows.size())});
+    const Eligibility* elig = mask.has_value() ? &*mask : nullptr;
+    Amounts V(static_cast<std::size_t>(g->num_edges()));
+    for (std::size_t e = 0; e < V.size(); ++e) {
+      const Amount c = g->edge_capacity_units()[e];
+      V[e] = rng() % 3 == 0 ? static_cast<Amount>(rng() % static_cast<unsigned>(c + 1)) : c;
+    }
+    const bool hr = rng() % 2 == 0;
+    const std::int64_t N = 1 + static_cast<std::int64_t>(rng() % 3);
+    const std::optional<Amount> D = rng() % 3 == 0 ? std::nullopt : std::optional<Amount>(static_cast<Amount>(rng() % 15));
+    const auto design = D.has_value() ? std::optional<std::optional<Amount>>(D) : UNLIMITED;
+    auto p = make(g, heads, dests, t2(N, LOSSLESS, hr), elig, std::make_shared<FlowLedger>(g, V));
+    const auto r = p->replace(INF, design);
+    const auto& pl = *r.plan;
+    const auto& roster = detail::PolicyAccess::engine(*p.p).reachable_sources;
+    const auto H = static_cast<std::int64_t>(roster.size());
+    if (H == 0) continue;
+    const auto u_of = [&](Amount U) {
+      if (!D.has_value()) return U;
+      Amount need = 1;
+      for (NodeId h : pl.heads_with_capacity.value_or(std::vector<NodeId> {})) {
+        const auto i = std::find(roster.begin(), roster.end(), h) - roster.begin();
+        const Amount share = t1_reference::rr(*D, H, i);
+        need = std::max(need, (share + N - 1) / N);
+      }
+      return std::min(U, need);
+    };
+    const auto want = t2_reference::solve(*g, elig, roster, dests, N, V, u_of, hr);
+    EXPECT_EQ(pl.heads_with_capacity, want.live);
+    EXPECT_EQ(pl.max_bandwidth_per_tunnel, want.U);
+    if (!want.live.empty()) EXPECT_EQ(pl.max_fractional_bandwidth_per_tunnel, want.fluid);
+    ++checked;
+    if (want.U == 0) {
+      EXPECT_TRUE(r.program->tunnels().empty());
+      continue;
+    }
+    ASSERT_TRUE(want.best.has_value());
+    // The objectives of the program's own counts are the plan's and the brute-force minimum.
+    Int128 J = 0;
+    Int128 phi = 0;
+    Amounts x(V.size(), 0);
+    for (const auto& t : r.program->tunnels()) {
+      for (EdgeId e : *t.edges) ++x[static_cast<std::size_t>(e)];
+    }
+    for (std::size_t e = 0; e < x.size(); ++e) {
+      J = J + Int128(g->edge_costs()[e]) * x[e];
+      for (Amount j = 1; hr && g->edge_capacity_units()[e] > 0 && j <= x[e]; ++j) {
+        phi = phi + t2_reference::slot_price(g->edge_capacity_units()[e], V[e], j, *pl.planned_bandwidth_per_tunnel);
+      }
+      EXPECT_LE(x[e] * *pl.planned_bandwidth_per_tunnel, V[e]);
+    }
+    EXPECT_EQ(J, wide(*pl.total_tunnel_cost));
+    EXPECT_EQ((std::pair {J, phi}), *want.best);
+    if (hr) EXPECT_EQ(phi, wide(*pl.headroom_penalty));
+    ++optimal;
+    // k tunnels per live head, round order j * H + i with holes.
+    std::vector<std::int32_t> want_index;
+    for (std::int64_t j = 0; j < N; ++j) {
+      for (std::int64_t i = 0; i < H; ++i) {
+        if (std::count(want.live.begin(), want.live.end(), roster[static_cast<std::size_t>(i)]) != 0) {
+          want_index.push_back(static_cast<std::int32_t>(j * H + i));
+        }
+      }
+    }
+    EXPECT_EQ(indices(*r.program), want_index);
+    // F: the independent lossless bound of the program on V.
+    std::vector<t1_reference::RefTunnel> ref;
+    for (const auto& t : r.program->tunnels()) {
+      t1_reference::RefTunnel rt;
+      rt.head = t.head;
+      rt.slot = static_cast<std::size_t>(std::find(roster.begin(), roster.end(), t.head) - roster.begin());
+      rt.path = *t.edges;
+      ref.push_back(rt);
+    }
+    EXPECT_EQ(pl.max_lossless_offer, t1_reference::lossless_bound(roster.size(), ref, V));
+    const auto K = static_cast<Amount>(want.live.size()) * N;
+    if (pl.planned_bandwidth_per_tunnel == pl.max_bandwidth_per_tunnel && want.live.size() == roster.size()) {
+      EXPECT_GE(*pl.max_lossless_offer - K * want.U, 0);
+      EXPECT_LT(*pl.max_lossless_offer - K * want.U, K);
+    }
+    // Up to N: the unpruned selection over the EXACT(k) programs at U(k) (unlimited design).
+    std::vector<Int128> scores;
+    for (std::int64_t k = 1; k <= N; ++k) {
+      auto e = make(g, heads, dests, t2(k, LOSSLESS, hr), elig, std::make_shared<FlowLedger>(g, V));
+      const auto rk = e->replace(INF);
+      if (*rk.plan->max_bandwidth_per_tunnel == 0) {
+        scores.push_back(0);
+        continue;
+      }
+      const std::int64_t M = H * k;
+      auto fits = [&](Int128 z) {
+        Amounts load(V.size(), 0);
+        for (const auto& t : rk.program->tunnels()) {
+          const Int128 amount = z / M + (Int128(t.entry_id) < z % M ? 1 : 0);
+          for (EdgeId x2 : *t.edges) load[static_cast<std::size_t>(x2)] += static_cast<Amount>(amount);
+        }
+        for (std::size_t x2 = 0; x2 < V.size(); ++x2) {
+          if (load[x2] > V[x2]) return false;
+        }
+        return true;
+      };
+      Int128 z = 0;
+      while (fits(z + 1)) z = z + 1;
+      const Int128 capped = D.has_value() && Int128(*D) < z ? Int128(*D) : z;
+      Int128 g_part = 0;
+      for (std::int64_t i = 0; i < H; ++i) {
+        if (std::count(want.live.begin(), want.live.end(), roster[static_cast<std::size_t>(i)]) == 0) continue;
+        g_part = g_part + capped / H + (Int128(i) < capped % H ? 1 : 0);
+      }
+      scores.push_back(g_part);
+    }
+    Int128 target = -1;
+    if (D.has_value()) {
+      target = 0;
+      for (std::int64_t i = 0; i < H; ++i) {
+        if (std::count(want.live.begin(), want.live.end(), roster[static_cast<std::size_t>(i)]) != 0) {
+          target = target + t1_reference::rr(*D, H, i);
+        }
+      }
+    }
+    std::int64_t chosen = 0;
+    for (std::int64_t k = 1; k <= N && chosen == 0; ++k) {
+      if (scores[static_cast<std::size_t>(k - 1)] == target) chosen = k;
+    }
+    if (chosen == 0) {
+      chosen = 1;
+      for (std::int64_t k = 2; k <= N; ++k) {
+        if (scores[static_cast<std::size_t>(k - 1)] > scores[static_cast<std::size_t>(chosen - 1)]) chosen = k;
+      }
+    }
+    auto up = make(g, heads, dests, t2(N, LOSSLESS, hr, true), elig, std::make_shared<FlowLedger>(g, V));
+    EXPECT_EQ(up->replace(INF, design).plan->tunnels_per_head, chosen);
+    ++selections;
+  }
+  EXPECT_GT(checked, 200);
+  EXPECT_GT(optimal, 100);
+  EXPECT_GT(selections, 100);
+}
+
+} // namespace
diff --git a/tests/cpp/concurrency_tests.cpp b/tests/cpp/concurrency_tests.cpp
new file mode 100644
index 0000000..4e10b6e
--- /dev/null
+++ b/tests/cpp/concurrency_tests.cpp
@@ -0,0 +1,730 @@
+// Native synchronization, with explicit rendezvous rather than scheduling delays.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <exception>
+#include <future>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <thread>
+#include <type_traits>
+#include <vector>
+
+#include "netgraph/core/detail/cache_access.hpp"
+#include "netgraph/core/detail/concurrency.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_policy.hpp"
+
+namespace netgraph::core::test {
+namespace {
+
+using detail::CacheGate;
+using detail::ConcurrentStage;
+using detail::LedgerAccess;
+using namespace std::chrono_literals;
+
+std::shared_ptr<const Graph> one_link() {
+  return std::make_shared<const Graph>(2, std::vector<NodeId> {0}, std::vector<NodeId> {1},
+                                       std::vector<Amount> {10}, std::vector<Cost> {3}, 1.0);
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+struct Rendezvous {
+  std::mutex mutex;
+  std::condition_variable changed;
+  std::vector<ConcurrentStage> stages;
+  std::optional<ConcurrentStage> fail;
+  std::optional<ConcurrentStage> pause;
+  bool released {false};
+  // Reserve before the hook is armed: probe bookkeeping must not allocate while locked.
+  Rendezvous() { stages.reserve(32); }
+  static void notify(void* context, ConcurrentStage stage, const void*) {
+    auto& self = *static_cast<Rendezvous*>(context);
+    {
+      std::unique_lock lock(self.mutex);
+      self.stages.push_back(stage);
+      self.changed.notify_all();
+      if (self.pause == stage && !self.changed.wait_for(lock, 5s, [&] { return self.released; })) {
+        throw std::runtime_error("native rendezvous timed out");
+      }
+    }
+    if (self.fail == stage) throw std::runtime_error("injected admission failure");
+  }
+  bool wait(ConcurrentStage stage, std::chrono::milliseconds timeout = 5000ms) {
+    std::unique_lock lock(mutex);
+    return changed.wait_for(lock, timeout, [&] {
+      return std::find(stages.begin(), stages.end(), stage) != stages.end();
+    });
+  }
+  void release() {
+    const std::lock_guard lock(mutex);
+    released = true;
+    changed.notify_all();
+  }
+};
+
+struct ProbeScope {
+  detail::ConcurrentProbe probe;
+  const detail::ConcurrentProbe* previous;
+  explicit ProbeScope(Rendezvous& context)
+      : probe {Rendezvous::notify, &context}, previous(detail::current_concurrent_probe()) {
+    detail::set_concurrent_probe(&probe);
+  }
+  ~ProbeScope() { detail::set_concurrent_probe(previous); }
+};
+#endif
+
+TEST(Concurrency, LedgerReadsWaitAtTheSameGate) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  FlowLedger ledger(one_link());
+  FlowPolicy policy(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  (void)policy.replace(3);
+  const auto uid = ledger.uid();
+  const auto graph = ledger.graph();
+  const auto record = policy.records().front();
+  const auto program = policy.program();
+  const std::vector<std::pair<const char*, std::function<void()>>> readers {
+    {"ledger.uid", [&] { EXPECT_EQ(ledger.uid(), uid); }},
+    {"ledger.graph", [&] { EXPECT_EQ(ledger.graph(), graph); }},
+    {"ledger.edge_capacity_units", [&] { EXPECT_EQ(ledger.edge_capacity_units().front(), 10); }},
+    {"ledger.residual", [&] { EXPECT_EQ(ledger.residual(), (std::vector<Amount>{7})); }},
+    {"ledger.carried", [&] { EXPECT_EQ(ledger.carried(), (std::vector<Amount>{3})); }},
+    {"ledger.reserved", [&] { EXPECT_EQ(ledger.reserved(), (std::vector<Amount>{0})); }},
+    {"ledger.unreserved", [&] { EXPECT_EQ(ledger.unreserved(), (std::vector<Amount>{10})); }},
+    {"ledger.records", [&] { const auto rows = ledger.records(); ASSERT_EQ(rows.size(), 1); EXPECT_EQ(rows.front().flow_id, record.flow_id); EXPECT_EQ(rows.front().delivered, 3); }},
+    {"ledger.record", [&] { EXPECT_EQ(ledger.record(record.flow_id).delivered, 3); }},
+    {"ledger.saturated_boundary_edges", [&] { EXPECT_TRUE(ledger.saturated_boundary_edges(std::vector<NodeId>{0}).empty()); }},
+    {"policy.delivered", [&] { EXPECT_EQ(policy.delivered(), 3); }},
+    {"policy.records", [&] { const auto rows = policy.records(); ASSERT_EQ(rows.size(), 1); EXPECT_EQ(rows.front().flow_id, record.flow_id); EXPECT_EQ(rows.front().delivered, 3); }},
+    {"policy.record", [&] { EXPECT_EQ(policy.record(record.flow_id).delivered, 3); }},
+    {"policy.program", [&] { EXPECT_EQ(policy.program(), program); }},
+  };
+  for (const auto& [name, read] : readers) {
+    SCOPED_TRACE(name);
+    auto gate = LedgerAccess::lock(ledger);
+    Rendezvous rendezvous;
+    auto result = std::async(std::launch::async, [&] {
+      const ProbeScope probe(rendezvous);
+      read();
+    });
+    EXPECT_TRUE(rendezvous.wait(ConcurrentStage::LedgerWait));
+    EXPECT_FALSE(rendezvous.wait(ConcurrentStage::LedgerAcquired, 100ms));
+    EXPECT_EQ(result.wait_for(0s), std::future_status::timeout);
+    gate.unlock();
+    result.get();
+  }
+  // Immutable policy configuration is explicitly outside the gate's reader set.
+  auto gate = LedgerAccess::lock(ledger);
+  auto immutable = std::async(std::launch::async, [&] { return policy.config().admission; });
+  const auto status = immutable.wait_for(5s);
+  EXPECT_EQ(status, std::future_status::ready);
+  gate.unlock();
+  EXPECT_EQ(immutable.get(), Admission::Lossless);
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, PolicyReadinessFollowsEngineInstallation) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  FlowLedger ledger(one_link());
+  auto policy = detail::PolicyAccess::shell();
+  auto prepared = detail::PolicyAccess::prepare(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {}, nullptr, nullptr);
+  Rendezvous rendezvous;
+  rendezvous.pause = ConcurrentStage::PolicyEngineInstalled;
+  auto construction = std::async(std::launch::async, [&] {
+    const ProbeScope probe(rendezvous);
+    detail::PolicyAccess::construct(*policy, std::move(prepared), nullptr);
+  });
+  const bool paused = rendezvous.wait(ConcurrentStage::PolicyEngineInstalled);
+  EXPECT_TRUE(paused);
+  // Read only the atomic readiness bit: a wrong order fails safely even when the
+  // engine has not yet been installed. Do not dereference an initializing shell.
+  EXPECT_FALSE(detail::PolicyAccess::constructed(*policy));
+  EXPECT_EQ(construction.wait_for(0s), std::future_status::timeout);
+  rendezvous.release();
+  construction.get();
+  ASSERT_TRUE(detail::PolicyAccess::constructed(*policy));
+  EXPECT_EQ(policy->delivered(), 0);
+  EXPECT_EQ(policy->place(3).delivered, 3);
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+// Both frozen readers and building callers enroll behind the lifecycle request. The
+// queue marker proves order, independent of when each OS thread happens to run next.
+TEST(Concurrency, CacheLifecycleCannotBeOvertaken) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  for (bool frozen : {false, true}) {
+    CacheGate gate;
+    {
+      const CacheGate::Lease lease(gate, true);
+      gate.freeze(frozen);
+    }
+    std::optional<CacheGate::Lease> active;
+    active.emplace(gate);
+    Rendezvous writer_ready;
+    Rendezvous later_ready;
+    std::vector<int> order;
+    std::mutex order_mutex;
+    auto writer = std::async(std::launch::async, [&] {
+      const ProbeScope probe(writer_ready);
+      const CacheGate::Lease lease(gate, true);
+      const std::lock_guard lock(order_mutex);
+      order.push_back(1);
+    });
+    EXPECT_TRUE(writer_ready.wait(ConcurrentStage::CacheQueued));
+    auto later = std::async(std::launch::async, [&] {
+      const ProbeScope probe(later_ready);
+      const CacheGate::Lease lease(gate);
+      const std::lock_guard lock(order_mutex);
+      order.push_back(2);
+    });
+    EXPECT_TRUE(later_ready.wait(ConcurrentStage::CacheQueued));
+    EXPECT_EQ(writer.wait_for(0s), std::future_status::timeout);
+    EXPECT_EQ(later.wait_for(0s), std::future_status::timeout);
+    active.reset();
+    writer.get();
+    later.get();
+    EXPECT_EQ(order, (std::vector<int> {1, 2}));
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, FailedAdmissionLeavesNoQueuedNodeOrLease) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  for (ConcurrentStage point : {ConcurrentStage::CacheQueued, ConcurrentStage::CacheAcquired}) {
+    CacheGate gate;
+    Rendezvous failure;
+    failure.fail = point;
+    {
+      const ProbeScope probe(failure);
+      EXPECT_THROW((CacheGate::Lease(gate)), std::runtime_error);
+    }
+    ASSERT_FALSE(gate.has_waiters());
+    // Both a following lifecycle operation and lookup must terminate. CacheQueued
+    // fails while the node is enrolled; CacheAcquired fails after ownership changes.
+    {
+      const CacheGate::Lease lifecycle(gate, true);
+      gate.freeze(true);
+    }
+    const CacheGate::Lease reader(gate);
+    EXPECT_TRUE(gate.frozen());
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, ImmutableGraphAnchorSurvivesMove) {
+  auto graph = one_link();
+  std::weak_ptr<const Graph> weak = graph;
+  std::optional<FlowLedger> source;
+  source.emplace(graph);
+  const auto& anchor = source->graph();
+  graph.reset();
+  {
+    FlowLedger target(std::move(*source));
+    EXPECT_EQ(anchor.get(), target.graph().get());
+    EXPECT_THROW((void)source->graph(), std::logic_error);
+  }
+  ASSERT_FALSE(weak.expired());
+  EXPECT_EQ(anchor->num_edges(), 1);
+  source.reset();
+  EXPECT_TRUE(weak.expired());
+  // A copied ledger owns its immutable anchor after every original owner dies.
+  // Check liveness before dereferencing so a borrowing-copy plant fails safely.
+  std::optional<FlowLedger> copy;
+  {
+    auto original_graph = one_link();
+    weak = original_graph;
+    FlowLedger original(original_graph);
+    copy.emplace(original);
+  }
+  ASSERT_FALSE(weak.expired());
+  EXPECT_EQ(copy->graph()->num_edges(), 1);
+  copy.reset();
+  EXPECT_TRUE(weak.expired());
+}
+
+TEST(Concurrency, SameLedgerCallsHaveASerialHistory) {
+  FlowLedger ledger(one_link());
+  FlowPolicy a(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  FlowPolicy b(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  std::vector<std::future<Amount>> work;
+  for (int i = 0; i < 4; ++i) {
+    work.push_back(std::async(std::launch::async, [&, i] {
+      Amount delivered = 0;
+      for (int n = 0; n < 10; ++n) delivered += (i % 2 == 0 ? a : b).place(1).call_delivered;
+      return delivered;
+    }));
+  }
+  Amount delivered = 0;
+  for (auto& result : work) delivered += result.get();
+  EXPECT_EQ(delivered, 10);
+  EXPECT_EQ(a.delivered() + b.delivered(), 10);
+  EXPECT_EQ(ledger.residual(), std::vector<Amount>{0});
+}
+
+TEST(Concurrency, IndependentLedgersDoNotShareAGate) {
+  const auto graph = one_link();
+  FlowLedger a(graph), b(graph);
+  FlowPolicy policy(b, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  const auto gate = LedgerAccess::lock(a);
+  auto result = std::async(std::launch::async, [&] { return policy.place(3).call_delivered; });
+  EXPECT_EQ(result.wait_for(5s), std::future_status::ready);
+  EXPECT_EQ(result.get(), 3);
+}
+
+TEST(Concurrency, WeightedSourceCallsSerializeAndDoNotShareAGateAcrossLedgers) {
+  const auto graph=std::make_shared<const Graph>(3,std::vector<NodeId>{0,1},std::vector<NodeId>{2,2},
+      std::vector<Amount>{10,10},std::vector<Cost>{1,3},1.0);
+  CentralizedTE model(SourceAllocation::Weighted);
+  model.source_weights=std::make_shared<const std::vector<Amount>>(std::vector<Amount>{2,1,0});
+  FlowLedger a(graph),b(graph);
+  FlowPolicy p(a,std::vector<NodeId>{0,1},std::vector<NodeId>{2},FlowPolicyConfig{model});
+  FlowPolicy q(b,std::vector<NodeId>{0,1},std::vector<NodeId>{2},FlowPolicyConfig{model});
+  {
+    const auto gate=LedgerAccess::lock(a);
+    auto result=std::async(std::launch::async,[&]{return q.place(3).call_delivered;});
+    EXPECT_EQ(result.wait_for(5s),std::future_status::ready);EXPECT_EQ(result.get(),3);
+  }
+  std::vector<std::future<Amount>> tasks;
+  for(int i=0;i<4;++i)tasks.push_back(std::async(std::launch::async,[&]{Amount sum=0;for(int j=0;j<10;++j)sum+=p.place(1).call_delivered;return sum;}));
+  Amount sum=0;for(auto& t:tasks)sum+=t.get();
+  EXPECT_EQ(sum,15);EXPECT_EQ(p.delivered(),15);
+  const auto r=p.replace(15);
+  EXPECT_EQ(r.by_source[0].delivered,10);EXPECT_EQ(r.by_source[1].delivered,5);
+}
+
+TEST(Concurrency, ScalarAndListsDoNotLeaseTheConstructionCache) {
+  const auto graph = one_link();
+  ShortestPathCache cache(*graph);
+  FlowLedger ledger(graph);
+  FlowPolicy a(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {}, nullptr, &cache);
+  FlowPolicy b(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {}, nullptr, &cache);
+  const auto before = cache.stats();
+  const CacheGate::Lease lease(detail::DagCacheAccess::gate(cache), true);
+  auto result = std::async(std::launch::async, [&] {
+    const auto scalar = a.place(2);
+    const std::vector<Action> actions {Place{b, 3}};
+    return scalar.call_delivered + apply_actions(ledger, actions)[0].call_delivered;
+  });
+  EXPECT_EQ(result.wait_for(5s), std::future_status::ready);
+  EXPECT_EQ(result.get(), 5);
+  EXPECT_EQ(cache.stats().hits, before.hits);
+  EXPECT_EQ(cache.stats().misses, before.misses);
+}
+
+TEST(Concurrency, ArgumentChecksPrecedeEveryStateCheck) {
+  FlowLedger ledger(one_link());
+  FlowPolicy a(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  FlowPolicy b(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  auto text = [](auto&& body) {
+    try { body(); } catch (const std::invalid_argument& error) { return std::string(error.what()); }
+    return std::string("no exception");
+  };
+  EXPECT_EQ(text([&] { (void)a.forward(-1); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(text([&] { (void)a.forward(1); }), "forward requires an installed program");
+  const std::vector<Action> actions {Forward{a, 1}, Replace{b, -1}};
+  EXPECT_EQ(text([&] { (void)apply_actions(ledger, actions); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_TRUE(ledger.records().empty());
+  EXPECT_FALSE(a.program());
+  EXPECT_FALSE(b.program());
+  FlowLedger source(one_link());
+  FlowLedger moved(std::move(source));
+  EXPECT_EQ(text([&] { (void)apply_actions(source, {}, static_cast<BatchMode>(-1)); }),
+            "mode: -1 is not a value of BatchMode");
+}
+
+TEST(Concurrency, GateCoversExchangeAndEveryEpoch) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  FlowLedger ledger(one_link());
+  FlowPolicy a(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  FlowPolicy b(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  Rendezvous writer_stage, reader_stage;
+  writer_stage.pause = ConcurrentStage::AfterLedgerExchange;
+  auto writer = std::async(std::launch::async, [&] {
+    const ProbeScope probe(writer_stage);
+    const std::vector<Action> actions {Replace{a, 2}, Replace{b, 3}};
+    return apply_actions(ledger, actions);
+  });
+  EXPECT_TRUE(writer_stage.wait(ConcurrentStage::AfterLedgerExchange));
+  auto reader = std::async(std::launch::async, [&] {
+    const ProbeScope probe(reader_stage);
+    const auto gate = LedgerAccess::lock(ledger);
+    const auto& ae = detail::PolicyAccess::engine(a);
+    const auto& be = detail::PolicyAccess::engine(b);
+    return ae.epoch.program != nullptr && be.epoch.program != nullptr && LedgerAccess::carried(ledger)[0] == 5;
+  });
+  EXPECT_TRUE(reader_stage.wait(ConcurrentStage::LedgerWait));
+  EXPECT_EQ(reader.wait_for(0s), std::future_status::timeout);
+  writer_stage.release();
+  EXPECT_EQ(writer.get().size(), 2U);
+  EXPECT_TRUE(reader.get());
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, FailureBeforePublicationReleasesTheGate) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  FlowLedger ledger(one_link());
+  FlowPolicy policy(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {});
+  Rendezvous failure;
+  failure.fail = ConcurrentStage::BeforePublication;
+  {
+    const ProbeScope probe(failure);
+    EXPECT_THROW((void)policy.place(3), std::runtime_error);
+  }
+  EXPECT_TRUE(ledger.records().empty());
+  EXPECT_FALSE(policy.program());
+  EXPECT_EQ(policy.place(3).call_delivered, 3);
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, LowestWorkerFailureWins) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  struct Failures {
+    std::mutex mutex;
+    std::condition_variable changed;
+    bool later_failed {false};
+    static void notify(void* context, ConcurrentStage stage, const void* object) {
+      if (stage != ConcurrentStage::WorkerBegin) return;
+      auto& self = *static_cast<Failures*>(context);
+      const auto index = *static_cast<const std::size_t*>(object);
+      std::unique_lock lock(self.mutex);
+      if (index == 2) {
+        self.later_failed = true;
+        self.changed.notify_all();
+        throw std::runtime_error("task two failed first");
+      }
+      if (index == 0) {
+        if (!self.changed.wait_for(lock, 5s, [&] { return self.later_failed; })) throw std::runtime_error("worker rendezvous timed out");
+        throw std::runtime_error("task zero failed last");
+      }
+    }
+  } failures;
+  const auto graph = one_link();
+  const detail::ConcurrentProbe probe {Failures::notify, &failures};
+  const detail::ScopedConcurrentProbe installed(&probe);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(3, {{0}, {1}});
+  try {
+    (void)evaluate_pairs(*graph, pairs, {}, {}, 3);
+    FAIL() << "both failing workers were ignored";
+  } catch (const std::runtime_error& error) {
+    EXPECT_STREQ(error.what(), "task zero failed last");
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, PartialThreadLaunchJoinsAndReleasesLease) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  struct Failure {
+    std::size_t after;
+    static void notify(void* context, ConcurrentStage stage, const void* object) {
+      if (stage == ConcurrentStage::ThreadLaunch && *static_cast<const std::size_t*>(object) == static_cast<Failure*>(context)->after) {
+        throw std::runtime_error("injected thread launch failure");
+      }
+    }
+  } failure;
+  const auto graph = one_link();
+  ShortestPathCache cache(*graph);
+  (void)cache.lookup(*graph, std::vector<NodeId>{1}, Direction::Reverse, nullptr);
+  cache.freeze();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(3, {{0}, {1}});
+  EvaluationOptions options;
+  options.cache = &cache;
+  for (std::size_t after : {0U, 1U, 2U}) {
+    failure.after = after;
+    const auto before = cache.stats();
+    const detail::ConcurrentProbe probe {Failure::notify, &failure};
+    {
+      const detail::ScopedConcurrentProbe installed(&probe);
+      EXPECT_THROW((void)evaluate_pairs(*graph, pairs, options, {}, 3), std::runtime_error);
+    }
+    EXPECT_EQ(cache.stats().hits, before.hits);
+    cache.thaw();
+    cache.freeze();
+    EXPECT_EQ(evaluate_pairs(*graph, pairs, options, {}, 3).size(), 3U);
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, NativeArgumentsAreCopiedBeforeWaiting) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  // All scalar operations and both list modes have their own public copy point.
+  for (int entry = 0; entry < 6; ++entry) {
+  const auto graph = one_link();
+  FlowLedger ledger(graph);
+  FlowPolicy policy(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{1}, {.admission = Admission::Lossy});
+  (void)policy.replace(2);
+  OutputOptions outputs;
+  outputs.residual = true;
+  auto gate = LedgerAccess::lock(ledger);
+  Rendezvous waiting;
+  auto result = std::async(std::launch::async, [&] {
+    const ProbeScope probe(waiting);
+    switch (entry) {
+      case 0: return policy.place(3, outputs);
+      case 1: return policy.evaluate(3, {}, outputs);
+      case 2: return policy.replace(3, {}, outputs);
+      case 3: return policy.forward(3, nullptr, outputs);
+      default: return apply_actions(ledger, std::vector<Action>{Replace{policy, 3}},
+          entry == 4 ? BatchMode::Ordered : BatchMode::Simultaneous, outputs)[0];
+    }
+  });
+  EXPECT_TRUE(waiting.wait(ConcurrentStage::LedgerWait));
+  outputs.residual = false;  // after the call's copy, before it is admitted
+  gate.unlock();
+  const auto value = result.get();
+  EXPECT_TRUE(value.residual.has_value()) << entry;
+  if (value.residual) EXPECT_EQ(*value.residual, std::vector<Amount>{entry == 0 ? 5 : 7}) << entry;
+  EXPECT_EQ(ledger.residual(), std::vector<Amount>{entry == 1 ? 8 : (entry == 0 ? 5 : 7)}) << entry;
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, NativeEvaluatorInputsAreOwnedWhileQueued) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  for (int entry = 0; entry < 3; ++entry) {
+  const auto graph = one_link();
+  ShortestPathCache cache(*graph);
+  (void)cache.lookup(*graph, std::vector<NodeId>{1}, Direction::Reverse, nullptr);
+  std::optional<CacheGate::Lease> active;
+  active.emplace(detail::DagCacheAccess::gate(cache));
+  EvaluationOptions options;
+  options.cache = &cache;
+  options.offer = std::optional<Amount>{3};
+  std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs {{{0}, {1}}};
+  std::vector<NodeId> sources {0}, destinations {1};
+  std::vector<const Eligibility*> masks {nullptr};
+  const auto foreign = one_link();
+  const Eligibility wrong_mask = foreign->eligibility({}, {});
+  Rendezvous waiting;
+  auto result = std::async(std::launch::async, [&] {
+    const ProbeScope probe(waiting);
+    if (entry == 0) return evaluate_pairs(*graph, pairs, options, masks, 1)[0].delivered;
+    if (entry == 1) return evaluate_demand(*graph, sources, destinations, options).delivered;
+    return evaluate_edge_failures(*graph, sources, destinations, options, 1).baseline.delivered;
+  });
+  EXPECT_TRUE(waiting.wait(ConcurrentStage::CacheQueued));
+  pairs[0].second[0] = 99;
+  options.offer = std::optional<Amount>{7};
+  sources[0] = 99;
+  destinations[0] = 99;
+  masks[0] = &wrong_mask;
+  active.reset();
+  EXPECT_EQ(result.get(), 3) << entry;
+  EXPECT_GE(cache.stats().hits, 1) << entry;
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, FrozenTallyPublishesInsideTheLease) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto graph = one_link();
+  ShortestPathCache cache(*graph);
+  (void)cache.lookup(*graph, std::vector<NodeId>{1}, Direction::Reverse, nullptr);
+  cache.freeze();
+  const auto before = cache.stats().hits;
+  EvaluationOptions options;
+  options.cache = &cache;
+  options.offer = std::optional<Amount>{3};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(3, {{0}, {1}});
+  Rendezvous finishing, waiting;
+  finishing.pause = ConcurrentStage::CacheTallyComplete;
+  auto result = std::async(std::launch::async, [&] {
+    const ProbeScope probe(finishing);
+    return evaluate_pairs(*graph, pairs, options, {}, 3);
+  });
+  EXPECT_TRUE(finishing.wait(ConcurrentStage::CacheTallyComplete));
+  EXPECT_EQ(cache.stats().hits, before + 3);
+  auto lifecycle = std::async(std::launch::async, [&] {
+    const ProbeScope probe(waiting);
+    cache.thaw();
+  });
+  EXPECT_TRUE(waiting.wait(ConcurrentStage::CacheQueued));
+  EXPECT_EQ(lifecycle.wait_for(0s), std::future_status::timeout);
+  finishing.release();
+  EXPECT_EQ(result.get().size(), 3U);
+  lifecycle.get();
+  EXPECT_EQ(cache.stats().hits, before + 3);
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, NativeCacheRootsAreOwnedWhileQueued) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto graph = one_link();
+  ShortestPathCache cache(*graph);
+  const auto retained = cache.lookup(*graph, std::vector<NodeId>{1}, Direction::Reverse, nullptr);
+  std::optional<CacheGate::Lease> active;
+  active.emplace(detail::DagCacheAccess::gate(cache));
+  std::vector<NodeId> roots {1};
+  Rendezvous waiting;
+  auto result = std::async(std::launch::async, [&] {
+    const ProbeScope probe(waiting);
+    return cache.lookup(*graph, roots, Direction::Reverse, nullptr);
+  });
+  EXPECT_TRUE(waiting.wait(ConcurrentStage::CacheQueued));
+  roots[0] = 0;
+  active.reset();
+  EXPECT_EQ(result.get(), retained);
+  EXPECT_EQ(cache.stats().entries, 1);
+  EXPECT_EQ(cache.stats().hits, 1);
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+static_assert(std::is_same_v<decltype(std::declval<const FlowLedger&>().graph()),
+                             const std::shared_ptr<const Graph>&>);
+static_assert(noexcept(std::declval<const ShortestPathCache&>().stats()));
+static_assert(!noexcept(std::declval<ShortestPathCache&>().freeze()));
+static_assert(!noexcept(std::declval<ShortestPathCache&>().thaw()));
+
+TEST(Concurrency, TunnelRosterChecksRunInParallelBeforeAdmission) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  struct Overlap {
+    std::mutex mutex;
+    std::condition_variable changed;
+    std::size_t searches {0};
+    bool admitted {false};
+    static void notify(void* context, ConcurrentStage stage, const void*) {
+      auto& self = *static_cast<Overlap*>(context);
+      std::unique_lock lock(self.mutex);
+      if (stage == ConcurrentStage::LedgerWait || stage == ConcurrentStage::CacheQueued) self.admitted = true;
+      if (stage != ConcurrentStage::TunnelRosterSearch) return;
+      EXPECT_FALSE(self.admitted);
+      ++self.searches;
+      self.changed.notify_all();
+      if (self.searches == 1 && !self.changed.wait_for(lock, 2s, [&] { return self.searches >= 2; })) {
+        throw std::runtime_error("roster checks did not overlap");
+      }
+    }
+  };
+  const auto graph = one_link();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(8, {{0}, {1}});
+  CentralizedTE central(SourceAllocation::Equal);
+  central.tunnel_count = TunnelCount{1};
+  for (const Routing& routing : {Routing{DistributedTE{TunnelCount{1}}}, Routing{central}}) {
+    Overlap overlap;
+    EvaluationOptions options;
+    options.config.routing = routing;
+    options.offer = Amount{1};
+    options.design_demand = Amount{1};
+    const detail::ConcurrentProbe probe {Overlap::notify, &overlap};
+    const detail::ScopedConcurrentProbe installed(&probe);
+    const auto result = evaluate_pairs(*graph, pairs, options, {}, 2);
+    ASSERT_EQ(result.size(), 8U);
+    for (const auto& r : result) EXPECT_EQ(r.delivered, 1);
+    EXPECT_EQ(overlap.searches, pairs.size());
+    EXPECT_TRUE(overlap.admitted);
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, TunnelPreflightReportsTheLowestErrorBeforeLaterChecks) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  struct Failures {
+    std::mutex mutex;
+    std::condition_variable changed;
+    bool later {false};
+    static void notify(void* context, ConcurrentStage stage, const void* object) {
+      if (stage != ConcurrentStage::WorkerBegin) return;
+      auto& self = *static_cast<Failures*>(context);
+      const auto index = *static_cast<const std::size_t*>(object);
+      std::unique_lock lock(self.mutex);
+      if (index == 0) {
+        if (!self.changed.wait_for(lock, 2s, [&] { return self.later; })) throw std::runtime_error("no later worker");
+        throw std::runtime_error("first pair failed last");
+      }
+      self.later = true;
+      self.changed.notify_all();
+      throw std::runtime_error("second pair failed first");
+    }
+  } failures;
+  const auto graph = one_link();
+  EvaluationOptions options;
+  options.config.routing = DistributedTE{TunnelCount{1}};
+  options.offer = Amount{1};
+  options.design_demand = Amount{1};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs {{{0}, {1}}, {{0}, {1}}, {{}, {1}}};
+  const detail::ConcurrentProbe probe {Failures::notify, &failures};
+  const detail::ScopedConcurrentProbe installed(&probe);
+  try {
+    (void)evaluate_pairs(*graph, pairs, options, {}, 2);
+    FAIL() << "the first-pass errors were ignored";
+  } catch (const std::runtime_error& error) {
+    EXPECT_STREQ(error.what(), "first pair failed last");
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+TEST(Concurrency, TunnelPreflightJoinsAfterPartialLaunchFailure) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  struct Failure {
+    std::size_t after {0};
+    static void notify(void* context, ConcurrentStage stage, const void* object) {
+      if (stage == ConcurrentStage::ThreadLaunch &&
+          *static_cast<const std::size_t*>(object) == static_cast<Failure*>(context)->after) {
+        throw std::runtime_error("injected preflight launch failure");
+      }
+    }
+  } failure;
+  const auto graph = one_link();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(8, {{0}, {1}});
+  EvaluationOptions options;
+  options.config.routing = DistributedTE{TunnelCount{1}};
+  options.offer = Amount{1};
+  options.design_demand = Amount{1};
+  for (std::size_t after : {0U, 1U, 2U}) {
+    failure.after = after;
+    const detail::ConcurrentProbe probe {Failure::notify, &failure};
+    {
+      const detail::ScopedConcurrentProbe installed(&probe);
+      EXPECT_THROW((void)evaluate_pairs(*graph, pairs, options, {}, 3), std::runtime_error);
+    }
+    const auto retry = evaluate_pairs(*graph, pairs, options, {}, 3);
+    ASSERT_EQ(retry.size(), pairs.size());
+    for (const auto& result : retry) EXPECT_EQ(result.delivered, 1);
+  }
+#else
+  GTEST_SKIP() << "requires native rendezvous hooks";
+#endif
+}
+
+static_assert(std::is_nothrow_destructible_v<FlowPolicy>);
+static_assert(!noexcept(std::declval<const FlowPolicy&>().program()));
+static_assert(std::is_nothrow_move_assignable_v<detail::PolicyEpoch>);
+static_assert(std::is_nothrow_move_assignable_v<PlacementResult>);
+
+} // namespace
+} // namespace netgraph::core::test
diff --git a/tests/cpp/contract_examples_tests.cpp b/tests/cpp/contract_examples_tests.cpp
new file mode 100644
index 0000000..bd7d396
--- /dev/null
+++ b/tests/cpp/contract_examples_tests.cpp
@@ -0,0 +1,3648 @@
+// The worked examples run on the library: each example's own inputs and expected values,
+// one test per example (ContractExamples.<id> with '-' as '_'). The examples state edges as
+// (source, destination, capacity, cost) in input order and amounts in units; every per-edge value
+// below is in that order (translated through the graph's input positions). An example whose input
+// is a Python value (a float factor, a NumPy scalar, a wrong type) is checked here through the C++
+// value it stands for; the conversion itself is the Python suite's.
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cmath>
+#include <iomanip>
+#include <limits>
+#include <random>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <memory>
+#include <optional>
+#include <set>
+#include <string>
+#include <tuple>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/concurrency_models.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+using Amounts = std::vector<Amount>;
+using Ints = std::vector<std::int64_t>;
+using Routes = std::vector<Ints>;
+using Texts = std::vector<std::string>;
+using DesignArg = std::optional<std::optional<Amount>>;
+
+constexpr Admission LL = Admission::Lossless;
+constexpr Admission LY = Admission::Lossy;
+constexpr Amount kBig = Amount {1} << 40;  // a link that never limits anything
+
+DesignArg design_of(Amount x) { return DesignArg {std::in_place, x}; }
+const DesignArg kUnlimited {std::in_place, std::nullopt};
+
+Amount lo(const Counter128& c) {
+  EXPECT_EQ(c.hi, 0U);
+  return static_cast<Amount>(c.lo);
+}
+Amount lo(const std::optional<Counter128>& c) { return c.has_value() ? lo(*c) : -1; }
+
+std::string name_of(TunnelStatus s) {
+  switch (s) {
+    case TunnelStatus::Up: return "UP";
+    case TunnelStatus::InsufficientBandwidth: return "INSUFFICIENT_BANDWIDTH";
+    case TunnelStatus::CostCeilingExceeded: return "COST_CEILING_EXCEEDED";
+    case TunnelStatus::Failed: return "FAILED";
+    case TunnelStatus::Blackholed: return "BLACKHOLED";
+  }
+  return "?";
+}
+std::string name_of(Termination t) {
+  switch (t) {
+    case Termination::Complete: return "COMPLETE";
+    case Termination::NoRoute: return "NO_ROUTE";
+    case Termination::Exhausted: return "EXHAUSTED";
+    case Termination::NoActiveWeight: return "NO_ACTIVE_WEIGHT";
+  }
+  return "?";
+}
+
+// A graph of the example's edges (input order) with its input <-> EdgeId maps.
+struct Net {
+  std::shared_ptr<const Graph> g;
+  std::vector<EdgeId> id;  // input position -> EdgeId
+
+  explicit Net(const std::vector<InEdge>& edges, std::int32_t n = 0) {
+    for (const auto& e : edges) n = std::max({n, e.u + 1, e.v + 1});
+    g = shared(make_graph(n, edges));
+    id = id_of_input(*g);
+  }
+  [[nodiscard]] std::int64_t pos(EdgeId e) const { return g->input_positions()[static_cast<std::size_t>(e)]; }
+  [[nodiscard]] std::size_t m() const { return id.size(); }
+  [[nodiscard]] Ints positions(const std::vector<EdgeId>& edges) const {
+    Ints out;
+    for (EdgeId e : edges) out.push_back(pos(e));
+    return out;
+  }
+  [[nodiscard]] std::vector<EdgeId> ids(const Ints& positions) const {
+    std::vector<EdgeId> out;
+    for (auto p : positions) out.push_back(id[static_cast<std::size_t>(p)]);
+    return out;
+  }
+  // A per-EdgeId array in input order.
+  [[nodiscard]] Amounts in_order(const std::vector<Amount>& by_id) const { return to_input(*g, by_id); }
+  // An (EdgeId, amount) list as a per-edge array in input order.
+  [[nodiscard]] Amounts per_edge(const std::vector<std::pair<EdgeId, Amount>>& pairs) const {
+    Amounts out(m(), 0);
+    for (const auto& [e, x] : pairs) out[static_cast<std::size_t>(pos(e))] += x;
+    return out;
+  }
+  [[nodiscard]] Amounts per_edge(const std::vector<std::pair<EdgeId, Counter128>>& pairs) const {
+    Amounts out(m(), 0);
+    for (const auto& [e, x] : pairs) out[static_cast<std::size_t>(pos(e))] += lo(x);
+    return out;
+  }
+  // A per-input array in EdgeId order.
+  [[nodiscard]] Amounts by_id(const Amounts& by_input) const { return to_ids(*g, by_input); }
+  [[nodiscard]] std::shared_ptr<const Eligibility> mask(const std::vector<NodeId>& nodes, const Ints& edges) const {
+    if (nodes.empty() && edges.empty()) return nullptr;
+    return std::make_shared<const Eligibility>(g->eligibility(nodes, ids(edges)));
+  }
+  [[nodiscard]] std::shared_ptr<const PredecessorDAG> dag(const Ints& edges) const { return dag_of(*g, ids(edges)); }
+  [[nodiscard]] std::shared_ptr<const Path> path(const Ints& edges) const {
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : ids(edges)) hops.push_back({e});
+    return std::make_shared<const Path>(*g, hops);
+  }
+};
+
+struct Pol {
+  std::shared_ptr<FlowLedger> ledger;
+  std::shared_ptr<const Eligibility> mask;
+  std::unique_ptr<FlowPolicy> p;
+  FlowPolicy* operator->() const { return p.get(); }
+};
+Pol policy(const Net& n, const std::vector<NodeId>& s, const std::vector<NodeId>& d, FlowPolicyConfig cfg,
+           std::shared_ptr<const Eligibility> mask = nullptr, std::shared_ptr<FlowLedger> ledger = nullptr) {
+  Pol out {ledger ? std::move(ledger) : std::make_shared<FlowLedger>(n.g), std::move(mask), nullptr};
+  out.p = std::make_unique<FlowPolicy>(*out.ledger, s, d, std::move(cfg), out.mask.get());
+  return out;
+}
+
+const OutputOptions kFlows {.edge_flows = true};
+
+// ---------------------------------------------------------------- shared integer rules
+
+Amounts ha(Amount n, const Amounts& w) {
+  Amounts out(w.size(), 0);
+  detail::highest_averages(n, w, out);
+  return out;
+}
+
+// A reduced fraction num / den (den > 0) and its comparison by cross products.
+struct Frac {
+  std::int64_t num;
+  std::int64_t den;
+};
+Frac reduce(std::int64_t num, std::int64_t den) {
+  const auto g = std::gcd(num < 0 ? -num : num, den);
+  return {num / g, den / g};
+}
+bool less(const Frac& a, const Frac& b) { return static_cast<Int128>(a.num) * b.den < static_cast<Int128>(b.num) * a.den; }
+std::string text(const Frac& f) { return std::to_string(f.num) + "/" + std::to_string(f.den); }
+
+// Each split's largest excess and deficit against its exact share n w / W.
+struct SplitError {
+  Amounts assigned;
+  Frac max_excess;
+  Frac max_deficit;
+  bool below_k;
+  bool below_one;
+};
+SplitError split_error(Amount n, const Amounts& w) {
+  const Amounts got = ha(n, w);
+  Amount total = 0;
+  for (Amount x : w) total += x;
+  SplitError out {got, {-1, 1}, {-1, 1}, true, true};
+  bool first = true;
+  const auto k = static_cast<std::int64_t>(w.size());
+  for (std::size_t i = 0; i < w.size(); ++i) {
+    const Frac excess = reduce(got[i] * total - n * w[i], total);
+    const Frac deficit = reduce(n * w[i] - got[i] * total, total);
+    if (first || less(out.max_excess, excess)) out.max_excess = excess;
+    if (first || less(out.max_deficit, deficit)) out.max_deficit = deficit;
+    first = false;
+    const std::int64_t gap = excess.num < 0 ? -excess.num : excess.num;
+    out.below_k = out.below_k && gap < k * excess.den;
+    out.below_one = out.below_one && gap < excess.den;
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- searches
+
+struct SearchOut {
+  std::optional<Cost> distance;
+  Ints dag;
+  std::vector<std::pair<Cost, Ints>> paths;
+  std::string error;
+};
+SearchOut search(const std::vector<InEdge>& edges, NodeId source, NodeId destination, std::optional<Amounts> residual = std::nullopt,
+                 std::optional<std::int64_t> k = std::nullopt, std::optional<CostStretch> stretch = std::nullopt) {
+  const Net n(edges);
+  SearchOut out;
+  Amounts res;
+  if (residual.has_value()) res = residual->size() == n.m() ? n.by_id(*residual) : *residual;
+  if (k.has_value()) {
+    KspOptions o(*k);
+    if (stretch.has_value()) o.cost_ceiling = *stretch;
+    if (residual.has_value()) o.residual = std::span<const Amount>(res);
+    out.error = error_of([&] {
+      for (const auto& [cost, p] : ksp(*n.g, source, destination, o)) {
+        std::vector<EdgeId> es;
+        for (const auto& hop : p.hops()) es.push_back(hop.front());
+        out.paths.emplace_back(cost, n.positions(es));
+      }
+    });
+    return out;
+  }
+  SpfOptions o(Direction::Forward);
+  o.targets = std::vector<NodeId> {destination};
+  if (residual.has_value()) o.residual = std::span<const Amount>(res);
+  const NodeId roots[1] = {source};
+  const auto r = spf(*n.g, roots, o);
+  out.distance = r.target_cost;
+  out.dag = n.positions(ascending_edges(r.dag));
+  std::sort(out.dag.begin(), out.dag.end());
+  return out;
+}
+
+// The single path spf chooses under a tie rule (multipath false), on `available` as the residual.
+Ints tie_choice(const std::vector<InEdge>& edges, NodeId source, NodeId destination, RouteTieBreak tie,
+                std::optional<Amounts> available = std::nullopt) {
+  const Net n(edges);
+  SpfOptions o(Direction::Forward);
+  o.targets = std::vector<NodeId> {destination};
+  o.tie_break = tie;
+  o.multipath = false;
+  Amounts res;
+  if (available.has_value()) {
+    res = n.by_id(*available);
+    o.residual = std::span<const Amount>(res);
+  }
+  const NodeId roots[1] = {source};
+  const auto r = spf(*n.g, roots, o);
+  const auto via = ascending_edges(r.dag);
+  // One path: order its edges from the source.
+  Ints out;
+  NodeId at = source;
+  while (at != destination) {
+    const auto it = std::find_if(via.begin(), via.end(), [&](EdgeId e) { return n.g->edge_sources()[static_cast<std::size_t>(e)] == at; });
+    if (it == via.end()) break;
+    out.push_back(n.pos(*it));
+    at = n.g->edge_destinations()[static_cast<std::size_t>(*it)];
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- exact flows (CentralizedTE)
+
+struct FlowOut {
+  Amount delivered;
+  Amount cost;
+  Amounts edge_flows;
+  std::optional<Ints> min_cut;
+};
+FlowOut exact_flow(const std::vector<InEdge>& edges, const std::vector<NodeId>& heads, const std::vector<NodeId>& dests,
+                   std::optional<Amount> limit, SourceAllocation s) {
+  const Net n(edges);
+  auto p = policy(n, heads, dests, {.routing = centralized(s)});
+  const auto r = p->place(limit, OutputOptions {.edge_flows = true, .min_cut = true});
+  FlowOut out {r.call_delivered, lo(r.total_cost), n.in_order(*r.edge_flows), std::nullopt};
+  if (r.min_cut.has_value()) {
+    out.min_cut = n.positions(*r.min_cut);
+    std::sort(out.min_cut->begin(), out.min_cut->end());
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- T1
+
+struct T1In {
+  std::vector<InEdge> edges;
+  std::vector<NodeId> heads;
+  std::vector<NodeId> destinations;
+  Amount design_demand;
+  std::int64_t per_head;
+  std::optional<Amount> offer {};
+  Ints excluded {};
+  std::optional<Cost> absolute {};
+  std::optional<CostStretch> stretch {};
+};
+struct T1Out {
+  std::string error;
+  Amounts requested;
+  Routes routes;
+  Texts status;
+  std::int64_t up {0};
+  Amount reserved {0};
+  Amounts edge_reservations;
+  Amount bound {0};
+  Amounts offered_by_entry;
+  Amount source_drops {0};
+  Amounts no_drop_load;
+  Amount lossy_delivery {0};
+  Amounts lossy_edge_drops;
+  Amount lossless_admitted {0};
+  Amount lossless_unadmitted {0};
+};
+T1Out t1(const T1In& in) {
+  const Net n(in.edges);
+  DistributedTE dte {TunnelCount {in.per_head}};
+  if (in.absolute.has_value()) dte.cost_ceiling = AbsoluteCost {*in.absolute};
+  if (in.stretch.has_value()) dte.cost_ceiling = *in.stretch;
+  const auto mask = n.mask({}, in.excluded);
+  T1Out out;
+  out.error = error_of([&] { (void)policy(n, in.heads, in.destinations, {.routing = dte, .admission = LL}, mask); });
+  if (!out.error.empty()) return out;
+  auto bound = policy(n, in.heads, in.destinations, {.routing = dte, .admission = LL}, mask);
+  const auto b = bound->replace(std::nullopt, design_of(in.design_demand), OutputOptions {.edge_reservations = true});
+  out.bound = b.call_delivered;
+  out.reserved = b.plan->total_reserved_bandwidth;
+  out.edge_reservations = n.in_order(*b.edge_reservations);
+  Routes paths;
+  for (const auto& t : b.program->tunnels()) {
+    out.requested.push_back(t.requested_bandwidth);
+    out.status.push_back(name_of(t.status));
+    out.up += t.status == TunnelStatus::Up ? 1 : 0;
+    paths.push_back(t.edges.has_value() ? n.positions(*t.edges) : Ints {});
+  }
+  out.routes = paths;
+  if (!in.offer.has_value()) return out;
+  auto lossy = policy(n, in.heads, in.destinations, {.routing = dte, .admission = LY}, mask);
+  const auto r = lossy->replace(*in.offer, design_of(in.design_demand));
+  out.no_drop_load.assign(n.m(), 0);
+  for (std::size_t i = 0; i < r.by_tunnel.size(); ++i) {
+    const Amount a = lo(r.by_tunnel[i].assigned);
+    out.offered_by_entry.push_back(a);
+    for (auto e : paths[i]) out.no_drop_load[static_cast<std::size_t>(e)] += a;
+  }
+  out.source_drops = r.call_source_drops;
+  out.lossy_delivery = r.call_delivered;
+  out.lossy_edge_drops = n.per_edge(r.call_edge_drops);
+  auto lossless = policy(n, in.heads, in.destinations, {.routing = dte, .admission = LL}, mask);
+  out.lossless_admitted = lossless->replace(*in.offer, design_of(in.design_demand)).call_delivered;
+  out.lossless_unadmitted = *in.offer - out.lossless_admitted;
+  return out;
+}
+
+// ---------------------------------------------------------------- T2
+
+struct T2In {
+  std::vector<InEdge> edges;
+  std::vector<NodeId> heads;
+  std::vector<NodeId> destinations;
+  std::int64_t per_head;
+  std::optional<Amount> design_demand {};
+  std::optional<Amounts> cap {};
+  bool prefer_headroom {false};
+  std::optional<Amount> lossy_offer {};
+  std::optional<Ints> support {};
+  Ints excluded {};
+  bool up_to {false};
+};
+struct T2Out {
+  TunnelPlan plan;
+  Ints counts;
+  Routes paths;
+  std::vector<std::int32_t> entry_ids;
+  Amount delivered {0};  // Lossless: the design's delivery (the design, or the bound without one)
+  Amount lossy_delivery {0};
+  Amount lossy_source_drops {0};
+};
+std::shared_ptr<FlowLedger> ledger_of(const Net& n, const std::optional<Amounts>& service) {
+  if (!service.has_value()) return std::make_shared<FlowLedger>(n.g);
+  const Amounts v = n.by_id(*service);
+  return std::make_shared<FlowLedger>(n.g, v);
+}
+T2Out t2(const T2In& in) {
+  const Net n(in.edges);
+  const auto support = in.support.has_value() ? n.dag(*in.support) : nullptr;
+  const auto cte = centralized(SourceAllocation::Equal, support, TunnelCount {in.per_head, in.up_to}, in.prefer_headroom);
+  const auto mask = n.mask({}, in.excluded);
+  const DesignArg design = in.design_demand.has_value() ? design_of(*in.design_demand) : kUnlimited;
+  auto p = policy(n, in.heads, in.destinations, {.routing = cte, .admission = LL}, mask, ledger_of(n, in.cap));
+  const auto r = p->replace(in.design_demand, design);
+  T2Out out;
+  out.plan = *r.plan;
+  out.delivered = r.call_delivered;
+  out.counts.assign(n.m(), 0);
+  for (const auto& t : r.program->tunnels()) {
+    const Ints ps = n.positions(*t.edges);
+    for (auto e : ps) ++out.counts[static_cast<std::size_t>(e)];
+    out.paths.push_back(ps);
+    out.entry_ids.push_back(t.entry_id);
+  }
+  if (in.lossy_offer.has_value()) {
+    auto ly = policy(n, in.heads, in.destinations, {.routing = cte, .admission = LY}, mask, ledger_of(n, in.cap));
+    const auto l = ly->replace(*in.lossy_offer, design);
+    out.lossy_delivery = l.call_delivered;
+    out.lossy_source_drops = l.call_source_drops;
+  }
+  return out;
+}
+std::pair<Amount, Amount> fraction(Amount num, Amount den = 1) { return {num, den}; }
+Counter128 c128(std::uint64_t x) { return Counter128 {0, x}; }
+
+// ---------------------------------------------------------------- programs of explicit routes
+
+// Routes over abstract links: each abstract link e of capacity cap[e] gets its own two nodes, and
+// each route runs from its head through its links (joined by links that never limit anything) to
+// the one destination. head_of[i] is route i's head (0, 1, ...); the destination follows the heads.
+struct Routed {
+  Net net;
+  std::vector<EdgeId> link;  // abstract link -> EdgeId
+  std::vector<std::vector<EdgeId>> paths;
+  std::vector<NodeId> heads;
+  NodeId destination;
+};
+Routed routed(const Amounts& cap, const Routes& routes, const std::vector<NodeId>& head_of) {
+  const NodeId h = *std::max_element(head_of.begin(), head_of.end()) + 1;
+  const NodeId dest = h;
+  auto tail = [&](std::int64_t e) { return static_cast<NodeId>(h + 1 + 2 * e); };
+  auto headn = [&](std::int64_t e) { return static_cast<NodeId>(h + 2 + 2 * e); };
+  std::vector<InEdge> rows;
+  for (std::size_t e = 0; e < cap.size(); ++e) rows.push_back({tail(static_cast<std::int64_t>(e)), headn(static_cast<std::int64_t>(e)), cap[e], 1});
+  std::vector<std::vector<std::size_t>> rows_of(routes.size());
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    const auto& r = routes[i];
+    rows_of[i].push_back(rows.size());
+    rows.push_back({head_of[i], tail(r.front()), kBig, 1});
+    for (std::size_t j = 0; j < r.size(); ++j) {
+      rows_of[i].push_back(static_cast<std::size_t>(r[j]));
+      if (j + 1 < r.size()) {
+        rows_of[i].push_back(rows.size());
+        rows.push_back({headn(r[j]), tail(r[j + 1]), kBig, 1});
+      }
+    }
+    rows_of[i].push_back(rows.size());
+    rows.push_back({headn(r.back()), dest, kBig, 1});
+  }
+  Routed out {Net(rows, h + 1 + 2 * static_cast<NodeId>(cap.size())), {}, {}, {}, dest};
+  for (std::size_t e = 0; e < cap.size(); ++e) out.link.push_back(out.net.id[e]);
+  for (const auto& rs : rows_of) {
+    std::vector<EdgeId> p;
+    for (auto r : rs) p.push_back(out.net.id[r]);
+    out.paths.push_back(p);
+  }
+  for (NodeId v = 0; v < h; ++v) out.heads.push_back(v);
+  return out;
+}
+// Each route a tunnel, or (where dags[i] is set) a supplied DAG route of the same links.
+std::shared_ptr<const ForwardingProgram> routed_program(const Routed& r, const std::vector<NodeId>& head_of, const Amounts& weights,
+                                                        const std::vector<bool>& dags = {}) {
+  std::vector<RouteDefinition> defs;
+  for (std::size_t i = 0; i < r.paths.size(); ++i) {
+    if (i < dags.size() && dags[i]) {
+      defs.push_back(RouteDefinition {head_of[i], dag_of(*r.net.g, r.paths[i]), weights[i]});
+      continue;
+    }
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : r.paths[i]) hops.push_back({e});
+    defs.push_back(RouteDefinition {head_of[i], std::make_shared<const Path>(*r.net.g, hops), weights[i]});
+  }
+  const NodeId t[1] = {r.destination};
+  return ForwardingProgram::from_routes(*r.net.g, r.heads, t, defs);
+}
+
+// The one Lossy forwarding of routes with offers: one tunnel per route, weight = its offer, under
+// head label[i] (the hierarchy's middle level; heads share the offer equally, so a head's routes
+// must offer equal totals). Per route: what it carries and drops at each of its links, and what it
+// delivers; per link, what it carries. `dark`: the abstract links the call black-holes; `dags[i]`:
+// route i a supplied DAG route instead of a tunnel; `total`: the call's offer (default: the sum of
+// the offers). The structure (hooks): the abstract links that wait, the cyclic groups, their rounds
+// and the dependency arcs.
+struct LossyOut {
+  std::string error;
+  std::int64_t rounds {-1};  // hooks only, as the three below
+  std::int64_t groups {-1};
+  Ints barrier_links;
+  std::int64_t dependencies {-1};
+  Routes carried;
+  Routes edge_drops;
+  Amounts delivered;
+  Amounts edge_flows;
+};
+LossyOut lossy(const Amounts& offers, const Routes& routes, const Amounts& cap, std::vector<NodeId> head_of = {}, const Ints& dark = {},
+               const std::vector<bool>& dags = {}, std::optional<Amount> total = std::nullopt) {
+  if (head_of.empty()) head_of.assign(routes.size(), 0);
+  const Routed r = routed(cap, routes, head_of);
+  const auto prog = routed_program(r, head_of, offers, dags);
+  auto p = policy(r.net, r.heads, {r.destination}, {.routing = Pinned {prog, dark.empty() ? nullptr : r.net.mask({}, dark)}, .admission = LY});
+  if (!total.has_value()) {
+    total = 0;
+    for (Amount x : offers) *total += x;
+  }
+  LossyOut out;
+  PlacementResult res;
+  out.error = error_of([&] { res = p->place(*total, kFlows); });
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto& counters = detail::thread_lossy_counters();
+  out.rounds = counters.rounds;
+  out.groups = counters.groups;
+  out.dependencies = counters.dependencies;
+  for (std::size_t e = 0; e < cap.size(); ++e) {
+    if (std::find(counters.barriers.begin(), counters.barriers.end(), r.link[e]) != counters.barriers.end()) out.barrier_links.push_back(static_cast<std::int64_t>(e));
+  }
+#endif
+  if (!out.error.empty()) return out;
+  std::map<std::int32_t, FlowRecord> rec;
+  for (auto& x : p->records()) rec[*x.entry_id] = x;
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    Ints c;
+    Ints d;
+    for (auto e : routes[i]) {
+      const EdgeId id = r.link[static_cast<std::size_t>(e)];
+      Amount cf = 0;
+      Amount df = 0;
+      if (rec.count(static_cast<std::int32_t>(i)) != 0) {
+        for (const auto& [x, a] : rec[static_cast<std::int32_t>(i)].edge_flows) cf += x == id ? a : 0;
+        for (const auto& [x, a] : rec[static_cast<std::int32_t>(i)].edge_drops) df += x == id ? lo(a) : 0;
+      }
+      c.push_back(cf);
+      d.push_back(df);
+    }
+    out.carried.push_back(c);
+    out.edge_drops.push_back(d);
+    // by_tunnel has the tunnels only (a DAG route's delivery is not reported: -1).
+    const auto tunnel = static_cast<std::size_t>(std::count(dags.begin(), dags.begin() + static_cast<std::ptrdiff_t>(std::min(i, dags.size())), true));
+    out.delivered.push_back(i < dags.size() && dags[i] ? -1 : res.by_tunnel[i - tunnel].delivered);
+  }
+  for (EdgeId id : r.link) out.edge_flows.push_back((*res.edge_flows)[static_cast<std::size_t>(id)]);
+  return out;
+}
+
+// The Lossless bound of one head's routes with weights.
+Amount bound(const Amounts& cap, const Routes& routes, const Amounts& weights) {
+  const std::vector<NodeId> head_of(routes.size(), 0);
+  const Routed r = routed(cap, routes, head_of);
+  auto p = policy(r.net, r.heads, {r.destination}, {.routing = Pinned {routed_program(r, head_of, weights), nullptr}});
+  return p->place(std::nullopt).call_delivered;
+}
+
+// ---------------------------------------------------------------- stale forwarding
+
+struct StaleIn {
+  std::vector<InEdge> edges;
+  std::vector<NodeId> sources;
+  NodeId destination;
+  Amount offer;
+  std::vector<std::optional<Amount>> weights;
+  Ints black_links {};
+  std::vector<NodeId> black_nodes {};
+  Ints mask_links {};
+  std::vector<NodeId> mask_nodes {};
+};
+struct StaleOut {
+  Amount delivered;
+  Amounts edge_flows;
+  Amounts edge_drops;
+  Amount source_drops;
+};
+StaleOut stale_dag(const StaleIn& in) {
+  const Net n(in.edges);
+  Ints members;
+  bool equal = true;
+  Amounts w(n.m(), 0);
+  for (std::size_t e = 0; e < in.weights.size(); ++e) {
+    if (!in.weights[e].has_value()) continue;
+    members.push_back(static_cast<std::int64_t>(e));
+    equal = equal && *in.weights[e] == 1;
+    w[e] = *in.weights[e];
+  }
+  RouteOptions o;
+  if (!equal) {
+    o.allocation = RouteAllocation::Weighted;
+    o.weight_basis = WeightBasis::Explicit;
+    o.edge_weights = n.by_id(w);
+  }
+  const NodeId t[1] = {in.destination};
+  const auto prog = ForwardingProgram::from_dag(*n.g, in.sources, t, n.dag(members), o);
+  auto p = policy(n, in.sources, {in.destination}, {.routing = Pinned {prog, n.mask(in.black_nodes, in.black_links)}, .admission = LY},
+                  n.mask(in.mask_nodes, in.mask_links));
+  const auto r = p->place(in.offer, kFlows);
+  return {r.call_delivered, n.in_order(*r.edge_flows), n.per_edge(r.call_edge_drops), r.call_source_drops};
+}
+
+struct StalePathsIn {
+  std::vector<InEdge> edges;
+  std::vector<std::pair<NodeId, Ints>> tunnels;
+  std::map<NodeId, Amount> offers;
+  Ints black_links {};
+  std::vector<NodeId> black_nodes {};
+  Ints mask_links {};
+  std::vector<NodeId> mask_nodes {};
+};
+struct StalePathsOut {
+  Texts status;
+  Amounts assigned;
+  Amounts delivered;
+  Amounts edge_drops;
+  Amount source_drops;
+  std::optional<Amount> lossless_admitted;
+};
+StalePathsOut stale_paths(const StalePathsIn& in) {
+  const Net n(in.edges);
+  std::vector<NodeId> heads;
+  Amount total = 0;
+  for (const auto& [h, x] : in.offers) {
+    heads.push_back(h);
+    total += x;
+    EXPECT_EQ(x, in.offers.begin()->second);  // heads share the offer equally
+  }
+  std::vector<RouteDefinition> defs;
+  NodeId dest = 0;
+  for (const auto& [h, es] : in.tunnels) {
+    const auto p = n.path(es);
+    dest = p->destination();
+    defs.push_back(RouteDefinition {h, p, 1});
+  }
+  const NodeId t[1] = {dest};
+  const auto prog = ForwardingProgram::from_routes(*n.g, heads, t, defs);
+  const FlowPolicyConfig ly {.routing = Pinned {prog, n.mask(in.black_nodes, in.black_links)}, .admission = LY};
+  auto p = policy(n, heads, {dest}, ly, n.mask(in.mask_nodes, in.mask_links));
+  const auto r = p->place(total);
+  StalePathsOut out;
+  for (const auto& row : r.by_tunnel) {
+    out.status.push_back(name_of(row.status));
+    out.assigned.push_back(lo(row.assigned));
+    out.delivered.push_back(row.delivered);
+  }
+  out.edge_drops = n.per_edge(r.call_edge_drops);
+  out.source_drops = r.call_source_drops;
+  if (heads.size() == 1 && r.call_source_drops == 0) {
+    FlowPolicyConfig ll = ly;
+    ll.admission = LL;
+    auto q = policy(n, heads, {dest}, ll, n.mask(in.mask_nodes, in.mask_links));
+    out.lossless_admitted = q->place(total).call_delivered;
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- the configuration's examples
+
+// The example graph of the configuration cases: 0 -> 1, 0 -> 2, 1 -> 2; one source [0] or two
+// [0, 1]; destination 2; "dag" is the support {0 -> 2}.
+const Net& config_net() {
+  static const Net n({{0, 1, 5, 1}, {0, 2, 5, 1}, {1, 2, 5, 1}});
+  return n;
+}
+
+std::string resolved(const Routing& r) {
+  auto opt = [](const auto& x, auto f) { return x.has_value() ? f(*x) : std::string("None"); };
+  auto alloc = [](RouteAllocation a) { return std::string(a == RouteAllocation::Equal ? "EQUAL" : a == RouteAllocation::Weighted ? "WEIGHTED" : "OPTIMIZED"); };
+  auto src = [](SourceAllocation s) { return std::string(s == SourceAllocation::Equal ? "EQUAL" : "OPTIMIZED"); };
+  auto basis = [](WeightBasis b) { return std::string(b == WeightBasis::Capacity ? "CAPACITY" : b == WeightBasis::Explicit ? "EXPLICIT" : "RESIDUAL_SNAPSHOT"); };
+  auto tie = [](RouteTieBreak t) {
+    switch (t) {
+      case RouteTieBreak::FewerHops: return std::string("FEWER_HOPS");
+      case RouteTieBreak::HigherCapacity: return std::string("HIGHER_CAPACITY");
+      case RouteTieBreak::HigherAvailableCapacity: return std::string("HIGHER_AVAILABLE_CAPACITY");
+      case RouteTieBreak::HigherHeadroom: return std::string("HIGHER_HEADROOM");
+    }
+    return std::string("?");
+  };
+  auto boolean = [](bool b) { return std::string(b ? "True" : "False"); };
+  if (const auto* sp = std::get_if<ShortestPaths>(&r)) {
+    return "allocation=" + alloc(sp->allocation) + " source_allocation=" + opt(sp->source_allocation, src) +
+           " weight_basis=" + opt(sp->weight_basis, basis) + " tie_break=" + tie(sp->tie_break) + " multipath=" + boolean(sp->multipath) +
+           " parallel_edges=" + boolean(sp->parallel_edges);
+  }
+  if (const auto* gl = std::get_if<CentralizedTE>(&r)) {
+    auto count = [](const TunnelCount& t) { return std::to_string(t.per_head) + (t.up_to ? " up_to" : ""); };
+    return "source_allocation=" + src(gl->source_allocation) + " support=" + (gl->support ? "dag" : "None") +
+           " tunnel_count=" + opt(gl->tunnel_count, count) + " prefer_headroom=" + boolean(gl->prefer_headroom);
+  }
+  return "valid";
+}
+
+// One configuration case: the policy's first error, else the resolved fields of the model (a
+// zero call placed first: a zero offer skips no validation).
+std::string config_case(Routing routing, int sources = 1, Admission admission = LL, bool cache = false,
+                        std::optional<std::pair<std::vector<NodeId>, std::vector<NodeId>>> endpoints = std::nullopt) {
+  const Net& n = config_net();
+  std::vector<NodeId> s = sources == 1 ? v({0}) : v({0, 1});
+  std::vector<NodeId> d = v({2});
+  if (endpoints.has_value()) std::tie(s, d) = *endpoints;
+  ShortestPathCache c(*n.g);
+  FlowLedger fg(n.g);
+  std::string got;
+  const auto e = error_of([&] {
+    FlowPolicy p(fg, s, d, {.routing = std::move(routing), .admission = admission}, nullptr, cache ? &c : nullptr);
+    const bool tunnels = std::holds_alternative<DistributedTE>(p.config().routing) ||
+                         (std::holds_alternative<CentralizedTE>(p.config().routing) &&
+                          std::get<CentralizedTE>(p.config().routing).tunnel_count.has_value());
+    if (tunnels) {
+      (void)p.replace(0, design_of(0));
+    } else {
+      (void)p.place(0);
+    }
+    got = resolved(p.config().routing);
+  });
+  return e.empty() ? got : e;
+}
+ShortestPaths sp_with(RouteAllocation a = RouteAllocation::Equal, std::optional<SourceAllocation> s = std::nullopt,
+                      std::optional<WeightBasis> b = std::nullopt, RouteTieBreak t = RouteTieBreak::FewerHops, bool multipath = true,
+                      bool parallel = true) {
+  ShortestPaths sp;
+  sp.allocation = a;
+  sp.source_allocation = s;
+  sp.weight_basis = b;
+  sp.tie_break = t;
+  sp.multipath = multipath;
+  sp.parallel_edges = parallel;
+  return sp;
+}
+DistributedTE dte_with(std::int64_t count, bool up_to = false, std::optional<CostCeiling> ceiling = std::nullopt, Amount minimum = 0) {
+  DistributedTE d {TunnelCount {count, up_to}};
+  d.cost_ceiling = ceiling;
+  d.min_unreserved_bandwidth = minimum;
+  return d;
+}
+
+// One evaluation case: the evaluator's first error, else the offer and design it evaluated.
+std::string evaluation_case(Routing routing, Admission admission, DesignArg offer, DesignArg design) {
+  const Net& n = config_net();
+  EvaluationOptions o {{.routing = std::move(routing), .admission = admission}};
+  o.offer = offer;
+  o.design_demand = design;
+  std::string got;
+  const auto e = error_of([&] {
+    const auto r = evaluate_demand(*n.g, v({0}), v({2}), o);
+    const std::string offered = !r.requested.has_value() ? (r.by_source[0].offered.has_value() ? "first-hop experiment" : "inf")
+                                                         : std::to_string(lo(r.requested));
+    const std::string d = !r.plan.has_value() ? "None"
+                          : r.plan->design_demand.has_value() ? std::to_string(*r.plan->design_demand)
+                                                              : "inf";
+    got = "offer=" + offered + " design_demand=" + d;
+  });
+  return e.empty() ? got : e;
+}
+Pinned config_pinned(const Net& n, NodeId to) {
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.path({to == 1 ? 0 : 1}), 1}};
+  const NodeId t[1] = {to};
+  return Pinned {ForwardingProgram::from_routes(*n.g, v({0}), t, defs), nullptr};
+}
+
+// ---------------------------------------------------------------- calls on one policy
+
+struct EpochOut {
+  Amount requested;
+  Amount delivered;
+  Amount edge_drops;
+  Amounts edge_flows;
+  Amounts residual;
+  Amounts per_call;
+};
+EpochOut epoch(const Amounts& cap, const Amounts& calls, bool full, Admission admission) {
+  std::vector<InEdge> rows;
+  for (Amount c : cap) rows.push_back({0, 1, c, 1});
+  const Net n(rows);
+  auto p = policy(n, v({0}), v({1}), {.routing = ShortestPaths {}, .admission = admission});
+  EpochOut out {};
+  PlacementResult r;
+  if (full) {
+    Amount total = 0;
+    for (Amount x : calls) total += x;
+    r = p->place(total, kFlows);
+    out.per_call.push_back(r.call_delivered);
+  } else {
+    for (Amount x : calls) {
+      r = p->place(x, kFlows);
+      out.per_call.push_back(r.call_delivered);
+    }
+  }
+  out.requested = lo(r.requested);
+  out.delivered = r.delivered;
+  for (const auto& [e, x] : r.edge_drops) out.edge_drops += lo(x);
+  out.edge_flows = n.in_order(*r.edge_flows);
+  out.residual = n.in_order(p.ledger->residual());
+  return out;
+}
+
+// Sources 0 .. k - 1, each with its own link to node k (equal sources, ShortestPaths ECMP); before
+// call c the other owners' load on link i is outside[c][i] (one Pinned policy per link).
+struct IncrementsOut {
+  Amounts call_delivered;
+  Amount requested;
+  std::optional<Amount> admitted;
+  std::optional<Amount> unadmitted;
+  std::optional<Amount> offered;
+  Amount delivered;
+  Amounts edge_drops;
+};
+IncrementsOut increments(const Amounts& caps, const Amounts& calls, Admission admission, std::vector<Amounts> outside = {}) {
+  const auto k = static_cast<NodeId>(caps.size());
+  std::vector<InEdge> rows;
+  for (NodeId i = 0; i < k; ++i) rows.push_back({i, k, caps[static_cast<std::size_t>(i)], 1});
+  const Net n(rows);
+  auto ledger = std::make_shared<FlowLedger>(n.g);
+  std::vector<Pol> others;
+  for (NodeId i = 0; i < k && !outside.empty(); ++i) {
+    const std::vector<RouteDefinition> defs = {RouteDefinition {i, n.path({i}), 1}};
+    const NodeId s[1] = {i};
+    const NodeId t[1] = {k};
+    others.push_back(policy(n, {i}, {k}, {.routing = Pinned {ForwardingProgram::from_routes(*n.g, s, t, defs), nullptr}}, nullptr, ledger));
+  }
+  std::vector<NodeId> sources;
+  for (NodeId i = 0; i < k; ++i) sources.push_back(i);
+  auto p = policy(n, sources, {k}, {.routing = ShortestPaths {}, .admission = admission}, nullptr, ledger);
+  IncrementsOut out {};
+  PlacementResult r;
+  for (std::size_t c = 0; c < calls.size(); ++c) {
+    for (std::size_t i = 0; i < others.size(); ++i) (void)others[i]->replace(outside[c][i]);
+    r = p->place(calls[c]);
+    out.call_delivered.push_back(r.call_delivered);
+  }
+  out.requested = lo(r.requested);
+  out.admitted = admission == LL ? std::optional<Amount>(lo(r.admitted)) : std::nullopt;
+  out.unadmitted = r.unadmitted.has_value() ? std::optional<Amount>(lo(r.unadmitted)) : std::nullopt;
+  out.offered = r.offered.has_value() ? std::optional<Amount>(lo(r.offered)) : std::nullopt;
+  out.delivered = r.delivered;
+  out.edge_drops = n.per_edge(r.edge_drops);
+  return out;
+}
+
+// The installed program of a setup forwarded at `offer`: the program's tunnel count, the Lossy and
+// Lossless terminations and the roster's per-source drops; forward works on the installed program.
+struct TerminationOut {
+  std::size_t tunnels;
+  std::string lossy;
+  std::string lossless;
+  Amounts source_drops;
+  std::string forward_error;
+};
+TerminationOut termination(const Net& n, const std::vector<NodeId>& s, const std::vector<NodeId>& d, const Routing& routing,
+                           Amount offer, DesignArg design) {
+  auto ly = policy(n, s, d, {.routing = routing, .admission = LY});
+  auto ll = policy(n, s, d, {.routing = routing, .admission = LL});
+  const bool tunnel_model = !std::holds_alternative<Pinned>(routing);
+  const auto a = tunnel_model ? ly->replace(offer, design) : ly->place(offer);
+  const auto b = tunnel_model ? ll->replace(offer, design) : ll->place(offer);
+  TerminationOut out {a.program ? a.program->tunnels().size() : 0, name_of(a.termination), name_of(b.termination), {}, ""};
+  for (const auto& row : a.by_source) out.source_drops.push_back(lo(row.source_drops));
+  if (tunnel_model) out.forward_error = error_of([&] { (void)ly->forward(offer); });
+  return out;
+}
+
+// The edges of a T1 example with heads 0 .. h - 1 and one link each to node h.
+std::vector<InEdge> fan(NodeId h, Amount cap) {
+  std::vector<InEdge> rows;
+  for (NodeId i = 0; i < h; ++i) rows.push_back({i, h, cap, 1});
+  return rows;
+}
+
+const std::vector<InEdge> kX8 = {{0, 2, 0, 1}, {1, 2, 8, 3}};
+const std::vector<InEdge> kG1 = {{0, 1, 8192, 1}, {0, 2, 40960, 1}, {1, 3, 8192, 1}, {2, 3, 40960, 1}};
+const std::vector<InEdge> kX7 = {{0, 1, 6, 1}, {0, 2, 6, 3}, {1, 2, 4, 1}, {1, 3, 6, 3}, {2, 3, 6, 1}};
+const std::vector<InEdge> kG10 = {
+    {0, 1, 40960, 1}, {0, 5, 40960, 1}, {0, 3, 24576, 2}, {1, 0, 40960, 1}, {1, 2, 40960, 1}, {1, 4, 16384, 2},
+    {2, 1, 40960, 1}, {2, 3, 40960, 1}, {2, 5, 20480, 2}, {3, 2, 40960, 1}, {3, 4, 40960, 1}, {3, 0, 24576, 2},
+    {4, 3, 40960, 1}, {4, 5, 40960, 1}, {4, 1, 16384, 2}, {5, 0, 40960, 1}, {5, 4, 40960, 1}, {5, 2, 20480, 2}};
+const std::vector<InEdge> kDP = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}, {2, 3, 1, 1}};
+const std::vector<InEdge> kSup = {{0, 1, 6, 1}, {0, 1, 6, 1}, {0, 1, 100, 2}};
+
+}  // namespace
+
+// ================================================================ shared integer rules
+
+TEST(ContractExamples, E_configured) { EXPECT_EQ(ha(12, {1, 2}), (Amounts {4, 8})); }
+TEST(ContractExamples, E_snapshot) { EXPECT_EQ(ha(12, {2, 10}), (Amounts {2, 10})); }
+TEST(ContractExamples, E_source_survivor) { EXPECT_EQ(ha(16, {3, 1}), (Amounts {12, 4})); }
+TEST(ContractExamples, H_not_one_unit) { EXPECT_EQ(ha(50, {100, 1, 1, 1}), (Amounts {50, 0, 0, 0})); }
+
+// R3-H-large, H(2^126 - 1, [2^125, 2^125]) = [2^125, 2^125 - 1], is outside the domain (amounts
+// and weights below 2^62): the library refuses its weight and its offer, and the same rounding at
+// the largest inputs of the domain gives the rule's values (the Python test computes the same
+// values with the rule written out and checks them on the library there too). Each analogue runs
+// on the rule itself and as a LOSSY offer over tunnels of those weights on links of capacity 1.
+TEST(ContractExamples, R3_H_large) {
+  constexpr Amount kTop = (Amount {1} << 62) - 1;
+  const Net n({{0, 1, 1, 1}, {0, 1, 1, 1}});
+  const NodeId s[1] = {0};
+  const NodeId t[1] = {1};
+  const std::vector<RouteDefinition> beyond = {RouteDefinition {0, n.path({0}), kTop + 1}};
+  EXPECT_THROW((void)ForwardingProgram::from_routes(*n.g, s, t, beyond), std::invalid_argument);
+  const std::vector<RouteDefinition> unit = {RouteDefinition {0, n.path({0}), 1}};
+  const auto one = ForwardingProgram::from_routes(*n.g, s, t, unit);
+  auto p = policy(n, {0}, {1}, {.routing = Pinned {one, nullptr}, .admission = LY});
+  EXPECT_THROW((void)p->place(kTop + 1), std::invalid_argument);
+
+  constexpr Amount half = Amount {1} << 61;
+  const std::vector<std::pair<std::pair<Amount, Amounts>, Amounts>> analogues = {
+      {{kTop, {half, half}}, {half, half - 1}},
+      {{kTop, {kTop, kTop}}, {half, half - 1}},
+      {{kTop, {kTop, kTop - 1, 1}}, {half, half - 1, 0}},
+      {{kTop - 1, {kTop, half, 3}}, {3074457345618258601, 1537228672809129300, 1}},
+      {{kTop, {3, 5, 7}}, {922337203685477580, 1537228672809129301, 2152120141932781022}},
+  };
+  for (const auto& [in, want] : analogues) {
+    const auto& [total, weights] = in;
+    EXPECT_EQ(ha(total, weights), want);
+    std::vector<InEdge> links;
+    std::vector<RouteDefinition> defs;
+    for (std::size_t i = 0; i < weights.size(); ++i) links.push_back({0, 1, 1, 1});
+    const Net m(links);
+    for (std::size_t i = 0; i < weights.size(); ++i) {
+      defs.push_back(RouteDefinition {0, m.path({static_cast<std::int64_t>(i)}), weights[i]});
+    }
+    auto q = policy(m, {0}, {1}, {.routing = Pinned {ForwardingProgram::from_routes(*m.g, s, t, defs), nullptr}, .admission = LY});
+    Amounts got;
+    for (const auto& row : q->place(total).by_tunnel) got.push_back(lo(row.assigned));
+    EXPECT_EQ(got, want);
+  }
+}
+
+// The 128-bit cumulative offers near 2^126 (beyond any one call, reached by increments): from
+// X = 2^126 - 2 (split equally) one more unit goes to source 0; from 2^126 - 4, two more units
+// split (1, 1).
+TEST(CumulativeOffers, IncrementsNear2To126) {
+  const Net n({{0, 2, 10, 1}, {1, 2, 10, 1}});
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.path({0}), 1}, RouteDefinition {1, n.path({1}), 1}};
+  const NodeId t[1] = {2};
+  const auto prog = ForwardingProgram::from_routes(*n.g, v({0, 1}), t, defs);
+  const auto view = detail::make_forwarding_view(*n.g, prog, nullptr, v({2}), nullptr, false);
+  const Counter128 just_below {(std::uint64_t {1} << 62) - 1, ~std::uint64_t {0} - 1};  // 2^126 - 2
+  Amounts out(2, 0);
+  detail::source_offer_increments(view, just_below, 1, out);
+  EXPECT_EQ(out, (Amounts {1, 0}));
+  const Counter128 four_below {(std::uint64_t {1} << 62) - 1, ~std::uint64_t {0} - 3};  // 2^126 - 4
+  detail::source_offer_increments(view, four_below, 2, out);
+  EXPECT_EQ(out, (Amounts {1, 1}));
+}
+
+TEST(ContractExamples, H_local_bound) {
+  Amounts w(11, 1);
+  w[0] = 1000000;
+  const auto e = split_error(1000000, w);
+  EXPECT_EQ(e.assigned, (Amounts {1000000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}));
+  EXPECT_EQ(text(e.max_excess), "1000000/100001");
+  EXPECT_EQ(text(e.max_deficit), "100000/100001");
+  EXPECT_TRUE(e.below_k);
+}
+
+TEST(ContractExamples, RR_local_bound) {
+  const auto e = split_error(10, {1, 1, 1});
+  EXPECT_EQ(e.assigned, (Amounts {4, 3, 3}));
+  EXPECT_EQ(text(e.max_excess), "2/3");
+  EXPECT_EQ(text(e.max_deficit), "1/3");
+  EXPECT_TRUE(e.below_one);
+}
+
+// Every split with total <= 24, 1 to 4 members and weights 0 .. 4 (not all zero): each member within
+// k of its exact share, within 1 when the weights are equal.
+TEST(ContractExamples, H_bound_sweep) {
+  std::int64_t cases = 0;
+  std::int64_t violations = 0;
+  std::int64_t equal_violations = 0;
+  for (std::size_t k = 1; k <= 4; ++k) {
+    std::size_t combos = 1;
+    for (std::size_t i = 0; i < k; ++i) combos *= 5;
+    for (std::size_t c = 0; c < combos; ++c) {
+      Amounts w(k);
+      std::size_t x = c;
+      for (std::size_t i = k; i-- > 0;) {
+        w[i] = static_cast<Amount>(x % 5);
+        x /= 5;
+      }
+      if (std::all_of(w.begin(), w.end(), [](Amount y) { return y == 0; })) continue;
+      const bool equal = std::all_of(w.begin(), w.end(), [&](Amount y) { return y == w[0]; });
+      for (Amount n = 0; n <= 24; ++n) {
+        ++cases;
+        const auto e = split_error(n, w);
+        violations += e.below_k ? 0 : 1;
+        if (equal) equal_violations += e.below_one ? 0 : 1;
+      }
+    }
+  }
+  EXPECT_EQ(cases, 19400);
+  EXPECT_EQ(violations, 0);
+  EXPECT_EQ(equal_violations, 0);
+}
+
+// Members in prepared order (ascending EdgeId): member 1 (input order) has the smaller EdgeId (its
+// lower cost sorts it first), so one unit goes to it.
+TEST(ContractExamples, R3_member_order) {
+  const Net n({{0, 1, 5, 2}, {0, 1, 5, 1}});
+  ASSERT_LT(n.id[1], n.id[0]);
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.dag({0, 1}), 1}};
+  const NodeId t[1] = {1};
+  auto p = policy(n, v({0}), v({1}), {.routing = Pinned {ForwardingProgram::from_routes(*n.g, v({0}), t, defs), nullptr}, .admission = LY});
+  EXPECT_EQ(n.in_order(*p->place(1, kFlows).edge_flows), (Amounts {0, 1}));
+}
+
+// Two sources of one unit each meet at router 2, which splits the pooled two units once over its
+// two members (one each), attributed back by H: member 0's unit to source 0, member 1's to source 1.
+// Splitting each source separately puts both units on the first member.
+TEST(ContractExamples, B_pooled) {
+  const Net n({{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 3, 10, 1}});
+  const NodeId t[1] = {3};
+  auto pooled = policy(n, v({0, 1}), v({3}), {.routing = Pinned {ForwardingProgram::from_dag(*n.g, v({0, 1}), t, n.dag({0, 1, 2, 3})), nullptr}, .admission = LY});
+  const auto r = pooled->place(2, kFlows);
+  EXPECT_EQ(n.in_order(*r.edge_flows), (Amounts {1, 1, 1, 1}));  // columns [1, 1]
+  std::vector<std::vector<Amount>> by_column(2, Amounts(2, 0));
+  for (const auto& rec : pooled->records()) {
+    const auto src = rec.sources.at(0);
+    for (const auto& [e, x] : rec.edge_flows) {
+      const auto c = n.pos(e) - 2;
+      if (c >= 0) by_column[static_cast<std::size_t>(c)][static_cast<std::size_t>(src)] += x;
+    }
+  }
+  EXPECT_EQ(by_column, (std::vector<Amounts> {{1, 0}, {0, 1}}));
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.dag({0, 2, 3}), 1}, RouteDefinition {1, n.dag({1, 2, 3}), 1}};
+  auto separate = policy(n, v({0, 1}), v({3}), {.routing = Pinned {ForwardingProgram::from_routes(*n.g, v({0, 1}), t, defs), nullptr}, .admission = LY});
+  const auto flows = n.in_order(*separate->place(2, kFlows).edge_flows);
+  EXPECT_EQ((Amounts {flows[2], flows[3]}), (Amounts {2, 0}));  // independent columns
+}
+
+// ================================================================ searches
+
+const std::vector<InEdge> kZeroEdge = {{0, 1, 0, 1}, {0, 2, 5, 1}, {2, 1, 5, 1}};
+
+TEST(ContractExamples, SPF_zero_edge) {
+  const auto r = search(kZeroEdge, 0, 1);
+  EXPECT_EQ(r.distance, std::optional<Cost>(1));
+  EXPECT_EQ(r.dag, (Ints {0}));
+}
+TEST(ContractExamples, SPF_zero_edge_residual) {
+  const auto r = search(kZeroEdge, 0, 1, Amounts {0, 5, 5});
+  EXPECT_EQ(r.distance, std::optional<Cost>(2));
+  EXPECT_EQ(r.dag, (Ints {1, 2}));
+}
+TEST(ContractExamples, KSP_zero_edge) {
+  const auto r = search(kZeroEdge, 0, 1, std::nullopt, 2);
+  EXPECT_EQ(r.paths, (std::vector<std::pair<Cost, Ints>> {{1, {0}}, {2, {1, 2}}}));
+}
+TEST(ContractExamples, KSP_zero_edge_residual) {
+  const auto r = search(kZeroEdge, 0, 1, Amounts {0, 5, 5}, 2);
+  EXPECT_EQ(r.paths, (std::vector<std::pair<Cost, Ints>> {{2, {1, 2}}}));
+}
+
+// A ceiling of another type is a Python value; in C++ the ceiling is a variant of the two types.
+// The valid part: with a residual of the wrong length, ksp refuses the residual (the type check
+// that comes first has nothing to refuse here).
+TEST(ContractExamples, KSP_ceiling_type) {
+  static_assert(std::variant_size_v<CostCeiling> == 2);
+  const auto r = search({{0, 1, 10, 5}}, 0, 1, Amounts {10, 10}, 2);
+  EXPECT_EQ(r.error, "residual has length 2, expected 1 (one entry per edge)");
+}
+TEST(ContractExamples, KSP_stretch_below_one) {
+  const auto r = search({{0, 1, 10, 5}}, 0, 1, std::nullopt, 2, CostStretch(1, 2));
+  EXPECT_EQ(r.error, "cost_ceiling CostStretch factor must be >= 1 (got 1/2)");
+}
+TEST(ContractExamples, KSP_ceiling_before_residual) {
+  const auto r = search({{0, 1, 10, 5}}, 0, 1, Amounts {10, 10}, 2, CostStretch(1, 2));
+  EXPECT_EQ(r.error, "cost_ceiling CostStretch factor must be >= 1 (got 1/2)");
+}
+TEST(ContractExamples, KSP_residual_length) {
+  const auto r = search({{0, 1, 10, 5}}, 0, 1, Amounts {10, 10}, 2, CostStretch(3, 2));
+  EXPECT_EQ(r.error, "residual has length 2, expected 1 (one entry per edge)");
+}
+// numpy.float32(1.2) is the fraction 6/5 (its own shortest decimal).
+TEST(ContractExamples, KSP_stretch_numpy) {
+  const auto r = search({{0, 1, 0, 100000000}, {0, 1, 10, 120000001}}, 0, 1, Amounts {0, 10}, 2, CostStretch(6, 5));
+  EXPECT_EQ(r.error, "");
+  EXPECT_TRUE(r.paths.empty());
+}
+TEST(ContractExamples, KSP_stretch_numpy_equal) {
+  const auto r = search({{0, 1, 0, 100000000}, {0, 1, 10, 120000000}}, 0, 1, Amounts {0, 10}, 2, CostStretch(6, 5));
+  EXPECT_EQ(r.paths, (std::vector<std::pair<Cost, Ints>> {{120000000, {1}}}));
+}
+// The float 1.2 is the fraction 6/5.
+TEST(ContractExamples, KSP_stretch_boundary) {
+  const auto r = search({{0, 1, 0, 5}, {0, 1, 10, 6}}, 0, 1, Amounts {0, 10}, 2, CostStretch(6, 5));
+  EXPECT_EQ(r.paths, (std::vector<std::pair<Cost, Ints>> {{6, {1}}}));
+}
+TEST(ContractExamples, KSP_stretch_below) {
+  const auto r = search({{0, 1, 0, 5}, {0, 1, 10, 6}}, 0, 1, Amounts {0, 10}, 2, CostStretch(11, 10));
+  EXPECT_EQ(r.error, "");
+  EXPECT_TRUE(r.paths.empty());
+}
+
+TEST(ContractExamples, TIE_parallel) {
+  const std::vector<InEdge> e = {{0, 1, 4, 1}, {0, 1, 10, 1}, {0, 1, 100, 1}, {0, 1, 1000, 2}};
+  const Amounts avail = {4, 8, 5, 1000};
+  EXPECT_EQ(tie_choice(e, 0, 1, RouteTieBreak::FewerHops, avail), (Ints {0}));
+  EXPECT_EQ(tie_choice(e, 0, 1, RouteTieBreak::HigherCapacity, avail), (Ints {2}));
+  EXPECT_EQ(tie_choice(e, 0, 1, RouteTieBreak::HigherAvailableCapacity, avail), (Ints {1}));
+  EXPECT_EQ(tie_choice(e, 0, 1, RouteTieBreak::HigherHeadroom, avail), (Ints {0}));
+}
+TEST(ContractExamples, TIE_routes) {
+  const std::vector<InEdge> e = {{0, 1, 10, 1}, {0, 2, 3, 2}, {1, 2, 10, 1}};
+  EXPECT_EQ(tie_choice(e, 0, 2, RouteTieBreak::FewerHops), (Ints {1}));
+  EXPECT_EQ(tie_choice(e, 0, 2, RouteTieBreak::HigherCapacity), (Ints {0, 2}));
+  EXPECT_EQ(tie_choice(e, 0, 2, RouteTieBreak::HigherAvailableCapacity), (Ints {0, 2}));
+  EXPECT_EQ(tie_choice(e, 0, 2, RouteTieBreak::HigherHeadroom), (Ints {1}));
+}
+TEST(ContractExamples, TIE_bottleneck) {
+  const std::vector<InEdge> e = {{0, 1, 10, 1}, {0, 2, 3, 2}, {1, 2, 1, 1}};
+  for (const auto t : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity, RouteTieBreak::HigherAvailableCapacity,
+                       RouteTieBreak::HigherHeadroom}) {
+    EXPECT_EQ(tie_choice(e, 0, 2, t), (Ints {1}));
+  }
+}
+
+// ================================================================ exact flows
+
+const std::vector<InEdge> kB1 = {{0, 3, 2, 1}, {1, 2, 10, 1}, {2, 3, 10, 2}};
+const std::vector<InEdge> kB2 = {{0, 1, 4, 1}, {0, 2, 2, 1}, {1, 2, 10, 1}};
+
+void expect_flow(const FlowOut& got, Amount delivered, Amount cost, const Amounts& flows) {
+  EXPECT_EQ(got.delivered, delivered);
+  EXPECT_EQ(got.cost, cost);
+  EXPECT_EQ(got.edge_flows, flows);
+}
+TEST(ContractExamples, B1_equal) { expect_flow(exact_flow(kB1, v({0, 1}), v({3}), 12, SourceAllocation::Equal), 4, 8, {2, 2, 2}); }
+TEST(ContractExamples, B1_optimized) {
+  expect_flow(exact_flow(kB1, v({0, 1}), v({3}), 12, SourceAllocation::Optimized), 12, 32, {2, 10, 10});
+}
+TEST(ContractExamples, MINCUT_B1) {
+  const auto r = exact_flow(kB1, v({0, 1}), v({3}), std::nullopt, SourceAllocation::Optimized);
+  EXPECT_EQ(r.delivered, 12);
+  EXPECT_EQ(r.min_cut, std::optional<Ints>(Ints {0, 1}));
+}
+TEST(ContractExamples, MINCUT_zero_edge) {
+  const auto r = exact_flow({{0, 2, 0, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), std::nullopt, SourceAllocation::Optimized);
+  EXPECT_EQ(r.delivered, 10);
+  EXPECT_EQ(r.min_cut, std::optional<Ints>(Ints {0, 1}));
+}
+TEST(ContractExamples, B2_equal_global) { expect_flow(exact_flow(kB2, v({0, 1}), v({2}), 12, SourceAllocation::Equal), 12, 16, {4, 2, 10}); }
+TEST(ContractExamples, B2_shortest) {
+  expect_flow(exact_flow({{0, 2, 2, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 12, SourceAllocation::Equal), 4, 4, {2, 2});
+}
+TEST(ContractExamples, B2_optimized) {
+  expect_flow(exact_flow(kB2, v({0, 1}), v({2}), 12, SourceAllocation::Optimized), 12, 12, {0, 2, 10});
+}
+TEST(ContractExamples, B3_zero_first) {
+  expect_flow(exact_flow({{0, 2, 0, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 10, SourceAllocation::Equal), 0, 0, {0, 0});
+}
+TEST(ContractExamples, B3_positive_first) {
+  expect_flow(exact_flow({{0, 2, 10, 1}, {1, 2, 0, 1}}, v({0, 1}), v({2}), 10, SourceAllocation::Equal), 1, 1, {1, 0});
+}
+TEST(ContractExamples, B3_delete_zero) {
+  expect_flow(exact_flow({{0, 2, 0, 1}, {1, 2, 10, 1}}, v({1}), v({2}), 10, SourceAllocation::Equal), 10, 10, {0, 10});
+}
+TEST(ContractExamples, E_support) {
+  expect_flow(exact_flow({{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 2, 1}, {2, 3, 10, 2}}, v({0}), v({3}), 12, SourceAllocation::Equal), 12, 34,
+              {2, 10, 2, 10});
+}
+TEST(ContractExamples, E_support_shortest) {
+  expect_flow(exact_flow({{0, 1, 10, 1}, {1, 3, 2, 1}}, v({0}), v({3}), 12, SourceAllocation::Equal), 2, 4, {2, 2});
+}
+TEST(ContractExamples, T2_OPT_global) {
+  expect_flow(exact_flow({{0, 2, 2, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 12, SourceAllocation::Optimized), 12, 12, {2, 10});
+}
+
+// Two sources with private links (capacities 2 and 10, costs 9 and 1), equal sources, Lossless
+// increments of 3: the second call can add only 1 (both sources must carry the same).
+TEST(ContractExamples, R4_lossless_equal) {
+  const Net n({{0, 2, 2, 9}, {1, 2, 10, 1}});
+  auto p = policy(n, v({0, 1}), v({2}), {.routing = centralized(SourceAllocation::Equal)});
+  const auto a = p->place(3);
+  const auto b = p->place(3, kFlows);
+  EXPECT_EQ((Amounts {a.call_delivered, b.call_delivered}), (Amounts {3, 1}));
+  EXPECT_EQ(n.in_order(*b.edge_flows), (Amounts {2, 2}));
+  EXPECT_EQ(b.delivered, 4);
+  EXPECT_EQ(lo(b.total_cost), 20);
+}
+
+// One unit from 0 to 2 over 0 -> 2 (cost 1) or 0 -> 1 -> 0 -> 2 (a cycle 0 -> 1 -> 0 of cost 2): the
+// library's flow is the minimum-cost one, [0, 1, 0] at cost 1, with no positive-flow cycle; the
+// cyclic flow [1, 1, 1] costs 3, above that minimum.
+const std::vector<InEdge> kWitness = {{0, 1, 1, 1}, {0, 2, 1, 1}, {1, 0, 1, 1}};
+TEST(ContractExamples, R3_residual_optimal) {
+  const auto r = exact_flow(kWitness, v({0}), v({2}), 1, SourceAllocation::Optimized);
+  EXPECT_EQ(r.edge_flows, (Amounts {0, 1, 0}));
+  EXPECT_EQ(r.cost, 1);
+}
+TEST(ContractExamples, R3_residual_cyclic) {
+  const auto r = exact_flow(kWitness, v({0}), v({2}), 1, SourceAllocation::Optimized);
+  EXPECT_EQ(r.cost, 1);  // the minimum cost at value 1
+  const Amounts cyclic = {1, 1, 1};
+  Amount cost = 0;
+  for (std::size_t e = 0; e < cyclic.size(); ++e) cost += cyclic[e] * kWitness[e].cost;
+  EXPECT_EQ(cost, 3);
+  EXPECT_NE(r.edge_flows, cyclic);  // not the minimum-cost flow
+}
+
+// ================================================================ T1
+
+void expect_t1_base(const T1Out& r, const Amounts& requested, const Routes& routes, std::int64_t up, Amount reserved,
+                    const Amounts& reservations, Amount bound_) {
+  EXPECT_EQ(r.error, "");
+  EXPECT_EQ(r.requested, requested);
+  EXPECT_EQ(r.routes, routes);
+  EXPECT_EQ(r.up, up);
+  EXPECT_EQ(r.reserved, reserved);
+  EXPECT_EQ(r.edge_reservations, reservations);
+  EXPECT_EQ(r.bound, bound_);
+}
+void expect_t1_offer(const T1Out& r, const Amounts& offered, Amount source_drops, const Amounts& no_drop_load) {
+  EXPECT_EQ(r.offered_by_entry, offered);
+  EXPECT_EQ(r.source_drops, source_drops);
+  EXPECT_EQ(r.no_drop_load, no_drop_load);
+}
+
+TEST(ContractExamples, A_X1) {
+  const auto r = t1({{{0, 1, 6, 1}, {0, 1, 6, 2}}, v({0}), v({1}), 12, 4, 13});
+  expect_t1_base(r, {3, 3, 3, 3}, {{0}, {0}, {1}, {1}}, 4, 12, {6, 6}, 12);
+  expect_t1_offer(r, {4, 3, 3, 3}, 0, {7, 6});
+  EXPECT_EQ(r.lossy_delivery, 12);
+  EXPECT_EQ(r.lossy_edge_drops, (Amounts {1, 0}));
+  EXPECT_EQ(r.lossless_admitted, 12);
+  EXPECT_EQ(r.lossless_unadmitted, 1);
+}
+TEST(ContractExamples, A_X2) {
+  const auto r = t1({{{0, 1, 3, 1}, {0, 1, 2, 2}}, v({0}), v({1}), 5, 2, 5});
+  expect_t1_base(r, {3, 2}, {{0}, {1}}, 2, 5, {3, 2}, 5);
+  expect_t1_offer(r, {3, 2}, 0, {3, 2});
+}
+TEST(ContractExamples, A_X2_small_share) {
+  const auto r = t1({{{0, 1, 6, 1}, {0, 1, 6, 2}}, v({0}), v({1}), 1, 2, 1});
+  expect_t1_base(r, {1, 0}, {{0}, {0}}, 2, 1, {1, 0}, 6);
+  expect_t1_offer(r, {1, 0}, 0, {1, 0});
+  EXPECT_EQ(r.status, (Texts {"UP", "UP"}));
+}
+TEST(ContractExamples, T1_over_reservation) {
+  const auto r = t1({{{0, 1, 5, 1}, {0, 1, 5, 1}}, v({0}), v({1}), 8, 2, 10});
+  EXPECT_EQ(r.requested, (Amounts {4, 4}));
+  EXPECT_EQ(r.routes, (Routes {{0}, {1}}));
+  EXPECT_EQ(r.edge_reservations, (Amounts {4, 4}));
+  EXPECT_EQ(r.offered_by_entry, (Amounts {5, 5}));
+  EXPECT_EQ(r.no_drop_load, (Amounts {5, 5}));
+  EXPECT_EQ(r.lossy_delivery, 10);
+  EXPECT_EQ(r.lossy_edge_drops, (Amounts {0, 0}));
+  EXPECT_EQ(r.bound, 10);
+}
+TEST(ContractExamples, T1_zero_link_drop) {
+  const auto r = t1({{{0, 1, 0, 1}}, v({0}), v({1}), 0, 1, 1});
+  EXPECT_EQ(r.requested, (Amounts {0}));
+  EXPECT_EQ(r.routes, (Routes {{0}}));
+  EXPECT_EQ(r.status, (Texts {"UP"}));
+  EXPECT_EQ(r.offered_by_entry, (Amounts {1}));
+  EXPECT_EQ(r.source_drops, 0);
+  EXPECT_EQ(r.lossy_delivery, 0);
+  EXPECT_EQ(r.lossy_edge_drops, (Amounts {1}));
+  EXPECT_EQ(r.bound, 0);
+  EXPECT_EQ(r.lossless_admitted, 0);
+  EXPECT_EQ(r.lossless_unadmitted, 1);
+}
+TEST(ContractExamples, A_X3) {
+  const auto r = t1({{{0, 1, 2, 1}, {0, 1, 10, 2}}, v({0}), v({1}), 12, 4, 12});
+  expect_t1_base(r, {3, 3, 3, 3}, {{1}, {1}, {1}, {}}, 3, 9, {0, 9}, 10);
+  expect_t1_offer(r, {4, 4, 4, 0}, 0, {0, 12});
+  EXPECT_EQ(r.status, (Texts {"UP", "UP", "UP", "INSUFFICIENT_BANDWIDTH"}));
+}
+TEST(ContractExamples, A_X4) {
+  const auto r = t1({{{0, 2, 6, 1}, {1, 2, 6, 1}, {2, 3, 6, 1}}, v({0, 1}), v({3}), 12, 2, 12});
+  expect_t1_base(r, {3, 3, 3, 3}, {{0, 2}, {1, 2}, {}, {}}, 2, 6, {3, 3, 6}, 6);
+  expect_t1_offer(r, {6, 6, 0, 0}, 0, {6, 6, 12});
+}
+TEST(ContractExamples, A_X5) {
+  const auto r = t1({fan(3, 20), v({0, 1, 2}), v({3}), 2, 1, 3});
+  expect_t1_base(r, {1, 1, 0}, {{0}, {1}, {2}}, 3, 2, {1, 1, 0}, 60);
+  expect_t1_offer(r, {1, 1, 1}, 0, {1, 1, 1});
+}
+TEST(ContractExamples, A_X6) {
+  const auto r = t1({{{0, 1, 5, 1}, {0, 1, 5, 1}}, v({0}), v({1}), 8, 2, 8});
+  expect_t1_base(r, {4, 4}, {{0}, {1}}, 2, 8, {4, 4}, 10);
+  expect_t1_offer(r, {4, 4}, 0, {4, 4});
+}
+TEST(ContractExamples, A_X8) {
+  const auto r = t1({kX8, v({0, 1}), v({2}), 4, 1, 4});
+  expect_t1_base(r, {2, 2}, {{}, {1}}, 1, 2, {0, 2}, 0);
+  expect_t1_offer(r, {0, 2}, 2, {0, 2});
+}
+TEST(ContractExamples, A_X9) {
+  const auto r = t1({kG1, v({0}), v({3}), 49152, 16, 49152});
+  Routes routes = {{0, 2}, {0, 2}};
+  for (int i = 0; i < 13; ++i) routes.push_back({1, 3});
+  routes.push_back({});
+  expect_t1_base(r, Amounts(16, 3072), routes, 15, 46080, {6144, 39936, 6144, 39936}, 47262);
+  Amounts offered(12, 3277);
+  for (int i = 0; i < 3; ++i) offered.push_back(3276);
+  offered.push_back(0);
+  expect_t1_offer(r, offered, 0, {6554, 42598, 6554, 42598});
+}
+TEST(ContractExamples, A_X9_large_design) {
+  const auto r = t1({kG1, v({0}), v({3}), 409600, 16});
+  Routes routes = {{1, 3}};
+  for (int i = 0; i < 15; ++i) routes.push_back({});
+  expect_t1_base(r, Amounts(16, 25600), routes, 1, 25600, {0, 25600, 0, 25600}, 40960);
+}
+TEST(ContractExamples, A_X8_delete_zero_edge) {
+  T1In in {kX8, v({0, 1}), v({2}), 4, 1};
+  in.excluded = {0};
+  expect_t1_base(t1(in), {4}, {{1}}, 1, 4, {0, 4}, 8);
+}
+TEST(ContractExamples, A_X8_Stretch2) {
+  T1In in {kX8, v({0, 1}), v({2}), 4, 1};
+  in.stretch = CostStretch(2);
+  const auto r = t1(in);
+  expect_t1_base(r, {2, 2}, {{}, {}}, 0, 0, {0, 0}, 0);
+  EXPECT_EQ(r.status, (Texts {"INSUFFICIENT_BANDWIDTH", "COST_CEILING_EXCEEDED"}));
+}
+TEST(ContractExamples, A_X8_Absolute3) {
+  T1In in {kX8, v({0, 1}), v({2}), 4, 1};
+  in.absolute = 3;
+  const auto r = t1(in);
+  expect_t1_base(r, {2, 2}, {{}, {1}}, 1, 2, {0, 2}, 0);
+  EXPECT_EQ(r.status, (Texts {"INSUFFICIENT_BANDWIDTH", "UP"}));
+}
+// The float factor 1.2 is the fraction 6/5: cost 6 against 5 * 6/5 = 6 is admitted.
+TEST(ContractExamples, A_X8_Stretch_exact) {
+  T1In in {{{0, 1, 0, 5}, {0, 1, 1, 6}}, v({0}), v({1}), 1, 1, 1};
+  in.stretch = CostStretch(6, 5);
+  const auto r = t1(in);
+  EXPECT_EQ(r.status, (Texts {"UP"}));
+  EXPECT_EQ(r.routes, (Routes {{1}}));
+  EXPECT_EQ(r.up, 1);
+  EXPECT_EQ(r.lossy_delivery, 1);
+  EXPECT_EQ(r.source_drops, 0);
+  EXPECT_EQ(r.lossless_admitted, 1);
+}
+TEST(ContractExamples, A_X8_Stretch_cost7) {
+  T1In in {{{0, 1, 0, 5}, {0, 1, 1, 7}}, v({0}), v({1}), 1, 1, 1};
+  in.stretch = CostStretch(6, 5);
+  const auto r = t1(in);
+  EXPECT_EQ(r.status, (Texts {"COST_CEILING_EXCEEDED"}));
+  EXPECT_EQ(r.routes, (Routes {{}}));
+  EXPECT_EQ(r.up, 0);
+  EXPECT_EQ(r.lossy_delivery, 0);
+  EXPECT_EQ(r.source_drops, 1);
+  EXPECT_EQ(r.lossless_admitted, 0);
+}
+TEST(ContractExamples, A_X7_8) { expect_t1_base(t1({kX7, v({0}), v({3}), 8, 2}), {4, 4}, {{0, 2, 4}, {}}, 1, 4, {4, 0, 4, 0, 4}, 4); }
+TEST(ContractExamples, A_X7_10) { expect_t1_base(t1({kX7, v({0}), v({3}), 10, 2}), {5, 5}, {{0, 3}, {1, 4}}, 2, 10, {5, 5, 0, 5, 5}, 12); }
+TEST(ContractExamples, A_X7_14) { expect_t1_base(t1({kX7, v({0}), v({3}), 14, 2}), {7, 7}, {{}, {}}, 0, 0, {0, 0, 0, 0, 0}, 0); }
+TEST(ContractExamples, T1_two_heads) {
+  const auto r = t1({{{0, 2, 2, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 12, 2, 12});
+  expect_t1_base(r, {3, 3, 3, 3}, {{}, {1}, {}, {1}}, 2, 6, {0, 6}, 0);
+  EXPECT_EQ(r.status, (Texts {"INSUFFICIENT_BANDWIDTH", "UP", "INSUFFICIENT_BANDWIDTH", "UP"}));
+  expect_t1_offer(r, {0, 3, 0, 3}, 6, {0, 6});
+  EXPECT_EQ(r.lossy_delivery, 6);
+}
+TEST(ContractExamples, T1_idle) {
+  const auto r = t1({{{0, 1, 10, 1}}, v({0}), v({1}), 3, 4, 3});
+  expect_t1_base(r, {1, 1, 1, 0}, {{0}, {0}, {0}, {0}}, 4, 3, {3}, 10);
+  expect_t1_offer(r, {1, 1, 1, 0}, 0, {3});
+  EXPECT_EQ(r.lossy_delivery, 3);
+}
+TEST(ContractExamples, T1_idle_zero_link) {
+  const auto r = t1({{{0, 1, 0, 1}, {0, 1, 10, 2}}, v({0}), v({1}), 1, 2, 2});
+  expect_t1_base(r, {1, 0}, {{1}, {0}}, 2, 1, {0, 1}, 1);
+  EXPECT_EQ(r.status, (Texts {"UP", "UP"}));
+  expect_t1_offer(r, {1, 1}, 0, {1, 1});
+  EXPECT_EQ(r.lossy_delivery, 1);
+}
+TEST(ContractExamples, T1_zero_design) {
+  const auto r = t1({{{0, 1, 10, 1}}, v({0}), v({1}), 0, 2, 4});
+  expect_t1_base(r, {0, 0}, {{0}, {0}}, 2, 0, {0}, 10);
+  expect_t1_offer(r, {2, 2}, 0, {4});
+  EXPECT_EQ(r.lossy_delivery, 4);
+}
+TEST(ContractExamples, T1_stretch_below_one) {
+  T1In in {{{0, 1, 10, 5}}, v({0}), v({1}), 1, 1, 1};
+  in.stretch = CostStretch(1, 2);
+  EXPECT_EQ(t1(in).error, "cost_ceiling CostStretch factor must be >= 1 (got 1/2)");
+}
+// Two heads with two tunnels each, design 5: RR(5, 2) = (3, 2) per head, then per tunnel in round
+// order: (2, 1) for head 0's rounds and (1, 1) for head 1's.
+TEST(ContractExamples, T1_split) {
+  const auto r = t1({fan(2, 100), v({0, 1}), v({2}), 5, 2});
+  EXPECT_EQ(r.requested, (Amounts {2, 1, 1, 1}));
+}
+
+// ================================================================ T2
+
+void expect_t2_core(const T2Out& r, Amount U, const Ints& counts, std::pair<Amount, Amount> fluid, Amount max_lossless) {
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, U);
+  EXPECT_EQ(r.counts, counts);
+  EXPECT_EQ(r.plan.max_fractional_bandwidth_per_tunnel, fluid);
+  EXPECT_EQ(r.plan.max_lossless_offer, max_lossless);
+}
+Routes repeat(const Routes& parts, const std::vector<int>& times) {
+  Routes out;
+  for (std::size_t i = 0; i < parts.size(); ++i) {
+    for (int t = 0; t < times[i]; ++t) out.push_back(parts[i]);
+  }
+  return out;
+}
+
+TEST(ContractExamples, C_G1) {
+  T2In in {kG1, v({0}), v({3}), 16, 49152};
+  in.prefer_headroom = true;
+  in.lossy_offer = 49152;
+  const auto r = t2(in);
+  expect_t2_core(r, 2925, {2, 14, 2, 14}, fraction(20480, 7), 46812);
+  EXPECT_EQ(r.lossy_delivery, 47104);
+  EXPECT_EQ(r.paths, repeat({{0, 2}, {1, 3}}, {2, 14}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(73610035200));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 46800);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(32));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 2925);
+}
+TEST(ContractExamples, C_G1_finite) {
+  T2In in {kG1, v({0}), v({3}), 16, 8192};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  expect_t2_core(r, 2925, {2, 14, 2, 14}, fraction(20480, 7), 46812);
+  EXPECT_EQ(r.paths, repeat({{0, 2}, {1, 3}}, {2, 14}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(12884901876));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 8192);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(32));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 512);
+}
+TEST(ContractExamples, C_G4) {
+  std::vector<InEdge> e;
+  for (NodeId i = 1; i <= 15; ++i) e.push_back({0, i, 4096, 1});
+  for (NodeId i = 1; i <= 15; ++i) e.push_back({i, 16, 4096, 1});
+  T2In in {e, v({0}), v({16}), 16, 61440};
+  in.prefer_headroom = true;
+  in.lossy_offer = 61440;
+  const auto r = t2(in);
+  Ints counts(30, 1);
+  counts[0] = 2;
+  counts[15] = 2;
+  expect_t2_core(r, 2048, counts, fraction(2048), 32768);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 2048);
+  Routes paths = {{0, 15}, {0, 15}};
+  for (std::int64_t i = 1; i < 15; ++i) paths.push_back({i, 15 + i});
+  EXPECT_EQ(r.paths, paths);
+  EXPECT_EQ(r.lossy_delivery, 57856);
+  EXPECT_EQ(r.plan.headroom_penalty, c128(73014444032));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 32768);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(32));
+}
+TEST(ContractExamples, C_equal) {
+  T2In in {{{0, 2, 3, 1}, {1, 2, 8, 1}}, v({0, 1}), v({2}), 2, 6};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  expect_t2_core(r, 1, {2, 2}, fraction(3, 2), 6);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}, {0}, {1}}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(5905580031));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 4);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(4));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+}
+TEST(ContractExamples, C_finite_cost) {
+  T2In in {{{0, 1, 2, 1}, {0, 1, 10, 2}}, v({0}), v({1}), 2, 2};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  expect_t2_core(r, 5, {2, 0}, fraction(5), 2);
+  EXPECT_EQ(r.paths, (Routes {{0}, {0}}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(6442450944));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 2);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(2));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+}
+TEST(ContractExamples, C_G10_0) {
+  T2In in {kG10, v({0}), v({3}), 16, 49152};
+  in.prefer_headroom = true;
+  in.cap = Amounts {40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480, 40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480};
+  const auto r = t2(in);
+  expect_t2_core(r, 6144, {4, 4, 8, 0, 4, 0, 0, 4, 0, 0, 0, 0, 4, 0, 0, 0, 4, 0}, fraction(6144), 49160);
+  EXPECT_EQ(r.paths, repeat({{0, 4, 7}, {1, 16, 12}, {2}}, {4, 4, 8}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(38654705652));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 49152);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(40));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 3072);
+}
+TEST(ContractExamples, C_G10_1) {
+  T2In in {kG10, v({1}), v({4}), 16, 49152};
+  in.prefer_headroom = true;
+  in.cap = Amounts {28672, 28672, 0, 40960, 28672, 16384, 40960, 28672, 20480, 40960, 40960, 24576, 28672, 40960, 16384, 40960, 28672, 20480};
+  const auto r = t2(in);
+  expect_t2_core(r, 4096, {0, 6, 0, 6, 5, 5, 0, 5, 0, 0, 5, 0, 0, 0, 0, 0, 6, 0}, fraction(4096), 52431);
+  EXPECT_EQ(r.paths, repeat({{3, 1, 16}, {4, 7, 10}, {5}}, {6, 5, 5}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 49152);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(43));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 3072);
+}
+TEST(ContractExamples, C_G10_2) {
+  T2In in {kG10, v({2}), v({5}), 16, 49152};
+  in.prefer_headroom = true;
+  in.cap = Amounts {28672, 10240, 0, 22528, 13312, 1024, 40960, 13312, 20480, 40960, 25600, 24576, 28672, 40960, 16384, 40960, 10240, 20480};
+  const auto r = t2(in);
+  expect_t2_core(r, 2560, {0, 4, 0, 4, 0, 0, 4, 4, 8, 0, 4, 0, 0, 4, 0, 0, 0, 0}, fraction(2560), 40960);
+  EXPECT_EQ(r.paths, repeat({{6, 3, 1}, {7, 10, 13}, {8}}, {4, 4, 8}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 40960);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(40));
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 2560);
+}
+// The plan's alg-internal supply budget (21) is no public field; every public one is checked.
+TEST(ContractExamples, T2_dead_head) {
+  T2In in {{{0, 2, 0, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 2, 10};
+  in.prefer_headroom = true;
+  in.lossy_offer = 10;
+  const auto r = t2(in);
+  EXPECT_EQ(r.entry_ids, (std::vector<std::int32_t> {1, 3}));
+  EXPECT_EQ(r.plan.design_by_head, (std::vector<std::pair<NodeId, Amount>> {{0, 5}, {1, 5}}));
+  EXPECT_EQ(r.plan.heads_with_capacity, std::optional<std::vector<NodeId>>(v({1})));
+  expect_t2_core(r, 5, {0, 2}, fraction(5), 0);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 3);
+  EXPECT_EQ(r.paths, (Routes {{1}, {1}}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 6);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(2));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(3865470565));
+  EXPECT_EQ(r.lossy_delivery, 5);
+  EXPECT_EQ(r.lossy_source_drops, 5);
+}
+TEST(ContractExamples, T2_two_heads_equal) {
+  T2In in {{{0, 2, 2, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 2};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.entry_ids, (std::vector<std::int32_t> {0, 1, 2, 3}));
+  EXPECT_TRUE(r.plan.design_by_head.empty());
+  expect_t2_core(r, 1, {2, 2}, fraction(1), 4);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}, {0}, {1}}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 4);
+  EXPECT_EQ(r.plan.total_tunnel_cost, c128(4));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(7730941132));
+}
+TEST(ContractExamples, T2_idle) {
+  T2In in {{{0, 1, 10, 1}}, v({0}), v({1}), 4, 3};
+  in.prefer_headroom = true;
+  in.lossy_offer = 3;
+  const auto r = t2(in);
+  expect_t2_core(r, 2, {4}, fraction(5, 2), 10);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 4);
+  EXPECT_EQ(r.plan.headroom_penalty, c128(4294967294));
+  EXPECT_EQ(r.lossy_delivery, 3);
+}
+TEST(ContractExamples, T2_zero_design) {
+  T2In in {{{0, 1, 10, 1}}, v({0}), v({1}), 2, 0};
+  in.prefer_headroom = true;
+  in.lossy_offer = 4;
+  const auto r = t2(in);
+  expect_t2_core(r, 5, {2}, fraction(5), 10);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 2);
+  EXPECT_EQ(r.lossy_delivery, 4);
+}
+TEST(ContractExamples, T2_remainder_first) {
+  T2In in {{{0, 1, 3, 1}, {0, 1, 2, 1}}, v({0}), v({1}), 2, 5};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  expect_t2_core(r, 2, {1, 1}, fraction(2), 5);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 2);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 4);
+}
+TEST(ContractExamples, T2_remainder_second) {
+  T2In in {{{0, 1, 2, 1}, {0, 1, 3, 1}}, v({0}), v({1}), 2, 5};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  expect_t2_core(r, 2, {1, 1}, fraction(2), 4);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 2);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}}));
+  EXPECT_EQ(r.plan.total_planned_bandwidth, 4);
+}
+TEST(ContractExamples, T2_tiny_head) {
+  T2In in {{{0, 2, 1, 1}, {1, 2, 100, 1}}, v({0, 1}), v({2}), 16};
+  in.prefer_headroom = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.heads_with_capacity, std::optional<std::vector<NodeId>>(v({0, 1})));
+  expect_t2_core(r, 0, {0, 0}, fraction(1, 16), 0);
+  EXPECT_TRUE(r.paths.empty());
+  EXPECT_EQ(r.plan.insufficient_resolution, std::optional<bool>(true));
+}
+TEST(ContractExamples, T2_prefer_headroom_off) {
+  T2In in {{{0, 1, 10, 1}, {0, 1, 10, 1}}, v({0}), v({1}), 2, 2};
+  in.lossy_offer = 12;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, 10);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.counts, (Ints {2, 0}));
+  EXPECT_EQ(r.plan.max_lossless_offer, 10);
+  EXPECT_EQ(r.lossy_delivery, 10);
+}
+TEST(ContractExamples, T2_prefer_headroom_on) {
+  T2In in {{{0, 1, 10, 1}, {0, 1, 10, 1}}, v({0}), v({1}), 2, 2};
+  in.prefer_headroom = true;
+  in.lossy_offer = 12;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, 10);
+  EXPECT_EQ(r.plan.planned_bandwidth_per_tunnel, 1);
+  EXPECT_EQ(r.counts, (Ints {1, 1}));
+  EXPECT_EQ(r.plan.headroom_penalty, c128(858993458));
+  EXPECT_EQ(r.plan.max_lossless_offer, 20);
+  EXPECT_EQ(r.lossy_delivery, 12);
+}
+TEST(ContractExamples, T2_support) {
+  T2In in {kSup, v({0}), v({1}), 2};
+  in.support = Ints {0, 1};
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, 6);
+  EXPECT_EQ(r.counts, (Ints {1, 1, 0}));
+  EXPECT_EQ(r.plan.max_lossless_offer, 12);
+}
+TEST(ContractExamples, T2_support_masked) {
+  T2In in {kSup, v({0}), v({1}), 2};
+  in.support = Ints {0, 1};
+  in.excluded = {1};
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, 3);
+  EXPECT_EQ(r.counts, (Ints {2, 0, 0}));
+  EXPECT_EQ(r.paths, (Routes {{0}, {0}}));
+  EXPECT_EQ(r.entry_ids, (std::vector<std::int32_t> {0, 1}));
+  EXPECT_EQ(r.plan.max_lossless_offer, 6);
+}
+TEST(ContractExamples, T2_support_mask_outside) {
+  T2In in {kSup, v({0}), v({1}), 2};
+  in.support = Ints {0, 1};
+  in.excluded = {2};
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.max_bandwidth_per_tunnel, 6);
+  EXPECT_EQ(r.counts, (Ints {1, 1, 0}));
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}}));
+  EXPECT_EQ(r.entry_ids, (std::vector<std::int32_t> {0, 1}));
+  EXPECT_EQ(r.plan.max_lossless_offer, 12);
+}
+
+// "Up to L": the chosen count, the delivery of the design (the bound without one) and the paths.
+// Each count's bound is the lossless maximum of that count's program (every head live here).
+std::vector<Amount> upto_bounds(const T2In& base, std::int64_t limit) {
+  std::vector<Amount> out;
+  for (std::int64_t k = 1; k <= limit; ++k) {
+    T2In in = base;
+    in.per_head = k;
+    in.up_to = false;
+    T2In unlimited = in;
+    unlimited.design_demand = std::nullopt;
+    out.push_back(*t2(unlimited).plan.max_lossless_offer);
+  }
+  return out;
+}
+TEST(ContractExamples, C_G1_UP_TO) {
+  T2In in {kG1, v({0}), v({3}), 6, 49152};
+  in.prefer_headroom = true;
+  in.up_to = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.tunnels_per_head, 6);
+  EXPECT_EQ(r.delivered, 49152);
+  EXPECT_EQ(upto_bounds(in, 6), (Amounts {40960, 40960, 40960, 40960, 40960, 49152}));  // = the scores (design above)
+}
+TEST(ContractExamples, T2_UP_TO_common) {
+  T2In in {{{0, 3, 6, 1}, {1, 3, 3, 1}, {1, 3, 3, 1}}, v({0, 1}), v({3}), 2, 12};
+  in.prefer_headroom = true;
+  in.up_to = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.tunnels_per_head, 2);
+  EXPECT_EQ(r.delivered, 12);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}, {0}, {2}}));
+  EXPECT_EQ(upto_bounds(in, 2), (Amounts {7, 12}));  // = the scores (design 12)
+}
+// With a dead head the count-selection scores (its supply budget 21 and live share 5) are internal;
+// the public outcome: one tunnel per head, delivery 0 (the dead head's share blocks), path [1].
+TEST(ContractExamples, T2_UP_TO_dead_head) {
+  T2In in {{{0, 2, 0, 1}, {1, 2, 10, 1}}, v({0, 1}), v({2}), 2, 10};
+  in.prefer_headroom = true;
+  in.up_to = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.tunnels_per_head, 1);
+  EXPECT_EQ(r.delivered, 0);
+  EXPECT_EQ(r.paths, (Routes {{1}}));
+}
+TEST(ContractExamples, T2_tiny_head_UP_TO) {
+  T2In in {{{0, 2, 1, 1}, {1, 2, 100, 1}}, v({0, 1}), v({2}), 3};
+  in.prefer_headroom = true;
+  in.up_to = true;
+  const auto r = t2(in);
+  EXPECT_EQ(r.plan.tunnels_per_head, 1);
+  EXPECT_EQ(r.delivered, 2);
+  EXPECT_EQ(r.paths, (Routes {{0}, {1}}));
+  EXPECT_EQ(upto_bounds(in, 3), (Amounts {2, 0, 0}));  // = the scores (no design)
+}
+
+// ================================================================ programs
+
+TEST(ContractExamples, E_duplicates) { EXPECT_EQ(bound({4, 8}, {{0}, {1}, {1}}, {1, 1, 1}), 12); }
+TEST(ContractExamples, E_deduplicated) { EXPECT_EQ(bound({4, 8}, {{0}, {1}}, {1, 1}), 8); }
+TEST(ContractExamples, E_static_path_fill) { EXPECT_EQ(bound({6, 4}, {{0}, {1}}, {1, 1}), 9); }
+TEST(ContractExamples, E_zero_first) { EXPECT_EQ(bound({0, 4}, {{0}, {1}}, {1, 1}), 0); }
+TEST(ContractExamples, E_zero_last) { EXPECT_EQ(bound({4, 0}, {{0}, {1}}, {1, 1}), 1); }
+TEST(ContractExamples, E_support_pinned_bound) { EXPECT_EQ(bound({10, 2, 10, 10}, {{0, 1}, {2, 3}}, {1, 1}), 4); }
+
+// One head, two links of capacity 1 to the destination, two equal split routes over both: separate
+// contexts each put their share on the first link; pooled (from_dag) they split once.
+std::pair<Amount, Amounts> split_contexts(bool pool) {
+  const Net n({{0, 1, 1, 1}, {0, 1, 1, 1}});
+  const NodeId t[1] = {1};
+  std::shared_ptr<const ForwardingProgram> prog;
+  if (pool) {
+    prog = ForwardingProgram::from_dag(*n.g, v({0}), t, n.dag({0, 1}));
+  } else {
+    const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.dag({0, 1}), 1}, RouteDefinition {0, n.dag({0, 1}), 1}};
+    prog = ForwardingProgram::from_routes(*n.g, v({0}), t, defs);
+  }
+  auto ll = policy(n, v({0}), v({1}), {.routing = Pinned {prog, nullptr}});
+  auto ly = policy(n, v({0}), v({1}), {.routing = Pinned {prog, nullptr}, .admission = LY});
+  const auto r = ly->place(2, kFlows);
+  Amounts loads = n.in_order(*r.edge_flows);
+  const Amounts drops = n.per_edge(r.call_edge_drops);
+  for (std::size_t e = 0; e < loads.size(); ++e) loads[e] += drops[e];
+  return {ll->place(std::nullopt).call_delivered, loads};
+}
+TEST(ContractExamples, E_split_contexts) { EXPECT_EQ(split_contexts(false), (std::pair<Amount, Amounts> {1, {2, 0}})); }
+TEST(ContractExamples, E_split_contexts_pooled) { EXPECT_EQ(split_contexts(true), (std::pair<Amount, Amounts> {2, {1, 1}})); }
+
+std::pair<Amount, Amount> dag_contexts(bool pooled, Amount offer) {
+  const Net n(kDP);
+  const NodeId t[1] = {3};
+  std::shared_ptr<const ForwardingProgram> prog;
+  if (pooled) {
+    prog = ForwardingProgram::from_dag(*n.g, v({0, 1}), t, n.dag({0, 1, 2, 3}));
+  } else {
+    const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.dag({0, 1, 2, 3}), 1}, RouteDefinition {1, n.dag({0, 1, 2, 3}), 1}};
+    prog = ForwardingProgram::from_routes(*n.g, v({0, 1}), t, defs);
+  }
+  auto ll = policy(n, v({0, 1}), v({3}), {.routing = Pinned {prog, nullptr}});
+  auto ly = policy(n, v({0, 1}), v({3}), {.routing = Pinned {prog, nullptr}, .admission = LY});
+  return {ll->place(std::nullopt).call_delivered, ly->place(offer).call_delivered};
+}
+TEST(ContractExamples, DAG_pooled) { EXPECT_EQ(dag_contexts(true, 2), (std::pair<Amount, Amount> {2, 2})); }
+TEST(ContractExamples, DAG_separate) { EXPECT_EQ(dag_contexts(false, 2), (std::pair<Amount, Amount> {1, 1})); }
+
+// ================================================================ stale forwarding and repair
+
+const std::vector<InEdge> kDiamond100 = {{0, 1, 100, 1}, {0, 2, 100, 1}, {1, 3, 100, 1}, {2, 3, 100, 1}};
+std::vector<std::optional<Amount>> ones(std::size_t k) { return std::vector<std::optional<Amount>>(k, Amount {1}); }
+
+void expect_stale(const StaleOut& r, Amount delivered, const Amounts& flows, const Amounts& drops, std::optional<Amount> source = std::nullopt) {
+  EXPECT_EQ(r.delivered, delivered);
+  EXPECT_EQ(r.edge_flows, flows);
+  EXPECT_EQ(r.edge_drops, drops);
+  if (source.has_value()) EXPECT_EQ(r.source_drops, *source);
+}
+TEST(ContractExamples, STALE_remote_tail) {
+  StaleIn in {kDiamond100, v({0}), 3, 100, ones(4)};
+  in.black_links = {3};
+  expect_stale(stale_dag(in), 50, {50, 50, 50, 0}, {0, 0, 0, 50});
+}
+TEST(ContractExamples, STALE_remote_tail_repair) {
+  StaleIn in {kDiamond100, v({0}), 3, 100, ones(4)};
+  in.mask_links = {3};
+  expect_stale(stale_dag(in), 100, {100, 0, 100, 0}, {0, 0, 0, 0});
+}
+TEST(ContractExamples, STALE_wcmp_member) {
+  StaleIn in {{{0, 1, 10, 1}, {0, 1, 40, 1}}, v({0}), 1, 40, {Amount {10}, Amount {40}}};
+  in.black_links = {0};
+  expect_stale(stale_dag(in), 32, {0, 32}, {8, 0});
+}
+TEST(ContractExamples, STALE_wcmp_zero_capacity) {
+  const StaleIn in {{{0, 1, 0, 1}, {0, 1, 40, 1}}, v({0}), 1, 40, {Amount {0}, Amount {40}}};
+  expect_stale(stale_dag(in), 40, {0, 40}, {0, 0});
+}
+TEST(ContractExamples, STALE_pooled_original) {
+  const StaleIn in {{{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 3, 10, 1}}, v({0, 1}), 3, 2, ones(4)};
+  expect_stale(stale_dag(in), 2, {1, 1, 1, 1}, {0, 0, 0, 0}, 0);
+}
+TEST(ContractExamples, STALE_pooled_remainder) {
+  StaleIn in {{{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 3, 10, 1}}, v({0, 1}), 3, 2, ones(4)};
+  in.black_links = {0, 3};
+  expect_stale(stale_dag(in), 1, {0, 1, 1, 0}, {1, 0, 0, 0}, 0);
+}
+TEST(ContractExamples, STALE_all_zero_weight) {
+  const StaleIn in {{{0, 1, 0, 1}}, v({0}), 1, 2, {Amount {0}}};
+  expect_stale(stale_dag(in), 0, {0}, {0}, 2);
+}
+TEST(ContractExamples, STALE_black_source) {
+  StaleIn in {{{0, 1, 10, 1}}, v({0}), 1, 10, ones(1)};
+  in.black_nodes = {0};
+  expect_stale(stale_dag(in), 0, {0}, {0}, 10);
+}
+
+TEST(ContractExamples, STALE_relief) {
+  StalePathsIn in {{{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}}, {{0, {0, 2}}, {1, {1, 2}}}, {{0, 10}, {1, 10}}};
+  in.black_links = {0};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"BLACKHOLED", "UP"}));
+  EXPECT_EQ(r.delivered, (Amounts {0, 10}));
+  EXPECT_EQ(r.edge_drops, (Amounts {10, 0, 0}));
+}
+TEST(ContractExamples, STALE_relief_original) {
+  const StalePathsIn in {{{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}}, {{0, {0, 2}}, {1, {1, 2}}}, {{0, 10}, {1, 10}}};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"UP", "UP"}));
+  EXPECT_EQ(r.delivered, (Amounts {5, 5}));
+  EXPECT_EQ(r.edge_drops, (Amounts {0, 0, 10}));
+}
+const std::vector<InEdge> kDiamond10 = {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 10, 1}};
+TEST(ContractExamples, STALE_tunnel_node) {
+  StalePathsIn in {kDiamond10, {{0, {0, 2}}, {0, {1, 3}}}, {{0, 10}}};
+  in.black_nodes = {2};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"UP", "BLACKHOLED"}));
+  EXPECT_EQ(r.assigned, (Amounts {5, 5}));
+  EXPECT_EQ(r.delivered, (Amounts {5, 0}));
+  EXPECT_EQ(r.edge_drops, (Amounts {0, 5, 0, 0}));
+  EXPECT_EQ(r.lossless_admitted, std::optional<Amount>(1));
+}
+TEST(ContractExamples, STALE_tunnel_node_repair) {
+  StalePathsIn in {kDiamond10, {{0, {0, 2}}, {0, {1, 3}}}, {{0, 10}}};
+  in.mask_nodes = {2};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"UP", "FAILED"}));
+  EXPECT_EQ(r.assigned, (Amounts {10, 0}));
+  EXPECT_EQ(r.delivered, (Amounts {10, 0}));
+  EXPECT_EQ(r.edge_drops, (Amounts {0, 0, 0, 0}));
+  EXPECT_EQ(r.lossless_admitted, std::optional<Amount>(10));
+}
+TEST(ContractExamples, STALE_black_source_tunnel) {
+  StalePathsIn in {{{0, 1, 10, 1}}, {{0, {0}}}, {{0, 10}}};
+  in.black_nodes = {0};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"BLACKHOLED"}));
+  EXPECT_EQ(r.assigned, (Amounts {0}));
+  EXPECT_EQ(r.delivered, (Amounts {0}));
+  EXPECT_EQ(r.source_drops, 10);
+  EXPECT_EQ(r.edge_drops, (Amounts {0}));
+}
+TEST(ContractExamples, STALE_mask_and_black_hole) {
+  StalePathsIn in {{{0, 1, 10, 1}, {0, 2, 10, 1}, {0, 3, 10, 1}, {1, 4, 10, 1}, {2, 4, 10, 1}, {3, 4, 10, 1}},
+                   {{0, {0, 3}}, {0, {1, 4}}, {0, {2, 5}}},
+                   {{0, 10}}};
+  in.mask_links = {3};
+  in.black_links = {3, 4};
+  const auto r = stale_paths(in);
+  EXPECT_EQ(r.status, (Texts {"FAILED", "BLACKHOLED", "UP"}));
+  EXPECT_EQ(r.assigned, (Amounts {0, 5, 5}));
+  EXPECT_EQ(r.delivered, (Amounts {0, 0, 5}));
+  EXPECT_EQ(r.edge_drops, (Amounts {0, 0, 0, 0, 5, 0}));
+  EXPECT_EQ(r.source_drops, 0);
+}
+
+// ================================================================ the Lossy loss rule
+
+void expect_lossy(const LossyOut& r, const Routes& carried, const std::optional<Routes>& drops, const Amounts& delivered,
+                  const Amounts& flows) {
+  EXPECT_EQ(r.error, "");
+  EXPECT_EQ(r.carried, carried);
+  if (drops.has_value()) EXPECT_EQ(r.edge_drops, *drops);
+  EXPECT_EQ(r.delivered, delivered);
+  EXPECT_EQ(r.edge_flows, flows);
+}
+TEST(ContractExamples, D_merge) { expect_lossy(lossy({8, 4}, {{0}, {0}}, {9}), {{6}, {3}}, Routes {{2}, {1}}, {6, 3}, {9}); }
+TEST(ContractExamples, D_key_tie) { expect_lossy(lossy({1, 1}, {{0}, {0}}, {1}), {{1}, {0}}, Routes {{0}, {1}}, {1, 0}, {1}); }
+TEST(ContractExamples, D_rounding) {
+  expect_lossy(lossy({5, 1, 1}, {{0}, {0}, {0}}, {3}), {{3}, {0}, {0}}, Routes {{2}, {1}, {1}}, {3, 0, 0}, {3});
+}
+// Demand 0 (routes 0 and 1) and demand 1 (route 2): the demand level is the head level here (two
+// heads offered 2 each), the route level below it.
+TEST(ContractExamples, D_hierarchy) {
+  expect_lossy(lossy({1, 1, 2}, {{0}, {0}, {0}}, {1}, {0, 0, 1}), {{1}, {0}, {0}}, Routes {{0}, {1}, {2}}, {1, 0, 0}, {1});
+}
+TEST(ContractExamples, D_cycle_compressed) {
+  expect_lossy(lossy({1, 1}, {{0, 1}, {1, 0}}, {2, 2}), {{1, 1}, {1, 1}}, Routes {{0, 0}, {0, 0}}, {1, 1}, {2, 2});
+}
+TEST(ContractExamples, D_zero_service) { expect_lossy(lossy({2}, {{0}}, {0}), {{0}}, Routes {{2}}, {0}, {0}); }
+TEST(ContractExamples, D_subdivision_before) {
+  expect_lossy(lossy({1, 1, 1}, {{0, 1}, {0, 2}, {0, 3}}, {1, 1, 1, 1}), {{1, 1}, {0, 0}, {0, 0}}, std::nullopt, {1, 0, 0}, {1, 1, 0, 0});
+}
+TEST(ContractExamples, D_subdivision_after) {
+  expect_lossy(lossy({1, 1, 1}, {{0, 1, 2}, {0, 3}, {0, 4}}, {1, 1, 1, 1, 1}), {{1, 1, 1}, {0, 0}, {0, 0}}, std::nullopt, {1, 0, 0},
+               {1, 1, 1, 0, 0});
+}
+TEST(ContractExamples, E_support_pinned_loss) {
+  expect_lossy(lossy({6, 6}, {{0, 1}, {2, 3}}, {10, 2, 10, 10}), {{6, 2}, {6, 6}}, Routes {{0, 4}, {0, 0}}, {2, 6}, {6, 2, 6, 6});
+}
+// The forwarding's alternating state is an error (the round count it took is internal).
+TEST(ContractExamples, D_C2) {
+  EXPECT_EQ(lossy({1, 2}, {{0, 1}, {1, 0}}, {1, 2}).error, "lossy forwarding iteration entered a period-2 cycle");
+}
+
+// ================================================================ ledger, epochs, increments
+
+// A T1 tunnel reserving 6 of a link of 10 and carrying 4: the ledger's four views; a replace from 4
+// to 2 has delivery delta -2.
+TEST(ContractExamples, E_ledger) {
+  const Net n({{0, 1, 10, 1}});
+  auto p = policy(n, v({0}), v({1}), {.routing = dte_with(1), .admission = LY});
+  (void)p->replace(4, design_of(6));
+  EXPECT_EQ(p.ledger->carried(), (Amounts {4}));
+  EXPECT_EQ(p.ledger->residual(), (Amounts {6}));
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {6}));
+  EXPECT_EQ(p.ledger->unreserved(), (Amounts {4}));
+  EXPECT_EQ(p->replace(2, design_of(6)).delivery_delta, -2);
+}
+
+void expect_epoch(const EpochOut& r, Amount requested, Amount delivered, Amount drops, const Amounts& flows, const Amounts& residual,
+                  const Amounts& per_call) {
+  EXPECT_EQ(r.requested, requested);
+  EXPECT_EQ(r.delivered, delivered);
+  EXPECT_EQ(r.edge_drops, drops);
+  EXPECT_EQ(r.edge_flows, flows);
+  EXPECT_EQ(r.residual, residual);
+  EXPECT_EQ(r.per_call, per_call);
+}
+TEST(ContractExamples, RC02_increment) { expect_epoch(epoch({1, 1}, {1, 1}, false, LY), 2, 1, 1, {1, 0}, {0, 1}, {1, 0}); }
+TEST(ContractExamples, RC02_increment_lossless) { expect_epoch(epoch({1, 1}, {1, 1}, false, LL), 2, 2, 0, {1, 1}, {0, 0}, {1, 1}); }
+TEST(ContractExamples, RC02_full) { expect_epoch(epoch({1, 1}, {1, 1}, true, LY), 2, 2, 0, {1, 1}, {0, 0}, {2}); }
+
+TEST(ContractExamples, INC_lossless) {
+  const auto r = increments({1, 3}, {3, 1}, LL);
+  EXPECT_EQ(r.call_delivered, (Amounts {2, 0}));
+  EXPECT_EQ(r.requested, 4);
+  EXPECT_EQ(r.admitted, std::optional<Amount>(2));
+  EXPECT_EQ(r.unadmitted, std::optional<Amount>(2));
+  EXPECT_EQ(r.offered, std::nullopt);
+  EXPECT_EQ(r.delivered, 2);
+}
+TEST(ContractExamples, INC_lossy) {
+  const auto r = increments({1, 3}, {3, 1}, LY);
+  EXPECT_EQ(r.call_delivered, (Amounts {2, 1}));
+  EXPECT_EQ(r.requested, 4);
+  EXPECT_EQ(r.offered, std::optional<Amount>(4));
+  EXPECT_EQ(r.edge_drops, (Amounts {1, 0}));
+  EXPECT_EQ(r.unadmitted, std::optional<Amount>(0));
+  EXPECT_EQ(r.delivered, 3);
+}
+TEST(ContractExamples, INC_lossless_refusal) {
+  const auto r = increments({10}, {5, 1}, LL, {{8}, {5}});
+  EXPECT_EQ(r.call_delivered, (Amounts {2, 1}));
+  EXPECT_EQ(r.requested, 6);
+  EXPECT_EQ(r.admitted, std::optional<Amount>(3));
+  EXPECT_EQ(r.unadmitted, std::optional<Amount>(3));
+  EXPECT_EQ(r.delivered, 3);
+}
+// The delivery after each call: a refused unit is not offered again (2 then 3), not 2 then 5.
+TEST(ContractExamples, R4_refusal) {
+  const auto r = increments({10}, {5, 1}, LL, {{8}, {5}});
+  const Amounts correct = {r.call_delivered[0], r.call_delivered[0] + r.call_delivered[1]};
+  EXPECT_EQ(correct, (Amounts {2, 3}));
+  EXPECT_NE(correct, (Amounts {2, 5}));
+}
+
+// place(0) on a new policy: nothing prepared, nothing changed; the residual is the service baseline
+// less the other owners' loads (1 and 2).
+TEST(ContractExamples, RC02_zero_unprepared) {
+  const Net n({{0, 1, 5, 1}, {0, 1, 8, 1}});
+  auto ledger = std::make_shared<FlowLedger>(n.g, n.by_id({5, 8}));
+  const NodeId s[1] = {0};
+  const NodeId t[1] = {1};
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.path({0}), 1}, RouteDefinition {0, n.path({1}), 2}};
+  auto other = policy(n, v({0}), v({1}), {.routing = Pinned {ForwardingProgram::from_routes(*n.g, s, t, defs), nullptr}, .admission = LY},
+                      nullptr, ledger);
+  (void)other->place(3);
+  ASSERT_EQ(n.in_order(ledger->carried()), (Amounts {1, 2}));
+  auto p = policy(n, v({0}), v({1}), {.routing = ShortestPaths {}}, nullptr, ledger);
+  const auto r = p->place(0, OutputOptions {.edge_flows = true, .residual = true, .min_cut = true, .edge_reservations = true});
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.call_undelivered, std::optional<Amount>(0));
+  EXPECT_EQ(r.delivery_delta, 0);
+  EXPECT_TRUE(r.call_edge_drops.empty());
+  EXPECT_EQ(r.call_source_drops, 0);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_FALSE(r.routes_changed || r.weights_changed || r.reservations_changed);
+  EXPECT_EQ(r.program, nullptr);
+  EXPECT_EQ(n.in_order(*r.edge_flows), (Amounts {0, 0}));
+  EXPECT_EQ(n.in_order(*r.edge_reservations), (Amounts {0, 0}));
+  EXPECT_EQ(n.in_order(*r.residual), (Amounts {4, 6}));
+  EXPECT_EQ(r.min_cut, std::nullopt);
+  EXPECT_EQ(r.marginal_cost_curve, std::nullopt);
+}
+
+// The change flags of the second and third calls on a one-path program (path capacity 20): a
+// controller re-solving changes its path's weight; a fixed program (Pinned) changes nothing.
+TEST(ContractExamples, FLAGS_controller_increment) {
+  const Net n({{0, 1, 20, 1}});
+  auto p = policy(n, v({0}), v({1}), {.routing = centralized()});
+  (void)p->place(5);
+  const auto b = p->place(5);
+  const auto c = p->replace(10);
+  EXPECT_EQ((std::vector<bool> {b.routes_changed, c.routes_changed}), (std::vector<bool> {false, false}));
+  EXPECT_EQ((std::vector<bool> {b.weights_changed, c.weights_changed}), (std::vector<bool> {true, false}));
+  EXPECT_EQ((std::vector<bool> {b.reservations_changed, c.reservations_changed}), (std::vector<bool> {false, false}));
+}
+TEST(ContractExamples, FLAGS_fixed_offer) {
+  const Net n({{0, 1, 20, 1}});
+  const NodeId s[1] = {0};
+  const NodeId t[1] = {1};
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.path({0}), 1}};
+  auto p = policy(n, v({0}), v({1}), {.routing = Pinned {ForwardingProgram::from_routes(*n.g, s, t, defs), nullptr}});
+  (void)p->replace(5);
+  for (int i = 0; i < 2; ++i) {
+    const auto r = p->replace(10);
+    EXPECT_FALSE(r.routes_changed || r.weights_changed || r.reservations_changed);
+  }
+}
+
+// ================================================================ terminations
+
+TEST(ContractExamples, TERM_T1_all_down) {
+  const Net n(kX7);
+  const auto r = termination(n, v({0}), v({3}), dte_with(2), 14, design_of(14));
+  EXPECT_EQ(r.tunnels, 2U);
+  EXPECT_EQ(r.lossy, "COMPLETE");
+  EXPECT_EQ(r.lossless, "EXHAUSTED");
+  EXPECT_EQ(r.source_drops, (Amounts {14}));
+  EXPECT_EQ(r.forward_error, "");
+}
+TEST(ContractExamples, TERM_T2_all_dead) {
+  const Net n({{0, 2, 0, 1}, {1, 2, 0, 1}});
+  const auto r = termination(n, v({0, 1}), v({2}), centralized(SourceAllocation::Equal, {}, TunnelCount {2}), 10, design_of(10));
+  EXPECT_EQ(r.tunnels, 0U);
+  EXPECT_EQ(r.lossy, "COMPLETE");
+  EXPECT_EQ(r.lossless, "EXHAUSTED");
+  EXPECT_EQ(r.source_drops, (Amounts {5, 5}));
+  EXPECT_EQ(r.forward_error, "");
+}
+// One head, one tunnel of weight 0: no head can forward.
+TEST(ContractExamples, TERM_zero_weight_route) {
+  const Net n({{0, 1, 10, 1}});
+  const NodeId s[1] = {0};
+  const NodeId t[1] = {1};
+  const std::vector<RouteDefinition> defs = {RouteDefinition {0, n.path({0}), 0}};
+  const auto r = termination(n, v({0}), v({1}), Pinned {ForwardingProgram::from_routes(*n.g, s, t, defs), nullptr}, 4, std::nullopt);
+  EXPECT_EQ(r.tunnels, 1U);
+  EXPECT_EQ(r.lossy, "NO_ACTIVE_WEIGHT");
+  EXPECT_EQ(r.lossless, "NO_ACTIVE_WEIGHT");
+  EXPECT_EQ(r.source_drops, (Amounts {4}));
+}
+TEST(ContractExamples, T2_no_tunnels_forward) {
+  const Net n({{0, 2, 1, 1}, {1, 2, 100, 1}});
+  const auto r = termination(n, v({0, 1}), v({2}), centralized(SourceAllocation::Equal, {}, TunnelCount {16}), 10, kUnlimited);
+  EXPECT_EQ(r.tunnels, 0U);
+  EXPECT_EQ(r.lossy, "COMPLETE");
+  EXPECT_EQ(r.lossless, "EXHAUSTED");
+  EXPECT_EQ(r.source_drops, (Amounts {5, 5}));
+  EXPECT_EQ(r.forward_error, "");
+}
+
+// ================================================================ texts
+
+TEST(ContractExamples, ERR_ownership_texts) {
+  const Net n(kDP);
+  const Net other(kDP);
+  const NodeId t[1] = {3};
+  const auto foreign_program = ForwardingProgram::from_dag(*other.g, v({0, 1}), t, other.dag({0, 1, 2, 3}));
+  const auto foreign_mask = std::make_shared<const Eligibility>(other.g->eligibility({}, std::vector<EdgeId> {0}));
+  ShortestPathCache foreign_cache(*other.g);
+  FlowLedger fg(n.g);
+  auto make = [&](FlowPolicyConfig c, const Eligibility* m = nullptr, ShortestPathCache* cache = nullptr) {
+    return error_of([&] { FlowPolicy p(fg, v({0, 1}), v({3}), std::move(c), m, cache); });
+  };
+  const Texts got = {
+      make({.routing = Pinned {foreign_program, nullptr}}),
+      make({.routing = centralized(SourceAllocation::Optimized, other.dag({0, 2}))}),
+      make({.routing = Pinned {ForwardingProgram::from_dag(*n.g, v({0, 1}), t, n.dag({0, 1, 2, 3})), foreign_mask}}),
+      make({.routing = ShortestPaths {}}, foreign_mask.get()),
+      make({.routing = ShortestPaths {}}, nullptr, &foreign_cache),
+      error_of([&] { (void)ForwardingProgram::from_dag(*n.g, v({0, 1}), t, other.dag({0, 1, 2, 3})); }),
+  };
+  EXPECT_EQ(got, (Texts {"program belongs to another graph", "support belongs to another graph", "black_holes belongs to another graph",
+                         "foreign Eligibility: built for another graph", "foreign ShortestPathCache: bound to another graph",
+                         "dag belongs to another graph"}));
+}
+
+// The T1 search minimum and the ledger's reservation baseline (its length, then each entry).
+TEST(ContractExamples, ERR_unreserved_texts) {
+  const Net n({{0, 1, 10, 1}, {0, 1, 10, 1}});
+  auto minimum = [&](Amount x) { return error_of([&] { (void)policy(n, v({0}), v({1}), {.routing = dte_with(1, false, std::nullopt, x)}); }); };
+  auto baseline = [&](Amounts r) {
+    const Amounts service = {10, 10};
+    return error_of([&] { FlowLedger fg(n.g, service, r); });
+  };
+  EXPECT_EQ(minimum(Amount {1} << 62), "min_unreserved_bandwidth must be an integer in [0, 2^62)");
+  EXPECT_EQ(baseline({1, 2, 3}), "reservation_baseline has length 3, expected 2 (one entry per edge)");
+  EXPECT_EQ(minimum(-1), "min_unreserved_bandwidth must be an integer in [0, 2^62)");
+  EXPECT_EQ(baseline(n.by_id({5, 11})), "reservation_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]");
+  EXPECT_EQ(minimum(0), "");
+  EXPECT_EQ(baseline({10, 0}), "");
+}
+
+// ================================================================ the configuration
+
+TEST(ContractExamples, CFG_defaults) {
+  EXPECT_EQ(config_case(ShortestPaths {}),
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True");
+  EXPECT_EQ(config_case(sp_with(RouteAllocation::Equal)),
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True");
+  EXPECT_EQ(config_case(sp_with(RouteAllocation::Weighted)),
+            "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True");
+  EXPECT_EQ(config_case(sp_with(RouteAllocation::Optimized)),
+            "allocation=OPTIMIZED source_allocation=OPTIMIZED weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True");
+  EXPECT_EQ(config_case(centralized(SourceAllocation::Equal, {}, TunnelCount {16})),
+            "source_allocation=EQUAL support=None tunnel_count=16 prefer_headroom=False");
+}
+
+// Every case is a construction TypeError of the Python surface (a missing or None source
+// allocation, a keyword of another model). In C++ the same shapes cannot be written: CentralizedTE
+// has no default constructor, and the models have only their own fields.
+TEST(ContractExamples, CFG_construction) {
+  static_assert(!std::is_default_constructible_v<CentralizedTE>);
+  static_assert(std::is_constructible_v<CentralizedTE, SourceAllocation>);
+  static_assert(std::is_aggregate_v<DistributedTE> && std::is_aggregate_v<ShortestPaths> && std::is_aggregate_v<FlowPolicyConfig>);
+}
+
+TEST(ContractExamples, CFG_matrix) {
+  const Net& n = config_net();
+  const Texts got = {
+      config_case(sp_with(RouteAllocation::Equal, SourceAllocation::Optimized)),
+      config_case(sp_with(RouteAllocation::Optimized), 1, LY),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, std::nullopt, RouteTieBreak::HigherCapacity)),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, std::nullopt, RouteTieBreak::HigherCapacity, false), 2),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, std::nullopt, RouteTieBreak::HigherCapacity, false)),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, std::nullopt, RouteTieBreak::HigherHeadroom, true, false), 2),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, WeightBasis::Capacity)),
+      config_case(sp_with(RouteAllocation::Weighted, std::nullopt, WeightBasis::Explicit)),
+      config_case(centralized(SourceAllocation::Optimized, {}, TunnelCount {2}), 2),
+      config_case(centralized(SourceAllocation::Optimized, {}, TunnelCount {2})),
+      config_case(centralized(SourceAllocation::Equal), 1, LY),
+      config_case(centralized(SourceAllocation::Equal, {}, std::nullopt, true)),
+      config_case(centralized(SourceAllocation::Equal, n.dag({1}), TunnelCount {2}), 1, LY),
+      config_case(dte_with(4, true)),
+  };
+  EXPECT_EQ(got, (Texts {
+                     "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+                     "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+                     "ShortestPaths tie_break requires multipath=False or parallel_edges=False",
+                     "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False",
+                     "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_CAPACITY multipath=False parallel_edges=True",
+                     "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_HEADROOM multipath=True parallel_edges=False",
+                     "weight_basis requires allocation=WEIGHTED",
+                     "weight_basis=EXPLICIT requires edge_weights",
+                     "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+                     "source_allocation=OPTIMIZED support=None tunnel_count=2 prefer_headroom=False",
+                     "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+                     "prefer_headroom requires tunnel_count",
+                     "source_allocation=EQUAL support=dag tunnel_count=2 prefer_headroom=False",
+                     "DistributedTE requires an exact tunnel count",
+                 }));
+}
+
+TEST(ContractExamples, CFG_first_error) {
+  const Texts got = {
+      config_case(centralized(SourceAllocation::Equal, {}, std::nullopt, true), 1, LY),
+      config_case(sp_with(RouteAllocation::Equal, SourceAllocation::Optimized, WeightBasis::Capacity)),
+      config_case(sp_with(RouteAllocation::Optimized, std::nullopt, std::nullopt, RouteTieBreak::HigherCapacity), 1, LY),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, WeightBasis::Capacity, RouteTieBreak::HigherCapacity)),
+      config_case(sp_with(RouteAllocation::Equal, std::nullopt, WeightBasis::Capacity, RouteTieBreak::HigherCapacity, false), 2),
+      config_case(centralized(SourceAllocation::Optimized, {}, TunnelCount {0}, true), 2),
+      config_case(dte_with(0, true, CostStretch(1, 2))),
+      config_case(dte_with(4, true, CostStretch(1, 2))),
+      config_case(dte_with(4, false, CostStretch(1, 2), -1)),
+      config_case(dte_with(4, false, std::nullopt, -1)),
+  };
+  EXPECT_EQ(got, (Texts {
+                     "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+                     "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+                     "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+                     "ShortestPaths tie_break requires multipath=False or parallel_edges=False",
+                     "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False",
+                     "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+                     "tunnel count must be in [1, 10000]",
+                     "DistributedTE requires an exact tunnel count",
+                     "cost_ceiling CostStretch factor must be >= 1 (got 1/2)",
+                     "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+                 }));
+}
+
+TEST(ContractExamples, CFG_cache_order) {
+  const Net& n = config_net();
+  const auto to2 = config_pinned(n, 2);
+  const auto to1 = config_pinned(n, 1);
+  const std::pair<std::vector<NodeId>, std::vector<NodeId>> ends {v({0}), v({1})};
+  const Texts got = {
+      config_case(dte_with(0), 1, LL, true),
+      config_case(to2, 1, LL, true, ends),
+      config_case(centralized(SourceAllocation::Equal, {}, TunnelCount {0}), 1, LL, true),
+      config_case(centralized(SourceAllocation::Equal, {}, std::nullopt, true), 1, LL, true),
+      config_case(sp_with(RouteAllocation::Weighted), 1, LL, true),
+      config_case(dte_with(0)),
+      config_case(to2, 1, LL, false, ends),
+      config_case(to1, 1, LL, false, ends),
+  };
+  EXPECT_EQ(got, (Texts {
+                     "DistributedTE does not use ShortestPathCache",
+                     "Pinned does not use ShortestPathCache",
+                     "CentralizedTE does not use ShortestPathCache",
+                     "prefer_headroom requires tunnel_count",
+                     "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+                     "tunnel count must be in [1, 10000]",
+                     "program endpoints do not match policy endpoints",
+                     "valid",
+                 }));
+}
+
+// A ceiling of another type (a float, an int) is a Python TypeError: the C++ ceiling is a variant of
+// AbsoluteCost and CostStretch. The valid case: the fraction 3/2.
+TEST(ContractExamples, CFG_ceiling_type) {
+  static_assert(!std::is_constructible_v<CostCeiling, double>);
+  EXPECT_EQ(config_case(dte_with(4, false, CostStretch(3, 2))), "valid");
+}
+
+TEST(ContractExamples, EVAL_first_error) {
+  const Net& n = config_net();
+  const DesignArg inf {std::in_place, std::nullopt};
+  const Texts got = {
+      evaluation_case(centralized(SourceAllocation::Equal, {}, std::nullopt, true), LL, design_of(-1), std::nullopt),
+      evaluation_case(dte_with(4), LY, design_of(-1), inf),
+      evaluation_case(dte_with(4), LY, design_of(5), inf),
+      evaluation_case(dte_with(4), LY, std::nullopt, std::nullopt),
+      evaluation_case(dte_with(4), LY, std::nullopt, design_of(10)),
+      evaluation_case(ShortestPaths {}, LL, inf, design_of(5)),
+      evaluation_case(ShortestPaths {}, LL, std::nullopt, design_of(5)),
+      evaluation_case(centralized(SourceAllocation::Equal, {}, TunnelCount {16}), LY, std::nullopt, std::nullopt),
+      evaluation_case(centralized(SourceAllocation::Equal, {}, TunnelCount {16}), LY, std::nullopt, design_of(10)),
+      evaluation_case(config_pinned(n, 2), LY, std::nullopt, std::nullopt),
+      evaluation_case(ShortestPaths {}, LY, std::nullopt, std::nullopt),
+      evaluation_case(ShortestPaths {}, LY, design_of(4), std::nullopt),
+  };
+  EXPECT_EQ(got, (Texts {
+                     "prefer_headroom requires tunnel_count",
+                     "offer must be an integer in [0, 2^62)",
+                     "DistributedTE requires a finite design demand",
+                     "DistributedTE evaluation requires design_demand",
+                     "DistributedTE LOSSY evaluation requires a finite offer",
+                     "offer must be an integer in [0, 2^62)",
+                     "ShortestPaths does not accept design_demand",
+                     "CentralizedTE LOSSY evaluation requires a finite offer",
+                     "offer=10 design_demand=10",
+                     "Pinned LOSSY evaluation requires a finite offer",
+                     "offer=first-hop experiment design_demand=None",
+                     "offer=4 design_demand=None",
+                 }));
+}
+
+// An explicit +inf offer is refused by the evaluator after the configuration. A string offer is a
+// Python TypeError with no C++ form (the C++ offer is an amount or +inf).
+TEST(ContractExamples, EVAL_offer_infinite) {
+  const DesignArg inf {std::in_place, std::nullopt};
+  EXPECT_EQ(evaluation_case(centralized(SourceAllocation::Equal, {}, std::nullopt, true), LL, inf, std::nullopt),
+            "prefer_headroom requires tunnel_count");
+  EXPECT_EQ(evaluation_case(ShortestPaths {}, LL, inf, std::nullopt), "offer must be an integer in [0, 2^62)");
+}
+
+// ECMP Lossy over parallel links from 0 to 1: the baseline and each single-link deletion at a fixed
+// offer, or without one (the first-hop experiment: each first-hop link injects its own capacity).
+// The baseline and each deletion's reduction, and the baseline's accounting: requested (-1 for an
+// infinite request), offered and the drop on each link.
+struct OfferOut {
+  Amount baseline;
+  Amounts reductions;
+  Amount requested;
+  Amount offered;
+  Amounts edge_drops;
+  bool operator==(const OfferOut&) const = default;
+};
+OfferOut evaluate_offer(const Amounts& caps, DesignArg offer) {
+  std::vector<InEdge> rows;
+  for (Amount c : caps) rows.push_back({0, 1, c, 1});
+  const Net n(rows);
+  EvaluationOptions o {{.routing = ShortestPaths {}, .admission = LY}};
+  o.offer = offer;
+  const auto s = evaluate_edge_failures(*n.g, v({0}), v({1}), o, 1);
+  Amounts reductions(n.m(), 0);
+  for (const auto& e : s.entries) reductions[static_cast<std::size_t>(n.pos(e.edge))] = e.delivery_reduction;
+  return {s.baseline.call_delivered, reductions, lo(s.baseline.requested), lo(s.baseline.offered),
+          n.per_edge(s.baseline.edge_drops)};
+}
+TEST(ContractExamples, EVAL_fixed_offer) {
+  const auto r = evaluate_offer({10, 10}, design_of(4));
+  EXPECT_EQ(r.baseline, 4);
+  EXPECT_EQ(r.reductions, (Amounts {0, 0}));
+}
+TEST(ContractExamples, EVAL_first_hop) {
+  const auto r = evaluate_offer({10, 10}, std::nullopt);
+  EXPECT_EQ(r.baseline, 20);
+  EXPECT_EQ(r.reductions, (Amounts {10, 10}));
+}
+// Each link injects its own free capacity (here its capacity): 14 delivered, nothing dropped.
+TEST(ContractExamples, EVAL_first_hop_unequal) {
+  EXPECT_EQ(evaluate_offer({4, 10}, std::nullopt), (OfferOut {14, {4, 10}, -1, 14, {0, 0}}));
+}
+// A finite offer splits by round robin: 6 per link, 2 dropped on the link of 4.
+TEST(ContractExamples, EVAL_fixed_offer_unequal) {
+  EXPECT_EQ(evaluate_offer({4, 10}, design_of(12)), (OfferOut {10, {0, 6}, 12, 12, {2, 0}}));
+}
+
+// ================================================================ CostStretch's exact fraction
+
+std::string reduced(const CostStretch& f) { return std::to_string(f.numerator()) + "/" + std::to_string(f.denominator()); }
+
+// The C++ value of each factor: a fraction reduced; an integer n/1; the float 1.2 is 6/5, 1.1 is
+// 11/10, 1.5 is 3/2. The Python conversions (a float's shortest decimal, a non-finite float, an
+// integer or a component beyond 64 bits, a bool or a string) have no C++ form; a denominator below 1
+// is the C++ refusal.
+TEST(ContractExamples, STRETCH_values) {
+  EXPECT_EQ(reduced(CostStretch(6, 5)), "6/5");
+  EXPECT_EQ(reduced(CostStretch(11, 10)), "11/10");
+  EXPECT_EQ(reduced(CostStretch(3, 2)), "3/2");
+  EXPECT_EQ(reduced(CostStretch(7500000000000001, 25000000000000000)), "7500000000000001/25000000000000000");
+  EXPECT_EQ(reduced(CostStretch(12, 10)), "6/5");
+  EXPECT_EQ(reduced(CostStretch(Amount {1} << 62, Amount {1} << 60)), "4/1");
+  EXPECT_EQ(reduced(CostStretch(2)), "2/1");
+  EXPECT_EQ(reduced(CostStretch(3)), "3/1");
+  EXPECT_EQ(error_of([] { (void)CostStretch(1, 0); }), "CostStretch fraction denominator must be in [1, 2^63)");
+  EXPECT_TRUE(CostStretch(15, 10) == CostStretch(3, 2));
+  EXPECT_TRUE(CostStretch(6, 5) == CostStretch(12, 10));
+  EXPECT_FALSE(CostStretch(6, 5) == CostStretch(5404319552844595, 4503599627370496));
+}
+// NumPy factors are Python values; their C++ values: float32/float16/float64 1.2 are 6/5, float32
+// 0.30000001192092896 is 3/10, int64 2 is 2/1.
+TEST(ContractExamples, STRETCH_numpy) {
+  EXPECT_EQ(reduced(CostStretch(6, 5)), "6/5");
+  EXPECT_EQ(reduced(CostStretch(3, 10)), "3/10");
+  EXPECT_EQ(reduced(CostStretch(2)), "2/1");
+  EXPECT_TRUE(CostStretch(6, 5) == CostStretch(6, 5));
+}
+
+// ================================================================ several demands at once (apply_actions)
+
+namespace {
+
+// The list form of the loss examples: each route is its own demand, a Pinned LOSSY policy (created
+// in route order), all in one SIMULTANEOUS list. Each abstract link e gets its own two nodes; each
+// route runs from its own head through its links to one destination, consecutive links joined by a
+// link that never limits anything, except where e is fused to f (fused_links): there e's head is f's
+// tail (no join), so the examples' serial pairs stay pairs. `dark[i]`: the abstract links route i's
+// demand black-holes. `forms[i]` (default kTunnel) realizes route i as:
+// - kTunnel: one tunnel;
+// - kDagRoute: the same links as a supplied DAG route alone (a pooled context);
+// - kDagBesideExit: that DAG route beside a tunnel on its head's own exit to the destination (a split
+//   route of a program that is not pooled), offered twice the route's offer (each entry gets it);
+// - kZeroBranch: a DAG route of the route's links plus that exit, beside the exit tunnel, offered 2:
+//   each entry gets 1 and round robin sends the DAG route's unit to the exit (a lower EdgeId than
+//   the route's first link), so every member on the route has a whole-unit share of 0 (the route's
+//   offer is not used);
+// - kEntryTunnel, kEntryDag: a tunnel or a DAG route in route 0's program, from route 0's head, of
+//   weight its offer (0: an empty entry); no participant of its own, its black holes not used; route
+//   0 (a tunnel) then has weight its offer and is offered `offer0` (default: the sum of its
+//   program's weights): with every other route an entry, the list is one scalar call.
+// Per participant (a route of its own) its rows on its route's links and its delivery (a split route
+// beside an exit: without the exit's units); the structure (hooks): the abstract links that wait
+// (after serial normalization), the cyclic groups, their rounds and the dependency arcs.
+enum Form { kTunnel, kDagRoute, kDagBesideExit, kZeroBranch, kEntryTunnel, kEntryDag };
+struct ListOut {
+  std::string error;
+  std::int64_t rounds {-1};  // hooks only, as the three below
+  std::int64_t groups {-1};
+  Ints barrier_links;
+  std::int64_t dependencies {-1};
+  Routes arrivals;
+  Routes carried;
+  Routes edge_drops;
+  Amounts delivered;
+  Amounts edge_flows;
+  Texts status;
+};
+bool black_holed(const std::vector<Ints>& dark, std::size_t i, std::int64_t e) {
+  return i < dark.size() && std::find(dark[i].begin(), dark[i].end(), e) != dark[i].end();
+}
+// Per link the link it is fused to (-1: none): every occurrence of e that can carry something
+// continues on f and every such occurrence of f comes from e. A zero offer carries nothing, and a
+// route's traffic stops at its own black hole (which still arrives from the link before it). A
+// pair that would make a route visit a node twice (a dead occurrence on e going elsewhere and one
+// on f) is joined instead: a tunnel is a simple path.
+Ints fused_links(const Amounts& offers, const Routes& routes, std::size_t L, const std::vector<Ints>& dark) {
+  std::vector<std::set<std::int64_t>> next(L);
+  std::vector<std::set<std::int64_t>> prev(L);
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    if (offers[i] == 0) continue;
+    const auto& r = routes[i];
+    for (std::size_t j = 0; j < r.size(); ++j) {
+      prev[static_cast<std::size_t>(r[j])].insert(j > 0 ? r[j - 1] : -1);
+      if (black_holed(dark, i, r[j])) break;
+      next[static_cast<std::size_t>(r[j])].insert(j + 1 < r.size() ? r[j + 1] : -1);
+    }
+  }
+  Ints out(L, -1);
+  for (std::size_t e = 0; e < L; ++e) {
+    const auto& s = next[e];
+    if (s.size() == 1 && *s.begin() >= 0 && prev[static_cast<std::size_t>(*s.begin())] == std::set<std::int64_t> {static_cast<std::int64_t>(e)}) out[e] = *s.begin();
+  }
+  for (bool changed = true; changed;) {
+    changed = false;
+    for (const auto& r : routes) {
+      // Its nodes: a tail is e, a head L + e (a fused head is the next link's tail).
+      std::vector<std::int64_t> nodes {r.front()};
+      for (std::size_t j = 0; j < r.size(); ++j) {
+        const auto f = out[static_cast<std::size_t>(r[j])];
+        nodes.push_back(f >= 0 ? f : static_cast<std::int64_t>(L) + r[j]);
+        if (j + 1 < r.size() && f != r[j + 1]) nodes.push_back(r[j + 1]);
+      }
+      if (std::set<std::int64_t>(nodes.begin(), nodes.end()).size() == nodes.size()) continue;
+      for (std::size_t j = 0; j < r.size(); ++j) {
+        auto& f = out[static_cast<std::size_t>(r[j])];
+        if (f >= 0 && (j + 1 == r.size() || f != r[j + 1])) f = -1;  // e without its f
+        for (auto& g : out) {
+          if (g == r[j] && (j == 0 || out[static_cast<std::size_t>(r[j - 1])] != r[j])) g = -1;  // f without its e
+        }
+      }
+      changed = true;
+    }
+  }
+  return out;
+}
+ListOut list_lossy(const Amounts& offers, const Routes& routes, const Amounts& cap, const std::vector<Ints>& dark = {},
+                   const std::optional<Ints>& fusing = std::nullopt, const std::vector<Form>& forms = {},
+                   std::optional<Amount> offer0 = std::nullopt) {
+  const auto L = static_cast<std::int64_t>(cap.size());
+  const Ints fuse = fusing.value_or(fused_links(offers, routes, cap.size(), dark));
+  auto fused = [&](std::int64_t e, std::int64_t f) { return fuse[static_cast<std::size_t>(e)] == f; };
+  auto form = [&](std::size_t i) { return i < forms.size() ? forms[i] : kTunnel; };
+  auto own = [&](std::size_t i) { return form(i) != kEntryTunnel && form(i) != kEntryDag; };
+  // Nodes: heads 0..n-1, the destination n, then per link a tail and a head (a fused head is the
+  // next link's tail).
+  const auto n = static_cast<NodeId>(routes.size());
+  const NodeId dest = n;
+  std::vector<NodeId> tail(cap.size());
+  std::vector<NodeId> head(cap.size());
+  NodeId next_node = n + 1;
+  for (std::int64_t e = 0; e < L; ++e) tail[static_cast<std::size_t>(e)] = next_node++;
+  for (std::int64_t e = 0; e < L; ++e) {
+    const auto f = fuse[static_cast<std::size_t>(e)];
+    head[static_cast<std::size_t>(e)] = f >= 0 ? tail[static_cast<std::size_t>(f)] : next_node++;
+  }
+  std::vector<InEdge> rows;
+  for (std::int64_t e = 0; e < L; ++e) rows.push_back({tail[static_cast<std::size_t>(e)], head[static_cast<std::size_t>(e)], cap[static_cast<std::size_t>(e)], 1});
+  std::vector<std::vector<std::size_t>> rows_of(routes.size());
+  std::vector<std::size_t> exit_row(routes.size(), 0);
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    const auto& r = routes[i];
+    rows_of[i].push_back(rows.size());
+    rows.push_back({own(i) ? static_cast<NodeId>(i) : NodeId {0}, tail[static_cast<std::size_t>(r.front())], kBig, 1});
+    for (std::size_t j = 0; j < r.size(); ++j) {
+      rows_of[i].push_back(static_cast<std::size_t>(r[j]));
+      if (j + 1 < r.size() && !fused(r[j], r[j + 1])) {
+        rows_of[i].push_back(rows.size());
+        rows.push_back({head[static_cast<std::size_t>(r[j])], tail[static_cast<std::size_t>(r[j + 1])], kBig, 1});
+      }
+    }
+    rows_of[i].push_back(rows.size());
+    rows.push_back({head[static_cast<std::size_t>(r.back())], dest, kBig, 1});
+    if (form(i) == kDagBesideExit || form(i) == kZeroBranch) {
+      exit_row[i] = rows.size();
+      rows.push_back({static_cast<NodeId>(i), dest, kBig, 1});
+    }
+  }
+  const Net net(rows, next_node);
+  auto edges_of = [&](const std::vector<std::size_t>& rs) {
+    std::vector<EdgeId> out;
+    for (auto row : rs) out.push_back(net.id[row]);
+    return out;
+  };
+  auto tunnel_of = [&](const std::vector<std::size_t>& rs) {
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : edges_of(rs)) hops.push_back({e});
+    return std::make_shared<const Path>(*net.g, hops);
+  };
+  auto ledger = std::make_shared<FlowLedger>(net.g);
+  std::vector<std::shared_ptr<const Eligibility>> black;
+  std::vector<std::unique_ptr<FlowPolicy>> policies;
+  std::vector<std::size_t> route_of;  // per participant
+  std::vector<Action> list;
+  for (std::size_t i = 0; i < routes.size(); ++i) {
+    if (!own(i)) continue;
+    const auto h = static_cast<NodeId>(i);
+    std::vector<RouteDefinition> defs;
+    Amount offer = offers[i];
+    switch (form(i)) {
+      case kTunnel:
+        defs.push_back(RouteDefinition {h, tunnel_of(rows_of[i]), i == 0 ? offers[0] : 1});
+        break;
+      case kDagRoute:
+        defs.push_back(RouteDefinition {h, dag_of(*net.g, edges_of(rows_of[i])), 1});
+        break;
+      case kDagBesideExit:
+      case kZeroBranch: {
+        auto rs = rows_of[i];
+        if (form(i) == kZeroBranch) rs.push_back(exit_row[i]);
+        defs.push_back(RouteDefinition {h, dag_of(*net.g, edges_of(rs)), 1});
+        defs.push_back(RouteDefinition {h, tunnel_of({exit_row[i]}), 1});
+        offer = form(i) == kZeroBranch ? 2 : 2 * offers[i];
+        break;
+      }
+      default:
+        break;
+    }
+    if (i == 0) {  // route 0's program holds the entries
+      for (std::size_t k = 1; k < routes.size(); ++k) {
+        if (form(k) == kEntryTunnel) defs.push_back(RouteDefinition {0, tunnel_of(rows_of[k]), offers[k]});
+        if (form(k) == kEntryDag) defs.push_back(RouteDefinition {0, dag_of(*net.g, edges_of(rows_of[k])), offers[k]});
+        if (!own(k)) offer += offers[k];
+      }
+      offer = offer0.value_or(offer);
+    }
+    const NodeId s[1] = {h};
+    const NodeId t[1] = {dest};
+    const auto prog = ForwardingProgram::from_routes(*net.g, s, t, defs);
+    black.push_back(i < dark.size() ? net.mask({}, dark[i]) : nullptr);
+    policies.push_back(std::make_unique<FlowPolicy>(*ledger, std::vector<NodeId> {h}, std::vector<NodeId> {dest},
+                                                    FlowPolicyConfig {.routing = Pinned {prog, black.back()}, .admission = LY}));
+    route_of.push_back(i);
+    list.push_back(Replace {*policies.back(), offer});
+  }
+  ListOut out;
+  std::vector<PlacementResult> res;
+  out.error = error_of([&] { res = apply_actions(*ledger, list, BatchMode::Simultaneous); });
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const auto& counters = detail::thread_lossy_counters();
+  out.rounds = counters.rounds;
+  out.groups = counters.groups;
+  out.dependencies = counters.dependencies;
+  for (std::int64_t e = 0; e < L; ++e) {
+    const EdgeId id = net.id[static_cast<std::size_t>(e)];
+    if (std::find(counters.barriers.begin(), counters.barriers.end(), id) != counters.barriers.end()) out.barrier_links.push_back(e);
+  }
+#endif
+  if (!out.error.empty()) return out;
+  for (std::size_t k = 0; k < policies.size(); ++k) {
+    const std::size_t i = route_of[k];
+    const auto recs = policies[k]->records();
+    Ints a;
+    Ints c;
+    Ints d;
+    for (auto e : routes[i]) {
+      const EdgeId id = net.id[static_cast<std::size_t>(e)];
+      Amount cf = 0;
+      Amount df = 0;
+      for (const auto& rec : recs) {
+        for (const auto& [x, v] : rec.edge_flows) cf += x == id ? v : 0;
+        for (const auto& [x, v] : rec.edge_drops) df += x == id ? lo(v) : 0;
+      }
+      a.push_back(cf + df);
+      c.push_back(cf);
+      d.push_back(df);
+    }
+    out.arrivals.push_back(a);
+    out.carried.push_back(c);
+    out.edge_drops.push_back(d);
+    const Amount exit = form(i) == kDagBesideExit ? offers[i] : form(i) == kZeroBranch ? 2 : 0;
+    out.delivered.push_back(res[k].call_delivered - exit);
+    out.status.push_back(form(i) == kTunnel ? name_of(res[k].by_tunnel.front().status) : "SPLIT");
+  }
+  for (std::int64_t e = 0; e < L; ++e) out.edge_flows.push_back(ledger->carried()[static_cast<std::size_t>(net.id[static_cast<std::size_t>(e)])]);
+  return out;
+}
+
+// The list form of the stale-forwarding cycle examples: each head is its own demand (the reference's
+// labels), a Pinned LOSSY policy over its tunnels with the example's black holes, created in head
+// order, all in one SIMULTANEOUS list; a head's destination is its tunnels' end.
+ListOut stale_list(const StalePathsIn& in) {
+  const Net n(in.edges);
+  auto ledger = std::make_shared<FlowLedger>(n.g);
+  const auto black = n.mask(in.black_nodes, in.black_links);
+  std::vector<std::unique_ptr<FlowPolicy>> policies;
+  std::vector<Action> list;
+  for (const auto& [h, offer] : in.offers) {
+    std::vector<RouteDefinition> defs;
+    NodeId dest = 0;
+    for (const auto& [th, es] : in.tunnels) {
+      if (th != h) continue;
+      const auto p = n.path(es);
+      dest = p->destination();
+      defs.push_back(RouteDefinition {h, p, 1});
+    }
+    const NodeId s[1] = {h};
+    const NodeId t[1] = {dest};
+    const auto prog = ForwardingProgram::from_routes(*n.g, s, t, defs);
+    policies.push_back(std::make_unique<FlowPolicy>(*ledger, std::vector<NodeId> {h}, std::vector<NodeId> {dest},
+                                                    FlowPolicyConfig {.routing = Pinned {prog, black}, .admission = LY}));
+    list.push_back(Replace {*policies.back(), offer});
+  }
+  ListOut out;
+  std::vector<PlacementResult> res;
+  out.error = error_of([&] { res = apply_actions(*ledger, list, BatchMode::Simultaneous); });
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  out.rounds = detail::thread_lossy_counters().rounds;
+#endif
+  // The statuses, from each policy's own view of its program (the same whatever the forwarding).
+  for (const auto& p : policies) {
+    const auto& pe = detail::PolicyAccess::engine(*p);
+    for (std::size_t e = 0; e < pe.view.data->entries.size(); ++e) out.status.push_back(name_of(pe.view.status(e)));
+  }
+  if (!out.error.empty()) return out;
+  for (const auto& r : res) out.delivered.push_back(r.call_delivered);
+  return out;
+}
+
+// The examples' list helper for one-tunnel LOSSY participants on a fresh ledger, created in list
+// order: per entry its delivery, drops, tunnel status, residual and saturated_boundary_edges (from
+// the entry's own source).
+struct ListAction {
+  NodeId source;
+  Ints route;
+  Amount offer;
+  Ints black_holes {};
+};
+struct EntryOut {
+  Amount delivered;
+  std::vector<std::pair<std::int64_t, Amount>> call_edge_drops;
+  std::string status;
+  Amounts residual;
+  Ints saturated_boundary_edges;
+};
+std::vector<EntryOut> action_list(const std::vector<InEdge>& edges, const std::vector<ListAction>& actions, BatchMode mode) {
+  const Net n(edges);
+  auto ledger = std::make_shared<FlowLedger>(n.g);
+  std::vector<std::shared_ptr<const Eligibility>> black;
+  std::vector<std::unique_ptr<FlowPolicy>> policies;
+  std::vector<Action> list;
+  for (const auto& a : actions) {
+    const auto p = n.path(a.route);
+    const NodeId s[1] = {a.source};
+    const NodeId t[1] = {p->destination()};
+    const std::vector<RouteDefinition> defs {RouteDefinition {a.source, p, 1}};
+    black.push_back(n.mask({}, a.black_holes));
+    policies.push_back(std::make_unique<FlowPolicy>(*ledger, std::vector<NodeId> {a.source}, std::vector<NodeId> {p->destination()},
+                                                    FlowPolicyConfig {.routing = Pinned {ForwardingProgram::from_routes(*n.g, s, t, defs), black.back()},
+                                                                      .admission = LY}));
+    list.push_back(Replace {*policies.back(), a.offer});
+  }
+  const auto res = apply_actions(*ledger, list, mode, OutputOptions {.residual = true, .saturated_boundary_edges = true});
+  std::vector<EntryOut> out;
+  for (const auto& r : res) {
+    EntryOut e {r.call_delivered, {}, name_of(r.by_tunnel.front().status), n.in_order(*r.residual), {}};
+    for (const auto& [x, d] : r.call_edge_drops) e.call_edge_drops.emplace_back(n.pos(x), d);
+    std::sort(e.call_edge_drops.begin(), e.call_edge_drops.end());
+    for (EdgeId x : *r.saturated_boundary_edges) e.saturated_boundary_edges.push_back(n.pos(x));
+    std::sort(e.saturated_boundary_edges.begin(), e.saturated_boundary_edges.end());
+    out.push_back(e);
+  }
+  return out;
+}
+
+void expect_entry(const EntryOut& e, Amount delivered, const std::vector<std::pair<std::int64_t, Amount>>& drops, const std::string& status,
+                  const Amounts& residual, const Ints& boundary) {
+  EXPECT_EQ(e.delivered, delivered);
+  EXPECT_EQ(e.call_edge_drops, drops);
+  EXPECT_EQ(e.status, status);
+  EXPECT_EQ(e.residual, residual);
+  EXPECT_EQ(e.saturated_boundary_edges, boundary);
+}
+
+const std::vector<InEdge> kCycleEdges = {{0, 1, 12, 1},     {1, 6, 1000, 1},   {2, 3, 9, 1},      {3, 0, 1000, 1},
+                                         {3, 10, 1000, 1},  {4, 5, 7, 1},      {5, 6, 1000, 1},   {6, 7, 13, 1},
+                                         {7, 2, 1000, 1},   {7, 10, 1000, 1},  {8, 9, 1, 1},      {10, 11, 10, 1},
+                                         {11, 2, 1000, 1},  {12, 4, 1000, 1},  {13, 6, 1000, 1},  {14, 0, 1000, 1}};
+const std::vector<std::pair<NodeId, Ints>> kCycleTunnels = {
+    {12, {13, 5, 6, 7, 8, 2, 4, 11}}, {13, {14, 7, 9, 11, 12, 2, 3, 0}}, {14, {15, 0, 1, 7}}};
+const std::vector<InEdge> kCycleBlackEdges = {
+    {0, 1, 12, 1},    {1, 6, 1000, 1},  {1, 16, 1000, 1}, {2, 3, 9, 1},     {3, 0, 1000, 1},  {3, 10, 1000, 1}, {4, 5, 7, 1},
+    {5, 6, 1000, 1},  {6, 7, 13, 1},    {7, 2, 1000, 1},  {7, 10, 1000, 1}, {8, 9, 1, 1},     {10, 11, 10, 1},  {11, 2, 1000, 1},
+    {12, 4, 1000, 1}, {13, 6, 1000, 1}, {14, 0, 1000, 1}, {15, 0, 1000, 1}, {16, 2, 1000, 1}};
+const std::vector<std::pair<NodeId, Ints>> kCycleBlackTunnels = {
+    {12, {14, 6, 7, 8, 9, 3, 5, 12}}, {13, {15, 8, 10, 12, 13, 3, 4, 0}}, {14, {16, 0, 1, 8}}, {15, {17, 0, 2, 18, 3, 5, 12}}};
+
+const std::string kPeriodTwo = "lossy forwarding iteration entered a period-2 cycle";
+const std::string kRoundLimit = "lossy forwarding iteration did not reach a fixed point within the round limit";
+
+void expect_list(const ListOut& r, const Routes& arrivals, const Routes& carried, const std::optional<Routes>& drops, const Amounts& delivered,
+                 const Amounts& flows) {
+  EXPECT_EQ(r.error, "");
+  EXPECT_EQ(r.arrivals, arrivals);
+  EXPECT_EQ(r.carried, carried);
+  if (drops.has_value()) EXPECT_EQ(r.edge_drops, *drops);
+  EXPECT_EQ(r.delivered, delivered);
+  EXPECT_EQ(r.edge_flows, flows);
+}
+
+// D-no-H-fixed-point's oracle, the test's own: unit-at-a-time highest averages by exact
+// cross-multiplication (ties to the earlier label), sharing nothing with the library.
+Amounts own_h(Amount x, const Amounts& w) {
+  Amounts a(w.size(), 0);
+  for (Amount u = 0; u < x; ++u) {
+    std::size_t best = w.size();
+    for (std::size_t i = 0; i < w.size(); ++i) {
+      if (w[i] <= 0) continue;
+      if (best == w.size() || w[i] * (a[best] + 1) > w[best] * (a[i] + 1)) best = i;
+    }
+    if (best == w.size()) return Amounts(w.size(), 0);
+    ++a[best];
+  }
+  return a;
+}
+
+} // namespace
+
+TEST(ContractExamples, D_crossing) {
+  expect_list(list_lossy({8, 4, 4}, {{0, 1}, {0}, {1}}, {9, 7}), {{8, 6}, {4}, {4}}, {{6, 4}, {3}, {3}}, Routes {{2, 2}, {1}, {1}}, {4, 3, 3},
+              {9, 7});
+}
+TEST(ContractExamples, D_C3) {
+  const auto r = list_lossy({1, 1, 2}, {{0, 1}, {1, 2}, {2, 0}}, {1, 1, 2});
+  EXPECT_EQ(r.error, kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(r.rounds, 3);
+#endif
+}
+TEST(ContractExamples, D_cycle_prefix_suffix) {
+  expect_list(list_lossy({8, 4}, {{0, 1, 2}, {2, 1, 3}}, {2, 5, 5, 10}), {{8, 2, 2}, {4, 3, 3}}, {{2, 2, 2}, {3, 3, 3}},
+              Routes {{6, 0, 0}, {1, 0, 0}}, {2, 3}, {2, 5, 5, 3});
+}
+TEST(ContractExamples, D_cycle_subdivision_before) {
+  expect_list(list_lossy({2, 1, 4}, {{1, 0, 2}, {2, 0}, {2, 0, 1}}, {2, 4, 2}), {{2, 2, 1}, {1, 0}, {4, 2, 1}}, {{2, 1, 0}, {0, 0}, {2, 1, 1}},
+              std::nullopt, {0, 0, 1}, {2, 3, 2});
+}
+TEST(ContractExamples, D_cycle_subdivision_after) {
+  expect_list(list_lossy({2, 1, 4}, {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}}, {2, 4, 2, 2}), {{2, 2, 1, 0}, {1, 0, 0}, {4, 2, 2, 1}},
+              {{2, 1, 0, 0}, {0, 0, 0}, {2, 2, 1, 1}}, std::nullopt, {0, 0, 1}, {2, 3, 2, 2});
+}
+// A dead occurrence (a zero offer or share, traffic behind its own black hole) takes no part in the
+// no-drop loads, the waits or serial normalization, so adding it changes no other output, structure
+// included: with and without it, the other participants' rows and deliveries, every link flow, the
+// error and (hooks) the links that wait, the groups, their rounds and the dependency arcs are equal.
+// "Without" is the list without the dead participant, or (behind a black hole) with its route cut
+// after its black hole, as the contract's property states it. `extra_arcs`: the dependency arcs of
+// the added element's own live part that the comparison has none of.
+void expect_same_without(const ListOut& with, const ListOut& without, std::size_t n, const std::string& where,
+                         std::int64_t extra_arcs = 0) {
+  EXPECT_EQ(with.error, without.error) << where;
+  EXPECT_EQ(with.rounds, without.rounds) << where;
+  EXPECT_EQ(with.groups, without.groups) << where;
+  EXPECT_EQ(with.barrier_links, without.barrier_links) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(with.dependencies, without.dependencies + extra_arcs) << where;
+#else
+  (void)extra_arcs;
+#endif
+  auto first = [n](const auto& v) {
+    using V = std::decay_t<decltype(v)>;
+    return V(v.begin(), v.begin() + static_cast<std::ptrdiff_t>(std::min(n, v.size())));
+  };
+  EXPECT_EQ(first(with.arrivals), first(without.arrivals)) << where;
+  EXPECT_EQ(first(with.carried), first(without.carried)) << where;
+  EXPECT_EQ(first(with.edge_drops), first(without.edge_drops)) << where;
+  EXPECT_EQ(first(with.delivered), first(without.delivered)) << where;
+  EXPECT_EQ(with.edge_flows, without.edge_flows) << where;
+}
+std::string form_name(Form f) {
+  static const char* const kNames[] = {"tunnel", "DAG route", "DAG route beside an exit", "zero branch", "entry tunnel", "entry DAG route"};
+  return kNames[static_cast<std::size_t>(f)];
+}
+const Form kDeadForms[] = {kTunnel, kDagRoute, kDagBesideExit};
+
+// D-dead-tail: Z's traffic dies on link 3, its own black hole, so its occurrences on links 0 and 1
+// are dead: the period-2 error at round 3, as with Z cut after link 3 (and as without Z), with Z a
+// tunnel, a DAG route alone or a DAG route beside an exit. The scalar call (one head, the routes
+// its entries with weights = offers, the call's black hole on link 3, which only Z uses) gives the
+// same, Z a tunnel or a DAG route, against Z cut after link 3.
+void dead_tail(const Amounts& offers) {
+  const Routes routes {{2, 0}, {1, 0, 2}, {3, 0, 1}};
+  const Routes cut {{2, 0}, {1, 0, 2}, {3}};
+  const Amounts cap {2, 2, 1, 9};
+  const std::vector<Ints> dark {{}, {}, {3}};
+  const auto alone = list_lossy({offers[0], offers[1]}, {routes[0], routes[1]}, cap);
+  EXPECT_EQ(alone.error, kPeriodTwo);
+  for (Form f : kDeadForms) {
+    const std::vector<Form> forms {kTunnel, kTunnel, f};
+    const auto with = list_lossy(offers, routes, cap, dark, std::nullopt, forms);
+    EXPECT_EQ(with.error, kPeriodTwo) << form_name(f);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(with.rounds, 3) << form_name(f);
+#endif
+    expect_same_without(with, list_lossy(offers, cut, cap, dark, std::nullopt, forms), 2, form_name(f) + " against Z cut");
+    EXPECT_EQ(with.barrier_links, alone.barrier_links) << form_name(f);
+    EXPECT_EQ(with.groups, alone.groups) << form_name(f);
+  }
+  for (bool dag : {false, true}) {
+    const auto with = lossy(offers, routes, cap, {}, {3}, {false, false, dag});
+    const auto without = lossy(offers, cut, cap, {}, {3}, {false, false, dag});
+    EXPECT_EQ(with.error, kPeriodTwo) << "scalar, dag " << dag;
+    EXPECT_EQ(with.error, without.error) << "scalar, dag " << dag;
+    EXPECT_EQ(with.rounds, without.rounds) << "scalar, dag " << dag;
+    EXPECT_EQ(with.groups, without.groups) << "scalar, dag " << dag;
+    EXPECT_EQ(with.barrier_links, without.barrier_links) << "scalar, dag " << dag;
+    EXPECT_EQ(with.dependencies, without.dependencies) << "scalar, dag " << dag;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(with.rounds, 3) << "scalar, dag " << dag;
+#endif
+  }
+}
+TEST(ContractExamples, D_dead_tail) { dead_tail({1, 2, 1}); }
+// D-dead-waits: link 1 is a barrier with or without Z; Z's dead occurrences add no wait, so links 0
+// and 2 alone form the group.
+TEST(ContractExamples, D_dead_waits) { dead_tail({1, 3, 3}); }
+// D-zero-share-pair: D-cycle-subdivision-after plus a zero offer over link 2 alone, which ends there:
+// links 2 and 3 stay a transparent pair, with Z a tunnel, a DAG route alone (a pooled head whose
+// share is 0), a DAG route beside an exit (a split route whose share is 0) or a zero branch (a
+// split route member whose whole-unit share is 0; its exit member's unit makes one arc of its own).
+TEST(ContractExamples, D_zero_share_pair) {
+  const Routes routes {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}, {2}};
+  const Amounts cap {2, 4, 2, 2};
+  const auto without = list_lossy({2, 1, 4}, {routes[0], routes[1], routes[2]}, cap);
+  for (Form f : {kTunnel, kDagRoute, kDagBesideExit, kZeroBranch}) {
+    const auto r = list_lossy({2, 1, 4, 0}, routes, cap, {}, std::nullopt, {kTunnel, kTunnel, kTunnel, f});
+    expect_list(r, {{2, 2, 1, 0}, {1, 0, 0}, {4, 2, 2, 1}, {0}}, {{2, 1, 0, 0}, {0, 0, 0}, {2, 2, 1, 1}, {0}}, std::nullopt, {0, 0, 1, 0},
+                {2, 3, 2, 2});
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(r.rounds, 4) << form_name(f);
+#endif
+    expect_same_without(r, without, 3, form_name(f), f == kZeroBranch ? 1 : 0);
+  }
+}
+// D-dead-subdivision: Z over links 2 and 3 with its own black hole on link 2 alone: its unit is
+// dropped there and its occurrence on link 3 is dead, as before the split; with Z a tunnel, a DAG
+// route alone or a DAG route beside an exit, against Z cut after link 2.
+TEST(ContractExamples, D_dead_subdivision) {
+  const Routes routes {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}, {2, 3}};
+  const Routes cut {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}, {2}};
+  const Amounts cap {2, 4, 2, 2};
+  const std::vector<Ints> dark {{}, {}, {}, {2}};
+  for (Form f : kDeadForms) {
+    const std::vector<Form> forms {kTunnel, kTunnel, kTunnel, f};
+    const auto r = list_lossy({2, 1, 4, 1}, routes, cap, dark, std::nullopt, forms);
+    expect_list(r, {{2, 2, 1, 0}, {1, 0, 0}, {4, 2, 2, 1}, {1, 0}}, {{2, 1, 0, 0}, {0, 0, 0}, {2, 2, 1, 1}, {0, 0}},
+                Routes {{0, 1, 1, 0}, {1, 0, 0}, {2, 0, 1, 0}, {1, 0}}, {0, 0, 1, 0}, {2, 3, 2, 2});
+    if (f == kTunnel) EXPECT_EQ(r.status.back(), "BLACKHOLED");
+    expect_same_without(r, list_lossy({2, 1, 4, 1}, cut, cap, dark, std::nullopt, forms), 3, form_name(f) + " against Z cut");
+  }
+}
+
+// A dead occurrence loads no link, so it makes no barrier. A: links 1, 0 (offer 1); B: 0, 2, 1
+// (offer 2); V = 2, 1, 2. With or without Z (links 3, 2, offer 2, its own black hole on link 3; a
+// tunnel, a DAG route alone or a DAG route beside an exit) the period-2 error at round 3; Z's unit
+// on link 2 counted in the no-drop loads would make link 2 a third barrier of the group and the
+// iteration fail at the round limit (192 rounds).
+TEST(DeadOccurrences, LoadNoLink) {
+  const Amounts cap {2, 1, 2, 9};
+  const auto without = list_lossy({1, 2}, {{1, 0}, {0, 2, 1}}, cap);
+  EXPECT_EQ(without.error, kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(without.rounds, 3);
+#endif
+  for (Form f : kDeadForms) {
+    const std::vector<Form> forms {kTunnel, kTunnel, f};
+    const auto with = list_lossy({1, 2, 2}, {{1, 0}, {0, 2, 1}, {3, 2}}, cap, {{}, {}, {3}}, std::nullopt, forms);
+    expect_same_without(with, list_lossy({1, 2, 2}, {{1, 0}, {0, 2, 1}, {3}}, cap, {{}, {}, {3}}, std::nullopt, forms), 2,
+                        form_name(f) + " against Z cut");
+    EXPECT_EQ(with.error, kPeriodTwo) << form_name(f);
+    EXPECT_EQ(with.barrier_links, without.barrier_links) << form_name(f);
+  }
+}
+// An empty entry (weight 0: it gets no share and is not forwarded) changes nothing: D-cycle-
+// subdivision-after with a tunnel or a DAG route of weight 0 in A's program, over link 2 alone (it
+// would break the pair 2, 3) or over links 2, 3, 0.
+TEST(DeadOccurrences, EmptyEntriesChangeNothing) {
+  const Routes routes {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}};
+  const Amounts cap {2, 4, 2, 2};
+  const auto without = list_lossy({2, 1, 4}, routes, cap);
+  for (Form f : {kEntryTunnel, kEntryDag}) {
+    for (const Ints& extra : {Ints {2}, Ints {2, 3, 0}}) {
+      Routes with_routes = routes;
+      with_routes.push_back(extra);
+      const auto with = list_lossy({2, 1, 4, 0}, with_routes, cap, {}, std::nullopt, {kTunnel, kTunnel, kTunnel, f});
+      expect_same_without(with, without, 3, form_name(f) + " over " + std::to_string(extra.size()) + " links");
+      EXPECT_EQ(with.delivered, (Amounts {0, 0, 1}));
+    }
+  }
+}
+// The scalar call with a real serial pair: D-zero-share-pair's routes as the entries of one head's
+// program on the list layout (links 2 and 3 joined directly), weights 2, 1, 4, 1 at offer 7, so
+// highest averages give Z (link 2 alone, then its own exit) a share of 0. Z a tunnel or a DAG
+// route: delivery 1 and the structure of the call without Z (weights 2, 1, 4 at offer 7); counted in
+// normalization, Z would keep links 2 and 3 from passing traffic through as one.
+TEST(DeadOccurrences, ScalarSerialPairWithAZeroShareEntry) {
+  const Routes routes {{1, 0, 2, 3}, {2, 3, 0}, {2, 3, 0, 1}, {2}};
+  const Amounts cap {2, 4, 2, 2};
+  const Ints fuse = fused_links({2, 1, 4, 0}, routes, cap.size(), {});
+  const auto without = list_lossy({2, 1, 4}, {routes[0], routes[1], routes[2]}, cap, {}, fuse, {kTunnel, kEntryTunnel, kEntryTunnel}, 7);
+  EXPECT_EQ(without.error, "");
+  EXPECT_EQ(without.delivered, (Amounts {1}));
+  for (Form f : {kEntryTunnel, kEntryDag}) {
+    const auto with = list_lossy({2, 1, 4, 1}, routes, cap, {}, fuse, {kTunnel, kEntryTunnel, kEntryTunnel, f}, 7);
+    expect_same_without(with, without, 1, "scalar, Z an " + form_name(f));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(with.barrier_links, (Ints {0, 1, 2})) << form_name(f);  // link 3 passes link 2's traffic through
+#endif
+  }
+}
+// The scalar call: a dead entry changes no other output, structure included. D-crossing (A over
+// links 0, 1 with weight 8; B over 0, 4; C over 1, 4; V 9, 7) plus Z over its own link 2 (the
+// call's black hole) then link 0, weight 4, offer 20: Z's share dies on link 2. And D-dead-tail's
+// routes with weights 1, 2, 1 and offer 3 (no black hole): highest averages give Z a share of 0.
+// Z a tunnel or a DAG route; the outputs equal those without Z (D-crossing: offer 16; D-dead-tail:
+// weights 1, 2 and offer 3, the same shares), and D-crossing's dependency arcs those with Z cut after
+// its black hole (a DAG route's live part keeps the arcs of its own routers).
+TEST(DeadOccurrences, ScalarCallsWithoutThem) {
+  for (bool dag : {false, true}) {
+    const std::string where = dag ? "DAG route" : "tunnel";
+    const auto with = lossy({8, 4, 4, 4}, {{0, 1}, {0}, {1}, {2, 0}}, {9, 7, 9}, {}, {2}, {false, false, false, dag});
+    const auto without = lossy({8, 4, 4}, {{0, 1}, {0}, {1}}, {9, 7, 9});
+    EXPECT_EQ(with.error, "") << where;
+    EXPECT_EQ(Routes(with.carried.begin(), with.carried.begin() + 3), without.carried) << where;
+    EXPECT_EQ(Routes(with.edge_drops.begin(), with.edge_drops.begin() + 3), without.edge_drops) << where;
+    EXPECT_EQ(Amounts(with.delivered.begin(), with.delivered.begin() + 3), without.delivered) << where;
+    EXPECT_EQ(with.delivered[0], 4) << where;
+    EXPECT_EQ(with.edge_flows, without.edge_flows) << where;
+    EXPECT_EQ(with.barrier_links, without.barrier_links) << where;
+    EXPECT_EQ(with.groups, without.groups) << where;
+    // Z's live part up to its black hole (a DAG route's routers) keeps its own arcs: against Z cut.
+    const auto cut = lossy({8, 4, 4, 4}, {{0, 1}, {0}, {1}, {2}}, {9, 7, 9}, {}, {2}, {false, false, false, dag});
+    EXPECT_EQ(with.dependencies, cut.dependencies) << where;
+    EXPECT_EQ(with.barrier_links, cut.barrier_links) << where;
+    const auto zero = lossy({1, 2, 1}, {{2, 0}, {1, 0, 2}, {3, 0, 1}}, {2, 2, 1, 9}, {}, {}, {false, false, dag}, 3);
+    const auto none = lossy({1, 2}, {{2, 0}, {1, 0, 2}}, {2, 2, 1, 9}, {}, {}, {}, 3);
+    EXPECT_EQ(zero.error, kPeriodTwo) << where;
+    EXPECT_EQ(zero.error, none.error) << where;
+    EXPECT_EQ(zero.rounds, none.rounds) << where;
+    EXPECT_EQ(zero.groups, none.groups) << where;
+    EXPECT_EQ(zero.barrier_links, none.barrier_links) << where;
+    EXPECT_EQ(zero.dependencies, none.dependencies) << where;
+  }
+}
+// The forwarding sizes follow the same loads: D-dead-tail has two barriers (links 0 and 2) and
+// two dependency arcs (B: 0 before 2; A: 2 before 0; Z: none) with or without Z, so its event and
+// dependency counts are those of the network without Z (counted in Z's no-drop load, link 1 would
+// be a third barrier, with arcs to and from link 0).
+TEST(DeadOccurrences, ForwardingSizesWithoutThem) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  using detail::ForwardingCounter;
+  struct Restore {
+    ~Restore() { detail::thread_forwarding_limits() = {}; }
+  } restore;
+  // The smallest limit of a counter that the call meets.
+  auto smallest = [](ForwardingCounter counter, const std::function<ListOut()>& call) {
+    for (std::int64_t n = 1; n < 20; ++n) {
+      detail::thread_forwarding_limits() = {};
+      detail::thread_forwarding_limits()[static_cast<std::size_t>(counter)] = n;
+      if (call().error.find("limit exceeded") == std::string::npos) return n;
+    }
+    return std::int64_t {-1};
+  };
+  const std::function<ListOut()> with_z = [] { return list_lossy({1, 2, 1}, {{2, 0}, {1, 0, 2}, {3, 0, 1}}, {2, 2, 1, 9}, {{}, {}, {3}}); };
+  const std::function<ListOut()> without_z = [] { return list_lossy({1, 2}, {{2, 0}, {1, 0, 2}}, {2, 2, 1, 9}); };
+  EXPECT_EQ(smallest(ForwardingCounter::Event, with_z), 2);
+  EXPECT_EQ(smallest(ForwardingCounter::Event, without_z), 2);
+  EXPECT_EQ(smallest(ForwardingCounter::Dependency, with_z), 2);
+  EXPECT_EQ(smallest(ForwardingCounter::Dependency, without_z), 2);
+#else
+  GTEST_SKIP() << "needs the private hooks";
+#endif
+}
+
+// Python's random.Random(seed) for a small non-negative seed (MT19937 seeded from the seed's word, and
+// the random(), randint, randrange and sample of CPython 3.11 and later on populations of at most
+// 21), so the property below draws the contract's own inputs.
+class PyRandom {
+public:
+  explicit PyRandom(std::uint32_t seed) {
+    init(19650218U);
+    std::size_t i = 1;
+    for (std::size_t k = kN; k != 0; --k) {  // the key array's mixing, with `seed` its one word
+      mt_[i] = (mt_[i] ^ ((mt_[i - 1] ^ (mt_[i - 1] >> 30)) * 1664525U)) + seed;
+      if (++i >= kN) {
+        mt_[0] = mt_[kN - 1];
+        i = 1;
+      }
+    }
+    for (std::size_t k = kN - 1; k != 0; --k) {
+      mt_[i] = (mt_[i] ^ ((mt_[i - 1] ^ (mt_[i - 1] >> 30)) * 1566083941U)) - static_cast<std::uint32_t>(i);
+      if (++i >= kN) {
+        mt_[0] = mt_[kN - 1];
+        i = 1;
+      }
+    }
+    mt_[0] = 0x80000000U;
+  }
+  double random() {
+    const std::uint32_t a = next() >> 5;
+    const std::uint32_t b = next() >> 6;
+    return (a * 67108864.0 + b) * (1.0 / 9007199254740992.0);
+  }
+  std::int64_t randbelow(std::int64_t n) {
+    int k = 0;
+    while ((std::int64_t {1} << k) <= n) ++k;
+    std::int64_t r = next() >> (32 - k);
+    while (r >= n) r = next() >> (32 - k);
+    return r;
+  }
+  std::int64_t randint(std::int64_t a, std::int64_t b) { return a + randbelow(b - a + 1); }
+  Ints sample(std::int64_t n, std::int64_t k) {  // sample(range(n), k)
+    Ints pool(static_cast<std::size_t>(n));
+    for (std::int64_t i = 0; i < n; ++i) pool[static_cast<std::size_t>(i)] = i;
+    Ints out;
+    for (std::int64_t i = 0; i < k; ++i) {
+      const auto j = static_cast<std::size_t>(randbelow(n - i));
+      out.push_back(pool[j]);
+      pool[j] = pool[static_cast<std::size_t>(n - i - 1)];
+    }
+    return out;
+  }
+
+private:
+  static constexpr std::size_t kN = 624;
+  void init(std::uint32_t s) {
+    mt_[0] = s;
+    for (std::size_t i = 1; i < kN; ++i) mt_[i] = 1812433253U * (mt_[i - 1] ^ (mt_[i - 1] >> 30)) + static_cast<std::uint32_t>(i);
+    index_ = kN;
+  }
+  std::uint32_t next() {
+    if (index_ >= kN) {
+      for (std::size_t i = 0; i < kN; ++i) {
+        const std::uint32_t y = (mt_[i] & 0x80000000U) | (mt_[(i + 1) % kN] & 0x7fffffffU);
+        mt_[i] = mt_[(i + 397) % kN] ^ (y >> 1) ^ ((y & 1U) != 0 ? 0x9908b0dfU : 0U);
+      }
+      index_ = 0;
+    }
+    std::uint32_t y = mt_[index_++];
+    y ^= y >> 11;
+    y ^= (y << 7) & 0x9d2c5680U;
+    y ^= (y << 15) & 0xefc60000U;
+    y ^= y >> 18;
+    return y;
+  }
+  std::array<std::uint32_t, kN> mt_ {};
+  std::size_t index_ {kN};
+};
+
+// D-dead-demand-property (seed 4, 2000 trials): one added dead demand Z changes nothing. Small random
+// inputs of simple-path demands; Z has a zero offer over 1 to 3 of their links, or an offer of 1 to 3
+// whose route reaches its own black hole (link k, a link of Z's own, inserted into its route, or one of
+// its shared links) and continues behind it. The outcome with Z equals the outcome with Z's dead
+// occurrences removed (without Z for a zero offer, Z's route cut after its black hole otherwise): every
+// arrival, carried amount, drop and delivery of the others and of Z's prefix, every link flow, and an
+// error with its round count (hooks); Z's dead occurrences show 0. Structure included (hooks): the
+// links that wait, the groups and the dependency arcs are equal too. Z is a tunnel, a DAG route alone
+// (a pooled context) and a DAG route beside an exit (a split route of a program that is not pooled),
+// each on the same inputs. Both runs of a trial share one layout (fused_links of the input with Z).
+TEST(ContractExamples, D_dead_demand_property) {
+  PyRandom rng(4);
+  std::array<std::int64_t, 3> agree {};
+  std::array<std::int64_t, 3> errors {};
+  std::int64_t zero = 0;
+  std::int64_t tail = 0;
+  for (int trial = 0; trial < 2000; ++trial) {
+    const auto k = rng.randint(3, 5);
+    Amounts cap;
+    for (std::int64_t e = 0; e < k; ++e) cap.push_back(rng.randint(1, 3));
+    cap.push_back(9);
+    const auto n = static_cast<std::size_t>(rng.randint(2, 4));
+    Routes routes;
+    for (std::size_t i = 0; i < n; ++i) {
+      const auto len = rng.randint(2, std::min<std::int64_t>(4, k));
+      routes.push_back(rng.sample(k, len));
+    }
+    Amounts offers;
+    for (std::size_t i = 0; i < n; ++i) offers.push_back(rng.randint(1, 4));
+    const Ints links = rng.sample(k, rng.randint(1, std::min<std::int64_t>(3, k)));
+    Amount z = 0;
+    Ints zr = links;
+    std::int64_t hole = -1;
+    if (rng.random() < 0.5) {
+      ++zero;
+    } else {
+      ++tail;
+      z = rng.randint(1, 3);
+      const auto p = rng.randbelow(static_cast<std::int64_t>(links.size()));
+      if (rng.random() < 0.5) {
+        zr.insert(zr.begin() + p, k);
+        hole = k;
+      } else {
+        hole = links[static_cast<std::size_t>(p)];
+      }
+    }
+    std::vector<Ints> dark(n);
+    dark.push_back(hole < 0 ? Ints {} : Ints {hole});
+    Amounts all_offers = offers;
+    all_offers.push_back(z);
+    Routes all_routes = routes;
+    all_routes.push_back(zr);
+    const Ints fuse = fused_links(all_offers, all_routes, cap.size(), dark);
+    const std::size_t cut = hole < 0 ? 0 : static_cast<std::size_t>(std::find(zr.begin(), zr.end(), hole) - zr.begin()) + 1;
+    Routes cut_routes = all_routes;
+    if (cut != 0) cut_routes.back().resize(cut);
+    // The comparison: the others' rows and Z's prefix, deliveries, link flows, Z's dead tail all 0,
+    // the structure.
+    auto view = [&](const ListOut& r) {
+      std::vector<Routes> rows;
+      bool quiet = true;
+      const auto structure = std::make_tuple(r.rounds, r.groups, r.barrier_links, r.dependencies);
+      if (!r.error.empty()) return std::make_tuple(r.error, structure, rows, Amounts {}, Amounts {}, quiet);
+      for (const Routes* key : {&r.arrivals, &r.carried, &r.edge_drops}) {
+        Routes x(key->begin(), key->begin() + static_cast<std::ptrdiff_t>(std::min(n, key->size())));
+        if (cut != 0) x.push_back(Ints((*key)[n].begin(), (*key)[n].begin() + static_cast<std::ptrdiff_t>(cut)));
+        if (key != &r.edge_drops && key->size() > n) {
+          for (std::size_t j = cut; j < (*key)[n].size(); ++j) quiet = quiet && (*key)[n][j] == 0;
+        }
+        rows.push_back(x);
+      }
+      const Amounts delivered(r.delivered.begin(), r.delivered.begin() + static_cast<std::ptrdiff_t>(std::min(n, r.delivered.size())));
+      return std::make_tuple(r.error, structure, rows, delivered, r.edge_flows, quiet);
+    };
+    for (std::size_t f = 0; f < 3; ++f) {
+      std::vector<Form> forms(n, kTunnel);
+      forms.push_back(kDeadForms[f]);
+      const auto full = list_lossy(all_offers, all_routes, cap, dark, fuse, forms);
+      const auto shorter = hole < 0 ? list_lossy(offers, routes, cap, {}, fuse) : list_lossy(all_offers, cut_routes, cap, dark, fuse, forms);
+      const bool same = view(full) == view(shorter);
+      EXPECT_TRUE(same) << "trial " << trial << ", Z a " << form_name(kDeadForms[f]);
+      agree[f] += same ? 1 : 0;
+      errors[f] += full.error.empty() ? 0 : 1;
+    }
+  }
+  EXPECT_EQ(zero, 993);
+  EXPECT_EQ(tail, 1007);
+  for (std::size_t f = 0; f < 3; ++f) {
+    EXPECT_EQ(agree[f], 2000) << form_name(kDeadForms[f]);
+    EXPECT_EQ(errors[f], 55) << form_name(kDeadForms[f]);
+  }
+}
+// The documented call: two ECMP LOSSY policies on one link of 10.
+TEST(ContractExamples, D_simultaneous) {
+  const Net n({{0, 1, 10, 1}});
+  FlowLedger ledger(n.g);
+  const FlowPolicyConfig ecmp {.routing = ShortestPaths {}, .admission = LY};
+  FlowPolicy a(ledger, v({0}), v({1}), ecmp);
+  FlowPolicy b(ledger, v({0}), v({1}), ecmp);
+  const auto res = apply_actions(ledger, std::vector<Action> {Replace {a, 10}, Replace {b, 10}}, BatchMode::Simultaneous);
+  EXPECT_EQ(res[0].call_delivered, 5);
+  EXPECT_EQ(res[1].call_delivered, 5);
+  EXPECT_EQ(res[0].call_edge_drops, (std::vector<std::pair<EdgeId, Amount>> {{0, 5}}));
+  EXPECT_EQ(res[1].call_edge_drops, (std::vector<std::pair<EdgeId, Amount>> {{0, 5}}));
+  EXPECT_EQ(ledger.carried(), (Amounts {10}));
+}
+// The C3 instance (A: 0, 1; B: 1, 2; C: 2, 0; offers 1, 1, 2; V 1, 1, 2): the test's own enumeration
+// of every integer carried record within the continuation bounds and work conservation finds 5, none
+// meeting the loss rule's link equations (each record's violating links named); the library's highest averages
+// agrees with the test's own on every equation the enumeration evaluates; the list raises the
+// period-2 error.
+TEST(ContractExamples, D_no_H_fixed_point) {
+  const Amounts cap {1, 1, 2};
+  int records = 0;
+  int solutions = 0;
+  std::vector<std::vector<int>> violations;
+  for (Amount a0 = 0; a0 <= 1; ++a0) {
+    for (Amount a1 = 0; a1 <= a0; ++a1) {
+      for (Amount b1 = 0; b1 <= 1; ++b1) {
+        for (Amount b2 = 0; b2 <= b1; ++b2) {
+          for (Amount c2 = 0; c2 <= 2; ++c2) {
+            for (Amount c0 = 0; c0 <= c2; ++c0) {
+              // Arrivals: A 1 then a0; B 1 then b1; C 2 then c2. Links: 0 (A0, C0), 1 (A1, B1), 2 (B2, C2).
+              const Amounts arr0 {1, c2};
+              const Amounts car0 {a0, c0};
+              const Amounts arr1 {a0, 1};
+              const Amounts car1 {a1, b1};
+              const Amounts arr2 {b1, 2};
+              const Amounts car2 {b2, c2};
+              auto conserving = [&](const Amounts& arr, const Amounts& car, Amount v) {
+                return car[0] + car[1] == std::min(v, arr[0] + arr[1]);
+              };
+              if (!conserving(arr0, car0, cap[0]) || !conserving(arr1, car1, cap[1]) || !conserving(arr2, car2, cap[2])) continue;
+              ++records;
+              std::vector<int> bad;
+              const std::vector<std::pair<Amounts, Amounts>> links {{arr0, car0}, {arr1, car1}, {arr2, car2}};
+              for (std::size_t l = 0; l < 3; ++l) {
+                const Amount t = std::min(cap[l], links[l].first[0] + links[l].first[1]);
+                const Amounts mine = own_h(t, links[l].first);
+                Amounts lib(2, 0);
+                detail::highest_averages(t, links[l].first, lib);
+                EXPECT_EQ(lib, mine) << "link " << l;
+                if (mine != links[l].second) bad.push_back(static_cast<int>(l));
+              }
+              solutions += bad.empty() ? 1 : 0;
+              violations.push_back(bad);
+            }
+          }
+        }
+      }
+    }
+  }
+  EXPECT_EQ(records, 5);
+  EXPECT_EQ(solutions, 0);
+  EXPECT_EQ(violations, (std::vector<std::vector<int>> {{2}, {0}, {0, 1, 2}, {1}, {0}}));
+  EXPECT_EQ(list_lossy({1, 1, 2}, {{0, 1}, {1, 2}, {2, 0}}, {1, 1, 2}).error, kPeriodTwo);
+}
+TEST(ContractExamples, STALE_cycle_period_2) {
+  StalePathsIn in {{{0, 1, 768, 1}, {1, 2, 25600, 1}, {2, 3, 768, 1}, {3, 0, 25600, 1}, {4, 2, 25600, 1}, {5, 0, 25600, 1},
+                    {6, 2, 25600, 1}, {7, 8, 25600, 1}},
+                   {{4, {4, 2, 3, 0}}, {5, {5, 0, 1, 2}}, {6, {6, 2}}, {7, {7}}},
+                   {{4, 1024}, {5, 256}, {6, 256}, {7, 512}}};
+  in.black_links = {7};
+  const auto r = stale_list(in);
+  EXPECT_EQ(r.error, kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(r.rounds, 8);
+#endif
+}
+TEST(ContractExamples, STALE_cycle_round_limit_baseline) {
+  const StalePathsIn in {kCycleEdges, kCycleTunnels, {{12, 13}, {13, 11}, {14, 10}}};
+  const auto r = stale_list(in);
+  EXPECT_EQ(r.error, "");
+  EXPECT_EQ(r.delivered, (Amounts {3, 4, 4}));
+}
+TEST(ContractExamples, STALE_cycle_round_limit) {
+  StalePathsIn in {kCycleEdges, kCycleTunnels, {{12, 13}, {13, 11}, {14, 10}}};
+  in.black_links = {5};
+  const auto r = stale_list(in);
+  EXPECT_EQ(r.error, kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(r.rounds, 256);
+#endif
+}
+TEST(ContractExamples, STALE_black_hole_in_cycle) {
+  StalePathsIn in {kCycleBlackEdges, kCycleBlackTunnels, {{12, 13}, {13, 11}, {14, 10}, {15, 5}}};
+  in.black_links = {2, 6, 17};
+  const auto r = stale_list(in);
+  EXPECT_EQ(r.status, (Texts {"BLACKHOLED", "UP", "UP", "BLACKHOLED"}));
+  EXPECT_EQ(r.error, kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(r.rounds, 256);
+#endif
+}
+TEST(ContractExamples, LIST_black_hole_in_cycle) {
+  std::vector<ListAction> actions;
+  const Amounts offers {13, 11, 10, 5};
+  for (std::size_t i = 0; i < kCycleBlackTunnels.size(); ++i) actions.push_back({kCycleBlackTunnels[i].first, kCycleBlackTunnels[i].second, offers[i], {2, 6, 17}});
+  EXPECT_EQ(error_of([&] { (void)action_list(kCycleBlackEdges, actions, BatchMode::Simultaneous); }), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 256);
+#endif
+}
+TEST(ContractExamples, LIST_black_hole_own) {
+  const auto r = action_list({{0, 1, 10, 1}}, {{0, {0}, 10, {0}}, {0, {0}, 10}}, BatchMode::Simultaneous);
+  expect_entry(r[0], 0, {{0, 10}}, "BLACKHOLED", {0}, {0});
+  expect_entry(r[1], 10, {}, "UP", {0}, {0});
+}
+TEST(ContractExamples, LIST_black_hole_upstream) {
+  const auto r = action_list({{0, 1, 10, 1}, {1, 2, 10, 1}}, {{0, {0, 1}, 10, {1}}, {0, {0, 1}, 10}}, BatchMode::Simultaneous);
+  expect_entry(r[0], 0, {{0, 5}, {1, 5}}, "BLACKHOLED", {0, 5}, {0});
+  expect_entry(r[1], 5, {{0, 5}}, "UP", {0, 5}, {0});
+}
+TEST(ContractExamples, LIST_outputs_ordered) {
+  const auto r = action_list({{0, 1, 10, 1}}, {{0, {0}, 7}, {0, {0}, 7}}, BatchMode::Ordered);
+  expect_entry(r[0], 7, {}, "UP", {3}, {});
+  expect_entry(r[1], 3, {{0, 4}}, "UP", {0}, {0});
+}
+TEST(ContractExamples, LIST_outputs_simultaneous) {
+  const auto r = action_list({{0, 2, 5, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}}, {{0, {0, 2}, 5}, {1, {1, 2}, 5}}, BatchMode::Simultaneous);
+  expect_entry(r[0], 5, {}, "UP", {0, 5, 0}, {0});
+  expect_entry(r[1], 5, {}, "UP", {0, 5, 0}, {2});
+}
+// The fourteen lists with real policies (a, b of the list's ledger; x of another; the cycling action
+// is the cycle's Pinned replace(3)).
+TEST(ContractExamples, LIST_first_error) {
+  const Net n({{0, 1, 10, 1}});
+  const Net other({{0, 1, 10, 1}});
+  const Net cyc({{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1}, {3, 5, 1000, 1}, {4, 0, 1000, 1}, {4, 2, 1000, 1},
+                 {6, 7, 10, 1}});
+  FlowLedger ledger(n.g);
+  FlowLedger foreign(other.g);
+  FlowLedger cl(cyc.g);
+  const FlowPolicyConfig ly {.routing = ShortestPaths {}, .admission = LY};
+  const FlowPolicyConfig ll {.routing = ShortestPaths {}, .admission = LL};
+  FlowPolicy a(ledger, v({0}), v({1}), ly);
+  FlowPolicy x(foreign, v({0}), v({1}), ly);
+  FlowPolicy all(ledger, v({0}), v({1}), ll);
+  FlowPolicy t(ledger, v({0}), v({1}), {.routing = dte_with(1), .admission = LL});
+  FlowPolicy c(ledger, v({0}), v({1}), {.routing = centralized()});
+  (void)c.place(1);
+  const NodeId s4[1] = {4};
+  const NodeId t5[1] = {5};
+  const std::vector<RouteDefinition> two {RouteDefinition {4, cyc.path({6, 0, 1, 3, 5}), 1}, RouteDefinition {4, cyc.path({7, 3, 4, 0, 2}), 2}};
+  const auto pc_prog = ForwardingProgram::from_routes(*cyc.g, s4, t5, two);
+  const NodeId s6[1] = {6};
+  const NodeId t7[1] = {7};
+  const std::vector<RouteDefinition> one {RouteDefinition {6, cyc.path({8}), 1}};
+  const auto pb_prog = ForwardingProgram::from_routes(*cyc.g, s6, t7, one);
+  FlowPolicy pc(cl, v({4}), v({5}), {.routing = Pinned {pc_prog, nullptr}, .admission = LY});
+  FlowPolicy pb(cl, v({6}), v({7}), {.routing = Pinned {pb_prog, nullptr}, .admission = LY});
+  FlowPolicy p(ledger, v({0}), v({1}), {.routing = Pinned {ForwardingProgram::from_routes(*n.g, std::vector<NodeId> {0}, std::vector<NodeId> {1},
+                                                                                          std::vector<RouteDefinition> {RouteDefinition {0, n.path({0}), 1}}),
+                                                           nullptr},
+                                        .admission = LY});
+  FlowPolicy inf(ledger, v({0}), v({1}), ly);
+  (void)inf.place(std::nullopt);
+  FlowPolicy fw(ledger, v({0}), v({1}), ly);
+  (void)fw.replace(1);
+  const auto foreign_black = other.mask({}, {0});
+  const BatchMode O = BatchMode::Ordered;
+  const BatchMode S = BatchMode::Simultaneous;
+  auto first = [&](FlowLedger& l, std::vector<Action> list, BatchMode mode) {
+    const std::string e = error_of([&] { (void)apply_actions(l, list, mode); });
+    return e.empty() ? std::string("valid") : e;
+  };
+  const Texts got {
+      first(ledger, {Replace {a, -1}, Replace {x, 1}}, O),
+      first(ledger, {Replace {a, 1}, Replace {a, -1}}, O),
+      first(ledger, {Forward {fw, std::nullopt}}, S),
+      first(ledger, {Place {all, 1}}, S),
+      first(ledger, {Replace {t, 1}}, S),
+      first(ledger, {Forward {c, std::nullopt}}, S),
+      first(cl, {Replace {pc, 3}, Replace {pb, Amount {1} << 62}}, S),
+      first(cl, {Replace {pc, 3}, Replace {pb, 1}}, S),
+      first(ledger, {Place {t, -1}}, O),
+      first(ledger, {Forward {p, std::nullopt}}, O),
+      first(ledger, {Place {inf, 5}, Replace {x, 1}}, O),
+      first(ledger, {Replace {a, 1, design_of(5)}, Replace {x, 1}}, O),
+      first(ledger, {Forward {fw, 1, foreign_black.get()}, Replace {x, 1}}, O),
+      first(ledger, {}, S),
+  };
+  EXPECT_EQ(got, (Texts {"offer must be an integer in [0, 2^62) or permitted +inf", "duplicate policy in list", "SIMULTANEOUS requires finite offers",
+                         "SIMULTANEOUS does not accept Place", "SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned",
+                         "SIMULTANEOUS requires admission=LOSSY", "offer must be an integer in [0, 2^62) or permitted +inf", kPeriodTwo,
+                         "DistributedTE does not support incremental placement", "Pinned forwards with replace",
+                         "list policy belongs to another ledger", "ShortestPaths does not accept design_demand",
+                         "black_holes belongs to another graph", "valid"}));
+}
+// The forwarding sizes' counting step on the example's sizes (per participant, groups of tunnels
+// of one path length): the entry count, then the occurrence count, each in wide arithmetic against
+// 2^31 - 1 (the network itself cannot be built at these sizes; the end-to-end refusals run under
+// the hooks' small limits, ForwardingSize and ApplyActions tests).
+TEST(ContractExamples, ERR_forwarding_limit) {
+  using Groups = std::vector<std::pair<std::int64_t, std::int64_t>>;
+  auto check = [](const std::vector<Groups>& participants) {
+    std::int64_t entries = 0;
+    std::int64_t occurrences = 0;
+    for (const auto& g : participants) {
+      for (const auto& [count, length] : g) {
+        entries += count;
+        occurrences += count * length;
+      }
+    }
+    try {
+      detail::check_forwarding_count(detail::ForwardingCounter::Entry, entries);
+      detail::check_forwarding_count(detail::ForwardingCounter::Occurrence, occurrences);
+    } catch (const std::invalid_argument& e) {
+      return std::string(e.what());
+    }
+    return std::string("within the entry and occurrence limits");
+  };
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  detail::thread_forwarding_limits() = {};
+#endif
+  EXPECT_EQ(check({{{10000, 214749}}}), "forwarding occurrence limit exceeded: 2147490000 > 2147483647");
+  EXPECT_EQ(check({{{10000, 214748}, {1, 3647}}}), "within the entry and occurrence limits");
+  EXPECT_EQ(check({{{10000, 214748}, {1, 3648}}}), "forwarding occurrence limit exceeded: 2147483648 > 2147483647");
+  EXPECT_EQ(check({{{1, 1073741824}}}), "within the entry and occurrence limits");
+  EXPECT_EQ(check({{{1, 1073741824}}, {{1, 1073741824}}}), "forwarding occurrence limit exceeded: 2147483648 > 2147483647");
+  EXPECT_EQ(check({{{2147483648, 1}}}), "forwarding entry limit exceeded: 2147483648 > 2147483647");
+}
+// The list's offers as C++ values (the Python conversions, a bool, a string, a fraction, a float or
+// an int beyond 64 bits, have no C++ form): -1 fails the call's domain, 5 and +inf are valid.
+TEST(ContractExamples, ERR_class_list) {
+  const Net n({{0, 1, 10, 1}});
+  auto run = [&](std::optional<Amount> offer) {
+    FlowLedger ledger(n.g);
+    FlowPolicy p(ledger, v({0}), v({1}), {.routing = ShortestPaths {}, .admission = LY});
+    const std::string e = error_of([&] { (void)apply_actions(ledger, std::vector<Action> {Place {p, offer}}, BatchMode::Ordered); });
+    return e.empty() ? std::string("valid") : e;
+  };
+  EXPECT_EQ(run(-1), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(run(5), "valid");
+  EXPECT_EQ(run(std::nullopt), "valid");
+}
+
+TEST(ContractExamples, FPublicationLocked) {
+  const auto out = detail::publication_model(true);
+  EXPECT_EQ(out.mixed, 0U);
+  EXPECT_EQ(out.states, 15U);
+}
+TEST(ContractExamples, FPublicationUnlocked) {
+  const auto out = detail::publication_model(false);
+  EXPECT_EQ(out.mixed, 2U);
+  EXPECT_EQ(out.states, 23U);
+}
+namespace {
+void expect_phases(std::string_view name, std::size_t states, std::size_t partial,
+                   std::size_t python_under_lock, std::size_t late_hits) {
+  const auto out = detail::phase_model(name);
+  EXPECT_EQ(out.states, states);
+  EXPECT_EQ(out.partial, partial);
+  EXPECT_EQ(out.python_under_lock, python_under_lock);
+  EXPECT_EQ(out.late_hits, late_hits);
+}
+} // namespace
+TEST(ContractExamples, FPublishResultFirst) { expect_phases("publish-result-first", 22, 0, 0, 0); }
+TEST(ContractExamples, FPublishResultAfter) { expect_phases("publish-result-after", 22, 1, 0, 0); }
+TEST(ContractExamples, FReadResultFailure) { expect_phases("read-result-failure", 20, 0, 0, 0); }
+TEST(ContractExamples, FReadResultUnderGate) { expect_phases("read-result-under-gate", 18, 0, 2, 0); }
+TEST(ContractExamples, FFrozenHits) { expect_phases("frozen-hits", 25, 0, 0, 0); }
+TEST(ContractExamples, FFrozenHitsAfterLease) { expect_phases("frozen-hits-after-lease", 28, 0, 0, 2); }
+
+TEST(ContractExamples, LIST_state_second) {
+  const Texts expected {
+    "offer must be an integer in [0, 2^62) or permitted +inf",
+    "black_holes belongs to another graph",
+    "list policy belongs to another ledger",
+    "offer must be an integer in [0, 2^62) or permitted +inf",
+    "offer must be an integer in [0, 2^62) or permitted +inf",
+    "requested limit exceeded",
+    "forward requires an installed program",
+    "finite placement after infinite placement requires a new epoch",
+    "offer must be an integer in [0, 2^62) or permitted +inf"};
+  Texts observed;
+  for (std::size_t which = 0; which < expected.size(); ++which) {
+    const Net net({{0, 1, 10, 1}}), foreign({{0, 1, 10, 1}});
+    FlowLedger ledger(net.g), other(net.g);
+    FlowPolicy a(ledger, v({0}), v({1}), {.routing = ShortestPaths{}, .admission = LY});
+    FlowPolicy b(ledger, v({0}), v({1}), {.routing = ShortestPaths{}, .admission = LY});
+    FlowPolicy x(other, v({0}), v({1}), {.routing = ShortestPaths{}, .admission = LY});
+    const auto program = ForwardingProgram::from_routes(*net.g, v({0}), v({1}),
+        std::vector<RouteDefinition>{{0, net.path({0}), 1}});
+    FlowPolicy pin(ledger, v({0}), v({1}), {.routing = Pinned{program}, .admission = LY});
+    const auto holes = foreign.mask({}, {0});
+    if (which == 3 || which == 7) (void)a.place(std::nullopt);
+    if (which == 6) (void)b.place(std::nullopt);
+    if (which == 4 || which == 5) {
+      const auto gate = detail::LedgerAccess::lock(ledger);
+      detail::PolicyAccess::engine(a).epoch.requested = Counter128{(std::uint64_t{1} << 63) - 1, ~std::uint64_t{0}};
+    }
+    std::vector<Action> actions;
+    switch (which) {
+      case 0: actions = {Forward{a, -1}}; break;
+      case 1: actions = {Forward{a, 1, holes.get()}}; break;
+      case 2: actions = {Forward{a, 1}, Replace{x, 1}}; break;
+      case 3: actions = {Place{a, 5}, Replace{b, -1}}; break;
+      case 4: actions = {Place{a, 1}, Replace{b, -1}}; break;
+      case 5: actions = {Place{a, 1}}; break;
+      case 6: actions = {Forward{a, 1}, Place{b, 5}}; break;
+      case 7: actions = {Place{a, 5}, Forward{b, 1}}; break;
+      case 8: actions = {Forward{a, 1}, Replace{pin, kDomainLimit}}; break;
+    }
+    const auto carried = ledger.carried();
+    const auto holds = ledger.reserved();
+    const auto a_program = a.program(), b_program = b.program(), pin_program = pin.program();
+    const auto record_id = detail::LedgerAccess::next_record_counter(ledger);
+    observed.push_back(error_of([&] { (void)apply_actions(ledger, actions,
+        which == 8 ? BatchMode::Simultaneous : BatchMode::Ordered); }));
+    EXPECT_EQ(ledger.carried(), carried);
+    EXPECT_EQ(ledger.reserved(), holds);
+    EXPECT_EQ(a.program(), a_program);
+    EXPECT_EQ(b.program(), b_program);
+    EXPECT_EQ(pin.program(), pin_program);
+    EXPECT_EQ(detail::LedgerAccess::next_record_counter(ledger), record_id);
+  }
+  EXPECT_EQ(observed, expected);
+}
+
+// The numeric/ownership forms of CALL-state-second. Wrong Python types and
+// malformed pair shapes have no C++ value and are checked by its Python port.
+TEST(ContractExamples, CALL_state_second) {
+  const Net net({{0, 1, 10, 1}}), foreign({{0, 1, 10, 1}});
+  FlowLedger ledger(net.g);
+  FlowPolicy p(ledger, v({0}), v({1}), {.routing = ShortestPaths{}, .admission = LY});
+  const auto holes = foreign.mask({}, {0});
+  const auto program = ForwardingProgram::from_routes(*net.g, v({0}), v({1}),
+      std::vector<RouteDefinition>{{0, net.path({0}), 1}});
+  FlowPolicy pin(ledger, v({0}), v({1}), {.routing = Pinned{program}, .admission = LY});
+  ShortestPathCache cache(*net.g), wrong(*foreign.g);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs {{{0}, {1}}};
+  EvaluationOptions options;
+  options.cache = &cache;
+  const std::string mode = "a supplied building ShortestPathCache has one writer: it is rejected unless workers == 1 (got workers = 2; a frozen cache may be shared by every worker)";
+  Texts observed;
+  observed.push_back(error_of([&] { (void)p.forward(-1); }));
+  observed.push_back(error_of([&] { (void)p.forward(std::nullopt); }));
+  observed.push_back(error_of([&] { (void)p.forward(1, holes.get()); }));
+  observed.push_back(error_of([&] { (void)pin.forward(-1); }));
+  observed.push_back(error_of([&] { (void)p.forward(1); }));
+  options.config.routing = Pinned{program};
+  observed.push_back(error_of([&] { (void)evaluate_pairs(*net.g, pairs, options, {}, 2); }));
+  options.config.routing = ShortestPaths{};
+  options.offer = kUnlimited;
+  observed.push_back(error_of([&] { (void)evaluate_pairs(*net.g, pairs, options, {}, 2); }));
+  options.offer.reset();
+  options.cache = &wrong;
+  observed.push_back(error_of([&] { (void)evaluate_pairs(*net.g, pairs, options, {}, 2); }));
+  options.cache = &cache;
+  observed.push_back(error_of([&] { (void)evaluate_pairs(*net.g, pairs, options, {}, 2); }));
+  options.offer = kUnlimited;
+  observed.push_back(error_of([&] { (void)evaluate_edge_failures(*net.g, v({0}), v({1}), options, 2); }));
+  options.offer.reset();
+  observed.push_back(error_of([&] { (void)evaluate_edge_failures(*net.g, v({0}), v({1}), options, 2); }));
+  EXPECT_EQ(observed, (Texts{
+      "offer must be an integer in [0, 2^62) or permitted +inf", "LOSSY forwarding requires a finite offer",
+      "black_holes belongs to another graph", "Pinned forwards with replace", "forward requires an installed program",
+      "evaluate_pairs does not accept Pinned", "offer must be an integer in [0, 2^62)",
+      "foreign ShortestPathCache: bound to another graph", mode, "offer must be an integer in [0, 2^62)", mode}));
+}
+
+namespace {
+
+// Independently decode b = significand * 2^exponent, then divide integers with a half-up
+// remainder test. No production kernel, floating scaling, floor or floating +1/2 is used.
+Amount binary_units_reference(double b, int k) {
+  const auto bits = std::bit_cast<std::uint64_t>(b);
+  const auto biased = static_cast<int>((bits >> 52) & 0x7ffU);
+  const auto significand = (bits & ((std::uint64_t {1} << 52) - 1)) |
+                          (biased == 0 ? 0 : (std::uint64_t {1} << 52));
+  const int exponent = (biased == 0 ? -1074 : biased - 1023 - 52) - k;
+  if (exponent >= 0) return static_cast<Amount>(significand << exponent);
+  const int down = -exponent;
+  if (down >= 64) return 0;
+  const auto remainder = significand & ((std::uint64_t {1} << down) - 1);
+  return static_cast<Amount>((significand >> down) + (remainder >= (std::uint64_t {1} << (down - 1))));
+}
+
+void unit_error(double b, double q, Amount expected, double error_in_units) {
+  const auto u = to_units(b, q);
+  EXPECT_EQ(u, expected);
+  const auto product = as_float(u, q);
+  EXPECT_EQ(product, static_cast<double>(u) * q);
+  EXPECT_EQ((product - b) / q, error_in_units);
+  EXPECT_GT((product - b) / q, -0.5);
+  EXPECT_LE((product - b) / q, 0.5);
+}
+
+} // namespace
+
+TEST(ContractExamples, UNITS_literal_tie) {
+  const double q = 0x1p-21;
+  unit_error(5501195.1796, q, 11536842473289LL, 0.5);
+  EXPECT_EQ(to_units(std::nextafter(5501195.1796, 0.0), q), 11536842473288LL);
+}
+
+TEST(ContractExamples, UNITS_computed_tie) {
+  const double q = 0x1p-18;
+  unit_error(400.0 + 0x1p-19, q, 104857601, 0.5);
+  EXPECT_EQ(to_units(400.0, q), 104857600);
+}
+
+TEST(ContractExamples, UNITS_float32) {
+  const double q = 0x1p-32;
+  // float32(0.1) = 13421773/134217728, not the decimal its short printing suggests.
+  const double b = static_cast<double>(0.1F);
+  EXPECT_EQ(b, 13421773.0 / 134217728.0);
+  unit_error(b, q, 429496736, 0.0);
+  EXPECT_EQ(to_units(0.1, q), 429496730);
+}
+
+TEST(ContractExamples, UNITS_ties) {
+  EXPECT_EQ(to_units(0x1p-33, 0x1p-32), 1);
+  EXPECT_EQ(to_units(std::nextafter(0x1p-33, 0.0), 0x1p-32), 0);
+  EXPECT_EQ(to_units(0x1p31, 0x1p32), 1);
+  for (Amount n = 0; n != 4; ++n) EXPECT_EQ(to_units(static_cast<double>(n) + 0.5, 1.0), n + 1);
+  EXPECT_EQ(to_units(0x1p52 - 0.5, 1.0), Amount {1} << 52);
+  EXPECT_EQ(to_units(0x1p52 + 1, 1.0), (Amount {1} << 52) + 1);
+  EXPECT_EQ(to_units(0x1p53 + 2, 1.0), (Amount {1} << 53) + 2);
+  EXPECT_EQ(to_units(-0.0, 1.0), 0);
+  EXPECT_EQ(to_units(std::numeric_limits<double>::denorm_min(), 0x1p32), 0);
+}
+
+TEST(ContractExamples, UNITS_round_trip) {
+  for (double q : {1.0, 0x1p-32, 0x1p32}) {
+    for (Amount u : {Amount {1} << 53, (Amount {1} << 53) + 2, (Amount {1} << 62) - 512}) {
+      EXPECT_EQ(to_units(as_float(u, q), q), u);
+    }
+    EXPECT_EQ(to_units(as_float((Amount {1} << 53) + 1, q), q), Amount {1} << 53);
+    EXPECT_EQ(as_float((Amount {1} << 53) + 1, q), 0x1p53 * q);
+    EXPECT_THROW((void)to_units(as_float((Amount {1} << 62) - 1, q), q), std::invalid_argument);
+  }
+  EXPECT_EQ(to_units(as_float(120401795907070192LL, 0x1p-27), 0x1p-27), 120401795907070192LL);
+}
+
+TEST(ContractExamples, UNITS_promoted_integer) {
+  const Amount first = (Amount {1} << 53) + 1;
+  const Amount second = (Amount {1} << 53) + 3;
+  unit_error(static_cast<double>(first), 1.0, first - 1, 0.0);
+  unit_error(static_cast<double>(second), 1.0, second + 1, 0.0);
+  // Compare as integers to preserve the promotion error which a double subtraction would hide.
+  EXPECT_EQ(to_units(static_cast<double>(first), 1.0) - first, -1);
+  EXPECT_EQ(to_units(static_cast<double>(second), 1.0) - second, 1);
+}
+
+TEST(ContractExamples, UNITS_as_float_range) {
+  EXPECT_EQ(as_float(-1, 0.5), -0.5);
+  EXPECT_EQ(as_float((Amount {1} << 53) + 3, 1.0), 9007199254740996.0);
+  // The native signature is int64, so the unbounded-integer finite-double boundary and
+  // 2^70+1 case belong to the Python API tests. Native int64 extrema are always finite.
+  for (int k = -32; k <= 32; ++k) {
+    const double q = std::ldexp(1.0, k);
+    EXPECT_EQ(as_float(std::numeric_limits<Amount>::max(), q), std::ldexp(1.0, 63 + k));
+    EXPECT_EQ(as_float(std::numeric_limits<Amount>::min(), q), -std::ldexp(1.0, 63 + k));
+    EXPECT_EQ(as_float(-(Amount {1} << 53), q), -0x1p53 * q);
+    EXPECT_EQ(as_float(-((Amount {1} << 53) + 3), q), -(0x1p53 + 4) * q);
+  }
+}
+
+TEST(ContractExamples, UNITS_sums) {
+  EXPECT_EQ(to_units(0.5, 1.0), 1);
+  EXPECT_EQ(to_units(0.5, 1.0) + to_units(0.5, 1.0), 2);
+  EXPECT_EQ(to_units(0.5 + 0.5, 1.0), 1);
+  EXPECT_EQ(to_units(0.25, 1.0), 0);
+  EXPECT_EQ(to_units(0.25, 1.0) + to_units(0.25, 1.0), 0);
+  EXPECT_EQ(to_units(0.25 + 0.25, 1.0), 1);
+  EXPECT_EQ(as_float(2, 1.0) - (0.5 + 0.5), 1.0);
+  EXPECT_EQ(as_float(0, 1.0) - (0.25 + 0.25), -0.5);
+}
+
+TEST(ContractExamples, UNITS_double_steps) {
+  // Two hand-derived differentiators for each oracle branch: below half/at half, odd/even
+  // ties, the last tie/first integral double, and exact/inexact integer promotion.
+  EXPECT_EQ(binary_units_reference(0.25, 0), 0);
+  EXPECT_EQ(binary_units_reference(0.5, 0), 1);
+  EXPECT_EQ(binary_units_reference(1.5, 0), 2);
+  EXPECT_EQ(binary_units_reference(2.5, 0), 3);
+  EXPECT_EQ(binary_units_reference(0x1p52 - 0.5, 0), Amount {1} << 52);
+  EXPECT_EQ(binary_units_reference(0x1p52 + 1, 0), (Amount {1} << 52) + 1);
+  EXPECT_EQ(binary_units_reference(0x1p53, 0), Amount {1} << 53);
+  EXPECT_EQ(binary_units_reference(0x1p53 + 2, 0), (Amount {1} << 53) + 2);
+  EXPECT_EQ(binary_units_reference(0x1p-1074, 32), 0);
+  EXPECT_EQ(binary_units_reference(0x1p-1074, -32), 0);
+  std::mt19937_64 rng(10);
+  int checked = 0;
+  int returned = 0;
+  for (int k = -32; k <= 32; ++k) {
+    const double q = std::ldexp(1.0, k);
+    const auto check = [&](double b) {
+      const auto expected = binary_units_reference(b, k);
+      const auto u = to_units(b, q);
+      EXPECT_EQ(u, expected) << "b=" << std::hexfloat << b << " k=" << k;
+      const auto value = as_float(u, q);
+      EXPECT_EQ(value, static_cast<double>(u) * q);
+      EXPECT_GT((value - b) / q, -0.5);
+      EXPECT_LE((value - b) / q, 0.5);
+      ++checked;
+    };
+    for (int i = 0; i < 68; ++i) {
+      const Amount n = i == 0 ? 0 : i == 1 ? 1 : i == 2 ? Amount {1} << 26 :
+                       i == 3 ? (Amount {1} << 52) - 1 : static_cast<Amount>(rng() % (std::uint64_t {1} << 52));
+      const double tie = static_cast<double>(2 * n + 1) * q / 2;
+      EXPECT_EQ(to_units(tie, q), n + 1);
+      check(tie);
+      check(std::nextafter(tie, 0.0));
+      check(std::nextafter(tie, std::numeric_limits<double>::infinity()));
+    }
+    for (double edge : {0x1p52, 0x1p53}) {
+      check(edge * q);
+      check(std::nextafter(edge * q, 0.0));
+    }
+    check(std::numeric_limits<double>::denorm_min());
+    for (int i = 0; i < 64; ++i) {
+      // A 53-bit significand, with exponents covering tiny values through <2^62 scaled units.
+      const double mantissa = static_cast<double>(rng() >> 11) * 0x1p-53;
+      const int exponent = static_cast<int>(rng() % 103) - 40;
+      check(std::ldexp(mantissa, exponent) * q);
+    }
+    for (int i = 0; i < 68; ++i) {
+      const Amount u = i == 0 ? 0 : i == 1 ? 1 : i == 2 ? (Amount {1} << 53) - 1 :
+                       i == 3 ? Amount {1} << 53 : static_cast<Amount>(rng() % ((std::uint64_t {1} << 53) + 1));
+      EXPECT_EQ(to_units(as_float(u, q), q), u);
+      ++returned;
+    }
+  }
+  EXPECT_EQ(checked, 17745);
+  EXPECT_EQ(returned, 4420);
+}
diff --git a/tests/cpp/distributed_te_tests.cpp b/tests/cpp/distributed_te_tests.cpp
new file mode 100644
index 0000000..1e27fcb
--- /dev/null
+++ b/tests/cpp/distributed_te_tests.cpp
@@ -0,0 +1,1752 @@
+// T1 (DistributedTE(TunnelCount(N))): every head sets up its own strict tunnels by CSPF
+// (docs/semantics.md, "T1: tunnels set up by their heads"), the two ledger projections, T1's
+// programs, replays and stale forwarding, records, rows, flags and terminations, T1's evaluators
+// and the numeric ranges of its sums. Every expected value is derived by hand from those rules,
+// never from a build; the property test compares random small cases with t1_reference
+// (test_utils.hpp), an independent restatement of T1's setup and forwarding that calls none of the
+// library's searches or apportionment helpers.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <random>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+constexpr Admission LOSSLESS = Admission::Lossless;
+constexpr Admission LOSSY = Admission::Lossy;
+constexpr TunnelStatus UP = TunnelStatus::Up;
+constexpr TunnelStatus NB = TunnelStatus::InsufficientBandwidth;
+constexpr TunnelStatus CC = TunnelStatus::CostCeilingExceeded;
+constexpr TunnelStatus FAILED = TunnelStatus::Failed;
+constexpr TunnelStatus BLACKHOLED = TunnelStatus::Blackholed;
+const std::optional<Amount> INF;  // +inf
+
+using Amounts = std::vector<Amount>;
+using Edges = std::vector<EdgeId>;
+using Pairs = std::vector<std::pair<EdgeId, Amount>>;
+// A by_tunnel row: (index, head, status, assigned, delivered, dropped).
+using Row = std::tuple<std::int32_t, NodeId, TunnelStatus, Amount, Amount, Amount>;
+using Rows = std::vector<Row>;
+// A by_source row: (source, offered or -1 when Lossless, admitted, delivered, source_drops, total_edge_drops).
+using SourceRow = std::tuple<NodeId, Amount, Amount, Amount, Amount, Amount>;
+
+// A graph whose rows are given in EdgeId order (the ledger's eK notation).
+std::shared_ptr<const Graph> ordered(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+
+FlowPolicyConfig t1(std::int64_t n, Admission a = LOSSLESS, std::optional<CostCeiling> ceiling = std::nullopt,
+                    Amount minimum = 0, RouteTieBreak tie = RouteTieBreak::FewerHops, bool parallel_edges = true) {
+  return FlowPolicyConfig {.routing = DistributedTE {TunnelCount {n}, ceiling, minimum, tie, parallel_edges}, .admission = a};
+}
+
+Amount lo(const Counter128& c) {
+  EXPECT_EQ(c.hi, 0U);
+  return static_cast<Amount>(c.lo);
+}
+Amount lo(const std::optional<Counter128>& c) { return c.has_value() ? lo(*c) : -1; }
+
+Rows rows(const PlacementResult& r) {
+  Rows out;
+  for (const auto& t : r.by_tunnel) out.emplace_back(t.entry_id, t.head, t.status, lo(t.assigned), t.delivered, lo(t.total_edge_drops));
+  return out;
+}
+std::vector<SourceRow> source_rows(const PlacementResult& r) {
+  std::vector<SourceRow> out;
+  for (const auto& s : r.by_source) {
+    out.emplace_back(s.source, lo(s.offered), lo(s.admitted), s.delivered, lo(s.source_drops), lo(s.total_edge_drops));
+  }
+  return out;
+}
+std::vector<TunnelStatus> statuses(const ForwardingProgram& p) {
+  std::vector<TunnelStatus> out;
+  for (const auto& t : p.tunnels()) out.push_back(t.status);
+  return out;
+}
+// Each tunnel's path (empty when down), in index order.
+std::vector<Edges> routes(const ForwardingProgram& p) {
+  std::vector<Edges> out;
+  for (const auto& t : p.tunnels()) out.push_back(t.edges.value_or(Edges {}));
+  return out;
+}
+Amounts requests(const ForwardingProgram& p) {
+  Amounts out;
+  for (const auto& t : p.tunnels()) out.push_back(t.requested_bandwidth);
+  return out;
+}
+std::vector<std::optional<std::int32_t>> entries(const std::vector<FlowRecord>& records) {
+  std::vector<std::optional<std::int32_t>> out;
+  for (const auto& r : records) out.push_back(r.entry_id);
+  return out;
+}
+std::vector<Pairs> holds(const std::vector<FlowRecord>& records) {
+  std::vector<Pairs> out;
+  for (const auto& r : records) out.push_back(r.edge_reservations);
+  return out;
+}
+
+// One policy on its own ledger.
+struct Pol {
+  std::shared_ptr<FlowLedger> ledger;
+  std::unique_ptr<FlowPolicy> p;
+  FlowPolicy* operator->() const { return p.get(); }
+};
+Pol make(const std::shared_ptr<const Graph>& g, std::vector<NodeId> s, std::vector<NodeId> d, const FlowPolicyConfig& c,
+         const Eligibility* elig = nullptr, std::shared_ptr<FlowLedger> ledger = nullptr) {
+  Pol out;
+  out.ledger = ledger ? std::move(ledger) : std::make_shared<FlowLedger>(g);
+  out.p = std::make_unique<FlowPolicy>(*out.ledger, s, d, c, elig);
+  return out;
+}
+
+// The graphs of the hand derivations.
+std::shared_ptr<const Graph> one10() { return ordered(2, {{0, 1, 10, 1}}); }
+std::shared_ptr<const Graph> twoh(Amount a, Amount b) { return ordered(3, {{0, 2, a, 1}, {1, 2, b, 1}}); }
+std::shared_ptr<const Graph> par612() { return ordered(2, {{0, 1, 6, 1}, {0, 1, 6, 2}}); }
+std::shared_ptr<const Graph> diam5() {
+  return ordered(4, {{0, 1, 6, 1}, {0, 2, 6, 3}, {1, 2, 4, 1}, {1, 3, 6, 3}, {2, 3, 6, 1}});
+}
+std::shared_ptr<const Graph> x8() { return ordered(3, {{0, 2, 0, 1}, {1, 2, 8, 3}}); }
+std::shared_ptr<const Graph> zl() { return ordered(2, {{0, 1, 0, 1}, {0, 1, 10, 2}}); }
+
+const OutputOptions kHolds {.edge_reservations = true};
+
+} // namespace
+
+// ---------------------------------------------------------------- the worked examples
+
+// Every worked T1 example, reproduced with the example's own inputs
+// and expected values: the requests in round order, every tunnel's status and path, the holds per
+// edge and in all, the lossless bound (Lossless replace(+inf, D)), and with an offer O the Lossy
+// shares per entry, delivery and source loss of replace(O, D).
+TEST(T1Setup, ContractExamples) {
+  struct Example {
+    const char* id;
+    std::int32_t n;
+    std::vector<InEdge> edges;
+    std::vector<NodeId> heads;
+    NodeId dst;
+    Amount D;
+    std::int64_t N;
+    std::optional<CostCeiling> ceiling;
+    Amounts requests;
+    std::vector<Edges> routes;
+    std::vector<TunnelStatus> status;
+    Amount reserved;
+    Amounts edge_reservations;
+    Amount bound;
+    std::optional<Amount> offer {};
+    Amounts shares {};  // Lossy offered per entry
+    Amount delivery {0};
+    Amount source_drops {0};
+  };
+  const std::vector<InEdge> diam = {{0, 1, 6, 1}, {0, 2, 6, 3}, {1, 2, 4, 1}, {1, 3, 6, 3}, {2, 3, 6, 1}};
+  const std::vector<InEdge> g1 = {{0, 1, 8192, 1}, {0, 2, 40960, 1}, {1, 3, 8192, 1}, {2, 3, 40960, 1}};
+  std::vector<Edges> branch_routes(16, Edges {1, 3});
+  branch_routes[0] = branch_routes[1] = Edges {0, 2};
+  branch_routes[15] = {};
+  std::vector<TunnelStatus> branch_status(16, UP);
+  branch_status[15] = NB;
+  std::vector<Edges> large_routes(16, Edges {});
+  large_routes[0] = Edges {1, 3};
+  std::vector<TunnelStatus> large_status(16, NB);
+  large_status[0] = UP;
+  Amounts branch_shares(16, 3277);
+  branch_shares[12] = branch_shares[13] = branch_shares[14] = 3276;
+  branch_shares[15] = 0;
+  const std::vector<Example> examples = {
+      {"four tunnels on two parallel links",
+       2, {{0, 1, 6, 1}, {0, 1, 6, 2}}, {0}, 1, 12, 4, std::nullopt, {3, 3, 3, 3}, {{0}, {0}, {1}, {1}},
+       {UP, UP, UP, UP}, 12, {6, 6}, 12, 13, {4, 3, 3, 3}, 12, 0},
+      {"uneven requests 3 and 2",
+       2, {{0, 1, 3, 1}, {0, 1, 2, 2}}, {0}, 1, 5, 2, std::nullopt, {3, 2}, {{0}, {1}}, {UP, UP}, 5, {3, 2}, 5, 5,
+       {3, 2}, 5, 0},
+      {"a share below the tunnel count",
+       2, {{0, 1, 6, 1}, {0, 1, 6, 2}}, {0}, 1, 1, 2, std::nullopt, {1, 0}, {{0}, {0}}, {UP, UP}, 1,
+       {1, 0}, 6, 1, {1, 0}, 1, 0},
+      {"carried above the holds",
+       2, {{0, 1, 5, 1}, {0, 1, 5, 1}}, {0}, 1, 8, 2, std::nullopt, {4, 4}, {{0}, {1}}, {UP, UP},
+       8, {4, 4}, 10, 10, {5, 5}, 10, 0},
+      {"a zero request on a zero-capacity link",
+       2, {{0, 1, 0, 1}}, {0}, 1, 0, 1, std::nullopt, {0}, {{0}}, {UP}, 0, {0}, 0, 1, {1}, 0, 0},
+      {"the last tunnel without bandwidth",
+       2, {{0, 1, 2, 1}, {0, 1, 10, 2}}, {0}, 1, 12, 4, std::nullopt, {3, 3, 3, 3}, {{1}, {1}, {1}, {}},
+       {UP, UP, UP, NB}, 9, {0, 9}, 10, 12, {4, 4, 4, 0}, 10, 0},
+      {"two heads sharing a link",
+       4, {{0, 2, 6, 1}, {1, 2, 6, 1}, {2, 3, 6, 1}}, {0, 1}, 3, 12, 2, std::nullopt, {3, 3, 3, 3},
+       {{0, 2}, {1, 2}, {}, {}}, {UP, UP, NB, NB}, 6, {3, 3, 6}, 6, 12, {6, 6, 0, 0}, 6, 0},
+      {"three heads, one with a zero request",
+       4, {{0, 3, 20, 1}, {1, 3, 20, 1}, {2, 3, 20, 1}}, {0, 1, 2}, 3, 2, 1, std::nullopt, {1, 1, 0},
+       {{0}, {1}, {2}}, {UP, UP, UP}, 2, {1, 1, 0}, 60, 3, {1, 1, 1}, 3, 0},
+      {"two equal links, one tunnel each",
+       2, {{0, 1, 5, 1}, {0, 1, 5, 1}}, {0}, 1, 8, 2, std::nullopt, {4, 4}, {{0}, {1}}, {UP, UP}, 8, {4, 4}, 10,
+       8, {4, 4}, 8, 0},
+      {"a head behind a zero-capacity link",
+       3, {{0, 2, 0, 1}, {1, 2, 8, 3}}, {0, 1}, 2, 4, 1, std::nullopt, {2, 2}, {{}, {1}}, {NB, UP}, 2, {0, 2}, 0,
+       4, {0, 2}, 2, 2},
+      {"a head behind a zero-capacity link, AbsoluteCost(3)",
+       3, {{0, 2, 0, 1}, {1, 2, 8, 3}}, {0, 1}, 2, 4, 1, AbsoluteCost {3}, {2, 2}, {{}, {1}}, {NB, UP}, 2,
+       {0, 2}, 0},
+      {"a head behind a zero-capacity link, CostStretch(2)",
+       3, {{0, 2, 0, 1}, {1, 2, 8, 3}}, {0, 1}, 2, 4, 1, CostStretch(2), {2, 2}, {{}, {}}, {NB, CC}, 0,
+       {0, 0}, 0},
+      // A-X8-Stretch-exact: c0 = 5 and the factor exactly 6/5, so the cost-6 path is admitted at
+      // equality; A-X8-Stretch-cost7: at cost 7 it exceeds the ceiling.
+      {"CostStretch(6/5) admits the next path at equality",
+       2, {{0, 1, 0, 5}, {0, 1, 1, 6}}, {0}, 1, 1, 1, CostStretch(6, 5), {1}, {{1}}, {UP}, 1, {0, 1}, 1,
+       1, {1}, 1, 0},
+      {"CostStretch(6/5) below a path of cost 7",
+       2, {{0, 1, 0, 5}, {0, 1, 1, 7}}, {0}, 1, 1, 1, CostStretch(6, 5), {1}, {{}}, {CC}, 0, {0, 0}, 0,
+       1, {0}, 0, 1},
+      {"the diamond, design 8",
+       4, diam, {0}, 3, 8, 2, std::nullopt, {4, 4}, {{0, 2, 4}, {}}, {UP, NB}, 4, {4, 0, 4, 0, 4}, 4},
+      {"the diamond, design 10",
+       4, diam, {0}, 3, 10, 2, std::nullopt, {5, 5}, {{0, 3}, {1, 4}}, {UP, UP}, 10, {5, 5, 0, 5, 5}, 12},
+      {"the diamond, design 14",
+       4, diam, {0}, 3, 14, 2, std::nullopt, {7, 7}, {{}, {}}, {NB, NB}, 0, {0, 0, 0, 0, 0}, 0},
+      {"two heads, the second with bandwidth",
+       3, {{0, 2, 2, 1}, {1, 2, 10, 1}}, {0, 1}, 2, 12, 2, std::nullopt, {3, 3, 3, 3}, {{}, {1}, {}, {1}},
+       {NB, UP, NB, UP}, 6, {0, 6}, 0, 12, {0, 3, 0, 3}, 6, 6},
+      {"more tunnels than units",
+       2, {{0, 1, 10, 1}}, {0}, 1, 3, 4, std::nullopt, {1, 1, 1, 0}, {{0}, {0}, {0}, {0}}, {UP, UP, UP, UP}, 3,
+       {3}, 10, 3, {1, 1, 1, 0}, 3, 0},
+      {"an idle tunnel on a zero-capacity link",
+       2, {{0, 1, 0, 1}, {0, 1, 10, 2}}, {0}, 1, 1, 2, std::nullopt, {1, 0}, {{1}, {0}}, {UP, UP}, 1,
+       {0, 1}, 1, 2, {1, 1}, 1, 0},
+      {"a zero design",
+       2, {{0, 1, 10, 1}}, {0}, 1, 0, 2, std::nullopt, {0, 0}, {{0}, {0}}, {UP, UP}, 0, {0}, 10, 4,
+       {2, 2}, 4, 0},
+      // The sixteen tunnels' Lossy delivery (not in the example), by hand: tunnels 0 and 1 carry their 3277 + 3277 =
+      // 6554 within 8192; tunnels 2 to 14 bring 10 * 3277 + 3 * 3276 = 42598 to the 40960 link: 47514.
+      {"sixteen tunnels on two branches",
+       4, g1, {0}, 3, 49152, 16, std::nullopt, Amounts(16, 3072), branch_routes, branch_status, 46080,
+       {6144, 39936, 6144, 39936}, 47262, 49152, branch_shares, 47514, 0},
+      {"sixteen tunnels, a design above the network",
+       4, g1, {0}, 3, 409600, 16, std::nullopt, Amounts(16, 25600), large_routes, large_status,
+       25600, {0, 25600, 0, 25600}, 40960},
+  };
+  for (const auto& x : examples) {
+    const std::string where = x.id;
+    const auto g = ordered(x.n, x.edges);
+    // The setup and the lossless bound.
+    auto ll = make(g, x.heads, {x.dst}, t1(x.N, LOSSLESS, x.ceiling));
+    const auto r = ll->replace(INF, x.D, kHolds);
+    ASSERT_TRUE(r.program) << where;
+    EXPECT_EQ(requests(*r.program), x.requests) << where;
+    EXPECT_EQ(routes(*r.program), x.routes) << where;
+    EXPECT_EQ(statuses(*r.program), x.status) << where;
+    ASSERT_TRUE(r.plan.has_value()) << where;
+    EXPECT_EQ(r.plan->total_reserved_bandwidth, x.reserved) << where;
+    EXPECT_EQ(*r.edge_reservations, x.edge_reservations) << where;
+    EXPECT_EQ(ll.ledger->reserved(), x.edge_reservations) << where;
+    EXPECT_EQ(r.call_delivered, x.bound) << where;
+    EXPECT_EQ(r.termination, Termination::Exhausted) << where;  // an unlimited query
+    if (!x.offer.has_value()) continue;
+    auto ly = make(g, x.heads, {x.dst}, t1(x.N, LOSSY, x.ceiling));
+    const auto s = ly->replace(*x.offer, x.D);
+    Amounts shares;
+    for (const auto& t : s.by_tunnel) shares.push_back(lo(t.assigned));
+    EXPECT_EQ(shares, x.shares) << where;
+    EXPECT_EQ(s.call_delivered, x.delivery) << where;
+    EXPECT_EQ(s.call_source_drops, x.source_drops) << where;
+    EXPECT_EQ(s.termination, Termination::Complete) << where;
+    // The setup does not depend on the offer: the same program as the Lossless call's.
+    EXPECT_EQ(routes(*s.program), x.routes) << where;
+    EXPECT_EQ(statuses(*s.program), x.status) << where;
+  }
+}
+
+// The design split: D = 5 over two heads and N = 2: shares RR(5, 2) = (3, 2); requests in round
+// order 2, 1, 1, 1. And TWOH(10, 10), D = 10: shares (5, 5), requests 3, 3, 2, 2.
+TEST(T1Setup, RoundOrder) {
+  auto p = make(twoh(10, 10), {0, 1}, {2}, t1(2));
+  const auto split = p->replace(5, 5);
+  EXPECT_EQ(requests(*split.program), (Amounts {2, 1, 1, 1}));
+  std::vector<NodeId> heads;
+  std::vector<std::int32_t> indices, locals;
+  for (const auto& t : split.program->tunnels()) {
+    heads.push_back(t.head);
+    indices.push_back(t.entry_id);
+    locals.push_back(t.local_index);
+  }
+  EXPECT_EQ(heads, v({0, 1, 0, 1}));
+  EXPECT_EQ(indices, (std::vector<std::int32_t> {0, 1, 2, 3}));
+  EXPECT_EQ(locals, (std::vector<std::int32_t> {0, 0, 1, 1}));
+  EXPECT_EQ(split.plan->design_by_head, (std::vector<std::pair<NodeId, Amount>> {{0, 3}, {1, 2}}));
+  EXPECT_EQ(requests(*p->replace(10, 10).program), (Amounts {3, 3, 2, 2}));
+}
+
+// ---------------------------------------------------------------- setup
+
+// PARX (e0 cap 4, e1 cap 10, both cost 1), N = 2, D = 8 (requests 4 and 4). FEWER_HOPS reads no
+// score: e0 (lowest EdgeId), then e1 (e0 is filtered at U = 0). HIGHER_CAPACITY reads C (10 > 4):
+// e1 twice; HIGHER_AVAILABLE_CAPACITY reads U (10 > 4, then 6 > 4): e1 twice; HIGHER_HEADROOM reads
+// U/C (4/4 = 10/10: a tie, then the lower EdgeId e0; then e0 is filtered): e0, e1.
+TEST(T1Setup, TieBreaks) {
+  const auto g = ordered(2, {{0, 1, 4, 1}, {0, 1, 10, 1}});
+  struct Case {
+    RouteTieBreak s;
+    std::vector<Edges> routes;
+    Amounts holds;
+  };
+  for (const auto& c : {Case {RouteTieBreak::FewerHops, {{0}, {1}}, {4, 4}},
+                        Case {RouteTieBreak::HigherCapacity, {{1}, {1}}, {0, 8}},
+                        Case {RouteTieBreak::HigherAvailableCapacity, {{1}, {1}}, {0, 8}},
+                        Case {RouteTieBreak::HigherHeadroom, {{0}, {1}}, {4, 4}}}) {
+    auto p = make(g, {0}, {1}, t1(2, LOSSLESS, std::nullopt, 0, c.s));
+    const auto r = p->replace(8, 8);
+    EXPECT_EQ(routes(*r.program), c.routes);
+    EXPECT_EQ(p.ledger->reserved(), c.holds);
+  }
+}
+
+// PVIEW (e0 cap 10, e1 cap 8) with FlowLedger(g, reservation_baseline = [5, 8]), N = 1, D = 4: FEWER_HOPS
+// e0; HIGHER_CAPACITY e0 (C 10 > 8); HIGHER_AVAILABLE_CAPACITY e1 (U 8 > 5); HIGHER_HEADROOM e1
+// (8/8 > 5/10). HIGHER_AVAILABLE_CAPACITY and HIGHER_HEADROOM read U, not the service residual
+// (both 10 and 8 here).
+TEST(T1Setup, TieBreakReadsUnreserved) {
+  const auto g = ordered(2, {{0, 1, 10, 1}, {0, 1, 8, 1}});
+  const Amounts unreserved = {5, 8};
+  for (const auto& [s, want] : {std::pair {RouteTieBreak::FewerHops, Edges {0}},
+                                std::pair {RouteTieBreak::HigherCapacity, Edges {0}},
+                                std::pair {RouteTieBreak::HigherAvailableCapacity, Edges {1}},
+                                std::pair {RouteTieBreak::HigherHeadroom, Edges {1}}}) {
+    auto ledger = std::make_shared<FlowLedger>(g, g->edge_capacity_units(), unreserved);
+    auto p = make(g, {0}, {1}, t1(1, LOSSLESS, std::nullopt, 0, s), nullptr, ledger);
+    EXPECT_EQ(routes(*p->replace(4, 4).program), (std::vector<Edges> {want}));
+  }
+}
+
+// PAR(10, 10) with the reservation baseline [3, 8], N = 1, D = 1: equal capacities, so
+// HIGHER_CAPACITY ties and falls to hops, then the lower EdgeId (e0); the scores of
+// HIGHER_AVAILABLE_CAPACITY (3 < 8) and HIGHER_HEADROOM (3/10 < 8/10) read the unreserved view,
+// not the service view (10 and 10, a tie), and take e1.
+TEST(T1Setup, TieScores) {
+  const auto g = ordered(2, {{0, 1, 10, 1}, {0, 1, 10, 1}});
+  const Amounts unreserved = {3, 8};
+  for (const auto& [s, want] : {std::pair {RouteTieBreak::FewerHops, Edges {0}},
+                                std::pair {RouteTieBreak::HigherCapacity, Edges {0}},
+                                std::pair {RouteTieBreak::HigherAvailableCapacity, Edges {1}},
+                                std::pair {RouteTieBreak::HigherHeadroom, Edges {1}}}) {
+    auto ledger = std::make_shared<FlowLedger>(g, g->edge_capacity_units(), unreserved);
+    auto p = make(g, {0}, {1}, t1(1, LOSSLESS, std::nullopt, 0, s), nullptr, ledger);
+    EXPECT_EQ(routes(*p->replace(1, 1).program), (std::vector<Edges> {want})) << static_cast<int>(s);
+  }
+}
+
+// FILT (e0 cap 2, e1 cap 10), N = 1, D = 6: the filter (e0: 2 < 6) runs before the
+// collapse of parallel members, which would otherwise keep e0 (the lowest EdgeId at equal cost).
+TEST(T1Setup, FilterBeforeCollapse) {
+  const auto g = ordered(2, {{0, 1, 2, 1}, {0, 1, 10, 1}});
+  for (const bool parallel_edges : {false, true}) {
+    auto p = make(g, {0}, {1}, t1(1, LOSSLESS, std::nullopt, 0, RouteTieBreak::FewerHops, parallel_edges));
+    const auto r = p->replace(6, 6);
+    EXPECT_EQ(routes(*r.program), (std::vector<Edges> {{1}})) << parallel_edges;
+    EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {UP})) << parallel_edges;
+  }
+  // The last-tunnel-without-bandwidth example with parallel_edges = false (the filter comes before
+  // the collapse): UP, UP, UP, NB as with true.
+  const auto ax3 = ordered(2, {{0, 1, 2, 1}, {0, 1, 10, 2}});
+  auto p = make(ax3, {0}, {1}, t1(4, LOSSLESS, std::nullopt, 0, RouteTieBreak::FewerHops, false));
+  EXPECT_EQ(statuses(*p->replace(12, 12).program), (std::vector<TunnelStatus> {UP, UP, UP, NB}));
+}
+
+// min_unreserved_bandwidth filters every attempt at max(b, minimum) and is never a
+// reservation. PARC (e0 cap 4 cost 1, e1 cap 10 cost 2), N = 2, D = 2: minimum 5 filters e0 (4 <
+// 5): both on e1, holds [0, 2], bound 10; minimum 0: both on e0, holds [2, 0], bound 4. ZL with
+// minimum 1, D = 1, Lossy O = 2: requests 1 and 0, the request-0 tunnel now filtered at 1 too:
+// both on e1, holds [0, 1], delivered 2 (without the minimum, 1 is delivered).
+TEST(T1Setup, MinUnreserved) {
+  const auto parc = ordered(2, {{0, 1, 4, 1}, {0, 1, 10, 2}});
+  for (const auto& [minimum, path, holding, bound] :
+       {std::tuple {Amount {5}, Edges {1}, Amounts {0, 2}, Amount {10}}, std::tuple {Amount {0}, Edges {0}, Amounts {2, 0}, Amount {4}}}) {
+    auto p = make(parc, {0}, {1}, t1(2, LOSSLESS, std::nullopt, minimum));
+    const auto r = p->replace(INF, 2);
+    EXPECT_EQ(routes(*r.program), (std::vector<Edges> {path, path})) << minimum;
+    EXPECT_EQ(p.ledger->reserved(), holding) << minimum;
+    EXPECT_EQ(r.call_delivered, bound) << minimum;
+    EXPECT_EQ(r.plan->total_reserved_bandwidth, 2) << minimum;  // the requests, not the minimum
+  }
+  auto z = make(zl(), {0}, {1}, t1(2, LOSSY, std::nullopt, 1));
+  const auto r = z->replace(2, 1);
+  EXPECT_EQ(requests(*r.program), (Amounts {1, 0}));
+  EXPECT_EQ(routes(*r.program), (std::vector<Edges> {{1}, {1}}));
+  EXPECT_EQ(z.ledger->reserved(), (Amounts {0, 1}));
+  EXPECT_EQ(r.call_delivered, 2);
+}
+
+// Other owners' holds reduce U. ONE10: policy A (N = 1) replace(6, 6) holds 6
+// (reserved [6], unreserved [4]); policy B (N = 1, Lossy) replace(6, 6) sees U = 4 < 6: NB, its
+// share lost at the head; after A.remove() B's replace(6, 6) is up with the hold [6].
+TEST(T1Setup, OtherOwnersHolds) {
+  const auto g = one10();
+  auto ledger = std::make_shared<FlowLedger>(g);
+  auto a = make(g, {0}, {1}, t1(1), nullptr, ledger);
+  auto b = make(g, {0}, {1}, t1(1, LOSSY), nullptr, ledger);
+  EXPECT_EQ(statuses(*a->replace(6, 6).program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(ledger->reserved(), (Amounts {6}));
+  EXPECT_EQ(ledger->unreserved(), (Amounts {4}));
+  const auto down = b->replace(6, 6);
+  EXPECT_EQ(statuses(*down.program), (std::vector<TunnelStatus> {NB}));
+  EXPECT_EQ(down.call_source_drops, 6);
+  a->remove();
+  const auto up = b->replace(6, 6);
+  EXPECT_EQ(statuses(*up.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(ledger->reserved(), (Amounts {6}));
+  expect_balanced(*ledger, "after B's setup");
+}
+
+// TWOH(10, 10), N = 2, D = 10 with node 0 masked: the roster is [1] (requests 5, 5,
+// design_by_head ((1, 10))); source 0 keeps a zero by_source row (Lossy: offered 0).
+TEST(T1Setup, MaskedSource) {
+  const auto g = twoh(10, 10);
+  const auto mask = g->eligibility(std::vector<NodeId> {0}, {});
+  auto p = make(g, {0, 1}, {2}, t1(2, LOSSY), &mask);
+  const auto r = p->replace(10, 10);
+  EXPECT_EQ(requests(*r.program), (Amounts {5, 5}));
+  EXPECT_EQ(r.plan->design_by_head, (std::vector<std::pair<NodeId, Amount>> {{1, 10}}));
+  EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 0, 0, 0, 0, 0}, {1, 10, 10, 10, 0, 0}}));
+  EXPECT_EQ(vec(r.program->sources()), v({0, 1}));
+}
+
+// CostStretch(2) on X8: c0 = 1 is the pool minimum, through head 0's
+// zero-capacity link (before any filter): head 1's only path costs 3 > 2: COST_CEILING_EXCEEDED (a per-head
+// baseline would be 3 and admit it). The largest numerator, 2^63 - 1, does not overflow: NB, UP.
+TEST(T1Setup, StretchPoolBaseline) {
+  constexpr std::int64_t kMax = std::numeric_limits<std::int64_t>::max();
+  for (const auto& [f, second] : {std::pair {CostStretch(2), CC}, std::pair {CostStretch(kMax), UP}}) {
+    auto p = make(x8(), {0, 1}, {2}, t1(1, LOSSY, f));
+    EXPECT_EQ(statuses(*p->replace(4, 4).program), (std::vector<TunnelStatus> {NB, second})) << f.numerator();
+  }
+  // AbsoluteCost is inclusive: AbsoluteCost(3) admits the cost-3 path, AbsoluteCost(2) not.
+  auto in = make(x8(), {0, 1}, {2}, t1(1, LOSSY, AbsoluteCost {3}));
+  EXPECT_EQ(statuses(*in->replace(4, 4).program), (std::vector<TunnelStatus> {NB, UP}));
+  auto out = make(x8(), {0, 1}, {2}, t1(1, LOSSY, AbsoluteCost {2}));
+  EXPECT_EQ(statuses(*out->replace(4, 4).program), (std::vector<TunnelStatus> {NB, CC}));
+  // Large costs compare exactly: two parallel paths of 2^60 and 2^60 + 1 (two units each), D = 4,
+  // N = 2: CostStretch(1) admits only the cheaper one for the first tunnel, the second tunnel's only
+  // remaining path costs 2^60 + 1: CostCeiling; (2^60 + 1) / 2^60 admits it at equality, (2^61 + 1)
+  // / 2^61 does not ((2^60 + 1) * 2^61 = 2^121 + 2^61 > (2^61 + 1) * 2^60 = 2^121 + 2^60).
+  const Cost half = Cost {1} << 59;
+  const auto big = ordered(5, {{0, 1, 2, half}, {0, 2, 2, half}, {1, 4, 2, half}, {2, 4, 2, half + 1}});
+  const std::int64_t p60 = std::int64_t {1} << 60;
+  for (const auto& [f, want] : {std::pair {CostStretch(1), std::vector<TunnelStatus> {UP, CC}},
+                                std::pair {CostStretch(p60 + 1, p60), std::vector<TunnelStatus> {UP, UP}},
+                                std::pair {CostStretch(2 * p60 + 1, 2 * p60), std::vector<TunnelStatus> {UP, CC}},
+                                std::pair {CostStretch(kMax), std::vector<TunnelStatus> {UP, UP}}}) {
+    auto p = make(big, {0}, {4}, t1(2, LOSSLESS, f));
+    EXPECT_EQ(statuses(*p->replace(4, 4).program), want) << f.numerator() << "/" << f.denominator();
+  }
+  // The baseline ignores the setup view: a third party's holds on the cheap path leave c0 = 2^60.
+  auto ledger = std::make_shared<FlowLedger>(big);
+  auto third = make(big, {0}, {4}, t1(1), nullptr, ledger);
+  EXPECT_EQ(statuses(*third->replace(2, 2).program), (std::vector<TunnelStatus> {UP}));
+  auto p = make(big, {0}, {4}, t1(1, LOSSLESS, CostStretch(1)), nullptr, ledger);
+  EXPECT_EQ(statuses(*p->replace(2, 2).program), (std::vector<TunnelStatus> {CC}));
+  // A fractional factor is inclusive at equality: CostStretch(3/2) on c0 = 2 admits a path of cost 3
+  // exactly and rejects one of cost 4 (the cheaper links are too small for the request of 5).
+  auto at = make(ordered(2, {{0, 1, 1, 2}, {0, 1, 10, 3}}), {0}, {1}, t1(1, LOSSLESS, CostStretch(3, 2)));
+  const auto ra = at->replace(5, 5);
+  EXPECT_EQ(statuses(*ra.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(ra.program->tunnels()[0].path_cost, std::optional<Cost> {3});
+  auto above = make(ordered(2, {{0, 1, 1, 2}, {0, 1, 1, 3}, {0, 1, 10, 4}}), {0}, {1}, t1(1, LOSSLESS, CostStretch(3, 2)));
+  EXPECT_EQ(statuses(*above->replace(5, 5).program), (std::vector<TunnelStatus> {CC}));
+}
+
+// ---------------------------------------------------------------- forwarding
+
+// TWOH(2, 10) Lossless replace(12, 12): head 0 has no up tunnel, so only the total
+// 0 gives it nothing: call_delivered 0, unadmitted 12, Exhausted; the holds stand ([0, 6]).
+TEST(T1Forwarding, LosslessDeadHead) {
+  auto p = make(twoh(2, 10), {0, 1}, {2}, t1(2));
+  const auto r = p->replace(12, 12);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(lo(r.unadmitted), 12);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {0, 6}));
+}
+
+// Holds do not police and have no priority. ONE10: a ShortestPaths Lossy policy
+// carries 10 (residual 0); T1 (N = 1, Lossy) replace(4, 4) sets up on unreserved 10 (not the
+// residual): up, holding 4; its forwarding meets the residual 0: 4 dropped on e0, nothing delivered.
+TEST(T1Forwarding, HoldsDoNotQueue) {
+  const auto g = one10();
+  auto ledger = std::make_shared<FlowLedger>(g);
+  auto c = make(g, {0}, {1}, FlowPolicyConfig {ShortestPaths {}, LOSSY}, nullptr, ledger);
+  EXPECT_EQ(c->replace(10).call_delivered, 10);
+  auto p = make(g, {0}, {1}, t1(1, LOSSY), nullptr, ledger);
+  const auto r = p->replace(4, 4);
+  EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(ledger->reserved(), (Amounts {4}));
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{0, 4}}));
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(ledger->residual(), (Amounts {0}));
+  // Carried above the holds: each tunnel holds 4 and carries 5.
+  auto o = make(ordered(2, {{0, 1, 5, 1}, {0, 1, 5, 1}}), {0}, {1}, t1(2, LOSSY));
+  const auto over = o->replace(10, 8);
+  EXPECT_EQ(over.call_delivered, 10);
+  for (const auto& rec : o->records()) {
+    EXPECT_EQ(rec.delivered, 5);
+    ASSERT_EQ(rec.edge_reservations.size(), 1U);
+    EXPECT_EQ(rec.edge_reservations[0].second, 4);
+  }
+}
+
+// DIAM5 with D = 14: both tunnels down; Lossy replace(5, 14) loses
+// the 5 at the head (Complete: NO_ACTIVE_WEIGHT needs an entry with a path); Lossless places 0
+// (Exhausted). The offer 14 loses 14.
+TEST(T1Forwarding, AllDown) {
+  for (const Amount offer : {5, 14}) {
+    auto ly = make(diam5(), {0}, {3}, t1(2, LOSSY));
+    const auto r = ly->replace(offer, 14);
+    EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {NB, NB}));
+    EXPECT_EQ(r.call_source_drops, offer);
+    EXPECT_EQ(r.call_delivered, 0);
+    EXPECT_EQ(r.termination, Termination::Complete);
+    auto ll = make(diam5(), {0}, {3}, t1(2));
+    const auto s = ll->replace(offer, 14);
+    EXPECT_EQ(s.call_delivered, 0);
+    EXPECT_EQ(s.termination, Termination::Exhausted);
+  }
+}
+
+// PAR612, N = 4, Lossy replace(13, 12): shares RR(13, 4) = (4, 3, 3, 3); e0
+// receives 7 > 6 and carries H(6, [4, 3]) = (4, 2): tunnel 1 drops 1.
+TEST(T1Forwarding, ByTunnel) {
+  auto p = make(par612(), {0}, {1}, t1(4, LOSSY));
+  const auto r = p->replace(13, 12);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 4, 4, 0}, {1, 0, UP, 3, 2, 1}, {2, 0, UP, 3, 3, 0}, {3, 0, UP, 3, 3, 0}}));
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{0, 1}}));
+  EXPECT_EQ(r.call_delivered, 12);
+}
+
+// ---------------------------------------------------------------- operations
+
+// The TWOH call: TWOH(2, 10), N = 2, Lossy replace(12, 12),
+// then forward(8).
+TEST(T1Operations, ContractCall) {
+  auto p = make(twoh(2, 10), {0, 1}, {2}, t1(2, LOSSY));
+  const auto r = p->replace(12, 12, kHolds);
+  EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {NB, UP, NB, UP}));
+  EXPECT_EQ(r.call_delivered, 6);
+  EXPECT_EQ(r.call_source_drops, 6);
+  EXPECT_EQ(r.plan->total_reserved_bandwidth, 6);
+  EXPECT_EQ(r.plan->tunnels_per_head, 2);
+  EXPECT_EQ(r.plan->design_demand, std::optional<Amount> {12});
+  EXPECT_EQ(r.plan->design_by_head, (std::vector<std::pair<NodeId, Amount>> {{0, 6}, {1, 6}}));
+  EXPECT_EQ(*r.edge_reservations, (Amounts {0, 6}));
+  EXPECT_EQ(rows(r), (Rows {{0, 0, NB, 0, 0, 0}, {1, 1, UP, 3, 3, 0}, {2, 0, NB, 0, 0, 0}, {3, 1, UP, 3, 3, 0}}));
+  EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 6, 6, 0, 6, 0}, {1, 6, 6, 6, 0, 0}}));
+  const auto recs = p->records();
+  EXPECT_EQ(entries(recs), (std::vector<std::optional<std::int32_t>> {0, 1, 2, 3}));
+  EXPECT_EQ(holds(recs), (std::vector<Pairs> {{}, {{1, 3}}, {}, {{1, 3}}}));
+  for (const std::size_t down : {0U, 2U}) {
+    EXPECT_TRUE(ascending_edges(*recs[down].route).empty());
+    EXPECT_EQ(recs[down].min_route_cost, kUnreachable);
+  }
+  EXPECT_EQ(ascending_edges(*recs[1].route), (Edges {1}));
+  EXPECT_EQ(recs[1].min_route_cost, 1);
+  std::vector<std::int64_t> before;
+  for (const auto& rec : recs) before.push_back(rec.flow_id.second);
+  // forward(8): the same tunnels and holds; head 0 still loses its share (4).
+  const auto f = p->forward(8);
+  EXPECT_EQ(f.call_delivered, 4);
+  EXPECT_EQ(f.call_source_drops, 4);
+  EXPECT_EQ(f.delivery_delta, -2);
+  EXPECT_FALSE(f.routes_changed || f.weights_changed || f.reservations_changed);
+  EXPECT_EQ(f.program, r.program);
+  EXPECT_TRUE(f.plan == r.plan);
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {0, 6}));
+  Amounts shares;
+  for (const auto& t : f.by_tunnel) shares.push_back(lo(t.assigned));
+  EXPECT_EQ(shares, (Amounts {0, 2, 0, 2}));
+  const auto after = p->records();
+  EXPECT_EQ(holds(after), holds(recs));
+  for (std::size_t i = 0; i < after.size(); ++i) EXPECT_NE(after[i].flow_id.second, before[i]);
+  expect_balanced(*p.ledger, "after forward");
+}
+
+// ONE10, N = 1, Lossless replace(6, 6) twice: the second sees U = 10 (its own hold
+// released): up again, reserved [6] (not 12); all three flags false; the record id is new.
+TEST(T1Operations, ReplaceReleasesOwnHolds) {
+  auto p = make(one10(), {0}, {1}, t1(1));
+  (void)p->replace(6, 6);
+  const auto id = p->records().front().flow_id;
+  const auto r = p->replace(6, 6);
+  EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {6}));
+  EXPECT_FALSE(r.routes_changed || r.weights_changed || r.reservations_changed);
+  EXPECT_NE(p->records().front().flow_id, id);
+}
+
+// After replace(6, 6) on ONE10, evaluate(3, 8) sets up for 8 (its result holds 8) and publishes
+// nothing; replace(0) with N = 2 (D = 0): both up without a hold, Complete; replace(0, 12): requests
+// 6, 6, tunnel 0 up (U = 10), tunnel 1 NB (U = 4 < 6), holds [6]: a zero offer still books holds
+//.
+TEST(T1Operations, EvaluateAndZero) {
+  auto p = make(one10(), {0}, {1}, t1(1));
+  (void)p->replace(6, 6);
+  const auto ledger = ledger_state(*p.ledger);
+  const auto ep = epoch(*p.p);
+  const auto e = p->evaluate(3, 8, kHolds);
+  EXPECT_EQ(statuses(*e.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(requests(*e.program), (Amounts {8}));
+  EXPECT_EQ(e.program->tunnels()[0].reserved_bandwidth, 8);
+  EXPECT_EQ(e.plan->total_reserved_bandwidth, 8);
+  EXPECT_EQ(*e.edge_reservations, (Amounts {8}));
+  EXPECT_EQ(e.call_delivered, 3);
+  expect_same(ledger_state(*p.ledger), ledger, "evaluate");
+  expect_unchanged(epoch(*p.p), ep, "evaluate");
+  auto q = make(one10(), {0}, {1}, t1(2));
+  const auto z = q->replace(0);
+  EXPECT_EQ(statuses(*z.program), (std::vector<TunnelStatus> {UP, UP}));
+  EXPECT_EQ(requests(*z.program), (Amounts {0, 0}));
+  EXPECT_EQ(q.ledger->reserved(), (Amounts {0}));
+  EXPECT_EQ(z.termination, Termination::Complete);
+  EXPECT_EQ(z.call_delivered, 0);
+  const auto z12 = q->replace(0, 12);
+  EXPECT_EQ(requests(*z12.program), (Amounts {6, 6}));
+  EXPECT_EQ(statuses(*z12.program), (std::vector<TunnelStatus> {UP, NB}));
+  EXPECT_EQ(q.ledger->reserved(), (Amounts {6}));
+  EXPECT_EQ(z12.termination, Termination::Complete);
+}
+
+// PAR612, N = 4, Lossless replace(+inf, 12): call_delivered 12, call_undelivered +inf, requested +inf,
+// unadmitted absent, Exhausted.
+TEST(T1Operations, InfiniteOffer) {
+  auto p = make(par612(), {0}, {1}, t1(4));
+  const auto r = p->replace(INF, 12);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_FALSE(r.call_undelivered.has_value());
+  EXPECT_FALSE(r.requested.has_value());
+  EXPECT_FALSE(r.unadmitted.has_value());
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// EMPTY (node 0 has no edge), N = 2: replace(5, 5) Lossy is NO_ROUTE with the empty
+// program (sources (0,), destinations (2,), no tunnel), the plan (count 2, design 5, no head, no
+// hold), the 5 lost outside every row; replace(0, 5), evaluate(0, 5) and forward(0) are Complete.
+TEST(T1Operations, EmptyRoster) {
+  const auto g = ordered(3, {{1, 2, 5, 1}});
+  auto p = make(g, {0}, {2}, t1(2, LOSSY));
+  const auto r = p->replace(5, 5);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  ASSERT_TRUE(r.program);
+  EXPECT_EQ(vec(r.program->sources()), v({0}));
+  EXPECT_EQ(vec(r.program->destinations()), v({2}));
+  EXPECT_TRUE(r.program->tunnels().empty());
+  EXPECT_TRUE(r.plan == (TunnelPlan {2, 5, {}, 0}));
+  EXPECT_EQ(r.call_source_drops, 5);
+  EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 0, 0, 0, 0, 0}}));
+  EXPECT_TRUE(p->records().empty());
+  for (const auto& z : {p->replace(0, 5), p->evaluate(0, 5), p->forward(0)}) {
+    EXPECT_EQ(z.termination, Termination::Complete);
+    EXPECT_TRUE(z.program && z.program->tunnels().empty());
+    EXPECT_TRUE(z.plan.has_value());
+  }
+  EXPECT_TRUE(p->records().empty());
+}
+
+// DIAM5, N = 2: replace(8, 8) (one tunnel up), replace(10, 10) (both up: routes,
+// weights 1, 0 to 1, 1, and reservations all change), forward(10) (none). The first program of
+// the diamond with design 14 (all down) changes routes and reservations (requests 7, 7) but no weight.
+TEST(T1Operations, Flags) {
+  auto p = make(diam5(), {0}, {3}, t1(2));
+  const auto first = p->replace(8, 8);
+  EXPECT_TRUE(first.routes_changed && first.weights_changed && first.reservations_changed);
+  const auto second = p->replace(10, 10);
+  EXPECT_TRUE(second.routes_changed && second.weights_changed && second.reservations_changed);
+  const auto f = p->forward(10);
+  EXPECT_FALSE(f.routes_changed || f.weights_changed || f.reservations_changed);
+  auto down = make(diam5(), {0}, {3}, t1(2, LOSSY));
+  const auto d = down->replace(5, 14);
+  EXPECT_TRUE(d.routes_changed);
+  EXPECT_FALSE(d.weights_changed);
+  EXPECT_TRUE(d.reservations_changed);
+  // Only the requests change (D = 15: requests 8 and 7, still all down): reservations alone.
+  const auto d2 = down->replace(5, 15);
+  EXPECT_FALSE(d2.routes_changed || d2.weights_changed);
+  EXPECT_TRUE(d2.reservations_changed);
+  // A controller's tunnels hold nothing: a change in their number is a route change, never a
+  // reservation change (a tunnel absent from one program counts as (0, 0) there).
+  auto gl = make(diam5(), {0}, {3}, global_config());
+  const auto many = gl->replace(INF);
+  ASSERT_GT(many.program->tunnels().size(), 1u);
+  EXPECT_FALSE(many.reservations_changed);
+  const auto one = gl->replace(1);
+  ASSERT_EQ(one.program->tunnels().size(), 1u);
+  EXPECT_TRUE(one.routes_changed);
+  EXPECT_FALSE(one.reservations_changed);
+  const auto again = gl->replace(INF);
+  EXPECT_TRUE(again.routes_changed);
+  EXPECT_FALSE(again.reservations_changed);
+  // Equal requests, changed holds: two links of 4, N = 2, D = 8 (requests 4, 4). Another owner's
+  // hold of 1 on e0 leaves tunnel 0 on e1 and tunnel 1 down (reserved 4, 0); once it leaves, the
+  // same design brings both up (reserved 4, 4): the reservations changed though no request did.
+  const auto two = ordered(2, {{0, 1, 4, 1}, {0, 1, 4, 1}});
+  auto ledger = std::make_shared<FlowLedger>(two);
+  auto other = make(two, {0}, {1}, t1(1), nullptr, ledger);
+  (void)other->replace(1, 1);
+  auto mine = make(two, {0}, {1}, t1(2), nullptr, ledger);
+  const auto held = mine->replace(8, 8);
+  EXPECT_EQ(statuses(*held.program), (std::vector<TunnelStatus> {UP, NB}));
+  other->remove();
+  const auto freed = mine->replace(8, 8);
+  EXPECT_EQ(statuses(*freed.program), (std::vector<TunnelStatus> {UP, UP}));
+  EXPECT_EQ(requests(*held.program), requests(*freed.program));
+  EXPECT_TRUE(freed.reservations_changed);
+}
+
+// The comparison behind the flags: a tunnel absent from one program counts as (0, 0) there,
+// so programs of zero requests and holds with different tunnel counts (or none) are no reservation
+// change, and a program that holds something against none is one. No T1 call changes its tunnel
+// count, so only this direct check reaches the absent-tunnel branches.
+TEST(T1Operations, AbsentTunnelsCountAsZero) {
+  auto two = make(one10(), {0}, {1}, t1(2));
+  const auto zero2 = two->replace(0, 0).program;  // two tunnels, requests 0
+  auto one = make(one10(), {0}, {1}, t1(1));
+  const auto zero1 = one->replace(0, 0).program;  // one tunnel, request 0
+  const auto held1 = one->replace(0, 6).program;  // one tunnel holding 6
+  ASSERT_EQ(zero2->tunnels().size(), 2U);
+  ASSERT_EQ(held1->tunnels()[0].reserved_bandwidth, 6);
+  EXPECT_FALSE(detail::compare_programs(zero2.get(), zero1.get()).reservations);  // absent after
+  EXPECT_FALSE(detail::compare_programs(zero1.get(), zero2.get()).reservations);  // absent before
+  EXPECT_FALSE(detail::compare_programs(zero2.get(), nullptr).reservations);
+  EXPECT_FALSE(detail::compare_programs(nullptr, zero2.get()).reservations);
+  EXPECT_TRUE(detail::compare_programs(held1.get(), nullptr).reservations);
+  EXPECT_TRUE(detail::compare_programs(nullptr, held1.get()).reservations);
+  EXPECT_TRUE(detail::compare_programs(held1.get(), zero2.get()).reservations);
+}
+
+// T1 has no incremental place (also 0, and before an offer outside the domain), and forward needs
+// an installed program.
+TEST(T1Operations, NoIncrementsAndForwardNeedsAProgram) {
+  auto p = make(one10(), {0}, {1}, t1(1));
+  for (const Amount x : {Amount {5}, Amount {0}, Amount {-1}, kDomainLimit}) {
+    EXPECT_EQ(error_of([&] { (void)p->place(x); }), "DistributedTE does not support incremental placement") << x;
+  }
+  EXPECT_EQ(error_of([&] { (void)p->forward(5); }), "forward requires an installed program");
+  (void)p->replace(1, 1);
+  p->remove();
+  EXPECT_EQ(error_of([&] { (void)p->forward(5); }), "forward requires an installed program");
+}
+
+// The call's checks in their order (the offer, LOSSY's finite offer, then the
+// design: the model, its domain, finiteness) and the terminations.
+TEST(T1Operations, DesignValidationAndTerminations) {
+  const auto g = one10();
+  for (const auto& c : {shortest_paths_config(), global_config(),
+                        FlowPolicyConfig {.routing = pinned_paths(*g, {0}, {1}, {{0, {0}, 1}})}}) {
+    auto p = make(g, {0}, {1}, c);
+    const std::string model = detail::model_name(c.routing);
+    EXPECT_EQ(error_of([&] { (void)p->replace(5, 5); }), model + " does not accept design_demand");
+    EXPECT_EQ(error_of([&] { (void)p->evaluate(5, 5); }), model + " does not accept design_demand");
+    EXPECT_EQ(error_of([&] { (void)p->replace(5, std::optional<Amount> {}); }), model + " does not accept design_demand");
+  }
+  auto ll = make(g, {0}, {1}, t1(1));
+  const std::string domain = "design_demand must be an integer in [0, 2^62) or permitted +inf";
+  EXPECT_EQ(error_of([&] { (void)ll->replace(5, -1); }), domain);
+  EXPECT_EQ(error_of([&] { (void)ll->replace(5, kL62); }), domain);
+  EXPECT_EQ(error_of([&] { (void)ll->replace(-1, -1); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(error_of([&] { (void)ll->replace(5, std::optional<Amount> {}); }), "DistributedTE requires a finite design demand");
+  EXPECT_EQ(error_of([&] { (void)ll->replace(INF); }), "DistributedTE requires a finite design demand");
+  EXPECT_EQ(error_of([&] { (void)ll->evaluate(INF); }), "DistributedTE requires a finite design demand");
+  auto ly = make(g, {0}, {1}, t1(1, LOSSY));
+  EXPECT_EQ(error_of([&] { (void)ly->replace(INF, 5); }), "LOSSY forwarding requires a finite offer");
+  EXPECT_TRUE(ll.ledger->records().empty() && ly.ledger->records().empty());
+  // Terminations: zero offer, Lossy finite, Lossless full and partial, unlimited.
+  EXPECT_EQ(ll->replace(0, 5).termination, Termination::Complete);
+  EXPECT_EQ(ll->replace(10, 10).termination, Termination::Complete);
+  EXPECT_EQ(ll->replace(11, 10).termination, Termination::Exhausted);
+  EXPECT_EQ(ll->replace(INF, 10).termination, Termination::Exhausted);
+  EXPECT_EQ(ly->replace(11, 10).termination, Termination::Complete);
+  // A zero-weight route, the case rule (3) keeps: one supplied path of weight 0, both admissions.
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    auto z = make(g, {0}, {1}, FlowPolicyConfig {.routing = pinned_paths(*g, {0}, {1}, {{0, {0}, 0}}), .admission = a});
+    const auto r = z->replace(4);
+    EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+    if (a == LOSSY) EXPECT_EQ(r.call_source_drops, 4);
+  }
+}
+
+// No certificate for T1 (total_cost, min_cut, marginal_cost_curve absent), and a plan only for
+// the tunnel models (T1 here, T2 in centralized_te_tunnels_tests.cpp; absent for the other models, Pinned
+// over a T1 program too).
+TEST(T1Operations, NoCertificatesAndPlanOnlyForT1) {
+  const auto g = twoh(2, 10);
+  auto p = make(g, {0, 1}, {2}, t1(2));
+  const auto r = p->replace(INF, 12, OutputOptions {.min_cut = true});
+  EXPECT_FALSE(r.total_cost.has_value() || r.min_cut.has_value() || r.marginal_cost_curve.has_value());
+  ASSERT_TRUE(r.plan.has_value());
+  auto pin = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {r.program, nullptr}});
+  EXPECT_FALSE(pin->replace(12).plan.has_value());
+  for (const auto& c : {shortest_paths_config(), global_config()}) {
+    auto q = make(g, {0, 1}, {2}, c);
+    EXPECT_FALSE(q->place(5).plan.has_value());
+    EXPECT_FALSE(q->replace(5).plan.has_value());
+  }
+}
+
+// ---------------------------------------------------------------- the two projections
+
+// The two projections of one link: ONE10, N = 1, Lossless replace(4, 6): carried 4, held 6 (carried [4],
+// residual [6], reserved [6], unreserved [4]); then replace(2, 6): call_delivered 2, delivery_delta -2. A
+// ShortestPaths policy on the same ledger then places 6 (the residual): holds are never added to
+// carried load.
+TEST(LedgerProjections, ELedger) {
+  const auto g = one10();
+  auto ledger = std::make_shared<FlowLedger>(g);
+  auto p = make(g, {0}, {1}, t1(1), nullptr, ledger);
+  (void)p->replace(4, 6);
+  EXPECT_EQ(ledger->carried(), (Amounts {4}));
+  EXPECT_EQ(ledger->residual(), (Amounts {6}));
+  EXPECT_EQ(ledger->reserved(), (Amounts {6}));
+  EXPECT_EQ(ledger->unreserved(), (Amounts {4}));
+  auto c = make(g, {0}, {1}, shortest_paths_config(), nullptr, ledger);
+  EXPECT_EQ(c->place(10).call_delivered, 6);
+  c->remove();
+  const auto r = p->replace(2, 6);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(r.delivery_delta, -2);
+  expect_balanced(*ledger, "the two projections of one link");
+}
+
+// The reservation baseline is the setup's U: unreserved [3] puts
+// a request of 4 down while the residual stays 10; its texts are the residual baseline's with the
+// name unreserved, checked after the residual's.
+TEST(LedgerProjections, Baselines) {
+  const auto g = one10();
+  auto ledger = std::make_shared<FlowLedger>(g, g->edge_capacity_units(), Amounts {3});
+  auto p = make(g, {0}, {1}, t1(1), nullptr, ledger);
+  EXPECT_EQ(statuses(*p->replace(4, 4).program), (std::vector<TunnelStatus> {NB}));
+  EXPECT_EQ(ledger->residual(), (Amounts {10}));
+  EXPECT_EQ(ledger->unreserved(), (Amounts {3}));
+  EXPECT_EQ(error_of([&] { FlowLedger x(g, g->edge_capacity_units(), Amounts {3, 1}); }),
+            "reservation_baseline has length 2, expected 1 (one entry per edge)");
+  EXPECT_EQ(error_of([&] { FlowLedger x(g, g->edge_capacity_units(), Amounts {11}); }),
+            "reservation_baseline[0] = 11 is outside [0, edge_capacity_units[0] = 10]");
+  EXPECT_EQ(error_of([&] { FlowLedger x(g, Amounts {11}, Amounts {11}); }),
+            "service_baseline[0] = 11 is outside [0, edge_capacity_units[0] = 10]");
+  // The two-edge cases of the unreserved texts.
+  const auto two = ordered(2, {{0, 1, 10, 1}, {0, 1, 10, 1}});
+  EXPECT_EQ(error_of([&] { FlowLedger x(two, two->edge_capacity_units(), Amounts {1, 2, 3}); }),
+            "reservation_baseline has length 3, expected 2 (one entry per edge)");
+  EXPECT_EQ(error_of([&] { FlowLedger x(two, two->edge_capacity_units(), Amounts {5, 11}); }),
+            "reservation_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]");
+  EXPECT_EQ(error_of([&] { FlowLedger x(two, two->edge_capacity_units(), Amounts {10, 0}); }), "");
+}
+
+// remove() releases both projections and clears the program.
+TEST(LedgerProjections, RemoveReleasesBoth) {
+  auto p = make(one10(), {0}, {1}, t1(1));
+  (void)p->replace(4, 6);
+  p->remove();
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {0}));
+  EXPECT_EQ(p.ledger->carried(), (Amounts {0}));
+  EXPECT_EQ(p->program(), nullptr);
+  EXPECT_TRUE(p->records().empty());
+  p->remove();  // a repeated remove does nothing
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {0}));
+}
+
+// A policy destroyed without remove() leaves its holds as orphans (records readable)
+// until reset(); reset(residual, unreserved) sets both baselines; a copy of an unbound ledger keeps
+// the holds and records under a new uid; a bound ledger cannot be copied or reset.
+TEST(LedgerProjections, OrphansResetAndCopy) {
+  const auto g = one10();
+  auto ledger = std::make_shared<FlowLedger>(g);
+  {
+    auto p = std::make_unique<FlowPolicy>(*ledger, v({0}), v({1}), t1(1));
+    (void)p->replace(4, 6);
+    EXPECT_EQ(error_of([&] { FlowLedger copy(*ledger); }), "FlowLedger: a ledger with bound policies cannot be copied");
+    EXPECT_EQ(error_of([&] { ledger->reset(); }), "FlowLedger.reset is rejected while a policy is bound (1 bound)");
+  }
+  EXPECT_EQ(ledger->reserved(), (Amounts {6}));
+  ASSERT_EQ(ledger->records().size(), 1U);
+  EXPECT_EQ(ledger->records().front().edge_reservations, (Pairs {{0, 6}}));
+  const FlowLedger copy(*ledger);
+  EXPECT_NE(copy.uid(), ledger->uid());
+  EXPECT_EQ(copy.reserved(), (Amounts {6}));
+  EXPECT_EQ(copy.unreserved(), (Amounts {4}));
+  ASSERT_EQ(copy.records().size(), 1U);
+  EXPECT_EQ(copy.records().front().edge_reservations, (Pairs {{0, 6}}));
+  EXPECT_EQ(copy.records().front().flow_id.first, copy.uid());
+  expect_balanced(copy, "the copy");
+  ledger->reset();
+  EXPECT_EQ(ledger->reserved(), (Amounts {0}));
+  EXPECT_TRUE(ledger->records().empty());
+  EXPECT_EQ(copy.reserved(), (Amounts {6}));  // the copy owns its holds
+  ledger->reset(g->edge_capacity_units(), Amounts {3});
+  EXPECT_EQ(ledger->unreserved(), (Amounts {3}));
+  EXPECT_EQ(ledger->residual(), (Amounts {10}));
+  ledger->reset(Amounts {7});
+  EXPECT_EQ(ledger->unreserved(), (Amounts {10}));  // an absent reservation baseline: the capacities
+  EXPECT_EQ(ledger->residual(), (Amounts {7}));
+}
+
+// A ledger stores no holds until something holds (a policy without holds pays nothing for the
+// reservation projection): it reads holds 0 and the capacities, or the given reservation
+// baseline, as unreserved; the first hold stores them; a reset empties them again. A copy of an
+// unheld ledger owns its own storage once either side holds.
+TEST(LedgerProjections, HoldsAreStoredFromTheFirstHold) {
+  const auto g = twoh(2, 10);
+  FlowLedger fg(g);
+  EXPECT_TRUE(detail::LedgerAccess::reserved(fg).empty());
+  EXPECT_EQ(fg.reserved(), (Amounts {0, 0}));
+  EXPECT_EQ(fg.unreserved(), (Amounts {2, 10}));
+  EXPECT_EQ(vec(detail::LedgerAccess::reservation_baseline(fg)), (Amounts {2, 10}));
+  {
+    FlowPolicy cost(fg, v({0, 1}), v({2}), shortest_paths_config());
+    (void)cost.place(3);
+    EXPECT_TRUE(detail::LedgerAccess::reserved(fg).empty());  // carried traffic holds nothing
+    cost.remove();
+  }
+  const FlowLedger unheld(fg);
+  {
+    FlowPolicy p(fg, v({0, 1}), v({2}), t1(2, LOSSY));
+    (void)p.replace(12, 12);
+    EXPECT_EQ(fg.reserved(), (Amounts {0, 6}));
+    EXPECT_EQ(fg.unreserved(), (Amounts {2, 4}));
+    EXPECT_EQ(unheld.reserved(), (Amounts {0, 0}));  // the copy made before the hold has none
+    EXPECT_TRUE(detail::LedgerAccess::reserved(unheld).empty());
+    p.remove();
+    EXPECT_EQ(fg.reserved(), (Amounts {0, 0}));
+  }
+  fg.reset();
+  EXPECT_TRUE(detail::LedgerAccess::reserved(fg).empty());
+  EXPECT_EQ(fg.unreserved(), (Amounts {2, 10}));
+  FlowLedger given(g, g->edge_capacity_units(), Amounts {1, 7});
+  EXPECT_TRUE(detail::LedgerAccess::reserved(given).empty());
+  EXPECT_EQ(given.reserved(), (Amounts {0, 0}));
+  EXPECT_EQ(given.unreserved(), (Amounts {1, 7}));
+  FlowPolicy q(given, v({1}), v({2}), t1(1));
+  (void)q.replace(0, 5);
+  EXPECT_EQ(given.reserved(), (Amounts {0, 5}));
+  EXPECT_EQ(given.unreserved(), (Amounts {1, 2}));
+  expect_balanced(given, "the given baseline");
+}
+
+// T1's setup reads an absent reservation baseline as the capacities, also when the service
+// baseline is smaller: TWOH(2, 10) with residual (1, 4), head 1, N = 1, Lossy replace(6, 6) holds 6
+// (U = 10 - 0), and the same after reset(residual) of a ledger that had a given baseline.
+TEST(LedgerProjections, AbsentReservationBaselineIsTheCapacities) {
+  const auto g = twoh(2, 10);
+  for (const bool after_reset : {false, true}) {
+    FlowLedger fg = after_reset ? FlowLedger(g, Amounts {1, 4}, Amounts {1, 3}) : FlowLedger(g, Amounts {1, 4});
+    if (after_reset) fg.reset(Amounts {1, 4});
+    FlowPolicy p(fg, v({1}), v({2}), t1(1, LOSSY));
+    const auto r = p.replace(6, 6);
+    ASSERT_EQ(r.program->tunnels().size(), 1U);
+    EXPECT_EQ(r.program->tunnels()[0].status, UP) << after_reset;
+    EXPECT_EQ(fg.reserved(), (Amounts {0, 6})) << after_reset;
+    EXPECT_EQ(fg.unreserved(), (Amounts {2, 4})) << after_reset;
+    expect_balanced(fg, after_reset ? "after reset" : "two-argument ledger");
+    p.remove();
+  }
+}
+
+// edge_reservations is zeros for a model without holds; an imported T1
+// program books no hold; the bottleneck report reads the service view only.
+TEST(LedgerProjections, OutputsImportsAndBottleneck) {
+  const auto g = twoh(2, 10);
+  auto c = make(g, {0, 1}, {2}, shortest_paths_config());
+  EXPECT_EQ(*c->place(4, kHolds).edge_reservations, (Amounts {0, 0}));
+  auto p = make(g, {0, 1}, {2}, t1(2, LOSSY));
+  const auto r = p->replace(12, 12);
+  auto pin = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {r.program, nullptr}, .admission = LOSSY});
+  const auto q = pin->replace(12, std::nullopt, kHolds);
+  EXPECT_EQ(*q.edge_reservations, (Amounts {0, 0}));
+  EXPECT_EQ(pin.ledger->reserved(), (Amounts {0, 0}));
+  for (const auto& rec : pin->records()) EXPECT_TRUE(rec.edge_reservations.empty());
+  // ONE10 held whole (replace(0, 10): unreserved 0) is not a bottleneck: the residual is 10.
+  auto h = make(one10(), {0}, {1}, t1(1));
+  (void)h->replace(0, 10);
+  EXPECT_EQ(h.ledger->unreserved(), (Amounts {0}));
+  EXPECT_TRUE(h.ledger->saturated_boundary_edges(v({0})).empty());
+  EXPECT_EQ(*h->replace(0, 10, OutputOptions {.saturated_boundary_edges = true}).saturated_boundary_edges, Edges {});
+}
+
+// ---------------------------------------------------------------- programs
+
+// T1's tunnels (the TWOH call): a down tunnel has no destination, path or cost, weight 0
+// and no hold; an up one holds its request; requested 3 each. The program's roster is the
+// policy's (every head), its sources and destinations the policy's, equal sources.
+TEST(TunnelPrograms, T1Fields) {
+  auto p = make(twoh(2, 10), {0, 1}, {2}, t1(2, LOSSY));
+  const auto prog = p->replace(12, 12).program;
+  ASSERT_EQ(prog->tunnels().size(), 4U);
+  for (std::size_t i = 0; i < 4; ++i) {
+    const auto& t = prog->tunnels()[i];
+    const bool up = i % 2 == 1;
+    EXPECT_EQ(t.entry_id, static_cast<std::int32_t>(i));
+    EXPECT_EQ(t.head, static_cast<NodeId>(i % 2));
+    EXPECT_EQ(t.local_index, static_cast<std::int32_t>(i / 2));
+    EXPECT_EQ(t.status, up ? UP : NB);
+    EXPECT_EQ(t.requested_bandwidth, 3);
+    EXPECT_EQ(t.reserved_bandwidth, up ? 3 : 0);
+    EXPECT_EQ(t.weight, up ? 1 : 0);
+    EXPECT_EQ(t.destination, up ? std::optional<NodeId> {2} : std::nullopt);
+    EXPECT_EQ(t.edges, up ? std::optional<Edges> {{1}} : std::nullopt);
+    EXPECT_EQ(t.path_cost, up ? std::optional<Cost> {1} : std::nullopt);
+  }
+  EXPECT_EQ(vec(prog->sources()), v({0, 1}));
+  EXPECT_EQ(vec(prog->destinations()), v({2}));
+  EXPECT_FALSE(prog->source_weights().has_value());
+  EXPECT_EQ(vec(detail::ProgramAccess::data(*prog).reachable_sources), v({0, 1}));
+  // Two-hop tunnels end at the destination, not at the first link's end: DIAM5, N = 2, D = 10
+  // (requests 5, 5; e2 of 4 is filtered out): tunnel 0 takes e0 e3, tunnel 1 e1 e4, both cost 4.
+  auto d = make(diam5(), {0}, {3}, t1(2));
+  const auto two = d->replace(10, 10).program;
+  EXPECT_EQ(routes(*two), (std::vector<Edges> {{0, 3}, {1, 4}}));
+  for (const auto& t : two->tunnels()) {
+    EXPECT_EQ(t.destination, std::optional<NodeId> {3});
+    EXPECT_EQ(t.path_cost, std::optional<Cost> {4});
+  }
+}
+
+// Pinned over an imported T1 program books no holds, so it never reports a reservation change:
+// the first evaluate, replace and place over an up program (requested and reserved 6) and over an
+// all-down one with a positive request (20 on one link of 10) leave the ledger's and the records'
+// holds empty, and the installed program keeps the imported amounts as data.
+TEST(TunnelPrograms, PinnedOverT1ReservesNothing) {
+  const auto g = one10();
+  auto u = make(g, {0}, {1}, t1(1));
+  const auto up = u->replace(0, 6).program;
+  auto d = make(g, {0}, {1}, t1(1));
+  const auto down = d->replace(0, 20).program;
+  ASSERT_EQ(statuses(*up), (std::vector<TunnelStatus> {UP}));
+  ASSERT_EQ(statuses(*down), (std::vector<TunnelStatus> {NB}));
+  EXPECT_EQ(up->tunnels()[0].reserved_bandwidth, 6);
+  EXPECT_EQ(down->tunnels()[0].requested_bandwidth, 20);
+  for (const auto& prog : {up, down}) {
+    for (int op = 0; op < 3; ++op) {
+      auto p = make(g, {0}, {1}, FlowPolicyConfig {.routing = Pinned {prog, nullptr}});
+      const auto r = op == 0 ? p->evaluate(1) : op == 1 ? p->replace(1) : p->place(1);
+      EXPECT_FALSE(r.reservations_changed) << op;
+      EXPECT_FALSE(r.plan.has_value()) << op;
+      EXPECT_EQ(r.program->tunnels()[0].requested_bandwidth, prog->tunnels()[0].requested_bandwidth) << op;
+      EXPECT_EQ(r.program->tunnels()[0].reserved_bandwidth, prog->tunnels()[0].reserved_bandwidth) << op;
+      EXPECT_EQ(p.ledger->reserved(), (Amounts {0})) << op;
+      for (const auto& rec : p->records()) EXPECT_TRUE(rec.edge_reservations.empty()) << op;
+    }
+  }
+}
+
+// The builder alone (no forwarding runs): an up tunnel has weight 1, a down one weight 0 and no
+// path, so a call never forwards a share onto a tunnel without a path.
+TEST(TunnelPrograms, BuilderWeighsOnlyUpTunnels) {
+  const auto g = twoh(2, 10);
+  const std::vector<NodeId> heads {0, 1}, dests {2};
+  std::vector<detail::TunnelSetupResult> setup(2);
+  setup[0] = {.roster_index = 0, .local_index = 0, .requested_bandwidth = 3, .status = NB};
+  setup[1] = {.roster_index = 1, .local_index = 0, .requested_bandwidth = 3, .status = UP, .edges = {1}, .path_cost = 1};
+  const auto prog = detail::distributed_te_program(*g, heads, dests, heads, std::move(setup), {}, {});
+  ASSERT_EQ(prog->tunnels().size(), 2U);
+  EXPECT_EQ(prog->tunnels()[0].weight, 0);
+  EXPECT_EQ(prog->tunnels()[0].edges, std::nullopt);
+  EXPECT_EQ(prog->tunnels()[1].weight, 1);
+  EXPECT_EQ(prog->tunnels()[1].edges, std::optional<Edges> {{1}});
+}
+
+// Pinned over T1's program on PAR612 (N = 4, replace(13, 12)) with e0 masked: tunnels 0 and 1
+// FAILED; the head splits RR(13, 2) = (7, 6) over tunnels 2 and 3 on e1 (capacity 6): H(6, [7, 6])
+// = (3, 3) carried, 6 delivered, 7 dropped; Lossless admits 6.
+TEST(TunnelPrograms, T1Replay) {
+  const auto g = par612();
+  auto p = make(g, {0}, {1}, t1(4, LOSSY));
+  const auto prog = p->replace(13, 12).program;
+  const auto mask = g->eligibility({}, std::vector<EdgeId> {0});
+  auto ly = make(g, {0}, {1}, FlowPolicyConfig {.routing = Pinned {prog, nullptr}, .admission = LOSSY}, &mask);
+  const auto r = ly->replace(13);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, FAILED, 0, 0, 0}, {1, 0, FAILED, 0, 0, 0}, {2, 0, UP, 7, 3, 4}, {3, 0, UP, 6, 3, 3}}));
+  EXPECT_EQ(r.call_delivered, 6);
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{1, 7}}));
+  auto ll = make(g, {0}, {1}, FlowPolicyConfig {.routing = Pinned {prog, nullptr}}, &mask);
+  EXPECT_EQ(ll->replace(13).call_delivered, 6);
+  // The replay roster comes from the topology basis, not from the surviving tunnels: REPLAY, N = 1,
+  // D = 10: head 0's tunnel e0 fails, but head 0
+  // still reaches node 2 over the topology (e1, e3): it keeps its share 5 and loses it; head 1
+  // delivers its 5.
+  const auto rg = ordered(4, {{0, 2, 10, 1}, {0, 3, 10, 5}, {1, 2, 10, 1}, {3, 2, 10, 5}});
+  auto t = make(rg, {0, 1}, {2}, t1(1, LOSSY));
+  const auto rp = t->replace(10, 10).program;
+  EXPECT_EQ(routes(*rp), (std::vector<Edges> {{0}, {2}}));
+  const auto m0 = rg->eligibility({}, std::vector<EdgeId> {0});
+  auto replay = make(rg, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {rp, nullptr}, .admission = LOSSY}, &m0);
+  const auto x = replay->replace(10);
+  EXPECT_EQ(x.call_delivered, 5);
+  EXPECT_EQ(x.call_source_drops, 5);
+  EXPECT_EQ(source_rows(x), (std::vector<SourceRow> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 5, 0, 0}}));
+  EXPECT_EQ(x.termination, Termination::Complete);
+}
+
+// DIAM5's design-10 program (tunnels 0 -> 1 -> 3 and 0 -> 2 -> 3) with node 2 as a black
+// hole: Lossy replace(10): 5 and 5 assigned, the second tunnel BLACKHOLED with its 5 dropped on e1
+// (the link entering node 2), 5 delivered; Lossless admits 1. The live T1's forward(10,
+// black_holes) gives the same and keeps its holds and its program's statuses.
+TEST(TunnelPrograms, T1Stale) {
+  const auto g = diam5();
+  auto p = make(g, {0}, {3}, t1(2, LOSSY));
+  const auto prog = p->replace(10, 10).program;
+  const auto dark = std::make_shared<const Eligibility>(g->eligibility(std::vector<NodeId> {2}, {}));
+  auto ly = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {prog, dark}, .admission = LOSSY});
+  const auto r = ly->replace(10);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 5, 5, 0}, {1, 0, BLACKHOLED, 5, 0, 5}}));
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{1, 5}}));
+  EXPECT_EQ(r.call_delivered, 5);
+  auto ll = make(g, {0}, {3}, FlowPolicyConfig {.routing = Pinned {prog, dark}});
+  EXPECT_EQ(ll->replace(10).call_delivered, 1);
+  const auto holds_before = p.ledger->reserved();
+  const auto f = p->forward(10, dark.get());
+  EXPECT_EQ(rows(f), rows(r));
+  EXPECT_EQ(f.call_delivered, 5);
+  EXPECT_EQ(p.ledger->reserved(), holds_before);
+  EXPECT_EQ(statuses(*p->program()), (std::vector<TunnelStatus> {UP, UP}));
+}
+
+// Pinned over the TWOH call's program forwards like the live T1: 6
+// delivered, head 0's 6 lost at the head; the setup-down tunnels keep their status in by_tunnel;
+// no plan, no hold.
+TEST(TunnelPrograms, T1DownTunnels) {
+  const auto g = twoh(2, 10);
+  auto p = make(g, {0, 1}, {2}, t1(2, LOSSY));
+  const auto live = p->replace(12, 12);
+  auto pin = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {live.program, nullptr}, .admission = LOSSY});
+  const auto r = pin->replace(12);
+  EXPECT_EQ(r.call_delivered, 6);
+  EXPECT_EQ(r.call_source_drops, 6);
+  EXPECT_EQ(rows(r), rows(live));
+  EXPECT_FALSE(r.plan.has_value());
+  EXPECT_EQ(pin.ledger->reserved(), (Amounts {0, 0}));
+  EXPECT_EQ(r.termination, Termination::Complete);
+  // A replay never brings a down tunnel up: Pinned over the diamond's all-down program (design 14) with a mask
+  // that leaves every path: still NB, NB; Lossy loses the offer at the head (not rule (3)).
+  const auto dg = diam5();
+  auto d = make(dg, {0}, {3}, t1(2, LOSSY));
+  const auto down = d->replace(5, 14).program;
+  const auto mask = dg->eligibility({}, std::vector<EdgeId> {2});
+  auto replay = make(dg, {0}, {3}, FlowPolicyConfig {.routing = Pinned {down, nullptr}, .admission = LOSSY}, &mask);
+  const auto x = replay->replace(5);
+  EXPECT_EQ(rows(x), (Rows {{0, 0, NB, 0, 0, 0}, {1, 0, NB, 0, 0, 0}}));
+  EXPECT_EQ(x.termination, Termination::Complete);
+  EXPECT_EQ(x.call_source_drops, 5);
+}
+
+// The other producers' tunnels carry the new fields' plain values: status UP, requested
+// and reserved 0, a destination, a path and a cost.
+TEST(TunnelPrograms, OtherProducersFields) {
+  const auto g = ordered(3, {{0, 2, 2, 1}, {1, 2, 10, 1}});
+  auto gl = make(g, {0, 1}, {2}, global_config());
+  for (const auto& t : gl->place(12).program->tunnels()) {
+    EXPECT_EQ(t.status, UP);
+    EXPECT_EQ(t.requested_bandwidth, 0);
+    EXPECT_EQ(t.reserved_bandwidth, 0);
+    EXPECT_TRUE(t.destination.has_value() && t.edges.has_value() && t.path_cost.has_value());
+  }
+  const auto supplied = pinned_paths(*g, {0, 1}, {2}, {{0, {0}, 1}, {1, {1}, 0}});
+  for (const auto& t : supplied.program->tunnels()) {
+    EXPECT_EQ(t.status, UP);
+    EXPECT_EQ(t.requested_bandwidth, 0);
+    EXPECT_EQ(t.reserved_bandwidth, 0);
+    EXPECT_EQ(t.destination, std::optional<NodeId> {2});
+  }
+}
+
+// ---------------------------------------------------------------- zero offers and everything masked (E)
+
+// The TWOH call's policy with zero offers: replace(0, 12) programs the tunnels and books the
+// holds, four zero records; evaluate(0, 12) the same without publishing; forward(0) keeps program
+// and holds, recreates the records (new ids), sets no flag. Both admissions; every call Complete.
+TEST(TunnelZero, T1) {
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    auto p = make(twoh(2, 10), {0, 1}, {2}, t1(2, a));
+    const auto r = p->replace(0, 12);
+    EXPECT_EQ(r.termination, Termination::Complete);
+    EXPECT_EQ(r.call_delivered, 0);
+    EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {NB, UP, NB, UP}));
+    EXPECT_EQ(p.ledger->reserved(), (Amounts {0, 6}));
+    EXPECT_EQ(entries(p->records()), (std::vector<std::optional<std::int32_t>> {0, 1, 2, 3}));
+    for (const auto& rec : p->records()) EXPECT_EQ(rec.delivered, 0);
+    const auto state = ledger_state(*p.ledger);
+    const auto e = p->evaluate(0, 12);
+    EXPECT_EQ(e.termination, Termination::Complete);
+    EXPECT_EQ(statuses(*e.program), (std::vector<TunnelStatus> {NB, UP, NB, UP}));
+    expect_same(ledger_state(*p.ledger), state, "evaluate(0, 12)");
+    const auto before = p->records();
+    const auto f = p->forward(0);
+    EXPECT_EQ(f.termination, Termination::Complete);
+    EXPECT_FALSE(f.routes_changed || f.weights_changed || f.reservations_changed);
+    EXPECT_EQ(f.program, r.program);
+    EXPECT_EQ(p.ledger->reserved(), (Amounts {0, 6}));
+    // The records are retired and recreated: the same entries and holds under new ids.
+    const auto after = p->records();
+    EXPECT_EQ(entries(after), entries(before));
+    EXPECT_EQ(holds(after), holds(before));
+    for (const auto& rec : after) {
+      EXPECT_TRUE(std::none_of(before.begin(), before.end(), [&](const FlowRecord& b) { return b.flow_id == rec.flow_id; }));
+    }
+  }
+}
+
+// DIAM5 all down at D = 14: replace(0, 14) Complete; replace(5, 14) Lossy Complete, Lossless
+// Exhausted; two zero records (entries 0 and 1) every time; forward(0) Complete.
+TEST(TunnelZero, T1AllDown) {
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    auto p = make(diam5(), {0}, {3}, t1(2, a));
+    EXPECT_EQ(p->replace(0, 14).termination, Termination::Complete);
+    EXPECT_EQ(entries(p->records()), (std::vector<std::optional<std::int32_t>> {0, 1}));
+    const auto r = p->replace(5, 14);
+    EXPECT_EQ(r.termination, a == LOSSY ? Termination::Complete : Termination::Exhausted);
+    EXPECT_EQ(entries(p->records()), (std::vector<std::optional<std::int32_t>> {0, 1}));
+    EXPECT_EQ(p->forward(0).termination, Termination::Complete);
+    EXPECT_EQ(p->records().size(), 2U);
+  }
+}
+
+// TWOH(10, 10) with every edge masked: an empty roster: replace(5, 5) NO_ROUTE, then
+// replace(0, 5) Complete; the empty program; no record.
+TEST(TunnelZero, T1AllMasked) {
+  const auto g = twoh(10, 10);
+  const auto mask = g->eligibility({}, std::vector<EdgeId> {0, 1});
+  auto p = make(g, {0, 1}, {2}, t1(2), &mask);
+  const auto r = p->replace(5, 5);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  EXPECT_TRUE(r.program->tunnels().empty());
+  EXPECT_EQ(p->replace(0, 5).termination, Termination::Complete);
+  EXPECT_TRUE(p->records().empty());
+}
+
+// Pinned over the TWOH call's program. With e1 masked, tunnels 1 and 3 fail and head
+// 1 cannot reach node 2 (it leaves the replay roster); head 0 still can, over e0, but has no up
+// tunnel: it keeps the whole 12 and loses it. The program has up tunnels and no head can use one:
+// rule (3), NO_ACTIVE_WEIGHT in both admissions; replace(0) is Complete; four zero records. With
+// nodes 0 and 1 masked the replay roster is empty: NO_ROUTE, then Complete, four records still.
+TEST(TunnelZero, PinnedT1AllFailedOrNoRoster) {
+  const auto g = twoh(2, 10);
+  auto p = make(g, {0, 1}, {2}, t1(2, LOSSY));
+  const auto prog = p->replace(12, 12).program;
+  const auto no_e1 = g->eligibility({}, std::vector<EdgeId> {1});
+  const auto no_heads = g->eligibility(std::vector<NodeId> {0, 1}, {});
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    auto pin = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {prog, nullptr}, .admission = a}, &no_e1);
+    const auto r = pin->replace(12);
+    EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+    if (a == LOSSY) {
+      EXPECT_EQ(r.call_source_drops, 12);
+      EXPECT_EQ(source_rows(r), (std::vector<SourceRow> {{0, 12, 12, 0, 12, 0}, {1, 0, 0, 0, 0, 0}}));
+    }
+    EXPECT_EQ(rows(r), (Rows {{0, 0, NB, 0, 0, 0}, {1, 1, FAILED, 0, 0, 0}, {2, 0, NB, 0, 0, 0}, {3, 1, FAILED, 0, 0, 0}}));
+    EXPECT_EQ(pin->replace(0).termination, Termination::Complete);
+    EXPECT_EQ(entries(pin->records()), (std::vector<std::optional<std::int32_t>> {0, 1, 2, 3}));
+    auto none = make(g, {0, 1}, {2}, FlowPolicyConfig {.routing = Pinned {prog, nullptr}, .admission = a}, &no_heads);
+    EXPECT_EQ(none->replace(12).termination, Termination::NoRoute);
+    EXPECT_EQ(none->replace(0).termination, Termination::Complete);
+    EXPECT_EQ(none->records().size(), 4U);
+  }
+}
+
+// ---------------------------------------------------------------- evaluators (12)
+
+// Capacity of T1 is the lossless bound of the tunnels set up for the design
+// (required and finite); Lossy forwards `offered` (required and finite); the other models reject a
+// design; evaluate_pairs shares nothing between pairs.
+TEST(TunnelEvaluators, T1Capacity) {
+  const auto g = par612();
+  EvaluationOptions q {t1(4)};
+  q.design_demand = Amount {12};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), q).call_delivered, 12);
+  EvaluationOptions ly {t1(4, LOSSY)};
+  ly.design_demand = Amount {12};
+  ly.offer = Amount {13};
+  const auto r = evaluate_demand(*g, v({0}), v({1}), ly);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_EQ(r.call_edge_drops, (Pairs {{0, 1}}));
+  ASSERT_TRUE(r.plan.has_value());
+  EXPECT_EQ(r.plan->total_reserved_bandwidth, 12);
+  auto err = [&](const EvaluationOptions& o) { return error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), o); }); };
+  for (const auto a : {LOSSLESS, LOSSY}) EXPECT_EQ(err(EvaluationOptions {t1(4, a)}), "DistributedTE evaluation requires design_demand");
+  EvaluationOptions inf {t1(4)};
+  inf.design_demand = std::optional<Amount> {};
+  EXPECT_EQ(err(inf), "DistributedTE requires a finite design demand");
+  EvaluationOptions no_offer {t1(4, LOSSY)};
+  no_offer.design_demand = Amount {12};
+  EXPECT_EQ(err(no_offer), "DistributedTE LOSSY evaluation requires a finite offer");
+  no_offer.offer = std::optional<Amount> {};  // an explicit +inf
+  EXPECT_EQ(err(no_offer), "offer must be an integer in [0, 2^62)");
+  // Lossless with a finite offer: the tunnels' delivery up to it.
+  EvaluationOptions with_offer {t1(4)};
+  with_offer.design_demand = Amount {12};
+  with_offer.offer = Amount {5};
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), with_offer).call_delivered, 5);
+  EvaluationOptions bad {t1(4)};
+  bad.design_demand = Amount {-1};
+  EXPECT_EQ(err(bad), "design_demand must be an integer in [0, 2^62) or permitted +inf");
+  // An explicit offer comes before the design.
+  bad.offer = kL62;
+  EXPECT_EQ(err(bad), "offer must be an integer in [0, 2^62)");
+  for (const auto& c : {shortest_paths_config(), global_config()}) {
+    EvaluationOptions o {c};
+    o.design_demand = Amount {5};
+    EXPECT_EQ(err(o), std::string(detail::model_class(c.routing)) + " does not accept design_demand");
+    const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({1})}};
+    EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, pairs, o, {}, 1); }),
+              std::string(detail::model_class(c.routing)) + " does not accept design_demand");
+  }
+  EvaluationOptions pin {FlowPolicyConfig {.routing = pinned_paths(*g, {0}, {1}, {{0, {0}, 1}})}};
+  pin.design_demand = Amount {5};
+  EXPECT_EQ(err(pin), "Pinned does not accept design_demand");
+  // Each pair sets up on a fresh ledger: ONE10, N = 1, design 6, twice the same pair: 10 and 10.
+  const auto one = one10();
+  EvaluationOptions b {t1(1)};
+  b.design_demand = Amount {6};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({1})}, {v({0}), v({1})}};
+  for (const std::int32_t workers : {1, 2}) {
+    const auto rs = evaluate_pairs(*one, pairs, b, {}, workers);
+    ASSERT_EQ(rs.size(), 2U);
+    EXPECT_EQ(rs[0].call_delivered, 10);
+    EXPECT_EQ(rs[1].call_delivered, 10);
+  }
+}
+
+// evaluate_edge_failures(X8, [0, 1], 2, T1 N = 1, design 4): baseline 0
+// (head 0 is down and first); deleting e0 takes head 0 out of the roster and head 1's tunnel carries
+// 8: loss -8; deleting e1: 0. Every allowed link is a candidate (no shortcut), here an edge outside
+// every route too.
+TEST(TunnelEvaluators, T1Sensitivity) {
+  EvaluationOptions q {t1(1)};
+  q.design_demand = Amount {4};
+  for (const std::int32_t workers : {1, 2}) {
+    const auto s = evaluate_edge_failures(*x8(), v({0, 1}), v({2}), q, workers);
+    EXPECT_EQ(s.baseline.call_delivered, 0);
+    std::vector<std::pair<EdgeId, Amount>> got;
+    for (const auto& e : s.entries) got.emplace_back(e.edge, e.delivery_reduction);
+    EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, -8}, {1, 0}}));
+  }
+  const auto g = ordered(3, {{0, 1, 6, 1}, {0, 1, 6, 2}, {2, 0, 5, 1}});
+  EvaluationOptions all {t1(4)};
+  all.design_demand = Amount {12};
+  const auto s = evaluate_edge_failures(*g, v({0}), v({1}), all, 1);
+  std::vector<std::pair<EdgeId, Amount>> got;
+  for (const auto& e : s.entries) got.emplace_back(e.edge, e.delivery_reduction);
+  // Deleting e0: the four tunnels set up on e1 alone (two fit: 6 of 3 + 3), the bound 6.
+  EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, 6}, {1, 6}, {2, 0}}));
+  // A zero offered (Lossy) is Complete and every loss is 0.
+  EvaluationOptions zero {t1(1, LOSSY)};
+  zero.design_demand = Amount {4};
+  zero.offer = Amount {0};
+  const auto c0 = evaluate_demand(*x8(), v({0, 1}), v({2}), zero);
+  EXPECT_EQ(c0.termination, Termination::Complete);
+  EXPECT_EQ(c0.call_delivered, 0);
+  for (const auto& e : evaluate_edge_failures(*x8(), v({0, 1}), v({2}), zero, 1).entries) EXPECT_EQ(e.delivery_reduction, 0);
+  // An Eligibility that excludes every edge: an empty roster, NO_ROUTE, call_delivered 0.
+  const auto gm = x8();
+  const auto mask = gm->eligibility({}, std::vector<EdgeId> {0, 1});
+  const auto none = evaluate_demand(*gm, v({0, 1}), v({2}), EvaluationOptions {t1(1), &mask, nullptr, {}, Amount {4}});
+  EXPECT_EQ(none.termination, Termination::NoRoute);
+  EXPECT_EQ(none.call_delivered, 0);
+}
+
+// ---------------------------------------------------------------- validation (V)
+
+// T1's row of the matrix and its own parameters.
+TEST(TunnelValidation, T1Matrix) {
+  const auto g = one10();
+  FlowLedger fg(g);
+  auto rejects = [&](const FlowPolicyConfig& c, const std::string& text, ShortestPathCache* cache = nullptr) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), c, nullptr, cache); }), text);
+    EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty());
+  };
+  // T1 always orders single paths: every tie_break is valid with every parallel_edges (no
+  // ineffective tie rule), and the snapshot keeps the defaults.
+  for (const auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity, RouteTieBreak::HigherAvailableCapacity,
+                         RouteTieBreak::HigherHeadroom}) {
+    for (const bool parallel_edges : {true, false}) {
+      EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), t1(2, LOSSLESS, std::nullopt, 0, tie, parallel_edges)); }), "");
+    }
+  }
+  {
+    FlowPolicy p(fg, v({0}), v({1}), t1(2));
+    EXPECT_EQ(std::get<DistributedTE>(p.config().routing).tie_break, RouteTieBreak::FewerHops);
+    EXPECT_TRUE(std::get<DistributedTE>(p.config().routing).parallel_edges);
+  }
+  ShortestPathCache cache(*g);
+  rejects(t1(2), "DistributedTE does not use ShortestPathCache", &cache);
+  rejects(t1(0), "DistributedTE does not use ShortestPathCache", &cache);  // the cache before the count
+  rejects({.routing = DistributedTE {TunnelCount {2, true}}}, "DistributedTE requires an exact tunnel count");
+  rejects({.routing = DistributedTE {TunnelCount {0, true}}}, "tunnel count must be in [1, 10000]");  // the count first
+  for (const std::int64_t n : {std::int64_t {0}, std::int64_t {10001}, std::int64_t {-1}}) rejects(t1(n), "tunnel count must be in [1, 10000]");
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), t1(10000)); }), "");
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), t1(2, LOSSY)); }), "");
+}
+
+// The tunnel limit counts the roster's heads (after the mask) times the count:
+// FAN(107375) with N = 10000 is above 2^30 - 1; FAN(107374), FAN(112871) with N = 9513 (exactly
+// 2^30 - 1: the limit is inclusive) and FAN(107375) with head 0 masked construct (no tunnel is
+// made at construction).
+TEST(TunnelValidation, TunnelLimit) {
+  const auto fan = [](std::int32_t h) {
+    std::vector<InEdge> rows;
+    rows.reserve(static_cast<std::size_t>(h));
+    for (std::int32_t i = 0; i < h; ++i) rows.push_back({i, h, 1, 1});
+    return shared(make_graph(h + 1, rows));
+  };
+  const auto heads = [](std::int32_t h) {
+    std::vector<NodeId> out(static_cast<std::size_t>(h));
+    for (std::int32_t i = 0; i < h; ++i) out[static_cast<std::size_t>(i)] = i;
+    return out;
+  };
+  const auto big = fan(107375);
+  FlowLedger fg(big);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, heads(107375), v({107375}), t1(10000)); }),
+            "tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823");
+  const auto mask = big->eligibility(std::vector<NodeId> {0}, {});
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, heads(107375), v({107375}), t1(10000), &mask); }), "");
+  const auto ok = fan(107374);
+  FlowLedger fo(ok);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fo, heads(107374), v({107374}), t1(10000)); }), "");
+  // Exactly at the limit (inclusive): FAN(112871) with N = 9513 is 112871 x 9513 = 2^30 - 1 tunnels.
+  const auto edge = fan(112871);
+  FlowLedger fe(edge);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fe, heads(112871), v({112871}), t1(9513)); }), "");
+  // The limit at an evaluator, per pair.
+  EvaluationOptions q {t1(10000)};
+  q.design_demand = Amount {1};
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(*big, heads(107375), v({107375}), q); }),
+            "tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823");
+}
+
+// ---------------------------------------------------------------- numeric ranges (W)
+
+// ONEMAX (one link of 2^62 - 1): one tunnel holds 2^62 - 1 and carries it; two
+// owners near the baseline: A holds 2^61, B's request of 2^61 sees U = 2^61 - 1 (NB); the commit's
+// sum of holds stays below 2^63.
+TEST(TunnelRanges, OneMaxAndHoldsNearTheBaseline) {
+  const Amount max = kL62 - 1;
+  const auto g = ordered(2, {{0, 1, max, 1}});
+  auto p = make(g, {0}, {1}, t1(1, LOSSY));
+  const auto r = p->replace(max, max, kHolds);
+  EXPECT_EQ(statuses(*r.program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(r.plan->total_reserved_bandwidth, max);
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {max}));
+  EXPECT_EQ(p.ledger->unreserved(), (Amounts {0}));
+  EXPECT_EQ(r.call_delivered, max);
+  auto ll = make(g, {0}, {1}, t1(1));
+  EXPECT_EQ(ll->replace(INF, max).call_delivered, max);
+  auto ledger = std::make_shared<FlowLedger>(g);
+  auto a = make(g, {0}, {1}, t1(1), nullptr, ledger);
+  auto b = make(g, {0}, {1}, t1(1), nullptr, ledger);
+  const Amount half = Amount {1} << 61;
+  EXPECT_EQ(statuses(*a->replace(half, half).program), (std::vector<TunnelStatus> {UP}));
+  EXPECT_EQ(statuses(*b->replace(half, half).program), (std::vector<TunnelStatus> {NB}));
+  EXPECT_EQ(ledger->unreserved(), (Amounts {half - 1}));
+  expect_balanced(*ledger, "near the baseline");
+}
+
+// FAN4MAX (four heads, private links of 2^60 - 1), N = 10000, Lossless replace(2^62 - 4,
+// 2^62 - 4): 40000 tunnels, all up; each head's share 2^60 - 1 splits as 6975 requests of
+// 115292150460685 and 3025 of 115292150460684, which fill each link exactly; total_reserved_bandwidth 2^62 -
+// 4; the whole design is carried (every tunnel up and U <= V).
+TEST(TunnelRanges, ManyTunnels) {
+  const Amount cap = (Amount {1} << 60) - 1;
+  const auto g = ordered(5, {{0, 4, cap, 1}, {1, 4, cap, 1}, {2, 4, cap, 1}, {3, 4, cap, 1}});
+  auto p = make(g, {0, 1, 2, 3}, {4}, t1(10000));
+  const Amount D = kL62 - 4;
+  const auto r = p->replace(D, D);
+  ASSERT_EQ(r.program->tunnels().size(), 40000U);
+  std::map<Amount, std::int64_t> counts;
+  for (const auto& t : r.program->tunnels()) {
+    EXPECT_EQ(t.status, UP);
+    ++counts[t.requested_bandwidth];
+  }
+  EXPECT_EQ(counts, (std::map<Amount, std::int64_t> {{115292150460684, 4 * 3025}, {115292150460685, 4 * 6975}}));
+  EXPECT_EQ(r.plan->total_reserved_bandwidth, D);
+  EXPECT_EQ(p.ledger->reserved(), (Amounts {cap, cap, cap, cap}));
+  EXPECT_EQ(r.call_delivered, D);
+  EXPECT_EQ(r.termination, Termination::Complete);
+}
+
+// ---------------------------------------------------------------- property
+
+// The exact CostStretch comparison cost * d <= n * base where a 64-bit product overflows: the
+// largest components on large costs and baselines (products near 2^126), equality on both sides of
+// 2^62, a factor just above 1 on a baseline near 2^62, a fraction whose binary approximation
+// would decide otherwise, and a fractional factor at equality. The reference (the tests' Int128)
+// and the library's comparison agree.
+TEST(T1Reference, StretchComparisonIsExact) {
+  using t1_reference::stretch_admits;
+  constexpr Cost kMax = std::numeric_limits<Cost>::max();
+  constexpr Cost p62 = Cost {1} << 62;
+  constexpr std::int64_t p52 = std::int64_t {1} << 52;
+  constexpr std::int64_t p61 = std::int64_t {1} << 61;
+  struct Case {
+    Cost cost, base;
+    CostStretch f;
+    bool admits;
+  };
+  const std::vector<Case> cases {
+      {Cost {1} << 60, Cost {1} << 60, CostStretch(kMax), true},
+      {kMax, Cost {1} << 60, CostStretch(kMax), true},
+      {kMax, 1, CostStretch(kMax), true},  // equality at 2^63 - 1
+      {kMax, kMax, CostStretch(kMax, kMax - 1), true},  // products near 2^126
+      {kMax, kMax - 2, CostStretch(kMax - 1, kMax - 2), false},  // M (M - 2) > (M - 1)(M - 2), M = 2^63 - 1
+      {p62, 1, CostStretch(p62), true},  // equality
+      {p62 + 1, 1, CostStretch(p62), false},
+      {kMax, p62, CostStretch(std::int64_t {1} << 40), true},
+      {kMax, Cost {1} << 22, CostStretch(std::int64_t {1} << 40), false},  // 2^62 < 2^63 - 1
+      {p62 + 1022, p62 - 1, CostStretch(p52 + 1, p52), true},  // f * base = 2^62 + 1023 - 2^-52
+      {p62 + 1023, p62 - 1, CostStretch(p52 + 1, p52), false},
+      {(Cost {1} << 60) + 1, Cost {1} << 60, CostStretch(p61 + 1, p61), false},  // 2^121 + 2^61 > 2^121 + 2^60
+      {6, 5, CostStretch(6, 5), true},  // the binary value of 1.2 times 5 is below 6
+      {3, 2, CostStretch(3, 2), true},
+      {4, 2, CostStretch(3, 2), false},
+  };
+  for (const auto& c : cases) {
+    const std::string where = std::to_string(c.cost) + " " + std::to_string(c.base) + " " + std::to_string(c.f.numerator()) +
+                              "/" + std::to_string(c.f.denominator());
+    EXPECT_EQ(stretch_admits(c.cost, c.base, c.f), c.admits) << where;
+    EXPECT_EQ(detail::stretch_le(c.cost, c.base, c.f.numerator(), c.f.denominator()), c.admits) << where;
+  }
+  // A zero baseline admits only a zero cost, whatever the factor.
+  EXPECT_TRUE(stretch_admits(0, 0, CostStretch(kMax)));
+  EXPECT_FALSE(stretch_admits(1, 0, CostStretch(kMax)));
+  EXPECT_TRUE(detail::stretch_le(0, 0, kMax, 1));
+  EXPECT_FALSE(detail::stretch_le(1, 0, kMax, 1));
+}
+
+// The ceiling through the public calls, with products of about 2^64 to 2^65: two parallel links
+// 0 -> 1 of capacity 1, costs B = 2^32 (the shortest) and C. With C = 2^32 + 1 and
+// f = 2^32 / (2^32 - 1), C * den = 2^64 - 1 <= 2^64 = num * B: admitted (the low 64 bits alone say
+// 2^64 - 1 > 0). With C = 2^33 and f = (2^32 + 2) / (2^32 + 1), C * den = 2^65 + 2^33 > 2^64 + 2^33:
+// refused (the low 64 bits alone are equal). T1's second tunnel and ksp's second path follow.
+TEST(CostStretch, CeilingProductsBeyond64Bits) {
+  constexpr Cost b = Cost {1} << 32;
+  struct Case {
+    Cost c;
+    CostStretch f;
+    bool admitted;
+  };
+  for (const Case& x : {Case {b + 1, CostStretch(b, b - 1), true}, Case {2 * b, CostStretch(b + 2, b + 1), false}}) {
+    const auto g = ordered(2, {{0, 1, 1, b}, {0, 1, 1, x.c}});
+    KspOptions o(2);
+    o.cost_ceiling = x.f;
+    std::vector<Cost> costs;
+    for (const auto& [cost, path] : ksp(*g, 0, 1, o)) costs.push_back(cost);
+    EXPECT_EQ(costs, x.admitted ? (std::vector<Cost> {b, x.c}) : (std::vector<Cost> {b})) << x.c;
+    auto p = make(g, {0}, {1}, t1(2, LOSSLESS, CostCeiling {x.f}));
+    const auto r = p->replace(2, 2);
+    ASSERT_TRUE(r.program);
+    std::vector<TunnelStatus> statuses;
+    for (const auto& t : r.program->tunnels()) statuses.push_back(t.status);
+    EXPECT_EQ(statuses, (std::vector<TunnelStatus> {UP, x.admitted ? UP : CC})) << x.c;
+    EXPECT_EQ(r.call_delivered, x.admitted ? 2 : 1) << x.c;
+  }
+}
+
+// The C++ CostStretch is one reduced fraction: 12/10 is 6/5, the lowest numerator stays as
+// it is (no int64 negation is needed), and a denominator below 1 is an invalid argument.
+TEST(CostStretch, Reduction) {
+  EXPECT_EQ(CostStretch(12, 10), CostStretch(6, 5));
+  EXPECT_EQ(CostStretch(12, 10).numerator(), 6);
+  EXPECT_EQ(CostStretch(12, 10).denominator(), 5);
+  const CostStretch low(std::numeric_limits<std::int64_t>::min());
+  EXPECT_EQ(low.numerator(), std::numeric_limits<std::int64_t>::min());
+  EXPECT_EQ(low.denominator(), 1);
+  EXPECT_EQ(CostStretch(std::numeric_limits<std::int64_t>::min(), 4).numerator(), -(std::int64_t {1} << 61));
+  EXPECT_EQ(CostStretch(-6, 4), CostStretch(-3, 2));
+  EXPECT_EQ(CostStretch(0, 7), CostStretch(0));
+  for (const std::int64_t d : {std::int64_t {0}, std::int64_t {-2}}) {
+    EXPECT_EQ(error_of([&] { (void)CostStretch(1, d); }), "CostStretch fraction denominator must be in [1, 2^63)") << d;
+  }
+}
+
+// Random small graphs (costs 1 to 4, capacities 0 to 6, one or two heads and
+// destinations, a node or edge mask, every tie_break and parallel_edges, the three ceilings, a search
+// minimum, preloaded service and reservation baselines, another owner's holds and another owner's
+// carried load) against t1_reference (test_utils.hpp): the roster, every tunnel's request, status
+// and path, the holds per edge (the up requests, within the reservation baseline), the lossless
+// bound on the service view; the setup does not depend on the offer; when every tunnel is up and U
+// <= V on every link, D itself is admitted; Lossy accounting and per-record conservation.
+TEST(T1Property, SetupAndBoundAgainstTheReference) {
+  std::mt19937 rng(20261018);
+  auto below = [&](int k) { return static_cast<int>(rng() % static_cast<unsigned>(k)); };
+  int up = 0, nb = 0, cc = 0, bounded = 0, design_carried = 0, dropped = 0, preferred = 0, collapsed = 0, held = 0;
+  for (int trial = 0; trial < 700; ++trial) {
+    const int n = 4 + below(3);
+    const int m = 3 + below(10);
+    std::vector<InEdge> rows;
+    for (int i = 0; i < m; ++i) {
+      const NodeId u = below(n);
+      NodeId w = below(n - 1);
+      if (w >= u) ++w;
+      rows.push_back({u, w, static_cast<Amount>(below(7)), static_cast<Cost>(1 + below(4))});
+    }
+    const auto g = shared(make_graph(n, rows));
+    std::vector<NodeId> src = {0};
+    std::vector<NodeId> dst = {n - 1};
+    if (below(2) == 0) src.push_back(1);
+    if (below(2) == 0) dst.insert(dst.begin(), n - 2);
+    std::optional<Eligibility> mask;
+    switch (below(4)) {
+      case 0: mask = g->eligibility(std::vector<NodeId> {static_cast<NodeId>(below(n))}, {}); break;
+      case 1: mask = g->eligibility({}, std::vector<EdgeId> {static_cast<EdgeId>(below(m))}); break;
+      default: break;
+    }
+    const Eligibility* elig = mask ? &*mask : nullptr;
+    const bool prefer = below(2) == 0;
+    const RouteTieBreak higher = std::vector<RouteTieBreak> {RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherCapacity,
+                                                             RouteTieBreak::HigherHeadroom}[static_cast<std::size_t>(below(3))];
+    const t1_reference::Selection rs {prefer ? higher : RouteTieBreak::FewerHops, below(3) != 0};
+    std::optional<CostCeiling> ceiling;
+    switch (below(5)) {
+      case 0: ceiling = AbsoluteCost {1 + below(8)}; break;
+      case 1: {
+        const std::pair<std::int64_t, std::int64_t> factors[4] = {{1, 1}, {6, 5}, {3, 2}, {2, 1}};
+        const auto [n, d] = factors[static_cast<std::size_t>(below(4))];
+        ceiling = CostStretch(n, d);
+        break;
+      }
+      default: break;
+    }
+    const Amount minimum = below(4) == 0 ? below(3) : 0;
+    const std::int64_t N = 1 + below(3);
+    const Amount D = below(13);
+    std::vector<Amount> service(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+    std::vector<Amount> reservation = service;
+    if (below(2) == 0) {
+      for (auto& x : service) x = x == 0 ? 0 : below(static_cast<int>(x) + 1);
+    }
+    if (below(2) == 0) {
+      for (auto& x : reservation) x = x == 0 ? 0 : below(static_cast<int>(x) + 1);
+    }
+    const bool other_holds = below(3) == 0;
+    const bool other_load = below(3) == 0;
+    const Amount other_d = below(6);
+    // One scenario: the baselines and the other owners, then the policy under test.
+    struct Scenario {
+      std::shared_ptr<FlowLedger> ledger;
+      std::unique_ptr<FlowPolicy> holds, load, p;
+    };
+    auto build = [&](Admission a) {
+      Scenario s;
+      s.ledger = std::make_shared<FlowLedger>(g, service, reservation);
+      if (other_holds) {
+        s.holds = std::make_unique<FlowPolicy>(*s.ledger, src, dst, t1(1));
+        (void)s.holds->replace(0, other_d);
+      }
+      if (other_load) {
+        s.load = std::make_unique<FlowPolicy>(*s.ledger, src, dst, shortest_paths_config());
+        (void)s.load->place(other_d);
+      }
+      s.p = std::make_unique<FlowPolicy>(*s.ledger, src, dst, t1(N, a, ceiling, minimum, rs.tie_break, rs.parallel_edges), elig);
+      return s;
+    };
+    const std::string where = "trial " + std::to_string(trial);
+    auto s = build(LOSSLESS);
+    const auto U = s.ledger->unreserved();
+    const auto V = s.ledger->residual();
+    const auto R0 = detail::LedgerAccess::reservation_baseline(*s.ledger);
+    const auto held_before = s.ledger->reserved();
+    std::vector<NodeId> dests_ok;
+    for (NodeId d : dst) {
+      if (elig == nullptr || elig->allows_node(d)) dests_ok.push_back(d);
+    }
+    const auto heads = t1_reference::roster(*g, elig, src, dests_ok);
+    if (heads.empty()) continue;
+    const auto want = t1_reference::setup(*g, elig, heads, dests_ok, rs, ceiling, minimum, D, N, U);
+    const auto r = s.p->replace(INF, D);
+    ASSERT_EQ(vec(detail::ProgramAccess::data(*r.program).reachable_sources), heads) << where;
+    ASSERT_EQ(r.program->tunnels().size(), want.size()) << where;
+    std::vector<Amount> sum(U.size(), 0);
+    bool all_up = true;
+    for (std::size_t i = 0; i < want.size(); ++i) {
+      const auto& t = r.program->tunnels()[i];
+      EXPECT_EQ(t.head, want[i].head) << where << " tunnel " << i;
+      EXPECT_EQ(t.requested_bandwidth, want[i].request) << where << " tunnel " << i;
+      EXPECT_EQ(t.status, want[i].status) << where << " tunnel " << i;
+      EXPECT_EQ(t.edges.value_or(Edges {}), want[i].path) << where << " tunnel " << i;
+      if (t.status == UP) {
+        ++up;
+        for (EdgeId e : *t.edges) {
+          sum[static_cast<std::size_t>(e)] += t.requested_bandwidth;
+          EXPECT_GE(U[static_cast<std::size_t>(e)], std::max(t.requested_bandwidth, minimum)) << where;  // it passed its filter
+        }
+      } else {
+        all_up = false;
+        ++(t.status == NB ? nb : cc);
+      }
+    }
+    const auto held_after = s.ledger->reserved();
+    for (std::size_t e = 0; e < sum.size(); ++e) {
+      EXPECT_EQ(held_after[e], held_before[e] + sum[e]) << where << " edge " << e;
+      EXPECT_LE(held_after[e], R0[e]) << where << " edge " << e;
+      held += sum[e] > 0 ? 1 : 0;
+    }
+    expect_balanced(*s.ledger, where);
+    const Amount bound = t1_reference::lossless_bound(heads.size(), want, V);
+    EXPECT_EQ(r.call_delivered, bound) << where;
+    bounded += bound > 0 ? 1 : 0;
+    // The setup does not depend on the offer (evaluate releases the policy's own holds).
+    const auto e = s.p->evaluate(below(9), D);
+    EXPECT_EQ(routes(*e.program), routes(*r.program)) << where;
+    EXPECT_EQ(statuses(*e.program), statuses(*r.program)) << where;
+    // Every tunnel up and U <= V on every link: D is carried without loss.
+    bool covered = all_up;
+    for (std::size_t x = 0; covered && x < U.size(); ++x) covered = U[x] <= V[x];
+    if (covered) {
+      EXPECT_EQ(s.p->evaluate(D, D).call_delivered, D) << where;
+      ++design_carried;
+    }
+    preferred += rs.prefer() ? 1 : 0;
+    collapsed += rs.parallel_edges ? 0 : 1;
+    // Lossy: the same setup; the accounting and every record's conservation.
+    auto ly = build(LOSSY);
+    const Amount offer = below(15);
+    const auto lr = ly.p->replace(offer, D);
+    EXPECT_EQ(routes(*lr.program), routes(*r.program)) << where;
+    Amount drops = 0;
+    for (const auto& [x, d] : lr.edge_drops) drops += lo(d);
+    EXPECT_EQ(lo(lr.offered), offer) << where;
+    EXPECT_EQ(lo(lr.source_drops) + drops + lr.delivered, offer) << where;
+    dropped += drops > 0 ? 1 : 0;
+    for (const auto& rec : ly.p->records()) (void)expect_conserved(*g, rec, where);
+    expect_balanced(*ly.ledger, where);
+    ASSERT_FALSE(::testing::Test::HasFailure()) << where;
+  }
+  // Not vacuous.
+  EXPECT_GT(up, 300);
+  EXPECT_GT(nb, 100);
+  EXPECT_GT(cc, 20);
+  EXPECT_GT(bounded, 100);
+  EXPECT_GT(design_carried, 30);
+  EXPECT_GT(dropped, 30);
+  EXPECT_GT(preferred, 100);
+  EXPECT_GT(collapsed, 100);
+  EXPECT_GT(held, 100);
+}
diff --git a/tests/cpp/eligibility_tests.cpp b/tests/cpp/eligibility_tests.cpp
new file mode 100644
index 0000000..a6193fe
--- /dev/null
+++ b/tests/cpp/eligibility_tests.cpp
@@ -0,0 +1,130 @@
+// Eligibility as the graph builds it: dense node and edge flags from excluded ids,
+// graph-bound, uid 0 for the all-allowed value.
+#include <gtest/gtest.h>
+
+#include <string>
+#include <type_traits>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+std::vector<int> flags(std::span<const std::uint8_t> s) { return std::vector<int>(s.begin(), s.end()); }
+
+} // namespace
+
+TEST(Eligibility, AllAllowedHasUidZero) {
+  // Built only by Graph::eligibility and intersect: no default construction.
+  static_assert(!std::is_default_constructible_v<Eligibility>);
+  auto g = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  auto el = g.eligibility();
+  EXPECT_EQ(el.uid(), 0u);
+  EXPECT_EQ(el.graph_uid(), g.uid());
+  EXPECT_EQ(flags(el.node_allowed()), (std::vector<int>{1, 1, 1}));
+  EXPECT_EQ(flags(el.edge_allowed()), (std::vector<int>{1, 1}));
+}
+
+TEST(Eligibility, ExcludedNodeExcludesIncidentEdges) {
+  // In-edges, out-edges and a self-loop of the excluded node.
+  auto g = make_graph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {1, 1, 1, 2}, {3, 0, 1, 1}});
+  const auto inv = id_of_input(g);
+  const std::vector<NodeId> xn = {1};
+  auto el = g.eligibility(xn, {});
+  EXPECT_NE(el.uid(), 0u);
+  EXPECT_EQ(flags(el.node_allowed()), (std::vector<int>{1, 0, 1, 1}));
+  auto allowed_in = to_input(g, std::vector<std::uint8_t>(el.edge_allowed().begin(), el.edge_allowed().end()));
+  EXPECT_EQ(std::vector<int>(allowed_in.begin(), allowed_in.end()), (std::vector<int>{0, 0, 1, 0, 1}));
+  EXPECT_FALSE(el.allows_edge(inv[0]));
+  EXPECT_TRUE(el.allows_edge(inv[2]));
+}
+
+TEST(Eligibility, ExcludedEdgesDuplicatesAndOrder) {
+  // EdgeIds 0: 0 -> 1, 1: 0 -> 2, 2: 1 -> 2, 3: 3 -> 0 (the one edge left allowed).
+  auto g = make_graph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {0, 2, 1, 5}, {3, 0, 1, 1}});
+  const std::vector<EdgeId> xe = {2, 0, 2};
+  const std::vector<NodeId> xn = {2, 2};
+  auto el = g.eligibility(xn, xe);
+  EXPECT_EQ(flags(el.node_allowed()), (std::vector<int>{1, 1, 0, 1}));
+  int allowed = 0;
+  for (EdgeId e = 0; e < 4; ++e) {
+    const bool excluded = e == 0 || e == 2 || g.edge_destinations()[static_cast<std::size_t>(e)] == 2;
+    EXPECT_EQ(el.allows_edge(e), !excluded) << e;
+    allowed += excluded ? 0 : 1;
+  }
+  EXPECT_EQ(allowed, 1);  // both answers are expected
+}
+
+TEST(Eligibility, DistinctUidsForEqualLists) {
+  auto g = make_graph(2, {{0, 1, 1, 1}});
+  const std::vector<EdgeId> xe = {0};
+  auto a = g.eligibility({}, xe);
+  auto b = g.eligibility({}, xe);
+  EXPECT_NE(a.uid(), b.uid());
+  EXPECT_NE(a.uid(), 0u);
+  EXPECT_EQ(flags(a.edge_allowed()), flags(b.edge_allowed()));
+}
+
+TEST(Eligibility, OutOfRangeIdsRejected) {
+  auto g = make_graph(2, {{0, 1, 1, 1}});
+  const std::vector<NodeId> bad_node = {2};
+  const std::vector<EdgeId> bad_edge = {1};
+  const std::vector<NodeId> neg_node = {-1};
+  EXPECT_EQ(error_of([&] { (void)g.eligibility(bad_node, {}); }), "excluded node 2 out of node range [0, 2)");
+  EXPECT_EQ(error_of([&] { (void)g.eligibility({}, bad_edge); }), "excluded edge 1 out of edge range [0, 1)");
+  EXPECT_EQ(error_of([&] { (void)g.eligibility(neg_node, {}); }), "excluded node -1 out of node range [0, 2)");
+}
+
+// Eligibility.intersect: an operand when the result equals it (its uid kept, a
+// first), otherwise a new value with a fresh uid; values of different graphs rejected.
+TEST(Eligibility, IntersectReturnsAnOperandWhenEqual) {
+  auto g = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}, {0, 2, 1, 5}});
+  const auto all = g.eligibility();
+  const std::vector<EdgeId> e0 = {0};
+  const std::vector<EdgeId> e1 = {1};
+  const std::vector<EdgeId> e01 = {0, 1};
+  const auto a = g.eligibility({}, e0);
+  const auto b = g.eligibility({}, e1);
+  // all-allowed with a: a (its uid); a with all-allowed: a.
+  EXPECT_EQ(Eligibility::intersect(all, a).uid(), a.uid());
+  EXPECT_EQ(Eligibility::intersect(a, all).uid(), a.uid());
+  EXPECT_EQ(Eligibility::intersect(all, all).uid(), 0u);
+  EXPECT_EQ(Eligibility::intersect(a, a).uid(), a.uid());
+  {
+    // Two equal values built separately (distinct uids): the first operand wins the tie.
+    const auto x = g.eligibility({}, e0);
+    const auto y = g.eligibility({}, e0);
+    ASSERT_NE(x.uid(), y.uid());
+    EXPECT_EQ(Eligibility::intersect(x, y).uid(), x.uid());
+    EXPECT_EQ(Eligibility::intersect(y, x).uid(), y.uid());
+  }
+  // a subset relation: the smaller value.
+  const auto ab_list = g.eligibility({}, e01);
+  EXPECT_EQ(Eligibility::intersect(a, ab_list).uid(), ab_list.uid());
+  // A new value: a fresh uid, flags are the conjunction; equal results built twice differ.
+  const auto x = Eligibility::intersect(a, b);
+  const auto y = Eligibility::intersect(a, b);
+  EXPECT_NE(x.uid(), a.uid());
+  EXPECT_NE(x.uid(), b.uid());
+  EXPECT_NE(x.uid(), 0u);
+  EXPECT_NE(x.uid(), y.uid());
+  EXPECT_EQ(flags(x.edge_allowed()), flags(ab_list.edge_allowed()));
+  EXPECT_EQ(x.graph_uid(), g.uid());
+  // Node exclusions intersect too (and keep excluding incident edges).
+  const std::vector<NodeId> n2 = {2};
+  const auto c = g.eligibility(n2, {});
+  const auto z = Eligibility::intersect(a, c);
+  EXPECT_EQ(flags(z.node_allowed()), (std::vector<int>{1, 1, 0}));
+  EXPECT_EQ(flags(z.edge_allowed()), (std::vector<int>{0, 0, 0}));
+}
+
+TEST(Eligibility, IntersectRejectsValuesOfDifferentGraphs) {
+  auto g = make_graph(2, {{0, 1, 1, 1}});
+  auto h = make_graph(2, {{0, 1, 1, 1}});
+  EXPECT_EQ(error_of([&] { (void)Eligibility::intersect(g.eligibility(), h.eligibility()); }),
+            "Eligibility.intersect: the two values belong to different graphs");
+}
diff --git a/tests/cpp/epoch_static_tests.cpp b/tests/cpp/epoch_static_tests.cpp
new file mode 100644
index 0000000..f14d01d
--- /dev/null
+++ b/tests/cpp/epoch_static_tests.cpp
@@ -0,0 +1,468 @@
+// Static preparation ownership, value equivalence, every epoch entry point and
+// dynamic exclusions. The fresh control discards only its private retained owner.
+#include <gtest/gtest.h>
+
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/trace.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+const OutputOptions all {true, true, true, true, true};
+std::shared_ptr<const Graph> epoch_graph() {
+  return std::make_shared<const Graph>(make_graph(6, {{0, 2, 20, 1}, {1, 2, 20, 1}, {2, 3, 4, 1},
+      {2, 3, 10, 1}, {2, 4, 20, 1}, {3, 5, 20, 1}, {4, 5, 20, 1}}));
+}
+std::vector<FlowPolicyConfig> static_configs(const Graph& g, bool pooled) {
+  std::vector<FlowPolicyConfig> out;
+  for (auto allocation : {RouteAllocation::Equal, RouteAllocation::Weighted})
+    for (auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity})
+      for (bool multipath : {false, true}) for (bool parallel : {false, true}) {
+        if (tie == RouteTieBreak::HigherCapacity && ((multipath && parallel) || (pooled && !multipath))) continue;
+        for (bool explicit_weights : {false, true}) {
+          if (allocation == RouteAllocation::Equal && explicit_weights) continue;
+          ShortestPaths sp;
+          sp.allocation = allocation; sp.tie_break = tie; sp.multipath = multipath; sp.parallel_edges = parallel;
+          if (explicit_weights) {
+            sp.weight_basis = WeightBasis::Explicit;
+            auto weights = std::make_shared<std::vector<Amount>>(static_cast<std::size_t>(g.num_edges()));
+            for (std::size_t i = 0; i < weights->size(); ++i) (*weights)[i] = static_cast<Amount>(i % 3);
+            sp.edge_weights = weights;
+          }
+          for (auto admission : {Admission::Lossless, Admission::Lossy}) out.push_back({sp, admission});
+        }
+      }
+  return out;
+}
+void discard_kept(FlowPolicy& p) { detail::PolicyAccess::engine(p).kept_program.reset(); }
+void compare(const FlowPolicy& p, const FlowPolicy& ref, const FlowLedger& ledger, const FlowLedger& fresh,
+             const PlacementResult& got, const PlacementResult& want) {
+  expect_same(got, want, "fresh preparation result");
+  expect_same(ledger_state(ledger), ledger_state(fresh), "fresh preparation ledger");
+  expect_same(epoch(p), epoch(ref), "fresh preparation epoch");
+  expect_balanced(ledger, "retained preparation");
+}
+}  // namespace
+
+TEST(EpochStatic, EveryStaticCombinationReusesAcrossScalarAndListEpochsWithFreshValues) {
+  const auto g = epoch_graph();
+  for (bool pooled : {false, true}) for (const auto& cfg : static_configs(*g, pooled)) {
+    const std::vector<NodeId> sources = pooled ? std::vector<NodeId>{0, 1} : std::vector<NodeId>{0};
+    const std::vector<NodeId> targets {5};
+    FlowLedger ledger(g), fresh(g);
+    FlowPolicy p(ledger, sources, targets, cfg), ref(fresh, sources, targets, cfg);
+    auto& engine = detail::PolicyAccess::engine(p);
+    ASSERT_TRUE(engine.static_preparation);
+    EXPECT_FALSE(engine.kept_program);
+    (void)p.evaluate(0, {}, all);
+    EXPECT_FALSE(engine.kept_program);
+    EXPECT_FALSE(p.program());
+    (void)p.place(0);
+    EXPECT_FALSE(engine.kept_program);
+    auto got = p.place(6, all), want = ref.place(6, all);
+    compare(p, ref, ledger, fresh, got, want);
+    const auto kept = got.program;
+    ASSERT_TRUE(kept);
+    EXPECT_EQ(engine.kept_program.get(), kept.get());
+    const auto before = epoch(p);
+    const auto before_ledger = ledger_state(ledger);
+    discard_kept(ref);
+    expect_same(p.evaluate(8, {}, all), ref.evaluate(8, {}, all), "warm evaluate");
+    EXPECT_EQ(p.evaluate(8).program.get(), kept.get());
+    expect_same(epoch(p), before, "evaluate read only");
+    expect_same(ledger_state(ledger), before_ledger, "evaluate read only");
+    p.remove(); ref.remove();
+    EXPECT_FALSE(p.program());
+    EXPECT_EQ(engine.kept_program.get(), kept.get());
+    EXPECT_FALSE(p.place(0).program);
+    EXPECT_THROW((void)p.forward(1), std::invalid_argument);
+    discard_kept(ref);
+    got = p.place(7, all); want = ref.place(7, all);
+    EXPECT_EQ(got.program.get(), kept.get());
+    compare(p, ref, ledger, fresh, got, want);
+    const auto old_id = p.records().front().flow_id.second;
+    discard_kept(ref);
+    got = p.replace(3, {}, all); want = ref.replace(3, {}, all);
+    EXPECT_EQ(got.program.get(), kept.get());
+    EXPECT_GT(p.records().front().flow_id.second, old_id);
+    compare(p, ref, ledger, fresh, got, want);
+    for (bool replace : {false, true}) {
+      if (!replace) { p.remove(); ref.remove(); }
+      discard_kept(ref);
+      const Action a = replace ? Action(Replace {p, 9}) : Action(Place {p, 9});
+      const Action b = replace ? Action(Replace {ref, 9}) : Action(Place {ref, 9});
+      got = apply_actions(ledger, std::span(&a, 1), BatchMode::Ordered, all).front();
+      want = apply_actions(fresh, std::span(&b, 1), BatchMode::Ordered, all).front();
+      EXPECT_EQ(got.program.get(), kept.get());
+      compare(p, ref, ledger, fresh, got, want);
+    }
+    if (cfg.admission == Admission::Lossy) {
+      discard_kept(ref);
+      const Action a = Replace {p, 4}, b = Replace {ref, 4};
+      got = apply_actions(ledger, std::span(&a, 1), BatchMode::Simultaneous, all).front();
+      want = apply_actions(fresh, std::span(&b, 1), BatchMode::Simultaneous, all).front();
+      EXPECT_EQ(got.program.get(), kept.get());
+      compare(p, ref, ledger, fresh, got, want);
+    }
+    const auto holes = g->eligibility({}, std::vector<EdgeId>{2});
+    got = p.forward(8, &holes, all); want = ref.forward(8, &holes, all);
+    compare(p, ref, ledger, fresh, got, want);
+    discard_kept(ref);
+    got = p.replace(5, {}, all); want = ref.replace(5, {}, all);
+    EXPECT_EQ(got.program.get(), kept.get());
+    compare(p, ref, ledger, fresh, got, want);
+  }
+}
+
+TEST(EpochStatic, DynamicChoicesNeverRetainAndChangeOnTheNewResidual) {
+  for (int mode = 0; mode < 4; ++mode) {
+    const auto g = std::make_shared<const Graph>(make_graph(2, {{0, 1, 10, 1}, {0, 1, mode == 1 ? 20 : 10, 1}}));
+    const std::vector<NodeId> src {0}, dst {1};
+    ShortestPaths sp;
+    if (mode < 2) {
+      sp.tie_break = mode == 0 ? RouteTieBreak::HigherAvailableCapacity : RouteTieBreak::HigherHeadroom;
+      sp.parallel_edges = false;
+    } else if (mode == 2) {
+      sp.allocation = RouteAllocation::Weighted;
+      sp.weight_basis = WeightBasis::ResidualSnapshot;
+    } else sp.allocation = RouteAllocation::Optimized;
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger, src, dst, {sp, mode < 3 ? Admission::Lossy : Admission::Lossless});
+    ASSERT_FALSE(detail::PolicyAccess::engine(p).static_preparation);
+    const auto first = p.place(2);
+    const auto original = program_snapshot(first.program.get());
+    // Outside traffic is pinned to e0 so its own route choice cannot hide the change.
+    const auto route = std::make_shared<const PredecessorDAG>(*dag_of(*g, {0}));
+    RouteDefinition def {0, route};
+    const auto outside_program = ForwardingProgram::from_routes(*g, src, dst, std::span(&def, 1));
+    FlowPolicy outside(ledger, src, dst, {Pinned {outside_program}, Admission::Lossless});
+    ASSERT_EQ(outside.place(mode == 1 ? 1 : 8).delivered, mode == 1 ? 1 : 8);
+    const auto next = p.replace(mode < 2 ? 1 : 12);
+    EXPECT_NE(next.program.get(), first.program.get());
+    EXPECT_FALSE(detail::PolicyAccess::engine(p).kept_program);
+    EXPECT_FALSE(program_snapshot(next.program.get()) == original);
+    if (mode < 2) EXPECT_EQ(ascending_edges(*p.records().front().route), std::vector<EdgeId> {1});
+    else EXPECT_EQ(next.delivered, 12);
+    p.remove();
+    EXPECT_NE(p.place(1).program.get(), first.program.get());
+    for (bool replace : {false, true}) {
+      if (!replace) p.remove();
+      const auto before_program = p.program();
+      const Action action = replace ? Action(Replace {p, 1}) : Action(Place {p, 1});
+      const auto result = apply_actions(ledger, std::span(&action, 1)).front();
+      EXPECT_NE(result.program.get(), first.program.get());
+      if (before_program) EXPECT_NE(result.program.get(), before_program.get());
+      EXPECT_FALSE(detail::PolicyAccess::engine(p).kept_program);
+    }
+    if (mode < 3) {
+      const auto previous = p.program();
+      const Action action = Replace {p, 1};
+      const auto result = apply_actions(ledger, std::span(&action, 1), BatchMode::Simultaneous).front();
+      EXPECT_NE(result.program.get(), previous.get());
+      EXPECT_FALSE(detail::PolicyAccess::engine(p).kept_program);
+    }
+
+  }
+}
+
+TEST(EpochStatic, KeptProgramOwnsUnprunedRoutesAndLifetimeWithoutOldRecordIds) {
+  const auto g = std::make_shared<const Graph>(make_graph(2, {{0, 1, 0, 1}, {0, 1, 2, 1}}));
+  const std::vector<NodeId> s {0}, t {1};
+  FlowLedger ledger(g);
+  ShortestPaths sp; sp.allocation = RouteAllocation::Weighted;
+  auto p = std::make_unique<FlowPolicy>(ledger, s, t, FlowPolicyConfig {sp, Admission::Lossy});
+  std::weak_ptr<const ForwardingProgram> weak;
+  {
+    const auto result = p->place(2);
+    ASSERT_EQ(result.delivered, 2);
+    weak = result.program;
+    const auto& owner = detail::PolicyAccess::engine(*p).kept_program;
+    ASSERT_FALSE(owner.owner_before(result.program));
+    ASSERT_FALSE(result.program.owner_before(owner));
+
+    EXPECT_EQ(ascending_edges(*p->records().front().route), (std::vector<EdgeId>{0, 1}));
+    EXPECT_EQ(detail::ProgramAccess::data(*result.program).split_contexts[0].prepared_route->forwarding_edges,
+              (std::vector<EdgeId>{1}));
+  }
+  const auto id = p->records().front().flow_id;
+  p->remove();
+  EXPECT_FALSE(p->program()); EXPECT_FALSE(weak.expired());
+  auto next = p->place(1);
+  EXPECT_EQ(next.program.get(), weak.lock().get());
+  EXPECT_GT(p->records().front().flow_id.second, id.second);
+  EXPECT_THROW((void)ledger.record(id), std::invalid_argument);
+  p->remove(); p.reset();
+  EXPECT_FALSE(weak.expired());  // independently returned immutable value owns it
+  next.program.reset();
+  EXPECT_TRUE(weak.expired());
+}
+
+TEST(EpochStatic, ProgramComparatorDetectsWrongRetainedRouteCostWeightAndStructure) {
+  const auto g = epoch_graph();
+  FlowLedger ledger(g);
+  const std::vector<NodeId> sources {0, 1}, dst {5};
+  ShortestPaths sp; sp.allocation = RouteAllocation::Weighted;
+  FlowPolicy p(ledger, sources, dst, {sp, Admission::Lossy});
+  const auto r = p.place(3);
+  const auto good = program_snapshot(r.program.get());
+  auto wrong = good;
+  ASSERT_FALSE(wrong.weights.empty()); ASSERT_FALSE(wrong.weights.front().empty());
+  ++wrong.weights.front().front();
+  EXPECT_FALSE(good == wrong);
+  wrong = good; ASSERT_FALSE(wrong.structure.empty()); ++wrong.structure.back();
+  EXPECT_FALSE(good == wrong);
+  wrong = good; ++wrong.members.front().front();
+  EXPECT_FALSE(good == wrong);
+  // A writable, independently owned test value: never write through the real
+  // program's const ownership. initialize_storage rebuilds its own block/views.
+  const auto& original = detail::ProgramAccess::data(*r.program);
+  detail::ProgramData writable;
+  writable.graph_uid = original.graph_uid;
+  writable.tunnels = original.tunnels;
+  writable.source_weights = original.source_weights;
+  writable.source_weight_values = original.source_weight_values;
+  writable.entries = original.entries;
+  writable.split_contexts = original.split_contexts;
+  writable.uses_topology_basis = original.uses_topology_basis;
+  writable.common_replay_support = original.common_replay_support;
+  writable.source_supports = original.source_supports;
+  writable.pools_source_inflows = original.pools_source_inflows;
+  writable.initialize_storage(original.sources, original.destinations, original.reachable_sources,
+                              original.excluded_nodes, original.excluded_edges);
+  auto block = std::make_shared<detail::ProgramBlock>(std::move(writable));
+  const std::shared_ptr<const ForwardingProgram> poisoned(block, &block->program);
+  ASSERT_TRUE(good == program_snapshot(poisoned.get()));
+  ++block->data.entries.front().min_route_cost;
+  EXPECT_FALSE(good == program_snapshot(poisoned.get()));
+  --block->data.entries.front().min_route_cost;
+  block->data.entries.front().route = dag_of(*g, {0});
+  EXPECT_FALSE(good == program_snapshot(poisoned.get()));
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+namespace {
+bool equal_trace(const detail::Trace& a, const detail::Trace& b) {
+  if (a.kind != b.kind || a.i != b.i || a.s != b.s || a.items.size() != b.items.size() || a.fields.size() != b.fields.size()) return false;
+  for (std::size_t i = 0; i < a.items.size(); ++i) if (!equal_trace(a.items[i], b.items[i])) return false;
+  for (std::size_t i = 0; i < a.fields.size(); ++i)
+    if (a.fields[i].first != b.fields[i].first || !equal_trace(a.fields[i].second, b.fields[i].second)) return false;
+  return true;
+}
+}
+TEST(EpochStatic, TraceHasTheFreshPrepareMapOnReuseSingleAndPooled) {
+  const auto g = epoch_graph();
+  for (bool pooled : {false, true}) {
+    FlowLedger ledger(g);
+    const std::vector<NodeId> src = pooled ? std::vector<NodeId>{0, 1} : std::vector<NodeId>{0};
+    const std::vector<NodeId> dst {5};
+    FlowPolicy p(ledger, src, dst, {});
+    detail::Trace first, repeated, increment;
+    (void)detail::place_traced(p, 3, all, first);
+    p.remove();
+    (void)detail::place_traced(p, 3, all, repeated);
+    ASSERT_TRUE(equal_trace(first, repeated));
+    bool found = false;
+    for (const auto& field : repeated.fields) if (field.first == "prepare") {
+      found = true; EXPECT_EQ(field.second.kind, detail::Trace::Kind::Map);
+    }
+    EXPECT_TRUE(found);
+    (void)detail::place_traced(p, 1, all, increment);
+    for (const auto& field : increment.fields) if (field.first == "prepare") EXPECT_EQ(field.second.kind, detail::Trace::Kind::Null);
+  }
+}
+#endif
+
+TEST(EpochStatic, MaskedBranchJoinAndParallelPopulationsEqualFreshOnChangedResiduals) {
+  std::mt19937 random(8371);
+  for (int trial = 0; trial < 160; ++trial) {
+    std::vector<InEdge> edges;
+    for (NodeId u = 0; u < 6; ++u) {
+      edges.push_back({u, u + 1, 1 + Amount(random() % 8), 2});
+      for (NodeId v = u + 1; v < 8; ++v) if (random() % 3 == 0)
+        for (int copy = 0; copy < 2; ++copy) edges.push_back({u, v, Amount(random() % 8), 1 + Cost(random() % 7)});
+    }
+    edges.push_back({6, 7, 3, 2});
+    const auto g = std::make_shared<const Graph>(make_graph(8, edges));
+    std::vector<NodeId> excluded;
+    if (trial % 5 == 0) excluded = {0, 1};
+    else if (trial % 7 == 0) excluded = {6, 7};
+    else if (trial % 3 == 0) excluded = {3};
+    const auto mask = g->eligibility(excluded, std::vector<EdgeId>{EdgeId(random() % g->num_edges())});
+    ShortestPaths sp;
+    sp.allocation = trial % 3 == 0 ? RouteAllocation::Equal : RouteAllocation::Weighted;
+    if (trial % 2 == 0) { sp.tie_break = RouteTieBreak::HigherCapacity; sp.parallel_edges = false; }
+    if (trial % 3 == 2) {
+      sp.weight_basis = WeightBasis::Explicit;
+      auto weights = std::make_shared<std::vector<Amount>>(static_cast<std::size_t>(g->num_edges()));
+      for (auto& w : *weights) w = Amount(random() % 4);
+      sp.edge_weights = weights;
+    }
+    const FlowPolicyConfig cfg {sp, trial % 2 == 0 ? Admission::Lossless : Admission::Lossy};
+    FlowLedger ledger(g), fresh(g);
+    const std::vector<NodeId> sources {0, 1}, destinations {6, 7};
+    FlowPolicy p(ledger, sources, destinations, cfg, &mask), ref(fresh, sources, destinations, cfg, &mask);
+    auto got = p.place(3, all), want = ref.place(3, all);
+    compare(p, ref, ledger, fresh, got, want);
+    p.remove(); ref.remove();
+    const auto chosen = EdgeId(random() % g->num_edges());
+    const std::vector<NodeId> from {g->edge_sources()[static_cast<std::size_t>(chosen)]};
+    const std::vector<NodeId> to {g->edge_destinations()[static_cast<std::size_t>(chosen)]};
+    const RouteDefinition route {from[0], dag_of(*g, {chosen})};
+    const auto outside = ForwardingProgram::from_routes(*g, from, to, std::span(&route, 1));
+    const FlowPolicyConfig pinned {Pinned {outside}, Admission::Lossless};
+    FlowPolicy q(ledger, from, to, pinned), q_ref(fresh, from, to, pinned);
+    (void)q.place(3); (void)q_ref.place(3);
+    discard_kept(ref);
+    got = p.place(9, all); want = ref.place(9, all);
+    compare(p, ref, ledger, fresh, got, want);
+  }
+}
+
+TEST(EpochStatic, WideCountersAndLargestLegalRouteCostAreFreshAfterRemove) {
+  constexpr Amount m = kL62 - 1;
+  const auto g = std::make_shared<const Graph>(make_graph(3, {{0, 1, 0, kL62 / 2 - 1}, {1, 2, 0, kL62 / 2}}));
+  FlowLedger ledger(g);
+  const std::vector<NodeId> source {0}, destination {2};
+  FlowPolicy p(ledger, source, destination, {ShortestPaths {}, Admission::Lossy});
+  PlacementResult r;
+  for (int call = 0; call < 5; ++call) r = p.place(m);
+  ASSERT_TRUE(r.offered); ASSERT_TRUE(r.requested);
+  EXPECT_EQ(r.offered->hi, 1U); EXPECT_EQ(r.offered->lo, static_cast<std::uint64_t>(kL62 - 5));
+  EXPECT_EQ(*r.requested, *r.offered);
+  EXPECT_EQ(p.records().front().min_route_cost, m);
+  const auto kept = r.program;
+  p.remove();
+  r = p.place(1);
+  EXPECT_EQ(r.program.get(), kept.get());
+  EXPECT_EQ(r.offered->hi, 0U); EXPECT_EQ(r.offered->lo, 1U);
+  EXPECT_EQ(p.records().front().min_route_cost, m);
+}
+
+TEST(EpochStatic, ColdListPreparationSeedsTheOwnerBeforeLaterEpochs) {
+  const auto g = epoch_graph();
+  for (bool pooled : {false, true}) for (const auto& cfg : static_configs(*g, pooled))
+    for (auto mode : {BatchMode::Ordered, BatchMode::Simultaneous}) {
+      if (mode == BatchMode::Simultaneous && cfg.admission != Admission::Lossy) continue;
+      FlowLedger ledger(g);
+      const std::vector<NodeId> sources = pooled ? std::vector<NodeId>{0, 1} : std::vector<NodeId>{0};
+      FlowPolicy p(ledger, sources, std::vector<NodeId>{5}, cfg);
+      const Action action = Replace {p, 3};
+      const auto first = apply_actions(ledger, std::span(&action, 1), mode, all).front();
+      EXPECT_EQ(detail::PolicyAccess::engine(p).kept_program.get(), first.program.get());
+      p.remove();
+      const auto repeated = apply_actions(ledger, std::span(&action, 1), mode, all).front();
+      EXPECT_EQ(repeated.program.get(), first.program.get());
+      expect_same(repeated, first, "cold-list then retained list");
+      p.remove();
+      EXPECT_EQ(p.place(3).program.get(), first.program.get());
+    }
+}
+
+TEST(EpochStatic, SuppliedCacheStatisticsFreezeAndClearKeepTheirOriginalBehavior) {
+  const auto g = std::make_shared<const Graph>(make_graph(2, {{0, 1, 4, 1}, {0, 1, 10, 1}}));
+  ShortestPathCache cache(*g);
+  {
+    FlowLedger ledger(g);
+    const std::vector<NodeId> source {0}, destination {1};
+    FlowPolicy p(ledger, source, destination, {}, nullptr, &cache);
+    const auto before = cache.stats();
+    ASSERT_EQ(before.entries, 1); ASSERT_EQ(before.misses, 1); ASSERT_EQ(before.live_values, 1);
+    cache.freeze();
+    const auto original = p.place(3).program;
+    for (int epoch = 0; epoch < 3; ++epoch) {
+      p.remove();
+      EXPECT_EQ(p.place(3).program.get(), original.get());
+      EXPECT_EQ(p.evaluate(3).program.get(), original.get());
+      const auto now = cache.stats();
+      EXPECT_EQ(now.hits, before.hits); EXPECT_EQ(now.misses, before.misses);
+      EXPECT_EQ(now.entries, before.entries); EXPECT_EQ(now.bytes, before.bytes); EXPECT_EQ(now.live_values, before.live_values);
+    }
+    EXPECT_THROW(cache.clear(), std::invalid_argument);
+    cache.thaw(); cache.clear();
+    EXPECT_EQ(cache.stats().entries, 0); EXPECT_EQ(cache.stats().bytes, 0); EXPECT_EQ(cache.stats().live_values, 1);
+    p.remove();
+    EXPECT_EQ(p.place(1).program.get(), original.get());
+    EXPECT_EQ(cache.stats().misses, before.misses);
+  }
+  EXPECT_EQ(cache.stats().live_values, 0);
+}
+
+namespace {
+void check_separate_programs(bool explicit_weights) {
+  const auto g = std::make_shared<const Graph>(make_graph(2, {{0, 1, 12, 1}, {0, 1, 12, 1}}));
+  const auto mask = g->eligibility({}, std::vector<EdgeId>{0});
+  const std::vector<NodeId> source {0}, destination {1};
+  ShortestPaths first_choice, second_choice;
+  if (explicit_weights) {
+    first_choice.allocation = second_choice.allocation = RouteAllocation::Weighted;
+    first_choice.weight_basis = second_choice.weight_basis = WeightBasis::Explicit;
+    first_choice.edge_weights = std::make_shared<const std::vector<Amount>>(std::vector<Amount>{1, 2});
+    second_choice.edge_weights = std::make_shared<const std::vector<Amount>>(std::vector<Amount>{2, 1});
+  }
+  const FlowPolicyConfig first_config {first_choice, Admission::Lossless};
+  const FlowPolicyConfig second_config {second_choice, Admission::Lossless};
+  const Eligibility* second_mask = explicit_weights ? nullptr : &mask;
+  FlowLedger ledger(g), fresh(g);
+  FlowPolicy first(ledger, source, destination, first_config);
+  FlowPolicy second(ledger, source, destination, second_config, second_mask);
+  FlowPolicy first_ref(fresh, source, destination, first_config);
+  FlowPolicy second_ref(fresh, source, destination, second_config, second_mask);
+  std::shared_ptr<const ForwardingProgram> kept_first, kept_second;
+  auto check = [&](FlowPolicy& policy, FlowPolicy& ref, std::shared_ptr<const ForwardingProgram>& kept,
+                   const std::shared_ptr<const ForwardingProgram>& other, Amount offer,
+                   const std::vector<Amount>& carried, const std::vector<EdgeId>& edges) {
+    discard_kept(ref);
+    const auto got = policy.place(offer, all), want = ref.place(offer, all);
+    compare(policy, ref, ledger, fresh, got, want);
+    ASSERT_TRUE(got.program);
+    if (!kept) kept = got.program;
+    EXPECT_EQ(got.program.get(), kept.get());
+    if (other) EXPECT_NE(got.program.get(), other.get());
+    EXPECT_EQ(detail::PolicyAccess::engine(policy).kept_program.get(), kept.get());
+    EXPECT_EQ(got.delivered, offer);
+    EXPECT_EQ(ledger.carried(), carried);
+    const auto records = policy.records();
+    ASSERT_EQ(records.size(), 1U);
+    EXPECT_EQ(records.front().delivered, offer);
+    EXPECT_EQ(records.front().min_route_cost, 1);
+    EXPECT_EQ(ascending_edges(*records.front().route), edges);
+    std::vector<std::pair<EdgeId, Amount>> edge_flows;
+    for (EdgeId e = 0; e < 2; ++e)
+      if (carried[static_cast<std::size_t>(e)]) edge_flows.emplace_back(e, carried[static_cast<std::size_t>(e)]);
+    EXPECT_EQ(records.front().edge_flows, edge_flows);
+    policy.remove(); ref.remove();
+    EXPECT_FALSE(policy.program());
+    EXPECT_EQ(detail::PolicyAccess::engine(policy).kept_program.get(), kept.get());
+    expect_same(ledger_state(ledger), ledger_state(fresh), "separate-policy removal");
+    EXPECT_TRUE(ledger.records().empty());
+  };
+  for (Amount offer : {3, 6, 9, 6}) {
+    SCOPED_TRACE(offer);
+    // Equal RR gives [(offer+1)/2, offer/2]; masking e0 gives [0, offer].
+    // For offers divisible by 3, weights [1,2] and [2,1] give [n,2n] and [2n,n].
+    check(first, first_ref, kept_first, kept_second, offer,
+          explicit_weights ? std::vector<Amount>{offer / 3, 2 * (offer / 3)}
+                           : std::vector<Amount>{(offer + 1) / 2, offer / 2}, {0, 1});
+    check(second, second_ref, kept_second, kept_first, offer,
+          explicit_weights ? std::vector<Amount>{2 * (offer / 3), offer / 3}
+                           : std::vector<Amount>{0, offer},
+          explicit_weights ? std::vector<EdgeId>{0, 1} : std::vector<EdgeId>{1});
+    ASSERT_TRUE(kept_first); ASSERT_TRUE(kept_second);
+    EXPECT_NE(kept_first.get(), kept_second.get());
+    EXPECT_FALSE(program_snapshot(kept_first.get()) == program_snapshot(kept_second.get()));
+  }
+}
+}  // namespace
+
+TEST(EpochStatic, SeparateMaskedPoliciesKeepOwnProgramsAcrossEpochs) {
+  check_separate_programs(false);
+}
+
+TEST(EpochStatic, SeparateExplicitWeightPoliciesKeepOwnProgramsAcrossEpochs) {
+  check_separate_programs(true);
+}
diff --git a/tests/cpp/fault_injection.cpp b/tests/cpp/fault_injection.cpp
new file mode 100644
index 0000000..2914262
--- /dev/null
+++ b/tests/cpp/fault_injection.cpp
@@ -0,0 +1,107 @@
+// The allocation-failure hook of the fault-injection executable (netgraph_core_fault_tests):
+// the replacement global operator new and delete (throwing and nothrow forms), the countdown and
+// the leak counter declared in fault_injection.hpp, and fails_at / fails_in_workers_at /
+// reaches_in_workers_at, which every fault test file sweeps its operations through.
+#include <gtest/gtest.h>
+
+#include <atomic>
+#include <cstddef>
+#include <cstdlib>
+#include <functional>
+#include <new>
+
+#include "fault_injection.hpp"
+
+// Allocations left before the injected failure; negative: no injection (fault_injection.hpp).
+// Shared by every thread; with g_workers_only the calling test thread's allocations do not count.
+std::atomic<long> g_countdown {-1};
+// Live allocations of the replacement operator new (a successful allocation counts up, the
+// delete of a non-null pointer counts down): the sweeps compare it before and after an operation
+// to count leaks, which ASan's leak detection (off on macOS) would not.
+std::atomic<long> g_live {0};
+static std::atomic<bool> g_workers_only {false};
+static thread_local bool t_test_thread = false;
+
+void* operator new(std::size_t n) {
+  if (g_countdown.load(std::memory_order_relaxed) >= 0 &&
+      !(t_test_thread && g_workers_only.load(std::memory_order_relaxed)) &&
+      g_countdown.fetch_sub(1, std::memory_order_relaxed) == 0) {
+    throw std::bad_alloc();
+  }
+  if (void* p = std::malloc(n == 0 ? 1 : n)) {
+    g_live.fetch_add(1, std::memory_order_relaxed);
+    return p;
+  }
+  throw std::bad_alloc();
+}
+void* operator new[](std::size_t n) { return ::operator new(n); }
+// The nothrow forms never inject: a caller that asks for memory it can do without (the temporary
+// buffer of std::stable_partition) absorbs a failure by design, so an injected one would be
+// reported as swallowed. Their allocations count as live like the others. (Without these
+// replacements, the standard library's nothrow form would call the throwing one above and catch
+// the injected std::bad_alloc.)
+void* operator new(std::size_t n, const std::nothrow_t&) noexcept {
+  void* p = std::malloc(n == 0 ? 1 : n);
+  if (p != nullptr) g_live.fetch_add(1, std::memory_order_relaxed);
+  return p;
+}
+void* operator new[](std::size_t n, const std::nothrow_t&) noexcept { return ::operator new(n, std::nothrow); }
+void operator delete(void* p) noexcept {
+  if (p != nullptr) g_live.fetch_sub(1, std::memory_order_relaxed);
+  std::free(p);
+}
+void operator delete[](void* p) noexcept { ::operator delete(p); }
+void operator delete(void* p, std::size_t) noexcept { ::operator delete(p); }
+void operator delete[](void* p, std::size_t) noexcept { ::operator delete(p); }
+void operator delete(void* p, const std::nothrow_t&) noexcept { ::operator delete(p); }
+void operator delete[](void* p, const std::nothrow_t&) noexcept { ::operator delete(p); }
+
+namespace {
+
+// Runs fn with the k-th allocation failing; returns whether it was reached, and in `failed`
+// whether fn raised std::bad_alloc. Any other exception of fn propagates, with the hook disarmed
+// first: left armed, it would fail an allocation of whatever runs next (the test framework's
+// report of that exception, a later test).
+bool run(long k, bool workers_only, const std::function<void()>& fn, bool& failed) {
+  const auto disarm = [] {
+    g_countdown = -1;
+    g_workers_only = false;
+  };
+  t_test_thread = true;
+  g_workers_only = workers_only;
+  g_countdown = k;
+  failed = false;
+  try {
+    fn();
+  } catch (const std::bad_alloc&) {
+    failed = true;
+  } catch (...) {
+    disarm();
+    throw;
+  }
+  const bool reached = g_countdown.load() < 0;
+  disarm();
+  return reached;
+}
+
+bool inject(long k, bool workers_only, const std::function<void()>& fn) {
+  bool failed = false;
+  const bool reached = run(k, workers_only, fn, failed);
+  EXPECT_EQ(failed, reached) << "a std::bad_alloc was swallowed or replaced at allocation " << k
+                             << (workers_only ? " (worker threads)" : "");
+  return failed;
+}
+
+} // namespace
+
+// Runs fn with the k-th allocation (from 0) failing; returns whether that failure happened.
+bool fails_at(long k, const std::function<void()>& fn) { return inject(k, false, fn); }
+
+bool fails_in_workers_at(long k, const std::function<void()>& fn) { return inject(k, true, fn); }
+
+bool reaches_in_workers_at(long k, const std::function<void()>& fn, bool& bad_alloc) {
+  const bool reached = run(k, true, fn, bad_alloc);
+  EXPECT_TRUE(reached || !bad_alloc) << "a std::bad_alloc that was not injected, at allocation " << k
+                                     << " (worker threads)";
+  return reached;
+}
diff --git a/tests/cpp/fault_injection.hpp b/tests/cpp/fault_injection.hpp
new file mode 100644
index 0000000..141a0ec
--- /dev/null
+++ b/tests/cpp/fault_injection.hpp
@@ -0,0 +1,175 @@
+// The allocation-failure hook of the fault-injection executable (netgraph_core_fault_tests), with
+// the state its sweeps compare (state_comparators.hpp): fault_injection.cpp replaces the global
+// operator new so that the chosen allocation throws std::bad_alloc (the nothrow form never fails
+// and does not advance the countdown; its allocations count as live like the others); every test
+// file of the executable sweeps its operations through fails_at(). The counter is shared by every thread (the
+// evaluators' workers allocate too): the k-th allocation in the process fails, whichever thread
+// makes it.
+#pragma once
+
+#include <gtest/gtest.h>
+
+#include <atomic>
+#include <functional>
+#include <memory>
+#include <string>
+#include <thread>
+
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+// Allocations left before the injected failure; negative: no injection.
+extern std::atomic<long> g_countdown;
+// Live allocations of the replacement operator new (leak accounting).
+extern std::atomic<long> g_live;
+
+// Runs fn with the k-th allocation (from 0) failing; returns whether that failure happened
+// (and expects that a reached failure propagated as std::bad_alloc).
+bool fails_at(long k, const std::function<void()>& fn);
+
+// As fails_at, counting only the allocations of threads other than the caller's (the
+// evaluators' worker threads): the k-th worker allocation fails.
+bool fails_in_workers_at(long k, const std::function<void()>& fn);
+
+// As fails_in_workers_at, for a call whose lowest-index task exception is the one raised (the
+// evaluators): the injected std::bad_alloc may lose to another task's exception, which fn
+// handles. Returns whether the k-th worker allocation was reached, and sets `bad_alloc` when fn
+// raised std::bad_alloc (which must then be the injected one).
+bool reaches_in_workers_at(long k, const std::function<void()>& fn, bool& bad_alloc);
+
+namespace netgraph::core::test {
+
+// remove() and a policy's destruction allocate nothing: after place(3), remove() takes the
+// policy's records away; after place(2), the destruction leaves them as orphans, the aggregate as
+// it was and the policy no longer bound.
+template <class Policy>
+void expect_removal_and_release_allocate_nothing(const FlowLedger& fg, std::unique_ptr<Policy>& p,
+                                                 const std::string& where) {
+  (void)p->place(3);
+  ASSERT_FALSE(fg.records().empty()) << where;  // something to remove
+  EXPECT_FALSE(fails_at(0, [&] { p->remove(); })) << where;
+  EXPECT_TRUE(fg.records().empty()) << where;
+  (void)p->place(2);
+  const LedgerState held = ledger_state(fg);
+  ASSERT_FALSE(held.records.empty()) << where;  // something to orphan
+  ASSERT_EQ(held.bound.size(), 1U) << where;
+  EXPECT_FALSE(fails_at(0, [&] { p.reset(); })) << where;
+  const LedgerState orphaned = ledger_state(fg);
+  EXPECT_EQ(orphaned.carried, held.carried) << where;
+  EXPECT_EQ(orphaned.records.size(), held.records.size()) << where;
+  EXPECT_TRUE(orphaned.bound.empty()) << where;
+  EXPECT_EQ(orphaned.orphans, held.bound) << where;
+}
+
+// What a placement sweep sets up on a fresh ledger before the call under test: the policy it
+// calls, and what must stay alive with it (third parties, a wrapper of the policy).
+struct Staged {
+  std::shared_ptr<void> keep;
+  FlowPolicy* policy {nullptr};
+};
+
+// The placement-atomicity sweep of one call. setup(ledger) stages everything before the call on a
+// fresh ledger of g (third parties, the policy and its earlier calls); call(policy) is the call
+// under test. The reference stages and calls once without a failure, then removes the policy.
+// Attempt `at` (from 0) stages afresh (the same ledger state and epoch as the reference's) and
+// makes the at-th allocation of the call fail; after the failure the ledger and the policy's epoch
+// are as before the call and the aggregate is balanced, a clean retry gives the reference's result,
+// ledger and epoch, and remove() leaves the ledger the reference's remove() left. Everything an
+// attempt allocates is freed when it ends (the reference has already grown this thread's scratch),
+// so a live allocation left after an attempt is a leak of the failed call. The sweep ends at the
+// first attempt that completes, whose result, ledger and epoch must be the reference's, or at the first
+// reported difference. Returns the failures injected.
+inline long sweep_placement(const std::shared_ptr<const Graph>& g, const std::string& where,
+                            const std::function<Staged(FlowLedger&)>& setup,
+                            const std::function<PlacementResult(FlowPolicy&)>& call) {
+  FlowLedger ref(g);
+  const Staged staged_ref = setup(ref);
+  const LedgerState initial = ledger_state(ref);
+  const Epoch initial_epoch = epoch(*staged_ref.policy);
+  const PlacementResult want = call(*staged_ref.policy);
+  const LedgerState after = ledger_state(ref);
+  const Epoch want_epoch = epoch(*staged_ref.policy);
+  staged_ref.policy->remove();
+  const LedgerState removed = ledger_state(ref);
+  long injected = 0;
+  for (long at = 0;; ++at) {
+    const std::string w = where + " allocation " + std::to_string(at);
+    const long live = g_live.load();
+    bool completed = false;
+    {
+      FlowLedger fg(g);
+      const Staged staged = setup(fg);
+      FlowPolicy& p = *staged.policy;
+      expect_same(ledger_state(fg), initial, w + " (setup)");
+      expect_same(epoch(p), initial_epoch, w + " (setup)");
+      const auto* initial_kept = detail::PolicyAccess::engine(p).kept_program.get();
+      PlacementResult got;
+      if (!fails_at(at, [&] { got = call(p); })) {
+        expect_same(got, want, w + " (no failure)");
+        expect_same(ledger_state(fg), after, w + " (no failure)");
+        expect_same(epoch(p), want_epoch, w + " (no failure)");
+        completed = true;
+      } else {
+        ++injected;
+        // Failed: nothing changed, ledger and policy.
+        expect_same(ledger_state(fg), initial, w + " (failed call)");
+        expect_same(epoch(p), initial_epoch, w + " (failed call)");
+        EXPECT_EQ(detail::PolicyAccess::engine(p).kept_program.get(), initial_kept) << w;
+        expect_balanced(fg, w + " (failed call)");
+        // A clean retry is the reference call (no poisoned per-thread scratch).
+        expect_same(call(p), want, w + " (retry)");
+        expect_same(ledger_state(fg), after, w + " (retry)");
+        expect_same(epoch(p), want_epoch, w + " (retry)");
+        expect_balanced(fg, w + " (retry)");
+        p.remove();
+        expect_same(ledger_state(fg), removed, w + " (remove)");
+      }
+    }
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    if (completed || ::testing::Test::HasFailure()) break;
+  }
+  return injected;
+}
+
+// The scratch-growth sweep. Attempt `at` (from 0) runs on a new thread, whose per-thread scratch
+// starts empty: warm_up() (a call on a small graph), then attempt(at, where), which makes the
+// at-th allocation of the swept call on a larger graph fail, checks the failed call, compares its
+// retry (or the call itself, when the failure is not reached) with a reference call made
+// beforehand without a failure, and returns whether the failure was reached; the sweep ends at the
+// first attempt that completes. Each attempt's thread frees its scratch when it ends, so a live
+// allocation left after the join is a leak of the failed call. Then, on one more new thread,
+// warm_up() and warm(), which grows the scratch to the larger graph and returns how many
+// allocations the swept call still makes: fewer than the sweep's failures, so the sweep reached
+// the growth. Returns the sweep's failures.
+inline long sweep_scratch_growth(const std::string& what, const std::function<void()>& warm_up,
+                                 const std::function<bool(long, const std::string&)>& attempt,
+                                 const std::function<long()>& warm) {
+  long failures = 0;
+  for (long at = 0;; ++at) {
+    bool failed = false;
+    const std::string w = what + " allocation " + std::to_string(at);
+    const long live = g_live.load();
+    std::thread([&] {
+      warm_up();
+      failed = attempt(at, w);
+    }).join();
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";  // the thread's scratch is gone with it
+    if (!failed) break;
+    ++failures;
+    if (::testing::Test::HasFailure() || at >= 1000) {
+      ADD_FAILURE() << what << ": stopped at allocation " << at;
+      return failures;
+    }
+  }
+  long warm_count = 0;
+  std::thread([&] {
+    warm_up();
+    warm_count = warm();
+  }).join();
+  EXPECT_GT(failures, warm_count) << what;
+  return failures;
+}
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/flow_graph_tests.cpp b/tests/cpp/flow_graph_tests.cpp
deleted file mode 100644
index 687492d..0000000
--- a/tests/cpp/flow_graph_tests.cpp
+++ /dev/null
@@ -1,312 +0,0 @@
-#include <gtest/gtest.h>
-#include "netgraph/core/flow_graph.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-TEST(FlowGraph, EmptyLedgerInitially) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  FlowIndex idx{0, 2, 0, 0};
-  auto edges = fg.get_flow_edges(idx);
-
-  EXPECT_TRUE(edges.empty());
-}
-
-TEST(FlowGraph, PlacementCreatesEntry) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  // Get shortest path
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  Flow placed = fg.place(idx, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-
-  EXPECT_GT(placed, 0.0);
-
-  auto edges = fg.get_flow_edges(idx);
-  EXPECT_FALSE(edges.empty());
-}
-
-TEST(FlowGraph, RemovalDeletesEntry) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  Flow placed = fg.place(idx, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-  EXPECT_GT(placed, 0.0);
-
-  EXPECT_FALSE(fg.get_flow_edges(idx).empty());
-
-  fg.remove(idx);
-
-  EXPECT_TRUE(fg.get_flow_edges(idx).empty());
-}
-
-TEST(FlowGraph, RemoveByClassFiltersCorrectly) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Create flows with different classes
-  FlowIndex idx1{0, 2, 10, 0};
-  FlowIndex idx2{0, 2, 20, 1};
-  FlowIndex idx3{0, 2, 10, 2};
-
-  (void)fg.place(idx1, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-  (void)fg.place(idx2, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-  (void)fg.place(idx3, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-
-  // Remove flows of class 10
-  fg.remove_by_class(10);
-
-  // idx1 and idx3 should be removed (class 10)
-  EXPECT_TRUE(fg.get_flow_edges(idx1).empty());
-  EXPECT_TRUE(fg.get_flow_edges(idx3).empty());
-
-  // idx2 should remain (class 20)
-  EXPECT_FALSE(fg.get_flow_edges(idx2).empty());
-}
-
-TEST(FlowGraph, GetFlowEdgesReturnsDeltas) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  Flow placed = fg.place(idx, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-
-  auto edges = fg.get_flow_edges(idx);
-
-  // Should have entries for edges used in the path
-  EXPECT_GT(edges.size(), 0);
-
-  // Total flow across all edges should match placed amount times path length
-  double total = 0.0;
-  for (const auto& [eid, flow] : edges) {
-    EXPECT_GE(flow, 0.0);
-    total += flow;
-  }
-  EXPECT_NEAR(total, placed * 2, 1e-9);  // Two edges in path
-}
-
-TEST(FlowGraph, GetFlowPathForLinearFlow) {
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  Flow placed = fg.place(idx, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-  EXPECT_GT(placed, 0.0);
-
-  auto path = fg.get_flow_path(idx);
-
-  // Should find a simple path with 2 edges
-  EXPECT_EQ(path.size(), 2);
-}
-
-TEST(FlowGraph, GetFlowPathForDAGReturnsEmpty) {
-  // Create a graph with two disjoint equal-cost paths: 0->1->2 and 0->3->2
-  // When flow splits proportionally across both paths, get_flow_path should
-  // return empty (since there's no single simple path)
-  std::int32_t src[4] = {0, 1, 0, 3};
-  std::int32_t dst[4] = {1, 2, 3, 2};
-  double cap[4] = {1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost[4] = {1, 1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  // Place 2.0 units - should split across both paths (1.0 each)
-  Flow placed = fg.place(idx, 0, 2, dag, 2.0, FlowPlacement::Proportional);
-  EXPECT_GT(placed, 0.0);
-
-  auto path = fg.get_flow_path(idx);
-
-  // get_flow_path should return empty when flow is split across multiple paths
-  // (it only returns a simple path if one exists)
-  EXPECT_TRUE(path.empty()) << "Expected empty path for split flow, got " << path.size() << " edges";
-}
-
-TEST(FlowGraph, CoalescesDuplicateEdgeIds) {
-  // Create graph with parallel edges
-  std::int32_t src[3] = {0, 1, 1};
-  std::int32_t dst[3] = {1, 2, 2};
-  double cap[3] = {10.0, 1.0, 1.0};
-  std::int64_t cost[3] = {1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  FlowGraph fg(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  FlowIndex idx{0, 2, 0, 0};
-  (void)fg.place(idx, 0, 2, dag, 2.0, FlowPlacement::Proportional);
-
-  auto edges = fg.get_flow_edges(idx);
-
-  // Check that no EdgeId appears more than once
-  std::set<EdgeId> seen;
-  for (const auto& [eid, flow] : edges) {
-    EXPECT_EQ(seen.count(eid), 0) << "Duplicate EdgeId " << eid;
-    seen.insert(eid);
-  }
-}
-
-TEST(FlowGraph, LedgerHistory_RemovalRestoresResidual) {
-  // edges: 0->1, 1->2 (both cap=1.0)
-  auto g = make_line_graph(3);
-  FlowGraph fg(g);
-
-  // Build DAG once
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto sp = shortest_paths(g, 0, 2, /*multipath=*/true, sel, {}, {}, {});
-  const PredDAG& dag = sp.second;
-
-  FlowIndex idx{0, 2, 42, 7};
-
-  // Two placements on same flow
-  Flow p1 = fg.place(idx, 0, 2, dag, 0.4, FlowPlacement::Proportional);
-  Flow p2 = fg.place(idx, 0, 2, dag, 0.5, FlowPlacement::Proportional);
-  ASSERT_GT(p1, 0.0);
-  ASSERT_GT(p2, 0.0);
-
-  // Remove the flow (should restore both p1 and p2 if ledger retained history)
-  fg.remove(idx);
-
-  auto cap = g.capacity_view();
-  auto res = fg.residual_view();
-  ASSERT_EQ(res.size(), static_cast<std::size_t>(g.num_edges()));
-
-  // Expect residual to be fully restored to capacity if removal undid entire history
-  for (std::size_t i = 0; i < res.size(); ++i) {
-    EXPECT_NEAR(res[i], cap[i], 1e-9) << "Residual not fully restored at edge " << i;
-  }
-}
-
-TEST(FlowGraph, LedgerMicroFlows_RemovalRestoresResidual) {
-  // Split 1.0 unit equally over many parallel edges so per-edge share is < kMinFlow.
-  const int parallel = 5000; // 1.0 / 5000 < kMinFlow (1/4096)
-  std::vector<std::int32_t> src(parallel), dst(parallel);
-  std::vector<double> cap(parallel, 1.0);
-  std::vector<std::int64_t> cost(parallel, 1);
-  for (int i = 0; i < parallel; ++i) { src[i] = 0; dst[i] = 1; }
-  auto g = StrictMultiDiGraph::from_arrays(2, src, dst, cap, cost);
-
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto sp = shortest_paths(g, 0, 1, /*multipath=*/true, sel, {}, {}, {});
-  const PredDAG& dag = sp.second;
-
-  FlowIndex idx{0, 1, 1, 1};
-
-  // Place 1.0 evenly across many parallels; per-edge contribution < kMinFlow
-  Flow placed = fg.place(idx, 0, 1, dag, 1.0, FlowPlacement::EqualBalanced);
-  ASSERT_NEAR(placed, 1.0, 1e-9);
-
-  // Ledger must record all deltas, including micro-flows smaller than kMinFlow
-  auto edges = fg.get_flow_edges(idx);
-  EXPECT_FALSE(edges.empty()) << "Ledger should record micro-deltas even when per-edge < kMinFlow";
-
-  // Removing the flow should fully restore residual capacity with no drift
-  auto capv = g.capacity_view();
-  fg.remove(idx);
-  auto res_after = fg.residual_view();
-  ASSERT_EQ(res_after.size(), static_cast<std::size_t>(g.num_edges()));
-  for (std::size_t i = 0; i < res_after.size(); ++i) {
-    EXPECT_NEAR(res_after[i], capv[i], 1e-9) << "Residual not restored at edge " << i;
-  }
-}
-
-// state_stamp() uids must be unique per reachable instance. A copy that shared
-// the source's uid could diverge by the same number of mutations and then
-// present an equal stamp over different residual content, which would let
-// FlowPolicy's SPF memo fast path serve a DAG cached for the other object.
-// Moved-from FlowGraphs remain valid and mutable, so moves must not share the
-// uid either.
-TEST(FlowGraphStamp, CopiesAndMovesGetFreshUids) {
-  auto g = make_square_graph(1);
-  FlowGraph a(g);
-  const auto uid_a = a.state_stamp().uid;
-
-  FlowGraph b(a);                       // copy ctor
-  EXPECT_NE(b.state_stamp().uid, uid_a);
-
-  FlowGraph c(g);
-  c = a;                                // copy assign
-  EXPECT_NE(c.state_stamp().uid, uid_a);
-  EXPECT_NE(c.state_stamp().uid, b.state_stamp().uid);
-
-  FlowGraph d(std::move(b));            // move ctor
-  EXPECT_NE(d.state_stamp().uid, uid_a);
-
-  FlowGraph e(g);
-  e = std::move(c);                     // move assign
-  EXPECT_NE(e.state_stamp().uid, uid_a);
-}
-
-// The end-to-end failure the uid rule prevents: two copies mutated the same
-// NUMBER of times (equal versions) but with different content must never
-// satisfy the stamp fast path. Equal-version divergence is exactly the case a
-// shared uid would get wrong.
-TEST(FlowGraphStamp, EqualVersionDivergentCopiesCompareUnequal) {
-  auto g = make_square_graph(1);  // 0->1->2 cheap, 0->3->2 expensive
-  FlowGraph a(g);
-  FlowGraph b(a);
-
-  // One mutation each (same version count), different targets.
-  PredDAG cheap = make_path_dag(g, std::array<EdgeId, 2>{0, 1});
-  PredDAG dear  = make_path_dag(g, std::array<EdgeId, 2>{2, 3});
-  FlowIndex idx{0, 2, 0, 0};
-  (void)a.place(idx, 0, 2, cheap, 0.5, FlowPlacement::Proportional);
-  (void)b.place(idx, 0, 2, dear, 0.5, FlowPlacement::Proportional);
-
-  EXPECT_FALSE(a.state_stamp() == b.state_stamp());
-}
diff --git a/tests/cpp/flow_ledger_fault_tests.cpp b/tests/cpp/flow_ledger_fault_tests.cpp
new file mode 100644
index 0000000..e15e2b0
--- /dev/null
+++ b/tests/cpp/flow_ledger_fault_tests.cpp
@@ -0,0 +1,825 @@
+// Allocation-failure atomicity of the ledger and of a one-route Pinned policy's transaction.
+// The fault-injection executable replaces the global operator new so that one chosen allocation
+// throws std::bad_alloc (fault_injection.cpp). Every operation is swept over every allocation it
+// makes: after each injected failure the ledger (aggregate, residual, every record field, bound
+// and orphaned owners, next FlowId) and the policy's epoch state (requested, +inf, delivered(),
+// and its flow's id, route cost and plan: route, members, weights) must equal their state before
+// the call, the per-thread scratch must not be poisoned (a clean retry gives the reference
+// result), and remove() must leave the state the reference's own remove() leaves (the policy's
+// records gone, their FlowIds retired). The ledger's own calls are swept the same way: reset() and
+// reset(residual) change nothing and leak nothing when they fail; a failed construction or copy
+// of a ledger, and a failed construction of a policy, build nothing and leak nothing; a move
+// changes its source only once it can no longer fail; the completing copy and move hold
+// everything the source held; remove() and a policy's destruction allocate nothing. One check
+// belongs to the flow core: its node map never allocates when it adds a node (the last test but
+// one). The first test checks the comparators of state_comparators.hpp themselves: each must
+// report a copy with any one field changed; the next two check the hook of fault_injection.cpp: it
+// reports a swallowed or a foreign std::bad_alloc, its nothrow form never fails, and any other
+// exception of a swept call leaves it disarmed.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <functional>
+#include <memory>
+#include <numeric>
+#include <new>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/node_map.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "fault_injection.hpp"
+#include "route_policy.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::LedgerAccess;
+
+namespace {
+
+// The policies on one route the sweeps run: CentralizedTE with the route as its support, and Pinned over
+// the route as a supplied split route under each kernel, weight basis and admission.
+struct Kernel {
+  std::string name;
+  Admission admission;
+  std::function<FlowPolicyConfig(const FlowLedger&, NodeId, NodeId, std::shared_ptr<const PredecessorDAG>)> config;
+};
+
+const std::vector<Kernel>& kernels() {
+  using D = std::shared_ptr<const PredecessorDAG>;
+  auto split = [](RouteAllocation placement, Admission admission, WeightBasis weights) {
+    return [=](const FlowLedger& fg, NodeId s, NodeId d, D dag) {
+      return split_route(fg, s, d, std::move(dag), placement, admission, weights);
+    };
+  };
+  static const std::vector<Kernel> all = {
+      {"global support", Admission::Lossless, [](const FlowLedger&, NodeId, NodeId, D dag) { return on_support(std::move(dag)); }},
+      {"weighted snapshot", Admission::Lossless, split(RouteAllocation::Weighted, Admission::Lossless, WeightBasis::ResidualSnapshot)},
+      {"weighted capacity", Admission::Lossless, split(RouteAllocation::Weighted, Admission::Lossless, WeightBasis::Capacity)},
+      {"equal balanced", Admission::Lossless, split(RouteAllocation::Equal, Admission::Lossless, WeightBasis::Capacity)},
+      {"equal balanced lossy", Admission::Lossy, split(RouteAllocation::Equal, Admission::Lossy, WeightBasis::Capacity)},
+      {"weighted capacity lossy", Admission::Lossy, split(RouteAllocation::Weighted, Admission::Lossy, WeightBasis::Capacity)},
+  };
+  return all;
+}
+
+struct Case {
+  std::string name;
+  std::shared_ptr<const Graph> g;
+  NodeId src;
+  NodeId dst;
+};
+
+std::vector<Case> cases() {
+  return {
+      {"edge", shared(make_graph(2, {{0, 1, 9, 1}})), 0, 1},
+      {"chain", shared(make_graph(3, {{0, 1, 9, 1}, {1, 2, 9, 1}})), 0, 2},
+      // Split, reconvergence, a parallel pair and a costlier branch.
+      {"diamond", shared(make_graph(5, {{0, 1, 7, 1}, {0, 2, 5, 1}, {1, 3, 4, 1}, {1, 3, 3, 1}, {2, 3, 9, 1},
+                                        {3, 4, 20, 1}, {0, 4, 2, 5}})),
+       0, 4},
+  };
+}
+
+// One scenario: a third party's 1-unit Equal placement on the same route, then the
+// policy's earlier calls, then the call under test.
+struct Scenario {
+  std::vector<std::optional<Amount>> before;
+  std::optional<Amount> call;
+  std::string name;
+};
+
+const std::vector<Scenario>& scenarios() {
+  static const std::vector<Scenario> all = {
+      {{}, 2, "create"},
+      {{1}, 2, "update"},
+      {{1}, std::nullopt, "update to +inf"},
+      {{}, std::nullopt, "create at +inf"},
+  };
+  return all;
+}
+
+} // namespace
+
+// The sweeps' only "nothing changed" comparisons compare every field: same_record and the
+// expect_same overloads of the ledger, a result and a policy's epoch report a copy with any one
+// field changed, and expect_balanced reports an aggregate (of carried load or of holds) that leaves
+// the sum of the records or [0, its baseline] on one edge.
+TEST(LedgerFaults, TheSweepComparatorsCompareEveryField) {
+  const auto g = shared(make_graph(3, {{0, 1, 9, 1}, {1, 2, 9, 1}, {0, 2, 4, 3}}));
+  FlowLedger fg(g);
+  auto p = std::make_unique<FlowPolicy>(fg, v({0}), v({2}), shortest_paths_config());
+  const PlacementResult r = p->place(5, OutputOptions {true, true, true});
+  const LedgerState st = ledger_state(fg);
+  ASSERT_EQ(st.records.size(), 1U);
+  const FlowRecord& rec = st.records.front();
+  ASSERT_TRUE(rec.route != nullptr);
+  ASSERT_TRUE(same_record(rec, rec));
+  const auto other_route = all_edges(*g);
+  ASSERT_FALSE(*other_route == *rec.route);
+  const std::vector<std::function<void(FlowRecord&)>> records = {
+      [](auto& x) { ++x.flow_id.second; },
+      [](auto& x) { ++x.policy_id; },
+      [](auto& x) { x.sources.push_back(1); },
+      [](auto& x) { x.destinations.push_back(1); },
+      [](auto& x) { x.admission = Admission::Lossy; },
+      [](auto& x) { x.entry_id = 0; },
+      [&](auto& x) { x.route = other_route; },
+      [](auto& x) { ++x.min_route_cost; },
+      [](auto& x) { x.offered = Counter128 {}; },
+      [](auto& x) { ++x.delivered; },
+      [](auto& x) { x.edge_flows.emplace_back(2, 1); },
+      [](auto& x) { x.edge_drops.emplace_back(2, Counter128 {}); },
+      [](auto& x) { x.edge_reservations.emplace_back(2, 1); },
+  };
+  ASSERT_EQ(rec.admission, Admission::Lossless);
+  ASSERT_FALSE(rec.offered.has_value());
+  for (std::size_t k = 0; k < records.size(); ++k) {
+    FlowRecord x = rec;
+    records[k](x);
+    EXPECT_FALSE(same_record(x, rec)) << "record field " << k;
+  }
+  // entry_id both ways (absent against present) and one entry against another.
+  ASSERT_FALSE(rec.entry_id.has_value());
+  FlowRecord with_entry = rec;
+  with_entry.entry_id = 3;
+  EXPECT_TRUE(same_record(with_entry, with_entry));
+  EXPECT_FALSE(same_record(with_entry, rec));
+  EXPECT_FALSE(same_record(rec, with_entry));
+  FlowRecord other_entry = with_entry;
+  other_entry.entry_id = 4;
+  EXPECT_FALSE(same_record(other_entry, with_entry));
+  // The uid clause of ledger_state: the records' own uid passes, another fails.
+  {
+    auto own = fg.records();
+    EXPECT_EQ(failures_of([&] { expect_uid_then_clear(own, fg.uid()); }), 0);
+    EXPECT_EQ(own.front().flow_id.first, 0U);
+    auto foreign = fg.records();
+    EXPECT_EQ(failures_of([&] { expect_uid_then_clear(foreign, fg.uid() + 1); }), 1);
+  }
+  EXPECT_EQ(failures_of([&] { expect_same(st, st, "same"); }), 0);
+  const std::vector<std::function<void(LedgerState&)>> states = {
+      [](auto& x) { ++x.carried[0]; },
+      [](auto& x) { ++x.residual[0]; },
+      [](auto& x) { ++x.reserved[0]; },
+      [](auto& x) { ++x.unreserved[0]; },
+      [](auto& x) { x.records.emplace_back(); },
+      [](auto& x) { ++x.records[0].delivered; },
+      [](auto& x) { ++x.next_id; },
+      [](auto& x) { x.bound.push_back(7); },
+      [](auto& x) { x.orphans.push_back(7); },
+  };
+  for (std::size_t k = 0; k < states.size(); ++k) {
+    LedgerState x = st;
+    states[k](x);
+    EXPECT_GT(failures_of([&] { expect_same(x, st, "state"); }), 0) << "ledger field " << k;
+  }
+  ASSERT_TRUE(r.edge_flows.has_value() && r.residual.has_value() && r.saturated_boundary_edges.has_value());
+  EXPECT_EQ(failures_of([&] { expect_same(r, r, "same"); }), 0);
+  const std::vector<std::function<void(PlacementResult&)>> results = {
+      [](auto& x) { ++x.call_delivered; },
+      [](auto& x) { x.call_undelivered = Amount {1}; },
+      [](auto& x) { ++x.delivery_delta; },
+      [](auto& x) { x.call_edge_drops.emplace_back(2, 1); },
+      [](auto& x) { ++x.call_source_drops; },
+      [](auto& x) { x.termination = Termination::NoRoute; },
+      [](auto& x) { x.routes_changed = !x.routes_changed; },
+      [](auto& x) { x.weights_changed = !x.weights_changed; },
+      [](auto& x) { x.reservations_changed = !x.reservations_changed; },
+      [](auto& x) { x.plan = TunnelPlan {}; },
+      [](auto& x) { x.requested.reset(); },
+      [](auto& x) { x.offered = Counter128 {0, 1}; },
+      [](auto& x) { ++x.admitted.lo; },
+      [](auto& x) { ++x.delivered; },
+      [](auto& x) { x.unadmitted.reset(); },
+      [](auto& x) { ++x.source_drops.lo; },
+      [](auto& x) { x.edge_drops.emplace_back(2, Counter128 {0, 1}); },
+      [](auto& x) { x.by_source.emplace_back(); },
+      [](auto& x) { ++x.by_source[0].delivered; },
+      [](auto& x) { x.total_cost = Counter128 {0, 1}; },
+      [](auto& x) { x.marginal_cost_curve = std::vector<std::pair<Cost, Amount>> {{9, 1}}; },
+      [](auto& x) { x.edge_flows->push_back(0); },
+      [](auto& x) { x.residual->push_back(0); },
+      [](auto& x) { x.saturated_boundary_edges->push_back(0); },
+      [](auto& x) { x.edge_reservations = std::vector<Amount> {0}; },
+      [](auto& x) { x.min_cut = std::vector<EdgeId> {0}; },
+  };
+  ASSERT_NE(r.call_undelivered, std::optional<Amount> {1});
+  ASSERT_NE(r.termination, Termination::NoRoute);
+  ASSERT_FALSE(r.marginal_cost_curve.has_value());  // ShortestPaths: CentralizedTE's curve only
+  ASSERT_FALSE(r.min_cut.has_value());
+  ASSERT_FALSE(r.offered.has_value() || r.total_cost.has_value());  // Lossless ShortestPaths Equal
+  ASSERT_TRUE(r.requested.has_value() && r.unadmitted.has_value() && !r.by_source.empty());
+  for (std::size_t k = 0; k < results.size(); ++k) {
+    PlacementResult x = r;
+    results[k](x);
+    EXPECT_GT(failures_of([&] { expect_same(x, r, "result"); }), 0) << "result field " << k;
+  }
+  // Program values, including absent/present both ways and separately constructed equal values.
+  ASSERT_TRUE(r.program != nullptr);
+  PlacementResult absent = r;
+  absent.program.reset();
+  EXPECT_EQ(failures_of([&] { expect_same(absent, absent, "both programs absent"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_same(absent, r, "absent program"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_same(r, absent, "present program"); }), 0);
+  FlowLedger equal_ledger(g);
+  FlowPolicy equal_policy(equal_ledger, v({0}), v({2}), shortest_paths_config());
+  const auto equal_result = equal_policy.place(5);
+  ASSERT_NE(r.program.get(), equal_result.program.get());
+  PlacementResult same_program = r;
+  same_program.program = equal_result.program;
+  EXPECT_EQ(failures_of([&] { expect_same(same_program, r, "equal program value"); }), 0);
+  FlowLedger different_ledger(g);
+  FlowPolicy different_policy(different_ledger, v({1}), v({2}), shortest_paths_config());
+  PlacementResult different_program = r;
+  different_program.program = different_policy.place(5).program;
+  EXPECT_GT(failures_of([&] { expect_same(different_program, r, "different program"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_same(r, different_program, "different program reversed"); }), 0);
+
+  // Tunnel rows: empty/populated boundaries, every field, and a wrong distribution with the same total.
+  ASSERT_TRUE(r.by_tunnel.empty());
+  PlacementResult tunnels = r;
+  tunnels.by_tunnel = {{3, 0, TunnelStatus::Up, Counter128 {0, 2}, 2, Counter128 {0, 1}},
+                       {4, 0, TunnelStatus::Up, Counter128 {0, 2}, 2, Counter128 {0, 1}}};
+  const PlacementResult same_tunnels = tunnels;
+  EXPECT_EQ(failures_of([&] { expect_same(tunnels, same_tunnels, "equal populated tunnel rows"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_same(r, tunnels, "empty tunnel rows"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_same(tunnels, r, "populated tunnel rows"); }), 0);
+  const std::vector<std::function<void(TunnelFlow&)>> tunnel_fields = {
+      [](auto& x) { ++x.entry_id; },
+      [](auto& x) { ++x.head; },
+      [](auto& x) { x.status = TunnelStatus::Failed; },
+      [](auto& x) { ++x.assigned.hi; },
+      [](auto& x) { ++x.assigned.lo; },
+      [](auto& x) { ++x.delivered; },
+      [](auto& x) { ++x.total_edge_drops.hi; },
+      [](auto& x) { ++x.total_edge_drops.lo; },
+  };
+  for (std::size_t k = 0; k < tunnel_fields.size(); ++k) {
+    PlacementResult x = tunnels;
+    tunnel_fields[k](x.by_tunnel.front());
+    EXPECT_GT(failures_of([&] { expect_same(x, tunnels, "tunnel row field"); }), 0) << k;
+  }
+  PlacementResult redistributed = tunnels;
+  --redistributed.by_tunnel[0].delivered;
+  ++redistributed.by_tunnel[1].delivered;
+  EXPECT_GT(failures_of([&] { expect_same(redistributed, tunnels, "tunnel distribution"); }), 0);
+
+  // The epoch: every field of the call state and of a flow.
+  const Epoch ep = epoch(*p);
+  ASSERT_FALSE(ep.record_groups.empty() || ep.record_groups.front().empty());
+  EXPECT_EQ(failures_of([&] { expect_same(ep, ep, "same"); }), 0);
+  const std::vector<std::function<void(Epoch&)>> epochs = {
+      [](auto& x) { ++x.requested.hi; },
+      [](auto& x) { ++x.requested.lo; },
+      [](auto& x) { ++x.offered.lo; },
+      [](auto& x) { x.infinite = !x.infinite; },
+      [](auto& x) { x.prepared = !x.prepared; },
+      [](auto& x) { ++x.delivered; },
+      [](auto& x) {
+        if (!x.curve) x.curve.emplace();
+        x.curve->emplace_back(9, 1);
+      },
+      [](auto& x) { x.program.present = !x.program.present; },
+      [](auto& x) { x.program.tunnels.emplace_back(); },
+      [](auto& x) { x.program.members.emplace_back(); },
+      [](auto& x) { x.plan = TunnelPlan {}; },
+      [](auto& x) { x.support.push_back(0); },
+      [](auto& x) { x.source_drops_by_source.emplace_back(); },
+      [](auto& x) { x.by_tunnel.emplace_back(); },
+      [](auto& x) { x.record_groups.emplace_back(); },
+      [](auto& x) { ++x.record_groups[0][0].id; },
+      [](auto& x) { ++x.record_groups[0][0].cost; },
+      [](auto& x) { x.record_groups[0][0].route.push_back(0); },
+      [](auto& x) { ++x.record_groups[0][0].entry; },
+  };
+  for (std::size_t k = 0; k < epochs.size(); ++k) {
+    Epoch x = ep;
+    epochs[k](x);
+    EXPECT_GT(failures_of([&] { expect_same(x, ep, "epoch"); }), 0) << "epoch field " << k;
+  }
+  // expect_balanced: one clause broken at a time on a copy of the ledger (its record an orphan:
+  // a ledger with a bound policy cannot be copied), through the copy's stored aggregate and
+  // record (the copy is not const, so writing through the borrowed views is defined).
+  p.reset();
+  EXPECT_EQ(failures_of([&] { expect_balanced(fg, "balanced"); }), 0);
+  const EdgeId e = rec.edge_flows.front().first;
+  const auto ei = static_cast<std::size_t>(e);
+  const std::vector<std::pair<std::string, std::function<void(FlowLedger&)>>> ledgers = {
+      {"aggregate above the sum of the records",
+       [&](FlowLedger& x) { ++const_cast<Amount&>(detail::LedgerAccess::carried(x)[ei]); }},
+      {"record and aggregate above the baseline",
+       [&](FlowLedger& x) {
+         const Amount over = detail::LedgerAccess::baseline(x)[ei] + 1 - detail::LedgerAccess::carried(x)[ei];
+         const_cast<Amount&>(detail::LedgerAccess::carried(x)[ei]) += over;
+         auto& live = const_cast<FlowRecord&>(detail::LedgerAccess::live(x, rec.flow_id.second));
+         for (auto& [edge, amount] : live.edge_flows) amount += edge == e ? over : 0;
+       }},
+      {"record and aggregate below zero",
+       [&](FlowLedger& x) {
+         const Amount under = detail::LedgerAccess::carried(x)[ei] + 1;
+         const_cast<Amount&>(detail::LedgerAccess::carried(x)[ei]) -= under;
+         auto& live = const_cast<FlowRecord&>(detail::LedgerAccess::live(x, rec.flow_id.second));
+         for (auto& [edge, amount] : live.edge_flows) amount -= edge == e ? under : 0;
+       }},
+      {"holds above the sum of the records", [&](FlowLedger& x) { ++detail::LedgerAccess::reserved_storage(x)[ei]; }},
+      {"record and holds above the reservation baseline",
+       [&](FlowLedger& x) {
+         const Amount over = detail::LedgerAccess::reservation_baseline(x)[ei] + 1;
+         detail::LedgerAccess::reserved_storage(x)[ei] += over;
+         auto& live = const_cast<FlowRecord&>(detail::LedgerAccess::live(x, rec.flow_id.second));
+         live.edge_reservations.emplace_back(e, over);
+       }},
+      {"record and holds below zero",
+       [&](FlowLedger& x) {
+         detail::LedgerAccess::reserved_storage(x)[ei] -= 1;
+         auto& live = const_cast<FlowRecord&>(detail::LedgerAccess::live(x, rec.flow_id.second));
+         live.edge_reservations.emplace_back(e, -1);
+       }},
+  };
+  for (const auto& [name, breaks] : ledgers) {
+    FlowLedger x(fg);
+    breaks(x);
+    EXPECT_GT(failures_of([&] { expect_balanced(x, name); }), 0) << name;
+  }
+}
+
+// The hook itself. fails_at's check that an injected std::bad_alloc propagated is every sweep's
+// only check of it, so it must report a failure that fn swallows and a std::bad_alloc it did not
+// inject; a call that allocates nothing reaches no failure. The nothrow operator new never fails
+// and counts as live like the throwing one, so a call that asks for memory it can do without (the
+// temporary buffer of std::stable_partition) is neither a reported failure nor a leak.
+TEST(FaultHook, ReportsSwallowedAndForeignFailuresAndNeverFailsNothrow) {
+  EXPECT_EQ(failures_of([] { EXPECT_FALSE(fails_at(0, [] {})); }), 0);
+  // Reached and swallowed: the injected failure does not reach fails_at.
+  EXPECT_EQ(failures_of([] {
+              (void)fails_at(0, [] {
+                try {
+                  ::operator delete(::operator new(8));
+                } catch (const std::bad_alloc&) {
+                }
+              });
+            }),
+            1);
+  // A std::bad_alloc of fn's own while the armed failure is never reached.
+  EXPECT_EQ(failures_of([] { (void)fails_at(1000, [] { throw std::bad_alloc(); }); }), 1);
+  // A standard algorithm's nothrow temporary buffer: whether the library takes it through the
+  // nothrow form (not a failure point) or the throwing one (a failure that propagates), the hook
+  // reports nothing, and the completing call partitions.
+  std::vector<std::vector<int>> v(6);
+  for (int i = 0; i < 6; ++i) v[static_cast<std::size_t>(i)].push_back(i);
+  const auto even = [](const std::vector<int>& x) { return x[0] % 2 == 0; };
+  EXPECT_EQ(failures_of([&] { (void)fails_at(0, [&] { (void)std::stable_partition(v.begin(), v.end(), even); }); }),
+            0);
+  (void)std::stable_partition(v.begin(), v.end(), even);
+  EXPECT_EQ(v, (std::vector<std::vector<int>> {{0}, {2}, {4}, {1}, {3}, {5}}));
+  // The nothrow form under an armed failure: it allocates, counts and leaves the countdown alone.
+  const long live = g_live.load();
+  void* q = nullptr;
+  EXPECT_EQ(failures_of([&] { EXPECT_FALSE(fails_at(0, [&] { q = ::operator new(16, std::nothrow); })); }), 0);
+  ASSERT_NE(q, nullptr);
+  EXPECT_EQ(g_live.load(), live + 1);
+  ::operator delete(q);
+  EXPECT_EQ(g_live.load(), live);
+}
+
+// A swept call that throws something other than std::bad_alloc (a validation error, a failed
+// check of the library) leaves the hook with that exception, unchanged, and disarmed: an armed
+// countdown would fail an allocation of whatever runs next (the test framework's report of the
+// exception, a later test), so one real failure would show up as unrelated ones. Each check reads
+// the countdown and disarms it in one step, so a failure here does not spread either.
+TEST(FaultHook, AnyOtherExceptionLeavesTheHookDisarmed) {
+  EXPECT_THROW((void)fails_at(1000, [] { throw std::invalid_argument("a validation error"); }), std::invalid_argument);
+  EXPECT_LT(g_countdown.exchange(-1), 0);
+  EXPECT_THROW((void)fails_in_workers_at(1000, [] { throw std::logic_error("a failed check"); }), std::logic_error);
+  EXPECT_LT(g_countdown.exchange(-1), 0);
+  bool bad_alloc = true;
+  EXPECT_THROW((void)reaches_in_workers_at(1000, [] { throw std::invalid_argument("x"); }, bad_alloc),
+               std::invalid_argument);
+  EXPECT_LT(g_countdown.exchange(-1), 0);
+  EXPECT_FALSE(bad_alloc);
+}
+
+TEST(LedgerFaults, EveryAllocationOfAPlacementFailsAtomically) {
+  for (const auto& c : cases()) {
+    const auto dag = all_edges(*c.g);
+    for (const auto& k : kernels()) {
+      for (const auto& sc : scenarios()) {
+        // A Lossy program forwarding needs a finite offer (no first-hop experiment).
+        if (k.admission == Admission::Lossy && !sc.call.has_value()) continue;
+        const std::string where = c.name + " " + k.name + " " + sc.name;
+        // A third party's 1-unit Equal placement on the same route, then the policy's
+        // earlier calls.
+        const auto setup = [&](FlowLedger& fg) {
+          auto third = std::make_shared<RoutePolicy>(fg, c.src, c.dst, split_route(fg, c.src, c.dst, dag, RouteAllocation::Equal, Admission::Lossless));
+          (void)third->place(1);
+          auto p = std::make_shared<RoutePolicy>(fg, c.src, c.dst, k.config(fg, c.src, c.dst, dag));
+          for (auto v : sc.before) (void)p->place(v);
+          FlowPolicy* policy = &p->policy();
+          return Staged {std::make_shared<std::pair<std::shared_ptr<RoutePolicy>, std::shared_ptr<RoutePolicy>>>(
+                             std::move(third), std::move(p)),
+                         policy};
+        };
+        const long injected =
+            sweep_placement(c.g, where, setup, [&](FlowPolicy& p) { return p.place(sc.call); });
+        if (::testing::Test::HasFailure()) return;
+        EXPECT_GT(injected, 2) << where;  // not vacuous: every placement allocates
+      }
+    }
+  }
+}
+
+// A failed policy construction binds nothing, changes nothing and leaks nothing (the thread's
+// scratch is already grown by a clean construction of the same policy, so every allocation the
+// failed one leaves live is a leak).
+TEST(LedgerFaults, PolicyConstructionFailsWithoutBinding) {
+  for (const auto& c : cases()) {
+    const auto dag = all_edges(*c.g);
+    for (const auto& k : kernels()) {
+      {
+        FlowLedger warm(c.g);
+        (void)RoutePolicy(warm, c.src, c.dst, k.config(warm, c.src, c.dst, dag)).place(1);
+      }
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = c.name + " construction allocation " + std::to_string(at);
+        FlowLedger fg(c.g);
+        {
+          RoutePolicy other(fg, c.src, c.dst, split_route(fg, c.src, c.dst, dag, RouteAllocation::Equal, Admission::Lossless));
+          (void)other.place(1);
+        }  // an orphan
+        const LedgerState before = ledger_state(fg);
+        std::optional<RoutePolicy> p;
+        const long live = g_live.load();
+        if (!fails_at(at, [&] { p.emplace(fg, c.src, c.dst, k.config(fg, c.src, c.dst, dag)); })) {
+          EXPECT_EQ(LedgerAccess::bound_policy_ids(fg).size(), 1U);
+          break;
+        }
+        ++injected;
+        expect_same(ledger_state(fg), before, w);
+        EXPECT_FALSE(p.has_value()) << w;
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (::testing::Test::HasFailure()) return;
+      }
+      EXPECT_GT(injected, 0) << c.name;  // not vacuous
+    }
+  }
+}
+
+// reset() and reset(residual) build the new baseline before they change anything: a failure at
+// any of their allocations leaves the orphaned records, the aggregate, the baseline and the next
+// FlowId as they were, and the completing call gives the reference reset state.
+TEST(LedgerFaults, EveryAllocationOfAResetFailsAtomically) {
+  for (const auto& c : cases()) {
+    const auto dag = all_edges(*c.g);
+    const auto with_orphan = [&] {
+      auto fg = std::make_unique<FlowLedger>(c.g);
+      // The policies are destroyed without remove(): their records are orphans, a T1 tunnel's
+      // with its holds.
+      (void)RoutePolicy(*fg, c.src, c.dst, split_route(*fg, c.src, c.dst, dag, RouteAllocation::Equal, Admission::Lossless))
+          .place(2);
+      (void)FlowPolicy(*fg, v({c.src}), v({c.dst}), FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}}).replace(0, 1);
+      return fg;
+    };
+    const std::vector<Amount> half = [&] {
+      std::vector<Amount> r(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end());
+      for (auto& x : r) x /= 2;
+      return r;
+    }();
+    for (const int variant : {0, 1, 2}) {
+      const std::string where =
+          c.name + (variant == 0 ? " reset()" : variant == 1 ? " reset(residual)" : " reset(residual, unreserved)");
+      const auto reset = [&](FlowLedger& fg) {
+        if (variant == 0) {
+          fg.reset();
+        } else if (variant == 1) {
+          fg.reset(half);
+        } else {
+          fg.reset(half, half);
+        }
+      };
+      const bool to_capacities = variant == 0;
+      const auto ref = with_orphan();
+      const LedgerState initial = ledger_state(*ref);
+      ASSERT_FALSE(initial.records.empty()) << where;  // something to clear
+      reset(*ref);
+      const LedgerState want = ledger_state(*ref);
+      EXPECT_EQ(want.residual, to_capacities ? std::vector<Amount>(c.g->edge_capacity_units().begin(),
+                                                                   c.g->edge_capacity_units().end())
+                                             : half)
+          << where;
+      EXPECT_EQ(want.unreserved, variant == 2 ? half
+                                              : std::vector<Amount>(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end()))
+          << where;
+      EXPECT_EQ(want.reserved, std::vector<Amount>(half.size(), 0)) << where;
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = where + " allocation " + std::to_string(at);
+        // The attempt's ledger ends with it (the reference above grew this thread's scratch), so
+        // an allocation left live is a leak of the failed reset.
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          const auto fg = with_orphan();
+          expect_same(ledger_state(*fg), initial, w + " (setup)");
+          failed = fails_at(at, [&] { reset(*fg); });
+          if (!failed) {
+            expect_same(ledger_state(*fg), want, w + " (no failure)");
+          } else {
+            ++injected;
+            expect_same(ledger_state(*fg), initial, w + " (failed call)");
+            // A clean retry is the reference reset.
+            reset(*fg);
+            expect_same(ledger_state(*fg), want, w + " (retry)");
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (!failed) break;
+        if (::testing::Test::HasFailure()) return;
+      }
+      EXPECT_GT(injected, 0) << where;  // not vacuous: the new baseline is allocated
+    }
+  }
+}
+
+// A failed construction of a ledger, from the capacities or from a residual, builds nothing and
+// leaks nothing; the completing one holds the expected baseline and nothing else.
+TEST(LedgerFaults, EveryAllocationOfALedgerConstructionFailsWithoutALeak) {
+  for (const auto& c : cases()) {
+    const std::vector<Amount> capacities(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end());
+    std::vector<Amount> half = capacities;
+    for (auto& x : half) x /= 2;
+    for (const int variant : {0, 1, 2}) {
+      const bool from_residual = variant != 0;
+      const std::string where = c.name + (variant == 0   ? " FlowLedger(graph)"
+                                          : variant == 1 ? " FlowLedger(graph, residual)"
+                                                         : " FlowLedger(graph, residual, unreserved)");
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = where + " allocation " + std::to_string(at);
+        std::optional<FlowLedger> fg;
+        const long live = g_live.load();
+        if (!fails_at(at, [&] {
+              if (variant == 2) {
+                fg.emplace(c.g, half, half);
+              } else if (from_residual) {
+                fg.emplace(c.g, half);
+              } else {
+                fg.emplace(c.g);
+              }
+            })) {
+          ASSERT_TRUE(fg.has_value()) << w;
+          EXPECT_EQ(fg->residual(), from_residual ? half : capacities) << w;
+          EXPECT_EQ(fg->unreserved(), variant == 2 ? half : capacities) << w;
+          EXPECT_EQ(fg->carried(), std::vector<Amount>(capacities.size(), 0)) << w;
+          EXPECT_EQ(fg->reserved(), std::vector<Amount>(capacities.size(), 0)) << w;
+          EXPECT_TRUE(fg->records().empty()) << w;
+          break;
+        }
+        ++injected;
+        EXPECT_FALSE(fg.has_value()) << w;
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (::testing::Test::HasFailure()) return;
+      }
+      // The service baseline and aggregate, and the reservation baseline when one is given (the
+      // holds and a default reservation baseline cost nothing until a hold); MSVC's maps add their own.
+      EXPECT_GE(injected, variant == 2 ? 3 : 2) << where;
+    }
+  }
+}
+
+// A failed copy of a ledger constructs nothing, leaks nothing and leaves the source as it was;
+// the completing copy holds the source's records, aggregate, baseline, next FlowId and owners,
+// and so does the moved-to ledger. A move moves every member, so it allocates nothing with libc++
+// and libstdc++ (MSVC's maps allocate a new empty node when constructed): any allocation it makes
+// comes before it changes the source.
+TEST(LedgerFaults, EveryAllocationOfALedgerCopyOrMoveFailsWithoutALeak) {
+  for (const auto& c : cases()) {
+    const auto dag = all_edges(*c.g);
+    // A baseline below the capacities: a ledger that rebuilt its baseline from them would differ.
+    std::vector<Amount> half(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end());
+    for (auto& x : half) x /= 2;
+    FlowLedger fg(c.g, half, half);
+    {
+      RoutePolicy first(fg, c.src, c.dst, split_route(fg, c.src, c.dst, dag, RouteAllocation::Equal, Admission::Lossless));
+      (void)first.place(1);
+      RoutePolicy second(fg, c.src, c.dst, split_route(fg, c.src, c.dst, dag, RouteAllocation::Weighted, Admission::Lossy));
+      (void)second.place(2);
+      FlowPolicy holds(fg, v({c.src}), v({c.dst}), FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}});
+      (void)holds.replace(0, 1);
+    }  // three orphans (one with holds): a copy may only be taken of a ledger without bound policies
+    const LedgerState source = ledger_state(fg);
+    // Both baselines (a ledger that rebuilt one from the capacities would differ).
+    const auto baseline_of = [](const FlowLedger& x) {
+      const auto b = LedgerAccess::baseline(x);
+      const auto r = LedgerAccess::reservation_baseline(x);
+      std::vector<Amount> out(b.begin(), b.end());
+      out.insert(out.end(), r.begin(), r.end());
+      return out;
+    };
+    const std::vector<Amount> source_baseline = baseline_of(fg);
+    const auto fg_uid = fg.uid();
+    ASSERT_EQ(source.records.size(), 3U) << c.name;
+    ASSERT_GT(std::accumulate(source.reserved.begin(), source.reserved.end(), Amount {0}), 0) << c.name;
+    long injected = 0;
+    for (long at = 0;; ++at) {
+      const std::string w = c.name + " allocation " + std::to_string(at);
+      std::optional<FlowLedger> copy;
+      const long live = g_live.load();
+      if (!fails_at(at, [&] { copy.emplace(fg); })) {
+        ASSERT_TRUE(copy.has_value()) << w;
+        EXPECT_NE(copy->uid(), fg.uid()) << w;
+        expect_same(ledger_state(*copy), source, w + " (copy)");
+        EXPECT_EQ(baseline_of(*copy), source_baseline) << w << " (copy)";
+        break;
+      }
+      ++injected;
+      EXPECT_FALSE(copy.has_value()) << w;
+      EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+      expect_same(ledger_state(fg), source, w + " (source)");
+      if (::testing::Test::HasFailure()) return;
+    }
+    EXPECT_GT(injected, 2) << c.name;  // not vacuous: the baseline, the aggregate and the records
+    for (long at = 0;; ++at) {
+      const std::string w = c.name + " move, allocation " + std::to_string(at);
+      std::optional<FlowLedger> moved;
+      const long live = g_live.load();
+      if (!fails_at(at, [&] { moved.emplace(std::move(fg)); })) {
+        ASSERT_TRUE(moved.has_value()) << w;
+        EXPECT_EQ(moved->uid(), fg_uid) << w;
+        EXPECT_THROW((void)fg.records(), std::logic_error) << w;  // a moved-from ledger is unusable
+        // Everything the source held: the records, the aggregate, the baseline, the next FlowId
+        // and the owners (the uid is kept, so the records' FlowIds compare as they are).
+        expect_same(ledger_state(*moved), source, w + " (moved)");
+        EXPECT_EQ(baseline_of(*moved), source_baseline) << w << " (moved)";
+        moved->reset();  // the moved ledger works
+        break;
+      }
+      EXPECT_FALSE(moved.has_value()) << w;
+      EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+      expect_same(ledger_state(fg), source, w + " (source)");
+      if (::testing::Test::HasFailure()) return;
+    }
+  }
+}
+
+// The per-thread scratch of the plan builders and of the commit grows with the graph. Each
+// attempt runs on a new thread (its scratch empty) that first serves a 3-node graph, then the
+// swept call on a larger one, so every allocation of that call fails once while its scratch grows
+// from the small size; the failed call changes nothing, and a clean retry on the same graph (or
+// the call itself, once no failure is reached) and then a placement give the reference's ledger,
+// epoch and result (ASan/UBSan builds report any access outside a partly grown array). The same
+// call on a new thread whose scratch has first grown to the large graph allocates less: the sweep
+// reached the growth.
+TEST(LedgerFaults, ScratchGrowthFailureLeavesNothingHalfGrown) {
+  const auto small = chain_graph(3, 5);
+  const auto small_dag = all_edges(*small);
+  const auto large = chain_graph(3000, 5);
+  const auto dag = all_edges(*large);
+  const std::int32_t n = large->num_nodes();
+  const auto policy = [&](FlowLedger& fg) {
+    return RoutePolicy(fg, 0, n - 1, split_route(fg, 0, n - 1, dag, RouteAllocation::Equal, Admission::Lossless));
+  };
+  // The reference, without a failure: the empty ledger, the ledger and epoch right after the
+  // construction, and the result, ledger and epoch of place(2).
+  LedgerState fresh;
+  LedgerState built;
+  Epoch built_epoch;
+  PlacementResult want;
+  LedgerState want_state;
+  Epoch want_epoch;
+  {
+    FlowLedger fg(large);
+    fresh = ledger_state(fg);
+    RoutePolicy p = policy(fg);
+    built = ledger_state(fg);
+    built_epoch = epoch(p.policy());
+    want = p.place(2);
+    want_state = ledger_state(fg);
+    want_epoch = epoch(p.policy());
+  }
+  ASSERT_EQ(want.call_delivered, 2);  // the whole chain carries the request: the comparison is not of zeros
+  ASSERT_EQ(want_state.records.size(), 1U);
+  // Construction (the route plan's per-node scratch) and a placement (the commit's per-edge
+  // scratch and the kernels' buffers) on the small graph.
+  const auto warm_up = [&] {
+    FlowLedger fg(small);
+    RoutePolicy p(fg, 0, 2, split_route(fg, 0, 2, small_dag, RouteAllocation::Equal, Admission::Lossless));
+    EXPECT_EQ(p.place(2).call_delivered, 2);
+  };
+  sweep_scratch_growth(
+      "construction", warm_up,
+      [&](long at, const std::string& w) {
+        FlowLedger fg(large);
+        std::optional<RoutePolicy> p;
+        const bool failed = fails_at(at, [&] { p.emplace(policy(fg)); });
+        if (failed) {
+          EXPECT_FALSE(p.has_value()) << w;
+          expect_same(ledger_state(fg), fresh, w);  // nothing bound
+          p.emplace(policy(fg));
+        }
+        expect_same(ledger_state(fg), built, w);
+        expect_same(epoch(p->policy()), built_epoch, w);
+        expect_same(p->place(2), want, w);
+        expect_same(ledger_state(fg), want_state, w);
+        expect_same(epoch(p->policy()), want_epoch, w);
+        expect_balanced(fg, w);
+        return failed;
+      },
+      [&] {
+        FlowLedger fg(large);
+        std::optional<RoutePolicy> p(policy(fg));
+        (void)p->place(2);  // the scratch grows to the large graph
+        p->remove();
+        p.reset();
+        long warm = 0;
+        while (fails_at(warm, [&] { p.emplace(policy(fg)); })) ++warm;
+        return warm;
+      });
+  sweep_scratch_growth(
+      "placement", warm_up,
+      [&](long at, const std::string& w) {
+        FlowLedger fg(large);
+        RoutePolicy p = policy(fg);
+        const LedgerState before = ledger_state(fg);
+        const Epoch before_epoch = epoch(p.policy());
+        PlacementResult got;
+        const bool failed = fails_at(at, [&] { got = p.place(2); });
+        if (failed) {
+          expect_same(ledger_state(fg), before, w);
+          expect_same(epoch(p.policy()), before_epoch, w);
+          got = p.place(2);
+        }
+        expect_same(got, want, w);
+        expect_same(ledger_state(fg), want_state, w);
+        expect_same(epoch(p.policy()), want_epoch, w);
+        expect_balanced(fg, w);
+        return failed;
+      },
+      [&] {
+        FlowLedger fg(large);
+        RoutePolicy p = policy(fg);
+        (void)p.place(2);  // the scratch grows to the large graph
+        p.remove();
+        long warm = 0;
+        while (fails_at(warm, [&] { (void)p.place(2); })) ++warm;
+        return warm;
+      });
+}
+
+// The flow core's NodeMap::add runs once per edge endpoint in its subset solve. reset() sizes both
+// of its arrays, so add() never allocates and is noexcept: it stays a few inlined instructions (an
+// out-of-line call there made the solve's timing switch between two levels from one build to the
+// next).
+static_assert(noexcept(std::declval<detail::NodeMap&>().add(NodeId {0})));
+
+TEST(LedgerFaults, NodeMapAddNeverAllocates) {
+  auto& node_map = detail::NodeMap::local();
+  for (std::size_t n : {std::size_t {10}, std::size_t {5000}, std::size_t {300}}) {
+    node_map.reset(n);
+    EXPECT_FALSE(fails_at(0, [&] {
+      for (std::size_t v = n; v-- > 0;) (void)node_map.add(static_cast<NodeId>(v));
+      for (std::size_t v = 0; v < n; ++v) (void)node_map.add(static_cast<NodeId>(v));
+    }));
+    ASSERT_EQ(node_map.size(), n);
+    EXPECT_EQ(node_map.of(static_cast<NodeId>(n - 1)), 0);  // first-touch order
+    EXPECT_EQ(node_map.of(0), static_cast<std::int32_t>(n - 1));
+  }
+  node_map.reset(0);
+}
+
+TEST(LedgerFaults, RemovalAndReleaseNeverAllocate) {
+  for (const auto& c : cases()) {
+    const auto dag = all_edges(*c.g);
+    for (const auto& k : kernels()) {
+      FlowLedger fg(c.g);
+      auto p = std::make_unique<RoutePolicy>(fg, c.src, c.dst, k.config(fg, c.src, c.dst, dag));
+      expect_removal_and_release_allocate_nothing(fg, p, c.name + " " + k.name);
+    }
+  }
+}
+
+TEST(LedgerFaults, PlacementSweepRejectsAPartialCommit) {
+  const auto g = shared(make_graph(3, {{0, 1, 10, 1}, {1, 2, 10, 1}}));
+  const auto setup = [](FlowLedger& fg) {
+    auto p = std::make_shared<FlowPolicy>(fg, std::vector<NodeId> {0}, std::vector<NodeId> {2}, shortest_paths_config());
+    return Staged {p, p.get()};
+  };
+  long reached = 0;
+  EXPECT_EQ(failures_of([&] {
+    reached = sweep_placement(g, "one call", setup, [](FlowPolicy& p) { return p.place(2); });
+  }), 0);
+  EXPECT_GT(reached, 0);
+  EXPECT_GT(failures_of([&] {
+    (void)sweep_placement(g, "partial commit", setup, [](FlowPolicy& p) {
+      (void)p.place(1);
+      return p.place(1);
+    });
+  }), 0);
+}
diff --git a/tests/cpp/flow_ledger_tests.cpp b/tests/cpp/flow_ledger_tests.cpp
new file mode 100644
index 0000000..1715c13
--- /dev/null
+++ b/tests/cpp/flow_ledger_tests.cpp
@@ -0,0 +1,1598 @@
+// The integer ledger FlowLedger: the baseline, snapshots, FlowIds and the identity limits,
+// saturated_boundary_edges, and every row and transition of the lifetime table, driven through a policy on one route (CentralizedTE
+// with the route as its support, or Pinned over it as a supplied split route: test::RoutePolicy,
+// route_policy.hpp); the 128-bit counters of the records;
+// and the commit rule itself (each edge published once, the multi-owner model, the fresh-record
+// path, the batch exchange of several owners), driven through detail::LedgerAccess directly.
+//
+// | State             | place                         | remove()           | destroyed  | reset    | copy     |
+// | bound, no flows   | place(0) no-op; positive      | resets the epoch   | none       | rejected | rejected |
+// |                   | creates (no route: nothing)   |                    |            |          |          |
+// | bound, flows      | adds or replaces              | reverts, retires   | orphaned   | rejected | rejected |
+// | orphaned records  | n/a                           | n/a                | n/a        | clears   | copied   |
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+#include <typeinfo>
+#include <vector>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/uid.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "route_policy.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::LedgerAccess;
+using netgraph::core::Termination;
+
+namespace {
+
+std::vector<Amount> alloc_in(const FlowLedger& fg) { return to_input(*fg.graph(), fg.carried()); }
+
+// What fn raises: the message when the exception's dynamic type is exactly std::logic_error (the
+// ledger's refusals of a moved-from ledger and of a malformed commit), or a description of anything
+// else (std::invalid_argument and the other standard errors derived from std::logic_error are other
+// checks' refusals and must not pass for these).
+std::string logic_error_of(const std::function<void()>& fn) {
+  try {
+    fn();
+  } catch (const std::exception& e) {
+    if (typeid(e) == typeid(std::logic_error)) return e.what();
+    return std::string("another exception type (") + typeid(e).name() + "): " + e.what();
+  } catch (...) {
+    return "an exception not derived from std::exception";
+  }
+  return "no exception";
+}
+
+} // namespace
+
+TEST(FlowLedger, BaselineValidationAndSnapshots) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  EXPECT_THROW(FlowLedger(g, std::vector<Amount> {6}), std::invalid_argument);
+  EXPECT_THROW(FlowLedger(g, std::vector<Amount> {-1}), std::invalid_argument);
+  EXPECT_THROW(FlowLedger(g, std::vector<Amount> {1, 1}), std::invalid_argument);
+  EXPECT_EQ(error_of([] { FlowLedger fg(nullptr); }), "FlowLedger: graph is null");
+  EXPECT_EQ(error_of([] { FlowLedger fg(nullptr, std::vector<Amount> {}); }), "FlowLedger: graph is null");
+  FlowLedger fg(g, std::vector<Amount> {3});
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{3}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{0}));
+  EXPECT_EQ(std::vector<Amount>(fg.edge_capacity_units().begin(), fg.edge_capacity_units().end()), (std::vector<Amount>{5}));
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(fg.graph().get(), g.get());
+  FlowLedger other(g);
+  EXPECT_NE(fg.uid(), other.uid());
+  EXPECT_EQ(other.residual(), (std::vector<Amount>{5}));  // no baseline: the capacities
+  // Either constructor shares the ownership of the graph: it lives while the ledger does.
+  for (const bool with_baseline : {false, true}) {
+    auto owned = shared(make_graph(2, {{0, 1, 5, 1}}));
+    const std::weak_ptr<const Graph> watch = owned;
+    const FlowLedger held = with_baseline ? FlowLedger(owned, std::vector<Amount> {3}) : FlowLedger(owned);
+    owned.reset();
+    EXPECT_FALSE(watch.expired()) << with_baseline;
+    EXPECT_EQ(held.graph()->num_edges(), 1) << with_baseline;
+  }
+}
+
+// A baseline with one or several defects (one error, from the shared edge-amount check): its length
+// before any entry, then its first entry outside [0, capacity] in EdgeId order, at construction
+// and at reset; the immutable baseline is checked before bound state. A rejected reset changes
+// nothing (records, allocation, baseline, the next FlowId).
+TEST(FlowLedger, BaselineDefectsReportTheFirstInOrder) {
+  const auto g = shared(edge_amount_graph());
+  for (const auto& c : edge_amount_defects()) {
+    EXPECT_EQ(error_of([&] { FlowLedger fg(g, c.amounts); }), "service_baseline" + c.error);
+  }
+  FlowLedger fg(g);
+  {
+    RoutePolicy q(fg, 0, 3, split_route(fg, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+    ASSERT_EQ(q.place(1).call_delivered, 1);
+    for (const auto& c : edge_amount_defects()) {
+      EXPECT_EQ(error_of([&] { fg.reset(c.amounts); }), "service_baseline" + c.error);
+    }
+  }  // destroyed without remove(): the record stays as an orphan
+  const auto records = fg.records();
+  const auto carried = fg.carried();
+  const auto residual = fg.residual();
+  ASSERT_EQ(records.size(), 1U);
+  for (const auto& c : edge_amount_defects()) {
+    EXPECT_EQ(error_of([&] { fg.reset(c.amounts); }), "service_baseline" + c.error);
+    ASSERT_EQ(fg.records().size(), 1U);
+    EXPECT_EQ(fg.records()[0].flow_id, records[0].flow_id);
+    EXPECT_EQ(fg.carried(), carried);
+    EXPECT_EQ(fg.residual(), residual);
+    EXPECT_EQ(LedgerAccess::next_record_counter(fg), 1);
+  }
+  fg.reset(edge_amounts_at_the_bounds());
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(fg.residual(), edge_amounts_at_the_bounds());
+  fg.reset();  // no baseline: back to the capacities
+  EXPECT_EQ(fg.residual(), vec(g->edge_capacity_units()));
+}
+
+TEST(FlowLedger, BoundNoFlowsRow) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+  // place(0): a no-op that creates nothing.
+  auto r = p.place(0);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_FALSE(r.routes_changed);
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 0);
+  // reset and copy rejected while a policy is bound; move rejected too.
+  EXPECT_EQ(error_of([&] { fg.reset(); }), "FlowLedger.reset is rejected while a policy is bound (1 bound)");
+  EXPECT_EQ(error_of([&] { FlowLedger copy(fg); }), "FlowLedger: a ledger with bound policies cannot be copied");
+  EXPECT_EQ(error_of([&] { FlowLedger moved(std::move(fg)); }),
+            "FlowLedger: a ledger with bound policies cannot be moved");
+  // remove() with no flows and no request: nothing to revert, the epoch stays empty (the reset of a
+  // recorded request without flows: NoRouteCallsRecordTheEpochState).
+  p.remove();
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_FALSE(p.infinite());
+  EXPECT_TRUE(p.requested().is_zero());
+  // A positive request creates the flow (new id), routes_changed true.
+  r = p.place(2);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_TRUE(r.routes_changed);
+  ASSERT_TRUE(p.flow_id().has_value());
+  EXPECT_EQ(p.flow_id()->second, 0);
+}
+
+TEST(FlowLedger, NoRouteCreatesNothing) {
+  // A support whose only walk is excluded by the Eligibility: the roster is empty.
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  auto el = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {0}));
+  RoutePolicy p(fg, 0, 1, on_support(all_edges(*g)), el);
+  EXPECT_TRUE(detail::PolicyAccess::engine(p.policy()).reachable_sources.empty());
+  auto r = p.place(3);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  EXPECT_EQ(r.call_delivered, 0);
+  ASSERT_TRUE(r.call_undelivered.has_value());
+  EXPECT_EQ(*r.call_undelivered, 3);
+  EXPECT_FALSE(r.routes_changed);
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 0);
+  // A route without any walk: a supplied split route is rejected; as a support it leaves the
+  // roster empty.
+  auto g2 = shared(make_graph(3, {{0, 1, 5, 1}, {2, 1, 5, 1}}));
+  FlowLedger fg2(g2);
+  EXPECT_EQ(error_of([&] {
+              RoutePolicy bad(fg2, 0, 2, split_route(fg2, 0, 2, all_edges(*g2), RouteAllocation::Equal, Admission::Lossless));
+            }),
+            "routes[0]: no walk from head 0 to a destination");
+  RoutePolicy none(fg2, 0, 2, on_support(all_edges(*g2)));
+  EXPECT_TRUE(detail::PolicyAccess::engine(none.policy()).reachable_sources.empty());
+  EXPECT_EQ(none.place(1).termination, Termination::NoRoute);
+}
+
+TEST(FlowLedger, BoundWithFlowsRowAndEpochs) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+  EXPECT_EQ(p.place(2).call_delivered, 2);
+  // Adds: the requested total grows within the epoch.
+  auto r = p.place(std::nullopt);
+  EXPECT_EQ(r.call_delivered, 3);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_FALSE(r.call_undelivered.has_value());
+  EXPECT_TRUE(p.infinite());
+  // A finite request after +inf is rejected within the epoch, place(0) included (validation
+  // precedes the zero shortcut); the requested total, the +inf flag, the flow and the
+  // allocations are unchanged.
+  const Counter128 requested = p.requested();
+  const auto id = p.flow_id();
+  EXPECT_NE(error_of([&] { (void)p.place(1); }).find("after infinite placement"), std::string::npos);
+  EXPECT_NE(error_of([&] { (void)p.place(0); }).find("after infinite placement"), std::string::npos);
+  EXPECT_EQ(p.requested(), requested);
+  EXPECT_TRUE(p.infinite());
+  EXPECT_EQ(p.flow_id(), id);
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{5}));
+  // A rejected reset, copy or move of a ledger holding a record leaves the ledger as it was (the
+  // record, the allocations and the binding): remove() below still reverts the flow.
+  const LedgerState held = ledger_state(fg);
+  EXPECT_EQ(error_of([&] { fg.reset(); }), "FlowLedger.reset is rejected while a policy is bound (1 bound)");
+  EXPECT_EQ(error_of([&] { FlowLedger copy(fg); }), "FlowLedger: a ledger with bound policies cannot be copied");
+  EXPECT_EQ(error_of([&] { FlowLedger moved(std::move(fg)); }),
+            "FlowLedger: a ledger with bound policies cannot be moved");
+  expect_same(ledger_state(fg), held, "the rejected reset, copy and move");
+  EXPECT_EQ(fg.records().at(0).flow_id, *p.flow_id());
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{5}));
+  // remove(): allocations reverted, record gone, id retired.
+  const auto old = *p.flow_id();
+  p.remove();
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{0}));
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(error_of([&] { (void)fg.record(old); }),
+            "FlowId (" + std::to_string(old.first) + ", " + std::to_string(old.second) + ") is retired or unknown");
+  // place(+inf); remove(); place(1) is accepted: a new epoch with a new id.
+  r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 1);
+  EXPECT_TRUE(r.routes_changed);
+  EXPECT_EQ(p.flow_id()->second, 1);
+  p.remove();  // the epoch resets: the request of 1 is gone
+  EXPECT_TRUE(p.requested().is_zero());
+  EXPECT_FALSE(p.infinite());
+  p.remove();  // again, with no flow: nothing changes
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_TRUE(p.requested().is_zero());
+  EXPECT_FALSE(p.infinite());
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 2);
+}
+
+TEST(FlowLedger, OrphanedRecordsResetAndCopy) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  auto p = std::make_unique<RoutePolicy>(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+  {
+    RoutePolicy q(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+    EXPECT_EQ(q.place(2).call_delivered, 2);
+  }  // destroyed without remove(): the record stays as an orphan
+  ASSERT_EQ(fg.records().size(), 1u);
+  EXPECT_EQ(fg.records()[0].delivered, 2);
+  EXPECT_EQ(LedgerAccess::orphan_policy_ids(fg), (std::vector<std::int64_t>{1}));
+  EXPECT_EQ(LedgerAccess::bound_policy_ids(fg), (std::vector<std::int64_t>{0}));
+  // Another policy sees the orphan's allocation (it is never changed again).
+  EXPECT_EQ(p->place(5).call_delivered, 3);
+  EXPECT_NE(error_of([&] { fg.reset(); }).find("bound"), std::string::npos);
+  p->remove();
+  p.reset();  // destroyed: nothing bound
+  // Copy of an unbound ledger: new uid, same ids under the new uid.
+  FlowLedger c(fg);
+  EXPECT_NE(c.uid(), fg.uid());
+  ASSERT_EQ(c.records().size(), 1u);
+  EXPECT_EQ(c.records()[0].flow_id, (FlowId {c.uid(), 0}));
+  EXPECT_EQ(c.records()[0].delivered, 2);
+  EXPECT_EQ(c.carried(), fg.carried());
+  // reset: orphans and their allocations cleared, ids retired (never reused), new baseline.
+  fg.reset(std::vector<Amount> {4});
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{4}));
+  EXPECT_TRUE(LedgerAccess::orphan_policy_ids(fg).empty());
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 2);
+  RoutePolicy r(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+  EXPECT_EQ(r.place(9).call_delivered, 4);
+  EXPECT_EQ(r.flow_id()->second, 2);
+  // The copy is independent of the original.
+  EXPECT_EQ(c.records()[0].delivered, 2);
+}
+
+// The copy and the move constructors carry everything the source holds: the baseline, the
+// aggregate, every record field, the next FlowId and the owners (the orphaned ones and the id the
+// next policy gets). The source holds values a new or reset ledger would not have, so a member
+// left behind shows: a baseline below the capacities, a retired FlowId (the next FlowId is past
+// every live one), a Lossy record with an offer and drops beside a Lossless one, and an orphaned
+// owner without records. The copy has a new uid and leaves its source as it was; the move keeps
+// the uid and leaves its source unusable.
+TEST(FlowLedger, CopyAndMoveCarryTheWholeLedger) {
+  auto g = shared(make_graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 1, 1}, {2, 3, 10, 1}}));
+  const auto inv = id_of_input(*g);
+  std::vector<Amount> baseline(4);
+  const Amount by_input[4] = {9, 8, 1, 9};
+  for (std::size_t i = 0; i < 4; ++i) baseline[static_cast<std::size_t>(inv[i])] = by_input[i];
+  // A reservation baseline below the capacities: 7, 7, 1, 7 by input.
+  std::vector<Amount> reservation(4);
+  const Amount reserve_by_input[4] = {7, 7, 1, 7};
+  for (std::size_t i = 0; i < 4; ++i) reservation[static_cast<std::size_t>(inv[i])] = reserve_by_input[i];
+  FlowLedger fg(g, baseline, reservation);
+  {
+    RoutePolicy lossy(fg, 0, 3, split_route(fg, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+    (void)lossy.place(10);  // owner 0, FlowId 0: delivers 6, drops 4 on the 1 -> 3 edge
+    RoutePolicy removed(fg, 0, 3, on_support(all_edges(*g)));
+    (void)removed.place(1);  // owner 1, FlowId 1, retired by remove()
+    removed.remove();
+    RoutePolicy lossless(fg, 0, 3, on_support(all_edges(*g)));
+    (void)lossless.place(2);  // owner 2, FlowId 2
+    // owner 3, FlowId 3: one T1 tunnel over 0 -> 2 -> 3 holding 5 (the request filters out the
+    // 1-unit link 1 -> 3), carrying nothing.
+    FlowPolicy holds(fg, v({0}), v({3}), FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}});
+    (void)holds.replace(0, 5);
+  }  // three orphaned owners with three records (owner 1 removed its record: forgotten); a copy or
+     // a move needs a ledger without bound policies
+  const LedgerState source = ledger_state(fg);
+  const std::vector<Amount> source_baseline = vec(LedgerAccess::baseline(fg));
+  const std::vector<Amount> source_reservation = vec(LedgerAccess::reservation_baseline(fg));
+  // The source is what the comment above says, so that each part below can differ.
+  ASSERT_EQ(source.records.size(), 3u);
+  EXPECT_EQ(source.records[2].edge_reservations, (std::vector<std::pair<EdgeId, Amount>> {{inv[1], 5}, {inv[3], 5}}));
+  EXPECT_EQ(source.reserved[static_cast<std::size_t>(inv[1])], 5);
+  EXPECT_EQ(source_reservation, reservation);
+  EXPECT_TRUE(source.records[0].offered.has_value());
+  EXPECT_EQ(source.records[0].delivered, 6);
+  EXPECT_EQ(source.records[0].edge_drops, (std::vector<std::pair<EdgeId, Counter128>>{{inv[2], Counter128 {0, 4}}}));
+  EXPECT_FALSE(source.records[1].offered.has_value());
+  EXPECT_EQ(source.records[1].flow_id.second, 2);
+  EXPECT_EQ(source.next_id, 4);
+  EXPECT_TRUE(source.bound.empty());
+  EXPECT_EQ(source.orphans, (std::vector<std::int64_t>{0, 2, 3}));
+  EXPECT_NE(source_baseline, vec(g->edge_capacity_units()));
+  EXPECT_NE(source.carried, std::vector<Amount>(4, 0));
+
+  // Everything the source held (both baselines and both projections), then the next policy: it
+  // gets the next owner id (4) and the next FlowId.
+  auto expect_whole = [&](FlowLedger& x, const std::string& what) {
+    expect_same(ledger_state(x), source, what);
+    EXPECT_EQ(vec(LedgerAccess::baseline(x)), source_baseline) << what;
+    EXPECT_EQ(vec(LedgerAccess::reservation_baseline(x)), source_reservation) << what;
+    RoutePolicy next(x, 0, 3, on_support(all_edges(*g)));
+    EXPECT_EQ(next.place(1).call_delivered, 1) << what;
+    ASSERT_TRUE(next.flow_id().has_value()) << what;
+    EXPECT_EQ(next.flow_id()->second, source.next_id) << what;
+    EXPECT_EQ(x.record(*next.flow_id()).policy_id, 4) << what;
+    EXPECT_EQ(LedgerAccess::bound_policy_ids(x), (std::vector<std::int64_t>{4})) << what;
+    next.remove();
+  };
+
+  FlowLedger copy(fg);
+  EXPECT_NE(copy.uid(), fg.uid());
+  expect_same(ledger_state(fg), source, "the source after the copy");
+  expect_whole(copy, "the copy");
+  expect_same(ledger_state(fg), source, "the source after a placement on the copy");
+
+  const auto uid = fg.uid();
+  FlowLedger moved(std::move(fg));
+  EXPECT_EQ(moved.uid(), uid);
+  expect_whole(moved, "the move");
+  // Every call on the moved-from ledger raises the moved-from refusal (the copy and the move of
+  // it included), never a result or another check's error.
+  // NOLINTBEGIN(bugprone-use-after-move): the documented moved-from state.
+  const FlowId some {uid, 0};
+  const std::vector<NodeId> sources {0};
+  const std::vector<Amount> baseline_again(4, 1);
+  const std::vector<std::pair<std::string, std::function<void()>>> calls = {
+      {"uid", [&] { (void)fg.uid(); }},
+      {"graph", [&] { (void)fg.graph(); }},
+      {"edge_capacity_units", [&] { (void)fg.edge_capacity_units(); }},
+      {"residual", [&] { (void)fg.residual(); }},
+      {"carried", [&] { (void)fg.carried(); }},
+      {"reserved", [&] { (void)fg.reserved(); }},
+      {"unreserved", [&] { (void)fg.unreserved(); }},
+      {"records", [&] { (void)fg.records(); }},
+      {"record", [&] { (void)fg.record(some); }},
+      {"bottleneck", [&] { (void)fg.saturated_boundary_edges(sources); }},
+      {"reset", [&] { fg.reset(); }},
+      {"reset(residual)", [&] { fg.reset(baseline_again); }},
+      {"reset(residual, unreserved)", [&] { fg.reset(baseline_again, baseline_again); }},
+      {"copy", [&] { FlowLedger again(fg); }},
+      {"move", [&] { FlowLedger again(std::move(fg)); }},
+      {"bind", [&] { (void)LedgerAccess::bind(fg); }},
+  };
+  for (const auto& [name, call] : calls) {
+    EXPECT_EQ(logic_error_of(call), "FlowLedger: a moved-from ledger is empty and unusable") << name;
+  }
+  // NOLINTEND(bugprone-use-after-move)
+}
+
+// The commit checks holds against the reservation baseline exactly as it checks carried load
+// against the service baseline, in its own pass after the carried one, and publishes both or
+// neither: a hold above R0, a negative hold, and a draft whose load is infeasible (its holds
+// fine) each throw with nothing changed; the exchange releases the owner's old holds before the
+// check; detach releases both projections.
+TEST(FlowLedger, HoldsAreCheckedAgainstTheReservationBaseline) {
+  auto g = shared(make_graph(2, {{0, 1, 10, 1}}));
+  FlowLedger fg(g, std::vector<Amount> {10}, std::vector<Amount> {6});
+  const auto owner = LedgerAccess::bind(fg);
+  auto draft = [&](Amount load, Amount hold) {
+    detail::RecordDraft d;
+    d.record.sources = {0};
+    d.record.destinations = {1};
+    d.record.route = all_edges(*g);
+    if (load != 0) d.record.edge_flows = {{0, load}};
+    if (hold != 0) d.record.edge_reservations = {{0, hold}};
+    return d;
+  };
+  const LedgerState empty = ledger_state(fg);
+  for (const auto& [load, hold, text] :
+       {std::tuple {Amount {2}, Amount {7}, std::string("ledger: infeasible reservation on edge 0 (7 of 6)")},
+        std::tuple {Amount {2}, Amount {-1}, std::string("ledger: a negative hold in a commit")},
+        std::tuple {Amount {11}, Amount {6}, std::string("ledger: infeasible commit on edge 0 (11 of 10)")}}) {
+    std::vector<detail::RecordDraft> ds {draft(load, hold)};
+    EXPECT_EQ(logic_error_of([&] { (void)LedgerAccess::commit(fg, owner, ds); }), text);
+    expect_same(ledger_state(fg), empty, text);
+  }
+  std::vector<detail::RecordDraft> ds {draft(2, 6)};
+  const auto ids = LedgerAccess::commit(fg, owner, ds);
+  EXPECT_EQ(fg.reserved(), (std::vector<Amount> {6}));
+  EXPECT_EQ(fg.unreserved(), (std::vector<Amount> {0}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {2}));
+  // An exchange retires the old record and its hold before checking the new one's: 6 again fits.
+  std::vector<detail::RecordDraft> again {draft(3, 6)};
+  (void)LedgerAccess::exchange(fg, owner, again);
+  EXPECT_EQ(fg.reserved(), (std::vector<Amount> {6}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {3}));
+  EXPECT_EQ(LedgerAccess::live(fg, ids[0].second + 1).edge_reservations, (std::vector<std::pair<EdgeId, Amount>> {{0, 6}}));
+  (void)LedgerAccess::detach(fg, owner);
+  EXPECT_EQ(fg.reserved(), (std::vector<Amount> {0}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {0}));
+  expect_balanced(fg, "after detach");
+  LedgerAccess::release(fg, owner);
+}
+
+TEST(FlowLedger, FlowIdsOfOtherLedgersAndUnknownIds) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger a(g), b(g);
+  RoutePolicy p(a, 0, 1, on_support(all_edges(*g)));
+  (void)p.place(1);
+  const auto id = *p.flow_id();
+  EXPECT_EQ(a.record(id).delivered, 1);
+  EXPECT_EQ(error_of([&] { (void)b.record(id); }), "FlowId (" + std::to_string(a.uid()) + ", " + std::to_string(id.second) +
+                                                     ") belongs to another ledger (uid " + std::to_string(b.uid()) + ")");
+  EXPECT_EQ(error_of([&] { (void)a.record(FlowId {a.uid(), 7}); }),
+            "FlowId (" + std::to_string(a.uid()) + ", 7) is retired or unknown");
+  // A policy's record() reads its own records only: another policy's record of the same ledger is
+  // refused, and the ledger's own checks come first.
+  RoutePolicy q(a, 0, 1, on_support(all_edges(*g)));
+  EXPECT_EQ(p.policy().record(id).delivered, 1);
+  EXPECT_EQ(error_of([&] { (void)q.policy().record(id); }),
+            "FlowId (" + std::to_string(a.uid()) + ", " + std::to_string(id.second) + ") is not a record of this policy");
+  EXPECT_EQ(error_of([&] { (void)q.policy().record(FlowId {b.uid(), id.second}); }),
+            "FlowId (" + std::to_string(b.uid()) + ", " + std::to_string(id.second) + ") belongs to another ledger (uid " +
+                std::to_string(a.uid()) + ")");
+}
+
+TEST(FlowLedger, RecordsCarryTheContractFields) {
+  // Lossy Equal on the diamond 10/10/1/10: 10 then 1 (the reference fixture
+  // lossy_diamond_10_then_1, tests/reference/policy/p2_transaction/fixtures.py).
+  auto g = shared(make_graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 1, 1}, {2, 3, 10, 1}}));
+  const auto inv = id_of_input(*g);
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 3, split_route(fg, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+  auto r = p.place(10);
+  EXPECT_EQ(r.call_delivered, 6);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(r.call_edge_drops, (std::vector<std::pair<EdgeId, Amount>>{{inv[2], 4}}));
+  r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(*r.call_undelivered, 1);
+  // The call's own drops; the record keeps the cumulative 4 + 1 below.
+  EXPECT_EQ(r.call_edge_drops, (std::vector<std::pair<EdgeId, Amount>>{{inv[2], 1}}));
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{6, 5, 1, 5}));
+  const auto rec = fg.records().at(0);
+  EXPECT_EQ(rec.flow_id, (FlowId {fg.uid(), 0}));
+  EXPECT_EQ(rec.policy_id, 0);
+  EXPECT_EQ(rec.sources, (std::vector<NodeId>{0}));
+  EXPECT_EQ(rec.destinations, (std::vector<NodeId>{3}));
+  EXPECT_EQ(rec.admission, Admission::Lossy);
+  ASSERT_TRUE(rec.route);
+  EXPECT_EQ(rec.route->via_edges().size(), 4u);
+  EXPECT_TRUE(*rec.route == *all_edges(*g));
+  EXPECT_EQ(rec.min_route_cost, 2);
+  ASSERT_TRUE(rec.offered.has_value());
+  EXPECT_EQ(*rec.offered, (Counter128 {0, 11}));
+  EXPECT_EQ(rec.delivered, 6);
+  ASSERT_EQ(rec.edge_drops.size(), 1u);
+  EXPECT_EQ(rec.edge_drops[0].first, inv[2]);
+  EXPECT_EQ(rec.edge_drops[0].second, (Counter128 {0, 5}));
+  // +inf on a fresh ledger (ShortestPaths's first-hop experiment over the same DAG): offered is the
+  // injection (20), delivered 11, drops 9.
+  FlowLedger f2(g);
+  FlowPolicy q(f2, std::vector<NodeId> {0}, std::vector<NodeId> {3},
+               FlowPolicyConfig {ShortestPaths {}, Admission::Lossy});
+  r = q.place(std::nullopt);
+  EXPECT_EQ(r.call_delivered, 11);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_EQ(*f2.records()[0].offered, (Counter128 {0, 20}));
+  // Lossless records carry no offered.
+  FlowLedger f3(g);
+  RoutePolicy m(f3, 0, 3, on_support(all_edges(*g)));
+  (void)m.place(3);
+  EXPECT_FALSE(f3.records()[0].offered.has_value());
+  EXPECT_TRUE(f3.records()[0].edge_drops.empty());
+}
+
+TEST(FlowLedger, CountersBeyondSixtyFourBits) {
+  // Oversized offers on a link of capacity 1: of nine 2^62 - 1 offers one unit is delivered and
+  // every other unit dropped: offered and drops grow beyond 2^64.
+  auto g = shared(make_graph(2, {{0, 1, 1, 1}}));
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+  const Amount big = kDomainLimit - 1;
+  for (int i = 0; i < 9; ++i) (void)p.place(big);
+  const auto rec = fg.records().at(0);
+  // offered = 9 (2^62 - 1) = 2^65 + 2^62 - 9
+  EXPECT_EQ(*rec.offered, (Counter128 {2, (std::uint64_t {1} << 62) - 9}));
+  EXPECT_EQ(rec.delivered, 1);
+  EXPECT_EQ(rec.edge_drops[0].second, (Counter128 {2, (std::uint64_t {1} << 62) - 10}));
+  EXPECT_EQ(p.requested(), (Counter128 {2, (std::uint64_t {1} << 62) - 9}));  // the offers' total
+}
+
+// The public counter is self-contained (flow_record.hpp): its own hi and lo, no base class from
+// the private arithmetic, the same carry and the same failure at 2^127, which changes nothing.
+static_assert(std::is_aggregate_v<Counter128> && std::is_trivially_copyable_v<Counter128>);
+static_assert(std::is_standard_layout_v<Counter128> && sizeof(Counter128) == 2 * sizeof(std::uint64_t));
+static_assert(!std::is_base_of_v<netgraph::core::detail::U128, Counter128> &&
+              !std::is_convertible_v<Counter128, netgraph::core::detail::U128>);
+
+TEST(FlowLedger, Counter128CarriesAndFailsAt2To127) {
+  const std::uint64_t max64 = std::numeric_limits<std::uint64_t>::max();
+  Counter128 c;
+  EXPECT_TRUE(c.is_zero());
+  EXPECT_EQ(c, Counter128 {});
+  // A carry from lo into hi.
+  c.lo = max64 - 2;
+  EXPECT_TRUE(c.add(5));
+  EXPECT_EQ(c.hi, 1u);
+  EXPECT_EQ(c.lo, 2u);
+  EXPECT_FALSE(c.is_zero());
+  EXPECT_EQ(c, (Counter128 {1, 2}));
+  EXPECT_NE(c, (Counter128 {0, 2}));
+  EXPECT_NE(c, (Counter128 {1, 3}));
+  // 2^127 - 1 is the largest value; adding 0 keeps it, any positive amount fails unchanged,
+  // also through the carry.
+  Counter128 top {(std::uint64_t {1} << 63) - 1, max64};
+  EXPECT_TRUE(top.add(0));
+  EXPECT_FALSE(top.add(1));
+  EXPECT_EQ(top, (Counter128 {(std::uint64_t {1} << 63) - 1, max64}));
+  Counter128 near {(std::uint64_t {1} << 63) - 1, max64 - 4};
+  EXPECT_TRUE(near.add(4));
+  EXPECT_EQ(near, top);
+  Counter128 below {(std::uint64_t {1} << 63) - 1, max64 - 4};
+  EXPECT_FALSE(below.add(kDomainLimit - 1));
+  EXPECT_EQ(below, (Counter128 {(std::uint64_t {1} << 63) - 1, max64 - 4}));
+}
+
+TEST(FlowLedger, RequestDomainAndFailedCallsLeaveState) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Weighted, Admission::Lossless));
+  (void)p.place(2);
+  const LedgerState before = ledger_state(fg);
+  const auto id = p.flow_id();
+  EXPECT_EQ(error_of([&] { (void)p.place(kDomainLimit); }),
+            "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(error_of([&] { (void)p.place(-1); }),
+            "offer must be an integer in [0, 2^62) or permitted +inf");
+  // The failed calls changed nothing: the requested total, the +inf flag, the flow and the
+  // ledger (every record field, the aggregate, the residual, the next FlowId and the owners).
+  EXPECT_EQ(p.requested(), (Counter128 {0, 2}));
+  EXPECT_FALSE(p.infinite());
+  EXPECT_EQ(p.flow_id(), id);
+  expect_same(ledger_state(fg), before, "after the rejected requests");
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{2}));
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{3}));
+  // Constructor validation.
+  auto other = make_graph(2, {{0, 1, 5, 1}});
+  EXPECT_EQ(error_of([&] {
+              RoutePolicy x(fg, 0, 1, on_support(dag_of(other, {0})));
+            }),
+            "support belongs to another graph");
+  EXPECT_EQ(error_of([&] {
+              RoutePolicy x(fg, 0, 1, split_route(fg, 0, 1, dag_of(other, {0}), RouteAllocation::Equal, Admission::Lossless));
+            }),
+            "routes[0]: route belongs to another graph");
+  EXPECT_EQ(error_of([&] {
+              RoutePolicy x(fg, 0, 0, on_support(all_edges(*g)));
+            }),
+            "node 0 is in both endpoint sets: sources and destinations must not overlap");
+  EXPECT_EQ(error_of([&] {
+              RoutePolicy x(fg, 0, 1, on_support(all_edges(*g), Admission::Lossy));
+            }),
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS");
+  // A rejected construction binds nothing (the accepted one above was destroyed: an orphan owner).
+  EXPECT_EQ(LedgerAccess::bound_policy_ids(fg), (std::vector<std::int64_t>{0}));
+}
+
+TEST(FlowLedger, BottleneckVersusMinCut) {
+  // The ledger's bottleneck against the minimum cut: (0->1 cap 1 cost 1), (0->2 cap 2 cost 3),
+  // (1->2 cap 1), (2->3 cap 2). After the Optimized +inf [1, 1, 1, 2] the bottleneck (forward
+  // residual) is {0->1, 2->3}, not the cut {2->3}.
+  auto g = shared(make_graph(4, {{0, 1, 1, 1}, {0, 2, 2, 3}, {1, 2, 1, 1}, {2, 3, 2, 1}}));
+  const auto inv = id_of_input(*g);
+  FlowLedger fg(g);
+  RoutePolicy p(fg, 0, 3, on_support(all_edges(*g)));
+  EXPECT_EQ(p.place(std::nullopt).call_delivered, 2);
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{1, 1, 1, 2}));
+  std::vector<EdgeId> want = {inv[0], inv[3]};
+  std::sort(want.begin(), want.end());
+  EXPECT_EQ(fg.saturated_boundary_edges(std::vector<NodeId> {0}), want);
+  // The masks, on a graph whose unmasked bottleneck is not empty: (0->1 cap 1), (1->2 cap 1),
+  // (0->3 cap 1), (0->4 cap 0). Owner a fills 1->2 and owner b 0->3, so only 0->1 keeps a
+  // residual. Unmasked, the sources reach {0, 1}; the edges leaving that set are 1->2 and 0->3
+  // (saturated, listed) and 0->4 (zero capacity, not listed).
+  auto g2 = shared(make_graph(5, {{0, 1, 1, 1}, {1, 2, 1, 1}, {0, 3, 1, 1}, {0, 4, 0, 1}}));
+  const auto inv2 = id_of_input(*g2);
+  FlowLedger f2(g2);
+  RoutePolicy a(f2, 1, 2, on_support(dag_of(*g2, {inv2[1]})));
+  RoutePolicy b(f2, 0, 3, on_support(dag_of(*g2, {inv2[2]})));
+  ASSERT_EQ(a.place(1).call_delivered, 1);
+  ASSERT_EQ(b.place(1).call_delivered, 1);
+  std::vector<EdgeId> want2 = {inv2[1], inv2[2]};
+  std::sort(want2.begin(), want2.end());
+  EXPECT_EQ(f2.saturated_boundary_edges(std::vector<NodeId> {0}), want2);
+  // 0->1 excluded: neither crossed (1->2 would be listed) nor listed itself; the sources reach
+  // only {0}, whose leaving edges are 0->1 (excluded), 0->3 (listed) and 0->4 (zero capacity).
+  auto el = g2->eligibility({}, std::vector<EdgeId> {inv2[0]});
+  EXPECT_EQ(f2.saturated_boundary_edges(std::vector<NodeId> {0}, &el), (std::vector<EdgeId> {inv2[2]}));
+  // An excluded source contributes nothing; a foreign Eligibility throws.
+  const std::vector<NodeId> xn = {0};
+  auto ex = g2->eligibility(xn, {});
+  EXPECT_TRUE(f2.saturated_boundary_edges(std::vector<NodeId> {0}, &ex).empty());
+  auto other = make_graph(3, {{0, 1, 1, 1}});
+  auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  EXPECT_EQ(error_of([&] { (void)f2.saturated_boundary_edges(std::vector<NodeId> {0}, &foreign); }),
+            "foreign Eligibility: built for another graph");
+  EXPECT_EQ(error_of([&] { (void)f2.saturated_boundary_edges(std::vector<NodeId> {}); }), "sources: the node set is empty");
+}
+
+TEST(FlowLedger, TwoOwnersNeverCancelEachOther) {
+  // Two Optimized owners never cancel each other's flow: A holds the chain 0-1-2-3; B's route
+  // (chain plus bypasses) could reach 2 only by cancelling A's middle edge: B places 0 (record
+  // at zero delivery, exhausted) and A is untouched; after A's remove() B places 2.
+  auto g = shared(make_graph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {0, 2, 1, 3}, {1, 3, 1, 3}}));
+  const auto inv = id_of_input(*g);
+  FlowLedger fg(g);
+  RoutePolicy a(fg, 0, 3, on_support(dag_of(*g, {inv[0], inv[1], inv[2]})));
+  EXPECT_EQ(a.place(1).call_delivered, 1);
+  RoutePolicy b(fg, 0, 3, on_support(all_edges(*g)));
+  auto r = b.place(2);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_FALSE(r.routes_changed);  // a controller program without a path: no program change
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_EQ(fg.record(*b.flow_id()).delivered, 0);
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{1, 1, 1, 0, 0}));
+  a.remove();
+  r = b.place(2);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(alloc_in(fg), (std::vector<Amount>{1, 0, 1, 1, 1}));
+}
+
+TEST(FlowLedger, AggregatesEqualTheSumOfRecords) {
+  // Random sequences of placements, removals and destructions on one ledger: carried() is the
+  // exact sum of the records' edge_flows and residual() = baseline - carried() within [0, baseline],
+  // and every record is a flow of its own (expect_conserved, test_utils.hpp).
+  std::mt19937 rng(5);
+  int delivering = 0;   // placements that delivered units
+  int with_records = 0;  // trials whose ledger held a record after some step
+  int removed = 0;       // removals that dropped records
+  int orphaned = 0;      // destructions that left records as orphans
+  int lossless_carrying = 0;  // record checks of a Lossless record that carries something
+  int lossy_dropping = 0;     // record checks of a Lossy record with drops
+  for (int trial = 0; trial < 60; ++trial) {
+    bool recorded = false;
+    const int n = 4 + static_cast<int>(rng() % 3);
+    std::vector<InEdge> edges;
+    for (int i = 0; i < 3 * n; ++i) {
+      const NodeId u = static_cast<NodeId>(rng() % (n - 1));
+      const NodeId v = static_cast<NodeId>(u + 1 + rng() % static_cast<std::uint32_t>(n - 1 - u));
+      edges.push_back({u, v, static_cast<Amount>(rng() % 7), 1 + static_cast<Cost>(rng() % 3)});
+    }
+    auto g = shared(make_graph(n, edges));
+    FlowLedger fg(g);
+    std::vector<std::unique_ptr<RoutePolicy>> pols;
+    for (int k = 0; k < 4; ++k) {
+      // CentralizedTE on the route, or Pinned over it as a split route (Weighted or Equal, either
+      // admission).
+      const int kind = static_cast<int>(rng() % 3);
+      const auto adm = kind != 0 && rng() % 3 == 0 ? Admission::Lossy : Admission::Lossless;
+      try {
+        auto cfg = kind == 0 ? on_support(all_edges(*g))
+                             : split_route(fg, 0, n - 1, all_edges(*g),
+                                           kind == 1 ? RouteAllocation::Weighted : RouteAllocation::Equal, adm);
+        pols.push_back(std::make_unique<RoutePolicy>(fg, 0, n - 1, std::move(cfg)));
+      } catch (const std::invalid_argument&) {
+        break;  // no walk at all
+      }
+    }
+    for (int step = 0; step < 12 && !pols.empty(); ++step) {
+      auto& p = pols[rng() % pols.size()];
+      if (!p) continue;
+      const int op = static_cast<int>(rng() % 6);
+      const auto records = fg.records().size();
+      const auto orphans = LedgerAccess::orphan_policy_ids(fg).size();
+      if (op == 0) {
+        p->remove();
+        removed += fg.records().size() < records ? 1 : 0;
+      } else if (op == 1) {
+        p.reset();
+        orphaned += LedgerAccess::orphan_policy_ids(fg).size() > orphans ? 1 : 0;
+      } else if (!p->infinite()) {
+        // +inf only Lossless (a Lossy forwarding of a program needs a finite offer).
+        const bool inf = op == 2 && !p->lossy();
+        delivering += p->place(inf ? std::optional<Amount>() : std::optional<Amount>(rng() % 9)).call_delivered > 0;
+      }
+      recorded = recorded || !fg.records().empty();
+      const std::string where = "trial " + std::to_string(trial) + " step " + std::to_string(step);
+      expect_balanced(fg, where);
+      for (const auto& r : fg.records()) {
+        const bool carries = expect_conserved(*g, r, where + " record " + std::to_string(r.flow_id.second));
+        if (r.admission == Admission::Lossless) lossless_carrying += carries ? 1 : 0;
+        if (r.admission == Admission::Lossy) lossy_dropping += r.edge_drops.empty() ? 0 : 1;
+      }
+      const auto res = fg.residual();
+      const auto carried = fg.carried();
+      for (std::size_t e = 0; e < res.size(); ++e) {
+        EXPECT_EQ(res[e] + carried[e], g->edge_capacity_units()[e]) << where << " edge " << e;
+      }
+      ASSERT_FALSE(::testing::Test::HasFailure()) << where;
+    }
+    with_records += recorded;
+  }
+  // The trials did real work: a generator change that left every route without a walk, or every
+  // placement empty, would otherwise pass with nothing compared.
+  EXPECT_GT(delivering, 100);
+  EXPECT_GT(with_records, 50);
+  EXPECT_GT(removed, 25);
+  EXPECT_GT(orphaned, 40);
+  EXPECT_GT(lossless_carrying, 100);
+  EXPECT_GT(lossy_dropping, 20);
+}
+
+// expect_conserved's clauses, each broken in a copy of a real record by a change that breaks no
+// other clause: the check reports exactly that clause's violations, so a check that lost the
+// clause would report fewer. The Lossless record is the max flow of the diamond 10/10/1/10 (1 unit
+// over 0-1-3, 10 over 0-2-3); the Lossy one is RecordsCarryTheContractFields' record (offered 11,
+// 6 delivered, 5 dropped on 1 -> 3, so offered covers what was delivered and dropped exactly). A
+// drop at the source is outside the transit balance (the source's own drops are what offered
+// leaves over).
+TEST(FlowLedger, TheRecordCheckReportsEachBrokenClause) {
+  auto g = shared(make_graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 1, 1}, {2, 3, 10, 1}}));
+  const auto inv = id_of_input(*g);
+  FlowLedger f1(g);
+  FlowLedger f2(g);
+  RoutePolicy max_flow(f1, 0, 3, on_support(all_edges(*g)));
+  ASSERT_EQ(max_flow.place(std::nullopt).call_delivered, 11);
+  RoutePolicy lossy(f2, 0, 3, split_route(f2, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+  ASSERT_EQ(lossy.place(10).call_delivered, 6);
+  ASSERT_EQ(lossy.place(1).call_delivered, 0);
+  const FlowRecord lossless_record = f1.records().at(0);
+  const FlowRecord lossy_record = f2.records().at(0);
+  ASSERT_EQ(lossless_record.edge_flows,
+            (std::vector<std::pair<EdgeId, Amount>> {{inv[0], 1}, {inv[1], 10}, {inv[2], 1}, {inv[3], 10}}));
+  ASSERT_EQ(lossless_record.delivered, 11);
+  ASSERT_EQ(lossy_record.edge_flows,
+            (std::vector<std::pair<EdgeId, Amount>> {{inv[0], 6}, {inv[1], 5}, {inv[2], 1}, {inv[3], 5}}));
+  ASSERT_EQ(lossy_record.edge_drops, (std::vector<std::pair<EdgeId, Counter128>> {{inv[2], Counter128 {0, 5}}}));
+  ASSERT_EQ(lossy_record.offered, (std::optional<Counter128> {Counter128 {0, 11}}));
+  ASSERT_EQ(lossy_record.delivered, 6);
+  // The amount on the edge of input position i.
+  auto on = [&](FlowRecord& r, std::size_t i) -> Amount& {
+    const auto it = std::find_if(r.edge_flows.begin(), r.edge_flows.end(), [&](const auto& x) { return x.first == inv[i]; });
+    if (it == r.edge_flows.end()) throw std::logic_error("the record has no amount on that edge");
+    return it->second;
+  };
+  bool carries = false;
+  EXPECT_EQ(failures_of([&] { carries = expect_conserved(*g, lossless_record, "lossless"); }), 0);
+  EXPECT_TRUE(carries);
+  EXPECT_EQ(failures_of([&] { carries = expect_conserved(*g, lossy_record, "lossy"); }), 0);
+  EXPECT_TRUE(carries);
+  FlowRecord empty = lossless_record;
+  empty.edge_flows.clear();
+  empty.delivered = 0;
+  EXPECT_EQ(failures_of([&] { carries = expect_conserved(*g, empty, "empty"); }), 0);
+  EXPECT_FALSE(carries);
+
+  struct Broken {
+    std::string clause;
+    std::function<void(FlowRecord&)> change;
+    int failures;
+  };
+  const std::vector<Broken> lossless_cases = {
+      {"positive edge amounts (the path 0-1-3 emptied, delivered with it)",
+       [&](FlowRecord& r) {
+         on(r, 0) = 0;
+         on(r, 2) = 0;
+         r.delivered -= 1;
+       },
+       2},
+      {"edges in ascending EdgeId", [](FlowRecord& r) { std::swap(r.edge_flows[0], r.edge_flows[1]); }, 1},
+      {"offered only on a Lossy record", [](FlowRecord& r) { r.offered = Counter128 {0, 11}; }, 1},
+      {"drops only on a Lossy record", [&](FlowRecord& r) { r.edge_drops.emplace_back(inv[0], Counter128 {0, 1}); }, 1},
+      {"transit conservation (one unit moved from 0 -> 2 to 0 -> 1)",
+       [&](FlowRecord& r) {
+         ++on(r, 0);
+         --on(r, 1);
+       },
+       2},
+      // Lossless: delivered is both the destinations' net inflow and the sources' net outflow.
+      {"delivered equal to the destinations' inflow and the sources' outflow", [](FlowRecord& r) { ++r.delivered; },
+       2},
+  };
+  const std::vector<Broken> lossy_cases = {
+      {"drops below 2^64", [](FlowRecord& r) { r.edge_drops[0].second.hi = 1; }, 1},
+      {"positive drops (the transit node's inflow lowered with it)",
+       [&](FlowRecord& r) {
+         r.edge_drops[0].second.lo = 0;
+         on(r, 0) = 1;
+       },
+       1},
+      {"drops in ascending EdgeId (a second drop at the source, offered raised with it)",
+       [&](FlowRecord& r) {
+         r.edge_drops.emplace_back(inv[0], Counter128 {0, 1});
+         r.offered->lo += 1;
+       },
+       1},
+      {"transit conservation net of drops (offered raised with the drop)",
+       [](FlowRecord& r) {
+         r.edge_drops[0].second.lo += 1;
+         r.offered->lo += 1;
+       },
+       1},
+      {"delivered equal to the destinations' inflow (offered raised with it)",
+       [](FlowRecord& r) {
+         ++r.delivered;
+         r.offered->lo += 1;
+       },
+       1},
+      {"offered covers what was delivered and dropped", [](FlowRecord& r) { r.offered->lo -= 1; }, 1},
+      {"offered below 2^64", [](FlowRecord& r) { r.offered->hi = 1; }, 1},
+      // Without offered both the presence clause and the comparison with offered report.
+      {"offered on a Lossy record", [](FlowRecord& r) { r.offered.reset(); }, 2},
+  };
+  for (const auto& [base, cases] : {std::pair {&lossless_record, &lossless_cases}, std::pair {&lossy_record, &lossy_cases}}) {
+    for (const auto& c : *cases) {
+      FlowRecord x = *base;
+      c.change(x);
+      EXPECT_EQ(failures_of([&] { (void)expect_conserved(*g, x, c.clause); }), c.failures) << c.clause;
+    }
+  }
+}
+
+TEST(FlowLedger, NoRouteCallsRecordTheEpochState) {
+  // A positive request with an empty roster creates nothing, but the epoch records it: after
+  // +inf a finite request (place(0) included) is rejected until remove() (the epoch state:
+  // the reading of the reference in tests/reference/policy/p2_transaction/). CentralizedTE on a
+  // support: Pinned keeps one record per program entry even when every entry is masked
+  // (below, and test_programs.py::test_all_failed_entries_still_have_records).
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  auto el = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {0}));
+  RoutePolicy p(fg, 0, 1, on_support(all_edges(*g)), el);
+  EXPECT_EQ(p.place(3).termination, Termination::NoRoute);
+  EXPECT_EQ(p.requested(), (Counter128 {0, 3}));
+  auto r = p.place(std::nullopt);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  EXPECT_FALSE(r.call_undelivered.has_value());
+  EXPECT_TRUE(p.infinite());
+  EXPECT_NE(error_of([&] { (void)p.place(1); }).find("after infinite placement"), std::string::npos);
+  EXPECT_NE(error_of([&] { (void)p.place(0); }).find("after infinite placement"), std::string::npos);
+  EXPECT_EQ(p.requested(), (Counter128 {0, 3}));  // the rejected calls added nothing
+  EXPECT_TRUE(p.infinite());
+  p.remove();
+  EXPECT_FALSE(p.infinite());
+  EXPECT_TRUE(p.requested().is_zero());
+  EXPECT_EQ(p.place(1).termination, Termination::NoRoute);
+  EXPECT_TRUE(fg.records().empty());
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 0);
+  // Pinned with its one entry masked: NoRoute, and the entry's record at zero.
+  FlowLedger fg2(g);
+  RoutePolicy q(fg2, 0, 1, split_route(fg2, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless),
+                el);
+  auto rq = q.place(3);
+  EXPECT_EQ(rq.termination, Termination::NoRoute);
+  EXPECT_EQ(rq.call_delivered, 0);
+  const auto kept = fg2.records();
+  ASSERT_EQ(kept.size(), 1U);
+  EXPECT_EQ(kept[0].entry_id, std::optional<std::int32_t> {0});
+  EXPECT_EQ(kept[0].delivered, 0);
+  EXPECT_TRUE(kept[0].edge_flows.empty());
+  EXPECT_EQ(kept[0].min_route_cost, kUnreachable);
+}
+
+TEST(FlowLedger, RouteCostIsTheBundlesMinimumWalk) {
+  // A split route weighted by its residual snapshot, made while another owner fills its only
+  // edge: no positive weight (record at zero delivery; NoActiveWeight), min_route_cost is still the
+  // route's walk cost 3.
+  auto g = shared(make_graph(2, {{0, 1, 2, 3}}));
+  FlowLedger fg(g);
+  RoutePolicy holder(fg, 0, 1, on_support(all_edges(*g)));
+  EXPECT_EQ(holder.place(2).call_delivered, 2);
+  RoutePolicy w(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Weighted, Admission::Lossless, WeightBasis::ResidualSnapshot));
+  auto r = w.place(1);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+  EXPECT_TRUE(r.routes_changed);
+  ASSERT_NE(w.plan(), nullptr);
+  EXPECT_TRUE(w.plan()->forwarding_edges.empty());
+  const auto rec = fg.record(*w.flow_id());
+  EXPECT_EQ(rec.min_route_cost, 3);
+  EXPECT_EQ(rec.delivered, 0);
+  // A mixed-cost route: the cheapest walk (1 + 1 + 1) is the route cost, not the cost-4 edge.
+  auto g2 = shared(make_graph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {0, 3, 1, 4}}));
+  FlowLedger f2(g2);
+  RoutePolicy m(f2, 0, 3, on_support(all_edges(*g2)));
+  (void)m.place(1);
+  EXPECT_EQ(f2.records()[0].min_route_cost, 3);
+}
+
+TEST(FlowLedger, RemovalRestoresTheBaselineAndLeavesOtherOwnersIntact) {
+  // Removing a flow restores the baseline residual (5 on a capacity-10 link), not
+  // the capacity; another owner's allocation stays intact.
+  auto g = shared(make_graph(2, {{0, 1, 10, 1}}));
+  FlowLedger fg(g, std::vector<Amount> {5});
+  RoutePolicy a(fg, 0, 1, on_support(all_edges(*g)));
+  RoutePolicy b(fg, 0, 1, split_route(fg, 0, 1, all_edges(*g), RouteAllocation::Equal, Admission::Lossless));
+  EXPECT_EQ(a.place(3).call_delivered, 3);
+  EXPECT_EQ(b.place(1).call_delivered, 1);
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{1}));
+  a.remove();
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{4}));
+  EXPECT_EQ(fg.record(*b.flow_id()).edge_flows, (std::vector<std::pair<EdgeId, Amount>>{{0, 1}}));
+  b.remove();
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{5}));
+  // A baseline one unit above the quantised capacity is rejected (no clamp at this boundary).
+  EXPECT_THROW(FlowLedger(g, std::vector<Amount> {11}), std::invalid_argument);
+}
+
+TEST(FlowLedger, LossyOffersArePerCall) {
+  // On the diamond, two calls of 1 offer each unit to the lowest
+  // EdgeId first (both on the first branch) while one call of 2 splits [1, 1]: not additive.
+  auto g = shared(make_graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 1, 1}, {2, 3, 10, 1}}));
+  FlowLedger f1(g), f2(g);
+  RoutePolicy p1(f1, 0, 3, split_route(f1, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+  RoutePolicy p2(f2, 0, 3, split_route(f2, 0, 3, all_edges(*g), RouteAllocation::Equal, Admission::Lossy));
+  auto r = p1.place(1);
+  EXPECT_EQ(r.call_delivered, 1);
+  r = p1.place(1);
+  EXPECT_EQ(r.call_delivered, 0);  // the tail 1->3 is full: the unit is dropped there
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(alloc_in(f1), (std::vector<Amount>{2, 0, 1, 0}));
+  r = p2.place(2);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(alloc_in(f2), (std::vector<Amount>{1, 1, 1, 1}));
+}
+
+// A commit carrying several records of one owner touches an edge from more
+// than one record; its delta may pass through zero while it accumulates. Each edge's delta is
+// published once.
+namespace {
+
+detail::RecordDraft draft_on(const std::shared_ptr<const PredecessorDAG>& dag, std::vector<std::pair<EdgeId, Amount>> edges,
+                       std::optional<std::int64_t> id = std::nullopt) {
+  detail::RecordDraft d;
+  d.record_counter = id;
+  FlowRecord& r = d.record;
+  r.sources = {0};
+  r.destinations = {1};
+  r.route = dag;
+  r.min_route_cost = 1;
+  for (const auto& [e, x] : edges) r.delivered += x;
+  r.edge_flows = std::move(edges);
+  return d;
+}
+
+Amount record_sum(const FlowLedger& fg, EdgeId e) {
+  Amount sum = 0;
+  for (const auto& r : fg.records()) {
+    for (const auto& [f, x] : r.edge_flows) {
+      if (f == e) sum += x;
+    }
+  }
+  return sum;
+}
+
+} // namespace
+
+TEST(FlowLedger, MultiRecordCommitsPublishEachEdgeOnce) {
+  auto g = shared(make_graph(2, {{0, 1, 3, 1}}));
+  const auto dag = all_edges(*g);
+  FlowLedger fg(g);
+  const auto owner = LedgerAccess::bind(fg);
+  std::vector<detail::RecordDraft> first {draft_on(dag, {{0, 1}})};
+  const auto ids = LedgerAccess::commit(fg, owner, first);
+  // The record kept unchanged (-1, then +1: the delta passes through 0) plus a new 2-unit record.
+  std::vector<detail::RecordDraft> next {draft_on(dag, {{0, 1}}, ids[0].second), draft_on(dag, {{0, 2}})};
+  EXPECT_EQ(LedgerAccess::commit(fg, owner, next).size(), 1U);
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{3}));
+  EXPECT_EQ(fg.residual(), (std::vector<Amount>{0}));
+  EXPECT_EQ(record_sum(fg, 0), 3);
+  // Over capacity through the same pattern: rejected, nothing changed.
+  const LedgerState held = ledger_state(fg);
+  std::vector<detail::RecordDraft> over {draft_on(dag, {{0, 1}}, ids[0].second), draft_on(dag, {{0, 2}}, ids[0].second + 1),
+                                   draft_on(dag, {{0, 1}})};
+  EXPECT_EQ(logic_error_of([&] { (void)LedgerAccess::commit(fg, owner, over); }),
+            "ledger: infeasible commit on edge 0 (4 of 3)");
+  expect_same(ledger_state(fg), held, "the refused commit");
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{3}));
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), 2);
+  // A kept record gives its unit up while a new record takes the edge: published once.
+  std::vector<detail::RecordDraft> moved {draft_on(dag, {}, ids[0].second), draft_on(dag, {{0, 2}}, ids[0].second + 1),
+                                    draft_on(dag, {{0, 1}})};
+  EXPECT_EQ(LedgerAccess::commit(fg, owner, moved).size(), 1U);
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{3}));
+  EXPECT_EQ(record_sum(fg, 0), 3);
+  EXPECT_EQ(LedgerAccess::detach(fg, owner).size(), 3U);
+  EXPECT_EQ(fg.carried(), (std::vector<Amount>{0}));
+  LedgerAccess::release(fg, owner);
+}
+
+TEST(FlowLedger, RandomMultiOwnerCommitsMatchAModel) {
+  // Three owners on four edges; every commit carries all of its owner's records (each kept,
+  // changed, emptied or moved) plus up to two new ones, so deltas cancel and reappear on shared
+  // edges; detaches between commits. After every call the ledger must equal an independent model
+  // (the aggregate, every live record's owner and edge amounts, the next id), and a rejected
+  // commit must name an edge over its capacity and change nothing.
+  std::mt19937 rng(11);
+  auto g = shared(make_graph(4, {{0, 1, 6, 1}, {1, 2, 4, 1}, {2, 3, 5, 1}, {0, 3, 3, 1}}));
+  const auto dag = all_edges(*g);
+  const auto m = static_cast<std::size_t>(g->num_edges());
+  FlowLedger fg(g);
+  std::vector<std::int64_t> owners;
+  for (int i = 0; i < 3; ++i) owners.push_back(LedgerAccess::bind(fg));
+  // The model: per owner, its live records (id -> per-edge amounts).
+  std::vector<std::map<std::int64_t, std::vector<Amount>>> model(owners.size());
+  std::int64_t next_id = 0;
+  int moved = 0;     // accepted commits that changed the aggregate
+  int rejected = 0;  // commits the ledger rejected
+  auto random_edges = [&] {
+    std::vector<Amount> a(m, 0);
+    for (std::size_t e = 0; e < m; ++e) a[e] = (rng() % 3) == 0 ? static_cast<Amount>(rng() % 3) : 0;
+    return a;
+  };
+  auto as_pairs = [](const std::vector<Amount>& a) {
+    std::vector<std::pair<EdgeId, Amount>> out;
+    for (std::size_t e = 0; e < a.size(); ++e) {
+      if (a[e] != 0) out.emplace_back(static_cast<EdgeId>(e), a[e]);
+    }
+    return out;
+  };
+  for (int step = 0; step < 3000; ++step) {
+    const std::size_t o = rng() % owners.size();
+    if ((rng() % 10) == 0) {
+      (void)LedgerAccess::detach(fg, owners[o]);
+      model[o].clear();
+    } else {
+      std::vector<detail::RecordDraft> drafts;
+      std::map<std::int64_t, std::vector<Amount>> after;
+      for (const auto& [id, a] : model[o]) {
+        const auto kind = rng() % 4;  // kept, changed, emptied, moved to random edges
+        std::vector<Amount> b = a;
+        if (kind == 1) {
+          b[rng() % m] += 1;
+        } else if (kind == 2) {
+          b.assign(m, 0);
+        } else if (kind == 3) {
+          b = random_edges();
+        }
+        drafts.push_back(draft_on(dag, as_pairs(b), id));
+        after[id] = b;
+      }
+      const int fresh = static_cast<int>(rng() % 3);
+      for (int k = 0; k < fresh; ++k) {
+        const auto b = random_edges();
+        drafts.push_back(draft_on(dag, as_pairs(b)));
+        after[next_id + k] = b;
+      }
+      // Feasible exactly when every edge's new total stays within its capacity.
+      std::vector<Amount> total(m, 0);
+      for (std::size_t q = 0; q < owners.size(); ++q) {
+        for (const auto& [id, a] : q == o ? after : model[q]) {
+          for (std::size_t e = 0; e < m; ++e) total[e] += a[e];
+        }
+      }
+      bool feasible = true;
+      for (std::size_t e = 0; e < m; ++e) feasible = feasible && total[e] <= g->edge_capacity_units()[e];
+      const auto before = fg.carried();
+      const LedgerState before_state = ledger_state(fg);
+      if (feasible) {
+        // The new records take the next ids in draft order.
+        std::vector<FlowId> want_ids;
+        for (int k = 0; k < fresh; ++k) want_ids.emplace_back(fg.uid(), next_id + k);
+        EXPECT_EQ(LedgerAccess::commit(fg, owners[o], drafts), want_ids) << "step " << step;
+        model[o] = after;
+        next_id += fresh;
+        moved += fg.carried() != before ? 1 : 0;
+      } else {
+        // The refusal names one edge over its capacity, with its new total.
+        std::vector<std::string> refusals;
+        for (std::size_t e = 0; e < m; ++e) {
+          if (total[e] <= g->edge_capacity_units()[e]) continue;
+          refusals.push_back("ledger: infeasible commit on edge " + std::to_string(e) + " (" + std::to_string(total[e]) +
+                             " of " + std::to_string(g->edge_capacity_units()[e]) + ")");
+        }
+        const std::string got = logic_error_of([&] { (void)LedgerAccess::commit(fg, owners[o], drafts); });
+        EXPECT_TRUE(std::find(refusals.begin(), refusals.end(), got) != refusals.end()) << "step " << step << ": " << got;
+        ++rejected;
+        expect_same(ledger_state(fg), before_state, "step " + std::to_string(step));
+      }
+    }
+    std::vector<Amount> want(m, 0);
+    for (const auto& recs : model) {
+      for (const auto& [id, a] : recs) {
+        for (std::size_t e = 0; e < m; ++e) want[e] += a[e];
+      }
+    }
+    ASSERT_EQ(fg.carried(), want) << "step " << step;
+    for (std::size_t e = 0; e < m; ++e) ASSERT_EQ(record_sum(fg, static_cast<EdgeId>(e)), want[e]);
+    ASSERT_EQ(LedgerAccess::next_record_counter(fg), next_id);
+    // Every live record by id: its owner and its edge amounts are the model's.
+    std::map<std::int64_t, std::pair<std::int64_t, std::vector<std::pair<EdgeId, Amount>>>> want_records;
+    for (std::size_t q = 0; q < owners.size(); ++q) {
+      for (const auto& [id, a] : model[q]) want_records[id] = {owners[q], as_pairs(a)};
+    }
+    const auto records = fg.records();
+    ASSERT_EQ(records.size(), want_records.size()) << "step " << step;
+    for (const auto& r : records) {
+      const auto it = want_records.find(r.flow_id.second);
+      ASSERT_NE(it, want_records.end()) << "step " << step << ": record " << r.flow_id.second;
+      EXPECT_EQ(r.policy_id, it->second.first) << "step " << step << ": record " << r.flow_id.second;
+      EXPECT_EQ(r.edge_flows, it->second.second) << "step " << step << ": record " << r.flow_id.second;
+    }
+  }
+  EXPECT_GT(moved, 500);
+  EXPECT_GT(rejected, 500);
+  for (auto owner : owners) LedgerAccess::release(fg, owner);
+}
+
+TEST(FlowLedger, FreshSingleRecordCommitsMatchTheGeneralRule) {
+  // A commit of one new record by an owner without live records takes a shortcut
+  // when its edges strictly ascend (no aggregation). Against an independent model of the general
+  // rule, for drafts that ascend, repeat an edge, run backwards, hold zeros or negatives, and
+  // overflow at any position (another owner holding part of the capacity): the same outcome, the
+  // same message (negative amounts first, then the first infeasible edge in first-touch order with
+  // its aggregated total), and nothing changed by a rejected commit.
+  std::mt19937 rng(1007);
+  auto g = shared(make_graph(6, {{0, 1, 4, 1}, {1, 2, 3, 1}, {2, 3, 5, 1}, {0, 3, 2, 1}, {3, 4, 4, 1}, {4, 5, 3, 1}}));
+  const auto dag = all_edges(*g);
+  const auto m = static_cast<std::size_t>(g->num_edges());
+  FlowLedger fg(g);
+  const auto other = LedgerAccess::bind(fg);
+  std::vector<detail::RecordDraft> held {draft_on(dag, {{0, 1}, {2, 2}, {5, 1}})};
+  (void)LedgerAccess::commit(fg, other, held);
+  int shortcut = 0;    // accepted non-empty drafts whose edges strictly ascend
+  int general = 0;     // accepted drafts that repeat or reorder an edge
+  int negative = 0;    // rejected for a negative amount
+  int infeasible = 0;  // rejected for an infeasible edge
+  for (int step = 0; step < 4000; ++step) {
+    const auto owner = LedgerAccess::bind(fg);
+    std::vector<std::pair<EdgeId, Amount>> edges;
+    const auto k = rng() % 5;
+    for (std::size_t i = 0; i < k; ++i) {
+      edges.emplace_back(static_cast<EdgeId>(rng() % m), rng() % 9 == 0 ? Amount {-1} : static_cast<Amount>(rng() % 4));
+    }
+    const int shape = static_cast<int>(rng() % 3);  // ascending, sorted with repeats kept, as drawn
+    if (shape < 2) std::sort(edges.begin(), edges.end());
+    if (shape == 0) {
+      edges.erase(std::unique(edges.begin(), edges.end(), [](const auto& a, const auto& b) { return a.first == b.first; }),
+                  edges.end());
+    }
+    const bool strictly = std::adjacent_find(edges.begin(), edges.end(), [](const auto& a, const auto& b) {
+                            return a.first >= b.first;
+                          }) == edges.end();
+    // The general rule: negatives first; then each touched edge in first-touch order with its sum.
+    std::string want;
+    for (const auto& [e, x] : edges) {
+      if (x < 0) want = "ledger: a negative allocation in a commit";
+    }
+    std::vector<Amount> delta(m, 0);
+    std::vector<EdgeId> touched;
+    for (const auto& [e, x] : edges) {
+      if (std::find(touched.begin(), touched.end(), e) == touched.end()) touched.push_back(e);
+      delta[static_cast<std::size_t>(e)] += x;
+    }
+    const auto before = fg.carried();
+    const LedgerState before_state = ledger_state(fg);
+    const auto next_id = LedgerAccess::next_record_counter(fg);
+    if (want.empty()) {
+      for (EdgeId e : touched) {
+        const auto ei = static_cast<std::size_t>(e);
+        const Amount next = before[ei] + delta[ei];
+        if (next < 0 || next > g->edge_capacity_units()[ei]) {
+          want = "ledger: infeasible commit on edge " + std::to_string(e) + " (" + std::to_string(next) + " of " +
+                 std::to_string(g->edge_capacity_units()[ei]) + ")";
+          break;
+        }
+      }
+    }
+    std::vector<detail::RecordDraft> drafts {draft_on(dag, edges)};
+    if (!want.empty()) {
+      try {
+        (void)LedgerAccess::commit(fg, owner, drafts);
+        ADD_FAILURE() << "step " << step << ": accepted, want " << want;
+      } catch (const std::logic_error& e) {
+        EXPECT_EQ(std::string(e.what()), want) << "step " << step;
+        ++(std::string(e.what()).find("negative") != std::string::npos ? negative : infeasible);
+      }
+      expect_same(ledger_state(fg), before_state, "step " + std::to_string(step));
+    } else {
+      const auto ids = LedgerAccess::commit(fg, owner, drafts);
+      ASSERT_EQ(ids.size(), 1U);
+      EXPECT_EQ(ids[0], (FlowId {fg.uid(), next_id}));
+      const auto rec = fg.record(ids[0]);
+      std::vector<std::pair<EdgeId, Amount>> kept;
+      for (const auto& p : edges) {
+        if (p.second != 0) kept.push_back(p);
+      }
+      EXPECT_EQ(rec.edge_flows, kept) << "step " << step;
+      EXPECT_EQ(rec.policy_id, owner);
+      for (std::size_t e = 0; e < m; ++e) EXPECT_EQ(fg.carried()[e], before[e] + delta[e]) << "step " << step;
+      if (strictly && !edges.empty()) ++shortcut;
+      if (!strictly) ++general;
+      if (rng() % 2 == 0) (void)LedgerAccess::detach(fg, owner);
+    }
+    LedgerAccess::release(fg, owner);
+    if (::testing::Test::HasFailure()) return;
+  }
+  EXPECT_GT(shortcut, 140);
+  EXPECT_GT(general, 10);
+  EXPECT_GT(negative, 300);
+  EXPECT_GT(infeasible, 300);
+  LedgerAccess::release(fg, other);
+  // An owner with a live record, and a draft naming an id the owner does not hold, keep the
+  // general path and its rule (a fresh ledger).
+  FlowLedger fg2(g);
+  const auto owner = LedgerAccess::bind(fg2);
+  std::vector<detail::RecordDraft> one {draft_on(dag, {{3, 1}})};
+  const auto ids = LedgerAccess::commit(fg2, owner, one);
+  std::vector<detail::RecordDraft> without_it {draft_on(dag, {{4, 1}})};
+  const std::string must_carry = "ledger: a commit must carry every live record of its policy";
+  EXPECT_EQ(logic_error_of([&] { (void)LedgerAccess::commit(fg2, owner, without_it); }), must_carry);
+  const auto fresh = LedgerAccess::bind(fg2);
+  std::vector<detail::RecordDraft> claims {draft_on(dag, {{4, 1}}, ids[0].second)};
+  EXPECT_EQ(logic_error_of([&] { (void)LedgerAccess::commit(fg2, fresh, claims); }), must_carry);
+  EXPECT_EQ(fg2.records().size(), 1U);
+  LedgerAccess::release(fg2, owner);
+  LedgerAccess::release(fg2, fresh);
+}
+
+namespace {
+
+// What fn raises: the message when the exception's dynamic type is exactly std::runtime_error (an
+// internal limit), or a description of anything else.
+std::string runtime_error_of(const std::function<void()>& fn) {
+  try {
+    fn();
+  } catch (const std::exception& e) {
+    if (typeid(e) == typeid(std::runtime_error)) return e.what();
+    return std::string("another exception type (") + typeid(e).name() + "): " + e.what();
+  }
+  return "no exception";
+}
+
+constexpr std::int64_t kLastId = std::numeric_limits<std::int64_t>::max() - 1;
+
+} // namespace
+
+// Owner ids run up to the largest int64 less one (2^63 - 1 identities); the next bind is refused
+// before anything changes, and an existing owner keeps working.
+TEST(FlowLedger, PolicyIdentitiesStopBeforeTheLargestInt64) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  const auto dag = all_edges(*g);
+  FlowLedger fg(g);
+  LedgerAccess::set_next_ids(fg, 0, kLastId);
+  const auto last = LedgerAccess::bind(fg);
+  EXPECT_EQ(last, kLastId);
+  const LedgerState before = ledger_state(fg);
+  EXPECT_EQ(runtime_error_of([&] { (void)LedgerAccess::bind(fg); }), "policy identity limit exceeded");
+  EXPECT_EQ(runtime_error_of([&] { RoutePolicy p(fg, 0, 1, on_support(dag)); }), "policy identity limit exceeded");
+  expect_same(ledger_state(fg), before, "the refused binds");
+  std::vector<detail::RecordDraft> one {draft_on(dag, {{0, 2}})};
+  EXPECT_EQ(LedgerAccess::commit(fg, last, one).size(), 1U);
+  EXPECT_EQ(fg.records()[0].policy_id, kLastId);
+  (void)LedgerAccess::detach(fg, last);
+  LedgerAccess::release(fg, last);
+}
+
+// Record ids run up to the largest int64 less one (2^63 - 1 identities), checked for all of a
+// commit's new records at once, on the fresh-record path and on the general one: the refused
+// commit changes nothing, a commit with no new record still passes.
+TEST(FlowLedger, RecordIdentitiesStopBeforeTheLargestInt64) {
+  auto g = shared(make_graph(2, {{0, 1, 9, 1}}));
+  const auto dag = all_edges(*g);
+  FlowLedger fg(g);
+  const auto a = LedgerAccess::bind(fg);
+  const auto b = LedgerAccess::bind(fg);
+  LedgerAccess::set_next_ids(fg, kLastId - 1, 2);
+  // The general path (an owner with a live record): two new records with two ids left.
+  std::vector<detail::RecordDraft> first {draft_on(dag, {{0, 1}})};
+  const auto ids = LedgerAccess::commit(fg, a, first);
+  EXPECT_EQ(ids[0].second, kLastId - 1);
+  std::vector<detail::RecordDraft> two {draft_on(dag, {{0, 1}}, ids[0].second), draft_on(dag, {{0, 1}}),
+                                        draft_on(dag, {{0, 1}})};
+  const LedgerState one_left = ledger_state(fg);
+  EXPECT_EQ(runtime_error_of([&] { (void)LedgerAccess::commit(fg, a, two); }), "record identity limit exceeded");
+  expect_same(ledger_state(fg), one_left, "two new records, one id left");
+  std::vector<detail::RecordDraft> exchange {draft_on(dag, {{0, 1}}), draft_on(dag, {{0, 1}})};
+  EXPECT_EQ(runtime_error_of([&] { (void)LedgerAccess::exchange(fg, a, exchange); }), "record identity limit exceeded");
+  expect_same(ledger_state(fg), one_left, "an exchange of two new records, one id left");
+  // One new record takes the last id.
+  std::vector<detail::RecordDraft> second {draft_on(dag, {{0, 1}}, ids[0].second), draft_on(dag, {{0, 1}})};
+  EXPECT_EQ(LedgerAccess::commit(fg, a, second)[0].second, kLastId);
+  EXPECT_EQ(LedgerAccess::next_record_counter(fg), std::numeric_limits<std::int64_t>::max());
+  // The fresh-record path (an owner without records): no id left.
+  const LedgerState none_left = ledger_state(fg);
+  std::vector<detail::RecordDraft> fresh {draft_on(dag, {{0, 1}})};
+  EXPECT_EQ(runtime_error_of([&] { (void)LedgerAccess::commit(fg, b, fresh); }), "record identity limit exceeded");
+  expect_same(ledger_state(fg), none_left, "a fresh record, no id left");
+  // A commit that keeps its records and creates none passes.
+  std::vector<detail::RecordDraft> kept {draft_on(dag, {{0, 2}}, kLastId - 1), draft_on(dag, {{0, 1}}, kLastId)};
+  EXPECT_TRUE(LedgerAccess::commit(fg, a, kept).empty());
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {3}));
+  (void)LedgerAccess::detach(fg, a);
+  LedgerAccess::release(fg, a);
+  LedgerAccess::release(fg, b);
+}
+
+// A uid comes from one counter holding the last uid taken: never 0, at most the largest int64
+// (2^63 - 1 identities); after it the counter is spent and unchanged.
+TEST(FlowLedger, ObjectIdentitiesStopAtTheLargestInt64) {
+  constexpr auto kMax = static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max());
+  std::atomic<std::uint64_t> counter {0};
+  EXPECT_EQ(detail::take_uid(counter), 1U);
+  counter = kMax - 1;
+  EXPECT_EQ(detail::take_uid(counter), kMax);
+  EXPECT_EQ(runtime_error_of([&] { (void)detail::take_uid(counter); }), "object identity limit exceeded");
+  EXPECT_EQ(counter.load(), kMax);
+  // The process counter: fresh, distinct uids.
+  const auto u1 = detail::next_uid();
+  const auto u2 = detail::next_uid();
+  EXPECT_NE(u1, 0U);
+  EXPECT_GT(u2, u1);
+}
+
+// An owner released without records leaves no entry (bound and orphaned owners only); an owner
+// released with records stays as their orphaned owner; ids are never reissued.
+TEST(FlowLedger, OwnersWithoutRecordsAreForgotten) {
+  auto g = shared(make_graph(2, {{0, 1, 5, 1}}));
+  const auto dag = all_edges(*g);
+  FlowLedger fg(g);
+  RoutePolicy anchor(fg, 0, 1, on_support(dag));
+  for (int i = 0; i < 1000; ++i) {
+    RoutePolicy q(fg, 0, 1, on_support(dag));
+    if (i % 2 == 0) {
+      EXPECT_EQ(q.place(1).call_delivered, 1);
+      q.remove();
+    }
+  }
+  EXPECT_EQ(LedgerAccess::bound_policy_ids(fg), (std::vector<std::int64_t> {0}));
+  EXPECT_TRUE(LedgerAccess::orphan_policy_ids(fg).empty());
+  {
+    RoutePolicy q(fg, 0, 1, on_support(dag));
+    EXPECT_EQ(q.place(2).call_delivered, 2);
+  }
+  EXPECT_EQ(LedgerAccess::orphan_policy_ids(fg), (std::vector<std::int64_t> {1001}));
+  ASSERT_EQ(fg.records().size(), 1U);
+  EXPECT_EQ(fg.records()[0].policy_id, 1001);
+  RoutePolicy next(fg, 0, 1, on_support(dag));
+  EXPECT_EQ(LedgerAccess::bound_policy_ids(fg), (std::vector<std::int64_t> {0, 1002}));
+  // The direct entry points: release of an owner that removed its records forgets it.
+  const auto owner = LedgerAccess::bind(fg);
+  std::vector<detail::RecordDraft> one {draft_on(dag, {{0, 1}})};
+  (void)LedgerAccess::commit(fg, owner, one);
+  (void)LedgerAccess::detach(fg, owner);
+  LedgerAccess::release(fg, owner);
+  EXPECT_EQ(LedgerAccess::bound_policy_ids(fg), (std::vector<std::int64_t> {0, 1002}));
+  EXPECT_EQ(LedgerAccess::orphan_policy_ids(fg), (std::vector<std::int64_t> {1001}));
+}
+
+namespace {
+
+// The batch exchange of several owners (apply_actions' publication), each with its own rule.
+std::vector<std::vector<FlowId>> commit_batch(FlowLedger& fg, std::vector<std::int64_t> owners,
+                                              std::vector<std::vector<detail::RecordDraft>>& drafts,
+                                              std::vector<bool> retire) {
+  std::vector<detail::OwnerDrafts> parts;
+  for (std::size_t i = 0; i < owners.size(); ++i) parts.push_back({owners[i], drafts[i], retire[i]});
+  std::vector<std::vector<FlowId>> created(owners.size());
+  LedgerAccess::commit_batch(fg, parts, created);
+  return created;
+}
+
+} // namespace
+
+TEST(FlowLedger, RandomBatchesMatchAModel) {
+  // Four owners on four edges; each step one batch of one to four distinct owners in random
+  // order, each owner committing (every live record kept, changed, emptied or moved, plus up to
+  // two new) or exchanging (every live record retired, up to two new). A batch is feasible exactly
+  // when the aggregate over every owner fits, even where an owner alone would not (one gives up
+  // what another takes); new ids follow owner order, then draft order. A refused batch names an
+  // edge over its capacity and changes nothing.
+  std::mt19937 rng(23);
+  auto g = shared(make_graph(4, {{0, 1, 6, 1}, {1, 2, 4, 1}, {2, 3, 5, 1}, {0, 3, 3, 1}}));
+  const auto dag = all_edges(*g);
+  const auto m = static_cast<std::size_t>(g->num_edges());
+  FlowLedger fg(g);
+  std::vector<std::int64_t> owners;
+  for (int i = 0; i < 4; ++i) owners.push_back(LedgerAccess::bind(fg));
+  std::vector<std::map<std::int64_t, std::vector<Amount>>> model(owners.size());
+  std::int64_t next_id = 0;
+  int accepted = 0;
+  int rejected = 0;
+  int needs_batch = 0;  // accepted batches some of whose owners would be refused alone, in batch order
+  auto random_edges = [&] {
+    std::vector<Amount> a(m, 0);
+    for (std::size_t e = 0; e < m; ++e) a[e] = (rng() % 3) == 0 ? static_cast<Amount>(rng() % 3) : 0;
+    return a;
+  };
+  auto as_pairs = [](const std::vector<Amount>& a) {
+    std::vector<std::pair<EdgeId, Amount>> out;
+    for (std::size_t e = 0; e < a.size(); ++e) {
+      if (a[e] != 0) out.emplace_back(static_cast<EdgeId>(e), a[e]);
+    }
+    return out;
+  };
+  for (int step = 0; step < 3000; ++step) {
+    std::vector<std::size_t> order(owners.size());
+    for (std::size_t i = 0; i < order.size(); ++i) order[i] = i;
+    std::shuffle(order.begin(), order.end(), rng);
+    order.resize(1 + rng() % owners.size());
+    std::vector<std::int64_t> ids;
+    std::vector<std::vector<detail::RecordDraft>> drafts;
+    std::vector<bool> retire;
+    std::vector<std::map<std::int64_t, std::vector<Amount>>> after = model;
+    std::vector<std::vector<FlowId>> want_ids;
+    std::int64_t id = next_id;
+    for (std::size_t o : order) {
+      ids.push_back(owners[o]);
+      retire.push_back(rng() % 3 == 0);
+      drafts.emplace_back();
+      after[o].clear();
+      if (!retire.back()) {
+        for (const auto& [rid, a] : model[o]) {
+          const auto kind = rng() % 4;
+          std::vector<Amount> b = a;
+          if (kind == 1) {
+            b[rng() % m] += 1;
+          } else if (kind == 2) {
+            b.assign(m, 0);
+          } else if (kind == 3) {
+            b = random_edges();
+          }
+          drafts.back().push_back(draft_on(dag, as_pairs(b), rid));
+          after[o][rid] = b;
+        }
+      }
+      want_ids.emplace_back();
+      const int fresh = static_cast<int>(rng() % 3);
+      for (int k = 0; k < fresh; ++k) {
+        const auto b = random_edges();
+        drafts.back().push_back(draft_on(dag, as_pairs(b)));
+        after[o][id] = b;
+        want_ids.back().emplace_back(fg.uid(), id++);
+      }
+    }
+    std::vector<Amount> total(m, 0);
+    for (const auto& recs : after) {
+      for (const auto& [rid, a] : recs) {
+        for (std::size_t e = 0; e < m; ++e) total[e] += a[e];
+      }
+    }
+    bool feasible = true;
+    for (std::size_t e = 0; e < m; ++e) feasible = feasible && total[e] <= g->edge_capacity_units()[e];
+    const LedgerState before_state = ledger_state(fg);
+    if (feasible) {
+      // Would the owners, one at a time in batch order, all pass alone?
+      std::vector<Amount> running = fg.carried();
+      bool alone = true;
+      for (std::size_t j = 0; j < order.size(); ++j) {
+        const auto o = order[j];
+        for (const auto& [rid, a] : model[o]) {
+          for (std::size_t e = 0; e < m; ++e) running[e] -= a[e];
+        }
+        for (const auto& [rid, a] : after[o]) {
+          for (std::size_t e = 0; e < m; ++e) running[e] += a[e];
+        }
+        for (std::size_t e = 0; e < m; ++e) alone = alone && running[e] <= g->edge_capacity_units()[e];
+      }
+      needs_batch += alone ? 0 : 1;
+      EXPECT_EQ(commit_batch(fg, ids, drafts, retire), want_ids) << "step " << step;
+      model = after;
+      next_id = id;
+      ++accepted;
+    } else {
+      std::vector<std::string> refusals;
+      for (std::size_t e = 0; e < m; ++e) {
+        if (total[e] <= g->edge_capacity_units()[e]) continue;
+        refusals.push_back("ledger: infeasible commit on edge " + std::to_string(e) + " (" + std::to_string(total[e]) +
+                           " of " + std::to_string(g->edge_capacity_units()[e]) + ")");
+      }
+      const std::string got = logic_error_of([&] { (void)commit_batch(fg, ids, drafts, retire); });
+      EXPECT_TRUE(std::find(refusals.begin(), refusals.end(), got) != refusals.end()) << "step " << step << ": " << got;
+      expect_same(ledger_state(fg), before_state, "step " + std::to_string(step));
+      ++rejected;
+    }
+    std::vector<Amount> want(m, 0);
+    std::map<std::int64_t, std::pair<std::int64_t, std::vector<std::pair<EdgeId, Amount>>>> want_records;
+    for (std::size_t q = 0; q < owners.size(); ++q) {
+      for (const auto& [rid, a] : model[q]) {
+        for (std::size_t e = 0; e < m; ++e) want[e] += a[e];
+        want_records[rid] = {owners[q], as_pairs(a)};
+      }
+    }
+    ASSERT_EQ(fg.carried(), want) << "step " << step;
+    ASSERT_EQ(LedgerAccess::next_record_counter(fg), next_id);
+    const auto records = fg.records();
+    ASSERT_EQ(records.size(), want_records.size()) << "step " << step;
+    for (const auto& r : records) {
+      const auto it = want_records.find(r.flow_id.second);
+      ASSERT_NE(it, want_records.end()) << "step " << step << ": record " << r.flow_id.second;
+      EXPECT_EQ(r.policy_id, it->second.first) << "step " << step;
+      EXPECT_EQ(r.edge_flows, it->second.second) << "step " << step;
+    }
+  }
+  EXPECT_GT(accepted, 500);
+  EXPECT_GT(rejected, 500);
+  EXPECT_GT(needs_batch, 50);
+  for (auto owner : owners) LedgerAccess::release(fg, owner);
+}
+
+TEST(FlowLedger, BatchHoldsMoveBetweenOwnersAtomically) {
+  // A holds 6 of a reservation baseline of 6; one batch moves the hold to B (A retires its
+  // record). B alone first would be refused; the batch passes. A batch that ends over the
+  // baseline is refused with the hold message and changes nothing.
+  auto g = shared(make_graph(2, {{0, 1, 10, 1}}));
+  const auto dag = all_edges(*g);
+  const std::vector<Amount> service {10};
+  const std::vector<Amount> reservation {6};
+  FlowLedger fg(g, service, reservation);
+  const auto a = LedgerAccess::bind(fg);
+  const auto b = LedgerAccess::bind(fg);
+  auto held_draft = [&](Amount flow, Amount hold) {
+    detail::RecordDraft d = draft_on(dag, {{0, flow}});
+    d.record.edge_reservations = {{0, hold}};
+    return d;
+  };
+  std::vector<detail::RecordDraft> first {held_draft(1, 6)};
+  (void)LedgerAccess::commit(fg, a, first);
+  std::vector<detail::RecordDraft> b_alone {held_draft(1, 6)};
+  EXPECT_EQ(logic_error_of([&] { (void)LedgerAccess::commit(fg, b, b_alone); }),
+            "ledger: infeasible reservation on edge 0 (12 of 6)");
+  std::vector<std::vector<detail::RecordDraft>> over {{}, {held_draft(1, 6)}};
+  over[0].push_back(held_draft(1, 1));
+  const LedgerState before = ledger_state(fg);
+  EXPECT_EQ(logic_error_of([&] { (void)commit_batch(fg, {a, b}, over, {true, false}); }),
+            "ledger: infeasible reservation on edge 0 (7 of 6)");
+  expect_same(ledger_state(fg), before, "the refused batch");
+  std::vector<std::vector<detail::RecordDraft>> move {{held_draft(2, 6)}, {}};
+  const auto created = commit_batch(fg, {b, a}, move, {false, true});
+  EXPECT_EQ(created, (std::vector<std::vector<FlowId>> {{{fg.uid(), 1}}, {}}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {2}));
+  EXPECT_EQ(fg.reserved(), (std::vector<Amount> {6}));
+  ASSERT_EQ(fg.records().size(), 1U);
+  EXPECT_EQ(fg.records()[0].policy_id, b);
+  (void)LedgerAccess::detach(fg, b);
+  LedgerAccess::release(fg, a);
+  LedgerAccess::release(fg, b);
+}
+
+TEST(FlowLedger, BatchRefusalsChangeNothing) {
+  // The batch's own refusals, each before anything changes: an unbound owner, an owner twice, a
+  // created list per owner, a commit that drops a live record, and the record ids of the whole
+  // batch counted first (each owner alone would fit the ids left).
+  auto g = shared(make_graph(2, {{0, 1, 9, 1}}));
+  const auto dag = all_edges(*g);
+  FlowLedger fg(g);
+  const auto a = LedgerAccess::bind(fg);
+  const auto b = LedgerAccess::bind(fg);
+  std::vector<detail::RecordDraft> first {draft_on(dag, {{0, 1}})};
+  const auto ids = LedgerAccess::commit(fg, a, first);
+  const LedgerState before = ledger_state(fg);
+  std::vector<std::vector<detail::RecordDraft>> two {{draft_on(dag, {{0, 1}})}, {draft_on(dag, {{0, 1}})}};
+  EXPECT_EQ(logic_error_of([&] { (void)commit_batch(fg, {b, 77}, two, {true, true}); }), "ledger: commit by an unbound owner");
+  EXPECT_EQ(logic_error_of([&] { (void)commit_batch(fg, {b, b}, two, {true, true}); }), "ledger: an owner twice in a batch");
+  std::vector<detail::OwnerDrafts> parts {{a, two[0], true}};
+  std::vector<std::vector<FlowId>> none;
+  EXPECT_EQ(logic_error_of([&] { LedgerAccess::commit_batch(fg, parts, none); }),
+            "ledger: a batch needs one id list per owner");
+  EXPECT_EQ(logic_error_of([&] { (void)commit_batch(fg, {b, a}, two, {true, false}); }),
+            "ledger: a commit must carry every live record of its policy");
+  expect_same(ledger_state(fg), before, "the malformed batches");
+  LedgerAccess::set_next_ids(fg, kLastId, 2);
+  const LedgerState one_left = ledger_state(fg);
+  EXPECT_EQ(runtime_error_of([&] { (void)commit_batch(fg, {a, b}, two, {true, true}); }), "record identity limit exceeded");
+  expect_same(ledger_state(fg), one_left, "two owners' new records, one id left");
+  std::vector<std::vector<detail::RecordDraft>> one {{draft_on(dag, {{0, 2}}, ids[0].second)}, {draft_on(dag, {{0, 1}})}};
+  EXPECT_EQ(commit_batch(fg, {a, b}, one, {false, false}), (std::vector<std::vector<FlowId>> {{}, {{fg.uid(), kLastId}}}));
+  EXPECT_EQ(fg.carried(), (std::vector<Amount> {3}));
+  (void)LedgerAccess::detach(fg, a);
+  (void)LedgerAccess::detach(fg, b);
+  LedgerAccess::release(fg, a);
+  LedgerAccess::release(fg, b);
+}
diff --git a/tests/cpp/flow_policy_fault_tests.cpp b/tests/cpp/flow_policy_fault_tests.cpp
new file mode 100644
index 0000000..0b08520
--- /dev/null
+++ b/tests/cpp/flow_policy_fault_tests.cpp
@@ -0,0 +1,2111 @@
+// Allocation-failure atomicity of the policy engine, the ShortestPathCache and the evaluators.
+// Exhaustive sweeps (each allocation fails once) cover the placement calls of the routing and
+// kernel modes below (supplied programs of split routes and of crossing tunnels, CentralizedTE with a
+// support among them), with and without a static Eligibility; the full-offer calls evaluate,
+// replace and forward (with black holes) of every mode; the zero and empty-roster calls; the
+// policy construction, with and without a supplied building cache and an Eligibility; the
+// ShortestPathCache construction and insertion; evaluate_demand() and evaluate_pairs() on one worker in every
+// mode (evaluate_pairs: every mode but Pinned), without options, with an Eligibility and, in the
+// ShortestPaths modes, with a supplied building cache; evaluate_edge_failures() on one worker in one mode per
+// routing model with the same options; and the frozen lookups. Sampled sweeps cover the other
+// modes' evaluate_edge_failures on one worker (every 11th allocation), the evaluators with 2 and 4 workers
+// and the frozen-cache statistics: every 7th (evaluate_pairs; every 5th on a frozen cache), 11th
+// (evaluate_edge_failures) or step-th allocation in the process, and every third allocation of the worker
+// threads only. The scratch-growth test sweeps every allocation of a placement on a 3,000-node
+// graph after warming up on a 3-node graph, on a fresh thread for each attempt. After each injected
+// std::bad_alloc the ledger (aggregate, residual, every record field, owners, next FlowId) and
+// the policy's epoch state (requested, +inf, CentralizedTE's cumulative curve, the installed program, the
+// by_tunnel rows, and per flow its id, route cost and plan: route, members, weights) equal their
+// state before the call; a clean retry gives
+// the reference result (no poisoned per-thread scratch); and remove() leaves the ledger as the
+// reference's own remove() does. No failed call leaves an allocation live once its attempt's
+// objects are gone (a supplied building cache with its kept entries included). remove(), a
+// policy's destruction and ShortestPathCache::clear() allocate nothing. A supplied building cache is a
+// memo: it keeps the complete entries of the lookups that succeeded before the failure (with
+// their misses), never a partial one. The hook's worker-only mode, which the sweeps with several
+// workers use, is checked against the caller's own allocations. Runs in the fault-injection
+// executable (fault_injection.hpp).
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <exception>
+#include <functional>
+#include <memory>
+#include <numeric>
+#include <new>
+#include <optional>
+#include <span>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "fault_injection.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/evaluator_checks.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::LedgerAccess;
+
+namespace {
+
+// Sources 0 and 1, destinations 5 and 6: three equal-cost routes with a parallel pair and a
+// shared middle, a costlier bypass, and a second destination. Two links of capacity 0 (inputs 11
+// and 12): 1 -> 6 ties source 1's other routes, so its shortest support (and every split there)
+// holds a zero-capacity member; 0 -> 5 is costlier than 0's routes and serves as an all-zero
+// Pinned route (a Weighted plan without a member).
+std::shared_ptr<const Graph> graph() {
+  return std::make_shared<const Graph>(
+      make_graph(7, {{0, 2, 6, 1}, {0, 3, 4, 1}, {1, 3, 5, 1}, {1, 4, 3, 1}, {2, 5, 3, 1}, {2, 5, 2, 1},
+                     {3, 5, 4, 1}, {4, 6, 9, 1}, {3, 6, 2, 2}, {0, 6, 3, 4}, {2, 4, 2, 1}, {1, 6, 0, 2},
+                     {0, 5, 0, 3}}));
+}
+
+struct Mode {
+  std::string name;
+  FlowPolicyConfig cfg;
+  std::vector<NodeId> sources;
+  std::vector<NodeId> destinations;
+  // The evaluators' offer (a T1 or Pinned Lossy evaluation requires a finite one; T2's takes a
+  // finite design instead).
+  std::optional<std::optional<Amount>> offered {};
+  // The tunnel models' design: the evaluators' design_demand and the design of their calls.
+  std::optional<std::optional<Amount>> design {};
+};
+
+// The evaluators' options of a mode.
+EvaluationOptions query_of(const Mode& m, const Eligibility* elig = nullptr, ShortestPathCache* cache = nullptr,
+                      OutputOptions outputs = {}) {
+  return EvaluationOptions {m.cfg, elig, cache, outputs, m.design, m.offered};
+}
+
+// A Pinned Lossy forwarding needs a finite offer (no first-hop experiment).
+bool finite_only(const Mode& m) {
+  return std::holds_alternative<Pinned>(m.cfg.routing) && m.cfg.admission == Admission::Lossy;
+}
+
+// ShortestPaths with an allocation and its other fields set by `edit`.
+FlowPolicyConfig shortest(RouteAllocation k, Admission a, const std::function<void(ShortestPaths&)>& edit = {}) {
+  ShortestPaths sp = shortest_paths(k);
+  if (edit) edit(sp);
+  return FlowPolicyConfig {sp, a};
+}
+
+std::vector<Mode> modes(const Graph& g) {
+  std::vector<Mode> out;
+  const std::vector<NodeId> S = {0, 1};
+  const std::vector<NodeId> D = {5, 6};
+  out.push_back({"shortest_paths maxflow", shortest(RouteAllocation::Optimized, Admission::Lossless), S, D});
+  out.push_back({"shortest_paths eb", shortest_paths_config(), S, D});
+  out.push_back({"shortest_paths weighted residual",
+                 shortest(RouteAllocation::Weighted, Admission::Lossless,
+                          [](ShortestPaths& sp) { sp.weight_basis = WeightBasis::ResidualSnapshot; }),
+                 S, D});
+  out.push_back({"shortest_paths lossy", shortest(RouteAllocation::Equal, Admission::Lossy), S, D});
+  // Several sources: the FEWER_HOPS single path (the pooled single-path rule rejects a HIGHER_*
+  // tie_break with multipath false).
+  out.push_back({"shortest_paths single path collapse",
+                 shortest(RouteAllocation::Equal, Admission::Lossless,
+                          [](ShortestPaths& sp) {
+                            sp.multipath = false;
+                            sp.parallel_edges = false;
+                          }),
+                 S, D});
+  out.push_back({"global", global_config(), S, D});
+  // The equal source allocation of the controllers: the bisection's probe solves and the final solve.
+  out.push_back({"global equal", {.routing = centralized(SourceAllocation::Equal)}, S, D});
+  for (bool support : {false, true}) {
+    CentralizedTE model(SourceAllocation::Weighted);
+    model.source_weights = std::make_shared<const std::vector<Amount>>(std::vector<Amount>{2,1,0,0,0,0,0});
+    if (support) model.support = all_edges(g);
+    out.push_back({support ? "weighted controller support" : "weighted controller", {.routing=model}, S, D});
+    model.source_weights = std::make_shared<const std::vector<Amount>>(static_cast<std::size_t>(g.num_nodes()),0);
+    out.push_back({support ? "zero weighted controller support" : "zero weighted controller", {.routing=model}, S, D});
+  }
+  {
+    CentralizedTE model(SourceAllocation::Weighted);
+    model.source_weights = std::make_shared<const std::vector<Amount>>(static_cast<std::size_t>(g.num_nodes()),kDomainLimit-1);
+    const auto program = evaluate_demand(g,S,D,EvaluationOptions{FlowPolicyConfig{model}}).program;
+    out.push_back({"wide weighted captured replay", {.routing=Pinned{program},.admission=Admission::Lossy},S,D,Amount{6}});
+  }
+  out.push_back({"shortest_paths maxflow equal",
+                 shortest(RouteAllocation::Optimized, Admission::Lossless,
+                          [](ShortestPaths& sp) { sp.source_allocation = SourceAllocation::Equal; }),
+                 S, D});
+  // Pooled Weighted Lossy: source 1's zero-capacity member has weight 0 (pruned), the shares
+  // attributed across the shared routers.
+  out.push_back({"shortest_paths weighted lossy", shortest(RouteAllocation::Weighted, Admission::Lossy), S, D});
+  // Pinned over supplied programs: three split routes of source 0 (one all-zero: a Weighted
+  // route without a member), Lossless Equal and Lossy Weighted; and two sources' crossing
+  // tunnels, Lossy, which meet on shared links (the general loss rule).
+  const auto inv = id_of_input(g);
+  const NodeId s0[1] = {0};
+  const NodeId d5[1] = {5};
+  const std::vector<RouteDefinition> split = {RouteDefinition {0, dag_of(g, {inv[0], inv[4], inv[5]}), 1},
+                                    RouteDefinition {0, dag_of(g, {inv[1], inv[6]}), 2}, RouteDefinition {0, dag_of(g, {inv[12]}), 1}};
+  RouteOptions weighted;
+  weighted.allocation = RouteAllocation::Weighted;
+  out.push_back({"pinned eb split routes",
+                 {.routing = Pinned {ForwardingProgram::from_routes(g, s0, d5, split), nullptr}}, {0}, {5}});
+  out.push_back({"pinned lossy",
+                 {.routing = Pinned {ForwardingProgram::from_routes(g, s0, d5, split, weighted), nullptr},
+                  .admission = Admission::Lossy},
+                 {0}, {5}, std::optional<Amount> {6}});
+  auto walk = [&](std::vector<std::size_t> inputs) {
+    std::vector<std::vector<EdgeId>> hops;
+    for (auto i : inputs) hops.push_back({inv[i]});
+    return std::make_shared<const Path>(g, hops);
+  };
+  const std::vector<RouteDefinition> crossing = {RouteDefinition {0, walk({0, 10, 7}), 2}, RouteDefinition {0, walk({1, 8}), 1},
+                                       RouteDefinition {1, walk({3, 7}), 1}, RouteDefinition {1, walk({2, 8}), 1}};
+  out.push_back({"pinned tunnels lossy",
+                 {.routing = Pinned {ForwardingProgram::from_routes(g, S, std::vector<NodeId> {6}, crossing), nullptr},
+                  .admission = Admission::Lossy},
+                 S, {6}, std::optional<Amount> {6}});
+  out.push_back({"global support", {.routing = centralized(SourceAllocation::Optimized, dag_of(g, {inv[0], inv[1], inv[4], inv[6], inv[2]}))}, S, D});
+  // Pinned over from_dag of the whole graph (a DAG): both sources pooled in one context, Lossless
+  // Equal and Lossy Weighted (the zero-capacity members pruned).
+  std::vector<EdgeId> every(static_cast<std::size_t>(g.num_edges()));
+  for (EdgeId e = 0; e < g.num_edges(); ++e) every[static_cast<std::size_t>(e)] = e;
+  const auto whole = dag_of(g, every);
+  out.push_back({"pinned from_dag eb", {.routing = Pinned {ForwardingProgram::from_dag(g, S, D, whole), nullptr}}, S, D});
+  out.push_back({"pinned from_dag weighted lossy",
+                 {.routing = Pinned {ForwardingProgram::from_dag(g, S, D, whole, weighted), nullptr}, .admission = Admission::Lossy},
+                 S, D, std::optional<Amount> {6}});
+  // ShortestPaths creation in one pass: its Collapse branch (multipath, parallel_edges false,
+  // HIGHER_AVAILABLE_CAPACITY on the creation view) and its Weighted weights (capacity basis).
+  out.push_back({"shortest_paths eb multipath collapse",
+                 shortest(RouteAllocation::Equal, Admission::Lossless,
+                          [](ShortestPaths& sp) {
+                            sp.tie_break = RouteTieBreak::HigherAvailableCapacity;
+                            sp.parallel_edges = false;
+                          }),
+                 S, D});
+  out.push_back({"shortest_paths weighted capacity", shortest(RouteAllocation::Weighted, Admission::Lossless), S, D});
+  out.push_back({"shortest_paths weighted explicit",
+                 shortest(RouteAllocation::Weighted, Admission::Lossy,
+                          [](ShortestPaths& sp) {
+                            sp.weight_basis = WeightBasis::Explicit;
+                            sp.edge_weights = std::make_shared<const std::vector<Amount>>(
+                                std::vector<Amount> {3, 1, 2, 2, 1, 4, 2, 1, 1, 5, 2, 7, 3});
+                          }),
+                 S, D});
+  return out;
+}
+
+// T1's modes: they take no place, so their sweeps are their own (T1 below). Lossless with two
+// tunnels per head; Lossy with three, HIGHER_AVAILABLE_CAPACITY on the unreserved view without
+// parallel links, a CostStretch ceiling and a search minimum.
+std::vector<Mode> t1_modes() {
+  const std::vector<NodeId> S = {0, 1};
+  const std::vector<NodeId> D = {5, 6};
+  std::vector<Mode> out;
+  out.push_back({"t1 lossless", {.routing = DistributedTE {TunnelCount {2}}}, S, D, std::nullopt, Amount {8}});
+  out.push_back({"t1 lossy",
+                 {.routing = DistributedTE {TunnelCount {3}, CostStretch(2), 1, RouteTieBreak::HigherAvailableCapacity, false},
+                  .admission = Admission::Lossy},
+                 S, D, Amount {6}, Amount {9}});
+  return out;
+}
+
+// T2's modes: no place either. Exact with prefer_headroom, Lossless (sizing, s*, the augmentation with
+// Phi, the decomposition, the lossless bound F); "up to" Lossy (every count's sizing, objectives
+// and budget, then the chosen count's layout).
+std::vector<Mode> t2_modes() {
+  const std::vector<NodeId> S = {0, 1};
+  const std::vector<NodeId> D = {5, 6};
+  std::vector<Mode> out;
+  out.push_back({"t2 exact headroom", {.routing = centralized(SourceAllocation::Equal, {}, TunnelCount {2}, true)}, S, D,
+                 std::nullopt, Amount {8}});
+  out.push_back({"t2 up to lossy", {.routing = centralized(SourceAllocation::Equal, {}, TunnelCount {2, true}), .admission = Admission::Lossy},
+                 S, D, Amount {6}, Amount {9}});
+  return out;
+}
+
+struct Scenario {
+  std::vector<std::optional<Amount>> before;
+  std::optional<Amount> call;
+  OutputOptions outputs;
+  std::string name;
+};
+
+std::vector<Scenario> scenarios() {
+  return {
+      {{}, 5, {}, "create"},
+      {{3}, 4, {}, "update"},
+      {{2}, std::nullopt, {}, "update to +inf"},
+      {{}, 7, {true, true, true}, "create with outputs"},
+      {{4}, 0, {true, true, true}, "zero with outputs"},
+  };
+}
+
+// The static Eligibility of g without the edge at input position `position`.
+Eligibility without_input_edge(const Graph& g, std::size_t position) {
+  const EdgeId excluded[] = {id_of_input(g)[position]};
+  return g.eligibility({}, excluded);
+}
+
+// graph() without the costly bypass 0 -> 6 (input 9), and without the cross edge 2 -> 4 (input
+// 10: evaluate_pairs's per-pair value, whose intersection with the first is a new value).
+Eligibility without_bypass(const Graph& g) { return without_input_edge(g, 9); }
+Eligibility without_cross(const Graph& g) { return without_input_edge(g, 10); }
+
+// A third party holding one unit on the first route's edges (CentralizedTE on that route as its support).
+std::unique_ptr<FlowPolicy> third_party(FlowLedger& fg, const Graph& g) {
+  const auto inv = id_of_input(g);
+  auto t = std::make_unique<FlowPolicy>(fg, std::vector<NodeId> {0}, std::vector<NodeId> {5},
+                                        FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(g, {inv[0], inv[4]}))});
+  (void)t->place(1);
+  return t;
+}
+
+} // namespace
+
+// The sweeps below reach the zero-capacity paths (not vacuous): source 1's ShortestPaths Equal
+// route holds the zero link 1 -> 6 as a member, and its failure study lists it; the all-zero Pinned
+// route is usable, with no member under the Weighted kernel.
+TEST(PolicyFaults, ZeroCapacityLinksTakePartInTheSweeps) {
+  const auto g = graph();
+  const auto inv = id_of_input(*g);
+  for (const auto& m : modes(*g)) {
+    FlowLedger fg(g);
+    FlowPolicy p(fg, m.sources, m.destinations, m.cfg);
+    (void)p.place(5);
+    const auto& pe = detail::PolicyAccess::engine(p);
+    if (m.name == "shortest_paths eb") {
+      // The pooled program of both sources holds the zero link as a member.
+      ASSERT_TRUE(pe.epoch.program != nullptr);
+      const auto& plan = *detail::ProgramAccess::data(*pe.epoch.program).split_contexts.front().prepared_route;
+      EXPECT_EQ(vec(plan.sources), (std::vector<NodeId> {0, 1}));
+      EXPECT_TRUE(std::find(plan.forwarding_edges.begin(), plan.forwarding_edges.end(), inv[11]) != plan.forwarding_edges.end());
+      const auto s = evaluate_edge_failures(*g, m.sources, m.destinations, query_of(m), 1);
+      EXPECT_TRUE(std::any_of(s.entries.begin(), s.entries.end(), [&](const auto& e) { return e.edge == inv[11]; }));
+    }
+    if (m.name == "pinned eb split routes" || m.name == "pinned lossy") {
+      // Three split routes, three records; the all-zero route keeps its Equal member and
+      // has none under the Weighted kernel.
+      ASSERT_EQ(pe.view.data->split_contexts.size(), 3U) << m.name;
+      ASSERT_EQ(pe.epoch.record_groups.size(), 3U) << m.name;
+      EXPECT_EQ(pe.view.prepared_route(2)->forwarding_edges.empty(), m.name == "pinned lossy") << m.name;
+    }
+  }
+}
+
+TEST(PolicyFaults, EveryAllocationOfEveryRoutingModeFailsAtomically) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  for (const auto& m : modes(*g)) {
+    for (const auto& sc : scenarios()) {
+      if (finite_only(m) && !sc.call.has_value()) continue;
+      for (const Eligibility* elig : {static_cast<const Eligibility*>(nullptr), &no_bypass}) {
+        const std::string where = m.name + " / " + sc.name + (elig != nullptr ? " / eligibility" : "");
+        // The third party, then the policy's earlier calls.
+        const auto setup = [&](FlowLedger& fg) {
+          auto third = std::shared_ptr<FlowPolicy>(third_party(fg, *g));
+          auto p = std::make_shared<FlowPolicy>(fg, m.sources, m.destinations, m.cfg, elig);
+          for (auto v : sc.before) (void)p->place(v);
+          FlowPolicy* policy = p.get();
+          return Staged {std::make_shared<std::pair<std::shared_ptr<FlowPolicy>, std::shared_ptr<FlowPolicy>>>(
+                             std::move(third), std::move(p)),
+                         policy};
+        };
+        const long injected =
+            sweep_placement(g, where, setup, [&](FlowPolicy& p) { return p.place(sc.call, sc.outputs); });
+        if (::testing::Test::HasFailure()) return;
+        EXPECT_GT(injected, 2) << where;  // not vacuous: every mode and scenario allocates
+      }
+    }
+  }
+}
+
+// The full-offer calls on a policy that has placed (its program installed): evaluate (nothing
+// published, the epoch untouched), replace (the old records retired and new ones created in one
+// exchange of the ledger; to zero, and to +inf when Lossless) and, for the computing models,
+// forward over the installed program, with and without black holes. Every allocation of the call
+// fails once, through the shared placement sweep: a failure changes neither the ledger nor the
+// epoch state and leaves no allocation live; the completing call, the retry and remove() leave the
+// ledger as the reference's do.
+TEST(PolicyFaults, EveryFullOfferCallFailsAtomically) {
+  const auto g = graph();
+  const auto inv = id_of_input(*g);
+  const EdgeId dark_edges[] = {inv[4], inv[6]};
+  const Eligibility dark = g->eligibility({}, dark_edges);
+  struct Op {
+    std::string name;
+    std::function<PlacementResult(FlowPolicy&)> call;
+  };
+  for (const auto& m : modes(*g)) {
+    const bool lossy = m.cfg.admission == Admission::Lossy;
+    const bool pinned = std::holds_alternative<Pinned>(m.cfg.routing);
+    std::vector<Op> ops = {{"evaluate", [](FlowPolicy& p) { return p.evaluate(6, std::nullopt, {true, true, true}); }},
+                           {"replace", [](FlowPolicy& p) { return p.replace(6, std::nullopt, {true, true, true}); }},
+                           {"replace to zero", [](FlowPolicy& p) { return p.replace(0); }}};
+    if (!lossy) ops.push_back({"replace +inf", [](FlowPolicy& p) { return p.replace(std::nullopt); }});
+    if (!pinned) {
+      ops.push_back({"forward", [](FlowPolicy& p) { return p.forward(6, nullptr, {true, true, true}); }});
+      ops.push_back({"forward black holes", [&](FlowPolicy& p) { return p.forward(6, &dark); }});
+    }
+    for (const auto& op : ops) {
+      const std::string where = m.name + " / " + op.name;
+      const auto setup = [&](FlowLedger& fg) {
+        auto third = std::shared_ptr<FlowPolicy>(third_party(fg, *g));
+        auto p = std::make_shared<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+        (void)p->place(3);
+        FlowPolicy* policy = p.get();
+        return Staged {std::make_shared<std::pair<std::shared_ptr<FlowPolicy>, std::shared_ptr<FlowPolicy>>>(
+                           std::move(third), std::move(p)),
+                       policy};
+      };
+      const long injected = sweep_placement(g, where, setup, op.call);
+      if (::testing::Test::HasFailure()) return;
+      EXPECT_GT(injected, 0) << where;  // not vacuous
+    }
+  }
+}
+
+// Lossy forwarding with links that wait on each other in a cycle: the rounds'
+// scratch, the independent check and the error path. CYC(x, y): tunnel 0 meets X (input edge 0)
+// before Y (input edge 3), tunnel 1 Y before X. With x = y = 1 the rounds settle: every
+// allocation of a replace(2) fails atomically. With weights 1, 2 and y = 2 the rounds alternate:
+// the period-two ValueError and every allocation failure before it publish nothing and leave no
+// allocation live.
+// Building a from_dag program: the k-th allocation fails for every k in turn, before and after a
+// complete build (nothing is cached between builds); a failure leaves no allocation live, and the
+// build that completes gives the reference program (its roster, entries and lossless bound).
+TEST(PolicyFaults, FromDagConstructionFailsCleanly) {
+  const auto g = graph();
+  std::vector<EdgeId> every(static_cast<std::size_t>(g->num_edges()));
+  for (EdgeId e = 0; e < g->num_edges(); ++e) every[static_cast<std::size_t>(e)] = e;
+  const auto whole = dag_of(*g, every);
+  const std::vector<NodeId> S = {0, 1};
+  const std::vector<NodeId> D = {5, 6};
+  RouteOptions weighted;
+  weighted.allocation = RouteAllocation::Weighted;
+  weighted.weight_basis = WeightBasis::ResidualSnapshot;
+  weighted.residual = std::vector<Amount>(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+  for (const auto& options : {RouteOptions {}, weighted}) {
+    const auto reference = ForwardingProgram::from_dag(*g, S, D, whole, options);
+    const auto bound = [&](const std::shared_ptr<const ForwardingProgram>& prog) {
+      FlowLedger fg(g);
+      FlowPolicy p(fg, S, D, {.routing = Pinned {prog, nullptr}});
+      return p.place(std::nullopt).call_delivered;
+    };
+    const Amount want = bound(reference);
+    EXPECT_GT(want, 0);
+    for (int round = 0; round < 2; ++round) {
+      long injected = 0;
+      for (long k = 0;; ++k) {
+        const long live = g_live.load();
+        std::shared_ptr<const ForwardingProgram> made;
+        if (!fails_at(k, [&] { made = ForwardingProgram::from_dag(*g, S, D, whole, options); })) {
+          ASSERT_TRUE(made);
+          EXPECT_EQ(made->sources().size(), reference->sources().size());
+          EXPECT_EQ(made->tunnels().size(), 0U);
+          EXPECT_EQ(bound(made), want);
+          break;
+        }
+        ++injected;
+        EXPECT_FALSE(made);
+        EXPECT_EQ(g_live.load(), live) << "allocation " << k;
+      }
+      EXPECT_GT(injected, 3);  // not vacuous
+    }
+  }
+}
+
+// Each failed preparation/buffering/publication is discarded; a retry on that
+// same thread yields the complete program, with cold and already-grown scratch.
+TEST(PolicyFaults, FromRoutesPreparationFailsCleanly) {
+  const auto g = graph();
+  std::vector<EdgeId> every(static_cast<std::size_t>(g->num_edges()));
+  std::iota(every.begin(), every.end(), EdgeId {0});
+  const auto whole = dag_of(*g, every);
+  const auto inv = id_of_input(*g);
+  const auto path = std::make_shared<const Path>(*g, std::vector<std::vector<EdgeId>> {{inv[0]}, {inv[4]}});
+  const std::vector<NodeId> sources {0, 1}, destinations {5, 6};
+  const std::vector<RouteDefinition> routes {{0, whole, 2}, {0, path, 1}, {1, whole, 3}, {0, whole, 0}};
+  RouteOptions capacity {.allocation = RouteAllocation::Weighted};
+  RouteOptions explicit_weights {.allocation = RouteAllocation::Weighted, .weight_basis = WeightBasis::Explicit,
+                                .edge_weights = std::vector<Amount>(every.size(), 0)};
+  (*explicit_weights.edge_weights)[static_cast<std::size_t>(inv[0])] = 2;
+  (*explicit_weights.edge_weights)[static_cast<std::size_t>(inv[4])] = 3;
+  RouteOptions snapshot {.allocation = RouteAllocation::Weighted, .weight_basis = WeightBasis::ResidualSnapshot,
+                        .residual = std::vector<Amount>(every.size(), 0)};
+  for (const auto& options : {RouteOptions {}, capacity, explicit_weights, snapshot}) {
+    const auto reference = ForwardingProgram::from_routes(*g, sources, destinations, routes, options);
+    const auto want = program_snapshot(reference.get());
+    for (const bool warm : {false, true}) {
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const long live = g_live.load();
+        bool failed = false;
+        std::thread worker([&] {
+          if (warm) (void)ForwardingProgram::from_routes(*g, sources, destinations, routes, options);
+          std::shared_ptr<const ForwardingProgram> made;
+          failed = fails_at(at, [&] { made = ForwardingProgram::from_routes(*g, sources, destinations, routes, options); });
+          if (failed) {
+            EXPECT_FALSE(made);
+            made = ForwardingProgram::from_routes(*g, sources, destinations, routes, options);
+          }
+          ASSERT_TRUE(made);
+          EXPECT_EQ(program_snapshot(made.get()), want);
+        });
+        worker.join();
+        EXPECT_EQ(g_live.load(), live) << "allocation " << at << ", warm " << warm;
+        if (::testing::Test::HasFailure()) return;
+        if (!failed) break;
+        ++injected;
+      }
+      EXPECT_GT(injected, 3);
+    }
+  }
+}
+
+TEST(PolicyFaults, CyclicLossyForwardingFailsAtomically) {
+  auto cyc = [](Amount x, Amount y) {
+    return shared(make_graph(6, {{0, 1, x, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, y, 1}, {3, 0, 1000, 1},
+                                 {3, 5, 1000, 1}, {4, 0, 1000, 1}, {4, 2, 1000, 1}}));
+  };
+  auto program = [](const Graph& g, Amount w1) {
+    const auto inv = id_of_input(g);
+    auto walk = [&](std::vector<std::size_t> inputs) {
+      std::vector<std::vector<EdgeId>> hops;
+      for (auto i : inputs) hops.push_back({inv[i]});
+      return std::make_shared<const Path>(g, hops);
+    };
+    const NodeId s[1] = {4};
+    const NodeId d[1] = {5};
+    const std::vector<RouteDefinition> routes = {RouteDefinition {4, walk({6, 0, 1, 3, 5}), 1}, RouteDefinition {4, walk({7, 3, 4, 0, 2}), w1}};
+    return ForwardingProgram::from_routes(g, s, d, routes);
+  };
+  auto config = [](std::shared_ptr<const ForwardingProgram> prog) {
+    return FlowPolicyConfig {.routing = Pinned {std::move(prog), nullptr}, .admission = Admission::Lossy};
+  };
+  const std::vector<NodeId> S = {4};
+  const std::vector<NodeId> D = {5};
+  {
+    const auto g = cyc(1, 1);
+    const auto prog = program(*g, 1);
+    const auto setup = [&](FlowLedger& fg) {
+      auto p = std::make_shared<FlowPolicy>(fg, S, D, config(prog));
+      FlowPolicy* policy = p.get();
+      return Staged {std::move(p), policy};
+    };
+    const long injected = sweep_placement(g, "converging cycle", setup, [](FlowPolicy& p) { return p.replace(2); });
+    EXPECT_GT(injected, 0);  // not vacuous
+  }
+  const auto g = cyc(1, 2);
+  const auto prog = program(*g, 2);
+  long injected = 0;
+  for (long at = 0;; ++at) {
+    const std::string w = "period two allocation " + std::to_string(at);
+    const long live = g_live.load();
+    bool completed = false;
+    {
+      FlowLedger fg(g);
+      FlowPolicy p(fg, S, D, config(prog));
+      const LedgerState initial = ledger_state(fg);
+      const Epoch initial_epoch = epoch(p);
+      bool raised = false;
+      if (fails_at(at, [&] {
+            try {
+              (void)p.replace(3);
+            } catch (const std::invalid_argument& e) {
+              raised = std::string(e.what()) == "lossy forwarding iteration entered a period-2 cycle";
+            }
+          })) {
+        ++injected;
+      } else {
+        EXPECT_TRUE(raised) << w;
+        completed = true;
+      }
+      expect_same(ledger_state(fg), initial, w);
+      expect_same(epoch(p), initial_epoch, w);
+    }
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    if (completed || ::testing::Test::HasFailure()) break;
+  }
+  EXPECT_GT(injected, 0);  // not vacuous
+}
+
+// The calls that place nothing publish only their outputs and, for a positive request, the
+// epoch's request: a zero request, and a positive or +inf request when no source reaches a
+// destination (an empty roster; the endpoints swapped: 5 and 6 have no out-edges). Each runs
+// through the shared placement sweep: a failure changes neither the ledger nor the epoch state and
+// leaves no allocation live; the completing call, the retry and remove() leave the ledger as the
+// reference's do.
+TEST(PolicyFaults, ZeroAndEmptyRosterCallsFailAtomically) {
+  const auto g = graph();
+  const OutputOptions all {true, true, true};
+  struct Case {
+    bool swap;
+    std::optional<Amount> offer;
+    std::string name;
+  };
+  const std::vector<Case> cases = {{false, 0, "zero"}, {true, 4, "empty roster"}, {true, std::nullopt, "empty roster +inf"}};
+  for (const auto& m : modes(*g)) {
+    if (std::holds_alternative<Pinned>(m.cfg.routing)) continue;  // a program binds its endpoints
+    for (const auto& c : cases) {
+      const auto& s = c.swap ? m.destinations : m.sources;
+      const auto& d = c.swap ? m.sources : m.destinations;
+      const std::string where = m.name + " / " + c.name;
+      const auto setup = [&](FlowLedger& fg) {
+        auto third = std::shared_ptr<FlowPolicy>(third_party(fg, *g));
+        auto p = std::make_shared<FlowPolicy>(fg, s, d, m.cfg);
+        if (c.swap) EXPECT_TRUE(detail::PolicyAccess::engine(*p).reachable_sources.empty()) << where;
+        FlowPolicy* policy = p.get();
+        return Staged {std::make_shared<std::pair<std::shared_ptr<FlowPolicy>, std::shared_ptr<FlowPolicy>>>(
+                           std::move(third), std::move(p)),
+                       policy};
+      };
+      const long injected = sweep_placement(g, where, setup, [&](FlowPolicy& p) { return p.place(c.offer, all); });
+      if (::testing::Test::HasFailure()) return;
+      EXPECT_GT(injected, 0) << where;  // not vacuous: every mode and case fails
+    }
+  }
+}
+
+TEST(PolicyFaults, ConstructionFailsWithoutBindingAndTheCacheStaysConsistent) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  for (const auto& m : modes(*g)) {
+    for (const int v : {0, 1, 2, 3}) {
+      const bool with_cache = (v & 1) != 0;
+      if (with_cache && !std::holds_alternative<ShortestPaths>(m.cfg.routing)) continue;  // rejected (below)
+      const Eligibility* elig = (v & 2) != 0 ? &no_bypass : nullptr;
+      const std::string variant = std::string(with_cache ? " cached" : "") + (elig != nullptr ? " eligibility" : "");
+      // The reference: a clean construction on a fresh ledger and cache, then place(2).
+      FlowLedger rf(g);
+      ShortestPathCache rc(*g);
+      FlowPolicy pr(rf, m.sources, m.destinations, m.cfg, elig, with_cache ? &rc : nullptr);
+      const ShortestPathCache::Stats fresh = rc.stats();
+      const PlacementResult want = pr.place(2);
+      const LedgerState after_place = ledger_state(rf);
+      long injected = 0;
+      int empty = 0;  // failures that left the supplied cache empty, and that left its whole entry
+      int whole = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = m.name + variant + " construction allocation " + std::to_string(at);
+        // Everything an attempt allocates (its ledger, cache, failed construction, then the clean
+        // construction and its placement) is freed when the attempt ends: the thread's scratch is
+        // already grown by the reference, so an allocation left live is a leak of the failed
+        // construction (a cache's kept entry is freed with the cache).
+        const long live = g_live.load();
+        {
+          FlowLedger fg(g);
+          ShortestPathCache cache(*g);
+          const LedgerState before = ledger_state(fg);
+          std::optional<FlowPolicy> p;
+          if (!fails_at(at, [&] { p.emplace(fg, m.sources, m.destinations, m.cfg, elig, with_cache ? &cache : nullptr); })) {
+            EXPECT_EQ(LedgerAccess::bound_policy_ids(fg).size(), 1U);
+            break;
+          }
+          ++injected;
+          EXPECT_FALSE(p.has_value()) << w;
+          expect_same(ledger_state(fg), before, w);
+          // A supplied cache holds whole entries only: none, or exactly the entries and bytes a
+          // clean construction leaves in a fresh cache; no policy holds a value any more.
+          const auto s = cache.stats();
+          EXPECT_LE(fresh.entries, 1) << w;
+          if (s.entries == 0) {
+            EXPECT_EQ(s.bytes, 0) << w;
+            ++empty;
+          } else {
+            EXPECT_EQ(s.entries, fresh.entries) << w;
+            EXPECT_EQ(s.bytes, fresh.bytes) << w;
+            ++whole;
+          }
+          EXPECT_EQ(s.live_values, s.entries) << w;
+          // A clean construction works, leaves the fresh cache's entries and places like the reference.
+          p.emplace(fg, m.sources, m.destinations, m.cfg, elig, with_cache ? &cache : nullptr);
+          EXPECT_EQ(cache.stats().entries, fresh.entries) << w;
+          EXPECT_EQ(cache.stats().bytes, fresh.bytes) << w;
+          expect_same(p->place(2), want, w);
+          expect_same(ledger_state(fg), after_place, w);
+          expect_balanced(fg, w);
+        }
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (::testing::Test::HasFailure()) return;
+      }
+      EXPECT_GT(injected, 0) << m.name << variant;  // not vacuous
+      // A mode that reads the supplied cache fails both before its entry exists and after.
+      if (fresh.entries == 1) {
+        EXPECT_GT(empty, 0) << m.name;
+        EXPECT_GT(whole, 0) << m.name;
+      }
+    }
+  }
+  // Every ShortestPaths mode reads the supplied cache (an entry after a clean construction), and the
+  // memo outcomes above are checked for every ShortestPaths mode; the other modes reject a cache before
+  // binding, without touching it.
+  for (const auto& m : modes(*g)) {
+    FlowLedger fg(g);
+    ShortestPathCache cache(*g);
+    if (std::holds_alternative<ShortestPaths>(m.cfg.routing)) {
+      const FlowPolicy p(fg, m.sources, m.destinations, m.cfg, nullptr, &cache);
+      EXPECT_EQ(cache.stats().entries, 1) << m.name;
+    } else {
+      EXPECT_THROW(FlowPolicy(fg, m.sources, m.destinations, m.cfg, nullptr, &cache), std::invalid_argument) << m.name;
+      EXPECT_EQ(cache.stats().entries, 0) << m.name;
+      EXPECT_TRUE(LedgerAccess::bound_policy_ids(fg).empty()) << m.name;
+    }
+  }
+}
+
+TEST(PolicyFaults, DagCacheInsertionIsAllOrNothing) {
+  const auto g = graph();
+  const std::vector<NodeId> roots = {5, 6};
+  {  // clean searches first grow this thread's search scratch, which outlives the attempts
+    ShortestPathCache warm(*g);
+    (void)warm.lookup(*g, std::vector<NodeId> {5}, Direction::Reverse, nullptr);
+    (void)warm.lookup(*g, roots, Direction::Reverse, nullptr);
+  }
+  long injected = 0;
+  for (long at = 0;; ++at) {
+    const std::string w = "lookup allocation " + std::to_string(at);
+    // Everything an attempt allocates (its cache and values, the retry) is freed when it ends, so
+    // an allocation left live is a leak of the failed lookup.
+    const long live = g_live.load();
+    bool failed = false;
+    {
+      ShortestPathCache cache(*g);
+      (void)cache.lookup(*g, std::vector<NodeId> {5}, Direction::Reverse, nullptr);  // one entry before
+      const auto before = cache.stats();
+      std::shared_ptr<const PredecessorDAG> got;
+      failed = fails_at(at, [&] { got = cache.lookup(*g, roots, Direction::Reverse, nullptr); });
+      if (!failed) {
+        EXPECT_EQ(cache.stats().entries, 2);
+      } else {
+        ++injected;
+        const auto s = cache.stats();
+        EXPECT_EQ(s.entries, before.entries) << w;
+        EXPECT_EQ(s.bytes, before.bytes) << w;
+        EXPECT_EQ(s.live_values, before.live_values) << w;
+        EXPECT_EQ(s.hits, before.hits) << w;
+        // The key is the lookup's first allocation: its failure counts nothing; a failed search (or
+        // insertion) after it counts its miss.
+        EXPECT_EQ(s.misses, before.misses + (at == 0 ? 0 : 1)) << w;
+        const auto v = cache.lookup(*g, roots, Direction::Reverse, nullptr);  // a clean retry inserts
+        EXPECT_EQ(cache.stats().entries, 2) << w;
+        EXPECT_TRUE(*v == detail::static_support(*g, roots, Direction::Reverse, nullptr)) << w;
+      }
+    }
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    if (!failed) break;
+  }
+  EXPECT_GE(injected, 2);  // the key (allocation 0) and at least one allocation after it
+}
+
+// A failed ShortestPathCache construction (its allocations: the counter of live values that every value's
+// deleter shares, and on MSVC the map's own) builds nothing and leaks nothing; clear() and
+// freeze()/thaw() make no allocation.
+TEST(PolicyFaults, DagCacheConstructionFailsWithoutALeakAndClearNeverAllocates) {
+  const auto g = graph();
+  long injected = 0;
+  for (long at = 0;; ++at) {
+    std::optional<ShortestPathCache> cache;
+    const long live = g_live.load();
+    if (!fails_at(at, [&] { cache.emplace(*g); })) {
+      ASSERT_TRUE(cache.has_value());
+      EXPECT_EQ(cache->stats().entries, 0);
+      break;
+    }
+    ++injected;
+    EXPECT_FALSE(cache.has_value()) << "allocation " << at;
+    EXPECT_EQ(g_live.load(), live) << "allocation " << at << ": a leak";
+  }
+  EXPECT_GE(injected, 1);  // the counter (MSVC's map adds its own)
+  ShortestPathCache cache(*g);
+  const auto held = cache.lookup(*g, std::vector<NodeId> {5}, Direction::Reverse, nullptr);
+  (void)cache.lookup(*g, std::vector<NodeId> {5, 6}, Direction::Reverse, nullptr);
+  ASSERT_EQ(cache.stats().entries, 2);
+  EXPECT_FALSE(fails_at(0, [&] {
+    cache.freeze();
+    cache.thaw();
+    cache.clear();
+  }));
+  const auto s = cache.stats();
+  EXPECT_EQ(s.entries, 0);
+  EXPECT_EQ(s.bytes, 0);
+  EXPECT_EQ(s.live_values, 1);  // the value held here outlives its entry
+}
+
+namespace {
+
+// The evaluators under a failure on `workers` threads: anywhere in the process (every `step`-th
+// allocation: 1 sweeps them all) or, with several workers, in the worker threads only (their
+// setup and their tasks; every third worker allocation, from the first). `setup` runs before each
+// attempt and `teardown` after it, both outside the failure; teardown frees what setup made (a
+// supplied building cache, whose kept entries are no leak). The failure propagates as
+// std::bad_alloc after every worker has joined, never terminating the process, and a clean retry
+// gives the reference. Each attempt leaves no allocation live: the workers' scratch ends with
+// their threads, and the caller computed the reference on its own thread first, which grew that
+// thread's scratch. Returns the number of injected failures.
+long sweep_evaluator(const std::string& name, std::int32_t workers, bool in_workers, long step,
+                     const std::function<void(std::int32_t)>& call, const std::function<void(std::int32_t)>& retry,
+                     const std::function<void()>& setup = [] {}, const std::function<void()>& teardown = [] {}) {
+  long failures = 0;
+  for (long at = 0;; at += in_workers ? 3 : step) {
+    const std::string w = name + " workers " + std::to_string(workers) + (in_workers ? " (worker threads)" : "") +
+                          " allocation " + std::to_string(at);
+    const long live = g_live.load();
+    setup();
+    const auto fn = [&] { call(workers); };
+    const bool failed = in_workers ? fails_in_workers_at(at, fn) : fails_at(at, fn);
+    if (failed) {
+      ++failures;
+      retry(workers);
+    }
+    teardown();
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    if (!failed) break;
+    if (::testing::Test::HasFailure()) {
+      ADD_FAILURE() << w;
+      break;
+    }
+  }
+  return failures;
+}
+
+// The options of an evaluator sweep: none, a static Eligibility (for evaluate_pairs also a
+// per-pair value, so each pair's intersection is a new value), or a supplied building cache (one
+// worker; a fresh cache before each attempt). A building cache is a memo: after a failed call it
+// holds whole entries only (no value alive outside it), some failed calls keep the entries of the
+// lookups that completed before the failure, and the retry leaves the entries of a clean call.
+struct Options {
+  std::string name;
+  const Eligibility* elig {nullptr};
+  const Eligibility* per_pair {nullptr};
+  bool cache {false};
+};
+
+std::vector<Options> option_sets(const Eligibility& no_bypass, const Eligibility& no_cross) {
+  return {{"", nullptr, nullptr, false}, {" eligibility", &no_bypass, &no_cross, false}, {" building cache", nullptr, nullptr, true}};
+}
+
+// A supplied building cache after a failed call: whole entries only, no more than a clean call
+// leaves.
+void expect_whole_entries(const ShortestPathCache::Stats& s, std::int64_t clean, const std::string& where) {
+  EXPECT_LE(s.entries, clean) << where;
+  EXPECT_EQ(s.live_values, s.entries) << where;
+  if (s.entries == 0) EXPECT_EQ(s.bytes, 0) << where;
+}
+
+void expect_whole_entries(const std::optional<ShortestPathCache>& cache, std::int64_t clean, const std::string& where) {
+  if (cache) expect_whole_entries(cache->stats(), clean, where);
+}
+
+long sweep_batch(const Mode& m, const Graph& g, std::span<const std::int32_t> workers_set, long step,
+                 const Options& o = {}) {
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {m.sources, m.destinations}, {{1}, {6}}, {{0}, {5}}};
+  const std::vector<const Eligibility*> per_pair(o.per_pair != nullptr ? pairs.size() : 0, o.per_pair);
+  std::optional<ShortestPathCache> cache;
+  const auto opts = [&] { return query_of(m, o.elig, cache ? &*cache : nullptr); };
+  if (o.cache) cache.emplace(g);
+  const auto want = evaluate_pairs(g, pairs, opts(), per_pair, 1);
+  const std::int64_t clean = cache ? cache->stats().entries : 0;
+  cache.reset();  // each attempt gets a fresh one (setup)
+  const std::string name = m.name + " batch" + o.name;
+  long kept = 0;  // failed calls whose cache kept the entries of the lookups before the failure
+  long attempts = 0;
+  for (const std::int32_t workers : workers_set) {
+    for (const bool in_workers : {false, true}) {
+      if (in_workers && workers == 1) continue;  // one worker runs on the calling thread
+      const long failures = sweep_evaluator(
+          name, workers, in_workers, step, [&](std::int32_t w) { (void)evaluate_pairs(g, pairs, opts(), per_pair, w); },
+          [&](std::int32_t w) {
+            expect_whole_entries(cache, clean, name + " failed call");
+            if (cache && cache->stats().entries > 0) ++kept;
+            const auto b = evaluate_pairs(g, pairs, opts(), per_pair, w);
+            ASSERT_EQ(b.size(), want.size());
+            for (std::size_t i = 0; i < b.size(); ++i) expect_same(b[i], want[i], name + " retry");
+            if (cache) EXPECT_EQ(cache->stats().entries, clean) << name << " retry";
+          },
+          [&] {
+            if (o.cache) cache.emplace(g);
+          },
+          [&] { cache.reset(); });
+      attempts += failures + 1;
+      EXPECT_GT(failures, 2) << name << " workers " << workers;  // not vacuous
+    }
+  }
+  if (o.cache) EXPECT_GT(kept, 0) << name;
+  return attempts;
+}
+
+long sweep_edge_failures(const Mode& m, const Graph& g, std::span<const std::int32_t> workers_set, long step,
+                       const Options& o = {}) {
+  std::optional<ShortestPathCache> cache;
+  const auto opts = [&] { return query_of(m, o.elig, cache ? &*cache : nullptr); };
+  if (o.cache) cache.emplace(g);
+  const auto want = evaluate_edge_failures(g, m.sources, m.destinations, opts(), 1);
+  const std::int64_t clean = cache ? cache->stats().entries : 0;
+  cache.reset();  // each attempt gets a fresh one (setup)
+  const std::string name = m.name + " sensitivity" + o.name;
+  long kept = 0;  // failed calls whose cache kept the entries of the lookups before the failure
+  long attempts = 0;
+  for (const std::int32_t workers : workers_set) {
+    for (const bool in_workers : {false, true}) {
+      if (in_workers && workers == 1) continue;
+      const long failures = sweep_evaluator(
+          name, workers, in_workers, step,
+          [&](std::int32_t w) { (void)evaluate_edge_failures(g, m.sources, m.destinations, opts(), w); },
+          [&](std::int32_t w) {
+            expect_whole_entries(cache, clean, name + " failed call");
+            if (cache && cache->stats().entries > 0) ++kept;
+            const auto s = evaluate_edge_failures(g, m.sources, m.destinations, opts(), w);
+            expect_same(s.baseline, want.baseline, name + " retry");
+            ASSERT_EQ(s.entries.size(), want.entries.size());
+            for (std::size_t i = 0; i < s.entries.size(); ++i) {
+              EXPECT_EQ(s.entries[i].edge, want.entries[i].edge) << name;
+              EXPECT_EQ(s.entries[i].delivery_reduction, want.entries[i].delivery_reduction) << name;
+            }
+          },
+          [&] {
+            if (o.cache) cache.emplace(g);
+          },
+          [&] { cache.reset(); });
+      attempts += failures + 1;
+      EXPECT_GT(failures, 2) << name << " workers " << workers;
+    }
+  }
+  if (o.cache) EXPECT_GT(kept, 0) << name;
+  return attempts;
+}
+
+} // namespace
+
+// The hook's worker-only mode, which every sweep of the evaluators with several workers relies on:
+// it counts and fails only the allocations of threads other than the caller's, so an allocation
+// of the calling thread neither fails nor advances the countdown (were the thread filter lost,
+// those sweeps would quietly fail any thread's allocations). reaches_in_workers_at accepts an
+// injected failure that reaches the caller or loses to another exception that fn handles, and
+// reports a std::bad_alloc that it did not inject.
+TEST(FaultHook, WorkerOnlyModeFailsOnlyWorkerAllocations) {
+  const auto caller_allocates = [] { ::operator delete(::operator new(8)); };
+  // Three allocations of the calling thread, then one of a worker, whose exception the caller
+  // rethrows after the join (as the evaluators do).
+  const auto worker_allocates = [](bool handle) {
+    for (int i = 0; i < 3; ++i) ::operator delete(::operator new(8));
+    std::exception_ptr error;
+    std::thread([&] {
+      try {
+        ::operator delete(::operator new(8));
+      } catch (...) {
+        error = std::current_exception();
+      }
+    }).join();
+    if (error && !handle) std::rethrow_exception(error);
+  };
+  EXPECT_EQ(failures_of([&] { EXPECT_FALSE(fails_in_workers_at(0, caller_allocates)); }), 0);
+  EXPECT_EQ(failures_of([&] { EXPECT_TRUE(fails_in_workers_at(0, [&] { worker_allocates(false); })); }), 0);
+  EXPECT_EQ(failures_of([&] { EXPECT_FALSE(fails_in_workers_at(1, [&] { worker_allocates(false); })); }), 0);
+  bool bad_alloc = false;
+  EXPECT_EQ(failures_of([&] { EXPECT_TRUE(reaches_in_workers_at(0, [&] { worker_allocates(false); }, bad_alloc)); }), 0);
+  EXPECT_TRUE(bad_alloc);
+  EXPECT_EQ(failures_of([&] { EXPECT_TRUE(reaches_in_workers_at(0, [&] { worker_allocates(true); }, bad_alloc)); }), 0);
+  EXPECT_FALSE(bad_alloc);  // lost to an outcome fn handled
+  EXPECT_EQ(failures_of([&] { EXPECT_FALSE(reaches_in_workers_at(0, caller_allocates, bad_alloc)); }), 0);
+  // A std::bad_alloc of fn's own while the armed worker failure is never reached.
+  EXPECT_EQ(failures_of([&] { (void)reaches_in_workers_at(1000, [] { throw std::bad_alloc(); }, bad_alloc); }), 1);
+}
+
+// Every allocation of evaluate_demand and evaluate_pairs on one worker fails once, for every mode, without
+// options, with a static Eligibility and (for ShortestPaths, the one routing model that reads a cache)
+// with a supplied building cache. evaluate_edge_failures repeats evaluate_demand's work once per candidate edge, so
+// its exhaustive sweep runs on one mode per routing model with the same options (every allocation
+// site of its own code: the deletion values, the intersections, the ShortestPaths skip, the per-
+// candidate cache clear); the other modes fail at every 11th allocation.
+TEST(PolicyFaults, EvaluatorsLeaveNoPoisonedScratch) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  const Eligibility no_cross = without_cross(*g);
+  const std::int32_t one[] = {1};
+  const std::vector<std::string> exhaustive_edge_failures = {"shortest_paths eb", "global", "pinned eb split routes",
+                                                           "pinned tunnels lossy"};
+  int swept_edge_failures = 0;
+  long attempts = 0;
+  for (const auto& m : modes(*g)) {
+    const bool reads_cache = std::holds_alternative<ShortestPaths>(m.cfg.routing);
+    const bool every_edge_failures_allocation =
+        std::find(exhaustive_edge_failures.begin(), exhaustive_edge_failures.end(), m.name) != exhaustive_edge_failures.end();
+    for (const auto& o : option_sets(no_bypass, no_cross)) {
+      if (o.cache && !reads_cache) continue;
+      const std::string name = m.name + " capacity" + o.name;
+      std::optional<ShortestPathCache> cache;
+      const auto copts = [&] {
+        return query_of(m, o.elig, cache ? &*cache : nullptr, OutputOptions {true, true, true});
+      };
+      if (o.cache) cache.emplace(*g);
+      const auto want = evaluate_demand(*g, m.sources, m.destinations, copts());
+      const std::int64_t clean = cache ? cache->stats().entries : 0;
+      if (o.cache) EXPECT_GT(clean, 0) << name;  // the cache is read
+      cache.reset();  // each attempt supplies a fresh one
+      long injected = 0;
+      long kept = 0;  // failed calls whose cache kept the entry of the lookup before the failure
+      long empty = 0;
+      for (long at = 0;; ++at) {
+        ++attempts;
+        const std::string w = name + " allocation " + std::to_string(at);
+        // Everything an attempt allocates is freed when it ends, the supplied cache with it (its
+        // kept entries are no leak), so an allocation left live is a leak of the failed call.
+        const long live = g_live.load();
+        if (o.cache) cache.emplace(*g);
+        bool failed = false;
+        {
+          PlacementResult got;
+          failed = fails_at(at, [&] { got = evaluate_demand(*g, m.sources, m.destinations, copts()); });
+          if (!failed) {
+            expect_same(got, want, name + " (no failure)");
+          } else {
+            ++injected;
+            expect_whole_entries(cache, clean, w);
+            if (cache) {
+              // The memo keeps a completed lookup's entry and its statistics: one miss per entry.
+              const auto s = cache->stats();
+              ++(s.entries > 0 ? kept : empty);
+              if (s.entries > 0) {
+                EXPECT_EQ(s.misses, s.entries) << w;
+                EXPECT_EQ(s.hits, 0) << w;
+              }
+            }
+            expect_same(evaluate_demand(*g, m.sources, m.destinations, copts()), want, w + " (retry)");
+            if (cache) EXPECT_EQ(cache->stats().entries, clean) << w;
+          }
+        }
+        cache.reset();
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (!failed) break;
+      }
+      EXPECT_GT(injected, 0) << name;  // not vacuous
+      if (o.cache) {
+        EXPECT_GT(kept, 0) << name;  // failures after the lookup, and before it
+        EXPECT_GT(empty, 0) << name;
+      }
+      if (!std::holds_alternative<Pinned>(m.cfg.routing)) attempts += sweep_batch(m, *g, one, 1, o);  // batch rejects Pinned
+      if (every_edge_failures_allocation) {
+        attempts += sweep_edge_failures(m, *g, one, 1, o);
+        ++swept_edge_failures;
+      } else if (o.elig == nullptr && !o.cache) {
+        attempts += sweep_edge_failures(m, *g, one, 11, o);
+      }
+      if (::testing::Test::HasFailure()) return;
+    }
+  }
+  RecordProperty("allocation_attempts", std::to_string(attempts));
+  EXPECT_EQ(swept_edge_failures, 3 * 2 + 3);  // three modes with two option sets, ShortestPaths's with three
+}
+
+namespace {
+
+// The evaluators at a finite offer: every allocation of evaluate_edge_failures (workers 1 and 2,
+// the calling thread's and the workers') and of evaluate_pairs fails once, and the retry on the
+// same, grown threads gives the clean result. `offers` gives each offer as a share of the model's
+// uncapped maximum: below (top / 2), at (top) or above (top + 3).
+long sweep_finite_offers(const Graph& g, const std::string& name, std::initializer_list<int> offers, int& swept) {
+  const std::int32_t workers[] = {1, 2};
+  long attempts = 0;
+  for (const auto& base : modes(g)) {
+    if (base.name != name) continue;
+    Mode uncapped = base;
+    uncapped.offered.reset();
+    const Amount top = evaluate_demand(g, base.sources, base.destinations, query_of(uncapped)).call_delivered;
+    EXPECT_GT(top, 2) << base.name;
+    for (const int which : offers) {
+      const Amount offer = which < 0 ? top / 2 : (which == 0 ? top : top + 3);
+      Mode m = base;
+      m.name = base.name + " offer " + std::to_string(offer);
+      m.offered = std::optional<std::optional<Amount>> {std::in_place, offer};
+      attempts += sweep_edge_failures(m, g, workers, 1);
+      attempts += sweep_batch(m, g, workers, 1);
+      ++swept;
+      if (::testing::Test::HasFailure()) return attempts;
+    }
+  }
+  return attempts;
+}
+
+} // namespace
+
+// Optimized CentralizedTE below and at its maximum (each deletion solved afresh at the binding
+// offer) and above it (the baseline is a maximum flow, repaired per deletion).
+TEST(PolicyFaults, FiniteOfferControllerFailureStudyFailsAtomically) {
+  const auto g = graph();
+  int swept = 0;
+  const long attempts = sweep_finite_offers(*g, "global", {-1, 0, 1}, swept);
+  EXPECT_EQ(swept, 3);
+  RecordProperty("allocation_attempts", std::to_string(attempts));
+}
+
+// The models that solve every deletion afresh, at a binding offer below their maximum.
+TEST(PolicyFaults, FiniteOfferEvaluatorsFailAtomically) {
+  const auto g = graph();
+  int swept = 0;
+  long attempts = 0;
+  for (const char* name : {"shortest_paths maxflow", "shortest_paths eb", "global equal"}) {
+    attempts += sweep_finite_offers(*g, name, {-1}, swept);
+    if (::testing::Test::HasFailure()) return;
+  }
+  EXPECT_EQ(swept, 3);
+  RecordProperty("allocation_attempts", std::to_string(attempts));
+}
+
+TEST(PolicyFaults, BatchWorkersFailWithoutTerminating) {
+  const auto g = graph();
+  const std::int32_t several[] = {2, 4};
+  for (const auto& m : modes(*g)) {
+    if (std::holds_alternative<Pinned>(m.cfg.routing)) continue;
+    sweep_batch(m, *g, several, 7);
+    if (::testing::Test::HasFailure()) return;
+  }
+}
+
+TEST(PolicyFaults, SensitivityWorkersFailWithoutTerminating) {
+  const auto g = graph();
+  const std::int32_t several[] = {2, 4};
+  long attempts = 0;
+  for (const auto& m : modes(*g)) {
+    attempts += sweep_edge_failures(m, *g, several, 11);
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("allocation_attempts", std::to_string(attempts));
+}
+
+TEST(PolicyFaults, RemovalAndReleaseNeverAllocate) {
+  const auto g = graph();
+  for (const auto& m : modes(*g)) {
+    FlowLedger fg(g);
+    auto p = std::make_unique<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+    expect_removal_and_release_allocate_nothing(fg, p, m.name);
+  }
+}
+
+// The working-residual overlay and the per-source scratch grow with the graph. Each attempt runs
+// on a new thread (its scratch empty) that first places on a 3-node graph, then the swept call on
+// a larger one, so every allocation of that call fails once while its scratch grows from the
+// small size; the failed call changes nothing, and a clean retry on the same thread and graph (or
+// the call itself, once no failure is reached) gives the reference call's result, every output
+// included, ledger and epoch (ASan reports any access outside a partly grown array). The same call
+// on a new thread whose scratch has first grown to the large graph allocates less: the sweep
+// reached the growth. `config` gives the policy's configuration on a graph.
+void expect_scratch_growth_failure_leaves_nothing_half_grown(
+    const std::string& name, const std::function<FlowPolicyConfig(const Graph&)>& config) {
+  SCOPED_TRACE(name);
+  const OutputOptions all {true, true, true};
+  const auto small = chain_graph(3, 5);
+  const auto large = chain_graph(3000, 5);
+  const std::int32_t n = large->num_nodes();
+  // The reference: the call on a fresh ledger without a failure.
+  PlacementResult want;
+  LedgerState want_state;
+  Epoch want_epoch;
+  {
+    FlowLedger fg(large);
+    FlowPolicy p(fg, std::vector<NodeId> {0}, std::vector<NodeId> {n - 1}, config(*large));
+    want = p.place(2, all);
+    want_state = ledger_state(fg);
+    want_epoch = epoch(p);
+  }
+  ASSERT_EQ(want.call_delivered, 2);  // the whole chain carries the request: the comparison is not of zeros
+  sweep_scratch_growth(
+      name + " placement",
+      [&] {
+        FlowLedger fg(small);
+        FlowPolicy p(fg, std::vector<NodeId> {0}, std::vector<NodeId> {2}, config(*small));
+        EXPECT_EQ(p.place(2, all).call_delivered, 2);
+      },
+      [&](long at, const std::string& w) {
+        FlowLedger fg(large);
+        FlowPolicy p(fg, std::vector<NodeId> {0}, std::vector<NodeId> {n - 1}, config(*large));
+        const LedgerState before = ledger_state(fg);
+        const Epoch before_epoch = epoch(p);
+        PlacementResult got;
+        const bool failed = fails_at(at, [&] { got = p.place(2, all); });
+        if (failed) {
+          expect_same(ledger_state(fg), before, w);
+          expect_same(epoch(p), before_epoch, w);
+          got = p.place(2, all);
+        }
+        expect_same(got, want, w);
+        expect_same(ledger_state(fg), want_state, w);
+        expect_same(epoch(p), want_epoch, w);
+        expect_balanced(fg, w);
+        return failed;
+      },
+      [&] {
+        FlowLedger fg(large);
+        FlowPolicy p(fg, std::vector<NodeId> {0}, std::vector<NodeId> {n - 1}, config(*large));
+        (void)p.place(2, all);  // the scratch grows to the large graph
+        p.remove();
+        long warm = 0;
+        while (fails_at(warm, [&] {
+          (void)p.place(2, all);
+          p.remove();
+        })) {
+          ++warm;
+        }
+        return warm;
+      });
+}
+
+// A split kernel's placement (ShortestPaths Equal): the working residual and the kernels'
+// scratch.
+TEST(PolicyFaults, ScratchGrowthFailureLeavesNothingHalfGrown) {
+  expect_scratch_growth_failure_leaves_nothing_half_grown("shortest_paths eb",
+                                                          [](const Graph&) { return shortest_paths_config(); });
+}
+
+// A controller's placement also grows the decomposition's per-thread scratch (cursors, range ends,
+// destination and slot marks, each grown on its own): CentralizedTE over every edge (positions are
+// EdgeIds) and CentralizedTE on a support (positions index the support).
+TEST(PolicyFaults, ControllerScratchGrowthFailureLeavesNothingHalfGrown) {
+  expect_scratch_growth_failure_leaves_nothing_half_grown("global", [](const Graph&) { return global_config(); });
+  if (::testing::Test::HasFailure()) return;
+  expect_scratch_growth_failure_leaves_nothing_half_grown("global support", [](const Graph& g) {
+    return FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, all_edges(g))};
+  });
+  for (bool support : {false,true}) {
+    expect_scratch_growth_failure_leaves_nothing_half_grown("weighted controller", [support](const Graph& g) {
+      CentralizedTE model(SourceAllocation::Weighted);
+      model.source_weights=std::make_shared<const std::vector<Amount>>(static_cast<std::size_t>(g.num_nodes()),kDomainLimit-1);
+      if(support)model.support=all_edges(g);
+      return FlowPolicyConfig{model};
+    });
+  }
+}
+
+TEST(PolicyFaults, WeightedSourceHeapAndWideReplayFailAtomically) {
+  std::vector<InEdge> edges;std::vector<NodeId> heads;
+  for(int i=0;i<17;++i){edges.push_back({i,17,5,1});heads.push_back(i);}
+  const auto g=std::make_shared<const Graph>(make_graph(18,edges));
+  const auto model=[&] {
+    CentralizedTE m(SourceAllocation::Weighted);
+    m.source_weights=std::make_shared<const std::vector<Amount>>(18,kDomainLimit-1);
+    return FlowPolicyConfig{m};
+  };
+  const auto program=evaluate_demand(*g,heads,std::vector<NodeId>{17},EvaluationOptions{model()}).program;
+  for(bool replay:{false,true})for(bool support:{false,true})for(int stage:{0,1,2}) {
+    const auto setup=[&](FlowLedger& ledger) {
+      auto cfg=model();
+      if(support)std::get<CentralizedTE>(cfg.routing).support=all_edges(*g);
+      if(replay)cfg=FlowPolicyConfig{Pinned{program},Admission::Lossy};
+      auto p=std::make_shared<FlowPolicy>(ledger,heads,std::vector<NodeId>{17},cfg);
+      if(stage!=0){(void)p->place(1);if(stage==1)p->remove();}
+      auto* raw=p.get();return Staged{p,raw};
+    };
+    EXPECT_GT(sweep_placement(g,"weighted heap/wide cold removed live",setup,[&](FlowPolicy& p){return p.place(stage==2 ? 15 : 16,{true,true,true,true,true});}),0);
+    if(::testing::Test::HasFailure())return;
+  }
+  // Finite16 over17 equal weights forces a heap remainder on each evaluator worker.
+  EvaluationOptions options{model(),nullptr,nullptr,{true,true,true,true,true},{},Amount{16}};
+  for(int workers:{2,4})for(bool warm:{false,true}) {
+    const std::vector<std::pair<std::vector<NodeId>,std::vector<NodeId>>> pairs(static_cast<std::size_t>(2*workers),{heads,{17}});
+    const auto expected=evaluate_pairs(*g,pairs,options,{},workers);
+    long failures=0;
+    for(long at=0;;++at) {
+      const auto live=g_live.load();bool failed=false;
+      std::thread attempt([&] {
+        if(warm)(void)evaluate_pairs(*g,pairs,options,{},workers);
+        std::vector<PlacementResult> got;
+        failed=fails_in_workers_at(at,[&]{got=evaluate_pairs(*g,pairs,options,{},workers);});
+        if(failed){EXPECT_TRUE(got.empty());got=evaluate_pairs(*g,pairs,options,{},workers);}
+        ASSERT_EQ(got.size(),expected.size());
+        for(std::size_t i=0;i<got.size();++i)expect_same(got[i],expected[i],"weighted heap worker retry");
+      });
+      attempt.join();EXPECT_EQ(g_live.load(),live);
+      if(!failed||::testing::Test::HasFailure())break;
+      ++failures;
+    }
+    EXPECT_GT(failures,17);
+    if(::testing::Test::HasFailure())return;
+  }
+}
+
+TEST(PolicyFaults, FrozenLookupsFailWithoutCounting) {
+  // Small queries own a stack copy; larger queries own a vector before waiting
+  // for the lease. A miss also builds its message, all before counting:
+  // a failure there counts nothing and changes no entry; a clean retry counts.
+  for (bool large : {false, true}) {
+    const auto g = large ? std::make_shared<const Graph>(12, std::vector<NodeId>{}, std::vector<NodeId>{},
+        std::vector<Amount>{}, std::vector<Cost>{}, 1.0) : graph();
+    ShortestPathCache cache(*g);
+    const std::vector<NodeId> unsorted = large ? std::vector<NodeId>{9,8,7,6,5,4,3,2,1,0} : std::vector<NodeId>{6,5};
+    auto sorted = unsorted;
+    std::sort(sorted.begin(), sorted.end());
+    const std::vector<NodeId> absent = large ? std::vector<NodeId>{11} : std::vector<NodeId>{5};
+    const auto value = cache.lookup(*g, unsorted, Direction::Reverse, nullptr);
+    cache.freeze();
+    for (const int kind : {0, 1, 2}) {  // a hit on unsorted roots, a hit on a sorted set, a miss
+      const bool hit = kind != 2;
+      const auto& present = kind == 0 ? unsorted : sorted;
+      long failures = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = std::string(hit ? "hit" : "miss") + " allocation " + std::to_string(at);
+        const long live = g_live.load();
+        const auto before = cache.stats();
+        bool missed = false;
+        const auto call = [&] {
+          try {
+            if (cache.lookup(*g, hit ? present : absent, Direction::Reverse, nullptr).get() != value.get()) ADD_FAILURE();
+          } catch (const ShortestPathCacheMiss&) {
+            missed = true;
+          }
+        };
+        const bool failed = fails_at(at, call);
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";  // the key and the miss's message are gone
+        const auto s = cache.stats();
+        EXPECT_EQ(s.entries, 1) << w;
+        EXPECT_EQ(s.bytes, before.bytes) << w;
+        EXPECT_EQ(s.live_values, before.live_values) << w;
+        if (failed) {
+          ++failures;
+          EXPECT_EQ(s.hits, before.hits) << w;
+          EXPECT_EQ(s.misses, before.misses) << w;
+          // A clean retry on the same thread after every failed allocation.
+          bool retry_missed = false;
+          try {
+            EXPECT_EQ(cache.lookup(*g, hit ? present : absent, Direction::Reverse, nullptr).get(), value.get());
+          } catch (const ShortestPathCacheMiss&) { retry_missed = true; }
+          EXPECT_EQ(retry_missed, !hit) << w;
+          EXPECT_EQ(cache.stats().hits - s.hits, hit ? 1 : 0) << w;
+          EXPECT_EQ(cache.stats().misses - s.misses, hit ? 0 : 1) << w;
+          continue;
+        }
+        EXPECT_EQ(missed, !hit) << w;
+        EXPECT_EQ(s.hits - before.hits, hit ? 1 : 0) << w;
+        EXPECT_EQ(s.misses - before.misses, hit ? 0 : 1) << w;
+        break;
+      }
+      if (hit && !large) {
+        EXPECT_EQ(failures, 0) << "small owned query";
+      } else {
+        EXPECT_GE(failures, hit ? 1 : 2) << (hit ? "large query copy" : "miss message");
+      }
+    }
+  }
+}
+
+namespace {
+
+void expect_stats(const ShortestPathCache::Stats& got, const ShortestPathCache::Stats& want, const std::string& where) {
+  EXPECT_EQ(stats_of(got), stats_of(want)) << where << " (hits, misses, entries, bytes, live values)";
+}
+
+// One public call reading a supplied frozen cache, under every injected failure (every `step`-th
+// allocation in any thread, or every third in the worker threads only): a call failing with
+// std::bad_alloc leaves all five statistics as they were and no allocation live; the call that
+// completes adds exactly `hits` hits, or, when its outcome is the ShortestPathCacheMiss (`miss`), exactly
+// one miss and no hit. A clean call before the sweep grows the calling thread's scratch, which
+// outlives the attempts (the workers' scratch ends with their threads). Returns the number of
+// injected failures.
+long sweep_frozen_stats(const std::string& name, const ShortestPathCache& cache, bool in_workers, long step, std::int64_t hits,
+                        bool miss, const std::function<void()>& call) {
+  try {
+    call();
+  } catch (const ShortestPathCacheMiss&) {
+  }
+  long failures = 0;
+  for (long at = 0;; at += in_workers ? 3 : step) {
+    const std::string w = name + " allocation " + std::to_string(at) + (in_workers ? " (worker threads)" : "");
+    const long live = g_live.load();
+    const auto before = cache.stats();
+    bool missed = false;
+    const auto fn = [&] {
+      try {
+        call();
+      } catch (const ShortestPathCacheMiss&) {
+        missed = true;
+      }
+    };
+    const bool failed = in_workers ? fails_in_workers_at(at, fn) : fails_at(at, fn);
+    EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+    auto want = before;
+    if (failed) {
+      ++failures;
+      EXPECT_FALSE(missed) << w;
+    } else {
+      EXPECT_EQ(missed, miss) << w;
+      if (miss) {
+        want.misses += 1;
+      } else {
+        want.hits += hits;
+      }
+    }
+    expect_stats(cache.stats(), want, w);
+    if (!failed || ::testing::Test::HasFailure()) break;
+  }
+  return failures;
+}
+
+} // namespace
+
+// The cache comparisons of the sweeps report each defect they exist for: expect_stats any one of
+// the five statistics changed; expect_whole_entries more entries than a clean call leaves, a
+// value alive outside the cache, and payload bytes without an entry.
+TEST(PolicyFaults, TheCacheComparatorsReportEveryDefect) {
+  const ShortestPathCache::Stats s {3, 2, 1, 40, 1};
+  EXPECT_EQ(failures_of([&] { expect_stats(s, s, "same"); }), 0);
+  const std::vector<std::function<void(ShortestPathCache::Stats&)>> fields = {
+      [](auto& x) { ++x.hits; },    [](auto& x) { ++x.misses; },      [](auto& x) { ++x.entries; },
+      [](auto& x) { ++x.bytes; },   [](auto& x) { ++x.live_values; },
+  };
+  for (std::size_t k = 0; k < fields.size(); ++k) {
+    ShortestPathCache::Stats x = s;
+    fields[k](x);
+    EXPECT_GT(failures_of([&] { expect_stats(x, s, "stats"); }), 0) << "statistic " << k;
+  }
+  EXPECT_EQ(failures_of([&] { expect_whole_entries(s, 1, "whole"); }), 0);
+  EXPECT_EQ(failures_of([&] { expect_whole_entries(ShortestPathCache::Stats {0, 0, 0, 0, 0}, 1, "empty"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_whole_entries(s, 0, "more entries than a clean call"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_whole_entries(ShortestPathCache::Stats {3, 2, 1, 40, 2}, 1, "a value outside"); }), 0);
+  EXPECT_GT(failures_of([&] { expect_whole_entries(ShortestPathCache::Stats {3, 2, 0, 40, 0}, 1, "bytes, no entry"); }), 0);
+}
+
+TEST(PolicyFaults, FrozenStatisticsFollowThePublicCall) {
+  // A frozen cache's statistics are observable state (the memo allowance of a building cache
+  // does not cover them). Every public call that can read a supplied frozen cache is swept: the
+  // policy constructor and evaluate_demand in every ShortestPaths mode (the other models reject a cache before
+  // reading it, statistics unchanged); evaluate_pairs at 1, 2 and 4 workers, in any
+  // thread and in the worker threads only, with and without a miss; ShortestPaths' failure study without
+  // a re-evaluated deletion at 1, 2 and 4 workers in any thread; and ShortestPaths' failure study whose
+  // deletions miss at 1 worker in any thread and at 2 and 4 workers in the worker threads only.
+  // Hits, misses, entries, bytes and live values after a failed call equal those before it.
+  const auto g = graph();
+  const auto all = modes(*g);
+  ShortestPathCache cache(*g);
+  for (const auto& t : {std::vector<NodeId> {5, 6}, std::vector<NodeId> {6}, std::vector<NodeId> {5}}) {
+    (void)cache.lookup(*g, t, Direction::Reverse, nullptr);
+  }
+  cache.freeze();
+  const auto reads = [](const Mode& m) -> std::int64_t { return std::holds_alternative<ShortestPaths>(m.cfg.routing) ? 1 : 0; };
+  for (const auto& m : all) {
+    if (!std::holds_alternative<ShortestPaths>(m.cfg.routing)) {
+      const auto before = cache.stats();
+      FlowLedger fg(g);
+      EXPECT_THROW(FlowPolicy(fg, m.sources, m.destinations, m.cfg, nullptr, &cache), std::invalid_argument) << m.name;
+      EXPECT_THROW((void)evaluate_demand(*g, m.sources, m.destinations, query_of(m, nullptr, &cache)),
+                   std::invalid_argument)
+          << m.name;
+      expect_stats(cache.stats(), before, m.name + " rejected");
+      continue;
+    }
+    const long built = sweep_frozen_stats(m.name + " frozen construction", cache, false, 1, reads(m), false, [&] {
+      FlowLedger fg(g);
+      FlowPolicy p(fg, m.sources, m.destinations, m.cfg, nullptr, &cache);
+    });
+    EXPECT_GT(built, 2) << m.name;
+    const EvaluationOptions opts {m.cfg, nullptr, &cache, OutputOptions {true, true, true}};
+    const long frozen_failures = sweep_frozen_stats(m.name + " frozen capacity", cache, false, 3, reads(m), false,
+                                           [&] { (void)evaluate_demand(*g, m.sources, m.destinations, opts); });
+    EXPECT_GT(frozen_failures, 2) << m.name;
+    if (::testing::Test::HasFailure()) return;
+  }
+  // A ShortestPaths policy whose key is absent: the constructor's outcome is the miss.
+  const auto& eb = all[1];  // shortest_paths eb
+  ASSERT_TRUE(std::holds_alternative<ShortestPaths>(eb.cfg.routing));
+  const std::vector<NodeId> absent = {4};
+  EXPECT_GT(sweep_frozen_stats("frozen construction miss", cache, false, 1, 0, true,
+                               [&] {
+                                 FlowLedger fg(g);
+                                 FlowPolicy p(fg, eb.sources, absent, eb.cfg, nullptr, &cache);
+                               }),
+            1);
+  const EvaluationOptions shared {eb.cfg, nullptr, &cache};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {eb.sources, eb.destinations}, {{1}, {6}}, {{0}, {5}}};
+  // Pair 0 hits, pair 1 misses: a lower pair's hit is not kept by the failed batch.
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> with_miss = {{eb.sources, eb.destinations},
+                                                                                     {{0}, absent}};
+  for (const std::int32_t workers : {1, 2, 4}) {
+    for (const bool in_workers : {false, true}) {
+      if (in_workers && workers == 1) continue;  // one worker runs on the calling thread
+      const std::string w = " workers " + std::to_string(workers);
+      EXPECT_GT(sweep_frozen_stats("frozen batch" + w, cache, in_workers, 5, 3, false,
+                                   [&] { (void)evaluate_pairs(*g, pairs, shared, {}, workers); }),
+                2)
+          << w;
+      EXPECT_GT(sweep_frozen_stats("frozen batch with a miss" + w, cache, in_workers, 3, 0, true,
+                                   [&] { (void)evaluate_pairs(*g, with_miss, shared, {}, workers); }),
+                1)
+          << w;
+      if (::testing::Test::HasFailure()) return;
+    }
+    // ShortestPaths' failure study from a source that reaches no destination: one lookup (the baseline's
+    // hit), no placed deletion, and the call succeeds; its failures happen after the hit.
+    EXPECT_GT(sweep_frozen_stats("frozen shortest_paths sensitivity" + std::string(" workers ") + std::to_string(workers),
+                                 cache, false, 3, 1, false,
+                                 [&] {
+                                   (void)evaluate_edge_failures(*g, std::vector<NodeId> {5}, std::vector<NodeId> {6},
+                                                     EvaluationOptions {eb.cfg, nullptr, &cache}, workers);
+                                 }),
+              2);
+  }
+  // ShortestPaths' failure study whose deletions miss (a fresh uid per deletion): the baseline's hit is
+  // dropped with the failed call, and the miss counts once.
+  const auto shortest_paths_miss = [&](std::int32_t workers) {
+    (void)evaluate_edge_failures(*g, eb.sources, eb.destinations, EvaluationOptions {eb.cfg, nullptr, &cache}, workers);
+  };
+  EXPECT_GT(sweep_frozen_stats("frozen shortest_paths sensitivity miss", cache, false, 1, 0, true, [&] { shortest_paths_miss(1); }),
+            2);
+  // The same with the deletions evaluated by 2 and 4 workers, every third allocation of the
+  // worker threads failing. The tasks start in increasing index and the lowest failing index's
+  // exception is raised, so an injected failure either is raised (nothing counted) or loses to a
+  // lower deletion's miss (the miss counted once, no hit).
+  for (const std::int32_t workers : {2, 4}) {
+    const std::string w = "frozen shortest_paths sensitivity miss, worker threads, workers " + std::to_string(workers);
+    long reached = 0, surfaced = 0;
+    for (long at = 0;; at += 3) {
+      const std::string where = w + " allocation " + std::to_string(at);
+      const long live = g_live.load();
+      const auto before = cache.stats();
+      bool missed = false;
+      bool bad_alloc = false;
+      const bool hit = reaches_in_workers_at(
+          at,
+          [&] {
+            try {
+              shortest_paths_miss(workers);
+            } catch (const ShortestPathCacheMiss&) {
+              missed = true;
+            }
+          },
+          bad_alloc);
+      EXPECT_EQ(g_live.load(), live) << where << ": a leak";
+      EXPECT_NE(missed, bad_alloc) << where;  // one outcome or the other
+      surfaced += hit && bad_alloc ? 1 : 0;
+      auto want = before;
+      if (missed) want.misses += 1;
+      expect_stats(cache.stats(), want, where);
+      if (!hit || ::testing::Test::HasFailure()) break;
+      ++reached;
+    }
+    EXPECT_GT(reached, 2) << w;
+    EXPECT_GT(surfaced, 0) << w;
+  }
+  EXPECT_EQ(cache.stats().entries, 3);
+}
+
+TEST(PolicyFaults, WorkersSharingAFrozenCacheFailCleanly) {
+  // evaluate_pairs with a frozen cache shared by two and four workers, a failure anywhere or in
+  // the worker threads only, then ShortestPaths' failure study with that cache on one worker (its
+  // statistics with two and four workers: the test above): the failure propagates as
+  // std::bad_alloc after the join, the cache keeps its entries, and a clean retry gives the
+  // reference. CentralizedTE's failure study, which reads no cache, rejects it before any worker starts.
+  const auto g = graph();
+  const auto all = modes(*g);
+  const auto& m = all[1];  // shortest_paths eb: reads the cache
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {m.sources, m.destinations}, {{1}, {6}}, {{0}, {5}}};
+  ShortestPathCache cache(*g);
+  for (const auto& [s, t] : pairs) (void)cache.lookup(*g, t, Direction::Reverse, nullptr);
+  const auto entries = cache.stats().entries;
+  cache.freeze();
+  const auto want = evaluate_pairs(*g, pairs, query_of(m), {}, 1);
+  const EvaluationOptions shared {m.cfg, nullptr, &cache};
+  for (const std::int32_t workers : {2, 4}) {
+    for (const bool in_workers : {false, true}) {
+      const long failures = sweep_evaluator(
+          "frozen batch", workers, in_workers, 5,
+          [&](std::int32_t w) { (void)evaluate_pairs(*g, pairs, shared, {}, w); },
+          [&](std::int32_t w) {
+            EXPECT_EQ(cache.stats().entries, entries);
+            const auto b = evaluate_pairs(*g, pairs, shared, {}, w);
+            ASSERT_EQ(b.size(), want.size());
+            for (std::size_t i = 0; i < b.size(); ++i) expect_same(b[i], want[i], "frozen batch retry");
+          });
+      EXPECT_GT(failures, 2) << "frozen batch workers " << workers;
+    }
+  }
+  // ShortestPaths' failure study through a frozen cache: every re-evaluated deletion misses (a fresh
+  // uid), so the reference outcome is the ShortestPathCacheMiss itself (its key; the uid is fresh per
+  // call). With one worker an injected failure before that miss gives std::bad_alloc, and the
+  // retry raises the same miss. (With several workers a lower candidate's miss may win over a
+  // worker's std::bad_alloc: the lowest index's exception is raised.)
+  const auto key_of = [](const ShortestPathCacheMiss& e) {
+    const std::string w = e.what();
+    return w.substr(0, w.find(", Eligibility uid "));
+  };
+  const auto shortest_paths_edge_failures = [&](std::int32_t w) {
+    (void)evaluate_edge_failures(*g, m.sources, m.destinations, query_of(m, nullptr, &cache), w);
+  };
+  std::string want_miss;
+  try {
+    shortest_paths_edge_failures(1);
+  } catch (const ShortestPathCacheMiss& e) {
+    want_miss = key_of(e);
+  }
+  EXPECT_EQ(want_miss, "ShortestPathCache: the frozen cache has no entry for roots {5, 6}, direction Reverse");
+  const long failures = sweep_evaluator(
+      "frozen sensitivity", 1, false, 1,
+      [&](std::int32_t w) {
+        try {
+          shortest_paths_edge_failures(w);
+        } catch (const ShortestPathCacheMiss&) {
+        }
+      },
+      [&](std::int32_t w) {
+        EXPECT_EQ(cache.stats().entries, entries);
+        try {
+          shortest_paths_edge_failures(w);
+          ADD_FAILURE() << "no ShortestPathCacheMiss";
+        } catch (const ShortestPathCacheMiss& e) {
+          EXPECT_EQ(key_of(e), want_miss);
+        }
+      });
+  EXPECT_GT(failures, 2) << "frozen sensitivity";
+  // CentralizedTE's failure study reads no cache: with the frozen cache it is rejected before any worker
+  // starts, the cache unchanged.
+  const auto git = std::find_if(all.begin(), all.end(), [](const Mode& x) { return x.name == "global"; });
+  ASSERT_NE(git, all.end());
+  EXPECT_THROW((void)evaluate_edge_failures(*g, git->sources, git->destinations, EvaluationOptions {git->cfg, nullptr, &cache}, 2),
+               std::invalid_argument);
+  EXPECT_EQ(cache.stats().entries, entries);
+}
+
+// ---------------------------------------------------------------- T1
+
+// T1's calls (replace, evaluate, replace(0), replace(+inf), forward with and without black holes,
+// and two whose holds change: a replace with a new design and the first replace of a policy)
+// with a third party's load and another T1 owner's holds on the ledger: every allocation of the
+// call fails once, through the shared placement sweep, which compares both projections and every
+// record field (edge_reservations included): a failure changes neither the ledger nor the epoch and
+// leaves no allocation live; the completing call, the retry and remove() leave the ledger as the
+// reference's do.
+TEST(PolicyFaults, T1CallsFailAtomically) {
+  const auto g = graph();
+  const auto inv = id_of_input(*g);
+  const EdgeId dark_edges[] = {inv[4], inv[6]};
+  const Eligibility dark = g->eligibility({}, dark_edges);
+  const OutputOptions all {.edge_flows = true, .residual = true, .saturated_boundary_edges = true, .edge_reservations = true};
+  struct Op {
+    std::string name;
+    std::function<PlacementResult(FlowPolicy&)> call;
+    bool fresh {false};  // on a policy without a call: every hold is new
+  };
+  for (const auto& m : t1_modes()) {
+    const bool lossy = m.cfg.admission == Admission::Lossy;
+    const auto design = *m.design;
+    std::vector<Op> ops = {{"evaluate", [&](FlowPolicy& p) { return p.evaluate(6, design, all); }},
+                           {"replace", [&](FlowPolicy& p) { return p.replace(6, design, all); }},
+                           {"replace to zero", [&](FlowPolicy& p) { return p.replace(0, design); }},
+                           {"forward", [](FlowPolicy& p) { return p.forward(6, nullptr, {true, true, true}); }},
+                           {"forward black holes", [&](FlowPolicy& p) { return p.forward(6, &dark); }},
+                           // The holds change: a failed commit must leave the old ones.
+                           {"replace with a new design",
+                            [&](FlowPolicy& p) { return p.replace(6, std::optional<Amount> {*design + 2}, all); }},
+                           {"first replace", [&](FlowPolicy& p) { return p.replace(6, design, all); }, true}};
+    if (!lossy) ops.push_back({"replace +inf", [&](FlowPolicy& p) { return p.replace(std::nullopt, design); }});
+    for (const auto& op : ops) {
+      const std::string where = m.name + " / " + op.name;
+      const auto setup = [&](FlowLedger& fg) {
+        auto third = std::shared_ptr<FlowPolicy>(third_party(fg, *g));
+        auto holder = std::make_shared<FlowPolicy>(fg, std::vector<NodeId> {1}, std::vector<NodeId> {6},
+                                                   FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}});
+        (void)holder->replace(0, 2);
+        auto p = std::make_shared<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+        if (!op.fresh) (void)p->replace(3, design);
+        FlowPolicy* policy = p.get();
+        auto keep = std::make_shared<std::vector<std::shared_ptr<FlowPolicy>>>(
+            std::vector<std::shared_ptr<FlowPolicy>> {std::move(third), std::move(holder), std::move(p)});
+        return Staged {keep, policy};
+      };
+      const long injected = sweep_placement(g, where, setup, op.call);
+      if (::testing::Test::HasFailure()) return;
+      EXPECT_GT(injected, 0) << where;  // not vacuous
+    }
+  }
+}
+
+// A T1 policy's construction (the roster, the pool baseline, the replay basis of its exclusions)
+// fails at every allocation without binding; a clean construction then sets up like the
+// reference.
+TEST(PolicyFaults, T1ConstructionFailsWithoutBinding) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  for (const auto& m : t1_modes()) {
+    for (const Eligibility* elig : {static_cast<const Eligibility*>(nullptr), &no_bypass}) {
+      const std::string variant = m.name + (elig != nullptr ? " eligibility" : "");
+      FlowLedger rf(g);
+      FlowPolicy pr(rf, m.sources, m.destinations, m.cfg, elig);
+      const PlacementResult want = pr.replace(2, *m.design);
+      const LedgerState after_place = ledger_state(rf);
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = variant + " construction allocation " + std::to_string(at);
+        const long live = g_live.load();
+        {
+          FlowLedger fg(g);
+          const LedgerState before = ledger_state(fg);
+          std::optional<FlowPolicy> p;
+          if (!fails_at(at, [&] { p.emplace(fg, m.sources, m.destinations, m.cfg, elig); })) {
+            EXPECT_EQ(LedgerAccess::bound_policy_ids(fg).size(), 1U);
+            break;
+          }
+          ++injected;
+          EXPECT_FALSE(p.has_value()) << w;
+          expect_same(ledger_state(fg), before, w);
+          p.emplace(fg, m.sources, m.destinations, m.cfg, elig);
+          expect_same(p->replace(2, *m.design), want, w);
+          expect_same(ledger_state(fg), after_place, w);
+          expect_balanced(fg, w);
+        }
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (::testing::Test::HasFailure()) return;
+      }
+      EXPECT_GT(injected, 0) << variant;
+    }
+  }
+}
+
+// T1's evaluators (evaluate_demand: setup and forwarding on a fresh ledger; evaluate_pairs;
+// evaluate_edge_failures:
+// setup redone under every deletion) under the shared evaluator sweeps, one worker exhaustively
+// and several workers in their threads.
+TEST(PolicyFaults, T1EvaluatorsLeaveNoPoisonedScratch) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  const Eligibility no_cross = without_cross(*g);
+  const std::int32_t one[] = {1};
+  const std::int32_t several[] = {2, 3};
+  long attempts = 0;
+  for (const auto& m : t1_modes()) {
+    for (const auto& o : option_sets(no_bypass, no_cross)) {
+      if (o.cache) continue;  // T1 rejects a cache
+      const std::string name = m.name + " capacity" + o.name;
+      const auto want = evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true}));
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          PlacementResult got;
+          failed = fails_at(at, [&] { got = evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true})); });
+          if (failed) {
+            ++injected;
+            expect_same(evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true})), want,
+                        name + " retry");
+          } else {
+            expect_same(got, want, name);
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << name << " allocation " << at << ": a leak";
+        if (!failed || ::testing::Test::HasFailure()) break;
+      }
+      EXPECT_GT(injected, 0) << name;
+      attempts += injected + sweep_batch(m, *g, one, 1, o) + sweep_edge_failures(m, *g, one, 1, o);
+      attempts += sweep_batch(m, *g, several, 1, o) + sweep_edge_failures(m, *g, several, 7, o);
+      if (::testing::Test::HasFailure()) return;
+    }
+  }
+  RecordProperty("allocation_attempts", std::to_string(attempts));
+}
+
+// remove() and the destruction of a T1 policy allocate nothing: remove() takes the records and the
+// holds away; the destruction leaves both projections as orphans and the policy no longer bound.
+TEST(PolicyFaults, T1RemovalAndReleaseNeverAllocate) {
+  const auto g = graph();
+  for (const auto& m : t1_modes()) {
+    FlowLedger fg(g);
+    auto p = std::make_unique<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+    (void)p->replace(4, *m.design);
+    ASSERT_FALSE(fg.records().empty()) << m.name;
+    EXPECT_FALSE(fails_at(0, [&] { p->remove(); })) << m.name;
+    EXPECT_TRUE(fg.records().empty()) << m.name;
+    EXPECT_EQ(fg.reserved(), std::vector<Amount>(fg.reserved().size(), 0)) << m.name;
+    (void)p->replace(2, *m.design);
+    const LedgerState held = ledger_state(fg);
+    ASSERT_GT(std::accumulate(held.reserved.begin(), held.reserved.end(), Amount {0}), 0) << m.name;
+    EXPECT_FALSE(fails_at(0, [&] { p.reset(); })) << m.name;
+    const LedgerState orphaned = ledger_state(fg);
+    EXPECT_EQ(orphaned.carried, held.carried) << m.name;
+    EXPECT_EQ(orphaned.reserved, held.reserved) << m.name;
+    EXPECT_EQ(orphaned.records.size(), held.records.size()) << m.name;
+    EXPECT_TRUE(orphaned.bound.empty()) << m.name;
+  }
+}
+
+// T1's commit books the holds through the reservation projection's own per-thread scratch, so the
+// shared placement sweep (whose reference call has already grown this thread's scratch) does not
+// reach its growth. Here each attempt runs on a new thread whose scratch is cold, or has first
+// served a T1 replace on a 3-node chain (small to large); the swept replace on a 3000-node chain
+// fails at its at-th allocation and changes neither projection, no record and not the epoch, and a
+// retry on the same thread gives the reference's result, ledger and epoch. With `prior`, the policy
+// already holds an earlier design (set up on another thread, so the attempt's scratch stays as it
+// was) and the swept call replaces those holds. The same call on a thread whose scratch has grown to
+// the large chain allocates less: the sweep reached the growth.
+void expect_t1_hold_scratch_growth(const std::string& name, bool from_small, bool prior) {
+  SCOPED_TRACE(name);
+  const auto small = chain_graph(3, 5);
+  const auto large = chain_graph(3000, 5);
+  const NodeId last = large->num_nodes() - 1;
+  const FlowPolicyConfig cfg {.routing = DistributedTE {TunnelCount {2}}};
+  const auto make = [&](FlowLedger& fg) {
+    auto p = std::make_unique<FlowPolicy>(fg, std::vector<NodeId> {0}, std::vector<NodeId> {last}, cfg);
+    if (prior) std::thread([&] { (void)p->replace(2, 2); }).join();
+    return p;
+  };
+  const OutputOptions holds {.edge_reservations = true};
+  const auto call = [&](FlowPolicy& p) { return p.replace(4, 4, holds); };
+  PlacementResult want;
+  LedgerState want_state;
+  Epoch want_epoch;
+  {
+    FlowLedger fg(large);
+    auto p = make(fg);
+    want = call(*p);
+    want_state = ledger_state(fg);
+    want_epoch = epoch(*p);
+  }
+  // Both tunnels up, each holding 2 on every link: the comparison is not of zeros.
+  ASSERT_EQ(want_state.reserved, std::vector<Amount>(want_state.reserved.size(), 4));
+  ASSERT_EQ(want.call_delivered, 4);
+  sweep_scratch_growth(
+      name,
+      [&] {
+        if (!from_small) return;
+        FlowLedger fg(small);
+        FlowPolicy p(fg, std::vector<NodeId> {0}, std::vector<NodeId> {2}, cfg);
+        EXPECT_EQ(p.replace(4, 4).call_delivered, 4);
+      },
+      [&](long at, const std::string& w) {
+        FlowLedger fg(large);
+        auto p = make(fg);
+        const LedgerState before = ledger_state(fg);
+        const Epoch before_epoch = epoch(*p);
+        PlacementResult got;
+        const bool failed = fails_at(at, [&] { got = call(*p); });
+        if (failed) {
+          expect_same(ledger_state(fg), before, w + " (failed call)");
+          expect_same(epoch(*p), before_epoch, w + " (failed call)");
+          expect_balanced(fg, w + " (failed call)");
+          got = call(*p);
+        }
+        expect_same(got, want, w);
+        expect_same(ledger_state(fg), want_state, w);
+        expect_same(epoch(*p), want_epoch, w);
+        expect_balanced(fg, w);
+        return failed;
+      },
+      [&] {
+        {
+          FlowLedger fg(large);
+          auto p = make(fg);
+          (void)call(*p);  // the scratch grows to the large chain
+        }
+        for (long warm = 0;; ++warm) {
+          FlowLedger fg(large);
+          auto p = make(fg);
+          if (!fails_at(warm, [&] { (void)call(*p); })) return warm;
+        }
+      });
+}
+
+TEST(PolicyFaults, T1HoldScratchGrowthFailureLeavesNothingHalfGrown) {
+  for (const bool prior : {false, true}) {
+    for (const bool from_small : {false, true}) {
+      expect_t1_hold_scratch_growth(std::string(prior ? "new design" : "first replace") +
+                                        (from_small ? " from small" : " from cold"),
+                                    from_small, prior);
+      if (::testing::Test::HasFailure()) return;
+    }
+  }
+}
+
+// ---------------------------------------------------------------- T2
+
+// T2's calls (replace, evaluate, replace(0), an unlimited design, forward with and without black
+// holes) with a third party's load and a T1 owner's holds on the ledger (T2 reads the residual):
+// every allocation of the call (the quota flows, the fluid search, the augmentation's arrays and
+// heap, the decomposition, "up to"'s per-count programs, the program, the bound, the forwarding)
+// fails once through the shared placement sweep: a failure changes neither the ledger nor the
+// epoch and leaves no allocation live.
+TEST(PolicyFaults, T2CallsFailAtomically) {
+  const auto g = graph();
+  const auto inv = id_of_input(*g);
+  const EdgeId dark_edges[] = {inv[4], inv[6]};
+  const Eligibility dark = g->eligibility({}, dark_edges);
+  const OutputOptions all {.edge_flows = true, .residual = true, .saturated_boundary_edges = true, .edge_reservations = true};
+  const std::optional<std::optional<Amount>> unlimited {std::in_place, std::nullopt};
+  struct Op {
+    std::string name;
+    std::function<PlacementResult(FlowPolicy&)> call;
+  };
+  for (const auto& m : t2_modes()) {
+    const bool lossy = m.cfg.admission == Admission::Lossy;
+    const auto design = *m.design;
+    std::vector<Op> ops = {{"evaluate", [&](FlowPolicy& p) { return p.evaluate(6, design, all); }},
+                           {"replace", [&](FlowPolicy& p) { return p.replace(6, design, all); }},
+                           {"replace to zero", [&](FlowPolicy& p) { return p.replace(0, design); }},
+                           {"replace unlimited design", [&](FlowPolicy& p) { return p.replace(7, unlimited); }},
+                           {"forward", [](FlowPolicy& p) { return p.forward(6, nullptr, {true, true, true}); }},
+                           {"forward black holes", [&](FlowPolicy& p) { return p.forward(6, &dark); }}};
+    if (!lossy) ops.push_back({"replace +inf", [&](FlowPolicy& p) { return p.replace(std::nullopt, design); }});
+    for (const auto& op : ops) {
+      const std::string where = m.name + " / " + op.name;
+      const auto setup = [&](FlowLedger& fg) {
+        auto third = std::shared_ptr<FlowPolicy>(third_party(fg, *g));
+        auto holder = std::make_shared<FlowPolicy>(fg, std::vector<NodeId> {1}, std::vector<NodeId> {6},
+                                                   FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}});
+        (void)holder->replace(0, 2);
+        auto p = std::make_shared<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+        (void)p->replace(3, design);
+        FlowPolicy* policy = p.get();
+        auto keep = std::make_shared<std::vector<std::shared_ptr<FlowPolicy>>>(
+            std::vector<std::shared_ptr<FlowPolicy>> {std::move(third), std::move(holder), std::move(p)});
+        return Staged {keep, policy};
+      };
+      const long injected = sweep_placement(g, where, setup, op.call);
+      if (::testing::Test::HasFailure()) return;
+      EXPECT_GT(injected, 0) << where;  // not vacuous
+    }
+  }
+}
+
+// A T2 policy's construction fails at every allocation without binding; a clean construction then
+// lays out like the reference.
+TEST(PolicyFaults, T2ConstructionFailsWithoutBinding) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  for (const auto& m : t2_modes()) {
+    for (const Eligibility* elig : {static_cast<const Eligibility*>(nullptr), &no_bypass}) {
+      const std::string variant = m.name + (elig != nullptr ? " eligibility" : "");
+      FlowLedger rf(g);
+      FlowPolicy pr(rf, m.sources, m.destinations, m.cfg, elig);
+      const PlacementResult want = pr.replace(2, *m.design);
+      const LedgerState after_place = ledger_state(rf);
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const std::string w = variant + " construction allocation " + std::to_string(at);
+        const long live = g_live.load();
+        {
+          FlowLedger fg(g);
+          const LedgerState before = ledger_state(fg);
+          std::optional<FlowPolicy> p;
+          if (!fails_at(at, [&] { p.emplace(fg, m.sources, m.destinations, m.cfg, elig); })) {
+            EXPECT_EQ(LedgerAccess::bound_policy_ids(fg).size(), 1U);
+            break;
+          }
+          ++injected;
+          EXPECT_FALSE(p.has_value()) << w;
+          expect_same(ledger_state(fg), before, w);
+          p.emplace(fg, m.sources, m.destinations, m.cfg, elig);
+          expect_same(p->replace(2, *m.design), want, w);
+          expect_same(ledger_state(fg), after_place, w);
+          expect_balanced(fg, w);
+        }
+        EXPECT_EQ(g_live.load(), live) << w << ": a leak";
+        if (::testing::Test::HasFailure()) return;
+      }
+      EXPECT_GT(injected, 0) << variant;
+    }
+  }
+}
+
+// T2's evaluators (evaluate_demand on a fresh ledger; evaluate_pairs; evaluate_edge_failures: sizing, count
+// selection and objectives redone under every deletion) under the shared evaluator sweeps: evaluate_demand
+// and evaluate_pairs exhaustively; evaluate_edge_failures, whose deletions each repeat the layout that
+// evaluate_demand's sweep already covers allocation by allocation, at every fifth allocation with one
+// worker and every seventh with several (a whole sweep would take minutes per mode). Three tests per
+// mode (evaluate_demand and evaluate_pairs; evaluate_edge_failures without, then with an Eligibility), each within the
+// test timeout under the sanitizers. `part`: 0, 1 or 2 in that order.
+void sweep_t2_evaluators(const Mode& m, int part) {
+  const auto g = graph();
+  const Eligibility no_bypass = without_bypass(*g);
+  const Eligibility no_cross = without_cross(*g);
+  const std::int32_t one[] = {1};
+  const std::int32_t several[] = {2, 3};
+  long attempts = 0;
+  {
+    for (const auto& o : option_sets(no_bypass, no_cross)) {
+      if (o.cache) continue;  // T2 rejects a cache
+      if (part > 0) {
+        if ((part == 2) != (o.elig != nullptr)) continue;
+        attempts += sweep_edge_failures(m, *g, one, 5, o) + sweep_edge_failures(m, *g, several, 7, o);
+        if (::testing::Test::HasFailure()) return;
+        continue;
+      }
+      const std::string name = m.name + " capacity" + o.name;
+      const auto want = evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true}));
+      long injected = 0;
+      for (long at = 0;; ++at) {
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          PlacementResult got;
+          failed = fails_at(at, [&] { got = evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true})); });
+          if (failed) {
+            ++injected;
+            expect_same(evaluate_demand(*g, m.sources, m.destinations, query_of(m, o.elig, nullptr, {true, true, true})), want,
+                        name + " retry");
+          } else {
+            expect_same(got, want, name);
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << name << " allocation " << at << ": a leak";
+        if (!failed || ::testing::Test::HasFailure()) break;
+      }
+      EXPECT_GT(injected, 0) << name;
+      attempts += injected + sweep_batch(m, *g, one, 1, o) + sweep_batch(m, *g, several, 1, o);
+      if (::testing::Test::HasFailure()) return;
+    }
+  }
+  ::testing::Test::RecordProperty("allocation_attempts", std::to_string(attempts));
+}
+
+TEST(PolicyFaults, T2ExactEvaluatorsLeaveNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[0], 0); }
+TEST(PolicyFaults, T2ExactSensitivityLeavesNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[0], 1); }
+TEST(PolicyFaults, T2ExactMaskedSensitivityLeavesNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[0], 2); }
+TEST(PolicyFaults, T2UpToEvaluatorsLeaveNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[1], 0); }
+TEST(PolicyFaults, T2UpToSensitivityLeavesNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[1], 1); }
+TEST(PolicyFaults, T2UpToMaskedSensitivityLeavesNoPoisonedScratch) { sweep_t2_evaluators(t2_modes()[1], 2); }
+
+// remove() and the destruction of a T2 policy allocate nothing: remove() takes the records away;
+// the destruction leaves them as orphans (a plan books no hold) and the policy no longer bound.
+TEST(PolicyFaults, T2RemovalAndReleaseNeverAllocate) {
+  const auto g = graph();
+  for (const auto& m : t2_modes()) {
+    FlowLedger fg(g);
+    auto p = std::make_unique<FlowPolicy>(fg, m.sources, m.destinations, m.cfg);
+    (void)p->replace(4, *m.design);
+    ASSERT_FALSE(fg.records().empty()) << m.name;
+    EXPECT_FALSE(fails_at(0, [&] { p->remove(); })) << m.name;
+    EXPECT_TRUE(fg.records().empty()) << m.name;
+    (void)p->replace(2, *m.design);
+    const LedgerState held = ledger_state(fg);
+    ASSERT_FALSE(held.records.empty()) << m.name;
+    EXPECT_FALSE(fails_at(0, [&] { p.reset(); })) << m.name;
+    const LedgerState orphaned = ledger_state(fg);
+    EXPECT_EQ(orphaned.carried, held.carried) << m.name;
+    EXPECT_EQ(orphaned.reserved, std::vector<Amount>(orphaned.reserved.size(), 0)) << m.name;
+    EXPECT_EQ(orphaned.records.size(), held.records.size()) << m.name;
+    EXPECT_TRUE(orphaned.bound.empty()) << m.name;
+  }
+}
+
+TEST(PolicyFaults, ParallelRosterPreparationFailsCleanly) {
+  const Graph g(4, std::vector<NodeId>{0,1,2}, std::vector<NodeId>{3,3,3},
+                std::vector<Amount>{10,10,10}, std::vector<Cost>{1,3,2}, 1.0);
+  const auto common = g.eligibility({}, std::vector<EdgeId>{2});
+  const auto first = g.eligibility(std::vector<NodeId>{0}, {});
+  const auto second = g.eligibility(std::vector<NodeId>{1}, {});
+  const auto none = g.eligibility(std::vector<NodeId>{0,1,2}, {});
+  const std::vector<const Eligibility*> per {&first, &second, &none};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs(3, {{0,1,2}, {3}});
+  const auto support = dag_of(g, std::vector<EdgeId>{0,1,2});
+  for (int model = 0; model < 3; ++model) {
+    EvaluationOptions options;
+    if (model == 0) options.config.routing = DistributedTE{TunnelCount{1}};
+    else {
+      CentralizedTE central(SourceAllocation::Equal);
+      central.tunnel_count = TunnelCount{1};
+      central.support = model == 2 ? support : nullptr;
+      options.config.routing = std::move(central);
+    }
+    options.eligibility = &common;
+    const auto check = [&](const std::vector<detail::TunnelRoster>& roster) {
+      ASSERT_EQ(roster.size(), 3U);
+      EXPECT_EQ(roster[0].heads, (std::vector<NodeId>{1}));
+      EXPECT_EQ(roster[0].c0, 3);
+      EXPECT_EQ(roster[1].heads, (std::vector<NodeId>{0}));
+      EXPECT_EQ(roster[1].c0, 1);
+      EXPECT_TRUE(roster[2].heads.empty());
+      EXPECT_EQ(roster[2].c0, kUnreachable);
+    };
+    for (int workers : {1, 3}) {
+      for (bool warm : {false, true}) {
+        long failures = 0;
+        for (long at = 0;; ++at) {
+          const auto live = g_live.load();
+          bool failed = false;
+          std::thread attempt([&] {
+            if (warm) check(detail::prepare_batch_rosters(g, pairs, options, per, workers));
+            std::vector<detail::TunnelRoster> result;
+            failed = fails_at(at, [&] { result = detail::prepare_batch_rosters(g, pairs, options, per, workers); });
+            if (failed) {
+              EXPECT_TRUE(result.empty());
+              result = detail::prepare_batch_rosters(g, pairs, options, per, workers);
+            }
+            check(result);
+          });
+          attempt.join();
+          EXPECT_EQ(g_live.load(), live) << "model " << model << " workers " << workers << " warm " << warm << " allocation " << at;
+          if (!failed || ::testing::Test::HasFailure()) break;
+          ++failures;
+        }
+        EXPECT_GT(failures, 3);
+        if (::testing::Test::HasFailure()) return;
+      }
+    }
+  }
+}
+
+TEST(PolicyFaults, StaticPreparationFirstAndRetainedEpochsAreAtomic) {
+  const auto g = graph();
+  const OutputOptions all {true, true, true, true, true};
+  for (bool pooled : {false, true}) for (bool weighted : {false, true}) for (int stage = 0; stage < 3; ++stage) {
+    const auto setup = [&](FlowLedger& ledger) {
+      ShortestPaths sp;
+      if (weighted) { sp.allocation = RouteAllocation::Weighted; sp.weight_basis = WeightBasis::Explicit;
+        sp.edge_weights = std::make_shared<const std::vector<Amount>>(static_cast<std::size_t>(g->num_edges()), 1); }
+      auto p = std::make_shared<FlowPolicy>(ledger, pooled ? std::vector<NodeId>{0, 1} : std::vector<NodeId>{0},
+          std::vector<NodeId>{5, 6}, FlowPolicyConfig {sp, Admission::Lossy});
+      if (stage != 0) { (void)p->place(3); if (stage == 1) p->remove(); }
+      return Staged {p, p.get()};
+    };
+    for (int operation = 0; operation < 4; ++operation) {
+      const auto call = [&](FlowPolicy& p) {
+        if (operation == 0) return p.place(7, all);
+        if (operation == 1) return p.replace(7, {}, all);
+        if (operation == 2) return p.evaluate(7, {}, all);
+        const Action action = Replace {p, 7};
+        auto results = apply_actions(detail::PolicyAccess::engine(p).ledger, std::span(&action, 1), BatchMode::Simultaneous, all);
+        return std::move(results.front());
+      };
+      EXPECT_GT(sweep_placement(g, "static first/removed/live epoch", setup, call), 0);
+    }
+  }
+}
+
+TEST(PolicyFaults, StaticPreparationBatchRollbackIncludesEveryPrivateOwner) {
+  const auto g = graph();
+  const OutputOptions all {true, true, true, true, true};
+  for (auto mode : {BatchMode::Ordered, BatchMode::Simultaneous}) for (bool warm : {false, true}) {
+    bool completed = false;
+    long failures = 0;
+    for (long at = 0; at < 1000 && !completed; ++at) {
+      FlowLedger ledger(g);
+      const FlowPolicyConfig cfg {ShortestPaths {}, Admission::Lossy};
+      FlowPolicy a(ledger, std::vector<NodeId>{0}, std::vector<NodeId>{5}, cfg);
+      FlowPolicy b(ledger, std::vector<NodeId>{0, 1}, std::vector<NodeId>{5, 6}, cfg);
+      if (warm) { (void)a.place(2); (void)b.place(2); a.remove(); b.remove(); }
+      const auto before = ledger_state(ledger);
+      const auto a_before = epoch(a), b_before = epoch(b);
+      const std::vector<Action> actions {Replace {a, 7}, Replace {b, 5}};
+      std::vector<PlacementResult> result;
+      if (fails_at(at, [&] { result = apply_actions(ledger, actions, mode, all); })) {
+        ++failures;
+        expect_same(ledger_state(ledger), before, "batch rollback ledger");
+        expect_same(epoch(a), a_before, "batch rollback first owner");
+        expect_same(epoch(b), b_before, "batch rollback second owner");
+        EXPECT_EQ(detail::PolicyAccess::engine(a).kept_program.get(), a_before.kept_id);
+        EXPECT_EQ(detail::PolicyAccess::engine(b).kept_program.get(), b_before.kept_id);
+        result = apply_actions(ledger, actions, mode, all);
+      } else completed = true;
+      ASSERT_EQ(result.size(), 2U);
+      EXPECT_TRUE(detail::PolicyAccess::engine(a).kept_program);
+      EXPECT_TRUE(detail::PolicyAccess::engine(b).kept_program);
+      expect_balanced(ledger, "batch retry");
+      if (::testing::Test::HasFailure()) break;
+    }
+    EXPECT_TRUE(completed); EXPECT_GT(failures, 0);
+  }
+}
diff --git a/tests/cpp/flow_policy_fixture_tests.cpp b/tests/cpp/flow_policy_fixture_tests.cpp
new file mode 100644
index 0000000..f616f29
--- /dev/null
+++ b/tests/cpp/flow_policy_fixture_tests.cpp
@@ -0,0 +1,1172 @@
+// The 31 fixtures of the independent reference replayed through FlowPolicy.
+//
+// tests/data/policy_fixtures.json was exported from the independent reference (its
+// frozen copy, the exporter, the regeneration check and the meaning of the data's historical
+// "source" string: tests/reference/policy/README.md): every ledger, policy and call of every
+// fixture in order, with the reference's values after each operation. The replay checks
+// every one of them on the engine: each call's result (this call's values, termination and flags,
+// the demand's state, the rows per source, the total cost, the cost curve, the requested outputs),
+// its trace (the reference's keys),
+// the ledger after it (allocations, residuals, every record field, next FlowId, owners) and the
+// policy state (roster, requested, +inf, placed demand, per source the flows'
+// ids, routes, T, deliveries and allocations). An operation the reference rejects must throw
+// std::invalid_argument here too (the messages differ); any other exception is a failure.
+// Normalised on both sides: the flow core's operation counters and ledger uids. The trace needs
+// the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS): without them, in the shipped configuration,
+// the replay compares everything but the trace, and the corruption test corrupts what that
+// replay compares: every section but the trace.
+//
+// The data keeps the reference's own names; the replay maps them to the library's here and nowhere
+// else: the routing kinds "CostOnly" and "Global" build ShortestPaths and CentralizedTE (with
+// source allocation OPTIMIZED, Global's default there), a configuration's "placement" is
+// ShortestPaths' allocation ("MaxFlow" and "EqualBalanced" are RouteAllocation::Optimized and
+// Equal) and its "weights" ShortestPaths' weight_basis; the configuration's "selection" is
+// ShortestPaths' route choice: "Deterministic" is FEWER_HOPS
+// whatever the "priority", "PreferHigherPriority" with "Residual", "Capacity" or "Headroom" is
+// HIGHER_AVAILABLE_CAPACITY, HIGHER_CAPACITY or HIGHER_HEADROOM, "multipath" is multipath and
+// "multi_edge" parallel_edges; a result's
+// "placed", "remaining", "call_drops", "call_source_loss", "source_loss", "drops",
+// "cost_distribution" and "bottleneck" are call_delivered, call_undelivered, call_edge_drops,
+// call_source_drops, source_drops, edge_drops, marginal_cost_curve and saturated_boundary_edges; the
+// ledger's "allocated" is carried(); a record's "owner", "bundle", "route_cost" and "edges" are
+// policy_id, route, min_route_cost and edge_flows; the policy's "placed_demand" is delivered().
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cctype>
+#include <cstdint>
+#include <cstdlib>
+#include <deque>
+#include <fstream>
+#include <functional>
+#include <initializer_list>
+#include <memory>
+#include <optional>
+#include <random>
+#include <set>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/trace.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/graph.hpp"
+#include "test_utils.hpp"
+
+#ifndef NETGRAPH_CORE_TEST_DATA
+#error "NETGRAPH_CORE_TEST_DATA (the tests/data directory) must be defined by the build"
+#endif
+
+using namespace netgraph::core;
+using detail::LedgerAccess;
+using test::Int128;
+using test::UInt128;
+
+namespace {
+
+// ---------------------------------------------------------------- a small JSON value
+
+struct J {
+  enum class K { Null, Bool, Int, Dbl, Str, Arr, Obj };
+  K k {K::Null};
+  bool b {false};
+  Int128 i {0};
+  double d {0.0};
+  std::string s {};
+  std::vector<J> a {};
+  std::vector<std::pair<std::string, J>> o {};
+
+  static J null() { return {}; }
+  static J boolean(bool v) {
+    J j;
+    j.k = K::Bool;
+    j.b = v;
+    return j;
+  }
+  static J integer(Int128 v) {
+    J j;
+    j.k = K::Int;
+    j.i = v;
+    return j;
+  }
+  static J str(std::string v) {
+    J j;
+    j.k = K::Str;
+    j.s = std::move(v);
+    return j;
+  }
+  static J arr() {
+    J j;
+    j.k = K::Arr;
+    return j;
+  }
+  static J obj() {
+    J j;
+    j.k = K::Obj;
+    return j;
+  }
+  // Builders for the replay.
+  J& set(const std::string& key, J v) {
+    k = K::Obj;
+    o.emplace_back(key, std::move(v));
+    return o.back().second;
+  }
+  J& push(J v) {
+    k = K::Arr;
+    a.push_back(std::move(v));
+    return a.back();
+  }
+  [[nodiscard]] const J* get(const std::string& key) const {
+    for (const auto& [kk, v] : o) {
+      if (kk == key) return &v;
+    }
+    return nullptr;
+  }
+  [[nodiscard]] const J& at(const std::string& key) const {
+    const J* p = get(key);
+    if (p == nullptr) throw std::runtime_error("missing key " + key);
+    return *p;
+  }
+  // Readers for the replay.
+  [[nodiscard]] bool is_null() const { return k == K::Null; }
+  [[nodiscard]] std::int64_t int64() const {
+    if (k != K::Int) throw std::runtime_error("not an integer");
+    return static_cast<std::int64_t>(i);
+  }
+};
+
+class Parser {
+public:
+  explicit Parser(const std::string& text) : t_(text) {}
+  J parse() {
+    J v = value();
+    ws();
+    if (p_ != t_.size()) fail("trailing data");
+    return v;
+  }
+
+private:
+  [[noreturn]] void fail(const std::string& why) const {
+    throw std::runtime_error("JSON: " + why + " at offset " + std::to_string(p_));
+  }
+  void ws() {
+    while (p_ < t_.size() && (t_[p_] == ' ' || t_[p_] == '\n' || t_[p_] == '\r' || t_[p_] == '\t')) ++p_;
+  }
+  bool lit(const char* word) {
+    const std::string w(word);
+    if (t_.compare(p_, w.size(), w) == 0) {
+      p_ += w.size();
+      return true;
+    }
+    return false;
+  }
+  std::string string() {
+    if (t_[p_] != '"') fail("expected a string");
+    ++p_;
+    std::string out;
+    while (p_ < t_.size() && t_[p_] != '"') {
+      char c = t_[p_++];
+      if (c == '\\') {
+        const char e = t_[p_++];
+        switch (e) {
+          case 'n': c = '\n'; break;
+          case 't': c = '\t'; break;
+          case 'r': c = '\r'; break;
+          case 'u': {
+            const auto code = std::strtol(t_.substr(p_, 4).c_str(), nullptr, 16);
+            p_ += 4;
+            if (code > 0x7f) fail("non-ASCII escape");
+            c = static_cast<char>(code);
+            break;
+          }
+          default: c = e;
+        }
+      }
+      out.push_back(c);
+    }
+    if (p_ >= t_.size()) fail("unterminated string");
+    ++p_;
+    return out;
+  }
+  J value() {
+    ws();
+    if (p_ >= t_.size()) fail("unexpected end");
+    const char c = t_[p_];
+    if (c == '{') {
+      ++p_;
+      J j = J::obj();
+      ws();
+      if (t_[p_] == '}') {
+        ++p_;
+        return j;
+      }
+      while (true) {
+        ws();
+        std::string key = string();
+        ws();
+        if (t_[p_++] != ':') fail("expected ':'");
+        j.o.emplace_back(std::move(key), value());
+        ws();
+        if (t_[p_] == ',') {
+          ++p_;
+          continue;
+        }
+        if (t_[p_] == '}') {
+          ++p_;
+          return j;
+        }
+        fail("expected ',' or '}'");
+      }
+    }
+    if (c == '[') {
+      ++p_;
+      J j = J::arr();
+      ws();
+      if (t_[p_] == ']') {
+        ++p_;
+        return j;
+      }
+      while (true) {
+        j.a.push_back(value());
+        ws();
+        if (t_[p_] == ',') {
+          ++p_;
+          continue;
+        }
+        if (t_[p_] == ']') {
+          ++p_;
+          return j;
+        }
+        fail("expected ',' or ']'");
+      }
+    }
+    if (c == '"') return J::str(string());
+    if (lit("null")) return J::null();
+    if (lit("true")) return J::boolean(true);
+    if (lit("false")) return J::boolean(false);
+    // A number: an integer of any size below 2^127, or a double.
+    const std::size_t start = p_;
+    if (t_[p_] == '-') ++p_;
+    while (p_ < t_.size() && std::isdigit(static_cast<unsigned char>(t_[p_]))) ++p_;
+    bool real = false;
+    while (p_ < t_.size() && (t_[p_] == '.' || t_[p_] == 'e' || t_[p_] == 'E' || t_[p_] == '+' || t_[p_] == '-' ||
+                              std::isdigit(static_cast<unsigned char>(t_[p_])))) {
+      real = true;
+      ++p_;
+    }
+    const std::string num = t_.substr(start, p_ - start);
+    if (num.empty() || num == "-") fail("bad value");
+    if (real) {
+      J j;
+      j.k = J::K::Dbl;
+      j.d = std::strtod(num.c_str(), nullptr);
+      return j;
+    }
+    Int128 v = 0;
+    const bool neg = num[0] == '-';
+    for (std::size_t n = neg ? 1 : 0; n < num.size(); ++n) v = v * 10 + (num[n] - '0');
+    return J::integer(neg ? -v : v);
+  }
+
+  const std::string& t_;
+  std::size_t p_ {0};
+};
+
+const J& data() {
+  static const J d = [] {
+    const std::string path = std::string(NETGRAPH_CORE_TEST_DATA) + "/policy_fixtures.json";
+    std::ifstream in(path);
+    if (!in) throw std::runtime_error("cannot open " + path);
+    std::stringstream ss;
+    ss << in.rdbuf();
+    const std::string text = ss.str();
+    return Parser(text).parse();
+  }();
+  return d;
+}
+
+} // namespace
+
+TEST(PolicyFixtures, TheDataHoldsEveryReferenceFixture) {
+  const J& d = data();
+  EXPECT_EQ(d.at("format").s, "p2-fixtures/1");
+  EXPECT_EQ(d.at("fixtures").a.size(), 31U);
+}
+
+namespace {
+
+std::string int128_text(Int128 v) {
+  if (v == 0) return "0";
+  const bool neg = v < 0;
+  UInt128 u = neg ? static_cast<UInt128>(-(v + 1)) + 1 : static_cast<UInt128>(v);
+  std::string out;
+  while (u != 0) {
+    out.push_back(static_cast<char>('0' + static_cast<int>(u % 10)));
+    u /= 10;
+  }
+  if (neg) out.push_back('-');
+  return {out.rbegin(), out.rend()};
+}
+
+std::string dump(const J& j) {
+  switch (j.k) {
+    case J::K::Null: return "null";
+    case J::K::Bool: return j.b ? "true" : "false";
+    case J::K::Int: return int128_text(j.i);
+    case J::K::Dbl: {
+      std::ostringstream os;
+      os << j.d;
+      return os.str();
+    }
+    case J::K::Str: return "\"" + j.s + "\"";
+    case J::K::Arr: {
+      std::string out = "[";
+      for (std::size_t n = 0; n < j.a.size(); ++n) out += (n ? "," : "") + dump(j.a[n]);
+      return out + "]";
+    }
+    case J::K::Obj: {
+      std::string out = "{";
+      for (std::size_t n = 0; n < j.o.size(); ++n) out += (n ? "," : "") + ("\"" + j.o[n].first + "\":") + dump(j.o[n].second);
+      return out + "}";
+    }
+  }
+  return "?";
+}
+
+// Structural equality; objects by key set, arrays in order. `why` names the first difference.
+bool same(const J& a, const J& b, const std::string& path, std::string& why) {
+  if (a.k != b.k) {
+    why = path + ": " + dump(a) + " (expected) != " + dump(b) + " (engine)";
+    return false;
+  }
+  switch (a.k) {
+    case J::K::Null: return true;
+    case J::K::Bool:
+      if (a.b == b.b) return true;
+      break;
+    case J::K::Int:
+      if (a.i == b.i) return true;
+      break;
+    case J::K::Dbl:
+      if (a.d == b.d) return true;
+      break;
+    case J::K::Str:
+      if (a.s == b.s) return true;
+      break;
+    case J::K::Arr:
+      if (a.a.size() != b.a.size()) {
+        why = path + ": length " + std::to_string(a.a.size()) + " (expected) != " + std::to_string(b.a.size()) +
+              " (engine): " + dump(a) + " vs " + dump(b);
+        return false;
+      }
+      for (std::size_t n = 0; n < a.a.size(); ++n) {
+        if (!same(a.a[n], b.a[n], path + "[" + std::to_string(n) + "]", why)) return false;
+      }
+      return true;
+    case J::K::Obj:
+      for (const auto& [key, v] : a.o) {
+        const J* w = b.get(key);
+        if (w == nullptr) {
+          why = path + "." + key + ": missing in the engine's value";
+          return false;
+        }
+        if (!same(v, *w, path + "." + key, why)) return false;
+      }
+      for (const auto& [key, v] : b.o) {
+        if (a.get(key) == nullptr) {
+          why = path + "." + key + ": only in the engine's value (" + dump(v) + ")";
+          return false;
+        }
+      }
+      return true;
+  }
+  why = path + ": " + dump(a) + " (expected) != " + dump(b) + " (engine)";
+  return false;
+}
+
+// ---------------------------------------------------------------- the engine as JSON values
+
+template <class T>
+J ints(const T& v) {
+  J j = J::arr();
+  for (const auto& x : v) j.push(J::integer(static_cast<Int128>(x)));
+  return j;
+}
+
+template <class A, class B>
+J pairs(const std::vector<std::pair<A, B>>& v) {
+  J j = J::arr();
+  for (const auto& [x, y] : v) {
+    J p = J::arr();
+    p.push(J::integer(static_cast<Int128>(x)));
+    p.push(J::integer(static_cast<Int128>(y)));
+    j.push(std::move(p));
+  }
+  return j;
+}
+
+Int128 wide(const Counter128& c) {
+  return test::int128_of(static_cast<std::int64_t>(c.hi), c.lo);
+}
+
+const char* outcome_name(Termination t) {
+  switch (t) {
+    case Termination::Complete: return "complete";
+    case Termination::NoRoute: return "no_route";
+    case Termination::Exhausted: return "exhausted";
+    case Termination::NoActiveWeight: return "no_active_weight";
+  }
+  return "?";
+}
+
+J counter_pairs(const std::vector<std::pair<EdgeId, Counter128>>& v) {
+  J j = J::arr();
+  for (const auto& [e, c] : v) {
+    J p = J::arr();
+    p.push(J::integer(e));
+    p.push(J::integer(wide(c)));
+    j.push(std::move(p));
+  }
+  return j;
+}
+
+J result_json(const PlacementResult& r) {
+  J j = J::obj();
+  j.set("placed", J::integer(r.call_delivered));
+  j.set("remaining", r.call_undelivered.has_value() ? J::integer(*r.call_undelivered) : J::str("inf"));
+  j.set("delivery_delta", J::integer(r.delivery_delta));
+  j.set("call_drops", pairs(r.call_edge_drops));
+  j.set("call_source_loss", J::integer(r.call_source_drops));
+  j.set("termination", J::str(outcome_name(r.termination)));
+  j.set("routes_changed", J::boolean(r.routes_changed));
+  j.set("weights_changed", J::boolean(r.weights_changed));
+  j.set("requested", r.requested.has_value() ? J::integer(wide(*r.requested)) : J::str("inf"));
+  j.set("admitted", J::integer(wide(r.admitted)));
+  j.set("delivered", J::integer(r.delivered));
+  j.set("source_loss", J::integer(wide(r.source_drops)));
+  j.set("drops", counter_pairs(r.edge_drops));
+  J rows = J::arr();
+  for (const auto& x : r.by_source) {
+    J row = J::arr();
+    row.push(J::integer(x.source));
+    row.push(x.offered.has_value() ? J::integer(wide(*x.offered)) : J::null());
+    row.push(J::integer(wide(x.admitted)));
+    row.push(J::integer(x.delivered));
+    row.push(J::integer(wide(x.source_drops)));
+    row.push(J::integer(wide(x.total_edge_drops)));
+    rows.push(std::move(row));
+  }
+  j.set("by_source", std::move(rows));
+  if (r.offered.has_value()) j.set("offered", J::integer(wide(*r.offered)));
+  if (r.unadmitted.has_value()) j.set("unadmitted", J::integer(wide(*r.unadmitted)));
+  if (r.total_cost.has_value()) j.set("total_cost", J::integer(wide(*r.total_cost)));
+  if (r.marginal_cost_curve.has_value()) j.set("cost_distribution", pairs(*r.marginal_cost_curve));
+  if (r.edge_flows.has_value()) j.set("edge_flows", ints(*r.edge_flows));
+  if (r.residual.has_value()) j.set("residual", ints(*r.residual));
+  if (r.saturated_boundary_edges.has_value()) j.set("bottleneck", ints(*r.saturated_boundary_edges));
+  if (r.min_cut.has_value()) j.set("min_cut", ints(*r.min_cut));
+  return j;
+}
+
+J ledger_json(const FlowLedger& fg) {
+  J j = J::obj();
+  j.set("allocated", ints(fg.carried()));
+  j.set("residual", ints(fg.residual()));
+  J recs = J::arr();
+  for (const auto& r : fg.records()) {
+    J x = J::obj();
+    x.set("flow_id", J::integer(r.flow_id.second));
+    x.set("owner", J::integer(r.policy_id));
+    x.set("sources", ints(r.sources));
+    x.set("destinations", ints(r.destinations));
+    x.set("admission", J::str(r.admission == Admission::Lossy ? "Lossy" : "Lossless"));
+    x.set("bundle", ints(detail::PredecessorDAGBuilder::ascending(*r.route)));
+    x.set("route_cost", r.min_route_cost == kUnreachable ? J::null() : J::integer(r.min_route_cost));
+    x.set("offered", r.offered.has_value() ? J::integer(wide(*r.offered)) : J::null());
+    x.set("delivered", J::integer(r.delivered));
+    x.set("edges", pairs(r.edge_flows));
+    J drops = J::arr();
+    for (const auto& [e, c] : r.edge_drops) {
+      J p = J::arr();
+      p.push(J::integer(e));
+      p.push(J::integer(wide(c)));
+      drops.push(std::move(p));
+    }
+    x.set("drops", std::move(drops));
+    recs.push(std::move(x));
+  }
+  j.set("records", std::move(recs));
+  j.set("next_flow_id", J::integer(LedgerAccess::next_record_counter(fg)));
+  j.set("bound", ints(LedgerAccess::bound_policy_ids(fg)));
+  j.set("orphans", ints(LedgerAccess::orphan_policy_ids(fg)));
+  return j;
+}
+
+J policy_json(const FlowPolicy& policy) {
+  const auto& pe = detail::PolicyAccess::engine(policy);
+  const bool lossy = pe.config.admission == Admission::Lossy;
+  J j = J::obj();
+  j.set("roster", ints(pe.reachable_sources));
+  j.set("requested", J::integer(wide(pe.epoch.requested)));
+  j.set("infinite", J::boolean(pe.epoch.infinite));
+  j.set("placed_demand", J::integer(policy.delivered()));
+  J record_groups = J::arr();
+  for (std::size_t i = 0; i < pe.reachable_sources.size(); ++i) {
+    if (pe.epoch.record_groups[i].empty()) continue;
+    J flows = J::arr();
+    for (const auto& s : pe.epoch.record_groups[i]) {
+      const FlowRecord& rec = LedgerAccess::live(pe.ledger, s.record_counter);
+      const auto e = detail::PredecessorDAGBuilder::ascending(*s.route);
+      const std::vector<EdgeId> route(e.begin(), e.end());
+      J f = J::obj();
+      f.set("id", J::integer(s.record_counter));
+      f.set("route", ints(route));
+      f.set("T", lossy ? J::null() : J::integer(rec.delivered));
+      f.set("delivered", J::integer(rec.delivered));
+      f.set("alloc", pairs(rec.edge_flows));
+      flows.push(std::move(f));
+    }
+    J entry = J::arr();
+    entry.push(J::integer(pe.reachable_sources[i]));
+    entry.push(std::move(flows));
+    record_groups.push(std::move(entry));
+  }
+  j.set("cohorts", std::move(record_groups));
+  return j;
+}
+
+// The trace with the normalisation of the exported data: probe counts, counters and ledger uids
+// dropped, FlowIds as ids.
+J trace_json(const detail::Trace& t) {
+  using K = detail::Trace::Kind;
+  switch (t.kind) {
+    case K::Null: return J::null();
+    case K::Int: return J::integer(t.i);
+    case K::Str: return J::str(t.s);
+    case K::List: {
+      J j = J::arr();
+      for (const auto& x : t.items) j.push(trace_json(x));
+      return j;
+    }
+    case K::Map: {
+      J j = J::obj();
+      for (const auto& [key, x] : t.fields) {
+        if (key == "ledger_uid" || key == "counters") continue;
+        if ((key == "flow" || key == "flow_id") && x.kind == K::List && x.items.size() == 2) {
+          j.set(key, J::integer(x.items[1].i));
+          continue;
+        }
+        j.set(key, trace_json(x));
+      }
+      return j;
+    }
+  }
+  return J::null();
+}
+
+// ---------------------------------------------------------------- the replay
+
+std::vector<std::int32_t> int32s(const J& j) {
+  std::vector<std::int32_t> out;
+  for (const auto& x : j.a) out.push_back(static_cast<std::int32_t>(x.int64()));
+  return out;
+}
+
+std::vector<Amount> amounts(const J& j) {
+  std::vector<Amount> out;
+  for (const auto& x : j.a) out.push_back(x.int64());
+  return out;
+}
+
+std::vector<NodeId> endpoints(const J& j) {
+  if (j.k == J::K::Int) return {static_cast<NodeId>(j.int64())};
+  return int32s(j);
+}
+
+// A name in the data that the replay does not know: the data and the replay disagree, which is a
+// failure of the replay, never a rejection by the engine.
+struct UnknownName : std::runtime_error {
+  using std::runtime_error::runtime_error;
+};
+
+// The value the data names `name` among `values`; any other name throws UnknownName.
+template <typename T>
+T named(const std::string& what, const std::string& name, std::initializer_list<std::pair<std::string, T>> values) {
+  for (const auto& [n, v] : values) {
+    if (n == name) return v;
+  }
+  throw UnknownName("the data names an unknown " + what + " (" + name + ")");
+}
+
+FlowPolicyConfig config_of(const Graph& g, const J& c) {
+  const J& r = c.at("routing");
+  const std::string kind = r.at("kind").s;
+  Routing routing = ShortestPaths {};
+  if (kind == "Global") {
+    CentralizedTE gl(SourceAllocation::Optimized);  // the frozen data's Global: the optimized source allocation
+    if (const J* support = r.get("support")) gl.support = test::dag_of(g, int32s(*support));
+    routing = gl;
+  } else if (kind != "CostOnly") {
+    throw UnknownName("the data names an unknown routing (" + kind + ")");
+  }
+  FlowPolicyConfig out {.routing = std::move(routing)};
+  auto* sp = std::get_if<ShortestPaths>(&out.routing);
+  if (!c.at("placement").is_null()) {
+    const auto allocation = named<RouteAllocation>("placement", c.at("placement").s,
+                                                   {{"MaxFlow", RouteAllocation::Optimized},
+                                                    {"Weighted", RouteAllocation::Weighted},
+                                                    {"EqualBalanced", RouteAllocation::Equal}});
+    if (sp == nullptr) throw UnknownName("the data names a placement for a routing without one (" + kind + ")");
+    sp->allocation = allocation;
+  }
+  out.admission = named<Admission>("admission", c.at("admission").s,
+                                   {{"Lossless", Admission::Lossless}, {"Lossy", Admission::Lossy}});
+  if (const J& sel = c.at("selection"); !sel.is_null()) {
+    const bool prefer = named<bool>("tie break", sel.at("tie_break").s,
+                                    {{"Deterministic", false}, {"PreferHigherPriority", true}});
+    const RouteTieBreak higher = named<RouteTieBreak>("priority", sel.at("priority").s,
+                                                      {{"Residual", RouteTieBreak::HigherAvailableCapacity},
+                                                       {"Capacity", RouteTieBreak::HigherCapacity},
+                                                       {"Headroom", RouteTieBreak::HigherHeadroom}});
+    if (sp == nullptr) throw UnknownName("the data names a selection for a routing without a route choice (" + kind + ")");
+    sp->tie_break = prefer ? higher : RouteTieBreak::FewerHops;
+    sp->multipath = sel.at("multipath").b;
+    sp->parallel_edges = sel.at("multi_edge").b;
+  }
+  if (const J* w = c.get("weights")) {
+    const auto basis = named<WeightBasis>("weight basis", w->s,
+                                          {{"Capacity", WeightBasis::Capacity},
+                                           {"Explicit", WeightBasis::Explicit},
+                                           {"ResidualSnapshot", WeightBasis::ResidualSnapshot}});
+    if (sp == nullptr) throw UnknownName("the data names weights for a routing without them (" + kind + ")");
+    sp->weight_basis = basis;
+  }
+  return out;
+}
+
+// Replays one fixture; returns the failures (empty when every value matches). `compared`, when
+// given, counts the expectations compared. `after_rejected_call`, when given, runs with the
+// operation's index and its policy right after each call the reference rejects, before the policy
+// is compared with its state before the call (the negative control of that comparison changes the
+// policy there). `inside_call`, when given, runs with the operation's index inside the guarded
+// part of every ledger, policy and placement operation, before the engine's call (the
+// negative control of the rejection rule throws there). The engine rejects an operation with
+// std::invalid_argument only; any other exception (an internal invariant's std::logic_error,
+// std::bad_alloc, a reader of the data) is a failure, also where the reference rejects.
+std::vector<std::string> replay(const J& fx, std::size_t* compared = nullptr,
+                                const std::function<void(std::size_t, FlowPolicy&)>& after_rejected_call = {},
+                                const std::function<void(std::size_t)>& inside_call = {}) {
+  std::vector<std::string> fails;
+  const std::string name = fx.at("name").s;
+  std::vector<std::shared_ptr<const Graph>> graphs;
+  for (const auto& spec : fx.at("graphs").a) {
+    std::vector<test::InEdge> edges;
+    for (const auto& e : spec.at("edges").a) {
+      edges.push_back({static_cast<NodeId>(e.a[0].int64()), static_cast<NodeId>(e.a[1].int64()), e.a[2].int64(),
+                       e.a[3].int64()});
+    }
+    const double q = spec.at("q").k == J::K::Dbl ? spec.at("q").d : static_cast<double>(spec.at("q").int64());
+    auto g = std::make_shared<const Graph>(
+        test::make_graph(static_cast<std::int32_t>(spec.at("n").int64()), edges, q));
+    const auto ii = g->input_positions();
+    if (std::vector<std::int32_t>(ii.begin(), ii.end()) != int32s(spec.at("input_index"))) {
+      fails.push_back(name + ": the engine ranks the edges differently (input_index)");
+      return fails;
+    }
+    graphs.push_back(std::move(g));
+  }
+  // Lifetimes: graphs outlive the ledgers and the Eligibility values, which outlive the policies.
+  std::deque<FlowLedger> ledgers;
+  std::vector<FlowLedger*> ledger_of_id;
+  std::deque<Eligibility> eligs;
+  std::vector<std::unique_ptr<FlowPolicy>> policies;
+  std::vector<FlowLedger*> policy_ledger;
+  auto check = [&](const std::string& where, const char* what, const J& expected, const J& actual) {
+    if (compared != nullptr) ++*compared;
+    std::string why;
+    if (!same(expected, actual, what, why)) fails.push_back(name + " " + where + ": " + why);
+  };
+  auto not_a_rejection = [&](const std::string& where, const std::exception& e) {
+    fails.push_back(name + " " + where + ": throws an exception other than a rejection: " + e.what());
+    return fails;
+  };
+  auto planted = [&](std::size_t n) {
+    if (inside_call) inside_call(n);
+  };
+  const auto& ops = fx.at("ops").a;
+  for (std::size_t n = 0; n < ops.size(); ++n) {
+    const J& op = ops[n];
+    const std::string kind = op.at("op").s;
+    const std::string where = "op " + std::to_string(n) + " (" + kind + ")";
+    const bool error = op.at("error").b;
+    const J* expect = op.get("expect");
+    if (kind == "ledger") {
+      const auto& g = graphs[static_cast<std::size_t>(op.at("graph").int64())];
+      try {
+        planted(n);
+        if (op.at("baseline").is_null()) {
+          ledgers.emplace_back(g);
+        } else {
+          ledgers.emplace_back(g, amounts(op.at("baseline")));
+        }
+        if (error) fails.push_back(name + " " + where + ": accepted, the reference rejects it");
+        ledger_of_id.push_back(&ledgers.back());
+      } catch (const std::invalid_argument& e) {
+        if (!error) {
+          fails.push_back(name + " " + where + ": throws " + e.what());
+          return fails;  // the later operations name a ledger that does not exist
+        }
+      } catch (const std::exception& e) {
+        return not_a_rejection(where, e);
+      }
+      continue;
+    }
+    if (kind == "policy") {
+      FlowLedger& fg = *ledger_of_id[static_cast<std::size_t>(op.at("ledger").int64())];
+      const auto& g = *fg.graph();
+      std::unique_ptr<FlowPolicy> pol;
+      try {
+        planted(n);
+        const Eligibility* elig = nullptr;
+        if (!op.at("elig").is_null()) {
+          eligs.push_back(g.eligibility(int32s(op.at("elig").at("nodes")), int32s(op.at("elig").at("edges"))));
+          elig = &eligs.back();
+        }
+        auto cfg = config_of(g, op.at("config"));
+        pol = std::make_unique<FlowPolicy>(fg, endpoints(op.at("sources")), endpoints(op.at("destinations")),
+                                           std::move(cfg), elig);
+      } catch (const UnknownName& e) {
+        fails.push_back(name + " " + where + ": " + e.what());
+        return fails;
+      } catch (const std::invalid_argument& e) {
+        if (!error) {
+          fails.push_back(name + " " + where + ": throws " + e.what());
+          return fails;  // the later operations name a policy that does not exist
+        }
+        continue;
+      } catch (const std::exception& e) {
+        return not_a_rejection(where, e);
+      }
+      if (error) {
+        fails.push_back(name + " " + where + ": accepted, the reference rejects it");
+        return fails;
+      }
+      policies.push_back(std::move(pol));
+      policy_ledger.push_back(&fg);
+      check(where, "policy", expect->at("policy"), policy_json(*policies.back()));
+      continue;
+    }
+    const auto pi = static_cast<std::size_t>(op.at("policy").int64());
+    const FlowLedger& fg = *policy_ledger[pi];
+    if (kind == "remove" && error) {
+      // It cannot fail here, so a reference that rejects one is a difference.
+      fails.push_back(name + " " + where + ": accepted, the reference rejects it");
+      return fails;
+    }
+    FlowPolicy& pol = *policies[pi];
+    if (kind == "remove") {
+      pol.remove();
+      check(where, "ledger", expect->at("ledger"), ledger_json(fg));
+      check(where, "policy", expect->at("policy"), policy_json(pol));
+      continue;
+    }
+    if (kind != "place") {
+      fails.push_back(name + " " + where + ": an unknown operation");
+      return fails;
+    }
+    std::optional<Amount> volume;
+    if (op.at("volume").k == J::K::Int) volume = op.at("volume").int64();
+    if (op.at("volume").k == J::K::Str && op.at("volume").s != "inf") {
+      fails.push_back(name + " " + where + ": unexpected volume " + dump(op.at("volume")));
+      continue;
+    }
+    if (op.at("volume").k == J::K::Dbl) {
+      // A non-integer request: the reference rejects it, as the bindings do; C++ has no such value.
+      if (!error) fails.push_back(name + " " + where + ": a non-integer request accepted by the reference");
+      continue;
+    }
+    OutputOptions outputs;
+    if (!op.at("outputs").is_null()) {
+      const auto& o = op.at("outputs").a;
+      outputs = OutputOptions {o[0].b, o[1].b, o[2].b, o[3].b};
+    }
+    const J policy_before = error ? policy_json(pol) : J::null();
+    detail::Trace trace;
+    PlacementResult r;
+    bool threw = false;
+    try {
+      planted(n);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      r = detail::place_traced(pol, volume, outputs, trace);
+#else
+      r = pol.place(volume, outputs);
+#endif
+    } catch (const std::invalid_argument&) {
+      threw = true;
+    } catch (const std::exception& e) {
+      return not_a_rejection(where, e);
+    }
+    if (threw != error) {
+      fails.push_back(name + " " + where + (error ? ": accepted, the reference rejects it" : ": throws"));
+      return fails;
+    }
+    if (error) {
+      if (after_rejected_call) after_rejected_call(n, pol);
+      // A rejected call leaves the ledger as the reference has it and the policy as it was (the
+      // data holds no policy section for it, so this comparison is not an expectation).
+      check(where, "ledger", expect->at("ledger"), ledger_json(fg));
+      std::string why;
+      if (!same(policy_before, policy_json(pol), "policy", why)) {
+        fails.push_back(name + " " + where + ": the rejected call changed the policy: " + why);
+      }
+      continue;
+    }
+    check(where, "result", expect->at("result"), result_json(r));
+    if (detail::kTraced) check(where, "trace", expect->at("trace"), trace_json(trace));
+    check(where, "ledger", expect->at("ledger"), ledger_json(fg));
+    check(where, "policy", expect->at("policy"), policy_json(pol));
+  }
+  return fails;
+}
+
+} // namespace
+
+TEST(PolicyFixtures, EveryFixtureReplaysIdentically) {
+  const J& d = data();
+  std::size_t sections = 0;  // the expectations the data holds (without the hooks: no trace)
+  std::size_t compared = 0;  // the expectations the replay compared
+  std::size_t replayed = 0;
+  for (const auto& fx : d.at("fixtures").a) {
+    ++replayed;
+    for (const auto& op : fx.at("ops").a) {
+      if (const J* expect = op.get("expect"); expect != nullptr) {
+        sections += expect->o.size() - (!detail::kTraced && expect->get("trace") != nullptr ? 1 : 0);
+      }
+    }
+    const auto fails = replay(fx, &compared);
+    for (const auto& f : fails) ADD_FAILURE() << f;
+  }
+  EXPECT_EQ(replayed, 31U);
+  EXPECT_EQ(sections, detail::kTraced ? 693U : 548U);  // the data's count, not vacuous
+  EXPECT_EQ(compared, sections);  // every expectation was compared, none skipped
+}
+
+namespace {
+
+// One leaf changed: a null becomes 0, a boolean flips, a number grows by one, a string gains a
+// character. Returns its kind: 0 integer, 1 boolean, 2 string, 3 other.
+int corrupt(J& leaf) {
+  switch (leaf.k) {
+    case J::K::Null: leaf = J::integer(0); return 3;
+    case J::K::Bool: leaf.b = !leaf.b; return 1;
+    case J::K::Int: leaf.i += 1; return 0;
+    case J::K::Dbl: leaf.d += 1.0; return 3;
+    case J::K::Str: leaf.s += "#"; return 2;
+    default: return 3;
+  }
+}
+
+// The member `key` of an object, for writing.
+J& member(J& x, const std::string& key) {
+  for (auto& [k, v] : x.o) {
+    if (k == key) return v;
+  }
+  throw std::out_of_range("no member " + key);
+}
+
+// The first leaf of x in document order (an empty container has none); nullptr when x has none.
+J* first_leaf(J& x) {
+  if (x.k == J::K::Arr) {
+    for (auto& y : x.a) {
+      if (J* l = first_leaf(y); l != nullptr) return l;
+    }
+    return nullptr;
+  }
+  if (x.k == J::K::Obj) {
+    for (auto& [k, y] : x.o) {
+      if (J* l = first_leaf(y); l != nullptr) return l;
+    }
+    return nullptr;
+  }
+  return &x;
+}
+
+// Whether the replay of fx reports a failure that starts with `prefix`.
+bool reported(const J& fx, const std::string& prefix) {
+  return test::has_failure(replay(fx), prefix);
+}
+
+// The replay's other failure clauses, each reported at the operation it concerns: the first leaf
+// of every section of every other operation's expectations (failed placements, policies,
+// removals); the error flag of the first operation of every kind and
+// outcome in each fixture; the input order of the first graph; an unknown operation; a ledger the
+// data accepts and the engine rejects; an unknown and a non-integer volume; the curve a CentralizedTE
+// zero call reports, against the remembered one; a policy changed by a call the data rejects;
+// an exception other than a rejection; and a configuration name the replay does not know.
+void expect_every_other_clause_reported() {
+  const J& d = data();
+  std::set<std::string> sections;  // "kind error key" combinations corrupted
+  std::set<std::string> flags;     // "kind error" combinations flipped
+  std::size_t exercised = 0;       // fixtures whose clauses were exercised
+  for (const auto& fx : d.at("fixtures").a) {
+    ++exercised;
+    const std::string name = fx.at("name").s;
+    ASSERT_TRUE(replay(fx).empty()) << name;
+    std::set<std::string> flipped;
+    for (std::size_t n = 0; n < fx.at("ops").a.size(); ++n) {
+      const J& op = fx.at("ops").a[n];
+      const std::string kind = op.at("op").s;
+      const bool error = op.at("error").b;
+      const std::string combination = kind + (error ? " failed" : " ok");
+      const std::string at = name + " op " + std::to_string(n) + " (" + kind + ")";
+      if (const J* expect = op.get("expect"); expect != nullptr && (kind != "place" || error)) {
+        for (const auto& [key, section] : expect->o) {
+          J copy = fx;
+          J* leaf = first_leaf(member(member(member(copy, "ops").a[n], "expect"), key));
+          ASSERT_NE(leaf, nullptr) << at << " " << key;
+          corrupt(*leaf);
+          EXPECT_TRUE(reported(copy, at + ": " + key)) << "undetected: " << at << " " << key;
+          sections.insert(combination + " " + key);
+        }
+      }
+      if (flipped.insert(combination).second) {
+        J copy = fx;
+        auto& flag = member(member(copy, "ops").a[n], "error");
+        flag.b = !flag.b;
+        EXPECT_TRUE(reported(copy, at + ": ")) << "undetected error flag: " << at;
+        flags.insert(combination);
+      }
+    }
+    J reordered = fx;
+    J* first = first_leaf(member(member(reordered, "graphs").a[0], "input_index"));
+    ASSERT_NE(first, nullptr) << name;
+    corrupt(*first);
+    EXPECT_TRUE(reported(reordered, name + ": the engine ranks the edges differently")) << name;
+  }
+  EXPECT_EQ(exercised, 31U);
+  // Every section of every other operation kind and outcome in the data, and every flag.
+  EXPECT_EQ(sections, (std::set<std::string> {"place failed ledger", "policy ok policy", "remove ok ledger",
+                                              "remove ok policy"}));
+  EXPECT_EQ(flags, (std::set<std::string> {"ledger ok", "place failed", "place ok", "policy failed", "policy ok",
+                                           "remove ok"}));
+  // Op 3 of global_epochs renamed: an unknown operation.
+  const auto& fixtures = d.at("fixtures").a;
+  const auto& epochs = *std::find_if(fixtures.begin(), fixtures.end(),
+                                     [](const J& fx) { return fx.at("name").s == "global_epochs"; });
+  ASSERT_EQ(epochs.at("ops").a[3].at("op").s, "place");
+  J renamed = epochs;
+  member(member(renamed, "ops").a[3], "op") = J::str("move");
+  EXPECT_TRUE(reported(renamed, "global_epochs op 3 (move): an unknown operation"));
+  // A ledger the data accepts and the engine rejects: op 0's baseline, one entry for two edges.
+  ASSERT_EQ(epochs.at("ops").a[0].at("op").s, "ledger");
+  J rejected = epochs;
+  auto& baseline = member(member(rejected, "ops").a[0], "baseline");
+  baseline = J::arr();
+  baseline.a.push_back(J::integer(-1));
+  EXPECT_TRUE(reported(rejected, "global_epochs op 0 (ledger): throws "));
+  // The volume of op 3 of global_epochs: neither "inf" nor an integer, then a non-integer number
+  // the data says is accepted.
+  J unknown = epochs;
+  member(member(unknown, "ops").a[3], "volume") = J::str("many");
+  EXPECT_TRUE(reported(unknown, "global_epochs op 3 (place): unexpected volume"));
+  J fractional = epochs;
+  auto& volume = member(member(fractional, "ops").a[3], "volume");
+  volume.k = J::K::Dbl;
+  volume.d = 0.5;
+  EXPECT_TRUE(reported(fractional, "global_epochs op 3 (place): a non-integer request accepted"));
+  // Op 2 of global_epochs is a CentralizedTE zero call on a fresh policy (no curve: nothing prepared),
+  // op 3 a positive call with the curve [[1, 1]]. With op 3 moved before op 2, the zero call
+  // reports the remembered curve [[1, 1]] where the data, recorded before any placement, has
+  // none: a result difference.
+  ASSERT_EQ(dump(epochs.at("ops").a[2].at("volume")), "0");
+  ASSERT_EQ(epochs.at("ops").a[2].at("expect").at("result").get("cost_distribution"), nullptr);
+  J swapped = epochs;
+  auto& ops = member(swapped, "ops").a;
+  std::swap(ops[2], ops[3]);
+  EXPECT_TRUE(reported(swapped, "global_epochs op 3 (place): result"));
+  // Every call the data rejects, with the policy changed after it (its +inf flag flipped; after
+  // that call only): the comparison with the policy before the call reports it.
+  std::size_t rejected_calls = 0;
+  for (const auto& fx : fixtures) {
+    for (std::size_t n = 0; n < fx.at("ops").a.size(); ++n) {
+      const J& op = fx.at("ops").a[n];
+      if (op.at("op").s != "place" || !op.at("error").b) continue;
+      ++rejected_calls;
+      const auto fails = replay(fx, nullptr, [n](std::size_t at, FlowPolicy& p) {
+        if (at != n) return;
+        auto& engine = detail::PolicyAccess::engine(p);
+        engine.epoch.infinite = !engine.epoch.infinite;
+      });
+      const std::string at = fx.at("name").s + " op " + std::to_string(n) + " (place)";
+      EXPECT_TRUE(test::has_failure(fails, at + ": the rejected call changed the policy")) << at;
+    }
+  }
+  EXPECT_EQ(rejected_calls, 3U);
+  // An exception other than std::invalid_argument (an internal invariant's std::logic_error)
+  // thrown inside the first operation of each kind, the first one the data rejects where there
+  // is one: a failure at that operation, never taken for the expected rejection.
+  std::set<std::string> planted;
+  for (const std::string kind : {"ledger", "policy", "place"}) {
+    const J* chosen = nullptr;
+    std::size_t at = 0;
+    for (const auto& fx : fixtures) {
+      for (std::size_t n = 0; n < fx.at("ops").a.size(); ++n) {
+        const J& op = fx.at("ops").a[n];
+        if (op.at("op").s != kind) continue;
+        if (chosen == nullptr || (op.at("error").b && !chosen->at("ops").a[at].at("error").b)) {
+          chosen = &fx;
+          at = n;
+        }
+      }
+    }
+    ASSERT_NE(chosen, nullptr) << kind;
+    const bool error = chosen->at("ops").a[at].at("error").b;
+    planted.insert(kind + (error ? " failed" : " ok"));
+    const auto fails = replay(*chosen, nullptr, {}, [at](std::size_t n) {
+      if (n == at) throw std::logic_error("planted");
+    });
+    const std::string where = chosen->at("name").s + " op " + std::to_string(at) + " (" + kind + ")";
+    EXPECT_TRUE(test::has_failure(fails, where + ": throws an exception other than a rejection: planted")) << where;
+  }
+  EXPECT_EQ(planted, (std::set<std::string> {"ledger ok", "place failed", "policy failed"}));
+  // A name the replay does not know, in the configuration of eb_unequal_1_10's ShortestPaths policy
+  // (op 1): a failure of the replay, never taken for the engine rejecting the policy.
+  const auto& unequal = *std::find_if(fixtures.begin(), fixtures.end(),
+                                      [](const J& fx) { return fx.at("name").s == "eb_unequal_1_10"; });
+  ASSERT_EQ(unequal.at("ops").a[1].at("op").s, "policy");
+  for (const std::string path :
+       {"routing kind", "placement", "admission", "selection tie_break", "selection priority"}) {
+    J copy = unequal;
+    J* config = &member(member(copy, "ops").a[1], "config");
+    std::string key = path;
+    if (const auto space = path.find(' '); space != std::string::npos) {
+      config = &member(*config, path.substr(0, space));
+      key = path.substr(space + 1);
+    }
+    member(*config, key) = J::str("Unknown");
+    EXPECT_TRUE(reported(copy, "eb_unequal_1_10 op 1 (policy): the data names an unknown ")) << path;
+  }
+}
+
+// The comparison's structural clauses, which the leaf corruptions above never reach: equal
+// values pass, and an array of another length, a key the engine lacks, a key only the engine has
+// and a value of another kind each fail with their own message.
+void expect_the_comparison_reports_shape_differences() {
+  auto diff = [](const std::string& expected, const std::string& engine) {
+    std::string why;
+    return same(Parser(expected).parse(), Parser(engine).parse(), "x", why) ? std::string("same") : why;
+  };
+  EXPECT_EQ(diff(R"({"a": [1, 2], "b": null})", R"({"b": null, "a": [1, 2]})"), "same");
+  EXPECT_EQ(diff("[1, 2]", "[1]"), "x: length 2 (expected) != 1 (engine): [1,2] vs [1]");
+  EXPECT_EQ(diff("[1]", "[1, 2]"), "x: length 1 (expected) != 2 (engine): [1] vs [1,2]");
+  EXPECT_EQ(diff(R"({"a": 1, "b": 2})", R"({"a": 1})"), "x.b: missing in the engine's value");
+  EXPECT_EQ(diff(R"({"a": 1})", R"({"a": 1, "c": 3})"), "x.c: only in the engine's value (3)");
+  EXPECT_EQ(diff(R"({"a": [1]})", R"({"a": 1})"), "x.a: [1] (expected) != 1 (engine)");
+  EXPECT_EQ(diff("[[1, 2]]", "[[1, 3]]"), "x[0][1]: 2 (expected) != 3 (engine)");
+}
+
+} // namespace
+
+// The comparison is not vacuous: a corrupted expectation is reported at the operation and by the
+// section it changes. In the first successful placement of every fixture, each section (result,
+// trace, ledger, policy) gets several single corruptions: its first and last integer, boolean
+// and string leaves, and one leaf drawn at random. Then the replay's other clauses and the
+// comparison's structural clauses (above). Without the hooks the replay compares no trace, so it
+// is not corrupted; the counts below are those of each configuration (the random draws come from std::mt19937_64, whose sequence the
+// standard fixes, so they are the same with every standard library).
+TEST(PolicyFixtures, ACorruptedExpectationFails) {
+  const J& d = data();
+  std::mt19937_64 rng(837);
+  std::size_t corrupted = 0;
+  std::size_t detected = 0;
+  std::size_t fixtures = 0;  // fixtures whose first successful placement was corrupted
+  std::size_t kinds[4] = {0, 0, 0, 0};  // integers, booleans, strings, others
+  for (const auto& fx : d.at("fixtures").a) {
+    for (std::size_t n = 0; n < fx.at("ops").a.size(); ++n) {
+      const J& op = fx.at("ops").a[n];
+      if (op.at("op").s != "place" || op.at("error").b) continue;
+      ++fixtures;
+      for (const std::string key : {"result", "trace", "ledger", "policy"}) {
+        if (!detail::kTraced && key == "trace") continue;
+        // The leaves of the section in document order, as paths of child indices.
+        std::vector<std::vector<std::size_t>> leaves;
+        std::vector<std::size_t> path;
+        std::function<void(const J&)> walk = [&](const J& x) {
+          if (x.k == J::K::Arr || x.k == J::K::Obj) {
+            const std::size_t count = x.k == J::K::Arr ? x.a.size() : x.o.size();
+            for (std::size_t i = 0; i < count; ++i) {
+              path.push_back(i);
+              walk(x.k == J::K::Arr ? x.a[i] : x.o[i].second);
+              path.pop_back();
+            }
+            return;
+          }
+          leaves.push_back(path);
+        };
+        const J& section = op.at("expect").at(key);
+        walk(section);
+        auto leaf = [](auto& root, const std::vector<std::size_t>& at) -> auto& {
+          auto* x = &root;
+          for (std::size_t i : at) x = x->k == J::K::Arr ? &x->a[i] : &x->o[i].second;
+          return *x;
+        };
+        std::set<std::vector<std::size_t>> picks;
+        for (const J::K kind : {J::K::Int, J::K::Bool, J::K::Str}) {
+          std::vector<std::vector<std::size_t>> of_kind;
+          for (const auto& at : leaves) {
+            if (leaf(section, at).k == kind) of_kind.push_back(at);
+          }
+          if (!of_kind.empty()) {
+            picks.insert(of_kind.front());
+            picks.insert(of_kind.back());
+          }
+        }
+        if (!leaves.empty()) picks.insert(leaves[rng() % leaves.size()]);
+        for (const auto& at : picks) {
+          J copy = fx;
+          J* ops = nullptr;
+          for (auto& [k, v] : copy.o) {
+            if (k == "ops") ops = &v;
+          }
+          J* exp = nullptr;
+          for (auto& [k, v] : ops->a[n].o) {
+            if (k == "expect") exp = &v;
+          }
+          J* target = nullptr;
+          for (auto& [k, v] : exp->o) {
+            if (k == key) target = &leaf(v, at);
+          }
+          ASSERT_NE(target->k, J::K::Arr) << "a container is not a leaf";
+          ASSERT_NE(target->k, J::K::Obj) << "a container is not a leaf";
+          ++kinds[corrupt(*target)];
+          ++corrupted;
+          // Reported at this op, by the comparison of this section.
+          const std::string where = fx.at("name").s + " op " + std::to_string(n) + " (place): " + key;
+          if (reported(copy, where)) {
+            ++detected;
+          } else {
+            ADD_FAILURE() << "undetected: " << where;
+          }
+        }
+      }
+      break;  // one placement per fixture
+    }
+  }
+  RecordProperty("corruptions", static_cast<int>(corrupted));
+  EXPECT_EQ(fixtures, 31U);
+  EXPECT_EQ(corrupted, detail::kTraced ? 518U : 429U);
+  EXPECT_GT(kinds[0], 200U);
+  EXPECT_GT(kinds[1], 50U);
+  EXPECT_GT(kinds[2], 50U);
+  EXPECT_EQ(detected, corrupted);
+  expect_every_other_clause_reported();
+  expect_the_comparison_reports_shape_differences();
+}
diff --git a/tests/cpp/flow_policy_tests.cpp b/tests/cpp/flow_policy_tests.cpp
index ac2b499..e0a1684 100644
--- a/tests/cpp/flow_policy_tests.cpp
+++ b/tests/cpp/flow_policy_tests.cpp
@@ -1,507 +1,1851 @@
+// The policy engine beyond the reference's fixtures (those replay in flow_policy_fixture_tests.cpp):
+// configuration validation, the configuration a policy keeps and the route choice ShortestPaths and
+// T1 read, request validation (a rejected request changes nothing) and the per-source round
+// robin of the cumulative request, the outputs (the bottleneck under the policy's Eligibility),
+// CentralizedTE's empty roster, its roster without flow and its zero call's cumulative curve, record
+// routes (sparse storage, sharing, pruning), records in FlowId order, one flow to several nearest
+// destinations, and the evaluators (evaluate_demand, evaluate_pairs, evaluate_edge_failures) with workers and their
+// default from the environment. T1 (DistributedTE) has its own file, distributed_te_tests.cpp; the
+// ShortestPathCache's own modes and key are tested in shortest_path_cache_tests.cpp.
 #include <gtest/gtest.h>
 
-#include "netgraph/core/flow_graph.hpp"
+#include <algorithm>
+#include <cmath>
+#include <cstdlib>
+#include <functional>
+#include <limits>
+#include <map>
+#include <memory>
+#include <numeric>
+#include <optional>
+#include <random>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <type_traits>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/evaluator_checks.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/trace.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
 #include "netgraph/core/flow_policy.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/types.hpp"
+#include "netgraph/core/search.hpp"
+#include "state_comparators.hpp"
 #include "test_utils.hpp"
 
 using namespace netgraph::core;
+using namespace netgraph::core::test;
 
 namespace {
 
-StrictMultiDiGraph make_square1() {
-  // Nodes: 0:A, 1:B, 2:C, 3:D
-  // Edges:
-  // 0: A->B cap=1 cost=1
-  // 1: B->C cap=1 cost=1
-  // 2: A->D cap=2 cost=2
-  // 3: D->C cap=2 cost=2
-  std::int32_t num_nodes = 4;
-  std::int32_t src_arr[4] = {0, 1, 0, 3};
-  std::int32_t dst_arr[4] = {1, 2, 3, 2};
-  double cap_arr[4] = {1.0, 1.0, 2.0, 2.0};
-  std::int64_t cost_arr[4] = {1, 1, 2, 2};
-  std::int64_t ext_arr[4] = {0, 1, 2, 3};
-  std::span<const std::int32_t> src(src_arr, 4);
-  std::span<const std::int32_t> dst(dst_arr, 4);
-  std::span<const double> cap(cap_arr, 4);
-  std::span<const std::int64_t> cost(cost_arr, 4);
-  std::span<const std::int64_t> ext(ext_arr, 4);
-  return StrictMultiDiGraph::from_arrays(num_nodes, src, dst, cap, cost, ext);
-}
-
-StrictMultiDiGraph make_line1() {
-  // Nodes: 0:A, 1:B, 2:C
-  // Edges forward:
-  // A->B cap=5 cost=1
-  // B->C cap=1 cost=1
-  // B->C cap=3 cost=1
-  // B->C cap=7 cost=2
-  std::int32_t num_nodes = 3;
-  std::int32_t src_arr[4] = {0, 1, 1, 1};
-  std::int32_t dst_arr[4] = {1, 2, 2, 2};
-  double cap_arr[4] = {5.0, 1.0, 3.0, 7.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 2};
-  std::int64_t ext_arr[4] = {0, 1, 2, 3};
-  std::span<const std::int32_t> src(src_arr, 4);
-  std::span<const std::int32_t> dst(dst_arr, 4);
-  std::span<const double> cap(cap_arr, 4);
-  std::span<const std::int64_t> cost(cost_arr, 4);
-  std::span<const std::int64_t> ext(ext_arr, 4);
-  return StrictMultiDiGraph::from_arrays(num_nodes, src, dst, cap, cost, ext);
-}
-
-StrictMultiDiGraph make_square3() {
-  // Nodes: 0:A, 1:B, 2:C, 3:D
-  // A->B 100@1, B->C 125@1, A->D 75@1, D->C 50@1
-  std::int32_t num_nodes = 4;
-  std::int32_t src_arr[4] = {0, 1, 0, 3};
-  std::int32_t dst_arr[4] = {1, 2, 3, 2};
-  double cap_arr[4] = {100.0, 125.0, 75.0, 50.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-  std::int64_t ext_arr[4] = {0, 1, 2, 3};
-  std::span<const std::int32_t> src(src_arr, 4);
-  std::span<const std::int32_t> dst(dst_arr, 4);
-  std::span<const double> cap(cap_arr, 4);
-  std::span<const std::int64_t> cost(cost_arr, 4);
-  std::span<const std::int64_t> ext(ext_arr, 4);
-  return StrictMultiDiGraph::from_arrays(num_nodes, src, dst, cap, cost, ext);
-}
-
-void expect_edge_flows_by_uv(const FlowGraph& fg, std::initializer_list<std::tuple<int,int,double>> exp) {
-  const auto& g = fg.graph();
-  auto row = g.row_offsets_view();
-  auto col = g.col_indices_view();
-  auto aei = g.adj_edge_index_view();
-  // Build map EdgeId->flow
-  auto ef = fg.edge_flow_view();
-  // Check each expected (u,v,flow)
-  // When a (u,v) pair appears multiple times, advance through successive edges
-  // in the adjacency row to validate each parallel edge in order.
-  std::map<std::pair<int,int>, std::size_t> cursor;
-  for (auto [u, v, expected] : exp) {
-    bool found = false;
-    // Scan adjacency row for (u->v)
-    auto s = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto e = static_cast<std::size_t>(row[static_cast<std::size_t>(u)+1]);
-    std::size_t start = s;
-    auto key = std::make_pair(u, v);
-    if (auto it = cursor.find(key); it != cursor.end()) start = it->second;
-    for (std::size_t j = start; j < e; ++j) {
-      if (static_cast<int>(col[j]) == v) {
-        auto eid = static_cast<std::size_t>(aei[j]);
-        EXPECT_NEAR(static_cast<double>(ef[eid]), expected, 1e-9) << "edge (" << u << "," << v << ")";
-        cursor[key] = j + 1; // subsequent matches continue after this position
-        found = true;
-        break;
-      }
+detail::RouteChoice sel(RouteTieBreak t = RouteTieBreak::FewerHops, bool multipath = true, bool parallel_edges = true) {
+  return detail::RouteChoice {t, multipath, parallel_edges};
+}
+
+// A configuration: ShortestPaths takes the allocation `k` and the route choice `s`, T1 the tie_break
+// and parallel_edges of `s`; the other models take neither.
+FlowPolicyConfig cfg(Routing r, RouteAllocation k, Admission a = Admission::Lossless, detail::RouteChoice s = sel()) {
+  if (auto* sp = std::get_if<ShortestPaths>(&r)) {
+    sp->allocation = k;
+    sp->tie_break = s.tie_break;
+    sp->multipath = s.multipath;
+    sp->parallel_edges = s.parallel_edges;
+  }
+  if (auto* ca = std::get_if<DistributedTE>(&r)) {
+    ca->tie_break = s.tie_break;
+    ca->parallel_edges = s.parallel_edges;
+  }
+  return FlowPolicyConfig {std::move(r), a};
+}
+
+// A T1 configuration: N tunnels per head, no placement.
+FlowPolicyConfig t1(std::int64_t n, Admission a = Admission::Lossless) {
+  return FlowPolicyConfig {.routing = DistributedTE {TunnelCount {n}}, .admission = a};
+}
+
+// Two disjoint routes 0 -> 1 -> 3 (caps a, cost 1) and 0 -> 2 -> 3 (caps b, cost c). EdgeIds:
+// 0 = 0->1, 1 = 0->2, 2 = 1->3, 3 = 2->3.
+std::shared_ptr<const Graph> diamond(Amount a, Amount b, Cost c = 1) {
+  return shared(make_graph(4, {{0, 1, a, 1}, {1, 3, a, 1}, {0, 2, b, c}, {2, 3, b, c}}));
+}
+
+} // namespace
+
+TEST(FlowPolicyConfig, EveryRejectedCombinationBeforeBinding) {
+  auto g = diamond(5, 5);
+  FlowLedger fg(g);
+  // Each combination is refused with its whole message, and no policy is bound afterwards.
+  auto rejects = [&](const FlowPolicyConfig& c, const std::string& message, std::vector<NodeId> s = {0},
+                     std::vector<NodeId> d = {3}) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, s, d, c); }), message);
+    EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty());
+  };
+  rejects(cfg(ShortestPaths {}, RouteAllocation::Optimized, Admission::Lossy), "ShortestPaths OPTIMIZED requires admission=LOSSLESS");
+  // ShortestPaths's weights come from its weight basis: HIGHER_HEADROOM is a tie rule like the others.
+  EXPECT_EQ(error_of([&] {
+              FlowPolicy p(fg, v({0}), v({3}),
+                           cfg(ShortestPaths {}, RouteAllocation::Weighted, Admission::Lossless,
+                               sel(RouteTieBreak::HigherHeadroom, true, false)));
+            }),
+            "");
+  fg.reset();
+  rejects({.routing = centralized(), .admission = Admission::Lossy}, "CentralizedTE without tunnel_count requires admission=LOSSLESS");
+  // T1: one exact tunnel count in [1, 10000], the ceiling's and the search minimum's own texts (the
+  // T1 rows of the matrix are distributed_te_tests.cpp's).
+  rejects(t1(0), "tunnel count must be in [1, 10000]");
+  rejects({.routing = DistributedTE {TunnelCount {2, true}}}, "DistributedTE requires an exact tunnel count");
+  DistributedTE ca {TunnelCount {1}};
+  ca.min_unreserved_bandwidth = -1;
+  rejects({.routing = ca}, "min_unreserved_bandwidth must be an integer in [0, 2^62)");
+  // The upper bound: 2^62 - 1 units is a valid minimum, 2^62 is not.
+  ca.min_unreserved_bandwidth = kDomainLimit;
+  rejects({.routing = ca}, "min_unreserved_bandwidth must be an integer in [0, 2^62)");
+  ca.min_unreserved_bandwidth = kDomainLimit - 1;
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({3}), {.routing = ca}); }), "");
+  fg.reset();
+  ca = DistributedTE {TunnelCount {1}};
+  ca.cost_ceiling = AbsoluteCost {-1};
+  rejects({.routing = ca}, "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)");
+  // A factor below 1 is a valid value, refused where the ceiling is used, with its reduced
+  // components (the numerator at its lowest included).
+  for (const auto& [f, shown] : {std::pair {CostStretch(1, 2), "1/2"}, std::pair {CostStretch(4, 6), "2/3"},
+                                 std::pair {CostStretch(std::numeric_limits<std::int64_t>::min()), "-9223372036854775808/1"}}) {
+    ca = DistributedTE {TunnelCount {1}};
+    ca.cost_ceiling = f;
+    rejects({.routing = ca}, std::string("cost_ceiling CostStretch factor must be >= 1 (got ") + shown + ")");
+  }
+  // Pinned: a program of this graph whose endpoints are the policy's.
+  rejects({.routing = Pinned {}}, "Pinned requires a program");
+  const Pinned ok = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2})});
+  rejects({.routing = ok}, "program endpoints do not match policy endpoints", {0, 1}, {3});
+  auto other = diamond(5, 5);
+  rejects({.routing = pinned_dags(*other, 0, 3, {dag_of(*other, {0, 2})})}, "program belongs to another graph");
+  rejects({.routing = Pinned {ok.program, std::make_shared<const Eligibility>(other->eligibility({}, std::vector<EdgeId> {0}))}},
+          "black_holes belongs to another graph");
+  rejects({.routing = centralized(SourceAllocation::Optimized, dag_of(*other, {0, 2}))}, "support belongs to another graph");
+  rejects(cfg(ShortestPaths {}, RouteAllocation::Optimized),
+          "node 3 is in both endpoint sets: sources and destinations must not overlap", {0, 3}, {3});
+  rejects(cfg(ShortestPaths {}, RouteAllocation::Optimized), "sources: the node set is empty", {}, {3});
+  rejects(cfg(ShortestPaths {}, RouteAllocation::Optimized), "sources: node 9 out of node range [0, 4)", {9}, {3});
+  // A routing variant left without a mode (valueless) by an exception while a mode was emplaced.
+  struct ThrowingConversion {
+    operator Pinned() const { throw std::runtime_error("conversion failed"); }
+  };
+  auto valueless = cfg(ShortestPaths {}, RouteAllocation::Optimized);
+  EXPECT_THROW(valueless.routing.emplace<Pinned>(ThrowingConversion {}), std::runtime_error);
+  ASSERT_TRUE(valueless.routing.valueless_by_exception());
+  rejects(valueless, "routing: the variant holds no routing mode");
+  const auto el = other->eligibility({}, std::vector<EdgeId> {0});
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({3}), cfg(ShortestPaths {}, RouteAllocation::Optimized), &el); }),
+            "foreign Eligibility: built for another graph");
+  // The endpoints come before the ownership of the mask and the cache.
+  ShortestPathCache foreign_first(*other);
+  EXPECT_EQ(error_of([&] {
+              FlowPolicy p(fg, std::vector<NodeId> {}, v({3}), cfg(ShortestPaths {}, RouteAllocation::Optimized), &el,
+                           &foreign_first);
+            }),
+            "sources: the node set is empty");
+  ShortestPathCache foreign_cache(*other);
+  EXPECT_EQ(error_of([&] {
+              FlowPolicy p(fg, v({0}), v({3}), cfg(ShortestPaths {}, RouteAllocation::Optimized), nullptr, &foreign_cache);
+            }),
+            "foreign ShortestPathCache: bound to another graph");
+  EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty());
+}
+
+// FlowPolicyConfig and the routing models are plain values: they hold any field, a value outside
+// its enumeration included (here 96 to 99, reachable by a cast), and their consumers check it
+// (EnumValuesOutsideTheirEnumerationAreRejected and SeveralDefectsReportTheFirstInTheContractOrder
+// below). CentralizedTE requires its source allocation: it has no default constructor.
+TEST(FlowPolicyConfig, PlainValuesHoldEnumValuesOutsideTheirEnumeration) {
+  static_assert(!std::is_default_constructible_v<CentralizedTE>);
+  EXPECT_NO_THROW((void)(FlowPolicyConfig {centralized(static_cast<SourceAllocation>(96)), static_cast<Admission>(98)}));
+  ShortestPaths sp;
+  sp.allocation = static_cast<RouteAllocation>(97);
+  sp.source_allocation = static_cast<SourceAllocation>(96);
+  sp.weight_basis = static_cast<WeightBasis>(95);
+  sp.tie_break = static_cast<RouteTieBreak>(99);
+  EXPECT_NO_THROW((void)(FlowPolicyConfig {.routing = sp}));
+  DistributedTE ca {TunnelCount {1}};
+  ca.tie_break = static_cast<RouteTieBreak>(99);
+  EXPECT_NO_THROW((void)(FlowPolicyConfig {.routing = ca}));
+}
+
+// Enumeration checks at every consuming entry: the fields stay assignable after construction, so
+// a value outside its enumeration is a domain error named by its field (allocation,
+// source_allocation, weight_basis, tie_break, admission), before any matrix check, at every entry
+// that takes the configuration; it never reaches a record.
+TEST(FlowPolicyConfig, EnumValuesOutsideTheirEnumerationAreRejected) {
+  auto g = diamond(5, 5);
+  FlowLedger fg(g);
+  const Pinned pinned = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2})});
+  std::vector<std::pair<FlowPolicyConfig, std::string>> cases;
+  const auto sp_with = [](const std::function<void(ShortestPaths&)>& set) {
+    ShortestPaths sp;
+    sp.allocation = RouteAllocation::Optimized;
+    sp.source_allocation = SourceAllocation::Optimized;  // valid, then a later defect
+    set(sp);
+    return FlowPolicyConfig {.routing = sp, .admission = Admission::Lossy};  // Lossy: a matrix defect after
+  };
+  cases.push_back({sp_with([](ShortestPaths& sp) { sp.allocation = static_cast<RouteAllocation>(99); }),
+                   "allocation: 99 is not a value of RouteAllocation"});
+  cases.push_back({sp_with([](ShortestPaths& sp) { sp.source_allocation = static_cast<SourceAllocation>(99); }),
+                   "source_allocation: 99 is not a value of SourceAllocation"});
+  cases.push_back({sp_with([](ShortestPaths& sp) { sp.weight_basis = static_cast<WeightBasis>(99); }),
+                   "weight_basis: 99 is not a value of WeightBasis"});
+  cases.push_back({sp_with([](ShortestPaths& sp) { sp.tie_break = static_cast<RouteTieBreak>(99); }),
+                   "tie_break: 99 is not a value of RouteTieBreak"});
+  cases.push_back({{.routing = centralized(static_cast<SourceAllocation>(99)), .admission = Admission::Lossy},
+                   "source_allocation: 99 is not a value of SourceAllocation"});
+  DistributedTE ca {TunnelCount {0}};
+  ca.tie_break = static_cast<RouteTieBreak>(99);
+  cases.push_back({{.routing = ca}, "tie_break: 99 is not a value of RouteTieBreak"});
+  for (const Routing& r : {Routing {ShortestPaths {}}, Routing {DistributedTE {TunnelCount {0}}}, Routing {centralized()},
+                           Routing {pinned}}) {
+    cases.push_back({{.routing = r, .admission = static_cast<Admission>(99)}, "admission: 99 is not a value of Admission"});
+  }
+  for (const auto& [c, text] : cases) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({3}), c); }), text);
+    EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty());
+    EXPECT_TRUE(fg.records().empty());
+    EvaluationOptions co {c};
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({3}), co); }), text);
+    EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {c}, 1); }), text);
+    if (!std::holds_alternative<Pinned>(c.routing)) {
+      const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({3})}};
+      EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, pairs, co, {}, 1); }), text);
+    }
+  }
+  // The kernel check, the search and the cache's key.
+  const auto bad_allocation = static_cast<RouteAllocation>(99);
+  const auto bad_direction = static_cast<Direction>(99);
+  EXPECT_TRUE(contains(error_of([&] { detail::check_kernel(bad_allocation, Admission::Lossless); }), "allocation: 99"));
+  EXPECT_TRUE(contains(error_of([&] { detail::check_kernel(RouteAllocation::Optimized, static_cast<Admission>(99)); }),
+                       "admission: 99"));
+  {
+    SpfOptions o(Direction::Forward);
+    o.direction = bad_direction;
+    EXPECT_TRUE(contains(error_of([&] { (void)spf(*g, v({0}), o); }), "direction: 99 is not a value of Direction"));
+    EXPECT_TRUE(contains(error_of([&] { SpfOptions bad(bad_direction); }), "direction: 99 is not a value of Direction"));
+    SpfOptions t(Direction::Forward);
+    t.tie_break = static_cast<RouteTieBreak>(99);
+    EXPECT_TRUE(contains(error_of([&] { (void)spf(*g, v({0}), t); }), "tie_break: 99 is not a value of RouteTieBreak"));
+  }
+  ShortestPathCache cache(*g);
+  EXPECT_TRUE(contains(error_of([&] { (void)cache.lookup(*g, v({3}), bad_direction, nullptr); }), "direction: 99"));
+  const auto st = cache.stats();
+  EXPECT_EQ(st.hits + st.misses + st.entries, 0);
+}
+
+// A configuration with two defects at once: one error, the first in the documented order:
+// the enumeration values; the matrix (route and source allocation, admission, the ineffective tie
+// rule, the pooled single-path rule, prefer_headroom, the weight combinations, then a cache on a
+// model that does not read it); the tunnel count, an "up to" count for T1, the ceilings, the search
+// minimum and edge_weights' length and entries; the tunnel limit; a Pinned program's endpoints.
+// Exact texts; the same first error at construction and at the evaluators; nothing is bound.
+TEST(FlowPolicyConfig, SeveralDefectsReportTheFirstInTheContractOrder) {
+  auto g = diamond(5, 5);
+  FlowLedger fg(g);
+  ShortestPathCache cache(*g);
+  const auto weights = [](std::vector<Amount> w) { return std::make_shared<const std::vector<Amount>>(std::move(w)); };
+  const auto sp = [](RouteAllocation k, std::optional<SourceAllocation> source = std::nullopt) {
+    ShortestPaths out;
+    out.allocation = k;
+    out.source_allocation = source;
+    return out;
+  };
+  struct Case {
+    const char* why;
+    FlowPolicyConfig c;
+    std::vector<NodeId> sources;
+    bool with_cache;
+    std::string error;
+  };
+  std::vector<Case> cases;
+  {
+    ShortestPaths x = sp(RouteAllocation::Equal, SourceAllocation::Optimized);
+    x.tie_break = RouteTieBreak::HigherCapacity;  // also an ineffective tie
+    cases.push_back({"source allocation before the tie rule", {x, Admission::Lossless}, {0}, false,
+                     "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL"});
+  }
+  {
+    ShortestPaths x = sp(RouteAllocation::Optimized);
+    x.tie_break = RouteTieBreak::HigherCapacity;
+    cases.push_back({"admission before the tie rule", {x, Admission::Lossy}, {0}, false,
+                     "ShortestPaths OPTIMIZED requires admission=LOSSLESS"});
+    x.multipath = false;
+    cases.push_back({"the pooled rule before the weights", {x, Admission::Lossless}, {0, 1}, false,
+                     "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False"});
+  }
+  {
+    ShortestPaths x = sp(RouteAllocation::Equal);
+    x.tie_break = RouteTieBreak::HigherCapacity;
+    x.weight_basis = WeightBasis::Capacity;
+    cases.push_back({"the tie rule before the weights", {x, Admission::Lossless}, {0}, false,
+                     "ShortestPaths tie_break requires multipath=False or parallel_edges=False"});
+  }
+  {
+    // V3: two sources, a single path under HIGHER_CAPACITY and explicit weights of the wrong length.
+    ShortestPaths x = sp(RouteAllocation::Weighted);
+    x.weight_basis = WeightBasis::Explicit;
+    x.edge_weights = weights({1});
+    x.multipath = false;
+    x.tie_break = RouteTieBreak::HigherCapacity;
+    cases.push_back({"the pooled rule before the vectors", {x, Admission::Lossless}, {0, 1}, false,
+                     "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False"});
+    x.tie_break = RouteTieBreak::FewerHops;
+    cases.push_back({"the vectors last", {x, Admission::Lossless}, {0, 1}, false, "edge_weights: expected 4 entries"});
+  }
+  {
+    ShortestPaths x = sp(RouteAllocation::Equal);
+    x.weight_basis = WeightBasis::Explicit;
+    cases.push_back({"weights on another allocation", {x, Admission::Lossless}, {0}, true,
+                     "weight_basis requires allocation=WEIGHTED"});
+    x.allocation = RouteAllocation::Weighted;
+    cases.push_back({"explicit weights without the array", {x, Admission::Lossless}, {0}, false,
+                     "weight_basis=EXPLICIT requires edge_weights"});
+    x.weight_basis = WeightBasis::Capacity;
+    x.edge_weights = weights({1, 1, 1, 1});
+    cases.push_back({"an array without explicit weights", {x, Admission::Lossless}, {0}, false,
+                     "edge_weights require weight_basis=EXPLICIT"});
+    x.weight_basis = WeightBasis::Explicit;
+    x.edge_weights = weights({1, 1, kDomainLimit, -1});
+    cases.push_back({"the first entry out of range", {x, Admission::Lossless}, {0}, false,
+                     "edge_weights[2] must be an integer in [0, 2^62)"});
+  }
+  // CentralizedTE: T2's several-sources rule before its tunnel count (today it came after); a
+  // live controller's admission before prefer_headroom; prefer_headroom before the cache.
+  cases.push_back({"T2's sources before the count", {centralized(SourceAllocation::Optimized, {}, TunnelCount {0}), Admission::Lossy},
+                   {0, 1}, false, "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL"});
+  cases.push_back({"admission before prefer_headroom", {centralized(SourceAllocation::Equal, {}, std::nullopt, true), Admission::Lossy},
+                   {0}, false, "CentralizedTE without tunnel_count requires admission=LOSSLESS"});
+  cases.push_back({"prefer_headroom before the cache", {centralized(SourceAllocation::Equal, {}, std::nullopt, true)}, {0}, true,
+                   "prefer_headroom requires tunnel_count"});
+  cases.push_back({"the cache before T2's count", {centralized(SourceAllocation::Equal, {}, TunnelCount {0})}, {0}, true,
+                   "CentralizedTE does not use ShortestPathCache"});
+  cases.push_back({"T2's count", {centralized(SourceAllocation::Equal, {}, TunnelCount {0})}, {0}, false,
+                   "tunnel count must be in [1, 10000]"});
+  // T1: the cache, then the count before up_to, up_to before the ceiling, the ceiling before the
+  // search minimum.
+  cases.push_back({"the cache before T1's count", {DistributedTE {TunnelCount {0}}}, {0}, true,
+                   "DistributedTE does not use ShortestPathCache"});
+  cases.push_back({"the count before up_to", {DistributedTE {TunnelCount {0, true}}}, {0}, false,
+                   "tunnel count must be in [1, 10000]"});
+  {
+    DistributedTE x {TunnelCount {2, true}, AbsoluteCost {-1}};
+    cases.push_back({"up_to before the ceiling", {x}, {0}, false, "DistributedTE requires an exact tunnel count"});
+    x.tunnel_count.up_to = false;
+    x.min_unreserved_bandwidth = kDomainLimit;
+    cases.push_back({"the ceiling before the minimum", {x}, {0}, false, "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)"});
+    x.cost_ceiling.reset();
+    cases.push_back({"the minimum", {x}, {0}, false, "min_unreserved_bandwidth must be an integer in [0, 2^62)"});
+  }
+  // Pinned: the cache before the program's endpoints.
+  const Pinned other_endpoints = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2})});
+  cases.push_back({"the cache before the endpoints", {other_endpoints}, {0, 1}, true, "Pinned does not use ShortestPathCache"});
+  cases.push_back({"the endpoints", {other_endpoints}, {0, 1}, false, "program endpoints do not match policy endpoints"});
+  for (const auto& k : cases) {
+    ShortestPathCache* c = k.with_cache ? &cache : nullptr;
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, k.sources, v({3}), k.c, nullptr, c); }), k.error) << k.why;
+    EXPECT_TRUE(detail::LedgerAccess::bound_policy_ids(fg).empty()) << k.why;
+    EXPECT_TRUE(fg.records().empty()) << k.why;
+    const EvaluationOptions co {k.c, nullptr, c};
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, k.sources, v({3}), co); }), k.error) << k.why;
+    EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(*g, k.sources, v({3}), co, 1); }), k.error) << k.why;
+  }
+  EXPECT_EQ(cache.stats().misses + cache.stats().hits, 0);
+}
+
+// Every field has a default but CentralizedTE's source allocation: ShortestPaths() is ECMP (EQUAL),
+// and the policy's snapshot resolves the absent source allocation (the allocation's default) and
+// the absent weight basis of WEIGHTED (CAPACITY); SP() and SP(allocation=EQUAL) give one snapshot.
+TEST(FlowPolicyConfig, ShortestPathsDefaults) {
+  auto g = diamond(5, 5);
+  const FlowPolicyConfig empty;
+  ASSERT_TRUE(std::holds_alternative<ShortestPaths>(empty.routing));
+  const auto& d = std::get<ShortestPaths>(empty.routing);
+  EXPECT_EQ(d.allocation, RouteAllocation::Equal);
+  EXPECT_FALSE(d.source_allocation.has_value() || d.weight_basis.has_value() || d.edge_weights);
+  EXPECT_EQ(d.tie_break, RouteTieBreak::FewerHops);
+  EXPECT_TRUE(d.multipath && d.parallel_edges);
+  EXPECT_EQ(empty.admission, Admission::Lossless);
+  const auto snapshot = [&](FlowPolicyConfig c) {
+    FlowLedger own(g);
+    FlowPolicy p(own, v({0}), v({3}), std::move(c));
+    return p.config();
+  };
+  const auto resolved = [&](ShortestPaths x) { return std::get<ShortestPaths>(snapshot({.routing = x}).routing); };
+  const auto ecmp = resolved(ShortestPaths {});
+  EXPECT_EQ(ecmp.source_allocation, SourceAllocation::Equal);
+  EXPECT_FALSE(ecmp.weight_basis.has_value());
+  EXPECT_EQ(ecmp.allocation, resolved(shortest_paths(RouteAllocation::Equal)).allocation);
+  EXPECT_EQ(ecmp.source_allocation, resolved(shortest_paths(RouteAllocation::Equal)).source_allocation);
+  const auto weighted = resolved(shortest_paths(RouteAllocation::Weighted));
+  EXPECT_EQ(weighted.source_allocation, SourceAllocation::Equal);
+  EXPECT_EQ(weighted.weight_basis, WeightBasis::Capacity);
+  const auto optimized = resolved(shortest_paths(RouteAllocation::Optimized));
+  EXPECT_EQ(optimized.source_allocation, SourceAllocation::Optimized);
+  EXPECT_FALSE(optimized.weight_basis.has_value());
+  ShortestPaths equal_controller = shortest_paths(RouteAllocation::Optimized);
+  equal_controller.source_allocation = SourceAllocation::Equal;
+  EXPECT_EQ(resolved(equal_controller).source_allocation, SourceAllocation::Equal);
+  // The other models keep what they were given.
+  EXPECT_EQ(std::get<CentralizedTE>(snapshot({.routing = centralized(SourceAllocation::Equal)}).routing).source_allocation,
+            SourceAllocation::Equal);
+  const auto tunnels = std::get<DistributedTE>(snapshot({.routing = DistributedTE {TunnelCount {2}}}).routing);
+  EXPECT_EQ(tunnels.tie_break, RouteTieBreak::FewerHops);
+  EXPECT_TRUE(tunnels.parallel_edges);
+}
+
+// config() is the copy taken at construction: every field as given, and a later change of the
+// caller's object changes nothing.
+TEST(FlowPolicyConfig, ConfigIsTheCopyTakenAtConstruction) {
+  auto g = diamond(5, 5);
+  FlowLedger fg(g);
+  DistributedTE ca {TunnelCount {2}};
+  ca.cost_ceiling = AbsoluteCost {9};
+  ca.min_unreserved_bandwidth = 1;
+  ca.tie_break = RouteTieBreak::HigherAvailableCapacity;
+  ca.parallel_edges = false;
+  FlowPolicyConfig c {.routing = ca, .admission = Admission::Lossy};
+  FlowPolicy p(fg, v({0}), v({3}), c);
+  c.admission = Admission::Lossless;
+  std::get<DistributedTE>(c.routing).tunnel_count.per_head = 7;
+  std::get<DistributedTE>(c.routing).tie_break = RouteTieBreak::FewerHops;
+  const auto& got = p.config();
+  EXPECT_NE(&got, &c);
+  EXPECT_EQ(got.admission, Admission::Lossy);
+  ASSERT_TRUE(std::holds_alternative<DistributedTE>(got.routing));
+  const auto& r = std::get<DistributedTE>(got.routing);
+  EXPECT_EQ(r.tunnel_count, (TunnelCount {2, false}));
+  EXPECT_TRUE(r.cost_ceiling == std::optional<CostCeiling> {AbsoluteCost {9}});
+  EXPECT_EQ(r.min_unreserved_bandwidth, 1);
+  EXPECT_EQ(r.tie_break, RouteTieBreak::HigherAvailableCapacity);
+  EXPECT_FALSE(r.parallel_edges);
+  // Pinned: the supplied program and black holes themselves (shared, never copied); explicit
+  // weights: the configuration's one array, shared by every policy built from it.
+  const auto dark = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {1}));
+  const Pinned pin {pinned_dags(*g, 0, 3, {dag_of(*g, {1, 3}), dag_of(*g, {0, 2})}).program, dark};
+  FlowLedger fg2(g);
+  FlowPolicy q(fg2, v({0}), v({3}), {.routing = pin});
+  ASSERT_TRUE(std::holds_alternative<Pinned>(q.config().routing));
+  EXPECT_EQ(std::get<Pinned>(q.config().routing).program.get(), pin.program.get());
+  EXPECT_EQ(std::get<Pinned>(q.config().routing).black_holes.get(), dark.get());
+  ShortestPaths wcmp = shortest_paths(RouteAllocation::Weighted);
+  wcmp.weight_basis = WeightBasis::Explicit;
+  wcmp.edge_weights = std::make_shared<const std::vector<Amount>>(std::vector<Amount> {1, 2, 3, 4});
+  const FlowPolicyConfig explicit_weights {.routing = wcmp};
+  FlowPolicy a(fg2, v({0}), v({3}), explicit_weights);
+  FlowPolicy b(fg2, v({0}), v({3}), explicit_weights);
+  EXPECT_EQ(std::get<ShortestPaths>(a.config().routing).edge_weights.get(), wcmp.edge_weights.get());
+  EXPECT_EQ(std::get<ShortestPaths>(b.config().routing).edge_weights.get(), wcmp.edge_weights.get());
+}
+
+// The tie rule is no weight. Two parallel edges 0 -> 1 of 4 units (EdgeIds 0 and 1), a third party
+// holding 3 units of edge 0, request 5. ShortestPaths Weighted over both edges: its weight basis
+// decides (Capacity 4 : 4 carries at most 1 + 1 = 2, edge 0 having 1 unit left; a residual
+// snapshot 1 : 4 at preparation carries 1 + 4 = 5) under the one tie rule that keeps both edges,
+// FEWER_HOPS (a HIGHER_* tie_break needs multipath=False or parallel_edges=False, either of which
+// keeps one edge). CentralizedTE, CentralizedTE on the two edges as its support, and Pinned over one
+// split route of both edges (Equal 2; Weighted with capacity weights 2, with the snapshot 5) take
+// no route choice. Control: ShortestPaths reads the route choice (a single path, multipath = false,
+// carries less than the two-edge DAG).
+TEST(FlowPolicyConfig, TheTieRuleIsNoWeight) {
+  auto g = shared(make_graph(2, {{0, 1, 4, 1}, {0, 1, 4, 1}}));
+  using Edges = std::vector<std::pair<EdgeId, Amount>>;
+  // The placement of request 5 after the third party: (call_delivered, the policy's records' edge_flows).
+  auto run = [&](const FlowPolicyConfig& c) {
+    FlowLedger fg(g);
+    FlowPolicy other(fg, v({0}), v({1}), FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(*g, {0}))});
+    EXPECT_EQ(other.place(3).call_delivered, 3);
+    FlowPolicy p(fg, v({0}), v({1}), c);
+    const auto r = p.place(5);
+    std::vector<Edges> edges;
+    for (const auto& rec : p.records()) edges.push_back(rec.edge_flows);
+    return std::pair {r.call_delivered, edges};
+  };
+  for (auto basis : {WeightBasis::Capacity, WeightBasis::ResidualSnapshot}) {
+    const bool snapshot = basis == WeightBasis::ResidualSnapshot;
+    ShortestPaths wcmp = shortest_paths(RouteAllocation::Weighted);
+    wcmp.weight_basis = basis;
+    const auto got = run({.routing = wcmp});
+    EXPECT_EQ(got.first, snapshot ? 5 : 2);
+    EXPECT_EQ(got.second, (std::vector<Edges> {snapshot ? Edges {{0, 1}, {1, 4}} : Edges {{0, 1}, {1, 1}}}));
+  }
+  const auto both = dag_of(*g, {0, 1});
+  EXPECT_EQ(run({.routing = centralized()}).first, 5);
+  EXPECT_EQ(run({.routing = centralized(SourceAllocation::Optimized, both)}).first, 5);
+  EXPECT_EQ(run({.routing = pinned_dags(*g, 0, 1, {both})}).first, 2);
+  EXPECT_EQ(run({.routing = pinned_dags(*g, 0, 1, {both}, RouteAllocation::Weighted)}).first, 2);
+  RouteOptions snap;
+  snap.allocation = RouteAllocation::Weighted;
+  snap.weight_basis = WeightBasis::ResidualSnapshot;
+  snap.residual = std::vector<Amount> {1, 4};
+  const NodeId s0[1] = {0};
+  const NodeId d1[1] = {1};
+  const RouteDefinition route[1] = {RouteDefinition {0, both, 1}};
+  EXPECT_EQ(run({.routing = Pinned {ForwardingProgram::from_routes(*g, s0, d1, route, snap), nullptr}}).first, 5);
+  EXPECT_EQ(run(cfg(ShortestPaths {}, RouteAllocation::Optimized, Admission::Lossless, sel())).first, 5);
+  EXPECT_EQ(run(cfg(ShortestPaths {}, RouteAllocation::Optimized, Admission::Lossless,
+                    sel(RouteTieBreak::FewerHops, false)))
+                .first,
+            1);
+}
+
+namespace {
+
+// What a rejected call must leave as it was: the policy's epoch state (the requested total, the
+// +inf flag, delivered(), the CentralizedTE curve and each roster source's flows with their routes)
+// and the ledger (every record field, the allocations, the residual, the next FlowId and the
+// owners). A flow's source is its roster source's, and its record's sources are compared.
+struct PolicyState {
+  Epoch epoch;
+  LedgerState ledger;
+};
+
+PolicyState state_of(const FlowPolicy& p, const FlowLedger& fg) { return {test::epoch(p), ledger_state(fg)}; }
+
+void expect_same(const PolicyState& a, const PolicyState& b, const std::string& where) {
+  expect_same(a.epoch, b.epoch, where);
+  expect_same(a.ledger, b.ledger, where);
+}
+
+// Each source's delivered total, by the records' single source (a source with a flow and no
+// delivery included).
+std::map<NodeId, Amount> delivered_by_source(const FlowPolicy& p) {
+  std::map<NodeId, Amount> out;
+  for (const auto& r : p.records()) out[r.sources.at(0)] += r.delivered;
+  return out;
+}
+
+} // namespace
+
+// A request rejected by validation (out of [0, 2^62), finite after +inf, a cumulative total
+// that would reach 2^127) changes neither the policy's epoch state nor the ledger, under every
+// routing model with incremental placement (T1's calls: distributed_te_tests.cpp); validation
+// precedes the shortcut of a zero request (place(0) after +inf is rejected too), and remove() ends
+// the epoch, after which a finite request places again. The 2^127 case starts from a requested
+// total set just below the limit.
+TEST(FlowPolicyRequests, RejectedRequestsLeaveThePolicyAndTheLedger) {
+  auto g = diamond(5, 3, 2);
+  const Pinned pinned = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2}), dag_of(*g, {1, 3})});
+  const std::vector<std::pair<const char*, FlowPolicyConfig>> configs = {
+      {"ShortestPaths", shortest_paths_config()},
+      {"CentralizedTE", global_config()},
+      {"Pinned", {.routing = pinned}},
+      {"CentralizedTE support", {.routing = centralized(SourceAllocation::Optimized, dag_of(*g, {0, 2}))}},
+      {"ShortestPaths Lossy", cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy)}};
+  const std::string range_error = "offer must be an integer in [0, 2^62) or permitted +inf";
+  const std::string after_inf = "finite placement after infinite placement requires a new epoch";
+  for (const auto& [name, config] : configs) {
+    FlowLedger fg(g);
+    FlowPolicy p(fg, v({0}), v({3}), config);
+    ASSERT_GT(p.place(4).call_delivered, 0) << name;
+    const auto finite = state_of(p, fg);
+    EXPECT_EQ(error_of([&] { (void)p.place(-1); }), range_error) << name;
+    EXPECT_EQ(error_of([&] { (void)p.place(kDomainLimit); }), range_error) << name;
+    expect_same(state_of(p, fg), finite, name);
+    // Just below 2^127: 5 more would reach it, 4 would not.
+    auto& requested = detail::PolicyAccess::engine(p).epoch.requested;
+    const Counter128 saved = requested;
+    requested = Counter128 {(std::uint64_t {1} << 63) - 1, std::numeric_limits<std::uint64_t>::max() - 4};
+    const auto near_limit = state_of(p, fg);
+    EXPECT_EQ(error_of([&] { (void)p.place(5); }), "requested limit exceeded") << name;
+    expect_same(state_of(p, fg), near_limit, name);
+    requested = saved;
+    (void)p.place(std::nullopt);
+    const auto infinite = state_of(p, fg);
+    ASSERT_TRUE(infinite.epoch.infinite) << name;
+    EXPECT_EQ(error_of([&] { (void)p.place(1); }), after_inf) << name;
+    EXPECT_EQ(error_of([&] { (void)p.place(0); }), after_inf) << name;
+    EXPECT_EQ(error_of([&] { (void)p.place(-1); }), range_error) << name;
+    expect_same(state_of(p, fg), infinite, name);
+    p.remove();
+    EXPECT_EQ(p.place(1).call_delivered, 1) << name;
+  }
+}
+
+// The Lossy counters' 2^127 limit. Finite calls bring a flow's offered total up to the request
+// total (below 2^127) and a +inf call then adds its injection, so both checks are reachable; the
+// state about 2^65 calls would build is set here through the ledger's commit (a drop counter
+// never above its flow's offered counter). On the path 0 -> 1 -> 2 with capacities 10 and 4,
+// place(1) leaves residuals 9 and 3; place(+inf) then offers 9 (its injection on edge 0), edge 1
+// carries 3 and drops 6. From L = 2^127: an offered total of L - 10 reaches L - 1 (accepted), L - 9
+// would reach L (rejected); a drop counter of L - 7 reaches L - 1 and passes, so the offered
+// check rejects the call; L - 6 would reach L (rejected by the drop check, which runs first).
+// A rejected call leaves the policy and the ledger as they were.
+TEST(FlowPolicyRequests, LossyCountersStopBelow2To127) {
+  auto g = shared(make_graph(3, {{0, 1, 10, 1}, {1, 2, 4, 1}}));
+  const auto below = [](std::uint64_t x) {
+    return Counter128 {(std::uint64_t {1} << 63) - 1, std::numeric_limits<std::uint64_t>::max() - (x - 1)};
+  };
+  const std::string offered_error = "offered limit exceeded";
+  const std::string drop_error = "drops limit exceeded";
+  struct Case {
+    std::uint64_t offered_below;
+    std::optional<std::uint64_t> drop_below;
+    std::optional<std::string> error;
+  };
+  for (const auto& c : {Case {10, std::nullopt, std::nullopt}, Case {9, std::nullopt, offered_error},
+                        Case {7, 7, offered_error}, Case {6, 6, drop_error}}) {
+    const std::string name = "L - " + std::to_string(c.offered_below);
+    FlowLedger fg(g);
+    FlowPolicy p(fg, v({0}), v({2}), cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy));
+    ASSERT_EQ(p.place(1).call_delivered, 1) << name;
+    std::vector<detail::RecordDraft> drafts(1);
+    drafts[0].record = p.records().at(0);
+    drafts[0].record_counter = drafts[0].record.flow_id.second;
+    drafts[0].record.offered = below(c.offered_below);
+    if (c.drop_below.has_value()) drafts[0].record.edge_drops = {{1, below(*c.drop_below)}};
+    (void)detail::LedgerAccess::commit(fg, detail::PolicyAccess::engine(p).policy_id, drafts);
+    const auto before = state_of(p, fg);
+    if (c.error.has_value()) {
+      EXPECT_EQ(error_of([&] { (void)p.place(std::nullopt); }), *c.error) << name;
+      expect_same(state_of(p, fg), before, name);
+      continue;
     }
-    ASSERT_TRUE(found) << "edge (" << u << "," << v << ") not found";
-  }
-}
-
-}
-
-TEST(FlowPolicyCore, Proportional_SingleDemand_UsesShortestPath) {
-  auto g = make_square1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, /*src=*/0, /*dst=*/2, /*flowClass=*/0, /*volume=*/1.0);
-  EXPECT_NEAR(res.first, 1.0, 1e-9);
-  EXPECT_NEAR(res.second, 0.0, 1e-9);
-  expect_edge_flows_by_uv(fg, {{0,1,1.0}, {1,2,1.0}, {0,3,0.0}, {3,2,0.0}});
-}
-
-TEST(FlowPolicyCore, Proportional_SingleDemand_SplitsAcrossTwoEqualCostPaths) {
-  auto g = make_square1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 2.0);
-  EXPECT_NEAR(res.first, 2.0, 1e-9);
-  EXPECT_NEAR(res.second, 0.0, 1e-9);
-  expect_edge_flows_by_uv(fg, {{0,1,1.0}, {1,2,1.0}, {0,3,1.0}, {3,2,1.0}});
-}
-
-TEST(FlowPolicyCore, Proportional_SingleDemand_MaxFlowCount1_UsesSinglePath) {
-  auto g = make_square1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.multipath = false;
-  cfg.min_flow_count = 1;
-  cfg.max_flow_count = 1;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 2.0);
-  EXPECT_NEAR(res.first, 2.0, 1e-9);
-  EXPECT_NEAR(res.second, 0.0, 1e-9);
-  expect_edge_flows_by_uv(fg, {{0,1,0.0}, {1,2,0.0}, {0,3,2.0}, {3,2,2.0}});
-}
-
-TEST(FlowPolicyCore, Proportional_SingleDemand_PartialPlacement_InsufficientCapacity) {
-  auto g = make_square1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 5.0);
-  EXPECT_NEAR(res.first, 3.0, 1e-9);
-  EXPECT_NEAR(res.second, 2.0, 1e-9);
-  expect_edge_flows_by_uv(fg, {{0,1,1.0}, {1,2,1.0}, {0,3,2.0}, {3,2,2.0}});
-}
-
-TEST(FlowPolicyCore, EqualBalanced_SingleDemand_FlowCount2_BalancedDistribution) {
-  auto g = make_line1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = false; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.min_flow_count = 2;
-  cfg.max_flow_count = 2;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 7.0);
-  EXPECT_NEAR(res.first, 4.0, 1e-9);
-  EXPECT_NEAR(res.second, 3.0, 1e-9);
-  // A->B: 4, B->C: cap1 gets 1.0, cap3 gets 3.0, cap7(cost2) unused
-  expect_edge_flows_by_uv(fg, {{0,1,4.0}, {1,2,1.0}, {1,2,3.0}, {1,2,0.0}});
-}
-
-TEST(FlowPolicyCore, EqualBalanced_SingleDemand_FlowCount3_SaturatesBothPaths) {
-  // Graph: A->B (cap 100), B->C (cap 125), A->D (cap 75), D->C (cap 50)
-  // Two equal-cost paths exist with capacities 100 (A->B->C) and 50 (A->D->C).
-  // EqualBalanced with 3 flows should saturate both paths for a total of 150,
-  // leaving 50 unplaced out of the 200 requested.
-  auto g = make_square3();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = false; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.min_flow_count = 3;
-  cfg.max_flow_count = 3;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 200.0);
-  EXPECT_NEAR(res.first, 150.0, 1e-9);
-  EXPECT_NEAR(res.second, 50.0, 1e-9);
-  // Path A->B->C carries 100, A->D->C carries 50
-  expect_edge_flows_by_uv(fg, {{0,1,100.0}, {1,2,100.0}, {0,3,50.0}, {3,2,50.0}});
-}
-
-TEST(FlowPolicyCore, DiminishingReturnsCutoff) {
-  auto g = make_line1();
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.multipath = true;
-  cfg.min_flow_count = 1;
-  cfg.max_flow_count = 1000000;
-  cfg.shortest_path = false;
-  cfg.reoptimize_flows_on_each_placement = false;
-  cfg.max_no_progress_iterations = 100;
-  cfg.max_total_iterations = 10000;
-  cfg.diminishing_returns_enabled = true;
-  cfg.diminishing_returns_window = 8;
-  cfg.diminishing_returns_epsilon_frac = 1e-3;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 2, 0, 7.0);
-  EXPECT_GE(res.first, 0.0);
-  EXPECT_GE(res.second, 0.0);
-  EXPECT_GT(res.second, 0.0);
-}
-
-TEST(FlowPolicyCore, EqualBalanced_ShortestPath_ECMP3_SaturatesAllEqualCostPaths) {
-  // Graph: 0->{1,2,3}->4, all caps=5, all costs=1 (ECMP width 3)
-  // ECMP-like config: EqualBalanced, multi_edge=true, require_capacity=false, shortest_path=true, single flow
-  std::int32_t num_nodes = 5;
-  std::int32_t src_arr[6] = {0, 0, 0, 1, 2, 3};
-  std::int32_t dst_arr[6] = {1, 2, 3, 4, 4, 4};
-  double cap_arr[6] = {5.0, 5.0, 5.0, 5.0, 5.0, 5.0};
-  std::int64_t cost_arr[6] = {1, 1, 1, 1, 1, 1};
-  std::int64_t ext_arr[6] = {0, 1, 2, 3, 4, 5};
-  auto g = StrictMultiDiGraph::from_arrays(num_nodes,
-                                           std::span<const std::int32_t>(src_arr, 6),
-                                           std::span<const std::int32_t>(dst_arr, 6),
-                                           std::span<const double>(cap_arr, 6),
-                                           std::span<const std::int64_t>(cost_arr, 6),
-                                           std::span<const std::int64_t>(ext_arr, 6));
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = false;
-  cfg.min_flow_count = 1;
-  cfg.max_flow_count = 1;
-  cfg.shortest_path = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 4, 0, 100.0);
-  // Should place sum of shortest-tier capacities = 15.0, and stop
-  EXPECT_NEAR(res.first, 15.0, 1e-9);
-  EXPECT_NEAR(res.second, 85.0, 1e-9);
-  // Equal-balanced split across the three equal-cost paths
-  expect_edge_flows_by_uv(fg, {{0,1,5.0}, {1,4,5.0}, {0,2,5.0}, {2,4,5.0}, {0,3,5.0}, {3,4,5.0}});
-}
-
-TEST(FlowPolicyCore, EqualBalanced_ShortestPath_DownstreamSplit_BalancesBottleneck) {
-  // Graph: 0->1 (cap 10) -> {2,3} (cap 5 each) -> 4, all costs=1
-  // Expect placement limited to 10, split 5/5 on downstream equal-cost arcs.
-  std::int32_t num_nodes = 5;
-  std::int32_t src_arr[5] = {0, 1, 1, 2, 3};
-  std::int32_t dst_arr[5] = {1, 2, 3, 4, 4};
-  double cap_arr[5] = {10.0, 5.0, 5.0, 10.0, 10.0};
-  std::int64_t cost_arr[5] = {1, 1, 1, 1, 1};
-  std::int64_t ext_arr[5] = {0, 1, 2, 3, 4};
-  auto g = StrictMultiDiGraph::from_arrays(num_nodes,
-                                           std::span<const std::int32_t>(src_arr, 5),
-                                           std::span<const std::int32_t>(dst_arr, 5),
-                                           std::span<const double>(cap_arr, 5),
-                                           std::span<const std::int64_t>(cost_arr, 5),
-                                           std::span<const std::int64_t>(ext_arr, 5));
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = false;
-  cfg.min_flow_count = 1;
-  cfg.max_flow_count = 1;
-  cfg.shortest_path = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 4, 0, 100.0);
-  EXPECT_NEAR(res.first, 10.0, 1e-9);
-  EXPECT_NEAR(res.second, 90.0, 1e-9);
-  expect_edge_flows_by_uv(fg, {{0,1,10.0}, {1,2,5.0}, {1,3,5.0}, {2,4,5.0}, {3,4,5.0}});
-}
-
-TEST(FlowPolicyCore, EqualBalanced_ShortestPath_IgnoresHigherCostTier) {
-  // Graph:
-  //   Shortest tier: 0->1->4, caps 10, costs=1
-  //   Higher tier:   0->2->4, caps 50, costs=2
-  // With shortest_path=True, placement must saturate shortest tier only (10) and stop.
-  std::int32_t num_nodes = 5;
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 4, 2, 4};
-  double cap_arr[4] = {10.0, 10.0, 50.0, 50.0};
-  std::int64_t cost_arr[4] = {1, 1, 2, 2};
-  std::int64_t ext_arr[4] = {0, 1, 2, 3};
-  auto g = StrictMultiDiGraph::from_arrays(num_nodes,
-                                           std::span<const std::int32_t>(src_arr, 4),
-                                           std::span<const std::int32_t>(dst_arr, 4),
-                                           std::span<const double>(cap_arr, 4),
-                                           std::span<const std::int64_t>(cost_arr, 4),
-                                           std::span<const std::int64_t>(ext_arr, 4));
-  FlowGraph fg(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::EqualBalanced;
-  cfg.selection = sel;
-  cfg.require_capacity = false;
-  cfg.min_flow_count = 1;
-  cfg.max_flow_count = 1;
-  cfg.shortest_path = true;
-  FlowPolicy policy(ctx, cfg);
-  auto res = policy.place_demand(fg, 0, 4, 0, 100.0);
-  EXPECT_NEAR(res.first, 10.0, 1e-9);
-  EXPECT_NEAR(res.second, 90.0, 1e-9);
-  // Only shortest tier edges should carry flow
-  expect_edge_flows_by_uv(fg, {{0,1,10.0}, {1,4,10.0}, {0,2,0.0}, {2,4,0.0}});
-}
-
-// ============================================================================
-// Static paths (pinned path bundles)
-// ============================================================================
-
-// Each flow binds to ITS OWN bundle in supply order (the original Python
-// semantics; the first C++ port bound every flow to bundle[0]).
-TEST(FlowPolicyStatic, PerFlowBundleBinding) {
-  auto g = make_square1();
-  FlowGraph fg(g);
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicy policy(ctx, FlowPolicyConfig{});
-
-  // Edge ids after (cost, src, dst) reordering match construction order here.
-  EdgeId short_path[2] = {0, 1};  // A->B->C, cost 2, cap 1
-  EdgeId long_path[2] = {2, 3};   // A->D->C, cost 4, cap 2
-  std::vector<PredDAG> bundles;
-  bundles.push_back(make_path_dag(g, std::span<const EdgeId>(short_path, 2)));
-  bundles.push_back(make_path_dag(g, std::span<const EdgeId>(long_path, 2)));
-  policy.set_static_paths(0, 2, std::move(bundles));
-
-  auto [placed, left] = policy.place_demand(fg, 0, 2, 0, 3.0);
-  EXPECT_NEAR(placed, 3.0, 1e-9);
-  EXPECT_NEAR(left, 0.0, 1e-9);
-  ASSERT_EQ(policy.flow_count(), 2);
-  // Creation order == supply order; costs prove the binding.
-  std::vector<std::pair<FlowId, Cost>> got;
-  for (auto const& kv : policy.flows()) got.emplace_back(kv.first.flowId, kv.second.cost);
-  std::sort(got.begin(), got.end());
-  EXPECT_EQ(got[0].second, 2);
-  EXPECT_EQ(got[1].second, 4);
-}
-
-// A bundle whose every walk is masked out is DOWN: no flow, no volume.
-TEST(FlowPolicyStatic, MaskedBundleIsDown) {
-  using netgraph::core::test::make_bool_mask;
-  auto g = make_square1();
-  FlowGraph fg(g);
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-
-  auto edge_mask = make_bool_mask(4);
-  edge_mask[0] = false;  // A->B down -> the short bundle has no surviving walk
-  FlowPolicyConfig cfg;
-  cfg.edge_mask = std::span<const bool>(edge_mask.get(), 4);
-  FlowPolicy policy(ctx, cfg);
-
-  EdgeId short_path[2] = {0, 1};
-  EdgeId long_path[2] = {2, 3};
-  std::vector<PredDAG> bundles;
-  bundles.push_back(make_path_dag(g, std::span<const EdgeId>(short_path, 2)));
-  bundles.push_back(make_path_dag(g, std::span<const EdgeId>(long_path, 2)));
-  policy.set_static_paths(0, 2, std::move(bundles));
-
-  auto [placed, left] = policy.place_demand(fg, 0, 2, 0, 3.0);
-  EXPECT_EQ(policy.flow_count(), 1);
-  EXPECT_NEAR(placed, 2.0, 1e-9);  // only the long bundle carries
-  EXPECT_NEAR(left, 1.0, 1e-9);
-}
-
-// Malformed bundles are rejected loudly; a foreign-graph DAG cannot slip through.
-TEST(FlowPolicyStatic, ValidationRejectsForeignAndDisconnectedBundles) {
-  auto g = make_square1();
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be); auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-  FlowPolicy policy(ctx, FlowPolicyConfig{});
-
-  EdgeId short_path[2] = {0, 1};
-  auto dag = make_path_dag(g, std::span<const EdgeId>(short_path, 2));
-
-  // Connects 0->2, not 1->3: structurally wrong for that demand.
+    const auto r = p.place(std::nullopt);
+    EXPECT_EQ(r.call_delivered, 3) << name;
+    EXPECT_EQ(r.call_edge_drops, (std::vector<std::pair<EdgeId, Amount>> {{1, 6}})) << name;
+    const auto records = p.records();
+    ASSERT_EQ(records.size(), 1U) << name;
+    EXPECT_EQ(records[0].offered, below(1)) << name;
+    EXPECT_EQ(records[0].edge_drops, (std::vector<std::pair<EdgeId, Counter128>> {{1, Counter128 {0, 6}}})) << name;
+    EXPECT_EQ(records[0].delivered, 4) << name;
+  }
+}
+
+// The equal source allocation's shares (round robin from the lowest source): a total T gives source i of k
+// floor(T / k) + [i < T mod k]. Sources 0 .. k - 1 with their own 100-unit edge to k. k = 3,
+// Lossless: place(2) admits 2, shares [1, 1, 0]; the next place(2) admits 4, shares [2, 1, 1] (the
+// admitted total split from zero), which a rejected call would move. Lossy injects the increments
+// of the cumulative offer O; k = 7, where 2^64 = 2 mod 7: from O = 2^64 place(1) injects its unit
+// at source 2, from O = 2^64 + 5 (= 0 mod 7) at source 0, so the high word of O counts with its
+// exact weight.
+TEST(FlowPolicyRequests, RoundRobinSharesFollowTheCumulativeRequest) {
+  auto star = [](std::int32_t k) {
+    std::vector<InEdge> rows;
+    for (std::int32_t s = 0; s < k; ++s) rows.push_back({s, k, 100, 1});
+    return shared(make_graph(k + 1, rows));
+  };
+  auto sources = [](std::int32_t k) {
+    std::vector<NodeId> out(static_cast<std::size_t>(k));
+    std::iota(out.begin(), out.end(), 0);
+    return out;
+  };
+  using Shares = std::map<NodeId, Amount>;
   {
-    std::vector<PredDAG> b; b.push_back(dag);
-    EXPECT_THROW(policy.set_static_paths(1, 3, std::move(b)), std::invalid_argument);
+    auto g = star(3);
+    FlowLedger fg(g);
+    FlowPolicy p(fg, sources(3), v({3}), shortest_paths_config());
+    EXPECT_EQ(p.place(2).call_delivered, 2);
+    EXPECT_EQ(delivered_by_source(p), (Shares {{0, 1}, {1, 1}, {2, 0}}));
+    EXPECT_EQ(error_of([&] { (void)p.place(-1); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+    EXPECT_EQ(error_of([&] { (void)p.place(kDomainLimit); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+    EXPECT_EQ(p.place(2).call_delivered, 2);
+    EXPECT_EQ(delivered_by_source(p), (Shares {{0, 2}, {1, 1}, {2, 1}}));
+  }
+  // Lossy injects the round-robin increments of the cumulative offer O (Lossless re-splits its
+  // admitted total from zero, above): the next unit goes to source O mod k.
+  auto g = star(7);
+  for (const auto& [offered, to] : {std::pair {Counter128 {1, 0}, NodeId {2}}, std::pair {Counter128 {1, 5}, NodeId {0}}}) {
+    FlowLedger fg(g);
+    FlowPolicy p(fg, sources(7), v({7}), cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy));
+    detail::PolicyAccess::engine(p).epoch.offered = offered;
+    EXPECT_EQ(p.place(1).call_delivered, 1) << offered.lo;
+    for (const auto& [s, x] : delivered_by_source(p)) EXPECT_EQ(x, s == to ? 1 : 0) << offered.lo << " source " << s;
+    EXPECT_EQ(delivered_by_source(p).at(to), 1) << offered.lo;
+  }
+}
+
+TEST(FlowPolicyOutputs, OwnAllocationLedgerResidualBottleneckAndGlobalCut) {
+  auto g = diamond(5, 3);
+  FlowLedger fg(g);
+  // A third party holds one unit of the first route.
+  const CentralizedTE third = centralized(SourceAllocation::Optimized, dag_of(*g, {0, 2}));
+  FlowPolicy other(fg, v({0}), v({3}), cfg(third, RouteAllocation::Optimized));
+  ASSERT_EQ(other.place(1).call_delivered, 1);
+  FlowPolicy p(fg, v({0}), v({3}), shortest_paths_config());
+  const OutputOptions all {true, true, true};
+  auto r = p.place(4, all);
+  // Both routes cost 2: Equal puts 2 units on each, so every edge carries 2 of this
+  // policy's units and the residuals are 5 - 1 - 2 on route 0 -> 1 -> 3 and 3 - 2 on the other.
+  // Every edge keeps a residual unit, so the sources reach everything: no saturated edge.
+  EXPECT_EQ(r.call_delivered, 4);
+  ASSERT_TRUE(r.edge_flows && r.residual && r.saturated_boundary_edges);
+  EXPECT_FALSE(r.min_cut.has_value());  // not CentralizedTE
+  EXPECT_FALSE(r.marginal_cost_curve.has_value());
+  std::vector<Amount> own(4, 0);
+  for (const auto& rec : p.records()) {
+    for (const auto& [e, x] : rec.edge_flows) own[static_cast<std::size_t>(e)] += x;
+  }
+  EXPECT_EQ(*r.edge_flows, (std::vector<Amount> {2, 2, 2, 2}));
+  EXPECT_EQ(*r.edge_flows, own);
+  EXPECT_EQ(*r.residual, (std::vector<Amount> {2, 1, 2, 1}));
+  EXPECT_EQ(*r.residual, fg.residual());
+  EXPECT_EQ(*r.saturated_boundary_edges, std::vector<EdgeId> {});
+  EXPECT_EQ(*r.saturated_boundary_edges, fg.saturated_boundary_edges(v({0})));
+  // Nothing requested: absent.
+  r = p.place(1);
+  EXPECT_FALSE(r.edge_flows || r.residual || r.saturated_boundary_edges || r.min_cut);
+  // CentralizedTE: the curve always, min_cut when requested and the solve is maximal (at +inf; none
+  // under a cap of 2 below the maximum 8, which leaves a residual path); bottleneck alone does
+  // not request it.
+  FlowLedger fg2(g);
+  FlowPolicy gl(fg2, v({0}), v({3}), global_config());
+  r = gl.place(2, OutputOptions {false, false, true, true});
+  EXPECT_EQ(r.call_delivered, 2);
+  ASSERT_TRUE(r.marginal_cost_curve.has_value());
+  EXPECT_EQ(*r.marginal_cost_curve, curve({{2, 2}}));
+  EXPECT_EQ(gl.delivered(), 2);
+  EXPECT_FALSE(r.min_cut.has_value());
+  // At +inf the remaining 6 of the maximum 5 + 3: both edges out of node 0 saturate, so the
+  // closure is {0} and the cut is 0 -> 1 and 0 -> 2 (EdgeIds 0 and 1).
+  r = gl.place(std::nullopt, OutputOptions {false, false, true, true});
+  EXPECT_EQ(r.call_delivered, 6);
+  EXPECT_EQ(gl.delivered(), 8);
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(*r.min_cut, (std::vector<EdgeId> {0, 1}));
+  FlowLedger fg3(g);
+  FlowPolicy gb(fg3, v({0}), v({3}), global_config());
+  r = gb.place(std::nullopt, OutputOptions {false, false, true});
+  EXPECT_TRUE(r.saturated_boundary_edges.has_value());
+  EXPECT_FALSE(r.min_cut.has_value());
+}
+
+// The bottleneck output is the ledger's saturation report for the policy's sources under the
+// policy's Eligibility. Edges (input order): a = 0 -> 3 (2 units), x = 0 -> 2 (5), y = 2 -> 3 (1). A
+// third party carries 1 unit on x and y, which saturates y. The policy excludes x and carries 2
+// units on a, which saturates a. Under the Eligibility the sources reach only node 0: the report is
+// [a]. Without it node 2 is reachable too and y is reported as well.
+TEST(FlowPolicyOutputs, BottleneckIsTheLedgersForThePolicysSourcesAndEligibility) {
+  auto g = shared(make_graph(4, {{0, 3, 2, 1}, {0, 2, 5, 1}, {2, 3, 1, 1}}));
+  const auto id = id_of_input(*g);
+  const EdgeId a = id[0], x = id[1], y = id[2];
+  FlowLedger fg(g);
+  const CentralizedTE third = centralized(SourceAllocation::Optimized, dag_of(*g, {x, y}));
+  FlowPolicy other(fg, v({0}), v({3}), cfg(third, RouteAllocation::Optimized));
+  ASSERT_EQ(other.place(1).call_delivered, 1);
+  const auto el = g->eligibility({}, std::vector<EdgeId> {x});
+  FlowPolicy p(fg, v({0}), v({3}), shortest_paths_config(), &el);
+  const auto r = p.place(2, OutputOptions {false, false, true});
+  EXPECT_EQ(r.call_delivered, 2);
+  ASSERT_TRUE(r.saturated_boundary_edges.has_value());
+  EXPECT_EQ(*r.saturated_boundary_edges, std::vector<EdgeId> {a});
+  EXPECT_EQ(*r.saturated_boundary_edges, fg.saturated_boundary_edges(v({0}), &el));
+  auto without = std::vector<EdgeId> {a, y};
+  std::sort(without.begin(), without.end());
+  EXPECT_EQ(fg.saturated_boundary_edges(v({0})), without);  // the Eligibility matters here
+}
+
+TEST(FlowPolicyGlobal, EmptyRosterReportsAnEmptyCurveAndAnEmptyCut) {
+  // No source reaches the destination: the maximum flow is 0 and maximal.
+  auto g = shared(make_graph(3, {{0, 1, 5, 1}}));
+  FlowLedger fg(g);
+  FlowPolicy p(fg, v({0}), v({2}), global_config());
+  auto r = p.place(std::nullopt, OutputOptions {false, false, true, true});
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  ASSERT_TRUE(r.marginal_cost_curve.has_value());
+  EXPECT_TRUE(r.marginal_cost_curve->empty());
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_TRUE(r.min_cut->empty());
+  EXPECT_TRUE(p.records().empty());
+  // The zero request is a no-op: no solve, no cut; nothing is prepared, so no curve.
+  FlowPolicy q(fg, v({1}), v({2}), global_config());
+  r = q.place(0, OutputOptions {false, false, true, true});
+  EXPECT_FALSE(r.min_cut.has_value());
+  EXPECT_FALSE(r.marginal_cost_curve.has_value());
+}
+
+// CentralizedTE with a roster whose maximum flow is 0: Exhausted (a controller whose maximum is 0 over
+// existing routes), whether or not something was placed before. One edge 0 -> 1 of 2 units that a
+// third party fills: the source statically reaches the destination (it is on the roster), and
+// place(1) finds no flow: Exhausted, its record created empty (no route, no min_route_cost, nothing
+// delivered). After the third party leaves, place(1) delivers 1; a third party then takes the other
+// unit, and the next place(1) re-solves 1 + 1 on a view of 1: nothing more, Exhausted.
+TEST(FlowPolicyGlobal, ARosterWithoutFlowIsExhausted) {
+  auto g = shared(make_graph(2, {{0, 1, 2, 1}}));
+  FlowLedger fg(g);
+  const CentralizedTE edge = centralized(SourceAllocation::Optimized, dag_of(*g, {0}));
+  auto third = std::make_unique<FlowPolicy>(fg, v({0}), v({1}), cfg(edge, RouteAllocation::Optimized));
+  ASSERT_EQ(third->place(2).call_delivered, 2);
+  FlowPolicy p(fg, v({0}), v({1}), global_config());
+  auto r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  ASSERT_TRUE(r.marginal_cost_curve.has_value());
+  EXPECT_TRUE(r.marginal_cost_curve->empty());
+  ASSERT_EQ(p.records().size(), 1U);
+  EXPECT_TRUE(ascending_edges(*p.records()[0].route).empty());
+  EXPECT_EQ(p.records()[0].min_route_cost, kUnreachable);
+  EXPECT_EQ(p.records()[0].delivered, 0);
+  third->remove();
+  r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 1);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  FlowPolicy fourth(fg, v({0}), v({1}), cfg(edge, RouteAllocation::Optimized));
+  ASSERT_EQ(fourth.place(1).call_delivered, 1);
+  r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// A CentralizedTE zero call reports the cumulative curve (its amounts sum to delivered(); None
+// before the epoch's first positive call, also after remove()) and changes nothing; it solves
+// nothing, so it claims no cut.
+TEST(FlowPolicyGlobal, ZeroCallReportsTheCumulativeCurve) {
+  using Curve = std::vector<std::pair<Cost, Amount>>;
+  auto g = shared(make_graph(3, {{0, 1, 3, 7}, {0, 2, 4, 1}, {2, 1, 4, 1}}));
+  FlowLedger fg(g);
+  FlowPolicy p(fg, v({0}), v({1}), global_config());
+  auto z = p.place(0);
+  EXPECT_FALSE(z.marginal_cost_curve.has_value());
+  auto r = p.place(5);
+  EXPECT_EQ(*r.marginal_cost_curve, (Curve {{2, 4}, {7, 1}}));
+  const auto carried = fg.carried();
+  const auto requested = detail::PolicyAccess::engine(p).epoch.requested;
+  z = p.place(0, OutputOptions {true, true, true, true});
+  EXPECT_EQ(z.call_delivered, 0);
+  EXPECT_EQ(*z.marginal_cost_curve, *r.marginal_cost_curve);
+  EXPECT_FALSE(z.min_cut.has_value());
+  EXPECT_EQ(fg.carried(), carried);
+  EXPECT_EQ(detail::PolicyAccess::engine(p).epoch.requested, requested);
+  r = p.place(1);  // cumulative 6: the solve's curve on V = W + own
+  EXPECT_EQ(*r.marginal_cost_curve, (Curve {{2, 4}, {7, 2}}));
+  z = p.place(0);
+  EXPECT_EQ(*z.marginal_cost_curve, *r.marginal_cost_curve);
+  Amount sum = 0;
+  for (const auto& [c, x] : *z.marginal_cost_curve) sum += x;
+  EXPECT_EQ(sum, p.delivered());
+  p.remove();
+  z = p.place(0);
+  EXPECT_FALSE(z.marginal_cost_curve.has_value());
+}
+
+// The CentralizedTE layer on random graphs (nonuniform costs 1 to 9 times a factor of 1, 1,000,003 or
+// 2^35, zero capacities, a node or edge mask, another owner's occupancy W): each call re-solves the policy's cumulative amount on the view
+// W + own. After each of up to two capped calls and after place(+inf), the policy's own flow is
+// feasible on the view, conserved, carries the cumulative amount at the minimum cost of that
+// amount (the independent Bellman-Ford curve, not the flow core), its records sum to it, and its
+// cumulative curve is the optimal curve; at +inf the reported cut separates the sources from the
+// destinations with a capacity equal to the flow. evaluate_demand() on a fresh ledger reaches the same
+// maximum and curve, and evaluate_pairs() agrees with evaluate_demand() per pair.
+TEST(FlowPolicyGlobal, RandomCumulativeSolvesAreOptimalWithACertifiedCut) {
+  std::mt19937_64 rng(20261010);
+  const OutputOptions all {true, true, true, true};
+  auto below = [&](std::int64_t k) { return static_cast<std::int32_t>(rng() % static_cast<std::uint64_t>(k)); };
+  int capped = 0, masked = 0, occupied = 0, with_flow = 0;
+  int evaluated = 0;  // trials whose evaluators are compared (no other owner)
+  for (int trial = 0; trial < 400; ++trial) {
+    const std::int32_t n = 4 + static_cast<std::int32_t>(rng() % 5);
+    std::vector<InEdge> rows;
+    const int m = 6 + static_cast<int>(rng() % 11);
+    // The cost factor of the trial, outside the random stream: 1, 1,000,003 or 2^35.
+    const Cost factor = trial % 3 == 0 ? 1 : trial % 3 == 1 ? 1000003 : Cost {1} << 35;
+    for (int i = 0; i < m; ++i) {
+      const auto u = static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n));
+      auto w = static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n - 1));
+      if (w >= u) ++w;
+      rows.push_back({u, w, static_cast<Amount>(rng() % 7), static_cast<Cost>(1 + rng() % 9) * factor});
+    }
+    auto g = shared(make_graph(n, rows));
+    const std::string where = "trial " + std::to_string(trial);
+    // Sources 0 and maybe 1, destinations n - 1 and maybe n - 2.
+    std::vector<NodeId> srcs = {0}, dsts = {n - 1};
+    if (rng() % 2 == 0) srcs.push_back(1);
+    if (rng() % 2 == 0) dsts.push_back(n - 2);
+    std::optional<Eligibility> el;
+    switch (rng() % 3) {
+      case 0: el = g->eligibility(std::vector<NodeId> {below(n)}, {}); break;
+      case 1: el = g->eligibility({}, std::vector<EdgeId> {below(m)}); break;
+      default: break;
+    }
+    const Eligibility* elig = el ? &*el : nullptr;
+    masked += elig != nullptr ? 1 : 0;
+    FlowLedger fg(g);
+    // Another owner: a CentralizedTE policy between other endpoints (when the graph allows them) takes
+    // part of the capacity first.
+    std::optional<FlowPolicy> other;
+    if (n >= 6 && rng() % 2 == 0) {
+      other.emplace(fg, v({2}), v({3}), global_config());
+      occupied += other->place(static_cast<Amount>(rng() % 5)).call_delivered > 0 ? 1 : 0;
+    }
+    const std::vector<Amount> view = fg.residual();  // W: the policy's own flow is 0 so far
+    const auto curve_pts = independent_curve(*g, view, srcs, dsts, elig);
+    const Amount max_flow = curve_pts.back().first;
+    FlowPolicy p(fg, srcs, dsts, global_config(), elig);
+    // The policy's own per-edge flow, its cost, and the checks every call ends with.
+    auto check_own = [&](Amount total, const PlacementResult& r, const std::string& at) {
+      std::vector<Amount> own(view.size(), 0);
+      Amount recorded = 0;
+      for (const auto& rec : p.records()) {
+        recorded += rec.delivered;
+        for (const auto& [e, x] : rec.edge_flows) own[static_cast<std::size_t>(e)] += x;
+      }
+      EXPECT_EQ(recorded, total) << at;
+      EXPECT_EQ(p.delivered(), total) << at;
+      ASSERT_TRUE(r.edge_flows.has_value() && r.residual.has_value()) << at;
+      EXPECT_EQ(*r.edge_flows, own) << at;
+      EXPECT_EQ(*r.residual, fg.residual()) << at;
+      // The flow certificates' flow clauses (test_utils.hpp): within the view, nothing on a masked
+      // edge, conserved, the cumulative amount out of the sources and into the destinations.
+      std::vector<std::string> fails;
+      (void)flow_clauses(*g, view, own, srcs, dsts, elig, total, fails);
+      const Int128 cost = flow_cost(*g, own);
+      EXPECT_TRUE(cost == curve_at(curve_pts, total)) << at;
+      // The cumulative curve, by the flow certificates' clauses: positive volumes at strictly
+      // increasing costs, its total the cumulative amount and its moment the flow's cost, and equal
+      // to the optimal curve at every breakpoint of either up to the total.
+      ASSERT_TRUE(r.marginal_cost_curve.has_value()) << at;
+      const auto pts = curve_shape_clauses(*r.marginal_cost_curve, total, cost, fails);
+      curve_optimum_clause(pts, curve_pts, total, "the optimal curve", fails);
+      for (const auto& f : fails) ADD_FAILURE() << at << ": " << f;
+    };
+    // Up to two capped calls below the maximum (each re-solves the cumulative amount), then +inf.
+    Amount total = 0;
+    for (int call = 0; call < 2; ++call) {
+      const Amount x = max_flow - total > 1 ? below(max_flow - total) : 0;
+      if (x == 0) continue;
+      ++capped;
+      total += x;
+      const auto r = p.place(x, all);
+      EXPECT_EQ(r.call_delivered, x) << where;
+      EXPECT_FALSE(r.min_cut.has_value()) << where;  // stopped by the cap
+      check_own(total, r, where + " capped call " + std::to_string(call));
+    }
+    const auto r = p.place(std::nullopt, all);
+    EXPECT_EQ(r.call_delivered, max_flow - total) << where;
+    with_flow += max_flow > 0 ? 1 : 0;
+    check_own(max_flow, r, where + " +inf");
+    // The cut, as the flow certificates define it (residual_closure and closure_cut,
+    // test_utils.hpp): the residual closure of the roster sources is the nodes they still reach
+    // over allowed edges, forward where the policy's own flow leaves room in the view and backward
+    // where it can be undone; no destination is in it, and the cut is every allowed edge that
+    // leaves it, whatever its view, in ascending EdgeId, with a capacity equal to the maximum flow.
+    ASSERT_TRUE(r.min_cut.has_value() && r.edge_flows.has_value()) << where;
+    Amount cut_capacity = 0;
+    for (const EdgeId e : *r.min_cut) cut_capacity += view[static_cast<std::size_t>(e)];
+    EXPECT_EQ(cut_capacity, max_flow) << where;
+    // The closure is seeded at the roster: the allowed sources with a walk over allowed edges
+    // (whatever their capacity) to an allowed destination. Another source can reach no
+    // destination, so it needs no cut edge; the cut of an empty roster is [].
+    std::vector<NodeId> roster;
+    for (const NodeId src : srcs) {
+      if (elig != nullptr && !elig->allows_node(src)) continue;
+      std::vector<char> reach(static_cast<std::size_t>(g->num_nodes()), 0);
+      std::vector<NodeId> stack = {src};
+      reach[static_cast<std::size_t>(src)] = 1;
+      while (!stack.empty()) {
+        const NodeId u = stack.back();
+        stack.pop_back();
+        for (EdgeId e = 0; e < g->num_edges(); ++e) {
+          const NodeId w = g->edge_destinations()[static_cast<std::size_t>(e)];
+          if (g->edge_sources()[static_cast<std::size_t>(e)] != u || reach[static_cast<std::size_t>(w)] != 0) continue;
+          if (elig != nullptr && !elig->allows_edge(e)) continue;
+          reach[static_cast<std::size_t>(w)] = 1;
+          stack.push_back(w);
+        }
+      }
+      if (std::any_of(dsts.begin(), dsts.end(), [&](NodeId d) {
+            return (elig == nullptr || elig->allows_node(d)) && reach[static_cast<std::size_t>(d)] != 0;
+          })) {
+        roster.push_back(src);
+      }
+    }
+    EXPECT_EQ(roster, detail::PolicyAccess::engine(p).reachable_sources) << where;
+    const auto closure = residual_closure(*g, view, *r.edge_flows, roster, elig);
+    for (const NodeId d : dsts) EXPECT_EQ(closure[static_cast<std::size_t>(d)], 0) << where << " destination " << d;
+    EXPECT_EQ(*r.min_cut, closure_cut(*g, closure, elig)) << where;
+    // The evaluators on a fresh ledger (static capacities): the same maximum and cost.
+    if (other.has_value()) continue;
+    ++evaluated;
+    const EvaluationOptions co {global_config(), elig, nullptr, all};
+    const auto cr = evaluate_demand(*g, srcs, dsts, co);
+    EXPECT_EQ(cr.call_delivered, max_flow) << where;
+    ASSERT_TRUE(cr.marginal_cost_curve.has_value()) << where;
+    EXPECT_EQ(*cr.marginal_cost_curve, *r.marginal_cost_curve) << where;
+    const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{srcs, dsts}, {v({0}), v({n - 1})}};
+    const auto batch = evaluate_pairs(*g, pairs, co, {}, 1);
+    ASSERT_EQ(batch.size(), 2U) << where;
+    for (std::size_t i = 0; i < pairs.size(); ++i) {
+      const auto one = evaluate_demand(*g, pairs[i].first, pairs[i].second, co);
+      EXPECT_EQ(batch[i].call_delivered, one.call_delivered) << where << " pair " << i;
+      EXPECT_EQ(batch[i].marginal_cost_curve, one.marginal_cost_curve) << where << " pair " << i;
+      EXPECT_EQ(batch[i].min_cut, one.min_cut) << where << " pair " << i;
+    }
+  }
+  // The population reaches every case (this seed: 289 capped calls, 257 masks, 44 occupied
+  // ledgers, 241 positive maxima of 400 trials).
+  EXPECT_GT(capped, 220);
+  EXPECT_GT(masked, 200);
+  EXPECT_GT(occupied, 33);
+  EXPECT_GT(with_flow, 180);
+  EXPECT_GT(evaluated, 100);
+}
+
+// ShortestPaths placements on random graphs (costs 1 to 9 times a factor of 1, 1,000,003 or 2^35, zero
+// capacities, a node or edge mask, one or two sources and destinations, another owner's flow
+// first), in the kernels and admissions ShortestPaths takes: after each of two capped calls and a call
+// of +inf, each of the policy's records is a flow of its own from the policy's sources to its
+// destinations (expect_conserved, test_utils.hpp: positive amounts in ascending EdgeId, every
+// transit node passing on what it receives less its drops, delivered the destinations' net inflow
+// and, Lossless, the sources' net outflow), carrying and dropping nothing on an edge the Eligibility
+// excludes; a Lossless policy's records deliver its delivered() total, and the ledger's aggregate is the
+// sum of its records (expect_balanced). ShortestPaths chooses routes by cost, not by the minimum-cost
+// flow, so no optimality certificate applies here (T1's records: T1Property, distributed_te_tests.cpp).
+TEST(FlowPolicyRecords, RandomShortestPathsRecordsAreFlows) {
+  const auto res = sel(RouteTieBreak::FewerHops);
+  const std::vector<FlowPolicyConfig> configs = {
+      shortest_paths_config(),
+      cfg(ShortestPaths {}, RouteAllocation::Weighted),
+      cfg(ShortestPaths {}, RouteAllocation::Optimized),
+      // The FEWER_HOPS single path (several sources reject a HIGHER_* tie_break with it).
+      cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossless,
+          sel(RouteTieBreak::FewerHops, false, false)),
+      cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy),
+      cfg(ShortestPaths {}, RouteAllocation::Weighted, Admission::Lossy, res),
+  };
+  std::mt19937_64 rng(20261011);
+  auto below = [&](std::int64_t k) { return static_cast<std::int32_t>(rng() % static_cast<std::uint64_t>(k)); };
+  int carrying = 0;                 // record checks of a record that carries something
+  int dropping = 0;                 // record checks of a Lossy record with drops
+  int masked = 0;                   // record checks of a carrying record under a mask
+  int scaled = 0;                   // record checks of a carrying record with costs times 1,000,003 or 2^35
+  int several = 0;                  // calls that delivered from two sources or into two destinations
+  for (int trial = 0; trial < 600; ++trial) {
+    const FlowPolicyConfig& config = configs[static_cast<std::size_t>(trial) % configs.size()];
+    const std::int32_t n = 4 + static_cast<std::int32_t>(rng() % 5);
+    const int m = 6 + static_cast<int>(rng() % 11);
+    const Cost factor = trial % 3 == 0 ? 1 : trial % 3 == 1 ? 1000003 : Cost {1} << 35;
+    std::vector<InEdge> rows;
+    for (int i = 0; i < m; ++i) {
+      const auto u = static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n));
+      auto w = static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n - 1));
+      if (w >= u) ++w;
+      rows.push_back({u, w, static_cast<Amount>(rng() % 7), static_cast<Cost>(1 + rng() % 9) * factor});
+    }
+    auto g = shared(make_graph(n, rows));
+    std::vector<NodeId> srcs = {0}, dsts = {n - 1};
+    if (rng() % 2 == 0) srcs.push_back(1);
+    if (rng() % 2 == 0) dsts.push_back(n - 2);
+    std::optional<Eligibility> el;
+    switch (rng() % 3) {
+      case 0: el = g->eligibility(std::vector<NodeId> {below(n)}, {}); break;
+      case 1: el = g->eligibility({}, std::vector<EdgeId> {below(m)}); break;
+      default: break;
+    }
+    const Eligibility* elig = el ? &*el : nullptr;
+    FlowLedger fg(g);
+    std::optional<FlowPolicy> other;
+    if (n >= 6 && rng() % 2 == 0) {
+      other.emplace(fg, v({2}), v({3}), shortest_paths_config());
+      (void)other->place(static_cast<Amount>(rng() % 5));
+    }
+    FlowPolicy p(fg, srcs, dsts, config, elig);
+    const std::vector<std::optional<Amount>> calls = {static_cast<Amount>(rng() % 6), static_cast<Amount>(rng() % 6),
+                                                      std::nullopt};
+    for (std::size_t call = 0; call < calls.size(); ++call) {
+      const std::string where = "trial " + std::to_string(trial) + " call " + std::to_string(call);
+      (void)p.place(calls[call]);
+      expect_balanced(fg, where);
+      Amount delivered = 0;
+      std::set<NodeId> from, into;
+      for (const auto& r : p.records()) {
+        const std::string at = where + " record " + std::to_string(r.flow_id.second);
+        for (NodeId x : r.sources) {
+          EXPECT_TRUE(std::find(srcs.begin(), srcs.end(), x) != srcs.end()) << at << " source " << x;
+        }
+        for (NodeId x : r.destinations) {
+          EXPECT_TRUE(std::find(dsts.begin(), dsts.end(), x) != dsts.end()) << at << " destination " << x;
+        }
+        const bool carries = expect_conserved(*g, r, at);
+        for (const auto& [e, x] : r.edge_flows) {
+          EXPECT_TRUE(elig == nullptr || elig->allows_edge(e)) << at << " carries " << x << " on excluded edge " << e;
+        }
+        for (const auto& [e, x] : r.edge_drops) {
+          EXPECT_TRUE(elig == nullptr || elig->allows_edge(e)) << at << " drops on excluded edge " << e;
+        }
+        delivered += r.delivered;
+        if (r.delivered > 0) {
+          from.insert(r.sources.begin(), r.sources.end());
+          for (const auto& [e, x] : r.edge_flows) {
+            const NodeId head = g->edge_destinations()[static_cast<std::size_t>(e)];
+            if (std::find(dsts.begin(), dsts.end(), head) != dsts.end()) into.insert(head);
+          }
+        }
+        carrying += carries ? 1 : 0;
+        dropping += r.edge_drops.empty() ? 0 : 1;
+        masked += carries && elig != nullptr ? 1 : 0;
+        scaled += carries && factor > 1 ? 1 : 0;
+      }
+      if (config.admission == Admission::Lossless) EXPECT_EQ(delivered, p.delivered()) << where;
+      several += from.size() > 1 || into.size() > 1 ? 1 : 0;
+      ASSERT_FALSE(::testing::Test::HasFailure()) << where;
+    }
+  }
+  EXPECT_GT(carrying, 0);
+  EXPECT_GT(dropping, 0);
+  EXPECT_GT(masked, 0);
+  EXPECT_GT(scaled, 0);
+  EXPECT_GT(several, 0);
+}
+
+TEST(FlowPolicyRecords, BundlesAreSharedOrPruned) {
+  auto g = diamond(5, 5);
+  FlowLedger fg(g);
+  const auto whole = dag_of(*g, {0, 1, 2, 3});
+  const Pinned pin = pinned_dags(*g, 0, 3, {whole});
+  FlowPolicy p(fg, v({0}), v({3}), {.routing = pin});
+  (void)p.place(2);
+  // An unchanged supplied split route is shared by the record (no copy).
+  EXPECT_EQ(p.records().front().route.get(), whole.get());
+  // A route pruned by the replay's mask is a new DAG of what remains.
+  const auto el = g->eligibility({}, std::vector<EdgeId> {2});
+  FlowLedger fg2(g);
+  FlowPolicy q(fg2, v({0}), v({3}), {.routing = pin}, &el);
+  (void)q.place(2);
+  const auto rec = q.records().front();
+  EXPECT_NE(rec.route.get(), whole.get());
+  EXPECT_EQ(ascending_edges(*rec.route), (std::vector<EdgeId> {1, 3}));
+  // ShortestPaths: a source whose route is the whole cached support shares it.
+  ShortestPathCache cache(*g);
+  FlowLedger fg3(g);
+  FlowPolicy c(fg3, v({0}), v({3}), shortest_paths_config(), nullptr, &cache);
+  (void)c.place(2);
+  const auto support = cache.lookup(*g, v({3}), Direction::Reverse, nullptr);
+  EXPECT_EQ(c.records().front().route.get(), support.get());
+}
+
+// records() lists the live records in FlowId order, also when the sources' entries interleave.
+// Sources 0 and 1, each with two parallel edges of 3 and 5 units to node 2; T1 with 2 tunnels per
+// head: one record per program entry, created in index order j * H + i (round j, head i), so the
+// entries 0 (source 0), 1 (source 1), 2 (source 0) and 3 (source 1) get FlowIds 0 to 3 and records()
+// gives their sources as 0, 1, 0, 1 (a source's records are not contiguous).
+TEST(FlowPolicyRecords, RecordsAreInFlowIdOrderAcrossSources) {
+  auto g = shared(make_graph(3, {{0, 2, 3, 1}, {0, 2, 5, 1}, {1, 2, 3, 1}, {1, 2, 5, 1}}));
+  FlowLedger fg(g);
+  FlowPolicy p(fg, v({0, 1}), v({2}), t1(2));
+  ASSERT_EQ(p.replace(8, 8).call_delivered, 8);
+  std::vector<std::int64_t> ids;
+  std::vector<NodeId> sources;
+  std::vector<std::int32_t> entries;
+  for (const auto& r : p.records()) {
+    ids.push_back(r.flow_id.second);
+    sources.push_back(r.sources.at(0));
+    entries.push_back(r.entry_id.value_or(-1));
+  }
+  EXPECT_EQ(ids, (std::vector<std::int64_t> {0, 1, 2, 3}));
+  EXPECT_EQ(sources, (std::vector<NodeId> {0, 1, 0, 1}));
+  EXPECT_EQ(entries, (std::vector<std::int32_t> {0, 1, 2, 3}));
+}
+
+// ShortestPaths routes to the nearest destinations, and one flow may deliver to several of them: edges (input order) 0 -> 1 (10 units, cost 1), 1 -> 2 (2, cost 1), 1 -> 3 (3,
+// cost 1) and 0 -> 3 (5, cost 5); destinations 2 and 3, both at cost 2 through node 1. The one
+// flow carries 2 to node 2 and 3 to node 3 (the edges entering each destination), 5 in all; the
+// costlier edge 0 -> 3 is no part of the route.
+TEST(FlowPolicyRecords, OneFlowDeliversToTheNearestDestinations) {
+  auto g = shared(make_graph(4, {{0, 1, 10, 1}, {1, 2, 2, 1}, {1, 3, 3, 1}, {0, 3, 5, 5}}));
+  const auto id = id_of_input(*g);
+  // Optimized fills both; Weighted's capacity weights 2 and 3 split 5 at node 1 as (2, 3).
+  for (const auto& [name, kernel] : std::vector<std::pair<std::string, RouteAllocation>> {
+           {"Optimized", RouteAllocation::Optimized}, {"Weighted", RouteAllocation::Weighted}}) {
+    FlowLedger fg(g);
+    FlowPolicy p(fg, v({0}), v({2, 3}), cfg(ShortestPaths {}, kernel));
+    const auto r = p.place(std::nullopt);
+    EXPECT_EQ(r.call_delivered, 5) << name;
+    const auto records = p.records();
+    ASSERT_EQ(records.size(), 1U) << name;
+    const auto& rec = records[0];
+    EXPECT_EQ(rec.delivered, 5) << name;
+    EXPECT_EQ(rec.min_route_cost, 2) << name;
+    EXPECT_EQ(rec.destinations, (std::vector<NodeId> {2, 3})) << name;
+    std::map<NodeId, Amount> into;
+    for (const auto& [e, x] : rec.edge_flows) into[g->edge_destinations()[static_cast<std::size_t>(e)]] += x;
+    EXPECT_EQ(into, (std::map<NodeId, Amount> {{1, 5}, {2, 2}, {3, 3}})) << name;
+    EXPECT_EQ(ascending_edges(*rec.route), (std::vector<EdgeId> {id[0], id[1], id[2]})) << name;
+  }
+}
+
+TEST(PredDAGStorage, ABundleCostsItsEntriesNotTheGraph) {
+  const std::int32_t n = 1'000'000;
+  auto g = shared(make_graph(n, {{n - 3, n - 2, 4, 1}, {n - 2, n - 1, 4, 1}}));
+  const auto dag = dag_of(*g, {0, 1});
+  EXPECT_LT(detail::PredecessorDAGBuilder::payload_bytes(*dag), 128U);  // two entries, not N + 1 offsets
+  const auto off = dag->parent_offsets();  // the from_csr shape, on demand
+  ASSERT_EQ(off.size(), static_cast<std::size_t>(n) + 1);
+  EXPECT_EQ(off[static_cast<std::size_t>(n) - 2], 0);
+  EXPECT_EQ(off[static_cast<std::size_t>(n) - 1], 1);
+  EXPECT_EQ(off[static_cast<std::size_t>(n)], 2);
+  EXPECT_TRUE(PredecessorDAG::from_csr(*g, off, dag->parents(), dag->via_edges()) == *dag);
+  FlowLedger fg(g);
+  FlowPolicy p(fg, v({n - 3}), v({n - 1}), {.routing = pinned_dags(*g, n - 3, n - 1, {dag})});
+  EXPECT_EQ(p.place(3).call_delivered, 3);
+  EXPECT_LT(detail::PredecessorDAGBuilder::payload_bytes(*p.records().front().route), 128U);
+  // The record routes the engine builds itself are sparse too: a supplied split route pruned by
+  // the replay's mask (the bypass n - 3 -> n - 1 excluded), CentralizedTE's used edges on a support, and
+  // the ShortestPaths and CentralizedTE routes.
+  auto h = shared(make_graph(n, {{n - 3, n - 2, 4, 1}, {n - 2, n - 1, 4, 1}, {n - 3, n - 1, 4, 5}}));
+  const auto inv = id_of_input(*h);
+  const auto three = dag_of(*h, {inv[0], inv[1], inv[2]});
+  const auto el = h->eligibility({}, std::vector<EdgeId> {inv[2]});
+  const std::vector<std::pair<const char*, FlowPolicyConfig>> built = {
+      {"pruned Pinned", {.routing = pinned_dags(*h, n - 3, n - 1, {three})}},
+      {"CentralizedTE support", {.routing = centralized(SourceAllocation::Optimized, dag_of(*h, {inv[0], inv[1]}))}},
+      {"ShortestPaths", shortest_paths_config()},
+      {"CentralizedTE", global_config()}};
+  for (const auto& [name, c] : built) {
+    FlowLedger fh(h);
+    FlowPolicy q(fh, v({n - 3}), v({n - 1}), c, std::holds_alternative<Pinned>(c.routing) ? &el : nullptr);
+    EXPECT_EQ(q.place(3).call_delivered, 3) << name;
+    const auto route = q.records().front().route;
+    EXPECT_NE(route.get(), three.get()) << name;
+    EXPECT_EQ(ascending_edges(*route), (std::vector<EdgeId> {inv[0], inv[1]})) << name;
+    EXPECT_LT(detail::PredecessorDAGBuilder::payload_bytes(*route), 128U) << name;
+  }
+}
+
+TEST(Evaluators, CapacityIsPlaceInfOnAFreshLedger) {
+  // Every field of the result, in every routing model with incremental placement (Pinned's
+  // program has the endpoints; T1's evaluate of its design: TunnelEvaluators.T1Capacity).
+  auto g = diamond(5, 3, 2);
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2}), dag_of(*g, {1, 3})});
+  for (const auto& c : {global_config(), shortest_paths_config(), FlowPolicyConfig {.routing = pin},
+                        FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(*g, {0, 2}))}}) {
+    const auto r = evaluate_demand(*g, v({0}), v({3}), EvaluationOptions {c, nullptr, nullptr, OutputOptions {true, true, true}});
+    FlowLedger fg(g);
+    FlowPolicy p(fg, v({0}), v({3}), c);
+    const auto want = p.place(std::nullopt, OutputOptions {true, true, true});
+    EXPECT_GT(want.call_delivered, 0);  // two empty results would agree too
+    expect_same(r, want, "capacity against place(+inf)");
+  }
+  // The exact maximum flow: CentralizedTE's curve (cheapest walks first).
+  const auto exact = evaluate_demand(*g, v({0}), v({3}), EvaluationOptions {global_config()});
+  EXPECT_EQ(exact.call_delivered, 8);
+  EXPECT_EQ(*exact.marginal_cost_curve, curve({{2, 5}, {4, 3}}));
+}
+
+TEST(Evaluators, BatchOrderIntersectionsExceptionsAndWorkers) {
+  auto g = diamond(5, 3);
+  const auto common = g->eligibility({}, std::vector<EdgeId> {3});       // route 2's last edge
+  const auto first_route = g->eligibility({}, std::vector<EdgeId> {0});  // route 1's first edge
+  std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {{0}, {3}}, {{0}, {3}}, {{1}, {3}}, {{0}, {1, 2}}};
+  const std::vector<const Eligibility*> per = {nullptr, &first_route, nullptr, nullptr};
+  const EvaluationOptions opts {global_config(), &common, nullptr, OutputOptions {true, true, true, true}};
+  const auto r1 = evaluate_pairs(*g, pairs, opts, per, 1);
+  ASSERT_EQ(r1.size(), 4U);
+  EXPECT_EQ(r1[0].call_delivered, 5);  // common only: route 1
+  EXPECT_EQ(r1[1].call_delivered, 0);  // common and the pair's: both routes cut
+  EXPECT_EQ(r1[2].call_delivered, 5);
+  EXPECT_EQ(r1[3].call_delivered, 8);  // destination set {1, 2}: both first edges (edge 3 excluded is past 2)
+  EXPECT_EQ(*r1[3].marginal_cost_curve, curve({{1, 8}}));
+  EXPECT_EQ(*r1[3].min_cut, (std::vector<EdgeId> {0, 1}));
+  // Every field of every result is the same for any worker count.
+  for (std::int32_t w : {2, 3, 8}) {
+    const auto rw = evaluate_pairs(*g, pairs, opts, per, w);
+    ASSERT_EQ(rw.size(), 4U);
+    for (std::size_t i = 0; i < 4; ++i) {
+      expect_same(rw[i], r1[i], "workers " + std::to_string(w) + " pair " + std::to_string(i));
+    }
   }
-  // Shuffled via edge: entry no longer connects its parent to its node.
+  EXPECT_TRUE(evaluate_pairs(*g, {}, opts, {}, 4).empty());
+  // Validation before any worker: endpoints, lengths, foreign values, Pinned, workers, the
+  // building cache's one writer.
+  auto bad = pairs;
+  bad[2].second = {9};
+  EXPECT_THROW((void)evaluate_pairs(*g, bad, opts, per, 4), std::invalid_argument);
+  bad = pairs;
+  bad[1].first = {3};
+  EXPECT_TRUE(contains(error_of([&] { (void)evaluate_pairs(*g, bad, opts, per, 4); }), "both endpoint sets"));
+  EXPECT_THROW((void)evaluate_pairs(*g, pairs, opts, std::vector<const Eligibility*> {nullptr}, 1), std::invalid_argument);
+  auto other = diamond(5, 3);
+  const auto foreign = other->eligibility({}, std::vector<EdgeId> {0});
+  const std::vector<const Eligibility*> per_foreign = {nullptr, &foreign, nullptr, nullptr};
+  EXPECT_TRUE(contains(error_of([&] { (void)evaluate_pairs(*g, pairs, opts, per_foreign, 1); }), "foreign"));
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2})});
+  EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, pairs, EvaluationOptions {{.routing = pin}}, {}, 1); }),
+            "evaluate_pairs does not accept Pinned");
+  EXPECT_TRUE(contains(error_of([&] { (void)evaluate_pairs(*g, pairs, opts, per, 0); }), "workers"));
+  ShortestPathCache cache(*g);
+  const EvaluationOptions with_cache {shortest_paths_config(), nullptr, &cache};
+  EXPECT_TRUE(contains(error_of([&] { (void)evaluate_pairs(*g, pairs, with_cache, {}, 2); }), "workers == 1"));
+  const auto cached = evaluate_pairs(*g, pairs, with_cache, {}, 1);
+  EXPECT_EQ(cache.stats().misses, 2);  // destination sets {3} and {1, 2}
+  EXPECT_EQ(cache.stats().hits, 2);
+  EXPECT_EQ(cached[0].call_delivered, 7);  // ShortestPaths EB over routes of 5 and 3: [4, 3] (odd unit to the lower id)
+  // The argument checks in their documented order, all before the pairs: with every defect
+  // present the first is reported, and with that one removed the next. Pinned also carries a
+  // configuration error (an admission outside its enumeration); pair 2 has a destination out of range. The building cache
+  // is untouched: no lookup ran.
+  ShortestPathCache foreign_cache(*other);
+  ShortestPathCache building(*g);
+  const FlowPolicyConfig pinned_bad {.routing = pin, .admission = static_cast<Admission>(97)};
+  const FlowPolicyConfig config_bad = cfg(ShortestPaths {}, RouteAllocation::Optimized, Admission::Lossy);
+  bad = pairs;
+  bad[2].second = {9};
+  const std::vector<const Eligibility*> short_per = {nullptr};
+  auto first_error = [&](const FlowPolicyConfig& c, const Eligibility* elig, ShortestPathCache* with,
+                         const std::vector<const Eligibility*>& per_pair, std::int32_t workers) {
+    return error_of([&] { (void)evaluate_pairs(*g, bad, EvaluationOptions {c, elig, with}, per_pair, workers); });
+  };
+  EXPECT_EQ(first_error(pinned_bad, &foreign, &foreign_cache, short_per, 0), "workers must be >= 1 (got 0)");
+  EXPECT_EQ(first_error(pinned_bad, &foreign, &foreign_cache, short_per, 2),
+            "foreign Eligibility: built for another graph");
+  EXPECT_EQ(first_error(pinned_bad, nullptr, &foreign_cache, short_per, 2), "foreign ShortestPathCache: bound to another graph");
+  EXPECT_EQ(first_error(pinned_bad, nullptr, &building, short_per, 2),
+            "evaluate_pairs does not accept Pinned");  // arguments before cache mode
+  EXPECT_EQ(first_error(pinned_bad, nullptr, &building, short_per, 1), "evaluate_pairs does not accept Pinned");
+  EXPECT_EQ(first_error(config_bad, nullptr, &building, short_per, 1), "ShortestPaths OPTIMIZED requires admission=LOSSLESS");
+  EXPECT_EQ(first_error(global_config(), nullptr, &building, short_per, 1), "CentralizedTE does not use ShortestPathCache");
+  EXPECT_EQ(first_error(shortest_paths_config(), nullptr, &building, short_per, 1), "per_pair_eligibility has 1 entries for 4 pairs");
+  EXPECT_EQ(first_error(shortest_paths_config(), nullptr, &building, per, 1), "destinations: node 9 out of node range [0, 4)");
+  EXPECT_EQ(stats_of(building.stats()), stats_of(ShortestPathCache(*g).stats()));
+}
+
+TEST(Evaluators, BatchValidatesInPairOrderBeforeAnyWorker) {
+  // Two invalid pairs (1 and 3): the batch raises pair 1's error before any worker starts.
+  auto g = diamond(5, 3);
+  std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {{0}, {3}}, {{0}, {7}}, {{0}, {3}}, {{0}, {8}}};
+  const auto msg = error_of([&] { (void)evaluate_pairs(*g, pairs, EvaluationOptions {global_config()}, {}, 4); });
+  EXPECT_TRUE(contains(msg, "node 7")) << msg;
+  // Within one pair: the sources, then the destinations, then their overlap, then the pair's
+  // Eligibility's graph.
+  const auto elsewhere = diamond(5, 3);
+  const auto foreign = elsewhere->eligibility({}, std::vector<EdgeId> {0});
+  const std::vector<const Eligibility*> per = {&foreign};
+  const auto pair_error = [&](std::vector<NodeId> s, std::vector<NodeId> d) {
+    const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> one = {{s, d}};
+    return error_of([&] { (void)evaluate_pairs(*g, one, EvaluationOptions {global_config()}, per, 1); });
+  };
+  EXPECT_EQ(pair_error({}, {9}), "sources: the node set is empty");
+  EXPECT_EQ(pair_error({0, 3}, {3, 9}), "destinations: node 9 out of node range [0, 4)");
+  EXPECT_EQ(pair_error({0, 3}, {3}), "node 3 is in both endpoint sets: sources and destinations must not overlap");
+  EXPECT_EQ(pair_error({0}, {3}), "foreign Eligibility: per_pair_eligibility[0] built for another graph");
+}
+
+// The failure study's shortcuts (optimized CentralizedTE from the baseline's maximum flow, ShortestPaths without a
+// re-evaluation of the edges outside the static shortest-path support reachable from the sources)
+// and the plain re-evaluations (equal CentralizedTE, T1, Pinned) give the losses of the
+// definition, the
+// baseline's call_delivered minus evaluate_demand() with the edge excluded, on random graphs with parallel
+// edges, self-loops, dispersed costs, zero capacities, endpoint sets and eligibility masks; every
+// ShortestPaths kernel under FEWER_HOPS and HIGHER_CAPACITY with every multipath and parallel_edges
+// setting the tie rule allows (the pooled single-path rule skips HIGHER_* single paths with two
+// sources), both admissions, one HIGHER_AVAILABLE_CAPACITY single path (no HIGHER_HEADROOM) and the
+// equal source allocation of Optimized; CentralizedTE under both source allocations (equal: a deletion that removes a
+// source from the roster can raise the total, a negative loss); two T1 configurations with the
+// design 6 (HIGHER_AVAILABLE_CAPACITY without parallel links, and three tunnels under a CostStretch ceiling: setup redone under
+// every deletion); and Pinned
+// with two route DAGs (the static support toward the destination and the second shortest path) on
+// single endpoints. An edge without an entry has loss 0 by the same definition.
+TEST(Evaluators, SensitivityEqualsTheDefinitionOnRandomGraphs) {
+  std::mt19937 rng(20261005);
+  auto pick = [&](int n) { return static_cast<int>(rng() % static_cast<unsigned>(n)); };
+  std::vector<FlowPolicyConfig> configs = {global_config(), {.routing = centralized(SourceAllocation::Equal)}};
+  for (auto k : {RouteAllocation::Optimized, RouteAllocation::Equal, RouteAllocation::Weighted}) {
+    for (bool multipath : {true, false}) {
+      for (bool parallel_edges : {true, false}) {
+        for (auto t : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity}) {
+          if (t != RouteTieBreak::FewerHops && multipath && parallel_edges) continue;  // the ineffective tie rule
+          configs.push_back(cfg(ShortestPaths {}, k, Admission::Lossless, sel(t, multipath, parallel_edges)));
+        }
+      }
+    }
+  }
+  configs.push_back(cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy));
+  configs.push_back(cfg(ShortestPaths {}, RouteAllocation::Weighted, Admission::Lossy, sel(RouteTieBreak::HigherAvailableCapacity, false, false)));
   {
-    PredDAG bad = dag;
-    bad.via_edges[0] = 3;  // D->C edge in place of a parent link
-    std::vector<PredDAG> b; b.push_back(std::move(bad));
-    EXPECT_THROW(policy.set_static_paths(0, 2, std::move(b)), std::invalid_argument);
-  }
-}
-
-// The max_path_cost_factor gate multiplies best_path_cost_ by the factor and casts
-// the product back to Cost. best_path_cost_ is only updated when dst is reachable
-// (flow_policy.cpp:135), so an UNREACHABLE destination is the one way to reach the
-// gate while it still holds the INT64_MAX "no best path yet" sentinel. Before 0.8.0
-// the multiply-and-cast ran unconditionally there, and INT64_MAX * factor is far
-// outside the int64 range -- undefined behavior.
-//
-// No assertion can distinguish fixed from unfixed here: both return "no path" for an
-// unreachable destination. The check is the UB itself, so this test exists to give
-// UBSan something to instrument. It only has teeth under `make sanitize-test`, which
-// runs ctest -- which is why this lives in C++ and not in the Python suite.
-TEST(FlowPolicyCostBounds, MaxPathCostFactor_UnreachableDst_KeepsSentinelOutOfTheCast) {
-  // 0 -> 1, plus an isolated node 2 that cannot be reached from 0.
-  std::vector<std::int32_t> src{0}, dst{1};
-  std::vector<double> cap{1.0};
-  std::vector<std::int64_t> cost{7};
-  auto g = StrictMultiDiGraph::from_arrays(3, src, dst, cap, cost);
-  FlowGraph fg(g);
-
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be);
-  auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.max_flow_count = 1;
-  cfg.min_flow_count = 1;  // seeding is what calls get_path_bundle
-  cfg.max_path_cost_factor = 2.0;
-  FlowPolicy policy(ctx, cfg);
-
-  // Reaches the gate with best_path_cost_ == INT64_MAX. Nothing can be placed.
-  auto res = policy.place_demand(fg, /*src=*/0, /*dst=*/2, /*flowClass=*/0, /*volume=*/1.0);
-  EXPECT_NEAR(res.first, 0.0, 1e-9);
-  EXPECT_NEAR(res.second, 1.0, 1e-9);
-}
-
-// A very large (but legal) best cost times a large factor overflows the int64 range
-// too. The bound must be dropped rather than wrapped: a wrapped negative bound would
-// reject the shortest path itself, so a successful placement is what separates the
-// guard from the bug. Unlike the sentinel case above, this one IS assertable.
-TEST(FlowPolicyCostBounds, MaxPathCostFactor_HugeProduct_DropsBoundInsteadOfWrapping) {
-  const std::int64_t big = std::int64_t{1} << 60;  // total stays below the 2^62 ceiling
-  std::vector<std::int32_t> src{0, 1}, dst{1, 2};
-  std::vector<double> cap{1.0, 1.0};
-  std::vector<std::int64_t> cost{big, big};
-  auto g = StrictMultiDiGraph::from_arrays(3, src, dst, cap, cost);
-  FlowGraph fg(g);
-
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto be = make_cpu_backend(); auto algs = std::make_shared<Algorithms>(be);
-  auto gh = algs->build_graph(g);
-  ExecutionContext ctx(algs, gh);
-
-  FlowPolicyConfig cfg;
-  cfg.flow_placement = FlowPlacement::Proportional;
-  cfg.selection = sel;
-  cfg.require_capacity = true;
-  cfg.max_flow_count = 1;
-  cfg.min_flow_count = 1;
-  cfg.max_path_cost_factor = 1e9;
-  FlowPolicy policy(ctx, cfg);
-
-  auto res = policy.place_demand(fg, /*src=*/0, /*dst=*/2, /*flowClass=*/0, /*volume=*/1.0);
-  EXPECT_NEAR(res.first, 1.0, 1e-9);
+    ShortestPaths equal_controller = shortest_paths(RouteAllocation::Optimized);
+    equal_controller.source_allocation = SourceAllocation::Equal;
+    configs.push_back({.routing = equal_controller});
+  }
+  configs.push_back({.routing = DistributedTE {.tunnel_count = TunnelCount {2},
+                                               .tie_break = RouteTieBreak::HigherAvailableCapacity,
+                                               .parallel_edges = false}});
+  configs.push_back({.routing = DistributedTE {TunnelCount {3}, CostStretch(2)}});
+  // T1 names its design; the other models take none.
+  const auto query = [](const FlowPolicyConfig& c, const Eligibility* e, OutputOptions o = {}) {
+    EvaluationOptions q {c, e, nullptr, o};
+    if (std::holds_alternative<DistributedTE>(c.routing)) q.design_demand = Amount {6};
+    return q;
+  };
+  int entries = 0;
+  int global_losses = 0;
+  int policy_losses = 0;
+  int policy_zero = 0;
+  int aware_losses = 0;
+  int pinned_losses = 0;
+  int pinned_trials = 0;
+  int zero_edge_losses = 0;  // entries of zero-capacity edges whose deletion changes the result
+  int negative = 0;          // equal-source-allocation deletions that raise the total
+  int absent = 0;
+  for (int trial = 0; trial < 60; ++trial) {
+    const int n = 4 + pick(7);
+    std::vector<InEdge> es;
+    for (int k = 0, m = n + pick(3 * n); k < m; ++k) {
+      es.push_back({pick(n), pick(n), pick(5) == 0 ? 0 : 1 + pick(9), static_cast<Cost>(1 + pick(4))});
+    }
+    auto g = shared(make_graph(n, es));
+    std::vector<NodeId> s = {0};
+    std::vector<NodeId> t = {n - 1};
+    if (pick(2) == 0) s.push_back(1);
+    if (pick(2) == 0) t.push_back(n - 2);
+    std::vector<NodeId> xn;
+    std::vector<EdgeId> xe;
+    if (pick(3) == 0) xn.push_back(static_cast<NodeId>(2 + pick(n - 4 > 0 ? n - 4 : 1)));
+    if (pick(2) == 0) xe.push_back(static_cast<EdgeId>(pick(static_cast<int>(es.size()))));
+    const auto mask = g->eligibility(xn, xe);
+    const Eligibility* elig = pick(2) == 0 ? &mask : nullptr;
+    // Pinned on the single endpoints 0 and n - 1, when 0 reaches n - 1 statically.
+    auto trial_configs = configs;
+    const NodeId t0 = n - 1;
+    const auto support = std::make_shared<const PredecessorDAG>(
+        detail::static_support(*g, std::vector<NodeId> {t0}, Direction::Reverse, nullptr));
+    const auto paths = ksp(*g, 0, t0, KspOptions(2));
+    if (paths.size() == 2) {
+      trial_configs.push_back({.routing = pinned_dags(*g, 0, t0,
+                                                      {support, std::make_shared<const PredecessorDAG>(paths[1].second.to_dag())},
+                                                      RouteAllocation::Weighted)});
+      ++pinned_trials;
+    }
+    for (const auto& c : trial_configs) {
+      const bool shortest_paths = std::holds_alternative<ShortestPaths>(c.routing);
+      if (shortest_paths && s.size() > 1 && !std::get<ShortestPaths>(c.routing).multipath &&
+          std::get<ShortestPaths>(c.routing).tie_break != RouteTieBreak::FewerHops) {
+        continue;  // the pooled single-path rule
+      }
+      const bool global = std::holds_alternative<CentralizedTE>(c.routing) &&
+                          std::get<CentralizedTE>(c.routing).source_allocation == SourceAllocation::Optimized;
+      const bool pinned = std::holds_alternative<Pinned>(c.routing);
+      const std::vector<NodeId> cs = pinned ? std::vector<NodeId> {0} : s;
+      const std::vector<NodeId> ct = pinned ? std::vector<NodeId> {t0} : t;
+      const auto r = evaluate_edge_failures(*g, cs, ct, query(c, elig), 1 + pick(3));
+      // The baseline is evaluate_demand() itself, and the entries are the candidates in ascending order:
+      // CentralizedTE, the baseline's positive-flow edges; every other model, every allowed edge,
+      // whatever its capacity.
+      const auto base = evaluate_demand(*g, cs, ct, query(c, elig, OutputOptions {true, false, false}));
+      ASSERT_EQ(r.baseline.call_delivered, base.call_delivered) << "trial " << trial;
+      std::vector<EdgeId> candidates;
+      for (EdgeId e = 0; e < g->num_edges(); ++e) {
+        const auto ei = static_cast<std::size_t>(e);
+        if (global ? (*base.edge_flows)[ei] > 0 : elig == nullptr || elig->allows_edge(e)) {
+          candidates.push_back(e);
+        }
+      }
+      const bool equal_global = std::holds_alternative<CentralizedTE>(c.routing) && !global;
+      const std::string model = global          ? " CentralizedTE"
+                                : equal_global  ? " CentralizedTE equal"
+                                : shortest_paths     ? " ShortestPaths"
+                                : pinned        ? " Pinned"
+                                                : " T1";
+      std::vector<EdgeId> listed;
+      for (const auto& e : r.entries) listed.push_back(e.edge);
+      ASSERT_EQ(listed, candidates) << "trial " << trial << model;
+      // The loss of deleting `e`, by the definition.
+      const auto loss = [&](EdgeId e) {
+        const EdgeId one[1] = {e};
+        auto deleted = g->eligibility({}, one);
+        if (elig != nullptr) deleted = Eligibility::intersect(*elig, deleted);
+        return base.call_delivered - evaluate_demand(*g, cs, ct, query(c, &deleted)).call_delivered;
+      };
+      for (const auto& e : r.entries) {
+        const Amount want = loss(e.edge);
+        ASSERT_EQ(e.delivery_reduction, want) << "trial " << trial << " edge " << e.edge << model;
+        ++entries;
+        if (want != 0) ++(global ? global_losses : shortest_paths ? policy_losses : pinned ? pinned_losses : aware_losses);
+        if (shortest_paths && want == 0) ++policy_zero;
+        if (g->edge_capacity_units()[static_cast<std::size_t>(e.edge)] == 0 && want != 0) ++zero_edge_losses;
+        if (want < 0) ++negative;
+      }
+      for (EdgeId e = 0; e < g->num_edges(); ++e) {
+        if (std::find(listed.begin(), listed.end(), e) != listed.end()) continue;
+        EXPECT_EQ(loss(e), 0) << "trial " << trial << " edge " << e << model << ": an edge without an entry";
+        ++absent;
+      }
+    }
+  }
+  // Not vacuous: many entries, losses under every model, zero-loss ShortestPaths deletions, Pinned
+  // trials, deletions of zero-capacity edges that change the result, and edges without an entry.
+  EXPECT_GT(entries, 3000);
+  EXPECT_GT(global_losses, 100);
+  EXPECT_GT(policy_losses, 500);
+  EXPECT_GT(policy_zero, 500);
+  EXPECT_GT(aware_losses, 100);
+  EXPECT_GT(pinned_losses, 30);
+  EXPECT_GT(pinned_trials, 20);
+  EXPECT_GT(zero_edge_losses, 50);
+  EXPECT_GT(negative, 10);
+  EXPECT_GT(absent, 500);
+}
+
+TEST(Evaluators, SensitivityCandidatesAndSignedLosses) {
+  // CentralizedTE: candidates are the baseline's positive-flow edges; an unsaturated critical edge
+  // appears: 0 -> 1 of capacity 9 carries 4 (its tail 1 -> 2 holds 4) and its deletion
+  // loses 4; a candidate set of saturated edges only would miss it.
+  auto g = shared(make_graph(3, {{0, 1, 9, 1}, {1, 2, 4, 1}, {0, 2, 2, 5}}));
+  auto s = evaluate_edge_failures(*g, v({0}), v({2}), EvaluationOptions {global_config()}, 1);
+  EXPECT_EQ(s.baseline.call_delivered, 6);
+  EXPECT_FALSE(s.baseline.edge_flows.has_value());  // requested internally, not returned
+  std::map<EdgeId, Amount> losses;
+  for (const auto& e : s.entries) losses[e.edge] = e.delivery_reduction;
+  const auto inv = id_of_input(*g);
+  EXPECT_EQ(losses.at(inv[0]), 4);  // unsaturated (4 of 9) and critical
+  EXPECT_EQ(losses.at(inv[1]), 4);
+  EXPECT_EQ(losses.at(inv[2]), 2);
+  EXPECT_EQ(losses.size(), 3U);
+  // A policy model: every allowed edge, whatever its capacity. Equal over parallel
+  // links of 1, 10 and 0 (ids 0, 1, 2): round robin over the three members fits 2 units and the
+  // third would cross the zero link. Without the thin link (members 1, 2): 1, loss 1; without the
+  // wide link (0, 2): 1, loss 1; without the zero link (0, 1): 2, loss 0.
+  auto p = shared(make_graph(2, {{0, 1, 1, 1}, {0, 1, 10, 1}, {0, 1, 0, 1}}));
+  const auto opts = EvaluationOptions {shortest_paths_config()};
+  s = evaluate_edge_failures(*p, v({0}), v({1}), opts, 1);
+  EXPECT_EQ(s.baseline.call_delivered, 2);
+  // The exact (edge, loss) list in ascending EdgeId.
+  const auto pin = id_of_input(*p);
+  std::vector<std::pair<EdgeId, Amount>> got;
+  for (const auto& e : s.entries) got.emplace_back(e.edge, e.delivery_reduction);
+  std::vector<std::pair<EdgeId, Amount>> want = {{pin[0], 1}, {pin[1], 1}, {pin[2], 0}};
+  std::sort(want.begin(), want.end());
+  EXPECT_EQ(got, want);
+  // Workers give the same entries; an excluded edge is no candidate.
+  const auto s4 = evaluate_edge_failures(*p, v({0}), v({1}), opts, 4);
+  std::vector<std::pair<EdgeId, Amount>> got4;
+  for (const auto& e : s4.entries) got4.emplace_back(e.edge, e.delivery_reduction);
+  EXPECT_EQ(got4, want);
+  const auto el = p->eligibility({}, std::vector<EdgeId> {pin[0]});
+  const auto se = evaluate_edge_failures(*p, v({0}), v({1}), EvaluationOptions {opts.config, &el}, 1);
+  ASSERT_EQ(se.entries.size(), 2U);
+  EXPECT_EQ(se.entries[0].edge, std::min(pin[1], pin[2]));
+  EXPECT_EQ(se.entries[1].edge, std::max(pin[1], pin[2]));
+  // A loss can be negative, also for a zero-capacity link (the search graph S: ids 0: 0 -> 1 of
+  // capacity 0, 1: 0 -> 2, 2: 2 -> 1 of 5, costs 1): the only shortest route crosses the zero
+  // link, so Equal carries 0; without it the route 0 -> 2 -> 1 carries 5, a loss of -5.
+  // The other two edges lie outside the reachable support (loss 0 without a placement).
+  auto g8 = shared(make_graph(3, {{0, 1, 0, 1}, {0, 2, 5, 1}, {2, 1, 5, 1}}));
+  const auto s8 = evaluate_edge_failures(*g8, v({0}), v({1}), opts, 1);
+  EXPECT_EQ(s8.baseline.call_delivered, 0);
+  std::vector<std::pair<EdgeId, Amount>> got8;
+  for (const auto& e : s8.entries) got8.emplace_back(e.edge, e.delivery_reduction);
+  EXPECT_EQ(got8, (std::vector<std::pair<EdgeId, Amount>> {{0, -5}, {1, 0}, {2, 0}}));
+  // Invalid inputs propagate (before any worker).
+  EXPECT_THROW((void)evaluate_edge_failures(*p, v({0}), v({0}), opts, 1), std::invalid_argument);
+  ShortestPathCache cache(*p);
+  EXPECT_THROW((void)evaluate_edge_failures(*p, v({0}), v({1}), EvaluationOptions {opts.config, nullptr, &cache}, 2),
+               std::invalid_argument);
+  EXPECT_EQ(evaluate_edge_failures(*p, v({0}), v({1}), EvaluationOptions {opts.config, nullptr, &cache}, 1).entries.size(), 3U);
+}
+
+// The baseline is evaluate_demand() with the requested outputs, in every routing model (T1 with its
+// design); without a request it carries none.
+TEST(Evaluators, SensitivityBaselineIsCapacityWithTheRequestedOutputs) {
+  auto g = diamond(5, 3, 2);
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2}), dag_of(*g, {1, 3})});
+  const OutputOptions all {.edge_flows = true, .residual = true, .saturated_boundary_edges = true, .edge_reservations = true};
+  for (const auto& c : {global_config(), shortest_paths_config(), t1(2), FlowPolicyConfig {.routing = pin},
+                        FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(*g, {0, 2}))}}) {
+    const auto with = [&](EvaluationOptions q) {
+      if (std::holds_alternative<DistributedTE>(c.routing)) q.design_demand = Amount {6};
+      return q;
+    };
+    const auto s = evaluate_edge_failures(*g, v({0}), v({3}), with({c, nullptr, nullptr, all}), 1);
+    const auto want = evaluate_demand(*g, v({0}), v({3}), with({c, nullptr, nullptr, all}));
+    EXPECT_GT(want.call_delivered, 0);
+    ASSERT_TRUE(want.edge_flows.has_value() && want.residual.has_value() && want.saturated_boundary_edges.has_value() &&
+                want.edge_reservations.has_value());
+    expect_same(s.baseline, want, "sensitivity baseline with every output");
+    const auto plain = evaluate_edge_failures(*g, v({0}), v({3}), with({c}), 1);
+    expect_same(plain.baseline, evaluate_demand(*g, v({0}), v({3}), with({c})), "sensitivity baseline, no output");
+  }
+}
+
+// ShortestPaths re-evaluates a deletion exactly when the edge lies in the static shortest-path support
+// (every edge on a shortest path to the destinations) reachable from a roster source; every other
+// candidate gets loss 0 without a placement. A supplied building cache shows which deletions were
+// placed: each placed deletion looks up its own fresh Eligibility uid (one miss and one entry),
+// after the baseline's one. Edges 0->2, 1->2, 2->3, 2->4, 3->5, 4->5 of 10 units at cost 1: all six
+// form the support toward 5. From source 0 the Optimized controller sends 10 over 0->2->3->5 (the
+// lowest EdgeIds first), but 2->4 and 4->5, carrying nothing, are in its reachable support and are
+// re-evaluated (loss 0); 1->2 is not and is skipped. From sources 0 and 1 (pooled, 20) the second
+// source reaches 1->2 too, and every deletion loses 10.
+TEST(Evaluators, ShortestPathsSensitivityReevaluatesExactlyTheReachableSupport) {
+  auto g = shared(make_graph(6, {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 4, 10, 1}, {3, 5, 10, 1}, {4, 5, 10, 1}}));
+  const auto in = id_of_input(*g);
+  const auto c = cfg(ShortestPaths {}, RouteAllocation::Optimized);
+  const auto losses_of = [&](const SensitivityResult& r) {
+    std::map<std::size_t, Amount> out;  // by input position
+    for (const auto& e : r.entries) {
+      out[static_cast<std::size_t>(std::find(in.begin(), in.end(), e.edge) - in.begin())] = e.delivery_reduction;
+    }
+    return out;
+  };
+  ShortestPathCache one(*g);
+  const auto r1 = evaluate_edge_failures(*g, v({0}), v({5}), EvaluationOptions {c, nullptr, &one}, 1);
+  EXPECT_EQ(r1.baseline.call_delivered, 10);
+  EXPECT_EQ(losses_of(r1), (std::map<std::size_t, Amount> {{0, 10}, {1, 0}, {2, 0}, {3, 0}, {4, 0}, {5, 0}}));
+  EXPECT_EQ(one.stats().hits, 0);
+  EXPECT_EQ(one.stats().misses, 1 + 5);  // the baseline, then every candidate but 1->2
+  EXPECT_EQ(one.stats().entries, 1 + 5);
+  ShortestPathCache two(*g);
+  const auto r2 = evaluate_edge_failures(*g, v({0, 1}), v({5}), EvaluationOptions {c, nullptr, &two}, 1);
+  EXPECT_EQ(r2.baseline.call_delivered, 20);
+  EXPECT_EQ(losses_of(r2), (std::map<std::size_t, Amount> {{0, 10}, {1, 10}, {2, 10}, {3, 10}, {4, 10}, {5, 10}}));
+  EXPECT_EQ(two.stats().misses, 1 + 6);  // every candidate
+  EXPECT_EQ(two.stats().entries, 1 + 6);
+}
+
+// evaluate_edge_failures's worker and cache rules are evaluate_pairs's, checked in its order before any work:
+// workers >= 1, the Eligibility's graph, the cache's graph, a supplied building cache only with
+// one worker; a frozen cache is shared by every worker. A model that reads no cache (CentralizedTE)
+// rejects one, frozen or not, after those checks.
+TEST(Evaluators, SensitivityChecksWorkersAndCachesAsTheBatchDoes) {
+  auto g = diamond(5, 3);
+  auto other = diamond(5, 3);
+  const auto foreign = other->eligibility({}, std::vector<EdgeId> {0});
+  ShortestPathCache foreign_cache(*other);
+  ShortestPathCache building(*g);
+  const auto first_error = [&](const Eligibility* elig, ShortestPathCache* cache, std::int32_t workers) {
+    return error_of([&] { (void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {shortest_paths_config(), elig, cache}, workers); });
+  };
+  EXPECT_EQ(first_error(&foreign, &foreign_cache, 0), "workers must be >= 1 (got 0)");
+  EXPECT_EQ(first_error(&foreign, &foreign_cache, 2), "foreign Eligibility: built for another graph");
+  EXPECT_EQ(first_error(nullptr, &foreign_cache, 2), "foreign ShortestPathCache: bound to another graph");
+  EXPECT_EQ(first_error(nullptr, &building, 2),
+            "a supplied building ShortestPathCache has one writer: it is rejected unless workers == 1 (got workers = 2; a "
+            "frozen cache may be shared by every worker)");
+  EXPECT_EQ(stats_of(building.stats()), stats_of(ShortestPathCache(*g).stats()));  // no lookup ran
+  building.freeze();
+  for (const std::int32_t workers : {1, 2, 4}) {
+    EXPECT_EQ(error_of([&] {
+                (void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {global_config(), nullptr, &building}, workers);
+              }),
+              "CentralizedTE does not use ShortestPathCache");
+  }
+  EXPECT_EQ(stats_of(building.stats()), stats_of(ShortestPathCache(*g).stats()));
+}
+
+// Only ShortestPaths reads the cache: CentralizedTE, T1 and Pinned reject one (frozen too) before
+// any lookup and count nothing; ShortestPaths's baseline raises the miss of an empty frozen cache.
+TEST(Evaluators, SensitivityReadsTheCacheOnlyUnderShortestPaths) {
+  auto g = diamond(5, 3, 2);
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0, 2}), dag_of(*g, {1, 3})});
+  ShortestPathCache empty(*g);
+  empty.freeze();
+  for (const auto& [c, model] :
+       {std::pair {global_config(), "CentralizedTE"},
+        std::pair {t1(2), "DistributedTE"},
+        std::pair {FlowPolicyConfig {.routing = pin}, "Pinned"}}) {
+    for (const std::int32_t workers : {1, 3}) {
+      EXPECT_EQ(error_of([&] {
+                  (void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {c, nullptr, &empty}, workers);
+                }),
+                std::string(model) + " does not use ShortestPathCache");
+    }
+  }
+  EXPECT_EQ(stats_of(empty.stats()), stats_of(ShortestPathCache(*g).stats()));
+  EXPECT_THROW((void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {shortest_paths_config(), nullptr, &empty}, 1),
+               ShortestPathCacheMiss);
+  EXPECT_EQ(empty.stats().misses, 1);
+}
+
+namespace {
+
+// Sets (value) or removes (nullptr) an environment variable of this process.
+void set_env(const char* name, const char* value) {
+#ifdef _WIN32
+  (void)_putenv_s(name, value == nullptr ? "" : value);  // an empty value removes it on Windows
+#else
+  if (value == nullptr) {
+    (void)unsetenv(name);
+  } else {
+    (void)setenv(name, value, 1);
+  }
+#endif
+}
+
+} // namespace
+
+// The evaluators' default worker counts (README "Environment variables", evaluator_checks.hpp):
+// NGRAPH_CORE_BATCH_THREADS for evaluate_pairs and NGRAPH_CORE_SENSITIVITY_THREADS for
+// evaluate_edge_failures, each an integer in [1, 4096] read independently of the other; 1 when unset or
+// invalid. " 4" reads as 4 (leading blanks are part of the integer syntax, as for strtol and
+// Python's int()); trailing characters, a sign alone and values outside the range
+// give 1.
+// ---------------------------------------------------------------- the offer of every model
+
+// PAR(a, b): two parallel links 0 -> 1 of capacities a and b, cost 1.
+std::shared_ptr<const Graph> par(Amount a, Amount b) { return shared(make_graph(2, {{0, 1, a, 1}, {0, 1, b, 1}})); }
+EvaluationOptions offered(FlowPolicyConfig c, std::optional<std::optional<Amount>> offer,
+                          std::optional<std::optional<Amount>> design = std::nullopt) {
+  EvaluationOptions o {std::move(c)};
+  o.offer = offer;
+  o.design_demand = design;
+  return o;
+}
+const std::optional<std::optional<Amount>> kNoOffer;
+std::optional<std::optional<Amount>> units(Amount a) { return std::optional<std::optional<Amount>> {std::in_place, a}; }
+
+// ECMP Lossless on PAR(4, 10): uncapped 8; an offer below the bound in full, above it up to 8.
+TEST(Evaluators, OfferShortestPaths) {
+  const auto g = par(4, 10);
+  const auto ecmp = shortest_paths_config();
+  auto r = evaluate_demand(*g, v({0}), v({1}), offered(ecmp, kNoOffer));
+  EXPECT_EQ(std::tuple(r.call_delivered, r.termination), std::tuple(Amount {8}, Termination::Exhausted));
+  r = evaluate_demand(*g, v({0}), v({1}), offered(ecmp, units(5)));
+  EXPECT_EQ(std::tuple(r.call_delivered, r.termination), std::tuple(Amount {5}, Termination::Complete));
+  r = evaluate_demand(*g, v({0}), v({1}), offered(ecmp, units(12)));
+  EXPECT_EQ(std::tuple(r.call_delivered, r.termination), std::tuple(Amount {8}, Termination::Exhausted));
+  r = evaluate_demand(*g, v({0}), v({1}), offered(ecmp, units(0)));
+  EXPECT_EQ(std::tuple(r.call_delivered, r.termination), std::tuple(Amount {0}, Termination::Complete));
+}
+
+// T1, design 8 (one tunnel on each link): Lossless 8, or 5 at the offer 5; Lossy 12 drops 2 on
+// link 0; the missing offer and the missing design.
+TEST(Evaluators, OfferDistributed) {
+  const auto g = par(4, 10);
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), offered(t1(2), kNoOffer, units(8))).call_delivered, 8);
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), offered(t1(2), units(5), units(8))).call_delivered, 5);
+  const auto r = evaluate_demand(*g, v({0}), v({1}), offered(t1(2, Admission::Lossy), units(12), units(8)));
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(r.call_edge_drops, (std::vector<std::pair<EdgeId, Amount>> {{0, 2}}));
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(t1(2, Admission::Lossy), kNoOffer, units(8))); }),
+            "DistributedTE LOSSY evaluation requires a finite offer");
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(t1(2), kNoOffer)); }),
+            "DistributedTE evaluation requires design_demand");
+}
+
+// evaluate_edge_failures at a fixed offer: every deletion answers the same offer (EVAL-fixed-offer
+// and PAR(4, 10)); without one, the first-hop experiment injects each remaining link's capacity.
+TEST(Evaluators, FailuresFixedOffer) {
+  const auto ly = FlowPolicyConfig {.routing = ShortestPaths {}, .admission = Admission::Lossy};
+  const auto run = [&](const Graph& g, std::optional<std::optional<Amount>> offer, std::int32_t workers) {
+    const auto s = evaluate_edge_failures(g, v({0}), v({1}), offered(ly, offer), workers);
+    std::vector<Amount> out {s.baseline.call_delivered};
+    for (const auto& e : s.entries) out.push_back(e.delivery_reduction);
+    return out;
+  };
+  for (const std::int32_t w : {1, 2}) {
+    EXPECT_EQ(run(*par(10, 10), units(4), w), (std::vector<Amount> {4, 0, 0}));
+    EXPECT_EQ(run(*par(10, 10), kNoOffer, w), (std::vector<Amount> {20, 10, 10}));
+    EXPECT_EQ(run(*par(4, 10), units(12), w), (std::vector<Amount> {10, 0, 6}));
+    EXPECT_EQ(run(*par(4, 10), kNoOffer, w), (std::vector<Amount> {14, 4, 10}));
+  }
+}
+
+// The C++ offer outside its domain (2^62, a negative value) and an explicit +inf: the one text,
+// after the configuration and before the design.
+TEST(Evaluators, OfferDomain) {
+  const auto g = par(4, 10);
+  const std::string domain = "offer must be an integer in [0, 2^62)";
+  for (const auto& offer : {units(kL62), units(-5), std::optional<std::optional<Amount>> {std::in_place, std::nullopt}}) {
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(shortest_paths_config(), offer)); }), domain);
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(t1(2), offer, units(-1))); }), domain);
+  }
+  EXPECT_EQ(error_of([&] {
+              (void)evaluate_demand(*g, v({0}), v({1}),
+                                    offered({.routing = centralized(SourceAllocation::Equal, {}, std::nullopt, true)}, units(-5)));
+            }),
+            "prefer_headroom requires tunnel_count");
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(shortest_paths_config(), kNoOffer, units(-1))); }),
+            "ShortestPaths does not accept design_demand");
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), offered(shortest_paths_config(), units(kL62 - 1))); }), "");
+}
+
+// The failure study of every controller and ShortestPaths at finite offers below, at and above
+// the maximum: the baseline is evaluate_demand's, and each allowed edge's reduction is the baseline
+// minus evaluate_demand with that edge excluded too (a capped CentralizedTE baseline is no maximum
+// flow: its deletions are solved afresh), workers 1 and 2.
+TEST(Evaluators, FailuresAtEveryOffer) {
+  const auto g = shared(make_graph(4, {{0, 1, 4, 1}, {0, 2, 6, 1}, {1, 3, 3, 2}, {2, 3, 9, 1}}));
+  const std::vector<FlowPolicyConfig> configs = {
+      {.routing = centralized(SourceAllocation::Optimized)}, {.routing = centralized(SourceAllocation::Equal)},
+      {.routing = shortest_paths(RouteAllocation::Optimized)}, {.routing = shortest_paths(RouteAllocation::Equal)},
+      {.routing = shortest_paths(RouteAllocation::Weighted)}};
+  int checked = 0;
+  for (std::size_t c = 0; c < configs.size(); ++c) {
+    const Amount top = evaluate_demand(*g, v({0}), v({3}), offered(configs[c], kNoOffer)).call_delivered;
+    ASSERT_GT(top, 2);
+    for (const Amount offer : {Amount {1}, top / 2, top, top + 5}) {
+      const auto o = offered(configs[c], units(offer));
+      const Amount base = evaluate_demand(*g, v({0}), v({3}), o).call_delivered;
+      for (const std::int32_t workers : {1, 2}) {
+        const std::string where = "config " + std::to_string(c) + " offer " + std::to_string(offer) + " workers " +
+                                  std::to_string(workers);
+        SensitivityResult s;
+        ASSERT_EQ(error_of([&] { s = evaluate_edge_failures(*g, v({0}), v({3}), o, workers); }), "") << where;
+        EXPECT_EQ(s.baseline.call_delivered, base) << where;
+        std::vector<Amount> got(static_cast<std::size_t>(g->num_edges()), 0);
+        for (const auto& e : s.entries) got[static_cast<std::size_t>(e.edge)] = e.delivery_reduction;
+        for (EdgeId e = 0; e < g->num_edges(); ++e) {
+          const EdgeId one[1] = {e};
+          const auto mask = g->eligibility({}, one);
+          auto deleted = o;
+          deleted.eligibility = &mask;
+          EXPECT_EQ(got[static_cast<std::size_t>(e)], base - evaluate_demand(*g, v({0}), v({3}), deleted).call_delivered)
+              << where << " edge " << e;
+        }
+        ++checked;
+      }
+    }
+  }
+  EXPECT_EQ(checked, 5 * 4 * 2);
+}
+
+TEST(Evaluators, DefaultWorkersParseTheEnvironment) {
+  const char* names[] = {"NGRAPH_CORE_BATCH_THREADS", "NGRAPH_CORE_SENSITIVITY_THREADS"};
+  std::optional<std::string> saved[2];
+  for (int i = 0; i < 2; ++i) {
+    if (const char* x = std::getenv(names[i])) saved[i] = x;
+  }
+  struct Restore {
+    const char* const* names;
+    std::optional<std::string>* saved;
+    ~Restore() {
+      for (int i = 0; i < 2; ++i) set_env(names[i], saved[i] ? saved[i]->c_str() : nullptr);
+    }
+  } restore {names, saved};
+  const std::vector<std::pair<const char*, std::int32_t>> cases = {
+      {nullptr, 1}, {"1", 1},   {"4", 4},     {"4096", 4096}, {"4097", 1}, {"0", 1},  {"-4", 1},
+      {"abc", 1},   {"4x", 1},  {"4 ", 1},    {" 4", 4},      {"+", 1},    {"99999999999999999999", 1},
+  };
+  for (const bool edge_failures : {false, true}) {
+    const int self = edge_failures ? 1 : 0;
+    for (const auto& [value, want] : cases) {
+      const std::string where =
+          std::string(names[self]) + "=" + (value == nullptr ? "(unset)" : "'" + std::string(value) + "'");
+      set_env(names[self], value);
+      set_env(names[1 - self], "7");  // the other variable never applies
+      EXPECT_EQ(detail::default_workers(edge_failures), want) << where;
+      EXPECT_EQ(detail::default_workers(!edge_failures), 7) << where;
+    }
+  }
+}
+
+// The route choice of ShortestPaths: the single-path order read on the service view
+// at preparation. TRI with the service view 4, 8, 5, 50: the record's route is e0, e2, e1, e0 for
+// FEWER_HOPS, HIGHER_CAPACITY, HIGHER_AVAILABLE_CAPACITY, HIGHER_HEADROOM.
+TEST(RouteChoice, ShortestPathsSinglePath) {
+  const auto g = shared(make_graph(2, {{0, 1, 4, 1}, {0, 1, 10, 1}, {0, 1, 100, 1}, {0, 1, 50, 2}}));
+  for (const auto& [tie, want] : {std::pair {RouteTieBreak::FewerHops, EdgeId {0}},
+                                  std::pair {RouteTieBreak::HigherCapacity, EdgeId {2}},
+                                  std::pair {RouteTieBreak::HigherAvailableCapacity, EdgeId {1}},
+                                  std::pair {RouteTieBreak::HigherHeadroom, EdgeId {0}}}) {
+    FlowLedger fg(g, std::vector<Amount> {4, 8, 5, 50});
+    FlowPolicy p(fg, v({0}), v({1}), cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossless, sel(tie, false)));
+    EXPECT_EQ(p.place(1).call_delivered, 1) << static_cast<int>(tie);
+    ASSERT_EQ(p.records().size(), 1U);
+    EXPECT_EQ(p.records()[0].edge_flows, (std::vector<std::pair<EdgeId, Amount>> {{want, 1}})) << static_cast<int>(tie);
+  }
 }
diff --git a/tests/cpp/flow_state_tests.cpp b/tests/cpp/flow_state_tests.cpp
deleted file mode 100644
index ac9658f..0000000
--- a/tests/cpp/flow_state_tests.cpp
+++ /dev/null
@@ -1,589 +0,0 @@
-#include <gtest/gtest.h>
-#include "netgraph/core/flow_state.hpp"
-#include <limits>
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/constants.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-TEST(FlowState, InitialResidualEqualsCapacity) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-
-  auto residual = fs.residual_view();
-  auto capacity = g.capacity_view();
-
-  for (std::size_t i = 0; i < residual.size(); ++i) {
-    EXPECT_DOUBLE_EQ(residual[i], capacity[i]);
-  }
-}
-
-TEST(FlowState, PlacementReducesResidual) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-
-  // Get shortest path DAG
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  auto initial_residual = fs.residual_view()[0];
-
-  // Place 0.5 units of flow
-  Flow placed = fs.place_on_dag(0, 2, dag, 0.5, FlowPlacement::Proportional);
-
-  EXPECT_GT(placed, 0.0);
-
-  // Residual should be reduced
-  auto new_residual = fs.residual_view()[0];
-  EXPECT_LT(new_residual, initial_residual);
-}
-
-TEST(FlowState, ProportionalDistribution) {
-  // Create graph with two parallel edges of different capacities
-  std::int32_t src[3] = {0, 1, 1};
-  std::int32_t dst[3] = {1, 2, 2};
-  double cap[3] = {10.0, 3.0, 7.0};  // Total 10 capacity B->C
-  std::int64_t cost[3] = {1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  FlowState fs(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Place 10 units (should use both B->C edges proportionally)
-  Flow placed = fs.place_on_dag(0, 2, dag, 10.0, FlowPlacement::Proportional);
-
-  EXPECT_NEAR(placed, 10.0, 1e-9);
-
-  auto flows = fs.edge_flow_view();
-  // First edge (A->B) should have 10
-  EXPECT_NEAR(flows[0], 10.0, 1e-9);
-
-  // Parallel edges should have flow proportional to capacity: 3 and 7
-  EXPECT_NEAR(flows[1], 3.0, 1e-9);
-  EXPECT_NEAR(flows[2], 7.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalancedDistribution) {
-  // Same graph as proportional test
-  std::int32_t src[3] = {0, 1, 1};
-  std::int32_t dst[3] = {1, 2, 2};
-  double cap[3] = {10.0, 3.0, 7.0};
-  std::int64_t cost[3] = {1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  FlowState fs(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Place 6 units with equal-balanced (limited by min capacity * 2 = 6)
-  Flow placed = fs.place_on_dag(0, 2, dag, 10.0, FlowPlacement::EqualBalanced);
-
-  EXPECT_NEAR(placed, 6.0, 1e-9);
-
-  auto flows = fs.edge_flow_view();
-  // Parallel edges should each get 3 (equal split)
-  EXPECT_NEAR(flows[1], 3.0, 1e-9);
-  EXPECT_NEAR(flows[2], 3.0, 1e-9);
-}
-
-TEST(FlowState, ZeroCapacityHandling) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {1};
-  double cap[1] = {0.0};
-  std::int64_t cost[1] = {1};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 1), std::span(dst, 1),
-    std::span(cap, 1), std::span(cost, 1));
-
-  FlowState fs(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;  // Should filter zero capacity
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, fs.residual_view(), {}, {});
-
-  // No path should be found due to zero capacity
-  EXPECT_EQ(dag.parent_offsets[1], dag.parent_offsets[2]);
-}
-
-TEST(FlowState, ApplyDeltasAdditive) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-
-  std::vector<std::pair<EdgeId, Flow>> deltas = {{0, 0.5}, {1, 0.3}};
-
-  auto initial_flow_0 = fs.edge_flow_view()[0];
-  auto initial_residual_0 = fs.residual_view()[0];
-
-  fs.apply_deltas(deltas, true);  // Add
-
-  EXPECT_NEAR(fs.edge_flow_view()[0], initial_flow_0 + 0.5, 1e-9);
-  EXPECT_NEAR(fs.residual_view()[0], initial_residual_0 - 0.5, 1e-9);
-}
-
-TEST(FlowState, ApplyDeltasSubtractive) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-
-  // First add some flow
-  std::vector<std::pair<EdgeId, Flow>> deltas = {{0, 0.5}};
-  fs.apply_deltas(deltas, true);
-
-  auto flow_after_add = fs.edge_flow_view()[0];
-  auto residual_after_add = fs.residual_view()[0];
-
-  // Subtract the same deltas to reverse the operation
-  fs.apply_deltas(deltas, false);
-
-  EXPECT_NEAR(fs.edge_flow_view()[0], flow_after_add - 0.5, 1e-9);
-  EXPECT_NEAR(fs.residual_view()[0], residual_after_add + 0.5, 1e-9);
-}
-
-TEST(FlowState, MinCutComputation) {
-  // Validates min-cut computation on a saturated flow graph.
-  // Square has two paths: 0->1->2 (cap 1, cost 2) and 0->3->2 (cap 2, cost 4).
-  // Max flow is 3.0, and min-cut should separate source from sink with saturated edges.
-  auto g = make_square_graph(1);
-  FlowState fs(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  // Saturate max-flow: iteratively place flow until exhausted
-  Flow total_placed = 0.0;
-  for (int iter = 0; iter < 10; ++iter) {
-    auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, fs.residual_view(), {}, {});
-    // Check if destination is reachable
-    if (dag.parent_offsets[2] == dag.parent_offsets[3]) break; // No path to node 2
-    Flow placed = fs.place_on_dag(0, 2, dag, 10.0, FlowPlacement::Proportional);
-    if (placed < kMinFlow) break;
-    total_placed += placed;
-  }
-
-  // Verify flow was actually placed
-  ASSERT_GT(total_placed, 0.0) << "No flow placed, test setup is broken";
-
-  // Compute min-cut from source
-  auto min_cut = fs.compute_min_cut(0, {}, {});
-
-  // Min-cut must have at least one edge separating source from sink
-  EXPECT_GT(min_cut.edges.size(), 0) << "Min-cut must contain saturated edges";
-
-  // All cut edges should be saturated (residual <= kMinCap)
-  auto residual = fs.residual_view();
-  for (auto eid : min_cut.edges) {
-    EXPECT_LE(residual[eid], kMinCap)
-      << "Cut edge " << eid << " not saturated (residual=" << residual[eid] << ")";
-  }
-
-  // Verify min-cut capacity equals max-flow (by max-flow min-cut theorem)
-  double cut_capacity = 0.0;
-  auto capacity = g.capacity_view();
-  for (auto eid : min_cut.edges) {
-    cut_capacity += capacity[eid];
-  }
-  EXPECT_NEAR(cut_capacity, total_placed, 1e-9)
-    << "Min-cut capacity should equal max-flow by max-flow min-cut theorem";
-}
-
-TEST(FlowState, ResetRestoresCapacity) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-
-  // Place some flow
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-  Flow placed = fs.place_on_dag(0, 2, dag, 0.5, FlowPlacement::Proportional);
-  EXPECT_GT(placed, 0.0);
-
-  EXPECT_GT(fs.edge_flow_view()[0], 0.0);
-
-  // Reset
-  fs.reset();
-
-  // Flow should be zero
-  EXPECT_DOUBLE_EQ(fs.edge_flow_view()[0], 0.0);
-
-  // Residual should equal capacity
-  auto residual = fs.residual_view();
-  auto capacity = g.capacity_view();
-  for (std::size_t i = 0; i < residual.size(); ++i) {
-    EXPECT_DOUBLE_EQ(residual[i], capacity[i]);
-  }
-}
-
-TEST(FlowState, CustomInitialResidual) {
-  auto g = make_line_graph(3);
-
-  // Create custom residual (half capacity)
-  std::vector<Cap> custom_residual(g.num_edges());
-  auto capacity = g.capacity_view();
-  for (std::size_t i = 0; i < custom_residual.size(); ++i) {
-    custom_residual[i] = capacity[i] * 0.5;
-  }
-
-  FlowState fs(g, custom_residual);
-
-  auto residual = fs.residual_view();
-  for (std::size_t i = 0; i < residual.size(); ++i) {
-    EXPECT_DOUBLE_EQ(residual[i], custom_residual[i]);
-  }
-}
-
-TEST(FlowState, InvalidResidualInitThrows) {
-  auto g = make_line_graph(3);
-  // residual_init wrong length
-  std::vector<Cap> bad(static_cast<std::size_t>(g.num_edges() + 1), 1.0);
-  EXPECT_THROW({ FlowState fs_bad(g, bad); (void)fs_bad; }, std::invalid_argument);
-}
-
-TEST(FlowState, ResetWithInvalidResidualThrows) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-  std::vector<Cap> bad(static_cast<std::size_t>(g.num_edges() + 2), 1.0);
-  EXPECT_THROW({ fs.reset(bad); }, std::invalid_argument);
-}
-
-TEST(FlowState, ApplyDeltasClampsWithinCapacityBounds) {
-  auto g = make_line_graph(3);
-  FlowState fs(g);
-  auto cap = g.capacity_view();
-  // Add some flow on edge 0
-  std::vector<std::pair<EdgeId, Flow>> add = {{0, 0.4}};
-  fs.apply_deltas(add, true);
-  // Subtract more than present; implementation should clamp to zero (no negative flows)
-  std::vector<std::pair<EdgeId, Flow>> sub = {{0, 1.0}};
-  fs.apply_deltas(sub, false);
-  EXPECT_GE(fs.edge_flow_view()[0], 0.0);
-  EXPECT_LE(fs.edge_flow_view()[0], cap[0]);
-  EXPECT_NEAR(fs.residual_view()[0], cap[0], 1e-12);
-}
-
-TEST(FlowState, EqualBalancedReconvergentDAGPlacesAll) {
-  // Graph: 0->1->3 and 0->2->3, all caps=1, costs=1
-  std::int32_t src[4] = {0, 1, 0, 2};
-  std::int32_t dst[4] = {1, 3, 2, 3};
-  double cap[4] = {1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost[4] = {1, 1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-  FlowState fs(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 3, /*multipath=*/true, sel, {}, {}, {});
-  Flow placed = fs.place_on_dag(0, 3, dag, std::numeric_limits<double>::infinity(), FlowPlacement::EqualBalanced);
-  EXPECT_NEAR(placed, 2.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalanced_ECMP3_FirstHopEqualization) {
-  // Graph with three equal-cost next-hops: 0->{1,2,3}->{4}, all caps=5, costs=1
-  std::int32_t src[6]  = {0, 0, 0, 1, 2, 3};
-  std::int32_t dst[6]  = {1, 2, 3, 4, 4, 4};
-  double       cap[6]  = {5.0, 5.0, 5.0, 5.0, 5.0, 5.0};
-  std::int64_t cost[6] = {1,   1,   1,   1,   1,   1};
-  auto g = StrictMultiDiGraph::from_arrays(5,
-    std::span(src, 6), std::span(dst, 6),
-    std::span(cap, 6), std::span(cost, 6));
-  FlowState fs(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 4, /*multipath=*/true, sel, {}, {}, {});
-  // Request 3 units; expect 1 on each of the three paths
-  Flow placed = fs.place_on_dag(0, 4, dag, 3.0, FlowPlacement::EqualBalanced);
-  EXPECT_NEAR(placed, 3.0, 1e-9);
-  auto ef = fs.edge_flow_view();
-  // First-hop equalization
-  // Edges 0->1, 0->2, 0->3 are the first three edges by construction
-  EXPECT_NEAR(ef[0], 1.0, 1e-9);
-  EXPECT_NEAR(ef[1], 1.0, 1e-9);
-  EXPECT_NEAR(ef[2], 1.0, 1e-9);
-  // Second hop equalization
-  EXPECT_NEAR(ef[3], 1.0, 1e-9);
-  EXPECT_NEAR(ef[4], 1.0, 1e-9);
-  EXPECT_NEAR(ef[5], 1.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalanced_MinFlowGating_DoesNotPruneValidParallelEdges) {
-  // Validates that EB placement doesn't prune paths where individual edges have
-  // residual < requested flow, but the parallel edge group collectively supports it.
-  // Graph: 0->1 cap 1.2; 1->2 has two parallel edges cap 0.6 each; all costs=1
-  // When placing 1.0, individual edges can't carry 1.0, but group of 2×0.6 can.
-  std::int32_t src[3]  = {0, 1, 1};
-  std::int32_t dst[3]  = {1, 2, 2};
-  double       cap[3]  = {1.2, 0.6, 0.6};
-  std::int64_t cost[3] = {1,   1,   1};
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-  FlowState fs(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 2, /*multipath=*/true, sel, {}, {}, {});
-  // Request 1.0; group capacity is min(1.2, 0.6+0.6) = 1.2, so should place 1.0
-  Flow placed = fs.place_on_dag(0, 2, dag, 1.0, FlowPlacement::EqualBalanced);
-  EXPECT_GE(placed, 1.0 - 1e-9) << "Should place full 1.0 using parallel edge group";
-  auto ef = fs.edge_flow_view();
-  // Parallel edges should split the flow
-  EXPECT_NEAR(ef[1] + ef[2], 1.0, 1e-9) << "Parallel edges should carry the flow";
-}
-
-TEST(FlowState, EqualBalanced_DownstreamSplitEqualization) {
-  // Downstream equalization: 0->1 (cap 10) then 1->{2,3}->4 (each hop cap 5)
-  // Expect 10 placed, split 5 and 5 downstream.
-  std::int32_t src[5]  = {0, 1, 1, 2, 3};
-  std::int32_t dst[5]  = {1, 2, 3, 4, 4};
-  double       cap[5]  = {10.0, 5.0, 5.0, 5.0, 5.0};
-  std::int64_t cost[5] = {1,    1,   1,   1,   1};
-  auto g = StrictMultiDiGraph::from_arrays(5,
-    std::span(src, 5), std::span(dst, 5),
-    std::span(cap, 5), std::span(cost, 5));
-  FlowState fs(g);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 4, /*multipath=*/true, sel, {}, {}, {});
-  Flow placed = fs.place_on_dag(0, 4, dag, 10.0, FlowPlacement::EqualBalanced);
-  EXPECT_NEAR(placed, 10.0, 1e-9);
-  auto ef = fs.edge_flow_view();
-  // First hop carries all 10
-  EXPECT_NEAR(ef[0], 10.0, 1e-9);
-  // Downstream split equalization
-  EXPECT_NEAR(ef[1], 5.0, 1e-9); // 1->2
-  EXPECT_NEAR(ef[2], 5.0, 1e-9); // 1->3
-  EXPECT_NEAR(ef[3], 5.0, 1e-9); // 2->4
-  EXPECT_NEAR(ef[4], 5.0, 1e-9); // 3->4
-}
-
-TEST(FlowState, EqualBalanced_ZeroCapacityOnShortestPath_ReturnsZero) {
-  // With require_capacity=false (true IP/IGP semantics), routing is cost-only.
-  // If the shortest path has a zero-capacity edge, no flow can be placed.
-  // Graph: 0->1 (cap 0, cost 1) -> 2 (cap 10, cost 1)  [shortest path, but no capacity]
-  //        0->3 (cap 100, cost 2) -> 2 (cap 100, cost 2)  [longer path with capacity]
-  std::int32_t src[4]  = {0, 1, 0, 3};
-  std::int32_t dst[4]  = {1, 2, 3, 2};
-  double       cap[4]  = {0.0, 10.0, 100.0, 100.0};  // 0->1 has zero capacity!
-  std::int64_t cost[4] = {1,   1,    2,     2};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-  FlowState fs(g);
-
-  // Build DAG with require_capacity=false (cost-only routing, ignores capacity).
-  // This simulates true IP/IGP behavior where routes are based purely on cost.
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 2, /*multipath=*/true, sel, {}, {}, {});
-
-  // Verify SPF found a path (the zero-capacity one is included in the DAG).
-  // The shortest path 0->1->2 has cost 2, while 0->3->2 has cost 4.
-  EXPECT_LT(dist[2], std::numeric_limits<Cost>::max());
-
-  // Attempt EqualBalanced placement. Since the shortest path has no capacity,
-  // and we're in single-tier mode (simulated by only having one DAG),
-  // placement should return 0.
-  Flow placed = fs.place_on_dag(0, 2, dag, std::numeric_limits<double>::infinity(), FlowPlacement::EqualBalanced);
-  EXPECT_NEAR(placed, 0.0, 1e-9) << "EqualBalanced should return 0 when shortest path has no capacity";
-
-  // Verify no edge flows were placed
-  auto ef = fs.edge_flow_view();
-  for (std::size_t i = 0; i < static_cast<std::size_t>(g.num_edges()); ++i) {
-    EXPECT_NEAR(ef[i], 0.0, 1e-9) << "Edge " << i << " should have no flow";
-  }
-}
-
-TEST(FlowState, Proportional_ZeroCapacityOnShortestPath_ReturnsZero) {
-  // With require_capacity=false, if the shortest path has a zero-capacity edge,
-  // no flow can be placed. Both placements behave consistently.
-  std::int32_t src[4]  = {0, 1, 0, 3};
-  std::int32_t dst[4]  = {1, 2, 3, 2};
-  double       cap[4]  = {0.0, 10.0, 100.0, 100.0};
-  std::int64_t cost[4] = {1,   1,    2,     2};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-  FlowState fs(g);
-
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 2, /*multipath=*/true, sel, {}, {}, {});
-
-  Flow placed = fs.place_on_dag(0, 2, dag, std::numeric_limits<double>::infinity(), FlowPlacement::Proportional);
-  EXPECT_NEAR(placed, 0.0, 1e-9) << "Proportional should return 0 when shortest path has no capacity";
-}
-
-TEST(FlowState, RepeatedPlacementAfterResetAndIndependentInstancesStayStable) {
-  // Exercise the per-instance workspace reuse path:
-  // 1. repeated placement on one FlowState after reset must be identical
-  // 2. a second FlowState must remain unaffected by the first instance
-  std::int32_t src[5]  = {0, 1, 1, 2, 3};
-  std::int32_t dst[5]  = {1, 2, 3, 4, 4};
-  double       cap[5]  = {10.0, 5.0, 5.0, 5.0, 5.0};
-  std::int64_t cost[5] = {1,    1,   1,   1,   1};
-  auto g = StrictMultiDiGraph::from_arrays(5,
-    std::span(src, 5), std::span(dst, 5),
-    std::span(cap, 5), std::span(cost, 5));
-
-  FlowState fs1(g);
-  FlowState fs2(g);
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 4, /*multipath=*/true, sel, {}, {}, {});
-
-  Flow placed_first = fs1.place_on_dag(0, 4, dag, 10.0, FlowPlacement::EqualBalanced);
-  std::vector<Flow> first_flows(fs1.edge_flow_view().begin(), fs1.edge_flow_view().end());
-  EXPECT_NEAR(placed_first, 10.0, 1e-9);
-
-  for (auto flow : fs2.edge_flow_view()) {
-    EXPECT_NEAR(flow, 0.0, 1e-12);
-  }
-
-  fs1.reset();
-  Flow placed_second = fs1.place_on_dag(0, 4, dag, 10.0, FlowPlacement::EqualBalanced);
-  EXPECT_NEAR(placed_second, placed_first, 1e-9);
-  for (std::size_t i = 0; i < first_flows.size(); ++i) {
-    EXPECT_NEAR(fs1.edge_flow_view()[i], first_flows[i], 1e-9);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// EqualBalanced / EqualBalancedLossy: load-blind hash-ECMP models.
-// ---------------------------------------------------------------------------
-#include "netgraph/core/flow_graph.hpp"
-
-namespace {
-// 0 -> 1 over two parallel equal-cost edges: edge 0 cap 10, edge 1 cap 100.
-StrictMultiDiGraph make_unbalanced_pair() {
-  std::int32_t src[2]  = {0, 0};
-  std::int32_t dst[2]  = {1, 1};
-  double       cap[2]  = {10.0, 100.0};
-  std::int64_t cost[2] = {1, 1};
-  return StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 2), std::span(dst, 2), std::span(cap, 2), std::span(cost, 2));
-}
-PredDAG cost_only_dag(const StrictMultiDiGraph& g, NodeId s, NodeId t) {
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, s, t, /*multipath=*/true, sel, {}, {}, {});
-  return dag;
-}
-} // namespace
-
-TEST(FlowState, EqualBalanced_SaturatedMemberBlocksAdmission) {
-  auto g = make_unbalanced_pair();
-  auto dag = cost_only_dag(g, 0, 1);
-
-  FlowState fs(g);
-  EXPECT_NEAR(fs.place_on_dag(0, 1, dag, 20.0, FlowPlacement::EqualBalanced), 20.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[0], 10.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[1], 10.0, 1e-9);
-  // The 10-unit member is full; equal hashing of any further demand would lose
-  // half of it, so nothing more is admitted losslessly on this DAG.
-  EXPECT_NEAR(fs.place_on_dag(0, 1, dag, 10.0, FlowPlacement::EqualBalanced), 0.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[1], 10.0, 1e-9) << "no flow may leak onto the remaining member";
-}
-
-TEST(FlowState, EqualBalanced_ProgressesOnlyThroughResidualAwareSpf) {
-  // On a fresh residual-aware DAG the full member is gone and placement continues.
-  auto g = make_unbalanced_pair();
-  FlowState fs(g);
-  EXPECT_NEAR(fs.place_on_dag(0, 1, cost_only_dag(g, 0, 1), 20.0, FlowPlacement::EqualBalanced), 20.0, 1e-9);
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = true; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 1, /*multipath=*/true, sel, fs.residual_view(), {}, {});
-  EXPECT_NEAR(fs.place_on_dag(0, 1, dag, 10.0, FlowPlacement::EqualBalanced), 10.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[1], 20.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalancedLossy_FillAndDropReportsDrops) {
-  auto g = make_unbalanced_pair();
-  auto dag = cost_only_dag(g, 0, 1);
-  FlowState fs(g);
-  std::vector<std::pair<EdgeId, Flow>> trace, drops;
-  Flow placed = fs.place_on_dag(0, 1, dag, 100.0, FlowPlacement::EqualBalancedLossy, &trace, &drops);
-  EXPECT_NEAR(placed, 60.0, 1e-9) << "50 on the 100-unit edge, 10 on the 10-unit edge";
-  EXPECT_NEAR(fs.edge_flow_view()[0], 10.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[1], 50.0, 1e-9);
-  ASSERT_EQ(drops.size(), 1u);
-  EXPECT_EQ(drops[0].first, 0);
-  EXPECT_NEAR(drops[0].second, 40.0, 1e-9);
-  double traced = 0.0; for (auto const& pr : trace) traced += pr.second;
-  EXPECT_NEAR(traced, 60.0, 1e-9) << "the trace records carried volume only";
-
-  // A later demand still hashes half onto the saturated member and loses it.
-  drops.clear();
-  EXPECT_NEAR(fs.place_on_dag(0, 1, dag, 10.0, FlowPlacement::EqualBalancedLossy, nullptr, &drops), 5.0, 1e-9);
-  ASSERT_EQ(drops.size(), 1u);
-  EXPECT_NEAR(drops[0].second, 5.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalancedLossy_DeficitPropagatesDownstream) {
-  // 0 -> 1 over edges cap 10 / 100 (cost 1 each), then 1 -> 2 cap 30 (cost 1).
-  std::int32_t src[3]  = {0, 0, 1};
-  std::int32_t dst[3]  = {1, 1, 2};
-  double       cap[3]  = {10.0, 100.0, 30.0};
-  std::int64_t cost[3] = {1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3), std::span(cap, 3), std::span(cost, 3));
-  auto dag = cost_only_dag(g, 0, 2);
-  FlowState fs(g);
-  std::vector<std::pair<EdgeId, Flow>> drops;
-  Flow placed = fs.place_on_dag(0, 2, dag, 100.0, FlowPlacement::EqualBalancedLossy, nullptr, &drops);
-  // Node 1 receives 60 (40 dropped upstream) and forwards 30 (30 dropped on 1->2).
-  EXPECT_NEAR(placed, 30.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[2], 30.0, 1e-9);
-  double total_dropped = 0.0; for (auto const& pr : drops) total_dropped += pr.second;
-  EXPECT_NEAR(total_dropped, 70.0, 1e-9);
-}
-
-TEST(FlowState, EqualBalancedLossy_InfiniteRequestFillsWithoutDrops) {
-  auto g = make_unbalanced_pair();
-  auto dag = cost_only_dag(g, 0, 1);
-  FlowState fs(g);
-  std::vector<std::pair<EdgeId, Flow>> drops;
-  Flow placed = fs.place_on_dag(0, 1, dag, std::numeric_limits<double>::infinity(),
-                                FlowPlacement::EqualBalancedLossy, nullptr, &drops);
-  EXPECT_NEAR(placed, 110.0, 1e-9);
-  EXPECT_TRUE(drops.empty()) << "drops are undefined for an infinite offered load";
-}
-
-TEST(FlowGraph, LossyPlacementIsReversibleAndDropsStayOutOfLedger) {
-  auto g = make_unbalanced_pair();
-  auto dag = cost_only_dag(g, 0, 1);
-  FlowGraph fg(g);
-  FlowIndex idx{0, 1, 0, 7};
-  std::vector<std::pair<EdgeId, Flow>> drops;
-  EXPECT_NEAR(fg.place(idx, 0, 1, dag, 100.0, FlowPlacement::EqualBalancedLossy, &drops), 60.0, 1e-9);
-  ASSERT_EQ(drops.size(), 1u);
-  double ledger = 0.0; for (auto const& pr : fg.get_flow_edges(idx)) ledger += pr.second;
-  EXPECT_NEAR(ledger, 60.0, 1e-9) << "only carried volume is in the ledger";
-  fg.remove(idx);
-  EXPECT_NEAR(fg.residual_view()[0], 10.0, 1e-9);
-  EXPECT_NEAR(fg.residual_view()[1], 100.0, 1e-9);
-  // Non-lossy placements never touch the collector.
-  drops.clear();
-  EXPECT_NEAR(fg.place(idx, 0, 1, dag, 20.0, FlowPlacement::EqualBalanced, &drops), 20.0, 1e-9);
-  EXPECT_TRUE(drops.empty());
-}
diff --git a/tests/cpp/graph_concurrency_tests.cpp b/tests/cpp/graph_concurrency_tests.cpp
new file mode 100644
index 0000000..e1b4e11
--- /dev/null
+++ b/tests/cpp/graph_concurrency_tests.cpp
@@ -0,0 +1,242 @@
+// The graph under concurrency, run in the ThreadSanitizer suite:
+// independent constructions at the same time (no shared hash or counting scratch; distinct uids
+// from the one counter), and full forward and reverse searches through both queues on one
+// published immutable graph and on its copy, each thread with its own options, compared with a
+// serial reference; every array of the graph is unchanged after. One batch path builds its own
+// reverse support in its workers (no prepopulated frozen cache), so the reverse-source copy is read
+// by worker threads. One PredecessorDAG and one Path are read by every thread. The tests' own threads
+// start their work together once all of them run (a start latch), so the calls overlap as far as
+// the scheduler allows; ThreadSanitizer reports a race between unordered accesses whether or not
+// they happened to overlap in time.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <latch>
+#include <optional>
+#include <random>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "graph_inputs.hpp"
+#include "graph_reference.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// m random edges of 1 to 4 units (no zero capacity).
+Input random_input(std::int32_t n, std::size_t m, Cost max_edge_cost, std::uint64_t seed) {
+  return test::random_input("", n, m, max_edge_cost, seed, 1, 4);
+}
+
+} // namespace
+
+TEST(GraphConcurrency, IndependentConstructionsAtTheSameTime) {
+  constexpr int kThreads = 8;
+  std::vector<Input> inputs;
+  for (int t = 0; t < kThreads; ++t) {
+    // Alternate the hash path and the fallback (K > 65,536) across threads.
+    inputs.push_back(t % 2 == 0 ? random_input(2000, 20000, 31, static_cast<std::uint64_t>(t))
+                                : random_input(4096, 70000, Cost{1} << 40, static_cast<std::uint64_t>(t)));
+    if (t % 2 == 0) {
+      ASSERT_LE(distinct(inputs.back().cost), 65536) << t;
+    } else {
+      ASSERT_GT(distinct(inputs.back().cost), 65536) << t;
+    }
+  }
+  std::vector<std::vector<std::int32_t>> got(kThreads), got_rev(kThreads);
+  std::vector<std::uint64_t> uids(kThreads);
+  std::vector<std::thread> threads;
+  std::latch start(kThreads);  // the threads start together, once all of them are running
+  for (int t = 0; t < kThreads; ++t) {
+    threads.emplace_back([&, t] {
+      const auto& in = inputs[static_cast<std::size_t>(t)];
+      start.arrive_and_wait();
+      const Graph g = build(in);
+      got[static_cast<std::size_t>(t)].assign(g.input_positions().begin(), g.input_positions().end());
+      got_rev[static_cast<std::size_t>(t)].assign(g.incoming_edges().begin(), g.incoming_edges().end());
+      uids[static_cast<std::size_t>(t)] = g.uid();
+    });
+  }
+  for (auto& th : threads) th.join();
+  // One process-wide uid counter: the graphs of different threads never share a uid, even after
+  // their threads have destroyed them.
+  std::sort(uids.begin(), uids.end());
+  EXPECT_GT(uids.front(), 0U);
+  EXPECT_EQ(std::adjacent_find(uids.begin(), uids.end()), uids.end());
+  for (int t = 0; t < kThreads; ++t) {
+    const auto& in = inputs[static_cast<std::size_t>(t)];
+    const auto r = reference_graph(in.n, in.src, in.dst, in.cap, in.cost, 1.0);
+    EXPECT_EQ(got[static_cast<std::size_t>(t)], r.input_positions) << t;
+    EXPECT_EQ(got_rev[static_cast<std::size_t>(t)], r.incoming_edges) << t;
+  }
+}
+
+TEST(GraphConcurrency, SharedGraphSearchesBothDirectionsBothQueues) {
+  const auto in = random_input(3000, 30000, 20, 99);
+  const Graph g = build(in);
+  const Graph copy(g);
+  const auto before = arrays_of(g);
+  struct Job {
+    const Graph* graph;
+    Direction direction;
+    SpfQueue queue;
+    NodeId root;
+  };
+  std::vector<Job> jobs;
+  for (const Graph* x : {&g, &copy}) {
+    for (Direction d : {Direction::Forward, Direction::Reverse}) {
+      for (SpfQueue q : {SpfQueue::Auto, SpfQueue::Heap}) {
+        for (NodeId r : {0, 17, 2999}) jobs.push_back({x, d, q, r});
+      }
+    }
+  }
+  auto run = [](const Job& j) {
+    const std::vector<NodeId> roots {j.root};
+    // A full search keeping every tight edge (multipath, every parallel member).
+    const SpfOptions o(j.direction);
+    return spf(*j.graph, roots, o, j.queue);
+  };
+  std::vector<SpfResult> serial;
+  for (const auto& j : jobs) serial.push_back(run(j));
+  // Not vacuous: every search reaches beyond its root.
+  for (std::size_t i = 0; i < jobs.size(); ++i) EXPECT_FALSE(serial[i].dag.via_edges().empty()) << i;
+  std::vector<std::optional<SpfResult>> parallel(jobs.size());
+  std::vector<std::thread> threads;
+  // The searches start together, once all threads run.
+  std::latch start(static_cast<std::ptrdiff_t>(jobs.size()));
+  for (std::size_t i = 0; i < jobs.size(); ++i) {
+    threads.emplace_back([&, i] {
+      start.arrive_and_wait();
+      parallel[i] = run(jobs[i]);
+    });
+  }
+  for (auto& th : threads) th.join();
+  for (std::size_t i = 0; i < jobs.size(); ++i) {
+    ASSERT_TRUE(parallel[i].has_value());
+    EXPECT_EQ(parallel[i]->costs, serial[i].costs) << i;
+    EXPECT_TRUE(parallel[i]->dag == serial[i].dag) << i;
+  }
+  EXPECT_TRUE(arrays_of(g) == before);
+  EXPECT_TRUE(arrays_of(copy) == before);
+}
+
+// The immutable route values shared by threads: every thread reads every member of one PredecessorDAG
+// (its sparse storage and its ascending edge list too, through the internal read access) and of
+// one Path (its DAG included) 20 times, and compares each read with the values read before the
+// threads started (the DAG also with a copy taken then). ThreadSanitizer reports any write racing
+// with these reads (a lazily cached member, for example).
+TEST(GraphConcurrency, SharedRouteValuesAreReadByEveryThread) {
+  const auto in = random_input(200, 2000, 9, 7);
+  const Graph g = build(in);
+  const std::vector<NodeId> roots {0};
+  const auto search = spf(g, roots, SpfOptions(Direction::Forward));
+  const PredecessorDAG& dag = search.dag;
+  const PredecessorDAG dag_before = dag;
+  ASSERT_FALSE(dag.via_edges().empty());
+  // A walk of single-member hops from the root: the first entry of each node, followed back.
+  NodeId v = static_cast<NodeId>(g.edge_destinations()[static_cast<std::size_t>(dag.via_edges().back())]);
+  std::vector<std::vector<EdgeId>> hops;
+  const auto offsets = dag.parent_offsets();
+  while (v != 0) {
+    const auto k = static_cast<std::size_t>(offsets[static_cast<std::size_t>(v)]);
+    hops.insert(hops.begin(), std::vector<EdgeId> {dag.via_edges()[k]});
+    v = dag.parents()[k];
+  }
+  ASSERT_FALSE(hops.empty());
+  const Path path(g, hops);
+  using Builder = detail::PredecessorDAGBuilder;
+  struct Read {
+    std::uint64_t graph_uid;
+    std::vector<std::int32_t> offsets;
+    std::vector<NodeId> parents;
+    std::vector<EdgeId> via;
+    std::vector<NodeId> member_nodes;
+    std::vector<std::int32_t> member_offsets;
+    std::vector<EdgeId> ascending;
+    std::uint64_t path_graph_uid;
+    std::vector<std::vector<EdgeId>> hops;
+    NodeId src;
+    NodeId dst;
+    Cost cost;
+    bool dag_equal;
+    bool path_dag_equal;
+    bool operator==(const Read&) const = default;
+  };
+  const PredecessorDAG path_dag = path.to_dag();
+  auto read = [&] {
+    const auto nodes = Builder::member_nodes(dag);
+    const auto node_offsets = Builder::member_offsets(dag);
+    const auto ascending = Builder::ascending(dag);
+    return Read {dag.graph_uid(),
+                 dag.parent_offsets(),
+                 {dag.parents().begin(), dag.parents().end()},
+                 {dag.via_edges().begin(), dag.via_edges().end()},
+                 {nodes.begin(), nodes.end()},
+                 {node_offsets.begin(), node_offsets.end()},
+                 {ascending.begin(), ascending.end()},
+                 path.graph_uid(),
+                 path.hops(),
+                 path.source(),
+                 path.destination(),
+                 path.cost(),
+                 dag == dag_before,
+                 path.to_dag() == path_dag};
+  };
+  const Read serial = read();
+  EXPECT_TRUE(serial.dag_equal && serial.path_dag_equal);
+  constexpr int kThreads = 8;
+  constexpr int kRounds = 20;
+  std::vector<int> wrong(kThreads, 0);  // per thread, the reads that differ from the serial one
+  std::latch start(kThreads);
+  std::vector<std::thread> threads;
+  for (int t = 0; t < kThreads; ++t) {
+    threads.emplace_back([&, t] {
+      start.arrive_and_wait();
+      for (int i = 0; i < kRounds; ++i) {
+        if (!(read() == serial)) ++wrong[static_cast<std::size_t>(t)];
+      }
+    });
+  }
+  for (auto& th : threads) th.join();
+  for (int t = 0; t < kThreads; ++t) EXPECT_EQ(wrong[static_cast<std::size_t>(t)], 0) << t;
+}
+
+// Workers of evaluate_pairs without a supplied cache each build their own reverse static support
+// (the ShortestPaths policy's DAG toward the destinations) on the shared graph.
+TEST(GraphConcurrency, BatchWorkersBuildTheirOwnReverseSupport) {
+  const auto in = random_input(400, 4000, 9, 5);
+  const Graph g = build(in);
+  const auto before = arrays_of(g);
+  std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs;
+  for (NodeId s = 0; s < 32; ++s) pairs.push_back({{s}, {static_cast<NodeId>(399 - s)}});
+  // ShortestPaths routing: each policy's DAG is the reverse static support toward its destination.
+  // Every output is requested, so the per-edge flows and the residuals are compared too.
+  const EvaluationOptions opts {shortest_paths_config(), nullptr, nullptr, OutputOptions {true, true, true}};
+  const auto serial = evaluate_pairs(g, pairs, opts, {}, 1);
+  const auto parallel = evaluate_pairs(g, pairs, opts, {}, 4);
+  ASSERT_EQ(serial.size(), pairs.size());
+  ASSERT_EQ(parallel.size(), pairs.size());
+  int placing = 0;
+  for (std::size_t i = 0; i < serial.size(); ++i) {
+    ASSERT_TRUE(serial[i].edge_flows.has_value() && parallel[i].edge_flows.has_value()) << i;
+    ASSERT_TRUE(serial[i].residual.has_value() && parallel[i].residual.has_value()) << i;
+    EXPECT_EQ(serial[i].call_delivered, parallel[i].call_delivered) << i;
+    EXPECT_EQ(serial[i].edge_flows, parallel[i].edge_flows) << i;
+    EXPECT_EQ(serial[i].residual, parallel[i].residual) << i;
+    EXPECT_EQ(serial[i].saturated_boundary_edges, parallel[i].saturated_boundary_edges) << i;
+    placing += serial[i].call_delivered > 0 ? 1 : 0;
+  }
+  EXPECT_GT(placing, 16);  // not vacuous: most pairs place something
+  EXPECT_TRUE(arrays_of(g) == before);
+}
diff --git a/tests/cpp/graph_fault_tests.cpp b/tests/cpp/graph_fault_tests.cpp
new file mode 100644
index 0000000..f0ef83c
--- /dev/null
+++ b/tests/cpp/graph_fault_tests.cpp
@@ -0,0 +1,236 @@
+// Allocation-failure atomicity of the graph's construction and copy, the allocation-free move,
+// and the calls that build a new Eligibility, PredecessorDAG or Path from const inputs. Runs in the
+// fault-injection executable (fault_injection.hpp), whose
+// replacement operator new fails the chosen allocation and counts the live allocations
+// (g_live, in fault_injection.cpp's replacement functions).
+//
+// Every allocation of every selected construction path fails once: the constructor raises
+// std::bad_alloc and constructs nothing, no allocation stays live (leaks are counted, not left to
+// ASan, whose leak detection is off on macOS), and a clean retry, like the construction without a
+// failure, gives the reference arrays and passes the complete layout checker. The inputs are built for these paths
+// (graph_inputs.hpp): an empty graph, isolated nodes, the hash path from creation through growth
+// and collisions, the K-limit transition into the fallback, the probe-budget fallbacks during
+// collection and during a table growth; and the copy constructor. Each factory call (the
+// Eligibility of a graph and of an intersection, PredecessorDAG::from_csr and parent_offsets, a Path and
+// its PredecessorDAG) fails at every allocation without building anything or leaking, and the completing
+// call equals the reference.
+// No branch counter is read here: graph_layout_tests.cpp observes the probe-budget paths of the
+// same shapes.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdlib>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "fault_injection.hpp"
+#include "graph_inputs.hpp"
+#include "graph_reference.hpp"
+#include "layout_checker.hpp"
+#include "netgraph/core/detail/graph_access.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+std::vector<Input> paths() {
+  return {Input {"empty", 0},
+          Input {"isolated", 64},
+          exact_k_strided(1, 10, 4),
+          exact_k_strided(31, 200, 16),
+          exact_k_strided(500, 100, 32),  // table growths
+          colliding(40),
+          exact_k_strided(65537, 50, 4096),  // the K-limit transition, then repeats
+          budget_shape("budget exhausted in collection", 10000, false),
+          budget_shape("budget exhausted in growth", 9380, true)};
+}
+
+void expect_built(const Graph& g, const Input& in, const std::string& where) {
+  const auto r = reference_graph(in.n, in.src, in.dst, in.cap, in.cost, 1.0);
+  EXPECT_EQ(std::vector<std::int32_t>(g.input_positions().begin(), g.input_positions().end()), r.input_positions) << where;
+  EXPECT_EQ(std::vector<EdgeId>(g.incoming_edges().begin(), g.incoming_edges().end()), r.incoming_edges)
+      << where;
+  const auto bad = check_layout(spans_of(g), view(in));
+  EXPECT_TRUE(bad.empty()) << where << ": " << (bad.empty() ? "" : bad.front());
+}
+
+} // namespace
+
+TEST(GraphFaults, EveryConstructionAllocationFailsCleanly) {
+  for (const auto& in : paths()) {
+    long k = 0;
+    for (;; ++k) {
+      std::optional<Graph> g;
+      const long live = g_live.load();
+      const bool failed = fails_at(k, [&] { g.emplace(in.n, in.src, in.dst, in.cap, in.cost, 1.0); });
+      if (!failed) {
+        expect_built(*g, in, in.name + " without a failure");
+        // The graph holds its retained arrays and nothing else: nine with edges, the two offset
+        // arrays without (counted by the allocator, not by the graph's own list of its arrays).
+        const long held = g_live.load() - live;
+        EXPECT_EQ(held, in.src.empty() ? 2 : 9) << in.name << ": allocations the graph holds";
+        // With edges every retained array is allocated, so the graph's own list of its arrays
+        // (detail::GraphAccess::retained, which the payload checks of graph_layout_tests.cpp
+        // read) must name every allocation it holds.
+        if (!in.src.empty()) {
+          EXPECT_EQ(static_cast<long>(detail::GraphAccess::retained(*g).arrays), held)
+              << in.name << ": an array left off the list";
+        }
+        break;
+      }
+      EXPECT_FALSE(g.has_value()) << in.name << " allocation " << k;
+      EXPECT_EQ(g_live.load(), live) << in.name << " allocation " << k << ": a leak";
+      const Graph retry = build(in);
+      expect_built(retry, in, in.name + " retry after allocation " + std::to_string(k));
+    }
+    // The allocation count of each path is recorded as a test property.
+    RecordProperty(in.name + " allocations", static_cast<int>(k));
+    // An edgeless graph allocates its two offset arrays only; with edges, the nine retained
+    // arrays at least.
+    if (in.src.empty()) {
+      EXPECT_EQ(k, 2) << in.name;
+    } else {
+      EXPECT_GE(k, 9) << in.name;
+    }
+  }
+}
+
+TEST(GraphFaults, EveryCopyAllocationFailsCleanly) {
+  for (const auto& in : paths()) {
+    const Graph g = build(in);
+    long k = 0;
+    for (;; ++k) {
+      std::optional<Graph> c;
+      const long live = g_live.load();
+      const bool failed = fails_at(k, [&] { c.emplace(g); });
+      if (!failed) {
+        expect_built(*c, in, in.name + " copy without a failure");
+        EXPECT_EQ(g_live.load() - live, in.src.empty() ? 2 : 9) << in.name << ": allocations the copy holds";
+        EXPECT_NE(c->uid(), g.uid());
+        break;
+      }
+      EXPECT_FALSE(c.has_value()) << in.name << " allocation " << k;
+      EXPECT_EQ(g_live.load(), live) << in.name << " allocation " << k << ": a leak";
+      const Graph retry(g);
+      expect_built(retry, in, in.name + " copy retry");
+      EXPECT_NE(retry.uid(), g.uid());
+    }
+    // k allocations failed before the copy succeeded: as in the construction sweep, the two offset
+    // arrays of an edgeless graph, at least the nine retained arrays with edges.
+    if (in.src.empty()) {
+      EXPECT_EQ(k, 2) << in.name;
+    } else {
+      EXPECT_GE(k, 9) << in.name;
+    }
+  }
+}
+
+// The declared noexcept move allocates nothing. The armed injection fails the first allocation
+// anywhere in the child: an allocating move would throw inside noexcept and terminate the child,
+// which the parent reports as a failure (death-test subprocess, so the suite survives).
+TEST(GraphFaults, MoveIsAllocationFreeUnderAnArmedFailure) {
+  GTEST_FLAG_SET(death_test_style, "threadsafe");
+  const auto in = exact_k_strided(31, 200, 16);
+  EXPECT_EXIT(
+      {
+        Graph g = build(in);
+        const auto uid = g.uid();
+        const auto edges = g.num_edges();
+        const long live = g_live.load();
+        g_countdown = 0;  // the next allocation, in any thread, throws
+        Graph m(std::move(g));
+        const bool untouched = g_countdown.load() == 0;  // no allocation was attempted
+        g_countdown = -1;
+        const bool ok = untouched && g_live.load() == live && m.uid() == uid && m.num_edges() == edges &&
+                        g.num_edges() == 0 && g.outgoing_offsets().size() == 1 &&  // NOLINT(bugprone-use-after-move)
+                        g.resolution() == m.resolution();
+        std::_Exit(ok ? 0 : 3);
+      },
+      ::testing::ExitedWithCode(0), "");
+}
+
+namespace {
+
+// Every allocation of make() fails once: nothing is built and nothing stays allocated; the
+// completing call equals the reference (the first call, which also sizes any per-thread scratch).
+template <class T, class Make, class Same>
+void sweep_factory(const std::string& name, Make make, Same same) {
+  const T want = make();
+  long k = 0;
+  for (;; ++k) {
+    std::optional<T> got;
+    const long live = g_live.load();
+    if (!fails_at(k, [&] { got.emplace(make()); })) {
+      ASSERT_TRUE(got.has_value()) << name;
+      EXPECT_TRUE(same(*got, want)) << name;
+      break;
+    }
+    EXPECT_FALSE(got.has_value()) << name << " allocation " << k;
+    EXPECT_EQ(g_live.load(), live) << name << " allocation " << k << ": a leak";
+  }
+  EXPECT_GT(k, 0) << name;  // not vacuous: every factory allocates
+}
+
+} // namespace
+
+TEST(GraphFaults, EveryFactoryAllocationFailsWithoutALeak) {
+  // 0 -> 1 -> 2 -> 3 with a parallel pair 1 -> 2 and a bypass 0 -> 3.
+  const std::vector<NodeId> src = {0, 1, 1, 2, 0};
+  const std::vector<NodeId> dst = {1, 2, 2, 3, 3};
+  const std::vector<Amount> cap = {5, 5, 3, 5, 1};
+  const std::vector<Cost> cost = {1, 1, 2, 1, 9};
+  const Graph g(4, src, dst, cap, cost, 1.0);
+  const auto edge = [&](NodeId u, NodeId v, Cost c) {
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      const auto i = static_cast<std::size_t>(e);
+      if (g.edge_sources()[i] == u && g.edge_destinations()[i] == v && g.edge_costs()[i] == c) return e;
+    }
+    ADD_FAILURE() << "no edge " << u << " -> " << v;
+    return EdgeId {0};
+  };
+  const EdgeId bypass[] = {edge(0, 3, 9)};
+  const EdgeId costly[] = {edge(1, 2, 2)};
+  const NodeId none[] = {0};
+  const auto same_elig = [](const Eligibility& a, const Eligibility& b) {
+    return std::ranges::equal(a.node_allowed(), b.node_allowed()) && std::ranges::equal(a.edge_allowed(), b.edge_allowed());
+  };
+  // Controls: an isolated node changes only the node flags; an edge changes only edge flags.
+  const auto isolated = make_graph(3, {{0, 1, 1, 1}});
+  const auto all = isolated.eligibility();
+  EXPECT_TRUE(same_elig(all, all));
+  EXPECT_FALSE(same_elig(all, isolated.eligibility(std::vector<NodeId> {2}, {})));
+  EXPECT_FALSE(same_elig(all, isolated.eligibility({}, std::vector<EdgeId> {0})));
+  sweep_factory<Eligibility>("Graph::eligibility", [&] { return g.eligibility(none, bypass); }, same_elig);
+  const Eligibility no_bypass = g.eligibility({}, bypass);
+  const Eligibility no_costly = g.eligibility({}, costly);
+  sweep_factory<Eligibility>("Eligibility::intersect", [&] { return Eligibility::intersect(no_bypass, no_costly); },
+                             same_elig);
+  const std::vector<std::vector<EdgeId>> hops = {{edge(0, 1, 1)}, {edge(1, 2, 1), edge(1, 2, 2)}, {edge(2, 3, 1)}};
+  const auto same = [](const auto& a, const auto& b) { return a == b; };
+  sweep_factory<Path>("Path", [&] { return Path(g, hops); }, same);
+  const Path path(g, hops);
+  sweep_factory<PredecessorDAG>("Path::to_dag", [&] { return path.to_dag(); }, same);
+  const PredecessorDAG dag = path.to_dag();
+  sweep_factory<std::vector<std::int32_t>>("PredecessorDAG::parent_offsets", [&] { return dag.parent_offsets(); }, same);
+  const auto offsets = dag.parent_offsets();
+  sweep_factory<PredecessorDAG>("PredecessorDAG::from_csr", [&] { return PredecessorDAG::from_csr(g, offsets, dag.parents(), dag.via_edges()); },
+                         same);
+}
+
+TEST(GraphFaults, ConstructionComparisonRejectsDifferentInputs) {
+  const Input in {"comparison", 4, {0, 1, 0, 2}, {1, 3, 2, 3}, {2, 3, 4, 5}, {2, 4, 6, 8}};
+  const auto g = build(in);
+  EXPECT_EQ(failures_of([&] { expect_built(g, in, "same"); }), 0);
+  for (int kind = 0; kind < 3; ++kind) {
+    auto bad = in;
+    if (kind == 0) std::swap(bad.cost[0], bad.cost[2]);
+    if (kind == 1) bad.dst[3] = 0;
+    if (kind == 2) ++bad.cap.back();
+    EXPECT_GT(failures_of([&] { expect_built(g, bad, "different"); }), 0) << kind;
+  }
+}
diff --git a/tests/cpp/graph_inputs.hpp b/tests/cpp/graph_inputs.hpp
new file mode 100644
index 0000000..810da34
--- /dev/null
+++ b/tests/cpp/graph_inputs.hpp
@@ -0,0 +1,166 @@
+// The graph inputs of the three graph test files (graph_layout_tests.cpp, graph_fault_tests.cpp,
+// graph_concurrency_tests.cpp): one input in input coordinates, its graph and its view for the
+// layout checker, its count of distinct costs, and its generators. Each generator
+// is deterministic (seeded or closed-form), so a test file and its readers see the same inputs on
+// every run. random_input draws general inputs; each other generator is built for the construction
+// path named at it (hash table, growths, collisions, the K-limit and probe-budget fallbacks). The
+// branch counters of graph_layout_tests.cpp (hooks builds) are read on exact_k's boundary inputs,
+// budget_shape's clusters, a colliding_costs sequence that grows the table, and random_input's
+// inputs (whether the fused path ran).
+#pragma once
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <random>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "layout_checker.hpp"
+#include "netgraph/core/detail/graph_access.hpp"
+#include "netgraph/core/graph.hpp"
+
+namespace netgraph::core::test {
+
+// A graph input as the constructor takes it.
+struct Input {
+  std::string name;
+  std::int32_t n {0};
+  std::vector<NodeId> src {}, dst {};
+  std::vector<Amount> cap {};
+  std::vector<Cost> cost {};
+  double q {1.0};
+};
+
+// The graph of an input, at its resolution.
+inline Graph build(const Input& in) { return Graph(in.n, in.src, in.dst, in.cap, in.cost, in.q); }
+
+// An input and a graph's stored layout as the layout checker reads them.
+inline LayoutInput view(const Input& in) { return {in.n, in.src, in.dst, in.cap, in.cost}; }
+inline LayoutSpans spans_of(const Graph& g) {
+  return {g.num_nodes(), g.num_edges(), g.edge_capacity_units(), g.edge_costs(), g.edge_sources(), g.edge_destinations(), g.input_positions(),
+          g.outgoing_offsets(), g.incoming_offsets(), g.incoming_edges(), detail::GraphAccess::incoming_edge_sources(g),
+          g.max_edge_cost(), g.edge_cost_gcd()};
+}
+
+// The number of distinct costs of an input (K), which decides its construction path.
+inline std::int64_t distinct(std::vector<Cost> c) {
+  std::sort(c.begin(), c.end());
+  return std::unique(c.begin(), c.end()) - c.begin();
+}
+
+// A copy of every stored array of a graph and of its two cost values: the before/after comparison
+// of graph_concurrency_tests.cpp, and the copy that the layout checker's corruption controls edit
+// (graph_layout_tests.cpp).
+struct GraphArrays {
+  std::vector<Amount> capacity;
+  std::vector<Cost> cost;
+  std::vector<NodeId> src, dst;
+  std::vector<std::int32_t> input_positions, outgoing_offsets, incoming_offsets;
+  std::vector<EdgeId> in_adj;
+  std::vector<NodeId> in_col;
+  Cost max_edge_cost {0}, edge_cost_gcd {0};
+  bool operator==(const GraphArrays&) const = default;
+};
+
+inline GraphArrays arrays_of(const Graph& g) {
+  const auto col = detail::GraphAccess::incoming_edge_sources(g);
+  return {{g.edge_capacity_units().begin(), g.edge_capacity_units().end()},
+          {g.edge_costs().begin(), g.edge_costs().end()},
+          {g.edge_sources().begin(), g.edge_sources().end()},
+          {g.edge_destinations().begin(), g.edge_destinations().end()},
+          {g.input_positions().begin(), g.input_positions().end()},
+          {g.outgoing_offsets().begin(), g.outgoing_offsets().end()},
+          {g.incoming_offsets().begin(), g.incoming_offsets().end()},
+          {g.incoming_edges().begin(), g.incoming_edges().end()},
+          {col.begin(), col.end()},
+          g.max_edge_cost(),
+          g.edge_cost_gcd()};
+}
+
+// m random edges over n nodes, costs 1..max_edge_cost, capacities cap_low .. cap_low + cap_span - 1.
+inline Input random_input(std::string name, std::int32_t n, std::size_t m, Cost max_edge_cost, std::uint64_t seed,
+                          Amount cap_low = 0, Amount cap_span = 5) {
+  std::mt19937_64 rng(seed);
+  Input in {std::move(name), n};
+  for (std::size_t i = 0; i < m; ++i) {
+    in.src.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+    in.dst.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+    in.cap.push_back(cap_low + static_cast<Amount>(rng() % static_cast<std::uint64_t>(cap_span)));
+    in.cost.push_back(static_cast<Cost>(1 + rng() % static_cast<std::uint64_t>(max_edge_cost)));
+  }
+  return in;
+}
+
+// Exactly k distinct costs (3 c + 1), each present, plus `extra` repeats, shuffled by the seed;
+// distinct capacities 1, 2, ...
+inline Input exact_k(std::int64_t k, std::size_t extra, std::int32_t n, std::uint64_t seed) {
+  std::mt19937_64 rng(seed);
+  Input in {"K=" + std::to_string(k), n};
+  for (std::int64_t c = 1; c <= k; ++c) in.cost.push_back(3 * c + 1);
+  for (std::size_t j = 0; j < extra; ++j) in.cost.push_back(in.cost[rng() % in.cost.size()]);
+  std::shuffle(in.cost.begin(), in.cost.end(), rng);
+  for (std::size_t i = 0; i < in.cost.size(); ++i) {
+    in.src.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+    in.dst.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+    in.cap.push_back(static_cast<Amount>(1 + i));
+  }
+  return in;
+}
+
+// Exactly k distinct costs (c * 5 + 2) in ascending order of first appearance, plus `extra`
+// repeats, by closed-form strides without a generator; capacities 0 to 8 (zero included).
+inline Input exact_k_strided(std::int64_t k, std::size_t extra, std::int32_t n) {
+  Input in {"K=" + std::to_string(k), n};
+  for (std::int64_t c = 1; c <= k; ++c) in.cost.push_back(c * 5 + 2);
+  for (std::size_t j = 0; j < extra; ++j) in.cost.push_back(in.cost[(j * 7919) % in.cost.size()]);
+  for (std::size_t i = 0; i < in.cost.size(); ++i) {
+    in.src.push_back(static_cast<NodeId>((i * 31) % static_cast<std::size_t>(n)));
+    in.dst.push_back(static_cast<NodeId>((i * 17 + 3) % static_cast<std::size_t>(n)));
+    in.cap.push_back(static_cast<Amount>(i % 9));
+  }
+  return in;
+}
+
+// The first `count` costs whose construction hash has `residue` under `mask` (they share a table
+// slot under that mask).
+inline std::vector<Cost> colliding_costs(std::uint64_t mask, std::size_t count, std::uint64_t residue = 5) {
+  std::vector<Cost> out;
+  for (Cost c = 1; out.size() < count; ++c) {
+    if ((detail::cost_hash(c) & mask) == residue) out.push_back(c);
+  }
+  return out;
+}
+
+// `count` edges over 8 nodes whose costs collide in the initial 64-slot table.
+inline Input colliding(std::size_t count) {
+  Input in {"collisions", 8};
+  in.cost = colliding_costs(63, count, 9);
+  for (std::size_t i = 0; i < in.cost.size(); ++i) {
+    in.src.push_back(static_cast<NodeId>(i % 8));
+    in.dst.push_back(static_cast<NodeId>((i + 3) % 8));
+    in.cap.push_back(1);
+  }
+  return in;
+}
+
+// The probe-budget shapes (GraphLayout.ProbeBudgetFallbackInCollectionAndGrowth): the 64 first
+// costs whose hash has 11 low zero bits (one cluster at slot 0 in every table up to 2,048 slots),
+// then `dups` duplicates alternating the 63rd and 64th, optionally a 65th cluster cost at the end.
+inline Input budget_shape(const std::string& name, std::size_t dups, bool tail) {
+  const std::vector<Cost> z = colliding_costs(2047, 65, 0);
+  Input in {name, 7};
+  std::vector<Cost> c(z.begin(), z.begin() + 64);
+  for (std::size_t i = 0; i < dups; ++i) c.push_back(z[i % 2 == 0 ? 62 : 63]);
+  if (tail) c.push_back(z[64]);
+  for (std::size_t i = 0; i < c.size(); ++i) {
+    in.src.push_back(static_cast<NodeId>(i % 7));
+    in.dst.push_back(static_cast<NodeId>((i * 3) % 7));
+    in.cap.push_back(static_cast<Amount>(i % 11));
+    in.cost.push_back(c[i]);
+  }
+  return in;
+}
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/graph_layout_tests.cpp b/tests/cpp/graph_layout_tests.cpp
new file mode 100644
index 0000000..9647489
--- /dev/null
+++ b/tests/cpp/graph_layout_tests.cpp
@@ -0,0 +1,856 @@
+// The graph's stored layout and construction: the independent layout checker on every graph, its
+// corruption controls, the differential test against the pinned earlier constructor
+// (graph_reference.hpp; every array, every error), the hash/fallback boundary, copies and
+// moves, and the retained array payload.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <functional>
+#include <numeric>
+#include <optional>
+#include <random>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <typeinfo>
+#include <vector>
+
+#include "graph_inputs.hpp"
+#include "graph_reference.hpp"
+#include "layout_checker.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/graph_access.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::GraphAccess;
+
+namespace {
+
+// Every public array, its element width, the counts, the resolution and the scans equal the
+// reference's; the internal copy equals the reference's edge_sources()[incoming_edges()[slot]].
+void expect_same_as_reference(const Graph& g, const Input& in) {
+  const auto r = reference_graph(in.n, in.src, in.dst, in.cap, in.cost, in.q);
+  static_assert(sizeof(decltype(g.edge_capacity_units())::element_type) == 8);
+  static_assert(sizeof(decltype(g.edge_costs())::element_type) == 8);
+  static_assert(sizeof(decltype(g.edge_sources())::element_type) == 4);
+  static_assert(sizeof(decltype(g.input_positions())::element_type) == 4);
+  static_assert(sizeof(decltype(g.incoming_edges())::element_type) == 4);
+  EXPECT_EQ(g.num_nodes(), r.num_nodes) << in.name;
+  EXPECT_EQ(g.num_edges(), static_cast<std::int32_t>(r.capacity.size())) << in.name;
+  EXPECT_EQ(g.resolution(), r.resolution) << in.name;
+  EXPECT_EQ(g.max_edge_cost(), r.max_edge_cost) << in.name;
+  EXPECT_EQ(g.edge_cost_gcd(), r.edge_cost_gcd) << in.name;
+  EXPECT_EQ(vec(g.edge_capacity_units()), r.capacity) << in.name;
+  EXPECT_EQ(vec(g.edge_costs()), r.cost) << in.name;
+  EXPECT_EQ(vec(g.edge_sources()), r.src) << in.name;
+  EXPECT_EQ(vec(g.edge_destinations()), r.dst) << in.name;
+  EXPECT_EQ(vec(g.input_positions()), r.input_positions) << in.name;
+  EXPECT_EQ(vec(g.outgoing_offsets()), r.outgoing_offsets) << in.name;
+  EXPECT_EQ(vec(g.incoming_offsets()), r.incoming_offsets) << in.name;
+  EXPECT_EQ(vec(g.incoming_edges()), r.incoming_edges) << in.name;
+  EXPECT_EQ(vec(GraphAccess::incoming_edge_sources(g)), reference_in_col_indices(r)) << in.name;
+  const auto bad = check_layout(spans_of(g), view(in));
+  EXPECT_TRUE(bad.empty()) << in.name << ": " << (bad.empty() ? "" : bad.front());
+}
+
+// --------------------------------------------------------------------------- generators
+
+Input permuted(const Input& in, const std::vector<std::size_t>& p, const std::string& suffix) {
+  Input out {in.name + suffix, in.n, {}, {}, {}, {}, in.q};
+  for (std::size_t i : p) {
+    out.src.push_back(in.src[i]);
+    out.dst.push_back(in.dst[i]);
+    out.cap.push_back(in.cap[i]);
+    out.cost.push_back(in.cost[i]);
+  }
+  return out;
+}
+
+// The same edges in EdgeId order, reversed and shuffled (all property arrays permuted together).
+std::vector<Input> orders(const Input& in, std::uint64_t seed) {
+  const auto r = reference_graph(in.n, in.src, in.dst, in.cap, in.cost, in.q);
+  std::vector<std::size_t> sorted(r.input_positions.begin(), r.input_positions.end());
+  std::vector<std::size_t> rev(in.src.size());
+  std::iota(rev.rbegin(), rev.rend(), 0);
+  std::vector<std::size_t> sh(in.src.size());
+  std::iota(sh.begin(), sh.end(), 0);
+  std::shuffle(sh.begin(), sh.end(), std::mt19937_64(seed));
+  return {in, permuted(in, sorted, " (EdgeId order)"), permuted(in, rev, " (reversed)"), permuted(in, sh, " (shuffled)")};
+}
+
+} // namespace
+
+// --------------------------------------------------------------------------- differential
+
+TEST(GraphLayout, DifferentialSmallAndDegenerateShapes) {
+  std::vector<Input> cases = {
+      {"N=0", 0},
+      {"N=1, E=0", 1},
+      {"N=1 self-loops", 1, {0, 0, 0}, {0, 0, 0}, {3, 1, 2}, {2, 2, 1}},
+      {"E=0, N=1M", 1 << 20},
+      random_input("N >> E", 1 << 18, 64, 9, 3),
+      {"parallel edges, distinct capacities", 2, {0, 0, 0, 0}, {1, 1, 1, 1}, {4, 3, 2, 1}, {5, 5, 5, 5}},
+  };
+  for (const auto& in : cases) expect_same_as_reference(build(in), in);
+}
+
+TEST(GraphLayout, DifferentialRandomGraphsInFourOrders) {
+  for (std::uint64_t seed = 1; seed <= 200; ++seed) {
+    const auto base = random_input("seed " + std::to_string(seed), 1 + static_cast<std::int32_t>(seed % 37),
+                                   1 + seed % 211, 1 + static_cast<Cost>(seed % 13), seed);
+    for (const auto& in : orders(base, seed)) expect_same_as_reference(build(in), in);
+  }
+}
+
+TEST(GraphLayout, DifferentialOneLongRowEachDirection) {
+  Input out {"long out-row", 50};
+  for (int i = 0; i < 20000; ++i) {
+    out.src.push_back(7);
+    out.dst.push_back(i % 50);
+    out.cap.push_back(i);
+    out.cost.push_back(1 + (i * 7919) % 31);
+  }
+  for (const auto& in : orders(out, 11)) expect_same_as_reference(build(in), in);
+  Input in = out;
+  in.name = "long in-row";
+  std::swap(in.src, in.dst);
+  for (const auto& x : orders(in, 12)) expect_same_as_reference(build(x), x);
+}
+
+TEST(GraphLayout, DifferentialDistinctCostCounts) {
+  for (std::int64_t k : {1, 2, 31, 4096, 65535, 65536, 65537}) {
+    const auto in = exact_k(k, 4096, 4096, static_cast<std::uint64_t>(k));
+    ASSERT_EQ(distinct(in.cost), k);
+    expect_same_as_reference(build(in), in);
+  }
+  // K about E: every cost distinct.
+  const auto all = exact_k(200000, 0, 4096, 7);
+  expect_same_as_reference(build(all), all);
+}
+
+// Exact units above 2^53 (capacities and costs kept as int64, not through double).
+TEST(GraphLayout, DifferentialWideIntegers) {
+  // Costs and units above 2^53, sums just below 2^62; separate from the large-K cases (the cost
+  // sum bound forbids combining them).
+  const Cost big = Cost{1} << 59;  // four of them sum to 2^61: below the bound
+  Input wide {"wide costs", 3, {0, 0, 1, 2, 0}, {1, 1, 2, 0, 1}, {(Amount{1} << 53) + 1, Amount{1} << 61, 0, 5, 3},
+              {big + 3, big + 1, big + 2, 1, big + 1}};
+  expect_same_as_reference(build(wide), wide);
+  Input sums {"sums just below 2^62", 2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2 - 1}, {kL62 / 2, kL62 / 2 - 1}};
+  expect_same_as_reference(build(sums), sums);
+  Input units {"units above 2^53", 2, {0, 1}, {1, 0}, {(Amount{1} << 53) + 1, (Amount{1} << 53) + 3}, {1, 1}};
+  expect_same_as_reference(build(units), units);
+  // Just above 2^53 (no double holds 2^53 + 1), both arrays; EdgeId 0 is the cheaper 0 -> 1.
+  const Amount above = (Amount{1} << 53) + 1;
+  const Input both {"2^53 + 1", 2, {0, 0, 1}, {1, 1, 0}, {above, above + 2, 0}, {(Cost{1} << 53) + 1, (Cost{1} << 53) + 3, 1}};
+  const Graph g = build(both);
+  expect_same_as_reference(g, both);
+  EXPECT_EQ(g.edge_capacity_units()[0], above);
+  EXPECT_EQ(g.edge_costs()[0], (Cost{1} << 53) + 1);
+}
+
+TEST(GraphLayout, DifferentialHashCollisions) {
+  // 40 costs colliding in the initial 64-slot table (their low 6 hash bits equal), and 40 sharing
+  // their low 18 hash bits, so they collide in every table these inputs reach.
+  for (std::uint64_t mask : {std::uint64_t {63}, (std::uint64_t {1} << 18) - 1}) {
+    Input in {"collisions mask " + std::to_string(mask), 16};
+    in.cost = colliding_costs(mask, 40);
+    for (std::size_t i = 0; i < in.cost.size(); ++i) {
+      in.src.push_back(static_cast<NodeId>(i % 16));
+      in.dst.push_back(static_cast<NodeId>((i * 5) % 16));
+      in.cap.push_back(static_cast<Amount>(i));
+    }
+    expect_same_as_reference(build(in), in);
+  }
+}
+
+// --------------------------------------------------------------------------- errors
+
+namespace {
+
+// The exception a construction raises, as (type name, message); ("", "") when none.
+template <typename F>
+std::pair<std::string, std::string> outcome(F&& fn) {
+  try {
+    fn();
+  } catch (const std::exception& e) {
+    return {typeid(e).name(), e.what()};
+  }
+  return {"", ""};
+}
+
+// The defects of the constructor's validation steps, each applied to a copy of a valid input.
+using Defect = std::function<void(Input&)>;
+
+std::vector<std::pair<std::string, Defect>> defects() {
+  return {
+      {"resolution", [](Input& x) { x.q = 3.0; }},
+      {"capacity negative at 2", [](Input& x) { x.cap[2] = -1; }},
+      {"capacity 2^62 at 1", [](Input& x) { x.cap[1] = kL62; }},
+      {"num_nodes negative", [](Input& x) { x.n = -1; }},
+      {"dst shorter", [](Input& x) { x.dst.pop_back(); }},
+      {"cost longer", [](Input& x) { x.cost.push_back(1); }},
+      {"cost zero at 3", [](Input& x) { x.cost[3] = 0; }},
+      {"cost negative at 1", [](Input& x) { x.cost[1] = -4; }},
+      {"src out of range at 2", [](Input& x) { x.src[2] = x.n; }},
+      {"dst negative at 1", [](Input& x) { x.dst[1] = -1; }},
+      {"capacity sum", [](Input& x) {
+         x.cap[0] = kL62 / 2;
+         x.cap[3] = kL62 / 2;
+       }},
+      {"cost sum", [](Input& x) {
+         x.cost[1] = kL62 / 2;
+         x.cost[2] = kL62 / 2;
+       }},
+  };
+}
+
+} // namespace
+
+TEST(GraphLayout, DifferentialErrorsSingleAndPairwise) {
+  const Input base {"base", 4, {0, 1, 2, 3, 0}, {1, 2, 3, 0, 2}, {1, 2, 3, 4, 5}, {1, 2, 3, 4, 5}};
+  const auto ds = defects();
+  for (std::size_t a = 0; a < ds.size(); ++a) {
+    for (std::size_t b = a; b < ds.size(); ++b) {
+      Input in = base;
+      ds[a].second(in);
+      if (b != a) ds[b].second(in);
+      const auto got = outcome([&] { (void)build(in); });
+      const auto want = outcome([&] { (void)reference_graph(in.n, in.src, in.dst, in.cap, in.cost, in.q); });
+      ASSERT_FALSE(want.first.empty()) << ds[a].first << " + " << ds[b].first;
+      EXPECT_EQ(got, want) << ds[a].first << " + " << ds[b].first;
+    }
+  }
+}
+
+TEST(GraphLayout, DifferentialErrorsFirstInvalidIndexAndSumOrder) {
+  // Two defects of one kind: the lower input index is named.
+  Input in {"two costs", 3, {0, 1, 2, 0}, {1, 2, 0, 2}, {1, 1, 1, 1}, {1, -2, 0, 1}};
+  auto got = outcome([&] { (void)build(in); });
+  EXPECT_EQ(got, outcome([&] { (void)reference_graph(in.n, in.src, in.dst, in.cap, in.cost, in.q); }));
+  EXPECT_NE(got.second.find("edge_costs[1] = -2"), std::string::npos) << got.second;
+  // Capacity and cost sums both over: the one whose running sum crosses first, in input order.
+  Input both {"sums", 2, {0, 0, 0}, {1, 1, 1}, {1, kL62 / 2, kL62 / 2}, {kL62 / 2, kL62 / 2, 1}};
+  got = outcome([&] { (void)build(both); });
+  EXPECT_EQ(got, outcome([&] { (void)reference_graph(both.n, both.src, both.dst, both.cap, both.cost, both.q); }));
+  EXPECT_NE(got.second.find("edge costs"), std::string::npos) << got.second;
+  // Both running sums reach 2^62 at the same edge: the capacity sum is reported.
+  Input tie {"sums at one edge", 2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2}, {kL62 / 2, kL62 / 2}};
+  got = outcome([&] { (void)build(tie); });
+  EXPECT_EQ(got, outcome([&] { (void)reference_graph(tie.n, tie.src, tie.dst, tie.cap, tie.cost, tie.q); }));
+  EXPECT_NE(got.second.find("sum of all capacities"), std::string::npos) << got.second;
+}
+
+// --------------------------------------------------------------------------- the layout checker
+
+// The corruption controls of the checker, on a graph built by the constructor.
+// The fixture repeats (source, cost, destination) keys with distinct capacities and input positions, and its
+// reverse slot order differs from its id order, with different source values.
+TEST(GraphLayout, CheckerRejectsEveryCorruption) {
+  const Input in {"controls", 4, {0, 2, 0, 1, 0, 3, 2, 0}, {1, 1, 1, 1, 1, 1, 3, 3}, {5, 6, 7, 8, 9, 1, 2, 3},
+                  {2, 1, 2, 1, 2, 1, 4, 4}};
+  const Graph g = build(in);
+  ASSERT_TRUE(check_layout(spans_of(g), view(in)).empty());
+  using Copy = GraphArrays;
+  const Copy clean = arrays_of(g);
+  bool reverse_differs = false;
+  for (std::size_t s = 0; s < clean.in_adj.size(); ++s) reverse_differs |= clean.in_adj[s] != static_cast<EdgeId>(s);
+  ASSERT_TRUE(reverse_differs);
+  auto check = [&](const Copy& c) {
+    return check_layout({in.n, static_cast<std::int64_t>(in.src.size()), c.capacity, c.cost, c.src, c.dst, c.input_positions,
+                         c.outgoing_offsets, c.incoming_offsets, c.in_adj, std::span<const NodeId>(c.in_col), c.max_edge_cost,
+                         c.edge_cost_gcd},
+                        view(in));
+  };
+  const std::vector<std::tuple<std::string, std::string, std::function<void(Copy&)>>> controls = {
+      // Wrong source or row boundary
+      {"wrong source", "forward:membership", [](Copy& c) { c.src[0] = 1; }},
+      {"row boundary moved", "forward:membership", [](Copy& c) { ++c.outgoing_offsets[1]; }},
+      // All-zero offsets (a graph with edges)
+      {"all-zero offsets", "outgoing_offsets:end", [](Copy& c) { std::fill(c.outgoing_offsets.begin(), c.outgoing_offsets.end(), 0); }},
+      // Missing or duplicated reverse coverage
+      {"duplicated reverse slot", "slot:permutation", [](Copy& c) { c.in_adj[1] = c.in_adj[0]; }},
+      {"wrong reverse destination", "reverse:membership", [](Copy& c) { ++c.incoming_offsets[1]; }},
+      // (source, cost) substituted for (cost, source)
+      {"(src, cost) reverse order", "reverse:order",
+       [](Copy& c) {
+         for (std::size_t v = 0; v + 1 < c.incoming_offsets.size(); ++v) {
+           std::sort(c.in_adj.begin() + c.incoming_offsets[v], c.in_adj.begin() + c.incoming_offsets[v + 1],
+                     [&](EdgeId p, EdgeId q) {
+                       return std::tuple(c.src[static_cast<std::size_t>(p)], c.cost[static_cast<std::size_t>(p)], p) <
+                              std::tuple(c.src[static_cast<std::size_t>(q)], c.cost[static_cast<std::size_t>(q)], q);
+                     });
+         }
+         for (std::size_t s = 0; s < c.in_col.size(); ++s) c.in_col[s] = c.src[static_cast<std::size_t>(c.in_adj[s])];
+       }},
+      // Unstable equal-key members
+      {"unstable equal keys", "forward:order",
+       [](Copy& c) {
+         for (std::size_t e = 0; e + 1 < c.cost.size(); ++e) {
+           if (c.src[e] == c.src[e + 1] && c.cost[e] == c.cost[e + 1] && c.dst[e] == c.dst[e + 1]) {
+             std::swap(c.input_positions[e], c.input_positions[e + 1]);
+             std::swap(c.capacity[e], c.capacity[e + 1]);
+             return;
+           }
+         }
+         FAIL() << "the fixture has no equal-key pair";
+       }},
+      // Corrupted map
+      {"map entries swapped", "property:capacity", [](Copy& c) { std::swap(c.input_positions[0], c.input_positions[1]); }},
+      // Property-only mispermutation
+      {"capacities swapped", "property:capacity", [](Copy& c) { std::swap(c.capacity[1], c.capacity[2]); }},
+      // Out-of-range map or slot before access
+      {"negative map entry", "map:permutation", [](Copy& c) { c.input_positions[1] = -3; }},
+      {"duplicated map entry", "map:permutation", [](Copy& c) { c.input_positions[1] = c.input_positions[0]; }},
+      {"map entry E", "map:permutation", [](Copy& c) { c.input_positions[1] = static_cast<std::int32_t>(c.input_positions.size()); }},
+      {"slot out of range", "slot:permutation", [](Copy& c) { c.in_adj[2] = 1 << 30; }},
+      {"negative slot", "slot:permutation", [](Copy& c) { c.in_adj[2] = -1; }},
+      // Additional size, offset and copied-source corruption controls.
+      {"truncated capacity", "size:capacity", [](Copy& c) { c.capacity.pop_back(); }},
+      {"oversized slots", "size:incoming_edges", [](Copy& c) { c.in_adj.push_back(0); }},
+      {"truncated offsets", "size:incoming_offsets", [](Copy& c) { c.incoming_offsets.pop_back(); }},
+      {"truncated copy", "size:in_col_indices", [](Copy& c) { c.in_col.pop_back(); }},
+      {"negative offset", "outgoing_offsets:range", [](Copy& c) { c.outgoing_offsets[1] = -1; }},
+      {"excessive offset", "incoming_offsets:range", [](Copy& c) { c.incoming_offsets[2] = 1 << 30; }},
+      {"wrong copied source", "copy:source", [](Copy& c) { c.in_col[0] = (c.in_col[0] + 1) % 4; }},
+      {"copy indexed by id", "copy:source",
+       [](Copy& c) {
+         for (std::size_t s = 0; s < c.in_col.size(); ++s) c.in_col[s] = c.src[s];
+       }},
+      {"copied source out of range", "range:in_col_indices", [](Copy& c) { c.in_col[0] = 4; }},
+      {"changed maximum", "scan:max_edge_cost", [](Copy& c) { ++c.max_edge_cost; }},
+      {"changed GCD", "scan:edge_cost_gcd", [](Copy& c) { c.edge_cost_gcd = 2; }},
+      // Every other code: each array's size, each offset rule of both offset arrays, the endpoint
+      // ranges and each permuted property.
+      {"truncated costs", "size:cost", [](Copy& c) { c.cost.pop_back(); }},
+      {"truncated sources", "size:src", [](Copy& c) { c.src.pop_back(); }},
+      {"truncated destinations", "size:dst", [](Copy& c) { c.dst.pop_back(); }},
+      {"truncated map", "size:input_positions", [](Copy& c) { c.input_positions.pop_back(); }},
+      {"truncated row offsets", "size:outgoing_offsets", [](Copy& c) { c.outgoing_offsets.pop_back(); }},
+      {"row offsets start at 1", "outgoing_offsets:start", [](Copy& c) { c.outgoing_offsets[0] = 1; }},
+      {"reverse offsets start at 1", "incoming_offsets:start", [](Copy& c) { c.incoming_offsets[0] = 1; }},
+      {"reverse offsets end early", "incoming_offsets:end", [](Copy& c) { --c.incoming_offsets.back(); }},
+      {"row offsets decrease", "outgoing_offsets:monotone", [](Copy& c) { c.outgoing_offsets[1] = c.outgoing_offsets[2] + 1; }},
+      {"reverse offsets decrease", "incoming_offsets:monotone",
+       [](Copy& c) { c.incoming_offsets[2] = c.incoming_offsets[1] - 1; }},
+      {"source out of range", "range:src", [](Copy& c) { c.src[0] = 4; }},
+      {"negative destination", "range:dst", [](Copy& c) { c.dst[0] = -1; }},
+      // Two different values exchanged (the first one and the first that differs from it).
+      {"costs swapped", "property:cost",
+       [](Copy& c) { std::swap(c.cost[0], *std::find_if(c.cost.begin(), c.cost.end(), [&](Cost x) { return x != c.cost[0]; })); }},
+      {"sources swapped", "property:src",
+       [](Copy& c) { std::swap(c.src[0], *std::find_if(c.src.begin(), c.src.end(), [&](NodeId x) { return x != c.src[0]; })); }},
+      {"destinations swapped", "property:dst",
+       [](Copy& c) { std::swap(c.dst[0], *std::find_if(c.dst.begin(), c.dst.end(), [&](NodeId x) { return x != c.dst[0]; })); }},
+  };
+  for (const auto& [name, code, corrupt] : controls) {
+    Copy c = clean;
+    corrupt(c);
+    const auto bad = check(c);
+    EXPECT_NE(std::find(bad.begin(), bad.end(), code), bad.end()) << name << ": expected " << code;
+  }
+  // The counts and the caller's arrays: the node and edge counts, and each input array's size.
+  auto spans = spans_of(g);
+  ++spans.num_nodes;
+  EXPECT_EQ(check_layout(spans, view(in)), std::vector<std::string> {"size:num_nodes"});
+  spans = spans_of(g);
+  ++spans.num_edges;
+  EXPECT_EQ(check_layout(spans, view(in)), std::vector<std::string> {"size:num_edges"});
+  // A negative node count fails even when the caller claims the same count.
+  spans = spans_of(g);
+  spans.num_nodes = -1;
+  auto negative_input = view(in);
+  negative_input.num_nodes = -1;
+  EXPECT_EQ(check_layout(spans, negative_input), std::vector<std::string> {"size:num_nodes"});
+  for (const std::string name : {"input.dst", "input.capacity", "input.cost"}) {
+    auto short_input = view(in);
+    if (name == "input.dst") short_input.dst = short_input.dst.first(short_input.dst.size() - 1);
+    if (name == "input.capacity") short_input.capacity = short_input.capacity.first(short_input.capacity.size() - 1);
+    if (name == "input.cost") short_input.cost = short_input.cost.first(short_input.cost.size() - 1);
+    EXPECT_EQ(check_layout(spans_of(g), short_input), std::vector<std::string> {"size:" + name});
+  }
+  // Empty graphs are positive controls: all-zero offsets are correct without edges.
+  for (std::int32_t n : {0, 1, 1000}) {
+    const Input e {"empty", n};
+    EXPECT_TRUE(check_layout(spans_of(build(e)), view(e)).empty()) << n;
+  }
+}
+
+// The hash and fallback boundary at 65,536 distinct costs (the branch observation), on
+// inputs that do not exhaust the probe budget. In this test and the five after it, the arrays are
+// compared with the reference in every build; only the branch counters need the private hooks, and
+// without them the test reports itself skipped after the comparisons have passed.
+TEST(GraphLayout, HashAndFallbackBoundaryAt65536DistinctCosts) {
+  for (const auto& [k, hashed] : std::vector<std::pair<std::int64_t, bool>> {{65535, true}, {65536, true}, {65537, false}}) {
+    const auto in = exact_k(k, 1000, 4096, static_cast<std::uint64_t>(k));
+    ASSERT_EQ(distinct(in.cost), k);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    auto& counts = detail::thread_construction_counts();
+    const auto before = counts;
+    const Graph g = build(in);
+    EXPECT_EQ(counts.hashed - before.hashed, hashed ? 1 : 0) << k;
+    EXPECT_EQ(counts.fallback - before.fallback, hashed ? 0 : 1) << k;
+    EXPECT_EQ(counts.distinct_limit - before.distinct_limit, hashed ? 0 : 1) << k;
+    EXPECT_EQ(counts.exhausted_collection - before.exhausted_collection, 0) << k;
+    EXPECT_EQ(counts.exhausted_growth - before.exhausted_growth, 0) << k;
+    EXPECT_LE(counts.last_probes, counts.last_budget) << k;
+    if (hashed) {
+      EXPECT_EQ(counts.last_distinct, k);
+      EXPECT_LE(counts.last_table_slots, std::int64_t {1} << 18);  // load <= 1/4 at K = 65,536
+      EXPECT_GE(counts.last_table_slots, 4 * k);
+    }
+#else
+    const Graph g = build(in);
+#endif
+    expect_same_as_reference(g, in);
+  }
+#if !NETGRAPH_CORE_PRIVATE_HOOKS
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+// The combined-key boundary: with N K < E the passes run on combined
+// keys; N K = E must take the five single-key passes. Both give the reference arrays, in every
+// input order, and the random differential inputs reach both branches.
+TEST(GraphLayout, CombinedKeyPassesOnlyBelowNTimesKEqualsE) {
+  auto shaped = [](std::int32_t n, std::int64_t k, std::size_t e, std::uint64_t seed) {
+    std::mt19937_64 rng(seed);
+    Input in {"N=" + std::to_string(n) + " K=" + std::to_string(k) + " E=" + std::to_string(e), n};
+    for (std::size_t i = 0; i < e; ++i) {
+      in.src.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+      in.dst.push_back(static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n)));
+      in.cap.push_back(static_cast<Amount>(1 + i));
+      const auto j = i < static_cast<std::size_t>(k) ? static_cast<std::int64_t>(i) : static_cast<std::int64_t>(rng() % static_cast<std::uint64_t>(k));
+      in.cost.push_back(3 * j + 1);
+    }
+    return in;
+  };
+  for (const auto& [n, k] : std::vector<std::pair<std::int32_t, std::int64_t>> {{5, 1}, {10, 3}, {400, 2}, {64, 31}}) {
+    const auto nk = static_cast<std::size_t>(n) * static_cast<std::size_t>(k);
+    for (const auto& [e, fused] : std::vector<std::pair<std::size_t, bool>> {{nk + 1, true}, {nk, false}}) {
+      for (const auto& in : orders(shaped(n, k, e, nk + e), e)) {
+        ASSERT_EQ(distinct(in.cost), k) << in.name;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+        auto& counts = detail::thread_construction_counts();
+        const auto before = counts.fused;
+        const Graph g = build(in);
+        EXPECT_EQ(counts.fused - before, fused ? 1 : 0) << in.name;
+#else
+        const Graph g = build(in);
+#endif
+        expect_same_as_reference(g, in);
+      }
+    }
+  }
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  std::int64_t fused = 0, plain = 0;
+  for (std::uint64_t seed = 1; seed <= 200; ++seed) {
+    const auto in = random_input("seed " + std::to_string(seed), 1 + static_cast<std::int32_t>(seed % 37),
+                                 1 + seed % 211, 1 + static_cast<Cost>(seed % 13), seed);
+    const auto before = detail::thread_construction_counts().fused;
+    (void)build(in);
+    (detail::thread_construction_counts().fused > before ? fused : plain) += 1;
+  }
+  EXPECT_GT(fused, 0);
+  EXPECT_GT(plain, 0);
+#else
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+// The fallback's 16-bit digits: N = 2, two copies of [1, ..., 65,536,
+// 2^59] (K = 65,537, E = 131,074 = N K: the single-key passes; the cost sum is below 2^62), then
+// one more cost of 1 (E = N K + 1: the combined keys). Both take the distinct-limit fallback (observed); by the
+// costs' values its radix sorts on the digits at 0, 16 and 48 bits and skips the one at 32 (one
+// digit value), with arrays equal to the reference in four input orders.
+TEST(GraphLayout, RadixFallbackDigitsOnBothSidesOfTheCombinedKeyBoundary) {
+  Input base {"two copies of 1..65,536 and 2^59", 2};
+  for (int copy = 0; copy < 2; ++copy) {
+    for (Cost c = 1; c <= 65536; ++c) base.cost.push_back(c);
+    base.cost.push_back(Cost {1} << 59);
+  }
+  Input plus = base;
+  plus.name += " + one cost 1";
+  plus.cost.push_back(1);
+  for (Input* in : {&base, &plus}) {
+    for (std::size_t i = 0; i < in->cost.size(); ++i) {
+      in->src.push_back(static_cast<NodeId>(i % 2));
+      in->dst.push_back(static_cast<NodeId>((i / 2) % 2));
+      in->cap.push_back(static_cast<Amount>(1 + i));
+    }
+  }
+  ASSERT_EQ(base.cost.size(), 131074u);
+  for (const auto& [x, fused] : std::vector<std::pair<const Input*, bool>> {{&base, false}, {&plus, true}}) {
+    ASSERT_EQ(distinct(x->cost), 65537);
+    for (const auto& in : orders(*x, x->cost.size())) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      auto& counts = detail::thread_construction_counts();
+      const auto before = counts;
+      const Graph g = build(in);
+      EXPECT_EQ(counts.distinct_limit - before.distinct_limit, 1) << in.name;
+      EXPECT_EQ(counts.fallback - before.fallback, 1) << in.name;
+      EXPECT_EQ(counts.fused - before.fused, fused ? 1 : 0) << in.name;
+      EXPECT_EQ(counts.last_distinct, 65537) << in.name;
+#else
+      const Graph g = build(in);
+#endif
+      expect_same_as_reference(g, in);
+    }
+  }
+#if !NETGRAPH_CORE_PRIVATE_HOOKS
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+// A run of equal costs reuses the previous ordinal without a lookup: one cost repeated costs
+// exactly one probe; two alternating costs in different slots cost one probe per edge.
+TEST(GraphLayout, RunsOfEqualCostsSkipTheLookup) {
+  Cost a = 1, b = 2;
+  while ((detail::cost_hash(a) & 63) == (detail::cost_hash(b) & 63)) ++b;
+  for (const bool alternate : {false, true}) {
+    Input in {alternate ? "alternating" : "one run", 9};
+    for (int i = 0; i < 1000; ++i) {
+      in.src.push_back(i % 9);
+      in.dst.push_back((i * 4) % 9);
+      in.cap.push_back(i);
+      in.cost.push_back(alternate && i % 2 == 1 ? b : a);
+    }
+    const Graph g = build(in);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_construction_counts().last_probes, alternate ? 1000 : 1) << in.name;
+#endif
+    expect_same_as_reference(g, in);
+  }
+#if !NETGRAPH_CORE_PRIVATE_HOOKS
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+namespace {
+
+enum class BudgetOutcome { Hashed, Collection, Growth };
+
+struct ProbeCount {
+  BudgetOutcome outcome {BudgetOutcome::Hashed};
+  std::int64_t probes {0};          // every examined slot: exactly the budget when it ran out
+  std::vector<std::int64_t> after;  // the probes after each hashed edge, in input order
+  std::size_t distinct {0};         // the distinct costs inserted
+  std::size_t slots {64};           // the table's size
+};
+
+// The probe accounting of the cost hashing, modelled from its definition rather than from the
+// constructor: linear probing from 64 slots, every examined slot counted against the budget; a
+// cost equal to the previous one reuses its ordinal without a lookup; before a new cost would
+// raise the load above 1/4, the table doubles, the distinct costs are reinserted in
+// first-appearance order and the new cost is looked up again. A probe beyond the budget stops the
+// hashing, inside an input lookup (Collection) or inside a growth, its reinsertion or the repeated
+// lookup (Growth). Without a budget every cost is hashed.
+ProbeCount count_probes(std::span<const Cost> cost, std::optional<std::int64_t> budget) {
+  ProbeCount out;
+  std::vector<Cost> table(64, 0);
+  std::vector<Cost> order;
+  auto locate = [&](Cost c) -> std::optional<std::size_t> {
+    for (std::size_t at = detail::cost_hash(c) & (table.size() - 1);; at = (at + 1) & (table.size() - 1)) {
+      if (budget.has_value() && out.probes == *budget) return std::nullopt;
+      ++out.probes;
+      if (table[at] == 0 || table[at] == c) return at;
+    }
+  };
+  Cost prev = 0;
+  for (const Cost c : cost) {
+    if (c != prev) {
+      auto at = locate(c);
+      if (!at) {
+        out.outcome = BudgetOutcome::Collection;
+        return out;
+      }
+      if (table[*at] == 0) {
+        if (4 * (order.size() + 1) > table.size()) {
+          table.assign(2 * table.size(), 0);
+          for (const Cost d : order) {
+            const auto slot = locate(d);
+            if (!slot) {
+              out.outcome = BudgetOutcome::Growth;
+              return out;
+            }
+            table[*slot] = d;
+          }
+          at = locate(c);
+          if (!at) {
+            out.outcome = BudgetOutcome::Growth;
+            return out;
+          }
+        }
+        table[*at] = c;
+        order.push_back(c);
+      }
+      prev = c;
+    }
+    out.after.push_back(out.probes);
+  }
+  out.distinct = order.size();
+  out.slots = table.size();
+  return out;
+}
+
+// The construction's budget B = 8E + 8 x 65,536 for E edges.
+std::int64_t probe_budget(std::size_t edges) { return 8 * static_cast<std::int64_t>(edges) + 8 * 65536; }
+
+BudgetOutcome budget_outcome(std::span<const Cost> cost) { return count_probes(cost, probe_budget(cost.size())).outcome; }
+
+} // namespace
+
+// The cumulative probe budget B = 8E + 8 x 65,536 over the whole construction. Costs whose hash has
+// 11 low zero bits start at slot 0 in every table up to 2,048 slots, so they form one cluster:
+// the j-th of them (from 0) is found after j + 1 probes. After the 64 cluster costs come D
+// duplicates alternating z[62], z[63] (a run of one cost reuses its ordinal without a lookup, so
+// the duplicates must alternate), each costing 63 or 64 probes while B grows by 8 per edge. The
+// boundaries are those of budget_outcome above (a model of the probe accounting, independent
+// of the constructor), which every case checks first:
+//  * collection: exhausted at an input lookup exactly when D >= 9,406;
+//  * growth: with a 65th cluster cost at the end (its lookup, then the reinsertion into 512
+//    slots, then the lookup repeated), exhausted inside the growth for 9,366 <= D <= 9,404, not at
+//    all for D <= 9,365, and at the 65th cost's first lookup (collection) for D = 9,405.
+// Exhausted constructions use exactly B probes and none more; the arrays equal the reference.
+TEST(GraphLayout, ProbeBudgetFallbackInCollectionAndGrowth) {
+  auto shape = [](std::size_t dups, bool tail) {
+    return budget_shape("cluster D=" + std::to_string(dups) + (tail ? " + 65th" : ""), dups, tail);
+  };
+  enum Where { None, Collection, Growth };
+  const std::vector<std::tuple<std::size_t, bool, Where>> cases = {
+      {9000, false, None},  {9405, false, None},  {9406, false, Collection}, {10000, false, Collection},
+      {9300, true, None},   {9365, true, None},   {9366, true, Growth},       {9380, true, Growth},
+      {9404, true, Growth}, {9405, true, Collection},
+  };
+
+  for (const auto& [dups, tail, where] : cases) {
+    const auto in = shape(dups, tail);
+    const BudgetOutcome modelled[] = {BudgetOutcome::Hashed, BudgetOutcome::Collection, BudgetOutcome::Growth};
+    EXPECT_EQ(budget_outcome(in.cost), modelled[where]) << in.name;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    auto& counts = detail::thread_construction_counts();
+    const auto before = counts;
+    const Graph g = build(in);
+    const std::int64_t budget = probe_budget(in.src.size());
+    EXPECT_EQ(counts.last_budget, budget) << in.name;
+    EXPECT_LE(counts.last_probes, budget) << in.name;  // no lookup examines more than B in total
+    EXPECT_EQ(counts.exhausted_collection - before.exhausted_collection, where == Collection ? 1 : 0) << in.name;
+    EXPECT_EQ(counts.exhausted_growth - before.exhausted_growth, where == Growth ? 1 : 0) << in.name;
+    EXPECT_EQ(counts.fallback - before.fallback, where == None ? 0 : 1) << in.name;
+    EXPECT_EQ(counts.hashed - before.hashed, where == None ? 1 : 0) << in.name;
+    if (where != None) EXPECT_EQ(counts.last_probes, budget) << in.name;
+#else
+    const Graph g = build(in);
+#endif
+    expect_same_as_reference(g, in);
+  }
+#if !NETGRAPH_CORE_PRIVATE_HOOKS
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+// The budget stays cumulative across the large table's growths: 64 costs share their
+// low 18 hash bits, so they collide in every table up to 262,144 slots; further costs grow the
+// table to K = 32,769; then the last two colliding costs alternate. The probe model above
+// (count_probes, independent of the constructor) finds the first edge count whose probes exceed
+// B: the collection exhausts the budget there, and one edge fewer stays hashed with exactly the
+// counted probes.
+TEST(GraphLayout, ProbeBudgetIsCumulativeAcrossTheLargeTableGrowths) {
+  const std::vector<Cost> z = colliding_costs(262143, 64, 0);
+  std::vector<Cost> seq = z;
+  for (Cost c = 1; seq.size() < 32769; ++c) {
+    if (!std::binary_search(z.begin(), z.end(), c)) seq.push_back(c);
+  }
+  const std::size_t distinct_end = seq.size();
+  for (std::size_t d = 0; d < 20000; ++d) seq.push_back(z[d % 2 == 0 ? 62 : 63]);
+  const ProbeCount unbounded = count_probes(seq, std::nullopt);
+  ASSERT_EQ(unbounded.distinct, 32769U);
+  ASSERT_EQ(unbounded.slots, 262144U);
+  std::size_t first = 0;  // the first edge count whose probes exceed its own budget
+  for (std::size_t e = 1; e <= seq.size() && first == 0; ++e) {
+    if (unbounded.after[e - 1] > probe_budget(e)) first = e;
+  }
+  ASSERT_GT(first, distinct_end);  // inside the alternation
+  seq.resize(first);
+  const std::int64_t prefix_probes = unbounded.after[first - 2];  // all probes of one edge fewer
+  // The same model run with each length's budget stops there and not one edge earlier.
+  EXPECT_EQ(count_probes(seq, probe_budget(first)).outcome, BudgetOutcome::Collection);
+  const ProbeCount shorter = count_probes(std::span<const Cost>(seq).first(first - 1), probe_budget(first - 1));
+  EXPECT_EQ(shorter.outcome, BudgetOutcome::Hashed);
+  EXPECT_EQ(shorter.probes, prefix_probes);
+  EXPECT_EQ(seq.size(), 44436U);  // the count of the probe model
+
+  auto input = [&](std::size_t e) {
+    Input in {"late growth E=" + std::to_string(e), 31};
+    for (std::size_t i = 0; i < e; ++i) {
+      in.src.push_back(static_cast<NodeId>(i % 31));
+      in.dst.push_back(static_cast<NodeId>((i * 7) % 31));
+      in.cap.push_back(static_cast<Amount>(i % 13));
+      in.cost.push_back(seq[i]);
+    }
+    return in;
+  };
+  for (const std::size_t e : {seq.size() - 1, seq.size()}) {
+    const auto in = input(e);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const bool exhausts = e == seq.size();
+    auto& counts = detail::thread_construction_counts();
+    const auto before = counts;
+    const Graph g = build(in);
+    const std::int64_t budget = probe_budget(e);
+    EXPECT_EQ(counts.last_budget, budget) << in.name;
+    EXPECT_EQ(counts.last_probes, exhausts ? budget : prefix_probes) << in.name;
+    EXPECT_EQ(counts.exhausted_collection - before.exhausted_collection, exhausts ? 1 : 0) << in.name;
+    EXPECT_EQ(counts.exhausted_growth - before.exhausted_growth, 0) << in.name;
+    EXPECT_EQ(counts.hashed - before.hashed, exhausts ? 0 : 1) << in.name;
+    if (!exhausts) EXPECT_EQ(counts.last_distinct, 32769) << in.name;
+#else
+    (void)prefix_probes;
+    const Graph g = build(in);
+#endif
+    expect_same_as_reference(g, in);
+  }
+#if !NETGRAPH_CORE_PRIVATE_HOOKS
+  GTEST_SKIP() << "branch observations need the private hooks";
+#endif
+}
+
+// A copy keeps every array, the map and the resolution (one input at a resolution other than 1)
+// and draws a new uid.
+TEST(GraphLayout, CopyKeepsEveryArrayAndDrawsANewUid) {
+  Input fine = exact_k(31, 500, 64, 6);
+  fine.name += " at 2^-12";
+  fine.q = std::ldexp(1.0, -12);
+  for (const auto& in : {exact_k(31, 500, 64, 1), exact_k(65537, 10, 512, 2), Input {"empty", 5}, fine}) {
+    const Graph g = build(in);
+    EXPECT_GT(g.uid(), 0U);  // a constructed graph's uid is positive (0 marks a moved-from one)
+    const Graph c(g);
+    EXPECT_NE(c.uid(), g.uid());
+    EXPECT_GT(c.uid(), g.uid());  // a relation, not an absolute counter value
+    expect_same_as_reference(c, in);
+    EXPECT_EQ(GraphAccess::retained(c).size_bytes, GraphAccess::retained(g).size_bytes);
+    // A second construction of the same input is a new graph too.
+    EXPECT_NE(build(in).uid(), g.uid());
+  }
+}
+
+// The move: every value and the uid transferred without allocation
+// (GraphFaults.MoveIsAllocationFreeUnderAnArmedFailure checks that none is made); the source keeps its resolution, has uid, N, E, maximum and
+// GCD zero, empty edge arrays and one zero in each offset view. Copying and moving an already
+// moved-from graph give the same state.
+TEST(GraphLayout, MoveTransfersEverythingAndLeavesAnEmptyGraph) {
+  const auto in = exact_k(31, 500, 64, 3);
+  const double q = std::ldexp(1.0, -12);
+  Graph g(in.n, in.src, in.dst, in.cap, in.cost, q);
+  const auto uid = g.uid();
+  const Graph m(std::move(g));
+  EXPECT_EQ(m.uid(), uid);
+  EXPECT_EQ(m.resolution(), q);
+  Input with_q = in;
+  with_q.q = q;
+  expect_same_as_reference(m, with_q);
+  auto expect_moved_from = [&](const Graph& x, const char* what) {
+    EXPECT_EQ(x.resolution(), q) << what;
+    EXPECT_EQ(x.num_nodes(), 0) << what;
+    EXPECT_EQ(x.num_edges(), 0) << what;
+    EXPECT_EQ(x.max_edge_cost(), 0) << what;
+    EXPECT_EQ(x.edge_cost_gcd(), 0) << what;
+    EXPECT_TRUE(x.edge_capacity_units().empty() && x.edge_costs().empty() && x.edge_sources().empty() && x.edge_destinations().empty() &&
+                x.input_positions().empty() && x.incoming_edges().empty() && GraphAccess::incoming_edge_sources(x).empty())
+        << what;
+    EXPECT_EQ(vec(x.outgoing_offsets()), (std::vector<std::int32_t> {0})) << what;
+    EXPECT_EQ(vec(x.incoming_offsets()), (std::vector<std::int32_t> {0})) << what;
+    EXPECT_TRUE(check_layout(spans_of(x), view(Input {"moved-from", 0})).empty()) << what;
+  };
+  // NOLINTBEGIN(bugprone-use-after-move): the documented moved-from state.
+  EXPECT_EQ(g.uid(), 0u);
+  expect_moved_from(g, "source");
+  const Graph copied(g);
+  EXPECT_GT(copied.uid(), uid);  // a copy is a new graph, even of an empty one
+  expect_moved_from(copied, "copy of the source");  // except its uid
+  Graph again(std::move(g));
+  EXPECT_EQ(again.uid(), 0u);
+  expect_moved_from(again, "moved again");
+  expect_moved_from(g, "source moved twice");
+  // NOLINTEND(bugprone-use-after-move)
+}
+
+// The retained array payload: 36 E + 8 (N + 1) bytes, capacities equal to sizes (no slack, no
+// retained scratch, no inverse map, no physical-capacity array). The sizes come from the graph's
+// own list of its arrays (GraphAccess::retained), whose length is fixed by that list's code and
+// so not compared here; that the list is complete, nine arrays and no other allocation held, is
+// GraphFaults' count of the allocations a graph holds.
+TEST(GraphLayout, RetainedPayloadIs36BytesPerEdgePlusOffsets) {
+  std::vector<Input> cases = {Input {"N=0", 0}, Input {"isolated", 1000}, exact_k(31, 4000, 512, 4),
+                              exact_k(65537, 100, 4096, 5)};
+  for (const auto& in : cases) {
+    const Graph g = build(in);
+    const Graph c(g);
+    Graph moved_from = build(in);
+    const Graph m(std::move(moved_from));
+    const std::size_t e = in.src.size();
+    const std::size_t want = 36 * e + 8 * (static_cast<std::size_t>(in.n) + 1);
+    for (const Graph* x : {&g, &c, &m}) {
+      const auto r = GraphAccess::retained(*x);
+      EXPECT_EQ(r.size_bytes, want) << in.name;
+      EXPECT_EQ(r.capacity_bytes, want) << in.name;
+    }
+  }
+}
+
+// Graph-bound objects from another graph are rejected at their existing use sites, on a twin
+// graph with identical arrays (only the uid differs, so the check is by identity, not by shape):
+// the evaluators' Eligibility and ShortestPathCache checks, and a Path's DAG (to_dag keeps the Path's
+// graph) in resolve_to_paths. The flow core, ledger, policy, KSP, search and cache sites have
+// their own tests.
+TEST(GraphLayout, ForeignGraphBoundObjectsAreRejectedAtTheirUseSites) {
+  const std::vector<NodeId> src {0, 0, 1, 2}, dst {1, 2, 3, 3};
+  const std::vector<Amount> cap {5, 5, 5, 5};
+  const std::vector<Cost> cost {1, 1, 1, 1};
+  const Graph g(4, src, dst, cap, cost, 1.0), twin(4, src, dst, cap, cost, 1.0);
+  ASSERT_NE(g.uid(), twin.uid());
+  const std::vector<NodeId> s {0}, d {3};
+  const FlowPolicyConfig cfg {shortest_paths(RouteAllocation::Optimized), Admission::Lossless};
+  const Eligibility el = twin.eligibility({}, std::vector<EdgeId> {0});
+  ShortestPathCache cache(twin);
+  const std::string elig_msg = "foreign Eligibility: built for another graph";
+  const std::string cache_msg = "foreign ShortestPathCache: bound to another graph";
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(g, s, d, EvaluationOptions {cfg, &el}); }), elig_msg);
+  EXPECT_EQ(error_of([&] { (void)evaluate_demand(g, s, d, EvaluationOptions {cfg, nullptr, &cache}); }), cache_msg);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs {{s, d}};
+  EXPECT_EQ(error_of([&] { (void)evaluate_pairs(g, pairs, EvaluationOptions {cfg, nullptr, &cache}, {}, 1); }), cache_msg);
+  EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(g, s, d, EvaluationOptions {cfg, &el}, 1); }), elig_msg);
+  EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(g, s, d, EvaluationOptions {cfg, nullptr, &cache}, 1); }), cache_msg);
+  const Path p(twin, {{0}, {2}});
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, p.to_dag(), 0, 3); }), "foreign PredecessorDAG: built for another graph");
+  // The same calls on the owning graph succeed (the controls).
+  EXPECT_NO_THROW((void)evaluate_demand(twin, s, d, EvaluationOptions {cfg, &el, &cache}));
+  EXPECT_EQ(resolve_to_paths(twin, p.to_dag(), 0, 3).size(), 1U);
+}
+
+TEST(GraphLayout, ReferenceComparisonRejectsDifferentInputs) {
+  const Input in {"comparison", 4, {0, 1, 0, 2}, {1, 3, 2, 3}, {2, 3, 4, 5}, {2, 4, 6, 8}};
+  const auto g = build(in);
+  EXPECT_EQ(failures_of([&] { expect_same_as_reference(g, in); }), 0);
+  const std::vector<std::function<void(Input&)>> changes = {
+      [](auto& x) { ++x.n; }, [](auto& x) { x.q = 2; },
+      [](auto& x) { ++x.cap.back(); }, [](auto& x) { x.cost.back() = 9; },
+      [](auto& x) { x.src.back() = 1; }, [](auto& x) { x.dst.back() = 0; },
+      [](auto& x) { x.src.push_back(3); x.dst.push_back(0); x.cap.push_back(1); x.cost.push_back(1); },
+      [](auto& x) { std::swap(x.cost[0], x.cost[2]); },
+  };
+  for (std::size_t i = 0; i < changes.size(); ++i) {
+    auto different = in;
+    changes[i](different);
+    EXPECT_GT(failures_of([&] { expect_same_as_reference(g, different); }), 0) << i;
+  }
+}
diff --git a/tests/cpp/graph_reference.hpp b/tests/cpp/graph_reference.hpp
new file mode 100644
index 0000000..9408e60
--- /dev/null
+++ b/tests/cpp/graph_reference.hpp
@@ -0,0 +1,201 @@
+// An earlier graph constructor kept as a test-only reference for the differential tests.
+//
+// Origin: the earlier src/graph.cpp, identified by its sha256 c9af7b06c48a741fbac33d40283c50c2
+// 6763dcda7a5e7acf4be0195bf896ab68, the function Graph::Graph(num_nodes, src, dst,
+// capacity_units, cost, resolution) at lines 91-222 and resolution_exponent at lines 42-53. This
+// file is self-contained: nothing here needs that source.
+// The statements are copied unchanged; only the members became fields of ReferenceGraph and the
+// uid is not drawn. Do not edit this file to follow a later constructor: it is the fixed point
+// the new construction is compared with (every array, every error type and message).
+#pragma once
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <numeric>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::test {
+
+// The reference graph's state, member for member (graph.hpp at 3e1f3ea6e, without the uid).
+struct ReferenceGraph {
+  double resolution {1.0};
+  std::int32_t num_nodes {0};
+  Cost max_edge_cost {0};
+  Cost edge_cost_gcd {0};
+  std::vector<Amount> capacity;
+  std::vector<Cost> cost;
+  std::vector<NodeId> src;
+  std::vector<NodeId> dst;
+  std::vector<std::int32_t> input_positions;
+  std::vector<std::int32_t> outgoing_offsets;
+  std::vector<std::int32_t> incoming_offsets;
+  std::vector<EdgeId> incoming_edges;
+};
+
+namespace reference_graph_detail {
+
+inline int resolution_exponent(double q) {
+  if (!std::isfinite(q) || q <= 0.0) {
+    throw std::invalid_argument("resolution must be a power of two in [2^-32, 2^32]");
+  }
+  int exp = 0;
+  const double mantissa = std::frexp(q, &exp);  // q = mantissa * 2^exp, mantissa in [0.5, 1)
+  const int k = exp - 1;
+  if (mantissa != 0.5 || k < -32 || k > 32) {
+    throw std::invalid_argument("resolution must be a power of two in [2^-32, 2^32]");
+  }
+  return k;
+}
+
+} // namespace reference_graph_detail
+
+inline ReferenceGraph reference_graph(std::int32_t num_nodes,
+                                std::span<const NodeId> src,
+                                std::span<const NodeId> dst,
+                                std::span<const Amount> edge_capacity_units,
+                                std::span<const Cost> cost,
+                                double resolution) {
+  ReferenceGraph r;
+  (void)reference_graph_detail::resolution_exponent(resolution);
+  // The unit values.
+  for (std::size_t i = 0; i < edge_capacity_units.size(); ++i) {
+    const Amount c = edge_capacity_units[i];
+    if (c < 0 || c >= kDomainLimit) {
+      throw std::invalid_argument("edge_capacity_units[" + std::to_string(i) + "] = " + std::to_string(c) +
+                                  " is outside the units domain [0, 2^62)");
+    }
+  }
+  // The array shapes.
+  if (num_nodes < 0) {
+    throw std::invalid_argument("num_nodes must be >= 0 (got " + std::to_string(num_nodes) + ")");
+  }
+  const std::size_t m = src.size();
+  if (dst.size() != m || edge_capacity_units.size() != m || cost.size() != m) {
+    throw std::invalid_argument("edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got " +
+                                std::to_string(src.size()) + ", " + std::to_string(dst.size()) + ", " +
+                                std::to_string(edge_capacity_units.size()) + ", " +
+                                std::to_string(cost.size()) + ")");
+  }
+  if (m > static_cast<std::size_t>(std::numeric_limits<std::int32_t>::max())) {
+    throw std::invalid_argument("the number of edges exceeds INT32_MAX (array length)");
+  }
+  // Zero or negative costs.
+  Cost max_edge_cost = 0;
+  Cost edge_cost_gcd = 0;
+  for (std::size_t i = 0; i < m; ++i) {
+    if (cost[i] < 1) {
+      throw std::invalid_argument("edge_costs[" + std::to_string(i) + "] = " + std::to_string(cost[i]) +
+                                  ": costs must be positive (edge_costs >= 1)");
+    }
+    max_edge_cost = std::max(max_edge_cost, cost[i]);
+    // A running GCD of 1 stays 1 (gcd(1, c) = 1): the remaining edges are only checked.
+    if (edge_cost_gcd != 1) edge_cost_gcd = std::gcd(edge_cost_gcd, cost[i]);
+  }
+  // The remaining bounds.
+  for (std::size_t i = 0; i < m; ++i) {
+    if (src[i] < 0 || src[i] >= num_nodes || dst[i] < 0 || dst[i] >= num_nodes) {
+      throw std::invalid_argument("edge " + std::to_string(i) + ": endpoint (" + std::to_string(src[i]) +
+                                  ", " + std::to_string(dst[i]) + ") out of node range [0, " +
+                                  std::to_string(num_nodes) + ")");
+    }
+  }
+  constexpr auto kLimit = static_cast<std::uint64_t>(kDomainLimit);
+  std::uint64_t cap_sum = 0;
+  std::uint64_t cost_sum = 0;
+  for (std::size_t i = 0; i < m; ++i) {
+    cap_sum += static_cast<std::uint64_t>(edge_capacity_units[i]);  // each < 2^62: no wrap before the check
+    if (cap_sum >= kLimit) {
+      throw std::invalid_argument("the sum of all capacities reaches the bound of the units domain (2^62 units)");
+    }
+    cost_sum += static_cast<std::uint64_t>(cost[i]);
+    if (cost_sum >= kLimit) {
+      throw std::invalid_argument(
+          "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64");
+    }
+  }
+
+  r.resolution = resolution;
+  r.num_nodes = num_nodes;
+  r.max_edge_cost = max_edge_cost;
+  r.edge_cost_gcd = edge_cost_gcd;
+  const auto n = static_cast<std::size_t>(num_nodes);
+
+  // Ids: rank in (src, cost, dst, input).
+  r.outgoing_offsets.assign(n + 1, 0);
+  for (std::size_t i = 0; i < m; ++i) ++r.outgoing_offsets[static_cast<std::size_t>(src[i]) + 1];
+  for (std::size_t u = 0; u < n; ++u) r.outgoing_offsets[u + 1] += r.outgoing_offsets[u];
+  r.input_positions.resize(m);
+  {
+    std::vector<std::int32_t> cursor(r.outgoing_offsets.begin(), r.outgoing_offsets.end() - 1);
+    for (std::size_t i = 0; i < m; ++i) {
+      r.input_positions[static_cast<std::size_t>(cursor[static_cast<std::size_t>(src[i])]++)] =
+          static_cast<std::int32_t>(i);
+    }
+  }
+  for (std::size_t u = 0; u < n; ++u) {
+    auto first = r.input_positions.begin() + r.outgoing_offsets[u];
+    auto last = r.input_positions.begin() + r.outgoing_offsets[u + 1];
+    if (last - first < 2) continue;
+    std::sort(first, last, [&](std::int32_t a, std::int32_t b) {
+      const auto ia = static_cast<std::size_t>(a);
+      const auto ib = static_cast<std::size_t>(b);
+      if (cost[ia] != cost[ib]) return cost[ia] < cost[ib];
+      if (dst[ia] != dst[ib]) return dst[ia] < dst[ib];
+      return a < b;
+    });
+  }
+  r.capacity.resize(m);
+  r.cost.resize(m);
+  r.src.resize(m);
+  r.dst.resize(m);
+  for (std::size_t e = 0; e < m; ++e) {
+    const auto i = static_cast<std::size_t>(r.input_positions[e]);
+    r.capacity[e] = edge_capacity_units[i];
+    r.cost[e] = cost[i];
+    r.src[e] = src[i];
+    r.dst[e] = dst[i];
+  }
+
+  // Reverse CSR in (cost, src, input) order.
+  r.incoming_offsets.assign(n + 1, 0);
+  for (std::size_t e = 0; e < m; ++e) ++r.incoming_offsets[static_cast<std::size_t>(r.dst[e]) + 1];
+  for (std::size_t v = 0; v < n; ++v) r.incoming_offsets[v + 1] += r.incoming_offsets[v];
+  r.incoming_edges.resize(m);
+  {
+    std::vector<std::int32_t> cursor(r.incoming_offsets.begin(), r.incoming_offsets.end() - 1);
+    for (std::size_t e = 0; e < m; ++e) {
+      r.incoming_edges[static_cast<std::size_t>(cursor[static_cast<std::size_t>(r.dst[e])]++)] =
+          static_cast<EdgeId>(e);
+    }
+  }
+  for (std::size_t v = 0; v < n; ++v) {
+    auto first = r.incoming_edges.begin() + r.incoming_offsets[v];
+    auto last = r.incoming_edges.begin() + r.incoming_offsets[v + 1];
+    if (last - first < 2) continue;
+    std::sort(first, last, [&](EdgeId a, EdgeId b) {
+      const auto ia = static_cast<std::size_t>(a);
+      const auto ib = static_cast<std::size_t>(b);
+      if (r.cost[ia] != r.cost[ib]) return r.cost[ia] < r.cost[ib];
+      if (r.src[ia] != r.src[ib]) return r.src[ia] < r.src[ib];
+      return a < b;
+    });
+  }
+  return r;
+}
+
+// The internal reverse-source column the current graph stores, derived from the reference (it has no
+// stored copy): edge_src[in_adj_edge_index[slot]].
+inline std::vector<NodeId> reference_in_col_indices(const ReferenceGraph& r) {
+  std::vector<NodeId> out(r.incoming_edges.size());
+  for (std::size_t s = 0; s < out.size(); ++s) out[s] = r.src[static_cast<std::size_t>(r.incoming_edges[s])];
+  return out;
+}
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/graph_tests.cpp b/tests/cpp/graph_tests.cpp
new file mode 100644
index 0000000..f929c07
--- /dev/null
+++ b/tests/cpp/graph_tests.cpp
@@ -0,0 +1,289 @@
+// The graph on integer units: construction, validation order, the EdgeId order
+// (source, cost, destination, input), the reverse CSR, input_positions, to_units and as_float.
+#include <gtest/gtest.h>
+
+#include <cmath>
+#include <limits>
+#include <numeric>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <type_traits>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// A Graph of these arrays (resolution 1 unless given).
+Graph build(std::int32_t n, std::vector<NodeId> src, std::vector<NodeId> dst, std::vector<Amount> cap,
+            std::vector<Cost> cost, double q = 1.0) {
+  return Graph(n, src, dst, cap, cost, q);
+}
+
+} // namespace
+
+TEST(Graph, EdgeIdOrderInputIndexAndReverseCsr) {
+  // (u, v, cap, cost) in input order. EdgeIds rank edges by source, then cost, then destination,
+  // then input position.
+  const std::vector<InEdge> edges = {{2, 0, 5, 3}, {0, 2, 4, 2}, {0, 1, 3, 2}, {1, 2, 2, 1},
+                                     {0, 1, 1, 2}, {0, 2, 6, 1}, {2, 1, 7, 1}};
+  auto g = make_graph(3, edges);
+  std::vector<std::int32_t> expect(edges.size());
+  std::iota(expect.begin(), expect.end(), 0);
+  std::stable_sort(expect.begin(), expect.end(), [&](int a, int b) {
+    const auto& x = edges[static_cast<std::size_t>(a)];
+    const auto& y = edges[static_cast<std::size_t>(b)];
+    return std::tie(x.u, x.cost, x.v) < std::tie(y.u, y.cost, y.v);
+  });
+  EXPECT_EQ(std::vector<std::int32_t>(g.input_positions().begin(), g.input_positions().end()), expect);
+  EXPECT_EQ(expect, (std::vector<std::int32_t>{5, 2, 4, 1, 3, 6, 0}));
+  EXPECT_EQ(std::vector<std::int32_t>(g.outgoing_offsets().begin(), g.outgoing_offsets().end()),
+            (std::vector<std::int32_t>{0, 4, 5, 7}));
+  // Every per-edge array is the input array permuted by input_positions.
+  for (std::size_t e = 0; e < edges.size(); ++e) {
+    const auto& in = edges[static_cast<std::size_t>(g.input_positions()[e])];
+    EXPECT_EQ(g.edge_sources()[e], in.u);
+    EXPECT_EQ(g.edge_destinations()[e], in.v);
+    EXPECT_EQ(g.edge_capacity_units()[e], in.cap);
+    EXPECT_EQ(g.edge_costs()[e], in.cost);
+  }
+  // Row u's id range holds u's out-edges (their (cost, destination, input) order within the row is the
+  // input_positions checked above).
+  for (NodeId u = 0; u < 3; ++u) {
+    for (auto e = g.outgoing_offsets()[u]; e < g.outgoing_offsets()[u + 1]; ++e) {
+      EXPECT_EQ(g.edge_sources()[static_cast<std::size_t>(e)], u);
+    }
+  }
+  // The inverse map from input positions to EdgeIds, derived by hand from the order above.
+  EXPECT_EQ(id_of_input(g), (std::vector<EdgeId> {6, 3, 1, 4, 2, 0, 5}));
+  std::vector<Amount> caps_in;
+  for (const auto& e : edges) caps_in.push_back(e.cap);
+  EXPECT_EQ(to_input(g, g.edge_capacity_units()), caps_in);
+  // Reverse CSR in (cost, source, input) order per destination, as input positions.
+  const std::vector<std::vector<std::int32_t>> expect_rev = {{0}, {6, 2, 4}, {5, 3, 1}};
+  for (NodeId v = 0; v < 3; ++v) {
+    std::vector<std::int32_t> got;
+    for (auto s = g.incoming_offsets()[v]; s < g.incoming_offsets()[v + 1]; ++s) {
+      const EdgeId e = g.incoming_edges()[static_cast<std::size_t>(s)];
+      EXPECT_EQ(g.edge_destinations()[static_cast<std::size_t>(e)], v);
+      got.push_back(g.input_positions()[static_cast<std::size_t>(e)]);
+    }
+    EXPECT_EQ(got, expect_rev[static_cast<std::size_t>(v)]) << "node " << v;
+  }
+}
+
+TEST(Graph, EqualKeysKeepInputOrder) {
+  // Parallel edges with equal (source, cost, destination) are ranked by input position, in both CSRs.
+  auto g = make_graph(3, {{0, 1, 4, 2}, {1, 2, 1, 1}, {0, 1, 7, 2}, {0, 1, 5, 1}, {2, 1, 3, 2}, {0, 1, 9, 2}});
+  EXPECT_EQ(std::vector<std::int32_t>(g.input_positions().begin(), g.input_positions().end()),
+            (std::vector<std::int32_t>{3, 0, 2, 5, 1, 4}));
+  std::vector<std::int32_t> rev;
+  for (auto s = g.incoming_offsets()[1]; s < g.incoming_offsets()[2]; ++s) {
+    rev.push_back(g.input_positions()[static_cast<std::size_t>(g.incoming_edges()[static_cast<std::size_t>(s)])]);
+  }
+  // (cost, source, input): cost 1 from 0 (input 3), then cost 2 from 0 (inputs 0, 2, 5), then from 2.
+  EXPECT_EQ(rev, (std::vector<std::int32_t>{3, 0, 2, 5, 4}));
+}
+
+TEST(Graph, ReverseOrderIsCostThenSource) {
+  // A scan in id order would give (source, cost, input); the reverse order is (cost, source, input).
+  auto g = make_graph(3, {{0, 2, 1, 5}, {1, 2, 1, 1}});
+  ASSERT_EQ(g.incoming_offsets()[2], 0);
+  const EdgeId first = g.incoming_edges()[0];
+  EXPECT_EQ(g.input_positions()[static_cast<std::size_t>(first)], 1);
+}
+
+TEST(Graph, ShapesOfEmptyAndIsolated) {
+  auto empty = build(0, {}, {}, {}, {});
+  EXPECT_EQ(empty.num_nodes(), 0);
+  EXPECT_EQ(empty.num_edges(), 0);
+  EXPECT_EQ(std::vector<std::int32_t>(empty.outgoing_offsets().begin(), empty.outgoing_offsets().end()),
+            (std::vector<std::int32_t>{0}));
+  EXPECT_EQ(std::vector<std::int32_t>(empty.incoming_offsets().begin(), empty.incoming_offsets().end()),
+            (std::vector<std::int32_t>{0}));
+  EXPECT_EQ(empty.max_edge_cost(), 0);
+  EXPECT_EQ(empty.edge_cost_gcd(), 0);
+  auto isolated = build(4, {}, {}, {}, {});
+  EXPECT_EQ(std::vector<std::int32_t>(isolated.outgoing_offsets().begin(), isolated.outgoing_offsets().end()),
+            (std::vector<std::int32_t>{0, 0, 0, 0, 0}));
+  auto g = make_graph(5, {{3, 1, 1, 6}, {1, 3, 1, 4}, {3, 3, 2, 10}});
+  EXPECT_EQ(std::vector<std::int32_t>(g.outgoing_offsets().begin(), g.outgoing_offsets().end()),
+            (std::vector<std::int32_t>{0, 0, 1, 1, 3, 3}));
+  EXPECT_EQ(std::vector<std::int32_t>(g.incoming_offsets().begin(), g.incoming_offsets().end()),
+            (std::vector<std::int32_t>{0, 0, 1, 1, 3, 3}));
+  EXPECT_EQ(g.max_edge_cost(), 10);
+  EXPECT_EQ(g.edge_cost_gcd(), 2);
+}
+
+// The cost loop after the running GCD reaches 1: every later edge is still checked for a
+// positive cost (in input order: the first bad index is named) and still counts for the
+// maximum; the sums are still validated; the GCD stays 1, and 0 without edges.
+TEST(Graph, CostChecksAndMaximumAfterTheGcdReachesOne) {
+  // The GCD is 1 from the second edge on; the maximum comes later.
+  auto g = build(2, {0, 0, 0, 0}, {1, 1, 1, 1}, {1, 1, 1, 1}, {3, 2, 9, 4});
+  EXPECT_EQ(g.edge_cost_gcd(), 1);
+  EXPECT_EQ(g.max_edge_cost(), 9);
+  auto late = build(2, {0, 0, 0}, {1, 1, 1}, {1, 1, 1}, {4, 6, 9});
+  EXPECT_EQ(late.edge_cost_gcd(), 1);  // 1 only at the last edge
+  EXPECT_EQ(late.max_edge_cost(), 9);
+  auto ones = build(2, {0, 0, 0}, {1, 1, 1}, {1, 1, 1}, {1, 1, kL62 / 4});
+  EXPECT_EQ(ones.edge_cost_gcd(), 1);
+  EXPECT_EQ(ones.max_edge_cost(), kL62 / 4);
+  EXPECT_EQ(build(2, {0}, {1}, {1}, {6}).edge_cost_gcd(), 6);
+  EXPECT_EQ(build(2, {0, 0}, {1, 1}, {1, 1}, {6, 4}).edge_cost_gcd(), 2);
+  EXPECT_EQ(build(0, {}, {}, {}, {}).edge_cost_gcd(), 0);
+  // A non-positive cost after the GCD reached 1 is still found, at its own index.
+  const auto zero = error_of([] { (void)build(2, {0, 0, 0}, {1, 1, 1}, {1, 1, 1}, {2, 3, 0}); });
+  EXPECT_TRUE(contains(zero, "edge_costs[2] = 0")) << zero;
+  const auto negative = error_of([] { (void)build(2, {0, 0, 0, 0}, {1, 1, 1, 1}, {1, 1, 1, 1}, {1, 5, -7, 0}); });
+  EXPECT_TRUE(contains(negative, "edge_costs[2] = -7")) << negative;
+  // The cost sum after the GCD reached 1.
+  EXPECT_TRUE(contains(error_of([] { (void)build(2, {0, 0, 0}, {1, 1, 1}, {1, 1, 1}, {1, kL62 / 2, kL62 / 2}); }),
+                       "sum of all edge costs"));
+}
+
+TEST(Graph, Resolution) {
+  // The resolution has no default: no constructor takes the arrays without it.
+  static_assert(!std::is_constructible_v<Graph, std::int32_t, std::span<const NodeId>, std::span<const NodeId>,
+                                         std::span<const Amount>, std::span<const Cost>>);
+  for (double q : {std::ldexp(1.0, -32), std::ldexp(1.0, -12), 1.0, std::ldexp(1.0, 32)}) {
+    auto g = build(2, {0}, {1}, {1}, {1}, q);
+    EXPECT_EQ(g.resolution(), q);
+  }
+  for (double q : {3.0, std::ldexp(1.0, -33), std::ldexp(1.0, 33), 0.0, -1.0, -0.5,
+                   std::numeric_limits<double>::quiet_NaN(), std::numeric_limits<double>::infinity(), 1e308}) {
+    EXPECT_TRUE(contains(error_of([&] { (void)build(2, {0}, {1}, {1}, {1}, q); }), "resolution")) << q;
+  }
+}
+
+TEST(Graph, EveryValidationError) {
+  // The unit values.
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {-1}, {1}); }),
+            "edge_capacity_units[0] = -1 is outside the units domain [0, 2^62)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {kL62}, {1}); }),
+            "edge_capacity_units[0] = 4611686018427387904 is outside the units domain [0, 2^62)");
+  // The shapes.
+  EXPECT_EQ(error_of([] { (void)build(-1, {}, {}, {}, {}); }), "num_nodes must be >= 0 (got -1)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 1}, {1}, {1}, {1}); }),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 2, 1, 1, 1)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {1, 2}, {1}); }),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 1, 1, 2, 1)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {1}, {}); }),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 1, 1, 1, 0)");
+  // Zero and negative costs.
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {1}, {0}); }), "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {1}, {-5}); }), "edge_costs[0] = -5: costs must be positive (edge_costs >= 1)");
+  // The remaining bounds.
+  EXPECT_EQ(error_of([] { (void)build(2, {2}, {1}, {1}, {1}); }), "edge 0: endpoint (2, 1) out of node range [0, 2)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {-1}, {1}, {1}); }), "edge 0: endpoint (0, -1) out of node range [0, 2)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2}, {1, 1}); }),
+            "the sum of all capacities reaches the bound of the units domain (2^62 units)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 0}, {1, 1}, {1, 1}, {kL62 / 2, kL62 / 2}); }),
+            "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64");
+  // Just below the bounds is accepted.
+  auto caps = build(2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2 - 1}, {1, 1});
+  EXPECT_EQ(caps.edge_capacity_units()[0] + caps.edge_capacity_units()[1], kL62 - 1);
+  auto costs = build(2, {0, 0}, {1, 1}, {1, 1}, {kL62 / 2, kL62 / 2 - 1});
+  EXPECT_EQ(costs.max_edge_cost(), kL62 / 2);
+  auto huge_cost = build(2, {0}, {1}, {1}, {kL62 - 1});
+  EXPECT_EQ(huge_cost.max_edge_cost(), kL62 - 1);
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {1}, {std::numeric_limits<Cost>::max()}); }),
+            "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64");
+}
+
+TEST(Graph, ValidationOrder) {
+  // Resolution before the unit values.
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {1}, {-1}, {1}, 3.0); }),
+            "resolution must be a power of two in [2^-32, 2^32]");
+  // The unit values before the shapes (the length message names edge_capacity_units too).
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 1}, {1}, {-1}, {1}); }),
+            "edge_capacity_units[0] = -1 is outside the units domain [0, 2^62)");
+  // The shapes before the costs.
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 1}, {1}, {1}, {0}); }),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 2, 1, 1, 1)");
+  EXPECT_EQ(error_of([] { (void)build(-1, {0}, {1}, {1}, {0}); }), "num_nodes must be >= 0 (got -1)");
+  // The costs before the remaining bounds (endpoints, sums).
+  EXPECT_EQ(error_of([] { (void)build(2, {0}, {5}, {1}, {0}); }), "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)");
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2}, {1, 0}); }),
+            "edge_costs[1] = 0: costs must be positive (edge_costs >= 1)");
+  // Endpoints before the sums.
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 7}, {1, 1}, {kL62 / 2, kL62 / 2}, {1, 1}); }),
+            "edge 1: endpoint (7, 1) out of node range [0, 2)");
+  // Both running sums reach 2^62 at the same edge: the capacity sum is reported.
+  EXPECT_EQ(error_of([] { (void)build(2, {0, 0}, {1, 1}, {kL62 / 2, kL62 / 2}, {kL62 / 2, kL62 / 2}); }),
+            "the sum of all capacities reaches the bound of the units domain (2^62 units)");
+}
+
+// Uids come from one process-wide counter and are never reused: a graph built after another was
+// destroyed (in the same storage) gets a larger uid, and so does a copy.
+TEST(Graph, UidsAreNeverReused) {
+  std::uint64_t last = 0;
+  for (int i = 0; i < 3; ++i) {
+    const auto g = build(2, {0}, {1}, {1}, {1});
+    EXPECT_GT(g.uid(), last) << i;
+    last = g.uid();
+  }
+  const auto g = build(2, {0}, {1}, {1}, {1});
+  const Graph copy(g);
+  EXPECT_GT(copy.uid(), g.uid());
+  EXPECT_GT(g.uid(), last);
+}
+
+TEST(Units, HalfUpBoundaries) {
+  for (int k : {-12, 0, -32, 32}) {
+    const double q = std::ldexp(1.0, k);
+    EXPECT_EQ(to_units(2.5 * q, q), 3) << k;
+    EXPECT_EQ(to_units(0.5 * q, q), 1) << k;
+    EXPECT_EQ(to_units(0.49 * q, q), 0) << k;
+    EXPECT_EQ(to_units(7.5 * q, q), 8) << k;
+    EXPECT_EQ(to_units(std::nextafter(7.5 * q, 0.0), q), 7) << k;
+    EXPECT_EQ(to_units(std::nextafter(0.5 * q, 0.0), q), 0) << k;
+    EXPECT_EQ(to_units(0.0, q), 0) << k;
+    EXPECT_EQ(to_units(-0.0, q), 0) << k;
+    EXPECT_EQ(as_float(12345, q), 12345 * q) << k;
+  }
+  // Physical 1e15 at q = 2^-12 is 4.096e18 units: below 2^62 and exact.
+  EXPECT_EQ(to_units(1e15, std::ldexp(1.0, -12)), Amount{4096000000000000000});
+  // Large integral values: the double is the unit count.
+  EXPECT_EQ(to_units(9007199254740993.0, 1.0), Amount{9007199254740992});
+  EXPECT_EQ(to_units(4503599627370497.5, 1.0), Amount{4503599627370498});  // 2^52 + 1.5 is not a double
+  EXPECT_EQ(to_units(4503599627370495.5, 1.0), Amount{4503599627370496});  // 2^52 - 0.5 rounds up
+  EXPECT_EQ(to_units(4611686018427387392.0, 1.0), Amount{4611686018427387392});  // 2^62 - 512
+  // The export above 2^53 is the nearest double (the documented export limit).
+  EXPECT_EQ(as_float((Amount{1} << 53) + 1, 1.0), 9007199254740992.0);
+}
+
+TEST(Units, RejectedValues) {
+  const double q = std::ldexp(1.0, -12);
+  const std::string nan = "to_units: NaN has no unit value";
+  const std::string infinite = "to_units: an infinite amount is not finite and has no unit value";
+  const std::string bound = "to_units: the amount is at or above the bound of the units domain (2^62 units)";
+  const std::string resolution = "resolution must be a power of two in [2^-32, 2^32]";
+  EXPECT_EQ(error_of([&] { (void)to_units(std::numeric_limits<double>::quiet_NaN(), q); }), nan);
+  EXPECT_EQ(error_of([&] { (void)to_units(std::numeric_limits<double>::infinity(), q); }), infinite);
+  EXPECT_EQ(error_of([&] { (void)to_units(-std::numeric_limits<double>::infinity(), q); }), infinite);
+  EXPECT_EQ(error_of([&] { (void)to_units(-1e-300, q); }), "to_units: a negative amount has no unit value");
+  EXPECT_EQ(error_of([&] { (void)to_units(4611686018427387904.0, 1.0); }), bound);  // 2^62
+  EXPECT_EQ(error_of([&] { (void)to_units(std::numeric_limits<double>::max(), std::ldexp(1.0, 32)); }), bound);
+  EXPECT_EQ(error_of([&] { (void)to_units(1e300, std::ldexp(1.0, -32)); }), bound);
+  // Both resolution checks: a value that is not a power of two, and a power of two out of range
+  // (and the values that are not positive and finite).
+  for (const double bad : {3.0, std::ldexp(1.0, -33), std::ldexp(1.0, 33), 0.0, -1.0,
+                           std::numeric_limits<double>::quiet_NaN(), std::numeric_limits<double>::infinity()}) {
+    EXPECT_EQ(error_of([&] { (void)to_units(1.0, bad); }), resolution) << bad;
+    EXPECT_EQ(error_of([&] { (void)as_float(1, bad); }), resolution) << bad;
+  }
+  // The capacity-sum bound at q = 2^-12: [1e15, 1.25e14] fits, [1e15, 1.26e14] exceeds the unit sum.
+  const std::vector<Amount> ok = {to_units(1e15, q), to_units(1.25e14, q)};
+  auto g = build(2, {0, 0}, {1, 1}, ok, {1, 1}, q);
+  EXPECT_EQ(g.edge_capacity_units()[0] + g.edge_capacity_units()[1], ok[0] + ok[1]);
+  const std::vector<Amount> over = {to_units(1e15, q), to_units(1.26e14, q)};
+  EXPECT_EQ(error_of([&] { (void)build(2, {0, 0}, {1, 1}, over, {1, 1}, q); }),
+            "the sum of all capacities reaches the bound of the units domain (2^62 units)");
+}
diff --git a/tests/cpp/joint_forwarding_tests.cpp b/tests/cpp/joint_forwarding_tests.cpp
new file mode 100644
index 0000000..ea0593b
--- /dev/null
+++ b/tests/cpp/joint_forwarding_tests.cpp
@@ -0,0 +1,1688 @@
+// The loss rule over several demands at once (detail::lossy of ForwardingDemand values: the demand
+// level above sources and entries, A+ and the cycle rule across demands, per-demand black holes),
+// natively: random tunnel demands against an independent reference evaluator (cycles, black holes,
+// serial pairs and round counts included); one pooled demand against the pooled kernel it replaces
+// in a list; random pooled and tunnel demands without a cyclic group against an independent
+// synchronous sweep; hand-derived cases (the demand level above tunnels and sources, a pooled demand
+// sharing a link, pooled roots blocking serial pairs, the source-labelled round state of a pooled
+// cycle, link sums beyond 2^63 and 2^64). The references call none of the library's apportionment
+// helpers (program_reference's round robin and highest averages).
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <functional>
+#include <map>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <random>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+namespace ref = program_reference;
+
+using Amounts = std::vector<Amount>;
+using Pairs = std::vector<std::pair<EdgeId, Amount>>;
+using detail::PreparedRoute;
+using detail::ProgramFlow;
+
+const std::string kPeriodTwo = "lossy forwarding iteration entered a period-2 cycle";
+const std::string kRoundLimit = "lossy forwarding iteration did not reach a fixed point within the round limit";
+
+// ---------------------------------------------------------------- the reference of simple paths
+
+// One component of the reference: one tunnel of one demand with its own offer, its route
+// (EdgeIds), its label (demand, source, tunnel) and the links its demand black-holes.
+struct Component {
+  Amount offer {0};
+  std::vector<EdgeId> route {};
+  std::tuple<int, int, int> label {};
+  std::set<EdgeId> dark {};
+};
+
+struct RefResult {
+  std::string error {};  // empty: solved
+  std::int64_t rounds {0};  // every round of every cyclic group
+  std::vector<Amounts> arrival {};
+  std::vector<Amounts> carried {};
+  Amounts delivered {};
+};
+
+// The loss rule at a link: demands by H, then sources, then tunnels, over the arrivals of one link's members.
+Amounts hierarchical(Amount total, const Amounts& arrivals, const std::vector<std::tuple<int, int, int>>& labels) {
+  Amounts out(arrivals.size(), 0);
+  std::function<void(const std::vector<std::size_t>&, Amount, int)> split = [&](const std::vector<std::size_t>& ids, Amount amount,
+                                                                              int depth) {
+    if (depth == 3) {
+      out[ids.front()] = amount;
+      return;
+    }
+    std::map<int, std::vector<std::size_t>> groups;
+    for (auto i : ids) {
+      const int key = depth == 0 ? std::get<0>(labels[i]) : depth == 1 ? std::get<1>(labels[i]) : std::get<2>(labels[i]);
+      groups[key].push_back(i);
+    }
+    Amounts w;
+    for (const auto& [k, g] : groups) {
+      Amount s = 0;
+      for (auto i : g) s += arrivals[i];
+      w.push_back(s);
+    }
+    auto q = ref::highest_averages(amount, w);
+    if (q.empty()) q.assign(w.size(), 0);
+    std::size_t j = 0;
+    for (const auto& [k, g] : groups) split(g, q[j++], depth + 1);
+  };
+  std::vector<std::size_t> all(arrivals.size());
+  for (std::size_t i = 0; i < all.size(); ++i) all[i] = i;
+  split(all, total, 0);
+  return out;
+}
+
+// A reference evaluator of the loss rule for simple-path components, written apart from the
+// library (its own SCCs, splits and rounds): A+ where arrivals are determined, serial normalization, bounded synchronous
+// rounds from zero in every cyclic group, the period-two and round-limit errors.
+RefResult reference(const std::vector<Component>& comps, const Amounts& cap) {
+  const std::size_t n = comps.size();
+  auto black = [&](std::size_t i, std::size_t j) { return comps[i].dark.count(comps[i].route[j]) != 0; };
+  // Dead: can carry nothing (a zero offer, or behind its own black hole); no part in the loads,
+  // the waits or serial normalization.
+  auto dead = [&](std::size_t i, std::size_t j) {
+    if (comps[i].offer == 0) return true;
+    for (std::size_t k = 0; k < j; ++k) {
+      if (black(i, k)) return true;
+    }
+    return false;
+  };
+  std::map<EdgeId, std::vector<std::pair<std::size_t, std::size_t>>> occ;
+  for (std::size_t i = 0; i < n; ++i) {
+    for (std::size_t j = 0; j < comps[i].route.size(); ++j) {
+      if (!black(i, j) && !dead(i, j)) occ[comps[i].route[j]].emplace_back(i, j);
+    }
+  }
+  std::set<EdgeId> binding;
+  for (const auto& [e, members] : occ) {
+    Amount upper = 0;
+    for (const auto& [i, j] : members) upper += comps[i].offer;
+    if (upper > cap[static_cast<std::size_t>(e)]) binding.insert(e);
+  }
+  for (const auto& [e, members] : occ) {
+    std::vector<std::pair<std::size_t, std::size_t>> nexts;
+    bool all = true;
+    for (const auto& [i, j] : members) {
+      if (j + 1 >= comps[i].route.size()) all = false;
+      nexts.emplace_back(i, j + 1);
+    }
+    if (!all) continue;
+    std::set<EdgeId> g;
+    for (const auto& [i, j] : nexts) g.insert(comps[i].route[j]);
+    if (g.size() != 1) continue;
+    const EdgeId f = *g.begin();
+    auto at = occ.find(f);
+    auto theirs = at == occ.end() ? std::vector<std::pair<std::size_t, std::size_t>> {} : at->second;
+    std::sort(nexts.begin(), nexts.end());
+    std::sort(theirs.begin(), theirs.end());
+    if (f != e && cap[static_cast<std::size_t>(f)] == cap[static_cast<std::size_t>(e)] && nexts == theirs) binding.erase(f);
+  }
+  // Nodes: routers (0, i, j) and services (1, e, 0).
+  using Node = std::tuple<int, std::int64_t, std::int64_t>;
+  std::map<Node, std::set<Node>> graph;
+  auto arc = [&](const Node& a, const Node& b) {
+    graph[a].insert(b);
+    graph[b];
+  };
+  for (std::size_t i = 0; i < n; ++i) {
+    if (comps[i].offer == 0) continue;
+    for (std::size_t j = 0; j < comps[i].route.size(); ++j) {
+      const EdgeId e = comps[i].route[j];
+      const Node r {0, static_cast<std::int64_t>(i), static_cast<std::int64_t>(j)};
+      const Node r2 {0, static_cast<std::int64_t>(i), static_cast<std::int64_t>(j + 1)};
+      if (binding.count(e) != 0 && !black(i, j) && !dead(i, j)) {
+        arc(r, Node {1, e, 0});
+        arc(Node {1, e, 0}, r2);
+      } else {
+        arc(r, r2);
+      }
+    }
+  }
+  // Strongly connected components (recursive Tarjan; the graphs are small).
+  std::map<Node, int> index;
+  std::map<Node, int> low;
+  std::vector<Node> stack;
+  std::set<Node> on;
+  std::vector<std::vector<Node>> groups;
+  std::function<void(const Node&)> strong = [&](const Node& v) {
+    index[v] = low[v] = static_cast<int>(index.size());
+    stack.push_back(v);
+    on.insert(v);
+    for (const auto& w : graph[v]) {
+      if (index.count(w) == 0) {
+        strong(w);
+        low[v] = std::min(low[v], low[w]);
+      } else if (on.count(w) != 0) {
+        low[v] = std::min(low[v], index[w]);
+      }
+    }
+    if (low[v] == index[v]) {
+      std::vector<Node> group;
+      while (true) {
+        const Node w = stack.back();
+        stack.pop_back();
+        on.erase(w);
+        group.push_back(w);
+        if (w == v) break;
+      }
+      groups.push_back(group);
+    }
+  };
+  for (const auto& [v, _] : graph) {
+    if (index.count(v) == 0) strong(v);
+  }
+  std::map<Node, std::size_t> where;
+  for (std::size_t g = 0; g < groups.size(); ++g) {
+    for (const auto& v : groups[g]) where[v] = g;
+  }
+  std::vector<std::set<std::size_t>> preds(groups.size());
+  for (const auto& [a, bs] : graph) {
+    for (const auto& b : bs) {
+      if (where[a] != where[b]) preds[where[b]].insert(where[a]);
+    }
+  }
+  RefResult out;
+  out.arrival.resize(n);
+  out.carried.resize(n);
+  for (std::size_t i = 0; i < n; ++i) {
+    out.arrival[i].assign(comps[i].route.size(), 0);
+    out.carried[i].assign(comps[i].route.size(), 0);
+  }
+  auto router = [&](std::size_t i, std::size_t j) {
+    if (j >= comps[i].route.size()) return;
+    out.arrival[i][j] = j == 0 ? comps[i].offer : out.carried[i][j - 1];
+    if (black(i, j)) {
+      out.carried[i][j] = 0;
+    } else if (binding.count(comps[i].route[j]) == 0) {
+      out.carried[i][j] = out.arrival[i][j];
+    }
+  };
+  auto service = [&](EdgeId e) {
+    const auto& members = occ[e];
+    Amounts w;
+    std::vector<std::tuple<int, int, int>> labels;
+    Amount sum = 0;
+    for (const auto& [i, j] : members) {
+      w.push_back(out.arrival[i][j]);
+      labels.push_back(comps[i].label);
+      sum += out.arrival[i][j];
+    }
+    return hierarchical(std::min(cap[static_cast<std::size_t>(e)], sum), w, labels);
+  };
+  std::set<std::size_t> done;
+  while (done.size() < groups.size()) {
+    // Any ready group: the order of independent groups changes no value and no round count.
+    std::size_t g = 0;
+    while (done.count(g) != 0 || !std::includes(done.begin(), done.end(), preds[g].begin(), preds[g].end())) ++g;
+    done.insert(g);
+    const auto& nodes = groups[g];
+    if (nodes.size() == 1 && graph[nodes.front()].count(nodes.front()) == 0) {
+      const auto& v = nodes.front();
+      if (std::get<0>(v) == 0) {
+        router(static_cast<std::size_t>(std::get<1>(v)), static_cast<std::size_t>(std::get<2>(v)));
+      } else {
+        const EdgeId e = static_cast<EdgeId>(std::get<1>(v));
+        const auto c = service(e);
+        for (std::size_t k = 0; k < c.size(); ++k) out.carried[occ[e][k].first][occ[e][k].second] = c[k];
+      }
+      continue;
+    }
+    std::vector<EdgeId> es;
+    std::vector<std::pair<std::size_t, std::size_t>> inner;
+    for (const auto& v : nodes) {
+      if (std::get<0>(v) == 1) {
+        es.push_back(static_cast<EdgeId>(std::get<1>(v)));
+      } else {
+        inner.emplace_back(static_cast<std::size_t>(std::get<1>(v)), static_cast<std::size_t>(std::get<2>(v)));
+      }
+    }
+    std::sort(es.begin(), es.end());
+    std::sort(inner.begin(), inner.end());
+    std::vector<std::pair<std::size_t, std::size_t>> coords;
+    for (EdgeId e : es) {
+      for (const auto& c : occ[e]) coords.push_back(c);
+    }
+    Amounts previous(coords.size(), 0);
+    std::optional<Amounts> before;
+    for (const auto& [i, j] : coords) out.carried[i][j] = 0;
+    bool solved = false;
+    const auto limit = 64 * static_cast<std::int64_t>(es.size());
+    for (std::int64_t step = 1; step <= limit; ++step) {
+      ++out.rounds;
+      for (const auto& [i, j] : inner) router(i, j);
+      Amounts next;
+      for (EdgeId e : es) {
+        const auto c = service(e);
+        next.insert(next.end(), c.begin(), c.end());
+      }
+      for (std::size_t k = 0; k < coords.size(); ++k) out.carried[coords[k].first][coords[k].second] = next[k];
+      if (next == previous) {
+        solved = true;
+        break;
+      }
+      if (before.has_value() && next == *before) {
+        out.error = kPeriodTwo;
+        return out;
+      }
+      before = previous;
+      previous = next;
+    }
+    if (!solved) {
+      out.error = kRoundLimit;
+      return out;
+    }
+  }
+  out.delivered.resize(n);
+  for (std::size_t i = 0; i < n; ++i) out.delivered[i] = out.carried[i].empty() ? comps[i].offer : out.carried[i].back();
+  return out;
+}
+
+// The reference's own controls: D-crossing and D-C2 (two fixed points, period two
+// at round 3), a dark arrival dropped where it arrives.
+TEST(JointForwarding, ReferenceControls) {
+  // D-crossing: A on e, f (8); B on e (4); C on f (4); V(e) = 9, V(f) = 7.
+  const auto r = reference({{8, {0, 1}, {0, 0, 0}, {}}, {4, {0}, {1, 0, 0}, {}}, {4, {1}, {2, 0, 0}, {}}}, {9, 7});
+  EXPECT_EQ(r.error, "");
+  EXPECT_EQ(r.delivered, (Amounts {4, 3, 3}));
+  const auto c2 = reference({{1, {0, 1}, {0, 0, 0}, {}}, {2, {1, 0}, {1, 0, 0}, {}}}, {1, 2});
+  EXPECT_EQ(c2.error, kPeriodTwo);
+  EXPECT_EQ(c2.rounds, 3);
+  const auto d = reference({{5, {0, 1}, {0, 0, 0}, {0}}, {3, {1}, {1, 0, 0}, {}}}, {10, 4});
+  EXPECT_EQ(d.delivered, (Amounts {0, 3}));
+  EXPECT_EQ(d.arrival[0], (Amounts {5, 0}));
+}
+
+// ---------------------------------------------------------------- the library's side
+
+// A demand of tunnels for the library: per head its injection, per tunnel (head index, EdgeIds,
+// weight), its black-holed links.
+struct TunnelDemand {
+  std::vector<NodeId> heads {};
+  Amounts injections {};
+  std::vector<std::tuple<std::size_t, std::vector<EdgeId>, Amount>> tunnels {};
+  std::vector<EdgeId> dark {};
+};
+
+struct Built {
+  std::vector<std::shared_ptr<const ForwardingProgram>> programs;
+  std::vector<std::shared_ptr<const Eligibility>> black;
+  std::vector<std::unique_ptr<detail::ForwardingView>> views;
+};
+
+Built build(const Graph& g, const std::vector<TunnelDemand>& demands, NodeId dst) {
+  Built b;
+  for (const auto& d : demands) {
+    std::vector<RouteDefinition> routes;
+    for (const auto& [h, es, w] : d.tunnels) {
+      std::vector<std::vector<EdgeId>> hops;
+      for (EdgeId e : es) hops.push_back({e});
+      routes.push_back(RouteDefinition {d.heads[h], std::make_shared<const Path>(g, hops), w});
+    }
+    b.programs.push_back(ForwardingProgram::from_routes(g, d.heads, std::vector<NodeId> {dst}, routes));
+    b.black.push_back(d.dark.empty() ? nullptr : std::make_shared<const Eligibility>(g.eligibility({}, d.dark)));
+    b.views.push_back(std::make_unique<detail::ForwardingView>(
+        detail::make_forwarding_view(g, b.programs.back(), nullptr, std::vector<NodeId> {dst}, b.black.back().get())));
+  }
+  return b;
+}
+
+detail::AvailableCapacityFn capacities(const Graph& g) {
+  return [&g](std::span<const EdgeId> edges, std::span<Amount> out) {
+    for (std::size_t i = 0; i < edges.size(); ++i) out[i] = g.edge_capacity_units()[static_cast<std::size_t>(edges[i])];
+  };
+}
+
+std::vector<ProgramFlow> joint(const Graph& g, const Built& b, const std::vector<Amounts>& injections) {
+  std::vector<detail::ForwardingDemand> demands;
+  for (std::size_t d = 0; d < b.views.size(); ++d) demands.push_back({b.views[d].get(), injections[d]});
+  return detail::lossy(demands, capacities(g));
+}
+
+// Random tunnel demands (one to three, each with one or two heads and one or two tunnels per head)
+// on random small graphs with cycles, some links black-holed for one demand, against the
+// reference: every hop's arrival and carried amount, each tunnel's delivery, the errors, and the
+// rounds of every cyclic group (hooks). Each tunnel ends at the one destination.
+TEST(JointForwarding, TunnelDemandsMatchTheReference) {
+  std::mt19937 rng(20261020);
+  int checked = 0;
+  int cyclic = 0;      // trials whose evaluation iterated a group
+  int errors = 0;      // trials that raised a cycle-rule error (rare: the deterministic cases are below)
+  int dark = 0;        // trials with a black-holed link on some forwarded tunnel
+  int crossings = 0;   // trials where some link carries two demands
+  for (int trial = 0; trial < 3000; ++trial) {
+    const std::int32_t inner = 5;
+    const NodeId dst = inner;
+    std::vector<InEdge> rows;
+    for (NodeId u = 0; u < inner; ++u) {
+      for (NodeId w = 0; w < inner; ++w) {
+        if (u != w && rng() % 2 == 0) rows.push_back({u, w, static_cast<Amount>(rng() % 4), 1});
+      }
+      rows.push_back({u, dst, static_cast<Amount>(rng() % 7), 1});
+    }
+    const auto g = shared(make_graph(inner + 1, rows));
+    // A random simple walk from h over inner nodes (1 to 3 inner edges), then its exit to dst.
+    auto walk = [&](NodeId h) {
+      std::vector<EdgeId> path;
+      std::set<NodeId> seen {h};
+      NodeId u = h;
+      const int len = static_cast<int>(rng() % 5);
+      for (int k = 0; k < len; ++k) {
+        std::vector<EdgeId> out;
+        for (EdgeId e = 0; e < g->num_edges(); ++e) {
+          const auto ei = static_cast<std::size_t>(e);
+          if (g->edge_sources()[ei] == u && g->edge_destinations()[ei] != dst && seen.count(g->edge_destinations()[ei]) == 0) out.push_back(e);
+        }
+        if (out.empty()) break;
+        const EdgeId e = out[rng() % out.size()];
+        path.push_back(e);
+        u = g->edge_destinations()[static_cast<std::size_t>(e)];
+        seen.insert(u);
+      }
+      for (EdgeId e = 0; e < g->num_edges(); ++e) {
+        if (g->edge_sources()[static_cast<std::size_t>(e)] == u && g->edge_destinations()[static_cast<std::size_t>(e)] == dst) {
+          path.push_back(e);
+          break;
+        }
+      }
+      return path;
+    };
+    std::vector<TunnelDemand> demands(1 + rng() % 4);
+    std::vector<Component> comps;
+    for (std::size_t d = 0; d < demands.size(); ++d) {
+      auto& dm = demands[d];
+      std::set<NodeId> heads;
+      const int nh = 1 + static_cast<int>(rng() % 2);
+      while (static_cast<int>(heads.size()) < nh) heads.insert(static_cast<NodeId>(rng() % inner));
+      dm.heads.assign(heads.begin(), heads.end());
+      for (std::size_t h = 0; h < dm.heads.size(); ++h) {
+        const int nt = 1 + static_cast<int>(rng() % 2);
+        for (int t = 0; t < nt; ++t) dm.tunnels.emplace_back(h, walk(dm.heads[h]), 1 + static_cast<Amount>(rng() % 3));
+        dm.injections.push_back(static_cast<Amount>(rng() % 13));
+      }
+      if (rng() % 3 == 0) {
+        std::set<EdgeId> black;
+        for (const auto& [h, es, w] : dm.tunnels) {
+          if (rng() % 2 == 0) black.insert(es[rng() % es.size()]);
+        }
+        dm.dark.assign(black.begin(), black.end());
+      }
+      // The components: per head, its tunnels' highest-averages amounts of its injection.
+      for (std::size_t h = 0; h < dm.heads.size(); ++h) {
+        Amounts w;
+        std::vector<std::size_t> ids;
+        for (std::size_t t = 0; t < dm.tunnels.size(); ++t) {
+          if (std::get<0>(dm.tunnels[t]) == h) {
+            ids.push_back(t);
+            w.push_back(std::get<2>(dm.tunnels[t]));
+          }
+        }
+        const auto split = ref::highest_averages(dm.injections[h], w);
+        for (std::size_t k = 0; k < ids.size(); ++k) {
+          const auto& [hh, es, ww] = dm.tunnels[ids[k]];
+          comps.push_back({split[k], es, {static_cast<int>(d), static_cast<int>(h), static_cast<int>(ids[k])},
+                           std::set<EdgeId>(dm.dark.begin(), dm.dark.end())});
+        }
+      }
+    }
+    Amounts cap(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+    const auto want = reference(comps, cap);
+    const auto b = build(*g, demands, dst);
+    std::vector<Amounts> injections;
+    for (const auto& dm : demands) injections.push_back(dm.injections);
+    const std::string where = "trial " + std::to_string(trial);
+    std::vector<ProgramFlow> got;
+    std::string error;
+    try {
+      got = joint(*g, b, injections);
+    } catch (const std::invalid_argument& e) {
+      error = e.what();
+    }
+    ASSERT_EQ(error, want.error) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, want.rounds) << where;
+    cyclic += detail::thread_lossy_counters().groups > 0 ? 1 : 0;
+#endif
+    errors += error.empty() ? 0 : 1;
+    if (!error.empty()) {
+      ++checked;
+      continue;
+    }
+    // Per component (in demand, then head, then tunnel order of the components list): its entry.
+    std::size_t c = 0;
+    std::map<EdgeId, std::set<int>> users;
+    for (std::size_t d = 0; d < demands.size(); ++d) {
+      const auto& dm = demands[d];
+      for (std::size_t h = 0; h < dm.heads.size(); ++h) {
+        for (std::size_t t = 0; t < dm.tunnels.size(); ++t) {
+          if (std::get<0>(dm.tunnels[t]) != h) continue;
+          const auto& f = got[d].entries[t];
+          const auto& es = std::get<1>(dm.tunnels[t]);
+          Pairs flows;
+          Pairs drops;
+          for (std::size_t j = 0; j < es.size(); ++j) {
+            if (want.carried[c][j] != 0) {
+              flows.emplace_back(es[j], want.carried[c][j]);
+              users[es[j]].insert(static_cast<int>(d));
+            }
+            if (want.arrival[c][j] != want.carried[c][j]) drops.emplace_back(es[j], want.arrival[c][j] - want.carried[c][j]);
+            dark += comps[c].dark.count(es[j]) != 0 && comps[c].offer > 0 ? 1 : 0;
+          }
+          std::sort(flows.begin(), flows.end());
+          std::sort(drops.begin(), drops.end());
+          EXPECT_EQ(f.assigned, comps[c].offer) << where << " component " << c;
+          EXPECT_EQ(f.delivered, want.delivered[c]) << where << " component " << c;
+          EXPECT_EQ(f.edge_flows, flows) << where << " component " << c;
+          EXPECT_EQ(f.edge_drops, drops) << where << " component " << c;
+          ++c;
+        }
+      }
+    }
+    crossings += std::any_of(users.begin(), users.end(), [](const auto& u) { return u.second.size() > 1; }) ? 1 : 0;
+    ++checked;
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("checked", checked);
+  RecordProperty("cyclic", cyclic);
+  RecordProperty("errors", errors);
+  RecordProperty("dark", dark);
+  RecordProperty("crossings", crossings);
+  EXPECT_EQ(checked, 3000);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_GT(cyclic, 20);  // not vacuous: groups iterated
+#endif
+  EXPECT_GT(dark, 100);
+  EXPECT_GT(crossings, 300);
+}
+
+// The cycle rule's errors across demands, against the reference: D-C2 on the two-barrier cycle
+// (A: X then Y, offer 1; B: Y then X, offer 2; V = 1, 2): period two at round 3; three barriers
+// that never settle (two demands of 1 and 2): the round limit after 64 * 3 rounds. Nothing returns.
+TEST(JointForwarding, CycleErrorsMatchTheReference) {
+  // CYC: e0 0->1 (X), e1 1->2, e2 1->5, e3 2->3 (Y), e4 3->0, e5 3->5, e6 4->0, e7 4->2.
+  const auto cyc = shared(make_graph(6, {{0, 1, 1, 1}, {1, 2, 1000, 1}, {1, 5, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1},
+                                         {3, 5, 1000, 1}, {4, 0, 1000, 1}, {4, 2, 1000, 1}}));
+  ASSERT_EQ(id_of_input(*cyc), (std::vector<EdgeId> {0, 1, 2, 3, 4, 5, 6, 7}));
+  const std::vector<EdgeId> t0 = {6, 0, 1, 3, 5};
+  const std::vector<EdgeId> t1 = {7, 3, 4, 0, 2};
+  const Amounts cap {1, 1000, 1000, 2, 1000, 1000, 1000, 1000};
+  const auto want = reference({{1, t0, {0, 0, 0}, {}}, {2, t1, {1, 0, 0}, {}}}, cap);
+  EXPECT_EQ(want.error, kPeriodTwo);
+  EXPECT_EQ(want.rounds, 3);
+  const auto b = build(*cyc, {{{4}, {1}, {{0, t0, 1}}, {}}, {{4}, {2}, {{0, t1, 1}}, {}}}, 5);
+  EXPECT_EQ(error_of([&] { (void)joint(*cyc, b, {{1}, {2}}); }), kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+  const auto lim = shared(make_graph(8, {{0, 1, 1, 1}, {1, 4, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1}, {3, 7, 1000, 1},
+                                         {4, 5, 1, 1}, {5, 2, 1000, 1}, {5, 7, 1000, 1}, {6, 0, 1000, 1}, {6, 2, 1000, 1}}));
+  ASSERT_EQ(id_of_input(*lim), (std::vector<EdgeId> {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}));
+  const std::vector<EdgeId> p0 = {8, 0, 1, 5, 6, 2, 4};
+  const std::vector<EdgeId> p1 = {9, 2, 3, 0, 1, 5, 7};
+  const Amounts lcap {1, 1000, 2, 1000, 1000, 1, 1000, 1000, 1000, 1000};
+  const auto limit = reference({{1, p0, {0, 0, 0}, {}}, {2, p1, {1, 0, 0}, {}}}, lcap);
+  EXPECT_EQ(limit.error, kRoundLimit);
+  EXPECT_EQ(limit.rounds, 192);
+  const auto lb = build(*lim, {{{6}, {1}, {{0, p0, 1}}, {}}, {{6}, {2}, {{0, p1, 1}}, {}}}, 7);
+  EXPECT_EQ(error_of([&] { (void)joint(*lim, lb, {{1}, {2}}); }), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 192);
+#endif
+}
+
+// ---------------------------------------------------------------- hand-derived cases
+
+// The demand level above tunnels: A has two unit tunnels on link 0 (capacity 1), B one tunnel; offers 2 and 2.
+// e0: H(1, (2, 2)) = (1, 0) by demand (A first), within A H(1, (1, 1)) = (1, 0): A's tunnel 0 gets
+// the unit (flat over tunnels H(1, (1, 1, 2)) would give it to B).
+TEST(JointForwarding, DemandLevelAboveTunnels) {
+  const auto g = shared(make_graph(2, {{0, 1, 1, 1}}));
+  const auto b = build(*g, {{{0}, {2}, {{0, {0}, 1}, {0, {0}, 1}}, {}}, {{0}, {2}, {{0, {0}, 1}}, {}}}, 1);
+  const auto got = joint(*g, b, {{2}, {2}});
+  EXPECT_EQ(got[0].entries[0].delivered, 1);
+  EXPECT_EQ(got[0].entries[1].delivered, 0);
+  EXPECT_EQ(got[1].entries[0].delivered, 0);
+  EXPECT_EQ(got[1].entries[0].edge_drops, (Pairs {{0, 2}}));
+  // The demand order is the given order: B first takes the unit.
+  const Amounts two {2};
+  const std::vector<detail::ForwardingDemand> swapped {{b.views[1].get(), two}, {b.views[0].get(), two}};
+  const auto other = detail::lossy(swapped, capacities(*g));
+  EXPECT_EQ(other[0].entries[0].delivered, 1);
+  EXPECT_EQ(other[1].delivered, 0);
+}
+
+// The demand level above sources: A's heads 1 and 2 (one unit each) against B's head 5 (2 units) on link 2
+// (capacity 1): H(1, (2, 2)) = (1, 0), within A H(1, (1, 1)) = (1, 0): head 1 delivers.
+TEST(JointForwarding, DemandLevelAboveSources) {
+  const auto g = shared(make_graph(6, {{1, 3, 100, 1}, {2, 3, 100, 1}, {3, 4, 1, 1}, {5, 3, 100, 1}}));
+  ASSERT_EQ(id_of_input(*g), (std::vector<EdgeId> {0, 1, 2, 3}));
+  const auto b = build(*g, {{{1, 2}, {1, 1}, {{0, {0, 2}, 1}, {1, {1, 2}, 1}}, {}}, {{5}, {2}, {{0, {3, 2}, 1}}, {}}}, 4);
+  const auto got = joint(*g, b, {{1, 1}, {2}});
+  EXPECT_EQ(got[0].entries[0].delivered, 1);
+  EXPECT_EQ(got[0].entries[1].delivered, 0);
+  EXPECT_EQ(got[1].delivered, 0);
+}
+
+// Link sums beyond 2^63: w = 2^62 - 1 per demand on one link; two, three and five
+// demands: (5, 5) of 10, (4, 3, 3), (2, 2, 2, 2, 2) and with capacity 11 (3, 2, 2, 2, 2) (the
+// extra unit to the first demand). Each drops the rest.
+TEST(JointForwarding, LinkSumsBeyond64Bits) {
+  const Amount w = kL62 - 1;
+  for (const auto& [n, cap, want] : std::vector<std::tuple<int, Amount, Amounts>> {
+           {2, 10, {5, 5}}, {3, 10, {4, 3, 3}}, {5, 10, {2, 2, 2, 2, 2}}, {5, 11, {3, 2, 2, 2, 2}}}) {
+    const auto g = shared(make_graph(2, {{0, 1, cap, 1}}));
+    std::vector<TunnelDemand> demands(static_cast<std::size_t>(n), TunnelDemand {{0}, {w}, {{0, {0}, 1}}, {}});
+    const auto b = build(*g, demands, 1);
+    const auto got = joint(*g, b, std::vector<Amounts>(static_cast<std::size_t>(n), Amounts {w}));
+    for (int d = 0; d < n; ++d) {
+      EXPECT_EQ(got[static_cast<std::size_t>(d)].delivered, want[static_cast<std::size_t>(d)]) << n << " demands, demand " << d;
+      EXPECT_EQ(got[static_cast<std::size_t>(d)].entries[0].edge_drops, (Pairs {{0, w - want[static_cast<std::size_t>(d)]}}));
+    }
+  }
+}
+
+// ---------------------------------------------------------------- pooled demands
+
+// A ShortestPaths program of `sources` to `dst` (pooled: one split context), prepared on a fresh
+// ledger of g.
+std::shared_ptr<const ForwardingProgram> pooled_program(const std::shared_ptr<const Graph>& g, const std::vector<NodeId>& sources,
+                                                        NodeId dst, RouteAllocation allocation = RouteAllocation::Equal) {
+  FlowLedger ledger(g);
+  FlowPolicy p(ledger, sources, std::vector<NodeId> {dst}, FlowPolicyConfig {.routing = shortest_paths(allocation), .admission = Admission::Lossy});
+  (void)p.replace(0);
+  return p.program();
+}
+
+bool same_flow(const ProgramFlow& a, const ProgramFlow& b, const std::string& where) {
+  EXPECT_EQ(a.admitted, b.admitted) << where;
+  EXPECT_EQ(a.offered, b.offered) << where;
+  EXPECT_EQ(a.source_drops, b.source_drops) << where;
+  EXPECT_EQ(a.delivered, b.delivered) << where;
+  EXPECT_EQ(a.offered_by_source, b.offered_by_source) << where;
+  EXPECT_EQ(a.source_drops_by_source, b.source_drops_by_source) << where;
+  EXPECT_EQ(a.entries.size(), b.entries.size()) << where;
+  for (std::size_t e = 0; e < std::min(a.entries.size(), b.entries.size()); ++e) {
+    EXPECT_EQ(a.entries[e].assigned, b.entries[e].assigned) << where << " entry " << e;
+    EXPECT_EQ(a.entries[e].delivered, b.entries[e].delivered) << where << " entry " << e;
+    EXPECT_EQ(a.entries[e].source_drops, b.entries[e].source_drops) << where << " entry " << e;
+    EXPECT_EQ(a.entries[e].edge_flows, b.entries[e].edge_flows) << where << " entry " << e;
+    EXPECT_EQ(a.entries[e].edge_drops, b.entries[e].edge_drops) << where << " entry " << e;
+  }
+  return !::testing::Test::HasFailure();
+}
+
+// One pooled demand: ShortestPaths EQUAL and WEIGHTED programs and from_dag programs of
+// three or four sources on random DAGs, with a random mask and random black holes, forwarded alone
+// on the joint evaluator, equal the pooled kernel's forwarding field by field (per head: injection,
+// source loss, delivery, carried and dropped per edge).
+TEST(JointForwarding, OnePooledDemandEqualsTheKernel) {
+  std::mt19937 rng(5101);
+  int checked = 0;
+  int attributed = 0;  // trials where some head both delivers and drops
+  int black = 0;
+  for (int trial = 0; trial < 400; ++trial) {
+    const std::int32_t n = 7;
+    const NodeId dst = n - 1;
+    std::vector<InEdge> rows;
+    for (NodeId u = 0; u < n; ++u) {
+      for (NodeId w = u + 1; w < n; ++w) {
+        if (rng() % 3 != 0) rows.push_back({u, w, static_cast<Amount>(rng() % 6), 1 + static_cast<Cost>(rng() % 2)});
+      }
+    }
+    const auto g = shared(make_graph(n, rows));
+    std::vector<NodeId> sources = {0, 1, 2};
+    if (rng() % 2 == 0) sources.push_back(3);
+    std::shared_ptr<const ForwardingProgram> prog;
+    const int kind = static_cast<int>(rng() % 3);
+    if (kind < 2) {
+      prog = pooled_program(g, sources, dst, kind == 0 ? RouteAllocation::Equal : RouteAllocation::Weighted);
+    } else {
+      try {
+        prog = ForwardingProgram::from_dag(*g, sources, std::vector<NodeId> {dst}, all_edges(*g), RouteOptions {});
+      } catch (const std::invalid_argument&) {
+        continue;
+      }
+    }
+    if (!prog || !detail::ProgramAccess::data(*prog).pools_source_inflows) continue;
+    std::shared_ptr<const Eligibility> mask;
+    if (rng() % 3 == 0) {
+      const std::vector<EdgeId> masked {static_cast<EdgeId>(rng() % g->num_edges())};
+      mask = std::make_shared<const Eligibility>(g->eligibility({}, masked));
+    }
+    std::shared_ptr<const Eligibility> dark;
+    if (rng() % 2 == 0) {
+      std::vector<EdgeId> es {static_cast<EdgeId>(rng() % g->num_edges())};
+      if (rng() % 2 == 0) es.push_back(static_cast<EdgeId>(rng() % g->num_edges()));
+      std::vector<NodeId> nodes;
+      if (rng() % 4 == 0) nodes.push_back(sources[rng() % sources.size()]);
+      dark = std::make_shared<const Eligibility>(g->eligibility(nodes, es));
+    }
+    const auto view = detail::make_forwarding_view(*g, prog, mask.get(), vec(prog->destinations()), dark.get());
+    if (!view.pooled) continue;
+    Amounts inject(view.num_sources());
+    for (auto& x : inject) x = static_cast<Amount>(rng() % 9);
+    const auto free = capacities(*g);
+    const auto kernel = detail::lossy(view, free, inject);
+    const detail::ForwardingDemand one {&view, inject};
+    const auto got = detail::lossy(std::span<const detail::ForwardingDemand>(&one, 1), free);
+    ASSERT_EQ(got.size(), 1U);
+    if (!same_flow(got.front(), kernel, "trial " + std::to_string(trial))) return;
+    for (const auto& f : kernel.entries) attributed += f.delivered > 0 && !f.edge_drops.empty() ? 1 : 0;
+    black += dark ? 1 : 0;
+    ++checked;
+  }
+  RecordProperty("checked", checked);
+  EXPECT_GT(checked, 200);
+  EXPECT_GT(attributed, 50);
+  EXPECT_GT(black, 80);
+}
+
+// An independent sweep of pooled and tunnel demands on one view: from zero carried, every sweep
+// recomputes every arrival from the previous carried amounts (a tunnel's hop from its previous hop;
+// a pooled router splits its heads' inflows' total by round robin or highest averages over its
+// members' frozen weights and attributes each member's amount to the heads by highest averages over
+// their remaining inflows, member by member) and every link's carried amounts by the loss rule over its
+// non-dark arrivals (labels demand, head, entry); a dark arrival carries 0. It stops when a sweep
+// changes nothing. When the dependencies are acyclic it reaches A+'s answer (depth by depth). It
+// reads the plans' structure only; the splits and the rule are its own.
+struct SweepPooled {
+  int demand {0};
+  const PreparedRoute* plan {nullptr};
+  std::vector<std::int32_t> root_positions;  // per head (-1: no member)
+  Amounts shares;                           // per head
+  std::set<EdgeId> dark;
+};
+struct SweepTunnel {
+  int demand {0};
+  int head {0};
+  int index {0};
+  Amount share {0};
+  std::vector<EdgeId> route;
+  std::set<EdgeId> dark;
+};
+struct SweepResult {
+  bool settled {false};
+  std::vector<std::vector<std::vector<Amount>>> pooled_carried;  // per pooled demand, member, head
+  std::vector<std::vector<std::vector<Amount>>> pooled_arrival;
+  std::vector<Amounts> tunnel_carried;
+  std::vector<Amounts> tunnel_arrival;
+  std::vector<Amounts> pooled_delivered;  // per pooled demand, head
+};
+
+SweepResult sweep(const std::vector<SweepPooled>& pooled, const std::vector<SweepTunnel>& tunnels, const Amounts& cap) {
+  SweepResult r;
+  r.pooled_carried.resize(pooled.size());
+  r.pooled_arrival.resize(pooled.size());
+  for (std::size_t q = 0; q < pooled.size(); ++q) {
+    const auto M = pooled[q].plan->forwarding_edges.size();
+    r.pooled_carried[q].assign(M, Amounts(pooled[q].shares.size(), 0));
+    r.pooled_arrival[q] = r.pooled_carried[q];
+  }
+  r.tunnel_carried.resize(tunnels.size());
+  r.tunnel_arrival.resize(tunnels.size());
+  for (std::size_t t = 0; t < tunnels.size(); ++t) {
+    r.tunnel_carried[t].assign(tunnels[t].route.size(), 0);
+    r.tunnel_arrival[t] = r.tunnel_carried[t];
+  }
+  for (int round = 0; round < 400; ++round) {
+    // Arrivals from the previous carried amounts.
+    for (std::size_t q = 0; q < pooled.size(); ++q) {
+      const auto& d = pooled[q];
+      const auto& plan = *d.plan;
+      const std::size_t P = plan.topological_order.size();
+      const std::size_t k = d.shares.size();
+      std::vector<Amounts> in(P, Amounts(k, 0));
+      for (std::size_t h = 0; h < k; ++h) {
+        if (d.root_positions[h] >= 0) in[static_cast<std::size_t>(d.root_positions[h])][h] += d.shares[h];
+      }
+      for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+        for (std::size_t h = 0; h < k; ++h) in[static_cast<std::size_t>(plan.edge_destination_positions[m])][h] += r.pooled_carried[q][m][h];
+      }
+      for (std::size_t pos = 0; pos < P; ++pos) {
+        if (plan.is_destination[pos] != 0) continue;
+        const auto b = static_cast<std::size_t>(plan.outgoing_begin[pos]);
+        const auto e = static_cast<std::size_t>(plan.outgoing_end[pos]);
+        Amount total = 0;
+        for (Amount x : in[pos]) total += x;
+        Amounts part;
+        if (plan.allocation == RouteAllocation::Weighted) {
+          part = ref::highest_averages(total, Amounts(plan.weights.begin() + static_cast<std::ptrdiff_t>(b), plan.weights.begin() + static_cast<std::ptrdiff_t>(e)));
+        } else {
+          part = ref::round_robin(total, e - b);
+        }
+        if (part.empty()) part.assign(e - b, 0);
+        Amounts remaining = in[pos];
+        for (std::size_t m = b; m < e; ++m) {
+          auto row = ref::highest_averages(part[m - b], remaining);
+          if (row.empty()) row.assign(k, 0);
+          for (std::size_t h = 0; h < k; ++h) {
+            remaining[h] -= row[h];
+            r.pooled_arrival[q][m][h] = row[h];
+          }
+        }
+      }
+    }
+    for (std::size_t t = 0; t < tunnels.size(); ++t) {
+      for (std::size_t j = 0; j < tunnels[t].route.size(); ++j) r.tunnel_arrival[t][j] = j == 0 ? tunnels[t].share : r.tunnel_carried[t][j - 1];
+    }
+    // Every link's rule over its non-dark arrivals, in (demand, head, entry) order.
+    struct Member {
+      std::tuple<int, int, int> label;
+      Amount* carried;
+      Amount arrival;
+    };
+    std::map<EdgeId, std::vector<Member>> links;
+    auto next_pc = r.pooled_carried;
+    auto next_tc = r.tunnel_carried;
+    for (std::size_t q = 0; q < pooled.size(); ++q) {
+      const auto& plan = *pooled[q].plan;
+      for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+        const EdgeId e = plan.forwarding_edges[m];
+        for (std::size_t h = 0; h < pooled[q].shares.size(); ++h) {
+          if (pooled[q].dark.count(e) != 0) {
+            next_pc[q][m][h] = 0;
+            continue;
+          }
+          links[e].push_back({{pooled[q].demand, static_cast<int>(h), 0}, &next_pc[q][m][h], r.pooled_arrival[q][m][h]});
+        }
+      }
+    }
+    for (std::size_t t = 0; t < tunnels.size(); ++t) {
+      for (std::size_t j = 0; j < tunnels[t].route.size(); ++j) {
+        const EdgeId e = tunnels[t].route[j];
+        if (tunnels[t].dark.count(e) != 0) {
+          next_tc[t][j] = 0;
+          continue;
+        }
+        links[e].push_back({{tunnels[t].demand, tunnels[t].head, tunnels[t].index}, &next_tc[t][j], r.tunnel_arrival[t][j]});
+      }
+    }
+    for (auto& [e, members] : links) {
+      std::stable_sort(members.begin(), members.end(), [](const Member& a, const Member& b) { return a.label < b.label; });
+      Amounts w;
+      std::vector<std::tuple<int, int, int>> labels;
+      Amount sum = 0;
+      for (const auto& x : members) {
+        w.push_back(x.arrival);
+        labels.push_back(x.label);
+        sum += x.arrival;
+      }
+      const auto c = hierarchical(std::min(cap[static_cast<std::size_t>(e)], sum), w, labels);
+      for (std::size_t i = 0; i < members.size(); ++i) *members[i].carried = c[i];
+    }
+    const bool same = next_pc == r.pooled_carried && next_tc == r.tunnel_carried && round > 0;
+    r.pooled_carried = std::move(next_pc);
+    r.tunnel_carried = std::move(next_tc);
+    if (same) {
+      r.settled = true;
+      break;
+    }
+  }
+  r.pooled_delivered.resize(pooled.size());
+  for (std::size_t q = 0; q < pooled.size(); ++q) {
+    const auto& plan = *pooled[q].plan;
+    r.pooled_delivered[q].assign(pooled[q].shares.size(), 0);
+    for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+      if (plan.is_destination[static_cast<std::size_t>(plan.edge_destination_positions[m])] == 0) continue;
+      for (std::size_t h = 0; h < pooled[q].shares.size(); ++h) r.pooled_delivered[q][h] += r.pooled_carried[q][m][h];
+    }
+  }
+  return r;
+}
+
+// Random pooled demands (ShortestPaths EQUAL or WEIGHTED, two or three sources) beside random
+// tunnel demands on random DAGs, each demand with its own black holes, in random creation orders,
+// against the sweep wherever the evaluation needs no rounds: every head's and tunnel's arrivals,
+// carried amounts and deliveries.
+TEST(JointForwarding, PooledAndTunnelDemandsMatchASweep) {
+  std::mt19937 rng(77);
+  int checked = 0;
+  int shared_pooled = 0;  // trials where a pooled member carries another demand too
+  int attributed = 0;     // trials where a pooled head drops while another delivers
+  for (int trial = 0; trial < 600; ++trial) {
+    const std::int32_t n = 7;
+    const NodeId dst = n - 1;
+    std::vector<InEdge> rows;
+    for (NodeId u = 0; u < n; ++u) {
+      for (NodeId w = u + 1; w < n; ++w) {
+        if (rng() % 3 != 0) rows.push_back({u, w, static_cast<Amount>(rng() % 5), 1 + static_cast<Cost>(rng() % 2)});
+      }
+    }
+    const auto g = shared(make_graph(n, rows));
+    const Amounts cap(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+    // Each demand: pooled (kind 0) or tunnels (kind 1).
+    const int D = 2 + static_cast<int>(rng() % 3);
+    std::vector<std::shared_ptr<const ForwardingProgram>> programs;
+    std::vector<std::shared_ptr<const Eligibility>> black;
+    std::vector<std::unique_ptr<detail::ForwardingView>> views;
+    std::vector<Amounts> injections;
+    std::vector<SweepPooled> sp;
+    std::vector<SweepTunnel> st;
+    std::vector<int> kind;
+    bool skip = false;
+    for (int d = 0; d < D && !skip; ++d) {
+      std::vector<EdgeId> dark_edges;
+      if (rng() % 3 == 0) dark_edges.push_back(static_cast<EdgeId>(rng() % g->num_edges()));
+      black.push_back(dark_edges.empty() ? nullptr : std::make_shared<const Eligibility>(g->eligibility({}, dark_edges)));
+      const std::set<EdgeId> dark_set(dark_edges.begin(), dark_edges.end());
+      if (rng() % 2 == 0) {
+        std::vector<NodeId> sources = {0, 1};
+        if (rng() % 2 == 0) sources.push_back(2);
+        programs.push_back(pooled_program(g, sources, dst, rng() % 2 == 0 ? RouteAllocation::Equal : RouteAllocation::Weighted));
+        views.push_back(std::make_unique<detail::ForwardingView>(
+            detail::make_forwarding_view(*g, programs.back(), nullptr, std::vector<NodeId> {dst}, black.back().get())));
+        if (!views.back()->pooled) {
+          skip = true;
+          break;
+        }
+        Amounts inj(views.back()->num_sources());
+        for (auto& x : inj) x = static_cast<Amount>(rng() % 9);
+        SweepPooled q;
+        q.demand = d;
+        q.plan = views.back()->prepared_route(0).get();
+        for (std::size_t h = 0; h < inj.size(); ++h) {
+          const auto e = static_cast<std::size_t>(views.back()->entries_for_source(h).front());
+          const auto rr = views.back()->context_source_index(e);
+          q.root_positions.push_back(rr < 0 ? -1 : q.plan->source_positions[static_cast<std::size_t>(rr)]);
+        }
+        q.shares = inj;
+        q.dark = dark_set;
+        sp.push_back(q);
+        injections.push_back(inj);
+        kind.push_back(0);
+        continue;
+      }
+      // One or two tunnels from a random head to dst along random paths of the DAG.
+      const NodeId head = static_cast<NodeId>(rng() % 3);
+      std::vector<RouteDefinition> routes;
+      const int nt = 1 + static_cast<int>(rng() % 2);
+      Amounts weights;
+      std::vector<std::vector<EdgeId>> paths;
+      for (int t = 0; t < nt; ++t) {
+        std::vector<EdgeId> path;
+        NodeId u = head;
+        while (u != dst) {
+          std::vector<EdgeId> out;
+          for (EdgeId e = 0; e < g->num_edges(); ++e) {
+            if (g->edge_sources()[static_cast<std::size_t>(e)] == u) out.push_back(e);
+          }
+          if (out.empty()) break;
+          const EdgeId e = out[rng() % out.size()];
+          path.push_back(e);
+          u = g->edge_destinations()[static_cast<std::size_t>(e)];
+        }
+        if (u != dst || path.empty()) continue;
+        std::vector<std::vector<EdgeId>> hops;
+        for (EdgeId e : path) hops.push_back({e});
+        weights.push_back(1 + static_cast<Amount>(rng() % 3));
+        routes.push_back(RouteDefinition {head, std::make_shared<const Path>(*g, hops), weights.back()});
+        paths.push_back(path);
+      }
+      if (routes.empty()) {
+        skip = true;
+        break;
+      }
+      programs.push_back(ForwardingProgram::from_routes(*g, std::vector<NodeId> {head}, std::vector<NodeId> {dst}, routes));
+      views.push_back(std::make_unique<detail::ForwardingView>(
+          detail::make_forwarding_view(*g, programs.back(), nullptr, std::vector<NodeId> {dst}, black.back().get())));
+      const Amount x = static_cast<Amount>(rng() % 9);
+      injections.push_back({x});
+      const auto split = ref::highest_averages(x, weights);
+      for (std::size_t t = 0; t < paths.size(); ++t) st.push_back({d, 0, static_cast<int>(t), split[t], paths[t], dark_set});
+      kind.push_back(1);
+    }
+    if (skip) continue;
+    std::vector<detail::ForwardingDemand> demands;
+    for (std::size_t d = 0; d < views.size(); ++d) demands.push_back({views[d].get(), injections[d]});
+    const auto got = detail::lossy(demands, capacities(*g));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    if (detail::thread_lossy_counters().groups != 0) continue;
+#endif
+    const auto want = sweep(sp, st, cap);
+    ASSERT_TRUE(want.settled) << "trial " << trial;
+    const std::string where = "trial " + std::to_string(trial);
+    std::size_t qi = 0;
+    std::size_t ti = 0;
+    std::map<EdgeId, std::set<int>> users;
+    for (std::size_t d = 0; d < views.size(); ++d) {
+      if (kind[d] == 0) {
+        const auto& plan = *sp[qi].plan;
+        bool drops = false;
+        bool delivers = false;
+        for (std::size_t h = 0; h < sp[qi].shares.size(); ++h) {
+          const auto& f = got[d].entries[static_cast<std::size_t>(views[d]->entries_for_source(h).front())];
+          Pairs flows;
+          Pairs dr;
+          for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) {
+            const Amount c = want.pooled_carried[qi][m][h];
+            const Amount a = want.pooled_arrival[qi][m][h];
+            if (c != 0) {
+              flows.emplace_back(plan.forwarding_edges[m], c);
+              users[plan.forwarding_edges[m]].insert(static_cast<int>(d));
+            }
+            if (a != c) dr.emplace_back(plan.forwarding_edges[m], a - c);
+          }
+          EXPECT_EQ(f.edge_flows, flows) << where << " demand " << d << " head " << h;
+          EXPECT_EQ(f.edge_drops, dr) << where << " demand " << d << " head " << h;
+          EXPECT_EQ(f.delivered, want.pooled_delivered[qi][h]) << where << " demand " << d << " head " << h;
+          drops = drops || !dr.empty();
+          delivers = delivers || f.delivered > 0;
+        }
+        attributed += drops && delivers ? 1 : 0;
+        ++qi;
+        continue;
+      }
+      for (std::size_t t = 0; ti < st.size() && st[ti].demand == static_cast<int>(d); ++t, ++ti) {
+        const auto& f = got[d].entries[t];
+        Pairs flows;
+        Pairs dr;
+        for (std::size_t j = 0; j < st[ti].route.size(); ++j) {
+          if (want.tunnel_carried[ti][j] != 0) {
+            flows.emplace_back(st[ti].route[j], want.tunnel_carried[ti][j]);
+            users[st[ti].route[j]].insert(static_cast<int>(d));
+          }
+          if (want.tunnel_arrival[ti][j] != want.tunnel_carried[ti][j]) dr.emplace_back(st[ti].route[j], want.tunnel_arrival[ti][j] - want.tunnel_carried[ti][j]);
+        }
+        std::sort(flows.begin(), flows.end());
+        std::sort(dr.begin(), dr.end());
+        EXPECT_EQ(f.edge_flows, flows) << where << " demand " << d << " tunnel " << t;
+        EXPECT_EQ(f.edge_drops, dr) << where << " demand " << d << " tunnel " << t;
+        EXPECT_EQ(f.delivered, want.tunnel_carried[ti].empty() ? st[ti].share : want.tunnel_carried[ti].back()) << where;
+      }
+    }
+    for (const auto& q : sp) {
+      for (EdgeId e : q.plan->forwarding_edges) {
+        if (users[e].size() > 1) {
+          ++shared_pooled;
+          break;
+        }
+      }
+    }
+    ++checked;
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("checked", checked);
+  RecordProperty("shared_pooled", shared_pooled);
+  RecordProperty("attributed", attributed);
+  EXPECT_GT(checked, 250);
+  EXPECT_GT(shared_pooled, 100);
+  EXPECT_GT(attributed, 50);
+}
+
+// A pooled demand shares a link with a tunnel. G7: e0 0->2, e1 1->2, e2 2->3 (1), e3 2->3, e4
+// 4->2 (all others wide); A pooled sources {0, 1} -> 3 (RR(2, 2) = (1, 1)), B tunnel [e4, e2] (2).
+// Node 2 splits A's 2 as (1, 1) over e2, e3; e2: A 1, B 2, capacity 1: by demand H(1, (1, 2)) =
+// (0, 1); e3 carries A's 1. Attribution at node 2: e2's unit to source 0 (H(1, (1, 1))), e3's to
+// source 1.
+TEST(JointForwarding, PooledDemandSharesALink) {
+  const auto g = shared(make_graph(5, {{0, 2, 100, 1}, {1, 2, 100, 1}, {2, 3, 1, 1}, {2, 3, 100, 1}, {4, 2, 100, 1}}));
+  ASSERT_EQ(id_of_input(*g), (std::vector<EdgeId> {0, 1, 2, 3, 4}));
+  const auto a = pooled_program(g, {0, 1}, 3);
+  ASSERT_TRUE(detail::ProgramAccess::data(*a).pools_source_inflows);
+  const auto va = detail::make_forwarding_view(*g, a, nullptr, std::vector<NodeId> {3}, nullptr);
+  const auto bp = build(*g, {{{4}, {2}, {{0, {4, 2}, 1}}, {}}}, 3);
+  const Amounts ia {1, 1};
+  const Amounts ib {2};
+  const std::vector<detail::ForwardingDemand> demands {{&va, ia}, {bp.views[0].get(), ib}};
+  const auto got = detail::lossy(demands, capacities(*g));
+  EXPECT_EQ(got[0].delivered, 1);
+  EXPECT_EQ(got[0].entries[0].delivered, 0);
+  EXPECT_EQ(got[0].entries[0].edge_flows, (Pairs {{0, 1}}));
+  EXPECT_EQ(got[0].entries[0].edge_drops, (Pairs {{2, 1}}));
+  EXPECT_EQ(got[0].entries[1].delivered, 1);
+  EXPECT_EQ(got[0].entries[1].edge_flows, (Pairs {{1, 1}, {3, 1}}));
+  EXPECT_TRUE(got[0].entries[1].edge_drops.empty());
+  EXPECT_EQ(got[1].delivered, 1);
+  EXPECT_EQ(got[1].entries[0].edge_drops, (Pairs {{2, 1}}));
+}
+
+// Every root is an injection. Chain 0->1->2->3 of capacity 2, a pooled demand of sources {0,
+// 1, 2} with shares (2, 2, 2): arrivals (2, 4, 4), carries (2, 2, 2); neither (e0, e1) nor (e1, e2)
+// is a transparent pair (nodes 1 and 2 inject). Per source: e1 carries H(2, (2, 2)) = (1, 1), e2
+// H(2, (1, 1, 2)) = (1, 0, 1): delivered (1, 0, 1). Alone and beside a demand on a disjoint link,
+// equal to the kernel.
+TEST(JointForwarding, PooledRootsBlockSerialPairs) {
+  const auto g = shared(make_graph(6, {{0, 1, 2, 1}, {1, 2, 2, 1}, {2, 3, 2, 1}, {4, 5, 1, 1}}));
+  const auto a = pooled_program(g, {0, 1, 2}, 3);
+  const auto va = detail::make_forwarding_view(*g, a, nullptr, std::vector<NodeId> {3}, nullptr);
+  const Amounts ia {2, 2, 2};
+  const auto kernel = detail::lossy(va, capacities(*g), ia);
+  EXPECT_EQ(kernel.delivered, 2);
+  const detail::ForwardingDemand alone {&va, ia};
+  const auto one = detail::lossy(std::span<const detail::ForwardingDemand>(&alone, 1), capacities(*g));
+  same_flow(one.front(), kernel, "alone");
+  EXPECT_EQ(one.front().entries[0].delivered, 1);
+  EXPECT_EQ(one.front().entries[1].delivered, 0);
+  EXPECT_EQ(one.front().entries[2].delivered, 1);
+  const auto other = build(*g, {{{4}, {3}, {{0, {3}, 1}}, {}}}, 5);
+  const Amounts io {3};
+  const std::vector<detail::ForwardingDemand> both {{&va, ia}, {other.views[0].get(), io}};
+  const auto two = detail::lossy(both, capacities(*g));
+  same_flow(two.front(), kernel, "beside another demand");
+  EXPECT_EQ(two[1].delivered, 1);
+}
+
+// A head whose share is 0 injects nothing and carries nothing (its occurrences are dead), and a dark
+// member's traffic goes no further. Chain 0->1->2->3, a pooled demand of sources {0, 1, 2}, four
+// routers. Capacities (1, 1, 1), shares (2, 0, 0): only e0 can drop and e1, e2 continue it (nodes 1
+// and 2 inject nothing), so one barrier: five events (hooks: the event limit 5 is met). Capacities
+// (2, 1, 2), shares (0, 2, 0): e1's first occurrence is source 0's, which carries nothing, yet e1
+// waits for source 1's arrival: delivered 1, source 1 drops 1 on e1. Capacities (1, 1, 1), shares
+// (2, 0, 0), e0 black-holed: source 0's traffic dies on e0, so e1 and e2 can carry nothing: no
+// barrier, four events. Each equals the kernel, and the program of its one live source alone
+// (the same plan without the heads that carry nothing): that source's amounts and (hooks) the
+// links that wait, the groups and the dependency arcs.
+TEST(JointForwarding, ZeroShareHeadsOfAPooledDemand) {
+  struct Restore {
+    ~Restore() {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      detail::thread_forwarding_limits() = {};
+#endif
+    }
+  } restore;
+  struct Case {
+    Amount v1;
+    Amounts shares;
+    bool black;
+    std::int64_t events;
+    Amounts delivered;
+  };
+  for (const auto& c : {Case {1, {2, 0, 0}, false, 5, {1, 0, 0}}, Case {1, {0, 2, 0}, false, 5, {0, 1, 0}},
+                        Case {1, {2, 0, 0}, true, 4, {0, 0, 0}}}) {
+    const Amount v0 = c.shares[1] != 0 ? 2 : 1;
+    const auto g = shared(make_graph(4, {{0, 1, v0, 1}, {1, 2, c.v1, 1}, {2, 3, v0, 1}}));
+    const auto a = pooled_program(g, {0, 1, 2}, 3);
+    const auto black = c.black ? std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {0})) : nullptr;
+    const auto va = detail::make_forwarding_view(*g, a, nullptr, std::vector<NodeId> {3}, black.get());
+    const auto kernel = detail::lossy(va, capacities(*g), c.shares);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    detail::thread_forwarding_limits()[static_cast<std::size_t>(detail::ForwardingCounter::Event)] = c.events;
+#endif
+    const detail::ForwardingDemand alone {&va, c.shares};
+    const auto one = detail::lossy(std::span<const detail::ForwardingDemand>(&alone, 1), capacities(*g));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    detail::thread_forwarding_limits() = {};
+#endif
+    const std::string where = "shares " + std::to_string(c.shares[0]) + std::to_string(c.shares[1]) + (c.black ? " black" : "");
+    same_flow(one.front(), kernel, where);
+    for (std::size_t h = 0; h < 3; ++h) EXPECT_EQ(one.front().entries[h].delivered, c.delivered[h]) << where << " source " << h;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const auto structure = std::make_tuple(detail::thread_lossy_counters().groups, detail::thread_lossy_counters().barriers,
+                                           detail::thread_lossy_counters().dependencies);
+#endif
+    const std::size_t live = c.shares[0] != 0 ? 0 : 1;
+    const auto b = pooled_program(g, {static_cast<NodeId>(live)}, 3);
+    const auto vb = detail::make_forwarding_view(*g, b, nullptr, std::vector<NodeId> {3}, black.get());
+    const Amounts ib {c.shares[live]};
+    const detail::ForwardingDemand only {&vb, ib};
+    const auto lone = detail::lossy(std::span<const detail::ForwardingDemand>(&only, 1), capacities(*g));
+    EXPECT_EQ(one.front().entries[live].delivered, lone.front().entries[0].delivered) << where;
+    EXPECT_EQ(one.front().entries[live].edge_flows, lone.front().entries[0].edge_flows) << where;
+    EXPECT_EQ(one.front().entries[live].edge_drops, lone.front().entries[0].edge_drops) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(structure, std::make_tuple(detail::thread_lossy_counters().groups, detail::thread_lossy_counters().barriers,
+                                         detail::thread_lossy_counters().dependencies))
+        << where;
+#endif
+  }
+}
+
+// Serial normalization reads only what can carry something: a router's merges and branches are
+// those of its live members. Each case against the same program without its dead member, pooled
+// (from_dag) and not (the DAG route beside a tunnel of weight 0), on links of capacity 0 that drop
+// everything (so every link with traffic can drop, and a link that passes its predecessor's traffic
+// through is no barrier): the delivery and (hooks) the links that wait, the groups and the arcs.
+// - Dead branch: e0 0->1, e1 1->2, e2 1->3 (capacity 9); one unit, round robin sends it to e1, so
+//   e2 carries nothing and e0, e1 stay a pair: one barrier, e0.
+// - Dead merge in one split route: e0 0->1 and e1 0->2 (capacity 9), e2 1->3, e3 2->3, e4 3->4; one
+//   unit takes e0 and e2, so e1 and e3 carry nothing and e2, e4 stay a pair: one barrier, e2.
+// - Dead merge of a pooled source: e0 0->2 (capacity 9), e1 1->2, e2 2->3; sources 0 and 1. Source 0's
+//   share is 0, or its 1 dies on e0, its own black hole (its router arc stays: one more arc); e1, e2
+//   stay a pair: one barrier, e1.
+TEST(JointForwarding, DeadBranchesAndMergesKeepPairs) {
+  struct Seen {
+    Amount delivered {0};
+    std::vector<EdgeId> barriers;
+    std::int64_t groups {-1};
+    std::int64_t dependencies {-1};
+  };
+  auto run = [](const std::shared_ptr<const Graph>& g, const std::shared_ptr<const ForwardingProgram>& prog, const Amounts& inject,
+                std::vector<NodeId> dests, const std::vector<EdgeId>& black) {
+    const auto holes = black.empty() ? nullptr : std::make_shared<const Eligibility>(g->eligibility({}, black));
+    const auto view = detail::make_forwarding_view(*g, prog, nullptr, dests, holes.get());
+    const detail::ForwardingDemand demand {&view, inject};
+    const auto out = detail::lossy(std::span<const detail::ForwardingDemand>(&demand, 1), capacities(*g));
+    Seen seen {out.front().delivered, {}, -1, -1};
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    seen.barriers = detail::thread_lossy_counters().barriers;
+    seen.groups = detail::thread_lossy_counters().groups;
+    seen.dependencies = detail::thread_lossy_counters().dependencies;
+#endif
+    return seen;
+  };
+  // A program of one DAG route from `source`, pooled or beside a weight-0 tunnel over `path`.
+  auto program = [](const std::shared_ptr<const Graph>& g, NodeId source, const std::vector<NodeId>& dests, const std::vector<EdgeId>& members,
+                    bool pooled, const std::vector<EdgeId>& path) {
+    const NodeId s[1] = {source};
+    if (pooled) return ForwardingProgram::from_dag(*g, s, dests, dag_of(*g, members), RouteOptions {});
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : path) hops.push_back({e});
+    const std::vector<RouteDefinition> defs {RouteDefinition {source, dag_of(*g, members), 1},
+                                             RouteDefinition {source, std::make_shared<const Path>(*g, hops), 0}};
+    return ForwardingProgram::from_routes(*g, s, dests, defs);
+  };
+  auto expect_same = [](const Seen& with, const Seen& without, std::int64_t extra_arcs, const std::string& where) {
+    EXPECT_EQ(with.delivered, without.delivered) << where;
+    EXPECT_EQ(with.barriers, without.barriers) << where;
+    EXPECT_EQ(with.groups, without.groups) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(with.dependencies, without.dependencies + extra_arcs) << where;
+#else
+    (void)extra_arcs;
+#endif
+  };
+  for (bool pooled : {true, false}) {
+    const std::string kind = pooled ? "pooled" : "not pooled";
+    {
+      const auto g = shared(make_graph(4, {{0, 1, 0, 1}, {1, 2, 0, 1}, {1, 3, 9, 1}}));
+      const auto id = id_of_input(*g);
+      const auto with = run(g, program(g, 0, {2, 3}, {id[0], id[1], id[2]}, pooled, {id[0], id[1]}), {1}, {2, 3}, {});
+      const auto without = run(g, program(g, 0, {2}, {id[0], id[1]}, pooled, {id[0], id[1]}), {1}, {2}, {});
+      expect_same(with, without, 0, "dead branch, " + kind);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      EXPECT_EQ(with.barriers, (std::vector<EdgeId> {id[0]})) << kind;
+#endif
+    }
+    {
+      const auto g = shared(make_graph(5, {{0, 1, 9, 1}, {0, 2, 9, 1}, {1, 3, 0, 1}, {2, 3, 0, 1}, {3, 4, 0, 1}}));
+      const auto id = id_of_input(*g);
+      const std::vector<EdgeId> path {id[0], id[2], id[4]};
+      const auto with = run(g, program(g, 0, {4}, {id[0], id[1], id[2], id[3], id[4]}, pooled, path), {1}, {4}, {});
+      const auto without = run(g, program(g, 0, {4}, path, pooled, path), {1}, {4}, {});
+      expect_same(with, without, 0, "dead merge in one split route, " + kind);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      EXPECT_EQ(with.barriers, (std::vector<EdgeId> {id[2]})) << kind;
+#endif
+    }
+  }
+  const auto g = shared(make_graph(4, {{0, 2, 9, 1}, {1, 2, 0, 1}, {2, 3, 0, 1}}));
+  const auto id = id_of_input(*g);
+  const NodeId both[2] = {0, 1};
+  const NodeId live[1] = {1};
+  const NodeId d[1] = {3};
+  const auto two = ForwardingProgram::from_dag(*g, both, d, dag_of(*g, {id[0], id[1], id[2]}), RouteOptions {});
+  const auto without = run(g, ForwardingProgram::from_dag(*g, live, d, dag_of(*g, {id[1], id[2]}), RouteOptions {}), {1}, {3}, {});
+  expect_same(run(g, two, {0, 1}, {3}, {}), without, 0, "dead merge of a zero-share source");
+  expect_same(run(g, two, {1, 1}, {3}, {id[0]}), without, 1, "dead merge of a black-holed source");
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(without.barriers, (std::vector<EdgeId> {id[1]}));
+#endif
+}
+
+// Adding an element that can carry nothing changes nothing, on every path of the rule: random small
+// graphs with cycles (six inner nodes, each with an exit to the destination),
+// two to four demands that are tunnels, split routes (a DAG route beside a tunnel of weight 0) or
+// pooled contexts (from_dag over two sources), each over one or two random walks of up to four inner
+// links, and one added element:
+// - a tunnel whose offer is 0;
+// - a tunnel behind its own black hole (against the tunnel cut after its black hole);
+// - a pooled source whose share is 0, its walk merging into its demand's DAG;
+// - such a source behind its own black hole (its black-holed first link keeps one router arc);
+// - a branch that round robin leaves empty (one unit at its root, the branch on the higher EdgeId),
+//   its walk merging back or reaching the destination, pooled and not;
+// - a source of share 0 inside a demand: a tunnel or a DAG route of a new head, or a pooled source
+//   on the demand's DAG (its root inside a chain).
+// One demand in a quarter of the draws; in half of those the element joins that demand (the
+// scalar path).
+// With and without the element: every demand's delivery and carried amounts per link, the drops of
+// every demand whose own traffic is unchanged, the error, and (hooks) the rounds, the groups, the
+// links that wait and the dependency arcs.
+TEST(JointForwarding, DeadElementsChangeNothingOnEveryPath) {
+  std::mt19937 rng(20261021);
+  const NodeId inner = 6;
+  const NodeId dst = inner;
+  struct Part {
+    std::shared_ptr<const ForwardingProgram> prog;
+    std::shared_ptr<const Eligibility> black;
+    Amounts inject;
+  };
+  struct Seen {
+    std::string error;
+    Amounts delivered;
+    std::vector<std::map<EdgeId, Amount>> carried;
+    std::vector<std::map<EdgeId, Amount>> drops;
+    std::int64_t rounds {-1};
+    std::int64_t groups {-1};
+    std::vector<EdgeId> barriers;
+    std::int64_t dependencies {-1};
+  };
+  std::array<int, 7> kinds {};
+  int checked = 0;
+  int skipped = 0;
+  int cyclic = 0;
+  int errors = 0;
+  for (int trial = 0; trial < 8000; ++trial) {
+    std::vector<InEdge> rows;
+    for (NodeId u = 0; u < inner; ++u) {
+      for (NodeId w = 0; w < inner; ++w) {
+        if (u != w && rng() % 2 == 0) rows.push_back({u, w, static_cast<Amount>(rng() % 4), 1});
+      }
+      rows.push_back({u, dst, static_cast<Amount>(1 + rng() % 5), 1});
+    }
+    const auto g = shared(make_graph(inner + 1, rows));
+    std::vector<std::vector<EdgeId>> outs(static_cast<std::size_t>(inner));
+    std::vector<EdgeId> exit(static_cast<std::size_t>(inner), -1);
+    for (EdgeId e = 0; e < g->num_edges(); ++e) {
+      const auto u = g->edge_sources()[static_cast<std::size_t>(e)];
+      const auto w = g->edge_destinations()[static_cast<std::size_t>(e)];
+      if (w == dst) {
+        exit[static_cast<std::size_t>(u)] = e;
+      } else {
+        outs[static_cast<std::size_t>(u)].push_back(e);
+      }
+    }
+    auto head_of = [&](EdgeId e) { return g->edge_destinations()[static_cast<std::size_t>(e)]; };
+    // A random simple walk from u (0 to 3 inner links, avoiding `avoid`), ending at the destination
+    // or, when it can, at a node of `merge` (taken half of the time it is offered).
+    auto walk = [&](NodeId u, std::set<NodeId> avoid, const std::set<NodeId>& merge) {
+      std::vector<EdgeId> path;
+      avoid.insert(u);
+      const int len = static_cast<int>(rng() % 5);
+      for (int k = 0; k <= len; ++k) {
+        std::vector<EdgeId> into;
+        std::vector<EdgeId> free;
+        for (EdgeId e : outs[static_cast<std::size_t>(u)]) {
+          const auto w = head_of(e);
+          if (merge.count(w) != 0) into.push_back(e);
+          if (avoid.count(w) == 0 && merge.count(w) == 0) free.push_back(e);
+        }
+        if (!into.empty() && rng() % 2 == 0) {
+          path.push_back(into[rng() % into.size()]);
+          return path;
+        }
+        if (k == len || free.empty()) break;
+        const EdgeId e = free[rng() % free.size()];
+        path.push_back(e);
+        u = head_of(e);
+        avoid.insert(u);
+      }
+      path.push_back(exit[static_cast<std::size_t>(u)]);
+      return path;
+    };
+    auto nodes_of = [&](const std::vector<EdgeId>& es) {
+      std::set<NodeId> out;
+      for (EdgeId e : es) {
+        out.insert(g->edge_sources()[static_cast<std::size_t>(e)]);
+        out.insert(head_of(e));
+      }
+      out.erase(dst);
+      return out;
+    };
+    auto path_of = [&](const std::vector<EdgeId>& es) {
+      std::vector<std::vector<EdgeId>> hops;
+      for (EdgeId e : es) hops.push_back({e});
+      return std::make_shared<const Path>(*g, hops);
+    };
+    // The union of two member sets; a union with a cycle is no route (thrown as invalid_argument: the
+    // trial is skipped).
+    auto unite = [&](std::vector<EdgeId> a, const std::vector<EdgeId>& b) {
+      a.insert(a.end(), b.begin(), b.end());
+      std::sort(a.begin(), a.end());
+      a.erase(std::unique(a.begin(), a.end()), a.end());
+      std::vector<int> indegree(static_cast<std::size_t>(inner) + 1, 0);
+      for (EdgeId e : a) ++indegree[static_cast<std::size_t>(head_of(e))];
+      std::vector<NodeId> ready;
+      for (NodeId v = 0; v <= inner; ++v) {
+        if (indegree[static_cast<std::size_t>(v)] == 0) ready.push_back(v);
+      }
+      std::size_t seen = 0;
+      while (!ready.empty()) {
+        const NodeId v = ready.back();
+        ready.pop_back();
+        ++seen;
+        for (EdgeId e : a) {
+          if (g->edge_sources()[static_cast<std::size_t>(e)] == v && --indegree[static_cast<std::size_t>(head_of(e))] == 0) ready.push_back(head_of(e));
+        }
+      }
+      if (seen != static_cast<std::size_t>(inner) + 1) throw std::invalid_argument("cyclic union");
+      return a;
+    };
+    const NodeId d[1] = {dst};
+    std::vector<Part> with;
+    std::vector<Part> without;
+    int pooled_at = -1;
+    std::vector<NodeId> pooled_sources;
+    std::vector<EdgeId> pooled_members;
+    std::vector<std::vector<RouteDefinition>> defs_of;  // per demand built from routes: its definitions
+    try {
+      const int n = 1 + static_cast<int>(rng() % 4);
+      for (int i = 0; i < n; ++i) {
+        const auto kind = rng() % 3;
+        const auto h = static_cast<NodeId>(rng() % inner);
+        if (kind == 0) {
+          std::vector<RouteDefinition> defs {RouteDefinition {h, path_of(walk(h, {}, {})), 1 + static_cast<Amount>(rng() % 3)}};
+          if (rng() % 2 == 0) defs.push_back(RouteDefinition {h, path_of(walk(h, {}, {})), 1 + static_cast<Amount>(rng() % 3)});
+          const NodeId s[1] = {h};
+          with.push_back({ForwardingProgram::from_routes(*g, s, d, defs), nullptr, {static_cast<Amount>(rng() % 6)}});
+          defs_of.push_back(defs);
+        } else if (kind == 1) {
+          const auto w1 = walk(h, {}, {});
+          const auto members = rng() % 2 == 0 ? unite(w1, walk(h, {}, {})) : w1;
+          const NodeId s[1] = {h};
+          const std::vector<RouteDefinition> defs {RouteDefinition {h, dag_of(*g, members), 1}, RouteDefinition {h, path_of(w1), 0}};
+          with.push_back({ForwardingProgram::from_routes(*g, s, d, defs), nullptr, {static_cast<Amount>(rng() % 6)}});
+          defs_of.push_back(defs);
+        } else {
+          NodeId h2 = static_cast<NodeId>(rng() % inner);
+          if (h2 == h) h2 = (h + 1) % inner;
+          const auto members = unite(walk(h, {}, {}), walk(h2, {}, {}));
+          std::vector<NodeId> s {std::min(h, h2), std::max(h, h2)};
+          with.push_back({ForwardingProgram::from_dag(*g, s, d, dag_of(*g, members), RouteOptions {}), nullptr,
+                          {static_cast<Amount>(rng() % 6), static_cast<Amount>(rng() % 6)}});
+          defs_of.emplace_back();
+          if (pooled_at < 0) {
+            pooled_at = i;
+            pooled_sources = s;
+            pooled_members = members;
+          }
+        }
+      }
+      without = with;
+      auto kind = static_cast<std::size_t>(rng() % 7);
+      if (n == 1 && kind != 6 && rng() % 2 == 0) kind = pooled_at >= 0 ? 2 + rng() % 2 : 6;  // the element joins the one demand
+      if ((kind == 2 || kind == 3) && pooled_at < 0) kind = 0;
+      const auto h = static_cast<NodeId>(rng() % inner);
+      const NodeId s[1] = {h};
+      if (kind == 0) {
+        with.push_back({ForwardingProgram::from_routes(*g, s, d, std::vector<RouteDefinition> {RouteDefinition {h, path_of(walk(h, {}, {})), 1}}),
+                        nullptr, {0}});
+      } else if (kind == 1) {
+        const auto w = walk(h, {}, {});
+        const auto p = rng() % w.size();
+        const auto black = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {w[p]}));
+        const Amount z = 1 + static_cast<Amount>(rng() % 3);
+        with.push_back({ForwardingProgram::from_routes(*g, s, d, std::vector<RouteDefinition> {RouteDefinition {h, path_of(w), 1}}), black, {z}});
+        const std::vector<EdgeId> cut(w.begin(), w.begin() + static_cast<std::ptrdiff_t>(p) + 1);
+        const NodeId end[1] = {head_of(cut.back())};
+        without.push_back({ForwardingProgram::from_routes(*g, s, end, std::vector<RouteDefinition> {RouteDefinition {h, path_of(cut), 1}}), black, {z}});
+      } else if (kind == 2 || kind == 3) {
+        const auto live = nodes_of(pooled_members);
+        std::vector<NodeId> free;
+        for (NodeId v = 0; v < inner; ++v) {
+          if (live.count(v) == 0) free.push_back(v);
+        }
+        if (free.empty()) {
+          ++skipped;
+          continue;
+        }
+        const NodeId h0 = free[rng() % free.size()];
+        const auto w = walk(h0, live, live);
+        std::vector<NodeId> sources = pooled_sources;
+        sources.push_back(h0);
+        std::sort(sources.begin(), sources.end());
+        auto& part = with[static_cast<std::size_t>(pooled_at)];
+        const auto old_inject = part.inject;
+        part.prog = ForwardingProgram::from_dag(*g, sources, d, dag_of(*g, unite(pooled_members, w)), RouteOptions {});
+        part.inject.clear();
+        for (NodeId v : part.prog->sources()) {
+          if (v == h0) {
+            part.inject.push_back(kind == 2 ? 0 : 1 + static_cast<Amount>(rng() % 3));
+          } else {
+            part.inject.push_back(old_inject[v == pooled_sources[0] ? 0 : 1]);
+          }
+        }
+        if (kind == 3) part.black = std::make_shared<const Eligibility>(g->eligibility({}, std::vector<EdgeId> {w.front()}));
+      } else if (kind == 6) {
+        // A source of share 0 inside demand i: a new head's tunnel or DAG route, or a pooled source
+        // on the demand's DAG.
+        const auto i = static_cast<std::size_t>(rng() % static_cast<std::size_t>(n));
+        auto& part = with[i];
+        std::vector<NodeId> sources(part.prog->sources().begin(), part.prog->sources().end());
+        NodeId h0 = -1;
+        if (defs_of[i].empty()) {
+          std::vector<NodeId> inside;
+          for (NodeId v : nodes_of(i == static_cast<std::size_t>(pooled_at) ? pooled_members : std::vector<EdgeId> {})) {
+            if (std::find(sources.begin(), sources.end(), v) == sources.end()) inside.push_back(v);
+          }
+          if (inside.empty()) {
+            ++skipped;
+            continue;
+          }
+          h0 = inside[rng() % inside.size()];
+          sources.push_back(h0);
+          std::sort(sources.begin(), sources.end());
+          part.prog = ForwardingProgram::from_dag(*g, sources, d, dag_of(*g, pooled_members), RouteOptions {});
+        } else {
+          h0 = static_cast<NodeId>(rng() % inner);
+          if (std::find(sources.begin(), sources.end(), h0) != sources.end()) {
+            ++skipped;
+            continue;
+          }
+          auto defs = defs_of[i];
+          const auto w = walk(h0, {}, {});
+          if (rng() % 2 == 0) {
+            defs.push_back(RouteDefinition {h0, path_of(w), 1});
+          } else {
+            defs.push_back(RouteDefinition {h0, dag_of(*g, w), 1});
+          }
+          sources.push_back(h0);
+          std::sort(sources.begin(), sources.end());
+          part.prog = ForwardingProgram::from_routes(*g, sources, d, defs);
+        }
+        const auto old = without[i].prog->sources();
+        const auto old_inject = part.inject;
+        part.inject.clear();
+        for (NodeId v : part.prog->sources()) {
+          const auto at = std::find(old.begin(), old.end(), v);
+          part.inject.push_back(v == h0 ? 0 : old_inject[static_cast<std::size_t>(at - old.begin())]);
+        }
+      } else {
+        // The live walk W from h; the branch on a higher EdgeId out of h than W's first link.
+        const auto w = walk(h, {}, {});
+        std::vector<EdgeId> later;
+        for (EdgeId e : outs[static_cast<std::size_t>(h)]) {
+          if (e > w.front() && std::find(w.begin(), w.end(), e) == w.end()) later.push_back(e);
+        }
+        if (exit[static_cast<std::size_t>(h)] > w.front() && exit[static_cast<std::size_t>(h)] != w.front()) later.push_back(exit[static_cast<std::size_t>(h)]);
+        if (later.empty()) {
+          ++skipped;
+          continue;
+        }
+        const EdgeId branch = later[rng() % later.size()];
+        auto live = nodes_of(w);
+        std::vector<EdgeId> dead {branch};
+        const auto b = head_of(branch);
+        if (b != dst && live.count(b) == 0) {
+          auto avoid = live;
+          const auto rest = walk(b, avoid, live);
+          dead.insert(dead.end(), rest.begin(), rest.end());
+        }
+        auto program = [&](const std::vector<EdgeId>& members) {
+          if (kind == 4) return ForwardingProgram::from_dag(*g, s, d, dag_of(*g, members), RouteOptions {});
+          return ForwardingProgram::from_routes(*g, s, d,
+                                                std::vector<RouteDefinition> {RouteDefinition {h, dag_of(*g, members), 1},
+                                                                              RouteDefinition {h, path_of(w), 0}});
+        };
+        with.push_back({program(unite(w, dead)), nullptr, {1}});
+        without.push_back({program(w), nullptr, {1}});
+      }
+      ++kinds[kind];
+      auto evaluate = [&](const std::vector<Part>& parts) {
+        std::vector<std::unique_ptr<detail::ForwardingView>> views;
+        std::vector<detail::ForwardingDemand> demands;
+        for (const auto& p : parts) {
+          views.push_back(std::make_unique<detail::ForwardingView>(detail::make_forwarding_view(
+              *g, p.prog, nullptr, std::vector<NodeId>(p.prog->destinations().begin(), p.prog->destinations().end()), p.black.get())));
+          demands.push_back({views.back().get(), p.inject});
+        }
+        Seen seen;
+        std::vector<ProgramFlow> got;
+        try {
+          got = detail::lossy(demands, capacities(*g));
+        } catch (const std::invalid_argument& e) {
+          seen.error = e.what();
+        }
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+        seen.rounds = detail::thread_lossy_counters().rounds;
+        seen.groups = detail::thread_lossy_counters().groups;
+        seen.barriers = detail::thread_lossy_counters().barriers;
+        seen.dependencies = detail::thread_lossy_counters().dependencies;
+#endif
+        for (const auto& f : got) {
+          seen.delivered.push_back(f.delivered);
+          std::map<EdgeId, Amount> c;
+          std::map<EdgeId, Amount> dr;
+          for (const auto& entry : f.entries) {
+            for (const auto& [e, x] : entry.edge_flows) c[e] += x;
+            for (const auto& [e, x] : entry.edge_drops) dr[e] += x;
+          }
+          seen.carried.push_back(c);
+          seen.drops.push_back(dr);
+        }
+        return seen;
+      };
+      const auto a = evaluate(with);
+      const auto b = evaluate(without);
+      const std::string where = "trial " + std::to_string(trial) + ", kind " + std::to_string(kind);
+      EXPECT_EQ(a.error, b.error) << where;
+      EXPECT_EQ(a.rounds, b.rounds) << where;
+      EXPECT_EQ(a.groups, b.groups) << where;
+      EXPECT_EQ(a.barriers, b.barriers) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      EXPECT_EQ(a.dependencies, b.dependencies + (kind == 3 ? 1 : 0)) << where;
+#endif
+      if (a.error.empty() && b.error.empty()) {
+        // Demands present in both runs: the live ones, and the added tunnel cut or branch removed.
+        const std::size_t both = std::min(a.delivered.size(), b.delivered.size());
+        for (std::size_t i = 0; i < both; ++i) {
+          EXPECT_EQ(a.delivered[i], b.delivered[i]) << where << ", demand " << i;
+          EXPECT_EQ(a.carried[i], b.carried[i]) << where << ", demand " << i;
+          if (!(kind == 3 && static_cast<int>(i) == pooled_at)) EXPECT_EQ(a.drops[i], b.drops[i]) << where << ", demand " << i;
+        }
+      }
+      errors += a.error.empty() ? 0 : 1;
+      cyclic += a.groups > 0 ? 1 : 0;
+      ++checked;
+    } catch (const std::invalid_argument&) {
+      ++skipped;  // a random member set the builders refuse (a cycle, no route to the destination)
+    }
+    if (::testing::Test::HasFailure()) return;
+  }
+  RecordProperty("checked", checked);
+  RecordProperty("skipped", skipped);
+  RecordProperty("cyclic", cyclic);
+  RecordProperty("errors", errors);
+  EXPECT_GT(checked, 3500);
+  for (std::size_t k = 0; k < kinds.size(); ++k) EXPECT_GT(kinds[k], 300) << "kind " << k;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_GT(cyclic, 50);  // not vacuous: groups iterated
+#endif
+}
+
+// The source-labelled round state. E = e0 0->1 (1), F = e1 2->3 (1); wide e2 4->0, e3 1->2, e4
+// 5->2, e5 3->6, e6 7->2, e7 3->0, e8 1->8. A pooled sources {4, 5} -> 6 (offer 2: one each), B a
+// tunnel [e6, e1, e7, e0, e8] from 7 to 8 (offer 1). One cyclic group {E, F}; the state (E: A4, B;
+// F: A4, A5, B) settles at round 3 (x1 ((1, 0), (0, 1, 0)), x2 = x3 ((1, 0), (1, 0, 0))), while
+// per-demand aggregates would repeat at round 2. A delivers 1 (source 4), source 5 drops 1 on F; B
+// drops 1 on F.
+TEST(JointForwarding, PooledCycleKeepsSourceState) {
+  const auto g = shared(make_graph(9, {{0, 1, 1, 1},
+                                       {2, 3, 1, 1},
+                                       {4, 0, 100, 1},
+                                       {1, 2, 100, 1},
+                                       {5, 2, 100, 1},
+                                       {3, 6, 100, 1},
+                                       {7, 2, 100, 1},
+                                       {3, 0, 100, 1},
+                                       {1, 8, 100, 1}}));
+  const auto id = id_of_input(*g);
+  auto ids = [&](std::vector<std::int32_t> in) {
+    std::vector<EdgeId> out;
+    for (auto i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  const auto a = pooled_program(g, {4, 5}, 6);
+  ASSERT_TRUE(detail::ProgramAccess::data(*a).pools_source_inflows);
+  const auto va = detail::make_forwarding_view(*g, a, nullptr, std::vector<NodeId> {6}, nullptr);
+  const auto bp = build(*g, {{{7}, {1}, {{0, ids({6, 1, 7, 0, 8}), 1}}, {}}}, 8);
+  const Amounts ia {1, 1};
+  const Amounts ib {1};
+  const std::vector<detail::ForwardingDemand> demands {{&va, ia}, {bp.views[0].get(), ib}};
+  const auto got = detail::lossy(demands, capacities(*g));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+  EXPECT_EQ(got[0].delivered, 1);
+  EXPECT_EQ(got[0].entries[0].delivered, 1);
+  EXPECT_EQ(got[0].entries[1].delivered, 0);
+  EXPECT_EQ(got[0].entries[1].edge_drops, (Pairs {{id[1], 1}}));
+  EXPECT_EQ(got[1].delivered, 0);
+  EXPECT_EQ(got[1].entries[0].edge_drops, (Pairs {{id[1], 1}}));
+}
+
+} // namespace
+
+
+// Source labels also reach destinations, which have no outgoing occurrence. A long chain
+// followed by a disconnected live component therefore crosses the occurrence index's width.
+TEST(JointForwarding, PooledHeadLabelOffsetsIncludeDestinationsWithoutNarrowing) {
+  constexpr std::int64_t chain_heads = 65535;
+  constexpr std::int64_t entries = chain_heads + 1;
+  constexpr std::int64_t occurrences = chain_heads * (chain_heads + 1) / 2 + 1;
+  constexpr std::int64_t routers = chain_heads + 3;
+  EXPECT_NO_THROW(detail::check_forwarding_count(detail::ForwardingCounter::Entry, entries));
+  EXPECT_NO_THROW(detail::check_forwarding_count(detail::ForwardingCounter::Occurrence, occurrences));
+  EXPECT_NO_THROW(detail::check_forwarding_count(detail::ForwardingCounter::Router, routers));
+  using Offset = detail::HeadLabelOffset;
+  // Each label is a root entry or is reached over an incoming occurrence. The cumulative
+  // offset must hold their sum, although each separate preflight counter fits in int32.
+  EXPECT_GE(static_cast<std::uint64_t>(std::numeric_limits<Offset>::max()),
+            2 * static_cast<std::uint64_t>(detail::kForwardingLimit));
+  std::int64_t exact_labels = 0;
+  Offset offset = 0;
+  for (std::int64_t labels = 1; labels <= chain_heads; ++labels) {
+    exact_labels += labels;
+    offset = static_cast<Offset>(exact_labels);
+    ASSERT_EQ(static_cast<std::int64_t>(offset), exact_labels);
+  }
+  exact_labels += chain_heads;  // destination labels have no outgoing occurrence
+  offset = static_cast<Offset>(exact_labels);
+  EXPECT_EQ(exact_labels, 2147516415LL);
+  EXPECT_EQ(static_cast<std::int64_t>(offset), exact_labels);
+  EXPECT_GT(static_cast<std::uint64_t>(offset), static_cast<std::uint64_t>(detail::kForwardingLimit));
+  const Offset disconnected_begin = offset;
+  offset = static_cast<Offset>(++exact_labels);
+  EXPECT_EQ(offset - disconnected_begin, Offset {1});
+  offset = static_cast<Offset>(++exact_labels);  // its destination
+  EXPECT_EQ(static_cast<std::int64_t>(offset), 2147516417LL);
+  // The bound includes destination labels; it is not the occurrence-only bound.
+  EXPECT_LE(static_cast<std::int64_t>(offset), entries + occurrences);
+  EXPECT_EQ(occurrences, 2147450881LL);
+}
diff --git a/tests/cpp/k_shortest_paths_tests.cpp b/tests/cpp/k_shortest_paths_tests.cpp
deleted file mode 100644
index 30b1dc6..0000000
--- a/tests/cpp/k_shortest_paths_tests.cpp
+++ /dev/null
@@ -1,331 +0,0 @@
-#include <gtest/gtest.h>
-#include <limits>
-#include <set>
-#include "netgraph/core/k_shortest_paths.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-TEST(KShortestPaths, FindsKPaths) {
-  auto g = make_square_graph(1);  // Has at least 2 paths
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts;
-  opts.k = 2;
-  opts.unique = true;
-  opts.max_cost_factor = std::nullopt;
-
-  auto paths = algs.ksp(gh, 0, 2, opts);
-
-  // Should find at least 1 path, up to 2
-  EXPECT_GT(paths.size(), 0);
-  EXPECT_LE(paths.size(), 2);
-}
-
-TEST(KShortestPaths, KEqualsZeroReturnsEmpty) {
-  auto g = make_square_graph(1);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-  KspOptions opts; opts.k = 0; opts.unique = true;
-  auto paths = algs.ksp(gh, 0, 2, opts);
-  EXPECT_TRUE(paths.empty());
-}
-
-TEST(KShortestPaths, NodeMaskBlocksPaths) {
-  // Verify that node masks prevent path discovery in KSP
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-  KspOptions opts; opts.k = 5; opts.unique = true;
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;  // Block middle node
-  opts.node_mask = std::span<const bool>(node_mask.get(), static_cast<std::size_t>(g.num_nodes()));
-  auto paths = algs.ksp(gh, 0, 2, opts);
-  EXPECT_TRUE(paths.empty());
-}
-
-TEST(KShortestPaths, UniqueModeFiltering) {
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts1;
-  opts1.k = 10;
-  opts1.unique = true;
-  auto paths_unique = algs.ksp(gh, 0, 2, opts1);
-
-  KspOptions opts2;
-  opts2.k = 10;
-  opts2.unique = false;
-  auto paths_non_unique = algs.ksp(gh, 0, 2, opts2);
-
-  // Non-unique mode should find at least as many paths as unique mode
-  EXPECT_GE(paths_non_unique.size(), paths_unique.size());
-}
-
-TEST(KShortestPaths, MaxCostFactorLimit) {
-  auto g = make_square_graph(1);  // Has paths of cost 2 and 4
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts1;
-  opts1.k = 10;
-  opts1.max_cost_factor = 1.5;  // Allow up to 1.5x shortest
-  auto paths_limited = algs.ksp(gh, 0, 2, opts1);
-
-  KspOptions opts2;
-  opts2.k = 10;
-  opts2.max_cost_factor = std::nullopt;  // No limit
-  auto paths_unlimited = algs.ksp(gh, 0, 2, opts2);
-
-  // Unlimited should find at least as many paths
-  EXPECT_GE(paths_unlimited.size(), paths_limited.size());
-
-  // All limited paths should have reasonable cost (check via distance to destination)
-  if (!paths_limited.empty()) {
-    Cost min_cost = paths_limited[0].first[2];  // Cost to destination node 2
-
-    for (const auto& [dist, dag] : paths_limited) {
-      Cost path_cost = dist[2];  // Cost to destination
-      EXPECT_LE(path_cost, min_cost * 1.5 + 1e-9);
-    }
-  }
-}
-
-TEST(KShortestPaths, PathsSortedByCost) {
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts;
-  opts.k = 5;
-  opts.unique = true;
-
-  auto paths = algs.ksp(gh, 0, 2, opts);
-
-  if (paths.size() > 1) {
-    // Extract costs to destination (node 2)
-    std::vector<Cost> costs;
-    for (const auto& [dist, dag] : paths) {
-      costs.push_back(dist[2]);  // Cost to destination node 2
-    }
-
-    // Check sorted
-    for (std::size_t i = 0; i < costs.size() - 1; ++i) {
-      EXPECT_LE(costs[i], costs[i + 1] + 1e-9) << "Paths not sorted by cost";
-    }
-  }
-}
-
-TEST(KShortestPaths, DisconnectedReturnsEmpty) {
-  // Create disconnected graph: 0-1 and 2-3
-  std::int32_t src[2] = {0, 2};
-  std::int32_t dst[2] = {1, 3};
-  double cap[2] = {1.0, 1.0};
-  std::int64_t cost[2] = {1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 2), std::span(dst, 2),
-    std::span(cap, 2), std::span(cost, 2));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts;
-  opts.k = 5;
-
-  // Try to find path from 0 to 3 (disconnected)
-  auto paths = algs.ksp(gh, 0, 3, opts);
-
-  EXPECT_EQ(paths.size(), 0);
-}
-
-TEST(KShortestPaths, LooplessPaths) {
-  // Create a graph with cycles: 0->1->2->3 (forward path) and 1->0, 2->0 (back edges)
-  std::int32_t src[6] = {0, 1, 2, 1, 0, 2};
-  std::int32_t dst[6] = {1, 2, 3, 0, 2, 0};  // Has cycles
-  double cap[6] = {1.0, 1.0, 1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost[6] = {1, 1, 1, 1, 2, 2};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 6), std::span(dst, 6),
-    std::span(cap, 6), std::span(cost, 6));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  KspOptions opts;
-  opts.k = 10;
-  opts.unique = true;
-
-  auto paths = algs.ksp(gh, 0, 3, opts);
-
-  // KSP should return loop-free paths (Yen's algorithm property)
-  // Verify by checking that destination is reachable and has finite cost
-  for (const auto& [dist, dag] : paths) {
-    // Destination (node 3) should be reachable with finite cost
-    EXPECT_LT(dist[3], std::numeric_limits<Cost>::max())
-      << "Path to destination should have finite cost (no infinite loops)";
-
-    // Source (node 0) should have distance 0
-    EXPECT_DOUBLE_EQ(dist[0], 0.0) << "Source distance should be 0";
-
-    // Path cost should be positive (since all edge costs are positive)
-    EXPECT_GT(dist[3], 0.0) << "Path cost should be positive";
-  }
-
-  // Should find at least one path (0->1->2->3 with cost 3)
-  EXPECT_GT(paths.size(), 0) << "Should find at least one loop-free path";
-
-  // First path should be shortest (cost 3)
-  if (!paths.empty()) {
-    EXPECT_DOUBLE_EQ(paths[0].first[3], 3.0) << "Shortest path should have cost 3";
-  }
-}
-
-TEST(KShortestPaths, OutOfOrderNodePredDAGSemantics) {
-  // Graph topology that forces paths visiting nodes out of numerical order.
-  // Path 1 (shortest): 0 -> 1 -> 2 (cost 2, in-order)
-  // Path 2 (longer):   0 -> 3 -> 2 (cost 4, visits node 3 before node 2)
-  // This was the exact bug scenario: PredDAG fill for path [0,3,2] swapped
-  // parent entries between nodes 2 and 3 when using a linear index.
-  auto g = make_square_graph(1);  // 0->1->2 (cost 2) vs 0->3->2 (cost 4)
-
-  auto items = k_shortest_paths(g, 0, 2, 5, std::nullopt, true);
-
-  ASSERT_GE(items.size(), 2) << "Should find at least 2 paths";
-
-  // Verify all PredDAGs have correct semantic structure
-  for (std::size_t p = 0; p < items.size(); ++p) {
-    const auto& [dist, dag] = items[p];
-    SCOPED_TRACE("Path " + std::to_string(p));
-
-    expect_pred_dag_valid(dag, g.num_nodes());
-    expect_pred_dag_semantically_valid(g, dag, dist);
-
-    // Source must have distance 0 and destination must be reachable
-    EXPECT_EQ(dist[0], 0);
-    EXPECT_LT(dist[2], std::numeric_limits<Cost>::max());
-
-    // Verify path can be reconstructed via resolve_to_paths
-    auto concrete = resolve_to_paths(dag, 0, 2, /*split_parallel_edges=*/true);
-    EXPECT_GE(concrete.size(), 1) << "resolve_to_paths should reconstruct at least one path";
-
-    // Verify reconstructed path is valid: consecutive nodes connected by claimed edges
-    for (const auto& path : concrete) {
-      ASSERT_GE(path.size(), 2);  // at least src and dst
-      EXPECT_EQ(path.front().first, 0) << "Path should start at source";
-      EXPECT_EQ(path.back().first, 2) << "Path should end at destination";
-      // Check edge connectivity
-      for (std::size_t i = 0; i + 1 < path.size(); ++i) {
-        auto from_node = path[i].first;
-        auto to_node = path[i + 1].first;
-        const auto& edges = path[i].second;
-        for (auto eid : edges) {
-          EXPECT_EQ(g.edge_src_view()[static_cast<std::size_t>(eid)], from_node);
-          EXPECT_EQ(g.edge_dst_view()[static_cast<std::size_t>(eid)], to_node);
-        }
-      }
-    }
-  }
-}
-
-TEST(KShortestPaths, LargerOutOfOrderTopology) {
-  // Larger graph where multiple k-shortest paths visit nodes out of numerical order.
-  // Topology (6 nodes):
-  //   0 -> 5 -> 3 -> 1 (cost 3, severely out-of-order: 0,5,3,1)
-  //   0 -> 2 -> 4 -> 1 (cost 6, also out-of-order: 0,2,4,1)
-  //   0 -> 1           (cost 10, direct)
-  std::int32_t src_arr[7] = {0, 5, 3, 0, 2, 4, 0};
-  std::int32_t dst_arr[7] = {5, 3, 1, 2, 4, 1, 1};
-  double cap_arr[7] = {1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost_arr[7] = {1, 1, 1, 2, 2, 2, 10};
-
-  auto g = StrictMultiDiGraph::from_arrays(6,
-    std::span(src_arr, 7), std::span(dst_arr, 7),
-    std::span(cap_arr, 7), std::span(cost_arr, 7));
-
-  auto items = k_shortest_paths(g, 0, 1, 5, std::nullopt, true);
-
-  ASSERT_GE(items.size(), 2) << "Should find at least 2 paths";
-
-  // Verify costs are non-decreasing
-  for (std::size_t i = 0; i + 1 < items.size(); ++i) {
-    EXPECT_LE(items[i].first[1], items[i + 1].first[1])
-        << "Paths should be sorted by cost to destination";
-  }
-
-  // The first path should be 0->5->3->1 (cost 3)
-  EXPECT_EQ(items[0].first[1], 3) << "Shortest path cost should be 3";
-
-  // Verify all PredDAGs are semantically correct and can be resolved
-  for (std::size_t p = 0; p < items.size(); ++p) {
-    const auto& [dist, dag] = items[p];
-    SCOPED_TRACE("Path " + std::to_string(p));
-
-    expect_pred_dag_valid(dag, g.num_nodes());
-    expect_pred_dag_semantically_valid(g, dag, dist);
-
-    // Source must have distance 0 and destination must be reachable
-    EXPECT_EQ(dist[0], 0);
-    EXPECT_LT(dist[1], std::numeric_limits<Cost>::max());
-
-    auto concrete = resolve_to_paths(dag, 0, 1, true);
-    EXPECT_GE(concrete.size(), 1) << "Should reconstruct at least one concrete path";
-
-    // Verify node connectivity in reconstructed paths
-    for (const auto& path : concrete) {
-      ASSERT_GE(path.size(), 2);
-      EXPECT_EQ(path.front().first, 0);
-      EXPECT_EQ(path.back().first, 1);
-      // Verify no repeated nodes (simple path)
-      std::set<NodeId> visited;
-      for (const auto& [node, edges] : path) {
-        EXPECT_TRUE(visited.insert(node).second)
-            << "Node " << node << " appears twice in path (cycle)";
-      }
-    }
-  }
-}
-
-// Regression: a max_cost_factor below 1.0 puts the cost ceiling under the shortest
-// path, so no path is admitted. The k > 1 loop opened with paths.back() on that empty
-// vector -- undefined behaviour. The k == 1 early return masked it, so only k >= 2 hit
-// it. All k must now agree and return no paths.
-TEST(KSP, MaxCostFactorBelowOne_ReturnsEmptyForAllK) {
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  for (int k : {1, 2, 5}) {
-    KspOptions opts;
-    opts.k = k;
-    opts.max_cost_factor = 0.5;
-    auto out = algs.ksp(gh, 0, 2, opts);
-    EXPECT_TRUE(out.empty()) << "k=" << k << " should admit no path under a sub-1.0 factor";
-  }
-  // A factor of exactly 1.0 still admits the shortest path.
-  KspOptions ok;
-  ok.k = 3;
-  ok.max_cost_factor = 1.0;
-  EXPECT_EQ(algs.ksp(gh, 0, 2, ok).size(), 1u);
-}
diff --git a/tests/cpp/ksp_tests.cpp b/tests/cpp/ksp_tests.cpp
new file mode 100644
index 0000000..0e6c0cd
--- /dev/null
+++ b/tests/cpp/ksp_tests.cpp
@@ -0,0 +1,791 @@
+// KSP and resolve_to_paths (docs/semantics.md#k-shortest-paths): the witness graphs (hand-built
+// examples: the diamond and the three-hop graph, whose first path is the canonical single path
+// of the forward and the reverse search; a shared bottleneck that leaves the fewest hops first; the prefix-capped spur; a
+// candidate's bottleneck including its prefix; parallel members under Expand and Collapse;
+// accepted paths that never return after a shared prefix; zero-capacity edges (searched like any
+// other; a residual filters them; Headroom 0 on them); the ceilings on
+// chain-plus-bypasses and the exact CostStretch ceiling at large costs and factors), the defects in the documented order, and agreement with exhaustive
+// enumeration (search_reference.hpp) on random graphs; the resolver's order, splitting and
+// truncation against an enumeration of every walk of a DAG, from either search direction and on
+// long chains.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cmath>
+#include <limits>
+#include <tuple>
+#include <functional>
+#include <map>
+#include <optional>
+#include <random>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/search.hpp"
+#include "search_reference.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// The route choice of ksp: parallel_edges and tie_break (always single paths).
+struct KspChoice {
+  bool parallel_edges {true};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+};
+KspChoice sel(bool parallel_edges = true, RouteTieBreak tie = RouteTieBreak::FewerHops) { return {parallel_edges, tie}; }
+
+// A single-path spf with targets under `tie`.
+SpfOptions single_path(Direction dir, RouteTieBreak tie, NodeId target) {
+  SpfOptions o(dir);
+  o.tie_break = tie;
+  o.multipath = false;
+  o.targets = std::vector<NodeId> {target};
+  return o;
+}
+
+// A graph from rows (u, v, capacity, cost), stable-sorted by (source, cost, destination) first: that is the
+// EdgeId order, so each EdgeId is the row's position in the sorted list.
+Graph bgraph(std::int32_t n, std::vector<InEdge> rows) {
+  std::stable_sort(rows.begin(), rows.end(), [](const InEdge& a, const InEdge& b) {
+    return std::tie(a.u, a.cost, a.v) < std::tie(b.u, b.cost, b.v);
+  });
+  return make_graph(n, rows);
+}
+
+std::vector<std::pair<Cost, Path>> run(const Graph& g, NodeId s, NodeId t, std::int64_t k, const KspChoice& s1,
+                                       std::optional<CostCeiling> ceiling = std::nullopt,
+                                       const std::vector<Amount>* residual = nullptr, const Eligibility* elig = nullptr) {
+  KspOptions o(k);
+  o.tie_break = s1.tie_break;
+  o.parallel_edges = s1.parallel_edges;
+  o.cost_ceiling = ceiling;
+  if (residual != nullptr) o.residual = std::span<const Amount>(*residual);
+  o.eligibility = elig;
+  return ksp(g, s, t, o);
+}
+
+std::vector<EdgeId> walk_of(const Path& p) {
+  std::vector<EdgeId> out;
+  for (const auto& hop : p.hops()) {
+    EXPECT_EQ(hop.size(), 1U);
+    out.push_back(hop.front());
+  }
+  return out;
+}
+
+std::vector<NodeId> nodes_of(const Graph& g, const Path& p) {
+  std::vector<NodeId> out = {p.source()};
+  for (const auto& hop : p.hops()) out.push_back(g.edge_destinations()[static_cast<std::size_t>(hop.front())]);
+  return out;
+}
+
+std::vector<Cost> costs_of(const std::vector<std::pair<Cost, Path>>& r) {
+  std::vector<Cost> out;
+  for (const auto& [c, p] : r) {
+    EXPECT_EQ(c, p.cost());
+    out.push_back(c);
+  }
+  return out;
+}
+
+void expect_walks(const Graph& g, NodeId s, NodeId t, const std::vector<std::pair<Cost, Path>>& got,
+                 const std::vector<Cost>& costs, const std::vector<std::vector<EdgeId>>& walks) {
+  ASSERT_EQ(got.size(), walks.size());
+  ASSERT_EQ(costs.size(), walks.size());
+  for (std::size_t i = 0; i < got.size(); ++i) {
+    EXPECT_EQ(got[i].first, costs[i]);
+    EXPECT_EQ(got[i].second.cost(), costs[i]);
+    EXPECT_EQ(got[i].second.source(), s);
+    EXPECT_EQ(got[i].second.destination(), t);
+    EXPECT_EQ(walk_of(got[i].second), walks[i]);
+    Cost sum = 0;
+    for (EdgeId e : walks[i]) sum += g.edge_costs()[static_cast<std::size_t>(e)];
+    EXPECT_EQ(sum, costs[i]);
+  }
+}
+
+} // namespace
+
+TEST(Ksp, DeviationBoundaryIsInclusiveAndSkippedPrefixCostsRemain) {
+  const auto g = bgraph(6, {{0, 1, 5, 1}, {0, 4, 5, 5}, {1, 2, 5, 1}, {1, 3, 5, 2}, {1, 5, 5, 2},
+                            {2, 1, 5, 1}, {2, 4, 5, 2}, {3, 4, 5, 1}, {5, 4, 5, 1}});
+  for (const auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity,
+                         RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherHeadroom}) {
+    expect_walks(g, 0, 4, run(g, 0, 4, 8, sel(true, tie)), {4, 4, 4, 5}, {{0, 2, 6}, {0, 3, 7}, {0, 4, 8}, {1}});
+    expect_walks(g, 0, 4, run(g, 0, 4, 8, sel(true, tie), AbsoluteCost {4}), {4, 4, 4}, {{0, 2, 6}, {0, 3, 7}, {0, 4, 8}});
+    expect_walks(g, 0, 4, run(g, 0, 4, 1, sel(true, tie)), {4}, {{0, 2, 6}});
+  }
+}
+
+TEST(Ksp, NonzeroDeviationRetainsTheSkippedBottleneck) {
+  // The prefix caps every whole path at 1. After the cost-3 path (d=1), the cost-4
+  // suffixes must tie on score: edge 3 precedes edge 4 despite its smaller capacity.
+  const auto g = bgraph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}, {1, 2, 1, 2}, {1, 2, 2, 3}, {1, 2, 3, 3}});
+  expect_walks(g, 0, 2, run(g, 0, 2, 8, sel(true, RouteTieBreak::HigherCapacity)),
+               {2, 3, 4, 4}, {{0, 1}, {0, 2}, {0, 3}, {0, 4}});
+}
+
+TEST(Ksp, NonzeroDeviationStillExcludesEveryEarlierVertex) {
+  const auto g = bgraph(6, {{0, 1, 5, 1}, {1, 2, 5, 1}, {1, 4, 5, 1}, {2, 3, 5, 1}, {2, 5, 5, 1},
+                            {3, 1, 5, 1}, {3, 5, 5, 2}, {4, 5, 5, 1}});
+  expect_walks(g, 0, 5, run(g, 0, 5, 8, sel()), {3, 3, 5}, {{0, 1, 4}, {0, 2, 7}, {0, 1, 3, 6}});
+}
+
+TEST(Ksp, PendingHeadroomOrderUsesExactWholePathRatios) {
+  constexpr Amount m = Amount {1} << 54;
+  const auto direct = bgraph(2, {{0, 1, m, 1}, {0, 1, m + 1, 1}});
+  const std::vector<Amount> dr {m - 1, m};
+  const auto tie = sel(true, RouteTieBreak::HigherHeadroom);
+  expect_walks(direct, 0, 1, run(direct, 0, 1, 3, tie, std::nullopt, &dr), {1, 1}, {{1}, {0}});
+  const auto g = bgraph(4, {{0, 1, 1, 1}, {0, 2, m + 1, 1}, {1, 3, 1, 1}, {1, 3, m, 2}, {2, 3, 1, 2}});
+  const std::vector<Amount> residual {1, m, 1, m - 1, 1};
+  expect_walks(g, 0, 3, run(g, 0, 3, 3, tie, std::nullopt, &residual), {2, 3, 3}, {{0, 2}, {1, 4}, {0, 3}});
+}
+
+TEST(Ksp, DeviationSkipsOnlySearchesComparedWithFullYen) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  std::vector<InEdge> rows;
+  for (NodeId v = 0; v < 40; ++v) rows.push_back({v, v + 1, 1, 1});
+  for (Cost c = 1; c <= 8; ++c) rows.push_back({40, 41, 1, c});
+  const auto g = bgraph(42, rows);
+  struct Counts { std::size_t searches {0}; std::size_t skipped {0}; };
+  auto observe = [](void* context, std::size_t d, std::size_t j) {
+    auto& counts = *static_cast<Counts*>(context);
+    ++counts.searches;
+    if (j == d) counts.skipped += d;
+  };
+  Counts lawler, yen;
+  detail::KspProbe probe;
+  probe.spur = observe;
+  probe.context = &lawler;
+  detail::ScopedKspProbe guard(&probe);
+  const auto got = run(g, 0, 41, 8, sel());
+  probe.full_yen = true;
+  probe.context = &yen;
+  const auto full = run(g, 0, 41, 8, sel());
+  EXPECT_EQ(got, full);
+  EXPECT_EQ(lawler.searches, 47U); // 41 first expansion, then six final-edge searches
+  EXPECT_EQ(yen.searches, 287U);   // seven complete 41-edge expansions
+  EXPECT_EQ(yen.searches - lawler.searches, lawler.skipped);
+#else
+  GTEST_SKIP() << "the full-Yen comparator needs private hooks";
+#endif
+}
+
+TEST(Ksp, FirstPathIsTheCanonicalSinglePathOfBothDirections) {
+  auto diamond = bgraph(4, {{0, 1, 1, 9}, {0, 2, 1, 1}, {1, 3, 1, 1}, {2, 3, 1, 9}});
+  auto three = bgraph(6, {{0, 2, 1, 1}, {2, 3, 1, 1}, {3, 5, 1, 1}, {0, 1, 1, 1}, {1, 4, 1, 1}, {4, 5, 1, 1}});
+  struct Case {
+    const Graph* g;
+    NodeId t;
+    std::vector<NodeId> want;
+  };
+  for (const auto& c : {Case {&diamond, 3, {0, 2, 3}}, Case {&three, 5, {0, 1, 4, 5}}}) {
+    for (auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherAvailableCapacity}) {
+      auto got = run(*c.g, 0, c.t, 2, sel(true, tie));
+      ASSERT_EQ(got.size(), 2U);
+      EXPECT_EQ(nodes_of(*c.g, got[0].second), c.want);
+      // The first path is the canonical single path of the forward and the reverse search.
+      const SpfOptions f = single_path(Direction::Forward, tie, c.t);
+      const SpfOptions r = single_path(Direction::Reverse, tie, 0);
+      auto fw = spf(*c.g, std::vector<NodeId> {0}, f);
+      auto rv = spf(*c.g, std::vector<NodeId> {c.t}, r);
+      auto w = walk_of(got[0].second);
+      std::sort(w.begin(), w.end());
+      auto fe = std::vector<EdgeId>(fw.dag.via_edges().begin(), fw.dag.via_edges().end());
+      auto re = std::vector<EdgeId>(rv.dag.via_edges().begin(), rv.dag.via_edges().end());
+      std::sort(fe.begin(), fe.end());
+      std::sort(re.begin(), re.end());
+      EXPECT_EQ(fe, w);
+      EXPECT_EQ(re, w);
+    }
+  }
+}
+
+TEST(Ksp, WithASharedBottleneckTheFewestHopsComeFirst) {
+  auto g = bgraph(5, {{0, 1, 1, 1}, {1, 4, 1, 3}, {1, 2, 2, 1}, {2, 3, 2, 1}, {3, 4, 2, 1}});
+  auto got = run(g, 0, 4, 1, sel(true, RouteTieBreak::HigherCapacity));
+  ASSERT_EQ(got.size(), 1U);
+  EXPECT_EQ(nodes_of(g, got[0].second), (std::vector<NodeId>{0, 1, 4}));
+}
+
+TEST(Ksp, PrefixCappedSpurOrder) {
+  // After 0-1-4 the spur at 1 takes 1-5-4 (bottleneck 1, the prefix's) before 1-2-3-4: with the
+  // spur's B* capped by the prefix, the 3-hop path comes second (uncapped it would come third).
+  auto g = bgraph(6, {{0, 1, 1, 1}, {1, 4, 1, 3}, {1, 5, 1, 1}, {5, 4, 1, 2}, {1, 2, 2, 1}, {2, 3, 2, 1}, {3, 4, 2, 1}});
+  auto got = run(g, 0, 4, 3, sel(true, RouteTieBreak::HigherCapacity));
+  ASSERT_EQ(got.size(), 3U);
+  EXPECT_EQ(nodes_of(g, got[0].second), (std::vector<NodeId>{0, 1, 4}));
+  EXPECT_EQ(nodes_of(g, got[1].second), (std::vector<NodeId>{0, 1, 5, 4}));
+  EXPECT_EQ(nodes_of(g, got[2].second), (std::vector<NodeId>{0, 1, 2, 3, 4}));
+}
+
+TEST(Ksp, CandidateBottleneckIncludesThePrefix) {
+  // The first path 0-1-3 (cost 2) has bottleneck 1 (edge 0-1). Its deviations cost 3: at 0,
+  // 0-2-3 (bottleneck 5); at 1, the prefix 0-1 then the second 1-3 edge (the spur alone has
+  // bottleneck 10, the candidate min(1, 10) = 1). HIGHER_CAPACITY orders 0-2-3 first; a
+  // candidate keyed by its spur's bottleneck alone would put the prefix's deviation first.
+  // FEWER_HOPS orders the two by EdgeIds: 0-1-3 (ids 0, 3) before 0-2-3 (ids 1, 4).
+  auto g = bgraph(4, {{0, 1, 1, 1}, {1, 3, 10, 1}, {0, 2, 5, 1}, {2, 3, 5, 2}, {1, 3, 10, 2}});
+  auto prefer = run(g, 0, 3, 8, sel(true, RouteTieBreak::HigherCapacity));
+  ASSERT_EQ(costs_of(prefer), (std::vector<Cost> {2, 3, 3}));
+  EXPECT_EQ(nodes_of(g, prefer[0].second), (std::vector<NodeId> {0, 1, 3}));
+  EXPECT_EQ(nodes_of(g, prefer[1].second), (std::vector<NodeId> {0, 2, 3}));
+  EXPECT_EQ(nodes_of(g, prefer[2].second), (std::vector<NodeId> {0, 1, 3}));
+  EXPECT_EQ(walk_of(prefer[2].second), (std::vector<EdgeId> {0, 3}));
+  auto det = run(g, 0, 3, 8, sel(true, RouteTieBreak::FewerHops));
+  ASSERT_EQ(costs_of(det), (std::vector<Cost> {2, 3, 3}));
+  EXPECT_EQ(walk_of(det[1].second), (std::vector<EdgeId> {0, 3}));
+  EXPECT_EQ(walk_of(det[2].second), (std::vector<EdgeId> {1, 4}));
+}
+
+TEST(Ksp, ParallelMembersUnderExpandAndCollapse) {
+  // Two hops of two parallel members: four equal paths under Expand, one under Collapse.
+  auto pr = bgraph(3, {{0, 1, 1, 1}, {0, 1, 1, 1}, {1, 2, 1, 1}, {1, 2, 1, 1}});
+  EXPECT_EQ(run(pr, 0, 2, 8, sel()).size(), 4U);
+  EXPECT_EQ(run(pr, 0, 2, 8, sel(false)).size(), 1U);
+  auto k3 = run(pr, 0, 2, 3, sel());
+  ASSERT_EQ(k3.size(), 3U);
+  EXPECT_EQ(walk_of(k3[0].second), (std::vector<EdgeId>{0, 2}));
+  EXPECT_EQ(walk_of(k3[1].second), (std::vector<EdgeId>{0, 3}));
+  EXPECT_EQ(walk_of(k3[2].second), (std::vector<EdgeId>{1, 2}));
+  // Costs 1/3 then 2/3: all four simple paths under Expand in cost order; Collapse keeps one.
+  auto fe = bgraph(3, {{0, 1, 1, 1}, {0, 1, 1, 3}, {1, 2, 1, 2}, {1, 2, 1, 3}});
+  EXPECT_EQ(costs_of(run(fe, 0, 2, 8, sel())), (std::vector<Cost>{3, 4, 5, 6}));
+  EXPECT_EQ(costs_of(run(fe, 0, 2, 8, sel(false))), (std::vector<Cost>{3}));
+}
+
+TEST(Ksp, AcceptedPathsNeverReturnAfterASharedPrefix) {
+  // A candidate goes into the pending set without a search of the accepted
+  // paths, because each accepted path with the spur's prefix has its next edge (Expand) or its
+  // next transition (Collapse) banned at the spur. Spurs here share their prefix with one or two
+  // accepted paths at once, over parallel members; every path comes once, in the derived order.
+  // EdgeIds: 0, 1: 0->1 (1); 2: 0->2 (3); 3: 1->2 (1); 4, 5: 1->3 (1); 6: 2->3 (1).
+  auto g = bgraph(4, {{0, 1, 1, 1}, {0, 1, 1, 1}, {0, 2, 1, 3}, {1, 2, 1, 1}, {1, 3, 1, 1}, {1, 3, 1, 1}, {2, 3, 1, 1}});
+  auto walks = [](const std::vector<std::pair<Cost, Path>>& r) {
+    std::vector<std::vector<EdgeId>> out;
+    for (const auto& [c, p] : r) out.push_back(walk_of(p));
+    return out;
+  };
+  // Expand, derived by hand from the deviations: [0, 4] first; its spurs give [1, 4] and [0, 5].
+  // After [0, 5] the spur at node 1 bans 4 and 5 (both accepted paths share the prefix [0]) and
+  // finds [0, 3, 6]; the spur at node 0 bans 0 (twice) and finds [1, 4] again (pending: kept
+  // once). [1, 4] adds [2, 6] and [1, 5]; [1, 5] adds [1, 3, 6]; the rest add nothing new.
+  const auto expand = run(g, 0, 3, 16, sel());
+  EXPECT_EQ(walks(expand), (std::vector<std::vector<EdgeId>> {{0, 4}, {0, 5}, {1, 4}, {1, 5}, {0, 3, 6}, {1, 3, 6}, {2, 6}}));
+  EXPECT_EQ(costs_of(expand), (std::vector<Cost> {2, 2, 2, 2, 3, 3, 4}));
+  // Collapse: [0, 4] first; at node 1 the transition to 3 is banned, so 5 never follows [0]; at
+  // node 0 the transition to 1 is banned. Then [0, 3, 6] (node 1 bans the heads 3 and 2) and
+  // [2, 6].
+  const auto collapse = run(g, 0, 3, 16, sel(false));
+  EXPECT_EQ(walks(collapse), (std::vector<std::vector<EdgeId>> {{0, 4}, {0, 3, 6}, {2, 6}}));
+  EXPECT_EQ(costs_of(collapse), (std::vector<Cost> {2, 3, 4}));
+  // Every k gives the prefix of the full answer.
+  const auto all_e = walks(expand);
+  const auto all_c = walks(collapse);
+  for (std::int64_t k = 1; k <= 8; ++k) {
+    EXPECT_EQ(walks(run(g, 0, 3, k, sel())), decltype(all_e)(all_e.begin(), all_e.begin() + std::min<std::int64_t>(k, 7)));
+    EXPECT_EQ(walks(run(g, 0, 3, k, sel(false))), decltype(all_c)(all_c.begin(), all_c.begin() + std::min<std::int64_t>(k, 3)));
+  }
+}
+
+TEST(Ksp, EndpointDefectsReportTheFirstInOrder) {
+  // The scalar endpoints are checked as one-element sets (range, then the
+  // overlap), with every other argument also wrong where the order allows it; the first defect
+  // in the validation order is reported, for ksp and resolve_to_paths.
+  auto g = bgraph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  auto other = bgraph(3, {{0, 1, 1, 1}});
+  auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  const std::vector<Amount> bad = {1, 2};
+  const auto all_wrong = [&](NodeId s, NodeId t) {
+    return error_of([&] { (void)run(g, s, t, 0, sel(), AbsoluteCost {-1}, &bad, &foreign); });
+  };
+  EXPECT_EQ(all_wrong(5, -1), "source: node 5 out of node range [0, 3)");
+  EXPECT_EQ(all_wrong(-1, -1), "source: node -1 out of node range [0, 3)");
+  EXPECT_EQ(all_wrong(3, 3), "source: node 3 out of node range [0, 3)");  // range before the overlap
+  EXPECT_EQ(all_wrong(0, 3), "destination: node 3 out of node range [0, 3)");
+  EXPECT_EQ(all_wrong(2, -4), "destination: node -4 out of node range [0, 3)");
+  EXPECT_EQ(all_wrong(1, 1), "node 1 is in both endpoint sets: source and destination must not overlap");
+  EXPECT_EQ(all_wrong(0, 2), "k must be >= 1 (got 0)");
+  KspOptions bad_tie(0);
+  bad_tie.tie_break = static_cast<RouteTieBreak>(9);
+  EXPECT_EQ(error_of([&] { (void)ksp(g, 7, 7, bad_tie); }), "tie_break: 9 is not a value of RouteTieBreak");
+  const auto dag = detail::PredecessorDAGBuilder::of_edges(g, std::vector<EdgeId> {0, 1});
+  const auto dag_other = detail::PredecessorDAGBuilder::of_edges(other, std::vector<EdgeId> {0});
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag_other, 9, 9, false, 0); }), "foreign PredecessorDAG: built for another graph");
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag, 9, -9, false, 0); }), "source: node 9 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag, 3, 3, false, 0); }), "source: node 3 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag, 0, 3, false, 0); }), "destination: node 3 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag, 2, 2, false, 0); }),
+            "node 2 is in both endpoint sets: source and destination must not overlap");
+  EXPECT_EQ(error_of([&] { (void)resolve_to_paths(g, dag, 0, 2, false, 0); }), "max_paths must be >= 1 (got 0)");
+  // Valid endpoints at both ends of the range.
+  EXPECT_EQ(run(g, 0, 2, 1, sel()).size(), 1U);
+  EXPECT_EQ(resolve_to_paths(g, dag, 0, 2).size(), 1U);
+  EXPECT_TRUE(run(g, 2, 0, 1, sel()).empty());
+}
+
+TEST(Ksp, ZeroCapacityEdgesAreSearchedAndOnlyAResidualFiltersThem) {
+  // Ids: 0: 0->1, 1: 0->2 (cost 1), 2: 0->3 cap 0, 3: 0->3 cap 1 (cost 2), 4: 1->3, 5: 2->3 (cost 1).
+  auto g = bgraph(4, {{0, 1, 1, 1}, {1, 3, 1, 1}, {0, 2, 1, 1}, {2, 3, 1, 1}, {0, 3, 0, 2}, {0, 3, 1, 2}});
+  ASSERT_EQ(g.edge_capacity_units()[2], 0);
+  auto walks = [](const std::vector<std::pair<Cost, Path>>& r) {
+    std::vector<std::vector<EdgeId>> out;
+    for (const auto& [c, p] : r) out.push_back(walk_of(p));
+    return out;
+  };
+  // Four walks of cost 2, the zero-capacity edge searched like any other: the one-hop walks
+  // first ([2] before [3] by EdgeId), then the two-hop walks.
+  auto all = run(g, 0, 3, 8, sel());
+  EXPECT_EQ(costs_of(all), (std::vector<Cost>{2, 2, 2, 2}));
+  EXPECT_EQ(walks(all), (std::vector<std::vector<EdgeId>>{{2}, {3}, {0, 4}, {1, 5}}));
+  // A residual equal to the capacities filters the zero-capacity edge (it has no unit free), and
+  // so does an Eligibility excluding it.
+  const std::vector<EdgeId> zero = {2};
+  auto el = g.eligibility({}, zero);
+  const std::vector<std::vector<EdgeId>> without = {{3}, {0, 4}, {1, 5}};
+  EXPECT_EQ(walks(run(g, 0, 3, 8, sel(), std::nullopt, nullptr, &el)), without);
+  const std::vector<Amount> full(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  EXPECT_EQ(walks(run(g, 0, 3, 8, sel(), std::nullopt, &full)), without);
+}
+
+TEST(Ksp, ZeroEdgeExamplesOfTheContract) {
+  // KSP over the zero edge, with and without a residual (ids 0: 0->1 cap 0, 1: 0->2 cap 5, 2: 2->1 cap 5,
+  // costs 1): k = 2 lists [0] (cost 1) and [1, 2] (cost 2); the residual (0, 5, 5) leaves [1, 2].
+  auto g = bgraph(3, {{0, 1, 0, 1}, {0, 2, 5, 1}, {2, 1, 5, 1}});
+  auto r = run(g, 0, 1, 2, sel());
+  ASSERT_EQ(r.size(), 2U);
+  EXPECT_EQ(costs_of(r), (std::vector<Cost>{1, 2}));
+  EXPECT_EQ(walk_of(r[0].second), (std::vector<EdgeId>{0}));
+  EXPECT_EQ(walk_of(r[1].second), (std::vector<EdgeId>{1, 2}));
+  const std::vector<Amount> res = {0, 5, 5};
+  auto gated = run(g, 0, 1, 2, sel(), std::nullopt, &res);
+  ASSERT_EQ(gated.size(), 1U);
+  EXPECT_EQ(costs_of(gated), (std::vector<Cost>{2}));
+  EXPECT_EQ(walk_of(gated[0].second), (std::vector<EdgeId>{1, 2}));
+  // The ceiling CostStretch(6/5): ids 0: 0->1 cap 0 cost 5, 1: 0->1 cap 1 cost 6. The static
+  // baseline counts the zero-capacity edge: 5; 6 * 5 <= 6 * 5 exactly, so both walks fit (the
+  // binary value of the float 1.2 would keep only the first); at 11/10 the cost-6 walk does not.
+  auto h = bgraph(2, {{0, 1, 0, 5}, {0, 1, 1, 6}});
+  EXPECT_EQ(costs_of(run(h, 0, 1, 2, sel(), CostStretch(6, 5))), (std::vector<Cost>{5, 6}));
+  auto ceiled = run(h, 0, 1, 2, sel(), CostStretch(11, 10));
+  ASSERT_EQ(ceiled.size(), 1U);
+  EXPECT_EQ(costs_of(ceiled), (std::vector<Cost>{5}));
+  EXPECT_EQ(walk_of(ceiled[0].second), (std::vector<EdgeId>{0}));
+}
+
+TEST(Ksp, HeadroomWithoutAResidualReadsOneOrZero) {
+  // Two equal-cost walks: [0, 2] over 0->1 (cap 0) and 1->3, [1, 3] over 0->2 and 2->3 (cap 5).
+  // HEADROOM without a residual reads capacity / capacity: 0 on the zero-capacity edge, else 1.
+  // HIGHER_HEADROOM ranks the bottleneck-1 walk first; FEWER_HOPS the EdgeId order.
+  auto g = bgraph(4, {{0, 1, 0, 1}, {0, 2, 5, 1}, {1, 3, 5, 1}, {2, 3, 5, 1}});
+  const auto head = sel(true, RouteTieBreak::HigherHeadroom);
+  auto r = run(g, 0, 3, 2, head);
+  ASSERT_EQ(r.size(), 2U);
+  EXPECT_EQ(walk_of(r[0].second), (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(walk_of(r[1].second), (std::vector<EdgeId>{0, 2}));
+  auto d = run(g, 0, 3, 2, sel());
+  ASSERT_EQ(d.size(), 2U);
+  EXPECT_EQ(walk_of(d[0].second), (std::vector<EdgeId>{0, 2}));
+  // On positive capacities 1 and 5 every edge reads 1: the bottlenecks tie and the EdgeId order
+  // decides (CAPACITY would rank the capacity-5 walk first).
+  auto q = bgraph(4, {{0, 1, 1, 1}, {0, 2, 5, 1}, {1, 3, 1, 1}, {2, 3, 5, 1}});
+  EXPECT_EQ(walk_of(run(q, 0, 3, 1, head)[0].second), (std::vector<EdgeId>{0, 2}));
+  const auto cap = sel(true, RouteTieBreak::HigherCapacity);
+  EXPECT_EQ(walk_of(run(q, 0, 3, 1, cap)[0].second), (std::vector<EdgeId>{1, 3}));
+}
+
+TEST(Ksp, CeilingsOnChainPlusBypasses) {
+  // Chain 0-1-2-3 (cost 3) with bypasses 0->2 and 1->3 (cost 3 each): static baseline 3.
+  auto g = bgraph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {0, 2, 1, 3}, {1, 3, 1, 3}});
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel())), (std::vector<Cost>{3, 4, 4}));
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), CostStretch(1))), (std::vector<Cost>{3}));
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), CostStretch(3, 2))), (std::vector<Cost>{3, 4, 4}));
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), CostStretch(5, 4))), (std::vector<Cost>{3}));  // 4 * 4 > 5 * 3
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), CostStretch(4, 3))), (std::vector<Cost>{3, 4, 4}));  // 4 * 3 = 4 * 3
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), AbsoluteCost {3})), (std::vector<Cost>{3}));
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), AbsoluteCost {4})), (std::vector<Cost>{3, 4, 4}));
+  EXPECT_TRUE(run(g, 0, 3, 8, sel(), AbsoluteCost {0}).empty());  // a valid empty budget
+  // The CostStretch baseline is static: a residual gating the middle edge removes the cost-3 path but
+  // not the baseline, so CostStretch(1) keeps nothing (the residual paths cost 4).
+  std::vector<Amount> res(5, 1);
+  const auto inv = id_of_input(g);
+  res[static_cast<std::size_t>(inv[2])] = 0;  // the middle edge 1 -> 2
+  EXPECT_TRUE(run(g, 0, 3, 8, sel(), CostStretch(1), &res).empty());
+  EXPECT_EQ(costs_of(run(g, 0, 3, 8, sel(), std::nullopt, &res)), (std::vector<Cost>{4, 4}));
+  // No static route under a CostStretch ceiling: [].
+  const std::vector<NodeId> xn = {1, 2};
+  auto el = g.eligibility(xn, {});
+  EXPECT_TRUE(run(g, 0, 3, 8, sel(), CostStretch(2), nullptr, &el).empty());
+}
+
+// The CostStretch ceiling is exact where a 64-bit product overflows: cost * d <= n * base in 128
+// bits. Paths 0->1 of cost b and 0->2->1 of cost b + 1 (b + 2 on the second graph). b = 2^60: b + 1
+// rounds to b in a double, so CostStretch(1) admitting both paths would be a double comparison;
+// (2^60 + 1) / 2^60 admits b + 1 at equality and (2^61 + 1) / 2^61 does not ((2^60 + 1) * 2^61 =
+// 2^121 + 2^61 > 2^121 + 2^60); the largest numerator admits both. b = 2^52: (2^52 + 1) / 2^52
+// admits b + 1, not b + 2.
+TEST(Ksp, StretchCeilingIsExactForLargeCostsAndFactors) {
+  const Cost big = Cost {1} << 60;
+  auto g = bgraph(3, {{0, 1, 1, big}, {0, 2, 1, 1}, {2, 1, 1, big}});
+  EXPECT_EQ(costs_of(run(g, 0, 1, 8, sel(), CostStretch(1))), (std::vector<Cost> {big}));
+  EXPECT_EQ(costs_of(run(g, 0, 1, 8, sel(), CostStretch(big + 1, big))), (std::vector<Cost> {big, big + 1}));
+  EXPECT_EQ(costs_of(run(g, 0, 1, 8, sel(), CostStretch(2 * big + 1, 2 * big))), (std::vector<Cost> {big}));
+  EXPECT_EQ(costs_of(run(g, 0, 1, 8, sel(), CostStretch(std::numeric_limits<std::int64_t>::max()))),
+            (std::vector<Cost> {big, big + 1}));
+  const Cost b52 = Cost {1} << 52;
+  auto h = bgraph(4, {{0, 1, 1, b52}, {0, 2, 1, 1}, {2, 1, 1, b52}, {0, 3, 1, 2}, {3, 1, 1, b52}});
+  EXPECT_EQ(costs_of(run(h, 0, 1, 8, sel(), CostStretch(1))), (std::vector<Cost> {b52}));
+  EXPECT_EQ(costs_of(run(h, 0, 1, 8, sel(), CostStretch(b52 + 1, b52))), (std::vector<Cost> {b52, b52 + 1}));
+  EXPECT_EQ(costs_of(run(h, 0, 1, 8, sel(), CostStretch(2))), (std::vector<Cost> {b52, b52 + 1, b52 + 2}));
+  // Components at 2^63 - 1 on a cost of 2^62 - 1 (c = c0): the products stay below 2^125.
+  const Cost top = (Cost {1} << 62) - 1;
+  constexpr std::int64_t kMax = std::numeric_limits<std::int64_t>::max();
+  EXPECT_EQ(costs_of(run(bgraph(2, {{0, 1, 1, top}}), 0, 1, 1, sel(), CostStretch(kMax, kMax - 1))),
+            (std::vector<Cost> {top}));
+}
+
+TEST(Ksp, ValidationInTheContractOrder) {
+  auto g = bgraph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  auto other = bgraph(3, {{0, 1, 1, 1}});
+  auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  const std::vector<Amount> bad = {1, 2};
+  // The endpoints and k, alone and with every later argument wrong: the test above.
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), AbsoluteCost {-1}); }), "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)");
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), CostStretch(1, 2)); }),
+            "cost_ceiling CostStretch factor must be >= 1 (got 1/2)");
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), CostStretch(std::numeric_limits<std::int64_t>::min())); }),
+            "cost_ceiling CostStretch factor must be >= 1 (got -9223372036854775808/1)");
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), CostStretch(1, 2), &bad); }),
+            "cost_ceiling CostStretch factor must be >= 1 (got 1/2)");  // before the residual
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), std::nullopt, &bad); }), "residual[1] = 2 is outside [0, edge_capacity_units[1] = 1]");
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), std::nullopt, nullptr, &foreign); }),
+            "foreign Eligibility: built for another graph");
+  // Order: the ceiling before the residual (the endpoints before k before the ceiling: the test
+  // above).
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 2, 1, sel(), AbsoluteCost {-1}, &bad); }), "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)");
+  KspOptions o(1);
+  o.tie_break = static_cast<RouteTieBreak>(4);
+  EXPECT_EQ(error_of([&] { (void)ksp(g, 0, 2, o); }), "tie_break: 4 is not a value of RouteTieBreak");
+  // An excluded endpoint, the source or the destination, gives [], never an error.
+  for (const NodeId x : {0, 2}) {
+    const std::vector<NodeId> xn = {x};
+    auto el = g.eligibility(xn, {});
+    EXPECT_TRUE(run(g, 0, 2, 3, sel(), std::nullopt, nullptr, &el).empty()) << x;
+    EXPECT_TRUE(run(g, 0, 2, 3, sel(), CostStretch(2), nullptr, &el).empty()) << x;
+  }
+}
+
+// A residual array with several defects at once (one error, from the shared edge-amount check): its
+// length before any entry, then its first entry outside [0, capacity] in EdgeId order, before
+// the Eligibility.
+TEST(Ksp, ResidualDefectsReportTheFirstInOrder) {
+  const auto g = edge_amount_graph();
+  const auto other = make_graph(4, {{0, 1, 2, 1}});
+  const auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  for (const auto& c : edge_amount_defects()) {
+    EXPECT_EQ(error_of([&] { (void)run(g, 0, 3, 2, sel(), std::nullopt, &c.amounts, &foreign); }), "residual" + c.error);
+  }
+  const auto bounds = edge_amounts_at_the_bounds();
+  EXPECT_EQ(error_of([&] { (void)run(g, 0, 3, 2, sel(), std::nullopt, &bounds); }), "");
+}
+
+namespace {
+
+// The reference KSP list: every simple source -> destination path of the member graph sorted by the key,
+// truncated at the inclusive ceiling and at k.
+std::vector<std::vector<EdgeId>> reference_ksp(const Graph& g, const ref::Query& q, NodeId s, NodeId t, std::int64_t k,
+                                               std::optional<CostCeiling> ceiling) {
+  const auto mem = ref::members(q);
+  std::vector<char> is_end(static_cast<std::size_t>(g.num_nodes()), 0);
+  is_end[static_cast<std::size_t>(t)] = 1;
+  std::vector<std::vector<EdgeId>> all;
+  std::vector<EdgeId> walk;
+  std::vector<char> on(static_cast<std::size_t>(g.num_nodes()), 0);
+  on[static_cast<std::size_t>(s)] = 1;
+  ref::walks(g, mem, s, is_end, walk, on, all);
+  std::sort(all.begin(), all.end(), [&](const auto& a, const auto& b) { return ref::key_less(q, a, b); });
+  // The static baseline: the member graph without the residual, Expand.
+  ref::Query st = q;
+  st.residual = nullptr;
+  st.parallel_edges = true;
+  const auto d = ref::distances(g, ref::members(st), {s}, false);
+  std::vector<std::vector<EdgeId>> out;
+  for (const auto& p : all) {
+    if (static_cast<std::int64_t>(out.size()) == k) break;
+    Cost c = 0;
+    for (EdgeId e : p) c += g.edge_costs()[static_cast<std::size_t>(e)];
+    if (ceiling.has_value()) {
+      if (const auto* a = std::get_if<AbsoluteCost>(&*ceiling)) {
+        if (c > a->cost) break;
+      } else {
+        const Cost base = d[static_cast<std::size_t>(t)];
+        if (base == ref::kNone) return {};
+        // c <= (n / d) * base exactly: c * d <= n * base.
+        const auto& f = std::get<CostStretch>(*ceiling);
+        if (static_cast<Int128>(c) * f.denominator() > static_cast<Int128>(f.numerator()) * base) break;
+      }
+    }
+    out.push_back(p);
+  }
+  return out;
+}
+
+} // namespace
+
+TEST(Ksp, RandomGraphsAgreeWithExhaustiveEnumeration) {
+  // Random graphs (seed 6006) checked against exhaustive enumeration: parallel members, residuals,
+  // masks, every tie_break, Expand and Collapse, k in {1, 3, 8}, AbsoluteCost and CostStretch
+  // ceilings.
+  std::mt19937 rng(6006);
+  int nonempty = 0;
+  int deep = 0;
+  for (int gi = 0; gi < 300; ++gi) {
+    const int n = 3 + static_cast<int>(rng() % 5);
+    const int m = n + static_cast<int>(rng() % static_cast<unsigned>(2 * n + 2));
+    std::vector<InEdge> rows;
+    for (int i = 0; i < m; ++i) {
+      rows.push_back({static_cast<NodeId>(rng() % static_cast<unsigned>(n)), static_cast<NodeId>(rng() % static_cast<unsigned>(n)),
+                      static_cast<Amount>(rng() % 5), static_cast<Cost>(1 + rng() % 5)});
+    }
+    if (rng() % 2 == 0) {
+      const auto u = static_cast<NodeId>(rng() % static_cast<unsigned>(n));
+      const auto v = static_cast<NodeId>(rng() % static_cast<unsigned>(n));
+      for (int i = 0; i < 2; ++i) rows.push_back({u, v, static_cast<Amount>(1 + rng() % 4), static_cast<Cost>(1 + rng() % 3)});
+    }
+    rows.push_back({0, static_cast<NodeId>(n - 1), static_cast<Amount>(1 + rng() % 3), static_cast<Cost>(3 + rng() % 6)});
+    auto g = make_graph(n, rows);
+    std::vector<Amount> residual(static_cast<std::size_t>(g.num_edges()));
+    for (std::size_t e = 0; e < residual.size(); ++e) {
+      residual[e] = static_cast<Amount>(rng() % static_cast<unsigned>(g.edge_capacity_units()[e] + 1));
+    }
+    std::vector<NodeId> xn;
+    std::vector<EdgeId> xe;
+    for (NodeId v = 1; v + 1 < n; ++v) {
+      if (rng() % 10 == 0) xn.push_back(v);
+    }
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      if (rng() % 10 == 0) xe.push_back(e);
+    }
+    const auto el = g.eligibility(xn, xe);
+    for (int c = 0; c < 24; ++c) {
+      const bool use_res = rng() % 2 == 0;
+      const bool masks = rng() % 10 < 3;
+      const RouteTieBreak higher[3] = {RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherCapacity,
+                                       RouteTieBreak::HigherHeadroom};
+      const bool parallel = rng() % 2 == 0;
+      const bool prefer = rng() % 2 != 0;
+      const RouteTieBreak tie = higher[rng() % 3];
+      const auto s1 = sel(parallel, prefer ? tie : RouteTieBreak::FewerHops);
+      const std::int64_t ks[3] = {1, 3, 8};
+      const std::int64_t k = ks[rng() % 3];
+      std::optional<CostCeiling> ceiling;
+      const auto pick = rng() % 4;
+      if (pick == 2) ceiling = AbsoluteCost {static_cast<Cost>(3 + rng() % 9)};
+      if (pick == 3) {
+        const std::pair<std::int64_t, std::int64_t> fs[4] = {{1, 1}, {5, 4}, {3, 2}, {2, 1}};
+        const auto [n, d] = fs[rng() % 4];
+        ceiling = CostStretch(n, d);
+      }
+      ref::Query q;
+      q.g = &g;
+      q.elig = masks ? &el : nullptr;
+      q.residual = use_res ? &residual : nullptr;
+      q.parallel_edges = s1.parallel_edges;
+      q.tie_break = s1.tie_break;
+      const auto want = reference_ksp(g, q, 0, static_cast<NodeId>(n - 1), k, ceiling);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      detail::KspProbe probe;
+      probe.duplicate = [](void*, std::size_t old_d, std::size_t new_d) { EXPECT_EQ(old_d, new_d); };
+      detail::ScopedKspProbe full_yen(&probe);
+#endif
+      auto got = run(g, 0, static_cast<NodeId>(n - 1), k, s1, ceiling, use_res ? &residual : nullptr, masks ? &el : nullptr);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+      probe.full_yen = true;
+      const auto full = run(g, 0, static_cast<NodeId>(n - 1), k, s1, ceiling, use_res ? &residual : nullptr, masks ? &el : nullptr);
+      EXPECT_EQ(got, full) << "graph " << gi << " case " << c;
+#endif
+      std::vector<std::vector<EdgeId>> walks;
+      for (const auto& [cost, p] : got) {
+        walks.push_back(walk_of(p));
+        EXPECT_EQ(cost, p.cost());
+      }
+      ASSERT_EQ(walks, want) << "graph " << gi << " case " << c;
+      if (!want.empty()) ++nonempty;
+      if (want.size() >= 3) ++deep;
+    }
+  }
+  EXPECT_GT(nonempty, 3000);
+  EXPECT_GT(deep, 300);
+}
+
+namespace {
+
+// Every source -> destination walk of a DAG given by its edges, as hops (grouped or split), sorted by the
+// resolver's key (cost, hops, edge-id sequence with a grouped hop keyed by its lowest member).
+std::vector<std::vector<std::vector<EdgeId>>> reference_walks(const Graph& g, const std::vector<EdgeId>& dag, NodeId s,
+                                                              NodeId t, bool split) {
+  std::map<std::pair<NodeId, NodeId>, std::vector<EdgeId>> groups;
+  for (EdgeId e : dag) groups[{g.edge_sources()[static_cast<std::size_t>(e)], g.edge_destinations()[static_cast<std::size_t>(e)]}].push_back(e);
+  for (auto& [k, v] : groups) std::sort(v.begin(), v.end());
+  std::vector<std::vector<std::vector<EdgeId>>> out;
+  std::function<void(NodeId, std::vector<std::vector<EdgeId>>&)> walk = [&](NodeId u, std::vector<std::vector<EdgeId>>& hops) {
+    if (u == t) {
+      if (!split) {
+        out.push_back(hops);
+        return;
+      }
+      std::vector<std::vector<std::vector<EdgeId>>> combos(1);
+      for (const auto& h : hops) {
+        std::vector<std::vector<std::vector<EdgeId>>> next;
+        for (const auto& c : combos) {
+          for (EdgeId e : h) {
+            auto cc = c;
+            cc.push_back({e});
+            next.push_back(cc);
+          }
+        }
+        combos = next;
+      }
+      out.insert(out.end(), combos.begin(), combos.end());
+      return;
+    }
+    for (const auto& [k, v] : groups) {
+      if (k.first != u) continue;
+      hops.push_back(v);
+      walk(k.second, hops);
+      hops.pop_back();
+    }
+  };
+  std::vector<std::vector<EdgeId>> hops;
+  walk(s, hops);
+  auto key = [&](const std::vector<std::vector<EdgeId>>& p) {
+    Cost c = 0;
+    std::vector<EdgeId> seq;
+    for (const auto& h : p) {
+      Cost best = g.edge_costs()[static_cast<std::size_t>(h.front())];
+      for (EdgeId e : h) best = std::min(best, g.edge_costs()[static_cast<std::size_t>(e)]);
+      c += best;
+      seq.push_back(h.front());
+    }
+    return std::make_tuple(c, p.size(), seq);
+  };
+  std::stable_sort(out.begin(), out.end(), [&](const auto& a, const auto& b) { return key(a) < key(b); });
+  return out;
+}
+
+} // namespace
+
+TEST(ResolveToPaths, OrderSplitAndTruncation) {
+  // A DAG with a parallel pair, two routes of equal cost and a dearer one:
+  // EdgeIds: 0: 0->1 (1), 1: 0->1 (1), 2: 0->2 (1), 3: 0->3 (5), 4: 1->3 (1), 5: 2->3 (1).
+  auto g = bgraph(4, {{0, 1, 1, 1}, {0, 1, 1, 1}, {0, 2, 1, 1}, {0, 3, 1, 5}, {1, 3, 1, 1}, {2, 3, 1, 1}});
+  const auto dag = detail::PredecessorDAGBuilder::of_edges(g, std::vector<EdgeId> {0, 1, 2, 3, 4, 5});
+  auto hops_of = [](const std::vector<Path>& ps) {
+    std::vector<std::vector<std::vector<EdgeId>>> out;
+    for (const auto& p : ps) out.push_back(p.hops());
+    return out;
+  };
+  // Grouped: [[0, 1], [4]] (cost 2, key 0), [[2], [5]] (cost 2, key 2), [[3]] (cost 5).
+  auto grouped = resolve_to_paths(g, dag, 0, 3);
+  EXPECT_EQ(hops_of(grouped), (std::vector<std::vector<std::vector<EdgeId>>> {{{0, 1}, {4}}, {{2}, {5}}, {{3}}}));
+  EXPECT_EQ(grouped[0].cost(), 2);
+  EXPECT_EQ(grouped[2].cost(), 5);
+  // Split: one path per member combination, sorted by its own (cost, hops, edge-id sequence).
+  auto split = resolve_to_paths(g, dag, 0, 3, true);
+  EXPECT_EQ(hops_of(split), (std::vector<std::vector<std::vector<EdgeId>>> {{{0}, {4}}, {{1}, {4}}, {{2}, {5}}, {{3}}}));
+  EXPECT_EQ(resolve_to_paths(g, dag, 0, 3, true, 2).size(), 2U);
+  EXPECT_EQ(hops_of(resolve_to_paths(g, dag, 0, 3, false, 1)), (std::vector<std::vector<std::vector<EdgeId>>> {{{0, 1}, {4}}}));
+  // An endpoint the DAG does not join: [].
+  EXPECT_TRUE(resolve_to_paths(g, dag, 3, 0).empty());
+  EXPECT_TRUE(resolve_to_paths(g, detail::PredecessorDAGBuilder::of_edges(g, std::vector<EdgeId> {4}), 0, 3).empty());
+  // Unequal parallel costs: expanding the first grouped walk in place would put cost 4 before
+  // the direct cost-3 path, and truncating there would discard the wrong path.
+  const auto mixed = bgraph(3, {{0, 1, 1, 1}, {0, 1, 1, 3}, {1, 2, 1, 1}, {0, 2, 1, 3}});
+  const auto all = detail::PredecessorDAGBuilder::of_edges(mixed, all_ids(mixed));
+  const auto grouped_mixed = resolve_to_paths(mixed, all, 0, 2);
+  EXPECT_EQ(hops_of(grouped_mixed), (std::vector<std::vector<std::vector<EdgeId>>> {{{0, 1}, {3}}, {{2}}}));
+  const auto split_mixed = resolve_to_paths(mixed, all, 0, 2, true);
+  EXPECT_EQ(hops_of(split_mixed), (std::vector<std::vector<std::vector<EdgeId>>> {{{0}, {3}}, {{2}}, {{1}, {3}}}));
+  ASSERT_EQ(split_mixed.size(), 3U);
+  EXPECT_EQ((std::vector<Cost> {split_mixed[0].cost(), split_mixed[1].cost(), split_mixed[2].cost()}),
+            (std::vector<Cost> {2, 3, 4}));
+  EXPECT_EQ(hops_of(resolve_to_paths(mixed, all, 0, 2, true, 2)),
+            (std::vector<std::vector<std::vector<EdgeId>>> {{{0}, {3}}, {{2}}}));
+  // Validation: Ksp.EndpointDefectsReportTheFirstInOrder.
+}
+
+TEST(ResolveToPaths, RandomDagsAgreeWithEnumeration) {
+  // Random DAGs (edges u -> v with u < v, parallel members, mixed costs, not necessarily tight):
+  // the order, both forms and the truncation against the enumeration of every walk.
+  std::mt19937 rng(55);
+  int nonempty = 0;   // checks with at least one walk
+  int truncated = 0;  // checks whose max_paths cut the walks short
+  for (int trial = 0; trial < 600; ++trial) {
+    const int n = 2 + static_cast<int>(rng() % 7);
+    std::vector<InEdge> rows;
+    const int m = static_cast<int>(rng() % 18);
+    for (int i = 0; i < m; ++i) {
+      const auto u = static_cast<NodeId>(rng() % static_cast<unsigned>(n - 1));
+      const auto v = static_cast<NodeId>(u + 1 + rng() % static_cast<unsigned>(n - 1 - u));
+      rows.push_back({u, v, 1, static_cast<Cost>(1 + rng() % 4)});
+    }
+    auto g = make_graph(n, rows);
+    std::vector<EdgeId> edges;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      if (rng() % 5 != 0) edges.push_back(e);
+    }
+    const auto dag = detail::PredecessorDAGBuilder::of_edges(g, edges);
+    const NodeId s = 0;
+    const auto t = static_cast<NodeId>(n - 1);
+    for (bool split : {false, true}) {
+      const auto want = reference_walks(g, edges, s, t, split);
+      for (std::optional<std::int64_t> mp : {std::optional<std::int64_t> {}, std::optional<std::int64_t> {1},
+                                            std::optional<std::int64_t> {3}}) {
+        const auto got = resolve_to_paths(g, dag, s, t, split, mp);
+        const std::size_t expect_n = mp.has_value() ? std::min<std::size_t>(want.size(), static_cast<std::size_t>(*mp)) : want.size();
+        ASSERT_EQ(got.size(), expect_n) << trial;
+        for (std::size_t i = 0; i < got.size(); ++i) EXPECT_EQ(got[i].hops(), want[i]) << trial << " path " << i;
+        nonempty += want.empty() ? 0 : 1;
+        truncated += expect_n < want.size() ? 1 : 0;
+      }
+    }
+  }
+  RecordProperty("nonempty", nonempty);
+  RecordProperty("truncated", truncated);
+  EXPECT_GT(nonempty, 1800);  // not vacuous: most DAGs hold a walk
+  EXPECT_GT(truncated, 400);
+}
+
+TEST(ResolveToPaths, ResolvesASearchDagFromEitherDirection) {
+  // The DAG of a reverse search is forward-oriented: resolving it from a source gives the same
+  // walks as resolving the forward search's DAG.
+  auto g = bgraph(5, {{0, 1, 1, 1}, {0, 2, 1, 1}, {1, 3, 1, 1}, {2, 3, 1, 1}, {3, 4, 1, 1}, {0, 4, 1, 3}});
+  SpfOptions f(Direction::Forward);
+  SpfOptions r(Direction::Reverse);
+  auto fw = spf(g, std::vector<NodeId> {0}, f);
+  auto rv = spf(g, std::vector<NodeId> {4}, r);
+  auto a = resolve_to_paths(g, fw.dag, 0, 4);
+  auto b = resolve_to_paths(g, rv.dag, 0, 4);
+  ASSERT_EQ(a.size(), 3U);
+  ASSERT_EQ(b.size(), 3U);
+  for (std::size_t i = 0; i < a.size(); ++i) EXPECT_TRUE(a[i] == b[i]);
+  EXPECT_EQ(a[0].cost(), 3);
+}
+
+TEST(ResolveToPaths, LongChainsNeedNoRecursion) {
+  // A 200,000-node chain with one parallel pair: the enumeration keeps an explicit stack.
+  const int n = 200000;
+  std::vector<InEdge> rows;
+  for (int v = 0; v + 1 < n; ++v) rows.push_back({v, v + 1, 1, 1});
+  rows.push_back({n / 2, n / 2 + 1, 1, 1});
+  auto g = make_graph(n, rows);
+  const auto dag = detail::PredecessorDAGBuilder::of_edges(g, all_ids(g));
+  EXPECT_EQ(resolve_to_paths(g, dag, 0, n - 1, true).size(), 2U);
+  EXPECT_EQ(resolve_to_paths(g, dag, 0, n - 1).size(), 1U);
+}
diff --git a/tests/cpp/layout_checker.hpp b/tests/cpp/layout_checker.hpp
new file mode 100644
index 0000000..4fd0ffd
--- /dev/null
+++ b/tests/cpp/layout_checker.hpp
@@ -0,0 +1,217 @@
+// An independent checker of the graph's stored layout (the EdgeId order and the CSR arrays that
+// graph.hpp describes).
+//
+// It reads the arrays as spans and the caller's input separately, and derives every expectation
+// from the layout's definition, never from the constructor's helpers:
+//   1. sizes first, before any element is read: N >= 0, E >= 0, the input arrays of length E,
+//      every per-edge array and the input map of length E, both offset arrays of length N + 1,
+//      the reverse slots of length E, the internal reverse-source copy of length E;
+//   2. then ranges, before any value is used as an index: offsets in [0, E], [0] = 0, [N] = E,
+//      non-decreasing; endpoints in [0, N); the map and the slots in [0, E) and permutations;
+//      the copied sources in [0, N);
+//   3. then the order: the ids of row u have source u and strictly increasing (cost, destination, input);
+//      the slots of v hold edges with destination v in strictly increasing (cost, source, input);
+//      each copied source equals edge_sources()[incoming_edges()[slot]]; every property is the input
+//      array permuted by the map; max_edge_cost and edge_cost_gcd are the full scans (0 without edges).
+// A failing step stops the check (later steps would read through unchecked values). The result
+// is the list of defect codes of the failing step, empty when the layout is correct.
+#pragma once
+
+#include <cstdint>
+#include <numeric>
+#include <span>
+#include <string>
+#include <tuple>
+#include <vector>
+
+#include "netgraph/core/types.hpp"
+
+namespace netgraph::core::test {
+
+// The caller's input, in input coordinates.
+struct LayoutInput {
+  std::int64_t num_nodes {0};
+  std::span<const NodeId> src {};
+  std::span<const NodeId> dst {};
+  std::span<const Amount> capacity {};
+  std::span<const Cost> cost {};
+};
+
+// What a graph stores (or claims to store).
+struct LayoutSpans {
+  std::int64_t num_nodes {0};
+  std::int64_t num_edges {0};
+  std::span<const Amount> capacity {};
+  std::span<const Cost> cost {};
+  std::span<const NodeId> src {};
+  std::span<const NodeId> dst {};
+  std::span<const std::int32_t> input_positions {};
+  std::span<const std::int32_t> outgoing_offsets {};
+  std::span<const std::int32_t> incoming_offsets {};
+  std::span<const EdgeId> incoming_edges {};
+  std::span<const NodeId> incoming_edge_sources {};  // the internal copy of the in-edges' sources
+  Cost max_edge_cost {0};
+  Cost edge_cost_gcd {0};
+};
+
+namespace layout_checker_detail {
+
+inline void offsets_ok(std::span<const std::int32_t> off, std::int64_t n, std::int64_t m, const char* name,
+                       std::vector<std::string>& bad) {
+  bool range = true;
+  bool monotone = true;
+  for (std::size_t k = 0; k < off.size(); ++k) {
+    if (off[k] < 0 || off[k] > m) range = false;
+    if (k > 0 && off[k] < off[k - 1]) monotone = false;
+  }
+  if (!range) bad.push_back(std::string(name) + ":range");
+  if (off[0] != 0) bad.push_back(std::string(name) + ":start");
+  if (off[static_cast<std::size_t>(n)] != m) bad.push_back(std::string(name) + ":end");
+  if (!monotone) bad.push_back(std::string(name) + ":monotone");
+}
+
+template <typename T>
+bool permutation_of_range(std::span<const T> a, std::int64_t m) {
+  std::vector<std::uint8_t> seen(static_cast<std::size_t>(m), 0);
+  for (const T x : a) {
+    if (x < 0 || x >= m) return false;
+    if (seen[static_cast<std::size_t>(x)] != 0) return false;
+    seen[static_cast<std::size_t>(x)] = 1;
+  }
+  return true;
+}
+
+} // namespace layout_checker_detail
+
+inline std::vector<std::string> check_layout(const LayoutSpans& g, const LayoutInput& in) {
+  using namespace layout_checker_detail;
+  std::vector<std::string> bad;
+  const std::int64_t n = g.num_nodes;
+  const std::int64_t m = g.num_edges;
+  // 1. Sizes (no element is read).
+  if (n < 0 || n != in.num_nodes) bad.emplace_back("size:num_nodes");
+  if (m < 0 || static_cast<std::size_t>(m) != in.src.size()) bad.emplace_back("size:num_edges");
+  if (!bad.empty()) return bad;
+  const auto me = static_cast<std::size_t>(m);
+  const auto np1 = static_cast<std::size_t>(n) + 1;
+  auto size_is = [&](std::size_t got, std::size_t want, const char* name) {
+    if (got != want) bad.emplace_back(std::string("size:") + name);
+  };
+  size_is(in.dst.size(), me, "input.dst");
+  size_is(in.capacity.size(), me, "input.capacity");
+  size_is(in.cost.size(), me, "input.cost");
+  size_is(g.capacity.size(), me, "capacity");
+  size_is(g.cost.size(), me, "cost");
+  size_is(g.src.size(), me, "src");
+  size_is(g.dst.size(), me, "dst");
+  size_is(g.input_positions.size(), me, "input_positions");
+  size_is(g.outgoing_offsets.size(), np1, "outgoing_offsets");
+  size_is(g.incoming_offsets.size(), np1, "incoming_offsets");
+  size_is(g.incoming_edges.size(), me, "incoming_edges");
+  size_is(g.incoming_edge_sources.size(), me, "in_col_indices");
+  if (!bad.empty()) return bad;
+
+  // 2. Ranges and permutations (values are read, none is used as an index yet).
+  offsets_ok(g.outgoing_offsets, n, m, "outgoing_offsets", bad);
+  offsets_ok(g.incoming_offsets, n, m, "incoming_offsets", bad);
+  for (std::size_t e = 0; e < me; ++e) {
+    if (g.src[e] < 0 || g.src[e] >= n) {
+      bad.emplace_back("range:src");
+      break;
+    }
+  }
+  for (std::size_t e = 0; e < me; ++e) {
+    if (g.dst[e] < 0 || g.dst[e] >= n) {
+      bad.emplace_back("range:dst");
+      break;
+    }
+  }
+  if (!permutation_of_range(g.input_positions, m)) bad.emplace_back("map:permutation");
+  if (!permutation_of_range(g.incoming_edges, m)) bad.emplace_back("slot:permutation");
+  for (const NodeId x : g.incoming_edge_sources) {
+    if (x < 0 || x >= n) {
+      bad.emplace_back("range:in_col_indices");
+      break;
+    }
+  }
+  if (!bad.empty()) return bad;
+
+  // 3. Properties, order, the copy, the scans.
+  for (std::size_t e = 0; e < me; ++e) {
+    const auto i = static_cast<std::size_t>(g.input_positions[e]);
+    if (g.capacity[e] != in.capacity[i]) {
+      bad.emplace_back("property:capacity");
+      break;
+    }
+  }
+  for (std::size_t e = 0; e < me; ++e) {
+    if (g.cost[e] != in.cost[static_cast<std::size_t>(g.input_positions[e])]) {
+      bad.emplace_back("property:cost");
+      break;
+    }
+  }
+  for (std::size_t e = 0; e < me; ++e) {
+    if (g.src[e] != in.src[static_cast<std::size_t>(g.input_positions[e])]) {
+      bad.emplace_back("property:src");
+      break;
+    }
+  }
+  for (std::size_t e = 0; e < me; ++e) {
+    if (g.dst[e] != in.dst[static_cast<std::size_t>(g.input_positions[e])]) {
+      bad.emplace_back("property:dst");
+      break;
+    }
+  }
+  // Forward rows: the ids of row u, in (cost, destination, input) strictly increasing, source u.
+  bool fwd_member = true;
+  bool fwd_order = true;
+  for (std::size_t u = 0; u + 1 < np1; ++u) {
+    for (auto e = static_cast<std::size_t>(g.outgoing_offsets[u]); e < static_cast<std::size_t>(g.outgoing_offsets[u + 1]); ++e) {
+      if (g.src[e] != static_cast<NodeId>(u)) fwd_member = false;
+      if (e > static_cast<std::size_t>(g.outgoing_offsets[u]) &&
+          !(std::tuple(g.cost[e - 1], g.dst[e - 1], g.input_positions[e - 1]) <
+            std::tuple(g.cost[e], g.dst[e], g.input_positions[e]))) {
+        fwd_order = false;
+      }
+    }
+  }
+  if (!fwd_member) bad.emplace_back("forward:membership");
+  if (!fwd_order) bad.emplace_back("forward:order");
+  // Reverse rows: the slots of v, edges with destination v in (cost, source, input) strictly increasing.
+  bool rev_member = true;
+  bool rev_order = true;
+  for (std::size_t v = 0; v + 1 < np1; ++v) {
+    const auto lo = static_cast<std::size_t>(g.incoming_offsets[v]);
+    const auto hi = static_cast<std::size_t>(g.incoming_offsets[v + 1]);
+    for (std::size_t s = lo; s < hi; ++s) {
+      const auto e = static_cast<std::size_t>(g.incoming_edges[s]);
+      if (g.dst[e] != static_cast<NodeId>(v)) rev_member = false;
+      if (s > lo) {
+        const auto p = static_cast<std::size_t>(g.incoming_edges[s - 1]);
+        if (!(std::tuple(g.cost[p], g.src[p], g.input_positions[p]) < std::tuple(g.cost[e], g.src[e], g.input_positions[e]))) {
+          rev_order = false;
+        }
+      }
+    }
+  }
+  if (!rev_member) bad.emplace_back("reverse:membership");
+  if (!rev_order) bad.emplace_back("reverse:order");
+  for (std::size_t s = 0; s < me; ++s) {
+    if (g.incoming_edge_sources[s] != g.src[static_cast<std::size_t>(g.incoming_edges[s])]) {
+      bad.emplace_back("copy:source");
+      break;
+    }
+  }
+  // The scans, from the input (0 on an empty graph).
+  Cost mx = 0;
+  Cost gcd = 0;
+  for (const Cost c : in.cost) {
+    mx = c > mx ? c : mx;
+    gcd = std::gcd(gcd, c);
+  }
+  if (g.max_edge_cost != mx) bad.emplace_back("scan:max_edge_cost");
+  if (g.edge_cost_gcd != gcd) bad.emplace_back("scan:edge_cost_gcd");
+  return bad;
+}
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/masking_tests.cpp b/tests/cpp/masking_tests.cpp
deleted file mode 100644
index 7af26d3..0000000
--- a/tests/cpp/masking_tests.cpp
+++ /dev/null
@@ -1,646 +0,0 @@
-/**
- * Comprehensive tests for masking behavior in NetGraph-Core.
- *
- * These tests verify:
- * 1. Node and edge mask semantics (true = allowed, false = excluded)
- * 2. Masked source node handling (should return empty DAG)
- * 3. Masked destination node handling
- * 4. Mask validation (length checking)
- * 5. Combination of node and edge masks
- * 6. Interaction with residual capacity gating
- * 7. Masking in max_flow and k_shortest_paths
- */
-
-#include <gtest/gtest.h>
-#include <limits>
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/k_shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/options.hpp"
-#include "netgraph/core/flow_state.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-// ============================================================================
-// Masked Source Tests
-// ============================================================================
-
-TEST(MaskingTests, MaskedSourceReturnsEmptyDAG) {
-  // CRITICAL BUG FIX TEST: When source is masked out, SPF must return empty DAG
-  // and leave all distances at infinity.
-  auto g = make_line_graph(3);  // 0->1->2
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out source node 0
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[0] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // All distances should remain at infinity
-  EXPECT_EQ(dist[0], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-
-  // DAG should be empty (all offsets zero)
-  EXPECT_EQ(dag.parent_offsets.size(), static_cast<std::size_t>(g.num_nodes() + 1));
-  for (const auto& offset : dag.parent_offsets) {
-    EXPECT_EQ(offset, 0) << "DAG should be empty when source is masked";
-  }
-  EXPECT_EQ(dag.parents.size(), 0);
-  EXPECT_EQ(dag.via_edges.size(), 0);
-}
-
-TEST(MaskingTests, MaskedSourceWithDestination) {
-  // Test masked source with explicit destination
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[0] = false;  // Mask source
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, NodeId(2), true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Destination should be unreachable
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-
-  // DAG should be empty
-  EXPECT_EQ(dag.parent_offsets.size(), static_cast<std::size_t>(g.num_nodes() + 1));
-  for (const auto& offset : dag.parent_offsets) {
-    EXPECT_EQ(offset, 0);
-  }
-}
-
-TEST(MaskingTests, MaskedSourceInMaxFlow) {
-  // Test masked source in max_flow algorithm
-  auto g = make_line_graph(3);
-
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[0] = false;  // Mask source
-
-  auto [flow_val, summary] = calc_max_flow(
-      g, 0, 2,
-      FlowPlacement::Proportional, false, true, true, false, false,
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // No flow should be possible
-  EXPECT_DOUBLE_EQ(flow_val, 0.0);
-
-  // Edge flows may be empty or all zeros when no flow is possible
-  if (!summary.edge_flows.empty()) {
-    for (const auto& ef : summary.edge_flows) {
-      EXPECT_DOUBLE_EQ(ef, 0.0);
-    }
-  }
-}
-
-TEST(MaskingTests, MaskedSourceInComputeMinCut) {
-  // Test masked source in FlowState::compute_min_cut (early return optimization)
-  auto g = make_triangle_topology();
-  FlowState fs(g);
-
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[0] = false;  // Mask source
-
-  auto mincut = fs.compute_min_cut(
-      0,
-      std::span<const bool>(node_mask.get(), g.num_nodes()),
-      {});
-
-  // Min cut should be empty when source is masked (early return)
-  EXPECT_EQ(mincut.edges.size(), 0);
-}
-
-TEST(MaskingTests, OutOfRangeSourceInComputeMinCut) {
-  // Test early return for out-of-range source in compute_min_cut
-  auto g = make_triangle_topology();
-  FlowState fs(g);
-
-  // Test negative source
-  auto mincut = fs.compute_min_cut(-1, {}, {});
-  EXPECT_EQ(mincut.edges.size(), 0);
-
-  // Test source >= num_nodes
-  mincut = fs.compute_min_cut(999, {}, {});
-  EXPECT_EQ(mincut.edges.size(), 0);
-}
-
-// ============================================================================
-// Masked Destination Tests
-// ============================================================================
-
-TEST(MaskingTests, MaskedDestinationUnreachable) {
-  auto g = make_line_graph(3);  // 0->1->2
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out destination node 2
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[2] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Source and node 1 should be reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_DOUBLE_EQ(dist[1], 1.0);
-
-  // Destination should be unreachable
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-
-  // Node 2 should have no predecessors
-  auto start = static_cast<std::size_t>(dag.parent_offsets[2]);
-  auto end = static_cast<std::size_t>(dag.parent_offsets[3]);
-  EXPECT_EQ(start, end) << "Masked node should have no predecessors";
-}
-
-TEST(MaskingTests, MaskedIntermediateNode) {
-  auto g = make_line_graph(3);  // 0->1->2
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out intermediate node 1
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, NodeId(2), true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Source reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-
-  // Nodes 1 and 2 should be unreachable (path broken)
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-}
-
-// ============================================================================
-// Edge Mask Tests
-// ============================================================================
-
-TEST(MaskingTests, MaskedEdgeBlocksPath) {
-  auto g = make_line_graph(3);  // 0->1->2
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out first edge (0->1)
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[0] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {}, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-}
-
-TEST(MaskingTests, MaskedEdgeSelectsAlternativePath) {
-  // Create graph with two paths: 0->1->3 and 0->2->3
-  auto g = make_simple_parallel_paths_topology();
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out edge 0->1 (first edge)
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[0] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, NodeId(3), true, sel, {}, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Should still reach destination via alternative path 0->2->3
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());  // Node 1 masked
-  EXPECT_DOUBLE_EQ(dist[2], 1.0);  // Via 0->2
-  EXPECT_DOUBLE_EQ(dist[3], 2.0);  // Via 0->2->3
-}
-
-TEST(MaskingTests, MultipleEdgesMasked) {
-  auto g = make_square_graph(2);  // Two equal-cost paths
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out multiple edges
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[1] = false;  // Block one path
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {}, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Should still have one path to destination
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_GT(dist[2], 0.0);
-  EXPECT_LT(dist[2], std::numeric_limits<Cost>::max());
-}
-
-// ============================================================================
-// Combined Node and Edge Mask Tests
-// ============================================================================
-
-TEST(MaskingTests, CombinedNodeAndEdgeMasks) {
-  // Create a grid graph with multiple paths
-  auto g = make_grid_graph(3, 3);  // 3x3 grid
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask out some nodes and edges to create specific topology
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[4] = false;  // Mask center node
-
-  auto edge_mask = make_bool_mask(g.num_edges());
-  // Find and mask specific edge (e.g., 0->1)
-  auto edge_src = g.edge_src_view();
-  for (std::int32_t e = 0; e < g.num_edges(); ++e) {
-    if (edge_src[e] == 0 && e == 0) {
-      edge_mask[e] = false;
-    }
-  }
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()),
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Verify source is reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-
-  // Verify masked node is unreachable
-  EXPECT_EQ(dist[4], std::numeric_limits<Cost>::max());
-
-  // DAG should be valid
-  expect_pred_dag_valid(dag, g.num_nodes());
-}
-
-TEST(MaskingTests, NodeMaskOverridesEdgeMask) {
-  // When both node and edge are masked, node mask takes precedence
-  // (if a node is masked, all its edges are implicitly unavailable)
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;  // Mask node 1
-
-  auto edge_mask = make_bool_mask(g.num_edges());
-  // Even if edges are allowed, masked node should block them
-  // (all edges true)
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()),
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Node 1 and beyond should be unreachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-}
-
-// ============================================================================
-// Mask Interaction with Residual Capacity
-// ============================================================================
-
-TEST(MaskingTests, MaskWithResidualCapacity) {
-  auto g = make_line_graph(4);  // 0->1->2->3
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;  // Enable residual filtering
-
-  // Set residual capacity
-  std::vector<Cap> residual(g.num_edges(), 1.0);
-  residual[1] = 0.0;  // Zero capacity on edge 1->2
-
-  // Also mask out edge 2->3
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[2] = false;
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, residual, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Should reach node 1 but not beyond
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_DOUBLE_EQ(dist[1], 1.0);
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());  // Blocked by residual
-  EXPECT_EQ(dist[3], std::numeric_limits<Cost>::max());  // Blocked by mask
-}
-
-TEST(MaskingTests, ResidualAndNodeMaskCombined) {
-  auto g = make_simple_parallel_paths_topology();  // Two parallel paths
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;
-
-  // Zero capacity on one path
-  std::vector<Cap> residual(g.num_edges(), 1.0);
-  residual[0] = 0.0;  // Block 0->1
-
-  // Mask intermediate node on other path
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[2] = false;  // Block 0->2->3 path
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, NodeId(3), true, sel, residual,
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Destination should be unreachable (both paths blocked)
-  EXPECT_EQ(dist[3], std::numeric_limits<Cost>::max());
-}
-
-// ============================================================================
-// K-Shortest Paths with Masks
-// ============================================================================
-
-TEST(MaskingTests, KSPWithNodeMask) {
-  auto g = make_square_graph(2);  // Two equal-cost paths
-
-  // Mask out one intermediate node
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;  // Block path through node 1
-
-  auto results = k_shortest_paths(
-      g, 0, 2, 2, std::nullopt, true,
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Should find at most 1 path (through node 3)
-  EXPECT_LE(results.size(), 1);
-
-  if (results.size() > 0) {
-    const auto& [dist, dag] = results[0];
-    // Destination should be reachable via alternate path
-    EXPECT_GT(dist[2], 0.0);
-    EXPECT_LT(dist[2], std::numeric_limits<Cost>::max());
-  }
-}
-
-TEST(MaskingTests, KSPWithEdgeMask) {
-  auto g = make_square_graph(2);  // Two equal-cost paths
-
-  // Mask out edges to eliminate one path
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[0] = false;  // Block first edge
-
-  auto results = k_shortest_paths(
-      g, 0, 2, 2, std::nullopt, true, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Should find remaining path(s)
-  EXPECT_EQ(results.size(), 1u);
-
-  for (const auto& [dist, dag] : results) {
-    if (dist[2] < std::numeric_limits<Cost>::max()) {
-      expect_pred_dag_valid(dag, g.num_nodes());
-    }
-  }
-}
-
-// ============================================================================
-// Max Flow with Masks
-// ============================================================================
-
-TEST(MaskingTests, MaxFlowWithNodeMask) {
-  auto g = make_simple_parallel_paths_topology();
-
-  // Mask out one intermediate node
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;  // Block path through node 1
-
-  auto [flow_val, summary] = calc_max_flow(
-      g, 0, 3,
-      FlowPlacement::Proportional, false, true, true, false, false,
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Should get flow only through remaining path
-  EXPECT_GT(flow_val, 0.0);
-  EXPECT_LE(flow_val, 1.0);  // Only one path available
-
-  // Validate constraints
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaskingTests, MaxFlowWithEdgeMask) {
-  auto g = make_triangle_topology();
-
-  // Mask out direct edge 0->2
-  auto edge_src = g.edge_src_view();
-  auto edge_dst = g.edge_dst_view();
-  auto edge_mask = make_bool_mask(g.num_edges());
-
-  for (std::int32_t e = 0; e < g.num_edges(); ++e) {
-    if (edge_src[e] == 0 && edge_dst[e] == 2) {
-      edge_mask[e] = false;
-    }
-  }
-
-  auto [flow_val, summary] = calc_max_flow(
-      g, 0, 2,
-      FlowPlacement::Proportional, false, true, true, false, false,
-      {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Should get flow only through indirect path 0->1->2
-  EXPECT_GT(flow_val, 0.0);
-  EXPECT_LE(flow_val, 1.0);  // Limited by bottleneck
-
-  // Verify masked edge has no flow
-  for (std::int32_t e = 0; e < g.num_edges(); ++e) {
-    if (edge_src[e] == 0 && edge_dst[e] == 2) {
-      EXPECT_DOUBLE_EQ(summary.edge_flows[e], 0.0)
-          << "Masked edge should have zero flow";
-    }
-  }
-}
-
-TEST(MaskingTests, MaxFlowAllPathsMasked) {
-  auto g = make_line_graph(3);
-
-  // Mask intermediate node to block all paths
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;
-
-  auto [flow_val, summary] = calc_max_flow(
-      g, 0, 2,
-      FlowPlacement::Proportional, false, true, true, false, false,
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // No flow should be possible
-  EXPECT_DOUBLE_EQ(flow_val, 0.0);
-
-  // All edge flows should be zero
-  for (const auto& ef : summary.edge_flows) {
-    EXPECT_DOUBLE_EQ(ef, 0.0);
-  }
-}
-
-// ============================================================================
-// Empty Mask Tests (no masking applied)
-// ============================================================================
-
-TEST(MaskingTests, EmptyNodeMaskAllowsAllNodes) {
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Empty mask means no masking
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // All nodes should be reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_DOUBLE_EQ(dist[1], 1.0);
-  EXPECT_DOUBLE_EQ(dist[2], 2.0);
-}
-
-TEST(MaskingTests, EmptyEdgeMaskAllowsAllEdges) {
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Empty mask means no masking
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  expect_pred_dag_valid(dag, g.num_nodes());
-
-  // All nodes should have valid paths
-  for (std::int32_t i = 0; i < g.num_nodes(); ++i) {
-    EXPECT_LT(dist[i], std::numeric_limits<Cost>::max());
-  }
-}
-
-// ============================================================================
-// All-False Mask Tests
-// ============================================================================
-
-TEST(MaskingTests, AllNodesMaskedNoReachability) {
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask all nodes
-  auto node_mask = make_bool_mask(g.num_nodes(), false);
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {},
-      std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // All nodes unreachable (including source)
-  for (std::int32_t i = 0; i < g.num_nodes(); ++i) {
-    EXPECT_EQ(dist[i], std::numeric_limits<Cost>::max());
-  }
-
-  // DAG should be empty
-  for (const auto& offset : dag.parent_offsets) {
-    EXPECT_EQ(offset, 0);
-  }
-}
-
-TEST(MaskingTests, AllEdgesMaskedNoReachability) {
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-
-  // Mask all edges
-  auto edge_mask = make_bool_mask(g.num_edges(), false);
-
-  auto [dist, dag] = shortest_paths(
-      g, 0, std::nullopt, true, sel, {}, {},
-      std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Only source should be reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-
-  // All other nodes unreachable
-  for (std::int32_t i = 1; i < g.num_nodes(); ++i) {
-    EXPECT_EQ(dist[i], std::numeric_limits<Cost>::max());
-  }
-}
-
-// ============================================================================
-// Backend (Algorithms API) Mask Tests
-// ============================================================================
-
-TEST(MaskingTests, AlgorithmsAPIMaskedSource) {
-  auto backend = make_cpu_backend();
-  Algorithms algs(backend);
-
-  auto g = make_line_graph(3);
-  auto gh = algs.build_graph(g);
-
-  // Mask source
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[0] = false;
-
-  SpfOptions opts;
-  opts.multipath = true;
-  opts.selection.multi_edge = true;
-  opts.selection.require_capacity = false;
-  opts.node_mask = std::span<const bool>(node_mask.get(), g.num_nodes());
-
-  auto [dist, dag] = algs.spf(gh, 0, opts);
-
-  // All distances should be infinity
-  for (const auto& d : dist) {
-    EXPECT_EQ(d, std::numeric_limits<Cost>::max());
-  }
-
-  // DAG should be empty
-  for (const auto& offset : dag.parent_offsets) {
-    EXPECT_EQ(offset, 0);
-  }
-}
-
-TEST(MaskingTests, AlgorithmsAPIMaxFlowWithMask) {
-  auto backend = make_cpu_backend();
-  Algorithms algs(backend);
-
-  auto g = make_simple_parallel_paths_topology();
-  auto gh = algs.build_graph(g);
-
-  // Mask one path
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-  opts.require_capacity = true;
-  opts.with_edge_flows = true;
-  opts.node_mask = std::span<const bool>(node_mask.get(), g.num_nodes());
-
-  auto [flow_val, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Should get flow through remaining path only
-  EXPECT_GT(flow_val, 0.0);
-  EXPECT_LE(flow_val, 1.0);
-}
diff --git a/tests/cpp/max_flow_tests.cpp b/tests/cpp/max_flow_tests.cpp
deleted file mode 100644
index cf14a92..0000000
--- a/tests/cpp/max_flow_tests.cpp
+++ /dev/null
@@ -1,1338 +0,0 @@
-/**
- * Comprehensive Max-Flow Algorithm Test Suite
- *
- * This suite systematically validates max-flow correctness across all parameter
- * combinations and network topologies. The test matrix ensures complete coverage
- * of algorithm behavior under various configurations.
- *
- * TEST MATRIX COVERAGE:
- *
- * Dimension 1: Path Structure
- *   - Single path
- *   - Multiple disjoint equal-cost paths (2, 3, 4, 10)
- *   - Multiple cost tiers (2-tier, 3-tier)
- *   - Complex topologies (grids, shared bottlenecks)
- *
- * Dimension 2: Capacity Patterns
- *   - Equal capacities across paths
- *   - Asymmetric capacities (1:100, 1:1M ratios)
- *   - Zero capacity edges
- *   - Bottleneck scenarios
- *
- * Dimension 3: Flow Placement
- *   - PROPORTIONAL: Capacity-weighted distribution
- *   - EQUAL_BALANCED: Uniform distribution across paths
- *
- * Dimension 4: Path Selection
- *   - shortest_path=False: Multi-tier max-flow (use all cost tiers)
- *   - shortest_path=True: Single-tier flow (lowest cost tier only)
- *
- * Dimension 5: Optional Features
- *   - Node/edge masking
- *   - Batch operations
- *   - Flow details (edge flows, residuals, min-cut)
- *
- * INVARIANT PROPERTIES VALIDATED:
- *   - Flow conservation at intermediate nodes
- *   - Capacity constraints on all edges
- *   - Cost distribution consistency
- *   - Min-cut correctness
- */
-
-#include <gtest/gtest.h>
-#include "netgraph/core/max_flow.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-//=============================================================================
-// SECTION 1: BASIC CORRECTNESS - SINGLE PATH SCENARIOS
-//=============================================================================
-
-TEST(MaxFlow, SinglePath_BasicLinear) {
-  // Validates basic max-flow computation on simplest topology
-  auto g = make_line_graph(3);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  EXPECT_NEAR(total, 1.0, 1e-9) << "Single path with unit capacity";
-}
-
-TEST(MaxFlow, SinglePath_BottleneckConstraint) {
-  // Validates that bottleneck edge correctly limits total flow
-  // Topology: 0→1 (cap 10), 1→2 (cap 2), 2→3 (cap 10)
-  std::int32_t src[3] = {0, 1, 2};
-  std::int32_t dst[3] = {1, 2, 3};
-  double cap[3] = {10.0, 2.0, 10.0};
-  std::int64_t cost[3] = {1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  EXPECT_NEAR(total, 2.0, 1e-9) << "Flow limited by bottleneck edge capacity";
-}
-
-TEST(MaxFlow, SinglePath_ShortestPathEquivalence) {
-  // For single-path networks, shortest_path=True/False should be identical
-  auto g = make_line_graph(3);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts_full;
-  opts_full.placement = FlowPlacement::Proportional;
-  opts_full.shortest_path = false;
-  auto [total_full, _] = algs.max_flow(gh, 0, 2, opts_full);
-
-  MaxFlowOptions opts_sp;
-  opts_sp.placement = FlowPlacement::Proportional;
-  opts_sp.shortest_path = true;
-  auto [total_sp, __] = algs.max_flow(gh, 0, 2, opts_sp);
-
-  EXPECT_NEAR(total_full, 1.0, 1e-9);
-  EXPECT_NEAR(total_sp, 1.0, 1e-9);
-  EXPECT_NEAR(total_full, total_sp, 1e-9)
-      << "shortest_path flag should not affect single-path networks";
-}
-
-TEST(MaxFlow, DegenerateCase_SourceEqualsSink) {
-  // Validates handling of degenerate case where source = sink
-  auto g = make_line_graph(3);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  auto [total, summary] = algs.max_flow(gh, 1, 1, opts);
-
-  EXPECT_NEAR(total, 0.0, 1e-12) << "Flow from node to itself must be zero";
-}
-
-//=============================================================================
-// SECTION 2: EQUAL-COST MULTIPATH (ECMP) - CORE VALIDATION
-//
-// This section systematically validates that when multiple paths have equal
-// cost, the algorithm correctly utilizes ALL paths to maximize throughput.
-// This is critical for data center fabrics (Clos, spine-leaf) where ECMP
-// load balancing across equal-cost paths is the primary traffic distribution
-// mechanism.
-//=============================================================================
-
-TEST(MaxFlow, ECMP_TwoPaths_Proportional_ShortestPath) {
-  // Validates ECMP with 2 parallel equal-cost paths
-  // Topology: Two disjoint paths from 0→3, each with capacity 10.0
-  // shortest_path=True should saturate both paths (not just one)
-  auto g = make_n_disjoint_paths(2, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  EXPECT_NEAR(total, 20.0, 1e-9)
-      << "shortest_path=True must saturate all equal-cost paths";
-
-  // Verify both paths carry significant flow
-  EXPECT_GT(summary.edge_flows[0], 5.0) << "Path 1 should be utilized";
-  EXPECT_GT(summary.edge_flows[2], 5.0) << "Path 2 should be utilized";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, ECMP_TwoPaths_Proportional_FullMaxFlow) {
-  // Same topology, but shortest_path=False for comparison
-  auto g = make_n_disjoint_paths(2, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  EXPECT_NEAR(total, 20.0, 1e-9) << "Full max-flow should use both paths";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, ECMP_TwoPaths_EqualBalanced_ShortestPath) {
-  // Same topology with EQUAL_BALANCED placement
-  // Should distribute flow uniformly across both paths
-  auto g = make_n_disjoint_paths(2, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::EqualBalanced;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  EXPECT_NEAR(total, 20.0, 1e-9) << "Equal-balanced should use both paths";
-
-  // With equal capacities, both paths should have equal flow
-  EXPECT_NEAR(summary.edge_flows[0], 10.0, 1e-9) << "Path 1 should be saturated";
-  EXPECT_NEAR(summary.edge_flows[2], 10.0, 1e-9) << "Path 2 should be saturated";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, ECMP_ThreePaths_Proportional_ShortestPath) {
-  // Extends ECMP validation to 3 equal-cost paths
-  auto g = make_n_disjoint_paths(3, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 4, opts);
-
-  EXPECT_NEAR(total, 30.0, 1e-9)
-      << "Should saturate all 3 equal-cost paths";
-
-  // Each path should carry significant flow (~10.0)
-  for (int i = 0; i < 3; ++i) {
-    EXPECT_GT(summary.edge_flows[i * 2], 5.0)
-        << "Path " << i << " should be utilized";
-  }
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 4);
-}
-
-TEST(MaxFlow, ECMP_FourPaths_ClosFabric_Simulation) {
-  // Simulates 4-spine Clos fabric (common data center topology)
-  // Each spine provides an equal-cost path with 100 Gbps capacity
-  auto g = make_n_disjoint_paths(4, 100.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 5, opts);
-
-  EXPECT_NEAR(total, 400.0, 1e-9)
-      << "4-spine Clos: aggregate bandwidth should be 400 Gbps";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 5);
-}
-
-TEST(MaxFlow, ECMP_TenPaths_ScalabilityValidation) {
-  // Validates algorithm scalability with many parallel equal-cost paths
-  auto g = make_n_disjoint_paths(10, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 11, opts);
-
-  EXPECT_NEAR(total, 100.0, 1e-9)
-      << "Should saturate all 10 equal-cost paths";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 11);
-}
-
-//=============================================================================
-// SECTION 3: ASYMMETRIC CAPACITY PATTERNS
-//
-// Real networks often have paths with very different capacities due to
-// heterogeneous equipment, upgrades, or failures. These tests validate
-// correct behavior under capacity asymmetry.
-//=============================================================================
-
-TEST(MaxFlow, AsymmetricCapacity_1to100_Proportional) {
-  // Two equal-cost paths with 100x capacity difference
-  // Path 1: capacity 1.0, Path 2: capacity 100.0
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {1.0, 1.0, 100.0, 100.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};  // Equal cost
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Should use both paths despite capacity asymmetry
-  EXPECT_NEAR(total, 101.0, 1e-9) << "Total flow should be 1.0 + 100.0";
-
-  // Validate per-edge flows by (u,v) lookup instead of relying on edge indices
-  auto row = g.row_offsets_view();
-  auto col = g.col_indices_view();
-  auto aei = g.adj_edge_index_view();
-  auto eid_uv = [&](int u, int v) -> std::size_t {
-    auto s = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto e = static_cast<std::size_t>(row[static_cast<std::size_t>(u) + 1]);
-    for (std::size_t j = s; j < e; ++j) {
-      if (static_cast<int>(col[j]) == v) return static_cast<std::size_t>(aei[j]);
-    }
-    ADD_FAILURE() << "Edge (" << u << "->" << v << ") not found";
-    return static_cast<std::size_t>(-1);
-  };
-  auto e01 = eid_uv(0, 1);
-  auto e13 = eid_uv(1, 3);
-  auto e02 = eid_uv(0, 2);
-  auto e23 = eid_uv(2, 3);
-  ASSERT_NE(e01, static_cast<std::size_t>(-1));
-  ASSERT_NE(e13, static_cast<std::size_t>(-1));
-  ASSERT_NE(e02, static_cast<std::size_t>(-1));
-  ASSERT_NE(e23, static_cast<std::size_t>(-1));
-  // Small path saturated
-  EXPECT_NEAR(summary.edge_flows[e01], 1.0, 1e-9)
-      << "Low-capacity first hop should be fully utilized";
-  EXPECT_NEAR(summary.edge_flows[e13], 1.0, 1e-9)
-      << "Low-capacity second hop should be fully utilized";
-  // Large path saturated
-  EXPECT_NEAR(summary.edge_flows[e02], 100.0, 1e-9)
-      << "High-capacity first hop should be fully utilized";
-  EXPECT_NEAR(summary.edge_flows[e23], 100.0, 1e-9)
-      << "High-capacity second hop should be fully utilized";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, AsymmetricCapacity_1to1M_NumericalStability) {
-  // Extreme capacity asymmetry: 1M:1 ratio
-  // Tests numerical stability of proportional placement
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {1.0, 1.0, 1000000.0, 1000000.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Should handle extreme asymmetry without numerical issues
-  EXPECT_NEAR(total, 1000001.0, 1e-6) << "Should use both paths";
-
-  // Small path saturated
-  EXPECT_NEAR(summary.edge_flows[0], 1.0, 1e-9)
-      << "Small path should be saturated";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, AsymmetricCapacity_1to100_EqualBalanced) {
-  // Equal-balanced placement with asymmetric capacities
-  // Should be limited by minimum capacity across paths
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {1.0, 1.0, 100.0, 100.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::EqualBalanced;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Equal-balanced: both paths get same flow, limited by min capacity
-  EXPECT_NEAR(total, 2.0, 1e-9)
-      << "Equal-balanced: 1.0 per path × 2 paths = 2.0";
-
-  // Both paths should have equal flow
-  EXPECT_NEAR(summary.edge_flows[0], 1.0, 1e-9) << "Path 1 saturated at min";
-  EXPECT_NEAR(summary.edge_flows[2], 1.0, 1e-9) << "Path 2 limited to min";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, EqualBalanced_NodeMask_ReducesECMPWidth) {
-  // Two equal-cost paths 0->1->3 and 0->2->3 with cap=5 each.
-  // Mask out node 2; EB should place only on path via 1, limited by 5.
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {5.0, 5.0, 5.0, 5.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::EqualBalanced;
-  opts.shortest_path = false;
-  opts.with_edge_flows = true;
-  // Node mask: disable node 2
-  auto node_mask_vec = make_bool_mask(g.num_nodes());
-  node_mask_vec[2] = false;
-  opts.node_mask = std::span<const bool>(node_mask_vec.get(), static_cast<std::size_t>(g.num_nodes()));
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-  EXPECT_NEAR(total, 5.0, 1e-9) << "Only unmasked path should carry flow";
-  // Validate that only path via 1 carries 5
-  auto row = g.row_offsets_view();
-  auto col = g.col_indices_view();
-  auto aei = g.adj_edge_index_view();
-  auto eid_uv = [&](int u, int v) -> std::size_t {
-    auto s = static_cast<std::size_t>(row[static_cast<std::size_t>(u)]);
-    auto e = static_cast<std::size_t>(row[static_cast<std::size_t>(u) + 1]);
-    for (std::size_t j = s; j < e; ++j) {
-      if (static_cast<int>(col[j]) == v) return static_cast<std::size_t>(aei[j]);
-    }
-    return static_cast<std::size_t>(-1);
-  };
-  auto e01 = eid_uv(0, 1);
-  auto e13 = eid_uv(1, 3);
-  auto e02 = eid_uv(0, 2);
-  auto e23 = eid_uv(2, 3);
-  ASSERT_NE(e01, static_cast<std::size_t>(-1));
-  ASSERT_NE(e13, static_cast<std::size_t>(-1));
-  ASSERT_NE(e02, static_cast<std::size_t>(-1));
-  ASSERT_NE(e23, static_cast<std::size_t>(-1));
-  EXPECT_NEAR(summary.edge_flows[e01], 5.0, 1e-9);
-  EXPECT_NEAR(summary.edge_flows[e13], 5.0, 1e-9);
-  EXPECT_NEAR(summary.edge_flows[e02], 0.0, 1e-9);
-  EXPECT_NEAR(summary.edge_flows[e23], 0.0, 1e-9);
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-TEST(MaxFlow, ZeroCapacityPath_CorrectFiltering) {
-  // One path with zero capacity should be ignored
-  // Tests correct residual capacity filtering
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {10.0, 10.0, 0.0, 0.0};  // Path 2 has zero capacity
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  EXPECT_NEAR(total, 10.0, 1e-9)
-      << "Should route all flow via non-zero capacity path";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-//=============================================================================
-// SECTION 4: COST TIER VALIDATION
-//
-// Networks often have paths with different costs (distance, latency, monetary).
-// The shortest_path parameter controls whether to use only lowest-cost paths
-// or to utilize higher-cost paths for additional capacity.
-//=============================================================================
-
-TEST(MaxFlow, TwoCostTiers_ShortestPath_SingleTierOnly) {
-  // Validates that shortest_path=True uses only lowest-cost tier
-  // Tier 1: cost=1, capacity=5
-  // Tier 2: cost=2, capacity=100
-  auto g = make_tiered_graph(5.0, 100.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Should use ONLY cost=1 tier, NOT cost=2 tier
-  EXPECT_NEAR(total, 5.0, 1e-9)
-      << "shortest_path=True: use only lowest-cost tier";
-
-  // Tier 1 (cost=1) should be saturated
-  EXPECT_NEAR(summary.edge_flows[0], 5.0, 1e-9)
-      << "Lowest-cost path should be saturated";
-
-  // Tier 2 (cost=2) should NOT be used
-  EXPECT_NEAR(summary.edge_flows[2], 0.0, 1e-9)
-      << "Higher-cost tier should not be used";
-
-  // Verify cost distribution contains only one tier
-  EXPECT_EQ(summary.costs.size(), 1) << "Only one cost tier used";
-  EXPECT_EQ(summary.costs[0], 2) << "Total cost = 2 (sum of 2 edges @ cost 1)";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, TwoCostTiers_FullMaxFlow_AllTiers) {
-  // Validates that shortest_path=False uses all available tiers
-  auto g = make_tiered_graph(5.0, 100.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;  // Full max-flow
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Should use BOTH tiers
-  EXPECT_NEAR(total, 105.0, 1e-9)
-      << "Full max-flow should use all tiers (5 + 100 = 105)";
-
-  // Both tiers should be saturated
-  EXPECT_NEAR(summary.edge_flows[0], 5.0, 1e-9) << "Tier 1 saturated";
-  EXPECT_NEAR(summary.edge_flows[2], 100.0, 1e-9) << "Tier 2 saturated";
-
-  // Verify cost distribution has TWO tiers
-  EXPECT_EQ(summary.costs.size(), 2) << "Two cost tiers used";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, EqualCost_ShortestVsFull_Equivalent) {
-  // When all paths have equal cost, shortest_path and full should be identical
-  auto g = make_n_disjoint_paths(3, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts_full;
-  opts_full.placement = FlowPlacement::Proportional;
-  opts_full.shortest_path = false;
-  auto [total_full, _] = algs.max_flow(gh, 0, 4, opts_full);
-
-  MaxFlowOptions opts_sp;
-  opts_sp.placement = FlowPlacement::Proportional;
-  opts_sp.shortest_path = true;
-  auto [total_sp, __] = algs.max_flow(gh, 0, 4, opts_sp);
-
-  EXPECT_NEAR(total_full, total_sp, 1e-9)
-      << "With all equal-cost paths, both modes should be equivalent";
-  EXPECT_NEAR(total_full, 30.0, 1e-9) << "Should saturate all 3 paths";
-}
-
-TEST(MaxFlow, ThreeCostTiers_ShortestPath_LowestTierOnly) {
-  // Validates shortest_path with 3+ cost tiers
-  // Path 1: 0→1→4 (cost=1 per edge, cap=5)
-  // Path 2: 0→2→4 (cost=2 per edge, cap=10)
-  // Path 3: 0→3→4 (cost=3 per edge, cap=20)
-  std::int32_t src_arr[6] = {0, 1, 0, 2, 0, 3};
-  std::int32_t dst_arr[6] = {1, 4, 2, 4, 3, 4};
-  double cap_arr[6] = {5.0, 5.0, 10.0, 10.0, 20.0, 20.0};
-  std::int64_t cost_arr[6] = {1, 1, 2, 2, 3, 3};
-
-  auto g = StrictMultiDiGraph::from_arrays(5,
-    std::span(src_arr, 6), std::span(dst_arr, 6),
-    std::span(cap_arr, 6), std::span(cost_arr, 6));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 4, opts);
-
-  // Should use ONLY cost=1 tier
-  EXPECT_NEAR(total, 5.0, 1e-9)
-      << "Should use only lowest-cost tier (cost=1)";
-
-  // Only first path should have flow
-  EXPECT_NEAR(summary.edge_flows[0], 5.0, 1e-9) << "Path 1 (cost=1) saturated";
-  EXPECT_NEAR(summary.edge_flows[2], 0.0, 1e-9) << "Path 2 (cost=2) unused";
-  EXPECT_NEAR(summary.edge_flows[4], 0.0, 1e-9) << "Path 3 (cost=3) unused";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 4);
-}
-
-//=============================================================================
-// SECTION 5: PLACEMENT MODE COMPARISON
-//
-// Direct comparison of PROPORTIONAL vs EQUAL_BALANCED behavior under
-// various conditions.
-//=============================================================================
-
-TEST(MaxFlow, PlacementModes_EqualCapacity_IdenticalResult) {
-  // With equal capacities, both modes should give same total flow
-  auto g = make_n_disjoint_paths(2, 10.0);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts_prop;
-  opts_prop.placement = FlowPlacement::Proportional;
-  opts_prop.shortest_path = true;
-  auto [total_prop, _] = algs.max_flow(gh, 0, 3, opts_prop);
-
-  MaxFlowOptions opts_eq;
-  opts_eq.placement = FlowPlacement::EqualBalanced;
-  opts_eq.shortest_path = true;
-  auto [total_eq, __] = algs.max_flow(gh, 0, 3, opts_eq);
-
-  // Both should saturate both paths
-  EXPECT_NEAR(total_prop, 20.0, 1e-9);
-  EXPECT_NEAR(total_eq, 20.0, 1e-9);
-  EXPECT_NEAR(total_prop, total_eq, 1e-9)
-      << "With equal capacities, both modes give same total";
-}
-
-//=============================================================================
-// SECTION 6: FLOW PROPERTIES & INVARIANTS
-//
-// Validates fundamental flow properties: conservation, capacity constraints,
-// min-cut correctness, cost distribution consistency.
-//=============================================================================
-
-TEST(MaxFlow, FlowConservation_IntermediateNodes) {
-  // Validates flow conservation: inflow = outflow at intermediate nodes
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  EXPECT_EQ(summary.edge_flows.size(), static_cast<std::size_t>(g.num_edges()));
-
-  // Use helper to validate conservation at all intermediate nodes
-  validate_flow_conservation(g, summary, 0, 2);
-}
-
-TEST(MaxFlow, MinCut_ValidEdgeIdentification) {
-  // Min-cut should separate source from sink with valid edge IDs
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  // Min cut should contain edges
-  EXPECT_GT(summary.min_cut.edges.size(), 0)
-      << "Min-cut must separate source from sink";
-
-  // All cut edges should have valid IDs
-  for (auto eid : summary.min_cut.edges) {
-    EXPECT_GE(eid, 0) << "Edge ID must be non-negative";
-    EXPECT_LT(eid, g.num_edges()) << "Edge ID must be in valid range";
-  }
-}
-
-TEST(MaxFlow, CostDistribution_AccountsForAllFlow) {
-  // Cost distribution should account for all flow
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  // Cost distribution flows should sum to total flow
-  double cost_sum = 0.0;
-  for (auto flow : summary.flows) {
-    cost_sum += flow;
-  }
-
-  EXPECT_NEAR(cost_sum, total, 1e-9)
-      << "Cost distribution must account for all flow";
-}
-
-//=============================================================================
-// SECTION 7: ADVANCED FEATURES
-//=============================================================================
-
-TEST(MaxFlow, OptionalOutputs_ResidualAndReachable) {
-  // Validates optional residual capacity and reachable nodes outputs
-  auto g = make_square_graph(1);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.with_edge_flows = true;
-  opts.with_reachable = true;
-  opts.with_residuals = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  // Verify output dimensions
-  EXPECT_EQ(summary.residual_capacity.size(),
-            static_cast<std::size_t>(g.num_edges()))
-      << "Residual capacity vector size must match edge count";
-  EXPECT_EQ(summary.reachable_nodes.size(),
-            static_cast<std::size_t>(g.num_nodes()))
-      << "Reachable nodes vector size must match node count";
-}
-
-TEST(MaxFlow, NodeMask_BlocksFlowThroughNode) {
-  // Validates that node masking prevents flow through masked nodes
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  // Mask out node 1 (middle node)
-  auto node_mask_vec = make_bool_mask(g.num_nodes());
-  node_mask_vec[1] = false;
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.node_mask = std::span<const bool>(node_mask_vec.get(),
-                                        static_cast<std::size_t>(g.num_nodes()));
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  EXPECT_NEAR(total, 0.0, 1e-12)
-      << "Masking middle node should prevent all flow";
-}
-
-TEST(MaxFlow, EdgeMask_SelectiveEdgeFiltering) {
-  // Validates edge mask functionality
-  auto g = make_n_disjoint_paths(2, 10.0);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  // Create mask with all edges enabled
-  auto edge_mask_vec = make_bool_mask(g.num_edges(), true);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.with_edge_flows = true;
-  opts.edge_mask = std::span<const bool>(edge_mask_vec.get(),
-                                        static_cast<std::size_t>(g.num_edges()));
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // With all edges enabled, should use both paths
-  EXPECT_NEAR(total, 20.0, 1e-9)
-      << "With all edges enabled, both paths should be used";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-TEST(MaxFlow, BatchMaxFlow_IndependentMaskApplication) {
-  // Validates batch max-flow with different masks per pair
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  std::vector<std::pair<NodeId, NodeId>> pairs = {{0, 2}, {0, 2}};
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  // First pair: no mask (should find flow)
-  // Second pair: mask node 1 (should find no flow)
-  std::vector<std::span<const bool>> node_masks;
-  auto nm0 = make_bool_mask(g.num_nodes());  // all true
-  auto nm1 = make_bool_mask(g.num_nodes());
-  nm1[1] = false;  // block middle node for second pair
-  node_masks.push_back(std::span<const bool>(nm0.get(),
-                                            static_cast<std::size_t>(g.num_nodes())));
-  node_masks.push_back(std::span<const bool>(nm1.get(),
-                                            static_cast<std::size_t>(g.num_nodes())));
-
-  auto summaries = algs.batch_max_flow(gh, pairs, opts, node_masks, {});
-
-  ASSERT_EQ(summaries.size(), 2u);
-  EXPECT_GT(summaries[0].total_flow, 0.0)
-      << "First pair (unmasked) should find flow";
-  EXPECT_NEAR(summaries[1].total_flow, 0.0, 1e-12)
-      << "Second pair (masked) should find no flow";
-}
-
-//=============================================================================
-// SECTION 8: COMPLEX TOPOLOGIES
-//
-// Validates algorithm correctness on realistic network topologies beyond
-// simple test graphs.
-//=============================================================================
-
-TEST(MaxFlow, GridGraph_3x3_MultipleEqualCostPaths) {
-  // Grid graphs have many equal-cost paths between corners
-  // Validates ECMP behavior in complex topology
-  auto g = make_grid_graph(3, 3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  // Flow from top-left (0) to bottom-right (8)
-  auto [total, summary] = algs.max_flow(gh, 0, 8, opts);
-
-  // Should find flow through multiple equal-cost paths
-  EXPECT_GT(total, 0.0) << "Should find flow in grid topology";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 8);
-}
-
-TEST(MaxFlow, SharedBottleneck_MultiplePathsMerge) {
-  // Two paths that merge at an intermediate node before reaching sink
-  // Validates correct handling of shared edges
-  auto g = make_shared_bottleneck_graph(10.0, 5.0);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-
-  // Shared bottleneck should limit total flow
-  // Path 1: 0→1 (10), 1→3 (5) - bottleneck at 1→3
-  // Path 2: 0→2 (10), 2→3 (10)
-  // Total limited by bottleneck + other path = 5 + 10 = 15
-  EXPECT_NEAR(total, 15.0, 1e-9)
-      << "Flow limited by shared bottleneck plus alternate path";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 3);
-}
-
-//=============================================================================
-// SECTION 10: REAL-WORLD TOPOLOGY VALIDATION (NetGraph Integration Tests)
-//=============================================================================
-//
-// These tests validate that NetGraph-Core produces the same maxflow results
-// as the original NetGraph repository for important real-world topologies.
-// Reference: NetGraph tests/integration/test_scenario_3.py and test_maxflow_api.py
-
-TEST(MaxFlow, Clos_3Tier_Topology_Proportional_Shortest) {
-  /**
-   * Validates 3-tier Clos fabric maxflow matches NetGraph scenario_3 expectations.
-   *
-   * Topology: 2 interconnected 3-tier Clos fabrics
-   * Source: Clos1 T1 nodes (0-3, 8-11) = 8 nodes
-   * Sink: Clos2 T1 nodes (32-35, 40-43) = 8 nodes
-   *
-   * Expected: 3200.0 Gbps (from NetGraph integration test expectations.py)
-   * Bottleneck: 8 active inter-clos spine links × 400 Gbps = 3200 Gbps
-   */
-  auto g = make_3tier_clos_graph();
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  // Test with PROPORTIONAL placement (matches NetGraph scenario_3 "capacity_analysis_forward")
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;  // shortest_path: true in scenario_3.yaml
-  opts.with_edge_flows = true;
-
-  // Compute maxflow from all Clos1 T1 nodes to all Clos2 T1 nodes
-  // We'll compute from representative nodes and verify total capacity
-  // For simplicity, test one representative path: node 0 (clos1/b1/t1-1) to node 32 (clos2/b1/t1-1)
-  auto [total, summary] = algs.max_flow(gh, 0, 32, opts);
-
-  // Expected: Each T1 node can push 400 Gbps through the network
-  // (4 T2 paths × 100 Gbps = 400 Gbps from T1 to T2 layer)
-  // But bottleneck at inter-clos spines limits per-T1 flow
-  EXPECT_NEAR(total, 400.0, 1.0)
-      << "Single T1-to-T1 maxflow should be ~400 Gbps";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 32);
-}
-
-TEST(MaxFlow, Clos_3Tier_Topology_EqualBalanced_Shortest) {
-  /**
-   * Validates 3-tier Clos with EQUAL_BALANCED placement.
-   * Reference: NetGraph scenario_3 "capacity_analysis_forward_balanced"
-   */
-  auto g = make_3tier_clos_graph();
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::EqualBalanced;
-  opts.shortest_path = true;
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 32, opts);
-
-  // With EQUAL_BALANCED, flow is split equally across paths
-  // Expected similar capacity as PROPORTIONAL for this balanced topology
-  EXPECT_GT(total, 0.0) << "Should find positive flow";
-  EXPECT_LE(total, 400.0 + 1.0) << "Should not exceed topology capacity";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 32);
-}
-
-TEST(MaxFlow, Triangle_Topology_Combine_Mode) {
-  /**
-   * Triangle topology from NetGraph solver tests.
-   * Reference: test_maxflow_api.py::test_max_flow_combine_basic()
-   *
-   * Expected maxflow A->C: 2.0 (1 direct + 1 via B)
-   */
-  auto g = make_triangle_topology();
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;  // Use all paths
-  opts.with_edge_flows = true;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 2, opts);
-
-  EXPECT_NEAR(total, 2.0, 1e-9)
-      << "Triangle A->C maxflow should be 2.0 (1 direct + 1 via B)";
-
-  validate_capacity_constraints(g, summary);
-  validate_flow_conservation(g, summary, 0, 2);
-}
-
-TEST(MaxFlow, SimpleParallelPaths_Topology) {
-  /**
-   * Two disjoint parallel paths topology.
-   * Reference: test_maxflow_api.py::test_max_flow_combine_basic() using _simple_network()
-   *
-   * Expected maxflow S->T: 2.0 (both paths saturated)
-   */
-  auto g = make_simple_parallel_paths_topology();
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  // Test with shortest_path=True (should use both equal-cost paths)
-  MaxFlowOptions opts_sp;
-  opts_sp.placement = FlowPlacement::Proportional;
-  opts_sp.shortest_path = true;
-  opts_sp.with_edge_flows = true;
-
-  auto [total_sp, summary_sp] = algs.max_flow(gh, 0, 3, opts_sp);
-
-  EXPECT_NEAR(total_sp, 2.0, 1e-9)
-      << "Should saturate both equal-cost parallel paths with shortest_path=True";
-
-  validate_capacity_constraints(g, summary_sp);
-  validate_flow_conservation(g, summary_sp, 0, 3);
-
-  // Test with shortest_path=False (should also be 2.0 since all paths are equal cost)
-  MaxFlowOptions opts_full;
-  opts_full.placement = FlowPlacement::Proportional;
-  opts_full.shortest_path = false;
-  opts_full.with_edge_flows = true;
-
-  auto [total_full, summary_full] = algs.max_flow(gh, 0, 3, opts_full);
-
-  EXPECT_NEAR(total_full, 2.0, 1e-9)
-      << "Should saturate both paths with shortest_path=False";
-
-  validate_capacity_constraints(g, summary_full);
-  validate_flow_conservation(g, summary_full, 0, 3);
-}
-
-TEST(MaxFlow, ShortestPath_MustSaturateAllEqualCostPaths) {
-  /**
-   * Validates that shortest_path=True correctly saturates ALL equal-cost paths,
-   * not just a single path.
-   * Reference: test_maxflow_api.py::test_shortest_path_vs_full_max_flow()
-   *
-   * When multiple parallel paths have equal cost, the algorithm must utilize
-   * all of them to maximize throughput, even with shortest_path=True.
-   */
-  auto g = make_simple_parallel_paths_topology();
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = true;
-
-  auto [total, _] = algs.max_flow(gh, 0, 3, opts);
-
-  // Two equal-cost paths with capacity 1.0 each should yield total flow of 2.0
-  EXPECT_NEAR(total, 2.0, 1e-9)
-      << "shortest_path=True must saturate all equal-cost paths, not just one";
-}
-
-//=============================================================================
-// SECTION 11: SENSITIVITY ANALYSIS
-//=============================================================================
-
-TEST(MaxFlow, Sensitivity_SinglePath) {
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  auto results = algs.sensitivity_analysis(gh, 0, 2, opts);
-
-  // Path: 0->1->2. Both edges saturated and critical.
-  // Capacity is 1.0. Flow is 1.0.
-  // Removing any edge drops flow to 0. Delta = 1.0.
-  EXPECT_EQ(results.size(), 2u);
-  for (const auto& p : results) {
-    EXPECT_NEAR(p.second, 1.0, 1e-9);
-  }
-}
-
-TEST(MaxFlow, Sensitivity_TwoParallelPaths) {
-  // Two paths, capacity 10 each. Total 20.
-  auto g = make_n_disjoint_paths(2, 10.0);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-
-  auto results = algs.sensitivity_analysis(gh, 0, 3, opts);
-
-  // All 4 edges are saturated.
-  // Removing any edge kills one path (flow 20 -> 10). Delta = 10.
-  EXPECT_EQ(results.size(), 4u);
-  for (const auto& p : results) {
-    EXPECT_NEAR(p.second, 10.0, 1e-9);
-  }
-}
-
-TEST(MaxFlow, Sensitivity_PartialSaturation) {
-  // Topology: S->A (cap 10), S->B (cap 5)
-  //           A->T (cap 5),  B->T (cap 10)
-  // Flow: S->A->T limited by A->T (5). S->B->T limited by S->B (5). Total 10.
-  // Saturated: A->T (edge 2), S->B (edge 1).
-  // Non-Saturated: S->A (edge 0), B->T (edge 3).
-
-  std::int32_t src[4] = {0, 0, 1, 2};
-  std::int32_t dst[4] = {1, 2, 3, 3};
-  double cap[4] = {10.0, 5.0, 5.0, 10.0};
-  std::int64_t cost[4] = {1, 1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-
-  auto results = algs.sensitivity_analysis(gh, 0, 3, opts);
-
-  // Should only report saturated edges: S->B and A->T.
-  // (We assume edge indices follow insertion order: 0, 1, 2, 3)
-  // S->B is index 1. A->T is index 2.
-
-  // Check results
-  int count = 0;
-  for (const auto& p : results) {
-    if (p.first == 1 || p.first == 2) {
-      EXPECT_NEAR(p.second, 5.0, 1e-9);
-      count++;
-    } else {
-      // If non-saturated edges are reported (which they shouldn't be based on logic), fail.
-      FAIL() << "Reported sensitivity for non-saturated edge " << p.first;
-    }
-  }
-  EXPECT_EQ(count, 2);
-}
-
-TEST(MaxFlow, Sensitivity_ShortestPathVsMaxFlow) {
-  // Tests that shortest_path mode produces different sensitivity results
-  // than full max-flow mode when there are paths of different costs.
-  //
-  // Topology: S(0) -> A(1) -> T(2) [cost 1+1=2, cap 10 each]
-  //           S(0) -> B(3) -> T(2) [cost 2+2=4, cap 5 each]
-  //
-  // With shortest_path=false (full max-flow):
-  //   - Uses both paths: S->A->T (10) + S->B->T (5) = 15 total
-  //   - All 4 edges are saturated and critical
-  //
-  // With shortest_path=true (single-pass, IP/IGP mode):
-  //   - Only uses cheapest path: S->A->T (10)
-  //   - Edges 2,3 (S->B->T path) are NOT used, so NOT critical
-
-  std::int32_t src[4] = {0, 1, 0, 3};
-  std::int32_t dst[4] = {1, 2, 3, 2};
-  double cap[4] = {10.0, 10.0, 5.0, 5.0};
-  std::int64_t cost[4] = {1, 1, 2, 2};  // S->A->T costs 2, S->B->T costs 4
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  // Step 1: Verify baseline flow values with max_flow
-  // This validates the routing semantics before testing sensitivity
-  {
-    MaxFlowOptions opts;
-    opts.placement = FlowPlacement::Proportional;
-    opts.shortest_path = false;
-    auto [flow_full, _] = algs.max_flow(gh, 0, 2, opts);
-    EXPECT_NEAR(flow_full, 15.0, 1e-9) << "Full max-flow should be 15";
-  }
-  {
-    MaxFlowOptions opts;
-    opts.placement = FlowPlacement::Proportional;
-    opts.shortest_path = true;
-    auto [flow_sp, _] = algs.max_flow(gh, 0, 2, opts);
-    EXPECT_NEAR(flow_sp, 10.0, 1e-9) << "Shortest-path flow should be 10";
-  }
-
-  // Step 2: Test sensitivity with shortest_path=false (full max-flow)
-  {
-    MaxFlowOptions opts;
-    opts.placement = FlowPlacement::Proportional;
-    opts.shortest_path = false;
-
-    auto results = algs.sensitivity_analysis(gh, 0, 2, opts);
-
-    // All 4 edges should be saturated and critical
-    EXPECT_EQ(results.size(), 4u) << "Full max-flow should report all 4 edges as critical";
-
-    // Edges 0,1 (S->A->T path) have delta 10 when removed
-    // Edges 2,3 (S->B->T path) have delta 5 when removed
-    for (const auto& p : results) {
-      if (p.first == 0 || p.first == 1) {
-        EXPECT_NEAR(p.second, 10.0, 1e-9);
-      } else {
-        EXPECT_NEAR(p.second, 5.0, 1e-9);
-      }
-    }
-  }
-
-  // Step 3: Test sensitivity with shortest_path=true (IP/IGP mode)
-  {
-    MaxFlowOptions opts;
-    opts.placement = FlowPlacement::Proportional;
-    opts.shortest_path = true;
-
-    auto results = algs.sensitivity_analysis(gh, 0, 2, opts);
-
-    // Only edges 0,1 (S->A->T path) should be critical
-    // Edges 2,3 (S->B->T path) are not used under shortest-path routing
-    EXPECT_EQ(results.size(), 2u) << "Shortest-path mode should only report 2 edges as critical";
-
-    for (const auto& p : results) {
-      EXPECT_TRUE(p.first == 0 || p.first == 1)
-          << "Edge " << p.first << " should not be critical in shortest-path mode";
-      // Baseline=10, removing either S->A or A->T forces traffic to S->B->T (cap 5)
-      // Delta = 10 - 5 = 5
-      EXPECT_NEAR(p.second, 5.0, 1e-9);
-    }
-  }
-}
-
-// ============================================================================
-// Regression: residual completion phase (flow cancellation)
-// ============================================================================
-
-// Successive shortest paths over forward-only SPF DAGs can strand capacity that
-// only reverse-arc cancellation can recover. On this full-duplex topology the
-// first tier routes 0->1->2->3 (cost 3), blocking both the direct 1->3 exit and
-// the 2->3 exit; the true maximum needs to reroute it. Expected max flow is 3:
-//   0->1->3 (1), 0->2->1->3 (1), 0->2->3 (1); the cut {0,2}|{1,3} has capacity 3.
-TEST(MaxFlow, CompletionPhase_RecoversCancellation) {
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost;
-  auto add_duplex = [&](std::int32_t u, std::int32_t v, double c, std::int64_t k) {
-    src.push_back(u); dst.push_back(v); cap.push_back(c); cost.push_back(k);
-    src.push_back(v); dst.push_back(u); cap.push_back(c); cost.push_back(k);
-  };
-  add_duplex(1, 3, 3.0, 17);
-  add_duplex(0, 2, 8.0, 17);
-  add_duplex(1, 2, 1.0, 1);
-  add_duplex(1, 0, 1.0, 1);
-  add_duplex(3, 2, 1.0, 1);
-  auto g = StrictMultiDiGraph::from_arrays(4, src, dst, cap, cost);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-  EXPECT_NEAR(total, 3.0, 1e-9) << "true max flow requires cancelling the first tier";
-
-  // Max-flow/min-cut duality: the reported cut capacity must equal the flow.
-  double cut_cap = 0.0;
-  auto capv = g.capacity_view();
-  for (auto eid : summary.min_cut.edges) cut_cap += capv[static_cast<std::size_t>(eid)];
-  EXPECT_NEAR(cut_cap, total, 1e-9) << "min-cut capacity must equal total flow";
-
-  // Cost distribution must account for exactly the total flow.
-  double dist_sum = 0.0;
-  for (auto f : summary.flows) dist_sum += f;
-  EXPECT_NEAR(dist_sum, total, 1e-9);
-}
-
-// The completion phase must respect masks: masking node 2 on the topology above
-// limits the flow to the direct 0->1->3 route.
-TEST(MaxFlow, CompletionPhase_RespectsNodeMask) {
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost;
-  auto add_duplex = [&](std::int32_t u, std::int32_t v, double c, std::int64_t k) {
-    src.push_back(u); dst.push_back(v); cap.push_back(c); cost.push_back(k);
-    src.push_back(v); dst.push_back(u); cap.push_back(c); cost.push_back(k);
-  };
-  add_duplex(1, 3, 3.0, 17);
-  add_duplex(0, 2, 8.0, 17);
-  add_duplex(1, 2, 1.0, 1);
-  add_duplex(1, 0, 1.0, 1);
-  add_duplex(3, 2, 1.0, 1);
-  auto g = StrictMultiDiGraph::from_arrays(4, src, dst, cap, cost);
-
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-
-  auto mask = make_bool_mask(4);
-  mask[2] = false;
-
-  MaxFlowOptions opts;
-  opts.placement = FlowPlacement::Proportional;
-  opts.shortest_path = false;
-  opts.node_mask = std::span<const bool>(mask.get(), 4);
-
-  auto [total, summary] = algs.max_flow(gh, 0, 3, opts);
-  EXPECT_NEAR(total, 1.0, 1e-9) << "without node 2 only 0->1->3 remains (bottleneck 1)";
-}
diff --git a/tests/cpp/min_cost_flow_deletion_fault_tests.cpp b/tests/cpp/min_cost_flow_deletion_fault_tests.cpp
new file mode 100644
index 0000000..65979f2
--- /dev/null
+++ b/tests/cpp/min_cost_flow_deletion_fault_tests.cpp
@@ -0,0 +1,713 @@
+// Allocation-failure atomicity of the deletion re-solve's paths: the capture
+// of a solve's final state (on cold and growing threads), the copy and the copy assignment of a
+// state (between states of different sizes, on 1, 2 and 4 threads), a resolver's construction
+// and every re-solve are swept over every allocation they make, and CentralizedTE's failure study over every
+// allocation on 1, 2 and 4 workers. After each injected std::bad_alloc nothing is captured or
+// constructed, no allocation is left live once the attempt's objects are gone, an
+// assigned state keeps its old value, the network every state and resolver shares is unchanged,
+// and a clean retry (the same resolver included) gives the reference result. A state's and a
+// resolver's moves allocate nothing. The state comparators of these checks have negative
+// controls field by field (the last test). Runs in the fault-injection executable
+// (fault_injection.hpp).
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <exception>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#include "fault_injection.hpp"
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using detail::DeletionCapture;
+using detail::DeletionResolver;
+using detail::DeletionResult;
+using detail::DeletionState;
+
+namespace {
+
+// Two sources and three destinations; deletions with full and with no reroute.
+std::shared_ptr<const Graph> graph() {
+  return std::make_shared<const Graph>(
+      make_graph(8, {{0, 2, 2, 1}, {1, 2, 1, 2}, {2, 4, 2, 1}, {2, 5, 2, 3}, {1, 5, 1, 7}, {0, 4, 1, 9},
+                     {4, 5, 1, 1}, {3, 6, 4, 1}, {6, 7, 4, 1}, {5, 2, 1, 1}, {2, 3, 1, 2}, {6, 4, 2, 1}}));
+}
+
+const std::vector<NodeId> kSources {0, 1};
+const std::vector<NodeId> kDestinations {4, 5, 7};
+
+MinCostFlowResult capture(const Graph& g, std::shared_ptr<const Graph> owner,
+                       DeletionCapture& req) {
+  req.graph = std::move(owner);
+  const std::vector<Amount> view(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  return solve_min_cost_flow(g, view, kSources, kDestinations, nullptr, std::nullopt, &req);
+}
+
+// The comparators below read a state through its accessors only, so they apply alike to the
+// StateFields stand-in of their negative controls (the last test), whose fields can be changed
+// one at a time.
+
+// The values of two states: residual, potentials, value and the maximum flag.
+template <typename State>
+bool same_state(const State& a, const State& b) {
+  return std::vector<Amount>(a.residual().begin(), a.residual().end()) ==
+             std::vector<Amount>(b.residual().begin(), b.residual().end()) &&
+         std::vector<detail::I128>(a.potentials().begin(), a.potentials().end()) ==
+             std::vector<detail::I128>(b.potentials().begin(), b.potentials().end()) &&
+         a.value() == b.value() && a.maximum() == b.maximum();
+}
+
+// Every field of two populated states: the graph and the network by identity (copies share
+// them), the rest by value.
+template <typename State>
+bool identical(const State& a, const State& b) {
+  return &a.graph() == &b.graph() && &a.network() == &b.network() && same_state(a, b) &&
+         same_counters(a.counters(), b.counters());
+}
+
+// A state without fields: no residual, no potentials, value 0, not maximum.
+template <typename State>
+bool no_fields(const State& s) {
+  return s.residual().empty() && s.potentials().empty() && s.value() == 0 && !s.maximum();
+}
+
+// A state that never held a solve: no fields, and no resolver accepts it.
+bool empty_state(const DeletionState& s) {
+  if (!no_fields(s)) return false;
+  try {
+    DeletionResolver rs(s);
+  } catch (const std::invalid_argument&) {
+    return true;
+  }
+  return false;
+}
+
+// A state's fields, read through DeletionState's accessors and writable one at a time.
+struct StateFields {
+  const Graph* graph_ {nullptr};
+  const detail::ResidualNetwork* network_ {nullptr};
+  std::vector<Amount> residual_ {};
+  std::vector<detail::I128> potentials_ {};
+  Amount value_ {0};
+  bool maximum_ {false};
+  detail::MinCostFlowCounters counters_ {};
+  [[nodiscard]] const Graph& graph() const { return *graph_; }
+  [[nodiscard]] const detail::ResidualNetwork& network() const { return *network_; }
+  [[nodiscard]] std::span<const Amount> residual() const { return residual_; }
+  [[nodiscard]] std::span<const detail::I128> potentials() const { return potentials_; }
+  [[nodiscard]] Amount value() const { return value_; }
+  [[nodiscard]] bool maximum() const { return maximum_; }
+  [[nodiscard]] const detail::MinCostFlowCounters& counters() const { return counters_; }
+};
+
+StateFields fields_of(const DeletionState& s) {
+  return {&s.graph(),
+          &s.network(),
+          {s.residual().begin(), s.residual().end()},
+          {s.potentials().begin(), s.potentials().end()},
+          s.value(),
+          s.maximum(),
+          s.counters()};
+}
+
+// A captured state with its re-solve of every positive-flow edge.
+struct Saved {
+  DeletionState state;
+  std::vector<std::pair<EdgeId, DeletionResult>> results;
+};
+
+Saved saved(std::shared_ptr<const Graph> g, const std::vector<NodeId>& sources,
+            const std::vector<NodeId>& destinations) {
+  DeletionCapture req;
+  req.graph = g;
+  (void)solve_min_cost_flow(*g, g->edge_capacity_units(), sources, destinations, nullptr, std::nullopt, &req);
+  Saved out {*req.state, {}};
+  const auto flows = out.state.edge_flows();
+  for (EdgeId e = 0; e < g->num_edges(); ++e) {
+    if (flows[static_cast<std::size_t>(e)] > 0) out.results.emplace_back(e, DeletionResolver(out.state).resolve(e));
+  }
+  return out;
+}
+
+// The path 0 -> 1 -> ... -> n - 1 (cost 1 per edge) at capacity c.
+Saved chain(std::int32_t n, Amount c) { return saved(chain_graph(n, c), {0}, {n - 1}); }
+
+// The state is identical to `want`'s and serves its re-solves: a resolver on it gives every
+// reference result (never run on a state that is not identical: a hybrid could crash it).
+bool holds(const DeletionState& s, const Saved& want) {
+  if (!identical(s, want.state)) return false;
+  DeletionResolver rs(s);
+  for (const auto& [e, r] : want.results) {
+    if (!same_result(rs.resolve(e), r)) return false;
+  }
+  return !want.results.empty();
+}
+
+// States of different coordinate sizes (N + 2 vertices and slots: 4 and 6 for the 2-node path,
+// 8 and 14 for the 6-node paths, 10 and 34 for the 8-node graph, 13 and 24 for the 11-node path),
+// and two of equal sizes with different residuals and values.
+std::vector<Saved> assignment_states() {
+  std::vector<Saved> out;
+  out.push_back(chain(2, 2));
+  out.push_back(chain(6, 2));
+  out.push_back(chain(6, 3));
+  const auto g = graph();
+  out.push_back(saved(g, kSources, kDestinations));
+  out.push_back(chain(11, 1));
+  return out;
+}
+
+} // namespace
+
+TEST(DeletionFaults, CaptureFailsWithoutAStateOrAChangedPayload) {
+  const auto g = graph();
+  DeletionCapture want;
+  const auto payload = capture(*g, g, want);
+  ASSERT_TRUE(want.state.has_value());
+  // The same solve without a capture, its view allocated alike: the sweep below must also fail
+  // the allocations of the captured state.
+  long plain = 0;
+  while (fails_at(plain, [&] {
+    const std::vector<Amount> view(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+    (void)solve_min_cost_flow(*g, view, kSources, kDestinations, nullptr, std::nullopt);
+  })) {
+    ++plain;
+  }
+  int failures = 0;
+  for (long at = 0;; ++at) {
+    // Everything an attempt allocates is freed when it ends (the reference capture above grew
+    // this thread's solver), so an allocation left live is a leak of the failed capture.
+    const long live = g_live.load();
+    bool failed = false;
+    {
+      DeletionCapture req;
+      MinCostFlowResult got;
+      failed = fails_at(at, [&] { got = capture(*g, g, req); });
+      if (!failed) {
+        EXPECT_TRUE(same_payload(got, payload));
+        ASSERT_TRUE(req.state.has_value());
+        EXPECT_TRUE(same_state(*req.state, *want.state));
+      } else {
+        ++failures;
+        EXPECT_FALSE(req.state.has_value()) << "allocation " << at;
+        DeletionCapture retry;
+        EXPECT_TRUE(same_payload(capture(*g, g, retry), payload)) << "retry after allocation " << at;
+      }
+    }
+    EXPECT_EQ(g_live.load(), live) << "allocation " << at << ": a leak";
+    if (!failed) break;
+  }
+  EXPECT_GT(failures, plain);
+}
+
+// A failed copy or resolver construction leaves nothing constructed and nothing allocated live;
+// each sweep fails every allocation of its call (counted in the test below).
+TEST(DeletionFaults, CopyAndResolverConstructionFailAtomically) {
+  const auto g = graph();
+  DeletionCapture req;
+  (void)capture(*g, g, req);
+  int copy_failures = 0;
+  for (long at = 0;; ++at) {
+    std::optional<DeletionState> copy;
+    const long live = g_live.load();
+    if (!fails_at(at, [&] { copy.emplace(*req.state); })) break;
+    ++copy_failures;
+    EXPECT_FALSE(copy.has_value()) << "copy, allocation " << at;
+    EXPECT_EQ(g_live.load(), live) << "copy, allocation " << at << ": a leak";
+  }
+  int resolver_failures = 0;
+  for (long at = 0;; ++at) {
+    std::unique_ptr<DeletionResolver> rs;
+    const long live = g_live.load();
+    if (!fails_at(at, [&] { rs = std::make_unique<DeletionResolver>(*req.state); })) break;
+    ++resolver_failures;
+    EXPECT_EQ(rs, nullptr) << "resolver, allocation " << at;
+    EXPECT_EQ(g_live.load(), live) << "resolver, allocation " << at << ": a leak";
+  }
+  EXPECT_EQ(copy_failures, 2);           // the residual and the potentials
+  EXPECT_EQ(resolver_failures, 1 + 10);  // the resolver itself, then its construction (below)
+}
+
+// A resolver reads its state's network in place and copies none of its 14
+// arrays. Its construction makes exactly the state copy's allocations (the residual and the
+// potentials) plus 8 of its own: the solver, and its working arrays (levels, marks, current
+// arcs, residual, wide potentials, wide distances, stamps). Counted on states of 4 to 13
+// vertices; a failure at each of them constructs nothing (the sweep above).
+TEST(DeletionFaults, AResolverAllocatesNoNetwork) {
+  auto allocations = [](const std::function<void()>& fn) {
+    long at = 0;
+    while (fails_at(at, fn)) ++at;
+    return at;
+  };
+  for (const auto& s : assignment_states()) {
+    const DeletionState& st = s.state;
+    const long copy = allocations([&] { DeletionState c(st); });
+    const long resolver = allocations([&] { DeletionResolver rs(st); });
+    EXPECT_EQ(copy, 2) << st.network().num_nodes;
+    EXPECT_EQ(resolver, copy + 8) << st.network().num_nodes;
+  }
+}
+
+// Every positive-flow edge, every allocation of a re-solve on a fresh resolver (its working
+// storage grows) and on a warm one; the failed resolver serves the next call correctly.
+TEST(DeletionFaults, EveryReSolveFailsWithoutPoisoningItsResolver) {
+  const auto g = graph();
+  DeletionCapture req;
+  (void)capture(*g, g, req);
+  const DeletionState saved = *req.state;
+  const detail::ResidualNetwork network = saved.network();  // the shared network, as captured
+  const auto flows = saved.edge_flows();
+  int candidates = 0;
+  for (EdgeId e = 0; e < g->num_edges(); ++e) {
+    if (flows[static_cast<std::size_t>(e)] <= 0) continue;
+    ++candidates;
+    const auto want = DeletionResolver(saved).resolve(e);
+    for (bool warm : {false, true}) {
+      DeletionResolver kept(saved);
+      if (warm) (void)kept.resolve(e);
+      int failures = 0;
+      for (long at = 0;; ++at) {
+        // A fresh resolver ends with the attempt; the warm one already holds its grown storage.
+        // So an allocation left live after the attempt is a leak of the failed re-solve.
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          DeletionResolver fresh(saved);
+          DeletionResolver& rs = warm ? kept : fresh;
+          DeletionResult got;
+          failed = fails_at(at, [&] { got = rs.resolve(e); });
+          if (!failed) {
+            EXPECT_TRUE(same_result(got, want)) << "edge " << e;
+          } else {
+            ++failures;
+            EXPECT_TRUE(same_network(saved.network(), network)) << "edge " << e << " allocation " << at;
+            EXPECT_TRUE(same_result(rs.resolve(e), want)) << "edge " << e << " retry after allocation " << at;
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << "edge " << e << " warm " << warm << " allocation " << at << ": a leak";
+        if (!failed) break;
+      }
+      // Every re-solve allocates (its result's arrays at least), warm or fresh.
+      EXPECT_GE(failures, 3) << "edge " << e << " warm " << warm;
+    }
+  }
+  EXPECT_GE(candidates, 5);
+}
+
+// A copy assignment between populated states of different coordinate sizes
+// (and onto itself) fails at every allocation without changing its target; the pairs include a
+// larger state assigned to a smaller one (the 6-node path to the 2-node path). A failed target is
+// identical to its old value and serves its re-solves; a finished one is identical to the source.
+TEST(DeletionFaults, CopyAssignmentFailsWithoutChangingItsTarget) {
+  const auto states = assignment_states();
+  for (std::size_t i = 0; i < states.size(); ++i) {
+    for (std::size_t j = 0; j < states.size(); ++j) {
+      int failed_here = 0;
+      for (long at = 0;; ++at) {
+        const std::string where = "target " + std::to_string(i) + " source " + std::to_string(j) + " allocation " +
+                                  std::to_string(at);
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          DeletionState target = states[i].state;
+          failed = fails_at(at, [&] {
+            if (i == j) {
+              const DeletionState& self = target;
+              target = self;
+            } else {
+              target = states[j].state;
+            }
+          });
+          if (!failed) {
+            EXPECT_TRUE(holds(target, states[j])) << where;
+          } else {
+            ++failed_here;
+            EXPECT_TRUE(holds(target, states[i])) << where;
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << where << ": a leak";  // the copy built aside is gone
+        if (!failed) break;
+        ASSERT_FALSE(::testing::Test::HasFailure()) << where;
+      }
+      // The copy built aside allocates the residual and the potentials, whatever the sizes.
+      EXPECT_EQ(failed_here, 2) << "target " << i << " source " << j;
+    }
+  }
+}
+
+// An empty state (no solve) as the target keeps nothing after a failure and accepts no resolver;
+// as the source it empties the target without allocating.
+TEST(DeletionFaults, CopyAssignmentWithAnEmptyStateIsAllOrNothing) {
+  const auto states = assignment_states();
+  for (std::size_t j = 0; j < states.size(); ++j) {
+    long failed = 0;
+    for (long at = 0;; ++at) {
+      const long live = g_live.load();
+      bool done = false;
+      {
+        DeletionState target;
+        done = !fails_at(at, [&] { target = states[j].state; });
+        if (done) {
+          EXPECT_TRUE(holds(target, states[j])) << "source " << j;
+        } else {
+          ++failed;
+          EXPECT_TRUE(empty_state(target)) << "source " << j << " allocation " << at;
+        }
+      }
+      EXPECT_EQ(g_live.load(), live) << "source " << j << " allocation " << at << ": a leak";
+      if (done) break;
+    }
+    // The copy built aside allocates the residual and the potentials (as a copy construction).
+    EXPECT_EQ(failed, 2) << "source " << j;
+    DeletionState target = states[j].state;
+    const DeletionState none;
+    EXPECT_FALSE(fails_at(0, [&] { target = none; })) << "target " << j;
+    EXPECT_TRUE(empty_state(target)) << "target " << j;
+  }
+}
+
+// The moves of a state, of a resolver and of a capture request neither allocate nor throw (the
+// exchange of the copy assignment); a moved resolver serves its state.
+TEST(DeletionFaults, MovesNeverAllocate) {
+  const auto states = assignment_states();
+  for (std::size_t i = 0; i + 1 < states.size(); ++i) {
+    DeletionState target = states[i].state;
+    DeletionState source = states[i + 1].state;
+    EXPECT_FALSE(fails_at(0, [&] { target = std::move(source); })) << i;
+    EXPECT_TRUE(identical(target, states[i + 1].state)) << i;
+    EXPECT_FALSE(fails_at(0, [&] { DeletionState moved(std::move(target)); })) << i;
+    DeletionResolver first(states[i].state);
+    DeletionResolver second(states[i + 1].state);
+    EXPECT_FALSE(fails_at(0, [&] { first = std::move(second); })) << i;
+    const auto& [e, want] = states[i + 1].results.front();
+    EXPECT_TRUE(same_result(first.resolve(e), want)) << i;
+    DeletionCapture req;
+    req.state = states[i].state;
+    DeletionCapture other;
+    EXPECT_FALSE(fails_at(0, [&] { other = std::move(req); })) << i;
+    ASSERT_TRUE(other.state.has_value());
+    EXPECT_TRUE(identical(*other.state, states[i].state)) << i;
+  }
+}
+
+// Copy assignments on 1, 2 and 4 threads at once, each thread into its own target from a source
+// whose graph and network the next thread's target, when there is one, shares (a copy of the same
+// state); every allocation of the run fails once (any thread's, or the workers' only). A target
+// whose assignment failed or never started keeps its old value, every other one holds its source;
+// the runs that failed are those of the threads' own allocations plus two per assignment.
+TEST(DeletionFaults, CopyAssignmentsOnWorkerThreadsAreAllOrNothing) {
+  const auto states = assignment_states();
+  const auto k = states.size();
+  // Runs body(t) on `workers` threads (on the caller for one), then raises the first error.
+  const auto on_threads = [](std::size_t workers, const std::function<void(std::size_t)>& body,
+                             const std::vector<std::exception_ptr>& errors) {
+    if (workers == 1) {
+      body(0);
+    } else {
+      std::vector<std::thread> pool;
+      pool.reserve(workers);
+      try {
+        for (std::size_t t = 0; t < workers; ++t) pool.emplace_back([&body, t] { body(t); });  // not a copy of body
+      } catch (...) {
+        for (auto& th : pool) th.join();
+        throw;
+      }
+      for (auto& th : pool) th.join();
+    }
+    for (const auto& e : errors) {
+      if (e) std::rethrow_exception(e);
+    }
+  };
+  for (std::size_t workers : {1, 2, 4}) {
+    for (bool workers_only : {false, true}) {
+      if (workers == 1 && workers_only) continue;
+      // The allocations of the threads alone (their bodies empty).
+      const std::vector<std::exception_ptr> none(workers);
+      const std::function<void(std::size_t)> empty = [](std::size_t) {};
+      const auto idle = [&] { on_threads(workers, empty, none); };
+      long threads_only = 0;
+      while (workers_only ? fails_in_workers_at(threads_only, idle) : fails_at(threads_only, idle)) ++threads_only;
+      long failures = 0;
+      for (long at = 0;; ++at) {
+        // The targets, the threads and the copies built aside end with the attempt: an
+        // allocation left live is a leak of a failed assignment.
+        const long live = g_live.load();
+        bool failed = false;
+        {
+          std::vector<DeletionState> targets;
+          for (std::size_t t = 0; t < workers; ++t) targets.push_back(states[t % k].state);
+          std::vector<std::uint8_t> done(workers, 0);
+          std::vector<std::exception_ptr> errors(workers);
+          // Wrapped before the sweep's window (the wrapper may allocate).
+          const std::function<void(std::size_t)> body = [&](std::size_t t) noexcept {
+            try {
+              targets[t] = states[(t + 1) % k].state;
+              done[t] = 1;
+            } catch (...) {
+              errors[t] = std::current_exception();
+            }
+          };
+          auto run = [&] { on_threads(workers, body, errors); };
+          failed = workers_only ? fails_in_workers_at(at, run) : fails_at(at, run);
+          for (std::size_t t = 0; t < workers; ++t) {
+            const auto& want = done[t] != 0 ? states[(t + 1) % k] : states[t % k];
+            EXPECT_TRUE(holds(targets[t], want)) << "workers " << workers << " thread " << t << " allocation " << at;
+          }
+          if (!failed) {
+            for (std::size_t t = 0; t < workers; ++t) EXPECT_EQ(done[t], 1) << "workers " << workers << " thread " << t;
+          }
+        }
+        EXPECT_EQ(g_live.load(), live) << "workers " << workers << " allocation " << at << ": a leak";
+        if (!failed) break;
+        ++failures;
+        ASSERT_FALSE(::testing::Test::HasFailure());
+        ASSERT_LT(at, 1000);
+      }
+      // Each assignment allocates twice (the copy built aside), and every allocation failed once.
+      EXPECT_EQ(failures, threads_only + 2 * static_cast<long>(workers))
+          << "workers " << workers << " workers_only " << workers_only;
+    }
+  }
+}
+
+// Every allocation of the capture on a thread whose solver is cold, and on one whose solver first
+// served a smaller graph (its storage grows), leaves no state and an unchanged payload; the retry
+// on the same thread gives the reference payload and state. The sweep's failures outnumber the
+// allocations of a capture on a thread whose solver already served this graph: the sweep reached
+// the solver's growth (sweep_scratch_growth).
+TEST(DeletionFaults, CaptureFailsAtEveryAllocationOnAColdOrGrowingThread) {
+  const auto g = graph();
+  DeletionCapture ref;
+  const auto payload = capture(*g, g, ref);
+  for (bool grow : {false, true}) {
+    sweep_scratch_growth(
+        grow ? "growing thread" : "cold thread",
+        [&] {
+          if (grow) (void)chain(2, 2);
+        },
+        [&](long at, const std::string& w) {
+          DeletionCapture req;
+          MinCostFlowResult got;
+          const bool failed = fails_at(at, [&] { got = capture(*g, g, req); });
+          if (failed) {
+            EXPECT_FALSE(req.state.has_value()) << w;
+            got = capture(*g, g, req);
+          }
+          EXPECT_TRUE(same_payload(got, payload)) << w;
+          EXPECT_TRUE(req.state.has_value() && same_state(*req.state, *ref.state)) << w;
+          return failed;
+        },
+        [&] {
+          DeletionCapture first;
+          (void)capture(*g, g, first);  // the solver's storage grows to this graph
+          long warm = 0;
+          while (fails_at(warm, [&] {
+            DeletionCapture again;
+            (void)capture(*g, g, again);
+          })) {
+            ++warm;
+          }
+          return warm;
+        });
+  }
+}
+
+// CentralizedTE's failure study at every allocation (any thread's, and the workers' only) on 1, 2 and 4
+// workers; after each failure a retry gives the reference baseline and every entry.
+TEST(DeletionFaults, GlobalSensitivityFailsAtEveryAllocation) {
+  const std::vector<std::shared_ptr<const Graph>> graphs {
+    std::make_shared<const Graph>(make_graph(5, {{0, 1, 2, 1}, {1, 2, 2, 1}, {1, 3, 1, 2}, {3, 2, 1, 2}, {2, 4, 2, 1}, {0, 3, 1, 5}})),
+    std::make_shared<const Graph>(make_graph(5, {{0, 1, 3, 1}, {0, 2, 3, 3}, {1, 3, 3, 1}, {2, 3, 3, 1}, {3, 4, 3, 1}})),
+  };
+  for (const auto& g : graphs) {
+    const EvaluationOptions opts {global_config(), nullptr, nullptr, OutputOptions {true, true, true}};
+    const std::vector<NodeId> sources {0};
+    const std::vector<NodeId> destinations {4};
+    const auto want = evaluate_edge_failures(*g, sources, destinations, opts, 1);
+    ASSERT_EQ(want.entries.size(), 3U);  // three baseline-positive candidates, including a cut edge
+    const auto same = [&](const SensitivityResult& got, const std::string& where) {
+      expect_same(got.baseline, want.baseline, where);
+      ASSERT_EQ(got.entries.size(), want.entries.size()) << where;
+      for (std::size_t i = 0; i < want.entries.size(); ++i) {
+        EXPECT_EQ(got.entries[i].edge, want.entries[i].edge) << where;
+        EXPECT_EQ(got.entries[i].delivery_reduction, want.entries[i].delivery_reduction) << where;
+      }
+    };
+    for (std::int32_t workers : {1, 2, 4}) {
+      for (bool workers_only : {false, true}) {
+        if (workers == 1 && workers_only) continue;
+        int failures = 0;
+        for (long at = 0;; ++at) {
+          const std::string where = "workers " + std::to_string(workers) + (workers_only ? " (workers only)" : "") +
+                                    " allocation " + std::to_string(at);
+          // The result and the retry end with the attempt, the workers' scratch with their threads,
+          // and the reference above grew this thread's: an allocation left live is a leak.
+          const long live = g_live.load();
+          bool failed = false;
+          {
+            SensitivityResult got;
+            const auto call = [&] { got = evaluate_edge_failures(*g, sources, destinations, opts, workers); };
+            failed = workers_only ? fails_in_workers_at(at, call) : fails_at(at, call);
+            if (!failed) {
+              same(got, where);
+            } else {
+              same(evaluate_edge_failures(*g, sources, destinations, opts, workers), "retry after " + where);
+            }
+          }
+          EXPECT_EQ(g_live.load(), live) << where << ": a leak";
+          if (!failed) break;
+          ++failures;
+          ASSERT_FALSE(::testing::Test::HasFailure());
+          ASSERT_LT(at, 10000);
+        }
+        EXPECT_GT(failures, workers_only ? 10 : 100) << "workers " << workers << " workers_only " << workers_only;
+      }
+    }
+  }
+}
+
+// The negative controls of the comparators above: a copy of a captured state's fields with any
+// one field changed is not identical, and with any value field changed not the same state
+// either; a vector field is changed both by one more entry and by its last entry's value (so a
+// comparator of sizes only, or of a prefix only, fails). A state without fields has none, and
+// each field set makes it one with a field. A state serves its own re-solves; another state
+// (also one of equal values on another graph), a changed reference result or an empty list of
+// results does not.
+TEST(DeletionFaults, TheStateComparatorsCompareEveryField) {
+  const Saved six = chain(6, 2);
+  const Saved other = chain(6, 3);
+  const StateFields st = fields_of(six.state);
+  const StateFields elsewhere = fields_of(other.state);
+  ASSERT_TRUE(identical(st, st));
+  ASSERT_TRUE(st.maximum_ && st.value_ > 0 && !st.residual_.empty() && !st.potentials_.empty());
+  ASSERT_NE(st.graph_, elsewhere.graph_);
+  ASSERT_NE(st.network_, elsewhere.network_);
+  const std::vector<std::function<void(StateFields&)>> values = {
+      [](auto& x) { x.residual_.push_back(0); },
+      [](auto& x) { ++x.residual_.back(); },
+      [](auto& x) { x.potentials_.push_back(detail::I128 {0}); },
+      [](auto& x) { x.potentials_.back() += detail::I128 {1}; },
+      [](auto& x) { ++x.value_; },
+      [](auto& x) { x.maximum_ = !x.maximum_; },
+  };
+  for (std::size_t k = 0; k < values.size(); ++k) {
+    StateFields x = st;
+    values[k](x);
+    EXPECT_FALSE(same_state(x, st)) << "value field " << k;
+    EXPECT_FALSE(identical(x, st)) << "value field " << k;
+  }
+  const std::vector<std::function<void(StateFields&)>> others = {
+      [&](auto& x) { x.graph_ = elsewhere.graph_; },
+      [&](auto& x) { x.network_ = elsewhere.network_; },
+      [](auto& x) { ++x.counters_.dijkstra_runs; },
+      [](auto& x) { ++x.counters_.augmentations; },
+  };
+  for (std::size_t k = 0; k < others.size(); ++k) {
+    StateFields x = st;
+    others[k](x);
+    EXPECT_TRUE(same_state(x, st)) << "identity or counter field " << k;
+    EXPECT_FALSE(identical(x, st)) << "identity or counter field " << k;
+  }
+  const StateFields none {};
+  EXPECT_TRUE(no_fields(none));
+  for (std::size_t k = 0; k < values.size(); ++k) {
+    if (k == 1 || k == 3) continue;  // the last entry's value: none has no entry
+    StateFields x = none;
+    values[k](x);
+    EXPECT_FALSE(no_fields(x)) << "value field " << k;
+  }
+  EXPECT_TRUE(empty_state(DeletionState {}));
+  EXPECT_FALSE(empty_state(six.state));
+  EXPECT_TRUE(holds(six.state, six));
+  EXPECT_FALSE(holds(other.state, six));
+  const Saved twin = chain(6, 2);  // equal values on another graph and network
+  ASSERT_TRUE(same_state(twin.state, six.state));
+  EXPECT_FALSE(holds(twin.state, six));
+  Saved changed = six;
+  ASSERT_FALSE(changed.results.empty());
+  ++changed.results.back().second.value;
+  EXPECT_FALSE(holds(six.state, changed));
+  Saved no_results = six;
+  no_results.results.clear();
+  EXPECT_FALSE(holds(six.state, no_results));
+}
+
+TEST(DeletionFaults, CutClassificationFailsWithoutChangingItsInputOrOutput) {
+  const auto g = graph();
+  DeletionCapture req;
+  (void)capture(*g, g, req);
+  const DeletionState saved = *req.state;
+  const auto expected = detail::deletion_cut_edges(saved);
+  const detail::ResidualNetwork network = saved.network();
+  int failures = 0;
+  for (long at = 0;; ++at) {
+    const long live = g_live.load();
+    bool failed;
+    {
+      std::vector<std::uint8_t> got {77};
+      failed = fails_at(at, [&] { got = detail::deletion_cut_edges(saved); });
+      if (failed) {
+        ++failures;
+        EXPECT_EQ(got, (std::vector<std::uint8_t> {77}));
+        EXPECT_TRUE(identical(saved, *req.state));
+        EXPECT_TRUE(same_network(saved.network(), network));
+        got = detail::deletion_cut_edges(saved);
+      }
+      EXPECT_EQ(got, expected);
+    }
+    EXPECT_EQ(g_live.load(), live) << at;
+    if (!failed) break;
+    ASSERT_LT(at, 100);
+  }
+  EXPECT_GE(failures, 7);
+}
+
+TEST(DeletionFaults, ScalarRepairsRetryOnTheSameColdAndGrownResolver) {
+  const auto g = graph();
+  DeletionCapture req;
+  (void)capture(*g, g, req);
+  const DeletionState saved = *req.state;
+  const detail::ResidualNetwork network = saved.network();
+  for (EdgeId e : saved.network().edges) {
+    if (saved.edge_flows()[static_cast<std::size_t>(e)] == 0) continue;
+    const auto full = DeletionResolver(saved).resolve(e);
+    for (bool warm : {false, true}) {
+      DeletionResolver kept(saved);
+      if (warm) (void)kept.loss(e);
+      for (long at = 0;; ++at) {
+        const long live = g_live.load();
+        bool failed;
+        {
+          DeletionResolver fresh(saved);
+          auto& resolver = warm ? kept : fresh;
+          Amount loss = -1;
+          failed = fails_at(at, [&] { loss = resolver.loss(e); });
+          if (failed) {
+            EXPECT_EQ(loss, -1);
+            EXPECT_TRUE(identical(saved, *req.state));
+            EXPECT_TRUE(same_network(saved.network(), network));
+            loss = resolver.loss(e);
+          }
+          EXPECT_EQ(loss, saved.value() - full.value);
+          // Complete repair can retain additional heap buckets beyond the scalar
+          // path. Its disposable resolver must not count as a leak of the kept one.
+          EXPECT_TRUE(same_result(DeletionResolver(saved).resolve(e), full));
+        }
+        EXPECT_EQ(g_live.load(), live) << e << " warm " << warm << " allocation " << at;
+        if (!failed) break;
+        ASSERT_LT(at, 1000);
+      }
+    }
+  }
+}
diff --git a/tests/cpp/min_cost_flow_deletion_tests.cpp b/tests/cpp/min_cost_flow_deletion_tests.cpp
new file mode 100644
index 0000000..f6146b3
--- /dev/null
+++ b/tests/cpp/min_cost_flow_deletion_tests.cpp
@@ -0,0 +1,1694 @@
+// The deletion re-solve of the flow core and the exact failure study that uses it. Every check
+// is independent of the repair: a solve from zero on the deleted view, the Bellman-Ford curve of
+// test_utils.hpp, residuals rebuilt from flows, divergences and reduced costs computed here in
+// the exact test integer of test_int128.hpp. Without the private hooks, check_deletion checks
+// each re-solve's final result only: the probe that observes every intermediate state of the
+// repairs is a hook. Three tests check the test tools themselves: the portable 128-bit classes of
+// test_int128.hpp against the built-in type, the equality helpers of test_utils.hpp field by
+// field, and this file's check_residual against a broken state per clause.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <functional>
+#include <iterator>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <random>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/evaluator_checks.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+using detail::DeletionCapture;
+using detail::DeletionResolver;
+using detail::DeletionResult;
+using detail::DeletionState;
+using detail::MinCostFlowCounters;
+using detail::I128;
+using detail::ResidualNetwork;
+
+constexpr std::size_t kNone = std::numeric_limits<std::size_t>::max();
+
+Int128 wide(I128 x) { return int128_of(x.hi, x.lo); }
+
+// A solve to capture: the graph, the view, the endpoint sets, the eligibility and the cap.
+struct Case {
+  std::shared_ptr<const Graph> g;
+  std::vector<Amount> view;
+  std::vector<NodeId> sources;
+  std::vector<NodeId> destinations;
+  std::optional<Eligibility> elig {};
+  std::optional<Amount> cap {};
+  [[nodiscard]] const Eligibility* el() const { return elig ? &*elig : nullptr; }
+};
+
+Case make_case(std::int32_t n, const std::vector<InEdge>& edges, std::vector<NodeId> s, std::vector<NodeId> d) {
+  Case c;
+  c.g = std::make_shared<const Graph>(make_graph(n, edges));
+  c.view.assign(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end());
+  c.sources = std::move(s);
+  c.destinations = std::move(d);
+  return c;
+}
+
+DeletionCapture capture_of(const Case& c, MinCostFlowResult* payload = nullptr) {
+  DeletionCapture req;
+  req.graph = c.g;
+  auto r = solve_min_cost_flow(*c.g, c.view, c.sources, c.destinations, c.el(), c.cap, &req);
+  if (payload != nullptr) *payload = std::move(r);
+  return req;
+}
+
+Int128 cost_sum(const Graph& g) {
+  Int128 c = 0;
+  for (Cost w : g.edge_costs()) c += w;
+  return c;
+}
+
+// The local index of edge e in the state's network.
+std::size_t local_of(const ResidualNetwork& net, EdgeId e) {
+  const auto it = std::lower_bound(net.edges.begin(), net.edges.end(), e);
+  return it != net.edges.end() && *it == e ? static_cast<std::size_t>(it - net.edges.begin()) : kNone;
+}
+
+// The tail of every slot.
+std::vector<std::int32_t> slot_tails(const ResidualNetwork& net) {
+  std::vector<std::int32_t> tail(net.arc_destinations.size());
+  for (std::int32_t x = 0; x < net.num_nodes + 2; ++x) {
+    for (auto p = net.arc_offsets[static_cast<std::size_t>(x)]; p < net.arc_offsets[static_cast<std::size_t>(x) + 1]; ++p) {
+      tail[static_cast<std::size_t>(p)] = x;
+    }
+  }
+  return tail;
+}
+
+// The residual of a flow (per EdgeId) on the network: real arcs from the flow and the view
+// capacity, virtual arcs from the endpoints' divergences; the deleted edge's arcs zero.
+std::vector<Amount> residual_of(const ResidualNetwork& net, const std::vector<Amount>& flows, std::size_t deleted) {
+  std::vector<Amount> res(net.arc_destinations.size(), 0);
+  std::vector<Amount> div(static_cast<std::size_t>(net.num_nodes) + 2, 0);
+  for (std::size_t k = 0; k < net.edges.size(); ++k) {
+    const Amount f = flows[static_cast<std::size_t>(net.edges[k])];
+    const auto fwd = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+    const auto bwd = static_cast<std::size_t>(net.reverse_arcs[fwd]);
+    if (k == deleted) continue;
+    res[fwd] = net.edge_capacities[k] - f;
+    res[bwd] = f;
+    div[static_cast<std::size_t>(net.edge_sources[k])] += f;
+    div[static_cast<std::size_t>(net.edge_destinations[k])] -= f;
+  }
+  for (std::size_t i = 0; i < net.sources.size(); ++i) {
+    const Amount x = div[static_cast<std::size_t>(net.sources[i])];
+    const auto a = static_cast<std::size_t>(net.source_reverse_arcs[i]);
+    res[a] = x;
+    res[static_cast<std::size_t>(net.reverse_arcs[a])] = kMaxFlowCap - x;
+  }
+  for (std::size_t i = 0; i < net.destinations.size(); ++i) {
+    const Amount y = -div[static_cast<std::size_t>(net.destinations[i])];
+    const auto a = static_cast<std::size_t>(net.destination_forward_arcs[i]);
+    res[a] = kMaxFlowCap - y;
+    res[static_cast<std::size_t>(net.reverse_arcs[a])] = y;
+  }
+  return res;
+}
+
+// The divergences (outflow minus inflow) every vertex should have: `at` lists (vertex, value).
+std::vector<Int128> divergences(const ResidualNetwork& net, std::initializer_list<std::pair<std::int32_t, Int128>> at) {
+  std::vector<Int128> d(static_cast<std::size_t>(net.num_nodes) + 2, 0);
+  for (auto [v, x] : at) d[static_cast<std::size_t>(v)] += x;
+  return d;
+}
+
+// The failed checks of a residual with potentials on the network: capacity
+// bounds (both arcs of a pair non-negative, summing to the pair's capacity; the deleted edge's
+// pair zero), the divergence vector `want`, non-negative reduced cost on every positive
+// residual arc (real and virtual), and the bound `bound` on every potential (non-negative).
+std::vector<std::string> check_residual(const ResidualNetwork& net, std::span<const Amount> res, std::span<const I128> pi,
+                                        std::size_t deleted, const std::vector<Int128>& want, Int128 bound) {
+  std::vector<std::string> fails;
+  const auto n = static_cast<std::size_t>(net.num_nodes) + 2;
+  if (res.size() != net.arc_destinations.size() || pi.size() != n) return {"shape"};
+  std::vector<Int128> div(n, 0);
+  for (std::size_t k = 0; k < net.edges.size(); ++k) {
+    const auto fwd = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+    const auto bwd = static_cast<std::size_t>(net.reverse_arcs[fwd]);
+    if (k == deleted) {
+      if (res[fwd] != 0 || res[bwd] != 0) fails.push_back("the deleted edge keeps a residual arc");
+      continue;
+    }
+    if (res[fwd] < 0 || res[bwd] < 0 || res[fwd] + res[bwd] != net.edge_capacities[k]) {
+      fails.push_back("capacity bounds at edge " + std::to_string(net.edges[k]));
+    }
+    div[static_cast<std::size_t>(net.edge_sources[k])] += res[bwd];
+    div[static_cast<std::size_t>(net.edge_destinations[k])] -= res[bwd];
+  }
+  const auto S = static_cast<std::size_t>(net.num_nodes);
+  const std::size_t T = S + 1;
+  auto virtual_pair = [&](std::size_t a, std::size_t from, std::size_t to, Amount flow) {
+    if (res[a] < 0 || res[static_cast<std::size_t>(net.reverse_arcs[a])] < 0 ||
+        static_cast<Int128>(res[a]) + res[static_cast<std::size_t>(net.reverse_arcs[a])] != kMaxFlowCap) {
+      fails.push_back("capacity bounds at a virtual arc");
+    }
+    div[from] += flow;
+    div[to] -= flow;
+  };
+  for (std::size_t i = 0; i < net.sources.size(); ++i) {
+    const auto a = static_cast<std::size_t>(net.source_reverse_arcs[i]);
+    virtual_pair(a, S, static_cast<std::size_t>(net.sources[i]), res[a]);
+  }
+  for (std::size_t i = 0; i < net.destinations.size(); ++i) {
+    const auto a = static_cast<std::size_t>(net.destination_forward_arcs[i]);
+    virtual_pair(a, static_cast<std::size_t>(net.destinations[i]), T, res[static_cast<std::size_t>(net.reverse_arcs[a])]);
+  }
+  if (div != want) fails.push_back("divergence vector");
+  const auto tail = slot_tails(net);
+  for (std::size_t a = 0; a < res.size(); ++a) {
+    if (res[a] <= 0) continue;
+    const auto u = static_cast<std::size_t>(tail[a]);
+    const auto v = static_cast<std::size_t>(net.arc_destinations[a]);
+    if (static_cast<Int128>(net.arc_cost[a]) + wide(pi[u]) - wide(pi[v]) < 0) {
+      fails.push_back("negative reduced cost on slot " + std::to_string(a) + (u >= S || v >= S ? " (virtual)" : ""));
+    }
+  }
+  for (std::size_t v = 0; v < n; ++v) {
+    if (wide(pi[v]) < 0 || wide(pi[v]) > bound) fails.push_back("potential outside [0, bound] at " + std::to_string(v));
+  }
+  return fails;
+}
+
+// The vertices the real sources reach over positive residual arcs (their residual closure).
+std::vector<char> closure_of(const ResidualNetwork& net, std::span<const Amount> res) {
+  const auto n = static_cast<std::size_t>(net.num_nodes) + 2;
+  std::vector<char> seen(n, 0);
+  std::vector<std::size_t> queue;
+  for (std::int32_t s : net.sources) {
+    seen[static_cast<std::size_t>(s)] = 1;
+    queue.push_back(static_cast<std::size_t>(s));
+  }
+  for (std::size_t qi = 0; qi < queue.size(); ++qi) {
+    const auto u = queue[qi];
+    for (auto p = net.arc_offsets[u]; p < net.arc_offsets[u + 1]; ++p) {
+      const auto v = static_cast<std::size_t>(net.arc_destinations[static_cast<std::size_t>(p)]);
+      if (res[static_cast<std::size_t>(p)] > 0 && seen[v] == 0) {
+        seen[v] = 1;
+        queue.push_back(v);
+      }
+    }
+  }
+  return seen;
+}
+
+// Whether the real sources reach t* over positive residual arcs.
+bool connected(const ResidualNetwork& net, std::span<const Amount> res) { return closure_of(net, res).back() != 0; }
+
+// A solve from zero with e deleted as evaluate_edge_failures deletes it: excluded by an Eligibility
+// (intersected with the case's), its view 0. An excluded edge is no edge of the network, so it is
+// never a cut edge; an allowed edge of view 0 leaving the closure is one.
+MinCostFlowResult fresh_without(const Case& c, EdgeId e) {
+  auto view = c.view;
+  view[static_cast<std::size_t>(e)] = 0;
+  const EdgeId one[1] = {e};
+  Eligibility deleted = c.g->eligibility({}, one);
+  if (c.el() != nullptr) deleted = Eligibility::intersect(*c.el(), deleted);
+  return solve_min_cost_flow(*c.g, view, c.sources, c.destinations, &deleted, std::nullopt);
+}
+
+// The cut of a residual: the network's edges, the deleted one aside, from the closure of the real
+// sources to its complement, whatever their view capacity, ascending EdgeId.
+std::vector<EdgeId> closure_cut(const ResidualNetwork& net, std::span<const Amount> res, std::size_t deleted) {
+  const auto seen = closure_of(net, res);
+  std::vector<EdgeId> cut;
+  for (std::size_t k = 0; k < net.edges.size(); ++k) {
+    if (k == deleted) continue;
+    if (seen[static_cast<std::size_t>(net.edge_sources[k])] != 0 && seen[static_cast<std::size_t>(net.edge_destinations[k])] == 0) {
+      cut.push_back(net.edges[k]);
+    }
+  }
+  return cut;
+}
+
+// The Dijkstra-run bound of a re-solve of an edge carrying f units: at most m + 2 r runs, where r
+// is the remainder (the units lost) and m = f - r the units repair 1 reroutes. The failed clause,
+// "" when the bound holds.
+std::string run_bound_failure(const DeletionState& st, Amount f, const DeletionResult& r) {
+  const Amount rem = st.value() - r.value;
+  if (rem < 0) return "the re-solve gained value";
+  if (r.counters.dijkstra_runs > (f - rem) + 2 * rem) return "more Dijkstra runs than m + 2 r";
+  return "";
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// What the probe reported, per repair (0 after the deletion, 1 to 3 the repairs, 4 at
+// completion): the events of each kind and the amount the repair had moved at its last event.
+struct Observation {
+  int updates[5] = {0, 0, 0, 0, 0};
+  int pushes[5] = {0, 0, 0, 0, 0};
+  Amount moved[5] = {0, 0, 0, 0, 0};
+};
+
+// The re-solve of e observed by the probe: every observed state (after the deletion, after every
+// potential update and push of the three repairs, at completion) is checked against the
+// capacity bounds, the exact divergence vector for the amounts moved so far and dual
+// feasibility on every positive residual arc. `updates` collects the counters after every
+// potential update with its repair; `seen` counts the events.
+DeletionResult observed(DeletionResolver& rs, const DeletionState& st, EdgeId e, std::vector<std::string>& fails,
+                        bool rerun = false, std::vector<std::pair<int, MinCostFlowCounters>>* updates = nullptr,
+                        Observation* seen = nullptr) {
+  const ResidualNetwork& net = st.network();
+  const std::size_t k = local_of(net, e);
+  const std::int32_t u = net.edge_sources[k];
+  const std::int32_t v = net.edge_destinations[k];
+  const Amount F = st.value();
+  const Amount f = st.edge_flows()[static_cast<std::size_t>(e)];
+  const Int128 n = net.num_nodes + 2;
+  const Int128 bound = (22 * n + 15) * cost_sum(st.graph());
+  Amount moved[5] = {0, 0, 0, 0, 0};
+  detail::DeletionProbe probe;
+  probe.rerun_failed_search = rerun;
+  probe.observe = [&](const detail::DeletionEvent& ev) {
+    if (ev.repair >= 1 && ev.repair <= 3) moved[ev.repair] = ev.moved;
+    const auto want = divergences(net, {{net.num_nodes, F - moved[2]},
+                                        {net.num_nodes + 1, -static_cast<Int128>(F) + moved[3]},
+                                        {u, -static_cast<Int128>(f) + moved[1] + moved[2]},
+                                        {v, static_cast<Int128>(f) - moved[1] - moved[3]}});
+    for (const auto& s : check_residual(net, ev.residual, ev.potentials, k, want, bound)) {
+      fails.push_back("repair " + std::to_string(ev.repair) + (ev.push ? " push" : " update") + ": " + s);
+    }
+    if (updates != nullptr && !ev.push && ev.repair >= 1 && ev.repair <= 3) updates->emplace_back(ev.repair, *ev.counters);
+    if (seen != nullptr && ev.repair >= 0 && ev.repair <= 4) {
+      ++(ev.push ? seen->pushes : seen->updates)[ev.repair];
+      seen->moved[ev.repair] = ev.moved;
+    }
+  };
+  return rs.resolve(e, probe);
+}
+#endif
+
+// A completed deletion's certificate, separate from the solve so broken answers can be fed to
+// every clause. The view, a fresh solve and an independent cost curve supply the expected values.
+void expect_deletion(const Case& c, const DeletionState& st, EdgeId e, const DeletionResult& r,
+                     const std::string& where) {
+  const ResidualNetwork& net = st.network();
+  const std::size_t k = local_of(net, e);
+  // Feasible on V \ {e} read per EdgeId: within the view, zero on the deleted edge and on every
+  // edge the Eligibility excludes.
+  auto view = c.view;
+  view[static_cast<std::size_t>(e)] = 0;
+  ASSERT_EQ(r.edge_flows.size(), view.size()) << where;
+  for (std::size_t x = 0; x < view.size(); ++x) {
+    EXPECT_TRUE(r.edge_flows[x] >= 0 && r.edge_flows[x] <= view[x]) << where << " edge " << x;
+    if (c.el() != nullptr && !c.el()->allows_edge(static_cast<EdgeId>(x))) EXPECT_EQ(r.edge_flows[x], 0) << where;
+  }
+  // From zero on V \ {e} with e excluded, and the independent Bellman-Ford curve.
+  const auto fresh = fresh_without(c, e);
+  const auto ref = independent_curve(*c.g, view, c.sources, c.destinations, c.el());
+  EXPECT_EQ(r.value, fresh.flow_value) << where;
+  EXPECT_EQ(r.value, ref.back().first) << where;
+  EXPECT_TRUE(flow_cost(*c.g, r.edge_flows) == flow_cost(*c.g, fresh.edge_flows)) << where;
+  EXPECT_TRUE(flow_cost(*c.g, r.edge_flows) == ref.back().second) << where;
+  ASSERT_TRUE(fresh.min_cut.has_value()) << where;
+  EXPECT_EQ(r.min_cut, *fresh.min_cut) << where;
+  Amount cut_value = 0;
+  for (EdgeId x : r.min_cut) cut_value += view[static_cast<std::size_t>(x)];
+  EXPECT_EQ(cut_value, r.value) << where;
+  EXPECT_EQ(r.edge_flows[static_cast<std::size_t>(e)], 0) << where;
+  // The final residual from the flow: bounds, divergences (value at s*), working potentials
+  // valid on every positive residual arc, the destinations disconnected, and the cut its closure's.
+  const auto res = residual_of(net, r.edge_flows, k);
+  const Int128 n = net.num_nodes + 2;
+  const auto want = divergences(net, {{net.num_nodes, r.value}, {net.num_nodes + 1, -static_cast<Int128>(r.value)}});
+  for (const auto& s : check_residual(net, res, r.potentials, k, want, (22 * n + 15) * cost_sum(*c.g))) {
+    ADD_FAILURE() << where << ": final: " << s;
+  }
+  EXPECT_FALSE(connected(net, res)) << where;
+  EXPECT_EQ(r.min_cut, closure_cut(net, res, k)) << where;  // the cut of that residual
+  EXPECT_EQ(run_bound_failure(st, st.edge_flows()[static_cast<std::size_t>(e)], r), "") << where;
+}
+
+// Every certificate check for the deletion of positive-flow edge e from the captured state of c.
+void check_deletion(const Case& c, const DeletionState& st, EdgeId e, const std::string& where) {
+  const ResidualNetwork& net = st.network();
+  const std::size_t k = local_of(net, e);
+  ASSERT_NE(k, kNone) << where;
+  const Amount f = st.edge_flows()[static_cast<std::size_t>(e)];
+  ASSERT_GT(f, 0) << where;
+  DeletionResolver rs(st);
+  const auto r = rs.resolve(e);
+  EXPECT_EQ(rs.loss(e), st.value() - r.value) << where;
+  // A partial scalar repair never becomes the next baseline, even when the
+  // resolver is reused for a full repair immediately afterwards.
+  EXPECT_TRUE(same_result(rs.resolve(e), r)) << where;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  // rem is the remainder (the units lost) and m the units repair 1 reroutes.
+  const Amount rem = st.value() - r.value;
+  const Amount m = f - rem;
+  std::vector<std::string> fails;
+  Observation seen;
+  const auto ro = observed(rs, st, e, fails, false, nullptr, &seen);
+  for (const auto& s : fails) ADD_FAILURE() << where << ": " << s;
+  EXPECT_TRUE(same_result(ro, r)) << where;
+  // The probe fired at every stage: one event after the deletion and one at completion; repair 1
+  // searched at least once and pushed exactly when it moved units, m in all; repairs 2 and 3
+  // pushed the remainder when there is one and are silent otherwise (repair 2 may reuse repair
+  // 1's failed search, so it need not search).
+  EXPECT_EQ(seen.updates[0], 1) << where;
+  EXPECT_EQ(seen.updates[4], 1) << where;
+  EXPECT_EQ(seen.pushes[0] + seen.pushes[4], 0) << where;
+  EXPECT_GE(seen.updates[1], 1) << where;
+  EXPECT_EQ(seen.pushes[1] > 0, m > 0) << where;
+  EXPECT_EQ(seen.moved[1], m) << where;
+  for (const int i : {2, 3}) {
+    EXPECT_EQ(seen.pushes[i] > 0, rem > 0) << where << " repair " << i;
+    EXPECT_EQ(seen.moved[i], rem) << where << " repair " << i;
+  }
+  EXPECT_EQ(seen.updates[3] > 0, rem > 0) << where;
+  EXPECT_TRUE(rem > 0 || seen.updates[2] == 0) << where;
+#endif
+  expect_deletion(c, st, e, r, where);
+}
+
+// The captured state's own checks: bounds, divergences, valid working potentials within
+// (n + 1) C, and the certificate.
+void check_state(const Case& c, const DeletionState& st, const MinCostFlowResult& payload, const std::string& where) {
+  const ResidualNetwork& net = st.network();
+  EXPECT_EQ(st.value(), payload.flow_value) << where;
+  EXPECT_EQ(st.edge_flows(), payload.edge_flows) << where;
+  const Int128 n = net.num_nodes + 2;
+  const auto want =
+      divergences(net, {{net.num_nodes, st.value()}, {net.num_nodes + 1, -static_cast<Int128>(st.value())}});
+  for (const auto& s : check_residual(net, st.residual(), st.potentials(), kNone, want, (n + 1) * cost_sum(*c.g))) {
+    ADD_FAILURE() << where << ": state: " << s;
+  }
+  EXPECT_EQ(st.maximum(), !connected(net, st.residual())) << where;
+  EXPECT_TRUE(same_counters(st.counters(), payload.counters)) << where;
+}
+
+// Every allowed edge of the captured state: positive flow by the re-solve, zero flow by a
+// solve from zero on V \ {e} and the independent Bellman-Ford curve there (the baseline's value
+// and cost; no re-solve, which rejects it).
+// `resolved`, when given, counts the edges checked by a re-solve.
+void check_every_edge(const Case& c, const std::string& where, int* resolved = nullptr) {
+  MinCostFlowResult payload;
+  const auto req = capture_of(c, &payload);
+  ASSERT_TRUE(req.state.has_value()) << where;
+  const DeletionState& st = *req.state;
+  check_state(c, st, payload, where);
+  ASSERT_TRUE(st.maximum()) << where;
+  const auto flows = st.edge_flows();
+  DeletionResolver reused(st);
+  const auto positive = std::find_if(st.network().edges.begin(), st.network().edges.end(),
+                                    [&](EdgeId e) { return flows[static_cast<std::size_t>(e)] > 0; });
+  for (EdgeId e : st.network().edges) {
+    const std::string at = where + " edge " + std::to_string(e);
+    if (flows[static_cast<std::size_t>(e)] > 0) {
+      check_deletion(c, st, e, at);
+      if (resolved != nullptr) ++*resolved;
+    } else {
+      auto view = c.view;
+      view[static_cast<std::size_t>(e)] = 0;
+      const auto fresh = solve_min_cost_flow(*c.g, view, c.sources, c.destinations, c.el(), std::nullopt);
+      EXPECT_EQ(fresh.flow_value, st.value()) << at;
+      EXPECT_TRUE(flow_cost(*c.g, fresh.edge_flows) == flow_cost(*c.g, flows)) << at;
+      const auto ref = independent_curve(*c.g, view, c.sources, c.destinations, c.el());
+      EXPECT_EQ(ref.back().first, st.value()) << at;
+      EXPECT_TRUE(ref.back().second == flow_cost(*c.g, flows)) << at;
+      EXPECT_EQ(error_of([&] { (void)reused.resolve(e); }), "deletion re-solve: edge " + std::to_string(e) + " carries no flow")
+          << at;
+      if (positive != st.network().edges.end()) {
+        EXPECT_TRUE(same_result(reused.resolve(*positive), DeletionResolver(st).resolve(*positive))) << at;
+      }
+    }
+    if (::testing::Test::HasFailure()) return;
+  }
+}
+
+Case random_case(std::mt19937_64& rng) {
+  auto pick = [&](std::int64_t lo, std::int64_t hi) { return std::uniform_int_distribution<std::int64_t>(lo, hi)(rng); };
+  const auto n = static_cast<std::int32_t>(pick(3, 8));
+  std::vector<NodeId> nodes(static_cast<std::size_t>(n));
+  for (std::int32_t v = 0; v < n; ++v) nodes[static_cast<std::size_t>(v)] = v;
+  std::shuffle(nodes.begin(), nodes.end(), rng);
+  const auto ns = static_cast<std::size_t>(pick(1, std::min<std::int64_t>(3, n - 1)));
+  const auto nd = static_cast<std::size_t>(pick(1, static_cast<std::int64_t>(nodes.size() - ns)));
+  std::vector<NodeId> s(nodes.begin(), nodes.begin() + static_cast<std::ptrdiff_t>(ns));
+  std::vector<NodeId> d(nodes.begin() + static_cast<std::ptrdiff_t>(ns),
+                        nodes.begin() + static_cast<std::ptrdiff_t>(ns + nd));
+  std::vector<InEdge> edges;
+  const auto m = pick(1, 24);
+  for (std::int64_t i = 0; i < m; ++i) {
+    edges.push_back({static_cast<NodeId>(pick(0, n - 1)), static_cast<NodeId>(pick(0, n - 1)), pick(0, 4), pick(1, 13)});
+  }
+  const Cost factor = m % 3 == 0 ? 1000003 : 1;
+  for (auto& edge : edges) edge.cost *= factor;
+  Case c = make_case(n, edges, s, d);
+  for (auto& x : c.view) {
+    if (pick(0, 1) == 1) x = pick(0, x);  // a reduced view
+  }
+  if (pick(0, 1) == 1) {
+    std::vector<NodeId> xn;
+    std::vector<EdgeId> xe;
+    for (NodeId v = 0; v < n; ++v) {
+      if (pick(0, 10) == 0) xn.push_back(v);
+    }
+    for (EdgeId e = 0; e < c.g->num_edges(); ++e) {
+      if (pick(0, 9) == 0) xe.push_back(e);
+    }
+    c.elig = c.g->eligibility(xn, xe);
+  }
+  return c;
+}
+
+// The positive-flow edges of a state.
+std::vector<EdgeId> positive_edges(const DeletionState& st) {
+  std::vector<EdgeId> out;
+  const auto flows = st.edge_flows();
+  for (EdgeId e : st.network().edges) {
+    if (flows[static_cast<std::size_t>(e)] > 0) out.push_back(e);
+  }
+  return out;
+}
+
+} // namespace
+
+// ------------------------------------------------------------------ the arithmetic
+
+TEST(FlowCoreDeletion, SignedWideArithmeticMatchesInt128) {
+  std::mt19937_64 rng(11);
+  auto any = [&] {
+    I128 x;
+    x.hi = static_cast<std::int64_t>(rng()) >> (rng() % 64);
+    x.lo = rng();
+    return x;
+  };
+  int equal = 0;
+  for (int i = 0; i < 20000; ++i) {
+    const I128 a = any();
+    const I128 b = i % 8 == 0 ? a : any();  // equal operands too (two random ones never are)
+    const Int128 x = wide(a);
+    const Int128 y = wide(b);
+    // Modulo 2^128, through the unsigned type (a signed built-in overflow is undefined).
+    EXPECT_TRUE(wide(a + b) == static_cast<Int128>(static_cast<UInt128>(x) + static_cast<UInt128>(y)));
+    EXPECT_TRUE(wide(a - b) == static_cast<Int128>(static_cast<UInt128>(x) - static_cast<UInt128>(y)));
+    EXPECT_EQ(a < b, x < y);
+    EXPECT_EQ(a == b, x == y);
+    equal += a == b ? 1 : 0;
+    const auto c = static_cast<std::int64_t>(rng());
+    EXPECT_TRUE(wide(I128 {c}) == c);
+  }
+  EXPECT_GT(equal, 2000);
+}
+
+#if defined(__SIZEOF_INT128__)
+// The portable classes of test_int128.hpp (the test integer where the compiler has no built-in
+// 128-bit type) against the built-in type: every operation, the compound assignments included,
+// on operands of every magnitude, the signed and unsigned orders and the conversions. The signed
+// built-in sums and products are formed in the unsigned type (a signed overflow is undefined; the
+// classes wrap).
+TEST(PortableInt128, PortableClassesMatchTheBuiltInType) {
+  using B = unsigned __int128;
+  using BS = __int128;
+  using P = PortableUInt128;
+  using PS = PortableInt128;
+  auto to_p = [](B x) { return P::of_words(static_cast<std::uint64_t>(x >> 64), static_cast<std::uint64_t>(x)); };
+  auto same = [](P p, B x) { return p.high() == static_cast<std::uint64_t>(x >> 64) && p.low() == static_cast<std::uint64_t>(x); };
+  auto same_s = [&](PS p, BS x) { return same(static_cast<P>(p), static_cast<B>(x)); };
+  std::mt19937_64 rng(128);
+  // Words of every bit length, so carries, borrows, one-word and two-word operands all occur.
+  auto word = [&] { return rng() >> (rng() % 64); };
+  auto any = [&] {
+    const int shape = static_cast<int>(rng() % 4);
+    const std::uint64_t hi = shape == 0 ? 0 : (shape == 1 ? ~std::uint64_t {0} : word());
+    return (static_cast<B>(hi) << 64) | word();
+  };
+  int wide_divisors = 0;
+  for (int i = 0; i < 20000; ++i) {
+    const B x = any();
+    const B y = i % 5 == 0 ? static_cast<B>(1 + rng() % 16) : any();
+    const P a = to_p(x);
+    const P b = to_p(y);
+    ASSERT_TRUE(same(a + b, x + y) && same(a - b, x - y) && same(a * b, x * y)) << i;
+    ASSERT_TRUE(same(a | b, x | y) && same(a & b, x & y)) << i;
+    P t = a;  // the compound assignments, in sequence on one value
+    ASSERT_TRUE(same(t += b, x + y) && same(t -= b, x) && same(t *= b, x * y)) << i;
+    ASSERT_EQ(a == b, x == y);
+    ASSERT_EQ(a < b, x < y);
+    ASSERT_EQ(a <= b, x <= y);
+    const int s = static_cast<int>(rng() % 128);
+    ASSERT_TRUE(same(a << s, x << s) && same(a >> s, x >> s)) << i << " shift " << s;
+    if (y != 0) {
+      ASSERT_TRUE(same(a / b, x / y) && same(a % b, x % y)) << i;
+      P q = a;
+      ASSERT_TRUE(same(q /= b, x / y)) << i;
+      wide_divisors += (y >> 64) != 0 ? 1 : 0;  // the two-word long division
+    }
+    ASSERT_EQ(static_cast<std::uint64_t>(a), static_cast<std::uint64_t>(x));
+    ASSERT_EQ(static_cast<std::int32_t>(a), static_cast<std::int32_t>(x));
+    const auto bx = static_cast<BS>(x);
+    const auto by = static_cast<BS>(y);
+    const PS sa(a);
+    const PS sb(b);
+    ASSERT_TRUE(same_s(sa + sb, static_cast<BS>(x + y)) && same_s(sa - sb, static_cast<BS>(x - y)) &&
+                same_s(sa * sb, static_cast<BS>(x * y)) && same_s(-sa, static_cast<BS>(B {0} - x)))
+        << i;
+    PS st = sa;
+    ASSERT_TRUE(same_s(st += sb, static_cast<BS>(x + y)) && same_s(st -= sb, bx) &&
+                same_s(st *= sb, static_cast<BS>(x * y)))
+        << i;
+    ASSERT_EQ(sa == sb, bx == by);
+    ASSERT_EQ(sa < sb, bx < by);
+    ASSERT_EQ(sa > sb, bx > by);
+    const BS min = static_cast<BS>(B {1} << 127);
+    if (by != 0 && !(bx == min && by == -1)) {
+      ASSERT_TRUE(same_s(sa / sb, bx / by) && same_s(sa % sb, bx % by)) << i;
+    }
+    ASSERT_EQ(static_cast<std::int64_t>(sa), static_cast<std::int64_t>(bx));
+    const auto c = static_cast<std::int64_t>(rng()) >> (rng() % 64);
+    const auto u = rng() >> (rng() % 64);
+    ASSERT_TRUE(same_s(PS {c}, BS {c}) && same(P {c}, static_cast<B>(c)) && same(P {u}, B {u})) << i;
+    ASSERT_TRUE(same_s(PS {u}, BS {u}) && same_s(PS {static_cast<std::int32_t>(c)}, BS {static_cast<std::int32_t>(c)}));
+  }
+  EXPECT_GT(wide_divisors, 5000);
+}
+#endif
+
+// ------------------------------------------------------------------ the capture
+
+// The capture changes no field of the ordinary payload (every field, all six counters): cap 0
+// (no search), an infeasible positive cap, caps below, at and above the maximum, uncapped;
+// never-reached sentinels and the final failed tier included. Every captured state also passes
+// the state checks, whose reachability test must then say "reachable" for each state stopped
+// below the maximum.
+TEST(FlowCoreDeletion, CaptureLeavesTheFromZeroPayloadUnchanged) {
+  std::mt19937_64 rng(5);
+  int below_maximum = 0;
+  for (int trial = 0; trial < 250; ++trial) {
+    Case c = random_case(rng);
+    const auto ref = independent_curve(*c.g, c.view, c.sources, c.destinations, c.el());
+    const Amount fmax = ref.back().first;
+    for (std::optional<Amount> cap : {std::optional<Amount> {}, std::optional<Amount> {0},
+                                      std::optional<Amount> {fmax / 2}, std::optional<Amount> {fmax},
+                                      std::optional<Amount> {fmax + 3}}) {
+      c.cap = cap;
+      const auto plain = solve_min_cost_flow(*c.g, c.view, c.sources, c.destinations, c.el(), cap);
+      MinCostFlowResult with;
+      const auto req = capture_of(c, &with);
+      ASSERT_TRUE(same_payload(plain, with)) << "trial " << trial;
+      ASSERT_TRUE(req.state.has_value());
+      EXPECT_EQ(req.state->maximum(), !cap.has_value() || *cap >= fmax || fmax == 0) << "trial " << trial;
+      check_state(c, *req.state, with, "trial " + std::to_string(trial));
+      if (::testing::Test::HasFailure()) return;
+      below_maximum += req.state->maximum() ? 0 : 1;
+    }
+  }
+  // An infeasible positive cap: no path, the failed first tier.
+  Case none = make_case(3, {{0, 1, 2, 1}}, {0}, {2});
+  none.cap = 5;
+  const auto plain = solve_min_cost_flow(*none.g, none.view, none.sources, none.destinations, nullptr, none.cap);
+  MinCostFlowResult with;
+  const auto req = capture_of(none, &with);
+  EXPECT_TRUE(same_payload(plain, with));
+  EXPECT_EQ(with.flow_value, 0);
+  EXPECT_EQ(with.counters.dijkstra_runs, 1);
+  EXPECT_TRUE(req.state->maximum());
+  EXPECT_GT(below_maximum, 100);
+}
+
+// The shared equality helpers of test_utils.hpp compare every field: a copy with any one field
+// changed is unequal, a vector field both by one more entry and by its last entry's value (so a
+// helper comparing sizes only, or a prefix only, fails).
+TEST(TestHelpers, EqualityHelpersCompareEveryField) {
+  Case c = make_case(5, {{0, 1, 3, 3}, {0, 2, 1, 3}, {1, 2, 2, 7}, {2, 3, 1, 3}, {3, 1, 1, 2}}, {0}, {3});
+  MinCostFlowResult payload;
+  const auto req = capture_of(c, &payload);
+  ASSERT_TRUE(req.state.has_value());
+  const auto& st = *req.state;
+  ASSERT_GT(st.value(), 0);
+  const std::vector<std::function<void(MinCostFlowCounters&)>> counters = {
+      [](auto& x) { ++x.dijkstra_runs; }, [](auto& x) { ++x.dijkstra_pops; }, [](auto& x) { ++x.settled; },
+      [](auto& x) { ++x.arc_scans; },     [](auto& x) { ++x.dinic_phases; },  [](auto& x) { ++x.augmentations; },
+  };
+  for (std::size_t k = 0; k < counters.size(); ++k) {
+    auto x = payload.counters;
+    counters[k](x);
+    EXPECT_FALSE(same_counters(x, payload.counters)) << "counter " << k;
+  }
+  const std::vector<std::function<void(MinCostFlowResult&)>> payloads = {
+      [](auto& x) { ++x.flow_value; },
+      [](auto& x) { x.marginal_cost_curve.emplace_back(1, 1); },
+      [](auto& x) { ++x.marginal_cost_curve.back().first; },
+      [](auto& x) { ++x.marginal_cost_curve.back().second; },
+      [](auto& x) { x.edge_flows.push_back(0); },
+      [](auto& x) { ++x.edge_flows.back(); },
+      [](auto& x) { x.min_cut.reset(); },
+      [](auto& x) { x.min_cut->push_back(0); },
+      [](auto& x) { ++x.min_cut->back(); },
+      [](auto& x) { x.potentials.push_back(0); },
+      [](auto& x) { ++x.potentials.back(); },
+      [](auto& x) { ++x.counters.settled; },
+  };
+  ASSERT_TRUE(payload.min_cut.has_value() && !payload.min_cut->empty());
+  ASSERT_FALSE(payload.marginal_cost_curve.empty());
+  for (std::size_t k = 0; k < payloads.size(); ++k) {
+    auto x = payload;
+    payloads[k](x);
+    EXPECT_FALSE(same_payload(x, payload)) << "payload field " << k;
+  }
+  EdgeId carrying = 0;
+  while (st.edge_flows()[static_cast<std::size_t>(carrying)] == 0) ++carrying;
+  const auto result = DeletionResolver(st).resolve(carrying);
+  const std::vector<std::function<void(DeletionResult&)>> results = {
+      [](auto& x) { ++x.value; },
+      [](auto& x) { x.potentials.push_back(I128 {0}); },
+      [](auto& x) { x.potentials.back() += I128 {1}; },
+      [](auto& x) { x.min_cut.push_back(0); },
+      [](auto& x) { ++x.min_cut.back(); },
+      [](auto& x) { x.edge_flows.push_back(0); },
+      [](auto& x) { ++x.edge_flows.back(); },
+      [](auto& x) { ++x.counters.augmentations; },
+  };
+  ASSERT_FALSE(result.min_cut.empty());
+  for (std::size_t k = 0; k < results.size(); ++k) {
+    auto x = result;
+    results[k](x);
+    EXPECT_FALSE(same_result(x, result)) << "result field " << k;
+  }
+  const ResidualNetwork& net = st.network();
+  const std::vector<std::function<void(ResidualNetwork&)>> networks = {
+      [](auto& x) { ++x.num_nodes; },          [](auto& x) { x.edges.push_back(0); },
+      [](auto& x) { x.edge_sources.push_back(0); },    [](auto& x) { x.edge_destinations.push_back(0); },
+      [](auto& x) { x.cost.push_back(0); },    [](auto& x) { x.edge_capacities.push_back(0); },
+      [](auto& x) { x.sources.push_back(0); }, [](auto& x) { x.destinations.push_back(0); },
+      [](auto& x) { x.arc_offsets.push_back(0); },     [](auto& x) { x.arc_destinations.push_back(0); },
+      [](auto& x) { x.reverse_arcs.push_back(0); },     [](auto& x) { x.arc_cost.push_back(0); },
+      [](auto& x) { x.edge_forward_arcs.push_back(0); }, [](auto& x) { x.source_reverse_arcs.push_back(0); },
+      [](auto& x) { x.destination_forward_arcs.push_back(0); },
+      [](auto& x) { ++x.edges.back(); },        [](auto& x) { ++x.edge_sources.back(); },
+      [](auto& x) { ++x.edge_destinations.back(); },         [](auto& x) { ++x.cost.back(); },
+      [](auto& x) { ++x.edge_capacities.back(); },          [](auto& x) { ++x.sources.back(); },
+      [](auto& x) { ++x.destinations.back(); }, [](auto& x) { ++x.arc_offsets.back(); },
+      [](auto& x) { ++x.arc_destinations.back(); },     [](auto& x) { ++x.reverse_arcs.back(); },
+      [](auto& x) { ++x.arc_cost.back(); },     [](auto& x) { ++x.edge_forward_arcs.back(); },
+      [](auto& x) { ++x.source_reverse_arcs.back(); },      [](auto& x) { ++x.destination_forward_arcs.back(); },
+  };
+  for (std::size_t k = 0; k < networks.size(); ++k) {
+    ResidualNetwork x = net;
+    networks[k](x);
+    EXPECT_FALSE(same_network(x, net)) << "network field " << k;
+  }
+  EXPECT_TRUE(same_network(net, net));
+}
+
+// check_residual is not vacuous: a captured state passes it, and each mutation below breaks the
+// clause it names.
+TEST(FlowCoreDeletion, ResidualCheckRejectsEachBrokenClause) {
+  Case c = make_case(5, {{0, 1, 3, 3}, {0, 2, 1, 3}, {1, 2, 2, 7}, {2, 3, 1, 3}, {3, 1, 1, 2}}, {0}, {3});
+  const auto req = capture_of(c);
+  ASSERT_TRUE(req.state.has_value());
+  const auto& st = *req.state;
+  const ResidualNetwork& net = st.network();
+  const std::vector<Amount> res(st.residual().begin(), st.residual().end());
+  const std::vector<I128> pi(st.potentials().begin(), st.potentials().end());
+  const auto want =
+      divergences(net, {{net.num_nodes, st.value()}, {net.num_nodes + 1, -static_cast<Int128>(st.value())}});
+  const Int128 bound = (static_cast<Int128>(net.num_nodes) + 3) * cost_sum(*c.g);  // (n + 1) C, n = num_nodes + 2
+  auto check = [&](const std::vector<Amount>& r, const std::vector<I128>& p, std::size_t deleted = kNone) {
+    return check_residual(net, r, p, deleted, want, bound);
+  };
+  ASSERT_TRUE(check(res, pi).empty());
+  ASSERT_GT(st.value(), 0);
+  // An edge that carries flow: its backward arc is positive.
+  std::size_t k = 0;
+  while (k < net.edges.size() && res[static_cast<std::size_t>(net.reverse_arcs[static_cast<std::size_t>(net.edge_forward_arcs[k])])] == 0) {
+    ++k;
+  }
+  ASSERT_LT(k, net.edges.size());
+  const auto fwd = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+  const auto bwd = static_cast<std::size_t>(net.reverse_arcs[fwd]);
+  // One more unit on the forward arc: the pair exceeds the edge's capacity (the divergences read
+  // the backward arc only).
+  auto over = res;
+  ++over[fwd];
+  EXPECT_TRUE(has_failure(check(over, pi), "capacity bounds at edge " + std::to_string(net.edges[k])));
+  // One unit from the backward to the forward arc: the pair's sum holds, the edge carries one unit
+  // less, so its endpoints' divergences are off.
+  auto less = res;
+  --less[bwd];
+  ++less[fwd];
+  EXPECT_TRUE(has_failure(check(less, pi), "divergence vector"));
+  // A source's virtual pair no longer sums to kMaxFlowCap.
+  auto virt = res;
+  ++virt[static_cast<std::size_t>(net.source_reverse_arcs[0])];
+  EXPECT_TRUE(has_failure(check(virt, pi), "capacity bounds at a virtual arc"));
+  // The same residual read as if edge k were deleted: its arcs should be zero.
+  EXPECT_TRUE(has_failure(check(res, pi, k), "the deleted edge keeps a residual arc"));
+  // A positive real arc u -> v with pi(v) raised to pi(u) + cost + 1: reduced cost -1.
+  const auto tail = slot_tails(net);
+  std::size_t a = 0;
+  while (a < res.size() && (res[a] <= 0 || tail[a] >= net.num_nodes || net.arc_destinations[a] >= net.num_nodes)) ++a;
+  ASSERT_LT(a, res.size());
+  auto raised = pi;
+  raised[static_cast<std::size_t>(net.arc_destinations[a])] =
+      raised[static_cast<std::size_t>(tail[a])] + I128 {net.arc_cost[a] + 1};
+  EXPECT_TRUE(has_failure(check(res, raised), "negative reduced cost on slot " + std::to_string(a)));
+  // A potential below 0 and one above the bound.
+  auto low = pi;
+  low[1] = I128 {-1};
+  EXPECT_TRUE(has_failure(check(res, low), "potential outside [0, bound] at 1"));
+  auto high = pi;
+  high[1] = I128 {static_cast<std::int64_t>(bound) + 1};
+  EXPECT_TRUE(has_failure(check(res, high), "potential outside [0, bound] at 1"));
+  // Either array one entry too long (a zero residual entry, read by no other clause).
+  auto longer_res = res;
+  longer_res.push_back(0);
+  EXPECT_EQ(check(longer_res, pi), std::vector<std::string> {"shape"});
+  auto longer_pi = pi;
+  longer_pi.push_back(I128 {0});
+  EXPECT_EQ(check(res, longer_pi), std::vector<std::string> {"shape"});
+  // Each arc of a pair negative while the pair's sum holds: edge k's, then the source's virtual
+  // pair (the moved units also shift the divergences).
+  auto negative = [&](std::size_t x) {
+    auto r = res;
+    const auto y = static_cast<std::size_t>(net.reverse_arcs[x]);
+    r[y] += r[x] + 1;
+    r[x] = -1;
+    return r;
+  };
+  EXPECT_TRUE(has_failure(check(negative(fwd), pi), "capacity bounds at edge " + std::to_string(net.edges[k])));
+  EXPECT_TRUE(has_failure(check(negative(bwd), pi), "capacity bounds at edge " + std::to_string(net.edges[k])));
+  const auto src_arc = static_cast<std::size_t>(net.source_reverse_arcs[0]);
+  EXPECT_TRUE(has_failure(check(negative(src_arc), pi), "capacity bounds at a virtual arc"));
+  EXPECT_TRUE(has_failure(check(negative(static_cast<std::size_t>(net.reverse_arcs[src_arc])), pi),
+                          "capacity bounds at a virtual arc"));
+  // Read as deleted, edge k with only its forward arc, then only its backward arc, positive.
+  for (const bool forward : {true, false}) {
+    auto kept = res;
+    kept[fwd] = forward ? 1 : 0;
+    kept[bwd] = forward ? 0 : 1;
+    EXPECT_TRUE(has_failure(check(kept, pi, k), "the deleted edge keeps a residual arc")) << forward;
+  }
+  // A positive virtual arc with its head's potential raised by its cost + 1 over its tail's.
+  std::size_t b = 0;
+  while (b < res.size() && (res[b] <= 0 || (tail[b] < net.num_nodes && net.arc_destinations[b] < net.num_nodes))) ++b;
+  ASSERT_LT(b, res.size());
+  auto raised_virtual = pi;
+  raised_virtual[static_cast<std::size_t>(net.arc_destinations[b])] =
+      raised_virtual[static_cast<std::size_t>(tail[b])] + I128 {net.arc_cost[b] + 1};
+  EXPECT_TRUE(
+      has_failure(check(res, raised_virtual), "negative reduced cost on slot " + std::to_string(b) + " (virtual)"));
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+namespace {
+
+// Captures c with the independent iterative all-vertex update beside: after every search, each
+// vertex by its distance or, unreached, by the search's largest finite distance, from 0.
+DeletionCapture capture_iterative(const Case& c, std::vector<Int128>& pi, int& searches) {
+  pi.assign(static_cast<std::size_t>(c.g->num_nodes()) + 2, 0);
+  searches = 0;
+  DeletionCapture req;
+  req.graph = c.g;
+  req.on_search = [&](std::span<const Cost> d) {
+    Cost top = 0;
+    for (Cost x : d) {
+      if (x != std::numeric_limits<Cost>::max()) top = std::max(top, x);
+    }
+    for (std::size_t v = 0; v < d.size(); ++v) pi[v] += d[v] != std::numeric_limits<Cost>::max() ? d[v] : top;
+    ++searches;
+  };
+  (void)solve_min_cost_flow(*c.g, c.view, c.sources, c.destinations, c.el(), c.cap, &req);
+  return req;
+}
+
+} // namespace
+#endif
+
+// The running-sum checkpoints equal the iterative all-vertex update exactly, real and virtual
+// vertices, a final failed search, never-settled vertices and the no-search cap-zero case
+// included; a common offset keeps every reduced cost valid and fails this convention check.
+TEST(FlowCoreDeletion, CheckpointsEqualTheIterativeUpdate) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  std::mt19937_64 rng(17);
+  int several = 0;
+  for (int trial = 0; trial < 300; ++trial) {
+    Case c = random_case(rng);
+    const Amount fmax = independent_curve(*c.g, c.view, c.sources, c.destinations, c.el()).back().first;
+    for (std::optional<Amount> cap : {std::optional<Amount> {}, std::optional<Amount> {0},
+                                      std::optional<Amount> {fmax / 2}, std::optional<Amount> {fmax + 1}}) {
+      c.cap = cap;
+      std::vector<Int128> pi;
+      int searches = 0;
+      const auto req = capture_iterative(c, pi, searches);
+      const auto& st = *req.state;
+      ASSERT_EQ(st.potentials().size(), pi.size());
+      for (std::size_t v = 0; v < pi.size(); ++v) ASSERT_TRUE(wide(st.potentials()[v]) == pi[v]) << trial << " " << v;
+      EXPECT_EQ(searches, st.counters().dijkstra_runs);
+      if (cap == 0) EXPECT_EQ(searches, 0);
+      several += searches >= 2 ? 1 : 0;  // a running sum of more than one search
+    }
+  }
+  EXPECT_GT(several, 150);
+  // The common-offset mutant: valid reduced costs, the wrong convention.
+  Case c = make_case(5, {{0, 1, 3, 3}, {0, 2, 1, 3}, {1, 2, 2, 7}, {2, 3, 1, 3}, {3, 1, 1, 2}}, {0}, {3});
+  std::vector<Int128> pi;
+  int searches = 0;
+  const auto req = capture_iterative(c, pi, searches);
+  const auto& st = *req.state;
+  std::vector<I128> shifted(st.potentials().begin(), st.potentials().end());
+  for (auto& p : shifted) p += 1000;
+  const ResidualNetwork& net = st.network();
+  const auto want =
+      divergences(net, {{net.num_nodes, st.value()}, {net.num_nodes + 1, -static_cast<Int128>(st.value())}});
+  EXPECT_TRUE(check_residual(net, st.residual(), shifted, kNone, want, cost_sum(*c.g) * 1000).empty());
+  bool same = true;
+  for (std::size_t v = 0; v < pi.size(); ++v) same = same && wide(shifted[v]) == pi[v];
+  EXPECT_FALSE(same);
+#else
+  GTEST_SKIP() << "needs the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS)";
+#endif
+}
+
+// ------------------------------------------------------------------ random views
+
+TEST(FlowCoreDeletion, EveryEdgeOfRandomViewsAgreesWithAFreshSolve) {
+  std::mt19937_64 rng(3005);
+  int deletions = 0, masked = 0, several = 0, scaled = 0, rerouted = 0, partial = 0, cut = 0, capped = 0;
+  for (int trial = 0; trial < 700; ++trial) {
+    Case c = random_case(rng);
+    const Amount fmax = independent_curve(*c.g, c.view, c.sources, c.destinations, c.el()).back().first;
+    // Uncapped, and positive caps at and above the independently established maximum.
+    for (std::optional<Amount> cap : {std::optional<Amount> {}, std::optional<Amount> {std::max<Amount>(fmax, 1)},
+                                      std::optional<Amount> {fmax + 2}}) {
+      c.cap = cap;
+      capped += cap.has_value() && *cap == fmax && fmax > 0 ? 1 : 0;
+      check_every_edge(c, "trial " + std::to_string(trial));
+      if (::testing::Test::HasFailure()) return;
+    }
+    const auto req = capture_of(c);
+    const auto& st = *req.state;
+    for (const EdgeId e : positive_edges(st)) {
+      ++deletions;
+      const auto result = DeletionResolver(st).resolve(e);
+      const Amount flow = st.edge_flows()[static_cast<std::size_t>(e)];
+      const Amount lost = st.value() - result.value;
+      masked += c.elig.has_value() && c.elig->uid() != 0 ? 1 : 0;
+      several += c.sources.size() > 1 || c.destinations.size() > 1 ? 1 : 0;
+      scaled += c.g->max_edge_cost() > 1000000 ? 1 : 0;
+      rerouted += lost == 0 ? 1 : 0;
+      partial += lost > 0 && lost < flow ? 1 : 0;
+      cut += lost == flow ? 1 : 0;
+    }
+  }
+  EXPECT_GT(deletions, 600);
+  EXPECT_GT(masked, 30);
+  EXPECT_GT(several, 100);
+  EXPECT_GT(scaled, 20);
+  EXPECT_GT(rerouted, 10);
+  EXPECT_GT(partial, 2);
+  EXPECT_GT(cut, 100);
+  EXPECT_GT(capped, 100);
+}
+
+// Deliberately damaged answers must trip each of the final-result certificate's clauses.
+TEST(FlowCoreDeletion, CertificateRejectsDamagedAnswers) {
+  Case c = make_case(4, {{0, 1, 3, 1}, {1, 3, 3, 1}, {0, 2, 3, 3}, {2, 3, 3, 1},
+                          {0, 3, 1, 9}, {2, 2, 1, 7}}, {0}, {3});
+  const auto ids = id_of_input(*c.g);
+  c.elig = c.g->eligibility({}, std::vector<EdgeId> {ids[5]});
+  const auto captured = capture_of(c);
+  const auto& st = *captured.state;
+  const EdgeId deleted = ids[4];
+  const auto good = DeletionResolver(st).resolve(deleted);
+  ASSERT_EQ(good.value, 6);
+  EXPECT_EQ(failures_of([&] { expect_deletion(c, st, deleted, good, "good"); }), 0);
+  auto rejects = [&](const DeletionResult& bad, const std::vector<std::string>& clauses) {
+    ::testing::TestPartResultArray results;
+    {
+      ::testing::ScopedFakeTestPartResultReporter capture(
+          ::testing::ScopedFakeTestPartResultReporter::INTERCEPT_ONLY_CURRENT_THREAD, &results);
+      expect_deletion(c, st, deleted, bad, "damaged");
+    }
+    for (const auto& clause : clauses) {
+      bool found = false;
+      for (int i = 0; i < results.size(); ++i) {
+        found = found || std::string(results.GetTestPartResult(i).message()).find(clause) != std::string::npos;
+      }
+      EXPECT_TRUE(found) << "missing certificate failure: " << clause;
+    }
+  };
+  auto bad = good;
+  bad.edge_flows.pop_back();
+  rejects(bad, {"r.edge_flows.size()"});
+  bad = good;
+  bad.edge_flows[static_cast<std::size_t>(deleted)] = 1;
+  rejects(bad, {"r.edge_flows[x] >= 0", "r.edge_flows[static_cast<std::size_t>(e)]",
+                "flow_cost(*c.g, r.edge_flows) == flow_cost(*c.g, fresh.edge_flows)",
+                "flow_cost(*c.g, r.edge_flows) == ref.back().second"});
+  bad = good;
+  bad.edge_flows[static_cast<std::size_t>(ids[5])] = 1;
+  rejects(bad, {"r.edge_flows[x]"});
+  bad = good;
+  ++bad.value;
+  rejects(bad, {"fresh.flow_value", "ref.back().first", "cut_value"});
+  bad = good;
+  bad.min_cut.clear();
+  rejects(bad, {"*fresh.min_cut", "closure_cut(net, res, k)"});
+  bad = good;
+  std::fill(bad.edge_flows.begin(), bad.edge_flows.end(), 0);
+  rejects(bad, {"connected(net, res)", "final:"});
+}
+
+// ------------------------------------------------------------------ hand-built examples
+
+// Repair 1 reroutes everything (m = f, r = 0): u -> w -> v replaces u -> v.
+TEST(FlowCoreDeletion, FullRepairOneReroute) {
+  const Case c = make_case(5, {{0, 1, 1, 1}, {1, 2, 1, 1}, {1, 3, 1, 5}, {3, 2, 1, 5}, {2, 4, 1, 1}}, {0}, {4});
+  check_every_edge(c, "full reroute");
+  const auto req = capture_of(c);
+  const EdgeId uv = id_of_input(*c.g)[1];
+  const auto r = DeletionResolver(*req.state).resolve(uv);
+  EXPECT_EQ(r.value, 1);
+  EXPECT_TRUE(flow_cost(*c.g, r.edge_flows) == 12);
+  EXPECT_EQ(r.counters.dijkstra_runs, 1);
+}
+
+// No reroute (m = 0, r = 1): deleting the sole unit-capacity source-to-destination edge takes
+// exactly two Dijkstra runs.
+TEST(FlowCoreDeletion, SoleEdgeTakesTwoSearches) {
+  const Case c = make_case(2, {{0, 1, 1, 1}}, {0}, {1});
+  check_every_edge(c, "sole edge");
+  const auto req = capture_of(c);
+  DeletionResolver rs(*req.state);
+  const auto r = rs.resolve(0);
+  EXPECT_EQ(r.value, 0);
+  EXPECT_EQ(r.counters.dijkstra_runs, 2);
+  // The run bound of check_deletion (m + 2 r = 2 here) holds, and each of its two clauses reports
+  // a result that breaks it.
+  EXPECT_EQ(run_bound_failure(*req.state, 1, r), "");
+  DeletionResult gained = r;
+  gained.value = req.state->value() + 1;
+  EXPECT_EQ(run_bound_failure(*req.state, 1, gained), "the re-solve gained value");
+  DeletionResult slower = r;
+  ++slower.counters.dijkstra_runs;
+  EXPECT_EQ(run_bound_failure(*req.state, 1, slower), "more Dijkstra runs than m + 2 r");
+}
+
+// The same deletion through the probe, with the control that reruns repair 1's failed search
+// instead of reusing it: three searches, failing the m + 2 r = 2 bound, with the same flow,
+// potentials, phases and paths; the reuse skips exactly that search's work.
+TEST(FlowCoreDeletion, RerunningTheFailedSearchAddsExactlyOneSearch) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const Case c = make_case(2, {{0, 1, 1, 1}}, {0}, {1});
+  const auto req = capture_of(c);
+  DeletionResolver rs(*req.state);
+  std::vector<std::string> fails;
+  std::vector<std::pair<int, MinCostFlowCounters>> reuse_updates;
+  std::vector<std::pair<int, MinCostFlowCounters>> rerun_updates;
+  const auto a = observed(rs, *req.state, 0, fails, false, &reuse_updates);
+  const auto b = observed(rs, *req.state, 0, fails, true, &rerun_updates);
+  for (const auto& s : fails) ADD_FAILURE() << s;
+  EXPECT_EQ(a.counters.dijkstra_runs, 2);
+  EXPECT_EQ(b.counters.dijkstra_runs, 3);
+  // m + 2 r = 2: the bound check of check_deletion accepts the reuse and rejects the control.
+  EXPECT_EQ(run_bound_failure(*req.state, 1, a), "");
+  EXPECT_EQ(run_bound_failure(*req.state, 1, b), "more Dijkstra runs than m + 2 r");
+  EXPECT_EQ(a.edge_flows, b.edge_flows);
+  EXPECT_EQ(a.potentials, b.potentials);
+  EXPECT_EQ(a.min_cut, b.min_cut);
+  EXPECT_EQ(a.counters.dinic_phases, b.counters.dinic_phases);
+  EXPECT_EQ(a.counters.augmentations, b.counters.augmentations);
+  // The control's extra search: the counters between repair 1's last update and repair 2's
+  // first (no Dinic work between them).
+  ASSERT_EQ(rerun_updates.size(), reuse_updates.size() + 1);
+  const auto first_of_2 =
+      std::find_if(rerun_updates.begin(), rerun_updates.end(), [](const auto& u) { return u.first == 2; });
+  ASSERT_NE(first_of_2, rerun_updates.end());
+  ASSERT_NE(first_of_2, rerun_updates.begin());
+  const auto& before = std::prev(first_of_2)->second;
+  const auto& after = first_of_2->second;
+  EXPECT_EQ(after.dinic_phases, before.dinic_phases);
+  EXPECT_EQ(after.augmentations, before.augmentations);
+  EXPECT_EQ(b.counters.dijkstra_runs - (after.dijkstra_runs - before.dijkstra_runs), a.counters.dijkstra_runs);
+  EXPECT_EQ(b.counters.dijkstra_pops - (after.dijkstra_pops - before.dijkstra_pops), a.counters.dijkstra_pops);
+  EXPECT_EQ(b.counters.settled - (after.settled - before.settled), a.counters.settled);
+  EXPECT_EQ(b.counters.arc_scans - (after.arc_scans - before.arc_scans), a.counters.arc_scans);
+  EXPECT_GT(after.settled - before.settled, 0);
+#else
+  GTEST_SKIP() << "needs the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS)";
+#endif
+}
+
+// Repair 1 moves part (m = 1 of f = 2); the remainder 1 goes back to s* and then from t* to v.
+TEST(FlowCoreDeletion, PartialRerouteThenBothRemainderPushes) {
+  const Case c = make_case(5, {{0, 1, 2, 1}, {1, 2, 2, 1}, {1, 3, 1, 2}, {3, 2, 1, 2}, {2, 4, 2, 1}}, {0}, {4});
+  check_every_edge(c, "partial reroute");
+  const auto req = capture_of(c);
+  const EdgeId uv = id_of_input(*c.g)[1];
+  ASSERT_EQ(req.state->edge_flows()[static_cast<std::size_t>(uv)], 2);
+  const auto r = DeletionResolver(*req.state).resolve(uv);
+  EXPECT_EQ(r.value, 1);  // r = 1, m = 1
+  EXPECT_TRUE(flow_cost(*c.g, r.edge_flows) == 6);
+  EXPECT_LE(r.counters.dijkstra_runs, 1 + 2 * 1);
+}
+
+// Every cost times a factor: each re-solve of the scaled graph passes the independent checks, and
+// against the unscaled one its working potentials scale while its value, flows, cut and operation
+// counters do not (every search meets the same keys in the same order).
+TEST(FlowCoreDeletion, ScalingEveryCostScalesOnlyThePotentials) {
+  const std::vector<InEdge> edges = {{0, 1, 2, 1}, {1, 2, 2, 1}, {1, 3, 1, 2}, {3, 2, 1, 2}, {2, 4, 2, 1}, {0, 3, 1, 5}};
+  const Case base = make_case(5, edges, {0}, {4});
+  const auto base_req = capture_of(base);
+  int compared = 0;
+  for (Cost factor : {3, 1000003}) {
+    std::vector<InEdge> scaled_edges = edges;
+    for (auto& e : scaled_edges) e.cost *= factor;
+    const Case scaled = make_case(5, scaled_edges, {0}, {4});
+    check_every_edge(scaled, "factor " + std::to_string(factor));
+    const auto req = capture_of(scaled);
+    for (EdgeId e : base_req.state->network().edges) {
+      if (base_req.state->edge_flows()[static_cast<std::size_t>(e)] == 0) continue;
+      const auto want = DeletionResolver(*base_req.state).resolve(e);
+      const auto got = DeletionResolver(*req.state).resolve(e);
+      const std::string where = "factor " + std::to_string(factor) + " edge " + std::to_string(e);
+      EXPECT_EQ(got.value, want.value) << where;
+      EXPECT_EQ(got.edge_flows, want.edge_flows) << where;
+      EXPECT_EQ(got.min_cut, want.min_cut) << where;
+      ASSERT_EQ(got.potentials.size(), want.potentials.size()) << where;
+      for (std::size_t v = 0; v < want.potentials.size(); ++v) {
+        EXPECT_TRUE(wide(got.potentials[v]) == wide(want.potentials[v]) * factor) << where << " vertex " << v;
+      }
+      EXPECT_TRUE(same_counters(got.counters, want.counters)) << where;
+      ++compared;
+    }
+  }
+  // Both units take 0 -> 1 -> 2 -> 4 (cost 3; 2 -> 4 caps the value at 2): three positive-flow
+  // edges, for each factor.
+  EXPECT_EQ(compared, 6);
+}
+
+// Total loss: a bridge carrying every unit.
+TEST(FlowCoreDeletion, TotalLoss) {
+  const Case c = make_case(3, {{0, 1, 3, 1}, {1, 2, 2, 1}, {1, 2, 1, 3}}, {0}, {2});
+  check_every_edge(c, "total loss");
+  const auto req = capture_of(c);
+  const auto r = DeletionResolver(*req.state).resolve(id_of_input(*c.g)[0]);
+  EXPECT_EQ(r.value, 0);
+  EXPECT_TRUE(r.min_cut.empty());
+}
+
+// Zero-flow deletions with positive view capacity (the deletion changes the canonical cut, not
+// the value) and with zero view capacity (an arc crossing the closure without capacity).
+TEST(FlowCoreDeletion, ZeroFlowDeletions) {
+  const Case positive = make_case(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}, {0, 2, 1, 3}}, {0}, {3});
+  check_every_edge(positive, "zero flow, positive capacity");
+  const EdgeId spare = id_of_input(*positive.g)[3];
+  const auto req = capture_of(positive);
+  EXPECT_EQ(req.state->edge_flows()[static_cast<std::size_t>(spare)], 0);
+  MinCostFlowResult base;
+  (void)capture_of(positive, &base);
+  const auto fresh = fresh_without(positive, spare);
+  ASSERT_TRUE(base.min_cut.has_value() && fresh.min_cut.has_value());
+  EXPECT_NE(*base.min_cut, *fresh.min_cut);
+  const Case zero = make_case(2, {{0, 1, 0, 1}}, {0}, {1});
+  check_every_edge(zero, "zero view capacity");
+  const auto zreq = capture_of(zero);
+  EXPECT_TRUE(zreq.state->maximum());
+  EXPECT_EQ(zreq.state->value(), 0);
+}
+
+// Parallel equal-cost ties: the re-solve's flow differs from the fresh solve's, its value, cost
+// and cut do not.
+TEST(FlowCoreDeletion, TiedFlowsDifferValueCostAndCutAgree) {
+  const Case c = make_case(3, {{0, 1, 1, 2}, {0, 1, 2, 3}, {1, 2, 1, 1}, {1, 2, 1, 1}}, {0}, {2});
+  check_every_edge(c, "ties");
+  const auto req = capture_of(c);
+  const EdgeId dear = id_of_input(*c.g)[1];
+  const auto r = DeletionResolver(*req.state).resolve(dear);
+  const auto fresh = fresh_without(c, dear);
+  EXPECT_EQ(r.edge_flows, (std::vector<Amount> {1, 0, 0, 1}));
+  EXPECT_EQ(fresh.edge_flows, (std::vector<Amount> {1, 0, 1, 0}));
+  EXPECT_EQ(r.value, 1);
+  EXPECT_TRUE(flow_cost(*c.g, r.edge_flows) == 3);
+  ASSERT_TRUE(fresh.min_cut.has_value());
+  EXPECT_EQ(r.min_cut, *fresh.min_cut);
+  EXPECT_EQ(r.min_cut, (std::vector<EdgeId> {0}));
+}
+
+// Several sources and destinations; edges out of a source, into a destination and between
+// endpoints; masked endpoints; vertices no search reaches.
+TEST(FlowCoreDeletion, EndpointsMasksAndUnreachedVertices) {
+  Case c = make_case(8,
+                     {{0, 2, 2, 1}, {1, 2, 1, 2}, {2, 4, 2, 1}, {2, 5, 2, 3}, {1, 5, 1, 7}, {0, 4, 1, 9},
+                      {4, 5, 1, 1}, {3, 6, 4, 1}, {6, 7, 4, 1}, {5, 2, 1, 1}},
+                     {0, 1, 3}, {4, 5});
+  // Each configuration re-solves at least one deletion (its flow is positive).
+  int resolved = 0;
+  check_every_edge(c, "endpoints", &resolved);
+  EXPECT_GT(resolved, 0);
+  c.elig = c.g->eligibility(std::vector<NodeId> {1}, std::vector<EdgeId> {});
+  resolved = 0;
+  check_every_edge(c, "masked source", &resolved);
+  EXPECT_GT(resolved, 0);
+  c.elig = c.g->eligibility(std::vector<NodeId> {4}, std::vector<EdgeId> {id_of_input(*c.g)[3]});
+  resolved = 0;
+  check_every_edge(c, "masked destination and edge", &resolved);
+  EXPECT_GT(resolved, 0);
+}
+
+// A near-domain cost witness: H = 2^61 and a cost sum H + 11
+// below 2^62; the working potentials exceed int64 after the deletion, vertex 4 is never
+// reached (the published sentinel, a numeric working potential).
+TEST(FlowCoreDeletion, NearDomainCostsNeedWideWorkingPotentials) {
+  const Cost H = Cost {1} << 61;
+  const Case c = make_case(5, {{0, 1, 3, 3}, {0, 2, 1, 3}, {1, 2, 2, H}, {2, 3, 1, 3}, {3, 1, 1, 2}}, {0}, {3});
+  ASSERT_TRUE(cost_sum(*c.g) == static_cast<Int128>(H) + 11);
+  MinCostFlowResult payload;
+  const auto req = capture_of(c, &payload);
+  const auto& st = *req.state;
+  EXPECT_EQ(payload.potentials[4], kNeverReached);
+  const std::vector<Int128> base {0, 3, static_cast<Int128>(H) + 3, static_cast<Int128>(H) + 6,
+                                    static_cast<Int128>(H) + 6, 0, static_cast<Int128>(H) + 6};
+  for (std::size_t v = 0; v < base.size(); ++v) EXPECT_TRUE(wide(st.potentials()[v]) == base[v]) << v;
+  const EdgeId e = id_of_input(*c.g)[3];
+  check_deletion(c, st, e, "near domain");
+  const auto r = DeletionResolver(st).resolve(e);
+  const Int128 h = H;
+  const std::vector<Int128> after {3 * h + 5, 2 * h + 8, 3 * h + 8, 2 * h + 6, 4 * h + 11, 3 * h + 5, 2 * h + 6};
+  for (std::size_t v = 0; v < after.size(); ++v) EXPECT_TRUE(wide(r.potentials[v]) == after[v]) << v;
+  EXPECT_TRUE(wide(r.potentials[4]) > std::numeric_limits<std::int64_t>::max());
+}
+
+// The precondition: a state stopped by a cap below the maximum with a residual path left is
+// rejected before any change; maximum states (uncapped, cap at the maximum) are accepted.
+TEST(FlowCoreDeletion, OnlyMaximumStatesAreAccepted) {
+  Case c = make_case(2, {{0, 1, 1, 1}, {0, 1, 3, 2}}, {0}, {1});
+  c.cap = 1;
+  const auto req = capture_of(c);
+  ASSERT_FALSE(req.state->maximum());
+  DeletionResolver rs(*req.state);
+  const EdgeId cheap = id_of_input(*c.g)[0];
+  // Rejected before any repair (the resolver works on its own copy of the state).
+  EXPECT_EQ(error_of([&] { (void)rs.resolve(cheap); }),
+            "deletion re-solve: the state is not certified maximum (a residual path from the sources to the "
+            "destinations remains)");
+  for (std::optional<Amount> cap : {std::optional<Amount> {}, std::optional<Amount> {4}}) {
+    c.cap = cap;
+    const auto ok = capture_of(c);
+    ASSERT_TRUE(ok.state->maximum());
+    EXPECT_EQ(DeletionResolver(*ok.state).resolve(cheap).value, 3);
+  }
+  // Not an edge of the view (excluded by the Eligibility), and an empty state (an edge of the
+  // view that carries no flow: check_every_edge).
+  c.cap = std::nullopt;
+  c.elig = c.g->eligibility(std::vector<NodeId> {}, std::vector<EdgeId> {cheap});
+  const auto masked = capture_of(c);
+  DeletionResolver reused(*masked.state);
+  EXPECT_EQ(error_of([&] { (void)reused.resolve(cheap); }),
+            "deletion re-solve: edge 0 is not in the solve's view");
+  const EdgeId allowed = id_of_input(*c.g)[1];
+  EXPECT_TRUE(same_result(reused.resolve(allowed), DeletionResolver(*masked.state).resolve(allowed)));
+  EXPECT_EQ(error_of([] { DeletionResolver {DeletionState {}}; }),
+            "deletion re-solve: an empty state (no solve captured it)");
+}
+
+// ------------------------------------------------------------------ the saved state
+
+// A saved state survives another solve on the same thread and serves candidates A, B, A: it
+// never changes and both A results (flow, certificates, counters) agree, on 1, 2 and 4 threads
+// each with its own resolver over one shared state.
+TEST(FlowCoreDeletion, ASavedStateServesCandidatesIndependently) {
+  std::mt19937_64 rng(29);
+  int checked = 0;
+  for (int trial = 0; trial < 400 && checked < 20; ++trial) {
+    const Case c = random_case(rng);
+    const auto req = capture_of(c);
+    const DeletionState& st = *req.state;
+    const std::vector<EdgeId> positive = positive_edges(st);
+    if (positive.size() < 2) continue;
+    ++checked;
+    const std::vector<Amount> res0(st.residual().begin(), st.residual().end());
+    const std::vector<I128> pi0(st.potentials().begin(), st.potentials().end());
+    const DeletionState copy = st;  // a copy shares the network only
+    const Case other = random_case(rng);
+    (void)solve_min_cost_flow(*other.g, other.view, other.sources, other.destinations, other.el(), std::nullopt);
+    const EdgeId A = positive.front();
+    const EdgeId B = positive.back();
+    DeletionResolver one(copy);
+    const auto a1 = one.resolve(A);
+    const auto b1 = one.resolve(B);
+    const auto a2 = one.resolve(A);
+    EXPECT_TRUE(same_result(a1, a2)) << trial;
+    EXPECT_EQ(b1.value, DeletionResolver(st).resolve(B).value) << trial;
+    for (int threads : {2, 4}) {
+      std::vector<DeletionResolver> resolvers;
+      for (int t = 0; t < threads; ++t) resolvers.emplace_back(st);
+      std::vector<std::vector<DeletionResult>> got(static_cast<std::size_t>(threads));
+      std::vector<std::thread> pool;
+      for (int t = 0; t < threads; ++t) {
+        pool.emplace_back([&, t] {
+          auto& rs = resolvers[static_cast<std::size_t>(t)];
+          auto& out = got[static_cast<std::size_t>(t)];
+          out.push_back(rs.resolve(A));
+          out.push_back(rs.resolve(B));
+          out.push_back(rs.resolve(A));
+        });
+      }
+      for (auto& th : pool) th.join();
+      for (const auto& out : got) {
+        EXPECT_TRUE(same_result(out[0], a1) && same_result(out[2], a1) && same_result(out[1], b1))
+            << trial << " threads " << threads;
+      }
+    }
+    EXPECT_EQ(std::vector<Amount>(st.residual().begin(), st.residual().end()), res0) << trial;
+    EXPECT_EQ(std::vector<I128>(st.potentials().begin(), st.potentials().end()), pi0) << trial;
+    EXPECT_EQ(std::vector<Amount>(copy.residual().begin(), copy.residual().end()), res0) << trial;
+    EXPECT_EQ(&copy.network(), &st.network());
+  }
+  EXPECT_EQ(checked, 20);
+}
+
+namespace {
+
+// Whether a re-solve of e agrees with a solve from zero on the view without e: the value, the
+// cost and the minimum cut (independent of the resolver).
+bool matches_fresh_solve(const Case& c, EdgeId e, const DeletionResult& r) {
+  const auto fresh = fresh_without(c, e);
+  return r.value == fresh.flow_value && flow_cost(*c.g, r.edge_flows) == flow_cost(*c.g, fresh.edge_flows) &&
+         fresh.min_cut.has_value() && r.min_cut == *fresh.min_cut;
+}
+
+} // namespace
+
+// A resolver reads its state's network in place, so the network must live as
+// long as the resolver by the resolver's own copy of the state. Built from a copy that then goes
+// away with the capture request, moved by construction, by the reallocations of a growing vector
+// and by an assignment over a resolver of another state (which drops that resolver's share of the
+// other network; the network goes with the last of grow's resolvers), and after a solve of another
+// network on the same thread, it serves every candidate twice, in reverse and in order, exactly as
+// a resolver that never moved, whose results agree with solves from zero. AddressSanitizer
+// reports a read of a released network.
+TEST(FlowCoreDeletion, AResolverKeepsItsNetworkAliveAcrossMoves) {
+  std::mt19937_64 rng(31);
+  int checked = 0;
+  for (int trial = 0; trial < 400 && checked < 20; ++trial) {
+    const Case c = random_case(rng);
+    std::vector<EdgeId> positive;
+    std::vector<DeletionResult> want;
+    std::optional<DeletionResolver> kept;
+    {
+      auto req = capture_of(c);
+      ASSERT_TRUE(req.state->maximum()) << "trial " << trial;  // random_case sets no cap
+      positive = positive_edges(*req.state);
+      if (positive.empty()) continue;
+      {
+        DeletionResolver still(*req.state);
+        for (EdgeId e : positive) want.push_back(still.resolve(e));
+      }
+      for (std::size_t i = 0; i < positive.size(); ++i) {
+        EXPECT_TRUE(matches_fresh_solve(c, positive[i], want[i])) << "trial " << trial << " edge " << positive[i];
+      }
+      auto copy = std::make_unique<DeletionState>(*req.state);
+      req.state = std::nullopt;
+      kept.emplace(*copy);
+    }  // the copy and the request are gone: the resolver's state is the network's only owner
+    ++checked;
+    const Case other = random_case(rng);
+    auto other_req = capture_of(other);  // rebuilds this thread's solver for another network
+    std::vector<DeletionResolver> grow;
+    grow.emplace_back(std::move(*kept));
+    kept = std::nullopt;
+    for (int i = 0; i < 6; ++i) grow.emplace_back(*other_req.state);  // reallocations move grow[0]
+    DeletionResolver target(*other_req.state);
+    other_req.state = std::nullopt;
+    target = std::move(grow.front());
+    grow.clear();  // the other network's last owners go
+    for (std::size_t i = positive.size(); i-- > 0;) {
+      EXPECT_TRUE(same_result(target.resolve(positive[i]), want[i])) << "trial " << trial << " edge " << positive[i];
+    }
+    for (std::size_t i = 0; i < positive.size(); ++i) {
+      EXPECT_TRUE(same_result(target.resolve(positive[i]), want[i])) << "trial " << trial << " edge " << positive[i];
+    }
+  }
+  EXPECT_EQ(checked, 20);
+}
+
+// Resolvers of one state on 1, 2 and 4 threads read the one network the state
+// copies share and never write it; each keeps its own residual, potentials and scratch. Each
+// thread runs every candidate in its own rotation of the order, twice; every result equals the
+// single-thread one (which agrees with a solve from zero), and the network equals its deep copy
+// taken before, field by field.
+// ThreadSanitizer checks the concurrent reads.
+TEST(FlowCoreDeletion, WorkersReadOneNetworkAndNeverWriteIt) {
+  std::mt19937_64 rng(37);
+  int checked = 0;
+  for (int trial = 0; trial < 400 && checked < 15; ++trial) {
+    const Case c = random_case(rng);
+    const auto req = capture_of(c);
+    const DeletionState& st = *req.state;
+    ASSERT_TRUE(st.maximum()) << "trial " << trial;  // random_case sets no cap
+    const auto positive = positive_edges(st);
+    if (positive.size() < 2) continue;
+    ++checked;
+    const ResidualNetwork before = st.network();
+    std::vector<DeletionResult> want;
+    for (EdgeId e : positive) {
+      want.push_back(DeletionResolver(st).resolve(e));
+      EXPECT_TRUE(matches_fresh_solve(c, e, want.back())) << trial << " edge " << e;
+    }
+    for (int threads : {1, 2, 4}) {
+      std::vector<DeletionResolver> resolvers;
+      for (int t = 0; t < threads; ++t) resolvers.emplace_back(st);
+      std::vector<int> wrong(static_cast<std::size_t>(threads), 0);
+      std::vector<std::thread> pool;
+      for (int t = 0; t < threads; ++t) {
+        pool.emplace_back([&, t] {
+          auto& rs = resolvers[static_cast<std::size_t>(t)];
+          for (int round = 0; round < 2; ++round) {
+            for (std::size_t j = 0; j < positive.size(); ++j) {
+              const std::size_t i = (j + static_cast<std::size_t>(t)) % positive.size();
+              if (!same_result(rs.resolve(positive[i]), want[i])) ++wrong[static_cast<std::size_t>(t)];
+            }
+          }
+        });
+      }
+      for (auto& th : pool) th.join();
+      for (int t = 0; t < threads; ++t) EXPECT_EQ(wrong[static_cast<std::size_t>(t)], 0) << trial << " thread " << t;
+      EXPECT_TRUE(same_network(st.network(), before)) << trial << " threads " << threads;
+    }
+  }
+  EXPECT_EQ(checked, 15);
+}
+
+// ------------------------------------------------------- evaluate_edge_failures
+
+// The exact model's delivery_reduction is call_delivered minus evaluate_demand() with the edge excluded, for every
+// candidate (the baseline's positive-flow edges), on 1, 2 and 4 workers; zero-flow edges are
+// not candidates. Both maxima also equal the independent Bellman-Ford curve's.
+TEST(Sensitivity, GlobalLossesEqualCapacityWithTheEdgeExcluded) {
+  std::mt19937_64 rng(41);
+  int entries = 0, masked = 0, several = 0, scaled = 0, rerouted = 0, partial = 0, cut = 0;
+  for (int trial = 0; trial < 300; ++trial) {
+    const Case c = random_case(rng);
+    const EvaluationOptions opts {global_config(), c.el()};
+    const auto base = evaluate_demand(*c.g, c.sources, c.destinations, EvaluationOptions {global_config(), c.el(), nullptr,
+                                                                                 OutputOptions {true, false, false}});
+    const auto s1 = evaluate_edge_failures(*c.g, c.sources, c.destinations, opts, 1);
+    EXPECT_EQ(s1.baseline.call_delivered, base.call_delivered) << trial;
+    const std::vector<Amount> caps(c.g->edge_capacity_units().begin(), c.g->edge_capacity_units().end());
+    EXPECT_EQ(base.call_delivered, independent_curve(*c.g, caps, c.sources, c.destinations, c.el()).back().first) << trial;
+    std::vector<EdgeId> want;
+    for (EdgeId e = 0; e < c.g->num_edges(); ++e) {
+      if ((*base.edge_flows)[static_cast<std::size_t>(e)] > 0) want.push_back(e);
+    }
+    ASSERT_EQ(s1.entries.size(), want.size()) << trial;
+    for (std::size_t i = 0; i < want.size(); ++i) {
+      const auto& entry = s1.entries[i];
+      EXPECT_EQ(entry.edge, want[i]) << trial;
+      const EdgeId one[1] = {entry.edge};
+      Eligibility without = c.g->eligibility({}, one);
+      if (c.elig) without = Eligibility::intersect(*c.elig, without);
+      const auto fresh = evaluate_demand(*c.g, c.sources, c.destinations, EvaluationOptions {global_config(), &without});
+      EXPECT_EQ(entry.delivery_reduction, base.call_delivered - fresh.call_delivered) << trial << " edge " << entry.edge;
+      auto without_view = caps;
+      without_view[static_cast<std::size_t>(entry.edge)] = 0;
+      EXPECT_EQ(fresh.call_delivered, independent_curve(*c.g, without_view, c.sources, c.destinations, c.el()).back().first)
+          << trial << " edge " << entry.edge;
+      ++entries;
+      const Amount flow = (*base.edge_flows)[static_cast<std::size_t>(entry.edge)];
+      masked += c.elig.has_value() && c.elig->uid() != 0 ? 1 : 0;
+      several += c.sources.size() > 1 || c.destinations.size() > 1 ? 1 : 0;
+      scaled += c.g->max_edge_cost() > 1000000 ? 1 : 0;
+      rerouted += entry.delivery_reduction == 0 ? 1 : 0;
+      partial += entry.delivery_reduction > 0 && entry.delivery_reduction < flow ? 1 : 0;
+      cut += entry.delivery_reduction == flow ? 1 : 0;
+    }
+    for (std::int32_t workers : {2, 4}) {
+      const auto sw = evaluate_edge_failures(*c.g, c.sources, c.destinations, opts, workers);
+      ASSERT_EQ(sw.entries.size(), s1.entries.size());
+      for (std::size_t i = 0; i < sw.entries.size(); ++i) {
+        EXPECT_EQ(sw.entries[i].edge, s1.entries[i].edge);
+        EXPECT_EQ(sw.entries[i].delivery_reduction, s1.entries[i].delivery_reduction);
+      }
+    }
+  }
+  EXPECT_GT(entries, 300);
+  EXPECT_GT(masked, 20);
+  EXPECT_GT(several, 70);
+  EXPECT_GT(scaled, 10);
+  EXPECT_GT(rerouted, 10);
+  EXPECT_GT(partial, 1);
+  EXPECT_GT(cut, 100);
+}
+
+// OutputOptions controls only the published baseline: every combination captures the same state
+// (the same entries) and the baseline's optional fields are evaluate_demand()'s.
+TEST(Sensitivity, GlobalBaselineKeepsEveryOutputsCombination) {
+  const Case c = make_case(5, {{0, 1, 2, 1}, {1, 2, 2, 1}, {1, 3, 1, 2}, {3, 2, 1, 2}, {2, 4, 2, 1}, {0, 3, 1, 5}},
+                           {0}, {4});
+  const auto reference = evaluate_edge_failures(*c.g, c.sources, c.destinations, EvaluationOptions {global_config()}, 1);
+  ASSERT_FALSE(reference.entries.empty());
+  for (int bits = 0; bits < 32; ++bits) {
+    const OutputOptions outputs {(bits & 1) != 0, (bits & 2) != 0, (bits & 4) != 0, (bits & 8) != 0, (bits & 16) != 0};
+    EvaluationOptions opts {global_config()};
+    opts.outputs = outputs;
+    const auto s = evaluate_edge_failures(*c.g, c.sources, c.destinations, opts, 1);
+    const auto cap = evaluate_demand(*c.g, c.sources, c.destinations, EvaluationOptions {global_config(), nullptr, nullptr, outputs});
+    expect_same(s.baseline, cap, "complete edge-failure baseline");
+    EXPECT_EQ(s.baseline.call_delivered, cap.call_delivered) << bits;
+    EXPECT_EQ(s.baseline.marginal_cost_curve, cap.marginal_cost_curve) << bits;
+    EXPECT_EQ(s.baseline.edge_flows, cap.edge_flows) << bits;
+    EXPECT_EQ(s.baseline.residual, cap.residual) << bits;
+    EXPECT_EQ(s.baseline.saturated_boundary_edges, cap.saturated_boundary_edges) << bits;
+    EXPECT_EQ(s.baseline.min_cut, cap.min_cut) << bits;
+    // Each requested output is present, each other one absent; CentralizedTE's curve always, and its
+    // min_cut when requested (the uncapped baseline is maximal).
+    EXPECT_EQ(s.baseline.edge_flows.has_value(), outputs.edge_flows) << bits;
+    EXPECT_EQ(s.baseline.residual.has_value(), outputs.residual) << bits;
+    EXPECT_EQ(s.baseline.saturated_boundary_edges.has_value(), outputs.saturated_boundary_edges) << bits;
+    EXPECT_EQ(s.baseline.min_cut.has_value(), outputs.min_cut) << bits;
+    EXPECT_TRUE(s.baseline.marginal_cost_curve.has_value()) << bits;
+    ASSERT_EQ(s.entries.size(), reference.entries.size()) << bits;
+    for (std::size_t i = 0; i < s.entries.size(); ++i) {
+      EXPECT_EQ(s.entries[i].edge, reference.entries[i].edge) << bits;
+      EXPECT_EQ(s.entries[i].delivery_reduction, reference.entries[i].delivery_reduction) << bits;
+    }
+  }
+}
+
+TEST(Sensitivity, BaselineComparisonRejectsEveryFieldAndRedistribution) {
+  const Case c = make_case(5, {{0, 2, 3, 1}, {0, 4, 0, 5}, {1, 3, 4, 2}, {2, 4, 3, 2}, {3, 4, 4, 1}}, {0, 1}, {4});
+  const EvaluationOptions options {global_config(), nullptr, nullptr, OutputOptions {true, true, true, true, true}};
+  const auto result = evaluate_edge_failures(*c.g, c.sources, c.destinations, options, 1);
+  const auto& good = result.baseline;
+  ASSERT_EQ(good.call_delivered, 7);
+  ASSERT_EQ(good.by_source.size(), 2U);
+  ASSERT_EQ(good.by_source[0].delivered, 3);
+  ASSERT_EQ(good.by_source[1].delivered, 4);
+  expect_same(good, evaluate_demand(*c.g, c.sources, c.destinations, options), "independent baseline call");
+  ASSERT_TRUE(good.program != nullptr);
+  ASSERT_TRUE(good.edge_flows && good.residual && good.saturated_boundary_edges && good.edge_reservations && good.min_cut);
+  ASSERT_TRUE(good.total_cost && good.marginal_cost_curve && !good.marginal_cost_curve->empty());
+  const std::vector<std::function<void(PlacementResult&)>> damage = {
+      [](auto& x) { ++x.call_delivered; }, [](auto& x) { x.call_undelivered = Amount {0}; },
+      [](auto& x) { ++x.delivery_delta; }, [](auto& x) { x.call_edge_drops.emplace_back(0, 0); },
+      [](auto& x) { ++x.call_source_drops; }, [](auto& x) { x.termination = Termination::Complete; },
+      [](auto& x) { x.routes_changed = !x.routes_changed; }, [](auto& x) { x.weights_changed = !x.weights_changed; },
+      [](auto& x) { x.reservations_changed = !x.reservations_changed; }, [](auto& x) { x.program.reset(); },
+      [](auto& x) { x.plan = TunnelPlan {}; }, [](auto& x) { x.requested = Counter128 {}; },
+      [](auto& x) { x.offered = Counter128 {}; }, [](auto& x) { ++x.admitted.lo; }, [](auto& x) { ++x.delivered; },
+      [](auto& x) { x.unadmitted = Counter128 {}; }, [](auto& x) { ++x.source_drops.lo; },
+      [](auto& x) { x.edge_drops.emplace_back(0, Counter128 {}); }, [](auto& x) { x.by_source.pop_back(); },
+      [](auto& x) { ++x.by_source[0].delivered; --x.by_source[1].delivered; },
+      [](auto& x) { x.by_tunnel.emplace_back(); }, [](auto& x) { x.total_cost.reset(); },
+      [](auto& x) { ++x.total_cost->lo; }, [](auto& x) { x.marginal_cost_curve.reset(); },
+      [](auto& x) { ++x.marginal_cost_curve->back().first; }, [](auto& x) { x.edge_flows.reset(); },
+      [](auto& x) { ++(*x.edge_flows)[0]; --(*x.edge_flows)[2]; }, [](auto& x) { x.residual.reset(); },
+      [](auto& x) { ++x.residual->back(); }, [](auto& x) { x.saturated_boundary_edges.reset(); },
+      [](auto& x) { x.saturated_boundary_edges->push_back(0); }, [](auto& x) { x.edge_reservations.reset(); },
+      [](auto& x) { ++x.edge_reservations->back(); }, [](auto& x) { x.min_cut.reset(); },
+      [](auto& x) { x.min_cut->push_back(0); },
+  };
+  EXPECT_EQ(failures_of([&] { expect_same(good, good, "same baseline"); }), 0);
+  for (std::size_t i = 0; i < damage.size(); ++i) {
+    auto bad = good;
+    damage[i](bad);
+    EXPECT_GT(failures_of([&] { expect_same(bad, good, "damaged baseline"); }), 0) << i;
+  }
+}
+
+TEST(FlowCoreDeletion, CutClassificationMatchesIndependentResidualReachability) {
+  std::mt19937_64 rng(721);
+  int classified = 0, bypassed = 0, zero = 0;
+  // The first case can reroute only by visiting the virtual source.
+  for (int trial = 0; trial < 181; ++trial) {
+    const Case c = trial == 0 ? make_case(4, {{0, 2, 1, 1}, {1, 2, 1, 2}, {2, 3, 1, 1}}, {0, 1}, {3}) : random_case(rng);
+    const auto req = capture_of(c);
+    const auto& st = *req.state;
+    const auto& net = st.network();
+    const auto got = detail::deletion_cut_edges(st);
+    ASSERT_EQ(got.size(), static_cast<std::size_t>(c.g->num_edges()));
+    const auto n = static_cast<std::size_t>(net.num_nodes) + 2;
+    std::vector<std::vector<bool>> reach(n, std::vector<bool>(n, false));
+    for (std::size_t u = 0; u < n; ++u) {
+      reach[u][u] = true;
+      for (auto a = net.arc_offsets[u]; a < net.arc_offsets[u + 1]; ++a) {
+        if (st.residual()[static_cast<std::size_t>(a)] > 0) reach[u][static_cast<std::size_t>(net.arc_destinations[static_cast<std::size_t>(a)])] = true;
+      }
+    }
+    for (std::size_t k = 0; k < n; ++k) for (std::size_t u = 0; u < n; ++u) for (std::size_t v = 0; v < n; ++v) {
+      reach[u][v] = reach[u][v] || (reach[u][k] && reach[k][v]);
+    }
+    const auto flows = st.edge_flows();
+    std::vector<std::uint8_t> expected(got.size(), 0);
+    for (std::size_t k = 0; k < net.edges.size(); ++k) {
+      const auto e = static_cast<std::size_t>(net.edges[k]);
+      const auto a = static_cast<std::size_t>(net.edge_forward_arcs[k]);
+      const auto u = static_cast<std::size_t>(net.edge_sources[k]);
+      const auto v = static_cast<std::size_t>(net.edge_destinations[k]);
+      expected[e] = flows[e] > 0 && st.residual()[a] == 0 && !reach[u][v];
+      classified += expected[e] != 0;
+      bypassed += flows[e] > 0 && expected[e] == 0;
+      zero += flows[e] == 0;
+      if (got[e]) EXPECT_EQ(st.value() - fresh_without(c, net.edges[k]).flow_value, flows[e]);
+    }
+    EXPECT_EQ(got, expected) << trial;
+    if (trial == 0) {
+      EXPECT_EQ(got[0], 0);  // s0 -> s* -> s1 -> a is a positive-residual bypass
+      EXPECT_EQ(st.value() - fresh_without(c, 0).flow_value, 0);
+    }
+  }
+  EXPECT_GT(classified, 50);
+  EXPECT_GT(bypassed, 10);
+  EXPECT_GT(zero, 50);
+}
+
+TEST(FlowCoreDeletion, ScalarLossPreservesMaximumGuardAndIndependentResets) {
+  const Case c = make_case(3, {{0, 1, 3, 1}, {1, 2, 3, 2}, {1, 2, 1, 5}}, {0}, {2});
+  const auto req = capture_of(c);
+  const auto saved = req.state->edge_flows();
+  DeletionResolver resolver(*req.state);
+  const auto ids = id_of_input(*c.g);
+  for (EdgeId e : {ids[1], ids[0], ids[1], ids[0]}) {
+    EXPECT_EQ(resolver.loss(e), e == ids[1] ? 2 : 3);
+    EXPECT_EQ(req.state->edge_flows(), saved);
+    EXPECT_EQ(resolver.resolve(e).value, fresh_without(c, e).flow_value);
+  }
+  for (EdgeId e : {ids[2], static_cast<EdgeId>(c.g->num_edges())}) {
+    EXPECT_EQ(error_of([&] { (void)resolver.loss(e); }), error_of([&] { (void)resolver.resolve(e); }));
+  }
+  Case capped = make_case(2, {{0, 1, 1, 1}, {0, 1, 2, 2}}, {0}, {1});
+  capped.cap = 1;
+  const auto cap = capture_of(capped);
+  ASSERT_FALSE(cap.state->maximum());
+  DeletionResolver cap_resolver(*cap.state);
+  EXPECT_EQ(error_of([&] { (void)cap_resolver.loss(0); }), error_of([&] { (void)cap_resolver.resolve(0); }));
+  EXPECT_THROW((void)detail::deletion_cut_edges(*cap.state), std::invalid_argument);
+  EXPECT_THROW((void)detail::deletion_cut_edges(DeletionState {}), std::invalid_argument);
+  const Case parallel = make_case(2, {{0, 1, 2, 1}, {0, 1, 2, 5}}, {0}, {1});
+  for (Amount offer : {0, 1, 5}) for (std::int32_t workers : {1, 2}) {
+    EvaluationOptions options {global_config(), nullptr, nullptr, OutputOptions {true, true, true, true, true}};
+    options.offer = std::optional<Amount>(offer);
+    const auto got = evaluate_edge_failures(*parallel.g, parallel.sources, parallel.destinations, options, workers);
+    expect_same(got.baseline, evaluate_demand(*parallel.g, parallel.sources, parallel.destinations, options), "finite baseline");
+    EXPECT_EQ(got.baseline.call_delivered, std::min<Amount>(offer, 4));
+    ASSERT_EQ(got.entries.size(), offer == 0 ? 0U : offer == 1 ? 1U : 2U);
+    for (std::size_t i = 0; i < got.entries.size(); ++i) {
+      EXPECT_EQ(got.entries[i].edge, static_cast<EdgeId>(i));
+      EXPECT_EQ(got.entries[i].delivery_reduction, offer == 5 ? 2 : 0);
+    }
+  }
+}
+
+TEST(FlowCoreDeletion, ScalarRepairStopsBeforeCancellation) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const Case c = make_case(3, {{0, 1, 3, 1}, {1, 2, 3, 2}, {1, 2, 1, 5}}, {0}, {2});
+  const auto req = capture_of(c);
+  DeletionResolver resolver(*req.state);
+  const auto e = id_of_input(*c.g)[1];
+  std::vector<int> stages;
+  detail::DeletionProbe probe;
+  probe.observe = [&](const detail::DeletionEvent& event) { stages.push_back(event.repair); };
+  EXPECT_EQ(resolver.loss(e, probe), 2);
+  EXPECT_FALSE(stages.empty());
+  EXPECT_NE(std::find(stages.begin(), stages.end(), 1), stages.end());
+  for (int stage : stages) EXPECT_LE(stage, 1);
+  // The same underlying repair engine's full mode must still do both cancellations.
+  stages.clear();
+  EXPECT_EQ(resolver.resolve(e, probe).value, 1);
+  EXPECT_NE(std::find(stages.begin(), stages.end(), 2), stages.end());
+  EXPECT_NE(std::find(stages.begin(), stages.end(), 3), stages.end());
+  EXPECT_NE(std::find(stages.begin(), stages.end(), 4), stages.end());
+#else
+  GTEST_SKIP() << "intermediate repair observation requires private hooks";
+#endif
+}
+
+TEST(FlowCoreDeletion, CutClassificationHandlesALongResidualChainWithoutRecursion) {
+  constexpr NodeId links = 1000000;
+  std::vector<InEdge> edges;
+  edges.reserve(static_cast<std::size_t>(links));
+  // Saturation leaves reverse residual arcs 0 -> 1 -> ... -> links. Starting
+  // at vertex 0 must descend the entire chain, regardless of component order.
+  for (NodeId v = 0; v < links; ++v) edges.push_back({v + 1, v, 1, 1});
+  const Case c = make_case(links + 1, edges, {links}, {0});
+  const auto req = capture_of(c);
+  const auto cut = detail::deletion_cut_edges(*req.state);
+  ASSERT_EQ(cut.size(), edges.size());
+  EXPECT_EQ(std::count(cut.begin(), cut.end(), 1), static_cast<std::ptrdiff_t>(edges.size()));
+}
+
+TEST(Sensitivity, ShortcutControlsPreserveEveryFieldAndClassifyCuts) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  const Case c = make_case(5, {{0, 1, 3, 1}, {0, 2, 3, 3}, {1, 3, 3, 1}, {2, 3, 3, 1}, {3, 4, 3, 1}}, {0}, {4});
+  const EvaluationOptions options {global_config(), nullptr, nullptr, OutputOptions {true, true, true, true, true}};
+  detail::SensitivityProbe full;
+  full.full_repair = true;
+  const auto reference = [&] {
+    detail::ScopedSensitivityProbe control(&full);
+    return evaluate_edge_failures(*c.g, c.sources, c.destinations, options, 1);
+  }();
+  ASSERT_EQ(reference.entries.size(), 3U);
+  ASSERT_EQ(reference.baseline.call_delivered, 3);
+  const std::vector<EdgeId> expected_edges {0, 2, 4};
+  const std::vector<Amount> expected_losses {0, 0, 3};
+  using Work = detail::SensitivityWork;
+  for (int mode = 0; mode < 3; ++mode) for (std::int32_t workers : {1, 2, 4}) {
+    std::vector<int> seen(static_cast<std::size_t>(c.g->num_edges()), -1);
+    detail::SensitivityProbe probe;
+    probe.cut_edges = mode != 1;
+    probe.full_repair = mode == 2;
+    probe.context = &seen;
+    probe.observe = [](void* context, EdgeId e, Work work) {
+      (*static_cast<std::vector<int>*>(context))[static_cast<std::size_t>(e)] = static_cast<int>(work);
+    };
+    detail::ScopedSensitivityProbe control(&probe);
+    const auto got = evaluate_edge_failures(*c.g, c.sources, c.destinations, options, workers);
+    expect_same(got.baseline, reference.baseline, "edge-failure full baseline");
+    ASSERT_EQ(got.entries.size(), expected_edges.size());
+    for (std::size_t i = 0; i < got.entries.size(); ++i) {
+      EXPECT_EQ(got.entries[i].edge, expected_edges[i]);
+      EXPECT_EQ(got.entries[i].delivery_reduction, expected_losses[i]);
+    }
+    if (workers == 1 && mode == 0) {
+      EXPECT_EQ(seen[0], static_cast<int>(Work::FirstRepair));
+      EXPECT_EQ(seen[2], static_cast<int>(Work::FirstRepair));
+      EXPECT_EQ(seen[4], static_cast<int>(Work::Cut));
+    }
+    if (mode == 2) for (EdgeId e : expected_edges) EXPECT_EQ(seen[static_cast<std::size_t>(e)], static_cast<int>(Work::FullRepair));
+    if (mode == 1) for (int work : seen) EXPECT_NE(work, static_cast<int>(Work::Cut));
+  }
+#else
+  GTEST_SKIP() << "edge-failure shortcut controls require private hooks";
+#endif
+}
diff --git a/tests/cpp/min_cost_flow_tests.cpp b/tests/cpp/min_cost_flow_tests.cpp
new file mode 100644
index 0000000..336863f
--- /dev/null
+++ b/tests/cpp/min_cost_flow_tests.cpp
@@ -0,0 +1,892 @@
+// The integer minimum-cost flow core through place_global_units: a first solve on a fresh graph,
+// the witness graphs (hand-built examples; expected values derived by hand and from the reference flow core,
+// tests/reference/policy/p1_amount/flowcore.py), the certificate in its two branches, input
+// validation, determinism, and randomized graphs certified against an exhaustive optimum (tier a)
+// and an independent solver (tier b), which is itself checked against the exhaustive optimum.
+#include <gtest/gtest.h>
+
+#include <cmath>
+#include <functional>
+#include <limits>
+#include <numeric>
+#include <random>
+#include <string>
+#include <vector>
+
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+constexpr Amount kL62m1 = (Amount{1} << 62) - 1;
+
+// The counters fixed by the per-tier order and the augmenting-path sequence, compared
+// with the reference flow core (tests/reference/policy/p1_amount/flowcore.py): dijkstra_runs,
+// dijkstra_pops, settled, dinic_phases, augmentations. arc_scans
+// is the implementation's own diagnostic (the level search here first marks the vertices that
+// reach t* and stops at t*'s level, so it examines a different number of arcs than the
+// reference's full BFS); it is checked for determinism and presence only.
+using Counters = std::vector<std::int64_t>;
+Counters counters_of(const MinCostFlowResult& r) {
+  const auto& c = r.counters;
+  EXPECT_GE(c.arc_scans, c.dijkstra_runs > 0 ? 1 : 0);
+  return {c.dijkstra_runs, c.dijkstra_pops, c.settled, c.dinic_phases, c.augmentations};
+}
+
+std::vector<InEdge> chain_plus_bypasses(Cost factor = 1) {
+  // Chain 0-1-2-3 of cost 1 with bypasses 0->2 and 1->3 of cost 3, unit capacities.
+  return {{0, 1, 1, factor}, {1, 2, 1, factor}, {2, 3, 1, factor}, {0, 2, 1, 3 * factor}, {1, 3, 1, 3 * factor}};
+}
+
+void expect_certified(const Graph& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+                      std::optional<Amount> cap, const MinCostFlowResult& r, const std::vector<Amount>* view = nullptr,
+                      const Eligibility* elig = nullptr, bool tier_a = true) {
+  std::vector<Amount> full(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  const auto& v = view ? *view : full;
+  const auto fails = certify(g, v, s, d, cap, elig, r, tier_a);
+  EXPECT_TRUE(fails.empty()) << (fails.empty() ? "" : fails.front());
+}
+
+} // namespace
+
+TEST(FlowCore, ConstructAndSolve) {
+  // 0 -> 1 (cost 10), 1 -> 2 (cost 20), 0 -> 2 (cost 100); capacities 10 units each.
+  const auto g = make_graph(3, {{0, 1, 10, 10}, {1, 2, 10, 20}, {0, 2, 10, 100}});
+  EXPECT_EQ(g.num_nodes(), 3);
+  EXPECT_EQ(g.num_edges(), 3);
+  const auto r = solve(g, {0}, {2}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 20);
+  ASSERT_EQ(r.marginal_cost_curve.size(), 2u);
+  EXPECT_EQ(r.marginal_cost_curve[0], (std::pair<Cost, Amount> {30, 10}));   // 0 -> 1 -> 2 first
+  EXPECT_EQ(r.marginal_cost_curve[1], (std::pair<Cost, Amount> {100, 10}));  // then the direct edge
+  expect_certified(g, {0}, {2}, std::nullopt, r);
+}
+
+TEST(FlowCore, QuantisedCapacitiesFamily) {
+  // Physical 2.5q is 3 units and 0.5q is 1 unit (the quantised network).
+  const double q = std::ldexp(1.0, -12);
+  const Amount a = to_units(2.5 * q, q);
+  const Amount b = to_units(0.5 * q, q);
+  ASSERT_EQ(a, 3);
+  ASSERT_EQ(b, 1);
+  auto g = make_graph(3, {{0, 1, a, 1}, {1, 2, a, 1}, {0, 2, b, 3}}, q);
+  auto r = solve(g, {0}, {2}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 4);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{2, 3}, {3, 1}}));
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(ids_to_input(g, *r.min_cut), (std::vector<std::int32_t>{0, 2}));
+  EXPECT_EQ(r.potentials, (std::vector<Cost>{0, 2, 3}));
+  EXPECT_EQ(counters_of(r), (Counters{3, 13, 12, 4, 2}));
+  expect_certified(g, {0}, {2}, std::nullopt, r);
+}
+
+TEST(FlowCore, ChainPlusBypassesCancellation) {
+  // A chain with bypasses: value 2 needs the middle edge cancelled.
+  auto g = make_graph(4, chain_plus_bypasses());
+  auto one = solve(g, {0}, {3}, 1);
+  EXPECT_EQ(one.flow_value, 1);
+  EXPECT_EQ(one.marginal_cost_curve, curve({{3, 1}}));
+  EXPECT_EQ(to_input(g, one.edge_flows), (std::vector<Amount>{1, 1, 1, 0, 0}));
+  EXPECT_FALSE(one.min_cut.has_value());  // value 1 of a maximum 2: no cut
+  EXPECT_EQ(counters_of(one), (Counters{1, 8, 6, 1, 1}));
+  expect_certified(g, {0}, {3}, 1, one);
+  auto two = solve(g, {0}, {3}, 2);
+  EXPECT_EQ(two.flow_value, 2);
+  EXPECT_EQ(two.marginal_cost_curve, curve({{3, 1}, {5, 1}}));  // C(1) = 3, C(2) = 8
+  EXPECT_EQ(to_input(g, two.edge_flows), (std::vector<Amount>{1, 0, 1, 1, 1}));
+  ASSERT_TRUE(two.min_cut.has_value());
+  EXPECT_EQ(ids_to_input(g, *two.min_cut), (std::vector<std::int32_t>{0, 3}));
+  EXPECT_EQ(two.potentials, (std::vector<Cost>{0, 2, 3, 5}));
+  EXPECT_EQ(counters_of(two), (Counters{2, 14, 12, 3, 2}));
+  expect_certified(g, {0}, {3}, 2, two);
+  auto inf = solve(g, {0}, {3}, std::nullopt);
+  EXPECT_EQ(inf.flow_value, 2);
+  EXPECT_EQ(inf.marginal_cost_curve, two.marginal_cost_curve);
+  EXPECT_EQ(inf.edge_flows, two.edge_flows);
+  EXPECT_EQ(inf.min_cut, two.min_cut);
+  EXPECT_EQ(counters_of(inf), (Counters{3, 16, 14, 4, 2}));  // the final failed Dijkstra
+  expect_certified(g, {0}, {3}, std::nullopt, inf);
+}
+
+TEST(FlowCore, ChainPlusBypassesMasksAndCostFactors) {
+  // The middle edge disabled by a zero view or excluded by Eligibility: curve [(4, 2)].
+  auto g = make_graph(4, chain_plus_bypasses());
+  const auto inv = id_of_input(g);
+  std::vector<Amount> view(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  view[static_cast<std::size_t>(inv[1])] = 0;
+  auto zero = solve(g, {0}, {3}, std::nullopt, &view);
+  EXPECT_EQ(zero.marginal_cost_curve, curve({{4, 2}}));
+  EXPECT_EQ(to_input(g, zero.edge_flows), (std::vector<Amount>{1, 0, 1, 1, 1}));
+  EXPECT_EQ(zero.potentials, (std::vector<Cost>{0, 1, 3, 4}));
+  expect_certified(g, {0}, {3}, std::nullopt, zero, &view);
+  const std::vector<EdgeId> excluded = {inv[1]};
+  auto el = g.eligibility({}, excluded);
+  auto masked = solve(g, {0}, {3}, std::nullopt, nullptr, &el);
+  EXPECT_EQ(masked.marginal_cost_curve, curve({{4, 2}}));
+  EXPECT_EQ(masked.edge_flows, zero.edge_flows);
+  EXPECT_EQ(masked.min_cut, zero.min_cut);
+  expect_certified(g, {0}, {3}, std::nullopt, masked, nullptr, &el);
+  // Excluding node 1 leaves 0 -> 2 -> 3 only.
+  const std::vector<NodeId> xn = {1};
+  auto el_node = g.eligibility(xn, {});
+  auto node_masked = solve(g, {0}, {3}, std::nullopt, nullptr, &el_node);
+  EXPECT_EQ(node_masked.marginal_cost_curve, curve({{4, 1}}));
+  EXPECT_EQ(node_masked.potentials[1], kNeverReached);
+  expect_certified(g, {0}, {3}, std::nullopt, node_masked, nullptr, &el_node);
+  // Scaling every cost by a factor scales the curve and the potentials; the flows, the cut and
+  // the operation counters are unchanged.
+  for (Cost factor : {2, 7, 1000003}) {
+    auto gf = make_graph(4, chain_plus_bypasses(factor));
+    auto base = solve(g, {0}, {3}, std::nullopt);
+    auto scaled = solve(gf, {0}, {3}, std::nullopt);
+    ASSERT_EQ(scaled.marginal_cost_curve.size(), base.marginal_cost_curve.size());
+    for (std::size_t i = 0; i < base.marginal_cost_curve.size(); ++i) {
+      EXPECT_EQ(scaled.marginal_cost_curve[i].first, factor * base.marginal_cost_curve[i].first);
+      EXPECT_EQ(scaled.marginal_cost_curve[i].second, base.marginal_cost_curve[i].second);
+    }
+    for (std::size_t v = 0; v < base.potentials.size(); ++v) {
+      EXPECT_EQ(scaled.potentials[v], factor * base.potentials[v]);
+    }
+    EXPECT_EQ(scaled.edge_flows, base.edge_flows);
+    EXPECT_EQ(scaled.min_cut, base.min_cut);
+    EXPECT_EQ(counters_of(scaled), counters_of(base));
+    expect_certified(gf, {0}, {3}, std::nullopt, scaled);
+  }
+}
+
+TEST(FlowCore, EqualCostTierNeedsTwoDinicPhases) {
+  // Equal-cost walks of several hop counts in one tier:
+  // C = {0: 0, 1: 3, 2: 6} in one tier of cost 3 drained by two successful level builds (plus the
+  // tier's last unsuccessful one).
+  auto g = make_graph(4, {{0, 3, 1, 3}, {0, 1, 1, 1}, {1, 2, 1, 1}, {2, 3, 1, 1}});
+  auto r = solve(g, {0}, {3}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 2);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{3, 2}}));
+  EXPECT_EQ(r.counters.dijkstra_runs, 2);
+  EXPECT_EQ(r.counters.dinic_phases, 3);
+  EXPECT_EQ(counters_of(r), (Counters{2, 8, 8, 3, 2}));
+  expect_certified(g, {0}, {3}, std::nullopt, r);
+}
+
+TEST(FlowCore, CyclicAdmissibleNeedsUpdateBeforeDrain) {
+  // Two parallel cost-1 links. Potentials are updated by
+  // the first Dijkstra before the drain (on the zero potentials no arc has reduced cost 0), and
+  // the zero-reduced-cost residual cycle 0 -> 1 -> 0 left after the first push is drained in
+  // the same tier.
+  auto g = make_graph(2, {{0, 1, 1, 1}, {0, 1, 1, 1}});
+  auto r = solve(g, {0}, {1}, 2);
+  EXPECT_EQ(r.flow_value, 2);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{1, 2}}));
+  EXPECT_EQ(counters_of(r), (Counters{1, 4, 4, 1, 2}));
+  expect_certified(g, {0}, {1}, 2, r);
+  // A partial drain: cap 1 stops inside the tier; the destinations stay connected.
+  auto p = solve(g, {0}, {1}, 1);
+  EXPECT_EQ(p.flow_value, 1);
+  EXPECT_EQ(p.marginal_cost_curve, curve({{1, 1}}));
+  EXPECT_FALSE(p.min_cut.has_value());
+  EXPECT_EQ(counters_of(p), (Counters{1, 4, 4, 1, 1}));
+  expect_certified(g, {0}, {1}, 1, p);
+}
+
+TEST(FlowCore, FailedFinalRunRaisesPotentials) {
+  // A failed final run: the side branch 3 is reached at 8 by the first run and at 10 by
+  // the failed final run; dual feasibility is claimed inside the closure {0, 3} only.
+  auto g = make_graph(4, {{0, 1, 1, 1}, {1, 2, 1, 1}, {1, 3, 1, 7}, {0, 3, 1, 10}});
+  auto r = solve(g, {0}, {2}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 1);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{2, 1}}));
+  EXPECT_EQ(r.potentials, (std::vector<Cost>{0, 1, 2, 10}));
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(ids_to_input(g, *r.min_cut), (std::vector<std::int32_t>{0}));
+  EXPECT_EQ(counters_of(r), (Counters{2, 10, 9, 2, 1}));
+  expect_certified(g, {0}, {2}, std::nullopt, r);
+}
+
+TEST(FlowCore, FreshSolveUsesReleasedCheapEdge) {
+  // A solve on the view [1, 1, 1] (as a re-placement sees it: the residual plus the owner's own
+  // allocation) at value 1 takes the cheap link (path cost 2), not the cost-3 link (path cost 4).
+  auto g = make_graph(3, {{0, 1, 1, 1}, {0, 1, 2, 3}, {1, 2, 2, 1}});
+  const std::vector<Amount> view = to_ids(g, std::vector<Amount>{1, 1, 1});
+  auto r = solve(g, {0}, {2}, 1, &view);
+  EXPECT_EQ(to_input(g, r.edge_flows), (std::vector<Amount>{1, 0, 1}));
+  EXPECT_EQ(r.marginal_cost_curve, curve({{2, 1}}));
+  std::vector<Amount> residual(view.size());
+  for (std::size_t e = 0; e < view.size(); ++e) residual[e] = view[e] - r.edge_flows[e];
+  EXPECT_EQ(to_input(g, residual), (std::vector<Amount>{0, 1, 0}));
+  expect_certified(g, {0}, {2}, 1, r, &view);
+  EXPECT_TRUE(same_payload(r, solve(g, {0}, {2}, 1, &view)));
+}
+
+TEST(FlowCore, AttainedValueUnderCapAndInfinity) {
+  // The attained value under a cap, without one and at the internal cap, on one edge of capacity 3 and cost 7.
+  auto g = make_graph(2, {{0, 1, 3, 7}});
+  auto c2 = solve(g, {0}, {1}, 2);
+  EXPECT_EQ(c2.flow_value, 2);
+  EXPECT_FALSE(c2.min_cut.has_value());
+  EXPECT_EQ(counters_of(c2), (Counters{1, 4, 4, 1, 1}));
+  expect_certified(g, {0}, {1}, 2, c2);
+  auto c3 = solve(g, {0}, {1}, 3);
+  EXPECT_EQ(c3.flow_value, 3);
+  ASSERT_TRUE(c3.min_cut.has_value());
+  EXPECT_EQ(*c3.min_cut, (std::vector<EdgeId>{0}));
+  EXPECT_EQ(counters_of(c3), (Counters{1, 4, 4, 1, 1}));  // the cap stops before a failed run
+  expect_certified(g, {0}, {1}, 3, c3);
+  auto inf = solve(g, {0}, {1}, std::nullopt);
+  EXPECT_EQ(inf.flow_value, 3);
+  EXPECT_EQ(inf.marginal_cost_curve, curve({{7, 3}}));
+  EXPECT_EQ(counters_of(inf), (Counters{2, 6, 6, 2, 1}));
+  expect_certified(g, {0}, {1}, std::nullopt, inf);
+  // The internal cap 2^63 - 2: the solve runs to disconnection (no clamp).
+  auto big = solve(g, {0}, {1}, kMaxFlowCap);
+  EXPECT_TRUE(same_payload(big, inf));
+  expect_certified(g, {0}, {1}, kMaxFlowCap, big);
+}
+
+TEST(FlowCore, ZeroCapIsThePrescribedZeroPayload) {
+  // A zero cap: no flow, no cut, every potential the never-reached sentinel, no work counted.
+  auto g = make_graph(4, {{0, 1, 2, 1}, {1, 2, 2, 2}, {3, 2, 1, 1}});
+  auto r = solve(g, {0}, {2}, 0);
+  EXPECT_EQ(r.flow_value, 0);
+  EXPECT_TRUE(r.marginal_cost_curve.empty());
+  EXPECT_EQ(r.edge_flows, (std::vector<Amount>{0, 0, 0}));
+  EXPECT_FALSE(r.min_cut.has_value());
+  EXPECT_EQ(r.potentials, (std::vector<Cost>(4, kNeverReached)));
+  EXPECT_EQ(counters_of(r), (Counters{0, 0, 0, 0, 0}));
+  expect_certified(g, {0}, {2}, 0, r);
+}
+
+TEST(FlowCore, PositiveCapOnZeroView) {
+  // A positive cap runs one failed Dijkstra even when the view gives the sources no
+  // out-capacity; roots at 0; min_cut is the edge 0 -> 1 of view 0 (the closure {0} is separated
+  // from the destination only by it; its value is 0).
+  auto g = make_graph(3, {{0, 1, 5, 1}, {1, 2, 5, 1}});
+  const std::vector<Amount> view = to_ids(g, std::vector<Amount>{0, 5});
+  auto r = solve(g, {0}, {2}, 4, &view);
+  EXPECT_EQ(r.flow_value, 0);
+  EXPECT_TRUE(r.marginal_cost_curve.empty());
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(*r.min_cut, (std::vector<EdgeId>{0}));
+  EXPECT_EQ(r.potentials, (std::vector<Cost>{0, kNeverReached, kNeverReached}));
+  EXPECT_EQ(counters_of(r), (Counters{1, 2, 2, 0, 0}));
+  expect_certified(g, {0}, {2}, 4, r, &view);
+  // An all-zero view behaves the same way.
+  const std::vector<Amount> zeros(2, 0);
+  auto z = solve(g, {0}, {2}, 1, &zeros);
+  EXPECT_EQ(z.flow_value, 0);
+  ASSERT_TRUE(z.min_cut.has_value());
+  EXPECT_EQ(*z.min_cut, (std::vector<EdgeId>{0}));
+  EXPECT_EQ(z.potentials[0], 0);
+  expect_certified(g, {0}, {2}, 1, z, &zeros);
+}
+
+TEST(FlowCore, LegalMaximumUnits) {
+  // Terminal saturation: one edge at 2^62 - 1 units; the closure is seeded at the real
+  // sources, so the cut holds the real edge (virtual arcs never saturate).
+  auto g = make_graph(2, {{0, 1, kL62m1, 1}});
+  auto r = solve(g, {0}, {1}, std::nullopt);
+  EXPECT_EQ(r.flow_value, kL62m1);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{1, kL62m1}}));
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(*r.min_cut, (std::vector<EdgeId>{0}));
+  EXPECT_EQ(r.potentials, (std::vector<Cost>{0, 1}));
+  expect_certified(g, {0}, {1}, std::nullopt, r, nullptr, nullptr, /*tier_a=*/false);
+  // A sum of capacities at 2^62 - 1 split over parallel paths with large costs.
+  auto h = make_graph(3, {{0, 1, kL62m1 - 10, (Amount{1} << 60)}, {0, 2, 5, 3}, {2, 1, 5, (Amount{1} << 60)}});
+  auto rh = solve(h, {0}, {1}, std::nullopt);
+  EXPECT_EQ(rh.flow_value, kL62m1 - 5);
+  EXPECT_EQ(rh.marginal_cost_curve, curve({{(Amount{1} << 60), kL62m1 - 10}, {(Amount{1} << 60) + 3, 5}}));
+  expect_certified(h, {0}, {1}, std::nullopt, rh, nullptr, nullptr, /*tier_a=*/false);
+  auto capped = solve(h, {0}, {1}, kL62m1 - 6);
+  EXPECT_EQ(capped.flow_value, kL62m1 - 6);
+  EXPECT_FALSE(capped.min_cut.has_value());
+  expect_certified(h, {0}, {1}, kL62m1 - 6, capped, nullptr, nullptr, /*tier_a=*/false);
+}
+
+TEST(FlowCore, EndpointSetsAndVirtualTerminals) {
+  // Several destinations through the virtual terminal: both destinations have
+  // inflow, so both carry pi(t*) = 2.
+  auto g = make_graph(3, {{0, 1, 1, 1}, {0, 2, 1, 2}});
+  auto r = solve(g, {0}, {1, 2}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 2);
+  EXPECT_EQ(r.marginal_cost_curve, curve({{1, 1}, {2, 1}}));
+  EXPECT_EQ(r.potentials, (std::vector<Cost>{0, 2, 2}));
+  expect_certified(g, {0}, {1, 2}, std::nullopt, r);
+  // Source transit is dominated: source 0 supplies nothing.
+  auto t = make_graph(3, {{0, 1, 1, 1}, {1, 2, 2, 1}});
+  auto rt = solve(t, {0, 1}, {2}, std::nullopt);
+  EXPECT_EQ(rt.flow_value, 2);
+  EXPECT_EQ(to_input(t, rt.edge_flows), (std::vector<Amount>{0, 2}));
+  EXPECT_EQ(rt.potentials, (std::vector<Cost>{0, 0, 1}));
+  expect_certified(t, {0, 1}, {2}, std::nullopt, rt);
+  // Duplicates are removed.
+  EXPECT_TRUE(same_payload(solve(t, {1, 0, 1}, {2, 2}, std::nullopt), rt));
+}
+
+TEST(FlowCore, ClosureAndSentinels) {
+  // The cut: the closure follows reverse arcs, so the forward-only boundary is wrong.
+  auto g = make_graph(5, {{0, 1, 1, 1}, {0, 2, 1, 1}, {1, 3, 1, 1}, {2, 3, 1, 1}, {3, 4, 1, 1}});
+  auto r = solve(g, {0}, {4}, std::nullopt);
+  EXPECT_EQ(r.flow_value, 1);
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_EQ(ids_to_input(g, *r.min_cut), (std::vector<std::int32_t>{4}));
+  expect_certified(g, {0}, {4}, std::nullopt, r);
+  // Node 3 is never settled when the cap stops the solve with the destination connected.
+  auto h = make_graph(4, {{0, 1, 2, 1}, {1, 2, 2, 2}, {3, 2, 1, 1}});
+  auto rh = solve(h, {0}, {2}, 1);
+  EXPECT_FALSE(rh.min_cut.has_value());
+  EXPECT_EQ(rh.potentials, (std::vector<Cost>{0, 1, 3, kNeverReached}));
+  expect_certified(h, {0}, {2}, 1, rh);
+}
+
+TEST(FlowCore, ExcludedEndpointsAreSkipped) {
+  auto g = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  const std::vector<NodeId> x0 = {0};
+  auto no_source = g.eligibility(x0, {});
+  auto r = solve(g, {0}, {2}, std::nullopt, nullptr, &no_source);
+  EXPECT_EQ(r.flow_value, 0);
+  ASSERT_TRUE(r.min_cut.has_value());
+  EXPECT_TRUE(r.min_cut->empty());
+  EXPECT_EQ(r.potentials, (std::vector<Cost>(3, kNeverReached)));
+  expect_certified(g, {0}, {2}, std::nullopt, r, nullptr, &no_source);
+  const std::vector<NodeId> x2 = {2};
+  auto no_dest = g.eligibility(x2, {});
+  auto rd = solve(g, {0}, {2}, std::nullopt, nullptr, &no_dest);
+  EXPECT_EQ(rd.flow_value, 0);
+  EXPECT_EQ(rd.potentials, (std::vector<Cost>{0, 1, kNeverReached}));
+  expect_certified(g, {0}, {2}, std::nullopt, rd, nullptr, &no_dest);
+  // One allowed source of two.
+  auto rs = solve(g, {0, 1}, {2}, std::nullopt, nullptr, &no_source);
+  EXPECT_EQ(rs.flow_value, 2);
+  expect_certified(g, {0, 1}, {2}, std::nullopt, rs, nullptr, &no_source);
+}
+
+TEST(FlowCore, MaskedSolvesReachTheValueOfTheirCuts) {
+  // Sources {0, 1}, destinations {3, 4} under three Eligibilities.
+  auto g = make_graph(5, {{0, 2, 2, 2}, {1, 2, 1, 1}, {2, 3, 2, 3}, {2, 4, 1, 5}});
+  const auto inv = id_of_input(g);
+  for (auto [mask, expect] : std::vector<std::pair<std::vector<std::int32_t>, Amount>>{{{}, 3}, {{1}, 2}, {{2}, 1}}) {
+    std::vector<EdgeId> excluded;
+    for (auto i : mask) excluded.push_back(inv[static_cast<std::size_t>(i)]);
+    auto el = g.eligibility({}, excluded);
+    auto r = solve(g, {0, 1}, {3, 4}, std::nullopt, nullptr, &el);
+    EXPECT_EQ(r.flow_value, expect);
+    expect_certified(g, {0, 1}, {3, 4}, std::nullopt, r, nullptr, &el);
+  }
+}
+
+TEST(FlowCore, InputValidationBeforeAnyWork) {
+  auto g = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  auto h = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  const std::vector<Amount> view = {2, 2};
+  const std::vector<NodeId> s = {0}, d = {2};
+  auto call = [&](std::vector<Amount> v, std::vector<NodeId> src, std::vector<NodeId> dst, std::optional<Amount> cap,
+                  const Eligibility* el = nullptr) {
+    return error_of([&] { (void)solve_min_cost_flow(g, v, src, dst, el, cap); });
+  };
+  EXPECT_EQ(call({2}, s, d, 1), "view has length 1, expected 2 (one entry per edge)");
+  EXPECT_EQ(call({2, 3}, s, d, 1), "view[1] = 3 is outside [0, edge_capacity_units[1] = 2]");
+  EXPECT_EQ(call({-1, 2}, s, d, 1), "view[0] = -1 is outside [0, edge_capacity_units[0] = 2]");
+  EXPECT_EQ(call(view, {}, d, 1), "sources: the node set is empty");
+  EXPECT_EQ(call(view, s, {}, 1), "destinations: the node set is empty");
+  EXPECT_EQ(call(view, {3}, d, 1), "sources: node 3 out of node range [0, 3)");
+  EXPECT_EQ(call(view, s, {-1}, 1), "destinations: node -1 out of node range [0, 3)");
+  EXPECT_EQ(call(view, {0, 2}, {2}, 1), "node 2 is in both endpoint sets: sources and destinations must not overlap");
+  EXPECT_EQ(call(view, s, d, -1), "cap -1 is outside [0, 2^63 - 2]");
+  EXPECT_EQ(call(view, s, d, kMaxFlowCap + 1), "cap 9223372036854775807 is outside [0, 2^63 - 2]");
+  auto foreign = h.eligibility();
+  EXPECT_EQ(call(view, s, d, 1, &foreign), "foreign Eligibility: built for another graph");
+  // The overlap is checked on the full sets, also when an Eligibility excludes the vertex.
+  const std::vector<NodeId> x0 = {0};
+  auto el = g.eligibility(x0, {});
+  EXPECT_EQ(call(view, {0}, {0}, 1, &el), "node 0 is in both endpoint sets: sources and destinations must not overlap");
+  // Order: the view before the endpoints, the sources before the destinations, the destinations
+  // before the overlap, the overlap before the cap, the cap before the Eligibility.
+  EXPECT_EQ(call({2}, {}, d, -1), "view has length 1, expected 2 (one entry per edge)");
+  EXPECT_EQ(call(view, {}, d, -1), "sources: the node set is empty");
+  EXPECT_EQ(call(view, {}, {}, -1, &foreign), "sources: the node set is empty");
+  EXPECT_EQ(call(view, {0, 2}, {2, 9}, -1, &foreign), "destinations: node 9 out of node range [0, 3)");
+  EXPECT_EQ(call(view, {0, 2}, {2}, -1, &foreign),
+            "node 2 is in both endpoint sets: sources and destinations must not overlap");
+  EXPECT_EQ(call(view, s, d, -1, &foreign), "cap -1 is outside [0, 2^63 - 2]");
+}
+
+// A view with several defects at once (one error, from the shared edge-amount check, labelled "view"):
+// its length before any entry, then its first entry outside [0, capacity] in EdgeId order, before
+// the endpoints, the cap and the Eligibility.
+TEST(FlowCore, ViewDefectsReportTheFirstInOrder) {
+  const auto g = edge_amount_graph();
+  const auto other = make_graph(4, {{0, 1, 2, 1}});
+  const auto foreign = other.eligibility();
+  for (const auto& c : edge_amount_defects()) {
+    EXPECT_EQ(error_of([&] { (void)solve_min_cost_flow(g, c.amounts, {}, {}, &foreign, -1); }), "view" + c.error);
+  }
+  const auto bounds = edge_amounts_at_the_bounds();
+  EXPECT_EQ(solve_min_cost_flow(g, bounds, v({0}), v({3}), nullptr, std::nullopt).flow_value, 0);
+}
+
+// A solve numbers its network in int32: the N real vertices plus s* and t*, and two arc slots per
+// edge, per source and per destination. Every solver takes its vertex count from
+// network_vertices(), called here with the counts alone, so no network of the boundary sizes is
+// allocated.
+TEST(FlowCore, NetworkSizeLimits) {
+  constexpr std::int32_t kMax = std::numeric_limits<std::int32_t>::max();
+  constexpr std::size_t kPairs = (std::size_t {1} << 30) - 1;  // twice it, 2^31 - 2, fits int32; 2^31 does not
+  constexpr std::size_t kHuge = std::numeric_limits<std::size_t>::max();
+  const std::string nodes = "flow solver node limit exceeded";
+  const std::string slots = "flow solver arc limit exceeded";
+  auto error = [](std::int32_t n, std::size_t e, std::size_t s, std::size_t d) {
+    return error_of([&] { (void)detail::network_vertices(n, e, s, d); });
+  };
+  // The vertices: N + 2, up to N = INT32_MAX - 2.
+  EXPECT_EQ(detail::network_vertices(0, 0, 0, 0), 2);
+  EXPECT_EQ(detail::network_vertices(kMax - 2, 0, 1, 1), kMax);
+  EXPECT_EQ(error(kMax - 1, 0, 1, 1), nodes);
+  EXPECT_EQ(error(kMax, 0, 1, 1), nodes);
+  // The slots: edges + sources + destinations up to 2^30 - 1, every term counted.
+  EXPECT_EQ(detail::network_vertices(2, kPairs - 2, 1, 1), 4);
+  EXPECT_EQ(error(2, kPairs - 1, 1, 1), slots);
+  EXPECT_EQ(error(2, kPairs - 1, 2, 0), slots);
+  EXPECT_EQ(error(2, kPairs - 1, 0, 2), slots);
+  EXPECT_EQ(detail::network_vertices(2, kPairs, 0, 0), 4);
+  EXPECT_EQ(detail::network_vertices(2, 0, kPairs, 0), 4);
+  EXPECT_EQ(detail::network_vertices(2, 0, 0, kPairs), 4);
+  EXPECT_EQ(error(2, kPairs + 1, 0, 0), slots);
+  EXPECT_EQ(error(2, 0, kPairs + 1, 0), slots);
+  EXPECT_EQ(error(2, 0, 0, kPairs + 1), slots);
+  // Counts whose plain sum would wrap around are refused, not wrapped into range.
+  EXPECT_EQ(error(2, kHuge, 2, 0), slots);
+  EXPECT_EQ(error(2, 0, kHuge, 2), slots);
+  EXPECT_EQ(error(2, 2, 0, kHuge), slots);
+  // The node limit is reported first.
+  EXPECT_EQ(error(kMax, kPairs + 1, 0, 0), nodes);
+}
+
+TEST(FlowCore, IdenticalCallsIdenticalPayloads) {
+  std::mt19937 rng(7);
+  int positive = 0;
+  for (int trial = 0; trial < 20; ++trial) {
+    std::vector<InEdge> edges;
+    for (int e = 0; e < 40; ++e) {
+      edges.push_back({static_cast<NodeId>(rng() % 12), static_cast<NodeId>(rng() % 12),
+                       static_cast<Amount>(rng() % 9), static_cast<Cost>(1 + rng() % 6)});
+    }
+    auto g = make_graph(12, edges);
+    auto a = solve(g, {0, 1}, {10, 11}, std::nullopt);
+    auto b = solve(g, {0, 1}, {10, 11}, std::nullopt);
+    EXPECT_TRUE(same_payload(a, b));
+    positive += a.flow_value > 0;
+  }
+  EXPECT_GT(positive, 10);  // two empty payloads would be identical too
+}
+
+namespace {
+
+struct RandomCase {
+  Graph g;
+  std::vector<NodeId> s, d;
+  std::vector<Amount> view;
+  std::optional<Amount> cap;
+  std::vector<NodeId> xn;
+  std::vector<EdgeId> xe;
+};
+
+RandomCase random_case(std::mt19937& rng, int n, int m, Amount max_cap, Cost max_edge_cost, bool masks) {
+  std::vector<InEdge> edges;
+  for (int e = 0; e < m; ++e) {
+    edges.push_back({static_cast<NodeId>(rng() % n), static_cast<NodeId>(rng() % n),
+                     static_cast<Amount>(rng() % (max_cap + 1)), static_cast<Cost>(1 + rng() % max_edge_cost)});
+  }
+  auto g = make_graph(n, edges);
+  std::vector<NodeId> nodes(static_cast<std::size_t>(n));
+  std::iota(nodes.begin(), nodes.end(), 0);
+  std::shuffle(nodes.begin(), nodes.end(), rng);
+  const int ns = 1 + static_cast<int>(rng() % static_cast<unsigned>(std::min(2, n - 1)));
+  const int nd = 1 + static_cast<int>(rng() % static_cast<unsigned>(std::min(2, n - ns)));
+  std::vector<NodeId> s(nodes.begin(), nodes.begin() + ns);
+  std::vector<NodeId> d(nodes.begin() + ns, nodes.begin() + std::min(n, ns + nd));
+  std::vector<Amount> view;
+  for (Amount c : g.edge_capacity_units()) view.push_back(rng() % 4 == 0 ? static_cast<Amount>(rng() % (c + 1)) : c);
+  std::optional<Amount> cap;
+  switch (rng() % 5) {
+    case 0: cap = std::nullopt; break;
+    case 1: cap = 0; break;
+    case 2: cap = 1; break;
+    case 3: cap = static_cast<Amount>(rng() % (2 * max_cap + 2)); break;
+    default: cap = kMaxFlowCap; break;
+  }
+  std::vector<NodeId> xn;
+  std::vector<EdgeId> xe;
+  if (masks && rng() % 2 == 0) {
+    if (rng() % 3 == 0) xn.push_back(static_cast<NodeId>(rng() % n));
+    for (int k = 0; k < 2; ++k) if (m > 0 && rng() % 2 == 0) xe.push_back(static_cast<EdgeId>(rng() % m));
+  }
+  return {std::move(g), s, d, view, cap, xn, xe};
+}
+
+// The kinds of random trials that reach a certificate branch only by chance, counted so a
+// population that stopped drawing them fails: masked (an Eligibility), stopped by a positive cap
+// below the maximum (no min_cut: the destinations stay connected) and capped at zero.
+struct Population {
+  int masked = 0;
+  int capped = 0;
+  int zero_cap = 0;
+  void count(const RandomCase& c, const Eligibility* elig, const MinCostFlowResult& r) {
+    masked += elig != nullptr ? 1 : 0;
+    capped += c.cap.has_value() && *c.cap > 0 && !r.min_cut.has_value() ? 1 : 0;
+    zero_cap += c.cap == Amount {0} ? 1 : 0;
+  }
+  void expect_at_least(int m, int c, int z) const {
+    EXPECT_GE(masked, m);
+    EXPECT_GE(capped, c);
+    EXPECT_GE(zero_cap, z);
+  }
+};
+
+} // namespace
+
+TEST(FlowCore, RandomGraphsTierAExhaustive) {
+  // Nonuniform costs, parallel edges, self-loops, partial views, endpoint sets, masks and caps;
+  // every payload certified, the curve against the minimum cost of every integer value.
+  std::mt19937 rng(20261004);
+  int positive = 0;
+  Population kinds;
+  for (int trial = 0; trial < 2000; ++trial) {
+    const int n = 2 + static_cast<int>(rng() % 4);
+    const int m = 1 + static_cast<int>(rng() % 6);
+    auto c = random_case(rng, n, m, 2, 5, true);
+    std::optional<Eligibility> el;
+    if (!c.xn.empty() || !c.xe.empty()) el = c.g.eligibility(c.xn, c.xe);
+    const Eligibility* elp = el ? &*el : nullptr;
+    auto r = solve_min_cost_flow(c.g, c.view, c.s, c.d, elp, c.cap);
+    const auto fails = certify(c.g, c.view, c.s, c.d, c.cap, elp, r, true);
+    ASSERT_TRUE(fails.empty()) << "trial " << trial << ": " << fails.front();
+    positive += r.flow_value > 0;
+    kinds.count(c, elp, r);
+  }
+  EXPECT_GT(positive, 250);  // the population is not vacuous
+  // 859, 68 and 443 at this seed with libc++: random_case's std::shuffle differs between standard
+  // libraries, so the floors stay well below the counts.
+  kinds.expect_at_least(400, 30, 200);
+}
+
+TEST(FlowCore, RandomGraphsTierBIndependent) {
+  std::mt19937 rng(1816);
+  int multi_tier = 0;
+  Population kinds;
+  for (int trial = 0; trial < 150; ++trial) {
+    const int n = 6 + static_cast<int>(rng() % 20);
+    const int m = n + static_cast<int>(rng() % (4 * n));
+    auto c = random_case(rng, n, m, 1000, 40, true);
+    std::optional<Eligibility> el;
+    if (!c.xn.empty() || !c.xe.empty()) el = c.g.eligibility(c.xn, c.xe);
+    const Eligibility* elp = el ? &*el : nullptr;
+    auto r = solve_min_cost_flow(c.g, c.view, c.s, c.d, elp, c.cap);
+    const auto fails = certify(c.g, c.view, c.s, c.d, c.cap, elp, r, false);
+    ASSERT_TRUE(fails.empty()) << "trial " << trial << ": " << fails.front();
+    multi_tier += r.marginal_cost_curve.size() > 1;
+    kinds.count(c, elp, r);
+  }
+  EXPECT_GT(multi_tier, 30);
+  kinds.expect_at_least(30, 15, 10);  // 64, 35 and 23 at this seed with libc++ (as above)
+}
+
+// The independent solver is tier b's only optimum (and the deletion and CentralizedTE tests'), so it is
+// itself checked against the exhaustive optimum: on small random graphs with partial views,
+// endpoint sets and masks, its curve has the same maximum and equals the minimum cost of every
+// integer value, many of them after two augmentations or more.
+TEST(FlowCore, IndependentSolverEqualsTheExhaustiveOptimum) {
+  // The chain with bypasses needs a cancellation: the second unit reroutes the first.
+  const auto chain = make_graph(4, chain_plus_bypasses());
+  const std::vector<Amount> unit(5, 1);
+  EXPECT_EQ(independent_curve(chain, unit, {0}, {3}, nullptr),
+            (std::vector<std::pair<Amount, Int128>> {{0, 0}, {1, 3}, {2, 8}}));
+  EXPECT_EQ(exhaustive_costs(chain, unit, {0}, {3}, nullptr), (std::map<Amount, Int128> {{0, 0}, {1, 3}, {2, 8}}));
+  std::mt19937 rng(2028);
+  int several = 0;
+  int masked = 0;
+  for (int trial = 0; trial < 1000; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 3);
+    const int m = 4 + static_cast<int>(rng() % 5);
+    const auto c = random_case(rng, n, m, 2, 5, true);
+    std::optional<Eligibility> el;
+    if (!c.xn.empty() || !c.xe.empty()) el = c.g.eligibility(c.xn, c.xe);
+    const Eligibility* elp = el ? &*el : nullptr;
+    const auto best = exhaustive_costs(c.g, c.view, c.s, c.d, elp);
+    const auto ref = independent_curve(c.g, c.view, c.s, c.d, elp);
+    ASSERT_EQ(ref.back().first, best.rbegin()->first) << "trial " << trial;
+    for (const auto& [x, cost] : best) ASSERT_EQ(curve_at(ref, x), cost) << "trial " << trial << " value " << x;
+    several += ref.size() > 2;
+    masked += elp != nullptr && ref.size() > 1;
+  }
+  // Not vacuous: curves of two augmentations or more, and masked cases with a positive flow (91
+  // and 116 at this seed with libc++, whose std::shuffle in random_case another standard library
+  // does not reproduce).
+  EXPECT_GT(several, 60);
+  EXPECT_GT(masked, 90);
+}
+
+TEST(FlowCore, RandomLargeUnitsTierB) {
+  // Capacities near the domain bound (sum below 2^62) and costs near 2^40.
+  std::mt19937_64 rng(62);
+  int positive = 0;
+  for (int trial = 0; trial < 40; ++trial) {
+    const int n = 4 + static_cast<int>(rng() % 6);
+    const int m = 3 + static_cast<int>(rng() % 12);
+    std::vector<InEdge> edges;
+    const Amount per = ((Amount{1} << 62) - 1) / m;
+    for (int e = 0; e < m; ++e) {
+      edges.push_back({static_cast<NodeId>(rng() % n), static_cast<NodeId>(rng() % n),
+                       static_cast<Amount>(rng() % static_cast<std::uint64_t>(per)),
+                       static_cast<Cost>(1 + rng() % (std::uint64_t{1} << 40))});
+    }
+    auto g = make_graph(n, edges);
+    std::vector<Amount> view(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+    auto r = solve_min_cost_flow(g, view, std::vector<NodeId>{0}, std::vector<NodeId>{static_cast<NodeId>(n - 1)},
+                                nullptr, std::nullopt);
+    const auto fails = certify(g, view, {0}, {n - 1}, std::nullopt, nullptr, r, false);
+    ASSERT_TRUE(fails.empty()) << "trial " << trial << ": " << fails.front();
+    positive += r.flow_value > 0;
+  }
+  // Only a positive flow reaches the arithmetic near the bound, and many of these sparse random
+  // graphs place nothing, so the trials that place something are counted.
+  EXPECT_GT(positive, 10);
+}
+
+TEST(FlowCore, CertificateRejectsMutatedPayloads) {
+  // The test oracle itself is not vacuous: each negative control below is rejected by the clause
+  // it breaks. Every clean payload certifies first, so the rejection comes from the mutation.
+  auto one = make_graph(2, {{0, 1, 3, 7}});
+  std::vector<Amount> v1 = {3};
+  auto under = solve(one, {0}, {1}, 1);
+  ASSERT_TRUE(certify(one, v1, {0}, {1}, 1, nullptr, under, true).empty());
+  // A flow of 1 under cap 2 with the edge still open.
+  EXPECT_TRUE(has_failure(certify(one, v1, {0}, {1}, 2, nullptr, under, true), "attained value: early stop"));
+  // The same payload without a cap, in both branches: an uncapped solve must be maximal, so the
+  // two clauses that prove it fail and nothing else does (the curve up to the placed unit is
+  // optimal): the destination is still reachable, and 1 is not F_max = 3.
+  for (const bool tier_a : {true, false}) {
+    EXPECT_EQ(certify(one, v1, {0}, {1}, std::nullopt, nullptr, under, tier_a),
+              (std::vector<std::string> {"uncapped solve left the destinations connected",
+                                         "placed differs from min(cap, F_max)"}))
+        << tier_a;
+  }
+  auto slope = solve(one, {0}, {1}, 2);
+  ASSERT_TRUE(certify(one, v1, {0}, {1}, 2, nullptr, slope, true).empty());
+  slope.marginal_cost_curve = curve({{6, 2}});  // moment 12, the flow costs 14
+  EXPECT_TRUE(has_failure(certify(one, v1, {0}, {1}, 2, nullptr, slope, true), "curve moment differs"));
+  // The curve-shape clauses, each the only failure in both branches: an entry of volume 0 before
+  // the real one (an empty curve segment, which the curve comparison must skip, not divide by its
+  // zero length), and the one tier split in two at the same cost. Total, moment and pi(t*) hold.
+  auto full = solve(one, {0}, {1}, std::nullopt);
+  ASSERT_EQ(full.marginal_cost_curve, curve({{7, 3}}));
+  for (const bool tier_a : {true, false}) {
+    ASSERT_TRUE(certify(one, v1, {0}, {1}, std::nullopt, nullptr, full, tier_a).empty()) << tier_a;
+    auto empty_entry = full;
+    empty_entry.marginal_cost_curve = curve({{6, 0}, {7, 3}});
+    EXPECT_EQ(certify(one, v1, {0}, {1}, std::nullopt, nullptr, empty_entry, tier_a),
+              std::vector<std::string> {"curve volume not positive"})
+        << tier_a;
+    auto split = full;
+    split.marginal_cost_curve = curve({{7, 1}, {7, 2}});
+    EXPECT_EQ(certify(one, v1, {0}, {1}, std::nullopt, nullptr, split, tier_a),
+              std::vector<std::string> {"curve costs not strictly increasing"})
+        << tier_a;
+  }
+  auto cut = solve(one, {0}, {1}, std::nullopt);
+  ASSERT_TRUE(certify(one, v1, {0}, {1}, std::nullopt, nullptr, cut, true).empty());
+  cut.min_cut = std::vector<EdgeId>{};
+  EXPECT_TRUE(has_failure(certify(one, v1, {0}, {1}, std::nullopt, nullptr, cut, true), "min_cut differs"));
+  auto par = make_graph(2, {{0, 1, 1, 1}, {0, 1, 1, 3}});
+  std::vector<Amount> vp = {1, 1};
+  auto omitted = solve(par, {0}, {1}, std::nullopt);
+  ASSERT_TRUE(certify(par, vp, {0}, {1}, std::nullopt, nullptr, omitted, true).empty());
+  omitted.marginal_cost_curve = curve({{2, 2}});  // same moment, omitted breakpoint at 1
+  EXPECT_TRUE(has_failure(certify(par, vp, {0}, {1}, std::nullopt, nullptr, omitted, true),
+                          "curve differs from the exhaustive optimum at 1"));
+  EXPECT_TRUE(has_failure(certify(par, vp, {0}, {1}, std::nullopt, nullptr, omitted, false),
+                          "curve differs from the independent solver at 1"));
+  auto any = make_graph(3, {{0, 1, 1, 1}, {0, 2, 1, 2}});
+  std::vector<Amount> va = {1, 1};
+  auto pot = solve(any, {0}, {1, 2}, std::nullopt);
+  ASSERT_TRUE(certify(any, va, {0}, {1, 2}, std::nullopt, nullptr, pot, true).empty());
+  pot.potentials[1] = 1;  // an inflow destination below pi(t*)
+  EXPECT_TRUE(has_failure(certify(any, va, {0}, {1, 2}, std::nullopt, nullptr, pot, true),
+                          "inflow destination potential differs"));
+  auto sentinel = solve(one, {0}, {1}, 1);
+  ASSERT_TRUE(certify(one, v1, {0}, {1}, 1, nullptr, sentinel, true).empty());
+  sentinel.potentials = {kNeverReached, kNeverReached};
+  EXPECT_TRUE(has_failure(certify(one, v1, {0}, {1}, 1, nullptr, sentinel, true), "closure vertex holds NEVER_REACHED"));
+  auto zero = solve(one, {0}, {1}, 0);
+  ASSERT_TRUE(certify(one, v1, {0}, {1}, 0, nullptr, zero, true).empty());
+  zero.counters.dijkstra_runs = 1;
+  EXPECT_TRUE(has_failure(certify(one, v1, {0}, {1}, 0, nullptr, zero, true), "zero cap: the prescribed zero payload"));
+
+  // The flow clauses. Two parallel edges of capacity 1 and cost 1 carry one unit each; both
+  // units on EdgeId 0 keep the value, conservation and the cost but exceed its view of 1.
+  auto twin = make_graph(2, {{0, 1, 1, 1}, {0, 1, 1, 1}});
+  std::vector<Amount> vt = {1, 1};
+  auto over = solve(twin, {0}, {1}, std::nullopt);
+  ASSERT_TRUE(certify(twin, vt, {0}, {1}, std::nullopt, nullptr, over, true).empty());
+  ASSERT_EQ(over.edge_flows, (std::vector<Amount>{1, 1}));
+  over.edge_flows = {2, 0};
+  EXPECT_TRUE(has_failure(certify(twin, vt, {0}, {1}, std::nullopt, nullptr, over, true), "feasibility at edge 0"));
+  // EdgeId 1 masked: the solve uses EdgeId 0; moving its unit to EdgeId 1 puts flow on the
+  // ineligible edge at the same cost.
+  const std::vector<EdgeId> second = {1};
+  const auto mask = twin.eligibility({}, second);
+  auto masked = solve(twin, {0}, {1}, std::nullopt, nullptr, &mask);
+  ASSERT_TRUE(certify(twin, vt, {0}, {1}, std::nullopt, &mask, masked, true).empty());
+  ASSERT_EQ(masked.edge_flows, (std::vector<Amount>{1, 0}));
+  masked.edge_flows = {0, 1};
+  EXPECT_TRUE(has_failure(certify(twin, vt, {0}, {1}, std::nullopt, &mask, masked, true),
+                          "flow on an ineligible edge 1"));
+  // The chain 0 -> 1 -> 2 carries 2 units; one unit less out of node 1 leaves it unbalanced.
+  auto chain = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  std::vector<Amount> vc = {2, 2};
+  auto leak = solve(chain, {0}, {2}, std::nullopt);
+  ASSERT_TRUE(certify(chain, vc, {0}, {2}, std::nullopt, nullptr, leak, true).empty());
+  const auto out_of_1 = static_cast<std::size_t>(chain.edge_sources()[0] == 1 ? 0 : 1);
+  leak.edge_flows[out_of_1] = 1;
+  EXPECT_TRUE(has_failure(certify(chain, vc, {0}, {2}, std::nullopt, nullptr, leak, true), "conservation at node 1"));
+  // The same chain with capacities 5, capped at 1: every vertex is in the closure with
+  // potentials (0, 1, 2). Raising pi(1) to 3 makes the reduced costs of 0 -> 1 (1 + 0 - 3) and of
+  // the backward arc 2 -> 1 (-1 + 2 - 3) negative; pi(t*) = 2 is still the last curve cost, so
+  // these two are the only failures.
+  auto wide_chain = make_graph(3, {{0, 1, 5, 1}, {1, 2, 5, 1}});
+  std::vector<Amount> vw = {5, 5};
+  auto reduced = solve(wide_chain, {0}, {2}, 1);
+  ASSERT_TRUE(certify(wide_chain, vw, {0}, {2}, 1, nullptr, reduced, true).empty());
+  ASSERT_EQ(reduced.potentials, (std::vector<Cost>{0, 1, 2}));
+  reduced.potentials[1] = 3;
+  EXPECT_EQ(certify(wide_chain, vw, {0}, {2}, 1, nullptr, reduced, true),
+            (std::vector<std::string>{"negative reduced cost inside the closure",
+                                      "negative reduced cost inside the closure"}));
+}
+
+TEST(FlowCore, CertificateRejectsEveryOtherClause) {
+  // The clauses (and each condition of a clause with several) that the test above does not reach,
+  // one control each. `mutated` solves on the full capacities, certifies the clean payload, then
+  // returns the failed clauses of the mutated copy. A control expects the exact list where the
+  // mutation can break one clause alone, else the clause it targets among those it also breaks.
+  using Mutation = std::function<void(MinCostFlowResult&)>;
+  auto mutated = [](const Graph& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+                    std::optional<Amount> cap, const Eligibility* el, const Mutation& mutate) {
+    std::vector<Amount> view(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+    auto r = solve_min_cost_flow(g, view, s, d, el, cap);
+    EXPECT_TRUE(certify(g, view, s, d, cap, el, r, true).empty());
+    mutate(r);
+    return certify(g, view, s, d, cap, el, r, true);
+  };
+  using Fails = std::vector<std::string>;
+  // One edge 0 -> 1 of capacity 3 and cost 7. Uncapped, the edge is saturated, so the closure is
+  // {0} and the destination's potential (7) is pinned only by the last curve cost; under cap 1 the
+  // destination stays in the closure.
+  const auto one = make_graph(2, {{0, 1, 3, 7}});
+  const auto s = v({0});
+  const auto d = v({1});
+  // The shape: either array one entry too long.
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.edge_flows.push_back(0); }), Fails{"shape"});
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials.push_back(0); }), Fails{"shape"});
+  // The zero-cap payload, each of its fields alone (the counters are the test above's control).
+  const std::vector<Mutation> nonzero = {
+      [](auto& r) { r.flow_value = 1; },
+      [](auto& r) { r.marginal_cost_curve = curve({{7, 1}}); },
+      [](auto& r) { r.min_cut = std::vector<EdgeId>{}; },
+      [](auto& r) { r.edge_flows[0] = 1; },
+      [](auto& r) { r.potentials[0] = 0; },
+  };
+  for (std::size_t k = 0; k < nonzero.size(); ++k) {
+    EXPECT_EQ(mutated(one, s, d, 0, nullptr, nonzero[k]), Fails{"zero cap: the prescribed zero payload"}) << k;
+  }
+  // A negative edge flow (the test above sends one above the view).
+  EXPECT_TRUE(has_failure(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.edge_flows[0] = -1; }),
+                          "feasibility at edge 0"));
+  // Sources {0, 1}, destination 2, edges 0 -> 1 and 1 -> 2: source 1 sends its unit directly.
+  // Moving it to 0 -> 1 makes source 1 absorb a unit.
+  const auto two_sources = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  const auto ts = id_of_input(two_sources);
+  EXPECT_TRUE(has_failure(mutated(two_sources, v({0, 1}), v({2}), std::nullopt, nullptr,
+                                  [&](auto& r) {
+                                    r.edge_flows[static_cast<std::size_t>(ts[0])] = 1;
+                                    r.edge_flows[static_cast<std::size_t>(ts[1])] = 0;
+                                  }),
+                          "source absorbs flow"));
+  // The same edges with destinations {1, 2} and source 0: the unit stops at destination 1;
+  // moving it to 1 -> 2 makes destination 1 emit a unit.
+  EXPECT_TRUE(has_failure(mutated(two_sources, v({0}), v({1, 2}), std::nullopt, nullptr,
+                                  [&](auto& r) {
+                                    r.edge_flows[static_cast<std::size_t>(ts[0])] = 0;
+                                    r.edge_flows[static_cast<std::size_t>(ts[1])] = 1;
+                                  }),
+                          "destination emits flow"));
+  // Excluded endpoints: 0 -> 2 and 1 -> 2 with sources {0, 1} and source 0 excluded (and with it
+  // the edge 0 -> 2); a unit on 0 -> 2 is supplied by the excluded source. Mirrored, 0 -> 1 and
+  // 0 -> 2 with destinations {1, 2} and destination 2 excluded.
+  const auto into_2 = make_graph(3, {{0, 2, 1, 1}, {1, 2, 1, 1}});
+  const auto x0 = into_2.eligibility(v({0}), {});
+  EXPECT_TRUE(has_failure(
+      mutated(into_2, v({0, 1}), v({2}), std::nullopt, &x0,
+              [&](auto& r) { r.edge_flows[static_cast<std::size_t>(id_of_input(into_2)[0])] = 1; }),
+      "excluded source supplies"));
+  const auto out_of_0 = make_graph(3, {{0, 1, 1, 1}, {0, 2, 1, 1}});
+  const auto x2 = out_of_0.eligibility(v({2}), {});
+  EXPECT_TRUE(has_failure(
+      mutated(out_of_0, v({0}), v({1, 2}), std::nullopt, &x2,
+              [&](auto& r) { r.edge_flows[static_cast<std::size_t>(id_of_input(out_of_0)[1])] = 1; }),
+      "excluded destination receives"));
+  // The value against the supply alone and the inflow alone: on the chain 0 -> 1 -> 2 carrying
+  // 2, one unit less into node 1 lowers the supply only, one unit less out of it the inflow only.
+  const auto chain = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  for (const int edge : {0, 1}) {
+    EXPECT_TRUE(has_failure(
+        mutated(chain, s, v({2}), std::nullopt, nullptr,
+                [&](auto& r) { r.edge_flows[static_cast<std::size_t>(id_of_input(chain)[edge])] = 1; }),
+        "value differs from supply or inflow"))
+        << edge;
+  }
+  // placed outside [0, cap]: above the cap, and negative without one.
+  EXPECT_TRUE(has_failure(mutated(one, s, d, 1, nullptr, [](auto& r) { r.flow_value = 2; }), "placed outside [0, cap]"));
+  EXPECT_TRUE(
+      has_failure(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.flow_value = -1; }), "placed outside [0, cap]"));
+  // The cut: present while cap 1 leaves the destination reachable, missing on the maximal solve,
+  // and its value (3) against a lowered flow value (which also breaks the value and the curve total).
+  EXPECT_EQ(mutated(one, s, d, 1, nullptr, [](auto& r) { r.min_cut = std::vector<EdgeId>{}; }),
+            Fails{"min_cut present on a connected solve"});
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.min_cut.reset(); }),
+            Fails{"min_cut missing on a maximal solve"});
+  EXPECT_TRUE(
+      has_failure(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.flow_value = 2; }), "cut value differs from placed"));
+  // The potentials: node 1's (outside the closure) below the sentinel (also below pi(t*)), the
+  // root's (the closure), pi(t*) against the last curve cost, and no destination potential at all
+  // although 3 units arrive (node 1 is reached at zero flow, so the sentinel also breaks that
+  // clause).
+  EXPECT_TRUE(has_failure(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials[1] = kNeverReached - 1; }),
+                          "potential below the sentinel"));
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials[0] = 1; }),
+            Fails{"allowed root with potential other than 0"});
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials[1] = 8; }),
+            Fails{"pi(t*) differs from the last curve cost"});
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials[1] = kNeverReached; }),
+            (Fails{"NEVER_REACHED differs from reachability at zero flow at node 1",
+                   "flow delivered but no destination reached"}));
+  // The sentinel against reachability at zero flow, each direction alone. On 0 -> 1 and 2 -> 1
+  // nothing reaches node 2, which must hold NEVER_REACHED, not 0 or another value. On 0 -> 1
+  // (capacity 3, cost 7) and 1 -> 2, uncapped, the first search settles node 2 through node 1 and
+  // the saturated edge then leaves both outside the closure: node 2 must not hold NEVER_REACHED.
+  const auto unreached = make_graph(3, {{0, 1, 1, 1}, {2, 1, 1, 1}});
+  for (const Cost p : {Cost {0}, Cost {123456}}) {
+    EXPECT_EQ(mutated(unreached, s, d, std::nullopt, nullptr, [&](auto& r) { r.potentials[2] = p; }),
+              Fails{"NEVER_REACHED differs from reachability at zero flow at node 2"})
+        << p;
+  }
+  const auto beyond = make_graph(3, {{0, 1, 3, 7}, {1, 2, 1, 1}});
+  EXPECT_EQ(mutated(beyond, s, d, std::nullopt, nullptr, [](auto& r) { r.potentials[2] = kNeverReached; }),
+            Fails{"NEVER_REACHED differs from reachability at zero flow at node 2"});
+  // The curve total: a free tier of 1 before the real one keeps the moment (21) and pi(t*), and
+  // the curve then also differs from the optimum at 1.
+  EXPECT_EQ(mutated(one, s, d, std::nullopt, nullptr, [](auto& r) { r.marginal_cost_curve = curve({{0, 1}, {7, 3}}); }),
+            (Fails{"curve total differs from placed", "curve differs from the exhaustive optimum at 1"}));
+}
diff --git a/tests/cpp/pooled_source_allocation_tests.cpp b/tests/cpp/pooled_source_allocation_tests.cpp
new file mode 100644
index 0000000..c706e19
--- /dev/null
+++ b/tests/cpp/pooled_source_allocation_tests.cpp
@@ -0,0 +1,1170 @@
+// One demand, several sources (docs/semantics.md, section 7): the configuration table and its
+// error order, the pooled single-path rule, pooled ShortestPaths splitting (one split per shared
+// router, attribution by highest averages, the equal source allocation's entry that cannot pass anything,
+// Lossy forwarding through a source, weights frozen per epoch, the first-hop experiment),
+// increments and zero calls, the controllers (CentralizedTE and ShortestPaths Optimized) under both source allocations,
+// min_cut as its own output, the result's accounting and per-source rows, the terminations and
+// the evaluators. Each test checks hand-derived values on small graphs whose EdgeIds equal their
+// input positions (asserted). The property tests check the controllers' certificates (conservation,
+// maximality under the source allocation, no negative residual cycle) with an independent augmenting-path
+// maximum flow and Bellman-Ford, and pooled records against their own routes; the pooled
+// forwarding itself is compared with an independent reference in tests/py/test_pooled.py.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <array>
+#include <memory>
+#include <optional>
+#include <random>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+using Drops = std::vector<std::pair<EdgeId, Amount>>;
+using Counters = std::vector<std::pair<EdgeId, Counter128>>;
+using Row = std::array<Amount, 6>;  // source, offered (-1: none), admitted, delivered, source loss, dropped
+
+constexpr Amount kNone = -1;
+
+Counter128 c(Amount x) { return Counter128 {0, static_cast<std::uint64_t>(x)}; }
+Amount lo(const Counter128& x) {
+  EXPECT_EQ(x.hi, 0U);
+  return static_cast<Amount>(x.lo);
+}
+Amount lo(const std::optional<Counter128>& x) { return x.has_value() ? lo(*x) : kNone; }
+
+std::vector<Row> rows(const PlacementResult& r) {
+  std::vector<Row> out;
+  for (const auto& s : r.by_source) {
+    out.push_back({s.source, lo(s.offered), lo(s.admitted), s.delivered, lo(s.source_drops), lo(s.total_edge_drops)});
+  }
+  return out;
+}
+
+// A graph whose rows are already in EdgeId order (source, cost, destination, input).
+std::shared_ptr<const Graph> ordered(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+
+// The ledger's graphs: (u, v, capacity, cost) in EdgeId order.
+const std::vector<InEdge> kPool = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}, {2, 3, 1, 1}};  // {0, 1} -> 3
+const std::vector<InEdge> kB1 = {{0, 3, 2, 1}, {1, 2, 10, 1}, {2, 3, 10, 2}};                // {0, 1} -> 3
+const std::vector<InEdge> kB2 = {{0, 1, 4, 1}, {0, 2, 2, 1}, {1, 2, 10, 1}};                 // {0, 1} -> 2
+const std::vector<InEdge> kB2S = {{0, 2, 2, 1}, {1, 2, 10, 1}};                              // {0, 1} -> 2
+const std::vector<InEdge> kB3Z = {{0, 2, 0, 1}, {1, 2, 10, 1}};                              // {0, 1} -> 2
+const std::vector<InEdge> kB3P = {{0, 2, 10, 1}, {1, 2, 0, 1}};                              // {0, 1} -> 2
+const std::vector<InEdge> kES = {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 2, 1}, {2, 3, 10, 2}};  // 0 -> 3
+const std::vector<InEdge> kR4 = {{0, 2, 2, 9}, {1, 2, 10, 1}};                               // {0, 1} -> 2
+const std::vector<InEdge> kInc = {{0, 2, 1, 1}, {1, 2, 3, 1}};                               // {0, 1} -> 2
+const std::vector<InEdge> kOne = {{0, 1, 10, 1}};
+const std::vector<InEdge> kRc = {{0, 1, 1, 1}, {0, 1, 1, 1}};
+const std::vector<InEdge> kPar = {{0, 1, 5, 1}, {0, 1, 8, 1}};
+const std::vector<InEdge> kChain = {{0, 2, 3, 1}, {1, 0, 10, 1}};  // {0, 1} -> 2, source 1 passes source 0
+const std::vector<InEdge> kSnap = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 3, 10, 1}};  // {0, 1} -> 3
+const std::vector<InEdge> kZero = {{0, 1, 0, 1}};
+const std::vector<InEdge> kSpf = {{0, 1, 0, 1}, {0, 2, 5, 1}, {2, 1, 5, 1}};                  // 0 -> 1
+const std::vector<InEdge> kRows = {{0, 3, 5, 1}, {1, 2, 5, 1}, {4, 3, 5, 1}};                 // {0, 1, 4} -> 3
+const std::vector<InEdge> kPriv = {{0, 2, 4, 1}, {1, 2, 6, 1}};                               // {0, 1} -> 2
+const std::vector<InEdge> kWit = {{0, 1, 1, 1}, {0, 2, 1, 1}, {1, 0, 1, 1}};                  // 0 -> 2
+
+std::shared_ptr<const Graph> graph(const std::vector<InEdge>& edges) {
+  NodeId n = 0;
+  for (const auto& e : edges) n = std::max({n, e.u + 1, e.v + 1});
+  return ordered(n, edges);
+}
+
+ShortestPaths sel(RouteTieBreak t = RouteTieBreak::FewerHops, bool multipath = true, bool parallel_edges = true) {
+  ShortestPaths sp;
+  sp.tie_break = t;
+  sp.multipath = multipath;
+  sp.parallel_edges = parallel_edges;
+  return sp;
+}
+
+// ShortestPaths with the allocation `k`, the route choice of `s` and the source allocation `o`.
+FlowPolicyConfig shortest_paths_policy(RouteAllocation k = RouteAllocation::Equal, Admission a = Admission::Lossless,
+                           ShortestPaths s = {}, std::optional<SourceAllocation> o = std::nullopt) {
+  s.allocation = k;
+  s.source_allocation = o;
+  return FlowPolicyConfig {s, a};
+}
+// CentralizedTE with the source allocation `o` (OPTIMIZED when absent, the exact maximum flow).
+FlowPolicyConfig glob(std::optional<SourceAllocation> o = std::nullopt) {
+  return FlowPolicyConfig {.routing = centralized(o.value_or(SourceAllocation::Optimized))};
+}
+
+const ShortestPaths kPreferPath = sel(RouteTieBreak::HigherCapacity, false);
+const std::string kQ12 = "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False";
+const OutputOptions kEdges {true, false, false, false};
+const OutputOptions kCut {false, false, false, true};
+const OutputOptions kAll {true, true, true, true};
+
+// A policy on a fresh ledger (an optional baseline residual) of its own graph.
+struct Case {
+  std::shared_ptr<const Graph> g;
+  FlowLedger ledger;
+  std::optional<Eligibility> mask;
+  std::unique_ptr<FlowPolicy> p;
+  Case(const std::vector<InEdge>& edges, std::vector<NodeId> s, std::vector<NodeId> t, const FlowPolicyConfig& cfg,
+       std::vector<NodeId> xn = {}, std::vector<Amount> residual = {})
+      : g(graph(edges)), ledger(residual.empty() ? FlowLedger(g) : FlowLedger(g, residual)) {
+    if (!xn.empty()) mask = g->eligibility(xn, {});
+    p = std::make_unique<FlowPolicy>(ledger, s, t, cfg, mask ? &*mask : nullptr);
+  }
+  PlacementResult place(std::optional<Amount> v, const OutputOptions& o = {}) { return p->place(v, o); }
+  std::vector<std::pair<std::vector<std::pair<EdgeId, Amount>>, Amount>> records() const {
+    std::vector<std::pair<std::vector<std::pair<EdgeId, Amount>>, Amount>> out;
+    for (const auto& r : p->records()) out.emplace_back(r.edge_flows, r.delivered);
+    return out;
+  }
+};
+
+std::string construct_error(const std::vector<InEdge>& edges, std::vector<NodeId> s, std::vector<NodeId> t,
+                            const FlowPolicyConfig& cfg, std::vector<NodeId> xn = {}) {
+  auto g = graph(edges);
+  FlowLedger fg(g);
+  const auto mask = g->eligibility(xn, {});
+  return error_of([&] { FlowPolicy p(fg, s, t, cfg, xn.empty() ? nullptr : &mask); });
+}
+
+}  // namespace
+
+// ---------------------------------------------------------------- configuration
+
+// Each defect's text, at a policy and at evaluate_demand(). ShortestPaths() is ECMP (its allocation has a
+// default), and the source allocation lives in the model that reads it (DistributedTE and Pinned
+// have none, so their old texts are gone).
+TEST(ConfigOrigin, MatrixTexts) {
+  const std::vector<std::pair<FlowPolicyConfig, std::string>> rows = {
+      {FlowPolicyConfig {.routing = ShortestPaths {}}, ""},
+      {shortest_paths_policy(RouteAllocation::Equal, Admission::Lossless, {}, SourceAllocation::Optimized),
+       "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL"},
+      {shortest_paths_policy(RouteAllocation::Weighted, Admission::Lossless, {}, SourceAllocation::Optimized),
+       "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL"},
+      {shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossy), "ShortestPaths OPTIMIZED requires admission=LOSSLESS"},
+      {FlowPolicyConfig {.routing = centralized(), .admission = Admission::Lossy},
+       "CentralizedTE without tunnel_count requires admission=LOSSLESS"},
+      {FlowPolicyConfig {.routing = centralized(SourceAllocation::Equal), .admission = Admission::Lossy},
+       "CentralizedTE without tunnel_count requires admission=LOSSLESS"},
+      {FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, {}, TunnelCount {2}), .admission = Admission::Lossy},
+       "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL"},
+  };
+  const auto g = graph(kB1);
+  for (const auto& [cfg, text] : rows) {
+    EXPECT_EQ(construct_error(kB1, {0, 1}, {3}, cfg), text);
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, v({0, 1}), v({3}), EvaluationOptions {cfg}); }), text);
+  }
+  // Pinned takes its source allocation from its program; both admissions.
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0})});
+  const auto pinned_error = [&](const FlowPolicyConfig& c) {
+    FlowLedger fg(g);
+    return error_of([&] { FlowPolicy p(fg, v({0}), v({3}), c); });
+  };
+  EXPECT_EQ(pinned_error(FlowPolicyConfig {.routing = pin, .admission = Admission::Lossy}), "");
+  EXPECT_EQ(pinned_error(FlowPolicyConfig {.routing = pin}), "");
+  // Only ShortestPaths reads a cache (policy and evaluators).
+  ShortestPathCache cache(*g);
+  FlowLedger fg(g);
+  const std::vector<std::tuple<FlowPolicyConfig, std::vector<NodeId>, std::string>> cached = {
+      {glob(), {0, 1}, "CentralizedTE does not use ShortestPathCache"},
+      {FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}}, {0, 1}, "DistributedTE does not use ShortestPathCache"},
+      {FlowPolicyConfig {.routing = pin}, {0}, "Pinned does not use ShortestPathCache"},
+  };
+  for (const auto& [cfg, s, text] : cached) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, s, v({3}), cfg, nullptr, &cache); }), text);
+    EXPECT_EQ(error_of([&] { (void)evaluate_demand(*g, s, v({3}), EvaluationOptions {cfg, nullptr, &cache}); }), text);
+    EXPECT_EQ(error_of([&] { (void)evaluate_edge_failures(*g, s, v({3}), EvaluationOptions {cfg, nullptr, &cache}, 1); }), text);
+  }
+  EXPECT_EQ(cache.stats().misses + cache.stats().hits, 0);
+}
+
+// The source allocation, then the admission, then the route-choice rules; the matrix before the
+// cache check.
+TEST(ConfigOrigin, MatrixOrder) {
+  EXPECT_EQ(construct_error(kB1, {0, 1}, {3}, FlowPolicyConfig {centralized(SourceAllocation::Equal), Admission::Lossy}),
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS");
+  EXPECT_EQ(construct_error(kPool, {0, 1}, {3},
+                            shortest_paths_policy(RouteAllocation::Equal, Admission::Lossless, kPreferPath, SourceAllocation::Optimized)),
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL");
+  const auto g = graph(kB1);
+  ShortestPathCache cache(*g);
+  FlowLedger fg(g);
+  EXPECT_EQ(error_of([&] {
+              FlowPolicy p(fg, v({0, 1}), v({3}), FlowPolicyConfig {.routing = centralized(), .admission = Admission::Lossy},
+                           nullptr, &cache);
+            }),
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS");
+}
+
+// The endpoints come before the ownership of the mask.
+TEST(ConfigOrigin, EndpointsBeforeOwnership) {
+  const auto g = graph(kB1);
+  const auto other = graph(kB1);
+  const auto foreign = other->eligibility(v({0}), {});
+  FlowLedger fg(g);
+  const auto text = error_of([&] { FlowPolicy p(fg, std::vector<NodeId> {}, v({3}), glob(), &foreign); });
+  EXPECT_FALSE(text.empty());
+  EXPECT_FALSE(contains(text, "foreign")) << text;
+}
+
+// Finite after infinite, place(0) included, until remove().
+TEST(ConfigOrigin, FiniteAfterInfinite) {
+  for (const auto& cfg : {shortest_paths_policy(), glob(), shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy)}) {
+    Case k(kOne, {0}, {1}, cfg);
+    (void)k.place(std::nullopt);
+    for (Amount x : {Amount {1}, Amount {0}}) {
+      EXPECT_EQ(error_of([&] { (void)k.place(x); }), "finite placement after infinite placement requires a new epoch");
+    }
+    k.p->remove();
+    EXPECT_EQ(k.place(1).call_delivered, 1);
+  }
+}
+
+// ---------------------------------------------------------------- the pooled single-path rule
+
+// Two normalized input sources (also when a mask leaves one) reject HIGHER_*
+// single paths for every kernel; one source and multipath are accepted.
+TEST(PooledSinglePath, Rejected) {
+  for (auto k : {RouteAllocation::Equal, RouteAllocation::Weighted, RouteAllocation::Optimized}) {
+    EXPECT_EQ(construct_error(kPool, {0, 1}, {3}, shortest_paths_policy(k, Admission::Lossless, kPreferPath)), kQ12);
+    EXPECT_EQ(construct_error(kPool, {0, 1}, {3}, shortest_paths_policy(k, Admission::Lossless, kPreferPath), {1}), kQ12);
+    EXPECT_EQ(construct_error(kPool, {0, 0}, {3}, shortest_paths_policy(k, Admission::Lossless, kPreferPath)), "");
+    EXPECT_EQ(construct_error(kPool, {0, 1}, {3},
+                              shortest_paths_policy(k, Admission::Lossless, sel(RouteTieBreak::HigherCapacity, true, false))),
+              "");
+  }
+}
+
+// FEWER_HOPS single paths pool: 0: [e0, e2], 1: [e1, e2] (equal cost and hops: e2).
+TEST(PooledSinglePath, DeterministicPaths) {
+  const auto det = sel(RouteTieBreak::FewerHops, false);
+  Case k(kPool, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossless, det));
+  const auto r = k.place(std::nullopt);
+  EXPECT_EQ(r.call_delivered, 1);
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, kNone, 1, 1, 0, 0}, {1, kNone, 0, 0, 0, 0}}));
+  Case lossy(kPool, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy, det));
+  const auto l = lossy.place(2);
+  EXPECT_EQ(l.call_delivered, 1);
+  EXPECT_EQ(l.call_edge_drops, (Drops {{2, 1}}));
+  EXPECT_EQ(rows(l), (std::vector<Row> {{0, 1, 1, 1, 0, 0}, {1, 1, 1, 0, 0, 1}}));
+  const auto recs = lossy.p->records();
+  ASSERT_EQ(recs.size(), 2U);
+  EXPECT_EQ(ascending_edges(*recs[0].route), (std::vector<EdgeId> {0, 2}));
+  EXPECT_EQ(ascending_edges(*recs[1].route), (std::vector<EdgeId> {1, 2}));
+}
+
+// ---------------------------------------------------------------- pooled ShortestPaths
+
+// One split at the shared router, attributed member by member.
+TEST(Pooled, SharedRouterSplitsOnce) {
+  Case k(kPool, {0, 1}, {3}, shortest_paths_policy());
+  const auto r = k.place(2, kEdges);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(*r.edge_flows, (std::vector<Amount> {1, 1, 1, 1}));
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, kNone, 1, 1, 0, 0}, {1, kNone, 1, 1, 0, 0}}));
+  EXPECT_EQ(k.records(), (decltype(k.records()) {{{{0, 1}, {2, 1}}, 1}, {{{1, 1}, {3, 1}}, 1}}));
+  Case inf(kPool, {0, 1}, {3}, shortest_paths_policy());
+  const auto i = inf.place(std::nullopt);
+  EXPECT_EQ(i.call_delivered, 2);
+  EXPECT_EQ(i.termination, Termination::Exhausted);
+  EXPECT_FALSE(i.requested.has_value());
+  EXPECT_FALSE(i.unadmitted.has_value());
+  EXPECT_FALSE(i.call_undelivered.has_value());
+  Case w(kPool, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Weighted));
+  EXPECT_EQ(w.place(2).call_delivered, 2);
+}
+
+// Each member's arrivals divided by what each source brought.
+TEST(Pooled, LossyAttributionByArrivals) {
+  Case k(kPool, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto r = k.place(4);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{2, 1}, {3, 1}}));
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, 2, 2, 2, 0, 0}, {1, 2, 2, 0, 0, 2}}));
+  for (const auto& rec : k.p->records()) expect_conserved(*k.g, rec, "Lossy attribution by arrivals");
+}
+
+// Lossless admits only totals that give the
+// source behind the zero edge nothing; Lossy drops its share on that edge.
+TEST(Pooled, EqualEntryThatCannotPass) {
+  for (const auto& [edges, want] : {std::pair {kB3Z, Amount {0}}, std::pair {kB3P, Amount {1}}}) {
+    Case eb(edges, {0, 1}, {2}, shortest_paths_policy());
+    const auto r = eb.place(10);
+    EXPECT_EQ(r.call_delivered, want);
+    EXPECT_EQ(r.termination, Termination::Exhausted);
+    EXPECT_EQ(eb.p->records().size(), 2U);
+    Case w(edges, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Weighted));
+    EXPECT_EQ(w.place(10).call_delivered, want);
+  }
+  Case lossy(kB3Z, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto l = lossy.place(10);
+  EXPECT_EQ(l.call_delivered, 5);
+  EXPECT_EQ(l.call_edge_drops, (Drops {{0, 5}}));
+  EXPECT_EQ(l.call_source_drops, 0);
+  EXPECT_EQ(l.termination, Termination::Complete);
+}
+
+// Weighted gives the zero edge weight 0; source 0's share has no member and is source loss.
+TEST(Pooled, WeightedZeroRouteIsSourceLoss) {
+  Case k(kB3Z, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Weighted, Admission::Lossy));
+  const auto r = k.place(10);
+  EXPECT_EQ(r.call_delivered, 5);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_TRUE(r.call_edge_drops.empty());
+  EXPECT_EQ(r.call_source_drops, 5);
+  EXPECT_EQ(lo(r.source_drops), 5);
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, 5, 5, 0, 5, 0}, {1, 5, 5, 5, 0, 0}}));
+}
+
+// P10, P11 on B1.
+TEST(Pooled, EqualOriginLimitsTheTotal) {
+  Case k(kB1, {0, 1}, {3}, shortest_paths_policy());
+  const auto r = k.place(12);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, kNone, 2, 2, 0, 0}, {1, kNone, 2, 2, 0, 0}}));
+  Case lossy(kB1, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto l = lossy.place(12);
+  EXPECT_EQ(l.call_delivered, 8);
+  EXPECT_EQ(l.call_edge_drops, (Drops {{0, 4}}));
+}
+
+// CHAIN: source 1's traffic passes source 0's router.
+TEST(Pooled, TransitThroughASource) {
+  Case k(kChain, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto r = k.place(10);
+  EXPECT_EQ(r.call_delivered, 3);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{0, 7}}));
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, 5, 5, 2, 0, 3}, {1, 5, 5, 1, 0, 4}}));
+  EXPECT_EQ(k.records(), (decltype(k.records()) {{{{0, 2}}, 2}, {{{0, 1}, {1, 5}}, 1}}));
+  for (const auto& rec : k.p->records()) expect_conserved(*k.g, rec, "transit through a source");
+  Case lossless(kChain, {0, 1}, {2}, shortest_paths_policy());
+  const auto l = lossless.place(std::nullopt);
+  EXPECT_EQ(l.call_delivered, 3);
+  EXPECT_EQ(rows(l), (std::vector<Row> {{0, kNone, 2, 2, 0, 0}, {1, kNone, 1, 1, 0, 0}}));
+  Case hop(kChain, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto h = hop.place(std::nullopt);
+  EXPECT_EQ(h.call_delivered, 3);
+  EXPECT_EQ(h.termination, Termination::Exhausted);
+  EXPECT_EQ(lo(h.offered), 13);
+  EXPECT_EQ(h.edge_drops, (Counters {{0, c(10)}}));
+  EXPECT_EQ(rows(h), (std::vector<Row> {{0, 3, 3, 0, 0, 3}, {1, 10, 10, 3, 0, 7}}));
+}
+
+// ResidualSnapshot weights read once, on the residual at the first positive call's entry.
+TEST(Pooled, ResidualWeightsOnTheCommonView) {
+  auto residual_basis = sel(RouteTieBreak::FewerHops);
+  residual_basis.weight_basis = WeightBasis::ResidualSnapshot;
+  auto snapshot = shortest_paths_policy(RouteAllocation::Weighted, Admission::Lossless, residual_basis);
+  Case k(kSnap, {0, 1}, {3}, snapshot, {}, {10, 10, 2, 10});
+  const auto r = k.place(std::nullopt);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_EQ(k.records(), (decltype(k.records()) {{{{0, 6}, {2, 1}, {3, 5}}, 6}, {{{1, 6}, {2, 1}, {3, 5}}, 6}}));
+}
+
+// The weights stay frozen for the epoch after the other owner leaves.
+TEST(Pooled, WeightsFrozenForTheEpoch) {
+  const auto g = graph(kSnap);
+  FlowLedger fg(g);
+  auto other = std::make_unique<FlowPolicy>(fg, v({2}), v({3}), FlowPolicyConfig {.routing = pinned_dags(*g, 2, 3, {dag_of(*g, {2})})});
+  EXPECT_EQ(other->place(8).call_delivered, 8);
+  auto residual_basis = sel(RouteTieBreak::FewerHops);
+  residual_basis.weight_basis = WeightBasis::ResidualSnapshot;
+  auto snapshot = shortest_paths_policy(RouteAllocation::Weighted, Admission::Lossless, residual_basis);
+  FlowPolicy p(fg, v({0, 1}), v({3}), snapshot);
+  EXPECT_EQ(p.place(2).call_delivered, 2);
+  other->remove();
+  const auto r = p.place(10, kEdges);
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(*r.edge_flows, (std::vector<Amount> {6, 6, 2, 10}));
+}
+
+// The first-hop experiment.
+TEST(Pooled, FirstHopExperiment) {
+  Case k(kPriv, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto r = k.place(std::nullopt);
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(lo(r.offered), 10);
+  EXPECT_FALSE(r.requested.has_value());
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// On random graphs with several sources, masks, zero capacities and dispersed
+// costs, every pooled record (EB and W, both admissions, multipath or deterministic single paths)
+// carries and drops only on its own route, conserves its traffic, and the rows sum to the totals
+// with the accounting identities; the ledger stays within the capacities.
+TEST(Pooled, RecordsStayOnTheirRoutesAndAccountExactly) {
+  std::mt19937 rng(20261018);
+  auto pick = [&](int n) { return static_cast<int>(rng() % static_cast<unsigned>(n)); };
+  int multi = 0, carrying = 0;
+  for (int trial = 0; trial < 300; ++trial) {
+    const int n = 4 + pick(5);
+    std::vector<InEdge> es;
+    for (int k = 0, m = n + pick(2 * n); k < m; ++k) {
+      const NodeId u = pick(n);
+      const NodeId w = pick(3) == 0 ? n - 1 : pick(n);
+      if (u != w) es.push_back({u, w, pick(4) == 0 ? 0 : 1 + pick(6), static_cast<Cost>(1 + pick(3))});
+    }
+    if (es.empty()) es.push_back({0, n - 1, 1, 1});
+    auto g = shared(make_graph(n, es));
+    std::vector<NodeId> s = {0, 1};
+    if (pick(2) == 0) s.push_back(2);
+    const std::vector<NodeId> t = {static_cast<NodeId>(n - 1)};
+    const auto mask = g->eligibility(pick(3) == 0 ? v({static_cast<NodeId>(3)}) : std::vector<NodeId> {},
+                                     pick(3) == 0 ? std::vector<EdgeId> {static_cast<EdgeId>(pick(g->num_edges()))}
+                                                  : std::vector<EdgeId> {});
+    const auto k = pick(2) == 0 ? RouteAllocation::Equal : RouteAllocation::Weighted;
+    const auto a = pick(2) == 0 ? Admission::Lossless : Admission::Lossy;
+    const auto choice = sel(RouteTieBreak::FewerHops, pick(3) != 0);
+    FlowLedger fg(g);
+    FlowPolicy p(fg, s, t, shortest_paths_policy(k, a, choice), &mask);
+    const std::string where = "trial " + std::to_string(trial);
+    for (int call = 0, calls = 1 + pick(3); call < calls; ++call) {
+      const std::optional<Amount> vol = pick(5) == 0 && call == calls - 1 ? std::nullopt : std::optional<Amount> {pick(9)};
+      const auto r = p.place(vol);
+      Amount admitted = 0, delivered = 0, loss = 0, dropped = 0;
+      for (const auto& row : r.by_source) {
+        admitted += lo(row.admitted);
+        delivered += row.delivered;
+        loss += lo(row.source_drops);
+        dropped += lo(row.total_edge_drops);
+      }
+      Amount drops = 0;
+      for (const auto& [e, x] : r.edge_drops) drops += lo(x);
+      const bool empty = fg.records().empty();
+      if (!empty || a == Admission::Lossless) {
+        EXPECT_EQ(admitted, lo(r.admitted)) << where;
+        EXPECT_EQ(loss, lo(r.source_drops)) << where;
+      }
+      EXPECT_EQ(delivered, r.delivered) << where;
+      EXPECT_EQ(dropped, drops) << where;
+      if (a == Admission::Lossy) {
+        EXPECT_EQ(lo(r.offered), lo(r.source_drops) + drops + r.delivered) << where;
+        EXPECT_EQ(lo(r.unadmitted), 0) << where;
+      } else if (r.requested.has_value()) {
+        EXPECT_EQ(lo(r.requested), lo(r.unadmitted) + r.delivered) << where;
+      }
+      EXPECT_EQ(r.delivery_delta, r.call_delivered) << where;
+      for (const auto& rec : p.records()) {
+        const auto route = ascending_edges(*rec.route);
+        for (const auto& [e, x] : rec.edge_flows) {
+          EXPECT_TRUE(std::binary_search(route.begin(), route.end(), e)) << where << " edge " << e;
+        }
+        for (const auto& [e, x] : rec.edge_drops) {
+          EXPECT_TRUE(std::binary_search(route.begin(), route.end(), e)) << where << " drop " << e;
+        }
+        if (expect_conserved(*g, rec, where)) ++carrying;
+      }
+      const auto alloc = fg.carried();
+      for (EdgeId e = 0; e < g->num_edges(); ++e) {
+        EXPECT_LE(alloc[static_cast<std::size_t>(e)], g->edge_capacity_units()[static_cast<std::size_t>(e)]) << where;
+      }
+      if (!vol.has_value()) break;
+    }
+    if (p.records().size() > 1) ++multi;
+  }
+  EXPECT_GT(multi, 100);
+  EXPECT_GT(carrying, 200);
+}
+
+// ---------------------------------------------------------------- increments and zero calls
+
+TEST(Increments, LosslessRefusedUnitsStayRefused) {
+  Case k(kInc, {0, 1}, {2}, shortest_paths_policy());
+  const auto a = k.place(3);
+  const auto b = k.place(1);
+  EXPECT_EQ(a.call_delivered, 2);
+  EXPECT_EQ(b.call_delivered, 0);
+  EXPECT_EQ(b.termination, Termination::Exhausted);
+  EXPECT_EQ(lo(b.requested), 4);
+  EXPECT_EQ(lo(b.admitted), 2);
+  EXPECT_EQ(lo(b.unadmitted), 2);
+  EXPECT_FALSE(b.offered.has_value());
+  Case lossy(kInc, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto la = lossy.place(3);
+  const auto lb = lossy.place(1);
+  EXPECT_EQ(la.call_delivered, 2);
+  EXPECT_EQ(la.call_edge_drops, (Drops {{0, 1}}));
+  EXPECT_EQ(lb.call_delivered, 1);
+  EXPECT_TRUE(lb.call_edge_drops.empty());
+  EXPECT_EQ(lb.edge_drops, (Counters {{0, c(1)}}));
+  EXPECT_EQ(lo(lb.offered), 4);
+  EXPECT_EQ(lb.delivered, 3);
+  EXPECT_EQ(rows(lb), (std::vector<Row> {{0, 2, 2, 1, 0, 1}, {1, 2, 2, 2, 0, 0}}));
+  // Another owner holds 8, leaves, places 5.
+  const auto g = graph(kOne);
+  FlowLedger fg(g);
+  FlowPolicy other(fg, v({0}), v({1}), shortest_paths_policy());
+  (void)other.place(8);
+  FlowPolicy p(fg, v({0}), v({1}), shortest_paths_policy());
+  EXPECT_EQ(p.place(5).call_delivered, 2);
+  other.remove();
+  (void)other.place(5);
+  const auto r = p.place(1);
+  EXPECT_EQ(r.call_delivered, 1);
+  EXPECT_EQ(lo(r.requested), 6);
+  EXPECT_EQ(lo(r.unadmitted), 3);
+  Case rc(kRc, {0}, {1}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  EXPECT_EQ(rc.place(1).call_delivered, 1);
+  EXPECT_EQ(rc.place(1).call_delivered, 0);
+  Case rc2(kRc, {0}, {1}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  EXPECT_EQ(rc2.place(2).call_delivered, 2);
+  Case rc3(kRc, {0}, {1}, shortest_paths_policy());
+  EXPECT_EQ(rc3.place(1).call_delivered, 1);
+  EXPECT_EQ(*rc3.place(1, kEdges).edge_flows, (std::vector<Amount> {1, 1}));
+}
+
+// A zero call before preparation, after a positive call, after
+// remove().
+TEST(Epochs, ZeroCallBeforePreparation) {
+  for (const bool global : {false, true}) {
+    Case k(kPar, {0}, {1}, global ? glob() : shortest_paths_policy(), {}, {4, 6});
+    auto unprepared = [&](const PlacementResult& r) {
+      EXPECT_EQ(r.call_delivered, 0);
+      EXPECT_EQ(r.call_undelivered, 0);
+      EXPECT_EQ(r.delivery_delta, 0);
+      EXPECT_TRUE(r.call_edge_drops.empty());
+      EXPECT_EQ(r.call_source_drops, 0);
+      EXPECT_EQ(r.termination, Termination::Complete);
+      EXPECT_FALSE(r.routes_changed || r.weights_changed);
+      EXPECT_EQ(*r.edge_flows, (std::vector<Amount> {0, 0}));
+      EXPECT_EQ(*r.residual, (std::vector<Amount> {4, 6}));
+      EXPECT_FALSE(r.min_cut.has_value());
+      EXPECT_FALSE(r.marginal_cost_curve.has_value());
+      EXPECT_EQ(lo(r.requested), 0);
+      EXPECT_EQ(rows(r), (std::vector<Row> {{0, kNone, 0, 0, 0, 0}}));
+      EXPECT_EQ(r.total_cost.has_value(), global);
+      if (global) EXPECT_EQ(*r.total_cost, c(0));
+      EXPECT_TRUE(k.p->records().empty());
+    };
+    unprepared(k.place(0, kAll));
+    (void)k.place(3);
+    const auto z = k.place(0, kAll);
+    EXPECT_EQ(z.delivered, 3);
+    EXPECT_FALSE(z.routes_changed);
+    if (global) EXPECT_EQ(*z.marginal_cost_curve, (std::vector<std::pair<Cost, Amount>> {{1, 3}}));
+    k.p->remove();
+    unprepared(k.place(0, kAll));
+  }
+}
+
+// ---------------------------------------------------------------- the controllers
+
+// One controller on the union of the sources' shortest routes.
+TEST(ShortestPathsMaxFlow, OptimizedPoolsTheRoster) {
+  struct Want {
+    std::vector<InEdge> edges;
+    std::vector<NodeId> s;
+    NodeId t;
+    std::optional<SourceAllocation> source_allocation;
+    Amount request, delivered, cost;
+    std::vector<std::vector<std::pair<EdgeId, Amount>>> records;
+  };
+  const std::vector<Want> wants = {
+      {kB1, {0, 1}, 3, std::nullopt, 12, 12, 32, {{{0, 2}}, {{1, 10}, {2, 10}}}},
+      {kB1, {0, 1}, 3, SourceAllocation::Equal, 12, 4, 8, {{{0, 2}}, {{1, 2}, {2, 2}}}},
+      {kB2, {0, 1}, 2, SourceAllocation::Equal, 12, 4, 4, {{{1, 2}}, {{2, 2}}}},
+      {kB2, {0, 1}, 2, SourceAllocation::Optimized, 12, 12, 12, {{{1, 2}}, {{2, 10}}}},
+      {kES, {0}, 3, std::nullopt, 12, 2, 4, {{{0, 2}, {2, 2}}}},
+      {kSpf, {0}, 1, std::nullopt, 5, 0, 0, {{}}},
+  };
+  for (const auto& w : wants) {
+    Case k(w.edges, w.s, {w.t}, shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossless, {}, w.source_allocation));
+    const auto r = k.place(w.request, kCut);
+    EXPECT_EQ(r.call_delivered, w.delivered);
+    EXPECT_EQ(r.termination, w.delivered == w.request ? Termination::Complete : Termination::Exhausted);
+    EXPECT_EQ(*r.total_cost, c(w.cost));
+    EXPECT_FALSE(r.marginal_cost_curve.has_value());
+    EXPECT_FALSE(r.min_cut.has_value());
+    std::vector<std::vector<std::pair<EdgeId, Amount>>> got;
+    for (const auto& rec : k.p->records()) got.push_back(rec.edge_flows);
+    EXPECT_EQ(got, w.records);
+  }
+  Case r4(kR4, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossless, {}, SourceAllocation::Equal));
+  EXPECT_EQ(r4.place(3).call_delivered, 3);
+  EXPECT_EQ(r4.place(3).call_delivered, 1);
+  EXPECT_EQ(*r4.place(0).total_cost, c(20));
+}
+
+TEST(GlobalEqual, Examples) {
+  struct Want {
+    std::vector<InEdge> edges;
+    std::vector<NodeId> s;
+    NodeId t;
+    SourceAllocation source_allocation;
+    Amount request, delivered, cost;
+    std::vector<Amount> flows;
+  };
+  const std::vector<Want> wants = {
+      {kB1, {0, 1}, 3, SourceAllocation::Equal, 12, 4, 8, {2, 2, 2}},
+      {kB1, {0, 1}, 3, SourceAllocation::Optimized, 12, 12, 32, {2, 10, 10}},
+      {kB2, {0, 1}, 2, SourceAllocation::Equal, 12, 12, 16, {4, 2, 10}},
+      {kB2, {0, 1}, 2, SourceAllocation::Optimized, 12, 12, 12, {0, 2, 10}},
+      {kB2S, {0, 1}, 2, SourceAllocation::Equal, 12, 4, 4, {2, 2}},
+      {kB2S, {0, 1}, 2, SourceAllocation::Optimized, 12, 12, 12, {2, 10}},
+      {kB3Z, {0, 1}, 2, SourceAllocation::Equal, 10, 0, 0, {0, 0}},
+      {kB3P, {0, 1}, 2, SourceAllocation::Equal, 10, 1, 1, {1, 0}},
+      {kB3Z, {0, 1}, 2, SourceAllocation::Optimized, 10, 10, 10, {0, 10}},
+      {kES, {0}, 3, SourceAllocation::Optimized, 12, 12, 34, {2, 10, 2, 10}},
+      {kWit, {0}, 2, SourceAllocation::Optimized, 1, 1, 1, {0, 1, 0}},
+  };
+  for (const auto& w : wants) {
+    Case k(w.edges, w.s, {w.t}, glob(w.source_allocation));
+    const auto r = k.place(w.request, kEdges);
+    EXPECT_EQ(r.call_delivered, w.delivered);
+    EXPECT_EQ(r.call_undelivered, w.request - w.delivered);
+    EXPECT_EQ(r.termination, w.delivered == w.request ? Termination::Complete : Termination::Exhausted);
+    EXPECT_EQ(*r.total_cost, c(w.cost));
+    EXPECT_EQ(*r.edge_flows, w.flows);
+    EXPECT_EQ(r.marginal_cost_curve.has_value(), w.source_allocation == SourceAllocation::Optimized);
+  }
+  // Source 0's 6 is 2 direct and 4 through node 1.
+  Case b2(kB2, {0, 1}, {2}, glob(SourceAllocation::Equal));
+  (void)b2.place(12);
+  EXPECT_EQ(b2.records(), (decltype(b2.records()) {{{{0, 4}, {1, 2}, {2, 4}}, 6}, {{{2, 6}}, 6}}));
+  // The source behind the zero-capacity link masked: it leaves the roster.
+  Case masked(kB3Z, {0, 1}, {2}, glob(SourceAllocation::Equal), {0});
+  EXPECT_EQ(masked.place(10).call_delivered, 10);
+}
+
+TEST(GlobalEqual, Increments) {
+  Case k(kR4, {0, 1}, {2}, glob(SourceAllocation::Equal));
+  const auto a = k.place(3);
+  const auto b = k.place(3, kEdges);
+  EXPECT_EQ(a.call_delivered, 3);
+  EXPECT_EQ(a.termination, Termination::Complete);
+  EXPECT_EQ(b.call_delivered, 1);
+  EXPECT_EQ(b.termination, Termination::Exhausted);
+  EXPECT_EQ(*b.edge_flows, (std::vector<Amount> {2, 2}));
+  EXPECT_EQ(*b.total_cost, c(20));
+  EXPECT_EQ(lo(b.requested), 6);
+  EXPECT_EQ(lo(b.unadmitted), 2);
+  const auto g = graph(kOne);
+  FlowLedger fg(g);
+  FlowPolicy other(fg, v({0}), v({1}), shortest_paths_policy());
+  (void)other.place(8);
+  FlowPolicy p(fg, v({0}), v({1}), glob());
+  EXPECT_EQ(p.place(5).call_delivered, 2);
+  other.remove();
+  (void)other.place(5);
+  EXPECT_EQ(p.place(1).call_delivered, 1);
+  Case one(kB2, {0, 1}, {2}, glob(SourceAllocation::Equal));
+  const auto whole = one.place(12, kEdges);
+  Case two(kB2, {0, 1}, {2}, glob(SourceAllocation::Equal));
+  (void)two.place(6);
+  const auto split = two.place(6, kEdges);
+  EXPECT_EQ(*split.edge_flows, *whole.edge_flows);
+  EXPECT_EQ(*split.total_cost, *whole.total_cost);
+  EXPECT_EQ(two.records(), one.records());
+}
+
+namespace {
+
+// Independent maximum flow (augmenting paths found by BFS) from a virtual root with an arc of
+// capacity caps[i] (nullopt: unbounded) to roots[i], to a virtual sink fed by every destination,
+// over the edges with `allowed`.
+Amount max_flow(const Graph& g, const std::vector<Amount>& view, const std::vector<char>& allowed,
+                const std::vector<NodeId>& roots, const std::vector<std::optional<Amount>>& caps,
+                const std::vector<NodeId>& dsts) {
+  struct Arc {
+    std::size_t u, v;
+    Amount cap, flow;
+  };
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  const std::size_t root = n, sink = n + 1;
+  Amount big = 1;
+  for (Amount x : view) big += x;
+  std::vector<Arc> arcs;
+  for (std::size_t e = 0; e < view.size(); ++e) {
+    if (allowed[e]) arcs.push_back({static_cast<std::size_t>(g.edge_sources()[e]), static_cast<std::size_t>(g.edge_destinations()[e]), view[e], 0});
+  }
+  for (std::size_t i = 0; i < roots.size(); ++i) arcs.push_back({root, static_cast<std::size_t>(roots[i]), caps[i].value_or(big), 0});
+  for (NodeId d : dsts) arcs.push_back({static_cast<std::size_t>(d), sink, big, 0});
+  Amount total = 0;
+  for (;;) {
+    std::vector<std::pair<std::size_t, int>> parent(n + 2, {SIZE_MAX, 0});
+    std::vector<char> seen(n + 2, 0);
+    std::vector<std::size_t> queue = {root};
+    seen[root] = 1;
+    for (std::size_t qi = 0; qi < queue.size(); ++qi) {
+      const std::size_t u = queue[qi];
+      for (std::size_t i = 0; i < arcs.size(); ++i) {
+        if (arcs[i].u == u && arcs[i].flow < arcs[i].cap && !seen[arcs[i].v]) {
+          seen[arcs[i].v] = 1;
+          parent[arcs[i].v] = {i, 1};
+          queue.push_back(arcs[i].v);
+        }
+        if (arcs[i].v == u && arcs[i].flow > 0 && !seen[arcs[i].u]) {
+          seen[arcs[i].u] = 1;
+          parent[arcs[i].u] = {i, -1};
+          queue.push_back(arcs[i].u);
+        }
+      }
+    }
+    if (!seen[sink]) return total;
+    Amount amount = big;
+    for (std::size_t x = sink; x != root;) {
+      const auto [i, d] = parent[x];
+      amount = std::min(amount, d == 1 ? arcs[i].cap - arcs[i].flow : arcs[i].flow);
+      x = d == 1 ? arcs[i].u : arcs[i].v;
+    }
+    for (std::size_t x = sink; x != root;) {
+      const auto [i, d] = parent[x];
+      arcs[i].flow += d * amount;
+      x = d == 1 ? arcs[i].u : arcs[i].v;
+    }
+    total += amount;
+  }
+}
+
+// Whether the residual graph of `flows` on the allowed edges, with a virtual sink fed by every
+// destination (and arcs back to a destination that receives) and, when `free_supply`, a virtual
+// root with arcs to every root (and back from a root that sends), has a negative-cost cycle
+// (Bellman-Ford from a virtual start joined to every node).
+bool negative_cycle(const Graph& g, const std::vector<Amount>& view, const std::vector<char>& allowed,
+                    const std::vector<Amount>& flows, const std::vector<NodeId>& roots,
+                    const std::vector<Amount>& supply, const std::vector<NodeId>& dsts,
+                    const std::vector<Amount>& inflow, bool free_supply) {
+  struct Arc {
+    std::size_t u, v;
+    Int128 w;
+  };
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  const std::size_t root = n, sink = n + 1;
+  std::vector<Arc> arcs;
+  for (std::size_t e = 0; e < view.size(); ++e) {
+    if (!allowed[e]) continue;
+    const auto u = static_cast<std::size_t>(g.edge_sources()[e]);
+    const auto w = static_cast<std::size_t>(g.edge_destinations()[e]);
+    if (flows[e] < view[e]) arcs.push_back({u, w, g.edge_costs()[e]});
+    if (flows[e] > 0) arcs.push_back({w, u, -static_cast<Int128>(g.edge_costs()[e])});
+  }
+  for (std::size_t i = 0; i < dsts.size(); ++i) {
+    arcs.push_back({static_cast<std::size_t>(dsts[i]), sink, 0});
+    if (inflow[i] > 0) arcs.push_back({sink, static_cast<std::size_t>(dsts[i]), 0});
+  }
+  if (free_supply) {
+    for (std::size_t i = 0; i < roots.size(); ++i) {
+      arcs.push_back({root, static_cast<std::size_t>(roots[i]), 0});
+      if (supply[i] > 0) arcs.push_back({static_cast<std::size_t>(roots[i]), root, 0});
+    }
+  }
+  std::vector<Int128> dist(n + 2, 0);
+  for (std::size_t round = 0; round <= n + 2; ++round) {
+    bool changed = false;
+    for (const auto& a : arcs) {
+      if (dist[a.u] + a.w < dist[a.v]) {
+        dist[a.v] = dist[a.u] + a.w;
+        changed = true;
+      }
+    }
+    if (!changed) return false;
+  }
+  return true;
+}
+
+// The roster (sources that reach a destination over allowed nodes and edges, capacity-blind) and
+// the static distance to the destinations, by Bellman-Ford.
+std::vector<std::optional<Int128>> distances(const Graph& g, const std::vector<NodeId>& dsts, const Eligibility* elig) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<std::optional<Int128>> d(n);
+  auto node_allowed = [&](NodeId x) { return elig == nullptr || elig->allows_node(x); };
+  const std::set<NodeId> D(dsts.begin(), dsts.end());
+  for (NodeId t : dsts) {
+    if (node_allowed(t)) d[static_cast<std::size_t>(t)] = 0;
+  }
+  for (std::size_t round = 0; round < n; ++round) {
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      const NodeId u = g.edge_sources()[static_cast<std::size_t>(e)];
+      const NodeId w = g.edge_destinations()[static_cast<std::size_t>(e)];
+      if ((elig != nullptr && !elig->allows_edge(e)) || !node_allowed(u) || !node_allowed(w) || D.count(u)) continue;
+      const auto& dw = d[static_cast<std::size_t>(w)];
+      auto& du = d[static_cast<std::size_t>(u)];
+      if (dw && (!du || *dw + g.edge_costs()[static_cast<std::size_t>(e)] < *du)) du = *dw + g.edge_costs()[static_cast<std::size_t>(e)];
+    }
+  }
+  return d;
+}
+
+// The controllers' certificates on random graphs with masks, zero capacities and dispersed costs:
+// CentralizedTE (every allowed edge) or ShortestPaths Optimized (the tight edges the roster reaches) under one
+// source allocation. Flow only on the support, conservation and bounds; supplies RR(T) under the equal
+// source allocation; maximality (equal: RR(T + 1) does not fit; optimized: the maximum flow); minimum cost (no
+// negative residual cycle, with free supplies only under the optimized source allocation).
+void certify_controllers(bool global) {
+  std::mt19937 rng(global ? 20261019 : 20261020);
+  auto pick = [&](int n) { return static_cast<int>(rng() % static_cast<unsigned>(n)); };
+  int positive = 0, differ = 0;
+  for (int trial = 0; trial < 200; ++trial) {
+    const int n = 4 + pick(5);
+    std::vector<InEdge> es;
+    for (int k = 0, m = n + pick(2 * n); k < m; ++k) {
+      const NodeId u = pick(n);
+      const NodeId w = pick(3) == 0 ? n - 1 : pick(n);
+      if (u != w) es.push_back({u, w, pick(5), static_cast<Cost>(1 + pick(4))});
+    }
+    if (es.empty()) es.push_back({0, n - 1, 1, 1});
+    auto g = shared(make_graph(n, es));
+    std::vector<NodeId> s = {0, 1};
+    if (pick(2) == 0) s.push_back(2);
+    std::vector<NodeId> t = {static_cast<NodeId>(n - 1)};
+    if (pick(3) == 0 && n - 2 > 2) t.push_back(static_cast<NodeId>(n - 2));
+    const auto mask = g->eligibility(pick(3) == 0 && n > 5 ? v({static_cast<NodeId>(3)}) : std::vector<NodeId> {},
+                                     pick(3) == 0 ? std::vector<EdgeId> {static_cast<EdgeId>(pick(g->num_edges()))}
+                                                  : std::vector<EdgeId> {});
+    const auto m = static_cast<std::size_t>(g->num_edges());
+    const auto dist = distances(*g, t, &mask);
+    std::vector<NodeId> roster;
+    for (NodeId x : s) {
+      if (mask.allows_node(x) && dist[static_cast<std::size_t>(x)]) roster.push_back(x);
+    }
+    std::vector<char> allowed(m, 0);
+    for (std::size_t e = 0; e < m; ++e) {
+      const NodeId u = g->edge_sources()[e], w = g->edge_destinations()[e];
+      allowed[e] = mask.allows_edge(static_cast<EdgeId>(e)) && mask.allows_node(u) && mask.allows_node(w);
+    }
+    if (!global) {
+      // The tight edges the roster reaches, not out of a destination.
+      std::vector<char> reach(static_cast<std::size_t>(n), 0), support(m, 0);
+      std::vector<NodeId> stack = roster;
+      for (NodeId x : roster) reach[static_cast<std::size_t>(x)] = 1;
+      while (!stack.empty()) {
+        const NodeId u = stack.back();
+        stack.pop_back();
+        if (std::find(t.begin(), t.end(), u) != t.end()) continue;
+        for (std::size_t e = 0; e < m; ++e) {
+          const NodeId w = g->edge_sources()[e] == u ? g->edge_destinations()[e] : -1;
+          if (w < 0 || !allowed[e]) continue;
+          const auto& du = dist[static_cast<std::size_t>(u)];
+          const auto& dw = dist[static_cast<std::size_t>(w)];
+          if (du && dw && *du == *dw + g->edge_costs()[e]) {
+            support[e] = 1;
+            if (!reach[static_cast<std::size_t>(w)]) {
+              reach[static_cast<std::size_t>(w)] = 1;
+              stack.push_back(w);
+            }
+          }
+        }
+      }
+      allowed = support;
+    }
+    std::vector<Amount> view(g->edge_capacity_units().begin(), g->edge_capacity_units().end());
+    std::vector<Amount> delivered_by_source_allocation;
+    for (const auto source_allocation : {SourceAllocation::Equal, SourceAllocation::Optimized}) {
+      const auto cfg = global ? glob(source_allocation) : shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossless, {}, source_allocation);
+      const std::string where = "trial " + std::to_string(trial) + (source_allocation == SourceAllocation::Equal ? " equal" : " optimized");
+      const auto r = evaluate_demand(*g, s, t, EvaluationOptions {cfg, &mask, nullptr, kEdges});
+      const auto& flows = *r.edge_flows;
+      delivered_by_source_allocation.push_back(r.call_delivered);
+      std::vector<std::string> fails;
+      const FlowBalance bal = flow_clauses(*g, view, flows, roster, t, &mask, r.call_delivered, fails);
+      EXPECT_TRUE(fails.empty()) << where << ": " << (fails.empty() ? "" : fails.front());
+      for (std::size_t e = 0; e < m; ++e) {
+        if (!allowed[e]) EXPECT_EQ(flows[e], 0) << where << " edge " << e;
+      }
+      std::vector<Amount> supply, inflow;
+      for (NodeId x : roster) supply.push_back(static_cast<Amount>(bal.supply[static_cast<std::size_t>(x)]));
+      for (NodeId x : t) inflow.push_back(static_cast<Amount>(bal.inflow[static_cast<std::size_t>(x)]));
+      Int128 cost = 0;
+      for (std::size_t e = 0; e < m; ++e) cost += static_cast<Int128>(g->edge_costs()[e]) * flows[e];
+      EXPECT_EQ(*r.total_cost, (Counter128 {0, static_cast<std::uint64_t>(cost)})) << where;
+      const auto k = roster.size();
+      if (source_allocation == SourceAllocation::Equal) {
+        if (k > 0) {
+          // The round-robin quotas written out (not the library's round_robin): T / k each, one more
+          // for the first T % k roster sources.
+          auto quotas = [&](Amount total) {
+            std::vector<Amount> q(k);
+            for (std::size_t i = 0; i < k; ++i) {
+              q[i] = total / static_cast<Amount>(k) + (static_cast<Amount>(i) < total % static_cast<Amount>(k) ? 1 : 0);
+            }
+            return q;
+          };
+          EXPECT_EQ(supply, quotas(r.call_delivered)) << where;
+          const auto next = quotas(r.call_delivered + 1);
+          std::vector<std::optional<Amount>> caps(next.begin(), next.end());
+          EXPECT_LT(max_flow(*g, view, allowed, roster, caps, t), r.call_delivered + 1) << where;
+        }
+        EXPECT_FALSE(r.marginal_cost_curve.has_value()) << where;
+      } else {
+        const std::vector<std::optional<Amount>> free(k);
+        EXPECT_EQ(max_flow(*g, view, allowed, roster, free, t), r.call_delivered) << where;
+      }
+      EXPECT_FALSE(negative_cycle(*g, view, allowed, flows, roster, supply, t, inflow, source_allocation == SourceAllocation::Optimized)) << where;
+      // A row for every input source; the supplies are the rows' admitted amounts.
+      ASSERT_EQ(r.by_source.size(), std::set<NodeId>(s.begin(), s.end()).size()) << where;
+      for (const auto& row : r.by_source) {
+        const auto it = std::find(roster.begin(), roster.end(), row.source);
+        EXPECT_EQ(lo(row.admitted), it == roster.end() ? 0 : supply[static_cast<std::size_t>(it - roster.begin())]) << where;
+      }
+      if (r.call_delivered > 0) ++positive;
+    }
+    if (delivered_by_source_allocation[0] != delivered_by_source_allocation[1]) ++differ;
+  }
+  EXPECT_GT(positive, 150);
+  EXPECT_GT(differ, 15);
+}
+
+}  // namespace
+
+TEST(GlobalEqual, Certificates) { certify_controllers(true); }
+
+TEST(ShortestPathsMaxFlow, Certificates) { certify_controllers(false); }
+
+// total_cost is exact beyond 64 bits, for both controllers under both source allocations (the values as
+// hexadecimal halves {hi, lo}). One link of capacity = cost = 2^40: 2^80. Two sources, 0 -> 2
+// (capacity 2^40, cost 2^40) and 1 -> 2 (capacity 2^39, cost 2^41): optimized carries both links
+// full, 2^80 + 2^80 = 2^81; equal stops at T = 2^40 + 1 (shares 2^39 + 1 and 2^39; one more unit
+// would give source 1 more than 2^39): (2^39 + 1) * 2^40 + 2^39 * 2^41 = 3 * 2^79 + 2^40.
+// A chain 0 -> 1 -> 2 of two links of capacity 2^32 - 1 and cost 2^32 + 1: each product is
+// 2^64 - 1, so the second one carries into the high half: 2^65 - 2.
+TEST(ResultShape, TotalCostBeyond64Bits) {
+  const Amount p40 = Amount {1} << 40, p39 = Amount {1} << 39, p41 = Amount {1} << 41;
+  const Amount lo32 = (Amount {1} << 32) - 1, hi32 = (Amount {1} << 32) + 1;
+  struct Want {
+    std::vector<InEdge> edges;
+    std::vector<NodeId> s;
+    NodeId t;
+    Counter128 optimized, equal;
+  };
+  const std::vector<Want> wants = {
+      {{{0, 1, p40, p40}}, {0}, 1, {0x10000, 0}, {0x10000, 0}},
+      {{{0, 2, p40, p40}, {1, 2, p39, p41}}, {0, 1}, 2, {0x20000, 0}, {0x18000, Amount {1} << 40}},
+      {{{0, 1, lo32, hi32}, {1, 2, lo32, hi32}}, {0}, 2, {1, 0xfffffffffffffffeULL}, {1, 0xfffffffffffffffeULL}},
+  };
+  for (const auto& w : wants) {
+    const auto g = graph(w.edges);
+    for (const auto source_allocation : {SourceAllocation::Optimized, SourceAllocation::Equal}) {
+      const Counter128 want = source_allocation == SourceAllocation::Optimized ? w.optimized : w.equal;
+      for (const auto& cfg :
+           {glob(source_allocation), shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossless, {}, source_allocation)}) {
+        Case k(w.edges, w.s, {w.t}, cfg);
+        EXPECT_EQ(*k.place(std::nullopt).total_cost, want);
+        EXPECT_EQ(*evaluate_demand(*g, w.s, v({w.t}), EvaluationOptions {cfg}).total_cost, want);
+        const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{w.s, {w.t}}, {w.s, {w.t}}};
+        for (const auto& r : evaluate_pairs(*g, pairs, EvaluationOptions {cfg}, {}, 2)) EXPECT_EQ(*r.total_cost, want);
+      }
+    }
+  }
+}
+
+// min_cut is its own output, for the optimized CentralizedTE only.
+TEST(GlobalMinCut, Flag) {
+  for (const auto& [edges, t] : {std::pair {kB1, NodeId {3}}, std::pair {kB3Z, NodeId {2}}}) {
+    Case k(edges, {0, 1}, {t}, glob());
+    EXPECT_EQ(*k.place(std::nullopt, kCut).min_cut, (std::vector<EdgeId> {0, 1}));
+  }
+  Case zero(kZero, {0}, {1}, glob());
+  const auto z = zero.place(5, kCut);
+  EXPECT_EQ(z.termination, Termination::Exhausted);
+  EXPECT_EQ(*z.min_cut, (std::vector<EdgeId> {0}));
+  Case bottleneck(kB1, {0, 1}, {3}, glob());
+  EXPECT_FALSE(bottleneck.place(std::nullopt, OutputOptions {false, false, true, false}).min_cut.has_value());
+  Case equal(kB1, {0, 1}, {3}, glob(SourceAllocation::Equal));
+  EXPECT_FALSE(equal.place(std::nullopt, kCut).min_cut.has_value());
+  Case below(kB1, {0, 1}, {3}, glob());
+  EXPECT_FALSE(below.place(5, kCut).min_cut.has_value());
+  EXPECT_FALSE(below.place(0, kCut).min_cut.has_value());
+  Case empty({{1, 0, 5, 1}}, {0}, {1}, glob());
+  const auto e = empty.place(5, kCut);
+  EXPECT_EQ(e.termination, Termination::NoRoute);
+  EXPECT_EQ(*e.min_cut, (std::vector<EdgeId> {}));
+  EXPECT_EQ(*e.marginal_cost_curve, (std::vector<std::pair<Cost, Amount>> {}));
+  EXPECT_EQ(*e.total_cost, c(0));
+}
+
+// ---------------------------------------------------------------- terminations and the result
+
+TEST(Terminations, Order) {
+  for (const auto& cfg : {glob(), shortest_paths_policy(), shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy)}) {
+    Case k({{1, 0, 5, 1}}, {0}, {1}, cfg);
+    EXPECT_EQ(k.place(0).termination, Termination::Complete);
+    const auto r = k.place(5);
+    EXPECT_EQ(r.termination, Termination::NoRoute);
+    if (cfg.admission == Admission::Lossy) {
+      // Nothing enters: the offer is all source loss, every row zero.
+      EXPECT_EQ(lo(r.offered), 5);
+      EXPECT_EQ(lo(r.source_drops), 5);
+      EXPECT_EQ(r.call_source_drops, 5);
+      EXPECT_EQ(rows(r), (std::vector<Row> {{0, 0, 0, 0, 0, 0}}));
+    } else {
+      EXPECT_EQ(lo(r.unadmitted), 5);
+    }
+  }
+  Case w(kZero, {0}, {1}, shortest_paths_policy(RouteAllocation::Weighted, Admission::Lossy));
+  const auto wr = w.place(2);
+  EXPECT_EQ(wr.termination, Termination::NoActiveWeight);
+  EXPECT_EQ(wr.call_source_drops, 2);
+  EXPECT_EQ(lo(wr.offered), 2);
+  Case wl(kZero, {0}, {1}, shortest_paths_policy(RouteAllocation::Weighted));
+  const auto wlr = wl.place(2);
+  EXPECT_EQ(wlr.termination, Termination::NoActiveWeight);
+  EXPECT_EQ(lo(wlr.unadmitted), 2);
+  Case lossy(kB1, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  EXPECT_EQ(lossy.place(12).termination, Termination::Complete);
+  Case unlimited(kPool, {0, 1}, {3}, shortest_paths_policy());
+  EXPECT_EQ(unlimited.place(std::nullopt).termination, Termination::Exhausted);
+}
+
+// A controller whose maximum is 0 over existing routes is exhausted, not without a route.
+TEST(Terminations, ControllerAtZero) {
+  Case g(kZero, {0}, {1}, glob());
+  EXPECT_EQ(g.place(5).termination, Termination::Exhausted);
+  Case m(kSpf, {0}, {1}, shortest_paths_policy(RouteAllocation::Optimized));
+  EXPECT_EQ(m.place(5).termination, Termination::Exhausted);
+}
+
+// Lossless accounting.
+TEST(ResultShape, LosslessAccounting) {
+  Case k(kB1, {0, 1}, {3}, glob(SourceAllocation::Equal));
+  const auto r = k.place(12);
+  EXPECT_EQ(lo(r.requested), 12);
+  EXPECT_FALSE(r.offered.has_value());
+  EXPECT_EQ(lo(r.admitted), 4);
+  EXPECT_EQ(r.delivered, 4);
+  EXPECT_EQ(lo(r.unadmitted), 8);
+  EXPECT_EQ(lo(r.source_drops), 0);
+  EXPECT_TRUE(r.edge_drops.empty() && r.call_edge_drops.empty());
+  EXPECT_EQ(r.call_source_drops, 0);
+  EXPECT_EQ(r.delivery_delta, 4);
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, kNone, 2, 2, 0, 0}, {1, kNone, 2, 2, 0, 0}}));
+}
+
+// Lossy accounting: state versus call.
+TEST(ResultShape, LossyAccounting) {
+  Case k(kChain, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  const auto r = k.place(10);
+  EXPECT_EQ(lo(r.requested), 10);
+  EXPECT_EQ(lo(r.offered), 10);
+  EXPECT_EQ(lo(r.admitted), 10);
+  EXPECT_EQ(r.delivered, 3);
+  EXPECT_EQ(lo(r.unadmitted), 0);
+  EXPECT_EQ(lo(r.source_drops), 0);
+  EXPECT_EQ(r.edge_drops, (Counters {{0, c(7)}}));
+  Case inc(kInc, {0, 1}, {2}, shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy));
+  (void)inc.place(3);
+  const auto b = inc.place(1);
+  EXPECT_TRUE(b.call_edge_drops.empty());
+  EXPECT_EQ(b.edge_drops, (Counters {{0, c(1)}}));
+}
+
+// A row for every input source; total_cost only for the controllers.
+TEST(ResultShape, RowsForEveryInputSource) {
+  Case k(kRows, {0, 1, 4}, {3}, shortest_paths_policy(), {4});
+  EXPECT_EQ(rows(k.place(3)),
+            (std::vector<Row> {{0, kNone, 3, 3, 0, 0}, {1, kNone, 0, 0, 0, 0}, {4, kNone, 0, 0, 0, 0}}));
+  const auto g = graph(kB1);
+  const Pinned pin = pinned_dags(*g, 0, 3, {dag_of(*g, {0})});
+  for (const auto& cfg : {shortest_paths_policy(), shortest_paths_policy(RouteAllocation::Weighted)}) {
+    FlowLedger fg(g);
+    EXPECT_FALSE(FlowPolicy(fg, v({0, 1}), v({3}), cfg).place(1).total_cost.has_value());
+  }
+  FlowLedger ft(g);
+  EXPECT_FALSE(FlowPolicy(ft, v({0, 1}), v({3}), FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}})
+                   .replace(1)
+                   .total_cost.has_value());
+  FlowLedger fg(g);
+  EXPECT_FALSE(FlowPolicy(fg, v({0}), v({3}), FlowPolicyConfig {.routing = pin}).place(1).total_cost.has_value());
+  FlowLedger fs(g);
+  EXPECT_EQ(*FlowPolicy(fs, v({0}), v({3}), FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(*g, {0}))}).place(1).total_cost,
+            c(1));
+  Case mf(kB1, {0, 1}, {3}, shortest_paths_policy(RouteAllocation::Optimized));
+  EXPECT_EQ(*mf.place(12).total_cost, c(32));
+}
+
+// Pinned over a zero edge in the new shape.
+TEST(ResultShape, PinnedInTheNewShape) {
+  const auto g = graph(kZero);
+  FlowLedger fg(g);
+  FlowPolicy w(fg, v({0}), v({1}),
+               FlowPolicyConfig {.routing = pinned_dags(*g, 0, 1, {dag_of(*g, {0})}, RouteAllocation::Weighted),
+                                 .admission = Admission::Lossy});
+  const auto r = w.place(2);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+  EXPECT_EQ(r.call_source_drops, 2);
+  EXPECT_EQ(lo(r.source_drops), 2);
+  EXPECT_EQ(lo(r.offered), 2);
+  EXPECT_EQ(rows(r), (std::vector<Row> {{0, 2, 2, 0, 2, 0}}));
+  FlowLedger fg2(g);
+  FlowPolicy eb(fg2, v({0}), v({1}),
+                FlowPolicyConfig {.routing = pinned_dags(*g, 0, 1, {dag_of(*g, {0})}), .admission = Admission::Lossy});
+  const auto e = eb.place(2);
+  EXPECT_EQ(e.edge_drops, (Counters {{0, c(2)}}));
+  EXPECT_EQ(e.termination, Termination::Complete);
+}
+
+// ---------------------------------------------------------------- evaluators
+
+TEST(Evaluators, CapacityUnderBothOrigins) {
+  const auto g = graph(kB1);
+  const std::vector<std::pair<FlowPolicyConfig, Amount>> wants = {
+      {glob(SourceAllocation::Equal), 4},
+      {glob(), 12},
+      {shortest_paths_policy(RouteAllocation::Optimized), 12},
+      {shortest_paths_policy(RouteAllocation::Optimized, Admission::Lossless, {}, SourceAllocation::Equal), 4},
+      {shortest_paths_policy(), 4},
+  };
+  for (const auto& [cfg, delivered] : wants) EXPECT_EQ(evaluate_demand(*g, v({0, 1}), v({3}), EvaluationOptions {cfg}).call_delivered, delivered);
+  EXPECT_EQ(evaluate_demand(*graph(kPool), v({0, 1}), v({3}), EvaluationOptions {shortest_paths_policy()}).call_delivered, 2);
+  const auto r = evaluate_demand(*graph(kPriv), v({0, 1}), v({2}),
+                          EvaluationOptions {shortest_paths_policy(RouteAllocation::Equal, Admission::Lossy)});
+  EXPECT_EQ(r.delivered, 10);
+  EXPECT_EQ(lo(r.offered), 10);
+  EXPECT_FALSE(r.requested.has_value());
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+TEST(Evaluators, BatchEqual) {
+  const auto g = graph(kB1);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{{0, 1}, {3}}, {{0}, {3}}, {{1}, {3}}};
+  std::vector<Amount> got;
+  for (const auto& r : evaluate_pairs(*g, pairs, EvaluationOptions {glob(SourceAllocation::Equal)}, {}, 2)) got.push_back(r.call_delivered);
+  EXPECT_EQ(got, (std::vector<Amount> {4, 2, 10}));
+}
+
+// The pooled single-path rule per pair, the lowest failing pair.
+TEST(Evaluators, BatchQ12PerPair) {
+  const auto g = graph(kPool);
+  const EvaluationOptions opts {shortest_paths_policy(RouteAllocation::Equal, Admission::Lossless, kPreferPath)};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> bad = {{{0}, {3}}, {{0, 1}, {3}}};
+  EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, bad, opts, {}, 1); }), kQ12);
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> good = {{{0}, {3}}, {{1}, {3}}};
+  EXPECT_EQ(evaluate_pairs(*g, good, opts, {}, 1).size(), 2U);
+}
+
+// Every allowed edge is a candidate under the equal source allocation.
+TEST(Evaluators, SensitivityEqualGlobal) {
+  for (int workers : {1, 2}) {
+    const auto r = evaluate_edge_failures(*graph(kB3Z), v({0, 1}), v({2}), EvaluationOptions {glob(SourceAllocation::Equal)}, workers);
+    EXPECT_EQ(r.baseline.call_delivered, 0);
+    std::vector<std::pair<EdgeId, Amount>> got;
+    for (const auto& e : r.entries) got.emplace_back(e.edge, e.delivery_reduction);
+    EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, -10}, {1, 0}}));
+  }
+}
+
+// Pooled ShortestPaths: deleting e0 takes source 0 out of the roster.
+TEST(Evaluators, SensitivityPooled) {
+  const auto r = evaluate_edge_failures(*graph(kB1), v({0, 1}), v({3}), EvaluationOptions {shortest_paths_policy()}, 1);
+  EXPECT_EQ(r.baseline.call_delivered, 4);
+  std::vector<std::pair<EdgeId, Amount>> got;
+  for (const auto& e : r.entries) got.emplace_back(e.edge, e.delivery_reduction);
+  EXPECT_EQ(got, (std::vector<std::pair<EdgeId, Amount>> {{0, -6}, {1, 2}, {2, 2}}));
+}
diff --git a/tests/cpp/program_tests.cpp b/tests/cpp/program_tests.cpp
new file mode 100644
index 0000000..c48ee10
--- /dev/null
+++ b/tests/cpp/program_tests.cpp
@@ -0,0 +1,2562 @@
+// Forwarding programs, natively: what every model exports, CentralizedTE with a support, the
+// weight bases, ForwardingProgram::from_routes, Pinned over programs, the lossless bound, the loss
+// rule inside one program (cycles included), replay under a failure mask, stale forwarding with
+// black holes, the operations evaluate, replace and forward with their epochs and flags, the
+// per-entry records, the by_tunnel rows and their 128-bit counters, the evaluators' offer, and
+// common Pinned setups written as programs. Each test checks hand-derived values on small
+// graphs whose EdgeIds equal their input positions (asserted); none is read from a build. Then the storage of the new layouts (a restricted plan, a forwarding view, an epoch)
+// against borrowing copies, and a property test of random tunnel programs against the
+// independent reference of test_utils.hpp (program_reference).
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <functional>
+#include <limits>
+#include <memory>
+#include <optional>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/sparse.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/private_hooks.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+constexpr RouteAllocation EB = RouteAllocation::Equal;
+constexpr RouteAllocation W = RouteAllocation::Weighted;
+constexpr RouteAllocation MF = RouteAllocation::Optimized;
+constexpr Admission LOSSY = Admission::Lossy;
+constexpr Admission LOSSLESS = Admission::Lossless;
+constexpr TunnelStatus UP = TunnelStatus::Up;
+constexpr TunnelStatus FAILED = TunnelStatus::Failed;
+constexpr TunnelStatus BLACKHOLED = TunnelStatus::Blackholed;
+const std::optional<Amount> INF;  // +inf
+
+using Spec = std::tuple<NodeId, std::vector<EdgeId>, Amount>;  // (head, path edges, weight)
+using Listing = std::vector<Spec>;
+using Row = std::tuple<std::int32_t, NodeId, TunnelStatus, Amount, Amount, Amount>;
+using Rows = std::vector<Row>;  // (index, head, status, assigned, delivered, dropped)
+using Drops = std::vector<std::pair<EdgeId, Amount>>;
+using Amounts = std::vector<Amount>;
+
+Counter128 c(Amount x) { return Counter128 {0, static_cast<std::uint64_t>(x)}; }
+Amount lo(const Counter128& x) {
+  EXPECT_EQ(x.hi, 0U);
+  return static_cast<Amount>(x.lo);
+}
+Amount lo(const std::optional<Counter128>& x) {
+  EXPECT_TRUE(x.has_value());
+  return x.has_value() ? lo(*x) : -1;
+}
+
+// A graph whose rows are already in EdgeId order (source, cost, destination, input).
+std::shared_ptr<const Graph> graph(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+std::shared_ptr<const Graph> par2(Amount a, Amount b) { return graph(2, {{0, 1, a, 1}, {0, 1, b, 1}}); }
+
+const std::vector<InEdge> kOne = {{0, 1, 10, 1}};
+const std::vector<InEdge> kB1 = {{0, 3, 2, 1}, {1, 2, 10, 1}, {2, 3, 10, 2}};
+const std::vector<InEdge> kB2 = {{0, 1, 4, 1}, {0, 2, 2, 1}, {1, 2, 10, 1}};
+const std::vector<InEdge> kES = {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 2, 1}, {2, 3, 10, 2}};
+const std::vector<InEdge> kG1U = {{0, 1, 2, 1}, {0, 2, 10, 1}, {1, 3, 2, 1}, {2, 3, 10, 1}};
+const std::vector<InEdge> kPinloss = {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 2, 1}, {2, 3, 10, 1}};
+const std::vector<InEdge> kDiam = {{0, 1, 100, 1}, {0, 2, 100, 1}, {1, 3, 100, 1}, {2, 3, 100, 1}};
+const std::vector<InEdge> kPool2 = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}, {2, 3, 10, 1}};
+const std::vector<InEdge> kRel = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 10, 1}};
+const std::vector<InEdge> kTun = {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 10, 1}};
+const std::vector<InEdge> kMB = {{0, 1, 10, 1}, {0, 2, 10, 1}, {0, 3, 10, 1},
+                                 {1, 4, 10, 1}, {2, 4, 10, 1}, {3, 4, 10, 1}};
+const std::vector<InEdge> kSurv = {{0, 3, 3, 1}, {1, 3, 1, 1}, {2, 3, 5, 1}};
+const std::vector<InEdge> kRB = {{0, 2, 5, 1}, {1, 2, 5, 1}, {1, 2, 5, 2}};
+const std::vector<InEdge> kInc = {{0, 2, 1, 1}, {1, 2, 3, 1}};
+const std::vector<InEdge> kShare = {{0, 1, 4, 1}, {1, 2, 10, 1}, {1, 2, 10, 1}};
+const std::vector<InEdge> kHier = {{0, 2, 1000, 1}, {1, 2, 1000, 1}, {2, 3, 1, 1}};
+
+// CYC(x, y): tunnel 0 = [e6, e0, e1, e3, e5] meets X (e0) then Y (e3); tunnel 1 = [e7, e3, e4,
+// e0, e2] meets Y then X; 4 -> 5.
+std::shared_ptr<const Graph> cyc(Amount x, Amount y) {
+  return graph(6, {{0, 1, x, 1},
+                   {1, 2, 1000, 1},
+                   {1, 5, 1000, 1},
+                   {2, 3, y, 1},
+                   {3, 0, 1000, 1},
+                   {3, 5, 1000, 1},
+                   {4, 0, 1000, 1},
+                   {4, 2, 1000, 1}});
+}
+const std::vector<EdgeId> kCycT0 = {6, 0, 1, 3, 5};
+const std::vector<EdgeId> kCycT1 = {7, 3, 4, 0, 2};
+
+// CYCS(x, y, z): CYC with Y split in series, e3: 2 -> 6 cap y, e8: 6 -> 3 cap z.
+std::shared_ptr<const Graph> cycs(Amount x, Amount y, Amount z) {
+  return graph(7, {{0, 1, x, 1},
+                   {1, 2, 1000, 1},
+                   {1, 5, 1000, 1},
+                   {2, 6, y, 1},
+                   {3, 0, 1000, 1},
+                   {3, 5, 1000, 1},
+                   {4, 0, 1000, 1},
+                   {4, 2, 1000, 1},
+                   {6, 3, z, 1}});
+}
+const std::vector<EdgeId> kCycsT0 = {6, 0, 1, 3, 8, 5};
+const std::vector<EdgeId> kCycsT1 = {7, 3, 8, 4, 0, 2};
+
+std::shared_ptr<const Path> path(const Graph& g, const std::vector<EdgeId>& edges) {
+  std::vector<std::vector<EdgeId>> hops;
+  for (EdgeId e : edges) hops.push_back({e});
+  return std::make_shared<const Path>(g, hops);
+}
+RouteDefinition tunnel_route(const Graph& g, NodeId head, const std::vector<EdgeId>& edges, Amount weight = 1) {
+  return RouteDefinition {head, path(g, edges), weight};
+}
+RouteDefinition dag_route(const Graph& g, NodeId head, const std::vector<EdgeId>& edges, Amount weight = 1) {
+  return RouteDefinition {head, dag_of(g, edges), weight};
+}
+std::shared_ptr<const ForwardingProgram> program(const Graph& g, const std::vector<NodeId>& s,
+                                                 const std::vector<NodeId>& d, const std::vector<RouteDefinition>& routes,
+                                                 const RouteOptions& options = {}) {
+  return ForwardingProgram::from_routes(g, s, d, routes, options);
+}
+// A supplied program of tunnels.
+std::shared_ptr<const ForwardingProgram> tunnels(const Graph& g, const std::vector<NodeId>& s,
+                                                 const std::vector<NodeId>& d, const std::vector<Spec>& specs) {
+  std::vector<RouteDefinition> routes;
+  for (const auto& [h, es, w] : specs) routes.push_back(tunnel_route(g, h, es, w));
+  return program(g, s, d, routes);
+}
+
+std::shared_ptr<const Eligibility> no_nodes(const Graph& g, const std::vector<NodeId>& nodes) {
+  return std::make_shared<const Eligibility>(g.eligibility(nodes, {}));
+}
+std::shared_ptr<const Eligibility> no_edges(const Graph& g, const std::vector<EdgeId>& edges) {
+  return std::make_shared<const Eligibility>(g.eligibility({}, edges));
+}
+
+// A policy with what it points to: the ledger and the Eligibility outlive it (declared first).
+struct Pol {
+  std::shared_ptr<FlowLedger> ledger;
+  std::shared_ptr<const Eligibility> elig;
+  std::unique_ptr<FlowPolicy> p;
+  FlowPolicy* operator->() const { return p.get(); }
+};
+
+Pol make(const std::shared_ptr<const Graph>& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+         FlowPolicyConfig cfg, std::shared_ptr<const Eligibility> elig = nullptr,
+         std::shared_ptr<FlowLedger> ledger = nullptr) {
+  Pol out {ledger ? std::move(ledger) : std::make_shared<FlowLedger>(g), std::move(elig), nullptr};
+  out.p = std::make_unique<FlowPolicy>(*out.ledger, s, d, std::move(cfg), out.elig.get());
+  return out;
+}
+
+FlowPolicyConfig shortest_paths_policy(RouteAllocation placement = EB, Admission admission = LOSSLESS) {
+  return FlowPolicyConfig {.routing = netgraph::core::test::shortest_paths(placement), .admission = admission};
+}
+FlowPolicyConfig weighted(Admission admission, WeightBasis basis, std::vector<Amount> edge_weights = {}) {
+  ShortestPaths sp = netgraph::core::test::shortest_paths(W);
+  sp.weight_basis = basis;
+  if (basis == WeightBasis::Explicit) sp.edge_weights = std::make_shared<const std::vector<Amount>>(std::move(edge_weights));
+  return FlowPolicyConfig {.routing = sp, .admission = admission};
+}
+FlowPolicyConfig global(std::optional<SourceAllocation> source_allocation = std::nullopt, std::shared_ptr<const PredecessorDAG> support = nullptr) {
+  return FlowPolicyConfig {.routing = centralized(source_allocation.value_or(SourceAllocation::Optimized), std::move(support))};
+}
+FlowPolicyConfig pinned_config(std::shared_ptr<const ForwardingProgram> prog, Admission admission = LOSSLESS,
+                               std::shared_ptr<const Eligibility> black_holes = nullptr) {
+  return FlowPolicyConfig {.routing = Pinned {std::move(prog), std::move(black_holes)}, .admission = admission};
+}
+FlowPolicyConfig capacity_aware() { return FlowPolicyConfig {.routing = DistributedTE {TunnelCount {1}}}; }
+
+Pol pinned(const std::shared_ptr<const Graph>& g, const std::shared_ptr<const ForwardingProgram>& prog,
+           Admission admission = LOSSLESS, std::shared_ptr<const Eligibility> elig = nullptr,
+           std::shared_ptr<const Eligibility> black_holes = nullptr, std::shared_ptr<FlowLedger> ledger = nullptr) {
+  return make(g, vec(prog->sources()), vec(prog->destinations()), pinned_config(prog, admission, std::move(black_holes)),
+              std::move(elig), std::move(ledger));
+}
+
+Rows rows(const PlacementResult& r) {
+  Rows out;
+  for (const auto& t : r.by_tunnel) out.emplace_back(t.entry_id, t.head, t.status, lo(t.assigned), t.delivered, lo(t.total_edge_drops));
+  return out;
+}
+Listing listing(const ForwardingProgram& p) {
+  Listing out;
+  for (const auto& t : p.tunnels()) out.emplace_back(t.head, t.edges.value_or(std::vector<EdgeId> {}), t.weight);
+  return out;
+}
+std::vector<std::optional<std::int32_t>> entries(const FlowPolicy& p) {
+  std::vector<std::optional<std::int32_t>> out;
+  for (const auto& r : p.records()) out.push_back(r.entry_id);
+  return out;
+}
+Amounts delivered(const FlowPolicy& p) {
+  Amounts out;
+  for (const auto& r : p.records()) out.push_back(r.delivered);
+  return out;
+}
+std::vector<std::int64_t> ids(const FlowPolicy& p) {
+  std::vector<std::int64_t> out;
+  for (const auto& r : p.records()) out.push_back(r.flow_id.second);
+  return out;
+}
+
+const OutputOptions kEdges {.edge_flows = true};
+
+EvaluationOptions query(FlowPolicyConfig cfg, std::optional<std::optional<Amount>> offered = std::nullopt) {
+  EvaluationOptions q {std::move(cfg)};
+  q.offer = offered;
+  return q;
+}
+std::optional<std::optional<Amount>> offer(Amount x) { return std::optional<std::optional<Amount>> {std::in_place, x}; }
+std::optional<std::optional<Amount>> offer_inf() { return std::optional<std::optional<Amount>> {std::in_place, std::nullopt}; }
+
+std::vector<std::pair<EdgeId, Amount>> losses(const SensitivityResult& s) {
+  std::vector<std::pair<EdgeId, Amount>> out;
+  for (const auto& e : s.entries) out.emplace_back(e.edge, e.delivery_reduction);
+  return out;
+}
+
+const std::string kFinite = "LOSSY forwarding requires a finite offer";
+const std::string kNoProgram = "forward requires an installed program";
+const std::string kPeriodTwo = "lossy forwarding iteration entered a period-2 cycle";
+const std::string kRoundLimit = "lossy forwarding iteration did not reach a fixed point within the round limit";
+
+} // namespace
+
+// ---------------------------------------------------------------- exported programs
+
+// B1, CentralizedTE optimized, place(12).
+TEST(ProgramExport, GlobalOptimized) {
+  const auto g = graph(4, kB1);
+  auto p = make(g, {0, 1}, {3}, global());
+  const auto r = p->place(12);
+  ASSERT_TRUE(r.program);
+  const auto& prog = *r.program;
+  EXPECT_EQ(listing(prog), (Listing {{0, {0}, 2}, {1, {1, 2}, 10}}));
+  std::vector<std::tuple<std::int32_t, std::int32_t, NodeId, Cost>> fields;
+  for (const auto& t : prog.tunnels()) fields.emplace_back(t.entry_id, t.local_index, *t.destination, *t.path_cost);
+  EXPECT_EQ(fields, (std::vector<std::tuple<std::int32_t, std::int32_t, NodeId, Cost>> {{0, 0, 3, 1}, {1, 0, 3, 3}}));
+  ASSERT_TRUE(prog.source_weights().has_value());
+  EXPECT_EQ(*prog.source_weights(), (std::vector<std::pair<NodeId, Amount>> {{0, 2}, {1, 10}}));
+  EXPECT_EQ(vec(prog.sources()), v({0, 1}));
+  EXPECT_EQ(vec(prog.destinations()), v({3}));
+  EXPECT_EQ(prog.graph_uid(), g->uid());
+  EXPECT_EQ(entries(*p.p), (std::vector<std::optional<std::int32_t>> {std::nullopt, std::nullopt}));
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 2, 2, 0}, {1, 1, UP, 10, 10, 0}}));
+  EXPECT_EQ(p->program(), r.program);
+}
+
+// The equal source allocation admits 4 and keeps no source weights.
+TEST(ProgramExport, GlobalEqual) {
+  const auto g = graph(4, kB1);
+  auto p = make(g, {0, 1}, {3}, global(SourceAllocation::Equal));
+  const auto r = p->place(12);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0}, 2}, {1, {1, 2}, 2}}));
+  EXPECT_FALSE(r.program->source_weights().has_value());
+}
+
+// One source is decomposed too.
+TEST(ProgramExport, SingleSourceDecomposed) {
+  const auto g = graph(4, kES);
+  auto p = make(g, {0}, {3}, global());
+  const auto r = p->place(12);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0, 2}, 2}, {0, {1, 3}, 10}}));
+  std::vector<std::pair<std::int32_t, Cost>> fields;
+  for (const auto& t : r.program->tunnels()) fields.emplace_back(t.local_index, *t.path_cost);
+  EXPECT_EQ(fields, (std::vector<std::pair<std::int32_t, Cost>> {{0, 2}, {1, 3}}));
+  EXPECT_EQ(r.total_cost, c(34));
+  EXPECT_EQ(*r.program->source_weights(), (std::vector<std::pair<NodeId, Amount>> {{0, 12}}));
+}
+
+// ShortestPaths Optimized exports its controller's paths.
+TEST(ProgramExport, ShortestPathsMaxFlow) {
+  const auto g = graph(4, kES);
+  auto p = make(g, {0}, {3}, shortest_paths_policy(MF));
+  const auto r = p->place(12);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0, 2}, 2}}));
+  EXPECT_EQ(*r.program->source_weights(), (std::vector<std::pair<NodeId, Amount>> {{0, 2}}));
+}
+
+// A ShortestPaths split program lists no tunnel.
+TEST(ProgramExport, ShortestPathsSplit) {
+  const auto g = graph(4, kPool2);
+  auto p = make(g, {0, 1}, {3}, shortest_paths_policy());
+  const auto r = p->place(2);
+  ASSERT_TRUE(r.program);
+  EXPECT_TRUE(r.program->tunnels().empty());
+  EXPECT_FALSE(r.program->source_weights().has_value());
+  EXPECT_EQ(vec(r.program->sources()), v({0, 1}));
+  EXPECT_EQ(vec(r.program->destinations()), v({3}));
+  EXPECT_TRUE(r.by_tunnel.empty());
+}
+
+// Every roster source keeps its source weight, zero included.
+TEST(ProgramExport, ZeroSupplyKept) {
+  const auto g = graph(3, {{0, 2, 5, 1}, {1, 2, 5, 1}});
+  auto p = make(g, {0, 1}, {2}, global());
+  const auto r = p->place(1);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0}, 1}}));
+  EXPECT_EQ(*r.program->source_weights(), (std::vector<std::pair<NodeId, Amount>> {{0, 1}, {1, 0}}));
+}
+
+// No program before the first positive call; a zero call reports none.
+TEST(ProgramExport, NoneBeforePreparation) {
+  const auto g = graph(3, {{0, 2, 5, 1}, {1, 2, 5, 1}});
+  for (const auto& cfg : {global(), shortest_paths_policy()}) {
+    auto p = make(g, {0, 1}, {2}, cfg);
+    EXPECT_EQ(p->program(), nullptr);
+    const auto z = p->place(0);
+    EXPECT_EQ(z.program, nullptr);
+    EXPECT_TRUE(z.by_tunnel.empty());
+    EXPECT_EQ(p->program(), nullptr);
+    (void)p->place(3);
+    EXPECT_NE(p->program(), nullptr);
+  }
+}
+
+// B1's optimized program forwarded by Pinned reproduces the solve.
+TEST(ProgramExport, ReplayReproducesTheSolve) {
+  const auto g = graph(4, kB1);
+  auto solver = make(g, {0, 1}, {3}, global());
+  const auto prog = solver->place(12).program;
+  auto p = pinned(g, prog);
+  const auto r = p->place(12, kEdges);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_EQ(*r.edge_flows, (Amounts {2, 10, 10}));
+  EXPECT_EQ(pinned(g, prog)->place(INF).call_delivered, 12);
+}
+
+// The producer's mask is saved: no replay brings source 1 back.
+TEST(ProgramExport, MaskSaved) {
+  const auto g = graph(4, kB1);
+  auto masked = make(g, {0, 1}, {3}, global(), no_nodes(*g, {1}));
+  const auto r = masked->place(12);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0}, 2}}));
+  const auto lossy = pinned(g, r.program, LOSSY)->replace(12);
+  EXPECT_EQ(lossy.call_delivered, 2);
+  ASSERT_EQ(lossy.by_source.size(), 2U);
+  EXPECT_EQ(lo(lossy.by_source[0].offered), 12);
+  EXPECT_EQ(lo(lossy.by_source[1].offered), 0);
+}
+
+// An empty roster installs an empty program.
+TEST(ProgramExport, EmptyRoster) {
+  const auto g = graph(2, kOne);
+  auto p = make(g, {0}, {1}, shortest_paths_policy(), no_nodes(*g, {0}));
+  const auto r = p->place(1);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  ASSERT_TRUE(r.program);
+  EXPECT_TRUE(r.program->tunnels().empty());
+  EXPECT_EQ(vec(r.program->sources()), v({0}));
+  EXPECT_FALSE(r.routes_changed);
+  EXPECT_FALSE(r.weights_changed);
+}
+
+// The policy's program is the configured one.
+TEST(PinnedProgram, ProgramIsTheConfiguredOne) {
+  const auto g = graph(4, kB1);
+  auto solver = make(g, {0, 1}, {3}, global());
+  const auto prog = solver->place(12).program;
+  auto p = pinned(g, prog);
+  const auto r = p->place(1);
+  EXPECT_EQ(r.program, prog);
+  EXPECT_EQ(p->program(), prog);
+  EXPECT_EQ(listing(*r.program), listing(*prog));
+}
+
+// ---------------------------------------------------------------- CentralizedTE with a support
+
+// Only the support carries traffic; no cut, no curve.
+TEST(GlobalSupport, OnlyTheSupport) {
+  const auto g = graph(4, kES);
+  auto p = make(g, {0}, {3}, global(std::nullopt, dag_of(*g, {1, 3})));
+  const auto r = p->place(12, OutputOptions {.min_cut = true});
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(r.total_cost, c(30));
+  EXPECT_FALSE(r.min_cut.has_value());
+  EXPECT_FALSE(r.marginal_cost_curve.has_value());
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {1, 3}, 10}}));
+  const auto full = make(g, {0}, {3}, global())->place(12);
+  EXPECT_EQ(full.call_delivered, 12);
+  EXPECT_EQ(full.total_cost, c(34));
+}
+
+// e0 leads nowhere inside the support: trimmed.
+TEST(GlobalSupport, Trimmed) {
+  const auto g = graph(4, kES);
+  const auto r = make(g, {0}, {3}, global(std::nullopt, dag_of(*g, {0, 1, 3})))->place(12, kEdges);
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(*r.edge_flows, (Amounts {0, 10, 0, 10}));
+}
+
+// The mask removes the support: an empty roster.
+TEST(GlobalSupport, MaskRemovesSupport) {
+  const auto g = graph(4, kES);
+  const auto r = make(g, {0}, {3}, global(std::nullopt, dag_of(*g, {1, 3})), no_edges(*g, {3}))->place(12);
+  EXPECT_EQ(r.termination, Termination::NoRoute);
+  EXPECT_EQ(r.call_delivered, 0);
+  ASSERT_TRUE(r.program);
+  EXPECT_TRUE(r.program->tunnels().empty());
+}
+
+// The equal source allocation on a support: RR(4, 2) fits, RR(5, 2) does not.
+TEST(GlobalSupport, EqualOrigin) {
+  const auto g = graph(3, kB2);
+  const auto r = make(g, {0, 1}, {2}, global(SourceAllocation::Equal, dag_of(*g, {1, 2})))->place(12);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(r.total_cost, c(4));
+}
+
+// Every allowed link of a support is a candidate, no shortcut.
+TEST(GlobalSupport, Sensitivity) {
+  const auto g = graph(4, kES);
+  const auto s = evaluate_edge_failures(*g, v({0}), v({3}), query(global(std::nullopt, dag_of(*g, {1, 3}))), 1);
+  EXPECT_EQ(s.baseline.call_delivered, 10);
+  EXPECT_EQ(losses(s), (std::vector<std::pair<EdgeId, Amount>> {{0, 0}, {1, 10}, {2, 0}, {3, 10}}));
+}
+
+// total_cost 2^70 (high half 64, low half 0).
+TEST(GlobalSupport, TotalCostBeyond64Bits) {
+  const auto g = graph(2, {{0, 1, Amount {1} << 40, Cost {1} << 30}});
+  const auto r = make(g, {0}, {1}, global(std::nullopt, dag_of(*g, {0})))->place(Amount {1} << 40);
+  EXPECT_EQ(r.call_delivered, Amount {1} << 40);
+  ASSERT_TRUE(r.total_cost.has_value());
+  EXPECT_EQ(r.total_cost->hi, 64U);
+  EXPECT_EQ(r.total_cost->lo, 0U);
+}
+
+// A support of another graph.
+TEST(GlobalSupport, Ownership) {
+  const auto g = graph(2, {{0, 1, 1, 1}});
+  const auto other = graph(2, {{0, 1, 1, 1}});
+  FlowLedger fg(g);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), global(std::nullopt, dag_of(*other, {0}))); }),
+            "support belongs to another graph");
+}
+
+// ---------------------------------------------------------------- weight bases
+
+// Configured weights; CAPACITY weights give (6, 6); the lossless bound 15.
+TEST(WeightBases, Explicit) {
+  const auto g = par2(10, 10);
+  EXPECT_EQ(*make(g, {0}, {1}, weighted(LOSSY, WeightBasis::Explicit, {1, 2}))->place(12, kEdges).edge_flows,
+            (Amounts {4, 8}));
+  EXPECT_EQ(*make(g, {0}, {1}, shortest_paths_policy(W, LOSSY))->place(12, kEdges).edge_flows, (Amounts {6, 6}));
+  const auto ll = weighted(LOSSLESS, WeightBasis::Explicit, {1, 2});
+  EXPECT_EQ(make(g, {0}, {1}, ll)->place(INF).call_delivered, 15);
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), query(ll)).call_delivered, 15);
+}
+
+// Legal weights below 2^62 each may sum to 2^64 or more; the sum is exact. Eight
+// equal weights of 2^61 (sum 2^64) and of 2^62 - 1 split 8 units as RR(8, 8) = one each; unequal
+// weights (2^62 - 1, 2^61, 2^61 + 1, 1), W = 2^63 + 1: H(9, w) = (5, 2, 2, 0). Through the helper,
+// tunnels and explicit WCMP, both admissions.
+TEST(WeightBases, WeightSumsBeyond64Bits) {
+  for (const Amount w : {Amount {1} << 61, (Amount {1} << 62) - 1}) {
+    Amounts out(8, 0);
+    detail::highest_averages(8, Amounts(8, w), out);
+    EXPECT_EQ(out, Amounts(8, 1)) << w;
+    std::vector<InEdge> rows(8, InEdge {0, 1, 100, 1});
+    const auto g = graph(2, rows);
+    std::vector<std::tuple<NodeId, std::vector<EdgeId>, Amount>> specs;
+    for (EdgeId e = 0; e < 8; ++e) specs.emplace_back(0, std::vector<EdgeId> {e}, w);
+    for (const auto admission : {LOSSLESS, LOSSY}) {
+      auto t = pinned(g, tunnels(*g, {0}, {1}, specs), admission);
+      const auto r = t->replace(8, std::nullopt, kEdges);
+      EXPECT_EQ(r.call_delivered, 8) << w;
+      EXPECT_EQ(*r.edge_flows, Amounts(8, 1)) << w;
+      EXPECT_TRUE(r.source_drops.is_zero()) << w;
+      const auto x = make(g, {0}, {1}, weighted(admission, WeightBasis::Explicit, Amounts(8, w)))->replace(8, std::nullopt, kEdges);
+      EXPECT_EQ(x.call_delivered, 8) << w;
+      EXPECT_EQ(*x.edge_flows, Amounts(8, 1)) << w;
+    }
+  }
+  const Amounts unequal = {(Amount {1} << 62) - 1, Amount {1} << 61, (Amount {1} << 61) + 1, 1};
+  Amounts out(4, 0);
+  detail::highest_averages(9, unequal, out);
+  EXPECT_EQ(out, (Amounts {5, 2, 2, 0}));
+  // The equal-weight control below 2^64: the same split.
+  detail::highest_averages(8, Amounts(8, 3), out = Amounts(8, 0));
+  EXPECT_EQ(out, Amounts(8, 1));
+}
+
+// Snapshot weights over the baseline (2, 10).
+TEST(WeightBases, Snapshot) {
+  const auto g = par2(10, 10);
+  const Amounts base = {2, 10};
+  auto ledger = [&] { return std::make_shared<FlowLedger>(g, base); };
+  EXPECT_EQ(make(g, {0}, {1}, shortest_paths_policy(W), nullptr, ledger())->place(12).call_delivered, 4);
+  EXPECT_EQ(make(g, {0}, {1}, weighted(LOSSLESS, WeightBasis::ResidualSnapshot), nullptr, ledger())->place(12).call_delivered,
+            12);
+}
+
+// The tie rule never chooses weights (CAPACITY is the default).
+TEST(WeightBases, TieRuleIsNotAWeight) {
+  const auto g = par2(10, 10);
+  auto cfg = shortest_paths_policy(W);
+  auto p = make(g, {0}, {1}, cfg, nullptr, std::make_shared<FlowLedger>(g, Amounts {2, 10}));
+  EXPECT_EQ(p->place(12).call_delivered, 4);
+  EXPECT_EQ(std::get<ShortestPaths>(p->config().routing).weight_basis, WeightBasis::Capacity);
+}
+
+// A positive weight on an edge of capacity 0 becomes 0: all 7 on e1, no drop.
+TEST(WeightBases, ExplicitOnZeroCapacity) {
+  const auto g = par2(0, 10);
+  const auto r = make(g, {0}, {1}, weighted(LOSSY, WeightBasis::Explicit, {5, 1}))->place(7);
+  EXPECT_EQ(r.call_delivered, 7);
+  EXPECT_TRUE(r.call_edge_drops.empty());
+}
+
+// A zero weight prunes its edge.
+TEST(WeightBases, ExplicitZeroPrunes) {
+  const auto g = par2(10, 10);
+  EXPECT_EQ(make(g, {0}, {1}, weighted(LOSSLESS, WeightBasis::Explicit, {0, 3}))->place(12).call_delivered, 10);
+  const auto r = make(g, {0}, {1}, weighted(LOSSY, WeightBasis::Explicit, {0, 3}))->place(12);
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{1, 2}}));
+}
+
+// Every weight 0: NO_ACTIVE_WEIGHT; Lossy loses the offer at the source.
+TEST(WeightBases, AllZeroIsNoActiveWeight) {
+  const auto g = par2(10, 10);
+  for (const auto& [adm, loss] : {std::pair {LOSSY, Amount {5}}, std::pair {LOSSLESS, Amount {0}}}) {
+    const auto r = make(g, {0}, {1}, weighted(adm, WeightBasis::Explicit, {0, 0}))->place(5);
+    EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+    EXPECT_EQ(r.call_delivered, 0);
+    EXPECT_EQ(r.source_drops, c(loss));
+  }
+}
+
+// Weighted with HIGHER_HEADROOM is accepted (ShortestPaths): the single path is e1.
+TEST(WeightBases, WeightedWithHeadroom) {
+  const auto g = par2(10, 10);
+  ShortestPaths headroom = netgraph::core::test::shortest_paths(W);
+  headroom.tie_break = RouteTieBreak::HigherHeadroom;
+  headroom.multipath = false;
+  const FlowPolicyConfig cfg {.routing = headroom};
+  auto p = make(g, {0}, {1}, cfg, nullptr, std::make_shared<FlowLedger>(g, Amounts {2, 10}));
+  EXPECT_EQ(p->place(12).call_delivered, 10);
+}
+
+// The snapshot is frozen for the epoch: call 2 splits 6 as H(6, (2, 10)) = (1, 5), both
+// dropped.
+TEST(WeightBases, SnapshotFrozenForTheEpoch) {
+  const auto g = par2(10, 10);
+  auto p = make(g, {0}, {1}, weighted(LOSSY, WeightBasis::ResidualSnapshot), nullptr,
+                std::make_shared<FlowLedger>(g, Amounts {2, 10}));
+  EXPECT_EQ(*p->place(12, kEdges).edge_flows, (Amounts {2, 10}));
+  const auto r = p->place(6);
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{0, 1}, {1, 5}}));
+  EXPECT_EQ(r.call_source_drops, 0);
+}
+
+// The texts of the weight fields (only ShortestPaths has them).
+TEST(WeightBases, MatrixTexts) {
+  const auto g = par2(10, 10);
+  FlowLedger fg(g);
+  auto with = [](FlowPolicyConfig cfg, std::optional<WeightBasis> w, std::optional<std::vector<Amount>> ew) {
+    auto& sp = std::get<ShortestPaths>(cfg.routing);
+    sp.weight_basis = w;
+    if (ew.has_value()) sp.edge_weights = std::make_shared<const std::vector<Amount>>(*ew);
+    return cfg;
+  };
+  const std::vector<std::pair<FlowPolicyConfig, std::string>> cases = {
+      {with(shortest_paths_policy(), WeightBasis::Capacity, std::nullopt), "weight_basis requires allocation=WEIGHTED"},
+      {with(shortest_paths_policy(), std::nullopt, Amounts {1, 1}), "edge_weights require weight_basis=EXPLICIT"},
+      {with(shortest_paths_policy(W), WeightBasis::Explicit, std::nullopt), "weight_basis=EXPLICIT requires edge_weights"},
+      {with(shortest_paths_policy(W), WeightBasis::Capacity, Amounts {1, 1}), "edge_weights require weight_basis=EXPLICIT"},
+      {with(shortest_paths_policy(W), WeightBasis::Explicit, Amounts {1, 2, 3}), "edge_weights: expected 2 entries"},
+      {with(shortest_paths_policy(W), WeightBasis::Explicit, Amounts {1, kL62}), "edge_weights[1] must be an integer in [0, 2^62)"},
+      {with(shortest_paths_policy(W), WeightBasis::Explicit, Amounts {-1, 1}), "edge_weights[0] must be an integer in [0, 2^62)"},
+  };
+  for (const auto& [cfg, text] : cases) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), cfg); }), text);
+  }
+  // The largest entry of the domain is accepted.
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), weighted(LOSSLESS, WeightBasis::Explicit, {1, kL62 - 1})); }),
+            "");
+}
+
+// One configuration's edge_weights array is shared by every policy built from it.
+TEST(WeightBases, SharedArray) {
+  const auto g = par2(10, 10);
+  const auto cfg = weighted(LOSSLESS, WeightBasis::Explicit, {1, 2});
+  FlowLedger fg(g);
+  FlowPolicy a(fg, v({0}), v({1}), cfg);
+  FlowPolicy b(fg, v({0}), v({1}), cfg);
+  const auto weights_of = [](const FlowPolicyConfig& c) { return std::get<ShortestPaths>(c.routing).edge_weights.get(); };
+  const auto* buffer = weights_of(cfg);
+  EXPECT_EQ(weights_of(detail::PolicyAccess::engine(a).config), buffer);
+  EXPECT_EQ(weights_of(detail::PolicyAccess::engine(b).config), buffer);
+  EXPECT_EQ(weights_of(a.config()), buffer);
+  // Control: an equal array built separately is another buffer.
+  FlowPolicy c2(fg, v({0}), v({1}), weighted(LOSSLESS, WeightBasis::Explicit, {1, 2}));
+  EXPECT_NE(weights_of(detail::PolicyAccess::engine(c2).config), buffer);
+}
+
+// ---------------------------------------------------------------- from_routes
+
+// The validation texts in order (graph PAR2(4, 8), 0 -> 1 unless stated).
+TEST(FromRoutes, Texts) {
+  const auto g = par2(4, 8);
+  const auto p0 = tunnel_route(*g, 0, {0});
+  const RouteDefinition d01 = dag_route(*g, 0, {0, 1});
+  auto err = [&](const std::vector<NodeId>& s, const std::vector<NodeId>& d, const std::vector<RouteDefinition>& routes,
+                 const RouteOptions& o = {}, const Graph* on = nullptr) {
+    return error_of([&] { (void)ForwardingProgram::from_routes(on ? *on : *g, s, d, routes, o); });
+  };
+  EXPECT_EQ(err({}, {1}, {p0}), "sources: the node set is empty");
+  EXPECT_EQ(err({0}, {0}, {p0}), "node 0 is in both endpoint sets: sources and destinations must not overlap");
+  EXPECT_EQ(err({0}, {1}, {}), "routes must not be empty");
+  EXPECT_EQ(err({0}, {1}, {p0}, RouteOptions {.allocation = EB}), "allocation applies only to PredecessorDAG routes");
+  EXPECT_EQ(err({0}, {1}, {p0}, RouteOptions {.weight_basis = WeightBasis::Capacity}),
+            "weight_basis applies only to PredecessorDAG routes");
+  EXPECT_EQ(err({0}, {1}, {p0}, RouteOptions {.edge_weights = Amounts {1, 1}}),
+            "edge_weights applies only to PredecessorDAG routes");
+  EXPECT_EQ(err({0}, {1}, {p0}, RouteOptions {.residual = Amounts {1, 1}}), "residual applies only to PredecessorDAG routes");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = MF}),
+            "from_routes allocation must be EQUAL or WEIGHTED");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.weight_basis = WeightBasis::Capacity}), "weight_basis requires allocation=WEIGHTED");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = W, .weight_basis = WeightBasis::Explicit}),
+            "weight_basis=EXPLICIT requires edge_weights");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = W, .edge_weights = Amounts {1, 1}}),
+            "edge_weights require weight_basis=EXPLICIT");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = W, .weight_basis = WeightBasis::ResidualSnapshot}),
+            "weight_basis=RESIDUAL_SNAPSHOT requires residual");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = W, .residual = Amounts {4, 8}}),
+            "residual requires weight_basis=RESIDUAL_SNAPSHOT");
+  EXPECT_EQ(err({0}, {1}, {d01}, RouteOptions {.allocation = W, .weight_basis = WeightBasis::Explicit, .edge_weights = Amounts {1}}),
+            "edge_weights: expected 2 entries");
+  EXPECT_EQ(err({0}, {1}, {d01},
+                RouteOptions {.allocation = W, .weight_basis = WeightBasis::Explicit, .edge_weights = Amounts {1, kL62}}),
+            "edge_weights[1] must be an integer in [0, 2^62)");
+  EXPECT_EQ(err({0}, {1}, {d01},
+                RouteOptions {.allocation = W, .weight_basis = WeightBasis::ResidualSnapshot, .residual = Amounts {5, 8}}),
+            "residual[0] = 5 is outside [0, edge_capacity_units[0] = 4]");
+  const auto other = par2(4, 8);
+  EXPECT_EQ(err({0}, {1}, {tunnel_route(*other, 0, {0})}), "routes[0]: route belongs to another graph");
+  EXPECT_EQ(err({0}, {1}, {tunnel_route(*g, 1, {0})}), "routes[0]: head 1 is not a source");
+  const RouteDefinition hop2 {0, std::make_shared<const Path>(*g, std::vector<std::vector<EdgeId>> {{0, 1}}), 1};
+  EXPECT_EQ(err({0}, {1}, {hop2}), "routes[0]: a tunnel has one edge per hop");
+  const auto d = graph(4, kDiam);
+  EXPECT_EQ(err({0, 1}, {3}, {tunnel_route(*d, 1, {0, 2})}, {}, d.get()),
+            "routes[0]: the path starts at 0, not at head 1");
+  EXPECT_EQ(err({0}, {3}, {tunnel_route(*d, 0, {0})}, {}, d.get()),
+            "routes[0]: the path ends at 1, not at a destination");
+  EXPECT_EQ(err({0}, {1, 3}, {tunnel_route(*d, 0, {0, 2})}, {}, d.get()),
+            "routes[0]: the path meets destination 1 before its end");
+  EXPECT_EQ(err({0}, {3}, {dag_route(*d, 0, {2})}, {}, d.get()), "routes[0]: no walk from head 0 to a destination");
+  for (const Amount w : {kL62, Amount {-1}}) {
+    EXPECT_EQ(err({0}, {1}, {tunnel_route(*g, 0, {0}, w)}), "routes[0]: weight must be an integer in [0, 2^62)");
+  }
+  // The last value of the domain is accepted; a later route is named by its position.
+  EXPECT_EQ(err({0}, {1}, {tunnel_route(*g, 0, {0}, kL62 - 1)}), "");
+  EXPECT_EQ(err({0}, {1}, {p0, tunnel_route(*g, 0, {1}, -1)}), "routes[1]: weight must be an integer in [0, 2^62)");
+}
+
+// The routes in list order, each route's checks in order.
+TEST(FromRoutes, Order) {
+  const auto g = par2(4, 8);
+  EXPECT_EQ(error_of([&] {
+              (void)program(*g, {0}, {1}, {tunnel_route(*g, 0, {0}, kL62), tunnel_route(*g, 5, {0})});
+            }),
+            "routes[0]: weight must be an integer in [0, 2^62)");
+  // The weight is checked after the shape: route 0's head text comes first.
+  EXPECT_EQ(error_of([&] { (void)program(*g, {0}, {1}, {tunnel_route(*g, 1, {0}, kL62)}); }),
+            "routes[0]: head 1 is not a source");
+}
+
+TEST(FromRoutes, CheckedPlansAreSharedAndOwned) {
+  const auto g = par2(4, 8);
+  const std::vector<NodeId> sources {0}, destinations {1};
+  const std::vector<RouteDefinition> routes {
+    tunnel_route(*g, 0, {0}, 0), dag_route(*g, 0, {0, 1}), dag_route(*g, 0, {0, 1}, 0)};
+  const std::vector<RouteOptions> options {
+    {}, {.allocation = W},
+    {.allocation = W, .weight_basis = WeightBasis::Explicit, .edge_weights = Amounts {1, 3}},
+    {.allocation = W, .weight_basis = WeightBasis::ResidualSnapshot, .residual = Amounts {0, 8}},
+    {.allocation = W, .weight_basis = WeightBasis::Explicit, .edge_weights = Amounts {0, 0}}};
+  const std::vector<Amounts> expected_weights {{}, {4, 8}, {1, 3}, {8}, {}};
+  const std::vector<Amounts> expected_carried {{2, 2}, {1, 3}, {1, 3}, {0, 4}, {0, 0}};
+  for (std::size_t k = 0; k < options.size(); ++k) {
+    std::shared_ptr<const ForwardingProgram> prog;
+    std::weak_ptr<const detail::PreparedRoute> retained;
+    {
+      auto checked = detail::check_route_definitions(*g, sources, destinations, routes, options[k]);
+      ASSERT_EQ(checked.split_contexts.size(), 2U);
+      std::vector<const detail::PreparedRoute*> plans;
+      for (const auto& c : checked.split_contexts) plans.push_back(c.prepared_route.get());
+      for (const auto& c : checked.split_contexts) {
+        ASSERT_TRUE(c.prepared_route);
+        EXPECT_EQ(c.prepared_route->support_edges, (std::vector<EdgeId> {0, 1}));
+        EXPECT_EQ(c.prepared_route->weights, expected_weights[k]);
+        const std::vector<EdgeId> members = k == 4 ? std::vector<EdgeId> {} : k == 3 ? std::vector<EdgeId> {1} : std::vector<EdgeId> {0, 1};
+        EXPECT_EQ(c.prepared_route->forwarding_edges, members);
+      }
+      retained = checked.split_contexts.front().prepared_route;
+      prog = detail::ProgramAccess::from_checked_routes(sources, destinations, routes, std::move(checked));
+      const auto& data = detail::ProgramAccess::data(*prog);
+      ASSERT_EQ(data.split_contexts.size(), 2U);
+      EXPECT_EQ(data.entries.size(), 3U);
+      EXPECT_EQ(prog->tunnels().size(), 1U);
+      for (std::size_t i = 0; i < plans.size(); ++i) {
+        EXPECT_EQ(data.split_contexts[i].prepared_route.get(), plans[i]);
+        EXPECT_EQ(data.entries[i + 1].min_route_cost, 1);
+      }
+    }
+    ASSERT_FALSE(retained.expired());  // before any read through a borrowed plan
+    {
+      FlowLedger ledger(g);
+      FlowPolicy p(ledger, sources, destinations, {.routing = Pinned {prog, nullptr}});
+      const auto result = p.place(4);
+      EXPECT_EQ(result.call_delivered, k == 4 ? 0 : 4);
+      EXPECT_EQ(ledger.carried(), expected_carried[k]);
+    }
+    prog.reset();
+    EXPECT_TRUE(retained.expired());
+  }
+}
+
+// A zero-weight route keeps its index and is validated in full.
+TEST(FromRoutes, ZeroWeightKept) {
+  const auto g = par2(4, 8);
+  const auto prog = program(*g, {0}, {1}, {tunnel_route(*g, 0, {0}, 0), tunnel_route(*g, 0, {1})});
+  std::vector<std::pair<std::int32_t, Amount>> got;
+  for (const auto& t : prog->tunnels()) got.emplace_back(t.entry_id, t.weight);
+  EXPECT_EQ(got, (std::vector<std::pair<std::int32_t, Amount>> {{0, 0}, {1, 1}}));
+  EXPECT_EQ(error_of([&] { (void)program(*g, {0}, {1}, {tunnel_route(*g, 1, {0}, 0)}); }),
+            "routes[0]: head 1 is not a source");
+}
+
+// Tunnels listed with indices 0 and 2 (the split route takes 1); local_index 0 and 2.
+TEST(FromRoutes, MixedIndices) {
+  const auto g = par2(4, 8);
+  const auto prog =
+      program(*g, {0}, {1}, {tunnel_route(*g, 0, {1}), dag_route(*g, 0, {0, 1}), tunnel_route(*g, 0, {0})});
+  std::vector<std::pair<std::int32_t, std::int32_t>> got;
+  for (const auto& t : prog->tunnels()) got.emplace_back(t.entry_id, t.local_index);
+  EXPECT_EQ(got, (std::vector<std::pair<std::int32_t, std::int32_t>> {{0, 0}, {2, 2}}));
+}
+
+// The endpoints are normalized like a policy's (sorted, duplicates removed).
+TEST(FromRoutes, Endpoints) {
+  const auto d = graph(4, kDiam);
+  const auto prog = program(*d, {1, 0, 1}, {3, 3}, {tunnel_route(*d, 0, {0, 2})});
+  EXPECT_EQ(vec(prog->sources()), v({0, 1}));
+  EXPECT_EQ(vec(prog->destinations()), v({3}));
+}
+
+// ---------------------------------------------------------------- Pinned's configuration
+
+// Pinned's row of the matrix: both admissions, no cache (its other options are its program's; the
+// model has no field to put one in).
+TEST(PinnedProgram, MatrixTexts) {
+  const auto g = par2(4, 8);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}});
+  FlowLedger fg(g);
+  ShortestPathCache cache(*g);
+  for (const auto a : {LOSSLESS, LOSSY}) {
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(prog, a)); }), "");
+    EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(prog, a), nullptr, &cache); }),
+              "Pinned does not use ShortestPathCache");
+  }
+  fg.reset();
+}
+
+// The program's endpoints must be the policy's.
+TEST(PinnedProgram, Endpoints) {
+  const auto g = graph(3, {{0, 1, 1, 1}, {0, 2, 1, 1}});
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}});
+  FlowLedger fg(g);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1, 2}), pinned_config(prog)); }),
+            "program endpoints do not match policy endpoints");
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1, 1}), pinned_config(prog)); }), "");
+}
+
+// The ownership texts, before the configuration matrix.
+TEST(PinnedProgram, Ownership) {
+  const auto g = par2(4, 8);
+  const auto other = par2(4, 8);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}});
+  const auto foreign = tunnels(*other, {0}, {1}, {{0, {0}, 1}});
+  FlowLedger fg(g);
+  ShortestPathCache own_cache(*g);  // a matrix defect after the ownership
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(foreign)); }),
+            "program belongs to another graph");
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(foreign), nullptr, &own_cache); }),
+            "program belongs to another graph");
+  EXPECT_EQ(error_of([&] {
+              FlowPolicy p(fg, v({0}), v({1}), pinned_config(prog, LOSSLESS, no_edges(*other, {0})));
+            }),
+            "black_holes belongs to another graph");
+  const auto mask = other->eligibility({}, std::vector<EdgeId> {0});
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(prog), &mask); }),
+            "foreign Eligibility: built for another graph");
+  ShortestPathCache cache(*other);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(prog), nullptr, &cache); }),
+            "foreign ShortestPathCache: bound to another graph");
+  // The mask is checked before the program.
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, v({0}), v({1}), pinned_config(foreign), &mask); }),
+            "foreign Eligibility: built for another graph");
+}
+
+// The endpoint sets come first.
+TEST(PinnedProgram, Order) {
+  const auto g = par2(4, 8);
+  const auto foreign = tunnels(*par2(4, 8), {0}, {1}, {{0, {0}, 1}});
+  FlowLedger fg(g);
+  EXPECT_EQ(error_of([&] { FlowPolicy p(fg, std::vector<NodeId> {}, v({1}), pinned_config(foreign)); }),
+            "sources: the node set is empty");
+}
+
+// Several sources and destinations.
+TEST(PinnedProgram, SeveralEndpoints) {
+  const auto g = graph(4, kRel);
+  const auto prog = tunnels(*g, {0, 1}, {3}, {{0, {0, 2}, 1}, {1, {1, 2}, 1}});
+  EXPECT_EQ(pinned(g, prog)->place(INF).call_delivered, 10);
+  const auto two = graph(4, {{0, 2, 3, 1}, {1, 3, 4, 1}});
+  const auto many = tunnels(*two, {0, 1}, {2, 3}, {{0, {0}, 1}, {1, {1}, 1}});
+  EXPECT_EQ(pinned(two, many)->place(INF).call_delivered, 6);  // RR(6, 2) = (3, 3) fits, RR(7, 2) = (4, 3) does not
+}
+
+// ---------------------------------------------------------------- lossless bounds
+
+namespace {
+Amount bound(const std::shared_ptr<const Graph>& g, const std::vector<Spec>& specs, const std::vector<NodeId>& s = {0},
+             const std::vector<NodeId>& d = {1}) {
+  return pinned(g, tunnels(*g, s, d, specs))->place(INF).call_delivered;
+}
+} // namespace
+
+// Lossless bounds: duplicate routes, deduplicated routes, a static path filled, a zero first or
+// last link, a support's Pinned bound.
+TEST(PinnedProgram, Duplicates) {
+  EXPECT_EQ(bound(par2(4, 8), {{0, {0}, 1}, {0, {1}, 1}, {0, {1}, 1}}), 12);
+  EXPECT_EQ(bound(par2(4, 8), {{0, {0}, 1}, {0, {1}, 1}}), 8);
+  EXPECT_EQ(bound(par2(6, 4), {{0, {0}, 1}, {0, {1}, 1}}), 9);
+  EXPECT_EQ(bound(par2(0, 4), {{0, {0}, 1}, {0, {1}, 1}}), 0);
+  EXPECT_EQ(bound(par2(4, 0), {{0, {0}, 1}, {0, {1}, 1}}), 1);
+  EXPECT_EQ(bound(graph(4, kPinloss), {{0, {0, 2}, 1}, {0, {1, 3}, 1}}, {0}, {3}), 4);
+  // Records per entry: the duplicates' three records, entries 0, 1, 2.
+  const auto g = par2(4, 8);
+  auto p = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}, {0, {1}, 1}, {0, {1}, 1}}));
+  (void)p->place(INF);
+  EXPECT_EQ(delivered(*p.p), (Amounts {4, 4, 4}));
+}
+
+// H(15, (1, 2)) = (5, 10) fits, H(16) = (5, 11) does not.
+TEST(PinnedProgram, WeightedTunnels) { EXPECT_EQ(bound(par2(10, 10), {{0, {0}, 1}, {0, {1}, 2}}), 15); }
+
+// A weight-0 tunnel carries nothing; its record and row exist with zeros.
+TEST(PinnedProgram, ZeroWeight) {
+  const auto g = par2(4, 8);
+  auto p = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 0}, {0, {1}, 1}}));
+  const auto r = p->place(INF);
+  EXPECT_EQ(r.call_delivered, 8);
+  EXPECT_EQ(entries(*p.p), (std::vector<std::optional<std::int32_t>> {0, 1}));
+  EXPECT_EQ(delivered(*p.p), (Amounts {0, 8}));
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 0, 0, 0}, {1, 0, UP, 8, 8, 0}}));
+  // Created at preparation: a zero-delivery record before any positive placement of it.
+  auto q = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 0}, {0, {1}, 1}}));
+  (void)q->place(1);
+  EXPECT_EQ(delivered(*q.p), (Amounts {0, 1}));
+}
+
+// Increments, Lossless and Lossy, and a Lossless increment's refused units.
+TEST(PinnedProgram, Increments) {
+  const auto g = graph(3, kInc);
+  const auto prog = tunnels(*g, {0, 1}, {2}, {{0, {0}, 1}, {1, {1}, 1}});
+  auto p = pinned(g, prog);
+  EXPECT_EQ(p->place(3).call_delivered, 2);
+  EXPECT_EQ(p->place(1).call_delivered, 0);
+  auto q = pinned(g, prog, LOSSY);
+  const auto r1 = q->place(3);
+  EXPECT_EQ(r1.call_delivered, 2);
+  EXPECT_EQ(r1.call_edge_drops, (Drops {{0, 1}}));
+  const auto r2 = q->place(1);  // RR(4) - RR(3) = (0, 1)
+  EXPECT_EQ(r2.call_delivered, 1);
+  EXPECT_TRUE(r2.call_edge_drops.empty());
+  EXPECT_EQ(lo(r2.by_source[0].offered), 2);
+  EXPECT_EQ(lo(r2.by_source[1].offered), 2);
+  const auto one = graph(2, kOne);
+  auto ledger = std::make_shared<FlowLedger>(one);
+  auto other = make(one, {0}, {1}, shortest_paths_policy(), nullptr, ledger);
+  (void)other->place(8);
+  auto t = pinned(one, tunnels(*one, {0}, {1}, {{0, {0}, 1}}), LOSSLESS, nullptr, nullptr, ledger);
+  EXPECT_EQ(t->place(5).call_delivered, 2);
+  other->remove();
+  (void)other->place(5);
+  EXPECT_EQ(t->place(1).call_delivered, 1);
+}
+
+// +inf is the bound, EXHAUSTED; Lossy rejects it.
+TEST(PinnedProgram, Infinite) {
+  const auto g = par2(6, 4);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}, {0, {1}, 1}});
+  const auto r = pinned(g, prog)->place(INF);
+  EXPECT_EQ(r.call_delivered, 9);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+  EXPECT_FALSE(r.call_undelivered.has_value());
+  EXPECT_FALSE(r.requested.has_value());
+  auto lossy = pinned(g, prog, LOSSY);
+  EXPECT_EQ(error_of([&] { (void)lossy->place(INF); }), kFinite);
+}
+
+// A tunnel and a split route side by side: RR(8, 2) = (4, 4).
+TEST(PinnedProgram, MixedEntries) {
+  const auto g = par2(4, 8);
+  auto p = pinned(g, program(*g, {0}, {1}, {tunnel_route(*g, 0, {0}), dag_route(*g, 0, {1})}));
+  const auto r = p->place(INF);
+  EXPECT_EQ(r.call_delivered, 8);
+  EXPECT_EQ(entries(*p.p), (std::vector<std::optional<std::int32_t>> {0, 1}));
+  EXPECT_EQ(delivered(*p.p), (Amounts {4, 4}));
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 4, 4, 0}}));
+}
+
+// Split contexts: each identical route splits its own unit, also pooled.
+TEST(PinnedProgram, SplitContextsAreSeparate) {
+  const auto g = par2(1, 1);
+  const auto d = dag_of(*g, {0, 1});
+  const auto prog = program(*g, {0}, {1}, {RouteDefinition {0, d, 1}, RouteDefinition {0, d, 1}});
+  EXPECT_EQ(pinned(g, prog)->place(INF).call_delivered, 1);
+  const auto r = pinned(g, prog, LOSSY)->replace(2, std::nullopt, kEdges);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{0, 1}}));
+  EXPECT_EQ(*r.edge_flows, (Amounts {1, 0}));
+  const auto pooled = make(g, {0}, {1}, shortest_paths_policy())->place(INF, kEdges);
+  EXPECT_EQ(pooled.call_delivered, 2);
+  EXPECT_EQ(*pooled.edge_flows, (Amounts {1, 1}));
+}
+
+// ---------------------------------------------------------------- losses inside one program
+
+namespace {
+struct LossyRun {
+  PlacementResult r;
+  std::vector<std::tuple<Amount, Amount, Amount>> got;  // per tunnel (assigned, delivered, dropped)
+};
+LossyRun lossy_rows(const std::shared_ptr<const Graph>& g, const std::vector<NodeId>& s, const std::vector<NodeId>& d,
+                    const std::vector<Spec>& specs, Amount offer) {
+  LossyRun out {pinned(g, tunnels(*g, s, d, specs), LOSSY)->replace(offer), {}};
+  for (const auto& t : out.r.by_tunnel) out.got.emplace_back(lo(t.assigned), t.delivered, lo(t.total_edge_drops));
+  return out;
+}
+using Triples = std::vector<std::tuple<Amount, Amount, Amount>>;
+Amounts delivered_of(const LossyRun& x) {
+  Amounts out;
+  for (const auto& [a, d, l] : x.got) out.push_back(d);
+  return out;
+}
+} // namespace
+
+// Losses inside one program: a merge, a tie of the split keys, the rounding, the split hierarchy,
+// a link of service 0, subdividing a link before or after, a support's Pinned loss.
+TEST(ProgramLossy, Merge) {
+  EXPECT_EQ(lossy_rows(graph(2, {{0, 1, 9, 1}}), {0}, {1}, {{0, {0}, 2}, {0, {0}, 1}}, 12).got,
+            (Triples {{8, 6, 2}, {4, 3, 1}}));
+  EXPECT_EQ(lossy_rows(graph(2, {{0, 1, 1, 1}}), {0}, {1}, {{0, {0}, 1}, {0, {0}, 1}}, 2).got,
+            (Triples {{1, 1, 0}, {1, 0, 1}}));
+  EXPECT_EQ(lossy_rows(graph(2, {{0, 1, 3, 1}}), {0}, {1}, {{0, {0}, 5}, {0, {0}, 1}, {0, {0}, 1}}, 7).got,
+            (Triples {{5, 3, 2}, {1, 0, 1}, {1, 0, 1}}));
+  const auto hier = lossy_rows(graph(4, kHier), {0, 1}, {3}, {{0, {0, 2}, 1}, {0, {0, 2}, 1}, {1, {1, 2}, 1}}, 4);
+  EXPECT_EQ(delivered_of(hier), (Amounts {1, 0, 0}));
+  EXPECT_EQ(hier.got, (Triples {{1, 1, 0}, {1, 0, 1}, {2, 0, 2}}));
+  const auto zero = lossy_rows(graph(2, {{0, 1, 0, 1}}), {0}, {1}, {{0, {0}, 1}}, 2);
+  EXPECT_EQ(zero.got, (Triples {{2, 0, 2}}));
+  EXPECT_EQ(zero.r.call_edge_drops, (Drops {{0, 2}}));
+  const auto before = graph(6, {{0, 1, 1, 1}, {1, 2, 1, 1}, {1, 3, 1, 1}, {1, 4, 1, 1},
+                                {2, 5, 1, 1}, {3, 5, 1, 1}, {4, 5, 1, 1}});
+  EXPECT_EQ(delivered_of(lossy_rows(before, {0}, {5}, {{0, {0, 1, 4}, 1}, {0, {0, 2, 5}, 1}, {0, {0, 3, 6}, 1}}, 3)),
+            (Amounts {1, 0, 0}));
+  const auto after = graph(7, {{0, 1, 1, 1}, {1, 2, 1, 1}, {1, 3, 1, 1}, {1, 4, 1, 1},
+                               {2, 6, 1, 1}, {3, 5, 1, 1}, {4, 5, 1, 1}, {6, 5, 1, 1}});
+  EXPECT_EQ(delivered_of(lossy_rows(after, {0}, {5}, {{0, {0, 1, 4, 7}, 1}, {0, {0, 2, 5}, 1}, {0, {0, 3, 6}, 1}}, 3)),
+            (Amounts {1, 0, 0}));
+  const auto pin = lossy_rows(graph(4, kPinloss), {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}}, 12);
+  EXPECT_EQ(pin.got, (Triples {{6, 2, 4}, {6, 6, 0}}));
+  EXPECT_EQ(pin.r.call_edge_drops, (Drops {{2, 4}}));
+  EXPECT_EQ(pin.r.call_delivered, 8);
+}
+
+// No link can drop (U0 = 2 on both barriers' candidates): no rounds.
+TEST(ProgramCycles, NoBarrierNoRounds) {
+  const auto run = lossy_rows(cyc(2, 2), {4}, {5}, {{4, kCycT0, 1}, {4, kCycT1, 1}}, 2);
+  EXPECT_EQ(delivered_of(run), (Amounts {1, 1}));
+  EXPECT_TRUE(run.r.call_edge_drops.empty());
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 0);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 0);
+#endif
+}
+
+// X and Y wait on each other; the rounds from zero settle at round 3.
+TEST(ProgramCycles, Converges) {
+  const auto run = lossy_rows(cyc(1, 1), {4}, {5}, {{4, kCycT0, 1}, {4, kCycT1, 1}}, 2);
+  EXPECT_EQ(run.got, (Triples {{1, 1, 0}, {1, 0, 1}}));
+  EXPECT_EQ(run.r.call_edge_drops, (Drops {{3, 1}}));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+}
+
+// Amounts (1, 2): the rounds alternate between two states; nothing is published.
+TEST(ProgramCycles, PeriodTwo) {
+  const auto g = cyc(1, 2);
+  auto p = pinned(g, tunnels(*g, {4}, {5}, {{4, kCycT0, 1}, {4, kCycT1, 2}}), LOSSY);
+  const auto ledger = ledger_state(*p.ledger);
+  const auto before = epoch(*p.p);
+  EXPECT_EQ(error_of([&] { (void)p->replace(3); }), kPeriodTwo);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  // The error comes at round 3, the first round whose state equals the one two rounds before.
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 3);
+#endif
+  expect_same(ledger_state(*p.ledger), ledger, "period two");
+  expect_unchanged(epoch(*p.p), before, "period two");
+  EXPECT_EQ(p->program(), nullptr);
+  EXPECT_EQ(error_of([&] { (void)p->place(3); }), kPeriodTwo);
+  EXPECT_EQ(error_of([&] { (void)p->evaluate(3); }), kPeriodTwo);
+}
+
+// Three barriers that never settle: the round limit 64 * 3.
+TEST(ProgramCycles, RoundLimit) {
+  const auto lim = graph(8, {{0, 1, 1, 1}, {1, 4, 1000, 1}, {2, 3, 2, 1}, {3, 0, 1000, 1}, {3, 7, 1000, 1},
+                             {4, 5, 1, 1}, {5, 2, 1000, 1}, {5, 7, 1000, 1}, {6, 0, 1000, 1}, {6, 2, 1000, 1}});
+  const auto prog = tunnels(*lim, {6}, {7}, {{6, {8, 0, 1, 5, 6, 2, 4}, 2}, {6, {9, 2, 3, 0, 1, 5, 7}, 3}});
+  auto p = pinned(lim, prog, LOSSY);
+  EXPECT_EQ(error_of([&] { (void)p->replace(3); }), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 192);
+#endif
+}
+
+// Y split in two in series changes nothing (serial normalization).
+TEST(ProgramCycles, SubdivisionInvariant) {
+  const auto run = lossy_rows(cycs(1, 1, 1), {4}, {5}, {{4, kCycsT0, 1}, {4, kCycsT1, 1}}, 2);
+  EXPECT_EQ(run.got, (Triples {{1, 1, 0}, {1, 0, 1}}));
+  EXPECT_EQ(run.r.call_edge_drops, (Drops {{3, 1}}));
+  const auto g = cycs(1, 2, 2);
+  auto p = pinned(g, tunnels(*g, {4}, {5}, {{4, kCycsT0, 1}, {4, kCycsT1, 2}}), LOSSY);
+  EXPECT_EQ(error_of([&] { (void)p->replace(3); }), kPeriodTwo);
+}
+
+// A scalar call's black holes add no barrier: STALE-black-hole-in-cycle's graph (input rows 0 to
+// 18, the example's EdgeIds there) with one head S = 17 feeding its four tunnels (wide rows 19 to
+// 22) and wide exits from each tunnel's end to one destination 18 (rows 23 to 25), so every tunnel
+// ends at the destination; one Pinned LOSSY program of four tunnels, weights 13, 11, 10, 5, and
+// replace(39) (the heads' amounts 13, 11, 10, 5), black holes on rows 2, 6 and 17. Tunnels 0 and 3
+// reach a black hole (BLACKHOLED); their arrivals there are dropped without a barrier, so the cyclic
+// group keeps its four physical barriers: the round-limit error after 64 * 4 = 256 rounds (the old
+// form, a black-holed link at capacity 0 inside the group, made a fifth barrier: 320). Without the
+// black holes the same call settles. LOSSLESS keeps its bound: a black-holed link serves 0, so the bound is
+// 0 (tunnel 0, on a black hole, takes the first unit).
+TEST(ProgramCycles, BlackHolesAddNoBarrier) {
+  const std::vector<InEdge> rows = {
+      {0, 1, 12, 1},   {1, 6, 1000, 1},  {1, 16, 1000, 1}, {2, 3, 9, 1},     {3, 0, 1000, 1},  {3, 10, 1000, 1},
+      {4, 5, 7, 1},    {5, 6, 1000, 1},  {6, 7, 13, 1},    {7, 2, 1000, 1},  {7, 10, 1000, 1}, {8, 9, 1, 1},
+      {10, 11, 10, 1}, {11, 2, 1000, 1}, {12, 4, 1000, 1}, {13, 6, 1000, 1}, {14, 0, 1000, 1}, {15, 0, 1000, 1},
+      {16, 2, 1000, 1}, {17, 12, 1000, 1}, {17, 13, 1000, 1}, {17, 14, 1000, 1}, {17, 15, 1000, 1},
+      {11, 18, 1000, 1}, {1, 18, 1000, 1},  {7, 18, 1000, 1}};
+  const auto g = shared(make_graph(19, rows));
+  const auto id = id_of_input(*g);
+  auto ids = [&](std::vector<std::int32_t> in) {
+    std::vector<EdgeId> out;
+    for (auto i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  const std::vector<Spec> specs = {{17, ids({19, 14, 6, 7, 8, 9, 3, 5, 12, 23}), 13},
+                                   {17, ids({20, 15, 8, 10, 12, 13, 3, 4, 0, 24}), 11},
+                                   {17, ids({21, 16, 0, 1, 8, 25}), 10},
+                                   {17, ids({22, 17, 0, 2, 18, 3, 5, 12, 23}), 5}};
+  const auto prog = tunnels(*g, {17}, {18}, specs);
+  const auto black = no_edges(*g, ids({2, 6, 17}));
+  auto stale = pinned(g, prog, LOSSY, nullptr, black);
+  const auto ledger = ledger_state(*stale.ledger);
+  EXPECT_EQ(error_of([&] { (void)stale->replace(39); }), kRoundLimit);
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  EXPECT_EQ(detail::thread_lossy_counters().groups, 1);
+  EXPECT_EQ(detail::thread_lossy_counters().rounds, 256);
+#endif
+  expect_same(ledger_state(*stale.ledger), ledger, "the round-limit error");
+  EXPECT_EQ(stale->program(), nullptr);
+  // The statuses of the same program forwarded where it settles (a smaller offer).
+  const auto settled = stale->evaluate(4);
+  ASSERT_EQ(settled.by_tunnel.size(), 4U);
+  EXPECT_EQ(settled.by_tunnel[0].status, BLACKHOLED);
+  EXPECT_EQ(settled.by_tunnel[1].status, UP);
+  EXPECT_EQ(settled.by_tunnel[2].status, UP);
+  EXPECT_EQ(settled.by_tunnel[3].status, BLACKHOLED);
+  // Control: without black holes the call settles.
+  EXPECT_NO_THROW((void)pinned(g, prog, LOSSY)->replace(39));
+  // LOSSLESS: a black-holed link serves 0.
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, nullptr, black)->evaluate(INF).call_delivered, 0);
+}
+
+// A tunnel whose share is 0 adds no wait, in a scalar call too: one Pinned LOSSY program, sources
+// sA, sB; sA's tunnels A (X, L0, L1; weight 100) and Z (L0, X; weight w), sB's tunnel B (L1, L0).
+// replace(4): RR gives each head 2, H(2, [100, 1]) gives Z 0. The period-2 error at round 3 with Z
+// at weight 0 (not forwarded) and at weight 1 (forwarded with share 0) alike.
+TEST(ProgramCycles, ZeroShareTunnelAddsNoWait) {
+  // sA 0, sB 1, n1..n6 2..7, dA 8, dB 9, dZ 10; rows X, L0, L1 first.
+  const auto g = shared(make_graph(11, {{2, 3, 1, 1},   {4, 5, 1, 1},   {6, 7, 2, 1},   {0, 2, 100, 1}, {3, 4, 100, 1},
+                                        {5, 6, 100, 1}, {7, 8, 100, 1}, {1, 6, 100, 1}, {7, 4, 100, 1}, {5, 9, 100, 1},
+                                        {0, 4, 100, 1}, {5, 2, 100, 1}, {3, 10, 100, 1}}));
+  const auto id = id_of_input(*g);
+  auto ids = [&](std::vector<int> in) {
+    std::vector<EdgeId> out;
+    for (int i : in) out.push_back(id[static_cast<std::size_t>(i)]);
+    return out;
+  };
+  for (Amount z : {0, 1}) {
+    const auto prog = tunnels(*g, {0, 1}, {8, 9, 10},
+                              {{0, ids({3, 0, 4, 1, 5, 2, 6}), 100}, {0, ids({10, 1, 11, 0, 12}), z}, {1, ids({7, 2, 8, 1, 9}), 1}});
+    auto p = pinned(g, prog, LOSSY);
+    EXPECT_EQ(error_of([&] { (void)p->replace(4); }), kPeriodTwo) << "Z weight " << z;
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    EXPECT_EQ(detail::thread_lossy_counters().rounds, 3) << "Z weight " << z;
+#endif
+  }
+}
+
+// The LOSSLESS search probes totals up to the first links' capacity: here 3 * 2^60 - 1 over two
+// tunnels that share edge 2 (0 -> 1 -> 3 and 0 -> 2 -> 1 -> 3, round robin), so the first probe's
+// link sums take the saturating no-drop pass (a total of 2^61 or more on a link shared twice) and
+// the later probes the plain one; the bound is the shared edge's 10 either way. LOSSY forwarding of
+// a (2^60 and 2^60 - 1 per tunnel): edge 3 (2^40) drops 2^60 - 1 - 2^40 of tunnel 1, edge 2 gives
+// its 10 to tunnel 0 (highest averages over 2^60 and 2^40) and drops the rest.
+TEST(LosslessBound, WideFirstLinksProbeBothSums) {
+  const Amount a = (Amount {1} << 61) - 1;
+  const Amount b = Amount {1} << 60;
+  const auto g = shared(make_graph(4, {{0, 1, a, 1}, {0, 2, b, 1}, {1, 3, 10, 1}, {2, 1, Amount {1} << 40, 1}}));
+  const auto prog = tunnels(*g, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3, 2}, 1}});
+  const auto lossless = pinned(g, prog, LOSSLESS)->evaluate(INF);
+  EXPECT_EQ(lossless.call_delivered, 10);
+  EXPECT_EQ(rows(lossless), (Rows {{0, 0, UP, 5, 5, 0}, {1, 0, UP, 5, 5, 0}}));
+  const auto lossy = pinned(g, prog, LOSSY)->replace(a);
+  EXPECT_EQ(lossy.call_delivered, 10);
+  EXPECT_EQ(lossy.call_edge_drops, (std::vector<std::pair<EdgeId, Amount>> {{2, b - 10 + (Amount {1} << 40)}, {3, b - 1 - (Amount {1} << 40)}}));
+  EXPECT_EQ(rows(lossy), (Rows {{0, 0, UP, b, 10, b - 10}, {1, 0, UP, b - 1, 0, b - 1}}));
+}
+
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+// Through the hook: an iterated result corrupted after its rounds fails the independent check
+// with std::runtime_error, and nothing is published.
+TEST(ProgramCycles, VerificationCatchesACorruptedResult) {
+  const auto g = cyc(1, 1);
+  auto p = pinned(g, tunnels(*g, {4}, {5}, {{4, kCycT0, 1}, {4, kCycT1, 1}}), LOSSY);
+  const auto ledger = ledger_state(*p.ledger);
+  const auto before = epoch(*p.p);
+  detail::thread_lossy_counters().corrupt = true;
+  std::string what;
+  try {
+    (void)p->replace(2);
+  } catch (const std::runtime_error& e) {
+    what = e.what();
+  }
+  detail::thread_lossy_counters().corrupt = false;
+  EXPECT_EQ(what, "lossy forwarding fixed-point verification failed");
+  expect_same(ledger_state(*p.ledger), ledger, "corrupted");
+  expect_unchanged(epoch(*p.p), before, "corrupted");
+  // Control: the same call without the corruption succeeds.
+  EXPECT_EQ(p->replace(2).call_delivered, 1);
+}
+#endif
+
+// ---------------------------------------------------------------- replay under a mask
+
+namespace {
+// G1U's optimized program: [(0, [e0, e2], 2), (0, [e1, e3], 10)].
+std::shared_ptr<const ForwardingProgram> g1u_program(const std::shared_ptr<const Graph>& g) {
+  auto solver = make(g, {0}, {3}, global());
+  const auto prog = solver->replace(12).program;
+  EXPECT_EQ(listing(*prog), (Listing {{0, {0, 2}, 2}, {0, {1, 3}, 10}}));
+  return prog;
+}
+} // namespace
+
+// The masked-replay call with a CentralizedTE program: tunnel 0 FAILED, the head's 12 goes to tunnel 1.
+TEST(Replay, GlobalProgram) {
+  const auto g = graph(4, kG1U);
+  const auto prog = g1u_program(g);
+  const auto r = pinned(g, prog, LOSSY, no_edges(*g, {2}))->replace(12);
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, FAILED, 0, 0, 0}, {1, 0, UP, 12, 10, 2}}));
+  EXPECT_EQ(r.call_edge_drops, (Drops {{1, 2}}));
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, no_edges(*g, {2}))->place(INF).call_delivered, 10);
+}
+
+// The surviving sources' captured weights: H(16, (3, 1)) = (12, 4).
+TEST(Replay, SourceSurvivor) {
+  const auto g = graph(4, kSurv);
+  auto solver = make(g, {0, 1, 2}, {3}, global());
+  const auto prog = solver->place(9).program;
+  EXPECT_EQ(*prog->source_weights(), (std::vector<std::pair<NodeId, Amount>> {{0, 3}, {1, 1}, {2, 5}}));
+  const auto r = pinned(g, prog, LOSSY, no_nodes(*g, {2}))->replace(16);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(lo(r.by_source[0].offered), 12);
+  EXPECT_EQ(lo(r.by_source[1].offered), 4);
+  EXPECT_EQ(lo(r.by_source[2].offered), 0);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{0, 9}, {1, 3}}));
+  EXPECT_EQ(std::get<2>(rows(r)[2]), FAILED);
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, no_nodes(*g, {2}))->place(INF).call_delivered, 4);
+}
+
+// The topology basis keeps head 1 (it still reaches 2 over e2) and it loses its share.
+TEST(Replay, TopologyBasisKeepsTheHead) {
+  const auto g = graph(3, kRB);
+  auto solver = make(g, {0, 1}, {2}, global());
+  const auto prog = solver->place(10).program;
+  EXPECT_EQ(listing(*prog), (Listing {{0, {0}, 5}, {1, {1}, 5}}));
+  const auto r = pinned(g, prog, LOSSY, no_edges(*g, {1}))->replace(10);
+  EXPECT_EQ(r.call_delivered, 5);
+  EXPECT_EQ(r.source_drops, c(5));
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, no_edges(*g, {1}))->place(INF).call_delivered, 1);
+}
+
+// The supplied basis drops head 1: head 0 gets all 10.
+TEST(Replay, SuppliedBasisDropsTheHead) {
+  const auto g = graph(3, kRB);
+  const auto prog = tunnels(*g, {0, 1}, {2}, {{0, {0}, 1}, {1, {1}, 1}});
+  const auto r = pinned(g, prog, LOSSY, no_edges(*g, {1}))->replace(10);
+  EXPECT_EQ(r.call_delivered, 5);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{0, 5}}));
+  EXPECT_EQ(r.source_drops, c(0));
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, no_edges(*g, {1}))->place(INF).call_delivered, 5);
+}
+
+// A link of free capacity 0 is not a failure.
+TEST(Replay, ZeroCapacityIsNotFailed) {
+  const auto g = graph(4, kG1U);
+  const auto prog = g1u_program(g);
+  const auto r = pinned(g, prog, LOSSY, nullptr, nullptr, std::make_shared<FlowLedger>(g, Amounts {2, 0, 2, 10}))
+                     ->replace(12);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 2, 2, 0}, {1, 0, UP, 10, 0, 10}}));
+  EXPECT_EQ(r.call_edge_drops, (Drops {{1, 10}}));
+}
+
+// The remaining head's captured weight is 0: the whole offer is lost at the sources.
+TEST(Replay, AllRemainingWeightsZero) {
+  const auto g = graph(3, {{0, 2, 5, 1}, {1, 2, 5, 1}});
+  auto solver = make(g, {0, 1}, {2}, global());
+  const auto prog = solver->place(1).program;
+  const auto r = pinned(g, prog, LOSSY, no_nodes(*g, {0}))->replace(4);
+  EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+  EXPECT_EQ(r.source_drops, c(4));
+  EXPECT_EQ(r.call_delivered, 0);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, FAILED, 0, 0, 0}}));
+  const auto ll = pinned(g, prog, LOSSLESS, no_nodes(*g, {0}))->replace(4);
+  EXPECT_EQ(ll.termination, Termination::NoActiveWeight);
+  EXPECT_EQ(ll.call_delivered, 0);
+}
+
+// A stale remote tail repaired: the branch 0 -> 2 is pruned.
+TEST(Replay, SplitRoutePruned) {
+  const auto g = graph(4, kDiam);
+  auto producer = make(g, {0}, {3}, shortest_paths_policy(EB, LOSSY));
+  const auto prog = producer->place(1).program;
+  const auto r = pinned(g, prog, LOSSY, no_edges(*g, {3}))->replace(100, std::nullopt, kEdges);
+  EXPECT_EQ(r.call_delivered, 100);
+  EXPECT_EQ(*r.edge_flows, (Amounts {100, 0, 100, 0}));
+}
+
+// A tunnel failed by its node.
+TEST(Replay, TunnelFailedByNode) {
+  const auto g = graph(4, kTun);
+  const auto prog = tunnels(*g, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  const auto r = pinned(g, prog, LOSSY, no_nodes(*g, {2}))->replace(10);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 10, 10, 0}, {1, 0, FAILED, 0, 0, 0}}));
+  EXPECT_EQ(r.call_delivered, 10);
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, no_nodes(*g, {2}))->place(INF).call_delivered, 10);
+}
+
+// Weights frozen at preparation: a member pruned there stays pruned in every replay.
+TEST(Replay, FrozenWeights) {
+  const auto z = par2(0, 10);
+  auto producer = make(z, {0}, {1}, shortest_paths_policy(W, LOSSY));
+  const auto wp = producer->place(1).program;
+  const auto r = pinned(z, wp, LOSSY)->replace(5);
+  EXPECT_EQ(r.call_delivered, 5);
+  EXPECT_TRUE(r.call_edge_drops.empty());
+  // A snapshot over the baseline (0, 10) prunes e0; the replay on a fresh ledger at full capacity
+  // still sends everything to e1: 10 delivered, 5 dropped there.
+  const auto g = par2(10, 10);
+  auto snap = make(g, {0}, {1}, weighted(LOSSY, WeightBasis::ResidualSnapshot), nullptr,
+                   std::make_shared<FlowLedger>(g, Amounts {0, 10}));
+  const auto sp = snap->place(1).program;
+  const auto rr = pinned(g, sp, LOSSY)->replace(15, std::nullopt, kEdges);
+  EXPECT_EQ(rr.call_delivered, 10);
+  EXPECT_EQ(*rr.edge_flows, (Amounts {0, 10}));
+  EXPECT_EQ(rr.call_edge_drops, (Drops {{1, 5}}));
+}
+
+// ---------------------------------------------------------------- stale forwarding
+
+// Stale forwarding: a remote tail, a WCMP member (also of capacity 0), the relief and its original
+// program, a tunnel node, a pooled original and remainder, all weights zero, a black-holed source
+// (also of a tunnel), a masked and black-holed element.
+TEST(StaleForwarding, RemoteTail) {
+  {
+    const auto g = graph(4, kDiam);
+    auto p = make(g, {0}, {3}, shortest_paths_policy(EB, LOSSY));
+    (void)p->replace(100);
+    const auto installed = p->program();
+    const auto bh = g->eligibility({}, std::vector<EdgeId> {3});
+    const auto r = p->forward(100, &bh);
+    EXPECT_EQ(r.call_delivered, 50);
+    EXPECT_EQ(r.call_edge_drops, (Drops {{3, 50}}));
+    EXPECT_EQ(p->program(), installed);
+    EXPECT_FALSE(r.routes_changed || r.weights_changed);
+    EXPECT_EQ(p->replace(100).call_delivered, 100);
+  }
+  {
+    const auto w = graph(2, {{0, 1, 10, 1}, {0, 1, 40, 1}});
+    auto q = make(w, {0}, {1}, shortest_paths_policy(W, LOSSY));
+    (void)q->replace(40);
+    const auto bh = w->eligibility({}, std::vector<EdgeId> {0});
+    const auto r = q->forward(40, &bh);
+    EXPECT_EQ(r.call_delivered, 32);
+    EXPECT_EQ(r.call_edge_drops, (Drops {{0, 8}}));
+  }
+  {
+    const auto wz = graph(2, {{0, 1, 0, 1}, {0, 1, 40, 1}});
+    auto q = make(wz, {0}, {1}, shortest_paths_policy(W, LOSSY));
+    (void)q->replace(1);
+    EXPECT_EQ(q->forward(40).call_delivered, 40);
+  }
+  {
+    const auto rel = graph(4, kRel);
+    const auto prog = tunnels(*rel, {0, 1}, {3}, {{0, {0, 2}, 1}, {1, {1, 2}, 1}});
+    EXPECT_EQ(rows(pinned(rel, prog, LOSSY)->replace(20)), (Rows {{0, 0, UP, 10, 5, 5}, {1, 1, UP, 10, 5, 5}}));
+    EXPECT_EQ(rows(pinned(rel, prog, LOSSY, nullptr, no_edges(*rel, {0}))->replace(20)),
+              (Rows {{0, 0, BLACKHOLED, 10, 0, 10}, {1, 1, UP, 10, 10, 0}}));
+  }
+  {
+    const auto t = graph(4, kTun);
+    const auto tp = tunnels(*t, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+    const auto r = pinned(t, tp, LOSSY, nullptr, no_nodes(*t, {2}))->replace(10);
+    EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 5, 5, 0}, {1, 0, BLACKHOLED, 5, 0, 5}}));
+    EXPECT_EQ(r.call_edge_drops, (Drops {{1, 5}}));
+    EXPECT_EQ(pinned(t, tp, LOSSLESS, nullptr, no_nodes(*t, {2}))->replace(10).call_delivered, 1);
+  }
+  {
+    const auto pool = graph(4, kPool2);
+    auto p = make(pool, {0, 1}, {3}, shortest_paths_policy(EB, LOSSY));
+    (void)p->replace(0);
+    const auto r = p->forward(2, nullptr, kEdges);
+    EXPECT_EQ(r.call_delivered, 2);
+    EXPECT_EQ(*r.edge_flows, (Amounts {1, 1, 1, 1}));
+    const auto bh = pool->eligibility({}, std::vector<EdgeId> {0, 3});
+    const auto s8 = p->forward(2, &bh);
+    EXPECT_EQ(s8.call_delivered, 1);
+    EXPECT_EQ(s8.call_edge_drops, (Drops {{0, 1}}));
+  }
+  {
+    const auto zero = graph(2, {{0, 1, 0, 1}});
+    auto q = make(zero, {0}, {1}, shortest_paths_policy(W, LOSSY));
+    (void)q->replace(0);
+    const auto r = q->forward(2);
+    EXPECT_EQ(r.source_drops, c(2));
+    EXPECT_EQ(r.termination, Termination::NoActiveWeight);
+  }
+  {
+    const auto one = graph(2, kOne);
+    auto q = make(one, {0}, {1}, shortest_paths_policy(EB, LOSSY));
+    (void)q->replace(0);
+    const auto bh = one->eligibility(std::vector<NodeId> {0}, {});
+    const auto r = q->forward(10, &bh);
+    EXPECT_EQ(r.source_drops, c(10));
+    EXPECT_TRUE(r.call_edge_drops.empty());
+    EXPECT_EQ(r.call_delivered, 0);
+    const auto s11 = pinned(one, tunnels(*one, {0}, {1}, {{0, {0}, 1}}), LOSSY, nullptr, no_nodes(*one, {0}))->replace(10);
+    EXPECT_EQ(rows(s11), (Rows {{0, 0, BLACKHOLED, 0, 0, 0}}));
+    EXPECT_EQ(s11.source_drops, c(10));
+  }
+  {
+    // A masked and black-holed element is masked.
+    const auto m = graph(5, kMB);
+    const auto mp = tunnels(*m, {0}, {4}, {{0, {0, 3}, 1}, {0, {1, 4}, 1}, {0, {2, 5}, 1}});
+    const auto r = pinned(m, mp, LOSSY, no_edges(*m, {3}), no_edges(*m, {3, 4}))->replace(10);
+    EXPECT_EQ(rows(r), (Rows {{0, 0, FAILED, 0, 0, 0}, {1, 0, BLACKHOLED, 5, 0, 5}, {2, 0, UP, 5, 5, 0}}));
+    EXPECT_EQ(r.call_edge_drops, (Drops {{4, 5}}));
+  }
+}
+
+// The masked-replay call's CentralizedTE program with e2 black-holed instead of masked.
+TEST(StaleForwarding, GlobalProgram) {
+  const auto g = graph(4, kG1U);
+  const auto prog = g1u_program(g);
+  const auto r = pinned(g, prog, LOSSY, nullptr, no_edges(*g, {2}))->replace(12);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, BLACKHOLED, 2, 0, 2}, {1, 0, UP, 10, 10, 0}}));
+  EXPECT_EQ(r.call_edge_drops, (Drops {{2, 2}}));
+  // H(4, (2, 10)) = (0, 4) fits; H(5, (2, 10)) = (1, 4) sends a unit into the black hole.
+  EXPECT_EQ(pinned(g, prog, LOSSLESS, nullptr, no_edges(*g, {2}))->replace(12).call_delivered, 4);
+}
+
+// An all-allowed Eligibility is no black hole.
+TEST(StaleForwarding, AllAllowedIsNone) {
+  const auto g = graph(4, kG1U);
+  const auto prog = g1u_program(g);
+  const auto allowed = std::make_shared<const Eligibility>(g->eligibility());
+  const auto with = pinned(g, prog, LOSSY, nullptr, allowed)->replace(12);
+  const auto without = pinned(g, prog, LOSSY)->replace(12);
+  EXPECT_EQ(rows(with), rows(without));
+  EXPECT_EQ(with.call_delivered, 12);
+  EXPECT_EQ(with.call_edge_drops, without.call_edge_drops);
+  // A forward with an all-allowed value equals a forward without.
+  auto p = make(g, {0}, {3}, shortest_paths_policy(EB, LOSSY));
+  (void)p->replace(12);
+  const auto all = g->eligibility();
+  EXPECT_EQ(p->forward(12, &all).call_delivered, p->forward(12).call_delivered);
+}
+
+// Place, evaluate, replace, evaluate_demand and evaluate_edge_failures all see a Pinned policy's black holes
+// (TUN, node 2 black-holed).
+TEST(StaleForwarding, EveryOperation) {
+  const auto t = graph(4, kTun);
+  const auto tp = tunnels(*t, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  const auto bh = no_nodes(*t, {2});
+  EXPECT_EQ(pinned(t, tp, LOSSY, nullptr, bh)->place(10).call_delivered, 5);
+  EXPECT_EQ(pinned(t, tp, LOSSY, nullptr, bh)->evaluate(10).call_delivered, 5);
+  EXPECT_EQ(pinned(t, tp, LOSSY, nullptr, bh)->replace(10).call_delivered, 5);
+  EXPECT_EQ(evaluate_demand(*t, v({0}), v({3}), query(pinned_config(tp, LOSSY, bh), offer(10))).call_delivered, 5);
+  EXPECT_EQ(evaluate_demand(*t, v({0}), v({3}), query(pinned_config(tp, LOSSLESS, bh))).call_delivered, 1);
+  EXPECT_EQ(evaluate_edge_failures(*t, v({0}), v({3}), query(pinned_config(tp, LOSSY, bh), offer(10)), 1).baseline.call_delivered, 5);
+  // Controls without the black holes.
+  EXPECT_EQ(pinned(t, tp, LOSSY)->replace(10).call_delivered, 10);
+  EXPECT_EQ(evaluate_demand(*t, v({0}), v({3}), query(pinned_config(tp))).call_delivered, 20);
+}
+
+// ---------------------------------------------------------------- operations
+
+// Evaluate publishes nothing: ledger, records and epoch counters unchanged.
+TEST(Operations, EvaluatePublishesNothing) {
+  const auto g = par2(10, 10);
+  auto p = make(g, {0}, {1}, shortest_paths_policy());
+  (void)p->replace(6);
+  const auto ledger = ledger_state(*p.ledger);
+  const auto before = epoch(*p.p);
+  const auto r = p->evaluate(12);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_EQ(r.delivery_delta, 6);
+  EXPECT_NE(r.program, nullptr);
+  expect_same(ledger_state(*p.ledger), ledger, "evaluate");
+  expect_unchanged(epoch(*p.p), before, "evaluate");
+  EXPECT_EQ(p->place(0).requested, c(6));
+}
+
+// Replace retires the old ids and starts a new epoch.
+TEST(Operations, ReplaceRetiresIds) {
+  const auto g = par2(10, 10);
+  auto p = make(g, {0}, {1}, shortest_paths_policy());
+  (void)p->place(4);
+  const auto old = p->records().front().flow_id;
+  const auto r = p->replace(6);
+  EXPECT_EQ(r.requested, c(6));
+  EXPECT_EQ(r.admitted, c(6));
+  EXPECT_NE(error_of([&] { (void)p.ledger->record(old); }), "");
+  EXPECT_NE(p->records().front().flow_id, old);
+}
+
+// Forward keeps the frozen weights; replace takes a new snapshot; an identical replace
+// sets no flag.
+TEST(Operations, ForwardKeepsTheProgram) {
+  const auto g = par2(10, 10);
+  auto ledger = std::make_shared<FlowLedger>(g, Amounts {2, 10});
+  auto a = make(g, {0}, {1}, weighted(LOSSLESS, WeightBasis::ResidualSnapshot), nullptr, ledger);
+  EXPECT_EQ(a->replace(6).call_delivered, 6);
+  auto b = pinned(g, tunnels(*g, {0}, {1}, {{0, {1}, 1}}), LOSSLESS, nullptr, nullptr, ledger);
+  EXPECT_EQ(b->place(5).call_delivered, 5);
+  const auto installed = a->program();
+  const auto f = a->forward(12);
+  EXPECT_EQ(f.call_delivered, 6);
+  EXPECT_FALSE(f.routes_changed || f.weights_changed);
+  EXPECT_EQ(a->program(), installed);
+  const auto r = a->replace(12);
+  EXPECT_EQ(r.call_delivered, 7);
+  EXPECT_FALSE(r.routes_changed);
+  EXPECT_TRUE(r.weights_changed);
+}
+
+TEST(Operations, IdenticalReplace) {
+  const auto g = par2(10, 10);
+  auto ledger = std::make_shared<FlowLedger>(g, Amounts {2, 10});
+  auto a = make(g, {0}, {1}, weighted(LOSSLESS, WeightBasis::ResidualSnapshot), nullptr, ledger);
+  const auto r1 = a->replace(12);
+  const auto ids1 = ids(*a.p);
+  const auto r2 = a->replace(12);
+  EXPECT_EQ(r2.call_delivered, r1.call_delivered);
+  EXPECT_FALSE(r2.routes_changed || r2.weights_changed);
+  EXPECT_NE(ids(*a.p), ids1);
+  EXPECT_EQ(delivered(*a.p), (Amounts {r1.call_delivered}));
+}
+
+// The forward texts.
+TEST(Operations, ForwardTexts) {
+  const auto g = par2(10, 10);
+  auto p = make(g, {0}, {1}, shortest_paths_policy(EB, LOSSY));
+  EXPECT_EQ(error_of([&] { (void)p->forward(1); }), kNoProgram);
+  (void)p->place(1);
+  for (const auto& call : std::vector<std::function<void()>> {[&] { (void)p->forward(INF); },
+                                                              [&] { (void)p->replace(INF); },
+                                                              [&] { (void)p->evaluate(INF); }}) {
+    EXPECT_EQ(error_of(call), kFinite);
+  }
+  p->remove();
+  EXPECT_EQ(error_of([&] { (void)p->forward(1); }), kNoProgram);
+  auto ca = make(g, {0}, {1}, capacity_aware());
+  EXPECT_EQ(error_of([&] { (void)ca->forward(1); }), kNoProgram);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}});
+  auto pin = pinned(g, prog, LOSSY);
+  EXPECT_EQ(error_of([&] { (void)pin->place(INF); }), kFinite);
+  (void)pin->place(1);
+  EXPECT_EQ(error_of([&] { (void)pin->forward(1); }), "Pinned forwards with replace");
+}
+
+// The order of a call's checks.
+TEST(Operations, ForwardOrder) {
+  const auto g = par2(10, 10);
+  const auto other = par2(1, 1);
+  const auto foreign = other->eligibility({}, std::vector<EdgeId> {0});
+  auto pin = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}}));
+  EXPECT_EQ(error_of([&] { (void)pin->forward(INF, &foreign); }), "Pinned forwards with replace");
+  auto p = make(g, {0}, {1}, shortest_paths_policy(EB, LOSSY));
+  EXPECT_EQ(error_of([&] { (void)p->forward(-1); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  (void)p->place(1);
+  EXPECT_EQ(error_of([&] { (void)p->forward(-1, &foreign); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(error_of([&] { (void)p->forward(INF, &foreign); }), kFinite);
+  EXPECT_EQ(error_of([&] { (void)p->forward(1, &foreign); }), "black_holes belongs to another graph");
+  EXPECT_EQ(error_of([&] { (void)p->replace(-1); }), "offer must be an integer in [0, 2^62) or permitted +inf");
+  EXPECT_EQ(error_of([&] { (void)p->replace(INF); }), kFinite);
+}
+
+// Lossless replace(+inf): the bound, EXHAUSTED.
+TEST(Operations, LosslessInfinite) {
+  const auto r = make(par2(10, 10), {0}, {1}, shortest_paths_policy())->replace(INF);
+  EXPECT_EQ(r.call_delivered, 20);
+  EXPECT_FALSE(r.call_undelivered.has_value());
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// A zero replace installs a program of two split routes and two records at zero.
+TEST(Operations, ZeroReplacePrograms) {
+  const auto g = graph(4, kPool2);
+  auto p = make(g, {0, 1}, {3}, shortest_paths_policy());
+  const auto r = p->replace(0);
+  EXPECT_EQ(r.termination, Termination::Complete);
+  EXPECT_TRUE(r.routes_changed);
+  EXPECT_TRUE(r.weights_changed);
+  ASSERT_NE(r.program, nullptr);
+  EXPECT_EQ(delivered(*p.p), (Amounts {0, 0}));
+}
+
+// A smaller replace: delivery_delta negative.
+TEST(Operations, DeliveryDeltaNegative) {
+  auto p = make(par2(10, 10), {0}, {1}, shortest_paths_policy());
+  (void)p->replace(10);
+  const auto r = p->replace(4);
+  EXPECT_EQ(r.call_delivered, 4);
+  EXPECT_EQ(r.delivery_delta, -6);
+}
+
+// Place continues the replace's epoch (its ids kept).
+TEST(Operations, PlaceContinuesTheEpoch) {
+  const auto g = par2(10, 10);
+  auto p = make(g, {0}, {1}, shortest_paths_policy());
+  (void)p->replace(6);
+  const auto before = ids(*p.p);
+  const auto r = p->place(3);
+  EXPECT_EQ(r.call_delivered, 3);
+  EXPECT_EQ(r.requested, c(9));
+  EXPECT_EQ(r.admitted, c(9));
+  EXPECT_EQ(ids(*p.p), before);
+  auto q = make(g, {0}, {1}, shortest_paths_policy(EB, LOSSY));
+  (void)q->replace(6);
+  const auto lr = q->place(3);
+  EXPECT_EQ(lr.call_delivered, 3);
+  EXPECT_EQ(lr.offered, c(9));
+  EXPECT_EQ(lr.requested, c(9));
+}
+
+// A controller's increment changes the weights.
+TEST(Operations, ControllerWeights) {
+  const auto g = graph(2, {{0, 1, 20, 1}});
+  auto p = make(g, {0}, {1}, global());
+  const auto r1 = p->place(5);
+  EXPECT_TRUE(r1.routes_changed && r1.weights_changed);
+  const auto r2 = p->place(5);
+  EXPECT_FALSE(r2.routes_changed);
+  EXPECT_TRUE(r2.weights_changed);
+  EXPECT_EQ(listing(*r2.program), (Listing {{0, {0}, 10}}));
+  const auto r3 = p->replace(10);
+  EXPECT_FALSE(r3.routes_changed || r3.weights_changed);
+}
+
+// A re-solve that adds a path changes the routes.
+TEST(Operations, ControllerRoutes) {
+  const auto g = graph(4, kB1);
+  auto q = make(g, {0, 1}, {3}, global());
+  EXPECT_EQ(listing(*q->place(2).program), (Listing {{0, {0}, 2}}));
+  const auto r = q->place(10);
+  EXPECT_EQ(listing(*r.program), (Listing {{0, {0}, 2}, {1, {1, 2}, 10}}));
+  EXPECT_TRUE(r.routes_changed);
+}
+
+// An offer-only change sets no flag.
+TEST(Operations, OfferOnly) {
+  const auto one = graph(2, {{0, 1, 20, 1}});
+  auto pin = pinned(one, tunnels(*one, {0}, {1}, {{0, {0}, 1}}));
+  (void)pin->replace(5);
+  for (const Amount x : {10, 10}) {
+    const auto before = ids(*pin.p);
+    const auto r = pin->replace(x);
+    EXPECT_FALSE(r.routes_changed || r.weights_changed) << x;
+    EXPECT_NE(ids(*pin.p), before);
+  }
+  auto cost = make(par2(10, 10), {0}, {1}, shortest_paths_policy(EB, LOSSY));
+  (void)cost->place(1);
+  for (const Amount x : {5, 7}) {
+    const auto r = cost->forward(x);
+    EXPECT_FALSE(r.routes_changed || r.weights_changed) << x;
+  }
+}
+
+// Forward over a controller's program reproduces the solve; above it, EXHAUSTED.
+TEST(Operations, ForwardControllerProgram) {
+  const auto g = graph(4, kG1U);
+  auto p = make(g, {0}, {3}, global());
+  (void)p->replace(12);
+  EXPECT_EQ(p->forward(12).call_delivered, 12);
+  const auto r = p->forward(20);
+  EXPECT_EQ(r.call_delivered, 12);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// remove() clears the program.
+TEST(Operations, RemoveClearsTheProgram) {
+  for (const auto& cfg : {global(), shortest_paths_policy()}) {
+    auto p = make(par2(10, 10), {0}, {1}, cfg);
+    (void)p->place(3);
+    EXPECT_NE(p->program(), nullptr);
+    p->remove();
+    EXPECT_EQ(p->program(), nullptr);
+    const auto z = p->place(0);
+    EXPECT_EQ(z.program, nullptr);
+    EXPECT_EQ(z.call_delivered, 0);
+    EXPECT_EQ(z.delivered, 0);
+    EXPECT_TRUE(z.by_tunnel.empty());
+  }
+}
+
+// ShortestPaths's first positive call sets both flags; the next none.
+TEST(Operations, FirstProgramFlags) {
+  auto q = make(graph(4, kPool2), {0, 1}, {3}, shortest_paths_policy());
+  const auto r = q->place(2);
+  EXPECT_TRUE(r.routes_changed && r.weights_changed);
+  const auto r2 = q->place(2);
+  EXPECT_FALSE(r2.routes_changed || r2.weights_changed);
+}
+
+// evaluate's outputs describe the evaluated state.
+TEST(Operations, EvaluateOutputs) {
+  auto gl = make(graph(4, kB1), {0, 1}, {3}, global());
+  (void)gl->place(2);
+  const auto r = gl->evaluate(12, std::nullopt, OutputOptions {.edge_flows = true, .residual = true, .min_cut = true});
+  EXPECT_EQ(*r.edge_flows, (Amounts {2, 10, 10}));
+  EXPECT_EQ(*r.residual, (Amounts {0, 0, 0}));
+  EXPECT_EQ(*r.min_cut, (std::vector<EdgeId> {0, 1}));
+  EXPECT_EQ(gl->delivered(), 2);
+  EXPECT_EQ(gl.ledger->residual(), (Amounts {0, 10, 10}));
+}
+
+// A rejected call of each kind (and an evaluator) changes nothing.
+TEST(Operations, RejectedCallsChangeNothing) {
+  const auto g = par2(10, 10);
+  const auto other = par2(1, 1);
+  const auto foreign = other->eligibility({}, std::vector<EdgeId> {0});
+  auto p = make(g, {0}, {1}, shortest_paths_policy(EB, LOSSY));
+  (void)p->place(4);
+  const auto ledger = ledger_state(*p.ledger);
+  const auto before = epoch(*p.p);
+  const std::vector<std::pair<std::string, std::function<void()>>> calls = {
+      {"place", [&] { (void)p->place(-1); }},
+      {"place 2^62", [&] { (void)p->place(kL62); }},
+      {"evaluate", [&] { (void)p->evaluate(INF); }},
+      {"replace", [&] { (void)p->replace(-1); }},
+      {"forward", [&] { (void)p->forward(1, &foreign); }},
+      {"capacity", [&] { (void)evaluate_demand(*g, v({0}), v({1}), query(shortest_paths_policy(EB, LOSSY), offer(-5))); }},
+  };
+  for (const auto& [name, call] : calls) {
+    EXPECT_NE(error_of(call), "") << name;
+    expect_same(ledger_state(*p.ledger), ledger, name);
+    expect_unchanged(epoch(*p.p), before, name);
+  }
+  // A rejected Pinned call.
+  auto pin = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}}), LOSSY);
+  (void)pin->place(3);
+  const auto pl = ledger_state(*pin.ledger);
+  const auto pe = epoch(*pin.p);
+  for (const auto& call : std::vector<std::function<void()>> {[&] { (void)pin->place(INF); },
+                                                              [&] { (void)pin->forward(1); },
+                                                              [&] { (void)pin->replace(-1); }}) {
+    EXPECT_NE(error_of(call), "");
+    expect_same(ledger_state(*pin.ledger), pl, "pinned");
+    expect_unchanged(epoch(*pin.p), pe, "pinned");
+  }
+}
+
+// ---------------------------------------------------------------- records
+
+// ShortestPaths and CentralizedTE records have no entry; a Pinned record carries its entry identifier.
+TEST(ProgramRecords, Fields) {
+  const auto g = graph(4, kB1);
+  for (const auto& cfg : {global(), shortest_paths_policy()}) {
+    auto p = make(g, {0, 1}, {3}, cfg);
+    (void)p->place(4);
+    for (const auto& e : entries(*p.p)) EXPECT_FALSE(e.has_value());
+  }
+  const auto mixed = par2(4, 8);
+  auto pin = pinned(mixed, program(*mixed, {0}, {1},
+                                   {tunnel_route(*mixed, 0, {1}), dag_route(*mixed, 0, {0, 1}), tunnel_route(*mixed, 0, {0})}));
+  (void)pin->place(3);
+  EXPECT_EQ(entries(*pin.p), (std::vector<std::optional<std::int32_t>> {0, 1, 2}));
+  for (const auto& r : pin->records()) {
+    EXPECT_EQ(r.sources, v({0}));
+    EXPECT_EQ(r.destinations, v({1}));
+  }
+}
+
+// One record per entry, duplicates included; a weight-0 entry's record at zero.
+TEST(ProgramRecords, PerEntry) {
+  const auto g = par2(4, 8);
+  auto p = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}, {0, {1}, 1}, {0, {1}, 1}}));
+  const auto r = p->place(12);
+  const auto recs = p->records();
+  ASSERT_EQ(recs.size(), 3U);
+  EXPECT_EQ(entries(*p.p), (std::vector<std::optional<std::int32_t>> {0, 1, 2}));
+  EXPECT_EQ(delivered(*p.p), (Amounts {4, 4, 4}));
+  EXPECT_EQ(ascending_edges(*recs[1].route), ascending_edges(*recs[2].route));
+  EXPECT_NE(recs[1].flow_id, recs[2].flow_id);
+  EXPECT_EQ(rows(r), (Rows {{0, 0, UP, 4, 4, 0}, {1, 0, UP, 4, 4, 0}, {2, 0, UP, 4, 4, 0}}));
+  auto z = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 0}, {0, {1}, 1}}));
+  (void)z->place(INF);
+  const auto zr = z->records();
+  ASSERT_EQ(zr.size(), 2U);
+  EXPECT_EQ(zr[0].delivered, 0);
+  EXPECT_TRUE(zr[0].edge_flows.empty());
+  EXPECT_EQ(ascending_edges(*zr[0].route), (std::vector<EdgeId> {0}));
+}
+
+// A FAILED tunnel's record: an empty route, min_route_cost UNREACHABLE.
+TEST(ProgramRecords, FailedEntry) {
+  const auto g = graph(4, kG1U);
+  const auto prog = g1u_program(g);
+  auto p = pinned(g, prog, LOSSY, no_edges(*g, {2}));
+  (void)p->replace(12);
+  const auto recs = p->records();
+  ASSERT_EQ(recs.size(), 2U);
+  EXPECT_TRUE(ascending_edges(*recs[0].route).empty());
+  EXPECT_EQ(recs[0].min_route_cost, kUnreachable);
+  EXPECT_EQ(ascending_edges(*recs[1].route), (std::vector<EdgeId> {1, 3}));
+  EXPECT_EQ(recs[1].min_route_cost, 2);
+}
+
+// A ShortestPaths program in Pinned keeps the pooled attribution (each source's share of a shared
+// router's traffic by highest averages).
+TEST(ProgramRecords, PooledContext) {
+  const auto g = graph(4, kPool2);
+  auto producer = make(g, {0, 1}, {3}, shortest_paths_policy(EB, LOSSY));
+  const auto prog = producer->place(2).program;
+  auto p = pinned(g, prog, LOSSY);
+  (void)p->replace(2);
+  std::vector<std::pair<std::optional<std::int32_t>, Drops>> got;
+  for (const auto& r : p->records()) got.emplace_back(r.entry_id, r.edge_flows);
+  EXPECT_EQ(got, (std::vector<std::pair<std::optional<std::int32_t>, Drops>> {{0, {{0, 1}, {2, 1}}},
+                                                                             {1, {{1, 1}, {3, 1}}}}));
+}
+
+// ---------------------------------------------------------------- results
+
+// The by_tunnel rows.
+TEST(ProgramResults, ByTunnel) {
+  const auto pl = graph(4, kPinloss);
+  const auto y8 = pinned(pl, tunnels(*pl, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}}), LOSSY)->replace(12);
+  EXPECT_EQ(rows(y8), (Rows {{0, 0, UP, 6, 2, 4}, {1, 0, UP, 6, 6, 0}}));
+  const auto b1 = graph(4, kB1);
+  EXPECT_EQ(rows(make(b1, {0, 1}, {3}, global())->place(12)), (Rows {{0, 0, UP, 2, 2, 0}, {1, 1, UP, 10, 10, 0}}));
+  EXPECT_TRUE(make(graph(4, kPool2), {0, 1}, {3}, shortest_paths_policy())->place(2).by_tunnel.empty());
+  // A zero call reports the state's rows.
+  auto p = pinned(pl, tunnels(*pl, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}}), LOSSY);
+  (void)p->replace(12);
+  EXPECT_EQ(rows(p->place(0)), (Rows {{0, 0, UP, 6, 2, 4}, {1, 0, UP, 6, 6, 0}}));
+}
+
+// RC02-zero-unprepared extended: no program, no rows.
+TEST(ProgramResults, ZeroUnprepared) {
+  for (const auto& cfg : {global(), shortest_paths_policy()}) {
+    auto p = make(par2(4, 6), {0}, {1}, cfg);
+    const auto z = p->place(0);
+    EXPECT_EQ(z.program, nullptr);
+    EXPECT_TRUE(z.by_tunnel.empty());
+    EXPECT_EQ(z.termination, Termination::Complete);
+    (void)p->place(3);
+    p->remove();
+    const auto after = p->place(0);
+    EXPECT_EQ(after.program, nullptr);
+    EXPECT_TRUE(after.by_tunnel.empty());
+  }
+}
+
+// TunnelFlow.assigned and dropped above 2^64 with a carry: 5 (2^62 - 1) =
+// 23058430092136939515, high half 1, low half 4611686018427387899.
+TEST(WideCounters, TunnelRowsBeyond64Bits) {
+  const auto g = graph(2, {{0, 1, 0, 1}});
+  auto p = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}}), LOSSY);
+  const Amount big = kL62 - 1;
+  PlacementResult r;
+  for (int i = 0; i < 5; ++i) r = p->place(big);
+  const Counter128 total {1, 4611686018427387899ULL};
+  ASSERT_EQ(r.by_tunnel.size(), 1U);
+  EXPECT_EQ(r.by_tunnel[0].assigned, total);
+  EXPECT_EQ(r.by_tunnel[0].total_edge_drops, total);
+  EXPECT_EQ(r.by_tunnel[0].delivered, 0);
+  EXPECT_EQ(r.offered, total);
+  EXPECT_EQ(r.requested, total);
+  EXPECT_EQ(r.admitted, total);
+  EXPECT_EQ(r.edge_drops, (std::vector<std::pair<EdgeId, Counter128>> {{0, total}}));
+  EXPECT_TRUE(r.source_drops.is_zero());
+  ASSERT_EQ(r.by_source.size(), 1U);
+  EXPECT_EQ(r.by_source[0].offered, total);
+  EXPECT_EQ(r.by_source[0].admitted, total);
+  EXPECT_EQ(r.by_source[0].total_edge_drops, total);
+  EXPECT_TRUE(r.by_source[0].source_drops.is_zero());
+  const auto rec = p->records().front();
+  EXPECT_EQ(rec.offered, total);
+  EXPECT_EQ(rec.edge_drops, (std::vector<std::pair<EdgeId, Counter128>> {{0, total}}));
+  // The carry: four calls stay below 2^64.
+  auto q = pinned(g, tunnels(*g, {0}, {1}, {{0, {0}, 1}}), LOSSY);
+  PlacementResult four;
+  for (int i = 0; i < 4; ++i) four = q->place(big);
+  EXPECT_EQ(four.by_tunnel[0].assigned, (Counter128 {0, 4 * static_cast<std::uint64_t>(big)}));
+}
+
+// ---------------------------------------------------------------- evaluators
+
+// Capacity of a Pinned Lossless program on PAR2(6, 4).
+TEST(QueryOptionsEval, PinnedLossless) {
+  const auto g = par2(6, 4);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}, {0, {1}, 1}});
+  const auto r = evaluate_demand(*g, v({0}), v({1}), query(pinned_config(prog)));
+  EXPECT_EQ(r.call_delivered, 9);
+  EXPECT_EQ(r.termination, Termination::Exhausted);
+}
+
+// Capacity of PINLOSS's Pinned Lossy with offered 12: 2 + 6.
+TEST(QueryOptionsEval, PinnedLossy) {
+  const auto pl = graph(4, kPinloss);
+  const auto prog = tunnels(*pl, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  EXPECT_EQ(evaluate_demand(*pl, v({0}), v({3}), query(pinned_config(prog, LOSSY), offer(12))).call_delivered, 8);
+}
+
+// The offered rules and evaluate_pairs's Pinned text.
+TEST(QueryOptionsEval, Texts) {
+  const auto g = par2(6, 4);
+  const auto prog = tunnels(*g, {0}, {1}, {{0, {0}, 1}, {0, {1}, 1}});
+  auto err = [&](const EvaluationOptions& q) { return error_of([&] { (void)evaluate_demand(*g, v({0}), v({1}), q); }); };
+  auto delivered = [&](const EvaluationOptions& q) { return evaluate_demand(*g, v({0}), v({1}), q).call_delivered; };
+  const std::string domain = "offer must be an integer in [0, 2^62)";
+  EXPECT_EQ(err(query(pinned_config(prog, LOSSY))), "Pinned LOSSY evaluation requires a finite offer");
+  EXPECT_EQ(err(query(pinned_config(prog, LOSSY), offer_inf())), domain);
+  EXPECT_EQ(err(query(shortest_paths_policy(), offer_inf())), domain);
+  // A finite offer for every model under each admission it supports.
+  EXPECT_EQ(delivered(query(shortest_paths_policy(EB, LOSSY), offer(5))), 5);
+  EXPECT_EQ(delivered(query(shortest_paths_policy(), offer(5))), 5);
+  EXPECT_EQ(delivered(query(global(), offer(5))), 5);
+  EXPECT_EQ(delivered(query(pinned_config(prog), offer(5))), 5);
+  auto designed = query(capacity_aware(), offer(5));
+  designed.design_demand = Amount {4};
+  EXPECT_EQ(err(designed), "");
+  for (const Amount bad : {Amount {-1}, kL62}) {
+    EXPECT_EQ(err(query(pinned_config(prog, LOSSY), offer(bad))), domain);
+  }
+  EXPECT_EQ(err(query(pinned_config(prog, LOSSY), offer(kL62 - 1))), "");
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{{0}, {1}}};
+  EXPECT_EQ(error_of([&] { (void)evaluate_pairs(*g, pairs, query(pinned_config(prog)), {}, 1); }),
+            "evaluate_pairs does not accept Pinned");
+}
+
+// A deletion fails the tunnels through it and the head splits over the others.
+TEST(QueryOptionsEval, PinnedSensitivity) {
+  const auto pl = graph(4, kPinloss);
+  const auto prog = tunnels(*pl, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  const auto s = evaluate_edge_failures(*pl, v({0}), v({3}), query(pinned_config(prog)), 1);
+  EXPECT_EQ(s.baseline.call_delivered, 4);
+  EXPECT_EQ(losses(s), (std::vector<std::pair<EdgeId, Amount>> {{0, -6}, {1, 2}, {2, -6}, {3, 2}}));
+  const auto l = evaluate_edge_failures(*pl, v({0}), v({3}), query(pinned_config(prog, LOSSY), offer(12)), 1);
+  EXPECT_EQ(l.baseline.call_delivered, 8);
+  EXPECT_EQ(losses(l), (std::vector<std::pair<EdgeId, Amount>> {{0, -2}, {1, 6}, {2, -2}, {3, 6}}));
+  const auto w2 = evaluate_edge_failures(*pl, v({0}), v({3}), query(pinned_config(prog, LOSSY), offer(12)), 2);
+  EXPECT_EQ(losses(w2), losses(l));
+  EXPECT_EQ(w2.baseline.call_delivered, 8);
+}
+
+// ---------------------------------------------------------------- common Pinned setups
+
+// Each common Pinned setup and its program form.
+TEST(PinnedMapping, SingleBundle) {
+  // One EB route DAG (DIAM, the four links).
+  const auto d = graph(4, kDiam);
+  const auto all = dag_of(*d, {0, 1, 2, 3});
+  const auto eb = program(*d, {0}, {3}, {RouteDefinition {0, all, 1}});
+  EXPECT_EQ(pinned(d, eb)->place(INF).call_delivered, 200);
+  EXPECT_EQ(pinned(d, eb, LOSSY)->place(100).call_delivered, 100);
+  // W with capacity weights; with residual weights (the ledger's residual at creation):
+  // H over (100, 50) at node 0: H(150) = (100, 50) fits, H(151) = (101, 50) does not.
+  const auto wc = program(*d, {0}, {3}, {RouteDefinition {0, all, 1}}, RouteOptions {.allocation = W});
+  EXPECT_EQ(pinned(d, wc)->place(INF).call_delivered, 200);
+  const auto ws = program(*d, {0}, {3}, {RouteDefinition {0, all, 1}},
+                          RouteOptions {.allocation = W, .weight_basis = WeightBasis::ResidualSnapshot,
+                                        .residual = Amounts {100, 50, 100, 50}});
+  EXPECT_EQ(pinned(d, ws)->place(INF).call_delivered, 150);
+  // Two route DAGs on PAR2(6, 4): separate contexts, RR over the entries: 9; W the same 9;
+  // an optimized split is CentralizedTE(support) and fills both: 10.
+  const auto p = par2(6, 4);
+  const auto two = program(*p, {0}, {1}, {dag_route(*p, 0, {0}), dag_route(*p, 0, {1})});
+  EXPECT_EQ(pinned(p, two)->place(INF).call_delivered, 9);
+  const auto two_w =
+      program(*p, {0}, {1}, {dag_route(*p, 0, {0}), dag_route(*p, 0, {1})}, RouteOptions {.allocation = W});
+  EXPECT_EQ(pinned(p, two_w)->place(INF).call_delivered, 9);
+  EXPECT_EQ(make(p, {0}, {1}, global(std::nullopt, dag_of(*p, {0, 1})))->place(INF).call_delivered, 10);
+  // Two route DAGs sharing e0 on SHARE, EB Lossy place(10): both arrive at e0 with 5:
+  // H(4, (5, 5)) = (2, 2).
+  const auto sh = graph(3, kShare);
+  auto shared_e0 = pinned(sh, program(*sh, {0}, {2}, {dag_route(*sh, 0, {0, 1}), dag_route(*sh, 0, {0, 2})}), LOSSY);
+  const auto r5 = shared_e0->place(10);
+  EXPECT_EQ(r5.call_delivered, 4);
+  EXPECT_EQ(delivered(*shared_e0.p), (Amounts {2, 2}));
+  // Optimized over one route DAG is CentralizedTE(support): 12, cost 34, one record per source with the
+  // used edges, no entry.
+  const auto es = graph(4, kES);
+  auto m6 = make(es, {0}, {3}, global(std::nullopt, dag_of(*es, {0, 1, 2, 3})));
+  const auto r6 = m6->place(INF);
+  EXPECT_EQ(r6.call_delivered, 12);
+  EXPECT_EQ(r6.total_cost, c(34));
+  const auto recs = m6->records();
+  ASSERT_EQ(recs.size(), 1U);
+  EXPECT_FALSE(recs[0].entry_id.has_value());
+  EXPECT_EQ(ascending_edges(*recs[0].route), (std::vector<EdgeId> {0, 1, 2, 3}));
+  // Lossy +inf is rejected.
+  auto m7 = pinned(d, eb, LOSSY);
+  EXPECT_EQ(error_of([&] { (void)m7->place(INF); }), kFinite);
+  // Two sources are accepted; duplicates are distinct entries.
+  const auto rel = graph(4, kRel);
+  EXPECT_EQ(pinned(rel, tunnels(*rel, {0, 1}, {3}, {{0, {0, 2}, 1}, {1, {1, 2}, 1}}))->place(INF).call_delivered, 10);
+  const auto par = par2(4, 8);
+  EXPECT_EQ(bound(par, {{0, {0}, 1}, {0, {1}, 1}, {0, {1}, 1}}), 12);
+  // An empty route list.
+  EXPECT_EQ(error_of([&] { (void)program(*par, {0}, {1}, {}); }), "routes must not be empty");
+}
+
+// ---------------------------------------------------------------- storage of the new layouts
+
+// A plan's replay under a mask (restrict_prepared_route) is a new plan whose views point into its own block:
+// it keeps its values after the source plan is destroyed and plans of the same shape reuse the
+// freed memory (a borrowing restriction would read the later plans' roots and destinations).
+TEST(ProgramLayouts, RestrictedPlanOwnsItsBlock) {
+  const auto g = graph(8, {{0, 1, 5, 1}, {0, 2, 5, 1}, {1, 3, 5, 1}, {2, 3, 5, 1},
+                           {4, 5, 5, 1}, {4, 6, 5, 1}, {5, 7, 5, 1}, {6, 7, 5, 1}});
+  const auto mask = g->eligibility({}, std::vector<EdgeId> {3, 7});
+  auto plan_of = [&](NodeId root, NodeId dst, std::vector<EdgeId> edges) {
+    const auto dag = detail::PredecessorDAGBuilder::of_edges(*g, edges);
+    return detail::prepare_route(*g, EB, LOSSLESS, detail::WeightSource {}, root, std::vector<NodeId> {dst}, dag);
+  };
+  std::optional<detail::PreparedRoute> source(plan_of(0, 3, {0, 1, 2, 3}));
+  const auto restricted = detail::restrict_prepared_route(*g, *source, v({0}), v({3}), &mask);
+  EXPECT_NE(restricted.sources.data(), source->sources.data());
+  EXPECT_NE(restricted.destinations.data(), source->destinations.data());
+  EXPECT_NE(restricted.topological_order.data(), source->topological_order.data());
+  EXPECT_NE(restricted.edge_destination_positions.data(), source->edge_destination_positions.data());
+  const auto roots = vec(restricted.sources);
+  const auto dsts = vec(restricted.destinations);
+  const auto topo = vec(restricted.topological_order);
+  const auto members = restricted.forwarding_edges;
+  EXPECT_EQ(members, (std::vector<EdgeId> {0, 2}));
+  EXPECT_EQ(roots, v({0}));
+  EXPECT_EQ(dsts, v({3}));
+  source.reset();
+  std::vector<detail::PreparedRoute> later;
+  for (int i = 0; i < 4; ++i) {
+    later.push_back(plan_of(4, 7, {4, 5, 6, 7}));
+    later.push_back(detail::restrict_prepared_route(*g, later.back(), v({4}), v({7}), &mask));
+  }
+  EXPECT_EQ(vec(restricted.sources), roots);
+  EXPECT_EQ(vec(restricted.destinations), dsts);
+  EXPECT_EQ(vec(restricted.topological_order), topo);
+  EXPECT_EQ(restricted.forwarding_edges, members);
+  // Its copy owns another block too.
+  const detail::PreparedRoute copy(restricted);
+  EXPECT_NE(copy.topological_order.data(), restricted.topological_order.data());
+  EXPECT_EQ(vec(copy.topological_order), topo);
+}
+
+// A program and its data are one allocation (detail::ProgramBlock): the program's data pointer
+// reads into the block that every shared reference keeps alive, not into the data it was moved
+// from, and stays valid after the producer's locals are gone and programs of the same shape reuse
+// the freed memory.
+// Every list of a program's data lies in the data's own block, none outside it.
+void expect_lists_in_block(const detail::ProgramData& data) {
+  const auto block = data.block();
+  auto inside = [&](std::span<const std::int32_t> list, const char* name) {
+    if (list.empty()) return;
+    EXPECT_TRUE(list.data() >= block.data() && list.data() + list.size() <= block.data() + block.size()) << name;
+  };
+  inside(data.sources, "sources");
+  inside(data.destinations, "destinations");
+  inside(data.reachable_sources, "roster");
+  inside(data.source_entry_offsets, "slot_first");
+  inside(data.source_entry_positions, "slot_entries");
+  inside(data.tunnel_entry_positions, "tunnel_entry");
+  inside(data.excluded_nodes, "excluded_nodes");
+  inside(data.excluded_edges, "excluded_edges");
+  for (const auto& c : data.split_contexts) inside(c.source_entry_positions, "root_entry");
+}
+
+TEST(ProgramLayouts, ProgramOwnsItsDataBlock) {
+  const auto g = graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 10, 1}});
+  std::shared_ptr<const ForwardingProgram> prog;
+  {
+    auto made = tunnels(*g, {0}, {3}, {{0, {0, 2}, 2}, {0, {1, 3}, 1}});
+    prog = made;
+  }
+  const auto& data = detail::ProgramAccess::data(*prog);
+  const auto* block_lo = reinterpret_cast<const char*>(prog.get());
+  const auto* data_at = reinterpret_cast<const char*>(&data);
+  // The data lies in the same allocation as the program (one block of the two objects).
+  EXPECT_LT(std::abs(data_at - block_lo), static_cast<std::ptrdiff_t>(sizeof(detail::ProgramBlock)));
+  std::vector<std::shared_ptr<const ForwardingProgram>> later;
+  for (int i = 0; i < 8; ++i) later.push_back(tunnels(*g, {0}, {3}, {{0, {1, 3}, 5}}));
+  ASSERT_EQ(prog->tunnels().size(), 2U);
+  EXPECT_EQ(prog->tunnels()[0].edges, v({0, 2}));
+  EXPECT_EQ(prog->tunnels()[1].weight, 1);
+  EXPECT_EQ(vec(prog->sources()), v({0}));
+  EXPECT_EQ(vec(data.reachable_sources), v({0}));
+  EXPECT_EQ(data.entries.size(), 2U);
+  EXPECT_EQ(vec(data.entries_for_source(0)), v({0, 1}));
+  expect_lists_in_block(data);
+  // A copy of the shared reference reads the same block.
+  const auto copy = prog;
+  prog.reset();
+  EXPECT_EQ(&detail::ProgramAccess::data(*copy), &data);
+  EXPECT_EQ(copy->tunnels()[1].edges, v({1, 3}));
+}
+
+// A controller's program owns its lists: it outlives the policy whose roster and exclusions it
+// copied, and reads the same values from its own block.
+TEST(ProgramLayouts, ControllerProgramOwnsItsLists) {
+  const auto g = graph(5, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 10, 1}, {4, 3, 10, 1}});
+  FlowLedger fg(g);
+  const auto el = std::make_shared<const Eligibility>(g->eligibility(std::vector<NodeId> {4}, std::vector<EdgeId> {1}));
+  std::shared_ptr<const ForwardingProgram> prog;
+  {
+    auto p = std::make_unique<FlowPolicy>(fg, v({0, 4}), v({3}), global(std::nullopt), el.get());
+    prog = p->place(5).program;
+    p.reset();
+  }
+  // Churn the allocator so a list read from freed policy storage would differ.
+  std::vector<std::vector<NodeId>> churn;
+  for (int i = 0; i < 64; ++i) churn.emplace_back(8, -7);
+  ASSERT_NE(prog, nullptr);
+  const auto& data = detail::ProgramAccess::data(*prog);
+  EXPECT_EQ(vec(prog->sources()), v({0, 4}));
+  EXPECT_EQ(vec(prog->destinations()), v({3}));
+  EXPECT_EQ(vec(data.reachable_sources), v({0}));
+  EXPECT_EQ(vec(data.excluded_nodes), v({4}));
+  EXPECT_EQ(vec(data.excluded_edges), v({1, 4}));
+  EXPECT_EQ(vec(data.tunnel_entry_positions), v({0}));
+  EXPECT_EQ(vec(data.source_entry_offsets), v({0, 1}));
+  EXPECT_EQ(vec(data.source_entry_positions), v({0}));
+  expect_lists_in_block(data);
+}
+
+// A forwarding view keeps its program alive (its data pointer reads into it), owns its vectors,
+// and a view with other black holes shares the program and its structure: both stay valid after
+// the source view and every other reference to the program are gone and programs of the same
+// shape reuse the memory.
+TEST(ProgramLayouts, ViewOwnsItsStorage) {
+  const auto g = graph(6, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 2, 10, 1}, {3, 4, 10, 1}, {3, 5, 10, 1}, {4, 5, 10, 1}});
+  auto build = [&](NodeId s, std::vector<EdgeId> a, std::vector<EdgeId> b, NodeId dst) {
+    return program(*g, {s}, {dst}, {tunnel_route(*g, s, a), dag_route(*g, s, b)});
+  };
+  const auto dark = g->eligibility({}, std::vector<EdgeId> {2});
+  std::optional<detail::ForwardingView> source;
+  {
+    auto prog = build(0, {1}, {0, 2}, 2);
+    source.emplace(detail::make_forwarding_view(*g, prog, nullptr, v({2}), nullptr, true));
+  }
+  ASSERT_EQ(source->num_sources(), 1U);
+  ASSERT_FALSE(source->borrowed);  // a tunnel's record route is made: the view holds its state
+  const detail::ForwardingView copy(*source);
+  const auto stale = detail::with_black_holes(*source, &dark);
+  EXPECT_NE(copy.status_.data(), source->status_.data());
+  EXPECT_NE(copy.source_entry_positions_.data(), source->source_entry_positions_.data());
+  EXPECT_EQ(copy.program, source->program);
+  EXPECT_EQ(stale.program, source->program);
+  EXPECT_EQ(stale.black_holes, &dark);
+  const auto status = copy.status_;
+  const auto entries_of_head = copy.source_entry_positions_;
+  const auto plans = copy.prepared_routes_.size();
+  source.reset();
+  std::vector<std::shared_ptr<const ForwardingProgram>> later;
+  for (int i = 0; i < 4; ++i) later.push_back(build(3, {4}, {3, 5}, 5));
+  for (const auto* view : {&copy, &stale}) {
+    ASSERT_NE(view->program, nullptr);
+    EXPECT_EQ(view->data, &detail::ProgramAccess::data(*view->program));
+    EXPECT_EQ(view->source(0), 0);
+    EXPECT_EQ(vec(view->data->reachable_sources), v({0}));
+    EXPECT_EQ(vec(view->data->destinations), v({2}));
+    expect_lists_in_block(*view->data);
+    EXPECT_EQ(view->status_, status);
+    EXPECT_EQ(view->source_entry_positions_, entries_of_head);
+    ASSERT_EQ(view->prepared_routes_.size(), plans);
+    for (const auto& plan : view->prepared_routes_) EXPECT_EQ(vec(plan->destinations), v({2}));
+  }
+}
+
+// A borrowed view (no mask, no black holes, no record route to make) holds no state of its own:
+// it reads the program, which its shared reference keeps alive after every other reference is
+// gone and programs of the same shape reuse the freed memory; a copy reads the same program, and
+// the same view with black holes writes the program's state out before changing it.
+TEST(ProgramLayouts, BorrowedViewReadsItsProgram) {
+  const auto g = graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 10, 1}});
+  auto build = [&](NodeId s) { return program(*g, {s}, {3}, {dag_route(*g, s, {0, 1, 2, 3})}); };
+  const auto dark = g->eligibility({}, std::vector<EdgeId> {2});
+  std::optional<detail::ForwardingView> source;
+  {
+    auto prog = build(0);
+    source.emplace(detail::make_forwarding_view(*g, prog, nullptr, v({3}), nullptr, true));
+  }
+  ASSERT_TRUE(source->borrowed);
+  EXPECT_TRUE(source->status_.empty() && source->prepared_routes_.empty() && source->source_entry_positions_.empty());
+  const detail::ForwardingView copy(*source);
+  const auto stale = detail::with_black_holes(*source, &dark);
+  EXPECT_TRUE(copy.borrowed);
+  EXPECT_FALSE(stale.borrowed);
+  const auto* plan = source->prepared_route(0).get();
+  source.reset();
+  std::vector<std::shared_ptr<const ForwardingProgram>> later;
+  for (int i = 0; i < 4; ++i) later.push_back(build(0));
+  for (const auto* view : {&copy, &stale}) {
+    ASSERT_NE(view->program, nullptr);
+    EXPECT_EQ(view->data, &detail::ProgramAccess::data(*view->program));
+    ASSERT_EQ(view->num_sources(), 1U);
+    EXPECT_EQ(view->source(0), 0);
+    EXPECT_EQ(view->status(0), TunnelStatus::Up);
+    EXPECT_EQ(vec(view->entries_for_source(0)), v({0}));
+    EXPECT_EQ(view->context_source_index(0), 0);
+    EXPECT_EQ(view->prepared_route(0).get(), plan);
+    EXPECT_EQ(view->prepared_route(0)->forwarding_edges, v({0, 1, 2, 3}));
+    EXPECT_EQ(view->min_route_cost(0), 2);
+    expect_lists_in_block(*view->data);
+  }
+  EXPECT_FALSE(copy.is_blackholed_source(0));
+}
+
+// An epoch is a value: its copy keeps the record_groups, the program, the rows and the counters after
+// the policy that held the original has moved on and been destroyed.
+TEST(ProgramLayouts, EpochCopyOwnsItsStorage) {
+  const auto g = graph(4, kPinloss);
+  const auto prog = tunnels(*g, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  std::optional<Pol> p(pinned(g, prog, LOSSY));
+  (void)(*p)->replace(12);
+  const detail::PolicyEpoch copy = detail::PolicyAccess::engine(*p->p).epoch;
+  const auto& live = detail::PolicyAccess::engine(*p->p).epoch;
+  ASSERT_EQ(copy.record_groups.size(), 2U);
+  EXPECT_NE(copy.record_groups.data(), live.record_groups.data());
+  EXPECT_NE(copy.by_tunnel.data(), live.by_tunnel.data());
+  const auto rows_before = copy.by_tunnel;
+  const auto ids_before = std::vector<std::int64_t> {copy.record_groups[0][0].record_counter, copy.record_groups[1][0].record_counter};
+  (void)(*p)->replace(4);
+  p.reset();
+  for (int i = 0; i < 4; ++i) (void)pinned(g, prog, LOSSY)->replace(2);
+  EXPECT_EQ(copy.program, prog);
+  EXPECT_TRUE(copy.by_tunnel == rows_before);
+  EXPECT_EQ(rows_before.size(), 2U);
+  EXPECT_EQ(lo(rows_before[0].assigned), 6);
+  EXPECT_EQ(rows_before[0].delivered, 2);
+  EXPECT_EQ((std::vector<std::int64_t> {copy.record_groups[0][0].record_counter, copy.record_groups[1][0].record_counter}), ids_before);
+  EXPECT_EQ(lo(copy.offered), 12);
+  EXPECT_EQ(lo(copy.requested), 12);
+}
+
+// ---------------------------------------------------------------- property: random tunnel programs
+
+// Random tunnel programs on random DAGs (two heads, one destination, paths drawn from every path
+// of each head, weights 0 to 3 with a positive one per head) against program_reference: the
+// lossless bound (x fits, x + 1 does not), each tunnel's highest-averages amount and the loads at
+// the bound, conservation at every node, a Lossy replace at the bound delivering every share, and
+// evaluate above the bound returning the bound.
+TEST(ProgramProperty, TunnelProgramsMatchTheReference) {
+  namespace ref = program_reference;
+  std::mt19937 rng(20261018);
+  int checked = 0;
+  int two_heads = 0;  // trials whose roster has both heads
+  int positive = 0;   // trials with a positive bound
+  int shared_links = 0;  // trials where some edge carries two tunnels' amounts
+  for (int trial = 0; trial < 60; ++trial) {
+    const std::int32_t n = 6;
+    std::vector<InEdge> rows;
+    for (NodeId u = 0; u < n; ++u) {
+      for (NodeId w = u + 1; w < n; ++w) {
+        if (u == 0 && w == 1) continue;  // the heads do not feed each other
+        const int copies = static_cast<int>(rng() % 3);
+        for (int k = 0; k < copies; ++k) rows.push_back({u, w, static_cast<Amount>(rng() % 7), 1});
+      }
+    }
+    const auto g = shared(make_graph(n, rows));
+    const NodeId dst = n - 1;
+    // Every path from a head to dst (ids of g; destinations are terminal).
+    std::vector<std::vector<EdgeId>> found[2];
+    for (NodeId h = 0; h < 2; ++h) {
+      std::vector<EdgeId> stack;
+      std::function<void(NodeId)> walk = [&](NodeId u) {
+        if (u == dst) {
+          found[h].push_back(stack);
+          return;
+        }
+        for (EdgeId e = 0; e < g->num_edges(); ++e) {
+          if (g->edge_sources()[static_cast<std::size_t>(e)] != u) continue;
+          stack.push_back(e);
+          walk(g->edge_destinations()[static_cast<std::size_t>(e)]);
+          stack.pop_back();
+        }
+      };
+      walk(h);
+    }
+    std::vector<ref::RefTunnel> t;
+    for (NodeId h = 0; h < 2; ++h) {
+      if (found[h].empty()) continue;
+      const int k = 1 + static_cast<int>(rng() % 3);
+      for (int i = 0; i < k; ++i) {
+        t.push_back({h, found[h][rng() % found[h].size()], static_cast<Amount>(rng() % 4)});
+      }
+      t.back().weight = std::max<Amount>(t.back().weight, 1);
+    }
+    if (t.empty()) continue;
+    std::vector<Spec> specs;
+    for (const auto& x : t) specs.emplace_back(x.head, x.edges, x.weight);
+    const auto prog = tunnels(*g, {0, 1}, {dst}, specs);
+    const Amount x = ref::lossless_bound(*g, t);
+    const std::string where = "trial " + std::to_string(trial) + " bound " + std::to_string(x);
+    ASSERT_FALSE(ref::fits(*g, t, x + 1)) << where;
+    auto p = pinned(g, prog);
+    const auto r = p->place(INF, kEdges);
+    ASSERT_EQ(r.call_delivered, x) << where;
+    const auto amounts = *ref::tunnel_amounts(x, t);
+    two_heads += ref::roster(t).size() == 2 ? 1 : 0;
+    positive += x > 0 ? 1 : 0;
+    {
+      std::vector<int> users(static_cast<std::size_t>(g->num_edges()), 0);
+      for (std::size_t i = 0; i < t.size(); ++i) {
+        if (amounts[i] > 0) {
+          for (EdgeId e : t[i].edges) ++users[static_cast<std::size_t>(e)];
+        }
+      }
+      shared_links += std::any_of(users.begin(), users.end(), [](int u) { return u > 1; }) ? 1 : 0;
+    }
+    EXPECT_EQ(*r.edge_flows, ref::loads(*g, t, amounts)) << where;
+    EXPECT_EQ(delivered(*p.p), amounts) << where;
+    ASSERT_EQ(r.by_tunnel.size(), t.size()) << where;
+    for (std::size_t i = 0; i < t.size(); ++i) EXPECT_EQ(r.by_tunnel[i].delivered, amounts[i]) << where << " tunnel " << i;
+    // Conservation: a transit node passes on what it receives; the heads send their shares.
+    std::vector<Amount> in(static_cast<std::size_t>(n), 0), out(static_cast<std::size_t>(n), 0);
+    for (EdgeId e = 0; e < g->num_edges(); ++e) {
+      out[static_cast<std::size_t>(g->edge_sources()[e])] += (*r.edge_flows)[e];
+      in[static_cast<std::size_t>(g->edge_destinations()[e])] += (*r.edge_flows)[e];
+    }
+    for (NodeId u = 2; u < dst; ++u) EXPECT_EQ(in[u], out[u]) << where << " node " << u;
+    EXPECT_EQ(in[dst], x) << where;
+    EXPECT_EQ(out[0] + out[1] - in[1], x) << where;
+    // Lossy at the bound: every share delivered, nothing dropped.
+    const auto l = pinned(g, prog, LOSSY)->replace(x);
+    EXPECT_EQ(l.call_delivered, x) << where;
+    EXPECT_TRUE(l.call_edge_drops.empty()) << where;
+    EXPECT_TRUE(l.source_drops.is_zero()) << where;
+    // Lossless above the bound places the bound.
+    EXPECT_EQ(pinned(g, prog)->evaluate(x + 1).call_delivered, x) << where;
+    ++checked;
+  }
+  RecordProperty("checked", checked);
+  RecordProperty("two_heads", two_heads);
+  RecordProperty("positive", positive);
+  RecordProperty("shared_links", shared_links);
+  EXPECT_GT(checked, 30);  // not vacuous
+  EXPECT_GT(two_heads, 10);
+  EXPECT_GT(positive, 20);
+  EXPECT_GT(shared_links, 5);
+}
+
+// The reference's own controls: a known bound and a lost share.
+TEST(ProgramProperty, ReferenceControls) {
+  namespace ref = program_reference;
+  EXPECT_EQ(ref::round_robin(5, 2), (Amounts {3, 2}));
+  EXPECT_EQ(ref::highest_averages(15, {1, 2}), (Amounts {5, 10}));
+  EXPECT_EQ(ref::highest_averages(2, {1, 1}), (Amounts {1, 1}));
+  EXPECT_EQ(ref::highest_averages(4, {0, 3}), (Amounts {0, 4}));
+  const auto g = par2(6, 4);
+  EXPECT_EQ(ref::lossless_bound(*g, {{0, {0}, 1}, {0, {1}, 1}}), 9);
+  EXPECT_EQ(ref::lossless_bound(*g, {{0, {0}, 1}, {0, {1}, 2}}), 6);  // H(6, (1, 2)) = (2, 4); H(7) = (2, 5)
+  EXPECT_FALSE(ref::tunnel_amounts(1, {{0, {0}, 0}}).has_value());
+}
+
+// ---------------------------------------------------------------- from_dag
+
+// DP: links 0->2 and 1->2 of capacity 10, then two parallel links 2->3 of capacity 1, cost 1;
+// sources 0 and 1, destination 3.
+const std::vector<InEdge> kDP = {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}, {2, 3, 1, 1}};
+
+std::shared_ptr<const ForwardingProgram> from_dag(const Graph& g, const std::vector<EdgeId>& edges, const RouteOptions& o = {}) {
+  return ForwardingProgram::from_dag(g, v({0, 1}), v({3}), dag_of(g, edges), o);
+}
+
+// DAG-pooled against DAG-separate: one context splits node 2's two units once; two contexts each
+// put their unit on the first link.
+TEST(FromDag, Pools) {
+  const auto g = graph(4, kDP);
+  const auto pooled = from_dag(*g, {0, 1, 2, 3});
+  EXPECT_EQ(pinned(g, pooled)->place(INF).call_delivered, 2);
+  EXPECT_EQ(pinned(g, pooled, LOSSY)->place(2).call_delivered, 2);
+  const auto separate = ForwardingProgram::from_routes(*g, v({0, 1}), v({3}),
+                                                       std::vector<RouteDefinition> {dag_route(*g, 0, {0, 1, 2, 3}), dag_route(*g, 1, {0, 1, 2, 3})});
+  EXPECT_EQ(pinned(g, separate)->place(INF).call_delivered, 1);
+  EXPECT_EQ(pinned(g, separate, LOSSY)->place(2).call_delivered, 1);
+  EXPECT_TRUE(pooled->tunnels().empty());
+}
+
+// LOSSY 3: node 2 splits RR(3, 2) = (2, 1), e2's 2 units go back by H(2, [2, 1]) = (2, 0).
+TEST(FromDag, Attribution) {
+  const auto g = graph(4, kDP);
+  auto p = pinned(g, from_dag(*g, {0, 1, 2, 3}), LOSSY);
+  const auto r = p->place(3);
+  EXPECT_EQ(r.call_delivered, 2);
+  EXPECT_EQ(r.call_edge_drops, (Drops {{2, 1}}));
+  ASSERT_EQ(r.by_source.size(), 2U);
+  EXPECT_EQ(std::tuple(lo(r.by_source[0].offered), r.by_source[0].delivered, lo(r.by_source[0].total_edge_drops)),
+            std::tuple(Amount {2}, Amount {1}, Amount {1}));
+  EXPECT_EQ(std::tuple(lo(r.by_source[1].offered), r.by_source[1].delivered, lo(r.by_source[1].total_edge_drops)),
+            std::tuple(Amount {1}, Amount {1}, Amount {0}));
+  const auto records = p.ledger->records();
+  ASSERT_EQ(records.size(), 2U);
+  EXPECT_EQ(records[0].edge_flows, (Drops {{0, 2}, {2, 1}}));
+  EXPECT_EQ(records[1].edge_flows, (Drops {{1, 1}, {3, 1}}));
+}
+
+// A residual snapshot is read per EdgeId, not per position in the DAG: e0 0->2 is outside the DAG,
+// e1 and e2 0->1 (cost 2) are in it; residual {10, 2, 8} weighs them 2 and 8, so an offer of 10
+// splits by highest averages as (2, 8) and e0 carries nothing.
+TEST(FromDag, SnapshotReadsByEdgeId) {
+  const auto g = graph(3, {{0, 2, 10, 1}, {0, 1, 10, 2}, {0, 1, 10, 2}});
+  RouteOptions o;
+  o.allocation = W;
+  o.weight_basis = WeightBasis::ResidualSnapshot;
+  o.residual = Amounts {10, 2, 8};
+  const auto program = ForwardingProgram::from_dag(*g, v({0}), v({1}), dag_of(*g, {1, 2}), o);
+  const auto r = pinned(g, program)->replace(10, std::nullopt, kEdges);
+  EXPECT_EQ(r.edge_flows, (Amounts {0, 2, 8}));
+}
+
+// ShortestPaths ECMP and Pinned over from_dag of the same DAG: identical delivered, drops and rows
+// for Lossy offers 1 to 5 and the Lossless bound; the same under a mask, and WCMP on DP3.
+TEST(FromDag, EqualsShortestPaths) {
+  const auto check = [](const std::shared_ptr<const Graph>& g, RouteAllocation k, std::shared_ptr<const Eligibility> mask) -> Amount {
+    RouteOptions o;
+    o.allocation = k;
+    const auto program = from_dag(*g, {0, 1, 2, 3}, o);
+    for (const Amount offer : {1, 2, 3, 4, 5}) {
+      auto a = make(g, v({0, 1}), v({3}), shortest_paths_policy(k, LOSSY), mask);
+      auto b = make(g, v({0, 1}), v({3}), FlowPolicyConfig {.routing = Pinned {program, nullptr}, .admission = LOSSY}, mask);
+      const auto x = a->place(offer);
+      const auto y = b->place(offer);
+      EXPECT_EQ(x.call_delivered, y.call_delivered) << offer;
+      EXPECT_EQ(x.call_edge_drops, y.call_edge_drops) << offer;
+      EXPECT_EQ(x.by_source.size(), y.by_source.size());
+      for (std::size_t i = 0; i < std::min(x.by_source.size(), y.by_source.size()); ++i) {
+        EXPECT_EQ(x.by_source[i].delivered, y.by_source[i].delivered) << offer;
+        EXPECT_EQ(x.by_source[i].total_edge_drops, y.by_source[i].total_edge_drops) << offer;
+      }
+    }
+    auto a = make(g, v({0, 1}), v({3}), shortest_paths_policy(k), mask);
+    auto b = make(g, v({0, 1}), v({3}), FlowPolicyConfig {.routing = Pinned {program, nullptr}}, mask);
+    const Amount bound = a->place(INF).call_delivered;
+    EXPECT_EQ(bound, b->place(INF).call_delivered);
+    return bound;
+  };
+  const auto dp = graph(4, kDP);
+  EXPECT_EQ(check(dp, EB, nullptr), 2);
+  EXPECT_EQ(check(dp, EB, no_edges(*dp, {3})), 1);
+  EXPECT_EQ(check(graph(4, {{0, 2, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}, {2, 3, 3, 1}}), W, nullptr), 4);
+}
+
+// The validation order of from_dag: the endpoints, the DAG's graph, the allocation, the weights.
+TEST(FromDag, Validation) {
+  const auto g = graph(4, kDP);
+  const auto other = graph(4, kDP);
+  const auto whole = dag_of(*g, {0, 1, 2, 3});
+  const auto foreign = dag_of(*other, {0, 1, 2, 3});
+  RouteOptions optimized;
+  optimized.allocation = MF;
+  RouteOptions basis;
+  basis.weight_basis = WeightBasis::Capacity;
+  RouteOptions short_weights;
+  short_weights.allocation = W;
+  short_weights.weight_basis = WeightBasis::Explicit;
+  short_weights.edge_weights = std::vector<Amount> {1, 1, 1};
+  const auto err = [&](std::vector<NodeId> s, const std::shared_ptr<const PredecessorDAG>& d, const RouteOptions& o) {
+    return error_of([&] { (void)ForwardingProgram::from_dag(*g, s, v({3}), d, o); });
+  };
+  EXPECT_EQ(err({}, foreign, optimized), "sources: the node set is empty");
+  EXPECT_EQ(err({0, 1}, foreign, optimized), "dag belongs to another graph");
+  EXPECT_EQ(err({0, 1}, nullptr, {}), "dag belongs to another graph");
+  EXPECT_EQ(err({0, 1}, whole, optimized), "from_dag allocation must be EQUAL or WEIGHTED");
+  EXPECT_EQ(err({0, 1}, whole, basis), "weight_basis requires allocation=WEIGHTED");
+  EXPECT_EQ(err({0, 1}, whole, short_weights), "edge_weights: expected 4 entries");
+  // An empty roster is a valid program.
+  const auto none = ForwardingProgram::from_dag(*g, v({0, 1}), v({3}), dag_of(*g, {2, 3}));
+  EXPECT_TRUE(none->tunnels().empty());
+  EXPECT_EQ(pinned(g, none)->place(INF).termination, Termination::NoRoute);
+}
+
+// ---------------------------------------------------------------- the forwarding network's size
+
+// Each count of a forwarding network is checked against 2^31 - 1 inclusively, with its exact value
+// and its name in the text. 10,000 tunnels of 214,749 hops (2,147,490,000
+// occurrences) are refused; exactly 2^31 - 1 passes; 2^31 entries are refused as entries.
+TEST(ForwardingSize, EachCountIsCheckedInclusivelyWithItsExactValue) {
+  using detail::ForwardingCounter;
+  EXPECT_EQ(detail::kForwardingLimit, 2147483647);
+  for (const auto c : {ForwardingCounter::Entry, ForwardingCounter::Occurrence, ForwardingCounter::Router,
+                       ForwardingCounter::Event, ForwardingCounter::Dependency}) {
+    EXPECT_EQ(error_of([&] { detail::check_forwarding_count(c, 2147483647); }), "");
+    EXPECT_EQ(error_of([&] { detail::check_forwarding_count(c, 0); }), "");
+  }
+  EXPECT_EQ(error_of([&] { detail::check_forwarding_count(ForwardingCounter::Occurrence, std::int64_t {10000} * 214749); }),
+            "forwarding occurrence limit exceeded: 2147490000 > 2147483647");
+  EXPECT_EQ(error_of([&] { detail::check_forwarding_count(ForwardingCounter::Entry, std::int64_t {1} << 31); }),
+            "forwarding entry limit exceeded: 2147483648 > 2147483647");
+  EXPECT_EQ(error_of([&] { detail::check_forwarding_count(ForwardingCounter::Router, std::int64_t {1} << 31); }),
+            "forwarding router limit exceeded: 2147483648 > 2147483647");
+  EXPECT_EQ(error_of([&] { detail::check_forwarding_count(ForwardingCounter::Event, std::int64_t {1} << 31); }),
+            "forwarding event limit exceeded: 2147483648 > 2147483647");
+  EXPECT_EQ(error_of([&] { detail::check_forwarding_count(ForwardingCounter::Dependency, std::int64_t {1} << 31); }),
+            "forwarding dependency limit exceeded: 2147483648 > 2147483647");
+}
+
+// A call counts its network and checks the entry, occurrence and router counts before the network
+// is allocated, the event and dependency counts before the event structures: with one counter's
+// limit lowered to its count less one for this thread (a hooks build), the call is refused with
+// that count, nothing changed; at the count it runs; with every limit at 1 the entries are
+// reported first. PAR2(6, 4) with two one-edge route DAGs (two contexts: the general network),
+// LOSSY replace(12): 2 entries, 2 occurrences (one member each), 4 routers (two per route), 6
+// units sent on each link; the 4-unit link can drop (one barrier), so 1 + 4 = 5 events and 3
+// dependencies (router to router on the 6-unit link; router to event to router on the other).
+// LOSSLESS has no events: its entries, occurrences and routers are checked. DIAM's two 2-hop
+// tunnels: 2 entries, 4 occurrences.
+TEST(ForwardingSize, TheCallChecksEachCountInOrder) {
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  using detail::ForwardingCounter;
+  struct Restore {
+    ~Restore() { detail::thread_forwarding_limits() = {}; }
+  } restore;
+  const auto p2 = par2(6, 4);
+  const auto two_dags = program(*p2, {0}, {1}, {dag_route(*p2, 0, {0}), dag_route(*p2, 0, {1})});
+  const auto d = graph(4, kDiam);
+  const auto two_tunnels = tunnels(*d, {0}, {3}, {{0, {0, 2}, 1}, {0, {1, 3}, 1}});
+  struct Count {
+    ForwardingCounter counter;
+    const char* name;
+    std::int64_t n;
+  };
+  struct Case {
+    std::shared_ptr<const Graph> g;
+    std::shared_ptr<const ForwardingProgram> prog;
+    Admission admission;
+    Amount delivered;
+    std::vector<Count> counts;
+  };
+  const std::vector<Case> cases {
+      {p2, two_dags, LOSSY, 10,
+       {{ForwardingCounter::Entry, "entry", 2}, {ForwardingCounter::Occurrence, "occurrence", 2},
+        {ForwardingCounter::Router, "router", 4}, {ForwardingCounter::Event, "event", 5},
+        {ForwardingCounter::Dependency, "dependency", 3}}},
+      {p2, two_dags, LOSSLESS, 9,
+       {{ForwardingCounter::Entry, "entry", 2}, {ForwardingCounter::Occurrence, "occurrence", 2},
+        {ForwardingCounter::Router, "router", 4}}},
+      {d, two_tunnels, LOSSY, 12, {{ForwardingCounter::Entry, "entry", 2}, {ForwardingCounter::Occurrence, "occurrence", 4}}},
+      {d, two_tunnels, LOSSLESS, 12, {{ForwardingCounter::Entry, "entry", 2}, {ForwardingCounter::Occurrence, "occurrence", 4}}},
+  };
+  for (const auto& c : cases) {
+    auto pol = pinned(c.g, c.prog, c.admission);
+    for (const auto& k : c.counts) {
+      const LedgerState before = ledger_state(*pol.ledger);
+      auto& limits = detail::thread_forwarding_limits();
+      limits = {};
+      limits[static_cast<std::size_t>(k.counter)] = k.n - 1;
+      EXPECT_EQ(error_of([&] { (void)pol->replace(12); }), std::string("forwarding ") + k.name + " limit exceeded: " +
+                                                                std::to_string(k.n) + " > " + std::to_string(k.n - 1));
+      expect_same(ledger_state(*pol.ledger), before, k.name);
+      EXPECT_TRUE(pol->records().empty());
+      limits[static_cast<std::size_t>(k.counter)] = k.n;
+      EXPECT_EQ(pol->replace(12).call_delivered, c.delivered) << k.name;
+      pol->remove();
+    }
+    detail::thread_forwarding_limits() = {1, 1, 1, 1, 1};
+    EXPECT_EQ(error_of([&] { (void)pol->replace(12); }), "forwarding entry limit exceeded: 2 > 1");
+    detail::thread_forwarding_limits() = {};
+  }
+#else
+  GTEST_SKIP() << "a lowered limit needs the private hooks";
+#endif
+}
+
+
+TEST(Program, SparseMemberAmountsPreserveOrderAndOwnTheirStorage) {
+  std::vector<EdgeId> members {9, 2, 7, 1};
+  std::vector<Amount> amounts {0, 3, 0, kDomainLimit - 1};
+  const auto pairs = detail::nonzero_pairs(members, amounts);
+  EXPECT_EQ(pairs, (std::vector<std::pair<EdgeId, Amount>> {{2, 3}, {1, kDomainLimit - 1}}));
+  members[1] = 8;
+  amounts[1] = 5;
+  EXPECT_EQ(pairs, (std::vector<std::pair<EdgeId, Amount>> {{2, 3}, {1, kDomainLimit - 1}}));
+  EXPECT_TRUE(detail::nonzero_pairs({}, {}).empty());
+  EXPECT_TRUE(detail::nonzero_pairs(members, std::vector<Amount>(4, 0)).empty());
+  EXPECT_EQ(detail::nonzero_pairs(std::vector<EdgeId> {4}, std::vector<Amount> {1}),
+            (std::vector<std::pair<EdgeId, Amount>> {{4, 1}}));
+}
diff --git a/tests/cpp/public_names_tests.cpp b/tests/cpp/public_names_tests.cpp
new file mode 100644
index 0000000..0d843b4
--- /dev/null
+++ b/tests/cpp/public_names_tests.cpp
@@ -0,0 +1,152 @@
+// The C++ public names: each renamed declaration is named once here, through the public headers
+// alone, so a rename that is undone or a name that is removed fails to compile; the enumerators of
+// every public enumeration; and the earlier header names, which no longer exist.
+
+#include <gtest/gtest.h>
+
+#include <initializer_list>
+#include <span>
+#include <concepts>
+#include <type_traits>
+#include <variant>
+#include <vector>
+
+#include "netgraph/core/eligibility.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/search.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/types.hpp"
+
+using namespace netgraph::core;
+
+namespace {
+
+// The earlier headers are gone.
+#if __has_include("netgraph/core/dag_cache.hpp") || __has_include("netgraph/core/pred_dag.hpp") || \
+    __has_include("netgraph/core/program.hpp")
+#error "an earlier public header still exists"
+#endif
+
+// Types.
+static_assert(std::is_class_v<AbsoluteCost> && std::is_class_v<CostStretch> && std::is_class_v<TunnelCount>);
+static_assert(std::is_class_v<ShortestPaths> && std::is_class_v<DistributedTE> && std::is_class_v<CentralizedTE> &&
+              std::is_class_v<Pinned>);
+static_assert(std::is_class_v<ShortestPathCache> && std::is_base_of_v<std::exception, ShortestPathCacheMiss>);
+static_assert(std::is_class_v<PredecessorDAG> && std::is_class_v<EvaluationOptions> && std::is_class_v<RouteDefinition>);
+static_assert(std::is_enum_v<RouteTieBreak> && std::is_enum_v<RouteAllocation> && std::is_enum_v<SourceAllocation>);
+
+// Fields.
+static_assert(requires(DistributedTE x) { x.cost_ceiling; x.tie_break; x.parallel_edges; });
+static_assert(requires(ShortestPaths x) {
+  x.allocation;
+  x.source_allocation;
+  x.weight_basis;
+  x.edge_weights;
+  x.tie_break;
+  x.multipath;
+  x.parallel_edges;
+});
+static_assert(requires(CentralizedTE x) { x.source_allocation; x.support; x.tunnel_count; x.prefer_headroom; });
+static_assert(requires(FlowRecord x) { x.route; x.edge_drops; x.edge_flows; x.entry_id; x.policy_id; x.min_route_cost; });
+static_assert(requires(KspOptions x) { x.eligibility; x.cost_ceiling; x.tie_break; x.parallel_edges; });
+static_assert(requires(SpfOptions x) { x.eligibility; x.tie_break; x.multipath; x.parallel_edges; });
+static_assert(requires(OutputOptions x) { x.saturated_boundary_edges; });
+static_assert(requires(PlacementResult x) {
+  x.saturated_boundary_edges;
+  x.call_edge_drops;
+  x.call_source_drops;
+  x.marginal_cost_curve;
+  x.edge_drops;
+  x.call_delivered;
+  x.call_undelivered;
+  x.source_drops;
+});
+static_assert(requires(EvaluationOptions x) { x.eligibility; x.offer; x.design_demand; });
+static_assert(requires(RouteDefinition x) { x.route; x.head; x.weight; });
+static_assert(requires(RouteOptions x) { x.allocation; x.weight_basis; x.edge_weights; x.residual; });
+static_assert(requires(SensitivityEntry x) { x.delivery_reduction; });
+static_assert(requires(SourceFlow x) { x.total_edge_drops; x.source_drops; });
+static_assert(requires(Tunnel x) { x.entry_id; x.path_cost; x.planned_bandwidth; });
+static_assert(requires(TunnelFlow x) { x.total_edge_drops; x.entry_id; });
+static_assert(requires(TunnelCount x) { x.per_head; x.up_to; });
+
+// Functions and methods.
+static_assert(requires(const Eligibility& e) { e.allows_edge(EdgeId {0}); e.allows_node(NodeId {0}); });
+static_assert(requires(const FlowLedger& f, std::span<const NodeId> s) {
+  f.carried();
+  f.saturated_boundary_edges(s);
+  f.edge_capacity_units();
+});
+static_assert(requires(const FlowPolicy& p) { p.delivered(); });
+static_assert(requires(const Graph& g) {
+  g.edge_capacity_units();
+  g.edge_costs();
+  g.edge_cost_gcd();
+  g.edge_destinations();
+  g.edge_sources();
+  g.incoming_edges();
+  g.incoming_offsets();
+  g.input_positions();
+  g.max_edge_cost();
+  g.outgoing_offsets();
+});
+static_assert(requires(const Path& p) { p.source(); p.destination(); });
+static_assert(requires(const Graph& g, std::span<const NodeId> s, const EvaluationOptions& o) {
+  evaluate_demand(g, s, s, o);
+  evaluate_edge_failures(g, s, s, o, 1);
+});
+static_assert(requires(const Graph& g, std::span<const NodeId> s, std::shared_ptr<const PredecessorDAG> dag) {
+  ForwardingProgram::from_dag(g, s, s, dag);
+});
+// The list operation: its actions, their variant and the call.
+static_assert(std::is_aggregate_v<Place> && std::is_aggregate_v<Replace> && std::is_aggregate_v<Forward>);
+static_assert(std::is_same_v<Action, std::variant<Place, Replace, Forward>>);
+static_assert(requires(Place x) { x.policy; x.offer; });
+static_assert(requires(Replace x) { x.policy; x.offer; x.design_demand; });
+static_assert(requires(Forward x) { x.policy; x.offer; x.black_holes; });
+static_assert(requires(FlowLedger& f, std::span<const Action> a, const OutputOptions& o) {
+  { apply_actions(f, a) } -> std::same_as<std::vector<PlacementResult>>;
+  apply_actions(f, a, BatchMode::Simultaneous, o);
+});
+
+}  // namespace
+
+// Every enumerator of the public enumerations, in declaration order (the order of the stub and
+// docs/semantics.md). Only TunnelStatus's and Termination's integer values are promised
+// (docs/semantics.md, "Termination" and "Forwarding programs"); for the others only the order is
+// checked.
+template <typename E>
+constexpr bool declared_in_order(std::initializer_list<E> names) {
+  const E* prev = nullptr;
+  for (const E& e : names) {
+    if (prev != nullptr && !(*prev < e)) return false;
+    prev = &e;
+  }
+  return true;
+}
+
+TEST(PublicNames, Enumerations) {
+  static_assert(declared_in_order({RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity,
+                                   RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherHeadroom}));
+  static_assert(declared_in_order({RouteAllocation::Equal, RouteAllocation::Weighted, RouteAllocation::Optimized}));
+  static_assert(declared_in_order({SourceAllocation::Equal, SourceAllocation::Optimized, SourceAllocation::Weighted}));
+  static_assert(declared_in_order({WeightBasis::Capacity, WeightBasis::Explicit, WeightBasis::ResidualSnapshot}));
+  static_assert(declared_in_order({Admission::Lossless, Admission::Lossy}));
+  static_assert(declared_in_order({Direction::Forward, Direction::Reverse}));
+  static_assert(declared_in_order({BatchMode::Ordered, BatchMode::Simultaneous}));
+  static_assert(static_cast<int>(TunnelStatus::Up) == 0 && static_cast<int>(TunnelStatus::InsufficientBandwidth) == 1 &&
+                static_cast<int>(TunnelStatus::CostCeilingExceeded) == 2 && static_cast<int>(TunnelStatus::Failed) == 3 &&
+                static_cast<int>(TunnelStatus::Blackholed) == 4);
+  static_assert(static_cast<int>(Termination::Complete) == 0 && static_cast<int>(Termination::NoRoute) == 1 &&
+                static_cast<int>(Termination::Exhausted) == 2 && static_cast<int>(Termination::NoActiveWeight) == 3);
+  // CentralizedTE names its source allocation: no default construction.
+  static_assert(!std::is_default_constructible_v<CentralizedTE>);
+  EXPECT_EQ(CentralizedTE(SourceAllocation::Equal).source_allocation, SourceAllocation::Equal);
+}
diff --git a/tests/cpp/route_kernels_tests.cpp b/tests/cpp/route_kernels_tests.cpp
new file mode 100644
index 0000000..efc2a90
--- /dev/null
+++ b/tests/cpp/route_kernels_tests.cpp
@@ -0,0 +1,1179 @@
+// Apportionment and the placement kernels in units: the closed-form
+// highest averages against the sequential definition, house monotonicity and the Hamilton hole
+// control, the round-robin callback form, the lower-quota division on both sides of 2^64; the
+// kernel check (the first defect in order, the combination rule alone); plans (membership by
+// kernel and tie score, split-graph pruning, the walk definition for every kernel), alloc(T) at
+// every split, exact T_max against an independent per-node reference, the Lossless steps of
+// Weighted and Equal, and the Lossy steps (drops, +inf injection; on random DAGs against an
+// independent per-node reference). Expected values are the closed forms, the hand derivations
+// given in each test and the per-node references.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <functional>
+#include <limits>
+#include <numeric>
+#include <optional>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <vector>
+
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using namespace netgraph::core::detail;
+
+namespace {
+
+std::vector<Amount> rr(Amount total, std::size_t k) {
+  std::vector<Amount> out(k);
+  round_robin(total, out);
+  return out;
+}
+
+std::vector<Amount> ha(Amount total, std::vector<Amount> w) {
+  std::vector<Amount> out(w.size());
+  highest_averages(total, w, out);
+  return out;
+}
+
+// The sequential D'Hondt definition: each unit to the member maximising w / (a + 1), ties to
+// the lower index.
+std::vector<Amount> ha_slow(Amount total, const std::vector<Amount>& w) {
+  std::vector<Amount> a(w.size(), 0);
+  for (Amount u = 0; u < total; ++u) {
+    std::size_t best = 0;
+    for (std::size_t i = 1; i < w.size(); ++i) {
+      if (static_cast<Int128>(w[i]) * (a[best] + 1) > static_cast<Int128>(w[best]) * (a[i] + 1)) best = i;
+    }
+    ++a[best];
+  }
+  return a;
+}
+
+// Count the exact rank of each quotient w[i] / k in all positive quotients w[j] / h.
+// Quotients above it precede it; equal quotients with j <= i also count. The k-th unit belongs
+// to i iff that rank is at most total. Binary search each member's last accepted k, using only
+// integer comparisons and division, independently of the library's lower-quota allocation.
+std::vector<Amount> ha_by_rank(Amount total, const std::vector<Amount>& w) {
+  std::vector<Amount> out(w.size(), 0);
+  for (std::size_t i = 0; i < w.size(); ++i) {
+    Amount lo = 0, hi = total;
+    while (lo < hi) {
+      const Amount k = lo + (hi - lo + 1) / 2;
+      Int128 rank = 0;
+      for (std::size_t j = 0; j < w.size(); ++j) {
+        const Int128 product = static_cast<Int128>(w[j]) * k;
+        rank += (product - 1) / w[i];
+        if (product % w[i] == 0 && j <= i) rank += 1;
+      }
+      if (rank <= total) lo = k;
+      else hi = k - 1;
+    }
+    out[i] = lo;
+  }
+  return out;
+}
+
+// The per-node reference of alloc(T) on a DAG whose node ids are a topological order,
+// independent of the library: `total` enters at node `src`; node by node in id order, each node's
+// inflow is split over its arcs in the given order by the sequential definition with the arcs'
+// weights. Returns each arc's amount.
+std::vector<Amount> per_node_reference(int n, const std::vector<std::pair<NodeId, NodeId>>& arcs,
+                                       const std::vector<Amount>& weights, Amount total, NodeId src = 0, bool by_rank = false) {
+  std::vector<Amount> inflow(static_cast<std::size_t>(n), 0), out(arcs.size(), 0);
+  inflow[static_cast<std::size_t>(src)] = total;
+  for (NodeId u = 0; u < n; ++u) {
+    std::vector<std::size_t> mine;
+    std::vector<Amount> w;
+    for (std::size_t i = 0; i < arcs.size(); ++i) {
+      if (arcs[i].first != u) continue;
+      mine.push_back(i);
+      w.push_back(weights[i]);
+    }
+    if (mine.empty()) continue;
+    const auto parts = by_rank ? ha_by_rank(inflow[static_cast<std::size_t>(u)], w)
+                               : ha_slow(inflow[static_cast<std::size_t>(u)], w);
+    for (std::size_t j = 0; j < mine.size(); ++j) {
+      out[mine[j]] = parts[j];
+      inflow[static_cast<std::size_t>(arcs[mine[j]].second)] += parts[j];
+    }
+  }
+  return out;
+}
+
+// The per-node reference of a Lossy step, independent of the library: on a split graph whose node
+// ids are a topological order, given as its arcs in ascending EdgeId with each arc's weight and
+// residual, the offer enters at `src` (+inf: each arc out of `src` is offered its residual); node
+// by node in id order, a node's inflow is split over its arcs one unit at a time (Weighted: each
+// unit to the largest weight / (share + 1), ties to the earlier arc; Equal: the arcs in
+// turn), each arc carries the smaller of its share and its residual and drops the rest, and what
+// it carries enters its head. A destination splits nothing (no arc of a split graph leaves one).
+struct LossyReference {
+  std::vector<Amount> carried;
+  std::vector<Amount> drops;
+  Amount injected {0};
+  Amount delivered {0};
+};
+LossyReference lossy_reference(int n, const std::vector<std::pair<NodeId, NodeId>>& arcs,
+                               const std::vector<Amount>& weights, const std::vector<Amount>& residual, bool weighted,
+                               std::optional<Amount> offer, NodeId src, const std::vector<NodeId>& dsts) {
+  LossyReference out {std::vector<Amount>(arcs.size(), 0), std::vector<Amount>(arcs.size(), 0)};
+  std::vector<Amount> inflow(static_cast<std::size_t>(n), 0);
+  inflow[static_cast<std::size_t>(src)] = offer.value_or(0);
+  for (NodeId u = 0; u < n; ++u) {
+    if (std::find(dsts.begin(), dsts.end(), u) != dsts.end()) continue;
+    std::vector<std::size_t> mine;
+    std::vector<Amount> w;
+    for (std::size_t i = 0; i < arcs.size(); ++i) {
+      if (arcs[i].first != u) continue;
+      mine.push_back(i);
+      w.push_back(weights[i]);
+    }
+    if (mine.empty()) continue;
+    std::vector<Amount> share(mine.size(), 0);
+    if (u == src && !offer.has_value()) {
+      for (std::size_t j = 0; j < mine.size(); ++j) share[j] = residual[mine[j]];
+    } else if (weighted) {
+      share = ha_slow(inflow[static_cast<std::size_t>(u)], w);
+    } else {
+      for (Amount unit = 0; unit < inflow[static_cast<std::size_t>(u)]; ++unit) {
+        ++share[static_cast<std::size_t>(unit % static_cast<Amount>(mine.size()))];
+      }
+    }
+    for (std::size_t j = 0; j < mine.size(); ++j) {
+      const std::size_t i = mine[j];
+      if (u == src) out.injected += share[j];
+      out.carried[i] = std::min(share[j], residual[i]);
+      out.drops[i] = share[j] - out.carried[i];
+      inflow[static_cast<std::size_t>(arcs[i].second)] += out.carried[i];
+    }
+  }
+  for (NodeId d : dsts) out.delivered += inflow[static_cast<std::size_t>(d)];
+  return out;
+}
+
+// Hamilton (largest remainders; not the library's rule): a control only.
+std::vector<Amount> hamilton(Amount total, const std::vector<Amount>& w) {
+  const Amount sum = std::accumulate(w.begin(), w.end(), Amount {0});
+  std::vector<Amount> a(w.size());
+  std::vector<std::size_t> order(w.size());
+  for (std::size_t i = 0; i < w.size(); ++i) {
+    a[i] = total * w[i] / sum;
+    order[i] = i;
+  }
+  std::stable_sort(order.begin(), order.end(),
+                   [&](std::size_t x, std::size_t y) { return (total * w[x]) % sum > (total * w[y]) % sum; });
+  Amount left = total - std::accumulate(a.begin(), a.end(), Amount {0});
+  for (std::size_t i = 0; i < order.size() && left > 0; ++i, --left) ++a[order[i]];
+  return a;
+}
+
+// Member-aligned view of a dense per-edge array.
+std::vector<Amount> on_members(const PreparedRoute& plan, const std::vector<Amount>& dense) {
+  std::vector<Amount> out;
+  for (EdgeId e : plan.forwarding_edges) out.push_back(dense[static_cast<std::size_t>(e)]);
+  return out;
+}
+
+// A member-aligned allocation as a dense per-edge array in input coordinates.
+std::vector<Amount> dense_input(const Graph& g, const PreparedRoute& plan, const std::vector<Amount>& alloc_m) {
+  std::vector<Amount> by_id(static_cast<std::size_t>(g.num_edges()), 0);
+  for (std::size_t m = 0; m < plan.forwarding_edges.size(); ++m) by_id[static_cast<std::size_t>(plan.forwarding_edges[m])] = alloc_m[m];
+  return to_input(g, by_id);
+}
+
+// A plan on `route` whose Weighted weights are the creation view `view` (ResidualSnapshot, the
+// default) or the capacities (Capacity).
+PreparedRoute plan_of(const Graph& g, RouteAllocation p, NodeId src, std::vector<NodeId> dsts,
+                   std::vector<EdgeId> route, const std::vector<Amount>& view,
+                   WeightBasis basis = WeightBasis::ResidualSnapshot, Admission adm = Admission::Lossless) {
+  std::sort(route.begin(), route.end());
+  std::vector<Amount> on_route;  // the creation view is route-aligned
+  for (EdgeId e : route) on_route.push_back(view[static_cast<std::size_t>(e)]);
+  const WeightSource weights {basis, basis == WeightBasis::ResidualSnapshot ? std::span<const Amount>(on_route)
+                                                                             : std::span<const Amount> {}};
+  return prepare_route(g, p, adm, weights, src, dsts, PredecessorDAGBuilder::of_edges(g, route));
+}
+
+// The route cost of a plan's route (its record's route).
+Cost cost_of(const Graph& g, const PreparedRoute& plan) {
+  return min_route_cost(g, PredecessorDAGBuilder::of_edges(g, plan.support_edges), plan.sources.front(), plan.destinations);
+}
+
+// One Lossy offer of a single-root plan on the member-aligned view `w` (nullopt: the first-hop
+// experiment of +inf).
+Forwarding lossy_step(const PreparedRoute& plan, std::optional<Amount> offer, std::span<const Amount> w) {
+  Injection in;
+  if (offer.has_value()) {
+    in.per_root = std::span<const Amount>(&*offer, 1);
+  } else {
+    in.first_hop = true;
+  }
+  return forward(plan, in, w);
+}
+
+std::vector<Amount> caps(const Graph& g) {
+  return std::vector<Amount>(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+}
+
+// One Lossless step on a fresh flow at T = 0.
+LosslessStep first_step(const PreparedRoute& plan, const std::vector<Amount>& view, std::optional<Amount> request) {
+  const auto v = on_members(plan, view);
+  const std::vector<Amount> own(plan.forwarding_edges.size(), 0);
+  return lossless_step(plan, 0, v, own, request);
+}
+
+// `count` random edges of a DAG whose node ids 0 .. n - 1 are a topological order: each u -> v
+// with u < v, then its capacity and its cost, drawn in that order.
+template <class Rng, class CapacityOf, class CostOf>
+std::vector<InEdge> random_dag_edges(Rng& rng, int n, int count, CapacityOf capacity, CostOf cost) {
+  std::vector<InEdge> edges;
+  for (int i = 0; i < count; ++i) {
+    const auto u = static_cast<NodeId>(rng() % static_cast<std::uint64_t>(n - 1));
+    const auto v = static_cast<NodeId>(u + 1 + rng() % static_cast<std::uint64_t>(n - 1 - u));
+    const Amount c = capacity();
+    const Cost w = cost();
+    edges.push_back({u, v, c, w});
+  }
+  return edges;
+}
+
+// The walk definition of a split graph, independent of the plan builder: the edges of `edges`
+// on some walk from src to the destination set that leaves no destination (destinations are
+// terminal), ascending; forward from src and backward from the destinations by fixpoint.
+std::vector<EdgeId> walk_members(const Graph& g, const std::vector<EdgeId>& edges, NodeId src,
+                                 const std::vector<NodeId>& dsts) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<std::uint8_t> is_dst(n, 0), fwd(n, 0), bwd(n, 0);
+  for (NodeId d : dsts) is_dst[static_cast<std::size_t>(d)] = bwd[static_cast<std::size_t>(d)] = 1;
+  fwd[static_cast<std::size_t>(src)] = 1;
+  std::vector<EdgeId> open;
+  for (EdgeId e : edges) {
+    if (is_dst[static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)])] == 0) open.push_back(e);
+  }
+  for (std::size_t round = 0; round < n; ++round) {
+    for (EdgeId e : open) {
+      const auto u = static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)]);
+      const auto v = static_cast<std::size_t>(g.edge_destinations()[static_cast<std::size_t>(e)]);
+      if (fwd[u] != 0) fwd[v] = 1;
+      if (bwd[v] != 0) bwd[u] = 1;
+    }
+  }
+  std::vector<EdgeId> out;
+  for (EdgeId e : open) {
+    if (fwd[static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)])] != 0 &&
+        bwd[static_cast<std::size_t>(g.edge_destinations()[static_cast<std::size_t>(e)])] != 0) {
+      out.push_back(e);
+    }
+  }
+  std::sort(out.begin(), out.end());
+  return out;
+}
+
+} // namespace
+
+TEST(Apportion, RoundRobinAndHighestAveragesValues) {
+  EXPECT_EQ(rr(7, 3), (std::vector<Amount>{3, 2, 2}));
+  EXPECT_EQ(rr(1, 3), (std::vector<Amount>{1, 0, 0}));
+  EXPECT_EQ(rr(0, 4), (std::vector<Amount>{0, 0, 0, 0}));
+  const Amount big = kDomainLimit - 1;
+  EXPECT_EQ(rr(big, 3), (std::vector<Amount>{big / 3, big / 3, big / 3}));
+  EXPECT_EQ(rr(big - 1, 3), (std::vector<Amount>{big / 3, big / 3, big / 3 - 1}));
+  EXPECT_EQ(ha(10, {3, 9, 9}), (std::vector<Amount>{1, 5, 4}));
+  EXPECT_EQ(ha(11, {3, 9, 9}), (std::vector<Amount>{1, 5, 5}));
+  EXPECT_EQ(ha(4, {1, 3, 3}), (std::vector<Amount>{0, 2, 2}));
+  EXPECT_EQ(ha(7, {1, 3, 3}), (std::vector<Amount>{1, 3, 3}));
+}
+
+// Highest averages with zero weights (pooled attribution divides by what each source holds, and a
+// source can hold nothing): a zero weight gets nothing and all-zero weights give nothing. The
+// worked examples: a member more than one unit from proportional, the local bounds of highest
+// averages and of round robin, and the sweep: every total up to 24 over 1 to 4 members with weights 0 to 4,
+// not all zero (19,400 cases), equals the sequential definition, and each member's rounding error
+// against its proportional share is below k units (k members), below 1 for equal weights.
+TEST(Apportion, HighestAveragesExamplesAndZeroWeights) {
+  EXPECT_EQ(ha(50, {100, 1, 1, 1}), (std::vector<Amount>{50, 0, 0, 0}));
+  std::vector<Amount> local(11, 1);
+  local[0] = 1000000;
+  std::vector<Amount> want(11, 0);
+  want[0] = 1000000;
+  EXPECT_EQ(ha(1000000, local), want);
+  EXPECT_EQ(rr(10, 3), (std::vector<Amount>{4, 3, 3}));
+  EXPECT_EQ(ha(3, {0, 2, 0, 1}), (std::vector<Amount>{0, 2, 0, 1}));
+  EXPECT_EQ(ha(5, {0, 0}), (std::vector<Amount>{0, 0}));
+  EXPECT_EQ(ha(0, {0, 0, 0}), (std::vector<Amount>{0, 0, 0}));
+  int cases = 0;
+  for (std::size_t k = 1; k <= 4; ++k) {
+    std::vector<Amount> w(k, 0);
+    for (;;) {
+      // The next weight vector (base 5 counter), all-zero skipped.
+      std::size_t i = 0;
+      while (i < k && w[i] == 4) w[i++] = 0;
+      if (i == k) break;
+      ++w[i];
+      Amount sum = 0;
+      for (Amount x : w) sum += x;
+      const bool equal = std::all_of(w.begin(), w.end(), [&](Amount x) { return x == w[0]; });
+      for (Amount total = 0; total <= 24; ++total) {
+        ++cases;
+        const auto got = ha(total, w);
+        ASSERT_EQ(got, ha_slow(total, w)) << total;
+        for (std::size_t j = 0; j < k; ++j) {
+          if (w[j] == 0) EXPECT_EQ(got[j], 0) << total;
+          // |got - total * w / sum| < bound, in integers: |got * sum - total * w| < bound * sum.
+          const Amount err = got[j] * sum - total * w[j];
+          const Amount bound = (equal ? 1 : static_cast<Amount>(k)) * sum;
+          EXPECT_LT(err < 0 ? -err : err, bound) << total << " member " << j;
+        }
+      }
+    }
+  }
+  EXPECT_EQ(cases, 19400);
+}
+
+// The callback form hands out the span form's shares (positive ones only, in index order) and
+// stops at the first share its callback refuses.
+TEST(Apportion, RoundRobinCallbackFormEqualsSpanFormAndStopsEarly) {
+  for (Amount total : {Amount {0}, Amount {1}, Amount {2}, Amount {7}, Amount {23}, kDomainLimit - 1}) {
+    for (std::size_t k : {std::size_t {1}, std::size_t {3}, std::size_t {4}, std::size_t {8}}) {
+      std::vector<Amount> span_out(k);
+      const std::size_t n = round_robin(total, span_out);
+      std::vector<Amount> cb_out(k);
+      std::vector<std::size_t> visited;
+      const std::size_t m = round_robin(total, k, [&](std::size_t i, Amount x) {
+        visited.push_back(i);
+        cb_out[i] = x;
+        return x > 0;
+      });
+      std::vector<std::size_t> leading(total < static_cast<Amount>(k) ? static_cast<std::size_t>(total) : k);
+      std::iota(leading.begin(), leading.end(), std::size_t {0});
+      EXPECT_EQ(n, leading.size()) << total << " over " << k;
+      EXPECT_EQ(m, n) << total << " over " << k;
+      EXPECT_EQ(visited, leading) << total << " over " << k;
+      EXPECT_EQ(cb_out, span_out) << total << " over " << k;
+    }
+  }
+  // 7 over 3 is {3, 2, 2}: refusing the share at index 1 returns 1 and visits nothing after it.
+  std::vector<std::size_t> seen;
+  const std::size_t stop = round_robin(7, 3, [&](std::size_t i, Amount x) {
+    seen.push_back(i);
+    return x > 2;
+  });
+  EXPECT_EQ(stop, 1u);
+  EXPECT_EQ(seen, (std::vector<std::size_t>{0, 1}));
+  EXPECT_EQ(round_robin(7, 3, [](std::size_t, Amount) { return false; }), 0u);
+}
+
+// The round-robin increments of a cumulative total X growing by v: RR(X + v) - RR(X) per
+// recipient. 2^64 = 3q + 1, so RR(2^64) = (q + 1, q, q) and RR(2^64 + 4) = (q + 2, q + 2, q + 1):
+// (1, 2, 1). A small X checks against the definition of round robin (total // k, one more for the
+// first total % k) on both totals; one recipient takes v; v = 0 gives zeros; no recipient,
+// nothing.
+TEST(Apportion, RoundRobinIncrementsOfACumulativeTotal) {
+  std::vector<Amount> out(3, -7);
+  round_robin_increments(Counter128 {1, 0}, 4, out);
+  EXPECT_EQ(out, (std::vector<Amount> {1, 2, 1}));
+  round_robin_increments(Counter128 {1, 0}, 0, out);
+  EXPECT_EQ(out, (std::vector<Amount> {0, 0, 0}));
+  for (Amount x = 0; x < 12; ++x) {
+    for (Amount v = 0; v < 8; ++v) {
+      std::vector<Amount> inc(4);
+      round_robin_increments(Counter128 {0, static_cast<std::uint64_t>(x)}, v, inc);
+      auto share = [](Amount total, Amount i) { return total / 4 + (i < total % 4 ? 1 : 0); };
+      for (Amount i = 0; i < 4; ++i) {
+        EXPECT_EQ(inc[static_cast<std::size_t>(i)], share(x + v, i) - share(x, i)) << x << " + " << v;
+      }
+    }
+  }
+  std::vector<Amount> one(1);
+  round_robin_increments(Counter128 {5, 9}, 11, one);
+  EXPECT_EQ(one, (std::vector<Amount> {11}));
+  round_robin_increments(Counter128 {5, 9}, 11, std::span<Amount> {});
+}
+
+TEST(Apportion, ClosedFormEqualsSequentialAndIsHouseMonotone) {
+  std::mt19937 rng(7);
+  int weighted = 0;  // allocations that differ from round robin: the weights mattered
+  for (int k = 1; k <= 20; ++k) {
+    for (int trial = 0; trial < 40; ++trial) {
+      std::vector<Amount> w(static_cast<std::size_t>(k));
+      for (auto& x : w) x = 1 + static_cast<Amount>(rng() % (trial < 20 ? 5 : 1000));
+      std::vector<Amount> prev(w.size(), 0);
+      for (Amount total = 0; total <= 60; ++total) {
+        const auto a = ha(total, w);
+        ASSERT_EQ(a, ha_slow(total, w)) << "k " << k << " total " << total;
+        for (std::size_t i = 0; i < a.size(); ++i) ASSERT_GE(a[i], prev[i]);
+        prev = a;
+        weighted += a != rr(total, static_cast<std::size_t>(k)) ? 1 : 0;
+      }
+    }
+  }
+  // Equal weights reduce to round robin.
+  for (std::size_t k = 1; k <= 9; ++k) {
+    for (Amount total = 0; total <= 40; ++total) EXPECT_EQ(ha(total, std::vector<Amount>(k, 7)), rr(total, k));
+  }
+  EXPECT_GT(weighted, 20000);
+}
+
+TEST(Apportion, HighestAveragesNearTheDomainBound) {
+  const std::vector<Amount> w = {(Amount {1} << 60) + 1, (Amount {1} << 60) - 1, 7};
+  const Amount total = kDomainLimit - 2;
+  const auto a = ha(total, w);
+  EXPECT_EQ(std::accumulate(a.begin(), a.end(), Amount {0}), total);
+  // Boundary property: every selected quotient w_i / a_i outranks every unselected one
+  // w_j / (a_j + 1) (ties by the lower index).
+  for (std::size_t i = 0; i < w.size(); ++i) {
+    if (a[i] == 0) continue;
+    for (std::size_t j = 0; j < w.size(); ++j) {
+      const Int128 left = static_cast<Int128>(w[i]) * (a[j] + 1);
+      const Int128 right = static_cast<Int128>(w[j]) * a[i];
+      EXPECT_TRUE(left > right || (left == right && i <= j)) << i << " " << j;
+    }
+  }
+  // Many members at large totals (the heap path) against the boundary property.
+  std::vector<Amount> wide(40);
+  for (std::size_t i = 0; i < wide.size(); ++i) wide[i] = (Amount {1} << 55) + static_cast<Amount>(i * 7919);
+  const auto b = ha((Amount {1} << 61) + 12345, wide);
+  EXPECT_EQ(std::accumulate(b.begin(), b.end(), Amount {0}), (Amount {1} << 61) + 12345);
+  for (std::size_t i = 0; i < wide.size(); ++i) {
+    for (std::size_t j = 0; j < wide.size(); ++j) {
+      if (b[i] == 0) continue;
+      const Int128 left = static_cast<Int128>(wide[i]) * (b[j] + 1);
+      const Int128 right = static_cast<Int128>(wide[j]) * b[i];
+      EXPECT_TRUE(left > right || (left == right && i <= j));
+    }
+  }
+}
+
+// The lower-quota division floor(n / d) on both sides of 2^64: dividends with a zero high word
+// (the 64-bit path) and with a nonzero one (the 128-bit path), divisors near 1, near the units
+// domain bound 2^62 (the call sites divide by a weight sum below it) and near 2^64, against the
+// 128-bit quotient of the test integer (test_int128.hpp) and the defining bounds q * d <= n < (q + 1) * d.
+TEST(Apportion, QuotaDivisionOnBothSidesOfTheSixtyFourBitBoundary) {
+  using u64 = std::uint64_t;
+  using u128 = UInt128;
+  constexpr u64 kMax = std::numeric_limits<u64>::max();
+  const auto domain = static_cast<u64>(kDomainLimit);
+  int narrow = 0, wide = 0;
+  auto check = [&](u64 hi, u64 lo, u64 d) {
+    ASSERT_GT(d, 0u);
+    ASSERT_LT(hi, d);  // the quotient fits 64 bits
+    const u128 n = (static_cast<u128>(hi) << 64) | lo;
+    const u64 q = div_u128(U128 {hi, lo}, d);
+    ASSERT_EQ(q, static_cast<u64>(n / d)) << hi << ":" << lo << " / " << d;
+    const u128 qd = static_cast<u128>(q) * d;
+    ASSERT_TRUE(qd <= n && n - qd < d) << hi << ":" << lo << " / " << d;
+    ++(hi == 0 ? narrow : wide);
+  };
+  const std::vector<u64> divisors = {1,          2,          3,          7,          domain - 2, domain - 1,
+                                     domain,     domain + 1, kMax / 2,   kMax - 1,   kMax};
+  const std::vector<u64> lows = {0, 1, 2, 3, domain - 1, domain, u64 {1} << 63, kMax - 1, kMax};
+  for (u64 d : divisors) {
+    for (u64 lo : lows) {
+      check(0, lo, d);
+      for (u64 hi : {u64 {1}, u64 {2}, d / 2, d - 2, d - 1}) {
+        if (hi > 0 && hi < d) check(hi, lo, d);
+      }
+    }
+    // The dividends next to a multiple of d on both sides of 2^64.
+    for (u64 q : {u64 {1}, u64 {2}, kMax / d, kMax - 1, kMax}) {
+      const u128 at = static_cast<u128>(q) * d;
+      for (u128 n : {at - 1, at, at + 1}) {
+        if ((n >> 64) < d) check(static_cast<u64>(n >> 64), static_cast<u64>(n), d);
+      }
+    }
+  }
+  // The call-site shape: total * w / W with total and the weights below 2^62, W the weight sum.
+  for (u64 total : {u64 {1}, u64 {50}, domain - 2, domain - 1}) {
+    for (u64 w : {u64 {1}, u64 {3}, domain / 3, domain - 1}) {
+      for (u64 sum : {w, w + 1, domain - 1}) {  // every sum at least w
+        const U128 n = mul_u64(total, w);
+        check(n.hi, n.lo, sum);
+      }
+    }
+  }
+  std::mt19937_64 rng(20261006);
+  for (int i = 0; i < 20000; ++i) {
+    const u64 d = i % 3 == 0 ? 1 + rng() % 4096 : (i % 3 == 1 ? 1 + rng() % (domain - 1) : 1 + rng() % kMax);
+    const u64 hi = i % 2 == 0 ? 0 : rng() % d;
+    check(hi, rng(), d);
+  }
+  EXPECT_GT(narrow, 10000);
+  EXPECT_GT(wide, 10000);
+}
+
+// The exact 64 x 64 -> 128-bit product: the built-in path where the compiler has a 128-bit
+// integer, the 32-bit-limb path elsewhere (MSVC), both against the test integer (test_int128.hpp,
+// independent of the library) at the word boundaries and on random operands.
+TEST(Apportion, MulU64IsTheExactProduct) {
+  using u64 = std::uint64_t;
+  constexpr u64 kMax = std::numeric_limits<u64>::max();
+  const std::vector<u64> edges = {0, 1, 2, 3, 0xffffffffULL, 0x100000000ULL, 0x100000001ULL, (u64 {1} << 62) - 1,
+                                  u64 {1} << 62, u64 {1} << 63, kMax - 1, kMax};
+  auto check = [](u64 a, u64 b) {
+    const U128 p = mul_u64(a, b);
+    const UInt128 want = static_cast<UInt128>(a) * static_cast<UInt128>(b);
+    ASSERT_EQ(p.hi, static_cast<u64>(want >> 64)) << a << " * " << b;
+    ASSERT_EQ(p.lo, static_cast<u64>(want)) << a << " * " << b;
+  };
+  for (u64 a : edges) {
+    for (u64 b : edges) check(a, b);
+  }
+  std::mt19937_64 rng(1729);
+  for (int i = 0; i < 20000; ++i) {
+    const int shift_a = static_cast<int>(rng() % 64), shift_b = static_cast<int>(rng() % 64);
+    check(rng() >> shift_a, rng() >> shift_b);
+  }
+}
+
+TEST(Apportion, HamiltonHoleControl) {
+  // Weights [1, 3, 3] on members with view [0, 3, 3]: highest averages is feasible on 0..4
+  // (T_max = 4 exactly); Hamilton's rule has the hole at 3 ({0, 1, 2, 4}).
+  const std::vector<Amount> w = {1, 3, 3};
+  const std::vector<Amount> view = {0, 3, 3};
+  auto fits = [&](const std::vector<Amount>& a) {
+    for (std::size_t i = 0; i < a.size(); ++i) {
+      if (a[i] > view[i]) return false;
+    }
+    return true;
+  };
+  std::vector<Amount> ha_ok, ham_ok;
+  for (Amount t = 0; t < 8; ++t) {
+    if (fits(ha(t, w))) ha_ok.push_back(t);
+    if (fits(hamilton(t, w))) ham_ok.push_back(t);
+  }
+  EXPECT_EQ(ha_ok, (std::vector<Amount>{0, 1, 2, 3, 4}));
+  EXPECT_EQ(ham_ok, (std::vector<Amount>{0, 1, 2, 4}));
+  EXPECT_EQ(hamilton(3, w), (std::vector<Amount>{1, 1, 1}));
+  EXPECT_EQ(hamilton(4, w), (std::vector<Amount>{0, 2, 2}));
+  // The kernel's T_max on the same plan (parallel links 1, 3, 3 with Capacity weights, link 0
+  // held by a third party): exactly 4, allocation [0, 2, 2].
+  auto g = make_graph(2, {{0, 1, 1, 1}, {0, 1, 3, 1}, {0, 1, 3, 1}});
+  const auto plan = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), caps(g), WeightBasis::Capacity);
+  const auto view_dense = to_ids(g, std::vector<Amount> {0, 3, 3});
+  const auto tm = max_lossless_offer(plan, on_members(plan, view_dense));
+  EXPECT_EQ(tm.value, 4);
+  std::vector<Amount> at4(plan.forwarding_edges.size());
+  ASSERT_TRUE(allocate(plan, 4, at4));
+  EXPECT_EQ(dense_input(g, plan, at4), (std::vector<Amount>{0, 2, 2}));
+  std::vector<Amount> at3(plan.forwarding_edges.size());
+  ASSERT_TRUE(allocate(plan, 3, at3));
+  EXPECT_EQ(dense_input(g, plan, at3), (std::vector<Amount>{0, 2, 1}));
+}
+
+// The kernel entries keep their complete check: with several defects at once, one error, the
+// first in the order allocation, admission, then the combination Lossy with Optimized; at
+// check_kernel and at the two entries that call it. Weighted takes no tie score (its weights come
+// from a WeightSource), so Headroom is no kernel defect.
+TEST(Plans, KernelEntriesReportTheFirstDefectInOrder) {
+  const auto bad_allocation = static_cast<RouteAllocation>(99);
+  const auto bad_admission = static_cast<Admission>(98);
+  struct Case {
+    RouteAllocation k;
+    Admission a;
+    std::string error;
+  };
+  const std::vector<Case> cases = {
+      {bad_allocation, bad_admission, "allocation: 99 is not a value of RouteAllocation"},
+      {bad_allocation, Admission::Lossy, "allocation: 99 is not a value of RouteAllocation"},
+      {RouteAllocation::Optimized, bad_admission, "admission: 98 is not a value of Admission"},
+      {RouteAllocation::Optimized, Admission::Lossy, kLossyKernelError},
+      {RouteAllocation::Weighted, Admission::Lossy, ""},
+      {RouteAllocation::Weighted, Admission::Lossless, ""},
+  };
+  const auto g = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  const auto support = all_edges(g);
+  const std::vector<NodeId> dsts = {2};
+  const PriorityValues values {&g, RouteTieBreak::FewerHops, {}};
+  for (const auto& c : cases) {
+    EXPECT_EQ(error_of([&] { check_kernel(c.k, c.a); }), c.error);
+    EXPECT_EQ(error_of([&] { (void)prepare_route(g, c.k, c.a, WeightSource {}, 0, dsts, *support); }), c.error);
+    const RouteChoice choice {};
+    EXPECT_EQ(error_of([&] {
+                (void)prepare_shortest_paths(g, support, 0, dsts, choice, PriorityReader::of(values), c.k, c.a, WeightSource {});
+              }),
+              c.error);
+  }
+}
+
+// check_config's part of the kernel check: the one combination only, never a domain, which the
+// configuration has checked under its own field names just before.
+TEST(Plans, TheCombinationRuleAloneChecksNoDomain) {
+  const auto bad_allocation = static_cast<RouteAllocation>(99);
+  const auto bad_admission = static_cast<Admission>(98);
+  EXPECT_EQ(error_of([&] { check_kernel_combination(RouteAllocation::Optimized, Admission::Lossy); }), kLossyKernelError);
+  EXPECT_EQ(error_of([&] { check_kernel_combination(bad_allocation, bad_admission); }), "");
+  for (auto k : {RouteAllocation::Optimized, RouteAllocation::Weighted, RouteAllocation::Equal}) {
+    for (auto a : {Admission::Lossless, Admission::Lossy}) {
+      const bool rejected = a == Admission::Lossy && k == RouteAllocation::Optimized;
+      EXPECT_EQ(error_of([&] { check_kernel_combination(k, a); }).empty(), !rejected);
+      EXPECT_EQ(error_of([&] { check_kernel_combination(k, a); }), error_of([&] { check_kernel(k, a); }));
+    }
+  }
+}
+
+TEST(Plans, MembershipByKernelAndPriority) {
+  // Parallel links of capacities [4, 4, 0] with residual [0, 4, 0] on the creation view.
+  auto g = make_graph(2, {{0, 1, 4, 1}, {0, 1, 4, 1}, {0, 1, 0, 1}});
+  const auto view = to_ids(g, std::vector<Amount> {0, 4, 0});
+  const auto inv = id_of_input(g);
+  auto mf = plan_of(g, RouteAllocation::Optimized, 0, {1}, all_ids(g), view);
+  EXPECT_EQ(mf.forwarding_edges, (std::vector<EdgeId>{0, 1, 2}));  // Optimized: the view decides
+  // Equal: every route edge, the zero-capacity one included (it takes its round-robin
+  // share and carries nothing).
+  auto eb = plan_of(g, RouteAllocation::Equal, 0, {1}, all_ids(g), view);
+  EXPECT_EQ(eb.forwarding_edges, (std::vector<EdgeId>{0, 1, 2}));
+  // Weighted: the edges of positive weight (residual weights on the creation view, capacity
+  // weights on the capacities).
+  auto wr = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), view, WeightBasis::ResidualSnapshot);
+  EXPECT_EQ(wr.forwarding_edges, (std::vector<EdgeId>{inv[1]}));
+  EXPECT_EQ(wr.weights, (std::vector<Amount>{4}));
+  auto wc = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), view, WeightBasis::Capacity);
+  EXPECT_EQ(wc.forwarding_edges, (std::vector<EdgeId>{inv[0], inv[1]}));
+  EXPECT_EQ(wc.weights, (std::vector<Amount>{4, 4}));
+  // Lossy keeps its kernel's membership and weights.
+  for (const auto& [kernel, prio, lossless] : {std::tuple {RouteAllocation::Equal, WeightBasis::ResidualSnapshot, &eb},
+                                               std::tuple {RouteAllocation::Weighted, WeightBasis::ResidualSnapshot, &wr},
+                                               std::tuple {RouteAllocation::Weighted, WeightBasis::Capacity, &wc}}) {
+    const auto lossy = plan_of(g, kernel, 0, {1}, all_ids(g), view, prio, Admission::Lossy);
+    EXPECT_EQ(lossy.forwarding_edges, lossless->forwarding_edges) << static_cast<int>(kernel) << " " << static_cast<int>(prio);
+    EXPECT_EQ(lossy.weights, lossless->weights) << static_cast<int>(kernel) << " " << static_cast<int>(prio);
+  }
+}
+
+TEST(Plans, SplitGraphPruning) {
+  // A zero-capacity tail. 0->1, 0->2, 1->3, 2->4 (cap 0), 4->3. Equal keeps the branch
+  // through 2: its share is stranded on 2->4, so T = 2 puts a unit there and T_max is 1.
+  // Weighted gives 2->4 weight 0: node 2 is left without a member, so the branch is pruned and
+  // the whole total takes the other branch.
+  auto g = make_graph(5, {{0, 1, 2, 1}, {0, 2, 2, 1}, {1, 3, 2, 1}, {2, 4, 0, 1}, {4, 3, 2, 1}});
+  const auto inv = id_of_input(g);
+  auto eb = plan_of(g, RouteAllocation::Equal, 0, {3}, all_ids(g), caps(g));
+  EXPECT_EQ(eb.forwarding_edges, all_ids(g));
+  std::vector<Amount> a(eb.forwarding_edges.size());
+  ASSERT_TRUE(allocate(eb, 2, a));
+  EXPECT_EQ(dense_input(g, eb, a), (std::vector<Amount>{1, 1, 1, 1, 1}));
+  EXPECT_EQ(max_lossless_offer(eb, caps(g)).value, 1);  // every edge is a member: the capacities are member-aligned
+  auto w = plan_of(g, RouteAllocation::Weighted, 0, {3}, all_ids(g), caps(g), WeightBasis::Capacity);
+  std::vector<EdgeId> want = {inv[0], inv[2]};
+  std::sort(want.begin(), want.end());
+  EXPECT_EQ(w.forwarding_edges, want);
+  std::vector<Amount> b(w.forwarding_edges.size());
+  ASSERT_TRUE(allocate(w, 2, b));
+  EXPECT_EQ(dense_input(g, w, b), (std::vector<Amount>{2, 0, 2, 0, 0}));
+  // Destinations are terminal; a destination set keeps both destinations.
+  auto g2 = make_graph(4, {{0, 1, 3, 1}, {1, 2, 3, 1}, {0, 2, 3, 2}, {2, 3, 3, 1}});
+  auto any = plan_of(g2, RouteAllocation::Equal, 0, {1, 2}, all_ids(g2), caps(g2));
+  const auto inv2 = id_of_input(g2);
+  std::vector<EdgeId> want2 = {inv2[0], inv2[2]};  // 1->2 leaves destination 1; 2->3 leaves 2
+  std::sort(want2.begin(), want2.end());
+  EXPECT_EQ(any.forwarding_edges, want2);
+  EXPECT_EQ(cost_of(g2, any), 1);
+  // An empty split graph (a route that reaches no destination): route cost unreachable, T_max 0.
+  auto none = plan_of(g, RouteAllocation::Equal, 0, {3}, std::vector<EdgeId> {inv[1], inv[3]}, caps(g));
+  EXPECT_TRUE(none.forwarding_edges.empty());
+  EXPECT_EQ(cost_of(g, none), kUnreachable);
+  EXPECT_EQ(max_lossless_offer(none, {}).value, 0);
+}
+
+TEST(Plans, SplitGraphEqualsTheWalkDefinition) {
+  // On random DAGs (parallel edges, zero capacities, statically excluded edges and nodes, edges
+  // into the source and out of a destination, one or two destinations) the route of a supplied DAG is,
+  // by definition, its allowed edges, whatever their capacity, on some walk from the source to a
+  // destination that enters no destination before its end, and the split graph is the route for
+  // Optimized and Equal, and for Weighted (capacity weights) the same definition over the
+  // allowed edges of at least 1 unit: the route and the members equal an independent
+  // reachability computation, the route cost equals an independent shortest walk over the
+  // allowed edges, the topological structure orders every member's tail before its head, and an
+  // allocation conserves its total and equals the per-node reference (each node's inflow split
+  // over its members by the kernel's rule). prepare_route on the DAG of the allowed edges gives
+  // the same plan as restrict_prepared_route of the route's plan under the Eligibility (a replay's
+  // plan), for every kernel, but for the route field. On the route itself (no Eligibility)
+  // prepare_route's Optimized and Equal members are the walk definition over all its edges.
+  std::mt19937 rng(2024);
+  int compared = 0;
+  int masked_differs = 0;    // trials where the Eligibility changes the route
+  int weighted_differs = 0;  // trials where Weighted's members omit a zero-capacity route edge
+  int splitting = 0;        // such plans with a split, and two destinations or a source other than 0
+  for (int trial = 0; trial < 2000; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 8);
+    auto g = make_graph(n, random_dag_edges(
+                               rng, n, 2 * n + static_cast<int>(rng() % 10),
+                               [&] { return (rng() % 6) == 0 ? Amount {0} : 1 + static_cast<Amount>(rng() % 9); },
+                               [&] { return 1 + static_cast<Cost>(rng() % 4); }));
+    std::vector<EdgeId> in_route;
+    for (EdgeId e : all_ids(g)) {
+      if ((rng() % 5) != 0) in_route.push_back(e);
+    }
+    const auto route_dag = PredecessorDAGBuilder::of_edges(g, in_route);
+    const NodeId src = static_cast<NodeId>(rng() % static_cast<std::uint32_t>(n));
+    std::vector<NodeId> dsts;
+    for (int k = 0; k < 1 + static_cast<int>(rng() % 2); ++k) {
+      const NodeId d = static_cast<NodeId>(rng() % static_cast<std::uint32_t>(n));
+      if (d != src && std::find(dsts.begin(), dsts.end(), d) == dsts.end()) dsts.push_back(d);
+    }
+    if (dsts.empty()) continue;
+    std::sort(dsts.begin(), dsts.end());
+    std::optional<Eligibility> elig;
+    if ((rng() % 3) == 0) {
+      std::vector<NodeId> xn;
+      std::vector<EdgeId> xe;
+      if ((rng() % 2) == 0) xn.push_back(static_cast<NodeId>(rng() % static_cast<std::uint32_t>(n)));
+      for (EdgeId e : all_ids(g)) {
+        if ((rng() % 7) == 0) xe.push_back(e);
+      }
+      elig = g.eligibility(xn, xe);
+    }
+    const auto capacity = g.edge_capacity_units();
+    const auto edge_sources = g.edge_sources();
+    const auto edge_destinations = g.edge_destinations();
+    const auto cost = g.edge_costs();
+    std::vector<EdgeId> usable;    // allowed
+    std::vector<EdgeId> positive;  // allowed, at least 1 unit
+    for (EdgeId e : PredecessorDAGBuilder::ascending(route_dag)) {
+      if (elig && !elig->allows_edge(e)) continue;
+      usable.push_back(e);
+      if (capacity[static_cast<std::size_t>(e)] >= 1) positive.push_back(e);
+    }
+    // The definition over the usable edges; the shortest walk by Bellman-Ford over those that
+    // leave no destination.
+    std::vector<std::uint8_t> is_dst(static_cast<std::size_t>(n), 0);
+    for (NodeId d : dsts) is_dst[static_cast<std::size_t>(d)] = 1;
+    const auto want = walk_members(g, usable, src, dsts);
+    const auto weighted_want = walk_members(g, positive, src, dsts);
+    weighted_differs += weighted_want != want ? 1 : 0;
+    std::vector<Cost> dist(static_cast<std::size_t>(n), kUnreachable);
+    dist[static_cast<std::size_t>(src)] = 0;
+    for (int round = 0; round < n; ++round) {
+      for (EdgeId e : usable) {
+        const auto u = static_cast<std::size_t>(edge_sources[static_cast<std::size_t>(e)]);
+        const auto v = static_cast<std::size_t>(edge_destinations[static_cast<std::size_t>(e)]);
+        if (is_dst[u] == 0 && dist[u] != kUnreachable) dist[v] = std::min(dist[v], dist[u] + cost[static_cast<std::size_t>(e)]);
+      }
+    }
+    Cost want_cost = kUnreachable;
+    if (!want.empty()) {
+      for (NodeId d : dsts) want_cost = std::min(want_cost, dist[static_cast<std::size_t>(d)]);
+    }
+    const auto usable_dag = PredecessorDAGBuilder::of_edges(g, usable);
+    const auto route_edges = PredecessorDAGBuilder::ascending(route_dag);
+    const auto unmasked_want = walk_members(g, std::vector<EdgeId>(route_edges.begin(), route_edges.end()), src, dsts);
+    for (const auto kernel : {RouteAllocation::Optimized, RouteAllocation::Equal}) {
+      EXPECT_EQ(prepare_route(g, kernel, Admission::Lossless, WeightSource {}, src, dsts, route_dag).forwarding_edges, unmasked_want)
+          << "trial " << trial;
+    }
+    masked_differs += unmasked_want != want ? 1 : 0;
+    for (const auto kernel : {RouteAllocation::Equal, RouteAllocation::Weighted, RouteAllocation::Optimized}) {
+      const auto unmasked = prepare_route(g, kernel, Admission::Lossless, WeightSource {}, src, dsts, route_dag);
+      const auto restricted = restrict_prepared_route(g, unmasked, std::vector<NodeId> {src}, dsts, elig ? &*elig : nullptr);
+      ASSERT_EQ(restricted.forwarding_edges, kernel == RouteAllocation::Weighted ? weighted_want : want) << "trial " << trial;
+      EXPECT_EQ(restricted.support_edges, unmasked.support_edges);
+      EXPECT_EQ(restricted.weights.size(), kernel == RouteAllocation::Weighted ? restricted.forwarding_edges.size() : 0U);
+      const Cost got_cost = min_route_cost(g, PredecessorDAGBuilder::of_edges(g, prune(g, route_dag, src, dsts, elig ? &*elig : nullptr)), src, dsts);
+      EXPECT_EQ(got_cost, want_cost) << "trial " << trial;
+      EXPECT_EQ(prune(g, usable_dag, src, dsts), want);
+      Cost plan_cost = -1;
+      const auto on_usable = prepare_route(g, kernel, Admission::Lossless, WeightSource {}, src, dsts, usable_dag, &plan_cost);
+      // The same plan but for its route, which is the whole allowed DAG (plan_differences,
+      // test_utils.hpp).
+      EXPECT_EQ(plan_differences(on_usable, restricted, false), std::vector<std::string> {}) << "trial " << trial;
+      // The plan built on the usable edges reports the same shortest-walk cost, and so does the
+      // cost pass alone.
+      EXPECT_EQ(plan_cost, want_cost) << "trial " << trial;
+      EXPECT_EQ(min_route_cost(g, usable_dag, src, dsts), want_cost) << "trial " << trial;
+      if (restricted.forwarding_edges.empty()) continue;
+      // Topology: the source first, every member's tail before its head, members of a node
+      // consecutive.
+      EXPECT_EQ(restricted.topological_order.front(), src);
+      for (std::size_t p = 0; p < restricted.topological_order.size(); ++p) {
+        for (auto k = restricted.outgoing_begin[p]; k < restricted.outgoing_end[p]; ++k) {
+          EXPECT_EQ(edge_sources[static_cast<std::size_t>(restricted.forwarding_edges[static_cast<std::size_t>(k)])], restricted.topological_order[p]);
+          EXPECT_GT(restricted.edge_destination_positions[static_cast<std::size_t>(k)], static_cast<std::int32_t>(p));
+        }
+      }
+      // Conservation: what enters the destinations is the total; and the per-node reference (node
+      // ids are a topological order; the members in ascending EdgeId, Weighted's weights the
+      // capacities). Optimized places by the flow core, not by alloc(T).
+      if (kernel == RouteAllocation::Optimized) continue;
+      std::vector<std::pair<NodeId, NodeId>> arcs;
+      std::vector<Amount> weights;
+      for (EdgeId e : restricted.forwarding_edges) {
+        arcs.emplace_back(edge_sources[static_cast<std::size_t>(e)], edge_destinations[static_cast<std::size_t>(e)]);
+        weights.push_back(kernel == RouteAllocation::Weighted ? capacity[static_cast<std::size_t>(e)] : 1);
+      }
+      std::vector<Amount> a(restricted.forwarding_edges.size());
+      for (Amount t : {Amount {1}, Amount {7}, Amount {50}}) {
+        ASSERT_TRUE(allocate(restricted, t, a));
+        Amount delivered = 0;
+        for (std::size_t m = 0; m < a.size(); ++m) {
+          if (is_dst[static_cast<std::size_t>(edge_destinations[static_cast<std::size_t>(restricted.forwarding_edges[m])])] != 0) {
+            delivered += a[m];
+          }
+        }
+        EXPECT_EQ(delivered, t) << "trial " << trial;
+        EXPECT_EQ(a, per_node_reference(n, arcs, weights, t, src)) << "trial " << trial << " T " << t;
+      }
+      // What the single-destination tests below do not reach: a split at some node, with two
+      // destinations or a source other than node 0.
+      bool splits = false;
+      for (std::size_t p = 0; p < restricted.topological_order.size(); ++p) {
+        splits = splits || (restricted.is_destination[p] == 0 && restricted.outgoing_end[p] - restricted.outgoing_begin[p] >= 2);
+      }
+      splitting += splits && (dsts.size() > 1 || src != 0) ? 1 : 0;
+      ++compared;
+    }
+  }
+  EXPECT_GT(compared, 1000);
+  EXPECT_GT(masked_differs, 100);
+  EXPECT_GT(weighted_differs, 100);
+  EXPECT_GT(splitting, 300);
+}
+
+TEST(Allocation, SplitAndReconvergeMatchesThePerNodeReferenceAtEveryValue) {
+  // House monotonicity of the apportionment on a DAG: capacities 20 x weights, baseline view.
+  const std::vector<std::pair<NodeId, NodeId>> dag = {{0, 1}, {0, 2}, {1, 3}, {1, 4}, {2, 3}, {2, 4}, {3, 5}, {4, 5}};
+  const std::vector<Amount> w = {2, 7, 1, 4, 3, 2, 1, 1};
+  const std::vector<Amount> view_in = {8, 20, 4, 9, 10, 10, 15, 15};
+  std::vector<InEdge> edges;
+  for (std::size_t i = 0; i < dag.size(); ++i) edges.push_back({dag[i].first, dag[i].second, 20 * w[i], 1});
+  auto g = make_graph(6, edges);
+  const auto view = to_ids(g, view_in);
+  for (auto kernel : {RouteAllocation::Weighted, RouteAllocation::Equal}) {
+    // The per-node reference on input positions (node ids are topological); Equal is the
+    // sequential definition with equal weights (ties to the lower index).
+    const auto weights = kernel == RouteAllocation::Equal ? std::vector<Amount>(w.size(), 1) : w;
+    auto ref = [&](Amount total) { return per_node_reference(6, dag, weights, total); };
+    Amount brute = 0;
+    for (Amount t = 0; t <= 100; ++t) {
+      const auto a = ref(t);
+      bool ok = true;
+      for (std::size_t i = 0; i < a.size(); ++i) ok = ok && a[i] <= view_in[i];
+      if (ok) brute = t;
+    }
+    const auto plan = plan_of(g, kernel, 0, {5}, all_ids(g), caps(g), WeightBasis::Capacity);
+    const auto vm = on_members(plan, view);
+    std::vector<Amount> own(plan.forwarding_edges.size(), 0);
+    Amount total = 0;
+    int steps = 0;
+    while (true) {
+      const auto step = lossless_step(plan, total, vm, own, 1);
+      if (step.admitted == total) break;
+      ++steps;
+      for (std::size_t m = 0; m < own.size(); ++m) ASSERT_GE(step.edge_flows[m], own[m]);  // member-monotone
+      EXPECT_EQ(dense_input(g, plan, step.edge_flows), ref(step.admitted));
+      total = step.admitted;
+      own = step.edge_flows;
+    }
+    EXPECT_EQ(total, brute);
+    EXPECT_EQ(max_lossless_offer(plan, vm).value, brute);
+    const auto one = first_step(plan, view, brute);
+    EXPECT_EQ(one.edge_flows, own);  // one call of T_max equals the calls of 1
+    EXPECT_GT(steps, 5);
+  }
+}
+
+TEST(Allocation, EqualBalancedOnePlusTwoEqualsThree) {
+  // Equal on a DAG that splits three ways at the source and reconverges at node 4.
+  const std::vector<std::pair<NodeId, NodeId>> recon = {{0, 1}, {0, 2}, {0, 3}, {1, 4}, {2, 4},
+                                                        {3, 4}, {4, 5}, {4, 6}, {5, 7}, {6, 7}};
+  std::vector<InEdge> edges;
+  for (auto [u, v] : recon) edges.push_back({u, v, 100, 1});
+  auto g = make_graph(8, edges);
+  const auto plan = plan_of(g, RouteAllocation::Equal, 0, {7}, all_ids(g), caps(g));
+  const auto vm = on_members(plan, caps(g));
+  std::vector<Amount> own(plan.forwarding_edges.size(), 0);
+  auto s1 = lossless_step(plan, 0, vm, own, 1);
+  EXPECT_EQ(dense_input(g, plan, s1.edge_flows), (std::vector<Amount>{1, 0, 0, 1, 0, 0, 1, 0, 1, 0}));
+  auto s2 = lossless_step(plan, s1.admitted, vm, s1.edge_flows, 2);
+  EXPECT_EQ(dense_input(g, plan, s2.edge_flows), (std::vector<Amount>{1, 1, 1, 1, 1, 1, 2, 1, 2, 1}));
+  EXPECT_EQ(first_step(plan, caps(g), 3).edge_flows, s2.edge_flows);
+}
+
+TEST(Allocation, TMaxExactAgainstBruteForce) {
+  // Random DAGs from node 0 to node n - 1 (node ids topological). The reference is independent of
+  // the library: the members by the walk definition, alloc(T) node by node in id order, each
+  // node's inflow split over its members in ascending EdgeId by the sequential definition
+  // (capacities as Weighted's weights, equal weights for Equal), and T_max the last T
+  // whose allocation fits the view (the allocation is member-monotone, so the fitting T are a
+  // prefix). allocate() equals the reference at every T up to one past T_max, its limit answer
+  // agrees, and max_lossless_offer returns that T.
+  std::mt19937 rng(99);
+  int several = 0;  // plans whose T_max is at least 2 units
+  for (int trial = 0; trial < 400; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 5);
+    auto g = make_graph(n, random_dag_edges(
+                               rng, n, 2 * n + static_cast<int>(rng() % 6),
+                               [&] { return 1 + static_cast<Amount>(rng() % 9); }, [] { return Cost {1}; }));
+    std::vector<Amount> view(static_cast<std::size_t>(g.num_edges()));
+    for (std::size_t e = 0; e < view.size(); ++e) {
+      view[e] = static_cast<Amount>(rng() % static_cast<std::uint32_t>(g.edge_capacity_units()[e] + 1));
+    }
+    const auto kernel = (rng() % 2) == 0 ? RouteAllocation::Weighted : RouteAllocation::Equal;
+    const auto plan = plan_of(g, kernel, 0, {n - 1}, all_ids(g), caps(g), WeightBasis::Capacity);
+    ASSERT_EQ(plan.forwarding_edges, walk_members(g, all_ids(g), 0, {n - 1})) << "trial " << trial;
+    if (plan.forwarding_edges.empty()) continue;
+    // The members as arcs in ascending EdgeId, with their weights.
+    std::vector<std::pair<NodeId, NodeId>> arcs;
+    std::vector<Amount> weights;
+    for (EdgeId m : plan.forwarding_edges) {
+      const auto e = static_cast<std::size_t>(m);
+      arcs.emplace_back(g.edge_sources()[e], g.edge_destinations()[e]);
+      weights.push_back(kernel == RouteAllocation::Weighted ? g.edge_capacity_units()[e] : 1);
+    }
+    auto reference = [&](Amount total) { return per_node_reference(n, arcs, weights, total); };
+    const auto vm = on_members(plan, view);
+    const auto tm = max_lossless_offer(plan, vm);
+    EXPECT_LE(tm.probes, 62);
+    Amount brute = -1;
+    std::vector<Amount> a(plan.forwarding_edges.size()), limited(plan.forwarding_edges.size());
+    for (Amount t = 0; t <= 200; ++t) {
+      const auto want = reference(t);
+      bool fits = true;
+      for (std::size_t k = 0; k < want.size(); ++k) fits = fits && want[k] <= vm[k];
+      ASSERT_TRUE(allocate(plan, t, a)) << "trial " << trial << " T " << t;
+      ASSERT_EQ(a, want) << "trial " << trial << " T " << t;
+      ASSERT_EQ(allocate(plan, t, limited, vm), fits) << "trial " << trial << " T " << t;
+      if (!fits) break;
+      brute = t;
+    }
+    ASSERT_GE(brute, 0);
+    ASSERT_EQ(tm.value, brute) << "trial " << trial;
+    several += tm.value >= 2 ? 1 : 0;
+  }
+  EXPECT_GT(several, 60);
+}
+
+TEST(Allocation, TMaxSearchIsExactAndWithinTheProbeBudgetOnLargeRanges) {
+  // Capacities and views up to 2^58 units (search ranges near 2^62 at the source): the seeded
+  // search must return the same T as a plain bisection from 0 and probe at most 62 times, also
+  // when its floating-point estimate is far off (a member capped near zero deep in the DAG).
+  // First cross-check the quotient-rank reference against the unit-by-unit definition,
+  // including ties. The large trials then use that reference at each node.
+  for (Amount total = 0; total < 50; ++total) {
+    for (const std::vector<Amount>& weights : {std::vector<Amount> {1, 1, 1}, {1, 3, 7}, {9, 2, 9, 1}}) {
+      ASSERT_EQ(ha_by_rank(total, weights), ha_slow(total, weights));
+    }
+  }
+  std::mt19937_64 rng(1234);
+  int large = 0;  // T at least 2^40
+  int far = 0;    // T at most 2^-20 of the source side's capacity (the estimate far off)
+  for (int trial = 0; trial < 300; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 6);
+    auto g = make_graph(n, random_dag_edges(
+                               rng, n, 2 * n + static_cast<int>(rng() % 8),
+                               [&] { return 1 + static_cast<Amount>(rng() % (std::uint64_t {1} << 58)); },
+                               [] { return Cost {1}; }));
+    std::vector<Amount> view(static_cast<std::size_t>(g.num_edges()));
+    for (std::size_t e = 0; e < view.size(); ++e) {
+      const Amount c = g.edge_capacity_units()[e];
+      view[e] = (rng() % 4) == 0 ? static_cast<Amount>(rng() % 3) : static_cast<Amount>(rng() % static_cast<std::uint64_t>(c + 1));
+    }
+    const auto kernel = (rng() % 2) == 0 ? RouteAllocation::Weighted : RouteAllocation::Equal;
+    const auto plan = plan_of(g, kernel, 0, {n - 1}, all_ids(g), caps(g), WeightBasis::Capacity);
+    if (plan.forwarding_edges.empty()) continue;
+    const auto vm = on_members(plan, view);
+    const auto tm = max_lossless_offer(plan, vm);
+    EXPECT_LE(tm.probes, 62);
+    // Reference: each node splits by exact quotient rank, then plain bisection over feasible
+    // totals. No production allocation or search is used to compute an expected amount.
+    Amount hi = 0;
+    const auto root = static_cast<std::size_t>(plan.source_positions.front());
+    for (auto k = plan.outgoing_begin[root]; k < plan.outgoing_end[root]; ++k) hi += vm[static_cast<std::size_t>(k)];
+    const Amount source_side = hi;
+    ASSERT_EQ(plan.forwarding_edges, walk_members(g, all_ids(g), 0, {n - 1}));
+    std::vector<std::pair<NodeId, NodeId>> arcs;
+    std::vector<Amount> weights;
+    for (EdgeId edge : plan.forwarding_edges) {
+      const auto e = static_cast<std::size_t>(edge);
+      arcs.emplace_back(g.edge_sources()[e], g.edge_destinations()[e]);
+      weights.push_back(kernel == RouteAllocation::Weighted ? g.edge_capacity_units()[e] : 1);
+    }
+    Amount lo = 0;
+    while (lo < hi) {
+      const Amount mid = lo + (hi - lo + 1) / 2;
+      const auto a = per_node_reference(n, arcs, weights, mid, 0, true);
+      bool fits = true;
+      for (std::size_t j = 0; j < a.size(); ++j) fits = fits && a[j] <= vm[j];
+      if (fits) lo = mid; else hi = mid - 1;
+    }
+    ASSERT_EQ(tm.value, lo) << "trial " << trial;
+    // The Lossless step from T = 0 with a request beyond the maximum lands on the same T.
+    const std::vector<Amount> zero(plan.forwarding_edges.size(), 0);
+    const auto step = lossless_step(plan, 0, vm, zero, kDomainLimit - 1);
+    EXPECT_EQ(step.admitted, lo);
+    EXPECT_LE(step.probes, 62);
+    large += lo >= (Amount {1} << 40) ? 1 : 0;
+    far += source_side >= (Amount {1} << 40) && lo <= (source_side >> 20) ? 1 : 0;
+  }
+  EXPECT_GT(large, 10);
+  EXPECT_GT(far, 100);
+}
+
+TEST(WeightedKernel, CapacityVersusResidualMembershipAfterOccupancy) {
+  // Weighted membership by capacity versus a residual snapshot after occupancy: parallel links
+  // [4, 4], another owner holds 3 on link 0 (residual [1, 4]).
+  auto g = make_graph(2, {{0, 1, 4, 1}, {0, 1, 4, 1}});
+  auto run = [&](WeightBasis prio, std::vector<Amount> residual_in, Amount request) {
+    const auto w = to_ids(g, residual_in);
+    const auto plan = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), w, prio);
+    auto s = first_step(plan, w, request);
+    return std::make_pair(s.admitted, dense_input(g, plan, s.edge_flows));
+  };
+  EXPECT_EQ(run(WeightBasis::ResidualSnapshot, {1, 4}, 5), std::make_pair(Amount {5}, std::vector<Amount>{1, 4}));
+  EXPECT_EQ(run(WeightBasis::Capacity, {1, 4}, 5), std::make_pair(Amount {2}, std::vector<Amount>{1, 1}));
+  EXPECT_EQ(run(WeightBasis::ResidualSnapshot, {0, 4}, 5), std::make_pair(Amount {4}, std::vector<Amount>{0, 4}));
+  EXPECT_EQ(run(WeightBasis::Capacity, {0, 4}, 5), std::make_pair(Amount {0}, std::vector<Amount>{0, 0}));
+  // Frozen plans after the owner leaves: Capacity grows to 5 as [3, 2]; ResidualSnapshot stays at 4.
+  const auto held = to_ids(g, std::vector<Amount> {0, 4});
+  const auto free = to_ids(g, std::vector<Amount> {4, 4});
+  const auto pc = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), held, WeightBasis::Capacity);
+  auto c = lossless_step(pc, 0, on_members(pc, free), std::vector<Amount>(pc.forwarding_edges.size(), 0), 5);
+  EXPECT_EQ(dense_input(g, pc, c.edge_flows), (std::vector<Amount>{3, 2}));
+  const auto pr = plan_of(g, RouteAllocation::Weighted, 0, {1}, all_ids(g), held, WeightBasis::ResidualSnapshot);
+  auto first = first_step(pr, held, 5);
+  // After the release V = W + own on the one member is its capacity 4.
+  auto again = lossless_step(pr, first.admitted, on_members(pr, free), first.edge_flows, 5);
+  EXPECT_EQ(again.admitted, 4);  // the plan has one member; weights never renormalised
+}
+
+TEST(WeightedKernel, OnePlusFiveEqualsSix) {
+  // Additivity on a fixed plan (place(1) then place(5) equals place(6)): weights 2 and 6 at the
+  // source.
+  auto g = make_graph(3, {{0, 1, 2, 1}, {0, 2, 6, 1}, {1, 2, 9, 1}});
+  const auto plan = plan_of(g, RouteAllocation::Weighted, 0, {2}, all_ids(g), caps(g), WeightBasis::Capacity);
+  const auto vm = on_members(plan, caps(g));
+  std::vector<Amount> zero(plan.forwarding_edges.size(), 0);
+  auto a = lossless_step(plan, 0, vm, zero, 1);
+  auto b = lossless_step(plan, a.admitted, vm, a.edge_flows, 5);
+  auto c = lossless_step(plan, 0, vm, zero, 6);
+  // By hand, D'Hondt over the source weights [2, 6] (each unit to the larger w / (a + 1), ties to
+  // the lower index): the first unit to 0 -> 2; 6 units give [1, 5] (the third unit is the tie
+  // 2 / 1 = 6 / 3), and node 1 passes its unit on over 1 -> 2. Every amount fits its capacity,
+  // so all 6 are placed.
+  EXPECT_EQ(dense_input(g, plan, a.edge_flows), (std::vector<Amount>{0, 1, 0}));
+  EXPECT_EQ(c.admitted, 6);
+  EXPECT_EQ(dense_input(g, plan, c.edge_flows), (std::vector<Amount>{1, 5, 1}));
+  EXPECT_EQ(b.admitted, c.admitted);
+  EXPECT_EQ(b.edge_flows, c.edge_flows);
+}
+
+TEST(LossyKernel, DiamondDropsAndInfiniteInjection) {
+  // A Lossy diamond: source links 10/10, tails 1/10.
+  auto g = make_graph(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 1, 1}, {2, 3, 10, 1}});
+  for (auto kernel : {RouteAllocation::Equal, RouteAllocation::Weighted}) {
+    const auto plan = plan_of(g, kernel, 0, {3}, all_ids(g), caps(g), WeightBasis::ResidualSnapshot, Admission::Lossy);
+    auto w = on_members(plan, caps(g));
+    auto s = lossy_step(plan, 10, w);
+    EXPECT_EQ(s.offered, 10);
+    EXPECT_EQ(s.network_entered, 10);
+    EXPECT_EQ(s.delivered, 6);
+    EXPECT_EQ(dense_input(g, plan, s.edge_flows), (std::vector<Amount>{5, 5, 1, 5}));
+    EXPECT_EQ(dense_input(g, plan, s.edge_drops), (std::vector<Amount>{0, 0, 4, 0}));
+    // Infinite offer: every source member injected to its residual.
+    auto inf = lossy_step(plan, std::nullopt, w);
+    EXPECT_EQ(inf.offered, 20);
+    EXPECT_EQ(inf.delivered, 11);
+    EXPECT_EQ(dense_input(g, plan, inf.edge_drops), (std::vector<Amount>{0, 0, 9, 0}));
+  }
+  // Highest averages at every node for Lossy Weighted: Capacity weights [1, 3, 3] split 7 as
+  // [1, 3, 3].
+  auto g2 = make_graph(2, {{0, 1, 1, 1}, {0, 1, 3, 1}, {0, 1, 3, 1}});
+  const auto p2 = plan_of(g2, RouteAllocation::Weighted, 0, {1}, all_ids(g2), caps(g2), WeightBasis::Capacity,
+                          Admission::Lossy);
+  auto s2 = lossy_step(p2, 7, on_members(p2, caps(g2)));
+  EXPECT_EQ(dense_input(g2, p2, s2.edge_flows), (std::vector<Amount>{1, 3, 3}));
+  EXPECT_EQ(s2.delivered, 7);
+  // One link of capacity 0. Equal keeps it as a member: the offer enters it and is
+  // dropped on it. Weighted gives it weight 0: the source has no member and injects nothing (the
+  // offer is a source drop).
+  auto g3 = make_graph(2, {{0, 1, 0, 1}});
+  const auto p3 = plan_of(g3, RouteAllocation::Equal, 0, {1}, all_ids(g3), caps(g3), WeightBasis::ResidualSnapshot,
+                          Admission::Lossy);
+  ASSERT_EQ(p3.forwarding_edges, (std::vector<EdgeId>{0}));
+  auto s3 = lossy_step(p3, 5, on_members(p3, caps(g3)));
+  EXPECT_EQ(s3.offered, 5);
+  EXPECT_EQ(s3.network_entered, 5);
+  EXPECT_EQ(s3.delivered, 0);
+  EXPECT_EQ(s3.edge_flows, (std::vector<Amount>{0}));
+  EXPECT_EQ(s3.edge_drops, (std::vector<Amount>{5}));
+  const auto w3 = plan_of(g3, RouteAllocation::Weighted, 0, {1}, all_ids(g3), caps(g3), WeightBasis::Capacity,
+                          Admission::Lossy);
+  ASSERT_TRUE(w3.forwarding_edges.empty());
+  auto s4 = lossy_step(w3, 5, {});
+  EXPECT_EQ(s4.offered, 5);
+  EXPECT_EQ(s4.network_entered, 0);
+  EXPECT_EQ(s4.delivered, 0);
+}
+
+// Lossy steps on random DAGs (parallel arcs, zero capacities, one or two destinations, a
+// destination reached through another), both kernels, finite offers and +inf, against the
+// per-node reference: every member's carried amount and drop, the injection, the delivery and
+// the offer. The members are first checked against the walk definition, so the reference reads
+// the same split graph.
+TEST(LossyKernel, RandomStepsEqualThePerNodeReference) {
+  std::mt19937 rng(1915);
+  int weighted_transit_drops = 0;  // Weighted steps that drop at a node other than the source
+  int balanced_transit_drops = 0;  // the same for Equal
+  int zero_member_drops = 0;       // Equal members of capacity 0 that dropped their share
+  int infinite = 0;                // +inf offers that injected something
+  int delivering = 0;              // steps that delivered something
+  for (int trial = 0; trial < 1000; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 6);
+    const auto edges = random_dag_edges(
+        rng, n, n + static_cast<int>(rng() % 10),
+        [&] { return (rng() % 6) == 0 ? Amount {0} : 1 + static_cast<Amount>(rng() % 6); },
+        [&] { return 1 + static_cast<Cost>(rng() % 3); });
+    auto g = make_graph(n, edges);
+    std::vector<NodeId> dsts = {static_cast<NodeId>(n - 1)};
+    if (rng() % 3 == 0) dsts.insert(dsts.begin(), static_cast<NodeId>(1 + rng() % static_cast<std::uint32_t>(n - 2)));
+    const bool weighted = trial % 2 == 1;
+    const auto kernel = weighted ? RouteAllocation::Weighted : RouteAllocation::Equal;
+    const auto plan = plan_of(g, kernel, 0, dsts, all_ids(g), caps(g), WeightBasis::Capacity, Admission::Lossy);
+    // The split graph: every edge for Equal (a zero-capacity member takes its share and
+    // drops it), the edges of positive weight (capacity) for Weighted.
+    std::vector<EdgeId> usable;
+    for (EdgeId e : all_ids(g)) {
+      if (!weighted || g.edge_capacity_units()[static_cast<std::size_t>(e)] >= 1) usable.push_back(e);
+    }
+    ASSERT_EQ(plan.forwarding_edges, walk_members(g, usable, 0, dsts)) << "trial " << trial;
+    std::vector<std::pair<NodeId, NodeId>> arcs;
+    std::vector<Amount> weights, residual;
+    for (EdgeId e : plan.forwarding_edges) {
+      const auto k = static_cast<std::size_t>(e);
+      arcs.emplace_back(g.edge_sources()[k], g.edge_destinations()[k]);
+      weights.push_back(g.edge_capacity_units()[k]);
+      residual.push_back(static_cast<Amount>(rng() % static_cast<std::uint64_t>(g.edge_capacity_units()[k] + 1)));
+    }
+    const std::optional<Amount> offer =
+        rng() % 4 == 0 ? std::nullopt : std::optional<Amount>(static_cast<Amount>(rng() % 25));
+    const auto s = lossy_step(plan, offer, residual);
+    const auto want = lossy_reference(n, arcs, weights, residual, weighted, offer, 0, dsts);
+    const std::string where = "trial " + std::to_string(trial);
+    EXPECT_EQ(s.edge_flows, want.carried) << where;
+    EXPECT_EQ(s.edge_drops, want.drops) << where;
+    EXPECT_EQ(s.network_entered, want.injected) << where;
+    EXPECT_EQ(s.delivered, want.delivered) << where;
+    EXPECT_EQ(s.offered, offer.value_or(want.injected)) << where;
+    bool transit_drop = false;
+    for (std::size_t i = 0; i < arcs.size(); ++i) transit_drop = transit_drop || (arcs[i].first != 0 && want.drops[i] > 0);
+    (weighted ? weighted_transit_drops : balanced_transit_drops) += transit_drop ? 1 : 0;
+    for (std::size_t i = 0; i < arcs.size(); ++i) {
+      zero_member_drops += g.edge_capacity_units()[static_cast<std::size_t>(plan.forwarding_edges[i])] == 0 && want.drops[i] > 0 ? 1 : 0;
+    }
+    infinite += !offer.has_value() && want.injected > 0 ? 1 : 0;
+    delivering += want.delivered > 0 ? 1 : 0;
+  }
+  EXPECT_GT(weighted_transit_drops, 0);
+  EXPECT_GT(balanced_transit_drops, 0);
+  EXPECT_GT(zero_member_drops, 0);
+  EXPECT_GT(infinite, 0);
+  EXPECT_GT(delivering, 0);
+}
diff --git a/tests/cpp/route_policy.hpp b/tests/cpp/route_policy.hpp
new file mode 100644
index 0000000..d95b474
--- /dev/null
+++ b/tests/cpp/route_policy.hpp
@@ -0,0 +1,84 @@
+// A policy on one fixed route, in the program API: CentralizedTE restricted to the route (on_support) or
+// Pinned over a program of the route as one supplied split route (split_route: Equal, or
+// Weighted with its WeightBasis; RESIDUAL_SNAPSHOT reads the ledger's residual when the program
+// is made). The ledger tests (flow_ledger_tests.cpp, flow_ledger_fault_tests.cpp) drive the ledger
+// through RoutePolicy and compare the real PlacementResult.
+#pragma once
+
+#include <memory>
+#include <optional>
+#include <utility>
+
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+
+namespace netgraph::core::test {
+
+inline FlowPolicyConfig on_support(std::shared_ptr<const PredecessorDAG> dag, Admission admission = Admission::Lossless) {
+  FlowPolicyConfig cfg;
+  CentralizedTE controller(SourceAllocation::Optimized);
+  controller.support = std::move(dag);
+  cfg.routing = std::move(controller);
+  cfg.admission = admission;
+  return cfg;
+}
+
+inline FlowPolicyConfig split_route(const FlowLedger& fg, NodeId src, NodeId dst, std::shared_ptr<const PredecessorDAG> dag,
+                                    RouteAllocation placement, Admission admission,
+                                    WeightBasis weights = WeightBasis::Capacity) {
+  const NodeId s[1] = {src};
+  const NodeId d[1] = {dst};
+  RouteOptions options;
+  options.allocation = placement;
+  if (placement == RouteAllocation::Weighted && weights != WeightBasis::Capacity) {
+    options.weight_basis = weights;
+    if (weights == WeightBasis::ResidualSnapshot) options.residual = fg.residual();
+  }
+  const RouteDefinition routes[1] = {RouteDefinition {src, std::move(dag), 1}};
+  FlowPolicyConfig cfg;
+  cfg.routing = Pinned {ForwardingProgram::from_routes(*fg.graph(), s, d, routes, options), nullptr};
+  cfg.admission = admission;
+  return cfg;
+}
+
+class RoutePolicy {
+public:
+  RoutePolicy(FlowLedger& fg, NodeId src, NodeId dst, FlowPolicyConfig cfg,
+              std::shared_ptr<const Eligibility> elig = nullptr)
+      : elig_(std::move(elig)) {
+    const NodeId s[1] = {src};
+    const NodeId d[1] = {dst};
+    policy_ = std::make_unique<FlowPolicy>(fg, s, d, std::move(cfg), elig_.get());
+  }
+
+  PlacementResult place(std::optional<Amount> offer) { return policy_->place(offer); }
+  void remove() { policy_->remove(); }
+  // The FlowId of the policy's one record (its first), if it has one.
+  [[nodiscard]] std::optional<FlowId> flow_id() const {
+    const auto& pe = engine();
+    if (pe.epoch.record_groups.empty() || pe.epoch.record_groups.front().empty()) return std::nullopt;
+    return FlowId {pe.ledger.uid(), pe.epoch.record_groups.front().front().record_counter};
+  }
+  // The split route's plan as forwarded (Pinned), or null (CentralizedTE's support has none).
+  [[nodiscard]] const detail::PreparedRoute* plan() const {
+    const auto& pe = engine();
+    if (!std::holds_alternative<Pinned>(pe.config.routing) || pe.view.data->split_contexts.empty()) return nullptr;
+    return pe.view.prepared_route(0).get();
+  }
+  [[nodiscard]] const Counter128& requested() const { return engine().epoch.requested; }
+  [[nodiscard]] bool infinite() const { return engine().epoch.infinite; }
+  [[nodiscard]] bool lossy() const { return engine().config.admission == Admission::Lossy; }
+  // The wrapped policy (for the shared comparators of state_comparators.hpp, such as epoch()).
+  [[nodiscard]] FlowPolicy& policy() { return *policy_; }
+
+private:
+  [[nodiscard]] const detail::PolicyEngine& engine() const { return detail::PolicyAccess::engine(*policy_); }
+  std::shared_ptr<const Eligibility> elig_;
+  std::unique_ptr<FlowPolicy> policy_;
+};
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/route_structures_tests.cpp b/tests/cpp/route_structures_tests.cpp
new file mode 100644
index 0000000..d671c2c
--- /dev/null
+++ b/tests/cpp/route_structures_tests.cpp
@@ -0,0 +1,267 @@
+// PredecessorDAG and Path: from_csr's complete validation in the documented order, the
+// canonical predecessor order, structural equality, Path validation in its order, cost and
+// to_dag().
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <random>
+#include <vector>
+
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// 0 -> 1 (two parallel members), 1 -> 2, 0 -> 2 and 2 -> 0; ids follow (source, cost, destination, input).
+Graph diamondish() {
+  return make_graph(3, {{0, 1, 5, 1}, {0, 1, 5, 1}, {1, 2, 5, 1}, {0, 2, 5, 3}, {2, 0, 5, 1}});
+}
+
+using V = std::vector<std::int32_t>;
+
+} // namespace
+
+TEST(PredecessorDAG, FromCsrRoundTripAndAccessors) {
+  auto g = diamondish();
+  // ids: 0: 0->1, 1: 0->1, 2: 0->2 (cost 3), 3: 1->2, 4: 2->0
+  const V off = {0, 0, 2, 4};
+  const V par = {0, 0, 0, 1};
+  const V via = {0, 1, 2, 3};
+  auto dag = PredecessorDAG::from_csr(g, off, par, via);
+  EXPECT_EQ(dag.graph_uid(), g.uid());
+  EXPECT_EQ(dag.parent_offsets(), off);
+  EXPECT_EQ(V(dag.parents().begin(), dag.parents().end()), par);
+  EXPECT_EQ(V(dag.via_edges().begin(), dag.via_edges().end()), via);
+  EXPECT_EQ(ascending_edges(dag), (std::vector<EdgeId>{0, 1, 2, 3}));
+  // Structural equality: the builder's value from the same edge set is equal.
+  const std::vector<EdgeId> edges = {3, 1, 0, 2};
+  EXPECT_TRUE(detail::PredecessorDAGBuilder::of_edges(g, edges) == dag);
+  auto empty = PredecessorDAG::from_csr(g, V {0, 0, 0, 0}, V {}, V {});
+  EXPECT_FALSE(empty == dag);
+  EXPECT_TRUE(ascending_edges(empty).empty());
+  // Equality includes the graph: the same CSR on a twin graph (the same arrays, another uid) is
+  // another value, from from_csr and from the builder alike.
+  const auto twin = diamondish();
+  ASSERT_NE(twin.uid(), g.uid());
+  const auto there = PredecessorDAG::from_csr(twin, off, par, via);
+  EXPECT_EQ(there.parent_offsets(), off);
+  EXPECT_EQ(V(there.via_edges().begin(), there.via_edges().end()), via);
+  EXPECT_FALSE(there == dag);
+  EXPECT_FALSE(detail::PredecessorDAGBuilder::of_edges(twin, edges) == dag);
+  EXPECT_TRUE(detail::PredecessorDAGBuilder::of_edges(twin, edges) == there);
+}
+
+// The builder's entries for any edge subset in any input order: children ascending, via
+// ascending within a child, the parent each via's tail, and the same value as from_csr. The
+// builder groups a subset of fewer than N / 8 edges by sorting (child, via) pairs and a larger one
+// by a counting sort over the nodes: small graphs take mostly the counting sort, and graphs of 512
+// to 767 nodes with four to seven children of five to nine in-edges each (at most 63 edges, often
+// more than a sort keeps in insertion order) take only the pair sort. Each population is guarded by
+// its DAGs with a child of several entries, whose order is what differs between the two.
+TEST(PredecessorDAG, BuilderGroupsAnyEdgeSubsetCanonically) {
+  std::mt19937 rng(5);
+  // Checks the builder's value for one subset; true when a child has several entries.
+  const auto check = [&](const Graph& g, std::vector<EdgeId> subset, int trial) {
+    const int n = g.num_nodes();
+    std::shuffle(subset.begin(), subset.end(), rng);
+    const auto dag = detail::PredecessorDAGBuilder::of_edges(g, subset);
+    V off(static_cast<std::size_t>(n) + 1, 0);
+    std::vector<std::pair<NodeId, EdgeId>> entries;
+    for (EdgeId e : subset) entries.emplace_back(g.edge_destinations()[static_cast<std::size_t>(e)], e);
+    std::sort(entries.begin(), entries.end());
+    V par;
+    V via;
+    for (auto [child, e] : entries) {
+      ++off[static_cast<std::size_t>(child) + 1];
+      par.push_back(g.edge_sources()[static_cast<std::size_t>(e)]);
+      via.push_back(e);
+    }
+    for (std::size_t i = 1; i < off.size(); ++i) off[i] += off[i - 1];
+    EXPECT_EQ(dag.parent_offsets(), off) << trial;
+    EXPECT_EQ(V(dag.parents().begin(), dag.parents().end()), par) << trial;
+    EXPECT_EQ(V(dag.via_edges().begin(), dag.via_edges().end()), via) << trial;
+    EXPECT_TRUE(PredecessorDAG::from_csr(g, off, par, via) == dag) << trial;
+    std::sort(subset.begin(), subset.end());
+    EXPECT_EQ(ascending_edges(dag), subset) << trial;
+    const auto o = dag.parent_offsets();
+    bool several = false;
+    for (std::size_t i = 1; i < o.size(); ++i) several = several || o[i] - o[i - 1] >= 2;
+    return several;
+  };
+  int grouped = 0;  // DAGs with a child of several entries (their order is checked)
+  for (int trial = 0; trial < 200; ++trial) {
+    const int n = 2 + static_cast<int>(rng() % 9);
+    std::vector<InEdge> es;
+    for (int k = 0, m = 1 + static_cast<int>(rng() % 30); k < m; ++k) {  // u < v: every subset is a DAG
+      const auto u = static_cast<NodeId>(rng() % static_cast<unsigned>(n - 1));
+      const auto v = static_cast<NodeId>(u + 1 + static_cast<NodeId>(rng() % static_cast<unsigned>(n - 1 - u)));
+      es.push_back({u, v, 1, static_cast<Cost>(1 + rng() % 3)});
+    }
+    const auto g = make_graph(n, es);
+    std::vector<EdgeId> subset;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      if (rng() % 2 == 0) subset.push_back(e);
+    }
+    grouped += check(g, subset, trial) ? 1 : 0;
+  }
+  EXPECT_GT(grouped, 50);
+  int sparse_grouped = 0;  // pair-sorted DAGs with a child of several entries
+  for (int trial = 0; trial < 200; ++trial) {
+    const int n = 512 + static_cast<int>(rng() % 256);
+    std::vector<InEdge> es;
+    for (int c = 0, children = 4 + static_cast<int>(rng() % 4); c < children; ++c) {
+      const auto v = static_cast<NodeId>(1 + rng() % static_cast<unsigned>(n - 1));
+      for (int k = 0, d = 5 + static_cast<int>(rng() % 5); k < d; ++k) {  // u < v; parallel members possible
+        es.push_back({static_cast<NodeId>(rng() % static_cast<unsigned>(v)), v, 1, static_cast<Cost>(1 + rng() % 3)});
+      }
+    }
+    const auto g = make_graph(n, es);
+    std::vector<EdgeId> subset;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      if (rng() % 8 != 0) subset.push_back(e);
+    }
+    ASSERT_LT(subset.size() * 8, static_cast<std::size_t>(n));  // the pair sort
+    sparse_grouped += check(g, subset, 1000 + trial) ? 1 : 0;
+  }
+  EXPECT_GT(sparse_grouped, 100);
+}
+
+TEST(PredecessorDAG, FromCsrShapeChecksInOrder) {
+  auto g = diamondish();
+  // offsets of length N + 1
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 0}, V {}, V {}); }), "parent_offsets has length 3"));
+  // offsets[0] == 0 (also before monotone)
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {1, 0, 2, 1}, V {}, V {}); }), "parent_offsets[0] = 1"));
+  // monotone
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 2, 1, 2}, V {0, 0}, V {0, 1}); }),
+                       "not monotone at 2"));
+  // offsets[N] == len(parents) == len(via)
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 2, 2}, V {0}, V {0, 1}); }),
+                       "parent_offsets[N] = 2 but parents has 1"));
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 2, 2}, V {0, 0}, V {0}); }),
+                       "and via_edges has 1"));
+  // Shape before entries: a bad parent and a shape defect report the shape.
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 2, 3}, V {9, 0}, V {0, 1}); }),
+                       "parent_offsets[N] = 3"));
+  // Every shape defect at once, then each reported one removed: each step is reported before
+  // all the later ones (and before the bad entry 9, 9).
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, V {1, 0, 0}, V {9}, V {9}); }),
+            "PredecessorDAG.from_csr: parent_offsets has length 3, expected N + 1 = 4");
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, V {1, 0, 2, 5}, V {9}, V {9}); }),
+            "PredecessorDAG.from_csr: parent_offsets[0] = 1, expected 0");
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 2, 1, 5}, V {9}, V {9}); }),
+            "PredecessorDAG.from_csr: parent_offsets are not monotone at 2 (2 > 1)");
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 2, 5}, V {9}, V {9}); }),
+            "PredecessorDAG.from_csr: parent_offsets[N] = 5 but parents has 1 and via_edges has 1 entries");
+}
+
+TEST(PredecessorDAG, FromCsrEntryChecksInOrder) {
+  auto g = diamondish();
+  const V off = {0, 0, 2, 2};
+  // parents in range, then via in range (entry by entry)
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {3, 0}, V {0, 1}); }),
+            "PredecessorDAG.from_csr: parents[0] = 3 out of node range [0, 3)");
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {0, 0}, V {0, 5}); }), "via_edges[1] = 5"));
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {-1, 0}, V {-1, 1}); }),
+            "PredecessorDAG.from_csr: parents[0] = -1 out of node range [0, 3)");
+  // via endpoints: wrong parent, wrong child
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {1, 0}, V {0, 1}); }), "joins (0, 1), not (1, 1)"));
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 0, 0, 1}, V {0}, V {0}); }),
+                       "joins (0, 1), not (0, 2)"));
+  // duplicate (child, via) before the order check
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {0, 0}, V {1, 1}); }), "duplicate entry"));
+  // a cycle (0 -> 1 -> 2 -> 0) before the order check: node 1's two entries descend (via 1, then 0)
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 1, 3, 4}, V {2, 0, 0, 1}, V {4, 1, 0, 3}); }),
+                       "cycle"));
+  // canonical order: ascending via within a node
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, off, V {0, 0}, V {1, 0}); }),
+                       "not in ascending via EdgeId"));
+  // Every entry defect at once, then each reported one removed. Node 0 has (2, via 4), node 1
+  // (0, via 1), (0, via 0), (0, via 0): a cycle 0 -> 1 -> 2 -> 0, a duplicate and a descending
+  // pair; node 2 has a wrong endpoint (entry 4) before an out-of-range via (entry 5), so the
+  // ranges of every entry come before any endpoint.
+  const auto first = [&](V o, V p, V w) { return error_of([&] { (void)PredecessorDAG::from_csr(g, o, p, w); }); };
+  EXPECT_EQ(first(V {0, 1, 4, 6}, V {2, 0, 0, 0, 0, 1}, V {4, 1, 0, 0, 0, 9}),
+            "PredecessorDAG.from_csr: via_edges[5] = 9 out of edge range [0, 5)");
+  EXPECT_EQ(first(V {0, 1, 4, 6}, V {2, 0, 0, 0, 0, 1}, V {4, 1, 0, 0, 0, 3}),
+            "PredecessorDAG.from_csr: entry 4 of node 2: via edge 0 joins (0, 1), not (0, 2)");
+  EXPECT_EQ(first(V {0, 1, 4, 6}, V {2, 0, 0, 0, 0, 1}, V {4, 1, 0, 0, 2, 3}),
+            "PredecessorDAG.from_csr: duplicate entry (child 1, via 0)");
+  EXPECT_EQ(first(V {0, 1, 3, 5}, V {2, 0, 0, 0, 1}, V {4, 1, 0, 2, 3}), "PredecessorDAG.from_csr: the entries contain a cycle");
+  EXPECT_EQ(first(V {0, 0, 2, 4}, V {0, 0, 0, 1}, V {1, 0, 2, 3}),
+            "PredecessorDAG.from_csr: the entries of node 1 are not in ascending via EdgeId (1 then 0)");
+  EXPECT_EQ(first(V {0, 0, 2, 4}, V {0, 0, 0, 1}, V {0, 1, 2, 3}), "");
+}
+
+TEST(PredecessorDAG, SelfLoopIsACycle) {
+  auto g = make_graph(2, {{0, 0, 1, 1}, {0, 1, 1, 1}});
+  // id 0: 0->0, id 1: 0->1
+  EXPECT_TRUE(contains(error_of([&] { (void)PredecessorDAG::from_csr(g, V {0, 1, 1}, V {0}, V {0}); }), "cycle"));
+}
+
+TEST(PredecessorDAG, EmptyGraph) {
+  auto g = make_graph(0, {});
+  auto dag = PredecessorDAG::from_csr(g, V {0}, V {}, V {});
+  EXPECT_EQ(dag.parent_offsets(), V {0});
+  EXPECT_EQ(error_of([&] { (void)PredecessorDAG::from_csr(g, V {}, V {}, V {}); }),
+            "PredecessorDAG.from_csr: parent_offsets has length 0, expected N + 1 = 1");
+}
+
+TEST(Path, CostSrcDstAndToDag) {
+  auto g = diamondish();
+  // Grouped first hop (members 1 and 0, caller order kept), then 1 -> 2.
+  Path p(g, {{1, 0}, {3}});
+  EXPECT_EQ(p.source(), 0);
+  EXPECT_EQ(p.destination(), 2);
+  EXPECT_EQ(p.cost(), 2);
+  EXPECT_EQ(p.hops(), (std::vector<std::vector<EdgeId>>{{1, 0}, {3}}));
+  EXPECT_EQ(p.graph_uid(), g.uid());
+  auto dag = p.to_dag();
+  EXPECT_EQ(dag.parent_offsets(), (V {0, 0, 2, 3}));
+  EXPECT_EQ(V(dag.via_edges().begin(), dag.via_edges().end()), (V {0, 1, 3}));
+  EXPECT_EQ(V(dag.parents().begin(), dag.parents().end()), (V {0, 0, 1}));
+  // to_dag gives a canonical value: from_csr accepts it unchanged.
+  EXPECT_TRUE(PredecessorDAG::from_csr(g, dag.parent_offsets(), dag.parents(), dag.via_edges()) == dag);
+  // Cost is the minimum member cost per hop.
+  auto g2 = make_graph(2, {{0, 1, 1, 4}, {0, 1, 1, 2}});
+  EXPECT_EQ(Path(g2, {{0, 1}}).cost(), 2);
+  EXPECT_TRUE(Path(g2, {{0, 1}}) == Path(g2, {{0, 1}}));
+  EXPECT_FALSE(Path(g2, {{0, 1}}) == Path(g2, {{1, 0}}));
+  // Equality includes the graph: the same hops on a twin graph (the same arrays, another uid).
+  auto twin = make_graph(2, {{0, 1, 1, 4}, {0, 1, 1, 2}});
+  ASSERT_NE(twin.uid(), g2.uid());
+  EXPECT_EQ(Path(twin, {{0, 1}}).hops(), Path(g2, {{0, 1}}).hops());
+  EXPECT_FALSE(Path(twin, {{0, 1}}) == Path(g2, {{0, 1}}));
+}
+
+TEST(Path, ValidationInOrder) {
+  auto g = diamondish();
+  // range before everything (an empty hop elsewhere is reported later)
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{}, {7}}); }), "member 7 out of edge range"));
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{-1}}); }), "member -1 out of edge range"));
+  // duplicate member before an empty hop
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{0, 0}, {}}); }), "duplicate member 0"));
+  EXPECT_EQ(error_of([&] { Path(g, {}); }), "Path: the hop list is empty");
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{0}, {}}); }), "hop 1 is empty"));
+  // members of a hop share (u, v)
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{0, 2}}); }), "do not share (u, v)"));
+  // contiguous hops
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{0}, {2}}); }), "not contiguous"));
+  // no repeated node: 0 -> 2 -> 0
+  EXPECT_TRUE(contains(error_of([&] { Path(g, {{2}, {4}}); }), "node 0 is repeated"));
+  // Several defects at once, then each reported one removed (an empty hop list has no member, so
+  // it is never reported with another defect). The later defect sits in an earlier hop where it
+  // can: the order is by step, not by position.
+  EXPECT_EQ(error_of([&] { Path(g, {{0, 0, 2}, {}, {7}}); }), "Path: hop 2 member 7 out of edge range [0, 5)");
+  EXPECT_EQ(error_of([&] { Path(g, {{0, 0, 2}, {}, {4}}); }), "Path: duplicate member 0");
+  EXPECT_EQ(error_of([&] { Path(g, {{0, 2}, {}, {4}}); }), "Path: hop 1 is empty");
+  // hop 2 mixes 0 -> 2 and 0 -> 1; hops 0 and 1 do not meet (1 then 2); node 0 repeats
+  EXPECT_EQ(error_of([&] { Path(g, {{1}, {4}, {2, 0}}); }),
+            "Path: the members of hop 2 do not share (u, v): edge 0 joins (0, 1), edge 2 joins (0, 2)");
+  EXPECT_EQ(error_of([&] { Path(g, {{1}, {4}, {2}}); }), "Path: hops 0 and 1 are not contiguous (1 then 2)");
+  EXPECT_EQ(error_of([&] { Path(g, {{2}, {4}, {0}}); }), "Path: node 0 is repeated");
+}
diff --git a/tests/cpp/search_fault_tests.cpp b/tests/cpp/search_fault_tests.cpp
new file mode 100644
index 0000000..90299ab
--- /dev/null
+++ b/tests/cpp/search_fault_tests.cpp
@@ -0,0 +1,349 @@
+// Allocation-failure atomicity of the search: every allocation an spf call makes
+// (the workspace's acquisition and growth, the tight-edge pool, both queues, the pruning and the
+// extraction scratch, the emitted DAG and the result) fails once; the call raises std::bad_alloc,
+// and a clean retry and a different query afterwards give their references, so the thread's
+// workspace is restored on every exit (no touched node, mark, list or queue entry survives); no
+// failed attempt leaves an allocation behind, on a warm workspace or from a new thread. Runs in
+// the fault-injection executable (fault_injection.hpp).
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <exception>
+#include <functional>
+#include <new>
+#include <optional>
+#include <random>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "fault_injection.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/search.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+struct Query {
+  std::string name;
+  std::vector<NodeId> roots;
+  Direction direction;
+  std::optional<std::vector<NodeId>> targets;
+  detail::RouteChoice choice;
+  bool residual;
+  SpfQueue queue;
+};
+
+// test_utils.hpp's random graph from its own seed, capacities 0 to 4 (an edge of capacity 0 is
+// searched like any other).
+Graph seeded_graph(int n, int m, Cost max_edge_cost, unsigned seed) {
+  std::mt19937 rng(seed);
+  return random_graph(rng, n, m, max_edge_cost);
+}
+
+SpfResult run(const Graph& g, const Query& q, const std::vector<Amount>& residual) {
+  SpfOptions o(q.direction);
+  o.tie_break = q.choice.tie_break;
+  o.multipath = q.choice.multipath;
+  o.parallel_edges = q.choice.parallel_edges;
+  o.targets = q.targets;
+  if (q.residual) o.residual = std::span<const Amount>(residual);
+  return spf(g, q.roots, o, q.queue);
+}
+
+void expect_same(const SpfResult& a, const SpfResult& b, const std::string& where) {
+  EXPECT_EQ(a.costs, b.costs) << where;
+  EXPECT_EQ(a.target_cost, b.target_cost) << where;
+  EXPECT_TRUE(a.dag == b.dag) << where;
+}
+
+// Runs `attempt` in a new thread, whose workspace starts empty (every growth path of the first
+// search is then reached), and on a std::bad_alloc runs `after` in the same thread (the injection
+// is spent by then) before the exception reaches the caller's thread.
+void in_fresh_thread(const std::function<void()>& attempt, const std::function<void()>& after) {
+  std::exception_ptr error;
+  std::thread worker([&] {
+    try {
+      attempt();
+    } catch (const std::bad_alloc&) {
+      error = std::current_exception();
+      after();
+    } catch (...) {
+      error = std::current_exception();
+    }
+  });
+  worker.join();
+  if (error) std::rethrow_exception(error);
+}
+
+// fails_at(k) around in_fresh_thread(attempt, after): a reached failure also leaves no
+// allocation behind (the thread's workspace ends with the thread, the partial result with the
+// call), counted with g_live rather than left to ASan, whose leak detection is off on macOS.
+bool fails_in_fresh_thread_at(long k, const std::function<void()>& attempt, const std::function<void()>& after,
+                              const std::string& where) {
+  const long live = g_live.load();
+  const bool hit = fails_at(k, [&] { in_fresh_thread(attempt, after); });
+  if (hit) EXPECT_EQ(g_live.load(), live) << where << " allocation " << k << ": a leak";
+  return hit;
+}
+
+// The allocations in_fresh_thread makes itself (its thread), given functions built beforehand:
+// a sweep through it counts these too, so its guard subtracts them.
+long thread_allocations() {
+  const std::function<void()> nothing = [] {};
+  long n = 0;
+  while (fails_at(n, [&] { in_fresh_thread(nothing, nothing); })) ++n;
+  return n;
+}
+
+} // namespace
+
+TEST(SearchFaults, EveryAllocationOfSpfFailsCleanly) {
+  // A graph large enough that the pool and the queues grow past their first capacities, with
+  // lists of several entries (unit costs on a dense part). The tiny search before every attempt
+  // runs on the same workspace and reuses it, sized for the large graph (SearchWorkspaceLease reallocates only
+  // below n or above 4n + 4096 nodes, so it never shrinks here): each attempt starts from a
+  // workspace another graph used last. The acquisition of the node arrays is swept below, from
+  // fresh threads.
+  const auto big = seeded_graph(400, 2400, 3, 99);
+  const auto tiny = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  std::vector<Amount> residual(static_cast<std::size_t>(big.num_edges()));
+  for (std::size_t e = 0; e < residual.size(); ++e) {
+    residual[e] = std::max<Amount>(0, big.edge_capacity_units()[e] - static_cast<Amount>(e % 2));
+  }
+  const detail::RouteChoice det {RouteTieBreak::FewerHops};
+  const detail::RouteChoice collapse {RouteTieBreak::HigherAvailableCapacity, true, false};
+  const detail::RouteChoice single {RouteTieBreak::HigherHeadroom, false, true};
+  const std::vector<Query> queries = {
+      {"full forward buckets", {0}, Direction::Forward, std::nullopt, det, false, SpfQueue::Auto},
+      {"full forward heap", {0, 7}, Direction::Forward, std::nullopt, det, false, SpfQueue::Heap},
+      {"full reverse collapse", {3}, Direction::Reverse, std::nullopt, collapse, true, SpfQueue::Auto},
+      {"anycast forward", {1}, Direction::Forward, std::vector<NodeId> {250, 399, 17}, det, true, SpfQueue::Auto},
+      {"anycast reverse heap", {250, 399}, Direction::Reverse, std::vector<NodeId> {1, 2}, collapse, false, SpfQueue::Heap},
+      {"single path forward", {5}, Direction::Forward, std::vector<NodeId> {300}, single, true, SpfQueue::Auto},
+      {"single path reverse", {300}, Direction::Reverse, std::vector<NodeId> {5, 6}, single, true, SpfQueue::Heap},
+  };
+  const Query other {"other", {2}, Direction::Forward, std::vector<NodeId> {123}, single, true, SpfQueue::Auto};
+  std::vector<SpfResult> want;
+  for (const auto& q : queries) want.push_back(run(big, q, residual));
+  const auto want_other = run(big, other, residual);
+  const auto want_tiny = spf(tiny, std::vector<NodeId> {0}, SpfOptions(Direction::Forward));
+  const long harness = thread_allocations();
+  for (std::size_t i = 0; i < queries.size(); ++i) {
+    const auto& q = queries[i];
+    long failures = 0;
+    for (long k = 0;; ++k) {
+      (void)spf(tiny, std::vector<NodeId> {0}, SpfOptions(Direction::Forward));  // reuses the workspace
+      std::optional<SpfResult> got;
+      // The workspace already has the size every query needs (the references above), so a failed
+      // search that leaves an allocation live leaks it.
+      const long live = g_live.load();
+      const bool hit = fails_at(k, [&] { got.emplace(run(big, q, residual)); });
+      if (!hit) {
+        ASSERT_TRUE(got.has_value()) << q.name;
+        expect_same(*got, want[i], q.name + " without a failure");
+        break;
+      }
+      ++failures;
+      EXPECT_FALSE(got.has_value()) << q.name << " at " << k;
+      EXPECT_EQ(g_live.load(), live) << q.name << " at " << k << ": a leak";
+      // The retry, another query and a tiny search on this thread see a clean workspace.
+      expect_same(run(big, q, residual), want[i], q.name + " retry after " + std::to_string(k));
+      expect_same(run(big, other, residual), want_other, q.name + " other after " + std::to_string(k));
+      expect_same(spf(tiny, std::vector<NodeId> {0}, SpfOptions(Direction::Forward)), want_tiny,
+                  q.name + " tiny after " + std::to_string(k));
+    }
+    EXPECT_GE(failures, 8) << q.name;  // the sweep reached the search's allocations, not only the result
+    // The same sweep from an empty workspace (a new thread per attempt): the first acquisition of
+    // the node arrays, the bucket arrays and the queues' storage fail too, so beyond the thread's
+    // own allocations the attempt allocates more than on the warm workspace above.
+    long fresh = 0;
+    for (long k = 0;; ++k) {
+      std::optional<SpfResult> got;
+      const std::function<void()> attempt = [&] { got.emplace(run(big, q, residual)); };
+      const std::function<void()> after = [&] {
+        expect_same(run(big, q, residual), want[i], q.name + " fresh retry after " + std::to_string(k));
+        expect_same(run(big, other, residual), want_other, q.name + " fresh other after " + std::to_string(k));
+      };
+      const bool hit = fails_in_fresh_thread_at(k, attempt, after, q.name + " fresh");
+      if (!hit) {
+        ASSERT_TRUE(got.has_value()) << q.name;
+        expect_same(*got, want[i], q.name + " fresh without a failure");
+        break;
+      }
+      ++fresh;
+    }
+    EXPECT_GT(fresh - harness, failures) << q.name;
+  }
+}
+
+TEST(SearchFaults, InternalRouteSearchesFailCleanly) {
+  // The policies' entries (route_search, support_route, static_support, static_costs) under the
+  // same sweep: a failure leaves nothing behind for the next search.
+  const auto g = seeded_graph(200, 1200, 2, 7);
+  std::vector<Amount> view(static_cast<std::size_t>(g.num_edges()));
+  for (std::size_t e = 0; e < view.size(); ++e) view[e] = g.edge_capacity_units()[e];
+  const detail::RouteChoice single {RouteTieBreak::HigherAvailableCapacity, false, false};
+  const std::vector<NodeId> dests = {150, 199};
+  const auto want_route = detail::route_search(g, detail::SearchFilter {nullptr, view, 1}, single, 3, dests);
+  ASSERT_TRUE(want_route.has_value());  // node 3 reaches a destination
+  const auto support = detail::static_support(g, dests, Direction::Reverse, nullptr);
+  const detail::PriorityValues values {&g, RouteTieBreak::HigherAvailableCapacity, view};
+  const auto prio = detail::PriorityReader::of(values);
+  const auto want_support = detail::support_route(g, detail::PredecessorDAGBuilder::ascending(support), 3, dests, single, prio);
+  const auto want_costs = detail::static_costs(g, nullptr, dests, std::vector<NodeId> {0, 1, 2, 3});
+  std::vector<std::function<void()>> calls = {
+      [&] {
+        auto r = detail::route_search(g, detail::SearchFilter {nullptr, view, 1}, single, 3, dests);
+        ASSERT_TRUE(r.has_value());
+        EXPECT_EQ(r->edges, want_route->edges);
+      },
+      [&] {
+        auto r = detail::support_route(g, detail::PredecessorDAGBuilder::ascending(support), 3, dests, single, prio);
+        EXPECT_EQ(r.edges, want_support.edges);
+      },
+      [&] { EXPECT_TRUE(detail::static_support(g, dests, Direction::Reverse, nullptr) == support); },
+      [&] { EXPECT_EQ(detail::static_costs(g, nullptr, dests, std::vector<NodeId> {0, 1, 2, 3}), want_costs); },
+  };
+  const std::function<void()> every = [&] {
+    for (auto& call : calls) call();  // every entry clean afterwards, on the same thread
+  };
+  const long harness = thread_allocations();
+  for (std::size_t c = 0; c < calls.size(); ++c) {
+    long failures = 0;
+    for (long k = 0;; ++k) {
+      const bool hit = fails_in_fresh_thread_at(k, calls[c], every, "call " + std::to_string(c));
+      if (!hit) break;
+      ++failures;
+    }
+    EXPECT_GE(failures - harness, 10) << "call " << c;  // beyond the thread's own allocations
+  }
+}
+
+TEST(SearchFaults, KspAndTheResolverFailCleanly) {
+  // ksp (the first path, every spur search, the candidate set, the Paths) and resolve_to_paths
+  // (the walk back, the hops, the per-node lists and heaps, the frame stack, the Paths): every
+  // allocation fails once, in a new thread each time (an empty workspace), and the thread's next
+  // calls give their references.
+  const auto g = seeded_graph(60, 300, 3, 21);
+  // ksp's choices: every parallel edge under HIGHER_CAPACITY, one per (u, v) pair under FEWER_HOPS.
+  const std::pair<RouteTieBreak, bool> expand {RouteTieBreak::HigherCapacity, true};
+  const std::pair<RouteTieBreak, bool> collapse {RouteTieBreak::FewerHops, false};
+  auto ksp_of = [&](const std::pair<RouteTieBreak, bool>& s) {
+    KspOptions o(6);
+    o.tie_break = s.first;
+    o.parallel_edges = s.second;
+    o.cost_ceiling = CostStretch(3);
+    return ksp(g, 0, 59, o);
+  };
+  const auto want_expand = ksp_of(expand);
+  const auto want_collapse = ksp_of(collapse);
+  ASSERT_GE(want_expand.size(), 3U);
+  ASSERT_GE(want_collapse.size(), 3U);
+  // Every later path has a nonzero deviation after a long prefix. Retry must reset
+  // the skipped prefix's flags and scores as well as the first complete expansion.
+  std::vector<InEdge> prefix_rows;
+  for (NodeId v = 0; v < 40; ++v) prefix_rows.push_back({v, v + 1, 1, 1});
+  for (Cost c = 1; c <= 8; ++c) prefix_rows.push_back({40, 41, c, c});
+  const auto prefix_graph = make_graph(42, prefix_rows);
+  KspOptions prefix_options(8);
+  prefix_options.tie_break = RouteTieBreak::HigherCapacity;
+  const auto want_prefix = ksp(prefix_graph, 0, 41, prefix_options);
+  ASSERT_EQ(want_prefix.size(), 8U);
+  // Layers 0 -> {1..5} -> {6..10} -> 59 with a parallel pair 10 -> 59: 25 equal shortest node
+  // walks, 30 when the pair is split into its members (the resolver below splits and keeps 7).
+  std::vector<InEdge> layered;
+  for (NodeId a = 1; a <= 5; ++a) layered.push_back({0, a, 1, 1});
+  for (NodeId a = 1; a <= 5; ++a) {
+    for (NodeId b = 6; b <= 10; ++b) layered.push_back({a, b, 1, 1});
+  }
+  for (NodeId b = 6; b <= 10; ++b) layered.push_back({b, 59, 1, 1});
+  layered.push_back({10, 59, 1, 1});
+  const auto unit = make_graph(60, layered);
+  SpfOptions full(Direction::Forward);
+  const auto dag = spf(unit, std::vector<NodeId> {0}, full).dag;
+  const auto want_paths = resolve_to_paths(unit, dag, 0, 59, true, 7);
+  ASSERT_EQ(want_paths.size(), 7U);
+  auto same = [](const std::vector<std::pair<Cost, Path>>& a, const std::vector<std::pair<Cost, Path>>& b) {
+    if (a.size() != b.size()) return false;
+    for (std::size_t i = 0; i < a.size(); ++i) {
+      if (a[i].first != b[i].first || !(a[i].second == b[i].second)) return false;
+    }
+    return true;
+  };
+  EXPECT_TRUE(same(want_expand, want_expand));
+  auto damaged = want_expand;
+  damaged.pop_back();
+  EXPECT_FALSE(same(damaged, want_expand));
+  damaged = want_expand;
+  ++damaged.back().first;
+  EXPECT_FALSE(same(damaged, want_expand));
+  damaged = want_expand;
+  damaged.back().second = want_expand.front().second;
+  EXPECT_FALSE(same(damaged, want_expand));
+  std::vector<std::function<void()>> calls = {
+      [&] { EXPECT_TRUE(same(ksp_of(expand), want_expand)); },
+      [&] { EXPECT_TRUE(same(ksp_of(collapse), want_collapse)); },
+      [&] { EXPECT_TRUE(same(ksp(prefix_graph, 0, 41, prefix_options), want_prefix)); },
+      [&] {
+        const auto got = resolve_to_paths(unit, dag, 0, 59, true, 7);
+        ASSERT_EQ(got.size(), want_paths.size());
+        for (std::size_t i = 0; i < got.size(); ++i) EXPECT_TRUE(got[i] == want_paths[i]);
+      },
+  };
+  const std::function<void()> every = [&] {
+    for (auto& call : calls) call();
+  };
+  const long harness = thread_allocations();
+  for (std::size_t c = 0; c < calls.size(); ++c) {
+    long failures = 0;
+    for (long k = 0;; ++k) {
+      const bool hit = fails_in_fresh_thread_at(k, calls[c], every, "call " + std::to_string(c));
+      if (!hit) break;
+      ++failures;
+    }
+    EXPECT_GE(failures - harness, 60) << "call " << c;  // beyond the thread's own allocations
+  }
+  // Separate queries on already-grown TLS: once after a two-node warm-up (the next
+  // query grows it again), once after every full query has warmed all reusable buffers.
+  // Arm the fail point only after warming, and retry every query on that same thread.
+  const auto tiny = make_graph(2, {{0, 1, 1, 1}});
+  const std::function<void()> nothing = [] {};
+  for (int warm = 0; warm < 2; ++warm) for (std::size_t c = 0; c < calls.size(); ++c) {
+    long failures = 0;
+    for (long k = 0;; ++k) {
+      const long live = g_live.load();
+      bool hit = false;
+      in_fresh_thread([&] {
+        if (warm == 0) (void)ksp(tiny, 0, 1, KspOptions(1));
+        else every();
+        hit = fails_at(k, calls[c]);
+        every();
+      }, nothing);
+      EXPECT_EQ(g_live.load(), live) << "warm " << warm << " call " << c << " allocation " << k;
+      if (!hit) break;
+      ++failures;
+    }
+    // Every call returns at least three Paths: their hops/nodes plus the result list
+    // alone exceed ten allocations, independently of retained workspace capacity.
+    EXPECT_GE(failures, 10) << "warm " << warm << " call " << c;
+  }
+}
+
+TEST(SearchFaults, ResultComparisonRejectsEveryField) {
+  const auto g = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  const SpfOptions opts(Direction::Forward);
+  const auto good = spf(g, std::vector<NodeId> {0}, opts);
+  EXPECT_EQ(failures_of([&] { expect_same(good, good, "same"); }), 0);
+  for (int field = 0; field < 3; ++field) {
+    auto bad = good;
+    if (field == 0) bad.costs = std::vector<Cost> {0, 1, 9};
+    if (field == 1) bad.target_cost = 9;
+    if (field == 2) bad.dag = spf(g, std::vector<NodeId> {2}, opts).dag;
+    EXPECT_EQ(failures_of([&] { expect_same(bad, good, "different"); }), 1) << field;
+  }
+}
diff --git a/tests/cpp/search_reference.hpp b/tests/cpp/search_reference.hpp
new file mode 100644
index 0000000..522c727
--- /dev/null
+++ b/tests/cpp/search_reference.hpp
@@ -0,0 +1,223 @@
+// An independent reference of the search semantics (docs/semantics.md#4-search) for the tests: the member graph
+// by an explicit per-pair choice, Bellman-Ford distances, the tight-edge DAG and the pruned
+// DAG by two-sided distances, and the canonical single path by enumerating every simple walk.
+// It shares no code with the traversal core (no queue, no lists, no extractor).
+#pragma once
+
+#include <algorithm>
+#include <cstdint>
+#include <map>
+#include <optional>
+#include <set>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/types.hpp"
+#include "test_int128.hpp"
+
+namespace netgraph::core::test::ref {
+
+// An exact priority: residual / capacity as a rational, or an integer (den 1); `inf` above all.
+struct Prio {
+  Int128 num {0};
+  Int128 den {1};
+  bool inf {false};
+};
+inline int cmp(const Prio& a, const Prio& b) {
+  if (a.inf || b.inf) return a.inf == b.inf ? 0 : (a.inf ? 1 : -1);
+  const Int128 l = a.num * b.den;
+  const Int128 r = b.num * a.den;
+  return l == r ? 0 : (l < r ? -1 : 1);
+}
+
+struct Query {
+  const Graph* g {nullptr};
+  const Eligibility* elig {nullptr};
+  const std::vector<Amount>* residual {nullptr};
+  Amount min_residual {1};
+  bool parallel_edges {true};
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  [[nodiscard]] bool prefer() const { return tie_break != RouteTieBreak::FewerHops; }
+};
+
+// Without a residual the availability is the static capacity (docs/semantics.md#4-search):
+// HIGHER_AVAILABLE_CAPACITY and HIGHER_CAPACITY read the capacity, HIGHER_HEADROOM capacity /
+// capacity. HIGHER_HEADROOM is 0 on an edge of capacity 0.
+inline Prio prio_of(const Query& q, EdgeId e) {
+  const auto ei = static_cast<std::size_t>(e);
+  const Amount cap = q.g->edge_capacity_units()[ei];
+  const Amount r = q.residual == nullptr ? cap : (*q.residual)[ei];
+  if (q.tie_break == RouteTieBreak::HigherCapacity) return {cap, 1, false};
+  if (q.tie_break == RouteTieBreak::HigherAvailableCapacity) return {r, 1, false};
+  if (cap == 0) return {0, 1, false};
+  return {r, cap, false};
+}
+
+// The member flags per edge: allowed, and with a residual at least min_residual of it; the
+// capacity is never read.
+inline std::vector<char> members(const Query& q) {
+  const Graph& g = *q.g;
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  std::vector<char> cand(m, 0);
+  for (std::size_t e = 0; e < m; ++e) {
+    if (q.elig != nullptr && !q.elig->allows_edge(static_cast<EdgeId>(e))) continue;
+    if (q.residual != nullptr && (*q.residual)[e] < q.min_residual) continue;
+    cand[e] = 1;
+  }
+  if (q.parallel_edges) return cand;
+  // The parallel-member choice (replaces()): the minimum cost, then the higher score under a HIGHER_* tie, then the lower id.
+  auto better = [&](EdgeId a, EdgeId b) {
+    const Cost ca = g.edge_costs()[static_cast<std::size_t>(a)];
+    const Cost cb = g.edge_costs()[static_cast<std::size_t>(b)];
+    if (ca != cb) return ca < cb;
+    if (q.prefer()) {
+      const int c = cmp(prio_of(q, a), prio_of(q, b));
+      if (c != 0) return c > 0;
+    }
+    return a < b;
+  };
+  std::map<std::pair<NodeId, NodeId>, EdgeId> best;
+  for (std::size_t e = 0; e < m; ++e) {
+    if (cand[e] == 0) continue;
+    const auto key = std::make_pair(g.edge_sources()[e], g.edge_destinations()[e]);
+    auto it = best.find(key);
+    if (it == best.end()) {
+      best[key] = static_cast<EdgeId>(e);
+    } else if (better(static_cast<EdgeId>(e), it->second)) {
+      it->second = static_cast<EdgeId>(e);
+    }
+  }
+  std::vector<char> out(m, 0);
+  for (const auto& [k, e] : best) out[static_cast<std::size_t>(e)] = 1;
+  return out;
+}
+
+constexpr Cost kNone = kUnreachable;
+
+// Bellman-Ford over the members: from the set (forward) or toward it (reverse).
+inline std::vector<Cost> distances(const Graph& g, const std::vector<char>& mem, const std::vector<NodeId>& set,
+                                   bool reverse) {
+  std::vector<Cost> d(static_cast<std::size_t>(g.num_nodes()), kNone);
+  for (NodeId v : set) d[static_cast<std::size_t>(v)] = 0;
+  for (bool changed = true; changed;) {
+    changed = false;
+    for (std::size_t e = 0; e < mem.size(); ++e) {
+      if (mem[e] == 0) continue;
+      const auto a = static_cast<std::size_t>(reverse ? g.edge_destinations()[e] : g.edge_sources()[e]);
+      const auto b = static_cast<std::size_t>(reverse ? g.edge_sources()[e] : g.edge_destinations()[e]);
+      if (d[a] == kNone) continue;
+      const Cost nd = d[a] + g.edge_costs()[e];
+      if (nd < d[b]) {
+        d[b] = nd;
+        changed = true;
+      }
+    }
+  }
+  return d;
+}
+
+// The full DAG of a search from (forward) or toward (reverse) the roots: tight member edges.
+inline std::set<EdgeId> full_dag(const Graph& g, const std::vector<char>& mem, const std::vector<Cost>& d, bool reverse) {
+  std::set<EdgeId> out;
+  for (std::size_t e = 0; e < mem.size(); ++e) {
+    if (mem[e] == 0) continue;
+    const Cost du = d[static_cast<std::size_t>(g.edge_sources()[e])];
+    const Cost dv = d[static_cast<std::size_t>(g.edge_destinations()[e])];
+    if (du == kNone || dv == kNone) continue;
+    if (reverse ? dv + g.edge_costs()[e] == du : du + g.edge_costs()[e] == dv) out.insert(static_cast<EdgeId>(e));
+  }
+  return out;
+}
+
+// The walks from the start set to the end set of minimum cost d*: (d*, their edges); d* kNone
+// when no end is reachable.
+inline std::pair<Cost, std::set<EdgeId>> pruned(const Graph& g, const std::vector<char>& mem,
+                                                const std::vector<NodeId>& starts, const std::vector<NodeId>& ends) {
+  const auto ds = distances(g, mem, starts, false);
+  const auto de = distances(g, mem, ends, true);
+  Cost dstar = kNone;
+  for (NodeId t : ends) dstar = std::min(dstar, ds[static_cast<std::size_t>(t)]);
+  std::set<EdgeId> out;
+  if (dstar == kNone) return {dstar, out};
+  for (std::size_t e = 0; e < mem.size(); ++e) {
+    if (mem[e] == 0) continue;
+    const Cost du = ds[static_cast<std::size_t>(g.edge_sources()[e])];
+    const Cost dv = de[static_cast<std::size_t>(g.edge_destinations()[e])];
+    if (du != kNone && dv != kNone && du + g.edge_costs()[e] + dv == dstar) out.insert(static_cast<EdgeId>(e));
+  }
+  return {dstar, out};
+}
+
+// Every simple walk from a start to an end (stopping at the first end entered) over the members.
+inline void walks(const Graph& g, const std::vector<char>& mem, NodeId u, const std::vector<char>& is_end,
+                  std::vector<EdgeId>& walk, std::vector<char>& on, std::vector<std::vector<EdgeId>>& out) {
+  if (is_end[static_cast<std::size_t>(u)] != 0) {
+    out.push_back(walk);
+    return;
+  }
+  for (std::size_t e = 0; e < mem.size(); ++e) {
+    if (mem[e] == 0 || g.edge_sources()[e] != u) continue;
+    const NodeId v = g.edge_destinations()[e];
+    if (on[static_cast<std::size_t>(v)] != 0) continue;
+    on[static_cast<std::size_t>(v)] = 1;
+    walk.push_back(static_cast<EdgeId>(e));
+    walks(g, mem, v, is_end, walk, on, out);
+    walk.pop_back();
+    on[static_cast<std::size_t>(v)] = 0;
+  }
+}
+
+// Every simple walk from any start to an end over the members (walks above, from each start).
+inline std::vector<std::vector<EdgeId>> all_walks(const Graph& g, const std::vector<char>& mem,
+                                                  const std::vector<NodeId>& starts, const std::vector<NodeId>& ends) {
+  std::vector<char> is_end(static_cast<std::size_t>(g.num_nodes()), 0);
+  for (NodeId t : ends) is_end[static_cast<std::size_t>(t)] = 1;
+  std::vector<std::vector<EdgeId>> all;
+  for (NodeId s : starts) {
+    std::vector<EdgeId> walk;
+    std::vector<char> on(static_cast<std::size_t>(g.num_nodes()), 0);
+    on[static_cast<std::size_t>(s)] = 1;
+    walks(g, mem, s, is_end, walk, on, all);
+  }
+  return all;
+}
+
+inline Cost walk_cost(const Graph& g, const std::vector<EdgeId>& walk) {
+  Cost x = 0;
+  for (EdgeId e : walk) x += g.edge_costs()[static_cast<std::size_t>(e)];
+  return x;
+}
+
+// A walk's bottleneck: its lowest priority value (cmp order).
+inline Prio bottleneck(const Query& q, const std::vector<EdgeId>& walk) {
+  Prio b {0, 1, true};
+  for (EdgeId e : walk) {
+    if (cmp(prio_of(q, e), b) < 0) b = prio_of(q, e);
+  }
+  return b;
+}
+
+// The canonical key (cost, -bottleneck under prefer, hops, edge-id sequence) as a strict order.
+inline bool key_less(const Query& q, const std::vector<EdgeId>& a, const std::vector<EdgeId>& b) {
+  const Cost ca = walk_cost(*q.g, a);
+  const Cost cb = walk_cost(*q.g, b);
+  if (ca != cb) return ca < cb;
+  if (q.prefer()) {
+    const int c = cmp(bottleneck(q, a), bottleneck(q, b));
+    if (c != 0) return c > 0;
+  }
+  if (a.size() != b.size()) return a.size() < b.size();
+  return a < b;
+}
+
+// The canonical single path from the start set to the end set, or nullopt.
+inline std::optional<std::vector<EdgeId>> canonical(const Query& q, const std::vector<char>& mem,
+                                                    const std::vector<NodeId>& starts, const std::vector<NodeId>& ends) {
+  const auto all = all_walks(*q.g, mem, starts, ends);
+  if (all.empty()) return std::nullopt;
+  return *std::min_element(all.begin(), all.end(), [&](const auto& a, const auto& b) { return key_less(q, a, b); });
+}
+
+} // namespace netgraph::core::test::ref
diff --git a/tests/cpp/search_tests.cpp b/tests/cpp/search_tests.cpp
new file mode 100644
index 0000000..fedfb6c
--- /dev/null
+++ b/tests/cpp/search_tests.cpp
@@ -0,0 +1,1274 @@
+// The search through the public spf and the traversal core's internal entries: the
+// member graph and replaces() (the parallel-member choice), the unique DAG in both directions and the values that reach
+// it only through the member graph, anycast pruning, the staged
+// canonical single path on its witness graphs (hand-built examples), the canonical predecessor order, both queues and
+// their dispatch, and agreement with an independent reference (search_reference.hpp) on random
+// graphs, one population of them built so that every rule of the single path's key decides
+// some trials.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <functional>
+#include <numeric>
+#include <optional>
+#include <queue>
+#include <random>
+#include <set>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/options.hpp"
+#include "netgraph/core/search.hpp"
+#include "search_reference.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// A route choice of spf: multipath, parallel_edges, tie_break.
+detail::RouteChoice sel(bool multipath = true, bool parallel_edges = true, RouteTieBreak tie = RouteTieBreak::FewerHops) {
+  return detail::RouteChoice {tie, multipath, parallel_edges};
+}
+
+constexpr RouteTieBreak kTieBreaks[] = {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity,
+                                        RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherHeadroom};
+
+SpfResult run(const Graph& g, std::vector<NodeId> roots, Direction dir, std::optional<std::vector<NodeId>> targets,
+              const detail::RouteChoice& s, const std::vector<Amount>* residual = nullptr, Amount min_residual = 1,
+              const Eligibility* elig = nullptr, SpfQueue queue = SpfQueue::Auto) {
+  SpfOptions o(dir);
+  o.tie_break = s.tie_break;
+  o.multipath = s.multipath;
+  o.parallel_edges = s.parallel_edges;
+  o.targets = std::move(targets);
+  if (residual != nullptr) o.residual = std::span<const Amount>(*residual);
+  o.min_residual = min_residual;
+  o.eligibility = elig;
+  return spf(g, roots, o, queue);
+}
+
+std::vector<EdgeId> edges_of(const PredecessorDAG& dag) {
+  std::vector<EdgeId> v(dag.via_edges().begin(), dag.via_edges().end());
+  std::sort(v.begin(), v.end());
+  return v;
+}
+
+std::vector<EdgeId> sorted(std::vector<EdgeId> v) {
+  std::sort(v.begin(), v.end());
+  return v;
+}
+
+// The DAG's canonical form: entries grouped by child, strictly ascending via within a child,
+// every via joining (parent, child); the internal ascending list equals the sorted via.
+void expect_canonical(const Graph& g, const PredecessorDAG& dag) {
+  const auto off = dag.parent_offsets();
+  ASSERT_EQ(off.size(), static_cast<std::size_t>(g.num_nodes()) + 1);
+  for (std::size_t v = 0; v + 1 < off.size(); ++v) {
+    for (auto k = off[v]; k < off[v + 1]; ++k) {
+      const auto e = static_cast<std::size_t>(dag.via_edges()[static_cast<std::size_t>(k)]);
+      EXPECT_EQ(g.edge_destinations()[e], static_cast<NodeId>(v));
+      EXPECT_EQ(g.edge_sources()[e], dag.parents()[static_cast<std::size_t>(k)]);
+      if (k > off[v]) EXPECT_LT(dag.via_edges()[static_cast<std::size_t>(k) - 1], dag.via_edges()[static_cast<std::size_t>(k)]);
+    }
+  }
+  const auto asc = detail::PredecessorDAGBuilder::ascending(dag);
+  EXPECT_EQ(std::vector<EdgeId>(asc.begin(), asc.end()), edges_of(dag));
+}
+
+} // namespace
+
+TEST(Search, MemberGraphIsEligibilityAndResidualNeverCapacity) {
+  // ids: 0: 0->1 cap 0, 1: 0->1 cap 3, 2: 0->1 cap 5 (cost 2), 3: 1->2 cap 4. A full search keeps
+  // the tight members, the zero-capacity id 0 included (capacity is never a condition): the
+  // cost-2 member is never tight while a cost-1 member exists.
+  auto g = make_graph(3, {{0, 1, 0, 1}, {0, 1, 3, 1}, {0, 1, 5, 2}, {1, 2, 4, 1}});
+  EXPECT_EQ(edges_of(run(g, {0}, Direction::Forward, std::nullopt, sel()).dag), (std::vector<EdgeId>{0, 1, 3}));
+  // A residual gates at min_residual: residual [0, 1, 5, 4] at 2 units removes id 1, so the
+  // cost-2 member carries node 1 (distance 2).
+  const std::vector<Amount> res = {0, 1, 5, 4};
+  auto gated = run(g, {0}, Direction::Forward, std::nullopt, sel(), &res, 2);
+  EXPECT_EQ(*gated.costs, (std::vector<Cost>{0, 2, 3}));
+  EXPECT_EQ(edges_of(gated.dag), (std::vector<EdgeId>{2, 3}));
+  // min_residual without a residual gates nothing.
+  auto static_only = run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 4);
+  EXPECT_EQ(*static_only.costs, (std::vector<Cost>{0, 1, 2}));
+  const std::vector<EdgeId> xe = {3};
+  auto el = g.eligibility({}, xe);
+  auto masked = run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, &el);
+  EXPECT_EQ(*masked.costs, (std::vector<Cost>{0, 1, kUnreachable}));
+}
+
+TEST(Search, CollapseBySelectAdjacency) {
+  // Parallel 0->1: id 0 cost 1 cap 2, id 1 cost 1 cap 6, id 2 cost 1 cap 4, id 3 cost 2 cap 9.
+  auto g = make_graph(2, {{0, 1, 2, 1}, {0, 1, 6, 1}, {0, 1, 4, 1}, {0, 1, 9, 2}});
+  auto member = [&](const detail::RouteChoice& s, const std::vector<Amount>* res = nullptr) {
+    return edges_of(run(g, {0}, Direction::Forward, std::nullopt, s, res).dag);
+  };
+  // Expand keeps every tight member; FEWER_HOPS Collapse the lowest EdgeId among the cheapest.
+  EXPECT_EQ(member(sel()), (std::vector<EdgeId>{0, 1, 2}));
+  // multipath and parallel_edges default to true: a full search keeping every tight member.
+  EXPECT_EQ(edges_of(spf(g, std::vector<NodeId> {0}, SpfOptions(Direction::Forward)).dag), (std::vector<EdgeId>{0, 1, 2}));
+  EXPECT_EQ(member(sel(true, false)), (std::vector<EdgeId>{0}));
+  // HIGHER_CAPACITY: the highest capacity among the cheapest.
+  EXPECT_EQ(member(sel(true, false, RouteTieBreak::HigherCapacity)), (std::vector<EdgeId>{1}));
+  // HIGHER_AVAILABLE_CAPACITY reads the residual; an equal residual keeps the lowest id.
+  const auto resid = sel(true, false, RouteTieBreak::HigherAvailableCapacity);
+  const std::vector<Amount> r1 = {2, 1, 2, 9};
+  const std::vector<Amount> r2 = {1, 1, 3, 9};
+  EXPECT_EQ(member(resid, &r1), (std::vector<EdgeId>{0}));
+  EXPECT_EQ(member(resid, &r2), (std::vector<EdgeId>{2}));
+  // HIGHER_HEADROOM compares residual / capacity exactly: 1/2 < 4/6 = 2/3 > 2/4.
+  const auto head = sel(true, false, RouteTieBreak::HigherHeadroom);
+  const std::vector<Amount> h1 = {1, 4, 2, 9};
+  const std::vector<Amount> h2 = {1, 1, 2, 9};
+  EXPECT_EQ(member(head, &h1), (std::vector<EdgeId>{1}));
+  // Equal rational headroom (2/4 == 1/2): the lowest EdgeId.
+  EXPECT_EQ(member(head, &h2), (std::vector<EdgeId>{0}));
+  // Without a residual HIGHER_AVAILABLE_CAPACITY reads the static capacities.
+  EXPECT_EQ(member(resid), (std::vector<EdgeId>{1}));
+}
+
+TEST(Search, HeadroomRationalsBeyondDoubles) {
+  // Headroom ratios a double cannot separate: (a - 1) / a < a / (a + 1) for a = 2^54, while both round to the
+  // same double. Parallel 0->1 members: id 0 residual a - 1 of capacity a, id 1 residual a of
+  // capacity a + 1; Headroom Collapse must keep id 1.
+  const Amount a = Amount {1} << 54;
+  auto g = make_graph(2, {{0, 1, a, 1}, {0, 1, a + 1, 1}});
+  const std::vector<Amount> res = {a - 1, a};
+  auto r = run(g, {0}, Direction::Forward, std::nullopt,
+               sel(true, false, RouteTieBreak::HigherHeadroom), &res);
+  EXPECT_EQ(edges_of(r.dag), (std::vector<EdgeId>{1}));
+}
+
+TEST(Search, FullDagForwardAndReverse) {
+  // Diamond with a parallel member and a longer branch: 0->1, 0->1, 0->2 (cost 2), 1->3, 2->3.
+  auto g = make_graph(4, {{0, 1, 1, 1}, {0, 1, 1, 1}, {0, 2, 1, 2}, {1, 3, 1, 1}, {2, 3, 1, 1}});
+  auto f = run(g, {0}, Direction::Forward, std::nullopt, sel());
+  ASSERT_TRUE(f.costs.has_value());
+  EXPECT_FALSE(f.target_cost.has_value());
+  EXPECT_EQ(*f.costs, (std::vector<Cost>{0, 1, 2, 2}));
+  // Tight edges: both parallel members, 0->2 (d(2) = 2) and 1->3; 2->3 is not tight (2 + 1 > 2).
+  EXPECT_EQ(edges_of(f.dag), (std::vector<EdgeId>{0, 1, 2, 3}));
+  expect_canonical(g, f.dag);
+  auto r = run(g, {3}, Direction::Reverse, std::nullopt, sel());
+  EXPECT_EQ(*r.costs, (std::vector<Cost>{2, 1, 1, 0}));
+  // The reverse DAG toward 3 is the forward-oriented set of tight edges toward 3. It differs from
+  // the forward DAG from 0 although 3 is a node that search reaches: each search keeps the edges
+  // tight in its own direction (0->2 forward only, 2->3 reverse only).
+  EXPECT_EQ(edges_of(r.dag), (std::vector<EdgeId>{0, 1, 3, 4}));
+  expect_canonical(g, r.dag);
+  // On the same root the directions differ too: no edge enters 0, so the reverse DAG is empty.
+  EXPECT_TRUE(run(g, {0}, Direction::Reverse, std::nullopt, sel()).dag.via_edges().empty());
+  // Unreached nodes keep kUnreachable.
+  auto u = run(g, {2}, Direction::Forward, std::nullopt, sel());
+  EXPECT_EQ(*u.costs, (std::vector<Cost>{kUnreachable, kUnreachable, 0, 1}));
+}
+
+TEST(Search, PredecessorOrderIsAscendingViaIndependentlyOfDiscovery) {
+  // A four-node witness: ids 0: 0->1 (1), 1: 0->2 (2), 2: 1->3 (2), 3: 2->3 (1).
+  // Node 3's tight parents are discovered via 2 (from node 1, settled first) and then via 3; the
+  // list holds them newest first, [3, 2]; the DAG must list [2, 3] whatever the queue.
+  auto g = make_graph(4, {{0, 1, 1, 1}, {0, 2, 1, 2}, {1, 3, 1, 2}, {2, 3, 1, 1}});
+  for (auto q : {SpfQueue::Auto, SpfQueue::Heap}) {
+    for (bool targets : {false, true}) {
+      auto r = run(g, {0}, Direction::Forward, targets ? std::optional<std::vector<NodeId>>(std::vector<NodeId> {3})
+                                                       : std::nullopt,
+                   sel(), nullptr, 1, nullptr, q);
+      const auto off = r.dag.parent_offsets();
+      ASSERT_EQ(off[4] - off[3], 2);
+      EXPECT_EQ(r.dag.via_edges()[static_cast<std::size_t>(off[3])], 2);
+      EXPECT_EQ(r.dag.via_edges()[static_cast<std::size_t>(off[3]) + 1], 3);
+      expect_canonical(g, r.dag);
+    }
+  }
+  // The same through the reverse search, whose lists hang on the tails.
+  auto rev = run(g, {3}, Direction::Reverse, std::nullopt, sel());
+  expect_canonical(g, rev.dag);
+  EXPECT_EQ(edges_of(rev.dag), (std::vector<EdgeId>{0, 1, 2, 3}));
+}
+
+// The canonical-form check reports each defect of a hand-built DAG: a descending via within a
+// child, a wrong parent, an entry under a child its edge does not enter, an ascending list that
+// is not the sorted via; the correct DAG passes.
+TEST(Search, CanonicalFormCheckReportsEachDefect) {
+  // ids: 0: 0->1, 1: 0->1, 2: 0->2 (cost 2), 3: 1->2.
+  auto g = make_graph(3, {{0, 1, 1, 1}, {0, 1, 1, 1}, {0, 2, 1, 2}, {1, 2, 1, 1}});
+  const auto failures = [&](std::vector<NodeId> nodes, std::vector<std::int32_t> offsets, std::vector<NodeId> parents,
+                            std::vector<EdgeId> via, std::vector<EdgeId> ascending) {
+    const auto dag = detail::PredecessorDAGBuilder::of_parts(g, std::move(nodes), std::move(offsets), std::move(parents),
+                                                      std::move(via), std::move(ascending));
+    return failures_of([&] { expect_canonical(g, dag); });
+  };
+  EXPECT_EQ(failures({1, 2}, {0, 2, 3}, {0, 0, 1}, {0, 1, 3}, {0, 1, 3}), 0);
+  EXPECT_GT(failures({1, 2}, {0, 2, 3}, {0, 0, 1}, {1, 0, 3}, {0, 1, 3}), 0) << "descending via";
+  EXPECT_GT(failures({1, 2}, {0, 2, 3}, {0, 0, 0}, {0, 1, 3}, {0, 1, 3}), 0) << "wrong parent";
+  EXPECT_GT(failures({1}, {0, 3}, {0, 0, 1}, {0, 1, 3}, {0, 1, 3}), 0) << "wrong child";
+  EXPECT_GT(failures({1, 2}, {0, 2, 3}, {0, 0, 1}, {0, 1, 3}, {0, 1, 2}), 0) << "ascending list";
+}
+
+TEST(Search, AnycastPruningAndDirectionIndependence) {
+  // 0->1 (1), 1->2 (1), 0->3 (2), 3->2 (5), 1->4 (5): targets {2, 4}: nearest is 2 at cost 2.
+  auto g = make_graph(5, {{0, 1, 1, 1}, {1, 2, 1, 1}, {0, 3, 1, 2}, {3, 2, 1, 5}, {1, 4, 1, 5}});
+  const auto inv = id_of_input(g);
+  auto f = run(g, {0}, Direction::Forward, std::vector<NodeId> {2, 4}, sel());
+  ASSERT_TRUE(f.target_cost.has_value());
+  EXPECT_EQ(*f.target_cost, 2);
+  EXPECT_FALSE(f.costs.has_value());
+  EXPECT_EQ(edges_of(f.dag), sorted({inv[0], inv[1]}));
+  // A reverse search rooted at the targets with the source as its target: the same edges.
+  auto r = run(g, {2, 4}, Direction::Reverse, std::vector<NodeId> {0}, sel());
+  EXPECT_EQ(edges_of(r.dag), edges_of(f.dag));
+  EXPECT_EQ(r.target_cost, f.target_cost);
+  // No reachable target: kUnreachable, no edges.
+  auto none = run(g, {2}, Direction::Forward, std::vector<NodeId> {0}, sel());
+  EXPECT_EQ(none.target_cost, kUnreachable);
+  EXPECT_TRUE(none.dag.via_edges().empty());
+}
+
+TEST(Search, AnycastKeepsEveryEquallyNearTarget) {
+  // Two targets at the same distance through different branches, a third farther: the search
+  // stops at the first target popped but keeps the walks to both nearest ones.
+  // ids by input: 0: 0->1, 1: 0->2, 2: 1->3, 3: 2->4, 4: 0->5 (cost 5).
+  auto g = make_graph(6, {{0, 1, 1, 1}, {0, 2, 1, 1}, {1, 3, 1, 1}, {2, 4, 1, 1}, {0, 5, 1, 5}});
+  const auto inv = id_of_input(g);
+  for (auto q : {SpfQueue::Auto, SpfQueue::Heap}) {
+    auto r = run(g, {0}, Direction::Forward, std::vector<NodeId> {3, 4, 5}, sel(), nullptr, 1, nullptr, q);
+    EXPECT_EQ(r.target_cost, 2);
+    EXPECT_EQ(edges_of(r.dag), sorted({inv[0], inv[1], inv[2], inv[3]}));
+  }
+}
+
+TEST(Search, ExcludedRootsAndTargetsAreSkipped) {
+  auto g = make_graph(3, {{0, 1, 1, 1}, {1, 2, 1, 1}});
+  const std::vector<NodeId> xn = {0};
+  auto el = g.eligibility(xn, {});
+  auto r = run(g, {0}, Direction::Forward, std::vector<NodeId> {2}, sel(), nullptr, 1, &el);
+  EXPECT_EQ(r.target_cost, kUnreachable);
+  EXPECT_TRUE(r.dag.via_edges().empty());
+  auto full = run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, &el);
+  EXPECT_EQ(*full.costs, (std::vector<Cost>{kUnreachable, kUnreachable, kUnreachable}));
+  // An excluded root in a set is skipped; the others search.
+  auto two = run(g, {0, 1}, Direction::Forward, std::nullopt, sel(), nullptr, 1, &el);
+  EXPECT_EQ(*two.costs, (std::vector<Cost>{kUnreachable, 0, 1}));
+  // An excluded target is unreachable; another target still counts.
+  const std::vector<NodeId> x2 = {2};
+  auto el2 = g.eligibility(x2, {});
+  auto t = run(g, {0}, Direction::Forward, std::vector<NodeId> {1, 2}, sel(), nullptr, 1, &el2);
+  EXPECT_EQ(t.target_cost, 1);
+}
+
+TEST(Search, ValidationBeforeAnyWorkInTheContractOrder) {
+  auto g = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  auto other = make_graph(3, {{0, 1, 2, 1}});
+  auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  const std::vector<Amount> short_res = {1};
+  const std::vector<Amount> big_res = {1, 3};
+  const std::vector<Amount> ok_res = {1, 1};
+  EXPECT_EQ(error_of([&] { (void)run(g, {}, Direction::Forward, std::nullopt, sel()); }), "roots: the node set is empty");
+  EXPECT_EQ(error_of([&] { (void)run(g, {3}, Direction::Forward, std::nullopt, sel()); }),
+            "roots: node 3 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::vector<NodeId> {}, sel()); }),
+            "targets: the node set is empty");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::vector<NodeId> {-1}, sel()); }),
+            "targets: node -1 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0, 1}, Direction::Forward, std::vector<NodeId> {1}, sel()); }),
+            "node 1 is in both endpoint sets: roots and targets must not overlap");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(false)); }),
+            "multipath = false requires targets (the single path joins a root to a target)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), &short_res); }),
+            "residual has length 1, expected 2 (one entry per edge)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), &big_res); }),
+            "residual[1] = 3 is outside [0, edge_capacity_units[1] = 2]");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 0); }),
+            "min_residual must be at least 1 unit (got 0)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, &foreign); }),
+            "foreign Eligibility: built for another graph");
+  // The order when several defects apply: roots before targets before the overlap before the
+  // single path before the ineffective tie before the residual before min_residual before the
+  // Eligibility.
+  EXPECT_EQ(error_of([&] { (void)run(g, {}, Direction::Forward, std::vector<NodeId> {}, sel()); }),
+            "roots: the node set is empty");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::vector<NodeId> {0, 7}, sel()); }),
+            "targets: node 7 out of node range [0, 3)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::vector<NodeId> {0}, sel(), &short_res); }),
+            "node 0 is in both endpoint sets: roots and targets must not overlap");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(false), &short_res, 0); }),
+            "multipath = false requires targets (the single path joins a root to a target)");
+  EXPECT_EQ(error_of([&] {
+              (void)run(g, {0}, Direction::Forward, std::nullopt, sel(true, true, RouteTieBreak::HigherCapacity),
+                        &short_res, 0);
+            }),
+            "spf tie_break requires multipath=False or parallel_edges=False");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), &big_res, 0, &foreign); }),
+            "residual[1] = 3 is outside [0, edge_capacity_units[1] = 2]");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), &ok_res, 0, &foreign); }),
+            "min_residual must be at least 1 unit (got 0)");
+  // Every root excluded with valid sets is an empty result, never an error; an excluded root
+  // does not excuse a defect.
+  const std::vector<NodeId> all = {0, 1, 2};
+  auto none = g.eligibility(all, {});
+  EXPECT_EQ(run(g, {0}, Direction::Forward, std::vector<NodeId> {2}, sel(), nullptr, 1, &none).target_cost, kUnreachable);
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::vector<NodeId> {0}, sel(), nullptr, 1, &none); }),
+            "node 0 is in both endpoint sets: roots and targets must not overlap");
+  // Enumeration values outside their enumeration, at construction and at the entry.
+  EXPECT_EQ(error_of([&] { SpfOptions o(static_cast<Direction>(9)); }), "direction: 9 is not a value of Direction");
+  SpfOptions bad(Direction::Forward);
+  bad.direction = static_cast<Direction>(7);
+  EXPECT_EQ(error_of([&] { (void)spf(g, std::vector<NodeId> {0}, bad); }), "direction: 7 is not a value of Direction");
+  SpfOptions bad_tie(Direction::Forward);
+  bad_tie.tie_break = static_cast<RouteTieBreak>(5);
+  EXPECT_EQ(error_of([&] { (void)spf(g, std::vector<NodeId> {0}, bad_tie); }),
+            "tie_break: 5 is not a value of RouteTieBreak");
+  SpfOptions good(Direction::Forward);
+  EXPECT_EQ(error_of([&] { (void)spf(g, std::vector<NodeId> {0}, good, static_cast<SpfQueue>(3)); }),
+            "queue: 3 is not a value of SpfQueue");
+  // The enumerations come before every other check, in the order direction, tie_break, the queue.
+  // Each call has every later defect too (empty roots, multipath = false without targets, a short
+  // residual, min_residual 0, a foreign Eligibility); repairing the reported defect moves the
+  // error to the next one.
+  SpfOptions every(Direction::Forward);
+  every.multipath = false;
+  every.residual = std::span<const Amount>(short_res);
+  every.min_residual = 0;
+  every.eligibility = &foreign;
+  every.direction = static_cast<Direction>(7);
+  every.tie_break = static_cast<RouteTieBreak>(6);
+  const auto bad_queue = static_cast<SpfQueue>(3);
+  const auto staircase_error = [&] { return error_of([&] { (void)spf(g, std::vector<NodeId> {}, every, bad_queue); }); };
+  EXPECT_EQ(staircase_error(), "direction: 7 is not a value of Direction");
+  every.direction = Direction::Forward;
+  EXPECT_EQ(staircase_error(), "tie_break: 6 is not a value of RouteTieBreak");
+  every.tie_break = RouteTieBreak::FewerHops;
+  EXPECT_EQ(staircase_error(), "queue: 3 is not a value of SpfQueue");
+  EXPECT_EQ(error_of([&] { (void)spf(g, std::vector<NodeId> {}, every, SpfQueue::Auto); }), "roots: the node set is empty");
+}
+
+// A residual array with several defects at once (one error, from the shared edge-amount check): its
+// length before any entry, then its first entry outside [0, capacity] in EdgeId order, before
+// min_residual and the Eligibility; in both directions, with and without targets.
+TEST(Search, ResidualDefectsReportTheFirstInOrder) {
+  const auto g = edge_amount_graph();
+  const auto other = make_graph(4, {{0, 1, 2, 1}});
+  const auto foreign = other.eligibility({}, std::vector<EdgeId> {0});
+  for (const auto& c : edge_amount_defects()) {
+    for (auto dir : {Direction::Forward, Direction::Reverse}) {
+      EXPECT_EQ(error_of([&] { (void)run(g, {0}, dir, std::nullopt, sel(), &c.amounts, 0, &foreign); }),
+                "residual" + c.error);
+      EXPECT_EQ(error_of([&] { (void)run(g, {0}, dir, std::vector<NodeId> {3}, sel(false), &c.amounts, 0, &foreign); }),
+                "residual" + c.error);
+    }
+  }
+  const auto bounds = edge_amounts_at_the_bounds();
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(), &bounds); }), "");
+}
+
+TEST(Search, StagedPathWithASharedBottleneckTakesTheFewestHops) {
+  // s=0 -> v=1 cost 1 prio 1; v -> t=4 cost 3 prio 1; v -> a=2 -> b=3 -> t costs 1+1+1 prio 2.
+  // Capacities carry the score. Under HIGHER_CAPACITY the bottleneck of every walk is 1 (the shared
+  // s->v), so B* = 1 and the canonical walk is the two-hop s, v, t.
+  auto g = make_graph(5, {{0, 1, 1, 1}, {1, 4, 1, 3}, {1, 2, 2, 1}, {2, 3, 2, 1}, {3, 4, 2, 1}});
+  const auto inv = id_of_input(g);
+  for (auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity}) {
+    auto r = run(g, {0}, Direction::Forward, std::vector<NodeId> {4}, sel(false, true, tie));
+    EXPECT_EQ(edges_of(r.dag), sorted({inv[0], inv[1]}));
+    EXPECT_EQ(r.target_cost, 4);
+    // The reverse call with the roles swapped returns the same walk.
+    auto rev = run(g, {4}, Direction::Reverse, std::vector<NodeId> {0}, sel(false, true, tie));
+    EXPECT_EQ(edges_of(rev.dag), edges_of(r.dag));
+  }
+}
+
+TEST(Search, StagedPathBottleneckThenHopsThenIds) {
+  // Two cost-2 walks 0->1->3 (caps 5, 1) and 0->2->3 (caps 3, 3), and a cost-2 direct edge
+  // 0->3 of capacity 2. FEWER_HOPS: fewest hops, the direct edge. HIGHER_CAPACITY: B* = 3
+  // (0->2->3), so the two-hop walk.
+  auto g = make_graph(4, {{0, 1, 5, 1}, {1, 3, 1, 1}, {0, 2, 3, 1}, {2, 3, 3, 1}, {0, 3, 2, 2}});
+  const auto inv = id_of_input(g);
+  auto det = run(g, {0}, Direction::Forward, std::vector<NodeId> {3}, sel(false));
+  EXPECT_EQ(edges_of(det.dag), (std::vector<EdgeId>{inv[4]}));
+  auto pri = run(g, {0}, Direction::Forward, std::vector<NodeId> {3},
+                 sel(false, true, RouteTieBreak::HigherCapacity));
+  EXPECT_EQ(edges_of(pri.dag), sorted({inv[2], inv[3]}));
+  // HIGHER_AVAILABLE_CAPACITY reads the residual: on capacities 5 everywhere and residuals by input
+  // [5, 4, 1, 3, 2], 0->1->3 has bottleneck 4, 0->2->3 has 1, the direct edge 2: B* = 4.
+  auto g5 = make_graph(4, {{0, 1, 5, 1}, {1, 3, 5, 1}, {0, 2, 5, 1}, {2, 3, 5, 1}, {0, 3, 5, 2}});
+  const auto inv5 = id_of_input(g5);
+  const auto residual = to_ids(g5, std::vector<Amount> {5, 4, 1, 3, 2});
+  auto res = run(g5, {0}, Direction::Forward, std::vector<NodeId> {3},
+                 sel(false, true, RouteTieBreak::HigherAvailableCapacity), &residual);
+  EXPECT_EQ(edges_of(res.dag), sorted({inv5[0], inv5[1]}));
+  // HIGHER_CAPACITY on the same graph: every walk has bottleneck 5, so hops decide.
+  auto cap5 = run(g5, {0}, Direction::Forward, std::vector<NodeId> {3},
+                  sel(false, true, RouteTieBreak::HigherCapacity), &residual);
+  EXPECT_EQ(edges_of(cap5.dag), (std::vector<EdgeId>{inv5[4]}));
+  // FEWER_HOPS ignores capacities and residuals entirely.
+  auto det_res = run(g5, {0}, Direction::Forward, std::vector<NodeId> {3}, sel(false), &residual);
+  EXPECT_EQ(edges_of(det_res.dag), (std::vector<EdgeId>{inv5[4]}));
+}
+
+TEST(Search, StagedPathPrefixTrapNeedsTheFullKey) {
+  // A cost-2 direct prefix 0->2 with bottleneck 5 against a two-edge
+  // cost-2 prefix 0->1->2 with bottleneck 10, then a cost-1 edge of priority 1 to the target 3.
+  // Both complete walks cost 3 with bottleneck 1, so hops decide: [0->2, 2->3]. A search that kept
+  // only the wider prefix would return the three-hop walk.
+  auto g = make_graph(4, {{0, 2, 5, 2}, {0, 1, 10, 1}, {1, 2, 10, 1}, {2, 3, 1, 1}});
+  const auto inv = id_of_input(g);
+  for (auto dir : {Direction::Forward, Direction::Reverse}) {
+    auto r = dir == Direction::Forward
+                 ? run(g, {0}, dir, std::vector<NodeId> {3}, sel(false, true, RouteTieBreak::HigherCapacity))
+                 : run(g, {3}, dir, std::vector<NodeId> {0}, sel(false, true, RouteTieBreak::HigherCapacity));
+    EXPECT_EQ(edges_of(r.dag), sorted({inv[0], inv[3]}));
+  }
+}
+
+TEST(Search, MultiRootSinglePathStartsAtTheNearestRootByHops) {
+  // Roots {0, 1}, both at cost 0; 0 -> 3 in one hop of cost 2 and 1 -> 2 -> 3 in two hops of
+  // cost 1 each: the walk of fewest hops (from root 0).
+  auto g = make_graph(4, {{0, 3, 1, 2}, {1, 2, 1, 1}, {2, 3, 1, 1}});
+  const auto inv = id_of_input(g);
+  auto r = run(g, {0, 1}, Direction::Forward, std::vector<NodeId> {3}, sel(false));
+  EXPECT_EQ(edges_of(r.dag), (std::vector<EdgeId>{inv[0]}));
+}
+
+TEST(Search, StagedPathTiesGoToTheSmallerEdgeIdSequence) {
+  // The diamond (0-1-3 and 0-2-3 both cost 10) takes 0-2-3,
+  // whose edge-id sequence is smaller; the equal three-hop graph takes 0-1-4-5. Every tie_break
+  // (all capacities 1: score ties), both directions.
+  auto diamond = make_graph(4, {{0, 1, 1, 9}, {0, 2, 1, 1}, {1, 3, 1, 1}, {2, 3, 1, 9}});
+  auto three = make_graph(6, {{0, 2, 1, 1}, {2, 3, 1, 1}, {3, 5, 1, 1}, {0, 1, 1, 1}, {1, 4, 1, 1}, {4, 5, 1, 1}});
+  auto nodes_of = [](const Graph& g, const PredecessorDAG& dag) {
+    std::set<NodeId> out;
+    for (EdgeId e : edges_of(dag)) {
+      out.insert(g.edge_sources()[static_cast<std::size_t>(e)]);
+      out.insert(g.edge_destinations()[static_cast<std::size_t>(e)]);
+    }
+    return out;
+  };
+  for (auto tie : kTieBreaks) {
+    {
+      const auto s = sel(false, true, tie);
+      auto a = run(diamond, {0}, Direction::Forward, std::vector<NodeId> {3}, s);
+      EXPECT_EQ(nodes_of(diamond, a.dag), (std::set<NodeId>{0, 2, 3}));
+      auto ar = run(diamond, {3}, Direction::Reverse, std::vector<NodeId> {0}, s);
+      EXPECT_EQ(edges_of(ar.dag), edges_of(a.dag));
+      auto b = run(three, {0}, Direction::Forward, std::vector<NodeId> {5}, s);
+      EXPECT_EQ(nodes_of(three, b.dag), (std::set<NodeId>{0, 1, 4, 5}));
+      auto br = run(three, {5}, Direction::Reverse, std::vector<NodeId> {0}, s);
+      EXPECT_EQ(edges_of(br.dag), edges_of(b.dag));
+    }
+  }
+}
+
+namespace {
+
+// One random query against the reference (search_reference.hpp), on both queues.
+struct RandomCase {
+  Graph g;
+  std::vector<Amount> residual;
+  bool use_res;
+  Amount min_residual;
+  std::optional<Eligibility> elig;
+  detail::RouteChoice choice;
+  Direction direction;
+  std::vector<NodeId> roots;
+  std::optional<std::vector<NodeId>> targets;
+};
+
+// The expected result of a query by the reference: costs, the DAG's edges, target_cost.
+struct Expected {
+  std::optional<std::vector<Cost>> costs;
+  std::vector<EdgeId> edges;
+  std::optional<Cost> target_cost;
+};
+
+ref::Query query_of(const RandomCase& c) {
+  ref::Query q;
+  q.g = &c.g;
+  q.elig = c.elig ? &*c.elig : nullptr;
+  q.residual = c.use_res ? &c.residual : nullptr;
+  q.min_residual = c.min_residual;
+  q.parallel_edges = c.choice.parallel_edges;
+  q.tie_break = c.choice.tie_break;
+  return q;
+}
+
+Expected expect_of(const RandomCase& c) {
+  const Graph& g = c.g;
+  const ref::Query q = query_of(c);
+  const auto mem = ref::members(q);
+  const auto roots = allowed_nodes(c.roots, q.elig);
+  const bool reverse = c.direction == Direction::Reverse;
+  Expected out;
+  if (!c.targets.has_value()) {
+    auto d = ref::distances(g, mem, roots, reverse);
+    const auto dag = ref::full_dag(g, mem, d, reverse);
+    out.costs = d;
+    out.edges.assign(dag.begin(), dag.end());
+    return out;
+  }
+  const auto targets = allowed_nodes(*c.targets, q.elig);
+  out.target_cost = kUnreachable;
+  if (roots.empty() || targets.empty()) return out;
+  const auto& starts = reverse ? targets : roots;
+  const auto& ends = reverse ? roots : targets;
+  auto [dstar, edges] = ref::pruned(g, mem, starts, ends);
+  if (dstar == ref::kNone) return out;
+  out.target_cost = dstar;
+  if (!c.choice.single_path()) {
+    out.edges.assign(edges.begin(), edges.end());
+  } else {
+    auto walk = ref::canonical(q, mem, starts, ends);
+    out.edges = sorted(*walk);
+  }
+  return out;
+}
+
+} // namespace
+
+// A HIGHER_* tie_break with multipath and parallel_edges both true is rejected (nothing to choose);
+// such a draw checks the rejection, then runs with FEWER_HOPS.
+TEST(Search, RandomQueriesAgreeWithTheReferenceOnBothQueues) {
+  std::mt19937 rng(20261006);
+  int full = 0;         // full searches that keep an edge
+  int multipath = 0;    // multipath target searches that reach a target
+  int single = 0;       // single-path target searches that reach a target
+  int ineffective = 0;  // draws of the rejected combination
+  for (int trial = 0; trial < 3000; ++trial) {
+    const int n = 2 + static_cast<int>(rng() % 7);
+    const int m = static_cast<int>(rng() % 16);
+    const Cost max_edge_cost = (trial % 5 == 0) ? 40 : 4;
+    const Cost scale = (trial % 7 == 0) ? 3 : 1;  // a common gcd above 1
+    RandomCase c {random_graph(rng, n, m, max_edge_cost, scale), {}, (rng() % 2) == 0, 1 + static_cast<Amount>(rng() % 3),
+                  std::nullopt, sel(),
+                  (rng() % 2) == 0 ? Direction::Forward : Direction::Reverse, {}, std::nullopt};
+    c.residual.resize(static_cast<std::size_t>(c.g.num_edges()));
+    for (std::size_t e = 0; e < c.residual.size(); ++e) {
+      const Amount cap = c.g.edge_capacity_units()[e];
+      c.residual[e] = cap == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cap + 1));
+    }
+    if (rng() % 3 == 0) {
+      std::vector<NodeId> xn;
+      std::vector<EdgeId> xe;
+      if (rng() % 2 == 0) xn.push_back(static_cast<NodeId>(rng() % static_cast<unsigned>(n)));
+      if (c.g.num_edges() > 0 && rng() % 2 == 0) xe.push_back(static_cast<EdgeId>(rng() % static_cast<unsigned>(c.g.num_edges())));
+      c.elig = c.g.eligibility(xn, xe);
+    }
+    const RouteTieBreak higher[3] = {RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherCapacity,
+                                     RouteTieBreak::HigherHeadroom};
+    const bool with_targets = (rng() % 3) != 0;
+    const bool prefer = (rng() % 2) != 0;
+    const RouteTieBreak tie = prefer ? higher[rng() % 3] : RouteTieBreak::FewerHops;
+    const bool mp = !with_targets || (rng() % 2) == 0;
+    c.choice = sel(mp, (rng() % 2) == 0, tie);
+    // Disjoint random root and target sets (duplicates allowed in the input).
+    std::vector<NodeId> perm(static_cast<std::size_t>(n));
+    std::iota(perm.begin(), perm.end(), 0);
+    std::shuffle(perm.begin(), perm.end(), rng);
+    const std::size_t nr = 1 + rng() % static_cast<unsigned>(std::max(1, n / 2));
+    c.roots.assign(perm.begin(), perm.begin() + static_cast<std::ptrdiff_t>(nr));
+    if (rng() % 4 == 0) c.roots.push_back(c.roots.front());
+    if (with_targets) {  // never empty: nr <= n / 2 < n
+      const std::size_t nt = 1 + rng() % static_cast<unsigned>(std::max<std::size_t>(1, perm.size() - nr));
+      c.targets = std::vector<NodeId>(perm.begin() + static_cast<std::ptrdiff_t>(nr),
+                                      perm.begin() + static_cast<std::ptrdiff_t>(std::min(perm.size(), nr + nt)));
+    }
+    if (c.choice.prefers_score() && c.choice.multipath && c.choice.parallel_edges) {
+      ASSERT_EQ(error_of([&] {
+                  (void)run(c.g, c.roots, c.direction, c.targets, c.choice, c.use_res ? &c.residual : nullptr,
+                            c.min_residual, c.elig ? &*c.elig : nullptr);
+                }),
+                "spf tie_break requires multipath=False or parallel_edges=False")
+          << "trial " << trial;
+      ++ineffective;
+      c.choice.tie_break = RouteTieBreak::FewerHops;
+    }
+    const auto want = expect_of(c);
+    for (auto queue : {SpfQueue::Auto, SpfQueue::Heap}) {
+      auto got = run(c.g, c.roots, c.direction, c.targets, c.choice, c.use_res ? &c.residual : nullptr, c.min_residual,
+                     c.elig ? &*c.elig : nullptr, queue);
+      ASSERT_EQ(got.costs, want.costs) << "trial " << trial;
+      ASSERT_EQ(edges_of(got.dag), want.edges) << "trial " << trial << " queue " << static_cast<int>(queue);
+      ASSERT_EQ(got.target_cost, want.target_cost) << "trial " << trial;
+      expect_canonical(c.g, got.dag);
+    }
+    full += !c.targets.has_value() && !want.edges.empty() ? 1 : 0;
+    const bool reached = c.targets.has_value() && want.target_cost != kUnreachable;
+    multipath += reached && !c.choice.single_path() ? 1 : 0;
+    single += reached && c.choice.single_path() ? 1 : 0;
+  }
+  EXPECT_GT(full, 300);
+  EXPECT_GT(multipath, 300);
+  EXPECT_GT(single, 300);
+  EXPECT_GT(ineffective, 300);
+}
+
+namespace {
+
+// Whether the hop count decides a single-path query's canonical walk: another walk ties it on
+// cost (and bottleneck under a HIGHER_* tie_break) with more hops but a smaller edge-id sequence.
+bool hops_decide(const RandomCase& c) {
+  const ref::Query q = query_of(c);
+  const auto mem = ref::members(q);
+  const bool reverse = c.direction == Direction::Reverse;
+  const auto roots = allowed_nodes(c.roots, q.elig);
+  const auto targets = allowed_nodes(*c.targets, q.elig);
+  const auto& starts = reverse ? targets : roots;
+  const auto& ends = reverse ? roots : targets;
+  const auto canonical = ref::canonical(q, mem, starts, ends);
+  if (!canonical) return false;
+  const std::vector<EdgeId>& walk = *canonical;
+  for (const auto& w : ref::all_walks(c.g, mem, starts, ends)) {
+    if (ref::walk_cost(c.g, w) == ref::walk_cost(c.g, walk) &&
+        (!q.prefer() || ref::cmp(ref::bottleneck(q, w), ref::bottleneck(q, walk)) == 0) && w.size() > walk.size() &&
+        w < walk) {
+      return true;
+    }
+  }
+  return false;
+}
+
+} // namespace
+
+// The single-path rules that the random comparison above reaches only now and then, on a
+// population built for them: a few nodes joined by many parallel edges of cost 1 or 2, a residual
+// on every query, one root and one target. Each rule is guarded by the trials in which it decides
+// the reference's answer, against a twin query without it: the HIGHER_HEADROOM ratio (the twin
+// reads the residual alone), HIGHER_CAPACITY (the twin reads the residual), the bottleneck key of a
+// HIGHER_* tie_break (the twin takes FEWER_HOPS, on Expand member graphs, where the tie_break
+// decides nothing else), and the hop count (hops_decide). Both queues agree with the reference on
+// every trial.
+TEST(Search, RandomSinglePathsExerciseEveryKeyRule) {
+  std::mt19937 rng(20261010);
+  int headroom = 0, capacity = 0, bottleneck = 0, hops = 0;
+  for (int trial = 0; trial < 8000; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 4);
+    const int m = 6 + static_cast<int>(rng() % 14);
+    const RouteTieBreak higher[3] = {RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherCapacity,
+                                     RouteTieBreak::HigherHeadroom};
+    const RouteTieBreak prio = higher[rng() % 3];
+    const bool prefer = rng() % 4 != 0;
+    const bool expand = rng() % 2 == 0;
+    RandomCase c {random_graph(rng, n, m, 2), {}, true, 1, std::nullopt,
+                  sel(false, expand, prefer ? prio : RouteTieBreak::FewerHops),
+                  (rng() % 2) == 0 ? Direction::Forward : Direction::Reverse, {}, std::nullopt};
+    c.residual.resize(static_cast<std::size_t>(c.g.num_edges()));
+    for (std::size_t e = 0; e < c.residual.size(); ++e) {
+      const Amount cap = c.g.edge_capacity_units()[e];
+      c.residual[e] = cap == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cap + 1));
+    }
+    const auto root = static_cast<NodeId>(rng() % static_cast<unsigned>(n));
+    c.roots = {root};
+    c.targets = std::vector<NodeId> {static_cast<NodeId>((root + 1 + rng() % static_cast<unsigned>(n - 1)) % n)};
+    const auto want = expect_of(c);
+    for (auto queue : {SpfQueue::Auto, SpfQueue::Heap}) {
+      auto got = run(c.g, c.roots, c.direction, c.targets, c.choice, &c.residual, c.min_residual, nullptr, queue);
+      ASSERT_EQ(edges_of(got.dag), want.edges) << "trial " << trial << " queue " << static_cast<int>(queue);
+      ASSERT_EQ(got.target_cost, want.target_cost) << "trial " << trial;
+    }
+    if (want.target_cost == kUnreachable) continue;
+    auto differs = [&](const std::function<void(RandomCase&)>& change) {
+      RandomCase twin = c;
+      change(twin);
+      return expect_of(twin).edges != want.edges ? 1 : 0;
+    };
+    const auto residual_only = [](RandomCase& t) { t.choice.tie_break = RouteTieBreak::HigherAvailableCapacity; };
+    if (prefer && prio == RouteTieBreak::HigherHeadroom) headroom += differs(residual_only);
+    if (prefer && prio == RouteTieBreak::HigherCapacity) capacity += differs(residual_only);
+    if (prefer && expand) {
+      bottleneck += differs([](RandomCase& t) { t.choice.tie_break = RouteTieBreak::FewerHops; });
+    }
+    hops += hops_decide(c) ? 1 : 0;
+  }
+  // Each rule decides 42 to 66 of the 8,000 trials with this seed: the floors leave room for a
+  // generator change while staying far above the one or two trials of the comparison above.
+  EXPECT_GT(headroom, 20);
+  EXPECT_GT(capacity, 20);
+  EXPECT_GT(bottleneck, 20);
+  EXPECT_GT(hops, 20);
+}
+
+TEST(Search, DirectionsWithExchangedEndpointsDescribeTheSameWalks) {
+  // A forward search from S with targets T and a reverse search rooted at T with targets S give
+  // the same pruned DAG, target cost and single path, under FEWER_HOPS and HIGHER_CAPACITY with and
+  // without multipath and parallel edges (HIGHER_CAPACITY not with both, where it is rejected; the
+  // other tie rules are compared with the reference in RandomQueriesAgreeWithTheReferenceOnBothQueues).
+  std::mt19937 rng(7);
+  int reached = 0;  // comparisons where a target is reached (a non-empty DAG)
+  for (int trial = 0; trial < 500; ++trial) {
+    const int n = 4 + static_cast<int>(rng() % 8);
+    auto g = random_graph(rng, n, 4 + static_cast<int>(rng() % 20), 3);
+    std::vector<NodeId> perm(static_cast<std::size_t>(n));
+    std::iota(perm.begin(), perm.end(), 0);
+    std::shuffle(perm.begin(), perm.end(), rng);
+    std::vector<NodeId> s(perm.begin(), perm.begin() + 1 + static_cast<std::ptrdiff_t>(rng() % 2));
+    std::vector<NodeId> t(perm.end() - 1 - static_cast<std::ptrdiff_t>(rng() % 2), perm.end());
+    for (auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity}) {
+      for (bool mp : {true, false}) {
+        for (bool me : {true, false}) {
+          if (tie != RouteTieBreak::FewerHops && mp && me) continue;
+          const auto s1 = sel(mp, me, tie);
+          auto f = run(g, s, Direction::Forward, t, s1);
+          auto r = run(g, t, Direction::Reverse, s, s1);
+          ASSERT_EQ(f.target_cost, r.target_cost) << trial;
+          ASSERT_EQ(edges_of(f.dag), edges_of(r.dag)) << trial;
+          reached += f.target_cost != kUnreachable ? 1 : 0;
+        }
+      }
+    }
+  }
+  RecordProperty("reached", reached);
+  EXPECT_GT(reached, 1500);  // not vacuous: of 3500 comparisons
+}
+
+TEST(Search, TieBreakWithEveryRouteAndEveryParallelEdgeIsRejected) {
+  // With multipath and parallel_edges both true the DAG keeps every tight member and every
+  // equal-cost walk, so a tie rule has nothing to choose: every HIGHER_* tie_break is rejected,
+  // before the residual, and FEWER_HOPS (never a hop-count prune) gives that DAG. Half of the
+  // graphs, with and without targets, have a random residual (0 to the capacity).
+  std::mt19937 rng(11);
+  int nonempty = 0;
+  int with_residual = 0;  // nonempty DAGs under a residual
+  for (int trial = 0; trial < 300; ++trial) {
+    auto g = random_graph(rng, 6, 14, 2);
+    std::optional<std::vector<NodeId>> t;
+    if (trial % 2 == 0) t = std::vector<NodeId> {5};
+    std::vector<Amount> res;
+    if (trial % 4 < 2) {
+      res.resize(static_cast<std::size_t>(g.num_edges()));
+      for (std::size_t e = 0; e < res.size(); ++e) {
+        const Amount cap = g.edge_capacity_units()[e];
+        res[e] = cap == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cap + 1));
+      }
+    }
+    const std::vector<Amount>* r = res.empty() ? nullptr : &res;
+    const auto base = edges_of(run(g, {0}, Direction::Forward, t, sel(), r).dag);
+    nonempty += base.empty() ? 0 : 1;
+    with_residual += !base.empty() && r != nullptr ? 1 : 0;
+    const RandomCase c {g, res, r != nullptr, 1, std::nullopt, sel(), Direction::Forward, {0}, t};
+    EXPECT_EQ(base, expect_of(c).edges) << trial;
+    for (auto tie : kTieBreaks) {
+      if (tie == RouteTieBreak::FewerHops) continue;
+      EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, t, sel(true, true, tie), r); }),
+                "spf tie_break requires multipath=False or parallel_edges=False")
+          << trial;
+    }
+  }
+  RecordProperty("nonempty", nonempty);
+  RecordProperty("with_residual", with_residual);
+  EXPECT_GT(nonempty, 150);  // not vacuous: of 300 graphs
+  EXPECT_GT(with_residual, 50);  // of the 150 graphs with a residual (this seed: 76)
+}
+
+TEST(Search, CapacityAndResidualValuesActOnlyThroughTheMemberGraph) {
+  // Two graphs with the same edges, in EdgeId order so the ids agree, where the second raises
+  // every positive capacity by 1 to 5 units (a zero capacity stays zero). On half of the trials
+  // each gets a residual that gates the same edges at min_residual (1 or 2 units) with other
+  // values. The member graph is then the same, so the DAG must be: in both directions, with and
+  // without targets, under the FEWER_HOPS rules, which read no capacity or residual value: every
+  // member and every walk, one member per (u, v) pair, and with targets the single path with and
+  // without parallel edges.
+  std::mt19937 rng(23);
+  int nonempty = 0;
+  int gated = 0;  // nonempty DAGs where the residual excluded an edge of at least 1 unit
+  for (int trial = 0; trial < 300; ++trial) {
+    auto g = random_graph(rng, 6, 14, 2);
+    const auto m = static_cast<std::size_t>(g.num_edges());
+    std::vector<InEdge> rows;
+    for (std::size_t e = 0; e < m; ++e) {
+      const Amount cap = g.edge_capacity_units()[e];
+      rows.push_back({g.edge_sources()[e], g.edge_destinations()[e], cap == 0 ? 0 : cap + 1 + static_cast<Amount>(rng() % 5),
+                      g.edge_costs()[e]});
+    }
+    auto h = make_graph(6, rows);
+    for (std::size_t e = 0; e < m; ++e) {
+      ASSERT_EQ(h.edge_sources()[e], g.edge_sources()[e]);
+      ASSERT_EQ(h.edge_destinations()[e], g.edge_destinations()[e]);
+      ASSERT_EQ(h.edge_costs()[e], g.edge_costs()[e]);
+      const Amount cg = g.edge_capacity_units()[e];
+      ASSERT_TRUE(cg == 0 ? h.edge_capacity_units()[e] == 0 : h.edge_capacity_units()[e] > cg);
+    }
+    std::vector<Amount> rg;
+    std::vector<Amount> rh;
+    const Amount minr = 1 + static_cast<Amount>(rng() % 2);
+    bool excluded = false;
+    if (trial % 2 == 0) {
+      for (std::size_t e = 0; e < m; ++e) {
+        const Amount cg = g.edge_capacity_units()[e];
+        const Amount ch = h.edge_capacity_units()[e];
+        rg.push_back(cg == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cg + 1)));
+        if (rg.back() >= minr) {
+          rh.push_back(minr + static_cast<Amount>(rng() % static_cast<std::uint32_t>(ch - minr + 1)));
+        } else {
+          rh.push_back(static_cast<Amount>(rng() % static_cast<std::uint32_t>(std::min(minr - 1, ch) + 1)));
+          excluded = excluded || cg >= 1;
+        }
+      }
+    }
+    const std::vector<Amount>* res_g = rg.empty() ? nullptr : &rg;
+    const std::vector<Amount>* res_h = rh.empty() ? nullptr : &rh;
+    std::optional<std::vector<NodeId>> t;
+    if (trial % 4 < 2) t = std::vector<NodeId> {5};
+    std::vector<detail::RouteChoice> sels {sel(true, true), sel(true, false)};
+    if (t.has_value()) {
+      sels.push_back(sel(false, true));
+      sels.push_back(sel(false, false));
+    }
+    for (const Direction dir : {Direction::Forward, Direction::Reverse}) {
+      for (const auto& s : sels) {
+        const auto want = edges_of(run(g, {0}, dir, t, s, res_g, minr).dag);
+        EXPECT_EQ(edges_of(run(h, {0}, dir, t, s, res_h, minr).dag), want) << trial;
+        nonempty += want.empty() ? 0 : 1;
+        gated += !want.empty() && excluded ? 1 : 0;
+      }
+    }
+  }
+  RecordProperty("nonempty", nonempty);
+  RecordProperty("gated", gated);
+  EXPECT_GT(nonempty, 700);  // not vacuous: of 150 x 2 x 4 + 150 x 2 x 2 = 1800 comparisons (this seed: 1018)
+  EXPECT_GT(gated, 200);     // of the 900 comparisons under a residual (this seed: 314)
+}
+
+TEST(Search, QueueDispatchAtTheWidthLimit) {
+  // W = max_edge_cost / gcd + 1: 65,535 / 1 + 1 = 65,536 buckets (the limit) and 65,536 + 1 above it;
+  // a large common gcd makes the width 2 big / big + 1 = 3; a graph without edges has width 1.
+  // The widths and the dispatch rule (Auto takes the bucket queue up to the limit, Heap never)
+  // hold in every build; the queue each search takes is counted by a private hook.
+  auto at = make_graph(3, {{0, 1, 1, 65535}, {1, 0, 1, 1}});
+  auto above = make_graph(3, {{0, 1, 1, 65536}, {1, 0, 1, 1}});
+  const Cost big = Cost {1} << 40;
+  auto gcd = make_graph(3, {{0, 1, 1, big}, {1, 0, 1, 2 * big}});
+  auto bare = make_graph(2, {});
+  EXPECT_EQ(detail::bucket_width(at), 65536);
+  EXPECT_EQ(detail::bucket_width(above), 65537);
+  EXPECT_EQ(detail::bucket_width(gcd), 3);
+  EXPECT_EQ(detail::bucket_width(bare), 1);
+  EXPECT_TRUE(detail::uses_buckets(at, SpfQueue::Auto));
+  EXPECT_FALSE(detail::uses_buckets(above, SpfQueue::Auto));
+  EXPECT_TRUE(detail::uses_buckets(gcd, SpfQueue::Auto));
+  EXPECT_TRUE(detail::uses_buckets(bare, SpfQueue::Auto));
+  EXPECT_FALSE(detail::uses_buckets(at, SpfQueue::Heap));
+  EXPECT_FALSE(detail::uses_buckets(gcd, SpfQueue::Heap));
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+  auto& counts = detail::thread_queue_counts();
+  auto queue_of = [&](const Graph& g, SpfQueue q) {
+    const auto before = counts;
+    auto r = run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, nullptr, q);
+    EXPECT_EQ(*r.costs, (std::vector<Cost>{0, g.edge_costs()[0], kUnreachable}));
+    return counts.buckets > before.buckets ? std::string("buckets") : std::string("heap");
+  };
+  EXPECT_EQ(queue_of(at, SpfQueue::Auto), "buckets");
+  EXPECT_EQ(queue_of(above, SpfQueue::Auto), "heap");
+  EXPECT_EQ(queue_of(gcd, SpfQueue::Auto), "buckets");
+  EXPECT_EQ(queue_of(at, SpfQueue::Heap), "heap");
+  EXPECT_EQ(queue_of(gcd, SpfQueue::Heap), "heap");
+#else
+  GTEST_SKIP() << "the queue counters are a private hook";
+#endif
+}
+
+namespace {
+
+// A textbook Dijkstra over every edge, whatever its capacity (the test's own, for large graphs
+// where Bellman-Ford is too slow): the costs and the tight-edge set of a full forward search.
+std::pair<std::vector<Cost>, std::vector<EdgeId>> dijkstra(const Graph& g, const std::vector<NodeId>& roots) {
+  std::vector<std::vector<std::size_t>> out(static_cast<std::size_t>(g.num_nodes()));
+  for (std::size_t e = 0; e < static_cast<std::size_t>(g.num_edges()); ++e) {
+    out[static_cast<std::size_t>(g.edge_sources()[e])].push_back(e);
+  }
+  std::vector<Cost> d(static_cast<std::size_t>(g.num_nodes()), kUnreachable);
+  std::priority_queue<std::pair<Cost, NodeId>, std::vector<std::pair<Cost, NodeId>>, std::greater<>> pq;
+  for (NodeId r : roots) {
+    d[static_cast<std::size_t>(r)] = 0;
+    pq.emplace(0, r);
+  }
+  while (!pq.empty()) {
+    auto [du, u] = pq.top();
+    pq.pop();
+    if (du != d[static_cast<std::size_t>(u)]) continue;
+    for (std::size_t e : out[static_cast<std::size_t>(u)]) {
+      const auto v = static_cast<std::size_t>(g.edge_destinations()[e]);
+      if (du + g.edge_costs()[e] < d[v]) {
+        d[v] = du + g.edge_costs()[e];
+        pq.emplace(d[v], static_cast<NodeId>(v));
+      }
+    }
+  }
+  std::vector<EdgeId> tight;
+  for (std::size_t e = 0; e < static_cast<std::size_t>(g.num_edges()); ++e) {
+    const Cost du = d[static_cast<std::size_t>(g.edge_sources()[e])];
+    const Cost dv = d[static_cast<std::size_t>(g.edge_destinations()[e])];
+    if (du != kUnreachable && dv != kUnreachable && du + g.edge_costs()[e] == dv) {
+      tight.push_back(static_cast<EdgeId>(e));
+    }
+  }
+  return {d, tight};
+}
+
+} // namespace
+
+TEST(Search, BucketWraparoundOnRings) {
+  // Small widths with distances many times the width: the cyclic buckets wrap around repeatedly.
+  // A plain ring, searched from node 0, runs like a chain with a frontier of one item (the inline
+  // item and its promotion); chords, shortcuts and parallel edges on the other three rings
+  // promote it. Every result equals the heap's and the textbook Dijkstra's.
+  std::mt19937 rng(5);
+  for (int shape = 0; shape < 4; ++shape) {
+    const int n = 400 + 37 * shape;
+    std::vector<InEdge> edges;
+    for (int v = 0; v < n; ++v) {
+      edges.push_back({v, (v + 1) % n, 1, 1 + static_cast<Cost>(rng() % 3)});  // the ring
+      if (shape >= 1 && rng() % 5 == 0) edges.push_back({v, (v + 7) % n, 1, 3});  // chords
+      if (shape >= 2 && rng() % 3 == 0) edges.push_back({v, (v + 2) % n, 1, 2});
+      if (shape == 3 && rng() % 4 == 0) edges.push_back({v, (v + 1) % n, 1, 1});  // parallel
+    }
+    auto g = make_graph(n, edges);
+    EXPECT_LE(detail::bucket_width(g), 4);
+    const auto [d, tight] = dijkstra(g, {0});
+    for (auto q : {SpfQueue::Auto, SpfQueue::Heap}) {
+      auto r = run(g, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, nullptr, q);
+      EXPECT_EQ(*r.costs, d) << "shape " << shape;
+      EXPECT_EQ(edges_of(r.dag), tight) << "shape " << shape;
+    }
+  }
+}
+
+TEST(Search, EarlyStopsLeaveNothingForTheNextQuery) {
+  // A target search stops with pending entries in the queue and touched tentative nodes; the next
+  // searches on this thread (other graphs, sizes, directions and queues) must see a clean
+  // workspace. Alternating graph sizes also exercise the arrays' growth and shrink.
+  std::mt19937 rng(3);
+  auto big = random_graph(rng, 3000, 24000, 30);
+  auto small = random_graph(rng, 9, 30, 3);
+  auto huge = random_graph(rng, 20000, 40000, 5);
+  const auto [d_big, t_big] = dijkstra(big, {0});
+  const auto [d_small, t_small] = dijkstra(small, {1});
+  // The huge reverse search, first on a fresh thread (an empty workspace): each repetition below
+  // must give the same.
+  std::optional<SpfResult> h_want;
+  std::thread([&] { h_want.emplace(run(huge, {5}, Direction::Reverse, std::vector<NodeId> {7}, sel(false))); }).join();
+  ASSERT_NE(h_want->target_cost, kUnreachable);
+  int stopped = 0;  // target searches that reached their target (and stopped there)
+  for (int round = 0; round < 6; ++round) {
+    for (auto q : {SpfQueue::Auto, SpfQueue::Heap}) {
+      auto stop = run(big, {0}, Direction::Forward, std::vector<NodeId> {static_cast<NodeId>(1 + round)}, sel(), nullptr, 1,
+                      nullptr, q);
+      EXPECT_EQ(stop.target_cost, d_big[static_cast<std::size_t>(1 + round)]);
+      stopped += stop.target_cost != kUnreachable ? 1 : 0;
+      auto s = run(small, {1}, Direction::Forward, std::nullopt, sel(), nullptr, 1, nullptr, q);
+      EXPECT_EQ(*s.costs, d_small);
+      EXPECT_EQ(edges_of(s.dag), t_small);
+      if (round % 2 == 0) {
+        const auto h = run(huge, {5}, Direction::Reverse, std::vector<NodeId> {7}, sel(false), nullptr, 1, nullptr, q);
+        EXPECT_EQ(h.target_cost, h_want->target_cost);
+        EXPECT_EQ(edges_of(h.dag), edges_of(h_want->dag));
+      }
+      auto b = run(big, {0}, Direction::Forward, std::nullopt, sel(), nullptr, 1, nullptr, q);
+      EXPECT_EQ(*b.costs, d_big);
+      EXPECT_EQ(edges_of(b.dag), t_big);
+    }
+  }
+  EXPECT_EQ(stopped, 12);
+}
+
+TEST(Search, LargeGraphsBothQueuesIdentical) {
+  // Every SpfResult field identical on both queues, on graphs where Auto takes the buckets: in
+  // both directions, the full multipath search and the target searches (multipath, and single
+  // path under FEWER_HOPS and HIGHER_CAPACITY; a single-path search needs targets), with and
+  // without parallel edges across the shapes.
+  std::mt19937 rng(17);
+  int reached = 0;
+  for (int shape = 0; shape < 3; ++shape) {
+    auto g = random_graph(rng, 2000, 16000, shape == 2 ? 1 : 31);
+    ASSERT_TRUE(detail::uses_buckets(g, SpfQueue::Auto));
+    int k = 0;
+    for (const Direction dir : {Direction::Forward, Direction::Reverse}) {
+      for (int kind = 0; kind < 4; ++kind, ++k) {
+        const auto tie = kind == 3 ? RouteTieBreak::HigherCapacity : RouteTieBreak::FewerHops;
+        const auto s = sel(kind < 2, (kind + shape) % 2 == 0, tie);
+        std::optional<std::vector<NodeId>> t;
+        if (kind > 0) t = std::vector<NodeId> {static_cast<NodeId>(100 + k), static_cast<NodeId>(900 + k)};
+        auto a = run(g, {static_cast<NodeId>(k)}, dir, t, s, nullptr, 1, nullptr, SpfQueue::Auto);
+        auto h = run(g, {static_cast<NodeId>(k)}, dir, t, s, nullptr, 1, nullptr, SpfQueue::Heap);
+        EXPECT_EQ(a.costs, h.costs);
+        EXPECT_EQ(a.target_cost, h.target_cost);
+        EXPECT_TRUE(a.dag == h.dag);
+        reached += t.has_value() && a.target_cost.value_or(kUnreachable) != kUnreachable;
+      }
+    }
+  }
+  EXPECT_GT(reached, 12);  // of the 18 target searches: not comparisons of unreached targets
+}
+
+TEST(Search, InternalEntriesMatchThePublicSearch) {
+  // route_search (T1's CSPF: the single path, in walk order), support_route (ShortestPaths on the cached
+  // support) and
+  // static_costs (rosters) against spf on the same questions; support_route under HIGHER_* scores
+  // read on a residual view against the independent reference (search_reference.hpp). A HIGHER_*
+  // tie_break never meets multipath and parallel_edges both true (the configuration rejects it).
+  std::mt19937 rng(23);
+  int routed = 0;        // gated route searches that reach a destination
+  int projected = 0;     // static projections that reach a destination
+  int residual_views = 0;
+  int view_changes = 0;  // the residual view selected another route than the static one
+  for (int trial = 0; trial < 400; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 8);
+    auto g = random_graph(rng, n, 3 + static_cast<int>(rng() % 22), 3);
+    const NodeId src = 0;
+    std::vector<NodeId> dests = {static_cast<NodeId>(n - 1)};
+    if (n > 4 && rng() % 2 == 0) dests.insert(dests.begin(), static_cast<NodeId>(n - 2));
+    std::vector<Amount> residual(static_cast<std::size_t>(g.num_edges()));
+    for (std::size_t e = 0; e < residual.size(); ++e) {
+      const Amount cap = g.edge_capacity_units()[e];
+      residual[e] = cap == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cap + 1));
+    }
+    for (bool mp : {true, false}) {
+      for (bool me : {true, false}) {
+        for (bool prefer : {false, true}) {
+          if (prefer && mp && me) continue;
+          const auto s = sel(mp, me, prefer ? RouteTieBreak::HigherAvailableCapacity : RouteTieBreak::FewerHops);
+          // T1's CSPF: gated at 2 units on the residual, the single path (it reads no multipath)
+          // in walk order from src.
+          if (!mp) {
+            auto want = run(g, {src}, Direction::Forward, dests, s, &residual, 2);
+            auto got = detail::route_search(g, detail::SearchFilter {nullptr, residual, 2}, s, src, dests);
+            if (want.target_cost == kUnreachable) {
+              EXPECT_FALSE(got.has_value());
+            } else {
+              ASSERT_TRUE(got.has_value());
+              EXPECT_EQ(got->cost, *want.target_cost);
+              NodeId at = src;
+              for (EdgeId e : got->edges) {
+                EXPECT_EQ(g.edge_sources()[static_cast<std::size_t>(e)], at);
+                at = g.edge_destinations()[static_cast<std::size_t>(e)];
+              }
+              auto sorted = got->edges;
+              std::sort(sorted.begin(), sorted.end());
+              EXPECT_EQ(sorted, edges_of(want.dag));
+              ++routed;
+            }
+          }
+          // ShortestPaths: the static support toward dests projected with static scores equals the
+          // static search from src (no residual: HIGHER_AVAILABLE_CAPACITY reads the capacities).
+          const auto support = detail::static_support(g, dests, Direction::Reverse, nullptr);
+          const detail::PriorityValues values {&g, s.tie_break, {}};
+          auto proj = detail::support_route(g, detail::PredecessorDAGBuilder::ascending(support), src, dests, s,
+                                            detail::PriorityReader::of(values));
+          auto stat = run(g, {src}, Direction::Forward, dests, s);
+          if (stat.target_cost == kUnreachable) {
+            EXPECT_TRUE(proj.edges.empty());
+          } else {
+            EXPECT_EQ(proj.edges, edges_of(stat.dag)) << trial;
+            EXPECT_EQ(proj.cost, *stat.target_cost);
+            ++projected;
+          }
+          // ShortestPaths creation reads its scores on a residual view without gating on it: the
+          // projection of the static support under each tie_break read on `residual` equals the
+          // independent reference's walks (or canonical path) over the static member graph with
+          // that tie_break, gated at no residual (min_residual 0).
+          const std::vector<RouteTieBreak> ties =
+              prefer ? std::vector<RouteTieBreak> {RouteTieBreak::HigherAvailableCapacity, RouteTieBreak::HigherHeadroom,
+                                                   RouteTieBreak::HigherCapacity}
+                     : std::vector<RouteTieBreak> {RouteTieBreak::FewerHops};
+          for (auto prio : ties) {
+            const auto sp = sel(mp, me, prio);
+            const detail::PriorityValues on_residual {&g, prio, residual};
+            auto rproj = detail::support_route(g, detail::PredecessorDAGBuilder::ascending(support), src, dests, sp,
+                                               detail::PriorityReader::of(on_residual));
+            ref::Query q;
+            q.g = &g;
+            q.residual = &residual;
+            q.min_residual = 0;
+            q.parallel_edges = me;
+            q.tie_break = prio;
+            const auto mem = ref::members(q);
+            const auto [dstar, walks] = ref::pruned(g, mem, {src}, dests);
+            if (dstar == ref::kNone) {
+              EXPECT_TRUE(rproj.edges.empty()) << trial;
+              continue;
+            }
+            std::vector<EdgeId> want(walks.begin(), walks.end());
+            if (!mp) want = sorted(*ref::canonical(q, mem, {src}, dests));
+            EXPECT_EQ(rproj.edges, want) << "trial " << trial << " tie_break " << static_cast<int>(prio);
+            EXPECT_EQ(rproj.cost, dstar) << trial;
+            ++residual_views;
+            if (rproj.edges != proj.edges) ++view_changes;
+          }
+        }
+      }
+    }
+    const auto costs = detail::static_costs(g, nullptr, dests, std::vector<NodeId> {0, 1});
+    auto rev = run(g, dests, Direction::Reverse, std::nullopt, sel());
+    EXPECT_EQ(costs, (std::vector<Cost>{(*rev.costs)[0], (*rev.costs)[1]}));
+  }
+  EXPECT_GT(routed, 300);           // not vacuous: many queries reach a destination
+  EXPECT_GT(projected, 1000);
+  EXPECT_GT(residual_views, 3000);
+  EXPECT_GT(view_changes, 30);      // and the residual view decides some of them
+}
+
+TEST(Search, ReverseSupportsOrderEveryTailsEdgesAtAnyDegree) {
+  // A reverse full search emits each tail's tight out-edges in ascending EdgeId, by one
+  // bit per out-edge id up to 64 out-edges and by sorting above: hubs with 1, 63, 64, 65 and 129
+  // out-edges, tight (cost 1, parallel copies, ties; a fifth of capacity 0, tight like any other)
+  // and not (cost 2), and hubs of
+  // 64, 65 and 66 out-edges that are all tight, against the reference's full DAG, with and
+  // without an Eligibility.
+  // Ids rank a node's costlier edges last, so the all-tight variant makes the last ids tight too.
+  std::mt19937 rng(64);
+  for (const auto& [degree, all_tight] : std::vector<std::pair<int, bool>> {
+           {1, false}, {63, false}, {64, false}, {65, false}, {129, false}, {64, true}, {65, true}, {66, true}}) {
+    const NodeId root = 0;
+    const NodeId hub = 1;
+    const int spokes = 40;  // nodes 2 .. 41, each one hop from the root
+    std::vector<InEdge> edges;
+    for (int k = 0; k < degree; ++k) {
+      const auto to = static_cast<NodeId>(2 + rng() % spokes);
+      const Cost cost = !all_tight && rng() % 4 == 0 ? 2 : 1;
+      edges.push_back({hub, to, static_cast<Amount>(!all_tight && rng() % 5 == 0 ? 0 : 3), cost});
+    }
+    for (NodeId s = 2; s < 2 + spokes; ++s) edges.push_back({s, root, 4, 1});
+    const Graph g = make_graph(2 + spokes, edges);
+    ASSERT_EQ(g.outgoing_offsets()[2] - g.outgoing_offsets()[1], degree);
+    for (bool with_elig : {false, true}) {
+      std::optional<Eligibility> elig;
+      if (with_elig) elig = g.eligibility(std::vector<NodeId> {5}, std::vector<EdgeId> {g.outgoing_offsets()[1]});
+      ref::Query q;
+      q.g = &g;
+      q.elig = elig ? &*elig : nullptr;
+      const auto mem = ref::members(q);
+      const auto d = ref::distances(g, mem, {root}, true);
+      const auto want = ref::full_dag(g, mem, d, true);
+      const auto got = detail::static_support(g, std::vector<NodeId> {root}, Direction::Reverse, q.elig);
+      const auto asc = detail::PredecessorDAGBuilder::ascending(got);
+      EXPECT_EQ(std::vector<EdgeId>(asc.begin(), asc.end()), std::vector<EdgeId>(want.begin(), want.end()))
+          << "degree " << degree << " all tight " << all_tight << " elig " << with_elig;
+      if (all_tight && !with_elig) EXPECT_EQ(asc.size(), static_cast<std::size_t>(degree + spokes));
+      EXPECT_TRUE(std::is_sorted(asc.begin(), asc.end()));
+      // The hub's own entries, whose order is the subject here: at least half its edges (none when
+      // the Eligibility masks the degree-1 hub's only edge).
+      const auto hub_entries = std::count_if(asc.begin(), asc.end(), [&](EdgeId e) { return g.edge_sources()[e] == hub; });
+      EXPECT_GE(hub_entries, with_elig && degree == 1 ? 0 : (degree + 1) / 2)
+          << "degree " << degree << " all tight " << all_tight << " elig " << with_elig;
+    }
+  }
+}
+
+TEST(Search, StaticSupportTakesNormalisedRootsAndAllowsNone) {
+  // static_support and static_costs take root sets their callers normalised
+  // (ascending, no duplicates, in range) and filter the Eligibility themselves. On random graphs
+  // with masks they equal the public search on the same roots: the full support in both
+  // directions, the reverse costs at every node. With no allowed root the support is the empty
+  // DAG and every cost kUnreachable, as the public search gives (and static_costs of no
+  // destination at all). The public entries keep normalising: spf and a cache lookup on the
+  // roots unsorted and repeated give the same support.
+  std::mt19937 rng(813);
+  int masked_roots = 0;  // supports with an edge although the Eligibility removes a root
+  for (int trial = 0; trial < 300; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 9);
+    const auto g = random_graph(rng, n, 2 + static_cast<int>(rng() % 30), 4);
+    std::vector<NodeId> roots;
+    for (NodeId v = 0; v < n; ++v) {
+      if (rng() % 3 == 0) roots.push_back(v);
+    }
+    if (roots.empty()) roots.push_back(static_cast<NodeId>(rng() % static_cast<unsigned>(n)));
+    std::vector<NodeId> xn;
+    for (NodeId v = 0; v < n; ++v) {
+      if (rng() % 4 == 0) xn.push_back(v);
+    }
+    if (trial % 10 == 0) xn = roots;  // no root allowed
+    std::vector<EdgeId> xe;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      if (rng() % 6 == 0) xe.push_back(e);
+    }
+    const auto el = g.eligibility(xn, xe);
+    const Eligibility* elig = trial % 2 == 0 ? &el : nullptr;
+    const bool any_allowed =
+        std::any_of(roots.begin(), roots.end(), [&](NodeId r) { return elig == nullptr || elig->allows_node(r); });
+    const bool masked =
+        elig != nullptr && std::any_of(roots.begin(), roots.end(), [&](NodeId r) { return !elig->allows_node(r); });
+    std::vector<NodeId> all(static_cast<std::size_t>(n));
+    std::iota(all.begin(), all.end(), 0);
+    for (Direction dir : {Direction::Forward, Direction::Reverse}) {
+      const auto got = detail::static_support(g, roots, dir, elig);
+      const auto [want_costs, want_dag, want_cost] = run(g, roots, dir, std::nullopt, sel(), nullptr, 1, elig);
+      EXPECT_TRUE(got == want_dag) << "trial " << trial << " direction " << static_cast<int>(dir);
+      if (!any_allowed) EXPECT_TRUE(got == detail::PredecessorDAGBuilder::empty(g)) << trial;
+      if (dir == Direction::Forward && masked && !detail::PredecessorDAGBuilder::ascending(got).empty()) ++masked_roots;
+    }
+    const auto costs = detail::static_costs(g, elig, roots, all);
+    const auto [rev_costs, rev_dag, rev_cost] = run(g, roots, Direction::Reverse, std::nullopt, sel(), nullptr, 1, elig);
+    EXPECT_EQ(costs, *rev_costs) << trial;
+    if (!any_allowed) EXPECT_EQ(costs, std::vector<Cost>(all.size(), kUnreachable)) << trial;  // every tenth trial, and an even one whose exclusions remove every root
+    EXPECT_EQ(detail::static_costs(g, elig, std::vector<NodeId> {}, all), std::vector<Cost>(all.size(), kUnreachable));
+    // The public entries on the same roots reversed and repeated.
+    std::vector<NodeId> messy(roots.rbegin(), roots.rend());
+    messy.push_back(roots.front());
+    ShortestPathCache cache(g);
+    const auto cached = cache.lookup(g, messy, Direction::Reverse, elig);
+    EXPECT_TRUE(*cached == detail::static_support(g, roots, Direction::Reverse, elig)) << trial;
+    EXPECT_TRUE(cache.lookup(g, roots, Direction::Reverse, elig) == cached) << trial;  // the same entry
+    EXPECT_TRUE(rev_dag == *cached) << trial;
+    const auto [messy_costs, messy_dag, messy_cost] = run(g, messy, Direction::Reverse, std::nullopt, sel(), nullptr, 1, elig);
+    EXPECT_TRUE(messy_dag == *cached) << trial;
+  }
+  EXPECT_GT(masked_roots, 10);  // not vacuous: the Eligibility removes some roots of real supports
+}
+
+// The route choice. TRI: three parallel cost-1 links 0 -> 1 of capacities 4, 10,
+// 100 and a cost-2 link of 50, availability 4, 8, 5, 50. The single path takes e0 under
+// FEWER_HOPS, e2 under HIGHER_CAPACITY, e1 under HIGHER_AVAILABLE_CAPACITY and e0 under
+// HIGHER_HEADROOM (1 against 4/5 and 1/20); e3 never.
+TEST(SpfTie, Parallel) {
+  const auto g = make_graph(2, {{0, 1, 4, 1}, {0, 1, 10, 1}, {0, 1, 100, 1}, {0, 1, 50, 2}});
+  const std::vector<Amount> available = {4, 8, 5, 50};
+  for (const auto& [tie, want] : {std::pair {RouteTieBreak::FewerHops, EdgeId {0}},
+                                  std::pair {RouteTieBreak::HigherCapacity, EdgeId {2}},
+                                  std::pair {RouteTieBreak::HigherAvailableCapacity, EdgeId {1}},
+                                  std::pair {RouteTieBreak::HigherHeadroom, EdgeId {0}}}) {
+    const auto single = run(g, {0}, Direction::Forward, std::vector<NodeId> {1}, sel(false, true, tie), &available);
+    EXPECT_EQ(edges_of(single.dag), (std::vector<EdgeId> {want})) << static_cast<int>(tie);
+    // The same rule keeps one member of the pair in a multipath search without parallel edges.
+    const auto collapsed = run(g, {0}, Direction::Forward, std::nullopt, sel(true, false, tie), &available);
+    EXPECT_EQ(edges_of(collapsed.dag), (std::vector<EdgeId> {want})) << static_cast<int>(tie);
+  }
+}
+
+// TIE-routes: the direct link e1 (capacity 3, cost 2) against e0, e2 (capacity 10, cost 1 each).
+// Without a residual HIGHER_HEADROOM reads 1 on every positive link, so hops decide. TIE-
+// bottleneck: e2 at capacity 1 makes the two-hop bottleneck 1, and every rule takes e1 although
+// the two-hop route's first link is the larger one (the paths are compared whole).
+TEST(SpfTie, Routes) {
+  for (const Amount e2 : {Amount {10}, Amount {1}}) {
+    const auto g = make_graph(3, {{0, 1, 10, 1}, {0, 2, 3, 2}, {1, 2, e2, 1}});
+    const std::vector<EdgeId> two_hops = e2 == 10 ? std::vector<EdgeId> {0, 2} : std::vector<EdgeId> {1};
+    for (const auto& [tie, want] : {std::pair {RouteTieBreak::FewerHops, std::vector<EdgeId> {1}},
+                                    std::pair {RouteTieBreak::HigherCapacity, two_hops},
+                                    std::pair {RouteTieBreak::HigherAvailableCapacity, two_hops},
+                                    std::pair {RouteTieBreak::HigherHeadroom, std::vector<EdgeId> {1}}}) {
+      const auto r = run(g, {0}, Direction::Forward, std::vector<NodeId> {2}, sel(false, true, tie));
+      EXPECT_EQ(edges_of(r.dag), want) << e2 << " " << static_cast<int>(tie);
+    }
+  }
+}
+
+// spf's entry: the ineffective tie rule after the single-path rule, before the residual.
+TEST(SpfValidation, TieRule) {
+  const auto g = make_graph(3, {{0, 1, 2, 1}, {1, 2, 2, 1}});
+  const std::string ineffective = "spf tie_break requires multipath=False or parallel_edges=False";
+  const std::vector<Amount> short_residual = {1};
+  const auto hc = RouteTieBreak::HigherCapacity;
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(true, true, hc)); }), ineffective);
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(true, true, hc), &short_residual); }),
+            ineffective);
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(false, true, hc)); }),
+            "multipath = false requires targets (the single path joins a root to a target)");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel(true, false, hc)); }), "");
+  EXPECT_EQ(error_of([&] { (void)run(g, {0}, Direction::Forward, std::nullopt, sel()); }), "");
+}
diff --git a/tests/cpp/shortest_path_cache_tests.cpp b/tests/cpp/shortest_path_cache_tests.cpp
new file mode 100644
index 0000000..3cad371
--- /dev/null
+++ b/tests/cpp/shortest_path_cache_tests.cpp
@@ -0,0 +1,521 @@
+// The ShortestPathCache's modes: the transition table (building and frozen lookups, freeze, clear, thaw,
+// destruction), the statistics (a frozen miss counts one miss), roots in any order sharing one
+// entry and one validation, the key (a policy's route choice is not part of it, the Eligibility uid
+// is) and clear() releasing the values nobody holds, ShortestPathCacheMiss as a dedicated exception, frozen
+// hits from several threads, and the evaluators' sharing rules: a frozen cache shared by every
+// worker, a building one rejected with two or more, ShortestPathCacheMiss propagated unchanged through
+// evaluate_pairs and evaluate_edge_failures, the reuse of a prepopulated Eligibility through an unchanged
+// intersection, the deletion-mode failure study (CentralizedTE: each deletion repaired from the baseline's
+// state) with a supplied frozen cache; a failed call's statistics, and concurrent calls and
+// publications that lose no hit. The thread cases form the suite DagCacheFrozen; make tsan-test
+// runs them under ThreadSanitizer with every other test.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <latch>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <tuple>
+#include <type_traits>
+#include <vector>
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+// ShortestPathCacheMiss is its own exception, neither a std::runtime_error nor a std::logic_error (a frozen
+// miss is thrown as one: miss_of in the tests below).
+static_assert(!std::is_base_of_v<std::runtime_error, ShortestPathCacheMiss>);
+static_assert(!std::is_base_of_v<std::logic_error, ShortestPathCacheMiss>);
+static_assert(std::is_base_of_v<std::exception, ShortestPathCacheMiss>);
+static_assert(std::is_nothrow_copy_constructible_v<ShortestPathCacheMiss>);
+
+namespace {
+
+// A small two-tier fabric: leaves 0..5, spines 6..8, every leaf joined to every spine both ways.
+std::shared_ptr<const Graph> fabric() {
+  std::vector<InEdge> e;
+  for (NodeId l = 0; l < 6; ++l) {
+    for (NodeId s = 6; s < 9; ++s) {
+      e.push_back({l, s, 4, 1});
+      e.push_back({s, l, 4, 1});
+    }
+  }
+  return std::make_shared<const Graph>(make_graph(9, e));
+}
+
+std::string miss_of(const std::function<void()>& fn) {
+  try {
+    fn();
+  } catch (const ShortestPathCacheMiss& e) {
+    return e.what();
+  }
+  return "";
+}
+
+// The bytes a DAG's stored arrays hold, from its public arrays: k nodes with entries and e
+// entries store the k nodes, k + 1 offsets, e parents, e via edges and their ascending copy, all
+// 32-bit values.
+std::int64_t stored_bytes(const PredecessorDAG& d) {
+  const auto off = d.parent_offsets();
+  std::int64_t k = 0;
+  for (std::size_t i = 0; i + 1 < off.size(); ++i) k += off[i + 1] > off[i] ? 1 : 0;
+  const auto e = static_cast<std::int64_t>(d.via_edges().size());
+  return 4 * (k + (k + 1) + e + e + e);
+}
+
+} // namespace
+
+TEST(DagCacheModes, TransitionTableAndStatistics) {
+  const auto g = fabric();
+  ShortestPathCache cache(*g);
+  // Building: a miss searches and inserts, a hit returns the same value.
+  const auto a = cache.lookup(*g, v({1, 0}), Direction::Reverse, nullptr);
+  const auto a2 = cache.lookup(*g, v({0, 1}), Direction::Reverse, nullptr);
+  EXPECT_EQ(a.get(), a2.get());
+  auto st = cache.stats();
+  EXPECT_EQ(st.misses, 1);
+  EXPECT_EQ(st.hits, 1);
+  EXPECT_EQ(st.entries, 1);
+  EXPECT_EQ(st.bytes, stored_bytes(*a));
+  // Invalid queries throw std::invalid_argument, each with its own message, and change no
+  // statistic, while building here and while frozen below: a foreign graph, an Eligibility built
+  // for another graph (the same roots and direction as a stored entry), empty roots, a root out of
+  // range, a direction outside its enumeration (with the roots of a stored entry).
+  const auto other = fabric();
+  const auto foreign = other->eligibility(v({}), std::vector<EdgeId> {0});
+  auto invalid_queries_count_nothing = [&](const char* mode) {
+    const auto before = cache.stats();
+    EXPECT_EQ(error_of([&] { (void)cache.lookup(*other, v({0}), Direction::Reverse, nullptr); }),
+              "ShortestPathCache: the graph is not the cache's graph (foreign graph)") << mode;
+    EXPECT_EQ(error_of([&] { (void)cache.lookup(*g, v({0, 1}), Direction::Reverse, &foreign); }),
+              "foreign Eligibility: built for another graph") << mode;
+    EXPECT_EQ(error_of([&] { (void)cache.lookup(*g, v({}), Direction::Reverse, nullptr); }), "roots: the node set is empty")
+        << mode;
+    EXPECT_EQ(error_of([&] { (void)cache.lookup(*g, v({9}), Direction::Reverse, nullptr); }),
+              "roots: node 9 out of node range [0, 9)") << mode;
+    EXPECT_EQ(error_of([&] { (void)cache.lookup(*g, v({0, 1}), static_cast<Direction>(9), nullptr); }),
+              "direction: 9 is not a value of Direction") << mode;
+    EXPECT_EQ(stats_of(cache.stats()), stats_of(before)) << mode;
+  };
+  invalid_queries_count_nothing("building");
+  // Frozen: hits return the value; a miss counts one miss, inserts nothing, throws ShortestPathCacheMiss.
+  cache.freeze();
+  cache.freeze();  // idempotent
+  EXPECT_EQ(cache.lookup(*g, v({0, 1}), Direction::Reverse, nullptr).get(), a.get());
+  const auto msg = miss_of([&] { (void)cache.lookup(*g, v({2}), Direction::Forward, nullptr); });
+  EXPECT_EQ(msg, "ShortestPathCache: the frozen cache has no entry for roots {2}, direction Forward, Eligibility uid 0 (a frozen "
+                 "cache never searches)");
+  st = cache.stats();
+  EXPECT_EQ(st.misses, 2);
+  EXPECT_EQ(st.hits, 2);
+  EXPECT_EQ(st.entries, 1);
+  invalid_queries_count_nothing("frozen");
+  // clear() throws when frozen and keeps the entries.
+  EXPECT_EQ(error_of([&] { cache.clear(); }),
+            "ShortestPathCache.clear is rejected while the cache is frozen (thaw() it, then clear())");
+  EXPECT_EQ(cache.stats().entries, 1);
+  // thaw(): building again; a miss searches and inserts, clear() empties (counters persist).
+  cache.thaw();
+  cache.thaw();  // no effect when building
+  const auto b = cache.lookup(*g, v({2}), Direction::Forward, nullptr);
+  EXPECT_EQ(cache.stats().entries, 2);
+  EXPECT_EQ(cache.stats().bytes, stored_bytes(*a) + stored_bytes(*b));
+  cache.clear();
+  st = cache.stats();
+  EXPECT_EQ(st.entries, 0);
+  EXPECT_EQ(st.bytes, 0);
+  EXPECT_EQ(st.misses, 3);
+  EXPECT_EQ(st.hits, 2);
+  EXPECT_EQ(st.live_values, 2);  // a and b are held by the test
+  // Held values stay valid after clear() and after a frozen cache is destroyed.
+  EXPECT_EQ(b->via_edges().size(), 18U);  // roots {2} forward: three 2 -> spine edges, 15 spine -> leaf
+  EXPECT_EQ(a2->via_edges().size(), 18U);
+  std::shared_ptr<const PredecessorDAG> c;
+  {
+    ShortestPathCache frozen(*g);
+    c = frozen.lookup(*g, v({3}), Direction::Reverse, nullptr);
+    frozen.freeze();
+  }
+  // Roots {3}: the three spine -> 3 edges and the five other leaves' 15 leaf -> spine edges;
+  // roots {0, 1}: six spine -> root edges and the four other leaves' 12.
+  EXPECT_EQ(c->via_edges().size(), 18U);
+  EXPECT_EQ(a->via_edges().size(), 18U);
+}
+
+TEST(DagCacheModes, RootsInAnyOrderShareOneEntryAndOneValidation) {
+  // A lookup borrows roots that are already a sorted set (no copy on a hit) and
+  // normalises any other; either way the key is the sorted set, ordered by roots, then direction,
+  // then Eligibility uid, and the checks and their messages are node_set's.
+  const auto g = fabric();
+  ShortestPathCache cache(*g);
+  const auto elig = g->eligibility(v({}), std::vector<EdgeId> {0});
+  const auto a = cache.lookup(*g, v({0, 2}), Direction::Reverse, nullptr);
+  for (const auto& roots : {v({2, 0}), v({0, 0, 2}), v({2, 2, 0, 2}), v({0, 2})}) {
+    EXPECT_EQ(cache.lookup(*g, roots, Direction::Reverse, nullptr).get(), a.get());
+  }
+  EXPECT_EQ(cache.stats().misses, 1);
+  EXPECT_EQ(cache.stats().hits, 4);
+  // Keys that differ in a prefix, the length, the direction or the Eligibility uid are distinct
+  // entries, each found again by its own key in any order.
+  const std::vector<std::tuple<std::vector<NodeId>, Direction, const Eligibility*>> keys = {
+      {v({0}), Direction::Reverse, nullptr},        {v({0, 1}), Direction::Reverse, nullptr},
+      {v({0, 2, 3}), Direction::Reverse, nullptr},  {v({1}), Direction::Reverse, nullptr},
+      {v({0, 2}), Direction::Forward, nullptr},     {v({0, 2}), Direction::Reverse, &elig},
+      {v({8}), Direction::Forward, &elig},          {v({0, 1, 2, 3, 4, 5}), Direction::Reverse, nullptr}};
+  std::vector<std::shared_ptr<const PredecessorDAG>> values;
+  for (const auto& [roots, dir, el] : keys) values.push_back(cache.lookup(*g, roots, dir, el));
+  EXPECT_EQ(cache.stats().entries, 9);
+  EXPECT_EQ(cache.stats().misses, 9);
+  for (std::size_t i = 0; i < keys.size(); ++i) {
+    EXPECT_NE(values[i].get(), a.get());
+    for (std::size_t j = 0; j < i; ++j) EXPECT_NE(values[i].get(), values[j].get());
+  }
+  for (std::size_t i = keys.size(); i-- > 0;) {
+    auto roots = std::get<0>(keys[i]);
+    std::reverse(roots.begin(), roots.end());
+    EXPECT_EQ(cache.lookup(*g, roots, std::get<1>(keys[i]), std::get<2>(keys[i])).get(), values[i].get());
+  }
+  EXPECT_EQ(cache.stats().misses, 9);
+  EXPECT_EQ(cache.stats().hits, 4 + static_cast<std::int64_t>(keys.size()));
+  // The checks in node_set's order, sorted or not: empty, then the first id out of range in input
+  // order; nothing counted.
+  auto lookup_error = [&](const std::vector<NodeId>& roots) {
+    return error_of([&] { (void)cache.lookup(*g, roots, Direction::Reverse, nullptr); });
+  };
+  const auto before = cache.stats();
+  EXPECT_EQ(lookup_error(v({9})), "roots: node 9 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({3, 9})), "roots: node 9 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({9, 3})), "roots: node 9 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({-1, 9})), "roots: node -1 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({9, -1})), "roots: node 9 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({3, 3, 12})), "roots: node 12 out of node range [0, 9)");
+  EXPECT_EQ(lookup_error(v({})), "roots: the node set is empty");
+  const auto after = cache.stats();
+  EXPECT_EQ(after.misses, before.misses);
+  EXPECT_EQ(after.hits, before.hits);
+  EXPECT_EQ(after.entries, before.entries);
+  // A frozen miss names the sorted set, borrowed or normalised.
+  cache.freeze();
+  const std::string want = "ShortestPathCache: the frozen cache has no entry for roots {1, 4}, direction Reverse, Eligibility uid "
+                           "0 (a frozen cache never searches)";
+  EXPECT_EQ(miss_of([&] { (void)cache.lookup(*g, v({1, 4}), Direction::Reverse, nullptr); }), want);
+  EXPECT_EQ(miss_of([&] { (void)cache.lookup(*g, v({4, 1, 4}), Direction::Reverse, nullptr); }), want);
+  EXPECT_EQ(cache.stats().misses, 11);
+}
+
+TEST(DagCacheModes, RouteChoiceIsNoPartOfTheKeyAndClearReleasesUnheldValues) {
+  // Two disjoint routes 0 -> 1 -> 3 and 0 -> 2 -> 3. EdgeIds: 0 = 0->1, 1 = 0->2, 2 = 1->3, 3 = 2->3.
+  const auto g = std::make_shared<const Graph>(make_graph(4, {{0, 1, 5, 1}, {1, 3, 5, 1}, {0, 2, 5, 1}, {2, 3, 5, 1}}));
+  ShortestPathCache cache(*g);
+  // Two ShortestPaths policies differing only in their route choice share one entry (the route
+  // choice is a projection at creation, never part of the key).
+  FlowLedger fg(g);
+  FlowPolicy a(fg, v({0}), v({3}), shortest_paths_config(), nullptr, &cache);
+  auto other_choice = shortest_paths_config();
+  ShortestPaths single_member;
+  single_member.tie_break = RouteTieBreak::HigherAvailableCapacity;
+  single_member.multipath = false;
+  single_member.parallel_edges = false;
+  other_choice.routing = single_member;
+  FlowPolicy b(fg, v({0}), v({3}), other_choice, nullptr, &cache);
+  auto s = cache.stats();
+  EXPECT_EQ(s.misses, 1);
+  EXPECT_EQ(s.hits, 1);
+  EXPECT_EQ(s.entries, 1);
+  EXPECT_GT(s.bytes, 0);
+  // The Eligibility uid is part of the key: the value under el is the static support without 0 -> 1.
+  const auto x = cache.lookup(*g, v({3}), Direction::Reverse, nullptr);
+  EXPECT_EQ(cache.stats().hits, 2);
+  (void)cache.lookup(*g, v({3}), Direction::Forward, nullptr);  // held by the cache only
+  const auto el = g->eligibility({}, std::vector<EdgeId> {0});
+  const auto y = cache.lookup(*g, v({3}), Direction::Reverse, &el);
+  s = cache.stats();
+  EXPECT_EQ(s.misses, 3);
+  EXPECT_EQ(s.entries, 3);
+  EXPECT_EQ(ascending_edges(*y), (std::vector<EdgeId> {1, 2, 3}));
+  EXPECT_EQ(ascending_edges(*x), (std::vector<EdgeId> {0, 1, 2, 3}));
+  // clear() releases the values nobody else holds: the Forward one dies, x and y stay alive.
+  EXPECT_EQ(cache.stats().live_values, 3);
+  cache.clear();
+  EXPECT_EQ(cache.stats().live_values, 2);
+  EXPECT_EQ(ascending_edges(*x), (std::vector<EdgeId> {0, 1, 2, 3}));
+  // After clear() a lookup misses and inserts again.
+  (void)cache.lookup(*g, v({3}), Direction::Reverse, nullptr);
+  EXPECT_EQ(cache.stats().misses, 4);
+  EXPECT_EQ(cache.stats().entries, 1);
+}
+
+namespace {
+
+// Frozen hits from `threads` threads at once over prepopulated keys; every value is the
+// prepopulated one and every hit is counted. The threads start their lookups together, once all
+// of them are running.
+void frozen_readers(int threads) {
+  const auto g = fabric();
+  ShortestPathCache cache(*g);
+  std::vector<std::shared_ptr<const PredecessorDAG>> want;
+  for (NodeId r = 0; r < 9; ++r) want.push_back(cache.lookup(*g, v({r}), Direction::Reverse, nullptr));
+  cache.freeze();
+  const auto before = cache.stats();
+  std::atomic<int> wrong {0};
+  std::vector<std::thread> pool;
+  constexpr int kRounds = 200;
+  std::latch start(threads);
+  for (int t = 0; t < threads; ++t) {
+    pool.emplace_back([&, t] {
+      start.arrive_and_wait();
+      for (int round = 0; round < kRounds; ++round) {
+        const NodeId r = static_cast<NodeId>((round + t) % 9);
+        const NodeId roots[1] = {r};
+        if (cache.lookup(*g, roots, Direction::Reverse, nullptr).get() != want[static_cast<std::size_t>(r)].get()) ++wrong;
+      }
+    });
+  }
+  for (auto& th : pool) th.join();
+  EXPECT_EQ(wrong.load(), 0);
+  const auto after = cache.stats();
+  EXPECT_EQ(after.hits - before.hits, static_cast<std::int64_t>(threads) * kRounds);
+  EXPECT_EQ(after.misses, before.misses);
+  EXPECT_EQ(after.entries, 9);
+  // Joined: thaw and build again.
+  cache.thaw();
+  (void)cache.lookup(*g, v({0, 1}), Direction::Reverse, nullptr);
+  EXPECT_EQ(cache.stats().entries, 10);
+}
+
+} // namespace
+
+TEST(DagCacheFrozen, HitsFromOneThread) { frozen_readers(1); }
+TEST(DagCacheFrozen, HitsFromTwoThreads) { frozen_readers(2); }
+TEST(DagCacheFrozen, HitsFromFourThreads) { frozen_readers(4); }
+
+// A frozen cache shared by every worker of a batch gives the batch without a cache: per pair the
+// placed amount and every output (on this symmetric fabric the amounts alone would not tell the
+// pairs apart: the first three each place the same amount, on different edges).
+TEST(DagCacheFrozen, SharedByEveryWorkerOfABatch) {
+  const auto g = fabric();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {v({0}), v({3})}, {v({1}), v({4})}, {v({2}), v({5})}, {v({0, 1}), v({3, 4})}};
+  const OutputOptions all {true, true, true};
+  const auto want = evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, nullptr, all}, {}, 1);
+  for (const auto& r : want) EXPECT_GT(r.call_delivered, 0);  // every pair places: the comparison is not of zeros
+  for (int workers : {1, 2, 4}) {
+    ShortestPathCache cache(*g);
+    for (const auto& [s, t] : pairs) (void)cache.lookup(*g, t, Direction::Reverse, nullptr);
+    // A building cache with two or more workers is rejected; frozen, it is shared.
+    if (workers > 1) {
+      EXPECT_THROW(
+          (void)evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, &cache, all}, {}, workers),
+          std::invalid_argument);
+    }
+    cache.freeze();
+    const auto before = cache.stats();
+    const auto got = evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, &cache, all}, {}, workers);
+    ASSERT_EQ(got.size(), want.size());
+    for (std::size_t i = 0; i < got.size(); ++i) {
+      ASSERT_TRUE(got[i].edge_flows.has_value() && want[i].edge_flows.has_value()) << workers << " " << i;
+      ASSERT_TRUE(got[i].residual.has_value() && want[i].residual.has_value()) << workers << " " << i;
+      EXPECT_EQ(got[i].call_delivered, want[i].call_delivered) << workers << " " << i;
+      EXPECT_EQ(got[i].edge_flows, want[i].edge_flows) << workers << " " << i;
+      EXPECT_EQ(got[i].residual, want[i].residual) << workers << " " << i;
+      EXPECT_EQ(got[i].saturated_boundary_edges, want[i].saturated_boundary_edges) << workers << " " << i;
+    }
+    EXPECT_EQ(cache.stats().hits - before.hits, static_cast<std::int64_t>(pairs.size()));
+    EXPECT_EQ(cache.stats().misses, before.misses);
+  }
+}
+
+TEST(DagCacheFrozen, MissPropagatesThroughBatchCapacity) {
+  // A frozen cache holding only pair 1's key: pairs 0 and 2 miss; the lowest index's ShortestPathCacheMiss
+  // (pair 0's) reaches the caller unchanged, with one worker and with several.
+  const auto g = fabric();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({0}), v({3})}, {v({1}), v({4})},
+                                                                                   {v({2}), v({5})}};
+  for (int workers : {1, 2, 4}) {
+    ShortestPathCache cache(*g);
+    (void)cache.lookup(*g, v({4}), Direction::Reverse, nullptr);  // only pair 1's key
+    cache.freeze();
+    const auto msg = miss_of([&] { (void)evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, &cache}, {}, workers); });
+    EXPECT_NE(msg.find("roots {3}"), std::string::npos) << workers << ": " << msg;  // pair 0, the lowest index
+  }
+}
+
+TEST(DagCacheFrozen, PerPairIntersectionsAndPrepopulatedUids) {
+  // An intersection equal to an operand returns that operand (its uid), so the
+  // prepopulated key hits; one that differs from both operands gets a fresh uid and misses.
+  const auto g = fabric();
+  const EdgeId e0[1] = {0};
+  const EdgeId e01[2] = {0, 1};
+  const EdgeId e1[1] = {1};
+  const auto common = g->eligibility({}, e0);    // excludes edge 0
+  const auto narrow = g->eligibility({}, e01);   // excludes 0 and 1: contained in common
+  const auto other = g->eligibility({}, e1);     // excludes 1: neither contains the other
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{v({1}), v({4})}, {v({2}), v({5})}};
+  ShortestPathCache cache(*g);
+  (void)cache.lookup(*g, v({4}), Direction::Reverse, &narrow);
+  (void)cache.lookup(*g, v({5}), Direction::Reverse, &common);
+  (void)cache.lookup(*g, v({4}), Direction::Reverse, &common);
+  cache.freeze();
+  const auto hits = [&] { return cache.stats().hits; };
+  // A common value containing the per-pair one: intersect returns the per-pair operand.
+  auto before = hits();
+  const std::vector<const Eligibility*> contained = {&narrow, nullptr};
+  EXPECT_EQ(evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), &common, &cache}, contained, 2).size(), 2U);
+  EXPECT_EQ(hits() - before, 2);
+  // An unchanged intersection (the operand itself) and already-effective values with a null
+  // common value.
+  before = hits();
+  const std::vector<const Eligibility*> same = {&common, &common};
+  EXPECT_EQ(evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), &common, &cache}, same, 2).size(), 2U);
+  const std::vector<const Eligibility*> own = {&narrow, &common};
+  EXPECT_EQ(evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, &cache}, own, 2).size(), 2U);
+  EXPECT_EQ(hits() - before, 4);
+  // An intersection that differs from both operands: a fresh uid, absent from the cache.
+  const auto misses = cache.stats().misses;
+  const std::vector<const Eligibility*> changed = {&other, nullptr};
+  const auto msg = miss_of([&] { (void)evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), &common, &cache}, changed, 2); });
+  EXPECT_NE(msg.find("roots {4}"), std::string::npos) << msg;
+  EXPECT_EQ(msg.find("uid " + std::to_string(common.uid()) + " "), std::string::npos) << msg;
+  EXPECT_EQ(msg.find("uid " + std::to_string(other.uid()) + " "), std::string::npos) << msg;
+  EXPECT_EQ(cache.stats().misses - misses, 1);
+  EXPECT_EQ(cache.stats().entries, 3);
+}
+
+TEST(DagCacheFrozen, MissPropagatesThroughSensitivity) {
+  // ShortestPaths' failure study evaluates each candidate under a new Eligibility (a new uid): with a
+  // frozen cache holding only the baseline's key, the first re-evaluated deletion misses and the
+  // miss reaches the caller.
+  const auto g = fabric();
+  for (int workers : {1, 2, 4}) {
+    ShortestPathCache cache(*g);
+    (void)cache.lookup(*g, v({4}), Direction::Reverse, nullptr);
+    cache.freeze();
+    const auto msg = miss_of([&] { (void)evaluate_edge_failures(*g, v({1}), v({4}), EvaluationOptions {shortest_paths_config(), nullptr, &cache}, workers); });
+    EXPECT_NE(msg.find("no entry for roots {4}"), std::string::npos) << workers << ": " << msg;
+    EXPECT_EQ(cache.stats().entries, 1);  // nothing inserted
+  }
+}
+
+TEST(DagCacheFrozen, DeletionModeSensitivityRejectsASuppliedFrozenCache) {
+  // CentralizedTE's failure study repairs the baseline's state per deletion and reads no cache: a supplied
+  // cache, frozen too, is rejected before any worker starts, its statistics unchanged.
+  const auto g = fabric();
+  for (int workers : {1, 2, 4}) {
+    ShortestPathCache cache(*g);
+    cache.freeze();
+    EXPECT_THROW((void)evaluate_edge_failures(*g, v({0, 1}), v({4, 5}), EvaluationOptions {global_config(), nullptr, &cache}, workers),
+                 std::invalid_argument);
+    EXPECT_EQ(cache.stats().hits + cache.stats().misses, 0);
+  }
+}
+
+TEST(DagCacheFrozen, AFailedCallChangesNoStatisticButItsMiss) {
+  // A frozen cache's statistics are observable state: a public call reading a frozen cache
+  // publishes its hits only when it succeeds. A batch whose pair 0 hits and pair 1 misses raises
+  // the miss and keeps no hit; the miss counts once, with one worker and with several (the boundary
+  // counts it, not the workers); the policy constructor and ShortestPaths' failure study do the same.
+  const auto g = fabric();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {
+      {v({0}), v({3})}, {v({1}), v({4})}, {v({2}), v({5})}, {v({0}), v({3})}};
+  for (int workers : {1, 2, 4}) {
+    ShortestPathCache cache(*g);
+    (void)cache.lookup(*g, v({3}), Direction::Reverse, nullptr);
+    cache.freeze();
+    auto before = stats_of(cache.stats());
+    // Pairs 1 and 2 miss; pairs 0 and 3 hit.
+    EXPECT_NE(miss_of([&] { (void)evaluate_pairs(*g, pairs, EvaluationOptions {shortest_paths_config(), nullptr, &cache}, {}, workers); })
+                  .find("roots {4}"),
+              std::string::npos);
+    auto want = before;
+    std::get<1>(want) += 1;
+    EXPECT_EQ(stats_of(cache.stats()), want) << workers;
+    before = stats_of(cache.stats());
+    EXPECT_NE(miss_of([&] {
+                (void)evaluate_edge_failures(*g, v({0}), v({3}), EvaluationOptions {shortest_paths_config(), nullptr, &cache}, workers);
+              }).find("roots {3}"),
+              std::string::npos);
+    want = before;
+    std::get<1>(want) += 1;
+    EXPECT_EQ(stats_of(cache.stats()), want) << workers;  // the baseline's hit is dropped
+  }
+  ShortestPathCache cache(*g);
+  cache.freeze();
+  FlowLedger fg(g);
+  EXPECT_FALSE(miss_of([&] { FlowPolicy p(fg, v({0}), v({3}), shortest_paths_config(), nullptr, &cache); }).empty());
+  EXPECT_EQ(stats_of(cache.stats()), std::make_tuple(0, 1, 0, 0, 0));
+}
+
+TEST(DagCacheFrozen, ConcurrentCallsKeepEverySuccessfulHit) {
+  // Calls on one frozen cache from four threads at once, each a successful batch (two hits), a
+  // failing batch (its hit dropped, one miss) and a successful capacity (one hit): every
+  // successful call's hits are kept, no failed call's, and every failed call's miss is counted.
+  const auto g = fabric();
+  ShortestPathCache cache(*g);
+  for (NodeId d : {3, 4}) (void)cache.lookup(*g, v({d}), Direction::Reverse, nullptr);
+  cache.freeze();
+  const auto before = cache.stats();
+  const EvaluationOptions opts {shortest_paths_config(), nullptr, &cache};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> good = {{v({0}), v({3})}, {v({1}), v({4})}};
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> bad = {{v({0}), v({3})}, {v({1}), v({5})}};
+  constexpr int kThreads = 4;
+  constexpr int kRounds = 25;
+  std::atomic<int> wrong {0};
+  std::vector<std::thread> pool;
+  std::latch start(kThreads);  // the threads start together, once all of them are running
+  for (int t = 0; t < kThreads; ++t) {
+    pool.emplace_back([&] {
+      start.arrive_and_wait();
+      for (int round = 0; round < kRounds; ++round) {
+        if (evaluate_pairs(*g, good, opts, {}, 2).size() != 2) ++wrong;
+        try {
+          (void)evaluate_pairs(*g, bad, opts, {}, 2);
+          ++wrong;
+        } catch (const ShortestPathCacheMiss&) {
+        }
+        if (evaluate_demand(*g, v({2}), v({3}), opts).call_delivered <= 0) ++wrong;
+      }
+    });
+  }
+  for (auto& th : pool) th.join();
+  EXPECT_EQ(wrong.load(), 0);
+  const auto after = cache.stats();
+  EXPECT_EQ(after.hits - before.hits, static_cast<std::int64_t>(kThreads) * kRounds * 3);
+  EXPECT_EQ(after.misses - before.misses, static_cast<std::int64_t>(kThreads) * kRounds);
+  EXPECT_EQ(after.entries, 2);
+  EXPECT_EQ(after.bytes, before.bytes);
+  EXPECT_EQ(after.live_values, before.live_values);
+}
+
+TEST(DagCacheFrozen, ConcurrentPublicationsLoseNoIncrement) {
+  // Many short public calls at once (a ShortestPaths policy constructor: one frozen hit, published as
+  // its last step), so that publications from different threads overlap often: the hits are
+  // added atomically, none is lost.
+  const auto g = fabric();
+  ShortestPathCache cache(*g);
+  (void)cache.lookup(*g, v({3}), Direction::Reverse, nullptr);
+  cache.freeze();
+  const auto before = cache.stats().hits;
+  constexpr int kThreads = 8;
+  constexpr int kRounds = 1500;
+  std::vector<std::thread> pool;
+  std::latch start(kThreads);  // the threads start together, once all of them are running
+  for (int t = 0; t < kThreads; ++t) {
+    pool.emplace_back([&] {
+      FlowLedger fg(g);
+      start.arrive_and_wait();
+      for (int round = 0; round < kRounds; ++round) FlowPolicy p(fg, v({0}), v({3}), shortest_paths_config(), nullptr, &cache);
+    });
+  }
+  for (auto& th : pool) th.join();
+  EXPECT_EQ(cache.stats().hits - before, static_cast<std::int64_t>(kThreads) * kRounds);
+}
diff --git a/tests/cpp/shortest_paths_creation_tests.cpp b/tests/cpp/shortest_paths_creation_tests.cpp
new file mode 100644
index 0000000..ef0b02c
--- /dev/null
+++ b/tests/cpp/shortest_paths_creation_tests.cpp
@@ -0,0 +1,647 @@
+// The ShortestPaths creation products in one pass: prepare_shortest_paths
+// against the general path the policy takes wherever the one pass declines (support_route's route,
+// the record route of record_route_of, prepare_route's plan and cost on that route), on random graphs for
+// every source, route choice and kernel: it answers exactly where that path's members are the whole
+// route, with the same record route (the support itself when the route is all of it), plan and cost. On
+// crafted supports that break its preconditions (edges leaving a destination, dead ends, members
+// below one unit, a cycle) it answers nothing or the general path's own result. Also
+// lower_bound_from against std::lower_bound from every hint, the plan's one block under copy
+// and move, and the plan comparison of test_utils.hpp against a plan changed in each field. The
+// general path is production code, not an independent reference: its parts are
+// checked independently elsewhere (support_route against search_reference.hpp, also under
+// residual priority views, in Search.InternalEntriesMatchThePublicSearch; prepare_route against the
+// walk definition for every kernel in route_kernels_tests.cpp).
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <functional>
+#include <limits>
+#include <memory>
+#include <numeric>
+#include <optional>
+#include <random>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/detail/search_detail.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+using namespace netgraph::core::detail;
+
+namespace {
+
+// Every field of two plans equal (plan_differences, test_utils.hpp).
+void expect_same_plan(const PreparedRoute& got, const PreparedRoute& want, const std::string& where) {
+  EXPECT_EQ(plan_differences(got, want), std::vector<std::string> {}) << where;
+}
+
+// The policy's general ShortestPaths creation (flow_policy.cpp: shortest_path_support, record_route_of and the
+// plan on the route, capacity weights), taken wherever the one pass declines; where the one pass
+// answers, it must equal this.
+struct GeneralPath {
+  std::vector<EdgeId> route;
+  std::shared_ptr<const PredecessorDAG> record_route;
+  PreparedRoute plan;
+  Cost cost {kUnreachable};
+};
+
+GeneralPath general_path(const Graph& g, const std::shared_ptr<const PredecessorDAG>& support, NodeId src,
+                    const std::vector<NodeId>& dsts, const RouteChoice& sel, PriorityReader view,
+                    const std::vector<Amount>& W, RouteAllocation placement, Admission admission) {
+  GeneralPath out;
+  auto r = support_route(g, PredecessorDAGBuilder::ascending(*support), src, dsts, sel, view);
+  out.route = r.edges;
+  Cost cost = sel.single_path() && !r.edges.empty() ? r.cost : kUnreachable;
+  out.record_route = PredecessorDAGBuilder::ascending(*support).size() == r.edges.size() ? support : dag_of(g, r.edges);
+  (void)W;
+  const bool computed = cost == kUnreachable;
+  out.plan = prepare_route(g, placement, admission, WeightSource {}, src, dsts, *out.record_route, computed ? &cost : nullptr);
+  out.cost = cost;
+  return out;
+}
+
+struct Kernel {
+  RouteAllocation placement;
+  Admission admission;
+};
+
+const Kernel kKernels[] = {{RouteAllocation::Optimized, Admission::Lossless},
+                           {RouteAllocation::Equal, Admission::Lossless},
+                           {RouteAllocation::Equal, Admission::Lossy},
+                           {RouteAllocation::Weighted, Admission::Lossless},
+                           {RouteAllocation::Weighted, Admission::Lossy}};
+
+// The 13 route choices a ShortestPaths configuration accepts: every tie_break with multipath and
+// parallel_edges, but no HIGHER_* tie_break with both true.
+std::vector<RouteChoice> choices() {
+  std::vector<RouteChoice> out;
+  for (auto tie : {RouteTieBreak::FewerHops, RouteTieBreak::HigherCapacity, RouteTieBreak::HigherAvailableCapacity,
+                   RouteTieBreak::HigherHeadroom}) {
+    for (bool mp : {true, false}) {
+      for (bool me : {true, false}) {
+        if (tie != RouteTieBreak::FewerHops && mp && me) continue;
+        out.push_back(RouteChoice {tie, mp, me});
+      }
+    }
+  }
+  return out;
+}
+
+// Random edges with many ties (costs 1 to 3, times `factor`), parallel bursts, capacities 0 to 4
+// units.
+Graph tied_graph(std::mt19937& rng, int n, int m, Cost factor = 1) {
+  std::vector<InEdge> edges;
+  while (static_cast<int>(edges.size()) < m) {
+    const auto u = static_cast<NodeId>(rng() % static_cast<unsigned>(n));
+    const auto v = static_cast<NodeId>(rng() % static_cast<unsigned>(n));
+    const int copies = rng() % 4 == 0 ? 1 + static_cast<int>(rng() % 3) : 1;
+    for (int c = 0; c < copies; ++c) {
+      edges.push_back({u, v, static_cast<Amount>(rng() % 5), static_cast<Cost>(1 + rng() % 3) * factor});
+    }
+  }
+  return make_graph(n, edges);
+}
+
+// What the comparison below counts.
+struct Tally {
+  long made {0};
+  long shared {0};
+  long collapsed {0};  // answers whose route Collapse changed (one edge per node pair)
+  long weighted {0};
+  long anycast {0};
+  long unrouted {0};  // declined although the route choice and kernel qualify: the general path has no route
+  long zero_weight {0};  // declined: a Weighted route with an edge of capacity 0 (weight 0, no member)
+  long beyond_int32 {0};  // answers whose route cost exceeds INT32_MAX
+};
+
+// The comparison on `trials` random graphs whose edge costs are 1 to 3 times `factor`: for every
+// source, every one of the 13 route choices and every legal kernel, the one pass answers exactly where
+// the general path's members are its whole multipath route, with the same record route (the support itself
+// when the route is all of it), every plan array and the exact cost.
+Tally compare_with_general_path(std::mt19937& rng, int trials, Cost factor) {
+  const auto sels = choices();
+  Tally t;
+  for (int trial = 0; trial < trials; ++trial) {
+    const int n = 2 + static_cast<int>(rng() % 10);
+    const Graph g = tied_graph(rng, n, static_cast<int>(rng() % 40), factor);
+    std::optional<Eligibility> elig;
+    if (rng() % 3 == 0) {
+      std::vector<NodeId> xn;
+      std::vector<EdgeId> xe;
+      if (rng() % 2 == 0) xn.push_back(static_cast<NodeId>(rng() % static_cast<unsigned>(n)));
+      for (int k = 0; k < 2 && g.num_edges() > 0; ++k) xe.push_back(static_cast<EdgeId>(rng() % static_cast<unsigned>(g.num_edges())));
+      elig = g.eligibility(xn, xe);
+    }
+    const Eligibility* el = elig ? &*elig : nullptr;
+    std::vector<NodeId> D;
+    for (std::size_t k = 1 + rng() % 3; k > 0; --k) D.push_back(static_cast<NodeId>(rng() % static_cast<unsigned>(n)));
+    const auto dset = allowed_nodes(D, nullptr);
+    const auto dsts = allowed_nodes(D, el);
+    if (dsts.empty()) continue;
+    const auto support = std::make_shared<const PredecessorDAG>(static_support(g, dset, Direction::Reverse, el));
+    std::vector<Amount> W(static_cast<std::size_t>(g.num_edges()));
+    for (std::size_t e = 0; e < W.size(); ++e) {
+      const Amount cap = g.edge_capacity_units()[e];
+      W[e] = cap == 0 ? 0 : static_cast<Amount>(rng() % static_cast<std::uint32_t>(cap + 1));
+    }
+    for (NodeId src = 0; src < n; ++src) {
+      if (std::binary_search(dset.begin(), dset.end(), src)) continue;
+      for (const auto& sel : sels) {
+        const PriorityValues values {&g, sel.tie_break, W};
+        const PriorityReader view = PriorityReader::of(values);
+        for (const auto& k : kKernels) {
+          const std::string where = "factor " + std::to_string(factor) + " trial " + std::to_string(trial) + " src " + std::to_string(src) + " kernel " +
+                                    std::to_string(static_cast<int>(k.placement)) + "/" +
+                                    std::to_string(static_cast<int>(k.admission)) + " sel " +
+                                    std::to_string(static_cast<int>(sel.tie_break)) + std::to_string(!sel.single_path()) +
+                                    std::to_string(sel.parallel_edges);
+          const auto want = general_path(g, support, src, dsts, sel, view, W, k.placement, k.admission);
+          const auto got = prepare_shortest_paths(g, support, src, dsts, sel, view, k.placement, k.admission, WeightSource {});
+          // It answers exactly where the general path's members are its whole multipath route under a
+          // kernel of static membership (on a valid support: every route that exists, except a
+          // Weighted route with an edge of capacity 0, which has weight 0 and is no member).
+          // Capacity weights (ShortestPaths's default basis) are static whatever the tie_break: every
+          // multipath route choice qualifies.
+          const bool qualifies = !sel.single_path();
+          const bool applies = qualifies && !want.route.empty() && want.plan.forwarding_edges == want.route;
+          EXPECT_EQ(got.has_value(), applies) << where;
+          if (got.has_value() != applies) return t;
+          if (!got.has_value()) {
+            t.unrouted += qualifies && want.route.empty() ? 1 : 0;
+            t.zero_weight += qualifies && !want.route.empty() ? 1 : 0;
+            if (qualifies && !want.route.empty()) EXPECT_EQ(k.placement, RouteAllocation::Weighted) << where;
+            continue;
+          }
+          EXPECT_EQ(want.plan.forwarding_edges, want.route) << where;  // the precondition the shortcut checks
+          EXPECT_TRUE(got->route) << where;
+          if (!got->route) return t;
+          EXPECT_TRUE(*got->route == *want.record_route) << where;
+          EXPECT_EQ(ascending_edges(*got->route), want.route) << where;
+          EXPECT_EQ(got->route == support, want.record_route == support) << where;  // the same shared value
+          expect_same_plan(got->prepared_route, want.plan, where);
+          EXPECT_EQ(got->min_route_cost, want.cost) << where;
+          ++t.made;
+          if (want.record_route == support) ++t.shared;
+          if (!sel.parallel_edges) {
+            // Collapse ran when the route differs from the one the same tie_break takes with every
+            // parallel edge kept.
+            RouteChoice all_edges = sel;
+            all_edges.parallel_edges = true;
+            if (support_route(g, PredecessorDAGBuilder::ascending(*support), src, dsts, all_edges, view).edges != want.route) ++t.collapsed;
+          }
+          if (k.placement == RouteAllocation::Weighted) ++t.weighted;
+          if (dsts.size() > 1) ++t.anycast;
+          if (want.cost > std::numeric_limits<std::int32_t>::max()) ++t.beyond_int32;
+          if (::testing::Test::HasFailure()) return t;
+        }
+      }
+    }
+  }
+  return t;
+}
+
+} // namespace
+
+TEST(ShortestPathsCreation, LowerBoundFromEveryHintIsStdLowerBound) {
+  std::mt19937 rng(20261007);
+  int forward = 0;   // the answer above the hint
+  int backward = 0;  // the answer below the hint
+  for (int trial = 0; trial < 400; ++trial) {
+    const auto n = static_cast<std::size_t>(rng() % 140);
+    std::vector<EdgeId> a(n);
+    EdgeId x = static_cast<EdgeId>(rng() % 3);
+    for (auto& v : a) {
+      v = x;
+      x += 1 + static_cast<EdgeId>(rng() % 4);
+    }
+    const EdgeId top = n == 0 ? 3 : a.back() + 3;
+    for (EdgeId key = -2; key <= top; ++key) {
+      const auto want = static_cast<std::size_t>(std::lower_bound(a.begin(), a.end(), key) - a.begin());
+      for (std::size_t hint = 0; hint <= n + 3; ++hint) {
+        ASSERT_EQ(lower_bound_from(a, hint, key), want) << "n " << n << " key " << key << " hint " << hint;
+        forward += want > hint ? 1 : 0;
+        backward += want < hint ? 1 : 0;
+      }
+    }
+  }
+  EXPECT_GT(forward, 1000000);
+  EXPECT_GT(backward, 1000000);
+}
+
+TEST(ShortestPathsCreation, EqualsTheGeneralPathForEverySourceSelectionAndKernel) {
+  std::mt19937 rng(1007);
+  const Tally t = compare_with_general_path(rng, 300, 1);
+  // Not vacuous: every branch of the one pass was compared, and the declined inputs too.
+  EXPECT_GT(t.made, 12000);  // this seed: 17,046 (13 route choices)
+  EXPECT_GT(t.shared, 500);
+  EXPECT_GT(t.collapsed, 2000);  // this seed: 2,838
+  EXPECT_GT(t.weighted, 4000);
+  EXPECT_GT(t.anycast, 4000);
+  EXPECT_GT(t.unrouted, 10000);
+  EXPECT_GT(t.zero_weight, 1000);
+}
+
+TEST(ShortestPathsCreation, WideCostsEqualTheGeneralPath) {
+  // Repeat the general-path comparison with factors 3, 64 and 2^35. These cases catch the
+  // int32 output truncation; with 2^35 every answered cost exceeds INT32_MAX.
+  // They do not catch every narrower representation: an output cut to 48 bits would pass here
+  // (ChainCostsBeyondInt32AreExact catches it).
+  for (const Cost factor : {Cost {3}, Cost {64}, Cost {1} << 35}) {
+    std::mt19937 rng(static_cast<std::uint32_t>(2000 + factor % 997));
+    const Tally t = compare_with_general_path(rng, 120, factor);
+    if (::testing::Test::HasFailure()) return;
+    EXPECT_GT(t.made, 5000) << "factor " << factor;  // factor 3: 6,695
+    EXPECT_GT(t.shared, 150) << "factor " << factor;
+    EXPECT_GT(t.collapsed, 700) << "factor " << factor;  // these seeds: 1,452, 946 and 1,210
+    EXPECT_GT(t.unrouted, 4000) << "factor " << factor;
+    if (factor == (Cost {1} << 35)) EXPECT_EQ(t.beyond_int32, t.made);
+  }
+}
+
+TEST(ShortestPathsCreation, ChainCostsBeyondInt32AreExact) {
+  // A chain of two edges beyond int32 (0 -> 1 -> 2, two edges of 2^35: the cost 2^36 =
+  // 68,719,476,736), a chain whose total 2,500,000,000 exceeds INT32_MAX without being a power of
+  // two, a diamond of 2^35 edges with a parallel pair, and a full-width chain of two edges of
+  // 2^60 + 1 (the cost 2^61 + 2, below the graph's 2^62 bound; a 48-bit output mask gives 2): the
+  // exact cost and every array, for every legal kernel, both parallel_edges settings.
+  struct Chain {
+    std::int32_t n;
+    std::vector<InEdge> edges;
+    NodeId dst;
+    Cost cost;
+  };
+  const Cost big = Cost {1} << 35;
+  const std::vector<Chain> chains = {
+      {3, {{0, 1, 3, big}, {1, 2, 3, big}}, 2, Cost {68719476736}},
+      {3, {{0, 1, 5, 1500000000}, {1, 2, 5, 1000000000}}, 2, Cost {2500000000}},
+      {4, {{0, 1, 4, big}, {0, 2, 3, big}, {1, 3, 2, big}, {2, 3, 1, big}, {2, 3, 2, big}}, 3, 2 * big},
+      {3, {{0, 1, 2, (Cost {1} << 60) + 1}, {1, 2, 2, (Cost {1} << 60) + 1}}, 2, Cost {2305843009213693954}},
+  };
+  for (const auto& c : chains) {
+    ASSERT_GT(c.cost, std::numeric_limits<std::int32_t>::max());
+    const Graph g = make_graph(c.n, c.edges);
+    const std::vector<NodeId> dsts = {c.dst};
+    const auto support = std::make_shared<const PredecessorDAG>(static_support(g, dsts, Direction::Reverse, nullptr));
+    const std::vector<Amount> W(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+    for (bool me : {true, false}) {
+      const RouteChoice sel {me ? RouteTieBreak::FewerHops : RouteTieBreak::HigherCapacity, true, me};
+      const PriorityValues values {&g, sel.tie_break, W};
+      for (const auto& k : kKernels) {
+        const std::string where = "chain cost " + std::to_string(c.cost) + " kernel " +
+                                  std::to_string(static_cast<int>(k.placement)) + "/" +
+                                  std::to_string(static_cast<int>(k.admission)) + " parallel_edges " + std::to_string(me);
+        const auto want = general_path(g, support, 0, dsts, sel, PriorityReader::of(values), W, k.placement, k.admission);
+        const auto got =
+            prepare_shortest_paths(g, support, 0, dsts, sel, PriorityReader::of(values), k.placement, k.admission, WeightSource {});
+        ASSERT_TRUE(got.has_value()) << where;
+        EXPECT_EQ(want.cost, c.cost) << where;
+        EXPECT_EQ(got->min_route_cost, c.cost) << where;
+        EXPECT_TRUE(*got->route == *want.record_route) << where;
+        EXPECT_EQ(ascending_edges(*got->route), want.route) << where;
+        EXPECT_EQ(got->route == support, want.record_route == support) << where;
+        expect_same_plan(got->prepared_route, want.plan, where);
+      }
+    }
+  }
+}
+
+TEST(ShortestPathsCreation, LargerGraphsEqualTheGeneralPath) {
+  // Larger fabrics (Clos and random) where the walk crosses many ranges: every source of the two
+  // Clos fabrics and every 7th source of the two 200-node random graphs, to one and to two
+  // destinations, the EB and Optimized kernels, with and without Collapse. A record route shares the
+  // support only when the general path's does (a record route equal to the support is met by the
+  // two general-path comparisons above, which count it).
+  std::mt19937 rng(7);
+  for (int shape = 0; shape < 4; ++shape) {
+    long made = 0;
+    long anycast = 0;  // answers to two destinations
+    Graph g = [&] {
+      if (shape < 2) {
+        std::vector<InEdge> edges;
+        const int leaves = shape == 0 ? 12 : 20;
+        const int spines = shape == 0 ? 6 : 8;
+        for (int u = 0; u < leaves; ++u) {
+          for (int s = 0; s < spines; ++s) {
+            const Amount cap = static_cast<Amount>(1 + rng() % 9);
+            for (int copy = 0; copy < (rng() % 5 == 0 ? 2 : 1); ++copy) {
+              edges.push_back({u, leaves + s, cap, 1});
+              edges.push_back({leaves + s, u, cap, 1});
+            }
+          }
+        }
+        return make_graph(leaves + spines, edges);
+      }
+      return tied_graph(rng, 200, 2400);
+    }();
+    const int n = g.num_nodes();
+    std::vector<Amount> W(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+    for (int q = 0; q < 6; ++q) {
+      std::vector<NodeId> D = {static_cast<NodeId>(rng() % static_cast<unsigned>(n))};
+      if (q % 2 == 1) D.push_back(static_cast<NodeId>(rng() % static_cast<unsigned>(n)));
+      const auto dsts = allowed_nodes(D, nullptr);
+      const auto support = std::make_shared<const PredecessorDAG>(static_support(g, dsts, Direction::Reverse, nullptr));
+      for (NodeId src = 0; src < n; src += (n > 50 ? 7 : 1)) {
+        if (std::binary_search(dsts.begin(), dsts.end(), src)) continue;
+        for (bool me : {true, false}) {
+          const RouteChoice sel {me ? RouteTieBreak::FewerHops : RouteTieBreak::HigherCapacity, true, me};
+          const PriorityValues values {&g, sel.tie_break, W};
+          for (auto placement : {RouteAllocation::Equal, RouteAllocation::Optimized}) {
+            const auto want = general_path(g, support, src, dsts, sel, PriorityReader::of(values), W, placement,
+                                        Admission::Lossless);
+            const auto got = prepare_shortest_paths(g, support, src, dsts, sel, PriorityReader::of(values), placement,
+                                                Admission::Lossless, WeightSource {});
+            ASSERT_EQ(got.has_value(), !want.route.empty());
+            if (!got) continue;
+            EXPECT_TRUE(*got->route == *want.record_route);
+            EXPECT_EQ(got->route == support, want.record_route == support);
+            expect_same_plan(got->prepared_route, want.plan, "shape " + std::to_string(shape) + " src " + std::to_string(src));
+            EXPECT_EQ(got->min_route_cost, want.cost);
+            ++made;
+            anycast += dsts.size() > 1 ? 1 : 0;
+          }
+        }
+      }
+    }
+    EXPECT_GT(made, 150) << "shape " << shape;
+    EXPECT_GT(anycast, 80) << "shape " << shape;
+  }
+}
+
+TEST(ShortestPathsCreation, CraftedSupportsGiveNothingOrTheGeneralPath) {
+  // Acyclic edge sets that are no static support: edges leaving a destination, nodes that reach no
+  // destination, members below one unit. The one pass declines them or equals the general path.
+  std::mt19937 rng(99);
+  long made = 0;
+  long trimmed = 0;  // answers whose record route is not the support itself
+  long declined = 0;
+  for (int trial = 0; trial < 1500; ++trial) {
+    const int n = 3 + static_cast<int>(rng() % 8);
+    const Graph g = tied_graph(rng, n, 4 + static_cast<int>(rng() % 30));
+    std::vector<NodeId> perm(static_cast<std::size_t>(n));
+    std::iota(perm.begin(), perm.end(), 0);
+    std::shuffle(perm.begin(), perm.end(), rng);
+    std::vector<int> rank(static_cast<std::size_t>(n));
+    for (int i = 0; i < n; ++i) rank[static_cast<std::size_t>(perm[static_cast<std::size_t>(i)])] = i;
+    std::vector<EdgeId> chosen;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      const auto u = g.edge_sources()[static_cast<std::size_t>(e)];
+      const auto v = g.edge_destinations()[static_cast<std::size_t>(e)];
+      if (rank[static_cast<std::size_t>(u)] < rank[static_cast<std::size_t>(v)] && rng() % 4 != 0) chosen.push_back(e);
+    }
+    const auto support = dag_of(g, chosen);
+    const NodeId src = perm.front();
+    std::vector<NodeId> dsts = {perm.back()};
+    if (n > 4 && rng() % 2 == 0) dsts.push_back(perm[static_cast<std::size_t>(n / 2)]);  // may have out-edges
+    std::sort(dsts.begin(), dsts.end());
+    std::vector<Amount> W(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+    for (bool me : {true, false}) {
+      const RouteChoice sel {RouteTieBreak::FewerHops, true, me};
+      const PriorityValues values {&g, sel.tie_break, W};
+      for (const auto& k : kKernels) {
+        const auto want = general_path(g, support, src, dsts, sel, PriorityReader::of(values), W, k.placement, k.admission);
+        const auto got =
+            prepare_shortest_paths(g, support, src, dsts, sel, PriorityReader::of(values), k.placement, k.admission, WeightSource {});
+        const std::string where = "trial " + std::to_string(trial);
+        if (!got.has_value()) {
+          ++declined;
+          continue;
+        }
+        EXPECT_TRUE(*got->route == *want.record_route) << where;
+        EXPECT_EQ(got->route == support, want.record_route == support) << where;
+        expect_same_plan(got->prepared_route, want.plan, where);
+        EXPECT_EQ(got->min_route_cost, want.cost) << where;
+        ++made;
+        trimmed += *want.record_route == *support ? 0 : 1;
+        if (::testing::Test::HasFailure()) return;
+      }
+    }
+  }
+  EXPECT_GT(made, 1000);
+  EXPECT_GT(trimmed, 800);
+  EXPECT_GT(declined, 1000);
+}
+
+TEST(ShortestPathsCreation, DeclinesEachBrokenPrecondition) {
+  // 0 -> 1 -> 3 and 0 -> 2 -> 3, destination 3: the general path keeps the whole route, and so
+  // does the one pass. Each variant breaks one precondition; the one pass then answers nothing (the
+  // general path's members differ from its route, or it throws), except that Optimized and
+  // Equal keep a member below one unit (only Weighted gives it weight 0 and drops it).
+  const Graph g = make_graph(6, {{0, 1, 2, 1}, {0, 2, 2, 1}, {1, 3, 2, 1}, {2, 3, 2, 1}, {3, 4, 2, 1},
+                                 {1, 5, 2, 1}, {2, 1, 2, 1}, {1, 2, 0, 1}});
+  const auto inv = id_of_input(g);
+  const std::vector<NodeId> dsts = {3};
+  const std::vector<Amount> W(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  const RouteChoice sel {RouteTieBreak::FewerHops, true, true};
+  const PriorityValues values {&g, sel.tie_break, W};
+  auto run = [&](std::vector<EdgeId> edges, RouteAllocation placement) {
+    for (auto& e : edges) e = inv[static_cast<std::size_t>(e)];
+    std::sort(edges.begin(), edges.end());
+    const auto support = dag_of(g, edges);
+    return std::make_pair(support, prepare_shortest_paths(g, support, 0, dsts, sel, PriorityReader::of(values), placement,
+                                                      Admission::Lossless, WeightSource {}));
+  };
+  {
+    const auto [support, got] = run({0, 1, 2, 3}, RouteAllocation::Equal);
+    ASSERT_TRUE(got.has_value());
+    EXPECT_EQ(got->route, support);  // the route is the whole support
+    EXPECT_EQ(got->min_route_cost, 2);
+    EXPECT_EQ(vec(got->prepared_route.topological_order), (std::vector<NodeId> {0, 1, 2, 3}));
+  }
+  // An edge leaving the destination (3 -> 4).
+  EXPECT_FALSE(run({0, 1, 2, 3, 4}, RouteAllocation::Equal).second.has_value());
+  // A node that reaches no destination (1 -> 5).
+  EXPECT_FALSE(run({0, 1, 2, 3, 5}, RouteAllocation::Equal).second.has_value());
+  // A member below one unit (1 -> 2 has no capacity): declined for Weighted, kept by Optimized and
+  // Equal.
+  EXPECT_FALSE(run({0, 1, 2, 3, 7}, RouteAllocation::Weighted).second.has_value());
+  EXPECT_TRUE(run({0, 1, 2, 3, 7}, RouteAllocation::Optimized).second.has_value());
+  EXPECT_TRUE(run({0, 1, 2, 3, 7}, RouteAllocation::Equal).second.has_value());
+  // A cycle (1 -> 2 -> 1): declined, and the general path throws.
+  {
+    const auto [support, got] = run({0, 1, 2, 3, 6, 7}, RouteAllocation::Optimized);
+    EXPECT_FALSE(got.has_value());
+    EXPECT_THROW((void)general_path(g, support, 0, dsts, sel, PriorityReader::of(values), W, RouteAllocation::Optimized,
+                                 Admission::Lossless),
+                 std::logic_error);
+  }
+  // Not applicable: multipath = false, Weighted with residual-snapshot weights, no destination reached.
+  {
+    std::vector<EdgeId> edges = {inv[0], inv[1], inv[2], inv[3]};
+    std::sort(edges.begin(), edges.end());
+    const auto support = dag_of(g, edges);
+    const RouteChoice single {RouteTieBreak::FewerHops, false, true};
+    EXPECT_FALSE(prepare_shortest_paths(g, support, 0, dsts, single, PriorityReader::of(values), RouteAllocation::Equal,
+                                    Admission::Lossless, WeightSource {})
+                     .has_value());
+    const RouteChoice residual {RouteTieBreak::FewerHops, true, true};
+    EXPECT_FALSE(prepare_shortest_paths(g, support, 0, dsts, residual, PriorityReader::of(values), RouteAllocation::Weighted,
+                                    Admission::Lossless, WeightSource {WeightBasis::ResidualSnapshot, {}})
+                     .has_value());
+    EXPECT_FALSE(prepare_shortest_paths(g, support, 0, std::vector<NodeId> {5}, sel, PriorityReader::of(values),
+                                    RouteAllocation::Equal, Admission::Lossless, WeightSource {})
+                     .has_value());
+  }
+}
+
+TEST(KernelPlanBlock, CopiesAndMovesKeepTheirOwnViews) {
+  const Graph g = make_graph(4, {{0, 1, 3, 1}, {0, 2, 2, 1}, {1, 3, 3, 1}, {2, 3, 2, 1}});
+  const auto dag = PredecessorDAGBuilder::of_edges(g, all_ids(g));
+  const std::vector<NodeId> dsts = {3};
+  const PreparedRoute original =
+      prepare_route(g, RouteAllocation::Weighted, Admission::Lossless, WeightSource {}, 0, dsts, dag);
+  ASSERT_EQ(original.topological_order.size(), 4U);
+  ASSERT_EQ(original.edge_destination_positions.size(), 4U);
+  ASSERT_EQ(vec(original.destinations), dsts);
+  // A copy's views point into its own block (none into the source's), and stay valid once the
+  // source is gone.
+  auto own_block = [](const PreparedRoute& a, const PreparedRoute& b) {
+    return a.sources.data() != b.sources.data() && a.source_positions.data() != b.source_positions.data() &&
+           a.destinations.data() != b.destinations.data() && a.topological_order.data() != b.topological_order.data() &&
+           a.outgoing_begin.data() != b.outgoing_begin.data() && a.outgoing_end.data() != b.outgoing_end.data() &&
+           a.edge_destination_positions.data() != b.edge_destination_positions.data() && a.is_destination.data() != b.is_destination.data();
+  };
+  std::optional<PreparedRoute> source(original);
+  const PreparedRoute copy(*source);
+  EXPECT_TRUE(own_block(copy, *source));
+  source.reset();
+  expect_same_plan(copy, original, "copy");
+  PreparedRoute donor(copy);
+  PreparedRoute moved(std::move(donor));
+  expect_same_plan(moved, original, "move");
+  EXPECT_TRUE(donor.topological_order.empty() && donor.destinations.empty() && donor.edge_destination_positions.empty() && donor.is_destination.empty() &&
+              donor.sources.empty() && donor.source_positions.empty());
+  PreparedRoute assigned;
+  assigned = copy;
+  expect_same_plan(assigned, original, "copy assignment");
+  EXPECT_TRUE(own_block(assigned, copy));
+  PreparedRoute target = prepare_route(g, RouteAllocation::Equal, Admission::Lossless, WeightSource {}, 1, dsts, dag);
+  target = std::move(moved);
+  expect_same_plan(target, original, "move assignment");
+  EXPECT_TRUE(moved.topological_order.empty() && moved.destinations.empty() && moved.edge_destination_positions.empty() && moved.is_destination.empty() &&
+              moved.sources.empty() && moved.source_positions.empty());
+  const PreparedRoute& self = target;
+  target = self;
+  expect_same_plan(target, original, "self assignment");
+  const PreparedRoute empty;
+  const PreparedRoute empty_copy(empty);
+  EXPECT_TRUE(empty_copy.destinations.empty() && empty_copy.topological_order.empty() && empty_copy.forwarding_edges.empty() &&
+              empty_copy.sources.empty() && empty_copy.source_positions.empty());
+}
+
+// A lifetime witness: two identical chains, 0 -> 1 -> 2 and 3 -> 4 -> 5, give plans of one shape
+// (one root, one destination, three positions, two members) and other values. A copy (and a copy
+// assignment) of the first chain's plan keeps its roots, root positions and destinations after the
+// plan it was copied from is destroyed and plans of the same shape for the second chain have been
+// built (they reuse freed blocks of that size): a copy whose views still pointed into the
+// destroyed block would read the second chain's root 3 and destination 5.
+TEST(KernelPlanBlock, ACopyOutlivesItsSource) {
+  const Graph g = make_graph(6, {{0, 1, 2, 1}, {1, 2, 2, 1}, {3, 4, 2, 1}, {4, 5, 2, 1}});
+  auto chain = [&](NodeId src, NodeId dst) {
+    const std::vector<EdgeId> edges = src == 0 ? std::vector<EdgeId> {0, 1} : std::vector<EdgeId> {2, 3};
+    const auto dag = PredecessorDAGBuilder::of_edges(g, edges);
+    return prepare_route(g, RouteAllocation::Equal, Admission::Lossless, WeightSource {}, src,
+                     std::vector<NodeId> {dst}, dag);
+  };
+  for (const bool assign : {false, true}) {
+    std::optional<PreparedRoute> owner(chain(0, 2));
+    ASSERT_EQ(vec(owner->sources), (std::vector<NodeId> {0}));
+    ASSERT_EQ(vec(owner->source_positions), (std::vector<std::int32_t> {0}));
+    std::optional<PreparedRoute> copy;
+    if (assign) {
+      copy.emplace(chain(3, 5));
+      *copy = *owner;
+    } else {
+      copy.emplace(*owner);
+    }
+    owner.reset();
+    std::vector<PreparedRoute> later;
+    for (int i = 0; i < 64; ++i) later.push_back(chain(3, 5));
+    const std::string where = assign ? "copy assignment" : "copy construction";
+    EXPECT_EQ(vec(copy->sources), (std::vector<NodeId> {0})) << where;
+    EXPECT_EQ(vec(copy->source_positions), (std::vector<std::int32_t> {0})) << where;
+    EXPECT_EQ(vec(copy->destinations), (std::vector<NodeId> {2})) << where;
+    EXPECT_EQ(vec(copy->topological_order), (std::vector<NodeId> {0, 1, 2})) << where;
+  }
+}
+
+// The plan comparison names every field that differs: a copy of a real plan with one field changed
+// differs in exactly that field (a vector or view field both by its last entry and by one more
+// entry), and without the route only the route may differ.
+TEST(TestHelpers, PlanDifferencesNameEveryField) {
+  const Graph g = make_graph(4, {{0, 1, 3, 1}, {0, 2, 2, 1}, {1, 3, 3, 1}, {2, 3, 2, 1}});
+  const auto dag = PredecessorDAGBuilder::of_edges(g, all_ids(g));
+  const std::vector<NodeId> dsts = {3};
+  const PreparedRoute plan =
+      prepare_route(g, RouteAllocation::Weighted, Admission::Lossless, WeightSource {}, 0, dsts, dag);
+  ASSERT_EQ(plan.weights.size(), 4U);
+  EXPECT_EQ(plan_differences(plan, plan), std::vector<std::string> {});
+  // The views' changed copies live here, as the plan's own views live in its block.
+  std::vector<NodeId> nodes;
+  std::vector<std::int32_t> positions;
+  std::vector<std::uint8_t> flags;
+  using Change = std::function<void(PreparedRoute&)>;
+  auto nodes_of = [&](std::span<const NodeId> x, bool longer) {
+    nodes.assign(x.begin(), x.end());
+    if (longer) nodes.push_back(0);
+    else ++nodes.back();
+    return std::span<const NodeId>(nodes);
+  };
+  auto positions_of = [&](std::span<const std::int32_t> x, bool longer) {
+    positions.assign(x.begin(), x.end());
+    if (longer) positions.push_back(0);
+    else ++positions.back();
+    return std::span<const std::int32_t>(positions);
+  };
+  const std::vector<std::pair<std::string, Change>> changes = {
+      {"allocation", [](auto& x) { x.allocation = RouteAllocation::Equal; }},
+      {"sources", [&](auto& x) { x.sources = nodes_of(x.sources, false); }},
+      {"sources", [&](auto& x) { x.sources = nodes_of(x.sources, true); }},
+      {"source_positions", [&](auto& x) { x.source_positions = positions_of(x.source_positions, false); }},
+      {"source_positions", [&](auto& x) { x.source_positions = positions_of(x.source_positions, true); }},
+      {"destinations", [&](auto& x) { x.destinations = nodes_of(x.destinations, false); }},
+      {"destinations", [&](auto& x) { x.destinations = nodes_of(x.destinations, true); }},
+      {"support_edges", [](auto& x) { x.support_edges.push_back(0); }},
+      {"support_edges", [](auto& x) { ++x.support_edges.back(); }},
+      {"forwarding_edges", [](auto& x) { x.forwarding_edges.push_back(0); }},
+      {"forwarding_edges", [](auto& x) { ++x.forwarding_edges.back(); }},
+      {"weights", [](auto& x) { x.weights.push_back(1); }},
+      {"weights", [](auto& x) { ++x.weights.back(); }},
+      {"topological_order", [&](auto& x) { x.topological_order = nodes_of(x.topological_order, false); }},
+      {"topological_order", [&](auto& x) { x.topological_order = nodes_of(x.topological_order, true); }},
+      {"outgoing_begin", [&](auto& x) { x.outgoing_begin = positions_of(x.outgoing_begin, false); }},
+      {"outgoing_begin", [&](auto& x) { x.outgoing_begin = positions_of(x.outgoing_begin, true); }},
+      {"outgoing_end", [&](auto& x) { x.outgoing_end = positions_of(x.outgoing_end, false); }},
+      {"outgoing_end", [&](auto& x) { x.outgoing_end = positions_of(x.outgoing_end, true); }},
+      {"edge_destination_positions", [&](auto& x) { x.edge_destination_positions = positions_of(x.edge_destination_positions, false); }},
+      {"edge_destination_positions", [&](auto& x) { x.edge_destination_positions = positions_of(x.edge_destination_positions, true); }},
+      {"is_destination", [&](auto& x) {
+         flags.assign(x.is_destination.begin(), x.is_destination.end());
+         flags.back() = flags.back() == 0 ? 1 : 0;
+         x.is_destination = flags;
+       }},
+      {"is_destination", [&](auto& x) {
+         flags.assign(x.is_destination.begin(), x.is_destination.end());
+         flags.push_back(0);
+         x.is_destination = flags;
+       }},
+  };
+  for (std::size_t k = 0; k < changes.size(); ++k) {
+    PreparedRoute x = plan;
+    changes[k].second(x);
+    EXPECT_EQ(plan_differences(x, plan), std::vector<std::string> {changes[k].first}) << k;
+    const auto without_route = changes[k].first == "support_edges" ? std::vector<std::string> {}
+                                                           : std::vector<std::string> {changes[k].first};
+    EXPECT_EQ(plan_differences(x, plan, false), without_route) << k;
+    // expect_same_plan reports it.
+    EXPECT_EQ(failures_of([&] { expect_same_plan(x, plan, "changed"); }), 1) << k;
+  }
+  EXPECT_EQ(failures_of([&] { expect_same_plan(plan, plan, "same"); }), 0);
+}
diff --git a/tests/cpp/shortest_paths_tests.cpp b/tests/cpp/shortest_paths_tests.cpp
deleted file mode 100644
index 0483b8b..0000000
--- a/tests/cpp/shortest_paths_tests.cpp
+++ /dev/null
@@ -1,701 +0,0 @@
-#include <gtest/gtest.h>
-#include <limits>
-#include <memory>
-#include <random>
-#include "netgraph/core/constants.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/backend.hpp"
-#include "netgraph/core/algorithms.hpp"
-#include "netgraph/core/options.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-TEST(ShortestPaths, SingleSourceAllNodes) {
-  auto g = make_line_graph(5);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Distances should be 0, 1, 2, 3, 4
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_DOUBLE_EQ(dist[1], 1.0);
-  EXPECT_DOUBLE_EQ(dist[2], 2.0);
-  EXPECT_DOUBLE_EQ(dist[3], 3.0);
-  EXPECT_DOUBLE_EQ(dist[4], 4.0);
-
-  expect_pred_dag_valid(dag, g.num_nodes());
-}
-
-TEST(ShortestPaths, DisconnectedComponents) {
-  // Create two disconnected components: 0-1 and 2-3
-  std::int32_t src[2] = {0, 2};
-  std::int32_t dst[2] = {1, 3};
-  double cap[2] = {1.0, 1.0};
-  std::int64_t cost[2] = {1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 2), std::span(dst, 2),
-    std::span(cap, 2), std::span(cost, 2));
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Nodes 0, 1 should be reachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_DOUBLE_EQ(dist[1], 1.0);
-
-  // Nodes 2, 3 should be unreachable
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[3], std::numeric_limits<Cost>::max());
-}
-
-TEST(ShortestPaths, MultipleEqualCostPaths) {
-  auto g = make_square_graph(2);  // Two equal-cost paths
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Both paths should have cost 2
-  EXPECT_DOUBLE_EQ(dist[2], 2.0);
-
-  // Node 2 should have two parents in the DAG
-  auto start = static_cast<std::size_t>(dag.parent_offsets[2]);
-  auto end = static_cast<std::size_t>(dag.parent_offsets[3]);
-  EXPECT_GT(end - start, 0);  // At least one predecessor
-}
-
-TEST(ShortestPaths, ResidualAwareFiltering) {
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = true;  // Only use edges with capacity
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  // Create residual with first edge having zero capacity
-  std::vector<Cap> residual(g.num_edges(), 1.0);
-  residual[0] = 0.0;  // Block first edge
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, residual, {}, {});
-
-  // Node 1 should be unreachable
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-}
-
-TEST(ShortestPaths, NodeMaskIsolation) {
-  // Verify that masking out the middle node in a line graph blocks reachability
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  // Mask out node 1 (middle node) - blocks path from 0 to 2
-  auto node_mask = make_bool_mask(g.num_nodes());
-  node_mask[1] = false;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, std::span<const bool>(node_mask.get(), g.num_nodes()), {});
-
-  // Nodes 1 and 2 should be unreachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-}
-
-TEST(ShortestPaths, EdgeMaskFiltering) {
-  // Verify that masking out an edge removes it from consideration
-  auto g = make_line_graph(3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  // Mask out first edge (0->1) - blocks the entire path
-  auto edge_mask = make_bool_mask(g.num_edges());
-  edge_mask[0] = false;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, std::span<const bool>(edge_mask.get(), g.num_edges()));
-
-  // Node 1 should be unreachable
-  EXPECT_DOUBLE_EQ(dist[0], 0.0);
-  EXPECT_EQ(dist[1], std::numeric_limits<Cost>::max());
-}
-
-TEST(ShortestPaths, EarlyExitOptimization) {
-  auto g = make_line_graph(10);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  // With destination specified, should exit early
-  auto [dist, dag] = shortest_paths(g, 0, NodeId(2), true, sel, {}, {}, {});
-
-  EXPECT_DOUBLE_EQ(dist[2], 2.0);
-  expect_pred_dag_valid(dag, g.num_nodes());
-}
-
-TEST(ShortestPaths, PredDAGIntegrity) {
-  auto g = make_grid_graph(3, 3);
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  expect_pred_dag_valid(dag, g.num_nodes());
-
-  // Source node should have no predecessors
-  EXPECT_EQ(dag.parent_offsets[0], 0);
-  EXPECT_EQ(dag.parent_offsets[1], 0);
-}
-
-TEST(ShortestPaths, TieBreakingDeterminism) {
-  // Two parallel edges with same cost
-  std::int32_t src[2] = {0, 0};
-  std::int32_t dst[2] = {1, 1};
-  double cap[2] = {1.0, 2.0};
-  std::int64_t cost[2] = {1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 2), std::span(dst, 2),
-    std::span(cap, 2), std::span(cost, 2));
-
-  EdgeSelection sel;
-  sel.multi_edge = false;  // Single edge selection
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist1, dag1] = shortest_paths(g, 0, std::nullopt, false, sel, {}, {}, {});
-  auto [dist2, dag2] = shortest_paths(g, 0, std::nullopt, false, sel, {}, {}, {});
-
-  // Results should be deterministic
-  EXPECT_EQ(dist1[1], dist2[1]);
-
-  // Should select the same edge both times
-  EXPECT_EQ(dag1.via_edges[0], dag2.via_edges[0]);
-}
-
-TEST(ShortestPaths, PreferHigherResidualTieBreak) {
-  // Same two parallel edges but enforce HigherResidual tie-break
-  std::int32_t src[2] = {0, 0};
-  std::int32_t dst[2] = {1, 1};
-  double cap[2] = {1.0, 2.0};
-  std::int64_t cost[2] = {1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 2), std::span(dst, 2),
-    std::span(cap, 2), std::span(cost, 2));
-
-  // Residuals equal to capacity; higher residual should pick edge with cap=2
-  EdgeSelection sel;
-  sel.multi_edge = false;
-  sel.require_capacity = true;
-  sel.tie_break = EdgeTieBreak::PreferHigherResidual;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, false, sel, g.capacity_view(), {}, {});
-  ASSERT_FALSE(dag.via_edges.empty());
-  // Edge ids are compacted; find which corresponds to cap=2 by checking capacity
-  auto chosen = dag.via_edges[0];
-  auto capv = g.capacity_view();
-  EXPECT_EQ(capv[chosen], 2.0);
-}
-
-TEST(ShortestPaths, ResolveToPathsSplittingParallelEdges) {
-  // Test resolve_to_paths both with and without splitting parallel edges
-  // Graph 0->1 has two parallel edges, 1->2 single edge
-  std::int32_t src[3] = {0, 0, 1};
-  std::int32_t dst[3] = {1, 1, 2};
-  double cap[3] = {1.0, 1.0, 1.0};
-  std::int64_t cost[3] = {1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 2, true, sel, {}, {}, {});
-
-  // Resolve without splitting (grouped parallel edges)
-  auto grouped = resolve_to_paths(dag, 0, 2, /*split_parallel_edges=*/false);
-  ASSERT_FALSE(grouped.empty());
-  ASSERT_GE(grouped[0].size(), 2u);
-  // First tuple corresponds to node 0 with two parallel edges grouped
-  EXPECT_EQ(grouped[0][0].first, 0);
-  EXPECT_EQ(grouped[0][0].second.size(), 2u);
-
-  // Resolve with splitting should produce 2 concrete paths (one per parallel edge)
-  auto concrete = resolve_to_paths(dag, 0, 2, /*split_parallel_edges=*/true);
-  EXPECT_EQ(concrete.size(), 2u);
-}
-
-TEST(ShortestPaths, ResolveToPathsWithMaxPathsLimit) {
-  // Verify that max_paths limit caps enumeration in resolve_to_paths
-  // Create graph with multiple equal-cost paths via 2x2 grid
-  std::int32_t src[4] = {0, 0, 1, 2};
-  std::int32_t dst[4] = {1, 2, 3, 3};
-  double cap[4] = {1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost[4] = {1, 1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src, 4), std::span(dst, 4),
-    std::span(cap, 4), std::span(cost, 4));
-
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  auto [dist, dag] = shortest_paths(g, 0, 3, true, sel, {}, {}, {});
-
-  // Without limit, should find both paths
-  auto all_paths = resolve_to_paths(dag, 0, 3, false, std::nullopt);
-  EXPECT_GE(all_paths.size(), 1u);
-
-  // With max_paths=1, enumeration should stop at first path
-  auto limited = resolve_to_paths(dag, 0, 3, false, std::int64_t(1));
-  EXPECT_EQ(limited.size(), 1u);
-}
-
-TEST(ShortestPaths, LargeGraphStressTest) {
-  // Create a larger graph to test performance
-  auto g = make_grid_graph(20, 20);  // 400 nodes
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  sel.require_capacity = false;
-  sel.tie_break = EdgeTieBreak::Deterministic;
-
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {});
-
-  // Bottom-right corner should be reachable with cost 38 (19 right + 19 down)
-  EXPECT_DOUBLE_EQ(dist[399], 38.0);
-  expect_pred_dag_valid(dag, g.num_nodes());
-}
-
-TEST(ShortestPaths, RejectsMaskLengthMismatch) {
-  // Simple line graph 0->1->2
-  auto g = make_line_graph(3);
-  auto be = make_cpu_backend();
-  Algorithms algs(be);
-  auto gh = algs.build_graph(g);
-  SpfOptions opts;
-  opts.multipath = true;
-  opts.dst = 2;
-  // Create node_mask with wrong length (N-1)
-  auto node_mask = make_bool_mask(static_cast<std::size_t>(g.num_nodes() - 1), true);
-  opts.node_mask = std::span<const bool>(node_mask.get(), static_cast<std::size_t>(g.num_nodes() - 1));
-  EXPECT_THROW({ (void)algs.spf(gh, 0, opts); }, std::invalid_argument);
-
-  // Edge mask wrong length (M-1)
-  SpfOptions opts2;
-  opts2.multipath = true;
-  opts2.dst = 2;
-  auto edge_mask = make_bool_mask(static_cast<std::size_t>(g.num_edges() - 1), true);
-  opts2.edge_mask = std::span<const bool>(edge_mask.get(), static_cast<std::size_t>(g.num_edges() - 1));
-  EXPECT_THROW({ (void)algs.spf(gh, 0, opts2); }, std::invalid_argument);
-}
-
-// ============================================================================
-// Regression: zero-cost edges must not create cycles in the PredDAG
-// ============================================================================
-
-// A zero-cost pair 1<->2 previously recorded each node as the other's parent
-// (both relaxations see an "equal cost" path), producing a cyclic PredDAG.
-// EqualBalanced placement then stalled (returned 0 flow) and path enumeration
-// walked the cycle forever. Equal-cost predecessors are now only accepted while
-// the child is unsettled, which keeps the DAG acyclic by settle order.
-TEST(ShortestPaths, ZeroCostEdges_PredDAGIsAcyclic) {
-  std::int32_t src_arr[4] = {0, 1, 2, 2};
-  std::int32_t dst_arr[4] = {1, 2, 1, 3};
-  double cap_arr[4] = {10.0, 10.0, 10.0, 10.0};
-  std::int64_t cost_arr[4] = {1, 0, 0, 1};
-  auto g = StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-
-  EdgeSelection sel;
-  sel.multi_edge = true;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, /*multipath=*/true, sel);
-
-  EXPECT_EQ(dist[3], 2);
-
-  // No 2-cycles: v's parent u must not also have v as a parent.
-  for (std::int32_t v = 0; v < 4; ++v) {
-    for (auto i = dag.parent_offsets[static_cast<std::size_t>(v)];
-         i < dag.parent_offsets[static_cast<std::size_t>(v) + 1]; ++i) {
-      auto u = dag.parents[static_cast<std::size_t>(i)];
-      for (auto j = dag.parent_offsets[static_cast<std::size_t>(u)];
-           j < dag.parent_offsets[static_cast<std::size_t>(u) + 1]; ++j) {
-        EXPECT_NE(dag.parents[static_cast<std::size_t>(j)], v)
-            << "cycle " << u << "<->" << v << " in PredDAG";
-      }
-    }
-  }
-
-  // Path enumeration must terminate and yield the single simple path.
-  auto paths = resolve_to_paths(dag, 0, 3);
-  ASSERT_EQ(paths.size(), 1u);
-  EXPECT_EQ(paths[0].size(), 4u);  // 0 -> 1 -> 2 -> 3
-}
-
-// ---------------------------------------------------------------------------
-// shortest_paths_to: reverse SPF toward one destination, with forced fan-out.
-// ---------------------------------------------------------------------------
-#include "netgraph/core/flow_state.hpp"
-
-namespace {
-// Nodes: 0=P (pseudo source), 1=S1, 2=S2, 3=M, 4=T.
-// Edges: 0: P->S1 cost 0 cap 1e6; 1: P->S2 cost 0 cap 1e6;
-//        2: S1->T cost 1 cap 100;  3: S2->M cost 1 cap 20; 4: M->T cost 1 cap 60.
-// S1 is one hop from T, S2 two hops, so an SPF from P keeps only S1.
-StrictMultiDiGraph make_fanout_graph() {
-  std::int32_t src[5]  = {0, 0, 1, 2, 3};
-  std::int32_t dst[5]  = {1, 2, 4, 3, 4};
-  double       cap[5]  = {1e6, 1e6, 100.0, 20.0, 60.0};
-  std::int64_t cost[5] = {0, 0, 1, 1, 1};
-  return StrictMultiDiGraph::from_arrays(5,
-    std::span(src, 5), std::span(dst, 5), std::span(cap, 5), std::span(cost, 5));
-}
-EdgeSelection cost_only_sel() {
-  EdgeSelection sel; sel.multi_edge = true; sel.require_capacity = false; sel.tie_break = EdgeTieBreak::Deterministic;
-  return sel;
-}
-} // namespace
-
-TEST(ShortestPathsTo, DistancesMatchForwardDistancesToDst) {
-  auto g = make_grid_graph(3, 4);
-  const NodeId t = g.num_nodes() - 1;
-  auto [dist_to, dag] = shortest_paths_to(g, t, /*multipath=*/true, cost_only_sel());
-  expect_pred_dag_valid(dag, g.num_nodes());
-  for (NodeId s = 0; s < g.num_nodes(); ++s) {
-    auto [dist_from_s, fwd] = shortest_paths(g, s, t, /*multipath=*/true, cost_only_sel());
-    EXPECT_EQ(dist_to[static_cast<std::size_t>(s)], dist_from_s[static_cast<std::size_t>(t)]) << "node " << s;
-  }
-  // Every DAG entry u -> v via e lies on a shortest u -> t walk.
-  const auto esrc = g.edge_src_view(); const auto edst = g.edge_dst_view(); const auto cost = g.cost_view();
-  for (NodeId v = 0; v < g.num_nodes(); ++v) {
-    for (auto i = dag.parent_offsets[static_cast<std::size_t>(v)]; i < dag.parent_offsets[static_cast<std::size_t>(v)+1]; ++i) {
-      const auto e = static_cast<std::size_t>(dag.via_edges[static_cast<std::size_t>(i)]);
-      const NodeId u = dag.parents[static_cast<std::size_t>(i)];
-      EXPECT_EQ(esrc[e], u); EXPECT_EQ(edst[e], v);
-      EXPECT_EQ(dist_to[static_cast<std::size_t>(u)], cost[e] + dist_to[static_cast<std::size_t>(v)]);
-    }
-  }
-}
-
-TEST(ShortestPathsTo, ForwardSpfFromPseudoSourceKeepsOnlyNearestSource) {
-  auto g = make_fanout_graph();
-  auto [dist, dag] = shortest_paths(g, 0, 4, /*multipath=*/true, cost_only_sel());
-  // T (node 4) is reached only via S1 -> T (edge 2): S2's branch costs 2 and is
-  // not on a shortest P -> T path, so a placement from P never uses S2.
-  ASSERT_EQ(dag.parent_offsets[5] - dag.parent_offsets[4], 1);
-  EXPECT_EQ(dag.via_edges[static_cast<std::size_t>(dag.parent_offsets[4])], 2);
-}
-
-TEST(ShortestPathsTo, FanoutEdgesForceEverySourceIntoTheDag) {
-  auto g = make_fanout_graph();
-  EdgeId fan[2] = {0, 1};
-  auto [dist, dag] = shortest_paths_to(g, 4, /*multipath=*/true, cost_only_sel(), {}, {}, {}, std::span<const EdgeId>(fan, 2));
-  expect_pred_dag_valid(dag, g.num_nodes());
-  EXPECT_EQ(dist[1], 1); EXPECT_EQ(dist[2], 2); EXPECT_EQ(dist[0], 1) << "pseudo source keeps the SPF distance via S1";
-  // Both S1 and S2 now have P as parent via their attachment edge.
-  ASSERT_EQ(dag.parent_offsets[2] - dag.parent_offsets[1], 1); EXPECT_EQ(dag.via_edges[static_cast<std::size_t>(dag.parent_offsets[1])], 0);
-  ASSERT_EQ(dag.parent_offsets[3] - dag.parent_offsets[2], 1); EXPECT_EQ(dag.via_edges[static_cast<std::size_t>(dag.parent_offsets[2])], 1);
-  // Entry the SPF already recorded (P->S1) is not duplicated.
-  int p_entries = 0;
-  for (auto v : dag.parents) if (v == 0) ++p_entries;
-  EXPECT_EQ(p_entries, 2);
-
-  // Lossless equal-balanced admission over the fan-out: shares 50/50 of 100;
-  // S2's branch admits 20 of 50 (link 3) so the whole demand scales to 0.4.
-  FlowState fs(g);
-  EXPECT_NEAR(fs.place_on_dag(0, 4, dag, 100.0, FlowPlacement::EqualBalanced), 40.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[2], 20.0, 1e-9);
-  EXPECT_NEAR(fs.edge_flow_view()[3], 20.0, 1e-9);
-}
-
-TEST(ShortestPathsTo, FanoutSkipsUnreachableAndMaskedHeads) {
-  auto g = make_fanout_graph();
-  EdgeId fan[2] = {0, 1};
-  auto edge_mask = make_bool_mask(static_cast<std::size_t>(g.num_edges()), true);
-  edge_mask[3] = false;  // S2 -> M down: S2 cannot reach T
-  auto [dist, dag] = shortest_paths_to(g, 4, true, cost_only_sel(), {}, {},
-                                       std::span<const bool>(edge_mask.get(), static_cast<std::size_t>(g.num_edges())),
-                                       std::span<const EdgeId>(fan, 2));
-  EXPECT_EQ(dist[2], std::numeric_limits<Cost>::max());
-  EXPECT_EQ(dag.parent_offsets[3] - dag.parent_offsets[2], 0) << "no fan-out entry to an unreachable source";
-  EXPECT_EQ(dag.parent_offsets[2] - dag.parent_offsets[1], 1);
-}
-
-TEST(ShortestPathsTo, FanoutFromInteriorNodeIsRejected) {
-  auto g = make_fanout_graph();
-  EdgeId fan[1] = {4};  // M -> T, but M already has the incoming entry S2 -> M
-  EXPECT_THROW((void)shortest_paths_to(g, 4, true, cost_only_sel(), {}, {}, {}, std::span<const EdgeId>(fan, 1)),
-               std::invalid_argument);
-  EdgeId bad[1] = {99};
-  EXPECT_THROW((void)shortest_paths_to(g, 4, true, cost_only_sel(), {}, {}, {}, std::span<const EdgeId>(bad, 1)),
-               std::invalid_argument);
-}
-
-TEST(ShortestPathsTo, SinglePathModeKeepsOneSuccessorPerNode) {
-  auto g = make_n_disjoint_paths(3, 10.0);
-  const NodeId t = g.num_nodes() - 1;
-  auto [dist, dag] = shortest_paths_to(g, t, /*multipath=*/false, cost_only_sel());
-  expect_pred_dag_valid(dag, g.num_nodes());
-  // Count DAG entries leaving node 0: exactly one successor.
-  int leaving_src = 0;
-  for (auto p : dag.parents) if (p == 0) ++leaving_src;
-  EXPECT_EQ(leaving_src, 1);
-}
-
-// ---------------------------------------------------------------------------
-// Queue differential: the bucket queue must reproduce the reference heap's
-// results bit for bit (distances, parent_offsets, parents, via_edges) across
-// the whole option matrix, including zero-cost edges, masks, residuals,
-// single-path capacity ties, destination early exit and workspace reuse.
-// ---------------------------------------------------------------------------
-namespace {
-
-using SpfResult = std::pair<std::vector<Cost>, PredDAG>;
-
-struct DiffGraph {
-  StrictMultiDiGraph g;
-  std::unique_ptr<bool[]> node_mask, edge_mask;
-  std::vector<Cap> residual;
-  std::span<const bool> nm() const { return {node_mask.get(), static_cast<std::size_t>(g.num_nodes())}; }
-  std::span<const bool> em() const { return {edge_mask.get(), static_cast<std::size_t>(g.num_edges())}; }
-};
-
-struct DiffSpec {
-  unsigned seed; int n; int degree; bool masked; Cost max_cost; int zero_pct; bool int64_offset;
-};
-
-DiffGraph make_diff_graph(const DiffSpec& s) {
-  std::mt19937 rng(s.seed);
-  std::vector<std::int32_t> src, dst;
-  std::vector<Cap> cap;
-  std::vector<Cost> cost;
-  auto draw_cost = [&]() -> Cost {
-    Cost c = (static_cast<int>(rng() % 100) < s.zero_pct) ? 0 : 1 + static_cast<Cost>(rng() % static_cast<unsigned>(s.max_cost));
-    return c + (s.int64_offset ? (Cost(1) << 34) : 0);
-  };
-  for (int u = 0; u < s.n; ++u) {
-    src.push_back(u); dst.push_back((u + 1) % s.n); cost.push_back(draw_cost()); cap.push_back(1.0 + double(rng() % 100) / 7.0);
-    for (int k = 1; k < s.degree; ++k) {
-      src.push_back(u); dst.push_back(static_cast<int>(rng() % s.n));   // self-loops and parallel edges allowed
-      cost.push_back(draw_cost()); cap.push_back(1.0 + double(rng() % 100) / 7.0);
-    }
-  }
-  // A root node with out-edges only (never has an incoming DAG entry): its
-  // out-edges serve as legal fanout edges for the reverse search.
-  const int root = s.n;
-  for (int k = 0; k < 3; ++k) { src.push_back(root); dst.push_back(static_cast<int>(rng() % s.n)); cost.push_back(draw_cost()); cap.push_back(2.0); }
-  DiffGraph d{StrictMultiDiGraph::from_arrays(s.n + 1, src, dst, cap, cost), nullptr, nullptr, {}};
-  const int N = d.g.num_nodes(); const int E = d.g.num_edges();
-  d.node_mask = std::make_unique<bool[]>(static_cast<std::size_t>(N));
-  d.edge_mask = std::make_unique<bool[]>(static_cast<std::size_t>(E));
-  d.residual.assign(d.g.capacity_view().begin(), d.g.capacity_view().end());
-  for (int i = 0; i < N; ++i) d.node_mask[static_cast<std::size_t>(i)] = !s.masked || rng() % 23 != 0;
-  for (int i = 0; i < E; ++i) {
-    d.edge_mask[static_cast<std::size_t>(i)] = !s.masked || rng() % 11 != 0;
-    if (s.masked && rng() % 13 == 0) d.residual[static_cast<std::size_t>(i)] = 0;
-    if (s.masked && rng() % 17 == 0) d.residual[static_cast<std::size_t>(i)] = kMinCap * static_cast<Cap>(rng() % 3);
-  }
-  return d;
-}
-
-bool same_result(const SpfResult& a, const SpfResult& b) {
-  return a.first == b.first && a.second.parent_offsets == b.second.parent_offsets &&
-         a.second.parents == b.second.parents && a.second.via_edges == b.second.via_edges;
-}
-
-const std::vector<DiffSpec> kDiffSpecs = {
-  {1, 40, 5, true, 31, 0, false},   {2, 43, 6, true, 31, 0, false},   {3, 46, 6, true, 31, 25, false},
-  {4, 60, 4, false, 1, 0, false},   {5, 64, 5, true, 1, 30, false},   {6, 80, 6, true, 1000, 10, false},
-  {7, 50, 6, true, 31, 0, true},    {8, 120, 8, false, 31, 0, false}, {9, 90, 3, true, 5, 40, false},
-  {10, 30, 12, true, 3, 20, false},
-  // Ring graphs (degree 1): a frontier of one node exercises the bucket
-  // queue's inline item, and zero-cost edges its promotion into the buckets.
-  {11, 300, 1, false, 31, 0, false}, {12, 300, 1, true, 5, 30, false},
-};
-
-template <class Fn>
-void for_each_option(const DiffGraph& d, Fn&& fn) {
-  for (int mp = 0; mp < 2; ++mp) for (int me = 0; me < 2; ++me) for (int tb = 0; tb < 2; ++tb)
-  for (int rc = 0; rc < 2; ++rc) for (int ur = 0; ur < 2; ++ur) for (int um = 0; um < 2; ++um) {
-    EdgeSelection sel;
-    sel.multi_edge = me != 0;
-    sel.require_capacity = rc != 0;
-    sel.tie_break = tb ? EdgeTieBreak::PreferHigherResidual : EdgeTieBreak::Deterministic;
-    auto res = ur ? std::span<const Cap>(d.residual) : std::span<const Cap>{};
-    auto nm = um ? d.nm() : std::span<const bool>{};
-    auto em = um ? d.em() : std::span<const bool>{};
-    fn(mp != 0, sel, res, nm, em);
-  }
-}
-
-} // namespace
-
-TEST(ShortestPaths, QueueDifferential_Forward) {
-  std::size_t checked = 0;
-  for (const auto& spec : kDiffSpecs) {
-    auto d = make_diff_graph(spec);
-    const int n = d.g.num_nodes();
-    for (NodeId s : {NodeId(0), NodeId(n / 3), NodeId(n - 2), NodeId(n - 1)}) {
-      for_each_option(d, [&](bool mp, const EdgeSelection& sel, auto res, auto nm, auto em) {
-        auto full = shortest_paths(d.g, s, std::nullopt, mp, sel, res, nm, em, SpfQueue::Heap);
-        NodeId far = -1; Cost fd = -1;
-        for (int v = 0; v < n; ++v) if (full.first[static_cast<std::size_t>(v)] != std::numeric_limits<Cost>::max() && full.first[static_cast<std::size_t>(v)] > fd) { fd = full.first[static_cast<std::size_t>(v)]; far = v; }
-        const auto row = d.g.row_offsets_view(); const auto col = d.g.col_indices_view();
-        std::vector<std::optional<NodeId>> dsts = {std::nullopt, s, NodeId((s + n / 2) % n), far};
-        if (row[static_cast<std::size_t>(s) + 1] > row[static_cast<std::size_t>(s)]) dsts.push_back(col[static_cast<std::size_t>(row[static_cast<std::size_t>(s)])]);
-        for (auto dst : dsts) {
-          auto expected = shortest_paths(d.g, s, dst, mp, sel, res, nm, em, SpfQueue::Heap);
-          for (int rep = 0; rep < 2; ++rep) {
-            auto actual = shortest_paths(d.g, s, dst, mp, sel, res, nm, em, SpfQueue::Bucket);
-            ++checked;
-            ASSERT_TRUE(same_result(expected, actual))
-                << "seed=" << spec.seed << " src=" << s << " dst=" << (dst ? *dst : -1)
-                << " mp=" << mp << " me=" << sel.multi_edge << " rc=" << sel.require_capacity;
-          }
-          // Auto must equal one of the two explicit routes, and both equal each other.
-          auto automatic = shortest_paths(d.g, s, dst, mp, sel, res, nm, em);
-          ASSERT_TRUE(same_result(expected, automatic));
-        }
-      });
-    }
-  }
-  EXPECT_GT(checked, 20000u);
-}
-
-TEST(ShortestPaths, QueueDifferential_Reverse) {
-  std::size_t checked = 0;
-  for (const auto& spec : kDiffSpecs) {
-    auto d = make_diff_graph(spec);
-    const int n = d.g.num_nodes();
-    const NodeId root = n - 1;
-    const auto row = d.g.row_offsets_view(); const auto aei = d.g.adj_edge_index_view();
-    std::vector<EdgeId> fanout(aei.begin() + row[static_cast<std::size_t>(root)], aei.begin() + row[static_cast<std::size_t>(root) + 1]);
-    for (NodeId t : {NodeId(0), NodeId(n / 3), NodeId(n - 2)}) {
-      for_each_option(d, [&](bool mp, const EdgeSelection& sel, auto res, auto nm, auto em) {
-        for (int with_fanout = 0; with_fanout < 2; ++with_fanout) {
-          auto fo = with_fanout ? std::span<const EdgeId>(fanout) : std::span<const EdgeId>{};
-          auto expected = shortest_paths_to(d.g, t, mp, sel, res, nm, em, fo, SpfQueue::Heap);
-          for (int rep = 0; rep < 2; ++rep) {
-            auto actual = shortest_paths_to(d.g, t, mp, sel, res, nm, em, fo, SpfQueue::Bucket);
-            ++checked;
-            ASSERT_TRUE(same_result(expected, actual))
-                << "seed=" << spec.seed << " dst=" << t << " mp=" << mp << " fanout=" << with_fanout;
-          }
-        }
-      });
-    }
-  }
-  EXPECT_GT(checked, 5000u);
-}
-
-TEST(ShortestPaths, QueueDifferential_ComparisonHasTeeth) {
-  // Guard: the comparison must reject a result whose predecessor order differs.
-  auto d = make_diff_graph(kDiffSpecs[7]);
-  EdgeSelection sel;
-  auto a = shortest_paths(d.g, 0, std::nullopt, true, sel, {}, {}, {}, SpfQueue::Heap);
-  auto b = a;
-  bool permuted = false;
-  for (std::size_t v = 0; v + 1 < b.second.parent_offsets.size() && !permuted; ++v) {
-    auto lo = static_cast<std::size_t>(b.second.parent_offsets[v]);
-    auto hi = static_cast<std::size_t>(b.second.parent_offsets[v + 1]);
-    if (hi - lo >= 2 && b.second.parents[lo] != b.second.parents[hi - 1]) {
-      std::swap(b.second.parents[lo], b.second.parents[hi - 1]);
-      std::swap(b.second.via_edges[lo], b.second.via_edges[hi - 1]);
-      permuted = true;
-    }
-  }
-  ASSERT_TRUE(permuted) << "fixture has no multi-parent node";
-  EXPECT_FALSE(same_result(a, b));
-  EXPECT_TRUE(same_result(a, a));
-}
-
-TEST(ShortestPaths, BucketQueueKeepsCapacityOrderedPredecessors) {
-  // 0 -> {1,2,3} at cost 1 with bottlenecks 1, 3, 2; each -> 4 at cost 1.
-  // Equal-cost nodes settle in descending bottleneck order, so 4's parents are
-  // recorded as 2, 3, 1 (not in node-id order). Both queues must agree.
-  std::vector<std::int32_t> src = {0, 0, 0, 1, 2, 3};
-  std::vector<std::int32_t> dst = {1, 2, 3, 4, 4, 4};
-  std::vector<Cap> cap = {1.0, 3.0, 2.0, 5.0, 5.0, 5.0};
-  std::vector<Cost> cost = {1, 1, 1, 1, 1, 1};
-  auto g = StrictMultiDiGraph::from_arrays(5, src, dst, cap, cost);
-  EdgeSelection sel;
-  for (SpfQueue q : {SpfQueue::Heap, SpfQueue::Bucket, SpfQueue::Auto}) {
-    auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel, {}, {}, {}, q);
-    std::vector<NodeId> parents(dag.parents.begin() + dag.parent_offsets[4], dag.parents.begin() + dag.parent_offsets[5]);
-    EXPECT_EQ(parents, (std::vector<NodeId>{2, 3, 1}));
-    EXPECT_EQ(dist[4], 2);
-  }
-}
-
-TEST(ShortestPaths, WorkspaceIsResetAfterFanoutThrow) {
-  auto d = make_diff_graph(kDiffSpecs[1]);
-  const int n = d.g.num_nodes();
-  EdgeSelection sel;
-  auto before = shortest_paths_to(d.g, 0, true, sel, d.residual, d.nm(), d.em(), {}, SpfQueue::Bucket);
-  auto before_fwd = shortest_paths(d.g, 3, std::nullopt, true, sel, d.residual, d.nm(), d.em(), SpfQueue::Bucket);
-  // A fanout edge leaving a node that already has an incoming DAG entry throws
-  // after the search has filled the workspace.
-  EdgeId offending = -1;
-  const auto esrc = d.g.edge_src_view();
-  for (std::size_t v = 0; v + 1 < before.second.parent_offsets.size() && offending < 0; ++v) {
-    if (before.second.parent_offsets[v + 1] > before.second.parent_offsets[v]) {
-      const auto row = d.g.row_offsets_view(); const auto aei = d.g.adj_edge_index_view();
-      if (row[v + 1] > row[v]) offending = aei[static_cast<std::size_t>(row[v])];
-    }
-  }
-  ASSERT_GE(offending, 0);
-  ASSERT_TRUE(before.second.parent_offsets[static_cast<std::size_t>(esrc[static_cast<std::size_t>(offending)]) + 1] >
-              before.second.parent_offsets[static_cast<std::size_t>(esrc[static_cast<std::size_t>(offending)])]);
-  std::vector<EdgeId> bad = {offending};
-  for (SpfQueue q : {SpfQueue::Bucket, SpfQueue::Heap}) {
-    EXPECT_THROW((void)shortest_paths_to(d.g, 0, true, sel, d.residual, d.nm(), d.em(), bad, q), std::invalid_argument);
-    EXPECT_THROW((void)shortest_paths_to(d.g, 0, true, sel, d.residual, d.nm(), d.em(), std::vector<EdgeId>{n * 10}, q), std::invalid_argument);
-    auto after = shortest_paths_to(d.g, 0, true, sel, d.residual, d.nm(), d.em(), {}, q);
-    EXPECT_TRUE(same_result(before, after));
-    auto after_fwd = shortest_paths(d.g, 3, std::nullopt, true, sel, d.residual, d.nm(), d.em(), q);
-    EXPECT_TRUE(same_result(before_fwd, after_fwd));
-  }
-}
-
-TEST(ShortestPaths, WorkspaceReuseAcrossGraphSizesAndEmptyGraphs) {
-  auto small = make_diff_graph(kDiffSpecs[0]);
-  auto large = make_diff_graph(kDiffSpecs[7]);
-  auto empty = StrictMultiDiGraph::from_arrays(0, {}, {}, {}, {});
-  EdgeSelection sel;
-  for (SpfQueue q : {SpfQueue::Bucket, SpfQueue::Heap}) {
-    auto s1 = shortest_paths(small.g, 1, std::nullopt, true, sel, small.residual, small.nm(), small.em(), q);
-    auto l1 = shortest_paths(large.g, 5, NodeId(7), false, sel, {}, {}, {}, q);
-    auto r1 = shortest_paths_to(large.g, 9, true, sel, large.residual, {}, {}, {}, q);
-    auto e1 = shortest_paths(empty, 0, std::nullopt, true, sel, {}, {}, {}, q);
-    EXPECT_TRUE(e1.first.empty());
-    EXPECT_EQ(e1.second.parent_offsets.size(), 1u);
-    auto e2 = shortest_paths_to(empty, 0, true, sel, {}, {}, {}, {}, q);
-    EXPECT_TRUE(e2.first.empty());
-    auto s2 = shortest_paths(small.g, 1, std::nullopt, true, sel, small.residual, small.nm(), small.em(), q);
-    auto l2 = shortest_paths(large.g, 5, NodeId(7), false, sel, {}, {}, {}, q);
-    auto r2 = shortest_paths_to(large.g, 9, true, sel, large.residual, {}, {}, {}, q);
-    EXPECT_TRUE(same_result(s1, s2));
-    EXPECT_TRUE(same_result(l1, l2));
-    EXPECT_TRUE(same_result(r1, r2));
-    // A masked-out source still returns an all-INF result without touching the workspace.
-    auto masked = make_bool_mask(static_cast<std::size_t>(small.g.num_nodes()), true);
-    masked[1] = false;
-    auto m = shortest_paths(small.g, 1, std::nullopt, true, sel, {}, std::span<const bool>(masked.get(), static_cast<std::size_t>(small.g.num_nodes())), {}, q);
-    for (auto dv : m.first) EXPECT_EQ(dv, std::numeric_limits<Cost>::max());
-    auto s3 = shortest_paths(small.g, 1, std::nullopt, true, sel, small.residual, small.nm(), small.em(), q);
-    EXPECT_TRUE(same_result(s1, s3));
-  }
-}
diff --git a/tests/cpp/smoke_test.cpp b/tests/cpp/smoke_test.cpp
deleted file mode 100644
index eb29f21..0000000
--- a/tests/cpp/smoke_test.cpp
+++ /dev/null
@@ -1,36 +0,0 @@
-#include <gtest/gtest.h>
-#include <span>
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/types.hpp"
-
-using namespace netgraph::core;
-
-TEST(GraphSmoke, ConstructAndRunSPF) {
-  const std::int32_t N = 3;
-  // 0 -> 1 (cost 10)
-  // 1 -> 2 (cost 20)
-  // 0 -> 2 (cost 100)
-  std::int32_t src[3] = {0, 1, 0};
-  std::int32_t dst[3] = {1, 2, 2};
-  double cap[3] = {10.0, 10.0, 10.0};
-  std::int64_t cost[3] = {10, 20, 100};
-
-  auto g = StrictMultiDiGraph::from_arrays(N,
-      std::span<const std::int32_t>(src, 3),
-      std::span<const std::int32_t>(dst, 3),
-      std::span<const double>(cap, 3),
-      std::span<const std::int64_t>(cost, 3));
-
-  EXPECT_EQ(g.num_nodes(), N);
-  EXPECT_EQ(g.num_edges(), 3);
-
-  // Run SPF from 0
-  EdgeSelection sel;
-  auto [dist, dag] = shortest_paths(g, 0, std::nullopt, true, sel);
-
-  // Check distances
-  EXPECT_EQ(dist[0], 0);
-  EXPECT_EQ(dist[1], 10);
-  EXPECT_EQ(dist[2], 30); // Path 0->1->2 is cost 10+20=30, better than 0->2 (100)
-}
diff --git a/tests/cpp/state_comparators.hpp b/tests/cpp/state_comparators.hpp
new file mode 100644
index 0000000..e277178
--- /dev/null
+++ b/tests/cpp/state_comparators.hpp
@@ -0,0 +1,265 @@
+// What a call leaves, as the tests compare it: the ledger (LedgerState, every record field), its
+// invariant (expect_balanced), a policy's epoch state (Epoch) and a placement result; the
+// comparators' negative controls intercept their failures with test_utils.hpp's failures_of.
+// Shared by both test executables; the fault-injection sweeps (fault_injection.hpp) compare
+// through these.
+#pragma once
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/ledger_access.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/detail/program_data.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "test_utils.hpp"
+
+namespace netgraph::core::test {
+
+// The ledger as the tests compare it: both projections (the aggregate and the residual, the
+// holds and the unreserved capacity), every record field (FlowIds keep their local ids: a
+// reference sequence runs on another ledger), the next FlowId and the bound and orphaned owners.
+struct LedgerState {
+  std::vector<Amount> carried;
+  std::vector<Amount> residual;
+  std::vector<Amount> reserved;
+  std::vector<Amount> unreserved;
+  std::vector<FlowRecord> records;
+  std::int64_t next_id {0};
+  std::vector<std::int64_t> bound;
+  std::vector<std::int64_t> orphans;
+};
+
+// Every record's FlowId carries the ledger's uid; then the uid is cleared, so records of two
+// ledgers compare by their local ids.
+inline void expect_uid_then_clear(std::vector<FlowRecord>& records, std::uint64_t uid) {
+  for (auto& r : records) {
+    EXPECT_EQ(r.flow_id.first, uid);
+    r.flow_id.first = 0;
+  }
+}
+
+inline LedgerState ledger_state(const FlowLedger& fg) {
+  using detail::LedgerAccess;
+  LedgerState s {fg.carried(), fg.residual(), fg.reserved(), fg.unreserved(), fg.records(),
+                 LedgerAccess::next_record_counter(fg), LedgerAccess::bound_policy_ids(fg), LedgerAccess::orphan_policy_ids(fg)};
+  expect_uid_then_clear(s.records, fg.uid());
+  return s;
+}
+
+inline bool same_record(const FlowRecord& a, const FlowRecord& b) {
+  return a.flow_id == b.flow_id && a.policy_id == b.policy_id && a.sources == b.sources && a.destinations == b.destinations &&
+         a.admission == b.admission && a.entry_id == b.entry_id && a.route && b.route && *a.route == *b.route &&
+         a.min_route_cost == b.min_route_cost && a.offered == b.offered && a.delivered == b.delivered && a.edge_flows == b.edge_flows &&
+         a.edge_drops == b.edge_drops && a.edge_reservations == b.edge_reservations;
+}
+
+inline void expect_same(const LedgerState& a, const LedgerState& b, const std::string& where) {
+  EXPECT_EQ(a.carried, b.carried) << where;
+  EXPECT_EQ(a.residual, b.residual) << where;
+  EXPECT_EQ(a.reserved, b.reserved) << where;
+  EXPECT_EQ(a.unreserved, b.unreserved) << where;
+  EXPECT_EQ(a.next_id, b.next_id) << where;
+  EXPECT_EQ(a.bound, b.bound) << where;
+  EXPECT_EQ(a.orphans, b.orphans) << where;
+  ASSERT_EQ(a.records.size(), b.records.size()) << where;
+  for (std::size_t i = 0; i < a.records.size(); ++i) {
+    EXPECT_TRUE(same_record(a.records[i], b.records[i])) << where << " record " << i;
+  }
+}
+
+// The ledger invariant, per projection: the aggregate is the sum of the records' edges and the
+// holds the sum of their edge_reservations, each within [0, its baseline] on every edge.
+inline void expect_balanced(const FlowLedger& fg, const std::string& where) {
+  const std::vector<Amount> carried = fg.carried();
+  const std::vector<Amount> reserved = fg.reserved();
+  const auto baseline = detail::LedgerAccess::baseline(fg);
+  const auto reservation = detail::LedgerAccess::reservation_baseline(fg);
+  std::vector<Amount> sum(carried.size(), 0);
+  std::vector<Amount> held(carried.size(), 0);
+  for (const auto& r : fg.records()) {
+    for (const auto& [e, x] : r.edge_flows) sum[static_cast<std::size_t>(e)] += x;
+    for (const auto& [e, x] : r.edge_reservations) held[static_cast<std::size_t>(e)] += x;
+  }
+  EXPECT_EQ(sum, carried) << where;
+  EXPECT_EQ(held, reserved) << where;
+  ASSERT_EQ(baseline.size(), carried.size()) << where;
+  ASSERT_EQ(reservation.size(), carried.size()) << where;
+  for (std::size_t e = 0; e < carried.size(); ++e) {
+    EXPECT_GE(carried[e], 0) << where << " edge " << e;
+    EXPECT_LE(carried[e], baseline[e]) << where << " edge " << e;
+    EXPECT_GE(reserved[e], 0) << where << " edge " << e;
+    EXPECT_LE(reserved[e], reservation[e]) << where << " edge " << e;
+  }
+}
+
+// A program as the tests compare it: its endpoints, its tunnels, its source weights, and per split
+// context its plan's roots, members and weights (a recomputed program is a new value).
+struct ProgramSnapshot {
+  bool present {false};
+  std::vector<NodeId> sources;
+  std::vector<NodeId> destinations;
+  std::vector<Tunnel> tunnels;
+  std::optional<std::vector<std::pair<NodeId, Amount>>> source_weights;
+  std::vector<std::vector<EdgeId>> members;
+  std::vector<std::vector<Amount>> weights;
+  std::vector<std::vector<NodeId>> roots;
+  std::vector<std::int64_t> structure;
+  bool operator==(const ProgramSnapshot&) const = default;
+};
+
+inline ProgramSnapshot program_snapshot(const ForwardingProgram* p) {
+  ProgramSnapshot s;
+  if (p == nullptr) return s;
+  s.present = true;
+  s.sources.assign(p->sources().begin(), p->sources().end());
+  s.destinations.assign(p->destinations().begin(), p->destinations().end());
+  s.tunnels.assign(p->tunnels().begin(), p->tunnels().end());
+  s.source_weights = p->source_weights();
+  const auto& data = detail::ProgramAccess::data(*p);
+  auto scalar = [&](auto value) { s.structure.push_back(static_cast<std::int64_t>(value)); };
+  auto array = [&](const auto& values) {
+    scalar(values.size());
+    for (auto value : values) scalar(value);
+  };
+  scalar(data.pools_source_inflows);
+  scalar(data.uses_topology_basis);
+  array(data.block());
+  array(data.source_weight_values);
+  scalar(data.entries.size());
+  for (const auto& e : data.entries) {
+    for (auto value : {e.entry_id, e.head, e.roster_index, e.local_index, e.tunnel_position, e.split_context_position}) scalar(value);
+    scalar(e.weight);
+    scalar(e.min_route_cost);
+    scalar(e.route != nullptr);
+    if (e.route) {
+      array(e.route->parent_offsets());
+      array(e.route->parents());
+      array(e.route->via_edges());
+    }
+  }
+  for (const auto& c : data.split_contexts) {
+    s.members.push_back(c.prepared_route->forwarding_edges);
+    s.weights.push_back(c.prepared_route->weights);
+    s.roots.emplace_back(c.prepared_route->sources.begin(), c.prepared_route->sources.end());
+    const auto& plan = *c.prepared_route;
+    scalar(plan.allocation);
+    array(plan.support_edges);
+    array(plan.sources);
+    array(plan.source_positions);
+    array(plan.destinations);
+    array(plan.topological_order);
+    array(plan.outgoing_begin);
+    array(plan.outgoing_end);
+    array(plan.edge_destination_positions);
+    array(plan.is_destination);
+    array(c.source_entry_positions);
+  }
+  return s;
+}
+
+// Every field of a placement result.
+inline void expect_same(const PlacementResult& a, const PlacementResult& b, const std::string& where) {
+  EXPECT_EQ(a.call_delivered, b.call_delivered) << where;
+  EXPECT_EQ(a.call_undelivered, b.call_undelivered) << where;
+  EXPECT_EQ(a.delivery_delta, b.delivery_delta) << where;
+  EXPECT_EQ(a.call_edge_drops, b.call_edge_drops) << where;
+  EXPECT_EQ(a.call_source_drops, b.call_source_drops) << where;
+  EXPECT_EQ(a.termination, b.termination) << where;
+  EXPECT_EQ(a.routes_changed, b.routes_changed) << where;
+  EXPECT_EQ(a.weights_changed, b.weights_changed) << where;
+  EXPECT_EQ(a.reservations_changed, b.reservations_changed) << where;
+  EXPECT_TRUE(program_snapshot(a.program.get()) == program_snapshot(b.program.get())) << where;
+  EXPECT_TRUE(a.plan == b.plan) << where;
+  EXPECT_EQ(a.requested, b.requested) << where;
+  EXPECT_EQ(a.offered, b.offered) << where;
+  EXPECT_EQ(a.admitted, b.admitted) << where;
+  EXPECT_EQ(a.delivered, b.delivered) << where;
+  EXPECT_EQ(a.unadmitted, b.unadmitted) << where;
+  EXPECT_EQ(a.source_drops, b.source_drops) << where;
+  EXPECT_EQ(a.edge_drops, b.edge_drops) << where;
+  EXPECT_TRUE(a.by_source == b.by_source) << where;
+  EXPECT_TRUE(a.by_tunnel == b.by_tunnel) << where;
+  EXPECT_EQ(a.total_cost, b.total_cost) << where;
+  EXPECT_EQ(a.marginal_cost_curve, b.marginal_cost_curve) << where;
+  EXPECT_EQ(a.edge_flows, b.edge_flows) << where;
+  EXPECT_EQ(a.residual, b.residual) << where;
+  EXPECT_EQ(a.saturated_boundary_edges, b.saturated_boundary_edges) << where;
+  EXPECT_EQ(a.edge_reservations, b.edge_reservations) << where;
+  EXPECT_EQ(a.min_cut, b.min_cut) << where;
+}
+
+// One live flow as the tests compare it: its local id, its route cost, its route's edges and its
+// program entry.
+struct FlowSnapshot {
+  std::int64_t id {0};
+  Cost cost {0};
+  std::vector<EdgeId> route;
+  std::int32_t entry {-1};
+  bool operator==(const FlowSnapshot&) const = default;
+};
+
+// A policy's epoch state: the call state (requested, offered, +inf, prepared, the delivered
+// demand), CentralizedTE's cumulative curve, the installed program (its identity and its value) and T1's
+// plan, ShortestPaths Optimized's support, a Pinned head's own losses, the by_tunnel rows and per record_group
+// its flows.
+struct Epoch {
+  Counter128 requested;
+  Counter128 offered;
+  bool infinite {false};
+  bool prepared {false};
+  Amount delivered {0};
+  std::optional<std::vector<std::pair<Cost, Amount>>> curve;
+  const ForwardingProgram* program_id {nullptr};
+  ProgramSnapshot program;
+  std::optional<TunnelPlan> plan;
+  std::vector<EdgeId> support;
+  std::vector<Counter128> source_drops_by_source;
+  std::vector<TunnelFlow> by_tunnel;
+  std::vector<std::vector<FlowSnapshot>> record_groups;
+  ProgramSnapshot kept_program;
+  const ForwardingProgram* kept_id {nullptr};
+};
+
+inline Epoch epoch(const FlowPolicy& p) {
+  const auto& pe = detail::PolicyAccess::engine(p);
+  const auto& ep = pe.epoch;
+  Epoch e {ep.requested, ep.offered, ep.infinite, ep.prepared, p.delivered(), ep.marginal_cost_curve, ep.program.get(),
+           program_snapshot(ep.program.get()), ep.plan ? std::optional<TunnelPlan>(*ep.plan) : std::nullopt, ep.support,
+           ep.source_drops_by_source, ep.by_tunnel, {}, program_snapshot(pe.kept_program.get()), pe.kept_program.get()};
+  for (const auto& c : ep.record_groups) {
+    auto& out = e.record_groups.emplace_back();
+    for (const auto& f : c) out.push_back({f.record_counter, f.min_route_cost, f.route ? ascending_edges(*f.route) : std::vector<EdgeId> {}, f.entry_id});
+  }
+  return e;
+}
+
+inline void expect_same(const Epoch& a, const Epoch& b, const std::string& where) {
+  EXPECT_EQ(a.requested, b.requested) << where;
+  EXPECT_EQ(a.offered, b.offered) << where;
+  EXPECT_EQ(a.infinite, b.infinite) << where;
+  EXPECT_EQ(a.prepared, b.prepared) << where;
+  EXPECT_EQ(a.delivered, b.delivered) << where;
+  EXPECT_EQ(a.curve, b.curve) << where;
+  EXPECT_TRUE(a.program == b.program) << where;
+  EXPECT_TRUE(a.plan == b.plan) << where;
+  EXPECT_EQ(a.support, b.support) << where;
+  EXPECT_EQ(a.source_drops_by_source, b.source_drops_by_source) << where;
+  EXPECT_TRUE(a.by_tunnel == b.by_tunnel) << where;
+  EXPECT_TRUE(a.record_groups == b.record_groups) << where;
+  EXPECT_TRUE(a.kept_program == b.kept_program) << where;
+}
+
+// The same state on the same policy: also the same program object (a failed call installs none).
+inline void expect_unchanged(const Epoch& a, const Epoch& b, const std::string& where) {
+  expect_same(a, b, where);
+  EXPECT_EQ(a.program_id, b.program_id) << where;
+}
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/strict_multidigraph_tests.cpp b/tests/cpp/strict_multidigraph_tests.cpp
deleted file mode 100644
index c475009..0000000
--- a/tests/cpp/strict_multidigraph_tests.cpp
+++ /dev/null
@@ -1,354 +0,0 @@
-#include <gtest/gtest.h>
-#include <limits>
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "test_utils.hpp"
-
-using namespace netgraph::core;
-using namespace netgraph::core::test;
-
-TEST(StrictMultiDiGraph, EmptyGraph) {
-  auto g = StrictMultiDiGraph::from_arrays(10, {}, {}, {}, {});
-  EXPECT_EQ(g.num_nodes(), 10);
-  EXPECT_EQ(g.num_edges(), 0);
-  expect_csr_valid(g);
-
-  // All row offsets should be 0
-  auto row = g.row_offsets_view();
-  for (auto offset : row) {
-    EXPECT_EQ(offset, 0);
-  }
-}
-
-TEST(StrictMultiDiGraph, SingleNode) {
-  auto g = StrictMultiDiGraph::from_arrays(1, {}, {}, {}, {});
-  EXPECT_EQ(g.num_nodes(), 1);
-  EXPECT_EQ(g.num_edges(), 0);
-  expect_csr_valid(g);
-}
-
-TEST(StrictMultiDiGraph, SingleEdge) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {1};
-  double cap[1] = {5.0};
-  std::int64_t cost[1] = {10};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 1), std::span(dst, 1),
-    std::span(cap, 1), std::span(cost, 1));
-
-  EXPECT_EQ(g.num_nodes(), 2);
-  EXPECT_EQ(g.num_edges(), 1);
-  expect_csr_valid(g);
-
-  // Check edge properties
-  auto cap_view = g.capacity_view();
-  auto cost_view = g.cost_view();
-  auto src_view = g.edge_src_view();
-  auto dst_view = g.edge_dst_view();
-
-  EXPECT_EQ(cap_view[0], 5.0);
-  EXPECT_EQ(cost_view[0], 10);
-  EXPECT_EQ(src_view[0], 0);
-  EXPECT_EQ(dst_view[0], 1);
-}
-
-TEST(StrictMultiDiGraph, ParallelEdges) {
-  // Three parallel edges from 0 to 1
-  std::int32_t src[3] = {0, 0, 0};
-  std::int32_t dst[3] = {1, 1, 1};
-  double cap[3] = {1.0, 2.0, 3.0};
-  std::int64_t cost[3] = {1, 1, 2};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  EXPECT_EQ(g.num_nodes(), 2);
-  EXPECT_EQ(g.num_edges(), 3);
-  expect_csr_valid(g);
-
-  // All three edges should be in node 0's adjacency list
-  auto row = g.row_offsets_view();
-  EXPECT_EQ(row[1] - row[0], 3);
-}
-
-TEST(StrictMultiDiGraph, EdgeSortingByCost) {
-  // Edges with different costs should be sorted
-  std::int32_t src[3] = {0, 0, 0};
-  std::int32_t dst[3] = {1, 1, 1};
-  double cap[3] = {1.0, 2.0, 3.0};
-  std::int64_t cost[3] = {3, 1, 2};  // Unsorted
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  // Edges should be reordered by cost
-  auto cost_view = g.cost_view();
-  EXPECT_EQ(cost_view[0], 1);  // Lowest cost first
-  EXPECT_EQ(cost_view[1], 2);
-  EXPECT_EQ(cost_view[2], 3);  // Highest cost last
-}
-
-TEST(StrictMultiDiGraph, ExternalEdgeIdsPreserved) {
-  std::int32_t src[3] = {0, 0, 0};
-  std::int32_t dst[3] = {1, 1, 1};
-  double cap[3] = {1.0, 2.0, 3.0};
-  std::int64_t cost[3] = {3, 1, 2};
-  std::int64_t ext[3] = {100, 200, 300};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3),
-    std::span(ext, 3));
-
-  // External IDs should be reordered alongside edges
-  auto ext_view = g.ext_edge_ids_view();
-  EXPECT_EQ(ext_view.size(), 3);
-
-  // Edge with cost 1 (input index 1) should have ext_id 200
-  auto cost_view = g.cost_view();
-  for (std::size_t i = 0; i < 3; ++i) {
-    if (cost_view[i] == 1) {
-      EXPECT_EQ(ext_view[i], 200);
-    } else if (cost_view[i] == 2) {
-      EXPECT_EQ(ext_view[i], 300);
-    } else if (cost_view[i] == 3) {
-      EXPECT_EQ(ext_view[i], 100);
-    }
-  }
-}
-
-TEST(StrictMultiDiGraph, CSROffsetsMonotonicity) {
-  auto g = make_grid_graph(3, 3);
-  expect_csr_valid(g);
-
-  auto row = g.row_offsets_view();
-  for (std::size_t i = 0; i < row.size() - 1; ++i) {
-    EXPECT_LE(row[i], row[i + 1]) << "CSR offsets not monotonic";
-  }
-}
-
-TEST(StrictMultiDiGraph, CSRReverseAdjacency) {
-  // Create a simple graph: 0->1, 1->2, 0->2
-  std::int32_t src[3] = {0, 1, 0};
-  std::int32_t dst[3] = {1, 2, 2};
-  double cap[3] = {1.0, 1.0, 1.0};
-  std::int64_t cost[3] = {1, 1, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(3,
-    std::span(src, 3), std::span(dst, 3),
-    std::span(cap, 3), std::span(cost, 3));
-
-  // Check reverse adjacency (incoming edges)
-  auto in_row = g.in_row_offsets_view();
-  auto in_col = g.in_col_indices_view();
-
-  // Node 0 has no incoming edges
-  EXPECT_EQ(in_row[1] - in_row[0], 0);
-
-  // Node 1 has one incoming edge (from 0)
-  EXPECT_EQ(in_row[2] - in_row[1], 1);
-  EXPECT_EQ(in_col[in_row[1]], 0);
-
-  // Node 2 has two incoming edges (from 0 and 1)
-  EXPECT_EQ(in_row[3] - in_row[2], 2);
-}
-
-TEST(StrictMultiDiGraph, MaxCapacityEdges) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {1};
-  double cap[1] = {std::numeric_limits<double>::max()};
-  std::int64_t cost[1] = {1};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 1), std::span(dst, 1),
-    std::span(cap, 1), std::span(cost, 1));
-
-  auto cap_view = g.capacity_view();
-  EXPECT_EQ(cap_view[0], std::numeric_limits<double>::max());
-}
-
-TEST(StrictMultiDiGraph, ZeroCostEdges) {
-  std::int32_t src[2] = {0, 0};
-  std::int32_t dst[2] = {1, 1};
-  double cap[2] = {1.0, 2.0};
-  std::int64_t cost[2] = {0, 1};
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 2), std::span(dst, 2),
-    std::span(cap, 2), std::span(cost, 2));
-
-  // Zero cost edge should be first in sorted order
-  auto cost_view = g.cost_view();
-  EXPECT_EQ(cost_view[0], 0);
-  EXPECT_EQ(cost_view[1], 1);
-}
-
-TEST(StrictMultiDiGraph, InvalidNumNodesThrows) {
-  // Negative node count
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(-1, {}, {}, {}, {});
-    (void)g;
-  }, std::invalid_argument);
-}
-
-TEST(StrictMultiDiGraph, MismatchedArrayLengthsThrow) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {0};
-  double cap[1] = {1.0};
-  std::int64_t cost[2] = {1, 2};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(1,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 2));
-    (void)g;
-  }, std::invalid_argument);
-}
-
-TEST(StrictMultiDiGraph, ExtEdgeIdsWrongLengthThrows) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {0};
-  double cap[1] = {1.0};
-  std::int64_t cost[1] = {1};
-  std::int64_t ext[2] = {10, 20};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(1,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 1),
-      std::span(ext, 2));
-    (void)g;
-  }, std::invalid_argument);
-}
-
-TEST(StrictMultiDiGraph, OutOfRangeNodeThrows) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {2}; // out of range for num_nodes=2 (0..1)
-  double cap[1] = {1.0};
-  std::int64_t cost[1] = {1};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(2,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 1));
-    (void)g;
-  }, std::out_of_range);
-}
-
-TEST(StrictMultiDiGraph, NegativeCapacityThrows) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {1};
-  double cap[1] = {-1.0};
-  std::int64_t cost[1] = {1};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(2,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 1));
-    (void)g;
-  }, std::invalid_argument);
-}
-
-TEST(StrictMultiDiGraph, NegativeCostThrows) {
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {1};
-  double cap[1] = {1.0};
-  std::int64_t cost[1] = {-1};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(2,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 1));
-    (void)g;
-  }, std::invalid_argument);
-}
-
-TEST(StrictMultiDiGraph, SelfLoopAllowed) {
-  // Self-loops (edges from node to itself) should be valid
-  std::int32_t src[1] = {0};
-  std::int32_t dst[1] = {0};  // Self-loop
-  double cap[1] = {5.0};
-  std::int64_t cost[1] = {1};
-
-  auto g = StrictMultiDiGraph::from_arrays(1,
-    std::span(src, 1), std::span(dst, 1),
-    std::span(cap, 1), std::span(cost, 1));
-
-  EXPECT_EQ(g.num_nodes(), 1);
-  EXPECT_EQ(g.num_edges(), 1);
-
-  // Verify self-loop appears in both forward and reverse adjacency
-  auto row = g.row_offsets_view();
-  EXPECT_EQ(row[1] - row[0], 1);  // One outgoing edge
-
-  auto in_row = g.in_row_offsets_view();
-  EXPECT_EQ(in_row[1] - in_row[0], 1);  // One incoming edge
-}
-
-TEST(StrictMultiDiGraph, NegativeNodeIdThrows) {
-  // Negative node IDs should be rejected
-  std::int32_t src[1] = {-1};  // Invalid negative ID
-  std::int32_t dst[1] = {0};
-  double cap[1] = {1.0};
-  std::int64_t cost[1] = {1};
-  EXPECT_THROW({
-    auto g = StrictMultiDiGraph::from_arrays(1,
-      std::span(src, 1), std::span(dst, 1),
-      std::span(cap, 1), std::span(cost, 1));
-    (void)g;
-  }, std::out_of_range);
-}
-
-TEST(StrictMultiDiGraph, MultipleCostTiers) {
-  // Verify edges are sorted by cost into distinct tiers
-  std::int32_t src[6] = {0, 0, 0, 0, 0, 0};
-  std::int32_t dst[6] = {1, 1, 1, 1, 1, 1};
-  double cap[6] = {1.0, 2.0, 3.0, 4.0, 5.0, 6.0};
-  std::int64_t cost[6] = {10, 5, 10, 1, 5, 1};  // Three tiers: 1, 5, 10
-
-  auto g = StrictMultiDiGraph::from_arrays(2,
-    std::span(src, 6), std::span(dst, 6),
-    std::span(cap, 6), std::span(cost, 6));
-
-  auto cost_view = g.cost_view();
-  // Sorted costs should be [1, 1, 5, 5, 10, 10]
-  EXPECT_EQ(cost_view[0], 1);
-  EXPECT_EQ(cost_view[1], 1);
-  EXPECT_EQ(cost_view[2], 5);
-  EXPECT_EQ(cost_view[3], 5);
-  EXPECT_EQ(cost_view[4], 10);
-  EXPECT_EQ(cost_view[5], 10);
-}
-
-TEST(StrictMultiDiGraph, CostSummaryMaxAndGcd) {
-  auto empty = StrictMultiDiGraph::from_arrays(0, {}, {}, {}, {});
-  EXPECT_EQ(empty.max_cost(), 0);
-  EXPECT_EQ(empty.cost_gcd(), 0);
-  {
-    std::vector<std::int32_t> src = {0, 1, 2}, dst = {1, 2, 0};
-    std::vector<double> cap = {1.0, 1.0, 1.0};
-    std::vector<std::int64_t> cost = {6, 9, 0};
-    auto g = StrictMultiDiGraph::from_arrays(3, src, dst, cap, cost);
-    EXPECT_EQ(g.max_cost(), 9);
-    EXPECT_EQ(g.cost_gcd(), 3);
-    StrictMultiDiGraph copy = g;
-    EXPECT_EQ(copy.max_cost(), 9);
-    EXPECT_EQ(copy.cost_gcd(), 3);
-    StrictMultiDiGraph moved = std::move(copy);
-    EXPECT_EQ(moved.max_cost(), 9);
-    EXPECT_EQ(moved.cost_gcd(), 3);
-  }
-  {
-    std::vector<std::int32_t> src = {0, 1}, dst = {1, 0};
-    std::vector<double> cap = {1.0, 1.0};
-    std::vector<std::int64_t> cost = {0, 0};
-    auto g = StrictMultiDiGraph::from_arrays(2, src, dst, cap, cost);
-    EXPECT_EQ(g.max_cost(), 0);
-    EXPECT_EQ(g.cost_gcd(), 0);
-  }
-  {
-    std::vector<std::int32_t> src = {0}, dst = {1};
-    std::vector<double> cap = {1.0};
-    std::vector<std::int64_t> cost = {(std::int64_t{1} << 40) + 7};
-    auto g = StrictMultiDiGraph::from_arrays(2, src, dst, cap, cost);
-    EXPECT_EQ(g.max_cost(), (std::int64_t{1} << 40) + 7);
-    EXPECT_EQ(g.cost_gcd(), (std::int64_t{1} << 40) + 7);
-  }
-}
diff --git a/tests/cpp/test_int128.hpp b/tests/cpp/test_int128.hpp
new file mode 100644
index 0000000..ea46bc1
--- /dev/null
+++ b/tests/cpp/test_int128.hpp
@@ -0,0 +1,183 @@
+// Exact 128-bit integers for the test oracles: Int128 (signed) and UInt128 (unsigned). The
+// portable classes wrap modulo 2^128; the built-in signed type must not overflow (that is
+// undefined), so a test that wants a wrapped signed result forms it in UInt128 and converts back.
+// Compilers with a built-in 128-bit integer (GCC, Clang) use it; others (MSVC) use the two small
+// classes below, written for the tests alone and independent of the library's detail/int128.hpp,
+// so an arithmetic error there cannot hide in an expected value. The CI job "C++ tests (windows,
+// MSVC)" runs every test on the classes, and PortableInt128.PortableClassesMatchTheBuiltInType
+// compares them with the built-in type wherever both exist. Defining
+// NETGRAPH_CORE_TEST_PORTABLE_INT128 selects the classes on any compiler; no make target or CI job
+// sets it. To run every test on them locally, from the repository root (a fresh build directory:
+// CMake reads CXXFLAGS only when it first configures one):
+//   CXXFLAGS=-DNETGRAPH_CORE_TEST_PORTABLE_INT128 cmake -S . -B build/cpp-tests-portable -DNETGRAPH_CORE_BUILD_TESTS=ON -DNETGRAPH_CORE_PRIVATE_HOOKS=ON
+//   cmake --build build/cpp-tests-portable --parallel && ctest --test-dir build/cpp-tests-portable --no-tests=error
+#pragma once
+
+#include <compare>
+#include <concepts>
+#include <cstdint>
+#include <cstdlib>
+#include <type_traits>
+
+namespace netgraph::core::test {
+
+// Two 64-bit words. Every operation is modulo 2^128; division by zero aborts.
+class PortableUInt128 {
+ public:
+  using U = PortableUInt128;
+
+  constexpr PortableUInt128() noexcept = default;
+  // Implicit, like a built-in integral conversion: a negative value wraps modulo 2^128.
+  template <std::integral T>
+  constexpr PortableUInt128(T v) noexcept : lo_(static_cast<std::uint64_t>(v)) {
+    if constexpr (std::is_signed_v<T>) hi_ = v < 0 ? ~std::uint64_t {0} : 0;
+  }
+  static constexpr U of_words(std::uint64_t hi, std::uint64_t lo) noexcept {
+    U r;
+    r.hi_ = hi;
+    r.lo_ = lo;
+    return r;
+  }
+  [[nodiscard]] constexpr std::uint64_t high() const noexcept { return hi_; }
+  [[nodiscard]] constexpr std::uint64_t low() const noexcept { return lo_; }
+  // The low bits, like a built-in narrowing conversion.
+  template <std::integral T>
+  constexpr explicit operator T() const noexcept {
+    return static_cast<T>(lo_);
+  }
+
+  friend constexpr bool operator==(const U&, const U&) noexcept = default;
+  friend constexpr std::strong_ordering operator<=>(const U& a, const U& b) noexcept {
+    if (a.hi_ != b.hi_) return a.hi_ <=> b.hi_;
+    return a.lo_ <=> b.lo_;
+  }
+
+  friend constexpr U operator+(U a, U b) noexcept {
+    const std::uint64_t lo = a.lo_ + b.lo_;
+    return of_words(a.hi_ + b.hi_ + (lo < a.lo_ ? 1 : 0), lo);
+  }
+  friend constexpr U operator-(U a, U b) noexcept {
+    return of_words(a.hi_ - b.hi_ - (a.lo_ < b.lo_ ? 1 : 0), a.lo_ - b.lo_);
+  }
+  friend constexpr U operator*(U a, U b) noexcept {
+    // The full product of the low words from 32-bit halves; the products with a high word only
+    // reach the high word (modulo 2^128).
+    const std::uint64_t mask = 0xffffffffU;
+    const std::uint64_t a0 = a.lo_ & mask, a1 = a.lo_ >> 32;
+    const std::uint64_t b0 = b.lo_ & mask, b1 = b.lo_ >> 32;
+    const std::uint64_t p00 = a0 * b0, p01 = a0 * b1, p10 = a1 * b0, p11 = a1 * b1;
+    const std::uint64_t middle = (p00 >> 32) + (p01 & mask) + (p10 & mask);
+    const std::uint64_t lo = (middle << 32) | (p00 & mask);
+    const std::uint64_t hi = p11 + (p01 >> 32) + (p10 >> 32) + (middle >> 32) + a.hi_ * b.lo_ + a.lo_ * b.hi_;
+    return of_words(hi, lo);
+  }
+  // Long division, one quotient bit per step: n = q * d + r with r < d.
+  static constexpr void divide(U n, U d, U& q, U& r) noexcept {
+    if (d == U {}) std::abort();
+    q = U {};
+    r = U {};
+    for (int i = 127; i >= 0; --i) {
+      r = (r << 1) | ((n >> i) & U {1});
+      if (r >= d) {
+        r = r - d;
+        q = q | (U {1} << i);
+      }
+    }
+  }
+  friend constexpr U operator/(U a, U b) noexcept {
+    U q, r;
+    divide(a, b, q, r);
+    return q;
+  }
+  friend constexpr U operator%(U a, U b) noexcept {
+    U q, r;
+    divide(a, b, q, r);
+    return r;
+  }
+  // Shifts by 0 to 127 bits.
+  friend constexpr U operator<<(U a, int s) noexcept {
+    if (s == 0) return a;
+    if (s >= 64) return of_words(a.lo_ << (s - 64), 0);
+    return of_words((a.hi_ << s) | (a.lo_ >> (64 - s)), a.lo_ << s);
+  }
+  friend constexpr U operator>>(U a, int s) noexcept {
+    if (s == 0) return a;
+    if (s >= 64) return of_words(0, a.hi_ >> (s - 64));
+    return of_words(a.hi_ >> s, (a.lo_ >> s) | (a.hi_ << (64 - s)));
+  }
+  friend constexpr U operator|(U a, U b) noexcept { return of_words(a.hi_ | b.hi_, a.lo_ | b.lo_); }
+  friend constexpr U operator&(U a, U b) noexcept { return of_words(a.hi_ & b.hi_, a.lo_ & b.lo_); }
+  constexpr U& operator+=(U b) noexcept { return *this = *this + b; }
+  constexpr U& operator-=(U b) noexcept { return *this = *this - b; }
+  constexpr U& operator*=(U b) noexcept { return *this = *this * b; }
+  constexpr U& operator/=(U b) noexcept { return *this = *this / b; }
+
+ private:
+  std::uint64_t hi_ {0};
+  std::uint64_t lo_ {0};
+};
+
+// The two's-complement reading of a PortableUInt128 bit pattern: signed comparison and division
+// (truncating toward zero, like the built-in type); the other operations are those of the bits.
+class PortableInt128 {
+ public:
+  using I = PortableInt128;
+  using U = PortableUInt128;
+
+  constexpr PortableInt128() noexcept = default;
+  // Implicit, like a built-in integral conversion: the value is kept.
+  template <std::integral T>
+  constexpr PortableInt128(T v) noexcept : bits_(v) {}
+  constexpr explicit PortableInt128(U bits) noexcept : bits_(bits) {}
+  constexpr explicit operator U() const noexcept { return bits_; }
+  template <std::integral T>
+  constexpr explicit operator T() const noexcept {
+    return static_cast<T>(bits_);
+  }
+
+  friend constexpr bool operator==(const I&, const I&) noexcept = default;
+  friend constexpr std::strong_ordering operator<=>(const I& a, const I& b) noexcept {
+    const auto ah = static_cast<std::int64_t>(a.bits_.high());
+    const auto bh = static_cast<std::int64_t>(b.bits_.high());
+    if (ah != bh) return ah <=> bh;
+    return a.bits_.low() <=> b.bits_.low();
+  }
+
+  friend constexpr I operator+(I a, I b) noexcept { return I(a.bits_ + b.bits_); }
+  friend constexpr I operator-(I a, I b) noexcept { return I(a.bits_ - b.bits_); }
+  friend constexpr I operator-(I a) noexcept { return I(U {} - a.bits_); }
+  friend constexpr I operator*(I a, I b) noexcept { return I(a.bits_ * b.bits_); }
+  friend constexpr I operator/(I a, I b) noexcept {
+    const I q(magnitude(a) / magnitude(b));
+    return (a < 0) != (b < 0) ? -q : q;
+  }
+  friend constexpr I operator%(I a, I b) noexcept {
+    const I r(magnitude(a) % magnitude(b));
+    return a < 0 ? -r : r;
+  }
+  constexpr I& operator+=(I b) noexcept { return *this = *this + b; }
+  constexpr I& operator-=(I b) noexcept { return *this = *this - b; }
+  constexpr I& operator*=(I b) noexcept { return *this = *this * b; }
+
+ private:
+  static constexpr U magnitude(I x) noexcept { return x < 0 ? (-x).bits_ : x.bits_; }
+  U bits_ {};
+};
+
+#if defined(__SIZEOF_INT128__) && !defined(NETGRAPH_CORE_TEST_PORTABLE_INT128)
+using Int128 = __int128;
+using UInt128 = unsigned __int128;
+#else
+using Int128 = PortableInt128;
+using UInt128 = PortableUInt128;
+#endif
+
+// hi * 2^64 + lo.
+constexpr Int128 int128_of(std::int64_t hi, std::uint64_t lo) noexcept {
+  return static_cast<Int128>((static_cast<UInt128>(static_cast<std::uint64_t>(hi)) << 64) | UInt128 {lo});
+}
+
+// 2^127 - 1.
+constexpr Int128 int128_max() noexcept { return static_cast<Int128>((UInt128 {1} << 127) - UInt128 {1}); }
+
+} // namespace netgraph::core::test
diff --git a/tests/cpp/test_utils.hpp b/tests/cpp/test_utils.hpp
index f041799..6711a22 100644
--- a/tests/cpp/test_utils.hpp
+++ b/tests/cpp/test_utils.hpp
@@ -1,479 +1,1276 @@
 #pragma once
 
+#include <gtest/gtest-spi.h>
 #include <gtest/gtest.h>
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <functional>
+#include <initializer_list>
+#include <limits>
+#include <map>
+#include <numeric>
+#include <memory>
+#include <optional>
+#include <random>
+#include <set>
 #include <span>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+#include <type_traits>
+#include <utility>
+#include <variant>
 #include <vector>
-#include "netgraph/core/strict_multidigraph.hpp"
-#include "netgraph/core/shortest_paths.hpp"
-#include "netgraph/core/max_flow.hpp"
+
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/min_cost_flow.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/flow_record.hpp"
+#include "netgraph/core/graph.hpp"
+#include "netgraph/core/route_structures.hpp"
+#include "netgraph/core/forwarding_program.hpp"
+#include "test_int128.hpp"
 
 namespace netgraph::core::test {
 
-// Helper to create bool arrays for masks (avoids std::vector<bool> issues with .data())
-inline std::unique_ptr<bool[]> make_bool_mask(std::size_t n, bool default_val = true) {
-  auto mask = std::make_unique<bool[]>(n);
-  std::fill_n(mask.get(), n, default_val);
-  return mask;
-}
-
-// Graph builders matching Python fixtures
-inline StrictMultiDiGraph make_line_graph(int n) {
-  // Create a simple line graph 0->1->2->...->n-1
-  if (n <= 1) {
-    return StrictMultiDiGraph::from_arrays(n, {}, {}, {}, {});
-  }
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost;
-  for (int i = 0; i < n - 1; ++i) {
-    src.push_back(i);
-    dst.push_back(i + 1);
-    cap.push_back(1.0);
-    cost.push_back(1);
-  }
-  return StrictMultiDiGraph::from_arrays(n, src, dst, cap, cost);
-}
-
-inline StrictMultiDiGraph make_square_graph(int type = 1) {
-  // Type 1: one shortest route and one longer alternative
-  // 0->1->2 (cost 2) vs 0->3->2 (cost 4)
-  if (type == 1) {
-    std::int32_t src_arr[4] = {0, 1, 0, 3};
-    std::int32_t dst_arr[4] = {1, 2, 3, 2};
-    double cap_arr[4] = {1.0, 1.0, 2.0, 2.0};
-    std::int64_t cost_arr[4] = {1, 1, 2, 2};
-    return StrictMultiDiGraph::from_arrays(4,
-      std::span(src_arr, 4), std::span(dst_arr, 4),
-      std::span(cap_arr, 4), std::span(cost_arr, 4));
-  }
-  // Type 2: two equal-cost shortest routes
-  std::int32_t src_arr[4] = {0, 1, 0, 3};
-  std::int32_t dst_arr[4] = {1, 2, 3, 2};
-  double cap_arr[4] = {1.0, 1.0, 2.0, 2.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-  return StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-}
-
-inline StrictMultiDiGraph make_grid_graph(int rows, int cols) {
-  // Create a grid graph with edges going right and down
-  int n = rows * cols;
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost;
-
-  for (int r = 0; r < rows; ++r) {
-    for (int c = 0; c < cols; ++c) {
-      int node = r * cols + c;
-      // Right edge
-      if (c < cols - 1) {
-        src.push_back(node);
-        dst.push_back(node + 1);
-        cap.push_back(1.0);
-        cost.push_back(1);
+using detail::MinCostFlowResult;
+using detail::kMaxFlowCap;
+using detail::kNeverReached;
+using detail::solve_min_cost_flow;
+
+// An edge in input coordinates.
+struct InEdge {
+  NodeId u;
+  NodeId v;
+  Amount cap;
+  Cost cost;
+};
+
+// 2^62: the bound of capacities and of the capacity and cost sums, in units.
+inline constexpr Amount kL62 = Amount {1} << 62;
+
+// CentralizedTE with its required source allocation (OPTIMIZED: the exact maximum flow), a support,
+// a tunnel count (T2) and prefer_headroom.
+inline CentralizedTE centralized(SourceAllocation source_allocation = SourceAllocation::Optimized,
+                                 std::shared_ptr<const PredecessorDAG> support = {},
+                                 std::optional<TunnelCount> tunnel_count = std::nullopt, bool prefer_headroom = false) {
+  CentralizedTE gl(source_allocation);
+  gl.support = std::move(support);
+  gl.tunnel_count = tunnel_count;
+  gl.prefer_headroom = prefer_headroom;
+  return gl;
+}
+
+// ShortestPaths with a route allocation (the rest default).
+inline ShortestPaths shortest_paths(RouteAllocation allocation = RouteAllocation::Equal) {
+  ShortestPaths sp;
+  sp.allocation = allocation;
+  return sp;
+}
+
+// The two policy configurations most tests use, both Lossless with the default route choice: the
+// exact maximum flow (CentralizedTE with the optimized source allocation) and ShortestPaths ECMP.
+inline FlowPolicyConfig global_config() { return FlowPolicyConfig {.routing = centralized()}; }
+inline FlowPolicyConfig shortest_paths_config() { return FlowPolicyConfig {.routing = ShortestPaths {}}; }
+
+// The five statistics of a ShortestPathCache, comparable as one value.
+inline std::tuple<std::int64_t, std::int64_t, std::int64_t, std::int64_t, std::int64_t> stats_of(
+    const ShortestPathCache::Stats& s) {
+  return {s.hits, s.misses, s.entries, s.bytes, s.live_values};
+}
+
+// The kernel-combination errors of the configuration check.
+inline const std::string kLossyKernelError = "OPTIMIZED requires admission=LOSSLESS";
+
+inline Graph make_graph(std::int32_t n, const std::vector<InEdge>& edges, double q = 1.0) {
+  std::vector<NodeId> src, dst;
+  std::vector<Amount> cap;
+  std::vector<Cost> cost;
+  for (const auto& e : edges) {
+    src.push_back(e.u);
+    dst.push_back(e.v);
+    cap.push_back(e.cap);
+    cost.push_back(e.cost);
+  }
+  return Graph(n, src, dst, cap, cost, q);
+}
+
+// m random edges on n nodes (self-loops and parallel edges allowed): capacities min_capacity to 4
+// units, costs 1 to max_edge_cost times scale. The draws are in a braced list, so their order is fixed.
+inline Graph random_graph(std::mt19937& rng, int n, int m, Cost max_edge_cost, Cost scale = 1, Amount min_capacity = 0) {
+  std::vector<InEdge> edges;
+  for (int i = 0; i < m; ++i) {
+    edges.push_back({static_cast<NodeId>(rng() % static_cast<unsigned>(n)), static_cast<NodeId>(rng() % static_cast<unsigned>(n)),
+                     min_capacity + static_cast<Amount>(rng() % static_cast<unsigned>(5 - min_capacity)),
+                     scale * static_cast<Cost>(1 + rng() % static_cast<unsigned>(max_edge_cost))});
+  }
+  return make_graph(n, edges);
+}
+
+// The message of the std::invalid_argument fn throws; "" when it throws none.
+inline std::string error_of(const std::function<void()>& fn) {
+  try {
+    fn();
+  } catch (const std::invalid_argument& e) {
+    return e.what();
+  }
+  return "";
+}
+
+// The failures fn records, intercepted (they do not fail the calling test): the negative
+// controls of the tests' own checks and comparators.
+inline int failures_of(const std::function<void()>& fn) {
+  ::testing::TestPartResultArray results;
+  {
+    const ::testing::ScopedFakeTestPartResultReporter reporter(
+        ::testing::ScopedFakeTestPartResultReporter::INTERCEPT_ONLY_CURRENT_THREAD, &results);
+    fn();
+  }
+  return results.size();
+}
+
+inline bool contains(const std::string& s, const std::string& part) { return s.find(part) != std::string::npos; }
+
+// Whether a checker's failed clauses (a list of messages) include one that starts with `clause`.
+inline bool has_failure(const std::vector<std::string>& fails, const std::string& clause) {
+  return std::any_of(fails.begin(), fails.end(), [&](const std::string& f) { return f.rfind(clause, 0) == 0; });
+}
+
+inline std::shared_ptr<const Graph> shared(Graph g) { return std::make_shared<const Graph>(std::move(g)); }
+
+// A node list written inline: v({0, 1}).
+inline std::vector<NodeId> v(std::initializer_list<NodeId> x) { return x; }
+
+// Per-edge amount arrays with one or several defects (one error; detail::check_edge_amounts) for
+// edge_amount_graph(), three edges of capacity 2, so the texts hold whatever the EdgeId order:
+// the length is reported before any entry, then the first entry outside [0, 2] in EdgeId order.
+// `error` follows the caller's label ("residual", "view").
+struct EdgeAmountDefect {
+  std::vector<Amount> amounts;
+  std::string error;
+};
+
+inline Graph edge_amount_graph() { return make_graph(4, {{0, 1, 2, 1}, {1, 2, 2, 1}, {2, 3, 2, 1}}); }
+
+inline std::vector<EdgeAmountDefect> edge_amount_defects() {
+  return {
+      {{9, -1, 0, 0}, " has length 4, expected 3 (one entry per edge)"},
+      {{-5, 9}, " has length 2, expected 3 (one entry per edge)"},
+      {{}, " has length 0, expected 3 (one entry per edge)"},
+      {{0, -1, 3}, "[1] = -1 is outside [0, edge_capacity_units[1] = 2]"},
+      {{0, 3, -1}, "[1] = 3 is outside [0, edge_capacity_units[1] = 2]"},
+      {{2, 0, 3}, "[2] = 3 is outside [0, edge_capacity_units[2] = 2]"},
+      {{-1, -1, -1}, "[0] = -1 is outside [0, edge_capacity_units[0] = 2]"},
+  };
+}
+
+// Both bounds of [0, capacity] are inside.
+inline std::vector<Amount> edge_amounts_at_the_bounds() { return {0, 2, 1}; }
+
+// A span (a public array, a plan's structure field) as a vector.
+template <class T>
+std::vector<std::remove_const_t<T>> vec(std::span<T> s) {
+  return std::vector<std::remove_const_t<T>>(s.begin(), s.end());
+}
+
+// Every EdgeId of g, ascending.
+inline std::vector<EdgeId> all_ids(const Graph& g) {
+  std::vector<EdgeId> out(static_cast<std::size_t>(g.num_edges()));
+  for (std::size_t i = 0; i < out.size(); ++i) out[i] = static_cast<EdgeId>(i);
+  return out;
+}
+
+// The PredecessorDAG of a set of EdgeIds (the builder's of_edges).
+inline std::shared_ptr<const PredecessorDAG> dag_of(const Graph& g, std::vector<EdgeId> edges) {
+  return std::make_shared<const PredecessorDAG>(detail::PredecessorDAGBuilder::of_edges(g, edges));
+}
+
+// A DAG's edges in ascending EdgeId (the builder's view of the storage).
+inline std::vector<EdgeId> ascending_edges(const PredecessorDAG& dag) {
+  const auto e = detail::PredecessorDAGBuilder::ascending(dag);
+  return {e.begin(), e.end()};
+}
+
+// The sorted, distinct nodes of `set` that `elig` allows (all of them without an Eligibility).
+inline std::vector<NodeId> allowed_nodes(std::vector<NodeId> set, const Eligibility* elig) {
+  std::sort(set.begin(), set.end());
+  set.erase(std::unique(set.begin(), set.end()), set.end());
+  std::vector<NodeId> out;
+  for (NodeId v : set) {
+    if (elig == nullptr || elig->allows_node(v)) out.push_back(v);
+  }
+  return out;
+}
+
+// The DAG of every edge of g.
+inline std::shared_ptr<const PredecessorDAG> all_edges(const Graph& g) { return dag_of(g, all_ids(g)); }
+
+// Pinned routing over a supplied program of split routes of one head, in order (weight 1 each;
+// placement absent: Equal).
+inline Pinned pinned_dags(const Graph& g, NodeId src, NodeId dst, const std::vector<std::shared_ptr<const PredecessorDAG>>& dags,
+                          std::optional<RouteAllocation> placement = std::nullopt, Admission admission = Admission::Lossless) {
+  (void)admission;
+  std::vector<RouteDefinition> routes;
+  for (const auto& d : dags) routes.push_back(RouteDefinition {src, d, 1});
+  RouteOptions options;
+  options.allocation = placement;
+  const NodeId s[1] = {src};
+  const NodeId t[1] = {dst};
+  return Pinned {ForwardingProgram::from_routes(g, s, t, routes, options), nullptr};
+}
+
+// Pinned routing over a supplied program of tunnels: (head, EdgeIds in path order, weight).
+inline Pinned pinned_paths(const Graph& g, const std::vector<NodeId>& sources, const std::vector<NodeId>& destinations,
+                           const std::vector<std::tuple<NodeId, std::vector<EdgeId>, Amount>>& tunnels) {
+  std::vector<RouteDefinition> routes;
+  for (const auto& [head, edges, weight] : tunnels) {
+    std::vector<std::vector<EdgeId>> hops;
+    for (EdgeId e : edges) hops.push_back({e});
+    routes.push_back(RouteDefinition {head, std::make_shared<const Path>(g, hops), weight});
+  }
+  return Pinned {ForwardingProgram::from_routes(g, sources, destinations, routes), nullptr};
+}
+
+// Every operation counter of two solves (the counter struct has no ==).
+inline bool same_counters(const detail::MinCostFlowCounters& x, const detail::MinCostFlowCounters& y) {
+  return x.dijkstra_runs == y.dijkstra_runs && x.dijkstra_pops == y.dijkstra_pops && x.settled == y.settled &&
+         x.arc_scans == y.arc_scans && x.dinic_phases == y.dinic_phases && x.augmentations == y.augmentations;
+}
+
+// Every field of a network against its copy `in`.
+inline bool same_network(const detail::ResidualNetwork& net, const detail::ResidualNetwork& in) {
+  return net.num_nodes == in.num_nodes && net.edges == in.edges && net.edge_sources == in.edge_sources && net.edge_destinations == in.edge_destinations &&
+         net.cost == in.cost && net.edge_capacities == in.edge_capacities && net.sources == in.sources && net.destinations == in.destinations &&
+         net.arc_offsets == in.arc_offsets && net.arc_destinations == in.arc_destinations && net.reverse_arcs == in.reverse_arcs && net.arc_cost == in.arc_cost &&
+         net.edge_forward_arcs == in.edge_forward_arcs && net.source_reverse_arcs == in.source_reverse_arcs && net.destination_forward_arcs == in.destination_forward_arcs;
+}
+
+// Every field of a deletion re-solve's result, its operation counters included.
+inline bool same_result(const detail::DeletionResult& a, const detail::DeletionResult& b) {
+  return a.value == b.value && a.potentials == b.potentials && a.min_cut == b.min_cut && a.edge_flows == b.edge_flows &&
+         same_counters(a.counters, b.counters);
+}
+
+// The caller's inverse of input_positions(): input position -> EdgeId.
+inline std::vector<EdgeId> id_of_input(const Graph& g) {
+  auto ii = g.input_positions();
+  std::vector<EdgeId> inv(ii.size());
+  for (std::size_t e = 0; e < ii.size(); ++e) inv[static_cast<std::size_t>(ii[e])] = static_cast<EdgeId>(e);
+  return inv;
+}
+
+// The path 0 -> 1 -> ... -> n - 1 (cost 1 per edge) at capacity `cap`.
+inline std::shared_ptr<const Graph> chain_graph(std::int32_t n, Amount cap) {
+  std::vector<InEdge> edges;
+  for (NodeId v = 0; v + 1 < n; ++v) edges.push_back({v, v + 1, cap, 1});
+  return std::make_shared<const Graph>(make_graph(n, edges));
+}
+
+// A per-edge array in input order, permuted to id order.
+template <typename T>
+std::vector<T> to_ids(const Graph& g, const std::vector<T>& by_input) {
+  auto ii = g.input_positions();
+  std::vector<T> out(ii.size());
+  for (std::size_t e = 0; e < ii.size(); ++e) out[e] = by_input[static_cast<std::size_t>(ii[e])];
+  return out;
+}
+
+// A per-edge array in id order, permuted to input order.
+template <typename T>
+std::vector<T> to_input(const Graph& g, std::span<const T> by_id) {
+  auto ii = g.input_positions();
+  std::vector<T> out(ii.size());
+  for (std::size_t e = 0; e < ii.size(); ++e) out[static_cast<std::size_t>(ii[e])] = by_id[e];
+  return out;
+}
+
+template <typename T>
+std::vector<T> to_input(const Graph& g, const std::vector<T>& by_id) {
+  return to_input(g, std::span<const T>(by_id));
+}
+
+// EdgeIds translated to sorted input positions.
+inline std::vector<std::int32_t> ids_to_input(const Graph& g, const std::vector<EdgeId>& ids) {
+  std::vector<std::int32_t> out;
+  for (EdgeId e : ids) out.push_back(g.input_positions()[static_cast<std::size_t>(e)]);
+  std::sort(out.begin(), out.end());
+  return out;
+}
+
+inline std::vector<std::pair<Cost, Amount>> curve(std::initializer_list<std::pair<Cost, Amount>> c) { return c; }
+
+inline MinCostFlowResult solve(const Graph& g, std::vector<NodeId> s, std::vector<NodeId> d,
+                            std::optional<Amount> cap, const std::vector<Amount>* view = nullptr,
+                            const Eligibility* elig = nullptr) {
+  std::vector<Amount> full(g.edge_capacity_units().begin(), g.edge_capacity_units().end());
+  return solve_min_cost_flow(g, view ? std::span<const Amount>(*view) : std::span<const Amount>(full), s, d, elig, cap);
+}
+
+inline bool same_payload(const MinCostFlowResult& a, const MinCostFlowResult& b) {
+  return a.flow_value == b.flow_value && a.marginal_cost_curve == b.marginal_cost_curve && a.edge_flows == b.edge_flows &&
+         a.min_cut == b.min_cut && a.potentials == b.potentials && same_counters(a.counters, b.counters);
+}
+
+// Value -> minimum cost of every integer flow value, by enumerating every integer flow on the
+// eligible edges (small graphs only). Independent of the solver.
+inline std::map<Amount, Int128> exhaustive_costs(const Graph& g, std::span<const Amount> view,
+                                                   const std::vector<NodeId>& srcs, const std::vector<NodeId>& dsts,
+                                                   const Eligibility* elig) {
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<std::size_t> free;
+  for (std::size_t e = 0; e < m; ++e) {
+    if (elig == nullptr || elig->allows_edge(static_cast<EdgeId>(e))) free.push_back(e);
+  }
+  std::set<NodeId> S, D;
+  for (NodeId s : srcs) if (elig == nullptr || elig->allows_node(s)) S.insert(s);
+  for (NodeId d : dsts) if (elig == nullptr || elig->allows_node(d)) D.insert(d);
+  std::map<Amount, Int128> best;
+  std::vector<Amount> f(free.size(), 0);
+  while (true) {
+    std::vector<Amount> bal(n, 0);
+    Int128 cost = 0;
+    for (std::size_t k = 0; k < free.size(); ++k) {
+      const auto e = free[k];
+      bal[static_cast<std::size_t>(g.edge_sources()[e])] -= f[k];
+      bal[static_cast<std::size_t>(g.edge_destinations()[e])] += f[k];
+      cost += static_cast<Int128>(g.edge_costs()[e]) * f[k];
+    }
+    bool ok = true;
+    Amount value = 0;
+    for (std::size_t v = 0; v < n && ok; ++v) {
+      const auto node = static_cast<NodeId>(v);
+      if (S.count(node)) { ok = bal[v] <= 0; value -= bal[v]; }
+      else if (D.count(node)) ok = bal[v] >= 0;
+      else ok = bal[v] == 0;
+    }
+    if (ok) {
+      auto it = best.find(value);
+      if (it == best.end() || cost < it->second) best[value] = cost;
+    }
+    std::size_t k = 0;
+    while (k < free.size() && f[k] == view[free[k]]) f[k++] = 0;
+    if (k == free.size()) break;
+    ++f[k];
+  }
+  return best;
+}
+
+// Breakpoints [(value, cost)] of the min-cost curve by successive shortest paths with
+// Bellman-Ford on the residual (no potentials, no Dinic, its own arc order); run to
+// disconnection. Independent of the solver.
+inline std::vector<std::pair<Amount, Int128>> independent_curve(const Graph& g,
+                                                                  std::span<const Amount> view,
+                                                                  const std::vector<NodeId>& srcs,
+                                                                  const std::vector<NodeId>& dsts,
+                                                                  const Eligibility* elig) {
+  struct Arc { int u, v; Amount cap; Cost w; Amount flow; };
+  const int n = g.num_nodes();
+  const int S = n, T = n + 1;
+  std::vector<Arc> arcs;
+  for (std::size_t e = 0; e < static_cast<std::size_t>(g.num_edges()); ++e) {
+    if (elig != nullptr && !elig->allows_edge(static_cast<EdgeId>(e))) continue;
+    arcs.push_back({g.edge_sources()[e], g.edge_destinations()[e], view[e], g.edge_costs()[e], 0});
+  }
+  for (NodeId s : srcs) if (elig == nullptr || elig->allows_node(s)) arcs.push_back({S, s, kMaxFlowCap, 0, 0});
+  for (NodeId d : dsts) if (elig == nullptr || elig->allows_node(d)) arcs.push_back({d, T, kMaxFlowCap, 0, 0});
+  std::vector<std::pair<Amount, Int128>> pts{{0, 0}};
+  while (true) {
+    const Int128 inf = int128_max();
+    std::vector<Int128> dist(static_cast<std::size_t>(n + 2), inf);
+    std::vector<std::pair<int, int>> parent(static_cast<std::size_t>(n + 2), {-1, 0});
+    dist[static_cast<std::size_t>(S)] = 0;
+    for (int it = 0; it < n + 2; ++it) {
+      bool changed = false;
+      for (int i = 0; i < static_cast<int>(arcs.size()); ++i) {
+        const auto& a = arcs[static_cast<std::size_t>(i)];
+        const auto du = dist[static_cast<std::size_t>(a.u)];
+        const auto dv = dist[static_cast<std::size_t>(a.v)];
+        if (a.flow < a.cap && du != inf && du + a.w < dv) {
+          dist[static_cast<std::size_t>(a.v)] = du + a.w;
+          parent[static_cast<std::size_t>(a.v)] = {i, 1};
+          changed = true;
+        }
+        if (a.flow > 0 && dist[static_cast<std::size_t>(a.v)] != inf &&
+            dist[static_cast<std::size_t>(a.v)] - a.w < dist[static_cast<std::size_t>(a.u)]) {
+          dist[static_cast<std::size_t>(a.u)] = dist[static_cast<std::size_t>(a.v)] - a.w;
+          parent[static_cast<std::size_t>(a.u)] = {i, -1};
+          changed = true;
+        }
       }
-      // Down edge
-      if (r < rows - 1) {
-        src.push_back(node);
-        dst.push_back(node + cols);
-        cap.push_back(1.0);
-        cost.push_back(1);
+      if (!changed) break;
+    }
+    if (dist[static_cast<std::size_t>(T)] == inf) return pts;
+    std::vector<std::pair<int, int>> path;
+    for (int v = T; v != S;) {
+      auto [i, sign] = parent[static_cast<std::size_t>(v)];
+      path.emplace_back(i, sign);
+      const auto& a = arcs[static_cast<std::size_t>(i)];
+      v = sign == 1 ? a.u : a.v;
+    }
+    Amount amount = std::numeric_limits<Amount>::max();
+    for (auto [i, sign] : path) {
+      const auto& a = arcs[static_cast<std::size_t>(i)];
+      amount = std::min(amount, sign == 1 ? a.cap - a.flow : a.flow);
+    }
+    for (auto [i, sign] : path) arcs[static_cast<std::size_t>(i)].flow += sign * amount;
+    pts.emplace_back(pts.back().first + amount, pts.back().second + dist[static_cast<std::size_t>(T)] * amount);
+  }
+}
+
+// Cost of a piecewise-linear curve at an integer value inside its domain. Every segment of both
+// curves has an integer slope (the cost per unit of one tier or one augmenting path), so the
+// value is exact in 128 bits: costs stay below 2^62 per unit and amounts below 2^62. An empty or
+// backward segment (a payload entry of volume 0 or less, which the curve-shape clause rejects) is
+// skipped rather than divided by its length.
+inline Int128 curve_at(const std::vector<std::pair<Amount, Int128>>& pts, Amount x) {
+  for (std::size_t i = 1; i < pts.size(); ++i) {
+    const auto [a, ca] = pts[i - 1];
+    const auto [b, cb] = pts[i];
+    if (a < b && a <= x && x <= b) {
+      const Int128 slope = (cb - ca) / (b - a);
+      return ca + slope * (x - a);
+    }
+  }
+  return pts.back().second;
+}
+
+// The curve clauses shared by the flow certificates (certify below, the Optimized kernel step's in
+// route_kernels_tests.cpp and the CentralizedTE policy's cumulative curve in flow_policy_tests.cpp). The shape: every volume positive and the costs strictly increasing; the
+// curve's total equals the delivered value and its moment (the sum of cost x volume) the flow's
+// cost. Returns the curve's breakpoints [(value, cost)] from (0, 0).
+inline std::vector<std::pair<Amount, Int128>> curve_shape_clauses(const std::vector<std::pair<Cost, Amount>>& curve,
+                                                                  Amount delivered, Int128 moment,
+                                                                  std::vector<std::string>& fails) {
+  std::vector<std::pair<Amount, Int128>> pts {{0, 0}};
+  for (std::size_t i = 0; i < curve.size(); ++i) {
+    const auto [c, u] = curve[i];
+    if (u <= 0) fails.push_back("curve volume not positive");
+    if (i > 0 && c <= curve[i - 1].first) fails.push_back("curve costs not strictly increasing");
+    pts.emplace_back(pts.back().first + u, pts.back().second + static_cast<Int128>(c) * u);
+  }
+  if (pts.back().first != delivered) fails.push_back("curve total differs from placed");
+  if (pts.back().second != moment) fails.push_back("curve moment differs from the flow cost");
+  return pts;
+}
+
+// The curve against an optimum's breakpoints: equal at every breakpoint of either up to `upto`
+// (both are piecewise linear, so equal everywhere there); the first value that differs is
+// reported, naming the optimum.
+inline void curve_optimum_clause(const std::vector<std::pair<Amount, Int128>>& pts,
+                                 const std::vector<std::pair<Amount, Int128>>& optimum, Amount upto,
+                                 const std::string& name, std::vector<std::string>& fails) {
+  std::set<Amount> xs;
+  for (const auto& [x, c] : pts) xs.insert(x);
+  for (const auto& [x, c] : optimum) xs.insert(x);
+  for (Amount x : xs) {
+    if (x > upto) continue;
+    if (curve_at(pts, x) != curve_at(optimum, x)) {
+      fails.push_back("curve differs from " + name + " at " + std::to_string(x));
+      return;
+    }
+  }
+}
+
+// The cost of a flow given per EdgeId: the sum of cost x flow, exact in 128 bits.
+inline Int128 flow_cost(const Graph& g, std::span<const Amount> flows) {
+  Int128 total = 0;
+  for (std::size_t e = 0; e < flows.size(); ++e) total += static_cast<Int128>(g.edge_costs()[e]) * flows[e];
+  return total;
+}
+
+// Per node, what a flow's sources send out and what its destinations receive (net amounts; 0 at
+// every other node).
+struct FlowBalance {
+  std::vector<Int128> supply;
+  std::vector<Int128> inflow;
+};
+
+// The flow clauses of the flow certificates (certify below, the deletion re-solve's in
+// min_cost_flow_deletion_tests.cpp and the CentralizedTE policy's in flow_policy_tests.cpp), on a flow given
+// per EdgeId: every edge flow within [0, view] and zero on an edge the Eligibility excludes; a
+// source absorbs nothing and a destination emits nothing (a node in both sets counts as a
+// source), an excluded one carries nothing, and every other node passes on what it receives;
+// what the sources send out and what the destinations receive both equal `delivered`. Appends the
+// failed clauses to `fails`.
+inline FlowBalance flow_clauses(const Graph& g, std::span<const Amount> view, std::span<const Amount> flows,
+                                const std::vector<NodeId>& srcs, const std::vector<NodeId>& dsts,
+                                const Eligibility* elig, Amount delivered, std::vector<std::string>& fails) {
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  auto edge_allowed = [&](std::size_t e) { return elig == nullptr || elig->allows_edge(static_cast<EdgeId>(e)); };
+  auto node_allowed = [&](NodeId v) { return elig == nullptr || elig->allows_node(v); };
+  std::vector<Int128> bal(n, 0);  // inflow minus outflow
+  for (std::size_t e = 0; e < m; ++e) {
+    const Amount f = flows[e];
+    if (f < 0 || f > view[e]) fails.push_back("feasibility at edge " + std::to_string(e));
+    if (!edge_allowed(e) && f != 0) fails.push_back("flow on an ineligible edge " + std::to_string(e));
+    bal[static_cast<std::size_t>(g.edge_sources()[e])] -= f;
+    bal[static_cast<std::size_t>(g.edge_destinations()[e])] += f;
+  }
+  const std::set<NodeId> S(srcs.begin(), srcs.end()), D(dsts.begin(), dsts.end());
+  FlowBalance out {std::vector<Int128>(n, 0), std::vector<Int128>(n, 0)};
+  Int128 supply = 0, inflow = 0;
+  for (std::size_t v = 0; v < n; ++v) {
+    const auto node = static_cast<NodeId>(v);
+    if (S.count(node)) {
+      if (bal[v] > 0) fails.push_back("source absorbs flow");
+      if (!node_allowed(node) && bal[v] != 0) fails.push_back("excluded source supplies");
+      out.supply[v] = -bal[v];
+      supply += -bal[v];
+    } else if (D.count(node)) {
+      if (bal[v] < 0) fails.push_back("destination emits flow");
+      if (!node_allowed(node) && bal[v] != 0) fails.push_back("excluded destination receives");
+      out.inflow[v] = bal[v];
+      inflow += bal[v];
+    } else if (bal[v] != 0) {
+      fails.push_back("conservation at node " + std::to_string(v));
+    }
+  }
+  if (supply != delivered || inflow != delivered) fails.push_back("value differs from supply or inflow");
+  return out;
+}
+
+// The residual closure of a flow given per EdgeId: the nodes that the allowed nodes of `seeds`
+// reach over allowed edges, forward along an edge whose flow leaves room in the view and backward
+// along an edge that carries flow (a unit there can be undone). Marks them with 1.
+inline std::vector<char> residual_closure(const Graph& g, std::span<const Amount> view,
+                                          std::span<const Amount> flows, const std::vector<NodeId>& seeds,
+                                          const Eligibility* elig) {
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<std::vector<std::size_t>> next(n);
+  for (std::size_t e = 0; e < m; ++e) {
+    if (elig != nullptr && !elig->allows_edge(static_cast<EdgeId>(e))) continue;
+    const auto u = static_cast<std::size_t>(g.edge_sources()[e]);
+    const auto v = static_cast<std::size_t>(g.edge_destinations()[e]);
+    if (flows[e] < view[e]) next[u].push_back(v);
+    if (flows[e] > 0) next[v].push_back(u);
+  }
+  std::vector<char> seen(n, 0);
+  std::vector<std::size_t> queue;
+  for (NodeId s : seeds) {
+    const auto x = static_cast<std::size_t>(s);
+    if ((elig == nullptr || elig->allows_node(s)) && seen[x] == 0) {
+      seen[x] = 1;
+      queue.push_back(x);
+    }
+  }
+  for (std::size_t qi = 0; qi < queue.size(); ++qi) {
+    for (const std::size_t v : next[queue[qi]]) {
+      if (seen[v] == 0) {
+        seen[v] = 1;
+        queue.push_back(v);
       }
     }
   }
-  return StrictMultiDiGraph::from_arrays(n, src, dst, cap, cost);
-}
-
-inline StrictMultiDiGraph make_n_disjoint_paths(int n, double capacity, std::int64_t cost = 1) {
-  // Create N disjoint equal-cost paths from source to sink
-  // Topology: 0 → [1..n] → (n+1)
-  // Each path has 2 hops with specified capacity and cost
-  int num_nodes = n + 2;  // source, n intermediates, sink
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost_vec;
-
-  for (int i = 0; i < n; ++i) {
-    // First hop: 0 → (i+1)
-    src.push_back(0);
-    dst.push_back(i + 1);
-    cap.push_back(capacity);
-    cost_vec.push_back(cost);
-
-    // Second hop: (i+1) → (n+1)
-    src.push_back(i + 1);
-    dst.push_back(n + 1);
-    cap.push_back(capacity);
-    cost_vec.push_back(cost);
-  }
-
-  return StrictMultiDiGraph::from_arrays(num_nodes, src, dst, cap, cost_vec);
-}
-
-inline StrictMultiDiGraph make_tiered_graph(double cap_tier1, double cap_tier2,
-                                             std::int64_t cost_tier1 = 1,
-                                             std::int64_t cost_tier2 = 2) {
-  // Create topology with two different-cost paths
-  // Path 1: 0→1→3 (tier1 cost and capacity)
-  // Path 2: 0→2→3 (tier2 cost and capacity)
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {cap_tier1, cap_tier1, cap_tier2, cap_tier2};
-  std::int64_t cost_arr[4] = {cost_tier1, cost_tier1, cost_tier2, cost_tier2};
-
-  return StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-}
-
-inline StrictMultiDiGraph make_shared_bottleneck_graph(double path_cap, double bottleneck_cap) {
-  // Create topology with shared bottleneck
-  // Two paths: 0→1→3 and 0→2→3, where edge 1→3 is shared
-  // Path 1: 0→1 (path_cap), 1→3 (bottleneck_cap)
-  // Path 2: 0→2 (path_cap), 2→3 (path_cap)
-  // Bottleneck: 1→3 limits total flow
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {path_cap, bottleneck_cap, path_cap, path_cap};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-
-  return StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-}
-
-inline StrictMultiDiGraph make_3tier_clos_graph() {
-  /**
-   * Build a 3-tier Clos topology matching NetGraph scenario_3.yaml structure.
-   *
-   * Structure (replicates scenario_3 from NetGraph integration tests):
-   * - 2 Clos instances (clos1, clos2)
-   * - Each Clos has:
-   *   - 2 bricks (b1, b2)
-   *   - Each brick has:
-   *     - 4 T1 nodes (tier1/leaf layer)
-   *     - 4 T2 nodes (tier2/aggregation layer)
-   *     - Mesh: all T1->T2 edges within brick (100 Gbps, cost 1)
-   *   - 16 spine nodes (T3)
-   *   - Connections: Each brick's 4 T2 nodes connect one-to-one to 4 spines (400 Gbps, cost 1)
-   * - Inter-Clos: 16 spine-to-spine links (400 Gbps, cost 1)
-   *
-   * Node numbering:
-   * - Clos1:
-   *   - b1/t1: nodes 0-3
-   *   - b1/t2: nodes 4-7
-   *   - b2/t1: nodes 8-11
-   *   - b2/t2: nodes 12-15
-   *   - spine: nodes 16-31
-   * - Clos2:
-   *   - b1/t1: nodes 32-35
-   *   - b1/t2: nodes 36-39
-   *   - b2/t1: nodes 40-43
-   *   - b2/t2: nodes 44-47
-   *   - spine: nodes 48-63
-   *
-   * Total nodes: 64
-   *
-   * Expected max flow from clos1 T1 nodes to clos2 T1 nodes: 3200.0 Gbps
-   * (8 inter-clos spine links × 400 Gbps = 3200 Gbps bottleneck)
-   */
-
-  constexpr int num_nodes = 64;
-  std::vector<std::int32_t> src, dst;
-  std::vector<double> cap;
-  std::vector<std::int64_t> cost;
-
-  // Helper to add mesh connections between two groups
-  auto add_mesh = [&](int group1_start, int group1_count, int group2_start, int group2_count, double capacity) {
-    for (int i = 0; i < group1_count; ++i) {
-      for (int j = 0; j < group2_count; ++j) {
-        src.push_back(group1_start + i);
-        dst.push_back(group2_start + j);
-        cap.push_back(capacity);
-        cost.push_back(1);
+  return seen;
+}
+
+// The cut of a closure: every allowed edge from a node of the closure to a node outside it,
+// whatever its view, ascending EdgeId (an edge of view 0 adds 0 to the value; it is listed
+// because every edge leaving the closure is, also where it leads to a dead end). On a maximal
+// flow, the closure of the sources holds no destination and this is the minimum cut the flow
+// certifies.
+inline std::vector<EdgeId> closure_cut(const Graph& g, const std::vector<char>& closure, const Eligibility* elig) {
+  std::vector<EdgeId> cut;
+  for (std::size_t e = 0; e < static_cast<std::size_t>(g.num_edges()); ++e) {
+    if (elig != nullptr && !elig->allows_edge(static_cast<EdgeId>(e))) continue;
+    if (closure[static_cast<std::size_t>(g.edge_sources()[e])] != 0 &&
+        closure[static_cast<std::size_t>(g.edge_destinations()[e])] == 0) {
+      cut.push_back(static_cast<EdgeId>(e));
+    }
+  }
+  return cut;
+}
+
+// The flow core's optimality certificate in two ordered branches. Returns the failed clauses. With
+// `tier_a`, the complete curve is compared with the exhaustive optimum of every value; else with
+// the independent Bellman-Ford curve at the union of both breakpoint sets.
+inline std::vector<std::string> certify(const Graph& g, std::span<const Amount> view,
+                                        std::vector<NodeId> srcs, std::vector<NodeId> dsts,
+                                        std::optional<Amount> cap, const Eligibility* elig,
+                                        const MinCostFlowResult& r, bool tier_a) {
+  std::vector<std::string> fails;
+  const auto m = static_cast<std::size_t>(g.num_edges());
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::sort(srcs.begin(), srcs.end());
+  srcs.erase(std::unique(srcs.begin(), srcs.end()), srcs.end());
+  std::sort(dsts.begin(), dsts.end());
+  dsts.erase(std::unique(dsts.begin(), dsts.end()), dsts.end());
+  auto edge_allowed = [&](std::size_t e) { return elig == nullptr || elig->allows_edge(static_cast<EdgeId>(e)); };
+  auto node_allowed = [&](NodeId v) { return elig == nullptr || elig->allows_node(v); };
+  if (r.edge_flows.size() != m || r.potentials.size() != n) {
+    fails.push_back("shape");
+    return fails;
+  }
+  if (cap.has_value() && *cap == 0) {
+    if (r.flow_value != 0 || !r.marginal_cost_curve.empty() || r.min_cut.has_value() ||
+        std::any_of(r.edge_flows.begin(), r.edge_flows.end(), [](Amount x) { return x != 0; }) ||
+        std::any_of(r.potentials.begin(), r.potentials.end(), [](Cost p) { return p != kNeverReached; }) ||
+        !same_counters(r.counters, detail::MinCostFlowCounters {})) {
+      fails.push_back("zero cap: the prescribed zero payload");
+    }
+    return fails;
+  }
+  const FlowBalance balance = flow_clauses(g, view, r.edge_flows, srcs, dsts, elig, r.flow_value, fails);
+  const Int128 moment = flow_cost(g, r.edge_flows);
+  if (r.flow_value < 0 || (cap.has_value() && r.flow_value > *cap)) fails.push_back("placed outside [0, cap]");
+  // The full residual closure, with a virtual source s* (an arc to every allowed source, and one
+  // back from a source that sends) and a virtual sink t* (an arc from every allowed destination,
+  // and one back to a destination that receives): t* is in it when an allowed destination is
+  // (the destinations are still connected to the sources), and then so is everything a receiving
+  // destination reaches; s* adds no node, every allowed source being a seed.
+  std::vector<char> seen = residual_closure(g, view, r.edge_flows, srcs, elig);
+  const bool connected = std::any_of(dsts.begin(), dsts.end(), [&](NodeId d) {
+    return node_allowed(d) && seen[static_cast<std::size_t>(d)] != 0;
+  });
+  if (connected) {
+    std::vector<NodeId> seeds = srcs;
+    for (NodeId d : dsts) {
+      if (balance.inflow[static_cast<std::size_t>(d)] > 0) seeds.push_back(d);
+    }
+    seen = residual_closure(g, view, r.edge_flows, seeds, elig);
+  }
+  if (!cap.has_value() && connected) fails.push_back("uncapped solve left the destinations connected");
+  if (cap.has_value() && r.flow_value != *cap && connected) fails.push_back("attained value: early stop");
+  if (connected) {
+    if (r.min_cut.has_value()) fails.push_back("min_cut present on a connected solve");
+  } else {
+    const std::vector<EdgeId> expect = closure_cut(g, seen, elig);
+    Int128 cut_value = 0;
+    for (const EdgeId e : expect) cut_value += view[static_cast<std::size_t>(e)];
+    if (!r.min_cut.has_value()) fails.push_back("min_cut missing on a maximal solve");
+    else if (*r.min_cut != expect) fails.push_back("min_cut differs from the closure cut");
+    if (cut_value != r.flow_value) fails.push_back("cut value differs from placed");
+  }
+  // The vertices some search settled: the first search runs on the zero flow and settles every
+  // vertex an allowed source reaches over eligible edges of positive view; a later search adds
+  // only the reverses of carrying edges, whose ends that one already settled.
+  std::vector<char> settled(n, 0);
+  std::vector<std::size_t> from_zero;
+  for (NodeId s : srcs) {
+    const auto x = static_cast<std::size_t>(s);
+    if (node_allowed(s) && !settled[x]) { settled[x] = 1; from_zero.push_back(x); }
+  }
+  for (std::size_t qi = 0; qi < from_zero.size(); ++qi) {
+    for (std::size_t e = 0; e < m; ++e) {
+      const auto u = static_cast<std::size_t>(g.edge_sources()[e]);
+      const auto v = static_cast<std::size_t>(g.edge_destinations()[e]);
+      if (u == from_zero[qi] && edge_allowed(e) && view[e] > 0 && !settled[v]) { settled[v] = 1; from_zero.push_back(v); }
+    }
+  }
+  for (std::size_t v = 0; v < n; ++v) {
+    if (r.potentials[v] < kNeverReached) fails.push_back("potential below the sentinel");
+    if (seen[v] && r.potentials[v] == kNeverReached) fails.push_back("closure vertex holds NEVER_REACHED");
+    if ((r.potentials[v] == kNeverReached) == (settled[v] != 0)) {
+      fails.push_back("NEVER_REACHED differs from reachability at zero flow at node " + std::to_string(v));
+    }
+  }
+  for (NodeId s : srcs) {
+    const auto p = r.potentials[static_cast<std::size_t>(s)];
+    if (node_allowed(s) && p != 0) fails.push_back("allowed root with potential other than 0");
+  }
+  // Every residual arc between two closure vertices with potentials: the forward arc of an
+  // allowed edge with room (its cost) and the backward arc of one that carries flow (minus it).
+  auto reduced_cost_clause = [&](std::size_t u, std::size_t v, Int128 w) {
+    if (!seen[u] || !seen[v] || r.potentials[u] == kNeverReached || r.potentials[v] == kNeverReached) return;
+    if (w + r.potentials[u] - r.potentials[v] < 0) fails.push_back("negative reduced cost inside the closure");
+  };
+  for (std::size_t e = 0; e < m; ++e) {
+    if (!edge_allowed(e)) continue;
+    const auto u = static_cast<std::size_t>(g.edge_sources()[e]);
+    const auto v = static_cast<std::size_t>(g.edge_destinations()[e]);
+    if (r.edge_flows[e] < view[e]) reduced_cost_clause(u, v, g.edge_costs()[e]);
+    if (r.edge_flows[e] > 0) reduced_cost_clause(v, u, -static_cast<Int128>(g.edge_costs()[e]));
+  }
+  std::optional<Cost> pt;
+  for (NodeId d : dsts) {
+    const auto p = r.potentials[static_cast<std::size_t>(d)];
+    if (p != kNeverReached) pt = pt ? std::min(*pt, p) : p;
+  }
+  if (pt) {
+    for (NodeId d : dsts) {
+      const auto p = r.potentials[static_cast<std::size_t>(d)];
+      if (p == kNeverReached) continue;
+      if (balance.inflow[static_cast<std::size_t>(d)] > 0 && p != *pt) {
+        fails.push_back("inflow destination potential differs from pi(t*)");
       }
     }
+    if (!r.marginal_cost_curve.empty() && r.marginal_cost_curve.back().first != *pt) {
+      fails.push_back("pi(t*) differs from the last curve cost");
+    }
+  } else if (r.flow_value != 0) {
+    fails.push_back("flow delivered but no destination reached");
+  }
+  const auto pts = curve_shape_clauses(r.marginal_cost_curve, r.flow_value, moment, fails);
+  std::vector<std::pair<Amount, Int128>> optimum;
+  if (tier_a) {
+    for (const auto& [x, c] : exhaustive_costs(g, view, srcs, dsts, elig)) optimum.emplace_back(x, c);
+  } else {
+    optimum = independent_curve(g, view, srcs, dsts, elig);
+  }
+  const Amount fmax = optimum.back().first;
+  const Amount top = cap.has_value() ? std::min(*cap, fmax) : fmax;
+  if (r.flow_value != top) fails.push_back("placed differs from min(cap, F_max)");
+  curve_optimum_clause(pts, optimum, std::min(top, r.flow_value),
+                       tier_a ? "the exhaustive optimum" : "the independent solver", fails);
+  return fails;
+}
+
+// The fields in which two kernel plans differ, by name. `with_route` false leaves the route out: a
+// plan built on a larger DAG keeps that DAG as its route but splits over the same members.
+inline std::vector<std::string> plan_differences(const detail::PreparedRoute& got, const detail::PreparedRoute& want,
+                                                 bool with_route = true) {
+  std::vector<std::string> out;
+  auto differ = [&](bool same, const char* name) {
+    if (!same) out.emplace_back(name);
   };
+  differ(got.allocation == want.allocation, "allocation");
+  differ(vec(got.sources) == vec(want.sources), "sources");
+  differ(vec(got.source_positions) == vec(want.source_positions), "source_positions");
+  differ(vec(got.destinations) == vec(want.destinations), "destinations");
+  if (with_route) differ(got.support_edges == want.support_edges, "support_edges");
+  differ(got.forwarding_edges == want.forwarding_edges, "forwarding_edges");
+  differ(got.weights == want.weights, "weights");
+  differ(vec(got.topological_order) == vec(want.topological_order), "topological_order");
+  differ(vec(got.outgoing_begin) == vec(want.outgoing_begin), "outgoing_begin");
+  differ(vec(got.outgoing_end) == vec(want.outgoing_end), "outgoing_end");
+  differ(vec(got.edge_destination_positions) == vec(want.edge_destination_positions), "edge_destination_positions");
+  differ(vec(got.is_destination) == vec(want.is_destination), "is_destination");
+  return out;
+}
 
-  // Helper to add one-to-one connections
-  auto add_one_to_one = [&](int group1_start, int group1_count, int group2_start, double capacity) {
-    for (int i = 0; i < group1_count; ++i) {
-      src.push_back(group1_start + i);
-      dst.push_back(group2_start + i);
-      cap.push_back(capacity);
-      cost.push_back(1);
-    }
+// One record on its own, from its fields alone: `edge_flows` and `edge_drops` hold positive amounts
+// in strictly ascending EdgeId, only a Lossy record has `offered` and drops, and the edges carry
+// the flow. Lossless: every node other than a source or a destination passes on what it
+// receives, and `delivered` is the net inflow of the destinations (the net outflow of the
+// sources). Lossy: a transit node passes on what it receives less what is dropped on the edges
+// it forwards over, `delivered` is still the destinations' net inflow, and what was offered
+// covers what was delivered and dropped (the rest is the source drops). Returns whether the
+// record carries something (delivered or dropped).
+inline bool expect_conserved(const Graph& g, const FlowRecord& r, const std::string& where) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<Amount> in(n, 0), out(n, 0), dropped_out(n, 0);
+  Amount total_drops = 0;
+  for (std::size_t i = 0; i < r.edge_flows.size(); ++i) {
+    const auto [e, x] = r.edge_flows[i];
+    EXPECT_GT(x, 0) << where << " edge " << e;
+    if (i > 0) EXPECT_LT(r.edge_flows[i - 1].first, e) << where;
+    out[static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)])] += x;
+    in[static_cast<std::size_t>(g.edge_destinations()[static_cast<std::size_t>(e)])] += x;
+  }
+  const bool lossy = r.admission == Admission::Lossy;
+  EXPECT_EQ(r.offered.has_value(), lossy) << where;
+  if (!lossy) EXPECT_TRUE(r.edge_drops.empty()) << where;
+  for (std::size_t i = 0; i < r.edge_drops.size(); ++i) {
+    const auto& [e, c] = r.edge_drops[i];
+    EXPECT_EQ(c.hi, 0u) << where;  // the trials' drops stay below 2^64
+    EXPECT_GT(c.lo, 0u) << where << " drop " << e;
+    if (i > 0) EXPECT_LT(r.edge_drops[i - 1].first, e) << where;
+    const auto x = static_cast<Amount>(c.lo);
+    dropped_out[static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)])] += x;
+    total_drops += x;
+  }
+  auto in_set = [](const std::vector<NodeId>& set, std::size_t v) {
+    return std::find(set.begin(), set.end(), static_cast<NodeId>(v)) != set.end();
   };
+  Amount into_destinations = 0, out_of_sources = 0;
+  for (std::size_t v = 0; v < n; ++v) {
+    if (in_set(r.destinations, v)) {
+      into_destinations += in[v] - out[v];
+    } else if (in_set(r.sources, v)) {
+      out_of_sources += out[v] - in[v];
+    } else {
+      EXPECT_EQ(in[v], out[v] + dropped_out[v]) << where << " node " << v;
+    }
+  }
+  EXPECT_EQ(into_destinations, r.delivered) << where;
+  if (lossy) {
+    if (r.offered.has_value() && r.offered->hi == 0) {
+      EXPECT_GE(static_cast<Amount>(r.offered->lo), r.delivered + total_drops) << where;
+    } else {
+      ADD_FAILURE() << where << ": a Lossy record without offered, or offered beyond 2^64";
+    }
+  } else {
+    EXPECT_EQ(out_of_sources, r.delivered) << where;
+  }
+  return r.delivered > 0 || total_drops > 0;
+}
+
+// An independent reference of a tunnel program's forwarding: equal
+// sources inject a total by round robin over the roster (the heads with a tunnel, ascending), each
+// head splits its share by highest averages over its tunnels' weights (ascending index), and the
+// lossless bound is the largest total whose loads fit the capacities with no share lost at a
+// source. Its own round robin and unit-by-unit highest averages: it calls none of the library's
+// apportionment helpers.
+namespace program_reference {
 
-  // Clos1 brick1: T1 (0-3) mesh to T2 (4-7)
-  add_mesh(0, 4, 4, 4, 100.0);
-
-  // Clos1 brick2: T1 (8-11) mesh to T2 (12-15)
-  add_mesh(8, 4, 12, 4, 100.0);
+struct RefTunnel {
+  NodeId head {0};
+  std::vector<EdgeId> edges {};
+  Amount weight {0};
+};
+
+// x over k slots: x / k each, the first x mod k one more.
+inline std::vector<Amount> round_robin(Amount x, std::size_t k) {
+  std::vector<Amount> out(k, 0);
+  for (Amount u = 0; u < x; ++u) ++out[static_cast<std::size_t>(u) % k];
+  return out;
+}
 
-  // Clos1 b1/T2 (4-7) one-to-one to spine (16-19)
-  add_one_to_one(4, 4, 16, 400.0);
-
-  // Clos1 b2/T2 (12-15) one-to-one to spine (20-23)
-  add_one_to_one(12, 4, 20, 400.0);
-
-  // Inter-Clos: Clos1 spine (16-31) one-to-one to Clos2 spine (48-63)
-  add_one_to_one(16, 16, 48, 400.0);
-
-  // Clos2 spine (48-63) to b1/T2 (36-39) - only first 4 spines connect
-  add_one_to_one(48, 4, 36, 400.0);
-
-  // Clos2 spine (52-55) to b2/T2 (44-47)
-  add_one_to_one(52, 4, 44, 400.0);
-
-  // Clos2 brick1: T2 (36-39) mesh to T1 (32-35)
-  add_mesh(36, 4, 32, 4, 100.0);
-
-  // Clos2 brick2: T2 (44-47) mesh to T1 (40-43)
-  add_mesh(44, 4, 40, 4, 100.0);
-
-  return StrictMultiDiGraph::from_arrays(num_nodes, src, dst, cap, cost);
-}
-
-inline StrictMultiDiGraph make_triangle_topology() {
-  /**
-   * Triangle topology from NetGraph solver tests.
-   * Used in test_maxflow_api.py::_triangle_network()
-   *
-   * Topology:
-   *   A(0) -> B(1) (cap 2)
-   *   B(1) -> C(2) (cap 1)
-   *   A(0) -> C(2) (cap 1)
-   *
-   * Expected max flow A->C: 2.0 (1 direct + 1 via B)
-   */
-  std::int32_t src_arr[3] = {0, 1, 0};
-  std::int32_t dst_arr[3] = {1, 2, 2};
-  double cap_arr[3] = {2.0, 1.0, 1.0};
-  std::int64_t cost_arr[3] = {1, 1, 1};
-
-  return StrictMultiDiGraph::from_arrays(3,
-    std::span(src_arr, 3), std::span(dst_arr, 3),
-    std::span(cap_arr, 3), std::span(cost_arr, 3));
-}
-
-inline StrictMultiDiGraph make_simple_parallel_paths_topology() {
-  /**
-   * Simple network with two disjoint parallel paths.
-   * From NetGraph solver tests: test_maxflow_api.py::_simple_network()
-   *
-   * Topology:
-   *   S(0) -> A(1) (cap 1) -> T(3) (cap 1)
-   *   S(0) -> B(2) (cap 1) -> T(3) (cap 1)
-   *
-   * Expected max flow S->T: 2.0
-   */
-  std::int32_t src_arr[4] = {0, 1, 0, 2};
-  std::int32_t dst_arr[4] = {1, 3, 2, 3};
-  double cap_arr[4] = {1.0, 1.0, 1.0, 1.0};
-  std::int64_t cost_arr[4] = {1, 1, 1, 1};
-
-  return StrictMultiDiGraph::from_arrays(4,
-    std::span(src_arr, 4), std::span(dst_arr, 4),
-    std::span(cap_arr, 4), std::span(cost_arr, 4));
-}
-
-// Assertion helpers
-inline void expect_csr_valid(const StrictMultiDiGraph& g) {
-  auto row = g.row_offsets_view();
-  auto col = g.col_indices_view();
-  auto aei = g.adj_edge_index_view();
-  auto edge_src = g.edge_src_view();
-  auto edge_dst = g.edge_dst_view();
-  const auto M = static_cast<std::size_t>(g.num_edges());
-  const auto N = static_cast<std::size_t>(g.num_nodes());
-
-  // --- Forward CSR structural checks ---
-
-  // Offsets should be monotonic
-  EXPECT_EQ(row.size(), N + 1);
-  for (std::size_t i = 0; i < row.size() - 1; ++i) {
-    EXPECT_LE(row[i], row[i + 1]) << "Row offsets not monotonic at " << i;
-  }
-
-  // Total edges match
-  EXPECT_EQ(static_cast<std::size_t>(row[row.size() - 1]), M);
-  EXPECT_EQ(col.size(), M);
-  EXPECT_EQ(aei.size(), M);
+// x units one at a time, each to the slot with the largest w / (a + 1) (ties: the lower slot);
+// slots of weight 0 get nothing (x must be 0 when every weight is 0).
+inline std::vector<Amount> highest_averages(Amount x, const std::vector<Amount>& w) {
+  std::vector<Amount> a(w.size(), 0);
+  for (Amount u = 0; u < x; ++u) {
+    std::size_t best = w.size();
+    for (std::size_t i = 0; i < w.size(); ++i) {
+      if (w[i] <= 0) continue;
+      if (best == w.size() || Int128(w[i]) * (a[best] + 1) > Int128(w[best]) * (a[i] + 1)) best = i;
+    }
+    if (best == w.size()) return {};
+    ++a[best];
+  }
+  return a;
+}
 
-  // All column indices and edge indices in range
-  for (std::size_t i = 0; i < col.size(); ++i) {
-    EXPECT_GE(col[i], 0) << "Invalid column index at " << i;
-    EXPECT_LT(col[i], g.num_nodes()) << "Column index out of range at " << i;
-    EXPECT_GE(aei[i], 0) << "Invalid edge index at " << i;
-    EXPECT_LT(aei[i], g.num_edges()) << "Edge index out of range at " << i;
-  }
-
-  // --- Forward CSR semantic checks ---
-
-  // Bijection: every edge appears exactly once in the CSR
-  std::vector<int> edge_count(M, 0);
-  for (std::size_t u = 0; u < N; ++u) {
-    auto s = static_cast<std::size_t>(row[u]);
-    auto e = static_cast<std::size_t>(row[u + 1]);
-    for (std::size_t j = s; j < e; ++j) {
-      auto eid = static_cast<std::size_t>(aei[j]);
-      ASSERT_LT(eid, M) << "Edge index out of range at CSR pos " << j;
-      edge_count[eid]++;
-
-      // Source consistency: edge must originate from node u
-      EXPECT_EQ(static_cast<std::size_t>(edge_src[eid]), u)
-          << "Forward CSR: edge " << eid << " in node " << u
-          << "'s adjacency has src=" << edge_src[eid];
-
-      // Destination consistency: col_indices must match edge destination
-      EXPECT_EQ(col[j], edge_dst[eid])
-          << "Forward CSR: col_indices[" << j << "]=" << col[j]
-          << " doesn't match edge_dst[" << eid << "]=" << edge_dst[eid];
-    }
-  }
-  for (std::size_t eid = 0; eid < M; ++eid) {
-    EXPECT_EQ(edge_count[eid], 1)
-        << "Edge " << eid << " appears " << edge_count[eid]
-        << " times in forward CSR (expected exactly 1)";
-  }
-
-  // --- Reverse CSR checks ---
-  auto in_row = g.in_row_offsets_view();
-  auto in_col = g.in_col_indices_view();
-  auto in_aei = g.in_adj_edge_index_view();
-
-  EXPECT_EQ(in_row.size(), N + 1);
-  for (std::size_t i = 0; i < in_row.size() - 1; ++i) {
-    EXPECT_LE(in_row[i], in_row[i + 1]) << "Reverse row offsets not monotonic at " << i;
-  }
-  EXPECT_EQ(static_cast<std::size_t>(in_row[in_row.size() - 1]), M);
-  EXPECT_EQ(in_col.size(), M);
-  EXPECT_EQ(in_aei.size(), M);
-
-  // Bijection and consistency for reverse CSR
-  std::vector<int> rev_edge_count(M, 0);
-  for (std::size_t v = 0; v < N; ++v) {
-    auto s = static_cast<std::size_t>(in_row[v]);
-    auto e = static_cast<std::size_t>(in_row[v + 1]);
-    for (std::size_t j = s; j < e; ++j) {
-      auto eid = static_cast<std::size_t>(in_aei[j]);
-      ASSERT_LT(eid, M) << "Reverse edge index out of range at CSR pos " << j;
-      rev_edge_count[eid]++;
-
-      // Destination consistency: edge must point to node v
-      EXPECT_EQ(static_cast<std::size_t>(edge_dst[eid]), v)
-          << "Reverse CSR: edge " << eid << " in node " << v
-          << "'s incoming list has dst=" << edge_dst[eid];
-
-      // Source consistency: in_col_indices must match edge source
-      EXPECT_EQ(in_col[j], edge_src[eid])
-          << "Reverse CSR: in_col_indices[" << j << "]=" << in_col[j]
-          << " doesn't match edge_src[" << eid << "]=" << edge_src[eid];
-    }
-  }
-  for (std::size_t eid = 0; eid < M; ++eid) {
-    EXPECT_EQ(rev_edge_count[eid], 1)
-        << "Edge " << eid << " appears " << rev_edge_count[eid]
-        << " times in reverse CSR (expected exactly 1)";
-  }
-}
-
-inline void expect_pred_dag_valid(const PredDAG& dag, int num_nodes) {
-  EXPECT_EQ(dag.parent_offsets.size(), static_cast<std::size_t>(num_nodes + 1));
-
-  // Offsets monotonic
-  for (std::size_t i = 0; i < dag.parent_offsets.size() - 1; ++i) {
-    EXPECT_LE(dag.parent_offsets[i], dag.parent_offsets[i + 1]);
-  }
-
-  auto total = static_cast<std::size_t>(dag.parent_offsets.back());
-  EXPECT_EQ(dag.parents.size(), total);
-  EXPECT_EQ(dag.via_edges.size(), total);
-
-  // Node IDs in range
-  for (auto p : dag.parents) {
-    EXPECT_GE(p, 0);
-    EXPECT_LT(p, num_nodes);
-  }
-}
-
-// Extended PredDAG validation that also checks semantic correctness against a graph.
-// Verifies that each entry refers to an actual edge from parent to node, and that
-// distances are consistent (dist[v] == dist[parent] + edge_cost).
-inline void expect_pred_dag_semantically_valid(const StrictMultiDiGraph& g,
-                                               const PredDAG& dag,
-                                               const std::vector<Cost>& dist) {
-  const auto N = g.num_nodes();
-  const auto edge_src = g.edge_src_view();
-  const auto edge_dst = g.edge_dst_view();
-  const auto edge_cost = g.cost_view();
-
-  expect_pred_dag_valid(dag, N);
-
-  for (std::int32_t v = 0; v < N; ++v) {
-    auto s = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v)]);
-    auto e = static_cast<std::size_t>(dag.parent_offsets[static_cast<std::size_t>(v) + 1]);
-    for (std::size_t i = s; i < e; ++i) {
-      auto parent = dag.parents[i];
-      auto eid = static_cast<std::size_t>(dag.via_edges[i]);
-      ASSERT_LT(eid, static_cast<std::size_t>(g.num_edges()));
-      // Edge must go from parent -> v
-      EXPECT_EQ(edge_src[eid], parent)
-          << "Node " << v << ": via_edge " << eid << " src mismatch";
-      EXPECT_EQ(edge_dst[eid], v)
-          << "Node " << v << ": via_edge " << eid << " dst mismatch";
-      // Distance consistency
-      auto d_v = dist[static_cast<std::size_t>(v)];
-      auto d_p = dist[static_cast<std::size_t>(parent)];
-      if (d_v < std::numeric_limits<Cost>::max() && d_p < std::numeric_limits<Cost>::max()) {
-        EXPECT_EQ(d_v, d_p + edge_cost[eid])
-            << "Distance inconsistency at node " << v;
+// The roster: the heads with a tunnel, ascending.
+inline std::vector<NodeId> roster(const std::vector<RefTunnel>& t) {
+  std::set<NodeId> heads;
+  for (const auto& x : t) heads.insert(x.head);
+  return {heads.begin(), heads.end()};
+}
+
+// Per tunnel its amount of the total x; nullopt when a positive head share has no tunnel of
+// positive weight (lost at the source).
+inline std::optional<std::vector<Amount>> tunnel_amounts(Amount x, const std::vector<RefTunnel>& t) {
+  const auto heads = roster(t);
+  const auto shares = round_robin(x, heads.size());
+  std::vector<Amount> out(t.size(), 0);
+  for (std::size_t h = 0; h < heads.size(); ++h) {
+    std::vector<std::size_t> ids;
+    std::vector<Amount> w;
+    for (std::size_t i = 0; i < t.size(); ++i) {
+      if (t[i].head == heads[h]) {
+        ids.push_back(i);
+        w.push_back(t[i].weight);
       }
     }
+    const auto split = highest_averages(shares[h], w);
+    if (split.empty() && shares[h] > 0) return std::nullopt;
+    for (std::size_t j = 0; j < split.size(); ++j) out[ids[j]] = split[j];
+  }
+  return out;
+}
+
+// The per-edge loads of per-tunnel amounts.
+inline std::vector<Amount> loads(const Graph& g, const std::vector<RefTunnel>& t, const std::vector<Amount>& amounts) {
+  std::vector<Amount> out(static_cast<std::size_t>(g.num_edges()), 0);
+  for (std::size_t i = 0; i < t.size(); ++i) {
+    for (EdgeId e : t[i].edges) out[static_cast<std::size_t>(e)] += amounts[i];
+  }
+  return out;
+}
+
+inline bool fits(const Graph& g, const std::vector<RefTunnel>& t, Amount x) {
+  const auto a = tunnel_amounts(x, t);
+  if (!a.has_value()) return false;
+  const auto l = loads(g, t, *a);
+  for (std::size_t e = 0; e < l.size(); ++e) {
+    if (l[e] > g.edge_capacity_units()[e]) return false;
   }
+  return true;
+}
+
+// The largest total that fits, scanning up from 0 (the loads only grow with the total); a total
+// above the sum of the capacities never fits.
+inline Amount lossless_bound(const Graph& g, const std::vector<RefTunnel>& t) {
+  Amount limit = 1;
+  for (Amount c : g.edge_capacity_units()) limit += c;
+  Amount x = 0;
+  while (x < limit && fits(g, t, x + 1)) ++x;
+  return x;
 }
 
-// FlowSummary validation helpers
-inline void validate_capacity_constraints(const StrictMultiDiGraph& g, const FlowSummary& summary) {
-  ASSERT_EQ(summary.edge_flows.size(), static_cast<std::size_t>(g.num_edges()))
-      << "Edge flow vector size mismatch";
+} // namespace program_reference
+
+// An independent reference of T1: the setup by brute force over the
+// simple paths of small graphs and the lossless bound with the policy's whole roster. It calls
+// none of the library's searches or apportionment helpers (its own round robin, Bellman-Ford
+// distances, exact comparisons in Int128).
+namespace t1_reference {
+
+struct Selection {
+  RouteTieBreak tie_break {RouteTieBreak::FewerHops};
+  bool parallel_edges {true};
+  [[nodiscard]] bool prefer() const { return tie_break != RouteTieBreak::FewerHops; }
+};
+
+struct RefTunnel {
+  NodeId head {0};
+  std::size_t slot {0};
+  Amount request {0};
+  TunnelStatus status {TunnelStatus::Up};
+  std::vector<EdgeId> path {};  // walk order; empty when down
+  Cost cost {0};
+};
 
-  auto caps = g.capacity_view();
-  for (std::size_t i = 0; i < summary.edge_flows.size(); ++i) {
-    EXPECT_GE(summary.edge_flows[i], 0.0)
-        << "Edge " << i << " has negative flow: " << summary.edge_flows[i];
-    EXPECT_LE(summary.edge_flows[i], caps[i] + 1e-9)
-        << "Edge " << i << " exceeds capacity: flow=" << summary.edge_flows[i]
-        << " cap=" << caps[i];
+// RR(x, k, i) = x // k + [i < x % k].
+inline Amount rr(Amount x, std::int64_t k, std::int64_t i) { return x / k + (i < x % k ? 1 : 0); }
+
+// The sources that reach an allowed destination over allowed edges (capacity ignored), ascending.
+inline std::vector<NodeId> roster(const Graph& g, const Eligibility* elig, const std::vector<NodeId>& sources,
+                                  const std::vector<NodeId>& dests) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<char> is_dst(n, 0);
+  for (NodeId d : dests) {
+    if (elig == nullptr || elig->allows_node(d)) is_dst[static_cast<std::size_t>(d)] = 1;
+  }
+  std::vector<NodeId> out;
+  for (NodeId s : sources) {
+    if (elig != nullptr && !elig->allows_node(s)) continue;
+    std::vector<char> seen(n, 0);
+    std::vector<NodeId> stack {s};
+    seen[static_cast<std::size_t>(s)] = 1;
+    bool reached = false;
+    while (!stack.empty() && !reached) {
+      const NodeId u = stack.back();
+      stack.pop_back();
+      for (EdgeId e = 0; e < g.num_edges(); ++e) {
+        if (g.edge_sources()[static_cast<std::size_t>(e)] != u || (elig != nullptr && !elig->allows_edge(e))) continue;
+        const NodeId w = g.edge_destinations()[static_cast<std::size_t>(e)];
+        if (is_dst[static_cast<std::size_t>(w)] != 0) reached = true;
+        if (seen[static_cast<std::size_t>(w)] == 0) {
+          seen[static_cast<std::size_t>(w)] = 1;
+          stack.push_back(w);
+        }
+      }
+    }
+    if (reached) out.push_back(s);
   }
+  return out;
 }
 
-inline void validate_flow_conservation(const StrictMultiDiGraph& g, const FlowSummary& summary,
-                                       NodeId src, NodeId dst) {
-  auto row = g.row_offsets_view();
-  auto aei = g.adj_edge_index_view();
-  auto in_row = g.in_row_offsets_view();
-  auto in_aei = g.in_adj_edge_index_view();
+// The pool baseline c0: the smallest static distance from a roster head to an allowed destination
+// over allowed edges, every capacity (Bellman-Ford).
+inline Cost pool_baseline(const Graph& g, const Eligibility* elig, const std::vector<NodeId>& heads,
+                          const std::vector<NodeId>& dests) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  constexpr Cost kInf = std::numeric_limits<Cost>::max();
+  Cost best = kInf;
+  for (NodeId h : heads) {
+    std::vector<Cost> d(n, kInf);
+    d[static_cast<std::size_t>(h)] = 0;
+    for (std::size_t round = 0; round < n; ++round) {
+      for (EdgeId e = 0; e < g.num_edges(); ++e) {
+        if (elig != nullptr && !elig->allows_edge(e)) continue;
+        const auto u = static_cast<std::size_t>(g.edge_sources()[static_cast<std::size_t>(e)]);
+        const auto w = static_cast<std::size_t>(g.edge_destinations()[static_cast<std::size_t>(e)]);
+        if (d[u] == kInf) continue;
+        d[w] = std::min(d[w], d[u] + g.edge_costs()[static_cast<std::size_t>(e)]);
+      }
+    }
+    for (NodeId t : dests) {
+      if (elig == nullptr || elig->allows_node(t)) best = std::min(best, d[static_cast<std::size_t>(t)]);
+    }
+  }
+  return best;
+}
 
-  for (std::int32_t u = 0; u < g.num_nodes(); ++u) {
-    if (u == src || u == dst) continue;  // Skip source and sink
+// cost <= (n / d) * base exactly, for costs in [0, 2^63) and a factor n / d >= 1: cost * d <= n * base
+// in the tests' own Int128 (each product below 2^126).
+inline bool stretch_admits(Cost cost, Cost base, const CostStretch& f) {
+  return Int128(cost) * Int128(f.denominator()) <= Int128(base) * Int128(f.numerator());
+}
 
-    double outflow = 0.0;
-    for (std::size_t j = row[u]; j < row[u + 1]; ++j) {
-      outflow += summary.edge_flows[aei[j]];
+// A HIGHER_* tie score as the exact rational num / den (HIGHER_HEADROOM: U / C, 0 on an edge of
+// capacity 0).
+inline std::pair<Amount, Amount> priority(const Graph& g, RouteTieBreak p, const std::vector<Amount>& U, EdgeId e) {
+  const auto ei = static_cast<std::size_t>(e);
+  const Amount c = g.edge_capacity_units()[ei];
+  if (p == RouteTieBreak::HigherAvailableCapacity) return {U[ei], 1};
+  if (p == RouteTieBreak::HigherCapacity) return {c, 1};
+  return c == 0 ? std::pair<Amount, Amount> {0, 1} : std::pair<Amount, Amount> {U[ei], c};
+}
+inline int compare(std::pair<Amount, Amount> a, std::pair<Amount, Amount> b) {
+  const Int128 l = Int128(a.first) * b.second;
+  const Int128 r = Int128(b.first) * a.second;
+  return l < r ? -1 : l > r ? 1 : 0;
+}
+
+// T1's setup for the roster `heads` (ascending) on the view U (consumed).
+inline std::vector<RefTunnel> setup(const Graph& g, const Eligibility* elig, const std::vector<NodeId>& heads,
+                                    const std::vector<NodeId>& dests, const Selection& sel,
+                                    const std::optional<CostCeiling>& ceiling, Amount minimum, Amount D, std::int64_t N,
+                                    std::vector<Amount> U) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<char> is_dst(n, 0);
+  for (NodeId d : dests) {
+    if (elig == nullptr || elig->allows_node(d)) is_dst[static_cast<std::size_t>(d)] = 1;
+  }
+  const Cost c0 = pool_baseline(g, elig, heads, dests);
+  const auto H = static_cast<std::int64_t>(heads.size());
+  std::vector<RefTunnel> out;
+  for (std::int64_t j = 0; j < N; ++j) {
+    for (std::int64_t i = 0; i < H; ++i) {
+      RefTunnel t;
+      t.head = heads[static_cast<std::size_t>(i)];
+      t.slot = static_cast<std::size_t>(i);
+      t.request = rr(rr(D, H, i), N, j);
+      const Amount threshold = std::max(t.request, minimum);
+      // The filtered member graph, then one member per (u, v) without parallel_edges.
+      std::vector<EdgeId> usable;
+      for (EdgeId e = 0; e < g.num_edges(); ++e) {
+        if (elig != nullptr && !elig->allows_edge(e)) continue;
+        if (U[static_cast<std::size_t>(e)] < threshold) continue;
+        usable.push_back(e);
+      }
+      if (!sel.parallel_edges) {
+        std::map<std::pair<NodeId, NodeId>, EdgeId> pick;
+        for (EdgeId e : usable) {
+          const auto key = std::pair {g.edge_sources()[static_cast<std::size_t>(e)], g.edge_destinations()[static_cast<std::size_t>(e)]};
+          const auto it = pick.find(key);
+          if (it == pick.end()) {
+            pick.emplace(key, e);
+            continue;
+          }
+          const EdgeId cur = it->second;
+          const Cost ce = g.edge_costs()[static_cast<std::size_t>(e)];
+          const Cost cc = g.edge_costs()[static_cast<std::size_t>(cur)];
+          if (ce < cc || (ce == cc && sel.prefer() && compare(priority(g, sel.tie_break, U, e), priority(g, sel.tie_break, U, cur)) > 0)) {
+            it->second = e;
+          }
+        }
+        usable.clear();
+        for (const auto& [key, e] : pick) usable.push_back(e);
+        std::sort(usable.begin(), usable.end());
+      }
+      // Every simple path from the head that ends at the first destination it meets.
+      std::vector<std::vector<EdgeId>> found;
+      std::vector<EdgeId> walk;
+      std::vector<char> on(n, 0);
+      std::function<void(NodeId)> dfs = [&](NodeId u) {
+        on[static_cast<std::size_t>(u)] = 1;
+        for (EdgeId e : usable) {
+          if (g.edge_sources()[static_cast<std::size_t>(e)] != u) continue;
+          const NodeId w = g.edge_destinations()[static_cast<std::size_t>(e)];
+          if (on[static_cast<std::size_t>(w)] != 0) continue;
+          walk.push_back(e);
+          if (is_dst[static_cast<std::size_t>(w)] != 0) {
+            found.push_back(walk);
+          } else {
+            dfs(w);
+          }
+          walk.pop_back();
+        }
+        on[static_cast<std::size_t>(u)] = 0;
+      };
+      dfs(t.head);
+      // The single-path order: cost, the bottleneck score (a HIGHER_* tie_break, larger first),
+      // hops, the EdgeId sequence.
+      const std::vector<EdgeId>* best = nullptr;
+      Cost best_cost = 0;
+      std::pair<Amount, Amount> best_bottleneck {0, 1};
+      for (const auto& p : found) {
+        Cost cost = 0;
+        for (EdgeId e : p) cost += g.edge_costs()[static_cast<std::size_t>(e)];
+        std::pair<Amount, Amount> bottleneck {std::numeric_limits<Amount>::max(), 1};
+        for (EdgeId e : p) {
+          const auto pr = priority(g, sel.tie_break, U, e);
+          if (compare(pr, bottleneck) < 0) bottleneck = pr;
+        }
+        bool better = best == nullptr;
+        if (!better && cost != best_cost) better = cost < best_cost;
+        else if (!better && sel.prefer() && compare(bottleneck, best_bottleneck) != 0) better = compare(bottleneck, best_bottleneck) > 0;
+        else if (!better && p.size() != best->size()) better = p.size() < best->size();
+        else if (!better) better = p < *best;
+        if (better) {
+          best = &p;
+          best_cost = cost;
+          best_bottleneck = bottleneck;
+        }
+      }
+      if (best == nullptr) {
+        t.status = TunnelStatus::InsufficientBandwidth;
+      } else if (ceiling.has_value() && (std::holds_alternative<AbsoluteCost>(*ceiling)
+                                             ? best_cost > std::get<AbsoluteCost>(*ceiling).cost
+                                             : !stretch_admits(best_cost, c0, std::get<CostStretch>(*ceiling)))) {
+        t.status = TunnelStatus::CostCeilingExceeded;
+      } else {
+        t.path = *best;
+        t.cost = best_cost;
+        for (EdgeId e : t.path) U[static_cast<std::size_t>(e)] -= t.request;
+      }
+      out.push_back(std::move(t));
     }
+  }
+  return out;
+}
 
-    double inflow = 0.0;
-    for (std::size_t j = in_row[u]; j < in_row[u + 1]; ++j) {
-      inflow += summary.edge_flows[in_aei[j]];
+// The lossless bound of the tunnels on the free capacity V: the largest total whose round
+// robin over the H heads, then over each head's up tunnels in index order, loads no edge above V
+// and gives no positive share to a head without an up tunnel (scanning up from 0).
+inline Amount lossless_bound(std::size_t H, const std::vector<RefTunnel>& tunnels, const std::vector<Amount>& V) {
+  Amount limit = 1;
+  for (Amount c : V) limit += c;
+  auto fits = [&](Amount x) {
+    std::vector<Amount> load(V.size(), 0);
+    for (std::size_t h = 0; h < H; ++h) {
+      const Amount share = rr(x, static_cast<std::int64_t>(H), static_cast<std::int64_t>(h));
+      std::vector<const RefTunnel*> up;
+      for (const auto& t : tunnels) {
+        if (t.slot == h && t.status == TunnelStatus::Up) up.push_back(&t);
+      }
+      if (share > 0 && up.empty()) return false;
+      for (std::size_t k = 0; k < up.size(); ++k) {
+        const Amount part = rr(share, static_cast<std::int64_t>(up.size()), static_cast<std::int64_t>(k));
+        for (EdgeId e : up[k]->path) load[static_cast<std::size_t>(e)] += part;
+      }
     }
+    for (std::size_t e = 0; e < V.size(); ++e) {
+      if (load[e] > V[e]) return false;
+    }
+    return true;
+  };
+  Amount x = 0;
+  while (x < limit && fits(x + 1)) ++x;
+  return x;
+}
+
+} // namespace t1_reference
+
+// An independent reference of T2 for small graphs: every multiset of k
+// simple paths per live head (a count vector x) by brute force; U = the largest
+// min over used edges of floor(V / x), s* = the largest min of V / x (an exact fraction), and the
+// minimum (J, Phi) over the vectors with x u <= V. It calls none of the library's flow, search or
+// apportionment code (its own path enumeration, Int128 arithmetic).
+namespace t2_reference {
+
+// Every simple path from `src` that ends at the first destination it meets, over the allowed edges
+// that do not leave a destination.
+inline std::vector<std::vector<EdgeId>> paths(const Graph& g, const Eligibility* elig, NodeId src,
+                                              const std::vector<char>& is_dst) {
+  const auto n = static_cast<std::size_t>(g.num_nodes());
+  std::vector<std::vector<EdgeId>> found;
+  std::vector<EdgeId> walk;
+  std::vector<char> on(n, 0);
+  std::function<void(NodeId)> dfs = [&](NodeId u) {
+    on[static_cast<std::size_t>(u)] = 1;
+    for (EdgeId e = 0; e < g.num_edges(); ++e) {
+      const auto ei = static_cast<std::size_t>(e);
+      if (g.edge_sources()[ei] != u) continue;
+      const NodeId w = g.edge_destinations()[ei];
+      if (elig != nullptr && (!elig->allows_edge(e) || !elig->allows_node(u) || !elig->allows_node(w))) continue;
+      if (on[static_cast<std::size_t>(w)] != 0) continue;
+      walk.push_back(e);
+      if (is_dst[static_cast<std::size_t>(w)] != 0) {
+        found.push_back(walk);
+      } else {
+        dfs(w);
+      }
+      walk.pop_back();
+    }
+    on[static_cast<std::size_t>(u)] = 0;
+  };
+  if (is_dst[static_cast<std::size_t>(src)] == 0) dfs(src);
+  return found;
+}
+
+struct Result {
+  std::vector<NodeId> live {};
+  Amount U {0};
+  std::pair<Amount, Amount> fluid {0, 1};  // reduced
+  std::optional<std::pair<Int128, Int128>> best {};  // the minimum (J, Phi) at u
+};
 
-    EXPECT_NEAR(inflow, outflow, 1e-9)
-        << "Flow not conserved at node " << u
-        << ": inflow=" << inflow << " outflow=" << outflow;
+// floor(2^32 (B - V + j u) / B).
+inline Int128 slot_price(Amount B, Amount V, Amount j, Amount u) {
+  return (Int128(B - V + j * u) * Int128(std::int64_t {1} << 32)) / Int128(B);
+}
+
+// T2 at count k for the roster `heads` (ascending) on V; `u_of(U)` gives the working size at U.
+inline Result solve(const Graph& g, const Eligibility* elig, const std::vector<NodeId>& heads,
+                    const std::vector<NodeId>& dests, std::int64_t k, const std::vector<Amount>& V,
+                    const std::function<Amount(Amount)>& u_of, bool headroom) {
+  std::vector<char> is_dst(static_cast<std::size_t>(g.num_nodes()), 0);
+  for (NodeId d : dests) {
+    if (elig == nullptr || elig->allows_node(d)) is_dst[static_cast<std::size_t>(d)] = 1;
   }
+  Result out;
+  std::vector<std::vector<std::vector<EdgeId>>> per;
+  for (NodeId h : heads) {
+    auto ps = paths(g, elig, h, is_dst);
+    const bool live = std::any_of(ps.begin(), ps.end(), [&](const auto& p) {
+      return std::all_of(p.begin(), p.end(), [&](EdgeId e) { return V[static_cast<std::size_t>(e)] >= 1; });
+    });
+    if (!live) continue;
+    out.live.push_back(h);
+    per.push_back(std::move(ps));
+  }
+  if (out.live.empty()) return out;
+  // Every count vector: per live head a nondecreasing choice of k path indices.
+  std::vector<std::vector<Amount>> xs;
+  std::vector<Amount> x(static_cast<std::size_t>(g.num_edges()), 0);
+  std::function<void(std::size_t, std::int64_t, std::size_t)> pick = [&](std::size_t h, std::int64_t left,
+                                                                         std::size_t from) {
+    if (h == per.size()) {
+      xs.push_back(x);
+      return;
+    }
+    if (left == 0) {
+      pick(h + 1, k, 0);
+      return;
+    }
+    for (std::size_t i = from; i < per[h].size(); ++i) {
+      for (EdgeId e : per[h][i]) ++x[static_cast<std::size_t>(e)];
+      pick(h, left - 1, i);
+      for (EdgeId e : per[h][i]) --x[static_cast<std::size_t>(e)];
+    }
+  };
+  pick(0, k, 0);
+  // U and s*: the largest common size over the vectors (fractions compared exactly).
+  bool have = false;
+  for (const auto& c : xs) {
+    Amount size = std::numeric_limits<Amount>::max();
+    std::pair<Amount, Amount> frac {1, 0};  // +inf
+    for (std::size_t e = 0; e < c.size(); ++e) {
+      if (c[e] == 0) continue;
+      size = std::min(size, V[e] / c[e]);
+      if (frac.second == 0 || Int128(V[e]) * frac.second < Int128(frac.first) * c[e]) frac = {V[e], c[e]};
+    }
+    out.U = std::max(out.U, size);
+    if (!have || Int128(frac.first) * out.fluid.second > Int128(out.fluid.first) * frac.second) {
+      out.fluid = frac;
+      have = true;
+    }
+  }
+  const Amount d = std::gcd(out.fluid.first, out.fluid.second);
+  out.fluid = {out.fluid.first / d, out.fluid.second / d};
+  if (out.U == 0) return out;
+  const Amount u = u_of(out.U);
+  for (const auto& c : xs) {
+    bool fits = true;
+    Int128 J = 0;
+    Int128 phi = 0;
+    for (std::size_t e = 0; e < c.size(); ++e) {
+      if (c[e] == 0) continue;
+      fits = fits && c[e] * u <= V[e];
+      J = J + Int128(g.edge_costs()[e]) * c[e];
+      const Amount B = g.edge_capacity_units()[e];
+      for (Amount j = 1; headroom && B > 0 && j <= c[e]; ++j) phi = phi + slot_price(B, V[e], j, u);
+    }
+    if (!fits) continue;
+    if (!out.best.has_value() || std::pair {J, phi} < *out.best) out.best = std::pair {J, phi};
+  }
+  return out;
 }
 
+} // namespace t2_reference
+
 } // namespace netgraph::core::test
diff --git a/tests/cpp/weighted_source_tests.cpp b/tests/cpp/weighted_source_tests.cpp
new file mode 100644
index 0000000..d94b2d0
--- /dev/null
+++ b/tests/cpp/weighted_source_tests.cpp
@@ -0,0 +1,534 @@
+// Prescribed source quotas and replay. Expected examples and small exhaustive
+// flows are independent of production apportionment and flow-core helpers.
+#include <gtest/gtest.h>
+
+#include <functional>
+#include <future>
+#include <numeric>
+
+#include "netgraph/core/detail/forwarding.hpp"
+#include "netgraph/core/detail/int128.hpp"
+#include "netgraph/core/detail/policy_engine.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "state_comparators.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+const OutputOptions all {true, true, true, true, true};
+FlowPolicyConfig weighted(std::vector<Amount> w, std::shared_ptr<const PredecessorDAG> support = {}) {
+  CentralizedTE model(SourceAllocation::Weighted);
+  model.source_weights = std::make_shared<const std::vector<Amount>>(std::move(w));
+  model.support = std::move(support);
+  return {.routing = std::move(model)};
+}
+std::shared_ptr<const Graph> witness(bool coarse = false) {
+  const Amount q = coarse ? 1 : 8;
+  return std::make_shared<const Graph>(make_graph(6, {{0,2,2*q,1}, {1,2,q,1}, {1,3,q,2},
+      {2,3,q,1}, {2,4,q,1}, {3,5,q,1}, {4,5,q,1}}));
+}
+std::vector<Amount> sources(const PlacementResult& r) {
+  std::vector<Amount> out;
+  for (const auto& row : r.by_source) out.push_back(row.delivered);
+  return out;
+}
+std::string refused(const std::function<void()>& call) {
+  try { call(); } catch (const std::invalid_argument& e) { return e.what(); }
+  return "no error";
+}
+// One-unit-at-a-time priority oracle for small totals; test integer arithmetic
+// is independent of the library's portable multiplication/division.
+std::vector<Amount> sequential(Amount t, const std::vector<Amount>& w) {
+  std::vector<Amount> a(w.size());
+  if (std::none_of(w.begin(), w.end(), [](Amount x) { return x != 0; })) return a;
+  for (Amount unit = 0; unit < t; ++unit) {
+    std::size_t best = 0;
+    for (std::size_t j = 1; j < w.size(); ++j) {
+      if (UInt128(w[j]) * UInt128(a[best] + 1) > UInt128(w[best]) * UInt128(a[j] + 1)) best = j;
+    }
+    ++a[best];
+  }
+  return a;
+}
+} // namespace
+
+TEST(WeightedSources, WitnessAndDeclaredReplayOnDenseAndSupportPaths) {
+  for (bool support : {false, true}) {
+    const auto g = witness();
+    const auto cfg = weighted({2,1,0,0,0,0}, support ? dag_of(*g, {0,1,2,3,4,5,6}) : nullptr);
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger, v({0,1}), v({5}), cfg);
+    const auto before = ledger_state(ledger);
+    const auto r = p.evaluate(std::nullopt, {}, all);
+    expect_same(ledger_state(ledger), before, "evaluate is read only");
+    EXPECT_FALSE(p.program());
+    expect_same(p.replace(std::nullopt, {}, all), r, "evaluate/replace");
+    EXPECT_EQ(r.delivered, 16);
+    EXPECT_FALSE(r.call_undelivered);
+    EXPECT_EQ(r.by_tunnel, (std::vector<TunnelFlow>{{0,0,TunnelStatus::Up,{0,3},3,{}},
+        {1,0,TunnelStatus::Up,{0,8},8,{}},{2,1,TunnelStatus::Up,{0,5},5,{}}}));
+    EXPECT_TRUE(r.routes_changed); EXPECT_TRUE(r.weights_changed); EXPECT_FALSE(r.reservations_changed);
+    EXPECT_EQ(sources(r), (std::vector<Amount>{11,5}));
+    EXPECT_EQ(r.total_cost, (Counter128{0,48}));
+    EXPECT_EQ(r.edge_flows, (std::optional<std::vector<Amount>>{{11,0,5,3,8,8,8}}));
+    ASSERT_TRUE(r.program->source_weights());
+    EXPECT_EQ(*r.program->source_weights(), (std::vector<std::pair<NodeId,Amount>>{{0,2},{1,1}}));
+    ASSERT_EQ(r.program->tunnels().size(), 3U);
+    const std::vector<std::vector<EdgeId>> paths {{0,3,5},{0,4,6},{2,5}};
+    const Amount amounts[] = {3,8,5};
+    for (std::size_t i = 0; i < paths.size(); ++i) {
+      const auto& t = r.program->tunnels()[i];
+      EXPECT_EQ(t.entry_id, static_cast<std::int32_t>(i));
+      EXPECT_EQ(t.head, i == 2 ? 1 : 0);
+      EXPECT_EQ(t.edges, paths[i]);
+      EXPECT_EQ(t.weight, amounts[i]);
+      EXPECT_EQ(t.path_cost, 3);
+    }
+    EXPECT_FALSE(r.plan); EXPECT_FALSE(r.min_cut); EXPECT_FALSE(r.marginal_cost_curve);
+    EXPECT_FALSE(r.offered); EXPECT_FALSE(r.unadmitted);
+    EXPECT_EQ(r.source_drops, (Counter128{})); EXPECT_TRUE(r.edge_drops.empty());
+    EXPECT_EQ(r.edge_reservations, (std::optional<std::vector<Amount>>(std::vector<Amount>(7,0))));
+    EXPECT_FALSE(detail::PolicyAccess::engine(p).static_preparation);
+    EXPECT_FALSE(detail::PolicyAccess::engine(p).kept_program);
+    for (Admission admission : {Admission::Lossless, Admission::Lossy}) {
+      FlowLedger replay(g);
+      FlowPolicy q(replay, v({0,1}), v({5}), {.routing=Pinned{r.program}, .admission=admission});
+      const auto at15 = q.replace(15, {}, all);
+      EXPECT_EQ(sources(at15), (std::vector<Amount>{10,5}));
+      EXPECT_EQ(at15.edge_flows, (std::optional<std::vector<Amount>>{{10,0,5,3,7,8,7}}));
+      EXPECT_EQ(at15.termination, Termination::Complete);
+      EXPECT_EQ(q.replace(16).delivered, 16);
+      EXPECT_EQ(refused([&] { (void)q.forward(15); }), "Pinned forwards with replace");
+    }
+    const auto forwarded=p.forward(15);
+    EXPECT_EQ(sources(forwarded), (std::vector<Amount>{10,5}));
+    EXPECT_FALSE(forwarded.routes_changed);EXPECT_FALSE(forwarded.weights_changed);EXPECT_FALSE(forwarded.reservations_changed);
+    expect_balanced(ledger, "controller replay");
+  }
+}
+
+TEST(WeightedSources, CoarsePositiveWeightWithoutAPathKeepsItsShare) {
+  const auto g = witness(true);
+  FlowLedger ledger(g);
+  FlowPolicy p(ledger, v({0,1}), v({5}), weighted({2,1,0,0,0,0}));
+  const auto r = p.replace(std::nullopt, {}, all);
+  EXPECT_EQ(r.delivered, 2); EXPECT_EQ(r.total_cost, (Counter128{0,6}));
+  EXPECT_EQ(sources(r), (std::vector<Amount>{2,0}));
+  EXPECT_EQ(r.edge_flows, (std::optional<std::vector<Amount>>{{2,0,0,1,1,1,1}}));
+  ASSERT_TRUE(r.program->source_weights());
+  EXPECT_EQ(*r.program->source_weights(), (std::vector<std::pair<NodeId,Amount>>{{0,2},{1,1}}));
+  ASSERT_EQ(r.program->tunnels().size(), 2U);
+  for (const auto& t : r.program->tunnels()) { EXPECT_EQ(t.head,0); EXPECT_EQ(t.weight,1); }
+  for (Admission admission : {Admission::Lossless, Admission::Lossy}) {
+    FlowLedger replay(g);
+    FlowPolicy q(replay, v({0,1}), v({5}), {.routing=Pinned{r.program}, .admission=admission});
+    const auto at3 = q.replace(3);
+    EXPECT_EQ(at3.delivered, 2);
+    EXPECT_EQ(at3.source_drops, (Counter128{0,admission==Admission::Lossy ? 1U : 0U}));
+    EXPECT_EQ(at3.termination, admission==Admission::Lossy ? Termination::Complete : Termination::Exhausted);
+  }
+}
+
+TEST(WeightedSources, RosterZeroWeightsAndEmptyReplayKeepDifferentOutcomes) {
+  const auto g = std::make_shared<const Graph>(make_graph(4, {{0,3,4,1},{1,3,4,1},{2,3,4,1}}));
+  for (bool masked : {false,true}) {
+    const auto mask = g->eligibility(masked ? v({2}) : v({}), {});
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger, v({2,0,1,2}), v({3}), weighted({1,1,2,0}), &mask);
+    const auto r = p.replace(std::nullopt, {}, all);
+    EXPECT_EQ(r.delivered,8); EXPECT_EQ(r.total_cost,(Counter128{0,8}));
+    EXPECT_EQ(sources(r), (masked ? std::vector<Amount>{4,4,0} : std::vector<Amount>{2,2,4}));
+  }
+  for (bool support : {false,true}) for (bool empty : {false,true}) {
+    const auto mask = g->eligibility(empty ? v({0,1,2}) : v({2}), {});
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger, v({0,1,2}), v({3}), weighted({0,0,5,0}, support ? dag_of(*g,{0,1,2}) : nullptr), &mask);
+    const auto r = p.replace(6, {}, all);
+    EXPECT_EQ(r.termination,empty ? Termination::NoRoute : Termination::NoActiveWeight);
+    EXPECT_EQ(r.delivered,0); EXPECT_EQ(r.unadmitted,(Counter128{0,6}));
+    EXPECT_EQ(sources(r),(std::vector<Amount>{0,0,0}));
+    ASSERT_TRUE(r.program->source_weights());
+    EXPECT_EQ(r.program->source_weights()->size(),empty ? 0U : 2U);
+    EXPECT_TRUE(r.program->tunnels().empty());
+    const auto unlimited=p.evaluate(std::nullopt);
+    EXPECT_EQ(unlimited.termination,empty ? Termination::NoRoute : Termination::NoActiveWeight);
+    EXPECT_FALSE(unlimited.requested);EXPECT_FALSE(unlimited.unadmitted);EXPECT_FALSE(unlimited.call_undelivered);
+    EXPECT_EQ(p.forward(6).termination,empty ? Termination::NoRoute : Termination::Exhausted);
+    for (Admission admission : {Admission::Lossless,Admission::Lossy}) {
+      FlowLedger replay(g);
+      FlowPolicy q(replay,v({0,1,2}),v({3}),{.routing=Pinned{r.program},.admission=admission},&mask);
+      EXPECT_EQ(q.replace(0).termination,Termination::Complete);
+      EXPECT_EQ(q.evaluate(6).termination,empty ? Termination::NoRoute : admission==Admission::Lossy ? Termination::Complete : Termination::Exhausted);
+      const auto at6=q.place(6);
+      EXPECT_EQ(at6.source_drops,(Counter128{0,admission==Admission::Lossy ? 6U : 0U}));
+      EXPECT_EQ(at6.termination,empty ? Termination::NoRoute : admission==Admission::Lossy ? Termination::Complete : Termination::Exhausted);
+      EXPECT_EQ(refused([&]{(void)q.forward(6);}),"Pinned forwards with replace");
+    }
+  }
+}
+
+TEST(WeightedSources, EqualPositiveWeightsAndZeroWeightHead) {
+  const auto g=std::make_shared<const Graph>(make_graph(4,{{0,3,2,1},{1,2,10,1},{2,3,10,2}}));
+  auto r=evaluate_demand(*g,v({0,1}),v({3}),EvaluationOptions{weighted({7,7,0,0}),nullptr,nullptr,all,{},Amount{12}});
+  EXPECT_EQ(r.delivered,4); EXPECT_EQ(r.total_cost,(Counter128{0,8}));
+  EXPECT_EQ(r.edge_flows,(std::optional<std::vector<Amount>>{{2,2,2}}));
+  EXPECT_EQ(sources(r),(std::vector<Amount>{2,2}));
+  const auto h=std::make_shared<const Graph>(make_graph(3,{{0,2,5,1},{1,2,5,1}}));
+  r=evaluate_demand(*h,v({0,1}),v({2}),EvaluationOptions{weighted({0,3,0}),nullptr,nullptr,all});
+  EXPECT_EQ(r.delivered,5); EXPECT_EQ(r.total_cost,(Counter128{0,5}));
+  EXPECT_EQ(sources(r),(std::vector<Amount>{0,5}));
+  EXPECT_EQ(r.edge_flows,(std::optional<std::vector<Amount>>{{0,5}}));
+  ASSERT_TRUE(r.program->source_weights());
+  EXPECT_EQ(*r.program->source_weights(),(std::vector<std::pair<NodeId,Amount>>{{0,0},{1,3}}));
+}
+
+TEST(WeightedSources, RefusalReliefUsesDeliveredRatherThanRequestedInScalarAndOrdered) {
+  const auto g=std::make_shared<const Graph>(make_graph(4,{{0,2,10,1},{1,2,10,1},{2,3,10,1}}));
+  for(bool ordered:{false,true}) {
+    FlowLedger ledger(g);
+    FlowPolicy other(ledger,v({2}),v({3}),{}),p(ledger,v({0,1}),v({3}),weighted({2,1,0,0}));
+    (void)other.replace(8);
+    const auto call=[&](Amount offer) {
+      if(!ordered)return p.place(offer,all);
+      const std::vector<Action> actions{Place{p,offer}};
+      return apply_actions(ledger,actions,BatchMode::Ordered,all).front();
+    };
+    const auto initial=call(5);
+    EXPECT_EQ(initial.delivered,2); EXPECT_EQ(initial.call_undelivered,3);
+    EXPECT_EQ(initial.by_tunnel,(std::vector<TunnelFlow>{{0,0,TunnelStatus::Up,{0,2},2,{}}}));
+    (void)other.replace(5);
+    const auto r=call(1);
+    EXPECT_EQ(r.delivered,3); EXPECT_EQ(r.call_delivered,1); EXPECT_EQ(r.total_cost,(Counter128{0,6}));
+    EXPECT_EQ(r.requested,(Counter128{0,6})); EXPECT_EQ(r.unadmitted,(Counter128{0,3}));
+    EXPECT_EQ(sources(r),(std::vector<Amount>{2,1}));
+    EXPECT_EQ(r.call_undelivered,0);
+    EXPECT_EQ(r.by_tunnel,(std::vector<TunnelFlow>{{0,0,TunnelStatus::Up,{0,2},2,{}},{1,1,TunnelStatus::Up,{0,1},1,{}}}));
+    EXPECT_EQ(r.edge_flows,(std::optional<std::vector<Amount>>{{2,1,3}}));
+    const auto state=epoch(p); (void)p.evaluate(4); expect_same(epoch(p),state,"evaluate after refusal");
+    p.remove(); EXPECT_FALSE(p.program());
+  }
+}
+
+TEST(WeightedSources, SimultaneousAwardsFollowCreationOrderInBothActionOrders) {
+  const auto g=std::make_shared<const Graph>(make_graph(2,{{0,1,3,1}}));
+  const auto program=evaluate_demand(*g,v({0}),v({1}),EvaluationOptions{weighted({1,0})}).program;
+  for(bool reverse:{false,true}) for(bool reverse_creation:{false,true}) {
+    FlowLedger ledger(g);
+    FlowPolicy first(ledger,v({0}),v({1}),{.routing=Pinned{program},.admission=Admission::Lossy});
+    FlowPolicy second(ledger,v({0}),v({1}),{.routing=Pinned{program},.admission=Admission::Lossy});
+    FlowPolicy* a=reverse_creation ? &second : &first;
+    FlowPolicy* b=reverse_creation ? &first : &second;
+    if(reverse)std::swap(a,b);
+    const std::vector<Action> actions{Replace{*a,3},Replace{*b,3}};
+    const auto r=apply_actions(ledger,actions,BatchMode::Simultaneous,all);
+    EXPECT_EQ(r[0].delivered,a==&first ? 2 : 1); EXPECT_EQ(r[1].delivered,b==&first ? 2 : 1);
+    EXPECT_EQ(first.delivered(),2); EXPECT_EQ(second.delivered(),1);
+    first.remove(); second.remove();
+    const auto ordered=apply_actions(ledger,actions,BatchMode::Ordered,all);
+    EXPECT_EQ(ordered[0].delivered,3); EXPECT_EQ(ordered[1].delivered,0);
+  }
+}
+
+TEST(WeightedSources, VectorMatrixAndValidationOrderHaveSuccessfulNeighbours) {
+  const auto g=std::make_shared<const Graph>(make_graph(3,{{0,2,2,1},{1,2,2,1}}));
+  const auto check=[&](FlowPolicyConfig cfg) {FlowLedger ledger(g);return refused([&]{FlowPolicy p(ledger,v({0}),v({2}),cfg);});};
+  auto cfg=weighted({1,0,0});
+  EXPECT_EQ(check(cfg),"no error");
+  std::get<CentralizedTE>(cfg.routing).tunnel_count=TunnelCount{1};
+  EXPECT_EQ(check(cfg),"source_allocation=WEIGHTED requires CentralizedTE without tunnel_count");
+  cfg.routing=CentralizedTE{SourceAllocation::Weighted};
+  EXPECT_EQ(check(cfg),"source_allocation=WEIGHTED requires source_weights");
+  cfg.admission=Admission::Lossy;
+  EXPECT_EQ(check(cfg),"CentralizedTE without tunnel_count requires admission=LOSSLESS");
+  for(auto allocation:{RouteAllocation::Equal,RouteAllocation::Weighted,RouteAllocation::Optimized}) {
+    ShortestPaths sp;sp.allocation=allocation;sp.source_allocation=SourceAllocation::Weighted;
+    EXPECT_EQ(check({sp}),"source_allocation=WEIGHTED requires CentralizedTE without tunnel_count");
+  }
+  for(auto allocation:{SourceAllocation::Equal,SourceAllocation::Optimized}) {
+    cfg=weighted({1,0,0}); std::get<CentralizedTE>(cfg.routing).source_allocation=allocation;
+    EXPECT_EQ(check(cfg),"source_weights require source_allocation=WEIGHTED");
+  }
+  for(const auto& w:std::vector<std::vector<Amount>>{{1,0},{-1,0},{0,kDomainLimit},{1,0,0,kDomainLimit}}) {
+    EXPECT_EQ(check(weighted(w)),"source_weights: expected 3 entries");
+    EXPECT_EQ(refused([&]{(void)evaluate_demand(*g,v({0}),v({2}),EvaluationOptions{weighted(w),nullptr,nullptr,all,{},Amount{0}});}),
+        "source_weights: expected 3 entries");
+  }
+  for(Amount bad:{Amount{-1},kDomainLimit}) EXPECT_EQ(check(weighted({1,0,bad})),"source_weights[2] must be an integer in [0, 2^62)");
+  EXPECT_EQ(check(weighted({kDomainLimit-1,0,0})),"no error");
+  cfg=weighted({1,0});
+  ShortestPathCache cache(*g);FlowLedger ledger(g);
+  EXPECT_EQ(refused([&]{FlowPolicy p(ledger,v({0}),v({2}),cfg,nullptr,&cache);}),"CentralizedTE does not use ShortestPathCache");
+}
+
+TEST(WeightedSources, FailureStudyRecomputesUnusedEdgesAndEveryWorkerMatches) {
+  const auto g=std::make_shared<const Graph>(make_graph(3,{{0,2,0,1},{1,2,10,1}}));
+  for(int workers:{1,2,4}) {
+    const EvaluationOptions options{weighted({2,1,0}),nullptr,nullptr,all};
+    const auto result=evaluate_edge_failures(*g,v({0,1}),v({2}),options,workers);
+    EXPECT_EQ(result.baseline.delivered,0);ASSERT_EQ(result.entries.size(),2U);
+    EXPECT_EQ(result.entries[0].edge,0);EXPECT_EQ(result.entries[0].delivery_reduction,-10);
+    EXPECT_EQ(result.entries[1].edge,1);EXPECT_EQ(result.entries[1].delivery_reduction,0);
+    const std::vector<std::pair<std::vector<NodeId>,std::vector<NodeId>>> pairs(5,{{1,0,1},{2}});
+    const auto batch=evaluate_pairs(*g,pairs,options,{},workers);
+    for(const auto& r:batch)expect_same(r,result.baseline,"pair-local source weights");
+  }
+}
+
+TEST(WeightedSources, SmallFlowEnumerationConfirmsThePrescribedMaximumAndMinimumCost) {
+  EXPECT_EQ(sequential(2,{2,1}),(std::vector<Amount>{2,0}));
+  EXPECT_EQ(sequential(50,{100,1,1,1}),(std::vector<Amount>{50,0,0,0}));
+  {
+    const auto g=make_graph(3,{{0,2,2,9},{1,2,10,1}});
+    const auto r=evaluate_demand(g,v({0,1}),v({2}),EvaluationOptions{weighted({2,1,0})});
+    EXPECT_EQ(r.delivered,3);EXPECT_EQ(r.total_cost,(Counter128{0,19}));EXPECT_EQ(sources(r),(std::vector<Amount>{2,1}));
+    const auto h=make_graph(3,{{0,1,2,1},{0,2,2,5},{1,2,2,1}});
+    const auto cheap=evaluate_demand(h,v({0}),v({2}),EvaluationOptions{weighted({1,0,0}),nullptr,nullptr,all,{},Amount{2}});
+    EXPECT_EQ(cheap.delivered,2);EXPECT_EQ(cheap.total_cost,(Counter128{0,4}));
+    EXPECT_EQ(cheap.edge_flows,(std::optional<std::vector<Amount>>{{2,0,2}}));
+  }
+  std::mt19937 rng(20261022);
+  for(int trial=0;trial<80;++trial) {
+    const std::vector<Amount> w{static_cast<Amount>(rng()%4),static_cast<Amount>(rng()%4)};
+    const auto g=std::make_shared<const Graph>(make_graph(4,{{0,2,static_cast<Amount>(rng()%3),1},
+      {0,3,static_cast<Amount>(rng()%3),7},{1,2,static_cast<Amount>(rng()%3),3},
+      {1,3,static_cast<Amount>(rng()%3),1},{2,3,static_cast<Amount>(rng()%3),1}}));
+    const auto u=g->edge_sources(),d=g->edge_destinations();const auto cap=g->edge_capacity_units(),cost=g->edge_costs();
+    std::vector<Amount> flow(5);std::map<Amount,Amount> best{{0,0}};
+    std::function<void(std::size_t)> enumerate=[&](std::size_t e) {
+      if(e<flow.size()){for(Amount x=0;x<=cap[e];++x){flow[e]=x;enumerate(e+1);}return;}
+      Amount bal[4]={0,0,0,0};Amount c=0;
+      for(std::size_t j=0;j<flow.size();++j){bal[u[j]]+=flow[j];bal[d[j]]-=flow[j];c+=flow[j]*cost[j];}
+      if(bal[2]!=0)return;
+      const Amount t=bal[0]+bal[1];const auto share=sequential(t,w);
+      if(bal[0]!=share[0]||bal[1]!=share[1])return;
+      auto [it,inserted]=best.emplace(t,c);if(!inserted)it->second=std::min(it->second,c);
+    };
+    enumerate(0);
+    const Amount maximum=best.rbegin()->first;
+    for(Amount offer:{Amount{0},Amount{1},Amount{9}}) {
+      const auto r=evaluate_demand(*g,v({0,1}),v({3}),EvaluationOptions{weighted({w[0],w[1],0,0}),nullptr,nullptr,all,{},offer});
+      const Amount t=std::min(offer,maximum);
+      EXPECT_EQ(r.delivered,t);EXPECT_EQ(r.total_cost,(Counter128{0,static_cast<std::uint64_t>(best.at(t))}));
+      EXPECT_EQ(sources(r),sequential(t,w));
+      Amount bal[4]={0,0,0,0};
+      for(std::size_t e=0;e<flow.size();++e){const Amount x=(*r.edge_flows)[e];EXPECT_GE(x,0);EXPECT_LE(x,cap[e]);bal[u[e]]+=x;bal[d[e]]-=x;}
+      EXPECT_EQ(bal[2],0);EXPECT_EQ(bal[0],sources(r)[0]);EXPECT_EQ(bal[1],sources(r)[1]);EXPECT_EQ(bal[3],-t);
+    }
+  }
+}
+
+namespace {
+// Compare two nonnegative rational numbers by Euclidean division, without any
+// cross-product or production arithmetic; denominators can use 127 bits.
+int rational_order(UInt128 a,UInt128 b,UInt128 c,UInt128 d) {
+  bool reverse=false;
+  for(;;) {
+    const auto x=a/b,y=c/d;
+    if(x!=y)return (x<y ? -1 : 1)*(reverse ? -1 : 1);
+    a=a%b;c=c%d;
+    if(a==0||c==0)return (a==c ? 0 : a==0 ? -1 : 1)*(reverse ? -1 : 1);
+    std::swap(a,b);std::swap(c,d);reverse=!reverse;
+  }
+}
+UInt128 test_value(detail::U128 a) {return (UInt128(a.hi)<<64)|UInt128(a.lo);}
+}
+
+TEST(WeightedSources, WideApportionmentHasExactQuotientOrderAndIncrementCarries) {
+  for(int count:{1,2,3,4,5,16,17,40})for(bool unequal:{false,true}) {
+    std::vector<Amount> weights(static_cast<std::size_t>(count));
+    for(int i=0;i<count;++i)weights[static_cast<std::size_t>(i)]=kDomainLimit-1-(unequal ? i : 0);
+    for(detail::U128 x:{detail::U128{0,16},detail::U128{1,1},detail::U128{(std::uint64_t{1}<<62)+1,3}}) {
+      std::vector<detail::U128> a(weights.size());detail::highest_averages(x,weights,a);
+      UInt128 sum=0;for(auto z:a)sum+=test_value(z);EXPECT_EQ(sum,test_value(x));
+      for(std::size_t i=0;i<a.size();++i)for(std::size_t j=0;j<a.size();++j)if(test_value(a[i])!=0) {
+        const int cmp=rational_order(UInt128(weights[i]),test_value(a[i]),UInt128(weights[j]),test_value(a[j])+1);
+        EXPECT_TRUE(cmp>0||(cmp==0&&i<=j));
+      }
+    }
+    std::vector<InEdge> edges;
+    std::vector<NodeId> heads;
+    for(int i=0;i<count;++i){edges.push_back({i,count,5,1});heads.push_back(i);}
+    const auto g=std::make_shared<const Graph>(make_graph(count+1,edges));
+    auto declared=weights;declared.push_back(0);
+    const auto program=evaluate_demand(*g,heads,v({count}),EvaluationOptions{weighted(declared)}).program;
+    const auto view=detail::make_forwarding_view(*g,program,nullptr,v({count}),nullptr);
+    for(Counter128 x:{Counter128{1,1},Counter128{(std::uint64_t{1}<<62)+1,3}}) {
+      std::vector<Amount> delta(weights.size());detail::source_offer_increments(view,x,17,delta);
+      EXPECT_EQ(std::accumulate(delta.begin(),delta.end(),Amount{0}),17);
+      if(count==5&&!unequal&&x.hi==1)EXPECT_EQ(delta,(std::vector<Amount>{3,3,4,4,3}));
+      if(count==5&&unequal&&x.hi>1)EXPECT_EQ(delta,(std::vector<Amount>{4,3,3,4,3}));
+    }
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger,heads,v({count}),{.routing=Pinned{program},.admission=Admission::Lossy});
+    UInt128 total=0;
+    for(Amount offer:{kDomainLimit-1,kDomainLimit-1,kDomainLimit-1,Amount{7},kDomainLimit-1,Amount{5},Amount{17}}) {
+      const auto r=p.place(offer);
+      total+=UInt128(offer);
+      ASSERT_TRUE(r.requested);
+      EXPECT_EQ((UInt128(r.requested->hi)<<64)|UInt128(r.requested->lo),total);
+      UInt128 offered=0;for(const auto& row:r.by_source){ASSERT_TRUE(row.offered);offered+=(UInt128(row.offered->hi)<<64)|UInt128(row.offered->lo);}
+      EXPECT_EQ(offered,total);
+    }
+  }
+}
+
+TEST(WeightedSources, WideCostKeepsBothWordsAndSharedInputOwnership) {
+  const Amount m=kDomainLimit-1;
+  const auto g=std::make_shared<const Graph>(make_graph(2,{{0,1,m,m}}));
+  auto owner=std::make_shared<const std::vector<Amount>>(std::vector<Amount>{m,0});
+  std::weak_ptr<const std::vector<Amount>> weak=owner;
+  CentralizedTE cfg(SourceAllocation::Weighted);cfg.source_weights=owner;
+  FlowLedger ledger(g);std::optional<FlowPolicy> p;
+  p.emplace(ledger,v({0}),v({1}),FlowPolicyConfig{cfg});
+  cfg.source_weights.reset();owner.reset();ASSERT_FALSE(weak.expired());
+  const auto r=p->replace(m,{},all);
+  const UInt128 square=UInt128(m)*UInt128(m);
+  ASSERT_TRUE(r.total_cost);
+  EXPECT_EQ((UInt128(r.total_cost->hi)<<64)|UInt128(r.total_cost->lo),square);
+  EXPECT_EQ(r.delivered,m);EXPECT_EQ(sources(r),(std::vector<Amount>{m}));
+  auto& requested=detail::PolicyAccess::engine(*p).epoch.requested;
+  requested=Counter128{(std::uint64_t{1}<<63)-1,std::numeric_limits<std::uint64_t>::max()};
+  const auto before=ledger_state(ledger);const auto old=epoch(*p);
+  EXPECT_EQ(refused([&]{(void)p->place(1);}),"requested limit exceeded");
+  expect_same(ledger_state(ledger),before,"counter limit");expect_same(epoch(*p),old,"counter limit");
+  p.reset();EXPECT_TRUE(weak.expired());
+}
+
+TEST(WeightedSources, MasksChangeTheRosterButBlackHolesKeepDeclaredShares) {
+  const auto g=std::make_shared<const Graph>(make_graph(3,{{0,2,10,1},{1,2,10,1}}));
+  const auto program=evaluate_demand(*g,v({0,1}),v({2}),EvaluationOptions{weighted({2,1,0}),nullptr,nullptr,{}, {},Amount{3}}).program;
+  const auto mask=g->eligibility(v({0}),{});
+  FlowLedger a(g),b(g);
+  FlowPolicy repaired(a,v({0,1}),v({2}),{.routing=Pinned{program},.admission=Admission::Lossy},&mask);
+  FlowPolicy stale(b,v({0,1}),v({2}),{.routing=Pinned{program,std::make_shared<const Eligibility>(mask)},.admission=Admission::Lossy});
+  EXPECT_EQ(sources(repaired.replace(3)),(std::vector<Amount>{0,3}));
+  const auto r=stale.replace(3);
+  EXPECT_EQ(sources(r),(std::vector<Amount>{0,1}));
+  EXPECT_EQ(r.source_drops,(Counter128{0,2}));
+  const auto supported=evaluate_demand(*g,v({0,1}),v({2}),EvaluationOptions{weighted({2,1,0},dag_of(*g,{1})),nullptr,nullptr,all});
+  EXPECT_EQ(sources(supported),(std::vector<Amount>{0,10}));
+  EXPECT_EQ(supported.edge_flows,(std::optional<std::vector<Amount>>{{0,10}}));
+}
+
+TEST(WeightedSources, ZeroInjectionChangesNoOtherLossOrForwardingStructure) {
+  const auto g=witness();
+  const auto empty=evaluate_demand(*g,v({0,1}),v({5}),EvaluationOptions{weighted({0,0,0,0,0,0})}).program;
+  const auto positive=evaluate_demand(*g,v({0,1}),v({5}),EvaluationOptions{weighted({2,1,0,0,0,0})}).program;
+  const auto dag=dag_of(*g,{0,1,2,3,4,5,6});
+  const auto pooled=ForwardingProgram::from_dag(*g,v({0,1}),v({5}),dag);
+  const std::vector<RouteDefinition> definitions{{0,dag,1},{1,dag,1}};
+  const auto split=ForwardingProgram::from_routes(*g,v({0,1}),v({5}),definitions);
+  const std::vector<Routing> models{Pinned{positive},ShortestPaths{},Pinned{pooled},Pinned{split}};
+  for(const auto& model:models)for(Amount zero_offer:{Amount{0},Amount{7}}) {
+    FlowLedger ledger(g);
+    FlowPolicy p(ledger,v({0,1}),v({5}),FlowPolicyConfig{model,Admission::Lossy});
+    FlowPolicy zero(ledger,v({0,1}),v({5}),{.routing=Pinned{empty},.admission=Admission::Lossy});
+    const std::vector<Action> baseline{Replace{p,19}};
+    const auto want=apply_actions(ledger,baseline,BatchMode::Simultaneous,all).front();
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const auto old=detail::thread_lossy_counters();
+#endif
+    p.remove();
+    const std::vector<Action> with_zero{Replace{zero,zero_offer},Replace{p,19}};
+    const auto actual=apply_actions(ledger,with_zero,BatchMode::Simultaneous,all);
+    expect_same(actual[1],want,"zero source injection");
+#if NETGRAPH_CORE_PRIVATE_HOOKS
+    const auto& now=detail::thread_lossy_counters();
+    EXPECT_EQ(now.groups,old.groups);EXPECT_EQ(now.rounds,old.rounds);EXPECT_EQ(now.barriers,old.barriers);
+    EXPECT_EQ(now.dependencies,old.dependencies);EXPECT_EQ(now.event_structures,old.event_structures);
+#endif
+  }
+}
+
+TEST(WeightedSources, TransitThroughAnotherSourceIsNotItsInjection) {
+  const auto g=std::make_shared<const Graph>(make_graph(3,{{0,1,5,1},{1,2,10,1}}));
+  FlowLedger ledger(g);FlowPolicy p(ledger,v({0,1}),v({2}),weighted({1,1,0}));
+  const auto r=p.replace(std::nullopt,{},all);
+  EXPECT_EQ(r.delivered,10);EXPECT_EQ(r.total_cost,(Counter128{0,15}));
+  EXPECT_EQ(sources(r),(std::vector<Amount>{5,5}));
+  EXPECT_EQ(r.edge_flows,(std::optional<std::vector<Amount>>{{5,10}}));
+  const auto records=p.records();ASSERT_EQ(records.size(),2U);
+  EXPECT_EQ(records[0].delivered,5);EXPECT_EQ(records[1].delivered,5);
+}
+
+TEST(WeightedSources, LiveTunnelRowsAndUndeliveredAreExactAcrossReaders) {
+  const auto g=std::make_shared<const Graph>(make_graph(2,{{0,1,5,1}}));
+  const auto cfg=weighted({1,0});
+  const auto check=[](const PlacementResult& r,Amount offer) {
+    const Amount carried=std::min(offer,Amount{5});
+    const Counter128 amount{0,static_cast<std::uint64_t>(carried)};
+    EXPECT_EQ(r.call_delivered,carried);EXPECT_EQ(r.call_undelivered,offer-carried);
+    EXPECT_EQ(r.delivery_delta,carried);EXPECT_TRUE(r.call_edge_drops.empty());EXPECT_EQ(r.call_source_drops,0);
+    EXPECT_EQ(r.termination,offer<=5 ? Termination::Complete : Termination::Exhausted);
+    EXPECT_TRUE(r.routes_changed);EXPECT_TRUE(r.weights_changed);EXPECT_FALSE(r.reservations_changed);
+    ASSERT_TRUE(r.program);EXPECT_FALSE(r.plan);EXPECT_FALSE(r.offered);
+    EXPECT_EQ(r.requested,(Counter128{0,static_cast<std::uint64_t>(offer)}));
+    EXPECT_EQ(r.admitted,amount);EXPECT_EQ(r.delivered,carried);
+    EXPECT_EQ(r.unadmitted,(Counter128{0,static_cast<std::uint64_t>(offer-carried)}));
+    EXPECT_EQ(r.source_drops,(Counter128{}));EXPECT_TRUE(r.edge_drops.empty());EXPECT_EQ(r.total_cost,amount);
+    EXPECT_EQ(r.by_source,(std::vector<SourceFlow>{{0,{},amount,carried,{},{}}}));
+    EXPECT_FALSE(r.min_cut);EXPECT_FALSE(r.marginal_cost_curve);
+    EXPECT_EQ(r.edge_flows,(std::optional<std::vector<Amount>>{{carried}}));
+    EXPECT_EQ(r.residual,(std::optional<std::vector<Amount>>{{5-carried}}));
+    EXPECT_EQ(r.edge_reservations,(std::optional<std::vector<Amount>>{{0}}));
+    EXPECT_EQ(r.saturated_boundary_edges,(std::optional<std::vector<EdgeId>>{carried==5 ? v({0}) : v({})}));
+    EXPECT_EQ(r.by_tunnel,(std::vector<TunnelFlow>{{0,0,TunnelStatus::Up,{0,static_cast<std::uint64_t>(carried)},carried,{}}}));
+  };
+  for(Amount offer:{Amount{3},Amount{7}}) {
+    for(int operation=0;operation<3;++operation)for(bool ordered:{false,true}) {
+      FlowLedger ledger(g);FlowPolicy p(ledger,v({0}),v({1}),cfg);
+      if(operation==2)check(p.evaluate(offer,{},all),offer);
+      else if(!ordered)check(operation==0 ? p.place(offer,all) : p.replace(offer,{},all),offer);
+      else {
+        const std::vector<Action> actions=operation==0 ? std::vector<Action>{Place{p,offer}} : std::vector<Action>{Replace{p,offer}};
+        check(apply_actions(ledger,actions,BatchMode::Ordered,all).front(),offer);
+      }
+    }
+    const EvaluationOptions options{cfg,nullptr,nullptr,all,{},offer};
+    check(evaluate_demand(*g,v({0}),v({1}),options),offer);
+    for(int workers:{1,2,4}) {
+      const std::vector<std::pair<std::vector<NodeId>,std::vector<NodeId>>> pairs(5,{{0},{1}});
+      for(const auto& r:evaluate_pairs(*g,pairs,options,{},workers))check(r,offer);
+      check(evaluate_edge_failures(*g,v({0}),v({1}),options,workers).baseline,offer);
+    }
+  }
+}
+
+TEST(WeightedSources, RemainingZeroCapturedWeightsWithAProgramPathHaveNoActiveWeight) {
+  const auto g=std::make_shared<const Graph>(make_graph(3,{{0,2,10,1},{1,2,10,1}}));
+  const auto program=evaluate_demand(*g,v({0,1}),v({2}),EvaluationOptions{weighted({2,0,0}),nullptr,nullptr,all,{},Amount{5}}).program;
+  ASSERT_EQ(program->tunnels().size(),1U);
+  const auto mask=g->eligibility(v({0}),{});
+  for(Admission admission:{Admission::Lossy,Admission::Lossless}) {
+    FlowLedger ledger(g);FlowPolicy p(ledger,v({0,1}),v({2}),{.routing=Pinned{program},.admission=admission},&mask);
+    for(int operation=0;operation<3;++operation) {
+      p.remove();
+      const auto r=operation==0 ? p.replace(4,{},all) : operation==1 ? p.evaluate(4,{},all) : p.place(4,all);
+      EXPECT_EQ(r.termination,Termination::NoActiveWeight);EXPECT_EQ(r.delivered,0);
+      EXPECT_EQ(r.call_undelivered,4);EXPECT_EQ(r.source_drops,(Counter128{0,admission==Admission::Lossy ? 4U : 0U}));
+      EXPECT_EQ(r.unadmitted,(std::optional<Counter128>{{0,admission==Admission::Lossy ? 0U : 4U}}));
+      EXPECT_EQ(sources(r),(std::vector<Amount>{0,0}));
+      for(const auto& row:r.by_source) EXPECT_EQ(row.source_drops,(Counter128{}));
+    }
+  }
+}
+
+TEST(WeightedSources, SmallWeightSumsUseWideCumulativeArithmetic) {
+  const Amount m=kDomainLimit-1;
+  for(int count:{2,3,4})for(bool unequal:{false,true}) {
+    std::vector<InEdge> edges;std::vector<NodeId> heads;std::vector<Amount> weights;
+    for(int i=0;i<count;++i){edges.push_back({i,count,5,1});heads.push_back(i);weights.push_back(m-(unequal ? i : 0));}
+    weights.push_back(0);
+    const auto g=std::make_shared<const Graph>(make_graph(count+1,edges));
+    const auto program=evaluate_demand(*g,heads,v({count}),EvaluationOptions{weighted(weights)}).program;
+    const auto view=detail::make_forwarding_view(*g,program,nullptr,v({count}),nullptr);
+    // The sum of four M weights is 2^64-4; X=3M+7 reaches the old product overflow.
+    std::vector<Amount> delta(static_cast<std::size_t>(count));
+    detail::source_offer_increments(view,{0,3*static_cast<std::uint64_t>(m)+7},m,delta);
+    EXPECT_TRUE(std::all_of(delta.begin(),delta.end(),[](Amount a){return a>=0;}));
+    UInt128 sum=0;for(auto a:delta)sum+=UInt128(a);EXPECT_EQ(sum,UInt128(m));
+    if(count==4&&!unequal) EXPECT_EQ(delta,(std::vector<Amount>{m/4+1,m/4+1,m/4+1,m/4}));
+  }
+}
diff --git a/tests/cpp/zero_capacity_tests.cpp b/tests/cpp/zero_capacity_tests.cpp
new file mode 100644
index 0000000..980cbdf
--- /dev/null
+++ b/tests/cpp/zero_capacity_tests.cpp
@@ -0,0 +1,520 @@
+// Edges of capacity 0 stay in routing (docs/semantics.md): searches, cached supports, rosters and
+// CostStretch baselines read no capacity (only an explicit residual filters), an Equal split
+// still gives a zero-capacity member its round-robin share (dropped under Lossy, blocking under
+// Lossless), a Weighted split gives it weight 0 and never routes around it, evaluate_edge_failures lists it,
+// and CentralizedTE's minimum cut lists it when it leaves the sources' residual closure. Each test checks
+// hand-derived values on small graphs whose EdgeIds equal their input positions (asserted). The
+// graphs: S (the worked search example, whose only shortest route crosses the zero edge): 0:
+// 0 -> 1 cap 0, 1: 0 -> 2 cap 5, 2: 2 -> 1 cap 5, costs 1;
+// B (two sources): 0: 0 -> 2 cap 0, 1: 1 -> 2 cap 10.
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <memory>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include "netgraph/core/detail/search_detail.hpp"
+#include "netgraph/core/shortest_path_cache.hpp"
+#include "netgraph/core/detail/route_kernels.hpp"
+#include "netgraph/core/detail/route_builders.hpp"
+#include "netgraph/core/evaluators.hpp"
+#include "netgraph/core/flow_ledger.hpp"
+#include "netgraph/core/flow_policy.hpp"
+#include "netgraph/core/search.hpp"
+#include "test_utils.hpp"
+
+using namespace netgraph::core;
+using namespace netgraph::core::test;
+
+namespace {
+
+// A graph whose rows are already in EdgeId order (source, cost, destination, input).
+std::shared_ptr<const Graph> ordered(std::int32_t n, const std::vector<InEdge>& rows) {
+  auto g = shared(make_graph(n, rows));
+  for (std::size_t i = 0; i < rows.size(); ++i) EXPECT_EQ(g->input_positions()[i], static_cast<std::int32_t>(i));
+  return g;
+}
+
+std::shared_ptr<const Graph> graph_s() { return ordered(3, {{0, 1, 0, 1}, {0, 2, 5, 1}, {2, 1, 5, 1}}); }
+std::shared_ptr<const Graph> graph_b(Amount c0, Amount c1) { return ordered(3, {{0, 2, c0, 1}, {1, 2, c1, 1}}); }
+
+detail::RouteChoice sel(RouteTieBreak t = RouteTieBreak::FewerHops, bool multipath = true, bool parallel_edges = true) {
+  return detail::RouteChoice {t, multipath, parallel_edges};
+}
+
+// A configuration: ShortestPaths takes the allocation `k` and the route choice `s`; the other models
+// take neither.
+FlowPolicyConfig cfg(Routing r, RouteAllocation k, Admission a = Admission::Lossless, detail::RouteChoice s = sel()) {
+  if (auto* sp = std::get_if<ShortestPaths>(&r)) {
+    sp->allocation = k;
+    sp->tie_break = s.tie_break;
+    sp->multipath = s.multipath;
+    sp->parallel_edges = s.parallel_edges;
+  }
+  return FlowPolicyConfig {std::move(r), a};
+}
+
+SpfResult search(const Graph& g, std::vector<NodeId> roots, Direction d, std::optional<std::vector<NodeId>> targets,
+                 const detail::RouteChoice& s = sel(), const std::vector<Amount>* residual = nullptr,
+                 const Eligibility* elig = nullptr) {
+  SpfOptions o(d);
+  o.tie_break = s.tie_break;
+  o.multipath = s.multipath;
+  o.parallel_edges = s.parallel_edges;
+  o.targets = std::move(targets);
+  if (residual != nullptr) o.residual = std::span<const Amount>(*residual);
+  o.eligibility = elig;
+  return spf(g, roots, o);
+}
+
+std::vector<EdgeId> dag_edges(const PredecessorDAG& dag) { return ascending_edges(dag); }
+
+std::vector<std::vector<EdgeId>> walks(const std::vector<std::pair<Cost, Path>>& r) {
+  std::vector<std::vector<EdgeId>> out;
+  for (const auto& [c, p] : r) {
+    std::vector<EdgeId> w;
+    for (const auto& hop : p.hops()) w.push_back(hop.front());
+    out.push_back(w);
+  }
+  return out;
+}
+
+using Drops = std::vector<std::pair<EdgeId, Amount>>;
+
+// One placement on a fresh ledger of g.
+struct Placed {
+  PlacementResult r;
+  std::vector<FlowRecord> records;
+};
+Placed place_once(const std::shared_ptr<const Graph>& g, std::vector<NodeId> s, std::vector<NodeId> d,
+                  const FlowPolicyConfig& c, std::optional<Amount> v, const Eligibility* elig = nullptr,
+                  OutputOptions out = {}) {
+  FlowLedger fg(g);
+  FlowPolicy p(fg, s, d, c, elig);
+  Placed x;
+  x.r = p.place(v, out);
+  x.records = p.records();
+  return x;
+}
+
+// T1 with N tunnels per head: one replace(offer, design) on a fresh ledger of g.
+FlowPolicyConfig t1(std::int64_t n, Admission a = Admission::Lossless, std::optional<CostCeiling> ceiling = std::nullopt) {
+  return FlowPolicyConfig {.routing = DistributedTE {TunnelCount {n}, ceiling}, .admission = a};
+}
+Placed replace_once(const std::shared_ptr<const Graph>& g, std::vector<NodeId> s, std::vector<NodeId> d,
+                    const FlowPolicyConfig& c, Amount offer, Amount design) {
+  FlowLedger fg(g);
+  FlowPolicy p(fg, s, d, c);
+  Placed x;
+  x.r = p.replace(offer, design);
+  x.records = p.records();
+  return x;
+}
+
+std::vector<std::pair<EdgeId, Amount>> entries(const SensitivityResult& s) {
+  std::vector<std::pair<EdgeId, Amount>> out;
+  for (const auto& e : s.entries) out.emplace_back(e.edge, e.delivery_reduction);
+  return out;
+}
+
+} // namespace
+
+// SPF over the zero edge and its variants on S.
+TEST(ZeroCapacity, SpfSearchesTheZeroEdgeAndOnlyAResidualFiltersIt) {
+  const auto g = graph_s();
+  const auto t = search(*g, {0}, Direction::Forward, std::vector<NodeId> {1});
+  EXPECT_EQ(t.target_cost, 1);
+  EXPECT_EQ(dag_edges(t.dag), (std::vector<EdgeId>{0}));
+  const std::vector<Amount> res = {0, 5, 5};  // a residual that filters the zero edge
+  const auto gated = search(*g, {0}, Direction::Forward, std::vector<NodeId> {1}, sel(), &res);
+  EXPECT_EQ(gated.target_cost, 2);
+  EXPECT_EQ(dag_edges(gated.dag), (std::vector<EdgeId>{1, 2}));
+  const auto full = search(*g, {0}, Direction::Forward, std::nullopt);
+  EXPECT_EQ(*full.costs, (std::vector<Cost>{0, 1, 1}));
+  EXPECT_EQ(dag_edges(full.dag), (std::vector<EdgeId>{0, 1}));
+  const auto rev = search(*g, {1}, Direction::Reverse, std::nullopt);
+  EXPECT_EQ(*rev.costs, (std::vector<Cost>{1, 0, 1}));
+  EXPECT_EQ(dag_edges(rev.dag), (std::vector<EdgeId>{0, 2}));
+  const auto single = search(*g, {0}, Direction::Forward, std::vector<NodeId> {1}, sel(RouteTieBreak::FewerHops, false));
+  EXPECT_EQ(single.target_cost, 1);
+  EXPECT_EQ(dag_edges(single.dag), (std::vector<EdgeId>{0}));
+  const auto mask = g->eligibility({}, std::vector<EdgeId> {0});
+  const auto masked = search(*g, {0}, Direction::Forward, std::vector<NodeId> {1}, sel(), nullptr, &mask);
+  EXPECT_EQ(masked.target_cost, 2);
+  EXPECT_EQ(dag_edges(masked.dag), (std::vector<EdgeId>{1, 2}));
+}
+
+// KSP over the zero edge, with and without a residual (the CostStretch case is in ksp_tests.cpp).
+TEST(ZeroCapacity, KspListsTheZeroEdgeWalk) {
+  const auto g = graph_s();
+  auto r = ksp(*g, 0, 1, KspOptions(2));
+  EXPECT_EQ(walks(r), (std::vector<std::vector<EdgeId>>{{0}, {1, 2}}));
+  EXPECT_EQ(r[0].first, 1);
+  EXPECT_EQ(r[1].first, 2);
+  const std::vector<Amount> res = {0, 5, 5};
+  KspOptions o(2);
+  o.residual = std::span<const Amount>(res);
+  EXPECT_EQ(walks(ksp(*g, 0, 1, o)), (std::vector<std::vector<EdgeId>>{{1, 2}}));
+}
+
+// The parallel-member rule and the tie scores without a residual.
+TEST(ZeroCapacity, CollapseAndPrioritiesWithoutAResidual) {
+  const auto pair = ordered(2, {{0, 1, 0, 1}, {0, 1, 3, 1}});
+  auto collapse = [&](RouteTieBreak t) {
+    return dag_edges(search(*pair, {0}, Direction::Forward, std::vector<NodeId> {1}, sel(t, true, false)).dag);
+  };
+  EXPECT_EQ(collapse(RouteTieBreak::FewerHops), (std::vector<EdgeId>{0}));
+  EXPECT_EQ(collapse(RouteTieBreak::HigherCapacity), (std::vector<EdgeId>{1}));
+  EXPECT_EQ(collapse(RouteTieBreak::HigherHeadroom), (std::vector<EdgeId>{1}));
+  EXPECT_EQ(collapse(RouteTieBreak::HigherAvailableCapacity), (std::vector<EdgeId>{1}));
+  // On positive capacities 1 and 5, HIGHER_HEADROOM reads 1 everywhere (EdgeId order decides);
+  // HIGHER_CAPACITY and HIGHER_AVAILABLE_CAPACITY read the capacities.
+  const auto d = ordered(4, {{0, 1, 1, 1}, {0, 2, 5, 1}, {1, 3, 1, 1}, {2, 3, 5, 1}});
+  auto path = [&](const std::shared_ptr<const Graph>& h, RouteTieBreak t) {
+    return dag_edges(search(*h, {0}, Direction::Forward, std::vector<NodeId> {3}, sel(t, false)).dag);
+  };
+  EXPECT_EQ(path(d, RouteTieBreak::HigherHeadroom), (std::vector<EdgeId>{0, 2}));
+  EXPECT_EQ(path(d, RouteTieBreak::HigherCapacity), (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(path(d, RouteTieBreak::HigherAvailableCapacity), (std::vector<EdgeId>{1, 3}));
+  // HIGHER_HEADROOM: 0 on the zero-capacity edge, 1 elsewhere.
+  const auto z = ordered(4, {{0, 1, 0, 1}, {0, 2, 5, 1}, {1, 3, 5, 1}, {2, 3, 5, 1}});
+  EXPECT_EQ(path(z, RouteTieBreak::HigherHeadroom), (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(path(z, RouteTieBreak::FewerHops), (std::vector<EdgeId>{0, 2}));
+  KspOptions o(2);
+  o.tie_break = RouteTieBreak::HigherHeadroom;
+  EXPECT_EQ(walks(ksp(*z, 0, 3, o)), (std::vector<std::vector<EdgeId>>{{1, 3}, {0, 2}}));
+}
+
+// The cached support is capacity-blind, and a policy reading it places 0 on S.
+TEST(ZeroCapacity, DagCacheValuesAndTheirConsumers) {
+  const auto g = graph_s();
+  ShortestPathCache cache(*g);
+  const auto v1 = cache.lookup(*g, v({1}), Direction::Reverse, nullptr);
+  EXPECT_EQ(dag_edges(*v1), (std::vector<EdgeId>{0, 2}));
+  EXPECT_EQ(cache.stats().misses, 1);
+  (void)cache.lookup(*g, v({1}), Direction::Reverse, nullptr);
+  EXPECT_EQ(cache.stats().hits, 1);
+  FlowLedger fg(g);
+  FlowPolicy p(fg, v({0}), v({1}), shortest_paths_config(), nullptr, &cache);
+  EXPECT_EQ(p.place(5).call_delivered, 0);
+  cache.freeze();
+  EXPECT_EQ(evaluate_demand(*g, v({0}), v({1}), EvaluationOptions {shortest_paths_config(), nullptr, &cache}).call_delivered, 0);
+}
+
+// S under every model: its only shortest route crosses the zero edge.
+TEST(ZeroCapacity, G8ForEveryModel) {
+  const auto g = graph_s();
+  const auto eb = place_once(g, {0}, {1}, shortest_paths_config(), 5);
+  EXPECT_EQ(eb.r.call_delivered, 0);
+  EXPECT_EQ(eb.r.call_undelivered, 5);
+  EXPECT_EQ(eb.r.termination, Termination::Exhausted);
+  EXPECT_TRUE(eb.r.routes_changed);
+  ASSERT_EQ(eb.records.size(), 1U);
+  EXPECT_EQ(eb.records[0].delivered, 0);
+  EXPECT_EQ(dag_edges(*eb.records[0].route), (std::vector<EdgeId>{0}));
+  EXPECT_EQ(eb.records[0].min_route_cost, 1);
+  EXPECT_TRUE(eb.records[0].edge_flows.empty());
+  const auto lossy = place_once(g, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy), 5);
+  EXPECT_EQ(lossy.r.call_delivered, 0);
+  EXPECT_EQ(lossy.r.call_edge_drops, (Drops {{0, 5}}));
+  EXPECT_EQ(lossy.r.termination, Termination::Complete);
+  ASSERT_EQ(lossy.records.size(), 1U);
+  EXPECT_EQ(lossy.records[0].offered, (Counter128 {0, 5}));
+  EXPECT_EQ(lossy.records[0].delivered, 0);
+  EXPECT_EQ(lossy.records[0].edge_drops, (std::vector<std::pair<EdgeId, Counter128>> {{0, Counter128 {0, 5}}}));
+  for (const auto a : {Admission::Lossless, Admission::Lossy}) {
+    const auto w = place_once(g, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Weighted, a), 5);
+    EXPECT_EQ(w.r.call_delivered, 0);
+    EXPECT_TRUE(w.r.call_edge_drops.empty());  // no member: the offer is lost at the source, never bypassed
+    EXPECT_EQ(w.r.call_source_drops, a == Admission::Lossy ? 5 : 0);
+    EXPECT_EQ(w.r.termination, Termination::NoActiveWeight);
+    ASSERT_EQ(w.records.size(), 1U);
+    EXPECT_EQ(dag_edges(*w.records[0].route), (std::vector<EdgeId>{0}));
+    EXPECT_EQ(w.records[0].min_route_cost, 1);
+    EXPECT_TRUE(w.records[0].edge_flows.empty());
+    if (a == Admission::Lossy) EXPECT_EQ(w.records[0].offered, (Counter128 {0, 5}));
+  }
+  const auto mf = place_once(g, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Optimized), 5);
+  EXPECT_EQ(mf.r.call_delivered, 0);
+  EXPECT_EQ(mf.r.termination, Termination::Exhausted);
+  const auto single =
+      place_once(g, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossless,
+                                  sel(RouteTieBreak::FewerHops, false)), 5);
+  EXPECT_EQ(single.r.call_delivered, 0);
+  EXPECT_EQ(place_once(g, {0}, {1}, global_config(), 5).r.call_delivered, 5);
+  // T1: the request of 5 filters the zero link out: the tunnel comes up over 0 -> 2 -> 1.
+  const auto tunnel = replace_once(g, {0}, {1}, t1(1), 5, 5);
+  EXPECT_EQ(tunnel.r.call_delivered, 5);
+  ASSERT_EQ(tunnel.r.program->tunnels().size(), 1U);
+  EXPECT_EQ(tunnel.r.program->tunnels()[0].edges, (std::optional<std::vector<EdgeId>> {{1, 2}}));
+}
+
+// A zero-capacity member first, last and deeper, and the parallel-member choice.
+TEST(ZeroCapacity, EqualSplitsKeepTheZeroMemberWeightedSplitsPruneIt) {
+  struct Want {
+    Amount eb_lossless, eb_lossy;
+    Drops drops;
+    Amount weighted, maxflow;
+  };
+  auto check = [](const std::shared_ptr<const Graph>& g, NodeId dst, const Want& w, const std::string& where) {
+    EXPECT_EQ(place_once(g, {0}, {dst}, shortest_paths_config(), 10).r.call_delivered, w.eb_lossless) << where;
+    const auto lossy = place_once(g, {0}, {dst}, cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy), 10);
+    EXPECT_EQ(lossy.r.call_delivered, w.eb_lossy) << where;
+    EXPECT_EQ(lossy.r.call_edge_drops, w.drops) << where;
+    for (const auto a : {Admission::Lossless, Admission::Lossy}) {
+      const auto wt = place_once(g, {0}, {dst}, cfg(ShortestPaths {}, RouteAllocation::Weighted, a), 10);
+      EXPECT_EQ(wt.r.call_delivered, w.weighted) << where;
+      EXPECT_TRUE(wt.r.call_edge_drops.empty()) << where;
+    }
+    EXPECT_EQ(place_once(g, {0}, {dst}, cfg(ShortestPaths {}, RouteAllocation::Optimized), 10).r.call_delivered, w.maxflow) << where;
+  };
+  const auto first = ordered(2, {{0, 1, 0, 1}, {0, 1, 10, 1}});
+  check(first, 1, {0, 5, {{0, 5}}, 10, 10}, "zero first");
+  check(ordered(2, {{0, 1, 10, 1}, {0, 1, 0, 1}}), 1, {1, 5, {{1, 5}}, 10, 10}, "zero last");
+  const auto deep = ordered(4, {{0, 1, 10, 1}, {0, 2, 10, 1}, {1, 3, 10, 1}, {2, 3, 0, 1}});
+  check(deep, 3, {1, 5, {{3, 5}}, 10, 10}, "zero deeper");
+  const auto w = place_once(deep, {0}, {3}, cfg(ShortestPaths {}, RouteAllocation::Weighted), 10);
+  ASSERT_EQ(w.records.size(), 1U);
+  EXPECT_EQ(w.records[0].edge_flows, (std::vector<std::pair<EdgeId, Amount>> {{0, 10}, {2, 10}}));
+  // One member per pair; HIGHER_HEADROOM reads the working residual, 0/0 on the zero link being 0
+  // (were it compared equal to every value, the lower EdgeId 0 would stay).
+  auto collapsed = [&](RouteTieBreak t) {
+    return place_once(first, {0}, {1},
+                      cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossless, sel(t, true, false)), 10)
+        .r.call_delivered;
+  };
+  EXPECT_EQ(collapsed(RouteTieBreak::FewerHops), 0);
+  EXPECT_EQ(collapsed(RouteTieBreak::HigherCapacity), 10);
+  EXPECT_EQ(collapsed(RouteTieBreak::HigherHeadroom), 10);
+  EXPECT_EQ(collapsed(RouteTieBreak::HigherAvailableCapacity), 10);
+  const auto head = place_once(first, {0}, {1},
+                               cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossless,
+                                   sel(RouteTieBreak::HigherHeadroom, false)), 10);
+  EXPECT_EQ(head.r.call_delivered, 10);  // the canonical single path by bottleneck: HIGHER_HEADROOM 1 over 0
+}
+
+// The first-hop experiment, a stale WCMP member of capacity 0, all weights zero and a link of
+// service 0.
+TEST(ZeroCapacity, LossyInjectionAndAllZeroWeights) {
+  const auto lossy_eb = cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy);
+  const auto first = ordered(2, {{0, 1, 0, 1}, {0, 1, 10, 1}});
+  EXPECT_EQ(evaluate_demand(*first, v({0}), v({1}), EvaluationOptions {lossy_eb}).call_delivered, 10);
+  const auto s = evaluate_demand(*graph_s(), v({0}), v({1}), EvaluationOptions {lossy_eb});
+  EXPECT_EQ(s.call_delivered, 0);
+  EXPECT_EQ(s.termination, Termination::Exhausted);
+  const auto wcmp = ordered(2, {{0, 1, 0, 1}, {0, 1, 40, 1}});
+  for (const auto a : {Admission::Lossless, Admission::Lossy}) {
+    EXPECT_EQ(place_once(wcmp, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Weighted, a), 40).r.call_delivered, 40);
+  }
+  const auto one = ordered(2, {{0, 1, 0, 1}});
+  const auto w = place_once(one, {0}, {1}, cfg(ShortestPaths {}, RouteAllocation::Weighted, Admission::Lossy), 2);
+  EXPECT_EQ(w.r.call_delivered, 0);
+  EXPECT_EQ(w.r.call_undelivered, 2);
+  EXPECT_TRUE(w.r.call_edge_drops.empty());
+  EXPECT_EQ(w.r.call_source_drops, 2);
+  EXPECT_EQ(w.r.termination, Termination::NoActiveWeight);
+  ASSERT_EQ(w.records.size(), 1U);
+  EXPECT_EQ(w.records[0].offered, (Counter128 {0, 2}));  // 2 offered, 0 delivered, no drop: lost at the source
+  EXPECT_EQ(w.records[0].delivered, 0);
+  const auto d = place_once(one, {0}, {1}, lossy_eb, 2);
+  EXPECT_EQ(d.r.call_delivered, 0);
+  EXPECT_EQ(d.r.call_edge_drops, (Drops {{0, 2}}));
+  EXPECT_EQ(d.r.termination, Termination::Complete);
+}
+
+// A zero-capacity first or second source, and its deletion, under the equal source allocation: a
+// source behind a zero-capacity link stays in the roster and receives its share, which Lossless
+// admits only when it is 0 (0 when it is the first source, 1 when the second) and Lossy loses.
+TEST(ZeroCapacity, ZeroCapacitySourcesStayInTheRoster) {
+  const auto b = graph_b(0, 10);
+  const auto ll = place_once(b, {0, 1}, {2}, shortest_paths_config(), 10);
+  EXPECT_EQ(ll.r.call_delivered, 0);
+  EXPECT_EQ(ll.r.termination, Termination::Exhausted);
+  ASSERT_EQ(ll.records.size(), 2U);
+  EXPECT_EQ(ll.records[0].sources, v({0}));
+  EXPECT_EQ(ll.records[0].delivered, 0);
+  EXPECT_EQ(dag_edges(*ll.records[0].route), (std::vector<EdgeId>{0}));
+  EXPECT_EQ(ll.records[1].delivered, 0);
+  const auto lossy_eb = cfg(ShortestPaths {}, RouteAllocation::Equal, Admission::Lossy);
+  const auto ly = place_once(b, {0, 1}, {2}, lossy_eb, 10);
+  EXPECT_EQ(ly.r.call_delivered, 5);
+  EXPECT_EQ(ly.r.call_edge_drops, (Drops {{0, 5}}));
+  EXPECT_EQ(ly.r.termination, Termination::Complete);
+  const auto bp = graph_b(10, 0);
+  const auto pl = place_once(bp, {0, 1}, {2}, shortest_paths_config(), 10);
+  EXPECT_EQ(pl.r.call_delivered, 1);
+  const auto py = place_once(bp, {0, 1}, {2}, lossy_eb, 10);
+  EXPECT_EQ(py.r.call_delivered, 5);
+  EXPECT_EQ(py.r.call_edge_drops, (Drops {{1, 5}}));
+  // The source or its link excluded: the roster is [1].
+  const auto no_node = b->eligibility(std::vector<NodeId> {0}, {});
+  const auto no_link = b->eligibility({}, std::vector<EdgeId> {0});
+  for (const Eligibility* el : {&no_node, &no_link}) {
+    EXPECT_EQ(place_once(b, {0, 1}, {2}, shortest_paths_config(), 10, el).r.call_delivered, 10);
+    EXPECT_EQ(place_once(b, {0, 1}, {2}, global_config(), 10, el).r.call_delivered, 10);
+  }
+  // CentralizedTE keeps a zero-delivery record of source 0 with an empty route.
+  const auto gl = place_once(b, {0, 1}, {2}, global_config(), 10);
+  EXPECT_EQ(gl.r.call_delivered, 10);
+  EXPECT_EQ(gl.r.termination, Termination::Complete);
+  ASSERT_EQ(gl.records.size(), 2U);
+  EXPECT_EQ(gl.records[0].delivered, 0);
+  EXPECT_TRUE(dag_edges(*gl.records[0].route).empty());
+  EXPECT_EQ(gl.records[0].min_route_cost, kUnreachable);
+  // T1 (one tunnel per head, design 10: requests 5 and 5): head 0's link has no unreserved
+  // capacity, so its tunnel is down (NoBandwidth) and the head stays in the roster with its share
+  //: Lossless admits only totals that give it nothing, 0 as it is the first head; Lossy
+  // delivers head 1's 5 and loses head 0's 5 at the head. One record per entry, the down one too.
+  const auto ll_t1 = replace_once(b, {0, 1}, {2}, t1(1), 10, 10);
+  EXPECT_EQ(ll_t1.r.call_delivered, 0);
+  EXPECT_EQ(ll_t1.r.termination, Termination::Exhausted);
+  ASSERT_EQ(ll_t1.records.size(), 2U);
+  EXPECT_EQ(ll_t1.records[0].entry_id, std::optional<std::int32_t> {0});
+  EXPECT_EQ(ll_t1.r.by_tunnel[0].status, TunnelStatus::InsufficientBandwidth);
+  const auto ly_t1 = replace_once(b, {0, 1}, {2}, t1(1, Admission::Lossy), 10, 10);
+  EXPECT_EQ(ly_t1.r.call_delivered, 5);
+  EXPECT_EQ(ly_t1.r.call_source_drops, 5);
+  EXPECT_EQ(ly_t1.r.termination, Termination::Complete);
+}
+
+// T1's setup on X8 and the pool baseline of CostStretch(6/5), exact at equality.
+TEST(ZeroCapacity, T1RosterAndStretchBaseline) {
+  // X8: D = 4, N = 1: head 0's link has capacity 0 (NoBandwidth), head 1's is up; Lossy delivers
+  // head 1's 2 and loses head 0's 2.
+  const auto x8 = ordered(3, {{0, 2, 0, 1}, {1, 2, 8, 3}});
+  const auto r = replace_once(x8, {0, 1}, {2}, t1(1, Admission::Lossy), 4, 4);
+  EXPECT_EQ(r.r.call_delivered, 2);
+  EXPECT_EQ(r.r.call_source_drops, 2);
+  EXPECT_EQ(r.r.by_tunnel[0].status, TunnelStatus::InsufficientBandwidth);
+  EXPECT_EQ(r.r.by_tunnel[1].status, TunnelStatus::Up);
+  // CostStretch(6/5): c0 = 5 (the zero-capacity link counts) and 6 * 5 <= 6 * 5 exactly, so the
+  // only feasible path (cost 6) is admitted at equality: up, 1 delivered. At cost 7 it exceeds the
+  // ceiling: CostCeilingExceeded, nothing delivered, the share lost at the source.
+  for (const Cost cost : {Cost {6}, Cost {7}}) {
+    const auto h = ordered(2, {{0, 1, 0, 5}, {0, 1, 1, cost}});
+    const auto r = replace_once(h, {0}, {1}, t1(1, Admission::Lossy, CostStretch(6, 5)), 1, 1);
+    EXPECT_EQ(r.r.call_delivered, cost == 6 ? 1 : 0) << cost;
+    EXPECT_EQ(r.r.call_source_drops, cost == 6 ? 0 : 1) << cost;
+    EXPECT_EQ(r.r.by_tunnel[0].status, cost == 6 ? TunnelStatus::Up : TunnelStatus::CostCeilingExceeded) << cost;
+    EXPECT_EQ(r.r.termination, Termination::Complete) << cost;  // every tunnel down: not rule (3)
+    EXPECT_EQ(r.records.size(), 1U) << cost;
+  }
+}
+
+// Pinned split routes over a zero-capacity link (first or last): each
+// route is its own split context, the head's share split over them by round robin. Equal
+// keeps the zero link as a member, so the first unit (route 0) blocks a Lossless total: 0 when the
+// zero route comes first, 1 when it comes last; Lossy offer 4 sends 2 down each route and loses
+// the zero route's 2 on its link. A Weighted route over the zero link has no member (weight 0), so
+// a share it receives has no route: Lossless 0 again. CentralizedTE with the two links as its support (a
+// controller) carries 4.
+TEST(ZeroCapacity, PinnedRoutesKeepTheirZeroLinks) {
+  const auto p0 = ordered(2, {{0, 1, 0, 1}, {0, 1, 4, 1}});
+  const auto p1 = ordered(2, {{0, 1, 4, 1}, {0, 1, 0, 1}});
+  const auto two = [&](const std::shared_ptr<const Graph>& g, std::optional<RouteAllocation> k,
+                       Admission a = Admission::Lossless) {
+    return FlowPolicyConfig {.routing = pinned_dags(*g, 0, 1, {dag_of(*g, {0}), dag_of(*g, {1})}, k), .admission = a};
+  };
+  const auto first = place_once(p0, {0}, {1}, two(p0, std::nullopt), std::nullopt);
+  EXPECT_EQ(first.r.call_delivered, 0);
+  EXPECT_EQ(first.records.size(), 2U);
+  EXPECT_EQ(place_once(p1, {0}, {1}, two(p1, std::nullopt), std::nullopt).r.call_delivered, 1);
+  const auto lossy = place_once(p0, {0}, {1}, two(p0, std::nullopt, Admission::Lossy), 4);
+  EXPECT_EQ(lossy.r.call_delivered, 2);
+  EXPECT_EQ(lossy.r.call_edge_drops, (Drops {{0, 2}}));
+  EXPECT_EQ(place_once(p0, {0}, {1}, two(p0, RouteAllocation::Weighted), std::nullopt).r.call_delivered, 0);
+  const auto weighted_lossy = place_once(p0, {0}, {1}, two(p0, RouteAllocation::Weighted, Admission::Lossy), 4);
+  EXPECT_EQ(weighted_lossy.r.call_delivered, 2);
+  EXPECT_EQ(weighted_lossy.r.call_source_drops, 2);
+  EXPECT_EQ(place_once(p0, {0}, {1}, FlowPolicyConfig {.routing = centralized(SourceAllocation::Optimized, dag_of(*p0, {0, 1}))}, std::nullopt).r.call_delivered,
+            4);
+  const auto alone =
+      place_once(p0, {0}, {1}, FlowPolicyConfig {.routing = pinned_dags(*p0, 0, 1, {dag_of(*p0, {0})})}, 3);
+  EXPECT_EQ(alone.r.call_delivered, 0);
+  EXPECT_EQ(alone.r.termination, Termination::Exhausted);
+  ASSERT_EQ(alone.records.size(), 1U);
+  EXPECT_EQ(alone.records[0].delivered, 0);
+}
+
+// The plan of a Weighted split route with capacity weights. A route without a
+// zero-capacity edge is its own member set; a route with one keeps only the positive edges on the
+// walks that remain, its route and route cost unchanged.
+TEST(ZeroCapacity, WeightedRoutePlansKeepOnlyPositiveEdges) {
+  // 0: 0 -> 1 cap 0, 1: 0 -> 1 cap 4, 2: 0 -> 2 cap 3, 3: 1 -> 3 cap 5, 4: 2 -> 3 cap 0 (costs 1).
+  const auto g = ordered(4, {{0, 1, 0, 1}, {0, 1, 4, 1}, {0, 2, 3, 1}, {1, 3, 5, 1}, {2, 3, 0, 1}});
+  const NodeId dst[1] = {3};
+  auto plan = [&](std::vector<EdgeId> edges, Cost& cost) {
+    return detail::prepare_route(*g, RouteAllocation::Weighted, Admission::Lossless, detail::WeightSource {}, 0, dst,
+                             *dag_of(*g, std::move(edges)), &cost);
+  };
+  Cost cost = -1;
+  const auto positive = plan({1, 3}, cost);  // no zero-capacity edge: route == members
+  EXPECT_EQ(positive.support_edges, (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(positive.forwarding_edges, (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(positive.weights, (std::vector<Amount>{4, 5}));
+  EXPECT_EQ(cost, 2);
+  const auto mixed = plan({0, 1, 2, 3, 4}, cost);  // the zero links 0 and 4 drop; so does 2 (dead end)
+  EXPECT_EQ(mixed.support_edges, (std::vector<EdgeId>{0, 1, 2, 3, 4}));
+  EXPECT_EQ(mixed.forwarding_edges, (std::vector<EdgeId>{1, 3}));
+  EXPECT_EQ(mixed.weights, (std::vector<Amount>{4, 5}));
+  EXPECT_EQ(cost, 2);
+  const auto zero = plan({0, 3}, cost);  // every walk crosses a zero link: no member
+  EXPECT_EQ(zero.support_edges, (std::vector<EdgeId>{0, 3}));
+  EXPECT_TRUE(zero.forwarding_edges.empty());
+  EXPECT_TRUE(zero.weights.empty());
+  EXPECT_EQ(cost, 2);
+}
+
+// The evaluators.
+TEST(ZeroCapacity, EvaluatorsCountZeroCapacityRoutesAndCandidates) {
+  const auto s = graph_s();
+  const std::vector<std::pair<std::vector<NodeId>, std::vector<NodeId>>> pairs = {{{0}, {1}}, {{2}, {1}}};
+  const auto batch = evaluate_pairs(*s, pairs, EvaluationOptions {shortest_paths_config()}, {}, 1);
+  ASSERT_EQ(batch.size(), 2U);
+  EXPECT_EQ(batch[0].call_delivered, 0);
+  EXPECT_EQ(batch[1].call_delivered, 5);
+  // ShortestPaths's negative loss is in flow_policy_tests.cpp; CentralizedTE keeps its
+  // positive-flow candidates.
+  EXPECT_EQ(entries(evaluate_edge_failures(*s, v({0}), v({1}), EvaluationOptions {global_config()}, 1)),
+            (std::vector<std::pair<EdgeId, Amount>> {{1, 5}, {2, 5}}));
+  const auto b = graph_b(0, 10);
+  // ShortestPaths EB under the equal source allocation (the zero-capacity source first): the baseline is 0; deleting the zero link
+  // takes source 0 out of the roster and raises the total to 10 (loss -10); deleting link 1 leaves
+  // source 0 alone (0).
+  const auto eb = evaluate_edge_failures(*b, v({0, 1}), v({2}), EvaluationOptions {shortest_paths_config()}, 1);
+  EXPECT_EQ(eb.baseline.call_delivered, 0);
+  EXPECT_EQ(entries(eb), (std::vector<std::pair<EdgeId, Amount>> {{0, -10}, {1, 0}}));
+  // T1 with the design 10 (X8's shape): head 0 is down and first, so the
+  // baseline admits 0; deleting the zero link takes head 0 out of the roster and head 1's one
+  // tunnel carries 10 (loss -10); deleting link 1 leaves head 0 alone, down (0).
+  EvaluationOptions tq {t1(1)};
+  tq.design_demand = Amount {10};
+  const auto ca = evaluate_edge_failures(*b, v({0, 1}), v({2}), tq, 2);
+  EXPECT_EQ(ca.baseline.call_delivered, 0);
+  EXPECT_EQ(entries(ca), (std::vector<std::pair<EdgeId, Amount>> {{0, -10}, {1, 0}}));
+  const auto p0 = ordered(2, {{0, 1, 0, 1}, {0, 1, 4, 1}});
+  const Pinned pin = pinned_dags(*p0, 0, 1, {dag_of(*p0, {0}), dag_of(*p0, {1})});
+  const auto ps = evaluate_edge_failures(*p0, v({0}), v({1}), EvaluationOptions {{.routing = pin}}, 1);
+  EXPECT_EQ(ps.baseline.call_delivered, 0);
+  EXPECT_EQ(entries(ps), (std::vector<std::pair<EdgeId, Amount>> {{0, -4}, {1, 0}}));
+}
+
+// CentralizedTE's minimum cut lists the zero-capacity link leaving the closure (value unchanged);
+// an excluded link is never listed.
+TEST(ZeroCapacity, GlobalMinCutListsZeroCapacityLinksLeavingTheClosure) {
+  const OutputOptions want {false, false, true, true};
+  const auto b = graph_b(0, 10);
+  const auto rb = evaluate_demand(*b, v({0, 1}), v({2}), EvaluationOptions {global_config(), nullptr, nullptr, want});
+  EXPECT_EQ(rb.call_delivered, 10);
+  EXPECT_EQ(rb.min_cut, (std::optional<std::vector<EdgeId>> {{0, 1}}));
+  const auto s = graph_s();
+  const auto rs = evaluate_demand(*s, v({0}), v({1}), EvaluationOptions {global_config(), nullptr, nullptr, want});
+  EXPECT_EQ(rs.call_delivered, 5);
+  EXPECT_EQ(rs.min_cut, (std::optional<std::vector<EdgeId>> {{0, 1}}));
+  const auto no_zero = s->eligibility({}, std::vector<EdgeId> {0});
+  const auto rm = evaluate_demand(*s, v({0}), v({1}), EvaluationOptions {global_config(), &no_zero, nullptr, want});
+  EXPECT_EQ(rm.min_cut, (std::optional<std::vector<EdgeId>> {{1}}));
+}
diff --git a/tests/data/policy_fixtures.json b/tests/data/policy_fixtures.json
new file mode 100644
index 0000000..9855e70
--- /dev/null
+++ b/tests/data/policy_fixtures.json
@@ -0,0 +1 @@
+{"format":"p2-fixtures/1","source":"prototype 2 of the design tree dev/design/2026-10-streamline (untracked by design): prototypes/p2_transaction in integer units (APPROACH 9), exported by gates/1c/export_fixture_data.py","fixtures":[{"name":"four_calls_MaxFlow","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":2},"trace":{"prepare":{"0":[0,1,2,3]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0,1,0],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1]]}},"ledger":{"allocated":[1,0,1,0],"residual":[4,5,4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":4},"trace":{"prepare":null,"cap":2,"flow_core":{"placed":2,"edge_flows":[2,0,2,0],"supply":{"0":2}},"shares":{"0":[[0,2],[2,2]]}},"ledger":{"allocated":[2,0,2,0],"residual":[3,5,3,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,2],[2,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,2],[2,2]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":6},"trace":{"prepare":null,"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0,3,0],"supply":{"0":3}},"shares":{"0":[[0,3],[2,3]]}},"ledger":{"allocated":[3,0,3,0],"residual":[2,5,2,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,3],[2,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[0,3],[2,3]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0,"total_cost":8},"trace":{"prepare":null,"cap":4,"flow_core":{"placed":4,"edge_flows":[4,0,4,0],"supply":{"0":4}},"shares":{"0":[[0,4],[2,4]]}},"ledger":{"allocated":[4,0,4,0],"residual":[1,5,1,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":4,"edges":[[0,4],[2,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":4,"delivered":4,"alloc":[[0,4],[2,4]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":2},"trace":{"prepare":{"0":[0,1,2,3]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0,1,0],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1]]}},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":4},"trace":{"prepare":null,"cap":2,"flow_core":{"placed":2,"edge_flows":[1,1,1,1],"supply":{"0":2}},"shares":{"0":[[0,1],[1,1],[2,1],[3,1]]}},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":6},"trace":{"prepare":null,"cap":3,"flow_core":{"placed":3,"edge_flows":[1,2,1,2],"supply":{"0":3}},"shares":{"0":[[0,1],[1,2],[2,1],[3,2]]}},"ledger":{"allocated":[1,2,1,2],"residual":[0,8,0,8],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,1],[1,2],[2,1],[3,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[0,1],[1,2],[2,1],[3,2]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0,"total_cost":8},"trace":{"prepare":null,"cap":4,"flow_core":{"placed":4,"edge_flows":[1,3,1,3],"supply":{"0":4}},"shares":{"0":[[0,1],[1,3],[2,1],[3,3]]}},"ledger":{"allocated":[1,3,1,3],"residual":[0,7,0,7],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":4,"edges":[[0,1],[1,3],[2,1],[3,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":4,"delivered":4,"alloc":[[0,1],[1,3],[2,1],[3,3]]}]]]}}}]},{"name":"four_calls_W","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,1]},"ledger":{"allocated":[1,0,1,0],"residual":[4,5,4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,2]},"ledger":{"allocated":[1,1,1,1],"residual":[4,4,4,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[2,3]},"ledger":{"allocated":[2,1,2,1],"residual":[3,4,3,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,2],[1,1],[2,2],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[0,2],[1,1],[2,2],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[3,4]},"ledger":{"allocated":[2,2,2,2],"residual":[3,3,3,3],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":4,"edges":[[0,2],[1,2],[2,2],[3,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":4,"delivered":4,"alloc":[[0,2],[1,2],[2,2],[3,2]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,1]},"ledger":{"allocated":[0,1,0,1],"residual":[1,9,1,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[1,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[1,1],[3,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,2]},"ledger":{"allocated":[0,2,0,2],"residual":[1,8,1,8],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[1,2],[3,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[1,2],[3,2]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[2,3]},"ledger":{"allocated":[0,3,0,3],"residual":[1,7,1,7],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[1,3],[3,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[1,3],[3,3]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[3,4]},"ledger":{"allocated":[0,4,0,4],"residual":[1,6,1,6],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":4,"edges":[[1,4],[3,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":4,"delivered":4,"alloc":[[1,4],[3,4]]}]]]}}}]},{"name":"four_calls_EB","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,1]},"ledger":{"allocated":[1,0,1,0],"residual":[4,5,4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,2]},"ledger":{"allocated":[1,1,1,1],"residual":[4,4,4,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[2,3]},"ledger":{"allocated":[2,1,2,1],"residual":[3,4,3,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,2],[1,1],[2,2],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[0,2],[1,1],[2,2],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[3,4]},"ledger":{"allocated":[2,2,2,2],"residual":[3,3,3,3],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":4,"edges":[[0,2],[1,2],[2,2],[3,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":4,"delivered":4,"alloc":[[0,2],[1,2],[2,2],[3,2]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,1]},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":3,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":2},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}}]},{"name":"four_calls_Lossy","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,1,1,1,0,0]],"offered":1,"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"offers":{"0":1}},"ledger":{"allocated":[1,0,1,0],"residual":[4,5,4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":1,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,2,2,2,0,0]],"offered":2,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[2,0,2,0],"residual":[3,5,3,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":2,"delivered":2,"edges":[[0,2],[2,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":2,"alloc":[[0,2],[2,2]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,3,3,3,0,0]],"offered":3,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[3,0,3,0],"residual":[2,5,2,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":3,"delivered":3,"edges":[[0,3],[2,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":3,"alloc":[[0,3],[2,3]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,4,4,4,0,0]],"offered":4,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[4,0,4,0],"residual":[1,5,1,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":4,"delivered":4,"edges":[[0,4],[2,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":4,"alloc":[[0,4],[2,4]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,1,1,1,0,0]],"offered":1,"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"offers":{"0":1}},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":1,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[[0,1]],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":1,"source_loss":0,"drops":[[0,1]],"by_source":[[0,2,2,1,0,1]],"offered":2,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":2,"delivered":1,"edges":[[0,1],[2,1]],"drops":[[0,1]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[[0,1]],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":1,"source_loss":0,"drops":[[0,2]],"by_source":[[0,3,3,1,0,2]],"offered":3,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":3,"delivered":1,"edges":[[0,1],[2,1]],"drops":[[0,2]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[[0,1]],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":4,"delivered":1,"source_loss":0,"drops":[[0,3]],"by_source":[[0,4,4,1,0,3]],"offered":4,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":4,"delivered":1,"edges":[[0,1],[2,1]],"drops":[[0,3]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}}]},{"name":"eb_unequal_1_10","graphs":[{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,1]},"ledger":{"allocated":[1,0,1,0],"residual":[0,10,0,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":3,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":2},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,1,1],"residual":[0,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}}]},{"name":"cancellation_dag","graphs":[{"n":6,"q":1.0,"edges":[[0,1,1,1],[0,2,1,1],[1,3,1,1],[1,4,1,1],[2,3,1,1],[3,5,1,1],[4,5,1,1]],"input_index":[0,1,2,3,4,5,6]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":5,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":3},"trace":{"prepare":{"0":[0,1,2,3,4,5,6]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0,1,0,0,1,0],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1],[5,1]]}},"ledger":{"allocated":[1,0,1,0,0,1,0],"residual":[0,1,0,1,1,0,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[5],"admission":"Lossless","bundle":[0,1,2,3,4,5,6],"route_cost":3,"offered":null,"delivered":1,"edges":[[0,1],[2,1],[5,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2,3,4,5,6],"T":1,"delivered":1,"alloc":[[0,1],[2,1],[5,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":6},"trace":{"prepare":null,"cap":2,"flow_core":{"placed":2,"edge_flows":[1,1,0,1,1,1,1],"supply":{"0":2}},"shares":{"0":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]]}},"ledger":{"allocated":[1,1,0,1,1,1,1],"residual":[0,0,1,0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[5],"admission":"Lossless","bundle":[0,1,2,3,4,5,6],"route_cost":3,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3,4,5,6],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":5,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":6},"trace":{"prepare":{"0":[0,1,2,3,4,5,6]},"cap":2,"flow_core":{"placed":2,"edge_flows":[1,1,0,1,1,1,1],"supply":{"0":2}},"shares":{"0":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]]}},"ledger":{"allocated":[1,1,0,1,1,1,1],"residual":[0,0,1,0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[5],"admission":"Lossless","bundle":[0,1,2,3,4,5,6],"route_cost":3,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3,4,5,6],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[3,1],[4,1],[5,1],[6,1]]}]]]}}}]},{"name":"lossy_diamond_10_then_1","graphs":[{"n":4,"q":1.0,"edges":[[0,1,10,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":10,"outputs":null,"error":false,"expect":{"result":{"placed":6,"remaining":4,"delivery_delta":6,"call_drops":[[2,4]],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":10,"admitted":10,"delivered":6,"source_loss":0,"drops":[[2,4]],"by_source":[[0,10,10,6,0,4]],"offered":10,"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"offers":{"0":10}},"ledger":{"allocated":[5,5,1,5],"residual":[5,5,0,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":10,"delivered":6,"edges":[[0,5],[1,5],[2,1],[3,5]],"drops":[[2,4]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":10,"infinite":false,"placed_demand":6,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":6,"alloc":[[0,5],[1,5],[2,1],[3,5]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[[2,1]],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":11,"admitted":11,"delivered":6,"source_loss":0,"drops":[[2,5]],"by_source":[[0,11,11,6,0,5]],"offered":11,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":1}},"ledger":{"allocated":[6,5,1,5],"residual":[4,5,0,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":11,"delivered":6,"edges":[[0,6],[1,5],[2,1],[3,5]],"drops":[[2,5]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":11,"infinite":false,"placed_demand":6,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":6,"alloc":[[0,6],[1,5],[2,1],[3,5]]}]]]}}}]},{"name":"inf_every_kernel","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,10,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":10,"remaining":"inf","delivery_delta":10,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":10,"delivered":10,"source_loss":0,"drops":[],"by_source":[[0,null,10,10,0,0]],"total_cost":20},"trace":{"prepare":{"0":[0,1,2,3]},"cap":null,"flow_core":{"placed":10,"edge_flows":[5,5,5,5],"supply":{"0":10}},"shares":{"0":[[0,5],[1,5],[2,5],[3,5]]}},"ledger":{"allocated":[5,5,5,5],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":10,"edges":[[0,5],[1,5],[2,5],[3,5]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":10,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":10,"delivered":10,"alloc":[[0,5],[1,5],[2,5],[3,5]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":10,"remaining":"inf","delivery_delta":10,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":10,"delivered":10,"source_loss":0,"drops":[],"by_source":[[0,null,10,10,0,0]]},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,10]},"ledger":{"allocated":[5,5,5,5],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":10,"edges":[[0,5],[1,5],[2,5],[3,5]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":10,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":10,"delivered":10,"alloc":[[0,5],[1,5],[2,5],[3,5]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":10,"remaining":"inf","delivery_delta":10,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":10,"delivered":10,"source_loss":0,"drops":[],"by_source":[[0,null,10,10,0,0]]},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,10]},"ledger":{"allocated":[5,5,5,5],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":10,"edges":[[0,5],[1,5],[2,5],[3,5]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":10,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":10,"delivered":10,"alloc":[[0,5],[1,5],[2,5],[3,5]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":3,"error":false},{"op":"policy","ledger":3,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":3,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":3,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":11,"remaining":"inf","delivery_delta":11,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":11,"delivered":11,"source_loss":0,"drops":[],"by_source":[[0,11,11,11,0,0]],"offered":11,"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"offers":{"0":"inf"}},"ledger":{"allocated":[1,10,1,10],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":11,"delivered":11,"edges":[[0,1],[1,10],[2,1],[3,10]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":11,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":11,"alloc":[[0,1],[1,10],[2,1],[3,10]]}]]]}}},{"op":"ledger","graph":2,"baseline":null,"id":4,"error":false},{"op":"policy","ledger":4,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":4,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":4,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":11,"remaining":"inf","delivery_delta":11,"call_drops":[[2,9]],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":20,"delivered":11,"source_loss":0,"drops":[[2,9]],"by_source":[[0,20,20,11,0,9]],"offered":20,"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"offers":{"0":"inf"}},"ledger":{"allocated":[10,10,1,10],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0,1,2,3],"route_cost":2,"offered":20,"delivered":11,"edges":[[0,10],[1,10],[2,1],[3,10]],"drops":[[2,9]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":11,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":null,"delivered":11,"alloc":[[0,10],[1,10],[2,1],[3,10]]}]]]}}}]},{"name":"weighted_frozen_third_party","graphs":[{"n":4,"q":1.0,"edges":[[0,1,10,1],[1,3,1,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,10,1],[1,3,2,1],[0,2,10,1],[2,3,10,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,2]},"ledger":{"allocated":[1,1,1,1],"residual":[9,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":3,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,1,1],"residual":[9,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2,3]},"T":[0,2]},"ledger":{"allocated":[1,1,1,1],"residual":[9,9,1,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"policy","ledger":1,"sources":1,"destinations":3,"config":{"routing":{"kind":"Global","support":[2]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[1,null,1,1,0,0]],"unadmitted":0,"total_cost":1},"trace":{"cap":1,"flow_core":{"placed":1,"edge_flows":[0,0,1,0],"supply":{"1":1}},"shares":{"1":[[2,1]]}},"ledger":{"allocated":[1,1,2,1],"residual":[9,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]},{"flow_id":1,"owner":1,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":1,"edges":[[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[1,[{"id":1,"route":[2],"T":1,"delivered":1,"alloc":[[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":3,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[2,2]},"ledger":{"allocated":[1,1,2,1],"residual":[9,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]},{"flow_id":1,"owner":1,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":1,"edges":[[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[2,1],[3,1]]}]]]}}},{"op":"remove","policy":2,"error":false,"expect":{"ledger":{"allocated":[1,1,1,1],"residual":[9,9,1,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[2,1],[3,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":4,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[2,3]},"ledger":{"allocated":[2,1,2,1],"residual":[8,9,0,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,2],[1,1],[2,2],[3,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":3,"delivered":3,"alloc":[[0,2],[1,1],[2,2],[3,1]]}]]]}}}]},{"name":"third_party_occupancy","graphs":[{"n":2,"q":1.0,"edges":[[0,1,10,1]],"input_index":[0]}],"ops":[{"op":"ledger","graph":0,"baseline":[8],"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":4,"remaining":0,"delivery_delta":4,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0,"total_cost":4},"trace":{"prepare":{"0":[0]},"cap":4,"flow_core":{"placed":4,"edge_flows":[4],"supply":{"0":4}},"shares":{"0":[[0,4]]}},"ledger":{"allocated":[4],"residual":[4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0],"T":4,"delivered":4,"alloc":[[0,4]]}]]]}}},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[7],"residual":[1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":1,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"place","policy":0,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":1,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":true,"requested":6,"admitted":5,"delivered":5,"source_loss":0,"drops":[],"by_source":[[0,null,5,5,0,0]],"unadmitted":1,"total_cost":5},"trace":{"prepare":null,"cap":6,"flow_core":{"placed":5,"edge_flows":[5],"supply":{"0":5}},"shares":{"0":[[0,5]]}},"ledger":{"allocated":[8],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":5,"edges":[[0,5]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":6,"infinite":false,"placed_demand":5,"cohorts":[[0,[{"id":0,"route":[0],"T":5,"delivered":5,"alloc":[[0,5]]}]]]}}},{"op":"ledger","graph":0,"baseline":[8],"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":4,"remaining":0,"delivery_delta":4,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0]},"T":[0,4]},"ledger":{"allocated":[4],"residual":[4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0],"T":4,"delivered":4,"alloc":[[0,4]]}]]]}}},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":3,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":3,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[7],"residual":[1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":1,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"place","policy":2,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":1,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":6,"admitted":5,"delivered":5,"source_loss":0,"drops":[],"by_source":[[0,null,5,5,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[4,5]},"ledger":{"allocated":[8],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":5,"edges":[[0,5]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":6,"infinite":false,"placed_demand":5,"cohorts":[[0,[{"id":0,"route":[0],"T":5,"delivered":5,"alloc":[[0,5]]}]]]}}},{"op":"ledger","graph":0,"baseline":[8],"id":2,"error":false},{"op":"policy","ledger":2,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":4,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":4,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":4,"remaining":0,"delivery_delta":4,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0]},"T":[0,4]},"ledger":{"allocated":[4],"residual":[4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0],"T":4,"delivered":4,"alloc":[[0,4]]}]]]}}},{"op":"policy","ledger":2,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":5,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":5,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[7],"residual":[1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":1,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"place","policy":4,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":1,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":6,"admitted":5,"delivered":5,"source_loss":0,"drops":[],"by_source":[[0,null,5,5,0,0]],"unadmitted":1},"trace":{"prepare":null,"T":[4,5]},"ledger":{"allocated":[8],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":5,"edges":[[0,5]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":6,"infinite":false,"placed_demand":5,"cohorts":[[0,[{"id":0,"route":[0],"T":5,"delivered":5,"alloc":[[0,5]]}]]]}}}]},{"name":"eb_1_plus_2_vs_3","graphs":[{"n":2,"q":1.0,"edges":[[0,1,10,1],[0,1,10,1],[0,1,10,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2]},"T":[0,1]},"ledger":{"allocated":[1,0,0],"residual":[9,10,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":1,"delivered":1,"alloc":[[0,1]]}]]]}}},{"op":"place","policy":0,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,3]},"ledger":{"allocated":[1,1,1],"residual":[9,9,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,1],[1,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":3,"delivered":3,"alloc":[[0,1],[1,1],[2,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2]},"T":[0,3]},"ledger":{"allocated":[1,1,1],"residual":[9,9,9],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,1],[1,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":3,"delivered":3,"alloc":[[0,1],[1,1],[2,1]]}]]]}}}]},{"name":"weighted_1_plus_5_vs_6","graphs":[{"n":2,"q":1.0,"edges":[[0,1,2,1],[0,1,2,1],[0,1,2,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2]},"T":[0,1]},"ledger":{"allocated":[1,0,0],"residual":[1,2,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":1,"delivered":1,"alloc":[[0,1]]}]]]}}},{"op":"place","policy":0,"volume":5,"outputs":null,"error":false,"expect":{"result":{"placed":5,"remaining":0,"delivery_delta":5,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":6,"admitted":6,"delivered":6,"source_loss":0,"drops":[],"by_source":[[0,null,6,6,0,0]],"unadmitted":0},"trace":{"prepare":null,"T":[1,6]},"ledger":{"allocated":[2,2,2],"residual":[0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":6,"edges":[[0,2],[1,2],[2,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":6,"infinite":false,"placed_demand":6,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":6,"delivered":6,"alloc":[[0,2],[1,2],[2,2]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":6,"outputs":null,"error":false,"expect":{"result":{"placed":6,"remaining":0,"delivery_delta":6,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":6,"admitted":6,"delivered":6,"source_loss":0,"drops":[],"by_source":[[0,null,6,6,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[0,1,2]},"T":[0,6]},"ledger":{"allocated":[2,2,2],"residual":[0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0,1,2],"route_cost":1,"offered":null,"delivered":6,"edges":[[0,2],[1,2],[2,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":6,"infinite":false,"placed_demand":6,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":6,"delivered":6,"alloc":[[0,2],[1,2],[2,2]]}]]]}}}]},{"name":"admission_zero_and_no_route","graphs":[{"n":4,"q":1.0,"edges":[[0,1,5,1],[1,3,5,1],[0,2,5,1],[2,3,5,1]],"input_index":[0,2,1,3]},{"n":4,"q":1.0,"edges":[[0,1,0,1],[1,3,0,1],[0,2,0,1],[2,3,0,1]],"input_index":[0,2,1,3]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":[1,3],"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"error":true},{"op":"ledger","graph":1,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1,"total_cost":0},"trace":{"prepare":{"0":[0,1,2,3]},"cap":1,"flow_core":{"placed":0,"edge_flows":[0,0,0,0],"supply":{"0":0}},"shares":{"0":[]}},"ledger":{"allocated":[0,0,0,0],"residual":[0,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,2,3],"route_cost":2,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":0,"route":[0,1,2,3],"T":0,"delivered":0,"alloc":[]}]]]}}}]},{"name":"flag_zero_delivery_creation","graphs":[{"n":2,"q":1.0,"edges":[[0,1,1,1]],"input_index":[0]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":1},"trace":{"cap":1,"flow_core":{"placed":1,"edge_flows":[1],"supply":{"0":1}},"shares":{"0":[[0,1]]}},"ledger":{"allocated":[1],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]]]}}},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[1],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":2,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":2},"trace":{"prepare":null,"T":[0,0]},"ledger":{"allocated":[1],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}}]},{"name":"sources_lossy_per_source","graphs":[{"n":6,"q":1.0,"edges":[[0,3,4,1],[1,3,4,1],[3,5,3,1],[1,4,4,2],[4,5,4,2]],"input_index":[0,1,3,2,4]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":5,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":8,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":5,"delivery_delta":3,"call_drops":[[3,5]],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":8,"admitted":8,"delivered":3,"source_loss":0,"drops":[[3,5]],"by_source":[[0,4,4,2,0,2],[1,4,4,1,0,3]],"offered":8,"unadmitted":0},"trace":{"prepare":{"0":[0,3],"1":[1,3]},"offers":{"0":4,"1":4}},"ledger":{"allocated":[4,4,0,3,0],"residual":[0,0,4,0,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[5],"admission":"Lossy","bundle":[0,3],"route_cost":2,"offered":4,"delivered":2,"edges":[[0,4],[3,2]],"drops":[[3,2]]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[5],"admission":"Lossy","bundle":[1,3],"route_cost":2,"offered":4,"delivered":1,"edges":[[1,4],[3,1]],"drops":[[3,3]]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":8,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,3],"T":null,"delivered":2,"alloc":[[0,4],[3,2]]}]],[1,[{"id":1,"route":[1,3],"T":null,"delivered":1,"alloc":[[1,4],[3,1]]}]]]}}}]},{"name":"sources_attribution","graphs":[{"n":4,"q":1.0,"edges":[[0,3,1,1],[1,2,10,1],[2,3,2,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":20,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":17,"delivery_delta":3,"call_drops":[[0,9],[2,8]],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":20,"admitted":20,"delivered":3,"source_loss":0,"drops":[[0,9],[2,8]],"by_source":[[0,10,10,1,0,9],[1,10,10,2,0,8]],"offered":20,"unadmitted":0},"trace":{"prepare":{"0":[0],"1":[1,2]},"offers":{"0":10,"1":10}},"ledger":{"allocated":[1,10,2],"residual":[0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0],"route_cost":1,"offered":10,"delivered":1,"edges":[[0,1]],"drops":[[0,9]]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossy","bundle":[1,2],"route_cost":2,"offered":10,"delivered":2,"edges":[[1,10],[2,2]],"drops":[[2,8]]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":20,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":null,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":null,"delivered":2,"alloc":[[1,10],[2,2]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":20,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":17,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":20,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,2,2,0,0]],"unadmitted":17,"total_cost":5},"trace":{"prepare":{"0":[0],"1":[1,2]},"cap":20,"flow_core":{"placed":3,"edge_flows":[1,2,2],"supply":{"0":1,"1":2}},"shares":{"0":[[0,1]],"1":[[1,2],[2,2]]}},"ledger":{"allocated":[1,2,2],"residual":[0,8,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":2,"edges":[[1,2],[2,2]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":20,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":2,"delivered":2,"alloc":[[1,2],[2,2]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":20,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":18,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":20,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]],"unadmitted":18},"trace":{"prepare":{"0":[0],"1":[1,2]},"T":[0,2]},"ledger":{"allocated":[1,1,1],"residual":[0,9,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":20,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":3,"error":false},{"op":"policy","ledger":3,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":3,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":3,"volume":20,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":18,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":20,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]],"unadmitted":18},"trace":{"prepare":{"0":[0],"1":[1,2]},"T":[0,2]},"ledger":{"allocated":[1,1,1],"residual":[0,9,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":20,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}}]},{"name":"sources_eb_per_source","graphs":[{"n":3,"q":1.0,"edges":[[0,2,4,1],[1,2,10,2]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":20,"outputs":null,"error":false,"expect":{"result":{"placed":8,"remaining":12,"delivery_delta":8,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":20,"admitted":8,"delivered":8,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0],[1,null,4,4,0,0]],"unadmitted":12},"trace":{"prepare":{"0":[0],"1":[1]},"T":[0,8]},"ledger":{"allocated":[4,4],"residual":[0,6],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":2,"offered":null,"delivered":4,"edges":[[1,4]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":20,"infinite":false,"placed_demand":8,"cohorts":[[0,[{"id":0,"route":[0],"T":4,"delivered":4,"alloc":[[0,4]]}]],[1,[{"id":1,"route":[1],"T":4,"delivered":4,"alloc":[[1,4]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":8,"remaining":"inf","delivery_delta":8,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":8,"delivered":8,"source_loss":0,"drops":[],"by_source":[[0,null,4,4,0,0],[1,null,4,4,0,0]]},"trace":{"prepare":{"0":[0],"1":[1]},"T":[0,8]},"ledger":{"allocated":[4,4],"residual":[0,6],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":4,"edges":[[0,4]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":2,"offered":null,"delivered":4,"edges":[[1,4]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":8,"cohorts":[[0,[{"id":0,"route":[0],"T":4,"delivered":4,"alloc":[[0,4]]}]],[1,[{"id":1,"route":[1],"T":4,"delivered":4,"alloc":[[1,4]]}]]]}}}]},{"name":"sources_augmentation_edges","graphs":[{"n":3,"q":1.0,"edges":[[0,2,1,2],[0,1,9,1],[1,2,9,1]],"input_index":[1,0,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":10,"remaining":"inf","delivery_delta":10,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":10,"delivered":10,"source_loss":0,"drops":[],"by_source":[[0,null,10,10,0,0]],"total_cost":20},"trace":{"prepare":{"0":[0,1,2]},"cap":null,"flow_core":{"placed":10,"edge_flows":[9,1,9],"supply":{"0":10}},"shares":{"0":[[0,9],[1,1],[2,9]]}},"ledger":{"allocated":[9,1,9],"residual":[0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,1,2],"route_cost":2,"offered":null,"delivered":10,"edges":[[0,9],[1,1],[2,9]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":10,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":10,"delivered":10,"alloc":[[0,9],[1,1],[2,9]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":"inf","delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]]},"trace":{"prepare":{"0":[0,1,2]},"T":[0,3]},"ledger":{"allocated":[2,1,2],"residual":[7,0,7],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,1,2],"route_cost":2,"offered":null,"delivered":3,"edges":[[0,2],[1,1],[2,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":true,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1,2],"T":3,"delivered":3,"alloc":[[0,2],[1,1],[2,2]]}]]]}}}]},{"name":"sources_inf_every_kernel","graphs":[{"n":4,"q":1.0,"edges":[[0,3,1,1],[1,2,10,1],[2,3,2,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":"inf","delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,2,2,0,0]],"total_cost":5},"trace":{"prepare":{"0":[0],"1":[1,2]},"cap":null,"flow_core":{"placed":3,"edge_flows":[1,2,2],"supply":{"0":1,"1":2}},"shares":{"0":[[0,1]],"1":[[1,2],[2,2]]}},"ledger":{"allocated":[1,2,2],"residual":[0,8,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":2,"edges":[[1,2],[2,2]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":2,"delivered":2,"alloc":[[1,2],[2,2]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":"inf","delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]]},"trace":{"prepare":{"0":[0],"1":[1,2]},"T":[0,2]},"ledger":{"allocated":[1,1,1],"residual":[0,9,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":"inf","delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]]},"trace":{"prepare":{"0":[0],"1":[1,2]},"T":[0,2]},"ledger":{"allocated":[1,1,1],"residual":[0,9,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":3,"error":false},{"op":"policy","ledger":3,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":3,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":3,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":"inf","delivery_delta":3,"call_drops":[[2,8]],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":11,"delivered":3,"source_loss":0,"drops":[[2,8]],"by_source":[[0,1,1,1,0,0],[1,10,10,2,0,8]],"offered":11,"unadmitted":0},"trace":{"prepare":{"0":[0],"1":[1,2]},"offers":{"0":"inf","1":"inf"}},"ledger":{"allocated":[1,10,2],"residual":[0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossy","bundle":[0],"route_cost":1,"offered":1,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossy","bundle":[1,2],"route_cost":2,"offered":10,"delivered":2,"edges":[[1,10],[2,2]],"drops":[[2,8]]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":null,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1,2],"T":null,"delivered":2,"alloc":[[1,10],[2,2]]}]]]}}}]},{"name":"sources_limits_and_validation","graphs":[{"n":5,"q":1.0,"edges":[[0,3,5,1],[1,3,5,1],[2,3,5,1],[4,0,1,1]],"input_index":[0,1,2,3]},{"n":3,"q":1.0,"edges":[[0,2,5,1],[2,1,5,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"error":true},{"op":"policy","ledger":0,"sources":[0,3],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"error":true},{"op":"policy","ledger":0,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":{"nodes":[0],"edges":[0,3]},"id":0,"error":false,"expect":{"policy":{"roster":[1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1,2],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1,2],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0],[1,null,0,0,0,0],[2,null,0,0,0,0]],"unadmitted":0,"total_cost":3},"trace":{"prepare":{"0":[0],"1":[1],"2":[2]},"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0,0,0],"supply":{"0":3,"1":0,"2":0}},"shares":{"0":[[0,3]],"1":[],"2":[]}},"ledger":{"allocated":[3,0,0,0],"residual":[2,5,5,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":2,"owner":0,"sources":[2],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":3,"bound":[0],"orphans":[]},"policy":{"roster":[0,1,2],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]],[1,[{"id":1,"route":[1],"T":0,"delivered":0,"alloc":[]}]],[2,[{"id":2,"route":[2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}}]},{"name":"sources_maxflow_vs_global","graphs":[{"n":4,"q":1.0,"edges":[[0,2,1,2],[1,2,1,1],[2,3,1,1],[0,3,1,5]],"input_index":[0,3,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":"inf","delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0],[1,null,1,1,0,0]],"total_cost":2},"trace":{"prepare":{"0":[0,3],"1":[2,3]},"cap":null,"flow_core":{"placed":1,"edge_flows":[0,0,1,1],"supply":{"0":0,"1":1}},"shares":{"0":[],"1":[[2,1],[3,1]]}},"ledger":{"allocated":[0,0,1,1],"residual":[1,1,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,3],"route_cost":3,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[2,1],[3,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,3],"T":0,"delivered":0,"alloc":[]}]],[1,[{"id":1,"route":[2,3],"T":1,"delivered":1,"alloc":[[2,1],[3,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":"inf","delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]],"total_cost":7,"cost_distribution":[[2,1],[5,1]]},"trace":{"V":[1,1,1,1],"cap":null,"flow_core":{"placed":2,"cost_distribution":[[2,1],[5,1]],"edge_flows":[0,1,1,1],"min_cut":[1,3],"potentials":[0,0,2,5],"supply":{"0":1,"1":1}},"shares":{"0":[[1,1]],"1":[[2,1],[3,1]]}},"ledger":{"allocated":[0,1,1,1],"residual":[1,0,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[1],"route_cost":5,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[2,3],"route_cost":2,"offered":null,"delivered":1,"edges":[[2,1],[3,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":true,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]],[1,[{"id":1,"route":[2,3],"T":1,"delivered":1,"alloc":[[2,1],[3,1]]}]]]}}}]},{"name":"sources_split_cumulative","graphs":[{"n":4,"q":1.0,"edges":[[0,3,10,1],[1,3,10,1],[2,3,10,1]],"input_index":[0,1,2]},{"n":3,"q":1.0,"edges":[[0,2,5,1],[1,2,5,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1,2],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1,2],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,0,0,0,0],[2,null,0,0,0,0]],"unadmitted":0,"total_cost":1},"trace":{"prepare":{"0":[0],"1":[1],"2":[2]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0,0],"supply":{"0":1,"1":0,"2":0}},"shares":{"0":[[0,1]],"1":[],"2":[]}},"ledger":{"allocated":[1,0,0],"residual":[9,10,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":2,"owner":0,"sources":[2],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":3,"bound":[0],"orphans":[]},"policy":{"roster":[0,1,2],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":0,"delivered":0,"alloc":[]}]],[2,[{"id":2,"route":[2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,0,0,0,0],[2,null,0,0,0,0]],"unadmitted":0,"total_cost":2},"trace":{"prepare":null,"cap":2,"flow_core":{"placed":2,"edge_flows":[2,0,0],"supply":{"0":2,"1":0,"2":0}},"shares":{"0":[[0,2]],"1":[],"2":[]}},"ledger":{"allocated":[2,0,0],"residual":[8,10,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":2,"owner":0,"sources":[2],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":3,"bound":[0],"orphans":[]},"policy":{"roster":[0,1,2],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":2,"delivered":2,"alloc":[[0,2]]}]],[1,[{"id":1,"route":[1],"T":0,"delivered":0,"alloc":[]}]],[2,[{"id":2,"route":[2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1,2],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1,2],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,0,0,0,0],[2,null,0,0,0,0]],"unadmitted":0,"total_cost":2},"trace":{"prepare":{"0":[0],"1":[1],"2":[2]},"cap":2,"flow_core":{"placed":2,"edge_flows":[2,0,0],"supply":{"0":2,"1":0,"2":0}},"shares":{"0":[[0,2]],"1":[],"2":[]}},"ledger":{"allocated":[2,0,0],"residual":[8,10,10],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":2,"owner":0,"sources":[2],"destinations":[3],"admission":"Lossless","bundle":[2],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":3,"bound":[0],"orphans":[]},"policy":{"roster":[0,1,2],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":2,"delivered":2,"alloc":[[0,2]]}]],[1,[{"id":1,"route":[1],"T":0,"delivered":0,"alloc":[]}]],[2,[{"id":2,"route":[2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":1,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,1,1,1,0,0],[1,0,0,0,0,0]],"offered":1,"unadmitted":0},"trace":{"prepare":{"0":[0],"1":[1]},"offers":{"0":1,"1":0}},"ledger":{"allocated":[1,0],"residual":[4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossy","bundle":[0],"route_cost":1,"offered":1,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossy","bundle":[1],"route_cost":1,"offered":0,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0],"T":null,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":null,"delivered":0,"alloc":[]}]]]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,1,1,1,0,0],[1,1,1,1,0,0]],"offered":2,"unadmitted":0},"trace":{"prepare":null,"offers":{"0":0,"1":1}},"ledger":{"allocated":[1,1],"residual":[4,4],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossy","bundle":[0],"route_cost":1,"offered":1,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossy","bundle":[1],"route_cost":1,"offered":1,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":null,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":null,"delivered":1,"alloc":[[1,1]]}]]]}}}]},{"name":"sources_1_9_request_4","graphs":[{"n":3,"q":1.0,"edges":[[0,2,1,1],[1,2,9,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":4,"remaining":0,"delivery_delta":4,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":4,"admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,3,3,0,0]],"unadmitted":0,"total_cost":4},"trace":{"prepare":{"0":[0],"1":[1]},"cap":4,"flow_core":{"placed":4,"edge_flows":[1,3],"supply":{"0":1,"1":3}},"shares":{"0":[[0,1]],"1":[[1,3]]}},"ledger":{"allocated":[1,3],"residual":[0,6],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":3,"edges":[[1,3]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":4,"infinite":false,"placed_demand":4,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":3,"delivered":3,"alloc":[[1,3]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"Weighted","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"},"weights":"ResidualSnapshot"},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":2,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]],"unadmitted":2},"trace":{"prepare":{"0":[0],"1":[1]},"T":[0,2]},"ledger":{"allocated":[1,1],"residual":[0,8],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":2,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,1,1,0,0]],"unadmitted":2},"trace":{"prepare":{"0":[0],"1":[1]},"T":[0,2]},"ledger":{"allocated":[1,1],"residual":[0,8],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}}]},{"name":"sources_partition_1_1_vs_2_0","graphs":[{"n":4,"q":1.0,"edges":[[0,2,2,1],[1,2,2,1],[2,3,2,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,0,0,0,0]],"unadmitted":0,"total_cost":4},"trace":{"prepare":{"0":[0,2],"1":[1,2]},"cap":2,"flow_core":{"placed":2,"edge_flows":[2,0,2],"supply":{"0":2,"1":0}},"shares":{"0":[[0,2],[2,2]],"1":[]}},"ledger":{"allocated":[2,0,2],"residual":[0,2,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,2],[2,2]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,2],"T":2,"delivered":2,"alloc":[[0,2],[2,2]]}]],[1,[{"id":1,"route":[1,2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"place","policy":0,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":2,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,0,0,0,0]],"unadmitted":2,"total_cost":4},"trace":{"prepare":null,"cap":4,"flow_core":{"placed":2,"edge_flows":[2,0,2],"supply":{"0":2,"1":0}},"shares":{"0":[[0,2],[2,2]],"1":[]}},"ledger":{"allocated":[2,0,2],"residual":[0,2,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,2],[2,2]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,2],"T":2,"delivered":2,"alloc":[[0,2],[2,2]]}]],[1,[{"id":1,"route":[1,2],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":[0,1],"destinations":3,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":2,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":4,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,0,0,0,0]],"unadmitted":2,"total_cost":4},"trace":{"prepare":{"0":[0,2],"1":[1,2]},"cap":4,"flow_core":{"placed":2,"edge_flows":[2,0,2],"supply":{"0":2,"1":0}},"shares":{"0":[[0,2],[2,2]],"1":[]}},"ledger":{"allocated":[2,0,2],"residual":[0,2,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":2,"edges":[[0,2],[2,2]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[3],"admission":"Lossless","bundle":[1,2],"route_cost":2,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":4,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,2],"T":2,"delivered":2,"alloc":[[0,2],[2,2]]}]],[1,[{"id":1,"route":[1,2],"T":0,"delivered":0,"alloc":[]}]]]}}}]},{"name":"termination_complete_and_no_route","graphs":[{"n":2,"q":1.0,"edges":[[0,1,1,1],[0,1,10,1]],"input_index":[0,1]},{"n":2,"q":1.0,"edges":[[1,0,1,1]],"input_index":[0]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossy","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":4,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":1,"delivery_delta":3,"call_drops":[[0,1]],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":4,"admitted":4,"delivered":3,"source_loss":0,"drops":[[0,1]],"by_source":[[0,4,4,3,0,1]],"offered":4,"unadmitted":0},"trace":{"prepare":{"0":[0,1]},"offers":{"0":4}},"ledger":{"allocated":[1,2],"residual":[0,8],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossy","bundle":[0,1],"route_cost":1,"offered":4,"delivered":3,"edges":[[0,1],[1,2]],"drops":[[0,1]]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":4,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0,1],"T":null,"delivered":3,"alloc":[[0,1],[1,2]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":0,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":0,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":0,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":0},"trace":{},"ledger":{"allocated":[0,0],"residual":[1,10],"records":[],"next_flow_id":0,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"ledger","graph":1,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"no_route","routes_changed":false,"weights_changed":false,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"roster":[]},"ledger":{"allocated":[0],"residual":[1],"records":[],"next_flow_id":0,"bound":[0],"orphans":[]},"policy":{"roster":[],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":"inf","delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"no_route","routes_changed":false,"weights_changed":false,"requested":"inf","admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]]},"trace":{"roster":[]},"ledger":{"allocated":[0],"residual":[1],"records":[],"next_flow_id":0,"bound":[0],"orphans":[]},"policy":{"roster":[],"requested":1,"infinite":true,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":true,"expect":{"ledger":{"allocated":[0],"residual":[1],"records":[],"next_flow_id":0,"bound":[0],"orphans":[]}}}]},{"name":"global_chain_plus_bypasses","graphs":[{"n":4,"q":1.0,"edges":[[0,1,1,1],[1,2,1,1],[2,3,1,1],[0,2,1,3],[1,3,1,3]],"input_index":[0,3,1,4,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":3,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":3,"cost_distribution":[[3,1]]},"trace":{"V":[1,1,1,1,1],"cap":1,"flow_core":{"placed":1,"cost_distribution":[[3,1]],"edge_flows":[1,0,1,0,1],"min_cut":null,"potentials":[0,1,2,3],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1],[4,1]]}},"ledger":{"allocated":[1,0,1,0,1],"residual":[0,1,0,1,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,2,4],"route_cost":3,"offered":null,"delivered":1,"edges":[[0,1],[2,1],[4,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,2,4],"T":1,"delivered":1,"alloc":[[0,1],[2,1],[4,1]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":8,"cost_distribution":[[3,1],[5,1]]},"trace":{"V":[1,1,1,1,1],"cap":2,"flow_core":{"placed":2,"cost_distribution":[[3,1],[5,1]],"edge_flows":[1,1,0,1,1],"min_cut":[0,1],"potentials":[0,2,3,5],"supply":{"0":2}},"shares":{"0":[[0,1],[1,1],[3,1],[4,1]]}},"ledger":{"allocated":[1,1,0,1,1],"residual":[0,0,1,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,3,4],"route_cost":4,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[3,1],[4,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,3,4],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[3,1],[4,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":3,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":2,"outputs":null,"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":8,"cost_distribution":[[3,1],[5,1]]},"trace":{"V":[1,1,1,1,1],"cap":2,"flow_core":{"placed":2,"cost_distribution":[[3,1],[5,1]],"edge_flows":[1,1,0,1,1],"min_cut":[0,1],"potentials":[0,2,3,5],"supply":{"0":2}},"shares":{"0":[[0,1],[1,1],[3,1],[4,1]]}},"ledger":{"allocated":[1,1,0,1,1],"residual":[0,0,1,0,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[3],"admission":"Lossless","bundle":[0,1,3,4],"route_cost":4,"offered":null,"delivered":2,"edges":[[0,1],[1,1],[3,1],[4,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0,1,3,4],"T":2,"delivered":2,"alloc":[[0,1],[1,1],[3,1],[4,1]]}]]]}}}]},{"name":"global_capped_underfill_control","graphs":[{"n":2,"q":1.0,"edges":[[0,1,3,7]],"input_index":[0]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":2,"outputs":[false,false,true,true],"error":false,"expect":{"result":{"placed":2,"remaining":0,"delivery_delta":2,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":2,"admitted":2,"delivered":2,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0]],"unadmitted":0,"total_cost":14,"cost_distribution":[[7,2]],"bottleneck":[]},"trace":{"V":[3],"cap":2,"flow_core":{"placed":2,"cost_distribution":[[7,2]],"edge_flows":[2],"min_cut":null,"potentials":[0,7],"supply":{"0":2}},"shares":{"0":[[0,2]]}},"ledger":{"allocated":[2],"residual":[1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":7,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":2,"cohorts":[[0,[{"id":0,"route":[0],"T":2,"delivered":2,"alloc":[[0,2]]}]]]}}},{"op":"place","policy":0,"volume":"inf","outputs":[false,false,true,true],"error":false,"expect":{"result":{"placed":1,"remaining":"inf","delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":true,"requested":"inf","admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"total_cost":21,"cost_distribution":[[7,3]],"bottleneck":[0],"min_cut":[0]},"trace":{"V":[3],"cap":null,"flow_core":{"placed":3,"cost_distribution":[[7,3]],"edge_flows":[3],"min_cut":[0],"potentials":[0,7],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3],"residual":[0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":7,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":true,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}}]},{"name":"global_zero_growth_support_change","graphs":[{"n":3,"q":1.0,"edges":[[0,1,1,1],[0,1,2,3],[1,2,2,1]],"input_index":[0,1,2]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":2,"config":{"routing":{"kind":"Global","support":[0,2]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":2},"trace":{"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0,1],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1]]}},"ledger":{"allocated":[1,0,1],"residual":[0,2,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0,2],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"policy","ledger":0,"sources":0,"destinations":2,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":4,"cost_distribution":[[4,1]]},"trace":{"V":[0,2,1],"cap":1,"flow_core":{"placed":1,"cost_distribution":[[4,1]],"edge_flows":[0,1,1],"min_cut":[2],"potentials":[0,3,4],"supply":{"0":1}},"shares":{"0":[[1,1],[2,1]]}},"ledger":{"allocated":[1,1,2],"residual":[0,1,0],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,1,1],"residual":[1,1,1],"records":[{"flow_id":1,"owner":1,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"policy","ledger":0,"sources":0,"destinations":2,"config":{"routing":{"kind":"Global","support":[1,2]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0,"total_cost":4},"trace":{"cap":1,"flow_core":{"placed":1,"edge_flows":[0,1,1],"supply":{"0":1}},"shares":{"0":[[1,1],[2,1]]}},"ledger":{"allocated":[0,2,2],"residual":[1,0,0],"records":[{"flow_id":1,"owner":1,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]},{"flow_id":2,"owner":2,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":3,"bound":[0,1,2],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":2,"route":[1,2],"T":1,"delivered":1,"alloc":[[1,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":false,"requested":2,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":1,"total_cost":2,"cost_distribution":[[2,1]]},"trace":{"V":[1,1,1],"cap":2,"flow_core":{"placed":1,"cost_distribution":[[2,1]],"edge_flows":[1,0,1],"min_cut":[2],"potentials":[0,3,2],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1]]}},"ledger":{"allocated":[1,1,2],"residual":[0,1,0],"records":[{"flow_id":1,"owner":1,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]},{"flow_id":2,"owner":2,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":3,"bound":[0,1,2],"orphans":[]},"policy":{"roster":[0],"requested":2,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[0,2],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":false,"weights_changed":false,"requested":3,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":2,"total_cost":2,"cost_distribution":[[2,1]]},"trace":{"V":[1,1,1],"cap":2,"flow_core":{"placed":1,"cost_distribution":[[2,1]],"edge_flows":[1,0,1],"min_cut":[2],"potentials":[0,3,2],"supply":{"0":1}},"shares":{"0":[[0,1],[2,1]]}},"ledger":{"allocated":[1,1,2],"residual":[0,1,0],"records":[{"flow_id":1,"owner":1,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0,2],"route_cost":2,"offered":null,"delivered":1,"edges":[[0,1],[2,1]],"drops":[]},{"flow_id":2,"owner":2,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[1,2],"route_cost":4,"offered":null,"delivered":1,"edges":[[1,1],[2,1]],"drops":[]}],"next_flow_id":3,"bound":[0,1,2],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[0,2],"T":1,"delivered":1,"alloc":[[0,1],[2,1]]}]]]}}}]},{"name":"global_epochs","graphs":[{"n":3,"q":1.0,"edges":[[0,2,2,3],[1,2,2,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"Global"},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":0,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":0,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":false,"weights_changed":false,"requested":0,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0],[1,null,0,0,0,0]],"unadmitted":0,"total_cost":0},"trace":{},"ledger":{"allocated":[0,0],"residual":[2,2],"records":[],"next_flow_id":0,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0],[1,null,1,1,0,0]],"unadmitted":0,"total_cost":1,"cost_distribution":[[1,1]]},"trace":{"V":[2,2],"cap":1,"flow_core":{"placed":1,"cost_distribution":[[1,1]],"edge_flows":[0,1],"min_cut":null,"potentials":[0,0,1],"supply":{"0":0,"1":1}},"shares":{"0":[],"1":[[1,1]]}},"ledger":{"allocated":[0,1],"residual":[2,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[],"route_cost":null,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[],"T":0,"delivered":0,"alloc":[]}]],[1,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[2,2],"records":[],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0],[1,null,1,1,0,0]],"unadmitted":0,"total_cost":1,"cost_distribution":[[1,1]]},"trace":{"V":[2,2],"cap":1,"flow_core":{"placed":1,"cost_distribution":[[1,1]],"edge_flows":[0,1],"min_cut":null,"potentials":[0,0,1],"supply":{"0":0,"1":1}},"shares":{"0":[],"1":[[1,1]]}},"ledger":{"allocated":[0,1],"residual":[2,1],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[],"route_cost":null,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":2,"route":[],"T":0,"delivered":0,"alloc":[]}]],[1,[{"id":3,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":"inf","delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":4,"delivered":4,"source_loss":0,"drops":[],"by_source":[[0,null,2,2,0,0],[1,null,2,2,0,0]],"total_cost":8,"cost_distribution":[[1,2],[3,2]]},"trace":{"V":[2,2],"cap":null,"flow_core":{"placed":4,"cost_distribution":[[1,2],[3,2]],"edge_flows":[2,2],"min_cut":[0,1],"potentials":[0,0,3],"supply":{"0":2,"1":2}},"shares":{"0":[[0,2]],"1":[[1,2]]}},"ledger":{"allocated":[2,2],"residual":[0,0],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":3,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":2,"edges":[[1,2]],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":true,"placed_demand":4,"cohorts":[[0,[{"id":2,"route":[0],"T":2,"delivered":2,"alloc":[[0,2]]}]],[1,[{"id":3,"route":[1],"T":2,"delivered":2,"alloc":[[1,2]]}]]]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":true,"expect":{"ledger":{"allocated":[2,2],"residual":[0,0],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":3,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":2,"edges":[[1,2]],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]}}},{"op":"place","policy":0,"volume":0,"outputs":null,"error":true,"expect":{"ledger":{"allocated":[2,2],"residual":[0,0],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":3,"offered":null,"delivered":2,"edges":[[0,2]],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":2,"edges":[[1,2]],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[2,2],"records":[],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0],[1,null,1,1,0,0]],"unadmitted":0,"total_cost":1,"cost_distribution":[[1,1]]},"trace":{"V":[2,2],"cap":1,"flow_core":{"placed":1,"cost_distribution":[[1,1]],"edge_flows":[0,1],"min_cut":null,"potentials":[0,0,1],"supply":{"0":0,"1":1}},"shares":{"0":[],"1":[[1,1]]}},"ledger":{"allocated":[0,1],"residual":[2,1],"records":[{"flow_id":4,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[],"route_cost":null,"offered":null,"delivered":0,"edges":[],"drops":[]},{"flow_id":5,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":6,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":4,"route":[],"T":0,"delivered":0,"alloc":[]}]],[1,[{"id":5,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}}]},{"name":"epochs_place_remove_place","graphs":[{"n":3,"q":1.0,"edges":[[0,2,5,1],[1,2,5,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":[0,1],"destinations":2,"config":{"routing":{"kind":"CostOnly"},"placement":"MaxFlow","admission":"Lossless","selection":{"multipath":true,"multi_edge":true,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,0,0,0,0]],"unadmitted":0,"total_cost":1},"trace":{"prepare":{"0":[0],"1":[1]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0],"supply":{"0":1,"1":0}},"shares":{"0":[[0,1]],"1":[]}},"ledger":{"allocated":[1,0],"residual":[4,5],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":1,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":0,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":1,"route":[1],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[5,5],"records":[],"next_flow_id":2,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,0,0,0,0]],"unadmitted":0,"total_cost":1},"trace":{"prepare":{"0":[0],"1":[1]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0],"supply":{"0":1,"1":0}},"shares":{"0":[[0,1]],"1":[]}},"ledger":{"allocated":[1,0],"residual":[4,5],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":2,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":3,"route":[1],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"place","policy":0,"volume":"inf","outputs":null,"error":false,"expect":{"result":{"placed":9,"remaining":"inf","delivery_delta":9,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":"inf","admitted":10,"delivered":10,"source_loss":0,"drops":[],"by_source":[[0,null,5,5,0,0],[1,null,5,5,0,0]],"total_cost":10},"trace":{"prepare":null,"cap":null,"flow_core":{"placed":10,"edge_flows":[5,5],"supply":{"0":5,"1":5}},"shares":{"0":[[0,5]],"1":[[1,5]]}},"ledger":{"allocated":[5,5],"residual":[0,0],"records":[{"flow_id":2,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":5,"edges":[[0,5]],"drops":[]},{"flow_id":3,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":5,"edges":[[1,5]],"drops":[]}],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":true,"placed_demand":10,"cohorts":[[0,[{"id":2,"route":[0],"T":5,"delivered":5,"alloc":[[0,5]]}]],[1,[{"id":3,"route":[1],"T":5,"delivered":5,"alloc":[[1,5]]}]]]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[5,5],"records":[],"next_flow_id":4,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0],[1,null,0,0,0,0]],"unadmitted":0,"total_cost":1},"trace":{"prepare":{"0":[0],"1":[1]},"cap":1,"flow_core":{"placed":1,"edge_flows":[1,0],"supply":{"0":1,"1":0}},"shares":{"0":[[0,1]],"1":[]}},"ledger":{"allocated":[1,0],"residual":[4,5],"records":[{"flow_id":4,"owner":0,"sources":[0],"destinations":[2],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":1,"edges":[[0,1]],"drops":[]},{"flow_id":5,"owner":0,"sources":[1],"destinations":[2],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":6,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":4,"route":[0],"T":1,"delivered":1,"alloc":[[0,1]]}]],[1,[{"id":5,"route":[1],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[5,5],"records":[],"next_flow_id":6,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"remove","policy":0,"error":false,"expect":{"ledger":{"allocated":[0,0],"residual":[5,5],"records":[],"next_flow_id":6,"bound":[0],"orphans":[]},"policy":{"roster":[0,1],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}}]},{"name":"collapse_projection_every_priority","graphs":[{"n":2,"q":1.0,"edges":[[0,1,3,1],[0,1,2,1]],"input_index":[0,1]}],"ops":[{"op":"ledger","graph":0,"baseline":null,"id":0,"error":false},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":0,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":0,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":0,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":1,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":1,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":1,"error":false},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":2,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":2,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":1,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"Deterministic","priority":"Capacity"}},"elig":null,"id":3,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":3,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":2,"error":false},{"op":"policy","ledger":2,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":4,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":4,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":2,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"Deterministic","priority":"Headroom"}},"elig":null,"id":5,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":5,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":3,"error":false},{"op":"policy","ledger":3,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":6,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":6,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":3,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Residual"}},"elig":null,"id":7,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":7,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[1]},"T":[0,1]},"ledger":{"allocated":[3,1],"residual":[0,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":4,"error":false},{"op":"policy","ledger":4,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":8,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":8,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":4,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Capacity"}},"elig":null,"id":9,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":9,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":5,"error":false},{"op":"policy","ledger":5,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":10,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":10,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":5,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":false,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Headroom"}},"elig":null,"id":11,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":11,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[1]},"T":[0,1]},"ledger":{"allocated":[3,1],"residual":[0,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":6,"error":false},{"op":"policy","ledger":6,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":12,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":12,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":6,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"Deterministic","priority":"Residual"}},"elig":null,"id":13,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":13,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":7,"error":false},{"op":"policy","ledger":7,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":14,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":14,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":7,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"Deterministic","priority":"Capacity"}},"elig":null,"id":15,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":15,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":8,"error":false},{"op":"policy","ledger":8,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":16,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":16,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":8,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"Deterministic","priority":"Headroom"}},"elig":null,"id":17,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":17,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":9,"error":false},{"op":"policy","ledger":9,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":18,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":18,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":9,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Residual"}},"elig":null,"id":19,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":19,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[1]},"T":[0,1]},"ledger":{"allocated":[3,1],"residual":[0,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":10,"error":false},{"op":"policy","ledger":10,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":20,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":20,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":10,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Capacity"}},"elig":null,"id":21,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":21,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":0,"remaining":1,"delivery_delta":0,"call_drops":[],"call_source_loss":0,"termination":"exhausted","routes_changed":true,"weights_changed":true,"requested":1,"admitted":0,"delivered":0,"source_loss":0,"drops":[],"by_source":[[0,null,0,0,0,0]],"unadmitted":1},"trace":{"prepare":{"0":[0]},"T":[0,0]},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":0,"edges":[],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":0,"cohorts":[[0,[{"id":1,"route":[0],"T":0,"delivered":0,"alloc":[]}]]]}}},{"op":"ledger","graph":0,"baseline":null,"id":11,"error":false},{"op":"policy","ledger":11,"sources":0,"destinations":1,"config":{"routing":{"kind":"Global","support":[0]},"placement":null,"admission":"Lossless","selection":null},"elig":null,"id":22,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":22,"volume":3,"outputs":null,"error":false,"expect":{"result":{"placed":3,"remaining":0,"delivery_delta":3,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":3,"admitted":3,"delivered":3,"source_loss":0,"drops":[],"by_source":[[0,null,3,3,0,0]],"unadmitted":0,"total_cost":3},"trace":{"cap":3,"flow_core":{"placed":3,"edge_flows":[3,0],"supply":{"0":3}},"shares":{"0":[[0,3]]}},"ledger":{"allocated":[3,0],"residual":[0,2],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]}],"next_flow_id":1,"bound":[0],"orphans":[]},"policy":{"roster":[0],"requested":3,"infinite":false,"placed_demand":3,"cohorts":[[0,[{"id":0,"route":[0],"T":3,"delivered":3,"alloc":[[0,3]]}]]]}}},{"op":"policy","ledger":11,"sources":0,"destinations":1,"config":{"routing":{"kind":"CostOnly"},"placement":"EqualBalanced","admission":"Lossless","selection":{"multipath":true,"multi_edge":false,"tie_break":"PreferHigherPriority","priority":"Headroom"}},"elig":null,"id":23,"error":false,"expect":{"policy":{"roster":[0],"requested":0,"infinite":false,"placed_demand":0,"cohorts":[]}}},{"op":"place","policy":23,"volume":1,"outputs":null,"error":false,"expect":{"result":{"placed":1,"remaining":0,"delivery_delta":1,"call_drops":[],"call_source_loss":0,"termination":"complete","routes_changed":true,"weights_changed":true,"requested":1,"admitted":1,"delivered":1,"source_loss":0,"drops":[],"by_source":[[0,null,1,1,0,0]],"unadmitted":0},"trace":{"prepare":{"0":[1]},"T":[0,1]},"ledger":{"allocated":[3,1],"residual":[0,1],"records":[{"flow_id":0,"owner":0,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[0],"route_cost":1,"offered":null,"delivered":3,"edges":[[0,3]],"drops":[]},{"flow_id":1,"owner":1,"sources":[0],"destinations":[1],"admission":"Lossless","bundle":[1],"route_cost":1,"offered":null,"delivered":1,"edges":[[1,1]],"drops":[]}],"next_flow_id":2,"bound":[0,1],"orphans":[]},"policy":{"roster":[0],"requested":1,"infinite":false,"placed_demand":1,"cohorts":[[0,[{"id":1,"route":[1],"T":1,"delivered":1,"alloc":[[1,1]]}]]]}}}]}]}
diff --git a/tests/data/weighted_sources.json b/tests/data/weighted_sources.json
new file mode 100644
index 0000000..5400861
--- /dev/null
+++ b/tests/data/weighted_sources.json
@@ -0,0 +1,1519 @@
+[
+  {
+    "id": "W-witness",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          2,
+          16,
+          1
+        ],
+        [
+          1,
+          2,
+          8,
+          1
+        ],
+        [
+          1,
+          3,
+          8,
+          2
+        ],
+        [
+          2,
+          3,
+          8,
+          1
+        ],
+        [
+          2,
+          4,
+          8,
+          1
+        ],
+        [
+          3,
+          5,
+          8,
+          1
+        ],
+        [
+          4,
+          5,
+          8,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1
+      ],
+      "destinations": [
+        5
+      ],
+      "source_weights": [
+        2,
+        1,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1
+      ],
+      "program_source_weights": [
+        [
+          0,
+          2
+        ],
+        [
+          1,
+          1
+        ]
+      ],
+      "delivered": 16,
+      "termination": "EXHAUSTED",
+      "by_source": [
+        [
+          0,
+          11
+        ],
+        [
+          1,
+          5
+        ]
+      ],
+      "cost": 48,
+      "edge_flows": [
+        11,
+        0,
+        5,
+        3,
+        8,
+        8,
+        8
+      ],
+      "tunnels": [
+        [
+          0,
+          0,
+          [
+            0,
+            3,
+            5
+          ],
+          3
+        ],
+        [
+          1,
+          0,
+          [
+            0,
+            4,
+            6
+          ],
+          8
+        ],
+        [
+          2,
+          1,
+          [
+            2,
+            5
+          ],
+          5
+        ]
+      ]
+    }
+  },
+  {
+    "id": "W-witness-coarse",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          2,
+          2,
+          1
+        ],
+        [
+          1,
+          2,
+          1,
+          1
+        ],
+        [
+          1,
+          3,
+          1,
+          2
+        ],
+        [
+          2,
+          3,
+          1,
+          1
+        ],
+        [
+          2,
+          4,
+          1,
+          1
+        ],
+        [
+          3,
+          5,
+          1,
+          1
+        ],
+        [
+          4,
+          5,
+          1,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1
+      ],
+      "destinations": [
+        5
+      ],
+      "source_weights": [
+        2,
+        1,
+        0,
+        0,
+        0,
+        0
+      ],
+      "replays": [
+        3
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1
+      ],
+      "program_source_weights": [
+        [
+          0,
+          2
+        ],
+        [
+          1,
+          1
+        ]
+      ],
+      "delivered": 2,
+      "termination": "EXHAUSTED",
+      "by_source": [
+        [
+          0,
+          2
+        ],
+        [
+          1,
+          0
+        ]
+      ],
+      "cost": 6,
+      "edge_flows": [
+        2,
+        0,
+        0,
+        1,
+        1,
+        1,
+        1
+      ],
+      "tunnels": [
+        [
+          0,
+          0,
+          [
+            0,
+            3,
+            5
+          ],
+          1
+        ],
+        [
+          1,
+          0,
+          [
+            0,
+            4,
+            6
+          ],
+          1
+        ]
+      ],
+      "replays": [
+        {
+          "offer": 3,
+          "edge_flows": [
+            2,
+            0,
+            0,
+            1,
+            1,
+            1,
+            1
+          ],
+          "source_drops": [
+            0,
+            1
+          ],
+          "delivered": [
+            2,
+            0
+          ],
+          "demand_source_drops": 1,
+          "lossy_termination": "COMPLETE",
+          "lossless_termination": "EXHAUSTED"
+        }
+      ],
+      "lossless_bound": 2
+    }
+  },
+  {
+    "id": "W-replay-smaller",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          2,
+          16,
+          1
+        ],
+        [
+          1,
+          2,
+          8,
+          1
+        ],
+        [
+          1,
+          3,
+          8,
+          2
+        ],
+        [
+          2,
+          3,
+          8,
+          1
+        ],
+        [
+          2,
+          4,
+          8,
+          1
+        ],
+        [
+          3,
+          5,
+          8,
+          1
+        ],
+        [
+          4,
+          5,
+          8,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1
+      ],
+      "destinations": [
+        5
+      ],
+      "source_weights": [
+        2,
+        1,
+        0,
+        0,
+        0,
+        0
+      ],
+      "replays": [
+        16,
+        15
+      ]
+    },
+    "expected": {
+      "delivered": 16,
+      "replays": [
+        {
+          "offer": 16,
+          "edge_flows": [
+            11,
+            0,
+            5,
+            3,
+            8,
+            8,
+            8
+          ],
+          "source_drops": [
+            0,
+            0
+          ],
+          "delivered": [
+            11,
+            5
+          ],
+          "demand_source_drops": 0,
+          "lossy_termination": "COMPLETE",
+          "lossless_termination": "COMPLETE"
+        },
+        {
+          "offer": 15,
+          "edge_flows": [
+            10,
+            0,
+            5,
+            3,
+            7,
+            8,
+            7
+          ],
+          "source_drops": [
+            0,
+            0
+          ],
+          "delivered": [
+            10,
+            5
+          ],
+          "demand_source_drops": 0,
+          "lossy_termination": "COMPLETE",
+          "lossless_termination": "COMPLETE"
+        }
+      ],
+      "lossless_bound": 16
+    }
+  },
+  {
+    "id": "W-zero-weight",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          2,
+          5,
+          1
+        ],
+        [
+          1,
+          2,
+          5,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1
+      ],
+      "destinations": [
+        2
+      ],
+      "source_weights": [
+        0,
+        3,
+        0
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1
+      ],
+      "program_source_weights": [
+        [
+          0,
+          0
+        ],
+        [
+          1,
+          3
+        ]
+      ],
+      "delivered": 5,
+      "termination": "EXHAUSTED",
+      "by_source": [
+        [
+          0,
+          0
+        ],
+        [
+          1,
+          5
+        ]
+      ],
+      "cost": 5,
+      "edge_flows": [
+        0,
+        5
+      ],
+      "tunnels": [
+        [
+          0,
+          1,
+          [
+            1
+          ],
+          5
+        ]
+      ]
+    }
+  },
+  {
+    "id": "W-masked-source",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          3,
+          4,
+          1
+        ],
+        [
+          1,
+          3,
+          4,
+          1
+        ],
+        [
+          2,
+          3,
+          4,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1,
+        2
+      ],
+      "destinations": [
+        3
+      ],
+      "source_weights": [
+        1,
+        1,
+        2,
+        0
+      ],
+      "excluded_nodes": [
+        2
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1
+      ],
+      "program_source_weights": [
+        [
+          0,
+          1
+        ],
+        [
+          1,
+          1
+        ]
+      ],
+      "delivered": 8,
+      "termination": "EXHAUSTED",
+      "by_source": [
+        [
+          0,
+          4
+        ],
+        [
+          1,
+          4
+        ],
+        [
+          2,
+          0
+        ]
+      ],
+      "cost": 8,
+      "edge_flows": [
+        4,
+        4,
+        0
+      ],
+      "tunnels": [
+        [
+          0,
+          0,
+          [
+            0
+          ],
+          4
+        ],
+        [
+          1,
+          1,
+          [
+            1
+          ],
+          4
+        ]
+      ]
+    }
+  },
+  {
+    "id": "W-unmasked-source",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          3,
+          4,
+          1
+        ],
+        [
+          1,
+          3,
+          4,
+          1
+        ],
+        [
+          2,
+          3,
+          4,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1,
+        2
+      ],
+      "destinations": [
+        3
+      ],
+      "source_weights": [
+        1,
+        1,
+        2,
+        0
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1,
+        2
+      ],
+      "program_source_weights": [
+        [
+          0,
+          1
+        ],
+        [
+          1,
+          1
+        ],
+        [
+          2,
+          2
+        ]
+      ],
+      "delivered": 8,
+      "termination": "EXHAUSTED",
+      "by_source": [
+        [
+          0,
+          2
+        ],
+        [
+          1,
+          2
+        ],
+        [
+          2,
+          4
+        ]
+      ],
+      "cost": 8,
+      "edge_flows": [
+        2,
+        2,
+        4
+      ],
+      "tunnels": [
+        [
+          0,
+          0,
+          [
+            0
+          ],
+          2
+        ],
+        [
+          1,
+          1,
+          [
+            1
+          ],
+          2
+        ],
+        [
+          2,
+          2,
+          [
+            2
+          ],
+          4
+        ]
+      ]
+    }
+  },
+  {
+    "id": "W-all-zero",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          3,
+          4,
+          1
+        ],
+        [
+          1,
+          3,
+          4,
+          1
+        ],
+        [
+          2,
+          3,
+          4,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1,
+        2
+      ],
+      "destinations": [
+        3
+      ],
+      "source_weights": [
+        0,
+        0,
+        5,
+        0
+      ],
+      "excluded_nodes": [
+        2
+      ],
+      "offer": 6,
+      "replays": [
+        6
+      ]
+    },
+    "expected": {
+      "roster": [
+        0,
+        1
+      ],
+      "program_source_weights": [
+        [
+          0,
+          0
+        ],
+        [
+          1,
+          0
+        ]
+      ],
+      "delivered": 0,
+      "termination": "NO_ACTIVE_WEIGHT",
+      "by_source": [
+        [
+          0,
+          0
+        ],
+        [
+          1,
+          0
+        ],
+        [
+          2,
+          0
+        ]
+      ],
+      "cost": 0,
+      "edge_flows": [
+        0,
+        0,
+        0
+      ],
+      "tunnels": [],
+      "replays": [
+        {
+          "offer": 6,
+          "edge_flows": [
+            0,
+            0,
+            0
+          ],
+          "source_drops": [
+            0,
+            0
+          ],
+          "delivered": [
+            0,
+            0
+          ],
+          "demand_source_drops": 6,
+          "lossy_termination": "COMPLETE",
+          "lossless_termination": "EXHAUSTED"
+        }
+      ],
+      "lossless_bound": 0
+    }
+  },
+  {
+    "id": "W-empty-roster",
+    "oracle": "weighted_te",
+    "input": {
+      "edges": [
+        [
+          0,
+          3,
+          4,
+          1
+        ],
+        [
+          1,
+          3,
+          4,
+          1
+        ],
+        [
+          2,
+          3,
+          4,
+          1
+        ]
+      ],
+      "sources": [
+        0,
+        1,
+        2
+      ],
+      "destinations": [
+        3
+      ],
+      "source_weights": [
+        0,
+        0,
+        5,
+        0
+      ],
+      "excluded_nodes": [
+        0,
+        1,
+        2
+      ],
+      "offer": 6,
+      "replays": [
+        0,
+        6
+      ]
+    },
+    "expected": {
+      "roster": [],
+      "program_source_weights": [],
+      "delivered": 0,
+      "termination": "NO_ROUTE",
+      "replays": [
+        {
+          "offer": 0,
+          "edge_flows": [
+            0,
+            0,
+            0
+          ],
+          "source_drops": [],
+          "delivered": [],
+          "demand_source_drops": 0,
+          "lossy_termination": "COMPLETE",
+          "lossless_termination": "COMPLETE"
+        },
+        {
+          "offer": 6,
+          "edge_flows": [
+            0,
+            0,
+            0
+          ],
+          "source_drops": [],
+          "delivered": [],
+          "demand_source_drops": 6,
+          "lossy_termination": "NO_ROUTE",
+          "lossless_termination": "NO_ROUTE"
+        }
+      ],
+      "lossless_bound": 0
+    }
+  },
+  {
+    "id": "W-equal-weights",
+    "oracle": "weighted_equal",
+    "input": {
+      "edges": [
+        [
+          0,
+          3,
+          2,
+          1
+        ],
+        [
+          1,
+          2,
+          10,
+          1
+        ],
+        [
+          2,
+          3,
+          10,
+          2
+        ]
+      ],
+      "sources": [
+        0,
+        1
+      ],
+      "destinations": [
+        3
+      ],
+      "weight": 7,
+      "offer": 12
+    },
+    "expected": {
+      "weighted": {
+        "delivered": 4,
+        "cost": 8,
+        "edge_flows": [
+          2,
+          2,
+          2
+        ],
+        "by_source": [
+          [
+            0,
+            2
+          ],
+          [
+            1,
+            2
+          ]
+        ]
+      },
+      "equal": {
+        "delivered": 4,
+        "cost": 8,
+        "edge_flows": [
+          2,
+          2,
+          2
+        ]
+      }
+    }
+  },
+  {
+    "id": "W-config",
+    "oracle": "model_config",
+    "input": {
+      "cases": [
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED"
+          }
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "EQUAL",
+            "source_weights": [
+              "list",
+              1,
+              1,
+              0,
+              0
+            ]
+          }
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "OPTIMIZED",
+            "source_weights": [
+              "list",
+              1,
+              1,
+              0,
+              0
+            ]
+          }
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "tunnel_count": "2"
+          }
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "tunnel_count": "2",
+            "source_weights": [
+              "list",
+              1,
+              0,
+              0,
+              0
+            ]
+          }
+        },
+        {
+          "model": "ShortestPaths",
+          "kwargs": {
+            "source_allocation": "WEIGHTED"
+          }
+        },
+        {
+          "model": "ShortestPaths",
+          "kwargs": {
+            "allocation": "OPTIMIZED",
+            "source_allocation": "WEIGHTED"
+          }
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED"
+          },
+          "admission": "LOSSY"
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED"
+          },
+          "cache": true
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              1,
+              1,
+              0
+            ]
+          },
+          "cache": true,
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              1,
+              1,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              0,
+              -1,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              0,
+              4611686018427387904,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              1.5,
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "bool",
+                true
+              ],
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              18446744073709551616,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "list",
+                1
+              ],
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "str",
+              "1100"
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              2,
+              1,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              0,
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              1.5,
+              [
+                "list",
+                1
+              ],
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              18446744073709551616,
+              [
+                "list",
+                1
+              ],
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              18446744073709551616,
+              1.5,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              -1,
+              18446744073709551616,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "range",
+              4
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "range",
+              4
+            ]
+          },
+          "num_nodes": 5
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              18446744073709551616,
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4,
+          "admission": "LOSSY"
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "str",
+                "a"
+              ],
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        }
+      ]
+    },
+    "expected": [
+      "source_allocation=WEIGHTED requires source_weights",
+      "source_weights require source_allocation=WEIGHTED",
+      "source_weights require source_allocation=WEIGHTED",
+      "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+      "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+      "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+      "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+      "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+      "source_allocation=WEIGHTED requires source_weights",
+      "CentralizedTE does not use ShortestPathCache",
+      "source_weights: expected 4 entries",
+      "source_weights[1] must be an integer in [0, 2^62)",
+      "source_weights[1] must be an integer in [0, 2^62)",
+      "TypeError: source_weights[0] must be an integer (got float)",
+      "TypeError: source_weights[0] must be an integer (got bool)",
+      "ValueError: source_weights[0] must be an integer in [0, 2^62)",
+      "TypeError: source_weights must be a 1-D sequence of integers (entry 0 is a sequence)",
+      "TypeError: source_weights must be a 1-D sequence of integers (got str)",
+      "source_allocation=WEIGHTED support=None tunnel_count=None prefer_headroom=False source_weights=[2, 1, 0, 0]",
+      "source_allocation=WEIGHTED support=None tunnel_count=None prefer_headroom=False source_weights=[0, 0, 0, 0]",
+      "TypeError: source_weights must be a 1-D sequence of integers (entry 1 is a sequence)",
+      "TypeError: source_weights must be a 1-D sequence of integers (entry 1 is a sequence)",
+      "TypeError: source_weights[1] must be an integer (got float)",
+      "ValueError: source_weights[1] must be an integer in [0, 2^62)",
+      "source_allocation=WEIGHTED support=None tunnel_count=None prefer_headroom=False source_weights=[0, 1, 2, 3]",
+      "source_weights: expected 5 entries",
+      "ValueError: source_weights[0] must be an integer in [0, 2^62)",
+      "TypeError: source_weights[0] must be an integer (got str)"
+    ]
+  },
+  {
+    "id": "W-config-numpy",
+    "oracle": "model_config",
+    "input": {
+      "cases": [
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "uint64",
+              [
+                9223372036854775808,
+                0,
+                0,
+                0
+              ]
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "uint64",
+              [
+                9223372036854775808,
+                0,
+                0,
+                0
+              ]
+            ]
+          },
+          "num_nodes": 4,
+          "admission": "LOSSY"
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "int32",
+              [
+                2,
+                1,
+                0,
+                0
+              ]
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "float64",
+              [
+                1,
+                0,
+                0,
+                0
+              ]
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "int64",
+              [
+                [
+                  1,
+                  0,
+                  0,
+                  0
+                ]
+              ]
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "array",
+                "int64",
+                [
+                  1
+                ]
+              ],
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "array",
+                "int64",
+                1
+              ],
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "array",
+              "bool",
+              [
+                1,
+                0,
+                0,
+                0
+              ]
+            ]
+          },
+          "num_nodes": 4
+        },
+        {
+          "model": "CentralizedTE",
+          "kwargs": {
+            "source_allocation": "WEIGHTED",
+            "source_weights": [
+              "list",
+              [
+                "numpy",
+                "uint64",
+                9223372036854775808
+              ],
+              0,
+              0,
+              0
+            ]
+          },
+          "num_nodes": 4
+        }
+      ]
+    },
+    "expected": [
+      "ValueError: source_weights[0] must be an integer in [0, 2^62)",
+      "ValueError: source_weights[0] must be an integer in [0, 2^62)",
+      "source_allocation=WEIGHTED support=None tunnel_count=None prefer_headroom=False source_weights=[2, 1, 0, 0]",
+      "TypeError: source_weights entries must be integers (got dtype float64)",
+      "TypeError: source_weights must be a 1-D array (got 2 dimensions)",
+      "TypeError: source_weights must be a 1-D sequence of integers (entry 0 is a sequence)",
+      "source_allocation=WEIGHTED support=None tunnel_count=None prefer_headroom=False source_weights=[1, 0, 0, 0]",
+      "TypeError: source_weights entries must be integers (got dtype bool)",
+      "ValueError: source_weights[0] must be an integer in [0, 2^62)"
+    ]
+  }
+]
diff --git a/tests/py/concurrency_support.py b/tests/py/concurrency_support.py
new file mode 100644
index 0000000..df635b7
--- /dev/null
+++ b/tests/py/concurrency_support.py
@@ -0,0 +1,113 @@
+"""Parent-enforced progress checks with an explicitly selected native extension."""
+
+import os
+import subprocess
+import sys
+import textwrap
+from pathlib import Path
+
+import _netgraph_core
+
+ROOT = Path(__file__).resolve().parents[2]
+PREAMBLE = r"""
+import gc
+import importlib.util
+import os
+import sys
+import threading
+from concurrent.futures import ThreadPoolExecutor
+import numpy as np
+import pytest
+path = os.environ['CORE_CONCURRENCY_BINARY']
+spec = importlib.util.spec_from_file_location('_netgraph_core', path)
+ext = importlib.util.module_from_spec(spec)
+sys.modules['_netgraph_core'] = ext
+spec.loader.exec_module(ext)
+assert os.path.realpath(ext.__file__) == os.path.realpath(path)
+import netgraph_core as ngc
+
+_probes, _threads = [], []
+if hasattr(ext, '_ConcurrencyProbe'):
+    _native_probe = ext._ConcurrencyProbe
+    def new_probe(*args, **kwargs):
+        probe = _native_probe(*args, **kwargs)
+        _probes.append(probe)
+        return probe
+
+def graph(capacity=10):
+    return ngc.Graph(2, [0], [1], [capacity], [3], 1.0)
+
+def policy(ledger, *, cache=None, lossy=False):
+    config = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY if lossy else ngc.Admission.LOSSLESS)
+    return ngc.FlowPolicy(ledger, 0, 1, config, cache=cache)
+
+def start(function, probe=None):
+    values, errors = [], []
+    def call():
+        try:
+            values.append(probe.run(function) if probe else function())
+        except BaseException as error:
+            print('CHILD: worker error', type(error).__name__, str(error), flush=True)
+            errors.append(error)
+    thread = threading.Thread(target=call, daemon=True)
+    _threads.append(thread)
+    thread.start()
+    return thread, values, errors
+
+def finish(task):
+    thread, values, errors = task
+    thread.join(5)
+    assert not thread.is_alive(), 'native thread did not finish'
+    if errors:
+        raise errors[0]
+    assert len(values) == 1
+    return values[0]
+
+print('CHILD: selected extension', path, flush=True)
+"""
+
+
+def run_python(source, *, seconds=25, cleanup=True):
+    env = dict(os.environ)
+    env["CORE_CONCURRENCY_BINARY"] = str(Path(_netgraph_core.__file__).resolve())
+    env["PYTHONPATH"] = os.pathsep.join([str(ROOT / "python"), str(ROOT / "tests/py")])
+    # Assertion failures under a plant must also release native rendezvous and
+    # join workers. The parent deadline remains the backstop for a real deadlock.
+    if cleanup:
+        program = (
+            PREAMBLE + "\ntry:\n" + textwrap.indent(textwrap.dedent(source), "    ")
+        )
+        program += "\nfinally:\n    for probe in _probes:\n        probe.release()\n    for thread in _threads:\n        thread.join(5)\n"
+    else:
+        # Interpreter-finalization tests deliberately leave the daemon active.
+        program = PREAMBLE + "\n" + textwrap.dedent(source)
+    program += "\nprint('CHILD: COMPLETE', flush=True)\n"
+    result = subprocess.run(
+        [sys.executable, "-B", "-u", "-c", program],
+        env=env,
+        cwd=ROOT,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        timeout=seconds,
+        check=False,
+    )
+    assert result.returncode == 0, f"child exit={result.returncode}\n{result.stdout}"
+    if cleanup:
+        assert result.stdout.rstrip().endswith("CHILD: COMPLETE"), result.stdout
+    else:
+        assert "CHILD: COMPLETE" in result.stdout.splitlines(), result.stdout
+    return result.stdout
+
+
+def run_test_in_subprocess(path, function):
+    run_python(
+        f"""
+        spec = importlib.util.spec_from_file_location('bounded_test', {str(Path(path).resolve())!r})
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        print('CHILD: entering {function}', flush=True)
+        getattr(module, {function!r})()
+        print('CHILD: threads joined and outcomes checked', flush=True)
+        """
+    )
diff --git a/tests/py/conftest.py b/tests/py/conftest.py
deleted file mode 100644
index 17422e5..0000000
--- a/tests/py/conftest.py
+++ /dev/null
@@ -1,956 +0,0 @@
-"""Shared pytest fixtures for the test suite.
-
-Provides small, reusable builders to reduce repetition across tests.
-
-Fixtures (logical order):
-- build_graph: generic builder from edge tuples.
-- line1_graph: 3-node line with tiered B->C parallels.
-- square1_graph: shortest vs longer alternative path.
-- square2_graph: two equal-cost shortest paths.
-- two_disjoint_shortest_graph: two disjoint equal-cost routes with bottlenecks.
-- graph3: mixed 6-node topology with parallels and a longer route.
-- square4_graph: 4-node square with mixed tiers.
-- fully_connected_graph: factory for K_n directed (no self-loops).
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-# Global Algorithms fixture (CPU backend) and helper to build graph handles
-
-
-@pytest.fixture
-def algs():
-    be = ngc.Backend.cpu()
-    return ngc.Algorithms(be)
-
-
-@pytest.fixture
-def to_handle(algs):
-    def _h(g: ngc.StrictMultiDiGraph):
-        return algs.build_graph(g)
-
-    return _h
-
-
-# Centralized helper fixtures and shared assertions for tests
-
-
-@pytest.fixture
-def t_cost():
-    """Return a function to extract distance to a target node as float."""
-
-    def _t_cost(dist: np.ndarray, node: int) -> float:
-        return float(dist[int(node)])
-
-    return _t_cost
-
-
-@pytest.fixture
-def flows_by_eid():
-    """Return a function mapping EdgeId -> edge flow value for a graph."""
-
-    def _flows_by_eid(
-        g: ngc.StrictMultiDiGraph, edge_flows: np.ndarray
-    ) -> dict[int, float]:
-        arr = np.asarray(edge_flows, dtype=float)
-        return {int(eid): float(arr[eid]) for eid in range(g.num_edges())}
-
-    return _flows_by_eid
-
-
-@pytest.fixture
-def cost_dist_dict():
-    """Return a function converting FlowSummary (costs, flows) to a dict."""
-
-    def _to_dict(summary) -> dict[float, float]:
-        costs = np.asarray(getattr(summary, "costs", []), dtype=float)
-        flows = np.asarray(getattr(summary, "flows", []), dtype=float)
-        return {float(c): float(f) for c, f in zip(costs, flows, strict=False)}
-
-    return _to_dict
-
-
-@pytest.fixture
-def assert_pred_dag_integrity():
-    """Return an assertion helper to validate PredDAG shapes, id ranges, and semantics.
-
-    Checks structural validity (sizes, ranges, monotonicity) AND semantic
-    correctness: each parent entry must correspond to an actual edge in the
-    graph from the claimed parent to the node, and if distances are provided,
-    the distance must be consistent (dist[v] == dist[parent] + edge_cost).
-    """
-
-    def _assert(
-        g: ngc.StrictMultiDiGraph,
-        dag: ngc.PredDAG,
-        dist: np.ndarray | None = None,
-    ) -> None:
-        off = np.asarray(dag.parent_offsets)
-        par = np.asarray(dag.parents)
-        via = np.asarray(dag.via_edges)
-        # Offsets length and monotonicity
-        assert off.shape == (g.num_nodes() + 1,)
-        assert np.all(off[:-1] <= off[1:])
-        total = int(off[-1])
-        # Parents/via sizes match total entries
-        assert par.shape == (total,)
-        assert via.shape == (total,)
-        if total > 0:
-            # Id ranges
-            assert int(par.min()) >= 0 and int(par.max()) < g.num_nodes()
-            assert int(via.min()) >= 0 and int(via.max()) < g.num_edges()
-
-        # Semantic validation: each entry must reference an actual graph edge
-        edge_src = np.asarray(g.edge_src_view())
-        edge_dst = np.asarray(g.edge_dst_view())
-        edge_cost = np.asarray(g.cost_view())
-        for v in range(g.num_nodes()):
-            s, e = int(off[v]), int(off[v + 1])
-            for i in range(s, e):
-                parent = int(par[i])
-                eid = int(via[i])
-                # The via_edge must go from parent -> v
-                assert int(edge_src[eid]) == parent, (
-                    f"PredDAG entry for node {v}: via_edge {eid} has src="
-                    f"{int(edge_src[eid])}, expected parent={parent}"
-                )
-                assert int(edge_dst[eid]) == v, (
-                    f"PredDAG entry for node {v}: via_edge {eid} has dst="
-                    f"{int(edge_dst[eid])}, expected node={v}"
-                )
-                # Distance consistency (if distances provided)
-                if dist is not None:
-                    d_v = float(dist[v])
-                    d_p = float(dist[parent])
-                    ec = float(edge_cost[eid])
-                    if d_v < 1e18 and d_p < 1e18:  # skip unreachable
-                        assert abs(d_v - (d_p + ec)) < 1e-9, (
-                            f"PredDAG distance inconsistency at node {v}: "
-                            f"dist[{v}]={d_v} != dist[{parent}]={d_p} + "
-                            f"cost({eid})={ec} = {d_p + ec}"
-                        )
-
-    return _assert
-
-
-@pytest.fixture
-def assert_edge_flows_shape():
-    """Return an assertion helper to validate edge_flows presence/shape.
-
-    expected_present=True means summary.edge_flows must exist and be length N.
-    If False, allow either empty list or omitted; if present, allow 0 or N.
-    """
-
-    def _assert(
-        g: ngc.StrictMultiDiGraph, summary, expected_present: bool = True
-    ) -> None:
-        edge_flows = getattr(summary, "edge_flows", None)
-        if expected_present:
-            assert edge_flows is not None
-            arr = np.asarray(edge_flows)
-            assert arr.shape == (g.num_edges(),)
-        else:
-            if edge_flows is not None:
-                arr = np.asarray(edge_flows)
-                assert arr.size in (0, g.num_edges())
-
-    return _assert
-
-
-@pytest.fixture
-def assert_valid_min_cut():
-    """Return an assertion helper to validate a MinCut.
-
-    Always checks that edge ids are unique and in range. Note that an empty cut
-    satisfies those two checks vacuously, so pass ``total_flow`` whenever the call
-    site computed a true maximum flow: that enables the max-flow/min-cut duality
-    check (``total_flow == sum(capacity[cut])``), which is what actually pins the
-    result down.
-
-    Duality only holds for a genuine maximum flow. Do NOT pass ``total_flow`` for
-    ``EQUAL_BALANCED`` placement (an ECMP admission model that deliberately places
-    less than the maximum) or for ``shortest_path=True`` (a single augmentation).
-    """
-
-    def _assert(
-        g: ngc.StrictMultiDiGraph, min_cut, total_flow: float | None = None
-    ) -> None:
-        edges = [int(e) for e in getattr(min_cut, "edges", [])]
-        assert len(edges) == len(set(edges)), "min-cut has duplicate edge ids"
-        for e in edges:
-            assert 0 <= e < g.num_edges()
-
-        if total_flow is None:
-            return
-
-        cap = np.asarray(g.capacity_view(), dtype=float)
-        cut_cap = float(cap[edges].sum()) if edges else 0.0
-        assert cut_cap == pytest.approx(total_flow), (
-            f"max-flow/min-cut duality violated: flow={total_flow} "
-            f"but cut capacity={cut_cap} (cut={edges})"
-        )
-        if total_flow > 0:
-            assert edges, "positive flow reported with an empty min-cut"
-
-    return _assert
-
-
-@pytest.fixture
-def certify_max_flow():
-    """Return a helper that *proves* a max-flow result correct without an oracle.
-
-    Checks four properties. Together they are a certificate of optimality: by weak
-    duality any feasible flow is bounded by any s-t cut, so a feasible flow whose
-    value equals the capacity of a genuine cut is necessarily maximum.
-
-    1. feasibility   -- ``0 <= flow(e) <= capacity(e)``, and masked-out edges idle
-    2. conservation  -- inflow == outflow at interior nodes; net at sink == total
-    3. genuine cut   -- deleting the reported cut edges disconnects src from dst
-    4. tightness     -- ``total == sum(capacity[cut])``
-
-    Pass ``maximal=False`` for configurations that deliberately place less than the
-    maximum (``EQUAL_BALANCED`` placement, ``shortest_path=True``); only checks 1-2
-    apply there, and they still hold.
-
-    Requires ``with_edge_flows=True`` on the ``max_flow`` call.
-    """
-
-    def _certify(
-        g: ngc.StrictMultiDiGraph,
-        summary,
-        total: float,
-        src: int,
-        dst: int,
-        *,
-        maximal: bool = True,
-        node_mask=None,
-        edge_mask=None,
-        tol: float = 1e-6,
-    ) -> None:
-        flow = np.asarray(summary.edge_flows, dtype=float)
-        assert flow.size == g.num_edges(), (
-            "certify_max_flow needs edge flows; pass with_edge_flows=True"
-        )
-        cap = np.asarray(g.capacity_view(), dtype=float)
-        e_src = np.asarray(g.edge_src_view())
-        e_dst = np.asarray(g.edge_dst_view())
-        n = g.num_nodes()
-
-        # 1. feasibility
-        assert np.all(flow >= -tol), "negative flow on some edge"
-        assert np.all(flow <= cap + tol), "flow exceeds capacity on some edge"
-
-        usable = np.ones(g.num_edges(), dtype=bool)
-        if edge_mask is not None:
-            usable &= np.asarray(edge_mask, dtype=bool)
-        if node_mask is not None:
-            nm = np.asarray(node_mask, dtype=bool)
-            usable &= nm[e_src] & nm[e_dst]
-        assert np.all(np.abs(flow[~usable]) <= tol), "flow placed on a masked-out edge"
-
-        # 2. conservation
-        net = np.zeros(n)
-        np.add.at(net, e_src, -flow)
-        np.add.at(net, e_dst, flow)
-        interior = [v for v in range(n) if v != src and v != dst]
-        if interior:
-            worst = float(np.max(np.abs(net[interior])))
-            assert worst <= tol, f"flow not conserved at an interior node (net={worst})"
-        assert net[dst] == pytest.approx(total, abs=tol), (
-            f"net inflow at sink ({net[dst]}) != reported total ({total})"
-        )
-
-        if not maximal:
-            return
-
-        # 3. the reported cut must actually separate src from dst
-        cut = {int(e) for e in np.asarray(summary.min_cut.edges)}
-        adj: list[list[int]] = [[] for _ in range(n)]
-        for e in range(g.num_edges()):
-            if e in cut or not usable[e] or cap[e] <= 0:
-                continue
-            adj[int(e_src[e])].append(int(e_dst[e]))
-        seen = {int(src)}
-        stack = [int(src)]
-        while stack:
-            u = stack.pop()
-            for v in adj[u]:
-                if v not in seen:
-                    seen.add(v)
-                    stack.append(v)
-        assert int(dst) not in seen, (
-            f"reported min-cut {sorted(cut)} does not separate {src} from {dst}"
-        )
-
-        # 4. tightness -- with (1)-(3) this proves the flow is maximum
-        cut_cap = float(cap[sorted(cut)].sum()) if cut else 0.0
-        assert cut_cap == pytest.approx(total, abs=tol), (
-            f"flow ({total}) != min-cut capacity ({cut_cap}); flow is not maximal"
-        )
-
-    return _certify
-
-
-@pytest.fixture
-def build_graph():
-    """Build a StrictMultiDiGraph from edge tuples.
-
-    Args:
-        num_nodes: Number of nodes in the graph
-        edges: List of tuples (src, dst, cost, cap[, ext_id])
-
-    Returns:
-        StrictMultiDiGraph instance
-    """
-
-    def _builder(num_nodes: int, edges: list[tuple]) -> ngc.StrictMultiDiGraph:
-        if not edges:
-            return ngc.StrictMultiDiGraph.from_arrays(
-                num_nodes,
-                np.empty((0,), dtype=np.int32),
-                np.empty((0,), dtype=np.int32),
-                np.empty((0,), dtype=np.float64),
-                np.empty((0,), dtype=np.int64),
-                np.empty((0,), dtype=np.int64),
-            )
-        src = np.array([e[0] for e in edges], dtype=np.int32)
-        dst = np.array([e[1] for e in edges], dtype=np.int32)
-        cost = np.array([int(e[2]) for e in edges], dtype=np.int64)
-        cap = np.array([float(e[3]) for e in edges], dtype=np.float64)
-        ext_edge_ids = np.arange(len(edges), dtype=np.int64)
-        return ngc.StrictMultiDiGraph.from_arrays(
-            num_nodes, src, dst, cap, cost, ext_edge_ids
-        )
-
-    return _builder
-
-
-@pytest.fixture
-def line1_graph(build_graph):
-    """Line graph A->B->C with unit costs; caps as in typical tests.
-
-    Nodes: 0->1 (cap 5, cost 1), 1->2 has parallel edges with costs {1,1,2} and
-    capacities {1,3,7} to test tiering.
-    """
-
-    edges = [
-        (0, 1, 1, 5, 0),  # A->B
-        (1, 2, 1, 1, 2),  # B->C (min-cost)
-        (1, 2, 1, 3, 4),  # B->C (min-cost)
-        (1, 2, 2, 7, 6),  # B->C (higher cost)
-    ]
-    return build_graph(3, edges)
-
-
-@pytest.fixture
-def square1_graph(build_graph):
-    """Square1: one shortest route and one longer alternative.
-
-    0->1->2 with total cost 2; 0->3->2 with total cost 4.
-    """
-
-    edges = [
-        (0, 1, 1, 1, 0),
-        (1, 2, 1, 1, 1),
-        (0, 3, 2, 2, 2),
-        (3, 2, 2, 2, 3),
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def square2_graph(build_graph):
-    """Square2: two equal-cost shortest routes from 0->2 via 1 and 3.
-
-    All edge costs are 1; both paths have total cost 2.
-    """
-
-    edges = [
-        (0, 1, 1, 1, 0),
-        (1, 2, 1, 1, 1),
-        (0, 3, 1, 2, 2),
-        (3, 2, 1, 2, 3),
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def graph3(build_graph):
-    """Six-node mixed topology with parallel edges and multiple paths."""
-
-    edges = [
-        (0, 1, 1, 2, 0),  # A->B parallels
-        (0, 1, 1, 4, 1),
-        (0, 1, 1, 6, 2),
-        (1, 2, 1, 1, 3),  # B->C parallels
-        (1, 2, 1, 2, 4),
-        (1, 2, 1, 3, 5),
-        (2, 3, 2, 3, 6),  # C->D
-        (0, 4, 1, 5, 7),  # A->E
-        (4, 2, 1, 4, 8),  # E->C
-        (0, 3, 4, 2, 9),  # A->D
-        (2, 5, 1, 1, 10),  # C->F
-        (5, 3, 1, 2, 11),  # F->D
-    ]
-    return build_graph(6, edges)
-
-
-@pytest.fixture
-def square4_graph(build_graph):
-    """A 4-node square with parallel/higher-cost tiers used in max-flow tests.
-
-    Nodes: A=0, B=1, C=2, D=3
-    """
-
-    edges = [
-        (0, 1, 1, 100, 0),  # A->B
-        (1, 2, 1, 125, 1),  # B->C
-        (0, 3, 1, 75, 2),  # A->D
-        (3, 2, 1, 50, 3),  # D->C
-        (1, 3, 1, 50, 4),  # B->D
-        (3, 1, 1, 50, 5),  # D->B
-        (0, 1, 2, 200, 6),  # A->B (higher cost)
-        (1, 3, 2, 200, 7),  # B->D (higher cost)
-        (3, 2, 2, 200, 8),  # D->C (higher cost)
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def triangle1_graph(build_graph):
-    """Triangle graph with higher capacities on A<->B and B<->C; lower on A<->C.
-
-    Nodes: 0(A), 1(B), 2(C)
-    Edges directed both ways to match the fixture used across tests.
-    """
-
-    edges = [
-        (0, 1, 1, 15, 0),
-        (1, 0, 1, 15, 1),
-        (1, 2, 1, 15, 2),
-        (2, 1, 1, 15, 3),
-        (0, 2, 1, 5, 4),
-        (2, 0, 1, 5, 5),
-    ]
-    return build_graph(3, edges)
-
-
-@pytest.fixture
-def square3_graph(build_graph):
-    """Square with cross-links B<->D and mixed capacities.
-
-    Nodes: 0(A),1(B),2(C),3(D)
-    """
-
-    edges = [
-        (0, 1, 1, 100, 0),
-        (1, 2, 1, 125, 1),
-        (0, 3, 1, 75, 2),
-        (3, 2, 1, 50, 3),
-        (1, 3, 1, 50, 4),
-        (3, 1, 1, 50, 5),
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def graph1_graph(build_graph):
-    """Five-node graph with bidirectional edges between B and C."""
-
-    edges = [
-        (0, 1, 1, 1, 0),
-        (0, 2, 1, 1, 1),
-        (1, 3, 1, 1, 2),
-        (2, 3, 1, 1, 3),
-        (1, 2, 1, 1, 4),
-        (2, 1, 1, 1, 5),
-        (3, 4, 1, 1, 6),
-    ]
-    return build_graph(5, edges)
-
-
-@pytest.fixture
-def graph2_graph(build_graph):
-    """Five-node branched graph with bidirectional C-D edges."""
-
-    edges = [
-        (0, 1, 1, 1, 0),
-        (1, 2, 1, 1, 1),
-        (1, 3, 1, 1, 2),
-        (2, 3, 1, 1, 3),
-        (3, 2, 1, 1, 4),
-        (2, 4, 1, 1, 5),
-        (3, 4, 1, 1, 6),
-    ]
-    return build_graph(5, edges)
-
-
-@pytest.fixture
-def graph4_graph(build_graph):
-    """Graph with three parallel branches from A to C of increasing cost/capacity.
-
-    Nodes: 0(A),1(B),2(B1),3(B2),4(C)
-    """
-
-    edges = [
-        (0, 1, 1, 1, 0),
-        (1, 4, 1, 1, 1),
-        (0, 2, 2, 2, 2),
-        (2, 4, 2, 2, 3),
-        (0, 3, 3, 3, 4),
-        (3, 4, 3, 3, 5),
-    ]
-    return build_graph(5, edges)
-
-
-@pytest.fixture
-def make_fully_connected_graph(build_graph):
-    """Return a builder for fully-connected directed graphs (no self-loops).
-
-    Usage: make_fully_connected_graph(n, cost=1.0, cap=1.0)
-    """
-
-    def _build(
-        n: int, *, cost: float = 1.0, cap: float = 1.0
-    ) -> ngc.StrictMultiDiGraph:
-        edges = []
-        lid = 0
-        for s in range(n):
-            for d in range(n):
-                if s == d:
-                    continue
-                edges.append((s, d, float(cost), float(cap), lid))
-                lid += 1
-        return build_graph(n, edges)
-
-    return _build
-
-
-@pytest.fixture
-def dag_to_pred_map():
-    """Return a converter from PredDAG to {node: {parent: [EdgeId...]}} mapping."""
-
-    def _convert(g: ngc.StrictMultiDiGraph, dag: ngc.PredDAG):
-        pred: dict[int, dict[int, list[int]]] = {}
-        offsets = np.asarray(dag.parent_offsets)
-        parents = np.asarray(dag.parents)
-        via = np.asarray(dag.via_edges)
-        n = g.num_nodes()
-        for v in range(n):
-            start = int(offsets[v])
-            end = int(offsets[v + 1])
-            if start == end:
-                continue
-            group: dict[int, list[int]] = {}
-            for i in range(start, end):
-                p = int(parents[i])
-                e = int(via[i])
-                group.setdefault(p, []).append(e)
-            pred[v] = group
-        if 0 not in pred and n > 0:
-            pred[0] = {}
-        return pred
-
-    return _convert
-
-
-@pytest.fixture
-def assert_paths_concrete():
-    """Validate path tuples returned by resolve_to_paths.
-
-    Ensures structure is ((node, (edge_ids...)), ..., (dst, ())).
-    If expect_split=True, each hop (except src/dst) must have exactly one edge id.
-    If False, hops must have >=1 edge id.
-    """
-
-    def _assert(paths, src: int, dst: int, expect_split: bool) -> None:
-        for path in paths:
-            # path should be a tuple/list of elements
-            assert isinstance(path, (tuple, list)) and len(path) >= 2
-            # First element is (src, ())
-            first = path[0]
-            assert isinstance(first, (tuple, list)) and len(first) == 2
-            assert int(first[0]) == int(src)
-            assert isinstance(first[1], (tuple, list)) and len(first[1]) >= 1
-            if expect_split:
-                assert len(first[1]) == 1
-            # Last element is (dst, ())
-            last = path[-1]
-            assert isinstance(last, (tuple, list)) and len(last) == 2
-            assert int(last[0]) == int(dst)
-            assert isinstance(last[1], (tuple, list)) and len(last[1]) == 0
-            # Intermediate hops
-            for elem in path[1:-1]:
-                assert isinstance(elem, (tuple, list)) and len(elem) == 2
-                node, edges = elem
-                # node id is int
-                assert isinstance(int(node), int)
-                # edges is tuple/list of ints
-                assert isinstance(edges, (tuple, list)) and len(edges) >= 1
-                if expect_split:
-                    assert len(edges) == 1
-                for e in edges:
-                    assert isinstance(int(e), int)
-
-    return _assert
-
-
-@pytest.fixture
-def two_disjoint_shortest_graph(build_graph):
-    """Two disjoint shortest routes 0->1->3 and 0->2->3 with equal cost.
-
-    Capacities configured so that total is limited by per-path bottlenecks.
-    """
-
-    edges = [
-        (0, 1, 1, 3, 0),  # S->A cap 3
-        (1, 3, 1, 2, 1),  # A->T cap 2
-        (0, 2, 1, 4, 2),  # S->B cap 4
-        (2, 3, 1, 1, 3),  # B->T cap 1
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def graph5(build_graph):
-    """Fully connected 5-node directed graph with unit costs/caps."""
-
-    edges = []
-    lid = 0
-    for s in range(5):
-        for d in range(5):
-            if s == d:
-                continue
-            edges.append((s, d, 1.0, 1.0, lid))
-            lid += 1
-    return build_graph(5, edges)
-
-
-@pytest.fixture
-def square5_graph(build_graph):
-    """Five-node 'square5' topology used in KSP tests.
-
-    Nodes: 0(A),1(B),2(C),3(D),4(E)
-    Edges: A->B, A->C, B->D, C->D, B->C, C->B; E is isolated for negative tests.
-    """
-
-    edges = [
-        (0, 1, 1, 1, 0),  # A->B
-        (0, 2, 1, 1, 1),  # A->C
-        (1, 3, 1, 1, 2),  # B->D
-        (2, 3, 1, 1, 3),  # C->D
-        (1, 2, 1, 1, 4),  # B->C
-        (2, 1, 1, 1, 5),  # C->B
-    ]
-    return build_graph(5, edges)
-
-
-# FlowPolicy canonical configurations
-# These represent common use cases for flow routing and traffic engineering
-
-
-@pytest.fixture
-def make_flow_policy_config():
-    """Factory for canonical FlowPolicy configurations.
-
-    Canonical configurations:
-    - SHORTEST_PATHS_ECMP: IP/IGP-style ECMP (hash-based multipath, shortest paths only)
-    - SHORTEST_PATHS_WCMP: IP/IGP-style WCMP (proportional multipath, shortest paths only)
-    - TE_WCMP_UNLIM: Traffic engineering with unlimited proportional flows
-    - TE_ECMP_UP_TO_256_LSP: TE with up to 256 ECMP LSPs (tunnel-based)
-    - TE_ECMP_16_LSP: TE with exactly 16 ECMP LSPs (fixed allocation)
-
-    Usage:
-        config = make_flow_policy_config("SHORTEST_PATHS_ECMP")
-        policy = ngc.FlowPolicy(algs, graph, config)
-    """
-
-    def _make(config_name: str) -> ngc.FlowPolicyConfig:
-        if config_name == "SHORTEST_PATHS_ECMP":
-            # IP/IGP ECMP: Hash-based equal splitting across shortest paths
-            # - multipath=True: Each flow splits across all equal-cost next-hops
-            # - require_capacity=False: Routes based on costs only (IGP behavior)
-            # - shortest_path=True: Only use lowest-cost paths
-            # - max_flow_count=1: Single flow (models single demand stream)
-            config = ngc.FlowPolicyConfig()
-            config.path_alg = ngc.PathAlg.SPF
-            config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-            config.selection = ngc.EdgeSelection(
-                multi_edge=True,
-                require_capacity=False,
-                tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-            )
-            config.require_capacity = False
-            config.multipath = True
-            config.shortest_path = True
-            config.min_flow_count = 1
-            config.max_flow_count = 1
-            return config
-
-        elif config_name == "SHORTEST_PATHS_WCMP":
-            # IP/IGP WCMP: Proportional splitting across shortest paths
-            # - Similar to ECMP but uses PROPORTIONAL placement
-            # - Flow splits proportionally to available capacity
-            config = ngc.FlowPolicyConfig()
-            config.path_alg = ngc.PathAlg.SPF
-            config.flow_placement = ngc.FlowPlacement.PROPORTIONAL
-            config.selection = ngc.EdgeSelection(
-                multi_edge=True,
-                require_capacity=False,
-                tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-            )
-            config.require_capacity = False
-            config.multipath = True
-            config.shortest_path = True
-            config.min_flow_count = 1
-            config.max_flow_count = 1
-            return config
-
-        elif config_name == "TE_WCMP_UNLIM":
-            # Traffic Engineering: Unlimited proportional flows
-            # - require_capacity=True: Respects capacity, progressive fill
-            # - No flow count limits: Creates flows as needed
-            # - Uses all available paths (not just shortest)
-            config = ngc.FlowPolicyConfig()
-            config.path_alg = ngc.PathAlg.SPF
-            config.flow_placement = ngc.FlowPlacement.PROPORTIONAL
-            config.selection = ngc.EdgeSelection(
-                multi_edge=True,
-                require_capacity=True,
-                tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-            )
-            config.require_capacity = True
-            config.multipath = True
-            config.min_flow_count = 1
-            # max_flow_count not set: unlimited
-            return config
-
-        elif config_name == "TE_ECMP_UP_TO_256_LSP":
-            # Traffic Engineering: Up to 256 ECMP LSPs (tunnels)
-            # - multipath=False: Each flow is a single-path LSP/tunnel
-            # - max_flow_count=256: Up to 256 parallel LSPs
-            # - ECMP across LSPs (not within each LSP)
-            config = ngc.FlowPolicyConfig()
-            config.path_alg = ngc.PathAlg.SPF
-            config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-            config.selection = ngc.EdgeSelection(
-                multi_edge=False,
-                require_capacity=True,
-                tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-            )
-            config.require_capacity = True
-            config.multipath = False
-            config.min_flow_count = 1
-            config.max_flow_count = 256
-            config.reoptimize_flows_on_each_placement = True
-            return config
-
-        elif config_name == "TE_ECMP_16_LSP":
-            # Traffic Engineering: Exactly 16 ECMP LSPs (fixed allocation)
-            # - Similar to TE_ECMP_UP_TO_256_LSP but fixed at 16 flows
-            # - Models hardware with fixed LSP resources
-            config = ngc.FlowPolicyConfig()
-            config.path_alg = ngc.PathAlg.SPF
-            config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-            config.selection = ngc.EdgeSelection(
-                multi_edge=False,
-                require_capacity=True,
-                tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-            )
-            config.require_capacity = True
-            config.multipath = False
-            config.min_flow_count = 16
-            config.max_flow_count = 16
-            config.reoptimize_flows_on_each_placement = True
-            return config
-
-        else:
-            raise ValueError(f"Unknown configuration: {config_name}")
-
-    return _make
-
-
-@pytest.fixture
-def make_flow_policy(make_flow_policy_config):
-    """Factory for creating FlowPolicy with canonical configurations and optional masks.
-
-    Usage:
-        policy = make_flow_policy(
-            "SHORTEST_PATHS_ECMP",
-            algs,
-            graph_handle,
-            node_mask=mask_array,
-            edge_mask=mask_array
-        )
-    """
-
-    def _make(
-        config_name: str,
-        algs: ngc.Algorithms,
-        graph_handle,
-        node_mask=None,
-        edge_mask=None,
-    ) -> ngc.FlowPolicy:
-        # Reuse the single-source preset factory to avoid drift.
-        base_cfg = make_flow_policy_config(config_name)
-        # Pass masks directly to FlowPolicy constructor (not stored on config).
-        return ngc.FlowPolicy(
-            algs, graph_handle, base_cfg, node_mask=node_mask, edge_mask=edge_mask
-        )
-
-    return _make
-
-
-# ============================================================================
-# Validation helpers for path distribution and flow placement
-# ============================================================================
-
-
-def analyze_path_usage(
-    fg: ngc.FlowGraph, graph: ngc.StrictMultiDiGraph, source: int, target: int
-) -> dict[int, float]:
-    """Analyze which parallel paths are used and their volumes.
-
-    For topologies with parallel paths between source and target,
-    identifies which middle nodes are used and how much flow goes through each.
-
-    Args:
-        fg: FlowGraph with placed flows
-        graph: Topology graph
-        source: Source node
-        target: Target node
-
-    Returns:
-        Dict mapping middle_node_id -> total_flow_volume through that path
-        For 2-hop parallel paths: {middle_node: flow_volume}
-    """
-    edge_flows = fg.edge_flow_view()
-    edge_src = graph.edge_src_view()
-    edge_dst = graph.edge_dst_view()
-
-    path_usage = {}
-
-    # Find all edges from source and sum their flows
-    for edge_id in range(graph.num_edges()):
-        if edge_src[edge_id] == source:
-            middle_node = edge_dst[edge_id]
-            flow = edge_flows[edge_id]
-            if flow > 1e-9:  # Only count non-zero flows
-                path_usage[middle_node] = flow
-
-    return path_usage
-
-
-def count_lsps_per_path(
-    policy: ngc.FlowPolicy,
-    fg: ngc.FlowGraph,
-    graph: ngc.StrictMultiDiGraph,
-    source: int,
-    target: int,
-) -> dict[int, list[int]]:
-    """Count how many LSPs use each parallel path.
-
-    For topologies with parallel paths, determines which LSPs (flows)
-    use which paths.
-
-    Args:
-        policy: FlowPolicy with placed flows
-        fg: FlowGraph with placed flows
-        graph: Topology graph
-        source: Source node
-        target: Target node
-
-    Returns:
-        Dict mapping middle_node_id -> list of flow_ids using that path
-    """
-    edge_src = graph.edge_src_view()
-    edge_dst = graph.edge_dst_view()
-
-    path_lsps: dict[int, list[int]] = {}
-
-    # For each flow, determine which path it uses
-    for flow_id in range(policy.flow_count()):
-        try:
-            flow_index = ngc.FlowIndex(source, target, 0, flow_id)
-            flow_edges = fg.get_flow_edges(flow_index)
-
-            # Find the middle node this flow uses (for 2-hop paths)
-            # flow_edges is list of (edge_id, volume) tuples
-            for edge_id, _ in flow_edges:
-                src = edge_src[edge_id]
-                dst = edge_dst[edge_id]
-                if src == source:
-                    middle_node = dst
-                    if middle_node not in path_lsps:
-                        path_lsps[middle_node] = []
-                    path_lsps[middle_node].append(flow_id)
-                    break
-        except (KeyError, RuntimeError):
-            pass  # Flow might not exist or have no edges
-
-    return path_lsps
-
-
-def check_distribution_balanced(
-    lsps_per_path: dict[int, list[int]], tolerance: int = 1
-) -> tuple[bool, dict]:
-    """Check if LSPs are evenly distributed across paths.
-
-    Args:
-        lsps_per_path: Dict mapping path_id -> list of LSP ids
-        tolerance: Maximum allowed difference in LSP count between paths
-
-    Returns:
-        (is_balanced, stats)
-        is_balanced: True if max_count - min_count <= tolerance
-        stats: Dict with min, max, counts for debugging
-    """
-    if not lsps_per_path:
-        return (True, {"counts": [], "min": 0, "max": 0, "variance": 0})
-
-    counts = [len(lsps) for lsps in lsps_per_path.values()]
-    min_count = min(counts)
-    max_count = max(counts)
-    variance = max_count - min_count
-
-    stats = {
-        "counts": counts,
-        "min": min_count,
-        "max": max_count,
-        "variance": variance,
-        "per_path": {path_id: len(lsps) for path_id, lsps in lsps_per_path.items()},
-    }
-
-    is_balanced = variance <= tolerance
-
-    return (is_balanced, stats)
-
-
-def calculate_theoretical_capacity_parallel_paths(
-    capacity_per_path: float, num_paths: int, num_lsps: int
-) -> float:
-    """Calculate theoretical maximum capacity with optimal LSP distribution.
-
-    For parallel equal-capacity paths with single-path LSPs.
-
-    Args:
-        capacity_per_path: Capacity of each path
-        num_paths: Number of available paths
-        num_lsps: Number of LSPs to distribute
-
-    Returns:
-        Theoretical maximum total capacity with optimal distribution
-    """
-    if num_lsps <= num_paths:
-        # Each LSP gets its own path
-        return num_lsps * capacity_per_path
-    else:
-        # LSPs must share paths
-        lsps_per_path = num_lsps / num_paths
-        capacity_per_lsp = capacity_per_path / lsps_per_path
-        return num_lsps * capacity_per_lsp
diff --git a/tests/py/contract_api.py b/tests/py/contract_api.py
new file mode 100644
index 0000000..b0501b4
--- /dev/null
+++ b/tests/py/contract_api.py
@@ -0,0 +1,570 @@
+"""The promised public API (its interface listing), written out: per public name, its members
+and, per callable, every overload's parameters as (name, kind, default) with kind "pos", "kw", "var"
+or "varkw" and the default's source text. A member the listing states in prose rather than as a
+declaration (an unchanged method or field) is "declared"; a property, field or enum member is
+"attribute". test_public_surface.py compares the generated stub with it."""
+
+CONTRACT_API = {
+    "AbsoluteCost": {"__init__": [[("cost", "pos", None)]], "cost": "attribute"},
+    "Admission": {"LOSSLESS": "attribute", "LOSSY": "attribute"},
+    "BatchMode": {"ORDERED": "attribute", "SIMULTANEOUS": "attribute"},
+    "CentralizedTE": {
+        "__init__": [
+            [
+                ("source_allocation", "kw", None),
+                ("source_weights", "kw", "None"),
+                ("support", "kw", "None"),
+                ("tunnel_count", "kw", "None"),
+                ("prefer_headroom", "kw", "False"),
+            ]
+        ],
+        "prefer_headroom": "attribute",
+        "source_allocation": "attribute",
+        "source_weights": "attribute",
+        "support": "attribute",
+        "tunnel_count": "attribute",
+    },
+    "CostStretch": {"__init__": [[("factor", "pos", None)]], "factor": "attribute"},
+    "Direction": {"FORWARD": "declared", "REVERSE": "declared"},
+    "DistributedTE": {
+        "__init__": [
+            [
+                ("tunnel_count", "pos", None),
+                ("cost_ceiling", "kw", "None"),
+                ("min_unreserved_bandwidth", "kw", "0"),
+                ("tie_break", "kw", "RouteTieBreak.FEWER_HOPS"),
+                ("parallel_edges", "kw", "True"),
+            ]
+        ],
+        "cost_ceiling": "attribute",
+        "min_unreserved_bandwidth": "attribute",
+        "parallel_edges": "attribute",
+        "tie_break": "attribute",
+        "tunnel_count": "attribute",
+    },
+    "Eligibility": {
+        "edge_allowed": "declared",
+        "graph_uid": "declared",
+        "intersect": "declared",
+        "node_allowed": "declared",
+        "uid": "declared",
+    },
+    "EvaluationOptions": {
+        "__init__": [
+            [
+                ("config", "pos", None),
+                ("eligibility", "kw", "None"),
+                ("cache", "kw", "None"),
+                ("outputs", "kw", "None"),
+                ("design_demand", "kw", "None"),
+                ("offer", "kw", "None"),
+            ]
+        ],
+        "cache": "attribute",
+        "config": "attribute",
+        "design_demand": "attribute",
+        "eligibility": "attribute",
+        "offer": "attribute",
+        "outputs": "attribute",
+    },
+    "FlowLedger": {
+        "__init__": [
+            [
+                ("graph", "pos", None),
+                ("service_baseline", "pos", "None"),
+                ("reservation_baseline", "kw", "None"),
+            ]
+        ],
+        "carried": [[]],
+        "copy": "declared",
+        "edge_capacity_units": [[]],
+        "graph": "declared",
+        "record": "declared",
+        "records": "declared",
+        "reserved": [[]],
+        "reset": [
+            [
+                ("service_baseline", "pos", "None"),
+                ("reservation_baseline", "kw", "None"),
+            ]
+        ],
+        "residual": "declared",
+        "saturated_boundary_edges": [
+            [("sources", "pos", None), ("eligibility", "pos", "None")]
+        ],
+        "uid": "declared",
+        "unreserved": [[]],
+    },
+    "FlowPolicy": {
+        "__init__": [
+            [
+                ("ledger", "pos", None),
+                ("sources", "pos", None),
+                ("destinations", "pos", None),
+                ("config", "pos", None),
+                ("eligibility", "pos", "None"),
+                ("cache", "pos", "None"),
+            ]
+        ],
+        "config": "attribute",
+        "delivered": [[]],
+        "evaluate": [
+            [
+                ("offer", "pos", None),
+                ("design_demand", "kw", "None"),
+                ("outputs", "kw", "None"),
+            ]
+        ],
+        "forward": [
+            [
+                ("offer", "pos", None),
+                ("black_holes", "kw", "None"),
+                ("outputs", "kw", "None"),
+            ]
+        ],
+        "place": [[("offer", "pos", None), ("outputs", "pos", "None")]],
+        "program": "attribute",
+        "record": [[("flow_id", "pos", None)]],
+        "records": [[]],
+        "remove": [[]],
+        "replace": [
+            [
+                ("offer", "pos", None),
+                ("design_demand", "kw", "None"),
+                ("outputs", "kw", "None"),
+            ]
+        ],
+    },
+    "FlowPolicyConfig": {
+        "__init__": [
+            [("routing", "kw", None), ("admission", "kw", "Admission.LOSSLESS")]
+        ],
+        "admission": "attribute",
+        "routing": "attribute",
+    },
+    "FlowRecord": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "admission": "attribute",
+        "delivered": "attribute",
+        "destinations": "attribute",
+        "edge_drops": "attribute",
+        "edge_flows": "attribute",
+        "edge_reservations": "attribute",
+        "entry_id": "attribute",
+        "flow_id": "attribute",
+        "min_route_cost": "attribute",
+        "offered": "attribute",
+        "policy_id": "attribute",
+        "route": "attribute",
+        "sources": "attribute",
+    },
+    "Forward": {
+        "__init__": [
+            [
+                ("policy", "pos", None),
+                ("offer", "pos", None),
+                ("black_holes", "kw", "None"),
+            ]
+        ],
+        "black_holes": "attribute",
+        "offer": "attribute",
+        "policy": "attribute",
+    },
+    "ForwardingProgram": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "destinations": "attribute",
+        "from_dag": [
+            [
+                ("graph", "pos", None),
+                ("sources", "pos", None),
+                ("destinations", "pos", None),
+                ("dag", "pos", None),
+                ("allocation", "kw", "None"),
+                ("weight_basis", "kw", "None"),
+                ("edge_weights", "kw", "None"),
+                ("residual", "kw", "None"),
+            ]
+        ],
+        "from_routes": [
+            [
+                ("graph", "pos", None),
+                ("sources", "pos", None),
+                ("destinations", "pos", None),
+                ("routes", "pos", None),
+                ("allocation", "kw", "None"),
+                ("weight_basis", "kw", "None"),
+                ("edge_weights", "kw", "None"),
+                ("residual", "kw", "None"),
+            ]
+        ],
+        "source_weights": "attribute",
+        "sources": "attribute",
+        "tunnels": "attribute",
+    },
+    "Graph": {
+        "__init__": [
+            [
+                ("num_nodes", "pos", None),
+                ("edge_sources", "pos", None),
+                ("edge_destinations", "pos", None),
+                ("edge_capacity_units", "pos", None),
+                ("edge_costs", "pos", None),
+                ("resolution", "pos", None),
+            ]
+        ],
+        "edge_capacity_units": [[]],
+        "edge_cost_gcd": [[]],
+        "edge_costs": [[]],
+        "edge_destinations": [[]],
+        "edge_sources": [[]],
+        "eligibility": "declared",
+        "incoming_edges": [[]],
+        "incoming_offsets": [[]],
+        "input_positions": [[]],
+        "max_edge_cost": [[]],
+        "num_edges": "declared",
+        "num_nodes": "declared",
+        "outgoing_offsets": [[]],
+        "resolution": "declared",
+        "uid": "declared",
+    },
+    "KspOptions": {
+        "__init__": [
+            [
+                ("k", "pos", None),
+                ("tie_break", "kw", "RouteTieBreak.FEWER_HOPS"),
+                ("parallel_edges", "kw", "True"),
+                ("cost_ceiling", "kw", "None"),
+                ("residual", "kw", "None"),
+                ("eligibility", "kw", "None"),
+            ]
+        ],
+        "cost_ceiling": "attribute",
+        "eligibility": "attribute",
+        "k": "attribute",
+        "parallel_edges": "attribute",
+        "residual": "attribute",
+        "tie_break": "attribute",
+    },
+    "OutputOptions": {
+        "__init__": [
+            [
+                ("edge_flows", "kw", "False"),
+                ("residual", "kw", "False"),
+                ("saturated_boundary_edges", "kw", "False"),
+                ("edge_reservations", "kw", "False"),
+                ("min_cut", "kw", "False"),
+            ]
+        ],
+        "edge_flows": "attribute",
+        "edge_reservations": "attribute",
+        "min_cut": "attribute",
+        "residual": "attribute",
+        "saturated_boundary_edges": "attribute",
+    },
+    "Path": {
+        "cost": "declared",
+        "destination": [[]],
+        "graph_uid": "declared",
+        "hops": "declared",
+        "source": [[]],
+        "to_dag": [[]],
+    },
+    "Pinned": {
+        "__init__": [[("program", "pos", None), ("black_holes", "kw", "None")]],
+        "black_holes": "attribute",
+        "program": "attribute",
+    },
+    "Place": {
+        "__init__": [[("policy", "pos", None), ("offer", "pos", None)]],
+        "offer": "attribute",
+        "policy": "attribute",
+    },
+    "PlacementResult": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "admitted": "attribute",
+        "by_source": "attribute",
+        "by_tunnel": "attribute",
+        "call_delivered": "attribute",
+        "call_edge_drops": "attribute",
+        "call_source_drops": "attribute",
+        "call_undelivered": "attribute",
+        "delivered": "attribute",
+        "delivery_delta": "attribute",
+        "edge_drops": "attribute",
+        "edge_flows": "attribute",
+        "edge_reservations": "attribute",
+        "marginal_cost_curve": "attribute",
+        "min_cut": "attribute",
+        "offered": "attribute",
+        "plan": "attribute",
+        "program": "attribute",
+        "requested": "attribute",
+        "reservations_changed": "attribute",
+        "residual": "attribute",
+        "routes_changed": "attribute",
+        "saturated_boundary_edges": "attribute",
+        "source_drops": "attribute",
+        "termination": "attribute",
+        "total_cost": "attribute",
+        "unadmitted": "attribute",
+        "weights_changed": "attribute",
+    },
+    "PredecessorDAG": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "from_csr": [
+            [
+                ("graph", "pos", None),
+                ("parent_offsets", "pos", None),
+                ("parents", "pos", None),
+                ("via_edges", "pos", None),
+            ]
+        ],
+        "graph_uid": "declared",
+        "parent_offsets": "declared",
+        "parents": "declared",
+        "via_edges": "declared",
+    },
+    "Replace": {
+        "__init__": [
+            [
+                ("policy", "pos", None),
+                ("offer", "pos", None),
+                ("design_demand", "kw", "None"),
+            ]
+        ],
+        "design_demand": "attribute",
+        "offer": "attribute",
+        "policy": "attribute",
+    },
+    "RouteAllocation": {
+        "EQUAL": "attribute",
+        "OPTIMIZED": "attribute",
+        "WEIGHTED": "attribute",
+    },
+    "RouteDefinition": {
+        "__init__": [
+            [("head", "pos", None), ("route", "pos", None), ("weight", "kw", "1")]
+        ],
+        "head": "attribute",
+        "route": "attribute",
+        "weight": "attribute",
+    },
+    "RouteTieBreak": {
+        "FEWER_HOPS": "attribute",
+        "HIGHER_AVAILABLE_CAPACITY": "attribute",
+        "HIGHER_CAPACITY": "attribute",
+        "HIGHER_HEADROOM": "attribute",
+    },
+    "SensitivityEntry": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "delivery_reduction": "attribute",
+        "edge": "attribute",
+    },
+    "SensitivityResult": {"baseline": "declared", "entries": "declared"},
+    "ShortestPathCache": {
+        "clear": "declared",
+        "freeze": "declared",
+        "graph_uid": "declared",
+        "stats": "declared",
+        "thaw": "declared",
+    },
+    "ShortestPathCacheMiss": {},
+    "ShortestPathCacheStats": {
+        "bytes": "declared",
+        "entries": "declared",
+        "hits": "declared",
+        "live_values": "declared",
+        "misses": "declared",
+    },
+    "ShortestPaths": {
+        "__init__": [
+            [
+                ("allocation", "kw", "RouteAllocation.EQUAL"),
+                ("source_allocation", "kw", "None"),
+                ("weight_basis", "kw", "None"),
+                ("edge_weights", "kw", "None"),
+                ("tie_break", "kw", "RouteTieBreak.FEWER_HOPS"),
+                ("multipath", "kw", "True"),
+                ("parallel_edges", "kw", "True"),
+            ]
+        ],
+        "allocation": "attribute",
+        "edge_weights": "attribute",
+        "multipath": "attribute",
+        "parallel_edges": "attribute",
+        "source_allocation": "attribute",
+        "tie_break": "attribute",
+        "weight_basis": "attribute",
+    },
+    "SourceAllocation": {
+        "EQUAL": "attribute",
+        "OPTIMIZED": "attribute",
+        "WEIGHTED": "attribute",
+    },
+    "SourceFlow": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "admitted": "attribute",
+        "delivered": "attribute",
+        "offered": "attribute",
+        "source": "attribute",
+        "source_drops": "attribute",
+        "total_edge_drops": "attribute",
+    },
+    "SpfOptions": {
+        "__init__": [
+            [
+                ("direction", "pos", None),
+                ("targets", "kw", "None"),
+                ("tie_break", "kw", "RouteTieBreak.FEWER_HOPS"),
+                ("multipath", "kw", "True"),
+                ("parallel_edges", "kw", "True"),
+                ("residual", "kw", "None"),
+                ("min_residual", "kw", "1"),
+                ("eligibility", "kw", "None"),
+            ]
+        ],
+        "direction": "attribute",
+        "eligibility": "attribute",
+        "min_residual": "attribute",
+        "multipath": "attribute",
+        "parallel_edges": "attribute",
+        "residual": "attribute",
+        "targets": "attribute",
+        "tie_break": "attribute",
+    },
+    "SpfResult": {"costs": "declared", "dag": "declared", "target_cost": "declared"},
+    "Termination": {
+        "COMPLETE": "attribute",
+        "EXHAUSTED": "attribute",
+        "NO_ACTIVE_WEIGHT": "attribute",
+        "NO_ROUTE": "attribute",
+    },
+    "Tunnel": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "destination": "attribute",
+        "edges": "attribute",
+        "entry_id": "attribute",
+        "head": "attribute",
+        "local_index": "attribute",
+        "path_cost": "attribute",
+        "planned_bandwidth": "attribute",
+        "requested_bandwidth": "attribute",
+        "reserved_bandwidth": "attribute",
+        "status": "attribute",
+        "weight": "attribute",
+    },
+    "TunnelCount": {
+        "__init__": [[("per_head", "pos", None), ("up_to", "kw", "False")]],
+        "per_head": "attribute",
+        "up_to": "attribute",
+    },
+    "TunnelFlow": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "assigned": "attribute",
+        "delivered": "attribute",
+        "entry_id": "attribute",
+        "head": "attribute",
+        "status": "attribute",
+        "total_edge_drops": "attribute",
+    },
+    "TunnelPlan": {
+        "__init__": [[("_no_public_constructor", "pos", None)]],
+        "design_by_head": "attribute",
+        "design_demand": "attribute",
+        "headroom_penalty": "attribute",
+        "heads_with_capacity": "attribute",
+        "insufficient_resolution": "attribute",
+        "max_bandwidth_per_tunnel": "attribute",
+        "max_fractional_bandwidth_per_tunnel": "attribute",
+        "max_lossless_offer": "attribute",
+        "planned_bandwidth_per_tunnel": "attribute",
+        "total_planned_bandwidth": "attribute",
+        "total_reserved_bandwidth": "attribute",
+        "total_tunnel_cost": "attribute",
+        "tunnels_per_head": "attribute",
+    },
+    "TunnelStatus": {
+        "BLACKHOLED": "attribute",
+        "COST_CEILING_EXCEEDED": "attribute",
+        "FAILED": "attribute",
+        "INSUFFICIENT_BANDWIDTH": "attribute",
+        "UP": "attribute",
+    },
+    "WeightBasis": {
+        "CAPACITY": "attribute",
+        "EXPLICIT": "attribute",
+        "RESIDUAL_SNAPSHOT": "attribute",
+    },
+    "apply_actions": {
+        "__call__": [
+            [
+                ("ledger", "pos", None),
+                ("actions", "pos", None),
+                ("mode", "kw", "BatchMode.ORDERED"),
+                ("outputs", "kw", "None"),
+            ]
+        ]
+    },
+    "as_float": {"__call__": [[("x", "pos", None), ("resolution", "pos", None)]]},
+    "evaluate_demand": {
+        "__call__": [
+            [
+                ("graph", "pos", None),
+                ("sources", "pos", None),
+                ("destinations", "pos", None),
+                ("options", "pos", None),
+            ]
+        ]
+    },
+    "evaluate_edge_failures": {
+        "__call__": [
+            [
+                ("graph", "pos", None),
+                ("sources", "pos", None),
+                ("destinations", "pos", None),
+                ("options", "pos", None),
+                ("workers", "pos", "None"),
+            ]
+        ]
+    },
+    "evaluate_pairs": {
+        "__call__": [
+            [
+                ("graph", "pos", None),
+                ("pairs", "pos", None),
+                ("options", "pos", None),
+                ("per_pair_eligibility", "pos", "None"),
+                ("workers", "pos", "None"),
+            ]
+        ]
+    },
+    "ksp": {
+        "__call__": [
+            [
+                ("graph", "pos", None),
+                ("source", "pos", None),
+                ("destination", "pos", None),
+                ("options", "pos", None),
+            ]
+        ]
+    },
+    "resolve_to_paths": {
+        "__call__": [
+            [
+                ("graph", "pos", None),
+                ("dag", "pos", None),
+                ("source", "pos", None),
+                ("destination", "pos", None),
+                ("split_parallel_edges", "pos", "False"),
+                ("max_paths", "pos", "None"),
+            ]
+        ]
+    },
+    "spf": {
+        "__call__": [
+            [("graph", "pos", None), ("roots", "pos", None), ("options", "pos", None)]
+        ]
+    },
+    "to_units": {"__call__": [[("x", "pos", None), ("resolution", "pos", None)]]},
+}
diff --git a/tests/py/flow_oracle.py b/tests/py/flow_oracle.py
new file mode 100644
index 0000000..a690796
--- /dev/null
+++ b/tests/py/flow_oracle.py
@@ -0,0 +1,297 @@
+"""Independent checks of the flow-core payload (``_solve_min_cost_flow``) for the Python tests.
+
+Nothing here calls the extension's solver: an exhaustive minimum cost of every integer
+value on small graphs, an independent successive-shortest-path solver (Bellman-Ford) for the
+others, and the certificate in its two ordered branches (the payload shape, feasibility,
+conservation, attained value, the full residual closure of the real sources and its cut,
+potentials with the NEVER_REACHED sentinel tested first (never below it, never on a closure
+vertex, and exactly on the vertices that no allowed source reaches over eligible edges of
+positive view at zero flow), the virtual-terminal convention,
+pi(t*) equal to the last curve cost, the curve shape, total and moment, and the complete
+curve: against the exhaustive optimum of every value when the graph has at most 7 edges and
+every view is at most 3, else against the independent solver at every breakpoint of either
+curve; the C++ certificate checks the same clauses and makes the same two comparisons, its
+branch chosen by each test).
+"""
+
+from __future__ import annotations
+
+from collections import deque
+from fractions import Fraction
+from itertools import product
+
+NEVER_REACHED = -1
+
+
+def exhaustive(num_nodes, src, dst, cost, view, sources, dests, allowed=None):
+    """Minimum cost of every integer flow value over the allowed edges (id coordinates)."""
+    edges = [e for e in range(len(src)) if allowed is None or allowed[e]]
+    s_set, d_set = set(sources), set(dests)
+    best: dict[int, int] = {}
+    for flow in product(*(range(view[e] + 1) for e in edges)):
+        bal = [0] * num_nodes
+        for e, x in zip(edges, flow, strict=True):
+            bal[src[e]] -= x
+            bal[dst[e]] += x
+        ok = all(
+            (bal[v] <= 0)
+            if v in s_set
+            else (bal[v] >= 0)
+            if v in d_set
+            else bal[v] == 0
+            for v in range(num_nodes)
+        )
+        if not ok:
+            continue
+        value = -sum(bal[s] for s in s_set)
+        c = sum(cost[e] * x for e, x in zip(edges, flow, strict=True))
+        if value not in best or c < best[value]:
+            best[value] = c
+    return best
+
+
+def independent_curve(num_nodes, src, dst, cost, view, sources, dests, allowed=None):
+    """The minimum-cost curve as breakpoints [(value, cost)], from (0, 0): one shortest
+    augmenting path at a time, each found by Bellman-Ford over the residual arcs (a virtual
+    source feeds every source, every destination drains into a virtual sink)."""
+    big = sum(view) + 1  # more than any flow, so the virtual arcs never bind
+    arcs = [
+        [src[e], dst[e], view[e], cost[e], 0]
+        for e in range(len(src))
+        if allowed is None or allowed[e]
+    ]
+    s_v, t_v = num_nodes, num_nodes + 1
+    arcs += [[s_v, s, big, 0, 0] for s in sources]
+    arcs += [[d, t_v, big, 0, 0] for d in dests]
+    points = [(0, 0)]
+    while True:
+        dist: list[int | None] = [None] * (num_nodes + 2)
+        parent: list[tuple[int, int] | None] = [None] * (num_nodes + 2)
+        dist[s_v] = 0
+        for _ in range(num_nodes + 2):
+            changed = False
+            for i, (u, v, cap, w, flow) in enumerate(arcs):
+                du, dv = dist[u], dist[v]
+                if flow < cap and du is not None and (dv is None or du + w < dv):
+                    dist[v], parent[v], changed = du + w, (i, 1), True
+                du, dv = dist[u], dist[v]
+                if flow > 0 and dv is not None and (du is None or dv - w < du):
+                    dist[u], parent[u], changed = dv - w, (i, -1), True
+            if not changed:
+                break
+        if dist[t_v] is None:
+            return points
+        path, v = [], t_v
+        while v != s_v:
+            i, sign = parent[v]
+            path.append((i, sign))
+            v = arcs[i][0] if sign == 1 else arcs[i][1]
+        amount = min(
+            arcs[i][2] - arcs[i][4] if sign == 1 else arcs[i][4] for i, sign in path
+        )
+        for i, sign in path:
+            arcs[i][4] += sign * amount
+        value, total = points[-1]
+        points.append((value + amount, total + dist[t_v] * amount))
+
+
+def points_value(points, x):
+    """Cost of the piecewise-linear curve through the breakpoints at a value in its domain
+    (an empty or backward segment, which the curve-shape clause rejects, is skipped)."""
+    for (a, ca), (b, cb) in zip(points, points[1:], strict=False):
+        if a <= x <= b and a < b:
+            return ca + Fraction(cb - ca, b - a) * (x - a)
+    return Fraction(points[-1][1])
+
+
+def curve_value(curve, x):
+    """Cost of the convex function given by its marginal curve at the integer value x."""
+    total = Fraction(0)
+    left = x
+    for c, u in curve:
+        take = min(left, u)
+        total += c * take
+        left -= take
+        if left == 0:
+            break
+    return total
+
+
+def certify(
+    g, view, sources, dests, cap, payload, node_allowed=None, edge_allowed=None
+):
+    """Failed clauses of the certificate (empty when the payload is certified)."""
+    n, m = g.num_nodes(), g.num_edges()
+    src = [int(x) for x in g.edge_sources()]
+    dst = [int(x) for x in g.edge_destinations()]
+    cost = [int(x) for x in g.edge_costs()]
+    node_usable = (
+        [True] * n if node_allowed is None else [bool(x) for x in node_allowed]
+    )
+    edge_usable = (
+        [True] * m if edge_allowed is None else [bool(x) for x in edge_allowed]
+    )
+    s_all, d_all = sorted(set(sources)), sorted(set(dests))
+    f = payload["edge_flows"]
+    pi = payload["potentials"]
+    value = payload["flow_value"]
+    curve = [tuple(t) for t in payload["marginal_cost_curve"]]
+    fails: list[str] = []
+    if len(f) != m or len(pi) != n:
+        fails.append("shape")
+        return fails
+    if cap == 0:
+        zero = {
+            "flow_value": 0,
+            "marginal_cost_curve": [],
+            "edge_flows": [0] * m,
+            "min_cut": None,
+            "potentials": [NEVER_REACHED] * n,
+        }
+        if any(payload[k] != v for k, v in zero.items()) or any(
+            payload["counters"].values()
+        ):
+            fails.append("zero cap: the prescribed zero payload")
+        return fails
+    bal = [0] * n
+    for e in range(m):
+        if not 0 <= f[e] <= view[e]:
+            fails.append(f"feasibility at {e}")
+        if not edge_usable[e] and f[e]:
+            fails.append(f"flow on ineligible edge {e}")
+        bal[src[e]] -= f[e]
+        bal[dst[e]] += f[e]
+    supply = {s: -bal[s] for s in s_all}
+    inflow = {d: bal[d] for d in d_all}
+    for v in range(n):
+        if v in supply:
+            if supply[v] < 0 or (not node_usable[v] and supply[v]):
+                fails.append(f"source {v}")
+        elif v in inflow:
+            if inflow[v] < 0 or (not node_usable[v] and inflow[v]):
+                fails.append(f"destination {v}")
+        elif bal[v]:
+            fails.append(f"conservation at {v}")
+    if sum(supply.values()) != value or sum(inflow.values()) != value:
+        fails.append("value differs from supply or inflow")
+    if value < 0 or (cap is not None and value > cap):
+        fails.append("placed outside [0, cap]")
+    s_star, t_star = n, n + 1
+    out: list[list[tuple[int, int]]] = [[] for _ in range(n + 2)]
+    for e in range(m):
+        if not edge_usable[e]:
+            continue
+        if f[e] < view[e]:
+            out[src[e]].append((dst[e], cost[e]))
+        if f[e] > 0:
+            out[dst[e]].append((src[e], -cost[e]))
+    roots = [s for s in s_all if node_usable[s]]
+    for s in roots:
+        out[s_star].append((s, 0))
+        if supply[s] > 0:
+            out[s].append((s_star, 0))
+    for d in d_all:
+        if node_usable[d]:
+            out[d].append((t_star, 0))
+            if inflow[d] > 0:
+                out[t_star].append((d, 0))
+    seen = set(roots)
+    queue = deque(roots)
+    while queue:
+        u = queue.popleft()
+        for v, _w in out[u]:
+            if v not in seen:
+                seen.add(v)
+                queue.append(v)
+    connected = t_star in seen
+    if cap is None and connected:
+        fails.append("uncapped solve left the destinations connected")
+    if cap is not None and value != cap and connected:
+        fails.append("attained value: early stop")
+    if connected:
+        if payload["min_cut"] is not None:
+            fails.append("min_cut on a connected solve")
+    else:
+        expect = [
+            e
+            for e in range(m)
+            if edge_usable[e] and src[e] in seen and dst[e] not in seen
+        ]
+        if payload["min_cut"] != expect:
+            fails.append(f"min_cut {payload['min_cut']} != closure cut {expect}")
+        if sum(view[e] for e in expect) != value:
+            fails.append("cut value differs from placed")
+    # The vertices some search settled: the first search runs on the zero flow and settles
+    # every vertex an allowed source reaches over eligible edges of positive view; a later
+    # search adds only the reverses of carrying edges, whose ends that one already settled.
+    settled = set(roots)
+    queue = deque(roots)
+    while queue:
+        u = queue.popleft()
+        for e in range(m):
+            if src[e] == u and edge_usable[e] and view[e] > 0 and dst[e] not in settled:
+                settled.add(dst[e])
+                queue.append(dst[e])
+    for v in range(n):
+        if pi[v] < NEVER_REACHED:
+            fails.append("potential below the sentinel")
+        if v in seen and pi[v] == NEVER_REACHED:
+            fails.append(f"closure vertex {v} holds NEVER_REACHED")
+        if (pi[v] == NEVER_REACHED) == (v in settled):
+            fails.append(
+                f"NEVER_REACHED differs from reachability at zero flow at node {v}"
+            )
+    for s in roots:
+        if pi[s] != 0:
+            fails.append(f"root {s} potential {pi[s]}")
+    for u in range(n):
+        if u not in seen or pi[u] == NEVER_REACHED:
+            continue
+        for v, w in out[u]:
+            if v < n and v in seen and pi[v] != NEVER_REACHED and w + pi[u] - pi[v] < 0:
+                fails.append(f"negative reduced cost {u}->{v}")
+    reached = [d for d in d_all if pi[d] != NEVER_REACHED]
+    if reached:
+        pt = min(pi[d] for d in reached)
+        for d in reached:
+            if inflow[d] > 0 and pi[d] != pt:
+                fails.append(f"inflow destination {d} potential differs from pi(t*)")
+        if curve and curve[-1][0] != pt:
+            fails.append("pi(t*) differs from the last curve cost")
+    elif value:
+        fails.append("flow delivered but no destination reached")
+    if any(u <= 0 for _c, u in curve):
+        fails.append("curve volume not positive")
+    if any(b[0] <= a[0] for a, b in zip(curve, curve[1:], strict=False)):
+        fails.append("curve costs not strictly increasing")
+    if sum(u for _c, u in curve) != value:
+        fails.append("curve total differs from placed")
+    if sum(c * u for c, u in curve) != sum(cost[e] * f[e] for e in range(m)):
+        fails.append("curve moment differs from the flow cost")
+    allowed_dests = [d for d in d_all if node_usable[d]]
+    if m <= 7 and max(view, default=0) <= 3:
+        best = exhaustive(n, src, dst, cost, view, roots, allowed_dests, edge_usable)
+        fmax = max(best)
+        top = fmax if cap is None else min(cap, fmax)
+        if value != top:
+            fails.append(f"placed {value} != min(cap, F_max) {top} (exhaustive)")
+        for x in range(min(top, value) + 1):
+            if curve_value(curve, x) != best[x]:
+                fails.append(f"curve differs from the exhaustive optimum at {x}")
+                break
+    else:
+        ref = independent_curve(
+            n, src, dst, cost, view, roots, allowed_dests, edge_usable
+        )
+        fmax = ref[-1][0]
+        top = fmax if cap is None else min(cap, fmax)
+        if value != top:
+            fails.append(f"placed {value} != min(cap, F_max) {top} (independent)")
+        mine = [(0, 0)]
+        for c, u in curve:
+            mine.append((mine[-1][0] + u, mine[-1][1] + c * u))
+        for x in sorted({x for x, _c in mine + ref}):
+            if x <= min(top, value) and points_value(mine, x) != points_value(ref, x):
+                fails.append(f"curve differs from the independent solver at {x}")
+                break
+    return fails
diff --git a/tests/py/helpers.py b/tests/py/helpers.py
new file mode 100644
index 0000000..19a8fa1
--- /dev/null
+++ b/tests/py/helpers.py
@@ -0,0 +1,288 @@
+"""Builders and constants shared by the Python tests (not collected: no test_ prefix): graphs,
+EdgeId mappings, DAGs, the two policy configurations most tests use, results
+and ledgers as comparable data, the sweep of a call's Python object allocations, and the
+pytest.raises pattern of an exact message."""
+
+from __future__ import annotations
+
+import math
+import re
+
+import _netgraph_core
+import pytest
+
+import netgraph_core as ngc
+
+INF = math.inf
+L62 = 1 << 62
+FEWER = ngc.RouteTieBreak.FEWER_HOPS
+HIGHER_CAP = ngc.RouteTieBreak.HIGHER_CAPACITY
+HIGHER_AVAIL = ngc.RouteTieBreak.HIGHER_AVAILABLE_CAPACITY
+HIGHER_HEADROOM = ngc.RouteTieBreak.HIGHER_HEADROOM
+# Every optional output of a placement or an evaluator.
+ALL_OUT = ngc.OutputOptions(
+    edge_flows=True, residual=True, saturated_boundary_edges=True
+)
+# A chain 0 -> 1 -> 2 -> 3 (cost 1 per edge) with the bypasses 0 -> 2 and 1 -> 3 (cost 3), every
+# capacity 1: (u, v, capacity, cost) in input order.
+CHAIN = [(0, 1, 1, 1), (1, 2, 1, 1), (2, 3, 1, 1), (0, 2, 1, 3), (1, 3, 1, 3)]
+
+
+def exact(text):
+    """The pytest.raises pattern of exactly this message: the whole text, so a message with
+    anything more, a trailing newline included, does not match."""
+    return rf"\A{re.escape(text)}\Z"
+
+
+def assert_read_only(obj, *names):
+    """Each name is a read-only property of obj: the class defines it without a setter, it reads
+    (a misspelt or removed name fails here, not as the AttributeError below), and assigning the
+    value it holds raises AttributeError and leaves it unchanged."""
+    for name in names:
+        prop = getattr(type(obj), name)
+        assert isinstance(prop, property) and prop.fset is None, name
+        value = getattr(obj, name)
+        with pytest.raises(AttributeError):
+            setattr(obj, name, value)
+        assert getattr(obj, name) == value, name
+
+
+def build(n, edges, q=1.0):
+    """A Graph from (u, v, capacity, cost) rows in input order, at resolution q."""
+    return ngc.Graph(
+        n,
+        [e[0] for e in edges],
+        [e[1] for e in edges],
+        [e[2] for e in edges],
+        [e[3] for e in edges],
+        q,
+    )
+
+
+def to_ids(g, values_in):
+    """A per-edge list in input order, permuted to EdgeId order."""
+    return [values_in[int(i)] for i in g.input_positions()]
+
+
+def by_input(g, values):
+    """A per-edge list in EdgeId order, permuted to input order (the inverse of to_ids)."""
+    out = [0] * len(values)
+    for e, x in enumerate(values):
+        out[int(g.input_positions()[e])] = x
+    return out
+
+
+def stats_of(cache):
+    """The five statistics of a ShortestPathCache as one comparable tuple."""
+    s = cache.stats()
+    return (s.hits, s.misses, s.entries, s.bytes, s.live_values)
+
+
+def ids(g, positions):
+    """The EdgeIds of the edges at the given input positions, ascending."""
+    wanted = {int(p) for p in positions}
+    return sorted(int(e) for e, p in enumerate(g.input_positions()) if int(p) in wanted)
+
+
+def assert_ints(values, optional=False):
+    """Every value is exactly an int: not a bool, not a float equal to it (None too when optional).
+    Equality alone passes 3.0 for 3."""
+    for v in values:
+        assert type(v) is int or (optional and v is None), (v, type(v).__name__)
+
+
+def dag_of(g, edges):
+    """The PredecessorDAG of a set of EdgeIds, through the public PredecessorDAG.from_csr."""
+    per = [[] for _ in range(g.num_nodes())]
+    for e in sorted(edges):
+        per[int(g.edge_destinations()[e])].append(e)
+    offsets, parents, via = [0], [], []
+    for v in range(g.num_nodes()):
+        for e in per[v]:
+            parents.append(int(g.edge_sources()[e]))
+            via.append(e)
+        offsets.append(len(via))
+    return ngc.PredecessorDAG.from_csr(g, offsets, parents, via)
+
+
+def shortest(model=None, **changes):
+    """A ShortestPaths model: `model` (default ShortestPaths()) with the named fields replaced."""
+    model = model or ngc.ShortestPaths()
+    fields = {
+        name: getattr(model, name)
+        for name in (
+            "allocation",
+            "source_allocation",
+            "weight_basis",
+            "edge_weights",
+            "tie_break",
+            "multipath",
+            "parallel_edges",
+        )
+    }
+    fields.update(changes)
+    return ngc.ShortestPaths(**fields)
+
+
+def config(routing, allocation=None, admission=None):
+    """A FlowPolicyConfig, Lossless by default; `allocation` (ShortestPaths only) replaces the
+    model's own."""
+    if allocation is not None:
+        routing = shortest(routing, allocation=allocation)
+    return ngc.FlowPolicyConfig(
+        routing=routing, admission=admission or ngc.Admission.LOSSLESS
+    )
+
+
+def centralized(source_allocation=None, **fields):
+    """CentralizedTE with its required source allocation: OPTIMIZED (the exact maximum flow) by
+    default, EQUAL with a tunnel count (T2)."""
+    if source_allocation is None:
+        source_allocation = (
+            ngc.SourceAllocation.EQUAL
+            if fields.get("tunnel_count") is not None
+            else ngc.SourceAllocation.OPTIMIZED
+        )
+    return ngc.CentralizedTE(source_allocation=source_allocation, **fields)
+
+
+def t1_config(count, admission=None, **routing):
+    """A T1 FlowPolicyConfig: DistributedTE(TunnelCount(count), **routing), Lossless by default."""
+    return ngc.FlowPolicyConfig(
+        routing=ngc.DistributedTE(ngc.TunnelCount(count), **routing),
+        admission=admission or ngc.Admission.LOSSLESS,
+    )
+
+
+# The exact maximum flow (CentralizedTE routing, the optimized source allocation) and ShortestPaths Equal, both
+# Lossless (ShortestPaths() is ECMP: FEWER_HOPS, every route and parallel edge). Configurations
+# are immutable, so tests share these values.
+GLOBAL = config(centralized())
+SHORTEST_PATHS = config(ngc.ShortestPaths())
+
+
+# The result classes whose public attributes are all fields (no methods).
+_RESULTS = (
+    ngc.PlacementResult,
+    ngc.SourceFlow,
+    ngc.TunnelFlow,
+    ngc.ForwardingProgram,
+    ngc.Tunnel,
+    ngc.TunnelPlan,
+    ngc.SensitivityResult,
+    ngc.SensitivityEntry,
+    ngc.SpfResult,
+)
+
+
+def plain(value):
+    """A result as comparable data, with no object identities: a result object (a program and its
+    tunnels included) by every public field, a PredecessorDAG by its three arrays, a Path by its
+    endpoints, hops and cost, an Eligibility by its two masks, containers element by element,
+    arrays as lists."""
+    if isinstance(value, getattr(_netgraph_core, "_PlacementTrace", ())):
+        return plain(value.as_dict())
+    if isinstance(value, _RESULTS):
+        fields = [
+            f
+            for f in dir(value)
+            if not f.startswith("_") and not callable(getattr(value, f))
+        ]
+        return {f: plain(getattr(value, f)) for f in fields}
+    if isinstance(value, ngc.PredecessorDAG):
+        return [
+            plain(a)
+            for a in (value.parent_offsets(), value.parents(), value.via_edges())
+        ]
+    if isinstance(value, ngc.Eligibility):
+        return [plain(value.node_allowed()), plain(value.edge_allowed())]
+    if isinstance(value, ngc.Path):
+        return [value.source(), value.destination(), plain(value.hops()), value.cost()]
+    if isinstance(value, dict):
+        return {k: plain(x) for k, x in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [plain(x) for x in value]
+    return value.tolist() if hasattr(value, "tolist") else value
+
+
+def ledger_state(ledger):
+    """A FlowLedger's public state as comparable data, with no object identity (its uid, which
+    is also the first half of every FlowId, and its graph's uid, which every route carries):
+    both projections (the residual and the allocations, the holds and the unreserved capacity)
+    and every public field of every record, the route as its three arrays."""
+    return [
+        ledger.residual().tolist(),
+        ledger.carried().tolist(),
+        ledger.reserved().tolist(),
+        ledger.unreserved().tolist(),
+        [
+            (
+                r.flow_id[1],
+                r.policy_id,
+                r.sources,
+                r.destinations,
+                r.admission,
+                r.entry_id,
+                [
+                    r.route.parent_offsets().tolist(),
+                    r.route.parents().tolist(),
+                    r.route.via_edges().tolist(),
+                ],
+                r.min_route_cost,
+                r.offered,
+                r.delivered,
+                r.edge_flows,
+                r.edge_drops,
+                r.edge_reservations,
+            )
+            for r in ledger.records()
+        ],
+    ]
+
+
+def full_ledger_state(ledger):
+    """The ledger's observable state, its next FlowId and bound and orphaned owners included
+    (``_state()``: private hooks needed)."""
+    return [ledger._state(), ledger_state(ledger)]
+
+
+def sweep_python_allocation(make, limit=400, collect=True, allocation_call=None):
+    """The all-or-nothing sweep of a call's Python object allocations (private hooks needed).
+    make() gives fresh (fn, args, snapshot); attempt k = 0, 1, ... makes the k-th Python object
+    allocation of fn(*args) fail, until a call completes. Every reached failure raises
+    MemoryError (exactly that class) with no value and leaves snapshot() as it was, and the same call
+    then returns the reference (the plain() value of a call on fresh state); the call that
+    completes returns the reference after each of its allocations failed exactly once. Returns
+    the number of failures, for the caller's check that the sweep is not vacuous. collect (the
+    default): a full collection (gc.collect()) before each attempt empties CPython's free lists, so
+    every int, float, list and tuple the call makes is a new allocation that the attempt can fail."""
+    import gc
+
+    import _netgraph_core as ext
+
+    # Install native probes outside the checked allocation window, when needed.
+    if allocation_call is None:
+        allocation_call = ext._fail_python_allocation
+
+    fn, args, _ = make()
+    want = plain(fn(*args))
+    failures = 0
+    for k in range(limit):
+        fn, args, snapshot = make()
+        before = snapshot()
+        if collect:
+            gc.collect()
+        hit, seen, value, error = allocation_call(fn, args, k)
+        where = (getattr(fn, "__name__", fn), k)
+        if not hit:
+            assert error is None, (where, repr(error))
+            assert plain(value) == want, where
+            assert seen == failures, (where, seen)  # every allocation failed once
+            return failures
+        failures += 1
+        # A reached failure propagates: a call that absorbed it and returned a value fails here.
+        assert value is None, (where, value)
+        assert type(error) is MemoryError, (where, repr(error))
+        assert snapshot() == before, where
+        assert plain(fn(*args)) == want, where
+    pytest.fail(f"{getattr(fn, '__name__', fn)} never completed")
diff --git a/tests/py/private_hooks.py b/tests/py/private_hooks.py
new file mode 100644
index 0000000..61a0a33
--- /dev/null
+++ b/tests/py/private_hooks.py
@@ -0,0 +1,20 @@
+"""Whether the extension carries the private hooks (CMake option NETGRAPH_CORE_PRIVATE_HOOKS: ON
+for the editable development build, OFF for an installed wheel). Tests that need a hook are
+skipped without them, never failed.
+
+A few scenario tests run in both builds and add checks of the private state observers
+(``_state()``: next FlowId, bound and orphaned owners, the requested offer, a flow's members)
+under ``if HOOKS:``; without the hooks those lines alone are left out. They are
+test_flow_ledger.py's test_lifetime_bound_rows_and_epochs,
+test_orphans_from_destruction_reset_and_copy, test_records_fields_and_counters_beyond_64_bits,
+test_empty_split_graph_keeps_the_route_cost and test_rejected_requests_leave_the_policy_and_the_ledger,
+and test_flow_policy.py's test_lifetimes_keep_alive_and_orphans."""
+
+import _netgraph_core
+import pytest
+
+HOOKS = hasattr(_netgraph_core, "_fail_native_allocation")
+
+needs_hooks = pytest.mark.skipif(
+    not HOOKS, reason="needs the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS)"
+)
diff --git a/tests/py/program_oracle.py b/tests/py/program_oracle.py
new file mode 100644
index 0000000..1e4e8d5
--- /dev/null
+++ b/tests/py/program_oracle.py
@@ -0,0 +1,248 @@
+"""An independent reference for forwarding programs of tunnels (the property tests of
+test_programs.py). It restates the rules of docs/semantics.md in plain Python and calls nothing
+of the library: round robin and highest averages, the injection over the roster and the split of
+each head's share over its entries, the lossless bound of a fixed program, the loss rule inside
+one program with the nested split at each link, sources first and then entries, and a maximum
+flow with its residual-graph certificates.
+
+The loss rule is evaluated by synchronous rounds from zero, not by the library's ordering of
+events: for tunnels that visit links in one topological order (the generators draw paths over a
+DAG) the rounds settle on the unique solution of the link equations within the longest path's
+number of hops."""
+
+from __future__ import annotations
+
+from fractions import Fraction
+
+
+def rr(n, k):
+    """Round robin: n units over k members; the first n % k members get one more."""
+    return [n // k + (i < n % k) for i in range(k)] if k else []
+
+
+def ha(n, weights):
+    """Highest averages: each unit to the largest weight / (assigned + 1), ties to the lower
+    position; all weights 0 assign nothing."""
+    total = sum(weights)
+    if total == 0:
+        return [0] * len(weights)
+    got = [n * w // total for w in weights]
+    for _ in range(n - sum(got)):
+        best = max(
+            range(len(weights)), key=lambda i: (Fraction(weights[i], got[i] + 1), -i)
+        )
+        got[best] += 1
+    return got
+
+
+def replay_roster(specs, rows, excluded_edges, destinations):
+    """The replay roster: the heads (ascending) that still reach a destination over their
+    original routes' edges (the union of their tunnels, the saved basis) without the excluded
+    edges, whether or not one of their tunnels survives whole. rows: (u, v, ...) per EdgeId."""
+    heads = sorted({h for h, _, _ in specs})
+    out = []
+    for h in heads:
+        basis = {e for head, es, _ in specs if head == h for e in es} - set(
+            excluded_edges
+        )
+        seen, stack = {h}, [h]
+        while stack:
+            u = stack.pop()
+            for e in basis:
+                if rows[e][0] == u and rows[e][1] not in seen:
+                    seen.add(rows[e][1])
+                    stack.append(rows[e][1])
+        if seen & set(destinations):
+            out.append(h)
+    return out
+
+
+def entry_amounts(x, specs, alive=None, source_weights=None, roster=None):
+    """The amount of each tunnel of a program for a total offer x.
+
+    specs: (head, edges, weight) in index order; alive: per tunnel, False when it is FAILED;
+    roster: the replay roster (default: every head with a tunnel, the program's own). Equal
+    sources split x by round robin over the roster, captured source weights by highest averages;
+    a head then splits its share by highest averages over its surviving tunnels' weights. What no
+    tunnel carries is lost at the source: an empty roster's whole offer, the offer captured
+    weights of 0 do not inject, a head whose surviving tunnels have weight 0 or that has none.
+    Returns (amounts, source_drops)."""
+    alive = alive if alive is not None else [True] * len(specs)
+    roster = roster if roster is not None else sorted({h for h, _, _ in specs})
+    if not roster:
+        return [0] * len(specs), x
+    if source_weights is None:
+        shares = rr(x, len(roster))
+    else:
+        weights = dict(source_weights)
+        shares = ha(x, [weights[h] for h in roster])
+    amounts = [0] * len(specs)
+    lost = x - sum(shares)
+    for h, share in zip(roster, shares, strict=True):
+        ids = [i for i, (head, _, _) in enumerate(specs) if head == h and alive[i]]
+        split = ha(share, [specs[i][2] for i in ids])
+        lost += share - sum(split)
+        for i, a in zip(ids, split, strict=True):
+            amounts[i] = a
+    return amounts, lost
+
+
+def loads(specs, amounts, num_edges):
+    """Per edge, the sum of the amounts of the tunnels that use it (once per use)."""
+    out = [0] * num_edges
+    for (_, edges, _), a in zip(specs, amounts, strict=True):
+        for e in edges:
+            out[e] += a
+    return out
+
+
+def lossless_bound(
+    specs, caps, alive=None, source_weights=None, roster=None, top=1 << 20
+):
+    """The largest x whose amounts fit every capacity and lose nothing at the sources (the
+    split rules are house-monotone, so the fitting offers are a prefix: bisection)."""
+
+    def fits(x):
+        amounts, lost = entry_amounts(x, specs, alive, source_weights, roster)
+        load = loads(specs, amounts, len(caps))
+        return lost == 0 and all(u <= c for u, c in zip(load, caps, strict=True))
+
+    lo, hi = 0, top
+    if fits(hi):
+        return hi
+    while hi - lo > 1:
+        mid = (lo + hi) // 2
+        lo, hi = (mid, hi) if fits(mid) else (lo, mid)
+    return lo
+
+
+def nested_split(service, arrivals, heads):
+    """One link's service split over its occurrences: highest averages over the heads' arrival
+    totals (ascending head), then within each head over its occurrences' arrivals (in order)."""
+    out = [0] * len(arrivals)
+    order = sorted(set(heads))
+    totals = [
+        sum(a for a, h in zip(arrivals, heads, strict=True) if h == k) for k in order
+    ]
+    for k, quota in zip(order, ha(service, totals), strict=True):
+        ids = [i for i, h in enumerate(heads) if h == k]
+        for i, c in zip(ids, ha(quota, [arrivals[i] for i in ids]), strict=True):
+            out[i] = c
+    return out
+
+
+def lossy(specs, amounts, caps):
+    """The loss rule by synchronous rounds from zero. Returns per tunnel (delivered, dropped)
+    and the carried amount of each edge; raises when the rounds do not settle."""
+    occ = {}
+    for i, (_, edges, _) in enumerate(specs):
+        for j, e in enumerate(edges):
+            occ.setdefault(e, []).append((i, j))
+    carried = [[0] * len(edges) for _, edges, _ in specs]
+    limit = 2 + max((len(edges) for _, edges, _ in specs), default=0)
+    for _ in range(limit + 1):
+        arrival = [
+            [a if j == 0 else carried[i][j - 1] for j in range(len(edges))]
+            for i, ((_, edges, _), a) in enumerate(zip(specs, amounts, strict=True))
+        ]
+        new = [[0] * len(edges) for _, edges, _ in specs]
+        for e, members in occ.items():
+            arr = [arrival[i][j] for i, j in members]
+            heads = [specs[i][0] for i, _ in members]
+            for (i, j), c in zip(
+                members, nested_split(min(caps[e], sum(arr)), arr, heads), strict=True
+            ):
+                new[i][j] = c
+        if new == carried:
+            break
+        carried = new
+    else:
+        raise AssertionError("the rounds did not settle")
+    rows = []
+    for i, a in enumerate(amounts):
+        delivered = carried[i][-1] if carried[i] else a
+        rows.append((delivered, a - delivered))
+    edge = [0] * len(caps)
+    for e, members in occ.items():
+        edge[e] = sum(carried[i][j] for i, j in members)
+    return rows, edge
+
+
+def max_flow(num_nodes, arcs, sources, sinks):
+    """Edmonds-Karp over arcs (u, v, cap) from a super source over `sources` to a super sink
+    over `sinks`. Returns (value, flow per arc)."""
+    s, t = num_nodes, num_nodes + 1
+    big = sum(c for _, _, c in arcs) + 1
+    adj = [[] for _ in range(num_nodes + 2)]
+    head, cap = [], []
+
+    def add(u, v, c):
+        adj[u].append(len(head))
+        head.append(v)
+        cap.append(c)
+        adj[v].append(len(head))
+        head.append(u)
+        cap.append(0)
+
+    for u, v, c in arcs:
+        add(u, v, c)
+    for u in sources:
+        add(s, u, big)
+    for v in sinks:
+        add(v, t, big)
+    value = 0
+    while True:
+        parent = [-1] * (num_nodes + 2)
+        parent[s] = -2
+        queue = [s]
+        for u in queue:
+            for a in adj[u]:
+                if cap[a] > 0 and parent[head[a]] == -1:
+                    parent[head[a]] = a
+                    queue.append(head[a])
+        if parent[t] == -1:
+            break
+        push, v = big, t
+        while v != s:
+            a = parent[v]
+            push = min(push, cap[a])
+            v = head[a ^ 1]
+        v = t
+        while v != s:
+            a = parent[v]
+            cap[a] -= push
+            cap[a ^ 1] += push
+            v = head[a ^ 1]
+        value += push
+    return value, [cap[2 * k + 1] for k in range(len(arcs))]
+
+
+def residual_certificates(num_nodes, arcs, flow, sources, sinks):
+    """For a flow on arcs (u, v, cap, cost): (no augmenting path from the sources to the sinks,
+    no negative-cost cycle in the residual graph). Both true: a minimum-cost maximum flow."""
+    res = []
+    for (u, v, c, w), f in zip(arcs, flow, strict=True):
+        if f < c:
+            res.append((u, v, w))
+        if f > 0:
+            res.append((v, u, -w))
+    reach, stack = set(sources), list(sources)
+    while stack:
+        u = stack.pop()
+        for a, b, _ in res:
+            if a == u and b not in reach:
+                reach.add(b)
+                stack.append(b)
+    maximal = not (reach & set(sinks))
+    dist = [
+        0
+    ] * num_nodes  # Bellman-Ford from a virtual root joined to every node at cost 0
+    for _ in range(num_nodes):
+        changed = False
+        for a, b, w in res:
+            if dist[a] + w < dist[b]:
+                dist[b] = dist[a] + w
+                changed = True
+        if not changed:
+            return maximal, True
+    return maximal, False
diff --git a/tests/py/source_allocation_oracle.py b/tests/py/source_allocation_oracle.py
new file mode 100644
index 0000000..76cd198
--- /dev/null
+++ b/tests/py/source_allocation_oracle.py
@@ -0,0 +1,569 @@
+"""Independent references for pooled sources and the source allocation (docs/semantics.md, section 7).
+
+Nothing here calls the extension. ``rr`` and ``ha`` are the round robin and the highest averages
+(the latter one unit at a time, with exact cross-products). ``PooledReference`` replays a ShortestPaths
+policy with ``EQUAL`` or ``WEIGHTED`` routing: each roster source's static shortest-path
+DAG (or canonical path) toward the destinations, their union, one split per router, attribution
+to sources member by member (highest averages over what each source still holds there) and, on an
+edge that drops, highest averages over what each source brought to it; Lossless admits the
+largest total whose round robin forwards with no drop, Lossy forwards hop by hop on the free
+capacity, and an infinite Lossy request is the first-hop experiment. ``equal_source_allocation`` is the
+equal-source-allocation controller: the largest total ``T`` whose round-robin supplies a simple
+augmenting-path maximum flow can carry, and the minimum cost at those supplies by successive
+shortest paths (Bellman-Ford). ``optimized_source_allocation`` is the same without supply caps.
+"""
+
+from __future__ import annotations
+
+INF = float("inf")
+
+
+def rr(x, k):
+    """Round robin of x units over k members: x // k each, one more for the first x % k."""
+    return [x // k + (1 if i < x % k else 0) for i in range(k)]
+
+
+def ha(x, w):
+    """Highest averages: x units one at a time to the member with the largest
+    w[i] / (given[i] + 1), ties to the earlier member; a zero weight gets nothing and
+    all-zero weights give nothing."""
+    out = [0] * len(w)
+    for _ in range(x):
+        best = None
+        for i, wi in enumerate(w):
+            if wi <= 0:
+                continue
+            if best is None or wi * (out[best] + 1) > w[best] * (out[i] + 1):
+                best = i
+        if best is None:
+            break
+        out[best] += 1
+    return out
+
+
+def _graph_lists(g):
+    src = [int(x) for x in g.edge_sources()]
+    dst = [int(x) for x in g.edge_destinations()]
+    cost = [int(x) for x in g.edge_costs()]
+    cap = [int(x) for x in g.edge_capacity_units()]
+    return src, dst, cost, cap
+
+
+def distances_to(n, src, dst, cost, dests, node_allowed, edge_allowed):
+    """Static distance of every node to the nearest allowed destination over allowed edges
+    (Bellman-Ford; capacity-blind), None where none is reachable."""
+    dist = [None] * n
+    for d in dests:
+        if node_allowed[d]:
+            dist[d] = 0
+    for _ in range(n):
+        changed = False
+        for e in range(len(src)):
+            u, v = src[e], dst[e]
+            if (
+                not edge_allowed[e]
+                or not node_allowed[u]
+                or not node_allowed[v]
+                or dist[v] is None
+            ):
+                continue
+            if u in dests:
+                continue  # a path stops at the first destination it meets
+            if dist[u] is None or dist[v] + cost[e] < dist[u]:
+                dist[u] = dist[v] + cost[e]
+                changed = True
+        if not changed:
+            break
+    return dist
+
+
+def tight_edges(src, dst, cost, dests, node_allowed, edge_allowed, dist):
+    """Per node, its tight out-edges in ascending EdgeId (none out of a destination)."""
+    out = {}
+    for e in range(len(src)):
+        u, v = src[e], dst[e]
+        if (
+            not edge_allowed[e]
+            or not node_allowed[u]
+            or not node_allowed[v]
+            or u in dests
+        ):
+            continue
+        if dist[u] is not None and dist[v] is not None and dist[u] == cost[e] + dist[v]:
+            out.setdefault(u, []).append(e)
+    return out
+
+
+def canonical_next(dst, dests, tight, dist):
+    """Per node, the next edge of its canonical path under FEWER_HOPS: the lowest cost (tight
+    edges), then the fewest hops, then the lexicographically smallest EdgeId sequence."""
+    hops = {d: 0 for d in dests}
+    order = sorted((u for u in tight), key=lambda u: dist[u])
+    for u in order:  # every tight edge leads to a strictly smaller distance
+        best = None
+        for e in tight[u]:
+            h = hops.get(dst[e])
+            if h is not None and (best is None or h + 1 < best):
+                best = h + 1
+        if best is not None:
+            hops[u] = best
+    nxt = {}
+    for u in order:
+        if u not in hops:
+            continue
+        for e in tight[u]:  # ascending EdgeId: the first edge of the optimal hop count
+            if hops.get(dst[e]) == hops[u] - 1:
+                nxt[u] = e
+                break
+    return nxt
+
+
+class PooledReference:
+    """A ShortestPaths EQUAL or WEIGHTED policy, replayed call by call."""
+
+    def __init__(
+        self,
+        g,
+        sources,
+        dests,
+        kernel,  # "EB" or "W"
+        lossy,
+        residual,  # the ledger's residual before the first call (per EdgeId)
+        multipath=True,
+        weight_basis="CAPACITY",  # W's weights: "CAPACITY" or "RESIDUAL_SNAPSHOT"
+        excluded_nodes=(),
+        excluded_edges=(),
+    ):
+        self.n = g.num_nodes()
+        self.src, self.dst, self.cost, self.cap = _graph_lists(g)
+        self.m = len(self.src)
+        self.node_allowed = [v not in set(excluded_nodes) for v in range(self.n)]
+        self.edge_allowed = [e not in set(excluded_edges) for e in range(self.m)]
+        self.dests = set(dests)
+        self.inputs = sorted(set(sources))
+        self.kernel = kernel
+        self.lossy = lossy
+        self.multipath = multipath
+        self.weight_basis = weight_basis
+        self.free = list(residual)  # the free capacity (the ledger's residual)
+        dist = distances_to(
+            self.n,
+            self.src,
+            self.dst,
+            self.cost,
+            self.dests,
+            self.node_allowed,
+            self.edge_allowed,
+        )
+        self.roster = [
+            s for s in self.inputs if self.node_allowed[s] and dist[s] is not None
+        ]
+        self.dist = dist
+        self.prepared = False
+        self.requested = 0
+        self.infinite = False
+        self.offered = 0  # Lossy: the round-robin position
+        self.records = {}  # source -> dict(edges, drops, offered, delivered)
+        self.source_drops = {s: 0 for s in self.inputs}
+
+    # -- preparation ----------------------------------------------------------------------
+    def _prepare(self):
+        tight = tight_edges(
+            self.src,
+            self.dst,
+            self.cost,
+            self.dests,
+            self.node_allowed,
+            self.edge_allowed,
+            self.dist,
+        )
+        if not self.multipath:
+            nxt = canonical_next(self.dst, self.dests, tight, self.dist)
+            tight = {u: [e] for u, e in nxt.items()}
+        # Each source's route: the tight edges it reaches.
+        self.route = {}
+        union_nodes = set()
+        for s in self.roster:
+            seen, stack, edges = {s}, [s], set()
+            while stack:
+                u = stack.pop()
+                for e in tight.get(u, []):
+                    edges.add(e)
+                    if self.dst[e] not in seen:
+                        seen.add(self.dst[e])
+                        stack.append(self.dst[e])
+            self.route[s] = edges
+            union_nodes |= seen
+        if self.kernel == "W":
+            weight = [
+                (self.cap[e] if self.weight_basis == "CAPACITY" else self.free[e])
+                for e in range(self.m)
+            ]
+            # Usable nodes: a destination, or a node with a member of positive weight to a
+            # usable node (processed by increasing distance).
+            usable = set(self.dests)
+            members = {}
+            for u in sorted(union_nodes, key=lambda x: self.dist[x]):
+                if u in self.dests:
+                    continue
+                ms = [
+                    e
+                    for e in tight.get(u, [])
+                    if weight[e] > 0 and self.dst[e] in usable
+                ]
+                if ms:
+                    members[u] = ms
+                    usable.add(u)
+            self.weight = weight
+        else:
+            members = {u: list(tight[u]) for u in union_nodes if u in tight}
+            self.weight = None
+        self.members = members
+        self.order = sorted(
+            (u for u in union_nodes if u not in self.dests),
+            key=lambda x: -self.dist[x],
+        )
+        self.records = {
+            s: {"edges": {}, "drops": {}, "offered": 0, "delivered": 0}
+            for s in self.roster
+        }
+        self.prepared = True
+
+    def _split(self, u, x):
+        ms = self.members[u]
+        if self.kernel == "EB":
+            return rr(x, len(ms))
+        return ha(x, [self.weight[e] for e in ms])
+
+    # -- forwarding -----------------------------------------------------------------------
+    def _forward(self, inject, view, first_hop=False):
+        """One forwarding from the roots' injections. Returns per source: carried per edge,
+        dropped per edge, delivered, source loss, offered; with view None, nothing drops and
+        the result says whether every share fitted (fits) and no share was memberless."""
+        k = len(self.roster)
+        index = {s: i for i, s in enumerate(self.roster)}
+        held = {u: [0] * k for u in self.order}  # what each source holds at a node
+        delivered = [0] * k
+        loss = [0] * k
+        offered = [0] * k
+        carried = [dict() for _ in range(k)]
+        dropped = [dict() for _ in range(k)]
+        fits = True
+        for s in self.roster:
+            i = index[s]
+            if not first_hop:
+                held[s][i] += inject[i]
+                offered[i] += inject[i]
+        for u in self.order:
+            have = held[u]
+            x = sum(have)
+            own_hop = (
+                first_hop and u in index and u in self.members
+            )  # the first-hop experiment's own injection, per member
+            if u not in self.members:
+                if x > 0:  # only a root can hold traffic without a member
+                    for i in range(k):
+                        loss[i] += have[i]
+                    fits = False
+                continue
+            ms = self.members[u]
+            shares = self._split(u, x)
+            remaining = list(have)
+            for e, share in zip(ms, shares, strict=True):
+                per = ha(share, remaining)
+                remaining = [a - b for a, b in zip(remaining, per, strict=True)]
+                if own_hop:
+                    own = view[e] if view is not None else 0
+                    per[index[u]] += own
+                    offered[index[u]] += own
+                # Lossless (no view) carries every share; its caller checks the edge bounds.
+                if view is None or sum(per) <= view[e]:
+                    take = per
+                else:
+                    take = ha(view[e], per)
+                for i in range(k):
+                    if take[i]:
+                        carried[i][e] = carried[i].get(e, 0) + take[i]
+                    if per[i] - take[i]:
+                        dropped[i][e] = dropped[i].get(e, 0) + per[i] - take[i]
+                head = self.dst[e]
+                for i in range(k):
+                    if head in self.dests:
+                        delivered[i] += take[i]
+                    else:
+                        held[head][i] += take[i]
+        return carried, dropped, delivered, loss, offered, fits
+
+    def _fits(self, total, view):
+        inject = rr(total, len(self.roster))
+        carried, _, _, _, _, ok = self._forward(inject, None)
+        if not ok:
+            return False
+        for e in range(self.m):
+            if sum(c.get(e, 0) for c in carried) > view[e]:
+                return False
+        return True
+
+    # -- the call -------------------------------------------------------------------------
+    def place(self, offer):
+        """One place(offer) call; returns the result fields the tests compare and applies it
+        to the free capacity and the records."""
+        if offer == 0:
+            return self._result(0, {}, 0, offer)
+        if not self.roster:
+            if offer != INF:
+                self.requested += offer
+            else:
+                self.infinite = True
+            # Nothing can enter: a finite Lossy offer is lost before it enters (offered =
+            # requested, all of it source loss); every row stays zero.
+            lost = offer if self.lossy and offer != INF else 0
+            self.offered += lost
+            return self._result(0, {}, lost, offer, empty=True)
+        if not self.prepared:
+            self._prepare()
+        k = len(self.roster)
+        if offer == INF:
+            self.infinite = True
+        else:
+            self.requested += offer
+        if not self.lossy:
+            own = [0] * self.m
+            admitted = 0
+            for r in self.records.values():
+                admitted += r["delivered"]
+                for e, x in r["edges"].items():
+                    own[e] += x
+            view = [self.free[e] + own[e] for e in range(self.m)]
+            lo = admitted
+            hi = admitted + offer if offer != INF else admitted + sum(view) + 1
+            while lo < hi:  # the largest total that fits (a prefix)
+                mid = (lo + hi + 1) // 2
+                if self._fits(mid, view):
+                    lo = mid
+                else:
+                    hi = mid - 1
+            carried, _, delivered, _, _, _ = self._forward(rr(lo, k), None)
+            for e in range(self.m):
+                self.free[e] = view[e] - sum(c.get(e, 0) for c in carried)
+            for i, s in enumerate(self.roster):
+                self.records[s]["edges"] = dict(carried[i])
+                self.records[s]["delivered"] = delivered[i]
+            return self._result(lo - admitted, {}, 0, offer)
+        if offer == INF:
+            carried, dropped, delivered, loss, offered, _ = self._forward(
+                [0] * k, list(self.free), first_hop=True
+            )
+        else:
+            before = rr(self.offered, k)
+            self.offered += offer
+            after = rr(self.offered, k)
+            inject = [a - b for a, b in zip(after, before, strict=True)]
+            carried, dropped, delivered, loss, offered, _ = self._forward(
+                inject, list(self.free)
+            )
+        call_edge_drops = {}
+        for i, s in enumerate(self.roster):
+            r = self.records[s]
+            for e, x in carried[i].items():
+                r["edges"][e] = r["edges"].get(e, 0) + x
+                self.free[e] -= x
+            for e, x in dropped[i].items():
+                r["drops"][e] = r["drops"].get(e, 0) + x
+                call_edge_drops[e] = call_edge_drops.get(e, 0) + x
+            r["offered"] += offered[i]
+            r["delivered"] += delivered[i]
+            self.source_drops[s] += loss[i]
+        return self._result(sum(delivered), call_edge_drops, sum(loss), offer)
+
+    def _result(self, call_delivered, call_edge_drops, call_loss, offer, empty=False):
+        rows = []
+        for s in self.inputs:
+            r = self.records.get(s)
+            if r is None:
+                rows.append((s, 0 if self.lossy else None, 0, 0, 0, 0))
+                continue
+            dropped = sum(r["drops"].values())
+            if self.lossy:
+                rows.append(
+                    (
+                        s,
+                        r["offered"],
+                        r["offered"],
+                        r["delivered"],
+                        self.source_drops[s],
+                        dropped,
+                    )
+                )
+            else:
+                rows.append((s, None, r["delivered"], r["delivered"], 0, 0))
+        drops = {}
+        for r in self.records.values():
+            for e, x in r["drops"].items():
+                drops[e] = drops.get(e, 0) + x
+        delivered = sum(r["delivered"] for r in self.records.values())
+        requested = INF if self.infinite else self.requested
+        if self.lossy:
+            offered = sum(r["offered"] for r in self.records.values())
+            source_drops = sum(self.source_drops.values())
+            if empty or not self.roster:
+                offered, source_drops = self.offered, self.offered
+            admitted, unadmitted = offered, 0
+        else:
+            offered, source_drops, admitted = None, 0, delivered
+            unadmitted = None if self.infinite else self.requested - delivered
+        if offer == 0:
+            term = "COMPLETE"
+        elif not self.roster:
+            term = "NO_ROUTE"
+        elif not self.members:
+            term = "NO_ACTIVE_WEIGHT"
+        elif self.lossy:
+            term = "COMPLETE" if offer != INF else "EXHAUSTED"
+        else:
+            term = (
+                "COMPLETE" if offer != INF and call_delivered == offer else "EXHAUSTED"
+            )
+        return {
+            "call_delivered": call_delivered,
+            "termination": term,
+            "call_edge_drops": sorted((e, x) for e, x in call_edge_drops.items() if x),
+            "call_source_drops": call_loss,
+            "requested": requested,
+            "offered": offered,
+            "admitted": admitted,
+            "delivered": delivered,
+            "unadmitted": unadmitted,
+            "source_drops": source_drops,
+            "drops": sorted((e, x) for e, x in drops.items() if x),
+            "by_source": rows,
+            "records": {
+                s: (sorted((e, x) for e, x in r["edges"].items() if x), r["delivered"])
+                for s, r in self.records.items()
+            },
+        }
+
+
+# -- the controllers ------------------------------------------------------------------------
+
+
+def _max_flow(n, src, dst, view, allowed, sources, caps, dests):
+    """Maximum flow (augmenting paths, BFS) from a virtual root with an arc of capacity caps[i]
+    to sources[i] (None: unbounded) to a virtual sink fed by every destination."""
+    root, sink = n, n + 1
+    arcs = []  # [u, v, cap, flow]
+    for e in range(len(src)):
+        if allowed[e]:
+            arcs.append([src[e], dst[e], view[e], 0])
+    big = sum(view) + 1
+    for s, c in zip(sources, caps, strict=True):
+        arcs.append([root, s, big if c is None else c, 0])
+    for d in dests:
+        arcs.append([d, sink, big, 0])
+    total = 0
+    while True:
+        parent = {root: None}
+        queue = [root]
+        for u in queue:
+            for i, (a, b, c, f) in enumerate(arcs):
+                if a == u and f < c and b not in parent:
+                    parent[b] = (i, 1)
+                    queue.append(b)
+                if b == u and f > 0 and a not in parent:
+                    parent[a] = (i, -1)
+                    queue.append(a)
+        if sink not in parent:
+            return total
+        path, v = [], sink
+        while v != root:
+            i, sign = parent[v]
+            path.append((i, sign))
+            v = arcs[i][0] if sign == 1 else arcs[i][1]
+        amount = min(arcs[i][2] - arcs[i][3] if s == 1 else arcs[i][3] for i, s in path)
+        for i, s in path:
+            arcs[i][3] += s * amount
+        total += amount
+
+
+def _min_cost(n, src, dst, cost, view, allowed, sources, caps, dests, value):
+    """The minimum cost of a flow of `value` with root arcs capped at caps (None: unbounded),
+    by successive shortest paths with Bellman-Ford; None when value is not reachable."""
+    root, sink = n, n + 1
+    big = sum(view) + 1
+    arcs = []
+    for e in range(len(src)):
+        if allowed[e]:
+            arcs.append([src[e], dst[e], view[e], cost[e], 0])
+    for s, c in zip(sources, caps, strict=True):
+        arcs.append([root, s, big if c is None else c, 0, 0])
+    for d in dests:
+        arcs.append([d, sink, big, 0, 0])
+    sent, total = 0, 0
+    while sent < value:
+        dist = [None] * (n + 2)
+        parent = [None] * (n + 2)
+        dist[root] = 0
+        for _ in range(n + 2):
+            changed = False
+            for i, (u, v, c, w, f) in enumerate(arcs):
+                if (
+                    f < c
+                    and dist[u] is not None
+                    and (dist[v] is None or dist[u] + w < dist[v])
+                ):
+                    dist[v], parent[v], changed = dist[u] + w, (i, 1), True
+                if (
+                    f > 0
+                    and dist[v] is not None
+                    and (dist[u] is None or dist[v] - w < dist[u])
+                ):
+                    dist[u], parent[u], changed = dist[v] - w, (i, -1), True
+            if not changed:
+                break
+        if dist[sink] is None:
+            return None
+        path, v = [], sink
+        while v != root:
+            i, s = parent[v]
+            path.append((i, s))
+            v = arcs[i][0] if s == 1 else arcs[i][1]
+        amount = min(arcs[i][2] - arcs[i][4] if s == 1 else arcs[i][4] for i, s in path)
+        amount = min(amount, value - sent)
+        for i, s in path:
+            arcs[i][4] += s * amount
+        sent += amount
+        total += dist[sink] * amount
+    return total
+
+
+def equal_source_allocation(g, roster, dests, view, allowed, limit=None):
+    """(T, cost): the largest total up to `limit` whose round-robin supplies over the roster
+    fit (the solve reaches T), and the minimum cost at those supplies."""
+    n = g.num_nodes()
+    src, dst, cost, _ = _graph_lists(g)
+    k = len(roster)
+    if k == 0:
+        return 0, 0
+    top = sum(view) if limit is None else limit
+    best = 0
+    for t in range(1, top + 1):  # feasible totals form a prefix
+        if _max_flow(n, src, dst, view, allowed, roster, rr(t, k), dests) != t:
+            break
+        best = t
+    return best, _min_cost(
+        n, src, dst, cost, view, allowed, roster, rr(best, k), dests, best
+    )
+
+
+def optimized_source_allocation(g, roster, dests, view, allowed, limit=None):
+    """(T, cost): the maximum flow up to `limit` from the roster and its minimum cost."""
+    n = g.num_nodes()
+    src, dst, cost, _ = _graph_lists(g)
+    if not roster:
+        return 0, 0
+    top = _max_flow(n, src, dst, view, allowed, roster, [None] * len(roster), dests)
+    if limit is not None:
+        top = min(top, limit)
+    return top, _min_cost(
+        n, src, dst, cost, view, allowed, roster, [None] * len(roster), dests, top
+    )
diff --git a/tests/py/test_api_validation.py b/tests/py/test_api_validation.py
deleted file mode 100644
index fad6b01..0000000
--- a/tests/py/test_api_validation.py
+++ /dev/null
@@ -1,147 +0,0 @@
-"""API validation: argument shapes, bounds, and error handling for frontdoor APIs."""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-def _small_graph(build_graph):
-    # 0 -> 1 with cost=1, cap=1
-    return build_graph(2, [(0, 1, 1.0, 1.0, 0)])
-
-
-def test_spf_invalid_node_mask_shape_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    bad_mask = np.array([True], dtype=bool)  # wrong length
-    with pytest.raises(TypeError):
-        algs.spf(to_handle(g), 0, 1, selection=sel, node_mask=bad_mask)
-
-
-def test_spf_invalid_edge_mask_shape_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    bad_edge_mask = np.array([True, False, True], dtype=bool)  # wrong length
-    with pytest.raises(TypeError):
-        algs.spf(to_handle(g), 0, 1, selection=sel, edge_mask=bad_edge_mask)
-
-
-def test_spf_invalid_source_node_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    with pytest.raises(ValueError):
-        algs.spf(to_handle(g), 10)  # out of range src
-
-
-def test_max_flow_invalid_masks_shape_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    bad_edge_mask = np.array([True, False, True], dtype=bool)
-    with pytest.raises(TypeError):
-        algs.max_flow(to_handle(g), 0, 1, edge_mask=bad_edge_mask)
-
-    bad_node_mask = np.array([True], dtype=bool)
-    with pytest.raises(TypeError):
-        algs.max_flow(to_handle(g), 0, 1, node_mask=bad_node_mask)
-
-
-def test_ksp_invalid_k_and_dst_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    with pytest.raises(ValueError):
-        algs.ksp(to_handle(g), 0, 1, k=0, max_cost_factor=None, unique=True)
-    with pytest.raises(ValueError):
-        algs.ksp(to_handle(g), 0, 100, k=1, max_cost_factor=None, unique=True)
-
-
-def test_batch_max_flow_invalid_pairs_shape_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    pairs = np.array([[0, 1, 2]], dtype=np.int32)  # wrong shape
-    with pytest.raises(TypeError):
-        algs.batch_max_flow(to_handle(g), pairs)
-
-
-def test_batch_max_flow_masks_length_mismatch_raises(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    pairs = np.array([[0, 1], [0, 1]], dtype=np.int32)
-    node_masks = [np.array([True, True], dtype=bool)]  # len 1, need 2
-    with pytest.raises(TypeError):
-        algs.batch_max_flow(to_handle(g), pairs, node_masks=node_masks)
-
-
-def test_flowstate_views_are_readonly():
-    """Verify that FlowState views return read-only arrays."""
-    g = _make_graph(
-        3,
-        np.array([0, 1], dtype=np.int32),
-        np.array([1, 2], dtype=np.int32),
-        np.array([10.0, 10.0]),
-        np.ones(2, dtype=np.int64),
-    )
-
-    fs = ngc.FlowState(g)
-
-    # Test capacity_view is read-only
-    capacity_view = fs.capacity_view()
-    assert not capacity_view.flags.writeable, "capacity_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        capacity_view[0] = 5.0
-
-    # Test residual_view is read-only
-    residual_view = fs.residual_view()
-    assert not residual_view.flags.writeable, "residual_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        residual_view[0] = 5.0
-
-    # Test edge_flow_view is read-only
-    edge_flow_view = fs.edge_flow_view()
-    assert not edge_flow_view.flags.writeable, "edge_flow_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        edge_flow_view[0] = 5.0
-
-
-def test_flowgraph_views_are_readonly():
-    """Verify that FlowGraph views return read-only arrays."""
-    g = _make_graph(
-        3,
-        np.array([0, 1], dtype=np.int32),
-        np.array([1, 2], dtype=np.int32),
-        np.array([10.0, 10.0]),
-        np.ones(2, dtype=np.int64),
-    )
-
-    fg = ngc.FlowGraph(g)
-
-    # Test capacity_view is read-only
-    capacity_view = fg.capacity_view()
-    assert not capacity_view.flags.writeable, "capacity_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        capacity_view[0] = 999.0
-
-    # Test residual_view is read-only
-    residual_view = fg.residual_view()
-    assert not residual_view.flags.writeable, "residual_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        residual_view[0] = 999.0
-
-    # Test edge_flow_view is read-only
-    edge_flow_view = fg.edge_flow_view()
-    assert not edge_flow_view.flags.writeable, "edge_flow_view should be read-only"
-    with pytest.raises((ValueError, RuntimeError)):
-        edge_flow_view[0] = 999.0
diff --git a/tests/py/test_apply_actions.py b/tests/py/test_apply_actions.py
new file mode 100644
index 0000000..50bae2b
--- /dev/null
+++ b/tests/py/test_apply_actions.py
@@ -0,0 +1,1801 @@
+"""apply_actions: several policies of one ledger in one operation (docs/semantics.md, "Several
+demands at once"). The action values and the call's conversions (the types first, in argument
+order, then the list's checks in list order; a refusal changes nothing), ORDERED as the same
+scalar calls on a private working state, SIMULTANEOUS on one view with the losses shared across
+the demands, per-entry outputs, the all-or-nothing sweeps of a list's Python allocations and the
+forwarding size limits counted over the whole list. Hand-derived values on small graphs (EdgeIds
+equal input positions unless mapped); two seeded generators compare an ORDERED list with the same
+scalar calls, and a SIMULTANEOUS participant with its scalar call, on an identical world."""
+
+from __future__ import annotations
+
+import gc
+import random
+import weakref
+from fractions import Fraction
+
+import _netgraph_core as ext
+import numpy as np
+import pytest
+from helpers import (
+    INF,
+    L62,
+    assert_read_only,
+    build,
+    centralized,
+    config,
+    dag_of,
+    exact,
+    full_ledger_state,
+    ledger_state,
+    plain,
+    shortest,
+    sweep_python_allocation,
+    t1_config,
+)
+from private_hooks import HOOKS, needs_hooks
+
+import netgraph_core as ngc
+
+LY = ngc.Admission.LOSSY
+LL = ngc.Admission.LOSSLESS
+ORDERED = ngc.BatchMode.ORDERED
+SIMULTANEOUS = ngc.BatchMode.SIMULTANEOUS
+W62 = L62 - 1
+OFFER = "offer must be an integer in [0, 2^62) or permitted +inf"
+PERIOD_TWO = "lossy forwarding iteration entered a period-2 cycle"
+ROUND_LIMIT = (
+    "lossy forwarding iteration did not reach a fixed point within the round limit"
+)
+ALL = ngc.OutputOptions(
+    edge_flows=True,
+    residual=True,
+    saturated_boundary_edges=True,
+    edge_reservations=True,
+)
+UP = ngc.TunnelStatus.UP
+BLACKHOLED = ngc.TunnelStatus.BLACKHOLED
+
+
+def graph(n, rows):
+    """A Graph from (u, v, capacity, cost) rows written in EdgeId order (checked)."""
+    g = build(n, rows)
+    assert [int(i) for i in g.input_positions()] == list(range(len(rows)))
+    return g
+
+
+def mapped(n, rows):
+    """A Graph from rows in any order and the EdgeId of each input row."""
+    g = build(n, rows)
+    ids = [0] * len(rows)
+    for e, p in enumerate(g.input_positions()):
+        ids[int(p)] = e
+    return g, ids
+
+
+def ecmp(admission=LY):
+    return config(ngc.ShortestPaths(), admission=admission)
+
+
+def t1(admission=LY):
+    return t1_config(1, admission)
+
+
+def t2(admission=LY):
+    return config(centralized(tunnel_count=ngc.TunnelCount(1)), admission=admission)
+
+
+def controller(admission=LL):
+    return config(centralized(), admission=admission)
+
+
+def tunnels(g, sources, destinations, specs):
+    """A supplied program of tunnels: specs are (head, [EdgeIds in path order], weight)."""
+    routes = [
+        ngc.RouteDefinition(h, ngc.Path(g, [[e] for e in es]), weight=w)
+        for h, es, w in specs
+    ]
+    return ngc.ForwardingProgram.from_routes(g, sources, destinations, routes)
+
+
+def tunnel(g, s, d, edges, weight=1):
+    return tunnels(g, [s], [d], [(s, edges, weight)])
+
+
+def no_edges(g, edges):
+    return g.eligibility(excluded_edges=edges)
+
+
+def no_nodes(g, nodes):
+    return g.eligibility(excluded_nodes=nodes)
+
+
+def policy_state(p):
+    """A policy's state without object identities: its delivery, its records' local ids and
+    flows, its program and (private hooks) its epoch."""
+    out = [
+        p.delivered(),
+        [(r.flow_id[1], r.delivered, r.edge_flows, r.edge_drops) for r in p.records()],
+        plain(p.program),
+    ]
+    if HOOKS:
+        epoch = p._state()
+        for flows in epoch["cohorts"].values():
+            for flow in flows:
+                flow["flow_id"] = flow["flow_id"][1]
+        out.append(epoch)
+    return out
+
+
+class World:
+    """A ledger with its policies (created in order), each policy's sources and mask."""
+
+    def __init__(self, g, service=None, reservation=None):
+        self.g = g
+        self.ledger = ngc.FlowLedger(g, service, reservation_baseline=reservation)
+        self.p = []
+        self.sources = []
+        self.masks = []
+
+    def add(self, sources, destinations, cfg, mask=None):
+        self.p.append(ngc.FlowPolicy(self.ledger, sources, destinations, cfg, mask))
+        self.sources.append(sources)
+        self.masks.append(mask)
+        return self.p[-1]
+
+    def pin(self, program, admission=LY, black_holes=None, mask=None):
+        cfg = ngc.FlowPolicyConfig(
+            routing=ngc.Pinned(program, black_holes=black_holes), admission=admission
+        )
+        return self.add(list(program.sources), list(program.destinations), cfg, mask)
+
+    def state(self):
+        """The ledger (private hooks: with its next FlowId and owners) and every policy."""
+        ledger = full_ledger_state(self.ledger) if HOOKS else ledger_state(self.ledger)
+        return [ledger, [policy_state(p) for p in self.p]]
+
+
+def run(w, actions, mode=ORDERED, outputs=None):
+    out = ngc.apply_actions(w.ledger, actions, mode=mode, outputs=outputs)
+    assert type(out) is list and len(out) == len(actions)
+    assert all(type(r) is ngc.PlacementResult for r in out)
+    return out
+
+
+def refused(w, actions, mode=ORDERED, outputs=None, error=ValueError):
+    """The message of the error the list raises (exactly that class); nothing changed."""
+    before = w.state()
+    with pytest.raises(error) as info:
+        ngc.apply_actions(w.ledger, actions, mode=mode, outputs=outputs)
+    assert type(info.value) is error
+    assert w.state() == before
+    return str(info.value)
+
+
+def delivered(results):
+    return [r.call_delivered for r in results]
+
+
+def cyc12():
+    """The cycle Pc's graph: CYC(1, 2)."""
+    return graph(
+        6,
+        [
+            (0, 1, 1, 1),
+            (1, 2, 1000, 1),
+            (1, 5, 1000, 1),
+            (2, 3, 2, 1),
+            (3, 0, 1000, 1),
+            (3, 5, 1000, 1),
+            (4, 0, 1000, 1),
+            (4, 2, 1000, 1),
+        ],
+    )
+
+
+def pc_program(g):
+    """Two tunnels crossing X (e0) and Y (e3) in opposite orders, weights 1 and 2: replace(3)
+    enters a period-2 cycle."""
+    return tunnels(g, [4], [5], [(4, [6, 0, 1, 3, 5], 1), (4, [7, 3, 4, 0, 2], 2)])
+
+
+def g1():
+    return graph(2, [(0, 1, 10, 1)])
+
+
+# -- the action values -------------------------------------------------------------------------
+
+
+def test_action_fields():
+    g = g1()
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, ecmp())
+    m = no_edges(g, [0])
+    place, rep, fwd = (
+        ngc.Place(p, 3),
+        ngc.Replace(p, 3, design_demand=5),
+        ngc.Forward(p, 3, black_holes=m),
+    )
+    assert place.policy is p and rep.policy is p and fwd.policy is p
+    assert [place.offer, rep.offer, fwd.offer, rep.design_demand] == [3, 3, 3, 5]
+    assert all(type(x) is int for x in (place.offer, rep.offer, rep.design_demand))
+    assert fwd.black_holes is m
+    assert ngc.Place(p, INF).offer == INF
+    assert ngc.Replace(p, 3).design_demand is None
+    assert ngc.Forward(p, 3).black_holes is None
+    # Kept as given, never converted to units.
+    assert ngc.Place(p, 2**70).offer == 2**70
+    assert ngc.Replace(p, 1.5, design_demand=2.5).design_demand == 2.5
+    assert_read_only(place, "policy", "offer")
+    assert_read_only(rep, "policy", "offer", "design_demand")
+    assert_read_only(fwd, "policy", "offer", "black_holes")
+
+
+def test_signatures():
+    g = g1()
+    led = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(led, 0, 1, ecmp())
+    m = no_edges(g, [0])
+    for build_one in (
+        lambda: ngc.Replace(p, 1, 5),
+        lambda: ngc.Forward(p, 1, m),
+        lambda: ngc.apply_actions(led, [], ORDERED),
+        lambda: ngc.apply_actions(led, [], ORDERED, None),
+    ):
+        with pytest.raises(TypeError, match="incompatible"):
+            build_one()
+    out = ngc.apply_actions(
+        ledger=led, actions=[ngc.Replace(p, 1)], mode=ORDERED, outputs=None
+    )
+    assert type(out) is list and len(out) == 1
+
+
+def test_action_construction_errors():
+    g = g1()
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, ecmp())
+    cases = [
+        (lambda: ngc.Place(None, 1), "policy must be a FlowPolicy (got NoneType)"),
+        (lambda: ngc.Place(3, 1), "policy must be a FlowPolicy (got int)"),
+        (lambda: ngc.Place(p, True), "offer must be an int or a float (got bool)"),
+        (lambda: ngc.Place(p, "1"), "offer must be an int or a float (got str)"),
+        (lambda: ngc.Place(p, None), "offer must be an int or a float (got NoneType)"),
+        (
+            lambda: ngc.Place(p, Fraction(3, 2)),
+            "offer must be an int or a float (got Fraction)",
+        ),
+        (
+            lambda: ngc.Place(p, np.bool_(True)),
+            "offer must be an int or a float (got bool)",
+        ),
+        (
+            lambda: ngc.Replace(p, 1, design_demand=True),
+            "design_demand must be an int or a float (got bool)",
+        ),
+        (
+            lambda: ngc.Replace(p, 1, design_demand="x"),
+            "design_demand must be an int or a float (got str)",
+        ),
+        (
+            lambda: ngc.Forward(p, 1, black_holes=3),
+            "black_holes must be an Eligibility or None (got int)",
+        ),
+        (
+            lambda: ngc.Forward(p, True, black_holes=3),
+            "offer must be an int or a float (got bool)",
+        ),
+        (
+            lambda: ngc.Replace(None, True),
+            "policy must be a FlowPolicy (got NoneType)",
+        ),
+    ]
+    for make, text in cases:
+        with pytest.raises(TypeError, match=exact(text)) as info:
+            make()
+        assert type(info.value) is TypeError
+    with pytest.raises(TypeError, match="incompatible"):
+        ngc.Place(p, 1, design_demand=1)
+    with pytest.raises(TypeError, match="incompatible"):
+        ngc.Place(p)
+    # NumPy integers are ints (kept as Python ints), NumPy floats are floats.
+    three = ngc.Place(p, np.int64(3)).offer
+    assert three == 3 and type(three) is int
+    assert ngc.Place(p, np.uint8(3)).offer == 3
+    assert ngc.Place(p, np.float32(1.5)).offer == 1.5
+    assert ngc.Place(p, np.float64(INF)).offer == INF
+
+    class Index:
+        def __index__(self):
+            return 4
+
+    assert type(ngc.Place(p, Index()).offer) is int
+
+
+def test_offers_are_checked_by_the_call():
+    g = g1()
+    w = World(g)
+    p = w.add(0, 1, ecmp())
+    w.add(0, 1, ecmp()).place(2)
+    for offer in (-1, 2**62, 2**63, 2**70, 1.5, np.float32(1.5), float("nan"), -INF):
+        action = ngc.Place(p, offer)  # constructs
+        assert refused(w, [action]) == OFFER
+        assert refused(w, [ngc.Replace(p, offer)], SIMULTANEOUS) == OFFER
+    for design in (-1, 2**63, 1.5, float("nan")):
+        t = w.add(0, 1, t1())
+        text = "design_demand must be an integer in [0, 2^62) or permitted +inf"
+        assert refused(w, [ngc.Replace(t, 1, design_demand=design)]) == text
+    # +inf (a NumPy infinity too) is +inf, never a bad finite value.
+    f = w.add(0, 1, ecmp(LL))
+    assert run(w, [ngc.Replace(f, np.float64(INF))])[0].requested == INF
+
+
+def test_list_conversion_errors():
+    g = g1()
+    w = World(g)
+    e = w.add(0, 1, ecmp())
+    other = World(g1())
+    x = other.add(0, 1, ecmp())
+    e.place(2)
+    cases = [
+        ((None, []), {}, "ledger must be a FlowLedger"),
+        ((5, []), {}, "ledger must be a FlowLedger"),
+        ((None, 5), {}, "ledger must be a FlowLedger"),
+        (
+            (w.ledger, 5),
+            {},
+            "actions must be a sequence of Place, Replace or Forward (got int)",
+        ),
+        (
+            (w.ledger, "ab"),
+            {},
+            "actions must be a sequence of Place, Replace or Forward (got str)",
+        ),
+        (
+            (w.ledger, [ngc.Place(e, 1), 1]),
+            {},
+            "actions[1] must be a Place, Replace or Forward (got int)",
+        ),
+        # Before any native check: the foreign first action, the bad mode.
+        (
+            (w.ledger, [ngc.Place(x, 1), None]),
+            {"mode": ngc.BatchMode(7)},
+            "actions[1] must be a Place, Replace or Forward (got NoneType)",
+        ),
+        ((w.ledger, []), {"mode": 0}, "mode must be a BatchMode (got int)"),
+        ((w.ledger, []), {"mode": None}, "mode must be a BatchMode (got NoneType)"),
+        (
+            (w.ledger, [ngc.Place(x, 1)]),
+            {"outputs": 1},
+            "outputs must be an OutputOptions (got int)",
+        ),
+    ]
+    for args, kw, text in cases:
+        before = w.state()
+        with pytest.raises(TypeError, match=exact(text)) as info:
+            ngc.apply_actions(*args, **kw)
+        assert type(info.value) is TypeError
+        assert w.state() == before
+    # A tuple, a NumPy object array and a generator-free sequence are sequences.
+    assert delivered(run(w, (ngc.Replace(e, 3),))) == [3]
+    assert delivered(run(w, np.array([ngc.Replace(e, 4)], dtype=object))) == [4]
+
+
+def test_actions_keep_their_objects_alive():
+    g = graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)])
+    led = ngc.FlowLedger(g)
+    action = ngc.Replace(ngc.FlowPolicy(led, 0, 1, ecmp()), 4)
+    gc.collect()
+    assert delivered(ngc.apply_actions(led, [action])) == [4]
+    assert led.carried().tolist() == [2, 2]
+    held = ngc.FlowPolicy(led, 0, 1, ecmp())
+    held.replace(2)
+    forward = ngc.Forward(held, 6, black_holes=g.eligibility(excluded_edges=[1]))
+    alive = weakref.ref(forward.black_holes)
+    del held
+    gc.collect()
+    assert alive() is not None
+    r = ngc.apply_actions(led, [forward])[0]
+    assert r.call_delivered == 3 and r.call_edge_drops == [(1, 3)]
+    assert len(led.records()) == 2
+
+
+# -- validation --------------------------------------------------------------------------------
+
+
+def test_empty_list():
+    w = World(g1())
+    e = w.add(0, 1, ecmp())
+    e.place(3)
+    before = w.state()
+    assert run(w, []) == [] and run(w, [], SIMULTANEOUS) == []
+    assert w.state() == before
+    text = "mode: 7 is not a value of BatchMode"
+    assert refused(w, [], ngc.BatchMode(7)) == text
+    assert refused(w, [ngc.Place(e, 1)], ngc.BatchMode(7)) == text
+
+
+def test_validation_order():
+    w = World(g1())
+    e = w.add(0, 1, ecmp())
+    e2 = w.add(0, 1, ecmp())
+    f = w.add(0, 1, ecmp(LL))
+    t = w.add(0, 1, t1())
+    k = w.add(0, 1, controller())
+    opt = w.add(0, 1, config(ngc.ShortestPaths(), ngc.RouteAllocation.OPTIMIZED))
+    tt = w.add(0, 1, t2())
+    p = w.pin(tunnel(w.g, 0, 1, [0]))
+    pll = w.pin(tunnel(w.g, 0, 1, [0]), LL)
+    inf = w.add(0, 1, ecmp())
+    other = World(g1())
+    x = other.add(0, 1, ecmp())
+    inf.place(INF)
+    k.place(1)
+    e.place(2)
+    P, R, F = ngc.Place, ngc.Replace, ngc.Forward
+    model = "SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned"
+    lossy = "SIMULTANEOUS requires admission=LOSSY"
+    cases = [
+        # Ownership, then the duplicate rule (at the second occurrence).
+        ([P(e, 1), P(e, 2)], ORDERED, "duplicate policy in list"),
+        ([R(e, 1), F(e, 1)], ORDERED, "duplicate policy in list"),
+        ([R(e, 1), F(e, 1)], SIMULTANEOUS, "duplicate policy in list"),
+        ([P(x, 1)], ORDERED, "list policy belongs to another ledger"),
+        ([P(x, 1), P(x, 1)], ORDERED, "list policy belongs to another ledger"),
+        ([R(x, 1)], SIMULTANEOUS, "list policy belongs to another ledger"),
+        ([P(e, 1), P(e, -1)], ORDERED, "duplicate policy in list"),
+        # Every check of an action before the next action's.
+        ([P(e, -1), P(e2, 1)], ORDERED, OFFER),
+        ([P(e, -1), P(x, 1)], ORDERED, OFFER),
+        ([P(e, -1), P(e, 1)], ORDERED, OFFER),
+        # SIMULTANEOUS's rules in their order, then the scalar checks.
+        ([P(e, 1)], SIMULTANEOUS, "SIMULTANEOUS does not accept Place"),
+        ([R(t, 1)], SIMULTANEOUS, model),
+        ([R(k, 1)], SIMULTANEOUS, model),
+        ([R(opt, 1)], SIMULTANEOUS, model),
+        ([R(tt, 1)], SIMULTANEOUS, model),
+        ([R(f, 1)], SIMULTANEOUS, lossy),
+        ([R(pll, 1)], SIMULTANEOUS, lossy),
+        ([F(k, 1)], SIMULTANEOUS, lossy),
+        ([R(e, INF)], SIMULTANEOUS, "SIMULTANEOUS requires finite offers"),
+        ([F(p, 1)], SIMULTANEOUS, "Pinned forwards with replace"),
+        ([F(e2, 1)], SIMULTANEOUS, "forward requires an installed program"),
+        ([R(e, -1)], SIMULTANEOUS, OFFER),
+        (
+            [R(e, 1, design_demand=1)],
+            SIMULTANEOUS,
+            "ShortestPaths does not accept design_demand",
+        ),
+        # Several invalid parts in one action.
+        ([F(e2, INF)], SIMULTANEOUS, "SIMULTANEOUS requires finite offers"),
+        ([F(k, INF)], SIMULTANEOUS, lossy),
+        ([R(t, -1)], SIMULTANEOUS, model),
+        (
+            [R(e2, 1), P(e, 1), R(t, 1)],
+            SIMULTANEOUS,
+            "SIMULTANEOUS does not accept Place",
+        ),
+        # ORDERED runs the scalar checks in the call's order.
+        ([P(t, 1)], ORDERED, "DistributedTE does not support incremental placement"),
+        (
+            [P(tt, 0)],
+            ORDERED,
+            "CentralizedTE with tunnel_count does not support incremental placement",
+        ),
+        (
+            [F(e, 1, black_holes=no_edges(other.g, [0]))],
+            ORDERED,
+            "black_holes belongs to another graph",
+        ),
+        (
+            [P(inf, 1)],
+            ORDERED,
+            "finite placement after infinite placement requires a new epoch",
+        ),
+        ([P(t, -1)], ORDERED, "DistributedTE does not support incremental placement"),
+        ([F(p, 1)], ORDERED, "Pinned forwards with replace"),
+        ([F(e2, 1)], ORDERED, "forward requires an installed program"),
+        (
+            [R(f, 1, design_demand=2)],
+            ORDERED,
+            "ShortestPaths does not accept design_demand",
+        ),
+        (
+            [R(t, 1, design_demand=INF)],
+            ORDERED,
+            "DistributedTE requires a finite design demand",
+        ),
+    ]
+    for actions, mode, text in cases:
+        assert refused(w, actions, mode) == text, (actions, mode)
+
+
+def test_invalid_last_action_changes_nothing():
+    w = World(cyc12())
+    pc = w.pin(pc_program(w.g))
+    t = w.add(4, 5, t1())
+    fresh = [w.add(4, 5, ecmp()) for _ in range(48)]
+    e = w.add(4, 5, ecmp())
+    ordered = [ngc.Replace(pc, 3)] + [ngc.Place(f, 1) for f in fresh]
+    simultaneous = [ngc.Replace(pc, 3)] + [ngc.Replace(f, 1) for f in fresh]
+    assert (
+        refused(w, [*ordered, ngc.Place(t, 1)])
+        == "DistributedTE does not support incremental placement"
+    )
+    assert (
+        refused(w, [*simultaneous, ngc.Place(e, 1)], SIMULTANEOUS)
+        == "SIMULTANEOUS does not accept Place"
+    )
+    # Controls: without the last action, the computation's error.
+    assert refused(w, ordered) == PERIOD_TWO
+    assert refused(w, simultaneous, SIMULTANEOUS) == PERIOD_TWO
+
+
+# -- ORDERED -----------------------------------------------------------------------------------
+
+
+def test_earlier_actions_are_served_first():
+    # A reservation protects nothing: on one link of 10 the first action takes the link.
+    for tunnel_first in (False, True):
+        w = World(g1())
+        e = w.add(0, 1, ecmp())
+        t = w.add(0, 1, t1())
+        re, rt = ngc.Replace(e, 10), ngc.Replace(t, 10, design_demand=10)
+        r = run(w, [rt, re] if tunnel_first else [re, rt])
+        er, tr = (r[1], r[0]) if tunnel_first else (r[0], r[1])
+        first, second = (tr, er) if tunnel_first else (er, tr)
+        assert first.call_delivered == 10 and first.call_edge_drops == []
+        assert second.call_delivered == 0 and second.call_edge_drops == [(0, 10)]
+        assert tr.by_tunnel[0].status == UP
+        assert w.ledger.carried().tolist() == [10]
+        assert w.ledger.reserved().tolist() == [10]
+        assert w.ledger.residual().tolist() == [0]
+        assert w.ledger.unreserved().tolist() == [0]
+
+
+def test_flow_ids_in_list_order():
+    w = World(g1())
+    a = w.add(0, 1, ecmp())
+    b = w.add(0, 1, ecmp())
+    run(w, [ngc.Replace(b, 1), ngc.Replace(a, 1)])
+    assert b.records()[0].flow_id == (w.ledger.uid(), 0)
+    assert a.records()[0].flow_id == (w.ledger.uid(), 1)
+
+
+def test_ordered_outputs_after_each_action():
+    w = World(g1())
+    a = w.add(0, 1, ecmp())
+    b = w.add(0, 1, ecmp())
+    o = ngc.OutputOptions(edge_flows=True, residual=True, saturated_boundary_edges=True)
+    ra, rb = run(w, [ngc.Replace(a, 7), ngc.Replace(b, 7)], outputs=o)
+    assert ra.call_delivered == 7 and ra.residual.tolist() == [3]
+    assert ra.saturated_boundary_edges == [] and ra.edge_flows.tolist() == [7]
+    assert rb.call_delivered == 3 and rb.call_edge_drops == [(0, 4)]
+    assert rb.residual.tolist() == [0] and rb.saturated_boundary_edges == [0]
+    assert rb.edge_flows.tolist() == [3]
+
+
+def test_ordered_holds_after_each_action():
+    for reversed_order in (False, True):
+        w = World(g1())
+        t = w.add(0, 1, t1())
+        u = w.add(0, 1, t1())
+        o = ngc.OutputOptions(edge_reservations=True)
+        rt = ngc.Replace(t, 10, design_demand=10)
+        ru = ngc.Replace(u, 10, design_demand=10)
+        first, second = run(w, [ru, rt] if reversed_order else [rt, ru], outputs=o)
+        assert first.by_tunnel[0].status == UP and first.call_delivered == 10
+        assert first.edge_reservations.tolist() == [10]
+        assert second.by_tunnel[0].status == ngc.TunnelStatus.INSUFFICIENT_BANDWIDTH
+        assert second.call_source_drops == 10 and second.call_delivered == 0
+        assert second.edge_reservations.tolist() == [0]
+        assert w.ledger.reserved().tolist() == [10]
+
+
+def test_normal_outcomes_commit():
+    w = World(g1())
+    e = w.add(0, 1, ecmp())
+    f = w.add(0, 1, ecmp(LL))
+    e2 = w.add(0, 1, ecmp())
+    re, rf = run(w, [ngc.Replace(e, 10), ngc.Replace(f, 5)])
+    assert re.call_delivered == 10
+    assert rf.call_delivered == 0 and rf.call_undelivered == 5
+    assert rf.termination == ngc.Termination.EXHAUSTED
+    assert [r.delivered for r in f.records()] == [0]
+    # A zero place on a new policy: zeros, no program, no record, flags false; nothing published.
+    before = w.state()
+    (z,) = run(w, [ngc.Place(e2, 0)], outputs=ngc.OutputOptions(residual=True))
+    assert z.call_delivered == 0 and z.program is None
+    assert not (z.routes_changed or z.weights_changed or z.reservations_changed)
+    assert z.residual.tolist() == [0]
+    assert w.state() == before
+
+
+def test_error_leaves_everything_unchanged():
+    rows = [
+        (0, 1, 1, 1),
+        (1, 2, 1000, 1),
+        (1, 5, 1000, 1),
+        (2, 3, 2, 1),
+        (3, 0, 1000, 1),
+        (3, 5, 1000, 1),
+        (4, 0, 1000, 1),
+        (4, 2, 1000, 1),
+        (6, 7, 10, 1),
+    ]
+    w = World(graph(8, rows))
+    a = w.add(6, 7, ecmp())
+    pc = w.pin(pc_program(w.g))
+    a.place(2)
+    old = a.records()[0].flow_id
+    assert refused(w, [ngc.Replace(a, 5), ngc.Replace(pc, 3)]) == PERIOD_TWO
+    assert a.delivered() == 2 and a.records()[0].flow_id == old
+
+
+def test_infinite_ordered_actions():
+    w = World(g1())
+    f = w.add(0, 1, ecmp(LL))
+    e = w.add(0, 1, ecmp())
+    rf, re = run(w, [ngc.Replace(f, INF), ngc.Replace(e, 1)])
+    assert rf.call_delivered == 10 and rf.termination == ngc.Termination.EXHAUSTED
+    assert rf.requested == INF and rf.offered is None
+    assert rf.unadmitted is None and rf.call_undelivered == INF
+    assert re.call_delivered == 0 and re.call_edge_drops == [(0, 1)]
+    assert re.termination == ngc.Termination.COMPLETE
+
+    def par():
+        return graph(2, [(0, 1, 4, 1), (0, 1, 10, 1)])
+
+    w = World(par())
+    e = w.add(0, 1, ecmp())
+    (r,) = run(w, [ngc.Place(e, INF)])
+    assert r.requested == INF and r.offered == 14 and r.call_delivered == 14
+    assert r.call_edge_drops == [] and r.termination == ngc.Termination.EXHAUSTED
+    assert (
+        refused(w, [ngc.Place(e, 0)])
+        == "finite placement after infinite placement requires a new epoch"
+    )
+    (r,) = run(w, [ngc.Replace(e, 12)])
+    assert r.call_delivered == 10 and r.call_edge_drops == [(0, 2)]
+    before = w.state()
+    run(w, [ngc.Place(e, 0)])
+    assert w.state() == before
+
+
+def test_counters_cross_two_to_the_64():
+    w = World(g1())
+    e = w.add(0, 1, ecmp())
+    for _ in range(4):
+        e.place(W62)
+    old = e.records()[0].flow_id
+    (r,) = run(w, [ngc.Place(e, W62)])
+    assert r.requested == r.offered == r.admitted == 5 * W62 == 2**64 + 2**62 - 5
+    assert r.delivered == 10 and r.edge_drops == [(0, 5 * W62 - 10)]
+    assert r.call_delivered == 0 and r.call_undelivered == W62
+    assert r.call_edge_drops == [(0, W62)]
+    assert e.records()[0].flow_id == old
+
+
+# -- SIMULTANEOUS ------------------------------------------------------------------------------
+
+
+def test_ordered_against_simultaneous():
+    # docs/semantics.md's call: two offers of 10 on a link of 10.
+    for mode, want, drops in (
+        (SIMULTANEOUS, [5, 5], [[(0, 5)], [(0, 5)]]),
+        (ORDERED, [10, 0], [[], [(0, 10)]]),
+    ):
+        w = World(g1())
+        a = w.add(0, 1, ecmp())
+        b = w.add(0, 1, ecmp())
+        r = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], mode)
+        assert delivered(r) == want
+        assert [x.call_edge_drops for x in r] == drops
+
+
+def released_world():
+    """An outside owner O (4), then A (1) and B (5) on one link of 10."""
+    w = World(g1())
+    o, a, b = (w.add(0, 1, ecmp()) for _ in range(3))
+    o.place(4)
+    a.place(1)
+    b.place(5)
+    return w, o, a, b
+
+
+def test_simultaneous_view_releases_together():
+    w, o, a, b = released_world()
+    outside = policy_state(o)
+    r = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS)
+    assert delivered(r) == [3, 3] and r[0].call_edge_drops == [(0, 7)]
+    assert [x.delivery_delta for x in r] == [2, -2]
+    assert w.ledger.carried().tolist() == [10]
+    assert policy_state(o) == outside
+    # ORDERED (the contrast): A on 0 + 1, B on 0 + 5.
+    w3, _, a3, b3 = released_world()
+    assert delivered(run(w3, [ngc.Replace(a3, 10), ngc.Replace(b3, 10)])) == [1, 5]
+
+
+def test_permutation_changes_nothing():
+    w, _, a, b = released_world()
+    r = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS)
+    w2, _, a2, b2 = released_world()
+    r2 = run(w2, [ngc.Replace(b2, 10), ngc.Replace(a2, 10)], SIMULTANEOUS)
+    assert plain(r2) == plain([r[1], r[0]])
+    assert w2.ledger.carried().tolist() == w.ledger.carried().tolist()
+    assert (a2.delivered(), b2.delivered()) == (a.delivered(), b.delivered())
+    # The new records' FlowIds follow list order.
+    assert b2.records()[0].flow_id[1] + 1 == a2.records()[0].flow_id[1]
+
+
+def test_repeat_gives_the_same_state():
+    w, _, a, b = released_world()
+    run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS)
+    old = a.records()[0].flow_id
+    again = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS)
+    assert delivered(again) == [3, 3] and again[0].delivery_delta == 0
+    assert a.records()[0].flow_id != old
+    # Removing A later frees only its traffic; B does not rebalance.
+    a.remove()
+    assert w.ledger.carried().tolist() == [7] and b.delivered() == 3
+
+
+def test_holds_and_orphans_stay_outside():
+    w = World(g1())
+    t = w.add(0, 1, t1())
+    e = w.add(0, 1, ecmp())
+    t.replace(0, design_demand=10)
+    assert run(w, [ngc.Replace(e, 10)], SIMULTANEOUS)[0].call_delivered == 10
+    w = World(g1())
+    w.add(0, 1, ecmp()).place(4)
+    w.p.pop()  # dropped without remove(): its record is an orphan
+    gc.collect()
+    a = w.add(0, 1, ecmp())
+    b = w.add(0, 1, ecmp())
+    r = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS)
+    assert delivered(r) == [3, 3] and w.ledger.carried().tolist() == [10]
+
+
+def test_simultaneous_preparation_reads_the_view():
+    for mode in (SIMULTANEOUS, ORDERED):
+        w = World(graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)]))
+        snap = shortest(
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        )
+        a = w.add(0, 1, config(snap, admission=LY))
+        a.replace(2)
+        w.pin(tunnel(w.g, 0, 1, [0])).place(8)
+        b = w.add(0, 1, ecmp())
+        ra, rb = run(w, [ngc.Replace(a, 12), ngc.Replace(b, 4)], mode)
+        if mode == SIMULTANEOUS:
+            assert ra.weights_changed and not ra.routes_changed
+            assert ra.call_delivered == 10 and ra.call_edge_drops == [(0, 1), (1, 1)]
+            assert rb.call_delivered == 2 and rb.call_edge_drops == [(0, 1), (1, 1)]
+            assert w.ledger.carried().tolist() == [10, 10]
+        else:
+            assert ra.call_delivered == 12
+            assert rb.call_delivered == 0 and rb.call_edge_drops == [(0, 2), (1, 2)]
+
+
+def test_simultaneous_preparation_reads_the_list_view():
+    # The other participant's old load is released before the preparation: B (a tunnel on edge 0)
+    # carries 8, the list replaces A (12) and B (8). On the list's view A's snapshot is (10, 10): A
+    # splits (6, 6) and edge 0 shares 10 over A 6 and B 8, (4, 6) (A created first); on A's own
+    # view it would be (2, 10) with no drop. A single path by HIGHER_AVAILABLE_CAPACITY ties on the
+    # list's view and takes edge 0 (edge 1 on A's own view): edge 0 shares 10 over 12 and 8, (6, 4).
+    snap = shortest(
+        allocation=ngc.RouteAllocation.WEIGHTED,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+    )
+    single = shortest(
+        tie_break=ngc.RouteTieBreak.HIGHER_AVAILABLE_CAPACITY,
+        multipath=False,
+        parallel_edges=False,
+    )
+    for model, a_flows, want, carried in (
+        (snap, [(0, 4), (1, 6)], [10, 6], [10, 6]),
+        (single, [(0, 6)], [6, 4], [10, 0]),
+    ):
+        w = World(graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)]))
+        a = w.add(0, 1, config(model, admission=LY))
+        b = w.pin(tunnel(w.g, 0, 1, [0]))
+        b.replace(8)
+        r = run(w, [ngc.Replace(a, 12), ngc.Replace(b, 8)], SIMULTANEOUS)
+        assert [rec.edge_flows for rec in a.records()] == [a_flows]
+        assert delivered(r) == want and w.ledger.carried().tolist() == carried
+
+
+def test_ties_follow_creation_order():
+    for first_created_listed_second in (True, False):
+        w = World(graph(2, [(0, 1, 1, 1)]))
+        prog = tunnel(w.g, 0, 1, [0])
+        p0, p1 = w.pin(prog), w.pin(prog)
+        if first_created_listed_second:
+            r = run(w, [ngc.Replace(p1, 1), ngc.Replace(p0, 1)], SIMULTANEOUS)
+            assert delivered(r) == [0, 1] and r[0].call_edge_drops == [(0, 1)]
+        else:
+            r = run(w, [ngc.Replace(p0, 1), ngc.Replace(p1, 1)], SIMULTANEOUS)
+            assert delivered(r) == [1, 0]
+
+
+def test_pooled_demand_shares_a_link():
+    # Every field of both entries.
+    w = World(
+        graph(
+            5, [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 1, 1), (4, 2, 10, 1)]
+        )
+    )
+    a = w.add([0, 1], 3, ecmp())
+    b = w.pin(tunnel(w.g, 4, 3, [4, 2]))
+    ra, rb = run(w, [ngc.Replace(a, 2), ngc.Replace(b, 2)], SIMULTANEOUS, ALL)
+    assert (ra.call_delivered, ra.call_undelivered, ra.delivery_delta) == (1, 1, 1)
+    assert ra.call_edge_drops == [(2, 1)] and ra.call_source_drops == 0
+    assert ra.termination == ngc.Termination.COMPLETE
+    assert ra.routes_changed and ra.weights_changed and not ra.reservations_changed
+    assert ra.program is not None and len(ra.program.tunnels) == 0 and ra.plan is None
+    assert (ra.requested, ra.offered, ra.admitted, ra.delivered) == (2, 2, 2, 1)
+    assert ra.unadmitted == 0 and ra.source_drops == 0 and ra.edge_drops == [(2, 1)]
+    assert [
+        (s.source, s.offered, s.delivered, s.total_edge_drops) for s in ra.by_source
+    ] == [
+        (0, 1, 0, 1),
+        (1, 1, 1, 0),
+    ]
+    assert len(ra.by_tunnel) == 0 and ra.total_cost is None
+    assert ra.marginal_cost_curve is None and ra.min_cut is None
+    assert ra.edge_flows.tolist() == [1, 1, 0, 1, 0]
+    assert ra.residual.tolist() == [9, 9, 0, 0, 8]
+    assert ra.saturated_boundary_edges == [2, 3]
+    assert ra.edge_reservations.tolist() == [0] * 5
+    recs = a.records()
+    assert [r.edge_flows for r in recs] == [[(0, 1)], [(1, 1), (3, 1)]]
+    assert [len(r.edge_drops) for r in recs] == [1, 0]
+    assert (rb.call_delivered, rb.call_undelivered, rb.delivery_delta) == (1, 1, 1)
+    assert rb.call_edge_drops == [(2, 1)] and rb.termination == ngc.Termination.COMPLETE
+    assert rb.routes_changed and rb.weights_changed
+    assert [
+        (x.head, x.status, x.assigned, x.delivered, x.total_edge_drops)
+        for x in rb.by_tunnel
+    ] == [(4, UP, 2, 1, 1)]
+    assert rb.edge_flows.tolist() == [0, 0, 1, 0, 2]
+    assert rb.residual.tolist() == [9, 9, 0, 0, 8]
+    assert w.ledger.carried().tolist() == [1, 1, 1, 1, 2]
+
+
+def test_results_in_input_order():
+    w = World(graph(4, [(0, 1, 10, 1), (2, 3, 10, 1)]))
+    a = w.pin(tunnel(w.g, 0, 1, [0]))
+    b = w.pin(tunnel(w.g, 2, 3, [1]))
+    for mode in (ORDERED, SIMULTANEOUS):
+        r = run(w, [ngc.Replace(b, 7), ngc.Replace(a, 3)], mode)
+        assert delivered(r) == [7, 3] and r[0].program.tunnels[0].head == 2
+
+
+def test_demand_level_above_tunnels():
+    w = World(graph(2, [(0, 1, 1, 1)]))
+    a = w.pin(tunnels(w.g, [0], [1], [(0, [0], 1), (0, [0], 1)]))
+    b = w.pin(tunnel(w.g, 0, 1, [0]))
+    ra, rb = run(w, [ngc.Replace(a, 2), ngc.Replace(b, 2)], SIMULTANEOUS)
+    assert ra.call_delivered == 1 and [x.delivered for x in ra.by_tunnel] == [1, 0]
+    assert rb.call_delivered == 0
+    # Created the other way round, the tie goes to the other demand.
+    w2 = World(graph(2, [(0, 1, 1, 1)]))
+    b2 = w2.pin(tunnel(w2.g, 0, 1, [0]))
+    a2 = w2.pin(tunnels(w2.g, [0], [1], [(0, [0], 1), (0, [0], 1)]))
+    r2 = run(w2, [ngc.Replace(a2, 2), ngc.Replace(b2, 2)], SIMULTANEOUS)
+    assert delivered(r2) == [0, 1]
+
+
+def test_demand_level_above_sources():
+    w = World(graph(6, [(1, 3, 100, 1), (2, 3, 100, 1), (3, 4, 1, 1), (5, 3, 100, 1)]))
+    a = w.pin(tunnels(w.g, [1, 2], [4], [(1, [0, 2], 1), (2, [1, 2], 1)]))
+    b = w.pin(tunnel(w.g, 5, 4, [3, 2]))
+    ra, rb = run(w, [ngc.Replace(a, 2), ngc.Replace(b, 2)], SIMULTANEOUS)
+    assert ra.call_delivered == 1 and ra.by_tunnel[0].delivered == 1
+    assert rb.call_delivered == 0
+
+
+def test_black_holes_of_one_participant():
+    w = World(g1())
+    a = w.pin(tunnel(w.g, 0, 1, [0]), black_holes=no_edges(w.g, [0]))
+    b = w.add(0, 1, ecmp())
+    o = ngc.OutputOptions(residual=True, saturated_boundary_edges=True)
+    ra, rb = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS, o)
+    assert ra.call_delivered == 0 and ra.call_edge_drops == [(0, 10)]
+    assert ra.by_tunnel[0].status == BLACKHOLED
+    assert rb.call_delivered == 10 and rb.call_edge_drops == []
+    assert ra.residual.tolist() == [0] == rb.residual.tolist()
+    assert ra.saturated_boundary_edges == [0]
+    # A Forward's own black holes.
+    w = World(graph(2, [(0, 1, 10, 1), (0, 1, 10, 1)]))
+    a = w.add(0, 1, ecmp())
+    b = w.add(0, 1, ecmp())
+    a.replace(2)
+    ra, rb = run(
+        w,
+        [ngc.Forward(a, 10, black_holes=no_edges(w.g, [1])), ngc.Replace(b, 10)],
+        SIMULTANEOUS,
+    )
+    assert ra.call_delivered == 5 and ra.call_edge_drops == [(1, 5)]
+    assert rb.call_delivered == 10 and w.ledger.carried().tolist() == [10, 5]
+
+
+def test_black_hole_downstream_of_a_shared_link():
+    w = World(graph(3, [(0, 1, 10, 1), (1, 2, 10, 1)]))
+    a = w.pin(tunnel(w.g, 0, 2, [0, 1]), black_holes=no_edges(w.g, [1]))
+    b = w.pin(tunnel(w.g, 0, 2, [0, 1]))
+    o = ngc.OutputOptions(residual=True, saturated_boundary_edges=True)
+    ra, rb = run(w, [ngc.Replace(a, 10), ngc.Replace(b, 10)], SIMULTANEOUS, o)
+    assert ra.call_edge_drops == [(0, 5), (1, 5)]
+    assert ra.by_tunnel[0].status == BLACKHOLED
+    assert rb.call_delivered == 5 and rb.call_edge_drops == [(0, 5)]
+    assert ra.residual.tolist() == [0, 5]
+    assert ra.saturated_boundary_edges == [0] == rb.saturated_boundary_edges
+
+
+def test_forward_keeps_holds():
+    w = World(g1())
+    t = w.add(0, 1, t1())
+    e = w.add(0, 1, ecmp())
+    t.replace(5, design_demand=5)
+    rt, re = run(w, [ngc.Forward(t, 10), ngc.Replace(e, 10)], SIMULTANEOUS)
+    assert rt.call_delivered == 5 and rt.call_edge_drops == [(0, 5)]
+    assert not rt.routes_changed and not rt.reservations_changed
+    assert rt.plan.total_reserved_bandwidth == 5
+    assert [r.edge_reservations for r in t.records()] == [[(0, 5)]]
+    assert re.call_delivered == 5
+    assert w.ledger.carried().tolist() == [10] and w.ledger.reserved().tolist() == [5]
+
+
+def test_empty_roster_participants():
+    w = World(g1())
+    mask = no_edges(w.g, [0])
+    m = w.add(0, 1, ecmp(), mask)
+    e = w.add(0, 1, ecmp())
+    p = w.pin(tunnel(w.g, 0, 1, [0]), mask=mask)
+    rm, re, rp = run(
+        w, [ngc.Replace(m, 5), ngc.Replace(e, 10), ngc.Replace(p, 5)], SIMULTANEOUS
+    )
+    assert rm.termination == ngc.Termination.NO_ROUTE and rm.call_source_drops == 5
+    assert rm.offered == 5 and rm.source_drops == 5 and m.records() == []
+    assert re.call_delivered == 10
+    assert rp.termination == ngc.Termination.NO_ROUTE and rp.call_source_drops == 5
+    assert [r.delivered for r in p.records()] == [0]
+
+
+def test_everything_masked():
+    for mode in (ORDERED, SIMULTANEOUS):
+        w = World(g1())
+        mask = no_edges(w.g, [0])
+        m1 = w.add(0, 1, ecmp(), mask)
+        m2 = w.add(0, 1, ecmp(), mask)
+        p = w.pin(tunnel(w.g, 0, 1, [0]), mask=mask)
+        r = run(w, [ngc.Replace(x, 5) for x in (m1, m2, p)], mode)
+        assert all(x.termination == ngc.Termination.NO_ROUTE for x in r)
+        assert all(x.call_source_drops == 5 for x in r)
+        assert m1.records() == [] and m2.records() == [] and len(p.records()) == 1
+        assert w.ledger.carried().tolist() == [0]
+
+
+def test_zero_offers():
+    w = World(g1())
+    a = w.add(0, 1, ecmp())
+    b = w.add(0, 1, ecmp())
+    for x in run(w, [ngc.Replace(a, 0), ngc.Replace(b, 0)], SIMULTANEOUS):
+        assert x.termination == ngc.Termination.COMPLETE and x.call_delivered == 0
+        assert x.program is not None and x.routes_changed and x.weights_changed
+    assert len(a.records()) == len(b.records()) == 1
+    assert w.ledger.carried().tolist() == [0]
+
+
+def test_iteration_errors_change_nothing():
+    # D-C3 as three Pinned tunnels, each link on its own nodes with wide connectors.
+    g, i = mapped(
+        8,
+        [
+            (0, 1, 1, 1),
+            (2, 3, 1, 1),
+            (4, 5, 2, 1),
+            (1, 2, 1000, 1),
+            (3, 4, 1000, 1),
+            (5, 0, 1000, 1),
+            (6, 0, 1000, 1),
+            (6, 2, 1000, 1),
+            (6, 4, 1000, 1),
+            (3, 7, 1000, 1),
+            (5, 7, 1000, 1),
+            (1, 7, 1000, 1),
+        ],
+    )
+    w = World(g)
+    a = w.pin(tunnel(g, 6, 7, [i[k] for k in (6, 0, 3, 1, 9)]))
+    b = w.pin(tunnel(g, 6, 7, [i[k] for k in (7, 1, 4, 2, 10)]))
+    c = w.pin(tunnel(g, 6, 7, [i[k] for k in (8, 2, 5, 0, 11)]))
+    for x in (a, b, c):
+        x.replace(1)
+    actions = [ngc.Replace(a, 1), ngc.Replace(b, 1), ngc.Replace(c, 2)]
+    assert refused(w, actions, SIMULTANEOUS) == PERIOD_TWO
+
+
+def test_dark_arrivals_add_no_barrier():
+    # The round-limit example's graph plus 16 -> 6; its three demands (black holes {5}, used by
+    # head 12 only) and a demand D from 16 whose black holes {16, 11} drop its offer on its first
+    # link: the round-limit error, nothing published (a dark copy of link 11 as a barrier would
+    # raise the limit).
+    g, i = mapped(
+        17,
+        [
+            (0, 1, 12, 1),
+            (1, 6, 1000, 1),
+            (2, 3, 9, 1),
+            (3, 0, 1000, 1),
+            (3, 10, 1000, 1),
+            (4, 5, 7, 1),
+            (5, 6, 1000, 1),
+            (6, 7, 13, 1),
+            (7, 2, 1000, 1),
+            (7, 10, 1000, 1),
+            (8, 9, 1, 1),
+            (10, 11, 10, 1),
+            (11, 2, 1000, 1),
+            (12, 4, 1000, 1),
+            (13, 6, 1000, 1),
+            (14, 0, 1000, 1),
+            (16, 6, 1000, 1),
+        ],
+    )
+    w = World(g)
+
+    def ids(rows):
+        return [i[k] for k in rows]
+
+    a = w.pin(
+        tunnel(g, 12, 11, ids([13, 5, 6, 7, 8, 2, 4, 11])),
+        black_holes=no_edges(g, ids([5])),
+    )
+    b = w.pin(tunnel(g, 13, 1, ids([14, 7, 9, 11, 12, 2, 3, 0])))
+    c = w.pin(tunnel(g, 14, 7, ids([15, 0, 1, 7])))
+    three = [ngc.Replace(a, 13), ngc.Replace(b, 11), ngc.Replace(c, 10)]
+    assert refused(w, three, SIMULTANEOUS) == ROUND_LIMIT
+    d = w.pin(
+        tunnel(g, 16, 1, ids([16, 7, 9, 11, 12, 2, 3, 0])),
+        black_holes=no_edges(g, ids([16, 11])),
+    )
+    assert refused(w, [*three, ngc.Replace(d, 1)], SIMULTANEOUS) == ROUND_LIMIT
+    (r,) = run(w, [ngc.Replace(d, 1)], SIMULTANEOUS)
+    assert r.call_edge_drops == [(i[16], 1)] and r.by_tunnel[0].status == BLACKHOLED
+
+
+def test_zero_shares_add_no_arc():
+    # An entry whose share is 0 can carry nothing: it makes no link wait and joins no group. Two
+    # cycles bridged by two tunnels of offer 0 fail with the period-2 error with or without
+    # the bridges; so does a link X before a period-2 pair with or without Z (offer 0) over L0 then
+    # X, as a Pinned tunnel or a ShortestPaths demand.
+    cycle = [
+        (0, 1, 1, 1),
+        (1, 2, 1000, 1),
+        (1, 5, 1000, 1),
+        (2, 3, 2, 1),
+        (3, 0, 1000, 1),
+        (3, 5, 1000, 1),
+        (4, 0, 1000, 1),
+        (4, 2, 1000, 1),
+    ]
+    other = [
+        (0, 1, 1, 1),
+        (1, 4, 1000, 1),
+        (2, 3, 2, 1),
+        (3, 0, 1000, 1),
+        (3, 7, 1000, 1),
+        (4, 5, 1, 1),
+        (5, 2, 1000, 1),
+        (5, 7, 1000, 1),
+        (6, 0, 1000, 1),
+        (6, 2, 1000, 1),
+    ]
+    rows = cycle + [(a + 10, b + 10, c, d) for a, b, c, d in other]
+    rows += [(1, 10, 1000, 1), (11, 0, 1000, 1)]
+    bridged = [
+        (4, 5, [6, 0, 1, 3, 5], 1),
+        (4, 5, [7, 3, 4, 0, 2], 2),
+        (16, 17, [16, 8, 9, 13, 14, 10, 12], 1),
+        (16, 17, [17, 10, 11, 8, 9, 13, 15], 2),
+        (4, 17, [6, 0, 18, 8, 9, 13, 15], 0),
+        (16, 5, [16, 8, 19, 0, 2], 0),
+    ]
+    for count in (4, 6):
+        g, i = mapped(18, rows)
+        w = World(g)
+        actions = []
+        for s, d, path, offer in bridged[:count]:
+            p = w.pin(tunnel(g, s, d, [i[k] for k in path]))
+            p.replace(1)
+            actions.append(ngc.Replace(p, offer))
+        assert refused(w, actions, SIMULTANEOUS) == PERIOD_TWO, count
+    # sA 0, sB 1, sZ 2, n1..n6 3..8, dA 9, dB 10, dZ 11; rows X, L0, L1 first.
+    rows = [
+        (3, 4, 1, 1),
+        (5, 6, 1, 1),
+        (7, 8, 2, 1),
+        (0, 3, 100, 1),
+        (4, 5, 100, 1),
+        (6, 7, 100, 1),
+        (8, 9, 100, 1),
+        (1, 7, 100, 1),
+        (8, 5, 100, 1),
+        (6, 10, 100, 1),
+        (2, 5, 100, 1),
+        (6, 3, 100, 1),
+        (4, 11, 100, 1),
+    ]
+    for z in ("none", "tunnel", "shortest paths"):
+        g, i = mapped(12, rows)
+        w = World(g)
+        a = w.pin(tunnel(g, 0, 9, [i[k] for k in (3, 0, 4, 1, 5, 2, 6)]))
+        b = w.pin(tunnel(g, 1, 10, [i[k] for k in (7, 2, 8, 1, 9)]))
+        actions = [ngc.Replace(a, 2), ngc.Replace(b, 2)]
+        if z == "tunnel":
+            zt = w.pin(tunnel(g, 2, 11, [i[k] for k in (10, 1, 11, 0, 12)]))
+            actions.append(ngc.Replace(zt, 0))
+        if z == "shortest paths":
+            actions.append(ngc.Replace(w.add(2, 11, ecmp()), 0))
+        assert refused(w, actions, SIMULTANEOUS) == PERIOD_TWO, z
+    # A member that can carry nothing in a program that is not pooled: Z's program from sZ has a
+    # supplied DAG route (sZ's exit to dZ0 below its L0 branch, L0 then X) and a tunnel over that
+    # exit; offer 2 gives each entry 1 and the DAG route's unit takes the exit, so the L0 branch never
+    # carries anything. sA 0, sB 1, sZ 2, dZ0 3, n1..n6 4..9, dA 10, dB 11, dZ 12; rows X, L0, L1 first.
+    rows = [
+        (4, 5, 1, 1),
+        (6, 7, 1, 1),
+        (8, 9, 2, 1),
+        (0, 4, 100, 1),
+        (5, 6, 100, 1),
+        (7, 8, 100, 1),
+        (9, 10, 100, 1),
+        (1, 8, 100, 1),
+        (9, 6, 100, 1),
+        (7, 11, 100, 1),
+        (2, 6, 100, 1),
+        (7, 4, 100, 1),
+        (5, 12, 100, 1),
+        (2, 3, 100, 1),
+    ]
+    g, i = mapped(13, rows)
+    assert i[13] < i[10]
+    w = World(g)
+    a = w.pin(tunnel(g, 0, 10, [i[k] for k in (3, 0, 4, 1, 5, 2, 6)]))
+    b = w.pin(tunnel(g, 1, 11, [i[k] for k in (7, 2, 8, 1, 9)]))
+    routes = [
+        ngc.RouteDefinition(2, dag_of(g, [i[k] for k in (10, 1, 11, 0, 12, 13)])),
+        ngc.RouteDefinition(2, ngc.Path(g, [[i[13]]])),
+    ]
+    z = w.pin(ngc.ForwardingProgram.from_routes(g, [2], [3, 12], routes))
+    actions = [ngc.Replace(a, 2), ngc.Replace(b, 2), ngc.Replace(z, 2)]
+    assert refused(w, actions, SIMULTANEOUS) == PERIOD_TWO
+
+
+def test_members_that_carry_nothing_change_nothing():
+    # D-cycle-subdivision-after (A over links 1, 0, 2, 3 with offer 2; B over 2, 3, 0 with offer 1;
+    # C over 2, 3, 0, 1 with offer 4; links of 2, 4, 2, 2; links 2 and 3 joined directly at node 10)
+    # delivers 0, 0, 1. B becomes a DAG program with a member that carries nothing at node 10: a
+    # second pooled source (node 12, its own link into node 10) with share 0, or whose link is B's
+    # own black hole; a branch from node 10 to a destination of its own (node 13) that round robin
+    # leaves empty; a merge into node 10 from B's source over node 12 that round robin leaves empty
+    # (pooled, and as a DAG route beside a tunnel of weight 0). Links 2 and 3 stay a pair: the same
+    # deliveries and link flows as without the member. sA 0, sB 1, sC 2, d 3; link e from 4 + 2e.
+    rows = [
+        (4, 5, 2, 1),
+        (6, 7, 4, 1),
+        (8, 10, 2, 1),
+        (10, 11, 2, 1),
+        (0, 6, 100, 1),
+        (7, 4, 100, 1),
+        (5, 8, 100, 1),
+        (11, 3, 100, 1),
+        (1, 8, 100, 1),
+        (11, 4, 100, 1),
+        (5, 3, 100, 1),
+        (2, 8, 100, 1),
+        (5, 6, 100, 1),
+        (7, 3, 100, 1),
+        (12, 10, 9, 1),
+        (10, 13, 100, 1),
+        (1, 12, 100, 1),
+    ]
+
+    def call(case, pooled=True):
+        g, i = mapped(14, rows)
+        assert i[3] < i[15] and i[8] < i[16]
+        w = World(g)
+        a = w.pin(tunnel(g, 0, 3, [i[k] for k in (4, 1, 5, 0, 6, 2, 3, 7)]))
+        path = [i[k] for k in (8, 2, 3, 9, 0, 10)]
+        members, sources, dests = list(path), [1], [3]
+        if case in ("zero share", "black hole"):
+            members, sources = [*members, i[14]], [1, 12]
+        if case == "branch":
+            members, dests = [*members, i[15]], [3, 13]
+        if case == "merge":
+            members = [*members, i[16], i[14]]
+        if pooled:
+            program = ngc.ForwardingProgram.from_dag(
+                g, sources, dests, dag_of(g, members)
+            )
+        else:
+            routes = [
+                ngc.RouteDefinition(1, dag_of(g, members)),
+                ngc.RouteDefinition(1, ngc.Path(g, [[e] for e in path]), weight=0),
+            ]
+            program = ngc.ForwardingProgram.from_routes(g, sources, dests, routes)
+        black = no_edges(g, [i[14]]) if case == "black hole" else None
+        b = w.pin(program, LY, black)
+        c = w.pin(tunnel(g, 2, 3, [i[k] for k in (11, 2, 3, 9, 0, 12, 1, 13)]))
+        offer = 2 if case == "black hole" else 1
+        actions = [ngc.Replace(a, 2), ngc.Replace(b, offer), ngc.Replace(c, 4)]
+        try:
+            results = run(w, actions, SIMULTANEOUS)
+        except ValueError as e:
+            return str(e)
+        carried = w.ledger.carried().tolist()
+        return [r.call_delivered for r in results], [carried[i[e]] for e in range(4)]
+
+    for case, pooled in (
+        ("zero share", True),
+        ("black hole", True),
+        ("branch", True),
+        ("branch", False),
+        ("merge", True),
+        ("merge", False),
+    ):
+        without = call("none", pooled)
+        assert without[0] == [0, 0, 1], (case, pooled)
+        assert call(case, pooled) == without, (case, pooled)
+
+
+def test_dead_tails_take_no_part():
+    # Traffic behind a demand's own black hole can carry nothing: D-dead-tail (A over links 2, 0
+    # with offer 1; B over 1, 0, 2 with offer 2; links of 2, 2, 1, 9) gives the period-2 error
+    # without Z, and with Z (its own black hole on link 3) over links 3, 0, 1 with offer 1 as a
+    # tunnel or as a supplied DAG route (a pooled context), or with offer 2 as that DAG route
+    # beside a tunnel on its own exit (a split route of a program that is not pooled). sA 0, sB 1,
+    # sZ 2, d 3; link e from 4 + 2e to 5 + 2e (rows 0 to 3), joined by links of 100; Z's exit is
+    # row 15.
+    rows = [
+        (4, 5, 2, 1),
+        (6, 7, 2, 1),
+        (8, 9, 1, 1),
+        (10, 11, 9, 1),
+        (0, 8, 100, 1),
+        (9, 4, 100, 1),
+        (5, 3, 100, 1),
+        (1, 6, 100, 1),
+        (7, 4, 100, 1),
+        (5, 8, 100, 1),
+        (9, 3, 100, 1),
+        (2, 10, 100, 1),
+        (11, 4, 100, 1),
+        (5, 6, 100, 1),
+        (7, 3, 100, 1),
+        (2, 3, 100, 1),
+    ]
+    for z in ("none", "tunnel", "DAG route", "DAG route and tunnel"):
+        g, i = mapped(12, rows)
+        w = World(g)
+        a = w.pin(tunnel(g, 0, 3, [i[k] for k in (4, 2, 5, 0, 6)]))
+        b = w.pin(tunnel(g, 1, 3, [i[k] for k in (7, 1, 8, 0, 9, 2, 10)]))
+        actions = [ngc.Replace(a, 1), ngc.Replace(b, 2)]
+        zr = [i[k] for k in (11, 3, 12, 0, 13, 1, 14)]
+        black = no_edges(g, [i[3]])
+        if z == "tunnel":
+            actions.append(ngc.Replace(w.pin(tunnel(g, 2, 3, zr), LY, black), 1))
+        if z.startswith("DAG route"):
+            routes = [ngc.RouteDefinition(2, dag_of(g, zr))]
+            if z == "DAG route and tunnel":
+                routes.append(ngc.RouteDefinition(2, ngc.Path(g, [[i[15]]])))
+            program = ngc.ForwardingProgram.from_routes(g, [2], [3], routes)
+            offer = 2 if z == "DAG route and tunnel" else 1
+            actions.append(ngc.Replace(w.pin(program, LY, black), offer))
+        assert refused(w, actions, SIMULTANEOUS) == PERIOD_TWO, z
+
+
+def test_maximal_offers_share_a_link():
+    # Link sums beyond 2^63 and 2^64.
+    for n, cap, want in (
+        (2, 10, [5, 5]),
+        (3, 10, [4, 3, 3]),
+        (5, 10, [2, 2, 2, 2, 2]),
+        (5, 11, [3, 2, 2, 2, 2]),
+    ):
+        w = World(graph(2, [(0, 1, cap, 1)]))
+        prog = tunnel(w.g, 0, 1, [0])
+        r = run(w, [ngc.Replace(w.pin(prog), W62) for _ in range(n)], SIMULTANEOUS)
+        assert delivered(r) == want
+        assert [x.call_edge_drops for x in r] == [[(0, W62 - k)] for k in want]
+
+
+def test_disjoint_maximal_participants():
+    each = W62 // 5  # the graph's capacity sum stays below 2^62
+    w = World(graph(2, [(0, 1, each, 1)] * 5))
+    actions = [ngc.Replace(w.pin(tunnel(w.g, 0, 1, [e])), each) for e in range(5)]
+    assert delivered(run(w, actions, SIMULTANEOUS)) == [each] * 5
+    assert w.ledger.carried().tolist() == [each] * 5
+
+
+def test_imported_tunnels_book_no_holds():
+    w = World(g1(), [8], [6])
+    t = w.add(0, 1, t1())
+    t.replace(0, design_demand=6)
+    p = w.pin(t.program)
+    o = ngc.OutputOptions(edge_reservations=True)
+    rt, rp = run(w, [ngc.Forward(t, 8), ngc.Replace(p, 8)], SIMULTANEOUS, o)
+    assert delivered([rt, rp]) == [4, 4]
+    assert w.ledger.carried().tolist() == [8] and w.ledger.reserved().tolist() == [6]
+    assert rp.edge_reservations.tolist() == [0] and rp.plan is None
+    assert rt.plan is not None
+    # The program of an orphaned T1 policy.
+    w = World(g1(), [8], [6])
+    w.add(0, 1, t1()).replace(0, design_demand=6)
+    prog = w.p.pop().program
+    gc.collect()
+    p = w.pin(prog)
+    assert run(w, [ngc.Replace(p, 8)], SIMULTANEOUS)[0].call_delivered == 8
+    assert w.ledger.reserved().tolist() == [6]
+
+
+def test_zero_forward():
+    w = World(g1())
+    t = w.add(0, 1, t1())
+    e = w.add(0, 1, ecmp())
+    t.replace(6, design_demand=6)
+    old = t.records()[0].flow_id
+    prog = t.program
+    rt, re = run(w, [ngc.Forward(t, 0), ngc.Replace(e, 10)], SIMULTANEOUS)
+    assert rt.termination == ngc.Termination.COMPLETE and rt.call_delivered == 0
+    assert rt.delivery_delta == -6 and rt.by_tunnel[0].assigned == 0
+    assert plain(t.program) == plain(prog)
+    assert len(t.records()) == 1 and t.records()[0].flow_id != old
+    assert t.records()[0].edge_reservations == [(0, 6)]
+    assert re.call_delivered == 10
+    f = t.forward(8)
+    assert f.call_delivered == 0 and f.call_edge_drops == [(0, 8)]
+    assert w.ledger.reserved().tolist() == [6]
+
+
+def test_black_holed_sources_and_nodes():
+    w = World(graph(5, [(0, 2, 10, 1), (1, 2, 10, 1), (3, 4, 10, 1)]))
+    a = w.add([0, 1], 2, ecmp())
+    a.replace(2)
+    z = w.pin(tunnel(w.g, 3, 4, [2]))
+    ra, rz = run(
+        w,
+        [ngc.Forward(a, 4, black_holes=no_nodes(w.g, [0])), ngc.Replace(z, 3)],
+        SIMULTANEOUS,
+    )
+    assert ra.call_source_drops == 2 and ra.call_edge_drops == []
+    assert ra.call_delivered == 2 and rz.call_delivered == 3
+    # A repair mask first: source 1 takes the whole offer.
+    q = w.pin(a.program, mask=no_nodes(w.g, [0]))
+    rq, _ = run(w, [ngc.Replace(q, 4), ngc.Replace(z, 3)], SIMULTANEOUS)
+    assert rq.call_delivered == 4 and rq.call_source_drops == 0
+    # An internal black-holed node.
+    w2 = World(graph(3, [(0, 1, 10, 1), (1, 2, 10, 1)]))
+    n = w2.pin(tunnel(w2.g, 0, 2, [0, 1]), black_holes=no_nodes(w2.g, [1]))
+    (rn,) = run(w2, [ngc.Replace(n, 6)], SIMULTANEOUS)
+    assert rn.by_tunnel[0].status == BLACKHOLED and rn.call_edge_drops == [(0, 6)]
+
+
+def test_zero_service_and_zero_weight():
+    w = World(graph(4, [(0, 1, 0, 1), (2, 3, 10, 1)]))
+    z = w.add(0, 1, ecmp())
+    pos = w.pin(tunnel(w.g, 2, 3, [1]))
+    rz, rp = run(w, [ngc.Replace(z, 2), ngc.Replace(pos, 4)], SIMULTANEOUS)
+    assert rz.termination == ngc.Termination.COMPLETE and rz.call_edge_drops == [(0, 2)]
+    assert rp.call_delivered == 4
+    w2 = World(graph(4, [(0, 1, 10, 1), (2, 3, 10, 1)]))
+    zw = w2.pin(tunnel(w2.g, 0, 1, [0], weight=0))
+    pos2 = w2.pin(tunnel(w2.g, 2, 3, [1]))
+    rz, rp = run(w2, [ngc.Replace(zw, 2), ngc.Replace(pos2, 4)], SIMULTANEOUS)
+    assert rz.termination == ngc.Termination.NO_ACTIVE_WEIGHT
+    assert rz.call_source_drops == 2 and len(zw.records()) == 1
+    assert rp.call_delivered == 4
+
+
+def test_pooled_roots_block_serial_pairs():
+    def make():
+        return graph(6, [(0, 1, 2, 1), (1, 2, 2, 1), (2, 3, 2, 1), (4, 5, 10, 1)])
+
+    scalar = World(make())
+    want = plain(scalar.add([0, 1, 2], 3, ecmp()).replace(6))
+    for beside in (False, True):
+        w = World(make())
+        a = w.add([0, 1, 2], 3, ecmp())
+        z = w.pin(tunnel(w.g, 4, 5, [3]))
+        actions = [ngc.Replace(a, 6)] + ([ngc.Replace(z, 1)] if beside else [])
+        r = run(w, actions, SIMULTANEOUS)[0]
+        assert plain(r) == want
+        assert r.call_delivered == 2
+        assert [s.delivered for s in r.by_source] == [1, 0, 1]
+
+
+def test_pooled_cycle_keeps_source_state():
+    g, i = mapped(
+        9,
+        [
+            (0, 1, 1, 1),
+            (2, 3, 1, 1),
+            (4, 0, 100, 1),
+            (1, 2, 100, 1),
+            (5, 2, 100, 1),
+            (3, 6, 100, 1),
+            (7, 2, 100, 1),
+            (3, 0, 100, 1),
+            (1, 8, 100, 1),
+        ],
+    )
+    w = World(g)
+    a = w.add([4, 5], 6, ecmp())
+    b = w.pin(tunnel(g, 7, 8, [i[6], i[1], i[7], i[0], i[8]]))
+    ra, rb = run(w, [ngc.Replace(a, 2), ngc.Replace(b, 1)], SIMULTANEOUS)
+    assert ra.call_delivered == 1 and [s.delivered for s in ra.by_source] == [1, 0]
+    assert rb.call_delivered == 0 and rb.call_edge_drops == [(i[1], 1)]
+
+
+def test_outputs_per_entry():
+    w = World(graph(4, [(0, 2, 10, 1), (1, 2, 1, 1), (2, 3, 10, 1)]))
+    a = w.pin(tunnel(w.g, 0, 3, [0, 2]))
+    b = w.pin(tunnel(w.g, 1, 3, [1, 2]))
+    o = ngc.OutputOptions(residual=True, saturated_boundary_edges=True)
+    ra, rb = run(w, [ngc.Replace(a, 5), ngc.Replace(b, 1)], SIMULTANEOUS, o)
+    assert ra.residual.tolist() == [5, 0, 4] == rb.residual.tolist()
+    assert ra.saturated_boundary_edges == [] and rb.saturated_boundary_edges == [1]
+
+
+def test_captured_weights_in_a_list():
+    g = graph(3, [(0, 2, 3, 1), (1, 2, 1, 1)])
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, controller()).replace(4).program
+    w = World(g)
+    a = w.pin(prog)
+    b = w.pin(tunnel(g, 0, 2, [0]))
+    r = run(w, [ngc.Replace(a, 4), ngc.Replace(b, 1)], SIMULTANEOUS)
+    assert delivered(r) == [4, 0] and r[1].call_edge_drops == [(0, 1)]
+
+
+# -- all or nothing ----------------------------------------------------------------------------
+
+
+def list_world(mode):
+    """Fresh state and a list of three actions that `mode` accepts (two pooled demands and a
+    Pinned one with black holes; each policy already holds records)."""
+    g = graph(5, [(0, 1, 5, 1), (0, 2, 3, 2), (1, 3, 5, 1), (2, 3, 3, 2), (3, 4, 6, 1)])
+    w = World(g)
+    a = w.add([0, 1], 4, ecmp())
+    b = w.pin(tunnel(g, 0, 4, [1, 3, 4]), black_holes=no_edges(g, [3]))
+    c = w.add(0, 4, ecmp(LL) if mode == ORDERED else ecmp())
+    for p in (a, b, c):
+        p.replace(1)
+    return w, [ngc.Replace(a, 6), ngc.Replace(b, 4), ngc.Replace(c, 3)]
+
+
+@needs_hooks
+def test_lists_are_all_or_nothing():
+    # Every Python allocation of the call (the list and its result objects, made before anything
+    # is published) fails in turn: MemoryError, nothing changed, then the call returns the
+    # reference. The call is positional (ORDERED, no outputs): pybind11's parsing of a call that
+    # passes keywords does not check its allocations (limit 1 of the module docstring), and mode
+    # and outputs are keyword-only. The binding's Python allocations do not depend on the mode;
+    # a SIMULTANEOUS list's native allocations are swept in test_native_allocation.py.
+    def make():
+        w, actions = list_world(ORDERED)
+        return ngc.apply_actions, (w.ledger, actions), w.state
+
+    assert sweep_python_allocation(make) >= 4
+    # The same lists with every output and in both modes return the same as their reference.
+    for mode in (ORDERED, SIMULTANEOUS):
+        w, actions = list_world(mode)
+        twin, twin_actions = list_world(mode)
+        got = plain(ngc.apply_actions(w.ledger, actions, mode=mode, outputs=ALL))
+        assert got == plain(
+            ngc.apply_actions(twin.ledger, twin_actions, mode=mode, outputs=ALL)
+        )
+
+
+@needs_hooks
+def test_forwarding_bounds():
+    # A list's joint network counts every participant: a Pinned program of two one-edge routes
+    # on PAR(6, 4) (2 entries, 2 occurrences, 4 routers; the 4-unit link drops: 1 event, 3
+    # dependencies), a Pinned program of two 2-hop tunnels on a diamond (2 entries, 4 occurrences)
+    # and a pooled ShortestPaths demand of sources 6 and 7 (2 entries, 4 occurrences, 4 routers, 3
+    # dependencies): 6 entries, 10 occurrences, 8 routers, 9 events, 6 dependencies.
+    g = graph(
+        10,
+        [
+            (0, 1, 6, 1),
+            (0, 1, 4, 1),
+            (2, 3, 100, 1),
+            (2, 4, 100, 1),
+            (3, 5, 100, 1),
+            (4, 5, 100, 1),
+            (6, 8, 100, 1),
+            (7, 8, 100, 1),
+            (8, 9, 100, 1),
+        ],
+    )
+    w = World(g)
+    routes = [ngc.RouteDefinition(0, dag_of(g, [e]), weight=1) for e in (0, 1)]
+    a = w.pin(ngc.ForwardingProgram.from_routes(g, [0], [1], routes))
+    b = w.pin(tunnels(g, [2], [5], [(2, [2, 4], 1), (2, [3, 5], 1)]))
+    c = w.add([6, 7], 9, ecmp())
+    actions = [ngc.Replace(a, 12), ngc.Replace(b, 2), ngc.Replace(c, 2)]
+
+    def call(*listed):
+        return ngc.apply_actions(w.ledger, list(listed), mode=SIMULTANEOUS)
+
+    counts = [
+        ("entry", 6),
+        ("occurrence", 10),
+        ("router", 8),
+        ("event", 9),
+        ("dependency", 6),
+    ]
+    for k, (name, n) in enumerate(counts):
+        limits = [0] * 5
+        limits[k] = n - 1
+        before = w.state()
+        value, error, structures = ext._with_forwarding_limits(
+            call, tuple(actions), limits
+        )
+        assert value is None and type(error) is ValueError
+        assert str(error) == f"forwarding {name} limit exceeded: {n} > {n - 1}"
+        assert w.state() == before
+        if name in ("event", "dependency"):
+            assert structures == 0, name
+        for one in actions:  # each participant alone stays within
+            assert ext._with_forwarding_limits(call, (one,), limits)[1] is None, name
+        limits[k] = n
+        value, error, structures = ext._with_forwarding_limits(
+            call, tuple(actions), limits
+        )
+        assert error is None and len(value) == 3 and structures == 1, name
+    _, error, _ = ext._with_forwarding_limits(call, tuple(actions), [1] * 5)
+    assert str(error) == "forwarding entry limit exceeded: 6 > 1"
+    # The scalar call counts its own network: a's alone has 2 entries.
+    _, error, _ = ext._with_forwarding_limits(a.replace, (12,), [1, 0, 0, 0, 0])
+    assert str(error) == "forwarding entry limit exceeded: 2 > 1"
+
+
+# -- the generators ----------------------------------------------------------------------------
+
+
+class Generated:
+    """A world built from a seed (built twice, identically): a random DAG on nodes 0..5 (sources 0
+    and 1, destination 5; nonuniform costs, capacities 0 to 8) plus a separate link 6 -> 7, and one
+    policy of each kind: ShortestPaths EQUAL LY (two sources), EQUAL LL, WEIGHTED LY with capacity,
+    explicit and residual-snapshot weights, EQUAL LY under a mask; OPTIMIZED LL; CentralizedTE LL;
+    T1 LY (two tunnels per head); T2 LY; Pinned LY over tunnels, over split routes, over from_dag
+    under a mask, over a controller program with black holes; Pinned LY on the separate link. Then
+    scalar calls, an orphan and an outside owner. None when a construction fails (both copies fail
+    alike). g: the first copy's graph, shared by the second (records compare their routes)."""
+
+    LOSSY_REPLACE = (
+        0,
+        2,
+        3,
+        4,
+        5,
+        10,
+        11,
+        12,
+        13,
+    )  # what a SIMULTANEOUS Replace accepts
+    FORWARDABLE = (0, 2, 3, 4, 5, 8, 9)  # LOSSY computing policies
+    SEPARATE = 14
+
+    @classmethod
+    def make(cls, seed, g=None):
+        rng = random.Random(seed)
+        rows = [
+            (u, v, rng.randrange(9), 1 + rng.randrange(3))
+            for u in range(6)
+            for v in range(u + 1, 6)
+            if rng.randrange(3) != 0
+        ]
+        rows.append((6, 7, 10, 1))
+        try:
+            return cls(rng, g or build(8, rows))
+        except ValueError:
+            return None
+
+    def __init__(self, rng, g):
+        self.w = w = World(g)
+        n_edges = g.num_edges()
+        sep = n_edges - 1  # 6 -> 7: the largest tail
+        tails = g.edge_sources().tolist()
+        heads_of = g.edge_destinations().tolist()
+
+        def random_edge():
+            return rng.randrange(n_edges - 1)
+
+        def path_from(h):
+            path, u = [], h
+            while u != 5:
+                outs = [e for e in range(sep) if tails[e] == u]
+                if not outs:
+                    return []
+                e = rng.choice(outs)
+                path.append(e)
+                u = heads_of[e]
+            return path
+
+        S, D = [0, 1], [5]
+        weighted = ngc.RouteAllocation.WEIGHTED
+        w.add(S, D, ecmp())
+        w.add([0], D, ecmp(LL))
+        w.add(S, D, config(shortest(allocation=weighted), admission=LY))
+        explicit = shortest(
+            allocation=weighted,
+            weight_basis=ngc.WeightBasis.EXPLICIT,
+            edge_weights=[rng.randrange(4) for _ in range(n_edges)],
+        )
+        w.add(S, D, config(explicit, admission=LY))
+        snapshot = shortest(
+            allocation=weighted, weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT
+        )
+        w.add([0], D, config(snapshot, admission=LY))
+        w.add(S, D, ecmp(), no_edges(g, [random_edge()]))
+        w.add(S, D, config(ngc.ShortestPaths(), ngc.RouteAllocation.OPTIMIZED))
+        w.add(S, D, controller())
+        w.add(S, D, t1_config(2, LY))
+        w.add(S, D, t2())
+        specs = []
+        for h in S:
+            for _ in range(2):
+                path = path_from(h)
+                if path:
+                    specs.append((h, path, 1 + rng.randrange(3)))
+        if not specs:
+            raise ValueError("no tunnel")
+        heads = sorted({h for h, _, _ in specs})
+        w.pin(tunnels(g, heads, D, specs))
+        everything = dag_of(g, range(n_edges))
+        split = [
+            ngc.RouteDefinition(h, everything, weight=1 + rng.randrange(2))
+            for h in heads
+        ]
+        w.pin(ngc.ForwardingProgram.from_routes(g, heads, D, split))
+        w.pin(
+            ngc.ForwardingProgram.from_dag(g, S, D, everything),
+            mask=no_edges(g, [random_edge()]),
+        )
+        prog = ngc.FlowPolicy(ngc.FlowLedger(g), S, D, controller()).replace(6).program
+        w.pin(prog, black_holes=no_edges(g, [random_edge()]))
+        w.pin(tunnel(g, 6, 7, [sep]))
+        # State before the list: scalar calls, an outside owner, an orphan.
+        w.p[0].place(rng.randrange(6))
+        w.p[2].replace(rng.randrange(6))
+        w.p[6].place(rng.randrange(6))
+        w.p[8].replace(2, design_demand=2)
+        w.p[9].replace(2)
+        w.p[10].replace(rng.randrange(6))
+        w.add(S, D, ecmp()).place(1 + rng.randrange(3))
+        w.add([0], D, ecmp()).place(1 + rng.randrange(3))
+        w.p.pop()
+        w.sources.pop()
+        w.masks.pop()
+        gc.collect()
+
+
+def ordered_action(rng, w, i):
+    """One random valid ORDERED action on policy i of a generated world."""
+    p = w.p[i]
+    routing, lossy = p.config.routing, p.config.admission == LY
+    tunnel_model = isinstance(routing, ngc.DistributedTE) or (
+        isinstance(routing, ngc.CentralizedTE) and routing.tunnel_count is not None
+    )
+    v = rng.randrange(13)
+    kind = rng.randrange(3)
+    if kind == 2 and not isinstance(routing, ngc.Pinned) and p.program is not None:
+        bh = None
+        if rng.randrange(3) == 0:
+            bh = no_edges(w.g, [rng.randrange(w.g.num_edges() - 1)])
+        return ngc.Forward(
+            p, INF if not lossy and rng.randrange(4) == 0 else v, black_holes=bh
+        )
+    if kind == 0 and not tunnel_model:
+        return ngc.Place(p, v)
+    if isinstance(routing, ngc.DistributedTE):
+        return ngc.Replace(p, v, design_demand=v + rng.randrange(3))
+    return ngc.Replace(p, INF if not lossy and rng.randrange(4) == 0 else v)
+
+
+def scalar(action, policy, outputs):
+    """The action as a scalar call of `policy` (its own policy, or its twin's)."""
+    if isinstance(action, ngc.Place):
+        return policy.place(action.offer, outputs)
+    if isinstance(action, ngc.Replace):
+        return policy.replace(
+            action.offer, design_demand=action.design_demand, outputs=outputs
+        )
+    return policy.forward(action.offer, black_holes=action.black_holes, outputs=outputs)
+
+
+def index_of(w, policy):
+    return next(k for k, p in enumerate(w.p) if p is policy)
+
+
+def test_ordered_equals_scalar_calls():
+    checked = forwards = holds = 0
+    for seed in range(1, 201):
+        a = Generated.make(seed)
+        if a is None:
+            continue
+        b = Generated.make(seed, a.w.g)
+        rng = random.Random(seed * 7919)
+        order = list(range(len(a.w.p)))
+        rng.shuffle(order)
+        actions = [ordered_action(rng, a.w, i) for i in order[: 2 + rng.randrange(6)]]
+        try:
+            got, error = (
+                plain(ngc.apply_actions(a.w.ledger, actions, outputs=ALL)),
+                None,
+            )
+        except ValueError as e:
+            got, error = None, str(e)
+        want, scalar_error = [], None
+        for x in actions:
+            try:
+                want.append(plain(scalar(x, b.w.p[index_of(a.w, x.policy)], ALL)))
+            except ValueError as e:
+                scalar_error = str(e)
+                break
+        assert error == scalar_error, seed
+        if error is not None:
+            continue
+        assert got == want, seed
+        assert a.w.state() == b.w.state(), seed
+        forwards += sum(isinstance(x, ngc.Forward) for x in actions)
+        holds += any(a.w.ledger.reserved().tolist())
+        checked += 1
+    assert checked > 150 and forwards > 80 and holds > 30, (checked, forwards, holds)
+
+
+def test_one_participant_equals_the_scalar_call():
+    checked = pooled = black = 0
+    for seed in range(1, 301):
+        a = Generated.make(seed)
+        if a is None:
+            continue
+        b = Generated.make(seed, a.w.g)
+        rng = random.Random(seed * 104729)
+        forward = rng.randrange(2) == 0
+        pool = Generated.FORWARDABLE if forward else Generated.LOSSY_REPLACE
+        i = rng.choice(pool)
+        v = rng.randrange(13)
+        p = a.w.p[i]
+        if forward:
+            if p.program is None:
+                p.replace(1)
+                b.w.p[i].replace(1)
+            bh = None
+            if rng.randrange(2) == 0:
+                bh = no_edges(a.w.g, [rng.randrange(a.w.g.num_edges() - 1)])
+                black += 1
+            actions = [ngc.Forward(p, v, black_holes=bh)]
+        else:
+            actions = [ngc.Replace(p, v)]
+            pooled += i <= 5
+        pair = rng.randrange(2) == 0
+        if pair:
+            separate = a.w.p[Generated.SEPARATE]
+            actions.append(ngc.Replace(separate, rng.randrange(13)))
+        got = plain(
+            ngc.apply_actions(a.w.ledger, actions, mode=SIMULTANEOUS, outputs=ALL)
+        )
+        want = [plain(scalar(x, b.w.p[index_of(a.w, x.policy)], ALL)) for x in actions]
+        # The scalar calls' outputs read the ledger after each; the list's after both: with the
+        # pair, each entry's residual is the one after the list (the other one is disjoint).
+        if pair:
+            want[0]["residual"] = want[1]["residual"]
+            want[0]["saturated_boundary_edges"] = b.w.ledger.saturated_boundary_edges(
+                b.w.sources[i], b.w.masks[i]
+            )
+        assert got == want, (seed, i)
+        assert a.w.state() == b.w.state(), (seed, i)
+        checked += 1
+    assert checked > 200 and pooled > 60 and black > 40, (checked, pooled, black)
diff --git a/tests/py/test_apportionment.py b/tests/py/test_apportionment.py
new file mode 100644
index 0000000..cde9949
--- /dev/null
+++ b/tests/py/test_apportionment.py
@@ -0,0 +1,30 @@
+"""The apportionment through the private hooks (``_round_robin``, ``_highest_averages``;
+docs/semantics.md#1-units-the-one-numeric-domain)."""
+
+from __future__ import annotations
+
+import _netgraph_core as ext
+import pytest
+from helpers import exact
+from private_hooks import needs_hooks
+
+
+@needs_hooks
+def test_apportionment_entries():
+    assert ext._round_robin(7, 3) == [3, 2, 2]
+    assert ext._highest_averages(10, [3, 9, 9]) == [1, 5, 4]
+    assert ext._highest_averages(11, [3, 9, 9]) == [1, 5, 5]
+    assert ext._highest_averages(4, [1, 3, 3]) == [0, 2, 2]
+    big = (1 << 62) - 2
+    a = ext._highest_averages(big, [(1 << 60) + 1, (1 << 60) - 1, 7])
+    # By hand: the lower quotas floor(big * w / W), W = 2^61 + 7, are 2^61 - 6, 2^61 - 10 and
+    # 13; the one unit left goes to the largest w / (a + 1), the second member's.
+    assert a == [(1 << 61) - 6, (1 << 61) - 9, 13]
+    assert sum(a) == big
+    with pytest.raises(ValueError, match=exact("weights[0] = 0 is outside [1, 2^62)")):
+        ext._highest_averages(1, [0, 1])
+    # Legal weights whose sum reaches 2^64 are summed exactly. Eight of 2^61: one each. Two of
+    # 2^61 sharing 3: the lower quotas are 1 and 1; the unit left goes to the tie's first member
+    # (as 9/5 above).
+    assert ext._highest_averages(8, [1 << 61] * 8) == [1] * 8
+    assert ext._highest_averages(3, [1 << 61, 1 << 61]) == [2, 1]
diff --git a/tests/py/test_batch_max_flow_consistency.py b/tests/py/test_batch_max_flow_consistency.py
deleted file mode 100644
index 7ad2521..0000000
--- a/tests/py/test_batch_max_flow_consistency.py
+++ /dev/null
@@ -1,72 +0,0 @@
-"""Batch max-flow consistency with per-pair max_flow results."""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def test_batch_max_flow_matches_individuals_proportional(
-    square1_graph, algs, to_handle
-):
-    g = square1_graph
-    pairs = np.array([[0, 2], [0, 3]], dtype=np.int32)
-    out = algs.batch_max_flow(
-        to_handle(g),
-        pairs,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    # Individual calculations
-    v1, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    v2, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert len(out) == 2
-    assert np.isclose(out[0].total_flow, v1)
-    assert np.isclose(out[1].total_flow, v2)
-
-
-def test_batch_max_flow_matches_individuals_equal_balanced(
-    line1_graph, algs, to_handle
-):
-    g = line1_graph
-    pairs = np.array([[0, 2], [1, 2]], dtype=np.int32)
-    out = algs.batch_max_flow(
-        to_handle(g),
-        pairs,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    v1, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    v2, _ = algs.max_flow(
-        to_handle(g),
-        1,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert len(out) == 2
-    assert np.isclose(out[0].total_flow, v1)
-    assert np.isclose(out[1].total_flow, v2)
diff --git a/tests/py/test_batch_max_flow_masks.py b/tests/py/test_batch_max_flow_masks.py
deleted file mode 100644
index 83c363f..0000000
--- a/tests/py/test_batch_max_flow_masks.py
+++ /dev/null
@@ -1,35 +0,0 @@
-"""Batch max-flow with node/edge masks and per-edge flow outputs."""
-
-from __future__ import annotations
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def test_batch_max_flow_with_masks_and_edge_flows(square1_graph, algs, to_handle):
-    g = square1_graph
-    pairs = np.array([[0, 2], [0, 3]], dtype=np.int32)
-    node_masks = [
-        np.array([True, True, True, True], dtype=bool),
-        np.array([True, True, True, False], dtype=bool),  # block node 3 for second pair
-    ]
-    # Supply a proper mask for each pair; the first pair allows all edges
-    edge_masks = [
-        np.ones(g.num_edges(), dtype=bool),
-        np.array([True, True, False, False], dtype=bool),  # block the alt path edges
-    ]
-    out = algs.batch_max_flow(
-        to_handle(g),
-        pairs,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=True,
-        node_masks=node_masks,
-        edge_masks=edge_masks,  # type: ignore[arg-type]
-    )
-    assert len(out) == 2
-    # Second pair should be zero due to masks blocking all routes
-    assert out[1].total_flow == 0.0
-    # Edge flows length matches num_edges for with_edge_flows=True
-    assert np.asarray(out[0].edge_flows).shape == (g.num_edges(),)
diff --git a/tests/py/test_centralized_te_tunnels.py b/tests/py/test_centralized_te_tunnels.py
new file mode 100644
index 0000000..9786b65
--- /dev/null
+++ b/tests/py/test_centralized_te_tunnels.py
@@ -0,0 +1,1724 @@
+"""T2 (CentralizedTE(tunnel_count=TunnelCount(N)), TunnelCount(L, up_to=True)) through the binding: the worked T2
+examples and calls (docs/semantics.md, "T2: the controller's equal tunnels"), the configuration and call checks, sizing, objectives,
+count selection, operations, programs and replays, records, flags and terminations, the
+evaluators, the numeric ranges of T2's sums, zero offers and everything masked, a property test
+against the independent tunnel_oracle.py, and the Python-allocation sweeps of T2's results.
+Expected values are derived by hand from those rules, never taken from a build."""
+
+from __future__ import annotations
+
+import random
+from fractions import Fraction
+
+import pytest
+import tunnel_oracle as orc
+from helpers import (
+    GLOBAL,
+    INF,
+    L62,
+    SHORTEST_PATHS,
+    build,
+    dag_of,
+    exact,
+    full_ledger_state,
+    sweep_python_allocation,
+)
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+T = ngc.Termination
+S = ngc.TunnelStatus
+UP, FAILED, BLACKHOLED = S.UP, S.FAILED, S.BLACKHOLED
+LOSSY = ngc.Admission.LOSSY
+LOSSLESS = ngc.Admission.LOSSLESS
+
+
+def graph(rows, n=None):
+    """A graph whose rows are in EdgeId order (asserted): (u, v, capacity, cost)."""
+    n = n if n is not None else 1 + max(max(u, v) for u, v, _, _ in rows)
+    g = build(n, rows)
+    assert [int(i) for i in g.input_positions()] == list(range(len(rows)))
+    return g
+
+
+def t2_config(
+    count, admission=None, headroom=False, up_to=False, source_allocation=None
+):
+    """A T2 FlowPolicyConfig: CentralizedTE(source_allocation=source_allocation (EQUAL by default),
+    tunnel_count=TunnelCount(count, up_to=up_to), prefer_headroom=headroom), Lossless by
+    default."""
+    return ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(
+            source_allocation=source_allocation or ngc.SourceAllocation.EQUAL,
+            tunnel_count=ngc.TunnelCount(count, up_to=up_to),
+            prefer_headroom=headroom,
+        ),
+        admission=admission or LOSSLESS,
+    )
+
+
+def policy(
+    g,
+    s,
+    d,
+    n,
+    admission=None,
+    ledger=None,
+    eligibility=None,
+    headroom=False,
+    up_to=False,
+    source_allocation=None,
+):
+    ledger = ledger if ledger is not None else ngc.FlowLedger(g)
+    return ngc.FlowPolicy(
+        ledger,
+        s,
+        d,
+        t2_config(n, admission, headroom, up_to, source_allocation),
+        eligibility,
+    )
+
+
+def routes(r):
+    return [list(t.edges) for t in r.program.tunnels]
+
+
+def counts(r, m):
+    x = [0] * m
+    for t in r.program.tunnels:
+        for e in t.edges:
+            x[e] += 1
+    return x
+
+
+def rows(r):
+    return [
+        (t.entry_id, t.head, t.status, t.assigned, t.delivered, t.total_edge_drops)
+        for t in r.by_tunnel
+    ]
+
+
+def source_rows(r):
+    return [
+        (
+            s.source,
+            s.offered,
+            s.admitted,
+            s.delivered,
+            s.source_drops,
+            s.total_edge_drops,
+        )
+        for s in r.by_source
+    ]
+
+
+def plan_tuple(p):
+    return (
+        p.tunnels_per_head,
+        p.design_demand,
+        p.design_by_head,
+        p.total_reserved_bandwidth,
+        p.heads_with_capacity,
+        p.insufficient_resolution,
+        p.max_fractional_bandwidth_per_tunnel,
+        p.max_bandwidth_per_tunnel,
+        p.planned_bandwidth_per_tunnel,
+        p.total_planned_bandwidth,
+        p.total_tunnel_cost,
+        p.headroom_penalty,
+        p.max_lossless_offer,
+    )
+
+
+G1 = [(0, 1, 8192, 1), (0, 2, 40960, 1), (1, 3, 8192, 1), (2, 3, 40960, 1)]
+G4 = [(0, i, 4096, 1) for i in range(1, 16)] + [(i, 16, 4096, 1) for i in range(1, 16)]
+G10 = [
+    (0, 1, 40960, 1), (0, 5, 40960, 1), (0, 3, 24576, 2), (1, 0, 40960, 1), (1, 2, 40960, 1), (1, 4, 16384, 2),
+    (2, 1, 40960, 1), (2, 3, 40960, 1), (2, 5, 20480, 2), (3, 2, 40960, 1), (3, 4, 40960, 1), (3, 0, 24576, 2),
+    (4, 3, 40960, 1), (4, 5, 40960, 1), (4, 1, 16384, 2), (5, 0, 40960, 1), (5, 4, 40960, 1), (5, 2, 20480, 2),
+]  # fmt: skip
+G10_CAPS = {
+    "G10 head 0": [40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480,
+                40960, 40960, 24576, 40960, 40960, 16384, 40960, 40960, 20480],
+    "G10 head 1": [28672, 28672, 0, 40960, 28672, 16384, 40960, 28672, 20480,
+                40960, 40960, 24576, 28672, 40960, 16384, 40960, 28672, 20480],
+    "G10 head 2": [28672, 10240, 0, 22528, 13312, 1024, 40960, 13312, 20480,
+                40960, 25600, 24576, 28672, 40960, 16384, 40960, 10240, 20480],
+}  # fmt: skip
+G1_PATHS = [[0, 2]] * 2 + [[1, 3]] * 14
+
+
+def twoh(a, b):
+    return graph([(0, 2, a, 1), (1, 2, b, 1)])
+
+
+def one10():
+    return graph([(0, 1, 10, 1)])
+
+
+# ---------------------------------------------------------------- the worked examples (X)
+
+# id: (rows, heads, dst, N, D, free capacity or None, prefer_headroom, expected plan fields, routes, lossy offer, delivery,
+#      source loss). Plan fields: (U, u, fluid, F, planned total, route cost, Phi or None, live heads, indices or None).
+EXAMPLES = {
+    "G1 design 49152": (G1, [0], 3, 16, 49152, None, True,
+             (2925, 2925, Fraction(20480, 7), 46812, 46800, 32, 73610035200, (0,), None), G1_PATHS, 49152, 47104, 0),
+    "G1 design 8192": (G1, [0], 3, 16, 8192, None, True,
+                    (2925, 512, Fraction(20480, 7), 46812, 8192, 32, 12884901876, (0,), None), G1_PATHS, None, None, None),
+    "G4 design 61440": (G4, [0], 16, 16, 61440, None, True,
+             (2048, 2048, Fraction(2048), 32768, 32768, 32, 73014444032, (0,), None),
+             [[0, 15], [0, 15]] + [[i, 15 + i] for i in range(1, 15)], 61440, 57856, 0),
+    "heads behind 3 and 8": ([(0, 2, 3, 1), (1, 2, 8, 1)], [0, 1], 2, 2, 6, None, True,
+                (1, 1, Fraction(3, 2), 6, 4, 4, 5905580031, (0, 1), [0, 1, 2, 3]), [[0], [1], [0], [1]], None, None, None),
+    "a cheap link of 2": ([(0, 1, 2, 1), (0, 1, 10, 2)], [0], 1, 2, 2, None, True,
+                      (5, 1, Fraction(5), 2, 2, 2, 6442450944, (0,), None), [[0], [0]], None, None, None),
+    "G10 head 0": (G10, [0], 3, 16, 49152, G10_CAPS["G10 head 0"], True,
+                (6144, 3072, Fraction(6144), 49160, 49152, 40, 38654705652, (0,), None),
+                [[0, 4, 7]] * 4 + [[1, 16, 12]] * 4 + [[2]] * 8, None, None, None),
+    "G10 head 1": (G10, [1], 4, 16, 49152, G10_CAPS["G10 head 1"], True,
+                (4096, 3072, Fraction(4096), 52431, 49152, 43, None, (1,), None),
+                [[3, 1, 16]] * 6 + [[4, 7, 10]] * 5 + [[5]] * 5, None, None, None),
+    "G10 head 2": (G10, [2], 5, 16, 49152, G10_CAPS["G10 head 2"], True,
+                (2560, 2560, Fraction(2560), 40960, 40960, 40, None, (2,), None),
+                [[6, 3, 1]] * 4 + [[7, 10, 13]] * 4 + [[8]] * 8, None, None, None),
+    "a dead head": ([(0, 2, 0, 1), (1, 2, 10, 1)], [0, 1], 2, 2, 10, None, True,
+                     (5, 3, Fraction(5), 0, 6, 2, 3865470565, (1,), [1, 3]), [[1], [1]], 10, 5, 5),
+    "heads behind 2 and 10": ([(0, 2, 2, 1), (1, 2, 10, 1)], [0, 1], 2, 2, None, None, True,
+                           (1, 1, Fraction(1), 4, 4, 4, 7730941132, (0, 1), [0, 1, 2, 3]), [[0], [1], [0], [1]],
+                           None, None, None),
+    "an idle tunnel": ([(0, 1, 10, 1)], [0], 1, 4, 3, None, True,
+                (2, 1, Fraction(5, 2), 10, 4, 4, 4294967294, (0,), None), [[0]] * 4, 3, 3, 0),
+    "a zero design": ([(0, 1, 10, 1)], [0], 1, 2, 0, None, True,
+                       (5, 1, Fraction(5), 10, 2, 2, None, (0,), None), [[0]] * 2, 4, 4, 0),
+    "the remainder on the first link": ([(0, 1, 3, 1), (0, 1, 2, 1)], [0], 1, 2, 5, None, True,
+                           (2, 2, Fraction(2), 5, 4, 2, None, (0,), None), [[0], [1]], None, None, None),
+    "the remainder on the second link": ([(0, 1, 2, 1), (0, 1, 3, 1)], [0], 1, 2, 5, None, True,
+                            (2, 2, Fraction(2), 4, 4, 2, None, (0,), None), [[0], [1]], None, None, None),
+    "a tiny head": ([(0, 2, 1, 1), (1, 2, 100, 1)], [0, 1], 2, 16, None, None, True,
+                     (0, 0, Fraction(1, 16), 0, 0, 0, 0, (0, 1), None), [], None, None, None),
+}  # fmt: skip
+
+
+@pytest.mark.parametrize("eid", list(EXAMPLES))
+def test_contract_examples(eid):
+    rows_, heads, dst, N, D, free, hr, want, rts, offer, delivery, loss = EXAMPLES[eid]
+    g = graph(rows_)
+    fg = ngc.FlowLedger(g, free) if free is not None else ngc.FlowLedger(g)
+    r = policy(g, heads, dst, N, ledger=fg, headroom=hr).replace(
+        INF, design_demand=INF if D is None else D
+    )
+    p = r.plan
+    U, u, fluid, F, total, cost, phi, live, indices = want
+    assert (
+        p.max_bandwidth_per_tunnel,
+        p.planned_bandwidth_per_tunnel,
+        p.max_fractional_bandwidth_per_tunnel,
+        p.max_lossless_offer,
+    ) == (U, u, fluid, F)
+    assert (p.total_planned_bandwidth, p.total_tunnel_cost, p.heads_with_capacity) == (
+        total,
+        cost,
+        live,
+    )
+    if phi is not None:
+        assert p.headroom_penalty == phi
+    assert routes(r) == rts
+    if indices is not None:
+        assert [t.entry_id for t in r.program.tunnels] == indices
+    assert all(
+        (t.planned_bandwidth, t.weight, t.status) == (u, 1, UP)
+        for t in r.program.tunnels
+    )
+    assert (r.call_delivered, r.termination) == (
+        F,
+        T.EXHAUSTED,
+    )  # the unlimited query admits F
+    assert p.insufficient_resolution == (U == 0)
+    if offer is None:
+        return
+    ly = policy(
+        g,
+        heads,
+        dst,
+        N,
+        LOSSY,
+        ledger=ngc.FlowLedger(g, free) if free else None,
+        headroom=hr,
+    )
+    s = ly.replace(offer, design_demand=D)
+    assert (s.call_delivered, s.call_source_drops, s.termination) == (
+        delivery,
+        loss,
+        T.COMPLETE,
+    )
+    assert routes(s) == rts  # the offer never changes the layout
+
+
+UP_TO = {
+    # id: (rows, heads, dst, L, D, chosen count, routes, lossless delivery of D (None: unlimited, the bound),
+    #      the EXACT(k) bounds F'(k) of the all-live examples)
+    "G1 up to 6": (G1, [0], 3, 6, 49152, 6, [[0, 2]] + [[1, 3]] * 5, 49152, [40960] * 5 + [49152]),
+    "up to, a common size": ([(0, 3, 6, 1), (1, 3, 3, 1), (1, 3, 3, 1)], [0, 1], 3, 2, 12, 2, [[0], [1], [0], [2]], 12,
+                        [7, 12]),
+    "up to, a dead head": ([(0, 2, 0, 1), (1, 2, 10, 1)], [0, 1], 2, 2, 10, 1, [[1]], 0, None),
+    "up to, a tiny head": ([(0, 2, 1, 1), (1, 2, 100, 1)], [0, 1], 2, 3, None, 1, [[0], [1]], 2, [2, 0, 0]),
+}  # fmt: skip
+
+
+@pytest.mark.parametrize("eid", list(UP_TO))
+def test_up_to_examples(eid):
+    rows_, heads, dst, L, D, k, rts, delivered, bounds = UP_TO[eid]
+    g = graph(rows_)
+    r = policy(g, heads, dst, L, up_to=True, headroom=True).replace(
+        INF if D is None else D
+    )
+    assert (r.plan.tunnels_per_head, routes(r), r.call_delivered) == (k, rts, delivered)
+    if bounds is None:
+        return
+    # With every head live, F'(k) is EXACT(k)'s bound at U(k) (an unlimited design).
+    for c, b in enumerate(bounds, 1):
+        assert (
+            policy(g, heads, dst, c, headroom=True).replace(INF).call_delivered == b
+        ), c
+
+
+def test_g1_call():
+    # The G1 call, then its program's fields and the ledger.
+    q = 2.0**-12
+    g = ngc.Graph(
+        4,
+        edge_sources=[0, 0, 1, 2],
+        edge_destinations=[1, 2, 3, 3],
+        edge_capacity_units=ngc.to_units([2, 10, 2, 10], q),
+        edge_costs=[1, 1, 1, 1],
+        resolution=q,
+    )
+    te16 = t2_config(16, ngc.Admission.LOSSY, headroom=True)
+    fg = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(fg, 0, 3, te16)
+    r = p.replace(49152)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+        r.plan.max_lossless_offer,
+    ) == (2925, 2925, 46812)
+    assert r.call_delivered == 47104
+    assert plan_tuple(r.plan) == (
+        16,
+        49152,
+        ((0, 49152),),
+        0,
+        (0,),
+        False,
+        Fraction(20480, 7),
+        2925,
+        2925,
+        46800,
+        32,
+        73610035200,
+        46812,
+    )
+    assert [list(t.edges) for t in r.program.tunnels] == G1_PATHS
+    assert [
+        (
+            t.requested_bandwidth,
+            t.reserved_bandwidth,
+            t.planned_bandwidth,
+            t.status,
+            t.weight,
+        )
+        for t in r.program.tunnels
+    ] == [(0, 0, 2925, UP, 1)] * 16
+    assert [t.delivered for t in r.by_tunnel] == [3072] * 2 + [2926] * 10 + [2925] * 4
+    assert r.call_edge_drops == [(1, 2048)]
+    assert r.reservations_changed is False and (
+        r.routes_changed,
+        r.weights_changed,
+    ) == (True, True)
+    # A plan books nothing.
+    assert fg.reserved().tolist() == [0, 0, 0, 0]
+    assert all(rec.edge_reservations == [] for rec in p.records())
+    assert ngc.CentralizedTE(
+        source_allocation=ngc.SourceAllocation.EQUAL,
+        tunnel_count=ngc.TunnelCount(256, up_to=True),
+    ).tunnel_count == ngc.TunnelCount(256, up_to=True)
+
+
+def test_masked_replay_call():
+    # The replay under the mask, then the same program stale (black holes).
+    g = graph(G1)
+    p = policy(g, 0, 3, 16, LOSSY, headroom=True)
+    p.replace(49152)
+    base = p.program
+    fail = g.eligibility(excluded_edges=[2])
+    replay = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        ngc.FlowPolicyConfig(routing=ngc.Pinned(base), admission=LOSSY),
+        eligibility=fail,
+    )
+    r = replay.replace(49152)
+    assert [t.status for t in r.by_tunnel][:3] == [FAILED, FAILED, UP]
+    assert r.call_delivered == 40960 and r.plan is None
+    stale = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        ngc.FlowPolicyConfig(
+            routing=ngc.Pinned(base, black_holes=fail), admission=LOSSY
+        ),
+    )
+    s = stale.replace(49152)
+    assert [t.status for t in s.by_tunnel] == [BLACKHOLED] * 2 + [UP] * 14
+    assert (s.call_edge_drops, s.call_delivered) == ([(1, 2048), (2, 6144)], 40960)
+    assert [t.status for t in base.tunnels] == [
+        UP
+    ] * 16  # the program's own statuses stay
+
+
+# ---------------------------------------------------------------- validation (V)
+
+
+SEVERAL = "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL"
+
+
+def cte(source_allocation=ngc.SourceAllocation.EQUAL, **fields):
+    return ngc.CentralizedTE(source_allocation=source_allocation, **fields)
+
+
+def test_matrix():
+    # T2's row of the matrix, in order (the evaluators run the same checks). CentralizedTE has
+    # no route choice and no weights: those keywords are no keywords of it.
+    g = twoh(10, 10)
+    fg = ngc.FlowLedger(g)
+    t2 = cte(tunnel_count=ngc.TunnelCount(2))
+    opt = cte(ngc.SourceAllocation.OPTIMIZED, tunnel_count=ngc.TunnelCount(2))
+    dag = dag_of(g, [0, 1])
+    both = cte(support=dag, tunnel_count=ngc.TunnelCount(2), prefer_headroom=True)
+    for kw in (
+        {"allocation": ngc.RouteAllocation.EQUAL},
+        {"weight_basis": ngc.WeightBasis.CAPACITY},
+        {"edge_weights": [1, 1]},
+        {"tie_break": ngc.RouteTieBreak.FEWER_HOPS},
+        {"multipath": False},
+        {"parallel_edges": False},
+    ):
+        with pytest.raises(TypeError):
+            cte(tunnel_count=ngc.TunnelCount(2), **kw)
+    for kw in (
+        {"placement": ngc.RouteAllocation.EQUAL},
+        {"origin": ngc.SourceAllocation.EQUAL},
+    ):
+        with pytest.raises(TypeError):
+            ngc.FlowPolicyConfig(routing=t2, **kw)
+    cases = [
+        # The several-sources rule first, then prefer_headroom without tunnel_count.
+        (ngc.FlowPolicyConfig(routing=opt), SEVERAL),
+        (ngc.FlowPolicyConfig(routing=cte(ngc.SourceAllocation.OPTIMIZED, support=dag,
+                                          tunnel_count=ngc.TunnelCount(2), prefer_headroom=True),
+                              admission=LOSSY), SEVERAL),
+        (ngc.FlowPolicyConfig(routing=cte(prefer_headroom=True)), "prefer_headroom requires tunnel_count"),
+        (ngc.FlowPolicyConfig(routing=cte(support=dag, prefer_headroom=True)),
+         "prefer_headroom requires tunnel_count"),
+    ]  # fmt: skip
+    for cfg, text in cases:
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowPolicy(fg, [0, 1], 2, cfg)
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.evaluate_demand(g, [0, 1], 2, ngc.EvaluationOptions(cfg))
+    with pytest.raises(
+        ValueError, match=exact("CentralizedTE does not use ShortestPathCache")
+    ):
+        ngc.FlowPolicy(
+            fg,
+            [0, 1],
+            2,
+            ngc.FlowPolicyConfig(routing=t2),
+            cache=ngc.ShortestPathCache(g),
+        )
+    # The several-sources rule counts the normalized input sources, before the mask; one source
+    # with OPTIMIZED is accepted (the same calculation).
+    with pytest.raises(ValueError, match=exact(SEVERAL)):
+        ngc.FlowPolicy(
+            fg,
+            [0, 1],
+            2,
+            ngc.FlowPolicyConfig(routing=opt),
+            g.eligibility(excluded_nodes=[1]),
+        )
+    one = ngc.FlowPolicy(fg, [0, 0], 2, ngc.FlowPolicyConfig(routing=opt))
+    assert one.config.routing.source_allocation == ngc.SourceAllocation.OPTIMIZED
+    # Accepted: both admissions, with and without prefer_headroom, with and without a support.
+    for adm in (LOSSLESS, LOSSY):
+        for hr in (False, True):
+            ngc.FlowPolicy(fg, [0, 1], 2, t2_config(2, adm, hr))
+        ngc.FlowPolicy(fg, [0, 1], 2, ngc.FlowPolicyConfig(routing=both, admission=adm))
+    got = ngc.FlowPolicy(fg, [0, 1], 2, ngc.FlowPolicyConfig(routing=t2)).config
+    assert (got.routing.source_allocation, got.routing.tunnel_count) == (
+        ngc.SourceAllocation.EQUAL,
+        ngc.TunnelCount(2),
+    )
+    # The arguments of CentralizedTE itself: source_allocation required; prefer_headroom False
+    # by default.
+    for bad in ({}, {"source_allocation": None}):
+        with pytest.raises(TypeError):
+            ngc.CentralizedTE(**bad)
+    with pytest.raises(TypeError):
+        cte(tunnel_count=2)
+    with pytest.raises(TypeError):
+        cte(tunnel_count=ngc.TunnelCount(2), prefer_headroom="yes")
+    plain = cte()
+    assert (plain.support, plain.tunnel_count, plain.prefer_headroom) == (
+        None,
+        None,
+        False,
+    )
+    assert cte(prefer_headroom=True).prefer_headroom is True
+    eq = "source_allocation=SourceAllocation.EQUAL"
+    assert (
+        repr(cte(tunnel_count=ngc.TunnelCount(256, up_to=True)))
+        == f"CentralizedTE({eq}, tunnel_count=TunnelCount(256, up_to=True))"
+    )
+    assert (
+        repr(cte(tunnel_count=ngc.TunnelCount(16), prefer_headroom=True))
+        == f"CentralizedTE({eq}, tunnel_count=TunnelCount(16), prefer_headroom=True)"
+    )
+    assert (
+        repr(cte(prefer_headroom=True)) == f"CentralizedTE({eq}, prefer_headroom=True)"
+    )
+    assert repr(cte()) == f"CentralizedTE({eq})"
+    assert (
+        repr(cte(ngc.SourceAllocation.OPTIMIZED))
+        == "CentralizedTE(source_allocation=SourceAllocation.OPTIMIZED)"
+    )
+    # Every set field, the invalid support-and-tunnels combination included.
+    dag = dag_of(twoh(10, 10), [0, 1])
+    assert repr(cte(support=dag)) == f"CentralizedTE({eq}, support=...)"
+    assert (
+        repr(cte(support=dag, tunnel_count=ngc.TunnelCount(2)))
+        == f"CentralizedTE({eq}, support=..., tunnel_count=TunnelCount(2))"
+    )
+    assert (
+        repr(cte(support=dag, prefer_headroom=True))
+        == f"CentralizedTE({eq}, support=..., prefer_headroom=True)"
+    )
+
+
+def test_global_prefer_headroom_texts():
+    # CentralizedTE's own cases in the model matrix's order, at a policy and at an evaluator:
+    # prefer_headroom without tunnel_count is refused, with or without a support; support and
+    # tunnels together are T2 on the support.
+    g = twoh(10, 10)
+    fg = ngc.FlowLedger(g)
+    dag = dag_of(g, [0, 1])
+    t2 = ngc.TunnelCount(2)
+    cases = [
+        (dict(prefer_headroom=True), "prefer_headroom requires tunnel_count"),
+        (dict(prefer_headroom=True, support=dag), "prefer_headroom requires tunnel_count"),
+        (dict(prefer_headroom=True, support=dag, tunnel_count=t2), None),
+        (dict(prefer_headroom=True, tunnel_count=t2), None),
+        ({}, None),
+    ]  # fmt: skip
+    for kwargs, text in cases:
+        cfg = ngc.FlowPolicyConfig(routing=cte(**kwargs))
+        if text is None:
+            ngc.FlowPolicy(fg, 0, 2, cfg)
+            ngc.evaluate_demand(g, 0, 2, ngc.EvaluationOptions(cfg))
+            continue
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowPolicy(fg, 0, 2, cfg)
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.evaluate_demand(g, 0, 2, ngc.EvaluationOptions(cfg))
+    # No old spelling of the objective is accepted.
+    with pytest.raises(TypeError):
+        cte(tunnel_count=t2, priority=ngc.RouteTieBreak.HIGHER_HEADROOM)
+
+
+# ---------------------------------------------------------------- a supplied support
+
+
+SUPPORTED = [(0, 1, 6, 1), (0, 1, 6, 1), (0, 1, 100, 2)]
+
+
+@pytest.mark.parametrize(
+    ("excluded", "want"),
+    [
+        # T2-support: the support holds links 0 and 1; U = 6, one tunnel on each, the third link
+        # never used, the lossless maximum 12.
+        (None, (6, [1, 1, 0], [[0], [1]], [0, 1], 12)),
+        # T2-support-masked: the mask also excludes link 1: U = 3, both tunnels on link 0.
+        ([1], (3, [2, 0, 0], [[0], [0]], [0, 1], 6)),
+        # T2-support-mask-outside: a mask outside the support changes nothing.
+        ([2], (6, [1, 1, 0], [[0], [1]], [0, 1], 12)),
+    ],
+)
+def test_support_examples(excluded, want):
+    g = graph(SUPPORTED, 2)
+    cfg = ngc.FlowPolicyConfig(
+        routing=cte(support=dag_of(g, [0, 1]), tunnel_count=ngc.TunnelCount(2))
+    )
+    mask = None if excluded is None else g.eligibility(excluded_edges=excluded)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg, mask).replace(INF)
+    got = (
+        r.plan.max_bandwidth_per_tunnel,
+        counts(r, 3),
+        routes(r),
+        [t.entry_id for t in r.program.tunnels],
+        r.plan.max_lossless_offer,
+    )
+    assert got == want
+    assert r.call_delivered == want[4]
+
+
+def on_sup(g, support=(0, 1), admission=LOSSLESS, headroom=False):
+    return ngc.FlowPolicyConfig(
+        routing=cte(
+            support=dag_of(g, list(support)),
+            tunnel_count=ngc.TunnelCount(2),
+            prefer_headroom=headroom,
+        ),
+        admission=admission,
+    )
+
+
+def test_support_equals_mask():
+    # T2 on {e0, e1} against T2 with a mask excluding e2: the same plan, tunnels, rows, deliveries,
+    # drops and flags, Lossless and Lossy at offers 6, 12 and 13.
+    g = graph(SUPPORTED, 2)
+    outside = g.eligibility(excluded_edges=[2])
+    for admission in (LOSSLESS, LOSSY):
+        for offer in (6, 12, 13):
+            got = []
+            for cfg, mask in (
+                (on_sup(g, admission=admission), None),
+                (t2_config(2, admission), outside),
+            ):
+                p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg, mask)
+                r = p.replace(offer)
+                got.append(
+                    (
+                        plan_tuple(r.plan),
+                        routes(r),
+                        [t.planned_bandwidth for t in r.program.tunnels],
+                        rows(r),
+                        source_rows(r),
+                        r.call_delivered,
+                        r.call_edge_drops,
+                        r.termination,
+                        (r.routes_changed, r.weights_changed, r.reservations_changed),
+                    )
+                )
+            assert got[0] == got[1], (admission, offer)
+
+
+def test_support_edge_failures():
+    # Lossless, no offer: the baseline 12; deleting e0 or e1 halves it, deleting e2 (outside the
+    # support) changes nothing.
+    g = graph(SUPPORTED, 2)
+    for workers in (1, 2):
+        s = ngc.evaluate_edge_failures(
+            g, 0, 1, ngc.EvaluationOptions(on_sup(g)), workers
+        )
+        assert s.baseline.call_delivered == 12
+        assert [(x.edge, x.delivery_reduction) for x in s.entries] == [
+            (0, 6),
+            (1, 6),
+            (2, 0),
+        ]
+
+
+def test_support_empty_and_masked():
+    # An empty support: no head reaches a destination (NO_ROUTE, the Lossy offer lost at the
+    # source; a zero call COMPLETE); a mask excluding every edge does the same.
+    g = graph(SUPPORTED, 2)
+    empty = on_sup(g, support=(), admission=LOSSY)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, empty).replace(2)
+    assert (r.termination, r.call_source_drops, r.call_delivered) == (T.NO_ROUTE, 2, 0)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, empty).replace(0)
+    assert (r.termination, r.call_delivered) == (T.COMPLETE, 0)
+    every = g.eligibility(excluded_edges=[0, 1, 2])
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, on_sup(g), every).replace(2)
+    assert (r.termination, r.call_delivered) == (T.NO_ROUTE, 0)
+
+
+def test_support_headroom():
+    # prefer_headroom on the support, N = 2, design 2: U = 6, u = 1; the second tunnel takes e1 (a
+    # second slot on e0 costs more); the penalty is 2 floor(2^32 1 / 6).
+    g = graph(SUPPORTED, 2)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, on_sup(g, headroom=True)).replace(
+        INF, design_demand=2
+    )
+    assert (r.plan.max_bandwidth_per_tunnel, r.plan.planned_bandwidth_per_tunnel) == (
+        6,
+        1,
+    )
+    assert counts(r, 3) == [1, 1, 0]
+    assert r.plan.headroom_penalty == 2 * (2**32 // 6) == 1431655764
+
+
+def _composed(g, support_edges, mask_nodes, mask_edges):
+    """The policy's mask with every edge outside the support excluded too."""
+    outside = [e for e in range(g.num_edges()) if e not in set(support_edges)]
+    return g.eligibility(
+        excluded_nodes=mask_nodes, excluded_edges=sorted(set(mask_edges) | set(outside))
+    )
+
+
+@pytest.mark.parametrize("seed", range(80))
+def test_support_is_the_composed_mask(seed):
+    # T2 on a support gives what the same T2 configuration gives with the support's edges composed
+    # into the mask: the plan, the routes, the rows, the deliveries, at a policy (replace, then a
+    # forward) and at the three evaluators.
+    rng = random.Random(seed)
+    n = rng.randint(3, 6)
+    # Forward links only: every support is a DAG.
+    rows_ = []
+    for _ in range(rng.randint(n, 3 * n)):
+        u, v = sorted(rng.sample(range(n), 2))
+        rows_.append((u, v, rng.choice([0, 1, 3, 6, 10]), rng.randint(1, 4)))
+    g = build(n, rows_)
+    m = g.num_edges()
+    support_edges = sorted(rng.sample(range(m), rng.randint(1, m)))
+    mask_nodes = [v for v in range(1, n - 1) if rng.random() < 0.15]
+    mask_edges = [e for e in range(m) if rng.random() < 0.15]
+    mask = g.eligibility(excluded_nodes=mask_nodes, excluded_edges=mask_edges)
+    composed = _composed(g, support_edges, mask_nodes, mask_edges)
+    sources = sorted(rng.sample(range(n - 1), rng.randint(1, min(2, n - 1))))
+    count = ngc.TunnelCount(rng.randint(1, 3), up_to=rng.random() < 0.3)
+    headroom = rng.random() < 0.5
+    admission = rng.choice([LOSSLESS, LOSSY])
+    on_support = ngc.FlowPolicyConfig(
+        routing=cte(
+            support=dag_of(g, support_edges),
+            tunnel_count=count,
+            prefer_headroom=headroom,
+        ),
+        admission=admission,
+    )
+    plain_t2 = ngc.FlowPolicyConfig(
+        routing=cte(tunnel_count=count, prefer_headroom=headroom), admission=admission
+    )
+    offer = rng.choice([0, 3, 11, 40])
+    design = rng.choice([None, 0, 5, 30])
+
+    def call(cfg, eligibility):
+        p = ngc.FlowPolicy(ngc.FlowLedger(g), sources, n - 1, cfg, eligibility)
+        r = p.replace(offer, design_demand=design)
+        f = p.forward(offer + 1)
+        return (
+            plan_tuple(r.plan),
+            routes(r),
+            rows(r),
+            source_rows(r),
+            r.call_delivered,
+            r.call_edge_drops,
+            r.call_source_drops,
+            rows(f),
+            f.call_delivered,
+        )
+
+    assert call(on_support, mask) == call(plain_t2, composed), seed
+    options = dict(offer=offer if admission == LOSSY else None, design_demand=design)
+    a = ngc.EvaluationOptions(on_support, eligibility=mask, **options)
+    b = ngc.EvaluationOptions(plain_t2, eligibility=composed, **options)
+    ra, rb = (
+        ngc.evaluate_demand(g, sources, n - 1, a),
+        ngc.evaluate_demand(g, sources, n - 1, b),
+    )
+    assert (plan_tuple(ra.plan), routes(ra), ra.call_delivered) == (
+        plan_tuple(rb.plan),
+        routes(rb),
+        rb.call_delivered,
+    ), seed
+    (pa,) = ngc.evaluate_pairs(g, [(sources, n - 1)], a)
+    assert pa.call_delivered == ra.call_delivered
+    # The deletions of the support's allowed edges match; a deletion outside the support changes
+    # nothing.
+    sa = ngc.evaluate_edge_failures(g, sources, n - 1, a, 1)
+    sb = ngc.evaluate_edge_failures(g, sources, n - 1, b, 1)
+    reduction_b = {x.edge: x.delivery_reduction for x in sb.entries}
+    for x in sa.entries:
+        assert x.delivery_reduction == reduction_b.get(x.edge, 0), (seed, x.edge)
+
+
+@pytest.mark.parametrize("on", [False, True])
+def test_prefer_headroom_example(on):
+    # prefer_headroom off and on: two equal-cost parallel links of 10, one head, N = 2, D = 2:
+    # U = 10, u = 1. Off, the canonical tie puts both tunnels on link 0 (bound 10; Lossy 12
+    # delivers 10). On, the second tunnel pays floor(2^32 / 10) on link 1 against
+    # floor(2^32 2 / 10) for a second slot on link 0: Phi = 2 floor(2^32 / 10) = 858993458, bound
+    # 20, Lossy 12 delivers 12. Both plan 2.
+    g = graph([(0, 1, 10, 1), (0, 1, 10, 1)])
+    r = policy(g, 0, 1, 2, LOSSY, headroom=on).replace(12, design_demand=2)
+    p = r.plan
+    assert (
+        p.max_bandwidth_per_tunnel,
+        p.planned_bandwidth_per_tunnel,
+        p.total_planned_bandwidth,
+        p.total_tunnel_cost,
+    ) == (
+        10,
+        1,
+        2,
+        2,
+    )
+    assert routes(r) == ([[0], [1]] if on else [[0], [0]])
+    assert p.headroom_penalty == (858993458 if on else None)
+    assert (p.max_lossless_offer, r.call_delivered) == ((20, 12) if on else (10, 10))
+
+
+def test_count_range_and_tunnel_limit():
+    # The count range (the count and the largest count of "up to"); the tunnel limit uses L for
+    # "up to".
+    fg = ngc.FlowLedger(one10())
+    for n in (0, 10001, -1):
+        for up in (False, True):
+            with pytest.raises(
+                ValueError, match=exact("tunnel count must be in [1, 10000]")
+            ):
+                policy(None, 0, 1, n, ledger=fg, up_to=up)
+    policy(None, 0, 1, 10000, ledger=fg)
+    policy(None, 0, 1, 10000, ledger=fg, up_to=True)
+    # 1000 heads x 10000 = 10^7 tunnels: within the limit (2^30 - 1).
+    rows_ = [(h, 1000, 1, 1) for h in range(1000)]
+    policy(graph(rows_), list(range(1000)), 1000, 10000, up_to=True)
+
+
+@needs_hooks
+def test_traced_place_checks_the_operation_first():
+    p = policy(one10(), 0, 1, 2)
+    for v in (5, 0, -1, L62, 2**100):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "CentralizedTE with tunnel_count does not support incremental placement"
+            ),
+        ):
+            p._place_traced(v)
+
+
+def test_operations_and_design_validation():
+    # The operations of T2 and the design's domain, with their texts.
+    g = one10()
+    p = policy(g, 0, 1, 2)
+    # The operation comes before the offer: also for an offer outside its domain.
+    for v in (5, 0, -1, L62, 2**100):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "CentralizedTE with tunnel_count does not support incremental placement"
+            ),
+        ):
+            p.place(v)
+    with pytest.raises(
+        ValueError, match=exact("forward requires an installed program")
+    ):
+        p.forward(5)
+    for d in (-1, L62):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "design_demand must be an integer in [0, 2^62) or permitted +inf"
+            ),
+        ):
+            p.replace(5, design_demand=d)
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        p.replace(-1, design_demand=-1)
+    ly = policy(g, 0, 1, 2, LOSSY)
+    with pytest.raises(
+        ValueError, match=exact("LOSSY forwarding requires a finite offer")
+    ):
+        ly.replace(INF)
+    assert p.replace(INF).plan.design_demand == INF  # an unlimited design
+    for cfg in (SHORTEST_PATHS, GLOBAL):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                f"{'ShortestPaths' if cfg is SHORTEST_PATHS else 'CentralizedTE'} does not accept design_demand"
+            ),
+        ):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).replace(5, design_demand=5)
+
+
+# ---------------------------------------------------------------- sizing, objectives and count (U)
+
+
+def test_headroom_off_and_finite_cost_tie():
+    # G1 without prefer_headroom (the cost tie goes to the smallest keys); PAR412 with and without.
+    g = graph(G1)
+    r = policy(g, 0, 3, 16, LOSSY).replace(49152)
+    assert (
+        counts(r, 4),
+        r.plan.max_lossless_offer,
+        r.call_delivered,
+        r.plan.headroom_penalty,
+    ) == ([2, 14, 2, 14], 46812, 47104, None)
+    r = policy(g, 0, 3, 16).replace(INF, design_demand=8192)
+    assert (
+        r.plan.planned_bandwidth_per_tunnel,
+        counts(r, 4),
+        r.plan.max_lossless_offer,
+    ) == (
+        512,
+        [16, 0, 16, 0],
+        8192,
+    )
+    r = policy(g, 0, 3, 16, headroom=True).replace(INF, design_demand=8192)
+    assert (counts(r, 4), r.plan.max_lossless_offer) == ([2, 14, 2, 14], 46812)
+    p412 = graph([(0, 1, 4, 1), (0, 1, 12, 1)])
+    r = policy(p412, 0, 1, 2, headroom=True).replace(INF, design_demand=2)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+        routes(r),
+        r.plan.max_lossless_offer,
+    ) == (6, 1, [[1], [1]], 12)
+    assert r.plan.headroom_penalty == 1073741823
+    r = policy(p412, 0, 1, 2).replace(INF, design_demand=2)
+    assert (routes(r), r.plan.max_lossless_offer) == ([[0], [0]], 4)
+
+
+# The graphs of T2's three canonical tie rules (u, v, capacity, cost), each derived in tests/cpp's twin.
+ROOT_TIE_A = [
+    (0, 2, 1, 1),
+    (0, 4, 1, 1),
+    (1, 2, 1, 1),
+    (1, 5, 1, 1),
+    (2, 3, 1, 1),
+    (4, 3, 1, 1),
+    (5, 3, 1, 1),
+]
+ROOT_TIE_B = [
+    (0, 2, 1, 1),
+    (0, 5, 1, 1),
+    (1, 2, 1, 1),
+    (1, 4, 1, 1),
+    (2, 3, 1, 1),
+    (4, 3, 1, 1),
+    (5, 3, 1, 1),
+]
+FEWEST_A = [(0, 1, 1, 1), (0, 2, 1, 2), (1, 2, 1, 1)]
+FEWEST_B = [(0, 1, 1, 1), (0, 3, 1, 3), (1, 2, 1, 1), (2, 3, 1, 1)]
+CUT_A = [(0, 1, 2, 2), (1, 2, 2, 2), (1, 2, 3, 2)]
+CUT_B = [
+    (0, 2, 1, 1),
+    (1, 2, 1, 1),
+    (2, 3, 1, 1),
+    (2, 4, 1, 1),
+    (3, 5, 1, 1),
+    (4, 5, 1, 1),
+]
+
+
+def head_routes(r):
+    return [(t.head, list(t.edges)) for t in r.program.tunnels]
+
+
+@pytest.mark.parametrize("headroom", [False, True])
+def test_root_key_tie(headroom):
+    # The heads' first walks tie (price 2, four arcs): the smaller head NodeId goes first; the
+    # other head then takes its four-arc walk, not the six-arc one through a reverse arc.
+    r = policy(graph(ROOT_TIE_A), [0, 1], 3, 1, headroom=headroom).replace(INF)
+    assert head_routes(r) == [(0, [0, 4]), (1, [3, 6])]
+    r = policy(graph(ROOT_TIE_B), [0, 1], 3, 1, headroom=headroom).replace(INF)
+    assert head_routes(r) == [(0, [0, 4]), (1, [3, 5])]
+
+
+def test_fewest_arcs_before_keys():
+    # The direct link ties the longer walk on cost; fewer arcs wins before the smallest keys.
+    assert routes(policy(graph(FEWEST_A), 0, 2, 1).replace(INF)) == [[1]]
+    assert routes(policy(graph(FEWEST_B), 0, 3, 1).replace(INF)) == [[1]]
+
+
+def test_cut_into_unit_walks():
+    # Live heads ascending, each walk along the smallest positive EdgeId: head 0 cuts first.
+    r = policy(graph(CUT_A), [0, 1], 2, 2).replace(INF)
+    assert head_routes(r) == [(0, [0, 1]), (1, [2]), (0, [0, 1]), (1, [2])]
+    r = policy(graph(CUT_B), [0, 1], 5, 1).replace(INF)
+    assert head_routes(r) == [(0, [0, 2, 4]), (1, [1, 3, 5])]
+
+
+def test_reverse_arcs_and_preloaded_prices():
+    # A reverse arc: the second unit cancels the first unit's middle link (reverse arcs undo an
+    # earlier choice); a preload: the slot prices read the static capacity, not the free one.
+    g = graph([(0, 1, 1, 1), (0, 2, 1, 5), (1, 2, 1, 1), (1, 3, 1, 5), (2, 3, 1, 1)])
+    r = policy(g, 0, 3, 2).replace(INF)
+    assert (r.plan.max_bandwidth_per_tunnel, routes(r), r.plan.total_tunnel_cost) == (
+        1,
+        [[0, 3], [1, 4]],
+        12,
+    )
+    r = policy(
+        one10(), 0, 1, 2, ledger=ngc.FlowLedger(one10(), [6]), headroom=True
+    ).replace(INF, design_demand=4)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+        r.plan.headroom_penalty,
+    ) == (3, 2, 6012954213)
+
+
+def test_unlimited_design_and_up_to():
+    # An unlimited design (u = U); G1 up to 6 delivers 49152.
+    g = graph(G1)
+    r = policy(g, 0, 3, 16, headroom=True).replace(INF)
+    assert (
+        r.plan.planned_bandwidth_per_tunnel,
+        r.plan.design_by_head,
+        r.plan.design_demand,
+    ) == (
+        2925,
+        (),
+        INF,
+    )
+    assert (r.call_delivered, r.termination) == (46812, T.EXHAUSTED)
+    r = policy(g, 0, 3, 6, up_to=True, headroom=True).replace(INF)
+    assert (r.plan.tunnels_per_head, r.call_delivered) == (6, 49152)
+
+
+def test_up_to_reaches_the_design_exactly():
+    # Three parallel links of 6, 5 and 4, D = 11, up to 3. k = 1: U = 6, F'(1) = 6. k = 2: U = 5
+    # (one tunnel on the 6-link, one on the 5-link), the bounds 10 and 11 leave the score open,
+    # F'(2) = 11 (z = 11 gives 6 and 5) = D: chosen. k = 3: U = 4, its lower bound min(11, 3 * 4)
+    # already reaches D, so a budget F'(2) one unit low would choose 3.
+    g = graph([(0, 1, 6, 1), (0, 1, 5, 1), (0, 1, 4, 1)])
+    r = policy(g, 0, 1, 3, up_to=True).replace(11)
+    assert (
+        r.plan.tunnels_per_head,
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+    ) == (2, 5, 5)
+    assert (routes(r), r.call_delivered) == ([[0], [1]], 11)
+
+
+def test_all_dead_and_insufficient_resolution():
+    # A plan of zeros without a live head; every head dead, forwarding without tunnels.
+    g = twoh(0, 0)
+    for up, count in ((False, 2), (True, 1)):
+        for adm in (LOSSY, LOSSLESS):
+            p = policy(g, [0, 1], 2, 2 if not up else 3, adm, up_to=up)
+            r = p.replace(10, design_demand=10)
+            assert plan_tuple(r.plan) == (
+                count,
+                10,
+                ((0, 5), (1, 5)),
+                0,
+                (),
+                False,
+                Fraction(0),
+                0,
+                0,
+                0,
+                0,
+                None,
+                0,
+            )
+            assert (r.program.tunnels, r.program.sources) == ((), (0, 1))
+            assert r.call_delivered == 0 and p.records() == []
+            if adm == LOSSY:
+                assert (r.call_source_drops, r.termination) == (10, T.COMPLETE)
+                assert source_rows(r) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 0, 5, 0)]
+            else:
+                assert (r.unadmitted, r.termination) == (10, T.EXHAUSTED)
+    g = twoh(1, 100)
+    for adm in (LOSSY, LOSSLESS):
+        p = policy(g, [0, 1], 2, 16, adm)
+        r = p.replace(200, design_demand=200)
+        assert (
+            r.plan.insufficient_resolution,
+            r.plan.max_fractional_bandwidth_per_tunnel,
+            r.plan.max_bandwidth_per_tunnel,
+        ) == (True, Fraction(1, 16), 0)
+        assert (r.plan.heads_with_capacity, r.program.tunnels, r.call_delivered) == (
+            (0, 1),
+            (),
+            0,
+        )
+        assert p.program is not None and p.program.sources == (0, 1)
+        f = p.forward(10)
+        if adm == LOSSY:
+            assert source_rows(r) == [
+                (0, 100, 100, 0, 100, 0),
+                (1, 100, 100, 0, 100, 0),
+            ]
+            assert (f.call_source_drops, f.termination) == (10, T.COMPLETE)
+            assert source_rows(f) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 0, 5, 0)]
+        else:
+            assert (r.termination, f.call_delivered, f.termination) == (
+                T.EXHAUSTED,
+                0,
+                T.EXHAUSTED,
+            )
+        assert f.plan == r.plan or plan_tuple(f.plan) == plan_tuple(r.plan)
+
+
+def test_dead_head_rows_and_records():
+    # A dead head's indices, rows and records; the round order with heads behind 3 and 8.
+    g = twoh(0, 10)
+    p = policy(g, [0, 1], 2, 2, LOSSY)
+    r = p.replace(10, design_demand=10)
+    assert [t.entry_id for t in r.program.tunnels] == [1, 3]
+    assert source_rows(r) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 5, 0, 0)]
+    assert sorted(rec.entry_id for rec in p.records()) == [1, 3]
+    assert [(t.entry_id, t.status, t.assigned, t.delivered) for t in r.by_tunnel] == [
+        (1, UP, 3, 3),
+        (3, UP, 2, 2),
+    ]
+    r = policy(graph([(0, 2, 3, 1), (1, 2, 8, 1)]), [0, 1], 2, 2).replace(
+        INF, design_demand=6
+    )
+    assert [
+        (t.entry_id, t.head, t.local_index, list(t.edges)) for t in r.program.tunnels
+    ] == [
+        (0, 0, 0, [0]),
+        (1, 1, 0, [1]),
+        (2, 0, 1, [0]),
+        (3, 1, 1, [1]),
+    ]
+
+
+def test_optimized_one_source():
+    # OPTIMIZED with one source: every field equal to the EQUAL call's.
+    g = graph(G1)
+    a = policy(g, 0, 3, 16, LOSSY, headroom=True).replace(49152)
+    p = policy(
+        g,
+        0,
+        3,
+        16,
+        LOSSY,
+        headroom=True,
+        source_allocation=ngc.SourceAllocation.OPTIMIZED,
+    )
+    b = p.replace(49152)
+    assert plan_tuple(a.plan) == plan_tuple(b.plan)
+    assert (routes(a), rows(a), a.call_delivered, a.call_edge_drops) == (
+        routes(b),
+        rows(b),
+        b.call_delivered,
+        b.call_edge_drops,
+    )
+    assert (p.config.routing.source_allocation, b.program.source_weights) == (
+        ngc.SourceAllocation.OPTIMIZED,
+        None,
+    )
+
+
+def test_planned_only_on_t2():
+    # The planned bandwidth is T2's alone: 0 on T1's tunnels, on a controller's paths (CentralizedTE,
+    # ShortestPaths OPTIMIZED) and on a supplied program's tunnels; Pinned over a T2 program keeps u.
+    g = twoh(2, 10)
+
+    def planned(cfg, call):
+        p = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg)
+        return [t.planned_bandwidth for t in call(p).program.tunnels]
+
+    t1 = ngc.FlowPolicyConfig(
+        routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=LOSSY
+    )
+    assert planned(t1, lambda p: p.replace(12, design_demand=12)) == [0, 0, 0, 0]
+    assert planned(GLOBAL, lambda p: p.place(12)) == [0, 0]
+    max_flow = ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(allocation=ngc.RouteAllocation.OPTIMIZED)
+    )
+    assert planned(max_flow, lambda p: p.place(12)) == [0, 0]
+    supplied = ngc.ForwardingProgram.from_routes(
+        g,
+        [0, 1],
+        [2],
+        [
+            ngc.RouteDefinition(0, ngc.Path(g, [[0]])),
+            ngc.RouteDefinition(1, ngc.Path(g, [[1]])),
+        ],
+    )
+    pinned = ngc.FlowPolicyConfig(routing=ngc.Pinned(supplied), admission=LOSSY)
+    assert planned(pinned, lambda p: p.replace(4)) == [0, 0]
+    laid = policy(g, [0, 1], 2, 2).replace(INF).program
+    assert [t.planned_bandwidth for t in laid.tunnels] == [1, 1, 1, 1]
+    replay = ngc.FlowPolicyConfig(routing=ngc.Pinned(laid), admission=LOSSY)
+    assert planned(replay, lambda p: p.replace(4)) == [1, 1, 1, 1]
+
+
+def test_two_heads_equal_against_global():
+    # Heads behind 2 and 10 against the global optimum, N = 2: the common size 1, lossless
+    # bound 4; optimized CentralizedTE delivers 12 on the same network.
+    g = twoh(2, 10)
+    r = policy(g, [0, 1], 2, 2).replace(INF)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+        r.call_delivered,
+    ) == (1, 1, 4)
+    assert (
+        ngc.evaluate_demand(g, [0, 1], 2, ngc.EvaluationOptions(GLOBAL)).call_delivered
+        == 12
+    )
+
+
+def test_empty_roster_zero_design_forward_and_flags():
+    # An empty roster, a zero design, forward, and the change flags.
+    empty = graph([(1, 2, 5, 1)])
+    for adm in (LOSSY, LOSSLESS):
+        r = policy(empty, 0, 2, 2, adm, headroom=True).replace(5, design_demand=5)
+        assert (
+            r.termination,
+            r.program.tunnels,
+            r.program.sources,
+            r.program.destinations,
+        ) == (T.NO_ROUTE, (), (0,), (2,))
+        assert plan_tuple(r.plan) == (
+            2,
+            5,
+            (),
+            0,
+            (),
+            False,
+            Fraction(0),
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+        )
+    r = policy(one10(), 0, 1, 2).replace(0)
+    assert (
+        r.plan.planned_bandwidth_per_tunnel,
+        [t.planned_bandwidth for t in r.program.tunnels],
+        r.call_delivered,
+        r.termination,
+    ) == (
+        1,
+        [1, 1],
+        0,
+        T.COMPLETE,
+    )
+    g = graph(G1)
+    p = policy(g, 0, 3, 16, LOSSY, headroom=True)
+    first = p.replace(49152)
+    f = p.forward(32768)
+    assert (
+        f.call_delivered,
+        f.routes_changed,
+        f.weights_changed,
+        f.reservations_changed,
+    ) == (
+        32768,
+        False,
+        False,
+        False,
+    )
+    assert f.program is first.program and plan_tuple(f.plan) == plan_tuple(first.plan)
+    q = policy(g, 0, 3, 16, headroom=True)
+    q.replace(49152)
+    assert q.forward(INF).call_delivered == 46812
+    second = p.replace(49152, design_demand=8192)
+    assert (
+        second.routes_changed,
+        second.weights_changed,
+        second.reservations_changed,
+    ) == (False, False, False)
+    assert (
+        first.plan.planned_bandwidth_per_tunnel,
+        second.plan.planned_bandwidth_per_tunnel,
+    ) == (
+        2925,
+        512,
+    )
+
+
+def test_no_certificates_and_plan_only_for_tunnels():
+    # No certificates; the plan only for the tunnel models.
+    g = graph(G1)
+    r = policy(g, 0, 3, 16).replace(INF, outputs=ngc.OutputOptions(min_cut=True))
+    assert (r.total_cost, r.min_cut, r.marginal_cost_curve) == (None, None, None)
+    pin = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 3, ngc.FlowPolicyConfig(routing=ngc.Pinned(r.program))
+    )
+    assert pin.replace(10).plan is None
+    # An optimized-source-allocation T2 policy whose roster is empty (source 0 reaches nothing): no
+    # certificate either, never an empty cut or curve.
+    empty = ngc.FlowPolicy(
+        ngc.FlowLedger(graph([(1, 2, 10, 1)], 3)),
+        0,
+        2,
+        t2_config(2, source_allocation=ngc.SourceAllocation.OPTIMIZED),
+    )
+    for offer, termination in ((5, T.NO_ROUTE), (0, T.COMPLETE)):
+        e = empty.replace(offer, outputs=ngc.OutputOptions(min_cut=True))
+        assert (e.termination, e.call_delivered, e.plan is not None) == (
+            termination,
+            0,
+            True,
+        )
+        assert (e.total_cost, e.min_cut, e.marginal_cost_curve) == (None, None, None)
+
+
+def test_t2_replay_with_every_tunnel_failed():
+    # The G1 call's program with e0 and e1 masked: no head reaches 3; sixteen zero records.
+    g = graph(G1)
+    base = policy(g, 0, 3, 16, LOSSY, headroom=True)
+    base.replace(49152)
+    pin = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        ngc.FlowPolicyConfig(routing=ngc.Pinned(base.program), admission=LOSSY),
+        g.eligibility(excluded_edges=[0, 1]),
+    )
+    r = pin.replace(49152)
+    assert (r.termination, len(pin.records()), [t.status for t in r.by_tunnel]) == (
+        T.NO_ROUTE,
+        16,
+        [FAILED] * 16,
+    )
+    assert all(rec.delivered == 0 for rec in pin.records())
+    assert pin.replace(0).termination == T.COMPLETE
+
+
+# ---------------------------------------------------------------- zero offers (E)
+
+
+def test_zero_and_masked():
+    # Zero offers and an Eligibility that excludes every edge.
+    g = twoh(0, 0)
+    for adm in (LOSSY, LOSSLESS):
+        p = policy(g, [0, 1], 2, 2, adm)
+        assert p.replace(0, design_demand=10).termination == T.COMPLETE
+        assert p.evaluate(0, design_demand=10).termination == T.COMPLETE
+        assert p.forward(0).termination == T.COMPLETE
+        r = p.replace(10, design_demand=10)
+        assert r.termination == (T.COMPLETE if adm == LOSSY else T.EXHAUSTED)
+        assert (r.program.tunnels, p.records()) == ((), [])
+    p = policy(twoh(1, 100), [0, 1], 2, 16, LOSSY)
+    assert (p.replace(0).termination, p.forward(0).termination) == (
+        T.COMPLETE,
+        T.COMPLETE,
+    )
+    assert source_rows(p.forward(10)) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 0, 5, 0)]
+    for adm in (LOSSY, LOSSLESS):
+        p = policy(one10(), 0, 1, 2, adm)
+        r = p.replace(0)
+        assert (r.termination, [t.planned_bandwidth for t in r.program.tunnels]) == (
+            T.COMPLETE,
+            [1, 1],
+        )
+        assert [(rec.entry_id, rec.delivered) for rec in p.records()] == [
+            (0, 0),
+            (1, 0),
+        ]
+        ids = [rec.flow_id for rec in p.records()]
+        e = p.evaluate(0)
+        assert (
+            e.termination == T.COMPLETE and [rec.flow_id for rec in p.records()] == ids
+        )
+        f = p.forward(0)
+        assert (f.termination, f.routes_changed, f.weights_changed) == (
+            T.COMPLETE,
+            False,
+            False,
+        )
+        assert len(p.records()) == 2 and [rec.flow_id for rec in p.records()] != ids
+    g = twoh(10, 10)
+    none = g.eligibility(excluded_edges=[0, 1])
+    q = ngc.EvaluationOptions(t2_config(2), eligibility=none)
+    r = ngc.evaluate_demand(g, [0, 1], 2, q)
+    assert (r.termination, r.call_delivered) == (T.NO_ROUTE, 0)
+    assert [
+        x.termination for x in ngc.evaluate_pairs(g, [([0, 1], [2]), ([0], [2])], q)
+    ] == [T.NO_ROUTE] * 2
+
+
+# ---------------------------------------------------------------- evaluators (Q)
+
+
+def test_capacity():
+    # The design rule of capacity, nothing shared between pairs, a zero offered.
+    g = graph(G1)
+    hr16 = t2_config(16, headroom=True)
+    assert (
+        ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(hr16)).call_delivered
+        == 46812
+    )
+    assert (
+        ngc.evaluate_demand(
+            g, 0, 3, ngc.EvaluationOptions(hr16, design_demand=8192)
+        ).call_delivered
+        == 46812
+    )
+    ly = t2_config(16, LOSSY, headroom=True)
+    assert (
+        ngc.evaluate_demand(
+            g, 0, 3, ngc.EvaluationOptions(ly, design_demand=49152)
+        ).call_delivered
+        == 47104
+    )
+    assert (
+        ngc.evaluate_demand(
+            g, 0, 3, ngc.EvaluationOptions(ly, offer=49152)
+        ).call_delivered
+        == 47104
+    )
+    with pytest.raises(
+        ValueError,
+        match=exact("CentralizedTE LOSSY evaluation requires a finite offer"),
+    ):
+        ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(ly))
+    with pytest.raises(
+        ValueError,
+        match=exact("CentralizedTE LOSSY evaluation requires a finite offer"),
+    ):
+        ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(ly, design_demand=INF))
+    # Lossless with a finite offer and no design: the design is the offer, delivered up to it.
+    r5 = ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(hr16, offer=5))
+    assert (r5.call_delivered, r5.plan.design_demand) == (5, 5)
+    with pytest.raises(
+        ValueError,
+        match=exact("design_demand must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(hr16, design_demand=-1))
+    r = ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(ly, offer=0))
+    assert (r.termination, r.call_delivered) == (T.COMPLETE, 0)
+    one = one10()
+    got = ngc.evaluate_pairs(
+        one, [([0], [1]), ([0], [1])], ngc.EvaluationOptions(t2_config(2))
+    )
+    assert [x.call_delivered for x in got] == [10, 10]
+
+
+@pytest.mark.parametrize("offered", [None, INF, 0, 7])
+@pytest.mark.parametrize("design", [None, 0, 4, INF])
+def test_lossy_offer_rule(design, offered):
+    # T2 LOSSY's offer rule in all three evaluators: a finite offer is used as given, an
+    # absent one is the design if finite, an explicit inf is an error whatever the design (the
+    # offer's domain, checked first). One link of 10, N = 2: both tunnels share the link,
+    # delivery min(offer, 10).
+    g = one10()
+    q = ngc.EvaluationOptions(t2_config(2, LOSSY), design_demand=design, offer=offered)
+    if offered is None:
+        want = design if design is not None and design != INF else None
+    else:
+        want = None if offered == INF else offered
+    if want is None:
+        text = (
+            "offer must be an integer in [0, 2^62)"
+            if offered == INF
+            else "CentralizedTE LOSSY evaluation requires a finite offer"
+        )
+        for call in (
+            lambda: ngc.evaluate_demand(g, 0, 1, q),
+            lambda: ngc.evaluate_pairs(g, [([0], [1]), ([0], [1])], q, workers=2),
+            lambda: ngc.evaluate_edge_failures(g, 0, 1, q, workers=2),
+        ):
+            with pytest.raises(ValueError, match=exact(text)):
+                call()
+        return
+    assert ngc.evaluate_demand(g, 0, 1, q).call_delivered == want
+    got = ngc.evaluate_pairs(g, [([0], [1]), ([0], [1])], q, workers=2)
+    assert [r.call_delivered for r in got] == [want, want]
+    assert (
+        ngc.evaluate_edge_failures(g, 0, 1, q, workers=2).baseline.call_delivered
+        == want
+    )
+
+
+def test_edge_failures():
+    # Every allowed link is a candidate; deleting head 0's zero link
+    # removes it from the roster (a negative loss).
+    g = twoh(0, 10)
+    s = ngc.evaluate_edge_failures(
+        g, [0, 1], 2, ngc.EvaluationOptions(t2_config(2), design_demand=10)
+    )
+    assert (
+        s.baseline.call_delivered,
+        [(e.edge, e.delivery_reduction) for e in s.entries],
+    ) == (
+        0,
+        [(0, -10), (1, 0)],
+    )
+    g = graph([(0, 1, 10, 1), (2, 1, 5, 1)])  # edge 1 lies on no route of source 0
+    s = ngc.evaluate_edge_failures(g, 0, 1, ngc.EvaluationOptions(t2_config(2)))
+    assert [(e.edge, e.delivery_reduction) for e in s.entries] == [(0, 10), (1, 0)]
+    s = ngc.evaluate_edge_failures(
+        g, 0, 1, ngc.EvaluationOptions(t2_config(2, LOSSY), offer=0)
+    )
+    assert [e.delivery_reduction for e in s.entries] == [0, 0]
+
+
+# ---------------------------------------------------------------- numeric ranges (W)
+
+
+def test_ranges():
+    # The numeric ranges: a route cost above 2^64, the largest sizes and budgets.
+    wide = graph([(0, 1, 16, 2**61 + 1)])
+    assert (
+        policy(wide, 0, 1, 16).replace(INF, design_demand=16).plan.total_tunnel_cost
+        == 36893488147419103248
+    )
+    onemax = graph([(0, 1, L62 - 1, 1)])
+    r = policy(onemax, 0, 1, 1, headroom=True).replace(INF)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.planned_bandwidth_per_tunnel,
+        r.plan.total_planned_bandwidth,
+    ) == (
+        L62 - 1,
+        L62 - 1,
+        L62 - 1,
+    )
+    assert (r.plan.headroom_penalty, r.plan.max_lossless_offer, r.call_delivered) == (
+        2**32,
+        L62 - 1,
+        L62 - 1,
+    )
+    fan = graph([(h, 4, 2**60 - 1, 1) for h in range(4)])
+    r = policy(fan, [0, 1, 2, 3], 4, 16).replace(INF)
+    assert (
+        r.plan.max_bandwidth_per_tunnel,
+        r.plan.total_planned_bandwidth,
+        r.plan.max_lossless_offer,
+    ) == (
+        2**56 - 1,
+        L62 - 64,
+        L62 - 4,
+    )
+    dead = graph([(h, 101, 0, 1) for h in range(100)] + [(100, 101, 2**61, 1)])
+    r = policy(dead, list(range(101)), 101, 2, up_to=True).replace(INF)
+    assert (
+        r.plan.tunnels_per_head,
+        r.plan.max_lossless_offer,
+        r.plan.heads_with_capacity,
+    ) == (1, 0, (100,))
+    r = policy(dead, list(range(101)), 101, 1, LOSSY).replace(101)
+    assert (r.call_delivered, r.call_source_drops) == (1, 100)
+    costmax = graph([(0, 1, 10000, L62 - 1)])
+    r = policy(costmax, 0, 1, 10000, headroom=True).replace(INF, design_demand=10000)
+    assert (r.plan.max_bandwidth_per_tunnel, r.plan.planned_bandwidth_per_tunnel) == (
+        1,
+        1,
+    )
+    assert r.plan.total_tunnel_cost == 10000 * (L62 - 1) == 46116860184273879030000
+    assert (
+        r.plan.headroom_penalty
+        == sum(2**32 * j // 10000 for j in range(1, 10001))
+        == 21476983958656
+    )
+
+
+# ---------------------------------------------------------------- the property test
+
+
+def _random_case(rng):
+    """A small random graph with a route from 0 to the last node: rows (u, v, capacity, cost)."""
+    n = rng.randint(3, 5)
+    raw = [
+        (i, i + 1, rng.choice([0, 2, 4, 6, 8]), rng.randint(1, 4)) for i in range(n - 1)
+    ]
+    for _ in range(rng.randint(1, 5)):
+        u, v = rng.randrange(n - 1), rng.randrange(1, n)
+        if u != v:
+            raw.append((u, v, rng.choice([0, 1, 2, 3, 4, 6, 8]), rng.randint(1, 4)))
+    rng.shuffle(raw)
+    return n, raw
+
+
+def test_property():
+    rng = random.Random(20261019)
+    laid = optimal = bounds = lossy_cmp = upto = live_all = 0
+    for trial in range(300):
+        n, rows_ = _random_case(rng)
+        g = build(n, rows_)
+        edges = [rows_[int(i)] for i in g.input_positions()]
+        sources = sorted(rng.sample(range(n - 1), rng.randint(1, min(2, n - 1))))
+        dests = [n - 1]
+        mask = eligibility = None
+        if rng.random() < 0.3:
+            xe = [rng.randrange(len(rows_))]
+            mask, eligibility = ([], xe), g.eligibility(excluded_edges=xe)
+        caps = [c for _, _, c, _ in edges]
+        free = [rng.randint(0, c) for c in caps] if rng.random() < 0.4 else list(caps)
+        hr = rng.random() < 0.5
+        N = rng.randint(1, 3)
+        up = rng.random() < 0.3
+        D = rng.choice([None, rng.randint(0, 14)])
+        fg = ngc.FlowLedger(g, free)
+        p = ngc.FlowPolicy(
+            fg, sources, dests, t2_config(N, headroom=hr, up_to=up), eligibility
+        )
+        r = p.replace(INF, design_demand=INF if D is None else D)
+        want = orc.t2(
+            edges, sources, dests, N, D, up_to=up, V=free, mask=mask, headroom=hr
+        )
+        where = (trial, rows_, sources, free, N, up, D, hr, mask)
+        pl = r.plan
+        assert (
+            pl.tunnels_per_head,
+            list(pl.heads_with_capacity),
+            pl.max_bandwidth_per_tunnel,
+            pl.max_fractional_bandwidth_per_tunnel,
+        ) == (
+            want.count,
+            want.live,
+            want.U,
+            want.fluid,
+        ), where
+        assert (pl.planned_bandwidth_per_tunnel, pl.insufficient_resolution) == (
+            want.u,
+            want.insufficient,
+        ), where
+        got = [(t.entry_id, t.head, list(t.edges)) for t in r.program.tunnels]
+        assert got == [(t.index, t.head, t.path) for t in want.tunnels], where
+        assert (pl.total_tunnel_cost, pl.headroom_penalty if hr else 0) == (
+            want.J,
+            want.phi,
+        ), where
+        assert pl.max_lossless_offer == want.F == r.call_delivered, where
+        laid += 1
+        if want.U:
+            # U maximal: U + 1 does not fit; J then Phi minimal over every count vector at u.
+            ok = orc.allowed(edges, mask)
+            k = want.count
+            assert not orc.t2_fits(
+                edges, ok, want.roster, want.live, dests, k, Fraction(want.U + 1), free
+            ), where
+            best = orc.t2_best_objectives(
+                edges, ok, want.live, dests, k, want.u, free, hr
+            )
+            assert (want.J, want.phi) == best, where
+            optimal += 1
+            K = len(want.live) * k
+            if want.u == want.U and want.live == want.roster:
+                # The remainder bound 0 <= F - K U < K.
+                assert 0 <= want.F - K * want.U < K, where
+                bounds += 1
+        if up:
+            upto += 1
+        if want.live and want.live == want.roster:
+            live_all += 1
+        # Lossy: the oracle's loss rule, conservation, the layout independent of the offer.
+        offer = rng.randint(0, 14)
+        lp = ngc.FlowPolicy(
+            ngc.FlowLedger(g, free),
+            sources,
+            dests,
+            t2_config(N, LOSSY, hr, up),
+            eligibility,
+        )
+        lr = lp.replace(offer, design_demand=INF if D is None else D)
+        assert [(t.entry_id, list(t.edges)) for t in lr.program.tunnels] == [
+            (a, c) for a, _, c in got
+        ], where
+        assert (
+            lr.offered
+            == lr.source_drops + sum(x for _, x in lr.edge_drops) + lr.delivered
+        ), where
+        if want.roster:
+            try:
+                delivered, lost, per, _ = orc.lossy(
+                    edges, want.roster, want.tunnels, offer, free
+                )
+            except AssertionError:
+                continue
+            assert (lr.call_delivered, lr.call_source_drops) == (delivered, lost), where
+            assert [
+                (t.assigned, t.delivered, t.total_edge_drops) for t in lr.by_tunnel
+            ] == per, where
+            lossy_cmp += 1
+    assert (
+        laid > 250
+        and optimal > 120
+        and bounds > 40
+        and lossy_cmp > 150
+        and upto > 50
+        and live_all > 100
+    ), (
+        laid,
+        optimal,
+        bounds,
+        lossy_cmp,
+        upto,
+        live_all,
+    )
+
+
+# ---------------------------------------------------------------- Python allocation failures
+
+
+@needs_hooks
+@pytest.mark.parametrize("method", ["replace", "evaluate", "forward"])
+def test_t2_results_survive_python_allocation_failures(method):
+    # Every Python object of a T2 result (the plan, its fields, the tunnels) exists before anything
+    # is published. Positional calls, as for T1 (the module docstring's limit 1).
+    g = graph(G1)
+
+    def make():
+        fg = ngc.FlowLedger(g)
+        p = ngc.FlowPolicy(fg, 0, 3, t2_config(4, LOSSY, True))
+        p.replace(4096)
+
+        def snapshot():
+            return [full_ledger_state(fg), repr(p._state())]
+
+        return getattr(p, method), (8192,), snapshot
+
+    assert (
+        sweep_python_allocation(make) >= 1
+    )  # the result object at least (its fields convert when read)
+
+
+GETTER_SWEEP = """
+import _netgraph_core as ext, netgraph_core as ngc
+g = ngc.Graph(4, [0, 0, 1, 2], [1, 2, 3, 3], [8192, 40960, 8192, 40960], [1, 1, 1, 1], 1.0)
+cfg = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL,
+                                                     tunnel_count=ngc.TunnelCount(4), prefer_headroom=True),
+                           admission=ngc.Admission.LOSSY)
+p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg)
+r = p.replace(4096)
+gl = ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL, tunnel_count=ngc.TunnelCount(4))
+fn = lambda: {getter}
+expected = repr(fn())  # the getter reads its value first: a missing name fails here
+for k in range(400):
+    hit, seen, value, error = ext._fail_python_allocation(fn, (), k)
+    if not hit:
+        assert error is None and repr(value) == expected, (k, error, value)
+        break
+    assert value is None and type(error) is MemoryError, (k, error)
+else:
+    raise SystemExit("never completed")
+print("failures", k)
+"""
+
+
+@needs_hooks
+@pytest.mark.parametrize(
+    "getter",
+    [
+        "r.plan",
+        "r.plan.max_fractional_bandwidth_per_tunnel",
+        "r.plan.heads_with_capacity",
+        "r.plan.total_tunnel_cost",
+        "r.plan.headroom_penalty",
+        "r.program.tunnels",
+        "gl.tunnel_count",
+        # A repr is called on the type: repr() on Python 3.13 and older returns the default repr
+        # when its method lookup fails.
+        "type(r).__repr__(r)",
+    ],
+)
+def test_t2_getters_survive_python_allocation_failures(getter):
+    import subprocess
+    import sys
+
+    done = subprocess.run(
+        [sys.executable, "-c", GETTER_SWEEP.format(getter=getter)],
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    assert done.returncode == 0, (getter, done.returncode, done.stderr[-400:])
+    assert int(done.stdout.split()[-1]) >= 1
diff --git a/tests/py/test_concurrency.py b/tests/py/test_concurrency.py
new file mode 100644
index 0000000..ff6405b
--- /dev/null
+++ b/tests/py/test_concurrency.py
@@ -0,0 +1,1108 @@
+"""Native progress, exclusion, publication and lease witnesses, with parent deadlines."""
+
+import sysconfig
+
+import pytest
+from concurrency_support import run_python
+from private_hooks import needs_hooks
+
+pytestmark = needs_hooks
+GIL_ONLY = pytest.mark.skipif(
+    bool(sysconfig.get_config_var("Py_GIL_DISABLED")), reason="GIL-proof-only"
+)
+SETUP = """
+network = graph()
+ledger = ngc.FlowLedger(network)
+p = policy(ledger)
+Probe = new_probe
+"""
+
+
+def run(source):
+    run_python(SETUP + source)
+
+
+def test_conversions_run_before_native_locks():
+    run("""
+class Index:
+    def __index__(self):
+        assert ledger.residual().tolist() == [10]
+        assert p.program is None
+        return 3
+probe = Probe()
+r = probe.run(p.place, Index())
+assert r.delivered == 3
+before = probe.counts()
+with pytest.raises(ValueError, match='offer must be'):
+    probe.run(p.forward, -1)
+assert probe.counts() == before
+q = policy(ledger)
+cache = ngc.ShortestPathCache(network)
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache)
+invalid = {
+    'scalar': lambda: p.replace(-1),
+    'list': lambda: ngc.apply_actions(ledger, [ngc.Forward(p, 1), ngc.Replace(q, -1)]),
+    'reset': lambda: ledger.reset([-1]),
+    'demand': lambda: ngc.evaluate_demand(network, [], 1, options),
+    'pairs': lambda: ngc.evaluate_pairs(network, [([], 1)], options, workers=2),
+    'edge_failures': lambda: ngc.evaluate_edge_failures(network, [], 1, options, workers=2),
+    'graph': lambda: ngc.Graph(2, [0], [1], [1], [0], 1.0),
+    'mask': lambda: network.eligibility(excluded_edges=[99]),
+    'path': lambda: ngc.Path(network, []),
+    'dag': lambda: ngc.PredecessorDAG.from_csr(network, [0,1,1], [1], [0]),
+    'program': lambda: ngc.ForwardingProgram.from_routes(network, [], 1, []),
+    'spf': lambda: ngc.spf(network, [], ngc.SpfOptions(ngc.Direction.FORWARD)),
+    'to_units': lambda: ngc.to_units([float('nan')], 1.0),
+    'as_float': lambda: ngc.as_float([0.5], 1.0),
+}
+for name, call in invalid.items():
+    failure = Probe()
+    with pytest.raises((TypeError, ValueError)):
+        failure.run(call)
+    assert all(value == 0 for value in failure.counts().values()), (name, failure.counts())
+assert ledger.carried().tolist() == [3] and cache.stats().entries == 0
+# Every immutable entry check precedes native construction, for Path and DAG.
+from helpers import dag_of
+chain = ngc.Graph(4, [0,1,2], [1,2,3], [10]*3, [1]*3, 1.0)
+foreign = ngc.Graph(4, [0,1,2], [1,2,3], [10]*3, [1]*3, 1.0)
+whole = ngc.Path(chain, [[0],[1],[2]])
+split = ngc.Graph(3, [0,0], [1,1], [10,10], [1,1], 1.0)
+cases = [
+    (chain, 0, 3, ngc.RouteDefinition(0, ngc.Path(foreign, [[0]])), 'route belongs to another graph'),
+    (chain, 0, 3, ngc.RouteDefinition(1, whole), 'head 1 is not a source'),
+    (chain, 0, 3, ngc.RouteDefinition(0, ngc.Path(chain, [[1],[2]])), 'the path starts at 1, not at head 0'),
+    (chain, 0, 3, ngc.RouteDefinition(0, ngc.Path(chain, [[0]])), 'the path ends at 1, not at a destination'),
+    (chain, 0, [1,3], ngc.RouteDefinition(0, whole), 'the path meets destination 1 before its end'),
+    (split, 0, 1, ngc.RouteDefinition(0, ngc.Path(split, [[0,1]])), 'a tunnel has one edge per hop'),
+    (chain, 0, 3, ngc.RouteDefinition(0, whole, weight=-1), 'weight must be an integer in [0, 2^62)'),
+    (chain, 0, 3, ngc.RouteDefinition(0, dag_of(foreign, [0,1,2])), 'route belongs to another graph'),
+    (chain, 0, 3, ngc.RouteDefinition(1, dag_of(chain, [0,1,2])), 'head 1 is not a source'),
+    (chain, 0, 3, ngc.RouteDefinition(0, dag_of(chain, [1,2])), 'no walk from head 0 to a destination'),
+    (chain, 0, 3, ngc.RouteDefinition(0, dag_of(chain, [0,1,2]), weight=-1), 'weight must be an integer in [0, 2^62)'),
+]
+for route_graph, sources, destinations, route, error in cases:
+    probe = Probe()
+    with pytest.raises(ValueError) as caught:
+        probe.run(ngc.ForwardingProgram.from_routes, route_graph, sources, destinations, [route])
+    assert str(caught.value) == 'routes[0]: ' + error
+    assert probe.counts()['native_begin'] == 0, (error, probe.counts())
+for route in (whole, dag_of(chain, [0,1,2])):
+    probe = Probe()
+    result = probe.run(ngc.ForwardingProgram.from_routes, chain, 0, 3, [ngc.RouteDefinition(0, route)])
+    assert result.sources == (0,) and result.destinations == (3,)
+    assert probe.counts()['native_begin'] == probe.counts()['native_complete'] == 1
+    assert probe.counts()['route_definition_check'] == 1, probe.counts()
+    assert probe.counts()['route_walk'] == (0 if isinstance(route, ngc.Path) else 1), probe.counts()
+# The DAG's walk/refusal precedes its weight, and all of route 0 precedes route 1.
+for routes, error in [
+    ([ngc.RouteDefinition(0, dag_of(chain, [1,2]), weight=-1)], 'routes[0]: no walk from head 0 to a destination'),
+    ([ngc.RouteDefinition(0, dag_of(chain, [0,1,2]), weight=-1), ngc.RouteDefinition(1, whole)], 'routes[0]: weight must be an integer in [0, 2^62)'),
+]:
+    probe = Probe()
+    with pytest.raises(ValueError) as caught:
+        probe.run(ngc.ForwardingProgram.from_routes, chain, 0, 3, routes)
+    assert str(caught.value) == error
+    assert probe.counts()['native_begin'] == 0
+""")
+
+
+def test_initializing_policy_is_not_exposed():
+    run("""
+candidate = ngc.FlowPolicy.__new__(ngc.FlowPolicy)
+config = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+holder = Probe(pause='ledger_acquired')
+task = start(lambda: candidate.__init__(ledger, 0, 1, config), holder)
+assert holder.wait('ledger_acquired')
+for read in (lambda: candidate.program, lambda: candidate.config,
+             candidate.delivered, candidate.records, lambda: candidate.place(1),
+             lambda: ngc.Place(candidate, 1)):
+    with pytest.raises(TypeError, match='FlowPolicy is not constructed'):
+        read()
+holder.release()
+finish(task)
+assert candidate.place(3).delivered == 3
+""")
+
+
+def test_inputs_are_copied_before_native_work():
+    run(
+        """
+service = np.array([7], dtype=np.int64)
+probe = Probe(pause='native_begin')
+task = start(lambda: ledger.reset(service), probe)
+assert probe.wait('native_begin')
+service[0] = 1
+probe.release()
+finish(task)
+assert ledger.residual().tolist() == [7]
+""".replace("task = start", "del p\ntask = start")
+    )
+
+
+def test_options_snapshot_at_entry():
+    run("""
+options = ngc.OutputOptions(residual=True, edge_flows=True)
+probe = Probe(pause='ledger_acquired')
+task = start(lambda: p.place(3, options), probe)
+assert probe.wait('ledger_acquired')
+with pytest.raises(AttributeError):
+    options.residual = False
+probe.release()
+r = finish(task)
+assert r.residual.tolist() == [7] and r.edge_flows.tolist() == [3]
+""")
+
+
+@GIL_ONLY
+def test_native_phase_allows_heartbeat():
+    run("""
+assert getattr(sys, "_is_gil_enabled", lambda: True)()
+sys.setswitchinterval(0.000001)
+network = ngc.Graph(2, [0]*3000, [1]*3000, [1000]*3000, [1]*3000, 1.0)
+ledger = ngc.FlowLedger(network)
+p = policy(ledger)
+p.replace(1)
+probe = Probe()
+wcfg = ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.WEIGHTED, source_weights=[2,0]))
+weighted_policy = ngc.FlowPolicy(ngc.FlowLedger(network),0,1,wcfg)
+operations = [lambda: p.place(1), lambda: p.evaluate(3), lambda: p.replace(3),
+              lambda: p.forward(3), lambda: ngc.apply_actions(ledger, [ngc.Replace(p, 3)]), lambda: weighted_policy.place(1)]
+observations = {}
+for name, operation in zip(('place', 'evaluate', 'replace', 'forward', 'ordered_list', 'weighted_place'), operations, strict=True):
+    overlaps = 0
+    for _ in range(50):
+        task = start(lambda: [operation() for _ in range(60)], probe)
+        while task[0].is_alive():
+            counts = probe.counts()
+            if counts['native_begin'] > counts['native_complete']:
+                # A snapshot can become stale while counts() reacquires the GIL.
+                second = probe.counts()
+                overlaps += (counts['native_begin'], counts['native_complete']) == (second['native_begin'], second['native_complete'])
+        finish(task)
+        if overlaps:
+            break
+    observations[name] = overlaps
+
+# Each lock-wait entry has a finite native pause, so a retained-GIL plant
+# terminates with zero overlap rather than stranding the Python controller.
+def active_pause(probe):
+    first = probe.counts()
+    if first['pause_begin'] <= first['pause_end']:
+        return None
+    # counts() snapshots while detached. Returning here proves Python ran;
+    # the fresh snapshot must still identify the same unfinished pause.
+    second = probe.counts()
+    if (first['pause_begin'], first['pause_end']) == (second['pause_begin'], second['pause_end']):
+        return second
+    return None
+network = graph()
+bare = ngc.FlowLedger(network)
+active_ledger = ngc.FlowLedger(network)
+owner = policy(active_ledger)
+owner.replace(3)
+record_id = owner.records()[0].flow_id
+cache = ngc.ShortestPathCache(network)
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache, offer=3)
+held = [policy(ngc.FlowLedger(network))]
+def destroy():
+    held.clear()
+cases = [
+    ('uid', bare.uid, 'ledger_acquired'),
+    ('graph_read', bare.graph, 'ledger_acquired'),
+    ('capacities', bare.edge_capacity_units, 'ledger_acquired'),
+    ('residual', bare.residual, 'ledger_acquired'),
+    ('carried', bare.carried, 'ledger_acquired'),
+    ('reserved', bare.reserved, 'ledger_acquired'),
+    ('unreserved', bare.unreserved, 'ledger_acquired'),
+    ('ledger_records', bare.records, 'ledger_acquired'),
+    ('ledger_record', lambda: active_ledger.record(record_id), 'ledger_acquired'),
+    ('saturated_boundary', lambda: bare.saturated_boundary_edges(0), 'ledger_acquired'),
+    ('reset', bare.reset, 'ledger_acquired'),
+    ('copy', bare.copy, 'ledger_acquired'),
+    ('program_read', lambda: owner.program, 'ledger_acquired'),
+    ('delivered_read', owner.delivered, 'ledger_acquired'),
+    ('policy_records', owner.records, 'ledger_acquired'),
+    ('policy_record', lambda: owner.record(record_id), 'ledger_acquired'),
+    ('construction', lambda: policy(bare), 'ledger_acquired'),
+    ('remove', owner.remove, 'ledger_acquired'),
+    ('destruction', destroy, 'ledger_acquired'),
+    ('freeze', cache.freeze, 'cache_acquired'),
+    ('thaw', cache.thaw, 'cache_acquired'),
+    ('clear', cache.clear, 'cache_acquired'),
+    ('evaluate_demand', lambda: ngc.evaluate_demand(network, 0, 1, options), 'cache_acquired'),
+    ('evaluate_pairs', lambda: ngc.evaluate_pairs(network, [(0, 1)], options, workers=1), 'cache_acquired'),
+    ('evaluate_failures', lambda: ngc.evaluate_edge_failures(network, 0, 1, options, 1), 'cache_acquired'),
+]
+for name, operation, stage in cases:
+    probe = Probe(pause=stage, auto_release_ms=200)
+    task = start(operation, probe)
+    overlap = 0
+    while task[0].is_alive():
+        overlap += active_pause(probe) is not None
+    finish(task)
+    observations[name] = overlap
+assert all(value > 0 for value in observations.values()), observations
+# Tunnel-limit preflight grows with the grid and runs before any lease or gate.
+# The bounded native pause makes a retained-GIL mistake fail by assertion.
+side = 80
+us, vs = [], []
+for u in range(side*side):
+    if u % side + 1 < side: us.append(u); vs.append(u+1)
+    if u + side < side*side: us.append(u); vs.append(u+side)
+grid = ngc.Graph(side*side, us, vs, [10]*len(us), [1]*len(us), 1.0)
+pairs = [(i, side*side-1) for i in range(64)]
+for routing in (ngc.DistributedTE(ngc.TunnelCount(1)), ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL, tunnel_count=ngc.TunnelCount(1))):
+    options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=routing), design_demand=1, offer=1)
+    probe = Probe(pause='tunnel_roster_search', auto_release_ms=200)
+    task = start(lambda: ngc.evaluate_pairs(grid, pairs, options, workers=4), probe)
+    overlap = 0
+    while task[0].is_alive():
+        counts = active_pause(probe)
+        if counts is not None:
+            assert counts['native_begin'] == counts['ledger_wait'] == counts['cache_queued'] == 0
+            overlap += 1
+    results = finish(task)
+    assert overlap > 0, 'tunnel preflight held the GIL'
+    assert len(results) == len(pairs) and all(r.delivered == 1 for r in results)
+    assert probe.counts()['tunnel_roster_search'] == len(pairs), probe.counts()
+    # The constructor's first pass follows the same detached-search rule.
+    tunnel_ledger = ngc.FlowLedger(grid)
+    constructor = Probe(pause='tunnel_roster_search', auto_release_ms=200)
+    task = start(lambda: ngc.FlowPolicy(tunnel_ledger, 0, side*side-1,
+                                      ngc.FlowPolicyConfig(routing=routing)), constructor)
+    overlap = 0
+    while task[0].is_alive():
+        counts = active_pause(constructor)
+        if counts is not None:
+            assert counts['native_begin'] == counts['ledger_wait'] == counts['cache_queued'] == 0
+            overlap += 1
+    constructed = finish(task)
+    assert overlap > 0, 'constructor tunnel preflight held the GIL'
+    assert constructor.counts()['tunnel_roster_search'] == 1
+    assert constructed.replace(1, design_demand=1).delivered == 1
+    small = ngc.Graph(4, [0,1,2], [1,2,3], [10]*3, [1]*3, 1.0)
+    for name, call, searches in (
+        ('demand', lambda: ngc.evaluate_demand(small, 0, 3, options), 1),
+        ('edge_failures', lambda: ngc.evaluate_edge_failures(small, 0, 3, options, 2), 4),
+    ):
+        preflight = Probe(pause='tunnel_roster_search', auto_release_ms=200)
+        task = start(call, preflight)
+        overlap = 0
+        while task[0].is_alive():
+            counts = active_pause(preflight)
+            if counts is not None:
+                assert counts['native_begin'] == counts['ledger_wait'] == counts['cache_queued'] == 0
+                overlap += 1
+        result = finish(task)
+        assert overlap > 0, (name, 'tunnel preflight held the GIL')
+        assert preflight.counts()['tunnel_roster_search'] == searches
+        if name == 'demand':
+            assert result.delivered == 1
+        else:
+            assert result.baseline.delivered == 1
+            assert [(e.edge, e.delivery_reduction) for e in result.entries] == [(0,1), (1,1), (2,1)]
+# Supplied-DAG preparation is the first pass's graph walk, before construction.
+from helpers import dag_of
+supplied = dag_of(grid, range(grid.num_edges()))
+probe = Probe(pause='route_walk', auto_release_ms=200)
+task = start(lambda: ngc.ForwardingProgram.from_routes(grid, 0, side*side-1,
+                    [ngc.RouteDefinition(0, supplied)]), probe)
+overlap = 0
+while task[0].is_alive():
+    counts = active_pause(probe)
+    if counts is not None:
+        assert counts['native_begin'] == counts['ledger_wait'] == counts['cache_queued'] == 0
+        overlap += 1
+program = finish(task)
+assert overlap > 0, 'supplied route first-pass walk held the GIL'
+assert program.sources == (0,) and program.destinations == (side*side-1,)
+assert probe.counts()['route_walk'] == probe.counts()['route_definition_check'] == 1
+""")
+
+
+def test_cache_before_gate_order():
+    run("""
+cache = ngc.ShortestPathCache(network)
+holder = Probe(pause='ledger_acquired')
+a = start(lambda: p.place(2), holder)
+assert holder.wait('ledger_acquired')
+constructor = Probe()
+b = start(lambda: policy(ledger, cache=cache), constructor)
+assert constructor.wait('cache_acquired')
+assert constructor.wait('ledger_wait')
+early = constructor.wait('ledger_acquired', seconds=0.1)
+try:
+    if early:
+        q = finish(b)
+finally:
+    holder.release()
+assert finish(a).delivered == 2
+if not early:
+    q = finish(b)
+assert not early, 'construction bypassed the ledger gate'
+assert q.place(2).delivered == 2
+""")
+
+
+def test_cached_policies_ignore_busy_original_cache():
+    run("""
+cache = ngc.ShortestPathCache(network)
+q = policy(ledger, cache=cache)
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache, offer=2)
+holder = Probe(pause='cache_acquired')
+a = start(lambda: ngc.evaluate_demand(network, 0, 1, options), holder)
+assert holder.wait('cache_acquired')
+assert q.place(2).delivered == 2
+assert ngc.apply_actions(ledger, [ngc.Replace(q, 3)])[0].delivered == 3
+holder.release()
+assert finish(a).delivered == 2
+""")
+
+
+def test_record_and_workers_do_not_deadlock():
+    run("""
+p.place(3)
+record = p.records()[0]
+assert p.record(record.flow_id).delivered == ledger.record(record.flow_id).delivered == 3
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), offer=4)
+assert [r.delivered for r in ngc.evaluate_pairs(network, [(0, 1)]*8, options, workers=4)] == [4]*8
+assert ngc.evaluate_edge_failures(network, 0, 1, options, 3).entries[0].delivery_reduction == 4
+""")
+
+
+def test_same_ledger_calls_serialize():
+    run("""
+holder, waiter = Probe(pause='ledger_acquired'), Probe()
+a = start(lambda: p.place(2), holder)
+assert holder.wait('ledger_acquired')
+b = start(lambda: p.place(3), waiter)
+assert waiter.wait('ledger_wait')
+assert waiter.counts()['ledger_acquired'] == 0
+holder.release()
+assert finish(a).delivered == 2
+assert finish(b).delivered == 5
+assert ledger.carried().tolist() == [5]
+""")
+
+
+def test_every_ledger_reader_waits_without_gil():
+    run("""
+p.place(1)
+flow_id = p.records()[0].flow_id
+readers = [ledger.uid, ledger.graph, ledger.edge_capacity_units, ledger.residual,
+           ledger.carried, ledger.reserved, ledger.unreserved, ledger.records,
+           lambda: ledger.record(flow_id), lambda: ledger.saturated_boundary_edges([0]),
+           p.delivered, p.records, lambda: p.record(flow_id), lambda: p.program,
+           ledger.copy, lambda: ledger.reset(), p.remove]
+early = []
+for index, read in enumerate(readers):
+    holder, waiter = Probe(pause='ledger_acquired'), Probe()
+    a = start(lambda: p.place(0), holder)
+    assert holder.wait('ledger_acquired')
+    b = start(read, waiter)
+    assert waiter.wait('ledger_wait')
+    if waiter.wait('ledger_acquired', seconds=0.1):
+        early.append(index)
+        print('CHILD: reader', index, 'did not wait', flush=True)
+    holder.release()
+    finish(a)
+    if index in (14, 15):
+        with pytest.raises(ValueError, match='bound'):
+            finish(b)
+    else:
+        finish(b)
+assert early == [], early
+assert ledger.carried().tolist() == [0] and p.program is None
+""")
+
+
+def test_immutable_readers_do_not_wait():
+    run("""
+cache = ngc.ShortestPathCache(network)
+q = policy(ledger, cache=cache)
+result = q.place(2)
+holder = Probe(pause='ledger_acquired')
+a = start(lambda: q.place(0), holder)
+assert holder.wait('ledger_acquired')
+assert q.config.admission == ngc.Admission.LOSSLESS
+assert cache.graph_uid() == network.uid()
+assert cache.stats().entries == 1
+assert result.delivered == 2
+assert result.program.sources == (0,)
+assert network.edge_capacity_units().tolist() == [10]
+holder.release()
+finish(a)
+""")
+
+
+def test_two_ledgers_enter_together():
+    run("""
+other = policy(ngc.FlowLedger(network))
+left, right = Probe(pause='ledger_acquired'), Probe(pause='ledger_acquired')
+a = start(lambda: p.place(2), left)
+assert left.wait('ledger_acquired')
+b = start(lambda: other.place(3), right)
+assert right.wait('ledger_acquired')
+left.release()
+right.release()
+assert finish(a).delivered == 2
+assert finish(b).delivered == 3
+""")
+
+
+def test_full_calls_and_reads_serialize():
+    run("""
+p.replace(2)
+for operation, expected in zip((lambda: p.evaluate(4), lambda: p.replace(4), lambda: p.forward(4), p.remove), (2, 4, 4, 0)):
+    holder, waiter = Probe(pause='ledger_acquired'), Probe()
+    a = start(operation, holder)
+    assert holder.wait('ledger_acquired')
+    b = start(p.delivered, waiter)
+    assert waiter.wait('ledger_wait')
+    assert waiter.counts()['ledger_acquired'] == 0
+    holder.release()
+    finish(a)
+    assert finish(b) == expected
+""")
+
+
+def test_list_publication_is_atomic():
+    run("""
+for mode in (ngc.BatchMode.ORDERED, ngc.BatchMode.SIMULTANEOUS):
+    ledger = ngc.FlowLedger(network)
+    a, b = policy(ledger, lossy=True), policy(ledger, lossy=True)
+    holder, waiter = Probe(pause='after_exchange'), Probe()
+    writer = start(lambda: ngc.apply_actions(ledger, [ngc.Replace(a, 2), ngc.Replace(b, 3)], mode=mode), holder)
+    assert holder.wait('after_exchange')
+    reader = start(lambda: (a.program, b.program, ledger.records()), waiter)
+    assert waiter.wait('ledger_wait')
+    assert waiter.counts()['ledger_acquired'] == 0
+    holder.release()
+    assert [r.delivered for r in finish(writer)] == [2, 3]
+    pa, pb, records = finish(reader)
+    assert pa is not None and pb is not None
+    assert [r.delivered for r in records] == [2, 3]
+""")
+
+
+def test_reservations_and_program_are_atomic():
+    run("""
+q = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1))))
+holder, waiter = Probe(pause='after_exchange'), Probe()
+a = start(lambda: q.replace(4, design_demand=6), holder)
+assert holder.wait('after_exchange')
+b = start(lambda: (q.program, q.records(), ledger.reserved()), waiter)
+assert waiter.wait('ledger_wait')
+assert waiter.counts()['ledger_acquired'] == 0
+holder.release()
+r = finish(a)
+program, records, holds = finish(b)
+assert program is not None and r.plan.total_reserved_bandwidth == 6
+assert holds.tolist() == [6] and records[0].edge_reservations == [(0, 6)]
+""")
+
+
+CACHE_SETUP = """
+cache = ngc.ShortestPathCache(network)
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache, offer=2)
+ngc.evaluate_demand(network, 0, 1, options)
+"""
+
+
+def test_building_cache_serializes_native_calls():
+    run(
+        CACHE_SETUP
+        + """
+holder, waiter = Probe(pause='cache_acquired'), Probe()
+a = start(lambda: ngc.evaluate_demand(network, 0, 1, options), holder)
+assert holder.wait('cache_acquired')
+b = start(lambda: ngc.evaluate_demand(network, 0, 1, options), waiter)
+assert waiter.wait('cache_queued')
+early = waiter.wait('cache_acquired', seconds=0.1)
+try:
+    if early:
+        second = finish(b)
+finally:
+    holder.release()
+first = finish(a)
+if not early:
+    second = finish(b)
+assert first.delivered == second.delivered == 2
+assert not early, 'building calls shared a lease'
+"""
+    )
+
+
+def test_frozen_cache_allows_overlapping_calls():
+    run(
+        CACHE_SETUP
+        + """
+cache.freeze()
+left, right = Probe(pause='cache_acquired'), Probe(pause='cache_acquired')
+a = start(lambda: ngc.evaluate_demand(network, 0, 1, options), left)
+assert left.wait('cache_acquired')
+b = start(lambda: ngc.evaluate_demand(network, 0, 1, options), right)
+assert right.wait('cache_acquired')
+left.release()
+right.release()
+assert finish(a).delivered == finish(b).delivered == 2
+"""
+    )
+
+
+def test_cache_fifo_admission():
+    run(
+        CACHE_SETUP
+        + """
+for frozen in (False, True):
+    if frozen:
+        cache.freeze()
+    holder, writer, later = Probe(pause='cache_acquired'), Probe(pause='cache_acquired'), Probe()
+    a = start(lambda: ngc.evaluate_demand(network, 0, 1, options), holder)
+    assert holder.wait('cache_acquired')
+    b = start(cache.thaw, writer)
+    assert writer.wait('cache_queued')
+    c = start(lambda: ngc.evaluate_demand(network, 0, 1, options), later)
+    assert later.wait('cache_queued')
+    holder.release()
+    assert writer.wait('cache_acquired')
+    assert later.counts()['cache_acquired'] == 0
+    writer.release()
+    finish(a)
+    finish(b)
+    assert finish(c).delivered == 2
+"""
+    )
+
+
+def test_workers_borrow_outer_lease():
+    run(
+        CACHE_SETUP
+        + """
+cache.freeze()
+holder, lifecycle = Probe(pause='worker_begin'), Probe()
+a = start(lambda: ngc.evaluate_pairs(network, [(0, 1)]*6, options, workers=3), holder)
+assert holder.wait('worker_begin', count=3)
+b = start(cache.thaw, lifecycle)
+assert lifecycle.wait('cache_queued')
+holder.release()
+assert [r.delivered for r in finish(a)] == [2]*6
+finish(b)
+assert holder.counts()['cache_acquired'] == 1
+# With no supplied cache, each worker owns a building cache. Clearing it for
+# the next failure state must not enroll a public lifecycle lease either.
+network = ngc.Graph(3, [0,0,1,1], [1,1,2,2], [3]*4, [1]*4, 1.0)
+options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), offer=4)
+probe = Probe()
+result = probe.run(lambda: ngc.evaluate_edge_failures(network, 0, 2, options, workers=2))
+assert result.baseline.call_delivered == 4
+assert [entry.delivery_reduction for entry in result.entries] == [1]*4
+assert probe.counts()['cache_queued'] == 0 and probe.counts()['cache_acquired'] == 0
+"""
+    )
+
+
+def test_failed_waiter_unblocks_lifecycle():
+    run(
+        CACHE_SETUP
+        + """
+for point in ('cache_queued', 'cache_acquired', 'ledger_wait', 'ledger_acquired'):
+    failure = Probe(fail=point)
+    before = cache.stats().hits
+    with pytest.raises(RuntimeError, match='injected native failure'):
+        failure.run(lambda: policy(ledger, cache=cache))
+    cache.freeze()
+    cache.thaw()
+    assert ngc.evaluate_demand(network, 0, 1, options).delivered == 2
+"""
+    )
+
+
+def test_worker_validation_uses_leased_mode():
+    run(
+        CACHE_SETUP
+        + """
+holder, waiter = Probe(pause='cache_acquired'), Probe()
+a = start(cache.freeze, holder)
+assert holder.wait('cache_acquired')
+b = start(lambda: ngc.evaluate_pairs(network, [(0, 1)]*4, options, workers=2), waiter)
+assert waiter.wait('cache_queued')
+holder.release()
+finish(a)
+assert [r.delivered for r in finish(b)] == [2]*4
+cache.thaw()
+with pytest.raises(ValueError, match='supplied building'):
+    ngc.evaluate_pairs(network, [(0, 1)], options, workers=2)
+with pytest.raises(ValueError, match='sources'):
+    ngc.evaluate_pairs(network, [([], 1)], options, workers=2)
+"""
+    )
+
+
+def test_frozen_tally_finishes_before_lifecycle():
+    run(
+        CACHE_SETUP
+        + """
+cache.freeze()
+before = cache.stats().hits
+holder, lifecycle = Probe(pause='cache_tally_complete'), Probe()
+a = start(lambda: ngc.evaluate_pairs(network, [(0, 1)]*3, options, workers=3), holder)
+assert holder.wait('cache_tally_complete')
+assert cache.stats().hits == before + 3
+b = start(cache.thaw, lifecycle)
+assert lifecycle.wait('cache_queued')
+assert lifecycle.counts()['cache_acquired'] == 0
+holder.release()
+assert len(finish(a)) == 3
+finish(b)
+assert cache.stats().hits == before + 3
+"""
+    )
+
+
+def test_cache_lifetime_is_pinned_during_wait():
+    run(
+        CACHE_SETUP
+        + """
+holder, waiter = Probe(pause='cache_acquired'), Probe()
+a = start(lambda: ngc.evaluate_demand(network, 0, 1, options), holder)
+assert holder.wait('cache_acquired')
+keep = [cache]
+b = start(lambda: keep[0].freeze(), waiter)
+assert waiter.wait('cache_queued')
+del cache
+gc.collect()
+holder.release()
+assert finish(a).delivered == 2
+finish(b)
+assert keep[0].stats().entries == 1
+"""
+    )
+
+
+def test_policy_destructor_cannot_deadlock():
+    run("""
+holder, destructor = Probe(pause='ledger_acquired'), Probe()
+ready, drop = threading.Event(), threading.Event()
+def lifetime():
+    # Create and delete on the same OS thread. Free-threaded CPython may defer
+    # cross-thread final decrefs, which would not witness the native destructor.
+    owned = policy(ledger)
+    owned.place(2)
+    ready.set()
+    assert drop.wait(5)
+    del owned
+b = start(lifetime, destructor)
+assert ready.wait(5)
+before = destructor.counts()
+a = start(lambda: p.place(3), holder)
+assert holder.wait('ledger_acquired')
+drop.set()
+assert destructor.wait('ledger_wait', count=before['ledger_wait'] + 1)
+early = destructor.wait('ledger_acquired', count=before['ledger_acquired'] + 1, seconds=0.1)
+try:
+    if early:
+        finish(b)
+finally:
+    holder.release()
+assert finish(a).delivered == 3
+if not early:
+    finish(b)
+assert not early, 'destruction bypassed the ledger gate'
+assert ledger._state()['orphans']
+""")
+
+
+def test_waiters_pin_every_dependency():
+    run("""
+holder, waiter = Probe(pause='ledger_acquired'), Probe()
+other = [policy(ledger)]
+a = start(lambda: p.place(2), holder)
+assert holder.wait('ledger_acquired')
+method = other[0].place
+b = start(lambda: method(3), waiter)
+assert waiter.wait('ledger_wait')
+other.clear()
+gc.collect()
+holder.release()
+finish(a)
+assert finish(b).delivered == 3
+assert ledger.carried().tolist() == [5]
+""")
+
+
+def test_identity_order_is_a_serial_order():
+    run("""
+policies = []
+with ThreadPoolExecutor(4) as pool:
+    policies = list(pool.map(lambda _: policy(ledger), range(16)))
+assert sorted(q._owner() for q in policies) == list(range(1, 17))
+with ThreadPoolExecutor(4) as pool:
+    results = list(pool.map(lambda q: q.place(0), policies))
+assert all(r.delivered == 0 for r in results)
+assert ledger._state()['next_flow_id'] == 0
+""")
+
+
+def test_bind_copy_reset_races():
+    run("""
+del p
+holder, waiter = Probe(pause='ledger_acquired'), Probe()
+a = start(lambda: policy(ledger), holder)
+assert holder.wait('ledger_acquired')
+b = start(ledger.copy, waiter)
+assert waiter.wait('ledger_wait')
+holder.release()
+q = finish(a)
+with pytest.raises(ValueError, match='bound'):
+    finish(b)
+with pytest.raises(ValueError, match='bound'):
+    ledger.reset()
+del q, a
+gc.collect()
+ledger.reset()
+assert ledger.copy().residual().tolist() == [10]
+""")
+
+
+def test_failed_acquisition_releases_waiters():
+    run(
+        CACHE_SETUP
+        + """
+for stage in ('cache_queued', 'cache_acquired', 'ledger_wait', 'ledger_acquired'):
+    probe = Probe(fail=stage)
+    with pytest.raises(RuntimeError, match='injected native failure'):
+        probe.run(lambda: policy(ledger, cache=cache))
+    assert ledger._state()['bound'] == [p._owner()]
+    cache.freeze()
+    cache.thaw()
+    assert p.place(0).delivered == 0
+"""
+    )
+
+
+def test_lowest_worker_exception_survives_overlap():
+    run(
+        CACHE_SETUP
+        + """
+cache.freeze()
+for entry in ('pairs', 'failures'):
+    if entry == 'pairs':
+        operation = lambda: ngc.evaluate_pairs(network, [(0, 1)]*4, options, workers=3)
+    else:
+        big = ngc.Graph(2, [0]*4, [1]*4, [10]*4, [1]*4, 1.0)
+        operation = lambda: ngc.evaluate_edge_failures(big, 0, 1, ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL)), offer=4), 3)
+    probe = Probe(workers=[0, 2], reverse=True)
+    with pytest.raises(RuntimeError, match='injected worker failure 0$'):
+        probe.run(operation)
+"""
+    )
+
+
+def test_failure_does_not_strand_waiters():
+    run("""
+for operation in (lambda: p.place(3), lambda: p.replace(3), lambda: p.forward(3),
+                  lambda: ngc.apply_actions(ledger, [ngc.Replace(p, 3)])):
+    p.replace(1)
+    before = (ledger.carried().tolist(), p.place(0), [r.flow_id for r in p.records()])
+    failure = Probe(fail='before_publication')
+    with pytest.raises(RuntimeError, match='injected native failure'):
+        failure.run(operation)
+    assert ledger.carried().tolist() == before[0]
+    after = p.place(0)
+    assert (after.requested, after.admitted, after.delivered) == (before[1].requested, before[1].admitted, before[1].delivered)
+    assert [r.flow_id for r in p.records()] == before[2]
+    assert p.replace(2).delivered == 2
+""")
+
+
+def test_zero_empty_and_masked_calls():
+    run("""
+assert p.place(0).program is None
+assert ngc.apply_actions(ledger, []) == []
+masked = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), eligibility=network.eligibility(excluded_nodes=[0]))
+assert masked.place(5).delivered == 0
+before = p.place(3)
+for mode in (ngc.BatchMode.ORDERED, ngc.BatchMode.SIMULTANEOUS):
+    # A zero LOSSY participant changes no other participant's quantities.
+    l = ngc.FlowLedger(network)
+    a, z = policy(l, lossy=True), policy(l, lossy=True)
+    r = ngc.apply_actions(l, [ngc.Replace(a, 3), ngc.Replace(z, 0)], mode=mode)
+    assert [x.delivered for x in r] == [3, 0]
+    assert l.carried().tolist() == [3]
+assert p.place(0).program is before.program
+""")
+
+
+@GIL_ONLY
+def test_immutable_native_operations_overlap_heartbeat():
+    run("""
+assert getattr(sys, "_is_gil_enabled", lambda: True)()
+sys.setswitchinterval(0.000001)
+big = ngc.Graph(2, [0]*30000, [1]*30000, [10]*30000, [1]*30000, 1.0)
+probe = Probe()
+edges = list(range(30000))
+from helpers import dag_of
+mask = big.eligibility(excluded_edges=edges[::2])
+dag = dag_of(big, edges)
+chain = ngc.Graph(10001, list(range(10000)), list(range(1, 10001)), [10]*10000, [1]*10000, 1.0)
+hops = [[i] for i in range(10000)]
+path = ngc.Path(chain, hops)
+operations = [lambda: ngc.Graph(2, [0]*30000, [1]*30000, [10]*30000, [1]*30000, 1.0),
+              lambda: big.eligibility(excluded_edges=edges[::2]),
+              lambda: ngc.Eligibility.intersect(mask, mask),
+              lambda: ngc.PredecessorDAG.from_csr(big, dag.parent_offsets(), dag.parents(), dag.via_edges()),
+              lambda: ngc.Path(chain, hops),
+              path.to_dag,
+              lambda: ngc.ForwardingProgram.from_dag(big, 0, 1, dag),
+              lambda: ngc.ForwardingProgram.from_routes(chain, 0, 10000, [ngc.RouteDefinition(0, path)]),
+              lambda: ngc.spf(big, 0, ngc.SpfOptions(ngc.Direction.FORWARD)),
+              lambda: ngc.ksp(big, 0, 1, ngc.KspOptions(10)),
+              lambda: ngc.resolve_to_paths(big, dag, 0, 1, split_parallel_edges=True, max_paths=10000),
+              lambda: ngc.to_units(np.ones(300000), 1.0),
+              lambda: ngc.as_float(np.ones(300000, dtype=np.int64), 1.0)]
+observations = {}
+names = ('graph', 'eligibility', 'intersect', 'csr', 'path', 'path_to_dag', 'program_dag', 'program_routes', 'spf', 'ksp', 'resolve', 'to_units', 'as_float')
+for name, operation in zip(names, operations, strict=True):
+    task = start(lambda: [operation() for _ in range(8)], probe)
+    overlap = 0
+    while task[0].is_alive():
+        counts = probe.counts()
+        overlap += counts['native_begin'] > counts['native_complete']
+    finish(task)
+    observations[name] = overlap
+assert all(value > 0 for value in observations.values()), observations
+""")
+
+
+def test_trace_conversion_is_separate_read():
+    run("""
+result, trace = p._place_traced(3)
+assert result.delivered == 3
+before = (ledger.carried().tolist(), p.program, p._state())
+first = trace.as_dict()
+assert set(first) == {'prepare', 'T'}
+assert trace.as_dict() == first
+from helpers import plain
+assert type(plain(trace)) is dict and plain(trace) == first
+# One unconstrained source: the equal-allocation search checks 0, then offer 3.
+assert first['T'] == [0, 3]
+poisoned = dict(first)
+poisoned['T'] = None
+assert plain(trace) != poisoned
+poisoned['T'] = [0, 4]
+assert plain(trace) != poisoned
+assert before == (ledger.carried().tolist(), p.program, p._state())
+probe = Probe(pause='ledger_acquired')
+task = start(lambda: p.place(0), probe)
+assert probe.wait('ledger_acquired')
+assert trace.as_dict() == first
+probe.release()
+finish(task)
+""")
+
+
+def test_daemon_exit_releases_native_resources():
+    # A daemon thread's engine work ends after interpreter finalization began; the thread must
+    # neither retake the GIL nor end the process (it parks). Py_AtExit runs after Python teardown:
+    # its native waiter owns a different policy on the busy ledger, or queues thaw against the
+    # daemon's outer lease. destruction: a second daemon drops the last reference to a policy on
+    # the busy ledger, whose destructor waits for the gate and ends while the finalizing thread
+    # stays in module teardown (an object that module teardown wipes waits there). window: the
+    # last exit function holds the GIL past the daemon's pause, so the daemon finds Python
+    # initialized, waits for the GIL, and finalization begins during that wait.
+    for case in ("ledger", "cache", "destruction", "window"):
+        output = run_python(
+            f"\ncase = {case!r}\n"
+            + """
+if case == 'window':
+    import atexit
+    # The only exit function, so the last: no bytecode runs between it and finalization (the
+    # preamble's imports registered one: logging's, imported by concurrent.futures; this child
+    # needs neither).
+    atexit._clear()
+    atexit.register(sum, range(4 * 10**8))
+"""
+            + SETUP
+            + """
+if case == 'ledger':
+    probe = Probe(pause='ledger_acquired', auto_release_ms=1000)
+    ext._at_native_exit(ledger, None, probe)
+    operation = lambda: p.replace(3)
+    stage = 'ledger_acquired'
+elif case == 'destruction':
+    import time
+    import types
+    class Keeper:
+        def __del__(self, clock=time.monotonic, out=sys.stdout):
+            # A busy wait: time.sleep fails in module teardown on Windows (its SIGINT event is closed).
+            end = clock() + 4
+            while clock() < end:
+                pass
+            out.write('CHILD: teardown waited for the daemons\\n')
+            out.flush()
+    sys.modules['teardown_keeper'] = types.ModuleType('teardown_keeper')
+    sys.modules['teardown_keeper'].keeper = Keeper()
+    # Made and dropped on one daemon thread: free-threaded CPython hands a final decref from
+    # another thread back to the thread that made the object.
+    made, drop = threading.Event(), threading.Event()
+    def lifetime():
+        owned = policy(ledger)
+        made.set()
+        drop.wait()
+        del owned
+    dropping = threading.Thread(target=lifetime, daemon=True)
+    dropping.start()
+    assert made.wait(5)
+    probe = Probe(pause='ledger_acquired', auto_release_ms=2000)
+    operation = lambda: p.replace(3)
+    stage = 'ledger_acquired'
+elif case == 'window':
+    probe = Probe(pause='ledger_acquired', auto_release_ms=1000)
+    operation = lambda: p.replace(3)
+    stage = 'ledger_acquired'
+else:
+    cache = ngc.ShortestPathCache(network)
+    options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache, offer=3)
+    assert ngc.evaluate_demand(network, 0, 1, options).delivered == 3
+    cache.freeze()
+    probe = Probe(pause='cache_acquired', auto_release_ms=1000)
+    ext._at_native_exit(None, cache, probe)
+    operation = lambda: ngc.evaluate_demand(network, 0, 1, options)
+    stage = 'cache_acquired'
+task = start(operation, probe)
+assert probe.wait(stage)
+assert probe.counts()['pause_begin'] == 1 and probe.counts()['pause_end'] == 0
+if case == 'destruction':
+    drop.set()
+    dropping.join(0.3)
+    assert dropping.is_alive(), 'the destructor did not wait for the gate'
+print('CHILD: finalizing with daemon holding', case, flush=True)
+""",
+            cleanup=False,
+            seconds=60 if case == "window" else 25,
+        )
+        if case in ("ledger", "cache"):
+            assert "CHILD: native finalizer waiting after Python teardown" in output
+            assert "CHILD: native finalizer completed" in output
+        if case == "destruction":
+            assert "CHILD: teardown waited for the daemons" in output
+
+
+def test_every_program_representation_uses_the_transaction_gate():
+    run("""
+from helpers import dag_of, plain
+from test_apply_actions import World
+from test_contract_examples import mismatch
+# Two heads, a branch and a merge, and one shared final link. Each program
+# representation describes these same walks; a competing offer makes the final
+# link bind. Compare whole serial states, not only aggregate delivery.
+network = ngc.Graph(7, [0,1,2,2,3,4,5], [2,2,3,4,5,5,6], [10]*7, [1]*7, 1.0)
+dag = dag_of(network, range(7))
+paths = [ngc.Path(network, [[first],[branch],[last],[6]]) for first in (0,1) for branch,last in ((2,4),(3,5))]
+programs = {
+    'pooled_dag': ngc.ForwardingProgram.from_dag(network, [0,1], 6, dag),
+    'tunnels': ngc.ForwardingProgram.from_routes(network, [0,1], 6, [ngc.RouteDefinition(i//2, path) for i,path in enumerate(paths)]),
+    'split_routes': ngc.ForwardingProgram.from_routes(network, [0,1], 6, [ngc.RouteDefinition(head, dag) for head in (0,1)]),
+    'mixed': ngc.ForwardingProgram.from_routes(network, [0,1], 6, [ngc.RouteDefinition(0, dag), ngc.RouteDefinition(0, paths[0]), ngc.RouteDefinition(1, dag), ngc.RouteDefinition(1, paths[2])]),
+}
+outputs = ngc.OutputOptions(edge_flows=True, residual=True, saturated_boundary_edges=True, edge_reservations=True)
+def make(representation):
+    world = World(network)
+    routing = ngc.ShortestPaths() if representation == 'shortest_paths' else ngc.Pinned(programs[representation])
+    config = ngc.FlowPolicyConfig(routing=routing, admission=ngc.Admission.LOSSY)
+    for _ in range(2):
+        world.add([0,1], [6], config).replace(2)
+    return world
+
+def operation(world, entry):
+    a,b = world.p
+    if entry == 'place':
+        return lambda: a.place(7, outputs)
+    if entry == 'evaluate':
+        return lambda: a.evaluate(9, outputs=outputs)
+    if entry == 'replace':
+        return lambda: a.replace(9, outputs=outputs)
+    if entry == 'forward':
+        return lambda: a.forward(9, outputs=outputs)
+    mode = ngc.BatchMode.ORDERED if entry == 'ordered' else ngc.BatchMode.SIMULTANEOUS
+    return lambda: ngc.apply_actions(world.ledger, [ngc.Replace(a, 9), ngc.Replace(b, 7)], mode=mode, outputs=outputs)
+
+def capture(task):
+    try:
+        return finish(task)
+    except Exception as error:
+        # A reader of a partial publication can fail on a retired record as well
+        # as return a mixed value. Keep that failure and exercise every other path.
+        return ('unexpected task error', type(error).__name__, str(error))
+
+checked, failures = [], []
+for representation in ('shortest_paths', *programs):
+    entries = ('place', 'evaluate', 'replace', 'ordered', 'simultaneous')
+    if representation == 'shortest_paths':
+        entries += ('forward',)
+    for entry in entries:
+        serial, racing = make(representation), make(representation)
+        want = plain(operation(serial, entry)())
+        want_state = serial.state()
+        call = operation(racing, entry)
+        if entry != 'evaluate':
+            before = racing.state()
+            with pytest.raises(RuntimeError, match='injected native failure'):
+                Probe(fail='before_publication').run(call)
+            assert mismatch(racing.state(), before) is None, (representation, entry, 'failed call published')
+        holder = Probe(pause='ledger_acquired' if entry == 'evaluate' else 'after_exchange')
+        reader = Probe()
+        writer = start(call, holder)
+        assert holder.wait('ledger_acquired' if entry == 'evaluate' else 'after_exchange')
+        observer = start(racing.state, reader)
+        assert reader.wait('ledger_wait')
+        early = False
+        got_state = None
+        try:
+            early = reader.wait('ledger_acquired', seconds=0.1)
+            if early:
+                # A gate-removal plant still makes an owned snapshot while the
+                # writer is stopped. Join the reader before resuming writes.
+                got_state = capture(observer)
+        finally:
+            holder.release()
+        got = plain(capture(writer))
+        if not early:
+            got_state = capture(observer)
+        differences = (early, mismatch(got, want), mismatch(got_state, want_state))
+        if any(differences):
+            failures.append((representation, entry, differences))
+            print('CHILD: transaction', representation, entry, 'failed', flush=True)
+        checked.append((representation, entry))
+assert len(checked) == 26
+assert failures == [], failures
+""")
+
+
+def test_batch_first_pass_uses_one_detach_and_no_computation_event():
+    run("""
+chain = ngc.Graph(4, [0,1,2], [1,2,3], [10]*3, [1]*3, 1.0)
+for routing in (ngc.DistributedTE(ngc.TunnelCount(1)),
+                ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL, tunnel_count=ngc.TunnelCount(1))):
+    options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=routing), design_demand=1, offer=1)
+    for count in (1, 8):
+        probe = Probe()
+        result = probe.run(ngc.evaluate_pairs, chain, [(0,3)]*count, options, None, 3)
+        counts = probe.counts()
+        assert len(result) == count and all(r.delivered == 1 for r in result)
+        assert counts['argument_begin'] == 1, counts
+        assert counts['native_begin'] == counts['native_complete'] == 1, counts
+        assert counts['tunnel_roster_search'] == count, counts
+    for bad in ((2,2), ([],3), None):
+        probe = Probe()
+        with pytest.raises((ValueError, TypeError)):
+            probe.run(ngc.evaluate_pairs, chain, [(0,3), bad], options, None, 2)
+        counts = probe.counts()
+        assert counts['argument_begin'] == counts['tunnel_roster_search'] == 1, counts
+        assert counts['native_begin'] == counts['native_complete'] == counts['ledger_wait'] == counts['cache_queued'] == 0, counts
+    failed = Probe(workers=[0,1], reverse=True)
+    with pytest.raises(RuntimeError, match='^injected worker failure 0$'):
+        failed.run(ngc.evaluate_pairs, chain, [(0,3), (0,3), ([],3)], options, None, 2)
+    assert failed.counts()['native_begin'] == failed.counts()['ledger_wait'] == failed.counts()['cache_queued'] == 0
+""")
diff --git a/tests/py/test_concurrency_public.py b/tests/py/test_concurrency_public.py
new file mode 100644
index 0000000..6f3b3d3
--- /dev/null
+++ b/tests/py/test_concurrency_public.py
@@ -0,0 +1,201 @@
+"""Public concurrency promises on ordinary and free-threaded, hooks ON/OFF builds."""
+
+from concurrency_support import run_python
+
+
+def test_shared_policy_increments():
+    run_python("""
+        ledger = ngc.FlowLedger(graph(100))
+        a, b = policy(ledger), policy(ledger)
+        def place(i):
+            return (a if i % 2 else b).place(1).call_delivered
+        with ThreadPoolExecutor(4) as pool:
+            results = list(pool.map(place, range(240)))
+        assert sum(results) == a.delivered() + b.delivered() == 100
+        assert ledger.carried().tolist() == [100]
+        assert ledger.residual().tolist() == [0]
+        assert sum(row.delivered for row in ledger.records()) == 100
+    """)
+
+
+def test_replacements_replay_by_flow_id():
+    run_python("""
+        for mode in (ngc.BatchMode.ORDERED, ngc.BatchMode.SIMULTANEOUS):
+            ledger = ngc.FlowLedger(graph())
+            a, b = policy(ledger, lossy=True), policy(ledger, lossy=True)
+            ngc.apply_actions(ledger, [ngc.Replace(a, 2), ngc.Replace(b, 3)], mode=mode)
+            owner_a, owner_b = [row.policy_id for row in ledger.records()]
+            def writer():
+                for i in range(80):
+                    offers = (2, 3) if i % 2 else (6, 4)
+                    results = ngc.apply_actions(ledger, [ngc.Replace(a, offers[0]), ngc.Replace(b, offers[1])], mode=mode)
+                    assert [row.delivered for row in results] == list(offers)
+            def reader():
+                for _ in range(200):
+                    records = ledger.records()
+                    amounts = {row.policy_id: row.delivered for row in records}
+                    assert (amounts[owner_a], amounts[owner_b]) in ((2, 3), (6, 4))
+                    ids = [row.flow_id for row in records]
+                    assert ids == sorted(ids) and len(set(ids)) == 2
+            with ThreadPoolExecutor(3) as pool:
+                jobs = [pool.submit(writer), pool.submit(reader), pool.submit(reader)]
+                for job in jobs:
+                    job.result()
+    """)
+
+
+def test_independent_ledgers():
+    run_python("""
+        network = graph(1000)
+        ledgers = [ngc.FlowLedger(network), ngc.FlowLedger(network)]
+        policies = [policy(ledger) for ledger in ledgers]
+        barrier = threading.Barrier(2)
+        def worker(p):
+            barrier.wait(5)
+            return sum(p.place(1).call_delivered for _ in range(400))
+        with ThreadPoolExecutor(2) as pool:
+            assert list(pool.map(worker, policies)) == [400, 400]
+        assert [ledger.residual().tolist() for ledger in ledgers] == [[600], [600]]
+        assert ledgers[0].uid() != ledgers[1].uid()
+    """)
+
+
+def test_immutable_configuration_and_snapshots():
+    run_python("""
+        network = graph()
+        ledger = ngc.FlowLedger(network)
+        p = policy(ledger)
+        old_result = p.place(3, ngc.OutputOptions(residual=True, edge_flows=True))
+        old_record = p.records()[0]
+        old_program = p.program
+        config = p.config
+        def reader(_):
+            for _ in range(100):
+                assert old_result.delivered == old_record.delivered == 3
+                assert old_result.residual.tolist() == [7]
+                assert old_result.edge_flows.tolist() == [3]
+                assert old_record.route.graph_uid() == network.uid()
+                assert old_program.sources == (0,) and old_program.destinations == (1,)
+                assert config.admission == ngc.Admission.LOSSLESS
+        def writer(_):
+            for i in range(50):
+                p.replace(i % 10)
+        with ThreadPoolExecutor(4) as pool:
+            jobs = [pool.submit(reader, i) for i in range(3)] + [pool.submit(writer, 0)]
+            for job in jobs:
+                job.result()
+        assert old_record.delivered == old_result.delivered == 3
+    """)
+
+
+def test_cache_lifecycle_and_retained_values():
+    run_python("""
+        network = graph()
+        cache = ngc.ShortestPathCache(network)
+        options = ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache, offer=3)
+        retained = ngc.evaluate_demand(network, 0, 1, options)
+        def reader():
+            for _ in range(100):
+                assert ngc.evaluate_pairs(network, [(0, 1), (0, 1)], options, workers=1)[0].delivered == 3
+        def lifecycle():
+            for _ in range(100):
+                cache.freeze()
+                cache.thaw()
+        with ThreadPoolExecutor(3) as pool:
+            jobs = [pool.submit(reader), pool.submit(reader), pool.submit(lifecycle)]
+            for job in jobs:
+                job.result()
+        assert cache.stats().hits == 400
+        cache.clear()
+        assert cache.stats().entries == 0
+        assert retained.program.sources == (0,) and retained.program.destinations == (1,)
+        assert retained.delivered == 3
+    """)
+
+
+def test_public_policy_teardown():
+    # The keeper's __del__ runs in interpreter teardown, on the finalizing thread after
+    # Py_IsInitialized() is already 0: its native read must retake the GIL there.
+    output = run_python(
+        """
+        class Keeper:
+            def __init__(self, ledger):
+                self.ledger = ledger
+
+            def __del__(self):
+                print("CHILD: teardown read", self.ledger.carried().tolist(), flush=True)
+
+        network = graph()
+        ledger = ngc.FlowLedger(network)
+        keeper = Keeper(ledger)
+        p = policy(ledger)
+        p.place(3)
+        record = ledger.records()[0]
+        del p
+        gc.collect()
+        assert ledger.records()[0].flow_id == record.flow_id
+        assert ledger.carried().tolist() == [3]
+        copied = ledger.copy()
+        assert copied.carried().tolist() == [3]
+        assert copied.uid() != ledger.uid()
+        ledger.reset()
+        assert ledger.records() == []
+        assert ledger.residual().tolist() == [10]
+    """,
+        cleanup=False,
+    )
+    assert "CHILD: teardown read [0]" in output.splitlines()
+
+
+def test_final_policy_rejects_swallowed_constructor_error():
+    run_python("""
+        with pytest.raises(TypeError):
+            class Swallow(ngc.FlowPolicy):
+                def __init__(self):
+                    try:
+                        super().__init__(None, 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()))
+                    except Exception:
+                        pass
+        network = graph()
+        ledger = ngc.FlowLedger(network)
+        cache = ngc.ShortestPathCache(network)
+        cache.freeze()
+        shell = ngc.FlowPolicy.__new__(ngc.FlowPolicy)
+        with pytest.raises(ngc.ShortestPathCacheMiss):
+            ngc.FlowPolicy.__init__(shell, ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), cache=cache)
+        with pytest.raises(TypeError):
+            shell.place(1)
+        del shell
+        gc.collect()
+        ledger.reset()
+        class Pretender:
+            reads = 0
+            @property
+            def __class__(self):
+                self.reads += 1
+                return ngc.FlowPolicy
+        fake = Pretender()
+        # Python's isinstance accepts this object; its actual native layout is unrelated.
+        assert type(fake) is Pretender and isinstance(fake, ngc.FlowPolicy)
+        assert fake.reads == 1
+        for action in (ngc.Place, ngc.Replace, ngc.Forward):
+            with pytest.raises(TypeError, match='policy must be a FlowPolicy'):
+                action(fake, 1)
+        entries = [
+            lambda: ngc.FlowPolicy.config.fget(fake),
+            lambda: ngc.FlowPolicy.program.fget(fake),
+            lambda: ngc.FlowPolicy.place(fake, 1),
+            lambda: ngc.FlowPolicy.evaluate(fake, 1),
+            lambda: ngc.FlowPolicy.replace(fake, 1),
+            lambda: ngc.FlowPolicy.forward(fake, 1),
+            lambda: ngc.FlowPolicy.remove(fake),
+            lambda: ngc.FlowPolicy.delivered(fake),
+            lambda: ngc.FlowPolicy.records(fake),
+            lambda: ngc.FlowPolicy.record(fake, (ledger.uid(), 0)),
+        ]
+        for entry in entries:
+            with pytest.raises(TypeError, match='policy must be a FlowPolicy'):
+                entry()
+        assert fake.reads == 1
+        assert ledger.carried().tolist() == [0]
+    """)
diff --git a/tests/py/test_configuration.py b/tests/py/test_configuration.py
new file mode 100644
index 0000000..12f7972
--- /dev/null
+++ b/tests/py/test_configuration.py
@@ -0,0 +1,958 @@
+"""The configuration values (docs/semantics.md, "Configuration"): their construction (keywords,
+required arguments, types, defaults), the model matrix in its order and its first error, the
+route choice's rules (the ineffective tie rule of ShortestPaths and the pooled single-path rule),
+at a policy and at an evaluator. The table cases are the worked CFG examples, run here on the
+library: a valid model reads back its resolved fields from the policy's config."""
+
+from __future__ import annotations
+
+import ast
+from fractions import Fraction
+from pathlib import Path
+
+import numpy as np
+import pytest
+from helpers import assert_read_only, build, dag_of, exact
+
+import netgraph_core as ngc
+
+TIE = ngc.RouteTieBreak
+A = ngc.RouteAllocation
+INEFFECTIVE = "ShortestPaths tie_break requires multipath=False or parallel_edges=False"
+POOLED = (
+    "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS"
+    " when multipath=False"
+)
+
+
+def config(allocation, **choice):
+    return ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(allocation=allocation, **choice)
+    )
+
+
+def test_ineffective_tie():
+    # A HIGHER_* tie_break with every route and every parallel edge has nothing to choose:
+    # rejected for every allocation (OPTIMIZED's support is the route choice too); with
+    # multipath=False or parallel_edges=False it is valid; FEWER_HOPS always is.
+    g = build(2, [(0, 1, 4, 1), (0, 1, 10, 1)])
+    for allocation in (A.EQUAL, A.WEIGHTED, A.OPTIMIZED):
+        for tie in (
+            TIE.HIGHER_CAPACITY,
+            TIE.HIGHER_AVAILABLE_CAPACITY,
+            TIE.HIGHER_HEADROOM,
+        ):
+            cfg = config(allocation, tie_break=tie)
+            with pytest.raises(ValueError, match=exact(INEFFECTIVE)):
+                ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg)
+            with pytest.raises(ValueError, match=exact(INEFFECTIVE)):
+                ngc.evaluate_demand(g, 0, 1, ngc.EvaluationOptions(cfg))
+            for choice in ({"multipath": False}, {"parallel_edges": False}):
+                ok = config(allocation, tie_break=tie, **choice)
+                assert (
+                    ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, ok).place(1).call_delivered
+                    == 1
+                )
+        assert (
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, config(allocation))
+            .place(1)
+            .call_delivered
+            == 1
+        )
+
+
+def test_pooled_rule_counts_inputs():
+    # The pooled single-path rule counts the normalized input sources before the mask:
+    # [0, 0, 1] is two sources, [0, 1] with source 1 masked is still two, [0] is one.
+    g = build(3, [(0, 2, 5, 1), (1, 2, 5, 1)])
+    cfg = config(A.EQUAL, tie_break=TIE.HIGHER_CAPACITY, multipath=False)
+    with pytest.raises(ValueError, match=exact(POOLED)):
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 0, 1], 2, cfg)
+    masked = g.eligibility(excluded_nodes=[1])
+    with pytest.raises(ValueError, match=exact(POOLED)):
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg, masked)
+    with pytest.raises(ValueError, match=exact(POOLED)):
+        ngc.evaluate_demand(
+            g, [0, 1], 2, ngc.EvaluationOptions(cfg, eligibility=masked)
+        )
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), [0], 2, cfg).place(1).call_delivered == 1
+    # FEWER_HOPS single paths pool, and HIGHER_* multipath (one member per pair) pools.
+    for choice in (
+        {"multipath": False},
+        {"tie_break": TIE.HIGHER_CAPACITY, "parallel_edges": False},
+    ):
+        ok = config(A.EQUAL, **choice)
+        assert (
+            ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, ok).place(2).call_delivered
+            == 2
+        )
+
+
+# -- the worked CFG examples ----------------------------------------------------------------------
+
+# 0 -> 1 (e0), 0 -> 2 (e1), 1 -> 2 (e2): one source is [0], two are [0, 1]; the destination is 2.
+EXAMPLE = [(0, 1, 5, 1), (0, 2, 5, 1), (1, 2, 5, 1)]
+ENUMS = {
+    "allocation": ngc.RouteAllocation,
+    "source_allocation": ngc.SourceAllocation,
+    "weight_basis": ngc.WeightBasis,
+    "tie_break": ngc.RouteTieBreak,
+}
+MODELS = {
+    "ShortestPaths": ngc.ShortestPaths,
+    "DistributedTE": lambda tunnel_count, **kw: ngc.DistributedTE(tunnel_count, **kw),
+    "CentralizedTE": ngc.CentralizedTE,
+    "Pinned": lambda program, **kw: ngc.Pinned(program, **kw),
+    "FlowPolicyConfig": ngc.FlowPolicyConfig,
+}
+
+
+CEILING = "cost_ceiling must be AbsoluteCost, CostStretch or None"
+
+
+def program_of(g, spec):
+    """A program of the example graph: "p" from 0 to 2, or {"sources": [0], "destinations": [d]}."""
+    if spec == "p":
+        spec = {"sources": [0], "destinations": [2]}
+    (d,) = spec["destinations"]
+    route = ngc.Path(g, [[0 if d == 1 else 1]])
+    return ngc.ForwardingProgram.from_routes(
+        g, spec["sources"], [d], [ngc.RouteDefinition(0, route)]
+    )
+
+
+def argument(g, key, value):
+    """The library value of one example keyword (the examples spell values as strings)."""
+    if key in ENUMS and isinstance(value, str):
+        return getattr(ENUMS[key], value)
+    if key == "tunnel_count":
+        count, *up_to = value.split()
+        return ngc.TunnelCount(int(count), up_to=up_to == ["up_to"])
+    if key == "cost_ceiling":
+        kind, *parts = value
+        return ngc.CostStretch(Fraction(*parts)) if kind == "fraction" else parts[0]
+    if key == "support":
+        return dag_of(g, [1])
+    if key == "program":
+        return program_of(g, value)
+    if key == "routing":
+        return ngc.ShortestPaths()
+    return value
+
+
+def resolved(routing):
+    """A valid model's resolved fields, as the examples print them."""
+
+    def name(v):
+        return "None" if v is None else v.name
+
+    if isinstance(routing, ngc.ShortestPaths):
+        return (
+            f"allocation={name(routing.allocation)}"
+            f" source_allocation={name(routing.source_allocation)}"
+            f" weight_basis={name(routing.weight_basis)}"
+            f" tie_break={name(routing.tie_break)}"
+            f" multipath={routing.multipath} parallel_edges={routing.parallel_edges}"
+        )
+    if isinstance(routing, ngc.CentralizedTE):
+        t = routing.tunnel_count
+        count = "None" if t is None else f"{t.per_head}" + (" up_to" if t.up_to else "")
+        return (
+            f"source_allocation={name(routing.source_allocation)}"
+            f" support={'None' if routing.support is None else 'dag'}"
+            f" tunnel_count={count} prefer_headroom={routing.prefer_headroom}"
+        )
+    return "valid"
+
+
+def outcome(
+    model, kwargs, sources=1, admission="LOSSLESS", cache=False, endpoints=None
+):
+    """One CFG example on the library: "TypeError" (with the text where the example names one)
+    at construction, the policy's first ValueError text, or the resolved fields of a valid model.
+    The policy is built, and a zero call placed, only when the model is valid (a zero offer skips
+    no validation)."""
+    g = build(3, EXAMPLE)
+    try:
+        value = MODELS[model](**{k: argument(g, k, v) for k, v in kwargs.items()})
+    except TypeError as e:
+        return f"TypeError: {e}" if str(e) == CEILING else "TypeError"
+    if model == "FlowPolicyConfig":
+        return "constructed"
+    cfg = ngc.FlowPolicyConfig(
+        routing=value, admission=getattr(ngc.Admission, admission)
+    )
+    src, dst = ([0], [2]) if sources == 1 else ([0, 1], [2])
+    if endpoints is not None:
+        src, dst = endpoints
+    tunnels = isinstance(value, ngc.DistributedTE) or (
+        isinstance(value, ngc.CentralizedTE) and value.tunnel_count is not None
+    )
+    try:
+        policy = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            src,
+            dst,
+            cfg,
+            None,
+            ngc.ShortestPathCache(g) if cache else None,
+        )
+    except ValueError as e:
+        return str(e)
+    (policy.replace if tunnels else policy.place)(0)
+    return resolved(policy.config.routing)
+
+
+def run_cases(cases, expected):
+    got = [outcome(**case) for case in cases]
+    assert got == expected
+
+
+def test_cfg_defaults():
+    # CFG-defaults: every resolved field of ShortestPaths' allocations, and a T2 model.
+    run_cases(
+        [
+            dict(model="ShortestPaths", kwargs={}),
+            dict(model="ShortestPaths", kwargs={"allocation": "EQUAL"}),
+            dict(model="ShortestPaths", kwargs={"allocation": "WEIGHTED"}),
+            dict(model="ShortestPaths", kwargs={"allocation": "OPTIMIZED"}),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "tunnel_count": "16"},
+            ),
+        ],
+        [
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=OPTIMIZED source_allocation=OPTIMIZED weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "source_allocation=EQUAL support=None tunnel_count=16 prefer_headroom=False",
+        ],
+    )
+
+
+def test_cfg_construction():
+    # CFG-construction: every case is a TypeError when the value is built.
+    run_cases(
+        [
+            dict(model="CentralizedTE", kwargs={}),
+            dict(model="CentralizedTE", kwargs={"source_allocation": None}),
+            dict(model="CentralizedTE", kwargs={"tunnel_count": "16"}),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "selection": "default"},
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "4", "source_allocation": "EQUAL"},
+            ),
+            dict(
+                model="DistributedTE", kwargs={"tunnel_count": "4", "multipath": False}
+            ),
+            dict(model="Pinned", kwargs={"program": "p", "allocation": "EQUAL"}),
+            dict(
+                model="FlowPolicyConfig",
+                kwargs={"routing": "ShortestPaths()", "allocation": "EQUAL"},
+            ),
+            dict(model="ShortestPaths", kwargs={"multipath": None}),
+            dict(model="ShortestPaths", kwargs={"placement": "EQUAL"}),
+        ],
+        ["TypeError"] * 10,
+    )
+
+
+def test_cfg_matrix():
+    # CFG-matrix: one result per row of the matrix (the rows checked at a policy, each valid
+    # model also placing a zero call).
+    run_cases(
+        [
+            dict(model="ShortestPaths", kwargs={"source_allocation": "OPTIMIZED"}),
+            dict(
+                model="ShortestPaths",
+                kwargs={"allocation": "OPTIMIZED"},
+                admission="LOSSY",
+            ),
+            dict(model="ShortestPaths", kwargs={"tie_break": "HIGHER_CAPACITY"}),
+            dict(
+                model="ShortestPaths",
+                kwargs={"tie_break": "HIGHER_CAPACITY", "multipath": False},
+                sources=2,
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={"tie_break": "HIGHER_CAPACITY", "multipath": False},
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={"tie_break": "HIGHER_HEADROOM", "parallel_edges": False},
+                sources=2,
+            ),
+            dict(model="ShortestPaths", kwargs={"weight_basis": "CAPACITY"}),
+            dict(
+                model="ShortestPaths",
+                kwargs={"allocation": "WEIGHTED", "weight_basis": "EXPLICIT"},
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "OPTIMIZED", "tunnel_count": "2"},
+                sources=2,
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "OPTIMIZED", "tunnel_count": "2"},
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL"},
+                admission="LOSSY",
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "prefer_headroom": True},
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={
+                    "source_allocation": "EQUAL",
+                    "support": "dag",
+                    "tunnel_count": "2",
+                },
+                admission="LOSSY",
+            ),
+            dict(model="DistributedTE", kwargs={"tunnel_count": "4 up_to"}),
+        ],
+        [
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+            "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+            INEFFECTIVE,
+            POOLED,
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_CAPACITY multipath=False parallel_edges=True",
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_HEADROOM multipath=True parallel_edges=False",
+            "weight_basis requires allocation=WEIGHTED",
+            "weight_basis=EXPLICIT requires edge_weights",
+            "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+            "source_allocation=OPTIMIZED support=None tunnel_count=2 prefer_headroom=False",
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+            "prefer_headroom requires tunnel_count",
+            "source_allocation=EQUAL support=dag tunnel_count=2 prefer_headroom=False",
+            "DistributedTE requires an exact tunnel count",
+        ],
+    )
+
+
+def test_cfg_first_error():
+    # CFG-first-error: two defects each; the first in the model matrix's order is reported.
+    run_cases(
+        [
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "prefer_headroom": True},
+                admission="LOSSY",
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={"source_allocation": "OPTIMIZED", "weight_basis": "CAPACITY"},
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={"allocation": "OPTIMIZED", "tie_break": "HIGHER_CAPACITY"},
+                admission="LOSSY",
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={"tie_break": "HIGHER_CAPACITY", "weight_basis": "CAPACITY"},
+            ),
+            dict(
+                model="ShortestPaths",
+                kwargs={
+                    "tie_break": "HIGHER_CAPACITY",
+                    "multipath": False,
+                    "weight_basis": "CAPACITY",
+                },
+                sources=2,
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={
+                    "source_allocation": "OPTIMIZED",
+                    "tunnel_count": "0",
+                    "prefer_headroom": True,
+                },
+                sources=2,
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "0 up_to", "cost_ceiling": ["fraction", 1, 2]},
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "4 up_to", "cost_ceiling": ["fraction", 1, 2]},
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={
+                    "tunnel_count": "4",
+                    "cost_ceiling": ["fraction", 1, 2],
+                    "min_unreserved_bandwidth": -1,
+                },
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "4", "min_unreserved_bandwidth": -1},
+            ),
+        ],
+        [
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+            "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+            INEFFECTIVE,
+            POOLED,
+            "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+            "tunnel count must be in [1, 10000]",
+            "DistributedTE requires an exact tunnel count",
+            "cost_ceiling CostStretch factor must be >= 1 (got 1/2)",
+            "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+        ],
+    )
+
+
+def test_cfg_cache_order():
+    # CFG-cache-order: the cache refusal is the matrix's last check (after prefer_headroom,
+    # before the tunnel count), the program's endpoints come after the matrix.
+    other = {"sources": [0], "destinations": [2]}
+    run_cases(
+        [
+            dict(model="DistributedTE", kwargs={"tunnel_count": "0"}, cache=True),
+            dict(
+                model="Pinned",
+                kwargs={"program": other},
+                cache=True,
+                endpoints=[[0], [1]],
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "tunnel_count": "0"},
+                cache=True,
+            ),
+            dict(
+                model="CentralizedTE",
+                kwargs={"source_allocation": "EQUAL", "prefer_headroom": True},
+                cache=True,
+            ),
+            dict(model="ShortestPaths", kwargs={"allocation": "WEIGHTED"}, cache=True),
+            dict(model="DistributedTE", kwargs={"tunnel_count": "0"}),
+            dict(model="Pinned", kwargs={"program": other}, endpoints=[[0], [1]]),
+            dict(
+                model="Pinned",
+                kwargs={"program": {"sources": [0], "destinations": [1]}},
+                endpoints=[[0], [1]],
+            ),
+        ],
+        [
+            "DistributedTE does not use ShortestPathCache",
+            "Pinned does not use ShortestPathCache",
+            "CentralizedTE does not use ShortestPathCache",
+            "prefer_headroom requires tunnel_count",
+            "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "tunnel count must be in [1, 10000]",
+            "program endpoints do not match policy endpoints",
+            "valid",
+        ],
+    )
+
+
+def test_cfg_ceiling_type():
+    # CFG-ceiling-type: a ceiling of another type is refused when DistributedTE is built, before
+    # any policy check (the count 0 is never reached).
+    ceiling = f"TypeError: {CEILING}"
+    run_cases(
+        [
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "0", "cost_ceiling": ["other", 1.5]},
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "4", "cost_ceiling": ["other", 2]},
+            ),
+            dict(
+                model="DistributedTE",
+                kwargs={"tunnel_count": "4", "cost_ceiling": ["fraction", 3, 2]},
+            ),
+        ],
+        [ceiling, ceiling, "valid"],
+    )
+
+
+# -- construction ------------------------------------------------------------------------------
+
+
+def test_shortest_paths_defaults():
+    # ShortestPaths() is ShortestPaths(allocation=EQUAL): the same fields as built and the same
+    # resolved snapshot (the source allocation resolved to EQUAL).
+    g = build(3, EXAMPLE)
+    fields = (
+        "allocation",
+        "source_allocation",
+        "weight_basis",
+        "edge_weights",
+        "tie_break",
+        "multipath",
+        "parallel_edges",
+    )
+    built = (A.EQUAL, None, None, None, TIE.FEWER_HOPS, True, True)
+    snapshots = []
+    for sp in (ngc.ShortestPaths(), ngc.ShortestPaths(allocation=A.EQUAL)):
+        assert tuple(getattr(sp, f) for f in fields) == built
+        cfg = ngc.FlowPolicyConfig(routing=sp)
+        routing = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, cfg).config.routing
+        snapshots.append(tuple(getattr(routing, f) for f in fields))
+    assert (
+        snapshots
+        == [
+            (
+                A.EQUAL,
+                ngc.SourceAllocation.EQUAL,
+                None,
+                None,
+                TIE.FEWER_HOPS,
+                True,
+                True,
+            )
+        ]
+        * 2
+    )
+
+
+def test_resolved_snapshot():
+    # WEIGHTED resolves source EQUAL and basis CAPACITY; OPTIMIZED source OPTIMIZED and no
+    # basis; OPTIMIZED with source EQUAL keeps EQUAL. The model value itself is unchanged.
+    g = build(3, EXAMPLE)
+    S = ngc.SourceAllocation
+    for sp, want in (
+        (ngc.ShortestPaths(allocation=A.WEIGHTED), (S.EQUAL, ngc.WeightBasis.CAPACITY)),
+        (ngc.ShortestPaths(allocation=A.OPTIMIZED), (S.OPTIMIZED, None)),
+        (
+            ngc.ShortestPaths(allocation=A.OPTIMIZED, source_allocation=S.EQUAL),
+            (S.EQUAL, None),
+        ),
+    ):
+        before = repr(sp)
+        cfg = ngc.FlowPolicyConfig(routing=sp)
+        routing = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg).config.routing
+        assert (routing.source_allocation, routing.weight_basis) == want, sp
+        assert repr(sp) == before and repr(cfg.routing) == before
+
+
+def test_centralized_requires_source_allocation():
+    with pytest.raises(TypeError):
+        ngc.CentralizedTE()
+    with pytest.raises(TypeError):
+        ngc.CentralizedTE(source_allocation=None)
+    c = ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL)
+    assert (c.source_allocation, c.support, c.tunnel_count, c.prefer_headroom) == (
+        ngc.SourceAllocation.EQUAL,
+        None,
+        None,
+        False,
+    )
+
+
+def test_unknown_keywords():
+    # A field of another model, or a retired one, is no keyword: pybind11's own TypeError.
+    g = build(3, EXAMPLE)
+    program = program_of(g, "p")
+    sp = ngc.ShortestPaths()
+    cases = [
+        lambda: ngc.FlowPolicyConfig(routing=sp, placement=A.EQUAL),
+        lambda: ngc.FlowPolicyConfig(routing=sp, selection=None),
+        lambda: ngc.FlowPolicyConfig(routing=sp, origin=ngc.SourceAllocation.EQUAL),
+        lambda: ngc.FlowPolicyConfig(routing=sp, weights=ngc.WeightBasis.CAPACITY),
+        lambda: ngc.FlowPolicyConfig(routing=sp, edge_weights=[1, 1, 1]),
+        lambda: ngc.FlowPolicyConfig(routing=sp, allocation=A.EQUAL),
+        lambda: ngc.DistributedTE(
+            ngc.TunnelCount(2), source_allocation=ngc.SourceAllocation.EQUAL
+        ),
+        lambda: ngc.DistributedTE(ngc.TunnelCount(2), multipath=False),
+        lambda: ngc.Pinned(program, allocation=A.EQUAL),
+        lambda: ngc.Pinned(program, source_allocation=ngc.SourceAllocation.EQUAL),
+        lambda: ngc.KspOptions(2, multipath=False),
+    ]
+    for case in cases:
+        with pytest.raises(
+            TypeError, match="incompatible (function|constructor) arguments"
+        ):
+            case()
+
+
+def test_missing_required():
+    for case in (ngc.FlowPolicyConfig, ngc.DistributedTE, ngc.Pinned):
+        with pytest.raises(TypeError):
+            case()
+
+
+class _Truthy:
+    def __bool__(self):
+        return True
+
+
+# Classes that only borrow the type name of NumPy's bool (both spellings): a bool parameter
+# checks the type itself.
+FAKE_NUMPY_BOOLS = [
+    type(name, (), {"__bool__": lambda self: True})
+    for name in ("numpy.bool_", "numpy.bool")
+]
+
+
+def _stub_bool_parameters():
+    # Every parameter the installed stub annotates `bool`, as "Owner.method:name" or
+    # "function:name".
+    stub = ast.parse(Path(ngc.__file__).with_name("__init__.pyi").read_text())
+    out = set()
+
+    def walk(body, owner=None):
+        for node in body:
+            if isinstance(node, ast.ClassDef):
+                walk(node.body, node.name)
+            elif isinstance(node, ast.FunctionDef):
+                args = node.args
+                for a in args.posonlyargs + args.args + args.kwonlyargs:
+                    if a.annotation is not None and ast.unparse(a.annotation) == "bool":
+                        out.add(f"{owner + '.' if owner else ''}{node.name}:{a.arg}")
+
+    walk(stub.body)
+    return out
+
+
+def _bool_parameters():
+    # Every bool parameter of the API (the configuration values and the search options), with
+    # how to read the value back; test_bools_are_strict checks the list against the stub.
+    g = build(2, [(0, 1, 1, 1), (0, 1, 1, 1)])
+    dag = ngc.PredecessorDAG.from_csr(g, [0, 0, 2], [0, 0], [0, 1])
+    S = ngc.SourceAllocation.EQUAL
+    params = [
+        (
+            "ShortestPaths.__init__:multipath",
+            lambda v: ngc.ShortestPaths(multipath=v).multipath,
+        ),
+        (
+            "ShortestPaths.__init__:parallel_edges",
+            lambda v: ngc.ShortestPaths(parallel_edges=v).parallel_edges,
+        ),
+        (
+            "DistributedTE.__init__:parallel_edges",
+            lambda v: ngc.DistributedTE(
+                ngc.TunnelCount(1), parallel_edges=v
+            ).parallel_edges,
+        ),
+        (
+            "CentralizedTE.__init__:prefer_headroom",
+            lambda v: ngc.CentralizedTE(
+                source_allocation=S, prefer_headroom=v
+            ).prefer_headroom,
+        ),
+        ("TunnelCount.__init__:up_to", lambda v: ngc.TunnelCount(2, up_to=v).up_to),
+        (
+            "KspOptions.__init__:parallel_edges",
+            lambda v: ngc.KspOptions(2, parallel_edges=v).parallel_edges,
+        ),
+        (
+            "SpfOptions.__init__:multipath",
+            lambda v: ngc.SpfOptions(ngc.Direction.FORWARD, multipath=v).multipath,
+        ),
+        (
+            "SpfOptions.__init__:parallel_edges",
+            lambda v: ngc.SpfOptions(
+                ngc.Direction.FORWARD, parallel_edges=v
+            ).parallel_edges,
+        ),
+        (
+            "resolve_to_paths:split_parallel_edges",
+            lambda v: len(ngc.resolve_to_paths(g, dag, 0, 1, split_parallel_edges=v))
+            == 2,
+        ),
+    ]
+    for field in (
+        "edge_flows",
+        "residual",
+        "saturated_boundary_edges",
+        "edge_reservations",
+        "min_cut",
+    ):
+        params.append(
+            (
+                f"OutputOptions.__init__:{field}",
+                lambda v, field=field: getattr(ngc.OutputOptions(**{field: v}), field),
+            )
+        )
+    return params
+
+
+def test_bools_are_strict():
+    # A bool parameter takes exactly a bool or a numpy.bool_, both known by their type: not a
+    # class named like NumPy's bool, an object with __bool__, None, an int or a string.
+    params = _bool_parameters()
+    assert {name for name, _ in params} == _stub_bool_parameters()
+    assert len(params) == 14
+    fakes = [fake() for fake in FAKE_NUMPY_BOOLS]
+    for name, make in params:
+        for bad in (*fakes, _Truthy(), None, 0, 1, "x", np.int64(1), np.array([True])):
+            with pytest.raises(TypeError):
+                make(bad)
+                pytest.fail(f"{name} took {bad!r}")
+        for good in (True, False, np.bool_(True), np.bool_(False)):
+            assert make(good) is bool(good), name
+
+
+def test_integer_scalars():
+    # A configuration value's integer field: a value of another type is a TypeError naming the
+    # field; beyond 64 bits a ValueError; in 64 bits it constructs and its domain is checked
+    # where the value is used.
+    for bad, kind in ((True, "bool"), (1.5, "float"), (None, "NoneType")):
+        with pytest.raises(
+            TypeError,
+            match=exact(f"TunnelCount per_head must be an integer (got {kind})"),
+        ):
+            ngc.TunnelCount(bad)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "TunnelCount per_head = 18446744073709551616 is out of range "
+            "[-9223372036854775808, 9223372036854775807]"
+        ),
+    ):
+        ngc.TunnelCount(2**64)
+    g = build(3, EXAMPLE)
+
+    def policy(routing):
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, ngc.FlowPolicyConfig(routing=routing))
+
+    with pytest.raises(ValueError, match=exact("tunnel count must be in [1, 10000]")):
+        policy(ngc.DistributedTE(ngc.TunnelCount(0)))
+    with pytest.raises(
+        TypeError, match=exact("AbsoluteCost cost must be an integer (got NoneType)")
+    ):
+        ngc.AbsoluteCost(None)
+    with pytest.raises(
+        ValueError, match=exact("cost_ceiling AbsoluteCost cost must be >= 0 (got -1)")
+    ):
+        policy(ngc.DistributedTE(ngc.TunnelCount(1), cost_ceiling=ngc.AbsoluteCost(-1)))
+    with pytest.raises(
+        TypeError,
+        match=exact("min_unreserved_bandwidth must be an integer (got float)"),
+    ):
+        ngc.DistributedTE(ngc.TunnelCount(1), min_unreserved_bandwidth=1.0)
+    with pytest.raises(
+        ValueError, match=r"^min_unreserved_bandwidth = .* is out of range"
+    ):
+        ngc.DistributedTE(ngc.TunnelCount(1), min_unreserved_bandwidth=2**63)
+    with pytest.raises(
+        ValueError,
+        match=exact("min_unreserved_bandwidth must be an integer in [0, 2^62)"),
+    ):
+        policy(ngc.DistributedTE(ngc.TunnelCount(1), min_unreserved_bandwidth=2**62))
+
+
+def test_wrong_types():
+    g = build(3, EXAMPLE)
+    S = ngc.SourceAllocation.EQUAL
+    for case, text in (
+        (lambda: ngc.ShortestPaths(allocation="EQUAL"), None),
+        (lambda: ngc.ShortestPaths(tie_break=0), None),
+        (
+            lambda: ngc.CentralizedTE(source_allocation=S, support=5),
+            "CentralizedTE support must be a PredecessorDAG or None",
+        ),
+        (
+            lambda: ngc.CentralizedTE(source_allocation=S, tunnel_count=2),
+            "CentralizedTE tunnel_count must be a TunnelCount or None",
+        ),
+        (
+            lambda: ngc.FlowPolicyConfig(routing=1),
+            "routing must be ShortestPaths, DistributedTE, CentralizedTE or Pinned (got int)",
+        ),
+        (
+            lambda: ngc.DistributedTE(ngc.TunnelCount(1), cost_ceiling=1.5),
+            "cost_ceiling must be AbsoluteCost, CostStretch or None",
+        ),
+        (lambda: ngc.Pinned(None), "Pinned program must be a ForwardingProgram"),
+    ):
+        with pytest.raises(TypeError, match=None if text is None else exact(text)):
+            case()
+    assert g.num_edges() == 3
+
+
+def test_edge_weights():
+    # One integer per edge, read back as a tuple; an entry beyond 64 bits is refused at
+    # construction; the array is the model's, shared by every policy built from it.
+    g = build(4, [(0, 1, 10, 1), (0, 2, 10, 1), (1, 3, 10, 1), (2, 3, 10, 1)])
+    sp = ngc.ShortestPaths(
+        allocation=A.WEIGHTED,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=np.array([1, 3, 1, 1]),
+    )
+    assert sp.edge_weights == (1, 3, 1, 1)
+    assert all(type(w) is int for w in sp.edge_weights)
+    with pytest.raises(
+        ValueError, match=exact("edge_weights[0] must be an integer in [0, 2^62)")
+    ):
+        ngc.ShortestPaths(
+            allocation=A.WEIGHTED,
+            weight_basis=ngc.WeightBasis.EXPLICIT,
+            edge_weights=[2**64, 1, 1, 1],
+        )
+    # A vector of the wrong type or shape is a TypeError at construction; a value out of range
+    # stays a ValueError (above) or is checked where the model is used.
+    for bad in (
+        [True, 1, 1, 1],
+        [1.5, 1, 1, 1],
+        [np.bool_(True), 1, 1, 1],
+        [None, 1, 1, 1],
+        ["1", 1, 1, 1],
+        [[1], 1, 1, 1],
+        3,
+        "1111",
+        b"1111",
+        {1, 3},
+        np.array([True, False, True, True]),
+        np.array([1.0, 3.0, 1.0, 1.0]),
+        np.array([[1, 3, 1, 1]]),
+        np.array(1),
+    ):
+        with pytest.raises(TypeError, match=r"^edge_weights"):
+            ngc.ShortestPaths(
+                allocation=A.WEIGHTED,
+                weight_basis=ngc.WeightBasis.EXPLICIT,
+                edge_weights=bad,
+            )
+    with pytest.raises(
+        TypeError, match=exact("edge_weights[0] must be an integer (got bool)")
+    ):
+        ngc.ShortestPaths(edge_weights=[True])
+    cfg = ngc.FlowPolicyConfig(routing=sp)
+    for _ in range(2):
+        r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg).place(8)
+        assert r.call_delivered == 8
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg).config.routing.edge_weights == (
+        1,
+        3,
+        1,
+        1,
+    )
+
+
+def test_immutable_values():
+    g = build(3, EXAMPLE)
+    program = program_of(g, "p")
+    for value, names in (
+        (ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()), ("admission",)),
+        (
+            ngc.ShortestPaths(),
+            (
+                "allocation",
+                "source_allocation",
+                "weight_basis",
+                "edge_weights",
+                "tie_break",
+                "multipath",
+                "parallel_edges",
+            ),
+        ),
+        (
+            ngc.DistributedTE(ngc.TunnelCount(1)),
+            (
+                "tunnel_count",
+                "cost_ceiling",
+                "min_unreserved_bandwidth",
+                "tie_break",
+                "parallel_edges",
+            ),
+        ),
+        (
+            ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL),
+            ("source_allocation", "support", "tunnel_count", "prefer_headroom"),
+        ),
+        (ngc.Pinned(program), ("program", "black_holes")),
+        (ngc.TunnelCount(2), ("per_head", "up_to")),
+        (ngc.AbsoluteCost(2), ("cost",)),
+        (ngc.CostStretch(2), ("factor",)),
+        (ngc.RouteDefinition(0, ngc.Path(g, [[1]])), ("head", "route", "weight")),
+    ):
+        assert_read_only(value, *names)
+    # The routing reads back as a new Python object each time (a model has no equality).
+    cfg = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    assert type(ngc.FlowPolicyConfig.routing).__name__ == "property"
+    assert ngc.FlowPolicyConfig.routing.fset is None
+    with pytest.raises(AttributeError):
+        cfg.routing = ngc.ShortestPaths()
+
+
+# -- the matrix's order -----------------------------------------------------------------------
+
+
+def test_pooled_rule_before_vectors():
+    # The pooled single-path rule is part of the matrix: before edge_weights' length.
+    g = build(3, [(0, 2, 5, 1), (1, 2, 5, 1)])
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(
+            allocation=A.WEIGHTED,
+            weight_basis=ngc.WeightBasis.EXPLICIT,
+            edge_weights=[1],
+            multipath=False,
+            tie_break=TIE.HIGHER_CAPACITY,
+        )
+    )
+    with pytest.raises(ValueError, match=exact(POOLED)):
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg)
+    with pytest.raises(ValueError, match=exact("edge_weights: expected 2 entries")):
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0], 2, cfg)
+
+
+def test_cache_rule_place():
+    # The cache refusal comes after the matrix's other checks and before the tunnel count.
+    g = build(3, EXAMPLE)
+    cache = ngc.ShortestPathCache(g)
+    for routing, text in (
+        (
+            ngc.DistributedTE(ngc.TunnelCount(0)),
+            "DistributedTE does not use ShortestPathCache",
+        ),
+        (
+            ngc.CentralizedTE(
+                source_allocation=ngc.SourceAllocation.EQUAL, prefer_headroom=True
+            ),
+            "prefer_headroom requires tunnel_count",
+        ),
+    ):
+        cfg = ngc.FlowPolicyConfig(routing=routing)
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, cfg, None, cache)
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.evaluate_demand(g, 0, 2, ngc.EvaluationOptions(cfg, cache=cache))
+
+
+def test_ownership_first():
+    # The endpoints and the ownership of the inputs come before the matrix.
+    g = build(3, EXAMPLE)
+    other = build(3, EXAMPLE)
+    for support in (dag_of(other, [1]), dag_of(other, [])):
+        routing = ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.EQUAL,
+            support=support,
+            tunnel_count=ngc.TunnelCount(2),
+            prefer_headroom=True,
+        )
+        cfg = ngc.FlowPolicyConfig(routing=routing, admission=ngc.Admission.LOSSY)
+        with pytest.raises(ValueError, match=exact("support belongs to another graph")):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, cfg)
+    bad = ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(source_allocation=ngc.SourceAllocation.OPTIMIZED)
+    )
+    with pytest.raises(ValueError, match=exact("sources: the node set is empty")):
+        ngc.FlowPolicy(
+            ngc.FlowLedger(g), [], 2, bad, other.eligibility(excluded_edges=[0])
+        )
+    with pytest.raises(
+        ValueError, match=exact("foreign Eligibility: built for another graph")
+    ):
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, bad, other.eligibility())
diff --git a/tests/py/test_contract_examples.py b/tests/py/test_contract_examples.py
new file mode 100644
index 0000000..380c846
--- /dev/null
+++ b/tests/py/test_contract_examples.py
@@ -0,0 +1,7428 @@
+"""The worked examples, run on the library: each example's own input and expected
+values (copied as written), one adapter per kind of example that builds the input with the library
+and returns what the example names, compared field by field (an expected mapping may name fewer
+fields than the adapter returns; an int is not a float or a bool; a Fraction compares by its exact
+string). The examples of several demands at once run as one apply_actions list (each route or head
+its own demand); concurrent publication examples use an exhaustive native finite-state port.
+
+Examples given as routes of link indices (no nodes) are laid out as one head, a feeder link to each
+route's first link, a connector between consecutive links and an exit link to one destination;
+these added links are wider than anything offered, so they never bind and the example's links
+decide every split. An example's per-route offers are the routes' weights, so the head's split by
+highest averages hands each route exactly its offer."""
+
+from __future__ import annotations
+
+import copy
+import itertools
+import math
+import random
+from decimal import Decimal
+from fractions import Fraction
+
+import _netgraph_core as ext
+import numpy as np
+import pytest
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+INF = math.inf
+LL = ngc.Admission.LOSSLESS
+LY = ngc.Admission.LOSSY
+S = ngc.SourceAllocation
+WIDE = 1 << 50  # wider than any amount an example offers
+
+
+class NotExposed(Exception):
+    """The example names a value the library does not report (an internal quantity)."""
+
+
+# -- comparison -------------------------------------------------------------------------------
+
+
+def mismatch(got, want, where="value"):
+    """None if `got` matches `want`, else the first difference. Typed and recursive: an int must be
+    an int (not a float or a bool), a bool a bool, None None; an expected mapping names the keys it
+    checks; a sequence must have the expected length; a Fraction compares by its exact string."""
+    if isinstance(got, Fraction):
+        got = f"{got.numerator}/{got.denominator}" if got.denominator != 1 else str(got)
+    if isinstance(want, dict):
+        if not isinstance(got, dict):
+            return f"{where}: got {got!r}, expected a mapping"
+        for key, value in want.items():
+            if key not in got:
+                return f"{where}.{key}: missing"
+            sub = mismatch(got[key], value, f"{where}.{key}")
+            if sub:
+                return sub
+        return None
+    if isinstance(want, (list, tuple)):
+        if not isinstance(got, (list, tuple)) or len(got) != len(want):
+            return f"{where}: got {got!r}, expected {want!r}"
+        for n, (g, w) in enumerate(zip(got, want, strict=True)):
+            sub = mismatch(g, w, f"{where}[{n}]")
+            if sub:
+                return sub
+        return None
+    if type(got) is not type(want) or got != want:
+        return f"{where}: got {got!r}, expected {want!r}"
+    return None
+
+
+# -- building blocks --------------------------------------------------------------------------
+
+
+def graph_of(edges):
+    """The example's graph: [source, destination, capacity, cost] rows in EdgeId order."""
+    n = 1 + max(max(a, b) for a, b, _, _ in edges)
+    g = ngc.Graph(
+        n,
+        [e[0] for e in edges],
+        [e[1] for e in edges],
+        [e[2] for e in edges],
+        [e[3] for e in edges],
+        1.0,
+    )
+    assert g.input_positions().tolist() == list(range(len(edges)))
+    return g
+
+
+def dag_of(g, edges):
+    """The PredecessorDAG of the given links (each link's tail is its predecessor)."""
+    n = g.num_nodes()
+    tails = g.edge_sources().tolist()
+    heads = g.edge_destinations().tolist()
+    preds = [[] for _ in range(n)]
+    for e in sorted(edges):
+        preds[heads[e]].append((tails[e], e))
+    offsets, parents, via = [0], [], []
+    for v in range(n):
+        for u, e in preds[v]:
+            parents.append(u)
+            via.append(e)
+        offsets.append(len(parents))
+    return ngc.PredecessorDAG.from_csr(g, offsets, parents, via)
+
+
+def path_of(g, edges):
+    return ngc.Path(g, [[e] for e in edges])
+
+
+def per_edge(pairs, m):
+    out = [0] * m
+    for e, x in pairs:
+        out[e] += x
+    return out
+
+
+def config(routing, admission=LL):
+    return ngc.FlowPolicyConfig(routing=routing, admission=admission)
+
+
+def policy(g, sources, destinations, cfg, mask=None, ledger=None):
+    return ngc.FlowPolicy(
+        ledger if ledger is not None else ngc.FlowLedger(g),
+        sources,
+        destinations,
+        cfg,
+        mask,
+    )
+
+
+def pinned(g, program, admission=LL, mask=None, black_holes=None, ledger=None):
+    cfg = config(ngc.Pinned(program, black_holes=black_holes), admission)
+    return policy(
+        g, list(program.sources), list(program.destinations), cfg, mask, ledger
+    )
+
+
+def edge_mask(g, links=(), nodes=()):
+    """The Eligibility excluding the given links and nodes (None: nothing excluded)."""
+    if not links and not nodes:
+        return None
+    return g.eligibility(excluded_nodes=list(nodes), excluded_edges=list(links))
+
+
+def laid_out(cap, routes):
+    """The layout of routes given as link indices: one head (node 0), one destination (node 1),
+    per link its own two nodes, a feeder from the head to each first link, a connector between
+    consecutive links and an exit from each last link. Returns the graph and per example link its
+    EdgeId, and per route its path of EdgeIds."""
+    rows = []
+    node = itertools.count(2)
+    ends = {e: (next(node), next(node)) for e in range(len(cap))}
+    for e, c in enumerate(cap):
+        rows.append((ends[e][0], ends[e][1], c, 1, ("link", e)))
+    added = {}
+
+    def link(a, b, key):
+        if key not in added:
+            added[key] = len(rows)
+            rows.append((a, b, WIDE, 1, key))
+        return key
+
+    walks = []
+    for route in routes:
+        walk = [link(0, ends[route[0]][0], ("feed", route[0]))]
+        for e, f in itertools.pairwise(route):
+            walk += [("link", e), link(ends[e][1], ends[f][0], ("join", e, f))]
+        walk += [("link", route[-1]), link(ends[route[-1]][1], 1, ("exit", route[-1]))]
+        walks.append(walk)
+    n = 2 + 2 * len(cap)
+    g = ngc.Graph(
+        n,
+        [r[0] for r in rows],
+        [r[1] for r in rows],
+        [r[2] for r in rows],
+        [r[3] for r in rows],
+        1.0,
+    )
+    position = {r[4]: i for i, r in enumerate(rows)}
+    eid = {pos: e for e, pos in enumerate(g.input_positions().tolist())}
+    edge = {key: eid[pos] for key, pos in position.items()}
+    links = [edge[("link", e)] for e in range(len(cap))]
+    paths = [[edge[k] for k in walk] for walk in walks]
+    return g, links, paths
+
+
+def laid_out_tunnels(cap, routes, weights, groups=None):
+    """The program of tunnels along laid-out routes: one head per group (default: one head for
+    every route), each route a tunnel of its weight. Returns the graph, the example links'
+    EdgeIds and the program."""
+    if groups is None:
+        g, links, paths = laid_out(cap, routes)
+        tunnels = [
+            ngc.RouteDefinition(0, path_of(g, p), weight=w)
+            for p, w in zip(paths, weights, strict=True)
+        ]
+        return g, links, ngc.ForwardingProgram.from_routes(g, [0], [1], tunnels)
+    # One head per group: a node per group feeding the shared head-side layout.
+    g, links, paths = laid_out_groups(cap, routes, groups)
+    tunnels = [
+        ngc.RouteDefinition(head, path_of(g, p), weight=w)
+        for (head, p), w in zip(paths, weights, strict=True)
+    ]
+    heads = sorted({h for h, _ in paths})
+    return g, links, ngc.ForwardingProgram.from_routes(g, heads, [1], tunnels)
+
+
+def laid_out_groups(cap, routes, groups):
+    """As laid_out, with route i fed from its group's own head (heads are nodes 2 + 2L ...)."""
+    rows = []
+    ends = {e: (2 + 2 * e, 3 + 2 * e) for e in range(len(cap))}
+    for e, c in enumerate(cap):
+        rows.append((ends[e][0], ends[e][1], c, 1, ("link", e)))
+    first_head = 2 + 2 * len(cap)
+    head_of = {grp: first_head + i for i, grp in enumerate(sorted(set(groups)))}
+    added = set()
+
+    def link(a, b, key):
+        if key not in added:
+            added.add(key)
+            rows.append((a, b, WIDE, 1, key))
+        return key
+
+    walks = []
+    for route, grp in zip(routes, groups, strict=True):
+        h = head_of[grp]
+        walk = [link(h, ends[route[0]][0], ("feed", grp, route[0]))]
+        for e, f in itertools.pairwise(route):
+            walk += [("link", e), link(ends[e][1], ends[f][0], ("join", e, f))]
+        walk += [("link", route[-1]), link(ends[route[-1]][1], 1, ("exit", route[-1]))]
+        walks.append((h, walk))
+    n = first_head + len(head_of)
+    g = ngc.Graph(
+        n,
+        [r[0] for r in rows],
+        [r[1] for r in rows],
+        [r[2] for r in rows],
+        [r[3] for r in rows],
+        1.0,
+    )
+    position = {r[4]: i for i, r in enumerate(rows)}
+    eid = {pos: e for e, pos in enumerate(g.input_positions().tolist())}
+    edge = {key: eid[pos] for key, pos in position.items()}
+    links = [edge[("link", e)] for e in range(len(cap))]
+    return g, links, [(h, [edge[k] for k in walk]) for h, walk in walks]
+
+
+def factor_of(spec):
+    """An example's CostStretch factor: itself, or ["float", x], ["fraction", n, d], ["int", n],
+    ["bool", b], ["index", n] (an object known only by __index__), ["numpy", type, value],
+    ["str", s] or ["other", x] (a value of another type)."""
+    if not isinstance(spec, list):
+        return spec
+    kind = spec[0]
+    if kind == "float":
+        return float(spec[1])
+    if kind == "fraction":
+        return Fraction(spec[1], spec[2])
+    if kind == "index":
+        return _Index(spec[1])
+    if kind == "numpy":
+        return getattr(np, spec[1])(spec[2])
+    if kind in ("str", "other"):
+        return spec[1]
+    return bool(spec[1]) if kind == "bool" else int(spec[1])
+
+
+class _Index:
+    def __init__(self, n):
+        self.n = n
+
+    def __index__(self):
+        return self.n
+
+
+def ceiling_of(spec):
+    """A ceiling argument: a CostStretch of the factor, or the raw value of another type."""
+    if isinstance(spec, list) and spec[0] == "other":
+        return spec[1]
+    return ngc.CostStretch(factor_of(spec))
+
+
+def error_text(error):
+    return f"TypeError: {error}" if isinstance(error, TypeError) else str(error)
+
+
+# -- splitting rules ----------------------------------------------------------------------------
+
+
+def split_on_parallel_links(n, weights):
+    """H(n, w) as the library splits it: one head, a tunnel of weight w_i on its own link."""
+    if n >= 1 << 62:
+        raise NotExposed("an amount at or above 2^62 is outside the library's domain")
+    m = len(weights)
+    g = ngc.Graph(2, [0] * m, [1] * m, [max(n, 1)] * m, [1] * m, 1.0)
+    tunnels = [
+        ngc.RouteDefinition(0, path_of(g, [e]), weight=w) for e, w in enumerate(weights)
+    ]
+    program = ngc.ForwardingProgram.from_routes(g, [0], [1], tunnels)
+    return [t.assigned for t in pinned(g, program, LY).place(n).by_tunnel]
+
+
+def run_ha(n, weights):
+    return split_on_parallel_links(n, weights)
+
+
+def split_report(n, weights, assigned):
+    total = sum(weights)
+    exact = [Fraction(n * w, total) for w in weights]
+    return dict(
+        assigned=assigned,
+        max_excess=max(Fraction(a) - x for a, x in zip(assigned, exact, strict=True)),
+        max_deficit=max(x - Fraction(a) for a, x in zip(assigned, exact, strict=True)),
+        below_k=all(
+            abs(a - x) < len(weights) for a, x in zip(assigned, exact, strict=True)
+        ),
+        below_one=all(abs(a - x) < 1 for a, x in zip(assigned, exact, strict=True)),
+    )
+
+
+def run_split_error(n, weights):
+    return split_report(n, weights, split_on_parallel_links(n, weights))
+
+
+def run_bound_sweep(max_total, max_members, max_weight):
+    # One program per weight vector; every total is an evaluation of it (nothing published).
+    cases = violations = equal_violations = 0
+    for k in range(1, max_members + 1):
+        g = ngc.Graph(2, [0] * k, [1] * k, [max(max_total, 1)] * k, [1] * k, 1.0)
+        for weights in itertools.product(range(max_weight + 1), repeat=k):
+            if not any(weights):
+                continue
+            tunnels = [
+                ngc.RouteDefinition(0, path_of(g, [e]), weight=w)
+                for e, w in enumerate(weights)
+            ]
+            p = pinned(g, ngc.ForwardingProgram.from_routes(g, [0], [1], tunnels), LY)
+            for n in range(max_total + 1):
+                cases += 1
+                assigned = [t.assigned for t in p.evaluate(n).by_tunnel]
+                r = split_report(n, list(weights), assigned)
+                violations += not r["below_k"]
+                if len(set(weights)) == 1:
+                    equal_violations += not r["below_one"]
+    return dict(cases=cases, violations=violations, equal_violations=equal_violations)
+
+
+def run_member_order(amount, order):
+    # The members of one split, taken in prepared (EdgeId) order: the member order[j] is link j.
+    k = len(order)
+    g = ngc.Graph(2, [0] * k, [1] * k, [max(amount, 1)] * k, [1] * k, 1.0)
+    program = ngc.ForwardingProgram.from_dag(g, [0], [1], dag_of(g, range(k)))
+    flows = (
+        pinned(g, program, LY)
+        .place(amount, ngc.OutputOptions(edge_flows=True))
+        .edge_flows.tolist()
+    )
+    result = [0] * k
+    for j, member in enumerate(order):
+        result[member] = flows[j]
+    return result
+
+
+def run_pooled(sources, members):
+    # Sources 0..s-1 each feed router s by a wide link; the router reaches s + 1 over `members`
+    # wide parallel links. Pooled: from_dag; independent: one split route per source.
+    s = len(sources)
+    if len(set(sources)) != 1:
+        raise NotExposed("unequal source amounts: a program's sources are equal")
+    rows = [(i, s, WIDE) for i in range(s)] + [(s, s + 1, WIDE)] * members
+    g = ngc.Graph(
+        s + 2,
+        [r[0] for r in rows],
+        [r[1] for r in rows],
+        [r[2] for r in rows],
+        [1] * len(rows),
+        1.0,
+    )
+    member_links = list(range(s, s + members))
+    whole = dag_of(g, range(len(rows)))
+    pooled_policy = pinned(
+        g, ngc.ForwardingProgram.from_dag(g, list(range(s)), [s + 1], whole), LY
+    )
+    flows = pooled_policy.place(
+        sum(sources), ngc.OutputOptions(edge_flows=True)
+    ).edge_flows.tolist()
+    records = sorted(pooled_policy.records(), key=lambda r: r.sources[0])
+    by_column = [
+        [dict(rec.edge_flows).get(e, 0) for rec in records] for e in member_links
+    ]
+    separate = ngc.ForwardingProgram.from_routes(
+        g, list(range(s)), [s + 1], [ngc.RouteDefinition(i, whole) for i in range(s)]
+    )
+    independent = (
+        pinned(g, separate, LY)
+        .place(sum(sources), ngc.OutputOptions(edge_flows=True))
+        .edge_flows.tolist()
+    )
+    return dict(
+        columns=[flows[e] for e in member_links],
+        source_by_column=by_column,
+        independent_columns=[independent[e] for e in member_links],
+    )
+
+
+# -- the ledger and the policy's operations ------------------------------------------------------
+
+
+def run_ledger(service, reservation, carried, strict, new_delivery, old_delivery):
+    # One link: a ShortestPaths policy carries `old_delivery` (then is replaced by `new_delivery`)
+    # and a DistributedTE policy holds `strict` for its design.
+    g = ngc.Graph(2, [0], [1], [max(service, reservation)], [1], 1.0)
+    ledger = ngc.FlowLedger(g, [service], reservation_baseline=[reservation])
+    carrier = policy(g, 0, 1, config(ngc.ShortestPaths(), LY), ledger=ledger)
+    assert carrier.place(old_delivery).call_delivered == carried
+    holder = policy(
+        g, 0, 1, config(ngc.DistributedTE(ngc.TunnelCount(1)), LY), ledger=ledger
+    )
+    holder.replace(0, design_demand=strict)
+    out = dict(
+        carried=int(ledger.carried()[0]),
+        residual=int(ledger.residual()[0]),
+        reserved=int(ledger.reserved()[0]),
+        unreserved=int(ledger.unreserved()[0]),
+    )
+    out["delivery_delta"] = carrier.replace(new_delivery).delivery_delta
+    return out
+
+
+def run_refusal(capacity, outside, calls):
+    # One link; another owner holds outside[c] at the entry of call c; a Lossless policy places
+    # each call; its delivery after each call. The rejected rule (re-offering refused units) is
+    # what the library must not do: only the correct sequence is reported.
+    g = ngc.Graph(2, [0], [1], [capacity], [1], 1.0)
+    ledger = ngc.FlowLedger(g)
+    other = policy(g, 0, 1, config(ngc.ShortestPaths()), ledger=ledger)
+    mine = policy(g, 0, 1, config(ngc.ShortestPaths()), ledger=ledger)
+    out = []
+    for load, offer in zip(outside, calls, strict=True):
+        other.replace(load)
+        out.append(mine.place(offer).delivered)
+    return dict(correct=out)
+
+
+def private_links(caps, costs=None):
+    """Sources 0..n-1, each with its own link to node n."""
+    n = len(caps)
+    return ngc.Graph(
+        n + 1, list(range(n)), [n] * n, list(caps), list(costs or [1] * n), 1.0
+    )
+
+
+def run_increments(caps, calls, admission, outside=None):
+    n = len(caps)
+    g = private_links(caps)
+    ledger = ngc.FlowLedger(g)
+    adm = getattr(ngc.Admission, admission)
+    others = [
+        policy(g, i, n, config(ngc.ShortestPaths()), ledger=ledger) for i in range(n)
+    ]
+    mine = policy(g, list(range(n)), n, config(ngc.ShortestPaths(), adm), ledger=ledger)
+    delivered, r = [], None
+    for c, v in enumerate(calls):
+        if outside is not None:
+            for i, load in enumerate(outside[c]):
+                others[i].replace(load)
+        r = mine.place(v)
+        delivered.append(r.call_delivered)
+    out = dict(
+        call_delivered=delivered,
+        requested=r.requested,
+        delivered=r.delivered,
+        unadmitted=r.unadmitted,
+        offered=r.offered,
+    )
+    if admission == "LOSSLESS":
+        out["admitted"] = r.admitted
+    else:
+        out["edge_drops"] = per_edge(r.edge_drops, n)
+    return out
+
+
+def run_epoch(cap, calls, full=False, admission="LOSSY"):
+    # ShortestPaths ECMP over parallel links.
+    k = len(cap)
+    g = ngc.Graph(2, [0] * k, [1] * k, list(cap), [1] * k, 1.0)
+    ledger = ngc.FlowLedger(g)
+    p = policy(
+        g,
+        0,
+        1,
+        config(ngc.ShortestPaths(), getattr(ngc.Admission, admission)),
+        ledger=ledger,
+    )
+    per_call, r = [], None
+    for v in [sum(calls)] if full else calls:
+        r = p.place(v)
+        per_call.append(r.call_delivered)
+    return dict(
+        requested=sum(calls),
+        delivered=r.delivered,
+        edge_drops=sum(x for _, x in r.edge_drops),
+        edge_flows=ledger.carried().tolist(),
+        residual=ledger.residual().tolist(),
+        per_call_delivery=per_call,
+    )
+
+
+def run_equal_increment(capacities, costs, calls):
+    # The equal-source controller: CentralizedTE EQUAL, sources with private links.
+    k = len(capacities)
+    g = private_links(capacities, costs)
+    ledger = ngc.FlowLedger(g)
+    p = policy(
+        g,
+        list(range(k)),
+        k,
+        config(ngc.CentralizedTE(source_allocation=S.EQUAL)),
+        ledger=ledger,
+    )
+    deliveries, r = [], None
+    for v in calls:
+        r = p.place(v)
+        deliveries.append(r.call_delivered)
+    return dict(
+        call_deliveries=deliveries,
+        allocation=ledger.carried().tolist(),
+        delivered=r.delivered,
+        cost=r.total_cost,
+    )
+
+
+def run_zero_state(service, outside):
+    # place(0) on a ShortestPaths policy without a prepared program, new and after remove(); another
+    # owner's tunnels hold `outside` (weights = its loads) on parallel links of capacities `service`.
+    k = len(service)
+    g = ngc.Graph(2, [0] * k, [1] * k, list(service), [1] * k, 1.0)
+    ledger = ngc.FlowLedger(g)
+    held = [
+        ngc.RouteDefinition(0, path_of(g, [e]), weight=w) for e, w in enumerate(outside)
+    ]
+    pinned(
+        g, ngc.ForwardingProgram.from_routes(g, [0], [1], held), ledger=ledger
+    ).place(sum(outside))
+    outputs = ngc.OutputOptions(
+        edge_flows=True, residual=True, edge_reservations=True, min_cut=True
+    )
+
+    def state(r):
+        return dict(
+            call_delivered=r.call_delivered,
+            call_undelivered=r.call_undelivered,
+            delivery_delta=r.delivery_delta,
+            call_edge_drops=r.call_edge_drops,
+            call_source_drops=r.call_source_drops,
+            termination=r.termination.name,
+            routes_changed=r.routes_changed,
+            weights_changed=r.weights_changed,
+            reservations_changed=r.reservations_changed,
+            program=r.program,
+            edge_flows=r.edge_flows.tolist(),
+            edge_reservations=r.edge_reservations.tolist(),
+            residual=r.residual.tolist(),
+            min_cut=r.min_cut,
+            marginal_cost_curve=r.marginal_cost_curve,
+        )
+
+    fresh = state(
+        policy(g, 0, 1, config(ngc.ShortestPaths()), ledger=ledger).place(0, outputs)
+    )
+    used = policy(g, 0, 1, config(ngc.ShortestPaths()), ledger=ledger)
+    used.place(1)
+    used.remove()
+    again = state(used.place(0, outputs))
+    assert again == fresh, (fresh, again)
+    return fresh
+
+
+def run_change_flags(path_cap, calls, recomputed):
+    # One link; a recomputed program (CentralizedTE) or a fixed one (Pinned over one tunnel).
+    g = ngc.Graph(2, [0], [1], [path_cap], [1], 1.0)
+    if recomputed:
+        p = policy(g, 0, 1, config(ngc.CentralizedTE(source_allocation=S.OPTIMIZED)))
+    else:
+        tunnel = [ngc.RouteDefinition(0, path_of(g, [0]))]
+        p = pinned(g, ngc.ForwardingProgram.from_routes(g, [0], [1], tunnel))
+    flags = []
+    for i, (op, v) in enumerate(calls):
+        r = getattr(p, op)(v)
+        if i:
+            flags.append(r)
+    return dict(
+        routes_changed=[r.routes_changed for r in flags],
+        weights_changed=[r.weights_changed for r in flags],
+        reservations_changed=[r.reservations_changed for r in flags],
+    )
+
+
+# -- programs: tunnels, split routes, the LOSSY rule ------------------------------------------------
+
+
+def run_lossy(offers, routes, cap, labels=None):
+    """Routes of link indices carrying their offers. Each demand of the labels is one source of
+    the program (a demand's routes are its tunnels, weights = offers), so a link splits by highest
+    averages over sources, then tunnels: the labels' demand-then-tunnel order. Several demands must
+    offer equal totals (a program's sources are equal)."""
+    labels = labels or [[i, 0, 0] for i in range(len(offers))]
+    demands = [lab[0] for lab in labels]
+    if len(set(demands)) == len(demands):
+        groups = (
+            None  # one tunnel per demand: one head, split by H over the routes' offers
+        )
+        total = sum(offers)
+    else:
+        totals = {}
+        for d, o in zip(demands, offers, strict=True):
+            totals[d] = totals.get(d, 0) + o
+        if len(set(totals.values())) != 1:
+            raise NotExposed("demands with unequal totals")
+        groups = demands
+        total = sum(offers)
+    g, links, program = laid_out_tunnels(cap, routes, offers, groups)
+    p = pinned(g, program, LY)
+    try:
+        r = p.place(total, ngc.OutputOptions(edge_flows=True))
+    except ValueError as e:
+        return dict(error=str(e))
+    flows = r.edge_flows.tolist()
+    drops = per_edge(r.call_edge_drops, g.num_edges())
+    carried, edge_drops = [], []
+    records = {rec.entry_id: rec for rec in p.records()}
+    for i, route in enumerate(routes):
+        rec_flows = dict(records[i].edge_flows) if i in records else {}
+        rec_drops = dict(records[i].edge_drops) if i in records else {}
+        carried.append([rec_flows.get(links[e], 0) for e in route])
+        edge_drops.append([rec_drops.get(links[e], 0) for e in route])
+    return dict(
+        carried=carried,
+        edge_drops=edge_drops,
+        delivered=[t.delivered for t in r.by_tunnel],
+        edge_flows=[flows[links[e]] for e in range(len(cap))],
+        link_drops=[drops[links[e]] for e in range(len(cap))],
+    )
+
+
+def run_bound(cap, routes, weights):
+    # One head, a tunnel per route of the given weight: the Lossless bound of the program.
+    g, _, program = laid_out_tunnels(cap, routes, weights)
+    return pinned(g, program).place(INF).call_delivered
+
+
+def run_split_contexts(cap, routes, weights, pool):
+    # One head, split routes whose members are parallel links to the destination. Separate: one
+    # split route per entry (from_routes); pooled: the one shared context of from_dag.
+    k = len(cap)
+    g = ngc.Graph(2, [0] * k, [1] * k, list(cap), [1] * k, 1.0)
+    if pool:
+        if len({tuple(r) for r in routes}) != 1:
+            raise NotExposed("pooled routes with different members")
+        program = ngc.ForwardingProgram.from_dag(g, [0], [1], dag_of(g, routes[0]))
+    else:
+        program = ngc.ForwardingProgram.from_routes(
+            g,
+            [0],
+            [1],
+            [
+                ngc.RouteDefinition(0, dag_of(g, r), weight=w)
+                for r, w in zip(routes, weights, strict=True)
+            ],
+        )
+    bound = pinned(g, program).place(INF).call_delivered
+    r = pinned(g, program, LY).place(2, ngc.OutputOptions(edge_flows=True))
+    drops = per_edge(r.call_edge_drops, k)
+    return dict(
+        bound=bound,
+        loads_at_2=[f + d for f, d in zip(r.edge_flows.tolist(), drops, strict=True)],
+    )
+
+
+def run_dag_contexts(edges, sources, destination, offer, pooled):
+    g = graph_of(edges)
+    whole = dag_of(g, range(len(edges)))
+    if pooled:
+        program = ngc.ForwardingProgram.from_dag(g, sources, [destination], whole)
+    else:
+        program = ngc.ForwardingProgram.from_routes(
+            g, sources, [destination], [ngc.RouteDefinition(s, whole) for s in sources]
+        )
+    return dict(
+        lossless_bound=pinned(g, program).place(INF).call_delivered,
+        lossy_delivered=pinned(g, program, LY).place(offer).call_delivered,
+    )
+
+
+def run_stale_dag(
+    edges, sources, destinations, offer, weights,
+    black_links=(), black_nodes=(), mask_links=(), mask_nodes=(),
+):  # fmt: skip
+    # One split route (from_dag of the member links, WEIGHTED by the given frozen weights) forwarded
+    # by Pinned under the repair mask, with the black holes laid over.
+    g = graph_of(edges)
+    members = [e for e, w in enumerate(weights) if w is not None]
+    program = ngc.ForwardingProgram.from_dag(
+        g,
+        sources,
+        [destinations],
+        dag_of(g, members),
+        allocation=ngc.RouteAllocation.WEIGHTED,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[w or 0 for w in weights],
+    )
+    p = pinned(
+        g,
+        program,
+        LY,
+        mask=edge_mask(g, mask_links, mask_nodes),
+        black_holes=edge_mask(g, black_links, black_nodes),
+    )
+    r = p.place(offer, ngc.OutputOptions(edge_flows=True))
+    return dict(
+        delivered=r.call_delivered,
+        edge_flows=r.edge_flows.tolist(),
+        edge_drops=per_edge(r.call_edge_drops, len(edges)),
+        source_drops=r.call_source_drops,
+    )
+
+
+def run_stale_paths(
+    edges, tunnels, offers, black_links=(), black_nodes=(), mask_links=(), mask_nodes=()
+):
+    # Tunnels from their heads (one program; each head its own source, offers equal), forwarded by
+    # Pinned under the repair mask with the black holes laid over.
+    g = graph_of(edges)
+    heads = sorted({h for h, _ in tunnels})
+    if len({offers[h] for h in heads}) != 1:
+        raise NotExposed("heads with unequal offers")
+    program = ngc.ForwardingProgram.from_routes(
+        g,
+        heads,
+        sorted({edges[p[-1]][1] for _, p in tunnels}),
+        [ngc.RouteDefinition(h, path_of(g, p)) for h, p in tunnels],
+    )
+    mask = edge_mask(g, mask_links, mask_nodes)
+    holes = edge_mask(g, black_links, black_nodes)
+    total = sum(offers[h] for h in heads)
+    try:
+        r = pinned(g, program, LY, mask=mask, black_holes=holes).place(total)
+    except ValueError as e:
+        return dict(error=str(e))
+    out = dict(
+        status=[t.status.name for t in r.by_tunnel],
+        assigned=[t.assigned for t in r.by_tunnel],
+        delivered=[t.delivered for t in r.by_tunnel],
+        edge_drops=per_edge(r.call_edge_drops, len(edges)),
+        source_drops=r.call_source_drops,
+    )
+    if len(heads) == 1 and not r.call_source_drops:
+        out["lossless_admitted"] = (
+            pinned(g, program, mask=mask, black_holes=holes).place(total).call_delivered
+        )
+    return out
+
+
+def run_termination(offer, model=None, args=None, program=None):
+    # The installed program decides: a T1 or T2 setup, or a program of tunnels (head, path,
+    # weight) on one link per head.
+    if model is not None:
+        g = graph_of(args["edges"])
+        count = ngc.TunnelCount(args["per_head"])
+        if model == "t1":
+            routing = ngc.DistributedTE(count)
+        else:
+            routing = ngc.CentralizedTE(source_allocation=S.EQUAL, tunnel_count=count)
+        p = policy(g, args["heads"], args["destinations"], config(routing, LY))
+        r = p.replace(offer, design_demand=args.get("design_demand"))
+        installed = p.program
+        forward_error = None
+        try:
+            p.forward(offer)
+        except ValueError as e:
+            forward_error = str(e)
+        lossless = pinned(g, installed).place(offer).termination.name
+    else:
+        roster, entries = program
+        n = 1 + max(roster)
+        g = ngc.Graph(n + 1, list(range(n)), [n] * n, [WIDE] * n, [1] * n, 1.0)
+        routes = []
+        for head, has_path, weight in entries:
+            if not has_path:
+                raise NotExposed("an entry without a path")
+            routes.append(ngc.RouteDefinition(head, path_of(g, [head]), weight=weight))
+        installed = ngc.ForwardingProgram.from_routes(g, roster, [n], routes)
+        p = pinned(g, installed, LY)
+        r = p.place(offer)
+        forward_error = None
+        lossless = pinned(g, installed).place(offer).termination.name
+    return dict(
+        tunnels=len(installed.tunnels),
+        lossy=r.termination.name,
+        lossless=lossless,
+        source_drops=[row.source_drops for row in r.by_source if row.source_drops],
+        forward_error=forward_error,
+    )
+
+
+# -- the tunnel models ------------------------------------------------------------------------------
+
+
+def t1_routing(per_head, absolute=None, stretch=None, minimum=0):
+    ceiling = None
+    if absolute is not None:
+        ceiling = ngc.AbsoluteCost(absolute)
+    elif stretch is not None:
+        ceiling = ceiling_of(stretch)
+    return ngc.DistributedTE(
+        ngc.TunnelCount(per_head),
+        cost_ceiling=ceiling,
+        min_unreserved_bandwidth=minimum,
+    )
+
+
+def run_t1(
+    edges, heads, destinations, design_demand, per_head, offer=None,
+    excluded=(), absolute=None, stretch=None, minimum=0,
+):  # fmt: skip
+    g = graph_of(edges)
+    mask = edge_mask(g, excluded)
+    try:
+        routing = t1_routing(per_head, absolute, stretch, minimum)
+        ledger = ngc.FlowLedger(g)
+        setup = policy(g, heads, destinations, config(routing), mask, ledger)
+    except (TypeError, ValueError) as e:
+        return dict(error=error_text(e))
+    r = setup.replace(INF, design_demand=design_demand)
+    tunnels = r.program.tunnels
+    out = dict(
+        requested_bandwidth=[t.requested_bandwidth for t in tunnels],
+        routes=[list(t.edges) if t.edges is not None else [] for t in tunnels],
+        status=[t.status.name for t in tunnels],
+        up=sum(t.status == ngc.TunnelStatus.UP for t in tunnels),
+        total_reserved_bandwidth=r.plan.total_reserved_bandwidth,
+        edge_reservations=ledger.reserved().tolist(),
+        bound=r.call_delivered,
+    )
+    if offer is not None:
+        lossy = policy(g, heads, destinations, config(routing, LY), mask).replace(
+            offer, design_demand=design_demand
+        )
+        assigned = [t.assigned for t in lossy.by_tunnel]
+        load = [0] * len(edges)
+        for t, a in zip(lossy.program.tunnels, assigned, strict=True):
+            for e in t.edges or ():
+                load[e] += a
+        lossless = policy(g, heads, destinations, config(routing), mask).replace(
+            offer, design_demand=design_demand
+        )
+        out.update(
+            offered_by_entry=assigned,
+            source_drops=lossy.call_source_drops,
+            no_drop_load=load,
+            lossy_delivery=lossy.call_delivered,
+            lossy_edge_drops=per_edge(lossy.call_edge_drops, len(edges)),
+            lossless_admitted=lossless.call_delivered,
+            lossless_unadmitted=lossless.call_undelivered,
+        )
+    return out
+
+
+def run_head_requests(heads, per_head, design_demand):
+    # T1's requests in program order, heads with one wide link each.
+    g = ngc.Graph(
+        heads + 1, list(range(heads)), [heads] * heads, [WIDE] * heads, [1] * heads, 1.0
+    )
+    p = policy(
+        g,
+        list(range(heads)),
+        heads,
+        config(ngc.DistributedTE(ngc.TunnelCount(per_head)), LY),
+    )
+    r = p.replace(0, design_demand=design_demand)
+    return [t.requested_bandwidth for t in r.program.tunnels]
+
+
+def t2_policy(
+    edges,
+    heads,
+    destinations,
+    count,
+    prefer_headroom,
+    admission,
+    cap=None,
+    support=None,
+    excluded=(),
+):
+    g = graph_of(edges)
+    routing = ngc.CentralizedTE(
+        source_allocation=S.EQUAL,
+        support=None if support is None else dag_of(g, support),
+        tunnel_count=count,
+        prefer_headroom=prefer_headroom,
+    )
+    ledger = ngc.FlowLedger(g, cap)
+    return policy(
+        g,
+        heads,
+        destinations,
+        config(routing, admission),
+        edge_mask(g, excluded),
+        ledger,
+    )
+
+
+def run_t2(
+    edges, heads, destinations, per_head, design_demand=None, cap=None,
+    prefer_headroom=False, lossy_offer=None, support=None, excluded=(),
+):  # fmt: skip
+    count = ngc.TunnelCount(per_head)
+    p = t2_policy(
+        edges, heads, destinations, count, prefer_headroom, LL, cap, support, excluded
+    )
+    r = p.replace(INF, design_demand=design_demand)
+    plan = r.plan
+    tunnels = r.program.tunnels
+    counts = [0] * len(edges)
+    for t in tunnels:
+        for e in t.edges:
+            counts[e] += 1
+    out = dict(
+        heads_with_capacity=list(plan.heads_with_capacity),
+        max_fractional_bandwidth_per_tunnel=plan.max_fractional_bandwidth_per_tunnel,
+        max_bandwidth_per_tunnel=plan.max_bandwidth_per_tunnel,
+        planned_bandwidth_per_tunnel=plan.planned_bandwidth_per_tunnel,
+        total_planned_bandwidth=plan.total_planned_bandwidth,
+        total_tunnel_cost=plan.total_tunnel_cost,
+        headroom_penalty=plan.headroom_penalty,
+        max_lossless_offer=plan.max_lossless_offer,
+        insufficient_resolution=plan.insufficient_resolution,
+        design_by_head=[list(x) for x in plan.design_by_head],
+        tunnels_per_head=plan.tunnels_per_head,
+        counts=counts,
+        paths=[list(t.edges) for t in tunnels],
+        entry_ids=[t.entry_id for t in tunnels],
+    )
+    if lossy_offer is not None:
+        q = t2_policy(
+            edges,
+            heads,
+            destinations,
+            count,
+            prefer_headroom,
+            LY,
+            cap,
+            support,
+            excluded,
+        )
+        lr = q.replace(lossy_offer, design_demand=design_demand)
+        out.update(
+            lossy_delivery=lr.call_delivered, lossy_source_drops=lr.call_source_drops
+        )
+    return out
+
+
+def run_upto(
+    edges, heads, destinations, limit, design_demand=None, prefer_headroom=False
+):
+    count = ngc.TunnelCount(limit, up_to=True)
+    p = t2_policy(edges, heads, destinations, count, prefer_headroom, LL)
+    offer = INF if design_demand is None else design_demand
+    r = p.replace(offer, design_demand=design_demand)
+    return dict(
+        tunnels_per_head=r.plan.tunnels_per_head,
+        delivered=r.call_delivered,
+        paths=[list(t.edges) for t in r.program.tunnels],
+    )
+
+
+# -- the controllers ------------------------------------------------------------------------------
+
+
+def run_flow(edges, heads, destinations, limit, source_allocation="EQUAL"):
+    g = graph_of(edges)
+    routing = ngc.CentralizedTE(source_allocation=getattr(S, source_allocation))
+    r = policy(g, heads, destinations, config(routing)).place(
+        limit, ngc.OutputOptions(edge_flows=True)
+    )
+    return dict(
+        delivered=r.call_delivered, cost=r.total_cost, edge_flows=r.edge_flows.tolist()
+    )
+
+
+def run_min_cut(edges, heads, destinations):
+    g = graph_of(edges)
+    routing = ngc.CentralizedTE(source_allocation=S.OPTIMIZED)
+    r = policy(g, heads, destinations, config(routing)).place(
+        INF, ngc.OutputOptions(min_cut=True)
+    )
+    return dict(value=r.call_delivered, cut=r.min_cut)
+
+
+def run_residual_witness(edges, flow, source, sink, value, potentials):
+    # The library's minimum cost at the value (CentralizedTE up to `value`), against the given
+    # flow's cost; the cycle costs are the given flow's residual structure (a property of the
+    # example's flow, read here, not of a library result).
+    g = graph_of(edges)
+    r = policy(
+        g, source, sink, config(ngc.CentralizedTE(source_allocation=S.OPTIMIZED))
+    ).place(value)
+    assert r.call_delivered == value
+    cost = sum(f * e[3] for f, e in zip(flow, edges, strict=True))
+    residual, positive = [], []
+    for (a, b, cap, c), f in zip(edges, flow, strict=True):
+        if f < cap:
+            residual.append((a, b, c))
+        if f:
+            residual.append((b, a, -c))
+            positive.append((a, b, c))
+    return dict(
+        value=value,
+        cost=cost,
+        minimum_cost_at_value=r.total_cost,
+        is_minimum_cost=cost == r.total_cost,
+        positive_flow_cycle_costs=cycle_costs(positive),
+        residual_cycle_costs=cycle_costs(residual),
+    )
+
+
+def cycle_costs(arcs):
+    """The costs of the simple cycles of a small arc list (u, v, cost), each cycle once."""
+    nodes = {x for a, b, _ in arcs for x in (a, b)}
+    found = set()
+
+    def walk(start, u, seen, ids):
+        for i, (a, b, _) in enumerate(arcs):
+            if a != u:
+                continue
+            if b == start:
+                cycle = ids + [i]
+                found.add(min(tuple(cycle[k:] + cycle[:k]) for k in range(len(cycle))))
+            elif b not in seen:
+                walk(start, b, seen | {b}, ids + [i])
+
+    for start in sorted(nodes):
+        walk(start, start, {start}, [])
+    return sorted(sum(arcs[i][2] for i in cycle) for cycle in found)
+
+
+def run_evaluate_offer(capacities, offer=None):
+    # ECMP LOSSY from node 0 over parallel links to node 1 (equal costs: EdgeId = input position):
+    # the baseline, each deletion, and the baseline's accounting (requested, offered, the drop on
+    # each link).
+    k = len(capacities)
+    g = ngc.Graph(2, [0] * k, [1] * k, list(capacities), [1] * k, 1.0)
+    opts = ngc.EvaluationOptions(config(ngc.ShortestPaths(), LY), offer=offer)
+    s = ngc.evaluate_edge_failures(g, 0, 1, opts, 1)
+    return dict(
+        baseline=s.baseline.call_delivered,
+        delivery_reduction=per_edge(
+            [(x.edge, x.delivery_reduction) for x in s.entries], k
+        ),
+        requested=s.baseline.requested,
+        offered=s.baseline.offered,
+        edge_drops=per_edge(s.baseline.edge_drops, k),
+    )
+
+
+# -- searches and the route choice ------------------------------------------------------------------
+
+
+def run_search(
+    edges, source, destinations, residual=None, min_residual=1, k=None, stretch=None
+):
+    g = graph_of(edges)
+    try:
+        if k is not None:
+            options = ngc.KspOptions(
+                k,
+                cost_ceiling=None if stretch is None else ceiling_of(stretch),
+                residual=residual,
+            )
+            found = ngc.ksp(g, source, destinations, options)
+            return dict(paths=[[cost, [h[0] for h in p.hops()]] for cost, p in found])
+        options = ngc.SpfOptions(
+            ngc.Direction.FORWARD,
+            targets=[destinations],
+            residual=residual,
+            min_residual=min_residual,
+        )
+        r = ngc.spf(g, source, options)
+    except (TypeError, ValueError) as e:
+        return dict(error=error_text(e))
+    if r.target_cost is None or r.target_cost == ngc.UNREACHABLE:
+        return dict(distance=None, dag=[])
+    return dict(distance=r.target_cost, dag=sorted(r.dag.via_edges().tolist()))
+
+
+def run_tie_choice(edges, source, destination, available=None):
+    # The single path spf chooses under each RouteTieBreak (availability: the residual).
+    g = graph_of(edges)
+    out = {}
+    for tie in ngc.RouteTieBreak.__members__.values():
+        options = ngc.SpfOptions(
+            ngc.Direction.FORWARD,
+            targets=[destination],
+            tie_break=tie,
+            multipath=False,
+            residual=available,
+        )
+        out[tie.name] = sorted(ngc.spf(g, source, options).dag.via_edges().tolist())
+    return out
+
+
+def run_stretch_values(factors, equal_pairs=()):
+    values = []
+    for spec in factors:
+        try:
+            f = ngc.CostStretch(factor_of(spec)).factor
+            values.append(f"{f.numerator}/{f.denominator}")
+        except TypeError:
+            values.append("TypeError")
+        except ValueError as e:
+            values.append(str(e))
+    equal = [
+        ngc.CostStretch(factor_of(a)) == ngc.CostStretch(factor_of(b))
+        for a, b in equal_pairs
+    ]
+    return dict(values=values, equal=equal)
+
+
+# -- configuration, evaluation and texts ------------------------------------------------------------
+
+# 0 -> 1 (e0), 0 -> 2 (e1), 1 -> 2 (e2): one source is [0], two are [0, 1]; the destination is 2.
+CONFIG_EDGES = [[0, 1, 5, 1], [0, 2, 5, 1], [1, 2, 5, 1]]
+ENUMS = {
+    "allocation": ngc.RouteAllocation,
+    "source_allocation": ngc.SourceAllocation,
+    "weight_basis": ngc.WeightBasis,
+    "tie_break": ngc.RouteTieBreak,
+}
+MODELS = {
+    "ShortestPaths": ngc.ShortestPaths,
+    "DistributedTE": lambda tunnel_count, **kw: ngc.DistributedTE(tunnel_count, **kw),
+    "CentralizedTE": ngc.CentralizedTE,
+    "Pinned": lambda program, **kw: ngc.Pinned(program, **kw),
+    "FlowPolicyConfig": ngc.FlowPolicyConfig,
+}
+
+
+def config_program(g, spec):
+    """A program of the configuration graph: "p" from 0 to 2, or {"sources", "destinations"}."""
+    if spec == "p":
+        spec = {"sources": [0], "destinations": [2]}
+    (d,) = spec["destinations"]
+    route = path_of(g, [0 if d == 1 else 1])
+    return ngc.ForwardingProgram.from_routes(
+        g, spec["sources"], [d], [ngc.RouteDefinition(0, route)]
+    )
+
+
+def config_argument(g, key, value):
+    if key in ENUMS and isinstance(value, str):
+        return getattr(ENUMS[key], value)
+    if key == "tunnel_count":
+        count, *up_to = value.split()
+        return ngc.TunnelCount(int(count), up_to=up_to == ["up_to"])
+    if key == "cost_ceiling":
+        return ceiling_of(value)
+    if key == "support":
+        return dag_of(g, [1])
+    if key == "program":
+        return config_program(g, value)
+    if key == "routing":
+        return ngc.ShortestPaths()
+    return value
+
+
+def resolved(routing):
+    def name(v):
+        return "None" if v is None else v.name
+
+    if isinstance(routing, ngc.ShortestPaths):
+        return (
+            f"allocation={name(routing.allocation)}"
+            f" source_allocation={name(routing.source_allocation)}"
+            f" weight_basis={name(routing.weight_basis)}"
+            f" tie_break={name(routing.tie_break)}"
+            f" multipath={routing.multipath} parallel_edges={routing.parallel_edges}"
+        )
+    if isinstance(routing, ngc.CentralizedTE):
+        t = routing.tunnel_count
+        count = "None" if t is None else f"{t.per_head}" + (" up_to" if t.up_to else "")
+        return (
+            f"source_allocation={name(routing.source_allocation)}"
+            f" support={'None' if routing.support is None else 'dag'}"
+            f" tunnel_count={count} prefer_headroom={routing.prefer_headroom}"
+        )
+    return "valid"
+
+
+def config_case(
+    model, kwargs, sources=1, admission="LOSSLESS", cache=False, endpoints=None
+):
+    g = graph_of(CONFIG_EDGES)
+    try:
+        value = MODELS[model](
+            **{k: config_argument(g, k, v) for k, v in kwargs.items()}
+        )
+    except TypeError as e:
+        text = str(e)
+        return (
+            f"TypeError: {text}"
+            if text == "cost_ceiling must be AbsoluteCost, CostStretch or None"
+            else "TypeError"
+        )
+    if model == "FlowPolicyConfig":
+        return "constructed"
+    cfg = ngc.FlowPolicyConfig(
+        routing=value, admission=getattr(ngc.Admission, admission)
+    )
+    src, dst = ([0], [2]) if sources == 1 else ([0, 1], [2])
+    if endpoints is not None:
+        src, dst = endpoints
+    tunnels = isinstance(value, ngc.DistributedTE) or (
+        isinstance(value, ngc.CentralizedTE) and value.tunnel_count is not None
+    )
+    try:
+        p = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            src,
+            dst,
+            cfg,
+            None,
+            ngc.ShortestPathCache(g) if cache else None,
+        )
+    except ValueError as e:
+        return str(e)
+    (p.replace if tunnels else p.place)(0)
+    return resolved(p.config.routing)
+
+
+def run_model_config(cases):
+    return [config_case(**c) for c in cases]
+
+
+def evaluation_case(
+    model, kwargs, admission="LOSSLESS", offer=None, design_demand=None, sources=1
+):
+    g = graph_of(CONFIG_EDGES)
+    fields = {k: config_argument(g, k, v) for k, v in kwargs.items()}
+    if model == "Pinned":
+        routing = ngc.Pinned(fields["program"])
+    elif model == "DistributedTE":
+        routing = ngc.DistributedTE(fields.pop("tunnel_count"), **fields)
+    else:
+        routing = MODELS[model](**fields)
+    try:
+        options = ngc.EvaluationOptions(
+            config(routing, getattr(ngc.Admission, admission)),
+            offer=offer,
+            design_demand=design_demand,
+        )
+    except TypeError:
+        return "TypeError"
+    src = [0] if sources == 1 else [0, 1]
+    try:
+        r = ngc.evaluate_demand(g, src, 2, options)
+    except ValueError as e:
+        return str(e)
+    if r.requested == INF and r.by_source[0].offered is not None:
+        evaluated = "first-hop experiment"
+    else:
+        evaluated = r.requested
+    design = None if r.plan is None else r.plan.design_demand
+    return f"offer={evaluated} design_demand={design}"
+
+
+def run_evaluation_validation(cases):
+    return [evaluation_case(**c) for c in cases]
+
+
+def run_ownership_texts(objects):
+    # Each object of another graph where it is used.
+    g = graph_of(CONFIG_EDGES)
+    other = graph_of(CONFIG_EDGES)
+    mine = config_program(g, "p")
+    out = []
+    for name in objects:
+        try:
+            if name == "program":
+                policy(g, 0, 2, config(ngc.Pinned(config_program(other, "p"))))
+            elif name == "support":
+                cte = ngc.CentralizedTE(
+                    source_allocation=S.OPTIMIZED, support=dag_of(other, [1])
+                )
+                policy(g, 0, 2, config(cte))
+            elif name == "black_holes":
+                policy(
+                    g, 0, 2, config(ngc.Pinned(mine, black_holes=other.eligibility()))
+                )
+            elif name == "Eligibility":
+                policy(
+                    g,
+                    0,
+                    2,
+                    config(ngc.ShortestPaths()),
+                    other.eligibility(excluded_edges=[0]),
+                )
+            elif name == "ShortestPathCache":
+                ngc.FlowPolicy(
+                    ngc.FlowLedger(g),
+                    0,
+                    2,
+                    config(ngc.ShortestPaths()),
+                    None,
+                    ngc.ShortestPathCache(other),
+                )
+            elif name == "dag":
+                ngc.ForwardingProgram.from_dag(g, [0], [2], dag_of(other, [1]))
+            out.append(None)
+        except ValueError as e:
+            out.append(str(e))
+    return out
+
+
+def run_input_texts(cases):
+    out = []
+    for c in cases:
+        caps = c["capacities"]
+        k = len(caps)
+        g = ngc.Graph(2, [0] * k, [1] * k, list(caps), [1] * k, 1.0)
+        row = []
+        try:
+            routing = ngc.DistributedTE(
+                ngc.TunnelCount(1),
+                min_unreserved_bandwidth=c["min_unreserved_bandwidth"],
+            )
+            policy(g, 0, 1, config(routing))
+            row.append(None)
+        except ValueError as e:
+            row.append(str(e))
+        for baseline in c["reservation_baseline"]:
+            try:
+                ngc.FlowLedger(g, reservation_baseline=baseline)
+                row.append(None)
+            except ValueError as e:
+                row.append(str(e))
+        out.append(row)
+    return out
+
+
+class IndexOnly:
+    """An integer known only through __index__."""
+
+    def __init__(self, n):
+        self.n = n
+
+    def __index__(self):
+        return self.n
+
+
+class FloatOnly:
+    """A number known only through __float__."""
+
+    def __init__(self, x):
+        self.x = x
+
+    def __float__(self):
+        return float(self.x)
+
+
+def input_value(spec):
+    """An example's argument: itself, or ["bool", b], ["float", x] ("inf", "-inf" and "nan" as
+    text), ["str", s], ["none"], ["fraction", n, d], ["decimal", s], ["floatonly", x] (FloatOnly),
+    ["index", n] (IndexOnly), ["pow2", n] (the int 2**n), ["numpy", type name, value], ["list",
+    spec, ...] or ["array", dtype, nested list]."""
+    if not isinstance(spec, list):
+        return spec
+    kind, rest = spec[0], spec[1:]
+    if kind == "list":
+        return [input_value(x) for x in rest]
+    if kind == "array":
+        return np.array(rest[1], dtype=rest[0])
+    if kind == "numpy":
+        return getattr(np, rest[0])(rest[1])
+    return {
+        "bool": lambda: bool(rest[0]),
+        "float": lambda: float(rest[0]),
+        "str": lambda: rest[0],
+        "none": lambda: None,
+        "fraction": lambda: Fraction(rest[0], rest[1]),
+        "decimal": lambda: Decimal(rest[0]),
+        "floatonly": lambda: FloatOnly(rest[0]),
+        "index": lambda: IndexOnly(rest[0]),
+        "pow2": lambda: 2 ** rest[0],
+    }[kind]()
+
+
+def input_class(call, *args):
+    """ "valid", or the input error of call(*args) as "<class>: <text>" (TypeError or ValueError
+    exactly)."""
+    try:
+        call(*args)
+    except (TypeError, ValueError) as e:
+        assert type(e) in (TypeError, ValueError), type(e)
+        return f"{type(e).__name__}: {e}"
+    return "valid"
+
+
+def run_input_classes(cases):
+    """Each value at its position: an spf or ksp search option (read at the call), place's offer
+    (on a fresh policy), a ledger's service baseline over links of capacities `caps`, or one Place
+    of a LOSSY ShortestPaths policy of a fresh ledger in an ORDERED apply_actions list, with the
+    case's ledger (the policy's own, or None)."""
+    g = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+    forward = ngc.Direction.FORWARD
+
+    def baseline(v, caps):
+        k = len(caps)
+        return ngc.FlowLedger(ngc.Graph(2, [0] * k, [1] * k, caps, [1] * k, 1.0), v)
+
+    def listed(v, _):
+        ledger = ngc.FlowLedger(g)
+        p = policy(g, 0, 1, config(ngc.ShortestPaths(), LY), ledger=ledger)
+        action = ngc.Place(p, input_value(v["offer"]))  # its construction comes first
+        own = None if input_value(v["ledger"]) is None else ledger
+        return ngc.apply_actions(own, [action])
+
+    calls = {
+        "spf min_residual": lambda v, _: ngc.spf(
+            g, 0, ngc.SpfOptions(forward, min_residual=v)
+        ),
+        "ksp k": lambda v, _: ngc.ksp(g, 0, 1, ngc.KspOptions(v)),
+        "place offer": lambda v, _: policy(g, 0, 1, config(ngc.ShortestPaths())).place(
+            v
+        ),
+        "service_baseline": baseline,
+        "apply_actions": listed,
+    }
+    out = []
+    for case in cases:
+        call, caps = calls[case["entry"]], case.get("caps")
+        out.append([input_class(call, input_value(v), caps) for v in case["values"]])
+    return out
+
+
+def number_outcome(call, report=False):
+    """ "valid" ("valid <result>" when reported), or the error as "<class>: <text>", pybind11's
+    refusal of an argument's type as "TypeError: pybind11 conversion"."""
+    try:
+        got = call()
+    except (TypeError, ValueError) as e:
+        assert type(e) in (TypeError, ValueError), type(e)
+        if type(e) is TypeError and "incompatible" in str(e):
+            return "TypeError: pybind11 conversion"
+        return f"{type(e).__name__}: {e}"
+    if not report:
+        return "valid"
+    return f"valid {got.tolist() if isinstance(got, np.ndarray) else got}"
+
+
+def run_number_types(cases):
+    """Each value at its position: a resolution (Graph, to_units and as_float, which must agree),
+    to_units' physical value at the case's resolution (reported: the units), as_float's integer
+    amount, or place's offer (on a fresh policy)."""
+    g = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+
+    def resolution(q):
+        outcomes = {
+            number_outcome(lambda: ngc.Graph(2, [0], [1], [1], [1], q)),
+            number_outcome(lambda: ngc.to_units(1.0, q)),
+            number_outcome(lambda: ngc.as_float(1, q)),
+        }
+        assert len(outcomes) == 1, outcomes
+        return outcomes.pop()
+
+    out = []
+    for case in cases:
+        entry = case["entry"]
+        row = []
+        for spec in case["values"]:
+            v = input_value(spec)
+            if entry == "resolution":
+                row.append(resolution(v))
+            elif entry == "to_units":
+                q = input_value(case.get("resolution", 1.0))
+                row.append(number_outcome(lambda v=v, q=q: ngc.to_units(v, q), True))
+            elif entry == "as_float x":
+                row.append(number_outcome(lambda v=v: ngc.as_float(v, 1.0)))
+            else:
+                p = policy(g, 0, 1, config(ngc.ShortestPaths()))
+                row.append(number_outcome(lambda v=v, p=p: p.place(v)))
+        out.append(row)
+    return out
+
+
+# -- several demands at once (apply_actions) ---------------------------------------------------
+
+
+def fused_links(offers, routes, cap, dark=None):
+    """Per example link the link it is fused to (-1: none): every occurrence of e that can carry
+    something continues on f and every such occurrence of f comes from e. A zero offer carries
+    nothing, and a route's traffic stops at its own black hole (which still arrives from the link
+    before it). A pair that would make a route visit a node twice (a dead occurrence on e going
+    elsewhere and one on f) is joined instead: a tunnel is a simple path."""
+    dark = dark or [()] * len(routes)
+    nxt = [set() for _ in cap]
+    prv = [set() for _ in cap]
+    for r, o, holes in zip(routes, offers, dark, strict=True):
+        if not o:
+            continue
+        for j, e in enumerate(r):
+            prv[e].add(r[j - 1] if j > 0 else -1)
+            if e in holes:
+                break
+            nxt[e].add(r[j + 1] if j + 1 < len(r) else -1)
+    out = [-1] * len(cap)
+    for e, s in enumerate(nxt):
+        f = next(iter(s)) if len(s) == 1 else -1
+        if f >= 0 and prv[f] == {e}:
+            out[e] = f
+    L = len(cap)
+    changed = True
+    while changed:
+        changed = False
+        for r in routes:
+            # Its nodes: a tail is e, a head L + e (a fused head is the next link's tail).
+            nodes = [r[0]]
+            for j, e in enumerate(r):
+                nodes.append(out[e] if out[e] >= 0 else L + e)
+                if j + 1 < len(r) and out[e] != r[j + 1]:
+                    nodes.append(r[j + 1])
+            if len(set(nodes)) == len(nodes):
+                continue
+            for j, e in enumerate(r):
+                if out[e] >= 0 and (j + 1 == len(r) or out[e] != r[j + 1]):
+                    out[e] = -1  # e without its f
+                if j == 0 or out[r[j - 1]] != e:
+                    out = [-1 if g == e else g for g in out]  # f without its e
+            changed = True
+    return out
+
+
+# How run_list_lossy realizes a route (as list_lossy in contract_examples_tests.cpp): a tunnel; the
+# same links as a supplied DAG route alone (a pooled context); that DAG route beside a tunnel on its
+# head's own exit (a split route of a program that is not pooled), offered twice the route's offer;
+# a DAG route of the route's links plus that exit beside the exit tunnel, offered 2, so round robin
+# sends the DAG route's unit to the exit and every member on the route has a whole-unit share of 0;
+# a tunnel or a DAG route in route 0's program, of weight its offer (0: an empty entry; no
+# participant of its own), route 0 then offered `offer0` (default: its program's weights' sum).
+TUNNEL, DAG_ROUTE, DAG_BESIDE_EXIT, ZERO_BRANCH, ENTRY_TUNNEL, ENTRY_DAG = range(6)
+DEAD_FORMS = (TUNNEL, DAG_ROUTE, DAG_BESIDE_EXIT)
+
+
+def several_demands_layout(cap, routes, fusing, forms):
+    """The list layout of routes given as link indices: each route is its own demand from its own
+    head (node i; an empty entry's from route 0's head) to one destination (node n); each example
+    link gets its own two nodes, joined to the next link of a route by a link that never limits
+    anything, except where e is fused to f (fused_links): there e's head is f's tail (no join), so
+    the examples' serial pairs stay pairs; a route beside an exit has a link of its own from its
+    head to the destination. Returns the graph, per example link its EdgeId, per route its path of
+    EdgeIds and its exit's EdgeId (or None)."""
+    n = len(routes)
+    tail = [n + 1 + e for e in range(len(cap))]
+    node = n + 1 + len(cap)
+    head = []
+    for e in range(len(cap)):
+        if fusing[e] >= 0:
+            head.append(tail[fusing[e]])
+        else:
+            head.append(node)
+            node += 1
+    rows = [(tail[e], head[e], c, 1) for e, c in enumerate(cap)]
+    positions, exits = [], []
+    for i, (r, form) in enumerate(zip(routes, forms, strict=True)):
+        path = [len(rows)]
+        rows.append(
+            (0 if form in (ENTRY_TUNNEL, ENTRY_DAG) else i, tail[r[0]], WIDE, 1)
+        )
+        for j, e in enumerate(r):
+            path.append(e)
+            if j + 1 < len(r) and fusing[e] != r[j + 1]:
+                path.append(len(rows))
+                rows.append((head[e], tail[r[j + 1]], WIDE, 1))
+        path.append(len(rows))
+        rows.append((head[r[-1]], n, WIDE, 1))
+        positions.append(path)
+        exits.append(None)
+        if form in (DAG_BESIDE_EXIT, ZERO_BRANCH):
+            exits[-1] = len(rows)
+            rows.append((i, n, WIDE, 1))
+    g = ngc.Graph(node, *([row[k] for row in rows] for k in range(4)), 1.0)
+    ids = [0] * len(rows)
+    for e, position in enumerate(g.input_positions().tolist()):
+        ids[position] = e
+    paths = [[ids[k] for k in path] for path in positions]
+    return g, ids, paths, [None if x is None else ids[x] for x in exits]
+
+
+def run_list_lossy(
+    offers, routes, cap, dark=None, fusing=None, forms=None, offer0=None
+):
+    """Each route its own demand (`forms`: how each route is realized, default TUNNEL): a Pinned
+    LOSSY policy, created in route order, all replaced in one SIMULTANEOUS list; dark[i]: the
+    example links route i's demand black-holes. Per demand its arrivals, carried and drops on each
+    link of its route (from its records), its delivery (a route beside an exit: without the exit's
+    units), and per example link the total carried."""
+    dark = dark or [()] * len(routes)
+    forms = forms or [TUNNEL] * len(routes)
+    if fusing is None:
+        fusing = fused_links(offers, routes, cap, dark)
+    g, ids, paths, exits = several_demands_layout(cap, routes, fusing, forms)
+    n = len(routes)
+    ledger = ngc.FlowLedger(g)
+    policies, actions, owned, exit_units = [], [], [], []
+    entries = [
+        ngc.RouteDefinition(
+            0,
+            path_of(g, path) if form == ENTRY_TUNNEL else dag_of(g, path),
+            weight=o,
+        )
+        for path, form, o in zip(paths, forms, offers, strict=True)
+        if form in (ENTRY_TUNNEL, ENTRY_DAG)
+    ]
+    for i, (path, holes, form) in enumerate(zip(paths, dark, forms, strict=True)):
+        if form in (ENTRY_TUNNEL, ENTRY_DAG):
+            continue
+        offer, units = offers[i], 0
+        if form == TUNNEL:
+            weight = offers[0] if i == 0 else 1
+            defs = [ngc.RouteDefinition(i, path_of(g, path), weight=weight)]
+        elif form == DAG_ROUTE:
+            defs = [ngc.RouteDefinition(i, dag_of(g, path))]
+        else:
+            members = path + ([exits[i]] if form == ZERO_BRANCH else [])
+            defs = [
+                ngc.RouteDefinition(i, dag_of(g, members)),
+                ngc.RouteDefinition(i, path_of(g, [exits[i]])),
+            ]
+            offer = 2 if form == ZERO_BRANCH else 2 * offers[i]
+            units = offer - offers[i] if form == DAG_BESIDE_EXIT else 2
+        if i == 0:
+            defs += entries
+            total = offer + sum(e.weight for e in entries)
+            offer = total if offer0 is None else offer0
+        program = ngc.ForwardingProgram.from_routes(g, [i], [n], defs)
+        black = edge_mask(g, [ids[e] for e in holes])
+        policies.append(pinned(g, program, LY, black_holes=black, ledger=ledger))
+        actions.append(ngc.Replace(policies[-1], offer))
+        owned.append(routes[i])
+        exit_units.append(units)
+    try:
+        results = ngc.apply_actions(ledger, actions, mode=ngc.BatchMode.SIMULTANEOUS)
+    except ValueError as e:
+        return dict(error=str(e))
+    arrivals, carried, edge_drops = [], [], []
+    for p, route in zip(policies, owned, strict=True):
+        flows, drops = {}, {}
+        for rec in p.records():
+            for e, x in rec.edge_flows:
+                flows[e] = flows.get(e, 0) + x
+            for e, x in rec.edge_drops:
+                drops[e] = drops.get(e, 0) + x
+        carried.append([flows.get(ids[e], 0) for e in route])
+        edge_drops.append([drops.get(ids[e], 0) for e in route])
+        arrivals.append(
+            [c + d for c, d in zip(carried[-1], edge_drops[-1], strict=True)]
+        )
+    total = ledger.carried().tolist()
+    return dict(
+        arrivals=arrivals,
+        carried=carried,
+        edge_drops=edge_drops,
+        delivered=[
+            r.call_delivered - u for r, u in zip(results, exit_units, strict=True)
+        ],
+        edge_flows=[total[ids[e]] for e in range(len(cap))],
+    )
+
+
+def run_stale_list(edges, tunnels, offers, black_links=(), black_nodes=()):
+    """Each head its own demand (the examples' labels): a Pinned LOSSY policy over its tunnels with
+    the example's black holes, created in head order, all replaced in one SIMULTANEOUS list. The
+    statuses come from each policy's evaluation of 0 (they depend on the program and the black
+    holes only)."""
+    g = graph_of(edges)
+    ledger = ngc.FlowLedger(g)
+    holes = edge_mask(g, black_links, black_nodes)
+    policies, actions = [], []
+    for h in sorted(offers):
+        mine = [p for th, p in tunnels if th == h]
+        program = ngc.ForwardingProgram.from_routes(
+            g,
+            [h],
+            [edges[mine[0][-1]][1]],
+            [ngc.RouteDefinition(h, path_of(g, p)) for p in mine],
+        )
+        policies.append(pinned(g, program, LY, black_holes=holes, ledger=ledger))
+        actions.append(ngc.Replace(policies[-1], offers[h]))
+    status = [t.status.name for p in policies for t in p.evaluate(0).by_tunnel]
+    try:
+        results = ngc.apply_actions(ledger, actions, mode=ngc.BatchMode.SIMULTANEOUS)
+    except ValueError as e:
+        return dict(error=str(e), status=status)
+    return dict(status=status, delivered=[r.call_delivered for r in results])
+
+
+def run_action_list(edges, actions, mode):
+    """One-tunnel LOSSY Pinned participants created in list order on a fresh ledger, replaced in
+    one list of the mode: per entry its delivery, drops, tunnel status, residual and
+    saturated_boundary_edges (from the entry's own source)."""
+    g = graph_of(edges)
+    ledger = ngc.FlowLedger(g)
+    listed = []
+    for a in actions:
+        route = path_of(g, a["route"])
+        program = ngc.ForwardingProgram.from_routes(
+            g,
+            [a["source"]],
+            [route.destination()],
+            [ngc.RouteDefinition(a["source"], route)],
+        )
+        holes = edge_mask(g, a.get("black_holes", ()))
+        listed.append(
+            ngc.Replace(
+                pinned(g, program, LY, black_holes=holes, ledger=ledger), a["offer"]
+            )
+        )
+    outputs = ngc.OutputOptions(residual=True, saturated_boundary_edges=True)
+    try:
+        results = ngc.apply_actions(
+            ledger, listed, mode=getattr(ngc.BatchMode, mode), outputs=outputs
+        )
+    except ValueError as e:
+        return dict(error=str(e))
+    entries = [
+        dict(
+            delivered=r.call_delivered,
+            call_edge_drops=[list(x) for x in r.call_edge_drops],
+            status=r.by_tunnel[0].status.name,
+            residual=r.residual.tolist(),
+            saturated_boundary_edges=r.saturated_boundary_edges,
+        )
+        for r in results
+    ]
+    return dict(entries=entries)
+
+
+def run_list_validation(cases):
+    """Each case's list with real policies, on one ledger per case over CYC(1, 2) plus a separate
+    link 6 -> 7 of 10: an action's policy (by name, created at its first use) has the case's model
+    and admission on 6 -> 7, a foreign one is of another ledger; a Pinned action that `computes`
+    the period-2 error is the cycle (two crossing tunnels from 4, weights 1 and 2) with that
+    cycle's offer 3 in place of the case's, another Pinned one a tunnel over 6 -> 7; `program` installs the policy's program first (a replace or a
+    place of 1), `after_infinite` places +inf first, `foreign_black_holes` gives black holes of
+    another graph. The list's first error, or "valid"."""
+    rows = [
+        (0, 1, 1, 1),
+        (1, 2, 1000, 1),
+        (1, 5, 1000, 1),
+        (2, 3, 2, 1),
+        (3, 0, 1000, 1),
+        (3, 5, 1000, 1),
+        (4, 0, 1000, 1),
+        (4, 2, 1000, 1),
+        (6, 7, 10, 1),
+    ]
+    models = {
+        "ShortestPaths": lambda: ngc.ShortestPaths(),
+        "DistributedTE": lambda: ngc.DistributedTE(ngc.TunnelCount(1)),
+        "CentralizedTE": lambda: ngc.CentralizedTE(source_allocation=S.OPTIMIZED),
+    }
+    out = []
+    for case in cases:
+        g = graph_of(rows)
+        ledger = ngc.FlowLedger(g)
+        policies, listed = {}, []
+        for a in case["actions"]:
+            admission = getattr(ngc.Admission, a["admission"])
+            if a["policy"] not in policies:
+                own = ngc.FlowLedger(g) if a.get("foreign") else ledger
+                if a["model"] != "Pinned":
+                    cfg = config(models[a["model"]](), admission)
+                    p = policy(g, 6, 7, cfg, ledger=own)
+                elif a.get("computes"):
+                    cyc = [(4, [6, 0, 1, 3, 5], 1), (4, [7, 3, 4, 0, 2], 2)]
+                    routes = [
+                        ngc.RouteDefinition(h, path_of(g, es), weight=w)
+                        for h, es, w in cyc
+                    ]
+                    program = ngc.ForwardingProgram.from_routes(g, [4], [5], routes)
+                    p = pinned(g, program, admission, ledger=own)
+                else:
+                    program = ngc.ForwardingProgram.from_routes(
+                        g, [6], [7], [ngc.RouteDefinition(6, path_of(g, [8]))]
+                    )
+                    p = pinned(g, program, admission, ledger=own)
+                if a.get("program"):
+                    (p.place if admission == LL else p.replace)(1)
+                if a.get("after_infinite"):
+                    p.place(INF)
+                if "requested" in a:
+                    requested = a["requested"]
+                    p._seed_requested(requested >> 64, requested & ((1 << 64) - 1))
+                policies[a["policy"]] = p
+            p = policies[a["policy"]]
+            offer = INF if a["offer"] == "inf" else a["offer"]
+            if a.get("computes"):
+                offer = 3
+            if a["kind"] == "Place":
+                listed.append(ngc.Place(p, offer))
+            elif a["kind"] == "Replace":
+                listed.append(
+                    ngc.Replace(p, offer, design_demand=a.get("design_demand"))
+                )
+            else:
+                holes = None
+                if a.get("foreign_black_holes"):
+                    holes = graph_of(rows).eligibility(excluded_edges=[8])
+                listed.append(ngc.Forward(p, offer, black_holes=holes))
+        try:
+            ngc.apply_actions(ledger, listed, mode=getattr(ngc.BatchMode, case["mode"]))
+            out.append("valid")
+        except ValueError as e:
+            out.append(str(e))
+    return out
+
+
+def run_forwarding_size(cases):
+    """The forwarding sizes' counting step on each case's sizes (per participant, groups of
+    (tunnels, path length)): the entry count, then the occurrence count, each exact against
+    2^31 - 1 (the networks cannot be built at these sizes; test_apply_actions.py shows the same
+    refusals end to end under lowered limits). Needs the private hooks."""
+    if not hasattr(ext, "_check_forwarding_count"):
+        pytest.skip("needs the private hooks (NETGRAPH_CORE_PRIVATE_HOOKS)")
+    out = []
+    for participants in cases:
+        groups = [group for participant in participants for group in participant]
+        entries = sum(count for count, _ in groups)
+        occurrences = sum(count * length for count, length in groups)
+        try:
+            ext._check_forwarding_count(0, entries)
+            ext._check_forwarding_count(1, occurrences)
+            out.append("within the entry and occurrence limits")
+        except ValueError as e:
+            out.append(str(e))
+    return out
+
+
+def own_highest_averages(x, w):
+    """Unit-at-a-time highest averages by exact cross-multiplication, ties to the earlier label:
+    the test's own, sharing nothing with the library."""
+    a = [0] * len(w)
+    for _ in range(x):
+        best = None
+        for i, wi in enumerate(w):
+            if wi > 0 and (best is None or wi * (a[best] + 1) > w[best] * (a[i] + 1)):
+                best = i
+        if best is None:
+            return [0] * len(w)
+        a[best] += 1
+    return a
+
+
+def run_c3(offers, routes, cap):
+    """The C3 instance (A: links 0, 1; B: 1, 2; C: 2, 0): every integer carried record within the
+    continuation bounds (a demand's carried on a link at most its arrival there) and work
+    conservation (each link carries min(capacity, arrivals)), each checked against the link
+    equations with the test's own highest averages; the library's highest averages (private hooks)
+    agrees with it on every equation evaluated; and the list itself raises the period-2 error."""
+    assert offers == [1, 1, 2] and routes == [[0, 1], [1, 2], [2, 0]]
+    records = solutions = 0
+    violations = []
+    for a0, a1, b1, b2, c2, c0 in itertools.product(
+        range(2), range(2), range(2), range(2), range(3), range(3)
+    ):
+        if a1 > a0 or b2 > b1 or c0 > c2:
+            continue
+        # Arrivals: A 1 then a0; B 1 then b1; C 2 then c2. Links: 0 (A, C), 1 (A, B), 2 (B, C).
+        links = [([1, c2], [a0, c0]), ([a0, 1], [a1, b1]), ([b1, 2], [b2, c2])]
+        if any(
+            sum(car) != min(v, sum(arr))
+            for (arr, car), v in zip(links, cap, strict=True)
+        ):
+            continue
+        records += 1
+        bad = []
+        for k, ((arr, car), v) in enumerate(zip(links, cap, strict=True)):
+            t = min(v, sum(arr))
+            mine = own_highest_averages(t, arr)
+            if hasattr(ext, "_highest_averages") and all(arr):
+                assert ext._highest_averages(t, arr) == mine, (arr, t)
+            if mine != car:
+                bad.append(k)
+        solutions += not bad
+        violations.append(bad)
+    assert violations == [[2], [0], [0, 1, 2], [1], [0]], violations
+    assert run_list_lossy(offers, routes, cap) == dict(
+        error="lossy forwarding iteration entered a period-2 cycle"
+    )
+    return dict(feasible_work_conserving_records=records, local_H_solutions=solutions)
+
+
+def run_dead_demand(seed, trials, form=TUNNEL):
+    """One added dead demand Z changes nothing. Small random inputs of simple-path demands (3 to 5
+    links of free capacity 1 to 3, two to four demands of offer 1 to 4 over 2 to 4 distinct links
+    each), drawn as the contract draws them; Z has a zero offer over 1 to 3 of those links, or an
+    offer of 1 to 3 whose route reaches its own black hole (link k, a link of Z's own, inserted into
+    its route, or one of its shared links) and continues behind it. The outcome with Z equals the
+    outcome with Z's dead occurrences removed (without Z for a zero offer, Z's route cut after its
+    black hole otherwise): every arrival, carried amount, drop and delivery of the others and of
+    Z's prefix, every link flow, or the error; Z's dead occurrences show 0. `form`: how Z is
+    realized (run_list_lossy). Both runs of a trial share one layout (fused_links of the input
+    with Z)."""
+    rng = random.Random(seed)
+    kinds = {"zero": 0, "tail": 0}
+    agree = errors = 0
+
+    def view(rec, n, cut):
+        if "error" in rec:
+            return rec["error"]
+        rows = [
+            rec[key][:n] + ([rec[key][n][:cut]] if cut else [])
+            for key in ("arrivals", "carried", "edge_drops")
+        ]
+        tail = [
+            x
+            for key in ("arrivals", "carried")
+            if len(rec[key]) > n
+            for x in rec[key][n][cut:]
+        ]
+        return rows, rec["delivered"][:n], rec["edge_flows"], not any(tail)
+
+    for _ in range(trials):
+        k = rng.randint(3, 5)
+        cap = [rng.randint(1, 3) for _ in range(k)] + [9]
+        n = rng.randint(2, 4)
+        routes = [rng.sample(range(k), rng.randint(2, min(4, k))) for _ in range(n)]
+        offers = [rng.randint(1, 4) for _ in range(n)]
+        links = rng.sample(range(k), rng.randint(1, min(3, k)))
+        if rng.random() < 0.5:
+            kind, z, zr, hole = "zero", 0, links, None
+        else:
+            kind, z, p = "tail", rng.randint(1, 3), rng.randrange(len(links))
+            if rng.random() < 0.5:
+                zr, hole = links[:p] + [k] + links[p:], k
+            else:
+                zr, hole = links, links[p]
+        kinds[kind] += 1
+        dark = [()] * n + [() if hole is None else (hole,)]
+        fusing = fused_links(offers + [z], routes + [zr], cap, dark)
+        forms = [TUNNEL] * n + [form]
+        full = run_list_lossy(offers + [z], routes + [zr], cap, dark, fusing, forms)
+        if kind == "zero":
+            cut, short = 0, run_list_lossy(offers, routes, cap, None, fusing)
+        else:
+            cut = zr.index(hole) + 1
+            short = run_list_lossy(
+                offers + [z], routes + [zr[:cut]], cap, dark, fusing, forms
+            )
+        agree += view(full, n, cut) == view(short, n, cut)
+        errors += "error" in full
+    return dict(trials=trials, agree=agree, kinds=kinds, errors=errors)
+
+
+# The examples of several demands at once that share an oracle with a single program's: each
+# route (or head) is its own demand, all in one SIMULTANEOUS list.
+SEVERAL_DEMANDS = {
+    "D-crossing": run_list_lossy,
+    "D-simultaneous": run_list_lossy,
+    "D-C3": run_list_lossy,
+    "D-cycle-prefix-suffix": run_list_lossy,
+    "D-cycle-subdivision-before": run_list_lossy,
+    "D-cycle-subdivision-after": run_list_lossy,
+    "D-dead-tail": run_list_lossy,
+    "D-dead-waits": run_list_lossy,
+    "D-zero-share-pair": run_list_lossy,
+    "D-dead-subdivision": run_list_lossy,
+    "STALE-cycle-period-2": run_stale_list,
+    "STALE-cycle-round-limit-baseline": run_stale_list,
+    "STALE-cycle-round-limit": run_stale_list,
+    "STALE-black-hole-in-cycle": run_stale_list,
+}
+
+
+ADAPTERS = {
+    "ha": run_ha,
+    "split_error": run_split_error,
+    "bound_sweep": run_bound_sweep,
+    "member_order": run_member_order,
+    "pooled": run_pooled,
+    "ledger": run_ledger,
+    "refusal": run_refusal,
+    "increments": run_increments,
+    "epoch": run_epoch,
+    "equal_increment": run_equal_increment,
+    "zero_state": run_zero_state,
+    "change_flags": run_change_flags,
+    "lossy": run_lossy,
+    "bound": run_bound,
+    "split_contexts": run_split_contexts,
+    "dag_contexts": run_dag_contexts,
+    "stale_dag": run_stale_dag,
+    "stale_paths": run_stale_paths,
+    "termination": run_termination,
+    "t1": run_t1,
+    "head_requests": run_head_requests,
+    "t2": run_t2,
+    "upto": run_upto,
+    "flow": run_flow,
+    "min_cut": run_min_cut,
+    "residual_witness": run_residual_witness,
+    "evaluate_offer": run_evaluate_offer,
+    "search": run_search,
+    "tie_choice": run_tie_choice,
+    "stretch_values": run_stretch_values,
+    "model_config": run_model_config,
+    "evaluation_validation": run_evaluation_validation,
+    "ownership_texts": run_ownership_texts,
+    "input_texts": run_input_texts,
+    "input_classes": run_input_classes,
+    "action_list": run_action_list,
+    "list_validation": run_list_validation,
+    "forwarding_size": run_forwarding_size,
+    "c3": run_c3,
+    "dead_demand": run_dead_demand,
+    "number_types": run_number_types,
+}
+
+
+EXAMPLES = [
+    {
+        "id": "E-configured",
+        "oracle": "ha",
+        "input": {"n": 12, "weights": [1, 2]},
+        "expected": [4, 8],
+    },
+    {
+        "id": "E-snapshot",
+        "oracle": "ha",
+        "input": {"n": 12, "weights": [2, 10]},
+        "expected": [2, 10],
+    },
+    {
+        "id": "E-source-survivor",
+        "oracle": "ha",
+        "input": {"n": 16, "weights": [3, 1]},
+        "expected": [12, 4],
+    },
+    {
+        "id": "H-not-one-unit",
+        "oracle": "ha",
+        "input": {"n": 50, "weights": [100, 1, 1, 1]},
+        "expected": [50, 0, 0, 0],
+    },
+    {
+        "id": "R3-H-large",
+        "oracle": "ha",
+        "input": {
+            "n": 85070591730234615865843651857942052863,
+            "weights": [
+                42535295865117307932921825928971026432,
+                42535295865117307932921825928971026432,
+            ],
+        },
+        "expected": [
+            42535295865117307932921825928971026432,
+            42535295865117307932921825928971026431,
+        ],
+    },
+    {
+        "id": "H-local-bound",
+        "oracle": "split_error",
+        "input": {"n": 1000000, "weights": [1000000, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]},
+        "expected": {
+            "assigned": [1000000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+            "max_excess": "1000000/100001",
+            "max_deficit": "100000/100001",
+            "below_k": True,
+        },
+    },
+    {
+        "id": "RR-local-bound",
+        "oracle": "split_error",
+        "input": {"n": 10, "weights": [1, 1, 1]},
+        "expected": {
+            "assigned": [4, 3, 3],
+            "max_excess": "2/3",
+            "max_deficit": "1/3",
+            "below_one": True,
+        },
+    },
+    {
+        "id": "H-bound-sweep",
+        "oracle": "bound_sweep",
+        "input": {"max_total": 24, "max_members": 4, "max_weight": 4},
+        "expected": {"cases": 19400, "violations": 0, "equal_violations": 0},
+    },
+    {
+        "id": "R3-member-order",
+        "oracle": "member_order",
+        "input": {"amount": 1, "order": [1, 0]},
+        "expected": [0, 1],
+    },
+    {
+        "id": "B-pooled",
+        "oracle": "pooled",
+        "input": {"sources": [1, 1], "members": 2},
+        "expected": {
+            "columns": [1, 1],
+            "source_by_column": [[1, 0], [0, 1]],
+            "independent_columns": [2, 0],
+        },
+    },
+    {
+        "id": "SPF-zero-edge",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 2, 5, 1], [2, 1, 5, 1]],
+            "source": 0,
+            "destinations": 1,
+        },
+        "expected": {"distance": 1, "dag": [0]},
+    },
+    {
+        "id": "SPF-zero-edge-residual",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 2, 5, 1], [2, 1, 5, 1]],
+            "source": 0,
+            "destinations": 1,
+            "residual": [0, 5, 5],
+        },
+        "expected": {"distance": 2, "dag": [1, 2]},
+    },
+    {
+        "id": "KSP-zero-edge",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 2, 5, 1], [2, 1, 5, 1]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+        },
+        "expected": {"paths": [[1, [0]], [2, [1, 2]]]},
+    },
+    {
+        "id": "KSP-zero-edge-residual",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 2, 5, 1], [2, 1, 5, 1]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [0, 5, 5],
+        },
+        "expected": {"paths": [[2, [1, 2]]]},
+    },
+    {
+        "id": "B1-equal",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 3, 2, 1], [1, 2, 10, 1], [2, 3, 10, 2]],
+            "heads": [0, 1],
+            "destinations": [3],
+            "limit": 12,
+            "source_allocation": "EQUAL",
+        },
+        "expected": {"cost": 8, "delivered": 4, "edge_flows": [2, 2, 2]},
+    },
+    {
+        "id": "B1-optimized",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 3, 2, 1], [1, 2, 10, 1], [2, 3, 10, 2]],
+            "heads": [0, 1],
+            "destinations": [3],
+            "limit": 12,
+            "source_allocation": "OPTIMIZED",
+        },
+        "expected": {"cost": 32, "delivered": 12, "edge_flows": [2, 10, 10]},
+    },
+    {
+        "id": "MINCUT-B1",
+        "oracle": "min_cut",
+        "input": {
+            "edges": [[0, 3, 2, 1], [1, 2, 10, 1], [2, 3, 10, 2]],
+            "heads": [0, 1],
+            "destinations": [3],
+        },
+        "expected": {"value": 12, "cut": [0, 1]},
+    },
+    {
+        "id": "MINCUT-zero-edge",
+        "oracle": "min_cut",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+        },
+        "expected": {"value": 10, "cut": [0, 1]},
+    },
+    {
+        "id": "B2-equal-global",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 1, 4, 1], [0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 12,
+        },
+        "expected": {"cost": 16, "delivered": 12, "edge_flows": [4, 2, 10]},
+    },
+    {
+        "id": "B2-shortest",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 12,
+            "source_allocation": "EQUAL",
+        },
+        "expected": {"cost": 4, "delivered": 4, "edge_flows": [2, 2]},
+    },
+    {
+        "id": "B2-optimized",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 1, 4, 1], [0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 12,
+            "source_allocation": "OPTIMIZED",
+        },
+        "expected": {"cost": 12, "delivered": 12, "edge_flows": [0, 2, 10]},
+    },
+    {
+        "id": "B3-zero-first",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 10,
+        },
+        "expected": {"delivered": 0, "cost": 0, "edge_flows": [0, 0]},
+    },
+    {
+        "id": "B3-positive-first",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 0, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 10,
+        },
+        "expected": {"delivered": 1, "cost": 1, "edge_flows": [1, 0]},
+    },
+    {
+        "id": "B3-delete-zero",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 10, 1]],
+            "heads": [1],
+            "destinations": [2],
+            "limit": 10,
+        },
+        "expected": {"delivered": 10, "cost": 10, "edge_flows": [0, 10]},
+    },
+    {
+        "id": "E-support",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 2, 10, 1], [1, 3, 2, 1], [2, 3, 10, 2]],
+            "heads": [0],
+            "destinations": [3],
+            "limit": 12,
+        },
+        "expected": {"cost": 34, "delivered": 12, "edge_flows": [2, 10, 2, 10]},
+    },
+    {
+        "id": "E-support-shortest",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 1, 10, 1], [1, 3, 2, 1]],
+            "heads": [0],
+            "destinations": [3],
+            "limit": 12,
+        },
+        "expected": {"delivered": 2, "cost": 4, "edge_flows": [2, 2]},
+    },
+    {
+        "id": "T2-OPT-global",
+        "oracle": "flow",
+        "input": {
+            "edges": [[0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 12,
+            "source_allocation": "OPTIMIZED",
+        },
+        "expected": {"delivered": 12, "cost": 12, "edge_flows": [2, 10]},
+    },
+    {
+        "id": "R4-lossless-equal",
+        "oracle": "equal_increment",
+        "input": {"capacities": [2, 10], "costs": [9, 1], "calls": [3, 3]},
+        "expected": {
+            "call_deliveries": [3, 1],
+            "allocation": [2, 2],
+            "delivered": 4,
+            "cost": 20,
+        },
+    },
+    {
+        "id": "R3-residual-optimal",
+        "oracle": "residual_witness",
+        "input": {
+            "edges": [[0, 1, 1, 1], [0, 2, 1, 1], [1, 0, 1, 1]],
+            "flow": [0, 1, 0],
+            "source": 0,
+            "sink": 2,
+            "value": 1,
+            "potentials": [0, 0, 1],
+        },
+        "expected": {
+            "is_minimum_cost": True,
+            "cost": 1,
+            "residual_cycle_costs": [2],
+            "positive_flow_cycle_costs": [],
+        },
+    },
+    {
+        "id": "R3-residual-cyclic",
+        "oracle": "residual_witness",
+        "input": {
+            "edges": [[0, 1, 1, 1], [0, 2, 1, 1], [1, 0, 1, 1]],
+            "flow": [1, 1, 1],
+            "source": 0,
+            "sink": 2,
+            "value": 1,
+            "potentials": [0, 0, 1],
+        },
+        "expected": {
+            "is_minimum_cost": False,
+            "cost": 3,
+            "minimum_cost_at_value": 1,
+            "residual_cycle_costs": [-2],
+            "positive_flow_cycle_costs": [2],
+        },
+    },
+    {
+        "id": "A-X1",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 6, 1], [0, 1, 6, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 12,
+            "per_head": 4,
+            "offer": 13,
+        },
+        "expected": {
+            "lossy_delivery": 12,
+            "lossy_edge_drops": [1, 0],
+            "lossless_admitted": 12,
+            "lossless_unadmitted": 1,
+            "bound": 12,
+            "no_drop_load": [7, 6],
+            "offered_by_entry": [4, 3, 3, 3],
+            "requested_bandwidth": [3, 3, 3, 3],
+            "total_reserved_bandwidth": 12,
+            "edge_reservations": [6, 6],
+            "routes": [[0], [0], [1], [1]],
+            "source_drops": 0,
+            "up": 4,
+        },
+    },
+    {
+        "id": "A-X2",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 3, 1], [0, 1, 2, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 5,
+            "per_head": 2,
+            "offer": 5,
+        },
+        "expected": {
+            "bound": 5,
+            "no_drop_load": [3, 2],
+            "offered_by_entry": [3, 2],
+            "requested_bandwidth": [3, 2],
+            "total_reserved_bandwidth": 5,
+            "edge_reservations": [3, 2],
+            "routes": [[0], [1]],
+            "source_drops": 0,
+            "up": 2,
+        },
+    },
+    {
+        "id": "A-X2-small-share",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 6, 1], [0, 1, 6, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 1,
+            "per_head": 2,
+            "offer": 1,
+        },
+        "expected": {
+            "bound": 6,
+            "no_drop_load": [1, 0],
+            "offered_by_entry": [1, 0],
+            "requested_bandwidth": [1, 0],
+            "total_reserved_bandwidth": 1,
+            "edge_reservations": [1, 0],
+            "routes": [[0], [0]],
+            "status": ["UP", "UP"],
+            "source_drops": 0,
+            "up": 2,
+        },
+    },
+    {
+        "id": "T1-over-reservation",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 5, 1], [0, 1, 5, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 8,
+            "per_head": 2,
+            "offer": 10,
+        },
+        "expected": {
+            "requested_bandwidth": [4, 4],
+            "routes": [[0], [1]],
+            "edge_reservations": [4, 4],
+            "offered_by_entry": [5, 5],
+            "no_drop_load": [5, 5],
+            "lossy_delivery": 10,
+            "lossy_edge_drops": [0, 0],
+            "bound": 10,
+        },
+    },
+    {
+        "id": "T1-zero-link-drop",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 0, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 0,
+            "per_head": 1,
+            "offer": 1,
+        },
+        "expected": {
+            "requested_bandwidth": [0],
+            "routes": [[0]],
+            "status": ["UP"],
+            "offered_by_entry": [1],
+            "source_drops": 0,
+            "lossy_delivery": 0,
+            "lossy_edge_drops": [1],
+            "bound": 0,
+            "lossless_admitted": 0,
+            "lossless_unadmitted": 1,
+        },
+    },
+    {
+        "id": "A-X3",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 2, 1], [0, 1, 10, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 12,
+            "per_head": 4,
+            "offer": 12,
+        },
+        "expected": {
+            "bound": 10,
+            "no_drop_load": [0, 12],
+            "offered_by_entry": [4, 4, 4, 0],
+            "requested_bandwidth": [3, 3, 3, 3],
+            "total_reserved_bandwidth": 9,
+            "edge_reservations": [0, 9],
+            "routes": [[1], [1], [1], []],
+            "source_drops": 0,
+            "up": 3,
+            "status": ["UP", "UP", "UP", "INSUFFICIENT_BANDWIDTH"],
+        },
+    },
+    {
+        "id": "A-X4",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 6, 1], [1, 2, 6, 1], [2, 3, 6, 1]],
+            "heads": [0, 1],
+            "destinations": [3],
+            "design_demand": 12,
+            "per_head": 2,
+            "offer": 12,
+        },
+        "expected": {
+            "bound": 6,
+            "no_drop_load": [6, 6, 12],
+            "offered_by_entry": [6, 6, 0, 0],
+            "requested_bandwidth": [3, 3, 3, 3],
+            "total_reserved_bandwidth": 6,
+            "edge_reservations": [3, 3, 6],
+            "routes": [[0, 2], [1, 2], [], []],
+            "source_drops": 0,
+            "up": 2,
+        },
+    },
+    {
+        "id": "A-X5",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 3, 20, 1], [1, 3, 20, 1], [2, 3, 20, 1]],
+            "heads": [0, 1, 2],
+            "destinations": [3],
+            "design_demand": 2,
+            "per_head": 1,
+            "offer": 3,
+        },
+        "expected": {
+            "bound": 60,
+            "no_drop_load": [1, 1, 1],
+            "offered_by_entry": [1, 1, 1],
+            "requested_bandwidth": [1, 1, 0],
+            "total_reserved_bandwidth": 2,
+            "edge_reservations": [1, 1, 0],
+            "routes": [[0], [1], [2]],
+            "source_drops": 0,
+            "up": 3,
+        },
+    },
+    {
+        "id": "T1-split",
+        "oracle": "head_requests",
+        "input": {"heads": 2, "per_head": 2, "design_demand": 5},
+        "expected": [2, 1, 1, 1],
+    },
+    {
+        "id": "A-X6",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 5, 1], [0, 1, 5, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 8,
+            "per_head": 2,
+            "offer": 8,
+        },
+        "expected": {
+            "bound": 10,
+            "no_drop_load": [4, 4],
+            "offered_by_entry": [4, 4],
+            "requested_bandwidth": [4, 4],
+            "total_reserved_bandwidth": 8,
+            "edge_reservations": [4, 4],
+            "routes": [[0], [1]],
+            "source_drops": 0,
+            "up": 2,
+        },
+    },
+    {
+        "id": "A-X8",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 8, 3]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "design_demand": 4,
+            "per_head": 1,
+            "offer": 4,
+        },
+        "expected": {
+            "bound": 0,
+            "no_drop_load": [0, 2],
+            "offered_by_entry": [0, 2],
+            "requested_bandwidth": [2, 2],
+            "total_reserved_bandwidth": 2,
+            "edge_reservations": [0, 2],
+            "routes": [[], [1]],
+            "source_drops": 2,
+            "up": 1,
+        },
+    },
+    {
+        "id": "A-X9",
+        "oracle": "t1",
+        "input": {
+            "edges": [
+                [0, 1, 8192, 1],
+                [0, 2, 40960, 1],
+                [1, 3, 8192, 1],
+                [2, 3, 40960, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "design_demand": 49152,
+            "per_head": 16,
+            "offer": 49152,
+        },
+        "expected": {
+            "bound": 47262,
+            "no_drop_load": [6554, 42598, 6554, 42598],
+            "offered_by_entry": [
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3277,
+                3276,
+                3276,
+                3276,
+                0,
+            ],
+            "requested_bandwidth": [
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+                3072,
+            ],
+            "total_reserved_bandwidth": 46080,
+            "edge_reservations": [6144, 39936, 6144, 39936],
+            "routes": [
+                [0, 2],
+                [0, 2],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [],
+            ],
+            "source_drops": 0,
+            "up": 15,
+        },
+    },
+    {
+        "id": "A-X9-large-design",
+        "oracle": "t1",
+        "input": {
+            "edges": [
+                [0, 1, 8192, 1],
+                [0, 2, 40960, 1],
+                [1, 3, 8192, 1],
+                [2, 3, 40960, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "design_demand": 409600,
+            "per_head": 16,
+        },
+        "expected": {
+            "bound": 40960,
+            "requested_bandwidth": [
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+                25600,
+            ],
+            "total_reserved_bandwidth": 25600,
+            "edge_reservations": [0, 25600, 0, 25600],
+            "routes": [
+                [1, 3],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+                [],
+            ],
+            "up": 1,
+        },
+    },
+    {
+        "id": "A-X8-delete-zero-edge",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 8, 3]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "design_demand": 4,
+            "per_head": 1,
+            "excluded": [0],
+        },
+        "expected": {
+            "bound": 8,
+            "requested_bandwidth": [4],
+            "total_reserved_bandwidth": 4,
+            "edge_reservations": [0, 4],
+            "routes": [[1]],
+            "up": 1,
+        },
+    },
+    {
+        "id": "A-X8-Stretch2",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 8, 3]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "design_demand": 4,
+            "per_head": 1,
+            "stretch": Fraction(2, 1),
+        },
+        "expected": {
+            "bound": 0,
+            "requested_bandwidth": [2, 2],
+            "total_reserved_bandwidth": 0,
+            "edge_reservations": [0, 0],
+            "routes": [[], []],
+            "up": 0,
+            "status": ["INSUFFICIENT_BANDWIDTH", "COST_CEILING_EXCEEDED"],
+        },
+    },
+    {
+        "id": "A-X8-Absolute3",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 0, 1], [1, 2, 8, 3]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "design_demand": 4,
+            "per_head": 1,
+            "absolute": 3,
+        },
+        "expected": {
+            "bound": 0,
+            "requested_bandwidth": [2, 2],
+            "total_reserved_bandwidth": 2,
+            "edge_reservations": [0, 2],
+            "routes": [[], [1]],
+            "up": 1,
+            "status": ["INSUFFICIENT_BANDWIDTH", "UP"],
+        },
+    },
+    {
+        "id": "A-X8-Stretch-exact",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 0, 5], [0, 1, 1, 6]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 1,
+            "per_head": 1,
+            "offer": 1,
+            "stretch": 1.2,
+        },
+        "expected": {
+            "status": ["UP"],
+            "routes": [[1]],
+            "up": 1,
+            "lossy_delivery": 1,
+            "source_drops": 0,
+            "lossless_admitted": 1,
+        },
+    },
+    {
+        "id": "A-X8-Stretch-cost7",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 0, 5], [0, 1, 1, 7]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 1,
+            "per_head": 1,
+            "offer": 1,
+            "stretch": Fraction(6, 5),
+        },
+        "expected": {
+            "status": ["COST_CEILING_EXCEEDED"],
+            "routes": [[]],
+            "up": 0,
+            "lossy_delivery": 0,
+            "source_drops": 1,
+            "lossless_admitted": 0,
+        },
+    },
+    {
+        "id": "A-X7-8",
+        "oracle": "t1",
+        "input": {
+            "edges": [
+                [0, 1, 6, 1],
+                [0, 2, 6, 3],
+                [1, 2, 4, 1],
+                [1, 3, 6, 3],
+                [2, 3, 6, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "design_demand": 8,
+            "per_head": 2,
+        },
+        "expected": {
+            "requested_bandwidth": [4, 4],
+            "routes": [[0, 2, 4], []],
+            "up": 1,
+            "total_reserved_bandwidth": 4,
+            "edge_reservations": [4, 0, 4, 0, 4],
+            "bound": 4,
+        },
+    },
+    {
+        "id": "A-X7-10",
+        "oracle": "t1",
+        "input": {
+            "edges": [
+                [0, 1, 6, 1],
+                [0, 2, 6, 3],
+                [1, 2, 4, 1],
+                [1, 3, 6, 3],
+                [2, 3, 6, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "design_demand": 10,
+            "per_head": 2,
+        },
+        "expected": {
+            "requested_bandwidth": [5, 5],
+            "routes": [[0, 3], [1, 4]],
+            "up": 2,
+            "total_reserved_bandwidth": 10,
+            "edge_reservations": [5, 5, 0, 5, 5],
+            "bound": 12,
+        },
+    },
+    {
+        "id": "A-X7-14",
+        "oracle": "t1",
+        "input": {
+            "edges": [
+                [0, 1, 6, 1],
+                [0, 2, 6, 3],
+                [1, 2, 4, 1],
+                [1, 3, 6, 3],
+                [2, 3, 6, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "design_demand": 14,
+            "per_head": 2,
+        },
+        "expected": {
+            "requested_bandwidth": [7, 7],
+            "routes": [[], []],
+            "up": 0,
+            "total_reserved_bandwidth": 0,
+            "edge_reservations": [0, 0, 0, 0, 0],
+            "bound": 0,
+        },
+    },
+    {
+        "id": "T1-two-heads",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "design_demand": 12,
+            "per_head": 2,
+            "offer": 12,
+        },
+        "expected": {
+            "requested_bandwidth": [3, 3, 3, 3],
+            "routes": [[], [1], [], [1]],
+            "status": ["INSUFFICIENT_BANDWIDTH", "UP", "INSUFFICIENT_BANDWIDTH", "UP"],
+            "up": 2,
+            "total_reserved_bandwidth": 6,
+            "edge_reservations": [0, 6],
+            "offered_by_entry": [0, 3, 0, 3],
+            "source_drops": 6,
+            "no_drop_load": [0, 6],
+            "bound": 0,
+            "lossy_delivery": 6,
+        },
+    },
+    {
+        "id": "T1-idle",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 3,
+            "per_head": 4,
+            "offer": 3,
+        },
+        "expected": {
+            "requested_bandwidth": [1, 1, 1, 0],
+            "routes": [[0], [0], [0], [0]],
+            "up": 4,
+            "total_reserved_bandwidth": 3,
+            "edge_reservations": [3],
+            "offered_by_entry": [1, 1, 1, 0],
+            "source_drops": 0,
+            "no_drop_load": [3],
+            "bound": 10,
+            "lossy_delivery": 3,
+        },
+    },
+    {
+        "id": "T1-idle-zero-link",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 1, 10, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 1,
+            "per_head": 2,
+            "offer": 2,
+        },
+        "expected": {
+            "requested_bandwidth": [1, 0],
+            "routes": [[1], [0]],
+            "status": ["UP", "UP"],
+            "up": 2,
+            "total_reserved_bandwidth": 1,
+            "edge_reservations": [0, 1],
+            "offered_by_entry": [1, 1],
+            "source_drops": 0,
+            "no_drop_load": [1, 1],
+            "bound": 1,
+            "lossy_delivery": 1,
+        },
+    },
+    {
+        "id": "T1-zero-design",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 0,
+            "per_head": 2,
+            "offer": 4,
+        },
+        "expected": {
+            "requested_bandwidth": [0, 0],
+            "routes": [[0], [0]],
+            "up": 2,
+            "total_reserved_bandwidth": 0,
+            "edge_reservations": [0],
+            "offered_by_entry": [2, 2],
+            "source_drops": 0,
+            "no_drop_load": [4],
+            "bound": 10,
+            "lossy_delivery": 4,
+        },
+    },
+    {
+        "id": "C-G1",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 8192, 1],
+                [0, 2, 40960, 1],
+                [1, 3, 8192, 1],
+                [2, 3, 40960, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "per_head": 16,
+            "design_demand": 49152,
+            "lossy_offer": 49152,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 2925,
+            "counts": [2, 14, 2, 14],
+            "max_fractional_bandwidth_per_tunnel": "20480/7",
+            "max_lossless_offer": 46812,
+            "lossy_delivery": 47104,
+            "paths": [
+                [0, 2],
+                [0, 2],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+            ],
+            "headroom_penalty": 73610035200,
+            "total_planned_bandwidth": 46800,
+            "total_tunnel_cost": 32,
+            "planned_bandwidth_per_tunnel": 2925,
+        },
+    },
+    {
+        "id": "C-G1-finite",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 8192, 1],
+                [0, 2, 40960, 1],
+                [1, 3, 8192, 1],
+                [2, 3, 40960, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "per_head": 16,
+            "design_demand": 8192,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 2925,
+            "counts": [2, 14, 2, 14],
+            "max_fractional_bandwidth_per_tunnel": "20480/7",
+            "max_lossless_offer": 46812,
+            "paths": [
+                [0, 2],
+                [0, 2],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+                [1, 3],
+            ],
+            "headroom_penalty": 12884901876,
+            "total_planned_bandwidth": 8192,
+            "total_tunnel_cost": 32,
+            "planned_bandwidth_per_tunnel": 512,
+        },
+    },
+    {
+        "id": "C-G4",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 4096, 1],
+                [0, 2, 4096, 1],
+                [0, 3, 4096, 1],
+                [0, 4, 4096, 1],
+                [0, 5, 4096, 1],
+                [0, 6, 4096, 1],
+                [0, 7, 4096, 1],
+                [0, 8, 4096, 1],
+                [0, 9, 4096, 1],
+                [0, 10, 4096, 1],
+                [0, 11, 4096, 1],
+                [0, 12, 4096, 1],
+                [0, 13, 4096, 1],
+                [0, 14, 4096, 1],
+                [0, 15, 4096, 1],
+                [1, 16, 4096, 1],
+                [2, 16, 4096, 1],
+                [3, 16, 4096, 1],
+                [4, 16, 4096, 1],
+                [5, 16, 4096, 1],
+                [6, 16, 4096, 1],
+                [7, 16, 4096, 1],
+                [8, 16, 4096, 1],
+                [9, 16, 4096, 1],
+                [10, 16, 4096, 1],
+                [11, 16, 4096, 1],
+                [12, 16, 4096, 1],
+                [13, 16, 4096, 1],
+                [14, 16, 4096, 1],
+                [15, 16, 4096, 1],
+            ],
+            "heads": [0],
+            "destinations": [16],
+            "per_head": 16,
+            "design_demand": 61440,
+            "lossy_offer": 61440,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 2048,
+            "planned_bandwidth_per_tunnel": 2048,
+            "max_fractional_bandwidth_per_tunnel": "2048",
+            "counts": [
+                2,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                2,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+                1,
+            ],
+            "paths": [
+                [0, 15],
+                [0, 15],
+                [1, 16],
+                [2, 17],
+                [3, 18],
+                [4, 19],
+                [5, 20],
+                [6, 21],
+                [7, 22],
+                [8, 23],
+                [9, 24],
+                [10, 25],
+                [11, 26],
+                [12, 27],
+                [13, 28],
+                [14, 29],
+            ],
+            "max_lossless_offer": 32768,
+            "lossy_delivery": 57856,
+            "headroom_penalty": 73014444032,
+            "total_planned_bandwidth": 32768,
+            "total_tunnel_cost": 32,
+        },
+    },
+    {
+        "id": "C-equal",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 3, 1], [1, 2, 8, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "per_head": 2,
+            "design_demand": 6,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 1,
+            "counts": [2, 2],
+            "max_fractional_bandwidth_per_tunnel": "3/2",
+            "max_lossless_offer": 6,
+            "paths": [[0], [1], [0], [1]],
+            "headroom_penalty": 5905580031,
+            "total_planned_bandwidth": 4,
+            "total_tunnel_cost": 4,
+            "planned_bandwidth_per_tunnel": 1,
+        },
+    },
+    {
+        "id": "C-finite-cost",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 1, 2, 1], [0, 1, 10, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 2,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 5,
+            "counts": [2, 0],
+            "max_fractional_bandwidth_per_tunnel": "5",
+            "max_lossless_offer": 2,
+            "paths": [[0], [0]],
+            "headroom_penalty": 6442450944,
+            "total_planned_bandwidth": 2,
+            "total_tunnel_cost": 2,
+            "planned_bandwidth_per_tunnel": 1,
+        },
+    },
+    {
+        "id": "C-G10-0",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 40960, 1],
+                [0, 5, 40960, 1],
+                [0, 3, 24576, 2],
+                [1, 0, 40960, 1],
+                [1, 2, 40960, 1],
+                [1, 4, 16384, 2],
+                [2, 1, 40960, 1],
+                [2, 3, 40960, 1],
+                [2, 5, 20480, 2],
+                [3, 2, 40960, 1],
+                [3, 4, 40960, 1],
+                [3, 0, 24576, 2],
+                [4, 3, 40960, 1],
+                [4, 5, 40960, 1],
+                [4, 1, 16384, 2],
+                [5, 0, 40960, 1],
+                [5, 4, 40960, 1],
+                [5, 2, 20480, 2],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "per_head": 16,
+            "design_demand": 49152,
+            "cap": [
+                40960,
+                40960,
+                24576,
+                40960,
+                40960,
+                16384,
+                40960,
+                40960,
+                20480,
+                40960,
+                40960,
+                24576,
+                40960,
+                40960,
+                16384,
+                40960,
+                40960,
+                20480,
+            ],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 6144,
+            "counts": [4, 4, 8, 0, 4, 0, 0, 4, 0, 0, 0, 0, 4, 0, 0, 0, 4, 0],
+            "max_fractional_bandwidth_per_tunnel": "6144",
+            "max_lossless_offer": 49160,
+            "paths": [
+                [0, 4, 7],
+                [0, 4, 7],
+                [0, 4, 7],
+                [0, 4, 7],
+                [1, 16, 12],
+                [1, 16, 12],
+                [1, 16, 12],
+                [1, 16, 12],
+                [2],
+                [2],
+                [2],
+                [2],
+                [2],
+                [2],
+                [2],
+                [2],
+            ],
+            "headroom_penalty": 38654705652,
+            "total_planned_bandwidth": 49152,
+            "total_tunnel_cost": 40,
+            "planned_bandwidth_per_tunnel": 3072,
+        },
+    },
+    {
+        "id": "C-G10-1",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 40960, 1],
+                [0, 5, 40960, 1],
+                [0, 3, 24576, 2],
+                [1, 0, 40960, 1],
+                [1, 2, 40960, 1],
+                [1, 4, 16384, 2],
+                [2, 1, 40960, 1],
+                [2, 3, 40960, 1],
+                [2, 5, 20480, 2],
+                [3, 2, 40960, 1],
+                [3, 4, 40960, 1],
+                [3, 0, 24576, 2],
+                [4, 3, 40960, 1],
+                [4, 5, 40960, 1],
+                [4, 1, 16384, 2],
+                [5, 0, 40960, 1],
+                [5, 4, 40960, 1],
+                [5, 2, 20480, 2],
+            ],
+            "heads": [1],
+            "destinations": [4],
+            "per_head": 16,
+            "design_demand": 49152,
+            "cap": [
+                28672,
+                28672,
+                0,
+                40960,
+                28672,
+                16384,
+                40960,
+                28672,
+                20480,
+                40960,
+                40960,
+                24576,
+                28672,
+                40960,
+                16384,
+                40960,
+                28672,
+                20480,
+            ],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 4096,
+            "counts": [0, 6, 0, 6, 5, 5, 0, 5, 0, 0, 5, 0, 0, 0, 0, 0, 6, 0],
+            "max_fractional_bandwidth_per_tunnel": "4096",
+            "max_lossless_offer": 52431,
+            "paths": [
+                [3, 1, 16],
+                [3, 1, 16],
+                [3, 1, 16],
+                [3, 1, 16],
+                [3, 1, 16],
+                [3, 1, 16],
+                [4, 7, 10],
+                [4, 7, 10],
+                [4, 7, 10],
+                [4, 7, 10],
+                [4, 7, 10],
+                [5],
+                [5],
+                [5],
+                [5],
+                [5],
+            ],
+            "total_planned_bandwidth": 49152,
+            "total_tunnel_cost": 43,
+            "planned_bandwidth_per_tunnel": 3072,
+        },
+    },
+    {
+        "id": "C-G10-2",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 40960, 1],
+                [0, 5, 40960, 1],
+                [0, 3, 24576, 2],
+                [1, 0, 40960, 1],
+                [1, 2, 40960, 1],
+                [1, 4, 16384, 2],
+                [2, 1, 40960, 1],
+                [2, 3, 40960, 1],
+                [2, 5, 20480, 2],
+                [3, 2, 40960, 1],
+                [3, 4, 40960, 1],
+                [3, 0, 24576, 2],
+                [4, 3, 40960, 1],
+                [4, 5, 40960, 1],
+                [4, 1, 16384, 2],
+                [5, 0, 40960, 1],
+                [5, 4, 40960, 1],
+                [5, 2, 20480, 2],
+            ],
+            "heads": [2],
+            "destinations": [5],
+            "per_head": 16,
+            "design_demand": 49152,
+            "cap": [
+                28672,
+                10240,
+                0,
+                22528,
+                13312,
+                1024,
+                40960,
+                13312,
+                20480,
+                40960,
+                25600,
+                24576,
+                28672,
+                40960,
+                16384,
+                40960,
+                10240,
+                20480,
+            ],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 2560,
+            "counts": [0, 4, 0, 4, 0, 0, 4, 4, 8, 0, 4, 0, 0, 4, 0, 0, 0, 0],
+            "max_fractional_bandwidth_per_tunnel": "2560",
+            "max_lossless_offer": 40960,
+            "paths": [
+                [6, 3, 1],
+                [6, 3, 1],
+                [6, 3, 1],
+                [6, 3, 1],
+                [7, 10, 13],
+                [7, 10, 13],
+                [7, 10, 13],
+                [7, 10, 13],
+                [8],
+                [8],
+                [8],
+                [8],
+                [8],
+                [8],
+                [8],
+                [8],
+            ],
+            "total_planned_bandwidth": 40960,
+            "total_tunnel_cost": 40,
+            "planned_bandwidth_per_tunnel": 2560,
+        },
+    },
+    {
+        "id": "T2-dead-head",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 0, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "per_head": 2,
+            "design_demand": 10,
+            "lossy_offer": 10,
+        },
+        "expected": {
+            "entry_ids": [1, 3],
+            "design_by_head": [[0, 5], [1, 5]],
+            "heads_with_capacity": [1],
+            "max_fractional_bandwidth_per_tunnel": "5",
+            "max_bandwidth_per_tunnel": 5,
+            "planned_bandwidth_per_tunnel": 3,
+            "counts": [0, 2],
+            "paths": [[1], [1]],
+            "total_planned_bandwidth": 6,
+            "total_tunnel_cost": 2,
+            "max_lossless_offer": 0,
+            "budget": 21,
+            "headroom_penalty": 3865470565,
+            "lossy_delivery": 5,
+            "lossy_source_drops": 5,
+        },
+    },
+    {
+        "id": "T2-two-heads-equal",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 2, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "per_head": 2,
+        },
+        "expected": {
+            "entry_ids": [0, 1, 2, 3],
+            "design_by_head": [],
+            "max_fractional_bandwidth_per_tunnel": "1",
+            "max_bandwidth_per_tunnel": 1,
+            "planned_bandwidth_per_tunnel": 1,
+            "counts": [2, 2],
+            "paths": [[0], [1], [0], [1]],
+            "total_planned_bandwidth": 4,
+            "total_tunnel_cost": 4,
+            "max_lossless_offer": 4,
+            "headroom_penalty": 7730941132,
+        },
+    },
+    {
+        "id": "T2-idle",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 4,
+            "design_demand": 3,
+            "lossy_offer": 3,
+        },
+        "expected": {
+            "max_fractional_bandwidth_per_tunnel": "5/2",
+            "max_bandwidth_per_tunnel": 2,
+            "planned_bandwidth_per_tunnel": 1,
+            "counts": [4],
+            "total_planned_bandwidth": 4,
+            "max_lossless_offer": 10,
+            "headroom_penalty": 4294967294,
+            "lossy_delivery": 3,
+        },
+    },
+    {
+        "id": "T2-zero-design",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 0,
+            "lossy_offer": 4,
+        },
+        "expected": {
+            "max_fractional_bandwidth_per_tunnel": "5",
+            "max_bandwidth_per_tunnel": 5,
+            "planned_bandwidth_per_tunnel": 1,
+            "counts": [2],
+            "total_planned_bandwidth": 2,
+            "max_lossless_offer": 10,
+            "lossy_delivery": 4,
+        },
+    },
+    {
+        "id": "T2-remainder-first",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 1, 3, 1], [0, 1, 2, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 5,
+        },
+        "expected": {
+            "max_fractional_bandwidth_per_tunnel": "2",
+            "max_bandwidth_per_tunnel": 2,
+            "planned_bandwidth_per_tunnel": 2,
+            "counts": [1, 1],
+            "paths": [[0], [1]],
+            "total_planned_bandwidth": 4,
+            "max_lossless_offer": 5,
+        },
+    },
+    {
+        "id": "T2-remainder-second",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 1, 2, 1], [0, 1, 3, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 5,
+        },
+        "expected": {
+            "max_fractional_bandwidth_per_tunnel": "2",
+            "max_bandwidth_per_tunnel": 2,
+            "planned_bandwidth_per_tunnel": 2,
+            "counts": [1, 1],
+            "paths": [[0], [1]],
+            "total_planned_bandwidth": 4,
+            "max_lossless_offer": 4,
+        },
+    },
+    {
+        "id": "C-G1-UP_TO",
+        "oracle": "upto",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [
+                [0, 1, 8192, 1],
+                [0, 2, 40960, 1],
+                [1, 3, 8192, 1],
+                [2, 3, 40960, 1],
+            ],
+            "heads": [0],
+            "destinations": [3],
+            "limit": 6,
+            "design_demand": 49152,
+        },
+        "expected": {
+            "bounds": [40960, 40960, 40960, 40960, 40960, 49152],
+            "scores": [40960, 40960, 40960, 40960, 40960, 49152],
+            "tunnels_per_head": 6,
+            "delivered": 49152,
+        },
+    },
+    {
+        "id": "T2-UP_TO-common",
+        "oracle": "upto",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 3, 6, 1], [1, 3, 3, 1], [1, 3, 3, 1]],
+            "heads": [0, 1],
+            "destinations": [3],
+            "limit": 2,
+            "design_demand": 12,
+        },
+        "expected": {
+            "bounds": [7, 12],
+            "scores": [7, 12],
+            "tunnels_per_head": 2,
+            "delivered": 12,
+            "paths": [[0], [1], [0], [2]],
+        },
+    },
+    {
+        "id": "T2-UP_TO-dead-head",
+        "oracle": "upto",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 0, 1], [1, 2, 10, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 2,
+            "design_demand": 10,
+        },
+        "expected": {
+            "bounds": [21, 21],
+            "scores": [5, 5],
+            "tunnels_per_head": 1,
+            "delivered": 0,
+            "paths": [[1]],
+        },
+    },
+    {
+        "id": "T2-tiny-head",
+        "oracle": "t2",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 1, 1], [1, 2, 100, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "per_head": 16,
+        },
+        "expected": {
+            "heads_with_capacity": [0, 1],
+            "max_fractional_bandwidth_per_tunnel": "1/16",
+            "max_bandwidth_per_tunnel": 0,
+            "counts": [0, 0],
+            "paths": [],
+            "max_lossless_offer": 0,
+            "insufficient_resolution": True,
+        },
+    },
+    {
+        "id": "T2-tiny-head-UP_TO",
+        "oracle": "upto",
+        "input": {
+            "prefer_headroom": True,
+            "edges": [[0, 2, 1, 1], [1, 2, 100, 1]],
+            "heads": [0, 1],
+            "destinations": [2],
+            "limit": 3,
+        },
+        "expected": {
+            "bounds": [2, 0, 0],
+            "scores": [2, 0, 0],
+            "tunnels_per_head": 1,
+            "delivered": 2,
+            "paths": [[0], [1]],
+        },
+    },
+    {
+        "id": "E-duplicates",
+        "oracle": "bound",
+        "input": {"cap": [4, 8], "routes": [[0], [1], [1]], "weights": [1, 1, 1]},
+        "expected": 12,
+    },
+    {
+        "id": "E-deduplicated",
+        "oracle": "bound",
+        "input": {"cap": [4, 8], "routes": [[0], [1]], "weights": [1, 1]},
+        "expected": 8,
+    },
+    {
+        "id": "E-split-contexts",
+        "oracle": "split_contexts",
+        "input": {
+            "cap": [1, 1],
+            "routes": [[0, 1], [0, 1]],
+            "weights": [1, 1],
+            "pool": False,
+        },
+        "expected": {"bound": 1, "loads_at_2": [2, 0]},
+    },
+    {
+        "id": "E-split-contexts-pooled",
+        "oracle": "split_contexts",
+        "input": {
+            "cap": [1, 1],
+            "routes": [[0, 1], [0, 1]],
+            "weights": [1, 1],
+            "pool": True,
+        },
+        "expected": {"bound": 2, "loads_at_2": [1, 1]},
+    },
+    {
+        "id": "E-static-path-fill",
+        "oracle": "bound",
+        "input": {"cap": [6, 4], "routes": [[0], [1]], "weights": [1, 1]},
+        "expected": 9,
+    },
+    {
+        "id": "E-zero-first",
+        "oracle": "bound",
+        "input": {"cap": [0, 4], "routes": [[0], [1]], "weights": [1, 1]},
+        "expected": 0,
+    },
+    {
+        "id": "E-zero-last",
+        "oracle": "bound",
+        "input": {"cap": [4, 0], "routes": [[0], [1]], "weights": [1, 1]},
+        "expected": 1,
+    },
+    {
+        "id": "E-support-pinned-bound",
+        "oracle": "bound",
+        "input": {
+            "cap": [10, 2, 10, 10],
+            "routes": [[0, 1], [2, 3]],
+            "weights": [1, 1],
+        },
+        "expected": 4,
+    },
+    {
+        "id": "STALE-remote-tail",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 100, 1], [0, 2, 100, 1], [1, 3, 100, 1], [2, 3, 100, 1]],
+            "sources": [0],
+            "destinations": 3,
+            "offer": 100,
+            "weights": [1, 1, 1, 1],
+            "black_links": [3],
+        },
+        "expected": {
+            "delivered": 50,
+            "edge_flows": [50, 50, 50, 0],
+            "edge_drops": [0, 0, 0, 50],
+        },
+    },
+    {
+        "id": "STALE-remote-tail-repair",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 100, 1], [0, 2, 100, 1], [1, 3, 100, 1], [2, 3, 100, 1]],
+            "sources": [0],
+            "destinations": 3,
+            "offer": 100,
+            "weights": [1, 1, 1, 1],
+            "mask_links": [3],
+        },
+        "expected": {
+            "delivered": 100,
+            "edge_flows": [100, 0, 100, 0],
+            "edge_drops": [0, 0, 0, 0],
+        },
+    },
+    {
+        "id": "STALE-wcmp-member",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 1, 40, 1]],
+            "sources": [0],
+            "destinations": 1,
+            "offer": 40,
+            "weights": [10, 40],
+            "black_links": [0],
+        },
+        "expected": {"delivered": 32, "edge_flows": [0, 32], "edge_drops": [8, 0]},
+    },
+    {
+        "id": "STALE-wcmp-zero-capacity",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 0, 1], [0, 1, 40, 1]],
+            "sources": [0],
+            "destinations": 1,
+            "offer": 40,
+            "weights": [0, 40],
+        },
+        "expected": {"delivered": 40, "edge_flows": [0, 40], "edge_drops": [0, 0]},
+    },
+    {
+        "id": "STALE-relief",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 10, 1]],
+            "tunnels": [[0, [0, 2]], [1, [1, 2]]],
+            "offers": {0: 10, 1: 10},
+            "black_links": [0],
+        },
+        "expected": {
+            "status": ["BLACKHOLED", "UP"],
+            "delivered": [0, 10],
+            "edge_drops": [10, 0, 0],
+        },
+    },
+    {
+        "id": "STALE-relief-original",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 10, 1]],
+            "tunnels": [[0, [0, 2]], [1, [1, 2]]],
+            "offers": {0: 10, 1: 10},
+        },
+        "expected": {
+            "status": ["UP", "UP"],
+            "delivered": [5, 5],
+            "edge_drops": [0, 0, 10],
+        },
+    },
+    {
+        "id": "STALE-tunnel-node",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 2, 10, 1], [1, 3, 10, 1], [2, 3, 10, 1]],
+            "tunnels": [[0, [0, 2]], [0, [1, 3]]],
+            "offers": {0: 10},
+            "black_nodes": [2],
+        },
+        "expected": {
+            "status": ["UP", "BLACKHOLED"],
+            "assigned": [5, 5],
+            "delivered": [5, 0],
+            "edge_drops": [0, 5, 0, 0],
+            "lossless_admitted": 1,
+        },
+    },
+    {
+        "id": "STALE-tunnel-node-repair",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 2, 10, 1], [1, 3, 10, 1], [2, 3, 10, 1]],
+            "tunnels": [[0, [0, 2]], [0, [1, 3]]],
+            "offers": {0: 10},
+            "mask_nodes": [2],
+        },
+        "expected": {
+            "status": ["UP", "FAILED"],
+            "assigned": [10, 0],
+            "delivered": [10, 0],
+            "edge_drops": [0, 0, 0, 0],
+            "lossless_admitted": 10,
+        },
+    },
+    {
+        "id": "STALE-pooled-original",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 10, 1], [2, 3, 10, 1]],
+            "sources": [0, 1],
+            "destinations": 3,
+            "offer": 2,
+            "weights": [1, 1, 1, 1],
+        },
+        "expected": {
+            "delivered": 2,
+            "edge_flows": [1, 1, 1, 1],
+            "edge_drops": [0, 0, 0, 0],
+            "source_drops": 0,
+        },
+    },
+    {
+        "id": "STALE-pooled-remainder",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 10, 1], [2, 3, 10, 1]],
+            "sources": [0, 1],
+            "destinations": 3,
+            "offer": 2,
+            "weights": [1, 1, 1, 1],
+            "black_links": [0, 3],
+        },
+        "expected": {
+            "delivered": 1,
+            "edge_flows": [0, 1, 1, 0],
+            "edge_drops": [1, 0, 0, 0],
+            "source_drops": 0,
+        },
+    },
+    {
+        "id": "STALE-all-zero-weight",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 0, 1]],
+            "sources": [0],
+            "destinations": 1,
+            "offer": 2,
+            "weights": [0],
+        },
+        "expected": {
+            "delivered": 0,
+            "edge_flows": [0],
+            "edge_drops": [0],
+            "source_drops": 2,
+        },
+    },
+    {
+        "id": "STALE-black-source",
+        "oracle": "stale_dag",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "sources": [0],
+            "destinations": 1,
+            "offer": 10,
+            "weights": [1],
+            "black_nodes": [0],
+        },
+        "expected": {
+            "delivered": 0,
+            "source_drops": 10,
+            "edge_flows": [0],
+            "edge_drops": [0],
+        },
+    },
+    {
+        "id": "STALE-black-source-tunnel",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "tunnels": [[0, [0]]],
+            "offers": {0: 10},
+            "black_nodes": [0],
+        },
+        "expected": {
+            "status": ["BLACKHOLED"],
+            "assigned": [0],
+            "delivered": [0],
+            "source_drops": 10,
+            "edge_drops": [0],
+        },
+    },
+    {
+        "id": "STALE-mask-and-black-hole",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [
+                [0, 1, 10, 1],
+                [0, 2, 10, 1],
+                [0, 3, 10, 1],
+                [1, 4, 10, 1],
+                [2, 4, 10, 1],
+                [3, 4, 10, 1],
+            ],
+            "tunnels": [[0, [0, 3]], [0, [1, 4]], [0, [2, 5]]],
+            "offers": {0: 10},
+            "mask_links": [3],
+            "black_links": [3, 4],
+        },
+        "expected": {
+            "status": ["FAILED", "BLACKHOLED", "UP"],
+            "assigned": [0, 5, 5],
+            "delivered": [0, 0, 5],
+            "edge_drops": [0, 0, 0, 0, 5, 0],
+            "source_drops": 0,
+        },
+    },
+    {
+        "id": "D-merge",
+        "oracle": "lossy",
+        "input": {"offers": [8, 4], "routes": [[0], [0]], "cap": [9]},
+        "expected": {
+            "carried": [[6], [3]],
+            "edge_drops": [[2], [1]],
+            "delivered": [6, 3],
+            "edge_flows": [9],
+        },
+    },
+    {
+        "id": "D-key-tie",
+        "oracle": "lossy",
+        "input": {"offers": [1, 1], "routes": [[0], [0]], "cap": [1]},
+        "expected": {
+            "carried": [[1], [0]],
+            "edge_drops": [[0], [1]],
+            "delivered": [1, 0],
+            "edge_flows": [1],
+        },
+    },
+    {
+        "id": "D-rounding",
+        "oracle": "lossy",
+        "input": {"offers": [5, 1, 1], "routes": [[0], [0], [0]], "cap": [3]},
+        "expected": {
+            "carried": [[3], [0], [0]],
+            "edge_drops": [[2], [1], [1]],
+            "delivered": [3, 0, 0],
+            "edge_flows": [3],
+        },
+    },
+    {
+        "id": "D-hierarchy",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 1, 2],
+            "routes": [[0], [0], [0]],
+            "cap": [1],
+            "labels": [[0, 0, 0], [0, 0, 1], [1, 0, 0]],
+        },
+        "expected": {
+            "carried": [[1], [0], [0]],
+            "edge_drops": [[0], [1], [2]],
+            "delivered": [1, 0, 0],
+            "edge_flows": [1],
+        },
+    },
+    {
+        "id": "D-cycle-compressed",
+        "oracle": "lossy",
+        "input": {"offers": [1, 1], "routes": [[0, 1], [1, 0]], "cap": [2, 2]},
+        "expected": {
+            "carried": [[1, 1], [1, 1]],
+            "edge_drops": [[0, 0], [0, 0]],
+            "delivered": [1, 1],
+            "edge_flows": [2, 2],
+        },
+    },
+    {
+        "id": "D-zero-service",
+        "oracle": "lossy",
+        "input": {"offers": [2], "routes": [[0]], "cap": [0]},
+        "expected": {
+            "carried": [[0]],
+            "edge_drops": [[2]],
+            "delivered": [0],
+            "edge_flows": [0],
+        },
+    },
+    {
+        "id": "D-subdivision-before",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 1, 1],
+            "routes": [[0, 1], [0, 2], [0, 3]],
+            "cap": [1, 1, 1, 1],
+            "labels": [[0, 0, 0], [0, 0, 1], [0, 0, 2]],
+        },
+        "expected": {
+            "carried": [[1, 1], [0, 0], [0, 0]],
+            "delivered": [1, 0, 0],
+            "edge_flows": [1, 1, 0, 0],
+        },
+    },
+    {
+        "id": "D-subdivision-after",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 1, 1],
+            "routes": [[0, 1, 2], [0, 3], [0, 4]],
+            "cap": [1, 1, 1, 1, 1],
+            "labels": [[0, 0, 0], [0, 0, 1], [0, 0, 2]],
+        },
+        "expected": {
+            "carried": [[1, 1, 1], [0, 0], [0, 0]],
+            "delivered": [1, 0, 0],
+            "edge_flows": [1, 1, 1, 0, 0],
+        },
+    },
+    {
+        "id": "E-support-pinned-loss",
+        "oracle": "lossy",
+        "input": {
+            "offers": [6, 6],
+            "routes": [[0, 1], [2, 3]],
+            "cap": [10, 2, 10, 10],
+            "labels": [[0, 0, 0], [0, 0, 1]],
+        },
+        "expected": {
+            "carried": [[6, 2], [6, 6]],
+            "edge_drops": [[0, 4], [0, 0]],
+            "delivered": [2, 6],
+            "edge_flows": [6, 2, 6, 6],
+        },
+    },
+    {
+        "id": "D-C2",
+        "oracle": "lossy",
+        "input": {"offers": [1, 2], "routes": [[0, 1], [1, 0]], "cap": [1, 2]},
+        "expected": {
+            "error": "lossy forwarding iteration entered a period-2 cycle",
+            "rounds": 3,
+        },
+    },
+    {
+        "id": "E-ledger",
+        "oracle": "ledger",
+        "input": {
+            "service": 10,
+            "reservation": 10,
+            "carried": 4,
+            "strict": 6,
+            "new_delivery": 2,
+            "old_delivery": 4,
+        },
+        "expected": {
+            "carried": 4,
+            "residual": 6,
+            "reserved": 6,
+            "unreserved": 4,
+            "delivery_delta": -2,
+        },
+    },
+    {
+        "id": "RC02-increment",
+        "oracle": "epoch",
+        "input": {"cap": [1, 1], "calls": [1, 1]},
+        "expected": {
+            "requested": 2,
+            "delivered": 1,
+            "edge_drops": 1,
+            "edge_flows": [1, 0],
+            "residual": [0, 1],
+            "per_call_delivery": [1, 0],
+        },
+    },
+    {
+        "id": "RC02-increment-lossless",
+        "oracle": "epoch",
+        "input": {"cap": [1, 1], "calls": [1, 1], "admission": "LOSSLESS"},
+        "expected": {
+            "requested": 2,
+            "delivered": 2,
+            "edge_drops": 0,
+            "edge_flows": [1, 1],
+            "residual": [0, 0],
+            "per_call_delivery": [1, 1],
+        },
+    },
+    {
+        "id": "RC02-full",
+        "oracle": "epoch",
+        "input": {"cap": [1, 1], "calls": [1, 1], "full": True},
+        "expected": {
+            "requested": 2,
+            "delivered": 2,
+            "edge_drops": 0,
+            "edge_flows": [1, 1],
+            "residual": [0, 0],
+            "per_call_delivery": [2],
+        },
+    },
+    {
+        "id": "INC-lossless",
+        "oracle": "increments",
+        "input": {"caps": [1, 3], "calls": [3, 1], "admission": "LOSSLESS"},
+        "expected": {
+            "call_delivered": [2, 0],
+            "requested": 4,
+            "admitted": 2,
+            "unadmitted": 2,
+            "offered": None,
+            "delivered": 2,
+        },
+    },
+    {
+        "id": "INC-lossy",
+        "oracle": "increments",
+        "input": {"caps": [1, 3], "calls": [3, 1], "admission": "LOSSY"},
+        "expected": {
+            "call_delivered": [2, 1],
+            "requested": 4,
+            "offered": 4,
+            "edge_drops": [1, 0],
+            "unadmitted": 0,
+            "delivered": 3,
+        },
+    },
+    {
+        "id": "INC-lossless-refusal",
+        "oracle": "increments",
+        "input": {
+            "caps": [10],
+            "calls": [5, 1],
+            "admission": "LOSSLESS",
+            "outside": [[8], [5]],
+        },
+        "expected": {
+            "call_delivered": [2, 1],
+            "requested": 6,
+            "admitted": 3,
+            "unadmitted": 3,
+            "delivered": 3,
+        },
+    },
+    {
+        "id": "R4-refusal",
+        "oracle": "refusal",
+        "input": {"capacity": 10, "outside": [8, 5], "calls": [5, 1]},
+        "expected": {"correct": [2, 3], "requeue": [2, 5]},
+    },
+    {
+        "id": "RC02-zero-unprepared",
+        "oracle": "zero_state",
+        "input": {"service": [5, 8], "outside": [1, 2]},
+        "expected": {
+            "call_delivered": 0,
+            "call_undelivered": 0,
+            "delivery_delta": 0,
+            "call_edge_drops": [],
+            "call_source_drops": 0,
+            "termination": "COMPLETE",
+            "routes_changed": False,
+            "weights_changed": False,
+            "reservations_changed": False,
+            "program": None,
+            "edge_flows": [0, 0],
+            "edge_reservations": [0, 0],
+            "residual": [4, 6],
+            "min_cut": None,
+            "marginal_cost_curve": None,
+        },
+    },
+    {
+        "id": "FLAGS-controller-increment",
+        "oracle": "change_flags",
+        "input": {
+            "path_cap": 20,
+            "calls": [["place", 5], ["place", 5], ["replace", 10]],
+            "recomputed": True,
+        },
+        "expected": {
+            "routes_changed": [False, False],
+            "weights_changed": [True, False],
+            "reservations_changed": [False, False],
+        },
+    },
+    {
+        "id": "FLAGS-fixed-offer",
+        "oracle": "change_flags",
+        "input": {
+            "path_cap": 20,
+            "calls": [["replace", 5], ["replace", 10], ["replace", 10]],
+            "recomputed": False,
+        },
+        "expected": {
+            "routes_changed": [False, False],
+            "weights_changed": [False, False],
+            "reservations_changed": [False, False],
+        },
+    },
+    {
+        "id": "ERR-ownership-texts",
+        "oracle": "ownership_texts",
+        "input": {
+            "objects": [
+                "program",
+                "support",
+                "black_holes",
+                "Eligibility",
+                "ShortestPathCache",
+                "dag",
+            ]
+        },
+        "expected": [
+            "program belongs to another graph",
+            "support belongs to another graph",
+            "black_holes belongs to another graph",
+            "foreign Eligibility: built for another graph",
+            "foreign ShortestPathCache: bound to another graph",
+            "dag belongs to another graph",
+        ],
+    },
+    {
+        "id": "T2-prefer-headroom-off",
+        "oracle": "t2",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 2,
+            "prefer_headroom": False,
+            "lossy_offer": 12,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 10,
+            "planned_bandwidth_per_tunnel": 1,
+            "counts": [2, 0],
+            "max_lossless_offer": 10,
+            "lossy_delivery": 10,
+        },
+    },
+    {
+        "id": "T2-prefer-headroom-on",
+        "oracle": "t2",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 1, 10, 1]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "design_demand": 2,
+            "prefer_headroom": True,
+            "lossy_offer": 12,
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 10,
+            "planned_bandwidth_per_tunnel": 1,
+            "counts": [1, 1],
+            "headroom_penalty": 858993458,
+            "max_lossless_offer": 20,
+            "lossy_delivery": 12,
+        },
+    },
+    {
+        "id": "T2-support",
+        "oracle": "t2",
+        "input": {
+            "edges": [[0, 1, 6, 1], [0, 1, 6, 1], [0, 1, 100, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "support": [0, 1],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 6,
+            "counts": [1, 1, 0],
+            "max_lossless_offer": 12,
+        },
+    },
+    {
+        "id": "T2-support-masked",
+        "oracle": "t2",
+        "input": {
+            "edges": [[0, 1, 6, 1], [0, 1, 6, 1], [0, 1, 100, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "support": [0, 1],
+            "excluded": [1],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 3,
+            "counts": [2, 0, 0],
+            "paths": [[0], [0]],
+            "entry_ids": [0, 1],
+            "max_lossless_offer": 6,
+        },
+    },
+    {
+        "id": "T2-support-mask-outside",
+        "oracle": "t2",
+        "input": {
+            "edges": [[0, 1, 6, 1], [0, 1, 6, 1], [0, 1, 100, 2]],
+            "heads": [0],
+            "destinations": [1],
+            "per_head": 2,
+            "support": [0, 1],
+            "excluded": [2],
+        },
+        "expected": {
+            "max_bandwidth_per_tunnel": 6,
+            "counts": [1, 1, 0],
+            "paths": [[0], [1]],
+            "entry_ids": [0, 1],
+            "max_lossless_offer": 12,
+        },
+    },
+    {
+        "id": "CFG-defaults",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {"model": "ShortestPaths", "kwargs": {}},
+                {"model": "ShortestPaths", "kwargs": {"allocation": "EQUAL"}},
+                {"model": "ShortestPaths", "kwargs": {"allocation": "WEIGHTED"}},
+                {"model": "ShortestPaths", "kwargs": {"allocation": "OPTIMIZED"}},
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "tunnel_count": "16"},
+                },
+            ]
+        },
+        "expected": [
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "allocation=OPTIMIZED source_allocation=OPTIMIZED weight_basis=None tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "source_allocation=EQUAL support=None tunnel_count=16 prefer_headroom=False",
+        ],
+    },
+    {
+        "id": "CFG-construction",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {"model": "CentralizedTE", "kwargs": {}},
+                {"model": "CentralizedTE", "kwargs": {"source_allocation": None}},
+                {"model": "CentralizedTE", "kwargs": {"tunnel_count": "16"}},
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "selection": "default"},
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4", "source_allocation": "EQUAL"},
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4", "multipath": False},
+                },
+                {"model": "Pinned", "kwargs": {"program": "p", "allocation": "EQUAL"}},
+                {
+                    "model": "FlowPolicyConfig",
+                    "kwargs": {"routing": "ShortestPaths()", "allocation": "EQUAL"},
+                },
+                {"model": "ShortestPaths", "kwargs": {"multipath": None}},
+                {"model": "ShortestPaths", "kwargs": {"placement": "EQUAL"}},
+            ]
+        },
+        "expected": [
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+            "TypeError",
+        ],
+    },
+    {
+        "id": "CFG-matrix",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"source_allocation": "OPTIMIZED"},
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"allocation": "OPTIMIZED"},
+                    "admission": "LOSSY",
+                },
+                {"model": "ShortestPaths", "kwargs": {"tie_break": "HIGHER_CAPACITY"}},
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"tie_break": "HIGHER_CAPACITY", "multipath": False},
+                    "sources": 2,
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"tie_break": "HIGHER_CAPACITY", "multipath": False},
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"tie_break": "HIGHER_HEADROOM", "parallel_edges": False},
+                    "sources": 2,
+                },
+                {"model": "ShortestPaths", "kwargs": {"weight_basis": "CAPACITY"}},
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"allocation": "WEIGHTED", "weight_basis": "EXPLICIT"},
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "OPTIMIZED", "tunnel_count": "2"},
+                    "sources": 2,
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "OPTIMIZED", "tunnel_count": "2"},
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL"},
+                    "admission": "LOSSY",
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {
+                        "source_allocation": "EQUAL",
+                        "support": "dag",
+                        "tunnel_count": "2",
+                    },
+                    "admission": "LOSSY",
+                },
+                {"model": "DistributedTE", "kwargs": {"tunnel_count": "4 up_to"}},
+            ]
+        },
+        "expected": [
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+            "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+            "ShortestPaths tie_break requires multipath=False or parallel_edges=False",
+            "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False",
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_CAPACITY multipath=False parallel_edges=True",
+            "allocation=EQUAL source_allocation=EQUAL weight_basis=None tie_break=HIGHER_HEADROOM multipath=True parallel_edges=False",
+            "weight_basis requires allocation=WEIGHTED",
+            "weight_basis=EXPLICIT requires edge_weights",
+            "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+            "source_allocation=OPTIMIZED support=None tunnel_count=2 prefer_headroom=False",
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+            "prefer_headroom requires tunnel_count",
+            "source_allocation=EQUAL support=dag tunnel_count=2 prefer_headroom=False",
+            "DistributedTE requires an exact tunnel count",
+        ],
+    },
+    {
+        "id": "CFG-first-error",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                    "admission": "LOSSY",
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {
+                        "source_allocation": "OPTIMIZED",
+                        "weight_basis": "CAPACITY",
+                    },
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {
+                        "allocation": "OPTIMIZED",
+                        "tie_break": "HIGHER_CAPACITY",
+                    },
+                    "admission": "LOSSY",
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {
+                        "tie_break": "HIGHER_CAPACITY",
+                        "weight_basis": "CAPACITY",
+                    },
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {
+                        "tie_break": "HIGHER_CAPACITY",
+                        "multipath": False,
+                        "weight_basis": "CAPACITY",
+                    },
+                    "sources": 2,
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {
+                        "source_allocation": "OPTIMIZED",
+                        "tunnel_count": "0",
+                        "prefer_headroom": True,
+                    },
+                    "sources": 2,
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {
+                        "tunnel_count": "0 up_to",
+                        "cost_ceiling": ["fraction", 1, 2],
+                    },
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {
+                        "tunnel_count": "4 up_to",
+                        "cost_ceiling": ["fraction", 1, 2],
+                    },
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {
+                        "tunnel_count": "4",
+                        "cost_ceiling": ["fraction", 1, 2],
+                        "min_unreserved_bandwidth": -1,
+                    },
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4", "min_unreserved_bandwidth": -1},
+                },
+            ]
+        },
+        "expected": [
+            "CentralizedTE without tunnel_count requires admission=LOSSLESS",
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+            "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+            "ShortestPaths tie_break requires multipath=False or parallel_edges=False",
+            "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False",
+            "CentralizedTE with tunnel_count and several sources requires source_allocation=EQUAL",
+            "tunnel count must be in [1, 10000]",
+            "DistributedTE requires an exact tunnel count",
+            "cost_ceiling CostStretch factor must be >= 1 (got 1/2)",
+            "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+        ],
+    },
+    {
+        "id": "EVAL-first-error",
+        "oracle": "evaluation_validation",
+        "input": {
+            "cases": [
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                    "offer": -1,
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4"},
+                    "admission": "LOSSY",
+                    "offer": -1,
+                    "design_demand": math.inf,
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4"},
+                    "admission": "LOSSY",
+                    "offer": 5,
+                    "design_demand": math.inf,
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4"},
+                    "admission": "LOSSY",
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4"},
+                    "admission": "LOSSY",
+                    "design_demand": 10,
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {},
+                    "offer": math.inf,
+                    "design_demand": 5,
+                },
+                {"model": "ShortestPaths", "kwargs": {}, "design_demand": 5},
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "tunnel_count": "16"},
+                    "admission": "LOSSY",
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "tunnel_count": "16"},
+                    "admission": "LOSSY",
+                    "design_demand": 10,
+                },
+                {"model": "Pinned", "kwargs": {"program": "p"}, "admission": "LOSSY"},
+                {"model": "ShortestPaths", "kwargs": {}, "admission": "LOSSY"},
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {},
+                    "admission": "LOSSY",
+                    "offer": 4,
+                },
+            ]
+        },
+        "expected": [
+            "prefer_headroom requires tunnel_count",
+            "offer must be an integer in [0, 2^62)",
+            "DistributedTE requires a finite design demand",
+            "DistributedTE evaluation requires design_demand",
+            "DistributedTE LOSSY evaluation requires a finite offer",
+            "offer must be an integer in [0, 2^62)",
+            "ShortestPaths does not accept design_demand",
+            "CentralizedTE LOSSY evaluation requires a finite offer",
+            "offer=10 design_demand=10",
+            "Pinned LOSSY evaluation requires a finite offer",
+            "offer=first-hop experiment design_demand=None",
+            "offer=4 design_demand=None",
+        ],
+    },
+    {
+        "id": "CFG-cache-order",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "0"},
+                    "cache": True,
+                },
+                {
+                    "model": "Pinned",
+                    "kwargs": {"program": {"sources": [0], "destinations": [2]}},
+                    "cache": True,
+                    "endpoints": [[0], [1]],
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "tunnel_count": "0"},
+                    "cache": True,
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                    "cache": True,
+                },
+                {
+                    "model": "ShortestPaths",
+                    "kwargs": {"allocation": "WEIGHTED"},
+                    "cache": True,
+                },
+                {"model": "DistributedTE", "kwargs": {"tunnel_count": "0"}},
+                {
+                    "model": "Pinned",
+                    "kwargs": {"program": {"sources": [0], "destinations": [2]}},
+                    "endpoints": [[0], [1]],
+                },
+                {
+                    "model": "Pinned",
+                    "kwargs": {"program": {"sources": [0], "destinations": [1]}},
+                    "endpoints": [[0], [1]],
+                },
+            ]
+        },
+        "expected": [
+            "DistributedTE does not use ShortestPathCache",
+            "Pinned does not use ShortestPathCache",
+            "CentralizedTE does not use ShortestPathCache",
+            "prefer_headroom requires tunnel_count",
+            "allocation=WEIGHTED source_allocation=EQUAL weight_basis=CAPACITY tie_break=FEWER_HOPS multipath=True parallel_edges=True",
+            "tunnel count must be in [1, 10000]",
+            "program endpoints do not match policy endpoints",
+            "valid",
+        ],
+    },
+    {
+        "id": "EVAL-offer-infinite",
+        "oracle": "evaluation_validation",
+        "input": {
+            "cases": [
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                    "offer": math.inf,
+                },
+                {
+                    "model": "CentralizedTE",
+                    "kwargs": {"source_allocation": "EQUAL", "prefer_headroom": True},
+                    "offer": "4",
+                },
+                {"model": "ShortestPaths", "kwargs": {}, "offer": math.inf},
+            ]
+        },
+        "expected": [
+            "prefer_headroom requires tunnel_count",
+            "TypeError",
+            "offer must be an integer in [0, 2^62)",
+        ],
+    },
+    {
+        "id": "CFG-ceiling-type",
+        "oracle": "model_config",
+        "input": {
+            "cases": [
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "0", "cost_ceiling": ["other", 1.5]},
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4", "cost_ceiling": ["other", 2]},
+                },
+                {
+                    "model": "DistributedTE",
+                    "kwargs": {"tunnel_count": "4", "cost_ceiling": ["fraction", 3, 2]},
+                },
+            ]
+        },
+        "expected": [
+            "TypeError: cost_ceiling must be AbsoluteCost, CostStretch or None",
+            "TypeError: cost_ceiling must be AbsoluteCost, CostStretch or None",
+            "valid",
+        ],
+    },
+    {
+        "id": "KSP-ceiling-type",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 10, 5]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [10, 10],
+            "stretch": ["other", 1.5],
+        },
+        "expected": {
+            "error": "TypeError: cost_ceiling must be AbsoluteCost, CostStretch or None"
+        },
+    },
+    {
+        "id": "T1-stretch-below-one",
+        "oracle": "t1",
+        "input": {
+            "edges": [[0, 1, 10, 5]],
+            "heads": [0],
+            "destinations": [1],
+            "design_demand": 1,
+            "per_head": 1,
+            "offer": 1,
+            "stretch": ["fraction", 1, 2],
+        },
+        "expected": {"error": "cost_ceiling CostStretch factor must be >= 1 (got 1/2)"},
+    },
+    {
+        "id": "KSP-stretch-below-one",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 10, 5]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "stretch": ["fraction", 1, 2],
+        },
+        "expected": {"error": "cost_ceiling CostStretch factor must be >= 1 (got 1/2)"},
+    },
+    {
+        "id": "KSP-ceiling-before-residual",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 10, 5]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [10, 10],
+            "stretch": ["fraction", 1, 2],
+        },
+        "expected": {"error": "cost_ceiling CostStretch factor must be >= 1 (got 1/2)"},
+    },
+    {
+        "id": "KSP-residual-length",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 10, 5]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [10, 10],
+            "stretch": ["fraction", 3, 2],
+        },
+        "expected": {"error": "residual has length 2, expected 1 (one entry per edge)"},
+    },
+    {
+        "id": "TIE-parallel",
+        "oracle": "tie_choice",
+        "input": {
+            "edges": [[0, 1, 4, 1], [0, 1, 10, 1], [0, 1, 100, 1], [0, 1, 1000, 2]],
+            "source": 0,
+            "destination": 1,
+            "available": [4, 8, 5, 1000],
+        },
+        "expected": {
+            "FEWER_HOPS": [0],
+            "HIGHER_CAPACITY": [2],
+            "HIGHER_AVAILABLE_CAPACITY": [1],
+            "HIGHER_HEADROOM": [0],
+        },
+    },
+    {
+        "id": "TIE-routes",
+        "oracle": "tie_choice",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 2, 3, 2], [1, 2, 10, 1]],
+            "source": 0,
+            "destination": 2,
+        },
+        "expected": {
+            "FEWER_HOPS": [1],
+            "HIGHER_CAPACITY": [0, 2],
+            "HIGHER_AVAILABLE_CAPACITY": [0, 2],
+            "HIGHER_HEADROOM": [1],
+        },
+    },
+    {
+        "id": "TIE-bottleneck",
+        "oracle": "tie_choice",
+        "input": {
+            "edges": [[0, 1, 10, 1], [0, 2, 3, 2], [1, 2, 1, 1]],
+            "source": 0,
+            "destination": 2,
+        },
+        "expected": {
+            "FEWER_HOPS": [1],
+            "HIGHER_CAPACITY": [1],
+            "HIGHER_AVAILABLE_CAPACITY": [1],
+            "HIGHER_HEADROOM": [1],
+        },
+    },
+    {
+        "id": "EVAL-fixed-offer",
+        "oracle": "evaluate_offer",
+        "input": {"capacities": [10, 10], "offer": 4},
+        "expected": {"baseline": 4, "delivery_reduction": [0, 0]},
+    },
+    {
+        "id": "EVAL-first-hop",
+        "oracle": "evaluate_offer",
+        "input": {"capacities": [10, 10]},
+        "expected": {"baseline": 20, "delivery_reduction": [10, 10]},
+    },
+    {
+        "id": "EVAL-first-hop-unequal",
+        "oracle": "evaluate_offer",
+        "input": {"capacities": [4, 10]},
+        "expected": {
+            "baseline": 14,
+            "delivery_reduction": [4, 10],
+            "requested": math.inf,
+            "offered": 14,
+            "edge_drops": [0, 0],
+        },
+    },
+    {
+        "id": "EVAL-fixed-offer-unequal",
+        "oracle": "evaluate_offer",
+        "input": {"capacities": [4, 10], "offer": 12},
+        "expected": {
+            "baseline": 10,
+            "delivery_reduction": [0, 6],
+            "requested": 12,
+            "offered": 12,
+            "edge_drops": [2, 0],
+        },
+    },
+    {
+        "id": "DAG-pooled",
+        "oracle": "dag_contexts",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 1, 1], [2, 3, 1, 1]],
+            "sources": [0, 1],
+            "destination": 3,
+            "offer": 2,
+            "pooled": True,
+        },
+        "expected": {"lossless_bound": 2, "lossy_delivered": 2},
+    },
+    {
+        "id": "DAG-separate",
+        "oracle": "dag_contexts",
+        "input": {
+            "edges": [[0, 2, 10, 1], [1, 2, 10, 1], [2, 3, 1, 1], [2, 3, 1, 1]],
+            "sources": [0, 1],
+            "destination": 3,
+            "offer": 2,
+            "pooled": False,
+        },
+        "expected": {"lossless_bound": 1, "lossy_delivered": 1},
+    },
+    {
+        "id": "STRETCH-values",
+        "oracle": "stretch_values",
+        "input": {
+            "factors": [
+                ["float", 1.2],
+                ["float", 1.1],
+                ["float", 1.5],
+                ["float", 0.30000000000000004],
+                ["fraction", 6, 5],
+                ["fraction", 18446744073709551616, 4611686018427387904],
+                ["int", 2],
+                ["float", math.inf],
+                ["float", 1e19],
+                ["fraction", 1, 9223372036854775808],
+                ["bool", True],
+                ["index", 3],
+                ["str", "1.2"],
+            ],
+            "equal_pairs": [
+                [["float", 1.5], ["fraction", 3, 2]],
+                [["float", 1.2], ["fraction", 6, 5]],
+                [["float", 1.2], ["fraction", 5404319552844595, 4503599627370496]],
+            ],
+        },
+        "expected": {
+            "values": [
+                "6/5",
+                "11/10",
+                "3/2",
+                "7500000000000001/25000000000000000",
+                "6/5",
+                "4/1",
+                "2/1",
+                "CostStretch factor must be finite (got inf)",
+                "CostStretch fraction numerator must be in [-2^63, 2^63)",
+                "CostStretch fraction denominator must be in [1, 2^63)",
+                "TypeError",
+                "3/1",
+                "TypeError",
+            ],
+            "equal": [True, True, False],
+        },
+    },
+    {
+        "id": "STRETCH-numpy",
+        "oracle": "stretch_values",
+        "input": {
+            "factors": [
+                ["numpy", "float64", 1.2],
+                ["numpy", "float32", 1.2],
+                ["numpy", "float16", 1.2],
+                ["numpy", "float32", 0.30000001192092896],
+                ["numpy", "int64", 2],
+                ["numpy", "float64", math.nan],
+                ["numpy", "float32", math.inf],
+                ["numpy", "float64", 1e19],
+                ["numpy", "bool_", True],
+            ],
+            "equal_pairs": [
+                [["numpy", "float32", 1.2], ["fraction", 6, 5]],
+                [["numpy", "float64", 1.2], ["float", 1.2]],
+            ],
+        },
+        "expected": {
+            "values": [
+                "6/5",
+                "6/5",
+                "6/5",
+                "3/10",
+                "2/1",
+                "CostStretch factor must be finite (got nan)",
+                "CostStretch factor must be finite (got inf)",
+                "CostStretch fraction numerator must be in [-2^63, 2^63)",
+                "TypeError",
+            ],
+            "equal": [True, True],
+        },
+    },
+    {
+        "id": "KSP-stretch-numpy",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 100000000], [0, 1, 10, 120000001]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [0, 10],
+            "stretch": ["numpy", "float32", 1.2],
+        },
+        "expected": {"paths": []},
+    },
+    {
+        "id": "KSP-stretch-numpy-equal",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 100000000], [0, 1, 10, 120000000]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [0, 10],
+            "stretch": ["numpy", "float32", 1.2],
+        },
+        "expected": {"paths": [[120000000, [1]]]},
+    },
+    {
+        "id": "KSP-stretch-boundary",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 5], [0, 1, 10, 6]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [0, 10],
+            "stretch": ["float", 1.2],
+        },
+        "expected": {"paths": [[6, [1]]]},
+    },
+    {
+        "id": "KSP-stretch-below",
+        "oracle": "search",
+        "input": {
+            "edges": [[0, 1, 0, 5], [0, 1, 10, 6]],
+            "source": 0,
+            "destinations": 1,
+            "k": 2,
+            "residual": [0, 10],
+            "stretch": ["fraction", 11, 10],
+        },
+        "expected": {"paths": []},
+    },
+    {
+        "id": "TERM-T1-all-down",
+        "oracle": "termination",
+        "input": {
+            "offer": 14,
+            "model": "t1",
+            "args": {
+                "edges": [
+                    [0, 1, 6, 1],
+                    [0, 2, 6, 3],
+                    [1, 2, 4, 1],
+                    [1, 3, 6, 3],
+                    [2, 3, 6, 1],
+                ],
+                "heads": [0],
+                "destinations": [3],
+                "design_demand": 14,
+                "per_head": 2,
+            },
+        },
+        "expected": {
+            "tunnels": 2,
+            "lossy": "COMPLETE",
+            "lossless": "EXHAUSTED",
+            "source_drops": [14],
+            "forward_error": None,
+        },
+    },
+    {
+        "id": "TERM-T2-all-dead",
+        "oracle": "termination",
+        "input": {
+            "offer": 10,
+            "model": "t2",
+            "args": {
+                "edges": [[0, 2, 0, 1], [1, 2, 0, 1]],
+                "heads": [0, 1],
+                "destinations": [2],
+                "per_head": 2,
+                "design_demand": 10,
+            },
+        },
+        "expected": {
+            "tunnels": 0,
+            "lossy": "COMPLETE",
+            "lossless": "EXHAUSTED",
+            "source_drops": [5, 5],
+            "forward_error": None,
+        },
+    },
+    {
+        "id": "TERM-zero-weight-route",
+        "oracle": "termination",
+        "input": {"offer": 4, "program": [[0], [[0, True, 0]]]},
+        "expected": {
+            "tunnels": 1,
+            "lossy": "NO_ACTIVE_WEIGHT",
+            "lossless": "NO_ACTIVE_WEIGHT",
+            "source_drops": [4],
+            "forward_error": None,
+        },
+    },
+    {
+        "id": "T2-no-tunnels-forward",
+        "oracle": "termination",
+        "input": {
+            "offer": 10,
+            "model": "t2",
+            "args": {
+                "edges": [[0, 2, 1, 1], [1, 2, 100, 1]],
+                "heads": [0, 1],
+                "destinations": [2],
+                "per_head": 16,
+            },
+        },
+        "expected": {
+            "tunnels": 0,
+            "lossy": "COMPLETE",
+            "lossless": "EXHAUSTED",
+            "source_drops": [5, 5],
+            "forward_error": None,
+        },
+    },
+    {
+        "id": "ERR-unreserved-texts",
+        "oracle": "input_texts",
+        "input": {
+            "cases": [
+                {
+                    "min_unreserved_bandwidth": 4611686018427387904,
+                    "capacities": [10, 10],
+                    "reservation_baseline": [[1, 2, 3]],
+                },
+                {
+                    "min_unreserved_bandwidth": -1,
+                    "capacities": [10, 10],
+                    "reservation_baseline": [[5, 11]],
+                },
+                {
+                    "min_unreserved_bandwidth": 0,
+                    "capacities": [10, 10],
+                    "reservation_baseline": [[10, 0]],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+                "reservation_baseline has length 3, expected 2 (one entry per edge)",
+            ],
+            [
+                "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+                "reservation_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]",
+            ],
+            [None, None],
+        ],
+    },
+    {
+        "id": "ERR-class-search",
+        "oracle": "input_classes",
+        "input": {
+            "cases": [
+                {
+                    "entry": "spf min_residual",
+                    "values": [
+                        ["bool", 1],
+                        ["float", 1.0],
+                        ["str", "1"],
+                        ["none"],
+                        ["float", "inf"],
+                        0,
+                        -3,
+                        1,
+                    ],
+                },
+                {
+                    "entry": "ksp k",
+                    "values": [
+                        ["bool", 1],
+                        ["float", "inf"],
+                        ["str", "2"],
+                        0,
+                        -5,
+                        1180591620717411303424,
+                        3,
+                    ],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: min_residual must be an integer (got bool)",
+                "TypeError: min_residual must be an integer (got float)",
+                "TypeError: min_residual must be an integer (got str)",
+                "TypeError: min_residual must be an integer (got NoneType)",
+                "TypeError: min_residual must be an integer (got float)",
+                "ValueError: min_residual must be at least 1 unit (got 0)",
+                "ValueError: min_residual must be at least 1 unit (got -3)",
+                "valid",
+            ],
+            [
+                "TypeError: k must be an integer (got bool)",
+                "TypeError: k must be an integer (got float)",
+                "TypeError: k must be an integer (got str)",
+                "ValueError: k must be >= 1 (got 0)",
+                "ValueError: k must be >= 1 (got -5)",
+                "valid",
+                "valid",
+            ],
+        ],
+    },
+    {
+        "id": "ERR-class-call",
+        "oracle": "input_classes",
+        "input": {
+            "cases": [
+                {
+                    "entry": "place offer",
+                    "values": [
+                        ["bool", 1],
+                        ["bool", 0],
+                        ["str", "1"],
+                        ["none"],
+                        ["fraction", 1, 1],
+                        ["float", 1.5],
+                        ["float", 0.0],
+                        ["float", "-inf"],
+                        ["float", "nan"],
+                        -1,
+                        4611686018427387904,
+                        9223372036854775808,
+                        ["float", "inf"],
+                        0,
+                        4611686018427387903,
+                    ],
+                }
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "valid",
+                "valid",
+                "valid",
+            ]
+        ],
+    },
+    {
+        "id": "ERR-class-vector",
+        "oracle": "input_classes",
+        "input": {
+            "cases": [
+                {
+                    "entry": "service_baseline",
+                    "caps": [10, 10],
+                    "values": [
+                        ["list", ["bool", 1], 0],
+                        ["list", ["float", 1.0], 0],
+                        ["list", 0, ["str", "0"]],
+                        ["str", "ab"],
+                        5,
+                        ["list", ["list", 0], 0],
+                        ["list", 0],
+                        ["list", ["bool", 1]],
+                        ["list", 0, 11],
+                        ["list", -1, 0],
+                        ["list", 1180591620717411303424, 0],
+                        ["list", 3, 10],
+                    ],
+                }
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: service_baseline (units)[0] must be an integer (got bool)",
+                "TypeError: service_baseline (units)[0] must be an integer (got float)",
+                "TypeError: service_baseline (units)[1] must be an integer (got str)",
+                "TypeError: service_baseline must be a 1-D sequence of integers (got str)",
+                "TypeError: service_baseline must be a 1-D sequence of integers (got int)",
+                "TypeError: service_baseline must be a 1-D sequence of integers (entry 0 is a sequence)",
+                "ValueError: service_baseline has length 1, expected 2 (one entry per edge)",
+                "ValueError: service_baseline has length 1, expected 2 (one entry per edge)",
+                "ValueError: service_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]",
+                "ValueError: service_baseline[0] = -1 is outside [0, edge_capacity_units[0] = 10]",
+                "ValueError: service_baseline[0] = 1180591620717411303424 is outside [0, edge_capacity_units[0] = 10]",
+                "valid",
+            ]
+        ],
+    },
+    {
+        "id": "ERR-class-numpy",
+        "oracle": "input_classes",
+        "input": {
+            "cases": [
+                {
+                    "entry": "place offer",
+                    "values": [
+                        ["numpy", "bool_", True],
+                        ["numpy", "float64", 1.5],
+                        ["numpy", "float32", "-inf"],
+                        ["numpy", "float64", "inf"],
+                        ["numpy", "int64", 2],
+                        ["numpy", "uint64", 9223372036854775808],
+                    ],
+                },
+                {
+                    "entry": "ksp k",
+                    "values": [
+                        ["numpy", "int64", 1],
+                        ["numpy", "float64", 1.0],
+                        ["numpy", "bool_", True],
+                    ],
+                },
+                {
+                    "entry": "service_baseline",
+                    "caps": [10, 10],
+                    "values": [
+                        ["array", "float64", [1, 1]],
+                        ["array", "int64", [[1, 1]]],
+                        ["array", "float64", [1]],
+                        ["array", "int64", [1, 11]],
+                        ["array", "uint8", [1, 10]],
+                    ],
+                },
+                {
+                    "entry": "apply_actions",
+                    "values": [
+                        {"ledger": "own", "offer": ["numpy", "bool_", True]},
+                        {"ledger": "own", "offer": ["numpy", "float32", 1.5]},
+                        {"ledger": "own", "offer": ["numpy", "int64", 5]},
+                    ],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "valid",
+                "valid",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+            ],
+            [
+                "valid",
+                "TypeError: k must be an integer (got float64)",
+                "TypeError: k must be an integer (got bool)",
+            ],
+            [
+                "TypeError: service_baseline (units) entries must be integers (got dtype float64)",
+                "TypeError: service_baseline must be a 1-D array (got 2 dimensions)",
+                "ValueError: service_baseline has length 1, expected 2 (one entry per edge)",
+                "ValueError: service_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]",
+                "valid",
+            ],
+            [
+                "TypeError: offer must be an int or a float (got bool)",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "valid",
+            ],
+        ],
+    },
+    {
+        "id": "ERR-number-resolution",
+        "oracle": "number_types",
+        "input": {
+            "cases": [
+                {
+                    "entry": "resolution",
+                    "values": [
+                        1,
+                        ["float", 0.5],
+                        ["float", 2.3283064365386963e-10],
+                        4294967296,
+                        ["decimal", "1"],
+                        ["fraction", 1, 1],
+                        ["floatonly", 1.0],
+                        ["index", 1],
+                        ["bool", 1],
+                        ["str", "1"],
+                        ["none"],
+                        ["float", 0.75],
+                        ["float", "nan"],
+                        ["float", "inf"],
+                        8589934592,
+                        ["pow2", 1024],
+                        0,
+                        -1,
+                    ],
+                }
+            ]
+        },
+        "expected": [
+            [
+                "valid",
+                "valid",
+                "valid",
+                "valid",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+            ]
+        ],
+    },
+    {
+        "id": "ERR-number-list",
+        "oracle": "number_types",
+        "input": {
+            "cases": [
+                {
+                    "entry": "to_units",
+                    "resolution": 1.0,
+                    "values": [
+                        ["list", ["pow2", 64], 1.5],
+                        ["list", ["decimal", "1"], 1.5],
+                        ["list", ["fraction", 3, 2], 1],
+                        ["list", ["floatonly", 1.0]],
+                        ["list", ["index", 1], 2],
+                        ["list", ["decimal", "1"], ["pow2", 64]],
+                        ["list", -1.5, ["pow2", 64]],
+                        ["list", ["bool", 1], 1.5],
+                        ["list", ["bool", 1], ["bool", 0]],
+                        ["list", ["list", 1, 2], ["list", 3, 4]],
+                        ["list", ["pow2", 63], 1.5],
+                        ["list", -1, ["pow2", 63]],
+                        ["list", ["float", "nan"], 1],
+                        ["list", 1, 2.5, 0.49],
+                        ["list"],
+                    ],
+                },
+                {
+                    "entry": "to_units",
+                    "resolution": 0.5,
+                    "values": [["list", 1, 2.25], ["list", ["decimal", "1"]]],
+                },
+                {
+                    "entry": "to_units",
+                    "resolution": ["decimal", "1"],
+                    "values": [["list", ["pow2", 64], 1.5], ["list", 1.0]],
+                },
+                {
+                    "entry": "to_units",
+                    "resolution": 0.75,
+                    "values": [["list", ["decimal", "1"]], ["list", ["pow2", 64], 1.5]],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "ValueError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "ValueError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (a float or an array of floats)",
+                "TypeError: to_units takes physical numbers (got dtype bool)",
+                "TypeError: to_units takes a float or a 1-D array of floats",
+                "ValueError: to_units: the amount is at or above the bound of the units domain (2^62 units)",
+                "ValueError: to_units: a negative amount has no unit value",
+                "ValueError: to_units: NaN has no unit value",
+                "valid [1, 3, 0]",
+                "valid []",
+            ],
+            [
+                "valid [2, 5]",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+            ],
+            ["TypeError: pybind11 conversion", "TypeError: pybind11 conversion"],
+            [
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+            ],
+        ],
+    },
+    {
+        "id": "ERR-number-scalar",
+        "oracle": "number_types",
+        "input": {
+            "cases": [
+                {
+                    "entry": "to_units",
+                    "resolution": 1.0,
+                    "values": [
+                        ["decimal", "1"],
+                        ["pow2", 64],
+                        ["fraction", 1, 1],
+                        ["floatonly", 1.0],
+                        ["index", 1],
+                        ["bool", 1],
+                        ["str", "1"],
+                        ["none"],
+                        ["float", "-inf"],
+                        4611686018427387904,
+                        4611686018427387903,
+                        9007199254740993,
+                        2.5,
+                        ["float", 0.5],
+                    ],
+                },
+                {
+                    "entry": "place offer",
+                    "values": [
+                        ["index", 3],
+                        ["decimal", "1"],
+                        ["floatonly", 1.0],
+                        ["pow2", 64],
+                        3,
+                    ],
+                },
+                {
+                    "entry": "as_float x",
+                    "values": [
+                        ["index", 3],
+                        ["decimal", "1"],
+                        ["floatonly", 1.0],
+                        ["float", 1.5],
+                        ["pow2", 64],
+                    ],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "ValueError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (a float or an array of floats)",
+                "TypeError: to_units takes physical numbers (a float or an array of floats)",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "ValueError: to_units: an infinite amount is not finite and has no unit value",
+                "ValueError: to_units: the amount is at or above the bound of the units domain (2^62 units)",
+                "ValueError: to_units: the amount is at or above the bound of the units domain (2^62 units)",
+                "valid 9007199254740992",
+                "valid 3",
+                "valid 1",
+            ],
+            [
+                "valid",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "valid",
+            ],
+            [
+                "valid",
+                "TypeError: as_float: x must be an integer (got Decimal)",
+                "TypeError: as_float: x must be an integer (got FloatOnly)",
+                "TypeError: as_float: x must be an integer (got float)",
+                "valid",
+            ],
+        ],
+    },
+    {
+        "id": "ERR-number-numpy",
+        "oracle": "number_types",
+        "input": {
+            "cases": [
+                {
+                    "entry": "resolution",
+                    "values": [
+                        ["numpy", "float32", 0.5],
+                        ["numpy", "int64", 2],
+                        ["numpy", "uint64", 1],
+                        ["numpy", "bool_", True],
+                        ["array", "float64", 1.0],
+                        ["numpy", "float64", "nan"],
+                        ["numpy", "float16", 0.75],
+                    ],
+                },
+                {
+                    "entry": "to_units",
+                    "resolution": 1.0,
+                    "values": [
+                        ["array", "float32", [1.5, 2.5]],
+                        ["array", "object", [1, 2]],
+                        ["array", "bool", [True, False]],
+                        ["list", ["numpy", "bool_", True], 1.5],
+                        ["list", ["numpy", "bool_", True], ["numpy", "bool_", False]],
+                        ["array", "int64", [[1, 2]]],
+                        ["array", "float64", 2.5],
+                        ["numpy", "float32", 2.5],
+                        ["list", ["numpy", "uint64", 9223372036854775808], -1],
+                    ],
+                },
+            ]
+        },
+        "expected": [
+            [
+                "valid",
+                "valid",
+                "valid",
+                "TypeError: pybind11 conversion",
+                "TypeError: pybind11 conversion",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+                "ValueError: resolution must be a power of two in [2^-32, 2^32]",
+            ],
+            [
+                "valid [2, 3]",
+                "TypeError: to_units takes physical numbers (got dtype object)",
+                "TypeError: to_units takes physical numbers (got dtype bool)",
+                "TypeError: to_units takes physical numbers (a float or an array of floats)",
+                "TypeError: to_units takes physical numbers (got dtype bool)",
+                "TypeError: to_units takes a float or a 1-D array of floats",
+                "valid 3",
+                "valid 3",
+                "ValueError: to_units: the amount is at or above the bound of the units domain (2^62 units)",
+            ],
+        ],
+    },
+    # Several demands at once (apply_actions).
+    {
+        "id": "D-crossing",
+        "oracle": "lossy",
+        "input": {"offers": [8, 4, 4], "routes": [[0, 1], [0], [1]], "cap": [9, 7]},
+        "expected": {
+            "arrivals": [[8, 6], [4], [4]],
+            "carried": [[6, 4], [3], [3]],
+            "edge_drops": [[2, 2], [1], [1]],
+            "delivered": [4, 3, 3],
+            "edge_flows": [9, 7],
+        },
+    },
+    {
+        "id": "D-simultaneous",
+        "oracle": "lossy",
+        "input": {"offers": [10, 10], "routes": [[0], [0]], "cap": [10]},
+        "expected": {
+            "carried": [[5], [5]],
+            "edge_drops": [[5], [5]],
+            "delivered": [5, 5],
+            "edge_flows": [10],
+        },
+    },
+    {
+        "id": "D-C3",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 1, 2],
+            "routes": [[0, 1], [1, 2], [2, 0]],
+            "cap": [1, 1, 2],
+        },
+        "expected": {
+            "error": "lossy forwarding iteration entered a period-2 cycle",
+            "rounds": 3,
+        },
+    },
+    {
+        "id": "D-cycle-prefix-suffix",
+        "oracle": "lossy",
+        "input": {
+            "offers": [8, 4],
+            "routes": [[0, 1, 2], [2, 1, 3]],
+            "cap": [2, 5, 5, 10],
+        },
+        "expected": {
+            "arrivals": [[8, 2, 2], [4, 3, 3]],
+            "carried": [[2, 2, 2], [3, 3, 3]],
+            "edge_drops": [[6, 0, 0], [1, 0, 0]],
+            "delivered": [2, 3],
+            "edge_flows": [2, 5, 5, 3],
+        },
+    },
+    {
+        "id": "D-cycle-subdivision-before",
+        "oracle": "lossy",
+        "input": {
+            "offers": [2, 1, 4],
+            "routes": [[1, 0, 2], [2, 0], [2, 0, 1]],
+            "cap": [2, 4, 2],
+        },
+        "expected": {
+            "arrivals": [[2, 2, 1], [1, 0], [4, 2, 1]],
+            "carried": [[2, 1, 0], [0, 0], [2, 1, 1]],
+            "delivered": [0, 0, 1],
+            "edge_flows": [2, 3, 2],
+        },
+    },
+    {
+        "id": "D-cycle-subdivision-after",
+        "oracle": "lossy",
+        "input": {
+            "offers": [2, 1, 4],
+            "routes": [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1]],
+            "cap": [2, 4, 2, 2],
+        },
+        "expected": {
+            "arrivals": [[2, 2, 1, 0], [1, 0, 0], [4, 2, 2, 1]],
+            "carried": [[2, 1, 0, 0], [0, 0, 0], [2, 2, 1, 1]],
+            "delivered": [0, 0, 1],
+            "edge_flows": [2, 3, 2, 2],
+        },
+    },
+    {
+        "id": "D-dead-tail",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 2, 1],
+            "routes": [[2, 0], [1, 0, 2], [3, 0, 1]],
+            "cap": [2, 2, 1, 9],
+            "dark": [[], [], [3]],
+        },
+        "expected": {
+            "error": "lossy forwarding iteration entered a period-2 cycle",
+            "rounds": 3,
+        },
+    },
+    {
+        "id": "D-dead-waits",
+        "oracle": "lossy",
+        "input": {
+            "offers": [1, 3, 3],
+            "routes": [[2, 0], [1, 0, 2], [3, 0, 1]],
+            "cap": [2, 2, 1, 9],
+            "dark": [[], [], [3]],
+        },
+        "expected": {
+            "error": "lossy forwarding iteration entered a period-2 cycle",
+            "rounds": 3,
+        },
+    },
+    {
+        "id": "D-zero-share-pair",
+        "oracle": "lossy",
+        "input": {
+            "offers": [2, 1, 4, 0],
+            "routes": [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1], [2]],
+            "cap": [2, 4, 2, 2],
+        },
+        "expected": {
+            "arrivals": [[2, 2, 1, 0], [1, 0, 0], [4, 2, 2, 1], [0]],
+            "carried": [[2, 1, 0, 0], [0, 0, 0], [2, 2, 1, 1], [0]],
+            "delivered": [0, 0, 1, 0],
+            "edge_flows": [2, 3, 2, 2],
+        },
+    },
+    {
+        "id": "D-dead-subdivision",
+        "oracle": "lossy",
+        "input": {
+            "offers": [2, 1, 4, 1],
+            "routes": [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1], [2, 3]],
+            "cap": [2, 4, 2, 2],
+            "dark": [[], [], [], [2]],
+        },
+        "expected": {
+            "arrivals": [[2, 2, 1, 0], [1, 0, 0], [4, 2, 2, 1], [1, 0]],
+            "carried": [[2, 1, 0, 0], [0, 0, 0], [2, 2, 1, 1], [0, 0]],
+            "edge_drops": [[0, 1, 1, 0], [1, 0, 0], [2, 0, 1, 0], [1, 0]],
+            "delivered": [0, 0, 1, 0],
+            "edge_flows": [2, 3, 2, 2],
+        },
+    },
+    {
+        "id": "D-dead-demand-property",
+        "oracle": "dead_demand",
+        "input": {"seed": 4, "trials": 2000},
+        "expected": {
+            "trials": 2000,
+            "agree": 2000,
+            "kinds": {"zero": 993, "tail": 1007},
+            "errors": 55,
+        },
+    },
+    {
+        "id": "D-no-H-fixed-point",
+        "oracle": "c3",
+        "input": {
+            "offers": [1, 1, 2],
+            "routes": [[0, 1], [1, 2], [2, 0]],
+            "cap": [1, 1, 2],
+        },
+        "expected": {"feasible_work_conserving_records": 5, "local_H_solutions": 0},
+    },
+    {
+        "id": "STALE-cycle-period-2",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [
+                [0, 1, 768, 1],
+                [1, 2, 25600, 1],
+                [2, 3, 768, 1],
+                [3, 0, 25600, 1],
+                [4, 2, 25600, 1],
+                [5, 0, 25600, 1],
+                [6, 2, 25600, 1],
+                [7, 8, 25600, 1],
+            ],
+            "tunnels": [[4, [4, 2, 3, 0]], [5, [5, 0, 1, 2]], [6, [6, 2]], [7, [7]]],
+            "offers": {4: 1024, 5: 256, 6: 256, 7: 512},
+            "black_links": [7],
+        },
+        "expected": {
+            "error": "lossy forwarding iteration entered a period-2 cycle",
+            "rounds": 8,
+        },
+    },
+    {
+        "id": "STALE-cycle-round-limit-baseline",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [
+                [0, 1, 12, 1],
+                [1, 6, 1000, 1],
+                [2, 3, 9, 1],
+                [3, 0, 1000, 1],
+                [3, 10, 1000, 1],
+                [4, 5, 7, 1],
+                [5, 6, 1000, 1],
+                [6, 7, 13, 1],
+                [7, 2, 1000, 1],
+                [7, 10, 1000, 1],
+                [8, 9, 1, 1],
+                [10, 11, 10, 1],
+                [11, 2, 1000, 1],
+                [12, 4, 1000, 1],
+                [13, 6, 1000, 1],
+                [14, 0, 1000, 1],
+            ],
+            "tunnels": [
+                [12, [13, 5, 6, 7, 8, 2, 4, 11]],
+                [13, [14, 7, 9, 11, 12, 2, 3, 0]],
+                [14, [15, 0, 1, 7]],
+            ],
+            "offers": {12: 13, 13: 11, 14: 10},
+        },
+        "expected": {"delivered": [3, 4, 4]},
+    },
+    {
+        "id": "STALE-cycle-round-limit",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [
+                [0, 1, 12, 1],
+                [1, 6, 1000, 1],
+                [2, 3, 9, 1],
+                [3, 0, 1000, 1],
+                [3, 10, 1000, 1],
+                [4, 5, 7, 1],
+                [5, 6, 1000, 1],
+                [6, 7, 13, 1],
+                [7, 2, 1000, 1],
+                [7, 10, 1000, 1],
+                [8, 9, 1, 1],
+                [10, 11, 10, 1],
+                [11, 2, 1000, 1],
+                [12, 4, 1000, 1],
+                [13, 6, 1000, 1],
+                [14, 0, 1000, 1],
+            ],
+            "tunnels": [
+                [12, [13, 5, 6, 7, 8, 2, 4, 11]],
+                [13, [14, 7, 9, 11, 12, 2, 3, 0]],
+                [14, [15, 0, 1, 7]],
+            ],
+            "offers": {12: 13, 13: 11, 14: 10},
+            "black_links": [5],
+        },
+        "expected": {
+            "error": "lossy forwarding iteration did not reach a fixed point within the round limit",
+            "rounds": 256,
+        },
+    },
+    {
+        "id": "STALE-black-hole-in-cycle",
+        "oracle": "stale_paths",
+        "input": {
+            "edges": [
+                [0, 1, 12, 1],
+                [1, 6, 1000, 1],
+                [1, 16, 1000, 1],
+                [2, 3, 9, 1],
+                [3, 0, 1000, 1],
+                [3, 10, 1000, 1],
+                [4, 5, 7, 1],
+                [5, 6, 1000, 1],
+                [6, 7, 13, 1],
+                [7, 2, 1000, 1],
+                [7, 10, 1000, 1],
+                [8, 9, 1, 1],
+                [10, 11, 10, 1],
+                [11, 2, 1000, 1],
+                [12, 4, 1000, 1],
+                [13, 6, 1000, 1],
+                [14, 0, 1000, 1],
+                [15, 0, 1000, 1],
+                [16, 2, 1000, 1],
+            ],
+            "tunnels": [
+                [12, [14, 6, 7, 8, 9, 3, 5, 12]],
+                [13, [15, 8, 10, 12, 13, 3, 4, 0]],
+                [14, [16, 0, 1, 8]],
+                [15, [17, 0, 2, 18, 3, 5, 12]],
+            ],
+            "offers": {12: 13, 13: 11, 14: 10, 15: 5},
+            "black_links": [2, 6, 17],
+        },
+        "expected": {
+            "status": ["BLACKHOLED", "UP", "UP", "BLACKHOLED"],
+            "error": "lossy forwarding iteration did not reach a fixed point within the round limit",
+            "rounds": 256,
+        },
+    },
+    {
+        "id": "LIST-black-hole-in-cycle",
+        "oracle": "action_list",
+        "input": {
+            "edges": [
+                [0, 1, 12, 1],
+                [1, 6, 1000, 1],
+                [1, 16, 1000, 1],
+                [2, 3, 9, 1],
+                [3, 0, 1000, 1],
+                [3, 10, 1000, 1],
+                [4, 5, 7, 1],
+                [5, 6, 1000, 1],
+                [6, 7, 13, 1],
+                [7, 2, 1000, 1],
+                [7, 10, 1000, 1],
+                [8, 9, 1, 1],
+                [10, 11, 10, 1],
+                [11, 2, 1000, 1],
+                [12, 4, 1000, 1],
+                [13, 6, 1000, 1],
+                [14, 0, 1000, 1],
+                [15, 0, 1000, 1],
+                [16, 2, 1000, 1],
+            ],
+            "actions": [
+                {
+                    "source": 12,
+                    "route": [14, 6, 7, 8, 9, 3, 5, 12],
+                    "offer": 13,
+                    "black_holes": [2, 6, 17],
+                },
+                {
+                    "source": 13,
+                    "route": [15, 8, 10, 12, 13, 3, 4, 0],
+                    "offer": 11,
+                    "black_holes": [2, 6, 17],
+                },
+                {
+                    "source": 14,
+                    "route": [16, 0, 1, 8],
+                    "offer": 10,
+                    "black_holes": [2, 6, 17],
+                },
+                {
+                    "source": 15,
+                    "route": [17, 0, 2, 18, 3, 5, 12],
+                    "offer": 5,
+                    "black_holes": [2, 6, 17],
+                },
+            ],
+            "mode": "SIMULTANEOUS",
+        },
+        "expected": {
+            "error": "lossy forwarding iteration did not reach a fixed point within the round limit",
+            "rounds": 256,
+        },
+    },
+    {
+        "id": "LIST-black-hole-own",
+        "oracle": "action_list",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "actions": [
+                {"source": 0, "route": [0], "offer": 10, "black_holes": [0]},
+                {"source": 0, "route": [0], "offer": 10},
+            ],
+            "mode": "SIMULTANEOUS",
+        },
+        "expected": {
+            "entries": [
+                {
+                    "delivered": 0,
+                    "call_edge_drops": [[0, 10]],
+                    "status": "BLACKHOLED",
+                    "residual": [0],
+                    "saturated_boundary_edges": [0],
+                },
+                {
+                    "delivered": 10,
+                    "call_edge_drops": [],
+                    "status": "UP",
+                    "residual": [0],
+                    "saturated_boundary_edges": [0],
+                },
+            ]
+        },
+    },
+    {
+        "id": "LIST-black-hole-upstream",
+        "oracle": "action_list",
+        "input": {
+            "edges": [[0, 1, 10, 1], [1, 2, 10, 1]],
+            "actions": [
+                {"source": 0, "route": [0, 1], "offer": 10, "black_holes": [1]},
+                {"source": 0, "route": [0, 1], "offer": 10},
+            ],
+            "mode": "SIMULTANEOUS",
+        },
+        "expected": {
+            "entries": [
+                {
+                    "delivered": 0,
+                    "call_edge_drops": [[0, 5], [1, 5]],
+                    "status": "BLACKHOLED",
+                    "residual": [0, 5],
+                    "saturated_boundary_edges": [0],
+                },
+                {
+                    "delivered": 5,
+                    "call_edge_drops": [[0, 5]],
+                    "status": "UP",
+                    "residual": [0, 5],
+                    "saturated_boundary_edges": [0],
+                },
+            ]
+        },
+    },
+    {
+        "id": "LIST-outputs-ordered",
+        "oracle": "action_list",
+        "input": {
+            "edges": [[0, 1, 10, 1]],
+            "actions": [
+                {"source": 0, "route": [0], "offer": 7},
+                {"source": 0, "route": [0], "offer": 7},
+            ],
+            "mode": "ORDERED",
+        },
+        "expected": {
+            "entries": [
+                {
+                    "delivered": 7,
+                    "call_edge_drops": [],
+                    "residual": [3],
+                    "saturated_boundary_edges": [],
+                },
+                {
+                    "delivered": 3,
+                    "call_edge_drops": [[0, 4]],
+                    "residual": [0],
+                    "saturated_boundary_edges": [0],
+                },
+            ]
+        },
+    },
+    {
+        "id": "LIST-outputs-simultaneous",
+        "oracle": "action_list",
+        "input": {
+            "edges": [[0, 2, 5, 1], [1, 2, 10, 1], [2, 3, 10, 1]],
+            "actions": [
+                {"source": 0, "route": [0, 2], "offer": 5},
+                {"source": 1, "route": [1, 2], "offer": 5},
+            ],
+            "mode": "SIMULTANEOUS",
+        },
+        "expected": {
+            "entries": [
+                {
+                    "delivered": 5,
+                    "call_edge_drops": [],
+                    "residual": [0, 5, 0],
+                    "saturated_boundary_edges": [0],
+                },
+                {
+                    "delivered": 5,
+                    "call_edge_drops": [],
+                    "residual": [0, 5, 0],
+                    "saturated_boundary_edges": [2],
+                },
+            ]
+        },
+    },
+    {
+        "id": "LIST-first-error",
+        "oracle": "list_validation",
+        "input": {
+            "cases": [
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": -1,
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "x",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "foreign": True,
+                        },
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": -1,
+                        },
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Forward",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": "inf",
+                        }
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Place",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSLESS",
+                            "offer": 1,
+                        }
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "t",
+                            "model": "DistributedTE",
+                            "admission": "LOSSLESS",
+                            "offer": 1,
+                        }
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Forward",
+                            "policy": "c",
+                            "model": "CentralizedTE",
+                            "admission": "LOSSLESS",
+                            "offer": "inf",
+                            "program": True,
+                        }
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "Pinned",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "computes": "lossy forwarding iteration entered a period-2 cycle",
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "b",
+                            "model": "Pinned",
+                            "admission": "LOSSY",
+                            "offer": 4611686018427387904,
+                        },
+                    ],
+                },
+                {
+                    "mode": "SIMULTANEOUS",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "Pinned",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "computes": "lossy forwarding iteration entered a period-2 cycle",
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "b",
+                            "model": "Pinned",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                        },
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Place",
+                            "policy": "t",
+                            "model": "DistributedTE",
+                            "admission": "LOSSLESS",
+                            "offer": -1,
+                        }
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Forward",
+                            "policy": "p",
+                            "model": "Pinned",
+                            "admission": "LOSSY",
+                            "offer": "inf",
+                        }
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Place",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 5,
+                            "after_infinite": True,
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "x",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "foreign": True,
+                        },
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Replace",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "design_demand": 5,
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "x",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "foreign": True,
+                        },
+                    ],
+                },
+                {
+                    "mode": "ORDERED",
+                    "actions": [
+                        {
+                            "kind": "Forward",
+                            "policy": "a",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "program": True,
+                            "foreign_black_holes": True,
+                        },
+                        {
+                            "kind": "Replace",
+                            "policy": "x",
+                            "model": "ShortestPaths",
+                            "admission": "LOSSY",
+                            "offer": 1,
+                            "foreign": True,
+                        },
+                    ],
+                },
+                {"mode": "SIMULTANEOUS", "actions": []},
+            ]
+        },
+        "expected": [
+            "offer must be an integer in [0, 2^62) or permitted +inf",
+            "duplicate policy in list",
+            "SIMULTANEOUS requires finite offers",
+            "SIMULTANEOUS does not accept Place",
+            "SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned",
+            "SIMULTANEOUS requires admission=LOSSY",
+            "offer must be an integer in [0, 2^62) or permitted +inf",
+            "lossy forwarding iteration entered a period-2 cycle",
+            "DistributedTE does not support incremental placement",
+            "Pinned forwards with replace",
+            "list policy belongs to another ledger",
+            "ShortestPaths does not accept design_demand",
+            "black_holes belongs to another graph",
+            "valid",
+        ],
+    },
+    {
+        "id": "ERR-forwarding-limit",
+        "oracle": "forwarding_size",
+        "input": {
+            "cases": [
+                [[[10000, 214749]]],
+                [[[10000, 214748], [1, 3647]]],
+                [[[10000, 214748], [1, 3648]]],
+                [[[1, 1073741824]]],
+                [[[1, 1073741824]], [[1, 1073741824]]],
+                [[[2147483648, 1]]],
+            ]
+        },
+        "expected": [
+            "forwarding occurrence limit exceeded: 2147490000 > 2147483647",
+            "within the entry and occurrence limits",
+            "forwarding occurrence limit exceeded: 2147483648 > 2147483647",
+            "within the entry and occurrence limits",
+            "forwarding occurrence limit exceeded: 2147483648 > 2147483647",
+            "forwarding entry limit exceeded: 2147483648 > 2147483647",
+        ],
+    },
+    {
+        "id": "ERR-class-list",
+        "oracle": "input_classes",
+        "input": {
+            "cases": [
+                {
+                    "entry": "apply_actions",
+                    "values": [
+                        {"ledger": "own", "offer": ["bool", 1]},
+                        {"ledger": "own", "offer": ["str", "1"]},
+                        {"ledger": "own", "offer": ["fraction", 3, 2]},
+                        {"ledger": "own", "offer": ["float", 1.5]},
+                        {"ledger": "own", "offer": 9223372036854775808},
+                        {"ledger": "own", "offer": -1},
+                        {"ledger": ["none"], "offer": 5},
+                        {"ledger": ["none"], "offer": ["bool", 1]},
+                        {"ledger": ["none"], "offer": -1},
+                        {"ledger": "own", "offer": ["float", "inf"]},
+                        {"ledger": "own", "offer": 5},
+                    ],
+                }
+            ]
+        },
+        "expected": [
+            [
+                "TypeError: offer must be an int or a float (got bool)",
+                "TypeError: offer must be an int or a float (got str)",
+                "TypeError: offer must be an int or a float (got Fraction)",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: ledger must be a FlowLedger",
+                "TypeError: offer must be an int or a float (got bool)",
+                "TypeError: ledger must be a FlowLedger",
+                "valid",
+                "valid",
+            ]
+        ],
+    },
+]
+
+
+# Values an example names that the library does not report, by example: left out of the comparison.
+NOT_REPORTED = {
+    "T2-dead-head": {
+        "budget": "the supply budget of T2's count choice is internal to its up-to rule",
+    },
+    "D-C2": {
+        "rounds": "the error names the period-2 cycle, not the round it was found in"
+    },
+    "D-C3": {
+        "rounds": "the error names the period-2 cycle, not the round it was found in"
+    },
+    "STALE-cycle-period-2": {
+        "rounds": "the error names the period-2 cycle, not the round it was found in"
+    },
+    "D-dead-tail": {
+        "rounds": "the error names the period-2 cycle, not the round it was found in"
+    },
+    "D-dead-waits": {
+        "rounds": "the error names the period-2 cycle, not the round it was found in"
+    },
+    "R4-refusal": {
+        "requeue": "the rejected rule (a refused unit offered again), which the library never applies",
+    },
+}
+for _name in (
+    "STALE-cycle-round-limit",
+    "STALE-black-hole-in-cycle",
+    "LIST-black-hole-in-cycle",
+):
+    NOT_REPORTED[_name] = {"rounds": "the error names the round limit, not its value"}
+for _name in (
+    "C-G1-UP_TO",
+    "T2-UP_TO-common",
+    "T2-UP_TO-dead-head",
+    "T2-tiny-head-UP_TO",
+):
+    NOT_REPORTED[_name] = {
+        "bounds": "the per-count supply budgets of the up-to choice are internal",
+        "scores": "the per-count scores of the up-to choice are internal",
+    }
+
+# Inputs outside the library's domain (amounts and weights are below 2^62). Such an example is
+# not run on the library; it is checked three ways: its expected value is the rule's
+# (reference_ha), the library refuses its input, and the same rounding at the largest inputs of
+# the domain (its analogues) gives the library the rule's value.
+OUTSIDE_THE_DOMAIN = {"R3-H-large": "a split of about 2^126 units"}
+TOP = (1 << 62) - 1
+# Each analogue: (input, expected); the C++ test (contract_examples_tests.cpp) uses the same values.
+ANALOGUES = {
+    "R3-H-large": [
+        # Equal powers of two summing to n + 1, as in the example: the odd unit to the first.
+        ({"n": TOP, "weights": [1 << 61, 1 << 61]}, [1 << 61, (1 << 61) - 1]),
+        # The largest weights, equal and unequal (products of about 2^124).
+        ({"n": TOP, "weights": [TOP, TOP]}, [1 << 61, (1 << 61) - 1]),
+        ({"n": TOP, "weights": [TOP, TOP - 1, 1]}, [1 << 61, (1 << 61) - 1, 0]),
+        (
+            {"n": TOP - 1, "weights": [TOP, 1 << 61, 3]},
+            [3074457345618258601, 1537228672809129300, 1],
+        ),
+        (
+            {"n": TOP, "weights": [3, 5, 7]},
+            [922337203685477580, 1537228672809129301, 2152120141932781022],
+        ),
+    ]
+}
+
+
+def reference_ha(n, weights):
+    """H(n, w) as docs/semantics.md defines it ("Terms"), in exact integers: the floor of each
+    share, then each remaining unit to the largest w / (assigned + 1), ties to the earlier member."""
+    total = sum(weights)
+    if not total:
+        return [0] * len(weights)
+    ans = [n * w // total for w in weights]
+    for _ in range(n - sum(ans)):
+        j = max(
+            range(len(weights)), key=lambda i: (Fraction(weights[i], ans[i] + 1), -i)
+        )
+        ans[j] += 1
+    return ans
+
+
+def split_offer_on_unit_links(n, weights):
+    """H(n, w) as the library splits a LOSSY offer: one head, a tunnel of weight w_i on its own
+    link of capacity 1 (the split is of the offer; the links only limit the delivery)."""
+    m = len(weights)
+    g = ngc.Graph(2, [0] * m, [1] * m, [1] * m, [1] * m, 1.0)
+    tunnels = [
+        ngc.RouteDefinition(0, path_of(g, [e]), weight=w) for e, w in enumerate(weights)
+    ]
+    program = ngc.ForwardingProgram.from_routes(g, [0], [1], tunnels)
+    return [t.assigned for t in pinned(g, program, LY).place(n).by_tunnel]
+
+
+def refuses_outside_the_domain(n, weights):
+    # A route weight and an offer beyond the domain are each refused.
+    g = ngc.Graph(
+        2,
+        [0] * len(weights),
+        [1] * len(weights),
+        [1] * len(weights),
+        [1] * len(weights),
+        1.0,
+    )
+    for w in weights:
+        with pytest.raises(ValueError, match="out of range|must be an integer in"):
+            ngc.RouteDefinition(0, path_of(g, [0]), weight=w)
+    program = ngc.ForwardingProgram.from_routes(
+        g, [0], [1], [ngc.RouteDefinition(0, path_of(g, [0]))]
+    )
+    with pytest.raises(ValueError, match="offer must be an integer in"):
+        pinned(g, program, LY).place(n)
+
+
+PERIOD_TWO = "lossy forwarding iteration entered a period-2 cycle"
+
+
+def same_without(with_, without, n, where):
+    """The other participants' outcome with and without a dead element: the error, or the first n
+    participants' rows and deliveries and every link flow (the structure is the C++ suite's: the
+    Python API reports no wait or group)."""
+    assert with_.get("error") == without.get("error"), where
+    if "error" in with_:
+        return
+    for key in ("arrivals", "carried", "edge_drops", "delivered"):
+        assert with_[key][:n] == without[key][:n], (where, key)
+    assert with_["edge_flows"] == without["edge_flows"], where
+
+
+def test_dead_occurrences_change_no_other_output():
+    # D-dead-tail, D-dead-waits, D-zero-share-pair, D-dead-subdivision and a dead load that would
+    # make a barrier (A: links 1, 0; B: 0, 2, 1; Z: 3, 2 behind its own black hole on link 3), with
+    # Z a tunnel, a DAG route alone or a DAG route beside an exit (D-zero-share-pair also as a zero
+    # branch): equal to the list with Z cut after its black hole, or without a zero-offer Z.
+    tail_routes = [[2, 0], [1, 0, 2], [3, 0, 1]]
+    tail_cut = [[2, 0], [1, 0, 2], [3]]
+    for offers in ([1, 2, 1], [1, 3, 3]):
+        for form in DEAD_FORMS:
+            forms = [TUNNEL, TUNNEL, form]
+            args = ([2, 2, 1, 9], [[], [], [3]], None, forms)
+            got = run_list_lossy(offers, tail_routes, *args)
+            assert got == dict(error=PERIOD_TWO), (offers, form)
+            same_without(got, run_list_lossy(offers, tail_cut, *args), 2, form)
+    after = [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1]]
+    cap = [2, 4, 2, 2]
+    plain = run_list_lossy([2, 1, 4], after, cap)
+    for form in (*DEAD_FORMS, ZERO_BRANCH):
+        forms = [TUNNEL] * 3 + [form]
+        got = run_list_lossy([2, 1, 4, 0], [*after, [2]], cap, None, None, forms)
+        assert got["delivered"] == [0, 0, 1, 0], form
+        same_without(got, plain, 3, form)
+    for form in DEAD_FORMS:
+        forms = [TUNNEL] * 3 + [form]
+        dark = [[], [], [], [2]]
+        got = run_list_lossy([2, 1, 4, 1], [*after, [2, 3]], cap, dark, None, forms)
+        assert got["edge_drops"][3] == [1, 0], form
+        cut = run_list_lossy([2, 1, 4, 1], [*after, [2]], cap, dark, None, forms)
+        same_without(got, cut, 3, form)
+    for form in DEAD_FORMS:
+        forms = [TUNNEL, TUNNEL, form]
+        args = ([2, 1, 2, 9], [[], [], [3]], None, forms)
+        got = run_list_lossy([1, 2, 2], [[1, 0], [0, 2, 1], [3, 2]], *args)
+        assert got == dict(error=PERIOD_TWO), form
+        cut = run_list_lossy([1, 2, 2], [[1, 0], [0, 2, 1], [3]], *args)
+        same_without(got, cut, 2, form)
+
+
+def test_empty_entries_change_nothing():
+    # A tunnel or a DAG route of weight 0 in A's program of D-cycle-subdivision-after (over link 2
+    # alone, or over links 2, 3, 0): it gets no share and is not forwarded.
+    after = [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1]]
+    cap = [2, 4, 2, 2]
+    plain = run_list_lossy([2, 1, 4], after, cap)
+    for form in (ENTRY_TUNNEL, ENTRY_DAG):
+        for extra in ([2], [2, 3, 0]):
+            forms = [TUNNEL] * 3 + [form]
+            got = run_list_lossy([2, 1, 4, 0], [*after, extra], cap, None, None, forms)
+            same_without(got, plain, 3, (form, extra))
+
+
+def test_scalar_serial_pair_with_a_zero_share_entry():
+    # D-zero-share-pair's routes as the entries of one head's program on the list layout (links 2
+    # and 3 joined directly), weights 2, 1, 4, 1 at offer 7: Z (link 2 alone) gets a share of 0 and,
+    # a tunnel or a DAG route, leaves the call's delivery 1, as without Z.
+    routes = [[1, 0, 2, 3], [2, 3, 0], [2, 3, 0, 1], [2]]
+    cap = [2, 4, 2, 2]
+    fusing = fused_links([2, 1, 4, 0], routes, cap)
+    forms = [TUNNEL, ENTRY_TUNNEL, ENTRY_TUNNEL]
+    without = run_list_lossy([2, 1, 4], routes[:3], cap, None, fusing, forms, 7)
+    assert without["delivered"] == [1]
+    for form in (ENTRY_TUNNEL, ENTRY_DAG):
+        got = run_list_lossy([2, 1, 4, 1], routes, cap, None, fusing, [*forms, form], 7)
+        same_without(got, without, 1, form)
+
+
+def test_dead_demand_property_in_every_form():
+    # D-dead-demand-property with Z a DAG route alone and a DAG route beside an exit.
+    for form in (DAG_ROUTE, DAG_BESIDE_EXIT):
+        assert run_dead_demand(4, 2000, form) == dict(
+            trials=2000, agree=2000, kinds={"zero": 993, "tail": 1007}, errors=55
+        ), form
+
+
+def test_dead_entries_in_a_scalar_call():
+    # One call (one head, the routes its entries with weights = offers), Z a tunnel or a DAG route:
+    # D-dead-tail and D-dead-waits with the call's black hole on link 3 (only Z uses it) give the
+    # period-2 error, as with Z cut after link 3; D-crossing plus Z over its own black-holed link 2
+    # then link 0 (weight 4, offer 20) gives the others what D-crossing gives them (offer 16); and
+    # D-dead-tail's routes with weights 1, 2, 1 at offer 3 (Z's share 0) give the error without Z.
+    def call(offers, routes, cap, dag, black=(), total=None):
+        g, links, paths = laid_out(cap, routes)
+        last = len(routes) - 1
+        defs = [
+            ngc.RouteDefinition(
+                0, dag_of(g, p) if dag and i == last else path_of(g, p), weight=w
+            )
+            for i, (p, w) in enumerate(zip(paths, offers, strict=True))
+        ]
+        program = ngc.ForwardingProgram.from_routes(g, [0], [1], defs)
+        mask = edge_mask(g, [links[e] for e in black])
+        offer = sum(offers) if total is None else total
+        try:
+            r = pinned(g, program, LY, black_holes=mask).place(
+                offer, ngc.OutputOptions(edge_flows=True)
+            )
+        except ValueError as e:
+            return str(e)
+        flows = r.edge_flows.tolist()
+        delivered = [t.delivered for t in r.by_tunnel][:3]
+        return delivered, [flows[links[e]] for e in range(len(cap))]
+
+    routes, cap = [[2, 0], [1, 0, 2], [3, 0, 1]], [2, 2, 1, 9]
+    for dag in (False, True):
+        for offers in ([1, 2, 1], [1, 3, 3]):
+            assert call(offers, routes, cap, dag, [3]) == PERIOD_TWO, (dag, offers)
+            assert call(offers, [*routes[:2], [3]], cap, dag, [3]) == PERIOD_TWO
+        crossing = ([[0, 1], [0], [1]], [9, 7, 9])
+        with_z = call([8, 4, 4, 4], [*crossing[0], [2, 0]], crossing[1], dag, [2])
+        assert with_z == call([8, 4, 4], *crossing, False), dag
+        assert with_z[0] == [4, 3, 3], dag
+        zero = call([1, 2, 1], routes, cap, dag, total=3)
+        assert zero == call([1, 2], routes[:2], cap, False, total=3) == PERIOD_TWO
+
+
+def check_outside_the_domain(example):
+    assert mismatch(reference_ha(**example["input"]), example["expected"]) is None
+    refuses_outside_the_domain(**example["input"])
+    for case, want in ANALOGUES[example["id"]]:
+        assert mismatch(reference_ha(**case), want) is None, case
+        assert mismatch(split_offer_on_unit_links(**case), want) is None, case
+
+
+def run_publication(locked):
+    return ext._concurrency_model(
+        "publication-locked" if locked else "publication-unlocked"
+    )
+
+
+def run_phases(protocol):
+    return ext._concurrency_model(protocol)
+
+
+def run_search_call_checks(case):
+    faults = set(case["faults"])
+    heads = 107375
+    g = ngc.Graph(
+        heads + 2, list(range(1, heads + 1)), [0] * heads, [1] * heads, [1] * heads, 1.0
+    )
+    options = ngc.EvaluationOptions(
+        ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(10000))),
+        design_demand=None if "no_design" in faults else 1,
+        offer=INF if "offer_infinite" in faults else 1,
+    )
+    try:
+        if case["entry"] == "evaluate_pairs":
+            pairs = []
+            for i in range(2):
+                if f"p{i}_overlap" in faults:
+                    pairs.append(([heads + 1], [heads + 1]))
+                elif f"p{i}_tunnel_limit" in faults:
+                    pairs.append((list(range(1, heads + 1)), [0]))
+                else:
+                    pairs.append(([1], [0]))
+            ngc.evaluate_pairs(g, pairs, options, workers=2)
+        else:
+            sources = list(range(1, heads + 1)) if "tunnel_limit" in faults else [1]
+            if case["entry"] == "evaluate_demand":
+                ngc.evaluate_demand(g, sources, 0, options)
+            else:
+                ngc.evaluate_edge_failures(g, sources, 0, options, workers=2)
+    except (TypeError, ValueError) as error:
+        return f"{type(error).__name__}: {error}"
+    return "valid"
+
+
+def run_call_checks(cases):
+    out = []
+    for case in cases:
+        faults = set(case["faults"])
+        if case["entry"] == "evaluate_demand" or any(
+            "tunnel_limit" in f or f.endswith("_overlap") for f in faults
+        ):
+            out.append(run_search_call_checks(case))
+            continue
+        g = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+        other = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+        program = ngc.ForwardingProgram.from_routes(
+            g, 0, 1, [ngc.RouteDefinition(0, ngc.Path(g, [[0]]))]
+        )
+        routing = ngc.Pinned(program) if "pinned" in faults else ngc.ShortestPaths()
+        try:
+            if case["entry"] == "forward":
+                p = ngc.FlowPolicy(
+                    ngc.FlowLedger(g),
+                    0,
+                    1,
+                    ngc.FlowPolicyConfig(routing=routing, admission=LY),
+                )
+                offer = (
+                    "x"
+                    if "offer_type" in faults
+                    else (
+                        -1
+                        if "offer_domain" in faults
+                        else (INF if "lossy_infinite" in faults else 1)
+                    )
+                )
+                black_holes = (
+                    "x"
+                    if "black_holes_type" in faults
+                    else (
+                        other.eligibility(excluded_edges=[0])
+                        if "foreign_black_holes" in faults
+                        else None
+                    )
+                )
+                p.forward(offer, black_holes=black_holes)
+            else:
+                cache = ngc.ShortestPathCache(other if "foreign_cache" in faults else g)
+                options = ngc.EvaluationOptions(
+                    ngc.FlowPolicyConfig(routing=routing),
+                    cache=cache,
+                    offer=INF if "offer_infinite" in faults else None,
+                )
+                if case["entry"] == "evaluate_pairs":
+                    pairs = (
+                        "x"
+                        if "pairs_type" in faults
+                        else ([(0, 1, 2)] if "pair_length" in faults else [(0, 1)])
+                    )
+                    ngc.evaluate_pairs(g, pairs, options, workers=2)
+                else:
+                    ngc.evaluate_edge_failures(g, 0, 1, options, workers=2)
+        except (ValueError, TypeError) as error:
+            out.append(f"{type(error).__name__}: {error}")
+        else:
+            out.append("valid")
+    return out
+
+
+ADAPTERS.update(
+    publication=run_publication, phases=run_phases, call_checks=run_call_checks
+)
+EXAMPLES.extend(
+    [
+        {
+            "id": "F-publication-locked",
+            "oracle": "publication",
+            "input": {"locked": True},
+            "expected": {"mixed": 0, "states": 15},
+        },
+        {
+            "id": "F-publication-unlocked",
+            "oracle": "publication",
+            "input": {"locked": False},
+            "expected": {"mixed": 2, "states": 23},
+        },
+        {
+            "id": "CALL-state-second",
+            "oracle": "call_checks",
+            "input": {
+                "cases": [
+                    {"entry": "forward", "faults": ["no_program", "offer_type"]},
+                    {"entry": "forward", "faults": ["no_program", "offer_domain"]},
+                    {"entry": "forward", "faults": ["no_program", "black_holes_type"]},
+                    {"entry": "forward", "faults": ["no_program", "lossy_infinite"]},
+                    {
+                        "entry": "forward",
+                        "faults": ["no_program", "foreign_black_holes"],
+                    },
+                    {"entry": "forward", "faults": ["pinned", "offer_type"]},
+                    {"entry": "forward", "faults": ["no_program"]},
+                    {"entry": "evaluate_pairs", "faults": ["building_cache", "pinned"]},
+                    {
+                        "entry": "evaluate_pairs",
+                        "faults": ["building_cache", "offer_infinite"],
+                    },
+                    {
+                        "entry": "evaluate_pairs",
+                        "faults": ["building_cache", "pairs_type"],
+                    },
+                    {
+                        "entry": "evaluate_pairs",
+                        "faults": ["building_cache", "pair_length"],
+                    },
+                    {
+                        "entry": "evaluate_pairs",
+                        "faults": ["foreign_cache", "building_cache"],
+                    },
+                    {"entry": "evaluate_pairs", "faults": ["building_cache"]},
+                    {
+                        "entry": "evaluate_edge_failures",
+                        "faults": ["building_cache", "offer_infinite"],
+                    },
+                    {"entry": "evaluate_edge_failures", "faults": ["building_cache"]},
+                ]
+            },
+            "expected": [
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+                "TypeError: black_holes must be an Eligibility or None (got str)",
+                "ValueError: LOSSY forwarding requires a finite offer",
+                "ValueError: black_holes belongs to another graph",
+                "ValueError: Pinned forwards with replace",
+                "ValueError: forward requires an installed program",
+                "ValueError: evaluate_pairs does not accept Pinned",
+                "ValueError: offer must be an integer in [0, 2^62)",
+                "TypeError: pairs must be a sequence of (sources, destinations)",
+                "ValueError: each pair must be (sources, destinations)",
+                "ValueError: foreign ShortestPathCache: bound to another graph",
+                "ValueError: a supplied building ShortestPathCache has one writer: it "
+                "is rejected unless workers == 1 (got workers = 2; a frozen cache may "
+                "be shared by every worker)",
+                "ValueError: offer must be an integer in [0, 2^62)",
+                "ValueError: a supplied building ShortestPathCache has one writer: it "
+                "is rejected unless workers == 1 (got workers = 2; a frozen cache may "
+                "be shared by every worker)",
+            ],
+        },
+        {
+            "id": "LIST-state-second",
+            "oracle": "list_validation",
+            "input": {
+                "cases": [
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Forward",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": -1,
+                            }
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Forward",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                                "foreign_black_holes": True,
+                            }
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Forward",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                            },
+                            {
+                                "kind": "Replace",
+                                "policy": "x",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                                "foreign": True,
+                            },
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Place",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 5,
+                                "after_infinite": True,
+                            },
+                            {
+                                "kind": "Replace",
+                                "policy": "b",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": -1,
+                            },
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Place",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                                "requested": 170141183460469231731687303715884105727,
+                            },
+                            {
+                                "kind": "Replace",
+                                "policy": "b",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": -1,
+                            },
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Place",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                                "requested": 170141183460469231731687303715884105727,
+                            }
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Forward",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                            },
+                            {
+                                "kind": "Place",
+                                "policy": "b",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 5,
+                                "after_infinite": True,
+                            },
+                        ],
+                    },
+                    {
+                        "mode": "ORDERED",
+                        "actions": [
+                            {
+                                "kind": "Place",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 5,
+                                "after_infinite": True,
+                            },
+                            {
+                                "kind": "Forward",
+                                "policy": "b",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                            },
+                        ],
+                    },
+                    {
+                        "mode": "SIMULTANEOUS",
+                        "actions": [
+                            {
+                                "kind": "Forward",
+                                "policy": "a",
+                                "model": "ShortestPaths",
+                                "admission": "LOSSY",
+                                "offer": 1,
+                            },
+                            {
+                                "kind": "Replace",
+                                "policy": "b",
+                                "model": "Pinned",
+                                "admission": "LOSSY",
+                                "offer": 4611686018427387904,
+                            },
+                        ],
+                    },
+                ]
+            },
+            "expected": [
+                "offer must be an integer in [0, 2^62) or permitted +inf",
+                "black_holes belongs to another graph",
+                "list policy belongs to another ledger",
+                "offer must be an integer in [0, 2^62) or permitted +inf",
+                "offer must be an integer in [0, 2^62) or permitted +inf",
+                "requested limit exceeded",
+                "forward requires an installed program",
+                "finite placement after infinite placement requires a new epoch",
+                "offer must be an integer in [0, 2^62) or permitted +inf",
+            ],
+        },
+        {
+            "id": "F-publish-result-first",
+            "oracle": "phases",
+            "input": {"protocol": "publish-result-first"},
+            "expected": {
+                "states": 22,
+                "partial": 0,
+                "python_under_lock": 0,
+                "late_hits": 0,
+            },
+        },
+        {
+            "id": "F-publish-result-after",
+            "oracle": "phases",
+            "input": {"protocol": "publish-result-after"},
+            "expected": {
+                "states": 22,
+                "partial": 1,
+                "python_under_lock": 0,
+                "late_hits": 0,
+            },
+        },
+        {
+            "id": "F-read-result-failure",
+            "oracle": "phases",
+            "input": {"protocol": "read-result-failure"},
+            "expected": {
+                "states": 20,
+                "partial": 0,
+                "python_under_lock": 0,
+                "late_hits": 0,
+            },
+        },
+        {
+            "id": "F-read-result-under-gate",
+            "oracle": "phases",
+            "input": {"protocol": "read-result-under-gate"},
+            "expected": {
+                "states": 18,
+                "partial": 0,
+                "python_under_lock": 2,
+                "late_hits": 0,
+            },
+        },
+        {
+            "id": "F-frozen-hits",
+            "oracle": "phases",
+            "input": {"protocol": "frozen-hits"},
+            "expected": {
+                "states": 25,
+                "partial": 0,
+                "python_under_lock": 0,
+                "late_hits": 0,
+            },
+        },
+        {
+            "id": "F-frozen-hits-after-lease",
+            "oracle": "phases",
+            "input": {"protocol": "frozen-hits-after-lease"},
+            "expected": {
+                "states": 28,
+                "partial": 0,
+                "python_under_lock": 0,
+                "late_hits": 2,
+            },
+        },
+    ]
+)
+
+
+EXAMPLES.append(
+    {
+        "id": "CALL-search-first-pass",
+        "oracle": "call_checks",
+        "input": {
+            "cases": [
+                {"entry": "evaluate_pairs", "faults": ["p0_tunnel_limit"]},
+                {
+                    "entry": "evaluate_pairs",
+                    "faults": ["offer_infinite", "p0_tunnel_limit"],
+                },
+                {
+                    "entry": "evaluate_pairs",
+                    "faults": ["p0_tunnel_limit", "p1_overlap"],
+                },
+                {
+                    "entry": "evaluate_pairs",
+                    "faults": ["p0_overlap", "p1_tunnel_limit"],
+                },
+                {
+                    "entry": "evaluate_edge_failures",
+                    "faults": ["tunnel_limit", "offer_infinite"],
+                },
+                {
+                    "entry": "evaluate_demand",
+                    "faults": ["tunnel_limit", "offer_infinite"],
+                },
+                {"entry": "evaluate_demand", "faults": ["tunnel_limit", "no_design"]},
+                {"entry": "evaluate_demand", "faults": ["offer_infinite", "no_design"]},
+            ]
+        },
+        "expected": [
+            "ValueError: tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823",
+            "ValueError: offer must be an integer in [0, 2^62)",
+            "ValueError: tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823",
+            "ValueError: node 107376 is in both endpoint sets: sources and destinations must not overlap",
+            "ValueError: tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823",
+            "ValueError: tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823",
+            "ValueError: tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823",
+            "ValueError: offer must be an integer in [0, 2^62)",
+        ],
+    }
+)
+
+
+def _param(example):
+    marks = (
+        needs_hooks
+        if example["id"].startswith("F-") or example["id"] == "LIST-state-second"
+        else []
+    )
+    return pytest.param(example, id=example["id"], marks=marks)
+
+
+def test_every_example_once():
+    ids = [e["id"] for e in EXAMPLES]
+    assert len(ids) == len(set(ids)) == 199
+    assert {e["oracle"] for e in EXAMPLES} <= set(ADAPTERS)
+
+
+@pytest.mark.parametrize("example", [_param(e) for e in EXAMPLES])
+def test_contract_example(example):
+    if example["id"] in OUTSIDE_THE_DOMAIN:
+        check_outside_the_domain(example)
+        return
+    expected = example["expected"]
+    left_out = NOT_REPORTED.get(example["id"], {})
+    if left_out:
+        expected = {k: v for k, v in expected.items() if k not in left_out}
+    adapter = SEVERAL_DEMANDS.get(example["id"], ADAPTERS[example["oracle"]])
+    got = adapter(**copy.deepcopy(example["input"]))
+    assert mismatch(got, expected) is None
+
+
+def test_every_pair_of_call_check_faults():
+    # The ordered first-pass and second-pass refusals, derived independently
+    # from the documented scalar/evaluator order: 39 pairs plus 16 single-fault controls.
+    building = (
+        "ValueError: a supplied building ShortestPathCache has one writer: it is rejected unless workers == 1 "
+        "(got workers = 2; a frozen cache may be shared by every worker)"
+    )
+    order = {
+        "forward": [
+            ("pinned", 1, "ValueError: Pinned forwards with replace"),
+            ("no_program", 2, "ValueError: forward requires an installed program"),
+            (
+                "offer_type",
+                1,
+                "TypeError: offer must be an integer in [0, 2^62) or permitted +inf",
+            ),
+            (
+                "offer_domain",
+                1,
+                "ValueError: offer must be an integer in [0, 2^62) or permitted +inf",
+            ),
+            (
+                "black_holes_type",
+                1,
+                "TypeError: black_holes must be an Eligibility or None (got str)",
+            ),
+            (
+                "lossy_infinite",
+                1,
+                "ValueError: LOSSY forwarding requires a finite offer",
+            ),
+            (
+                "foreign_black_holes",
+                1,
+                "ValueError: black_holes belongs to another graph",
+            ),
+        ],
+        "evaluate_pairs": [
+            (
+                "foreign_cache",
+                1,
+                "ValueError: foreign ShortestPathCache: bound to another graph",
+            ),
+            ("building_cache", 2, building),
+            ("pinned", 1, "ValueError: evaluate_pairs does not accept Pinned"),
+            ("offer_infinite", 1, "ValueError: offer must be an integer in [0, 2^62)"),
+            (
+                "pairs_type",
+                1,
+                "TypeError: pairs must be a sequence of (sources, destinations)",
+            ),
+            ("pair_length", 1, "ValueError: each pair must be (sources, destinations)"),
+        ],
+        "evaluate_edge_failures": [
+            (
+                "foreign_cache",
+                1,
+                "ValueError: foreign ShortestPathCache: bound to another graph",
+            ),
+            ("building_cache", 2, building),
+            ("offer_infinite", 1, "ValueError: offer must be an integer in [0, 2^62)"),
+        ],
+    }
+    count = 0
+    for entry, checks in order.items():
+        for pair in itertools.chain(
+            itertools.combinations(checks, 1), itertools.combinations(checks, 2)
+        ):
+            faults = {item[0] for item in pair}
+            expected = next(
+                text
+                for fault, _, text in sorted(checks, key=lambda c: c[1])
+                if fault in faults
+            )
+            assert run_call_checks([{"entry": entry, "faults": sorted(faults)}]) == [
+                expected
+            ], (entry, faults)
+            count += 1
+    assert count == 55
+
+
+def test_scalar_argument_conversions_precede_domain_checks():
+    g = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+    other = ngc.Graph(2, [0], [1], [10], [1], 1.0)
+    domain = "offer must be an integer in [0, 2^62) or permitted +inf"
+    design = "design_demand must be an integer in [0, 2^62) or permitted +inf"
+    for admission in (LL, LY):
+        for routing in (ngc.ShortestPaths(), ngc.DistributedTE(ngc.TunnelCount(1))):
+            ledger = ngc.FlowLedger(g)
+            policy = ngc.FlowPolicy(
+                ledger, 0, 1, ngc.FlowPolicyConfig(routing=routing, admission=admission)
+            )
+            policy.replace(
+                1,
+                **(
+                    {"design_demand": 1}
+                    if isinstance(routing, ngc.DistributedTE)
+                    else {}
+                ),
+            )
+            for operation in (policy.evaluate, policy.replace):
+                for offer, kwargs, error, text in [
+                    (-1, {"design_demand": "x"}, ValueError, domain),
+                    (INF, {"design_demand": "x"}, TypeError, design),
+                    (1, {"design_demand": "x"}, TypeError, design),
+                    (
+                        -1,
+                        {"outputs": "x"},
+                        ValueError,
+                        domain,
+                    ),
+                    (
+                        INF,
+                        {"outputs": "x"},
+                        TypeError,
+                        "outputs must be an OutputOptions (got str)",
+                    ),
+                    (
+                        1,
+                        {"design_demand": 5, "outputs": "x"},
+                        TypeError,
+                        "outputs must be an OutputOptions (got str)",
+                    ),
+                    ("x", {"design_demand": "x"}, TypeError, domain),
+                ]:
+                    with pytest.raises(error) as caught:
+                        operation(offer, **kwargs)
+                    assert str(caught.value) == text
+            for offer, kwargs, error, text in [
+                (
+                    INF,
+                    {"black_holes": "x"},
+                    TypeError,
+                    "black_holes must be an Eligibility or None (got str)",
+                ),
+                (
+                    -1,
+                    {"black_holes": "x"},
+                    ValueError,
+                    domain,
+                ),
+                (
+                    INF,
+                    {"outputs": "x"},
+                    TypeError,
+                    "outputs must be an OutputOptions (got str)",
+                ),
+                (
+                    1,
+                    {"black_holes": other.eligibility(), "outputs": "x"},
+                    TypeError,
+                    "outputs must be an OutputOptions (got str)",
+                ),
+            ]:
+                with pytest.raises(error) as caught:
+                    policy.forward(offer, **kwargs)
+                assert str(caught.value) == text
+            assert policy.delivered() == 1
diff --git a/tests/py/test_cost_stretch.py b/tests/py/test_cost_stretch.py
new file mode 100644
index 0000000..2364f2c
--- /dev/null
+++ b/tests/py/test_cost_stretch.py
@@ -0,0 +1,157 @@
+"""CostStretch as one exact fraction: the accepted forms and their conversion in
+the documented order (docs/semantics.md, "Cost ceilings and the exact stretch"), the components at their limits, and the value semantics (factor, equality,
+hash, repr). The refusal below 1 where the ceiling is used is in test_ksp.py and
+test_distributed_te.py."""
+
+from __future__ import annotations
+
+from fractions import Fraction
+
+import numpy as np
+import pytest
+from helpers import assert_read_only, exact
+
+import netgraph_core as ngc
+
+NUMERATOR = "CostStretch fraction numerator must be in [-2^63, 2^63)"
+DENOMINATOR = "CostStretch fraction denominator must be in [1, 2^63)"
+
+
+class _Index:
+    # An integer known only through __index__.
+    def __init__(self, n):
+        self.n = n
+
+    def __index__(self):
+        return self.n
+
+
+class _OwnFloatFails(np.float32):
+    # A NumPy floating value whose own conversion to a float fails.
+    def __float__(self):
+        raise ArithmeticError("own float")
+
+
+def reduced(factor):
+    f = ngc.CostStretch(factor).factor
+    return f"{f.numerator}/{f.denominator}"
+
+
+def test_values():
+    # STRETCH-values: a float is the decimal it prints (1.2 is 6/5, 0.1 + 0.2 its own 17 digits),
+    # a Fraction as it is (2^64 / 2^62 reduces to 4), an integer n/1, an __index__ object too.
+    for factor, want in (
+        (1.2, "6/5"),
+        (1.1, "11/10"),
+        (1.5, "3/2"),
+        (0.1 + 0.2, "7500000000000001/25000000000000000"),
+        (Fraction(6, 5), "6/5"),
+        (Fraction(2**64, 2**62), "4/1"),
+        (2, "2/1"),
+        (_Index(3), "3/1"),
+    ):
+        assert reduced(factor) == want, factor
+    with pytest.raises(
+        ValueError, match=exact("CostStretch factor must be finite (got inf)")
+    ):
+        ngc.CostStretch(float("inf"))
+    with pytest.raises(ValueError, match=exact(NUMERATOR)):
+        ngc.CostStretch(1e19)
+    with pytest.raises(ValueError, match=exact(DENOMINATOR)):
+        ngc.CostStretch(Fraction(1, 2**63))
+    for bad in (True, False, "1.2", None, [1]):
+        with pytest.raises(TypeError, match=r"^CostStretch factor must be"):
+            ngc.CostStretch(bad)
+    # Equal factors are equal values: 1.5 and 3/2, 1.2 and 6/5; the binary value of 1.2 is not.
+    assert ngc.CostStretch(1.5) == ngc.CostStretch(Fraction(3, 2))
+    assert ngc.CostStretch(1.2) == ngc.CostStretch(Fraction(6, 5))
+    assert ngc.CostStretch(1.2) != ngc.CostStretch(
+        Fraction(5404319552844595, 4503599627370496)
+    )
+
+
+def test_numpy():
+    # STRETCH-numpy: every NumPy floating type prints its own shortest decimal (float32's 1.2 is
+    # 6/5, not 1.2000000476837158), a NumPy integer is n/1, numpy.bool_ is no number.
+    for factor, want in (
+        (np.float64(1.2), "6/5"),
+        (np.float32(1.2), "6/5"),
+        (np.float16(1.2), "6/5"),
+        (np.float32(0.30000001192092896), "3/10"),
+        (np.int64(2), "2/1"),
+    ):
+        assert reduced(factor) == want, factor
+    for factor, shown in ((np.float64("nan"), "nan"), (np.float32("inf"), "inf")):
+        with pytest.raises(
+            ValueError, match=exact(f"CostStretch factor must be finite (got {shown})")
+        ):
+            ngc.CostStretch(factor)
+    with pytest.raises(ValueError, match=exact(NUMERATOR)):
+        ngc.CostStretch(np.float64(1e19))
+    with pytest.raises(TypeError, match=r"^CostStretch factor must be"):
+        ngc.CostStretch(np.bool_(True))
+    assert ngc.CostStretch(np.float32(1.2)) == ngc.CostStretch(Fraction(6, 5))
+    assert ngc.CostStretch(np.float64(1.2)) == ngc.CostStretch(1.2)
+    # The object's own conversion failing reaches the caller unchanged.
+    with pytest.raises(ArithmeticError, match=exact("own float")):
+        ngc.CostStretch(_OwnFloatFails(1.2))
+
+
+def test_component_limits():
+    # The reduced components are checked as exact integers, whatever their size before reduction.
+    with pytest.raises(ValueError, match=exact(NUMERATOR)):
+        ngc.CostStretch(Fraction(2**63, 1))
+    with pytest.raises(ValueError, match=exact(NUMERATOR)):
+        ngc.CostStretch(2**63)
+    with pytest.raises(ValueError, match=exact(DENOMINATOR)):
+        ngc.CostStretch(Fraction(1, 2**63))
+    assert (
+        reduced(Fraction(-(2**63), 1)) == f"{-(2**63)}/1"
+    )  # valid; refused where used
+    assert reduced(Fraction(2**63 - 1, 2**63 - 1)) == "1/1"
+    assert reduced(Fraction(2**64, 2**62)) == "4/1"
+    assert reduced(Fraction(2**63 - 1, 2**63 - 2)) == f"{2**63 - 1}/{2**63 - 2}"
+    assert (
+        reduced(0.5) == "1/2"
+    )  # below 1: a valid value, refused where the ceiling is used
+
+
+def test_value_semantics():
+    # factor is a fractions.Fraction; equality, hash and repr follow the fraction.
+    f = ngc.CostStretch(1.5).factor
+    assert type(f) is Fraction and f == Fraction(3, 2)
+    assert ngc.CostStretch(1.5) == ngc.CostStretch(Fraction(3, 2))
+    assert hash(ngc.CostStretch(1.5)) == hash(ngc.CostStretch(Fraction(3, 2)))
+    assert hash(ngc.CostStretch(1.5)) == hash(Fraction(3, 2))
+    assert ngc.CostStretch(2) != ngc.AbsoluteCost(2)
+    assert repr(ngc.CostStretch(1.2)) == "CostStretch(Fraction(6, 5))"
+    assert repr(ngc.CostStretch(-(2**63))) == f"CostStretch(Fraction({-(2**63)}, 1))"
+    assert_read_only(ngc.CostStretch(Fraction(6, 5)), "factor")
+
+
+def test_ceiling_products_beyond_64_bits():
+    # Two parallel links 0 -> 1 of capacity 1, costs B = 2^32 (the shortest) and C. The ceiling
+    # compares C * den with num * B, products of about 2^64 to 2^65: with C = 2^32 + 1 and
+    # f = 2^32 / (2^32 - 1), C * den = 2^64 - 1 <= 2^64 = num * B (admitted; the low 64 bits alone
+    # say 2^64 - 1 > 0); with C = 2^33 and f = (2^32 + 2) / (2^32 + 1), C * den = 2^65 + 2^33 >
+    # 2^64 + 2^33 (refused; the low 64 bits alone are equal). T1's second tunnel and ksp's second
+    # path follow the exact comparison.
+    b = 1 << 32
+    for c, factor, admitted in (
+        (b + 1, Fraction(b, b - 1), True),
+        (2 * b, Fraction(b + 2, b + 1), False),
+    ):
+        g = ngc.Graph(2, [0, 0], [1, 1], [1, 1], [b, c], 1.0)
+        ceiling = ngc.CostStretch(factor)
+        paths = ngc.ksp(g, 0, 1, ngc.KspOptions(2, cost_ceiling=ceiling))
+        assert [cost for cost, _ in paths] == ([b, c] if admitted else [b]), c
+        t1 = ngc.FlowPolicyConfig(
+            routing=ngc.DistributedTE(ngc.TunnelCount(2), cost_ceiling=ceiling)
+        )
+        r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, t1).replace(2, design_demand=2)
+        status = ngc.TunnelStatus
+        assert [t.status for t in r.program.tunnels] == [
+            status.UP,
+            status.UP if admitted else status.COST_CEILING_EXCEEDED,
+        ], c
+        assert r.call_delivered == (2 if admitted else 1), c
diff --git a/tests/py/test_cross_validation.py b/tests/py/test_cross_validation.py
deleted file mode 100644
index 3765e01..0000000
--- a/tests/py/test_cross_validation.py
+++ /dev/null
@@ -1,356 +0,0 @@
-"""Cross-validation tests comparing NetGraph-Core to original NetGraph implementation.
-
-This module validates that NetGraph-Core produces the same maxflow results
-as the original NetGraph repository for important real-world topologies.
-
-References:
-- NetGraph tests/integration/test_scenario_3.py (Clos topology)
-- NetGraph tests/solver/test_maxflow_api.py (Triangle, parallel paths)
-- NetGraph tests/model/test_flow.py (Basic topologies)
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-def _build_3tier_clos_graph() -> ngc.StrictMultiDiGraph:
-    """Build a 3-tier Clos topology matching NetGraph scenario_3.yaml structure.
-
-    Structure (replicates scenario_3 from NetGraph integration tests):
-    - 2 Clos instances (clos1, clos2)
-    - Each Clos has:
-      - 2 bricks (b1, b2)
-      - Each brick has:
-        - 4 T1 nodes (tier1/leaf layer)
-        - 4 T2 nodes (tier2/aggregation layer)
-        - Mesh: all T1->T2 edges within brick (100 Gbps, cost 1)
-      - 16 spine nodes (T3)
-      - Connections: Each brick's 4 T2 nodes connect one-to-one to 4 spines (400 Gbps, cost 1)
-    - Inter-Clos: 16 spine-to-spine links (400 Gbps, cost 1)
-
-    Node numbering:
-    - Clos1:
-      - b1/t1: nodes 0-3
-      - b1/t2: nodes 4-7
-      - b2/t1: nodes 8-11
-      - b2/t2: nodes 12-15
-      - spine: nodes 16-31
-    - Clos2:
-      - b1/t1: nodes 32-35
-      - b1/t2: nodes 36-39
-      - b2/t1: nodes 40-43
-      - b2/t2: nodes 44-47
-      - spine: nodes 48-63
-
-    Total nodes: 64
-
-    Expected max flow from clos1 T1 nodes to clos2 T1 nodes: 3200.0 Gbps
-    (8 inter-clos spine links × 400 Gbps = 3200 Gbps bottleneck)
-    """
-    num_nodes = 64
-    src_list = []
-    dst_list = []
-    cap_list = []
-    cost_list = []
-
-    def add_mesh(group1_start, group1_count, group2_start, group2_count, capacity):
-        """Add mesh connections between two groups."""
-        for i in range(group1_count):
-            for j in range(group2_count):
-                src_list.append(group1_start + i)
-                dst_list.append(group2_start + j)
-                cap_list.append(capacity)
-                cost_list.append(1)
-
-    def add_one_to_one(group1_start, group1_count, group2_start, capacity):
-        """Add one-to-one connections."""
-        for i in range(group1_count):
-            src_list.append(group1_start + i)
-            dst_list.append(group2_start + i)
-            cap_list.append(capacity)
-            cost_list.append(1)
-
-    # Clos1 brick1: T1 (0-3) mesh to T2 (4-7)
-    add_mesh(0, 4, 4, 4, 100.0)
-
-    # Clos1 brick2: T1 (8-11) mesh to T2 (12-15)
-    add_mesh(8, 4, 12, 4, 100.0)
-
-    # Clos1 b1/T2 (4-7) one-to-one to spine (16-19)
-    add_one_to_one(4, 4, 16, 400.0)
-
-    # Clos1 b2/T2 (12-15) one-to-one to spine (20-23)
-    add_one_to_one(12, 4, 20, 400.0)
-
-    # Inter-Clos: Clos1 spine (16-31) one-to-one to Clos2 spine (48-63)
-    add_one_to_one(16, 16, 48, 400.0)
-
-    # Clos2 spine (48-63) to b1/T2 (36-39) - only first 4 spines connect
-    add_one_to_one(48, 4, 36, 400.0)
-
-    # Clos2 spine (52-55) to b2/T2 (44-47)
-    add_one_to_one(52, 4, 44, 400.0)
-
-    # Clos2 brick1: T2 (36-39) mesh to T1 (32-35)
-    add_mesh(36, 4, 32, 4, 100.0)
-
-    # Clos2 brick2: T2 (44-47) mesh to T1 (40-43)
-    add_mesh(44, 4, 40, 4, 100.0)
-
-    return _make_graph(
-        num_nodes,
-        np.array(src_list, dtype=np.int32),
-        np.array(dst_list, dtype=np.int32),
-        np.array(cap_list, dtype=np.float64),
-        np.array(cost_list, dtype=np.int64),
-    )
-
-
-def _build_triangle_graph() -> ngc.StrictMultiDiGraph:
-    """Triangle topology from NetGraph solver tests.
-
-    Used in test_maxflow_api.py::_triangle_network()
-
-    Topology:
-      A(0) -> B(1) (cap 2)
-      B(1) -> C(2) (cap 1)
-      A(0) -> C(2) (cap 1)
-
-    Expected max flow A->C: 2.0 (1 direct + 1 via B)
-    """
-    src = np.array([0, 1, 0], dtype=np.int32)
-    dst = np.array([1, 2, 2], dtype=np.int32)
-    cap = np.array([2.0, 1.0, 1.0], dtype=np.float64)
-    cost = np.array([1, 1, 1], dtype=np.int64)
-
-    return _make_graph(3, src, dst, cap, cost)
-
-
-def _build_simple_parallel_paths_graph() -> ngc.StrictMultiDiGraph:
-    """Simple network with two disjoint parallel paths.
-
-    From NetGraph solver tests: test_maxflow_api.py::_simple_network()
-
-    Topology:
-      S(0) -> A(1) (cap 1) -> T(3) (cap 1)
-      S(0) -> B(2) (cap 1) -> T(3) (cap 1)
-
-    Expected max flow S->T: 2.0
-    """
-    src = np.array([0, 1, 0, 2], dtype=np.int32)
-    dst = np.array([1, 3, 2, 3], dtype=np.int32)
-    cap = np.array([1.0, 1.0, 1.0, 1.0], dtype=np.float64)
-    cost = np.array([1, 1, 1, 1], dtype=np.int64)
-
-    return _make_graph(4, src, dst, cap, cost)
-
-
-class TestNetGraphCrossValidation:
-    """Validate maxflow results match original NetGraph for important topologies."""
-
-    def test_3tier_clos_proportional_shortest(self, algs, to_handle):
-        """Validates 3-tier Clos fabric maxflow matches NetGraph scenario_3 expectations.
-
-        Reference: NetGraph tests/integration/test_scenario_3.py
-        Expected: 3200.0 Gbps from clos1 T1 nodes to clos2 T1 nodes
-        """
-        g = _build_3tier_clos_graph()
-        gh = to_handle(g)
-
-        # Test single T1-to-T1 path (representative of full fabric capacity)
-        # node 0 (clos1/b1/t1-1) to node 32 (clos2/b1/t1-1)
-        total, _summary = algs.max_flow(
-            gh,
-            0,
-            32,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # Each T1 node can push 400 Gbps through the network
-        # (4 T2 paths × 100 Gbps = 400 Gbps from T1 to T2 layer)
-        assert pytest.approx(total, rel=0, abs=1.0) == 400.0
-
-    def test_3tier_clos_equal_balanced_shortest(self, algs, to_handle):
-        """Validates 3-tier Clos with EQUAL_BALANCED placement.
-
-        Reference: NetGraph scenario_3 "capacity_analysis_forward_balanced"
-        """
-        g = _build_3tier_clos_graph()
-        gh = to_handle(g)
-
-        total, _summary = algs.max_flow(
-            gh,
-            0,
-            32,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # With EQUAL_BALANCED, flow is split equally across paths
-        # Expected similar capacity as PROPORTIONAL for this balanced topology
-        assert total > 0.0, "Should find positive flow"
-        assert total <= 400.0 + 1.0, "Should not exceed topology capacity"
-
-    def test_triangle_topology_combine_mode(self, algs, to_handle):
-        """Triangle topology from NetGraph solver tests.
-
-        Reference: test_maxflow_api.py::test_max_flow_combine_basic()
-        Expected maxflow A->C: 2.0 (1 direct + 1 via B)
-        """
-        g = _build_triangle_graph()
-        gh = to_handle(g)
-
-        total, _summary = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=False,  # Use all paths
-            with_edge_flows=False,
-        )
-
-        assert pytest.approx(total, rel=0, abs=1e-9) == 2.0
-
-    def test_simple_parallel_paths_topology_shortest_path(self, algs, to_handle):
-        """Two disjoint parallel paths topology with shortest_path=True.
-
-        Reference: test_maxflow_api.py::test_shortest_path_vs_full_max_flow()
-        Expected maxflow S->T: 2.0 (both equal-cost paths saturated)
-        """
-        g = _build_simple_parallel_paths_graph()
-        gh = to_handle(g)
-
-        # Test with shortest_path=True (should use both equal-cost paths)
-        total_sp, _summary = algs.max_flow(
-            gh,
-            0,
-            3,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        assert pytest.approx(total_sp, rel=0, abs=1e-9) == 2.0
-
-    def test_simple_parallel_paths_topology_full_maxflow(self, algs, to_handle):
-        """Two disjoint parallel paths topology with shortest_path=False.
-
-        Reference: test_maxflow_api.py::test_shortest_path_vs_full_max_flow()
-        Expected maxflow S->T: 2.0
-        """
-        g = _build_simple_parallel_paths_graph()
-        gh = to_handle(g)
-
-        # Test with shortest_path=False
-        total_full, _summary = algs.max_flow(
-            gh,
-            0,
-            3,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=False,
-            with_edge_flows=False,
-        )
-
-        assert pytest.approx(total_full, rel=0, abs=1e-9) == 2.0
-
-
-class TestCommonFixtureTopologies:
-    """Validate that common test fixtures produce expected maxflow results."""
-
-    def test_square1_graph_proportional(self, square1_graph, algs, to_handle):
-        """Validate square1_graph (one shortest, one longer alternative path)."""
-        gh = to_handle(square1_graph)
-
-        # With shortest_path=True, should use shortest path only
-        total_sp, _ = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # Shortest path: 0->1->2, capacity limited to 1.0
-        assert pytest.approx(total_sp, rel=0, abs=1e-9) == 1.0
-
-        # With shortest_path=False, should use both paths
-        total_full, _ = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=False,
-            with_edge_flows=False,
-        )
-
-        # Both paths: shortest (cap 1) + longer (cap 2) = 3.0
-        assert pytest.approx(total_full, rel=0, abs=1e-9) == 3.0
-
-    def test_line1_graph_wcmp_vs_ecmp(self, line1_graph, algs, to_handle):
-        """Validate line1_graph behavior with WCMP vs ECMP placement."""
-        gh = to_handle(line1_graph)
-
-        # WCMP (PROPORTIONAL) with shortest_path=True
-        total_wcmp, _ = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # ECMP (EQUAL_BALANCED) with shortest_path=True
-        total_ecmp, _ = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # WCMP should utilize parallel paths proportionally to capacity
-        # ECMP should split equally, potentially leaving capacity unused
-        assert total_wcmp > 0.0
-        assert total_ecmp > 0.0
-        # WCMP typically utilizes more capacity when paths have different capacities
-        assert total_wcmp >= total_ecmp - 1e-9
-
-    def test_graph3_multipath_capacity(self, graph3, algs, to_handle):
-        """Validate graph3 (complex 6-node topology with parallels and longer routes)."""
-        gh = to_handle(graph3)
-
-        total, _ = algs.max_flow(
-            gh,
-            0,
-            2,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-            with_edge_flows=False,
-        )
-
-        # graph3 has multiple parallel paths from 0->2
-        # Total capacity should be sum of parallel edge capacities
-        # 0->1: caps [2, 4, 6] = 12 total
-        # 1->2: caps [1, 2, 3] = 6 total
-        # Bottleneck at 1->2 limits to 6.0
-        # But also 0->4->2 path exists with cap 4
-        # Total expected: 10.0
-        assert pytest.approx(total, rel=0, abs=1e-9) == 10.0
diff --git a/tests/py/test_distributed_te.py b/tests/py/test_distributed_te.py
new file mode 100644
index 0000000..2ba57df
--- /dev/null
+++ b/tests/py/test_distributed_te.py
@@ -0,0 +1,1600 @@
+"""T1 (DistributedTE(TunnelCount(N))) through the binding: the worked T1 examples, the configuration and call checks, setup, forwarding, operations, programs and replays,
+records, flags and terminations, the evaluators, the numeric ranges, zero offers and everything
+masked, a property test against the independent tunnel_oracle.py, and the Python-allocation
+sweeps of T1's results. The ledger's two projections are test_ledger_projections.py's."""
+
+from __future__ import annotations
+
+import random
+from fractions import Fraction
+
+import pytest
+import tunnel_oracle as orc
+from helpers import (
+    GLOBAL,
+    INF,
+    L62,
+    SHORTEST_PATHS,
+    assert_ints,
+    build,
+    exact,
+    full_ledger_state,
+    ledger_state,
+    sweep_python_allocation,
+    t1_config,
+)
+from private_hooks import HOOKS, needs_hooks
+
+import netgraph_core as ngc
+
+T = ngc.Termination
+S = ngc.TunnelStatus
+UP, NB, CC, FAILED, BLACKHOLED = (
+    S.UP,
+    S.INSUFFICIENT_BANDWIDTH,
+    S.COST_CEILING_EXCEEDED,
+    S.FAILED,
+    S.BLACKHOLED,
+)
+LOSSY = ngc.Admission.LOSSY
+LOSSLESS = ngc.Admission.LOSSLESS
+TIE = ngc.RouteTieBreak
+HOLDS = ngc.OutputOptions(edge_reservations=True)
+
+
+def ledger_now(fg):
+    """The ledger's public state; with the private hooks also its next FlowId and owners."""
+    return full_ledger_state(fg) if HOOKS else ledger_state(fg)
+
+
+def graph(rows, n=None):
+    """A graph whose rows are in EdgeId order (asserted): (u, v, capacity, cost)."""
+    n = n if n is not None else 1 + max(max(u, v) for u, v, _, _ in rows)
+    g = build(n, rows)
+    assert [int(i) for i in g.input_positions()] == list(range(len(rows)))
+    return g
+
+
+def one10():
+    return graph([(0, 1, 10, 1)])
+
+
+def twoh(a, b):
+    return graph([(0, 2, a, 1), (1, 2, b, 1)])
+
+
+def par612():
+    return graph([(0, 1, 6, 1), (0, 1, 6, 2)])
+
+
+DIAM5 = [(0, 1, 6, 1), (0, 2, 6, 3), (1, 2, 4, 1), (1, 3, 6, 3), (2, 3, 6, 1)]
+
+
+def diam5():
+    return graph(DIAM5)
+
+
+def x8():
+    return graph([(0, 2, 0, 1), (1, 2, 8, 3)])
+
+
+def policy(g, s, d, n, admission=None, ledger=None, eligibility=None, **routing):
+    ledger = ledger if ledger is not None else ngc.FlowLedger(g)
+    return ngc.FlowPolicy(ledger, s, d, t1_config(n, admission, **routing), eligibility)
+
+
+def statuses(r):
+    return [t.status for t in r.program.tunnels]
+
+
+def routes(r):
+    return [list(t.edges) if t.edges is not None else [] for t in r.program.tunnels]
+
+
+def requests(r):
+    return [t.requested_bandwidth for t in r.program.tunnels]
+
+
+def rows(r):
+    return [
+        (t.entry_id, t.head, t.status, t.assigned, t.delivered, t.total_edge_drops)
+        for t in r.by_tunnel
+    ]
+
+
+def source_rows(r):
+    return [
+        (
+            s.source,
+            s.offered,
+            s.admitted,
+            s.delivered,
+            s.source_drops,
+            s.total_edge_drops,
+        )
+        for s in r.by_source
+    ]
+
+
+def err(fn):
+    with pytest.raises(ValueError) as e:
+        fn()
+    return str(e.value)
+
+
+# ---------------------------------------------------------------- the worked examples (X)
+
+G1 = [(0, 1, 8192, 1), (0, 2, 40960, 1), (1, 3, 8192, 1), (2, 3, 40960, 1)]
+BRANCH_ROUTES = [[0, 2]] * 2 + [[1, 3]] * 13 + [[]]
+BRANCH_SHARES = [3277] * 12 + [3276] * 3 + [0]
+EXAMPLES = {
+    # id: (rows, heads, dst, D, N, routing keywords, requests, routes, statuses, reserved,
+    #      reserved per edge, lossless bound, offer, Lossy shares per entry, delivery, source loss)
+    "four tunnels on two parallel links": (
+        [(0, 1, 6, 1), (0, 1, 6, 2)], [0], 1, 12, 4, {}, [3] * 4, [[0], [0], [1], [1]],
+        [UP] * 4, 12, [6, 6], 12, 13, [4, 3, 3, 3], 12, 0),
+    "uneven requests 3 and 2": (
+        [(0, 1, 3, 1), (0, 1, 2, 2)], [0], 1, 5, 2, {}, [3, 2], [[0], [1]], [UP, UP], 5,
+        [3, 2], 5, 5, [3, 2], 5, 0),
+    "a share below the tunnel count": (
+        [(0, 1, 6, 1), (0, 1, 6, 2)], [0], 1, 1, 2, {}, [1, 0], [[0], [0]],
+        [UP, UP], 1, [1, 0], 6, 1, [1, 0], 1, 0),
+    "carried above the holds": (
+        [(0, 1, 5, 1), (0, 1, 5, 1)], [0], 1, 8, 2, {}, [4, 4], [[0], [1]],
+        [UP, UP], 8, [4, 4], 10, 10, [5, 5], 10, 0),
+    "a zero request on a zero-capacity link": (
+        [(0, 1, 0, 1)], [0], 1, 0, 1, {}, [0], [[0]], [UP], 0, [0], 0, 1, [1],
+        0, 0),
+    "the last tunnel without bandwidth": (
+        [(0, 1, 2, 1), (0, 1, 10, 2)], [0], 1, 12, 4, {}, [3] * 4, [[1], [1], [1], []],
+        [UP, UP, UP, NB], 9, [0, 9], 10, 12, [4, 4, 4, 0], 10, 0),
+    "two heads sharing a link": (
+        [(0, 2, 6, 1), (1, 2, 6, 1), (2, 3, 6, 1)], [0, 1], 3, 12, 2, {}, [3] * 4,
+        [[0, 2], [1, 2], [], []], [UP, UP, NB, NB], 6, [3, 3, 6], 6, 12, [6, 6, 0, 0], 6, 0),
+    "three heads, one with a zero request": (
+        [(0, 3, 20, 1), (1, 3, 20, 1), (2, 3, 20, 1)], [0, 1, 2], 3, 2, 1, {}, [1, 1, 0],
+        [[0], [1], [2]], [UP] * 3, 2, [1, 1, 0], 60, 3, [1, 1, 1], 3, 0),
+    "two equal links, one tunnel each": (
+        [(0, 1, 5, 1), (0, 1, 5, 1)], [0], 1, 8, 2, {}, [4, 4], [[0], [1]], [UP, UP], 8,
+        [4, 4], 10, 8, [4, 4], 8, 0),
+    "a head behind a zero-capacity link": (
+        [(0, 2, 0, 1), (1, 2, 8, 3)], [0, 1], 2, 4, 1, {}, [2, 2], [[], [1]], [NB, UP], 2,
+        [0, 2], 0, 4, [0, 2], 2, 2),
+    "a head behind a zero-capacity link, AbsoluteCost(3)": (
+        [(0, 2, 0, 1), (1, 2, 8, 3)], [0, 1], 2, 4, 1,
+        {"cost_ceiling": ngc.AbsoluteCost(3)}, [2, 2], [[], [1]], [NB, UP], 2,
+        [0, 2], 0, None, None, None, None),
+    "a head behind a zero-capacity link, CostStretch(2)": (
+        [(0, 2, 0, 1), (1, 2, 8, 3)], [0, 1], 2, 4, 1,
+        {"cost_ceiling": ngc.CostStretch(2)}, [2, 2], [[], []], [NB, CC], 0, [0, 0],
+        0, None, None, None, None),
+    # A-X8-Stretch-exact: 1.2 is exactly 6/5, so c0 = 5 admits the cost-6 path at equality;
+    # A-X8-Stretch-cost7: a cost-7 path exceeds the ceiling.
+    "CostStretch(1.2) admits the next path at equality": (
+        [(0, 1, 0, 5), (0, 1, 1, 6)], [0], 1, 1, 1,
+        {"cost_ceiling": ngc.CostStretch(1.2)}, [1], [[1]], [UP], 1, [0, 1], 1,
+        1, [1], 1, 0),
+    "CostStretch(6/5) below a path of cost 7": (
+        [(0, 1, 0, 5), (0, 1, 1, 7)], [0], 1, 1, 1,
+        {"cost_ceiling": ngc.CostStretch(Fraction(6, 5))}, [1], [[]], [CC], 0, [0, 0], 0,
+        1, [0], 0, 1),
+    "the diamond, design 8": (
+        DIAM5, [0], 3, 8, 2, {}, [4, 4], [[0, 2, 4], []], [UP, NB], 4, [4, 0, 4, 0, 4], 4,
+        None, None, None, None),
+    "the diamond, design 10": (
+        DIAM5, [0], 3, 10, 2, {}, [5, 5], [[0, 3], [1, 4]], [UP, UP], 10,
+        [5, 5, 0, 5, 5], 12, None, None, None, None),
+    "the diamond, design 14": (
+        DIAM5, [0], 3, 14, 2, {}, [7, 7], [[], []], [NB, NB], 0, [0] * 5, 0, 14, [0, 0],
+        0, 14),
+    "two heads, the second with bandwidth": (
+        [(0, 2, 2, 1), (1, 2, 10, 1)], [0, 1], 2, 12, 2, {}, [3] * 4,
+        [[], [1], [], [1]], [NB, UP, NB, UP], 6, [0, 6], 0, 12, [0, 3, 0, 3], 6, 6),
+    "more tunnels than units": (
+        [(0, 1, 10, 1)], [0], 1, 3, 4, {}, [1, 1, 1, 0], [[0]] * 4, [UP] * 4, 3, [3], 10,
+        3, [1, 1, 1, 0], 3, 0),
+    "an idle tunnel on a zero-capacity link": (
+        [(0, 1, 0, 1), (0, 1, 10, 2)], [0], 1, 1, 2, {}, [1, 0], [[1], [0]],
+        [UP, UP], 1, [0, 1], 1, 2, [1, 1], 1, 0),
+    "a zero design": (
+        [(0, 1, 10, 1)], [0], 1, 0, 2, {}, [0, 0], [[0], [0]], [UP, UP], 0, [0],
+        10, 4, [2, 2], 4, 0),
+    # The sixteen tunnels' Lossy delivery is not in the example: by hand 6554 within 8192 plus
+    # 40960 of 42598.
+    "sixteen tunnels on two branches": (
+        G1, [0], 3, 49152, 16, {}, [3072] * 16, BRANCH_ROUTES, [UP] * 15 + [NB], 46080,
+        [6144, 39936, 6144, 39936], 47262, 49152, BRANCH_SHARES, 47514, 0),
+    "sixteen tunnels, a design above the network": (
+        G1, [0], 3, 409600, 16, {}, [25600] * 16, [[1, 3]] + [[]] * 15,
+        [UP] + [NB] * 15, 25600, [0, 25600, 0, 25600], 40960, None, None, None,
+        None),
+}  # fmt: skip
+
+
+@pytest.mark.parametrize("eid", list(EXAMPLES))
+def test_contract_examples(eid):
+    (rows_, heads, dst, D, N, kw, req, rts, st, reserved, per_edge, bound) = EXAMPLES[
+        eid
+    ][:12]
+    offer, shares, delivery, loss = EXAMPLES[eid][12:]
+    g = graph(rows_)
+    fg = ngc.FlowLedger(g)
+    p = policy(g, heads, dst, N, ledger=fg, **kw)
+    r = p.replace(INF, design_demand=D, outputs=HOLDS)
+    assert (requests(r), routes(r), statuses(r)) == (req, rts, st)
+    assert r.plan.total_reserved_bandwidth == reserved
+    assert r.edge_reservations.tolist() == per_edge == fg.reserved().tolist()
+    assert (r.call_delivered, r.termination) == (bound, T.EXHAUSTED)
+    if offer is None:
+        return
+    ly = policy(g, heads, dst, N, LOSSY, **kw)
+    s = ly.replace(offer, design_demand=D)
+    assert [t.assigned for t in s.by_tunnel] == shares
+    assert (s.call_delivered, s.call_source_drops, s.termination) == (
+        delivery,
+        loss,
+        T.COMPLETE,
+    )
+    assert (routes(s), statuses(s)) == (rts, st)  # the offer never changes the setup
+
+
+def test_twoh_call():
+    g = ngc.Graph(
+        3,
+        edge_sources=[0, 1],
+        edge_destinations=[2, 2],
+        edge_capacity_units=[2, 10],
+        edge_costs=[1, 1],
+        resolution=1.0,
+    )
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=LOSSY
+    )
+    fg = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(fg, [0, 1], 2, cfg)
+    r = p.replace(12, design_demand=12)
+    assert [t.status for t in r.program.tunnels] == [NB, UP, NB, UP]
+    assert (r.call_delivered, r.call_source_drops) == (6, 6)
+    assert r.plan.total_reserved_bandwidth == 6
+    assert (r.plan.tunnels_per_head, r.plan.design_demand, r.plan.design_by_head) == (
+        2,
+        12,
+        ((0, 6), (1, 6)),
+    )
+    f = p.forward(8)
+    assert (f.call_delivered, f.call_source_drops, f.delivery_delta) == (4, 4, -2)
+    assert [t.assigned for t in f.by_tunnel] == [0, 2, 0, 2]
+    assert fg.reserved().tolist() == [0, 6]
+
+
+# ---------------------------------------------------------------- validation (V)
+
+
+def test_matrix():
+    # T1's row of the matrix, in order.
+    g = one10()
+    fg = ngc.FlowLedger(g)
+    ca = ngc.DistributedTE(ngc.TunnelCount(2))
+    # The fields of the other models are no keywords of DistributedTE or FlowPolicyConfig.
+    for kw in (
+        {"allocation": ngc.RouteAllocation.EQUAL},
+        {"source_allocation": ngc.SourceAllocation.EQUAL},
+        {"weight_basis": ngc.WeightBasis.CAPACITY},
+        {"edge_weights": [1]},
+        {"multipath": False},
+    ):
+        with pytest.raises(TypeError):
+            ngc.DistributedTE(ngc.TunnelCount(2), **kw)
+    for kw in (
+        {"placement": ngc.RouteAllocation.EQUAL},
+        {"origin": ngc.SourceAllocation.EQUAL},
+    ):
+        with pytest.raises(TypeError):
+            ngc.FlowPolicyConfig(routing=ca, **kw)
+    upto = ngc.FlowPolicyConfig(
+        routing=ngc.DistributedTE(ngc.TunnelCount(2, up_to=True))
+    )
+    text = "DistributedTE requires an exact tunnel count"
+    with pytest.raises(ValueError, match=exact(text)):
+        ngc.FlowPolicy(fg, 0, 1, upto)
+    with pytest.raises(ValueError, match=exact(text)):
+        ngc.evaluate_demand(g, 0, 1, ngc.EvaluationOptions(upto, design_demand=1))
+    with pytest.raises(
+        ValueError, match=exact("DistributedTE does not use ShortestPathCache")
+    ):
+        ngc.FlowPolicy(
+            fg, 0, 1, ngc.FlowPolicyConfig(routing=ca), cache=ngc.ShortestPathCache(g)
+        )
+    # Both admissions with every tie_break and parallel_edges (T1 always orders single paths:
+    # no tie rule is ineffective); T1 has no multipath field.
+    for tie in TIE.__members__.values():
+        for parallel_edges in (True, False):
+            for adm in (LOSSLESS, LOSSY):
+                routing = ngc.DistributedTE(
+                    ngc.TunnelCount(2), tie_break=tie, parallel_edges=parallel_edges
+                )
+                ngc.FlowPolicy(
+                    fg, 0, 1, ngc.FlowPolicyConfig(routing=routing, admission=adm)
+                )
+    got = ngc.FlowPolicy(fg, 0, 1, ngc.FlowPolicyConfig(routing=ca)).config
+    assert repr(got.routing) == repr(ca)
+    assert (got.routing.tie_break, got.routing.parallel_edges) == (TIE.FEWER_HOPS, True)
+
+
+def test_validation_order():
+    # After the matrix: the count's range, then "up to", the ceiling, the search minimum.
+    fg = ngc.FlowLedger(one10())
+    for routing, text in (
+        (
+            ngc.DistributedTE(ngc.TunnelCount(0, up_to=True)),
+            "tunnel count must be in [1, 10000]",
+        ),
+        (
+            ngc.DistributedTE(
+                ngc.TunnelCount(2, up_to=True), cost_ceiling=ngc.AbsoluteCost(-1)
+            ),
+            "DistributedTE requires an exact tunnel count",
+        ),
+        (
+            ngc.DistributedTE(
+                ngc.TunnelCount(2),
+                cost_ceiling=ngc.AbsoluteCost(-1),
+                min_unreserved_bandwidth=L62,
+            ),
+            "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)",
+        ),
+        (
+            ngc.DistributedTE(ngc.TunnelCount(2), min_unreserved_bandwidth=L62),
+            "min_unreserved_bandwidth must be an integer in [0, 2^62)",
+        ),
+    ):
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowPolicy(fg, 0, 1, ngc.FlowPolicyConfig(routing=routing))
+
+
+def test_count_range():
+    # [1, 10000] at the policy; a bool or a float at TunnelCount itself (a configuration value's
+    # wrong type: TypeError).
+    fg = ngc.FlowLedger(one10())
+    for n in (0, 10001, -1):
+        with pytest.raises(
+            ValueError, match=exact("tunnel count must be in [1, 10000]")
+        ):
+            policy(None, 0, 1, n, ledger=fg)
+    policy(None, 0, 1, 10000, ledger=fg)
+    for bad, kind in ((True, "bool"), (1.0, "float")):
+        with pytest.raises(
+            TypeError,
+            match=exact(f"TunnelCount per_head must be an integer (got {kind})"),
+        ):
+            ngc.TunnelCount(bad)
+
+
+def test_parameters():
+    # The search minimum's domain, the unreserved texts and the ceilings' kept texts.
+    fg = ngc.FlowLedger(one10())
+    for bad in (-1, L62):
+        with pytest.raises(
+            ValueError,
+            match=exact("min_unreserved_bandwidth must be an integer in [0, 2^62)"),
+        ):
+            policy(None, 0, 1, 1, ledger=fg, min_unreserved_bandwidth=bad)
+    policy(None, 0, 1, 1, ledger=fg, min_unreserved_bandwidth=L62 - 1)
+    with pytest.raises(
+        ValueError, match=exact("cost_ceiling AbsoluteCost cost must be >= 0 (got -1)")
+    ):
+        policy(None, 0, 1, 1, ledger=fg, cost_ceiling=ngc.AbsoluteCost(-1))
+    for factor, shown in ((0.5, "1/2"), (Fraction(-(2**63)), "-9223372036854775808/1")):
+        with pytest.raises(
+            ValueError,
+            match=exact(f"cost_ceiling CostStretch factor must be >= 1 (got {shown})"),
+        ):
+            policy(None, 0, 1, 1, ledger=fg, cost_ceiling=ngc.CostStretch(factor))
+
+
+def test_tunnel_limit():
+    # Heads after the mask times the count; FAN(107374) with N = 10000 just fits.
+    def fan(h):
+        return build(h + 1, [(i, h, 1, 1) for i in range(h)])
+
+    big = fan(107375)
+    with pytest.raises(
+        ValueError,
+        match=exact("tunnel limit exceeded: 107375 heads x 10000 tunnels > 1073741823"),
+    ):
+        policy(big, list(range(107375)), 107375, 10000)
+    policy(
+        big,
+        list(range(107375)),
+        107375,
+        10000,
+        eligibility=big.eligibility(excluded_nodes=[0]),
+    )
+    policy(fan(107374), list(range(107374)), 107374, 10000)
+
+
+@needs_hooks
+def test_traced_place_checks_the_operation_first():
+    p = policy(one10(), 0, 1, 1)
+    for v in (5, 0, -1, L62, 2**100):
+        with pytest.raises(
+            ValueError,
+            match=exact("DistributedTE does not support incremental placement"),
+        ):
+            p._place_traced(v)
+    sp = ngc.FlowPolicy(ngc.FlowLedger(one10()), 0, 1, SHORTEST_PATHS)
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        sp._place_traced(-1)
+    assert sp._place_traced(3)[0].delivered == 3
+
+
+def test_operations_and_design_validation():
+    # Place rejected (also 0), forward needs a program, design_demand only
+    # for T1, in its domain, finite; the offer's checks first.
+    p = policy(one10(), 0, 1, 1)
+    # The operation comes before the offer: also for an offer outside its domain (the same offers
+    # raise the offer's error on a model that places).
+    for v in (5, 0, -1, L62, 2**100):
+        with pytest.raises(
+            ValueError,
+            match=exact("DistributedTE does not support incremental placement"),
+        ):
+            p.place(v)
+    sp = ngc.FlowPolicy(ngc.FlowLedger(one10()), 0, 1, SHORTEST_PATHS)
+    for v in (-1, L62, 2**100):
+        with pytest.raises(
+            ValueError,
+            match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+        ):
+            sp.place(v)
+    with pytest.raises(
+        ValueError, match=exact("forward requires an installed program")
+    ):
+        p.forward(5)
+    dom = "design_demand must be an integer in [0, 2^62) or permitted +inf"
+    # 2**63 and -(2**64) overflow int64 in the binding: still the domain's error. One text, with
+    # the class of its cause: a bool is a wrong type, the rest wrong values.
+    for bad, cls in [(v, ValueError) for v in (-1, L62, 2**63, -(2**64), 1.5)] + [
+        (True, TypeError)
+    ]:
+        with pytest.raises((TypeError, ValueError), match=exact(dom)) as error:
+            p.replace(5, design_demand=bad)
+        assert error.type is cls
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        p.replace(-1, design_demand=-1)
+    for call in (
+        lambda: p.replace(5, design_demand=INF),
+        lambda: p.replace(INF),
+        lambda: p.evaluate(INF),
+    ):
+        with pytest.raises(
+            ValueError, match=exact("DistributedTE requires a finite design demand")
+        ):
+            call()
+    ly = policy(one10(), 0, 1, 1, LOSSY)
+    with pytest.raises(
+        ValueError, match=exact("LOSSY forwarding requires a finite offer")
+    ):
+        ly.replace(INF, design_demand=5)
+    g = one10()
+    pin = ngc.ForwardingProgram.from_routes(
+        g, 0, 1, [ngc.RouteDefinition(0, ngc.Path(g, [[0]]))]
+    )
+    for cfg, model in (
+        (SHORTEST_PATHS, "ShortestPaths"),
+        (GLOBAL, "CentralizedTE"),
+        (ngc.FlowPolicyConfig(routing=ngc.Pinned(pin)), "Pinned"),
+    ):
+        q = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg)
+        for call in (q.replace, q.evaluate):
+            with pytest.raises(
+                ValueError, match=exact(f"{model} does not accept design_demand")
+            ):
+                call(5, design_demand=5)
+    assert p.records() == []
+
+
+# ---------------------------------------------------------------- setup (T)
+
+
+def test_tie_breaks():
+    # PARX, N = 2, D = 8.
+    g = graph([(0, 1, 4, 1), (0, 1, 10, 1)])
+    for s, want, held in (
+        (TIE.FEWER_HOPS, [[0], [1]], [4, 4]),
+        (TIE.HIGHER_CAPACITY, [[1], [1]], [0, 8]),
+        (TIE.HIGHER_AVAILABLE_CAPACITY, [[1], [1]], [0, 8]),
+        (TIE.HIGHER_HEADROOM, [[0], [1]], [4, 4]),
+    ):
+        fg = ngc.FlowLedger(g)
+        r = ngc.FlowPolicy(fg, 0, 1, t1_config(2, tie_break=s)).replace(
+            8, design_demand=8
+        )
+        assert (routes(r), fg.reserved().tolist()) == (want, held)
+
+
+def test_tie_break_reads_unreserved():
+    # PVIEW with unreserved [5, 8], N = 1, D = 4.
+    g = graph([(0, 1, 10, 1), (0, 1, 8, 1)])
+    for s, want in (
+        (TIE.FEWER_HOPS, [0]),
+        (TIE.HIGHER_CAPACITY, [0]),
+        (TIE.HIGHER_AVAILABLE_CAPACITY, [1]),
+        (TIE.HIGHER_HEADROOM, [1]),
+    ):
+        fg = ngc.FlowLedger(g, reservation_baseline=[5, 8])
+        r = ngc.FlowPolicy(fg, 0, 1, t1_config(1, tie_break=s)).replace(
+            4, design_demand=4
+        )
+        assert routes(r) == [want]
+
+
+def test_tie_scores_read_unreserved():
+    # PAR(10, 10) with the reservation baseline [3, 8], N = 1, D = 1: equal capacities, so
+    # HIGHER_CAPACITY ties and falls to hops, then the lower EdgeId (e0); the availability is the
+    # unreserved bandwidth: HIGHER_AVAILABLE_CAPACITY 3 < 8 and HIGHER_HEADROOM 3/10 < 8/10 take
+    # e1. The service view (the full capacities) would tie both.
+    g = graph([(0, 1, 10, 1), (0, 1, 10, 1)])
+    for tie, want in (
+        (TIE.FEWER_HOPS, [0]),
+        (TIE.HIGHER_CAPACITY, [0]),
+        (TIE.HIGHER_AVAILABLE_CAPACITY, [1]),
+        (TIE.HIGHER_HEADROOM, [1]),
+    ):
+        fg = ngc.FlowLedger(g, reservation_baseline=[3, 8])
+        r = ngc.FlowPolicy(fg, 0, 1, t1_config(1, tie_break=tie)).replace(
+            1, design_demand=1
+        )
+        assert routes(r) == [want], tie
+
+
+def test_filter_before_collapse_and_min_unreserved():
+    # The filter before the collapse.
+    g = graph([(0, 1, 2, 1), (0, 1, 10, 1)])
+    for parallel_edges in (False, True):
+        r = ngc.FlowPolicy(
+            ngc.FlowLedger(g), 0, 1, t1_config(1, parallel_edges=parallel_edges)
+        ).replace(6, design_demand=6)
+        assert (routes(r), statuses(r)) == ([[1]], [UP])
+    # PARC, N = 2, D = 2, minimum 5 and 0.
+    parc = graph([(0, 1, 4, 1), (0, 1, 10, 2)])
+    for minimum, path, held, bound in ((5, [1], [0, 2], 10), (0, [0], [2, 0], 4)):
+        fg = ngc.FlowLedger(parc)
+        r = policy(parc, 0, 1, 2, ledger=fg, min_unreserved_bandwidth=minimum).replace(
+            INF, design_demand=2
+        )
+        assert (routes(r), fg.reserved().tolist(), r.call_delivered) == (
+            [path, path],
+            held,
+            bound,
+        )
+    # ZL with minimum 1.
+    zl = graph([(0, 1, 0, 1), (0, 1, 10, 2)])
+    fg = ngc.FlowLedger(zl)
+    r = policy(zl, 0, 1, 2, LOSSY, ledger=fg, min_unreserved_bandwidth=1).replace(
+        2, design_demand=1
+    )
+    assert (requests(r), routes(r), fg.reserved().tolist(), r.call_delivered) == (
+        [1, 0],
+        [[1], [1]],
+        [0, 1],
+        2,
+    )
+
+
+def test_other_owners_holds():
+    g = one10()
+    fg = ngc.FlowLedger(g)
+    a = policy(g, 0, 1, 1, ledger=fg)
+    b = policy(g, 0, 1, 1, LOSSY, ledger=fg)
+    assert statuses(a.replace(6, design_demand=6)) == [UP]
+    assert (fg.reserved().tolist(), fg.unreserved().tolist()) == ([6], [4])
+    down = b.replace(6, design_demand=6)
+    assert (statuses(down), down.call_source_drops) == ([NB], 6)
+    a.remove()
+    assert statuses(b.replace(6, design_demand=6)) == [UP]
+    assert fg.reserved().tolist() == [6]
+
+
+def test_holds_do_not_queue():
+    # Setup reads unreserved 10, forwarding the residual 0.
+    g = one10()
+    fg = ngc.FlowLedger(g)
+    c = ngc.FlowPolicy(
+        fg,
+        0,
+        1,
+        ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=LOSSY),
+    )
+    assert c.replace(10).call_delivered == 10
+    r = policy(g, 0, 1, 1, LOSSY, ledger=fg).replace(4, design_demand=4)
+    assert (
+        statuses(r),
+        fg.reserved().tolist(),
+        r.call_edge_drops,
+        r.call_delivered,
+    ) == (
+        [UP],
+        [4],
+        [(0, 4)],
+        0,
+    )
+
+
+def test_replace_evaluate_and_zero():
+    fg = ngc.FlowLedger(one10())
+    p = policy(None, 0, 1, 1, ledger=fg)
+    p.replace(6, design_demand=6)
+    first = p.records()[0].flow_id
+    r = p.replace(6, design_demand=6)
+    assert (statuses(r), fg.reserved().tolist()) == ([UP], [6])
+    assert not (r.routes_changed or r.weights_changed or r.reservations_changed)
+    assert p.records()[0].flow_id != first
+    state = ledger_now(fg)
+    e = p.evaluate(3, design_demand=8, outputs=HOLDS)
+    assert (
+        statuses(e),
+        requests(e),
+        e.program.tunnels[0].reserved_bandwidth,
+        e.plan.total_reserved_bandwidth,
+    ) == ([UP], [8], 8, 8)
+    assert (e.edge_reservations.tolist(), e.call_delivered) == ([8], 3)
+    assert ledger_now(fg) == state
+    fg2 = ngc.FlowLedger(one10())
+    q = policy(None, 0, 1, 2, ledger=fg2)
+    z = q.replace(0)
+    assert (
+        statuses(z),
+        requests(z),
+        fg2.reserved().tolist(),
+        z.termination,
+        z.call_delivered,
+    ) == (
+        [UP, UP],
+        [0, 0],
+        [0],
+        T.COMPLETE,
+        0,
+    )
+    z12 = q.replace(0, design_demand=12)
+    assert (requests(z12), statuses(z12), fg2.reserved().tolist()) == (
+        [6, 6],
+        [UP, NB],
+        [6],
+    )
+
+
+def test_infinite_offer_masked_source_and_empty_roster():
+    r = policy(par612(), 0, 1, 4).replace(INF, design_demand=12)
+    assert (
+        r.call_delivered,
+        r.call_undelivered,
+        r.requested,
+        r.unadmitted,
+        r.termination,
+    ) == (
+        12,
+        INF,
+        INF,
+        None,
+        T.EXHAUSTED,
+    )
+    g = twoh(10, 10)
+    r = policy(
+        g, [0, 1], 2, 2, LOSSY, eligibility=g.eligibility(excluded_nodes=[0])
+    ).replace(10, design_demand=10)
+    assert (requests(r), r.plan.design_by_head) == ([5, 5], ((1, 10),))
+    assert source_rows(r) == [(0, 0, 0, 0, 0, 0), (1, 10, 10, 10, 0, 0)]
+    # EMPTY.
+    empty = build(3, [(1, 2, 5, 1)])
+    p = policy(empty, 0, 2, 2, LOSSY)
+    r = p.replace(5, design_demand=5)
+    assert (
+        r.termination,
+        r.program.sources,
+        r.program.destinations,
+        r.program.tunnels,
+    ) == (
+        T.NO_ROUTE,
+        (0,),
+        (2,),
+        (),
+    )
+    assert (
+        r.plan.tunnels_per_head,
+        r.plan.design_demand,
+        r.plan.design_by_head,
+        r.plan.total_reserved_bandwidth,
+    ) == (2, 5, (), 0)
+    assert (r.call_source_drops, source_rows(r)) == (5, [(0, 0, 0, 0, 0, 0)])
+    for z in (
+        p.replace(0, design_demand=5),
+        p.evaluate(0, design_demand=5),
+        p.forward(0),
+    ):
+        assert (z.termination, z.program.tunnels) == (T.COMPLETE, ())
+    assert p.records() == []
+
+
+def test_all_down_and_round_order():
+    # Every tunnel down (design 14 asks 7 per tunnel, no path has 7); the round order.
+    for offer in (5, 14):
+        r = policy(diam5(), 0, 3, 2, LOSSY).replace(offer, design_demand=14)
+        assert (statuses(r), r.call_source_drops, r.call_delivered, r.termination) == (
+            [NB, NB],
+            offer,
+            0,
+            T.COMPLETE,
+        )
+        s = policy(diam5(), 0, 3, 2).replace(offer, design_demand=14)
+        assert (s.call_delivered, s.termination) == (0, T.EXHAUSTED)
+    r = policy(twoh(10, 10), [0, 1], 2, 2).replace(10, design_demand=10)
+    assert requests(r) == [3, 3, 2, 2]
+    assert [(t.entry_id, t.head, t.local_index) for t in r.program.tunnels] == [
+        (0, 0, 0),
+        (1, 1, 0),
+        (2, 0, 1),
+        (3, 1, 1),
+    ]
+    assert_ints(t.local_index for t in r.program.tunnels)
+
+
+def test_by_tunnel_and_stretch():
+    r = policy(par612(), 0, 1, 4, LOSSY).replace(13, design_demand=12)
+    assert rows(r) == [
+        (0, 0, UP, 4, 4, 0),
+        (1, 0, UP, 3, 2, 1),
+        (2, 0, UP, 3, 3, 0),
+        (3, 0, UP, 3, 3, 0),
+    ]
+    assert (r.call_edge_drops, r.call_delivered) == ([(0, 1)], 12)
+    # The pool baseline; the largest numerator compares exactly.
+    for f, second in ((2, CC), (2**63 - 1, UP)):
+        r = policy(x8(), [0, 1], 2, 1, LOSSY, cost_ceiling=ngc.CostStretch(f)).replace(
+            4, design_demand=4
+        )
+        assert statuses(r) == [NB, second]
+
+
+def test_flags():
+    p = policy(diam5(), 0, 3, 2)
+    a = p.replace(8, design_demand=8)
+    b = p.replace(10, design_demand=10)
+    f = p.forward(10)
+    assert (a.routes_changed, a.weights_changed, a.reservations_changed) == (
+        True,
+        True,
+        True,
+    )
+    assert (b.routes_changed, b.weights_changed, b.reservations_changed) == (
+        True,
+        True,
+        True,
+    )
+    assert (f.routes_changed, f.weights_changed, f.reservations_changed) == (False,) * 3
+    d = policy(diam5(), 0, 3, 2, LOSSY).replace(5, design_demand=14)
+    assert (d.routes_changed, d.weights_changed, d.reservations_changed) == (
+        True,
+        False,
+        True,
+    )
+    # Equal requests, changed holds: two links of 4, N = 2, D = 8. Another owner's hold of 1 on
+    # e0 leaves tunnel 1 down (reserved 4, 0); once it leaves, both come up (reserved 4, 4).
+    g = graph([(0, 1, 4, 1), (0, 1, 4, 1)])
+    fg = ngc.FlowLedger(g)
+    other = policy(None, 0, 1, 1, ledger=fg)
+    other.replace(1, design_demand=1)
+    mine = policy(None, 0, 1, 2, ledger=fg)
+    held = mine.replace(8, design_demand=8)
+    other.remove()
+    freed = mine.replace(8, design_demand=8)
+    assert (statuses(held), statuses(freed)) == ([UP, NB], [UP, UP])
+    assert [t.reserved_bandwidth for t in held.program.tunnels] == [4, 0]
+    assert requests(held) == requests(freed) == [4, 4]
+    assert freed.reservations_changed
+
+
+def test_pinned_over_a_t1_program_reserves_nothing():
+    # Pinned forwards an imported T1 program and books no holds: its first evaluate, replace
+    # and place report no reservation change, the program keeps the imported requests and holds
+    # as data, and the ledger and the records hold nothing. Also for an all-down program whose
+    # requests are positive (a request of 20 on one link of 10).
+    g = one10()
+    up = policy(g, 0, 1, 1).replace(0, design_demand=6).program
+    down = policy(g, 0, 1, 1).replace(0, design_demand=20).program
+    assert [
+        (t.status, t.requested_bandwidth, t.reserved_bandwidth) for t in up.tunnels
+    ] == [(UP, 6, 6)]
+    assert [
+        (t.status, t.requested_bandwidth, t.reserved_bandwidth) for t in down.tunnels
+    ] == [(NB, 20, 0)]
+    for prog in (up, down):
+        for op in ("evaluate", "replace", "place"):
+            fg = ngc.FlowLedger(g)
+            p = pinned(g, prog, 0, 1, LOSSLESS, ledger=fg)
+            r = getattr(p, op)(1)
+            assert not r.reservations_changed, (prog.tunnels[0].status, op)
+            assert r.plan is None
+            assert [
+                (t.requested_bandwidth, t.reserved_bandwidth) for t in r.program.tunnels
+            ] == [(t.requested_bandwidth, t.reserved_bandwidth) for t in prog.tunnels]
+            assert fg.reserved().tolist() == [0]
+            assert all(rec.edge_reservations == [] for rec in p.records())
+
+
+# ---------------------------------------------------------------- records, rows, terminations (F)
+
+
+def test_rows():
+    # The TWOH call's policy's rows and records; forward recreates the records with their holds.
+    p = policy(twoh(2, 10), [0, 1], 2, 2, LOSSY)
+    r = p.replace(12, design_demand=12)
+    assert rows(r) == [
+        (0, 0, NB, 0, 0, 0),
+        (1, 1, UP, 3, 3, 0),
+        (2, 0, NB, 0, 0, 0),
+        (3, 1, UP, 3, 3, 0),
+    ]
+    assert source_rows(r) == [(0, 6, 6, 0, 6, 0), (1, 6, 6, 6, 0, 0)]
+    assert_ints(t.head for t in r.by_tunnel)
+    recs = p.records()
+    assert [rec.entry_id for rec in recs] == [0, 1, 2, 3]
+    assert_ints(rec.entry_id for rec in recs)
+    assert [rec.min_route_cost for rec in recs] == [None, 1, None, 1]
+    assert [len(rec.route.via_edges()) for rec in recs] == [0, 1, 0, 1]
+    ids = [rec.flow_id for rec in recs]
+    f = p.forward(8)
+    assert not (f.routes_changed or f.weights_changed or f.reservations_changed)
+    after = p.records()
+    assert [rec.edge_reservations for rec in after] == [
+        rec.edge_reservations for rec in recs
+    ]
+    assert all(a.flow_id != b for a, b in zip(after, ids, strict=True))
+
+
+def test_terminations():
+    # Zero offer, Lossy finite, Lossless full and partial, unlimited; a zero-weight route.
+    p = policy(one10(), 0, 1, 1)
+    assert p.replace(0, design_demand=5).termination == T.COMPLETE
+    assert p.replace(10, design_demand=10).termination == T.COMPLETE
+    assert p.replace(11, design_demand=10).termination == T.EXHAUSTED
+    assert p.replace(INF, design_demand=10).termination == T.EXHAUSTED
+    assert (
+        policy(one10(), 0, 1, 1, LOSSY).replace(11, design_demand=10).termination
+        == T.COMPLETE
+    )
+    g = one10()
+    prog = ngc.ForwardingProgram.from_routes(
+        g, 0, 1, [ngc.RouteDefinition(0, ngc.Path(g, [[0]]), weight=0)]
+    )
+    for adm in (LOSSLESS, LOSSY):
+        z = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            0,
+            1,
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(prog), admission=adm),
+        )
+        assert z.replace(4).termination == T.NO_ACTIVE_WEIGHT
+
+
+def test_no_certificates_and_plan_only_for_t1():
+    g = twoh(2, 10)
+    r = policy(g, [0, 1], 2, 2).replace(
+        INF, design_demand=12, outputs=ngc.OutputOptions(min_cut=True)
+    )
+    assert (r.total_cost, r.min_cut, r.marginal_cost_curve) == (None, None, None)
+    assert isinstance(r.plan, ngc.TunnelPlan)
+    pin = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        [0, 1],
+        2,
+        ngc.FlowPolicyConfig(routing=ngc.Pinned(r.program)),
+    )
+    assert pin.replace(12).plan is None
+    for cfg in (SHORTEST_PATHS, GLOBAL):
+        q = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg)
+        assert q.place(5).plan is None and q.replace(5).plan is None
+    with pytest.raises(TypeError):
+        ngc.TunnelPlan()
+
+
+# ---------------------------------------------------------------- programs (P)
+
+
+def test_the_exact_int_check_rejects_floats_and_bools():
+    # The controls of assert_ints: a float or a bool equal to the int fails, None only when
+    # optional.
+    assert_ints([0, 3, 2**70])
+    assert_ints([None, 1], optional=True)
+    for bad in ([1.0], [True], [None]):
+        with pytest.raises(AssertionError):
+            assert_ints(bad)
+
+
+def test_program_fields():
+    r = policy(twoh(2, 10), [0, 1], 2, 2, LOSSY).replace(12, design_demand=12)
+    got = [
+        (
+            t.entry_id,
+            t.head,
+            t.local_index,
+            t.status,
+            t.requested_bandwidth,
+            t.reserved_bandwidth,
+            t.weight,
+            t.destination,
+            t.edges,
+            t.path_cost,
+        )
+        for t in r.program.tunnels
+    ]
+    assert got == [
+        (0, 0, 0, NB, 3, 0, 0, None, None, None),
+        (1, 1, 0, UP, 3, 3, 1, 2, (1,), 1),
+        (2, 0, 1, NB, 3, 0, 0, None, None, None),
+        (3, 1, 1, UP, 3, 3, 1, 2, (1,), 1),
+    ]
+    assert (r.program.sources, r.program.destinations, r.program.source_weights) == (
+        (0, 1),
+        (2,),
+        None,
+    )
+    # Two-hop tunnels end at the destination: DIAM5, N = 2, D = 10 (requests 5, 5; e2 of 4 is
+    # filtered out): tunnel 0 takes e0 e3, tunnel 1 e1 e4, both cost 4, both to node 3.
+    two = policy(diam5(), 0, 3, 2).replace(10, design_demand=10)
+    assert [(t.edges, t.destination, t.path_cost) for t in two.program.tunnels] == [
+        ((0, 3), 3, 4),
+        ((1, 4), 3, 4),
+    ]
+    g = twoh(2, 10)
+    for t in (
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, GLOBAL).place(12).program.tunnels
+    ):
+        assert (t.status, t.requested_bandwidth, t.reserved_bandwidth) == (UP, 0, 0)
+        assert t.destination == 2 and t.edges is not None and t.path_cost is not None
+    supplied = ngc.ForwardingProgram.from_routes(
+        g, [0, 1], 2, [ngc.RouteDefinition(0, ngc.Path(g, [[0]]))]
+    )
+    assert [
+        (t.status, t.requested_bandwidth, t.reserved_bandwidth, t.destination)
+        for t in supplied.tunnels
+    ] == [(UP, 0, 0, 2)]
+
+
+def pinned(
+    g, prog, s, d, admission=LOSSY, eligibility=None, black_holes=None, ledger=None
+):
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.Pinned(prog, black_holes=black_holes), admission=admission
+    )
+    ledger = ledger if ledger is not None else ngc.FlowLedger(g)
+    return ngc.FlowPolicy(ledger, s, d, cfg, eligibility)
+
+
+def test_t1_replay_stale_and_down_tunnels():
+    g = par612()
+    prog = policy(g, 0, 1, 4, LOSSY).replace(13, design_demand=12).program
+    mask = g.eligibility(excluded_edges=[0])
+    r = pinned(g, prog, 0, 1, eligibility=mask).replace(13)
+    assert rows(r) == [
+        (0, 0, FAILED, 0, 0, 0),
+        (1, 0, FAILED, 0, 0, 0),
+        (2, 0, UP, 7, 3, 4),
+        (3, 0, UP, 6, 3, 3),
+    ]
+    assert (r.call_delivered, r.call_edge_drops) == (6, [(1, 7)])
+    assert (
+        pinned(g, prog, 0, 1, LOSSLESS, eligibility=mask).replace(13).call_delivered
+        == 6
+    )
+    # Node 2 a black hole; the live forward the same, holds kept.
+    g = diam5()
+    fg = ngc.FlowLedger(g)
+    p = policy(g, 0, 3, 2, LOSSY, ledger=fg)
+    prog = p.replace(10, design_demand=10).program
+    dark = g.eligibility(excluded_nodes=[2])
+    r = pinned(g, prog, 0, 3, black_holes=dark).replace(10)
+    assert rows(r) == [(0, 0, UP, 5, 5, 0), (1, 0, BLACKHOLED, 5, 0, 5)]
+    assert (r.call_edge_drops, r.call_delivered) == ([(1, 5)], 5)
+    assert (
+        pinned(g, prog, 0, 3, LOSSLESS, black_holes=dark).replace(10).call_delivered
+        == 1
+    )
+    held = fg.reserved().tolist()
+    f = p.forward(10, black_holes=dark)
+    assert (rows(f), f.call_delivered, fg.reserved().tolist()) == (rows(r), 5, held)
+    assert [t.status for t in p.program.tunnels] == [UP, UP]
+    g = twoh(2, 10)
+    live = policy(g, [0, 1], 2, 2, LOSSY).replace(12, design_demand=12)
+    pin = pinned(g, live.program, [0, 1], 2)
+    r = pin.replace(12)
+    assert (r.call_delivered, r.call_source_drops, rows(r), r.plan, r.termination) == (
+        6,
+        6,
+        rows(live),
+        None,
+        T.COMPLETE,
+    )
+    # The replay roster comes from the topology basis: head 0 keeps its share and loses it.
+    rg = graph([(0, 2, 10, 1), (0, 3, 10, 5), (1, 2, 10, 1), (3, 2, 10, 5)])
+    prog = policy(rg, [0, 1], 2, 1, LOSSY).replace(10, design_demand=10).program
+    x = pinned(
+        rg, prog, [0, 1], 2, eligibility=rg.eligibility(excluded_edges=[0])
+    ).replace(10)
+    assert (x.call_delivered, x.call_source_drops, x.termination) == (5, 5, T.COMPLETE)
+    assert source_rows(x) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 5, 0, 0)]
+
+
+# ---------------------------------------------------------------- evaluators (Q)
+
+
+def q(cfg, **kw):
+    return ngc.EvaluationOptions(cfg, **kw)
+
+
+def test_capacity():
+    g = par612()
+    assert (
+        ngc.evaluate_demand(g, 0, 1, q(t1_config(4), design_demand=12)).call_delivered
+        == 12
+    )
+    r = ngc.evaluate_demand(g, 0, 1, q(t1_config(4, LOSSY), design_demand=12, offer=13))
+    assert (r.call_delivered, r.call_edge_drops, r.plan.total_reserved_bandwidth) == (
+        12,
+        [(0, 1)],
+        12,
+    )
+    for opts, text in (
+        (q(t1_config(4)), "DistributedTE evaluation requires design_demand"),
+        (q(t1_config(4, LOSSY)), "DistributedTE evaluation requires design_demand"),
+        (
+            q(t1_config(4), design_demand=INF),
+            "DistributedTE requires a finite design demand",
+        ),
+        (
+            q(t1_config(4, LOSSY), design_demand=12),
+            "DistributedTE LOSSY evaluation requires a finite offer",
+        ),
+        (
+            q(t1_config(4, LOSSY), design_demand=12, offer=INF),
+            "offer must be an integer in [0, 2^62)",
+        ),
+        (
+            q(SHORTEST_PATHS, design_demand=5),
+            "ShortestPaths does not accept design_demand",
+        ),
+        (q(GLOBAL, design_demand=5), "CentralizedTE does not accept design_demand"),
+    ):
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.evaluate_demand(g, 0, 1, opts)
+    # Lossless with a finite offer: the tunnels' delivery up to it.
+    r5 = ngc.evaluate_demand(g, 0, 1, q(t1_config(4), design_demand=12, offer=5))
+    assert r5.call_delivered == 5
+    # The design is kept as given and checked by the evaluator.
+    assert q(t1_config(4), design_demand=-1).design_demand == -1
+    with pytest.raises(
+        ValueError,
+        match=exact("design_demand must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        ngc.evaluate_demand(g, 0, 1, q(t1_config(4), design_demand=-1))
+    assert q(t1_config(4), design_demand=INF).design_demand == INF
+    assert (
+        q(t1_config(4), design_demand=7).design_demand == 7
+        and q(SHORTEST_PATHS).design_demand is None
+    )
+    prog = ngc.ForwardingProgram.from_routes(
+        g, 0, 1, [ngc.RouteDefinition(0, ngc.Path(g, [[0]]))]
+    )
+    with pytest.raises(ValueError, match=exact("Pinned does not accept design_demand")):
+        ngc.evaluate_demand(
+            g, 0, 1, q(ngc.FlowPolicyConfig(routing=ngc.Pinned(prog)), design_demand=5)
+        )
+    rs = ngc.evaluate_pairs(one10(), [(0, 1), (0, 1)], q(t1_config(1), design_demand=6))
+    assert [r.call_delivered for r in rs] == [10, 10]
+
+
+def test_edge_failures():
+    # X8, design 4: the bound is 0 (head 0's tunnel is down and its head keeps a share);
+    # deleting the zero-capacity e0 drops head 0, so the bound rises by 8; deleting e1 loses 0.
+    s = ngc.evaluate_edge_failures(x8(), [0, 1], 2, q(t1_config(1), design_demand=4))
+    assert (
+        s.baseline.call_delivered,
+        [(e.edge, e.delivery_reduction) for e in s.entries],
+    ) == (
+        0,
+        [(0, -8), (1, 0)],
+    )
+    g = graph([(0, 1, 6, 1), (0, 1, 6, 2), (2, 0, 5, 1)])
+    s = ngc.evaluate_edge_failures(g, 0, 1, q(t1_config(4), design_demand=12))
+    assert [(e.edge, e.delivery_reduction) for e in s.entries] == [
+        (0, 6),
+        (1, 6),
+        (2, 0),
+    ]
+    zero = q(t1_config(1, LOSSY), design_demand=4, offer=0)
+    r = ngc.evaluate_demand(x8(), [0, 1], 2, zero)
+    assert (r.termination, r.call_delivered) == (T.COMPLETE, 0)
+    assert all(
+        e.delivery_reduction == 0
+        for e in ngc.evaluate_edge_failures(x8(), [0, 1], 2, zero).entries
+    )
+    # Everything masked.
+    gm = x8()
+    masked = q(
+        t1_config(1), design_demand=4, eligibility=gm.eligibility(excluded_edges=[0, 1])
+    )
+    r = ngc.evaluate_demand(gm, [0, 1], 2, masked)
+    assert (r.termination, r.call_delivered) == (T.NO_ROUTE, 0)
+    assert [x.termination for x in ngc.evaluate_pairs(gm, [([0, 1], 2)], masked)] == [
+        T.NO_ROUTE
+    ]
+
+
+# ---------------------------------------------------------------- multipath is a bool (M)
+
+
+def test_multipath_is_a_bool_and_the_pooled_rule():
+    # None is no multipath value (it was the model's natural shape before); the pooled
+    # single-path rule fires on multipath=False with a HIGHER_* tie_break only.
+    with pytest.raises(TypeError):
+        ngc.SpfOptions(ngc.Direction.FORWARD, multipath=None)
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(multipath=None)
+    g = twoh(10, 10)
+
+    def pooled(routing):
+        cfg = ngc.FlowPolicyConfig(routing=routing)
+        return ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, cfg)
+
+    pooled(ngc.ShortestPaths(tie_break=TIE.HIGHER_CAPACITY, parallel_edges=False))
+    pooled(ngc.ShortestPaths(multipath=False))
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS"
+            " when multipath=False"
+        ),
+    ):
+        pooled(ngc.ShortestPaths(tie_break=TIE.HIGHER_CAPACITY, multipath=False))
+
+
+# ---------------------------------------------------------------- numeric ranges (W)
+
+
+def test_ranges():
+    # ONEMAX.
+    m = L62 - 1
+    g = graph([(0, 1, m, 1)])
+    fg = ngc.FlowLedger(g)
+    r = policy(g, 0, 1, 1, LOSSY, ledger=fg).replace(m, design_demand=m)
+    assert (
+        statuses(r),
+        r.plan.total_reserved_bandwidth,
+        fg.reserved().tolist(),
+        fg.unreserved().tolist(),
+        r.call_delivered,
+    ) == (
+        [UP],
+        m,
+        [m],
+        [0],
+        m,
+    )
+    assert policy(g, 0, 1, 1).replace(INF, design_demand=m).call_delivered == m
+    fg = ngc.FlowLedger(g)
+    half = 1 << 61
+    assert statuses(
+        policy(g, 0, 1, 1, ledger=fg).replace(half, design_demand=half)
+    ) == [UP]
+    assert statuses(
+        policy(g, 0, 1, 1, ledger=fg).replace(half, design_demand=half)
+    ) == [NB]
+    assert fg.unreserved().tolist() == [half - 1]
+    # FAN4MAX with N = 10000: 40000 tunnels, all up, the design carried whole.
+    cap = (1 << 60) - 1
+    g = graph([(i, 4, cap, 1) for i in range(4)])
+    fg = ngc.FlowLedger(g)
+    D = L62 - 4
+    r = policy(g, [0, 1, 2, 3], 4, 10000, ledger=fg).replace(D, design_demand=D)
+    reqs = [t.requested_bandwidth for t in r.program.tunnels]
+    assert len(reqs) == 40000 and all(t.status == UP for t in r.program.tunnels)
+    assert (reqs.count(115292150460685), reqs.count(115292150460684)) == (
+        4 * 6975,
+        4 * 3025,
+    )
+    assert (
+        sum(reqs),
+        r.plan.total_reserved_bandwidth,
+        fg.reserved().tolist(),
+        r.call_delivered,
+    ) == (
+        D,
+        D,
+        [cap] * 4,
+        D,
+    )
+
+
+# ---------------------------------------------------------------- zero offers and masks (E)
+
+
+def test_zero_and_masked():
+    for adm in (LOSSLESS, LOSSY):
+        fg = ngc.FlowLedger(twoh(2, 10))
+        p = policy(None, [0, 1], 2, 2, adm, ledger=fg)
+        r = p.replace(0, design_demand=12)
+        assert (
+            r.termination,
+            r.call_delivered,
+            statuses(r),
+            fg.reserved().tolist(),
+        ) == (
+            T.COMPLETE,
+            0,
+            [NB, UP, NB, UP],
+            [0, 6],
+        )
+        assert [(rec.entry_id, rec.delivered) for rec in p.records()] == [
+            (0, 0),
+            (1, 0),
+            (2, 0),
+            (3, 0),
+        ]
+        state = ledger_now(fg)
+        assert (
+            p.evaluate(0, design_demand=12).termination == T.COMPLETE
+            and ledger_now(fg) == state
+        )
+        f = p.forward(0)
+        assert (
+            f.termination,
+            f.program is r.program or f.program.tunnels == r.program.tunnels,
+        ) == (T.COMPLETE, True)
+        assert not (f.routes_changed or f.weights_changed or f.reservations_changed)
+        assert fg.reserved().tolist() == [0, 6]
+        d = policy(diam5(), 0, 3, 2, adm)
+        assert d.replace(0, design_demand=14).termination == T.COMPLETE
+        assert d.replace(5, design_demand=14).termination == (
+            T.COMPLETE if adm == LOSSY else T.EXHAUSTED
+        )
+        assert [rec.entry_id for rec in d.records()] == [0, 1]
+        assert d.forward(0).termination == T.COMPLETE
+        g = twoh(10, 10)
+        e = policy(
+            g, [0, 1], 2, 2, adm, eligibility=g.eligibility(excluded_edges=[0, 1])
+        )
+        assert e.replace(5, design_demand=5).termination == T.NO_ROUTE
+        assert (
+            e.replace(0, design_demand=5).termination == T.COMPLETE
+            and e.records() == []
+        )
+        # Pinned over the TWOH call's program.
+        g = twoh(2, 10)
+        prog = policy(g, [0, 1], 2, 2, LOSSY).replace(12, design_demand=12).program
+        x = pinned(
+            g, prog, [0, 1], 2, adm, eligibility=g.eligibility(excluded_edges=[1])
+        )
+        r = x.replace(12)
+        assert r.termination == T.NO_ACTIVE_WEIGHT
+        assert [t.status for t in r.by_tunnel] == [NB, FAILED, NB, FAILED]
+        if adm == LOSSY:
+            assert source_rows(r) == [(0, 12, 12, 0, 12, 0), (1, 0, 0, 0, 0, 0)]
+        assert x.replace(0).termination == T.COMPLETE
+        assert [rec.entry_id for rec in x.records()] == [0, 1, 2, 3]
+        y = pinned(
+            g, prog, [0, 1], 2, adm, eligibility=g.eligibility(excluded_nodes=[0, 1])
+        )
+        assert (
+            y.replace(12).termination,
+            y.replace(0).termination,
+            len(y.records()),
+        ) == (T.NO_ROUTE, T.COMPLETE, 4)
+
+
+# ---------------------------------------------------------------- the property against the oracle
+
+
+def _random_case(rng):
+    """A small random graph with a route from 0 to the last node: rows (u, v, capacity, cost)."""
+    n = rng.randint(3, 6)
+    raw = [
+        (i, i + 1, rng.choice([0, 2, 4, 6, 8]), rng.randint(1, 4)) for i in range(n - 1)
+    ]
+    for _ in range(rng.randint(1, 7)):
+        u, v = rng.randrange(n - 1), rng.randrange(1, n)
+        if u != v:
+            raw.append((u, v, rng.choice([0, 1, 2, 3, 4, 6, 8]), rng.randint(1, 4)))
+    rng.shuffle(raw)
+    return n, raw
+
+
+def test_property():
+    rng = random.Random(20261018)
+    setups = lossless = lossy_cmp = all_up = 0
+    for trial in range(400):
+        n, rows_ = _random_case(rng)
+        if not rows_:
+            continue
+        g = build(n, rows_)
+        # The oracle's edges in EdgeId order (the graph's own order of the input rows).
+        edges = [rows_[int(i)] for i in g.input_positions()]
+        sources = sorted(rng.sample(range(n - 1), rng.randint(1, min(2, n - 1))))
+        dests = [n - 1]
+        mask = None
+        eligibility = None
+        if rng.random() < 0.3:
+            xe = [rng.randrange(len(rows_))]
+            mask = ([], xe)
+            eligibility = g.eligibility(excluded_edges=xe)
+        caps = [c for _, _, c, _ in edges]
+        unres = [rng.randint(0, c) for c in caps] if rng.random() < 0.4 else list(caps)
+        resid = [rng.randint(0, c) for c in caps] if rng.random() < 0.4 else list(caps)
+        fg = ngc.FlowLedger(g, resid, reservation_baseline=unres)
+        held = [0] * len(rows_)
+        if rng.random() < 0.3 and sources:
+            other = ngc.FlowPolicy(fg, sources[:1], dests, t1_config(1))
+            other.replace(0, design_demand=rng.randint(0, 4))
+            held = fg.reserved().tolist()
+        php = rng.random() < 0.5
+        prio = rng.choice(["CAPACITY", "AVAILABLE_CAPACITY", "HEADROOM"])
+        me = rng.random() < 0.7
+        tie = f"HIGHER_{prio}" if php else "FEWER_HOPS"
+        s = {"tie_break": getattr(TIE, tie), "parallel_edges": me}
+        minimum = rng.choice([0, 0, 1, 2])
+        ceiling = rng.choice(
+            [
+                None,
+                None,
+                ("abs", rng.randint(1, 6)),
+                ("str", rng.choice([1.0, 1.2, 1.5, 2.0])),
+            ]
+        )
+        kw = {"min_unreserved_bandwidth": minimum}
+        okw = {"minimum": minimum}
+        if ceiling and ceiling[0] == "abs":
+            kw["cost_ceiling"], okw["absolute"] = (
+                ngc.AbsoluteCost(ceiling[1]),
+                ceiling[1],
+            )
+        elif ceiling:
+            kw["cost_ceiling"], okw["stretch"] = ngc.CostStretch(ceiling[1]), ceiling[1]
+        N = rng.randint(1, 3)
+        D = rng.randint(0, 12)
+        want = orc.setup(
+            edges,
+            sources,
+            dests,
+            D,
+            N,
+            sel=orc.Selection(tie, me),
+            mask=mask,
+            unreserved=fg.unreserved().tolist(),
+            held=None,
+            service=fg.residual().tolist(),
+            **okw,
+        )
+        before_holds = fg.reserved().tolist()
+        V = fg.residual().tolist()
+        p = ngc.FlowPolicy(fg, sources, dests, t1_config(N, **s, **kw), eligibility)
+        r = p.replace(INF, design_demand=D)
+        where = (trial, rows_, sources, D, N, s, kw)
+        got = [
+            (t.status.name, list(t.edges or []), t.requested_bandwidth)
+            for t in r.program.tunnels
+        ]
+        assert got == [(t.status, t.path or [], t.requested) for t in want.tunnels], (
+            where
+        )
+        setups += 1
+        # Every up path passed its filter; holds = the up requests; within R0.
+        assert [
+            a - b for a, b in zip(fg.reserved().tolist(), before_holds, strict=True)
+        ] == want.holds, where
+        assert all(
+            x <= u for x, u in zip(fg.reserved().tolist(), unres, strict=True)
+        ), where
+        # The program's lossless bound on the service view.
+        if want.roster:
+            assert r.call_delivered == orc.lossless_bound(
+                edges, want.roster, want.tunnels, V
+            ), where
+            lossless += 1
+        # Every tunnel up and U <= V: the design is carried losslessly.
+        U = [u - h for u, h in zip(unres, held, strict=True)]
+        if (
+            want.roster
+            and all(t.up for t in want.tunnels)
+            and all(a <= b for a, b in zip(U, V, strict=True))
+        ):
+            assert p.replace(D, design_demand=D).call_delivered == D, where
+            all_up += 1
+        # Lossy: the oracle's loss rule, conservation and the setup independent of the offer.
+        offer = rng.randint(0, 14)
+        # The same setup view: the other owner's holds taken out of the reservation baseline.
+        seen = [u - h for u, h in zip(unres, held, strict=True)]
+        lp = ngc.FlowPolicy(
+            ngc.FlowLedger(g, resid, reservation_baseline=seen),
+            sources,
+            dests,
+            t1_config(N, LOSSY, **s, **kw),
+            eligibility,
+        )
+        lr = lp.replace(offer, design_demand=D)
+        assert [(t.status.name, list(t.edges or [])) for t in lr.program.tunnels] == [
+            (a, b) for a, b, _ in got
+        ], where
+        assert (
+            lr.offered
+            == lr.source_drops + sum(x for _, x in lr.edge_drops) + lr.delivered
+        ), where
+        assert (
+            lr.offered == sum(row.offered for row in lr.by_source) or not want.roster
+        ), where
+        if want.roster:
+            try:
+                delivered, lost, per, _ = orc.lossy(
+                    edges, want.roster, want.tunnels, offer, V
+                )
+            except AssertionError:
+                continue
+            assert (lr.call_delivered, lr.call_source_drops) == (delivered, lost), where
+            assert [
+                (t.assigned, t.delivered, t.total_edge_drops) for t in lr.by_tunnel
+            ] == per, where
+            lossy_cmp += 1
+    # Not vacuous.
+    assert setups > 300 and lossless > 250 and lossy_cmp > 200 and all_up > 20, (
+        setups,
+        lossless,
+        lossy_cmp,
+        all_up,
+    )
+
+
+# ---------------------------------------------------------------- Python allocation failures
+
+
+@needs_hooks
+@pytest.mark.parametrize("method", ["replace", "evaluate", "forward"])
+def test_t1_results_survive_python_allocation_failures(method):
+    # Every Python object of a T1 result (the plan, tunnels with None fields, edge_reservations)
+    # exists before anything is published. The calls are positional (the design is the offer):
+    # pybind11's parsing of a call that passes keywords does not check its allocations, so a
+    # keyword call may crash there (limit 1 of the module docstring).
+    g = twoh(2, 10)
+
+    def make():
+        fg = ngc.FlowLedger(g)
+        p = ngc.FlowPolicy(fg, [0, 1], 2, t1_config(2, LOSSY))
+        p.replace(4, design_demand=12)
+
+        def snapshot():
+            return [full_ledger_state(fg), repr(p._state())]
+
+        return getattr(p, method), (8,), snapshot
+
+    assert (
+        sweep_python_allocation(make) >= 1
+    )  # the result object at least (its fields convert when read)
+
+
+GETTER_SWEEP = """
+import _netgraph_core as ext, netgraph_core as ngc
+g = ngc.Graph(3, [0, 1], [2, 2], [2, 10], [1, 1], 1.0)
+fg = ngc.FlowLedger(g)
+cfg = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=ngc.Admission.LOSSY)
+p = ngc.FlowPolicy(fg, [0, 1], 2, cfg)
+r = p.replace(12, design_demand=12)
+fid = p.records()[0].flow_id
+ca = cfg.routing
+t0 = r.program.tunnels[0]
+abs3 = ngc.DistributedTE(ngc.TunnelCount(2), cost_ceiling=ngc.AbsoluteCost(3))
+st2 = ngc.DistributedTE(ngc.TunnelCount(2), cost_ceiling=ngc.CostStretch(2.0))
+sp = ngc.ShortestPaths(tie_break=ngc.RouteTieBreak.HIGHER_HEADROOM, multipath=False)
+fn = lambda: {getter}
+expected = repr(fn())  # the getter reads its value first: a missing name fails here
+for k in range(400):
+    hit, seen, value, error = ext._fail_python_allocation(fn, (), k)
+    if not hit:
+        assert error is None and repr(value) == expected, (k, error, value)
+        break
+    assert value is None and type(error) is MemoryError, (k, error)
+else:
+    raise SystemExit("never completed")
+print("failures", k)
+"""
+
+
+@needs_hooks
+@pytest.mark.parametrize(
+    "getter",
+    [
+        "r.program.tunnels",
+        "fg.reserved()",
+        "fg.unreserved()",
+        "r.plan",
+        "r.plan.design_by_head",
+        "ca.tunnel_count",
+        "t0.status",
+        # A repr is called on the type: repr() on Python 3.13 and older returns the default repr
+        # when its method lookup fails.
+        "type(abs3).__repr__(abs3)",
+        "type(st2).__repr__(st2)",
+        "st2.cost_ceiling.factor",
+        "st2.cost_ceiling",
+        "cfg.routing",
+        "type(r).__repr__(r)",
+        "type(sp).__repr__(sp)",
+        "p.records()",
+        "p.record(fid)",
+        "fg.records()",
+        "fg.record(fid)",
+    ],
+)
+def test_t1_getters_survive_python_allocation_failures(getter):
+    # Each getter's sweep runs in its own process: a crash fails the test instead of the run.
+    import subprocess
+    import sys
+
+    done = subprocess.run(
+        [sys.executable, "-c", GETTER_SWEEP.format(getter=getter)],
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    assert done.returncode == 0, (getter, done.returncode, done.stderr[-400:])
+    assert int(done.stdout.split()[-1]) >= 1
+
+
+# ---------------------------------------------------------------- the exact stretch (S)
+
+
+def test_stretch_exact():
+    # A-X8-Stretch-exact / -cost7: links of costs 5 (capacity 0) and 6 or 7, D = 1, N = 1. c0 = 5
+    # counts the zero-capacity link; 1.2 is exactly 6/5, so cost 6 is admitted at equality (up on
+    # e1, 1 delivered, Lossless bound 1) and cost 7 is not (the share lost at the source).
+    for cost, status, route, delivered in ((6, UP, [1], 1), (7, CC, [], 0)):
+        g = graph([(0, 1, 0, 5), (0, 1, 1, cost)])
+        factor = 1.2 if cost == 6 else Fraction(6, 5)
+        lossy = policy(g, 0, 1, 1, LOSSY, cost_ceiling=ngc.CostStretch(factor))
+        r = lossy.replace(1, design_demand=1)
+        assert (statuses(r), routes(r)) == ([status], [route]), cost
+        assert (r.call_delivered, r.call_source_drops) == (delivered, 1 - delivered), (
+            cost
+        )
+        lossless = policy(g, 0, 1, 1, cost_ceiling=ngc.CostStretch(factor))
+        assert lossless.replace(INF, design_demand=1).call_delivered == delivered, cost
+
+
+def test_stretch_below_one():
+    # T1-stretch-below-one: 1/2 is refused where the policy checks the ceiling (after the tunnel
+    # count); the lowest numerator too.
+    g = graph([(0, 1, 10, 5)])
+    for factor, shown in ((Fraction(1, 2), "1/2"), (-(2**63), f"{-(2**63)}/1")):
+        text = f"cost_ceiling CostStretch factor must be >= 1 (got {shown})"
+        with pytest.raises(ValueError, match=exact(text)):
+            policy(g, 0, 1, 1, cost_ceiling=ngc.CostStretch(factor))
+    with pytest.raises(ValueError, match=exact("tunnel count must be in [1, 10000]")):
+        policy(g, 0, 1, 0, cost_ceiling=ngc.CostStretch(0.5))
+
+
+def test_stretch_wide_products():
+    # BIG(2^60): links 0 -> 1 of capacity 1 and costs 2^60 and 2^60 + 1, D = 2, N = 2: tunnel 0
+    # (request 1) is up on e0; tunnel 1 finds e0 full and e1 at cost 2^60 + 1: up with
+    # (2^60 + 1) / 2^60 (equality), COST_CEILING_EXCEEDED with (2^61 + 1) / 2^61.
+    c0 = 2**60
+    g = graph([(0, 1, 1, c0), (0, 1, 1, c0 + 1)])
+    for factor, second in (
+        (Fraction(2**60 + 1, 2**60), UP),
+        (Fraction(2**61 + 1, 2**61), CC),
+    ):
+        r = policy(g, 0, 1, 2, cost_ceiling=ngc.CostStretch(factor)).replace(
+            INF, design_demand=2
+        )
+        assert statuses(r) == [UP, second], factor
diff --git a/tests/py/test_docs_examples.py b/tests/py/test_docs_examples.py
new file mode 100644
index 0000000..825f2a2
--- /dev/null
+++ b/tests/py/test_docs_examples.py
@@ -0,0 +1,199 @@
+"""The documented examples print what the documents show (CONTRIBUTING, "Behaviour
+Documentation"): every Python example of docs/semantics.md, run in order in one namespace as the
+document says, against the ``text`` block that follows it (an example without one prints
+nothing), and README's quick start against the output written in the comment of each print."""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import re
+import traceback
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+FENCE = re.compile(r"^```(\w*)\n(.*?)^```$", re.S | re.M)
+
+
+def blocks(text: str) -> list[tuple[int, str, str, int, int]]:
+    """(line, language, body, start, end) of every fenced block, in document order."""
+    found = list(FENCE.finditer(text))
+    # A different Markdown closing fence may end a block before the parser's closing line.
+    assert not any(
+        re.search(r"^ {0,3}`{3,}[ \t]*$", m.group(2), re.M) for m in found
+    ), "unsupported closing fence inside a parsed block"
+    # A fence marker outside the parsed blocks uses an unsupported form or has no closing
+    # fence. Other markers inside a block are contents an example may print literally.
+    assert all(
+        any(m.start() <= fence.start() < m.end() for m in found)
+        for fence in re.finditer(r"^[ \t]*(?:`{3,}|~{3,}).*$", text, re.M)
+    ), "only unindented triple-backtick fences with a bare language are supported"
+    return [
+        (text.count("\n", 0, m.start()) + 1, m.group(1), m.group(2), m.start(), m.end())
+        for m in found
+    ]
+
+
+def run(code: str, name: str, namespace: dict) -> str:
+    out = io.StringIO()
+    with contextlib.redirect_stdout(out):
+        exec(compile(code, name, "exec"), namespace)
+    return out.getvalue()
+
+
+def check_examples(text: str, name: str) -> tuple[int, int]:
+    """Runs every Python example of a document in order in one namespace and compares what each
+    prints with the ``text`` block directly after it (an example without one prints nothing).
+    Returns (the examples, the documented outputs compared); a structural defect or a
+    mismatch fails an assertion."""
+    found = blocks(text)
+    # Only Python examples and their outputs, each output directly after an example: a fence of
+    # another language (a typo such as ```py) would otherwise leave an example unchecked.
+    assert {lang for _, lang, *_ in found} <= {"python", "text"}
+    for i, (line, lang, _, start, _) in enumerate(found):
+        if lang == "text":
+            prev = found[i - 1] if i else None
+            assert prev is not None and prev[1] == "python", (
+                f"line {line}: output of no example"
+            )
+            assert text[prev[4] : start].strip() == "", (
+                f"line {line}: text between example and output"
+            )
+    examples = [b for b in found if b[1] == "python"]
+    assert examples
+
+    namespace: dict = {}
+    mismatches = []
+    outputs = 0  # documented outputs compared with what their example printed
+    for i, (line, lang, code, _, end) in enumerate(found):
+        if lang != "python":
+            continue
+        nxt = found[i + 1] if i + 1 < len(found) else None
+        expected = (
+            nxt[2]
+            if nxt and nxt[1] == "text" and text[end : nxt[3]].strip() == ""
+            else ""
+        )
+        got = run(code, f"{name}:{line}", namespace)
+        outputs += expected != ""
+        if got != expected:
+            mismatches.append(
+                f"line {line}:\n--- documented\n{expected}--- printed\n{got}"
+            )
+    assert not mismatches, "\n".join(mismatches)
+    assert outputs == sum(lang == "text" for _, lang, *_ in found) > 0
+    return len(examples), outputs
+
+
+def check_quick_start(text: str) -> int:
+    """Runs README's quick start (the first fenced block after its heading, a Python block) and
+    compares every line it prints with the comment of its print. Returns the prints compared."""
+    heading = text.index("\n## Quick Start\n")
+    line, lang, code, *_ = next(b for b in blocks(text) if b[3] > heading)
+    assert lang == "python", f"README.md:{line}: the quick start is not a Python block"
+    prints = [ln for ln in code.splitlines() if ln.startswith("print(")]
+    expected = [re.fullmatch(r"print\(.*\)\s+# (.*)", ln) for ln in prints]
+    assert prints and all(expected), (
+        f"README.md:{line}: a print without its output comment"
+    )
+    got = run(code, f"README.md:{line}", {}).splitlines()
+    assert got == [m.group(1) for m in expected if m]
+    return len(prints)
+
+
+def test_semantics_examples_print_their_documented_output():
+    text = (ROOT / "docs" / "semantics.md").read_text(encoding="utf-8")
+    check_examples(text, "docs/semantics.md")
+
+
+def test_readme_quick_start_prints_its_commented_output():
+    text = (ROOT / "README.md").read_text(encoding="utf-8")
+    assert check_quick_start(text) > 0
+
+
+GOOD = "```python\nx = 2\nprint(x)\n```\n\n```text\n2\n```\n\nProse.\n\n```python\ny = x\n```\n"
+
+
+def test_the_checks_reject_a_broken_document():
+    # The checkers pass a well-formed document and fail each defect they exist for, each at its
+    # own clause (the failing source line), so a deleted clause is noticed even when a later
+    # clause would also fail.
+    assert check_examples(GOOD, "good") == (2, 1)
+    literal = "```python\nprint('~~~python\\n  ```python')\n```\n\n```text\n~~~python\n  ```python\n```\n"
+    assert check_examples(literal, "literal markers") == (1, 1)
+    count = 'assert outputs == sum(lang == "text" for _, lang, *_ in found) > 0'
+    mismatch = 'assert not mismatches, "\\n".join(mismatches)'
+    broken = {
+        "a changed output": (GOOD.replace("```text\n2\n", "```text\n3\n"), mismatch),
+        "an unseen indented example": (
+            GOOD + "\n  ```python\n  print(999)\n  ```\n",
+            "assert all(",
+        ),
+        "an unseen tilde example": (
+            GOOD + "\n~~~python\nprint(999)\n~~~\n",
+            "assert all(",
+        ),
+        "an unseen longer fence": (
+            GOOD + "\n````python\nprint(999)\n````\n",
+            "assert all(",
+        ),
+        "an unseen fence with extra information": (
+            GOOD + "\n```python title\nprint(999)\n```\n",
+            "assert all(",
+        ),
+        "an unseen unclosed fence": (
+            GOOD + "\n```python\nprint(999)\n",
+            "assert all(",
+        ),
+        "another fence language": (
+            GOOD.replace("```python\ny", "```py\ny"),
+            'assert {lang for _, lang, *_ in found} <= {"python", "text"}',
+        ),
+        "an output of no example": (
+            "```text\n2\n```\n\n" + GOOD,
+            'assert prev is not None and prev[1] == "python", (',
+        ),
+        "prose between an example and its output": (
+            GOOD + "\n```python\nz = 1\n```\nProse.\n```text\n1\n```\n",
+            'assert text[prev[4] : start].strip() == "", (',
+        ),
+        "an example that prints without an output": (
+            GOOD.replace("y = x", "print(x)"),
+            mismatch,
+        ),
+        "no example": ("Prose only.\n", "assert examples"),
+        "an empty output block": ("```python\nx = 1\n```\n\n```text\n```\n", count),
+        "no documented output": ("```python\nx = 1\n```\n", count),
+    }
+    for close in ("  ```", "````", "``` "):
+        printed = "2\n" + close + "\n~~~python\nprint(999)\n~~~"
+        broken[f"an unseen example after {close!r}"] = (
+            GOOD.replace("print(x)", f"print({printed!r})").replace(
+                "```text\n2\n```", "```text\n" + printed + "\n```"
+            ),
+            "assert not any(",
+        )
+    for what, (text, clause) in broken.items():
+        with pytest.raises(AssertionError) as info:
+            check_examples(text, what)
+        assert traceback.extract_tb(info.tb)[-1].line == clause, what
+    quick = "# Title\n\n## Quick Start\n\n```python\nprint(1 + 1)  # 2\n```\n"
+    assert check_quick_start(quick) == 1
+    commented = "assert prints and all(expected), ("
+    for text, clause in (
+        (
+            quick.replace("# 2", "# 3"),  # a wrong output comment
+            "assert got == [m.group(1) for m in expected if m]",
+        ),
+        (quick.replace("  # 2", ""), commented),  # a print without its comment
+        (quick.replace("print(1 + 1)  # 2", "x = 1"), commented),  # no print at all
+        (
+            quick.replace("```python", "```bash"),  # the quick start not a Python block
+            'assert lang == "python", f"README.md:{line}: the quick start is not a Python block"',
+        ),
+    ):
+        with pytest.raises(AssertionError) as info:
+            check_quick_start(text)
+        assert traceback.extract_tb(info.tb)[-1].line == clause, text
diff --git a/tests/py/test_edge_amounts.py b/tests/py/test_edge_amounts.py
new file mode 100644
index 0000000..674daae
--- /dev/null
+++ b/tests/py/test_edge_amounts.py
@@ -0,0 +1,204 @@
+"""The per-edge amount arrays at the binding: a ledger's baseline (at
+construction and reset), a search's residual (the public search and its K shortest paths) and
+the flow core's view (the private _solve_min_cost_flow) share one validation of the unnarrowed Python integers: the length first,
+then every entry in EdgeId order, the first one outside [0, edge_capacity_units[e]] reported with its
+exact value. Each user keeps its own names: ``residual`` / ``residual (units)`` and ``view`` /
+``view (capacity units)``.
+"""
+
+from __future__ import annotations
+
+import _netgraph_core as ext
+import numpy as np
+import pytest
+from helpers import GLOBAL, build, exact, ledger_state
+
+import netgraph_core as ngc
+
+
+def graph():
+    # EdgeIds 0: 0->1 (capacity 5), 1: 1->2 (capacity 3)
+    return build(3, [(0, 1, 5, 1), (1, 2, 3, 1)])
+
+
+# Each user: (name, label, call(graph, amounts, later_defect)). With later_defect the call also
+# carries an argument checked after the amounts, which must not be the error reported.
+def ledger(g, a, later):
+    return ngc.FlowLedger(g, a)
+
+
+def reset(g, a, later):
+    fg = ngc.FlowLedger(g, [4, 2])
+    fg.reset(a)
+    return fg
+
+
+def search(g, a, later):
+    opts = ngc.SpfOptions(
+        ngc.Direction.FORWARD, residual=a, min_residual=0 if later else 1
+    )
+    return ngc.spf(g, 0, opts)
+
+
+def paths(g, a, later):
+    eligibility = graph().eligibility() if later else None  # a foreign Eligibility
+    return ngc.ksp(g, 0, 2, ngc.KspOptions(1, residual=a, eligibility=eligibility))
+
+
+def view(g, a, later):
+    return ext._solve_min_cost_flow(g, a, [9] if later else [0], [2], None, None)
+
+
+USERS = {
+    "ledger": ("service_baseline", "service_baseline (units)", ledger),
+    "reset": ("service_baseline", "service_baseline (units)", reset),
+    "search": ("residual", "residual (units)", search),
+    "paths": ("residual", "residual (units)", paths),
+    "view": ("view", "view (capacity units)", view),
+}
+
+# (amounts, later defect, the class, the message with {name} and {label}). A shape (an array's
+# rank, a nested entry, a non-sequence) or an entry of a wrong type is a TypeError, a length or a
+# value outside its range a ValueError.
+T, V = TypeError, ValueError
+CASES = [
+    # the length (the shape step) before any entry is read
+    ([1.5], False, V, "{name} has length 1, expected 2 (one entry per edge)"),
+    ([1, 1, 1], False, V, "{name} has length 3, expected 2 (one entry per edge)"),
+    (
+        np.zeros((1, 2), dtype=np.int64),
+        False,
+        T,
+        "{name} must be a 1-D array (got 2 dimensions)",
+    ),
+    (
+        [5, [1]],
+        False,
+        T,
+        "{name} must be a 1-D sequence of integers (entry 1 is a sequence)",
+    ),
+    ("ab", False, T, "{name} must be a 1-D sequence of integers (got str)"),
+    # the entries' types, all of them before any value
+    ([1, 2.5], False, T, "{label}[1] must be an integer (got float)"),
+    ([True, 0], False, T, "{label}[0] must be an integer (got bool)"),
+    ([6, 2.5], False, T, "{label}[1] must be an integer (got float)"),
+    (
+        np.array([1.0, 2.0]),
+        False,
+        T,
+        "{label} entries must be integers (got dtype float64)",
+    ),
+    # the values: the first entry outside, exact also beyond int64
+    ([-1, 99], False, V, "{name}[0] = -1 is outside [0, edge_capacity_units[0] = 5]"),
+    ([5, 4], False, V, "{name}[1] = 4 is outside [0, edge_capacity_units[1] = 3]"),
+    (
+        [5, 2**70],
+        False,
+        V,
+        "{name}[1] = 1180591620717411303424 is outside [0, edge_capacity_units[1] = 3]",
+    ),
+    (
+        [-(2**70), 9],
+        False,
+        V,
+        "{name}[0] = -1180591620717411303424 is outside [0, edge_capacity_units[0] = 5]",
+    ),
+    (
+        np.array([5, 2**64 - 1], dtype=np.uint64),
+        False,
+        V,
+        "{name}[1] = 18446744073709551615 is outside [0, edge_capacity_units[1] = 3]",
+    ),
+    # an amount above its capacity (one above; beyond 64 bits) wins over an argument checked
+    # after the amounts
+    ([6, 0], True, V, "{name}[0] = 6 is outside [0, edge_capacity_units[0] = 5]"),
+    (
+        [5, 2**70],
+        True,
+        V,
+        "{name}[1] = 1180591620717411303424 is outside [0, edge_capacity_units[1] = 3]",
+    ),
+]
+
+
+# No argument of a ledger is checked after its baseline: its users take no later defect.
+PAIRS = [
+    (user, case)
+    for user in sorted(USERS)
+    for case in range(len(CASES))
+    if not (CASES[case][1] and user in ("ledger", "reset"))
+]
+
+
+@pytest.mark.parametrize(("user", "case"), PAIRS)
+def test_every_user_reports_the_same_first_defect(user, case):
+    name, label, call = USERS[user]
+    amounts, later, cls, text = CASES[case]
+    want = text.format(name=name, label=label)
+    with pytest.raises((TypeError, ValueError), match=exact(want)) as error:
+        call(graph(), amounts, later)
+    assert error.type is cls
+
+
+@pytest.mark.parametrize(
+    ("user", "text"),
+    [
+        ("paths", "foreign Eligibility: built for another graph"),
+        ("search", "min_residual must be at least 1 unit (got 0)"),
+        ("view", "sources: node 9 out of node range [0, 3)"),
+    ],
+)
+def test_the_later_defect_alone_is_rejected(user, text):
+    # The later defect of the cases above is a defect of its own: with valid amounts the call
+    # still fails, so those cases test an order.
+    with pytest.raises(ValueError, match=exact(text)):
+        USERS[user][2](graph(), [5, 3], True)
+
+
+# What each user's result shows of the amounts it took, for full amounts (the capacities) and
+# for zero ones: the ledger's residual (its baseline), the search's costs (an edge with 0 units
+# left is not used: its head stays unreached), the number of paths and the flow placed.
+BOUND_OUTCOMES = {
+    "ledger": (lambda r: r.residual().tolist(), [5, 3], [0, 0]),
+    "reset": (lambda r: r.residual().tolist(), [5, 3], [0, 0]),
+    "search": (
+        lambda r: r.costs.tolist(),
+        [0, 1, 2],
+        [0, ngc.UNREACHABLE, ngc.UNREACHABLE],
+    ),
+    "paths": (len, 1, 0),
+    "view": (lambda r: (r["flow_value"], r["edge_flows"]), (3, [3, 3]), (0, [0, 0])),
+}
+
+
+@pytest.mark.parametrize("user", sorted(USERS))
+def test_every_user_accepts_the_bounds(user):
+    _name, _label, call = USERS[user]
+    shown, full, zero = BOUND_OUTCOMES[user]
+    for amounts, want in (
+        ([5, 3], full),
+        ([0, 0], zero),
+        (np.array([5, 3], dtype=np.uint64), full),
+    ):
+        assert shown(call(graph(), amounts, False)) == want, amounts
+
+
+def test_a_failed_reset_leaves_the_ledger_unchanged():
+    g = graph()
+    fg = ngc.FlowLedger(g, [4, 2])
+    policy = ngc.FlowPolicy(fg, 0, 2, GLOBAL)
+    assert policy.place(2).call_delivered == 2
+    del policy  # its records stay as orphans: reset() is allowed and would clear them
+
+    uid, before = fg.uid(), ledger_state(fg)
+    assert before[1] == [2, 2] and len(before[4]) == 1
+    for bad, cls in (([1], V), ([1, 2.5], T), ([6, 0], V), ([4, 2**70], V)):
+        with pytest.raises(cls):
+            fg.reset(bad)
+        assert (fg.uid(), ledger_state(fg)) == (uid, before)
+    fg.reset([1, 1])
+    assert (fg.residual().tolist(), fg.carried().tolist(), fg.records()) == (
+        [1, 1],
+        [0, 0],
+        [],
+    )
diff --git a/tests/py/test_edge_cases.py b/tests/py/test_edge_cases.py
deleted file mode 100644
index a8d5f5f..0000000
--- a/tests/py/test_edge_cases.py
+++ /dev/null
@@ -1,184 +0,0 @@
-"""Edge case and special behavior tests for NetGraph-Core.
-
-This module tests:
-- Unsafe API usage patterns that lack runtime guards
-- Edge cases in EqualBalanced min-flow gating with parallel edges
-- Exact integer distance calculations (int64) for large cost values
-
-Note: Object lifetime tests are in test_lifetime_safety.py
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-def test_eb_min_flow_gating_does_not_prune_valid_parallel_edges(algs):
-    """EB path gating: do not prune paths where per-edge residual < min_flow but group supports it."""
-    # Graph: 0->1 cap 1.2; 1->2 has two parallel edges cap 0.6 each; all costs=1
-    src = np.array([0, 1, 1], dtype=np.int32)
-    dst = np.array([1, 2, 2], dtype=np.int32)
-    cap = np.array([1.2, 0.6, 0.6], dtype=np.float64)
-    cost = np.array([1, 1, 1], dtype=np.int64)
-    g = _make_graph(3, src, dst, cap, cost)
-    fg = ngc.FlowGraph(g)
-    sel = ngc.EdgeSelection(
-        multi_edge=True, require_capacity=True, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-    )
-    # Use EqualBalanced with max_flow_count=1 so per_target == requested volume
-    cfg = ngc.FlowPolicyConfig(
-        path_alg=ngc.PathAlg.SPF,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        selection=sel,
-        min_flow_count=1,
-        max_flow_count=1,
-        shortest_path=True,
-    )
-    policy = ngc.FlowPolicy(algs, algs.build_graph(g), cfg)
-    placed, leftover = policy.place_demand(fg, 0, 2, 0, 1.0)
-    # Should place 1.0 (group capacity min(0.6)*2 = 1.2 supports it)
-    assert placed >= 1.0 - 1e-9
-
-
-def test_spf_distance_dtype_int64_exact(algs):
-    """Distances should support dtype='int64' to avoid float rounding for large sums."""
-    # Build a chain 0->1->2 with very large costs that are not exactly representable in float64.
-    big = np.int64(2**53 + 1)  # not exactly representable in float64
-    src = np.array([0, 1], dtype=np.int32)
-    dst = np.array([1, 2], dtype=np.int32)
-    cap = np.array([1.0, 1.0], dtype=np.float64)
-    cost = np.array([big, big], dtype=np.int64)
-    g = _make_graph(3, src, dst, cap, cost)
-    try:
-        dist_i64, _ = algs.spf(algs.build_graph(g), 0, 2, dtype="int64")
-    except TypeError:
-        pytest.skip("Algorithms.spf does not support dtype= argument yet")
-    else:
-        dist_i64 = np.asarray(dist_i64)
-        assert dist_i64.dtype == np.int64
-        assert int(dist_i64[2]) == int(big + big)
-
-
-def test_ksp_distance_dtype_int64_exact(algs):
-    """KSP distances should support dtype='int64' to avoid float rounding."""
-    big = np.int64(2**53 + 1)
-    src = np.array([0, 1], dtype=np.int32)
-    dst = np.array([1, 2], dtype=np.int32)
-    cap = np.array([1.0, 1.0], dtype=np.float64)
-    cost = np.array([big, big], dtype=np.int64)
-    g = _make_graph(3, src, dst, cap, cost)
-    try:
-        items = algs.ksp(algs.build_graph(g), 0, 2, k=1, dtype="int64")
-    except TypeError:
-        pytest.skip("Algorithms.ksp does not support dtype= argument yet")
-    else:
-        assert len(items) >= 1
-        dist_i64, _ = items[0]
-        dist_i64 = np.asarray(dist_i64)
-        assert dist_i64.dtype == np.int64
-        assert int(dist_i64[2]) == int(big + big)
-
-
-def test_max_flow_zero_capacity_on_shortest_path_equal_balanced(algs, to_handle):
-    """EqualBalanced with require_capacity=False returns 0 when shortest path has no capacity.
-
-    With require_capacity=False (true IP/IGP semantics), routing is cost-only.
-    If the shortest path has a zero-capacity edge, no flow can be placed.
-
-    Topology:
-        Shortest path: 0->1->2 (cost 2, but 0->1 has cap=0)
-        Longer path:   0->3->2 (cost 4, cap=100)
-    """
-    src = np.array([0, 1, 0, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 2], dtype=np.int32)
-    cap = np.array(
-        [0.0, 10.0, 100.0, 100.0], dtype=np.float64
-    )  # 0->1 has zero capacity
-    cost = np.array([1, 1, 2, 2], dtype=np.int64)
-    g = _make_graph(4, src, dst, cap, cost)
-
-    # Test with EqualBalanced + require_capacity=False + shortest_path=True
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=True,
-        require_capacity=False,
-        with_edge_flows=True,
-    )
-
-    # Should return 0 because the shortest path (cost 2) has no capacity
-    assert np.isclose(total, 0.0), (
-        f"Expected 0 flow when shortest path has zero capacity, got {total}"
-    )
-
-    # Verify no edge flows were placed
-    edge_flows = np.asarray(summary.edge_flows)
-    assert np.allclose(edge_flows, 0.0), f"Expected no edge flows, got {edge_flows}"
-
-
-def test_max_flow_zero_capacity_on_shortest_path_proportional(algs, to_handle):
-    """Proportional with require_capacity=False returns 0 when shortest path has no capacity.
-
-    With require_capacity=False, if the shortest path has a zero-capacity edge,
-    no flow can be placed. Both placements behave consistently.
-    """
-    src = np.array([0, 1, 0, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 2], dtype=np.int32)
-    cap = np.array([0.0, 10.0, 100.0, 100.0], dtype=np.float64)
-    cost = np.array([1, 1, 2, 2], dtype=np.int64)
-    g = _make_graph(4, src, dst, cap, cost)
-
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-        require_capacity=False,
-        with_edge_flows=True,
-    )
-
-    assert np.isclose(total, 0.0), (
-        f"Expected 0 flow when shortest path has zero capacity, got {total}"
-    )
-
-
-def test_max_flow_require_capacity_true_finds_alternative(algs, to_handle):
-    """With require_capacity=True, max_flow should find an alternative path with capacity.
-
-    This is the contrast test: when require_capacity=True, the algorithm should
-    skip the zero-capacity edge and find the longer path that has capacity.
-    """
-    src = np.array([0, 1, 0, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 2], dtype=np.int32)
-    cap = np.array([0.0, 10.0, 100.0, 100.0], dtype=np.float64)
-    cost = np.array([1, 1, 2, 2], dtype=np.int64)
-    g = _make_graph(4, src, dst, cap, cost)
-
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=True,
-        require_capacity=True,  # This should skip zero-capacity edges
-        with_edge_flows=True,
-    )
-
-    # Should find the longer path 0->3->2 and place 100 flow
-    assert np.isclose(total, 100.0), (
-        f"Expected 100 flow via alternative path, got {total}"
-    )
diff --git a/tests/py/test_epoch_static.py b/tests/py/test_epoch_static.py
new file mode 100644
index 0000000..8d498e2
--- /dev/null
+++ b/tests/py/test_epoch_static.py
@@ -0,0 +1,160 @@
+"""Static epoch preparation is reused as a value, without retaining mutable epochs."""
+
+import itertools
+
+import numpy as np
+import pytest
+from helpers import ALL_OUT, build, dag_of, plain
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+
+def cases():
+    for pooled, allocation, tie, multipath, parallel, lossy in itertools.product(
+        (False, True),
+        ("equal", "capacity", "explicit"),
+        ("FEWER_HOPS", "HIGHER_CAPACITY"),
+        (False, True),
+        (False, True),
+        (False, True),
+    ):
+        if tie == "HIGHER_CAPACITY" and (
+            (multipath and parallel) or (pooled and not multipath)
+        ):
+            continue
+        yield pooled, allocation, tie, multipath, parallel, lossy
+
+
+def fixture(pooled, allocation, tie, multipath, parallel, lossy):
+    g = build(
+        6,
+        [
+            (0, 2, 20, 1),
+            (1, 2, 20, 1),
+            (2, 3, 4, 1),
+            (2, 3, 10, 1),
+            (2, 4, 20, 1),
+            (3, 5, 20, 1),
+            (4, 5, 20, 1),
+        ],
+    )
+    kw = dict(
+        tie_break=getattr(ngc.RouteTieBreak, tie),
+        multipath=multipath,
+        parallel_edges=parallel,
+    )
+    if allocation != "equal":
+        kw.update(allocation=ngc.RouteAllocation.WEIGHTED)
+        if allocation == "capacity":
+            kw.update(weight_basis=ngc.WeightBasis.CAPACITY)
+        else:
+            kw.update(
+                weight_basis=ngc.WeightBasis.EXPLICIT,
+                edge_weights=np.arange(7, dtype=np.int64) % 3,
+            )
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(**kw),
+        admission=ngc.Admission.LOSSY if lossy else ngc.Admission.LOSSLESS,
+    )
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger, [0, 1] if pooled else [0], 5, cfg)
+    return g, ledger, p
+
+
+@pytest.mark.parametrize("case", list(cases()))
+def test_static_identity_all_preparation_points_and_unchanged_values(case):
+    g, ledger, p = fixture(*case)
+    assert p.evaluate(0).program is not None
+    assert p.program is None and not p.records()
+    assert p.place(0).program is None
+    first = p.place(6, ALL_OUT)
+    before_ids = [r.flow_id for r in p.records()]
+    assert p.evaluate(6, outputs=ALL_OUT).program is first.program
+    assert [r.flow_id for r in p.records()] == before_ids
+    p.remove()
+    assert p.program is None
+    assert p.place(0).program is None
+    with pytest.raises(ValueError, match="forward requires an installed program"):
+        p.forward(1)
+    second = p.place(6, ALL_OUT)
+    assert second.program is first.program
+    assert plain(second) == plain(first)
+    assert all(r.flow_id[1] > before_ids[-1][1] for r in p.records())
+    replaced = p.replace(6, outputs=ALL_OUT)
+    assert replaced.program is first.program
+    assert not replaced.routes_changed and not replaced.weights_changed
+    p.remove()
+    ordered = ngc.apply_actions(ledger, [ngc.Place(p, 6)], outputs=ALL_OUT)[0]
+    assert ordered.program is first.program and plain(ordered) == plain(first)
+    ordered = ngc.apply_actions(ledger, [ngc.Replace(p, 6)], outputs=ALL_OUT)[0]
+    assert ordered.program is first.program and plain(ordered) == plain(replaced)
+    if case[-1]:
+        simultaneous = ngc.apply_actions(
+            ledger,
+            [ngc.Replace(p, 6)],
+            mode=ngc.BatchMode.SIMULTANEOUS,
+            outputs=ALL_OUT,
+        )[0]
+        assert simultaneous.program is first.program
+        assert plain(simultaneous) == plain(replaced)
+    del g  # policy and ledger keep the graph owner
+    p.remove()
+    assert ledger.records() == []
+
+
+@pytest.mark.parametrize("mode", ("available", "headroom", "snapshot", "optimized"))
+def test_excluded_preparation_is_new_and_reads_changed_residual(mode):
+    g = build(2, [(0, 1, 10, 1), (0, 1, 20 if mode == "headroom" else 10, 1)])
+    kw = {}
+    if mode in ("available", "headroom"):
+        kw.update(
+            parallel_edges=False,
+            tie_break=getattr(
+                ngc.RouteTieBreak,
+                "HIGHER_AVAILABLE_CAPACITY"
+                if mode == "available"
+                else "HIGHER_HEADROOM",
+            ),
+        )
+    elif mode == "snapshot":
+        kw.update(
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        )
+    else:
+        kw.update(allocation=ngc.RouteAllocation.OPTIMIZED)
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(
+        ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(**kw))
+    )
+    first = p.place(2)
+    program = ngc.ForwardingProgram.from_routes(
+        g, [0], [1], [ngc.RouteDefinition(0, dag_of(g, [0]))]
+    )
+    other = ngc.FlowPolicy(
+        ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.Pinned(program))
+    )
+    other.place(1 if mode == "headroom" else 8)
+    second = p.replace(1 if mode in ("available", "headroom") else 12)
+    assert second.program is not first.program
+    if mode in ("available", "headroom"):
+        assert list(p.records()[0].route.via_edges()) == [1]
+    else:
+        assert second.delivered == 12
+    p.remove()
+    assert p.place(1).program is not first.program
+
+
+@needs_hooks
+@pytest.mark.parametrize("pooled", (False, True))
+def test_reused_prepare_trace_is_non_null_and_equal_to_fresh(pooled):
+    _, _, p = fixture(pooled, "equal", "FEWER_HOPS", True, True, False)
+    first, trace = p._place_traced(3, ALL_OUT)
+    p.remove()
+    second, repeated = p._place_traced(3, ALL_OUT)
+    assert second.program is first.program
+    assert plain(trace)["prepare"] is not None
+    assert plain(trace)["prepare"] == plain(repeated)["prepare"]
+    _, increment = p._place_traced(1, ALL_OUT)
+    assert plain(increment)["prepare"] is None
diff --git a/tests/py/test_equal_balanced_modes.py b/tests/py/test_equal_balanced_modes.py
deleted file mode 100644
index c186271..0000000
--- a/tests/py/test_equal_balanced_modes.py
+++ /dev/null
@@ -1,218 +0,0 @@
-"""EQUAL_BALANCED and EQUAL_BALANCED_LOSSY placement semantics.
-
-Both model a hop-by-hop forwarding table that does not react to load: the
-split set is every shortest-path edge with capacity. EQUAL_BALANCED admits
-losslessly (a full member blocks admission on that DAG), EQUAL_BALANCED_LOSSY
-forwards best-effort (each member carries what it can and the rest is dropped).
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _graph(src, dst, cap, cost, n):
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes=n,
-        src=np.array(src, dtype=np.int32),
-        dst=np.array(dst, dtype=np.int32),
-        capacity=np.array(cap, dtype=np.float64),
-        cost=np.array(cost, dtype=np.int64),
-        ext_edge_ids=np.arange(len(src), dtype=np.int64),
-    )
-
-
-SEL = ngc.EdgeSelection(
-    multi_edge=True, require_capacity=False, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-)
-
-
-@pytest.fixture
-def pair():
-    """0 -> 1 over two equal-cost parallel edges: edge 0 cap 10, edge 1 cap 100."""
-    g = _graph([0, 0], [1, 1], [10.0, 100.0], [1, 1], 2)
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    handle = algs.build_graph(g)
-    _, dag = algs.spf(
-        handle, src=0, dst=None, selection=SEL, multipath=True, dtype="float64"
-    )
-    return g, algs, handle, dag
-
-
-def test_enum_members():
-    assert set(ngc.FlowPlacement.__members__) == {
-        "PROPORTIONAL",
-        "EQUAL_BALANCED",
-        "EQUAL_BALANCED_LOSSY",
-    }
-
-
-def test_full_member_blocks_admission_on_the_same_dag(pair):
-    g, _, _, dag = pair
-    fg = ngc.FlowGraph(g)
-    assert fg.place(
-        ngc.FlowIndex(0, 1, 0, 0), 0, 1, dag, 20.0, ngc.FlowPlacement.EQUAL_BALANCED
-    ) == pytest.approx(20.0)
-    assert fg.place(
-        ngc.FlowIndex(0, 1, 0, 1), 0, 1, dag, 10.0, ngc.FlowPlacement.EQUAL_BALANCED
-    ) == pytest.approx(0.0)
-    assert fg.edge_flow_view()[1] == pytest.approx(10.0)
-
-
-def test_progress_comes_from_a_residual_aware_dag(pair):
-    g, algs, handle, dag = pair
-    fg = ngc.FlowGraph(g)
-    assert fg.place(
-        ngc.FlowIndex(0, 1, 0, 0), 0, 1, dag, 20.0, ngc.FlowPlacement.EQUAL_BALANCED
-    ) == pytest.approx(20.0)
-    residual = np.ascontiguousarray(fg.residual_view(), dtype=np.float64)
-    _, fresh = algs.spf(
-        handle,
-        src=0,
-        dst=None,
-        selection=SEL,
-        residual=residual,
-        multipath=True,
-        dtype="float64",
-    )
-    assert fg.place(
-        ngc.FlowIndex(0, 1, 0, 1), 0, 1, fresh, 10.0, ngc.FlowPlacement.EQUAL_BALANCED
-    ) == pytest.approx(10.0)
-    assert fg.edge_flow_view()[1] == pytest.approx(20.0)
-
-
-def test_cost_only_max_flow_is_single_pass(pair):
-    """place_max_flow with require_capacity=False never re-places on the stale DAG."""
-    g, _, _, _ = pair
-    fs = ngc.FlowState(g)
-    total = fs.place_max_flow(
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        require_capacity=False,
-    )
-    assert total == pytest.approx(20.0)
-
-
-def test_lossy_delivers_and_reports_drops(pair):
-    g, _, _, dag = pair
-    fg = ngc.FlowGraph(g)
-    placed, drops = fg.place_with_drops(
-        ngc.FlowIndex(0, 1, 0, 0),
-        0,
-        1,
-        dag,
-        100.0,
-        ngc.FlowPlacement.EQUAL_BALANCED_LOSSY,
-    )
-    assert placed == pytest.approx(60.0)
-    assert drops == [(0, pytest.approx(40.0))]
-    assert fg.edge_flow_view().tolist() == pytest.approx([10.0, 50.0])
-    placed2, drops2 = fg.place_with_drops(
-        ngc.FlowIndex(0, 1, 0, 1),
-        0,
-        1,
-        dag,
-        10.0,
-        ngc.FlowPlacement.EQUAL_BALANCED_LOSSY,
-    )
-    assert placed2 == pytest.approx(5.0)
-    assert drops2 == [(0, pytest.approx(5.0))]
-
-
-def test_place_with_drops_is_empty_for_other_modes(pair):
-    g, _, _, dag = pair
-    fg = ngc.FlowGraph(g)
-    placed, drops = fg.place_with_drops(
-        ngc.FlowIndex(0, 1, 0, 0), 0, 1, dag, 100.0, ngc.FlowPlacement.EQUAL_BALANCED
-    )
-    assert placed == pytest.approx(20.0)
-    assert drops == []
-
-
-def test_lossy_ledger_holds_carried_volume_only(pair):
-    g, _, _, dag = pair
-    fg = ngc.FlowGraph(g)
-    idx = ngc.FlowIndex(0, 1, 0, 3)
-    placed, _ = fg.place_with_drops(
-        idx, 0, 1, dag, 100.0, ngc.FlowPlacement.EQUAL_BALANCED_LOSSY
-    )
-    assert sum(a for _, a in fg.get_flow_edges(idx)) == pytest.approx(placed)
-    fg.remove(idx)
-    assert fg.residual_view().tolist() == pytest.approx([10.0, 100.0])
-
-
-def test_cost_only_flow_policy_does_not_reroute_around_saturation():
-    """require_capacity=False must route on cost alone, even with an EB per-flow target.
-
-    A -> B direct (cap 10, cost 1); A -> C -> B (cap 100, cost 5 + 5).
-    """
-    g = _graph([0, 0, 2], [1, 2, 1], [10.0, 100.0, 100.0], [1, 5, 5], 3)
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    handle = algs.build_graph(g)
-
-    cfg = ngc.FlowPolicyConfig()
-    cfg.path_alg = ngc.PathAlg.SPF
-    cfg.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    cfg.selection = SEL
-    cfg.require_capacity = False
-    cfg.shortest_path = True
-    cfg.min_flow_count = 1
-    cfg.max_flow_count = 1
-
-    fg = ngc.FlowGraph(g)
-    _, dag = algs.spf(
-        handle, src=0, dst=None, selection=SEL, multipath=True, dtype="float64"
-    )
-    assert fg.place(
-        ngc.FlowIndex(0, 1, 9, 0), 0, 1, dag, 10.0, ngc.FlowPlacement.EQUAL_BALANCED
-    ) == pytest.approx(10.0)
-
-    policy = ngc.FlowPolicy(algs, handle, cfg)
-    placed, remaining = policy.place_demand(fg, 0, 1, 0, 50.0)
-    assert placed == pytest.approx(0.0), (
-        "cost-only routing must not discover the A->C->B detour"
-    )
-    assert remaining == pytest.approx(50.0)
-    assert all(float(v[2]) == 1.0 for v in policy.flows.values())
-
-
-def test_lossy_static_paths_carry_what_fits_without_equalizing():
-    """Pinned routes under EQUAL_BALANCED_LOSSY: each LSP is offered its share
-    and delivers what fits. A -> B direct cap 10 (edge 0); A -> C -> B cap 100
-    (edges 1, 2). Demand 50 over both routes: 25 offered each, 10 + 25 = 35.
-    """
-    g = _graph([0, 0, 2], [1, 2, 1], [10.0, 100.0, 100.0], [1, 1, 1], 3)
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    handle = algs.build_graph(g)
-    bundles = [ngc.PredDAG.from_edges(g, [0]), ngc.PredDAG.from_edges(g, [1, 2])]
-
-    def policy(placement):
-        cfg = ngc.FlowPolicyConfig()
-        cfg.path_alg = ngc.PathAlg.SPF
-        cfg.flow_placement = placement
-        cfg.selection = SEL
-        cfg.require_capacity = False
-        cfg.min_flow_count = 1
-        cfg.max_flow_count = 2
-        p = ngc.FlowPolicy(algs, handle, cfg)
-        p.set_static_paths(0, 1, bundles)
-        return p
-
-    fg = ngc.FlowGraph(g)
-    placed, remaining = policy(ngc.FlowPlacement.EQUAL_BALANCED_LOSSY).place_demand(
-        fg, 0, 1, 0, 50.0
-    )
-    assert placed == pytest.approx(35.0)
-    assert remaining == pytest.approx(15.0)
-    assert fg.edge_flow_view().tolist() == pytest.approx([10.0, 25.0, 25.0])
-
-    fg = ngc.FlowGraph(g)
-    placed, _ = policy(ngc.FlowPlacement.EQUAL_BALANCED).place_demand(fg, 0, 1, 0, 50.0)
-    assert placed == pytest.approx(20.0, abs=1e-3), (
-        "lossless: equal carried share, bottleneck 10"
-    )
diff --git a/tests/py/test_evaluators.py b/tests/py/test_evaluators.py
new file mode 100644
index 0000000..7fe1c97
--- /dev/null
+++ b/tests/py/test_evaluators.py
@@ -0,0 +1,858 @@
+"""The evaluators' offer (docs/semantics.md, "10. Evaluators"): a finite offer for every model under
+each admission it supports, in all three evaluators; EvaluationOptions keeps its offer and design
+as given and the evaluators check them after the configuration, in the documented order; the
+worked EVAL examples run on the library. PAR(a, b)
+is two parallel links 0 -> 1 of capacities a and b, cost 1."""
+
+from __future__ import annotations
+
+import math
+
+import numpy as np
+import pytest
+from helpers import build, exact, plain
+
+import netgraph_core as ngc
+
+INF = math.inf
+A = ngc.RouteAllocation
+S = ngc.SourceAllocation
+LL = ngc.Admission.LOSSLESS
+LY = ngc.Admission.LOSSY
+T = ngc.Termination
+L62 = 1 << 62
+
+
+@pytest.mark.parametrize("workers", [1, 2, 4])
+@pytest.mark.parametrize("bits", range(32))
+def test_optimized_deletion_shortcuts_keep_complete_results(workers, bits):
+    fixtures = [
+        (
+            5,
+            [(0, 1, 3, 1), (0, 2, 3, 3), (1, 3, 3, 1), (2, 3, 3, 1), (3, 4, 3, 1)],
+            [0],
+            [4],
+            3,
+            9,
+            [(0, 0), (2, 0), (4, 3)],
+        ),
+        (
+            3,
+            [(0, 1, 3, 1), (1, 2, 3, 2), (1, 2, 1, 5)],
+            [0],
+            [2],
+            3,
+            9,
+            [(0, 3), (1, 2)],
+        ),
+        (3, [(0, 1, 2, 1), (1, 2, 2, 3)], [0], [2], 2, 8, [(0, 2), (1, 2)]),
+        (
+            4,
+            [(0, 2, 1, 1), (1, 2, 1, 2), (2, 3, 1, 1)],
+            [0, 1],
+            [3],
+            1,
+            2,
+            [(0, 0), (2, 1)],
+        ),
+        (
+            3,
+            [(0, 1, 3, 1), (1, 0, 1, 7), (1, 1, 1, 9), (1, 2, 3, 2), (1, 2, 1, 5)],
+            [0],
+            [2],
+            3,
+            9,
+            [(0, 3), (3, 2)],
+        ),
+    ]
+    outputs = ngc.OutputOptions(
+        edge_flows=bool(bits & 1),
+        residual=bool(bits & 2),
+        saturated_boundary_edges=bool(bits & 4),
+        min_cut=bool(bits & 8),
+        edge_reservations=bool(bits & 16),
+    )
+    model = ngc.CentralizedTE(source_allocation=S.OPTIMIZED)
+    for n, edges, sources, destinations, value, cost, reductions in fixtures:
+        g = build(n, edges)
+        options = opts(model, outputs=outputs)
+        got = ngc.evaluate_edge_failures(g, sources, destinations, options, workers)
+        baseline = ngc.evaluate_demand(g, sources, destinations, options)
+        assert plain(got.baseline) == plain(baseline)
+        assert (got.baseline.call_delivered, got.baseline.total_cost) == (value, cost)
+        by_input = dict(reductions)
+        expected = [
+            (e, by_input[int(position)])
+            for e, position in enumerate(g.input_positions())
+            if int(position) in by_input
+        ]
+        assert [
+            (entry.edge, entry.delivery_reduction) for entry in got.entries
+        ] == expected
+        for entry in got.entries:
+            without = opts(
+                model,
+                eligibility=g.eligibility(excluded_edges=[entry.edge]),
+                outputs=outputs,
+            )
+            fresh = ngc.evaluate_demand(g, sources, destinations, without)
+            assert entry.delivery_reduction == value - fresh.call_delivered
+            if fresh.edge_flows is not None:
+                caps = list(g.edge_capacity_units())
+                flows = list(fresh.edge_flows)
+                assert all(
+                    0 <= flow <= cap for flow, cap in zip(flows, caps, strict=True)
+                )
+
+
+def test_optimized_deletion_shortcuts_masks_finite_zero_and_wide_cost():
+    model = ngc.CentralizedTE(source_allocation=S.OPTIMIZED)
+    outputs = ngc.OutputOptions(
+        edge_flows=True,
+        residual=True,
+        min_cut=True,
+        saturated_boundary_edges=True,
+        edge_reservations=True,
+    )
+    g = build(3, [(0, 1, 3, 1), (1, 2, 3, 2), (1, 2, 1, 5)])
+    for eligibility in [
+        None,
+        g.eligibility(excluded_edges=[2]),
+        g.eligibility(excluded_nodes=[1]),
+    ]:
+        for offer in [None, 0, 1, 3, 4]:
+            options = opts(model, eligibility=eligibility, outputs=outputs, offer=offer)
+            for workers in [1, 2]:
+                got = ngc.evaluate_edge_failures(g, [0], [2], options, workers)
+                assert plain(got.baseline) == plain(
+                    ngc.evaluate_demand(g, [0], [2], options)
+                )
+                for entry in got.entries:
+                    deleted = g.eligibility(excluded_edges=[entry.edge])
+                    if eligibility is not None:
+                        deleted = ngc.Eligibility.intersect(eligibility, deleted)
+                    fresh = ngc.evaluate_demand(
+                        g, [0], [2], opts(model, eligibility=deleted, offer=offer)
+                    )
+                    assert (
+                        entry.delivery_reduction
+                        == got.baseline.call_delivered - fresh.call_delivered
+                    )
+    amount = (1 << 32) + 1
+    wide = build(2, [(0, 1, amount, amount)])
+    got = ngc.evaluate_edge_failures(wide, 0, 1, opts(model, outputs=outputs), 2)
+    assert got.baseline.total_cost == (1 << 64) + (1 << 33) + 1
+    assert [(e.edge, e.delivery_reduction) for e in got.entries] == [(0, amount)]
+
+
+DOMAIN = "offer must be an integer in [0, 2^62)"
+
+
+def par(a, b):
+    return build(2, [(0, 1, a, 1), (0, 1, b, 1)])
+
+
+def opts(routing, admission=LL, **kw):
+    return ngc.EvaluationOptions(
+        ngc.FlowPolicyConfig(routing=routing, admission=admission), **kw
+    )
+
+
+def demand(g, routing, admission=LL, **kw):
+    return ngc.evaluate_demand(g, 0, 1, opts(routing, admission, **kw))
+
+
+def failures(g, routing, admission=LL, workers=1, **kw):
+    s = ngc.evaluate_edge_failures(g, 0, 1, opts(routing, admission, **kw), workers)
+    return s.baseline.call_delivered, [x.delivery_reduction for x in s.entries]
+
+
+def dte(count=2):
+    return ngc.DistributedTE(ngc.TunnelCount(count))
+
+
+def t2(count=2):
+    return ngc.CentralizedTE(
+        source_allocation=S.EQUAL, tunnel_count=ngc.TunnelCount(count)
+    )
+
+
+def two_paths(g):
+    # The program of two tunnels, one on each link.
+    routes = [ngc.RouteDefinition(0, ngc.Path(g, [[e]])) for e in (0, 1)]
+    return ngc.Pinned(ngc.ForwardingProgram.from_routes(g, 0, 1, routes))
+
+
+# -- construction -----------------------------------------------------------------------------
+
+
+def test_options_construction():
+    # The offer and the design are Units kept as given: a negative, an infinite or a float value
+    # constructs and reads back unchanged (the evaluator checks it); another type is a TypeError.
+    cfg = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    for value in (-1, INF, 4.0, 2**70):
+        assert ngc.EvaluationOptions(cfg, offer=value).offer == value
+    assert ngc.EvaluationOptions(cfg, design_demand=-1).design_demand == -1
+    assert ngc.EvaluationOptions(cfg, offer=np.int64(3)).offer == 3
+    for bad in ("4", True, np.bool_(True), [4]):
+        with pytest.raises(TypeError, match=r"^offer must be an int or a float"):
+            ngc.EvaluationOptions(cfg, offer=bad)
+        with pytest.raises(
+            TypeError, match=r"^design_demand must be an int or a float"
+        ):
+            ngc.EvaluationOptions(cfg, design_demand=bad)
+    with pytest.raises(TypeError):
+        ngc.EvaluationOptions(cfg, offered=4)
+
+
+# -- one model at a time (E1 to E7) ----------------------------------------------------------
+
+
+def test_offer_shortest_paths_lossless():
+    # ECMP on PAR(4, 10): the uncapped bound 8 (each link 4); an offer below it is delivered in
+    # full, above it up to 8; a zero offer delivers nothing.
+    g = par(4, 10)
+    r = demand(g, ngc.ShortestPaths())
+    assert (r.call_delivered, r.requested, r.termination) == (8, INF, T.EXHAUSTED)
+    r = demand(g, ngc.ShortestPaths(), offer=5)
+    assert (r.call_delivered, r.requested, r.call_undelivered, r.termination) == (
+        5,
+        5,
+        0,
+        T.COMPLETE,
+    )
+    r = demand(g, ngc.ShortestPaths(), offer=12)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (8, 4, T.EXHAUSTED)
+    r = demand(g, ngc.ShortestPaths(), offer=0)
+    assert (r.call_delivered, r.termination) == (0, T.COMPLETE)
+
+
+def test_offer_shortest_paths_lossy():
+    # ECMP Lossy on PAR(4, 10): the offer 12 splits 6 and 6, link 0 drops 2. Without an offer,
+    # the first-hop experiment: each first-hop link injects its own free capacity (4 and 10),
+    # offered 14 against requested +inf, nothing dropped.
+    g = par(4, 10)
+    r = demand(g, ngc.ShortestPaths(), LY, offer=12)
+    assert (r.call_delivered, r.call_edge_drops, r.by_source[0].offered) == (
+        10,
+        [(0, 2)],
+        12,
+    )
+    assert r.termination == T.COMPLETE
+    r = demand(g, ngc.ShortestPaths(), LY)
+    assert (r.call_delivered, r.requested, r.by_source[0].offered) == (14, INF, 14)
+    assert r.call_edge_drops == []
+    r = demand(g, ngc.ShortestPaths(), LY, offer=0)
+    assert (r.call_delivered, r.by_source[0].offered) == (0, 0)
+
+
+def test_offer_weighted():
+    # WCMP by capacity on PAR(4, 10): 14 uncapped; the offer 7 splits 2 and 5.
+    g = par(4, 10)
+    wcmp = ngc.ShortestPaths(allocation=A.WEIGHTED)
+    assert demand(g, wcmp).call_delivered == 14
+    r = demand(g, wcmp, offer=7, outputs=ngc.OutputOptions(edge_flows=True))
+    assert r.call_delivered == 7 and r.edge_flows.tolist() == [2, 5]
+
+
+def test_offer_controllers():
+    # The controllers deliver the optimum up to the offer at cost 1 per unit; CentralizedTE's
+    # min_cut exists only when the solve reaches the maximum; LOSSY is refused by the matrix.
+    g = par(4, 10)
+    cut = ngc.OutputOptions(min_cut=True)
+    for model in (
+        ngc.ShortestPaths(allocation=A.OPTIMIZED),
+        ngc.CentralizedTE(source_allocation=S.OPTIMIZED),
+    ):
+        r = demand(g, model, outputs=cut)
+        assert (r.call_delivered, r.total_cost) == (14, 14)
+        assert r.min_cut == ([0, 1] if isinstance(model, ngc.CentralizedTE) else None)
+        r = demand(g, model, offer=5, outputs=cut)
+        assert (r.call_delivered, r.total_cost, r.min_cut) == (5, 5, None)
+        with pytest.raises(ValueError, match="requires admission=LOSSLESS"):
+            demand(g, model, LY, offer=5)
+
+
+def test_offer_distributed():
+    # T1, two tunnels sized for the design 8 (requests 4 and 4: one on each link): Lossless
+    # bound 8, an offer 5 delivered in full; Lossy 12 splits 6 and 6, link 0 drops 2.
+    g = par(4, 10)
+    assert demand(g, dte(), design_demand=8).call_delivered == 8
+    assert demand(g, dte(), design_demand=8, offer=5).call_delivered == 5
+    r = demand(g, dte(), LY, design_demand=8, offer=12)
+    assert [list(t.edges) for t in r.program.tunnels] == [[0], [1]]
+    assert (r.call_delivered, r.call_edge_drops) == (10, [(0, 2)])
+    with pytest.raises(
+        ValueError,
+        match=exact("DistributedTE LOSSY evaluation requires a finite offer"),
+    ):
+        demand(g, dte(), LY, design_demand=8)
+    with pytest.raises(
+        ValueError, match=exact("DistributedTE evaluation requires design_demand")
+    ):
+        demand(g, dte())
+
+
+def test_offer_centralized_tunnels():
+    # T2 on PAR(4, 10), N = 2: without a design U = 5, both tunnels on link 1, the bound 10; an
+    # offer 5 is also the design; Lossy 12 (the design 12, u 5) drops 2 on link 1; Lossy with
+    # the design 4 and no offer forwards 4 (u 2, both tunnels on link 0).
+    g = par(4, 10)
+    r = demand(g, t2())
+    assert (r.call_delivered, r.plan.max_bandwidth_per_tunnel) == (10, 5)
+    assert [list(t.edges) for t in r.program.tunnels] == [[1], [1]]
+    r = demand(g, t2(), offer=5)
+    assert (r.call_delivered, r.plan.design_demand) == (5, 5)
+    r = demand(g, t2(), LY, offer=12)
+    assert (r.call_delivered, r.call_edge_drops) == (10, [(1, 2)])
+    assert (r.plan.design_demand, r.plan.planned_bandwidth_per_tunnel) == (12, 5)
+    r = demand(g, t2(), LY, design_demand=4)
+    assert (r.call_delivered, r.plan.planned_bandwidth_per_tunnel) == (4, 2)
+    assert [list(t.edges) for t in r.program.tunnels] == [[0], [0]]
+    with pytest.raises(
+        ValueError,
+        match=exact("CentralizedTE LOSSY evaluation requires a finite offer"),
+    ):
+        demand(g, t2(), LY)
+
+
+def test_offer_pinned():
+    # Pinned over one tunnel per link: the bound 8 (equal split, link 0 holds 4), an offer 5 in
+    # full, Lossy 12 delivers 10.
+    g = par(4, 10)
+    pin = two_paths(g)
+    assert demand(g, pin).call_delivered == 8
+    assert demand(g, pin, offer=5).call_delivered == 5
+    assert demand(g, pin, LY, offer=12).call_delivered == 10
+    with pytest.raises(
+        ValueError, match=exact("Pinned LOSSY evaluation requires a finite offer")
+    ):
+        demand(g, pin, LY)
+
+
+# -- the three evaluators (E8 to E12) -------------------------------------------------------
+
+
+def test_failures_fixed_offer():
+    # EVAL-fixed-offer and EVAL-first-hop on PAR(10, 10); then PAR(4, 10) ECMP Lossy at the
+    # offers 4 and 12 (every deletion answers the same offer) and without one (the first-hop
+    # experiment injects each remaining link's capacity, a different question).
+    for workers in (1, 2):
+        assert failures(par(10, 10), ngc.ShortestPaths(), LY, workers, offer=4) == (
+            4,
+            [0, 0],
+        )
+        assert failures(par(10, 10), ngc.ShortestPaths(), LY, workers) == (20, [10, 10])
+        g = par(4, 10)
+        assert failures(g, ngc.ShortestPaths(), LY, workers, offer=4) == (4, [0, 0])
+        assert failures(g, ngc.ShortestPaths(), LY, workers, offer=12) == (10, [0, 6])
+        assert failures(g, ngc.ShortestPaths(), LY, workers) == (14, [4, 10])
+
+
+def test_failures_distributed_offer():
+    # T1, design 8, Lossy 12: the baseline 10; deleting link 0 sets both tunnels up on link 1
+    # (10, reduction 0); deleting link 1 leaves one tunnel on link 0 carrying 4 (reduction 6).
+    g = par(4, 10)
+    assert failures(g, dte(), LY, design_demand=8, offer=12) == (10, [0, 6])
+
+
+def test_pairs_offer():
+    # The offer is the offer of every pair; nothing is shared between pairs.
+    g = par(4, 10)
+    rs = ngc.evaluate_pairs(g, [(0, 1), (0, 1)], opts(ngc.ShortestPaths(), offer=5))
+    assert [r.call_delivered for r in rs] == [5, 5]
+
+
+def test_offer_zero_and_masked():
+    # Both links masked: Lossy's offer 4 is the demand's source drops (its row zero), Lossless
+    # leaves it undelivered; NO_ROUTE both. A zero offer is COMPLETE for every model, T1's plan
+    # still set up (both tunnels up, 8 reserved).
+    g = par(4, 10)
+    mask = g.eligibility(excluded_edges=[0, 1])
+    r = demand(g, ngc.ShortestPaths(), LY, eligibility=mask, offer=4)
+    assert (r.termination, r.call_delivered, r.call_source_drops) == (T.NO_ROUTE, 0, 4)
+    assert [(s.offered, s.source_drops) for s in r.by_source] == [(0, 0)]
+    r = demand(g, ngc.ShortestPaths(), eligibility=mask, offer=4)
+    assert (r.termination, r.call_delivered, r.call_undelivered) == (T.NO_ROUTE, 0, 4)
+    pin = two_paths(g)
+    for model, admission, kw in (
+        (ngc.ShortestPaths(), LL, {}),
+        (ngc.ShortestPaths(), LY, {}),
+        (ngc.ShortestPaths(allocation=A.OPTIMIZED), LL, {}),
+        (ngc.CentralizedTE(source_allocation=S.OPTIMIZED), LL, {}),
+        (dte(), LL, {"design_demand": 8}),
+        (dte(), LY, {"design_demand": 8}),
+        (t2(), LL, {}),
+        (t2(), LY, {}),
+        (pin, LL, {}),
+        (pin, LY, {}),
+    ):
+        r = demand(g, model, admission, offer=0, **kw)
+        assert (r.termination, r.call_delivered) == (T.COMPLETE, 0), model
+    r = demand(g, dte(), LY, design_demand=8, offer=0)
+    assert r.plan.total_reserved_bandwidth == 8
+    assert [t.status for t in r.program.tunnels] == [ngc.TunnelStatus.UP] * 2
+
+
+def test_offer_limits():
+    # One link of 2^62 - 1: every model delivers the largest offer (T1 with that design); 2^62 is
+    # refused; deleting the link takes it all.
+    big = L62 - 1
+    g = build(2, [(0, 1, big, 1)])
+    route = [ngc.RouteDefinition(0, ngc.Path(g, [[0]]))]
+    pin = ngc.Pinned(ngc.ForwardingProgram.from_routes(g, 0, 1, route))
+    for model, admission, kw in (
+        (ngc.ShortestPaths(), LL, {}),
+        (ngc.ShortestPaths(), LY, {}),
+        (ngc.ShortestPaths(allocation=A.OPTIMIZED), LL, {}),
+        (ngc.CentralizedTE(source_allocation=S.OPTIMIZED), LL, {}),
+        (dte(1), LL, {"design_demand": big}),
+        (dte(1), LY, {"design_demand": big}),
+        (t2(1), LL, {}),
+        (t2(1), LY, {}),
+        (pin, LL, {}),
+        (pin, LY, {}),
+    ):
+        assert demand(g, model, admission, offer=big, **kw).call_delivered == big, model
+    with pytest.raises(ValueError, match=exact(DOMAIN)):
+        demand(g, ngc.ShortestPaths(), offer=L62)
+    assert failures(g, ngc.ShortestPaths(), offer=big) == (big, [big])
+
+
+# -- the order of the checks (V9 to V11) -----------------------------------------------------
+
+
+def outcome(model, kwargs, admission="LOSSLESS", offer=None, design_demand=None):
+    """One EVAL case on the library: the first error, or the offer and design it evaluates."""
+    g = build(3, [(0, 1, 5, 1), (0, 2, 5, 1), (1, 2, 5, 1)])
+    if model == "Pinned":
+        route = [ngc.RouteDefinition(0, ngc.Path(g, [[1]]))]
+        routing = ngc.Pinned(ngc.ForwardingProgram.from_routes(g, 0, 2, route))
+    else:
+        fields = dict(kwargs)
+        if "source_allocation" in fields:
+            fields["source_allocation"] = getattr(S, fields["source_allocation"])
+        if "tunnel_count" in fields:
+            fields["tunnel_count"] = ngc.TunnelCount(int(fields["tunnel_count"]))
+        if model == "DistributedTE":
+            routing = ngc.DistributedTE(fields.pop("tunnel_count"), **fields)
+        else:
+            routing = getattr(ngc, model)(**fields)
+    try:
+        options = ngc.EvaluationOptions(
+            ngc.FlowPolicyConfig(
+                routing=routing, admission=getattr(ngc.Admission, admission)
+            ),
+            offer=offer,
+            design_demand=design_demand,
+        )
+    except TypeError:
+        return "TypeError"
+    try:
+        r = ngc.evaluate_demand(g, 0, 2, options)
+    except ValueError as e:
+        return str(e)
+    if r.requested == INF and r.by_source[0].offered is not None:
+        evaluated = "first-hop experiment"
+    else:
+        evaluated = r.requested
+    design = None if r.plan is None else r.plan.design_demand
+    return f"offer={evaluated} design_demand={design}"
+
+
+def test_first_error():
+    # EVAL-first-error: the configuration, an explicit offer, the design, T1's missing design,
+    # the missing Lossy offer.
+    cases = [
+        dict(
+            model="CentralizedTE",
+            kwargs={"source_allocation": "EQUAL", "prefer_headroom": True},
+            offer=-1,
+        ),
+        dict(
+            model="DistributedTE",
+            kwargs={"tunnel_count": "4"},
+            admission="LOSSY",
+            offer=-1,
+            design_demand=INF,
+        ),
+        dict(
+            model="DistributedTE",
+            kwargs={"tunnel_count": "4"},
+            admission="LOSSY",
+            offer=5,
+            design_demand=INF,
+        ),
+        dict(model="DistributedTE", kwargs={"tunnel_count": "4"}, admission="LOSSY"),
+        dict(
+            model="DistributedTE",
+            kwargs={"tunnel_count": "4"},
+            admission="LOSSY",
+            design_demand=10,
+        ),
+        dict(model="ShortestPaths", kwargs={}, offer=INF, design_demand=5),
+        dict(model="ShortestPaths", kwargs={}, design_demand=5),
+        dict(
+            model="CentralizedTE",
+            kwargs={"source_allocation": "EQUAL", "tunnel_count": "16"},
+            admission="LOSSY",
+        ),
+        dict(
+            model="CentralizedTE",
+            kwargs={"source_allocation": "EQUAL", "tunnel_count": "16"},
+            admission="LOSSY",
+            design_demand=10,
+        ),
+        dict(model="Pinned", kwargs={}, admission="LOSSY"),
+        dict(model="ShortestPaths", kwargs={}, admission="LOSSY"),
+        dict(model="ShortestPaths", kwargs={}, admission="LOSSY", offer=4),
+    ]
+    assert [outcome(**c) for c in cases] == [
+        "prefer_headroom requires tunnel_count",
+        DOMAIN,
+        "DistributedTE requires a finite design demand",
+        "DistributedTE evaluation requires design_demand",
+        "DistributedTE LOSSY evaluation requires a finite offer",
+        DOMAIN,
+        "ShortestPaths does not accept design_demand",
+        "CentralizedTE LOSSY evaluation requires a finite offer",
+        "offer=10 design_demand=10",
+        "Pinned LOSSY evaluation requires a finite offer",
+        "offer=first-hop experiment design_demand=None",
+        "offer=4 design_demand=None",
+    ]
+
+
+def test_offer_infinite():
+    # EVAL-offer-infinite: +inf constructs and is refused by the evaluator after the
+    # configuration; a string is a construction TypeError.
+    headroom = {"source_allocation": "EQUAL", "prefer_headroom": True}
+    assert [
+        outcome("CentralizedTE", headroom, offer=INF),
+        outcome("CentralizedTE", headroom, offer="4"),
+        outcome("ShortestPaths", {}, offer=INF),
+    ] == ["prefer_headroom requires tunnel_count", "TypeError", DOMAIN]
+
+
+def test_design_model_before_range():
+    # A model without a design refuses one before its range is read.
+    assert (
+        outcome("ShortestPaths", {}, design_demand=-1)
+        == "ShortestPaths does not accept design_demand"
+    )
+    assert (
+        outcome("DistributedTE", {"tunnel_count": "4"}, design_demand=-1)
+        == "design_demand must be an integer in [0, 2^62) or permitted +inf"
+    )
+
+
+def test_pairs_order():
+    # Pinned first (its offer is never read); the offer before per_pair_eligibility's length;
+    # then each pair in order.
+    g = par(4, 10)
+    with pytest.raises(
+        ValueError, match=exact("evaluate_pairs does not accept Pinned")
+    ):
+        ngc.evaluate_pairs(g, [(0, 1)], opts(two_paths(g), LY, offer=-1))
+    with pytest.raises(ValueError, match=exact(DOMAIN)):
+        ngc.evaluate_pairs(
+            g, [(0, 1)], opts(ngc.ShortestPaths(), offer=-1), per_pair_eligibility=[]
+        )
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "node 1 is in both endpoint sets: sources and destinations must not overlap"
+        ),
+    ):
+        ngc.evaluate_pairs(g, [(0, 1), (1, 1)], opts(ngc.ShortestPaths(), offer=4))
+
+
+# -- every model at finite offers: the failure study against its definition -----------------
+
+
+def _models(g):
+    # Every model the evaluators take, with its admission and design (T1 always names one).
+    route = ngc.Path(g, [[0], [2]])
+    pin = ngc.Pinned(
+        ngc.ForwardingProgram.from_routes(
+            g,
+            0,
+            3,
+            [
+                ngc.RouteDefinition(0, route),
+                ngc.RouteDefinition(0, ngc.Path(g, [[1], [3]])),
+            ],
+        )
+    )
+    return [
+        ("ECMP", ngc.ShortestPaths(), (LL, LY), {}),
+        ("WCMP", ngc.ShortestPaths(allocation=A.WEIGHTED), (LL, LY), {}),
+        ("SP OPTIMIZED", ngc.ShortestPaths(allocation=A.OPTIMIZED), (LL,), {}),
+        ("CTE OPTIMIZED", ngc.CentralizedTE(source_allocation=S.OPTIMIZED), (LL,), {}),
+        ("CTE EQUAL", ngc.CentralizedTE(source_allocation=S.EQUAL), (LL,), {}),
+        (
+            "CTE support",
+            ngc.CentralizedTE(source_allocation=S.OPTIMIZED, support=route.to_dag()),
+            (LL,),
+            {},
+        ),
+        ("T1", dte(2), (LL, LY), {"design_demand": 8}),
+        ("T2", t2(2), (LL, LY), {}),
+        ("Pinned", pin, (LL, LY), {}),
+    ]
+
+
+def test_failures_on_random_graphs_at_an_offer():
+    # 300 random graphs (4 to 7 nodes, 6 to 15 edges, capacities 0..8, costs 1..3, one or two
+    # sources, a random offer 0..14), eight configurations each: every deletion's reduction is the
+    # baseline minus evaluate_demand with that edge excluded too (an edge left out of the
+    # candidates: 0), on 1 worker for even trials and 2 for odd ones. Optimized CentralizedTE
+    # repairs its baseline when the offer exceeds the maximum and solves afresh when the offer
+    # binds below it: both happen here.
+    rng = np.random.default_rng(7)
+    repaired = fresh = rows = 0
+    for trial in range(300):
+        n = int(rng.integers(4, 8))
+        m = int(rng.integers(6, 16))
+        es, ed = [], []
+        while len(es) < m:
+            u, v = int(rng.integers(0, n)), int(rng.integers(0, n))
+            if u != v:
+                es.append(u)
+                ed.append(v)
+        cap = [int(x) for x in rng.integers(0, 9, m)]
+        cost = [int(x) for x in rng.integers(1, 4, m)]
+        g = ngc.Graph(n, es, ed, cap, cost, 1.0)
+        nodes = [int(x) for x in rng.permutation(n)]
+        src = sorted(nodes[: int(rng.integers(1, 3))])
+        dst = [nodes[-1]]
+        offer = int(rng.integers(0, 15))
+        workers = 1 + trial % 2
+        configs = [
+            (ngc.CentralizedTE(source_allocation=S.OPTIMIZED), LL, {"offer": offer}),
+            (ngc.CentralizedTE(source_allocation=S.EQUAL), LL, {"offer": offer}),
+            (ngc.ShortestPaths(allocation=A.OPTIMIZED), LL, {"offer": offer}),
+            (ngc.ShortestPaths(), LY, {"offer": offer}),
+            (ngc.ShortestPaths(), LL, {"offer": offer}),
+            (dte(2), LY, {"offer": offer, "design_demand": offer}),
+            (t2(2), LY, {"offer": offer}),
+            (ngc.CentralizedTE(source_allocation=S.OPTIMIZED), LL, {}),
+        ]
+        for k, (model, admission, kw) in enumerate(configs):
+            o = opts(model, admission, **kw)
+            s = ngc.evaluate_edge_failures(g, src, dst, o, workers)
+            base = ngc.evaluate_demand(g, src, dst, o).call_delivered
+            assert s.baseline.call_delivered == base, (trial, k)
+            if k == 0 and any(x.delivery_reduction for x in s.entries):
+                top = ngc.evaluate_demand(g, src, dst, opts(model, LL)).call_delivered
+                repaired += base < offer
+                fresh += base == offer < top
+            got = {x.edge: x.delivery_reduction for x in s.entries}
+            for e in range(g.num_edges()):
+                deleted = opts(
+                    model,
+                    admission,
+                    eligibility=g.eligibility(excluded_edges=[e]),
+                    **kw,
+                )
+                want = base - ngc.evaluate_demand(g, src, dst, deleted).call_delivered
+                assert got.get(e, 0) == want, (trial, k, e, workers)
+                rows += 1
+    assert repaired >= 10 and fresh >= 10, (repaired, fresh)
+    assert rows > 20000
+
+
+def test_failures_at_every_offer():
+    # A diamond 0 -> {1, 2} -> 3, capacities 4, 6, 3, 9 and costs 1, 1, 2, 1: the maximum is 9.
+    # For every model, admission and offer (below, at and above its maximum, and none where a
+    # model takes none), evaluate_edge_failures gives the baseline of evaluate_demand and, per
+    # allowed edge, the baseline minus evaluate_demand with that edge excluded too (an edge left
+    # out of the candidates must have reduction 0); evaluate_pairs agrees with evaluate_demand.
+    g = build(4, [(0, 1, 4, 1), (0, 2, 6, 1), (1, 3, 3, 2), (2, 3, 9, 1)])
+    checked = 0
+    for name, model, admissions, extra in _models(g):
+        for admission in admissions:
+            top = ngc.evaluate_demand(
+                g,
+                0,
+                3,
+                opts(model, LL, **extra)
+                if LL in admissions
+                else opts(model, admission, offer=L62 - 1, **extra),
+            ).call_delivered
+            offers = [1, top, top + 5] + ([None] if admission == LL else [])
+            for offer in offers:
+                o = opts(model, admission, offer=offer, **extra)
+                base = ngc.evaluate_demand(g, 0, 3, o).call_delivered
+                for workers in (1, 2):
+                    s = ngc.evaluate_edge_failures(g, 0, 3, o, workers)
+                    assert s.baseline.call_delivered == base, (name, admission, offer)
+                    got = {x.edge: x.delivery_reduction for x in s.entries}
+                    for e in range(g.num_edges()):
+                        deleted = ngc.evaluate_demand(
+                            g,
+                            0,
+                            3,
+                            opts(
+                                model,
+                                admission,
+                                offer=offer,
+                                eligibility=g.eligibility(excluded_edges=[e]),
+                                **extra,
+                            ),
+                        ).call_delivered
+                        assert got.get(e, 0) == base - deleted, (
+                            name,
+                            admission,
+                            offer,
+                            workers,
+                            e,
+                        )
+                    checked += 1
+                if not isinstance(model, ngc.Pinned):
+                    (pair,) = ngc.evaluate_pairs(g, [(0, 3)], o, workers=2)
+                    assert pair.call_delivered == base, (name, admission, offer)
+    assert checked > 100
+
+
+def test_invalid_offer_precedes_frozen_cache_miss():
+    g = par(5, 7)
+    cache = ngc.ShortestPathCache(g)
+    cache.freeze()
+    invalid = opts(ngc.ShortestPaths(), cache=cache, offer=INF)
+    valid = opts(ngc.ShortestPaths(), cache=cache, offer=1)
+    calls = [
+        lambda o: ngc.evaluate_demand(g, 0, 1, o),
+        lambda o: ngc.evaluate_pairs(g, [(0, 1)], o, workers=2),
+        lambda o: ngc.evaluate_edge_failures(g, 0, 1, o, workers=2),
+    ]
+    for call in calls:
+        before = cache.stats()
+        with pytest.raises(ValueError) as error:
+            call(invalid)
+        assert str(error.value) == DOMAIN
+        after = cache.stats()
+        assert (after.hits, after.misses, after.entries) == (
+            before.hits,
+            before.misses,
+            before.entries,
+        )
+        with pytest.raises(ngc.ShortestPathCacheMiss):
+            call(valid)
+        after = cache.stats()
+        assert (
+            after.misses == before.misses + 1
+            and after.hits == before.hits
+            and after.entries == 0
+        )
+    cache.thaw()
+    result = ngc.evaluate_demand(g, 0, 1, valid)
+    assert result.call_delivered == 1
+
+
+@pytest.mark.parametrize("model", ["distributed", "centralized", "support"])
+def test_pair_rosters_use_the_composed_mask(model):
+    """Every reused roster has the same endpoints and effective mask as its evaluation."""
+    import random
+
+    from helpers import ALL_OUT, dag_of, plain
+
+    def routing(g):
+        if model == "distributed":
+            return dte(2)
+        return ngc.CentralizedTE(
+            source_allocation=S.EQUAL,
+            tunnel_count=ngc.TunnelCount(2),
+            support=dag_of(g, range(g.num_edges())) if model == "support" else None,
+        )
+
+    # A removed source (or its only edge) leaves one head: the full offer 4 goes
+    # to that head. Using the unmasked two-head roster would lose its share.
+    g = build(4, [(0, 3, 4, 1), (1, 3, 8, 1)])
+    masks = [
+        g.eligibility(excluded_nodes=[0]),
+        g.eligibility(excluded_edges=[0]),
+        g.eligibility(excluded_nodes=[0, 1]),
+    ]
+    common = g.eligibility(excluded_nodes=[2])
+    o = opts(routing(g), eligibility=common, design_demand=6, offer=4, outputs=ALL_OUT)
+    result = ngc.evaluate_pairs(g, [([0, 1], 3)] * 3, o, masks, 2)
+    assert [r.delivered for r in result] == [4, 4, 0]
+    assert [r.edge_flows.tolist() for r in result] == [[0, 4], [0, 4], [0, 0]]
+    zero = opts(
+        routing(g), eligibility=common, design_demand=6, offer=0, outputs=ALL_OUT
+    )
+    assert all(
+        r.delivered == 0
+        for r in ngc.evaluate_pairs(g, [([0, 1], 3)] * 3, zero, masks, 2)
+    )
+
+    rng = random.Random(7)
+    compared = 0
+    for _ in range(150):
+        n = rng.randint(5, 9)
+        edges = [
+            (u, v, rng.randint(1, 9), rng.randint(1, 4))
+            for u in range(n)
+            for v in range(u + 1, n)
+            if rng.random() < 0.45
+        ]
+        if not edges:
+            continue
+        g = build(n, edges)
+        common = (
+            g.eligibility(excluded_edges=[rng.randrange(g.num_edges())])
+            if rng.random() < 0.5
+            else None
+        )
+        pairs, per = [], []
+        for _ in range(3):
+            nodes = list(range(n - 2))
+            rng.shuffle(nodes)
+            heads = sorted(nodes[: rng.randint(2, 3)])
+            pairs.append((heads, [rng.choice([n - 2, n - 1])]))
+            per.append(
+                g.eligibility(
+                    excluded_nodes=[h for h in heads if rng.random() < 0.4],
+                    excluded_edges=[
+                        e for e in range(g.num_edges()) if rng.random() < 0.25
+                    ],
+                )
+            )
+        config = ngc.FlowPolicyConfig(routing=routing(g))
+        options = ngc.EvaluationOptions(
+            config, eligibility=common, design_demand=6, offer=4, outputs=ALL_OUT
+        )
+        batch = ngc.evaluate_pairs(g, pairs, options, per, 2)
+        assert len(batch) == 3
+        for i, (heads, destinations) in enumerate(pairs):
+            mask = (
+                per[i] if common is None else ngc.Eligibility.intersect(common, per[i])
+            )
+            single = ngc.EvaluationOptions(
+                config, eligibility=mask, design_demand=6, offer=4, outputs=ALL_OUT
+            )
+            assert plain(batch[i]) == plain(
+                ngc.evaluate_demand(g, heads, destinations, single)
+            )
+            compared += 1
+    assert compared >= 400
+
+
+def test_tunnel_pair_search_error_precedes_later_conversion_error():
+    # floor((2^30-1)/10000)+1 reachable heads exceed the tunnel limit.
+    heads = ((1 << 30) - 1) // 10000 + 1
+    g = build(heads + 1, [(h, heads, 1, 1) for h in range(heads)])
+    expected = f"tunnel limit exceeded: {heads} heads x 10000 tunnels > {(1 << 30) - 1}"
+    for model in (dte(10000), t2(10000)):
+        options = opts(model, design_demand=1, offer=1)
+        for invalid in (None, (0,), ([], heads), (0, 0)):
+            with pytest.raises(ValueError, match=exact(expected)):
+                ngc.evaluate_pairs(
+                    g, [(list(range(heads)), heads), invalid], options, workers=2
+                )
+        # If the earlier pair fails its linear checks, no later search takes precedence.
+        with pytest.raises(ValueError, match=exact("sources: the node set is empty")):
+            ngc.evaluate_pairs(
+                g, [([], heads), (list(range(heads)), heads)], options, workers=2
+            )
diff --git a/tests/py/test_ext_edge_ids.py b/tests/py/test_ext_edge_ids.py
deleted file mode 100644
index 83bbe88..0000000
--- a/tests/py/test_ext_edge_ids.py
+++ /dev/null
@@ -1,142 +0,0 @@
-"""Tests for external edge ID preservation in StrictMultiDiGraph."""
-
-import numpy as np
-
-import netgraph_core
-
-
-def test_ext_edge_ids_without_reverse():
-    """Test that external edge IDs are preserved through reordering."""
-    # Create edges in non-sorted order to trigger reordering
-    num_nodes = 4
-    src = np.array([2, 0, 1, 0], dtype=np.int32)
-    dst = np.array([3, 1, 2, 2], dtype=np.int32)
-    capacity = np.array([10.0, 20.0, 15.0, 25.0], dtype=np.float64)
-    cost = np.array([5, 1, 3, 1], dtype=np.int64)
-    ext_edge_ids = np.array([1000, 2000, 3000, 4000], dtype=np.int64)
-
-    g = netgraph_core.StrictMultiDiGraph.from_arrays(
-        num_nodes=num_nodes,
-        src=src,
-        dst=dst,
-        capacity=capacity,
-        cost=cost,
-        ext_edge_ids=ext_edge_ids,
-    )
-
-    assert g.num_nodes() == 4
-    assert g.num_edges() == 4
-
-    # Get reordered data
-    src_view = g.edge_src_view()
-    dst_view = g.edge_dst_view()
-    cost_view = g.cost_view()
-    ext_ids_view = g.ext_edge_ids_view()
-
-    # Core sorts by (cost, src, dst), so expected order:
-    # (0→1, cost=1, ext_id=2000)
-    # (0→2, cost=1, ext_id=4000)
-    # (1→2, cost=3, ext_id=3000)
-    # (2→3, cost=5, ext_id=1000)
-    expected_order = [
-        (0, 1, 1, 2000),
-        (0, 2, 1, 4000),
-        (1, 2, 3, 3000),
-        (2, 3, 5, 1000),
-    ]
-
-    for i, (exp_src, exp_dst, exp_cost, exp_ext_id) in enumerate(expected_order):
-        assert src_view[i] == exp_src
-        assert dst_view[i] == exp_dst
-        assert cost_view[i] == exp_cost
-        assert ext_ids_view[i] == exp_ext_id
-
-
-def test_ext_edge_ids_with_manual_reverse():
-    """Test ext_edge_ids when reverse edges are manually added with distinct IDs."""
-    num_nodes = 3
-
-    # Manually add forward and reverse edges with distinct ext_edge_ids
-    src = np.array([0, 1, 1, 2], dtype=np.int32)  # fwd0, rev0, fwd1, rev1
-    dst = np.array([1, 0, 2, 1], dtype=np.int32)
-    capacity = np.array([10.0, 10.0, 20.0, 20.0], dtype=np.float64)
-    cost = np.array([1, 1, 2, 2], dtype=np.int64)
-    ext_edge_ids = np.array([0, 1, 2, 3], dtype=np.int64)  # Distinct for fwd/rev
-
-    g = netgraph_core.StrictMultiDiGraph.from_arrays(
-        num_nodes=num_nodes,
-        src=src,
-        dst=dst,
-        capacity=capacity,
-        cost=cost,
-        ext_edge_ids=ext_edge_ids,
-    )
-
-    assert g.num_edges() == 4
-
-    ext_ids_view = g.ext_edge_ids_view()
-    src_view = g.edge_src_view()
-    dst_view = g.edge_dst_view()
-
-    # Verify all ext_edge_ids are distinct
-    assert len(set(ext_ids_view)) == 4, "ext_edge_ids should all be distinct"
-
-    # Verify we can distinguish forward from reverse
-    # In sorted order by cost, src, dst:
-    # (0→1, cost=1, ext_id=0), (1→0, cost=1, ext_id=1), (1→2, cost=2, ext_id=2), (2→1, cost=2, ext_id=3)
-    expected = [(0, 1, 0), (1, 0, 1), (1, 2, 2), (2, 1, 3)]
-    for i, (exp_src, exp_dst, exp_ext_id) in enumerate(expected):
-        assert src_view[i] == exp_src
-        assert dst_view[i] == exp_dst
-        assert ext_ids_view[i] == exp_ext_id
-
-
-def test_ext_edge_ids_encoding_scheme():
-    """Test a typical encoding scheme: (linkIndex << 1) | directionBit."""
-    num_nodes = 3
-
-    # Simulate two links with forward/reverse encoding
-    # Link 0: fwd=(0<<1)|0=0, rev=(0<<1)|1=1
-    # Link 1: fwd=(1<<1)|0=2, rev=(1<<1)|1=3
-    src = np.array([0, 1, 1, 2], dtype=np.int32)
-    dst = np.array([1, 0, 2, 1], dtype=np.int32)
-    capacity = np.array([10.0, 10.0, 20.0, 20.0], dtype=np.float64)
-    cost = np.array([1, 1, 1, 1], dtype=np.int64)
-    ext_edge_ids = np.array([0, 1, 2, 3], dtype=np.int64)
-
-    g = netgraph_core.StrictMultiDiGraph.from_arrays(
-        num_nodes=num_nodes,
-        src=src,
-        dst=dst,
-        capacity=capacity,
-        cost=cost,
-        ext_edge_ids=ext_edge_ids,
-    )
-
-    ext_ids_view = g.ext_edge_ids_view()
-    src_view = g.edge_src_view()
-    dst_view = g.edge_dst_view()
-
-    # Decode ext_edge_ids back to (linkIndex, directionBit)
-    for i in range(len(ext_ids_view)):
-        ext_id = int(ext_ids_view[i])
-        link_idx = ext_id >> 1
-        dir_bit = ext_id & 1
-        direction = "rev" if dir_bit else "fwd"
-
-        # Verify encoding is consistent
-        assert link_idx in (0, 1), f"Invalid link_idx {link_idx}"
-        assert direction in ("fwd", "rev"), f"Invalid direction {direction}"
-
-        # Verify forward edges have dir_bit=0, reverse have dir_bit=1
-        if src_view[i] < dst_view[i]:  # Assuming forward means src < dst
-            assert dir_bit == 0, f"Forward edge {i} should have dir_bit=0"
-        else:
-            assert dir_bit == 1, f"Reverse edge {i} should have dir_bit=1"
-
-
-if __name__ == "__main__":
-    test_ext_edge_ids_without_reverse()
-    test_ext_edge_ids_with_manual_reverse()
-    test_ext_edge_ids_encoding_scheme()
-    print("All ext_edge_ids tests passed!")
diff --git a/tests/py/test_flow_ledger.py b/tests/py/test_flow_ledger.py
new file mode 100644
index 0000000..3b31157
--- /dev/null
+++ b/tests/py/test_flow_ledger.py
@@ -0,0 +1,508 @@
+"""The integer ledger FlowLedger through the bindings (docs/semantics.md#6-the-ledger):
+baselines on unnarrowed values, snapshots and records, FlowIds, bottleneck, and the lifetime
+table driven by manual placements on one fixed route (a manual flow: CentralizedTE with the route as its
+support, or Pinned over a program of the one split route), whose PlacementResult the tests read."""
+
+from __future__ import annotations
+
+import copy
+import gc
+import itertools
+
+import numpy as np
+import pytest
+from helpers import (
+    GLOBAL,
+    INF,
+    L62,
+    SHORTEST_PATHS,
+    build,
+    dag_of,
+    exact,
+    ids,
+    ledger_state,
+)
+from private_hooks import HOOKS, needs_hooks
+
+import netgraph_core as ngc
+
+T = ngc.Termination
+
+
+def pinned(fg, src, dst, edges, placement, admission=None):
+    """A manual flow on the edges' DAG: OPTIMIZED is CentralizedTE with that DAG as its support (a
+    controller restricted to it); EQUAL and WEIGHTED are Pinned over a program of the one
+    split route (WEIGHTED's weights: the ledger's residual now, frozen, as the old flow read them
+    at its creation)."""
+    g = fg.graph()
+    admission = admission or ngc.Admission.LOSSLESS
+    if placement == ngc.RouteAllocation.OPTIMIZED:
+        cfg = ngc.FlowPolicyConfig(
+            routing=ngc.CentralizedTE(
+                source_allocation=ngc.SourceAllocation.OPTIMIZED,
+                support=dag_of(g, edges),
+            ),
+            admission=admission,
+        )
+        return ngc.FlowPolicy(fg, src, dst, cfg)
+    snapshot = placement == ngc.RouteAllocation.WEIGHTED
+    program = ngc.ForwardingProgram.from_routes(
+        g,
+        src,
+        dst,
+        [ngc.RouteDefinition(src, dag_of(g, edges))],
+        allocation=placement,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT if snapshot else None,
+        residual=fg.residual() if snapshot else None,
+    )
+    cfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(program), admission=admission)
+    return ngc.FlowPolicy(fg, src, dst, cfg)
+
+
+def flow_id(policy):
+    recs = policy.records()
+    return recs[0].flow_id if recs else None
+
+
+EB = ngc.RouteAllocation.EQUAL
+MF = ngc.RouteAllocation.OPTIMIZED
+W = ngc.RouteAllocation.WEIGHTED
+LOSSY = ngc.Admission.LOSSY
+
+
+def test_baseline_validation_order_and_snapshots():
+    g = build(2, [(0, 1, 5, 1), (1, 0, 3, 1)])
+    fg = ngc.FlowLedger(g)
+    assert list(fg.residual()) == [5, 3]
+    assert fg.residual().dtype == np.int64
+    assert list(fg.carried()) == [0, 0]
+    assert list(fg.edge_capacity_units()) == [5, 3]
+    assert fg.records() == []
+    assert fg.graph() is g
+    for bad, msg in (
+        (
+            [6, 0],
+            r"service_baseline\[0\] = 6 is outside \[0, edge_capacity_units\[0\] = 5\]",
+        ),
+        ([1], "service_baseline has length 1, expected 2"),
+        ([-1, 0], r"service_baseline\[0\] = -1"),
+        ([L62 * 4, 0], r"service_baseline\[0\] = 18446744073709551616"),
+        ([2.5, 0], "integer"),
+        ([True, 0], "integer"),
+        (np.zeros((1, 2), dtype=np.int64), "1-D"),
+    ):
+        # An entry or a rank of a wrong type is a TypeError, a length or a value a ValueError.
+        with pytest.raises((TypeError, ValueError), match=msg) as error:
+            ngc.FlowLedger(g, bad)
+        assert error.type is (TypeError if msg in ("integer", "1-D") else ValueError)
+    fg2 = ngc.FlowLedger(graph=g, service_baseline=np.array([1, 2], dtype=np.uint64))
+    assert list(fg2.residual()) == [1, 2]
+    assert fg2.uid() != fg.uid()
+    # residual() and carried() are copies: writing one changes neither the ledger nor the next
+    # snapshot. edge_capacity_units() is a read-only view of the graph's own capacities.
+    for snapshot in (fg.residual, fg.carried):
+        a = snapshot()
+        assert a.dtype == np.int64
+        before = a.tolist()
+        a[0] = 7
+        assert snapshot().tolist() == before
+    assert list(fg.residual()) == [5, 3] and list(fg.carried()) == [0, 0]
+    view = fg.edge_capacity_units()
+    assert view.dtype == np.int64 and not view.flags.writeable
+    assert np.shares_memory(view, g.edge_capacity_units())
+
+
+def test_the_ledger_has_no_public_placement_or_removal():
+    # Only policies place or remove flows: the public members are the readers, reset and copy.
+    public = {n for n in dir(ngc.FlowLedger) if not n.startswith("_")}
+    assert public == {
+        "carried",
+        "copy",
+        "edge_capacity_units",
+        "graph",
+        "record",
+        "records",
+        "reserved",
+        "reset",
+        "residual",
+        "saturated_boundary_edges",
+        "uid",
+        "unreserved",
+    }
+
+
+def test_lifetime_bound_rows_and_epochs():
+    g = build(2, [(0, 1, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    p = pinned(fg, 0, 1, [0], EB)
+    r = p.place(0)
+    assert (r.call_delivered, r.call_undelivered, r.termination, r.delivery_delta) == (
+        0,
+        0,
+        T.COMPLETE,
+        0,
+    )
+    assert (r.routes_changed, r.weights_changed, r.call_edge_drops, fg.records()) == (
+        False,
+        False,
+        [],
+        [],
+    )
+    if HOOKS:
+        assert fg._state()["next_flow_id"] == 0
+    with pytest.raises(ValueError, match="bound"):
+        fg.reset()
+    with pytest.raises(ValueError, match="bound"):
+        fg.copy()
+    with pytest.raises(ValueError, match="bound"):
+        copy.copy(fg)
+    with pytest.raises(ValueError, match="bound"):
+        copy.deepcopy(fg)
+    r = p.place(2)
+    assert (r.call_delivered, r.termination, r.routes_changed, flow_id(p)[1]) == (
+        2,
+        T.COMPLETE,
+        True,
+        0,
+    )
+    r = p.place(INF)
+    assert (r.call_delivered, r.termination, r.call_undelivered, r.requested) == (
+        3,
+        T.EXHAUSTED,
+        INF,
+        INF,
+    )
+    assert (r.admitted, r.delivered, r.unadmitted) == (5, 5, None)
+    assert (r.routes_changed, r.weights_changed, r.marginal_cost_curve) == (
+        False,
+        False,
+        None,
+    )
+    for finite in (1, 0):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "finite placement after infinite placement requires a new epoch"
+            ),
+        ):
+            p.place(finite)
+    old = flow_id(p)
+    p.remove()
+    assert list(fg.carried()) == [0]
+    with pytest.raises(ValueError, match="retired or unknown"):
+        fg.record(old)
+    r = p.place(1)
+    assert (r.call_delivered, r.routes_changed, flow_id(p)[1]) == (1, True, 1)
+    p.remove()
+    p.remove()
+    assert p.records() == []
+    if HOOKS:
+        assert (p._state()["requested"], p._state()["infinite"]) == (0, False)
+        assert fg._state() == {"next_flow_id": 2, "bound": [0], "orphans": []}
+
+
+def test_orphans_from_destruction_reset_and_copy():
+    g = build(2, [(0, 1, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    q = pinned(fg, 0, 1, [0], EB)
+    q.place(2)
+    del q
+    gc.collect()  # destroyed without remove(): an orphan
+    if HOOKS:
+        assert fg._state()["orphans"] == [0]
+    assert fg.records()[0].delivered == 2
+    p = pinned(fg, 0, 1, [0], EB)
+    assert p.place(5).call_delivered == 3
+    with pytest.raises(ValueError, match="bound"):
+        fg.copy()
+    del p
+    gc.collect()  # the second orphan; the ledger has no bound policy left
+    c = fg.copy()
+    assert c.uid() != fg.uid()
+    assert [r.flow_id for r in c.records()] == [(c.uid(), 0), (c.uid(), 1)]
+    assert list(c.carried()) == [5]
+    d = copy.deepcopy(fg)
+    assert list(d.carried()) == [5]
+    fg.reset([4])
+    assert (fg.records(), list(fg.residual())) == ([], [4])
+    if HOOKS:
+        assert fg._state() == {"next_flow_id": 2, "bound": [], "orphans": []}
+    assert len(c.records()) == 2  # the copy is independent
+    fg.reset()  # no baseline: back to the capacities
+    assert list(fg.residual()) == [5]
+
+
+def test_policy_keeps_the_ledger_alive():
+    g = build(2, [(0, 1, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    p = pinned(fg, 0, 1, [0], MF)
+    del fg
+    gc.collect()
+    assert p.place(2).call_delivered == 2
+    assert p.delivered() == 2
+
+
+def test_records_fields_and_counters_beyond_64_bits():
+    g = build(4, [(0, 1, 10, 1), (0, 2, 10, 1), (1, 3, 1, 1), (2, 3, 10, 1)])
+    fg = ngc.FlowLedger(g)
+    p = pinned(fg, 0, 3, range(4), EB, LOSSY)
+    r = p.place(10)
+    assert (r.call_delivered, r.call_undelivered, r.termination, r.edge_drops) == (
+        6,
+        4,
+        T.COMPLETE,
+        [(2, 4)],
+    )
+    rec = fg.records()[0]
+    assert rec.flow_id == (fg.uid(), 0)
+    assert (rec.policy_id, rec.sources, rec.destinations) == (0, [0], [3])
+    # The route is the ledger's own PredecessorDAG, shared by every snapshot (not a copy).
+    assert rec.route is fg.records()[0].route is fg.record(rec.flow_id).route
+    assert rec.admission == LOSSY
+    assert list(rec.route.via_edges()) == [0, 1, 2, 3]
+    assert (rec.min_route_cost, rec.offered, rec.delivered) == (2, 10, 6)
+    assert rec.edge_flows == [(0, 5), (1, 5), (2, 1), (3, 5)]
+    assert rec.edge_drops == [(2, 4)]
+    assert fg.record(rec.flow_id).delivered == 6
+    # Records are snapshots: a later call changes the ledger's record, not one read before it.
+    held = fg.record(rec.flow_id)
+    p.place(1)
+    assert (rec.offered, held.offered, fg.record(rec.flow_id).offered) == (10, 10, 11)
+    # Lossless records: no offered.
+    g2 = build(2, [(0, 1, 1, 1)])
+    fg2 = ngc.FlowLedger(g2)
+    pinned(fg2, 0, 1, [0], MF).place(1)
+    assert fg2.records()[0].offered is None
+    # An empty route: min_route_cost None. CentralizedTE routing keeps a record per source; one unit from
+    # sources 0 and 1 takes the cheaper edge 0 -> 2, so source 1 has no share.
+    g3 = build(3, [(0, 2, 1, 1), (1, 2, 1, 5)])
+    fg3 = ngc.FlowLedger(g3)
+    assert ngc.FlowPolicy(fg3, [0, 1], 2, GLOBAL).place(1).call_delivered == 1
+    rec_used, rec_idle = fg3.records()
+    assert (rec_used.sources, rec_used.min_route_cost, rec_used.delivered) == (
+        [0],
+        1,
+        1,
+    )
+    assert (rec_idle.sources, rec_idle.min_route_cost, rec_idle.delivered) == (
+        [1],
+        None,
+        0,
+    )
+    assert rec_idle.edge_flows == []
+    assert list(rec_idle.route.via_edges()) == []
+    # Every unit dropped on a saturated link, nine times: the counters pass 2^64.
+    sat = pinned(fg2, 0, 1, [0], EB, LOSSY)
+    for _ in range(9):
+        sat.place(L62 - 1)
+    lossy = fg2.records()[1]
+    assert lossy.offered == 9 * (L62 - 1)
+    assert lossy.edge_drops == [(0, 9 * (L62 - 1))]
+    if HOOKS:
+        assert sat._state()["requested"] == 9 * (L62 - 1)
+    assert lossy.offered > 1 << 64
+
+
+def test_record_endpoint_sets_are_ascending():
+    # A destination set given out of order and with a repeat: every record lists it ascending,
+    # once; a record per source under CentralizedTE, each with its one source.
+    g = build(4, [(0, 2, 5, 1), (0, 3, 5, 1), (1, 2, 5, 1), (1, 3, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    ngc.FlowPolicy(fg, 0, [3, 2, 3], SHORTEST_PATHS).place(2)
+    ngc.FlowPolicy(fg, [1, 0, 1], [3, 2], GLOBAL).place(4)
+    records = fg.records()
+    assert [r.destinations for r in records] == [[2, 3]] * len(records)
+    assert sorted(r.sources for r in records[1:]) == [[0], [1]]
+    assert records[0].sources == [0] and len(records) == 3
+
+
+def test_empty_split_graph_keeps_the_route_cost():
+    # Weighted with a residual snapshot of 0 on every route edge under another owner's flow:
+    # the record exists at zero delivery with an empty split graph (no positive weight:
+    # NO_ACTIVE_WEIGHT); min_route_cost is the route's minimum walk cost, not a split-graph value.
+    # The first preparation installs the program: routes and weights changed.
+    g = build(2, [(0, 1, 2, 3)])
+    fg = ngc.FlowLedger(g)
+    pinned(fg, 0, 1, [0], MF).place(2)
+    w = pinned(fg, 0, 1, [0], W)
+    r = w.place(1)
+    assert (r.call_delivered, r.termination, r.routes_changed, r.weights_changed) == (
+        0,
+        T.NO_ACTIVE_WEIGHT,
+        True,
+        True,
+    )
+    rec = fg.record(flow_id(w))
+    assert (rec.min_route_cost, rec.delivered, rec.edge_flows) == (3, 0, [])
+    if HOOKS:
+        # The flow's route is the split route before weight pruning (its replay basis).
+        flows = next(iter(w._state()["cohorts"].values()))
+        assert flows[0]["route"] == [0]
+
+
+def test_flow_ids_of_other_ledgers_and_bad_shapes():
+    g = build(2, [(0, 1, 5, 1)])
+    a, b = ngc.FlowLedger(g), ngc.FlowLedger(g)
+    p = pinned(a, 0, 1, [0], MF)
+    p.place(1)
+    with pytest.raises(
+        ValueError,
+        match=exact(f"FlowId {flow_id(p)} belongs to another ledger (uid {b.uid()})"),
+    ):
+        b.record(flow_id(p))
+    # Not a tuple is a wrong type, a tuple of another length a wrong value: one text.
+    for bad, cls in (
+        (0, TypeError),
+        ([a.uid(), 0], TypeError),
+        ((a.uid(),), ValueError),
+    ):
+        with pytest.raises(
+            (TypeError, ValueError), match=exact("a FlowId is a tuple (ledger uid, id)")
+        ) as error:
+            a.record(bad)
+        assert error.type is cls
+    for bad, what in ((True, "ledger uid"), (1.0, "id")):
+        fid = (bad, 0) if what == "ledger uid" else (a.uid(), bad)
+        with pytest.raises(
+            TypeError,
+            match=exact(f"FlowId {what} must be an integer (got {type(bad).__name__})"),
+        ):
+            a.record(fid)
+    with pytest.raises(
+        ValueError, match=exact(f"FlowId ({a.uid()}, {L62 * 8}) is retired or unknown")
+    ):
+        a.record((a.uid(), L62 * 8))
+
+
+@needs_hooks
+def test_a_flow_id_read_passes_an_allocation_failure_through():
+    # A ledger uid outside [0, 2^64) names no ledger: the read raises "retired or unknown". When a
+    # Python allocation fails while that range error is raised, the call raises MemoryError, never
+    # the "retired or unknown" answer (which would hide the failure). Both readers of a FlowId.
+    import _netgraph_core as ext
+
+    g = build(2, [(0, 1, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    policy = pinned(fg, 0, 1, [0], MF)
+    for uid, read in itertools.product(
+        (-1, 2**64, -(2**70)), (fg.record, policy.record)
+    ):
+        failures = 0
+        for k in range(100):
+            hit, _, value, error = ext._fail_python_allocation(read, ((uid, 0),), k)
+            assert value is None, (k, value)
+            if not hit:
+                assert isinstance(error, ValueError), (k, repr(error))
+                assert str(error) == f"FlowId ({uid}, 0) is retired or unknown"
+                break
+            failures += 1
+            assert type(error) is MemoryError, (k, repr(error))
+        else:
+            pytest.fail("the read never completed")
+        assert failures > 0
+
+
+@pytest.mark.parametrize("routing", ["Pinned", "ShortestPaths", "CentralizedTE"])
+def test_rejected_requests_leave_the_policy_and_the_ledger(routing):
+    """Every rejected request (a value that is not an integer unit or +inf, outside [0, 2^62),
+    or finite after +inf), on a fresh policy, after a finite call and after +inf, leaves the
+    ledger and the policy as they were: the records, allocations and delivered amount always, and
+    with the private hooks the epoch state itself (the requested total, the +inf flag and the
+    flows). A NumPy integer is an integer unit."""
+    g = build(4, [(0, 1, 5, 1), (1, 3, 5, 1), (0, 2, 3, 2), (2, 3, 3, 2)])
+    fg = ngc.FlowLedger(g)
+    if routing == "Pinned":
+        p = pinned(fg, 0, 3, [0, 2], EB)  # EdgeIds of 0 -> 1 -> 3
+    else:
+        p = ngc.FlowPolicy(
+            fg, 0, 3, GLOBAL if routing == "CentralizedTE" else SHORTEST_PATHS
+        )
+
+    def state():
+        own = p._state() if HOOKS else None
+        return ledger_state(fg), p.delivered(), own
+
+    def rejected(requests):
+        before = state()
+        for value, cls, msg in requests:
+            with pytest.raises((TypeError, ValueError), match=exact(msg)) as error:
+                p.place(value)
+            assert error.type is cls, value
+        assert state() == before
+        return before
+
+    # One text for every offer outside the domain: a type an offer never takes (a bool, a
+    # string) TypeError, a value outside it ValueError.
+    offer = "offer must be an integer in [0, 2^62) or permitted +inf"
+    bad = [
+        (value, ValueError, offer)
+        for value in (1.5, -1, L62, -INF, float("nan"), np.float64(2.0))
+    ] + [(value, TypeError, offer) for value in (True, "1")]
+    rejected(bad)
+    assert fg.records() == []
+    assert p.place(np.int64(4)).call_delivered == 4
+    rejected(bad)
+    p.place(INF)
+    after_inf = "finite placement after infinite placement requires a new epoch"
+    before = rejected([(1, ValueError, after_inf), (0, ValueError, after_inf), *bad])
+    if HOOKS:
+        assert (before[2]["requested"], before[2]["infinite"]) == (4, True)
+
+
+def test_ledger_bottleneck_with_eligibility_and_errors():
+    g = build(4, [(0, 1, 1, 1), (0, 2, 2, 3), (1, 2, 1, 1), (2, 3, 2, 1)])
+    fg = ngc.FlowLedger(g)
+    p = pinned(fg, 0, 3, range(4), MF)
+    r = p.place(INF)
+    assert (r.call_delivered, r.termination) == (2, T.EXHAUSTED)
+    assert fg.saturated_boundary_edges(0) == ids(g, [0, 3])
+    assert fg.saturated_boundary_edges([0, 0]) == ids(g, [0, 3])
+    assert fg.saturated_boundary_edges([0], g.eligibility(excluded_nodes=[0])) == []
+    # An excluded edge is neither crossed nor listed: without 0 -> 2 (the one edge with residual)
+    # the sources reach only {0}; of its leaving edges 0 -> 1 is listed and 0 -> 2 is not.
+    assert fg.saturated_boundary_edges(
+        [0], g.eligibility(excluded_edges=ids(g, [1]))
+    ) == ids(g, [0])
+    with pytest.raises(ValueError, match="empty"):
+        fg.saturated_boundary_edges([])
+    with pytest.raises(ValueError, match="out of node range"):
+        fg.saturated_boundary_edges([L62 * 8])
+    with pytest.raises(ValueError, match="foreign"):
+        fg.saturated_boundary_edges(
+            [0], build(4, [(0, 1, 1, 1)]).eligibility(excluded_edges=[0])
+        )
+
+
+def test_manual_flow_construction_errors():
+    g = build(3, [(0, 1, 5, 1), (2, 1, 5, 1)])
+    fg = ngc.FlowLedger(g)
+    with pytest.raises(
+        ValueError, match=exact("routes[0]: no walk from head 0 to a destination")
+    ):
+        pinned(fg, 0, 2, [0, 1], EB)
+    # As a support, a route without a walk leaves the roster empty.
+    assert pinned(fg, 0, 2, [0, 1], MF).place(1).termination == T.NO_ROUTE
+    with pytest.raises(
+        ValueError,
+        match=exact("CentralizedTE without tunnel_count requires admission=LOSSLESS"),
+    ):
+        pinned(fg, 0, 1, [0], MF, LOSSY)
+    with pytest.raises(ValueError, match="both endpoint sets"):
+        pinned(fg, 1, 1, [0], MF)
+    other = build(3, [(0, 1, 5, 1), (2, 1, 5, 1)])
+    foreign = ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.OPTIMIZED,
+            support=dag_of(other, [0]),
+        )
+    )
+    with pytest.raises(ValueError, match=exact("support belongs to another graph")):
+        ngc.FlowPolicy(fg, 0, 1, foreign)
+    foreign_route = ngc.ForwardingProgram.from_routes(
+        other, 0, 1, [ngc.RouteDefinition(0, dag_of(other, [0]))]
+    )
+    with pytest.raises(ValueError, match=exact("program belongs to another graph")):
+        ngc.FlowPolicy(
+            fg, 0, 1, ngc.FlowPolicyConfig(routing=ngc.Pinned(foreign_route))
+        )
+    fg.reset()  # no policy is bound
diff --git a/tests/py/test_flow_policy.py b/tests/py/test_flow_policy.py
index 774e903..d2e3b49 100644
--- a/tests/py/test_flow_policy.py
+++ b/tests/py/test_flow_policy.py
@@ -1,282 +1,1116 @@
-"""FlowPolicy behavior across canonical graphs.
-
-Systematic checks for PROPORTIONAL vs EQUAL_BALANCED and multipath True/False
-on the canonical graphs used elsewhere. Assertions compare total placed and
-remaining volumes to expected capacities.
-"""
+"""The policy engine, the ShortestPathCache and the evaluators through the bindings (docs/semantics.md):
+configuration objects and their structural validation, PlacementResult fields and outputs,
+lifetimes, the evaluators with workers, and the cache statistics. The fixtures of the reference
+(``tests/reference/policy/``) replay in ``test_flow_policy_fixtures.py``."""
 
 from __future__ import annotations
 
-from typing import Dict, Tuple
+import gc
+import weakref
 
+import _netgraph_core as ext
 import numpy as np
 import pytest
+from helpers import (
+    ALL_OUT,
+    GLOBAL,
+    HIGHER_AVAIL,
+    INF,
+    L62,
+    SHORTEST_PATHS,
+    assert_read_only,
+    build,
+    config,
+    dag_of,
+    exact,
+    full_ledger_state,
+    ids,
+    plain,
+    sweep_python_allocation,
+    t1_config,
+    to_ids,
+)
+from private_hooks import HOOKS, needs_hooks
 
 import netgraph_core as ngc
 
-# Policy configs covered (subset):
-# - SHORTEST_PATHS_WCMP  -> Proportional split over equal-cost SPF (multipath)
-# - SHORTEST_PATHS_ECMP  -> Equal-balanced over equal-cost SPF (multipath)
-# - TE_ECMP_16_LSP       -> Equal-balanced, capacity-aware single-path selection, 16 flows
-POLICY_CONFIGS = (
-    "SHORTEST_PATHS_WCMP",
-    "SHORTEST_PATHS_ECMP",
-    "TE_ECMP_16_LSP",
-)
+T = ngc.Termination
 
 
-def make_policy(config: str, algs: ngc.Algorithms, gh) -> ngc.FlowPolicy:
-    if config == "SHORTEST_PATHS_WCMP":
-        sel = ngc.EdgeSelection(
-            multi_edge=True,
-            require_capacity=True,
-            tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-        )
-        cfg = ngc.FlowPolicyConfig(
-            path_alg=ngc.PathAlg.SPF,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            selection=sel,
-            shortest_path=True,
-        )
-        return ngc.FlowPolicy(algs, gh, cfg)
-    if config == "SHORTEST_PATHS_ECMP":
-        sel = ngc.EdgeSelection(
-            multi_edge=True,
-            require_capacity=True,
-            tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-        )
-        cfg = ngc.FlowPolicyConfig(
-            path_alg=ngc.PathAlg.SPF,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            selection=sel,
-            shortest_path=True,
-            max_flow_count=1,
+def diamond(a=5, b=3, c=1):
+    # input edges: 0: 0->1, 1: 1->3 (cap a, cost 1); 2: 0->2, 3: 2->3 (cap b, cost c)
+    return build(4, [(0, 1, a, 1), (1, 3, a, 1), (0, 2, b, c), (2, 3, b, c)])
+
+
+def test_configurations_are_structural_and_explicit():
+    with pytest.raises(TypeError):
+        ngc.FlowPolicyConfig(ngc.ShortestPaths(), ngc.Admission.LOSSLESS)
+    # Keyword-only; the routing is required, admission LOSSLESS by default. The
+    # allocations, the weights and the route choice are the model's: no keyword of the config.
+    # A wrong class is TypeError.
+    plain = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    assert plain.admission == ngc.Admission.LOSSLESS
+    with pytest.raises(TypeError):
+        ngc.FlowPolicyConfig(admission=ngc.Admission.LOSSLESS)
+    for kw in (
+        "selection",
+        "placement",
+        "origin",
+        "weights",
+        "edge_weights",
+        "bundles",
+    ):
+        with pytest.raises(TypeError):
+            ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), **{kw: None})
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(allocation=1)
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(source_allocation="EQUAL")
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(weight_basis="EXPLICIT")
+    with pytest.raises(TypeError, match="incompatible"):
+        ngc.ShortestPaths(
+            tunnels=ngc.TunnelCount(2)
+        )  # a field outside its routing variant: TypeError
+    with pytest.raises(TypeError, match="incompatible"):
+        ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.OPTIMIZED,
+            cost_ceiling=ngc.AbsoluteCost(4),
         )
-        return ngc.FlowPolicy(algs, gh, cfg)
-    if config == "TE_ECMP_16_LSP":
-        sel = ngc.EdgeSelection(
-            multi_edge=False,
-            require_capacity=True,
-            tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
+    with pytest.raises(TypeError, match="routing"):
+        config("ShortestPaths")
+    # T1: the tunnel count (a TunnelCount), the ceiling and the search minimum, every field as built.
+    ca = ngc.DistributedTE(
+        ngc.TunnelCount(2),
+        cost_ceiling=ngc.CostStretch(1.5),
+        min_unreserved_bandwidth=3,
+    )
+    assert (ca.tunnel_count, ca.cost_ceiling, ca.min_unreserved_bandwidth) == (
+        ngc.TunnelCount(2),
+        ngc.CostStretch(1.5),
+        3,
+    )
+    assert (ca.tunnel_count.per_head, ca.tunnel_count.up_to) == (2, False)
+    assert ngc.TunnelCount(3, up_to=True).up_to is True
+    d = ngc.DistributedTE(ngc.TunnelCount(1))
+    assert (d.cost_ceiling, d.min_unreserved_bandwidth) == (None, 0)
+    assert ngc.DistributedTE(
+        ngc.TunnelCount(1), cost_ceiling=ngc.AbsoluteCost(7)
+    ).cost_ceiling == ngc.AbsoluteCost(7)
+    with pytest.raises(TypeError):
+        ngc.DistributedTE()  # the tunnel count is required
+    with pytest.raises(TypeError):
+        ngc.DistributedTE(2)  # a TunnelCount, not an int
+    with pytest.raises(TypeError):
+        ngc.DistributedTE(
+            ngc.TunnelCount(1), ngc.AbsoluteCost(1)
+        )  # keyword-only after tunnels
+    with pytest.raises(TypeError):
+        ngc.TunnelCount(2, True)  # up_to is keyword-only
+    for bad, error, message in (
+        (
+            2**70,
+            ValueError,
+            "TunnelCount per_head = 1180591620717411303424 is out of range",
+        ),
+        (True, TypeError, "TunnelCount per_head must be an integer (got bool)"),
+        (1.5, TypeError, "TunnelCount per_head must be an integer (got float)"),
+    ):
+        with pytest.raises(
+            error, match=message.replace("(", r"\(").replace(")", r"\)")
+        ):
+            ngc.TunnelCount(bad)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "min_unreserved_bandwidth = 1208925819614629174706176 is out of range "
+            "[-9223372036854775808, 9223372036854775807]"
+        ),
+    ):
+        ngc.DistributedTE(ngc.TunnelCount(1), min_unreserved_bandwidth=2**80)
+    with pytest.raises(TypeError):
+        ngc.Pinned([[0, 1]])
+    cfg = ngc.FlowPolicyConfig(routing=ca)
+    assert isinstance(cfg.routing, ngc.DistributedTE)
+    assert cfg.routing.tunnel_count.per_head == 2
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.ShortestPaths(
+            allocation=ngc.RouteAllocation.EQUAL,
+            source_allocation=ngc.SourceAllocation.OPTIMIZED,
+        ),
+        admission=ngc.Admission.LOSSY,
+    )  # a plain value: the combination is checked where it is used
+    assert cfg.routing.allocation == ngc.RouteAllocation.EQUAL
+    assert cfg.admission == ngc.Admission.LOSSY
+    assert cfg.routing.source_allocation == ngc.SourceAllocation.OPTIMIZED
+    # The ineffective tie rule is checked where the model is used, not at construction.
+    tie = ngc.ShortestPaths(tie_break=HIGHER_AVAIL)
+    assert (tie.tie_break, tie.multipath, tie.parallel_edges) == (
+        HIGHER_AVAIL,
+        True,
+        True,
+    )
+    o = ngc.OutputOptions()
+    names = (
+        "edge_flows",
+        "residual",
+        "saturated_boundary_edges",
+        "edge_reservations",
+        "min_cut",
+    )
+    assert tuple(getattr(o, n) for n in names) == (False,) * 5
+    for k in range(len(names)):
+        flags = tuple(i == k for i in range(len(names)))
+        o = ngc.OutputOptions(**dict(zip(names, flags, strict=True)))
+        assert tuple(getattr(o, n) for n in names) == flags
+    # Pinned keeps its program and black holes by reference (one shared, immutable value each).
+    g = diamond()
+    a, b = dag_of(g, ids(g, [0, 1])), dag_of(g, ids(g, [2, 3]))
+    program = ngc.ForwardingProgram.from_routes(
+        g, 0, 3, [ngc.RouteDefinition(0, b), ngc.RouteDefinition(0, a)]
+    )
+    dark = g.eligibility(excluded_edges=ids(g, [0]))
+    pinned = ngc.Pinned(program, black_holes=dark)
+    assert pinned.program is program and pinned.black_holes is dark
+    assert ngc.Pinned(program).black_holes is None
+    # A policy's config is the configuration it was built with, ShortestPaths' absent source
+    # allocation and weight basis resolved to the allocation's defaults (Pinned has neither).
+    pol = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, ngc.FlowPolicyConfig(routing=pinned))
+    assert pol.config.routing.program is program
+    for allocation, source_allocation, weight_basis in (
+        (ngc.RouteAllocation.EQUAL, ngc.SourceAllocation.EQUAL, None),
+        (
+            ngc.RouteAllocation.WEIGHTED,
+            ngc.SourceAllocation.EQUAL,
+            ngc.WeightBasis.CAPACITY,
+        ),
+        (ngc.RouteAllocation.OPTIMIZED, ngc.SourceAllocation.OPTIMIZED, None),
+    ):
+        got = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            0,
+            3,
+            ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(allocation=allocation)),
+        ).config
+        assert (got.routing.source_allocation, got.routing.weight_basis) == (
+            source_allocation,
+            weight_basis,
         )
-        cfg = ngc.FlowPolicyConfig(
-            path_alg=ngc.PathAlg.SPF,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            selection=sel,
-            min_flow_count=16,
-            max_flow_count=16,
-            reoptimize_flows_on_each_placement=True,
-            # TE placement should not stop early due to tiny increments
-            # to ensure full utilization
+    got = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, GLOBAL).config
+    assert got.routing.source_allocation == ngc.SourceAllocation.OPTIMIZED
+    got = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1))),
+    ).config
+    assert (got.routing.tie_break, got.routing.parallel_edges) == (
+        ngc.RouteTieBreak.FEWER_HOPS,
+        True,
+    )
+    # The constructors' own checks: an integer field outside its C++ type raises ValueError; a
+    # field of the wrong class and an unknown keyword raise TypeError.
+    assert ngc.AbsoluteCost(2**63 - 1).cost == 2**63 - 1
+    assert ngc.AbsoluteCost(-(2**63)).cost == -(2**63)
+    for bad in (2**63, -(2**63) - 1):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                f"AbsoluteCost cost = {bad} is out of range [-9223372036854775808, 9223372036854775807]"
+            ),
+        ):
+            ngc.AbsoluteCost(bad)
+    with pytest.raises(
+        TypeError, match=exact("cost_ceiling must be AbsoluteCost, CostStretch or None")
+    ):
+        ngc.DistributedTE(ngc.TunnelCount(1), cost_ceiling=3)
+    with pytest.raises(TypeError):
+        ngc.DistributedTE(
+            ngc.TunnelCount(1), min_flow_bandwidth=2
+        )  # T0's field is gone
+
+
+class _ConversionFailed(Exception):
+    pass
+
+
+class _FailingFloat(np.float32):
+    # A NumPy floating scalar whose own conversion to a float fails.
+    def __float__(self):
+        raise _ConversionFailed("own float")
+
+
+class _FailingIndex:
+    # An object whose own conversion to an index fails.
+    def __index__(self):
+        raise _ConversionFailed("own index")
+
+
+class _OverflowingFloat(np.float32):
+    # A NumPy floating scalar whose own __float__ raises OverflowError.
+    def __float__(self):
+        raise OverflowError("own conversion")
+
+
+class _OverflowingIndex:
+    # An integer-like object whose own __index__ raises OverflowError.
+    def __index__(self):
+        raise OverflowError("own conversion")
+
+
+def test_validation_messages_before_binding():
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+
+    def rejects(cfg, msg, src=0):
+        with pytest.raises(ValueError, match=exact(msg)):
+            ngc.FlowPolicy(fg, src, 3, cfg)
+
+    stretch = "cost_ceiling CostStretch factor must be >= 1 (got {})"
+    rejects(
+        config(ngc.ShortestPaths(), ngc.RouteAllocation.OPTIMIZED, ngc.Admission.LOSSY),
+        LOSSY_KERNEL,
+    )
+    rejects(config(GLOBAL.routing, admission=ngc.Admission.LOSSY), CTE_LOSSY)
+    rejects(t1_config(0), "tunnel count must be in [1, 10000]")
+    rejects(t1_config(10001), "tunnel count must be in [1, 10000]")
+    rejects(
+        ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(2, up_to=True))),
+        "DistributedTE requires an exact tunnel count",
+    )
+    rejects(t1_config(1, cost_ceiling=ngc.CostStretch(0.5)), stretch.format("1/2"))
+    for bad in (-1, 2**62):
+        rejects(
+            t1_config(1, min_unreserved_bandwidth=bad),
+            "min_unreserved_bandwidth must be an integer in [0, 2^62)",
         )
-        return ngc.FlowPolicy(algs, gh, cfg)
-    raise AssertionError(f"Unknown config {config}")
-
-
-# Demands per graph
-EXPECTED: Dict[str, Tuple[Tuple[int, int], float]] = {
-    # key: graph fixture name; value: ((src,dst), demand)
-    "square1_graph": ((0, 2), 3.0),  # total cap 3
-    "line1_graph": ((0, 2), 7.0),  # total cap limited by 0->1 = 5
-    "graph3": ((0, 2), 10.0),  # total cap 10
-    "two_disjoint_shortest_graph": ((0, 3), 3.0),  # total cap 3
-    "square4_graph": ((0, 1), 350.0),  # total cap 350
-    "triangle1_graph": ((0, 2), 5.0),  # A->C direct cap 5, cheaper detours huge
-    "square3_graph": ((0, 2), 320.0),  # large demand to exercise tiers
-    "graph1_graph": ((0, 4), 1.0),
-    "graph2_graph": ((0, 4), 1.0),
-    "graph4_graph": ((0, 4), 6.0),
-}
-
-
-def _run_case(
-    g: ngc.StrictMultiDiGraph,
-    label: str,
-    src: int,
-    dst: int,
-    demand: float,
-    algs: ngc.Algorithms,
-    to_handle,
-):
-    for key in POLICY_CONFIGS:
-        fg = ngc.FlowGraph(g)
-        policy = make_policy(key, algs, to_handle(g))
-        placed, remaining = policy.place_demand(
-            fg, src, dst, flowClass=0, volume=demand
+    b = dag_of(g, ids(g, [0, 1]))
+    program = ngc.ForwardingProgram.from_routes(g, 0, 3, [ngc.RouteDefinition(0, b)])
+    rejects(
+        ngc.FlowPolicyConfig(routing=ngc.Pinned(program)),
+        "program endpoints do not match policy endpoints",
+        src=[0, 1],
+    )
+    rejects(
+        SHORTEST_PATHS,
+        "node 3 is in both endpoint sets: sources and destinations must not overlap",
+        src=[0, 3],
+    )
+    rejects(SHORTEST_PATHS, "sources: the node set is empty", src=[])
+    rejects(SHORTEST_PATHS, f"sources: node {L62} out of node range [0, 4)", src=[L62])
+    with pytest.raises(
+        ValueError, match=exact("foreign Eligibility: built for another graph")
+    ):
+        ngc.FlowPolicy(
+            fg, 0, 3, SHORTEST_PATHS, diamond().eligibility(excluded_edges=[0])
         )
+    with pytest.raises(
+        ValueError, match=exact("foreign ShortestPathCache: bound to another graph")
+    ):
+        ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, None, ngc.ShortestPathCache(diamond()))
+    # Arguments of the wrong kind are TypeError: a ledger of None, non-integer node ids, a ledger,
+    # config, eligibility or cache of the wrong class and an unknown keyword.
+    with pytest.raises(TypeError, match=exact("ledger must be a FlowLedger")):
+        ngc.FlowPolicy(None, 0, 3, SHORTEST_PATHS)
+    with pytest.raises(
+        TypeError, match=exact("sources[0] must be an integer (got float)")
+    ):
+        ngc.FlowPolicy(fg, [0.0], 3, SHORTEST_PATHS)
+    with pytest.raises(
+        TypeError, match=exact("destinations must be a sequence of integers")
+    ):
+        ngc.FlowPolicy(fg, 0, 3.0, SHORTEST_PATHS)
+    for wrong in (
+        lambda: ngc.FlowPolicy(g, 0, 3, SHORTEST_PATHS),
+        lambda: ngc.FlowPolicy(fg, 0, 3, ngc.ShortestPaths()),
+        lambda: ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, ngc.ShortestPathCache(g)),
+        lambda: ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, None, g.eligibility()),
+        lambda: ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, cash=None),
+    ):
+        with pytest.raises(TypeError):
+            wrong()
+    fg.reset()  # nothing bound
+    pol = ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS)
+    with pytest.raises(
+        TypeError, match=exact("outputs must be an OutputOptions (got ShortestPaths)")
+    ):
+        pol.place(1, ngc.ShortestPaths())
+    assert pol.records() == []
 
-        if key == "SHORTEST_PATHS_WCMP":
-            exp_total, _ = algs.max_flow(
-                to_handle(g),
-                src,
-                dst,
-                flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-                shortest_path=True,
-            )
-            expected = float(exp_total)
-            assert placed == pytest.approx(expected, rel=0, abs=1e-3), (
-                f"placed mismatch for {label}:{key}: got {placed}, expected ~{expected}"
-            )
-            assert remaining == pytest.approx(demand - expected, rel=0, abs=1e-3), (
-                f"remaining mismatch for {label}:{key}: got {remaining}, expected ~{demand - expected}"
-            )
 
-            # Check optimality
-            if placed > 0 and demand >= expected:
-                assert placed >= expected * 0.99, (
-                    f"placed {placed} is less than 99% of max_flow {expected} "
-                    f"for {label}:{key}"
-                )
-
-        elif key == "SHORTEST_PATHS_ECMP":
-            exp_total, _ = algs.max_flow(
-                to_handle(g),
-                src,
-                dst,
-                flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-                shortest_path=True,
-            )
-            expected = float(exp_total)
-            assert placed == pytest.approx(expected, rel=0, abs=1e-3), (
-                f"placed mismatch for {label}:{key}: got {placed}, expected ~{expected}"
-            )
-            assert remaining == pytest.approx(demand - expected, rel=0, abs=1e-3), (
-                f"remaining mismatch for {label}:{key}: got {remaining}, expected ~{demand - expected}"
-            )
+LOSSY_KERNEL = "ShortestPaths OPTIMIZED requires admission=LOSSLESS"
+CTE_LOSSY = "CentralizedTE without tunnel_count requires admission=LOSSLESS"
+P = ngc.RouteAllocation
+A = ngc.Admission
+ORIGIN = ngc.SourceAllocation
+HC = ngc.RouteTieBreak.HIGHER_CAPACITY
 
-            # Verify ECMP equal balancing
-            if placed > 0:
-                flows = policy.flows
-                volumes = [v[3] for v in flows.values()]
-                if len(volumes) > 1:
-                    for vol in volumes:
-                        assert vol == pytest.approx(volumes[0], abs=1e-3), (
-                            f"ECMP violation for {label}:{key}: "
-                            f"volumes not equal: {volumes}"
-                        )
-
-        elif key == "TE_ECMP_16_LSP":
-            # TE-like full mode: placement should not exceed max_flow, and accounting must hold
-            exp_total, _ = algs.max_flow(
-                to_handle(g),
-                src,
-                dst,
-                flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-                shortest_path=False,
-            )
-            expected = float(exp_total)
-            assert placed <= expected + 1e-3, (
-                f"placed exceeds max_flow for {label}:{key}: got {placed}, max {expected}"
-            )
-            assert (placed + remaining) == pytest.approx(demand, rel=0, abs=1e-6), (
-                f"accounting mismatch for {label}:{key}: placed+remaining={placed + remaining}, demand={demand}"
-            )
 
-            # Verify flow count
-            flow_count = policy.flow_count()
-            assert flow_count == 16 or flow_count == 0, (
-                f"TE_ECMP_16_LSP should create exactly 16 flows (or 0 if no path), "
-                f"got {flow_count} for {label}:{key}"
-            )
+def T1():
+    return ngc.DistributedTE(ngc.TunnelCount(1))
+
 
-            # Verify ECMP balancing
-            if placed > 0 and flow_count > 0:
-                flows = policy.flows
-                volumes = [v[3] for v in flows.values()]
-                if len(volumes) > 1:
-                    for vol in volumes:
-                        assert vol == pytest.approx(volumes[0], abs=1e-3), (
-                            f"TE ECMP violation for {label}:{key}: "
-                            f"LSPs not equal: {volumes}"
-                        )
-        else:
-            raise AssertionError(f"Unknown policy key {key}")
+INEFFECTIVE = "ShortestPaths tie_break requires multipath=False or parallel_edges=False"
 
 
 @pytest.mark.parametrize(
-    "fixture_name",
+    ("routing", "admission", "msg"),
     [
-        "square1_graph",
-        "line1_graph",
-        "graph3",
-        "two_disjoint_shortest_graph",
-        "square4_graph",
-        "triangle1_graph",
-        "square3_graph",
-        "graph1_graph",
-        "graph2_graph",
-        "graph4_graph",
+        # The rows of the matrix, their checks in order: the source allocation, admission, the
+        # ineffective tie rule (a HIGHER_* tie_break over every route and parallel edge),
+        # prefer_headroom, the weights, the tunnel count.
+        (
+            lambda: ngc.CentralizedTE(
+                source_allocation=ORIGIN.EQUAL, prefer_headroom=True
+            ),
+            A.LOSSY,
+            CTE_LOSSY,
+        ),
+        (
+            lambda: ngc.ShortestPaths(
+                allocation=P.EQUAL, source_allocation=ORIGIN.OPTIMIZED, tie_break=HC
+            ),
+            A.LOSSY,
+            "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL",
+        ),
+        (
+            lambda: ngc.ShortestPaths(allocation=P.OPTIMIZED, tie_break=HC),
+            A.LOSSY,
+            LOSSY_KERNEL,
+        ),
+        (
+            lambda: ngc.ShortestPaths(
+                allocation=P.OPTIMIZED, source_allocation=ORIGIN.EQUAL, tie_break=HC
+            ),
+            A.LOSSLESS,
+            INEFFECTIVE,
+        ),
+        (lambda: ngc.ShortestPaths(tie_break=HC), A.LOSSY, INEFFECTIVE),
+        (
+            lambda: ngc.ShortestPaths(
+                tie_break=HC, weight_basis=ngc.WeightBasis.CAPACITY
+            ),
+            A.LOSSLESS,
+            INEFFECTIVE,
+        ),
+        (
+            lambda: ngc.ShortestPaths(edge_weights=[1, 1, 1, 1, 1]),
+            A.LOSSY,
+            "edge_weights require weight_basis=EXPLICIT",
+        ),
+        (
+            lambda: ngc.DistributedTE(
+                ngc.TunnelCount(1, up_to=True), cost_ceiling=ngc.CostStretch(0.5)
+            ),
+            A.LOSSY,
+            "DistributedTE requires an exact tunnel count",
+        ),
     ],
 )
-def test_policy_placement_modes_match_maxflow_reference(
-    fixture_name, algs, to_handle, request
+def test_several_defects_report_the_first_in_the_contract_order(
+    routing, admission, msg
 ):
-    """Validates that FlowPolicy placement matches max_flow for various configurations.
-
-    Tests PROPORTIONAL vs EQUAL_BALANCED vs TE_ECMP across different topologies,
-    ensuring placed+remaining accounting is correct and results match max_flow reference.
-    """
-    g = request.getfixturevalue(fixture_name)
-    (src, dst), dem = EXPECTED[fixture_name]
-    _run_case(g, fixture_name, src, dst, dem, algs, to_handle)
-
-
-def test_flow_costs_match_expected(algs, to_handle):
-    """Verify reported costs match known path costs on simple topologies."""
-    # Simple 3-node chain: 0 -> 1 -> 2
-    # Edge 0->1: cost 10
-    # Edge 1->2: cost 20
-    # Expected path cost: 30
-    g = ngc.StrictMultiDiGraph.from_arrays(
+    # Several defects at once: one exact ValueError text, the first in the matrix's order, at
+    # construction and at the three evaluators (evaluate_pairs's precheck included); nothing is
+    # bound.
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+    cfg = ngc.FlowPolicyConfig(routing=routing(), admission=admission)
+    with pytest.raises(ValueError) as e:
+        ngc.FlowPolicy(fg, 0, 3, cfg)
+    assert str(e.value) == msg
+    with pytest.raises(ValueError) as e:
+        ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(cfg))
+    assert str(e.value) == msg
+    with pytest.raises(ValueError) as e:
+        ngc.evaluate_pairs(g, [(0, 3)], ngc.EvaluationOptions(cfg))
+    assert str(e.value) == msg
+    with pytest.raises(ValueError) as e:
+        ngc.evaluate_edge_failures(g, 0, 3, ngc.EvaluationOptions(cfg), 1)
+    assert str(e.value) == msg
+    fg.reset()  # nothing bound
+
+
+def test_enum_values_outside_their_enumeration_are_rejected():
+    # An enum built from an integer outside the enumeration is a domain error named by its field:
+    # FlowPolicyConfig and the models are plain values, checked wherever they are used, first
+    # among their checks, so it never reaches a policy or record; the searches check their own.
+    bad_tie = ngc.RouteTieBreak(99)
+    for options, search in (
+        (ngc.SpfOptions(ngc.Direction.FORWARD, tie_break=bad_tie), ngc.spf),
+        (ngc.KspOptions(1, tie_break=bad_tie), lambda g, s, o: ngc.ksp(g, s, 3, o)),
+    ):
+        with pytest.raises(
+            ValueError, match=exact("tie_break: 99 is not a value of RouteTieBreak")
+        ):
+            search(diamond(), 0, options)
+    g = diamond()
+    bad_source = "source_allocation: 99 is not a value of SourceAllocation"
+    cases = [
+        (
+            ngc.ShortestPaths(allocation=ngc.RouteAllocation(99)),
+            "allocation: 99 is not a value of RouteAllocation",
+        ),
+        (ngc.ShortestPaths(source_allocation=ORIGIN(99)), bad_source),
+        (
+            ngc.ShortestPaths(allocation=P.WEIGHTED, weight_basis=ngc.WeightBasis(99)),
+            "weight_basis: 99 is not a value of WeightBasis",
+        ),
+        (ngc.CentralizedTE(source_allocation=ORIGIN(99)), bad_source),
+    ]
+    for routing in (ngc.ShortestPaths(), T1(), GLOBAL.routing):
+        cases.append(
+            (
+                ngc.FlowPolicyConfig(routing=routing, admission=ngc.Admission(99)),
+                "admission: 99 is not a value of Admission",
+            )
+        )
+    for cfg, message in cases:
+        if not isinstance(cfg, ngc.FlowPolicyConfig):
+            cfg = ngc.FlowPolicyConfig(routing=cfg)
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg)
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.evaluate_demand(g, 0, 3, ngc.EvaluationOptions(cfg))
+    for routing in (
+        ngc.ShortestPaths(tie_break=bad_tie),
+        ngc.DistributedTE(ngc.TunnelCount(1), tie_break=bad_tie),
+    ):
+        cfg = ngc.FlowPolicyConfig(routing=routing, admission=ngc.Admission(98))
+        message = (
+            "admission: 98 is not a value of Admission"  # the config's own enums first
+        )
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg)
+        cfg = ngc.FlowPolicyConfig(routing=routing)
+        with pytest.raises(
+            ValueError, match=exact("tie_break: 99 is not a value of RouteTieBreak")
+        ):
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, cfg)
+    assert len(ngc.RouteAllocation.__members__) == 3  # the loop below is not empty
+    for valid in ngc.RouteAllocation.__members__.values():
+        assert config(ngc.ShortestPaths(), valid).routing.allocation == valid
+
+
+def test_placement_result_fields_and_outputs():
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+    pol = ngc.FlowPolicy(fg, [0], [3], SHORTEST_PATHS)
+    r = pol.place(4)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (4, 0, T.COMPLETE)
+    assert not hasattr(r, "local_outcomes")
+    # The epoch's first call installs the program: its routes and weights.
+    assert (r.routes_changed, r.weights_changed, r.call_edge_drops) == (True, True, [])
+    assert (r.delivery_delta, r.call_source_drops, r.edge_drops, r.source_drops) == (
+        4,
+        0,
+        [],
+        0,
+    )
+    assert (r.requested, r.offered, r.admitted, r.delivered, r.unadmitted) == (
+        4,
+        None,
+        4,
+        4,
+        0,
+    )
+    row = r.by_source[0]
+    assert isinstance(r.by_source, tuple) and len(r.by_source) == 1
+    assert (row.source, row.offered, row.admitted, row.delivered) == (0, None, 4, 4)
+    assert (row.source_drops, row.total_edge_drops) == (0, 0)
+    with pytest.raises(TypeError):
+        ngc.SourceFlow()
+    assert_read_only(row, "delivered")
+    assert r.marginal_cost_curve is None and r.total_cost is None
+    assert (
+        r.edge_flows is None
+        and r.residual is None
+        and r.saturated_boundary_edges is None
+        and r.min_cut is None
+    )
+    r = pol.place(INF, ALL_OUT)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (
         3,
-        np.array([0, 1], dtype=np.int32),
-        np.array([1, 2], dtype=np.int32),
-        np.array([100.0, 100.0], dtype=np.float64),
-        np.array([10, 20], dtype=np.int64),
-        np.array([0, 1], dtype=np.int64),
+        INF,
+        T.EXHAUSTED,
     )
+    assert r.edge_flows.dtype == np.int64 and r.residual.dtype == np.int64
+    assert list(r.residual) == list(fg.residual())
+    own = [0] * 4
+    for rec in pol.records():
+        for e, x in rec.edge_flows:
+            own[e] += x
+    assert list(r.edge_flows) == own
+    assert r.saturated_boundary_edges == fg.saturated_boundary_edges(0)
+    # By hand: the flow's 7 units split equally at node 0, the leftover unit to the lower
+    # EdgeId: 4 on 0 -> 1 -> 3 and 3 on 0 -> 2 -> 3, the most that keeps 0 -> 2 within its 3.
+    # Only 0 -> 2 is saturated where it leaves what the source still reaches.
+    assert r.edge_flows.tolist() == to_ids(g, [4, 4, 3, 3])
+    assert r.residual.tolist() == to_ids(g, [1, 1, 0, 0])
+    assert r.saturated_boundary_edges == ids(g, [2])
+    assert r.min_cut is None  # CentralizedTE only
+    assert pol.delivered() == 7
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        pol.place(1.5)
+    with pytest.raises(_ConversionFailed):  # a float request whose own conversion fails
+        pol.place(_FailingFloat(1.0))
+    for bad in (_OverflowingFloat(1.0), _OverflowingIndex()):  # its OverflowError too
+        with pytest.raises(OverflowError, match=exact("own conversion")):
+            pol.place(bad)
+    with pytest.raises(
+        ValueError,
+        match=exact("finite placement after infinite placement requires a new epoch"),
+    ):
+        pol.place(np.int64(1))
+    pol.remove()
+    assert pol.records() == [] and list(fg.carried()) == [0, 0, 0, 0]
+    assert pol.place(np.int64(2)).call_delivered == 2
+    # CentralizedTE: the marginal curve; min_cut with bottleneck.
+    fg2 = ngc.FlowLedger(diamond(5, 3, 2))
+    gl = ngc.FlowPolicy(fg2, 0, 3, GLOBAL)
+    r = gl.place(INF, ngc.OutputOptions(saturated_boundary_edges=True))
+    assert r.marginal_cost_curve == [(2, 5), (4, 3)] and r.min_cut is None
+    gl.remove()
+    r = gl.place(INF, ngc.OutputOptions(min_cut=True))
+    assert r.min_cut == sorted(ids(diamond(5, 3, 2), [0, 2]))
+    assert [rec.delivered for rec in gl.records()] == [8]
 
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
 
-    placed, _ = policy.place_demand(fg, 0, 2, flowClass=0, volume=50.0)
+def test_lifetimes_keep_alive_and_orphans():
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+    el = g.eligibility(excluded_edges=ids(g, [2]))
+    cache = ngc.ShortestPathCache(g)
+    pol = ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, el, cache)
+    held = [weakref.ref(x) for x in (fg, el, cache)]
+    del fg, el, cache
+    gc.collect()
+    assert all(r() is not None for r in held)
+    assert (
+        pol.place(10).call_delivered == 5
+    )  # the ledger, the Eligibility and the cache are alive
+    del pol
+    gc.collect()
+    assert all(r() is None for r in held)  # the policy alone held them
+    fg2 = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(fg2, 0, 3, SHORTEST_PATHS)
+    p.place(2)
+    del p
+    gc.collect()
+    if HOOKS:
+        assert fg2._state()["orphans"] == [0]
+    assert fg2.records()[0].delivered == 2
+    with pytest.raises(ValueError, match="bound"):
+        q = ngc.FlowPolicy(fg2, 0, 3, SHORTEST_PATHS)
+        fg2.reset()
+    del q
+    gc.collect()
+    fg2.reset()
+    assert fg2.records() == []
 
-    assert placed > 0, "Should place flow on simple chain"
-    assert len(policy.flows) == 1, "Should create exactly one flow"
 
-    # Check reported cost
-    flow_info = list(policy.flows.values())[0]
-    src, dst, cost, volume = flow_info
+@needs_hooks
+def test_owner_hook_is_the_owner_of_the_records():
+    # The private hook FlowPolicy._owner reads the ledger-local owner id: one per policy of a
+    # ledger, known before the policy has a record, and carried by its records as FlowRecord.policy_id.
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+    policies = [ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS) for _ in range(3)]
+    owners = [p._owner() for p in policies]
+    assert len(set(owners)) == 3
+    for p in reversed(policies):
+        assert p.place(1).call_delivered == 1
+    for p, owner in zip(policies, owners, strict=True):
+        assert [r.policy_id for r in p.records()] == [owner]
 
-    assert cost == 30, f"Cost should be 30 (10+20), got {cost}"
 
-    # Test with parallel edges of different costs
-    # 0 -> 1 (cost 5)
-    # 1 -> 2 via edge A (cost 10) or edge B (cost 20)
-    # Shortest path: 0->1->2A, cost = 15
-    g2 = ngc.StrictMultiDiGraph.from_arrays(
+def pinned_over(g, *dags):
+    """Pinned over a program of the split routes `dags` of head 0 to node 3."""
+    program = ngc.ForwardingProgram.from_routes(
+        g, 0, 3, [ngc.RouteDefinition(0, d) for d in dags]
+    )
+    return ngc.FlowPolicyConfig(routing=ngc.Pinned(program))
+
+
+def test_pinned_records():
+    g = diamond()
+    fg = ngc.FlowLedger(g)
+    r1, r2 = dag_of(g, ids(g, [0, 1])), dag_of(g, ids(g, [2, 3]))
+    el = g.eligibility(excluded_edges=ids(g, [3]))
+    # The replay fails the second route (its last edge excluded): the head's share goes to the
+    # first; one record per program entry, the failed one with an empty route.
+    pol = ngc.FlowPolicy(fg, 0, 3, pinned_over(g, r1, r2), el)
+    r = pol.place(9)
+    assert (r.call_delivered, r.termination) == (5, T.EXHAUSTED)
+    rec, failed = pol.records()
+    assert rec.route == r1 and pol.record(rec.flow_id).delivered == 5
+    assert (rec.entry_id, failed.entry_id, failed.min_route_cost) == (0, 1, None)
+    # record() reads the policy's own records only, not another policy's on the same ledger.
+    other = ngc.FlowPolicy(fg, 0, 3, pinned_over(g, r1))
+    other.place(1)
+    theirs = other.records()[0].flow_id
+    with pytest.raises(
+        ValueError, match=exact(f"FlowId {theirs} is not a record of this policy")
+    ):
+        pol.record(theirs)
+    assert fg.record(theirs).delivered == 0
+    elsewhere = ngc.FlowLedger(g).uid()
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            f"FlowId ({elsewhere}, 0) belongs to another ledger (uid {fg.uid()})"
+        ),
+    ):
+        pol.record((elsewhere, 0))
+    pol.remove()
+    with pytest.raises(
+        ValueError, match=exact(f"FlowId {rec.flow_id} is retired or unknown")
+    ):
+        pol.record(rec.flow_id)
+    all_down = ngc.FlowPolicy(
+        fg, 0, 3, pinned_over(g, r2), g.eligibility(excluded_edges=ids(g, [3]))
+    )
+    r = all_down.place(1)
+    assert (r.call_delivered, r.termination, r.by_source[0].admitted) == (
+        0,
+        T.NO_ROUTE,
+        0,
+    )
+
+
+def test_dag_cache_statistics_and_projection():
+    g = diamond()
+    cache = ngc.ShortestPathCache(g)
+    fg = ngc.FlowLedger(g)
+    a = ngc.FlowPolicy(fg, 0, 3, SHORTEST_PATHS, None, cache)
+    b = ngc.FlowPolicy(
+        fg,
+        0,
         3,
-        np.array([0, 1, 1], dtype=np.int32),
-        np.array([1, 2, 2], dtype=np.int32),
-        np.array([100.0, 100.0, 100.0], dtype=np.float64),
-        np.array([5, 10, 20], dtype=np.int64),
-        np.array([0, 1, 2], dtype=np.int64),
+        config(
+            ngc.ShortestPaths(
+                tie_break=HIGHER_AVAIL, multipath=False, parallel_edges=False
+            )
+        ),
+        None,
+        cache,
+    )
+    s = cache.stats()
+    assert (s.hits, s.misses, s.entries, s.live_values) == (1, 1, 1, 1)
+    assert s.bytes > 0
+    assert a.place(2).call_delivered == 2 and b.place(2).call_delivered == 2
+    cache.clear()
+    s = cache.stats()
+    assert (s.hits, s.misses, s.entries, s.bytes) == (1, 1, 0, 0)
+    assert s.live_values == 1  # held by the policies
+    assert cache.graph_uid() == g.uid()
+
+
+def test_capacity_batch_and_workers(monkeypatch):
+    g = diamond(5, 3)
+    opts = ngc.EvaluationOptions(GLOBAL, outputs=ngc.OutputOptions(edge_flows=True))
+    r = ngc.evaluate_demand(g, 0, 3, opts)
+    assert (r.call_delivered, r.termination, r.marginal_cost_curve) == (
+        8,
+        T.EXHAUSTED,
+        [(2, 8)],
+    )
+    assert int(np.sum(r.edge_flows)) == 16
+    common = g.eligibility(excluded_edges=ids(g, [3]))
+    pairs = [(0, 3), ([0], [3]), (1, 3), (0, [1, 2])]
+    per = [None, g.eligibility(excluded_edges=ids(g, [0])), None, None]
+    want = [5, 0, 5, 8]
+    for workers in (1, 3, None):
+        got = ngc.evaluate_pairs(
+            g, pairs, ngc.EvaluationOptions(GLOBAL, eligibility=common), per, workers
+        )
+        assert [x.call_delivered for x in got] == want
+    # workers=None reads NGRAPH_CORE_BATCH_THREADS. The count changes only how many threads run,
+    # never a result, so this checks only that the default path with the variable set gives the
+    # same results (its parsing: the C++ test Evaluators.DefaultWorkersParseTheEnvironment).
+    monkeypatch.setenv("NGRAPH_CORE_BATCH_THREADS", "4")
+    got = ngc.evaluate_pairs(
+        g, pairs, ngc.EvaluationOptions(GLOBAL, eligibility=common), per
+    )
+    assert [x.call_delivered for x in got] == want
+    assert ngc.evaluate_pairs(g, [], ngc.EvaluationOptions(GLOBAL)) == []
+    with pytest.raises(ValueError, match="node 7"):
+        ngc.evaluate_pairs(
+            g, [(0, 3), (0, 7), (0, 8)], ngc.EvaluationOptions(GLOBAL), workers=4
+        )
+    with pytest.raises(
+        ValueError, match=exact("per_pair_eligibility has 1 entries for 4 pairs")
+    ):
+        ngc.evaluate_pairs(g, pairs, ngc.EvaluationOptions(GLOBAL), [None])
+    with pytest.raises(
+        ValueError, match=exact("evaluate_pairs does not accept Pinned")
+    ):
+        ngc.evaluate_pairs(
+            g,
+            pairs,
+            ngc.EvaluationOptions(pinned_over(g, dag_of(g, ids(g, [0, 1])))),
+        )
+    cache = ngc.ShortestPathCache(g)
+    eb = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    with pytest.raises(ValueError, match="workers == 1"):
+        ngc.evaluate_pairs(g, pairs, eb, workers=2)
+    got = ngc.evaluate_pairs(
+        g, pairs, eb
+    )  # None with a cache: 1 worker, even with the env set
+    assert [x.call_delivered for x in got] == [
+        7,
+        7,
+        5,
+        7,
+    ]  # EB: [4, 3] over links of 5 and 3
+    with pytest.raises(ValueError, match="workers"):
+        ngc.evaluate_pairs(g, pairs, ngc.EvaluationOptions(GLOBAL), workers=0)
+
+
+def test_edge_failures_candidates_and_signed_reductions(monkeypatch):
+    # CentralizedTE: an unsaturated critical edge appears.
+    g = build(3, [(0, 1, 9, 1), (1, 2, 4, 1), (0, 2, 2, 5)])
+    s = ngc.evaluate_edge_failures(g, 0, 2, ngc.EvaluationOptions(GLOBAL))
+    assert s.baseline.call_delivered == 6
+    pos = g.input_positions()
+    assert {int(pos[e.edge]): e.delivery_reduction for e in s.entries} == {
+        0: 4,
+        1: 4,
+        2: 2,
+    }
+    # workers=None reads NGRAPH_CORE_SENSITIVITY_THREADS: the same results on 3 workers (only that
+    # the default path with the variable set works; its parsing is tested in C++).
+    monkeypatch.setenv("NGRAPH_CORE_SENSITIVITY_THREADS", "3")
+    assert plain(
+        ngc.evaluate_edge_failures(g, 0, 2, ngc.EvaluationOptions(GLOBAL))
+    ) == plain(s)
+    # A policy model: every allowed edge is a candidate, a zero-capacity one too. Equal splitting
+    # over parallel links of 1, 10 and 0 fits 2 units (a third would cross the zero link);
+    # without the thin link 1 fits, without the wide link 1, without the zero link 2.
+    p = build(2, [(0, 1, 1, 1), (0, 1, 10, 1), (0, 1, 0, 1)])
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS)
+    s = ngc.evaluate_edge_failures(p, 0, 1, opts, workers=2)
+    assert s.baseline.call_delivered == 2
+    pos = p.input_positions()
+    assert {int(pos[e.edge]): e.delivery_reduction for e in s.entries} == {
+        0: 1,
+        1: 1,
+        2: 0,
+    }
+    # A negative loss on a zero-capacity link (the search graph S): the only shortest route 0 -> 1 has capacity
+    # 0, so equal splitting carries 0; without it the route 0 -> 2 -> 1 carries 5.
+    g8 = build(3, [(0, 1, 0, 1), (0, 2, 5, 1), (2, 1, 5, 1)])
+    s8 = ngc.evaluate_edge_failures(g8, 0, 1, opts)
+    assert s8.baseline.call_delivered == 0
+    pos8 = g8.input_positions()
+    assert {int(pos8[e.edge]): e.delivery_reduction for e in s8.entries} == {
+        0: -5,
+        1: 0,
+        2: 0,
+    }
+    with pytest.raises(ValueError, match="both endpoint sets"):
+        ngc.evaluate_edge_failures(p, 0, 0, opts)
+    # The baseline is evaluate_demand() with the requested outputs.
+    for cfg in (GLOBAL, SHORTEST_PATHS):
+        s = ngc.evaluate_edge_failures(
+            g, 0, 2, ngc.EvaluationOptions(cfg, outputs=ALL_OUT)
+        )
+        want = ngc.evaluate_demand(g, 0, 2, ngc.EvaluationOptions(cfg, outputs=ALL_OUT))
+        assert want.edge_flows is not None and want.residual is not None
+        assert plain(s.baseline) == plain(want)
+
+
+def test_evaluator_options_and_results():
+    # The options hold what they were given (None: everything allowed, no supplied cache, no
+    # output); the results have no public constructor.
+    g = diamond()
+    el = g.eligibility(excluded_edges=ids(g, [0]))
+    cache = ngc.ShortestPathCache(g)
+    for cls in (ngc.EvaluationOptions, ngc.EvaluationOptions):
+        o = cls(
+            GLOBAL,
+            eligibility=el,
+            cache=cache,
+            outputs=ngc.OutputOptions(residual=True),
+        )
+        assert (
+            o.config.routing.source_allocation == GLOBAL.routing.source_allocation
+            and o.eligibility is el
+            and o.cache is cache
+        )
+        out = o.outputs
+        assert (out.edge_flows, out.residual, out.saturated_boundary_edges) == (
+            False,
+            True,
+            False,
+        )
+        d = cls(SHORTEST_PATHS)
+        assert d.eligibility is None and d.cache is None
+        assert (
+            d.outputs.edge_flows,
+            d.outputs.residual,
+            d.outputs.saturated_boundary_edges,
+        ) == (
+            False,
+            False,
+            False,
+        )
+    for cls in (ngc.SensitivityEntry, ngc.SensitivityResult):
+        with pytest.raises(TypeError, match="No constructor defined"):
+            cls()
+
+
+def test_explicit_workers_win_over_the_environment(monkeypatch):
+    # The environment supplies only the default of workers=None, which is 1 whenever a cache is
+    # supplied; an explicit count is always honoured (a building cache accepts only 1).
+    monkeypatch.setenv("NGRAPH_CORE_BATCH_THREADS", "4")
+    monkeypatch.setenv("NGRAPH_CORE_SENSITIVITY_THREADS", "4")
+    g = diamond(5, 3)
+    building = ngc.ShortestPathCache(g)
+    bopts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=building)
+    sopts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=building)
+    want = [
+        r.call_delivered
+        for r in ngc.evaluate_pairs(g, [(0, 3), (1, 3)], bopts, workers=1)
+    ]
+    assert want == [7, 5]
+    assert [
+        r.call_delivered for r in ngc.evaluate_pairs(g, [(0, 3), (1, 3)], bopts)
+    ] == want
+    base = plain(ngc.evaluate_edge_failures(g, 0, 3, sopts, workers=1))
+    assert plain(ngc.evaluate_edge_failures(g, 0, 3, sopts)) == base
+    for call in (
+        lambda: ngc.evaluate_pairs(g, [(0, 3)], bopts, workers=2),
+        lambda: ngc.evaluate_edge_failures(g, 0, 3, sopts, workers=2),
+    ):
+        with pytest.raises(ValueError, match="unless workers == 1"):
+            call()
+    with pytest.raises(ValueError, match=exact("workers must be >= 1 (got 0)")):
+        ngc.evaluate_edge_failures(g, 0, 3, ngc.EvaluationOptions(GLOBAL), workers=0)
+
+
+def test_python_keeps_what_a_policy_and_an_option_need_alive():
+    # Once the caller drops them, the evaluators' options still apply their Eligibility and cache,
+    # the ledger still reads its graph, and a policy still places on its ledger. Graphs of the
+    # same shape are built in between, so the memory of a released value would be reused.
+    g = diamond()
+    want = [
+        g.edge_capacity_units().tolist(),
+        g.edge_costs().tolist(),
+        g.edge_destinations().tolist(),
+    ]
+    ledger = ngc.FlowLedger(g)
+    policy = ngc.FlowPolicy(ledger, 0, 3, SHORTEST_PATHS)
+    opts = ngc.EvaluationOptions(
+        SHORTEST_PATHS,
+        eligibility=g.eligibility(excluded_edges=ids(g, [2])),
+        cache=ngc.ShortestPathCache(g),
     )
+    gc.collect()
+    reused = [diamond(7, 9, 2) for _ in range(64)]
+    assert (
+        ngc.evaluate_demand(g, 0, 3, opts).call_delivered == 5
+    )  # without the edge 0 -> 2
+    assert opts.cache.stats().misses == 1  # the call's lookup
+    del g, opts
+    gc.collect()
+    reused += [diamond(7, 9, 2) for _ in range(64)]
+    kept = ledger.graph()
+    assert [
+        kept.edge_capacity_units().tolist(),
+        kept.edge_costs().tolist(),
+        kept.edge_destinations().tolist(),
+    ] == want
+    del kept, ledger
+    gc.collect()
+    reused += [diamond(7, 9, 2) for _ in range(64)]
+    assert policy.place(10).call_delivered == 7  # Equal over routes of 5 and 3: [4, 3]
+    assert len(reused) == 192
+
+
+def test_exception_classes_of_conversions():
+    # An integer beyond the float range is an accepted type with a value outside the domain, a
+    # ValueError, both where a float is expected (the resolution) and as a request (integer
+    # units). A request's own conversion failure reaches the caller unchanged.
+    for call in (
+        lambda: ngc.Graph(2, [0], [1], [5], [1], 10**400),
+        lambda: ngc.to_units(1.0, 10**400),
+        lambda: ngc.as_float(1, 10**400),
+    ):
+        with pytest.raises(
+            ValueError,
+            match=exact("resolution must be a power of two in [2^-32, 2^32]"),
+        ) as error:
+            call()
+        assert error.type is ValueError
+    g = build(2, [(0, 1, 5, 1)])
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, SHORTEST_PATHS)
+    for big in (10**400, -(10**400)):
+        with pytest.raises(
+            ValueError,
+            match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+        ):
+            p.place(big)
+    # An index's own failure (a float's: test_placement_result_fields_and_outputs).
+    with pytest.raises(_ConversionFailed):
+        p.place(_FailingIndex())
+    assert p.delivered() == 0
+
+
+@needs_hooks
+@pytest.mark.parametrize("routing", ["shortest_paths", "global", "weighted"])
+@pytest.mark.parametrize("traced", [False, True])
+def test_python_publication_is_all_or_nothing(routing, traced):
+    # Every Python object of a placement exists before anything is published, so the k-th
+    # Python allocation failing raises with the ledger and the policy unchanged (an earlier
+    # call's flow in the same epoch included), never crashes, and a retry places as a call
+    # without failure does.
+    cfg = GLOBAL if routing == "global" else SHORTEST_PATHS
+    if routing == "weighted":
+        cfg = config(
+            ngc.CentralizedTE(
+                source_allocation=ngc.SourceAllocation.WEIGHTED,
+                source_weights=[1001, 0],
+            )
+        )
+    g = build(2, [(0, 1, 10, 1)])
+
+    for entry in (
+        ("_place_traced",) if traced else ("place", "replace", "forward", "evaluate")
+    ):
+        current_probe = []
 
-    fg2 = ngc.FlowGraph(g2)
-    config2 = ngc.FlowPolicyConfig()
-    config2.multipath = False
-    config2.shortest_path = True
-    policy2 = ngc.FlowPolicy(algs, to_handle(g2), config2)
+        def make(entry=entry, current_probe=current_probe):
+            ledger = ngc.FlowLedger(g)
+            policy = ngc.FlowPolicy(ledger, 0, 1, cfg)
+            assert policy.place(1).call_delivered == 1
+            probe = ext._ConcurrencyProbe()
+            current_probe[:] = [probe]
+
+            def snapshot():
+                return [
+                    full_ledger_state(ledger),
+                    repr(policy._state()),
+                    probe.counts()["native_begin"],
+                ]
+
+            return getattr(policy, entry), (3,), snapshot
+
+        def allocation_call(fn, args, k, current_probe=current_probe):
+            probe = current_probe[0]
+            result = probe.run(ext._fail_python_allocation, fn, args, k)
+            if not result[0]:
+                assert probe.counts()["native_begin"] == 1
+            return result
+
+        # Each scalar entry owns its result allocation path. Not vacuous: the result
+        # object at least; traced, also the pair and trace. Retry must return every field.
+        assert sweep_python_allocation(make, allocation_call=allocation_call) >= (
+            3 if traced else 1
+        ), entry
+
+
+@needs_hooks
+def test_evaluator_results_survive_python_allocation_failures():
+    # Fixed evaluator result objects exist before native entry, even without a supplied cache.
+    # A failed Python allocation raises before native work; the completed call matches a clean call.
+    g = diamond(5, 3)
+    calls = [
+        (ngc.evaluate_demand, (g, 0, 3, ngc.EvaluationOptions(GLOBAL))),
+        (ngc.evaluate_pairs, (g, [(0, 3), (1, 3)], ngc.EvaluationOptions(GLOBAL))),
+        # Node sets given as lists: the call makes no temporary list, so the result list itself
+        # is a new allocation the sweep reaches.
+        (
+            ngc.evaluate_pairs,
+            (g, [([0], [3]), ([1], [3])], ngc.EvaluationOptions(GLOBAL)),
+        ),
+        (ngc.evaluate_edge_failures, (g, 0, 3, ngc.EvaluationOptions(GLOBAL))),
+    ]
+    for fn, args in calls:
+        current_probe = []
+
+        def make(fn=fn, args=args, current_probe=current_probe):
+            probe = ext._ConcurrencyProbe()
+            current_probe[:] = [probe]
+            return fn, args, lambda: probe.counts()["native_begin"]
+
+        def allocation_call(fn, args, k, current_probe=current_probe):
+            probe = current_probe[0]
+            result = probe.run(ext._fail_python_allocation, fn, args, k)
+            if not result[0]:
+                assert probe.counts()["native_begin"] == 1
+            return result
+
+        failures = sweep_python_allocation(make, allocation_call=allocation_call)
+        # Not vacuous: the result objects allocate (their fields convert when read).
+        assert failures >= 1, fn.__name__
+
+
+def test_batch_reports_the_lowest_failing_pair():
+    # The arguments first, then each pair completely in pair order, across the
+    # Python/C++ boundary.
+    g = build(2, [(0, 1, 3, 7)])
+    opts = ngc.EvaluationOptions(GLOBAL)
+    overlap = (
+        "node 0 is in both endpoint sets: sources and destinations must not overlap"
+    )
+    out_of_range = "sources: node 2 out of node range [0, 2)"
+    with pytest.raises(ValueError, match=exact(overlap)):
+        ngc.evaluate_pairs(g, [(0, 0), (2, 1)], opts, workers=2)
+    with pytest.raises(ValueError, match=exact(out_of_range)):
+        ngc.evaluate_pairs(g, [(0, 1), (2, 1), (0, 0)], opts)
+    other = build(2, [(0, 1, 3, 7)]).eligibility()
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "foreign Eligibility: per_pair_eligibility[0] built for another graph"
+        ),
+    ):
+        ngc.evaluate_pairs(
+            g, [(0, 1), (2, 1)], opts, per_pair_eligibility=[other, None]
+        )
+    with pytest.raises(
+        TypeError,
+        match=exact("per_pair_eligibility entries must be Eligibility or None"),
+    ):
+        ngc.evaluate_pairs(g, [(0, 1), (2, 1)], opts, per_pair_eligibility=[3, None])
+    with pytest.raises(ValueError, match=exact(out_of_range)):
+        ngc.evaluate_pairs(g, [(0, 1), (2, 1)], opts, per_pair_eligibility=[None, 3])
+    # An argument error comes before every pair error.
+    with pytest.raises(ValueError, match=exact("workers must be >= 1 (got 0)")):
+        ngc.evaluate_pairs(g, [(0, 0)], opts, workers=0)
 
-    placed2, _ = policy2.place_demand(fg2, 0, 2, flowClass=0, volume=50.0)
 
-    assert placed2 > 0, "Should place flow"
+def test_batch_checks_an_explicit_empty_eligibility_list():
+    # A given per_pair_eligibility has one entry per pair, also when it is empty.
+    g = build(2, [(0, 1, 3, 7)])
+    opts = ngc.EvaluationOptions(GLOBAL)
+    with pytest.raises(
+        ValueError, match=exact("per_pair_eligibility has 0 entries for 1 pairs")
+    ):
+        ngc.evaluate_pairs(g, [(0, 1)], opts, per_pair_eligibility=[])
+    assert ngc.evaluate_pairs(g, [], opts, per_pair_eligibility=[]) == []
+    assert [
+        r.call_delivered
+        for r in ngc.evaluate_pairs(g, [(0, 1)], opts, per_pair_eligibility=[None])
+    ] == [3]
 
-    # Check cost is shortest path cost
-    flow_info2 = list(policy2.flows.values())[0]
-    cost2 = flow_info2[2]
 
-    assert cost2 == 15, f"Cost should be 15 (5+10), got {cost2}"
+def test_global_zero_call_reports_the_cumulative_curve():
+    # CentralizedTE's curve is cumulative (its amounts sum to delivered()); a zero call
+    # reports it (None before the epoch's preparation and after remove()), changes nothing and
+    # claims no cut, even when asked for one.
+    g = build(2, [(0, 1, 3, 7)])
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger, 0, 1, GLOBAL)
+    assert p.place(0).marginal_cost_curve is None
+    assert p.place(2).marginal_cost_curve == [(7, 2)]
+    z = p.place(0, ALL_OUT)
+    assert (z.call_delivered, z.marginal_cost_curve, z.min_cut) == (0, [(7, 2)], None)
+    assert p.place(0, ngc.OutputOptions(min_cut=True)).min_cut is None  # a zero call
+    assert p.delivered() == 2 and [int(x) for x in ledger.carried()] == [2]
+    p.remove()
+    assert p.place(0).marginal_cost_curve is None
diff --git a/tests/py/test_flow_policy_configurations.py b/tests/py/test_flow_policy_configurations.py
deleted file mode 100644
index 2b61855..0000000
--- a/tests/py/test_flow_policy_configurations.py
+++ /dev/null
@@ -1,513 +0,0 @@
-"""FlowPolicy tests across canonical configurations.
-
-Tests 5 canonical configurations:
-- SHORTEST_PATHS_ECMP: IP/IGP ECMP (hash-based multipath, shortest paths only)
-- SHORTEST_PATHS_WCMP: IP/IGP WCMP (proportional multipath, shortest paths only)
-- TE_WCMP_UNLIM: Traffic engineering with unlimited proportional flows
-- TE_ECMP_UP_TO_256_LSP: TE with up to 256 ECMP LSPs (tunnel-based)
-- TE_ECMP_16_LSP: TE with exactly 16 ECMP LSPs (fixed allocation)
-
-Validates:
-- Accounting: placed + remaining = demand
-- Capacity constraints: TE configurations respect max_flow
-- Flow count enforcement: min/max flow counts
-- Balancing: ECMP equal, WCMP proportional
-- Cost distribution: volumes sum correctly
-- Progressive TE: uses multiple cost tiers when needed
-- Lifecycle: remove_demand, rebalance
-"""
-
-from __future__ import annotations
-
-from typing import Dict, List, Tuple
-
-import pytest
-
-import netgraph_core as ngc
-
-# All canonical configurations to test
-ALL_CONFIGS = [
-    "SHORTEST_PATHS_ECMP",
-    "SHORTEST_PATHS_WCMP",
-    "TE_WCMP_UNLIM",
-    "TE_ECMP_UP_TO_256_LSP",
-    "TE_ECMP_16_LSP",
-]
-
-ECMP_CONFIGS = ["SHORTEST_PATHS_ECMP", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-WCMP_CONFIGS = ["SHORTEST_PATHS_WCMP", "TE_WCMP_UNLIM"]
-CAPACITY_AWARE_CONFIGS = ["TE_WCMP_UNLIM", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-TE_CONFIGS = ["TE_WCMP_UNLIM", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-
-
-def get_expected_flow_count(config_name: str) -> Tuple[int, int | None]:
-    """Return (min_expected, max_expected) flow count for a configuration."""
-    if config_name in ["SHORTEST_PATHS_ECMP", "SHORTEST_PATHS_WCMP"]:
-        return (1, 1)
-    elif config_name == "TE_WCMP_UNLIM":
-        return (1, None)  # Unlimited
-    elif config_name == "TE_ECMP_UP_TO_256_LSP":
-        return (1, 256)
-    elif config_name == "TE_ECMP_16_LSP":
-        return (16, 16)
-    raise ValueError(f"Unknown configuration: {config_name}")
-
-
-def extract_cost_distribution(policy: ngc.FlowPolicy) -> Dict[float, float]:
-    """Extract cost distribution from policy.flows dictionary."""
-    cost_dist = {}
-    for _key, value in policy.flows.items():
-        # value is tuple: (src, dst, cost, volume)
-        cost = float(value[2])
-        volume = float(value[3])
-        cost_dist[cost] = cost_dist.get(cost, 0.0) + volume
-    return cost_dist
-
-
-def check_equal_balancing(volumes: List[float], tolerance: float = 1e-3) -> bool:
-    """Check if all volumes are approximately equal."""
-    if not volumes or len(volumes) == 1:
-        return True
-    avg = sum(volumes) / len(volumes)
-    # Use both absolute and relative tolerance for robustness
-    return all(
-        abs(v - avg) < tolerance or (abs(v - avg) / avg < 1e-6 if avg > 0 else False)
-        for v in volumes
-    )
-
-
-# ============================================================================
-# FIXTURES
-# ============================================================================
-
-
-@pytest.fixture
-def multi_path_graph(build_graph):
-    """4 parallel paths with equal cost but different capacities."""
-    # S=0, T=5
-    # Path 1: 0->1->5, cost=10, cap=100
-    # Path 2: 0->2->5, cost=10, cap=80
-    # Path 3: 0->3->5, cost=10, cap=60
-    # Path 4: 0->4->5, cost=10, cap=40
-    edges = [
-        (0, 1, 5, 100, 0),
-        (1, 5, 5, 100, 1),
-        (0, 2, 5, 80, 2),
-        (2, 5, 5, 80, 3),
-        (0, 3, 5, 60, 4),
-        (3, 5, 5, 60, 5),
-        (0, 4, 5, 40, 6),
-        (4, 5, 5, 40, 7),
-    ]
-    return build_graph(6, edges)
-
-
-@pytest.fixture
-def multi_tier_graph(build_graph):
-    """3 cost tiers with different capacities."""
-    # S=0, T=4
-    # Tier 1: cost=10, cap=50  (0->1->4)
-    # Tier 2: cost=15, cap=75  (0->2->4)
-    # Tier 3: cost=20, cap=100 (0->3->4)
-    edges = [
-        (0, 1, 5, 50, 0),
-        (1, 4, 5, 50, 1),
-        (0, 2, 7, 75, 2),
-        (2, 4, 8, 75, 3),
-        (0, 3, 10, 100, 4),
-        (3, 4, 10, 100, 5),
-    ]
-    return build_graph(5, edges)
-
-
-# ============================================================================
-# TEST 1: ACCOUNTING VALIDATION
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_accounting_correctness(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify placed + remaining = demand for all configurations."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    demand = 200.0
-    placed, remaining = policy.place_demand(fg, 0, 5, flowClass=0, volume=demand)
-
-    assert placed + remaining == pytest.approx(demand, rel=0, abs=1e-6), (
-        f"{config_name}: placed({placed}) + remaining({remaining}) != demand({demand})"
-    )
-
-
-# ============================================================================
-# TEST 2: CAPACITY CONSTRAINTS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", CAPACITY_AWARE_CONFIGS)
-def test_capacity_aware_respects_max_flow(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify capacity-aware configurations don't exceed max_flow."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-
-    # Calculate max flow
-    max_flow, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        5,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=1000.0)
-
-    assert placed <= float(max_flow) + 1e-3, (
-        f"{config_name}: placed({placed}) exceeds max_flow({max_flow})"
-    )
-
-
-# ============================================================================
-# TEST 3: FLOW COUNT VALIDATION
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_flow_count_enforcement(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify each configuration creates the expected number of flows."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-    flow_count = policy.flow_count()
-
-    min_exp, max_exp = get_expected_flow_count(config_name)
-
-    assert flow_count >= min_exp, (
-        f"{config_name}: flow_count({flow_count}) < min_expected({min_exp})"
-    )
-
-    if max_exp is not None:
-        assert flow_count <= max_exp, (
-            f"{config_name}: flow_count({flow_count}) > max_expected({max_exp})"
-        )
-
-    # Specific checks for fixed-count configurations
-    if config_name == "TE_ECMP_16_LSP":
-        assert flow_count == 16, (
-            f"{config_name}: expected exactly 16 flows, got {flow_count}"
-        )
-    elif config_name in ["SHORTEST_PATHS_ECMP", "SHORTEST_PATHS_WCMP"]:
-        assert flow_count == 1, (
-            f"{config_name}: expected exactly 1 flow, got {flow_count}"
-        )
-
-
-# ============================================================================
-# TEST 4: EQUAL BALANCING (ECMP)
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ECMP_CONFIGS)
-def test_ecmp_equal_balancing(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify ECMP configurations split flows equally."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-
-    if placed == 0:
-        pytest.skip("No flow placed, cannot check balancing")
-
-    flows = policy.flows
-    volumes = [v[3] for v in flows.values()]
-
-    assert check_equal_balancing(volumes, tolerance=1e-3), (
-        f"{config_name}: flows not equally balanced. Volumes: {volumes}"
-    )
-
-
-# ============================================================================
-# TEST 5: PROPORTIONAL BALANCING (WCMP)
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", WCMP_CONFIGS)
-def test_wcmp_proportional_balancing(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify WCMP configurations split flows proportionally."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-
-    if placed == 0:
-        pytest.skip("No flow placed, cannot check balancing")
-
-    flows = policy.flows
-    volumes = [v[3] for v in flows.values()]
-
-    # Verify total is correct
-    assert abs(sum(volumes) - placed) < 1e-6, (
-        f"{config_name}: sum of flow volumes doesn't match placed"
-    )
-
-
-# ============================================================================
-# TEST 6: COST DISTRIBUTION
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_cost_distribution_sums_correctly(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify cost distribution volumes sum to total placed volume."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-
-    if placed == 0:
-        pytest.skip("No flow placed, cannot check cost distribution")
-
-    cost_dist = extract_cost_distribution(policy)
-    total_from_costs = sum(cost_dist.values())
-
-    assert abs(total_from_costs - placed) < 1e-6, (
-        f"{config_name}: sum of cost_distribution ({total_from_costs}) != placed ({placed})"
-    )
-
-
-# ============================================================================
-# TEST 7: PROGRESSIVE TE USES MULTIPLE TIERS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", TE_CONFIGS)
-def test_te_uses_multiple_cost_tiers(
-    config_name, multi_tier_graph, algs, to_handle, make_flow_policy
-):
-    """Verify TE configurations use progressively more expensive paths when needed."""
-    g = multi_tier_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Demand exceeds cheapest tier (50), should use tier 2 and 3
-    demand = 150.0
-    placed, _ = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    cost_dist = extract_cost_distribution(policy)
-    unique_costs = sorted(cost_dist.keys())
-
-    # Should have used multiple cost tiers
-    assert len(unique_costs) >= 2, (
-        f"{config_name}: expected multiple cost tiers, got {unique_costs}"
-    )
-
-
-# ============================================================================
-# TEST 8: PLACED DEMAND TRACKING
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_placed_demand_tracking(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify policy.placed_demand() matches returned placed value."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-    tracked_placed = policy.placed_demand()
-
-    assert abs(placed - tracked_placed) < 1e-9, (
-        f"{config_name}: placed({placed}) != policy.placed_demand()({tracked_placed})"
-    )
-
-
-# ============================================================================
-# TEST 9: FLOW DICTIONARY STRUCTURE
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_flow_dictionary_structure(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify policy.flows has correct structure."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-
-    if placed == 0:
-        pytest.skip("No flow placed")
-
-    flows = policy.flows
-
-    # Check structure
-    assert isinstance(flows, dict), f"{config_name}: flows is not a dict"
-
-    for key, value in flows.items():
-        # Key should be tuple of 4 elements
-        assert len(key) == 4, f"{config_name}: flow key length != 4"
-
-        # Value should be tuple of 4 elements: (src, dst, cost, volume)
-        assert len(value) == 4, f"{config_name}: flow value length != 4"
-
-        # src, dst should be ints
-        assert isinstance(value[0], int), f"{config_name}: src not int"
-        assert isinstance(value[1], int), f"{config_name}: dst not int"
-
-        # cost, volume should be numeric
-        assert isinstance(value[2], (int, float)), f"{config_name}: cost not numeric"
-        assert isinstance(value[3], (int, float)), f"{config_name}: volume not numeric"
-
-        # volume should be positive
-        assert value[3] >= 0, f"{config_name}: negative volume"
-
-
-# ============================================================================
-# TEST 10: REMOVE DEMAND
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_remove_demand_clears_flows(
-    config_name, multi_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify removing demand clears all flows."""
-    g = multi_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Place demand
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=200.0)
-
-    if placed == 0:
-        pytest.skip("No flow placed")
-
-    # Remove demand
-    policy.remove_demand(fg)
-
-    # Verify cleared
-    assert policy.flow_count() == 0, f"{config_name}: flow_count != 0 after remove"
-    assert policy.placed_demand() == pytest.approx(0.0, abs=1e-12), (
-        f"{config_name}: placed_demand != 0 after remove"
-    )
-
-
-# ============================================================================
-# TEST 11: COMPARISON WITH MAX_FLOW REFERENCE
-# ============================================================================
-
-
-# Demands per graph for reference comparison
-EXPECTED: Dict[str, Tuple[Tuple[int, int], float]] = {
-    "square1_graph": ((0, 2), 3.0),
-    "line1_graph": ((0, 2), 7.0),
-    "graph3": ((0, 2), 10.0),
-    "two_disjoint_shortest_graph": ((0, 3), 3.0),
-    "square4_graph": ((0, 1), 350.0),
-    "triangle1_graph": ((0, 2), 5.0),
-    "square3_graph": ((0, 2), 320.0),
-    "graph1_graph": ((0, 4), 1.0),
-    "graph2_graph": ((0, 4), 1.0),
-    "graph4_graph": ((0, 4), 6.0),
-}
-
-
-@pytest.mark.parametrize(
-    "fixture_name",
-    [
-        "square1_graph",
-        "line1_graph",
-        "graph3",
-        "two_disjoint_shortest_graph",
-        "square4_graph",
-        "triangle1_graph",
-        "square3_graph",
-        "graph1_graph",
-        "graph2_graph",
-        "graph4_graph",
-    ],
-)
-@pytest.mark.parametrize(
-    "config_name", ["SHORTEST_PATHS_WCMP", "SHORTEST_PATHS_ECMP", "TE_ECMP_16_LSP"]
-)
-def test_matches_maxflow_reference(
-    fixture_name, config_name, algs, to_handle, make_flow_policy, request
-):
-    """Validate that FlowPolicy placement matches max_flow for various configurations."""
-    g = request.getfixturevalue(fixture_name)
-    (src, dst), demand = EXPECTED[fixture_name]
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-    placed, remaining = policy.place_demand(fg, src, dst, flowClass=0, volume=demand)
-
-    # Compute expected using Algorithms.max_flow for corresponding mode
-    if config_name == "SHORTEST_PATHS_WCMP":
-        exp_total, _ = algs.max_flow(
-            to_handle(g),
-            src,
-            dst,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            shortest_path=True,
-        )
-        expected = float(exp_total)
-        assert placed == pytest.approx(expected, rel=0, abs=1e-3), (
-            f"placed mismatch for {fixture_name}:{config_name}: got {placed}, expected ~{expected}"
-        )
-        assert remaining == pytest.approx(demand - expected, rel=0, abs=1e-3), (
-            f"remaining mismatch for {fixture_name}:{config_name}: got {remaining}, expected ~{demand - expected}"
-        )
-    elif config_name == "SHORTEST_PATHS_ECMP":
-        exp_total, _ = algs.max_flow(
-            to_handle(g),
-            src,
-            dst,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            shortest_path=True,
-        )
-        expected = float(exp_total)
-        assert placed == pytest.approx(expected, rel=0, abs=1e-3), (
-            f"placed mismatch for {fixture_name}:{config_name}: got {placed}, expected ~{expected}"
-        )
-        assert remaining == pytest.approx(demand - expected, rel=0, abs=1e-3), (
-            f"remaining mismatch for {fixture_name}:{config_name}: got {remaining}, expected ~{demand - expected}"
-        )
-    elif config_name == "TE_ECMP_16_LSP":
-        exp_total, _ = algs.max_flow(
-            to_handle(g),
-            src,
-            dst,
-            flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-            shortest_path=False,
-        )
-        expected = float(exp_total)
-        assert placed <= expected + 1e-3, (
-            f"placed exceeds max_flow for {fixture_name}:{config_name}: got {placed}, max {expected}"
-        )
-        assert (placed + remaining) == pytest.approx(demand, rel=0, abs=1e-6), (
-            f"accounting mismatch for {fixture_name}:{config_name}: placed+remaining={placed + remaining}, demand={demand}"
-        )
diff --git a/tests/py/test_flow_policy_edge_cases.py b/tests/py/test_flow_policy_edge_cases.py
deleted file mode 100644
index ea7262b..0000000
--- a/tests/py/test_flow_policy_edge_cases.py
+++ /dev/null
@@ -1,408 +0,0 @@
-"""FlowPolicy edge case tests.
-
-Tests boundary conditions and error handling across canonical configurations.
-"""
-
-from __future__ import annotations
-
-import pytest
-
-import netgraph_core as ngc
-
-# All canonical configurations to test
-ALL_CONFIGS = [
-    "SHORTEST_PATHS_ECMP",
-    "SHORTEST_PATHS_WCMP",
-    "TE_WCMP_UNLIM",
-    "TE_ECMP_UP_TO_256_LSP",
-    "TE_ECMP_16_LSP",
-]
-
-CAPACITY_AWARE_CONFIGS = ["TE_WCMP_UNLIM", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-TE_CONFIGS = ["TE_WCMP_UNLIM", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-
-# ============================================================================
-# FIXTURES
-# ============================================================================
-
-
-@pytest.fixture
-def single_path_graph(build_graph):
-    """Single linear path: 0 -> 1 -> 2."""
-    edges = [
-        (0, 1, 5, 100, 0),
-        (1, 2, 5, 100, 1),
-    ]
-    return build_graph(3, edges)
-
-
-@pytest.fixture
-def bottleneck_graph(build_graph):
-    """Linear path with bottleneck at second edge."""
-    edges = [
-        (0, 1, 5, 100, 0),
-        (1, 2, 5, 10, 1),
-    ]
-    return build_graph(3, edges)
-
-
-@pytest.fixture
-def limited_paths_graph(build_graph):
-    """Four equal-cost parallel 2-hop paths."""
-    edges = [
-        (0, 1, 5, 50, 0),
-        (1, 5, 5, 50, 1),
-        (0, 2, 5, 50, 2),
-        (2, 5, 5, 50, 3),
-        (0, 3, 5, 50, 4),
-        (3, 5, 5, 50, 5),
-        (0, 4, 5, 50, 6),
-        (4, 5, 5, 50, 7),
-    ]
-    return build_graph(6, edges)
-
-
-@pytest.fixture
-def disconnected_graph(build_graph):
-    """Graph with isolated nodes."""
-    edges = [
-        (0, 1, 5, 100, 0),
-    ]
-    return build_graph(3, edges)
-
-
-# ============================================================================
-# TEST 1: INSUFFICIENT CAPACITY
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_insufficient_capacity(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify graceful handling when demand > capacity."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Path capacity is 100, demand is 500
-    demand = 500.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Should place up to capacity
-    assert placed <= 100.0 + 1e-3, (
-        f"{config_name}: placed ({placed}) exceeds available capacity (100)"
-    )
-
-    # Accounting must be correct
-    assert placed + remaining == pytest.approx(demand, abs=1e-6), (
-        f"{config_name}: accounting broken with insufficient capacity"
-    )
-
-    # For capacity-aware configurations, should place exactly max capacity
-    if config_name in CAPACITY_AWARE_CONFIGS:
-        assert placed == pytest.approx(100.0, abs=1e-3), (
-            f"{config_name}: didn't fully utilize capacity when demand exceeds capacity"
-        )
-
-
-# ============================================================================
-# TEST 2: SINGLE PATH NETWORK
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_single_path_network(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior on networks with only one path."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    demand = 50.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Should successfully place on the single path
-    assert placed > 0, f"{config_name}: failed to place flow on single-path network"
-
-    # Accounting
-    assert placed + remaining == pytest.approx(demand, abs=1e-6), (
-        f"{config_name}: accounting broken on single-path network"
-    )
-
-
-# ============================================================================
-# TEST 3: FEWER PATHS THAN REQUESTED FLOWS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ["TE_ECMP_16_LSP", "TE_ECMP_UP_TO_256_LSP"])
-def test_fewer_paths_than_requested(
-    config_name, limited_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when network has fewer paths than requested flows.
-
-    With 4 paths and 16 LSPs, all 4 paths must be used.
-    """
-    from conftest import (
-        analyze_path_usage,
-        check_distribution_balanced,
-        count_lsps_per_path,
-    )
-
-    g = limited_paths_graph  # Only 4 paths available
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    demand = 150.0
-    placed, remaining = policy.place_demand(fg, 0, 5, flowClass=0, volume=demand)
-
-    assert placed > 0, (
-        f"{config_name}: failed to place when fewer paths than requested flows"
-    )
-
-    flow_count = policy.flow_count()
-    assert flow_count >= 1, f"{config_name}: no flows created on limited paths"
-
-    # Verify path usage
-    path_usage = analyze_path_usage(fg, g, 0, 5)
-    available_paths = 4
-
-    if config_name == "TE_ECMP_16_LSP":
-        # All 4 paths must be used
-        assert len(path_usage) == available_paths, (
-            f"{config_name}: With 16 LSPs and 4 available paths, "
-            f"all 4 paths must be used, but only {len(path_usage)} were used. "
-            f"Paths with flow: {list(path_usage.keys())}"
-        )
-
-        # Verify LSP distribution
-        lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 5)
-        expected_lsps_per_path = 16 // 4
-
-        for path_id in [1, 2, 3, 4]:
-            if path_id in lsps_per_path:
-                lsp_count = len(lsps_per_path[path_id])
-                assert lsp_count == expected_lsps_per_path, (
-                    f"{config_name}: Path via node {path_id} should have "
-                    f"{expected_lsps_per_path} LSPs, but has {lsp_count}. "
-                    f"Distribution: {lsps_per_path}"
-                )
-            else:
-                raise AssertionError(
-                    f"{config_name}: Path via node {path_id} has no LSPs! "
-                    f"Distribution: {lsps_per_path}"
-                )
-
-        # Check balance
-        is_balanced, stats = check_distribution_balanced(lsps_per_path, tolerance=0)
-        assert is_balanced, (
-            f"{config_name}: LSPs not evenly distributed. Stats: {stats}"
-        )
-
-        # Check capacity
-        assert placed >= 140.0, (
-            f"{config_name}: With 16 LSPs balanced across 4 paths, "
-            f"should place ~150 units (demand), but only placed {placed}"
-        )
-
-
-# ============================================================================
-# TEST 4: ZERO CAPACITY (SATURATED) NETWORK
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", CAPACITY_AWARE_CONFIGS)
-def test_zero_remaining_capacity(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when all links are saturated."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy1 = make_flow_policy(config_name, algs, to_handle(g))
-
-    # First placement: saturate the network
-    demand1 = 100.0
-    placed1, remaining1 = policy1.place_demand(fg, 0, 2, flowClass=0, volume=demand1)
-
-    # Try to place more on saturated network (different flowClass)
-    placed_b, remaining_b = policy1.place_demand(fg, 0, 2, flowClass=1, volume=50.0)
-
-    # Should not be able to place additional flow
-    assert placed_b < 1e-6, (
-        f"{config_name}: placed flow on saturated network. placed_b={placed_b}"
-    )
-
-
-# ============================================================================
-# TEST 5: DISCONNECTED NETWORK
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_no_path_exists(
-    config_name, disconnected_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when no path exists."""
-    g = disconnected_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Try to route from 0 to 2 (no path exists)
-    demand = 100.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Should place nothing
-    assert placed == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: placed volume when no path exists"
-    )
-
-    # All demand should remain
-    assert remaining == pytest.approx(demand, abs=1e-9), (
-        f"{config_name}: remaining doesn't match demand when no path exists"
-    )
-
-    # Should have no flows
-    assert policy.flow_count() == 0, f"{config_name}: created flows when no path exists"
-
-
-# ============================================================================
-# TEST 6: BOTTLENECK NETWORK
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", CAPACITY_AWARE_CONFIGS)
-def test_bottleneck_network(
-    config_name, bottleneck_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior with severe bottleneck."""
-    g = bottleneck_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    demand = 100.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Should place up to bottleneck capacity (10)
-    # Allow some tolerance for TE policies that may find alternate routes
-    assert placed <= 100.0 + 1e-3, (
-        f"{config_name}: exceeded total capacity through bottleneck. Got {placed}"
-    )
-
-
-# ============================================================================
-# TEST 7: VERY LARGE DEMAND
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_very_large_demand(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior with extremely large demand."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Demand 1000x capacity
-    demand = 100000.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Accounting must still be correct
-    assert placed + remaining == pytest.approx(demand, abs=1e-3), (
-        f"{config_name}: accounting broken with very large demand"
-    )
-
-    # Should not exceed capacity
-    assert placed <= 100.0 + 1e-3, (
-        f"{config_name}: exceeded capacity with very large demand"
-    )
-
-
-# ============================================================================
-# TEST 8: ZERO DEMAND
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_zero_demand(config_name, single_path_graph, algs, to_handle, make_flow_policy):
-    """Verify behavior with zero demand."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    demand = 0.0
-    placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-    # Should place nothing
-    assert placed == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: placed volume with zero demand"
-    )
-
-    # Remaining should be zero
-    assert remaining == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: remaining non-zero with zero demand"
-    )
-
-
-# ============================================================================
-# TEST 9: NEGATIVE DEMAND (ERROR CASE)
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_negative_demand(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior with negative demand (should be rejected or clamped)."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # This might raise an exception or clamp to zero - either is acceptable
-    try:
-        demand = -100.0
-        placed, remaining = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand)
-
-        # If it doesn't raise, should treat as zero or clamp
-        assert placed == pytest.approx(0.0, abs=1e-9), (
-            f"{config_name}: placed volume with negative demand"
-        )
-    except (ValueError, RuntimeError):
-        # Acceptable to raise error for negative demand
-        pass
-
-
-# ============================================================================
-# TEST 10: MULTIPLE DEMANDS SAME FLOW CLASS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", TE_CONFIGS)
-def test_multiple_demands_additive(
-    config_name, single_path_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when trying to place multiple demands for same (src,dst,class)."""
-    g = single_path_graph
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g))
-
-    # Place first demand
-    demand1 = 50.0
-    placed1, _ = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand1)
-
-    # Try to place second demand for same (src, dst, flowClass)
-    # Current behavior: likely adds to existing demand
-    try:
-        demand2 = 30.0
-        placed2, _ = policy.place_demand(fg, 0, 2, flowClass=0, volume=demand2)
-
-        # If it succeeds, verify total placed doesn't exceed capacity
-        total_placed = policy.placed_demand()
-        assert total_placed <= 100.0 + 1e-3, (
-            f"{config_name}: total placed exceeds capacity after multiple placements"
-        )
-    except RuntimeError:
-        # Acceptable to reject duplicate placement
-        pass
diff --git a/tests/py/test_flow_policy_fixtures.py b/tests/py/test_flow_policy_fixtures.py
new file mode 100644
index 0000000..f09f741
--- /dev/null
+++ b/tests/py/test_flow_policy_fixtures.py
@@ -0,0 +1,582 @@
+"""The 31 fixtures of the independent reference replayed through the bindings (the ledger and
+the policies).
+
+``tests/data/policy_fixtures.json`` was exported from the independent reference
+(its frozen copy, the exporter, the regeneration check and the meaning of the data's historical
+``source`` string: ``tests/reference/policy/README.md``): every ledger, policy and call of
+every fixture in order, with the reference's values after each operation. The
+replay asserts every one of them on the build: each call's result (placed, remaining,
+termination, flags, drops, the cost curve and the requested outputs), its trace (the
+reference's keys: CostOnly's prepared routes, offers and admitted totals; the controllers'
+view, cap, flow-core payload and shares), the ledger after it (allocations, residuals, every
+record field, next FlowId, owners) and the policy state (roster, requested, +inf, placed
+demand, per source the flows' ids, routes, T, deliveries and allocations). An operation the
+reference rejects must raise here too (the messages differ), and a rejected placement leaves
+the policy's state as it was. Normalised on both sides: the flow core's operation counters and
+ledger uids. The replay reads the trace through the private hooks, so it is skipped without
+them.
+
+The data keeps the reference's own names; the replay maps them to the library's here and
+nowhere else: the routing kinds ``CostOnly`` and ``Global`` build ``ShortestPaths`` and
+``CentralizedTE`` (source allocation OPTIMIZED, the reference's only one); the configuration's
+``placement`` and ``weights`` are ShortestPaths' ``allocation`` and ``weight_basis``, its
+``selection`` ShortestPaths' route choice
+(``Deterministic`` is FEWER_HOPS whatever the ``priority``, ``PreferHigherPriority`` with
+``Residual``, ``Capacity`` or ``Headroom`` is HIGHER_AVAILABLE_CAPACITY, HIGHER_CAPACITY or
+HIGHER_HEADROOM, ``multi_edge`` is ``parallel_edges``); ``elig`` is the policy's eligibility, ``volume`` the offer; a result's
+``placed``, ``remaining``, ``call_drops``, ``call_source_loss``, ``source_loss``, ``drops`` and
+``cost_distribution`` are ``call_delivered``, ``call_undelivered``, ``call_edge_drops``,
+``call_source_drops``, ``source_drops``, ``edge_drops`` and ``marginal_cost_curve``, a source
+row's last two entries ``source_drops`` and ``total_edge_drops``, the output ``bottleneck``
+``saturated_boundary_edges``; the ledger's ``allocated`` is ``carried()``; a record's ``owner``,
+``bundle``, ``route_cost``, ``edges`` and ``drops`` are ``policy_id``, ``route``,
+``min_route_cost``, ``edge_flows`` and ``edge_drops``; a graph's ``input_index`` is
+``input_positions()``.
+"""
+
+from __future__ import annotations
+
+import copy
+import json
+import math
+import traceback
+from pathlib import Path
+
+import pytest
+from helpers import build, dag_of
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+DATA = Path(__file__).resolve().parents[1] / "data" / "policy_fixtures.json"
+FIXTURES = json.loads(DATA.read_text())["fixtures"]
+
+PLACEMENT = {
+    "MaxFlow": ngc.RouteAllocation.OPTIMIZED,
+    "Weighted": ngc.RouteAllocation.WEIGHTED,
+    "EqualBalanced": ngc.RouteAllocation.EQUAL,
+}
+ADMISSION = {"Lossless": ngc.Admission.LOSSLESS, "Lossy": ngc.Admission.LOSSY}
+ADMISSION_NAME = {v: k for k, v in ADMISSION.items()}
+PREFER = {"Deterministic": False, "PreferHigherPriority": True}
+HIGHER = {
+    "Residual": ngc.RouteTieBreak.HIGHER_AVAILABLE_CAPACITY,
+    "Capacity": ngc.RouteTieBreak.HIGHER_CAPACITY,
+    "Headroom": ngc.RouteTieBreak.HIGHER_HEADROOM,
+}
+WEIGHTS = {
+    "Capacity": ngc.WeightBasis.CAPACITY,
+    "Explicit": ngc.WeightBasis.EXPLICIT,
+    "ResidualSnapshot": ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+}
+
+
+def norm(x):
+    """String map keys; probe counts, counters and ledger uids dropped; FlowIds as ids."""
+    if isinstance(x, dict):
+        out = {}
+        for k, v in x.items():
+            if k in ("ledger_uid", "counters"):
+                continue
+            if (
+                k in ("flow_id", "flow")
+                and isinstance(v, (list, tuple))
+                and len(v) == 2
+            ):
+                out[str(k)] = v[1]
+                continue
+            out[str(k)] = norm(v)
+        return out
+    if isinstance(x, (list, tuple)):
+        return [norm(v) for v in x]
+    return x
+
+
+def exactly(a, b):
+    """Whether a and b are equal with the same type at every level: a dict has the same keys
+    and exactly equal values, a list the same length and exactly equal items, and every other
+    value the same type and value (so True differs from 1, and 1 from 1.0)."""
+    if type(a) is not type(b):
+        return False
+    if isinstance(a, dict):
+        return a.keys() == b.keys() and all(exactly(a[k], b[k]) for k in a)
+    if isinstance(a, (list, tuple)):
+        return len(a) == len(b) and all(
+            exactly(x, y) for x, y in zip(a, b, strict=True)
+        )
+    return a == b
+
+
+def build_graph(spec):
+    g = build(spec["n"], spec["edges"], spec["q"])
+    assert exactly(g.input_positions().tolist(), spec["input_index"])
+    return g
+
+
+def config_of(g, c):
+    r = c["routing"]
+    kind = r["kind"]
+    sel = c["selection"]
+    if kind == "CostOnly":
+        choice = {}
+        if sel is not None:
+            higher = HIGHER[
+                sel["priority"]
+            ]  # an unknown name fails here, even under Deterministic
+            choice = {
+                "tie_break": higher
+                if PREFER[sel["tie_break"]]
+                else ngc.RouteTieBreak.FEWER_HOPS,
+                "multipath": sel["multipath"],
+                "parallel_edges": sel["multi_edge"],
+            }
+        routing = ngc.ShortestPaths(
+            allocation=PLACEMENT[c["placement"]],
+            weight_basis=None if c.get("weights") is None else WEIGHTS[c["weights"]],
+            **choice,
+        )
+    elif kind == "Global":
+        assert sel is None, f"the data names a selection for {kind}"
+        assert c["placement"] is None and c.get("weights") is None, c
+        support = r.get("support")
+        routing = ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.OPTIMIZED,
+            support=None if support is None else dag_of(g, support),
+        )
+    else:
+        raise AssertionError(f"the data names an unknown routing ({kind})")
+    return ngc.FlowPolicyConfig(routing=routing, admission=ADMISSION[c["admission"]])
+
+
+def result_json(r):
+    out = {
+        "placed": r.call_delivered,
+        "remaining": "inf" if r.call_undelivered == math.inf else r.call_undelivered,
+        "delivery_delta": r.delivery_delta,
+        "call_drops": [[e, x] for e, x in r.call_edge_drops],
+        "call_source_loss": r.call_source_drops,
+        "termination": r.termination.name.lower(),
+        "routes_changed": r.routes_changed,
+        "weights_changed": r.weights_changed,
+        "requested": "inf" if r.requested == math.inf else r.requested,
+        "admitted": r.admitted,
+        "delivered": r.delivered,
+        "source_loss": r.source_drops,
+        "drops": [[e, x] for e, x in r.edge_drops],
+        "by_source": [
+            [
+                x.source,
+                x.offered,
+                x.admitted,
+                x.delivered,
+                x.source_drops,
+                x.total_edge_drops,
+            ]
+            for x in r.by_source
+        ],
+    }
+    for name in ("offered", "unadmitted", "total_cost"):
+        value = getattr(r, name)
+        if value is not None:
+            out[name] = value
+    if r.marginal_cost_curve is not None:
+        out["cost_distribution"] = [[c, u] for c, u in r.marginal_cost_curve]
+    for name, attribute in (
+        ("edge_flows", "edge_flows"),
+        ("residual", "residual"),
+        ("bottleneck", "saturated_boundary_edges"),
+        ("min_cut", "min_cut"),
+    ):
+        value = getattr(r, attribute)
+        if value is not None:
+            out[name] = [int(x) for x in value]
+    return out
+
+
+def ledger_json(fg):
+    st = fg._state()
+    return {
+        "allocated": [int(x) for x in fg.carried()],
+        "residual": [int(x) for x in fg.residual()],
+        "records": [
+            {
+                "flow_id": r.flow_id[1],
+                "owner": r.policy_id,
+                "sources": list(r.sources),
+                "destinations": list(r.destinations),
+                "admission": ADMISSION_NAME[r.admission],
+                "bundle": sorted(int(e) for e in r.route.via_edges()),
+                "route_cost": r.min_route_cost,
+                "offered": r.offered,
+                "delivered": r.delivered,
+                "edges": [[e, x] for e, x in r.edge_flows],
+                "drops": [[e, x] for e, x in r.edge_drops],
+            }
+            for r in fg.records()
+        ],
+        "next_flow_id": st["next_flow_id"],
+        "bound": list(st["bound"]),
+        "orphans": list(st["orphans"]),
+    }
+
+
+def policy_json(pol):
+    st = pol._state()
+    lossy = pol.config.admission == ngc.Admission.LOSSY
+    record_groups = []
+    for s, flows in sorted(st["cohorts"].items()):
+        if not flows:
+            continue
+        out = []
+        for f in flows:
+            out.append(
+                {
+                    "id": f["flow_id"][1],
+                    "route": list(f["route"]),
+                    "T": None if lossy else f["T"],
+                    "delivered": f["delivered"],
+                    "alloc": [[e, x] for e, x in f["alloc"]],
+                }
+            )
+        record_groups.append([s, out])
+    return {
+        "roster": list(st["roster"]),
+        "requested": st["requested"],
+        "infinite": st["infinite"],
+        "placed_demand": st["placed_demand"],
+        "cohorts": record_groups,
+    }
+
+
+def replay(fx, at=None):
+    """Replays fx, asserting every expectation; `at`, when given, collects the index of each
+    operation as it starts (so a failure can be attributed to its operation)."""
+    graphs = [build_graph(spec) for spec in fx["graphs"]]
+    ledgers: dict[int, object] = {}
+    policies: dict[int, object] = {}
+    for i, op in enumerate(fx["ops"]):
+        if at is not None:
+            at.append(i)
+        where = f"{fx['name']} op {i} ({op['op']})"
+        kind = op["op"]
+        expect = op.get("expect", {})
+        if kind == "ledger":
+            # The data holds no ledger the reference rejects: a data file with one fails here,
+            # rather than in a branch no fixture would reach.
+            assert not op["error"], where
+            ledgers[op["id"]] = ngc.FlowLedger(graphs[op["graph"]], op["baseline"])
+            continue
+        if kind == "policy":
+            fg = ledgers[op["ledger"]]
+            g = fg.graph()
+
+            def construct(op=op, fg=fg, g=g):
+                eligibility = None
+                if op["elig"] is not None:
+                    eligibility = g.eligibility(
+                        excluded_nodes=op["elig"]["nodes"],
+                        excluded_edges=op["elig"]["edges"],
+                    )
+                cfg = config_of(g, op["config"])
+                return ngc.FlowPolicy(
+                    fg, op["sources"], op["destinations"], cfg, eligibility
+                )
+
+            if op["error"]:
+                with pytest.raises((ValueError, TypeError)):
+                    construct()
+                continue
+            pol = construct()
+            policies[op["id"]] = (pol, fg)
+            assert exactly(policy_json(pol), expect["policy"]), where
+            continue
+        pol, fg = policies[op["policy"]]
+        # A removal cannot fail, so the reference must accept it.
+        assert kind != "remove" or not op["error"], where
+        if kind == "remove":
+            pol.remove()
+            assert exactly(ledger_json(fg), expect["ledger"]), where
+            assert exactly(policy_json(pol), expect["policy"]), where
+            continue
+        assert kind == "place", where
+        offer = math.inf if op["volume"] == "inf" else op["volume"]
+        outputs = None
+        if op["outputs"] is not None:
+            e, r, b, m = op["outputs"]
+            outputs = ngc.OutputOptions(
+                edge_flows=e, residual=r, saturated_boundary_edges=b, min_cut=m
+            )
+        if op["error"]:
+            before = policy_json(pol)
+            with pytest.raises((ValueError, TypeError)):
+                pol.place(offer, outputs)
+            assert exactly(ledger_json(fg), expect["ledger"]), where
+            # The reference records the ledger only; the policy's own state (requested, +inf,
+            # the flows) must be as before the call too.
+            assert exactly(policy_json(pol), before), where
+            continue
+        r, trace = pol._place_traced(offer, outputs)
+        assert exactly(result_json(r), expect["result"]), where
+        assert exactly(norm(trace.as_dict()), expect["trace"]), where
+        assert exactly(ledger_json(fg), expect["ledger"]), where
+        assert exactly(policy_json(pol), expect["policy"]), where
+
+
+def test_the_data_holds_every_fixture():
+    assert len(FIXTURES) == 31
+    assert len({fx["name"] for fx in FIXTURES}) == 31
+
+
+@needs_hooks
+@pytest.mark.parametrize("fx", FIXTURES, ids=[fx["name"] for fx in FIXTURES])
+def test_fixture(fx):
+    replay(fx)
+
+
+def _first_leaf(x):
+    """(container, key) of the first leaf of x in document order; None when x has none."""
+    items = (
+        x.items()
+        if isinstance(x, dict)
+        else enumerate(x)
+        if isinstance(x, list)
+        else ()
+    )
+    for k, v in items:
+        if not isinstance(v, (dict, list)):
+            return x, k
+        found = _first_leaf(v)
+        if found is not None:
+            return found
+    return None
+
+
+def _corrupt(container, key):
+    """Changes one leaf: None becomes 0, a bool flips, a number grows by one, a string gains a
+    character."""
+    v = container[key]
+    if v is None:
+        container[key] = 0
+    elif isinstance(v, bool):
+        container[key] = not v
+    elif isinstance(v, (int, float)):
+        container[key] = v + 1
+    else:
+        container[key] = v + "#"
+
+
+def _failure(fx, at=None):
+    """Where the replay of fx fails: (the index of the operation being replayed, None before
+    the first; the failing source line), or None when the replay passes. `at`, when given, is
+    the list the replay appends each operation's index to (so a control can read it)."""
+    at = [] if at is None else at
+    try:
+        replay(fx, at)
+    except (AssertionError, ValueError, TypeError, pytest.fail.Exception) as e:
+        return (at[-1] if at else None), traceback.extract_tb(e.__traceback__)[-1].line
+    return None
+
+
+@needs_hooks
+@pytest.mark.parametrize("key", ["result", "trace", "ledger", "policy"])
+def test_a_corrupted_expectation_fails(key):
+    # The replay is not vacuous (the twin of PolicyFixtures.ACorruptedExpectationFails): in
+    # every fixture, the first integer of the expectation `key` of the first successful
+    # placement that has one is corrupted; the replay must fail at that operation, on that
+    # expectation's assertion.
+    corrupted = 0
+    for fx in FIXTURES:
+        bad = copy.deepcopy(fx)
+        n = next(
+            (
+                n
+                for n, o in enumerate(bad["ops"])
+                if o["op"] == "place"
+                and not o["error"]
+                and _corrupt_first_int(o["expect"][key])
+            ),
+            None,
+        )
+        if n is None:
+            continue
+        index, line = _failure(bad)
+        assert index == n, fx["name"]
+        assert f'expect["{key}"]' in line, fx["name"]
+        corrupted += 1
+    assert corrupted == len(FIXTURES)  # every fixture has such a placement
+
+
+def test_exactly_compares_types_at_every_level():
+    assert exactly(
+        {"a": [1, [True, None]], "b": "x"}, {"a": [1, [True, None]], "b": "x"}
+    )
+    for a, b in (
+        (True, 1),
+        (1, 1.0),
+        (0, False),
+        ([1], (1,)),
+        ({"a": [1]}, {"a": [1.0]}),
+        ({"a": [[0]]}, {"a": [[False]]}),
+        ({"a": 1}, {"a": 1, "b": 1}),
+        ([1, 2], [1]),
+    ):
+        assert not exactly(a, b), (a, b)
+        assert not exactly(b, a), (b, a)
+
+
+@needs_hooks
+@pytest.mark.parametrize("change", ["integer as float", "bool as integer"])
+def test_an_expected_value_of_another_type_fails(change):
+    # The replay compares types too: in every fixture, the first successful placement's
+    # expected `placed` becomes the same number as a float, or its `routes_changed` the same
+    # truth value as an integer; the replay must fail at that operation, on the result.
+    changed = 0
+    for fx in FIXTURES:
+        bad = copy.deepcopy(fx)
+        n = next(
+            (
+                n
+                for n, o in enumerate(bad["ops"])
+                if o["op"] == "place" and not o["error"]
+            ),
+            None,
+        )
+        if n is None:
+            continue
+        result = bad["ops"][n]["expect"]["result"]
+        if change == "integer as float":
+            result["placed"] = float(result["placed"])
+        else:
+            result["routes_changed"] = int(result["routes_changed"])
+        assert result == fx["ops"][n]["expect"]["result"]  # equal under ==
+        index, line = _failure(bad)
+        assert index == n, fx["name"]
+        assert 'expect["result"]' in line, fx["name"]
+        changed += 1
+    assert changed == len(FIXTURES)
+
+
+@needs_hooks
+def test_every_other_replay_clause_reports_its_operation(monkeypatch):
+    # The replay's other assertions, each failing at the operation it concerns (the twin of the
+    # other-clause controls inside PolicyFixtures.ACorruptedExpectationFails): the first leaf of every section
+    # of every other operation's expectations, the error flag of the first operation of every
+    # kind and outcome in each fixture, the input order of the first graph, an unknown
+    # operation, a policy changed by a call the data rejects, and the curve a Global zero call
+    # reports against the remembered one.
+    sections = set()
+    flags = set()
+    for fx in FIXTURES:
+        flipped = set()
+        for n, op in enumerate(fx["ops"]):
+            combination = f"{op['op']} {'failed' if op['error'] else 'ok'}"
+            if "expect" in op and (op["op"] != "place" or op["error"]):
+                for key in op["expect"]:
+                    bad = copy.deepcopy(fx)
+                    leaf = _first_leaf(bad["ops"][n]["expect"][key])
+                    assert leaf is not None, (fx["name"], n, key)
+                    _corrupt(*leaf)
+                    index, line = _failure(bad)
+                    assert index == n, (fx["name"], n, key)
+                    assert f'expect["{key}"]' in line, (fx["name"], n, key)
+                    sections.add(f"{combination} {key}")
+            if combination not in flipped:
+                flipped.add(combination)
+                bad = copy.deepcopy(fx)
+                bad["ops"][n]["error"] = not op["error"]
+                failure = _failure(bad)
+                assert failure is not None and failure[0] == n, (fx["name"], n)
+                flags.add(combination)
+        bad = copy.deepcopy(fx)
+        _corrupt(bad["graphs"][0]["input_index"], 0)
+        assert _failure(bad) == (
+            None,
+            'assert exactly(g.input_positions().tolist(), spec["input_index"])',
+        )
+    assert sections == {
+        "place failed ledger",
+        "policy ok policy",
+        "remove ok ledger",
+        "remove ok policy",
+    }
+    assert flags == {
+        "ledger ok",
+        "place failed",
+        "place ok",
+        "policy failed",
+        "policy ok",
+        "remove ok",
+    }
+    # An unknown operation in place of op 3 of global_epochs (a placement).
+    epochs = next(fx for fx in FIXTURES if fx["name"] == "global_epochs")
+    renamed = copy.deepcopy(epochs)
+    renamed["ops"][3]["op"] = "move"
+    assert _failure(renamed) == (3, 'assert kind == "place", where')
+    # Every call the data rejects, with the policy's +inf flag read flipped after that call only
+    # (the binding gives no way to change a policy's state directly, so its state read is
+    # changed): the comparison with the policy before the call must fail there. The ledger is
+    # left as it is, so the ledger comparison before it still passes.
+    place, read_state = ngc.FlowPolicy.place, ngc.FlowPolicy._state
+    at, changed, target = [], set(), None
+
+    def rejected_then_changed(self, *args):
+        try:
+            return place(self, *args)
+        except (ValueError, TypeError):
+            if at[-1] == target:
+                changed.add(id(self))
+            raise
+
+    def changed_state(self):
+        st = read_state(self)
+        if id(self) in changed:
+            st["infinite"] = not st["infinite"]
+        return st
+
+    monkeypatch.setattr(ngc.FlowPolicy, "place", rejected_then_changed)
+    monkeypatch.setattr(ngc.FlowPolicy, "_state", changed_state)
+    rejected_calls = 0
+    for fx in FIXTURES:
+        for n, op in enumerate(fx["ops"]):
+            if op["op"] != "place" or not op["error"]:
+                continue
+            rejected_calls += 1
+            at.clear()
+            changed.clear()
+            target = n
+            assert _failure(fx, at) == (
+                n,
+                "assert exactly(policy_json(pol), before), where",
+            ), (fx["name"], n)
+    assert rejected_calls == 3
+    monkeypatch.undo()
+    # Op 2 of global_epochs is a Global zero call on a fresh policy (nothing prepared: no curve),
+    # op 3 a positive call with the curve [[1, 1]]. With op 3 moved before op 2, the zero call
+    # reports the remembered curve [[1, 1]] where the data, recorded before any placement, has
+    # none: the result line of that operation fails.
+    assert epochs["ops"][2]["volume"] == 0
+    assert "cost_distribution" not in epochs["ops"][2]["expect"]["result"]
+    swapped = copy.deepcopy(epochs)
+    swapped["ops"][2], swapped["ops"][3] = swapped["ops"][3], swapped["ops"][2]
+    assert _failure(swapped) == (
+        3,
+        'assert exactly(result_json(r), expect["result"]), where',
+    )
+
+
+def _corrupt_first_int(x):
+    """Adds 1 to the first integer (not a bool) of x in document order; whether one was found."""
+    items = (
+        x.items()
+        if isinstance(x, dict)
+        else enumerate(x)
+        if isinstance(x, list)
+        else ()
+    )
+    for k, v in items:
+        if isinstance(v, int) and not isinstance(v, bool):
+            x[k] = v + 1
+            return True
+        if _corrupt_first_int(v):
+            return True
+    return False
diff --git a/tests/py/test_flow_policy_lifecycle.py b/tests/py/test_flow_policy_lifecycle.py
deleted file mode 100644
index 2f13fb5..0000000
--- a/tests/py/test_flow_policy_lifecycle.py
+++ /dev/null
@@ -1,76 +0,0 @@
-"""FlowPolicy lifecycle: place, rebalance, remove, and flow count bounds."""
-
-from __future__ import annotations
-
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_sel():
-    return ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-
-
-def _small_graph(build_graph):
-    # 0 -> 1 (cap 3), 0 -> 2 -> 1 (cap 2)
-    edges = [
-        (0, 1, 1.0, 3.0, 0),
-        (0, 2, 1.0, 2.0, 1),
-        (2, 1, 1.0, 2.0, 2),
-    ]
-    return build_graph(3, edges)
-
-
-def test_flow_policy_place_rebalance_remove(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    fg = ngc.FlowGraph(g)
-    cfg = ngc.FlowPolicyConfig(
-        path_alg=ngc.PathAlg.SPF,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        selection=_make_sel(),
-        min_flow_count=2,
-        max_flow_count=4,
-    )
-    policy = ngc.FlowPolicy(algs, to_handle(g), cfg)
-
-    placed, remaining = policy.place_demand(fg, 0, 1, flowClass=0, volume=4.0)
-    assert placed + remaining == pytest.approx(4.0, rel=0, abs=1e-9)
-    assert policy.flow_count() >= 1
-    assert policy.placed_demand() == pytest.approx(placed, rel=0, abs=1e-9)
-    assert isinstance(policy.flows, dict)
-    assert all(len(k) == 4 for k in policy.flows.keys())
-
-    # Rebalance to a higher target
-    placed2, remaining2 = policy.rebalance_demand(fg, 0, 1, flowClass=0, target=5.0)
-    # Rebalance keeps total demand constant; target is per-flow guidance
-    assert placed2 + remaining2 == pytest.approx(placed, rel=0, abs=1e-9)
-    # Flows should be roughly equalized after rebalance
-    vals = [v[3] for v in policy.flows.values()]
-    if len(vals) >= 2:
-        assert max(vals) - min(vals) <= 1e-6
-
-    # Remove and ensure counters reset
-    policy.remove_demand(fg)
-    assert policy.flow_count() == 0
-    assert policy.placed_demand() == pytest.approx(0.0, rel=0, abs=1e-12)
-
-
-def test_flow_policy_flow_count_bounds(build_graph, algs, to_handle):
-    g = _small_graph(build_graph)
-    fg = ngc.FlowGraph(g)
-    # Constrain to exactly 3 flows
-    cfg = ngc.FlowPolicyConfig(
-        path_alg=ngc.PathAlg.SPF,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        selection=_make_sel(),
-        min_flow_count=3,
-        max_flow_count=3,
-    )
-    policy = ngc.FlowPolicy(algs, to_handle(g), cfg)
-    placed, _ = policy.place_demand(fg, 0, 1, flowClass=0, volume=3.0)
-    assert placed >= 0.0
-    assert policy.flow_count() == 3
diff --git a/tests/py/test_flow_policy_masks.py b/tests/py/test_flow_policy_masks.py
deleted file mode 100644
index 2e14f49..0000000
--- a/tests/py/test_flow_policy_masks.py
+++ /dev/null
@@ -1,383 +0,0 @@
-"""FlowPolicy mask tests.
-
-Tests node and edge mask functionality for failure simulation across
-canonical configurations.
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-# All canonical configurations to test
-ALL_CONFIGS = [
-    "SHORTEST_PATHS_ECMP",
-    "SHORTEST_PATHS_WCMP",
-    "TE_WCMP_UNLIM",
-    "TE_ECMP_UP_TO_256_LSP",
-    "TE_ECMP_16_LSP",
-]
-
-CAPACITY_AWARE_CONFIGS = ["TE_WCMP_UNLIM", "TE_ECMP_UP_TO_256_LSP", "TE_ECMP_16_LSP"]
-
-# ============================================================================
-# FIXTURES
-# ============================================================================
-
-
-@pytest.fixture
-def redundant_paths_graph(build_graph):
-    """Graph with redundant paths for testing masking."""
-    # S=0, T=4
-    # Path 1: 0->1->4, cost=10, cap=100 (primary)
-    # Path 2: 0->2->4, cost=10, cap=100 (backup)
-    # Path 3: 0->3->4, cost=15, cap=100 (expensive backup)
-    edges = [
-        (0, 1, 5, 100, 0),  # Primary path
-        (1, 4, 5, 100, 1),
-        (0, 2, 5, 100, 2),  # Backup path (same cost)
-        (2, 4, 5, 100, 3),
-        (0, 3, 7, 100, 4),  # Expensive path
-        (3, 4, 8, 100, 5),
-    ]
-    return build_graph(5, edges)
-
-
-# ============================================================================
-# TEST 1: NODE MASK EXCLUSION
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_node_mask_excludes_node(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify configurations respect node exclusions."""
-    g = redundant_paths_graph
-
-    # Without mask - should place successfully using all paths
-    fg1 = ngc.FlowGraph(g)
-    policy1 = make_flow_policy(config_name, algs, to_handle(g), node_mask=None)
-    placed1, _ = policy1.place_demand(fg1, 0, 4, flowClass=0, volume=100.0)
-
-    # Create mask excluding node 1 (part of primary path)
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[1] = False  # Exclude node 1
-
-    # With mask - should place using alternate paths
-    fg2 = ngc.FlowGraph(g)
-    policy2 = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=100.0)
-
-    # Should still place flow (via nodes 2 or 3)
-    assert placed2 > 0, f"{config_name}: failed to place when node 1 masked"
-
-    # Placement with mask may differ from without mask (configuration-dependent)
-    # Verifies alternate path discovery when primary path is masked
-
-
-# ============================================================================
-# TEST 2: EDGE MASK EXCLUSION
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_edge_mask_excludes_edge(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify configurations respect edge exclusions."""
-    g = redundant_paths_graph
-
-    # Without mask
-    fg1 = ngc.FlowGraph(g)
-    policy1 = make_flow_policy(config_name, algs, to_handle(g), edge_mask=None)
-    placed1, _ = policy1.place_demand(fg1, 0, 4, flowClass=0, volume=100.0)
-
-    # Create mask excluding edge 0 (0->1, first hop of primary path)
-    edge_mask = np.ones(6, dtype=bool)
-    edge_mask[0] = False  # Exclude edge 0
-
-    # With mask - should use alternate paths
-    fg2 = ngc.FlowGraph(g)
-    policy2 = make_flow_policy(config_name, algs, to_handle(g), edge_mask=edge_mask)
-    placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=100.0)
-
-    # Should still place flow (via other edges)
-    assert placed2 > 0, f"{config_name}: failed to place when edge 0 masked"
-
-
-# ============================================================================
-# TEST 3: MASK REDUCES CAPACITY
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", CAPACITY_AWARE_CONFIGS)
-def test_mask_reduces_available_capacity(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify masking reduces available capacity correctly."""
-    g = redundant_paths_graph
-
-    # Without mask - get baseline capacity
-    fg1 = ngc.FlowGraph(g)
-    policy1 = make_flow_policy(config_name, algs, to_handle(g))
-    placed1, _ = policy1.place_demand(fg1, 0, 4, flowClass=0, volume=1000.0)
-
-    # With mask excluding primary path nodes
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[1] = False  # Exclude primary path
-
-    fg2 = ngc.FlowGraph(g)
-    policy2 = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=1000.0)
-
-    # Masked version should place less or equal
-    assert placed2 <= placed1 + 1e-6, (
-        f"{config_name}: masking didn't reduce or maintain capacity. "
-        f"Without mask: {placed1}, with mask: {placed2}"
-    )
-
-
-# ============================================================================
-# TEST 4: MASK CHANGES COSTS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_mask_forces_higher_cost_paths(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify masking forces use of alternate (more expensive) paths."""
-    g = redundant_paths_graph
-
-    # Helper to extract minimum cost
-    def get_min_cost(policy):
-        flows = policy.flows
-        if not flows:
-            return float("inf")
-        costs = [v[2] for v in flows.values()]
-        return min(costs)
-
-    # Without mask - should use cheap paths (cost 10)
-    fg1 = ngc.FlowGraph(g)
-    policy1 = make_flow_policy(config_name, algs, to_handle(g))
-    placed1, _ = policy1.place_demand(fg1, 0, 4, flowClass=0, volume=50.0)
-
-    if placed1 > 0:
-        min_cost1 = get_min_cost(policy1)
-
-        # With mask excluding cheap paths - should use expensive path (cost 15)
-        node_mask = np.ones(5, dtype=bool)
-        node_mask[1] = False  # Exclude node 1
-        node_mask[2] = False  # Exclude node 2
-
-        fg2 = ngc.FlowGraph(g)
-        policy2 = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-        placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=50.0)
-
-        if placed2 > 0:
-            min_cost2 = get_min_cost(policy2)
-
-            # Masked version should use more expensive paths
-            assert min_cost2 >= min_cost1 - 1e-6, (
-                f"{config_name}: masking didn't increase or maintain path cost. "
-                f"Without mask: {min_cost1}, with mask: {min_cost2}"
-            )
-
-
-# ============================================================================
-# TEST 5: COMPLETE NETWORK MASKING
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_complete_mask_blocks_all_paths(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when all paths are masked."""
-    g = redundant_paths_graph
-
-    # Mask all intermediate nodes
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[1] = False  # Exclude all
-    node_mask[2] = False  # intermediate
-    node_mask[3] = False  # nodes
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=100.0)
-
-    # Should place nothing
-    assert placed == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: placed volume when all paths masked"
-    )
-    assert remaining == pytest.approx(100.0, abs=1e-9), (
-        f"{config_name}: remaining doesn't match demand when all paths masked"
-    )
-
-
-# ============================================================================
-# TEST 6: SOURCE NODE MASKED
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_source_node_masked(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when source node is masked."""
-    g = redundant_paths_graph
-
-    # Mask source node
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[0] = False  # Exclude source
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=100.0)
-
-    # Should place nothing (no traversal can start from excluded source)
-    assert placed == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: placed volume when source masked"
-    )
-    assert remaining == pytest.approx(100.0, abs=1e-9), (
-        f"{config_name}: remaining doesn't match demand when source masked"
-    )
-
-
-# ============================================================================
-# TEST 7: DESTINATION NODE MASKED
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_destination_node_masked(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior when destination node is masked."""
-    g = redundant_paths_graph
-
-    # Mask destination node
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[4] = False  # Exclude destination
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=100.0)
-
-    # Should place nothing (cannot reach excluded destination)
-    assert placed == pytest.approx(0.0, abs=1e-9), (
-        f"{config_name}: placed volume when destination masked"
-    )
-    assert remaining == pytest.approx(100.0, abs=1e-9), (
-        f"{config_name}: remaining doesn't match demand when destination masked"
-    )
-
-
-# ============================================================================
-# TEST 8: COMBINED NODE AND EDGE MASKS
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ALL_CONFIGS)
-def test_combined_node_and_edge_masks(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify behavior with both node and edge masks."""
-    g = redundant_paths_graph
-
-    # Exclude node 1 and edge 2 (0->2)
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[1] = False
-
-    edge_mask = np.ones(6, dtype=bool)
-    edge_mask[2] = False
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(
-        config_name, algs, to_handle(g), node_mask=node_mask, edge_mask=edge_mask
-    )
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=100.0)
-
-    # Should still place via expensive path (0->3->4)
-    assert placed > 0, f"{config_name}: failed to place with combined masks"
-
-
-# ============================================================================
-# TEST 9: MASK VALIDATION
-# ============================================================================
-
-
-def test_invalid_node_mask_length(
-    redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify that invalid mask lengths are rejected."""
-    g = redundant_paths_graph
-
-    # Create mask with wrong length
-    node_mask = np.ones(10, dtype=bool)  # Graph has 5 nodes, not 10
-
-    # Should raise TypeError for length mismatch
-    with pytest.raises(TypeError, match="node_mask"):
-        make_flow_policy("SHORTEST_PATHS_ECMP", algs, to_handle(g), node_mask=node_mask)
-
-
-def test_invalid_edge_mask_length(
-    redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify that invalid mask lengths are rejected."""
-    g = redundant_paths_graph
-
-    # Create mask with wrong length
-    edge_mask = np.ones(10, dtype=bool)  # Graph has 6 edges, not 10
-
-    # Should raise TypeError for length mismatch
-    with pytest.raises(TypeError, match="edge_mask"):
-        make_flow_policy("SHORTEST_PATHS_ECMP", algs, to_handle(g), edge_mask=edge_mask)
-
-
-def test_invalid_mask_dtype(redundant_paths_graph, algs, to_handle, make_flow_policy):
-    """Verify that non-bool masks are rejected."""
-    g = redundant_paths_graph
-
-    # Create mask with wrong dtype
-    node_mask = np.ones(5, dtype=np.float64)  # Should be bool
-
-    # Should raise TypeError for wrong dtype
-    with pytest.raises(TypeError, match="bool"):
-        make_flow_policy("SHORTEST_PATHS_ECMP", algs, to_handle(g), node_mask=node_mask)
-
-
-# ============================================================================
-# TEST 10: MASK IMMUTABILITY
-# ============================================================================
-
-
-@pytest.mark.parametrize("config_name", ["SHORTEST_PATHS_ECMP", "TE_WCMP_UNLIM"])
-def test_mask_is_copied(
-    config_name, redundant_paths_graph, algs, to_handle, make_flow_policy
-):
-    """Verify that masks are copied (not referenced) by FlowPolicy."""
-    g = redundant_paths_graph
-
-    # Create mask
-    node_mask = np.ones(5, dtype=bool)
-    node_mask[1] = False
-
-    fg = ngc.FlowGraph(g)
-    policy = make_flow_policy(config_name, algs, to_handle(g), node_mask=node_mask)
-    placed1, _ = policy.place_demand(fg, 0, 4, flowClass=0, volume=50.0)
-
-    # Modify the mask after policy creation
-    node_mask[2] = False
-
-    # Policy should not be affected by external mask changes
-    # (behavior should be consistent with first placement)
-    policy2 = make_flow_policy(config_name, algs, to_handle(g), node_mask=None)
-    fg2 = ngc.FlowGraph(g)
-    # This test mainly validates that the policy doesn't crash or behave erratically
-    # The actual assertion is that this doesn't raise an exception
-    placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=50.0)
-    assert placed2 > 0  # Should work normally
diff --git a/tests/py/test_flow_policy_path_distribution.py b/tests/py/test_flow_policy_path_distribution.py
deleted file mode 100644
index e308d58..0000000
--- a/tests/py/test_flow_policy_path_distribution.py
+++ /dev/null
@@ -1,532 +0,0 @@
-"""FlowPolicy path distribution tests.
-
-Verifies that LSPs distribute correctly across available equal-cost paths:
-- All available paths are utilized
-- Flow distribution is balanced (not clustered)
-- Per-path volumes match expected values
-- ECMP equal-balancing constraint is satisfied
-"""
-
-from __future__ import annotations
-
-import pytest
-
-import netgraph_core as ngc
-
-# ============================================================================
-# HELPER FUNCTIONS
-# ============================================================================
-
-
-def analyze_path_usage(
-    fg: ngc.FlowGraph, graph: ngc.StrictMultiDiGraph, source: int, target: int
-) -> dict[int, float]:
-    """Analyze which parallel paths are used and their volumes.
-
-    Returns dict mapping middle_node_id -> total_flow_volume
-    """
-    edge_flows = fg.edge_flow_view()
-    edge_src = graph.edge_src_view()
-    edge_dst = graph.edge_dst_view()
-
-    path_usage = {}
-
-    # Find all edges from source
-    for edge_id in range(graph.num_edges()):
-        if edge_src[edge_id] == source:
-            middle_node = edge_dst[edge_id]
-            flow = edge_flows[edge_id]
-            if flow > 0.001:
-                path_usage[middle_node] = flow
-
-    return path_usage
-
-
-def count_lsps_per_path(
-    policy: ngc.FlowPolicy,
-    fg: ngc.FlowGraph,
-    graph: ngc.StrictMultiDiGraph,
-    source: int,
-    target: int,
-) -> dict[int, list[int]]:
-    """Count how many LSPs use each path.
-
-    Returns dict mapping middle_node_id -> list of flow_ids
-    """
-    edge_src = graph.edge_src_view()
-    edge_dst = graph.edge_dst_view()
-
-    path_lsps = {}
-
-    # For each flow, determine which path it uses
-    for flow_id in range(policy.flow_count()):
-        try:
-            flow_index = ngc.FlowIndex(source, target, 0, flow_id)
-            flow_edges = fg.get_flow_edges(flow_index)
-
-            # Find the middle node this flow uses
-            # flow_edges is list of (edge_id, volume) tuples
-            for edge_id, _ in flow_edges:
-                src = edge_src[edge_id]
-                dst = edge_dst[edge_id]
-                if src == source:
-                    middle_node = dst
-                    if middle_node not in path_lsps:
-                        path_lsps[middle_node] = []
-                    path_lsps[middle_node].append(flow_id)
-                    break
-        except (KeyError, RuntimeError):
-            pass  # Flow might not exist or have no edges
-
-    return path_lsps
-
-
-# ============================================================================
-# TEST FIXTURES: Parallel Path Topologies
-# ============================================================================
-
-
-@pytest.fixture
-def parallel_3_paths(build_graph):
-    """Three parallel 2-hop paths, each with capacity 100."""
-    edges = [
-        (0, 1, 1, 100.0),  # S -> M1
-        (0, 2, 1, 100.0),  # S -> M2
-        (0, 3, 1, 100.0),  # S -> M3
-        (1, 4, 1, 100.0),  # M1 -> T
-        (2, 4, 1, 100.0),  # M2 -> T
-        (3, 4, 1, 100.0),  # M3 -> T
-    ]
-    return build_graph(5, edges)
-
-
-@pytest.fixture
-def parallel_5_paths(build_graph):
-    """Five parallel 2-hop paths."""
-    edges = [
-        (0, 1, 1, 100.0),
-        (0, 2, 1, 100.0),
-        (0, 3, 1, 100.0),
-        (0, 4, 1, 100.0),
-        (0, 5, 1, 100.0),
-        (1, 6, 1, 100.0),
-        (2, 6, 1, 100.0),
-        (3, 6, 1, 100.0),
-        (4, 6, 1, 100.0),
-        (5, 6, 1, 100.0),
-    ]
-    return build_graph(7, edges)
-
-
-@pytest.fixture
-def parallel_2_paths(build_graph):
-    """Two parallel 2-hop paths."""
-    edges = [
-        (0, 1, 1, 100.0),
-        (0, 2, 1, 100.0),
-        (1, 3, 1, 100.0),
-        (2, 3, 1, 100.0),
-    ]
-    return build_graph(4, edges)
-
-
-# ============================================================================
-# PATH UTILIZATION TESTS
-# ============================================================================
-
-
-def test_all_paths_used_with_multipath_false_3_paths_6_lsps(
-    parallel_3_paths, algs, to_handle
-):
-    """CRITICAL: When multipath=false, ALL available paths must be used.
-
-    This is the test that would have caught the bug!
-
-    With 3 paths and 6 LSPs:
-    - Expected: 2 LSPs per path (optimal distribution)
-    - Bug behavior: Only 2 paths used, 3 LSPs each, path-3 idle
-    """
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False  # Each LSP uses ONE path
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 250.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Check path usage
-    path_usage = analyze_path_usage(fg, g, 0, 4)
-
-    # CRITICAL ASSERTION: All 3 paths must be used!
-    assert len(path_usage) == 3, (
-        f"Expected all 3 paths to be used, but only {len(path_usage)} were used. "
-        f"Paths with flow: {list(path_usage.keys())}"
-    )
-
-    # All paths should have equal flow (100 each with optimal distribution)
-    # With 6 LSPs and 3 paths: 2 LSPs per path = 100 capacity / 2 = 50 per LSP
-    # Total per path: 2 * 50 = 100 units (if using reoptimization)
-    # OR if balanced: each LSP gets demand/6, so 250/6 = 41.67 per LSP
-    # With 2 LSPs per path: 2 * 41.67 = 83.33 per path
-
-    for path_id, flow in path_usage.items():
-        assert flow > 0.0, f"Path {path_id} has zero flow"
-
-    # Check LSP distribution
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 4)
-
-    # With 6 LSPs and 3 paths, each path should have 2 LSPs
-    for path_id in [1, 2, 3]:  # Middle nodes
-        lsp_count = len(lsps_per_path.get(path_id, []))
-        assert lsp_count == 2, (
-            f"Path via node {path_id} should have 2 LSPs, but has {lsp_count}. "
-            f"Distribution: {lsps_per_path}"
-        )
-
-    # Expected capacity: 6 LSPs * 50 units = 300 units (if perfectly balanced)
-    # With demand=250, we should place it all
-    assert placed >= 240.0, (  # Allow some tolerance
-        f"Expected to place ~250 units with optimal distribution, got {placed}"
-    )
-
-
-def test_all_paths_used_with_multipath_false_5_paths_3_lsps(
-    parallel_5_paths, algs, to_handle
-):
-    """When paths > LSPs, only use as many paths as needed, but distribute optimally."""
-    g = parallel_5_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False
-    config.min_flow_count = 3
-    config.max_flow_count = 3
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 150.0
-    placed, remaining = policy.place_demand(fg, 0, 6, flowClass=0, volume=demand)
-
-    # Check path usage
-    path_usage = analyze_path_usage(fg, g, 0, 6)
-
-    # With 3 LSPs and 5 paths: should use 3 paths (1 LSP each)
-    assert len(path_usage) == 3, (
-        f"Expected 3 paths to be used (1 LSP each), but {len(path_usage)} were used"
-    )
-
-    # Check LSP distribution
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 6)
-
-    # Each used path should have exactly 1 LSP
-    for path_id, lsp_list in lsps_per_path.items():
-        assert len(lsp_list) == 1, (
-            f"Path {path_id} should have 1 LSP, has {len(lsp_list)}"
-        )
-
-    # With 1 LSP per path and 100 capacity: 3 * 100 = 300 available
-    # Demand is 150, so should place it all
-    assert placed == pytest.approx(150.0, abs=1.0), (
-        f"Expected to place all 150 units, got {placed}"
-    )
-
-
-def test_all_paths_used_with_multipath_false_2_paths_6_lsps(
-    parallel_2_paths, algs, to_handle
-):
-    """When LSPs > paths, distribute evenly across available paths."""
-    g = parallel_2_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 200.0
-    placed, remaining = policy.place_demand(fg, 0, 3, flowClass=0, volume=demand)
-
-    # Check path usage
-    path_usage = analyze_path_usage(fg, g, 0, 3)
-
-    # Both paths must be used
-    assert len(path_usage) == 2, (
-        f"Expected both paths to be used, but only {len(path_usage)} were used"
-    )
-
-    # Check LSP distribution
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 3)
-
-    # With 6 LSPs and 2 paths: each path should have 3 LSPs
-    for path_id in [1, 2]:  # Middle nodes
-        lsp_count = len(lsps_per_path.get(path_id, []))
-        assert lsp_count == 3, (
-            f"Path via node {path_id} should have 3 LSPs, but has {lsp_count}"
-        )
-
-    # With 3 LSPs per path and 100 capacity: 100/3 = 33.33 per LSP
-    # Total: 6 * 33.33 = 200 units
-    assert placed == pytest.approx(200.0, abs=1.0), (
-        f"Expected to place all 200 units, got {placed}"
-    )
-
-
-# ============================================================================
-# TEST: Path Distribution Balance
-# ============================================================================
-
-
-def test_balanced_path_distribution_multipath_false(parallel_3_paths, algs, to_handle):
-    """Verify LSPs are evenly distributed across paths, not clustered."""
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    config.multipath = False
-    config.min_flow_count = 9  # 9 LSPs across 3 paths = 3 per path
-    config.max_flow_count = 9
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 300.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Check LSP distribution
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 4)
-
-    # All 3 paths must be used
-    assert len(lsps_per_path) == 3, "All 3 paths must be used"
-
-    # Each path should have exactly 3 LSPs (9 / 3 = 3)
-    for path_id in [1, 2, 3]:
-        lsp_count = len(lsps_per_path.get(path_id, []))
-        assert lsp_count == 3, (
-            f"Path {path_id} should have 3 LSPs for balanced distribution, "
-            f"but has {lsp_count}"
-        )
-
-    # With 3 LSPs per path and 100 capacity: 100/3 = 33.33 per LSP
-    # Total: 9 * 33.33 = 300 units
-    assert placed == pytest.approx(300.0, abs=1.0)
-
-
-# ============================================================================
-# TEST: ECMP Equal-Balancing Constraint
-# ============================================================================
-
-
-def test_ecmp_all_lsps_equal_volume(parallel_3_paths, algs, to_handle):
-    """Verify ECMP constraint: all LSPs must carry equal volume."""
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 240.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Extract flow volumes
-    flow_volumes = []
-    for flow_id in range(policy.flow_count()):
-        flow_key = (0, 4, 0, flow_id)
-        if flow_key in policy.flows:
-            flow_info = policy.flows[flow_key]
-            volume = flow_info[3]
-            flow_volumes.append(volume)
-
-    # All flows should have equal volume (ECMP constraint)
-    if len(flow_volumes) > 0:
-        expected_volume = flow_volumes[0]
-        for vol in flow_volumes:
-            assert vol == pytest.approx(expected_volume, abs=0.01), (
-                f"ECMP violation: LSPs have different volumes: {flow_volumes}"
-            )
-
-
-# ============================================================================
-# TEST: Multipath=True Should Use All Paths Differently
-# ============================================================================
-
-
-def test_multipath_true_uses_all_paths(parallel_3_paths, algs, to_handle):
-    """With multipath=true, each flow should split across all paths."""
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = True  # Each flow SPLITS across all paths
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    demand = 250.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Check path usage
-    path_usage = analyze_path_usage(fg, g, 0, 4)
-
-    # All 3 paths must be used
-    assert len(path_usage) == 3, (
-        f"With multipath=true, all paths should be used, "
-        f"but only {len(path_usage)} were used"
-    )
-
-    # With multipath=true, flows are evenly distributed
-    # 6 flows, each taking 1/3 of each path = 2 "effective" flows per path
-    # Each flow: 250/6 = 41.67 units, split 1/3 per path = 13.89 per path per flow
-    # Total per path: 6 * 13.89 = 83.33 units
-
-    for flow in path_usage.values():
-        assert flow == pytest.approx(83.33, abs=1.0), (
-            "With multipath=true, paths should be equally loaded"
-        )
-
-    # Should place all demand
-    assert placed == pytest.approx(250.0, abs=1.0)
-
-
-# ============================================================================
-# TEST: Progressive Flow Addition
-# ============================================================================
-
-
-def test_incremental_lsp_placement(parallel_3_paths, algs, to_handle):
-    """Test placing LSPs incrementally to verify path selection logic."""
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False
-    config.min_flow_count = 1
-    config.max_flow_count = 1
-    config.reoptimize_flows_on_each_placement = False
-
-    # Place LSPs one at a time using DIFFERENT flowClasses (each represents a separate LSP)
-    lsp_volume = 30.0
-    paths_used_over_time = []
-
-    for i in range(6):
-        policy = ngc.FlowPolicy(algs, to_handle(g), config)  # New policy for each "LSP"
-        placed, remaining = policy.place_demand(
-            fg,
-            0,
-            4,
-            flowClass=i,
-            volume=lsp_volume,  # Different flowClass = different LSP
-        )
-
-        path_usage = analyze_path_usage(fg, g, 0, 4)
-        paths_used_over_time.append(set(path_usage.keys()))
-
-        # After 3 LSPs, all 3 paths should be in use
-        if i >= 2:
-            assert len(path_usage) == 3, (
-                f"After placing {i + 1} LSPs, all 3 paths should be used, "
-                f"but only {len(path_usage)} are used: {list(path_usage.keys())}"
-            )
-
-
-# ============================================================================
-# TEST: Capacity Constraint Enforcement
-# ============================================================================
-
-
-def test_capacity_limits_with_multipath_false(parallel_3_paths, algs, to_handle):
-    """Verify capacity constraints are properly enforced per path."""
-    g = parallel_3_paths
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.path_alg = ngc.PathAlg.SPF
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.selection = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    config.multipath = False
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-
-    # Demand exceeds total capacity (3 * 100 = 300)
-    demand = 400.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Should place at most 300 (total capacity)
-    assert placed <= 300.0, f"Placed {placed} exceeds total capacity of 300"
-    assert remaining >= 100.0, f"Should have at least 100 remaining, got {remaining}"
-
-    # Check no path is over-utilized
-    edge_flows = fg.edge_flow_view()
-    edge_cap = g.capacity_view()
-
-    for edge_id in range(g.num_edges()):
-        flow = edge_flows[edge_id]
-        cap = edge_cap[edge_id]
-        assert flow <= cap + 0.1, (  # Small tolerance for floating point
-            f"Edge {edge_id} flow ({flow}) exceeds capacity ({cap})"
-        )
diff --git a/tests/py/test_flow_policy_spf_memo.py b/tests/py/test_flow_policy_spf_memo.py
deleted file mode 100644
index 172e95c..0000000
--- a/tests/py/test_flow_policy_spf_memo.py
+++ /dev/null
@@ -1,158 +0,0 @@
-"""FlowPolicy's SPF memo must be invisible: identical results, fewer SPF runs.
-
-EqualBalanced placement and rebalance rounds re-request path bundles against
-residual state that repeats (94% of SPF calls in a measured place/rebalance
-cycle were exact input repeats), so get_path_bundle memoizes raw SPF results,
-keyed by (src, dst, residual content, residual-awareness). These tests pin the
-one way that can go wrong: a stale hit -- serving a cached DAG computed for
-residuals that have since changed. Each scenario mutates residual state between
-placements and asserts routing reflects the *current* residuals.
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _graph(num_nodes, edges):
-    """edges: (src, dst, cost, cap)."""
-    s = np.array([e[0] for e in edges], np.int32)
-    d = np.array([e[1] for e in edges], np.int32)
-    k = np.array([int(e[2]) for e in edges], np.int64)
-    c = np.array([float(e[3]) for e in edges], np.float64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, s, d, c, k, np.arange(len(edges), dtype=np.int64)
-    )
-
-
-def _eb_policy(algs, gh, **kw):
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    cfg = ngc.FlowPolicyConfig(
-        path_alg=ngc.PathAlg.SPF,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        selection=sel,
-        **kw,
-    )
-    return ngc.FlowPolicy(algs, gh, cfg)
-
-
-def _two_path_graph():
-    """0->1->3 (cost 2) and 0->2->3 (cost 4); cheap path capacity 2."""
-    return _graph(
-        4,
-        [
-            (0, 1, 1, 2.0),
-            (1, 3, 1, 2.0),
-            (0, 2, 2, 10.0),
-            (2, 3, 2, 10.0),
-        ],
-    )
-
-
-def _edges_used(fg, g, idx):
-    flows = fg.get_flow_edges(ngc.FlowIndex(*idx))
-    src = np.asarray(g.edge_src_view())
-    dst = np.asarray(g.edge_dst_view())
-    return {(int(src[e]), int(dst[e])) for e, amt in flows if amt > 1e-12}
-
-
-class TestMemoInvalidation:
-    def test_replacement_sees_residuals_changed_by_another_policy(self, algs):
-        """A cached bundle must not survive residual changes made between calls.
-
-        Policy A places on the cheap path and is removed (restoring residuals,
-        which reproduces the memo's key). Policy B then saturates the cheap
-        path through the same FlowGraph. When A places again, its SPF runs
-        against the *new* residuals and must route via the expensive path; a
-        stale memo hit would re-serve the cheap-path DAG.
-        """
-        g = _two_path_graph()
-        gh = algs.build_graph(g)
-        fg = ngc.FlowGraph(g)
-
-        pa = _eb_policy(algs, gh, max_flow_count=1, min_flow_count=1)
-        placed, _ = pa.place_demand(fg, 0, 3, 0, 1.0)
-        assert placed == pytest.approx(1.0)
-        (idx,) = pa.flows.keys()
-        assert _edges_used(fg, g, idx) == {(0, 1), (1, 3)}
-        pa.remove_demand(fg)  # residual content is now back to the initial bytes
-
-        pb = _eb_policy(algs, gh, max_flow_count=1, min_flow_count=1)
-        placed_b, _ = pb.place_demand(fg, 0, 3, 1, 2.0)
-        assert placed_b == pytest.approx(2.0)  # saturates 0->1->3
-
-        placed2, _ = pa.place_demand(fg, 0, 3, 0, 1.0)
-        assert placed2 == pytest.approx(1.0)
-        (idx2,) = pa.flows.keys()
-        assert _edges_used(fg, g, idx2) == {(0, 2), (2, 3)}, (
-            "placement after residual change reused a stale cached path"
-        )
-
-    def test_alternating_flow_graphs_stay_isolated(self, algs):
-        """One policy asked about two FlowGraphs must answer for the right one.
-
-        fg_busy has the cheap path saturated; fg_idle does not. Alternating
-        get-path queries (via place/remove cycles) between the two must route
-        differently every time, regardless of which answer the memo last held.
-        """
-        g = _two_path_graph()
-        gh = algs.build_graph(g)
-        fg_idle = ngc.FlowGraph(g)
-        fg_busy = ngc.FlowGraph(g)
-
-        blocker = _eb_policy(algs, gh, max_flow_count=1, min_flow_count=1)
-        placed, _ = blocker.place_demand(fg_busy, 0, 3, 9, 2.0)
-        assert placed == pytest.approx(2.0)
-
-        prober = _eb_policy(algs, gh, max_flow_count=1, min_flow_count=1)
-        for _ in range(3):
-            placed, _ = prober.place_demand(fg_idle, 0, 3, 0, 1.0)
-            assert placed == pytest.approx(1.0)
-            (idx,) = prober.flows.keys()
-            assert _edges_used(fg_idle, g, idx) == {(0, 1), (1, 3)}
-            prober.remove_demand(fg_idle)
-
-            placed, _ = prober.place_demand(fg_busy, 0, 3, 0, 1.0)
-            assert placed == pytest.approx(1.0)
-            (idx,) = prober.flows.keys()
-            assert _edges_used(fg_busy, g, idx) == {(0, 2), (2, 3)}
-            prober.remove_demand(fg_busy)
-
-    def test_eb_rebalance_churn_matches_fresh_policy(self, algs):
-        """Heavy place/rebalance churn (the memoized path) must land exactly
-        where a fresh policy with no memo history lands."""
-        rng = np.random.default_rng(3)
-        n = 24
-        edges = []
-        for _ in range(70):
-            u, v = rng.integers(0, n, size=2)
-            if u != v:
-                edges.append(
-                    (
-                        int(u),
-                        int(v),
-                        int(rng.integers(1, 21)),
-                        float(rng.integers(1, 6)),
-                    )
-                )
-        g = _graph(n, edges)
-        gh = algs.build_graph(g)
-
-        def run(cycles):
-            p = _eb_policy(algs, gh, max_flow_count=4, min_flow_count=4)
-            fg = ngc.FlowGraph(g)
-            for _ in range(cycles):
-                p.place_demand(fg, 0, n - 1, 0, 8.0)
-                p.rebalance_demand(fg, 0, n - 1, 0, 2.0)
-            return np.asarray(fg.edge_flow_view()).copy()
-
-        churned = run(cycles=4)  # memo-heavy history
-        fresh = run(cycles=4)  # brand-new policy, identical inputs
-        np.testing.assert_array_equal(churned, fresh)
diff --git a/tests/py/test_flow_policy_validation.py b/tests/py/test_flow_policy_validation.py
deleted file mode 100644
index 9f2c62b..0000000
--- a/tests/py/test_flow_policy_validation.py
+++ /dev/null
@@ -1,385 +0,0 @@
-"""Validation tests for FlowPolicy path distribution and flow placement.
-
-Tests cover:
-- Path usage and distribution
-- Optimality vs theoretical maximum
-- ECMP constraints and balancing
-"""
-
-import numpy as np
-import pytest
-from conftest import (
-    analyze_path_usage,
-    calculate_theoretical_capacity_parallel_paths,
-    check_distribution_balanced,
-    count_lsps_per_path,
-)
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-# ============================================================================
-# FIXTURES: Test Topologies
-# ============================================================================
-
-
-@pytest.fixture
-def parallel_paths_varying_capacities():
-    """3 parallel paths with different capacities for distribution testing."""
-    # S -> [M1, M2, M3] -> T
-    # Paths: S-M1-T (cap 100), S-M2-T (cap 50), S-M3-T (cap 75)
-    num_nodes = 5
-    src = np.array([0, 0, 0, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4, 4], dtype=np.int32)
-    cap = np.array([100.0, 50.0, 75.0, 100.0, 50.0, 75.0], dtype=np.float64)
-    cost = np.array([10, 10, 10, 10, 10, 10], dtype=np.int64)  # Equal costs
-
-    return _make_graph(num_nodes, src, dst, cap, cost)
-
-
-# ============================================================================
-# TEST 1: Path Distribution and Balance
-# ============================================================================
-
-
-def test_path_distribution_with_equal_cost_paths(algs, to_handle):
-    """Verify LSPs are evenly distributed across equal-cost paths."""
-    # Create topology with 4 equal-cost parallel paths
-    num_nodes = 6
-    src = np.array([0, 0, 0, 0, 1, 2, 3, 4], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 5, 5, 5, 5], dtype=np.int32)
-    cap = np.array([50.0] * 8, dtype=np.float64)
-    cost = np.array([10] * 8, dtype=np.int64)  # All equal cost
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False  # Single-path LSPs
-    config.min_flow_count = 8  # 8 LSPs for 4 paths = 2 per path
-    config.max_flow_count = 8
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    placed, remaining = policy.place_demand(fg, 0, 5, flowClass=0, volume=100.0)
-
-    # Verify all paths are used
-    path_usage = analyze_path_usage(fg, g, 0, 5)
-    assert len(path_usage) == 4, (
-        f"Expected all 4 paths to be used, got {len(path_usage)}: {list(path_usage.keys())}"
-    )
-
-    # Verify LSPs are evenly distributed
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 5)
-    is_balanced, stats = check_distribution_balanced(lsps_per_path, tolerance=0)
-    assert is_balanced, f"LSPs not evenly distributed: {stats}"
-
-    # Each path should have exactly 2 LSPs
-    for path_id in [1, 2, 3, 4]:
-        assert path_id in lsps_per_path, f"Path {path_id} has no LSPs"
-        assert len(lsps_per_path[path_id]) == 2, (
-            f"Path {path_id} should have 2 LSPs, has {len(lsps_per_path[path_id])}"
-        )
-
-
-def test_path_usage_optimality(algs, to_handle):
-    """Verify that available paths are used optimally to maximize capacity."""
-    # 5 parallel paths, 10 LSPs -> should use all 5 paths (2 LSPs each)
-    num_nodes = 7
-    src = np.array([0, 0, 0, 0, 0, 1, 2, 3, 4, 5], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 5, 6, 6, 6, 6, 6], dtype=np.int32)
-    cap = np.array([100.0] * 10, dtype=np.float64)
-    cost = np.array([10] * 10, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    config.min_flow_count = 10
-    config.max_flow_count = 10
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    demand = 500.0
-    placed, remaining = policy.place_demand(fg, 0, 6, flowClass=0, volume=demand)
-
-    # Calculate theoretical maximum
-    num_paths = 5
-    num_lsps = 10
-    theoretical_max = calculate_theoretical_capacity_parallel_paths(
-        100.0, num_paths, num_lsps
-    )
-
-    # Should achieve theoretical maximum (or very close)
-    assert placed >= theoretical_max * 0.99, (
-        f"Placed {placed} is less than 99% of theoretical max {theoretical_max}"
-    )
-
-
-# ============================================================================
-# TEST 2: ECMP Constraints
-# ============================================================================
-
-
-def test_ecmp_equal_balancing_strict(algs, to_handle):
-    """Verify ECMP constraint: all LSPs must carry equal volume."""
-    num_nodes = 5
-    src = np.array([0, 0, 0, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4, 4], dtype=np.int32)
-    cap = np.array([100.0, 100.0, 100.0, 100.0, 100.0, 100.0], dtype=np.float64)
-    cost = np.array([10] * 6, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    config.min_flow_count = 12  # 12 LSPs
-    config.max_flow_count = 12
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=100.0)
-
-    # Verify all LSPs have equal volume
-    flows = policy.flows
-    volumes = [v[3] for v in flows.values()]
-
-    if len(volumes) > 1:
-        ref_volume = volumes[0]
-        for vol in volumes:
-            assert vol == pytest.approx(ref_volume, abs=1e-3), (
-                f"ECMP violation: volumes not equal. Got {volumes}"
-            )
-
-
-def test_ecmp_with_path_capacity_constraints(
-    algs, to_handle, parallel_paths_varying_capacities
-):
-    """Verify ECMP with varying path capacities limits correctly."""
-    g = parallel_paths_varying_capacities
-    fg = ngc.FlowGraph(g)
-
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    config.min_flow_count = 6  # 6 LSPs for 3 paths
-    config.max_flow_count = 6
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    demand = 300.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Bottleneck: M2 has only 50 capacity
-    # With 6 LSPs, some must share M2, limiting per-LSP volume to 50/N_M2
-    # Theoretical max depends on distribution
-
-    # Verify accounting
-    assert placed + remaining == pytest.approx(demand, abs=1e-6)
-
-    # Verify ECMP: all LSPs have equal volume
-    flows = policy.flows
-    volumes = [v[3] for v in flows.values()]
-    if len(volumes) > 1:
-        ref_volume = volumes[0]
-        for vol in volumes:
-            assert vol == pytest.approx(ref_volume, abs=1e-3)
-
-
-# ============================================================================
-# TEST 3: Multi-path vs Single-path Behavior
-# ============================================================================
-
-
-def test_multipath_true_vs_false_capacity_difference(algs, to_handle):
-    """Verify multipath=true achieves higher capacity than multipath=false."""
-    # Topology with 3 equal-cost parallel paths
-    num_nodes = 5
-    src = np.array([0, 0, 0, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4, 4], dtype=np.int32)
-    cap = np.array([100.0] * 6, dtype=np.float64)
-    cost = np.array([10] * 6, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    # Test 1: multipath=true (hash-based ECMP)
-    fg1 = ngc.FlowGraph(g)
-    config1 = ngc.FlowPolicyConfig()
-    config1.multipath = True  # Each flow splits across all paths
-    config1.min_flow_count = 3
-    config1.max_flow_count = 3
-    policy1 = ngc.FlowPolicy(algs, to_handle(g), config1)
-    placed1, _ = policy1.place_demand(fg1, 0, 4, flowClass=0, volume=500.0)
-
-    # Test 2: multipath=false (tunnel-based ECMP)
-    fg2 = ngc.FlowGraph(g)
-    config2 = ngc.FlowPolicyConfig()
-    config2.multipath = False  # Each flow uses single path
-    config2.min_flow_count = 3
-    config2.max_flow_count = 3
-    policy2 = ngc.FlowPolicy(algs, to_handle(g), config2)
-    placed2, _ = policy2.place_demand(fg2, 0, 4, flowClass=0, volume=500.0)
-
-    # multipath=true should achieve significantly more capacity
-    # With 3 flows and 3 paths:
-    # - multipath=true: each flow uses all 3 paths (hash-based ECMP)
-    # - multipath=false: each flow uses 1 path (tunnel-based ECMP)
-    # Both should achieve similar total throughput with balanced distribution.
-
-    # Verify multipath=true placement is at least as good as multipath=false
-    assert placed1 >= placed2 * 0.99, (
-        f"multipath=true ({placed1}) should not be worse than multipath=false ({placed2})"
-    )
-
-
-# ============================================================================
-# TEST 4: Flow Count Verification
-# ============================================================================
-
-
-def test_flow_count_matches_configuration(algs, to_handle):
-    """Verify exact flow count matches configuration when paths available."""
-    # Create topology with 10 parallel paths (plenty)
-    src_nodes = list(range(10))
-    dst_nodes = list(range(1, 11))
-    src = np.array(src_nodes + dst_nodes, dtype=np.int32)
-    dst = np.array(dst_nodes + [11] * 10, dtype=np.int32)
-    cap = np.array([100.0] * 20, dtype=np.float64)
-    cost = np.array([10] * 20, dtype=np.int64)
-    g = _make_graph(12, src, dst, cap, cost)
-
-    # Test various flow counts
-    for target_flows in [1, 4, 8, 16]:
-        fg = ngc.FlowGraph(g)
-        config = ngc.FlowPolicyConfig()
-        config.multipath = False
-        config.min_flow_count = target_flows
-        config.max_flow_count = target_flows
-
-        policy = ngc.FlowPolicy(algs, to_handle(g), config)
-        placed, _ = policy.place_demand(fg, 0, 11, flowClass=0, volume=50.0)
-
-        if placed > 0:
-            actual_flows = policy.flow_count()
-            assert actual_flows == target_flows, (
-                f"Expected {target_flows} flows, got {actual_flows}"
-            )
-
-
-# ============================================================================
-# TEST 5: Distribution Variance
-# ============================================================================
-
-
-def test_distribution_variance_minimal(algs, to_handle):
-    """Verify LSP distribution has minimal variance across paths."""
-    # 4 paths, 9 LSPs -> should be [3, 2, 2, 2] or [3, 3, 2, 1] etc
-    # Variance should be at most 1
-    num_nodes = 6
-    src = np.array([0, 0, 0, 0, 1, 2, 3, 4], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 5, 5, 5, 5], dtype=np.int32)
-    cap = np.array([50.0] * 8, dtype=np.float64)
-    cost = np.array([10] * 8, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    config.min_flow_count = 9
-    config.max_flow_count = 9
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    placed, _ = policy.place_demand(fg, 0, 5, flowClass=0, volume=100.0)
-
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 5)
-    is_balanced, stats = check_distribution_balanced(lsps_per_path, tolerance=1)
-
-    assert is_balanced, (
-        f"Distribution variance too high. Stats: {stats}. "
-        f"With 9 LSPs and 4 paths, variance should be ≤1"
-    )
-
-
-# ============================================================================
-# TEST 6: Optimality with Complex Topology
-# ============================================================================
-
-
-def test_capacity_near_theoretical_max(algs, to_handle):
-    """Verify placed capacity is near theoretical maximum."""
-    # Simple scenario: 3 paths, 6 LSPs, equal capacities
-    num_nodes = 5
-    src = np.array([0, 0, 0, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4, 4], dtype=np.int32)
-    cap = np.array([60.0] * 6, dtype=np.float64)
-    cost = np.array([10] * 6, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.multipath = False
-    config.min_flow_count = 6
-    config.max_flow_count = 6
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    demand = 200.0
-    placed, remaining = policy.place_demand(fg, 0, 4, flowClass=0, volume=demand)
-
-    # Theoretical: 3 paths, 6 LSPs -> 2 LSPs per path
-    # Each path has 60 capacity -> 60/2 = 30 per LSP
-    # Total: 6 * 30 = 180
-    theoretical = calculate_theoretical_capacity_parallel_paths(60.0, 3, 6)
-    assert theoretical == 180.0
-
-    # Placed should be at or near theoretical
-    assert placed >= theoretical * 0.95, (
-        f"Placed {placed} is less than 95% of theoretical {theoretical}"
-    )
-
-
-# ============================================================================
-# TEST 7: Path Usage Coverage
-# ============================================================================
-
-
-def test_all_equal_cost_paths_utilized(algs, to_handle):
-    """Verify ALL equal-cost paths are utilized when LSPs exceed path count."""
-    # Critical test: 2 paths, 4 LSPs -> both paths must be used
-    num_nodes = 4
-    src = np.array([0, 0, 1, 2], dtype=np.int32)
-    dst = np.array([1, 2, 3, 3], dtype=np.int32)
-    cap = np.array([50.0] * 4, dtype=np.float64)
-    cost = np.array([10] * 4, dtype=np.int64)
-    g = _make_graph(num_nodes, src, dst, cap, cost)
-
-    fg = ngc.FlowGraph(g)
-    config = ngc.FlowPolicyConfig()
-    config.flow_placement = ngc.FlowPlacement.EQUAL_BALANCED
-    config.multipath = False
-    config.min_flow_count = 4
-    config.max_flow_count = 4
-
-    policy = ngc.FlowPolicy(algs, to_handle(g), config)
-    placed, _ = policy.place_demand(fg, 0, 3, flowClass=0, volume=100.0)
-
-    # Both paths MUST be used
-    path_usage = analyze_path_usage(fg, g, 0, 3)
-    assert len(path_usage) == 2, (
-        f"Both paths must be used with 4 LSPs and 2 paths. "
-        f"Used: {list(path_usage.keys())}"
-    )
-
-    # Each path should have 2 LSPs
-    lsps_per_path = count_lsps_per_path(policy, fg, g, 0, 3)
-    for path_id in [1, 2]:
-        assert path_id in lsps_per_path, f"Path {path_id} not used"
-        assert len(lsps_per_path[path_id]) == 2, (
-            f"Path {path_id} should have 2 LSPs, has {len(lsps_per_path[path_id])}"
-        )
diff --git a/tests/py/test_getter_allocation.py b/tests/py/test_getter_allocation.py
new file mode 100644
index 0000000..7df7578
--- /dev/null
+++ b/tests/py/test_getter_allocation.py
@@ -0,0 +1,509 @@
+"""Every property, repr and own hash of one value of every public class under Python allocation
+failure (the private hook _fail_python_allocation): the k-th Python object allocation of the read
+fails, for every k in turn, and the read raises MemoryError with no value, or returns the value of
+a read without failure. A full collection (gc.collect()) before each attempt empties CPython's
+free lists, so an int or a float a read creates is a new object, never a reused one. A getter that
+converts a value through pybind11's own machinery raises another class (TypeError from a return
+conversion, RuntimeError from its list and tuple constructors) or crashes here instead.
+
+The integers CPython caches (-5 to 256) are never created anew, so a read of a small int cannot
+fail: the number sweep reads wide_values(), where every property that holds an int or a float
+(by the stub's annotation) holds an uncached one, large node and edge ids, entry ids,
+counts and amounts, and every property that holds a Fraction holds one with both components
+uncached, one with only the numerator uncached and one with only the denominator uncached.
+
+Each value's reads run in a child interpreter, so a crash fails this test instead of the session:
+python -B test_getter_allocation.py NAME sweeps every read of one value and prints its count;
+python -B test_getter_allocation.py --wide NAME sweeps the number reads (and the own hash) of one
+wide value."""
+
+from __future__ import annotations
+
+import ast
+import gc
+import os
+import re
+import subprocess
+import sys
+from fractions import Fraction
+from pathlib import Path
+
+if __name__ == "__main__":
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import pytest
+from helpers import build, dag_of
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+
+def values():
+    """One value of every public class with readable fields, by name."""
+    inf = float("inf")
+    g = build(4, [(0, 1, 8, 1), (0, 2, 8, 1), (1, 3, 8, 1), (2, 3, 8, 1)])
+    mask = g.eligibility(excluded_edges=[3])
+    search = ngc.spf(g, 0, ngc.SpfOptions(ngc.Direction.FORWARD))
+    path = ngc.ksp(g, 0, 3, ngc.KspOptions(1))[0][1]
+    wcmp = ngc.ShortestPaths(
+        allocation=ngc.RouteAllocation.WEIGHTED,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[1, 2, 1, 1],
+    )
+    dte = ngc.DistributedTE(ngc.TunnelCount(2), cost_ceiling=ngc.CostStretch(1.5))
+    t2 = ngc.CentralizedTE(
+        source_allocation=ngc.SourceAllocation.EQUAL,
+        support=dag_of(g, [0, 1, 2, 3]),
+        tunnel_count=ngc.TunnelCount(2),
+        prefer_headroom=True,
+    )
+    controller = ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)
+    ledger = ngc.FlowLedger(g)
+    cfg = ngc.FlowPolicyConfig(routing=wcmp)
+    policy = ngc.FlowPolicy(ledger, 0, 3, cfg)
+    result = policy.place(
+        4,
+        ngc.OutputOptions(
+            edge_flows=True, residual=True, saturated_boundary_edges=True
+        ),
+    )
+    t1_result = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        ngc.FlowPolicyConfig(routing=dte, admission=ngc.Admission.LOSSY),
+    ).replace(6, design_demand=6, outputs=ngc.OutputOptions(edge_reservations=True))
+    t2_result = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 3, ngc.FlowPolicyConfig(routing=t2)
+    ).replace(inf)
+    exact = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 3, ngc.FlowPolicyConfig(routing=controller)
+    ).place(inf, ngc.OutputOptions(min_cut=True))
+    failures = ngc.evaluate_edge_failures(
+        g, 0, 3, ngc.EvaluationOptions(ngc.FlowPolicyConfig(routing=controller)), 1
+    )
+    cache = ngc.ShortestPathCache(g)
+    return {
+        "Graph": g,
+        "Eligibility": mask,
+        "SpfResult": search,
+        "PredecessorDAG": search.dag,
+        "Path": path,
+        "ShortestPaths": wcmp,
+        "DistributedTE": dte,
+        "CentralizedTE": t2,
+        "CentralizedTEWeighted": ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.WEIGHTED,
+            source_weights=[1001, 1003, 0, 0],
+        ),
+        "Pinned": ngc.Pinned(t1_result.program, black_holes=mask),
+        "TunnelCount": ngc.TunnelCount(2, up_to=True),
+        "AbsoluteCost": ngc.AbsoluteCost(3),
+        "CostStretch": ngc.CostStretch(1.2),
+        "FlowPolicyConfig": cfg,
+        "OutputOptions": ngc.OutputOptions(min_cut=True),
+        "EvaluationOptions": ngc.EvaluationOptions(cfg, eligibility=mask, offer=5),
+        "SpfOptions": ngc.SpfOptions(
+            ngc.Direction.FORWARD,
+            targets=[3],
+            tie_break=ngc.RouteTieBreak.HIGHER_CAPACITY,
+            multipath=False,
+        ),
+        "KspOptions": ngc.KspOptions(2, cost_ceiling=ngc.CostStretch(2)),
+        "FlowLedger": ledger,
+        "FlowRecord": ledger.records()[0],
+        "FlowPolicy": policy,
+        "PlacementResult": result,
+        "SourceFlow": result.by_source[0],
+        "PlacementResult.T1": t1_result,
+        "TunnelPlan.T1": t1_result.plan,
+        "Tunnel": t1_result.program.tunnels[0],
+        "TunnelFlow": t1_result.by_tunnel[0],
+        "PlacementResult.T2": t2_result,
+        "TunnelPlan.T2": t2_result.plan,
+        "PlacementResult.exact": exact,
+        "ForwardingProgram": ngc.ForwardingProgram.from_dag(
+            g, [0], [3], dag_of(g, [0, 1, 2, 3])
+        ),
+        "RouteDefinition": ngc.RouteDefinition(0, path, weight=2),
+        "SensitivityResult": failures,
+        "SensitivityEntry": failures.entries[0],
+        "ShortestPathCache": cache,
+        "ShortestPathCache.Stats": cache.stats(),
+    }
+
+
+def wide_values():
+    """Values whose int and float properties hold uncached objects: node ids from 296 up, edge ids
+    from 260 up (260 one-unit filler edges come first), capacities of 2^40 units, costs of 2^30, 300
+    tunnels per head (entry ids and local indexes up to 299), policy ids beyond 300, cache counts
+    beyond 256; and whose Fraction properties hold each shape of uncached components."""
+    cap, cost = 2**40, 2**30
+    rows = [(i, i + 1, 1, 1) for i in range(260)]
+    rows += [
+        (296, 299, cap, cost),
+        (297, 298, cap, cost),
+        (298, 299, cap // 2, cost),
+        (297, 299, cap, 3 * cost),
+    ]
+    g = build(300, rows)
+    lossy = ngc.Admission.LOSSY
+    shortest = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    out = {}
+    # Source 296 black-holed: its share is lost at the source; 297's share drops on 298 -> 299.
+    sp = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        [296, 297],
+        299,
+        ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=lossy),
+    )
+    sp.replace(2**41)
+    dark = sp.forward(2**41, black_holes=g.eligibility(excluded_nodes=[296]))
+    out["PlacementResult.dark"] = dark
+    out["SourceFlow.dark"] = dark.by_source[0]
+    out["SourceFlow.drops"] = dark.by_source[1]
+    out["FlowRecord.lossy"] = sp.records()[-1]
+    lossless = ngc.FlowPolicy(ngc.FlowLedger(g), 297, 299, shortest).place(2**42)
+    out["PlacementResult.lossless"] = lossless
+    out["SourceFlow.lossless"] = lossless.by_source[0]
+    controller = ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)
+    )
+    exact = ngc.FlowPolicy(ngc.FlowLedger(g), 297, 299, controller).place(float("inf"))
+    out["PlacementResult.exact"] = exact
+    out["Tunnel.exact"] = exact.program.tunnels[0]
+    failures = ngc.evaluate_edge_failures(
+        g, 297, 299, ngc.EvaluationOptions(controller), 1
+    )
+    out["SensitivityEntry"] = failures.entries[-1]
+    ledger = ngc.FlowLedger(g)
+    for _ in range(300):
+        ngc.FlowPolicy(ledger, 297, 299, shortest)
+    t1 = ngc.FlowPolicy(
+        ledger,
+        297,
+        299,
+        ngc.FlowPolicyConfig(
+            routing=ngc.DistributedTE(ngc.TunnelCount(300)), admission=lossy
+        ),
+    )
+    t1_result = t1.replace(2**41, design_demand=300 * cost)
+    out["PlacementResult.T1"] = t1_result
+    out["TunnelPlan.T1"] = t1_result.plan
+    out["Tunnel.T1"] = t1_result.program.tunnels[-1]
+    out["TunnelFlow.T1"] = t1_result.by_tunnel[-1]
+    out["FlowRecord.T1"] = t1.records()[-1]
+    t2 = ngc.CentralizedTE(
+        source_allocation=ngc.SourceAllocation.EQUAL,
+        tunnel_count=ngc.TunnelCount(300),
+        prefer_headroom=True,
+    )
+    t2_result = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 297, 299, ngc.FlowPolicyConfig(routing=t2)
+    ).replace(2**40)
+    out["TunnelPlan.T2"] = t2_result.plan  # fluid optimum 2^37/25
+    out["Tunnel.T2"] = t2_result.program.tunnels[-1]
+    # One link of capacity c split over 300 tunnels: the fluid optimum c/300.
+    for name, c in (("TunnelPlan.T2.thin", 1), ("TunnelPlan.T2.wide", cap + 1)):
+        link = build(2, [(0, 1, c, 1)])
+        out[name] = (
+            ngc.FlowPolicy(ngc.FlowLedger(link), 0, 1, ngc.FlowPolicyConfig(routing=t2))
+            .replace(1)
+            .plan
+        )
+    path = ngc.ksp(g, 297, 299, ngc.KspOptions(1))[0][1]
+    out["RouteDefinition"] = ngc.RouteDefinition(297, path, weight=cap)
+    cache = ngc.ShortestPathCache(g)
+    cached = ngc.FlowLedger(g)
+    for _ in range(2):
+        for s in range(260):
+            ngc.FlowPolicy(cached, s, s + 1, shortest, cache=cache)
+    out["ShortestPathCacheStats"] = cache.stats()
+    out["SpfResult"] = ngc.spf(
+        g, 297, ngc.SpfOptions(ngc.Direction.FORWARD, targets=[299])
+    )
+    out["AbsoluteCost"] = ngc.AbsoluteCost(cap)
+    for name, factor in (
+        ("CostStretch", Fraction(2**62 + 1, 2**62 - 1)),
+        ("CostStretch.numerator", Fraction(2**62 + 1, 3)),
+        ("CostStretch.denominator", Fraction(3, 2**62 - 1)),
+    ):
+        out[name] = ngc.CostStretch(factor)
+    out["TunnelCount"] = ngc.TunnelCount(300)
+    out["DistributedTE"] = ngc.DistributedTE(
+        ngc.TunnelCount(300), min_unreserved_bandwidth=cap
+    )
+    out["KspOptions"] = ngc.KspOptions(300)
+    out["EvaluationOptions"] = ngc.EvaluationOptions(
+        controller, offer=cap, design_demand=cap
+    )
+    out["SpfOptions"] = ngc.SpfOptions(ngc.Direction.FORWARD, min_residual=cap)
+    out["Place"] = ngc.Place(sp, cap)
+    out["Replace"] = ngc.Replace(sp, cap, design_demand=cap)
+    out["Forward"] = ngc.Forward(sp, cap)
+    return out
+
+
+def number(x):
+    return isinstance(x, (int, float, Fraction)) and not isinstance(x, bool)
+
+
+def uncached(x):
+    """An int or a float CPython does not take from its small-int cache."""
+    return isinstance(x, float) or (
+        isinstance(x, int) and not isinstance(x, bool) and not -5 <= x <= 256
+    )
+
+
+def shape(x):
+    """A number's uncached components: (numerator, denominator) for a Fraction."""
+    if isinstance(x, Fraction):
+        return (uncached(x.numerator), uncached(x.denominator))
+    return (uncached(x),)
+
+
+def number_properties():
+    """(class, property) of every property the stub annotates as an int, a float or a Fraction
+    (with None), but an enumeration's value (a small int)."""
+    tree = ast.parse((Path(ngc.__file__).parent / "__init__.pyi").read_text())
+    out = set()
+    for node in tree.body:
+        if not isinstance(node, ast.ClassDef) or hasattr(
+            getattr(ngc, node.name), "__members__"
+        ):
+            continue
+        for f in node.body:
+            if isinstance(f, ast.FunctionDef) and any(
+                isinstance(d, ast.Name) and d.id == "property" for d in f.decorator_list
+            ):
+                parts = {p.strip() for p in ast.unparse(f.returns).split("|")}
+                numbers = {"int", "float", "fractions.Fraction"}
+                if parts & numbers and parts <= numbers | {"None"}:
+                    out.add((node.name, f.name))
+    return out
+
+
+def properties(value):
+    cls = type(value)
+    return sorted(
+        n
+        for n in dir(cls)
+        if not n.startswith("_") and isinstance(getattr(cls, n), property)
+    )
+
+
+def reads(value):
+    """The properties, the repr and, for a class with its own hash (the value types), the hash."""
+    own_hash = vars(type(value)).get("__hash__") is not None
+    return properties(value) + ["__repr__"] + (["__hash__"] if own_hash else [])
+
+
+def shown(value):
+    # A bound value without its own repr prints its address, which a fresh wrapper changes
+    # (upper-case hex digits on Windows).
+    return re.sub(r" at 0x[0-9a-fA-F]+", "", repr(value))
+
+
+def sweep(name, wide=False):
+    """Every read of values()[name] (wide: the number reads and the own hash of wide_values()[name])
+    with each of its Python allocations failing in turn, the free lists emptied first; returns the
+    failures injected."""
+    import _netgraph_core as ext
+
+    value = (wide_values if wide else values)()[name]
+    names = reads(value)
+    if wide:
+        names = [a for a in properties(value) if number(getattr(value, a))]
+        names += [a for a in reads(value) if a == "__hash__"]
+    injected = 0
+    # The repr and the hash are called on the type: Python 3.13 and older turn a failed method
+    # lookup in repr() into the default repr and in hash() into a TypeError.
+    for attr in names:
+        if attr == "__repr__":
+
+            def read():
+                return type(value).__repr__(value)
+
+        elif attr == "__hash__":
+
+            def read():
+                return type(value).__hash__(value)
+
+        else:
+
+            def read(attr=attr):
+                return getattr(value, attr)
+
+        read()  # the interpreter's first-use allocations belong to no binding
+        want = shown(read())
+        for k in range(600):
+            gc.collect()
+            hit, _, got, error = ext._fail_python_allocation(read, (), k)
+            if not hit:
+                assert error is None and shown(got) == want, (name, attr, k, error)
+                break
+            injected += 1
+            assert got is None and type(error) is MemoryError, (
+                name,
+                attr,
+                k,
+                repr(error),
+            )
+        else:
+            raise AssertionError((name, attr, "no completing read in 600 allocations"))
+    return injected
+
+
+if __name__ == "__main__":
+    if sys.argv[1] == "--wide":
+        print(sweep(sys.argv[2], wide=True))
+    else:
+        print(sweep(sys.argv[1]))
+    sys.exit(0)
+
+
+def test_wide_values_hold_uncached_numbers():
+    # Every int, float or Fraction property of the stub is read on some wide value, and holds an
+    # uncached object there (else its sweep could not fail where it converts); a Fraction property
+    # holds each shape of uncached components.
+    seen = {}
+    for value in wide_values().values():
+        for attr in properties(value):
+            x = getattr(value, attr)
+            if number(x):
+                seen.setdefault((type(value).__name__, attr), set()).add(shape(x))
+    want = number_properties()
+    assert len(want) > 50
+    assert sorted(want - set(seen)) == []
+    fractions = {
+        ("CostStretch", "factor"),
+        ("TunnelPlan", "max_fractional_bandwidth_per_tunnel"),
+    }
+    assert fractions <= want
+    every = {(True, True), (True, False), (False, True)}
+    assert sorted(k for k in fractions if not every <= seen[k]) == []
+    assert sorted(k for k in want - fractions if (True,) not in seen[k]) == []
+
+
+@needs_hooks
+def test_every_read_survives_python_allocation_failures():
+    failed = []
+    for name in values():
+        done = subprocess.run(
+            [sys.executable, "-B", os.path.abspath(__file__), name],
+            capture_output=True,
+            text=True,
+            timeout=300,
+        )
+        if done.returncode != 0 or int(done.stdout.split()[-1]) < 1:
+            failed.append((name, done.returncode, done.stderr[-300:]))
+    assert failed == []
+
+
+@needs_hooks
+def test_every_number_read_raises_memory_error():
+    failed = []
+    for name in wide_values():
+        done = subprocess.run(
+            [sys.executable, "-B", os.path.abspath(__file__), "--wide", name],
+            capture_output=True,
+            text=True,
+            timeout=300,
+        )
+        if done.returncode != 0:
+            failed.append((name, done.returncode, done.stderr[-300:]))
+    assert failed == []
+
+
+@needs_hooks
+def test_a_failed_integer_read_raises_memory_error():
+    # A valid result's int field of 2^60 units: the read's allocations fail one at a time after a
+    # full collection; each failure is a MemoryError with the ledger and the policy unchanged, and
+    # the read then returns the value.
+    import _netgraph_core as ext
+
+    g = build(2, [(0, 1, 2**61, 1)])
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths()))
+    r = p.place(2**60)
+
+    def read():
+        return r.call_delivered
+
+    read()
+    faults = 0
+    for k in range(20):
+        gc.collect()
+        hit, _, got, error = ext._fail_python_allocation(read, (), k)
+        assert p.delivered() == 2**60
+        assert ledger.carried().tolist() == [2**60]
+        if not hit:
+            assert got == 2**60 and error is None
+            assert faults >= 1  # the int's allocation (2^60 is never cached)
+            return
+        faults += 1
+        assert got is None and type(error) is MemoryError, (k, repr(error))
+    pytest.fail("no completing read in 20 allocation points")
+
+
+@needs_hooks
+def test_native_trace_conversion_allocation_failures():
+    from concurrency_support import run_python
+
+    run_python("""
+from helpers import full_ledger_state, sweep_python_allocation
+def make():
+    ledger = ngc.FlowLedger(graph(1000))
+    p = ngc.FlowPolicy(ledger, 0, 1, ngc.FlowPolicyConfig(routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.OPTIMIZED)))
+    result, trace = p._place_traced(300)
+    assert result.delivered == 300
+    def snapshot():
+        return full_ledger_state(ledger), p._state(), p.program
+    return trace.as_dict, (), snapshot
+assert sweep_python_allocation(make) >= 10
+""")
+
+
+@needs_hooks
+def test_policy_shell_native_failures_leave_no_binding():
+    from concurrency_support import run_python
+
+    run_python("""
+from helpers import full_ledger_state
+cfg = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+# Grow pybind11's process-wide instance and patient registries before counting
+# allocations owned by a constructor attempt.
+warm_ledger = ngc.FlowLedger(graph())
+warm = ngc.FlowPolicy(warm_ledger, 0, 1, cfg)
+del warm
+faults = 0
+for k in range(600):
+    ledger = ngc.FlowLedger(graph())
+    before = full_ledger_state(ledger)
+    # Python's generic tp_new is outside the binding's allocation guarantee.
+    # Sweep the new initialization path on an already created Python shell.
+    shell = ngc.FlowPolicy.__new__(ngc.FlowPolicy)
+    initialize = shell.__init__
+    gc.collect()
+    print('constructor native allocation', k, flush=True)
+    hit, _, value, error, live = ext._fail_native_allocation(initialize, (ledger, 0, 1, cfg), k)
+    if error is not None:
+        assert hit
+        faults += 1
+        assert value is None and type(error) is MemoryError, (k, repr(error))
+        assert live == 0, (k, live)
+        assert full_ledger_state(ledger) == before
+        with pytest.raises(TypeError, match='not constructed'):
+            shell.delivered()
+        retry = ngc.FlowPolicy(ledger, 0, 1, cfg)
+        assert retry.place(3).delivered == 3
+        del retry
+    else:
+        assert error is None and value is None
+        assert shell.place(3).delivered == 3
+        if not hit:
+            assert faults >= 1
+            break
+else:
+    raise AssertionError('no completing constructor in 600 allocation points')
+""")
diff --git a/tests/py/test_graph.py b/tests/py/test_graph.py
new file mode 100644
index 0000000..7922f7e
--- /dev/null
+++ b/tests/py/test_graph.py
@@ -0,0 +1,605 @@
+"""Graph on integer units (docs/semantics.md#2-the-graph): construction, validation order, EdgeIds,
+read-only views, Eligibility."""
+
+from __future__ import annotations
+
+import gc
+import weakref
+
+import numpy as np
+import pytest
+from helpers import L62, build, by_input, exact
+
+import netgraph_core as ngc
+
+# (u, v, capacity in units, cost) in input order.
+EDGES = [
+    (2, 0, 5, 3),
+    (0, 2, 4, 2),
+    (0, 1, 3, 2),
+    (1, 2, 2, 1),
+    (0, 1, 1, 2),
+    (0, 2, 6, 1),
+    (2, 1, 7, 1),
+]
+
+
+def test_edge_id_order_and_input_positions():
+    g = build(3, EDGES)
+    order = sorted(
+        range(len(EDGES)), key=lambda i: (EDGES[i][0], EDGES[i][3], EDGES[i][1], i)
+    )
+    assert g.input_positions().tolist() == order == [5, 2, 4, 1, 3, 6, 0]
+    assert g.outgoing_offsets().tolist() == [0, 4, 5, 7]
+    assert g.edge_sources().tolist() == [EDGES[i][0] for i in order]
+    assert g.edge_destinations().tolist() == [EDGES[i][1] for i in order]
+    assert g.edge_capacity_units().tolist() == [EDGES[i][2] for i in order]
+    assert g.edge_costs().tolist() == [EDGES[i][3] for i in order]
+    inv = np.empty(len(EDGES), dtype=np.int64)
+    inv[g.input_positions()] = np.arange(len(EDGES))
+    assert g.input_positions()[inv].tolist() == list(range(len(EDGES)))
+    # Reverse CSR in (cost, source, input) order, as input positions.
+    rev = []
+    off, adj = g.incoming_offsets(), g.incoming_edges()
+    for v in range(3):
+        rev.append([int(g.input_positions()[e]) for e in adj[off[v] : off[v + 1]]])
+    assert rev == [[0], [6, 2, 4], [5, 3, 1]]
+    assert g.max_edge_cost() == 3
+    assert g.edge_cost_gcd() == 1
+    assert g.num_nodes() == 3 and g.num_edges() == 7
+    assert g.resolution() == 1.0
+
+
+def test_numpy_integer_inputs_and_exact_large_units():
+    big = (1 << 53) + 1
+    g = ngc.Graph(
+        np.int64(2),
+        np.array([0, 0], dtype=np.int32),
+        np.array([1, 1], dtype=np.uint8),
+        np.array([big, 7], dtype=np.int64),
+        np.array([2, 1], dtype=np.uint64),
+        2.0**-12,
+    )
+    assert g.edge_capacity_units().tolist() == [7, big]
+    assert g.resolution() == 2.0**-12
+
+
+def test_empty_and_isolated():
+    g = ngc.Graph(0, [], [], [], [], 1)
+    assert g.outgoing_offsets().tolist() == [0] and g.incoming_offsets().tolist() == [0]
+    assert g.max_edge_cost() == 0 and g.edge_cost_gcd() == 0
+    h = ngc.Graph(3, [], [], [], [], 1)
+    assert h.outgoing_offsets().tolist() == [0, 0, 0, 0]
+
+
+def test_uids_are_distinct():
+    a, b = build(3, EDGES), build(3, EDGES)
+    assert a.uid() != b.uid() and a.uid() > 0
+
+
+def test_resolution_has_no_default():
+    with pytest.raises(TypeError):
+        ngc.Graph(2, [0], [1], [1], [1])
+
+
+@pytest.mark.parametrize(
+    "args, message",
+    [
+        # The resolution.
+        (
+            (2, [0], [1], [1], [1], 3.0),
+            "resolution must be a power of two in [2^-32, 2^32]",
+        ),
+        (
+            (2, [0], [1], [1], [1], 2.0**-33),
+            "resolution must be a power of two in [2^-32, 2^32]",
+        ),
+        (
+            (2, [0], [1], [1], [1], 0.0),
+            "resolution must be a power of two in [2^-32, 2^32]",
+        ),
+        (
+            (2, [0], [1], [1], [1], float("nan")),
+            "resolution must be a power of two in [2^-32, 2^32]",
+        ),
+        # The unit values.
+        (
+            (2, [0], [1], [-1], [1], 1),
+            "edge_capacity_units[0] = -1 is outside the units domain [0, 2^62)",
+        ),
+        (
+            (2, [0], [1], [L62], [1], 1),
+            "edge_capacity_units[0] = 4611686018427387904 is outside the units domain [0, 2^62)",
+        ),
+        (
+            (2, [0], [1], [1.0], [1], 1),
+            "edge_capacity_units[0] must be an integer (got float)",
+        ),
+        (
+            (2, [0], [1], np.array([1.5]), [1], 1),
+            "edge_capacity_units entries must be integers (got dtype float64)",
+        ),
+        (
+            (2, [0], [1], [True], [1], 1),
+            "edge_capacity_units[0] must be an integer (got bool)",
+        ),
+        # The shapes.
+        ((-1, [], [], [], [], 1), "num_nodes = -1 is out of range [0, 2147483647]"),
+        ((2.0, [0], [1], [1], [1], 1), "num_nodes must be an integer (got float)"),
+        (
+            (2, [0, 1], [1], [1], [1], 1),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 2, 1, 1, 1)",
+        ),
+        (
+            (2, [0], [1], [1, 1], [1], 1),
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 1, 1, 2, 1)",
+        ),
+        # Zero, negative and non-integer costs.
+        (
+            (2, [0], [1], [1], [0], 1),
+            "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)",
+        ),
+        (
+            (2, [0], [1], [1], [-3], 1),
+            "edge_costs[0] = -3: costs must be positive (edge_costs >= 1)",
+        ),
+        ((2, [0], [1], [1], [1.5], 1), "edge_costs[0] must be an integer (got float)"),
+        # The remaining bounds.
+        (
+            (2, [0], [2], [1], [1], 1),
+            "edge 0: endpoint (0, 2) out of node range [0, 2)",
+        ),
+        (
+            (2, [0, 0], [1, 1], [L62 // 2, L62 // 2], [1, 1], 1),
+            "the sum of all capacities reaches the bound of the units domain (2^62 units)",
+        ),
+        (
+            (2, [0, 0], [1, 1], [1, 1], [L62 // 2, L62 // 2], 1),
+            "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64",
+        ),
+    ],
+)
+def test_validation_errors(args, message):
+    # A value of a type its position never takes is a TypeError, every other defect a ValueError.
+    cls = TypeError if message in TYPE_DEFECTS else ValueError
+    with pytest.raises((TypeError, ValueError), match=exact(message)) as error:
+        ngc.Graph(*args)
+    assert error.type is cls
+
+
+TYPE_DEFECTS = {
+    "edge_capacity_units[0] must be an integer (got float)",
+    "edge_capacity_units entries must be integers (got dtype float64)",
+    "edge_capacity_units[0] must be an integer (got bool)",
+    "num_nodes must be an integer (got float)",
+    "edge_costs[0] must be an integer (got float)",
+}
+
+
+def test_validation_order():
+    # The unit values before the shapes (the length message names edge_capacity_units too), the
+    # shapes before the costs, the costs before the remaining bounds (endpoints and sums).
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge_capacity_units[0] = -1 is outside the units domain [0, 2^62)"
+        ),
+    ):
+        ngc.Graph(2, [0, 1], [1], [-1], [1], 1)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge_sources, edge_destinations, edge_capacity_units and edge_costs must have the same length (got 2, 1, 1, 1)"
+        ),
+    ):
+        ngc.Graph(2, [0, 1], [1], [1], [0], 1)
+    with pytest.raises(
+        ValueError,
+        match=exact("edge_costs[0] = 0: costs must be positive (edge_costs >= 1)"),
+    ):
+        ngc.Graph(2, [0], [9], [1], [0], 1)
+    with pytest.raises(
+        ValueError,
+        match=exact("edge_costs[0] = 0: costs must be positive (edge_costs >= 1)"),
+    ):
+        ngc.Graph(2, [0, 0], [1, 1], [L62 // 2, L62 // 2], [0, 1], 1)
+    with pytest.raises(
+        ValueError, match=exact("edge 1: endpoint (5, 1) out of node range [0, 2)")
+    ):
+        ngc.Graph(2, [0, 5], [1, 1], [L62 // 2, L62 // 2], [1, 1], 1)
+    # Within the shapes: num_nodes before the lengths.
+    with pytest.raises(
+        ValueError, match=exact("num_nodes = -1 is out of range [0, 2147483647]")
+    ):
+        ngc.Graph(-1, [0, 1], [1], [1], [0], 1)
+    # The sums run edge by edge in input order: the first edge at which a running sum reaches
+    # 2^62 reports that sum (here the cost sum at edge 1, the capacity sum only at edge 2), and
+    # at the same edge the capacity sum comes first.
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64"
+        ),
+    ):
+        ngc.Graph(
+            2, [0, 0, 0], [1, 1, 1], [1, L62 // 2, L62 // 2], [L62 // 2] * 2 + [1], 1
+        )
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "the sum of all capacities reaches the bound of the units domain (2^62 units)"
+        ),
+    ):
+        ngc.Graph(2, [0, 0], [1, 1], [L62 // 2] * 2, [L62 // 2] * 2, 1)
+
+
+def test_bounds_just_below_are_accepted():
+    g = ngc.Graph(
+        2, [0, 0], [1, 1], [L62 // 2, L62 // 2 - 1], [L62 // 2, L62 // 2 - 1], 1
+    )
+    assert sum(int(x) for x in g.edge_capacity_units()) == L62 - 1
+    assert sum(int(x) for x in g.edge_costs()) == L62 - 1
+
+
+def test_eligibility():
+    g = build(4, [(0, 1, 1, 1), (1, 2, 1, 1), (2, 3, 1, 1), (1, 1, 1, 2), (3, 0, 1, 1)])
+    every = g.eligibility()
+    assert every.uid() == 0 and every.graph_uid() == g.uid()
+    assert every.node_allowed().tolist() == [True] * 4
+    el = g.eligibility(excluded_nodes=[1, 1])
+    assert el.uid() not in (0, every.uid())
+    assert el.node_allowed().tolist() == [True, False, True, True]
+    assert by_input(g, el.edge_allowed().tolist()) == [False, False, True, False, True]
+    # Both flag arrays are read-only boolean views.
+    for view in (el.node_allowed(), el.edge_allowed()):
+        assert view.dtype == np.bool_
+        assert not view.flags.writeable
+        with pytest.raises(ValueError):
+            view[0] = True
+    # Built only by Graph.eligibility and Eligibility.intersect.
+    with pytest.raises(TypeError):
+        ngc.Eligibility()
+    xe = g.eligibility(excluded_edges=np.array([4, 0, 4]))
+    assert xe.edge_allowed().tolist() == [False, True, True, True, False]
+    assert g.eligibility([], [0]).uid() != g.eligibility([], [0]).uid()
+    with pytest.raises(
+        ValueError, match=exact("excluded node 4 out of node range [0, 4)")
+    ):
+        g.eligibility(excluded_nodes=[4])
+    with pytest.raises(
+        ValueError, match=exact("excluded edge -1 out of edge range [0, 5)")
+    ):
+        g.eligibility(excluded_edges=[-1])
+    with pytest.raises(
+        TypeError, match=exact("excluded_edges[0] must be an integer (got float)")
+    ):
+        g.eligibility(excluded_edges=[0.0])
+
+
+# The binding validates in the documented order on unnarrowed integers, so the
+# reported defect does not depend on how the same defective input is represented.
+@pytest.mark.parametrize(
+    "args, message",
+    [
+        # A zero or negative cost comes before any remaining bound, even one that does not fit
+        # the C++ type (endpoints beyond int32, a cost beyond int64).
+        (
+            (2, [2**31], [1], [1], [0], 1.0),
+            "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)",
+        ),
+        (
+            (2, [-1], [1], [1], [0], 1.0),
+            "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)",
+        ),
+        (
+            (2, [0], [2**31], [1], [-1], 1.0),
+            "edge_costs[0] = -1: costs must be positive (edge_costs >= 1)",
+        ),
+        (
+            (2, [0], [-(2**70)], [1], [-(2**70)], 1.0),
+            "edge_costs[0] = -1180591620717411303424: costs must be positive (edge_costs >= 1)",
+        ),
+        (
+            (2, [0, 0], [1, 1], [1, 1], [2**63, 0], 1.0),
+            "edge_costs[1] = 0: costs must be positive (edge_costs >= 1)",
+        ),
+        # The unit values come before the costs, the resolution before everything.
+        (
+            (2, [0], [1], [2**62], [0], 1.0),
+            "edge_capacity_units[0] = 4611686018427387904 is outside the units domain [0, 2^62)",
+        ),
+        (
+            (2, [0], [1], [2**64], [0], 1.0),
+            "edge_capacity_units[0] = 18446744073709551616 is outside the units domain [0, 2^62)",
+        ),
+        (
+            (2, [0], [1], [-(2**70)], [0], 1.0),
+            "edge_capacity_units[0] = -1180591620717411303424 is outside the units domain [0, 2^62)",
+        ),
+        (
+            (2, [0], [1], [-1], [0], 3.0),
+            "resolution must be a power of two in [2^-32, 2^32]",
+        ),
+        # The remaining bounds name the exact value: ids, then the sums.
+        (
+            (2, [2**40], [1], [1], [1], 1.0),
+            "edge 0: endpoint (1099511627776, 1) out of node range [0, 2)",
+        ),
+        (
+            (2, [0], [-(2**70)], [1], [1], 1.0),
+            "edge 0: endpoint (0, -1180591620717411303424) out of node range [0, 2)",
+        ),
+        (
+            (2, [0], [1], [1], [2**63], 1.0),
+            "the sum of all edge costs reaches the bound 2^62: path costs would overflow int64",
+        ),
+        (
+            (2, [0, 5], [1, 1], [1, 1], [2**64, 1], 1.0),
+            "edge 1: endpoint (5, 1) out of node range [0, 2)",
+        ),
+        # The shapes.
+        (
+            (2**40, [], [], [], [], 1.0),
+            "num_nodes = 1099511627776 is out of range [0, 2147483647]",
+        ),
+    ],
+)
+def test_validation_order_before_narrowing(args, message):
+    with pytest.raises(ValueError, match=exact(message)):
+        ngc.Graph(*args)
+
+
+def test_validation_independent_of_representation():
+    # The same defective graph as Python lists and as NumPy arrays (uint64 beyond int64).
+    as_lists = (2, [2**63], [1], [1], [0], 1.0)
+    as_arrays = (
+        2,
+        np.array([2**63], dtype=np.uint64),
+        np.array([1], dtype=np.int32),
+        np.array([1], dtype=np.int64),
+        np.array([0], dtype=np.int64),
+        1.0,
+    )
+    messages = []
+    for args in (as_lists, as_arrays):
+        with pytest.raises(ValueError) as info:
+            ngc.Graph(*args)
+        messages.append(str(info.value))
+    assert (
+        messages[0]
+        == messages[1]
+        == "edge_costs[0] = 0: costs must be positive (edge_costs >= 1)"
+    )
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge 0: endpoint (9223372036854775808, 1) out of node range [0, 2)"
+        ),
+    ):
+        ngc.Graph(2, np.array([2**63], dtype=np.uint64), [1], [1], [1], 1.0)
+
+
+def test_eligibility_ids_checked_before_narrowing():
+    g = build(3, EDGES)
+    with pytest.raises(
+        ValueError, match=exact("excluded node 1099511627776 out of node range [0, 3)")
+    ):
+        g.eligibility(excluded_nodes=[2**40])
+    with pytest.raises(
+        ValueError,
+        match=exact("excluded edge -1180591620717411303424 out of edge range [0, 7)"),
+    ):
+        g.eligibility(excluded_edges=[-(2**70)])
+    with pytest.raises(
+        ValueError, match=exact("excluded node 5 out of node range [0, 3)")
+    ):  # nodes before edges
+        g.eligibility(excluded_nodes=[5], excluded_edges=[2**70])
+
+
+ARG_INDEX = {
+    "edge_sources": 1,
+    "edge_destinations": 2,
+    "edge_capacity_units": 3,
+    "edge_costs": 4,
+}
+VALID = {
+    "edge_sources": 0,
+    "edge_destinations": 1,
+    "edge_capacity_units": 1,
+    "edge_costs": 0,
+}  # the cost stays zero
+
+
+@pytest.mark.parametrize("name", list(ARG_INDEX))
+@pytest.mark.parametrize("ndim", [0, 2])
+@pytest.mark.parametrize("cost", [0, -1])
+def test_array_rank_is_a_shape_defect_before_costs(name, ndim, cost):
+    # The shape step checks rank 1 for every array argument before the
+    # cost step, so a 2-D or 0-D array is reported before a zero or negative cost (a rank is a
+    # type: TypeError).
+    args = [2, [0], [1], [1], [cost], 1.0]
+    value = cost if name == "edge_costs" else VALID[name]
+    bad = np.array(value, dtype=np.int64)
+    args[ARG_INDEX[name]] = bad.reshape(1, 1) if ndim == 2 else bad
+    pattern = exact(f"{name} must be a 1-D array (got {ndim} dimensions)")
+    with pytest.raises(TypeError, match=pattern):
+        ngc.Graph(*args)
+
+
+@pytest.mark.parametrize("name", list(ARG_INDEX))
+def test_nested_and_scalar_arguments_are_shape_defects(name):
+    value = VALID[name]
+    nested = [2, [0], [1], [1], [0], 1.0]
+    nested[ARG_INDEX[name]] = [[value]]
+    with pytest.raises(
+        TypeError,
+        match=exact(
+            f"{name} must be a 1-D sequence of integers (entry 0 is a sequence)"
+        ),
+    ):
+        ngc.Graph(*nested)
+    scalar = [2, [0], [1], [1], [0], 1.0]
+    scalar[ARG_INDEX[name]] = value
+    with pytest.raises(
+        TypeError, match=exact(f"{name} must be a 1-D sequence of integers (got int)")
+    ):
+        ngc.Graph(*scalar)
+
+
+def test_shape_step_keeps_its_place_in_the_order():
+    # The resolution and the unit values still come before the shapes, whatever the shape.
+    with pytest.raises(
+        ValueError, match=exact("resolution must be a power of two in [2^-32, 2^32]")
+    ):
+        ngc.Graph(2, np.array([[0]]), [1], [1], [0], 3.0)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge_capacity_units[0] = 4611686018427387904 is outside the units domain [0, 2^62)"
+        ),
+    ):
+        ngc.Graph(2, [0], [1], np.array([[2**62]], dtype=np.int64), [0], 1.0)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge_capacity_units[0] = -1 is outside the units domain [0, 2^62)"
+        ),
+    ):
+        ngc.Graph(2, [0], [1], np.array(-1, dtype=np.int64), [0], 1.0)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "edge_capacity_units[1] = -5 is outside the units domain [0, 2^62)"
+        ),
+    ):
+        ngc.Graph(2, [0], [1], [[1], -5], [0], 1.0)
+    with pytest.raises(
+        ValueError,
+        match=exact("edge_capacity_units = -5 is outside the units domain [0, 2^62)"),
+    ):
+        ngc.Graph(2, [0], [1], -5, [0], 1.0)
+    # With valid values the misshapen capacity is a shape defect, before the costs.
+    with pytest.raises(
+        TypeError,
+        match=exact("edge_capacity_units must be a 1-D array (got 2 dimensions)"),
+    ):
+        ngc.Graph(2, [0], [1], np.array([[1]]), [0], 1.0)
+    # Rank (a type) before lengths (a value).
+    with pytest.raises(
+        TypeError,
+        match=exact("edge_destinations must be a 1-D array (got 2 dimensions)"),
+    ):
+        ngc.Graph(2, [0, 1], np.array([[1, 0]]), [1, 1], [1, 1], 1.0)
+    # A valid graph from 1-D arrays of every integer kind still builds.
+    g = ngc.Graph(
+        2, np.array([0]), np.array([1], dtype=np.uint8), np.array([7]), (3,), 1.0
+    )
+    assert g.edge_capacity_units().tolist() == [7]
+
+
+def test_repeated_views_share_storage_and_refuse_write_access():
+    g = build(3, EDGES)
+    for name in (
+        "edge_capacity_units",
+        "edge_costs",
+        "edge_sources",
+        "edge_destinations",
+        "input_positions",
+        "outgoing_offsets",
+        "incoming_offsets",
+        "incoming_edges",
+    ):
+        a, b = getattr(g, name)(), getattr(g, name)()
+        assert np.shares_memory(a, b), name
+        with pytest.raises(ValueError):
+            a.setflags(write=True)
+        assert not a.flags.writeable
+
+
+VIEW_DTYPES = {
+    "edge_capacity_units": np.int64,
+    "edge_costs": np.int64,
+    "edge_sources": np.int32,
+    "edge_destinations": np.int32,
+    "input_positions": np.int32,
+    "outgoing_offsets": np.int32,
+    "incoming_offsets": np.int32,
+    "incoming_edges": np.int32,
+}
+
+
+@pytest.mark.parametrize(
+    ("n", "edges"),
+    [(0, []), (100, []), (3, EDGES)],
+    ids=["empty", "isolated", "nonempty"],
+)
+def test_every_view_keeps_its_graph_alive_and_refuses_write_access(n, edges):
+    # An empty view has no bytes to share, so the owner is checked by identity and a weak
+    # reference rather than by np.shares_memory. The values stay readable after the caller
+    # drops the graph.
+    for name, dtype in VIEW_DTYPES.items():
+        g = build(n, edges)
+        ref = weakref.ref(g)
+        view = getattr(g, name)()
+        values = view.tolist()
+        assert view.base is g, name
+        assert view.dtype == dtype, name
+        assert not view.flags.writeable, name
+        with pytest.raises(ValueError):
+            view[...] = 0
+        with pytest.raises(ValueError):
+            view.setflags(write=True)
+        del g
+        gc.collect()
+        assert ref() is not None, name
+        assert view.tolist() == values, name
+        del view
+        gc.collect()
+        assert ref() is None, name
+
+
+def _reference_layout(n, src, dst, cost):
+    # EdgeIds: (source, cost, destination, input); the reverse slots: (destination, cost, source, input).
+    i = np.arange(len(src))
+    order = np.lexsort((i, dst, cost, src))
+    pos = np.empty_like(order)
+    pos[order] = np.arange(len(order))
+    rev = pos[np.lexsort((i, src, cost, dst))]
+    return order, np.searchsorted(src[order], np.arange(n + 1)), rev
+
+
+@pytest.mark.parametrize(
+    "shape",
+    ["hash", "combined_keys", "all_cost_sort", "reversed", "edgeless"],
+)
+def test_construction_orders_match_a_reference(shape):
+    # One input per construction path of the graph: distinct-cost hashing, the combined-key
+    # passes (N * K < E), the all-cost sort (K > 65,536), input in reversed EdgeId order, no edges.
+    rng = np.random.default_rng(7)
+    n, e = 300, 1000  # N * K = 1500 > E: the separate passes
+    if shape == "combined_keys":
+        n, e = 20, 4000  # N * K = 100 < E
+    if shape == "edgeless":
+        e = 0
+    src = rng.integers(0, n, e)
+    dst = rng.integers(0, n, e)
+    cost = rng.integers(1, 6, e)
+    if shape == "all_cost_sort":
+        e = 70000
+        src, dst = rng.integers(0, n, e), rng.integers(0, n, e)
+        cost = rng.permutation(np.arange(1, e + 1))
+    cap = rng.integers(0, 1 << 40, e)
+    if shape == "reversed":
+        order, _, _ = _reference_layout(n, src, dst, cost)
+        src, dst, cap, cost = (a[order[::-1]] for a in (src, dst, cap, cost))
+    g = ngc.Graph(n, src, dst, cap, cost, 1)
+    order, row, rev = _reference_layout(n, src, dst, cost)
+    assert g.input_positions().tolist() == order.tolist()
+    assert g.outgoing_offsets().tolist() == row.tolist()
+    assert g.incoming_edges().tolist() == rev.tolist()
+    assert (
+        g.incoming_offsets().tolist()
+        == np.searchsorted(np.sort(dst), np.arange(n + 1)).tolist()
+    )
+    assert g.edge_capacity_units().tolist() == cap[order].tolist()
+    assert g.max_edge_cost() == (int(cost.max()) if e else 0)
diff --git a/tests/py/test_graph_from_arrays.py b/tests/py/test_graph_from_arrays.py
deleted file mode 100644
index 19f8595..0000000
--- a/tests/py/test_graph_from_arrays.py
+++ /dev/null
@@ -1,69 +0,0 @@
-"""StrictMultiDiGraph.from_arrays behaviors and validations."""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_ext_ids(n):
-    """Generate ext_edge_ids for n edges."""
-    return np.arange(n, dtype=np.int64)
-
-
-def test_from_arrays_basic_bidirectional_manual():
-    n = 3
-    # Manually include reverse edges
-    src = np.array([0, 1, 1, 2], dtype=np.int32)
-    dst = np.array([1, 0, 2, 1], dtype=np.int32)
-    cap = np.array([1.0, 1.0, 2.0, 2.0], dtype=np.float64)
-    cost = np.array([1, 1, 1, 1], dtype=np.int64)
-    g = ngc.StrictMultiDiGraph.from_arrays(n, src, dst, cap, cost, _make_ext_ids(4))
-    # Expect reverse edges present; 4 edges total
-    assert g.num_edges() == 4
-
-
-def test_from_arrays_mismatched_lengths_raise():
-    n = 2
-    src = np.array([0], dtype=np.int32)
-    dst = np.array([1, 1], dtype=np.int32)
-    cap = np.array([1.0], dtype=np.float64)
-    cost = np.array([1], dtype=np.int64)
-    with pytest.raises(TypeError):
-        ngc.StrictMultiDiGraph.from_arrays(n, src, dst, cap, cost, _make_ext_ids(1))
-
-
-def test_from_arrays_wrong_dtypes_raise():
-    n = 2
-    src = np.array([0], dtype=np.int64)  # wrong dtype
-    dst = np.array([1], dtype=np.int32)
-    cap = np.array([1.0], dtype=np.float32)  # wrong dtype
-    cost = np.array([1], dtype=np.int64)
-    with pytest.raises((TypeError, ValueError)):
-        ngc.StrictMultiDiGraph.from_arrays(n, src, dst, cap, cost, _make_ext_ids(1))
-
-
-def test_from_arrays_negative_capacity_raises():
-    n = 2
-    src = np.array([0], dtype=np.int32)
-    dst = np.array([1], dtype=np.int32)
-    cap = np.array([-1.0], dtype=np.float64)
-    cost = np.array([1], dtype=np.int64)
-    with pytest.raises(ValueError):
-        ngc.StrictMultiDiGraph.from_arrays(n, src, dst, cap, cost, _make_ext_ids(1))
-
-
-def test_from_arrays_self_loops_behavior():
-    n = 2
-    src = np.array([0], dtype=np.int32)
-    dst = np.array([0], dtype=np.int32)  # self-loop
-    cap = np.array([1.0], dtype=np.float64)
-    cost = np.array([1], dtype=np.int64)
-    # Self-loops are accepted: StrictMultiDiGraph is a multigraph and from_arrays
-    # only rejects out-of-range ids and negative capacity/cost.
-    g = ngc.StrictMultiDiGraph.from_arrays(n, src, dst, cap, cost, _make_ext_ids(1))
-    assert g.num_edges() == 1
-    assert g.edge_src_view()[0] == 0
-    assert g.edge_dst_view()[0] == 0
diff --git a/tests/py/test_graph_structure.py b/tests/py/test_graph_structure.py
deleted file mode 100644
index da3926a..0000000
--- a/tests/py/test_graph_structure.py
+++ /dev/null
@@ -1,27 +0,0 @@
-"""Graph structure tests.
-
-Validate StrictMultiDiGraph compaction (deterministic ordering and grouping)
-and CSR/reverse CSR integrity at a basic level.
-"""
-
-import numpy as np
-
-
-def test_compaction_sorts_and_groups_parallel_edges(build_graph):
-    # Nodes: 0->1 with mixed order edges; 0->2; expect CSR row for 0 sorted by col and grouped
-    edges = [
-        (0, 2, 2.0, 1.0),
-        (0, 1, 1.0, 1.0),
-        (0, 1, 1.5, 2.0),
-        (1, 2, 1.0, 1.0),
-    ]
-    g = build_graph(3, edges)
-    row = np.asarray(g.row_offsets_view())
-    col = np.asarray(g.col_indices_view())
-    # Row for node 0 spans [row[0], row[1]) and should be non-decreasing by col
-    s, e = int(row[0]), int(row[1])
-    assert np.all(col[s:e][:-1] <= col[s:e][1:])
-    # Parallel edges to the same neighbor should be consecutive (grouped)
-    # Count transitions; for two neighbors (1 and 2), expect at most two groups
-    groups = 1 if e - s <= 1 else int(np.sum(col[s:e][1:] != col[s:e][:-1]) + 1)
-    assert groups <= 2
diff --git a/tests/py/test_imports.py b/tests/py/test_imports.py
deleted file mode 100644
index 6992915..0000000
--- a/tests/py/test_imports.py
+++ /dev/null
@@ -1,8 +0,0 @@
-def test_imports():
-    import netgraph_core as ngc
-
-    assert hasattr(ngc, "StrictMultiDiGraph")
-    assert hasattr(ngc, "Backend")
-    assert hasattr(ngc, "Algorithms")
-    assert hasattr(ngc, "EdgeSelection")
-    assert hasattr(ngc, "EdgeTieBreak")
diff --git a/tests/py/test_integer_array_allocation.py b/tests/py/test_integer_array_allocation.py
new file mode 100644
index 0000000..6cab8c2
--- /dev/null
+++ b/tests/py/test_integer_array_allocation.py
@@ -0,0 +1,316 @@
+"""Integer-array casts under Python allocation failure, each reader/dtype in its own process.
+
+Constructors use an instance shell created before the fault window, so the sweep covers input
+conversion rather than pybind11's documented unchecked allocation of a new bound instance.
+The private hook counts only allocations inside NumPy casts, excluding result wrapping.
+"""
+
+from __future__ import annotations
+
+import functools
+import gc
+import importlib.util
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+if __name__ == "__main__":
+    spec = importlib.util.spec_from_file_location("_netgraph_core", sys.argv[3])
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    sys.modules["_netgraph_core"] = module
+    spec.loader.exec_module(module)
+
+import _netgraph_core as ext
+import numpy as np
+from helpers import full_ledger_state, plain
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+KINDS = ("int32", "uint64", "swapped_uint64")
+# Every public reader of wide_integers, with separate rows for each array argument. Deferred
+# options are exercised at their consuming call; nested hops and pair endpoints are included.
+READERS = (
+    "Graph.sources",
+    "Graph.destinations",
+    "Graph.capacities",
+    "Graph.costs",
+    "eligibility.nodes",
+    "eligibility.edges",
+    "from_csr.offsets",
+    "from_csr.parents",
+    "from_csr.edges",
+    "Path.hop",
+    "ShortestPaths.weights",
+    "CentralizedTE.weights",
+    "FlowLedger.service",
+    "FlowLedger.reservation",
+    "reset.service",
+    "reset.reservation",
+    "saturated_boundary_edges.sources",
+    "FlowPolicy.sources",
+    "FlowPolicy.destinations",
+    "spf.roots",
+    "spf.targets",
+    "spf.residual",
+    "ksp.residual",
+    "from_routes.sources",
+    "from_routes.destinations",
+    "from_routes.weights",
+    "from_routes.residual",
+    "from_dag.sources",
+    "from_dag.destinations",
+    "from_dag.weights",
+    "from_dag.residual",
+    "evaluate_demand.sources",
+    "evaluate_demand.destinations",
+    "evaluate_pairs.sources",
+    "evaluate_pairs.destinations",
+    "evaluate_edge_failures.sources",
+    "evaluate_edge_failures.destinations",
+    "as_float",
+    "to_units",
+)
+
+
+def make(reader, kind):
+    arrays = []
+
+    def array(values):
+        dtype = (
+            np.dtype("uint64").newbyteorder("S")
+            if kind == "swapped_uint64"
+            else np.dtype(kind)
+        )
+        a = np.array(values * 1000 if len(values) == 1 else values, dtype=dtype)
+        arrays.append(a)
+        return a
+
+    large = reader.startswith(
+        (
+            "Graph.",
+            "from_csr.",
+            "Path.",
+            "ShortestPaths.",
+            "FlowLedger.",
+            "reset.",
+            "from_routes.",
+            "from_dag.",
+        )
+    ) or reader in ("spf.residual", "ksp.residual")
+    n = 1001 if reader.startswith("from_csr.") else 2
+    edges = 1000 if large else 1
+    g = ngc.Graph(n, [0] * edges, [1] * edges, [10] * edges, [1] * edges, 1.0)
+    ledger = ngc.FlowLedger(g)
+    cfg = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    options = ngc.EvaluationOptions(cfg, offer=4)
+    dag = ngc.Path(g, [[0]]).to_dag()
+    fn, args = None, ()
+
+    def check():
+        return None
+
+    def initialize(cls, args, **kwargs):
+        obj = cls.__new__(cls)
+        return functools.partial(obj.__init__, **kwargs), args, obj
+
+    if reader.startswith("Graph."):
+        values = [[0] * 1000, [1] * 1000, [10] * 1000, [1] * 1000]
+        position = ("sources", "destinations", "capacities", "costs").index(
+            reader.split(".")[1]
+        )
+        values[position] = array(values[position])
+        fn, args, obj = initialize(ngc.Graph, (2, *values, 1.0))
+
+        def check():
+            return (
+                obj.edge_sources().tolist(),
+                obj.edge_destinations().tolist(),
+                obj.edge_capacity_units().tolist(),
+                obj.edge_costs().tolist(),
+            )
+    elif reader.startswith("eligibility."):
+        fn = g.eligibility
+        args = (array([0]), []) if reader.endswith("nodes") else ([], array([0]))
+    elif reader.startswith("from_csr."):
+        values = [[0, 0] + [1000] * 1000, [0] * 1000, list(range(1000))]
+        position = ("offsets", "parents", "edges").index(reader.split(".")[1])
+        values[position] = array(values[position])
+        fn, args = ngc.PredecessorDAG.from_csr, (g, *values)
+    elif reader == "Path.hop":
+        fn, args, obj = initialize(ngc.Path, (g, [array(list(range(1000)))]))
+
+        def check():
+            return plain(obj)
+    elif reader.startswith("CentralizedTE."):
+        fn, args, obj = initialize(
+            ngc.CentralizedTE,
+            (),
+            source_allocation=ngc.SourceAllocation.WEIGHTED,
+            source_weights=array([1001, 1003]),
+        )
+
+        def check():
+            return plain(obj.source_weights)
+    elif reader.startswith("ShortestPaths."):
+        weights = array([1])
+        fn, args, obj = initialize(
+            ngc.ShortestPaths,
+            (),
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.EXPLICIT,
+            edge_weights=weights,
+        )
+
+        def check():
+            return plain(obj.edge_weights)
+    elif reader.startswith("FlowLedger."):
+        if reader.endswith("service"):
+            fn, args, obj = initialize(ngc.FlowLedger, (g, array([8])))
+        else:
+            fn, args, obj = initialize(
+                ngc.FlowLedger, (g,), reservation_baseline=array([8])
+            )
+
+        def check():
+            return (obj.residual().tolist(), obj.unreserved().tolist())
+    elif reader.startswith("reset."):
+        fn = (
+            ledger.reset
+            if reader.endswith("service")
+            else functools.partial(ledger.reset, reservation_baseline=array([8]))
+        )
+        args = (array([8]),) if reader.endswith("service") else ()
+    elif reader == "saturated_boundary_edges.sources":
+        fn, args = ledger.saturated_boundary_edges, (array([0]),)
+    elif reader.startswith("FlowPolicy."):
+        sources = array([0]) if reader.endswith("sources") else [0]
+        destinations = array([1]) if reader.endswith("destinations") else [1]
+        fn, args, obj = initialize(ngc.FlowPolicy, (ledger, sources, destinations, cfg))
+
+        def check():
+            return obj.delivered()
+    elif reader.startswith("spf."):
+        roots = array([0]) if reader.endswith("roots") else [0]
+        opts = ngc.SpfOptions(
+            ngc.Direction.FORWARD,
+            targets=array([1]) if reader.endswith("targets") else None,
+            residual=array([8]) if reader.endswith("residual") else None,
+        )
+        fn, args = ngc.spf, (g, roots, opts)
+    elif reader == "ksp.residual":
+        fn, args = ngc.ksp, (g, 0, 1, ngc.KspOptions(1, residual=array([8])))
+    elif reader.startswith(("from_routes.", "from_dag.")):
+        factory, field = reader.split(".")
+        sources = array([0]) if field == "sources" else [0]
+        destinations = array([1]) if field == "destinations" else [1]
+        kwargs = {}
+        if field == "weights":
+            kwargs = dict(
+                allocation=ngc.RouteAllocation.WEIGHTED,
+                weight_basis=ngc.WeightBasis.EXPLICIT,
+                edge_weights=array([1]),
+            )
+        elif field == "residual":
+            kwargs = dict(
+                allocation=ngc.RouteAllocation.WEIGHTED,
+                weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+                residual=array([8]),
+            )
+        route = [ngc.RouteDefinition(0, dag)] if factory == "from_routes" else dag
+        fn = functools.partial(getattr(ngc.ForwardingProgram, factory), **kwargs)
+        args = (g, sources, destinations, route)
+    elif reader.startswith("evaluate_"):
+        entry, field = reader.split(".")
+        sources = array([0]) if field == "sources" else [0]
+        destinations = array([1]) if field == "destinations" else [1]
+        fn = getattr(ngc, entry)
+        args = (
+            (g, [(sources, destinations)], options)
+            if entry == "evaluate_pairs"
+            else (g, sources, destinations, options)
+        )
+    elif reader in ("as_float", "to_units"):
+        fn, args = getattr(ngc, reader), (array(list(range(1000))), 1.0)
+    else:
+        raise AssertionError(reader)
+
+    def snapshot():
+        return [a.tobytes() for a in arrays], full_ledger_state(ledger)
+
+    return fn, args, snapshot, check
+
+
+def sweep(reader, kind):
+    fn, args, snapshot, check = make(reader, kind)
+    expected = plain(fn(*args))
+    expected_check = check()
+    expected_after = snapshot()
+    failures = 0
+    recovered = 0
+    for point in range(2000):
+        fn, args, snapshot, check = make(reader, kind)
+        before = snapshot()
+        gc.collect()
+        hit, seen, result, error = ext._fail_python_allocation(fn, args, point, True)
+        if not hit:
+            assert error is None, (point, repr(error))
+            assert plain(result) == expected, point
+            assert check() == expected_check, point
+            assert snapshot() == expected_after, point
+            assert seen == failures, (seen, failures)
+            assert failures > 0 or kind == "uint64"
+            print(
+                json.dumps(
+                    dict(
+                        reader=reader,
+                        dtype=kind,
+                        failures=failures,
+                        recovered=recovered,
+                        terminal="success",
+                    )
+                ),
+                flush=True,
+            )
+            return
+        failures += 1
+        if error is None:
+            # NumPy can recover a temporary-buffer allocation internally. A recovered cast
+            # must still give every original result and the same complete state.
+            assert plain(result) == expected, point
+            assert check() == expected_check, point
+            assert snapshot() == expected_after, point
+            recovered += 1
+        else:
+            assert result is None and type(error) is MemoryError, (point, repr(error))
+            assert snapshot() == before, point
+        assert plain(fn(*args)) == expected, point
+        assert check() == expected_check, point
+        assert snapshot() == expected_after, point
+    raise AssertionError("allocation sweep did not finish")
+
+
+@needs_hooks
+def test_integer_array_readers_propagate_allocation_failure_in_separate_processes():
+    for reader in READERS:
+        for kind in KINDS:
+            result = subprocess.run(
+                [sys.executable, "-B", __file__, reader, kind, ext.__file__],
+                capture_output=True,
+                text=True,
+                timeout=180,
+            )
+            assert result.returncode == 0, (reader, kind, result.stdout, result.stderr)
+            row = json.loads(result.stdout.splitlines()[-1])
+            assert row["reader"] == reader and row["dtype"] == kind
+            assert row["terminal"] == "success"
+            assert row["failures"] > 0 or kind == "uint64"
+            if reader != "to_units" and kind != "uint64":
+                assert row["failures"] > row["recovered"]
+
+
+if __name__ == "__main__":
+    assert Path(ext.__file__).resolve() == Path(sys.argv[3]).resolve()
+    sweep(sys.argv[1], sys.argv[2])
diff --git a/tests/py/test_ksp.py b/tests/py/test_ksp.py
index 5219b09..4c7a1e3 100644
--- a/tests/py/test_ksp.py
+++ b/tests/py/test_ksp.py
@@ -1,89 +1,468 @@
-"""K-shortest paths (KSP) on canonical graphs; SPF-compatible outputs."""
+"""KSP and resolve_to_paths through the binding (docs/semantics.md#k-shortest-paths): the
+order, Expand and Collapse, the ceilings, k = 1 against the single path of spf, the validation
+order on unnarrowed values, and the all-or-nothing construction of the result lists."""
+
+from __future__ import annotations
+
+from fractions import Fraction
 
 import numpy as np
+import pytest
+from helpers import (
+    CHAIN,
+    FEWER,
+    HIGHER_CAP,
+    assert_read_only,
+    build,
+    exact,
+    plain,
+    sweep_python_allocation,
+)
+from private_hooks import needs_hooks
 
+import netgraph_core as ngc
 
-def test_ksp_line1_two_paths(
-    line1_graph, t_cost, assert_pred_dag_integrity, algs, to_handle
-):
-    g = line1_graph
-    items = algs.ksp(to_handle(g), 0, 2, k=5, max_cost_factor=None, unique=True)
-    assert len(items) >= 2
-    costs = [t_cost(dist, 2) for dist, _ in items[:2]]
-    assert all(np.isclose(c, 2.0) for c in costs)
-    for d, dag in items[:2]:
-        assert_pred_dag_integrity(g, dag, dist=d)
 
+def bgraph(n, rows):
+    """A graph from rows (u, v, capacity, cost), sorted by (source, cost, destination) first: that is the
+    EdgeId order, so each EdgeId is the row's position in the sorted list."""
+    return build(n, sorted(rows, key=lambda r: (r[0], r[3], r[1])))
 
-def test_ksp_square1_two_paths(
-    square1_graph, t_cost, assert_pred_dag_integrity, algs, to_handle
-):
-    g = square1_graph
-    items = algs.ksp(to_handle(g), 0, 2, k=5, max_cost_factor=None, unique=True)
-    assert len(items) >= 2
-    costs = [t_cost(dist, 2) for dist, _ in items[:2]]
-    # Expect costs 2 and 4 (A->B->C and A->D->C)
-    assert set(round(c, 6) for c in costs) == {2.0, 4.0}
-    for d, dag in items[:2]:
-        assert_pred_dag_integrity(g, dag, dist=d)
-
-
-def test_ksp_fully_connected_costs(
-    make_fully_connected_graph, t_cost, assert_pred_dag_integrity, algs, to_handle
-):
-    g = make_fully_connected_graph(5, cost=1.0, cap=1.0)
-    items = algs.ksp(to_handle(g), 0, 1, k=2, max_cost_factor=None, unique=True)
-    assert len(items) == 2
-    assert np.isclose(t_cost(items[0][0], 1), 1.0)
-    assert np.isclose(t_cost(items[1][0], 1), 2.0)
-    for d, dag in items:
-        assert_pred_dag_integrity(g, dag, dist=d)
+
+def ksp(g, s, t, k, *, parallel_edges=True, tie=FEWER, **kw):
+    return ngc.ksp(
+        g,
+        s,
+        t,
+        ngc.KspOptions(k, tie_break=tie, parallel_edges=parallel_edges, **kw),
+    )
 
 
-def test_ksp_max_cost_factor_limit(
-    make_fully_connected_graph, t_cost, assert_pred_dag_integrity, algs, to_handle
+@pytest.mark.parametrize(
+    "n,rows,target,tie,residual,costs,walks",
+    [
+        (
+            6,
+            [
+                (0, 1, 5, 1),
+                (0, 4, 5, 5),
+                (1, 2, 5, 1),
+                (1, 3, 5, 2),
+                (1, 5, 5, 2),
+                (2, 1, 5, 1),
+                (2, 4, 5, 2),
+                (3, 4, 5, 1),
+                (5, 4, 5, 1),
+            ],
+            4,
+            FEWER,
+            None,
+            [4, 4, 4, 5],
+            [[0, 2, 6], [0, 3, 7], [0, 4, 8], [1]],
+        ),
+        (
+            3,
+            [(0, 1, 1, 1), (1, 2, 1, 1), (1, 2, 1, 2), (1, 2, 2, 3), (1, 2, 3, 3)],
+            2,
+            HIGHER_CAP,
+            None,
+            [2, 3, 4, 4],
+            [[0, 1], [0, 2], [0, 3], [0, 4]],
+        ),
+        (
+            6,
+            [
+                (0, 1, 5, 1),
+                (1, 2, 5, 1),
+                (1, 4, 5, 1),
+                (2, 3, 5, 1),
+                (2, 5, 5, 1),
+                (3, 1, 5, 1),
+                (3, 5, 5, 2),
+                (4, 5, 5, 1),
+            ],
+            5,
+            FEWER,
+            None,
+            [3, 3, 5],
+            [[0, 1, 4], [0, 2, 7], [0, 1, 3, 6]],
+        ),
+        (
+            4,
+            [
+                (0, 1, 1, 1),
+                (0, 2, 2**54 + 1, 1),
+                (1, 3, 1, 1),
+                (1, 3, 2**54, 2),
+                (2, 3, 1, 2),
+            ],
+            3,
+            ngc.RouteTieBreak.HIGHER_HEADROOM,
+            [1, 2**54, 1, 2**54 - 1, 1],
+            [2, 3, 3],
+            [[0, 2], [1, 4], [0, 3]],
+        ),
+    ],
+)
+def test_nonzero_deviation_keeps_the_whole_prefix(
+    n, rows, target, tie, residual, costs, walks
 ):
-    g = make_fully_connected_graph(5, cost=1.0, cap=1.0)
-    # Restrict to paths with cost <= best_cost * 1.0 => only the direct path
-    items = algs.ksp(to_handle(g), 0, 1, k=5, max_cost_factor=1.0, unique=True)
-    assert len(items) == 1
-    assert np.isclose(t_cost(items[0][0], 1), 1.0)
-    assert_pred_dag_integrity(g, items[0][1], dist=items[0][0])
+    g = bgraph(n, rows)
+    want = [
+        [c, [0, target, [[e] for e in walk], c]]
+        for c, walk in zip(costs, walks, strict=True)
+    ]
+    assert plain(ksp(g, 0, target, 8, tie=tie, residual=residual)) == want
+    assert plain(ksp(g, 0, target, 1, tie=tie, residual=residual)) == want[:1]
+    # A later nonzero deviation must retain the complete prefix cost at a ceiling.
+    bound = costs[1]
+    assert plain(
+        ksp(
+            g,
+            0,
+            target,
+            8,
+            tie=tie,
+            residual=residual,
+            cost_ceiling=ngc.AbsoluteCost(bound),
+        )
+    ) == [p for p in want if p[0] <= bound]
 
 
-def test_ksp_graph5_thresholds(
-    graph5, t_cost, assert_pred_dag_integrity, algs, to_handle
-):
-    g = graph5
-    # Best path cost = 1.0 (direct); with factor 2.0, paths up to cost 2 allowed.
-    items = algs.ksp(to_handle(g), 0, 1, k=10, max_cost_factor=2.0, unique=True)
-    # Ensure at least the direct and one via-node path exist
-    assert len(items) >= 2
-    costs = sorted(t_cost(dist, 1) for dist, _ in items[:2])
-    assert np.isclose(costs[0], 1.0)
-    assert np.isclose(costs[1], 2.0)
-    # With factor 1.0, only direct route
-    items2 = algs.ksp(to_handle(g), 0, 1, k=10, max_cost_factor=1.0, unique=True)
-    assert len(items2) == 1
-    assert np.isclose(t_cost(items2[0][0], 1), 1.0)
-    for d, dag in items[:2]:
-        assert_pred_dag_integrity(g, dag, dist=d)
-    assert_pred_dag_integrity(g, items2[0][1], dist=items2[0][0])
-
-
-def test_ksp_square5_routes(
-    square5_graph, t_cost, assert_pred_dag_integrity, algs, to_handle
-):
-    g = square5_graph
-    # Multiple routes from A(0) -> D(3): direct two-hop and via B<->C detours
-    items = algs.ksp(to_handle(g), 0, 3, k=5, max_cost_factor=None, unique=True)
-    assert len(items) >= 2
-    top_costs = sorted(t_cost(dist, 3) for dist, _ in items[:2])
-    # Expect two shortest (cost=2)
-    assert np.isclose(top_costs[0], 2.0)
-    assert np.isclose(top_costs[1], 2.0)
-    # No route from A(0) to E(4)
-    empty = algs.ksp(to_handle(g), 0, 4, k=5, max_cost_factor=None, unique=True)
-    assert empty == []
-    for d, dag in items[:2]:
-        assert_pred_dag_integrity(g, dag, dist=d)
+def test_order_and_ceilings():
+    g = bgraph(4, CHAIN)
+    got = ksp(g, 0, 3, 8)
+    assert [c for c, _ in got] == [3, 4, 4]
+    assert all(isinstance(p, ngc.Path) and p.cost() == c for c, p in got)
+    assert got[0][1].hops() == [[0], [2], [4]]
+    assert [c for c, _ in ksp(g, 0, 3, 8, cost_ceiling=ngc.CostStretch(1.0))] == [3]
+    assert [c for c, _ in ksp(g, 0, 3, 8, cost_ceiling=ngc.CostStretch(1.5))] == [
+        3,
+        4,
+        4,
+    ]
+    assert [c for c, _ in ksp(g, 0, 3, 8, cost_ceiling=ngc.AbsoluteCost(3))] == [3]
+    assert ksp(g, 0, 3, 8, cost_ceiling=ngc.AbsoluteCost(0)) == []
+    assert len(ksp(g, 0, 3, 2)) == 2
+    # The CostStretch baseline is static: gating the middle edge drops the cost-3 path only.
+    residual = [1, 1, 0, 1, 1]
+    assert ksp(g, 0, 3, 8, cost_ceiling=ngc.CostStretch(1.0), residual=residual) == []
+    assert [c for c, _ in ksp(g, 0, 3, 8, residual=residual)] == [4, 4]
+    excluded = g.eligibility([0], [])
+    assert ksp(g, 0, 3, 8, eligibility=excluded) == []
+
+
+def test_expand_collapse_and_the_single_path():
+    pr = bgraph(3, [(0, 1, 1, 1), (0, 1, 1, 1), (1, 2, 1, 1), (1, 2, 1, 1)])
+    assert len(ksp(pr, 0, 2, 8)) == 4
+    assert len(ksp(pr, 0, 2, 8, parallel_edges=False)) == 1
+    assert [p.hops() for _c, p in ksp(pr, 0, 2, 3)] == [
+        [[0], [2]],
+        [[0], [3]],
+        [[1], [2]],
+    ]
+    three = bgraph(
+        6,
+        [
+            (0, 2, 1, 1),
+            (2, 3, 1, 1),
+            (3, 5, 1, 1),
+            (0, 1, 1, 1),
+            (1, 4, 1, 1),
+            (4, 5, 1, 1),
+        ],
+    )
+    for tie in (FEWER, HIGHER_CAP):
+        first = ksp(three, 0, 5, 1, tie=tie)[0][1]
+        for direction, roots, targets in (
+            (ngc.Direction.FORWARD, 0, 5),
+            (ngc.Direction.REVERSE, 5, 0),
+        ):
+            options = ngc.SpfOptions(
+                direction, tie_break=tie, multipath=False, targets=targets
+            )
+            r = ngc.spf(three, roots, options)
+            assert r.dag == first.to_dag()
+    # ksp has no multipath field: k sets the number of paths. Every tie_break is valid with
+    # every parallel_edges (ksp always orders paths, so no tie rule is ineffective).
+    with pytest.raises(TypeError):
+        ngc.KspOptions(8, multipath=False)
+    for g, t in ((pr, 2), (three, 5)):
+        for tie, pe in ((FEWER, True), (HIGHER_CAP, True), (FEWER, False)):
+            assert ksp(g, 0, t, 8, tie=tie, parallel_edges=pe)
+
+
+def test_ksp_validation_order():
+    # The residual's own checks are the shared ones of test_edge_amounts.py.
+    g = bgraph(3, [(0, 1, 1, 1), (1, 2, 1, 1)])
+    other = bgraph(3, [(0, 1, 1, 1)])
+    with pytest.raises(
+        ValueError, match=exact("source: node 3 out of node range [0, 3)")
+    ):
+        ksp(g, 3, 1, 1)
+    with pytest.raises(
+        ValueError, match=exact("destination: node -1 out of node range [0, 3)")
+    ):
+        ksp(g, 0, -1, 1)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "destination: node 1180591620717411303424 out of node range [0, 3)"
+        ),
+    ):
+        ksp(g, 0, 2**70, 1)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "node 1 is in both endpoint sets: source and destination must not overlap"
+        ),
+    ):
+        ksp(g, 1, 1, 1)
+    with pytest.raises(ValueError, match=exact("k must be >= 1 (got 0)")):
+        ksp(g, 0, 2, 0)
+    with pytest.raises(ValueError, match=exact("k must be >= 1 (got -1)")):
+        ksp(g, 0, 2, -1)
+    with pytest.raises(
+        ValueError, match=exact("k must be >= 1 (got -1180591620717411303424)")
+    ):
+        ksp(g, 0, 2, -(2**70))
+    with pytest.raises(TypeError, match=exact("k must be an integer (got float)")):
+        ksp(g, 0, 2, 1.5)
+    absolute = "cost_ceiling AbsoluteCost cost must be >= 0 (got -1)"
+    stretch = "cost_ceiling CostStretch factor must be >= 1 (got {})"
+    with pytest.raises(ValueError, match=exact(absolute)):
+        ksp(g, 0, 2, 1, cost_ceiling=ngc.AbsoluteCost(-1))
+    with pytest.raises(ValueError, match=exact(stretch.format("1/2"))):
+        ksp(g, 0, 2, 1, cost_ceiling=ngc.CostStretch(0.5))
+    with pytest.raises(
+        TypeError,
+        match=exact("cost_ceiling must be AbsoluteCost, CostStretch or None"),
+    ):
+        ksp(g, 0, 2, 1, cost_ceiling=3)
+    with pytest.raises(
+        ValueError, match=exact("foreign Eligibility: built for another graph")
+    ):
+        ksp(g, 0, 2, 1, eligibility=other.eligibility([], [0]))
+    # The order: the endpoints (source, destination, source == destination), k, the ceiling, the residual.
+    with pytest.raises(
+        ValueError, match=exact("source: node 3 out of node range [0, 3)")
+    ):
+        ksp(g, 3, -1, 0, cost_ceiling=ngc.AbsoluteCost(-1), residual=[9])
+    with pytest.raises(
+        ValueError, match=exact("destination: node -1 out of node range [0, 3)")
+    ):
+        ksp(g, 0, -1, 0, cost_ceiling=ngc.AbsoluteCost(-1), residual=[9])
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "node 2 is in both endpoint sets: source and destination must not overlap"
+        ),
+    ):
+        ksp(g, 2, 2, 0, cost_ceiling=ngc.AbsoluteCost(-1), residual=[9])
+    with pytest.raises(ValueError, match=exact("k must be >= 1 (got 0)")):
+        ksp(g, 0, 2, 0, cost_ceiling=ngc.AbsoluteCost(-1), residual=[9])
+    with pytest.raises(ValueError, match=exact(absolute)):
+        ksp(g, 0, 2, 1, cost_ceiling=ngc.AbsoluteCost(-1), residual=[9])
+    # A huge k lists every path (no error).
+    assert len(ksp(g, 0, 2, 2**70)) == 1
+    with pytest.raises(TypeError, match=exact("KspOptions expected (got SpfOptions)")):
+        ngc.ksp(g, 0, 2, ngc.SpfOptions(ngc.Direction.FORWARD))
+    with pytest.raises(TypeError):
+        ngc.KspOptions()  # k is explicit
+    with pytest.raises(TypeError):
+        ngc.KspOptions(1, ngc.RouteTieBreak.FEWER_HOPS)  # the route choice is keywords
+    for bad in (None, 0, "no"):
+        with pytest.raises(TypeError):
+            ngc.KspOptions(1, parallel_edges=bad)
+    # KspOptions keeps its arguments as given (the same objects) and validates none of them:
+    # ksp does, at the call, in the order above.
+    k, ceiling, residual = 2**70, ngc.AbsoluteCost(-1), [9]
+    o = ngc.KspOptions(k, cost_ceiling=ceiling, residual=residual)
+    assert o.k is k and o.cost_ceiling is ceiling and o.residual is residual
+    assert (o.tie_break, o.parallel_edges, o.eligibility) == (FEWER, True, None)
+    assert_read_only(o, "k", "tie_break", "parallel_edges", "cost_ceiling")
+    with pytest.raises(
+        ValueError, match=exact("cost_ceiling AbsoluteCost cost must be >= 0 (got -1)")
+    ):
+        ngc.ksp(g, 0, 2, o)
+    with pytest.raises(ValueError, match=exact("k must be >= 1 (got 0)")):
+        ngc.ksp(g, 0, 2, ngc.KspOptions(0, cost_ceiling=ceiling))
+
+
+def test_resolve_to_paths():
+    # 0->1 twice (cost 1), 0->2 (1), 0->3 (5), 1->3 (1), 2->3 (1): ids in this order.
+    g = bgraph(
+        4,
+        [
+            (0, 1, 1, 1),
+            (0, 1, 1, 1),
+            (0, 2, 1, 1),
+            (0, 3, 1, 5),
+            (1, 3, 1, 1),
+            (2, 3, 1, 1),
+        ],
+    )
+    dag = ngc.PredecessorDAG.from_csr(
+        g, [0, 0, 2, 3, 6], [0, 0, 0, 0, 1, 2], [0, 1, 2, 3, 4, 5]
+    )
+    grouped = ngc.resolve_to_paths(g, dag, 0, 3)
+    assert [p.hops() for p in grouped] == [[[0, 1], [4]], [[2], [5]], [[3]]]
+    assert [p.cost() for p in grouped] == [2, 2, 5]
+    split = ngc.resolve_to_paths(g, dag, 0, 3, split_parallel_edges=True)
+    assert [p.hops() for p in split] == [[[0], [4]], [[1], [4]], [[2], [5]], [[3]]]
+    assert len(ngc.resolve_to_paths(g, dag, 0, 3, True, 2)) == 2
+    assert ngc.resolve_to_paths(g, dag, 3, 0) == []
+    other = bgraph(4, [(0, 1, 1, 1)])
+    foreign = "foreign PredecessorDAG: built for another graph"
+    overlap = "node 2 is in both endpoint sets: source and destination must not overlap"
+    with pytest.raises(ValueError, match=exact(foreign)):
+        ngc.resolve_to_paths(other, dag, 0, 3)
+    with pytest.raises(
+        ValueError, match=exact("source: node 4 out of node range [0, 4)")
+    ):
+        ngc.resolve_to_paths(g, dag, 4, 3)
+    with pytest.raises(ValueError, match=exact(overlap)):
+        ngc.resolve_to_paths(g, dag, 2, 2)
+    with pytest.raises(ValueError, match=exact("max_paths must be >= 1 (got 0)")):
+        ngc.resolve_to_paths(g, dag, 0, 3, False, 0)
+    with pytest.raises(
+        ValueError, match=exact("max_paths must be >= 1 (got -1180591620717411303424)")
+    ):
+        ngc.resolve_to_paths(g, dag, 0, 3, False, -(2**70))
+    # A count above INT64_MAX lists every walk (no error).
+    assert len(ngc.resolve_to_paths(g, dag, 0, 3, True, 2**70)) == 4
+    # Several defects: the DAG's graph, source, destination, source == destination, then max_paths.
+    with pytest.raises(ValueError, match=exact(foreign)):
+        ngc.resolve_to_paths(other, dag, 9, -9, False, 0)
+    with pytest.raises(
+        ValueError, match=exact("source: node 9 out of node range [0, 4)")
+    ):
+        ngc.resolve_to_paths(g, dag, 9, -9, False, 0)
+    with pytest.raises(
+        ValueError, match=exact("destination: node -9 out of node range [0, 4)")
+    ):
+        ngc.resolve_to_paths(g, dag, 0, -9, False, 0)
+    with pytest.raises(ValueError, match=exact(overlap)):
+        ngc.resolve_to_paths(g, dag, 2, 2, False, 0)
+    # A search's DAG resolves the same way from a reverse search: the two cost-2 paths (the
+    # cost-5 edge is on no shortest path).
+    fw = ngc.spf(g, 0, ngc.SpfOptions(ngc.Direction.FORWARD)).dag
+    rv = ngc.spf(g, 3, ngc.SpfOptions(ngc.Direction.REVERSE)).dag
+    forward = ngc.resolve_to_paths(g, fw, 0, 3)
+    assert [(p.cost(), p.hops()) for p in forward] == [
+        (2, [[0, 1], [4]]),
+        (2, [[2], [5]]),
+    ]
+    assert ngc.resolve_to_paths(g, rv, 0, 3) == forward
+
+
+@needs_hooks
+def test_python_result_lists_are_all_or_nothing():
+    # Every Python object allocation of the call fails once: the call raises (never crashes)
+    # and a clean retry gives the same list (resolve_to_paths: the four split paths of
+    # test_resolve_to_paths).
+    g = bgraph(4, CHAIN)
+    opts = ngc.KspOptions(8)
+    split = bgraph(
+        4,
+        [
+            (0, 1, 1, 1),
+            (0, 1, 1, 1),
+            (0, 2, 1, 1),
+            (0, 3, 1, 5),
+            (1, 3, 1, 1),
+            (2, 3, 1, 1),
+        ],
+    )
+    dag = ngc.PredecessorDAG.from_csr(
+        split, [0, 0, 2, 3, 6], [0, 0, 0, 0, 1, 2], [0, 1, 2, 3, 4, 5]
+    )
+    for fn, args in (
+        (ngc.ksp, (g, 0, 3, opts)),
+        (ngc.resolve_to_paths, (split, dag, 0, 3, True)),
+    ):
+        failures = sweep_python_allocation(
+            lambda fn=fn, args=args: (fn, args, list), 200
+        )
+        assert failures >= 3, fn.__name__
+    # Costs beyond the cached small ints, the free lists emptied before each attempt: the
+    # result's cost ints are new objects, and their failures raise MemoryError too.
+    wide = bgraph(
+        4, [(0, 1, 1, 2**30), (1, 2, 1, 2**30), (2, 3, 1, 2**30), (0, 3, 1, 2**32)]
+    )
+    assert [c for c, _ in ngc.ksp(wide, 0, 3, opts)] == [3 * 2**30, 2**32]
+    failures = sweep_python_allocation(lambda: (ngc.ksp, (wide, 0, 3, opts), list), 200)
+    assert failures >= 5
+
+
+def test_tie_order():
+    # TRI (three parallel cost-1 links of capacities 4, 10, 100 and a cost-2 link of 50) with
+    # availability 4, 8, 5, 50: the cost-1 links in each rule's order, then the cost-2 link.
+    g = build(2, [(0, 1, 4, 1), (0, 1, 10, 1), (0, 1, 100, 1), (0, 1, 50, 2)])
+    tie = ngc.RouteTieBreak
+    for t, want in (
+        (tie.FEWER_HOPS, [0, 1, 2, 3]),
+        (tie.HIGHER_CAPACITY, [2, 1, 0, 3]),
+        (tie.HIGHER_AVAILABLE_CAPACITY, [1, 2, 0, 3]),
+        (tie.HIGHER_HEADROOM, [0, 1, 2, 3]),  # 1, 4/5, 1/20
+    ):
+        paths = ngc.ksp(g, 0, 1, ngc.KspOptions(4, tie_break=t, residual=[4, 8, 5, 50]))
+        assert [p.hops()[0][0] for _, p in paths] == want, t
+        assert [c for c, _ in paths] == [1, 1, 1, 2]
+
+
+def test_stretch_examples():
+    # KSP-stretch-boundary / -below: links of costs 5 (residual 0, so gated) and 6; the static
+    # baseline is 5. 1.2 is exactly 6/5 and admits cost 6 at equality; 11/10 does not.
+    # KSP-stretch-numpy / -numpy-equal: base 10^8 and np.float32(1.2), also exactly 6/5, reject
+    # 120000001 and admit 120000000 (the float's binary value would not separate them).
+    def paths(cost0, cost1, factor):
+        g = build(2, [(0, 1, 0, cost0), (0, 1, 10, cost1)])
+        options = ngc.KspOptions(
+            2, cost_ceiling=ngc.CostStretch(factor), residual=[0, 10]
+        )
+        return [(c, [h[0] for h in p.hops()]) for c, p in ngc.ksp(g, 0, 1, options)]
+
+    assert paths(5, 6, 1.2) == [(6, [1])]
+    assert paths(5, 6, Fraction(11, 10)) == []
+    assert paths(10**8, 120000001, np.float32(1.2)) == []
+    assert paths(10**8, 120000000, np.float32(1.2)) == [(120000000, [1])]
+
+
+def test_stretch_below_one():
+    # KSP-stretch-below-one and KSP-ceiling-before-residual: a factor below 1 is refused where the
+    # ceiling is checked, after k and before the residual; the lowest numerator too.
+    g = build(2, [(0, 1, 10, 5)])
+    for factor, shown in ((Fraction(1, 2), "1/2"), (-(2**63), f"{-(2**63)}/1")):
+        text = f"cost_ceiling CostStretch factor must be >= 1 (got {shown})"
+        for residual in (None, [10], [99, 99]):
+            options = ngc.KspOptions(
+                2, cost_ceiling=ngc.CostStretch(factor), residual=residual
+            )
+            with pytest.raises(ValueError, match=exact(text)):
+                ngc.ksp(g, 0, 1, options)
+    with pytest.raises(ValueError, match=exact("k must be >= 1 (got 0)")):
+        ngc.ksp(g, 0, 1, ngc.KspOptions(0, cost_ceiling=ngc.CostStretch(0.5)))
+
+
+def test_stretch_wide_products():
+    # BIG(2^60): links of costs 2^60 and 2^60 + 1. With (2^60 + 1) / 2^60 both qualify (equality);
+    # with (2^61 + 1) / 2^61 only the first: (2^60 + 1) * 2^61 = 2^121 + 2^61 > (2^61 + 1) * 2^60.
+    c0 = 2**60
+    g = build(2, [(0, 1, 1, c0), (0, 1, 1, c0 + 1)])
+    for factor, want in (
+        (Fraction(2**60 + 1, 2**60), [c0, c0 + 1]),
+        (Fraction(2**61 + 1, 2**61), [c0]),
+    ):
+        options = ngc.KspOptions(2, cost_ceiling=ngc.CostStretch(factor))
+        assert [c for c, _ in ngc.ksp(g, 0, 1, options)] == want, factor
+
+
+def test_stretch_max_components():
+    # One link of cost 2^62 - 1 (c = c0) and the factor (2^63 - 1) / (2^63 - 2): the products stay
+    # below 2^125 and the path qualifies.
+    g = build(2, [(0, 1, 1, 2**62 - 1)])
+    options = ngc.KspOptions(
+        1, cost_ceiling=ngc.CostStretch(Fraction(2**63 - 1, 2**63 - 2))
+    )
+    assert [c for c, _ in ngc.ksp(g, 0, 1, options)] == [2**62 - 1]
diff --git a/tests/py/test_ksp_variants.py b/tests/py/test_ksp_variants.py
deleted file mode 100644
index 0001bfd..0000000
--- a/tests/py/test_ksp_variants.py
+++ /dev/null
@@ -1,135 +0,0 @@
-"""KSP variants: enumeration with unique=False, k-limit, masks, and out-of-order nodes."""
-
-from __future__ import annotations
-
-import numpy as np
-
-
-def _ksp_graph(build_graph):
-    # 0->1 direct; 0->2->1; 0->3->2->1 to generate multiple paths
-    edges = [
-        (0, 1, 1, 10, 0),
-        (0, 2, 1, 10, 1),
-        (2, 1, 1, 10, 2),
-        (0, 3, 1, 10, 3),
-        (3, 2, 1, 10, 4),
-    ]
-    return build_graph(4, edges)
-
-
-def test_ksp_unique_false_allows_alternative_enumeration(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    g = _ksp_graph(build_graph)
-    items = algs.ksp(to_handle(g), 0, 1, k=5, max_cost_factor=None, unique=False)
-    assert len(items) >= 3
-    # Costs should be nondecreasing among top items
-    costs = [float(dist[1]) for dist, _ in items]
-    assert all(c >= 1.0 for c in costs)
-    for d, dag in items[:3]:
-        assert_pred_dag_integrity(g, dag, dist=d)
-
-
-def test_ksp_respects_k_limit(build_graph, algs, to_handle):
-    g = _ksp_graph(build_graph)
-    items = algs.ksp(to_handle(g), 0, 1, k=2, max_cost_factor=None, unique=True)
-    assert len(items) == 2
-
-
-def test_ksp_with_masks(build_graph, algs, to_handle):
-    g = _ksp_graph(build_graph)
-    node_mask = np.array([True, True, True, False], dtype=bool)  # block node 3
-    items = algs.ksp(
-        to_handle(g), 0, 1, k=5, max_cost_factor=None, unique=True, node_mask=node_mask
-    )
-    # Only direct and via-2 remain
-    assert len(items) >= 2
-
-
-def test_ksp_out_of_order_node_preddag_semantics(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    """Verify PredDAG correctness when paths visit nodes out of numerical order.
-
-    Topology: 0->1->2 (cost 2) vs 0->3->2 (cost 4).
-    Path [0,3,2] visits node 3 before node 2, which previously triggered
-    a CSR fill-order bug where parent entries were swapped between nodes.
-    """
-    edges = [
-        (0, 1, 1, 1.0, 0),  # 0->1 cost 1
-        (1, 2, 1, 1.0, 1),  # 1->2 cost 1
-        (0, 3, 2, 2.0, 2),  # 0->3 cost 2
-        (3, 2, 2, 2.0, 3),  # 3->2 cost 2
-    ]
-    g = build_graph(4, edges)
-    items = algs.ksp(to_handle(g), 0, 2, k=5, max_cost_factor=None, unique=True)
-    assert len(items) >= 2
-
-    # Verify costs
-    costs = sorted(float(dist[2]) for dist, _ in items[:2])
-    assert np.isclose(costs[0], 2.0), f"Expected shortest cost 2.0, got {costs[0]}"
-    assert np.isclose(costs[1], 4.0), f"Expected second cost 4.0, got {costs[1]}"
-
-    for d, dag in items:
-        # Full semantic validation including distance consistency
-        assert_pred_dag_integrity(g, dag, dist=d)
-
-        # Reconstruct concrete paths via resolve_to_paths
-        concrete = dag.resolve_to_paths(0, 2, split_parallel_edges=True)
-        assert len(concrete) >= 1, "Should reconstruct at least one path"
-        for path in concrete:
-            assert len(path) >= 2
-            assert path[0][0] == 0, "Path should start at source"
-            assert path[-1][0] == 2, "Path should end at destination"
-            # Verify edge connectivity
-            edge_src = np.asarray(g.edge_src_view())
-            edge_dst = np.asarray(g.edge_dst_view())
-            for i in range(len(path) - 1):
-                from_node = path[i][0]
-                to_node = path[i + 1][0]
-                for eid in path[i][1]:
-                    assert int(edge_src[eid]) == from_node
-                    assert int(edge_dst[eid]) == to_node
-
-
-def test_ksp_larger_out_of_order_topology(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    """Larger topology where k-shortest paths traverse nodes in non-numerical order.
-
-    Path 1: 0->5->3->1 (cost 3, severely out-of-order)
-    Path 2: 0->2->4->1 (cost 6, also out-of-order)
-    Path 3: 0->1       (cost 10, direct)
-    """
-    edges = [
-        (0, 5, 1, 1.0, 0),  # 0->5 cost 1
-        (5, 3, 1, 1.0, 1),  # 5->3 cost 1
-        (3, 1, 1, 1.0, 2),  # 3->1 cost 1
-        (0, 2, 2, 1.0, 3),  # 0->2 cost 2
-        (2, 4, 2, 1.0, 4),  # 2->4 cost 2
-        (4, 1, 2, 1.0, 5),  # 4->1 cost 2
-        (0, 1, 10, 1.0, 6),  # 0->1 cost 10
-    ]
-    g = build_graph(6, edges)
-    items = algs.ksp(to_handle(g), 0, 1, k=5, max_cost_factor=None, unique=True)
-    assert len(items) >= 2
-
-    # Check costs non-decreasing
-    costs = [float(dist[1]) for dist, _ in items]
-    for i in range(len(costs) - 1):
-        assert costs[i] <= costs[i + 1] + 1e-9
-
-    # First path should be 0->5->3->1 with cost 3
-    assert np.isclose(costs[0], 3.0), f"Expected shortest cost 3.0, got {costs[0]}"
-
-    for d, dag in items:
-        assert_pred_dag_integrity(g, dag, dist=d)
-
-        concrete = dag.resolve_to_paths(0, 1, split_parallel_edges=True)
-        assert len(concrete) >= 1
-        for path in concrete:
-            # Verify no repeated nodes (simple path)
-            nodes = [step[0] for step in path]
-            assert len(nodes) == len(set(nodes)), (
-                f"Path contains repeated nodes: {nodes}"
-            )
diff --git a/tests/py/test_ledger_projections.py b/tests/py/test_ledger_projections.py
new file mode 100644
index 0000000..186b127
--- /dev/null
+++ b/tests/py/test_ledger_projections.py
@@ -0,0 +1,211 @@
+"""The ledger's two projections through the binding: carried traffic
+(carried, residual) and the strict holds of T1 tunnels (reserved, unreserved), never added;
+their baselines, texts, removal, orphans, reset, copy, the policy's reservation output and
+records, imported programs and the bottleneck report."""
+
+from __future__ import annotations
+
+import numpy as np
+import pytest
+from helpers import SHORTEST_PATHS, build, exact, ledger_state, t1_config
+
+import netgraph_core as ngc
+
+LOSSY = ngc.Admission.LOSSY
+HOLDS = ngc.OutputOptions(edge_reservations=True)
+
+
+def one10():
+    return build(2, [(0, 1, 10, 1)])
+
+
+def twoh(a, b):
+    return build(3, [(0, 2, a, 1), (1, 2, b, 1)])
+
+
+def t1(ledger, sources, dest, n, admission=None):
+    return ngc.FlowPolicy(ledger, sources, dest, t1_config(n, admission))
+
+
+def test_two_projections_of_one_link():
+    # Carried 4, held 6 on a link of 10: residual 6, unreserved 4; then replace(2,
+    # 6): call_delivered 2, delivery_delta -2.
+    fg = ngc.FlowLedger(one10())
+    p = t1(fg, 0, 1, 1)
+    p.replace(4, design_demand=6)
+    assert [
+        x.tolist()
+        for x in (fg.carried(), fg.residual(), fg.reserved(), fg.unreserved())
+    ] == [
+        [4],
+        [6],
+        [6],
+        [4],
+    ]
+    r = p.replace(2, design_demand=6)
+    assert (r.call_delivered, r.delivery_delta) == (2, -2)
+
+
+def test_holds_are_never_added_to_carried_load():
+    # After the T1 call (carried 4, held 6) a ShortestPaths policy places the residual 6 (not 10 - 4 - 6).
+    fg = ngc.FlowLedger(one10())
+    t1(fg, 0, 1, 1).replace(4, design_demand=6)
+    assert ngc.FlowPolicy(fg, 0, 1, SHORTEST_PATHS).place(10).call_delivered == 6
+
+
+def test_unreserved_texts():
+    # The reservation baseline is keyword-only, checked after the
+    # residual's, with the residual baseline's messages under its own name.
+    g = one10()
+    fg = ngc.FlowLedger(g, reservation_baseline=[3])
+    p = t1(fg, 0, 1, 1)
+    r = p.replace(4, design_demand=4)
+    assert r.program.tunnels[0].status == ngc.TunnelStatus.INSUFFICIENT_BANDWIDTH
+    assert (fg.residual().tolist(), fg.unreserved().tolist()) == ([10], [3])
+    for bad, text in (
+        ([3, 1], "reservation_baseline has length 2, expected 1 (one entry per edge)"),
+        (
+            [11],
+            "reservation_baseline[0] = 11 is outside [0, edge_capacity_units[0] = 10]",
+        ),
+        (
+            [-1],
+            "reservation_baseline[0] = -1 is outside [0, edge_capacity_units[0] = 10]",
+        ),
+    ):
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowLedger(g, reservation_baseline=bad)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "service_baseline[0] = 11 is outside [0, edge_capacity_units[0] = 10]"
+        ),
+    ):
+        ngc.FlowLedger(g, [11], reservation_baseline=[11])
+    with pytest.raises(TypeError):
+        ngc.FlowLedger(g, [10], [3])  # unreserved is keyword-only
+    # The two-edge cases.
+    two = build(2, [(0, 1, 10, 1), (0, 1, 10, 1)])
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "reservation_baseline has length 3, expected 2 (one entry per edge)"
+        ),
+    ):
+        ngc.FlowLedger(two, reservation_baseline=[1, 2, 3])
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "reservation_baseline[1] = 11 is outside [0, edge_capacity_units[1] = 10]"
+        ),
+    ):
+        ngc.FlowLedger(two, reservation_baseline=[5, 11])
+    assert ngc.FlowLedger(two, reservation_baseline=[10, 0]).unreserved().tolist() == [
+        10,
+        0,
+    ]
+
+
+def test_snapshots_are_int64_copies():
+    fg = ngc.FlowLedger(one10(), reservation_baseline=np.array([7], dtype=np.int64))
+    for snap in (fg.reserved, fg.unreserved):
+        a = snap()
+        assert a.dtype == np.int64
+        before = a.tolist()
+        a[0] = 99
+        assert snap().tolist() == before
+
+
+def test_remove_releases_both():
+    fg = ngc.FlowLedger(one10())
+    p = t1(fg, 0, 1, 1)
+    p.replace(4, design_demand=6)
+    p.remove()
+    assert (fg.reserved().tolist(), fg.carried().tolist()) == ([0], [0])
+    assert p.program is None and p.records() == []
+    p.remove()
+    assert fg.reserved().tolist() == [0]
+
+
+def test_orphans_reset_and_copy():
+    # Holds of a policy dropped without remove() stay as orphans, readable; reset() clears
+    # them; reset(reservation_baseline=...) sets the reservation baseline; a copy keeps holds and records.
+    g = one10()
+    fg = ngc.FlowLedger(g)
+    p = t1(fg, 0, 1, 1)
+    p.replace(4, design_demand=6)
+    with pytest.raises(ValueError, match="cannot be copied"):
+        fg.copy()
+    with pytest.raises(ValueError, match="rejected while a policy is bound"):
+        fg.reset()
+    del p
+    assert fg.reserved().tolist() == [6]
+    assert [r.edge_reservations for r in fg.records()] == [[(0, 6)]]
+    copy = fg.copy()
+    assert copy.uid() != fg.uid()
+    assert ledger_state(copy) == ledger_state(fg)
+    fg.reset()
+    assert (fg.reserved().tolist(), fg.records()) == ([0], [])
+    assert copy.reserved().tolist() == [6]
+    fg.reset(reservation_baseline=[3])
+    assert (fg.unreserved().tolist(), fg.residual().tolist()) == ([3], [10])
+    fg.reset([7])
+    assert (fg.unreserved().tolist(), fg.residual().tolist()) == ([10], [7])
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "reservation_baseline[0] = 11 is outside [0, edge_capacity_units[0] = 10]"
+        ),
+    ):
+        fg.reset(reservation_baseline=[11])
+    assert fg.residual().tolist() == [7]  # a failed reset changes nothing
+
+
+def test_reservation_output_and_record_holds():
+    # The TWOH call's policy's holds per edge [0, 6] and per record (tunnels 1 and 3 hold 3 on e1);
+    # a ShortestPaths policy's reservation output is zeros.
+    fg = ngc.FlowLedger(twoh(2, 10))
+    p = t1(fg, [0, 1], 2, 2, LOSSY)
+    r = p.replace(12, design_demand=12, outputs=HOLDS)
+    assert r.edge_reservations.tolist() == [0, 6]
+    assert r.edge_reservations.dtype == np.int64
+    recs = p.records()
+    assert [rec.edge_reservations for rec in recs] == [[], [(1, 3)], [], [(1, 3)]]
+    held = [0, 0]
+    for rec in recs:
+        for e, x in rec.edge_reservations:
+            held[e] += x
+    assert held == fg.reserved().tolist()
+    c = ngc.FlowPolicy(ngc.FlowLedger(twoh(2, 10)), [0, 1], 2, SHORTEST_PATHS)
+    assert c.place(4, HOLDS).edge_reservations.tolist() == [0, 0]
+    assert r.residual is None  # only what is requested
+    assert p.replace(12, design_demand=12).edge_reservations is None
+
+
+def test_imported_programs_book_nothing():
+    # Pinned over T1's program forwards it without a hold.
+    g = twoh(2, 10)
+    prog = (
+        t1(ngc.FlowLedger(g), [0, 1], 2, 2, LOSSY).replace(12, design_demand=12).program
+    )
+    fg = ngc.FlowLedger(g)
+    pin = ngc.FlowPolicy(
+        fg, [0, 1], 2, ngc.FlowPolicyConfig(routing=ngc.Pinned(prog), admission=LOSSY)
+    )
+    r = pin.replace(12, outputs=HOLDS)
+    assert (r.edge_reservations.tolist(), fg.reserved().tolist()) == (
+        [0, 0],
+        [0, 0],
+    )
+    assert all(rec.edge_reservations == [] for rec in pin.records())
+
+
+def test_bottleneck_reads_the_service_view_only():
+    # One link held whole (unreserved 0) carries nothing: no saturation is reported.
+    fg = ngc.FlowLedger(one10())
+    p = t1(fg, 0, 1, 1)
+    r = p.replace(
+        0, design_demand=10, outputs=ngc.OutputOptions(saturated_boundary_edges=True)
+    )
+    assert fg.unreserved().tolist() == [0]
+    assert fg.saturated_boundary_edges(0) == [] and r.saturated_boundary_edges == []
diff --git a/tests/py/test_lifetime_safety.py b/tests/py/test_lifetime_safety.py
deleted file mode 100644
index 90f4fd2..0000000
--- a/tests/py/test_lifetime_safety.py
+++ /dev/null
@@ -1,329 +0,0 @@
-"""
-Test lifetime management in Python bindings.
-
-These tests validate that pybind11 keep_alive policies correctly prevent
-premature garbage collection of objects that are referenced by raw pointers
-in C++ classes.
-"""
-
-import gc
-import weakref
-
-import numpy as np
-import pytest
-
-from netgraph_core import (
-    Algorithms,
-    Backend,
-    FlowGraph,
-    FlowPolicy,
-    FlowPolicyConfig,
-    FlowState,
-    StrictMultiDiGraph,
-)
-
-
-def _make_graph(num_nodes, src, dst, capacity, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, capacity, cost, ext_edge_ids
-    )
-
-
-class TestFlowStateLifetime:
-    """Test FlowState keeps graph alive (Issue #1)."""
-
-    def test_flowstate_keeps_graph_alive_basic(self):
-        """FlowState should prevent graph from being garbage collected."""
-        # Create graph
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-
-        # Create FlowState (should keep graph alive via keep_alive<0,1>)
-        fs = FlowState(g)
-
-        # Create weak reference to detect when graph is collected
-        graph_ref = weakref.ref(g)
-
-        # Delete strong reference to graph
-        del g
-        gc.collect()
-
-        # With fix: graph should still be alive (kept by fs)
-        assert graph_ref() is not None, "Graph was prematurely collected"
-
-        # FlowState should still work
-        residual = fs.residual_view()
-        assert len(residual) == 2
-        assert residual[0] == 10.0
-
-        # When both FlowState and all views are deleted, graph can be collected
-        del residual
-        del fs
-        gc.collect()
-        assert graph_ref() is None, (
-            "Graph should be collected after FlowState and views are deleted"
-        )
-
-    def test_flowstate_with_residual_keeps_graph_alive(self):
-        """FlowState(graph, residual) should keep graph alive, not residual."""
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-
-        residual = np.array([5.0, 7.0])
-        fs = FlowState(g, residual)
-
-        graph_ref = weakref.ref(g)
-
-        # Delete references
-        del g
-        del residual
-        gc.collect()
-
-        # Graph should be kept alive (by FlowState), residual is copied
-        assert graph_ref() is not None, "Graph was prematurely collected"
-
-        # FlowState should work
-        res = fs.residual_view()
-        assert len(res) == 2
-        assert res[0] == 5.0
-        assert res[1] == 7.0
-
-
-class TestFlowPolicyLifetime:
-    """Test FlowPolicy keeps Algorithms and Graph alive (Issue #2)."""
-
-    def test_flowpolicy_keeps_algorithms_alive(self):
-        """FlowPolicy should prevent Algorithms from being garbage collected."""
-        # Setup
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        # Create FlowPolicy
-        config = FlowPolicyConfig()
-        policy = FlowPolicy(algs, graph, config)
-
-        # Create weak references
-        algs_ref = weakref.ref(algs)
-        graph_ref = weakref.ref(graph)
-
-        # Delete strong references
-        del algs
-        del graph
-        gc.collect()
-
-        # With fix: both should still be alive
-        assert algs_ref() is not None, "Algorithms was prematurely collected"
-        assert graph_ref() is not None, "Graph was prematurely collected"
-
-        # Policy should still work
-        assert policy.flow_count() == 0
-        assert policy.placed_demand() == 0.0
-
-    def test_flowpolicy_keyword_constructor_keeps_alive(self):
-        """FlowPolicy keyword constructor should also keep dependencies alive."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        # Use config constructor
-        cfg = FlowPolicyConfig(min_flow_count=1, max_total_iterations=100)
-        policy = FlowPolicy(algs, graph, cfg)
-
-        algs_ref = weakref.ref(algs)
-
-        del algs
-        gc.collect()
-
-        assert algs_ref() is not None, "Algorithms was prematurely collected"
-        assert policy.flow_count() == 0
-
-
-class TestFlowGraphLifetime:
-    """Test FlowGraph lifetime management."""
-
-    def test_flowgraph_keeps_graph_alive(self):
-        """FlowGraph should prevent graph from being garbage collected."""
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-
-        fg = FlowGraph(g)
-        graph_ref = weakref.ref(g)
-
-        # Delete graph reference
-        del g
-        gc.collect()
-
-        # Graph should still be alive (kept by FlowGraph)
-        assert graph_ref() is not None, "Graph was prematurely collected"
-
-        # FlowGraph should still work
-        graph_from_fg = fg.graph
-        assert graph_from_fg.num_nodes() == 3
-        assert graph_from_fg.num_edges() == 2
-
-        # When FlowGraph is deleted, graph can be collected
-        del fg
-        del graph_from_fg
-        gc.collect()
-        assert graph_ref() is None, (
-            "Graph should be collected after FlowGraph is deleted"
-        )
-
-
-class TestComplexLifetimeScenarios:
-    """Test more complex lifetime interactions."""
-
-    def test_nested_lifetime_chain(self):
-        """Test chain: Graph -> FlowState -> operations."""
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-
-        fs = FlowState(g)
-
-        # Create weak references
-        g_ref = weakref.ref(g)
-
-        # Delete graph
-        del g
-        gc.collect()
-
-        # Graph should be kept alive by FlowState
-        assert g_ref() is not None
-
-        # Should be able to perform operations
-        fs.reset()
-        residual = fs.residual_view()
-        assert len(residual) == 2
-
-    def test_multiple_flowstates_share_graph(self):
-        """Multiple FlowStates should all keep the same graph alive."""
-        g = _make_graph(
-            3,
-            np.array([0, 1], dtype=np.int32),
-            np.array([1, 2], dtype=np.int32),
-            np.array([10.0, 10.0]),
-            np.array([1, 1], dtype=np.int64),
-        )
-
-        fs1 = FlowState(g)
-        fs2 = FlowState(g, np.array([8.0, 9.0]))
-
-        g_ref = weakref.ref(g)
-
-        del g
-        gc.collect()
-
-        # Graph kept alive by both FlowStates
-        assert g_ref() is not None
-
-        # Both should work
-        assert len(fs1.residual_view()) == 2
-        assert len(fs2.residual_view()) == 2
-
-        # Delete one FlowState - graph should still be alive
-        del fs1
-        gc.collect()
-        assert g_ref() is not None
-
-        # Delete second FlowState - now graph can be collected
-        del fs2
-        gc.collect()
-        assert g_ref() is None
-
-
-@pytest.mark.slow
-class TestLifetimeUnderStress:
-    """Stress tests for lifetime management."""
-
-    def test_rapid_create_delete_cycle(self):
-        """Rapidly create and delete objects to stress lifetime management."""
-        for _ in range(100):
-            g = _make_graph(
-                10,
-                np.arange(9, dtype=np.int32),
-                np.arange(1, 10, dtype=np.int32),
-                np.ones(9),
-                np.ones(9, dtype=np.int64),
-            )
-
-            fs = FlowState(g)
-            del g  # Should be kept alive by fs
-
-            # Do some work
-            try:
-                residual = fs.residual_view()
-                assert len(residual) == 9
-                fs.reset()
-            except Exception:
-                # If the graph was prematurely collected, this will crash
-                # That's what we're testing for
-                pass
-
-            # Delete FlowState
-            del fs
-            gc.collect()
-
-        # If we got here without crashing, lifetime management is working
-
-    def test_large_graph_lifetime(self):
-        """Test lifetime with larger graphs to catch memory issues."""
-        n = 1000
-        g = _make_graph(
-            n,
-            np.arange(n - 1, dtype=np.int32),
-            np.arange(1, n, dtype=np.int32),
-            np.random.rand(n - 1) * 100,
-            np.ones(n - 1, dtype=np.int64),
-        )
-
-        fs = FlowState(g)
-        g_ref = weakref.ref(g)
-
-        del g
-        gc.collect()
-
-        assert g_ref() is not None
-
-        # Access views multiple times
-        for _ in range(10):
-            residual = fs.residual_view()
-            assert len(residual) == n - 1
diff --git a/tests/py/test_mask_semantics.py b/tests/py/test_mask_semantics.py
deleted file mode 100644
index bd5a5b7..0000000
--- a/tests/py/test_mask_semantics.py
+++ /dev/null
@@ -1,180 +0,0 @@
-"""Quick CI probes for critical masking semantics.
-
-Validates that masks behave correctly end-to-end across all APIs,
-as suggested in the final masking review.
-"""
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-@pytest.fixture
-def tiny_graph():
-    """Tiny graph: 0 -> 1 -> 2"""
-    return _make_graph(
-        3,
-        np.array([0, 1], np.int32),
-        np.array([1, 2], np.int32),
-        np.array([1.0, 1.0], np.float64),
-        np.array([1, 1], np.int64),
-    )
-
-
-def test_spf_masked_source_returns_empty_dag_inf_distances(tiny_graph):
-    """SPF: masked source -> empty DAG + inf distances."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    dist, dag = algs.spf(G, 0, dst=2, node_mask=np.array([False, True, True], bool))
-
-    assert np.isinf(dist[2]), "Distance to dst should be infinity"
-    assert dag.parent_offsets[-1] == 0, "DAG should be empty"
-
-
-def test_spf_edge_mask_excludes_path(tiny_graph):
-    """SPF: edge mask excludes (1->2) -> unreachable."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    # Mask out edge 1 (1->2)
-    dist, dag = algs.spf(G, 0, dst=2, edge_mask=np.array([True, False], bool))
-
-    assert np.isinf(dist[2]), "Node 2 should be unreachable"
-
-
-def test_max_flow_destination_masked_returns_zero(tiny_graph):
-    """MaxFlow: destination masked -> zero flow, empty cut."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    # Mask out destination (node 2)
-    total, summary = algs.max_flow(
-        G, 0, 2, node_mask=np.array([True, True, False], bool)
-    )
-
-    assert total == 0.0, "Flow should be zero"
-    assert len(summary.min_cut.edges) == 0, "Min-cut should be empty"
-
-
-def test_flow_state_place_max_flow_accepts_masks(tiny_graph):
-    """FlowState.place_max_flow now accepts masks (strict validation)."""
-    fs = ngc.FlowState(tiny_graph)
-
-    # Mask out source
-    placed = fs.place_max_flow(
-        0,
-        2,
-        ngc.FlowPlacement.PROPORTIONAL,
-        node_mask=np.array([False, True, True], bool),
-    )
-
-    assert placed == 0.0, "No flow should be placed with masked source"
-
-
-def test_flow_state_place_max_flow_with_valid_masks(tiny_graph):
-    """FlowState.place_max_flow works correctly with valid masks."""
-    fs = ngc.FlowState(tiny_graph)
-
-    # Allow all nodes
-    placed = fs.place_max_flow(
-        0,
-        2,
-        ngc.FlowPlacement.PROPORTIONAL,
-        node_mask=np.array([True, True, True], bool),
-        edge_mask=np.array([True, True], bool),
-    )
-
-    assert placed > 0, "Flow should be placed with all nodes/edges allowed"
-
-
-def test_batch_max_flow_validates_mask_lengths(tiny_graph):
-    """Batch: shape mismatches throw (node_masks length != num_nodes)."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    with pytest.raises(TypeError, match="length"):
-        # Wrong node mask length (2 instead of 3)
-        algs.batch_max_flow(
-            G,
-            np.array([[0, 2]], np.int32),
-            node_masks=[np.ones(2, bool)],  # Wrong length!
-        )
-
-
-def test_flow_policy_with_masks_end_to_end(tiny_graph):
-    """FlowPolicy with masks: end-to-end place_demand."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    # Create policy with destination masked out
-    cfg = ngc.FlowPolicyConfig()
-    policy = ngc.FlowPolicy(algs, G, cfg, node_mask=np.array([True, True, False], bool))
-
-    fg = ngc.FlowGraph(tiny_graph)
-    placed, leftover = policy.place_demand(fg, 0, 2, flowClass=0, volume=1.0)
-
-    assert placed == 0.0, "No flow placed with masked destination"
-    assert leftover == pytest.approx(1.0, abs=1e-9), "All volume should remain"
-
-
-def test_ksp_honors_node_mask(tiny_graph):
-    """KSP: honors node masks (masked intermediate node)."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    # Mask out intermediate node 1
-    paths = algs.ksp(G, 0, 2, k=2, node_mask=np.array([True, False, True], bool))
-
-    assert len(paths) == 0, "No paths should exist with node 1 masked"
-
-
-def test_min_cut_with_masked_source(tiny_graph):
-    """FlowState.compute_min_cut with masked source returns empty cut."""
-    fs = ngc.FlowState(tiny_graph)
-
-    # Place some flow first
-    fs.place_max_flow(0, 2, ngc.FlowPlacement.PROPORTIONAL)
-
-    # Compute min-cut with source masked
-    cut = fs.compute_min_cut(0, node_mask=np.array([False, True, True], bool))
-
-    assert len(cut.edges) == 0, "Min-cut should be empty with masked source"
-
-
-def test_all_apis_accept_none_masks(tiny_graph):
-    """All APIs accept None masks (no masking)."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    G = algs.build_graph(tiny_graph)
-
-    # SPF
-    dist, dag = algs.spf(G, 0, 2, node_mask=None, edge_mask=None)
-    assert not np.isinf(dist[2])
-
-    # KSP
-    paths = algs.ksp(G, 0, 2, k=1, node_mask=None, edge_mask=None)
-    assert len(paths) == 1
-
-    # Max flow
-    total, _ = algs.max_flow(G, 0, 2, node_mask=None, edge_mask=None)
-    assert total > 0
-
-    # FlowState.place_max_flow
-    fs = ngc.FlowState(tiny_graph)
-    placed = fs.place_max_flow(
-        0, 2, ngc.FlowPlacement.PROPORTIONAL, node_mask=None, edge_mask=None
-    )
-    assert placed > 0
-
-    # FlowState.compute_min_cut
-    cut = fs.compute_min_cut(0, node_mask=None, edge_mask=None)
-    assert isinstance(cut, ngc.MinCut)
diff --git a/tests/py/test_mask_validation.py b/tests/py/test_mask_validation.py
deleted file mode 100644
index eaa726e..0000000
--- a/tests/py/test_mask_validation.py
+++ /dev/null
@@ -1,230 +0,0 @@
-"""Mask validation tests.
-
-Validates that API entry points enforce mask length requirements
-and reject malformed masks with clear error messages.
-"""
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-@pytest.fixture
-def simple_graph():
-    """Create a simple 3-node graph: 0->1->2."""
-    return _make_graph(
-        3,
-        np.array([0, 1], np.int32),
-        np.array([1, 2], np.int32),
-        np.array([10.0, 10.0], np.float64),
-        np.array([1, 1], np.int64),
-    )
-
-
-def test_spf_rejects_wrong_node_mask_length(simple_graph):
-    """shortest_paths rejects node_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        algs.spf(gh, 0, 2, node_mask=np.array([True, True], dtype=bool))
-
-
-def test_spf_rejects_wrong_edge_mask_length(simple_graph):
-    """shortest_paths rejects edge_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        algs.spf(gh, 0, 2, edge_mask=np.array([True, True, True], dtype=bool))
-
-
-def test_ksp_rejects_wrong_node_mask_length(simple_graph):
-    """k_shortest_paths rejects node_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        algs.ksp(gh, 0, 2, k=2, node_mask=np.array([True], dtype=bool))
-
-
-def test_ksp_rejects_wrong_edge_mask_length(simple_graph):
-    """k_shortest_paths rejects edge_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        algs.ksp(gh, 0, 2, k=2, edge_mask=np.array([True], dtype=bool))
-
-
-def test_max_flow_rejects_wrong_node_mask_length(simple_graph):
-    """calc_max_flow rejects node_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        algs.max_flow(
-            gh, 0, 2, node_mask=np.array([True, True, True, True], dtype=bool)
-        )
-
-
-def test_max_flow_rejects_wrong_edge_mask_length(simple_graph):
-    """calc_max_flow rejects edge_mask with wrong length."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        algs.max_flow(gh, 0, 2, edge_mask=np.array([True], dtype=bool))
-
-
-def test_batch_max_flow_rejects_wrong_mask_length(simple_graph):
-    """batch_max_flow validates all masks upfront."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    # Wrong node mask length in batch (batch_max_flow expects numpy array of pairs)
-    pairs = np.array([[0, 2], [1, 2]], dtype=np.int32)
-    with pytest.raises(TypeError, match="node_masks length must equal"):
-        algs.batch_max_flow(
-            gh,
-            pairs,
-            node_masks=[
-                np.array([True, True, True], dtype=bool),
-                np.array([True], dtype=bool),
-            ],
-        )
-
-    # Wrong edge mask length in batch
-    pairs = np.array([[0, 2]], dtype=np.int32)
-    with pytest.raises(TypeError, match="edge_masks length must equal"):
-        algs.batch_max_flow(
-            gh, pairs, edge_masks=[np.array([True, True, True], dtype=bool)]
-        )
-
-
-def test_flow_state_compute_min_cut_rejects_wrong_mask_length(simple_graph):
-    """FlowState.compute_min_cut rejects wrong mask lengths."""
-    fs = ngc.FlowState(simple_graph)
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        fs.compute_min_cut(0, node_mask=np.array([True], dtype=bool))
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        fs.compute_min_cut(0, edge_mask=np.array([True, True, True], dtype=bool))
-
-
-def test_flow_state_place_max_flow_rejects_wrong_mask_length(simple_graph):
-    """FlowState.place_max_flow rejects wrong mask lengths."""
-    fs = ngc.FlowState(simple_graph)
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        fs.place_max_flow(
-            0,
-            2,
-            ngc.FlowPlacement.PROPORTIONAL,
-            node_mask=np.array([True, True], dtype=bool),
-        )
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        fs.place_max_flow(
-            0,
-            2,
-            ngc.FlowPlacement.PROPORTIONAL,
-            edge_mask=np.array([True, True, True], dtype=bool),
-        )
-
-
-def test_flow_policy_rejects_wrong_mask_length_at_construction(simple_graph):
-    """FlowPolicy validates mask lengths at construction time."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-    cfg = ngc.FlowPolicyConfig()
-
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        ngc.FlowPolicy(algs, gh, cfg, node_mask=np.array([True, True], dtype=bool))
-
-    with pytest.raises(TypeError, match="edge_mask length must equal"):
-        ngc.FlowPolicy(algs, gh, cfg, edge_mask=np.array([True], dtype=bool))
-
-
-def test_flow_state_place_max_flow_honors_node_mask(simple_graph):
-    """FlowState.place_max_flow respects node_mask."""
-    fs = ngc.FlowState(simple_graph)
-
-    # Mask out source
-    node_mask = np.array([False, True, True], dtype=bool)
-    total = fs.place_max_flow(0, 2, ngc.FlowPlacement.PROPORTIONAL, node_mask=node_mask)
-    assert total == 0.0
-
-
-def test_flow_state_place_max_flow_honors_edge_mask(simple_graph):
-    """FlowState.place_max_flow respects edge_mask."""
-    fs = ngc.FlowState(simple_graph)
-
-    # Mask out first edge (0->1)
-    edge_mask = np.array([False, True], dtype=bool)
-    total = fs.place_max_flow(0, 2, ngc.FlowPlacement.PROPORTIONAL, edge_mask=edge_mask)
-    assert total == 0.0
-
-
-def test_flow_state_place_max_flow_with_valid_masks(simple_graph):
-    """FlowState.place_max_flow works correctly with valid masks."""
-    fs = ngc.FlowState(simple_graph)
-
-    # Allow all nodes and edges
-    node_mask = np.array([True, True, True], dtype=bool)
-    edge_mask = np.array([True, True], dtype=bool)
-    total = fs.place_max_flow(
-        0, 2, ngc.FlowPlacement.PROPORTIONAL, node_mask=node_mask, edge_mask=edge_mask
-    )
-    assert total == pytest.approx(10.0, abs=1e-9)
-
-
-def test_all_apis_accept_empty_masks(simple_graph):
-    """All APIs accept empty masks (no masking)."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    # SPF with no masks
-    dist, dag = algs.spf(gh, 0, 2)
-    assert not np.isinf(dist[2])
-
-    # KSP with no masks
-    paths = algs.ksp(gh, 0, 2, k=1)
-    assert len(paths) == 1
-
-    # Max flow with no masks
-    total, _ = algs.max_flow(gh, 0, 2)
-    assert total > 0
-
-    # Batch max flow with no masks (expects numpy array)
-    pairs = np.array([[0, 2]], dtype=np.int32)
-    summaries = algs.batch_max_flow(gh, pairs)
-    assert len(summaries) == 1
-
-    # FlowState with no masks
-    fs = ngc.FlowState(simple_graph)
-    cut = fs.compute_min_cut(0)
-    assert isinstance(cut, ngc.MinCut)
-
-    total = fs.place_max_flow(0, 2, ngc.FlowPlacement.PROPORTIONAL)
-    assert total > 0
-
-
-def test_mask_validation_happens_before_expensive_operations(simple_graph):
-    """Mask validation fails fast before expensive graph operations."""
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    gh = algs.build_graph(simple_graph)
-
-    # Invalid mask should be caught before Dijkstra runs
-    with pytest.raises(TypeError, match="node_mask length must equal"):
-        algs.spf(gh, 0, 2, node_mask=np.array([True], dtype=bool))
diff --git a/tests/py/test_masking_comprehensive.py b/tests/py/test_masking_comprehensive.py
deleted file mode 100644
index 4a4e5fc..0000000
--- a/tests/py/test_masking_comprehensive.py
+++ /dev/null
@@ -1,653 +0,0 @@
-"""Masking behavior tests.
-
-Verifies node/edge mask handling across all algorithms:
-- Masked source/destination nodes
-- Combined node and edge masks
-- Interaction with residual capacity
-- Masking in max_flow, shortest_paths, and k_shortest_paths
-- Mask semantics (true = allowed, false = excluded)
-"""
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-# ============================================================================
-# Test Fixtures
-# ============================================================================
-
-
-@pytest.fixture
-def line_graph_3(build_graph):
-    """Simple line graph: 0 -> 1 -> 2"""
-    edges = [
-        (0, 1, 1.0, 1, 0),
-        (1, 2, 1.0, 1, 1),
-    ]
-    return build_graph(3, edges)
-
-
-@pytest.fixture
-def parallel_paths_graph(build_graph):
-    """Two parallel paths: 0 -> 1 -> 3 and 0 -> 2 -> 3"""
-    edges = [
-        (0, 1, 1.0, 1, 0),
-        (1, 3, 1.0, 1, 1),
-        (0, 2, 1.0, 1, 2),
-        (2, 3, 1.0, 1, 3),
-    ]
-    return build_graph(4, edges)
-
-
-@pytest.fixture
-def triangle_graph(build_graph):
-    """Triangle: 0 -> 1 -> 2 and 0 -> 2"""
-    edges = [
-        (0, 1, 2.0, 1, 0),
-        (1, 2, 1.0, 1, 1),
-        (0, 2, 1.0, 1, 2),
-    ]
-    return build_graph(3, edges)
-
-
-# ============================================================================
-# Masked Source Tests (Critical Bug Fix)
-# ============================================================================
-
-
-def test_masked_source_returns_empty_dag(line_graph_3, algs, to_handle):
-    """
-    CRITICAL BUG FIX TEST: When source is masked out, SPF must return empty DAG
-    and leave all distances at infinity.
-
-    This tests the fix for the bug where a masked source was still enqueued
-    in the priority queue, allowing exploration from a forbidden node.
-    """
-    g = line_graph_3
-
-    # Mask out source node 0
-    node_mask = np.array([False, True, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, node_mask=node_mask)
-
-    # All distances should remain at infinity
-    assert np.isinf(dist[0]), "Source distance should be infinity when masked"
-    assert np.isinf(dist[1]), "All nodes should be unreachable when source is masked"
-    assert np.isinf(dist[2]), "All nodes should be unreachable when source is masked"
-
-    # DAG should be completely empty
-    offsets = np.asarray(dag.parent_offsets)
-    parents = np.asarray(dag.parents)
-    via_edges = np.asarray(dag.via_edges)
-
-    assert len(offsets) == g.num_nodes() + 1
-    assert np.all(offsets == 0), "All offsets should be zero for empty DAG"
-    assert len(parents) == 0, "Parents array should be empty when source is masked"
-    assert len(via_edges) == 0, "Via edges array should be empty when source is masked"
-
-
-def test_masked_source_with_destination(line_graph_3, algs, to_handle):
-    """Test masked source with explicit destination."""
-    g = line_graph_3
-
-    # Mask out source
-    node_mask = np.array([False, True, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-    )
-
-    dist, dag = algs.spf(to_handle(g), 0, dst=2, selection=sel, node_mask=node_mask)
-
-    # Destination should be unreachable
-    assert np.isinf(dist[2]), "Destination unreachable when source is masked"
-
-    # DAG should be empty
-    offsets = np.asarray(dag.parent_offsets)
-    assert np.all(offsets == 0)
-
-
-def test_masked_source_in_max_flow(line_graph_3, algs, to_handle):
-    """Test that max_flow correctly handles masked source."""
-    g = line_graph_3
-
-    # Mask out source
-    node_mask = np.array([False, True, True], dtype=bool)
-
-    flow_val, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        require_capacity=True,
-        with_edge_flows=True,
-        node_mask=node_mask,
-    )
-
-    # No flow should be possible
-    assert np.isclose(flow_val, 0.0), "No flow possible when source is masked"
-
-    # Edge flows array should be empty or all zeros
-    if len(summary.edge_flows) > 0:
-        assert np.all(np.isclose(summary.edge_flows, 0.0))
-
-
-def test_masked_source_in_ksp(line_graph_3, algs, to_handle):
-    """Test that k_shortest_paths correctly handles masked source."""
-    g = line_graph_3
-
-    # Mask out source
-    node_mask = np.array([False, True, True], dtype=bool)
-
-    results = algs.ksp(to_handle(g), 0, 2, k=2, unique=True, node_mask=node_mask)
-
-    # Should find no paths
-    assert len(results) == 0, "No paths should be found when source is masked"
-
-
-def test_masked_source_flow_state_compute_min_cut(triangle_graph, algs):
-    """Test FlowState.compute_min_cut with masked source."""
-    g = triangle_graph
-    fs = ngc.FlowState(g)
-
-    # Mask out source
-    node_mask = np.array([False, True, True], dtype=bool)
-
-    mincut = fs.compute_min_cut(0, node_mask=node_mask)
-
-    # Min cut should be empty when source is masked
-    assert len(mincut.edges) == 0, "Min cut should be empty when source is masked"
-
-
-# ============================================================================
-# Masked Destination Tests
-# ============================================================================
-
-
-def test_masked_destination_unreachable(line_graph_3, algs, to_handle):
-    """Test that masked destination is correctly marked unreachable."""
-    g = line_graph_3
-
-    # Mask out destination node 2
-    node_mask = np.array([True, True, False], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, node_mask=node_mask)
-
-    # Source and node 1 should be reachable
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[1], 1.0)
-
-    # Destination should be unreachable
-    assert np.isinf(dist[2]), "Masked destination should be unreachable"
-
-    # Node 2 should have no predecessors
-    offsets = np.asarray(dag.parent_offsets)
-    assert offsets[2] == offsets[3], "Masked node should have no predecessors"
-
-
-def test_masked_intermediate_node(line_graph_3, algs, to_handle):
-    """Test that masking intermediate node blocks path."""
-    g = line_graph_3
-
-    # Mask out intermediate node 1
-    node_mask = np.array([True, False, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, dst=2, selection=sel, node_mask=node_mask)
-
-    # Source reachable
-    assert np.isclose(dist[0], 0.0)
-
-    # Nodes 1 and 2 should be unreachable
-    assert np.isinf(dist[1]), "Masked intermediate node unreachable"
-    assert np.isinf(dist[2]), "Destination unreachable when path is blocked"
-
-
-# ============================================================================
-# Edge Mask Tests
-# ============================================================================
-
-
-def test_masked_edge_blocks_path(line_graph_3, algs, to_handle):
-    """Test that masked edge blocks path traversal."""
-    g = line_graph_3
-
-    # Mask out first edge (0->1)
-    edge_mask = np.array([False, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, edge_mask=edge_mask)
-
-    assert np.isclose(dist[0], 0.0)
-    assert np.isinf(dist[1]), "Node unreachable when edge is masked"
-    assert np.isinf(dist[2]), "Downstream nodes unreachable when edge is masked"
-
-
-def test_masked_edge_selects_alternative_path(parallel_paths_graph, algs, to_handle):
-    """Test that masking one edge allows alternative path."""
-    g = parallel_paths_graph
-
-    # Mask out edge 0->1 (first edge)
-    edge_mask = np.array([False, True, True, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, dst=3, selection=sel, edge_mask=edge_mask)
-
-    # Should still reach destination via alternative path 0->2->3
-    assert np.isclose(dist[0], 0.0)
-    assert np.isinf(dist[1]), "Node 1 unreachable via masked edge"
-    assert np.isclose(dist[2], 1.0), "Node 2 reachable via unmasked path"
-    assert np.isclose(dist[3], 2.0), "Destination reachable via alternative path"
-
-
-def test_multiple_edges_masked(parallel_paths_graph, algs, to_handle):
-    """Test masking multiple edges."""
-    g = parallel_paths_graph
-
-    # Mask out second hop on first path
-    edge_mask = np.array([True, False, True, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, edge_mask=edge_mask)
-
-    # Should reach destination via second path only
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[3], 2.0), "Destination reachable via unmasked path"
-
-
-# ============================================================================
-# Combined Node and Edge Mask Tests
-# ============================================================================
-
-
-def test_combined_node_and_edge_masks(parallel_paths_graph, algs, to_handle):
-    """Test that node and edge masks work together correctly."""
-    g = parallel_paths_graph
-
-    # Mask node 1 and edge 2->3
-    node_mask = np.array([True, False, True, True], dtype=bool)
-    edge_mask = np.array([True, True, True, False], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(
-        to_handle(g), 0, selection=sel, node_mask=node_mask, edge_mask=edge_mask
-    )
-
-    # Source reachable
-    assert np.isclose(dist[0], 0.0)
-
-    # Node 1 masked out
-    assert np.isinf(dist[1])
-
-    # Node 2 reachable but path to 3 blocked by edge mask
-    assert np.isclose(dist[2], 1.0)
-    assert np.isinf(dist[3]), "Destination unreachable due to edge mask"
-
-
-def test_node_mask_overrides_edge_availability(line_graph_3, algs, to_handle):
-    """Test that node mask effectively blocks all edges to/from that node."""
-    g = line_graph_3
-
-    # Mask node 1, but allow all edges
-    node_mask = np.array([True, False, True], dtype=bool)
-    edge_mask = np.array([True, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(
-        to_handle(g), 0, selection=sel, node_mask=node_mask, edge_mask=edge_mask
-    )
-
-    # Node 1 and beyond should be unreachable despite edges being "allowed"
-    assert np.isclose(dist[0], 0.0)
-    assert np.isinf(dist[1]), "Masked node unreachable despite edge mask"
-    assert np.isinf(dist[2]), "Downstream nodes unreachable"
-
-
-# ============================================================================
-# Mask Interaction with Residual Capacity
-# ============================================================================
-
-
-def test_mask_with_residual_capacity(build_graph, algs, to_handle):
-    """Test that masks work correctly with residual capacity filtering."""
-    # Create line graph 0->1->2->3
-    edges = [
-        (0, 1, 1.0, 1, 0),
-        (1, 2, 1.0, 1, 1),
-        (2, 3, 1.0, 1, 2),
-    ]
-    g = build_graph(4, edges)
-
-    # Set residual capacity (zero on edge 1->2)
-    residual = np.array([1.0, 0.0, 1.0], dtype=np.float64)
-
-    # Also mask edge 2->3
-    edge_mask = np.array([True, True, False], dtype=bool)
-
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=True,  # Enable residual filtering
-    )
-
-    dist, dag = algs.spf(
-        to_handle(g), 0, selection=sel, residual=residual, edge_mask=edge_mask
-    )
-
-    # Should reach node 1 but not beyond
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[1], 1.0)
-    assert np.isinf(dist[2]), "Blocked by residual capacity"
-    assert np.isinf(dist[3]), "Blocked by mask"
-
-
-def test_residual_and_node_mask_combined(parallel_paths_graph, algs, to_handle):
-    """Test combination of residual capacity and node mask."""
-    g = parallel_paths_graph
-
-    # Zero capacity on one path
-    residual = np.array([0.0, 1.0, 1.0, 1.0], dtype=np.float64)
-
-    # Mask intermediate node on other path
-    node_mask = np.array([True, True, False, True], dtype=bool)
-
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=True,
-    )
-
-    dist, dag = algs.spf(
-        to_handle(g), 0, dst=3, selection=sel, residual=residual, node_mask=node_mask
-    )
-
-    # Destination should be unreachable (both paths blocked)
-    assert np.isinf(dist[3]), "Both paths blocked"
-
-
-# ============================================================================
-# Max Flow with Masks
-# ============================================================================
-
-
-def test_max_flow_with_node_mask(parallel_paths_graph, algs, to_handle):
-    """Test max_flow with node mask blocking one path."""
-    g = parallel_paths_graph
-
-    # Mask out node 1 (blocks one path)
-    node_mask = np.array([True, False, True, True], dtype=bool)
-
-    flow_val, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        require_capacity=True,
-        with_edge_flows=True,
-        node_mask=node_mask,
-    )
-
-    # Should get flow only through remaining path (0->2->3)
-    assert flow_val > 0.0, "Some flow possible through unmasked path"
-    assert flow_val <= 1.0, "Only one path available"
-
-    # Verify path 0->1->3 is blocked (node 1 masked) and flow uses 0->2->3
-    # Due to multipath SPF, we need to check actual flow distribution
-    # The important thing is flow_val > 0 which proves masking doesn't block everything
-
-
-def test_max_flow_with_edge_mask(triangle_graph, algs, to_handle):
-    """Test max_flow with edge mask."""
-    g = triangle_graph
-
-    # Find and mask direct edge 0->2
-    edge_src = g.edge_src_view()
-    edge_dst = g.edge_dst_view()
-    edge_mask = np.ones(g.num_edges(), dtype=bool)
-
-    for e in range(g.num_edges()):
-        if edge_src[e] == 0 and edge_dst[e] == 2:
-            edge_mask[e] = False
-
-    flow_val, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        require_capacity=True,
-        with_edge_flows=True,
-        edge_mask=edge_mask,
-    )
-
-    # Should get flow only through indirect path 0->1->2
-    assert flow_val > 0.0, "Flow possible through indirect path"
-    assert flow_val <= 1.0, "Limited by bottleneck"
-
-    # Verify masked edge has no flow
-    for e in range(g.num_edges()):
-        if edge_src[e] == 0 and edge_dst[e] == 2:
-            assert np.isclose(summary.edge_flows[e], 0.0), (
-                "Masked edge should have zero flow"
-            )
-
-
-def test_max_flow_all_paths_masked(line_graph_3, algs, to_handle):
-    """Test max_flow when all paths are masked."""
-    g = line_graph_3
-
-    # Mask intermediate node to block all paths
-    node_mask = np.array([True, False, True], dtype=bool)
-
-    flow_val, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        require_capacity=True,
-        with_edge_flows=True,
-        node_mask=node_mask,
-    )
-
-    # No flow should be possible
-    assert np.isclose(flow_val, 0.0), "No flow possible when all paths masked"
-
-    # All edge flows should be zero
-    assert np.all(np.isclose(summary.edge_flows, 0.0))
-
-
-# ============================================================================
-# K-Shortest Paths with Masks
-# ============================================================================
-
-
-def test_ksp_with_node_mask(build_graph, algs, to_handle):
-    """Test k_shortest_paths with node mask."""
-    # Create graph with two paths
-    edges = [
-        (0, 1, 1.0, 1, 0),
-        (1, 2, 1.0, 1, 1),
-        (0, 3, 1.0, 1, 2),
-        (3, 2, 1.0, 1, 3),
-    ]
-    g = build_graph(4, edges)
-
-    # Mask out node 1 (blocks one path)
-    node_mask = np.array([True, False, True, True], dtype=bool)
-
-    results = algs.ksp(to_handle(g), 0, 2, k=2, unique=True, node_mask=node_mask)
-
-    # Should find at most 1 path (through node 3)
-    assert len(results) <= 1, "Only one path available with mask"
-
-    if len(results) > 0:
-        dist, dag = results[0]
-        # Destination should be reachable via alternate path
-        assert dist[2] > 0.0
-        assert not np.isinf(dist[2])
-
-
-def test_ksp_with_edge_mask(build_graph, algs, to_handle):
-    """Test k_shortest_paths with edge mask."""
-    # Create graph with two paths
-    edges = [
-        (0, 1, 1.0, 1, 0),
-        (1, 2, 1.0, 1, 1),
-        (0, 3, 1.0, 2, 2),
-        (3, 2, 1.0, 2, 3),
-    ]
-    g = build_graph(4, edges)
-
-    # Mask out first edge
-    edge_mask = np.array([False, True, True, True], dtype=bool)
-
-    results = algs.ksp(to_handle(g), 0, 2, k=2, unique=True, edge_mask=edge_mask)
-
-    # Should find path through node 3 only
-    assert len(results) >= 1, "Should find at least one path"
-
-    if len(results) > 0:
-        dist, dag = results[0]
-        # Cost should be 2.0 (path 0->3->2 with cost 1+1=2)
-        assert np.isclose(dist[2], 2.0), (
-            "Should use alternative path when shorter is masked"
-        )
-
-
-# ============================================================================
-# Empty Mask Tests
-# ============================================================================
-
-
-def test_empty_node_mask_allows_all(line_graph_3, algs, to_handle):
-    """Test that empty mask means no masking (all nodes allowed)."""
-    g = line_graph_3
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    # No mask provided
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel)
-
-    # All nodes should be reachable
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[1], 1.0)
-    assert np.isclose(dist[2], 2.0)
-
-
-def test_empty_edge_mask_allows_all(line_graph_3, algs, to_handle):
-    """Test that empty edge mask means no masking (all edges allowed)."""
-    g = line_graph_3
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    # No edge mask provided
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel)
-
-    # All nodes should be reachable
-    for i in range(g.num_nodes()):
-        assert not np.isinf(dist[i]), f"Node {i} should be reachable"
-
-
-# ============================================================================
-# All-False Mask Tests
-# ============================================================================
-
-
-def test_all_nodes_masked_no_reachability(line_graph_3, algs, to_handle):
-    """Test that masking all nodes makes everything unreachable."""
-    g = line_graph_3
-
-    # Mask all nodes
-    node_mask = np.array([False, False, False], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, node_mask=node_mask)
-
-    # All nodes unreachable (including source)
-    for i in range(g.num_nodes()):
-        assert np.isinf(dist[i]), f"Node {i} should be unreachable"
-
-    # DAG should be empty
-    offsets = np.asarray(dag.parent_offsets)
-    assert np.all(offsets == 0), "DAG should be empty"
-
-
-def test_all_edges_masked_only_source_reachable(line_graph_3, algs, to_handle):
-    """Test that masking all edges makes only source reachable."""
-    g = line_graph_3
-
-    # Mask all edges
-    edge_mask = np.array([False, False], dtype=bool)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    dist, dag = algs.spf(to_handle(g), 0, selection=sel, edge_mask=edge_mask)
-
-    # Only source should be reachable
-    assert np.isclose(dist[0], 0.0), "Source should be reachable"
-
-    # All other nodes unreachable
-    for i in range(1, g.num_nodes()):
-        assert np.isinf(dist[i]), f"Node {i} should be unreachable"
-
-
-# ============================================================================
-# Mask Validation Tests
-# ============================================================================
-
-
-def test_invalid_node_mask_length_raises_error(line_graph_3, algs, to_handle):
-    """Test that incorrect mask length raises an error."""
-    g = line_graph_3
-
-    # Wrong length mask
-    node_mask = np.array([True, True], dtype=bool)  # Should be length 3
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    with pytest.raises(TypeError, match="node_mask"):
-        algs.spf(to_handle(g), 0, selection=sel, node_mask=node_mask)
-
-
-def test_invalid_edge_mask_length_raises_error(line_graph_3, algs, to_handle):
-    """Test that incorrect edge mask length raises an error."""
-    g = line_graph_3
-
-    # Wrong length mask
-    edge_mask = np.array([True], dtype=bool)  # Should be length 2
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    with pytest.raises(TypeError, match="edge_mask"):
-        algs.spf(to_handle(g), 0, selection=sel, edge_mask=edge_mask)
-
-
-def test_non_bool_mask_raises_error(line_graph_3, algs, to_handle):
-    """Test that non-boolean mask raises an error."""
-    g = line_graph_3
-
-    # Integer mask instead of bool
-    node_mask = np.array([1, 1, 1], dtype=np.int32)
-
-    sel = ngc.EdgeSelection(multi_edge=True, require_capacity=False)
-
-    with pytest.raises(TypeError, match="bool"):
-        algs.spf(to_handle(g), 0, selection=sel, node_mask=node_mask)
diff --git a/tests/py/test_max_flow.py b/tests/py/test_max_flow.py
deleted file mode 100644
index 645730a..0000000
--- a/tests/py/test_max_flow.py
+++ /dev/null
@@ -1,310 +0,0 @@
-"""Max-flow end-to-end: placement modes, augmentation depth, and min-cut."""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, cap, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, cap, cost, ext_edge_ids
-    )
-
-
-def test_max_flow_square1_proportional_with_edge_flows(
-    square1_graph,
-    flows_by_eid,
-    assert_edge_flows_shape,
-    assert_valid_min_cut,
-    algs,
-    to_handle,
-):
-    g = square1_graph
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Multi-tier: cost 2 path carries 1, then cost 4 path carries 2 => total 3
-    assert np.isclose(total, 3.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    assert_valid_min_cut(g, summary.min_cut, total)
-    fb = flows_by_eid(g, summary.edge_flows)
-    # Check totals on 4 edges in this small graph (order is deterministic by compaction)
-    assert len(fb) == g.num_edges()
-    # Edge flows are per-edge amounts; summing across all edges counts each unit once per edge
-    # along its path. For two-edge paths with total 3, the sum is 2 * 3 = 6.
-    assert np.isclose(np.asarray(summary.edge_flows).sum(), 6.0)
-    # Cost distribution checks live in test_max_flow_cost_distribution.py
-
-
-def test_square1_equal_balanced_min_cut_and_distribution(
-    square1_graph, assert_edge_flows_shape, assert_valid_min_cut, algs, to_handle
-):
-    g = square1_graph
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Total flow should be 3 (1 along A->B->C and 2 along A->D->C)
-    assert np.isclose(total, 3.0)
-    # Min-cut may be edges out of A or into C; accept either set
-    # Min-cut returns EdgeIds; ensure it has size 2 and corresponds to cut around source or sink
-    mc = set(map(int, summary.min_cut.edges))
-    assert len(mc) == 2
-    # EQUAL_BALANCED places less than the maximum, so duality does not apply.
-    assert_valid_min_cut(g, summary.min_cut)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    # Cost distribution checks live in test_max_flow_cost_distribution.py
-
-
-def test_max_flow_line1_proportional_full_and_shortest(line1_graph, algs, to_handle):
-    g = line1_graph
-    total_full, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    total_sp, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total_full, 5.0)
-    assert np.isclose(total_sp, 4.0)
-
-
-def test_max_flow_graph5_proportional_full_and_shortest(
-    make_fully_connected_graph, algs, to_handle
-):
-    # Fully connected graph with 5 nodes (A..E), capacity 1 per edge
-    # Build: nodes 0..4 fully connected excluding self
-    g = make_fully_connected_graph(5, cost=1.0, cap=1.0)
-    total_full, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    total_sp, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total_full, 4.0)
-    assert np.isclose(total_sp, 1.0)
-
-
-def test_max_flow_square1_shortest_path_single_augmentation(
-    square1_graph,
-    flows_by_eid,
-    assert_edge_flows_shape,
-    assert_valid_min_cut,
-    algs,
-    to_handle,
-):
-    g = square1_graph
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-        with_edge_flows=True,
-    )
-    assert np.isclose(total, 1.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    # shortest_path=True is a single augmentation, not a maximum flow.
-    assert_valid_min_cut(g, summary.min_cut)
-    fb = flows_by_eid(g, summary.edge_flows)
-    # Should augment along A->B->C only once
-    assert np.isclose(fb[0], 1.0)
-    assert np.isclose(fb[1], 1.0)
-    assert np.isclose(fb[2], 0.0)
-    assert np.isclose(fb[3], 0.0)
-
-
-def test_max_flow_line1_equal_balanced(
-    line1_graph,
-    flows_by_eid,
-    assert_edge_flows_shape,
-    assert_valid_min_cut,
-    algs,
-    to_handle,
-):
-    g = line1_graph
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Equal-balanced across tiers: limited by A->B capacity => total 5
-    assert np.isclose(total, 5.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    # EQUAL_BALANCED places less than the maximum, so duality does not apply.
-    assert_valid_min_cut(g, summary.min_cut)
-    fb = flows_by_eid(g, summary.edge_flows)
-    # Expect 2 across min-cost tier (1 + 1), then remaining 3 on min/higher edges by successive tiers
-    assert np.isclose(fb[0], 5.0)  # A->B carries all
-    # Edges are compacted deterministically; verify flows on B->C parallels
-    assert np.isclose(fb[1], 1.0)
-    assert np.isclose(fb[2], 3.0)
-    assert np.isclose(fb[3], 1.0)
-
-
-def test_max_flow_ecmp3_equal_balanced(algs, to_handle):
-    # 0->{1,2,3}->{4}, all caps=5, equal costs
-    src = np.array([0, 0, 0, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4, 4], dtype=np.int32)
-    cap = np.array([5.0, 5.0, 5.0, 5.0, 5.0, 5.0], dtype=np.float64)
-    cost = np.array([1, 1, 1, 1, 1, 1], dtype=np.int64)
-    g = _make_graph(5, src, dst, cap, cost)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        4,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Total is limited by downstream 3*5 = 15
-    assert np.isclose(total, 15.0)
-    fb = np.asarray(summary.edge_flows)
-    # First hop equalized: three edges out of 0 carry 5 each
-    assert np.allclose(fb[:3], [5.0, 5.0, 5.0])
-    # Second hop equalized: three edges into 4 carry 5 each
-    assert np.allclose(fb[3:], [5.0, 5.0, 5.0])
-
-
-def test_max_flow_downstream_equal_balanced(algs, to_handle):
-    # Downstream split: 0->1 (10), then 1->{2,3}(5 each), then to 4 (5 each)
-    src = np.array([0, 1, 1, 2, 3], dtype=np.int32)
-    dst = np.array([1, 2, 3, 4, 4], dtype=np.int32)
-    cap = np.array([10.0, 5.0, 5.0, 5.0, 5.0], dtype=np.float64)
-    cost = np.array([1, 1, 1, 1, 1], dtype=np.int64)
-    g = _make_graph(5, src, dst, cap, cost)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        4,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    assert np.isclose(total, 10.0)
-    fb = np.asarray(summary.edge_flows)
-    # First hop carries all 10
-    assert np.isclose(fb[0], 10.0)
-    # Downstream equal split 5/5
-    assert np.isclose(fb[1], 5.0)
-    assert np.isclose(fb[2], 5.0)
-    assert np.isclose(fb[3], 5.0)
-    assert np.isclose(fb[4], 5.0)
-
-
-def test_max_flow_graph3_proportional_parallel_distribution(
-    graph3, flows_by_eid, assert_edge_flows_shape, assert_valid_min_cut, algs, to_handle
-):
-    # A=0, B=1, C=2, D=3, E=4, F=5
-    g = graph3
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Incoming to C via min-cost parents: from B (cap 1+2+3=6) and from E (cap 4) => total 10
-    assert np.isclose(total, 10.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    assert_valid_min_cut(g, summary.min_cut, total)
-    fb = flows_by_eid(g, summary.edge_flows)
-    # B->C parallels proportional to capacity: 1:2:3 over total 6 => 1,2,3
-    assert np.isclose(fb[4], 1.0)
-    assert np.isclose(fb[5], 2.0)
-    assert np.isclose(fb[6], 3.0)
-    # E->C should carry 4
-    assert np.isclose(fb[8], 4.0)
-    # A->B proportional to carry 6 (total to B): 2:4:6 over sum 12 => 1,2,3
-    assert np.isclose(fb[0], 1.0)
-    assert np.isclose(fb[1], 2.0)
-    assert np.isclose(fb[2], 3.0)
-    # A->E carries 4
-    assert np.isclose(fb[3], 4.0)
-
-
-def test_max_flow_two_disjoint_shortest_routes_proportional(
-    two_disjoint_shortest_graph,
-    flows_by_eid,
-    assert_edge_flows_shape,
-    assert_valid_min_cut,
-    algs,
-    to_handle,
-):
-    # S=0, A=1, B=2, T=3
-    # Two disjoint shortest paths S->A->T and S->B->T with equal total cost
-    g = two_disjoint_shortest_graph
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    # Bottlenecks along S->A->T = min(3,2)=2 and S->B->T = min(4,1)=1 => total 3
-    assert np.isclose(total, 3.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    assert_valid_min_cut(g, summary.min_cut, total)
-    fb = flows_by_eid(g, summary.edge_flows)
-    assert np.isclose(fb[0], 2.0)  # S->A
-    assert np.isclose(fb[2], 2.0)  # A->T
-    assert np.isclose(fb[1], 1.0)  # S->B
-    assert np.isclose(fb[3], 1.0)  # B->T
-    # Cost distribution checks live in test_max_flow_cost_distribution.py
-
-
-def test_max_flow_square4_full_and_shortest_proportional(
-    square4_graph, algs, to_handle
-):
-    g = square4_graph
-    total_full, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-    )
-    total_sp, _ = algs.max_flow(
-        to_handle(g),
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-    )
-    assert np.isclose(total_full, 350.0)
-    assert np.isclose(total_sp, 100.0)
diff --git a/tests/py/test_max_flow_cost_distribution.py b/tests/py/test_max_flow_cost_distribution.py
deleted file mode 100644
index 8a7f135..0000000
--- a/tests/py/test_max_flow_cost_distribution.py
+++ /dev/null
@@ -1,166 +0,0 @@
-"""Max-flow cost distribution analytics across scenarios."""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def test_cost_distribution_multiple_paths(build_graph, cost_dist_dict, algs, to_handle):
-    # S=0, A=1, B=2, T=3
-    # Path1: S->A->T cost=2, cap=5; Path2: S->B->T cost=4, cap=3
-    edges = [
-        (0, 1, 1, 5, 0),
-        (1, 3, 1, 5, 1),
-        (0, 2, 2, 3, 2),
-        (2, 3, 2, 3, 3),
-    ]
-    g = build_graph(4, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 8.0)
-    d = cost_dist_dict(summary)
-    assert np.isclose(d[2.0], 5.0)
-    assert np.isclose(d[4.0], 3.0)
-
-
-def test_cost_distribution_single_path(build_graph, cost_dist_dict, algs, to_handle):
-    # A=0, B=1, C=2; cost=3+2=5; cap=10
-    edges = [
-        (0, 1, 3, 10, 0),
-        (1, 2, 2, 10, 1),
-    ]
-    g = build_graph(3, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 10.0)
-    d = cost_dist_dict(summary)
-    assert np.isclose(d[5.0], 10.0)
-
-
-def test_cost_distribution_equal_cost_paths(
-    build_graph, cost_dist_dict, algs, to_handle
-):
-    # S=0, A=1, B=2, T=3; two paths both cost=2, caps 4 and 6
-    edges = [
-        (0, 1, 1, 4, 0),
-        (1, 3, 1, 4, 1),
-        (0, 2, 1, 6, 2),
-        (2, 3, 1, 6, 3),
-    ]
-    g = build_graph(4, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 10.0)
-    d = cost_dist_dict(summary)
-    assert np.isclose(d[2.0], 10.0)
-
-
-def test_cost_distribution_three_tiers(build_graph, cost_dist_dict, algs, to_handle):
-    # S=0, A=1, B=2, C=3, T=4
-    # Tier1: cost=1 cap=2 (0->1 cost1, 1->4 cost0)
-    # Tier2: cost=3 cap=4 (0->2 cost2, 2->4 cost1)
-    # Tier3: cost=6 cap=3 (0->3 cost3, 3->4 cost3)
-    edges = [
-        (0, 1, 1, 2, 0),
-        (1, 4, 0, 2, 1),
-        (0, 2, 2, 4, 2),
-        (2, 4, 1, 4, 3),
-        (0, 3, 3, 3, 4),
-        (3, 4, 3, 3, 5),
-    ]
-    g = build_graph(5, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        4,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 9.0)
-    d = cost_dist_dict(summary)
-    assert np.isclose(d[1.0], 2.0)
-    assert np.isclose(d[3.0], 4.0)
-    assert np.isclose(d[6.0], 3.0)
-
-
-def test_cost_distribution_no_flow(build_graph, cost_dist_dict, algs, to_handle):
-    g = build_graph(2, [])  # No edges
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        1,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 0.0)
-    assert np.asarray(summary.costs).size == 0 and np.asarray(summary.flows).size == 0
-
-
-def test_cost_distribution_shortest_path_mode(
-    build_graph, cost_dist_dict, algs, to_handle
-):
-    # Two paths: cost=2 cap=5; cost=4 cap=3; shortest_path=True -> only first tier
-    edges = [
-        (0, 1, 1, 5, 0),
-        (1, 3, 1, 5, 1),
-        (0, 2, 2, 3, 2),
-        (2, 3, 2, 3, 3),
-    ]
-    g = build_graph(4, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=True,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 5.0)
-    d = cost_dist_dict(summary)
-    assert len(d) == 1
-    assert np.isclose(d[2.0], 5.0)
-
-
-def test_cost_distribution_capacity_bottleneck(
-    build_graph, cost_dist_dict, algs, to_handle
-):
-    # Cheap path bottlenecked at 2 (cost 1); expensive path cost 3 cap 5
-    edges = [
-        (0, 1, 1, 10, 0),
-        (1, 3, 0, 2, 1),  # bottleneck at 2
-        (0, 2, 2, 5, 2),
-        (2, 3, 1, 5, 3),
-    ]
-    g = build_graph(4, edges)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 7.0)
-    d = cost_dist_dict(summary)
-    assert np.isclose(d[1.0], 2.0)
-    assert np.isclose(d[3.0], 5.0)
diff --git a/tests/py/test_max_flow_summary.py b/tests/py/test_max_flow_summary.py
deleted file mode 100644
index 609b3e3..0000000
--- a/tests/py/test_max_flow_summary.py
+++ /dev/null
@@ -1,53 +0,0 @@
-"""Max-flow FlowSummary semantics: shapes and MinCut validity."""
-
-from __future__ import annotations
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def _two_path_graph(build_graph):
-    # S=0, A=1, B=2, T=3
-    # Path1 cost=2 cap=5; Path2 cost=4 cap=3
-    edges = [
-        (0, 1, 1, 5, 0),
-        (1, 3, 1, 5, 1),
-        (0, 2, 2, 3, 2),
-        (2, 3, 2, 3, 3),
-    ]
-    return build_graph(4, edges)
-
-
-def test_flow_summary_shapes_and_min_cut_valid(
-    build_graph, assert_edge_flows_shape, assert_valid_min_cut, algs, to_handle
-):
-    g = _two_path_graph(build_graph)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=True,
-    )
-    assert np.isclose(total, 8.0)
-    assert_edge_flows_shape(g, summary, expected_present=True)
-    assert_valid_min_cut(g, summary.min_cut, total)
-    # Cost distribution checked in test_max_flow_cost_distribution.py
-
-
-def test_flow_summary_without_edge_flows(
-    build_graph, assert_edge_flows_shape, algs, to_handle
-):
-    g = _two_path_graph(build_graph)
-    total, summary = algs.max_flow(
-        to_handle(g),
-        0,
-        3,
-        flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-        shortest_path=False,
-        with_edge_flows=False,
-    )
-    assert np.isclose(total, 8.0)
-    assert_edge_flows_shape(g, summary, expected_present=False)
diff --git a/tests/py/test_maxflow_certificate.py b/tests/py/test_maxflow_certificate.py
deleted file mode 100644
index da58792..0000000
--- a/tests/py/test_maxflow_certificate.py
+++ /dev/null
@@ -1,197 +0,0 @@
-"""Oracle-free correctness certificates for max-flow.
-
-The suite historically checked max-flow results against hand-computed values on a
-handful of fixed topologies. That misses defects whose trigger is a graph nobody
-thought to write down -- the 0.7.2 under-reporting bug (fixed in 0.8.0) was not
-exposed by any fixture in the suite, at any src/dst pair.
-
-These tests take the opposite approach: generate graphs in the region where such
-defects live (dispersed edge costs, full-duplex links) and check a *certificate of
-optimality* rather than a recorded number. See the ``certify_max_flow`` fixture for
-the four properties; together they prove maximality, so no external oracle and no
-stored expected value is required.
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-# A fixed seed keeps these deterministic, so a given defect is either caught on every
-# run or never -- which means the corpus has to be shown to have teeth, not assumed to.
-# This seed was picked because its corpus trips the 0.7.2 under-reporting bug within the
-# first few graphs; both sweeps below were confirmed to fail against 0.7.2 and pass
-# against 0.8.0. An arbitrary seed needed ~5750 graphs to hit the same defect, so this
-# is purely a cheaper corpus, not a narrower one.
-SEED = 198
-QUICK_GRAPHS = 2000
-THOROUGH_GRAPHS = 20000
-
-
-def _random_graph(rng: np.random.Generator) -> tuple[ngc.StrictMultiDiGraph, int, int]:
-    """Build a random full-duplex graph with dispersed costs.
-
-    Cost dispersion is the essential ingredient: with a single cost tier there is
-    nothing for shortest-path tier ordering to get wrong, and randomized checks over
-    equal-cost graphs find nothing.
-    """
-    n = int(rng.integers(4, 9))
-    m = int(rng.integers(n, 2 * n))
-    links = []
-    for _ in range(m):
-        u, v = rng.choice(n, 2, replace=False)
-        cap = float(rng.integers(1, 6))
-        cost = int(rng.integers(1, 21))
-        links.append((int(u), int(v), cap, cost))
-
-    edges = [e for u, v, c, k in links for e in ((u, v, c, k), (v, u, c, k))]
-    src = np.array([e[0] for e in edges], dtype=np.int32)
-    dst = np.array([e[1] for e in edges], dtype=np.int32)
-    cap = np.array([e[2] for e in edges], dtype=np.float64)
-    cost = np.array([e[3] for e in edges], dtype=np.int64)
-    g = ngc.StrictMultiDiGraph.from_arrays(
-        n, src, dst, cap, cost, np.arange(len(edges), dtype=np.int64)
-    )
-    return g, 0, n - 1
-
-
-def _sweep(count: int, algs, certify_max_flow) -> None:
-    rng = np.random.default_rng(SEED)
-    for i in range(count):
-        g, s, t = _random_graph(rng)
-        total, summary = algs.max_flow(algs.build_graph(g), s, t, with_edge_flows=True)
-        try:
-            certify_max_flow(g, summary, total, s, t)
-        except AssertionError as exc:  # pragma: no cover - only on a real defect
-            pytest.fail(f"certificate failed on random graph #{i} (seed {SEED}): {exc}")
-
-
-def test_random_graphs_certify(algs, certify_max_flow):
-    """Every generated max-flow result must carry a valid optimality certificate."""
-    _sweep(QUICK_GRAPHS, algs, certify_max_flow)
-
-
-@pytest.mark.slow
-def test_random_graphs_certify_thorough(algs, certify_max_flow):
-    """Wider sweep of the same generator."""
-    _sweep(THOROUGH_GRAPHS, algs, certify_max_flow)
-
-
-FIXTURES = [
-    "line1_graph",
-    "square1_graph",
-    "square2_graph",
-    "graph3",
-    "square4_graph",
-    "triangle1_graph",
-]
-
-
-@pytest.mark.parametrize("fixture_name", FIXTURES)
-def test_named_fixtures_certify_all_pairs(
-    fixture_name, request, algs, certify_max_flow
-):
-    """Certify the shared fixtures for every src/dst pair, not just the tested one.
-
-    A fixture is usually queried for a single pair; the remaining pairs are free
-    coverage of the same topology.
-    """
-    g = request.getfixturevalue(fixture_name)
-    handle = algs.build_graph(g)
-    n = g.num_nodes()
-    for s in range(n):
-        for t in range(n):
-            if s == t:
-                continue
-            total, summary = algs.max_flow(handle, s, t, with_edge_flows=True)
-            certify_max_flow(g, summary, total, s, t)
-
-
-def test_certificate_rejects_a_non_maximal_flow(square1_graph, algs, certify_max_flow):
-    """The certificate must have teeth.
-
-    ``shortest_path=True`` performs a single augmentation and is deliberately not
-    maximal, so it is a genuine non-maximal result reachable through the public API.
-    Certifying it as maximal must fail. Without this guard the certificate could
-    silently degrade into an assertion that cannot fail -- which is exactly how the
-    previous ``assert_valid_min_cut`` helper missed the 0.7.2 bug.
-    """
-    g = square1_graph
-    total, summary = algs.max_flow(
-        algs.build_graph(g), 0, 2, shortest_path=True, with_edge_flows=True
-    )
-    assert total == pytest.approx(1.0)
-
-    # Feasibility and conservation still hold for a partial placement.
-    certify_max_flow(g, summary, total, 0, 2, maximal=False)
-
-    with pytest.raises(AssertionError):
-        certify_max_flow(g, summary, total, 0, 2, maximal=True)
-
-
-def test_equal_balanced_is_feasible_but_not_certified_maximal(
-    line1_graph, algs, certify_max_flow
-):
-    """EQUAL_BALANCED is an admission model, so only feasibility/conservation apply."""
-    g = line1_graph
-    total, summary = algs.max_flow(
-        algs.build_graph(g),
-        0,
-        2,
-        flow_placement=ngc.FlowPlacement.EQUAL_BALANCED,
-        with_edge_flows=True,
-    )
-    certify_max_flow(g, summary, total, 0, 2, maximal=False)
-
-
-def test_masked_runs_certify(algs, certify_max_flow):
-    """Masking must not break the certificate, and must not leak flow onto masked edges.
-
-    Masks are a good place for a future defect of this kind to hide: no external
-    solver models them, so an oracle-based test cannot reach them at all.
-
-    Node and edge masks are checked separately and together, because they are
-    separate branches in ``calc_max_flow`` -- including inside the residual
-    completion phase added in 0.8.0, whose forward and reverse arc loops each
-    consult ``edge_mask`` independently. A node-mask-only sweep leaves those
-    branches, and the certificate's own ``edge_mask`` handling, unexercised.
-    """
-    rng = np.random.default_rng(SEED + 1)
-    saw_masked_node = False
-    saw_masked_edge = False
-
-    for i in range(300):
-        g, s, t = _random_graph(rng)
-        n = g.num_nodes()
-
-        node_mask = None
-        edge_mask = None
-        mode = i % 3  # 0: nodes only, 1: edges only, 2: both
-        if mode in (0, 2):
-            node_mask = np.ones(n, dtype=bool)
-            victim = int(rng.integers(0, n))
-            if victim not in (s, t):
-                node_mask[victim] = False
-                saw_masked_node = True
-        if mode in (1, 2):
-            edge_mask = rng.random(g.num_edges()) > 0.25
-            if not edge_mask.all():
-                saw_masked_edge = True
-
-        total, summary = algs.max_flow(
-            algs.build_graph(g),
-            s,
-            t,
-            node_mask=node_mask,
-            edge_mask=edge_mask,
-            with_edge_flows=True,
-        )
-        certify_max_flow(
-            g, summary, total, s, t, node_mask=node_mask, edge_mask=edge_mask
-        )
-
-    # Guard against the sweep silently degrading into an unmasked one.
-    assert saw_masked_node, "node-mask branch was never exercised"
-    assert saw_masked_edge, "edge-mask branch was never exercised"
diff --git a/tests/py/test_min_cost_flow.py b/tests/py/test_min_cost_flow.py
new file mode 100644
index 0000000..8b23e08
--- /dev/null
+++ b/tests/py/test_min_cost_flow.py
@@ -0,0 +1,780 @@
+"""The private flow-core entry `_netgraph_core._solve_min_cost_flow`: the payload
+schema, the hand-derived witnesses, input validation and randomized certificates."""
+
+from __future__ import annotations
+
+import random
+
+import _netgraph_core as core
+import numpy as np
+import pytest
+from flow_oracle import (
+    NEVER_REACHED,
+    certify,
+    exhaustive,
+    independent_curve,
+    points_value,
+)
+from helpers import CHAIN, build, by_input, exact, ids, to_ids
+
+COUNTERS = {
+    "dijkstra_runs",
+    "dijkstra_pops",
+    "settled",
+    "arc_scans",
+    "dinic_phases",
+    "augmentations",
+}
+
+
+def allowed(eligibility):
+    """The certificate's masks of an Eligibility (None: everything allowed)."""
+    if eligibility is None:
+        return None, None
+    return eligibility.node_allowed(), eligibility.edge_allowed()
+
+
+def solve(g, sources, dests, cap, view=None, eligibility=None):
+    view = g.edge_capacity_units().tolist() if view is None else view
+    return core._solve_min_cost_flow(g, view, sources, dests, eligibility, cap)
+
+
+def test_payload_schema():
+    g = build(4, CHAIN)
+    p = solve(g, [0], [3], None)
+    assert set(p) == {
+        "flow_value",
+        "marginal_cost_curve",
+        "edge_flows",
+        "min_cut",
+        "potentials",
+        "counters",
+    }
+    assert type(p["flow_value"]) is int
+    assert all(type(c) is int and type(u) is int for c, u in p["marginal_cost_curve"])
+    assert isinstance(p["edge_flows"], list) and all(
+        type(x) is int for x in p["edge_flows"]
+    )
+    assert isinstance(p["min_cut"], list) and all(type(x) is int for x in p["min_cut"])
+    assert all(type(x) is int for x in p["potentials"])
+    assert set(p["counters"]) == COUNTERS and all(
+        type(x) is int for x in p["counters"].values()
+    )
+    assert p == solve(
+        g, [0], [3], None
+    )  # identical calls, identical payloads (counters included)
+
+
+def test_chain_plus_bypasses():
+    g = build(4, CHAIN)
+    one = solve(g, [0], [3], 1)
+    assert one["flow_value"] == 1 and one["marginal_cost_curve"] == [[3, 1]]
+    assert by_input(g, one["edge_flows"]) == [1, 1, 1, 0, 0]
+    assert one["min_cut"] is None
+    two = solve(g, [0], [3], 2)
+    assert two["marginal_cost_curve"] == [[3, 1], [5, 1]]
+    assert by_input(g, two["edge_flows"]) == [1, 0, 1, 1, 1]
+    assert sorted(int(g.input_positions()[e]) for e in two["min_cut"]) == [0, 3]
+    assert two["potentials"] == [0, 2, 3, 5]
+    inf = solve(g, [0], [3], None)
+    assert (
+        inf["edge_flows"] == two["edge_flows"] and inf["counters"]["dijkstra_runs"] == 3
+    )
+    for cap, p in ((1, one), (2, two), (None, inf)):
+        assert certify(g, g.edge_capacity_units().tolist(), [0], [3], cap, p) == []
+    mask = g.eligibility(excluded_edges=[ids(g, [1])[0]])
+    masked = solve(g, [0], [3], None, eligibility=mask)
+    assert masked["marginal_cost_curve"] == [[4, 2]]
+    view = g.edge_capacity_units().tolist()
+    assert certify(g, view, [0], [3], None, masked, *allowed(mask)) == []
+    # Every cost times a factor: the curve's costs and the potentials scale, the volumes, flows,
+    # cut and operation counters do not.
+    for factor in (2, 7, 1000003):
+        scaled_g = build(4, [(u, v, c, w * factor) for u, v, c, w in CHAIN])
+        scaled = solve(scaled_g, [0], [3], 2)
+        assert scaled["marginal_cost_curve"] == [[3 * factor, 1], [5 * factor, 1]]
+        assert scaled["potentials"] == [0, 2 * factor, 3 * factor, 5 * factor]
+        for key in ("flow_value", "edge_flows", "min_cut", "counters"):
+            assert scaled[key] == two[key], (factor, key)
+        assert (
+            certify(
+                scaled_g, scaled_g.edge_capacity_units().tolist(), [0], [3], 2, scaled
+            )
+            == []
+        )
+
+
+def test_zero_cap_and_positive_cap_on_zero_view():
+    g = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    z = solve(g, [0], [2], 0)
+    assert z == {
+        "flow_value": 0,
+        "marginal_cost_curve": [],
+        "edge_flows": [0, 0],
+        "min_cut": None,
+        "potentials": [NEVER_REACHED] * 3,
+        "counters": dict.fromkeys(COUNTERS, 0),
+    }
+    assert certify(g, [5, 5], [0], [2], 0, z) == []
+    zero_view = to_ids(g, [0, 5])
+    p = solve(g, [0], [2], 4, view=zero_view)
+    # The closure {0} is separated from 2 only by the edge 0 -> 1 of view 0 (id 0): it is the
+    # cut, of value 0.
+    assert (
+        p["flow_value"] == 0 and p["min_cut"] == [0] and p["potentials"] == [0, -1, -1]
+    )
+    assert p["counters"]["dijkstra_runs"] == 1
+    assert certify(g, zero_view, [0], [2], 4, p) == []
+
+
+def test_legal_maximum_and_anycast():
+    big = (1 << 62) - 1
+    g = build(2, [(0, 1, big, 1)])
+    p = solve(g, [0], [1], None)
+    assert (
+        p["flow_value"] == big
+        and p["marginal_cost_curve"] == [[1, big]]
+        and p["min_cut"] == [0]
+    )
+    assert certify(g, [big], [0], [1], None, p) == []
+    a = build(3, [(0, 1, 1, 1), (0, 2, 1, 2)])
+    q = solve(a, [0], [1, 2], None)
+    assert q["flow_value"] == 2 and q["marginal_cost_curve"] == [[1, 1], [2, 1]]
+    assert q["potentials"] == [0, 2, 2]
+    assert certify(a, [1, 1], [0], [1, 2], None, q) == []
+    five = solve(a, np.array([0, 0]), np.array([2, 1, 2]), np.int64(5))
+    assert five == solve(a, [0], [1, 2], 5)
+    assert certify(a, [1, 1], [0], [1, 2], 5, five) == []
+
+
+def test_fresh_solve_uses_the_released_cheap_edge():
+    # Two parallel edges 0 -> 1 (cost 1 with 1 unit, cost 3 with 2 units), then 1 -> 2. A view
+    # in which the cheap edge has its unit back (say, released by an earlier flow) is solved
+    # from scratch: the unit goes over the cheap edge, at cost 2.
+    g = build(3, [(0, 1, 1, 1), (0, 1, 2, 3), (1, 2, 2, 1)])
+    view = to_ids(g, [1, 1, 1])
+    p = solve(g, [0], [2], 1, view=view)
+    assert by_input(g, p["edge_flows"]) == [1, 0, 1]
+    assert p["marginal_cost_curve"] == [[2, 1]]
+    assert certify(g, view, [0], [2], 1, p) == []
+
+
+# A type the position never takes (a float or a bool for an integer, None for the graph) is a
+# TypeError, a value outside the domain a ValueError.
+TYPE_DEFECTS = {
+    "sources node ids[0] must be an integer (got float)",
+    "cap must be an integer number of units in [0, 2^63 - 2] or None",
+    "graph must be a Graph",
+}
+
+
+@pytest.mark.parametrize(
+    "kwargs, message",
+    [
+        ({"sources": []}, "sources: the node set is empty"),
+        ({"destinations": []}, "destinations: the node set is empty"),
+        ({"sources": [3]}, "sources: node 3 out of node range [0, 3)"),
+        (
+            {"sources": [0, 2]},
+            "node 2 is in both endpoint sets: sources and destinations must not overlap",
+        ),
+        ({"sources": [0.0]}, "sources node ids[0] must be an integer (got float)"),
+        ({"cap": -1}, "cap -1 is outside [0, 2^63 - 2]"),
+        ({"cap": 1 << 63}, "cap 9223372036854775808 is outside [0, 2^63 - 2]"),
+        ({"cap": (1 << 63) - 1}, "cap 9223372036854775807 is outside [0, 2^63 - 2]"),
+        (
+            {"cap": 1.0},
+            "cap must be an integer number of units in [0, 2^63 - 2] or None",
+        ),
+        (
+            {"cap": True},
+            "cap must be an integer number of units in [0, 2^63 - 2] or None",
+        ),
+        ({"graph": None}, "graph must be a Graph"),
+    ],
+)
+def test_invalid_inputs(kwargs, message):
+    g = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    call = {
+        "graph": g,
+        "view": [5, 5],
+        "sources": [0],
+        "destinations": [2],
+        "eligibility": None,
+        "cap": 3,
+    }
+    call.update(kwargs)
+    with pytest.raises((TypeError, ValueError), match=exact(message)) as error:
+        core._solve_min_cost_flow(**call)
+    assert error.type is (TypeError if message in TYPE_DEFECTS else ValueError)
+
+
+def test_foreign_eligibility_and_largest_cap():
+    g = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    h = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    with pytest.raises(
+        ValueError, match=exact("foreign Eligibility: built for another graph")
+    ):
+        solve(g, [0], [2], 1, eligibility=h.eligibility())
+    assert solve(g, [0], [2], (1 << 63) - 2)["flow_value"] == 5
+
+
+def kinds_of(sources, dests, view, g, cap, eligibility, excluded_nodes, p):
+    """The kinds of case a certified solve with a positive flow belongs to (none for no
+    flow): several sources or destinations, a view below the capacities, a cap that stopped
+    the solve (no cut) or a maximum flow proved by its cut, an Eligibility, an excluded node."""
+    if p["flow_value"] == 0:
+        return []
+    return [
+        kind
+        for kind, present in (
+            ("positive", True),
+            ("several sources", len(sources) > 1),
+            ("several destinations", len(dests) > 1),
+            ("reduced view", view != g.edge_capacity_units().tolist()),
+            ("stopped by the cap", cap is not None and p["min_cut"] is None),
+            ("maximum with its cut", bool(p["min_cut"])),
+            ("masked", eligibility is not None),
+            ("node masked", bool(excluded_nodes)),
+        )
+        if present
+    ]
+
+
+def test_random_graphs_certified():
+    rng = random.Random(2026)
+    # The kinds of case the draws aim at, each to be certified at least this often (well below
+    # of today's counts: a change of the draws that loses a kind fails here).
+    floors = {
+        "positive": 51,
+        "several sources": 14,
+        "several destinations": 11,
+        "reduced view": 10,
+        "stopped by the cap": 6,
+        "maximum with its cut": 28,
+        "masked": 16,
+        "node masked": 1,
+    }
+    kinds = dict.fromkeys(floors, 0)
+    for _ in range(400):
+        n = rng.randint(2, 5)
+        edges = [
+            (rng.randrange(n), rng.randrange(n), rng.randint(0, 2), rng.randint(1, 5))
+            for _ in range(rng.randint(1, 6))
+        ]
+        g = build(n, edges)
+        nodes = list(range(n))
+        rng.shuffle(nodes)
+        ns = rng.randint(1, min(2, n - 1))
+        sources, dests = nodes[:ns], nodes[ns : ns + rng.randint(1, min(2, n - ns))]
+        view = [
+            c if rng.random() < 0.7 else rng.randint(0, c)
+            for c in g.edge_capacity_units().tolist()
+        ]
+        cap = rng.choice([None, 0, 1, rng.randint(0, 6), (1 << 63) - 2])
+        eligibility = None
+        excluded_nodes = []
+        if rng.random() < 0.4:
+            excluded_nodes = [rng.randrange(n)] if rng.random() < 0.3 else []
+            eligibility = g.eligibility(
+                excluded_nodes=excluded_nodes,
+                excluded_edges=[rng.randrange(len(edges))]
+                if rng.random() < 0.6
+                else [],
+            )
+        p = solve(g, sources, dests, cap, view=view, eligibility=eligibility)
+        fails = certify(g, view, sources, dests, cap, p, *allowed(eligibility))
+        assert fails == [], (edges, sources, dests, view, cap, fails)
+        for kind in kinds_of(
+            sources, dests, view, g, cap, eligibility, excluded_nodes, p
+        ):
+            kinds[kind] += 1
+    assert all(kinds[k] >= floors[k] for k in floors), kinds
+
+
+def test_random_larger_graphs_certified_by_the_independent_solver():
+    # Past the exhaustive bound (more than 7 edges here), the certificate compares the curve
+    # with the independent solver; that solver first matches the exhaustive optimum at every
+    # value of a small graph, so the second tier's reference is itself checked.
+    # The chain with bypasses at capacities 4: its second batch of 4 units cancels the first
+    # batch's flow on 1 -> 2 (the backward residual arc), so the optimum is 4 units at cost 3,
+    # then 4 at cost 5.
+    wide_chain = build(4, [(u, v, 4, w) for u, v, _c, w in CHAIN])
+    args = (
+        4,
+        wide_chain.edge_sources().tolist(),
+        wide_chain.edge_destinations().tolist(),
+        wide_chain.edge_costs().tolist(),
+        wide_chain.edge_capacity_units().tolist(),
+    )
+    assert independent_curve(*args, [0], [3]) == [(0, 0), (4, 12), (8, 32)]
+    p = solve(wide_chain, [0], [3], None)
+    assert p["marginal_cost_curve"] == [[3, 4], [5, 4]]
+    assert certify(wide_chain, args[4], [0], [3], None, p) == []
+    # Small graphs of 4 to 7 edges of capacity 1 or 2, with one or two sources and destinations
+    # and most with some edges excluded (the certificate passes both solvers its sets and its
+    # edge mask): the independent solver's curve equals the exhaustive optimum at every value,
+    # many of them after two augmentations or more.
+    oracle_rng = random.Random(2028)
+    # The kinds of case, each to be crossed at least this often (well below today's counts).
+    floors = {
+        "several augmentations": 45,
+        "several sources": 60,
+        "several destinations": 50,
+        "edges excluded": 50,
+    }
+    crossed = dict.fromkeys(floors, 0)
+    for _ in range(400):
+        n = oracle_rng.randint(3, 4)
+        small = [
+            (
+                oracle_rng.randrange(n),
+                oracle_rng.randrange(n),
+                oracle_rng.randint(1, 2),
+                oracle_rng.randint(1, 5),
+            )
+            for _ in range(oracle_rng.randint(4, 7))
+        ]
+        args = (
+            n,
+            [u for u, _v, _c, _w in small],
+            [v for _u, v, _c, _w in small],
+            [w for _u, _v, _c, w in small],
+            [c for _u, _v, c, _w in small],
+        )
+        nodes = list(range(n))
+        oracle_rng.shuffle(nodes)
+        ns = oracle_rng.randint(1, 2)
+        nd = oracle_rng.randint(1, min(2, n - ns))
+        sources, dests = nodes[:ns], nodes[ns : ns + nd]
+        mask = None
+        if oracle_rng.random() < 0.7:
+            mask = [oracle_rng.random() < 0.8 for _ in small]
+        case = (small, sources, dests, mask)
+        best = exhaustive(*args, sources, dests, mask)
+        ref = independent_curve(*args, sources, dests, mask)
+        assert ref[-1][0] == max(best), case
+        assert all(points_value(ref, x) == c for x, c in best.items()), case
+        if max(best) > 0:
+            crossed["several augmentations"] += len(ref) > 2
+            crossed["several sources"] += len(sources) > 1
+            crossed["several destinations"] += len(dests) > 1
+            crossed["edges excluded"] += mask is not None and not all(mask)
+    assert all(crossed[k] >= floors[k] for k in floors), crossed
+    rng = random.Random(2027)
+    # The kinds of case the draws aim at, each to be certified at least this often (well below
+    # today's counts).
+    floors = {
+        "positive": 40,
+        "several augmentations": 21,
+        "cost factor above 1": 8,
+        "several sources": 23,
+        "several destinations": 22,
+        "reduced view": 38,
+        "stopped by the cap": 11,
+        "maximum with its cut": 30,
+        "masked": 21,
+        "node masked": 3,
+    }
+    kinds = dict.fromkeys(floors, 0)
+    for _ in range(120):
+        n = rng.randint(3, 7)
+        factor = rng.choice([1, 1, 3, 1000003])
+        edges = [
+            (
+                rng.randrange(n),
+                rng.randrange(n),
+                rng.randint(0, 9),
+                rng.randint(1, 9) * factor,
+            )
+            for _ in range(rng.randint(8, 14))
+        ]
+        g = build(n, edges)
+        nodes = list(range(n))
+        rng.shuffle(nodes)
+        ns = rng.randint(1, 2)
+        sources, dests = nodes[:ns], nodes[ns : ns + rng.randint(1, min(2, n - ns))]
+        view = [
+            c if rng.random() < 0.7 else rng.randint(0, c)
+            for c in g.edge_capacity_units().tolist()
+        ]
+        cap = rng.choice([None, 1, rng.randint(0, 20), (1 << 63) - 2])
+        eligibility = None
+        excluded_nodes = []
+        if rng.random() < 0.4:
+            excluded_nodes = [rng.randrange(n)] if rng.random() < 0.3 else []
+            eligibility = g.eligibility(
+                excluded_nodes=excluded_nodes,
+                excluded_edges=[rng.randrange(len(edges))],
+            )
+        p = solve(g, sources, dests, cap, view=view, eligibility=eligibility)
+        fails = certify(g, view, sources, dests, cap, p, *allowed(eligibility))
+        assert fails == [], (edges, sources, dests, view, cap, fails)
+        for kind in kinds_of(
+            sources, dests, view, g, cap, eligibility, excluded_nodes, p
+        ):
+            kinds[kind] += 1
+        several = len(p["marginal_cost_curve"]) > 1
+        kinds["several augmentations"] += several
+        kinds["cost factor above 1"] += several and factor > 1
+    assert all(kinds[k] >= floors[k] for k in floors), kinds
+
+
+def test_entry_validates_in_the_core_order_before_narrowing():
+    # The private entry validates in a fixed order: view length, view entries, sources,
+    # destinations, overlap, cap, each checked on the unnarrowed value. The view's own checks,
+    # entries before a later argument included, are the shared ones of test_edge_amounts.py.
+    g = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+
+    def call(**kw):
+        args = {
+            "view": [5, 5],
+            "sources": [0],
+            "destinations": [2],
+            "eligibility": None,
+            "cap": 3,
+        }
+        args.update(kw)
+        return core._solve_min_cost_flow(g, **args)
+
+    with pytest.raises(
+        ValueError, match=exact("view has length 1, expected 2 (one entry per edge)")
+    ):
+        call(view=[2**70], sources=[2**40])
+    with pytest.raises(
+        ValueError, match=exact("sources: node 1099511627776 out of node range [0, 3)")
+    ):
+        call(sources=[2**40], destinations=[-(2**70)])
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "destinations: node -1180591620717411303424 out of node range [0, 3)"
+        ),
+    ):
+        call(destinations=[-(2**70)], cap=-1)
+    with pytest.raises(
+        ValueError,
+        match=exact("destinations: node 1099511627776 out of node range [0, 3)"),
+    ):
+        call(sources=[0, 2], destinations=[2, 2**40], cap=2**70)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "node 2 is in both endpoint sets: sources and destinations must not overlap"
+        ),
+    ):
+        call(sources=[0, 2], cap=2**70)
+    with pytest.raises(
+        ValueError, match=exact("cap 1180591620717411303424 is outside [0, 2^63 - 2]")
+    ):
+        call(cap=2**70)
+    with pytest.raises(
+        ValueError, match=exact("cap -1180591620717411303424 is outside [0, 2^63 - 2]")
+    ):
+        call(cap=-(2**70))
+
+
+def test_entry_view_rank_is_checked_with_its_length():
+    # A 0-D view (the 2-D and nested views are test_edge_amounts.py's), and a 2-D sources array.
+    g = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    with pytest.raises(
+        TypeError, match=exact("view must be a 1-D array (got 0 dimensions)")
+    ):
+        core._solve_min_cost_flow(g, np.array(5), [0], [2], None, 3)
+    with pytest.raises(
+        TypeError,
+        match=exact("sources node ids must be a 1-D array (got 2 dimensions)"),
+    ):
+        core._solve_min_cost_flow(g, [5, 5], np.array([[0]]), [2], None, -1)
+
+
+def test_certificate_rejects_mutated_payloads():
+    # Each clean payload certifies first; changing one field must fail the clause it
+    # breaks. These controls include payload shape and the destination potential
+    # pi(t*) against the last curve cost, which the C++ certificate also checks.
+    def rejected(g, cap, payload, mutate, dests=(1,), allowed=(None, None)):
+        view = g.edge_capacity_units().tolist()
+        assert certify(g, view, [0], list(dests), cap, payload, *allowed) == []
+        mutate(payload)
+        return certify(g, view, [0], list(dests), cap, payload, *allowed)
+
+    one = build(2, [(0, 1, 3, 7)])
+    # Underfill: placed 1 is certified for cap 1 and an early stop for cap 2.
+    under = solve(one, [0], [1], 1)
+    assert certify(one, [3], [0], [1], 1, under) == []
+    assert "attained value: early stop" in certify(one, [3], [0], [1], 2, under)
+    # The same underfill without a cap, in both branches (capacity 3 takes the exhaustive one,
+    # capacity 4 the independent solver's): an uncapped solve must be maximal, so the two clauses
+    # that prove it fail and nothing else does.
+    for capacity, branch in ((3, "exhaustive"), (4, "independent")):
+        single = build(2, [(0, 1, capacity, 7)])
+        assert certify(
+            single, [capacity], [0], [1], None, solve(single, [0], [1], 1)
+        ) == [
+            "uncapped solve left the destinations connected",
+            f"placed 1 != min(cap, F_max) {capacity} ({branch})",
+        ]
+    assert "curve moment differs from the flow cost" in rejected(
+        one,
+        2,
+        solve(one, [0], [1], 2),
+        lambda p: p.update(marginal_cost_curve=[[6, 2]]),
+    )
+    assert rejected(
+        one, None, solve(one, [0], [1], None), lambda p: p.update(min_cut=[])
+    ) == ["min_cut [] != closure cut [0]"]
+    # The curve-shape clauses, each the only failure: an entry of volume 0 before the real one,
+    # and the one tier split in two at the same cost (total, moment and pi(t*) hold). Capacity 3
+    # takes the exhaustive branch, capacity 4 the independent solver's.
+    for capacity in (3, 4):
+        single = build(2, [(0, 1, capacity, 7)])
+        assert solve(single, [0], [1], None)["marginal_cost_curve"] == [[7, capacity]]
+        assert rejected(
+            single,
+            None,
+            solve(single, [0], [1], None),
+            lambda p, c=capacity: p.update(marginal_cost_curve=[[6, 0], [7, c]]),
+        ) == ["curve volume not positive"]
+        assert rejected(
+            single,
+            None,
+            solve(single, [0], [1], None),
+            lambda p, c=capacity: p.update(marginal_cost_curve=[[7, 1], [7, c - 1]]),
+        ) == ["curve costs not strictly increasing"]
+    par = build(2, [(0, 1, 1, 1), (0, 1, 1, 3)])
+    # Same moment as [[1, 1], [3, 1]], the breakpoint at 1 omitted.
+    assert "curve differs from the exhaustive optimum at 1" in rejected(
+        par,
+        None,
+        solve(par, [0], [1], None),
+        lambda p: p.update(marginal_cost_curve=[[2, 2]]),
+    )
+    anycast = build(3, [(0, 1, 1, 1), (0, 2, 1, 2)])
+    # Destination 1 lowered to 1 becomes pi(t*), so destination 2, which also receives, differs.
+    assert "inflow destination 2 potential differs from pi(t*)" in rejected(
+        anycast,
+        None,
+        solve(anycast, [0], [1, 2], None),
+        lambda p: p["potentials"].__setitem__(
+            1, 1
+        ),  # an inflow destination below pi(t*)
+        dests=(1, 2),
+    )
+    assert "closure vertex 1 holds NEVER_REACHED" in rejected(
+        one,
+        1,
+        solve(one, [0], [1], 1),
+        lambda p: p.update(potentials=[NEVER_REACHED, NEVER_REACHED]),
+    )
+    assert rejected(
+        one, 0, solve(one, [0], [1], 0), lambda p: p["counters"].update(dijkstra_runs=1)
+    ) == ["zero cap: the prescribed zero payload"]
+    # The payload shape: one edge flow too many.
+    assert rejected(
+        one, None, solve(one, [0], [1], None), lambda p: p["edge_flows"].append(0)
+    ) == ["shape"]
+    # pi(t*) alone: the saturated edge leaves the destination outside the closure, so only the
+    # last curve cost (7) pins its potential.
+    assert rejected(
+        one,
+        None,
+        solve(one, [0], [1], None),
+        lambda p: p["potentials"].__setitem__(1, 8),
+    ) == ["pi(t*) differs from the last curve cost"]
+    # The flow clauses. Two parallel edges of capacity 1 and cost 1 carry one unit each; both
+    # units on EdgeId 0 keep the value, conservation and the cost but exceed its view of 1.
+    twin = build(2, [(0, 1, 1, 1), (0, 1, 1, 1)])
+    over = solve(twin, [0], [1], None)
+    assert over["edge_flows"] == [1, 1]
+    assert "feasibility at 0" in rejected(
+        twin, None, over, lambda p: p.update(edge_flows=[2, 0])
+    )
+    # EdgeId 1 masked: the solve uses EdgeId 0; moving its unit to EdgeId 1 puts flow on the
+    # ineligible edge at the same cost.
+    mask = twin.eligibility(excluded_edges=[1])
+    masked = solve(twin, [0], [1], None, eligibility=mask)
+    assert masked["edge_flows"] == [1, 0]
+    assert "flow on ineligible edge 1" in rejected(
+        twin,
+        None,
+        masked,
+        lambda p: p.update(edge_flows=[0, 1]),
+        allowed=(mask.node_allowed(), mask.edge_allowed()),
+    )
+    # The chain 0 -> 1 -> 2 carries 2 units; one unit less out of node 1 leaves it unbalanced.
+    chain = build(3, [(0, 1, 2, 1), (1, 2, 2, 1)])
+    out_of_1 = 0 if int(chain.edge_sources()[0]) == 1 else 1
+    assert "conservation at 1" in rejected(
+        chain,
+        None,
+        solve(chain, [0], [2], None),
+        lambda p: p["edge_flows"].__setitem__(out_of_1, 1),
+        dests=(2,),
+    )
+    # The same chain with capacities 5, capped at 1: every vertex is in the closure with
+    # potentials (0, 1, 2). Raising pi(1) to 3 makes the reduced costs of 0 -> 1 (1 + 0 - 3)
+    # and of the backward arc 2 -> 1 (-1 + 2 - 3) negative; pi(t*) = 2 is still the last curve
+    # cost, so these two are the only failures.
+    wide = build(3, [(0, 1, 5, 1), (1, 2, 5, 1)])
+    capped = solve(wide, [0], [2], 1)
+    assert capped["potentials"] == [0, 1, 2]
+    assert rejected(
+        wide, 1, capped, lambda p: p["potentials"].__setitem__(1, 3), dests=(2,)
+    ) == ["negative reduced cost 0->1", "negative reduced cost 2->1"]
+    # Past the exhaustive bound (capacities 4): the cut 0 -> 1 lets one unit through, and from
+    # node 1 the direct edge to 3 costs 5, the detour through 2 costs 1 + 1. One unit sent the
+    # direct way is feasible and conserved with the same cut and a matching pi(t*), but costs 6,
+    # not the optimum 3; only the independent solver's curve catches it.
+    detour = build(4, [(0, 1, 1, 1), (1, 3, 4, 5), (1, 2, 4, 1), (2, 3, 4, 1)])
+    direct = [
+        1 if (int(u), int(v)) in ((0, 1), (1, 3)) else 0
+        for u, v in zip(detour.edge_sources(), detour.edge_destinations(), strict=True)
+    ]
+
+    def costlier(p):
+        p.update(edge_flows=direct, marginal_cost_curve=[[6, 1]])
+        p["potentials"][3] = 6
+
+    assert rejected(
+        detour, None, solve(detour, [0], [3], None), costlier, dests=(3,)
+    ) == ["curve differs from the independent solver at 1"]
+    # Two parallel edges of capacity 4 at costs 2 and 4: the curve [[3, 8]] keeps the moment 24,
+    # the value and pi(t*) = 3, and equals the optimum at its own breakpoints 0 and 8; only the
+    # independent solver's breakpoint at 4 (cost 8, not 12) shows it.
+    par4 = build(2, [(0, 1, 4, 2), (0, 1, 4, 4)])
+
+    def averaged(p):
+        p.update(marginal_cost_curve=[[3, 8]])
+        p["potentials"][1] = 3
+
+    assert rejected(par4, None, solve(par4, [0], [1], None), averaged) == [
+        "curve differs from the independent solver at 4"
+    ]
+
+
+def test_certificate_rejects_every_other_clause():
+    # The clauses (and each condition of a clause with several) that the test above does not
+    # reach, one control each, as in the C++ twin. A control expects the exact list where the
+    # mutation can break one clause alone, else the clause it targets among those it also breaks.
+    def mutated(g, sources, dests, cap, mutate, eligibility=None):
+        view = g.edge_capacity_units().tolist()
+        masks = allowed(eligibility)
+        payload = solve(g, sources, dests, cap, eligibility=eligibility)
+        assert certify(g, view, sources, dests, cap, payload, *masks) == []
+        mutate(payload)
+        return certify(g, view, sources, dests, cap, payload, *masks)
+
+    def flows(g, by_position):
+        """A mutation setting the edge flows of the given input positions."""
+
+        def mutate(p):
+            for pos, x in by_position.items():
+                p["edge_flows"][ids(g, [pos])[0]] = x
+
+        return mutate
+
+    def potential(v, x):
+        return lambda p: p["potentials"].__setitem__(v, x)
+
+    # One edge 0 -> 1 of capacity 3 and cost 7. Uncapped, the edge is saturated, so the closure
+    # is {0} and the destination's potential (7) is pinned only by the last curve cost; under
+    # cap 1 the destination stays in the closure.
+    one = build(2, [(0, 1, 3, 7)])
+    assert mutated(one, [0], [1], None, lambda p: p["potentials"].append(0)) == [
+        "shape"
+    ]
+    # The zero-cap payload, each of its fields alone (the counters are the test above's control).
+    for field, value in (
+        ("flow_value", 1),
+        ("marginal_cost_curve", [[7, 1]]),
+        ("min_cut", []),
+        ("edge_flows", [1]),
+        ("potentials", [0, NEVER_REACHED]),
+    ):
+        assert mutated(
+            one, [0], [1], 0, lambda p, f=field, x=value: p.update({f: x})
+        ) == ["zero cap: the prescribed zero payload"], field
+    # A negative edge flow (the test above sends one above the view).
+    assert "feasibility at 0" in mutated(one, [0], [1], None, flows(one, {0: -1}))
+    # Sources {0, 1}, destination 2, edges 0 -> 1 and 1 -> 2: source 1 sends its unit directly.
+    # Moving it to 0 -> 1 makes source 1 absorb a unit. With destinations {1, 2} and source 0
+    # the unit stops at destination 1; moving it to 1 -> 2 makes destination 1 emit a unit.
+    two = build(3, [(0, 1, 1, 1), (1, 2, 1, 1)])
+    assert "source 1" in mutated(two, [0, 1], [2], None, flows(two, {0: 1, 1: 0}))
+    assert "destination 1" in mutated(two, [0], [1, 2], None, flows(two, {0: 0, 1: 1}))
+    # Excluded endpoints: 0 -> 2 and 1 -> 2 with sources {0, 1} and source 0 excluded (and with
+    # it the edge 0 -> 2); a unit on 0 -> 2 is supplied by the excluded source. Mirrored, 0 -> 1
+    # and 0 -> 2 with destinations {1, 2} and destination 2 excluded.
+    into_2 = build(3, [(0, 2, 1, 1), (1, 2, 1, 1)])
+    assert "source 0" in mutated(
+        into_2,
+        [0, 1],
+        [2],
+        None,
+        flows(into_2, {0: 1}),
+        into_2.eligibility(excluded_nodes=[0]),
+    )
+    out_of_0 = build(3, [(0, 1, 1, 1), (0, 2, 1, 1)])
+    assert "destination 2" in mutated(
+        out_of_0,
+        [0],
+        [1, 2],
+        None,
+        flows(out_of_0, {1: 1}),
+        out_of_0.eligibility(excluded_nodes=[2]),
+    )
+    # The value against the supply alone and the inflow alone: on the chain 0 -> 1 -> 2 carrying
+    # 2, one unit less into node 1 lowers the supply only, one unit less out of it the inflow only.
+    chain = build(3, [(0, 1, 2, 1), (1, 2, 2, 1)])
+    for pos in (0, 1):
+        assert "value differs from supply or inflow" in mutated(
+            chain, [0], [2], None, flows(chain, {pos: 1})
+        ), pos
+    # placed outside [0, cap]: above the cap, and negative without one.
+    assert "placed outside [0, cap]" in mutated(
+        one, [0], [1], 1, lambda p: p.update(flow_value=2)
+    )
+    assert "placed outside [0, cap]" in mutated(
+        one, [0], [1], None, lambda p: p.update(flow_value=-1)
+    )
+    # The cut: present while cap 1 leaves the destination reachable, and its value (3) against
+    # a lowered placed (which also breaks the value and the curve total).
+    assert mutated(one, [0], [1], 1, lambda p: p.update(min_cut=[])) == [
+        "min_cut on a connected solve"
+    ]
+    assert "cut value differs from placed" in mutated(
+        one, [0], [1], None, lambda p: p.update(flow_value=2)
+    )
+    # The potentials: node 1's (outside the closure) below the sentinel (also below pi(t*)),
+    # the root's (the closure), and no destination potential at all although 3 units arrive
+    # (node 1 is reached at zero flow, so the sentinel also breaks that clause).
+    assert "potential below the sentinel" in mutated(
+        one, [0], [1], None, potential(1, NEVER_REACHED - 1)
+    )
+    assert mutated(one, [0], [1], None, potential(0, 1)) == ["root 0 potential 1"]
+    assert mutated(one, [0], [1], None, potential(1, NEVER_REACHED)) == [
+        "NEVER_REACHED differs from reachability at zero flow at node 1",
+        "flow delivered but no destination reached",
+    ]
+    # The sentinel against reachability at zero flow, each direction alone. On 0 -> 1 and
+    # 2 -> 1 nothing reaches node 2, which must hold NEVER_REACHED, not 0 or another value. On
+    # 0 -> 1 (capacity 3, cost 7) and 1 -> 2, uncapped, the first search settles node 2 through
+    # node 1 and the saturated edge then leaves both outside the closure: node 2 must not hold
+    # NEVER_REACHED.
+    unreached = build(3, [(0, 1, 1, 1), (2, 1, 1, 1)])
+    for x in (0, 123456):
+        assert mutated(unreached, [0], [1], None, potential(2, x)) == [
+            "NEVER_REACHED differs from reachability at zero flow at node 2"
+        ], x
+    beyond = build(3, [(0, 1, 3, 7), (1, 2, 1, 1)])
+    assert mutated(beyond, [0], [1], None, potential(2, NEVER_REACHED)) == [
+        "NEVER_REACHED differs from reachability at zero flow at node 2"
+    ]
+    # The curve total: a free tier of 1 before the real one keeps the moment (21) and pi(t*),
+    # and the curve then also differs from the optimum at 1.
+    assert mutated(
+        one, [0], [1], None, lambda p: p.update(marginal_cost_curve=[[0, 1], [7, 3]])
+    ) == [
+        "curve total differs from placed",
+        "curve differs from the exhaustive optimum at 1",
+    ]
diff --git a/tests/py/test_native_allocation.py b/tests/py/test_native_allocation.py
new file mode 100644
index 0000000..1168382
--- /dev/null
+++ b/tests/py/test_native_allocation.py
@@ -0,0 +1,896 @@
+"""Native allocation failures in the staged result constructions and in FlowLedger.reset: the
+k-th C++ allocation of spf, ksp, resolve_to_paths, ForwardingProgram.from_routes and from_dag, of the calls
+whose result objects are made before anything is published (place, evaluate, replace, forward,
+apply_actions in both modes, evaluate_demand, evaluate_pairs, evaluate_edge_failures) and of reset
+fails,
+for every k in turn (the private hook _fail_native_allocation). Every unabsorbed failure
+raises MemoryError, never aborts, leaves nothing it allocated behind and the observable state as
+it was. Standard-library optional buffers may absorb a failure; every successful call, including
+such a fallback, must return the same value and leave the same state as a call without failure.
+
+Each sweep runs in a child interpreter, so a crash (a double free) fails its test instead of
+the whole session: python -B test_native_allocation.py SCENARIO EXTENSION loads the parent's
+extension file and prints one JSON row per attempt."""
+
+from __future__ import annotations
+
+import gc
+import importlib.util
+import itertools
+import json
+import os
+import subprocess
+import sys
+
+if (
+    __name__ == "__main__"
+):  # the child: the parent's extension, whatever the import path finds
+    _spec = importlib.util.spec_from_file_location("_netgraph_core", sys.argv[2])
+    sys.modules["_netgraph_core"] = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(sys.modules["_netgraph_core"])
+
+import _netgraph_core as ext
+import numpy as np
+from helpers import (
+    ALL_OUT,
+    GLOBAL,
+    SHORTEST_PATHS,
+    build,
+    full_ledger_state,
+    plain,
+    stats_of,
+)
+
+import netgraph_core as ngc
+
+EDGES = [  # (u, v, capacity units, cost): unequal costs, parallel members, several routes
+    (0, 1, 5, 1),
+    (1, 3, 5, 1),
+    (0, 2, 3, 2),
+    (2, 3, 3, 2),
+    (1, 2, 2, 1),
+    (0, 1, 2, 1),
+    (3, 4, 9, 1),
+    (2, 4, 2, 4),
+]
+
+
+def graph():
+    return build(5, EDGES)
+
+
+POOLED_LOSSY = ngc.FlowPolicyConfig(
+    routing=ngc.ShortestPaths(), admission=ngc.Admission.LOSSY
+)
+GLOBAL_EQUAL = ngc.FlowPolicyConfig(
+    routing=ngc.CentralizedTE(source_allocation=ngc.SourceAllocation.EQUAL)
+)
+
+
+def caps(g):
+    return [int(c) for c in g.edge_capacity_units()]
+
+
+def epoch_state(policy):
+    """The policy's epoch (the requested total, the +inf flag, its flows), with each FlowId's
+    local id only (the ledger uid differs between the scenario's fresh ledgers)."""
+    state = policy._state()
+    for flows in state["cohorts"].values():
+        for flow in flows:
+            flow["flow_id"] = flow["flow_id"][1]
+    return state
+
+
+# A scenario makes fresh state and returns (fn, args, snapshot): snapshot() is the observable
+# state a failed call must leave as it was.
+def stateless(call):
+    def make():
+        g = graph()
+        fn, args = call(g)
+        return fn, args, lambda: [caps(g), g.edge_costs().tolist()]
+
+    return make
+
+
+def placement(cfg, traced, sources=0):
+    def make():
+        g = graph()
+        ledger = ngc.FlowLedger(g)
+        policy = ngc.FlowPolicy(ledger, sources, 4, cfg)
+        policy.place(
+            2
+        )  # an earlier call's flows in the same epoch: a failed call keeps them
+
+        def snap():
+            records = [(r.flow_id[1], r.delivered) for r in policy.records()]
+            return [
+                full_ledger_state(ledger),
+                policy.delivered(),
+                records,
+                epoch_state(policy),
+            ]
+
+        return (policy._place_traced if traced else policy.place), (6, ALL_OUT), snap
+
+    return make
+
+
+def exported(g, cfg=None, sources=0):
+    """A model's program on g (a CentralizedTE optimized one by default), for Pinned."""
+    return ngc.FlowPolicy(ngc.FlowLedger(g), sources, 4, cfg or GLOBAL).place(6).program
+
+
+def operation(cfg_of, method, sources=0, prepare="place", **kw):
+    """A call of `method` (offer 6, ALL_OUT, keywords kw of the graph) on a policy whose
+    configuration is cfg_of(g), after a `prepare(2)` in the same epoch; the snapshot adds the
+    installed program."""
+
+    def make():
+        g = graph()
+        ledger = ngc.FlowLedger(g)
+        policy = ngc.FlowPolicy(ledger, sources, 4, cfg_of(g))
+        getattr(policy, prepare)(2)
+        extra = {name: value(g) for name, value in kw.items()}
+
+        def call(offer):
+            return getattr(policy, method)(offer, outputs=ALL_OUT, **extra)
+
+        def snap():
+            records = [(r.flow_id[1], r.delivered) for r in policy.records()]
+            return [
+                full_ledger_state(ledger),
+                policy.delivered(),
+                records,
+                epoch_state(policy),
+                plain(policy.program),
+            ]
+
+        return call, (6,), snap
+
+    return make
+
+
+def listed(mode):
+    """One apply_actions list of `mode` (every output) over three policies that already hold
+    records: a pooled LOSSY ShortestPaths demand of sources 0 and 1, a LOSSY Pinned one over an
+    exported program with black holes, and a ShortestPaths one (LOSSLESS in an ORDERED list); the
+    snapshot adds every policy's epoch and program."""
+
+    def make():
+        g = graph()
+        ledger = ngc.FlowLedger(g)
+        lossy = ngc.Admission.LOSSY
+        pinned = pinned_cfg(
+            exported, lossy, lambda g: g.eligibility(excluded_edges=[1])
+        )
+        policies = [
+            ngc.FlowPolicy(ledger, [0, 1], 4, POOLED_LOSSY),
+            ngc.FlowPolicy(ledger, 0, 4, pinned(g)),
+            ngc.FlowPolicy(
+                ledger, 0, 4, SHORTEST_PATHS if mode == "ORDERED" else POOLED_LOSSY
+            ),
+        ]
+        for policy in policies:
+            policy.replace(2)
+        actions = [ngc.Replace(p, x) for p, x in zip(policies, (6, 4, 3), strict=True)]
+        batch = getattr(ngc.BatchMode, mode)
+
+        def call():
+            return ngc.apply_actions(ledger, actions, mode=batch, outputs=ALL_OUT)
+
+        def snap():
+            return [
+                full_ledger_state(ledger),
+                [epoch_state(p) for p in policies],
+                [plain(p.program) for p in policies],
+            ]
+
+        return call, (), snap
+
+    return make
+
+
+def pinned_cfg(program_of, admission=ngc.Admission.LOSSLESS, black_holes=None):
+    return lambda g: ngc.FlowPolicyConfig(
+        routing=ngc.Pinned(
+            program_of(g), black_holes=None if black_holes is None else black_holes(g)
+        ),
+        admission=admission,
+    )
+
+
+def split_route_args(g):
+    """from_routes' arguments for one WEIGHTED split route (a snapshot of half the capacity)
+    and one tunnel; the inputs are made before the swept call (a failed allocation inside
+    pybind11's registration of a new object escapes the hook: not this call's)."""
+    dag = ngc.spf(g, 0, spf_opts()).dag
+    tunnel = ngc.resolve_to_paths(g, dag, 0, 4, True)[0]
+
+    def call(*args):
+        return ngc.ForwardingProgram.from_routes(
+            *args,
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+            residual=residual,
+        )
+
+    residual = half(g)
+    return call, (
+        g,
+        0,
+        4,
+        [ngc.RouteDefinition(0, dag, weight=2), ngc.RouteDefinition(0, tunnel)],
+    )
+
+
+def split_route(g):
+    call, args = split_route_args(g)
+    return call(*args)
+
+
+def getter(make_owner, read):
+    """A getter that wraps a shared value in a new Python object (no wrapper exists yet):
+    make_owner(g) builds the object that holds it, read(owner) reads it."""
+
+    def make():
+        g = graph()
+        owner = make_owner(g)
+        return read, (owner,), lambda: [caps(g)]
+
+    return make
+
+
+def frozen_cache_capacity():
+    g = graph()
+    cache = ngc.ShortestPathCache(g)
+    ngc.evaluate_demand(g, 0, 4, ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache))
+    cache.freeze()
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache, outputs=ALL_OUT)
+    return ngc.evaluate_demand, (g, 0, 4, opts), lambda: stats_of(cache)
+
+
+def with_orphan(call):
+    """A ledger holding an orphaned record (its policy destroyed without remove()); call(ledger)
+    gives (fn, args), and the snapshot is the ledger's state. A successful reset can have a
+    negative native live balance: it frees the old baseline and orphan records allocated before
+    the hook was armed, while their deletions are counted inside the call."""
+
+    def make():
+        g = graph()
+        ledger = ngc.FlowLedger(g)
+        ngc.FlowPolicy(ledger, 0, 4, SHORTEST_PATHS).place(2)
+        gc.collect()  # the policy is gone: its record is an orphan
+        fn, args = call(ledger)
+        return fn, args, lambda: full_ledger_state(ledger)
+
+    return make
+
+
+def pooled_dag_args(g):
+    """from_dag's arguments: sources 0 and 1 pooled on the reverse shortest-path DAG to node 4,
+    WEIGHTED with a snapshot of half the capacity; the DAG is made before the swept call."""
+    dag = ngc.spf(g, 4, spf_opts(ngc.Direction.REVERSE)).dag
+
+    def call(*args):
+        return ngc.ForwardingProgram.from_dag(
+            *args,
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+            residual=residual,
+        )
+
+    residual = half(g)
+    return call, (g, [0, 1], 4, dag)
+
+
+def half(g):
+    return [c // 2 for c in caps(g)]
+
+
+def spf_opts(direction=ngc.Direction.FORWARD, multipath=True, **kw):
+    return ngc.SpfOptions(direction, multipath=multipath, **kw)
+
+
+def tunnel_pairs(g, model):
+    from helpers import dag_of
+
+    routing = (
+        ngc.DistributedTE(ngc.TunnelCount(2))
+        if model == "t1"
+        else ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.EQUAL,
+            tunnel_count=ngc.TunnelCount(2),
+            support=dag_of(g, range(g.num_edges())) if model == "t2_support" else None,
+        )
+    )
+    common = g.eligibility(excluded_edges=[0])
+    extra = g.eligibility(excluded_edges=[g.num_edges() - 1])
+    options = ngc.EvaluationOptions(
+        ngc.FlowPolicyConfig(routing=routing),
+        eligibility=common,
+        outputs=ALL_OUT,
+        design_demand=8,
+        offer=6,
+    )
+    return ngc.evaluate_pairs, (
+        g,
+        [([0, 1], 4), (1, 3), (0, 4)],
+        options,
+        [extra] * 3,
+        1,
+    )
+
+
+SCENARIOS = {
+    "evaluate_pairs.t1": stateless(lambda g: tunnel_pairs(g, "t1")),
+    "evaluate_pairs.t2": stateless(lambda g: tunnel_pairs(g, "t2")),
+    "evaluate_pairs.t2_support": stateless(lambda g: tunnel_pairs(g, "t2_support")),
+    "spf.full": stateless(lambda g: (ngc.spf, (g, 0, spf_opts()))),
+    "spf.targets_residual": stateless(
+        lambda g: (
+            ngc.spf,
+            (g, [0, 1], spf_opts(ngc.Direction.REVERSE, targets=[4], residual=caps(g))),
+        )
+    ),
+    "spf.single_path": stateless(
+        lambda g: (ngc.spf, (g, 0, spf_opts(multipath=False, targets=4)))
+    ),
+    "ksp": stateless(
+        lambda g: (ngc.ksp, (g, 0, 4, ngc.KspOptions(4, residual=caps(g))))
+    ),
+    "FlowLedger.reset": with_orphan(lambda fg: (fg.reset, (half(fg.graph()),))),
+    # to_units' input converter: a list of numbers of every accepted type, read into one buffer.
+    "to_units.list": stateless(
+        lambda g: (ngc.to_units, ([1.5, 2, np.int64(3), np.float32(4.0)], 1.0))
+    ),
+    "resolve_to_paths": stateless(
+        lambda g: (ngc.resolve_to_paths, (g, ngc.spf(g, 0, spf_opts()).dag, 0, 4, True))
+    ),
+    "place.shortest_paths": placement(SHORTEST_PATHS, traced=False),
+    "place.global": placement(GLOBAL, traced=False),
+    "place_traced.global": placement(GLOBAL, traced=True),
+    # Two sources: the pooled program's attribution and per-source rows, Lossy accounting, and
+    # the equal source allocation's bisection.
+    "place.shortest_paths_pooled_lossy": placement(
+        POOLED_LOSSY, traced=False, sources=[0, 1]
+    ),
+    "place.global_equal": placement(GLOBAL_EQUAL, traced=False, sources=[0, 1]),
+    "evaluate_pairs.global_equal": stateless(
+        lambda g: (
+            ngc.evaluate_pairs,
+            (g, [([0, 1], 4), (1, 3)], ngc.EvaluationOptions(GLOBAL_EQUAL), None, 1),
+        )
+    ),
+    "capacity.global": stateless(
+        lambda g: (
+            ngc.evaluate_demand,
+            (g, 0, 4, ngc.EvaluationOptions(GLOBAL, outputs=ALL_OUT)),
+        )
+    ),
+    "capacity.frozen_cache": frozen_cache_capacity,
+    "evaluate_pairs.global": stateless(
+        lambda g: (
+            ngc.evaluate_pairs,
+            (g, [(0, 4), (1, 3)], ngc.EvaluationOptions(GLOBAL), None, 1),
+        )
+    ),
+    "sensitivity.global": stateless(
+        lambda g: (
+            ngc.evaluate_edge_failures,
+            (g, 0, 4, ngc.EvaluationOptions(GLOBAL), 1),
+        )
+    ),
+    # Forwarding programs: building one, every operation over one, black holes, a
+    # support, and the evaluators over Pinned.
+    "from_routes": stateless(split_route_args),
+    "from_dag": stateless(pooled_dag_args),
+    "replace.pinned_tunnels_lossy": operation(
+        pinned_cfg(
+            exported, ngc.Admission.LOSSY, lambda g: g.eligibility(excluded_edges=[1])
+        ),
+        "replace",
+    ),
+    "place.pinned_split_route": operation(pinned_cfg(split_route), "place"),
+    "apply_actions.ordered": listed("ORDERED"),
+    "apply_actions.simultaneous": listed("SIMULTANEOUS"),
+    "evaluate.global": operation(lambda g: GLOBAL, "evaluate"),
+    "replace.global_support": operation(
+        lambda g: ngc.FlowPolicyConfig(
+            routing=ngc.CentralizedTE(
+                source_allocation=ngc.SourceAllocation.OPTIMIZED,
+                support=ngc.spf(g, 0, spf_opts()).dag,
+            )
+        ),
+        "replace",
+    ),
+    "forward.shortest_paths_pooled_lossy_black_holes": operation(
+        lambda g: POOLED_LOSSY,
+        "forward",
+        sources=[0, 1],
+        prepare="replace",
+        black_holes=lambda g: g.eligibility(excluded_edges=[0]),
+    ),
+    "capacity.pinned_lossy": stateless(
+        lambda g: (
+            ngc.evaluate_demand,
+            (
+                g,
+                0,
+                4,
+                ngc.EvaluationOptions(
+                    pinned_cfg(exported, ngc.Admission.LOSSY)(g),
+                    offer=6,
+                    outputs=ALL_OUT,
+                ),
+            ),
+        )
+    ),
+    # The getters of shared values (a failed wrapper registration once freed the value twice).
+    "PlacementResult.program": getter(
+        lambda g: ngc.FlowPolicy(ngc.FlowLedger(g), 0, 4, GLOBAL).place(6),
+        lambda r: r.program,
+    ),
+    "FlowRecord.route": getter(
+        lambda g: (lambda p: (p.place(6), p.records()[0])[1])(
+            ngc.FlowPolicy(ngc.FlowLedger(g), 0, 4, SHORTEST_PATHS)
+        ),
+        lambda r: r.route,
+    ),
+    "Eligibility.intersect": getter(
+        lambda g: (
+            g.eligibility(excluded_edges=[0]),
+            g.eligibility(excluded_edges=[1]),
+        ),
+        lambda pair: ngc.Eligibility.intersect(*pair),
+    ),
+    "sensitivity.pinned": stateless(
+        lambda g: (
+            ngc.evaluate_edge_failures,
+            (g, 0, 4, ngc.EvaluationOptions(pinned_cfg(exported)(g)), 1),
+        )
+    ),
+}
+
+
+def absorbing(g):
+    """A wrong call for the row checks' controls: it absorbs the injected failure."""
+
+    def absorbs(o):
+        try:
+            return ngc.spf(g, 0, o)
+        except MemoryError:
+            return "absorbed"
+
+    return absorbs, (spf_opts(),)
+
+
+def changing():
+    """A wrong call for the row checks' controls: it changes the observable state before the
+    failure reaches it."""
+    g = graph()
+    log = []
+
+    def changes(o):
+        log.append(None)
+        return ngc.spf(g, 0, o)
+
+    return changes, (spf_opts(),), lambda: len(log)
+
+
+def leaking():
+    """A wrong call for the row checks' controls: it keeps a result it made before the failure
+    reaches it (outside the snapshot), so that result's native allocations stay live."""
+    g = graph()
+    kept = []
+
+    def leaks(o):
+        kept.append(ngc.spf(g, 0, o))
+        return ngc.spf(g, 0, o)
+
+    return leaks, (spf_opts(),), lambda: [caps(g), g.edge_costs().tolist()]
+
+
+def replacing(g):
+    """A wrong call for the row checks' controls: it raises another exception in place of the
+    injected failure."""
+
+    def replaces(o):
+        try:
+            return ngc.spf(g, 0, o)
+        except MemoryError:
+            raise LookupError("replaced") from None
+
+    return replaces, (spf_opts(),)
+
+
+def exiting(status, after):
+    """Wrong calls for the row checks' controls: the process ends with `status` when the failure
+    of an attempt after the first `after` reaches the call (a crash, or an exit with status 0)."""
+
+    def make():
+        m = next(MADE)  # 0: the reference call
+        g = graph()
+
+        def exits(o):
+            try:
+                return ngc.spf(g, 0, o)
+            except MemoryError:
+                if m > after:
+                    os._exit(status)
+                raise
+
+        return exits, (spf_opts(),), lambda: [caps(g), g.edge_costs().tolist()]
+
+    return make
+
+
+def walks():
+    """A call for the row checks' controls that needs more attempts than the sweep makes: the
+    walks of ten diamonds in a row (1,024 walks, far more than 5,000 native allocations)."""
+    edges = []
+    for i in range(10):
+        a = 3 * i
+        edges += [
+            (a, a + 1, 1, 1),
+            (a, a + 2, 1, 1),
+            (a + 1, a + 3, 1, 1),
+            (a + 2, a + 3, 1, 1),
+        ]
+    g = build(31, edges)
+    dag = ngc.spf(g, 0, spf_opts()).dag
+    return (
+        ngc.resolve_to_paths,
+        (g, dag, 0, 30, True),
+        lambda: [caps(g), g.edge_costs().tolist()],
+    )
+
+
+def by_turn(call):
+    """A wrong call for the row checks' controls whose completing call differs from the
+    reference: call(m, g) gives the call of the m-th make() (m = 0: the reference call)."""
+
+    def make():
+        g = graph()
+        return (
+            call(next(MADE), g),
+            (spf_opts(),),
+            lambda: [caps(g), g.edge_costs().tolist()],
+        )
+
+    return make
+
+
+def raises_after(m, g):
+    """The completing call raises after its result (the reference call returns it)."""
+
+    def raises(o):
+        result = ngc.spf(g, 0, o)
+        if m:
+            raise LookupError("after its result")
+        return result
+
+    return raises
+
+
+def appending():
+    """A wrong call for the row checks' controls: the completing call adds two entries to the
+    observable log where the reference call added one."""
+    m = next(MADE)
+    g = graph()
+    log = []
+
+    def appends(o):
+        result = ngc.spf(g, 0, o)
+        log.extend([None] * (2 if m else 1))
+        return result
+
+    return appends, (spf_opts(),), lambda: len(log)
+
+
+def prebuilt(m, g):
+    """After ten failures the call returns a result built beforehand: it completes with no native
+    allocation, fewer than the failures before it."""
+    built = ngc.spf(g, 0, spf_opts())
+
+    def call(o):
+        return built if m > 10 else ngc.spf(g, 0, o)
+
+    return call
+
+
+def discarding(m, g):
+    """Keep the reference result, then discard it in each swept call. Comparing the returned
+    value detects the discard even if thread-local scratch keeps native allocations live."""
+
+    def discards(o):
+        result = ngc.spf(g, 0, o)
+        return 7 if m else result
+
+    return discards
+
+
+MADE = itertools.count()  # make() calls of a control in the child (each child runs one)
+
+# Wrong calls that the row checks must reject (run by the controls, not by the sweep test), one
+# per check. Their options are made before the call: a bound object constructed inside it would
+# meet the failure in its constructor.
+CONTROLS = {
+    "control.absorbs": stateless(absorbing),
+    "control.replaces": stateless(replacing),
+    "control.leaks": leaking,
+    "control.changes_state": changing,
+    "control.crashes": exiting(3, 0),
+    "control.never_completes": walks,
+    "control.exits": exiting(0, 1),
+    # A plain Python call makes exactly zero extension operator-new allocations on every
+    # platform. A native operation's count (even reset's) depends on the standard library.
+    "control.few": stateless(lambda g: (lambda: None, ())),
+    "control.raises_when_done": by_turn(raises_after),
+    "control.other_value": by_turn(lambda m, g: lambda o: ngc.spf(g, 1 if m else 0, o)),
+    "control.other_state": appending,
+    "control.fewer_allocations": by_turn(prebuilt),
+    "control.discards": by_turn(discarding),
+}
+
+
+def sweep(name: str) -> None:
+    """Attempts k = 0, 1, ... of one scenario until a call completes without reaching k; one
+    ROW line per attempt, written before the next attempt starts."""
+    make = {**SCENARIOS, **CONTROLS}[name]
+    fn, args, snap = make()
+    reference = plain(fn(*args))  # also the warm-up of lazily sized scratch
+    reference_after = snap()
+    gc.collect()
+    gc.disable()  # no unrelated object is released inside an attempt
+    for k in range(5000):
+        fn, args, snap = make()
+        before = snap()
+        print(f"START {k}", flush=True)
+        hit, seen, value, error, live = ext._fail_native_allocation(fn, args, k)
+        row = {"k": k, "hit": hit, "seen": seen, "live": live}
+        row["error"] = None if error is None else f"{type(error).__name__}: {error}"
+        if error is None:
+            row["returns"] = value is not None
+            row["value_ok"] = plain(value) == reference
+            row["state_ok"] = snap() == reference_after
+        else:
+            row["state_ok"] = snap() == before
+        del value, error
+        print("ROW " + json.dumps(row), flush=True)
+        if not hit:
+            return
+    print("ROW " + json.dumps({"k": None}), flush=True)
+
+
+def run_child(name):
+    proc = subprocess.run(
+        [sys.executable, "-B", __file__, name, ext.__file__],
+        capture_output=True,
+        text=True,
+        timeout=600,
+    )
+    rows, started = [], None
+    for line in proc.stdout.splitlines():
+        if line.startswith("START "):
+            started = int(line[6:])
+        elif line.startswith("ROW "):
+            rows.append(json.loads(line[4:]))
+    return proc, rows, started
+
+
+if __name__ != "__main__":
+    import traceback
+
+    import pytest
+    from private_hooks import needs_hooks
+
+    # The scenarios with fewer than ten native allocations, and at least how many they make:
+    # reset converts the residual from Python, then builds the new baseline; a getter registers
+    # its new wrapper (intersect first makes the new value); to_units reads its input into one
+    # buffer.
+    FEW = {
+        "FlowLedger.reset": 3,
+        "PlacementResult.program": 1,
+        "FlowRecord.route": 1,
+        "Eligibility.intersect": 4,
+        "to_units.list": 1,
+    }
+    # The scenarios whose result is a plain Python value (no native object): their completing
+    # call holds no native allocation.
+    PLAIN_RESULTS = {"to_units.list"}
+
+    def check(name, proc, rows, started):
+        """The checks of one scenario's rows."""
+        reached = [r for r in rows if r["k"] is not None and r["hit"]]
+        for row in reached:
+            if row["error"] is None:
+                # std::stable_partition's optional nothrow buffer may fail and fall back.
+                # Absorption is valid only with exactly the reference result and state.
+                assert row["value_ok"], row
+                assert row["state_ok"], row
+            else:
+                assert row["error"].startswith("MemoryError"), row
+                # A failed call may free a buffer the C++ library's own code allocated (libc++ 21
+                # grows a long std::string inside libc++.dylib), which the hook counts only as a
+                # deletion; an allocation the call left behind still counts as live > 0.
+                assert row["live"] <= 0, row
+                assert row["state_ok"], row
+        assert proc.returncode == 0, (
+            f"{name}: the child died (rc {proc.returncode}) in attempt {started}\n"
+            f"{proc.stderr[-2000:]}"
+        )
+        assert rows and rows[-1]["k"] is not None, f"{name}: the call never completed"
+        # Stop only when k is not reached; an absorbed failure still advances the sweep.
+        # A child that ended early with status 0 leaves a reached failure last.
+        assert len(reached) == len(rows) - 1, f"{name}: {len(reached)} attempts"
+        assert len(reached) >= FEW.get(name, 10), f"{name}: {len(reached)} attempts"
+        done = rows[-1]
+        assert done["error"] is None, done
+        assert done["value_ok"], done
+        assert done["state_ok"], done
+        assert done["seen"] == len(reached), done
+        for row in reached:
+            if row["error"] is None:
+                # A successful fallback holds exactly the result's native allocations,
+                # not an extra temporary buffer or a leaked staged result.
+                assert row["live"] == done["live"], row
+        if name in PLAIN_RESULTS:
+            assert done["live"] == 0, done
+        elif done["returns"]:
+            # The probe counts what the result object holds.
+            assert done["live"] > 0, done
+
+    def test_absorbed_rows_require_identical_success():
+        # Exercise fallback acceptance on every platform, even when its standard library
+        # does not request an optional buffer for this small graph.
+        proc = subprocess.CompletedProcess([], 0, stderr="")
+        rows = [
+            {
+                "k": k,
+                "hit": True,
+                "seen": k + 1,
+                "live": 0,
+                "error": "MemoryError: std::bad_alloc",
+                "state_ok": True,
+            }
+            for k in range(10)
+        ]
+        rows[0].update(error=None, live=3, value_ok=True)
+        rows.append(
+            {
+                "k": 10,
+                "hit": False,
+                "seen": 10,
+                "live": 3,
+                "error": None,
+                "value_ok": True,
+                "state_ok": True,
+                "returns": True,
+            }
+        )
+        check("fallback", proc, rows, 10)
+        for field, wrong in (("value_ok", False), ("state_ok", False), ("live", 4)):
+            corrupted = [dict(row) for row in rows]
+            corrupted[0][field] = wrong
+            with pytest.raises(AssertionError) as info:
+                check("fallback", proc, corrupted, 10)
+            clause = (
+                'assert row["live"] == done["live"], row'
+                if field == "live"
+                else f'assert row["{field}"], row'
+            )
+            assert traceback.extract_tb(info.tb)[-1].line == clause
+        corrupted = [dict(row) for row in rows]
+        corrupted[-1]["live"] = 0
+        corrupted[0]["live"] = 0
+        with pytest.raises(AssertionError) as info:
+            check("fallback", proc, corrupted, 10)
+        assert traceback.extract_tb(info.tb)[-1].line == 'assert done["live"] > 0, done'
+
+    @needs_hooks
+    def test_allocation_hooks_preserve_exception_identity():
+        class MarkedError(Exception):
+            pass
+
+        for hook in (ext._fail_python_allocation, ext._fail_native_allocation):
+            cause = LookupError("cause")
+            expected = MarkedError("instance")
+            expected.marker = object()
+
+            def raises(expected=expected, cause=cause):
+                raise expected from cause
+
+            hit, _, value, error, *_ = hook(raises, (), -1)
+            assert not hit
+            assert value is None
+            assert error is expected
+            assert error.marker is expected.marker
+            assert error.__cause__ is cause
+            assert error.__traceback__.tb_frame.f_code is raises.__code__
+            # The pending exception was cleared; another call returns normally.
+            assert hook(lambda: 7, (), -1)[2:4] == (7, None)
+
+    @needs_hooks
+    def test_python_allocation_hook_runs_the_call_untraced():
+        # A trace function's own allocations (a coverage tracer's) are not the call's: the hook
+        # suspends the thread's trace function for the call and restores it, also after a raise.
+        events = []
+
+        def tracer(frame, event, arg):
+            events.append(frame.f_code.co_name)
+            return tracer
+
+        def returns():
+            return 7
+
+        def raises():
+            raise LookupError("raised")
+
+        previous = sys.gettrace()
+        sys.settrace(tracer)
+        try:
+            returns()  # the tracer sees a direct call
+            seen_direct = "returns" in events
+            events.clear()
+            done = ext._fail_python_allocation(returns, (), -1)
+            failed = ext._fail_python_allocation(raises, (), -1)
+            after = sys.gettrace()
+        finally:
+            sys.settrace(previous)
+        assert seen_direct
+        assert done[2] == 7 and type(failed[3]) is LookupError
+        assert "returns" not in events and "raises" not in events, events
+        assert after is tracer
+
+    @needs_hooks
+    @pytest.mark.parametrize("name", list(SCENARIOS))
+    def test_native_allocation_failure_raises_and_changes_nothing(name):
+        check(name, *run_child(name))
+
+    @needs_hooks
+    def test_the_row_checks_reject_a_wrong_call():
+        # Each row check rejects its wrong call: one that absorbs a failure with a wrong
+        # result, raises another exception, leaks native allocations or changes the state;
+        # one that crashes, outlasts its sweep, or exits with status 0 after a failure;
+        # one with fewer allocations than the floor; and one whose completing call raises,
+        # returns another value or state, makes fewer allocations than failed before it, or returns
+        # a plain value in place of its result.
+        attempts = (
+            'assert len(reached) == len(rows) - 1, f"{name}: {len(reached)} attempts"'
+        )
+        for name, clause in (
+            ("control.absorbs", 'assert row["value_ok"], row'),
+            ("control.replaces", 'assert row["error"].startswith("MemoryError"), row'),
+            ("control.leaks", 'assert row["live"] <= 0, row'),
+            ("control.changes_state", 'assert row["state_ok"], row'),
+            ("control.crashes", "assert proc.returncode == 0, ("),
+            (
+                "control.never_completes",
+                'assert rows and rows[-1]["k"] is not None, f"{name}: the call never completed"',
+            ),
+            ("control.exits", attempts),
+            (
+                "control.few",
+                'assert len(reached) >= FEW.get(name, 10), f"{name}: {len(reached)} attempts"',
+            ),
+            ("control.raises_when_done", 'assert done["error"] is None, done'),
+            ("control.other_value", 'assert done["value_ok"], done'),
+            ("control.other_state", 'assert done["state_ok"], done'),
+            ("control.fewer_allocations", 'assert done["seen"] == len(reached), done'),
+            ("control.discards", 'assert done["value_ok"], done'),
+        ):
+            proc, rows, started = run_child(name)
+            try:
+                check(name, proc, rows, started)
+            except AssertionError as error:
+                actual = traceback.extract_tb(error.__traceback__)[-1].line
+                assert actual == clause, name
+            else:
+                pytest.fail(f"{name}: the planted bug passed; last row: {rows[-1:]}")
+
+else:
+    if ngc.spf is not ext.spf:  # the package binds to the loaded extension
+        sys.exit("netgraph_core does not use the extension the parent passed")
+    if not hasattr(ext, "_fail_native_allocation"):
+        sys.exit("the extension lacks the private hooks")
+    sweep(sys.argv[1])
diff --git a/tests/py/test_number_types.py b/tests/py/test_number_types.py
new file mode 100644
index 0000000..67ef2a8
--- /dev/null
+++ b/tests/py/test_number_types.py
@@ -0,0 +1,557 @@
+"""The types a number position takes (the one rule for error classes, with the number types).
+
+A non-integer number position (a resolution of Graph, to_units and as_float; to_units' value)
+takes exactly an int (not a bool), a float, a NumPy integer or floating scalar, an int or float
+subclass by its stored value (never through its own __int__, __float__ or __array__), and for
+to_units an array of an integer or floating dtype or a sequence of those scalars; any other type is
+a TypeError. An integer position (as_float's amount, an offer) takes any object with __index__,
+never a bool, and an exception of that __index__ reaches the caller as raised."""
+
+from __future__ import annotations
+
+import array
+import gc
+import itertools
+import math
+from collections import UserList
+from collections.abc import Sequence
+from decimal import Decimal
+from fractions import Fraction
+
+import numpy as np
+import pytest
+from helpers import exact, sweep_python_allocation
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+RESOLUTION = "resolution must be a power of two in [2^-32, 2^32]"
+OBJECT = "to_units takes physical numbers (got dtype object)"
+BOOL = "to_units takes physical numbers (got dtype bool)"
+
+
+class Index:
+    def __init__(self, value):
+        self.value = value
+
+    def __index__(self):
+        return self.value
+
+
+class IndexFails:
+    def __index__(self):
+        raise ZeroDivisionError("own index")
+
+
+class Both:
+    def __float__(self):
+        return 1.0
+
+    def __index__(self):
+        return 2
+
+
+class FloatOnly:
+    def __float__(self):
+        return 1.0
+
+
+class ArrayOnly:
+    def __array__(self, dtype=None, copy=None):
+        return np.array(2.0, dtype=dtype)
+
+
+# Subclasses whose own conversions must not be called (each raises).
+class IntValue(int):
+    def __float__(self):
+        raise AssertionError("int __float__ called")
+
+    def __int__(self):
+        raise AssertionError("int __int__ called")
+
+
+class FloatValue(float):
+    def __float__(self):
+        raise AssertionError("float __float__ called")
+
+
+class IntArrayValue(int):
+    def __array__(self, dtype=None, copy=None):
+        raise AssertionError("int __array__ called")
+
+
+class FloatArrayValue(float):
+    def __array__(self, dtype=None, copy=None):
+        raise AssertionError("float __array__ called")
+
+
+# Subclasses whose own conversions disagree with their stored value 2.
+class IntDifferent(int):
+    def __int__(self):
+        return 9
+
+
+class FloatDifferent(float):
+    def __float__(self):
+        return 9.0
+
+
+# Numeric subclasses that also look like a sequence of one 9: a number is read as the number.
+class IntSequence(int):
+    def __len__(self):
+        return 1
+
+    def __getitem__(self, i):
+        if i == 0:
+            return 9.0
+        raise IndexError(i)
+
+
+class FloatSequence(float):
+    def __len__(self):
+        return 1
+
+    def __getitem__(self, i):
+        if i == 0:
+            return 9.0
+        raise IndexError(i)
+
+
+class ColdResolution(np.float32):
+    # A resolution whose own conversion empties CPython's free lists, so the conversion's next
+    # Python allocations are real ones the hook can fail.
+    def __float__(self):
+        gc.collect()
+        return 1.0
+
+
+RESOLUTION_CALLS = {
+    "Graph": (lambda q: ngc.Graph(2, [0], [1], [1], [1], q).resolution(), 1.0),
+    "to_units": (lambda q: ngc.to_units(2.0, q), 2),
+    "as_float": (lambda q: ngc.as_float(1, q), 1.0),
+}
+REFUSED_RESOLUTIONS = {
+    "Decimal": Decimal(1),
+    "Fraction": Fraction(1),
+    "Index": Index(1),
+    "Both": Both(),
+    "FloatOnly": FloatOnly(),
+    "array0": np.array(1.0),
+    "bool": True,
+    "numpy-bool": np.True_,
+}
+TAKEN_RESOLUTIONS = {
+    "int": 1,
+    "float": 1.0,
+    "numpy-int": np.int64(1),
+    "numpy-float": np.float32(1.0),
+    "int-subclass": IntValue(1),
+    "float-subclass": FloatValue(1.0),
+}
+
+
+@pytest.mark.parametrize("name", RESOLUTION_CALLS)
+@pytest.mark.parametrize("q", REFUSED_RESOLUTIONS.values(), ids=REFUSED_RESOLUTIONS)
+def test_a_resolution_of_another_type_is_refused(name, q):
+    with pytest.raises(TypeError, match="incompatible") as error:
+        RESOLUTION_CALLS[name][0](q)
+    assert error.type is TypeError
+
+
+@pytest.mark.parametrize("name", RESOLUTION_CALLS)
+@pytest.mark.parametrize("q", [2**1024, -(2**1024)], ids=["positive", "negative"])
+def test_a_resolution_int_beyond_the_float_range_is_a_value(name, q):
+    with pytest.raises(ValueError, match=exact(RESOLUTION)) as error:
+        RESOLUTION_CALLS[name][0](q)
+    assert error.type is ValueError
+
+
+@pytest.mark.parametrize("name", RESOLUTION_CALLS)
+@pytest.mark.parametrize("q", TAKEN_RESOLUTIONS.values(), ids=TAKEN_RESOLUTIONS)
+def test_a_resolution_of_a_number_type_is_taken(name, q):
+    call, want = RESOLUTION_CALLS[name]
+    assert call(q) == want
+
+
+@pytest.mark.parametrize(
+    "x",
+    [[2**64, 1.5], [1.5, -(2**70)], [2**70, np.float32(1.5)]],
+    ids=["large-float", "negative-large-float", "large-numpy-float"],
+)
+def test_ints_beyond_64_bits_beside_floats_are_values(x):
+    with pytest.raises(ValueError, match=exact(OBJECT)) as error:
+        ngc.to_units(x, 1.0)
+    assert error.type is ValueError
+
+
+@pytest.mark.parametrize(
+    "x", [[True, False], (np.True_, np.False_)], ids=["bool-list", "bool-tuple"]
+)
+def test_bools_alone_keep_their_dtype_text(x):
+    with pytest.raises(TypeError, match=exact(BOOL)):
+        ngc.to_units(x, 1.0)
+
+
+@pytest.mark.parametrize(
+    ("x", "want"),
+    [
+        (Index(3), 3.0),
+        (Index(2**63), float(2**63)),
+        ([1, Index(3)], [1.0, 3.0]),
+        (Both(), 2.0),
+    ],
+    ids=["Index", "Index-large", "Index-list", "Both"],
+)
+def test_as_float_takes_the_integer_protocol(x, want):
+    got = ngc.as_float(x, 1.0)
+    assert (got.tolist() if isinstance(got, np.ndarray) else got) == want
+
+
+@pytest.mark.parametrize("x", [IndexFails(), [1, IndexFails()]], ids=["scalar", "list"])
+def test_as_float_passes_an_own_index_failure_through(x):
+    with pytest.raises(ZeroDivisionError, match="own index"):
+        ngc.as_float(x, 1.0)
+
+
+def test_as_float_refuses_an_object_array():
+    with pytest.raises(
+        TypeError,
+        match=exact("as_float: x entries must be integers (got dtype object)"),
+    ):
+        ngc.as_float(np.array([Index(3)], dtype=object), 1.0)
+
+
+@pytest.mark.parametrize(
+    "x",
+    [
+        Decimal(1),
+        Fraction(1),
+        Index(1),
+        Both(),
+        FloatOnly(),
+        ArrayOnly(),
+        [ArrayOnly()],
+        [np.array(1.0), 2.0],
+    ],
+    ids=[
+        "Decimal",
+        "Fraction",
+        "Index",
+        "Both",
+        "FloatOnly",
+        "array-protocol",
+        "array-protocol-entry",
+        "array0-entry",
+    ],
+)
+def test_to_units_refuses_other_types(x):
+    with pytest.raises(TypeError) as error:
+        ngc.to_units(x, 1.0)
+    assert error.type is TypeError
+
+
+def test_to_units_takes_a_real_zero_dimensional_array():
+    assert ngc.to_units(np.array(2.0), 1.0) == 2
+
+
+@pytest.mark.parametrize(
+    "x",
+    [
+        IntValue(2),
+        FloatValue(2.0),
+        IntArrayValue(2),
+        FloatArrayValue(2.0),
+        IntDifferent(2),
+        FloatDifferent(2.0),
+    ],
+    ids=[
+        "int-subclass",
+        "float-subclass",
+        "int-array-protocol",
+        "float-array-protocol",
+        "int-subclass-other-int",
+        "float-subclass-other-float",
+    ],
+)
+def test_to_units_reads_a_subclass_by_its_value(x):
+    assert ngc.to_units(x, 1.0) == 2
+    assert ngc.to_units([x], 1.0).tolist() == [2]
+
+
+def test_an_offer_keeps_the_integer_protocol():
+    g = ngc.Graph(2, [0], [1], [5], [1], 1.0)
+    p = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 1, ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    )
+    assert p.place(Index(3)).call_delivered == 3
+
+
+@pytest.mark.parametrize("cls", [IntSequence, FloatSequence])
+def test_a_numeric_subclass_with_sequence_methods_is_a_number(cls):
+    got = ngc.to_units(cls(2), 1.0)
+    assert got == 2 and type(got) is int
+    assert ngc.to_units([cls(2)], 1.0).tolist() == [2]
+    assert ngc.to_units([9.0], 1.0).tolist() == [9]
+
+
+def outcome(x, q=1.0):
+    """to_units(x, q) as comparable data: its units, or its refusal (class and text). A
+    MemoryError is not caught."""
+    try:
+        got = ngc.to_units(x, q)
+    except (TypeError, ValueError) as e:
+        return (type(e).__name__, str(e))
+    return got.tolist() if isinstance(got, np.ndarray) else got
+
+
+# Every branch of the converter: numbers of each type, subclasses, NumPy scalars, arrays of each
+# rank, lists and tuples, ints beyond 64 bits among numbers, bools, other types, nested lists.
+CONVERTER_INPUTS = [
+    2.5,
+    2**40,
+    IntSequence(2),
+    FloatSequence(2.0),
+    np.int64(3),
+    np.uint64(2**63),
+    np.float32(1.5),
+    np.array(2.5),
+    np.array([1.5, 2.5], dtype=np.float32),
+    np.array([1, 2], dtype=np.int64),
+    [1, 2.5, np.int64(3), np.float32(0.5), IntSequence(2)],
+    (np.float64(1.0), 2),
+    [],
+    [2**64, 1.5],
+    2**64,
+    [True, False],
+    [True, 1.5],
+    True,
+    "1",
+    [Decimal(1), 1.5],
+    Decimal(1),
+    ArrayOnly(),
+    [ArrayOnly()],
+    [[1, 2], [3, 4]],
+    np.array([[1.0]]),
+    np.array([True]),
+    np.array([1], dtype=object),
+    range(3),
+    UserList([1, 2.5]),
+    UserList(["a"]),
+    memoryview(np.array([1.0, 2.0])),
+    [2**64, True],
+]
+
+
+@needs_hooks
+def test_the_converter_raises_memory_error_on_every_python_allocation_failure():
+    # Each input's conversion with each of its Python allocations failing in turn (the free lists
+    # emptied first): MemoryError exactly, then the same outcome as without failure.
+    for x in CONVERTER_INPUTS:
+        sweep_python_allocation(lambda x=x: (outcome, (x,), lambda: None))
+
+
+@needs_hooks
+@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning")
+def test_a_cold_conversion_raises_memory_error():
+    # The review's witness: a resolution whose own conversion empties the free lists, then each
+    # Python allocation of to_units([1.0, 2.0], q) failing in turn. A failure inside the
+    # collection itself is recovered there (the call completes); every other one is a MemoryError.
+    import _netgraph_core as ext
+
+    x, q = [1.0, 2.0], ColdResolution(1.0)
+    assert ngc.to_units(x, q).tolist() == [1, 2]
+    failures = 0
+    for at in range(400):
+        hit, _, got, error = ext._fail_python_allocation(ngc.to_units, (x, q), at)
+        assert ngc.to_units(x, q).tolist() == [1, 2]
+        if not hit:
+            assert error is None and got.tolist() == [1, 2]
+            break
+        if got is not None:
+            assert error is None and got.tolist() == [1, 2]
+            continue
+        failures += 1
+        assert type(error) is MemoryError, (at, repr(error))
+    else:
+        pytest.fail("no completing call in 400 allocations")
+    assert failures >= 1
+
+
+@pytest.mark.parametrize(
+    "x", [[2**64, Decimal(1)], [Decimal(1), 2**64]], ids=["wide-first", "other-first"]
+)
+def test_an_int_beyond_64_bits_beside_another_type_is_a_wrong_type(x):
+    # NumPy's object dtype from another class is a TypeError, wherever the wide int stands.
+    with pytest.raises(TypeError, match=exact(OBJECT)) as error:
+        ngc.to_units(x, 1.0)
+    assert error.type is TypeError
+
+
+class CustomSequence(Sequence):
+    def __len__(self):
+        return 3
+
+    def __getitem__(self, i):
+        return [0, 1, 2][i]
+
+
+@pytest.mark.parametrize(
+    "x",
+    [
+        range(3),
+        memoryview(array.array("q", [0, 1, 2])),
+        array.array("q", [0, 1, 2]),
+        UserList([0, 1, 2]),
+        CustomSequence(),
+        [0, 1, 2],
+        (0, 1, 2),
+    ],
+    ids=["range", "memoryview", "array.array", "UserList", "custom", "list", "tuple"],
+)
+def test_every_python_sequence_of_numbers_is_taken(x):
+    assert ngc.to_units(x, 1.0).tolist() == [0, 1, 2]
+
+
+def test_a_sequence_of_other_types_keeps_numpys_text():
+    # Already refused before: the text NumPy's reading gives, whatever the sequence.
+    for x in (["a"], UserList(["a"]), ("a",)):
+        with pytest.raises(
+            TypeError, match=exact("to_units takes physical numbers (got dtype <U1)")
+        ):
+            ngc.to_units(x, 1.0)
+    with pytest.raises(
+        TypeError, match=exact("to_units takes a float or a 1-D array of floats")
+    ):
+        ngc.to_units(memoryview(np.zeros((2, 2))), 1.0)
+
+
+@pytest.mark.parametrize(
+    "x",
+    [[2**64, True], [False, 2**64], [np.True_, 2**64], [-(2**64), True]],
+    ids=["wide-bool", "bool-wide", "numpy-bool-wide", "negative-wide-bool"],
+)
+def test_numpys_dtype_comes_before_the_bool_rule(x):
+    # NumPy reads an int beyond 64 bits beside a bool as an object: its text, a wrong type.
+    with pytest.raises(TypeError, match=exact(OBJECT)) as error:
+        ngc.to_units(x, 1.0)
+    assert error.type is TypeError
+
+
+class ClaimedInteger:
+    @property
+    def __class__(self):
+        return np.int64
+
+    def __index__(self):
+        return 2
+
+
+class ClaimedFloating:
+    @property
+    def __class__(self):
+        return np.float32
+
+    def __float__(self):
+        return 2.0
+
+
+@pytest.mark.parametrize("cls", [ClaimedInteger, ClaimedFloating])
+def test_a_claimed_numpy_class_is_not_a_number(cls):
+    # Classification reads the object's real type, not its __class__.
+    x = cls()
+    assert isinstance(x, np.generic) and not issubclass(cls, np.generic)
+    for value in (x, [x]):
+        with pytest.raises(TypeError):
+            ngc.to_units(value, 1.0)
+    for call in (
+        lambda: ngc.to_units(1.0, x),
+        lambda: ngc.Graph(2, [0], [1], [1], [1], x),
+    ):
+        with pytest.raises(TypeError, match="incompatible"):
+            call()
+    assert ngc.to_units(np.int64(2), 1.0) == 2
+    assert ngc.to_units(np.float32(2), 1.0) == 2
+
+
+NOT_PHYSICAL = "to_units takes physical numbers (a float or an array of floats)"
+RANK = "to_units takes a float or a 1-D array of floats"
+
+
+def contract_outcome(x, q):
+    """The outcome 14.3 gives to_units(x, q), computed without the library: the resolution; a
+    bool, str or bytes; NumPy's dtype (an object from accepted numbers alone a value error, any
+    other non-numeric dtype a wrong type); the rank; a bool among numbers; then each value."""
+
+    def number(v):
+        return not isinstance(v, (bool, np.bool_)) and isinstance(
+            v, (int, float, np.integer, np.floating)
+        )
+
+    if q == 0.75:
+        return "ValueError", RESOLUTION
+    if isinstance(x, (bool, np.bool_, str, bytes)):
+        return "TypeError", NOT_PHYSICAL
+    raw = np.asarray(x)
+    if raw.dtype.kind not in "fiu":
+        accepted = (
+            all(number(v) for v in x) if isinstance(x, (list, tuple)) else number(x)
+        )
+        cause = "ValueError" if raw.dtype.kind == "O" and accepted else "TypeError"
+        return cause, f"to_units takes physical numbers (got dtype {raw.dtype})"
+    if raw.ndim > 1:
+        return "TypeError", RANK
+    if isinstance(x, (list, tuple)) and any(isinstance(v, (bool, np.bool_)) for v in x):
+        return "TypeError", NOT_PHYSICAL
+    units = []
+    for v in raw.astype(np.float64).reshape(-1):
+        v = float(v)
+        if math.isnan(v):
+            return "ValueError", "to_units: NaN has no unit value"
+        if math.isinf(v):
+            return (
+                "ValueError",
+                "to_units: an infinite amount is not finite and has no unit value",
+            )
+        if v < 0:
+            return "ValueError", "to_units: a negative amount has no unit value"
+        y = v / q
+        rounded = math.floor(y) + (y - math.floor(y) >= 0.5)
+        if rounded >= 2**62:
+            return (
+                "ValueError",
+                "to_units: the amount is at or above the bound of the units domain (2^62 units)",
+            )
+        units.append(rounded)
+    return "valid", units[0] if raw.ndim == 0 else units
+
+
+def test_the_check_order_over_pairs_and_triples():
+    # The review's order matrix: every pair of a pool of scalars and every triple of a smaller
+    # one, as lists and tuples, at three resolutions, against the contract's order.
+    pool = [0, 2.5, -1.0, math.nan, math.inf, 2**62, 2**64, True, np.True_]
+    pool += [Decimal(1), "1", None]
+    triples = [2.5, -1.0, 2**64, True, Decimal(1)]
+    inputs = list(pool)
+    for size, values in ((2, pool), (3, triples)):
+        for row in itertools.product(values, repeat=size):
+            inputs += [list(row), tuple(row)]
+    inputs += [
+        np.array([0, 1, 2]),
+        np.array([0.5, 2.5], dtype=np.float32),
+        np.array([True]),
+        np.array([1], dtype=object),
+        np.array([[1, 2]]),
+        np.array([[True]]),
+    ]
+    bad = []
+    for q in (1.0, 0.5, 0.75):
+        for x in inputs:
+            try:
+                got = ngc.to_units(x, q)
+            except (TypeError, ValueError) as e:
+                actual = (type(e).__name__, str(e))
+            else:
+                actual = ("valid", got.tolist() if isinstance(got, np.ndarray) else got)
+            if actual != contract_outcome(x, q):
+                bad.append((x, q, actual))
+    assert bad == []
diff --git a/tests/py/test_paths_resolve.py b/tests/py/test_paths_resolve.py
deleted file mode 100644
index 0183602..0000000
--- a/tests/py/test_paths_resolve.py
+++ /dev/null
@@ -1,67 +0,0 @@
-from __future__ import annotations
-
-import netgraph_core as ngc
-
-
-def test_resolve_no_split_parallel_edges(
-    build_graph, assert_paths_concrete, algs, to_handle
-):
-    # Graph: 0->1 has two equal-cost edges; 1->2 single edge
-    edges = [
-        (0, 1, 1.0, 1.0),
-        (0, 1, 1.0, 1.0),
-        (1, 2, 1.0, 1.0),
-    ]
-    g = build_graph(3, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 2, selection=sel)
-    paths = dag.resolve_to_paths(0, 2, split_parallel_edges=False)
-    # Expect one path grouping both parallel edges at hop 0->1
-    assert len(paths) == 1
-    assert_paths_concrete(paths, 0, 2, expect_split=False)
-
-
-def test_resolve_with_split_parallel_edges_cartesian(
-    build_graph, assert_paths_concrete, algs, to_handle
-):
-    # Graph: 0->1 two edges, 1->2 two edges (all equal cost)
-    edges = [
-        (0, 1, 1.0, 1.0),
-        (0, 1, 1.0, 1.0),
-        (1, 2, 1.0, 1.0),
-        (1, 2, 1.0, 1.0),
-    ]
-    g = build_graph(3, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 2, selection=sel)
-    paths = dag.resolve_to_paths(0, 2, split_parallel_edges=True)
-    # Expect 2*2 = 4 concrete paths
-    assert len(paths) == 4
-    assert_paths_concrete(paths, 0, 2, expect_split=True)
-
-
-def test_resolve_max_paths_cap(build_graph, assert_paths_concrete, algs, to_handle):
-    edges = [
-        (0, 1, 1.0, 1.0),
-        (0, 1, 1.0, 1.0),
-        (1, 2, 1.0, 1.0),
-        (1, 2, 1.0, 1.0),
-    ]
-    g = build_graph(3, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 2, selection=sel)
-    paths = dag.resolve_to_paths(0, 2, split_parallel_edges=True, max_paths=3)
-    assert len(paths) == 3
-    assert_paths_concrete(paths, 0, 2, expect_split=True)
diff --git a/tests/py/test_policy_vs_maxflow_equivalence.py b/tests/py/test_policy_vs_maxflow_equivalence.py
deleted file mode 100644
index cf5815a..0000000
--- a/tests/py/test_policy_vs_maxflow_equivalence.py
+++ /dev/null
@@ -1,213 +0,0 @@
-"""Policy vs MaxFlow equivalence across the full behavior matrix.
-
-Validates 3-way API equivalence across all modes:
-  - Algorithms.max_flow
-  - FlowState.place_max_flow
-  - FlowPolicy.place_demand
-
-Behavior Matrix (all combinations tested):
-  1. SDN Max-Flow:     require_capacity=True,  shortest_path=False, PROPORTIONAL
-  2. Single-Tier TE:   require_capacity=True,  shortest_path=True,  PROPORTIONAL
-  3. IP ECMP:          require_capacity=False, shortest_path=True,  EQUAL_BALANCED
-  4. IP WCMP:          require_capacity=False, shortest_path=True,  PROPORTIONAL
-
-Plus progressive TE modes with require_capacity=True, shortest_path=False, EQUAL_BALANCED.
-
-Also validates multi-step placement equivalence and remove/re-place idempotence.
-"""
-
-from __future__ import annotations
-
-import math
-
-# no typing imports needed
-import pytest
-
-import netgraph_core as ngc
-
-
-def _sel_for(
-    placement: ngc.FlowPlacement, shortest_path: bool, require_capacity: bool
-) -> ngc.EdgeSelection:
-    # Match MaxFlow's internal SPF selection
-    return ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=require_capacity,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-
-
-def _policy_for(
-    algs: ngc.Algorithms,
-    gh,
-    placement: ngc.FlowPlacement,
-    shortest_path: bool,
-    require_capacity: bool,
-) -> ngc.FlowPolicy:
-    sel = _sel_for(placement, shortest_path, require_capacity)
-    # Configure EB to match IP-like semantics under shortest_path=True
-    max_flow_c = (
-        1 if (placement == ngc.FlowPlacement.EQUAL_BALANCED and shortest_path) else None
-    )
-    cfg = ngc.FlowPolicyConfig(
-        path_alg=ngc.PathAlg.SPF,
-        flow_placement=placement,
-        selection=sel,
-        require_capacity=require_capacity,
-        shortest_path=shortest_path,
-        max_flow_count=max_flow_c,
-    )
-    return ngc.FlowPolicy(algs, gh, cfg)
-
-
-@pytest.mark.parametrize(
-    "graph_label",
-    [
-        "square1_graph",
-        "line1_graph",
-        "graph3",
-        "two_disjoint_shortest_graph",
-        "square3_graph",
-    ],
-)
-@pytest.mark.parametrize(
-    "placement,sp_flag,req_cap",
-    [
-        # Mode 1: SDN Max-Flow (uses all paths, capacity-aware)
-        (ngc.FlowPlacement.PROPORTIONAL, False, True),
-        # Mode 2: Single-Tier TE (shortest-cost tier only, capacity-aware)
-        (ngc.FlowPlacement.PROPORTIONAL, True, True),
-        # Mode 3: IP ECMP (shortest-cost tier, cost-only routing, equal splits)
-        (ngc.FlowPlacement.EQUAL_BALANCED, True, False),
-        # Mode 4: IP WCMP (shortest-cost tier, cost-only routing, proportional splits)
-        (ngc.FlowPlacement.PROPORTIONAL, True, False),
-        # Progressive TE mode (multi-tier EB, capacity-aware)
-        (ngc.FlowPlacement.EQUAL_BALANCED, False, True),
-    ],
-    ids=["sdn_maxflow", "tier_te", "ip_ecmp", "ip_wcmp", "progressive_te"],
-)
-def test_policy_matches_maxflow_equivalence(
-    request,
-    graph_label: str,
-    placement: ngc.FlowPlacement,
-    sp_flag: bool,
-    req_cap: bool,
-    algs: ngc.Algorithms,
-    to_handle,
-):
-    """3-way API equivalence: max_flow, FlowState.place_max_flow, FlowPolicy.place_demand.
-
-    Also validate:
-      - placing with demand > expected: placed==expected, remaining==demand-expected
-      - splitting placement into two steps: same totals
-      - placing, removing, placing again: same totals
-    """
-    # Acquire graph fixture by name
-    g = request.getfixturevalue(graph_label)
-    # src/dst mapping per canonical graph fixtures (mirrors test_flow_policy.py)
-    SRC_DST = {
-        "square1_graph": (0, 2),
-        "line1_graph": (0, 2),
-        "graph3": (0, 2),
-        "two_disjoint_shortest_graph": (0, 3),
-        "square3_graph": (0, 2),
-    }
-    src, dst = SRC_DST[graph_label]
-
-    # 1. Compute expected using max_flow under the same mode flags
-    total_mf, _summary = algs.max_flow(
-        to_handle(g),
-        src,
-        dst,
-        flow_placement=placement,
-        shortest_path=sp_flag,
-        require_capacity=req_cap,
-        with_edge_flows=False,
-    )
-    expected = float(total_mf)
-
-    # 2. Verify FlowState.place_max_flow matches
-    fs = ngc.FlowState(g)
-    total_fs = fs.place_max_flow(src, dst, placement, sp_flag, req_cap)
-    assert math.isclose(total_fs, expected, rel_tol=0, abs_tol=1e-6), (
-        f"FlowState mismatch for {graph_label}: {total_fs} != {expected}"
-    )
-
-    # Demand greater than expected
-    demand = expected + 7.0
-
-    # 3. Single-shot FlowPolicy placement
-    fg1 = ngc.FlowGraph(g)
-    policy1 = _policy_for(algs, to_handle(g), placement, sp_flag, req_cap)
-    placed1, rem1 = policy1.place_demand(fg1, src, dst, flowClass=0, volume=demand)
-    if sp_flag:
-        # Strict equivalence in shortest_path mode
-        assert math.isclose(placed1, expected, rel_tol=0, abs_tol=1e-6), (
-            f"single-shot placed mismatch for {graph_label}"
-        )
-        assert math.isclose(rem1, demand - expected, rel_tol=0, abs_tol=1e-6), (
-            f"single-shot remaining mismatch for {graph_label}"
-        )
-    else:
-        # TE mode: policy should not exceed max_flow; accounting must hold
-        assert placed1 <= expected + 1e-6, (
-            f"single-shot placed exceeds expected for {graph_label}"
-        )
-        assert math.isclose(placed1 + rem1, demand, rel_tol=0, abs_tol=1e-6), (
-            f"single-shot accounting mismatch for {graph_label}"
-        )
-
-    # Two-step placement (split request into two calls)
-    fg2 = ngc.FlowGraph(g)
-    policy2 = _policy_for(algs, to_handle(g), placement, sp_flag, req_cap)
-    v1 = demand * 0.4
-    p2a, r2a = policy2.place_demand(fg2, src, dst, flowClass=0, volume=v1)
-    p2b, r2b = policy2.place_demand(fg2, src, dst, flowClass=0, volume=demand - v1)
-    # Total placed must still not exceed expected
-    placed2 = p2a + p2b
-    if sp_flag:
-        # In shortest_path mode, ensure accounting only; placement additivity across calls may differ.
-        assert math.isclose(
-            (p2a + r2a) + (p2b + r2b), demand, rel_tol=0, abs_tol=1e-6
-        ), f"two-step accounting mismatch for {graph_label}"
-    else:
-        assert placed2 <= expected + 1e-6, (
-            f"two-step placed exceeds expected for {graph_label}"
-        )
-    # Accounting across both calls must match total demand
-    assert math.isclose((p2a + r2a) + (p2b + r2b), demand, rel_tol=0, abs_tol=1e-6), (
-        f"two-step accounting mismatch for {graph_label}"
-    )
-
-    # Place, remove, place again -> same totals as single-shot
-    fg3 = ngc.FlowGraph(g)
-    policy3 = _policy_for(algs, to_handle(g), placement, sp_flag, req_cap)
-    p3a, r3a = policy3.place_demand(fg3, src, dst, flowClass=0, volume=demand)
-    policy3.remove_demand(fg3)
-    p3b, r3b = policy3.place_demand(fg3, src, dst, flowClass=0, volume=demand)
-    if sp_flag:
-        assert math.isclose(p3a, expected, rel_tol=0, abs_tol=1e-6), (
-            f"pre-remove placed mismatch for {graph_label}"
-        )
-        assert math.isclose(r3a, demand - expected, rel_tol=0, abs_tol=1e-6), (
-            f"pre-remove remaining mismatch for {graph_label}"
-        )
-        assert math.isclose(p3b, expected, rel_tol=0, abs_tol=1e-6), (
-            f"post-remove placed mismatch for {graph_label}"
-        )
-        assert math.isclose(r3b, demand - expected, rel_tol=0, abs_tol=1e-6), (
-            f"post-remove remaining mismatch for {graph_label}"
-        )
-    else:
-        assert p3a <= expected + 1e-6, (
-            f"pre-remove placed exceeds expected for {graph_label}"
-        )
-        assert math.isclose(p3a + r3a, demand, rel_tol=0, abs_tol=1e-6), (
-            f"pre-remove accounting mismatch for {graph_label}"
-        )
-        assert p3b <= expected + 1e-6, (
-            f"post-remove placed exceeds expected for {graph_label}"
-        )
-        assert math.isclose(p3b + r3b, demand, rel_tol=0, abs_tol=1e-6), (
-            f"post-remove accounting mismatch for {graph_label}"
-        )
diff --git a/tests/py/test_pooled.py b/tests/py/test_pooled.py
new file mode 100644
index 0000000..f8a4a4c
--- /dev/null
+++ b/tests/py/test_pooled.py
@@ -0,0 +1,419 @@
+"""Pooled ShortestPaths sources (docs/semantics.md, section 7): one split per shared router,
+attribution to sources by highest averages, the equal source allocation's entry that cannot pass anything,
+Lossy forwarding through a source, weights read once per epoch, the first-hop experiment,
+increments and epochs. The values are derived by hand; the random tests compare every field with the independent reference of
+``source_allocation_oracle.py`` and check that each source's record uses only its own route."""
+
+from __future__ import annotations
+
+import random
+
+import pytest
+from helpers import build, dag_of, exact, shortest
+from source_allocation_oracle import INF, PooledReference
+
+import netgraph_core as ngc
+
+T = ngc.Termination
+EB = ngc.RouteAllocation.EQUAL
+W = ngc.RouteAllocation.WEIGHTED
+SNAPSHOT = ngc.WeightBasis.RESIDUAL_SNAPSHOT
+LOSSY = ngc.Admission.LOSSY
+LOSSLESS = ngc.Admission.LOSSLESS
+EDGES = ngc.OutputOptions(edge_flows=True)
+
+# The graphs of the ledger, every edge written in EdgeId order: (u, v, capacity, cost).
+POOL = [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 1, 1)]  # {0, 1} -> 3
+B1 = [(0, 3, 2, 1), (1, 2, 10, 1), (2, 3, 10, 2)]  # {0, 1} -> 3
+B3Z = [(0, 2, 0, 1), (1, 2, 10, 1)]  # {0, 1} -> 2
+B3P = [(0, 2, 10, 1), (1, 2, 0, 1)]  # {0, 1} -> 2
+CHAIN = [(0, 2, 3, 1), (1, 0, 10, 1)]  # {0, 1} -> 2: source 1's route passes source 0
+SNAP = [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 10, 1), (2, 3, 10, 1)]  # {0, 1} -> 3
+PRIV = [(0, 2, 4, 1), (1, 2, 6, 1)]  # {0, 1} -> 2
+INC = [(0, 2, 1, 1), (1, 2, 3, 1)]  # {0, 1} -> 2
+ONE = [(0, 1, 10, 1)]
+RC = [(0, 1, 1, 1), (0, 1, 1, 1)]
+
+
+def cfg(allocation=EB, admission=LOSSLESS, routing=None, weight_basis=None):
+    return ngc.FlowPolicyConfig(
+        routing=shortest(routing, allocation=allocation, weight_basis=weight_basis),
+        admission=admission,
+    )
+
+
+def policy(edges, sources, dest, config, n=None, residual=None):
+    g = build(n or 1 + max(max(u, v) for u, v, *_ in edges), edges)
+    ledger = ngc.FlowLedger(g, residual)
+    return g, ledger, ngc.FlowPolicy(ledger, sources, dest, config)
+
+
+def rows(r):
+    """by_source as (source, offered, admitted, delivered, source_drops, dropped) tuples."""
+    return [
+        (
+            x.source,
+            x.offered,
+            x.admitted,
+            x.delivered,
+            x.source_drops,
+            x.total_edge_drops,
+        )
+        for x in r.by_source
+    ]
+
+
+def records(p):
+    """Per record: (its one source, its edges, its delivery)."""
+    return [(rec.sources, rec.edge_flows, rec.delivered) for rec in p.records()]
+
+
+def test_b_pooled():
+    # RR(2, 2) = (1, 1) injected; router 2 holds 2 and splits (1, 1) over e2, e3; e2's unit
+    # goes to source 0 by H(1, [1, 1]) = [1, 0], e3's to source 1. Split separately, both units
+    # would take e2 (capacity 1) and only 1 would fit.
+    _, _, p = policy(POOL, [0, 1], 3, cfg())
+    r = p.place(2, EDGES)
+    assert (r.call_delivered, r.termination, r.edge_flows.tolist()) == (
+        2,
+        T.COMPLETE,
+        [1, 1, 1, 1],
+    )
+    assert rows(r) == [(0, None, 1, 1, 0, 0), (1, None, 1, 1, 0, 0)]
+    assert records(p) == [([0], [(0, 1), (2, 1)], 1), ([1], [(1, 1), (3, 1)], 1)]
+    # 3 would give e2 two units: the unlimited request admits 2.
+    _, _, p = policy(POOL, [0, 1], 3, cfg())
+    r = p.place(INF)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (
+        2,
+        INF,
+        T.EXHAUSTED,
+    )
+    assert (r.requested, r.unadmitted, r.offered) == (INF, None, None)
+    # Capacity weights (1, 1) are equal: highest averages is the round robin.
+    _, _, p = policy(POOL, [0, 1], 3, cfg(W))
+    assert p.place(2).call_delivered == 2
+
+
+def test_lossy_attribution_by_arrivals():
+    # Injections (2, 2); router 2 holds 4: (2, 2) over e2, e3, each attributed
+    # H(2, [2, 2]) = [1, 1] (then [1, 1] remain for e3); each edge carries 1 of its 2 arrivals,
+    # H(1, [1, 1]) = [1, 0]: source 0 delivers 2, source 1 drops one unit on each.
+    _, _, p = policy(POOL, [0, 1], 3, cfg(admission=LOSSY))
+    r = p.place(4)
+    assert (r.call_delivered, r.termination, r.call_edge_drops) == (
+        2,
+        T.COMPLETE,
+        [(2, 1), (3, 1)],
+    )
+    assert rows(r) == [(0, 2, 2, 2, 0, 0), (1, 2, 2, 0, 0, 2)]
+    assert (r.offered, r.admitted, r.unadmitted, r.edge_drops) == (
+        4,
+        4,
+        0,
+        [(2, 1), (3, 1)],
+    )
+
+
+@pytest.mark.parametrize(
+    ("edges", "lossless"),
+    [(B3Z, 0), (B3P, 1)],
+    ids=["zero-first", "positive-first"],
+)
+def test_pooled_source_behind_a_zero_link(edges, lossless):
+    # Lossless admits a total only when it gives the source behind the zero edge
+    # nothing: RR(1) gives source 0 the unit, RR(2) gives source 1 one.
+    _, _, p = policy(edges, [0, 1], 2, cfg())
+    r = p.place(10)
+    assert (r.call_delivered, r.termination) == (lossless, T.EXHAUSTED)
+    assert [rec.delivered for rec in p.records()] == [lossless, 0]
+    # The same with weights: a share without a usable route is not admitted.
+    _, _, p = policy(edges, [0, 1], 2, cfg(W))
+    assert p.place(10).call_delivered == lossless
+
+
+def test_lossy_entry_that_cannot_pass():
+    # EB keeps the zero edge and drops source 0's 5 there.
+    _, _, p = policy(B3Z, [0, 1], 2, cfg(admission=LOSSY))
+    r = p.place(10)
+    assert (
+        r.call_delivered,
+        r.termination,
+        r.call_edge_drops,
+        r.call_source_drops,
+    ) == (
+        5,
+        T.COMPLETE,
+        [(0, 5)],
+        0,
+    )
+    # W gives the zero edge weight 0: source 0 has no member, its 5 is lost at the source.
+    _, _, p = policy(B3Z, [0, 1], 2, cfg(W, LOSSY))
+    r = p.place(10)
+    assert (
+        r.call_delivered,
+        r.termination,
+        r.call_edge_drops,
+        r.call_source_drops,
+    ) == (
+        5,
+        T.COMPLETE,
+        [],
+        5,
+    )
+    assert rows(r) == [(0, 5, 5, 0, 5, 0), (1, 5, 5, 5, 0, 0)]
+    assert (r.offered, r.source_drops, r.delivered) == (10, 5, 5)
+
+
+def test_equal_source_allocation_limits_the_total():
+    # RR(5, 2) = (3, 2) would put 3 on e0 (capacity 2): 4, rows (2, 2).
+    _, _, p = policy(B1, [0, 1], 3, cfg())
+    r = p.place(12)
+    assert (r.call_delivered, r.termination) == (4, T.EXHAUSTED)
+    assert [x.delivered for x in r.by_source] == [2, 2]
+    # Lossy offers (6, 6): source 0 drops 4 on e0.
+    _, _, p = policy(B1, [0, 1], 3, cfg(admission=LOSSY))
+    r = p.place(12)
+    assert (r.call_delivered, r.call_edge_drops) == (8, [(0, 4)])
+
+
+def test_transit_through_a_source():
+    # Injections (5, 5); e1 carries source 1's 5 to node 0, which holds 10 for e0 (3):
+    # carried H(3, [5, 5]) = [2, 1].
+    _, _, p = policy(CHAIN, [0, 1], 2, cfg(admission=LOSSY))
+    r = p.place(10)
+    assert (r.call_delivered, r.call_edge_drops) == (3, [(0, 7)])
+    assert rows(r) == [(0, 5, 5, 2, 0, 3), (1, 5, 5, 1, 0, 4)]
+    assert records(p) == [([0], [(0, 2)], 2), ([1], [(0, 1), (1, 5)], 1)]
+    # Lossless: e0 carries the whole total, so 3, as RR(3) = (2, 1).
+    _, _, p = policy(CHAIN, [0, 1], 2, cfg())
+    r = p.place(INF)
+    assert (r.call_delivered, [x.delivered for x in r.by_source]) == (3, [2, 1])
+    # The first-hop experiment: source 0 injects e0's 3, source 1 e1's 10; node 0 adds
+    # source 1's 10 of transit on e0: arrivals (3, 10), carried H(3, [3, 10]) = [0, 3].
+    _, _, p = policy(CHAIN, [0, 1], 2, cfg(admission=LOSSY))
+    r = p.place(INF)
+    assert (r.call_delivered, r.termination, r.requested, r.offered) == (
+        3,
+        T.EXHAUSTED,
+        INF,
+        13,
+    )
+    assert r.edge_drops == [(0, 10)]
+    assert rows(r) == [(0, 3, 3, 0, 0, 3), (1, 10, 10, 3, 0, 7)]
+
+
+def test_residual_weights_on_the_common_view():
+    # Weights read once, on the residual at the first positive call's entry: e2 2, e3 10;
+    # router 2: H(12, [2, 10]) = (2, 10); RR(12) = (6, 6); each member attributed by highest
+    # averages over what the sources still hold: e2 H(2, [6, 6]) = [1, 1], e3 H(10, [5, 5]).
+    _, _, p = policy(
+        SNAP, [0, 1], 3, cfg(W, weight_basis=SNAPSHOT), residual=[10, 10, 2, 10]
+    )
+    r = p.place(INF)
+    assert (r.call_delivered, [x.delivered for x in r.by_source]) == (12, [6, 6])
+    assert records(p) == [
+        ([0], [(0, 6), (2, 1), (3, 5)], 6),
+        ([1], [(1, 6), (2, 1), (3, 5)], 6),
+    ]
+
+
+def test_weights_frozen_for_the_epoch():
+    # Another owner holds 8 of e2 at the first call: weights (2, 10) for the epoch, also
+    # after the owner leaves (weights read again would give [6, 6, 6, 6]).
+    g = build(4, SNAP)
+    ledger = ngc.FlowLedger(g)
+    holder = ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.OPTIMIZED, support=dag_of(g, [2])
+        )
+    )
+    other = ngc.FlowPolicy(ledger, 2, 3, holder)
+    assert other.place(8).call_delivered == 8
+    p = ngc.FlowPolicy(ledger, [0, 1], 3, cfg(W, weight_basis=SNAPSHOT))
+    assert p.place(2).call_delivered == 2
+    other.remove()
+    r = p.place(10, EDGES)
+    assert (r.call_delivered, r.edge_flows.tolist()) == (10, [6, 6, 2, 10])
+
+
+def test_first_hop_experiment():
+    # Every source injects its first edges' residual: 4 + 6.
+    _, _, p = policy(PRIV, [0, 1], 2, cfg(admission=LOSSY))
+    r = p.place(INF)
+    assert (r.call_delivered, r.termination, r.requested, r.offered) == (
+        10,
+        T.EXHAUSTED,
+        INF,
+        10,
+    )
+    for finite in (1, 0):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "finite placement after infinite placement requires a new epoch"
+            ),
+        ):
+            p.place(finite)
+
+
+def test_inc():
+    # RR(3) = (2, 1) does not fit e0 (1): call 1 admits 2; call 2 targets 3 again: 0.
+    _, _, p = policy(INC, [0, 1], 2, cfg())
+    a, b = p.place(3), p.place(1)
+    assert (a.call_delivered, a.termination, b.call_delivered, b.termination) == (
+        2,
+        T.EXHAUSTED,
+        0,
+        T.EXHAUSTED,
+    )
+    assert (b.requested, b.admitted, b.unadmitted, b.offered) == (4, 2, 2, None)
+    # Lossy: call 1 injects (2, 1) and drops 1 on e0; call 2 injects RR(4) - RR(3) = (0, 1).
+    _, _, p = policy(INC, [0, 1], 2, cfg(admission=LOSSY))
+    a, b = p.place(3), p.place(1)
+    assert (
+        a.call_delivered,
+        a.call_edge_drops,
+        b.call_delivered,
+        b.call_edge_drops,
+    ) == (2, [(0, 1)], 1, [])
+    assert (b.requested, b.offered, b.delivered, b.edge_drops, b.unadmitted) == (
+        4,
+        4,
+        3,
+        [(0, 1)],
+        0,
+    )
+    assert rows(b) == [(0, 2, 2, 1, 0, 1), (1, 2, 2, 2, 0, 0)]
+    # Another owner holds 8 of 10: call 1 admits 2; it leaves and places 5; call 2 targets
+    # 3 on the free 3 plus the policy's own 2.
+    g = build(2, ONE)
+    ledger = ngc.FlowLedger(g)
+    other = ngc.FlowPolicy(ledger, 0, 1, cfg())
+    other.place(8)
+    p = ngc.FlowPolicy(ledger, 0, 1, cfg())
+    assert p.place(5).call_delivered == 2
+    other.remove()
+    other.place(5)
+    r = p.place(1)
+    assert (r.call_delivered, r.requested, r.admitted, r.unadmitted) == (1, 6, 3, 3)
+    # Two parallel unit edges: Lossy 1 then 1 drops the second unit on e0 (RR(1) again);
+    # one call of 2 carries both; Lossless 1 then 1 fills both.
+    _, _, p = policy(RC, 0, 1, cfg(admission=LOSSY))
+    assert [p.place(1).call_delivered, p.place(1).call_delivered] == [1, 0]
+    _, _, p = policy(RC, 0, 1, cfg(admission=LOSSY))
+    assert p.place(2).call_delivered == 2
+    _, _, p = policy(RC, 0, 1, cfg())
+    assert [p.place(1).call_delivered, p.place(1, EDGES).edge_flows.tolist()] == [
+        1,
+        [1, 1],
+    ]
+
+
+def random_case(rng):
+    """A small graph (cycles and parallel edges allowed), usually several sources, and edges
+    biased toward the destinations so that most sources have a route."""
+    n = rng.randint(3, 7)
+    nodes = list(range(n))
+    rng.shuffle(nodes)
+    k = rng.randint(2, min(3, n - 1)) if rng.random() < 0.8 else 1
+    sources = nodes[:k]
+    dests = nodes[k : k + rng.randint(1, min(2, n - k))]
+    edges = []
+    for _ in range(rng.randint(n, 2 * n + 3)):
+        u = rng.randrange(n)
+        v = rng.choice(dests) if rng.random() < 0.3 else rng.randrange(n)
+        if u != v:
+            edges.append((u, v, rng.choice([0, 1, 2, 3, 5, 8]), rng.randint(1, 3)))
+    if not edges:
+        edges.append((sources[0], dests[0], 1, 1))
+    return n, edges, sources, dests
+
+
+def compare(where, r, want, p):
+    got = {
+        "call_delivered": r.call_delivered,
+        "termination": r.termination.name,
+        "call_edge_drops": r.call_edge_drops,
+        "call_source_drops": r.call_source_drops,
+        "requested": r.requested,
+        "offered": r.offered,
+        "admitted": r.admitted,
+        "delivered": r.delivered,
+        "unadmitted": r.unadmitted,
+        "source_drops": r.source_drops,
+        "drops": r.edge_drops,
+        "by_source": rows(r),
+        "records": {
+            rec.sources[0]: (rec.edge_flows, rec.delivered) for rec in p.records()
+        },
+    }
+    for key, value in want.items():
+        assert got[key] == value, (where, key, got[key], value)
+
+
+@pytest.mark.parametrize("seed", range(400))
+def test_random_against_reference(seed):
+    # Random graphs with masks, zero-capacity edges, nonuniform costs and a partial
+    # residual; EB and W (capacity or residual weights), both admissions, multipath or the
+    # canonical path; a series of calls. Every field equals the reference, the accounting
+    # identities hold, and each record's edges lie in its own route.
+    rng = random.Random(seed)
+    n, edges, sources, dests = random_case(rng)
+    g = build(n, edges)
+    m = g.num_edges()
+    cap = [int(x) for x in g.edge_capacity_units()]
+    residual = [rng.randint(0, c) if rng.random() < 0.3 else c for c in cap]
+    xn = [
+        v
+        for v in range(n)
+        if v not in sources and v not in dests and rng.random() < 0.15
+    ]
+    xe = [e for e in range(m) if rng.random() < 0.1]
+    kernel = rng.choice(["EB", "W"])
+    lossy = rng.random() < 0.5
+    multipath = rng.random() < 0.7
+    # W's weights: the capacities, or the residual snapshot at preparation (FEWER_HOPS: the
+    # tie rule never changes them).
+    basis = (
+        rng.choice(["CAPACITY", "RESIDUAL_SNAPSHOT"]) if kernel == "W" else "CAPACITY"
+    )
+    config = cfg(
+        EB if kernel == "EB" else W,
+        LOSSY if lossy else LOSSLESS,
+        ngc.ShortestPaths(multipath=multipath),
+        weight_basis=SNAPSHOT if basis == "RESIDUAL_SNAPSHOT" else None,
+    )
+    ledger = ngc.FlowLedger(g, residual)
+    eligibility = g.eligibility(excluded_nodes=xn, excluded_edges=xe)
+    p = ngc.FlowPolicy(ledger, sources, dests, config, eligibility)
+    ref = PooledReference(
+        g, sources, dests, kernel, lossy, residual, multipath, basis, xn, xe
+    )
+    calls = [rng.choice([0, 1, 2, 3, 5, 9]) for _ in range(rng.randint(1, 4))]
+    if rng.random() < 0.3:
+        calls.append(INF)
+    for i, offer in enumerate(calls):
+        r = p.place(offer)
+        want = ref.place(offer)
+        compare((seed, i, offer), r, want, p)
+        if lossy:
+            assert (
+                r.offered
+                == r.source_drops + sum(x for _, x in r.edge_drops) + r.delivered
+            )
+        elif offer != INF and not ref.infinite:
+            assert r.requested == r.unadmitted + r.delivered
+        for field in ("admitted", "delivered", "source_drops", "total_edge_drops"):
+            total = sum(getattr(x, field) for x in r.by_source)
+            state = r.edge_drops if field == "total_edge_drops" else getattr(r, field)
+            if field == "total_edge_drops":
+                state = sum(x for _, x in state)
+            if ref.roster or not lossy:
+                assert total == state, (seed, field)
+        for rec in p.records():
+            route = {int(e) for e in rec.route.via_edges()}
+            assert {e for e, _ in rec.edge_flows} <= route, (seed, rec.sources)
+            assert {e for e, _ in rec.edge_drops} <= route, (seed, rec.sources)
+        carried = ledger.carried().tolist()
+        assert all(0 <= a <= c for a, c in zip(carried, residual, strict=True)), seed
diff --git a/tests/py/test_profiling.py b/tests/py/test_profiling.py
deleted file mode 100644
index 96acd35..0000000
--- a/tests/py/test_profiling.py
+++ /dev/null
@@ -1,100 +0,0 @@
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-import sys
-import textwrap
-
-
-def _run_profile_subprocess(
-    code: str, *, extra_env: dict[str, str] | None = None
-) -> subprocess.CompletedProcess[str]:
-    env = os.environ.copy()
-    env["NGRAPH_CORE_PROFILE"] = "1"
-    if extra_env:
-        env.update(extra_env)
-    return subprocess.run(
-        [sys.executable, "-c", code],
-        check=True,
-        capture_output=True,
-        text=True,
-        env=env,
-    )
-
-
-def _calls_for(stderr: str, scope: str) -> int:
-    match = re.search(rf"^{re.escape(scope)}:\n  calls: (\d+)\n", stderr, re.MULTILINE)
-    assert match, stderr
-    return int(match.group(1))
-
-
-def test_profiling_dump_and_reset_lifecycle_via_python_api() -> None:
-    code = textwrap.dedent(
-        """
-        import sys
-        import numpy as np
-        import netgraph_core as ngc
-
-        src = np.array([0, 1], dtype=np.int32)
-        dst = np.array([1, 2], dtype=np.int32)
-        cap = np.array([1.0, 1.0], dtype=np.float64)
-        cost = np.array([1, 1], dtype=np.int64)
-        ext = np.array([0, 1], dtype=np.int64)
-        graph = ngc.StrictMultiDiGraph.from_arrays(3, src, dst, cap, cost, ext)
-        algs = ngc.Algorithms(ngc.Backend.cpu())
-        gh = algs.build_graph(graph)
-
-        sys.stderr.write("===FIRST===\\n")
-        for _ in range(3):
-            algs.spf(gh, 0, 2)
-        ngc.profiling_dump()
-        ngc.profiling_reset()
-        sys.stderr.write("===SECOND===\\n")
-        ngc.profiling_dump()
-        print(ngc.profiling_enabled())
-        """
-    )
-    proc = _run_profile_subprocess(code)
-    assert proc.stdout.strip() == "True"
-    first = proc.stderr.split("===FIRST===\n", 1)[1].split("===SECOND===\n", 1)[0]
-    second = proc.stderr.split("===SECOND===\n", 1)[1]
-    assert _calls_for(first, "shortest_paths_core") == 3
-    assert "shortest_paths_core:" not in second
-
-
-def test_profiling_threaded_scope_counts_match_serial() -> None:
-    code = textwrap.dedent(
-        """
-        import concurrent.futures
-        import os
-        import numpy as np
-        import netgraph_core as ngc
-
-        mode = os.environ["P8_MODE"]
-        src = np.array([0, 1], dtype=np.int32)
-        dst = np.array([1, 2], dtype=np.int32)
-        cap = np.array([1.0, 1.0], dtype=np.float64)
-        cost = np.array([1, 1], dtype=np.int64)
-        ext = np.array([0, 1], dtype=np.int64)
-        graph = ngc.StrictMultiDiGraph.from_arrays(3, src, dst, cap, cost, ext)
-        algs = ngc.Algorithms(ngc.Backend.cpu())
-        gh = algs.build_graph(graph)
-
-        def worker(iters: int) -> None:
-            for _ in range(iters):
-                algs.spf(gh, 0, 2)
-
-        ngc.profiling_reset()
-        if mode == "serial":
-            worker(20)
-        else:
-            with concurrent.futures.ThreadPoolExecutor(max_workers=4) as pool:
-                list(pool.map(worker, [5, 5, 5, 5]))
-        ngc.profiling_dump()
-        """
-    )
-    serial = _run_profile_subprocess(code, extra_env={"P8_MODE": "serial"})
-    threaded = _run_profile_subprocess(code, extra_env={"P8_MODE": "threaded"})
-    assert _calls_for(serial.stderr, "shortest_paths_core") == 20
-    assert _calls_for(threaded.stderr, "shortest_paths_core") == 20
diff --git a/tests/py/test_programs.py b/tests/py/test_programs.py
new file mode 100644
index 0000000..9d6f1c3
--- /dev/null
+++ b/tests/py/test_programs.py
@@ -0,0 +1,2745 @@
+"""Forwarding programs: what every model exports, CentralizedTE with a support, the weight
+bases, ForwardingProgram.from_routes, Pinned over programs, the lossless bound, the loss rule
+inside one program (cycles included), replay under a failure mask, stale forwarding with black
+holes, the operations evaluate, replace and forward with their epochs and flags, the per-entry
+records and the by_tunnel rows. Every expected value is derived by hand from the rules of
+docs/semantics.md;
+none is read from a build. The independent
+reference of the property tests is program_oracle.py."""
+
+from __future__ import annotations
+
+import random
+
+import pytest
+from helpers import (
+    INF,
+    build,
+    exact,
+    full_ledger_state,
+    shortest,
+    sweep_python_allocation,
+)
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+LOSSY = ngc.Admission.LOSSY
+LOSSLESS = ngc.Admission.LOSSLESS
+EB = ngc.RouteAllocation.EQUAL
+W = ngc.RouteAllocation.WEIGHTED
+MF = ngc.RouteAllocation.OPTIMIZED
+UP = ngc.TunnelStatus.UP
+FAILED = ngc.TunnelStatus.FAILED
+BLACKHOLED = ngc.TunnelStatus.BLACKHOLED
+T = ngc.Termination
+
+
+# ---------------------------------------------------------------- builders
+
+
+def graph(n, rows):
+    """A Graph from (u, v, capacity[, cost]) rows written in EdgeId order (checked)."""
+    g = ngc.Graph(
+        n,
+        [r[0] for r in rows],
+        [r[1] for r in rows],
+        [r[2] for r in rows],
+        [r[3] if len(r) > 3 else 1 for r in rows],
+        1.0,
+    )
+    assert [int(i) for i in g.input_positions()] == list(range(len(rows)))
+    return g
+
+
+def path(g, edges):
+    return ngc.Path(g, [[e] for e in edges])
+
+
+def dag(g, edges):
+    """The PredecessorDAG of a set of EdgeIds."""
+    per = [[] for _ in range(g.num_nodes())]
+    for e in sorted(edges):
+        per[int(g.edge_destinations()[e])].append(e)
+    offsets, parents, via = [0], [], []
+    for v in range(g.num_nodes()):
+        for e in per[v]:
+            parents.append(int(g.edge_sources()[e]))
+            via.append(e)
+        offsets.append(len(via))
+    return ngc.PredecessorDAG.from_csr(g, offsets, parents, via)
+
+
+def tunnels(g, sources, destinations, specs, **options):
+    """A supplied program of tunnels: specs are (head, [edges], weight)."""
+    routes = [ngc.RouteDefinition(h, path(g, es), weight=w) for h, es, w in specs]
+    return ngc.ForwardingProgram.from_routes(
+        g, sources, destinations, routes, **options
+    )
+
+
+def pinned(
+    g, program, admission=LOSSLESS, eligibility=None, black_holes=None, ledger=None
+):
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.Pinned(program, black_holes=black_holes), admission=admission
+    )
+    return ngc.FlowPolicy(
+        ledger or ngc.FlowLedger(g),
+        list(program.sources),
+        list(program.destinations),
+        cfg,
+        eligibility,
+    )
+
+
+def shortest_paths(allocation=EB, admission=LOSSLESS, routing=None, **fields):
+    return ngc.FlowPolicyConfig(
+        routing=shortest(routing, allocation=allocation, **fields), admission=admission
+    )
+
+
+def global_(source_allocation=None, support=None):
+    return ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(
+            source_allocation=source_allocation or ngc.SourceAllocation.OPTIMIZED,
+            support=support,
+        )
+    )
+
+
+def rows(result):
+    """The by_tunnel rows as (index, head, status, assigned, delivered, dropped)."""
+    return [
+        (t.entry_id, t.head, t.status, t.assigned, t.delivered, t.total_edge_drops)
+        for t in result.by_tunnel
+    ]
+
+
+def listing(program):
+    """A program's tunnels as (head, edges, weight)."""
+    return [(t.head, list(t.edges), t.weight) for t in program.tunnels]
+
+
+def par2(a, b):
+    return graph(2, [(0, 1, a), (0, 1, b)])
+
+
+ONE = [(0, 1, 10)]
+B1 = [(0, 3, 2), (1, 2, 10), (2, 3, 10, 2)]
+B2 = [(0, 1, 4), (0, 2, 2), (1, 2, 10)]
+ES = [(0, 1, 10), (0, 2, 10), (1, 3, 2), (2, 3, 10, 2)]
+G1U = [(0, 1, 2), (0, 2, 10), (1, 3, 2), (2, 3, 10)]
+PINLOSS = [(0, 1, 10), (0, 2, 10), (1, 3, 2), (2, 3, 10)]
+DIAM = [(0, 1, 100), (0, 2, 100), (1, 3, 100), (2, 3, 100)]
+POOL2 = [(0, 2, 10), (1, 2, 10), (2, 3, 10), (2, 3, 10)]
+REL = [(0, 2, 10), (1, 2, 10), (2, 3, 10)]
+TUN = [(0, 1, 10), (0, 2, 10), (1, 3, 10), (2, 3, 10)]
+MB = [(0, 1, 10), (0, 2, 10), (0, 3, 10), (1, 4, 10), (2, 4, 10), (3, 4, 10)]
+SURV = [(0, 3, 3), (1, 3, 1), (2, 3, 5)]
+RB = [(0, 2, 5), (1, 2, 5), (1, 2, 5, 2)]
+INC = [(0, 2, 1), (1, 2, 3)]
+SHARE = [(0, 1, 4), (1, 2, 10), (1, 2, 10)]
+HIER = [(0, 2, 1000), (1, 2, 1000), (2, 3, 1)]
+
+
+def cyc(x, y):
+    """CYC(x, y): tunnel 0 = [e6, e0, e1, e3, e5] meets X (e0) then Y (e3); tunnel 1 = [e7, e3,
+    e4, e0, e2] meets Y then X."""
+    return graph(
+        6,
+        [
+            (0, 1, x),
+            (1, 2, 1000),
+            (1, 5, 1000),
+            (2, 3, y),
+            (3, 0, 1000),
+            (3, 5, 1000),
+            (4, 0, 1000),
+            (4, 2, 1000),
+        ],
+    )
+
+
+CYC_T0 = [6, 0, 1, 3, 5]
+CYC_T1 = [7, 3, 4, 0, 2]
+
+
+# ---------------------------------------------------------------- P: exported programs
+
+
+def test_global_export():
+    # B1, CentralizedTE optimized and equal, place(12).
+    g = graph(4, B1)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, global_())
+    r = p.place(12)
+    prog = r.program
+    assert listing(prog) == [(0, [0], 2), (1, [1, 2], 10)]
+    assert [t.entry_id for t in prog.tunnels] == [0, 1]
+    assert [t.local_index for t in prog.tunnels] == [0, 0]
+    assert [t.destination for t in prog.tunnels] == [3, 3]
+    assert [t.path_cost for t in prog.tunnels] == [1, 3]
+    assert prog.source_weights == ((0, 2), (1, 10))
+    assert prog.sources == (0, 1) and prog.destinations == (3,)
+    assert [rec.entry_id for rec in p.records()] == [None, None]
+    assert rows(r) == [(0, 0, UP, 2, 2, 0), (1, 1, UP, 10, 10, 0)]
+    assert p.program.tunnels == prog.tunnels or listing(p.program) == listing(prog)
+    eq = ngc.FlowPolicy(
+        ngc.FlowLedger(g), [0, 1], 3, global_(ngc.SourceAllocation.EQUAL)
+    ).place(12)
+    assert eq.call_delivered == 4
+    assert listing(eq.program) == [(0, [0], 2), (1, [1, 2], 2)]
+    assert eq.program.source_weights is None
+
+
+def test_single_source_decomposed():
+    # One source is decomposed too; ShortestPaths OPTIMIZED.
+    g = graph(4, ES)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_()).place(12)
+    assert listing(r.program) == [(0, [0, 2], 2), (0, [1, 3], 10)]
+    assert [t.local_index for t in r.program.tunnels] == [0, 1]
+    assert [t.path_cost for t in r.program.tunnels] == [2, 3]
+    assert r.total_cost == 34
+    assert r.program.source_weights == ((0, 12),)
+    mf = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, shortest_paths(MF)).place(12)
+    assert mf.call_delivered == 2
+    assert listing(mf.program) == [(0, [0, 2], 2)]
+    assert mf.program.source_weights == ((0, 2),)
+
+
+def test_shortest_paths_split_program():
+    # A ShortestPaths split program lists no tunnel.
+    g = graph(4, POOL2)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, shortest_paths()).place(2)
+    assert r.program.tunnels == ()
+    assert r.program.source_weights is None
+    assert r.program.sources == (0, 1) and r.program.destinations == (3,)
+    assert r.by_tunnel == ()
+
+
+def test_zero_supply_kept_and_lifecycle():
+    # Every roster source has a source weight, zero included.
+    g = graph(3, [(0, 2, 5), (1, 2, 5)])
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, global_()).place(1)
+    assert listing(r.program) == [(0, [0], 1)]
+    assert r.program.source_weights == ((0, 1), (1, 0))
+    # None before the first positive call and after remove().
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, global_())
+    assert p.program is None
+    z = p.place(0)
+    assert z.program is None and z.by_tunnel == ()
+    p.place(3)
+    assert p.program is not None
+    p.remove()
+    assert p.program is None and p.place(0).program is None
+
+
+def test_replay_reproduces_the_solve_and_keeps_the_mask():
+    # B1's optimized program forwarded by Pinned reproduces the solve.
+    g = graph(4, B1)
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, global_()).place(12).program
+    p = pinned(g, prog)
+    r = p.place(12, ngc.OutputOptions(edge_flows=True))
+    assert (r.call_delivered, r.termination) == (12, T.COMPLETE)
+    assert r.edge_flows.tolist() == [2, 10, 10]
+    assert pinned(g, prog).place(INF).call_delivered == 12
+    # The policy's program is the configured one.
+    assert listing(p.program) == listing(prog) and listing(r.program) == listing(prog)
+    # The producer's mask is saved: no replay brings source 1 back.
+    masked = ngc.FlowPolicy(
+        ngc.FlowLedger(g), [0, 1], 3, global_(), g.eligibility(excluded_nodes=[1])
+    ).place(12)
+    assert masked.call_delivered == 2 and listing(masked.program) == [(0, [0], 2)]
+    lossy = pinned(g, masked.program, LOSSY).replace(12)
+    assert lossy.call_delivered == 2 and [row.offered for row in lossy.by_source] == [
+        12,
+        0,
+    ]
+
+
+def test_empty_roster_program():
+    # An empty roster installs an empty program.
+    g = graph(2, ONE)
+    p = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 1, shortest_paths(), g.eligibility(excluded_nodes=[0])
+    )
+    r = p.place(1)
+    assert r.termination == T.NO_ROUTE
+    assert r.program is not None and r.program.tunnels == ()
+    assert r.program.sources == (0,) and not r.routes_changed and not r.weights_changed
+
+
+# ---------------------------------------------------------------- G: CentralizedTE with a support
+
+
+def test_global_support():
+    # Only the trimmed support carries traffic.
+    g = graph(4, ES)
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_(support=dag(g, [1, 3]))).place(
+        12, ngc.OutputOptions(min_cut=True)
+    )
+    assert (r.call_delivered, r.total_cost) == (10, 30)
+    assert r.min_cut is None and r.marginal_cost_curve is None
+    assert listing(r.program) == [(0, [1, 3], 10)]
+    assert (
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_()).place(12).call_delivered
+        == 12
+    )
+    r2 = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 3, global_(support=dag(g, [0, 1, 3]))
+    ).place(12, ngc.OutputOptions(edge_flows=True))
+    assert r2.call_delivered == 10 and r2.edge_flows.tolist() == [0, 10, 0, 10]
+    # The mask removes the support: an empty roster.
+    r3 = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        3,
+        global_(support=dag(g, [1, 3])),
+        g.eligibility(excluded_edges=[3]),
+    ).place(12)
+    assert (r3.termination, r3.call_delivered, r3.program.tunnels) == (
+        T.NO_ROUTE,
+        0,
+        (),
+    )
+    # The equal source allocation on a support.
+    b2 = graph(3, B2)
+    r4 = ngc.FlowPolicy(
+        ngc.FlowLedger(b2),
+        [0, 1],
+        2,
+        global_(ngc.SourceAllocation.EQUAL, dag(b2, [1, 2])),
+    ).place(12)
+    assert (r4.call_delivered, r4.total_cost) == (4, 4)
+
+
+def test_global_support_wide_cost_and_ownership():
+    # total_cost above 2^64.
+    g = graph(2, [(0, 1, 1 << 40, 1 << 30)])
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, global_(support=dag(g, [0]))).place(
+        1 << 40
+    )
+    assert r.total_cost == 1 << 70
+    # A support of another graph.
+    other = graph(2, [(0, 1, 1)])
+    with pytest.raises(ValueError, match=exact("support belongs to another graph")):
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, global_(support=dag(other, [0])))
+
+
+# ---------------------------------------------------------------- W: weight bases
+
+
+def test_explicit_weights():
+    # Configured (explicit) weights.
+    g = par2(10, 10)
+    cfg = shortest_paths(
+        W, LOSSY, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[1, 2]
+    )
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(
+        12, ngc.OutputOptions(edge_flows=True)
+    )
+    assert r.edge_flows.tolist() == [4, 8]
+    cap = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths(W, LOSSY)).place(
+        12, ngc.OutputOptions(edge_flows=True)
+    )
+    assert cap.edge_flows.tolist() == [6, 6]
+    ll = shortest_paths(W, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[1, 2])
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, ll).place(INF).call_delivered == 15
+    assert ngc.evaluate_demand(g, 0, 1, ngc.EvaluationOptions(ll)).call_delivered == 15
+    # A positive weight on an edge of capacity 0 becomes 0.
+    z = par2(0, 10)
+    cfg = shortest_paths(
+        W, LOSSY, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[5, 1]
+    )
+    r = ngc.FlowPolicy(ngc.FlowLedger(z), 0, 1, cfg).place(7)
+    assert (r.call_delivered, r.call_edge_drops) == (7, [])
+    # A zero weight prunes.
+    cfg = shortest_paths(W, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[0, 3])
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(12).call_delivered == 10
+    cfg = shortest_paths(
+        W, LOSSY, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[0, 3]
+    )
+    r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(12)
+    assert (r.call_delivered, r.call_edge_drops) == (10, [(1, 2)])
+    # Every weight 0.
+    for adm, loss in ((LOSSY, 5), (LOSSLESS, 0)):
+        cfg = shortest_paths(
+            W, adm, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[0, 0]
+        )
+        r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg).place(5)
+        assert (r.termination, r.call_delivered, r.source_drops) == (
+            T.NO_ACTIVE_WEIGHT,
+            0,
+            loss,
+        )
+
+
+def test_snapshot_weights():
+    # Snapshot weights: the tie rule is no weight, the snapshot is frozen.
+    g = par2(10, 10)
+
+    def policy(admission, **fields):
+        ledger = ngc.FlowLedger(g, [2, 10])
+        return ngc.FlowPolicy(ledger, 0, 1, shortest_paths(W, admission, **fields))
+
+    assert policy(LOSSLESS).place(12).call_delivered == 4
+    snap = ngc.WeightBasis.RESIDUAL_SNAPSHOT
+    assert policy(LOSSLESS, weight_basis=snap).place(12).call_delivered == 12
+    p = policy(LOSSY, weight_basis=snap)
+    r1 = p.place(12, ngc.OutputOptions(edge_flows=True))
+    assert r1.edge_flows.tolist() == [2, 10]
+    r2 = p.place(6)
+    assert (r2.call_delivered, r2.call_edge_drops, r2.call_source_drops) == (
+        0,
+        [(0, 1), (1, 5)],
+        0,
+    )
+    # Weighted with HIGHER_HEADROOM is accepted (ShortestPaths): the single path is e1.
+    headroom = ngc.ShortestPaths(
+        tie_break=ngc.RouteTieBreak.HIGHER_HEADROOM, multipath=False
+    )
+    assert policy(LOSSLESS, routing=headroom).place(12).call_delivered == 10
+
+
+def test_weight_texts():
+    g = par2(10, 10)
+    ledger = ngc.FlowLedger(g)
+    explicit = ngc.WeightBasis.EXPLICIT
+    cases = [
+        (
+            shortest_paths(weight_basis=ngc.WeightBasis.CAPACITY),
+            "weight_basis requires allocation=WEIGHTED",
+        ),
+        (
+            shortest_paths(edge_weights=[1, 1]),
+            "edge_weights require weight_basis=EXPLICIT",
+        ),
+        (
+            shortest_paths(W, weight_basis=explicit),
+            "weight_basis=EXPLICIT requires edge_weights",
+        ),
+        (
+            shortest_paths(
+                W, weight_basis=ngc.WeightBasis.CAPACITY, edge_weights=[1, 1]
+            ),
+            "edge_weights require weight_basis=EXPLICIT",
+        ),
+        (
+            shortest_paths(W, weight_basis=explicit, edge_weights=[1, 2, 3]),
+            "edge_weights: expected 2 entries",
+        ),
+        (
+            shortest_paths(W, weight_basis=explicit, edge_weights=[1, 1 << 62]),
+            "edge_weights[1] must be an integer in [0, 2^62)",
+        ),
+    ]
+    for cfg, text in cases:
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.FlowPolicy(ledger, 0, 1, cfg)
+    with pytest.raises(
+        ValueError, match=exact("edge_weights[0] must be an integer in [0, 2^62)")
+    ):
+        ngc.FlowPolicy(
+            ledger, 0, 1, shortest_paths(W, weight_basis=explicit, edge_weights=[-1, 1])
+        )
+    # An entry beyond int64 is refused when the model is built.
+    with pytest.raises(
+        ValueError, match=exact("edge_weights[1] must be an integer in [0, 2^62)")
+    ):
+        shortest_paths(W, weight_basis=explicit, edge_weights=[1, 1 << 64])
+    # The other models take no weights.
+    for model in (
+        lambda **kw: ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.OPTIMIZED, **kw
+        ),
+        lambda **kw: ngc.DistributedTE(ngc.TunnelCount(1), **kw),
+        lambda **kw: ngc.Pinned(tunnels(g, [0], [1], [(0, [0], 1)]), **kw),
+    ):
+        with pytest.raises(TypeError):
+            model(weight_basis=ngc.WeightBasis.CAPACITY)
+        with pytest.raises(TypeError):
+            model(edge_weights=[1, 1])
+    with pytest.raises(TypeError):
+        shortest_paths(W, weight_basis=explicit, edge_weights=[True, 1])
+    cfg = shortest_paths(W, weight_basis=explicit, edge_weights=[1, 2])
+    assert cfg.routing.edge_weights == (1, 2)
+
+
+def test_supported_tunnel_replay_basis():
+    # A T2 program laid out on a support replays on that support: with e0 masked its tunnel
+    # FAILS (the Lossless bound 6); with e0 and e1 masked the head reaches no destination on the
+    # support and leaves the roster (NO_ROUTE; the Lossy offer 4 lost as the demand's source
+    # drops, its row all zero), although e2 still joins 0 to 1.
+    g = graph(2, [(0, 1, 6, 1), (0, 1, 6, 1), (0, 1, 100, 2)])
+    t2 = ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.EQUAL,
+            support=dag(g, [0, 1]),
+            tunnel_count=ngc.TunnelCount(2),
+        )
+    )
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, t2)
+    p.replace(INF)
+    prog = p.program
+    r = pinned(g, prog, eligibility=g.eligibility(excluded_edges=[0])).replace(INF)
+    assert [t.status for t in r.by_tunnel] == [
+        ngc.TunnelStatus.FAILED,
+        ngc.TunnelStatus.UP,
+    ]
+    assert r.call_delivered == 6
+    r = pinned(
+        g, prog, LOSSY, eligibility=g.eligibility(excluded_edges=[0, 1])
+    ).replace(4)
+    assert (r.termination, r.call_delivered, r.call_source_drops) == (
+        ngc.Termination.NO_ROUTE,
+        0,
+        4,
+    )
+    assert [(s.source, s.offered, s.source_drops) for s in r.by_source] == [(0, 0, 0)]
+
+
+# ---------------------------------------------------------------- F: from_routes
+
+
+def test_from_routes_texts():
+    g = par2(4, 8)
+    p0 = path(g, [0])
+    d01 = dag(g, [0, 1])
+    fr = ngc.ForwardingProgram.from_routes
+
+    def raises(text, *args, **kwargs):
+        with pytest.raises(ValueError, match=exact(text)):
+            fr(g, *args, **kwargs)
+
+    raises("sources: the node set is empty", [], [1], [ngc.RouteDefinition(0, p0)])
+    raises(
+        "node 0 is in both endpoint sets: sources and destinations must not overlap",
+        [0],
+        [0],
+        [ngc.RouteDefinition(0, p0)],
+    )
+    raises("routes must not be empty", [0], [1], [])
+    raises(
+        "allocation applies only to PredecessorDAG routes",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, p0)],
+        allocation=EB,
+    )
+    raises(
+        "weight_basis applies only to PredecessorDAG routes",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, p0)],
+        weight_basis=ngc.WeightBasis.CAPACITY,
+    )
+    raises(
+        "edge_weights applies only to PredecessorDAG routes",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, p0)],
+        edge_weights=[1, 1],
+    )
+    raises(
+        "residual applies only to PredecessorDAG routes",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, p0)],
+        residual=[1, 1],
+    )
+    dagr = [ngc.RouteDefinition(0, d01)]
+    # A value outside its enumeration is named by its parameter.
+    raises(
+        "allocation: 99 is not a value of RouteAllocation",
+        [0],
+        [1],
+        dagr,
+        allocation=ngc.RouteAllocation(99),
+    )
+    raises(
+        "weight_basis: 99 is not a value of WeightBasis",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis(99),
+    )
+    raises(
+        "from_routes allocation must be EQUAL or WEIGHTED",
+        [0],
+        [1],
+        dagr,
+        allocation=MF,
+    )
+    raises(
+        "weight_basis requires allocation=WEIGHTED",
+        [0],
+        [1],
+        dagr,
+        weight_basis=ngc.WeightBasis.CAPACITY,
+    )
+    raises(
+        "weight_basis=EXPLICIT requires edge_weights",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+    )
+    raises(
+        "edge_weights require weight_basis=EXPLICIT",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        edge_weights=[1, 1],
+    )
+    raises(
+        "weight_basis=RESIDUAL_SNAPSHOT requires residual",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+    )
+    raises(
+        "residual requires weight_basis=RESIDUAL_SNAPSHOT",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        residual=[4, 8],
+    )
+    raises(
+        "edge_weights: expected 2 entries",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[1],
+    )
+    raises(
+        "edge_weights[1] must be an integer in [0, 2^62)",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[1, 1 << 62],
+    )
+    raises(
+        "residual[0] = 5 is outside [0, edge_capacity_units[0] = 4]",
+        [0],
+        [1],
+        dagr,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        residual=[5, 8],
+    )
+    other = par2(4, 8)
+    raises(
+        "routes[0]: route belongs to another graph",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, path(other, [0]))],
+    )
+    raises("routes[0]: head 1 is not a source", [0], [1], [ngc.RouteDefinition(1, p0)])
+    hop2 = ngc.Path(g, [[0, 1]])
+    raises(
+        "routes[0]: a tunnel has one edge per hop",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, hop2)],
+    )
+    d = graph(4, DIAM)
+    fd = ngc.ForwardingProgram.from_routes
+    with pytest.raises(
+        ValueError, match=exact("routes[0]: the path starts at 0, not at head 1")
+    ):
+        fd(d, [0, 1], [3], [ngc.RouteDefinition(1, path(d, [0, 2]))])
+    with pytest.raises(
+        ValueError, match=exact("routes[0]: the path ends at 1, not at a destination")
+    ):
+        fd(d, [0], [3], [ngc.RouteDefinition(0, path(d, [0]))])
+    with pytest.raises(
+        ValueError,
+        match=exact("routes[0]: the path meets destination 1 before its end"),
+    ):
+        fd(d, [0], [1, 3], [ngc.RouteDefinition(0, path(d, [0, 2]))])
+    with pytest.raises(
+        ValueError, match=exact("routes[0]: no walk from head 0 to a destination")
+    ):
+        fd(d, [0], [3], [ngc.RouteDefinition(0, dag(d, [2]))])
+    for weight in (1 << 62, -1):
+        raises(
+            "routes[0]: weight must be an integer in [0, 2^62)",
+            [0],
+            [1],
+            [ngc.RouteDefinition(0, p0, weight=weight)],
+        )
+    with pytest.raises(TypeError, match=exact("weight must be an integer (got bool)")):
+        ngc.RouteDefinition(0, p0, weight=True)
+    # The routes in list order, each route's checks in order.
+    raises(
+        "routes[0]: weight must be an integer in [0, 2^62)",
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, p0, weight=1 << 62), ngc.RouteDefinition(5, p0)],
+    )
+
+
+def test_from_routes_entries():
+    g = par2(4, 8)
+    prog = ngc.ForwardingProgram.from_routes(
+        g,
+        [0],
+        [1],
+        [
+            ngc.RouteDefinition(0, path(g, [0]), weight=0),
+            ngc.RouteDefinition(0, path(g, [1])),
+        ],
+    )
+    assert [(t.entry_id, t.weight) for t in prog.tunnels] == [(0, 0), (1, 1)]
+    mixed = ngc.ForwardingProgram.from_routes(
+        g,
+        [0],
+        [1],
+        [
+            ngc.RouteDefinition(0, path(g, [1])),
+            ngc.RouteDefinition(0, dag(g, [0, 1])),
+            ngc.RouteDefinition(0, path(g, [0])),
+        ],
+    )
+    assert [(t.entry_id, t.local_index) for t in mixed.tunnels] == [(0, 0), (2, 2)]
+    d = graph(4, DIAM)
+    norm = ngc.ForwardingProgram.from_routes(
+        d, [1, 0, 1], [3], [ngc.RouteDefinition(0, path(d, [0, 2]))]
+    )
+    assert norm.sources == (0, 1)
+    with pytest.raises(TypeError):
+        ngc.ForwardingProgram.from_routes(g, [0], [1], [path(g, [0])])
+
+
+# ---------------------------------------------------------------- Q: from_dag
+
+# DP: links 0->2 and 1->2 of capacity 10, then two parallel links 2->3 of capacity 1 (e2, e3), all
+# cost 1; sources 0 and 1, destination 3 (DAG-pooled). DP3: e3 of capacity 3.
+DP = [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 1, 1)]
+DP3 = [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 3, 1)]
+
+
+def from_dag(g, edges, sources=(0, 1), destinations=3, **options):
+    return ngc.ForwardingProgram.from_dag(
+        g, list(sources), destinations, dag(g, edges), **options
+    )
+
+
+def test_from_dag_pools():
+    # DAG-pooled against DAG-separate: one context splits node 2's two units once (1, 1); two
+    # contexts each put their unit on the first link.
+    g = graph(4, DP)
+    pooled = from_dag(g, [0, 1, 2, 3])
+    whole = dag(g, [0, 1, 2, 3])
+    separate = ngc.ForwardingProgram.from_routes(
+        g, [0, 1], 3, [ngc.RouteDefinition(0, whole), ngc.RouteDefinition(1, whole)]
+    )
+    assert pinned(g, pooled).place(INF).call_delivered == 2
+    assert pinned(g, pooled, LOSSY).place(2).call_delivered == 2
+    assert pinned(g, separate).place(INF).call_delivered == 1
+    assert pinned(g, separate, LOSSY).place(2).call_delivered == 1
+
+
+def test_from_dag_attribution():
+    # LOSSY 3: node 2 splits RR(3, 2) = (2, 1); e2's 2 units go back to the sources by H(2, [2, 1])
+    # = (2, 0), so source 0 loses the dropped unit.
+    g = graph(4, DP)
+    p = pinned(g, from_dag(g, [0, 1, 2, 3]), LOSSY)
+    r = p.place(3)
+    assert (r.call_delivered, r.call_edge_drops) == (2, [(2, 1)])
+    assert [
+        (s.source, s.offered, s.delivered, s.total_edge_drops) for s in r.by_source
+    ] == [
+        (0, 2, 1, 1),
+        (1, 1, 1, 0),
+    ]
+    records = p.records()
+    assert [
+        (
+            rec.edge_flows,
+            rec.edge_drops,
+            sorted(rec.route.via_edges().tolist()),
+            rec.min_route_cost,
+        )
+        for rec in records
+    ] == [
+        ([(0, 2), (2, 1)], [(2, 1)], [0, 2, 3], 2),
+        ([(1, 1), (3, 1)], [], [1, 2, 3], 2),
+    ]
+
+
+def test_from_dag_value():
+    g = graph(4, DP)
+    p = from_dag(g, [0, 1, 2, 3])
+    assert (p.sources, p.destinations, p.tunnels, p.source_weights) == (
+        (0, 1),
+        (3,),
+        (),
+        None,
+    )
+
+
+def test_from_dag_roster():
+    # Without e1, source 1 reaches nothing in the DAG: the roster is {0}, which carries every unit
+    # (a graph roster would keep source 1's share and lose it: Lossless 1).
+    g = graph(4, DP)
+    p = from_dag(g, [0, 2, 3])
+    assert pinned(g, p).place(INF).call_delivered == 2
+    r = pinned(g, p, LOSSY).place(2)
+    assert r.call_delivered == 2
+    assert [
+        (s.source, s.offered, s.delivered, s.source_drops) for s in r.by_source
+    ] == [
+        (0, 2, 2, 0),
+        (1, 0, 0, 0),
+    ]
+
+
+def test_from_dag_empty_roster():
+    # No source reaches the destination in {e2, e3}: an empty roster is allowed; Lossy's offer is
+    # the demand's source drops, Lossless's is undelivered, a zero offer completes.
+    g = graph(4, DP)
+    p = from_dag(g, [2, 3])
+    r = pinned(g, p, LOSSY).place(2)
+    assert (r.termination, r.call_delivered, r.call_source_drops) == (T.NO_ROUTE, 0, 2)
+    assert [(s.offered, s.source_drops) for s in r.by_source] == [(0, 0), (0, 0)]
+    r = pinned(g, p).place(2)
+    assert (r.termination, r.call_delivered, r.call_undelivered) == (T.NO_ROUTE, 0, 2)
+    assert pinned(g, p, LOSSY).place(0).termination == T.COMPLETE
+
+
+def test_from_dag_trimming():
+    # The walks stop at the first destinations: with destinations {2, 3} nothing passes node 2
+    # (Lossless 20); links after a destination (3->4) or into it from outside the sources' walks
+    # (5->3) never carry and are in no record's route.
+    g = graph(4, DP)
+    p = from_dag(g, [0, 1, 2, 3], destinations=[2, 3])
+    assert pinned(g, p).place(INF).call_delivered == 20
+    g6 = graph(6, DP + [(3, 4, 5, 1), (5, 3, 5, 1)])
+    q = pinned(g6, from_dag(g6, [0, 1, 2, 3, 4, 5]))
+    assert q.place(INF).call_delivered == 2
+    records = q.records()
+    assert [sorted(rec.route.via_edges().tolist()) for rec in records] == [
+        [0, 2, 3],
+        [1, 2, 3],
+    ]
+    assert all(e not in (4, 5) for rec in records for e, _ in rec.edge_flows)
+
+
+def test_from_dag_weights():
+    # WCMP on DP3 by capacity: node 2 splits H(4, [1, 3]) = (1, 3): 4; EQUAL: 2. Explicit weights
+    # [1, 1, 0, 1] prune e2: Lossless 1, Lossy 2 delivers 1 with e3 dropping 1. A residual
+    # snapshot [10, 10, 1, 0] gives e3 weight 0: 1.
+    g3 = graph(4, DP3)
+    whole = [0, 1, 2, 3]
+    assert pinned(g3, from_dag(g3, whole, allocation=W)).place(INF).call_delivered == 4
+    assert pinned(g3, from_dag(g3, whole)).place(INF).call_delivered == 2
+    g = graph(4, DP)
+    explicit = from_dag(
+        g,
+        whole,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[1, 1, 0, 1],
+    )
+    assert pinned(g, explicit).place(INF).call_delivered == 1
+    r = pinned(g, explicit, LOSSY).place(2)
+    assert (r.call_delivered, r.call_edge_drops) == (1, [(3, 1)])
+    snapshot = from_dag(
+        g3,
+        whole,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        residual=[10, 10, 1, 0],
+    )
+    assert pinned(g3, snapshot).place(INF).call_delivered == 1
+
+
+def test_from_dag_snapshot_reads_by_edge_id():
+    # A residual snapshot is read per EdgeId, not per position in the DAG: e0 0->2 is outside the
+    # DAG, e1 and e2 0->1 (cost 2) are in it; residual [10, 2, 8] weighs them 2 and 8, so an offer
+    # of 10 splits by highest averages as (2, 8) and e0 carries nothing.
+    g = ngc.Graph(3, [0, 0, 0], [2, 1, 1], [10, 10, 10], [1, 2, 2], 1.0)
+    assert g.input_positions().tolist() == [0, 1, 2]
+    dag_12 = ngc.PredecessorDAG.from_csr(g, [0, 0, 2, 2], [0, 0], [1, 2])
+    program = ngc.ForwardingProgram.from_dag(
+        g,
+        0,
+        1,
+        dag_12,
+        allocation=ngc.RouteAllocation.WEIGHTED,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        residual=[10, 2, 8],
+    )
+    policy = ngc.FlowPolicy(
+        ngc.FlowLedger(g), 0, 1, ngc.FlowPolicyConfig(routing=ngc.Pinned(program))
+    )
+    r = policy.replace(10, outputs=ngc.OutputOptions(edge_flows=True))
+    assert r.edge_flows.tolist() == [0, 2, 8]
+
+
+def test_from_dag_validation():
+    g = graph(4, DP)
+    whole = dag(g, [0, 1, 2, 3])
+    foreign = dag(graph(4, DP), [0, 1, 2, 3])
+    explicit = ngc.WeightBasis.EXPLICIT
+    snap = ngc.WeightBasis.RESIDUAL_SNAPSHOT
+    fd = ngc.ForwardingProgram.from_dag
+    for call, text in (
+        (lambda: fd(g, [], 3, foreign), "sources: the node set is empty"),
+        (
+            lambda: fd(g, [0, 1], 3, foreign, allocation=MF),
+            "dag belongs to another graph",
+        ),
+        (
+            lambda: fd(
+                g,
+                [0, 1],
+                3,
+                whole,
+                allocation=MF,
+                weight_basis=ngc.WeightBasis.CAPACITY,
+            ),
+            "from_dag allocation must be EQUAL or WEIGHTED",
+        ),
+        (
+            lambda: fd(g, [0, 1], 3, whole, weight_basis=ngc.WeightBasis.CAPACITY),
+            "weight_basis requires allocation=WEIGHTED",
+        ),
+        (
+            lambda: fd(g, [0, 1], 3, whole, allocation=W, weight_basis=explicit),
+            "weight_basis=EXPLICIT requires edge_weights",
+        ),
+        (
+            lambda: fd(g, [0, 1], 3, whole, allocation=W, edge_weights=[1, 1, 1, 1]),
+            "edge_weights require weight_basis=EXPLICIT",
+        ),
+        (
+            lambda: fd(g, [0, 1], 3, whole, allocation=W, weight_basis=snap),
+            "weight_basis=RESIDUAL_SNAPSHOT requires residual",
+        ),
+        (
+            lambda: fd(g, [0, 1], 3, whole, allocation=W, residual=[1, 1, 1, 1]),
+            "residual requires weight_basis=RESIDUAL_SNAPSHOT",
+        ),
+        (
+            lambda: fd(
+                g,
+                [0, 1],
+                3,
+                whole,
+                allocation=W,
+                weight_basis=explicit,
+                edge_weights=[1, 1, 1],
+            ),
+            "edge_weights: expected 4 entries",
+        ),
+        (
+            lambda: fd(
+                g,
+                [0, 1],
+                3,
+                whole,
+                allocation=W,
+                weight_basis=explicit,
+                edge_weights=[-1, 1, 1, 1],
+            ),
+            "edge_weights[0] must be an integer in [0, 2^62)",
+        ),
+        (
+            lambda: fd(
+                g,
+                [0, 1],
+                3,
+                whole,
+                allocation=W,
+                weight_basis=snap,
+                residual=[11, 0, 0, 0],
+            ),
+            "residual[0] = 11 is outside [0, edge_capacity_units[0] = 10]",
+        ),
+    ):
+        with pytest.raises(ValueError, match=exact(text)):
+            call()
+    with pytest.raises(
+        TypeError, match=exact("dag must be a PredecessorDAG (got list)")
+    ):
+        fd(g, [0, 1], 3, [0])
+
+
+def test_from_dag_repair():
+    # A mask excluding e2: the replay keeps the pooled context, node 2 sends everything to e3.
+    g = graph(4, DP)
+    p = from_dag(g, [0, 1, 2, 3])
+    mask = g.eligibility(excluded_edges=[2])
+    assert pinned(g, p, eligibility=mask).place(INF).call_delivered == 1
+    r = pinned(g, p, LOSSY, eligibility=mask).place(2)
+    assert (r.call_delivered, r.call_edge_drops) == (1, [(3, 1)])
+
+
+def test_from_dag_replay_basis():
+    # DPX adds 1->3 (e2 here, in EdgeId order) outside the DAG {0->2, 1->2, 2->3, 2->3}. With 1->2
+    # masked, source 1 reaches nothing in the DAG and leaves the roster: Lossless 2 (the topology
+    # would keep it through 1->3, with no surviving entry: 1).
+    gx = graph(
+        4, [(0, 2, 10, 1), (1, 2, 10, 1), (1, 3, 5, 1), (2, 3, 1, 1), (2, 3, 1, 1)]
+    )
+    p = from_dag(gx, [0, 1, 3, 4])
+    mask = gx.eligibility(excluded_edges=[1])
+    assert pinned(gx, p, eligibility=mask).place(INF).call_delivered == 2
+    r = pinned(gx, p, LOSSY, eligibility=mask).place(2)
+    assert [(s.source, s.offered, s.delivered) for s in r.by_source] == [
+        (0, 2, 2),
+        (1, 0, 0),
+    ]
+
+
+def test_from_dag_stale():
+    # Black holes at e2: the tables and the roster stay; RR(2, 2) puts one unit on e2, lost there.
+    g = graph(4, DP)
+    p = from_dag(g, [0, 1, 2, 3])
+    holes = g.eligibility(excluded_edges=[2])
+    r = pinned(g, p, LOSSY, black_holes=holes).place(2)
+    assert (r.call_delivered, r.call_edge_drops) == (1, [(2, 1)])
+    assert pinned(g, p, black_holes=holes).place(INF).call_delivered == 0
+    r = pinned(g, p, LOSSY, black_holes=holes).place(1)
+    assert (r.call_delivered, r.call_edge_drops) == (0, [(2, 1)])
+
+
+def _sp_against_dag(g, edges, allocation=EB, mask=None):
+    # ShortestPaths from {0, 1} to 3 against Pinned over from_dag of the same DAG: delivered,
+    # edge drops and per-source rows for Lossy offers 1 to 5, and the Lossless bound.
+    sp = ngc.ShortestPaths(allocation=allocation)
+    program = from_dag(g, edges, allocation=allocation)
+
+    def rows_of(r):
+        return (
+            r.call_delivered,
+            r.call_edge_drops,
+            [
+                (s.source, s.offered, s.delivered, s.total_edge_drops)
+                for s in r.by_source
+            ],
+        )
+
+    for offer in range(1, 6):
+        a = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            [0, 1],
+            3,
+            ngc.FlowPolicyConfig(routing=sp, admission=LOSSY),
+            mask,
+        ).place(offer)
+        b = pinned(g, program, LOSSY, eligibility=mask).place(offer)
+        assert rows_of(a) == rows_of(b), offer
+    a = ngc.FlowPolicy(
+        ngc.FlowLedger(g), [0, 1], 3, ngc.FlowPolicyConfig(routing=sp), mask
+    ).place(INF)
+    assert (
+        a.call_delivered
+        == pinned(g, program, eligibility=mask).place(INF).call_delivered
+    )
+    return a.call_delivered
+
+
+def test_from_dag_equals_shortest_paths():
+    # One mechanism: ECMP on DP (Lossy 3: 2, [(2, 1)]), the same under a mask excluding e3, and
+    # WCMP by capacity on DP3.
+    g = graph(4, DP)
+    assert _sp_against_dag(g, [0, 1, 2, 3]) == 2
+    r = pinned(g, from_dag(g, [0, 1, 2, 3]), LOSSY).place(3)
+    assert (r.call_delivered, r.call_edge_drops) == (2, [(2, 1)])
+    assert _sp_against_dag(g, [0, 1, 2, 3], mask=g.eligibility(excluded_edges=[3])) == 1
+    assert _sp_against_dag(graph(4, DP3), [0, 1, 2, 3], allocation=W) == 4
+
+
+@pytest.mark.parametrize("seed", range(120))
+def test_from_dag_equals_shortest_paths_random(seed):
+    # ShortestPaths EQUAL or WEIGHTED (CAPACITY) from up to three sources, under a random mask,
+    # against Pinned over from_dag of the union of its records' routes (the selected supports),
+    # the same mask and allocation: the same delivered, edge drops and per-source rows, Lossy and
+    # Lossless. Even seeds add a hub (every source into one router, then 2 or 3 small parallel
+    # links), where pooling decides the split.
+    rng = random.Random(seed)
+    n = rng.randint(4, 7)
+    rows = []
+    if seed % 2 == 0:
+        for u in range(n - 2):
+            rows.append((u, n - 2, rng.choice([1, 2, 5, 10]), 1))
+        for _ in range(rng.randint(2, 3)):
+            rows.append((n - 2, n - 1, rng.choice([0, 1, 2, 3]), 1))
+    for u in range(n - 1):
+        for v in range(u + 1, n):
+            for _ in range(rng.choice([0, 0, 1, 1, 2] if seed % 2 else [0, 0, 0, 1])):
+                rows.append((u, v, rng.choice([0, 1, 2, 3, 5, 9]), rng.randint(1, 4)))
+    if not rows:
+        rows = [(0, n - 1, 3, 1)]
+    g = build(n, rows)
+    sources = sorted(rng.sample(range(n - 2), rng.randint(1, min(3, n - 2))))
+    mask = g.eligibility(
+        excluded_edges=[e for e in range(g.num_edges()) if rng.random() < 0.1]
+    )
+    allocation = rng.choice([EB, W])
+    admission = rng.choice([LOSSLESS, LOSSY])
+    offer = INF if admission == LOSSLESS else rng.choice([1, 2, 3, 5, 9, 20])
+    sp = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        sources,
+        n - 1,
+        ngc.FlowPolicyConfig(
+            routing=ngc.ShortestPaths(allocation=allocation), admission=admission
+        ),
+        mask,
+    )
+    a = sp.place(offer)
+    union = sorted({e for rec in sp.records() for e in rec.route.via_edges().tolist()})
+    if not union:
+        return
+    program = ngc.ForwardingProgram.from_dag(
+        g, sources, n - 1, dag(g, union), allocation=allocation
+    )
+    b = pinned(g, program, admission, eligibility=mask).place(offer)
+
+    def rows_of(r):
+        return (
+            r.call_delivered,
+            r.call_edge_drops,
+            r.call_source_drops,
+            [(s.source, s.delivered, s.total_edge_drops) for s in r.by_source],
+        )
+
+    assert rows_of(a) == rows_of(b), seed
+
+
+def test_from_dag_masked_and_zero():
+    g = graph(4, DP)
+    p = from_dag(g, [0, 1, 2, 3])
+    every = g.eligibility(excluded_edges=[0, 1, 2, 3])
+    assert pinned(g, p, eligibility=every).place(INF).termination == T.NO_ROUTE
+    ledger = ngc.FlowLedger(g)
+    r = pinned(g, p, ledger=ledger).place(0)
+    assert (r.termination, r.call_delivered) == (T.COMPLETE, 0)
+    assert ledger.records() == []
+
+
+def test_from_dag_many_sources():
+    # 64 sources, each a link of 2^55 into node 64, then one link of 2^61 - 1 (capacities summing
+    # to 2^62 - 1): Lossless 2^61 - 1; Lossy 2^61 fills every first link and drops 1 on the last.
+    rows = [(i, 64, 1 << 55, 1) for i in range(64)] + [(64, 65, (1 << 61) - 1, 1)]
+    g = graph(66, rows)
+    p = from_dag(g, range(65), sources=range(64), destinations=65)
+    assert pinned(g, p).place(INF).call_delivered == (1 << 61) - 1
+    r = pinned(g, p, LOSSY).place(1 << 61)
+    assert (r.call_delivered, r.call_edge_drops) == ((1 << 61) - 1, [(64, 1)])
+
+
+def test_from_dag_wide_weights():
+    # 16 parallel links of 2^57, explicit weights 2^62 - 1 each (their sum above 2^65): equal
+    # weights split by RR, 2^57 each: 2^61.
+    g = graph(2, [(0, 1, 1 << 57, 1)] * 16)
+    p = from_dag(
+        g,
+        range(16),
+        sources=[0],
+        destinations=1,
+        allocation=W,
+        weight_basis=ngc.WeightBasis.EXPLICIT,
+        edge_weights=[(1 << 62) - 1] * 16,
+    )
+    assert pinned(g, p).place(INF).call_delivered == 1 << 61
+
+
+# ---------------------------------------------------------------- C: Pinned's configuration
+
+
+def test_pinned_texts():
+    g = par2(4, 8)
+    prog = tunnels(g, [0], [1], [(0, [0], 1)])
+    ledger = ngc.FlowLedger(g)
+    # The fields of the other models are no keywords of FlowPolicyConfig or Pinned.
+    for kw in (
+        {"placement": EB},
+        {"allocation": EB},
+        {"origin": ngc.SourceAllocation.EQUAL},
+        {"weights": ngc.WeightBasis.CAPACITY},
+        {"edge_weights": [1, 1]},
+    ):
+        with pytest.raises(TypeError):
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(prog), **kw)
+        with pytest.raises(TypeError):
+            ngc.Pinned(prog, **kw)
+    three = graph(3, [(0, 1, 1), (0, 2, 1)])
+    p3 = tunnels(three, [0], [1], [(0, [0], 1)])
+    with pytest.raises(
+        ValueError, match=exact("program endpoints do not match policy endpoints")
+    ):
+        ngc.FlowPolicy(
+            ngc.FlowLedger(three),
+            0,
+            [1, 2],
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(p3)),
+        )
+    foreign = tunnels(par2(4, 8), [0], [1], [(0, [0], 1)])
+    cfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(foreign))
+    with pytest.raises(ValueError, match=exact("program belongs to another graph")):
+        ngc.FlowPolicy(ledger, 0, 1, cfg)
+    other = par2(4, 8)
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.Pinned(prog, black_holes=other.eligibility(excluded_edges=[0]))
+    )
+    with pytest.raises(ValueError, match=exact("black_holes belongs to another graph")):
+        ngc.FlowPolicy(ledger, 0, 1, cfg)
+    with pytest.raises(
+        ValueError, match=exact("foreign Eligibility: built for another graph")
+    ):
+        ngc.FlowPolicy(
+            ledger,
+            0,
+            1,
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(prog)),
+            other.eligibility(excluded_edges=[0]),
+        )
+    with pytest.raises(ValueError, match=exact("sources: the node set is empty")):
+        ngc.FlowPolicy(ledger, [], 1, ngc.FlowPolicyConfig(routing=ngc.Pinned(foreign)))
+    with pytest.raises(TypeError):
+        ngc.Pinned(bundles=[dag(g, [0])])
+    with pytest.raises(TypeError):
+        ngc.Pinned([dag(g, [0])])
+    with pytest.raises(TypeError):
+        ngc.Pinned(None)
+    # Several sources and destinations.
+    d = graph(4, REL)
+    many = tunnels(d, [0, 1], [3], [(0, [0, 2], 1), (1, [1, 2], 1)])
+    assert pinned(d, many).place(INF).call_delivered == 10
+
+
+# ---------------------------------------------------------------- L: lossless bounds
+
+
+def bound(g, specs, sources=(0,), destinations=(1,)):
+    return (
+        pinned(g, tunnels(g, list(sources), list(destinations), specs))
+        .place(INF)
+        .call_delivered
+    )
+
+
+def test_lossless_bound_examples():
+    # Duplicate routes, deduplicated routes, a static path filled, a zero first or last link, a
+    # support's Pinned bound, weighted tunnels.
+    assert bound(par2(4, 8), [(0, [0], 1), (0, [1], 1), (0, [1], 1)]) == 12
+    assert bound(par2(4, 8), [(0, [0], 1), (0, [1], 1)]) == 8
+    assert bound(par2(6, 4), [(0, [0], 1), (0, [1], 1)]) == 9
+    assert bound(par2(0, 4), [(0, [0], 1), (0, [1], 1)]) == 0
+    assert bound(par2(4, 0), [(0, [0], 1), (0, [1], 1)]) == 1
+    assert bound(graph(4, PINLOSS), [(0, [0, 2], 1), (0, [1, 3], 1)], (0,), (3,)) == 4
+    assert bound(par2(10, 10), [(0, [0], 1), (0, [1], 2)]) == 15
+
+
+def test_duplicates_and_zero_weight_records():
+    # Three records, entries 0, 1, 2; a weight-0 tunnel's record exists.
+    g = par2(4, 8)
+    p = pinned(g, tunnels(g, [0], [1], [(0, [0], 1), (0, [1], 1), (0, [1], 1)]))
+    r = p.place(12)
+    recs = p.records()
+    assert [rec.entry_id for rec in recs] == [0, 1, 2]
+    assert [rec.delivered for rec in recs] == [4, 4, 4]
+    assert len({rec.flow_id for rec in recs}) == 3
+    assert rows(r) == [(i, 0, UP, 4, 4, 0) for i in range(3)]
+    z = pinned(g, tunnels(g, [0], [1], [(0, [0], 0), (0, [1], 1)]))
+    r = z.place(INF)
+    assert r.call_delivered == 8
+    assert [(rec.entry_id, rec.delivered) for rec in z.records()] == [(0, 0), (1, 8)]
+
+
+def test_increments():
+    # Increments, Lossless and Lossy.
+    g = graph(3, INC)
+    prog = tunnels(g, [0, 1], [2], [(0, [0], 1), (1, [1], 1)])
+    p = pinned(g, prog)
+    assert [p.place(3).call_delivered, p.place(1).call_delivered] == [2, 0]
+    q = pinned(g, prog, LOSSY)
+    r1 = q.place(3)
+    assert (r1.call_delivered, r1.call_edge_drops) == (2, [(0, 1)])
+    assert q.place(1).call_delivered == 1
+    # A Lossless increment's refused units.
+    one = graph(2, ONE)
+    ledger = ngc.FlowLedger(one)
+    other = ngc.FlowPolicy(ledger, 0, 1, shortest_paths())
+    other.place(8)
+    p = pinned(one, tunnels(one, [0], [1], [(0, [0], 1)]), ledger=ledger)
+    assert p.place(5).call_delivered == 2
+    other.remove()
+    other.place(5)
+    assert p.place(1).call_delivered == 1
+
+
+def test_infinite_and_mixed():
+    g = par2(6, 4)
+    prog = tunnels(g, [0], [1], [(0, [0], 1), (0, [1], 1)])
+    r = pinned(g, prog).place(INF)
+    assert (r.call_delivered, r.termination, r.call_undelivered) == (
+        9,
+        T.EXHAUSTED,
+        INF,
+    )
+    with pytest.raises(
+        ValueError, match=exact("LOSSY forwarding requires a finite offer")
+    ):
+        pinned(g, prog, LOSSY).place(INF)
+    h = par2(4, 8)
+    mixed = ngc.ForwardingProgram.from_routes(
+        h,
+        [0],
+        [1],
+        [ngc.RouteDefinition(0, path(h, [0])), ngc.RouteDefinition(0, dag(h, [1]))],
+    )
+    p = pinned(h, mixed)
+    assert p.place(INF).call_delivered == 8
+    assert [(rec.entry_id, rec.delivered) for rec in p.records()] == [(0, 4), (1, 4)]
+
+
+def test_split_contexts():
+    # Each identical split route splits in its own context, also pooled.
+    g = par2(1, 1)
+    d = dag(g, [0, 1])
+    prog = ngc.ForwardingProgram.from_routes(
+        g, [0], [1], [ngc.RouteDefinition(0, d), ngc.RouteDefinition(0, d)]
+    )
+    assert pinned(g, prog).place(INF).call_delivered == 1
+    r = pinned(g, prog, LOSSY).replace(2, outputs=ngc.OutputOptions(edge_flows=True))
+    assert r.call_edge_drops == [(0, 1)]
+    pooled = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths())
+    r = pooled.place(INF, ngc.OutputOptions(edge_flows=True))
+    assert (r.call_delivered, r.edge_flows.tolist()) == (2, [1, 1])
+
+
+# ---------------------------------------------------------------- Y: losses inside one program
+
+
+def lossy_rows(g, sources, destinations, specs, offer, **kw):
+    r = pinned(g, tunnels(g, sources, destinations, specs), LOSSY, **kw).replace(offer)
+    return r, [(t.assigned, t.delivered, t.total_edge_drops) for t in r.by_tunnel]
+
+
+def test_loss_rule():
+    one9 = graph(2, [(0, 1, 9)])
+    r, got = lossy_rows(one9, [0], [1], [(0, [0], 2), (0, [0], 1)], 12)
+    assert got == [(8, 6, 2), (4, 3, 1)]  # two entries merge on one link
+    one1 = graph(2, [(0, 1, 1)])
+    _, got = lossy_rows(one1, [0], [1], [(0, [0], 1), (0, [0], 1)], 2)
+    assert got == [(1, 1, 0), (1, 0, 1)]  # a tie of the split keys
+    one3 = graph(2, [(0, 1, 3)])
+    _, got = lossy_rows(one3, [0], [1], [(0, [0], 5), (0, [0], 1), (0, [0], 1)], 7)
+    assert got == [(5, 3, 2), (1, 0, 1), (1, 0, 1)]  # the rounding of the split
+    hier = graph(4, HIER)
+    _, got = lossy_rows(
+        hier, [0, 1], [3], [(0, [0, 2], 1), (0, [0, 2], 1), (1, [1, 2], 1)], 4
+    )
+    assert [d for _, d, _ in got] == [1, 0, 0]  # the split hierarchy
+    zero = graph(2, [(0, 1, 0)])
+    r, got = lossy_rows(zero, [0], [1], [(0, [0], 1)], 2)
+    assert got == [(2, 0, 2)] and r.call_edge_drops == [(0, 2)]  # a link of service 0
+    r, got = lossy_rows(
+        graph(4, PINLOSS), [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)], 12
+    )
+    assert got == [(6, 2, 4), (6, 6, 0)] and r.call_edge_drops == [(2, 4)]
+
+
+def test_subdivision():
+    # Subdividing a link before or after: a gate of 1, then three own links of 1.
+    before = graph(
+        6, [(0, 1, 1), (1, 2, 1), (1, 3, 1), (1, 4, 1), (2, 5, 1), (3, 5, 1), (4, 5, 1)]
+    )
+    _, got = lossy_rows(
+        before,
+        [0],
+        [5],
+        [(0, [0, 1, 4], 1), (0, [0, 2, 5], 1), (0, [0, 3, 6], 1)],
+        3,
+    )
+    assert [d for _, d, _ in got] == [1, 0, 0]
+    after = graph(
+        7,
+        [
+            (0, 1, 1),
+            (1, 2, 1),
+            (1, 3, 1),
+            (1, 4, 1),
+            (2, 6, 1),
+            (3, 5, 1),
+            (4, 5, 1),
+            (6, 5, 1),
+        ],
+    )
+    _, got = lossy_rows(
+        after,
+        [0],
+        [5],
+        [(0, [0, 1, 4, 7], 1), (0, [0, 2, 5], 1), (0, [0, 3, 6], 1)],
+        3,
+    )
+    assert [d for _, d, _ in got] == [1, 0, 0]
+
+
+def test_cycles():
+    # A compressed cycle: no link can drop.
+    g = cyc(2, 2)
+    _, got = lossy_rows(g, [4], [5], [(4, CYC_T0, 1), (4, CYC_T1, 1)], 2)
+    assert [d for _, d, _ in got] == [1, 1]
+    # The rounds from zero settle at round 3.
+    g = cyc(1, 1)
+    r, got = lossy_rows(g, [4], [5], [(4, CYC_T0, 1), (4, CYC_T1, 1)], 2)
+    assert got == [(1, 1, 0), (1, 0, 1)] and r.call_edge_drops == [(3, 1)]
+    # Period two.
+    g = cyc(1, 2)
+    ledger = ngc.FlowLedger(g)
+    p = pinned(
+        g, tunnels(g, [4], [5], [(4, CYC_T0, 1), (4, CYC_T1, 2)]), LOSSY, ledger=ledger
+    )
+    before = (ledger.residual().tolist(), len(p.records()))
+    with pytest.raises(
+        ValueError, match=exact("lossy forwarding iteration entered a period-2 cycle")
+    ):
+        p.replace(3)
+    assert (
+        ledger.residual().tolist(),
+        len(p.records()),
+    ) == before and p.program is None
+    # The round limit (64 * 3 rounds for three barriers).
+    lim = graph(
+        8,
+        [
+            (0, 1, 1),
+            (1, 4, 1000),
+            (2, 3, 2),
+            (3, 0, 1000),
+            (3, 7, 1000),
+            (4, 5, 1),
+            (5, 2, 1000),
+            (5, 7, 1000),
+            (6, 0, 1000),
+            (6, 2, 1000),
+        ],
+    )
+    prog = tunnels(
+        lim, [6], [7], [(6, [8, 0, 1, 5, 6, 2, 4], 2), (6, [9, 2, 3, 0, 1, 5, 7], 3)]
+    )
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "lossy forwarding iteration did not reach a fixed point within the round limit"
+        ),
+    ):
+        pinned(lim, prog, LOSSY).replace(3)
+
+
+def test_zero_share_tunnel_adds_no_wait():
+    # One Pinned LOSSY program: sA's tunnels A (X, L0, L1; weight 100) and Z (L0, X; weight w), sB's
+    # tunnel B (L1, L0). replace(4) gives each head 2 and Z H(2, [100, 1]) = 0: the period-2 error
+    # with Z at weight 0 (not forwarded) and at weight 1 (forwarded with share 0) alike.
+    # sA 0, sB 1, n1..n6 2..7, dA 8, dB 9, dZ 10; rows X, L0, L1 first.
+    rows = [
+        (2, 3, 1),
+        (4, 5, 1),
+        (6, 7, 2),
+        (0, 2, 100),
+        (3, 4, 100),
+        (5, 6, 100),
+        (7, 8, 100),
+        (1, 6, 100),
+        (7, 4, 100),
+        (5, 9, 100),
+        (0, 4, 100),
+        (5, 2, 100),
+        (3, 10, 100),
+    ]
+    g = ngc.Graph(11, *([r[k] for r in rows] for k in range(3)), [1] * len(rows), 1.0)
+    ids = [0] * len(rows)
+    for e, position in enumerate(g.input_positions().tolist()):
+        ids[position] = e
+    for z in (0, 1):
+        specs = [
+            (0, [3, 0, 4, 1, 5, 2, 6], 100),
+            (0, [10, 1, 11, 0, 12], z),
+            (1, [7, 2, 8, 1, 9], 1),
+        ]
+        prog = tunnels(
+            g, [0, 1], [8, 9, 10], [(h, [ids[k] for k in p], w) for h, p, w in specs]
+        )
+        with pytest.raises(
+            ValueError,
+            match=exact("lossy forwarding iteration entered a period-2 cycle"),
+        ):
+            pinned(g, prog, LOSSY).replace(4)
+
+
+def test_black_holes_add_no_barrier():
+    # STALE-black-hole-in-cycle's graph (input rows 0 to 18) with one head 17 feeding its four
+    # tunnels (wide rows 19 to 22) and wide exits from each tunnel's end to one destination 18
+    # (rows 23 to 25); one Pinned LOSSY program, weights 13, 11, 10, 5, replace(39), black holes
+    # on rows 2, 6 and 17. Tunnels 0 and 3 reach a black hole; their arrivals there are dropped
+    # without a barrier: the round-limit error, nothing published. Without the black holes the
+    # call settles; LOSSLESS serves 0 on a black-holed link (tunnel 0 takes the first unit).
+    rows = [
+        (0, 1, 12),
+        (1, 6, 1000),
+        (1, 16, 1000),
+        (2, 3, 9),
+        (3, 0, 1000),
+        (3, 10, 1000),
+        (4, 5, 7),
+        (5, 6, 1000),
+        (6, 7, 13),
+        (7, 2, 1000),
+        (7, 10, 1000),
+        (8, 9, 1),
+        (10, 11, 10),
+        (11, 2, 1000),
+        (12, 4, 1000),
+        (13, 6, 1000),
+        (14, 0, 1000),
+        (15, 0, 1000),
+        (16, 2, 1000),
+        (17, 12, 1000),
+        (17, 13, 1000),
+        (17, 14, 1000),
+        (17, 15, 1000),
+        (11, 18, 1000),
+        (1, 18, 1000),
+        (7, 18, 1000),
+    ]
+    g = ngc.Graph(19, *([r[k] for r in rows] for k in range(3)), [1] * len(rows), 1.0)
+    ids = [0] * len(rows)
+    for e, position in enumerate(g.input_positions().tolist()):
+        ids[position] = e
+    specs = [
+        ([19, 14, 6, 7, 8, 9, 3, 5, 12, 23], 13),
+        ([20, 15, 8, 10, 12, 13, 3, 4, 0, 24], 11),
+        ([21, 16, 0, 1, 8, 25], 10),
+        ([22, 17, 0, 2, 18, 3, 5, 12, 23], 5),
+    ]
+    prog = tunnels(g, [17], [18], [(17, [ids[k] for k in p], w) for p, w in specs])
+    black = g.eligibility(excluded_edges=[ids[k] for k in (2, 6, 17)])
+    ledger = ngc.FlowLedger(g)
+    stale = pinned(g, prog, LOSSY, black_holes=black, ledger=ledger)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "lossy forwarding iteration did not reach a fixed point within the round limit"
+        ),
+    ):
+        stale.replace(39)
+    assert ledger.records() == [] and ledger.carried().tolist() == [0] * len(rows)
+    assert stale.program is None
+    settled = stale.evaluate(4)
+    assert [t.status for t in settled.by_tunnel] == [BLACKHOLED, UP, UP, BLACKHOLED]
+    assert pinned(g, prog, LOSSY).replace(39).call_delivered > 0
+    lossless = pinned(g, prog, LOSSLESS, black_holes=black)
+    assert lossless.evaluate(float("inf")).call_delivered == 0
+
+
+def test_cycle_subdivision():
+    # CYCS: Y split in two in series (e3: 2 -> 6, e8: 6 -> 3).
+    def cycs(x, y, z):
+        return graph(
+            7,
+            [
+                (0, 1, x),
+                (1, 2, 1000),
+                (1, 5, 1000),
+                (2, 6, y),
+                (3, 0, 1000),
+                (3, 5, 1000),
+                (4, 0, 1000),
+                (4, 2, 1000),
+                (6, 3, z),
+            ],
+        )
+
+    t0, t1 = [6, 0, 1, 3, 8, 5], [7, 3, 8, 4, 0, 2]
+    r, got = lossy_rows(cycs(1, 1, 1), [4], [5], [(4, t0, 1), (4, t1, 1)], 2)
+    assert got == [(1, 1, 0), (1, 0, 1)] and r.call_edge_drops == [(3, 1)]
+    g = cycs(1, 2, 2)
+    with pytest.raises(
+        ValueError, match=exact("lossy forwarding iteration entered a period-2 cycle")
+    ):
+        pinned(g, tunnels(g, [4], [5], [(4, t0, 1), (4, t1, 2)]), LOSSY).replace(3)
+
+
+# ---------------------------------------------------------------- R: replay under a mask
+
+
+def test_replay():
+    # A CentralizedTE program replayed with its first path failed.
+    g = graph(4, G1U)
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_()).replace(12).program
+    assert listing(prog) == [(0, [0, 2], 2), (0, [1, 3], 10)]
+    fail = g.eligibility(excluded_edges=[2])
+    p = pinned(g, prog, LOSSY, fail)
+    r = p.replace(12)
+    assert (r.call_delivered, rows(r)) == (
+        10,
+        [(0, 0, FAILED, 0, 0, 0), (1, 0, UP, 12, 10, 2)],
+    )
+    recs = p.records()
+    assert recs[0].min_route_cost is None and recs[0].route.via_edges().tolist() == []
+    assert pinned(g, prog, LOSSLESS, fail).place(INF).call_delivered == 10
+    zero = ngc.FlowLedger(g, [2, 0, 2, 10])
+    r = pinned(g, prog, LOSSY, ledger=zero).replace(12)
+    assert r.call_delivered == 2 and [t.status for t in r.by_tunnel] == [UP, UP]
+    # The surviving sources' captured weights.
+    s = graph(4, SURV)
+    surv = ngc.FlowPolicy(ngc.FlowLedger(s), [0, 1, 2], 3, global_()).place(9).program
+    assert surv.source_weights == ((0, 3), (1, 1), (2, 5))
+    q = pinned(s, surv, LOSSY, s.eligibility(excluded_nodes=[2]))
+    r = q.replace(16)
+    assert r.call_delivered == 4 and [row.offered for row in r.by_source] == [12, 4, 0]
+    assert (
+        pinned(s, surv, LOSSLESS, s.eligibility(excluded_nodes=[2]))
+        .place(INF)
+        .call_delivered
+        == 4
+    )
+
+
+def test_replay_basis():
+    # The topology basis keeps head 1; the supplied basis drops it.
+    g = graph(3, RB)
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, global_()).place(10).program
+    assert listing(prog) == [(0, [0], 5), (1, [1], 5)]
+    mask = g.eligibility(excluded_edges=[1])
+    r = pinned(g, prog, LOSSY, mask).replace(10)
+    assert (r.call_delivered, r.source_drops) == (5, 5)
+    assert pinned(g, prog, LOSSLESS, mask).place(INF).call_delivered == 1
+    sup = tunnels(g, [0, 1], [2], [(0, [0], 1), (1, [1], 1)])
+    r = pinned(g, sup, LOSSY, mask).replace(10)
+    assert (r.call_delivered, r.call_edge_drops) == (5, [(0, 5)])
+    assert pinned(g, sup, LOSSLESS, mask).place(INF).call_delivered == 5
+    # Every remaining weight 0.
+    z = graph(3, [(0, 2, 5), (1, 2, 5)])
+    zp = ngc.FlowPolicy(ngc.FlowLedger(z), [0, 1], 2, global_()).place(1).program
+    m = z.eligibility(excluded_nodes=[0])
+    r = pinned(z, zp, LOSSY, m).replace(4)
+    assert (r.termination, r.source_drops, r.call_delivered) == (
+        T.NO_ACTIVE_WEIGHT,
+        4,
+        0,
+    )
+    r = pinned(z, zp, LOSSLESS, m).replace(4)
+    assert (r.termination, r.call_delivered) == (T.NO_ACTIVE_WEIGHT, 0)
+
+
+def test_replay_split_routes():
+    # A stale remote tail repaired; a stale tunnel node repaired; frozen weights.
+    g = graph(4, DIAM)
+    prog = (
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, shortest_paths(admission=LOSSY))
+        .place(1)
+        .program
+    )
+    r = pinned(g, prog, LOSSY, g.eligibility(excluded_edges=[3])).replace(100)
+    assert r.call_delivered == 100
+    t = graph(4, TUN)
+    tp = tunnels(t, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    m = t.eligibility(excluded_nodes=[2])
+    r = pinned(t, tp, LOSSY, m).replace(10)
+    assert [s.status for s in r.by_tunnel] == [UP, FAILED] and r.call_delivered == 10
+    assert [s.assigned for s in r.by_tunnel] == [10, 0]
+    assert pinned(t, tp, LOSSLESS, m).place(INF).call_delivered == 10
+    z = par2(0, 10)
+    wp = (
+        ngc.FlowPolicy(ngc.FlowLedger(z), 0, 1, shortest_paths(W, LOSSY))
+        .place(1)
+        .program
+    )
+    fresh = par2(10, 10)
+    r = pinned(z, wp, LOSSY, ledger=ngc.FlowLedger(z)).replace(5)
+    assert (r.call_delivered, r.call_edge_drops) == (5, [])
+    del fresh
+
+
+# ---------------------------------------------------------------- S: stale forwarding
+
+
+def test_stale_examples():
+    g = graph(4, DIAM)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, shortest_paths(admission=LOSSY))
+    p.replace(100)
+    installed = p.program
+    r = p.forward(100, black_holes=g.eligibility(excluded_edges=[3]))
+    assert (r.call_delivered, r.call_edge_drops) == (
+        50,
+        [(3, 50)],
+    )  # a stale remote tail
+    assert p.program is installed and not r.routes_changed and not r.weights_changed
+    assert p.replace(100).call_delivered == 100
+    w = graph(2, [(0, 1, 10), (0, 1, 40)])
+    q = ngc.FlowPolicy(ngc.FlowLedger(w), 0, 1, shortest_paths(W, LOSSY))
+    q.replace(40)
+    r = q.forward(40, black_holes=w.eligibility(excluded_edges=[0]))
+    assert (r.call_delivered, r.call_edge_drops) == (
+        32,
+        [(0, 8)],
+    )  # a stale WCMP member
+    wz = graph(2, [(0, 1, 0), (0, 1, 40)])
+    q = ngc.FlowPolicy(ngc.FlowLedger(wz), 0, 1, shortest_paths(W, LOSSY))
+    q.replace(1)
+    assert q.forward(40).call_delivered == 40  # a stale WCMP member of capacity 0
+    rel = graph(4, REL)
+    prog = tunnels(rel, [0, 1], [3], [(0, [0, 2], 1), (1, [1, 2], 1)])
+    r = pinned(rel, prog, LOSSY).replace(20)
+    assert [t.delivered for t in r.by_tunnel] == [5, 5]  # the relief's original program
+    r = pinned(
+        rel, prog, LOSSY, black_holes=rel.eligibility(excluded_edges=[0])
+    ).replace(20)
+    assert rows(r) == [
+        (0, 0, BLACKHOLED, 10, 0, 10),
+        (1, 1, UP, 10, 10, 0),
+    ]  # no relief from a black hole
+
+
+def test_stale_tunnels_and_pools():
+    t = graph(4, TUN)
+    tp = tunnels(t, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    bh = t.eligibility(excluded_nodes=[2])
+    r = pinned(t, tp, LOSSY, black_holes=bh).replace(10)
+    assert rows(r) == [(0, 0, UP, 5, 5, 0), (1, 0, BLACKHOLED, 5, 0, 5)]
+    assert r.call_edge_drops == [(1, 5)]
+    assert pinned(t, tp, LOSSLESS, black_holes=bh).replace(10).call_delivered == 1
+    pool = graph(4, POOL2)
+    p = ngc.FlowPolicy(ngc.FlowLedger(pool), [0, 1], 3, shortest_paths(admission=LOSSY))
+    p.replace(0)
+    r = p.forward(2, outputs=ngc.OutputOptions(edge_flows=True))
+    assert (r.call_delivered, r.edge_flows.tolist()) == (2, [1, 1, 1, 1])
+    r = p.forward(2, black_holes=pool.eligibility(excluded_edges=[0, 3]))
+    assert (r.call_delivered, r.call_edge_drops) == (
+        1,
+        [(0, 1)],
+    )  # a stale pooled remainder
+    zero = graph(2, [(0, 1, 0)])
+    q = ngc.FlowPolicy(ngc.FlowLedger(zero), 0, 1, shortest_paths(W, LOSSY))
+    q.replace(0)
+    r = q.forward(2)
+    assert (r.source_drops, r.termination) == (2, T.NO_ACTIVE_WEIGHT)
+    one = graph(2, ONE)
+    q = ngc.FlowPolicy(ngc.FlowLedger(one), 0, 1, shortest_paths(admission=LOSSY))
+    q.replace(0)
+    r = q.forward(10, black_holes=one.eligibility(excluded_nodes=[0]))
+    assert (r.source_drops, r.call_edge_drops, r.call_delivered) == (10, [], 0)
+    op = tunnels(one, [0], [1], [(0, [0], 1)])
+    r = pinned(one, op, LOSSY, black_holes=one.eligibility(excluded_nodes=[0])).replace(
+        10
+    )
+    assert rows(r) == [(0, 0, BLACKHOLED, 0, 0, 0)] and r.source_drops == 10
+
+
+def test_stale_with_mask_and_global():
+    m = graph(5, MB)
+    mp = tunnels(m, [0], [4], [(0, [0, 3], 1), (0, [1, 4], 1), (0, [2, 5], 1)])
+    r = pinned(
+        m,
+        mp,
+        LOSSY,
+        m.eligibility(excluded_edges=[3]),
+        m.eligibility(excluded_edges=[3, 4]),
+    ).replace(10)
+    assert rows(r) == [
+        (0, 0, FAILED, 0, 0, 0),
+        (1, 0, BLACKHOLED, 5, 0, 5),
+        (2, 0, UP, 5, 5, 0),
+    ]
+    g = graph(4, G1U)
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_()).replace(12).program
+    bh = g.eligibility(excluded_edges=[2])
+    r = pinned(g, prog, LOSSY, black_holes=bh).replace(12)
+    assert rows(r) == [(0, 0, BLACKHOLED, 2, 0, 2), (1, 0, UP, 10, 10, 0)]
+    assert pinned(g, prog, LOSSLESS, black_holes=bh).replace(12).call_delivered == 4
+    allowed = g.eligibility()
+    assert rows(pinned(g, prog, LOSSY, black_holes=allowed).replace(12)) == rows(
+        pinned(g, prog, LOSSY).replace(12)
+    )
+
+
+# ---------------------------------------------------------------- O: operations
+
+
+def test_evaluate_publishes_nothing():
+    g = par2(10, 10)
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger, 0, 1, shortest_paths())
+    p.replace(6)
+
+    def state():
+        return ledger.residual().tolist(), [
+            (x.flow_id, x.delivered, x.edge_flows) for x in p.records()
+        ]
+
+    before = state()
+    r = p.evaluate(12)
+    assert (r.call_delivered, r.delivery_delta) == (12, 6) and r.program is not None
+    assert state() == before
+    assert p.place(0).requested == 6
+    gl = ngc.FlowPolicy(ngc.FlowLedger(graph(4, B1)), [0, 1], 3, global_())
+    gl.place(2)
+    out = ngc.OutputOptions(edge_flows=True, residual=True, min_cut=True)
+    r = gl.evaluate(12, outputs=out)
+    assert r.edge_flows.tolist() == [2, 10, 10] and r.residual.tolist() == [0, 0, 0]
+    assert r.min_cut == [0, 1] and gl.delivered() == 2
+
+
+def test_replace_and_epochs():
+    g = par2(10, 10)
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger, 0, 1, shortest_paths())
+    p.place(4)
+    old = p.records()[0].flow_id
+    r = p.replace(6)
+    assert (r.requested, r.admitted) == (6, 6)
+    with pytest.raises(ValueError):
+        ledger.record(old)
+    assert p.records()[0].flow_id != old
+    r = p.replace(INF)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (
+        20,
+        INF,
+        T.EXHAUSTED,
+    )
+    q = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths())
+    q.replace(10)
+    r = q.replace(4)
+    assert (r.call_delivered, r.delivery_delta) == (4, -6)
+    ids = [rec.flow_id for rec in q.records()]
+    r = q.place(3)
+    assert (r.call_delivered, r.requested, r.admitted) == (3, 7, 7)
+    assert [rec.flow_id for rec in q.records()] == ids
+    lossy = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths(admission=LOSSY))
+    lossy.replace(6)
+    r = lossy.place(3)
+    assert (r.call_delivered, r.offered, r.requested) == (3, 9, 9)
+
+
+def test_forward_keeps_the_program_and_flags():
+    g = par2(10, 10)
+    ledger = ngc.FlowLedger(g, [2, 10])
+    a = ngc.FlowPolicy(
+        ledger, 0, 1, shortest_paths(W, weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT)
+    )
+    assert a.replace(6).call_delivered == 6
+    b = pinned(g, tunnels(g, [0], [1], [(0, [1], 1)]), ledger=ledger)
+    b.place(5)
+    r = a.forward(12)
+    assert (r.call_delivered, r.routes_changed, r.weights_changed) == (6, False, False)
+    r = a.replace(12)
+    assert (r.call_delivered, r.routes_changed, r.weights_changed) == (7, False, True)
+    r = a.replace(12)
+    assert (r.call_delivered, r.routes_changed, r.weights_changed) == (7, False, False)
+
+
+def test_forward_texts_and_order():
+    g = par2(10, 10)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths(admission=LOSSY))
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        p.forward(-1)
+    p.place(1)
+    with pytest.raises(
+        ValueError,
+        match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+    ):
+        p.forward(-1)
+    with pytest.raises(
+        ValueError, match=exact("LOSSY forwarding requires a finite offer")
+    ):
+        p.forward(INF)
+    other = par2(1, 1)
+    with pytest.raises(ValueError, match=exact("black_holes belongs to another graph")):
+        p.forward(1, black_holes=other.eligibility(excluded_edges=[0]))
+    for call in (p.replace, p.evaluate):
+        with pytest.raises(
+            ValueError, match=exact("LOSSY forwarding requires a finite offer")
+        ):
+            call(INF)
+    p.remove()
+    with pytest.raises(
+        ValueError, match=exact("forward requires an installed program")
+    ):
+        p.forward(1)
+    ca = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        0,
+        1,
+        ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1))),
+    )
+    with pytest.raises(
+        ValueError, match=exact("forward requires an installed program")
+    ):
+        ca.forward(1)
+    pin = pinned(g, tunnels(g, [0], [1], [(0, [0], 1)]))
+    with pytest.raises(ValueError, match=exact("Pinned forwards with replace")):
+        pin.forward(INF, black_holes=other.eligibility(excluded_edges=[0]))
+
+
+def test_zero_replace_and_first_flags():
+    g = graph(4, POOL2)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, shortest_paths())
+    r = p.replace(0)
+    assert r.termination == T.COMPLETE and r.routes_changed and r.weights_changed
+    assert [rec.delivered for rec in p.records()] == [0, 0]
+    q = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, shortest_paths())
+    r = q.place(2)
+    assert r.routes_changed and r.weights_changed
+    r = q.place(2)
+    assert not r.routes_changed and not r.weights_changed
+
+
+def test_controller_flags():
+    # A controller's increment changes the weights; an offer-only change sets no flag.
+    g = graph(2, [(0, 1, 20)])
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, global_())
+    r1 = p.place(5)
+    assert (r1.routes_changed, r1.weights_changed) == (True, True)
+    r2 = p.place(5)
+    assert (r2.routes_changed, r2.weights_changed) == (False, True)
+    r3 = p.replace(10)
+    assert (r3.routes_changed, r3.weights_changed) == (False, False)
+    b1 = graph(4, B1)
+    q = ngc.FlowPolicy(ngc.FlowLedger(b1), [0, 1], 3, global_())
+    assert listing(q.place(2).program) == [(0, [0], 2)]
+    r = q.place(10)
+    assert listing(r.program) == [(0, [0], 2), (1, [1, 2], 10)] and r.routes_changed
+    pin = pinned(g, tunnels(g, [0], [1], [(0, [0], 1)]))
+    flags = [
+        (r.routes_changed, r.weights_changed) for r in map(pin.replace, (5, 10, 10))
+    ]
+    assert flags[1:] == [(False, False), (False, False)]
+    cost = ngc.FlowPolicy(
+        ngc.FlowLedger(par2(10, 10)), 0, 1, shortest_paths(admission=LOSSY)
+    )
+    cost.place(1)
+    assert [cost.forward(x).routes_changed for x in (5, 7)] == [False, False]
+    gu = graph(4, G1U)
+    c = ngc.FlowPolicy(ngc.FlowLedger(gu), 0, 3, global_())
+    c.replace(12)
+    assert c.forward(12).call_delivered == 12
+    r = c.forward(20)
+    assert (r.call_delivered, r.termination) == (12, T.EXHAUSTED)
+
+
+# ---------------------------------------------------------------- D, Z: records and rows
+
+
+def test_pooled_records_in_pinned():
+    # A ShortestPaths program in Pinned keeps the pooled attribution (each source's share of a
+    # shared router's traffic by highest averages).
+    g = graph(4, POOL2)
+    prog = (
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, shortest_paths(admission=LOSSY))
+        .place(2)
+        .program
+    )
+    p = pinned(g, prog, LOSSY)
+    p.replace(2)
+    assert [(rec.entry_id, rec.edge_flows) for rec in p.records()] == [
+        (0, [(0, 1), (2, 1)]),
+        (1, [(1, 1), (3, 1)]),
+    ]
+
+
+def test_wide_rows():
+    # TunnelFlow.assigned and dropped above 2^64.
+    g = graph(2, [(0, 1, 0)])
+    p = pinned(g, tunnels(g, [0], [1], [(0, [0], 1)]), LOSSY)
+    big = (1 << 62) - 1
+    for _ in range(5):
+        r = p.place(big)
+    total = 5 * big
+    assert total > 1 << 64
+    assert rows(r) == [(0, 0, UP, total, 0, total)]
+    assert r.offered == total and r.edge_drops == [(0, total)] and r.source_drops == 0
+    rec = p.records()[0]
+    assert rec.offered == total and rec.edge_drops == [(0, total)]
+
+
+# ---------------------------------------------------------------- E: evaluators
+
+
+def test_evaluation_options_offer():
+    g = par2(6, 4)
+    prog = tunnels(g, [0], [1], [(0, [0], 1), (0, [1], 1)])
+    cfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(prog))
+    # The offer is kept as given; the evaluator checks it.
+    assert ngc.EvaluationOptions(cfg, offer=5).offer == 5
+    assert ngc.EvaluationOptions(cfg).offer is None
+    assert ngc.EvaluationOptions(cfg, offer=INF).offer == INF
+    assert ngc.EvaluationOptions(cfg, offer=-1).offer == -1
+    r = ngc.evaluate_demand(g, 0, 1, ngc.EvaluationOptions(cfg))
+    assert (r.call_delivered, r.termination) == (9, T.EXHAUSTED)
+    pl = graph(4, PINLOSS)
+    lp = tunnels(pl, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    lcfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(lp), admission=LOSSY)
+    assert (
+        ngc.evaluate_demand(
+            pl, 0, 3, ngc.EvaluationOptions(lcfg, offer=12)
+        ).call_delivered
+        == 8
+    )
+    domain = "offer must be an integer in [0, 2^62)"
+    for opts, text in (
+        (
+            ngc.EvaluationOptions(lcfg),
+            "Pinned LOSSY evaluation requires a finite offer",
+        ),
+        (ngc.EvaluationOptions(lcfg, offer=INF), domain),
+        (ngc.EvaluationOptions(lcfg, offer=-1), domain),
+        (ngc.EvaluationOptions(lcfg, offer=4.0), domain),
+        (ngc.EvaluationOptions(lcfg, offer=1 << 62), domain),
+    ):
+        with pytest.raises(ValueError, match=exact(text)):
+            ngc.evaluate_demand(pl, 0, 3, opts)
+    # A finite offer for every model under each admission it supports.
+    t1 = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1)))
+    for opts in (
+        ngc.EvaluationOptions(shortest_paths(admission=LOSSY), offer=5),
+        ngc.EvaluationOptions(shortest_paths(), offer=5),
+        ngc.EvaluationOptions(global_(), offer=5),
+        ngc.EvaluationOptions(cfg, offer=5),
+        ngc.EvaluationOptions(t1, design_demand=6, offer=5),
+    ):
+        assert ngc.evaluate_demand(g, 0, 1, opts).call_delivered == 5
+    with pytest.raises(
+        ValueError, match=exact("evaluate_pairs does not accept Pinned")
+    ):
+        ngc.evaluate_pairs(g, [([0], [1])], ngc.EvaluationOptions(cfg))
+
+
+def test_pinned_edge_failures():
+    pl = graph(4, PINLOSS)
+    lp = tunnels(pl, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    cfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(lp))
+    s = ngc.evaluate_edge_failures(pl, 0, 3, ngc.EvaluationOptions(cfg), workers=1)
+    assert s.baseline.call_delivered == 4
+    assert [(e.edge, e.delivery_reduction) for e in s.entries] == [
+        (0, -6),
+        (1, 2),
+        (2, -6),
+        (3, 2),
+    ]
+    lcfg = ngc.FlowPolicyConfig(routing=ngc.Pinned(lp), admission=LOSSY)
+    s = ngc.evaluate_edge_failures(
+        pl, 0, 3, ngc.EvaluationOptions(lcfg, offer=12), workers=1
+    )
+    assert s.baseline.call_delivered == 8
+    assert [(e.edge, e.delivery_reduction) for e in s.entries] == [
+        (0, -2),
+        (1, 6),
+        (2, -2),
+        (3, 6),
+    ]
+    s2 = ngc.evaluate_edge_failures(
+        pl, 0, 3, ngc.EvaluationOptions(lcfg, offer=12), workers=2
+    )
+    assert [(e.edge, e.delivery_reduction) for e in s2.entries] == [
+        (e.edge, e.delivery_reduction) for e in s.entries
+    ]
+    es = graph(4, ES)
+    sup = ngc.evaluate_edge_failures(
+        es, 0, 3, ngc.EvaluationOptions(global_(support=dag(es, [1, 3]))), workers=1
+    )
+    assert sup.baseline.call_delivered == 10
+    assert [(e.edge, e.delivery_reduction) for e in sup.entries] == [
+        (0, 0),
+        (1, 10),
+        (2, 0),
+        (3, 10),
+    ]
+
+
+# ---------------------------------------------------------------- properties (program_oracle.py)
+
+
+def random_dag(rng, n):
+    """A random DAG on n nodes (edges from lower to higher node, some parallel, capacities with
+    zeros, costs 1 to 4), its rows sorted into EdgeId order."""
+    rows = []
+    for u in range(n):
+        for v in range(u + 1, n):
+            for _ in range(rng.choice((0, 1, 1, 2))):
+                rows.append((u, v, rng.choice((0, 3, 5, 7, 10, 12)), rng.randint(1, 4)))
+    rows.sort(key=lambda r: (r[0], r[3], r[1]))
+    return rows
+
+
+def simple_paths(rows, src, dst):
+    """Every path (EdgeIds) from src to dst over the DAG rows."""
+    out, stack = [], [(src, [])]
+    while stack:
+        u, p = stack.pop()
+        if u == dst:
+            out.append(p)
+            continue
+        for e, r in enumerate(rows):
+            if r[0] == u:
+                stack.append((r[1], [*p, e]))
+    return sorted(out)
+
+
+def random_tunnel_program(rng):
+    """A random graph and a supplied tunnel program over it (sources {0, 1} or {0}, destination
+    the last node), with weights 0 to 3; None when no source has a path. A quarter are the
+    crossing gadget: head 0's tunnels 0, 3, 5 and 1, 4, 6 cross at node 2, so a
+    mask can fail both while their union still reaches the destination (1, 3, 5)."""
+    if rng.random() < 0.25:
+        caps = [rng.choice((1, 3, 10)) for _ in range(7)]
+        ends = [(0, 2), (0, 2), (1, 5), (2, 3), (2, 4), (3, 5), (4, 5)]
+        rows = [(u, v, c, 1) for (u, v), c in zip(ends, caps, strict=True)]
+        specs = [
+            (0, [0, 3, 5], rng.randint(0, 3)),
+            (0, [1, 4, 6], rng.randint(1, 3)),
+            (1, [2], rng.randint(0, 3)),
+        ]
+        return 6, rows, [0, 1], specs
+    n = rng.randint(4, 6)
+    rows = random_dag(rng, n)
+    if (
+        rng.random() < 0.5
+    ):  # two heads into one tight link: ties between heads at a split
+        rows = [(0, 2, 10, 1), (1, 2, 10, 1)] + [r for r in rows if r[0] >= 2]
+        rows += [(2, n - 1, rng.choice((1, 2, 3)), 1)]
+        rows.sort(key=lambda r: (r[0], r[3], r[1]))
+    sources = [0, 1] if rng.random() < 0.7 else [0]
+    specs = []
+    for s in sources:
+        candidates = simple_paths(rows, s, n - 1)
+        for p in rng.sample(
+            candidates,
+            min(len(candidates), rng.randint(0, 3) if s else rng.randint(1, 5)),
+        ):
+            specs.append((s, p, rng.randint(0, 3)))
+    if not specs:
+        return None
+    rng.shuffle(specs)
+    return n, rows, sources, specs
+
+
+def test_tunnel_programs_against_the_oracle():
+    # Random tunnel programs, with and without a failure mask: the by_tunnel amounts, the LOSSY
+    # rows and edge loads (the loss rule, nested split at each link), conservation, and the
+    # LOSSLESS bound with its maximality.
+    import random
+
+    import program_oracle as orc
+
+    rng = random.Random(20261018)
+    checked = masked_checked = kept_without_entry = 0
+    for _ in range(150):
+        made = random_tunnel_program(rng)
+        if made is None:
+            continue
+        n, rows_, sources, specs = made
+        g = graph(n, rows_)
+        caps = [r[2] for r in rows_]
+        prog = tunnels(g, sources, [n - 1], specs)
+        excluded = (
+            []
+            if rng.random() < 0.5
+            else rng.sample(range(len(rows_)), min(len(rows_), rng.randint(1, 3)))
+        )
+        eligibility = g.eligibility(excluded_edges=excluded) if excluded else None
+        alive = [not (set(es) & set(excluded)) for _, es, _ in specs]
+        roster = orc.replay_roster(specs, rows_, excluded, [n - 1])
+        kept_without_entry += any(
+            not any(a for (h, _, _), a in zip(specs, alive, strict=True) if h == x)
+            for x in roster
+        )
+        offer = rng.randint(0, 40)
+        amounts, lost = orc.entry_amounts(offer, specs, alive, roster=roster)
+        r = pinned(g, prog, LOSSY, eligibility=eligibility).replace(
+            offer, outputs=ngc.OutputOptions(edge_flows=True)
+        )
+        assert [t.entry_id for t in r.by_tunnel] == list(
+            range(len(specs))
+        )  # list order
+        assert [t.assigned for t in r.by_tunnel] == amounts
+        assert [t.status for t in r.by_tunnel] == [UP if a else FAILED for a in alive]
+        want_rows, want_edges = orc.lossy(specs, amounts, caps)
+        assert [(t.delivered, t.total_edge_drops) for t in r.by_tunnel] == want_rows
+        assert r.edge_flows.tolist() == want_edges
+        assert r.source_drops == lost
+        assert (
+            r.offered
+            == offer
+            == r.delivered + sum(d for _, d in r.edge_drops) + r.source_drops
+        )
+        b = orc.lossless_bound(specs, caps, alive, roster=roster)
+        lossless = pinned(g, prog, LOSSLESS, eligibility=eligibility)
+        got = lossless.replace(INF, outputs=ngc.OutputOptions(edge_flows=True))
+        assert got.call_delivered == b
+        assert all(f <= c for f, c in zip(got.edge_flows.tolist(), caps, strict=True))
+        if b < 40:
+            assert lossless.replace(b + 1).call_delivered == b  # b + 1 does not fit
+        checked += 1
+        masked_checked += bool(excluded)
+    # Not vacuous: masks, and heads the replay keeps without a surviving tunnel.
+    assert checked > 100 and masked_checked > 30 and kept_without_entry > 0, (
+        kept_without_entry
+    )
+
+
+def test_export_replay_property():
+    # Over random graphs: a CentralizedTE program (both source allocations) forwarded by Pinned on a fresh
+    # ledger places the same amount on the same edges; its rows split each head's share over
+    # its tunnels exactly by the tunnel weights.
+    import random
+
+    import program_oracle as orc
+
+    rng = random.Random(7)
+    checked = 0
+    for _ in range(80):
+        n = rng.randint(4, 6)
+        rows_ = random_dag(rng, n)
+        g = graph(n, rows_)
+        sources = [0, 1] if rng.random() < 0.5 else [0]
+        source_allocation = rng.choice(
+            (ngc.SourceAllocation.OPTIMIZED, ngc.SourceAllocation.EQUAL)
+        )
+        offer = rng.randint(1, 30)
+        r = ngc.FlowPolicy(
+            ngc.FlowLedger(g), sources, n - 1, global_(source_allocation)
+        ).place(offer, ngc.OutputOptions(edge_flows=True))
+        if r.call_delivered == 0:
+            continue
+        prog = r.program
+        replay = pinned(g, prog).place(
+            r.call_delivered, ngc.OutputOptions(edge_flows=True)
+        )
+        assert (replay.call_delivered, replay.termination) == (
+            r.call_delivered,
+            T.COMPLETE,
+        )
+        assert replay.edge_flows.tolist() == r.edge_flows.tolist()
+        specs = [(t.head, list(t.edges), t.weight) for t in prog.tunnels]
+        amounts, lost = orc.entry_amounts(
+            r.call_delivered, specs, source_weights=prog.source_weights
+        )
+        assert lost == 0 and amounts == [t.weight for t in prog.tunnels]
+        assert [t.assigned for t in replay.by_tunnel] == amounts
+        checked += 1
+    assert checked > 50
+
+
+def test_global_support_optimality_certificate():
+    # CentralizedTE(support) over random supports: the value is the support's maximum flow (an
+    # independent Edmonds-Karp), the flow uses only the support, fits and is conserved, and the
+    # optimized source allocation leaves no negative-cost residual cycle (a minimum-cost maximum flow).
+    import random
+
+    import program_oracle as orc
+
+    rng = random.Random(11)
+    checked = 0
+    for _ in range(80):
+        n = rng.randint(4, 6)
+        rows_ = random_dag(rng, n)
+        if not rows_:
+            continue
+        g = graph(n, rows_)
+        support = sorted(rng.sample(range(len(rows_)), rng.randint(1, len(rows_))))
+        sources = [0, 1] if rng.random() < 0.5 else [0]
+        r = ngc.FlowPolicy(
+            ngc.FlowLedger(g), sources, n - 1, global_(support=dag(g, support))
+        ).place(INF, ngc.OutputOptions(edge_flows=True))
+        flow = r.edge_flows.tolist()
+        arcs = [(rows_[e][0], rows_[e][1], rows_[e][2]) for e in support]
+        value, _ = orc.max_flow(n, arcs, sources, [n - 1])
+        assert r.call_delivered == value
+        assert all(f == 0 for e, f in enumerate(flow) if e not in support)
+        assert all(f <= rows_[e][2] for e, f in enumerate(flow))
+        for v in range(n):
+            if v in sources or v == n - 1:
+                continue
+            assert sum(f for e, f in enumerate(flow) if rows_[e][1] == v) == sum(
+                f for e, f in enumerate(flow) if rows_[e][0] == v
+            )
+        maximal, min_cost = orc.residual_certificates(
+            n,
+            [(*rows_[e][:3], rows_[e][3]) for e in support],
+            [flow[e] for e in support],
+            sources,
+            [n - 1],
+        )
+        assert maximal and min_cost
+        assert r.total_cost == sum(flow[e] * rows_[e][3] for e in support)
+        checked += 1
+    assert checked > 60
+
+
+def test_mapping():
+    # today's Pinned uses mapped onto programs (values derived by hand).
+    split = ngc.RouteAllocation.WEIGHTED
+    # One Equal DAG route over DIAM: Lossless 200; Lossy place(100) delivers 100.
+    g = graph(4, DIAM)
+    one = ngc.ForwardingProgram.from_routes(
+        g, 0, 3, [ngc.RouteDefinition(0, dag(g, [0, 1, 2, 3]))]
+    )
+    assert pinned(g, one).place(INF).call_delivered == 200
+    assert pinned(g, one, LOSSY).place(100).call_delivered == 100
+    # Weighted with capacity weights (the default basis): 200; with the residual snapshot
+    # (100, 50, 100, 50), node 0 splits by H(x, (100, 50)): H(150) = (100, 50) fits, H(151) =
+    # (101, 50) does not.
+    w = ngc.ForwardingProgram.from_routes(
+        g, 0, 3, [ngc.RouteDefinition(0, dag(g, [0, 1, 2, 3]))], allocation=split
+    )
+    assert pinned(g, w).place(INF).call_delivered == 200
+    snap = ngc.ForwardingProgram.from_routes(
+        g,
+        0,
+        3,
+        [ngc.RouteDefinition(0, dag(g, [0, 1, 2, 3]))],
+        allocation=split,
+        weight_basis=ngc.WeightBasis.RESIDUAL_SNAPSHOT,
+        residual=[100, 50, 100, 50],
+    )
+    assert pinned(g, snap).place(INF).call_delivered == 150
+    # Two one-edge DAG routes on PAR2(6, 4): Equal and Weighted both split by round
+    # robin over the entries: 9; CentralizedTE(support) over both edges: 10.
+    g = par2(6, 4)
+    for options in ({}, {"allocation": split}):
+        two = ngc.ForwardingProgram.from_routes(
+            g,
+            0,
+            1,
+            [ngc.RouteDefinition(0, dag(g, [0])), ngc.RouteDefinition(0, dag(g, [1]))],
+            **options,
+        )
+        assert pinned(g, two).place(INF).call_delivered == 9
+    assert (
+        ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, global_(support=dag(g, [0, 1])))
+        .place(INF)
+        .call_delivered
+        == 10
+    )
+    # Two routes sharing e0 (4 units) on SHARE, Lossy place(10): RR(10, 2) = (5, 5) arrive at
+    # e0, which carries H(4, (5, 5)) = (2, 2): records 2 and 2.
+    g = graph(3, SHARE)
+    shared = ngc.ForwardingProgram.from_routes(
+        g,
+        0,
+        2,
+        [
+            ngc.RouteDefinition(0, dag(g, [0, 1])),
+            ngc.RouteDefinition(0, dag(g, [0, 2])),
+        ],
+    )
+    p = pinned(g, shared, LOSSY)
+    assert p.place(10).call_delivered == 4
+    assert [rec.delivered for rec in p.records()] == [2, 2]
+    # One Optimized route becomes CentralizedTE(support): ES over all four links, 12 at cost 34, one
+    # record per source with the used edges and no entry.
+    g = graph(4, ES)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_(support=dag(g, [0, 1, 2, 3])))
+    r = p.place(INF)
+    assert (r.call_delivered, r.total_cost) == (12, 34)
+    assert [(rec.entry_id, list(rec.route.via_edges())) for rec in p.records()] == [
+        (None, [0, 1, 2, 3])
+    ]
+    # Lossy +inf is refused.
+    g = par2(6, 4)
+    two = tunnels(g, [0], [1], [(0, [0], 1), (0, [1], 1)])
+    with pytest.raises(
+        ValueError, match=exact("LOSSY forwarding requires a finite offer")
+    ):
+        pinned(g, two, LOSSY).place(INF)
+    # Several sources and destinations are accepted.
+    g = graph(4, B1)
+    both = tunnels(g, [0, 1], [3], [(0, [0], 1), (1, [1, 2], 1)])
+    assert pinned(g, both).place(4).call_delivered == 4
+    # Duplicate routes are distinct entries: 12 over three records.
+    g = par2(4, 8)
+    dup = tunnels(g, [0], [1], [(0, [0], 1), (0, [1], 1), (0, [1], 1)])
+    p = pinned(g, dup)
+    assert p.place(INF).call_delivered == 12 and [
+        rec.entry_id for rec in p.records()
+    ] == [0, 1, 2]
+    # An empty route list.
+    with pytest.raises(ValueError, match=exact("routes must not be empty")):
+        ngc.ForwardingProgram.from_routes(g, 0, 1, [])
+    # Pinned takes a program: no bundles keyword, a list is not a program, None is refused.
+    with pytest.raises(TypeError):
+        ngc.Pinned(bundles=[dag(g, [0])])
+    with pytest.raises(TypeError):
+        ngc.Pinned([dag(g, [0])])
+    with pytest.raises(
+        TypeError, match=exact("Pinned program must be a ForwardingProgram")
+    ):
+        ngc.Pinned(None)
+
+
+# ---------------------------------------------------------------- facts of the retired fixtures
+
+
+def test_pinned_facts_of_the_retired_reference_fixtures():
+    # The Pinned facts that the removed reference fixtures held, derived again from the rules.
+    # pinned_bundle_rules: a split route's record reports its cheapest walk as min_route_cost: the
+    # DAG {0 -> 1 (cost 1), 1 -> 2 (cost 2), 0 -> 2 (cost 4)} has walks of cost 3 and 4.
+    g = graph(3, [(0, 1, 5, 1), (0, 2, 5, 4), (1, 2, 5, 2)])
+    prog = ngc.ForwardingProgram.from_routes(
+        g, [0], [2], [ngc.RouteDefinition(0, dag(g, [0, 1, 2]))]
+    )
+    p = pinned(g, prog)
+    p.place(1)
+    assert [(rec.entry_id, rec.min_route_cost) for rec in p.records()] == [(0, 3)]
+    # eb_1_plus_2_vs_3: Lossless Pinned is additive: place(1); place(2) re-solves 3 from zero,
+    # RR(3, 3) = (1, 1, 1), as place(3) does.
+    g = graph(2, [(0, 1, 10), (0, 1, 10), (0, 1, 10)])
+    prog = tunnels(g, [0], [1], [(0, [e], 1) for e in range(3)])
+    flows = ngc.OutputOptions(edge_flows=True)
+    split = pinned(g, prog)
+    split.place(1)
+    two = split.place(2, flows)
+    one = pinned(g, prog).place(3, flows)
+    assert two.edge_flows.tolist() == one.edge_flows.tolist() == [1, 1, 1]
+    assert (two.call_delivered, one.call_delivered) == (2, 3)
+    # admission_zero_and_no_route: every tunnel failed: the head reaches no destination over its
+    # own routes, the replay roster is empty, a positive request ends NO_ROUTE.
+    g = graph(4, TUN)
+    prog = tunnels(g, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    r = pinned(g, prog, eligibility=g.eligibility(excluded_edges=[0, 1])).place(5)
+    assert (r.call_delivered, r.termination) == (0, T.NO_ROUTE)
+    assert [t.status for t in r.by_tunnel] == [FAILED, FAILED]
+    # flag_zero_delivery_creation: a first place(1) on a tunnel whose only unit another owner
+    # holds creates the record at zero delivery and installs the program (both flags); a second
+    # zero-delivery call keeps the id and sets no flag (an offer-only call).
+    g = graph(2, [(0, 1, 1)])
+    ledger = ngc.FlowLedger(g)
+    ngc.FlowPolicy(ledger, 0, 1, shortest_paths()).place(1)
+    p = pinned(g, tunnels(g, [0], [1], [(0, [0], 1)]), ledger=ledger)
+    r = p.place(1)
+    ids = [rec.flow_id for rec in p.records()]
+    assert (r.call_delivered, r.termination, r.routes_changed, r.weights_changed) == (
+        0,
+        T.EXHAUSTED,
+        True,
+        True,
+    )
+    assert [rec.delivered for rec in p.records()] == [0]
+    r = p.place(1)
+    assert (r.call_delivered, r.routes_changed, r.weights_changed) == (0, False, False)
+    assert [rec.flow_id for rec in p.records()] == ids
+
+
+# ---------------------------------------------------------------- Python allocation failures
+
+
+@needs_hooks
+@pytest.mark.parametrize(
+    "case",
+    [
+        "shortest_paths replace",
+        "shortest_paths forward",
+        "global evaluate",
+        "pinned replace",
+    ],
+)
+def test_operations_are_all_or_nothing(case):
+    # Every Python object of evaluate, replace and forward exists before anything is published:
+    # the k-th Python allocation failing raises with the ledger and the policy as they were (the
+    # installed program and the earlier call's records included), and a retry returns what a
+    # call without failure returns.
+    g = graph(4, PINLOSS)
+    prog = tunnels(g, [0], [3], [(0, [0, 2], 1), (0, [1, 3], 1)])
+    configs = {
+        "shortest_paths replace": (shortest_paths(admission=LOSSY), "replace"),
+        "shortest_paths forward": (shortest_paths(admission=LOSSY), "forward"),
+        "global evaluate": (global_(), "evaluate"),
+        "pinned replace": (
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(prog), admission=LOSSY),
+            "replace",
+        ),
+    }
+    cfg, method = configs[case]
+
+    def make():
+        ledger = ngc.FlowLedger(g)
+        policy = ngc.FlowPolicy(ledger, 0, 3, cfg)
+        policy.replace(2)
+
+        def snapshot():
+            return [
+                full_ledger_state(ledger),
+                repr(policy._state()),
+                listing(policy.program),
+            ]
+
+        return getattr(policy, method), (6,), snapshot
+
+    assert (
+        sweep_python_allocation(make) >= 1
+    )  # the result object at least (its fields convert when read)
+
+
+@needs_hooks
+def test_from_routes_and_getters_survive_python_allocation_failures():
+    # from_routes, from_dag and the getters of shared values make their objects through the checked path:
+    # a failed Python allocation raises, and the call that completes returns the clean value.
+    g = graph(2, [(0, 1, 4), (0, 1, 8)])
+    routes = [
+        ngc.RouteDefinition(0, path(g, [0])),
+        ngc.RouteDefinition(0, dag(g, [0, 1]), weight=2),
+    ]
+    prog = ngc.ForwardingProgram.from_routes(g, [0], [1], routes)
+    # A CentralizedTE result: its program has no Python object yet, so the getter makes one.
+    result = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, global_()).place(3)
+    calls = [
+        (ngc.ForwardingProgram.from_routes, (g, [0], [1], routes)),
+        (ngc.ForwardingProgram.from_dag, (g, [0], [1], dag(g, [0, 1]))),
+        (lambda: result.program, ()),
+        (lambda: result.by_tunnel, ()),
+        (lambda: prog.tunnels, ()),
+    ]
+    for fn, args in calls:
+        failures = sweep_python_allocation(lambda fn=fn, args=args: (fn, args, list))
+        assert failures >= 1, fn
+
+
+# ---------------------------------------------------------------- wide weights, zero offers, failed entries
+
+
+@pytest.mark.parametrize("w", [1 << 61, (1 << 62) - 1])
+@pytest.mark.parametrize("admission", [LOSSLESS, LOSSY])
+@pytest.mark.parametrize("kind", ["tunnels", "explicit"])
+def test_large_equal_weights_deliver_exactly_eight(kind, admission, w):
+    # Eight equal legal weights sum to 2^64 or more; equal weights give RR(8, 8): one unit
+    # on each of eight links of 100.
+    g = graph(2, [(0, 1, 100)] * 8)
+    if kind == "tunnels":
+        p = pinned(g, tunnels(g, [0], [1], [(0, [i], w) for i in range(8)]), admission)
+    else:
+        p = ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            0,
+            1,
+            shortest_paths(
+                W,
+                admission,
+                weight_basis=ngc.WeightBasis.EXPLICIT,
+                edge_weights=[w] * 8,
+            ),
+        )
+    r = p.replace(8, outputs=ngc.OutputOptions(edge_flows=True))
+    assert r.call_delivered == r.delivered == r.admitted == 8
+    assert r.edge_flows.tolist() == [1] * 8
+    assert r.source_drops == r.call_source_drops == 0
+
+
+@pytest.mark.parametrize("admission", [LOSSLESS, LOSSY])
+def test_large_unequal_weights_split_by_highest_averages(admission):
+    # Weights 2^62 - 1, 2^61, 2^61 + 1, 1 (W = 2^63 + 1) on four links of 100, offer 9:
+    # lower quotas floor(9 w / W) = (4, 2, 2, 0); the ninth unit goes to the largest w / (a + 1),
+    # (2^62 - 1) / 5 against (2^61 + 1) / 3: H(9, w) = (5, 2, 2, 0), the oracle's too; explicit
+    # WCMP and tunnels alike.
+    import program_oracle as orc
+
+    weights = [(1 << 62) - 1, 1 << 61, (1 << 61) + 1, 1]
+    want = orc.ha(9, weights)
+    assert want == [5, 2, 2, 0]
+    g = graph(2, [(0, 1, 100)] * 4)
+    for p in (
+        pinned(
+            g,
+            tunnels(g, [0], [1], [(0, [i], w) for i, w in enumerate(weights)]),
+            admission,
+        ),
+        ngc.FlowPolicy(
+            ngc.FlowLedger(g),
+            0,
+            1,
+            shortest_paths(
+                W,
+                admission,
+                weight_basis=ngc.WeightBasis.EXPLICIT,
+                edge_weights=weights,
+            ),
+        ),
+    ):
+        r = p.replace(9, outputs=ngc.OutputOptions(edge_flows=True))
+        assert (
+            r.call_delivered == 9
+            and r.edge_flows.tolist() == want
+            and r.source_drops == 0
+        )
+
+
+@pytest.mark.parametrize("method", ["replace", "evaluate", "forward"])
+@pytest.mark.parametrize("case", ["no-route", "zero-weight"])
+@pytest.mark.parametrize("admission", [LOSSLESS, LOSSY])
+def test_full_zero_offer_is_complete(method, case, admission):
+    # A full zero offer is COMPLETE (the first termination rule), after its preparation: an empty
+    # roster and a program without a positive weight alike.
+    g = graph(2, [(0, 1, 10)])
+    cfg = shortest_paths(
+        W, admission, weight_basis=ngc.WeightBasis.EXPLICIT, edge_weights=[0]
+    )
+    eligibility = g.eligibility(excluded_edges=[0]) if case == "no-route" else None
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, cfg, eligibility)
+    if method == "forward":
+        p.replace(1)
+    r = getattr(p, method)(0)
+    assert r.termination == T.COMPLETE and r.call_delivered == 0
+    assert r.program is not None  # prepared
+
+
+@pytest.mark.parametrize("method", ["replace", "evaluate"])
+@pytest.mark.parametrize("admission", [LOSSLESS, LOSSY])
+def test_full_zero_offer_is_complete_for_pinned(method, admission):
+    # The same for Pinned: a program whose head is masked out, and one whose weights are all 0.
+    g = graph(2, [(0, 1, 10)])
+    masked = pinned(
+        g,
+        tunnels(g, [0], [1], [(0, [0], 1)]),
+        admission,
+        eligibility=g.eligibility(excluded_edges=[0]),
+    )
+    zero = pinned(g, tunnels(g, [0], [1], [(0, [0], 0)]), admission)
+    for p in (masked, zero):
+        assert getattr(p, method)(0).termination == T.COMPLETE
+
+
+@pytest.mark.parametrize("admission", [LOSSLESS, LOSSY])
+@pytest.mark.parametrize("offer", [0, 5])
+def test_all_failed_entries_still_have_records(admission, offer):
+    # One record per program entry also when every entry fails: zero, an empty route,
+    # route cost None; replace retires and recreates them, an increment keeps them, evaluate
+    # publishes nothing.
+    g = graph(2, [(0, 1, 10)])
+    p = pinned(
+        g,
+        tunnels(g, [0], [1], [(0, [0], 1)]),
+        admission,
+        eligibility=g.eligibility(excluded_edges=[0]),
+    )
+    assert p.evaluate(offer).call_delivered == 0 and p.records() == []
+    r = p.replace(offer)
+    assert r.termination == (T.COMPLETE if offer == 0 else T.NO_ROUTE)
+    rows = lambda: [  # noqa: E731
+        (
+            rec.entry_id,
+            rec.delivered,
+            rec.edge_flows,
+            rec.route.via_edges().tolist(),
+            rec.min_route_cost,
+        )
+        for rec in p.records()
+    ]
+    assert rows() == [(0, 0, [], [], None)]
+    first = [rec.flow_id for rec in p.records()]
+    p.replace(offer)
+    second = [rec.flow_id for rec in p.records()]
+    assert rows() == [(0, 0, [], [], None)] and second != first  # retired and recreated
+    r = p.place(3)
+    assert (
+        r.call_delivered == 0 and [rec.flow_id for rec in p.records()] == second
+    )  # an increment keeps it
+    if admission == LOSSY:
+        assert r.call_source_drops == 3
+
+
+def test_oracle_witnesses():
+    # The reference's replay roster is the saved basis, whatever survives, and the offer
+    # that captured weights of 0 do not inject is source loss; each against the library, with the
+    # old rule as a negative control (it must disagree on the same input).
+    import program_oracle as orc
+
+    rows_ = [
+        (0, 2, 10),
+        (0, 2, 10),
+        (1, 5, 10),
+        (2, 3, 10),
+        (2, 4, 10),
+        (3, 5, 10),
+        (4, 5, 10),
+    ]
+    g = graph(6, rows_)
+    specs = [(0, [0, 3, 5], 1), (0, [1, 4, 6], 1), (1, [2], 1)]
+    excluded = [0, 6]
+    alive = [False, False, True]
+    r = pinned(
+        g,
+        tunnels(g, [0, 1], [5], specs),
+        LOSSY,
+        eligibility=g.eligibility(excluded_edges=excluded),
+    ).replace(2)
+    native = ([t.assigned for t in r.by_tunnel], r.source_drops)
+    # Head 0's tunnels both fail, but its basis keeps 1, 3, 5: it stays in the equal pool and
+    # loses its unit; head 1 carries the other.
+    roster = orc.replay_roster(specs, rows_, excluded, [5])
+    assert roster == [0, 1]
+    assert orc.entry_amounts(2, specs, alive, roster=roster) == native == ([0, 0, 1], 1)
+    # The old rule (the heads with a surviving tunnel) gives head 1 both units.
+    assert orc.entry_amounts(2, specs, alive, roster=[1]) == ([0, 0, 2], 0) != native
+    # Captured weights all 0 (place(1)'s CentralizedTE program, whose source 1 weighs 0, with source 0
+    # masked): the whole offer is lost.
+    g = graph(3, [(0, 2, 5), (1, 2, 5)])
+    prog = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 2, global_()).place(1).program
+    r = pinned(g, prog, LOSSY, eligibility=g.eligibility(excluded_nodes=[0])).replace(4)
+    gspecs = [(t.head, list(t.edges), t.weight) for t in prog.tunnels]
+    galive = [t.head != 0 for t in prog.tunnels]
+    got = orc.entry_amounts(
+        4, gspecs, galive, source_weights=prog.source_weights, roster=[1]
+    )
+    assert got == ([0] * len(gspecs), 4) and r.source_drops == 4
+    assert orc.entry_amounts(5, [(0, [0], 1)], source_weights=[(0, 0)]) == ([0], 5)
+
+
+def test_global_record_route_is_its_share_inside_a_support():
+    # A CentralizedTE record's route is the set of edges that carry its share, also inside a supplied
+    # support (semantics, "Records of the controllers"); it is the support itself only when the
+    # share uses every support edge. Two paths to 3: 0-1-3 at cost 1 + 1 and 0-2-3 at cost 2 + 2,
+    # capacity 10 each; the support is all four edges.
+    g = graph(4, [(0, 1, 10, 1), (0, 2, 10, 2), (1, 3, 10, 1), (2, 3, 10, 2)])
+    support = dag(g, [0, 1, 2, 3])
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, global_(support=support))
+    # 3 units: the cheaper path carries them all (cost 2 per unit).
+    assert p.place(3).call_delivered == 3
+    [rec] = p.records()
+    assert [(int(e), int(x)) for e, x in rec.edge_flows] == [(0, 3), (2, 3)]
+    assert rec.route.via_edges().tolist() == [0, 2]
+    assert rec.min_route_cost == 2
+    # 10 more: the cheap path fills at 10 and the other carries 3: every support edge, the same
+    # value as the support.
+    assert p.place(10).call_delivered == 10
+    [rec] = p.records()
+    assert rec.route.via_edges().tolist() == [0, 1, 2, 3]
+    assert rec.route == support
+    assert rec.min_route_cost == 2
+
+
+def test_change_flags_of_empty_programs_and_place_zero():
+    # Semantics, change flags: the first nonempty program sets both flags; an empty program over
+    # none (an empty roster, replace(0) included) sets neither; place(0) prepares and installs
+    # nothing, while the full zero offer replace(0) installs the program and follows the rows.
+    g = graph(3, [(0, 1, 10), (2, 1, 10)])  # source 0 reaches 1; nothing reaches 2
+    empty = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 2, shortest_paths())
+    r = empty.replace(0)
+    assert r.program is not None and r.program.tunnels == ()
+    assert (r.routes_changed, r.weights_changed) == (False, False)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, shortest_paths())
+    r = p.place(0)
+    assert r.program is None and p.program is None
+    assert (r.routes_changed, r.weights_changed) == (False, False)
+    r = p.replace(0)
+    assert r.program is not None and p.program is not None
+    assert (r.routes_changed, r.weights_changed) == (True, True)
diff --git a/tests/py/test_public_surface.py b/tests/py/test_public_surface.py
new file mode 100644
index 0000000..1e9a893
--- /dev/null
+++ b/tests/py/test_public_surface.py
@@ -0,0 +1,898 @@
+"""The public surface: the graph on units, Eligibility, the conversions, the route structures,
+the route choice and placement axes, the ledger, the policy engine, the ShortestPathCache, the evaluators
+and the public search; the extension's private entry, which netgraph_core never re-exports;
+the retired spellings and the retired search entry points, which exist nowhere, without
+aliases; and the argument checks of the bindings, each with its exception class and whole
+message."""
+
+import re
+from pathlib import Path
+from types import SimpleNamespace
+
+import _netgraph_core
+import numpy as np
+import pytest
+from helpers import HIGHER_AVAIL, assert_read_only, config, exact
+from private_hooks import HOOKS
+
+import netgraph_core as ngc
+
+PUBLIC = {
+    "Graph",
+    "Eligibility",
+    "to_units",
+    "as_float",
+    "PredecessorDAG",
+    "Path",
+    "RouteTieBreak",
+    "RouteAllocation",
+    "Admission",
+    "SourceAllocation",
+    "FlowLedger",
+    "FlowRecord",
+    "AbsoluteCost",
+    "CostStretch",
+    "TunnelCount",
+    "ShortestPaths",
+    "DistributedTE",
+    "CentralizedTE",
+    "Pinned",
+    "WeightBasis",
+    "TunnelStatus",
+    "Tunnel",
+    "RouteDefinition",
+    "ForwardingProgram",
+    "TunnelFlow",
+    "TunnelPlan",
+    "FlowPolicyConfig",
+    "OutputOptions",
+    "Termination",
+    "PlacementResult",
+    "SourceFlow",
+    "FlowPolicy",
+    "Place",
+    "Replace",
+    "Forward",
+    "BatchMode",
+    "apply_actions",
+    "ShortestPathCache",
+    "ShortestPathCacheMiss",
+    "ShortestPathCacheStats",
+    "EvaluationOptions",
+    "SensitivityEntry",
+    "SensitivityResult",
+    "evaluate_demand",
+    "evaluate_pairs",
+    "evaluate_edge_failures",
+    "Direction",
+    "SpfOptions",
+    "SpfResult",
+    "UNREACHABLE",
+    "spf",
+    "KspOptions",
+    "ksp",
+    "resolve_to_paths",
+}
+
+# The shipped private entry: the flow core's _solve_min_cost_flow.
+PRIVATE = {"_solve_min_cost_flow"}
+
+# The private hooks (NETGRAPH_CORE_PRIVATE_HOOKS: the development build only): module functions
+# and class members.
+HOOK_FUNCTIONS = {
+    "_ConcurrencyProbe",
+    "_at_native_exit",
+    "_PlacementTrace",
+    "_concurrency_model",
+    "_fail_python_allocation",
+    "_fail_native_allocation",
+    "_with_forwarding_limits",
+    "_check_forwarding_count",
+    "_round_robin",
+    "_highest_averages",
+}
+HOOK_MEMBERS = {
+    "FlowLedger": {"_state"},
+    "FlowPolicy": {"_place_traced", "_state", "_owner", "_seed_requested"},
+}
+
+
+def test_public_surface():
+    assert set(ngc.__all__) == PUBLIC | {"__version__"}
+    # Every name the package exposes, not only the ones __all__ lists: the public names and the
+    # private metadata reader behind __version__ (dunder module attributes aside).
+    assert {n for n in dir(ngc) if not n.startswith("__")} == PUBLIC | {"_version"}
+    for name in ngc.__all__:
+        assert hasattr(ngc, name)
+    # Every public name is the compiled module's own object, re-exported.
+    for name in PUBLIC:
+        assert getattr(ngc, name) is getattr(_netgraph_core, name), name
+    assert isinstance(ngc.__version__, str)
+    # 55 entries with __version__ (RouteTieBreak replaces the three earlier route-choice types).
+    assert len(ngc.__all__) == 55
+
+
+def test_enum_values_are_pinned():
+    # The promised integer values of the public enumerations (docs/semantics.md, "Forwarding
+    # programs" and "Termination").
+    assert {m.name: int(m) for m in ngc.TunnelStatus.__members__.values()} == {
+        "UP": 0,
+        "INSUFFICIENT_BANDWIDTH": 1,
+        "COST_CEILING_EXCEEDED": 2,
+        "FAILED": 3,
+        "BLACKHOLED": 4,
+    }
+    assert {m.name: int(m) for m in ngc.Termination.__members__.values()} == {
+        "COMPLETE": 0,
+        "NO_ROUTE": 1,
+        "EXHAUSTED": 2,
+        "NO_ACTIVE_WEIGHT": 3,
+    }
+
+
+def test_enum_declaration_order():
+    # Every enumeration lists its members in the promised order (the interface listing,
+    # contract_api.py's source); no other integer value is promised.
+    order = {
+        ngc.RouteTieBreak: [
+            "FEWER_HOPS",
+            "HIGHER_CAPACITY",
+            "HIGHER_AVAILABLE_CAPACITY",
+            "HIGHER_HEADROOM",
+        ],
+        ngc.RouteAllocation: ["EQUAL", "WEIGHTED", "OPTIMIZED"],
+        ngc.SourceAllocation: ["EQUAL", "OPTIMIZED", "WEIGHTED"],
+        ngc.WeightBasis: ["CAPACITY", "EXPLICIT", "RESIDUAL_SNAPSHOT"],
+        ngc.Admission: ["LOSSLESS", "LOSSY"],
+        ngc.Direction: ["FORWARD", "REVERSE"],
+        ngc.TunnelStatus: [
+            "UP",
+            "INSUFFICIENT_BANDWIDTH",
+            "COST_CEILING_EXCEEDED",
+            "FAILED",
+            "BLACKHOLED",
+        ],
+        ngc.Termination: ["COMPLETE", "NO_ROUTE", "EXHAUSTED", "NO_ACTIVE_WEIGHT"],
+    }
+    for enum, names in order.items():
+        assert list(enum.__members__) == names, enum.__name__
+        values = [int(enum.__members__[n]) for n in names]
+        assert values == sorted(values), enum.__name__
+
+
+def test_route_choice_defaults_and_strict_bools():
+    # ShortestPaths() is ECMP: FEWER_HOPS, every equal-cost route, every parallel edge.
+    # The route choice is keywords only; a bool field takes bool or numpy.bool_ alone, so None
+    # (no longer a multipath value) and 1 are TypeErrors.
+    sp = ngc.ShortestPaths()
+    assert (sp.tie_break, sp.multipath, sp.parallel_edges) == (
+        ngc.RouteTieBreak.FEWER_HOPS,
+        True,
+        True,
+    )
+    assert repr(sp) == (
+        "ShortestPaths(allocation=RouteAllocation.EQUAL, source_allocation=None,"
+        " weight_basis=None, edge_weights=None, tie_break=RouteTieBreak.FEWER_HOPS,"
+        " multipath=True, parallel_edges=True)"
+    )
+    assert_read_only(
+        sp,
+        "allocation",
+        "source_allocation",
+        "weight_basis",
+        "edge_weights",
+        "tie_break",
+        "multipath",
+        "parallel_edges",
+    )
+    one = ngc.ShortestPaths(multipath=np.bool_(False))
+    assert one.multipath is False
+    ca = ngc.DistributedTE(ngc.TunnelCount(1))
+    assert (ca.tie_break, ca.parallel_edges) == (ngc.RouteTieBreak.FEWER_HOPS, True)
+    assert_read_only(ca, "tie_break", "parallel_edges")
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(ngc.RouteTieBreak.HIGHER_CAPACITY)
+    with pytest.raises(TypeError):
+        ngc.DistributedTE(ngc.TunnelCount(1), multipath=False)  # T1 is single-path
+    for bad in (None, 1, "no"):
+        with pytest.raises(TypeError):
+            ngc.ShortestPaths(multipath=bad)
+        with pytest.raises(TypeError):
+            ngc.ShortestPaths(parallel_edges=bad)
+        with pytest.raises(TypeError):
+            ngc.DistributedTE(ngc.TunnelCount(1), parallel_edges=bad)
+        with pytest.raises(TypeError):
+            ngc.OutputOptions(edge_flows=bad)
+        with pytest.raises(TypeError):
+            ngc.TunnelCount(2, up_to=bad)
+        with pytest.raises(TypeError):
+            ngc.CentralizedTE(
+                source_allocation=ngc.SourceAllocation.EQUAL, prefer_headroom=bad
+            )
+
+
+def test_tunnel_values_read_only():
+    # The T1 configuration values have read-only fields and no T0 keyword.
+    t = ngc.TunnelCount(2)
+    ca = ngc.DistributedTE(t, cost_ceiling=ngc.AbsoluteCost(3))
+    assert_read_only(t, "per_head", "up_to")
+    assert_read_only(ca, "tunnel_count", "cost_ceiling", "min_unreserved_bandwidth")
+    with pytest.raises(TypeError):
+        ngc.DistributedTE(flow_count=2)
+    assert (
+        repr(t) == "TunnelCount(2)"
+        and repr(ngc.TunnelCount(4, up_to=True)) == "TunnelCount(4, up_to=True)"
+    )
+    assert repr(ca) == (
+        "DistributedTE(TunnelCount(2), cost_ceiling=AbsoluteCost(3), min_unreserved_bandwidth=0,"
+        " tie_break=RouteTieBreak.FEWER_HOPS, parallel_edges=True)"
+    )
+    assert "cost_ceiling=None," in repr(ngc.DistributedTE(t))
+    assert repr(
+        ngc.DistributedTE(
+            ngc.TunnelCount(3),
+            cost_ceiling=ngc.CostStretch(2.0),
+            min_unreserved_bandwidth=5,
+            tie_break=ngc.RouteTieBreak.HIGHER_HEADROOM,
+            parallel_edges=False,
+        )
+    ) == (
+        "DistributedTE(TunnelCount(3), cost_ceiling=CostStretch(Fraction(2, 1)), min_unreserved_bandwidth=5,"
+        " tie_break=RouteTieBreak.HIGHER_HEADROOM, parallel_edges=False)"
+    )
+    assert (
+        t == ngc.TunnelCount(2)
+        and hash(t) == hash(ngc.TunnelCount(2))
+        and t != ngc.TunnelCount(2, up_to=True)
+    )
+
+
+def test_extension_surface_is_exactly_the_public_and_private_sets():
+    names = {n for n in dir(_netgraph_core) if not n.startswith("__")}
+    assert names == PUBLIC | PRIVATE | (HOOK_FUNCTIONS if HOOKS else set())
+    for name in PRIVATE | HOOK_FUNCTIONS:
+        assert not hasattr(ngc, name)
+    # Every private class member is a hook (beside pybind11's own conduit); the hooks are all
+    # present or all absent.
+    for cls in PUBLIC:
+        obj = getattr(_netgraph_core, cls)
+        private = {
+            n
+            for n in dir(obj)
+            if n.startswith("_")
+            and not n.startswith("__")
+            and n != "_pybind11_conduit_v1_"
+        }
+        want = HOOK_MEMBERS.get(cls, set()) if HOOKS else set()
+        assert private == want, cls
+
+
+def test_signatures_name_registered_types_only():
+    # pybind11 writes a signature's types when the binding is made: a type registered after a
+    # binding that takes, returns or defaults to it appears under its C++ name (the
+    # registration files run in an order where every such type comes first).
+    docs = []
+    for name, obj in vars(_netgraph_core).items():
+        docs.append((name, getattr(obj, "__doc__", None)))
+        if isinstance(obj, type):
+            for member, raw in vars(obj).items():
+                target = raw.__func__ if isinstance(raw, staticmethod) else raw
+                docs.append((f"{name}.{member}", getattr(target, "__doc__", None)))
+                if isinstance(raw, property) and raw.fget is not None:
+                    docs.append((f"{name}.{member}.fget", raw.fget.__doc__))
+    signed = [
+        (name, line)
+        for name, doc in docs
+        if isinstance(doc, str)
+        for index, line in enumerate(doc.splitlines())
+        if (index == 0 or re.match(r"^\d+\. ", line))
+        and re.match(r"^(?:\d+\. )?\w+\(.*\) -> ", line)
+    ]
+    assert len(signed) > 200  # not vacuous: every function, method and property
+    for name, signature in signed:
+        assert "::" not in signature, (name, signature)
+
+
+# Retired spellings of this API's names: no alias.
+RETIRED = {
+    "StrictMultiDiGraph",
+    "FlowGraph",
+    "Outputs",
+    "Diminishing",
+    "DiminishingReturns",
+    "MAX_FLOWS_PER_CALL",
+    "kMaxFlowsPerCall",
+    "_max_flows_per_call",
+    "CapacityOptions",
+    "SensitivityOptions",
+    "PathSelection",
+    "EdgeTieBreak",
+    "EdgePriority",
+}
+
+# The retired search entry points, their option types and the private name _spf: never bound.
+RETIRED_SEARCH = {
+    "shortest_paths",
+    "shortest_paths_to",
+    "spf_dag",
+    "spf_to",
+    "spf_reverse",
+    "k_shortest_paths",
+    "_spf",
+    "EdgeSelection",
+    "PathAlg",
+}
+
+
+# Retired members: PlacementResult's per-source termination list (the result reports one
+# termination and per-source rows in by_source), FlowRecord's kernel (only ever written),
+# FlowPolicy's usable-bundle count and Pinned's bundle list (Pinned forwards a ForwardingProgram;
+# FlowPolicy.program and PlacementResult.by_tunnel report what is forwarded), the growth
+# computation's DistributedTE fields and terminations (T1 sets up its tunnels once per call).
+RETIRED_MEMBERS = {
+    "PlacementResult": {"local_outcomes"},
+    "FlowRecord": {"placement"},
+    "FlowPolicy": {"usable_bundles"},
+    "Pinned": {"bundles"},
+    "DistributedTE": {
+        "flow_count",
+        "max_flow_count",
+        "min_flow_bandwidth",
+        "reoptimize",
+        "diminishing",
+        "selection",
+    },
+    "FlowPolicyConfig": {"selection", "placement", "origin", "weights", "edge_weights"},
+    "SpfOptions": {"selection"},
+    "KspOptions": {"selection", "multipath"},
+    "Termination": {"LIMIT_FLOWS", "LIMIT_DIMINISHING"},
+}
+
+
+# The files that tell a hooks build from a shipped one by probing one private hook.
+HOOK_PROBES = (
+    "dev/pytest_guard.py",
+    "dev/stubs/generate.py",
+    "tests/py/private_hooks.py",
+)
+
+
+def test_hook_probes_name_a_bound_hook():
+    # A probe of a deleted hook makes a hooks build look like a shipped one: CI then refuses a
+    # correct editable build, and the release check that a wheel has no hooks can never fail.
+    root = Path(__file__).resolve().parents[2]
+    if not all((root / rel).is_file() for rel in HOOK_PROBES):
+        pytest.skip("needs a git checkout: the sdist leaves out .github/ and dev/")
+    names = {}
+    for rel in HOOK_PROBES:
+        found = re.findall(r"hasattr\(\w+, ['\"](\w+)['\"]\)", (root / rel).read_text())
+        assert found, rel
+        for name in found:
+            names.setdefault(name, []).append(rel)
+    assert set(names) == {"_fail_native_allocation"}, names
+    assert not HOOKS or all(hasattr(_netgraph_core, name) for name in names)
+
+
+def test_retired_spellings_are_absent():
+    for name in RETIRED | RETIRED_SEARCH:
+        assert not hasattr(_netgraph_core, name), name
+        assert not hasattr(ngc, name), name
+    for cls, members in RETIRED_MEMBERS.items():
+        for member in members:
+            assert not hasattr(getattr(ngc, cls), member), (cls, member)
+    # FlowPolicyConfig takes keywords only: no positional spelling.
+    with pytest.raises(TypeError):
+        ngc.FlowPolicyConfig(ngc.ShortestPaths(), ngc.Admission.LOSSLESS)
+    assert ngc.Graph.__name__ == "Graph"
+    assert ngc.FlowLedger.__name__ == "FlowLedger"
+    assert ngc.OutputOptions.__name__ == "OutputOptions"
+    # PredecessorDAG and Path carry no resolver or alternative constructors.
+    for name in ("resolve_to_paths", "from_edges", "from_hops"):
+        assert not hasattr(ngc.PredecessorDAG, name), name
+    for name in ("from_edges", "from_hops"):
+        assert not hasattr(ngc.Path, name), name
+    # The search queue is C++ only.
+    assert not hasattr(ngc, "SpfQueue")
+    assert ngc.UNREACHABLE == 2**63 - 1
+
+
+def test_policy_takes_its_ledger_first_or_by_the_name_ledger():
+    cfg = config(ngc.ShortestPaths(tie_break=HIGHER_AVAIL, parallel_edges=False))
+    g = ngc.Graph(2, [0], [1], [3], [1], 1.0)
+    ledger = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(ledger=ledger, sources=0, destinations=1, config=cfg)
+    assert p.place(2).call_delivered == 2
+    assert ledger.records()[0].delivered == 2
+    # Positionally the ledger comes first.
+    assert ngc.FlowPolicy(ledger, 0, 1, cfg).place(1).call_delivered == 1
+    with pytest.raises(TypeError):
+        ngc.FlowPolicy(flow_graph=ledger, sources=0, destinations=1, config=cfg)
+    with pytest.raises(TypeError, match=exact("ledger must be a FlowLedger")) as info:
+        ngc.FlowPolicy(None, 0, 1, cfg)
+    assert type(info.value) is TypeError
+
+
+def _refusal_inputs():
+    """What the refused calls below share: the chain 0 -> 1 -> 2 and valid options."""
+    g = ngc.Graph(3, [0, 1], [1, 2], [5, 5], [1, 1], 1.0)
+    cfg = config(ngc.ShortestPaths())
+    return SimpleNamespace(
+        g=g,
+        ledger=ngc.FlowLedger(g),
+        cfg=cfg,
+        query=ngc.EvaluationOptions(cfg),
+        spf=ngc.SpfOptions(ngc.Direction.FORWARD),
+        ksp=ngc.KspOptions(1),
+        dag=ngc.Path(g, [[0], [1]]).to_dag(),
+        route=ngc.RouteDefinition(0, ngc.Path(g, [[0], [1]])),
+    )
+
+
+GRAPH = "graph must be a Graph"
+INTERSECT = "Eligibility.intersect takes two Eligibility values"
+PAIR = "each pair must be (sources, destinations)"
+ROUTING = (
+    "routing must be ShortestPaths, DistributedTE, CentralizedTE or Pinned (got {})"
+)
+ROUTES = "routes must be a sequence of RouteDefinition"
+ROUTE_TYPE = "RouteDefinition route must be a Path or a PredecessorDAG (got {})"
+
+# Each wrong argument, the exception class and the whole message it is refused with: a wrong type
+# (None included) TypeError, a wrong value (a pair of another length, an unknown FlowId)
+# ValueError. A None where a Graph, an Eligibility or a PredecessorDAG is expected reaches the
+# binding as a null value (pybind11 refuses every other wrong type first), so these checks also keep
+# the call from reading it.
+REFUSALS = {
+    "spf-graph-None": (lambda s: ngc.spf(None, 0, s.spf), TypeError, GRAPH),
+    "ksp-graph-None": (lambda s: ngc.ksp(None, 0, 2, s.ksp), TypeError, GRAPH),
+    "resolve-graph-None": (
+        lambda s: ngc.resolve_to_paths(None, s.dag, 0, 2),
+        TypeError,
+        GRAPH,
+    ),
+    "resolve-dag-None": (
+        lambda s: ngc.resolve_to_paths(s.g, None, 0, 2),
+        TypeError,
+        "dag must be a PredecessorDAG",
+    ),
+    "ShortestPathCache-graph-None": (
+        lambda s: ngc.ShortestPathCache(None),
+        TypeError,
+        GRAPH,
+    ),
+    "FlowLedger-graph-None": (lambda s: ngc.FlowLedger(None), TypeError, GRAPH),
+    "FlowLedger-graph-None-with-residual": (
+        lambda s: ngc.FlowLedger(None, [5, 5]),
+        TypeError,
+        GRAPH,
+    ),
+    "Path-graph-None": (lambda s: ngc.Path(None, [[0]]), TypeError, GRAPH),
+    "from_csr-graph-None": (
+        lambda s: ngc.PredecessorDAG.from_csr(None, [0, 0, 0, 0], [], []),
+        TypeError,
+        GRAPH,
+    ),
+    "capacity-graph-None": (
+        lambda s: ngc.evaluate_demand(None, 0, 2, s.query),
+        TypeError,
+        GRAPH,
+    ),
+    "evaluate_pairs-graph-None": (
+        lambda s: ngc.evaluate_pairs(None, [(0, 2)], s.query),
+        TypeError,
+        GRAPH,
+    ),
+    "sensitivity-graph-None": (
+        lambda s: ngc.evaluate_edge_failures(None, 0, 2, s.query),
+        TypeError,
+        GRAPH,
+    ),
+    "intersect-second-None": (
+        lambda s: ngc.Eligibility.intersect(s.g.eligibility(), None),
+        TypeError,
+        INTERSECT,
+    ),
+    "intersect-first-None": (
+        lambda s: ngc.Eligibility.intersect(None, s.g.eligibility()),
+        TypeError,
+        INTERSECT,
+    ),
+    # Shapes and types of sequence and field arguments.
+    "evaluate_pairs-pairs-not-a-sequence": (
+        lambda s: ngc.evaluate_pairs(s.g, 5, s.query),
+        TypeError,
+        "pairs must be a sequence of (sources, destinations)",
+    ),
+    "evaluate_pairs-pair-of-one": (
+        lambda s: ngc.evaluate_pairs(s.g, [(0,)], s.query),
+        ValueError,
+        PAIR,
+    ),
+    "evaluate_pairs-pair-not-a-sequence": (
+        lambda s: ngc.evaluate_pairs(s.g, [5], s.query),
+        TypeError,
+        PAIR,
+    ),
+    "evaluate_pairs-per_pair_eligibility-not-a-sequence": (
+        lambda s: ngc.evaluate_pairs(s.g, [(0, 2)], s.query, 5),
+        TypeError,
+        "per_pair_eligibility must be a sequence of Eligibility or None",
+    ),
+    "Path-hops-not-a-sequence": (
+        lambda s: ngc.Path(s.g, 5),
+        TypeError,
+        "Path: hops must be a sequence of hops (sequences of EdgeIds)",
+    ),
+    "FlowPolicy-sources-2-D": (
+        lambda s: ngc.FlowPolicy(s.ledger, np.array([[0]]), 2, s.cfg),
+        TypeError,
+        "sources must be a 1-D array (got 2 dimensions)",
+    ),
+    "FlowLedger-record-unknown-ledger": (
+        lambda s: s.ledger.record((-1, 0)),
+        ValueError,
+        "FlowId (-1, 0) is retired or unknown",
+    ),
+    "config-routing-int": (
+        lambda s: config(5),
+        TypeError,
+        ROUTING.format("int"),
+    ),
+    "config-routing-None": (
+        lambda s: config(None),
+        TypeError,
+        ROUTING.format("NoneType"),
+    ),
+    "TunnelCount-per_head-None": (
+        lambda s: ngc.TunnelCount(None),
+        TypeError,
+        "TunnelCount per_head must be an integer (got NoneType)",
+    ),
+    "TunnelCount-per_head-bool": (
+        lambda s: ngc.TunnelCount(True),
+        TypeError,
+        "TunnelCount per_head must be an integer (got bool)",
+    ),
+    "DistributedTE-min_unreserved_bandwidth-None": (
+        lambda s: ngc.DistributedTE(ngc.TunnelCount(1), min_unreserved_bandwidth=None),
+        TypeError,
+        "min_unreserved_bandwidth must be an integer (got NoneType)",
+    ),
+    "AbsoluteCost-cost-None": (
+        lambda s: ngc.AbsoluteCost(None),
+        TypeError,
+        "AbsoluteCost cost must be an integer (got NoneType)",
+    ),
+    "Stretch-factor-str": (
+        lambda s: ngc.CostStretch("1.5"),
+        TypeError,
+        "CostStretch factor must be a Fraction, a float or an integer (got str)",
+    ),
+    "Stretch-factor-bool": (
+        lambda s: ngc.CostStretch(True),
+        TypeError,
+        "CostStretch factor must be a Fraction, a float or an integer (got bool)",
+    ),
+    "Pinned-program-None": (
+        lambda s: ngc.Pinned(None),
+        TypeError,
+        "Pinned program must be a ForwardingProgram",
+    ),
+    "RouteDefinition-route-int": (
+        lambda s: ngc.RouteDefinition(0, 5),
+        TypeError,
+        ROUTE_TYPE.format("int"),
+    ),
+    "RouteDefinition-route-None": (
+        lambda s: ngc.RouteDefinition(0, None),
+        TypeError,
+        ROUTE_TYPE.format("NoneType"),
+    ),
+    "from_routes-graph-None": (
+        lambda s: ngc.ForwardingProgram.from_routes(None, [0], [2], [s.route]),
+        TypeError,
+        GRAPH,
+    ),
+    "from_routes-routes-int": (
+        lambda s: ngc.ForwardingProgram.from_routes(s.g, [0], [2], 5),
+        TypeError,
+        ROUTES,
+    ),
+    "from_routes-route-int": (
+        lambda s: ngc.ForwardingProgram.from_routes(s.g, [0], [2], [5]),
+        TypeError,
+        ROUTES,
+    ),
+    "from_routes-route-None": (
+        lambda s: ngc.ForwardingProgram.from_routes(s.g, [0], [2], [None]),
+        TypeError,
+        ROUTES,
+    ),
+}
+
+
+@pytest.mark.parametrize(
+    ("call", "error", "message"), REFUSALS.values(), ids=REFUSALS.keys()
+)
+def test_a_wrong_argument_is_refused_with_its_message(call, error, message):
+    s = _refusal_inputs()
+    with pytest.raises(error, match=exact(message)) as info:
+        call(s)
+    assert type(info.value) is error
+
+
+def test_t2_members():
+    # CentralizedTE.tunnel_count, CentralizedTE.prefer_headroom, Tunnel.planned_bandwidth and the T2 fields of TunnelPlan,
+    # read-only.
+    eq = ngc.SourceAllocation.EQUAL
+    gl = ngc.CentralizedTE(
+        source_allocation=eq, tunnel_count=ngc.TunnelCount(16), prefer_headroom=True
+    )
+    assert (gl.source_allocation, gl.tunnel_count, gl.prefer_headroom) == (
+        eq,
+        ngc.TunnelCount(16),
+        True,
+    )
+    plain = ngc.CentralizedTE(source_allocation=eq)
+    assert (plain.tunnel_count, plain.prefer_headroom) == (None, False)
+    assert_read_only(
+        gl, "source_allocation", "support", "tunnel_count", "prefer_headroom"
+    )
+    for name in (
+        "heads_with_capacity",
+        "insufficient_resolution",
+        "max_fractional_bandwidth_per_tunnel",
+        "max_bandwidth_per_tunnel",
+        "planned_bandwidth_per_tunnel",
+        "total_planned_bandwidth",
+        "total_tunnel_cost",
+        "headroom_penalty",
+        "max_lossless_offer",
+    ):
+        assert isinstance(getattr(ngc.TunnelPlan, name), property), name
+        assert getattr(ngc.TunnelPlan, name).fset is None, name
+    assert (
+        isinstance(ngc.Tunnel.planned_bandwidth, property)
+        and ngc.Tunnel.planned_bandwidth.fset is None
+    )
+
+
+def _top_level_labels(text):
+    # The `name=` labels of a repr at its own level, not those of a nested repr.
+    labels, depth, word = [], 0, ""
+    for ch in text:
+        if ch == "(":
+            depth += 1
+        elif ch == ")":
+            depth -= 1
+        if depth == 1 and ch == "=" and word:
+            labels.append(word)
+        word = word + ch if (ch.isalnum() or ch == "_") else ""
+    return labels
+
+
+def test_repr_labels_name_current_attributes():
+    # Every labelled __repr__ starts with its class name, and each of its own labels is an
+    # attribute of that class, except the three that print a count (no such attribute).
+    counts = {
+        ("PredecessorDAG", "entries"),
+        ("SpfResult", "dag_entries"),
+        ("Pinned", "tunnels"),
+    }
+    g = ngc.Graph(4, [0, 0, 1, 2], [1, 2, 3, 3], [8, 8, 8, 8], [1, 1, 1, 1], 1.0)
+    cfg = ngc.FlowPolicyConfig(
+        routing=ngc.DistributedTE(ngc.TunnelCount(2)), admission=ngc.Admission.LOSSY
+    )
+    fg = ngc.FlowLedger(g)
+    p = ngc.FlowPolicy(fg, 0, 3, cfg)
+    r = p.replace(4, design_demand=4)
+    search = ngc.spf(g, 0, ngc.SpfOptions(ngc.Direction.FORWARD))
+    path = ngc.ksp(g, 0, 3, ngc.KspOptions(1))[0][1]
+    objects = [
+        r,
+        r.plan,
+        r.program.tunnels[0],
+        r.by_tunnel[0],
+        r.by_source[0],
+        p.records()[0],
+        ngc.RouteDefinition(0, path, weight=2),
+        path,
+        search,
+        search.dag,
+        cfg,
+        cfg.routing,
+        ngc.DistributedTE(ngc.TunnelCount(2), cost_ceiling=ngc.AbsoluteCost(3)),
+        ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.EQUAL,
+            support=search.dag,
+            tunnel_count=ngc.TunnelCount(2, up_to=True),
+        ),
+        ngc.CentralizedTE(
+            source_allocation=ngc.SourceAllocation.EQUAL,
+            tunnel_count=ngc.TunnelCount(2),
+            prefer_headroom=True,
+        ),
+        ngc.ShortestPaths(
+            allocation=ngc.RouteAllocation.WEIGHTED,
+            weight_basis=ngc.WeightBasis.EXPLICIT,
+            edge_weights=[1, 2, 3, 4],
+        ),
+        ngc.TunnelCount(2, up_to=True),
+        ngc.Pinned(r.program),
+        ngc.ShortestPaths(tie_break=HIGHER_AVAIL, multipath=False),
+    ]
+    for obj in objects:
+        name = type(obj).__name__
+        text = repr(obj)
+        assert text.startswith(name + "("), text
+        for label in _top_level_labels(text):
+            assert (name, label) in counts or hasattr(type(obj), label), (text, label)
+    # The labels that once named retired fields, exactly.
+    assert repr(r).startswith("PlacementResult(call_delivered=4, termination=")
+    assert repr(r.plan) == "TunnelPlan(tunnels_per_head=2, total_reserved_bandwidth=4)"
+    assert repr(r.program.tunnels[0]).startswith("Tunnel(entry_id=0, ")
+    assert repr(r.by_tunnel[0]).startswith("TunnelFlow(entry_id=0, ")
+    assert repr(p.records()[0]).startswith("FlowRecord(flow_id=(")
+    assert ", policy_id=" in repr(p.records()[0])
+    assert repr(path).startswith("Path(source=0, destination=3, ")
+    assert (
+        repr(ngc.RouteDefinition(0, path, weight=2))
+        == "RouteDefinition(head=0, weight=2)"
+    )
+
+
+def _stub_members():
+    """The installed stub's public names: per class its members (a property, field or enum member is
+    "attribute"; a callable, every overload's parameters as contract_api writes them)."""
+    import ast
+    import pathlib
+
+    tree = ast.parse((pathlib.Path(ngc.__file__).parent / "__init__.pyi").read_text())
+
+    def params(fn):
+        a = fn.args
+        pos = a.posonlyargs + a.args
+        defaults = [None] * (len(pos) - len(a.defaults)) + list(a.defaults)
+        out = [
+            (arg.arg, "pos", None if d is None else ast.unparse(d))
+            for arg, d in zip(pos, defaults, strict=True)
+        ]
+        if a.vararg:
+            out.append(("*" + a.vararg.arg, "var", None))
+        out += [
+            (arg.arg, "kw", None if d is None else ast.unparse(d))
+            for arg, d in zip(a.kwonlyargs, a.kw_defaults, strict=True)
+        ]
+        if a.kwarg:
+            out.append(("**" + a.kwarg.arg, "varkw", None))
+        return [p for p in out if p[0] != "self"]
+
+    names = {}
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef):
+            names.setdefault(node.name, {}).setdefault("__call__", []).append(
+                params(node)
+            )
+        elif isinstance(node, ast.ClassDef):
+            members = {}
+            for item in node.body:
+                if isinstance(item, ast.FunctionDef):
+                    decorators = [ast.unparse(d) for d in item.decorator_list]
+                    if "property" in decorators:
+                        members[item.name] = "attribute"
+                    else:
+                        members.setdefault(item.name, []).append(params(item))
+                elif isinstance(item, ast.AnnAssign):
+                    members[item.target.id] = "attribute"
+            names[node.name] = members
+    return names
+
+
+def _runtime_default(cls, method, param):
+    # The stub prints an enum default as `...`; pybind11's runtime signature names the value.
+    owner = getattr(ngc, cls)
+    doc = (owner if method == "__call__" else getattr(owner, method)).__doc__ or ""
+    found = re.search(rf"\b{param}: [\w.]+ = ([\w.]+)", doc)
+    return found.group(1) if found else None
+
+
+def _runtime_signatures(owner, member):
+    """Every overload's parameters (name, kind) as pybind11's runtime docstring states them."""
+    target = (
+        getattr(ngc, owner)
+        if member == "__call__"
+        else getattr(getattr(ngc, owner), member)
+    )
+    name = owner if member == "__call__" else member
+    out = []
+    for line in (target.__doc__ or "").splitlines():
+        found = re.match(rf"^(?:\d+\. )?{re.escape(name)}\((.*)\) -> ", line)
+        if not found:
+            continue
+        params, depth, part, kind = [], 0, "", "pos"
+        for ch in found.group(1) + ",":
+            if ch in "[(":
+                depth += 1
+            elif ch in "])":
+                depth -= 1
+            if ch == "," and depth == 0:
+                part = part.strip()
+                if part == "*":
+                    kind = "kw"
+                elif part and part != "/":
+                    pname = part.split(":")[0].split("=")[0].strip()
+                    if pname != "self":
+                        params.append((pname, kind))
+                part = ""
+            else:
+                part += ch
+        out.append(params)
+    return out
+
+
+def test_runtime_signatures_match_the_contract():
+    # The extension's own signatures (pybind11's), parameter names and kinds, against the listing:
+    # a binding changed without its stub fails here, not only in the stub's drift check.
+    from contract_api import CONTRACT_API
+
+    differences = []
+    for name, members in CONTRACT_API.items():
+        for member, want in members.items():
+            if want in ("attribute", "declared") or not hasattr(ngc, name):
+                continue
+            have = _runtime_signatures(name, member)
+            for overload in want:
+                if overload == [("_no_public_constructor", "pos", None)]:
+                    continue
+                if [(n, k) for n, k, _ in overload] not in have:
+                    differences.append((name, member, overload, have))
+    assert differences == []
+
+
+def test_api_matches_the_contract():
+    # Every public name of the interface listing (contract_api.py), every member, and every
+    # parameter's name, kind and default; no other public member.
+    from contract_api import CONTRACT_API
+
+    stub = _stub_members()
+    differences = []
+    for name, members in CONTRACT_API.items():
+        if name not in stub:
+            differences.append(("missing", name))
+            continue
+        have = stub[name]
+        for member, want in members.items():
+            if member not in have:
+                differences.append(("missing", name, member))
+            elif want in ("attribute", "declared"):
+                if want == "attribute" and have[member] != "attribute":
+                    differences.append(("kind", name, member))
+            elif have[member] == "attribute":
+                differences.append(("kind", name, member))
+            else:
+                for overload in want:
+                    match = [
+                        got
+                        for got in have[member]
+                        if [(n, k) for n, k, _ in got]
+                        == [(n, k) for n, k, _ in overload]
+                    ]
+                    if not match:
+                        differences.append(("parameters", name, member, overload))
+                        continue
+                    for (param, _, default), (_, _, got) in zip(
+                        overload, match[0], strict=True
+                    ):
+                        if got != default and not (
+                            got == "..."
+                            and _runtime_default(name, member, param) == default
+                        ):
+                            differences.append(("default", name, member, param, got))
+        extra = sorted(
+            m
+            for m in have
+            if not m.startswith("_") and m not in members and m not in ("name", "value")
+        )
+        if extra:
+            differences.append(("extra", name, extra))
+    assert differences == []
diff --git a/tests/py/test_review_regressions.py b/tests/py/test_review_regressions.py
deleted file mode 100644
index 611439c..0000000
--- a/tests/py/test_review_regressions.py
+++ /dev/null
@@ -1,590 +0,0 @@
-"""Regression tests for the 2026-08 code review findings.
-
-Each test locks in the fixed behavior for a confirmed defect:
-
-1. max_flow under-reported when the SSP tier loop needed flow cancellation;
-   its own min_cut then contradicted total_flow (duality violation).
-2. Zero-cost edges produced a cyclic PredDAG: EqualBalanced placement returned
-   0 flow and resolve_to_paths never terminated.
-3. k_shortest_paths enumerated every equal-cost spur path (exponential in ECMP
-   width; a 22-stage ladder needed ~19 s and ~3.8 GB for k=3).
-4. batch_max_flow results must be identical to per-pair calls (now computed in
-   parallel).
-5. FlowPolicy.place_demand silently routed a second (src, dst) pair over the
-   first pair's paths.
-6. StrictMultiDiGraph accepted cost totals that overflow int64 path arithmetic.
-7. FlowState.compute_min_cut treated pre-existing usage from a custom
-   residual_init as cancellable flow.
-8. batch_max_flow rejected a genuine int32 `pairs` array on Windows, and read
-   non-contiguous input as if it were packed.
-9-10. FlowPolicy accepted a FlowGraph built from a different graph, and
-   rebalance_demand bypassed the (src, dst) guard.
-11-12. batch_max_flow and ksp validated inputs later (or not at all) compared
-   with their single-pair counterparts.
-13. _docs.py declared types that did not match runtime.
-14. The same class of user error raised different exception types.
-15. k_shortest_paths read paths.back() on an empty vector when
-   max_cost_factor < 1.0 and k > 1.
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _graph(num_nodes, edges):
-    """edges: list of (src, dst, capacity, cost)."""
-    s, d, c, k = zip(*edges, strict=False)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes,
-        np.array(s, dtype=np.int32),
-        np.array(d, dtype=np.int32),
-        np.array(c, dtype=np.float64),
-        np.array(k, dtype=np.int64),
-        np.arange(len(s), dtype=np.int64),
-    )
-
-
-def _bidir(links):
-    out = []
-    for u, v, cap, cost in links:
-        out.append((u, v, cap, cost))
-        out.append((v, u, cap, cost))
-    return out
-
-
-@pytest.fixture
-def algs():
-    return ngc.Algorithms(ngc.Backend.cpu())
-
-
-class TestMaxFlowCompletion:
-    """Finding 1: forward-only SSP stranded capacity that needs cancellation."""
-
-    def _cancellation_graph(self):
-        # s=0, a=1, b=2, t=3; all links full duplex. True max flow is 3.0:
-        # 0->1->3 (1), 0->2->1->3 (1), 0->2->3 (1); cut {0,2}|{1,3} has cap 3.
-        return _graph(
-            4,
-            _bidir(
-                [
-                    (1, 3, 3.0, 17),
-                    (0, 2, 8.0, 17),
-                    (1, 2, 1.0, 1),
-                    (1, 0, 1.0, 1),
-                    (3, 2, 1.0, 1),
-                ]
-            ),
-        )
-
-    def test_exact_max_flow(self, algs):
-        g = self._cancellation_graph()
-        pg = algs.build_graph(g)
-        total, _ = algs.max_flow(pg, 0, 3)
-        assert total == pytest.approx(3.0)
-
-    def test_min_cut_duality(self, algs):
-        g = self._cancellation_graph()
-        pg = algs.build_graph(g)
-        total, summary = algs.max_flow(pg, 0, 3)
-        cap = np.asarray(g.capacity_view())
-        cut = np.asarray(summary.min_cut.edges)
-        assert cut.size > 0
-        assert float(cap[cut].sum()) == pytest.approx(total)
-
-    def test_cost_distribution_accounts_for_total(self, algs):
-        g = self._cancellation_graph()
-        pg = algs.build_graph(g)
-        total, summary = algs.max_flow(pg, 0, 3)
-        assert float(np.asarray(summary.flows).sum()) == pytest.approx(total)
-
-    def test_completion_respects_masks(self, algs):
-        g = self._cancellation_graph()
-        pg = algs.build_graph(g)
-        mask = np.ones(4, dtype=bool)
-        mask[2] = False  # only 0->1->3 remains; bottleneck is cap(0->1) = 1
-        total, _ = algs.max_flow(pg, 0, 3, node_mask=mask)
-        assert total == pytest.approx(1.0)
-
-
-class TestZeroCostEdges:
-    """Finding 2: zero-cost edges made the PredDAG cyclic."""
-
-    def _zero_cost_graph(self):
-        # 0 ->(1) 1 <->(0) 2 ->(1) 3
-        return _graph(
-            4,
-            [(0, 1, 10.0, 1), (1, 2, 10.0, 0), (2, 1, 10.0, 0), (2, 3, 10.0, 1)],
-        )
-
-    def test_pred_dag_acyclic(self, algs):
-        g = self._zero_cost_graph()
-        pg = algs.build_graph(g)
-        _, dag = algs.spf(pg, 0, None, multipath=True)
-        po = np.asarray(dag.parent_offsets)
-        pa = np.asarray(dag.parents)
-        for v in range(4):
-            for i in range(po[v], po[v + 1]):
-                u = pa[i]
-                assert v not in pa[po[u] : po[u + 1]], f"cycle {u}<->{v}"
-
-    def test_equal_balanced_places_flow(self, algs):
-        g = self._zero_cost_graph()
-        pg = algs.build_graph(g)
-        total, _ = algs.max_flow(
-            pg, 0, 3, flow_placement=ngc.FlowPlacement.EQUAL_BALANCED
-        )
-        assert total == pytest.approx(10.0)
-
-    def test_resolve_to_paths_terminates(self, algs):
-        g = self._zero_cost_graph()
-        pg = algs.build_graph(g)
-        _, dag = algs.spf(pg, 0, None, multipath=True)
-        paths = dag.resolve_to_paths(0, 3)  # previously never returned
-        assert [n for n, _ in paths[0]] == [0, 1, 2, 3]
-
-
-class TestKspEcmpLadder:
-    """Finding 3: spur enumeration was exponential in equal-cost path count."""
-
-    def test_ladder_is_tractable(self, algs):
-        # 30 stages of parallel 2-hop diamonds: 2^30 equal-cost paths.
-        # Pre-fix this was unreachable (22 stages already took ~19 s / 3.8 GB).
-        stages = 30
-        edges = []
-        nid = 0
-
-        def new():
-            nonlocal nid
-            nid += 1
-            return nid - 1
-
-        main = [new()]
-        for _ in range(stages):
-            nxt, a, b = new(), new(), new()
-            for u, v in ((main[-1], a), (a, nxt), (main[-1], b), (b, nxt)):
-                edges.append((u, v, 10.0, 1))
-            main.append(nxt)
-        g = _graph(nid, edges)
-        pg = algs.build_graph(g)
-        out = algs.ksp(pg, main[0], main[-1], k=4)
-        assert len(out) == 4
-        # All returned paths are shortest (equal cost) and distinct.
-        costs = [dist[main[-1]] for dist, _ in out]
-        assert costs == [2 * stages] * 4
-        sigs = {tuple(dag.via_edges) for _, dag in out}
-        assert len(sigs) == 4
-
-
-class TestBatchMaxFlowParity:
-    """Finding 4: batch results must equal per-pair results (now parallel)."""
-
-    def test_batch_equals_serial(self, algs, certify_max_flow):
-        rng = np.random.default_rng(7)
-        n = 12
-        edges = []
-        for _ in range(40):
-            u, v = rng.integers(0, n, size=2)
-            if u != v:
-                # Costs must be dispersed. With a single cost tier there is nothing
-                # for shortest-path tier ordering to get wrong, so a uniform-cost
-                # generator only ever samples the region where max-flow defects of
-                # the Finding 1 kind cannot occur.
-                cap = float(rng.integers(1, 8))
-                cost = int(rng.integers(1, 21))
-                edges.append((int(u), int(v), cap, cost))
-        g = _graph(n, edges)
-        pg = algs.build_graph(g)
-        pairs = np.array([[i, (i + 5) % n] for i in range(8)], dtype=np.int32)
-        batch = algs.batch_max_flow(pg, pairs, with_edge_flows=True)
-        for i, (a, b) in enumerate(pairs):
-            total, summary = algs.max_flow(pg, int(a), int(b), with_edge_flows=True)
-            assert batch[i].total_flow == pytest.approx(total)
-            np.testing.assert_array_equal(
-                np.asarray(batch[i].edge_flows), np.asarray(summary.edge_flows)
-            )
-            # Agreement between two code paths that share calc_max_flow only proves
-            # consistency; both could be wrong together. Certify the result too.
-            certify_max_flow(g, summary, total, int(a), int(b))
-
-
-class TestFlowPolicySrcDstGuard:
-    """Finding 5: reusing a policy for a different pair corrupted placement."""
-
-    def test_mismatched_pair_raises(self, algs):
-        g = _graph(4, [(0, 1, 10.0, 1), (2, 3, 10.0, 1)])
-        pg = algs.build_graph(g)
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        placed, _ = policy.place_demand(fg, 0, 1, 0, 5.0)
-        assert placed == pytest.approx(5.0)
-        with pytest.raises(ValueError, match="different \\(src, dst\\)"):
-            policy.place_demand(fg, 2, 3, 0, 5.0)
-
-    def test_same_pair_and_after_remove_ok(self, algs):
-        g = _graph(4, [(0, 1, 10.0, 1), (2, 3, 10.0, 1)])
-        pg = algs.build_graph(g)
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        assert policy.place_demand(fg, 0, 1, 0, 5.0)[0] == pytest.approx(5.0)
-        assert policy.place_demand(fg, 0, 1, 0, 2.0)[0] == pytest.approx(2.0)
-        policy.remove_demand(fg)
-        assert policy.place_demand(fg, 2, 3, 0, 5.0)[0] == pytest.approx(5.0)
-        np.testing.assert_allclose(np.asarray(fg.edge_flow_view()), [0.0, 5.0])
-
-
-class TestCostOverflowGuard:
-    """Finding 6: cost totals near INT64_MAX silently wrapped in SPF."""
-
-    def test_total_at_2_pow_62_rejected(self):
-        big = 1 << 62
-        with pytest.raises(ValueError, match="2\\^62"):
-            _graph(3, [(0, 1, 10.0, big), (1, 2, 10.0, big)])
-
-    def test_large_but_safe_costs_accepted(self, algs):
-        big = 1 << 60
-        g = _graph(3, [(0, 1, 10.0, big), (1, 2, 10.0, big)])
-        pg = algs.build_graph(g)
-        dist, _ = algs.spf(pg, 0, None, dtype="int64")
-        assert dist[2] == 2 * big  # no wraparound
-
-
-class TestFlowStateCustomResidual:
-    """Finding 7: custom residual_init desynced min-cut's notion of flow."""
-
-    def test_min_cut_uses_own_placed_flow(self):
-        g = _graph(3, [(0, 1, 10.0, 1), (1, 2, 10.0, 1)])
-        fs = ngc.FlowState(g, np.array([4.0, 4.0]))
-        placed = fs.place_max_flow(0, 2, ngc.FlowPlacement.PROPORTIONAL)
-        assert placed == pytest.approx(4.0)
-        # Reverse arcs must be keyed on this state's own edge_flow (4.0), not
-        # capacity - residual (10.0, which counts pre-existing usage).
-        np.testing.assert_allclose(np.asarray(fs.edge_flow_view()), [4.0, 4.0])
-        cut = np.asarray(fs.compute_min_cut(0).edges)
-        assert cut.size > 0
-
-
-class TestBatchPairsDtype:
-    """Finding 8: `batch_max_flow` rejected a genuine int32 array on Windows.
-
-    The dtype check compared buffer format strings. NumPy spells int32 as
-    NPY_LONG ('l') on LLP64 (Windows) but NPY_INT ('i') on LP64, while
-    pybind11's `format_descriptor<int32_t>` is always 'i', so the check threw on
-    Windows for a correctly-typed array. Parametrizing over both 32-bit
-    spellings exercises whichever one is the platform's alias for int32.
-    """
-
-    def _line_graph(self):
-        return _graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)])
-
-    @pytest.mark.parametrize("dtype", [np.int32, np.intc])
-    def test_accepts_every_int32_spelling(self, algs, dtype):
-        g = self._line_graph()
-        pg = algs.build_graph(g)
-        pairs = np.array([[0, 2]], dtype=dtype)
-        assert np.dtype(dtype).itemsize == 4 and np.dtype(dtype).kind == "i"
-        out = algs.batch_max_flow(pg, pairs)
-        assert out[0].total_flow == pytest.approx(5.0)
-
-    def test_rejects_wrong_dtype(self, algs):
-        pg = algs.build_graph(self._line_graph())
-        with pytest.raises(TypeError, match="int32"):
-            algs.batch_max_flow(pg, np.array([[0, 2]], dtype=np.int64))
-
-    def test_rejects_non_contiguous(self, algs):
-        # A strided view would otherwise be read as if it were packed, silently
-        # turning [[0, 2]] into the pair (0, 99).
-        pg = algs.build_graph(self._line_graph())
-        strided = np.array([[0, 99, 2, 99]], dtype=np.int32)[:, ::2]
-        assert not strided.flags["C_CONTIGUOUS"]
-        with pytest.raises(TypeError, match="C-contiguous"):
-            algs.batch_max_flow(pg, strided)
-
-
-class TestFlowPolicyTargetGuards:
-    """Findings 9-10: FlowPolicy accepted uses that silently produced wrong answers."""
-
-    def _two_graphs_same_edge_count(self):
-        # Same edge count, different topology: the residual-length check that caught
-        # the mismatched-graph case by accident does not fire here.
-        a = _graph(4, [(0, 1, 5.0, 1), (1, 3, 5.0, 1), (0, 2, 1.0, 1)])
-        b = _graph(4, [(0, 2, 9.0, 1), (2, 3, 9.0, 1), (0, 1, 1.0, 1)])
-        return a, b
-
-    def test_flowgraph_from_a_different_graph_is_rejected(self, algs):
-        ga, gb = self._two_graphs_same_edge_count()
-        policy = ngc.FlowPolicy(algs, algs.build_graph(ga), ngc.FlowPolicyConfig())
-        with pytest.raises(ValueError, match="different StrictMultiDiGraph"):
-            policy.place_demand(ngc.FlowGraph(gb), 0, 3, 0, 100.0)
-
-    def test_rebalance_demand_rejects_a_different_pair(self, algs):
-        # remove_demand() empties flows_, so rebalance_demand must check the pair
-        # itself rather than relying on the check inside place_demand.
-        g = _graph(4, [(0, 1, 10.0, 1), (2, 3, 10.0, 1)])
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, algs.build_graph(g), ngc.FlowPolicyConfig())
-        policy.place_demand(fg, 0, 1, 0, 5.0)
-        with pytest.raises(ValueError, match="different \\(src, dst\\)"):
-            policy.rebalance_demand(fg, 2, 3, 0, 5.0)
-        # The matching pair still rebalances, and retargeting after remove_demand works.
-        policy.rebalance_demand(fg, 0, 1, 0, 2.0)
-        policy.remove_demand(fg)
-        assert policy.place_demand(fg, 2, 3, 0, 5.0)[0] == pytest.approx(5.0)
-
-
-class TestBindingValidationConsistency:
-    """Findings 11-12: validation that differed between analogous entry points."""
-
-    def _line(self):
-        return _graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)])
-
-    def test_batch_max_flow_rejects_out_of_range_like_max_flow(self, algs):
-        pg = algs.build_graph(self._line())
-        # Previously this returned total_flow=0.0 and the bad id vanished into the batch.
-        with pytest.raises(ValueError, match="out of range"):
-            algs.batch_max_flow(pg, np.array([[0, 99]], dtype=np.int32))
-        with pytest.raises(ValueError, match="out of range"):
-            algs.max_flow(pg, 0, 99)
-
-    def test_ksp_validates_dtype_even_when_no_paths_exist(self, algs):
-        pg = algs.build_graph(self._line())
-        # 2 -> 0 is unreachable, so the results loop never runs; the dtype check used
-        # to live inside that loop and silently accepted the bad value.
-        with pytest.raises(ValueError, match="dtype must be"):
-            algs.ksp(pg, 2, 0, k=1, dtype="float32")
-
-    def test_algorithms_backend_argument_is_nameable(self):
-        assert isinstance(ngc.Algorithms(backend=ngc.Backend.cpu()), ngc.Algorithms)
-
-    def test_unreachable_flow_record_class_is_not_exported(self):
-        import _netgraph_core
-
-        # Nothing could construct or receive it, and the name collided with the C++
-        # alias `using Flow = double`.
-        assert not hasattr(_netgraph_core, "Flow")
-
-
-class TestTypeStubAccuracy:
-    """Finding 13: _docs.py declared types that did not match runtime."""
-
-    def test_min_cut_edges_is_an_int32_array_not_a_list(self, algs):
-        g = _graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)])
-        _, summary = algs.max_flow(algs.build_graph(g), 0, 2)
-        edges = summary.min_cut.edges
-        assert isinstance(edges, np.ndarray)
-        assert edges.dtype == np.int32
-
-    def test_stub_declares_only_names_that_exist(self):
-        import _netgraph_core
-
-        from netgraph_core import _docs
-
-        declared = {
-            n
-            for n in dir(_docs)
-            if not n.startswith("_") and isinstance(getattr(_docs, n), type)
-        }
-        missing = {n for n in declared if not hasattr(_netgraph_core, n)}
-        assert not missing, f"_docs.py declares nonexistent runtime types: {missing}"
-
-
-class TestErrorTypeConsistency:
-    """Finding 14: the same class of user error raised different exception types."""
-
-    @pytest.fixture
-    def pg(self, algs):
-        return algs.build_graph(_graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)]))
-
-    def test_spf_residual_length_raises_type_error_like_masks(self, algs, pg):
-        # Previously the residual length check fell through to the C++ core, which
-        # throws std::invalid_argument -> ValueError, while every mask length check
-        # in the binding layer raises TypeError.
-        with pytest.raises(TypeError, match="residual length must equal"):
-            algs.spf(pg, 0, residual=np.zeros(5))
-        with pytest.raises(TypeError, match="node_mask length must equal"):
-            algs.spf(pg, 0, node_mask=np.ones(7, dtype=bool))
-
-    def test_wrong_typed_arguments_raise_type_error_not_runtime_error(self, algs, pg):
-        # These hand-rolled casts used to surface as
-        # "RuntimeError: Unable to cast ... to C++ type '?'", which no `except
-        # TypeError` catches and which names nothing actionable.
-        with pytest.raises(TypeError, match="must be a StrictMultiDiGraph"):
-            algs.build_graph(5)
-        with pytest.raises(TypeError, match="must be an Algorithms"):
-            ngc.FlowPolicy("not-algorithms", pg, ngc.FlowPolicyConfig())
-
-
-class TestKspCostCeiling:
-    """Finding 15: k>1 with max_cost_factor < 1.0 read paths.back() on an empty vector.
-
-    The ceiling lands below the shortest path, so nothing is admitted. The k == 1
-    branch returned early and masked the undefined behaviour; k >= 2 fell into the
-    spur loop, which opens with `paths.back()`.
-    """
-
-    @pytest.mark.parametrize("k", [1, 2, 5])
-    @pytest.mark.parametrize("factor", [0.5, 0.99])
-    def test_sub_unit_factor_returns_empty_for_every_k(self, algs, k, factor):
-        g = _graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)])
-        pg = algs.build_graph(g)
-        assert algs.ksp(pg, 0, 2, k=k, max_cost_factor=factor) == []
-
-    @pytest.mark.parametrize("k", [1, 2, 5])
-    def test_unit_factor_still_admits_the_shortest_path(self, algs, k):
-        g = _graph(3, [(0, 1, 5.0, 1), (1, 2, 5.0, 1)])
-        pg = algs.build_graph(g)
-        assert len(algs.ksp(pg, 0, 2, k=k, max_cost_factor=1.0)) == 1
-
-
-class TestStubConstructorConsistency:
-    """Finding 16: widened stubs declared no __init__ for classes that need one.
-
-    `_docs.py` is wired to type checkers, so a stub whose constructor disagrees
-    with the binding turns "unchecked" into "confidently wrong": pyright rejected
-    every real `FlowIndex(src, dst, cls, id)` call in the downstream consumer.
-    This repo's own pyright missed it because `tests/**` is excluded, so assert
-    the correspondence at runtime instead.
-    """
-
-    def _runtime_classes(self):
-        import _netgraph_core
-
-        for name in sorted(n for n in dir(_netgraph_core) if not n.startswith("_")):
-            obj = getattr(_netgraph_core, name)
-            if isinstance(obj, type):
-                yield name, obj
-
-    def test_stub_declares_init_wherever_construction_needs_arguments(self):
-        from netgraph_core import _docs
-
-        missing = []
-        for name, rt in self._runtime_classes():
-            stub = getattr(_docs, name, None)
-            if stub is None:
-                continue  # not part of the typed surface
-            try:
-                rt()
-                continue  # zero-arg construction works; a bare stub is fine
-            except Exception:
-                pass
-            doc = rt.__init__.__doc__ or ""
-            if "__init__" not in doc:
-                continue  # no bound constructor at all (e.g. result-only types)
-            if "__init__" not in vars(stub):
-                missing.append(name)
-        assert not missing, (
-            f"stub classes need an __init__ matching the binding: {missing}"
-        )
-
-    def test_stub_attributes_exist_at_runtime(self):
-        from netgraph_core import _docs
-
-        wrong = []
-        for name, rt in self._runtime_classes():
-            stub = getattr(_docs, name, None)
-            if stub is None:
-                continue
-            declared = {
-                a
-                for a in vars(stub)
-                if not a.startswith("_") and not callable(vars(stub)[a])
-            }
-            declared |= set(getattr(stub, "__annotations__", {}))
-            for attr in declared:
-                if not hasattr(rt, attr):
-                    wrong.append(f"{name}.{attr}")
-        assert not wrong, f"_docs.py declares attributes absent at runtime: {wrong}"
-
-    def test_flow_index_constructor_matches_the_binding(self):
-        # The exact call shape the downstream consumer uses.
-        idx = ngc.FlowIndex(1, 2, 3, 4)
-        assert (idx.src, idx.dst, idx.flowClass, idx.flowId) == (1, 2, 3, 4)
-        with pytest.raises(TypeError):
-            ngc.FlowIndex(src=1, dst=2, flowClass=3, flowId=4)  # positional-only
-        with pytest.raises(AttributeError):
-            idx.src = 9  # read-only, as the stub's properties declare
-
-
-class TestFlowPolicyMaxPathCostFactor:
-    """`max_path_cost_factor` had no test coverage at all.
-
-    The gate multiplies the best path cost by the factor and casts back to Cost.
-    Before 0.8.0 it did that unconditionally, including while `best_path_cost_` was
-    still the INT64_MAX "no best path yet" sentinel -- the product is then far outside
-    the int64 range and the conversion is undefined behavior. The fix skips the
-    relative bound until a best cost exists and drops it when the product would not
-    fit. Neither branch was exercised by any test.
-
-    Scope: these are *coverage* tests, not detectors of the original UB. They pass
-    against 0.7.2 (pre-fix) too, because an out-of-range float->int conversion is
-    undefined rather than reliably wrong -- in practice it saturates to something that
-    still admits the path. They also cannot reach the sentinel branch at all: a
-    reachable destination updates `best_path_cost_` (flow_policy.cpp:135) before the
-    gate runs. Their value is guarding the *functional* behaviour of the bound.
-
-    Detection of the UB itself lives in C++, in
-    `FlowPolicyCostBounds.MaxPathCostFactor_*` -- `make sanitize-test` builds with
-    sanitizers but runs `ctest`, so it never executes this Python suite. Those tests
-    use an unreachable destination to keep the sentinel live, and fail against the
-    pre-fix conversion.
-    """
-
-    @staticmethod
-    def _policy(algs, gh, *, max_flow_count=1, **cfg_kwargs):
-        sel = ngc.EdgeSelection(
-            multi_edge=True,
-            require_capacity=True,
-            tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-        )
-        cfg = ngc.FlowPolicyConfig(
-            path_alg=ngc.PathAlg.SPF,
-            flow_placement=ngc.FlowPlacement.PROPORTIONAL,
-            selection=sel,
-            max_flow_count=max_flow_count,
-            **cfg_kwargs,
-        )
-        return ngc.FlowPolicy(algs, gh, cfg)
-
-    def test_factor_applies_before_any_best_cost_exists(self, algs):
-        """First placement: the sentinel path must not be multiplied and cast."""
-        g = _graph(3, [(0, 1, 1.0, 5), (1, 2, 1.0, 5)])
-        gh = algs.build_graph(g)
-        policy = self._policy(algs, gh, max_path_cost_factor=2.0)
-        placed, left = policy.place_demand(ngc.FlowGraph(g), 0, 2, 0, 1.0)
-        assert placed == pytest.approx(1.0)
-        assert left == pytest.approx(0.0)
-
-    def test_huge_factor_does_not_wrap_the_bound(self, algs):
-        """best_cost * factor overflows int64; the bound must be dropped, not wrapped.
-
-        A wrapped (negative) bound would reject the shortest path itself, so a
-        successful placement is what distinguishes the guard from the bug.
-        """
-        big = 1 << 60  # legal: total stays below the 2**62 construction ceiling
-        g = _graph(3, [(0, 1, 1.0, big), (1, 2, 1.0, big)])
-        gh = algs.build_graph(g)
-        policy = self._policy(algs, gh, max_path_cost_factor=1e9)
-        placed, _ = policy.place_demand(ngc.FlowGraph(g), 0, 2, 0, 1.0)
-        assert placed == pytest.approx(1.0)
-
-    def test_factor_still_excludes_a_too_expensive_alternative(self, algs):
-        """The bound must remain functional, not merely safe."""
-        g = _graph(
-            4,
-            [
-                (0, 1, 1.0, 1),
-                (1, 3, 1.0, 1),  # cost 2 route
-                (0, 2, 5.0, 50),
-                (2, 3, 5.0, 50),  # cost 100 route, far beyond 2x
-            ],
-        )
-        gh = algs.build_graph(g)
-        policy = self._policy(
-            algs, gh, max_flow_count=4, max_path_cost_factor=2.0, min_flow_count=1
-        )
-        placed, _ = policy.place_demand(ngc.FlowGraph(g), 0, 3, 0, 6.0)
-        # Only the cost-2 route is within 2x; the cost-100 route must stay unused.
-        assert placed == pytest.approx(1.0)
diff --git a/tests/py/test_route_choice.py b/tests/py/test_route_choice.py
new file mode 100644
index 0000000..df1cbf2
--- /dev/null
+++ b/tests/py/test_route_choice.py
@@ -0,0 +1,32 @@
+"""The route choice of ShortestPaths: the single-path order read on the service
+view at preparation, one record per source over the route the rule chooses."""
+
+from __future__ import annotations
+
+from helpers import build
+
+import netgraph_core as ngc
+
+TIE = ngc.RouteTieBreak
+
+
+def test_shortest_paths_single_path():
+    # TRI (three parallel cost-1 links of capacities 4, 10, 100 and a cost-2 link of 50) with the
+    # service view 4, 8, 5, 50: FEWER_HOPS e0, HIGHER_CAPACITY e2, HIGHER_AVAILABLE_CAPACITY e1,
+    # HIGHER_HEADROOM e0 (4/4 = 1 against 4/5 and 1/20).
+    g = build(2, [(0, 1, 4, 1), (0, 1, 10, 1), (0, 1, 100, 1), (0, 1, 50, 2)])
+    for tie, want in (
+        (TIE.FEWER_HOPS, 0),
+        (TIE.HIGHER_CAPACITY, 2),
+        (TIE.HIGHER_AVAILABLE_CAPACITY, 1),
+        (TIE.HIGHER_HEADROOM, 0),
+    ):
+        ledger = ngc.FlowLedger(g, service_baseline=[4, 8, 5, 50])
+        cfg = ngc.FlowPolicyConfig(
+            routing=ngc.ShortestPaths(tie_break=tie, multipath=False)
+        )
+        policy = ngc.FlowPolicy(ledger, 0, 1, cfg)
+        assert policy.place(1).call_delivered == 1, tie
+        (record,) = policy.records()
+        assert record.route.via_edges().tolist() == [want], tie
+        assert record.edge_flows == [(want, 1)], tie
diff --git a/tests/py/test_route_structures.py b/tests/py/test_route_structures.py
new file mode 100644
index 0000000..c7fc1cd
--- /dev/null
+++ b/tests/py/test_route_structures.py
@@ -0,0 +1,368 @@
+"""PredecessorDAG, Path, RouteTieBreak, the enums and Eligibility.intersect through the bindings
+(docs/semantics.md#3-route-values-predecessordag-and-path): validation in the documented order on
+unnarrowed values, read-only views, structural equality."""
+
+from __future__ import annotations
+
+import gc
+
+import numpy as np
+import pytest
+from helpers import build, exact
+
+import netgraph_core as ngc
+
+L64 = 1 << 64
+
+
+# ids by (source, cost, destination, input): 0: 0->1, 1: 0->1, 2: 0->2 (cost 3), 3: 1->2, 4: 2->0
+G_EDGES = [(0, 1, 5, 1), (0, 1, 5, 1), (1, 2, 5, 1), (0, 2, 5, 3), (2, 0, 5, 1)]
+
+
+def test_from_csr_round_trip_and_views():
+    g = build(3, G_EDGES)
+    dag = ngc.PredecessorDAG.from_csr(g, [0, 0, 2, 4], [0, 0, 0, 1], [0, 1, 2, 3])
+    assert dag.graph_uid() == g.uid()
+    assert list(dag.parent_offsets()) == [0, 0, 2, 4]
+    assert list(dag.parents()) == [0, 0, 0, 1]
+    assert list(dag.via_edges()) == [0, 1, 2, 3]
+    # parent_offsets() is a new read-only array on each call.
+    offsets = dag.parent_offsets()
+    assert offsets.dtype == np.int32 and not offsets.flags.writeable
+    with pytest.raises(ValueError):
+        offsets[0] = 9
+    assert dag.parent_offsets() is not offsets
+    assert not np.shares_memory(dag.parent_offsets(), offsets)
+    # parents() and via_edges() are read-only views that keep the DAG alive.
+    parents, view = dag.parents(), dag.via_edges()
+    for array in (parents, view):
+        assert array.dtype == np.int32 and not array.flags.writeable
+        with pytest.raises(ValueError):
+            array[0] = 9
+    del dag
+    gc.collect()
+    assert list(view) == [0, 1, 2, 3]  # the views keep the DAG alive
+    assert list(parents) == [0, 0, 0, 1]
+    same = ngc.PredecessorDAG.from_csr(
+        g, np.array([0, 0, 2, 4]), np.array([0, 0, 0, 1]), np.array([0, 1, 2, 3])
+    )
+    again = ngc.PredecessorDAG.from_csr(g, [0, 0, 2, 4], [0, 0, 0, 1], [0, 1, 2, 3])
+    assert same == again and hash(same) == hash(again)
+    assert same != ngc.PredecessorDAG.from_csr(g, [0, 0, 0, 0], [], [])
+    # Equality includes the graph: the same CSR on a twin graph (the same arrays, another uid) is
+    # another value.
+    twin = build(3, G_EDGES)
+    there = ngc.PredecessorDAG.from_csr(twin, [0, 0, 2, 4], [0, 0, 0, 1], [0, 1, 2, 3])
+    assert there.graph_uid() == twin.uid() != g.uid()
+    assert list(there.via_edges()) == list(same.via_edges())
+    assert there != same and not there == same
+
+
+@pytest.mark.parametrize(
+    ("offsets", "parents", "via", "message"),
+    [
+        ([0, 0, 0], [], [], "parent_offsets has length 3, expected N + 1 = 4"),
+        ([1, 0, 2, 1], [], [], "parent_offsets[0] = 1, expected 0"),
+        (
+            [L64, 0, 0, 0],
+            [],
+            [],
+            "parent_offsets[0] = 18446744073709551616, expected 0",
+        ),
+        ([0, 2, 1, 2], [0, 0], [0, 1], "parent_offsets are not monotone at 2 (2 > 1)"),
+        (
+            [0, L64, 0, 0],
+            [],
+            [],
+            "parent_offsets are not monotone at 2 (18446744073709551616 > 0)",
+        ),
+        (
+            [0, 0, 2, 2],
+            [0],
+            [0, 1],
+            "parent_offsets[N] = 2 but parents has 1 and via_edges has 2 entries",
+        ),
+        (
+            [0, 0, 2, 3],
+            [9, 0],
+            [0, 1],
+            "parent_offsets[N] = 3 but parents has 2 and via_edges has 2 entries",
+        ),
+        ([0, 0, 2, 2], [3, 0], [0, 1], "parents[0] = 3 out of node range [0, 3)"),
+        (
+            [0, 0, 2, 2],
+            [-L64, 0],
+            [0, 1],
+            "parents[0] = -18446744073709551616 out of node range [0, 3)",
+        ),
+        (
+            [0, 0, 2, 2],
+            [0, 0],
+            [0, L64],
+            "via_edges[1] = 18446744073709551616 out of edge range [0, 5)",
+        ),
+        (
+            [0, 0, 2, 2],
+            [1, 0],
+            [0, 1],
+            "entry 0 of node 1: via edge 0 joins (0, 1), not (1, 1)",
+        ),
+        ([0, 0, 2, 2], [0, 0], [1, 1], "duplicate entry (child 1, via 1)"),
+        # A cycle (0 -> 1 -> 2 -> 0) before the order check: node 1's entries descend.
+        ([0, 1, 3, 4], [2, 0, 0, 1], [4, 1, 0, 3], "the entries contain a cycle"),
+        (
+            [0, 0, 2, 2],
+            [0, 0],
+            [1, 0],
+            "the entries of node 1 are not in ascending via EdgeId (1 then 0)",
+        ),
+    ],
+)
+def test_from_csr_validation_order(offsets, parents, via, message):
+    g = build(3, G_EDGES)
+    with pytest.raises(ValueError, match=exact(f"PredecessorDAG.from_csr: {message}")):
+        ngc.PredecessorDAG.from_csr(g, offsets, parents, via)
+
+
+def test_from_csr_reports_the_first_of_several_defects():
+    # Every defect at once, then each reported one removed: the shape (length, offsets[0],
+    # monotone, offsets[N]), then the ranges of every entry (unnarrowed, before any endpoint is
+    # read), the endpoints, a duplicate, a cycle, the order within a node. Node 1's entries hold
+    # the cycle 0 -> 1 -> 2 -> 0 with node 0's, a duplicate and a descending pair.
+    g = build(3, G_EDGES)
+    big = 2**70
+    steps = [
+        ([1, 0, 0], [big], [big], "parent_offsets has length 3, expected N + 1 = 4"),
+        ([1, 0, 2, 5], [big], [big], "parent_offsets[0] = 1, expected 0"),
+        ([0, 2, 1, 5], [big], [big], "parent_offsets are not monotone at 2 (2 > 1)"),
+        (
+            [0, 0, 2, 5],
+            [big],
+            [big],
+            "parent_offsets[N] = 5 but parents has 1 and via_edges has 1 entries",
+        ),
+        (
+            [0, 1, 4, 6],
+            [2, 0, 0, 0, 0, 1],
+            [4, 1, 0, 0, 0, big],
+            f"via_edges[5] = {big} out of edge range [0, 5)",
+        ),
+        (
+            [0, 1, 4, 6],
+            [2, 0, 0, 0, 0, 1],
+            [4, 1, 0, 0, 0, 3],
+            "entry 4 of node 2: via edge 0 joins (0, 1), not (0, 2)",
+        ),
+        (
+            [0, 1, 4, 6],
+            [2, 0, 0, 0, 0, 1],
+            [4, 1, 0, 0, 2, 3],
+            "duplicate entry (child 1, via 0)",
+        ),
+        ([0, 1, 3, 5], [2, 0, 0, 0, 1], [4, 1, 0, 2, 3], "the entries contain a cycle"),
+        (
+            [0, 0, 2, 4],
+            [0, 0, 0, 1],
+            [1, 0, 2, 3],
+            "the entries of node 1 are not in ascending via EdgeId (1 then 0)",
+        ),
+    ]
+    for offsets, parents, via, message in steps:
+        with pytest.raises(ValueError) as info:
+            ngc.PredecessorDAG.from_csr(g, offsets, parents, via)
+        assert str(info.value) == "PredecessorDAG.from_csr: " + message
+    ngc.PredecessorDAG.from_csr(g, [0, 0, 2, 4], [0, 0, 0, 1], [0, 1, 2, 3])
+
+
+@pytest.mark.parametrize(
+    "offsets",
+    [
+        [0, 2**100, 2**99],
+        (0, 2**100, 2**99),
+        [0, 2**64 - 1, 2**64 - 2],
+        np.array([0, 2**64 - 1, 2**64 - 2], dtype=np.uint64),
+        [0, 100, 99],
+    ],
+)
+def test_from_csr_compares_offsets_beyond_int64_exactly(offsets):
+    # Two offsets above int64 compare by value, so a decreasing pair is the
+    # monotonicity error at its index, before the offsets[N] count check.
+    g = build(2, [(0, 1, 1, 1)])
+    with pytest.raises(ValueError, match="not monotone at 2"):
+        ngc.PredecessorDAG.from_csr(g, offsets, [], [])
+    increasing = [0, 2**99, 2**100]
+    with pytest.raises(
+        ValueError, match=r"offsets\[N\] = 1267650600228229401496703205376"
+    ):
+        ngc.PredecessorDAG.from_csr(g, increasing, [], [])
+
+
+class FailingIndex:
+    """An integer-like object whose __index__ returns 2**100, except on call `fail_on`, which
+    raises `error` (kept to check that the caller receives this very exception)."""
+
+    def __init__(self, fail_on=0, error=None):
+        self.calls = 0
+        self.fail_on = fail_on
+        self.error = error
+
+    def __index__(self):
+        self.calls += 1
+        if self.calls == self.fail_on:
+            raise self.error
+        return 2**100
+
+
+class ConversionFailed(Exception):
+    pass
+
+
+@pytest.mark.parametrize("error_type", [ConversionFailed, MemoryError])
+@pytest.mark.parametrize("which", [1, 2])
+@pytest.mark.parametrize("fail_on", [1, 2])
+def test_from_csr_passes_a_failed_offset_conversion_through(fail_on, which, error_type):
+    # Offsets 1 and 2 both overflow int64: they are read once, then converted again to compare
+    # them exactly. A conversion that fails, on either read of either offset, raises its own
+    # exception to the caller, unchanged and with no other exception attached.
+    g = build(2, [(0, 1, 1, 1)])
+    offsets = [0, FailingIndex(), FailingIndex()]
+    error = error_type("conversion failed")
+    offsets[which].fail_on, offsets[which].error = fail_on, error
+    with pytest.raises(error_type) as info:
+        ngc.PredecessorDAG.from_csr(g, offsets, [], [])
+    assert info.value is error
+    assert info.value.__cause__ is None and info.value.__context__ is None
+    assert offsets[which].calls == fail_on
+    # Without a failure the same offsets reach the count check (2**100 is not 0 entries).
+    with pytest.raises(
+        ValueError, match=r"^PredecessorDAG.from_csr: parent_offsets\[N\] = "
+    ):
+        ngc.PredecessorDAG.from_csr(g, [0, FailingIndex(), FailingIndex()], [], [])
+
+
+def test_from_csr_type_and_shape_defects():
+    g = build(3, G_EDGES)
+    with pytest.raises(
+        TypeError, match=exact("parent_offsets must be a 1-D array (got 2 dimensions)")
+    ):
+        ngc.PredecessorDAG.from_csr(g, np.zeros((2, 2), dtype=np.int64), [], [])
+    with pytest.raises(
+        TypeError, match=exact("parent_offsets[3] must be an integer (got float)")
+    ):
+        ngc.PredecessorDAG.from_csr(g, [0, 0, 0, 0.0], [], [])
+    with pytest.raises(
+        TypeError, match=exact("parent_offsets[3] must be an integer (got bool)")
+    ):
+        ngc.PredecessorDAG.from_csr(g, [0, 0, 0, True], [], [])
+
+
+def test_path_cost_hops_and_to_dag():
+    g = build(3, G_EDGES)
+    p = ngc.Path(g, [[1, 0], [3]])
+    assert (p.source(), p.destination(), p.cost()) == (0, 2, 2)
+    assert p.hops() == [[1, 0], [3]]  # the caller's member order is kept
+    dag = p.to_dag()
+    assert list(dag.parent_offsets()) == [0, 0, 2, 3]
+    assert list(dag.via_edges()) == [0, 1, 3]
+    assert p.graph_uid() == g.uid()
+    assert ngc.Path(g, [[1, 0], [3]]) == p
+    assert ngc.Path(g, [[0, 1], [3]]) != p
+    assert hash(ngc.Path(g, [[1, 0], [3]])) == hash(p)
+    # Equality includes the graph: the same hops on a twin graph (the same arrays, another uid).
+    twin = build(3, G_EDGES)
+    there = ngc.Path(twin, [[1, 0], [3]])
+    assert there.graph_uid() == twin.uid() != g.uid()
+    assert there.hops() == p.hops() and there.cost() == p.cost()
+    assert there != p and not there == p
+
+
+@pytest.mark.parametrize(
+    ("hops", "message"),
+    [
+        ([[], [7]], "hop 1 member 7 out of edge range [0, 5)"),
+        ([[L64]], "hop 0 member 18446744073709551616 out of edge range [0, 5)"),
+        ([[0, 0], []], "duplicate member 0"),
+        ([], "the hop list is empty"),
+        ([[0], []], "hop 1 is empty"),
+        (
+            [[0, 2]],
+            "the members of hop 0 do not share (u, v): edge 2 joins (0, 2), edge 0 "
+            "joins (0, 1)",
+        ),
+        ([[0], [2]], "hops 0 and 1 are not contiguous (1 then 0)"),
+        ([[2], [4]], "node 0 is repeated"),
+    ],
+)
+def test_path_validation_order(hops, message):
+    g = build(3, G_EDGES)
+    with pytest.raises(ValueError, match=exact(f"Path: {message}")):
+        ngc.Path(g, hops)
+
+
+def test_path_reports_the_first_of_several_defects():
+    # Several defects at once, then each reported one removed; the later defect sits in an
+    # earlier hop where it can. Hop 2 of the fourth step mixes 0 -> 2 and 0 -> 1, hops 0 and 1
+    # do not meet and node 0 repeats.
+    g = build(3, G_EDGES)
+    big = 2**70
+    steps = [
+        ([[0, 0, 2], [], [big]], f"hop 2 member {big} out of edge range [0, 5)"),
+        ([[0, 0, 2], [], [4]], "duplicate member 0"),
+        ([[0, 2], [], [4]], "hop 1 is empty"),
+        (
+            [[1], [4], [2, 0]],
+            "the members of hop 2 do not share (u, v): edge 0 joins (0, 1), edge 2 "
+            "joins (0, 2)",
+        ),
+        ([[1], [4], [2]], "hops 0 and 1 are not contiguous (1 then 2)"),
+        ([[2], [4], [0]], "node 0 is repeated"),
+    ]
+    for hops, message in steps:
+        with pytest.raises(ValueError) as info:
+            ngc.Path(g, hops)
+        assert str(info.value) == "Path: " + message
+
+
+def test_route_tie_break_and_enums():
+    # RouteTieBreak has exactly four values, FEWER_HOPS first (the default everywhere); the
+    # route choice is fields of the models and the search options, not an object.
+    assert list(ngc.RouteTieBreak.__members__) == [
+        "FEWER_HOPS",
+        "HIGHER_CAPACITY",
+        "HIGHER_AVAILABLE_CAPACITY",
+        "HIGHER_HEADROOM",
+    ]
+    assert ngc.ShortestPaths().tie_break == ngc.RouteTieBreak.FEWER_HOPS
+    assert {m.name for m in ngc.RouteAllocation.__members__.values()} == {
+        "OPTIMIZED",
+        "WEIGHTED",
+        "EQUAL",
+    }
+    assert set(ngc.Admission.__members__) == {"LOSSLESS", "LOSSY"}
+    assert set(ngc.SourceAllocation.__members__) == {"EQUAL", "OPTIMIZED", "WEIGHTED"}
+    for retired in ("PathSelection", "EdgeTieBreak", "EdgePriority"):
+        assert retired not in dir(ngc), retired
+
+
+def test_eligibility_intersect_returns_the_operand_object():
+    g = build(3, G_EDGES)
+    everything = g.eligibility()
+    a = g.eligibility(excluded_edges=[0])
+    b = g.eligibility(excluded_edges=[1])
+    ab = g.eligibility(excluded_edges=[0, 1])
+    assert ngc.Eligibility.intersect(everything, a) is a
+    assert ngc.Eligibility.intersect(a, everything) is a
+    assert ngc.Eligibility.intersect(a, a) is a
+    # Two equal values built separately (distinct uids): the first operand wins the tie.
+    a2 = g.eligibility(excluded_edges=[0])
+    assert a2.uid() != a.uid()
+    assert ngc.Eligibility.intersect(a, a2) is a
+    assert ngc.Eligibility.intersect(a2, a) is a2
+    assert ngc.Eligibility.intersect(a, ab) is ab
+    x = ngc.Eligibility.intersect(a, b)
+    y = ngc.Eligibility.intersect(a, b)
+    assert x.uid() not in (0, a.uid(), b.uid(), y.uid())
+    assert list(x.edge_allowed()) == list(ab.edge_allowed())
+    other = build(3, G_EDGES)
+    with pytest.raises(ValueError, match="different graphs"):
+        ngc.Eligibility.intersect(a, other.eligibility())
diff --git a/tests/py/test_search.py b/tests/py/test_search.py
new file mode 100644
index 0000000..8a96b01
--- /dev/null
+++ b/tests/py/test_search.py
@@ -0,0 +1,458 @@
+"""The public search through the binding (``spf``, docs/semantics.md#4-search): results, the
+DAG's canonical form, the validation order on unnarrowed values, the enumerations, and the
+all-or-nothing construction of the result objects."""
+
+from __future__ import annotations
+
+import itertools
+import operator
+import traceback
+
+import numpy as np
+import pytest
+from helpers import (
+    FEWER,
+    HIGHER_AVAIL,
+    HIGHER_CAP,
+    L62,
+    assert_read_only,
+    build,
+    exact,
+    ids,
+    plain,
+    sweep_python_allocation,
+    to_ids,
+)
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+FWD = ngc.Direction.FORWARD
+REV = ngc.Direction.REVERSE
+
+
+def via(dag):
+    return sorted(int(e) for e in dag.via_edges())
+
+
+def opts(direction=FWD, **kw):
+    return ngc.SpfOptions(direction, **kw)
+
+
+ANYCAST = [(0, 1, 1, 1), (1, 2, 1, 1), (0, 3, 1, 2), (3, 2, 1, 5), (1, 4, 1, 5)]
+
+
+def test_full_search_and_anycast():
+    g = build(5, ANYCAST)
+    full = ngc.spf(g, 0, opts())
+    assert full.costs.dtype == np.int64
+    assert list(full.costs) == [0, 1, 2, 2, 6]
+    assert full.target_cost is None
+    assert not full.costs.flags.writeable
+    any_ = ngc.spf(g, [0], opts(targets=[2, 4]))
+    assert any_.costs is None
+    assert any_.target_cost == 2
+    assert via(any_.dag) == ids(g, {0, 1})
+    rev = ngc.spf(g, [2, 4], opts(REV, targets=0))
+    assert rev.dag == any_.dag
+    assert rev.target_cost == 2
+    none = ngc.spf(g, 2, opts(targets=0))
+    assert none.target_cost is None
+    assert list(none.dag.via_edges()) == []
+    unreachable = ngc.spf(g, 2, opts())
+    assert list(unreachable.costs) == [
+        ngc.UNREACHABLE,
+        ngc.UNREACHABLE,
+        0,
+        ngc.UNREACHABLE,
+        ngc.UNREACHABLE,
+    ]
+    # Reading a field twice returns the same object: the result allocates nothing on access.
+    assert full.dag is full.dag and full.costs is full.costs
+    assert "target_cost=2" in repr(any_)
+
+
+def test_reverse_full_search_is_forward_oriented():
+    g = build(4, [(0, 1, 1, 1), (0, 1, 1, 1), (0, 2, 1, 2), (1, 3, 1, 1), (2, 3, 1, 1)])
+    r = ngc.spf(g, 3, opts(REV))
+    assert list(r.costs) == [2, 1, 1, 0]
+    assert via(r.dag) == ids(g, {0, 1, 3, 4})
+    off = list(r.dag.parent_offsets())
+    assert off[0] == 0 and off[-1] == len(r.dag.via_edges())
+
+
+def test_staged_single_path_with_a_shared_bottleneck_takes_the_fewest_hops():
+    # s -> v (1, prio 1), v -> t (3, prio 1), v -> a -> b -> t (1 + 1 + 1, prio 2): the
+    # bottleneck of every walk is 1, so the two-hop walk wins under FEWER_HOPS and
+    # HIGHER_CAPACITY.
+    g = build(5, [(0, 1, 1, 1), (1, 4, 1, 3), (1, 2, 2, 1), (2, 3, 2, 1), (3, 4, 2, 1)])
+    for tie in (FEWER, HIGHER_CAP):
+        f = ngc.spf(g, 0, opts(tie_break=tie, multipath=False, targets=4))
+        assert via(f.dag) == ids(g, {0, 1})
+        assert f.target_cost == 4
+        r = ngc.spf(g, 4, opts(REV, tie_break=tie, multipath=False, targets=0))
+        assert r.dag == f.dag
+
+
+def test_residual_gating_and_tie_scores():
+    # Capacities 5; residuals by input [5, 4, 1, 3, 2]: 0->1->3 has bottleneck 4.
+    g = build(4, [(0, 1, 5, 1), (1, 3, 5, 1), (0, 2, 5, 1), (2, 3, 5, 1), (0, 3, 5, 2)])
+    residual = np.array(to_ids(g, [5, 4, 1, 3, 2]), dtype=np.int64)
+    r = ngc.spf(
+        g,
+        0,
+        opts(tie_break=HIGHER_AVAIL, multipath=False, targets=3, residual=residual),
+    )
+    assert via(r.dag) == ids(g, {0, 1})
+    # Gated at 4 units: only 0->1 (5) and 1->3 (4) are routable on that walk; the direct edge
+    # (residual 2) is gated out, so the cost-2 walk is the two-hop one through node 1.
+    gated = ngc.spf(g, 0, opts(targets=3, residual=residual, min_residual=4))
+    assert gated.target_cost == 2
+    assert via(gated.dag) == ids(g, {0, 1})
+    # min_residual without a residual gates nothing.
+    assert ngc.spf(g, 0, opts(min_residual=7)).costs[3] == 2
+
+
+def test_validation_order_on_unnarrowed_values():
+    # The residual's own checks are the shared ones of test_edge_amounts.py.
+    g = build(3, [(0, 1, 2, 1), (1, 2, 2, 1)])
+    other = build(3, [(0, 1, 2, 1)])
+    with pytest.raises(ValueError, match=exact("roots: the node set is empty")):
+        ngc.spf(g, [], opts())
+    with pytest.raises(
+        ValueError, match=exact("roots: node 3 out of node range [0, 3)")
+    ):
+        ngc.spf(g, 3, opts())
+    big = 2**70
+    with pytest.raises(ValueError, match=rf"^roots: node {big} out of node range"):
+        ngc.spf(g, [0, big], opts())
+    with pytest.raises(ValueError, match=exact("targets: the node set is empty")):
+        ngc.spf(g, 0, opts(targets=[]))
+    with pytest.raises(ValueError, match=r"^targets: node -1 out of node range"):
+        ngc.spf(g, 0, opts(targets=[-1]))
+    with pytest.raises(
+        ValueError, match=r"^node 1 is in both endpoint sets: roots and targets"
+    ):
+        ngc.spf(g, [0, 1], opts(targets=[1]))
+    single = (
+        "multipath = false requires targets (the single path joins a root to a target)"
+    )
+    with pytest.raises(ValueError, match=exact(single)):
+        ngc.spf(g, 0, opts(multipath=False))
+    ineffective = "spf tie_break requires multipath=False or parallel_edges=False"
+    with pytest.raises(ValueError, match=exact(ineffective)):
+        ngc.spf(g, 0, opts(tie_break=HIGHER_CAP))
+    for multipath, parallel_edges in ((False, True), (True, False), (False, False)):
+        ngc.spf(
+            g,
+            0,
+            opts(
+                tie_break=HIGHER_CAP,
+                multipath=multipath,
+                parallel_edges=parallel_edges,
+                targets=None if multipath else 2,
+            ),
+        )
+    with pytest.raises(
+        ValueError, match=exact("min_residual must be at least 1 unit (got 0)")
+    ):
+        ngc.spf(g, 0, opts(min_residual=0))
+    with pytest.raises(
+        ValueError, match=exact(f"min_residual must be at least 1 unit (got {-big})")
+    ):
+        ngc.spf(g, 0, opts(min_residual=-big))
+    with pytest.raises(
+        TypeError, match=exact("min_residual must be an integer (got float)")
+    ):
+        ngc.spf(g, 0, opts(min_residual=1.5))
+    with pytest.raises(ValueError, match="^foreign Eligibility"):
+        ngc.spf(g, 0, opts(eligibility=other.eligibility([], [0])))
+    # Several defects: the first in the documented order (roots, targets, overlap, single
+    # path, the ineffective tie rule, residual, min_residual, Eligibility).
+    with pytest.raises(ValueError, match=exact("roots: the node set is empty")):
+        ngc.spf(g, [], opts(targets=[], residual=[1], min_residual=0))
+    with pytest.raises(ValueError, match=rf"^targets: node {big} out of node range"):
+        ngc.spf(g, 0, opts(targets=[0, big], residual=[]))
+    with pytest.raises(ValueError, match="both endpoint sets"):
+        ngc.spf(g, 0, opts(targets=0, residual=[]))
+    with pytest.raises(ValueError, match=exact(single)):
+        ngc.spf(g, 0, opts(multipath=False, tie_break=HIGHER_CAP, residual=[]))
+    with pytest.raises(ValueError, match=exact(ineffective)):
+        ngc.spf(g, 0, opts(tie_break=HIGHER_CAP, residual=[], min_residual=0))
+    with pytest.raises(ValueError, match="^residual"):
+        ngc.spf(g, 0, opts(residual=[1, 9], min_residual=0))
+    with pytest.raises(ValueError, match="^min_residual"):
+        ngc.spf(g, 0, opts(min_residual=0, eligibility=other.eligibility([], [0])))
+    # A min_residual above INT64_MAX is no error and acts as INT64_MAX does: it gates every
+    # residual edge, even one whose residual is the largest unit value 2^62 - 1, which
+    # min_residual = 2^62 - 1 itself admits.
+    top = build(2, [(0, 1, L62 - 1, 1)])
+    for m in (L62 - 1, 2**63 - 1, big):
+        r = ngc.spf(top, 0, opts(residual=[L62 - 1], min_residual=m))
+        assert list(r.costs) == [0, 1 if m == L62 - 1 else ngc.UNREACHABLE], m
+    huge = ngc.spf(g, 0, opts(residual=[2, 2], min_residual=big))
+    assert list(huge.costs)[1:] == [ngc.UNREACHABLE, ngc.UNREACHABLE]
+    assert plain(huge) == plain(
+        ngc.spf(g, 0, opts(residual=[2, 2], min_residual=2**63 - 1))
+    )
+
+
+def test_options_types_and_enumerations():
+    g = build(2, [(0, 1, 1, 1)])
+    o = opts(targets=[1], min_residual=3)
+    assert o.direction == FWD and o.targets == [1] and o.min_residual == 3
+    assert o.residual is None and o.eligibility is None
+    with pytest.raises(
+        ValueError, match=exact("direction: 7 is not a value of Direction")
+    ):
+        ngc.SpfOptions(ngc.Direction(7))
+    with pytest.raises(TypeError):
+        ngc.SpfOptions(FWD, fanout_edges=[0])
+    with pytest.raises(TypeError, match=r"^spf\(\): incompatible function arguments"):
+        ngc.spf(g, 0, opts(), fanout_edges=[0])
+    with pytest.raises(TypeError, match=exact("SpfOptions expected (got KspOptions)")):
+        ngc.spf(g, 0, ngc.KspOptions(1))
+    with pytest.raises(TypeError):
+        ngc.SpfOptions()
+    # The route choice: keywords only, bools strictly (None and 1 are no bool).
+    with pytest.raises(TypeError):
+        ngc.SpfOptions(FWD, None)
+    for bad in (None, 1, "yes"):
+        for name in ("multipath", "parallel_edges"):
+            with pytest.raises(TypeError):
+                ngc.SpfOptions(FWD, **{name: bad})
+    assert ngc.SpfOptions(FWD, multipath=np.bool_(False)).multipath is False
+    # Roots as a NumPy array, with duplicates.
+    r = ngc.spf(g, np.array([0, 0], dtype=np.int32), opts())
+    assert list(r.costs) == [0, 1]
+    # SpfOptions keeps targets, residual and min_residual as given (the same objects) and
+    # validates only the direction: spf validates the rest at the call, in its order.
+    assert opts().min_residual == 1
+    targets, residual, low = [1, 1], [9], -(2**70)
+    o = opts(targets=targets, residual=residual, min_residual=low)
+    assert o.targets is targets and o.residual is residual and o.min_residual is low
+    assert (o.tie_break, o.multipath, o.parallel_edges) == (FEWER, True, True)
+    assert_read_only(o, "direction", "tie_break", "multipath", "parallel_edges")
+    with pytest.raises(ValueError, match=r"^residual\[0\] = 9 is outside"):
+        ngc.spf(g, 0, o)
+
+
+@needs_hooks
+def test_python_result_construction_is_all_or_nothing():
+    # Every Python object allocation of the call fails once: the call raises (never crashes)
+    # and a clean retry gives the same result, for a search with targets and a full search.
+    g = build(5, ANYCAST)
+    for o in (opts(targets=[2, 4]), opts()):
+        failures = sweep_python_allocation(lambda o=o: (ngc.spf, (g, 0, o), list), 200)
+        assert failures >= 2, o.targets
+
+
+@needs_hooks
+def test_the_python_allocation_sweep_rejects_a_wrong_call():
+    # sweep_python_allocation rejects a wrong call, each on its own clause: one that absorbs the
+    # injected failure and returns a value, one that raises another exception in its place, one
+    # that changes the observable state before the failure reaches it; one whose completing call
+    # raises after its result, returns another value or makes fewer allocations than failed
+    # before it (a prebuilt result), one whose retry after a failure returns another value; and
+    # one that has not completed within the attempt limit.
+    g = build(5, ANYCAST)
+
+    def absorbs(o):
+        try:
+            return ngc.spf(g, 0, o)
+        except MemoryError:
+            return "absorbed"
+
+    def replaces(o):
+        try:
+            return ngc.spf(g, 0, o)
+        except MemoryError:
+            raise RuntimeError("replaced") from None
+
+    def changing():
+        log = []
+
+        def changes(o):
+            log.append(o)
+            return ngc.spf(g, 0, o)
+
+        return changes, (opts(),), lambda: len(log)
+
+    def root(r):
+        def search(o):
+            return ngc.spf(g, r, o)
+
+        return search
+
+    root0, root1 = root(0), root(1)
+    full = ngc.spf(g, 0, opts())
+
+    def fewer_allocations():
+        made = itertools.count()
+        # This C callable returns the existing result without allocating a Python object.
+        prebuilt = operator.itemgetter(0)
+
+        def make():
+            if next(made) >= 3:
+                return prebuilt, ([full],), list
+            return ngc.spf, (g, 0, opts()), list
+
+        return make
+
+    def raising():
+        # The completing call raises after its result. It raises in the frame the sweep calls:
+        # CPython keeps an exception whose traceback entry for an outer frame failed to allocate.
+        made = itertools.count()
+
+        def make():
+            m = next(made)
+            injected_call = False
+
+            def snapshot():
+                # The sweep reads this before injection and again before a clean retry, so it
+                # tells those two calls apart whether or not the failure reaches raises().
+                nonlocal injected_call
+                injected_call = not injected_call
+                return []
+
+            def raises(o):
+                result = ngc.spf(g, 0, o)
+                if m and injected_call:
+                    raise LookupError("after its result")
+                return result
+
+            return raises, (opts(),), snapshot
+
+        return make
+
+    def by_turn(turns):
+        # m = 0 is the reference, c = 0 the injected call, c = 1 its clean retry.
+        # Advance at snapshot boundaries, which the sweep crosses once per call.
+        made = itertools.count()
+
+        def make():
+            m = next(made)
+            snapshots = itertools.count()
+            c = 0
+
+            def snapshot():
+                nonlocal c
+                c = next(snapshots)
+                return []
+
+            return (lambda o: turns(m, c)(o)), (opts(),), snapshot
+
+        return make
+
+    for make, clause in (
+        (lambda: (absorbs, (opts(),), list), "assert value is None, (where, value)"),
+        (
+            lambda: (replaces, (opts(),), list),
+            "assert type(error) is MemoryError, (where, repr(error))",
+        ),
+        (changing, "assert snapshot() == before, where"),
+        (raising(), "assert error is None, (where, repr(error))"),
+        (
+            by_turn(lambda m, c: root1 if m and not c else root0),
+            "assert plain(value) == want, where",
+        ),
+        (
+            fewer_allocations(),
+            "assert seen == failures, (where, seen)  # every allocation failed once",
+        ),
+        (
+            by_turn(lambda m, c: root1 if m and c == 1 else root0),
+            "assert plain(fn(*args)) == want, where",
+        ),
+    ):
+        try:
+            sweep_python_allocation(make, 200)
+        except AssertionError as error:
+            actual = traceback.extract_tb(error.__traceback__)[-1].line
+            assert actual == clause, (actual, clause)
+        else:
+            pytest.fail(f"the planted bug passed its clause: {clause}")
+    # A call that needs more attempts than the limit: the sweep fails, never passes.
+    with pytest.raises(pytest.fail.Exception) as info:
+        sweep_python_allocation(lambda: (ngc.spf, (g, 0, opts()), list), 2)
+    assert str(info.value) == "spf never completed"
+
+
+# The route choice. TRI: three parallel cost-1 links 0 -> 1 of capacities 4, 10,
+# 100 and a cost-2 link of 50; availability (the residual) 4, 8, 5, 50.
+TRI = [(0, 1, 4, 1), (0, 1, 10, 1), (0, 1, 100, 1), (0, 1, 50, 2)]
+TRI_AVAILABLE = [4, 8, 5, 50]
+TIE = ngc.RouteTieBreak
+# The scores: HIGHER_CAPACITY 4, 10, 100; HIGHER_AVAILABLE_CAPACITY 4, 8, 5; HIGHER_HEADROOM
+# 4/4 = 1, 8/10 = 4/5, 5/100 = 1/20. The costlier e3 never wins.
+TRI_WINNER = {
+    TIE.FEWER_HOPS: 0,
+    TIE.HIGHER_CAPACITY: 2,
+    TIE.HIGHER_AVAILABLE_CAPACITY: 1,
+    TIE.HIGHER_HEADROOM: 0,
+}
+
+
+def test_tie_parallel():
+    # TIE-parallel: the single path takes one link per rule.
+    g = build(2, TRI)
+    for tie, want in TRI_WINNER.items():
+        options = opts(
+            targets=[1], multipath=False, tie_break=tie, residual=TRI_AVAILABLE
+        )
+        assert via(ngc.spf(g, 0, options).dag) == [want], tie
+
+
+def test_parallel_collapse():
+    # Multipath with one member per (u, v) pair: the DAG keeps one link of the cost-1 class,
+    # chosen by the same rule.
+    g = build(2, TRI)
+    for tie, want in TRI_WINNER.items():
+        options = opts(parallel_edges=False, tie_break=tie, residual=TRI_AVAILABLE)
+        assert via(ngc.spf(g, 0, options).dag) == [want], tie
+
+
+def test_tie_routes():
+    # TIE-routes: a direct link of capacity 3 (e1, cost 2) against two hops of capacity 10 (e0,
+    # e2, cost 1 each). Without a residual every score reads static capacity, and HEADROOM reads
+    # 1 on every positive link, so its bottlenecks tie and hops decide. TIE-bottleneck: with e2
+    # at capacity 1 the two-hop bottleneck is 1 and every rule takes the direct link, although
+    # the two-hop route's first link is the larger one.
+    for e2, want in (
+        (10, {TIE.FEWER_HOPS: [1], TIE.HIGHER_CAPACITY: [0, 2]}),
+        (1, {TIE.FEWER_HOPS: [1], TIE.HIGHER_CAPACITY: [1]}),
+    ):
+        g = build(3, [(0, 1, 10, 1), (0, 2, 3, 2), (1, 2, e2, 1)])
+        want[TIE.HIGHER_AVAILABLE_CAPACITY] = want[TIE.HIGHER_CAPACITY]
+        want[TIE.HIGHER_HEADROOM] = [1]
+        for tie in TIE.__members__.values():
+            r = ngc.spf(g, 0, opts(targets=[2], multipath=False, tie_break=tie))
+            assert via(r.dag) == want[tie], (e2, tie)
+
+
+def test_headroom_zero_capacity():
+    # Without a residual HIGHER_HEADROOM reads 0 on a zero-capacity link and 1 on a positive
+    # one, so it takes e1; FEWER_HOPS takes the lower EdgeId e0.
+    g = build(2, [(0, 1, 0, 1), (0, 1, 5, 1)])
+    for tie, want in ((TIE.HIGHER_HEADROOM, [1]), (TIE.FEWER_HOPS, [0])):
+        r = ngc.spf(g, 0, opts(targets=[1], multipath=False, tie_break=tie))
+        assert via(r.dag) == want, tie
+
+
+def test_tie_rule_validation():
+    # spf's entry: the ineffective tie rule after the single-path rule and before the residual.
+    g = build(3, [(0, 1, 2, 1), (1, 2, 2, 1)])
+    ineffective = "spf tie_break requires multipath=False or parallel_edges=False"
+    single = (
+        "multipath = false requires targets (the single path joins a root to a target)"
+    )
+    with pytest.raises(ValueError, match=exact(ineffective)):
+        ngc.spf(g, 0, opts(tie_break=TIE.HIGHER_CAPACITY))
+    with pytest.raises(ValueError, match=exact(ineffective)):
+        ngc.spf(g, 0, opts(tie_break=TIE.HIGHER_CAPACITY, residual=[1]))
+    with pytest.raises(ValueError, match=exact(single)):
+        ngc.spf(g, 0, opts(tie_break=TIE.HIGHER_CAPACITY, multipath=False))
+    assert ngc.spf(
+        g, 0, opts(tie_break=TIE.HIGHER_CAPACITY, parallel_edges=False)
+    ).costs.tolist() == [0, 1, 2]
+    assert ngc.spf(g, 0, opts()).costs.tolist() == [0, 1, 2]
diff --git a/tests/py/test_sensitivity.py b/tests/py/test_sensitivity.py
deleted file mode 100644
index 00da0f0..0000000
--- a/tests/py/test_sensitivity.py
+++ /dev/null
@@ -1,196 +0,0 @@
-import os
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def _make_graph(num_nodes, src, dst, capacity, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, capacity, cost, ext_edge_ids
-    )
-
-
-def test_sensitivity_simple():
-    # S->T (cap 10)
-    g = _make_graph(
-        num_nodes=2,
-        src=np.array([0], dtype=np.int32),
-        dst=np.array([1], dtype=np.int32),
-        capacity=np.array([10.0], dtype=np.float64),
-        cost=np.array([1], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    res = alg.sensitivity_analysis(gh, 0, 1)
-    assert len(res) == 1
-    assert res[0][0] == 0  # Edge ID
-    assert res[0][1] == 10.0
-
-
-def test_sensitivity_parallel():
-    # S->T (cap 10), S->T (cap 10)
-    g = _make_graph(
-        num_nodes=2,
-        src=np.array([0, 0], dtype=np.int32),
-        dst=np.array([1, 1], dtype=np.int32),
-        capacity=np.array([10.0, 10.0], dtype=np.float64),
-        cost=np.array([1, 1], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    res = alg.sensitivity_analysis(gh, 0, 1)
-    assert len(res) == 2
-    for _eid, delta in res:
-        assert delta == 10.0
-
-
-def test_sensitivity_partial():
-    # S->A (10), S->B (5), A->T (5), B->T (10)
-    # 0->1 (0), 0->2 (1), 1->3 (2), 2->3 (3)
-    g = _make_graph(
-        num_nodes=4,
-        src=np.array([0, 0, 1, 2], dtype=np.int32),
-        dst=np.array([1, 2, 3, 3], dtype=np.int32),
-        capacity=np.array([10.0, 5.0, 5.0, 10.0], dtype=np.float64),
-        cost=np.array([1, 1, 1, 1], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    # With all equal-cost edges, shortest_path=True/False give the same result.
-
-    res = alg.sensitivity_analysis(gh, 0, 3)
-
-    # Saturated: S->B (1), A->T (2)
-    saturated = {1, 2}
-    assert len(res) == 2
-    for eid, delta in res:
-        assert eid in saturated
-        assert delta == 5.0
-
-
-def test_sensitivity_masked():
-    # Two parallel paths, cap 10. One masked out via input mask.
-    g = _make_graph(
-        num_nodes=2,
-        src=np.array([0, 0], dtype=np.int32),
-        dst=np.array([1, 1], dtype=np.int32),
-        capacity=np.array([10.0, 10.0], dtype=np.float64),
-        cost=np.array([1, 1], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    # Mask edge 1
-    edge_mask = np.array([True, False], dtype=bool)
-
-    res = alg.sensitivity_analysis(gh, 0, 1, edge_mask=edge_mask)
-
-    # Should only see edge 0. Max flow is 10. Sensitivity of edge 0 is 10.
-    assert len(res) == 1
-    assert res[0][0] == 0
-    assert res[0][1] == 10.0
-
-
-def test_sensitivity_shortest_path_vs_max_flow():
-    """Test that shortest_path mode produces different sensitivity results.
-
-    Topology: S(0) -> A(1) -> T(2) [cost 1+1=2, cap 10 each]
-              S(0) -> B(3) -> T(2) [cost 2+2=4, cap 5 each]
-
-    With shortest_path=False (full max-flow):
-      - Uses both paths: S->A->T (10) + S->B->T (5) = 15 total
-      - All 4 edges are saturated and critical
-
-    With shortest_path=True (single-pass, IP/IGP mode):
-      - Only uses cheapest path: S->A->T (10)
-      - Edges 2,3 (S->B->T path) are NOT used, so NOT critical
-    """
-    g = _make_graph(
-        num_nodes=4,
-        src=np.array([0, 1, 0, 3], dtype=np.int32),
-        dst=np.array([1, 2, 3, 2], dtype=np.int32),
-        capacity=np.array([10.0, 10.0, 5.0, 5.0], dtype=np.float64),
-        cost=np.array([1, 1, 2, 2], dtype=np.int64),  # S->A->T costs 2, S->B->T costs 4
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    # Step 1: Verify baseline flow values with max_flow
-    # This validates the routing semantics before testing sensitivity
-    flow_full, _ = alg.max_flow(gh, 0, 2, shortest_path=False)
-    flow_sp, _ = alg.max_flow(gh, 0, 2, shortest_path=True)
-
-    assert abs(flow_full - 15.0) < 1e-9, f"Full max-flow should be 15, got {flow_full}"
-    assert abs(flow_sp - 10.0) < 1e-9, f"Shortest-path flow should be 10, got {flow_sp}"
-
-    # Step 2: Test sensitivity with shortest_path=False (full max-flow)
-    res_full = alg.sensitivity_analysis(gh, 0, 2, shortest_path=False)
-
-    # All 4 edges should be saturated and critical
-    assert len(res_full) == 4, "Full max-flow should report all 4 edges as critical"
-    edge_ids_full = {eid for eid, _ in res_full}
-    assert edge_ids_full == {0, 1, 2, 3}
-
-    # Step 3: Test sensitivity with shortest_path=True (IP/IGP mode)
-    res_sp = alg.sensitivity_analysis(gh, 0, 2, shortest_path=True)
-
-    # Only edges 0,1 (S->A->T path) should be critical
-    assert len(res_sp) == 2, "Shortest-path mode should only report 2 edges as critical"
-    edge_ids_sp = {eid for eid, _ in res_sp}
-    assert edge_ids_sp == {0, 1}, f"Expected edges 0,1 but got {edge_ids_sp}"
-
-    # Delta values: baseline=10, with edge removed traffic uses S->B->T (cap 5)
-    for eid, delta in res_sp:
-        assert abs(delta - 5.0) < 1e-9, f"Edge {eid} should have delta 5.0, got {delta}"
-
-
-def test_sensitivity_order_deterministic_across_runs():
-    """Repeated runs should preserve the same edge ordering and deltas."""
-    g = _make_graph(
-        num_nodes=4,
-        src=np.array([0, 0, 1, 2], dtype=np.int32),
-        dst=np.array([1, 2, 3, 3], dtype=np.int32),
-        capacity=np.array([10.0, 5.0, 5.0, 10.0], dtype=np.float64),
-        cost=np.array([1, 1, 1, 1], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    first = alg.sensitivity_analysis(gh, 0, 3)
-    second = alg.sensitivity_analysis(gh, 0, 3)
-
-    assert first == second
-
-
-def test_sensitivity_threaded_matches_serial():
-    """Threaded sensitivity must exactly match the forced-serial reference."""
-    g = _make_graph(
-        num_nodes=4,
-        src=np.array([0, 1, 0, 3], dtype=np.int32),
-        dst=np.array([1, 2, 3, 2], dtype=np.int32),
-        capacity=np.array([10.0, 10.0, 5.0, 5.0], dtype=np.float64),
-        cost=np.array([1, 1, 2, 2], dtype=np.int64),
-    )
-    alg = ngc.Algorithms(ngc.Backend.cpu())
-    gh = alg.build_graph(g)
-
-    previous = os.environ.get("NGRAPH_CORE_SENSITIVITY_THREADS")
-    try:
-        os.environ["NGRAPH_CORE_SENSITIVITY_THREADS"] = "1"
-        serial = alg.sensitivity_analysis(gh, 0, 2, shortest_path=False)
-
-        os.environ["NGRAPH_CORE_SENSITIVITY_THREADS"] = "4"
-        threaded = alg.sensitivity_analysis(gh, 0, 2, shortest_path=False)
-    finally:
-        if previous is None:
-            os.environ.pop("NGRAPH_CORE_SENSITIVITY_THREADS", None)
-        else:
-            os.environ["NGRAPH_CORE_SENSITIVITY_THREADS"] = previous
-
-    assert threaded == serial
diff --git a/tests/py/test_shortest_path_cache.py b/tests/py/test_shortest_path_cache.py
new file mode 100644
index 0000000..9394d67
--- /dev/null
+++ b/tests/py/test_shortest_path_cache.py
@@ -0,0 +1,482 @@
+"""The ShortestPathCache's modes through the binding (docs/semantics.md#9-the-shortest-path-cache): the
+transition table, ShortestPathCacheMiss as a dedicated exception propagated unchanged by the evaluators,
+the evaluators' sharing rules (a frozen cache shared by every worker, a
+building one rejected with two or more), the reuse of prepopulated Eligibility uids, frozen
+lookups from several Python threads, and a frozen cache's statistics under failed calls."""
+
+from __future__ import annotations
+
+import itertools
+import threading
+import traceback
+
+import _netgraph_core as ext
+import pytest
+from concurrency_support import run_test_in_subprocess
+from helpers import ALL_OUT, GLOBAL, SHORTEST_PATHS, build, exact, stats_of
+from private_hooks import needs_hooks
+
+import netgraph_core as ngc
+
+
+def fabric():
+    """Leaves 0..5 and spines 6..8, every leaf joined to every spine both ways (capacity 4,
+    cost 1)."""
+    rows = [(leaf, s) for leaf in range(6) for s in range(6, 9)]
+    rows += [(s, leaf) for leaf, s in rows]
+    return build(9, [(u, v, 4, 1) for u, v in rows])
+
+
+def prepopulate(g, keys):
+    """A building cache holding the ShortestPaths support of each destination set (a capacity call
+    looks up the destinations' reverse support; the source is spine 6), frozen afterwards."""
+    cache = ngc.ShortestPathCache(g)
+    for dst in keys:
+        ngc.evaluate_demand(
+            g, 6, dst, ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+        )
+    cache.freeze()
+    return cache
+
+
+def stats(cache):
+    """Hits, misses and entries (the three statistics the transition table speaks of)."""
+    return stats_of(cache)[:3]
+
+
+def test_transition_table():
+    g = fabric()
+    cache = ngc.ShortestPathCache(g)
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    want = ngc.evaluate_demand(
+        g, 0, 3, ngc.EvaluationOptions(SHORTEST_PATHS)
+    ).call_delivered
+    assert want == 12  # three spines of 4: the comparisons below are not of zeros
+    assert ngc.evaluate_demand(g, 0, 3, opts).call_delivered == want
+    assert stats(cache) == (0, 1, 1)
+    cache.freeze()
+    cache.freeze()  # no effect
+    assert ngc.evaluate_demand(g, 1, 3, opts).call_delivered == want  # a hit
+    assert stats(cache) == (1, 1, 1)
+    with pytest.raises(
+        ngc.ShortestPathCacheMiss, match=r"no entry for roots \{4\}, direction Reverse"
+    ):
+        ngc.evaluate_demand(g, 0, 4, opts)
+    assert stats(cache) == (1, 2, 1)  # one miss, nothing inserted
+    with pytest.raises(ValueError) as error:
+        cache.clear()
+    assert (
+        str(error.value)
+        == "ShortestPathCache.clear is rejected while the cache is frozen (thaw() it, then clear())"
+    )
+    assert stats(cache) == (1, 2, 1)
+    cache.thaw()
+    cache.thaw()  # no effect
+    assert (
+        ngc.evaluate_demand(g, 0, 4, opts).call_delivered == want
+    )  # building again: searches, inserts
+    assert stats(cache) == (1, 3, 2)
+    cache.clear()
+    assert stats(cache) == (1, 3, 0)
+
+
+def test_miss_is_a_dedicated_exception():
+    assert issubclass(ngc.ShortestPathCacheMiss, Exception)
+    assert not issubclass(
+        ngc.ShortestPathCacheMiss, (RuntimeError, ValueError, TypeError)
+    )
+
+
+def test_frozen_cache_shared_by_every_worker():
+    g = fabric()
+    pairs = [(0, 3), (1, 4), (2, 5), ([0, 1], [3, 4])]
+    want = [
+        r.call_delivered
+        for r in ngc.evaluate_pairs(g, pairs, ngc.EvaluationOptions(SHORTEST_PATHS))
+    ]
+    building = ngc.ShortestPathCache(g)
+    with pytest.raises(ValueError, match="workers == 1"):
+        ngc.evaluate_pairs(
+            g, pairs, ngc.EvaluationOptions(SHORTEST_PATHS, cache=building), workers=2
+        )
+    assert all(w > 0 for w in want)  # every pair places: the comparison is not of zeros
+    cache = prepopulate(g, [[3], [4], [5], [3, 4]])
+    for workers in (1, 2, 4):
+        before = stats(cache)
+        got = ngc.evaluate_pairs(
+            g,
+            pairs,
+            ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache),
+            workers=workers,
+        )
+        assert [r.call_delivered for r in got] == want
+        assert stats(cache) == (before[0] + 4, before[1], 4), workers  # a hit per pair
+    # The lowest failing pair index's miss: pairs 0 and 2 miss, pair 0's key is reported, and
+    # the call counts that one miss.
+    partial = prepopulate(g, [[4]])
+    for workers in (1, 2, 4):
+        before = stats(partial)
+        with pytest.raises(ngc.ShortestPathCacheMiss, match=r"roots \{3\}"):
+            ngc.evaluate_pairs(
+                g,
+                pairs[:3],
+                ngc.EvaluationOptions(SHORTEST_PATHS, cache=partial),
+                workers=workers,
+            )
+        assert stats(partial) == (before[0], before[1] + 1, 1), workers
+
+
+def test_prepopulated_uids_and_intersections():
+    g = fabric()
+    common = g.eligibility(excluded_edges=[0])
+    narrow = g.eligibility(excluded_edges=[0, 1])  # contained in common
+    other = g.eligibility(excluded_edges=[1])  # the intersection with common is new
+    pairs = [(1, 4), (2, 5)]
+    cache = ngc.ShortestPathCache(g)
+    ngc.evaluate_demand(
+        g, 1, 4, ngc.EvaluationOptions(SHORTEST_PATHS, eligibility=narrow, cache=cache)
+    )
+    ngc.evaluate_demand(
+        g, 2, 5, ngc.EvaluationOptions(SHORTEST_PATHS, eligibility=common, cache=cache)
+    )
+    cache.freeze()
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, eligibility=common, cache=cache)
+    ngc.evaluate_pairs(g, pairs, opts, [narrow, None], workers=2)  # returns the operand
+    ngc.evaluate_pairs(
+        g,
+        pairs,
+        ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache),
+        [narrow, common],
+        workers=2,
+    )
+    assert stats(cache) == (4, 2, 2)
+    with pytest.raises(ngc.ShortestPathCacheMiss, match=r"roots \{4\}"):
+        ngc.evaluate_pairs(g, pairs, opts, [other, None], workers=2)
+
+
+def test_edge_failures_propagates_the_miss_and_global_rejects_a_cache():
+    g = fabric()
+    cache = prepopulate(g, [[4]])
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    for workers in (1, 2, 4):
+        before = stats(cache)
+        with pytest.raises(ngc.ShortestPathCacheMiss, match=r"roots \{4\}"):
+            ngc.evaluate_edge_failures(g, 1, 4, opts, workers)
+        assert stats(cache) == (before[0], before[1] + 1, 1), workers  # the miss, once
+    # Only ShortestPaths reads a ShortestPathCache: CentralizedTE given one is a configuration error at every worker
+    # count, and the cache is not read.
+    empty = ngc.ShortestPathCache(g)
+    empty.freeze()
+    for workers in (1, 2, 4):
+        with pytest.raises(
+            ValueError, match=exact("CentralizedTE does not use ShortestPathCache")
+        ):
+            ngc.evaluate_edge_failures(
+                g, [0, 1], [4, 5], ngc.EvaluationOptions(GLOBAL, cache=empty), workers
+            )
+    assert stats(empty) == (0, 0, 0)
+
+
+def test_frozen_lookups_from_python_threads():
+    run_test_in_subprocess(__file__, "_frozen_lookups_from_python_threads")
+
+
+def _frozen_lookups_from_python_threads():
+    g = fabric()
+    cache = prepopulate(g, [[d] for d in range(6)])
+    want = {
+        d: ngc.evaluate_demand(
+            g, 6, d, ngc.EvaluationOptions(SHORTEST_PATHS)
+        ).call_delivered
+        for d in range(6)
+    }
+    # The spine's one edge of 4 into each leaf: the comparisons below are not of zeros.
+    assert want == dict.fromkeys(range(6), 4)
+    errors = []
+
+    def reader(t):
+        try:
+            for i in range(60):
+                d = (i + t) % 6
+                r = ngc.evaluate_demand(
+                    g, 6, d, ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+                )
+                assert r.call_delivered == want[d]
+        except BaseException as exc:  # reported below; pytest's own failures included
+            errors.append(exc)
+
+    before = stats(cache)
+    threads = [threading.Thread(target=reader, args=(t,)) for t in range(4)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    assert errors == []
+    assert stats(cache) == (before[0] + 240, before[1], 6)
+
+
+def plus(stats, hits=0, misses=0):
+    return (stats[0] + hits, stats[1] + misses, *stats[2:])
+
+
+def test_a_failed_call_changes_no_statistic_but_its_miss():
+    # A public call publishes a frozen cache's hits only when it succeeds: a batch whose pair 0
+    # hits and pair 1 misses raises the miss, keeps no hit and counts the miss once, with one
+    # worker and with several; ShortestPaths' evaluate_edge_failures drops its baseline's hit the same way.
+    g = fabric()
+    cache = prepopulate(g, [[3]])
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    for workers in (1, 2, 4):
+        before = stats_of(cache)
+        with pytest.raises(ngc.ShortestPathCacheMiss, match=r"roots \{4\}"):
+            ngc.evaluate_pairs(
+                g, [(0, 3), (1, 4), (2, 5), (0, 3)], opts, workers=workers
+            )
+        assert stats_of(cache) == plus(before, misses=1)
+        before = stats_of(cache)
+        with pytest.raises(ngc.ShortestPathCacheMiss, match=r"roots \{3\}"):
+            ngc.evaluate_edge_failures(
+                g, 0, 3, ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache), workers
+            )
+        assert stats_of(cache) == plus(before, misses=1)
+    before = stats_of(cache)
+    assert ngc.evaluate_pairs(g, [(0, 3), (1, 3)], opts, workers=2)
+    assert stats_of(cache) == plus(before, hits=2)
+
+
+def test_concurrent_calls_keep_every_successful_hit():
+    run_test_in_subprocess(__file__, "_concurrent_calls_keep_every_successful_hit")
+
+
+def _concurrent_calls_keep_every_successful_hit():
+    # Python threads (the evaluators release the GIL) on one frozen cache, each alternating a
+    # successful capacity (one hit) and a failing batch (its hit dropped, one miss).
+    g = fabric()
+    cache = prepopulate(g, [[3], [4]])
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    errors = []
+
+    def caller():
+        try:
+            for _ in range(40):
+                assert ngc.evaluate_demand(g, 0, 3, opts).call_delivered > 0
+                with pytest.raises(ngc.ShortestPathCacheMiss):
+                    ngc.evaluate_pairs(g, [(1, 4), (2, 5)], opts, workers=2)
+        except BaseException as exc:  # reported below; pytest's own failures included
+            errors.append(exc)
+
+    before = stats_of(cache)
+    threads = [threading.Thread(target=caller) for _ in range(4)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    assert errors == []
+    assert stats_of(cache) == plus(before, hits=160, misses=160)
+
+
+def sweep_frozen(cache, fn, args, hits=0, miss=False):
+    """fn(*args) with each Python object allocation failing in turn: a failed call leaves all
+    five statistics as they were, the result object's allocation included; the call that
+    completes adds exactly `hits` hits, or, when its outcome is the ShortestPathCacheMiss, one
+    miss. One case keeps the miss: when the call has ended in
+    the miss and pybind11's translation of ShortestPathCacheMiss into its Python exception fails
+    (MemoryError instead), the miss is counted (pybind11's own machinery is outside the
+    all-or-nothing guarantee); every such failure comes after every allocation of the call
+    itself. Returns the number of failures inside the call (the translation's excluded)."""
+    inside = 0
+    translated = (
+        None  # the first allocation index past the call (translation of the miss)
+    )
+    for k in range(1000):
+        before = stats_of(cache)
+        hit, _, _, error = ext._fail_python_allocation(fn, args, k)
+        after = stats_of(cache)
+        if not hit:
+            if miss:
+                assert isinstance(error, ngc.ShortestPathCacheMiss), repr(error)
+                assert after == plus(before, misses=1), (k, before, after)
+            else:
+                assert error is None, repr(error)
+                assert after == plus(before, hits=hits), (k, before, after)
+            return inside
+        assert type(error) is MemoryError, (k, repr(error))
+        if miss and after == plus(before, misses=1):
+            translated = k if translated is None else translated
+            continue
+        assert translated is None, (
+            k,
+            translated,
+            "a failure inside the call after its translation",
+        )
+        assert after == before, (k, before, after)
+        inside += 1
+    pytest.fail(f"{fn.__name__} never completed")
+
+
+@needs_hooks
+def test_frozen_statistics_survive_python_allocation_failures():
+    g = fabric()
+    cache = prepopulate(g, [[3], [4], [3, 4]])
+    opts = ngc.EvaluationOptions(
+        SHORTEST_PATHS,
+        cache=cache,
+        outputs=ALL_OUT,
+    )
+    pairs = [(0, 3), (1, 4), ([0, 1], [3, 4])]
+    # Each result shell exists before the lease, including calls that end in a
+    # miss. Failing a shell leaves statistics unchanged; failing translation
+    # after the native miss keeps exactly that one miss. List shell allocation
+    # may reuse CPython's free list; each result instance is still a new object.
+    assert sweep_frozen(cache, ngc.evaluate_demand, (g, 0, 3, opts), hits=1) >= 1
+    assert sweep_frozen(cache, ngc.evaluate_demand, (g, 0, 5, opts), miss=True) >= 1
+    for workers in (1, 2):
+        assert (
+            sweep_frozen(
+                cache, ngc.evaluate_pairs, (g, pairs, opts, None, workers), hits=3
+            )
+            >= 3
+        )
+        assert (
+            sweep_frozen(
+                cache,
+                ngc.evaluate_pairs,
+                (g, [(0, 3), (1, 5)], opts, None, workers),
+                miss=True,
+            )
+            >= 2
+        )
+    sens = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache)
+    assert (
+        sweep_frozen(cache, ngc.evaluate_edge_failures, (g, 0, 3, sens, 1), miss=True)
+        >= 1
+    )
+    # ShortestPaths' evaluate_edge_failures from a source that reaches no destination: one hit (the baseline's)
+    # and no placed deletion.
+    island = build(3, [(0, 1, 4, 1), (1, 0, 4, 1)])
+    small = ngc.ShortestPathCache(island)
+    ngc.evaluate_demand(
+        island, 0, 1, ngc.EvaluationOptions(SHORTEST_PATHS, cache=small)
+    )
+    small.freeze()
+    for workers in (1, 2):
+        assert (
+            sweep_frozen(
+                small,
+                ngc.evaluate_edge_failures,
+                (
+                    island,
+                    2,
+                    1,
+                    ngc.EvaluationOptions(SHORTEST_PATHS, cache=small),
+                    workers,
+                ),
+                hits=1,
+            )
+            >= 1
+        )
+
+
+@needs_hooks
+def test_the_frozen_sweep_rejects_a_wrong_call():
+    # sweep_frozen rejects a wrong call, each on the clause it breaks: one that absorbs the
+    # injected failure and a failed translation of the miss reported as RuntimeError (both on the
+    # exact class); one that publishes a hit before the call the failure reaches; a hit where a
+    # miss is expected; a miss counted by another cache; a completing call that raises; a hit
+    # count other than expected; a failure inside a call after a translation; and a call that
+    # never completes.
+    g = fabric()
+    cache = prepopulate(g, [[3]])
+    other = prepopulate(g, [[3]])
+    opts = ngc.EvaluationOptions(SHORTEST_PATHS, cache=cache, outputs=ALL_OUT)
+    elsewhere = ngc.EvaluationOptions(SHORTEST_PATHS, cache=other, outputs=ALL_OUT)
+    hit = (g, 0, 3, opts)
+    miss = (g, 0, 5, opts)
+
+    def absorbs(*args):
+        try:
+            return ngc.evaluate_demand(*args)
+        except MemoryError:
+            return None
+
+    def hits_first(*args):
+        ngc.evaluate_demand(*args)
+        return ngc.evaluate_demand(*args)
+
+    def runtime_error(*args):
+        try:
+            return ngc.evaluate_demand(*args)
+        except MemoryError:
+            raise RuntimeError("in place of MemoryError") from None
+
+    # The miss call until its allocations are used up (its translation fails last), then a
+    # longer call of hits that fails inside.
+    turn = ext._fail_python_allocation(ngc.evaluate_demand, miss, 10**6)[1]
+    longer = (g, [(0, 3), (1, 3), (2, 3), (4, 3)] * 2, opts, None, 1)
+    assert ext._fail_python_allocation(ngc.evaluate_pairs, longer, 10**6)[1] > turn + 1
+    attempts = itertools.count()
+
+    def inside_after_translation(*args):
+        if next(attempts) < turn:
+            return ngc.evaluate_demand(*args)
+        return ngc.evaluate_pairs(*longer)
+
+    for fn, args, expect, clause in (
+        (
+            absorbs,
+            hit,
+            {"hits": 2},
+            "assert type(error) is MemoryError, (k, repr(error))",
+        ),
+        (hits_first, hit, {"hits": 2}, "assert after == before, (k, before, after)"),
+        (
+            ngc.evaluate_demand,
+            hit,
+            {"miss": True},
+            "assert isinstance(error, ngc.ShortestPathCacheMiss), repr(error)",
+        ),
+        (
+            ngc.evaluate_demand,
+            (g, 0, 5, elsewhere),
+            {"miss": True},
+            "assert after == plus(before, misses=1), (k, before, after)",
+        ),
+        (
+            ngc.evaluate_demand,
+            (g, 0, 99, opts),
+            {},
+            "assert error is None, repr(error)",
+        ),
+        (
+            ngc.evaluate_demand,
+            hit,
+            {"hits": 2},
+            "assert after == plus(before, hits=hits), (k, before, after)",
+        ),
+        (
+            runtime_error,
+            miss,
+            {"miss": True},
+            "assert type(error) is MemoryError, (k, repr(error))",
+        ),
+        (
+            inside_after_translation,
+            miss,
+            {"miss": True},
+            "assert translated is None, (",
+        ),
+    ):
+        with pytest.raises(AssertionError) as info:
+            sweep_frozen(cache, fn, args, **expect)
+        assert traceback.extract_tb(info.tb)[-1].line == clause, clause
+
+    # Made outside the sweep, as every bound object.
+    uncached = ngc.EvaluationOptions(SHORTEST_PATHS)
+
+    def endless(*args):
+        while True:
+            ngc.evaluate_demand(g, 0, 3, uncached)
+
+    with pytest.raises(pytest.fail.Exception) as info:
+        sweep_frozen(cache, endless, hit)
+    assert str(info.value) == "endless never completed"
diff --git a/tests/py/test_source_allocation.py b/tests/py/test_source_allocation.py
new file mode 100644
index 0000000..72042a7
--- /dev/null
+++ b/tests/py/test_source_allocation.py
@@ -0,0 +1,912 @@
+"""The source allocation and the result of one demand (docs/semantics.md, sections 7 and 10): the
+configuration's defaults and table with its error texts and their order, the pooled single-path
+rule, the controllers (CentralizedTE and ShortestPaths OPTIMIZED) under both source allocations, min_cut as its own
+output, zero calls before and after preparation, the result's accounting and per-source rows,
+the terminations and the evaluators. The values are derived by hand; the random tests compare the controllers with the
+independent equal-source-allocation and optimized references of ``source_allocation_oracle.py``."""
+
+from __future__ import annotations
+
+import random
+
+import pytest
+from helpers import HIGHER_CAP, assert_read_only, build, dag_of, exact, shortest
+from source_allocation_oracle import (
+    INF,
+    PooledReference,
+    distances_to,
+    equal_source_allocation,
+    optimized_source_allocation,
+    rr,
+)
+
+import netgraph_core as ngc
+
+T = ngc.Termination
+P = ngc.RouteAllocation
+A = ngc.Admission
+ORIGIN = ngc.SourceAllocation
+ALL = ngc.OutputOptions(
+    edge_flows=True, residual=True, saturated_boundary_edges=True, min_cut=True
+)
+CUT = ngc.OutputOptions(min_cut=True)
+
+POOL = [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 1, 1), (2, 3, 1, 1)]  # {0, 1} -> 3
+B1 = [(0, 3, 2, 1), (1, 2, 10, 1), (2, 3, 10, 2)]  # {0, 1} -> 3
+B2 = [(0, 1, 4, 1), (0, 2, 2, 1), (1, 2, 10, 1)]  # {0, 1} -> 2
+B2S = [(0, 2, 2, 1), (1, 2, 10, 1)]  # {0, 1} -> 2
+B3Z = [(0, 2, 0, 1), (1, 2, 10, 1)]  # {0, 1} -> 2
+B3P = [(0, 2, 10, 1), (1, 2, 0, 1)]  # {0, 1} -> 2
+ES = [(0, 1, 10, 1), (0, 2, 10, 1), (1, 3, 2, 1), (2, 3, 10, 2)]  # 0 -> 3
+R4 = [(0, 2, 2, 9), (1, 2, 10, 1)]  # {0, 1} -> 2
+ONE = [(0, 1, 10, 1)]
+PAR = [(0, 1, 5, 1), (0, 1, 8, 1)]
+ZERO = [(0, 1, 0, 1)]
+SPF = [(0, 1, 0, 1), (0, 2, 5, 1), (2, 1, 5, 1)]  # 0 -> 1
+ROWS = [(0, 3, 5, 1), (1, 2, 5, 1), (4, 3, 5, 1)]  # {0, 1, 4} -> 3, node 4 masked
+WIT = [(0, 1, 1, 1), (0, 2, 1, 1), (1, 0, 1, 1)]  # 0 -> 2
+PRIV = [(0, 2, 4, 1), (1, 2, 6, 1)]  # {0, 1} -> 2
+
+POOLED_PHP = "ShortestPaths with multiple input sources requires tie_break=FEWER_HOPS when multipath=False"
+PREFER_PATH = ngc.ShortestPaths(tie_break=HIGHER_CAP, multipath=False)
+
+
+def pinned_route(g, src, dst, edges, allocation=None, admission=None):
+    """Pinned over a program of one split route (the edges' DAG) from src to dst."""
+    program = ngc.ForwardingProgram.from_routes(
+        g, src, dst, [ngc.RouteDefinition(src, dag_of(g, edges))], allocation=allocation
+    )
+    return ngc.FlowPolicyConfig(
+        routing=ngc.Pinned(program), admission=admission or ngc.Admission.LOSSLESS
+    )
+
+
+def graph(edges):
+    return build(1 + max(max(u, v) for u, v, *_ in edges), edges)
+
+
+def glob(source_allocation=ORIGIN.OPTIMIZED, admission=A.LOSSLESS, **fields):
+    return ngc.FlowPolicyConfig(
+        routing=ngc.CentralizedTE(source_allocation=source_allocation, **fields),
+        admission=admission,
+    )
+
+
+def shortest_paths(
+    allocation=P.EQUAL, admission=A.LOSSLESS, routing=None, source_allocation=None
+):
+    return ngc.FlowPolicyConfig(
+        routing=shortest(
+            routing, allocation=allocation, source_allocation=source_allocation
+        ),
+        admission=admission,
+    )
+
+
+def rows(r):
+    return [
+        (
+            x.source,
+            x.offered,
+            x.admitted,
+            x.delivered,
+            x.source_drops,
+            x.total_edge_drops,
+        )
+        for x in r.by_source
+    ]
+
+
+def fresh(edges, sources, dests, config, eligibility=None, residual=None):
+    g = graph(edges)
+    ledger = ngc.FlowLedger(g, residual)
+    e = eligibility(g) if eligibility is not None else None
+    return g, ledger, ngc.FlowPolicy(ledger, sources, dests, config, e)
+
+
+# -- configuration ------------------------------------------------------------------------
+
+
+def test_defaults_resolve():
+    # ShortestPaths' source allocation is None on the value and resolves at the policy;
+    # CentralizedTE states its own; Pinned has none (its program has the injection).
+    c = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths())
+    assert (c.routing.source_allocation, c.admission) == (None, A.LOSSLESS)
+    g = graph(B1)
+    p = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, c)
+    assert p.config.routing.source_allocation == ORIGIN.EQUAL
+    assert p.config.routing.tie_break == ngc.RouteTieBreak.FEWER_HOPS
+    for cfg in (shortest_paths(P.OPTIMIZED), glob()):
+        assert (
+            ngc.FlowPolicy(
+                ngc.FlowLedger(g), [0, 1], 3, cfg
+            ).config.routing.source_allocation
+            == ORIGIN.OPTIMIZED
+        )
+    for cfg in (
+        shortest_paths(P.OPTIMIZED, source_allocation=ORIGIN.EQUAL),
+        glob(ORIGIN.EQUAL),
+    ):
+        assert (
+            ngc.FlowPolicy(
+                ngc.FlowLedger(g), [0, 1], 3, cfg
+            ).config.routing.source_allocation
+            == ORIGIN.EQUAL
+        )
+    pinned = pinned_route(g, 0, 3, [0])
+    routing = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned).config.routing
+    assert not hasattr(routing, "source_allocation")
+
+
+def test_conversion_errors():
+    # Conversion first: positional arguments, an unknown keyword, a string source allocation.
+    with pytest.raises(TypeError):
+        ngc.FlowPolicyConfig(ngc.ShortestPaths(), A.LOSSLESS)
+    with pytest.raises(TypeError):
+        ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), bundles=None)
+    with pytest.raises(TypeError):
+        ngc.CentralizedTE(source_allocation="EQUAL")
+    with pytest.raises(TypeError):
+        ngc.ShortestPaths(source_allocation="EQUAL")
+
+
+SOURCE_RULE = "ShortestPaths with EQUAL or WEIGHTED requires source_allocation=EQUAL"
+CTE_LOSSY = "CentralizedTE without tunnel_count requires admission=LOSSLESS"
+
+
+@pytest.mark.parametrize(
+    ("config", "message"),
+    [
+        (shortest_paths(P.EQUAL, source_allocation=ORIGIN.OPTIMIZED), SOURCE_RULE),
+        (shortest_paths(P.WEIGHTED, source_allocation=ORIGIN.OPTIMIZED), SOURCE_RULE),
+        (
+            shortest_paths(P.OPTIMIZED, A.LOSSY),
+            "ShortestPaths OPTIMIZED requires admission=LOSSLESS",
+        ),
+        (glob(admission=A.LOSSY), CTE_LOSSY),
+        (glob(ORIGIN.EQUAL, A.LOSSY), CTE_LOSSY),
+        # The source rule before the pooled single-path rule.
+        (
+            shortest_paths(
+                P.EQUAL, routing=PREFER_PATH, source_allocation=ORIGIN.OPTIMIZED
+            ),
+            SOURCE_RULE,
+        ),
+    ],
+)
+def test_matrix_texts(config, message):
+    g = graph(B1)
+    with pytest.raises(ValueError, match=exact(message)):
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config)
+    with pytest.raises(ValueError, match=exact(message)):
+        ngc.evaluate_demand(g, [0, 1], 3, ngc.EvaluationOptions(config))
+
+
+def test_pinned_rows():
+    # Pinned has no allocation and no source allocation (its program has the injection), and
+    # FlowPolicyConfig has neither field.
+    g = graph(B1)
+    program = pinned_route(g, 0, 3, [0]).routing.program
+    for kw in (
+        {"source_allocation": ORIGIN.EQUAL},
+        {"origin": ORIGIN.EQUAL},
+        {"allocation": P.OPTIMIZED},
+        {"placement": P.OPTIMIZED},
+    ):
+        with pytest.raises(TypeError):
+            ngc.Pinned(program, **kw)
+        with pytest.raises(TypeError):
+            ngc.FlowPolicyConfig(routing=ngc.Pinned(program), **kw)
+
+
+def test_cache_rule():
+    # Only ShortestPaths reads a ShortestPathCache; the table comes first.
+    g = graph(B1)
+    cache = ngc.ShortestPathCache(g)
+    pinned = pinned_route(g, 0, 3, [0])
+    capacity_aware = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1)))
+    for config, sources, message in (
+        (glob(), [0, 1], "CentralizedTE does not use ShortestPathCache"),
+        (capacity_aware, [0, 1], "DistributedTE does not use ShortestPathCache"),
+        (pinned, 0, "Pinned does not use ShortestPathCache"),
+        (glob(admission=A.LOSSY), [0, 1], CTE_LOSSY),
+    ):
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.FlowPolicy(ngc.FlowLedger(g), sources, 3, config, None, cache)
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.evaluate_demand(
+                g, sources, 3, ngc.EvaluationOptions(config, cache=cache)
+            )
+        with pytest.raises(ValueError, match=exact(message)):
+            ngc.evaluate_edge_failures(
+                g, sources, 3, ngc.EvaluationOptions(config, cache=cache)
+            )
+    assert cache.stats().misses == 0 and cache.stats().hits == 0
+
+
+def test_endpoints_before_ownership():
+    g = graph(B1)
+    foreign = graph(B1).eligibility(excluded_nodes=[0])
+    with pytest.raises(ValueError, match="sources") as e:
+        ngc.FlowPolicy(ngc.FlowLedger(g), [], 3, glob(), foreign)
+    assert "foreign" not in str(e.value)
+
+
+def test_amount_texts():
+    _, _, p = fresh(ONE, 0, 1, shortest_paths())
+    # One text, with the class of its cause: a bool is a wrong type, the rest wrong values.
+    for bad, cls in [(v, ValueError) for v in (-1, 2**62, float("nan"), 1.5, -INF)] + [
+        (True, TypeError)
+    ]:
+        with pytest.raises(
+            (TypeError, ValueError),
+            match=exact("offer must be an integer in [0, 2^62) or permitted +inf"),
+        ) as error:
+            p.place(bad)
+        assert error.type is cls
+    p.place(INF)
+    for finite in (1, 0):
+        with pytest.raises(
+            ValueError,
+            match=exact(
+                "finite placement after infinite placement requires a new epoch"
+            ),
+        ):
+            p.place(finite)
+    p.remove()
+    assert p.place(1).call_delivered == 1
+
+
+# -- the pooled single-path rule -------------------------------------------------------------
+
+
+def test_pooled_single_path_rule():
+    g = graph(POOL)
+    for placement in (P.EQUAL, P.WEIGHTED, P.OPTIMIZED):
+        config = shortest_paths(placement, routing=PREFER_PATH)
+        # Two input sources, also when the mask leaves one.
+        for eligibility in (None, g.eligibility(excluded_nodes=[1])):
+            with pytest.raises(ValueError, match=exact(POOLED_PHP)):
+                ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config, eligibility)
+            with pytest.raises(ValueError, match=exact(POOLED_PHP)):
+                ngc.evaluate_demand(
+                    g, [0, 1], 3, ngc.EvaluationOptions(config, eligibility=eligibility)
+                )
+        # One source; multipath.
+        assert (
+            ngc.FlowPolicy(ngc.FlowLedger(g), [0, 0], 3, config).place(1).call_delivered
+            == 1
+        )
+        # Multipath with a HIGHER_* tie_break (one member of each parallel pair: the equal
+        # pair 2 -> 3 keeps its lower EdgeId, capacity 1) is accepted with two sources.
+        multipath = shortest_paths(
+            placement,
+            routing=ngc.ShortestPaths(tie_break=HIGHER_CAP, parallel_edges=False),
+        )
+        assert (
+            ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, multipath)
+            .place(2)
+            .call_delivered
+            == 1
+        )
+    # evaluate_pairs checks each pair; pair 1 is the lowest failing.
+    opts = ngc.EvaluationOptions(shortest_paths(routing=PREFER_PATH))
+    with pytest.raises(ValueError, match=exact(POOLED_PHP)):
+        ngc.evaluate_pairs(g, [([0], 3), ([0, 1], 3)], opts)
+    assert [
+        r.call_delivered for r in ngc.evaluate_pairs(g, [([0], 3), ([1], 3)], opts)
+    ] == [
+        1,
+        1,
+    ]
+
+
+def test_deterministic_single_paths_pool():
+    # Canonical paths 0: [e0, e2], 1: [e1, e2] (equal cost and hops, lower EdgeId e2).
+    det = ngc.ShortestPaths(multipath=False)
+    _, _, p = fresh(POOL, [0, 1], 3, shortest_paths(routing=det))
+    r = p.place(INF)
+    assert (r.call_delivered, [x.admitted for x in r.by_source]) == (1, [1, 0])
+    # Lossy 2: e2's arrivals (1, 1), carried H(1, [1, 1]) = [1, 0].
+    _, _, p = fresh(POOL, [0, 1], 3, shortest_paths(admission=A.LOSSY, routing=det))
+    r = p.place(2)
+    assert (r.call_delivered, r.call_edge_drops) == (1, [(2, 1)])
+    assert rows(r) == [(0, 1, 1, 1, 0, 0), (1, 1, 1, 0, 0, 1)]
+    assert [list(rec.route.via_edges()) for rec in p.records()] == [[0, 2], [1, 2]]
+
+
+# -- the controllers --------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("edges", "sources", "dest", "source_allocation", "delivered", "cost", "flows"),
+    [
+        (B1, [0, 1], 3, ORIGIN.EQUAL, 4, 8, [2, 2, 2]),  # B1, equal
+        (B1, [0, 1], 3, ORIGIN.OPTIMIZED, 12, 32, [2, 10, 10]),  # B1, optimized
+        (B2, [0, 1], 2, ORIGIN.EQUAL, 12, 16, [4, 2, 10]),  # B2, equal
+        (B2, [0, 1], 2, ORIGIN.OPTIMIZED, 12, 12, [0, 2, 10]),  # B2, optimized
+        (
+            B2S,
+            [0, 1],
+            2,
+            ORIGIN.EQUAL,
+            4,
+            4,
+            [2, 2],
+        ),  # B2 on its shortest routes, equal
+        (
+            B2S,
+            [0, 1],
+            2,
+            ORIGIN.OPTIMIZED,
+            12,
+            12,
+            [2, 10],
+        ),  # B2 on its shortest routes, optimized
+        (B3Z, [0, 1], 2, ORIGIN.EQUAL, 0, 0, [0, 0]),  # a zero-capacity first source
+        (B3P, [0, 1], 2, ORIGIN.EQUAL, 1, 1, [1, 0]),  # a positive first source
+        (
+            B3Z,
+            [0, 1],
+            2,
+            ORIGIN.OPTIMIZED,
+            10,
+            10,
+            [0, 10],
+        ),  # a zero-capacity first source, optimized
+        (ES, 0, 3, ORIGIN.OPTIMIZED, 12, 34, [2, 10, 2, 10]),  # a support
+    ],
+)
+def test_global_examples(
+    edges, sources, dest, source_allocation, delivered, cost, flows
+):
+    request = 10 if edges in (B3Z, B3P) else 12
+    _, _, p = fresh(edges, sources, dest, glob(source_allocation))
+    r = p.place(request, ngc.OutputOptions(edge_flows=True))
+    term = T.COMPLETE if delivered == request else T.EXHAUSTED
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (
+        delivered,
+        request - delivered,
+        term,
+    )
+    assert (r.total_cost, r.edge_flows.tolist()) == (cost, flows)
+    if source_allocation == ORIGIN.EQUAL:
+        assert r.marginal_cost_curve is None
+        assert [x.admitted for x in r.by_source] == rr(delivered, len(r.by_source))
+    else:
+        assert sum(u for _, u in r.marginal_cost_curve) == delivered
+
+
+def test_global_records_and_masks():
+    # The rows; the records: source 0's 6 is 2 direct and 4 through node 1.
+    _, _, p = fresh(B1, [0, 1], 3, glob(ORIGIN.EQUAL))
+    assert rows(p.place(12)) == [(0, None, 2, 2, 0, 0), (1, None, 2, 2, 0, 0)]
+    _, _, p = fresh(B2, [0, 1], 2, glob(ORIGIN.EQUAL))
+    p.place(12)
+    assert [(rec.edge_flows, rec.delivered) for rec in p.records()] == [
+        ([(0, 4), (1, 2), (2, 4)], 6),
+        ([(2, 6)], 6),
+    ]
+    # The masked zero-capacity source leaves the roster.
+    _, _, p = fresh(
+        B3Z, [0, 1], 2, glob(ORIGIN.EQUAL), lambda g: g.eligibility(excluded_nodes=[0])
+    )
+    assert p.place(10).call_delivered == 10
+    # The optimum on the residual.
+    _, _, p = fresh(WIT, 0, 2, glob())
+    r = p.place(1, ngc.OutputOptions(edge_flows=True))
+    assert (r.edge_flows.tolist(), r.total_cost) == ([0, 1, 0], 1)
+
+
+def test_global_increments():
+    # Lossless with the equal source allocation: 3 (RR(3) = (2, 1) fits), then the target 6 admits 4 (RR(5) puts
+    # 3 on e0 of 2): allocation (2, 2), cost 2 * 9 + 2 * 1.
+    _, _, p = fresh(R4, [0, 1], 2, glob(ORIGIN.EQUAL))
+    a = p.place(3)
+    b = p.place(3, ngc.OutputOptions(edge_flows=True))
+    assert (a.call_delivered, a.termination, b.call_delivered, b.termination) == (
+        3,
+        T.COMPLETE,
+        1,
+        T.EXHAUSTED,
+    )
+    assert (b.edge_flows.tolist(), b.total_cost, b.requested, b.unadmitted) == (
+        [2, 2],
+        20,
+        6,
+        2,
+    )
+    # Refused units are not offered again.
+    g = graph(ONE)
+    ledger = ngc.FlowLedger(g)
+    other = ngc.FlowPolicy(ledger, 0, 1, shortest_paths())
+    other.place(8)
+    p = ngc.FlowPolicy(ledger, 0, 1, glob())
+    assert p.place(5).call_delivered == 2
+    other.remove()
+    other.place(5)
+    assert p.place(1).call_delivered == 1
+    # Equal increments end where one call does (the final total solved from zero).
+    _, _, one = fresh(B2, [0, 1], 2, glob(ORIGIN.EQUAL))
+    whole = one.place(12, ngc.OutputOptions(edge_flows=True))
+    _, _, two = fresh(B2, [0, 1], 2, glob(ORIGIN.EQUAL))
+    two.place(6)
+    split = two.place(6, ngc.OutputOptions(edge_flows=True))
+    assert split.edge_flows.tolist() == whole.edge_flows.tolist()
+    assert split.total_cost == whole.total_cost
+    assert [(r.edge_flows, r.delivered) for r in two.records()] == [
+        (r.edge_flows, r.delivered) for r in one.records()
+    ]
+
+
+@pytest.mark.parametrize(
+    ("edges", "sources", "dest", "source_allocation", "delivered", "cost", "records"),
+    [
+        # One controller on the union of the sources' routes.
+        (B1, [0, 1], 3, ORIGIN.OPTIMIZED, 12, 32, [[(0, 2)], [(1, 10), (2, 10)]]),
+        (B1, [0, 1], 3, ORIGIN.EQUAL, 4, 8, [[(0, 2)], [(1, 2), (2, 2)]]),
+        # The support leaves out e0 (0 -> 1 -> 2 costs 2).
+        (B2, [0, 1], 2, ORIGIN.EQUAL, 4, 4, [[(1, 2)], [(2, 2)]]),
+        (B2, [0, 1], 2, ORIGIN.OPTIMIZED, 12, 12, [[(1, 2)], [(2, 10)]]),
+        # A support on the shortest routes; a support that is the zero edge alone, never bypassed.
+        (ES, 0, 3, ORIGIN.OPTIMIZED, 2, 4, [[(0, 2), (2, 2)]]),
+        (SPF, 0, 1, ORIGIN.OPTIMIZED, 0, 0, [[]]),
+    ],
+)
+def test_shortest_paths_max_flow(
+    edges, sources, dest, source_allocation, delivered, cost, records
+):
+    request = 5 if edges is SPF else 12
+    _, _, p = fresh(
+        edges,
+        sources,
+        dest,
+        shortest_paths(P.OPTIMIZED, source_allocation=source_allocation),
+    )
+    r = p.place(request, CUT)
+    term = T.COMPLETE if delivered == request else T.EXHAUSTED
+    assert (r.call_delivered, r.termination, r.total_cost) == (delivered, term, cost)
+    assert [rec.edge_flows for rec in p.records()] == records
+    # No curve and no cut.
+    assert (r.marginal_cost_curve, r.min_cut) == (None, None)
+
+
+def test_shortest_paths_max_flow_increments():
+    _, _, p = fresh(
+        R4, [0, 1], 2, shortest_paths(P.OPTIMIZED, source_allocation=ORIGIN.EQUAL)
+    )
+    assert [p.place(3).call_delivered, p.place(3).call_delivered] == [3, 1]
+    assert p.place(0).total_cost == 20
+
+
+def test_min_cut_flag():
+    # The minimum cut of B1 and of a zero-capacity edge.
+    for edges, dest in ((B1, 3), (B3Z, 2)):
+        _, _, p = fresh(edges, [0, 1], dest, glob())
+        assert p.place(INF, CUT).min_cut == [0, 1]
+    # A zero maximum over existing routes is EXHAUSTED; its cut is the zero edge.
+    _, _, p = fresh(ZERO, 0, 1, glob())
+    r = p.place(5, CUT)
+    assert (r.call_delivered, r.termination, r.min_cut) == (0, T.EXHAUSTED, [0])
+    # Bottleneck alone, the equal source allocation, a request below the maximum, a zero call.
+    _, _, p = fresh(B1, [0, 1], 3, glob())
+    assert (
+        p.place(INF, ngc.OutputOptions(saturated_boundary_edges=True)).min_cut is None
+    )
+    _, _, p = fresh(B1, [0, 1], 3, glob(ORIGIN.EQUAL))
+    assert p.place(INF, CUT).min_cut is None
+    _, _, p = fresh(B1, [0, 1], 3, glob())
+    assert p.place(5, CUT).min_cut is None
+    assert p.place(0, CUT).min_cut is None
+    # An empty roster.
+    _, _, p = fresh([(1, 0, 5, 1)], 0, 1, glob())
+    r = p.place(5, CUT)
+    assert (r.termination, r.min_cut, r.marginal_cost_curve, r.total_cost) == (
+        T.NO_ROUTE,
+        [],
+        [],
+        0,
+    )
+
+
+P40, P39, P41 = 2**40, 2**39, 2**41
+LO32, HI32 = 2**32 - 1, 2**32 + 1
+
+
+@pytest.mark.parametrize(
+    ("edges", "sources", "dest", "optimized", "equal"),
+    [
+        # One link of capacity = cost = 2^40.
+        ([(0, 1, P40, P40)], 0, 1, 2**80, 2**80),
+        # Optimized fills both links: 2^80 + 2^80; equal stops at T = 2^40 + 1 (shares
+        # 2^39 + 1 and 2^39): (2^39 + 1) * 2^40 + 2^39 * 2^41.
+        (
+            [(0, 2, P40, P40), (1, 2, P39, P41)],
+            [0, 1],
+            2,
+            2**81,
+            3 * 2**79 + 2**40,
+        ),
+        # Two products of 2^64 - 1: the sum carries into the high half.
+        ([(0, 1, LO32, HI32), (1, 2, LO32, HI32)], 0, 2, 2**65 - 2, 2**65 - 2),
+    ],
+    ids=["product", "two-sources", "carry"],
+)
+def test_total_cost_beyond_64_bits(edges, sources, dest, optimized, equal):
+    # The controllers' total_cost is exact beyond 64 bits, under both source allocations, through place,
+    # capacity and evaluate_pairs with workers.
+    g = graph(edges)
+    for source_allocation, want in (
+        (ORIGIN.OPTIMIZED, optimized),
+        (ORIGIN.EQUAL, equal),
+    ):
+        assert want >= 2**64
+        for config in (
+            glob(source_allocation),
+            shortest_paths(P.OPTIMIZED, source_allocation=source_allocation),
+        ):
+            p = ngc.FlowPolicy(ngc.FlowLedger(g), sources, dest, config)
+            assert p.place(INF).total_cost == want
+            assert (
+                ngc.evaluate_demand(
+                    g, sources, dest, ngc.EvaluationOptions(config)
+                ).total_cost
+                == want
+            )
+            batch = ngc.evaluate_pairs(
+                g, [(sources, dest)] * 2, ngc.EvaluationOptions(config), workers=2
+            )
+            assert [r.total_cost for r in batch] == [want, want]
+
+
+# -- zero calls, the result, terminations ----------------------------------------------------
+
+
+@pytest.mark.parametrize("routing", ["shortest_paths", "global"])
+def test_zero_unprepared(routing):
+    # A zero call before the preparation; after a positive call and after remove().
+    config = shortest_paths() if routing == "shortest_paths" else glob()
+    g, ledger, p = fresh(PAR, 0, 1, config, residual=[4, 6])
+
+    def unprepared(r):
+        assert (
+            r.call_delivered,
+            r.call_undelivered,
+            r.delivery_delta,
+            r.termination,
+        ) == (
+            0,
+            0,
+            0,
+            T.COMPLETE,
+        )
+        assert (
+            r.call_edge_drops,
+            r.call_source_drops,
+            r.routes_changed,
+            r.weights_changed,
+        ) == (
+            [],
+            0,
+            False,
+            False,
+        )
+        assert (r.edge_flows.tolist(), r.residual.tolist()) == ([0, 0], [4, 6])
+        assert (r.min_cut, r.marginal_cost_curve, r.requested) == (None, None, 0)
+        assert rows(r) == [(0, None, 0, 0, 0, 0)]
+        assert r.total_cost == (0 if routing == "global" else None)
+        assert p.records() == []
+
+    unprepared(p.place(0, ALL))
+    p.place(3)
+    r = p.place(0, ALL)
+    assert (r.call_delivered, r.routes_changed, r.delivered, r.requested) == (
+        0,
+        False,
+        3,
+        3,
+    )
+    if routing == "global":
+        assert r.marginal_cost_curve == [(1, 3)] and r.min_cut is None
+    p.remove()
+    unprepared(p.place(0, ALL))
+
+
+def test_result_accounting():
+    # B1, equal source allocation, Lossless.
+    _, _, p = fresh(B1, [0, 1], 3, glob(ORIGIN.EQUAL))
+    r = p.place(12)
+    assert (r.requested, r.offered, r.admitted, r.delivered, r.unadmitted) == (
+        12,
+        None,
+        4,
+        4,
+        8,
+    )
+    assert (
+        r.source_drops,
+        r.edge_drops,
+        r.call_edge_drops,
+        r.call_source_drops,
+        r.delivery_delta,
+    ) == (
+        0,
+        [],
+        [],
+        0,
+        4,
+    )
+    # A row for every input source: 4 is masked, 1 has no route.
+    _, _, p = fresh(
+        ROWS,
+        [0, 1, 4],
+        3,
+        shortest_paths(),
+        lambda g: g.eligibility(excluded_nodes=[4]),
+    )
+    assert rows(p.place(3)) == [
+        (0, None, 3, 3, 0, 0),
+        (1, None, 0, 0, 0, 0),
+        (4, None, 0, 0, 0, 0),
+    ]
+    # total_cost only for the controllers.
+    g = graph(B1)
+    for config in (shortest_paths(), shortest_paths(P.WEIGHTED)):
+        assert (
+            ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, config).place(1).total_cost
+            is None
+        )
+    t1 = ngc.FlowPolicyConfig(routing=ngc.DistributedTE(ngc.TunnelCount(1)))
+    assert (
+        ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1], 3, t1).replace(1).total_cost is None
+    )
+    pinned = pinned_route(g, 0, 3, [0])
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, pinned).place(1).total_cost is None
+    support = glob(support=dag_of(g, [0]))
+    assert ngc.FlowPolicy(ngc.FlowLedger(g), 0, 3, support).place(1).total_cost == 1
+
+
+def test_pinned_in_the_new_shape():
+    # Weighted over the zero edge has no member: its offer is lost at the source.
+    g = graph(ZERO)
+    for allocation, want in (
+        (P.WEIGHTED, (0, T.NO_ACTIVE_WEIGHT, 2, [], (0, 2, 2, 0, 2, 0))),
+        (P.EQUAL, (0, T.COMPLETE, 0, [(0, 2)], (0, 2, 2, 0, 0, 2))),
+    ):
+        config = pinned_route(g, 0, 1, [0], allocation=allocation, admission=A.LOSSY)
+        r = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, config).place(2)
+        assert (
+            r.call_delivered,
+            r.termination,
+            r.call_source_drops,
+            r.call_edge_drops,
+            rows(r)[0],
+        ) == want
+        assert (r.offered, r.source_drops) == (2, want[2])
+
+
+def test_equal_source_increments_beyond_64_bits():
+    # Three equal sources, LOSSY increments: each source's cumulative offer is RR(X) of the
+    # cumulative total X, X // 3 plus one for the first X % 3 sources, also once X passes 2^64;
+    # the same through a ShortestPaths policy and a Pinned policy over its program. The last offer,
+    # 4, after the crossing, is no multiple of 3, so a rule that ignored X's high word would fail.
+    g = ngc.Graph(4, [0, 1, 2], [3, 3, 3], [1, 1, 1], [1, 2, 3], 1.0)
+    lossy = ngc.FlowPolicyConfig(routing=ngc.ShortestPaths(), admission=A.LOSSY)
+    sp = ngc.FlowPolicy(ngc.FlowLedger(g), [0, 1, 2], 3, lossy)
+    program = sp.replace(0).program
+    pinned = ngc.FlowPolicy(
+        ngc.FlowLedger(g),
+        [0, 1, 2],
+        3,
+        ngc.FlowPolicyConfig(routing=ngc.Pinned(program), admission=A.LOSSY),
+    )
+    total = 0
+    for offer in [1, 4] + [2**62 - 1] * 5 + [4]:
+        total += offer
+        expected = [total // 3 + (1 if i < total % 3 else 0) for i in range(3)]
+        for policy in (sp, pinned):
+            r = policy.place(offer)
+            assert r.offered == total
+            assert [row.offered for row in r.by_source] == expected
+            assert r.delivered == sum(min(x, 1) for x in expected)  # 1-unit links
+            assert r.source_drops == 0
+    assert total == 23058430092136939524 > 2**64
+
+
+def test_terminations():
+    # An empty roster (no edge reaches 1 from 0).
+    for config in (glob(), shortest_paths(), shortest_paths(admission=A.LOSSY)):
+        _, _, p = fresh([(1, 0, 5, 1)], 0, 1, config)
+        assert p.place(0).termination == T.COMPLETE
+        r = p.place(5)
+        assert (r.call_delivered, r.termination) == (0, T.NO_ROUTE)
+        if config.admission == A.LOSSY:
+            # Nothing enters: the offer is all source loss and the row stays zero.
+            assert (r.offered, r.source_drops, r.call_source_drops) == (5, 5, 5)
+            assert rows(r) == [(0, 0, 0, 0, 0, 0)]
+        else:
+            assert (r.offered, r.unadmitted) == (None, 5)
+    # Weighted splitting over the zero edge: no positive weight.
+    _, _, p = fresh(ZERO, 0, 1, shortest_paths(P.WEIGHTED, A.LOSSY))
+    r = p.place(2)
+    assert (r.termination, r.call_source_drops, r.offered) == (T.NO_ACTIVE_WEIGHT, 2, 2)
+    _, _, p = fresh(ZERO, 0, 1, shortest_paths(P.WEIGHTED))
+    r = p.place(2)
+    assert (r.termination, r.unadmitted) == (T.NO_ACTIVE_WEIGHT, 2)
+    # A controller at zero over existing routes.
+    for config in (glob(), shortest_paths(P.OPTIMIZED)):
+        _, _, p = fresh(
+            SPF if config.routing.__class__ is ngc.ShortestPaths else ZERO, 0, 1, config
+        )
+        assert p.place(5).termination == T.EXHAUSTED
+
+
+def test_result_objects():
+    _, _, p = fresh(B1, [0, 1], 3, glob(ORIGIN.EQUAL))
+    r = p.place(INF)
+    assert isinstance(r.by_source, tuple) and all(
+        isinstance(x, ngc.SourceFlow) for x in r.by_source
+    )
+    assert (r.requested, r.call_undelivered) == (INF, INF)
+    assert isinstance(r.requested, float)
+    assert_read_only(r.by_source[0], "admitted")
+    with pytest.raises(TypeError):
+        ngc.SourceFlow()
+    assert "SourceFlow(source=0" in repr(r.by_source[0])
+
+
+# -- evaluators ---------------------------------------------------------------------------------
+
+
+def test_evaluators():
+    g = graph(B1)
+    for config, delivered in (
+        (glob(ORIGIN.EQUAL), 4),
+        (glob(), 12),
+        (shortest_paths(P.OPTIMIZED), 12),
+        (shortest_paths(P.OPTIMIZED, source_allocation=ORIGIN.EQUAL), 4),
+        (shortest_paths(), 4),
+    ):
+        assert (
+            ngc.evaluate_demand(
+                g, [0, 1], 3, ngc.EvaluationOptions(config)
+            ).call_delivered
+            == delivered
+        )
+    assert (
+        ngc.evaluate_demand(
+            graph(POOL), [0, 1], 3, ngc.EvaluationOptions(shortest_paths())
+        ).call_delivered
+        == 2
+    )
+    r = ngc.evaluate_demand(
+        graph(PRIV), [0, 1], 2, ngc.EvaluationOptions(shortest_paths(admission=A.LOSSY))
+    )
+    assert (r.delivered, r.offered, r.requested, r.termination) == (
+        10,
+        10,
+        INF,
+        T.EXHAUSTED,
+    )
+    pairs = [([0, 1], 3), (0, 3), (1, 3)]
+    got = ngc.evaluate_pairs(g, pairs, ngc.EvaluationOptions(glob(ORIGIN.EQUAL)))
+    assert [x.call_delivered for x in got] == [4, 2, 10]
+    # Deleting the zero-capacity edge e0 takes source 0 out of the roster: every allowed edge is a
+    # candidate under the equal source allocation.
+    for workers in (1, 2):
+        s = ngc.evaluate_edge_failures(
+            graph(B3Z), [0, 1], 2, ngc.EvaluationOptions(glob(ORIGIN.EQUAL)), workers
+        )
+        assert (
+            s.baseline.call_delivered,
+            [(e.edge, e.delivery_reduction) for e in s.entries],
+        ) == (
+            0,
+            [(0, -10), (1, 0)],
+        )
+    # Pooled ShortestPaths: deleting e0 takes source 0 out of the roster.
+    s = ngc.evaluate_edge_failures(
+        g, [0, 1], 3, ngc.EvaluationOptions(shortest_paths())
+    )
+    assert (
+        s.baseline.call_delivered,
+        [(e.edge, e.delivery_reduction) for e in s.entries],
+    ) == (
+        4,
+        [(0, -6), (1, 2), (2, 2)],
+    )
+
+
+# -- random controllers against the references ------------------------------------------------
+
+
+def random_controller_case(rng):
+    n = rng.randint(3, 6)
+    nodes = list(range(n))
+    rng.shuffle(nodes)
+    k = rng.randint(2, min(3, n - 1)) if rng.random() < 0.8 else 1
+    sources = nodes[:k]
+    dests = nodes[k : k + rng.randint(1, min(2, n - k))]
+    edges = []
+    for _ in range(rng.randint(n, 2 * n + 2)):
+        u = rng.randrange(n)
+        v = rng.choice(dests) if rng.random() < 0.3 else rng.randrange(n)
+        if u != v:
+            edges.append((u, v, rng.randint(0, 4), rng.randint(1, 4)))
+    if not edges:
+        edges.append((sources[0], dests[0], 1, 1))
+    return n, edges, sources, dests
+
+
+@pytest.mark.parametrize("seed", range(300))
+def test_controllers_random(seed):
+    # CentralizedTE and ShortestPaths OPTIMIZED under both source allocations on random graphs with masks and
+    # nonuniform costs: the delivery, the minimum cost and (equal) the supplies RR(T) equal the
+    # references; increments re-solve the admitted total plus the request.
+    rng = random.Random(seed)
+    n, edges, sources, dests = random_controller_case(rng)
+    g = build(n, edges)
+    m = g.num_edges()
+    xn = [
+        v
+        for v in range(n)
+        if v not in sources and v not in dests and rng.random() < 0.15
+    ]
+    xe = [e for e in range(m) if rng.random() < 0.1]
+    eligibility = g.eligibility(excluded_nodes=xn, excluded_edges=xe)
+    src = [int(x) for x in g.edge_sources()]
+    dst = [int(x) for x in g.edge_destinations()]
+    cost = [int(x) for x in g.edge_costs()]
+    cap = [int(x) for x in g.edge_capacity_units()]
+    node_allowed = [v not in xn for v in range(n)]
+    edge_allowed = [
+        e not in xe and node_allowed[src[e]] and node_allowed[dst[e]] for e in range(m)
+    ]
+    dist = distances_to(n, src, dst, cost, set(dests), node_allowed, edge_allowed)
+    roster = sorted(s for s in set(sources) if dist[s] is not None)
+    ref = PooledReference(
+        g, sources, dests, "EB", False, cap, excluded_nodes=xn, excluded_edges=xe
+    )
+    support = [False] * m
+    if ref.roster:
+        ref._prepare()
+        for s in ref.roster:
+            for e in ref.route[s]:
+                support[e] = True
+    for routing, allowed in (("global", edge_allowed), ("shortest_paths", support)):
+        for source_allocation in (ORIGIN.EQUAL, ORIGIN.OPTIMIZED):
+            config = (
+                glob(source_allocation)
+                if routing == "global"
+                else shortest_paths(P.OPTIMIZED, source_allocation=source_allocation)
+            )
+            oracle = (
+                equal_source_allocation
+                if source_allocation == ORIGIN.EQUAL
+                else optimized_source_allocation
+            )
+            best, best_cost = oracle(g, roster, dests, cap, allowed)
+            r = ngc.evaluate_demand(
+                g,
+                sources,
+                dests,
+                ngc.EvaluationOptions(config, eligibility=eligibility),
+            )
+            where = (seed, routing, source_allocation.name)
+            assert (r.call_delivered, r.total_cost) == (best, best_cost), where
+            if source_allocation == ORIGIN.EQUAL:
+                admitted = {x.source: x.admitted for x in r.by_source}
+                assert [admitted[s] for s in roster] == rr(best, len(roster)), where
+            # Increments: a then b admit min(max, a) and then min(max, that + b).
+            a, b = rng.randint(0, 6), rng.randint(0, 6)
+            p = ngc.FlowPolicy(ngc.FlowLedger(g), sources, dests, config, eligibility)
+            first = p.place(a)
+            second = p.place(b)
+            want_a = min(best, a)
+            want_b = min(best, want_a + b)
+            assert (first.call_delivered, second.call_delivered) == (
+                want_a,
+                want_b - want_a,
+            ), where
+            _, cost_b = oracle(g, roster, dests, cap, allowed, want_b)
+            assert second.total_cost == cost_b, where
diff --git a/tests/py/test_spf_basic.py b/tests/py/test_spf_basic.py
deleted file mode 100644
index 1eb38bd..0000000
--- a/tests/py/test_spf_basic.py
+++ /dev/null
@@ -1,184 +0,0 @@
-"""SPF basics.
-
-Core shortest-path semantics: distances, predecessor DAG equivalence, output
-shapes/offsets, and destination early-exit behavior.
-"""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def run_spf(
-    g,
-    src,
-    dst=None,
-    selection=None,
-    *,
-    multipath=True,
-    _conv=None,
-    algs=None,
-    to_handle=None,
-):
-    if selection is None:
-        selection = ngc.EdgeSelection(
-            multi_edge=True,
-            require_capacity=False,
-            tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-        )
-    assert algs is not None and to_handle is not None
-    gh = to_handle(g)
-    dist, dag = algs.spf(gh, src, dst, selection=selection, multipath=multipath)
-    return dist, (_conv or (lambda gg, dd: dd))(g, dag)
-
-
-def test_spf_line1_all_min_cost(
-    line1_graph, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = line1_graph
-    dist, pred = run_spf(g, 0, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle)
-    assert np.allclose(dist, np.array([0.0, 1.0, 2.0]))
-    assert pred == {0: {}, 1: {0: [0]}, 2: {1: [1, 2]}}
-    # Validate raw DAG integrity from a direct call
-    dist2, dag2 = algs.spf(to_handle(g), 0)
-    assert_pred_dag_integrity(g, dag2)
-
-
-def test_spf_square1_all_min_cost(
-    square1_graph, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = square1_graph
-    dist, pred = run_spf(g, 0, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle)
-    expected_costs = np.array([0.0, 1.0, 2.0, 2.0])
-    assert np.allclose(dist, expected_costs)
-    assert pred == {0: {}, 1: {0: [0]}, 3: {0: [2]}, 2: {1: [1]}}
-    dist2, dag2 = algs.spf(to_handle(g), 0)
-    assert_pred_dag_integrity(g, dag2)
-
-
-def test_spf_square2_all_min_cost(
-    square2_graph, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = square2_graph
-    dist, pred = run_spf(g, 0, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle)
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[1], 1.0)
-    assert np.isclose(dist[3], 1.0)
-    assert np.isclose(dist[2], 2.0)
-    assert pred == {0: {}, 1: {0: [0]}, 3: {0: [1]}, 2: {1: [2], 3: [3]}}
-    dist2, dag2 = algs.spf(to_handle(g), 0)
-    assert_pred_dag_integrity(g, dag2)
-
-
-def test_spf_graph3_all_min_cost_and_single(
-    graph3, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = graph3
-    # ALL_MIN_COST, multipath=True
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, pred = run_spf(
-        g, 0, selection=sel, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle
-    )
-    assert np.isclose(dist[0], 0.0)
-    assert np.isclose(dist[1], 1.0)
-    assert np.isclose(dist[4], 1.0)
-    assert np.isclose(dist[2], 2.0)
-    assert np.isclose(dist[5], 3.0)
-    assert np.isclose(dist[3], 4.0)
-    assert pred == {
-        0: {},
-        1: {0: [0, 1, 2]},
-        4: {0: [3]},
-        2: {1: [4, 5, 6], 4: [8]},
-        5: {2: [7]},
-        3: {0: [11], 2: [10], 5: [9]},
-    }
-    # SINGLE_MIN_COST per adjacency with ECMP across parents
-    sel2 = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist2, pred2 = run_spf(
-        g,
-        0,
-        selection=sel2,
-        multipath=True,
-        _conv=dag_to_pred_map,
-        algs=algs,
-        to_handle=to_handle,
-    )
-    assert np.allclose(dist2, dist)
-    assert pred2 == {
-        0: {},
-        1: {0: [0]},
-        4: {0: [3]},
-        2: {1: [4], 4: [8]},
-        5: {2: [7]},
-        3: {0: [11], 2: [10], 5: [9]},
-    }
-    # Validate integrity of returned DAGs
-    dist_all, dag_all = algs.spf(to_handle(g), 0, selection=sel)
-    assert_pred_dag_integrity(g, dag_all)
-    dist_single, dag_single = algs.spf(to_handle(g), 0, selection=sel2)
-    assert_pred_dag_integrity(g, dag_single)
-
-
-def test_spf_capacity_filter_all_min_cost_with_cap_remaining(
-    build_graph, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = build_graph(2, [(0, 1, 1, 0.0, 0), (0, 1, 1, 1.0, 1)])
-    sel = ngc.EdgeSelection(
-        multi_edge=True, require_capacity=True, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-    )
-    dist, pred = run_spf(
-        g, 0, selection=sel, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle
-    )
-    assert np.allclose(dist, np.array([0.0, 1.0]))
-    assert pred == {0: {}, 1: {0: [1]}}
-    dist2, dag2 = algs.spf(to_handle(g), 0, selection=sel)
-    assert_pred_dag_integrity(g, dag2)
-
-
-def test_spf_with_dst_early_exit_equivalence(
-    square2_graph, dag_to_pred_map, assert_pred_dag_integrity, algs, to_handle
-):
-    g = square2_graph
-    dist1, pred1 = run_spf(g, 0, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle)
-    dist2, pred2 = run_spf(
-        g, 0, dst=2, _conv=dag_to_pred_map, algs=algs, to_handle=to_handle
-    )
-    assert np.allclose(dist1, dist2)
-    assert pred1 == pred2
-    d1, dag1 = algs.spf(to_handle(g), 0)
-    d2, dag2 = algs.spf(to_handle(g), 0, dst=2)
-    assert_pred_dag_integrity(g, dag1)
-    assert_pred_dag_integrity(g, dag2)
-
-
-def test_spf_pred_dag_shapes_and_monotonic_offsets(square2_graph, algs, to_handle):
-    g = square2_graph
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 2, selection=sel)
-    # Distances shape
-    assert isinstance(dist, np.ndarray)
-    assert dist.shape == (g.num_nodes(),)
-    # PredDAG arrays
-    off = np.asarray(dag.parent_offsets)
-    par = np.asarray(dag.parents)
-    via = np.asarray(dag.via_edges)
-    # Offsets length and monotonicity
-    assert off.shape == (g.num_nodes() + 1,)
-    assert np.all(off[:-1] <= off[1:])
-    # Parents/via sizes match total entries
-    total = int(off[-1])
-    assert par.shape == (total,)
-    assert via.shape == (total,)
diff --git a/tests/py/test_spf_edge_select.py b/tests/py/test_spf_edge_select.py
deleted file mode 100644
index 7b5cabc..0000000
--- a/tests/py/test_spf_edge_select.py
+++ /dev/null
@@ -1,186 +0,0 @@
-"""SPF edge selection variants: capacity-aware and residual-aware tie-breaking."""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def test_spf_all_min_cost_with_cap_remaining_selects_all_equal_cost_edges(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two parallel equal-cost edges; both have capacity > 0
-    edges = [
-        (0, 1, 1.0, 5.0, 10),
-        (0, 1, 1.0, 7.0, 20),
-    ]
-    g = build_graph(2, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True, require_capacity=True, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel)
-    # Distance should reflect the minimum cost (1.0)
-    assert np.isclose(dist[1], 1.0)
-    # Parent list for node 1 should include both parallel edges (two entries)
-    off = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 2
-    assert {int(via[i]) for i in range(s, e)}.issubset(set(range(g.num_edges())))
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_single_min_cost_with_cap_remaining_selects_one_deterministically(
-    build_graph,
-    assert_pred_dag_integrity,
-    algs,
-    to_handle,
-):
-    # Two parallel min-cost edges; expect exactly one chosen (deterministic by compaction)
-    edges = [
-        (0, 1, 1.0, 5.0, 20),
-        (0, 1, 1.0, 5.0, 10),
-    ]
-    g = build_graph(2, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel)
-    assert np.isclose(dist[1], 1.0)
-    off = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 1
-    assert int(via[s]) in range(g.num_edges())
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_all_min_cost_parallel_edges(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two min-cost parallels and one higher-cost; expect both min-cost edges selected
-    edges = [
-        (0, 1, 1.0, 5.0, 10),
-        (0, 1, 1.0, 7.0, 20),
-        (0, 1, 2.0, 9.0, 30),
-    ]
-    g = build_graph(2, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel)
-    assert np.isclose(dist[1], 1.0)
-    off = np.asarray(dag.parent_offsets)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 2
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_single_min_cost_parallel_edges(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two min-cost parallels; expect deterministic single edge selection
-    edges = [
-        (0, 1, 1.0, 5.0, 20),
-        (0, 1, 1.0, 7.0, 10),
-    ]
-    g = build_graph(2, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel)
-    assert np.isclose(dist[1], 1.0)
-    off = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 1
-    assert int(via[s]) in range(g.num_edges())
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_all_min_cost_with_cap_remaining_filters_zero_cap(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two min-cost parallels; one has zero capacity and must be excluded
-    edges = [
-        (0, 1, 1.0, 0.0, 10),
-        (0, 1, 1.0, 1.0, 20),
-    ]
-    g = build_graph(2, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=True, require_capacity=True, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel)
-    assert np.isclose(dist[1], 1.0)
-    off = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 1
-    assert int(via[s]) in range(g.num_edges())
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_residual_single_min_cost_with_cap_remaining_load_factored(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two min-cost parallels with different load; prefer lower-load (higher residual)
-    edges = [
-        (0, 1, 1.0, 10.0, 100),  # edge A
-        (0, 1, 1.0, 10.0, 200),  # edge B
-    ]
-    g = build_graph(2, edges)
-    residual = np.zeros(g.num_edges(), dtype=np.float64)
-    # Assign arbitrary loads to trigger deterministic preference; exact mapping by ext id removed
-    residual[:] = 10.0
-    sel = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=True,
-        tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel, residual=residual)
-    assert np.isclose(dist[1], 1.0)
-    off = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    s, e = int(off[1]), int(off[2])
-    assert e - s == 1
-    assert int(via[s]) in range(g.num_edges())
-    assert_pred_dag_integrity(g, dag)
-
-
-def test_spf_single_path_prefers_higher_residual_equal_cost(
-    build_graph, assert_pred_dag_integrity, algs, to_handle
-):
-    # Two equal-cost paths 0->1->3 (cap 1) and 0->2->3 (cap 10); single-path mode
-    edges = [
-        (0, 1, 1.0, 1.0, 10),
-        (1, 3, 1.0, 1.0, 11),
-        (0, 2, 1.0, 10.0, 20),
-        (2, 3, 1.0, 10.0, 21),
-    ]
-    g = build_graph(4, edges)
-    sel = ngc.EdgeSelection(
-        multi_edge=False,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-
-    dist, dag = algs.spf(
-        to_handle(g),
-        0,
-        3,
-        selection=sel,
-        multipath=False,  # single-path mode should prefer the higher-residual path
-    )
-
-    assert np.isclose(dist[3], 2.0)
-    off = np.asarray(dag.parent_offsets)
-    parents = np.asarray(dag.parents)
-    s, e = int(off[3]), int(off[4])
-    assert e - s == 1
-    assert int(parents[s]) == 2  # chooses path via node 2 (higher residual)
-    assert_pred_dag_integrity(g, dag)
diff --git a/tests/py/test_spf_masks.py b/tests/py/test_spf_masks.py
deleted file mode 100644
index ea5dfb3..0000000
--- a/tests/py/test_spf_masks.py
+++ /dev/null
@@ -1,51 +0,0 @@
-"""SPF masks: behavior of node_mask and edge_mask in shortest-path routines."""
-
-import numpy as np
-
-import netgraph_core as ngc
-
-
-def test_node_mask_blocks_path(build_graph, algs, to_handle):
-    # A=0 -> B=1 -> C=2, all cost=1
-    edges = [
-        (0, 1, 1, 1, 0),
-        (1, 2, 1, 1, 1),
-    ]
-    g = build_graph(3, edges)
-    node_mask = np.array([True, False, True], dtype=bool)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 2, selection=sel, node_mask=node_mask)
-    # Destination unreachable because B is masked out
-    assert np.isinf(dist[2])
-    # No parents recorded for 2
-    off = np.asarray(dag.parent_offsets)
-    assert off[2] == off[3]
-
-
-def test_edge_mask_filters_parallel_edges(build_graph, algs, to_handle):
-    # A=0 -> B=1 with two parallel edges of different costs; only cheap edge should be allowed
-    edges = [
-        (0, 1, 1, 1, 10),
-        (0, 1, 2, 1, 20),
-    ]
-    g = build_graph(2, edges)
-    edge_mask = np.array([True, False], dtype=bool)
-    sel = ngc.EdgeSelection(
-        multi_edge=True,
-        require_capacity=False,
-        tie_break=ngc.EdgeTieBreak.DETERMINISTIC,
-    )
-    dist, dag = algs.spf(to_handle(g), 0, 1, selection=sel, edge_mask=edge_mask)
-    assert np.isclose(dist[1], 1.0)
-    # Only one predecessor edge should appear
-    offsets = np.asarray(dag.parent_offsets)
-    via = np.asarray(dag.via_edges)
-    start, end = int(offsets[1]), int(offsets[2])
-    assert end - start == 1
-    # Map via edge id -> ensure it's a valid edge id
-    e = int(via[start])
-    assert 0 <= e < g.num_edges()
diff --git a/tests/py/test_spf_queue_env.py b/tests/py/test_spf_queue_env.py
deleted file mode 100644
index 962e814..0000000
--- a/tests/py/test_spf_queue_env.py
+++ /dev/null
@@ -1,69 +0,0 @@
-"""NGRAPH_CORE_SPF_QUEUE selects the SPF frontier queue; both routes must agree."""
-
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-
-SCRIPT = r"""
-import hashlib
-import numpy as np
-import netgraph_core as ngc
-
-rng = np.random.default_rng(7)
-n = 300
-src, dst, cost, cap = [], [], [], []
-for u in range(n):
-    for k in range(6):
-        src.append(u); dst.append(int(rng.integers(0, n)))
-        cost.append(0 if rng.integers(0, 5) == 0 else int(rng.integers(1, 32)))
-        cap.append(float(1 + rng.integers(0, 100) / 7.0))
-g = ngc.StrictMultiDiGraph.from_arrays(
-    n,
-    src=np.array(src, dtype=np.int32), dst=np.array(dst, dtype=np.int32),
-    capacity=np.array(cap, dtype=np.float64), cost=np.array(cost, dtype=np.int64),
-    ext_edge_ids=np.arange(len(src), dtype=np.int64),
-)
-algs = ngc.Algorithms(ngc.Backend.cpu())
-gh = algs.build_graph(g)
-h = hashlib.sha256()
-residual = np.array(cap, dtype=np.float64); residual[::13] = 0.0
-for s in (0, 17, 150):
-    for dstn in (None, 5, 299):
-        for multipath in (True, False):
-            for me in (True, False):
-                sel = ngc.EdgeSelection(multi_edge=me, require_capacity=not me, tie_break=ngc.EdgeTieBreak.PREFER_HIGHER_RESIDUAL)
-                dist, dag = algs.spf(gh, s, dstn, selection=sel, residual=residual, multipath=multipath)
-                for arr in (np.asarray(dist), np.asarray(dag.parent_offsets), np.asarray(dag.parents), np.asarray(dag.via_edges)):
-                    h.update(np.ascontiguousarray(arr).tobytes())
-    dist, dag = algs.spf_to(gh, s, multipath=True)
-    for arr in (np.asarray(dist), np.asarray(dag.parent_offsets), np.asarray(dag.parents), np.asarray(dag.via_edges)):
-        h.update(np.ascontiguousarray(arr).tobytes())
-flow, summary = algs.max_flow(gh, 0, 299, with_edge_flows=True)
-h.update(repr((flow, list(summary.costs), list(summary.flows))).encode())
-print(h.hexdigest())
-"""
-
-
-def _run(queue: str | None) -> str:
-    env = dict(os.environ)
-    env.pop("NGRAPH_CORE_SPF_QUEUE", None)
-    if queue is not None:
-        env["NGRAPH_CORE_SPF_QUEUE"] = queue
-    out = subprocess.run(
-        [sys.executable, "-c", SCRIPT],
-        env=env,
-        check=True,
-        capture_output=True,
-        text=True,
-    )
-    return out.stdout.strip()
-
-
-def test_queue_routes_agree_bit_for_bit() -> None:
-    heap = _run("heap")
-    bucket = _run("bucket")
-    auto = _run(None)
-    assert len(heap) == 64
-    assert heap == bucket == auto
diff --git a/tests/py/test_spf_to.py b/tests/py/test_spf_to.py
deleted file mode 100644
index 664adb8..0000000
--- a/tests/py/test_spf_to.py
+++ /dev/null
@@ -1,114 +0,0 @@
-"""spf_to: reverse SPF toward one destination, with forced fan-out edges."""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _graph(src, dst, cap, cost, n):
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes=n,
-        src=np.array(src, dtype=np.int32),
-        dst=np.array(dst, dtype=np.int32),
-        capacity=np.array(cap, dtype=np.float64),
-        cost=np.array(cost, dtype=np.int64),
-        ext_edge_ids=np.arange(len(src), dtype=np.int64),
-    )
-
-
-SEL = ngc.EdgeSelection(
-    multi_edge=True, require_capacity=False, tie_break=ngc.EdgeTieBreak.DETERMINISTIC
-)
-
-
-@pytest.fixture
-def fanout_graph():
-    """P(0) -> S1(1) cost 0, P -> S2(2) cost 0; S1 -> T(4) cap 100; S2 -> M(3) cap 20; M -> T cap 60."""
-    g = _graph(
-        [0, 0, 1, 2, 3],
-        [1, 2, 4, 3, 4],
-        [1e6, 1e6, 100.0, 20.0, 60.0],
-        [0, 0, 1, 1, 1],
-        5,
-    )
-    algs = ngc.Algorithms(ngc.Backend.cpu())
-    return g, algs, algs.build_graph(g)
-
-
-def test_distances_to_dst_match_forward_spf(fanout_graph):
-    g, algs, h = fanout_graph
-    dist_to, dag = algs.spf_to(h, 4, selection=SEL)
-    for s in range(g.num_nodes()):
-        d, _ = algs.spf(h, s, 4, selection=SEL)
-        assert dist_to[s] == d[4]
-    assert dag.parent_offsets.shape == (g.num_nodes() + 1,)
-
-
-def test_fanout_forces_all_sources_and_admission_scales_globally(fanout_graph):
-    g, algs, h = fanout_graph
-    dist, dag = algs.spf_to(h, 4, selection=SEL, fanout_edges=[0, 1])
-    assert dist[1] == 1.0 and dist[2] == 2.0
-    # S2 has P as parent although P->S2 is not on a shortest P->T path.
-    assert list(dag.via_edges[dag.parent_offsets[2] : dag.parent_offsets[3]]) == [1]
-    fg = ngc.FlowGraph(g)
-    placed = fg.place(
-        ngc.FlowIndex(0, 4, 0, 0),
-        0,
-        4,
-        dag,
-        100.0,
-        ngc.FlowPlacement.EQUAL_BALANCED,
-    )
-    # Even 50/50 split; S2's 20-unit link admits 20 of 50, so the demand scales to 0.4.
-    assert placed == pytest.approx(40.0)
-    assert fg.edge_flow_view()[2] == pytest.approx(20.0)
-
-
-def test_fanout_lossy_delivers_what_each_branch_carries(fanout_graph):
-    g, algs, h = fanout_graph
-    _, dag = algs.spf_to(h, 4, selection=SEL, fanout_edges=[0, 1])
-    fg = ngc.FlowGraph(g)
-    placed, drops = fg.place_with_drops(
-        ngc.FlowIndex(0, 4, 0, 0),
-        0,
-        4,
-        dag,
-        100.0,
-        ngc.FlowPlacement.EQUAL_BALANCED_LOSSY,
-    )
-    assert placed == pytest.approx(70.0)  # 50 via S1 + 20 via S2
-    assert drops == [(3, pytest.approx(30.0))]
-
-
-def test_without_fanout_the_pseudo_source_reaches_only_the_nearest_source(fanout_graph):
-    g, algs, h = fanout_graph
-    _, dag = algs.spf(h, 0, 4, selection=SEL)
-    # T is reached only via S1 -> T (edge 2): S2's branch costs 2 and never
-    # carries flow placed from P.
-    assert list(dag.via_edges[dag.parent_offsets[4] : dag.parent_offsets[5]]) == [2]
-
-
-def test_fanout_respects_masks_and_reachability(fanout_graph):
-    g, algs, h = fanout_graph
-    edge_mask = np.ones(g.num_edges(), dtype=bool)
-    edge_mask[3] = False  # S2 -> M down
-    dist, dag = algs.spf_to(
-        h, 4, selection=SEL, edge_mask=edge_mask, fanout_edges=[0, 1]
-    )
-    assert np.isinf(dist[2])
-    assert dag.parent_offsets[3] - dag.parent_offsets[2] == 0
-
-
-def test_fanout_validation(fanout_graph):
-    g, algs, h = fanout_graph
-    with pytest.raises(ValueError):
-        algs.spf_to(
-            h, 4, selection=SEL, fanout_edges=[4]
-        )  # M has an incoming DAG entry
-    with pytest.raises(ValueError):
-        algs.spf_to(h, 4, selection=SEL, fanout_edges=[99])
-    with pytest.raises(ValueError):
-        algs.spf_to(h, 42, selection=SEL)
diff --git a/tests/py/test_static_paths.py b/tests/py/test_static_paths.py
deleted file mode 100644
index eb94689..0000000
--- a/tests/py/test_static_paths.py
+++ /dev/null
@@ -1,392 +0,0 @@
-"""FlowPolicy.set_static_paths: pinned path bundles (MPLS-style routing).
-
-Semantics under test (design-panel reviewed):
-- One flow per usable bundle, each permanently bound to its own bundle in
-  supply order (the original Python semantics; the first C++ port bound every
-  flow to bundle[0]).
-- Bundles are validated against the graph and pruned against the policy's
-  masks; a bundle with no surviving src->dst walk is DOWN and creates no flow.
-- Flow cost is the min-cost src->dst walk of the PRUNED bundle.
-- Pinned policies never grow their flow set and never reoptimize;
-  max_path_cost/-factor, min_flow_count and reoptimize_flows_on_each_placement
-  are inert.
-- EqualBalanced spreads over the usable (up) bundles only, and the rebalance
-  loop is iterative (many heterogeneous pinned bundles must not blow the stack).
-- PredDAG.from_edges builds a single-path bundle from a contiguous edge list.
-"""
-
-from __future__ import annotations
-
-import numpy as np
-import pytest
-
-import netgraph_core as ngc
-
-
-def _graph(num_nodes, edges):
-    """edges: list of (src, dst, capacity, cost)."""
-    s, d, c, k = zip(*edges, strict=False)
-    return ngc.StrictMultiDiGraph.from_arrays(
-        num_nodes,
-        np.array(s, dtype=np.int32),
-        np.array(d, dtype=np.int32),
-        np.array(c, dtype=np.float64),
-        np.array(k, dtype=np.int64),
-        np.arange(len(s), dtype=np.int64),
-    )
-
-
-def _eid(g, u, v):
-    """Edge id of u->v after the graph's (cost, src, dst) reordering."""
-    es, ed = g.edge_src_view(), g.edge_dst_view()
-    (idx,) = np.where((es == u) & (ed == v))
-    assert idx.size == 1, f"expected exactly one {u}->{v} edge"
-    return int(idx[0])
-
-
-@pytest.fixture
-def algs():
-    return ngc.Algorithms(ngc.Backend.cpu())
-
-
-@pytest.fixture
-def square(algs):
-    """0->1->2 (cost 1+1, cap 1 each) and 0->3->2 (cost 2+2, cap 2 each)."""
-    g = _graph(4, [(0, 1, 1.0, 1), (1, 2, 1.0, 1), (0, 3, 2.0, 2), (3, 2, 2.0, 2)])
-    pg = algs.build_graph(g)
-    short = ngc.PredDAG.from_edges(g, [_eid(g, 0, 1), _eid(g, 1, 2)])
-    long = ngc.PredDAG.from_edges(g, [_eid(g, 0, 3), _eid(g, 3, 2)])
-    return g, pg, short, long
-
-
-class TestFromEdges:
-    def test_builds_usable_single_path_dag(self, algs, square):
-        g, pg, short, _ = square
-        fs = ngc.FlowState(g)
-        placed = fs.place_on_dag(
-            0, 2, short, float("inf"), ngc.FlowPlacement.PROPORTIONAL
-        )
-        assert placed == pytest.approx(1.0)  # bottleneck of the 0->1->2 path
-
-    def test_rejects_empty_out_of_range_non_contiguous_and_revisits(self, algs):
-        g = _graph(3, [(0, 1, 1.0, 1), (1, 2, 1.0, 1), (2, 0, 1.0, 1)])
-        e01, e12, e20 = _eid(g, 0, 1), _eid(g, 1, 2), _eid(g, 2, 0)
-        with pytest.raises(ValueError, match="non-empty"):
-            ngc.PredDAG.from_edges(g, [])
-        with pytest.raises(ValueError, match="out of range"):
-            ngc.PredDAG.from_edges(g, [99])
-        with pytest.raises(ValueError, match="not contiguous"):
-            ngc.PredDAG.from_edges(g, [e01, e20])
-        with pytest.raises(ValueError, match="simple path"):
-            ngc.PredDAG.from_edges(g, [e01, e12, e20])  # returns to node 0
-
-
-class TestPerFlowBinding:
-    """The port bug this redesign fixes: every flow bound to bundle[0]."""
-
-    def test_each_flow_bound_to_its_own_bundle_in_supply_order(self, algs, square):
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 2, [short, long])
-        placed, left = policy.place_demand(fg, 0, 2, 0, 3.0)
-        assert placed == pytest.approx(3.0)  # 1 on the short path + 2 on the long
-        assert left == pytest.approx(0.0)
-        # Ordinal binding: creation order == supply order; costs prove which
-        # bundle each flow holds (short = 2, long = 4).
-        by_creation = sorted(policy.flows.items(), key=lambda kv: kv[0][3])
-        assert [v[2] for _, v in by_creation] == [2, 4]
-        assert [v[3] for _, v in by_creation] == pytest.approx([1.0, 2.0])
-
-    def test_supply_order_is_placement_precedence(self, algs, square):
-        """Proportional pinned placement is greedy in bundle-supply order."""
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 2, [long, short])  # long first this time
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 2.0)
-        assert placed == pytest.approx(2.0)
-        by_creation = sorted(policy.flows.items(), key=lambda kv: kv[0][3])
-        # First-supplied bundle (long, cost 4) absorbed everything.
-        assert [v[2] for _, v in by_creation] == [4, 2]
-        assert [v[3] for _, v in by_creation] == pytest.approx([2.0, 0.0])
-
-
-class TestEqualBalanced:
-    def test_eb_equalizes_to_bottleneck_bundle(self, algs, square):
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(
-            algs,
-            pg,
-            ngc.FlowPolicyConfig(flow_placement=ngc.FlowPlacement.EQUAL_BALANCED),
-        )
-        policy.set_static_paths(0, 2, [short, long])
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)
-        # ECMP over 2 LSPs; the short path caps each at ~1.0.
-        assert placed == pytest.approx(2.0, abs=1e-3)
-        vols = [v[3] for v in policy.flows.values()]
-        assert max(vols) - min(vols) < 1e-3
-
-    def test_eb_spreads_over_up_bundles_only(self, algs, square):
-        g, pg, short, long = square
-        em = np.ones(4, dtype=bool)
-        em[_eid(g, 0, 1)] = False  # short path down
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(
-            algs,
-            pg,
-            ngc.FlowPolicyConfig(flow_placement=ngc.FlowPlacement.EQUAL_BALANCED),
-            edge_mask=em,
-        )
-        policy.set_static_paths(0, 2, [short, long])
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)
-        # One up LSP; head-end ECMP over up tunnels only -> full 2.0 on the long
-        # path, not volume/2 as a supplied-count divisor would give.
-        assert policy.flow_count() == 1
-        assert placed == pytest.approx(2.0, abs=1e-3)
-
-    def test_many_heterogeneous_bundles_do_not_blow_the_stack(self, algs):
-        """256 pinned parallel LSPs with one small bundle: the EB rebalance loop
-        (previously recursion of depth ~U * ln(imbalance/kMinFlow)) must survive."""
-        n_paths = 256
-        edges = []
-        # src=0, dst=1, path i via node 2+i with capacity 100 except one runt.
-        for i in range(n_paths):
-            mid = 2 + i
-            cap = 0.5 if i == 0 else 100.0
-            edges.append((0, mid, cap, 1))
-            edges.append((mid, 1, cap, 1))
-        g = _graph(2 + n_paths, edges)
-        pg = algs.build_graph(g)
-        bundles = [
-            ngc.PredDAG.from_edges(g, [_eid(g, 0, 2 + i), _eid(g, 2 + i, 1)])
-            for i in range(n_paths)
-        ]
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(
-            algs,
-            pg,
-            ngc.FlowPolicyConfig(flow_placement=ngc.FlowPlacement.EQUAL_BALANCED),
-        )
-        policy.set_static_paths(0, 1, bundles)
-        placed, _ = policy.place_demand(fg, 0, 1, 0, 10_000.0)
-        # ECMP: the runt bundle (cap 0.5) bounds every LSP.
-        assert placed == pytest.approx(n_paths * 0.5, rel=1e-2)
-
-    def test_second_placement_is_not_incremental(self, algs, square):
-        """Documented: per-call volume defines the EB per-flow target, so a second
-        smaller placement adds nothing (parity with dynamic EB + max_flow_count)."""
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(
-            algs,
-            pg,
-            ngc.FlowPolicyConfig(flow_placement=ngc.FlowPlacement.EQUAL_BALANCED),
-        )
-        policy.set_static_paths(0, 2, [short, long])
-        first, _ = policy.place_demand(fg, 0, 2, 0, 2.0)
-        assert first == pytest.approx(2.0, abs=1e-3)
-        # The smaller per-call volume yields a smaller per-flow target that the
-        # flows already meet, so nothing new is placed and the new volume is
-        # returned as leftover.
-        second, second_left = policy.place_demand(fg, 0, 2, 0, 1.0)
-        assert second == pytest.approx(0.0, abs=1e-3)
-        assert second_left == pytest.approx(1.0, abs=1e-3)
-        assert policy.placed_demand() == pytest.approx(first, abs=1e-3)
-
-
-class TestDiminishingReturnsArming:
-    def test_more_bundles_than_window_all_receive_volume(self, algs):
-        """16 LSPs x cap 1 against volume 10000: the diminishing-returns window
-        (8) must not fire before every pinned flow was visited once."""
-        n_paths = 16
-        edges = []
-        for i in range(n_paths):
-            mid = 2 + i
-            edges.append((0, mid, 1.0, 1))
-            edges.append((mid, 1, 1.0, 1))
-        g = _graph(2 + n_paths, edges)
-        pg = algs.build_graph(g)
-        bundles = [
-            ngc.PredDAG.from_edges(g, [_eid(g, 0, 2 + i), _eid(g, 2 + i, 1)])
-            for i in range(n_paths)
-        ]
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 1, bundles)
-        placed, _ = policy.place_demand(fg, 0, 1, 0, 10_000.0)
-        assert placed == pytest.approx(float(n_paths))  # all 16 units of capacity
-
-
-class TestMaskSemantics:
-    def test_down_bundle_creates_no_flow_and_cost_is_post_prune(self, algs):
-        """A bundle whose cheapest walk is masked reports the surviving walk's
-        cost; a bundle with no surviving walk is down."""
-        # Two parallel two-hop walks 0->1: via node 2 (cost 1+1) and node 3 (cost 5+0).
-        g = _graph(
-            4,
-            [(0, 2, 5.0, 1), (2, 1, 5.0, 1), (0, 3, 5.0, 5), (3, 1, 5.0, 0)],
-        )
-        pg = algs.build_graph(g)
-        cheap = [_eid(g, 0, 2), _eid(g, 2, 1)]
-        dear = [_eid(g, 0, 3), _eid(g, 3, 1)]
-        # One multi-walk bundle containing both walks: merge the two single-path
-        # DAGs by using an SPF-style DAG is not possible here (costs differ), so
-        # build the union manually via two bundles for the down test, and use the
-        # dear-only bundle for the cost check after masking the cheap walk.
-        b_cheap = ngc.PredDAG.from_edges(g, cheap)
-        b_dear = ngc.PredDAG.from_edges(g, dear)
-
-        em = np.ones(4, dtype=bool)
-        em[cheap[0]] = False  # kill the cheap walk entirely
-
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig(), edge_mask=em)
-        policy.set_static_paths(0, 1, [b_cheap, b_dear])
-        placed, _ = policy.place_demand(fg, 0, 1, 0, 100.0)
-        assert policy.flow_count() == 1  # cheap bundle is DOWN
-        ((_, flow),) = policy.flows.items()
-        assert flow[2] == 5  # cost of the surviving (dear) walk
-        assert placed == pytest.approx(5.0)
-
-    def test_multiwalk_bundle_survives_partial_failure_with_surviving_cost(self, algs):
-        """An SPF DAG used as one bundle renormalizes over surviving walks and
-        reports the post-prune min cost (SR-TE-style semantics)."""
-        # Equal-cost diamond: 0->1 via 2 or via 3, all edges cost 1 cap 5.
-        g = _graph(4, [(0, 2, 5.0, 1), (2, 1, 5.0, 1), (0, 3, 5.0, 1), (3, 1, 5.0, 1)])
-        pg = algs.build_graph(g)
-        algs_local = algs
-        _, dag = algs_local.spf(pg, 0, None, multipath=True)
-
-        em = np.ones(4, dtype=bool)
-        em[_eid(g, 0, 2)] = False  # one branch of the DAG fails
-
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig(), edge_mask=em)
-        policy.set_static_paths(0, 1, [dag])
-        placed, _ = policy.place_demand(fg, 0, 1, 0, 100.0)
-        assert policy.flow_count() == 1
-        assert placed == pytest.approx(5.0)  # surviving branch only
-        ((_, flow),) = policy.flows.items()
-        assert flow[2] == 2
-
-    def test_all_bundles_down_places_nothing_and_is_idempotent(self, algs, square):
-        g, pg, short, long = square
-        nm = np.ones(4, dtype=bool)
-        nm[1] = False
-        nm[3] = False  # both intermediate nodes down
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig(), node_mask=nm)
-        policy.set_static_paths(0, 2, [short, long])
-        for _ in range(2):
-            placed, left = policy.place_demand(fg, 0, 2, 0, 3.0)
-            assert (placed, left) == (0.0, 3.0)
-            assert policy.flow_count() == 0
-
-
-class TestPinnedInertness:
-    def test_reoptimize_on_each_placement_is_inert(self, algs, square):
-        """With reoptimization enabled (as the TE presets set), pinned flows keep
-        their bundles: deliberate divergence from the original Python, where
-        reoptimization silently rerouted pinned flows onto SPF paths."""
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(
-            algs, pg, ngc.FlowPolicyConfig(reoptimize_flows_on_each_placement=True)
-        )
-        policy.set_static_paths(0, 2, [short, long])
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)
-        assert placed == pytest.approx(3.0)
-        by_creation = sorted(policy.flows.items(), key=lambda kv: kv[0][3])
-        assert [v[2] for _, v in by_creation] == [2, 4]  # bindings unchanged
-
-    def test_max_path_cost_is_inert_for_pinned_bundles(self, algs, square):
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig(max_path_cost=1))
-        policy.set_static_paths(0, 2, [short, long])  # costs 2 and 4, both > 1
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)
-        assert placed == pytest.approx(3.0)  # pinned bundles bypass the cost gate
-
-    def test_lifecycle_remove_and_rebalance(self, algs, square):
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 2, [short, long])
-        policy.place_demand(fg, 0, 2, 0, 3.0)
-        policy.remove_demand(fg)
-        assert np.asarray(fg.edge_flow_view()).sum() == pytest.approx(0.0)
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)  # re-pins from bundles
-        assert placed == pytest.approx(3.0)
-        placed_r, _ = policy.rebalance_demand(fg, 0, 2, 0, 1.0)
-        assert placed_r == pytest.approx(2.0)  # 1.0 per flow target
-
-
-class TestValidation:
-    def test_repin_before_placement_replaces(self, algs, square):
-        g, pg, short, long = square
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 2, [short])
-        policy.set_static_paths(0, 2, [short, long])  # no spurious throw
-        fg = ngc.FlowGraph(g)
-        placed, _ = policy.place_demand(fg, 0, 2, 0, 3.0)
-        assert placed == pytest.approx(3.0)
-        assert policy.flow_count() == 2
-
-    def test_repin_with_masks_pruning_is_not_spurious(self, algs, square):
-        """The design-panel blocker: derived max_flow_count must not make
-        re-pinning the same bundles throw once masks prune some of them."""
-        g, pg, short, long = square
-        em = np.ones(4, dtype=bool)
-        em[_eid(g, 0, 1)] = False  # short bundle will be down (U=1 < N=2)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig(), edge_mask=em)
-        policy.set_static_paths(0, 2, [short, long])
-        policy.set_static_paths(0, 2, [short, long])  # must not throw
-        assert policy.flow_count() == 0  # no flows until placement
-
-    def test_rejects_bundle_from_a_different_graph(self, algs, square):
-        g, pg, short, _ = square
-        other = _graph(
-            4, [(0, 3, 1.0, 7), (3, 2, 1.0, 7), (0, 1, 1.0, 9), (1, 2, 1.0, 9)]
-        )
-        foreign = ngc.PredDAG.from_edges(other, [_eid(other, 0, 1), _eid(other, 1, 2)])
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        with pytest.raises(ValueError, match="different graph|does not connect"):
-            policy.set_static_paths(0, 2, [foreign])
-
-    def test_rejects_bundle_without_src_dst_walk(self, algs, square):
-        g, pg, short, _ = square
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        with pytest.raises(ValueError, match="no src->dst walk"):
-            policy.set_static_paths(1, 3, [short])  # short connects 0->2, not 1->3
-
-    def test_set_after_placement_and_wrong_demand_throw(self, algs, square):
-        g, pg, short, long = square
-        fg = ngc.FlowGraph(g)
-        policy = ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig())
-        policy.set_static_paths(0, 2, [short])
-        policy.place_demand(fg, 0, 2, 0, 1.0)
-        with pytest.raises(ValueError, match="already holds flows"):
-            policy.set_static_paths(0, 2, [long])
-        policy.remove_demand(fg)
-        policy.set_static_paths(0, 2, [long])  # allowed again after removal
-        with pytest.raises(ValueError, match="do not match demand"):
-            policy.place_demand(fg, 0, 1, 0, 1.0)
-
-    def test_config_incompatibilities(self, algs, square):
-        g, pg, short, long = square
-        with pytest.raises(ValueError, match="max_flow_count"):
-            ngc.FlowPolicy(
-                algs, pg, ngc.FlowPolicyConfig(max_flow_count=3)
-            ).set_static_paths(0, 2, [short, long])
-        with pytest.raises(ValueError, match="shortest_path"):
-            ngc.FlowPolicy(
-                algs, pg, ngc.FlowPolicyConfig(shortest_path=True)
-            ).set_static_paths(0, 2, [short])
-        with pytest.raises(ValueError, match="non-empty"):
-            ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig()).set_static_paths(0, 2, [])
-        with pytest.raises(ValueError, match="out of range or equal"):
-            ngc.FlowPolicy(algs, pg, ngc.FlowPolicyConfig()).set_static_paths(
-                2, 2, [short]
-            )
diff --git a/tests/py/test_thread_safety.py b/tests/py/test_thread_safety.py
deleted file mode 100644
index 9720542..0000000
--- a/tests/py/test_thread_safety.py
+++ /dev/null
@@ -1,360 +0,0 @@
-"""
-Test thread safety of Python bindings (Issue #4).
-
-These tests validate that NumPy array data is properly copied before releasing
-the GIL, preventing data races when other threads mutate the arrays.
-"""
-
-import threading
-import time
-
-import numpy as np
-import pytest
-
-from netgraph_core import (
-    Algorithms,
-    Backend,
-    StrictMultiDiGraph,
-)
-
-
-def _make_graph(num_nodes, src, dst, capacity, cost):
-    """Helper to build graph with auto-generated ext_edge_ids."""
-    ext_edge_ids = np.arange(len(src), dtype=np.int64)
-    return StrictMultiDiGraph.from_arrays(
-        num_nodes, src, dst, capacity, cost, ext_edge_ids
-    )
-
-
-class TestSPFThreadSafety:
-    """Test that spf() is thread-safe with respect to mask mutations."""
-
-    def test_spf_node_mask_thread_safety(self):
-        """
-        Verify that mutating node_mask in another thread doesn't affect spf() results.
-
-        The C++ code copies the mask to a local vector before releasing the GIL,
-        so concurrent mutations to the NumPy buffer won't cause data races.
-        """
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 100
-        g = _make_graph(
-            n,
-            np.arange(n - 1, dtype=np.int32),
-            np.arange(1, n, dtype=np.int32),
-            np.ones(n - 1) * 10.0,
-            np.ones(n - 1, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        # Create node mask (all True initially)
-        node_mask = np.ones(n, dtype=bool)
-
-        results = []
-
-        def run_spf():
-            """Run SPF with the mask."""
-            dist, dag = algs.spf(graph, 0, node_mask=node_mask)
-            results.append((dist.copy(), dag))
-
-        def mutate_mask():
-            """Mutate the mask after a short delay."""
-            time.sleep(0.001)  # Let SPF start
-            node_mask[:] = False  # Try to cause a race
-
-        # Run SPF in main thread while another thread mutates the mask
-        mutator = threading.Thread(target=mutate_mask)
-        mutator.start()
-
-        run_spf()
-
-        mutator.join()
-
-        # SPF should see a consistent mask (either all True or all False)
-        # because the C++ code copies the mask before releasing the GIL
-        dist, dag = results[0]
-
-        # If mask was all True: all nodes should be reachable
-        # If mask was all False: only source should have finite distance
-        # It should NOT be corrupted (some arbitrary subset)
-        finite_count = np.sum(np.isfinite(dist))
-
-        # Either saw all True (finite_count == n) or all False (finite_count == 1)
-        assert finite_count in [1, n], (
-            f"SPF saw corrupted mask: {finite_count} finite distances "
-            f"(expected 1 or {n})"
-        )
-
-    def test_spf_edge_mask_thread_safety(self):
-        """Verify edge_mask is also safe from concurrent mutations."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 50
-        edges = [(i, (i + 1) % n) for i in range(n)]  # Ring topology
-        src = np.array([e[0] for e in edges], dtype=np.int32)
-        dst = np.array([e[1] for e in edges], dtype=np.int32)
-
-        g = _make_graph(
-            n,
-            src,
-            dst,
-            np.ones(n) * 10.0,
-            np.ones(n, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        edge_mask = np.ones(n, dtype=bool)
-
-        results = []
-
-        def run_spf():
-            dist, dag = algs.spf(graph, 0, edge_mask=edge_mask)
-            results.append(dist.copy())
-
-        def mutate_mask():
-            time.sleep(0.001)
-            edge_mask[:] = False
-
-        mutator = threading.Thread(target=mutate_mask)
-        mutator.start()
-        run_spf()
-        mutator.join()
-
-        dist = results[0]
-        # Should see consistent results (not corrupted)
-        # Either all edges available (complete ring) or no edges
-        assert np.sum(np.isfinite(dist)) in [1, n]
-
-
-class TestKSPThreadSafety:
-    """Test that ksp() is thread-safe with respect to mask mutations."""
-
-    def test_ksp_mask_thread_safety(self):
-        """Verify ksp() copies masks before releasing GIL."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 20
-        g = _make_graph(
-            n,
-            np.array([0, 0, 1, 1, 2], dtype=np.int32),
-            np.array([1, 2, 3, 4, 4], dtype=np.int32),
-            np.ones(5) * 10.0,
-            np.array([1, 2, 1, 2, 1], dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        node_mask = np.ones(n, dtype=bool)
-
-        results = []
-
-        def run_ksp():
-            paths = algs.ksp(graph, 0, 4, k=3, node_mask=node_mask)
-            results.append(len(paths))
-
-        def mutate_mask():
-            time.sleep(0.001)
-            node_mask[2] = False  # Block a node
-
-        mutator = threading.Thread(target=mutate_mask)
-        mutator.start()
-        run_ksp()
-        mutator.join()
-
-        # Should get consistent results (either with or without node 2)
-        num_paths = results[0]
-        # The mask must be copied before the GIL is released, so the run sees one
-        # consistent snapshot: 2 paths (mask untouched) or 1 (node 2 blocked, leaving
-        # 0->1->4). Any other count means it observed a torn mask.
-        assert num_paths in (1, 2)
-
-
-class TestMaxFlowThreadSafety:
-    """Test that max_flow() is thread-safe with respect to mask mutations."""
-
-    def test_maxflow_mask_thread_safety(self):
-        """Verify max_flow() copies masks before releasing GIL."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        g = _make_graph(
-            4,
-            np.array([0, 0, 1, 2], dtype=np.int32),
-            np.array([1, 2, 3, 3], dtype=np.int32),
-            np.array([10.0, 10.0, 10.0, 10.0]),
-            np.ones(4, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        node_mask = np.ones(4, dtype=bool)
-        edge_mask = np.ones(4, dtype=bool)
-
-        results = []
-
-        def run_maxflow():
-            total_flow, summary = algs.max_flow(
-                graph, 0, 3, node_mask=node_mask, edge_mask=edge_mask
-            )
-            results.append(total_flow)
-
-        def mutate_masks():
-            time.sleep(0.001)
-            node_mask[1] = False
-            edge_mask[0] = False
-
-        mutator = threading.Thread(target=mutate_masks)
-        mutator.start()
-        run_maxflow()
-        mutator.join()
-
-        # Should get consistent flow value (either full graph or restricted)
-        flow = results[0]
-        assert flow >= 0.0  # Should not be corrupted (negative/NaN)
-
-
-class TestConcurrentAlgorithmCalls:
-    """Test multiple algorithm calls running concurrently."""
-
-    def test_concurrent_spf_calls(self):
-        """Multiple threads calling spf() simultaneously should be safe."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 30
-        g = _make_graph(
-            n,
-            np.arange(n - 1, dtype=np.int32),
-            np.arange(1, n, dtype=np.int32),
-            np.ones(n - 1) * 10.0,
-            np.ones(n - 1, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        results = []
-
-        def worker(src_node):
-            """Run SPF from a specific source."""
-            mask = np.ones(n, dtype=bool)
-            mask[src_node] = True  # Ensure source is available
-            dist, dag = algs.spf(graph, src_node, node_mask=mask)
-            results.append((src_node, dist.copy()))
-
-        # Run multiple SPF calls concurrently
-        threads = []
-        for i in range(5):
-            t = threading.Thread(target=worker, args=(i,))
-            threads.append(t)
-            t.start()
-
-        for t in threads:
-            t.join()
-
-        # All threads should complete successfully
-        assert len(results) == 5
-
-        # Each result should be valid
-        for src, dist in results:
-            assert dist[src] == 0.0  # Source distance is always 0
-
-
-@pytest.mark.slow
-class TestStressThreadSafety:
-    """Stress tests for thread safety under heavy concurrent load."""
-
-    def test_repeated_concurrent_mutations(self):
-        """Repeatedly mutate masks while running algorithms."""
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 50
-        g = _make_graph(
-            n,
-            np.arange(n - 1, dtype=np.int32),
-            np.arange(1, n, dtype=np.int32),
-            np.random.rand(n - 1) * 100,
-            np.ones(n - 1, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        node_mask = np.ones(n, dtype=bool)
-        # pytest.fail() inside a worker thread cannot fail the test: the exception
-        # stays in that thread and join() does not re-raise it. Record failures and
-        # assert on them from the main thread instead.
-        errors: list[str] = []
-
-        def run_algorithms():
-            """Run various algorithms repeatedly."""
-            for _ in range(20):
-                try:
-                    algs.spf(graph, 0, node_mask=node_mask)
-                except Exception as e:  # noqa: BLE001 - reported below
-                    errors.append(f"algorithm raised: {e!r}")
-
-        def mutate_continuously():
-            """Continuously mutate the mask."""
-            try:
-                for _ in range(100):
-                    node_mask[:] = np.random.rand(n) > 0.5
-                    time.sleep(0.001)
-            except Exception as e:  # noqa: BLE001 - reported below
-                errors.append(f"mutator raised: {e!r}")
-
-        algo_thread = threading.Thread(target=run_algorithms)
-        mutator_thread = threading.Thread(target=mutate_continuously)
-
-        algo_thread.start()
-        mutator_thread.start()
-
-        algo_thread.join()
-        mutator_thread.join()
-
-        assert not errors, "; ".join(errors)
-
-
-class TestMemoryOrdering:
-    """
-    Test that mask copying has proper memory ordering.
-
-    This is more of a theoretical concern - if masks aren't properly copied,
-    we might see stale or reordered writes from other threads.
-    """
-
-    def test_mask_sees_latest_values(self):
-        """
-        Verify that when we create a mask and immediately pass it to C++,
-        the C++ code sees the correct values (not stale cache).
-        """
-        backend = Backend.cpu()
-        algs = Algorithms(backend)
-
-        n = 10
-        g = _make_graph(
-            n,
-            np.arange(n - 1, dtype=np.int32),
-            np.arange(1, n, dtype=np.int32),
-            np.ones(n - 1),
-            np.ones(n - 1, dtype=np.int64),
-        )
-        graph = algs.build_graph(g)
-
-        # Create mask with specific pattern
-        mask = np.zeros(n, dtype=bool)
-        mask[0] = True  # Only source
-        mask[5] = True  # One intermediate node
-        mask[9] = True  # Destination
-
-        # Immediately use it
-        dist, dag = algs.spf(graph, 0, node_mask=mask)
-
-        # Should respect the mask (only nodes 0, 5, 9 are reachable)
-        finite_nodes = [i for i in range(n) if np.isfinite(dist[i])]
-
-        # With the mask, we can't reach node 9 because intermediate nodes are blocked
-        # (except 5, but we need more nodes in the path)
-        assert 0 in finite_nodes  # Source is always reachable
-
-        # The key test: C++ saw the mask we just created (not stale/zero data)
-        # If it saw all-false or all-true, the results would be very different
diff --git a/tests/py/test_tunnel_oracle.py b/tests/py/test_tunnel_oracle.py
new file mode 100644
index 0000000..6b580a8
--- /dev/null
+++ b/tests/py/test_tunnel_oracle.py
@@ -0,0 +1,451 @@
+"""The tunnel oracle (tunnel_oracle.py) against hand derivations, two per rule it restates: one
+test per rule, each with two cases derived by hand (a T2 test adds a third where the first two
+cannot see a misreading of its rule, and says so). These tests import nothing of the library; a
+copy of the oracle with one misreading of a rule must fail that rule's test."""
+
+from __future__ import annotations
+
+from fractions import Fraction
+
+import tunnel_oracle as orc
+
+UP, NB, CC, FAILED = orc.UP, orc.NB, orc.CC, orc.FAILED
+
+# The graphs of the hand derivations: (u, v, capacity, cost) in EdgeId order.
+ONE10 = [(0, 1, 10, 1)]
+PARX = [(0, 1, 4, 1), (0, 1, 10, 1)]
+PVIEW = [(0, 1, 10, 1), (0, 1, 8, 1)]
+FILT = [(0, 1, 2, 1), (0, 1, 10, 1)]
+PARC = [(0, 1, 4, 1), (0, 1, 10, 2)]
+PAR612 = [(0, 1, 6, 1), (0, 1, 6, 2)]
+ZL = [(0, 1, 0, 1), (0, 1, 10, 2)]
+X8 = [(0, 2, 0, 1), (1, 2, 8, 3)]
+LASTDOWN = [(0, 1, 2, 1), (0, 1, 10, 2)]  # the last tunnel without bandwidth
+SHARED = [(0, 2, 6, 1), (1, 2, 6, 1), (2, 3, 6, 1)]  # two heads sharing a link
+DIAM5 = [(0, 1, 6, 1), (0, 2, 6, 3), (1, 2, 4, 1), (1, 3, 6, 3), (2, 3, 6, 1)]
+REPLAY = [(0, 2, 10, 1), (0, 3, 10, 5), (1, 2, 10, 1), (3, 2, 10, 5)]
+SX = [(0, 1, 0, 5), (0, 1, 1, 6)]  # CostStretch(6/5) admits the next path at equality
+
+
+def twoh(a, b):
+    return [(0, 2, a, 1), (1, 2, b, 1)]
+
+
+def caps(edges):
+    return [c for _, _, c, _ in edges]
+
+
+def statuses(s):
+    return [t.status for t in s.tunnels]
+
+
+def routes(s):
+    return [t.path or [] for t in s.tunnels]
+
+
+def requests(s):
+    return [t.requested for t in s.tunnels]
+
+
+# The requests RR(RR(D, H, h), N, j) in round order
+def test_round_order_requests():
+    # RR(10, 2) = (5, 5), RR(5, 2) = (3, 2): round order 3, 3, 2, 2.
+    assert requests(orc.setup(twoh(10, 10), [0, 1], [2], 10, 2)) == [3, 3, 2, 2]
+    # D = 5 over two heads, N = 2: shares (3, 2), requests 2, 1, 1, 1.
+    assert requests(orc.setup(twoh(10, 10), [0, 1], [2], 5, 2)) == [2, 1, 1, 1]
+
+
+# Every attempt on U minus this setup's earlier up tunnels
+def test_attempts_see_earlier_tunnels():
+    # Two heads sharing a link: the first tunnel of each head fills node 2's exit (6 of 3 + 3).
+    assert statuses(orc.setup(SHARED, [0, 1], [3], 12, 2)) == [UP, UP, NB, NB]
+    # The last tunnel without bandwidth: three requests of 3 fit the 10-unit link, the fourth
+    # does not.
+    assert statuses(orc.setup(LASTDOWN, [0], [1], 12, 4)) == [UP, UP, UP, NB]
+
+
+# The filter U >= max(b, minimum) is inclusive
+def test_inclusive_filter():
+    # PAR612, D = 12, N = 4: two requests of 3 fill a link of 6.
+    assert routes(orc.setup(PAR612, [0], [1], 12, 4)) == [[0], [0], [1], [1]]
+    # Minimum 5 filters the 4-unit link: both on e1, holds [0, 2]; minimum 0: both on e0.
+    s = orc.setup(PARC, [0], [1], 2, 2, minimum=5)
+    assert (routes(s), s.holds) == ([[1], [1]], [0, 2])
+    s = orc.setup(PARC, [0], [1], 2, 2)
+    assert (routes(s), s.holds) == ([[0], [0]], [2, 0])
+
+
+# A request of 0 has no filter unless the minimum is positive
+def test_zero_requests():
+    # An idle tunnel on a zero-capacity link: request 1 on e1 (e0 has 0), request 0 over the
+    # zero link e0 (cost 1).
+    s = orc.setup(ZL, [0], [1], 1, 2)
+    assert (requests(s), routes(s), statuses(s)) == ([1, 0], [[1], [0]], [UP, UP])
+    # Minimum 1 filters the zero link for both.
+    s = orc.setup(ZL, [0], [1], 1, 2, minimum=1)
+    assert (routes(s), s.holds) == ([[1], [1]], [0, 1])
+
+
+# The filter first, then the collapse of parallel members
+def test_filter_before_collapse():
+    sel = orc.Selection(parallel_edges=False)
+    # e0 (2 < 6) is filtered before the collapse would keep it (lowest EdgeId).
+    assert routes(orc.setup(FILT, [0], [1], 6, 1, sel=sel)) == [[1]]
+    # The last tunnel without bandwidth with parallel_edges False: as with True.
+    assert statuses(orc.setup(LASTDOWN, [0], [1], 12, 4, sel=sel)) == [UP, UP, UP, NB]
+
+
+# The single-path order: cost, HIGHER_* bottleneck, hops, EdgeId sequence
+def test_single_path_order():
+    # FEWER_HOPS: equal costs and hops: the smaller EdgeId, then e0 is filtered.
+    assert routes(orc.setup(PARX, [0], [1], 8, 2)) == [[0], [1]]
+    # The diamond, design 8: the cheapest path 0-1-2-3 (cost 3, three hops) before the two-hop
+    # paths of cost 4.
+    assert routes(orc.setup(DIAM5, [0], [3], 8, 2)) == [[0, 2, 4], []]
+
+
+# The tie scores: HIGHER_AVAILABLE_CAPACITY reads U, HIGHER_HEADROOM U / C, HIGHER_CAPACITY C
+def test_tie_score_view():
+    # Unreserved [5, 8], service residual the capacities [10, 8]: HIGHER_AVAILABLE_CAPACITY reads
+    # U: e1.
+    sel = orc.Selection("HIGHER_AVAILABLE_CAPACITY")
+    assert routes(orc.setup(PVIEW, [0], [1], 4, 1, sel=sel, unreserved=[5, 8])) == [[1]]
+    # HIGHER_HEADROOM: 4/4 = 10/10, a tie: e0, then e0 is filtered: e1.
+    sel = orc.Selection("HIGHER_HEADROOM")
+    assert routes(orc.setup(PARX, [0], [1], 8, 2, sel=sel)) == [[0], [1]]
+
+
+# AbsoluteCost(c) is inclusive
+def test_absolute_inclusive():
+    # X8 with AbsoluteCost(3): head 1's path costs 3: up.
+    assert statuses(orc.setup(X8, [0, 1], [2], 4, 1, absolute=3)) == [NB, UP]
+    # AbsoluteCost(2): COST_CEILING_EXCEEDED.
+    assert statuses(orc.setup(X8, [0, 1], [2], 4, 1, absolute=2)) == [NB, CC]
+
+
+# CostStretch(f): the exact f times the pool minimum c0
+def test_stretch_pool_baseline():
+    # X8 with CostStretch(2): c0 = 1 (head 0's zero-capacity link), ceiling 2 < 3.
+    s = orc.setup(X8, [0, 1], [2], 4, 1, stretch=2.0)
+    assert (s.c0, statuses(s)) == (1, [NB, CC])
+    # CostStretch(1.2) on SX: c0 = 5 and 1.2 is exactly 6/5 (the decimal it prints, not its binary
+    # value, which times 5 is below 6), so the cost-6 path is admitted at equality; 11/10 is not.
+    s = orc.setup(SX, [0], [1], 1, 1, stretch=1.2)
+    assert Fraction(1.2) * 5 < 6 == Fraction("1.2") * 5
+    assert (s.c0, statuses(s)) == (5, [UP])
+    s = orc.setup(SX, [0], [1], 1, 1, stretch=Fraction(11, 10))
+    assert (s.c0, statuses(s)) == (5, [CC])
+
+
+# An up tunnel holds b on every link, a down one nothing
+def test_holds():
+    # The last tunnel without bandwidth: three up tunnels of 3 on e1, the fourth down.
+    s = orc.setup(LASTDOWN, [0], [1], 12, 4)
+    assert (s.holds, sum(t.reserved for t in s.tunnels)) == ([0, 9], 9)
+    # ONE10, N = 2, D = 12: 6 up, the second 6 down (U = 4).
+    s = orc.setup(ONE10, [0], [1], 12, 2)
+    assert (statuses(s), s.holds, sum(t.reserved for t in s.tunnels)) == (
+        [UP, NB],
+        [6],
+        6,
+    )
+
+
+# Forwarding: RR over the heads, RR over a head's up tunnels, no renormalization
+def test_forwarding():
+    # TWOH(2, 10), N = 2: head 0 has no up tunnel and loses its 6; head 1 delivers 6.
+    g = twoh(2, 10)
+    s = orc.setup(g, [0, 1], [2], 12, 2)
+    delivered, lost, _, _ = orc.lossy(g, s.roster, s.tunnels, 12, caps(g))
+    assert (delivered, lost) == (6, 6)
+    # Shares RR(13, 4) = (4, 3, 3, 3); e0 carries H(6, [4, 3]) = (4, 2).
+    s = orc.setup(PAR612, [0], [1], 12, 4)
+    delivered, lost, per, drops = orc.lossy(
+        PAR612, s.roster, s.tunnels, 13, caps(PAR612)
+    )
+    assert [a for a, _, _ in per] == [4, 3, 3, 3]
+    assert ([d for _, d, _ in per], delivered, lost, drops) == (
+        [4, 2, 3, 3],
+        12,
+        0,
+        [1, 0],
+    )
+
+
+# Lossless admits only totals that give a head without an up tunnel nothing
+def test_lossless_dead_head():
+    # TWOH(2, 10): head 0 is first and down: 0.
+    g = twoh(2, 10)
+    s = orc.setup(g, [0, 1], [2], 12, 2)
+    assert orc.lossless_bound(g, s.roster, s.tunnels, caps(g)) == 0
+    # X8: the same with head 0 behind a zero-capacity link.
+    s = orc.setup(X8, [0, 1], [2], 4, 1)
+    assert orc.lossless_bound(X8, s.roster, s.tunnels, caps(X8)) == 0
+
+
+# The replay roster from the program's basis, not from surviving entries
+def test_replay_roster():
+    # REPLAY: head 0's tunnel e0 fails, head 0 still reaches 2 over e1, e3: it keeps 5 and
+    # loses it; head 1 delivers its 5.
+    s = orc.setup(REPLAY, [0, 1], [2], 10, 1)
+    assert routes(s) == [[0], [2]]
+    roster, st, alive = orc.replay(REPLAY, s.roster, s.tunnels, [2], ([], [0]))
+    assert (roster, st) == ([0, 1], [FAILED, UP])
+    delivered, lost, _, _ = orc.lossy(
+        REPLAY, roster, s.tunnels, 10, caps(REPLAY), alive
+    )
+    assert (delivered, lost) == (5, 5)
+    # The TWOH call's program with e1 masked: head 1 leaves, head 0 keeps the whole 12 and loses it;
+    # the program has up tunnels none can use: NO_ACTIVE_WEIGHT.
+    g = twoh(2, 10)
+    s = orc.setup(g, [0, 1], [2], 12, 2)
+    roster, st, alive = orc.replay(g, s.roster, s.tunnels, [2], ([], [1]))
+    assert (roster, st) == ([0], [NB, FAILED, NB, FAILED])
+    delivered, lost, _, _ = orc.lossy(g, roster, s.tunnels, 12, caps(g), alive)
+    assert (delivered, lost) == (0, 12)
+    assert orc.termination(12, roster, s.tunnels, alive, True, 0) == "NO_ACTIVE_WEIGHT"
+
+
+# One record per entry, down and failed ones included
+def test_records_per_entry():
+    # DIAM5 at D = 14: both down, two zero records.
+    s = orc.setup(DIAM5, [0], [3], 14, 2)
+    assert statuses(s) == [NB, NB]
+    assert orc.records(s.tunnels) == [(0, 0, []), (1, 0, [])]
+    # The TWOH call's program: four records, the up tunnels holding 3 on e1.
+    s = orc.setup(twoh(2, 10), [0, 1], [2], 12, 2)
+    assert orc.records(s.tunnels) == [
+        (0, 0, []),
+        (1, 0, [(1, 3)]),
+        (2, 0, []),
+        (3, 0, [(1, 3)]),
+    ]
+
+
+# ---------------------------------------------------------------- T2
+
+G1 = [(0, 1, 8192, 1), (0, 2, 40960, 1), (1, 3, 8192, 1), (2, 3, 40960, 1)]
+PAR412 = [(0, 1, 4, 1), (0, 1, 12, 1)]
+# A reverse arc: the first unit's cheapest walk 0-1-2-3 (cost 3) blocks every second walk unless the
+# second unit cancels its middle link: 0-2, 2->1 reversed, 1-3 (5 - 1 + 5).
+REVERSE = [(0, 1, 1, 1), (0, 2, 1, 5), (1, 2, 1, 1), (1, 3, 1, 5), (2, 3, 1, 1)]
+DEAD100 = [(h, 101, 0, 1) for h in range(100)] + [(100, 101, 2**61, 1)]
+ROOT_TIE_A = [
+    (0, 2, 1, 1),
+    (0, 4, 1, 1),
+    (1, 2, 1, 1),
+    (1, 5, 1, 1),
+    (2, 3, 1, 1),
+    (4, 3, 1, 1),
+    (5, 3, 1, 1),
+]
+ROOT_TIE_B = [
+    (0, 2, 1, 1),
+    (0, 5, 1, 1),
+    (1, 2, 1, 1),
+    (1, 4, 1, 1),
+    (2, 3, 1, 1),
+    (4, 3, 1, 1),
+    (5, 3, 1, 1),
+]
+FEWEST_A = [(0, 1, 1, 1), (0, 2, 1, 2), (1, 2, 1, 1)]
+FEWEST_B = [(0, 1, 1, 1), (0, 3, 1, 3), (1, 2, 1, 1), (2, 3, 1, 1)]
+CUT_A = [(0, 1, 2, 2), (1, 2, 2, 2), (1, 2, 3, 2)]
+CUT_B = [
+    (0, 2, 1, 1),
+    (1, 2, 1, 1),
+    (2, 3, 1, 1),
+    (2, 4, 1, 1),
+    (3, 5, 1, 1),
+    (4, 5, 1, 1),
+]
+
+
+def x_of(plan, edges):
+    out = [0] * len(edges)
+    for t in plan.tunnels:
+        for e in t.path:
+            out[e] += 1
+    return out
+
+
+# Live heads reach a destination over links with V >= 1
+def test_heads_with_capacity():
+    # A dead head: head 0's only link is 0: dead.
+    assert orc.t2(twoh(0, 10), [0, 1], [2], 2, 10).live == [1]
+    # A tiny head: links 1 and 100: both live (U = 0 does not make a head dead).
+    assert orc.t2(twoh(1, 100), [0, 1], [2], 16).live == [0, 1]
+
+
+# U, the largest integer size passing the quota flow of the live heads
+def test_max_bandwidth_per_tunnel():
+    assert orc.t2(G1, [0], [3], 16, 49152, headroom=True).U == 2925  # G1, design 49152
+    assert orc.t2(twoh(3, 8), [0, 1], [2], 2, 6).U == 1  # Heads behind 3 and 8
+    # A dead head (U = 5 from head 1 alone): the two above have no dead head, which the
+    # misreading "dead heads given quotas" needs.
+    assert orc.t2(twoh(0, 10), [0, 1], [2], 2, 10).U == 5
+
+
+# The fluid share s*, the exact breakpoint V[e] / j
+def test_max_fractional_bandwidth_per_tunnel():
+    # G1, design 49152
+    assert orc.t2(G1, [0], [3], 16, 49152).fluid == Fraction(20480, 7)
+    p = orc.t2(twoh(1, 100), [0, 1], [2], 16)  # A tiny head
+    assert (p.fluid, p.U, p.insufficient, p.tunnels) == (Fraction(1, 16), 0, True, [])
+
+
+# The working size u from the design shares of the whole roster, dead heads included
+def test_working_size():
+    assert orc.t2(twoh(0, 10), [0, 1], [2], 2, 10).u == 3  # A dead head: ceil(5 / 2)
+    assert orc.t2(G1, [0], [3], 16, 8192, headroom=True).u == 512  # G1 design 8192
+
+
+# The minimum route-cost sum J first
+def test_route_cost():
+    # Both tunnels on a cheap link of 2 (u = 1), J = 2.
+    p = orc.t2([(0, 1, 2, 1), (0, 1, 10, 2)], [0], [1], 2, 2, headroom=True)
+    assert (x_of(p, [0, 1]), p.J) == ([2, 0], 2)
+    # G4 design 61440: 15 branches of 4096, 16 tunnels at 2048: J = 32, branch 1 (the smallest keys) gets 2.
+    g4 = [(0, i, 4096, 1) for i in range(1, 16)] + [
+        (i, 16, 4096, 1) for i in range(1, 16)
+    ]
+    p = orc.t2(g4, [0], [16], 16, 61440, headroom=True)
+    assert (p.J, x_of(p, g4)[:3], x_of(p, g4)[15:18]) == (32, [2, 1, 1], [2, 1, 1])
+
+
+# The slot prices floor(2^32 (B - V + j u) / B)
+def test_headroom_prices():
+    # PAR412, N = 2, D = 2 (u = 1): both on the 12-link, 2^32 / 12 + 2^33 / 12 rounded down.
+    p = orc.t2(PAR412, [0], [1], 2, 2, headroom=True)
+    assert (x_of(p, PAR412), p.phi) == ([0, 2], 1073741823)
+    # G1, design 49152
+    assert orc.t2(G1, [0], [3], 16, 49152, headroom=True).phi == 73610035200
+    # A preload: ONE10 with 6 units free, N = 2, D = 4: U = 3, u = 2, the slots pay
+    # floor(2^32 (10 - 6 + 2) / 10) + floor(2^32 (10 - 6 + 4) / 10) = 2576980377 + 3435973836. The
+    # two above have V = B, where the misreading "V in the denominator" gives the same
+    # prices (so has G10 head 0, whose preload equals the static capacities).
+    p = orc.t2(ONE10, [0], [1], 2, 4, V=[6], headroom=True)
+    assert (p.U, p.u, x_of(p, ONE10), p.phi) == (3, 2, [2], 6012954213)
+
+
+# The canonical augmentation: fewest arcs, then the smallest keys, reverse arcs allowed
+def test_canonical_augmentation():
+    g4 = [(0, i, 4096, 1) for i in range(1, 16)] + [
+        (i, 16, 4096, 1) for i in range(1, 16)
+    ]
+    p = orc.t2(g4, [0], [16], 16, 61440, headroom=True)  # G4 design 61440
+    assert [t.path for t in p.tunnels][:3] == [[0, 15], [0, 15], [1, 16]]
+    # G1 without prefer_headroom at D = 8192: the cost tie goes to the smallest keys.
+    assert x_of(orc.t2(G1, [0], [3], 16, 8192), G1) == [16, 0, 16, 0]
+    # A reverse arc: the second unit cancels the first unit's middle link (the two above never need
+    # a reverse arc).
+    p = orc.t2(REVERSE, [0], [3], 2)
+    assert (p.U, x_of(p, REVERSE), [t.path for t in p.tunnels], p.J) == (
+        1,
+        [1, 1, 0, 1, 1],
+        [[0, 3], [1, 4]],
+        12,
+    )
+
+
+# The root keys (1, head NodeId, direction): on a tie at the root the smaller head goes first
+def test_root_key_tie():
+    # Capacities and costs 1, N = 1: every first walk costs 2 with four arcs and every slot pays
+    # 2^32. Head 0 goes first and takes e0 e4 (its smaller link key); head 1 then takes e3 e6 (four
+    # arcs), not e2, e0 reversed, e1, e5 (six). Heads in descending order: e2 e4 and e1 e5.
+    for headroom in (False, True):
+        p = orc.t2(ROOT_TIE_A, [0, 1], [3], 1, headroom=headroom)
+        assert [(t.head, t.path) for t in p.tunnels] == [(0, [0, 4]), (1, [3, 6])]
+    # The same with node 4 and 5 swapped behind the heads: head 0 e0 e4, head 1 e3 e5
+    # (descending: e2 e4 and e1 e6).
+    p = orc.t2(ROOT_TIE_B, [0, 1], [3], 1)
+    assert [(t.head, t.path) for t in p.tunnels] == [(0, [0, 4]), (1, [3, 5])]
+
+
+# Fewest arcs before the keys
+def test_fewest_arcs_before_keys():
+    # e1 (cost 2, one link) ties e0 e2 (1 + 1); three arcs beat four, the keys alone take e0 e2.
+    assert [t.path for t in orc.t2(FEWEST_A, [0], [2], 1).tunnels] == [[1]]
+    # e1 (cost 3) ties e0 e2 e3 (1 + 1 + 1): three arcs beat five.
+    assert [t.path for t in orc.t2(FEWEST_B, [0], [3], 1).tunnels] == [[1]]
+
+
+# The cut into unit walks, sorted, indices j H + i with holes
+def test_program():
+    p = orc.t2(twoh(0, 10), [0, 1], [2], 2, 10)  # A dead head
+    assert [(t.index, t.head, t.path) for t in p.tunnels] == [(1, 1, [1]), (3, 1, [1])]
+    p = orc.t2(twoh(3, 8), [0, 1], [2], 2, 6)  # Heads behind 3 and 8
+    assert [(t.index, t.head, t.round, t.path) for t in p.tunnels] == [
+        (0, 0, 0, [0]),
+        (1, 1, 0, [1]),
+        (2, 0, 1, [0]),
+        (3, 1, 1, [1]),
+    ]
+    # The walks follow the smallest positive EdgeId, live heads ascending. Head 1's units took e1
+    # (cost 2 against head 0's 4), head 0's e0 e2: x = (2, 2, 2); head 0 cuts first, e0 e1 twice,
+    # leaving e2 to head 1 (the largest EdgeId: head 0 e0 e2, head 1 e1).
+    p = orc.t2(CUT_A, [0, 1], [2], 2)
+    assert [(t.head, t.path) for t in p.tunnels] == [
+        (0, [0, 1]),
+        (1, [2]),
+        (0, [0, 1]),
+        (1, [2]),
+    ]
+    # x all ones through node 2: head 0 e0 e2 e4, head 1 e1 e3 e5 (the largest EdgeId swaps the
+    # suffixes).
+    p = orc.t2(CUT_B, [0, 1], [5], 1)
+    assert [(t.head, t.path) for t in p.tunnels] == [(0, [0, 2, 4]), (1, [1, 3, 5])]
+
+
+# F, the program's lossless bound, a dead head's share blocking
+def test_max_lossless_offer():
+    assert orc.t2(twoh(0, 10), [0, 1], [2], 2, 10).F == 0  # A dead head
+    assert (
+        orc.t2([(0, 1, 3, 1), (0, 1, 2, 1)], [0], [1], 2, 5).F == 5
+    )  # The remainder on the first link
+    assert (
+        orc.t2([(0, 1, 2, 1), (0, 1, 3, 1)], [0], [1], 2, 5).F == 4
+    )  # The remainder on the second link
+
+
+# Up to L: the smallest k reaching the live part of D, else the best score, smaller k
+def test_up_to():
+    p = orc.t2(G1, [0], [3], 6, 49152, up_to=True, headroom=True)  # G1 up to 6
+    assert (p.scores, p.count) == ([40960] * 5 + [49152], 6)
+    p = orc.t2(twoh(0, 10), [0, 1], [2], 2, 10, up_to=True)  # Up to, a dead head
+    assert (p.scores, p.count, [t.path for t in p.tunnels]) == ([5, 5], 1, [[1]])
+    # DEAD100, unlimited: equal scores 2^61, no target: the smaller count (the two above reach
+    # their target, which the misreading "the largest k on a tie" never meets).
+    p = orc.t2(DEAD100, list(range(101)), [101], 2, None, up_to=True)
+    assert (p.scores, p.count, p.F) == ([2**61, 2**61], 1, 0)
+
+
+# No tunnels is an installed program keeping the roster
+def test_no_tunnels_keep_roster():
+    # Forwarding without tunnels: a tiny head (U = 0) forwarding 10: 5 lost at each head, COMPLETE.
+    p = orc.t2(twoh(1, 100), [0, 1], [2], 16, 200)
+    roster = orc.program_roster(p)
+    amounts, lost = orc.entry_shares(10, roster, p.tunnels)
+    assert (roster, lost, [orc.rr(10, len(roster), i) for i in range(len(roster))]) == (
+        [0, 1],
+        10,
+        [5, 5],
+    )
+    assert orc.termination(10, roster, p.tunnels, [], True, 0) == "COMPLETE"
+    # Every head dead: TWOH(0, 0): no live head, no tunnel; Lossless EXHAUSTED.
+    p = orc.t2(twoh(0, 0), [0, 1], [2], 2, 10)
+    roster = orc.program_roster(p)
+    assert (p.live, p.tunnels, roster) == ([], [], [0, 1])
+    assert orc.termination(10, roster, p.tunnels, [], False, 0) == "EXHAUSTED"
+
+
+# A dead head's T2 program replayed under masks
+def test_t2_replay_roster():
+    g = twoh(0, 10)
+    p = orc.t2(g, [0, 1], [2], 2, 10)
+    roster, st, alive = orc.replay(g, orc.program_roster(p), p.tunnels, [2], ([], []))
+    delivered, lost, _, _ = orc.lossy(g, roster, p.tunnels, 10, caps(g), alive)
+    assert (roster, st, delivered, lost) == ([0, 1], [UP, UP], 5, 5)
+    roster, st, alive = orc.replay(g, orc.program_roster(p), p.tunnels, [2], ([], [0]))
+    delivered, lost, _, _ = orc.lossy(g, roster, p.tunnels, 10, caps(g), alive)
+    assert (roster, st, delivered, lost) == ([1], [UP, UP], 10, 0)
diff --git a/tests/py/test_units.py b/tests/py/test_units.py
new file mode 100644
index 0000000..5ab2dd7
--- /dev/null
+++ b/tests/py/test_units.py
@@ -0,0 +1,873 @@
+"""to_units (round half up, the only entry of physical numbers) and as_float."""
+
+from __future__ import annotations
+
+import math
+import random
+from decimal import Decimal
+from fractions import Fraction
+
+import numpy as np
+import pytest
+from helpers import exact
+
+import netgraph_core as ngc
+
+
+@pytest.mark.parametrize("q", [2.0**-12, 1.0, 2.0**-32, 2.0**32])
+def test_half_up_boundaries(q):
+    assert ngc.to_units(2.5 * q, q) == 3
+    assert ngc.to_units(0.5 * q, q) == 1
+    assert ngc.to_units(0.49 * q, q) == 0
+    assert ngc.to_units(7.5 * q, q) == 8
+    assert ngc.to_units(math.nextafter(7.5 * q, 0), q) == 7
+    assert ngc.to_units(0.0, q) == 0
+    assert ngc.to_units(-0.0, q) == 0
+    assert ngc.as_float(12345, q) == 12345 * q
+    assert type(ngc.to_units(2.5 * q, q)) is int
+    # The detached array kernel reuses the resolution checked before entry.
+    # These hand-derived values distinguish half-up from floor and ties-to-even.
+    values = [
+        2.5 * q,
+        0.5 * q,
+        0.49 * q,
+        7.5 * q,
+        math.nextafter(7.5 * q, 0),
+        0.0,
+        -0.0,
+    ]
+    assert ngc.to_units(values, q).tolist() == [3, 1, 0, 8, 7, 0, 0]
+    assert ngc.as_float(
+        [0, 1, (1 << 53) + 1, (1 << 53) + 3, -((1 << 53) + 3)], q
+    ).tolist() == [
+        0.0,
+        q,
+        (1 << 53) * q,
+        ((1 << 53) + 4) * q,
+        -((1 << 53) + 4) * q,
+    ]
+
+
+def test_arrays():
+    q = 2.0**-12
+    out = ngc.to_units([0.5 * q, 1.49 * q, 2.5 * q, 1e15], q)
+    assert out.dtype == np.int64
+    assert out.tolist() == [1, 1, 3, 4096 * 10**15]
+    assert ngc.to_units(np.array([1.5, 2.5], dtype=np.float32), 1).tolist() == [2, 3]
+    assert ngc.to_units(np.float64(2.5), 1) == 3
+    assert ngc.to_units(np.array([], dtype=float), 1).tolist() == []
+    assert ngc.as_float([1, 2, 3], 0.5).tolist() == [0.5, 1.0, 1.5]
+    assert ngc.as_float(np.array([4096], dtype=np.int64), q).tolist() == [1.0]
+    # An int gives a float, an integer array a float64 array, also for whole results.
+    assert type(ngc.as_float(4096, q)) is float
+    assert type(ngc.as_float(2**70, 1.0)) is float
+    assert ngc.as_float([1, 2, 3], 1.0).dtype == np.float64
+    assert ngc.as_float(np.array([4096], dtype=np.int64), q).dtype == np.float64
+
+
+def test_rounding_is_per_value_not_additive():
+    # Each value is converted to whole units on its own: two values of 0.6 units give 1 + 1,
+    # their sum 1.2 gives 1.
+    q = 2.0**-12
+    assert ngc.to_units(0.6 * q, q) + ngc.to_units(0.6 * q, q) == 2
+    assert ngc.to_units(1.2 * q, q) == 1
+
+
+def test_exactness_limits():
+    assert ngc.to_units(2.0**62 - 512, 1) == (1 << 62) - 512
+    assert ngc.as_float((1 << 53) + 1, 1) == 2.0**53
+    assert ngc.as_float(1 << 70, 2.0**-12) == 2.0**58
+
+
+NAN = "to_units: NaN has no unit value"
+INFINITE = "to_units: an infinite amount is not finite and has no unit value"
+BOUND = "to_units: the amount is at or above the bound of the units domain (2^62 units)"
+NOT_PHYSICAL = "to_units takes physical numbers (a float or an array of floats)"
+RESOLUTION = "resolution must be a power of two in [2^-32, 2^32]"
+
+
+# A value outside the domain is a ValueError; a type to_units never takes (a string, a bool, an
+# array of another dtype or rank) a TypeError.
+@pytest.mark.parametrize(
+    "x, cls, message",
+    [
+        (float("nan"), ValueError, NAN),
+        (float("inf"), ValueError, INFINITE),
+        (-float("inf"), ValueError, INFINITE),
+        (-1e-300, ValueError, "to_units: a negative amount has no unit value"),
+        (2.0**62, ValueError, BOUND),
+        ([1.0, float("nan")], ValueError, NAN),
+        ("1.0", TypeError, NOT_PHYSICAL),
+        (b"1.0", TypeError, NOT_PHYSICAL),
+        (True, TypeError, NOT_PHYSICAL),
+        (np.True_, TypeError, NOT_PHYSICAL),
+        (["a"], TypeError, "to_units takes physical numbers (got dtype <U1)"),
+        (
+            np.array([True]),
+            TypeError,
+            "to_units takes physical numbers (got dtype bool)",
+        ),
+        (
+            np.zeros((1, 1)),
+            TypeError,
+            "to_units takes a float or a 1-D array of floats",
+        ),
+        ([[1.0]], TypeError, "to_units takes a float or a 1-D array of floats"),
+    ],
+)
+def test_rejected(x, cls, message):
+    with pytest.raises((TypeError, ValueError), match=exact(message)) as error:
+        ngc.to_units(x, 1)
+    assert error.type is cls
+
+
+@pytest.mark.parametrize("q", [True, False, np.True_, np.False_])
+def test_a_bool_resolution_is_a_wrong_type(q):
+    # A bool at a numeric position is a TypeError (pybind11's text for incompatible arguments),
+    # never read as 1.0 or 0.0; an int resolution is still taken.
+    for call in (
+        lambda: ngc.to_units(1.0, q),
+        lambda: ngc.as_float(1, q),
+        lambda: ngc.Graph(2, [0], [1], [1], [1], q),
+    ):
+        with pytest.raises(
+            TypeError, match="incompatible (function|constructor) arguments"
+        ) as error:
+            call()
+        assert error.type is TypeError
+    assert ngc.to_units(1.0, 1) == 1 and ngc.as_float(1, 1) == 1.0
+    assert ngc.Graph(2, [0], [1], [1], [1], 1).resolution() == 1.0
+
+
+def test_resolution_validated():
+    for q in (3.0, 2.0**-33, 2.0**33, 0.0, -1.0, math.nan, math.inf):
+        with pytest.raises(ValueError, match=exact(RESOLUTION)):
+            ngc.to_units(1.0, q)
+        with pytest.raises(ValueError, match=exact(RESOLUTION)):
+            ngc.as_float(1, q)
+    with pytest.raises(ValueError, match=exact(BOUND)):
+        ngc.to_units(1.7976931348623157e308, 2.0**32)
+
+
+def test_as_float_rejects_non_integers():
+    with pytest.raises(
+        TypeError, match=exact("as_float: x must be an integer (got float)")
+    ):
+        ngc.as_float(1.5, 1)
+    with pytest.raises(
+        TypeError,
+        match=exact("as_float: x entries must be integers (got dtype float64)"),
+    ):
+        ngc.as_float(np.array([1.5]), 1)
+
+
+@pytest.mark.parametrize("q", [0.0, 3.0, math.nan, 2.0**33, -1.0, math.inf])
+@pytest.mark.parametrize(
+    "empty", [[], (), np.array([], dtype=np.float64), np.array([], dtype=np.int64)]
+)
+def test_empty_arrays_validate_the_resolution(q, empty):
+    # The resolution is validated before the shape, also for empty input.
+    with pytest.raises(ValueError, match=exact(RESOLUTION)):
+        ngc.to_units(empty, q)
+    with pytest.raises(ValueError, match=exact(RESOLUTION)):
+        ngc.as_float(empty, q)
+    assert ngc.to_units(empty, 1.0).tolist() == []
+    if isinstance(empty, np.ndarray) and empty.dtype.kind == "f":
+        with pytest.raises(  # not units, even when empty
+            TypeError,
+            match=exact("as_float: x entries must be integers (got dtype float64)"),
+        ):
+            ngc.as_float(empty, 1.0)
+    else:
+        assert ngc.as_float(empty, 1.0).tolist() == []
+
+
+@pytest.mark.parametrize(
+    "x, q",
+    [
+        (2**1024, 2.0**-32),
+        (-(2**1024), 2.0**-32),
+        (2**1024 - 1, 2.0**-32),
+        (2**1055 + 3, 2.0**-32),
+        (2**64 + 1, 1.0),
+        (2**63, 2.0**-12),
+        (3 * 2**900 + 1, 2.0**32),
+        ((1 << 63) - 1, 2.0**-32),
+    ],
+)
+def test_as_float_unbounded_ints_are_correctly_rounded(x, q):
+    # Python Amounts are unbounded; the scaled value is the correctly rounded
+    # double of the exact product, and no Python error leaks.
+    expect = float(Fraction(x) * Fraction(q))
+    assert ngc.as_float(x, q) == expect
+    assert ngc.as_float([x, 1], q).tolist() == [expect, q]
+    assert ngc.as_float(np.int64(1), q) == q
+
+
+def test_as_float_beyond_the_finite_doubles():
+    def beyond(x):
+        return exact(
+            f"as_float: {x} units times the resolution exceed the largest finite double"
+        )
+
+    with pytest.raises(ValueError, match=beyond(2**1100)):
+        ngc.as_float(2**1100, 2.0**32)
+    with pytest.raises(ValueError, match=beyond(-(2**1100))):
+        ngc.as_float([1, -(2**1100)], 1.0)
+    assert ngc.as_float(np.array([2**64 - 1], dtype=np.uint64), 1.0).tolist() == [
+        2.0**64
+    ]
+
+
+class _IndexFails:
+    def __index__(self):
+        raise ZeroDivisionError("own index")
+
+
+class _FloatFails(np.float32):
+    # A NumPy floating value whose own conversion to a float fails.
+    def __float__(self):
+        raise ZeroDivisionError("own float")
+
+
+class _Index:
+    # An integer known only by Python's integer protocol.
+    def __init__(self, n):
+        self.n = n
+
+    def __index__(self):
+        return self.n
+
+
+class _FloatOnly:
+    # A number by duck typing alone: not a type a number position takes.
+    def __float__(self):
+        return 1.0
+
+
+class _FloatAndIndex:
+    def __float__(self):
+        return 1.0
+
+    def __index__(self):
+        return 2
+
+
+# The physical-number boundaries of the one rule for error classes: an accepted type with a value
+# outside the domain is a ValueError, a type the position never takes a TypeError, whatever the
+# position (a value to convert, a resolution).
+PHYSICAL_BOUNDARIES = {
+    "large Python int": (lambda: ngc.to_units(2**64, 1.0), ValueError),
+    "large Python int in list": (lambda: ngc.to_units([2**64], 1.0), ValueError),
+    "large negative Python int in list": (
+        lambda: ngc.to_units([1, -(2**70)], 1.0),
+        ValueError,
+    ),
+    "large int beside a float": (lambda: ngc.to_units([2**64, 1.5], 1.0), ValueError),
+    "float beside a large negative int": (
+        lambda: ngc.to_units([1.5, -(2**70)], 1.0),
+        ValueError,
+    ),
+    "large int beside a NumPy float": (
+        lambda: ngc.to_units([2**70, np.float32(1.5)], 1.0),
+        ValueError,
+    ),
+    "large object-dtype ndarray": (
+        lambda: ngc.to_units(np.array([2**64], dtype=object), 1.0),
+        TypeError,
+    ),
+    "large int beside None": (lambda: ngc.to_units([2**64, None], 1.0), TypeError),
+    "mixed Python bool": (lambda: ngc.to_units([True, 1.0], 1.0), TypeError),
+    "mixed NumPy bool": (lambda: ngc.to_units([1, np.True_], 1.0), TypeError),
+    "Graph Fraction resolution": (
+        lambda: ngc.Graph(2, [0], [1], [1], [1], Fraction(1)),
+        TypeError,
+    ),
+    "to_units Fraction resolution": (
+        lambda: ngc.to_units(1.0, Fraction(1)),
+        TypeError,
+    ),
+    "as_float Fraction resolution": (lambda: ngc.as_float(1, Fraction(1)), TypeError),
+    "to_units Decimal resolution": (
+        lambda: ngc.to_units(1.0, Decimal(1)),
+        TypeError,
+    ),
+    "Graph Decimal resolution": (
+        lambda: ngc.Graph(2, [0], [1], [1], [1], Decimal(1)),
+        TypeError,
+    ),
+    "as_float Decimal resolution": (lambda: ngc.as_float(1, Decimal(1)), TypeError),
+    "Graph __float__ resolution": (
+        lambda: ngc.Graph(2, [0], [1], [1], [1], _FloatOnly()),
+        TypeError,
+    ),
+    "to_units __float__ resolution": (
+        lambda: ngc.to_units(2.0, _FloatOnly()),
+        TypeError,
+    ),
+    "as_float __float__ resolution": (
+        lambda: ngc.as_float(1, _FloatOnly()),
+        TypeError,
+    ),
+    "Graph __float__ and __index__ resolution": (
+        lambda: ngc.Graph(2, [0], [1], [1], [1], _FloatAndIndex()),
+        TypeError,
+    ),
+    "to_units __float__ and __index__ resolution": (
+        lambda: ngc.to_units(2.0, _FloatAndIndex()),
+        TypeError,
+    ),
+    "as_float __float__ and __index__ resolution": (
+        lambda: ngc.as_float(1, _FloatAndIndex()),
+        TypeError,
+    ),
+    "Decimal entry": (lambda: ngc.to_units([Decimal(1), 1.0], 1.0), TypeError),
+    "__index__ value": (lambda: ngc.to_units(_Index(1), 1.0), TypeError),
+    "as_float Decimal entry": (lambda: ngc.as_float([Decimal(1)], 1.0), TypeError),
+    "Fraction value": (lambda: ngc.to_units(Fraction(1, 2), 1.0), TypeError),
+    "Graph huge integer resolution": (
+        lambda: ngc.Graph(2, [0], [1], [1], [1], 2**1024),
+        ValueError,
+    ),
+    "to_units huge integer resolution": (
+        lambda: ngc.to_units(1.0, 2**1024),
+        ValueError,
+    ),
+    "as_float huge integer resolution": (lambda: ngc.as_float(1, 2**1024), ValueError),
+    "as_float huge negative integer resolution": (
+        lambda: ngc.as_float(1, -(2**1024)),
+        ValueError,
+    ),
+}
+
+
+@pytest.mark.parametrize(
+    ("call", "cls"), PHYSICAL_BOUNDARIES.values(), ids=PHYSICAL_BOUNDARIES.keys()
+)
+def test_physical_boundaries(call, cls):
+    with pytest.raises((TypeError, ValueError)) as error:
+        call()
+    assert error.type is cls
+    if cls is ValueError and "resolution" in str(error.value):
+        assert str(error.value) == RESOLUTION
+
+
+@pytest.mark.parametrize(
+    "x", [[True, False], (np.True_, np.False_), [True]], ids=["list", "numpy", "one"]
+)
+def test_an_all_bool_sequence_keeps_its_dtype_text(x):
+    # A nonnumeric dtype is a type defect; its text names NumPy's dtype.
+    with pytest.raises(
+        TypeError, match=exact("to_units takes physical numbers (got dtype bool)")
+    ) as error:
+        ngc.to_units(x, 1.0)
+    assert error.type is TypeError
+
+
+def test_physical_inputs_still_taken():
+    # The accepted types at each position: NumPy numbers as resolutions, an exact int (2^63 fits
+    # NumPy's uint64), floats beside ints.
+    for q in (np.float32(0.5), np.float64(2.0), np.int64(4), 8):
+        assert ngc.to_units(8.0, q) == int(8 / float(q))
+        assert ngc.as_float(1, q) == float(q)
+    assert ngc.to_units(2**40, 2.0**-12) == 2**52
+    assert ngc.to_units([2**40, 1.5], 1.0).tolist() == [2**40, 2]
+    assert ngc.Graph(2, [0], [1], [1], [1], np.float64(1.0)).resolution() == 1.0
+    assert ngc.as_float(np.int64(3), 1.0) == 3.0
+    assert ngc.as_float([np.int64(1), 2], 1.0).tolist() == [1.0, 2.0]
+    # as_float's amount is an integer position: Python's integer protocol, as elsewhere.
+    assert ngc.as_float(_Index(3), 1.0) == 3.0
+    assert ngc.as_float([1, _Index(3)], 1.0).tolist() == [1.0, 3.0]
+    g = ngc.Graph(_Index(2), [_Index(0)], [1], [_Index(5)], [1], 1.0)
+    assert g.eligibility(excluded_nodes=[_Index(1)]).node_allowed().tolist() == [
+        True,
+        False,
+    ]
+    # A resolution's own conversion that fails passes through unchanged; an object known only by
+    # __index__ is not a number type, refused before any conversion.
+    with pytest.raises(ZeroDivisionError, match="own float"):
+        ngc.to_units(1.0, _FloatFails(1.0))
+    with pytest.raises(TypeError, match="incompatible function arguments"):
+        ngc.to_units(1.0, _IndexFails())
+
+
+# Exact binary values, the last half-unit tie, promotion, round trips and signed products.
+# Expectations are fixed arithmetic witnesses, independent of the production converter.
+UNITS_EXAMPLES = [
+    pytest.param(
+        [
+            {"op": "to_units", "x": 5501195.1796, "q": ["pow2", -21]},
+            {"op": "error", "x": 5501195.1796, "q": ["pow2", -21]},
+            {
+                "op": "to_units",
+                "x": math.nextafter(5501195.1796, 0.0),
+                "q": ["pow2", -21],
+            },
+        ],
+        [
+            11536842473289,
+            dict(
+                units=11536842473289,
+                error="1/2",
+                inside=True,
+                error_against_argument="1/2",
+            ),
+            11536842473288,
+        ],
+        id="UNITS-literal-tie",
+    ),
+    pytest.param(
+        [
+            {"op": "to_units", "x": 400 + 2 ** (-19), "q": ["pow2", -18]},
+            {"op": "error", "x": 400 + 2 ** (-19), "q": ["pow2", -18]},
+            {"op": "to_units", "x": 400.0, "q": ["pow2", -18]},
+        ],
+        [
+            104857601,
+            dict(
+                units=104857601, error="1/2", inside=True, error_against_argument="1/2"
+            ),
+            104857600,
+        ],
+        id="UNITS-computed-tie",
+    ),
+    pytest.param(
+        [
+            {"op": "to_units", "x": ["numpy", "float32", 0.1], "q": ["pow2", -32]},
+            {
+                "op": "to_units",
+                "x": ["array", "float32", [0.1, 0.1]],
+                "q": ["pow2", -32],
+            },
+            {"op": "error", "x": ["numpy", "float32", 0.1], "q": ["pow2", -32]},
+            {"op": "to_units", "x": ["numpy", "float64", 0.1], "q": ["pow2", -32]},
+            {"op": "to_units", "x": 0.1, "q": ["pow2", -32]},
+        ],
+        [
+            429496736,
+            [429496736, 429496736],
+            dict(units=429496736, error="0", inside=True, error_against_argument="0"),
+            429496730,
+            429496730,
+        ],
+        id="UNITS-float32",
+    ),
+    pytest.param(
+        [
+            {"op": "to_units", "x": 2 ** (-33), "q": ["pow2", -32]},
+            {
+                "op": "to_units",
+                "x": math.nextafter(2 ** (-33), 0.0),
+                "q": ["pow2", -32],
+            },
+            {"op": "to_units", "x": 2.0**31, "q": ["pow2", 32]},
+            {"op": "to_units", "x": 0.5, "q": 1.0},
+            {"op": "to_units", "x": 1.5, "q": 1.0},
+            {"op": "to_units", "x": 2.5, "q": 1.0},
+            {"op": "to_units", "x": 3.5, "q": 1.0},
+            {"op": "to_units", "x": 2.0**52 - 0.5, "q": 1.0},
+            {"op": "to_units", "x": 2.0**52 + 1, "q": 1.0},
+            {"op": "to_units", "x": 2.0**53 + 2, "q": 1.0},
+            {"op": "to_units", "x": -0.0, "q": 1.0},
+            {"op": "to_units", "x": 5e-324, "q": ["pow2", 32]},
+        ],
+        [1, 0, 1, 1, 2, 3, 4, 2**52, 2**52 + 1, 2**53 + 2, 0, 0],
+        id="UNITS-ties",
+    ),
+    pytest.param(
+        [
+            {"op": "round_trip", "u": 2**53, "q": 1.0},
+            {"op": "round_trip", "u": 2**53, "q": ["pow2", -32]},
+            {"op": "round_trip", "u": 2**53, "q": ["pow2", 32]},
+            {"op": "round_trip", "u": 2**53 + 1, "q": 1.0},
+            {"op": "as_float", "u": 2**53 + 1, "q": 1.0},
+            {"op": "round_trip", "u": 2**53 + 2, "q": 1.0},
+            {"op": "round_trip", "u": 2**62 - 2**9, "q": ["pow2", -32]},
+            {"op": "round_trip", "u": 2**62 - 1, "q": 1.0},
+            {"op": "round_trip", "u": 120401795907070192, "q": ["pow2", -27]},
+        ],
+        [
+            2**53,
+            2**53,
+            2**53,
+            2**53,
+            9007199254740992.0,
+            2**53 + 2,
+            2**62 - 2**9,
+            "ValueError: to_units: the amount is at or above the bound of the units domain (2^62 units)",
+            120401795907070192,
+        ],
+        id="UNITS-round-trip",
+    ),
+    pytest.param(
+        [
+            {"op": "error", "x": 2**53 + 1, "q": 1.0},
+            {"op": "error", "x": 2**53 + 3, "q": 1.0},
+            {"op": "to_units", "x": ["list", 2**53 + 1, 2**53 + 3], "q": 1.0},
+        ],
+        [
+            dict(units=2**53, error="0", inside=True, error_against_argument="-1"),
+            dict(units=2**53 + 4, error="0", inside=True, error_against_argument="1"),
+            [2**53, 2**53 + 4],
+        ],
+        id="UNITS-promoted-integer",
+    ),
+    pytest.param(
+        [
+            {"op": "as_float", "u": -1, "q": 0.5},
+            {"op": "as_float", "u": 2**53 + 3, "q": 1.0},
+            {"op": "as_float", "u": 2**70 + 1, "q": 1.0},
+            {"op": "as_float", "u": 2**1024 - 2**970 - 1, "q": 1.0},
+            {"op": "as_float", "u": 2**1024 - 2**970, "q": 1.0},
+            {"op": "as_float", "u": -(2**1024 - 2**970 - 1), "q": 1.0},
+            {"op": "as_float", "u": (2**1024 - 2**970) * 2**32 - 1, "q": ["pow2", -32]},
+            {"op": "as_float", "u": (2**1024 - 2**970) * 2**32, "q": ["pow2", -32]},
+        ],
+        [
+            -0.5,
+            9007199254740996.0,
+            1.1805916207174113e21,
+            1.7976931348623157e308,
+            f"ValueError: as_float: {2**1024 - 2**970} units times the resolution exceed the largest finite double",
+            -1.7976931348623157e308,
+            1.7976931348623157e308,
+            f"ValueError: as_float: {(2**1024 - 2**970) * 2**32} units times the resolution exceed the largest finite double",
+        ],
+        id="UNITS-as-float-range",
+    ),
+    pytest.param(
+        [
+            {"op": "sum", "xs": [0.5, 0.5], "q": 1.0},
+            {"op": "sum", "xs": [0.25, 0.25], "q": 1.0},
+        ],
+        [
+            dict(units=[1, 1], sum_of_units=2, total="1", units_of_total=1),
+            dict(units=[0, 0], sum_of_units=0, total="1/2", units_of_total=1),
+        ],
+        id="UNITS-sums",
+    ),
+]
+
+
+def _units_input(spec):
+    if not isinstance(spec, list):
+        return spec
+    if spec[0] == "pow2":
+        return 2.0 ** spec[1]
+    if spec[0] == "numpy":
+        return getattr(np, spec[1])(spec[2])
+    if spec[0] == "array":
+        return np.array(spec[2], dtype=spec[1])
+    assert spec[0] == "list"
+    return spec[1:]
+
+
+def _units_to_python(value):
+    if isinstance(value, np.ndarray):
+        assert value.dtype == np.int64
+        assert value.ndim == 1
+        return value.tolist()
+    assert type(value) is int
+    return value
+
+
+def _units_example(cases):
+    results = []
+    for case in cases:
+        q = _units_input(case["q"])
+        op = case["op"]
+        try:
+            if op == "to_units":
+                result = _units_to_python(ngc.to_units(_units_input(case["x"]), q))
+            elif op == "as_float":
+                result = ngc.as_float(case["u"], q)
+                assert type(result) is float
+            elif op == "round_trip":
+                result = ngc.to_units(ngc.as_float(case["u"], q), q)
+                assert type(result) is int
+            elif op == "error":
+                a = _units_input(case["x"])
+                b = float(a)
+                u = ngc.to_units(a, q)
+                value = Fraction(ngc.as_float(u, q))
+                error = (value - Fraction(b)) / Fraction(q)
+                exact_argument = Fraction(a) if isinstance(a, int) else Fraction(b)
+                result = dict(
+                    units=u,
+                    error=str(error),
+                    inside=-Fraction(1, 2) < error <= Fraction(1, 2),
+                    error_against_argument=str((value - exact_argument) / Fraction(q)),
+                )
+            else:
+                assert op == "sum"
+                xs = case["xs"]
+                each = _units_to_python(ngc.to_units(xs, q))
+                total = sum(map(Fraction, xs), Fraction(0))
+                result = dict(
+                    units=each,
+                    sum_of_units=sum(each),
+                    total=str(total / Fraction(q)),
+                    units_of_total=ngc.to_units(float(total), q),
+                )
+        except ValueError as exc:
+            result = f"ValueError: {exc}"
+        results.append(result)
+    return results
+
+
+def _assert_units_result(got, expected):
+    # Equality alone lets 1, True and 1.0 pass interchangeably; pin the types and every key.
+    assert type(got) is type(expected), (got, expected)
+    if isinstance(expected, dict):
+        assert got.keys() == expected.keys()
+        for key in expected:
+            _assert_units_result(got[key], expected[key])
+    elif isinstance(expected, list):
+        assert len(got) == len(expected)
+        for value, want in zip(got, expected, strict=True):
+            _assert_units_result(value, want)
+    else:
+        assert got == expected
+
+
+@pytest.mark.parametrize("cases, expected", UNITS_EXAMPLES)
+def test_binary64_examples(cases, expected):
+    _assert_units_result(_units_example(cases), expected)
+
+
+def _exact_binary_units(b, q):
+    # An independent rational oracle: never calls a production conversion helper.
+    return math.floor(Fraction(b) / Fraction(q) + Fraction(1, 2))
+
+
+def _units_sweep():
+    rng = random.Random(10)
+    counts = dict.fromkeys(
+        [
+            "checked",
+            "agree",
+            "ties",
+            "ties_up",
+            "inside",
+            "decimal_differs",
+            "round_trips",
+            "returned",
+        ],
+        0,
+    )
+
+    def one(b, q, tie_n=None):
+        expected = _exact_binary_units(b, q)
+        u = ngc.to_units(b, q)
+        assert type(u) is int
+        assert u == expected, (b, q, u, expected)
+        # The array kernel must obey the same rule, including both ndarray ranks.
+        assert ngc.to_units(np.array(b), q) == expected
+        array = ngc.to_units([b, b], q)
+        assert array.dtype == np.int64 and array.tolist() == [expected, expected]
+        array = ngc.to_units(np.array([b, 0.0, b])[::2], q)
+        assert array.dtype == np.int64 and array.tolist() == [expected, expected]
+        counts["checked"] += 1
+        counts["agree"] += u == expected
+        if tie_n is not None:
+            assert expected == tie_n + 1
+            counts["ties"] += 1
+            counts["ties_up"] += u == tie_n + 1
+        value = ngc.as_float(u, q)
+        assert type(value) is float
+        assert Fraction(value) == Fraction(u) * Fraction(q)
+        assert ngc.as_float([u, u], q).tolist() == [value, value]
+        e = Fraction(value) - Fraction(b)
+        assert -Fraction(q) / 2 < e <= Fraction(q) / 2
+        counts["inside"] += 1
+        counts["decimal_differs"] += (
+            math.floor(Fraction(str(b)) / Fraction(q) + Fraction(1, 2)) != expected
+        )
+
+    for k in range(-32, 33):
+        q = 2.0**k
+        ns = [0, 1, 2**26, 2**52 - 1] + [rng.randrange(2**52) for _ in range(64)]
+        for n in ns:
+            tie = (2 * n + 1) * q / 2
+            one(tie, q, n)
+            one(math.nextafter(tie, 0.0), q)
+            one(math.nextafter(tie, math.inf), q)
+        for edge in (2**52, 2**53):
+            one(edge * q, q)
+            one(math.nextafter(edge * q, 0.0), q)
+        one(5e-324, q)
+        for _ in range(64):
+            one(math.ldexp(rng.random(), rng.randrange(-40, 63)) * q, q)
+        for u in [0, 1, 2**53 - 1, 2**53] + [
+            rng.randrange(2**53 + 1) for _ in range(64)
+        ]:
+            value = ngc.as_float(u, q)
+            assert Fraction(value) == Fraction(u) * Fraction(q)
+            returned = ngc.to_units(value, q)
+            assert returned == u
+            counts["round_trips"] += 1
+            counts["returned"] += returned == u
+    return counts
+
+
+def test_binary64_double_steps():
+    _assert_units_result(
+        _units_sweep(),
+        dict(
+            checked=17745,
+            agree=17745,
+            ties=4420,
+            ties_up=4420,
+            inside=17745,
+            decimal_differs=2248,
+            round_trips=4420,
+            returned=4420,
+        ),
+    )
+
+
+@pytest.mark.parametrize("dtype", [np.float32, np.float64])
+def test_binary64_float32_containers(dtype):
+    # float32 promotion is exact; the shortest decimal of the source float32 is not its value.
+    value = dtype(0.1)
+    expected = 429496736 if dtype is np.float32 else 429496730
+    q = 2.0**-32
+    assert ngc.to_units(value, q) == expected
+    assert ngc.to_units(float(value), q) == expected
+    assert ngc.to_units(np.array(value), q) == expected
+    for values in (
+        [value, value],
+        (value, value),
+        np.array([value, value], dtype=dtype),
+    ):
+        result = ngc.to_units(values, q)
+        assert result.dtype == np.int64
+        assert result.tolist() == [expected, expected]
+
+
+@pytest.mark.parametrize("q", [2.0**k for k in range(-32, 33)])
+def test_binary64_signed_round_trip_and_refusal(q):
+    # Both directions around the consecutive-integer limit; vector and scalar paths.
+    for u in [
+        -(2**53 + 3),
+        -(2**53 + 1),
+        -(2**53),
+        -1,
+        0,
+        1,
+        2**53,
+        2**53 + 1,
+        2**53 + 3,
+    ]:
+        expected = float(Fraction(u) * Fraction(q))
+        assert ngc.as_float(u, q) == expected
+        assert ngc.as_float([u, u], q).tolist() == [expected, expected]
+    with pytest.raises(ValueError, match=exact(BOUND)):
+        ngc.to_units(ngc.as_float(2**62 - 1, q), q)
+    assert ngc.to_units(ngc.as_float(2**62 - 512, q), q) == 2**62 - 512
+
+
+@pytest.mark.parametrize("q", [1.0, 2.0**-32])
+@pytest.mark.parametrize("sign", [-1, 1])
+def test_binary64_unbounded_finite_edge(q, sign):
+    first_invalid = (2**1024 - 2**970) * (1 if q == 1.0 else 2**32)
+    last_valid = sign * (first_invalid - 1)
+    expected = sign * float.fromhex("0x1.fffffffffffffp+1023")
+    assert ngc.as_float(last_valid, q) == expected
+    result = ngc.as_float([1, last_valid], q)
+    assert result.dtype == np.float64 and result.tolist() == [q, expected]
+    u = sign * first_invalid
+    message = exact(
+        f"as_float: {u} units times the resolution exceed the largest finite double"
+    )
+    for value in (u, [1, u]):
+        with pytest.raises(ValueError, match=message) as error:
+            ngc.as_float(value, q)
+        assert error.type is ValueError
+
+
+class _IntegerSequence(int):
+    def __len__(self):
+        return 2
+
+    def __getitem__(self, index):
+        if index in (0, 1):
+            return (3, 4)[index]
+        raise IndexError(index)
+
+
+class _NumpySignedSequence(np.int64):
+    __len__ = _IntegerSequence.__len__
+    __getitem__ = _IntegerSequence.__getitem__
+
+
+class _NumpyUnsignedSequence(np.uint64):
+    __len__ = _IntegerSequence.__len__
+    __getitem__ = _IntegerSequence.__getitem__
+
+
+@pytest.mark.parametrize(
+    "scalar_type", [_IntegerSequence, _NumpySignedSequence, _NumpyUnsignedSequence]
+)
+def test_as_float_integer_scalar_precedes_sequence(scalar_type):
+    value = scalar_type(7)
+    result = ngc.as_float(value, 0.5)
+    assert type(result) is float
+    assert result == 3.5
+    assert result.hex() == (3.5).hex()
+
+
+def test_as_float_noninteger_sequence_keeps_its_path():
+    class IndexSequence(list):
+        def __index__(self):
+            return 7
+
+    result = ngc.as_float(IndexSequence([3, 4]), 0.5)
+    assert type(result) is np.ndarray
+    assert result.dtype == np.float64 and result.shape == (2,)
+    assert result.tolist() == [1.5, 2.0]
+
+
+@pytest.mark.parametrize("dtype", [np.int64, np.uint64])
+def test_as_float_integer_array_paths_are_unchanged(dtype):
+    with pytest.raises(
+        TypeError,
+        match=exact("as_float: x must be a 1-D array (got 0 dimensions)"),
+    ):
+        ngc.as_float(np.array(7, dtype=dtype), 0.5)
+    result = ngc.as_float(np.array([3, 4], dtype=dtype), 0.5)
+    assert type(result) is np.ndarray
+    assert result.dtype == np.float64 and result.shape == (2,)
+    assert result.tolist() == [1.5, 2.0]
+    with pytest.raises(
+        TypeError,
+        match=exact("as_float: x must be a 1-D array (got 2 dimensions)"),
+    ):
+        ngc.as_float(np.array([[7]], dtype=dtype), 0.5)
+
+
+@pytest.mark.parametrize("value", [True, False, np.True_, np.False_])
+def test_as_float_scalar_classification_still_rejects_bool(value):
+    with pytest.raises(TypeError):
+        ngc.as_float(value, 0.5)
+    assert ngc.as_float(1, 0.5) == 0.5
+
+
+@pytest.mark.parametrize("dtype", [np.int64, np.uint64])
+@pytest.mark.parametrize(
+    "value, expected", [(2**53 + 1, 2**53), (2**53 + 3, 2**53 + 4)]
+)
+def test_to_units_integer_zero_dimensional_array_promotes(dtype, value, expected):
+    result = ngc.to_units(np.array(value, dtype=dtype), 1.0)
+    assert type(result) is int
+    assert result == expected
+
+
+@pytest.mark.parametrize("dtype", [np.int64, np.uint64])
+def test_to_units_integer_array_promotes(dtype):
+    values = np.array([2**53 + 1, 2**53 + 3], dtype=dtype)
+    result = ngc.to_units(values, 1.0)
+    assert type(result) is np.ndarray
+    assert result.shape == (2,)
+    assert result.dtype == np.int64
+    assert result.tolist() == [2**53, 2**53 + 4]
diff --git a/tests/py/test_weighted_sources.py b/tests/py/test_weighted_sources.py
new file mode 100644
index 0000000..793b7de
--- /dev/null
+++ b/tests/py/test_weighted_sources.py
@@ -0,0 +1,830 @@
+"""Prescribed source quotas, captured-weight replay and independent integer witnesses."""
+
+import copy
+import gc
+import itertools
+import json
+import math
+import random
+from fractions import Fraction
+from pathlib import Path
+
+import numpy as np
+import pytest
+from helpers import build, config, dag_of, exact, ledger_state, plain
+
+import netgraph_core as n
+
+CASES = json.loads(
+    (Path(__file__).parents[1] / "data/weighted_sources.json").read_text()
+)
+M = 2**62 - 1
+OUT = n.OutputOptions(
+    edge_flows=True,
+    residual=True,
+    edge_reservations=True,
+    saturated_boundary_edges=True,
+    min_cut=True,
+)
+
+
+def weighted(weights, **kwargs):
+    return config(
+        n.CentralizedTE(
+            source_allocation=n.SourceAllocation.WEIGHTED,
+            source_weights=weights,
+            **kwargs,
+        )
+    )
+
+
+def ha(total, weights):
+    """Independent exact rational priorities; no library allocation helpers."""
+    if not sum(weights):
+        return [0] * len(weights)
+    a = [total * w // sum(weights) for w in weights]
+    for _ in range(total - sum(a)):
+        i = max(range(len(a)), key=lambda j: (Fraction(weights[j], a[j] + 1), -j))
+        a[i] += 1
+    return a
+
+
+def sequential(total, weights):
+    a = [0] * len(weights)
+    for _ in range(total if any(weights) else 0):
+        i = max(range(len(a)), key=lambda j: (Fraction(weights[j], a[j] + 1), -j))
+        a[i] += 1
+    return a
+
+
+def subset(got, want):
+    """Strict recursive schema/value comparison of the promised fixture fields."""
+    if isinstance(want, dict):
+        assert isinstance(got, dict)
+        assert want.keys() <= got.keys()
+        for key, value in want.items():
+            subset(got[key], value)
+    elif isinstance(want, list):
+        assert type(got) is list and len(got) == len(want)
+        for a, b in zip(got, want, strict=True):
+            subset(a, b)
+    else:
+        assert type(got) is type(want) and got == want
+
+
+def decode(value):
+    if not isinstance(value, list):
+        return value
+    tag, *args = value
+    if tag == "list":
+        return [decode(x) for x in args]
+    if tag == "range":
+        return range(*args)
+    if tag == "array":
+        return np.array(args[1], dtype=args[0])
+    if tag == "numpy":
+        return getattr(np, args[0])(args[1])
+    if tag in ("bool", "str"):
+        return args[0]
+    raise AssertionError(value)
+
+
+def config_case(case):
+    kw = dict(case["kwargs"])
+    for name in ("source_weights", "edge_weights"):
+        if name in kw:
+            kw[name] = decode(kw[name])
+    for name, enum in (
+        ("source_allocation", n.SourceAllocation),
+        ("allocation", n.RouteAllocation),
+    ):
+        if name in kw:
+            kw[name] = getattr(enum, kw[name])
+    if "tunnel_count" in kw:
+        kw["tunnel_count"] = n.TunnelCount(int(kw["tunnel_count"]))
+    try:
+        model = getattr(n, case["model"])(**kw)
+    except (TypeError, ValueError) as error:
+        return f"{type(error).__name__}: {error}"
+    g = build(case.get("num_nodes", 4), [(0, 3, 10, 1), (1, 3, 10, 1)])
+    try:
+        n.FlowPolicy(
+            n.FlowLedger(g),
+            [0, 1],
+            3,
+            config(
+                model, admission=getattr(n.Admission, case.get("admission", "LOSSLESS"))
+            ),
+            cache=n.ShortestPathCache(g) if case.get("cache") else None,
+        )
+    except ValueError as error:
+        return str(error)
+    return (
+        f"source_allocation={model.source_allocation.name} support=None tunnel_count=None"
+        f" prefer_headroom=False source_weights={list(model.source_weights)}"
+    )
+
+
+def run_case(case):
+    data = case["input"]
+    if case["oracle"] == "model_config":
+        return [config_case(c) for c in data["cases"]]
+    if case["oracle"] == "weighted_equal":
+        g = build(4, data["edges"])
+        out = {}
+        for name, cfg in (
+            ("weighted", weighted([data["weight"], data["weight"], 0, 0])),
+            (
+                "equal",
+                config(n.CentralizedTE(source_allocation=n.SourceAllocation.EQUAL)),
+            ),
+        ):
+            r = n.evaluate_demand(
+                g,
+                data["sources"],
+                data["destinations"],
+                n.EvaluationOptions(cfg, offer=data["offer"], outputs=OUT),
+            )
+            out[name] = dict(
+                delivered=r.delivered,
+                cost=r.total_cost,
+                edge_flows=r.edge_flows.tolist(),
+                by_source=[[s.source, s.delivered] for s in r.by_source],
+            )
+        return out
+    g = build(len(data["source_weights"]), data["edges"])
+    mask = g.eligibility(
+        excluded_nodes=data.get("excluded_nodes", []),
+        excluded_edges=data.get("excluded_edges", []),
+    )
+    cfg = weighted(data["source_weights"])
+    ledger = n.FlowLedger(g)
+    p = n.FlowPolicy(
+        ledger, data["sources"], data["destinations"], cfg, eligibility=mask
+    )
+    offer = data.get("offer", math.inf)
+    before = ledger_state(ledger)
+    evaluated = p.evaluate(offer, outputs=OUT)
+    assert ledger_state(ledger) == before and p.program is None
+    r = p.replace(offer, outputs=OUT)
+    if r.delivered:
+        assert r.routes_changed and r.weights_changed and not r.reservations_changed
+    assert plain(evaluated) == plain(r)
+    assert r.plan is None and r.min_cut is None and r.marginal_cost_curve is None
+    assert r.offered is None and r.admitted == r.delivered
+    assert r.source_drops == 0 and r.edge_drops == []
+    assert r.edge_reservations.tolist() == [0] * g.num_edges()
+    assert sum(s.delivered for s in r.by_source) == r.delivered
+    assert r.total_cost == sum(
+        int(c) * int(f) for c, f in zip(g.edge_costs(), r.edge_flows, strict=True)
+    )
+    assert r.requested == offer
+    assert r.unadmitted == (None if offer == math.inf else offer - r.delivered)
+    assert ledger.carried().tolist() == r.edge_flows.tolist()
+    assert ledger.residual().tolist() == [
+        int(c) - int(f)
+        for c, f in zip(g.edge_capacity_units(), r.edge_flows, strict=True)
+    ]
+    captured = r.program.source_weights
+    out = dict(
+        roster=[s for s, _ in captured],
+        program_source_weights=[list(x) for x in captured],
+        delivered=r.delivered,
+        termination=r.termination.name,
+        by_source=[[s.source, s.delivered] for s in r.by_source],
+        cost=r.total_cost,
+        edge_flows=r.edge_flows.tolist(),
+        tunnels=[
+            [t.entry_id, t.head, list(t.edges), t.weight] for t in r.program.tunnels
+        ],
+    )
+    if "replays" in data:
+        out["replays"] = []
+        for x in data["replays"]:
+            runs = {}
+            for admission in (n.Admission.LOSSY, n.Admission.LOSSLESS):
+                q = n.FlowPolicy(
+                    n.FlowLedger(g),
+                    data["sources"],
+                    data["destinations"],
+                    config(n.Pinned(r.program), admission=admission),
+                    eligibility=mask,
+                )
+                runs[admission] = q.replace(x, outputs=OUT)
+            a, b = runs[n.Admission.LOSSY], runs[n.Admission.LOSSLESS]
+            rows = {s.source: s for s in a.by_source}
+            out["replays"].append(
+                dict(
+                    offer=x,
+                    edge_flows=a.edge_flows.tolist(),
+                    source_drops=[rows[s].source_drops for s, _ in captured],
+                    delivered=[rows[s].delivered for s, _ in captured],
+                    demand_source_drops=a.source_drops,
+                    lossy_termination=a.termination.name,
+                    lossless_termination=b.termination.name,
+                )
+            )
+        q = n.FlowPolicy(
+            n.FlowLedger(g),
+            data["sources"],
+            data["destinations"],
+            config(n.Pinned(r.program)),
+            eligibility=mask,
+        )
+        out["lossless_bound"] = q.replace(math.inf).delivered
+    return out
+
+
+@pytest.mark.parametrize("case", CASES, ids=lambda c: c["id"])
+def test_contract_cases(case):
+    subset(run_case(case), case["expected"])
+
+
+def test_oracles_and_comparator_reject_wrong_rules():
+    assert sequential(2, [2, 1]) == [2, 0]
+    assert sequential(50, [100, 1, 1, 1]) == [50, 0, 0, 0]
+    for t in range(25):
+        for w in itertools.product(range(4), repeat=3):
+            assert ha(t, w) == sequential(t, w)
+    assert ha(15, [2, 1]) == [10, 5] != ha(15, [11, 5])
+
+    # Every promised fixture leaf: wrong value, wrong type, missing and null must fail.
+    def mutants(value):
+        yield None
+        if isinstance(value, dict):
+            for key in value:
+                bad = copy.deepcopy(value)
+                del bad[key]
+                yield bad
+                for replacement in mutants(value[key]):
+                    bad = copy.deepcopy(value)
+                    bad[key] = replacement
+                    yield bad
+        elif isinstance(value, list):
+            yield value + [None]
+            for i, leaf in enumerate(value):
+                for replacement in mutants(leaf):
+                    bad = copy.deepcopy(value)
+                    bad[i] = replacement
+                    yield bad
+        elif type(value) is int:
+            yield value + 1
+            yield float(value)
+        elif isinstance(value, str):
+            yield value + "!"
+
+    for case in CASES:
+        expected = case["expected"]
+        subset(expected, expected)
+        for changed in mutants(expected):
+            with pytest.raises((AssertionError, TypeError)):
+                subset(changed, expected)
+
+
+@pytest.mark.parametrize("ordered", [False, True])
+def test_refused_traffic_is_not_retried_after_relief(ordered):
+    g = build(4, [(0, 2, 10, 1), (1, 2, 10, 1), (2, 3, 10, 1)])
+    ledger = n.FlowLedger(g)
+    other = n.FlowPolicy(ledger, 2, 3, config(n.ShortestPaths()))
+    p = n.FlowPolicy(ledger, [0, 1], 3, weighted([2, 1, 0, 0]))
+    other.replace(8)
+
+    def call(v):
+        return (
+            n.apply_actions(ledger, [n.Place(p, v)], outputs=OUT)[0]
+            if ordered
+            else p.place(v, outputs=OUT)
+        )
+
+    initial = call(5)
+    assert initial.delivered == 2
+    check_live_rows(initial, [[0, 0, "UP", 2, 2, 0]], 3)
+    other.replace(5)
+    r = call(1)
+    assert (r.call_delivered, r.delivered, r.total_cost, r.requested, r.unadmitted) == (
+        1,
+        3,
+        6,
+        6,
+        3,
+    )
+    assert [s.delivered for s in r.by_source] == [2, 1]
+    assert r.edge_flows.tolist() == [2, 1, 3]
+    check_live_rows(r, [[0, 0, "UP", 2, 2, 0], [1, 1, "UP", 1, 1, 0]], 0)
+
+
+def test_exact_replay_paths_and_all_zero_termination():
+    g = build(3, [(0, 2, 10, 1), (1, 2, 10, 1)])
+    live = n.FlowPolicy(n.FlowLedger(g), [0, 1], 2, weighted([0, 0, 0]))
+    saved = live.replace(6)
+    assert saved.termination == n.Termination.NO_ACTIVE_WEIGHT
+    for support in (None, dag_of(g, [0, 1])):
+        q = n.FlowPolicy(
+            n.FlowLedger(g), [0, 1], 2, weighted([0, 0, 0], support=support)
+        )
+        unlimited = q.evaluate(math.inf)
+        assert unlimited.termination == n.Termination.NO_ACTIVE_WEIGHT
+        assert unlimited.requested == unlimited.call_undelivered == math.inf
+        assert unlimited.unadmitted is None and unlimited.delivered == 0
+    assert live.forward(6).termination == n.Termination.EXHAUSTED
+    for admission in (n.Admission.LOSSY, n.Admission.LOSSLESS):
+        q = n.FlowPolicy(
+            n.FlowLedger(g),
+            [0, 1],
+            2,
+            config(n.Pinned(saved.program), admission=admission),
+        )
+        with pytest.raises(ValueError, match=exact("Pinned forwards with replace")):
+            q.forward(6)
+        for method in (q.replace, q.evaluate, q.place):
+            q.remove()
+            r = method(6)
+            assert r.termination == (
+                n.Termination.COMPLETE
+                if admission == n.Admission.LOSSY
+                else n.Termination.EXHAUSTED
+            )
+            assert r.source_drops == (6 if admission == n.Admission.LOSSY else 0)
+            assert all(s.source_drops == s.delivered == 0 for s in r.by_source)
+            assert method(0).termination == n.Termination.COMPLETE
+
+
+@pytest.mark.parametrize("reverse", [False, True])
+@pytest.mark.parametrize("reverse_creation", [False, True])
+def test_simultaneous_ties_follow_creation_not_action_order(reverse, reverse_creation):
+    g = build(2, [(0, 1, 3, 1)])
+    p = n.FlowPolicy(n.FlowLedger(g), 0, 1, weighted([1, 0]))
+    program = p.replace(3).program
+    ledger = n.FlowLedger(g)
+    first = n.FlowPolicy(
+        ledger, 0, 1, config(n.Pinned(program), admission=n.Admission.LOSSY)
+    )
+    second = n.FlowPolicy(
+        ledger, 0, 1, config(n.Pinned(program), admission=n.Admission.LOSSY)
+    )
+    a, b = (second, first) if reverse_creation else (first, second)
+    owners = [b, a] if reverse else [a, b]
+    r = n.apply_actions(
+        ledger, [n.Replace(q, 3) for q in owners], mode=n.BatchMode.SIMULTANEOUS
+    )
+    assert [x.delivered for x in r] == [2 if q is first else 1 for q in owners]
+    assert first.delivered() == 2 and second.delivered() == 1
+    first.remove()
+    second.remove()
+    r = n.apply_actions(ledger, [n.Replace(q, 3) for q in owners])
+    assert [x.delivered for x in r] == [3, 0]
+
+
+@pytest.mark.parametrize("count", [1, 2, 3, 4, 5, 16, 17, 40])
+@pytest.mark.parametrize("unequal", [False, True])
+def test_cumulative_captured_weights_cross_sixty_four_bits(count, unequal):
+    weights = [M - i if unequal else M for i in range(count)]
+    g = build(count + 1, [(i, count, 5, 1) for i in range(count)])
+    p = n.FlowPolicy(
+        n.FlowLedger(g), list(range(count)), count, weighted(weights + [0])
+    )
+    program = p.replace(count).program
+    q = n.FlowPolicy(
+        n.FlowLedger(g),
+        list(range(count)),
+        count,
+        config(n.Pinned(program), admission=n.Admission.LOSSY),
+    )
+    total = 0
+    for x in [M, M, M, 7, M, 5, 17, 0, 1]:
+        try:
+            r = q.place(x)
+        except RuntimeError as error:
+            raise AssertionError("a valid cumulative offer must succeed") from error
+        total += x
+        assert [s.offered for s in r.by_source] == ha(total, weights)
+        assert r.offered == r.requested == total
+        assert r.delivered + r.source_drops + sum(v for _, v in r.edge_drops) == total
+
+
+def test_owned_weights_and_all_evaluator_readers():
+    data = next(c["input"] for c in CASES if c["id"] == "W-witness")
+    g = build(6, data["edges"])
+    weights = np.array(data["source_weights"], dtype=np.int64)
+    cfg = weighted(weights)
+    weights[:] = 0
+    assert cfg.routing.source_weights == (2, 1, 0, 0, 0, 0)
+    with pytest.raises(AttributeError):
+        cfg.routing.source_weights = (0,) * 6
+    opts = n.EvaluationOptions(cfg, offer=15, outputs=OUT)
+    want = n.evaluate_demand(g, [1, 0, 1], 5, opts)
+    assert [s.delivered for s in want.by_source] == [10, 5]
+    for workers in (1, 2, 4):
+        results = n.evaluate_pairs(
+            g, [([0, 1], [5]), ([1, 0, 1], [5])], opts, workers=workers
+        )
+        assert all(plain(r) == plain(want) for r in results)
+        failures = n.evaluate_edge_failures(g, [0, 1], 5, opts, workers=workers)
+        for entry in failures.entries:
+            deleted = g.eligibility(excluded_edges=[entry.edge])
+            r = n.evaluate_demand(
+                g, [0, 1], 5, n.EvaluationOptions(cfg, eligibility=deleted, offer=15)
+            )
+            assert entry.delivery_reduction == want.delivered - r.delivered
+    program = want.program
+    del opts, want, weights, cfg, results, failures
+    gc.collect()
+    q = n.FlowPolicy(n.FlowLedger(g), [0, 1], 5, config(n.Pinned(program)))
+    assert [s.delivered for s in q.replace(15).by_source] == [10, 5]
+
+
+def test_edge_failures_recompute_unused_zero_capacity_roster_edge():
+    g = build(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+    opts = n.EvaluationOptions(weighted([2, 1, 0]))
+    r = n.evaluate_edge_failures(g, [0, 1], 2, opts, workers=2)
+    assert r.baseline.delivered == 0
+    assert [(e.edge, e.delivery_reduction) for e in r.entries] == [(0, -10), (1, 0)]
+
+
+def test_small_integer_objective_with_masks_and_support():
+    rng = random.Random(20261022)
+    for _ in range(45):
+        edges = [
+            (0, 2, rng.randrange(3), 1),
+            (0, 3, rng.randrange(3), 7),
+            (1, 2, rng.randrange(3), 3),
+            (1, 3, rng.randrange(3), 1),
+            (2, 3, rng.randrange(3), 1),
+        ]
+        g = build(4, edges)
+        weights = [rng.randrange(4), rng.randrange(4)]
+        allowed = [rng.randrange(4) != 0 for _ in edges]
+        # Capacity-blind reachability; support is independently selected from the DAG.
+        roster = [
+            s
+            for s in (0, 1)
+            if any(
+                allowed[e]
+                and a == s
+                and (
+                    b == 3
+                    or any(
+                        allowed[j] and c == b and d == 3
+                        for j, (c, d, *_x) in enumerate(edges)
+                    )
+                )
+                for e, (a, b, *_x) in enumerate(edges)
+            )
+        ]
+        effective = [weights[s] for s in roster]
+        best = {0: 0}
+        for f in itertools.product(
+            *(
+                range(c + 1) if allowed[i] else [0]
+                for i, (_a, _b, c, _k) in enumerate(edges)
+            )
+        ):
+            bal = [0] * 4
+            for x, (a, b, _c, _k) in zip(f, edges, strict=True):
+                bal[a] += x
+                bal[b] -= x
+            t = bal[0] + bal[1]
+            shares = dict(zip(roster, sequential(t, effective), strict=True))
+            if bal[2] or any(bal[s] != shares.get(s, 0) for s in (0, 1)):
+                continue
+            cost = sum(x * edge[3] for x, edge in zip(f, edges, strict=True))
+            best[t] = min(best.get(t, cost), cost)
+        top = max(best)
+        assert sorted(best) == list(range(top + 1))
+        # Map input positions to sorted EdgeId for support/masks and exact cost.
+        support = dag_of(
+            g, [e for e, pos in enumerate(g.input_positions()) if allowed[int(pos)]]
+        )
+        cfg = weighted(weights + [0, 0], support=support)
+        for offer in (0, 1, 5, math.inf):
+            r = n.evaluate_demand(
+                g,
+                [0, 1],
+                3,
+                n.EvaluationOptions(
+                    cfg, offer=None if offer == math.inf else offer, outputs=OUT
+                ),
+            )
+            t = top if offer == math.inf else min(top, offer)
+            assert (r.delivered, r.total_cost) == (t, best[t])
+            assert [s.delivered for s in r.by_source] == [
+                dict(zip(roster, ha(t, effective), strict=True)).get(s, 0)
+                for s in (0, 1)
+            ]
+
+
+def test_source_vector_and_model_refusals_before_zero_offer():
+    g = build(3, [(0, 2, 2, 1), (1, 2, 2, 1)])
+    for model, message in (
+        (
+            n.CentralizedTE(
+                source_allocation=n.SourceAllocation.WEIGHTED,
+                source_weights=[1, 0, 0],
+                tunnel_count=n.TunnelCount(1),
+            ),
+            "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+        ),
+        (
+            n.ShortestPaths(source_allocation=n.SourceAllocation.WEIGHTED),
+            "source_allocation=WEIGHTED requires CentralizedTE without tunnel_count",
+        ),
+        (
+            n.CentralizedTE(source_allocation=n.SourceAllocation.WEIGHTED),
+            "source_allocation=WEIGHTED requires source_weights",
+        ),
+    ):
+        with pytest.raises(ValueError, match=exact(message)):
+            n.evaluate_demand(g, 0, 2, n.EvaluationOptions(config(model), offer=0))
+    for weights, message in (
+        ([1, 0], "source_weights: expected 3 entries"),
+        ([-1, 0], "source_weights: expected 3 entries"),
+        ([0, M + 1], "source_weights: expected 3 entries"),
+        ([1, 0, 0, M + 1], "source_weights: expected 3 entries"),
+        ([1, 0, -1], "source_weights[2] must be an integer in [0, 2^62)"),
+        ([1, 0, M + 1], "source_weights[2] must be an integer in [0, 2^62)"),
+    ):
+        with pytest.raises(ValueError, match=exact(message)):
+            n.evaluate_demand(g, 0, 2, n.EvaluationOptions(weighted(weights), offer=0))
+        with pytest.raises(ValueError, match=exact(message)):
+            n.FlowPolicy(n.FlowLedger(g), 0, 2, weighted(weights))
+    assert (
+        n.evaluate_demand(
+            g, 0, 2, n.EvaluationOptions(weighted([M, 0, 0]), offer=0)
+        ).delivered
+        == 0
+    )
+
+
+def test_support_black_holes_zero_calls_and_list_refusals():
+    g = build(3, [(0, 2, 10, 1), (1, 2, 10, 1)])
+    ledger = n.FlowLedger(g)
+    p = n.FlowPolicy(ledger, [0, 1], 2, weighted([2, 1, 0]))
+    zero = p.place(0)
+    assert zero.program is None and zero.termination == n.Termination.COMPLETE
+    assert not (
+        zero.routes_changed or zero.weights_changed or zero.reservations_changed
+    )
+    program = p.replace(3).program
+    mask = g.eligibility(excluded_nodes=[0])
+    repaired = n.FlowPolicy(
+        n.FlowLedger(g),
+        [0, 1],
+        2,
+        config(n.Pinned(program), admission=n.Admission.LOSSY),
+        eligibility=mask,
+    )
+    stale = n.FlowPolicy(
+        n.FlowLedger(g),
+        [0, 1],
+        2,
+        config(n.Pinned(program, black_holes=mask), admission=n.Admission.LOSSY),
+    )
+    a, b = repaired.replace(3), stale.replace(3)
+    assert [r.delivered for r in a.by_source] == [0, 3]
+    assert [r.delivered for r in b.by_source] == [0, 1]
+    assert b.source_drops + sum(x for _, x in b.edge_drops) == 2
+    assert program.source_weights == ((0, 2), (1, 1))
+    saved = ledger_state(ledger)
+    with pytest.raises(
+        ValueError,
+        match=exact(
+            "SIMULTANEOUS Replace requires ShortestPaths EQUAL or WEIGHTED, or Pinned"
+        ),
+    ):
+        n.apply_actions(ledger, [n.Replace(p, 3)], mode=n.BatchMode.SIMULTANEOUS)
+    with pytest.raises(ValueError, match=exact("SIMULTANEOUS does not accept Place")):
+        n.apply_actions(ledger, [n.Place(p, 0)], mode=n.BatchMode.SIMULTANEOUS)
+    assert ledger_state(ledger) == saved
+    r = p.replace(0)
+    assert r.termination == n.Termination.COMPLETE and r.program.source_weights == (
+        (0, 2),
+        (1, 1),
+    )
+    supported = weighted([2, 1, 0], support=dag_of(g, [1]))
+    r = n.evaluate_demand(g, [0, 1], 2, n.EvaluationOptions(supported, outputs=OUT))
+    assert r.edge_flows.tolist() == [0, 10] and [s.delivered for s in r.by_source] == [
+        0,
+        10,
+    ]
+
+
+def test_wide_cost_and_zero_effect_participants_across_program_forms():
+    g = build(2, [(0, 1, M, M)])
+    r = n.evaluate_demand(g, 0, 1, n.EvaluationOptions(weighted([M, 0]), outputs=OUT))
+    assert type(r.total_cost) is int and r.total_cost == M * M
+    data = CASES[0]["input"]
+    g = build(6, data["edges"])
+    empty = n.evaluate_demand(
+        g, [0, 1], 5, n.EvaluationOptions(weighted([0] * 6))
+    ).program
+    positive = n.evaluate_demand(
+        g, [0, 1], 5, n.EvaluationOptions(weighted([2, 1, 0, 0, 0, 0]))
+    ).program
+    dag = dag_of(g, range(g.num_edges()))
+    models = [
+        n.Pinned(positive),
+        n.ShortestPaths(),
+        n.Pinned(n.ForwardingProgram.from_dag(g, [0, 1], 5, dag)),
+        n.Pinned(
+            n.ForwardingProgram.from_routes(
+                g, [0, 1], 5, [n.RouteDefinition(0, dag), n.RouteDefinition(1, dag)]
+            )
+        ),
+    ]
+    for model in models:
+        for offer in (0, 7):
+            ledger = n.FlowLedger(g)
+            p = n.FlowPolicy(
+                ledger, [0, 1], 5, config(model, admission=n.Admission.LOSSY)
+            )
+            zero = n.FlowPolicy(
+                ledger, [0, 1], 5, config(n.Pinned(empty), admission=n.Admission.LOSSY)
+            )
+            base = n.apply_actions(
+                ledger, [n.Replace(p, 19)], mode=n.BatchMode.SIMULTANEOUS, outputs=OUT
+            )[0]
+            p.remove()
+            got = n.apply_actions(
+                ledger,
+                [n.Replace(zero, offer), n.Replace(p, 19)],
+                mode=n.BatchMode.SIMULTANEOUS,
+                outputs=OUT,
+            )[1]
+            assert plain(got) == plain(base)
+
+
+def test_transit_through_another_source_and_installed_flags():
+    g = build(3, [(0, 1, 5, 1), (1, 2, 10, 1)])
+    ledger = n.FlowLedger(g)
+    p = n.FlowPolicy(ledger, [0, 1], 2, weighted([1, 1, 0]))
+    first = p.replace(math.inf, outputs=OUT)
+    assert first.delivered == 10 and first.total_cost == 15
+    assert [r.delivered for r in first.by_source] == [5, 5]
+    assert first.edge_flows.tolist() == [5, 10]
+    assert [r.delivered for r in p.records()] == [5, 5]
+    assert (
+        first.routes_changed
+        and first.weights_changed
+        and not first.reservations_changed
+    )
+    r = p.forward(8)
+    assert r.delivered == 8
+    assert not (r.routes_changed or r.weights_changed or r.reservations_changed)
+    zero = p.place(0)
+    assert not (
+        zero.routes_changed or zero.weights_changed or zero.reservations_changed
+    )
+
+
+def check_live_rows(result, rows, undelivered):
+    actual = dict(
+        by_tunnel=[
+            [
+                r.entry_id,
+                r.head,
+                r.status.name,
+                r.assigned,
+                r.delivered,
+                r.total_edge_drops,
+            ]
+            for r in result.by_tunnel
+        ],
+        call_undelivered=result.call_undelivered,
+    )
+    subset(actual, dict(by_tunnel=rows, call_undelivered=undelivered))
+
+
+@pytest.mark.parametrize("offer", [3, 7])
+def test_live_tunnel_rows_and_undelivered_across_readers(offer):
+    g = build(2, [(0, 1, 5, 1)])
+    cfg = weighted([1, 0])
+    for operation in ("place", "replace", "evaluate"):
+        for ordered in (False, True):
+            ledger = n.FlowLedger(g)
+            p = n.FlowPolicy(ledger, 0, 1, cfg)
+            if ordered and operation != "evaluate":
+                action = (
+                    n.Place(p, offer) if operation == "place" else n.Replace(p, offer)
+                )
+                r = n.apply_actions(ledger, [action], outputs=OUT)[0]
+            else:
+                r = getattr(p, operation)(offer, outputs=OUT)
+            check_single_edge_result(r, offer)
+    options = n.EvaluationOptions(cfg, offer=offer, outputs=OUT)
+    check_single_edge_result(n.evaluate_demand(g, 0, 1, options), offer)
+    for workers in (1, 2, 4):
+        for r in n.evaluate_pairs(g, [([0], [1])] * 5, options, workers=workers):
+            check_single_edge_result(r, offer)
+        check_single_edge_result(
+            n.evaluate_edge_failures(g, 0, 1, options, workers=workers).baseline, offer
+        )
+
+
+def test_live_tunnel_row_schema_rejects_missing_null_and_wrong_distribution():
+    expected = dict(
+        by_tunnel=[[0, 0, "UP", 3, 3, 0], [1, 0, "UP", 8, 8, 0], [2, 1, "UP", 5, 5, 0]],
+        call_undelivered=0,
+    )
+    subset(expected, expected)
+    bad_values = [
+        dict(),
+        dict(by_tunnel=None, call_undelivered=0),
+        dict(by_tunnel=[], call_undelivered=0),
+    ]
+    for key in expected:
+        bad = copy.deepcopy(expected)
+        del bad[key]
+        bad_values.append(bad)
+        bad = copy.deepcopy(expected)
+        bad[key] = None
+        bad_values.append(bad)
+    bad = copy.deepcopy(expected)
+    bad["call_undelivered"] = 1
+    bad_values.append(bad)
+    for i in range(3):
+        for j in range(6):
+            for replacement in (
+                None,
+                "FAILED" if j == 2 else expected["by_tunnel"][i][j] + 1,
+            ):
+                bad = copy.deepcopy(expected)
+                bad["by_tunnel"][i][j] = replacement
+                bad_values.append(bad)
+    for j in (3, 4, 5):
+        bad = copy.deepcopy(expected)
+        bad["by_tunnel"][0][j] += 1
+        bad["by_tunnel"][1][j] -= 1
+        bad_values.append(bad)
+    for bad in bad_values:
+        with pytest.raises((AssertionError, TypeError)):
+            subset(bad, expected)
+    data = next(c["input"] for c in CASES if c["id"] == "W-witness")
+    g = build(6, data["edges"])
+    r = n.evaluate_demand(
+        g,
+        [0, 1],
+        5,
+        n.EvaluationOptions(weighted(data["source_weights"]), offer=16, outputs=OUT),
+    )
+    check_live_rows(r, expected["by_tunnel"], 0)
+
+
+@pytest.mark.parametrize("admission", [n.Admission.LOSSY, n.Admission.LOSSLESS])
+def test_remaining_zero_captured_weights_with_a_program_path(admission):
+    g = build(3, [(0, 2, 10, 1), (1, 2, 10, 1)])
+    program = n.evaluate_demand(
+        g, [0, 1], 2, n.EvaluationOptions(weighted([2, 0, 0]), offer=5)
+    ).program
+    assert len(program.tunnels) == 1 and program.source_weights == ((0, 2), (1, 0))
+    mask = g.eligibility(excluded_nodes=[0])
+    p = n.FlowPolicy(
+        n.FlowLedger(g),
+        [0, 1],
+        2,
+        config(n.Pinned(program), admission=admission),
+        eligibility=mask,
+    )
+    for method in (p.replace, p.evaluate, p.place):
+        p.remove()
+        r = method(4, outputs=OUT)
+        assert r.termination == n.Termination.NO_ACTIVE_WEIGHT
+        assert r.delivered == 0 and r.call_undelivered == 4
+        assert r.source_drops == (4 if admission == n.Admission.LOSSY else 0)
+        assert r.unadmitted == (0 if admission == n.Admission.LOSSY else 4)
+        assert all(s.delivered == s.source_drops == 0 for s in r.by_source)
+
+
+def check_single_edge_result(r, offer):
+    carried = min(offer, 5)
+    check_live_rows(r, [[0, 0, "UP", carried, carried, 0]], offer - carried)
+    assert r.delivery_delta == r.call_delivered == r.delivered == carried
+    assert r.call_edge_drops == r.edge_drops == []
+    assert r.call_source_drops == r.source_drops == 0
+    assert r.requested == offer and r.admitted == carried
+    assert r.unadmitted == offer - carried and r.offered is None
+    assert r.termination == (
+        n.Termination.COMPLETE if offer <= 5 else n.Termination.EXHAUSTED
+    )
+    assert r.routes_changed and r.weights_changed and not r.reservations_changed
+    assert r.program is not None and r.program.source_weights == ((0, 1),)
+    assert [
+        (t.entry_id, t.head, list(t.edges), t.weight, t.path_cost)
+        for t in r.program.tunnels
+    ] == [(0, 0, [0], carried, 1)]
+    assert r.plan is r.min_cut is r.marginal_cost_curve is None
+    assert r.total_cost == carried
+    assert [
+        (
+            s.source,
+            s.offered,
+            s.admitted,
+            s.delivered,
+            s.source_drops,
+            s.total_edge_drops,
+        )
+        for s in r.by_source
+    ] == [(0, None, carried, carried, 0, 0)]
+    assert r.edge_flows.tolist() == [carried]
+    assert r.residual.tolist() == [5 - carried]
+    assert r.edge_reservations.tolist() == [0]
+    assert r.saturated_boundary_edges == ([0] if carried == 5 else [])
diff --git a/tests/py/test_zero_capacity.py b/tests/py/test_zero_capacity.py
new file mode 100644
index 0000000..4d1606b
--- /dev/null
+++ b/tests/py/test_zero_capacity.py
@@ -0,0 +1,259 @@
+"""Edges of capacity 0 stay in routing, through the binding: the worked examples of zero
+capacity (SPF and KSP over the zero edge and their residual forms, the search graph S under every
+model, a source behind a zero link, a zero first or last link of a Pinned split route, a link of
+service 0, the zero-weight WCMP cases, T1's roster and its CostStretch pool baseline) and the minimum
+cut. The graphs list their rows in EdgeId order (asserted), so an
+EdgeId is the row's position. S: 0: 0 -> 1 cap 0, 1: 0 -> 2 cap 5, 2: 2 -> 1 cap 5 (costs 1)."""
+
+from __future__ import annotations
+
+import math
+from fractions import Fraction
+
+import pytest
+from helpers import (
+    GLOBAL,
+    HIGHER_CAP,
+    HIGHER_HEADROOM,
+    SHORTEST_PATHS,
+    config,
+    dag_of,
+    t1_config,
+)
+
+import netgraph_core as ngc
+
+EB = ngc.RouteAllocation.EQUAL
+W = ngc.RouteAllocation.WEIGHTED
+MF = ngc.RouteAllocation.OPTIMIZED
+LOSSY = ngc.Admission.LOSSY
+FWD = ngc.Direction.FORWARD
+S = [(0, 1, 0, 1), (0, 2, 5, 1), (2, 1, 5, 1)]
+
+
+def graph(n, rows):
+    g = ngc.Graph(n, *map(list, zip(*rows, strict=True)), 1.0)
+    assert [int(i) for i in g.input_positions()] == list(range(len(rows)))
+    return g
+
+
+def edges(dag):
+    return sorted(int(e) for e in dag.via_edges())
+
+
+def walks(result):
+    return [(c, [hop[0] for hop in p.hops()]) for c, p in result]
+
+
+def place(g, s, d, cfg, offer, eligibility=None):
+    policy = ngc.FlowPolicy(ngc.FlowLedger(g), s, d, cfg, eligibility)
+    return policy.place(offer), policy
+
+
+def test_spf_and_ksp_search_the_zero_edge():
+    g = graph(3, S)
+    r = ngc.spf(g, 0, ngc.SpfOptions(FWD, targets=1))
+    assert (r.target_cost, edges(r.dag)) == (1, [0])  # SPF over the zero edge
+    gated = ngc.spf(g, 0, ngc.SpfOptions(FWD, targets=1, residual=[0, 5, 5]))
+    assert (gated.target_cost, edges(gated.dag)) == (2, [1, 2])
+    full = ngc.spf(g, 0, ngc.SpfOptions(FWD))
+    assert (full.costs.tolist(), edges(full.dag)) == ([0, 1, 1], [0, 1])
+    assert walks(ngc.ksp(g, 0, 1, ngc.KspOptions(2))) == [(1, [0]), (2, [1, 2])]
+    opts = ngc.KspOptions(2, residual=[0, 5, 5])
+    assert walks(ngc.ksp(g, 0, 1, opts)) == [(2, [1, 2])]
+    # CostStretch(1.2), exactly 6/5: the static baseline 5 counts the zero-capacity edge, and
+    # 6 * 5 <= 6 * 5 admits the cost-6 walk at equality; 11/10 does not.
+    h = graph(2, [(0, 1, 0, 5), (0, 1, 1, 6)])
+    ceiled = ngc.KspOptions(2, cost_ceiling=ngc.CostStretch(1.2))
+    assert walks(ngc.ksp(h, 0, 1, ceiled)) == [(5, [0]), (6, [1])]
+    below = ngc.KspOptions(2, cost_ceiling=ngc.CostStretch(Fraction(11, 10)))
+    assert walks(ngc.ksp(h, 0, 1, below)) == [(5, [0])]
+
+
+def test_headroom_without_a_residual_reads_one_or_zero():
+    d = graph(4, [(0, 1, 1, 1), (0, 2, 5, 1), (1, 3, 1, 1), (2, 3, 5, 1)])
+    z = graph(4, [(0, 1, 0, 1), (0, 2, 5, 1), (1, 3, 5, 1), (2, 3, 5, 1)])
+
+    def path(g, tie):
+        o = ngc.SpfOptions(FWD, tie_break=tie, multipath=False, targets=3)
+        return edges(ngc.spf(g, 0, o).dag)
+
+    assert path(d, HIGHER_HEADROOM) == [
+        0,
+        2,
+    ]  # every positive edge reads 1: the EdgeId order decides
+    assert path(d, HIGHER_CAP) == [1, 3]
+    assert path(z, HIGHER_HEADROOM) == [1, 3]  # 0 on the zero-capacity edge
+
+
+def test_g8_for_every_model():
+    g = graph(3, S)
+    r, p = place(g, 0, 1, SHORTEST_PATHS, 5)
+    assert (r.call_delivered, r.call_undelivered, r.termination) == (
+        0,
+        5,
+        ngc.Termination.EXHAUSTED,
+    )
+    [rec] = p.records()
+    assert (rec.delivered, edges(rec.route), rec.min_route_cost, rec.edge_flows) == (
+        0,
+        [0],
+        1,
+        [],
+    )
+    r, p = place(g, 0, 1, config(ngc.ShortestPaths(), EB, LOSSY), 5)
+    assert (r.call_delivered, r.edge_drops, r.termination) == (
+        0,
+        [(0, 5)],
+        ngc.Termination.COMPLETE,
+    )
+    for admission in (ngc.Admission.LOSSLESS, LOSSY):
+        r, p = place(g, 0, 1, config(ngc.ShortestPaths(), W, admission), 5)
+        assert (r.call_delivered, r.edge_drops) == (
+            0,
+            [],
+        )  # weight 0: no member, never a bypass
+    assert place(g, 0, 1, config(ngc.ShortestPaths(), MF), 5)[0].call_delivered == 0
+    assert place(g, 0, 1, GLOBAL, 5)[0].call_delivered == 5
+    # T1: the request of 5 filters the zero link out; the tunnel comes up over 0 -> 2 -> 1.
+    t1 = ngc.FlowPolicy(ngc.FlowLedger(g), 0, 1, t1_config(1)).replace(
+        5, design_demand=5
+    )
+    assert (t1.call_delivered, t1.program.tunnels[0].edges) == (5, (1, 2))
+
+
+def test_equal_and_weighted_splits_over_a_zero_member():
+    first = graph(2, [(0, 1, 0, 1), (0, 1, 10, 1)])
+    last = graph(2, [(0, 1, 10, 1), (0, 1, 0, 1)])
+    assert place(first, 0, 1, SHORTEST_PATHS, 10)[0].call_delivered == 0
+    assert place(last, 0, 1, SHORTEST_PATHS, 10)[0].call_delivered == 1
+    r, _ = place(first, 0, 1, config(ngc.ShortestPaths(), EB, LOSSY), 10)
+    assert (r.call_delivered, r.edge_drops) == (5, [(0, 5)])
+    assert (
+        place(first, 0, 1, config(ngc.ShortestPaths(), W), 10)[0].call_delivered == 10
+    )
+    # A WCMP member of capacity 0, and all weights zero.
+    wcmp = graph(2, [(0, 1, 0, 1), (0, 1, 40, 1)])
+    assert (
+        place(wcmp, 0, 1, config(ngc.ShortestPaths(), W, LOSSY), 40)[0].call_delivered
+        == 40
+    )
+    one = graph(2, [(0, 1, 0, 1)])
+    r, p = place(one, 0, 1, config(ngc.ShortestPaths(), W, LOSSY), 2)
+    [rec] = p.records()
+    assert (r.call_delivered, r.edge_drops, rec.offered, rec.delivered) == (0, [], 2, 0)
+    # A link of service 0: both units dropped on the zero-capacity link.
+    r, _ = place(one, 0, 1, config(ngc.ShortestPaths(), EB, LOSSY), 2)
+    assert (r.call_delivered, r.edge_drops) == (0, [(0, 2)])
+
+
+@pytest.mark.parametrize(
+    ("caps", "lossless", "drops"),
+    [((0, 10), 0, [(0, 5)]), ((10, 0), 1, [(1, 5)])],
+    ids=["zero-first", "positive-first"],
+)
+def test_two_sources_one_behind_a_zero_link(caps, lossless, drops):
+    # The pooled equal source allocation: a LOSSLESS total a is admitted only when RR(a) fits, so a source
+    # behind the zero link caps it at its round-robin position: 0 when source 0 is behind it
+    # (RR(1) gives source 0 the unit), 1 when source 1 is (RR(2) gives source 1 a unit). LOSSY
+    # offers RR(10) = 5 and 5 and drops the share behind the zero link.
+    g = graph(3, [(0, 2, caps[0], 1), (1, 2, caps[1], 1)])
+    r, p = place(g, [0, 1], 2, SHORTEST_PATHS, 10)
+    assert (r.call_delivered, r.termination) == (lossless, ngc.Termination.EXHAUSTED)
+    assert [row.source for row in r.by_source] == [0, 1]
+    assert len(p.records()) == 2
+    r, _ = place(g, [0, 1], 2, config(ngc.ShortestPaths(), EB, LOSSY), 10)
+    assert (r.call_delivered, r.edge_drops) == (5, drops)
+
+
+def test_b3_delete_zero_and_edge_failures():
+    g = graph(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+    for eligibility in (
+        g.eligibility(excluded_nodes=[0]),
+        g.eligibility(excluded_edges=[0]),
+    ):
+        assert (
+            place(g, [0, 1], 2, SHORTEST_PATHS, 10, eligibility)[0].call_delivered == 10
+        )
+        assert place(g, [0, 1], 2, GLOBAL, 10, eligibility)[0].call_delivered == 10
+    # The zero-capacity source first, under the pooled equal source allocation, admits 0; removing the zero link takes source 0
+    # out of the program, so the deletion gains 10 (a negative loss); removing 1 -> 2 leaves 0.
+    s = ngc.evaluate_edge_failures(g, [0, 1], 2, ngc.EvaluationOptions(SHORTEST_PATHS))
+    assert (
+        s.baseline.call_delivered,
+        [(e.edge, e.delivery_reduction) for e in s.entries],
+    ) == (
+        0,
+        [(0, -10), (1, 0)],
+    )
+    # A negative loss for the zero-capacity link.
+    s8 = ngc.evaluate_edge_failures(
+        graph(3, S), 0, 1, ngc.EvaluationOptions(SHORTEST_PATHS)
+    )
+    assert [(e.edge, e.delivery_reduction) for e in s8.entries] == [
+        (0, -5),
+        (1, 0),
+        (2, 0),
+    ]
+
+
+def test_t1_roster_and_stretch_baseline():
+    # A-X8: head 0's link has no unreserved capacity: its tunnel is down and it loses its 2.
+    x8 = graph(3, [(0, 2, 0, 1), (1, 2, 8, 3)])
+    p = ngc.FlowPolicy(ngc.FlowLedger(x8), [0, 1], 2, t1_config(1, LOSSY))
+    r = p.replace(4, design_demand=4)
+    assert (r.call_delivered, r.call_source_drops, r.termination) == (
+        2,
+        2,
+        ngc.Termination.COMPLETE,
+    )
+    assert [t.status for t in r.by_tunnel] == [
+        ngc.TunnelStatus.INSUFFICIENT_BANDWIDTH,
+        ngc.TunnelStatus.UP,
+    ]
+    # CostStretch(1.2), exactly 6/5: c0 = 5 (the zero-capacity link counts), and the cost-6 path is
+    # admitted at equality; at 11/10 it exceeds the ceiling.
+    h = graph(2, [(0, 1, 0, 5), (0, 1, 1, 6)])
+    for factor, delivered, status in (
+        (1.2, 1, ngc.TunnelStatus.UP),
+        (Fraction(11, 10), 0, ngc.TunnelStatus.COST_CEILING_EXCEEDED),
+    ):
+        cfg = t1_config(1, LOSSY, cost_ceiling=ngc.CostStretch(factor))
+        p = ngc.FlowPolicy(ngc.FlowLedger(h), 0, 1, cfg)
+        r = p.replace(1, design_demand=1)
+        assert (r.call_delivered, r.by_tunnel[0].status) == (delivered, status), factor
+    assert [rec.entry_id for rec in p.records()] == [0]
+
+
+@pytest.mark.parametrize(
+    ("caps", "bound"), [((0, 4), 0), ((4, 0), 1)], ids=["zero-first", "zero-last"]
+)
+def test_pinned_routes_keep_their_zero_links(caps, bound):
+    # Two split routes, one over the zero link: the head's round robin gives the first unit to
+    # route 0, so a zero first route blocks every total and a zero last route admits 1.
+    g = graph(2, [(0, 1, caps[0], 1), (0, 1, caps[1], 1)])
+    program = ngc.ForwardingProgram.from_routes(
+        g,
+        0,
+        1,
+        [
+            ngc.RouteDefinition(0, dag_of(g, [0])),
+            ngc.RouteDefinition(0, dag_of(g, [1])),
+        ],
+    )
+    r, p = place(g, 0, 1, ngc.FlowPolicyConfig(routing=ngc.Pinned(program)), math.inf)
+    assert (r.call_delivered, len(p.records())) == (bound, 2)
+
+
+def test_global_min_cut_lists_zero_capacity_links_leaving_the_closure():
+    want = ngc.OutputOptions(min_cut=True)
+    b = graph(3, [(0, 2, 0, 1), (1, 2, 10, 1)])
+    r = ngc.evaluate_demand(b, [0, 1], 2, ngc.EvaluationOptions(GLOBAL, outputs=want))
+    assert (r.call_delivered, r.min_cut) == (10, [0, 1])
+    s = graph(3, S)
+    r = ngc.evaluate_demand(s, 0, 1, ngc.EvaluationOptions(GLOBAL, outputs=want))
+    assert (r.call_delivered, r.min_cut) == (5, [0, 1])
+    masked = ngc.EvaluationOptions(
+        GLOBAL, eligibility=s.eligibility(excluded_edges=[0]), outputs=want
+    )
+    assert ngc.evaluate_demand(s, 0, 1, masked).min_cut == [1]
diff --git a/tests/py/tunnel_oracle.py b/tests/py/tunnel_oracle.py
new file mode 100644
index 0000000..f8d6955
--- /dev/null
+++ b/tests/py/tunnel_oracle.py
@@ -0,0 +1,767 @@
+"""An independent reference for T1 (DistributedTE(TunnelCount(N))) and T2
+(CentralizedTE(tunnel_count=TunnelCount(N))) as docs/semantics.md states them ("T1: tunnels set up
+by their heads", "T2: the controller's equal tunnels", "Forwarding programs"), for the property
+tests of test_distributed_te.py and test_centralized_te_tunnels.py. It restates those rules in plain
+Python and calls nothing of the library: for
+T1 the requests in round order, every attempt a brute force over the simple paths (a path stops at
+the first destination) with the bandwidth filter, the collapse of parallel members and the
+single-path order, the cost ceilings with the pool baseline c0; for T2 the live heads by simple
+paths, the quota flow by augmenting paths (Edmonds-Karp), U by bisection over the integer sizes,
+s* by trying every candidate fraction V[e] / j, the objectives by enumerating the count vectors of
+path multisets, the canonical augmentation with Bellman-Ford, the cut into unit walks, and "up to"
+over every count without pruning; for both the forwarding (round robin over the heads, then over a
+head's up tunnels), the lossless bound, the replay under a mask and the records per entry.
+
+The Lossy loss rule is program_oracle.lossy (the synchronous rounds from zero, the nested
+split at each link): the tunnels' paths here are drawn over small graphs, and the property tests
+use only programs whose links the rounds settle on.
+
+A graph is a list of edges (u, v, capacity, cost) in EdgeId order. A mask is (excluded nodes,
+excluded edges); an edge is allowed when neither it nor an endpoint is excluded."""
+
+from __future__ import annotations
+
+import itertools
+from dataclasses import dataclass, field
+from fractions import Fraction
+
+import program_oracle
+
+UP, NB, CC, FAILED, BLACKHOLED = (
+    "UP",
+    "INSUFFICIENT_BANDWIDTH",
+    "COST_CEILING_EXCEEDED",
+    "FAILED",
+    "BLACKHOLED",
+)
+
+
+def rr(x, k, i):
+    """RR(x, k, i) = x // k + [i < x % k]."""
+    return x // k + (1 if i < x % k else 0)
+
+
+def allowed(edges, mask):
+    xn, xe = (set(mask[0]), set(mask[1])) if mask else (set(), set())
+    return [
+        e not in xe and u not in xn and v not in xn
+        for e, (u, v, _, _) in enumerate(edges)
+    ]
+
+
+def simple_paths(edges, ok, src, dests):
+    """Every simple path (EdgeIds in walk order) from src that ends at the first destination it
+    meets, over the edges with ok[e]."""
+    dests = set(dests)
+    out = []
+
+    def walk(u, seen, path):
+        for e, (a, b, _, _) in enumerate(edges):
+            if a != u or not ok[e] or b in seen:
+                continue
+            if b in dests:
+                out.append([*path, e])
+            else:
+                walk(b, seen | {b}, [*path, e])
+
+    walk(src, {src}, [])
+    return out
+
+
+def cost_of(edges, path):
+    return sum(edges[e][3] for e in path)
+
+
+def priority(edges, tie_break, U, e, service):
+    """The tie rule's edge score on T1's view: HIGHER_AVAILABLE_CAPACITY reads U,
+    HIGHER_HEADROOM U / C (0 when C = 0), HIGHER_CAPACITY C; `service` (the service residual)
+    is not read."""
+    cap = edges[e][2]
+    if tie_break == "HIGHER_AVAILABLE_CAPACITY":
+        return Fraction(U[e])
+    if tie_break == "HIGHER_HEADROOM":
+        return Fraction(U[e], cap) if cap > 0 else Fraction(0)
+    return Fraction(cap)
+
+
+@dataclass
+class Selection:
+    tie_break: str = "FEWER_HOPS"
+    parallel_edges: bool = True
+
+    @property
+    def higher(self):
+        return self.tie_break != "FEWER_HOPS"
+
+
+@dataclass
+class Tunnel:
+    index: int
+    head: int
+    slot: int
+    round: int
+    requested: int
+    status: str
+    path: list | None = None
+    cost: int | None = None
+    planned: int = 0
+
+    @property
+    def up(self):
+        return self.status == UP
+
+    @property
+    def reserved(self):
+        return self.requested if self.up else 0
+
+
+@dataclass
+class Setup:
+    roster: list
+    tunnels: list
+    holds: list
+    c0: int | None
+
+
+def roster_of(edges, sources, dests, mask=None):
+    """The sources whose node is allowed that statically reach an allowed destination."""
+    ok = allowed(edges, mask)
+    xn = set(mask[0]) if mask else set()
+    live = [d for d in dests if d not in xn]
+    return [
+        s
+        for s in sorted(set(sources))
+        if s not in xn and simple_paths(edges, ok, s, live)
+    ]
+
+
+def static_cost(edges, ok, src, dests):
+    paths = simple_paths(edges, ok, src, dests)
+    return min((cost_of(edges, p) for p in paths), default=None)
+
+
+def choose(edges, U, candidate_ok, sel, src, dests, threshold, service):
+    """One attempt's path: the filter, then the collapse, then the single-path order."""
+    # The filter U >= max(b, minimum); a threshold of 0 keeps every allowed edge.
+    filtered = [ok and U[e] >= threshold for e, ok in enumerate(candidate_ok)]
+    kept = list(filtered)
+    if not sel.parallel_edges:
+        best = {}
+        for e, (u, v, _, c) in enumerate(edges):
+            if not filtered[e]:
+                continue
+            key = (
+                c,
+                -priority(edges, sel.tie_break, U, e, service) if sel.higher else 0,
+                e,
+            )
+            if (u, v) not in best or key < best[(u, v)][0]:
+                best[(u, v)] = (key, e)
+        chosen = {e for _, e in best.values()}
+        kept = [filtered[e] and e in chosen for e in range(len(edges))]
+    paths = simple_paths(edges, kept, src, dests)
+    if not paths:
+        return None
+
+    def order(p):
+        bottleneck = min(priority(edges, sel.tie_break, U, e, service) for e in p)
+        cost, hops = cost_of(edges, p), len(p)
+        return (cost, -bottleneck if sel.higher else 0, hops, tuple(p))
+
+    return min(paths, key=order)
+
+
+def exact_fraction(f):
+    """A CostStretch factor as the library reads it: a Fraction as it is, a float as the decimal it prints
+    (Fraction(str(f)): 1.2 is 6/5), an integer n/1."""
+    if isinstance(f, Fraction):
+        return f
+    return Fraction(str(f)) if isinstance(f, float) else Fraction(f)
+
+
+def setup(
+    edges,
+    sources,
+    dests,
+    D,
+    N,
+    *,
+    sel=None,
+    minimum=0,
+    absolute=None,
+    stretch=None,
+    mask=None,
+    unreserved=None,
+    held=None,
+    service=None,
+):
+    """T1's setup. unreserved: the reservation baseline R0 (default: the
+    capacities); held: other owners' holds per edge (default 0); U = R0 - held. service: the
+    service residual (default: the capacities), which setup never reads (rule 7's misreading
+    does)."""
+    sel = sel or Selection()
+    ok = allowed(edges, mask)
+    xn = set(mask[0]) if mask else set()
+    live = [d for d in dests if d not in xn]
+    roster = roster_of(edges, sources, dests, mask)
+    H = len(roster)
+    base = list(unreserved) if unreserved is not None else [c for _, _, c, _ in edges]
+    U = [r - (held[e] if held else 0) for e, r in enumerate(base)]
+    service = list(service) if service is not None else [c for _, _, c, _ in edges]
+    # CostStretch: c0 is the smallest static shortest cost over the roster (before any filter).
+    c0 = min((static_cost(edges, ok, h, live) for h in roster), default=None)
+    tunnels = []
+    for j in range(N):
+        for i, head in enumerate(roster):
+            b = rr(rr(D, H, i), N, j)
+            threshold = max(b, minimum)
+            path = choose(edges, U, ok, sel, head, live, threshold, service)
+            t = Tunnel(j * H + i, head, i, j, b, NB)
+            if path is not None:
+                c = cost_of(edges, path)
+                limit_ok = True
+                if absolute is not None:
+                    limit_ok = c <= absolute
+                elif stretch is not None:
+                    limit_ok = c <= exact_fraction(stretch) * c0
+                if limit_ok:
+                    t.status, t.path, t.cost = UP, path, c
+                    for e in path:
+                        U[e] -= b
+                else:
+                    t.status = CC
+            tunnels.append(t)
+    holds = [0] * len(edges)
+    for t in tunnels:
+        for e in t.path or []:
+            holds[e] += t.reserved
+    return Setup(roster, tunnels, holds, c0)
+
+
+# ---------------------------------------------------------------- forwarding
+
+
+def entry_shares(x, roster, tunnels, alive=None):
+    """The shares of a total x: RR over the roster, then RR over each head's up tunnels in local
+    order. Returns (per tunnel amount, lost at the heads)."""
+    alive = alive if alive is not None else [t.up for t in tunnels]
+    H = len(roster)
+    if H == 0:
+        return [0] * len(tunnels), x
+    amounts = [0] * len(tunnels)
+    lost = 0
+    for i, h in enumerate(roster):
+        share = rr(x, H, i)
+        ids = [
+            k
+            for k, (t, a) in enumerate(zip(tunnels, alive, strict=True))
+            if a and t.head == h
+        ]
+        if not ids:
+            lost += share
+            continue
+        for m, k in enumerate(ids):
+            amounts[k] = rr(share, len(ids), m)
+    return amounts, lost
+
+
+def loads(edges, tunnels, amounts):
+    out = [0] * len(edges)
+    for t, a in zip(tunnels, amounts, strict=True):
+        for e in t.path or []:
+            out[e] += a
+    return out
+
+
+def lossless_bound(edges, roster, tunnels, V, alive=None, top=None):
+    """The lossless bound: the largest total whose no-drop loads fit V with no share lost at a
+    head."""
+    top = top if top is not None else sum(V) + 1
+
+    def fits(x):
+        amounts, lost = entry_shares(x, roster, tunnels, alive)
+        return lost == 0 and all(
+            u <= c for u, c in zip(loads(edges, tunnels, amounts), V, strict=True)
+        )
+
+    lo, hi = 0, top
+    if fits(hi):
+        return hi
+    while hi - lo > 1:
+        mid = (lo + hi) // 2
+        lo, hi = (mid, hi) if fits(mid) else (lo, mid)
+    return lo
+
+
+def lossy(edges, roster, tunnels, x, V, alive=None):
+    """The Lossy forwarding of x on the free capacity V: (delivered, lost at the heads, per
+    tunnel (assigned, delivered, dropped), per edge drops). The loss rule at each link is
+    program_oracle.nested_split (highest averages over the heads' arrivals, then within a head over
+    its tunnels'), evaluated by synchronous rounds from zero until they settle."""
+    amounts, lost = entry_shares(x, roster, tunnels, alive)
+    alive = alive if alive is not None else [t.up for t in tunnels]
+    live = [k for k, a in enumerate(alive) if a and amounts[k] > 0]
+    occ = {}
+    for k in live:
+        for j, e in enumerate(tunnels[k].path):
+            occ.setdefault(e, []).append((k, j))
+    carried = {k: [0] * len(tunnels[k].path) for k in live}
+    for _ in range(4 + max((len(tunnels[k].path) for k in live), default=0)):
+        new = {k: [0] * len(tunnels[k].path) for k in live}
+        for e, members in occ.items():
+            arrival = [amounts[k] if j == 0 else carried[k][j - 1] for k, j in members]
+            heads = [tunnels[k].head for k, _ in members]
+            split = program_oracle.nested_split(min(V[e], sum(arrival)), arrival, heads)
+            for (k, j), c in zip(members, split, strict=True):
+                new[k][j] = c
+        if new == carried:
+            break
+        carried = new
+    else:
+        raise AssertionError("the rounds did not settle")
+    per = [(amounts[k], 0, 0) for k in range(len(tunnels))]
+    drops = [0] * len(edges)
+    for k in live:
+        path = tunnels[k].path
+        for j, e in enumerate(path):
+            arrival = amounts[k] if j == 0 else carried[k][j - 1]
+            drops[e] += arrival - carried[k][j]
+        per[k] = (amounts[k], carried[k][-1], amounts[k] - carried[k][-1])
+    delivered = sum(d for _, d, _ in per)
+    return delivered, lost, per, drops
+
+
+# ---------------------------------------------------------------- replay and records
+
+
+def replay(edges, program_roster, tunnels, dests, mask, producer_mask=None):
+    """A Pinned replay of a T1 program under `mask`: the roster rebuilt from the topology basis
+    (the program's exclusions and the mask together), a tunnel FAILED when the mask touches it or
+    its head left, setup-down tunnels keeping their status. Returns (replay roster, statuses,
+    alive)."""
+    xn = set(mask[0]) | (set(producer_mask[0]) if producer_mask else set())
+    xe = set(mask[1]) | (set(producer_mask[1]) if producer_mask else set())
+    both = (sorted(xn), sorted(xe))
+    ok = allowed(edges, both)
+    live_dests = [d for d in dests if d not in xn]
+    roster = [
+        h
+        for h in program_roster
+        if h not in xn and simple_paths(edges, ok, h, live_dests)
+    ]
+    statuses, alive = [], []
+    for t in tunnels:
+        if not t.up:
+            statuses.append(t.status)
+            alive.append(False)
+        elif t.head not in roster or not all(ok[e] for e in t.path):
+            statuses.append(FAILED)
+            alive.append(False)
+        else:
+            statuses.append(UP)
+            alive.append(True)
+    return roster, statuses, alive
+
+
+def records(tunnels, amounts=None):
+    """One record per program entry, in index order: (entry, delivered, holds)."""
+    amounts = amounts or [0] * len(tunnels)
+    out = []
+    for t, a in zip(tunnels, amounts, strict=True):
+        out.append(
+            (
+                t.index,
+                a,
+                [(e, t.reserved) for e in sorted(t.path or [])] if t.up else [],
+            )
+        )
+    return out
+
+
+def termination(offer, roster, tunnels, alive, lossy_admission, admitted):
+    """The termination rule: zero offer, empty roster, rule (3) only for a program with an up
+    tunnel."""
+    if offer == 0:
+        return "COMPLETE"
+    if not roster:
+        return "NO_ROUTE"
+    has_path = any(t.up for t in tunnels)
+    usable = any(a and t.head in roster for t, a in zip(tunnels, alive, strict=True))
+    if has_path and not usable:
+        return "NO_ACTIVE_WEIGHT"
+    if lossy_admission:
+        return "COMPLETE"
+    return "COMPLETE" if admitted == offer else "EXHAUSTED"
+
+
+# ---------------------------------------------------------------- T2
+
+SCALE = 2**32
+
+
+def t2_live(edges, roster, dests, V, mask=None):
+    """The live heads: those with a simple path whose every link has V >= 1."""
+    ok = allowed(edges, mask)
+    xn = set(mask[0]) if mask else set()
+    live_dests = [d for d in dests if d not in xn]
+    return [
+        h
+        for h in roster
+        if any(
+            all(V[e] >= 1 for e in p) for p in simple_paths(edges, ok, h, live_dests)
+        )
+    ]
+
+
+def _max_flow(n, arcs, s, t):
+    """Edmonds-Karp on (u, v, capacity) arcs; exact integers."""
+    cap = {}
+    adj = [set() for _ in range(n)]
+    for u, v, c in arcs:
+        cap[(u, v)] = cap.get((u, v), 0) + c
+        cap.setdefault((v, u), 0)
+        adj[u].add(v)
+        adj[v].add(u)
+    flow = 0
+    while True:
+        prev = {s: None}
+        queue = [s]
+        for u in queue:
+            for v in sorted(adj[u]):
+                if v not in prev and cap[(u, v)] > 0:
+                    prev[v] = u
+                    queue.append(v)
+        if t not in prev:
+            return flow
+        step, v = None, t
+        while prev[v] is not None:
+            step = cap[(prev[v], v)] if step is None else min(step, cap[(prev[v], v)])
+            v = prev[v]
+        v = t
+        while prev[v] is not None:
+            cap[(prev[v], v)] -= step
+            cap[(v, prev[v])] += step
+            v = prev[v]
+        flow += step
+
+
+def t2_fits(edges, ok, roster, live, dests, k, size, V):
+    """Do k tunnels of the common size `size` fit at every live head? The quota flow: link
+    capacity min(K, floor(V / size)), an arc of k from a root to each live head, K from each
+    destination to a sink; links leaving a destination are not in it."""
+    heads = live
+    K = len(heads) * k
+    n = 1 + max(max(u, v) for u, v, _, _ in edges)
+    root, sink = n, n + 1
+    arcs = [
+        (u, v, min(K, int(Fraction(V[e]) / size)))
+        for e, (u, v, _, _) in enumerate(edges)
+        if ok[e] and u not in dests
+    ]
+    arcs += [(root, h, k) for h in heads]
+    arcs += [(d, sink, K) for d in dests]
+    return _max_flow(n + 2, arcs, root, sink) == K
+
+
+def t2_common(edges, ok, roster, live, dests, k, V):
+    """U: the largest integer size that fits (feasibility decreases in the size: bisection over
+    [1, max V]); 0 when none."""
+    lo, hi = 0, max(V, default=0) + 1  # lo fits (0 by convention), hi does not
+    while hi - lo > 1:
+        mid = (lo + hi) // 2
+        if t2_fits(edges, ok, roster, live, dests, k, Fraction(mid), V):
+            lo = mid
+        else:
+            hi = mid
+    return lo
+
+
+def t2_fluid(edges, ok, roster, live, dests, k, V):
+    """s*: the largest fraction V[e] / j (j <= K) that fits."""
+    K = len(live) * k
+    candidates = sorted(
+        {Fraction(v, j) for v in V if v for j in range(1, K + 1)}, reverse=True
+    )
+    for c in candidates:
+        if t2_fits(edges, ok, roster, live, dests, k, c, V):
+            return c
+    return Fraction(0)
+
+
+def t2_working(U, roster, live, k, D):
+    """u: for a finite design, min(U, max(1, max over live heads of ceil(RR(D, H, i) / k))),
+    the shares over the whole roster; unlimited: U."""
+    if D is None:
+        return U
+    H = len(roster)
+    need = max(-(-rr(D, H, roster.index(h)) // k) for h in live)
+    return min(U, max(1, need))
+
+
+def slot_price(B, V, j, u):
+    """The headroom price of slot j of an edge."""
+    return SCALE * (B - V + j * u) // B
+
+
+def t2_objectives(edges, x, V, u, headroom):
+    J = sum(edges[e][3] * x[e] for e in range(len(edges)))
+    phi = (
+        sum(
+            slot_price(edges[e][2], V[e], j, u)
+            for e in range(len(edges))
+            if edges[e][2] > 0
+            for j in range(1, x[e] + 1)
+        )
+        if headroom
+        else 0
+    )
+    return J, phi
+
+
+def t2_best_objectives(edges, ok, live, dests, k, u, V, headroom):
+    """The minimum (J, Phi) over every count vector of k simple paths per live head with x[e] <=
+    min(K, floor(V[e] / u)), by enumerating the path multisets (small graphs only)."""
+    K = len(live) * k
+    bound = [min(K, v // u) for v in V]
+    choices = []
+    for h in live:
+        paths = simple_paths(edges, ok, h, dests)
+        choices.append(list(itertools.combinations_with_replacement(paths, k)))
+    best = None
+    for pick in itertools.product(*choices):
+        x = [0] * len(edges)
+        for multiset in pick:
+            for p in multiset:
+                for e in p:
+                    x[e] += 1
+        if any(a > b for a, b in zip(x, bound, strict=True)):
+            continue
+        value = t2_objectives(edges, x, V, u, headroom)
+        best = value if best is None or value < best else best
+    return best
+
+
+def t2_canonical(edges, ok, live, dests, k, u, V, headroom):
+    """The canonical unit augmentation: K single units from zero, each on the residual path
+    from the root to the sink of minimum (J, Phi) price, then the fewest arcs, then the smallest
+    sequence of arc keys: (0, EdgeId, direction) for links, (1, head, direction) for root arcs,
+    (2, destination, direction) for sink arcs (forward 0, reverse 1). Bellman-Ford distances."""
+    n = 1 + max(max(a, b) for a, b, _, _ in edges)
+    root, sink = n, n + 1
+    K = len(live) * k
+    bound = [min(K, v // u) for v in V]
+    x = [0] * len(edges)
+    rootf = {h: 0 for h in live}
+    sinkf = {d: 0 for d in dests}
+
+    def price(e, j):
+        B = edges[e][2]
+        return slot_price(B, V[e], j, u) if headroom and B > 0 else 0
+
+    for _ in range(K):
+        arcs = []  # (tail, head, price, key, action)
+        for e, (a, b, _, c) in enumerate(edges):
+            if not ok[e] or a in dests:
+                continue
+            cj = c
+            if x[e] < bound[e]:
+                arcs.append((a, b, (cj, price(e, x[e] + 1)), (0, e, 0), ("x", e, 1)))
+            if x[e] > 0:
+                arcs.append((b, a, (-cj, -price(e, x[e])), (0, e, 1), ("x", e, -1)))
+        for h in live:
+            if rootf[h] < k:
+                arcs.append((root, h, (0, 0), (1, h, 0), ("r", h, 1)))
+            if rootf[h] > 0:
+                arcs.append((h, root, (0, 0), (1, h, 1), ("r", h, -1)))
+        for d in dests:
+            if sinkf[d] < K:
+                arcs.append((d, sink, (0, 0), (2, d, 0), ("s", d, 1)))
+            if sinkf[d] > 0:
+                arcs.append((sink, d, (0, 0), (2, d, 1), ("s", d, -1)))
+        dist = {root: (0, 0)}
+        for _round in range(n + 3):
+            changed = False
+            for a, b, p, _, _ in arcs:
+                if a in dist:
+                    cand = (dist[a][0] + p[0], dist[a][1] + p[1])
+                    if b not in dist or cand < dist[b]:
+                        dist[b], changed = cand, True
+            if not changed:
+                break
+        assert not changed and sink in dist, "a negative cycle or no path"
+
+        on = [
+            (a, b, p, key, act)
+            for a, b, p, key, act in arcs
+            if a in dist
+            and b in dist
+            and (dist[a][0] + p[0], dist[a][1] + p[1]) == dist[b]
+        ]
+        hop = {sink: 0}
+        frontier = [sink]
+        while frontier:
+            nxt = []
+            for v in frontier:
+                for arc in on:
+                    if arc[1] == v and arc[0] not in hop:
+                        hop[arc[0]] = hop[v] + 1
+                        nxt.append(arc[0])
+            frontier = nxt
+        v = root
+        while v != sink:
+            arc = min(
+                (a for a in on if a[0] == v and hop.get(a[1]) == hop[v] - 1),
+                key=lambda a: a[3],
+            )
+            kind, ident, step = arc[4]
+            if kind == "x":
+                x[ident] += step
+            elif kind == "r":
+                rootf[ident] += step
+            else:
+                sinkf[ident] += step
+            v = arc[1]
+    return x
+
+
+def t2_program(edges, roster, live, dests, k, x, u):
+    """The tunnels: x cut, live head by live head in ascending NodeId, into unit walks along
+    the smallest positive EdgeId to a destination; each head's walks sorted by EdgeId sequence;
+    in round order (local index j, then roster position i), index j * H + i."""
+    rem = list(x)
+    H = len(roster)
+    per_head = {}
+    for h in live:
+        walks = []
+        for _ in range(k):
+            cur, walk = h, []
+            while cur not in dests:
+                e = next(
+                    e for e, (a, _, _, _) in enumerate(edges) if a == cur and rem[e] > 0
+                )
+                rem[e] -= 1
+                walk.append(e)
+                cur = edges[e][1]
+            walks.append(walk)
+        per_head[h] = sorted(walks)
+    assert not any(rem), "the walks do not cover x"
+    tunnels = []
+    for j in range(k):
+        for i, h in enumerate(roster):
+            if h not in per_head:
+                continue
+            path = per_head[h][j]
+            index = j * H + i
+            t = Tunnel(index, h, i, j, 0, UP, path, cost_of(edges, path), u)
+            tunnels.append(t)
+    return tunnels
+
+
+@dataclass
+class T2Plan:
+    roster: list
+    live: list
+    count: int
+    U: int = 0
+    fluid: Fraction = Fraction(0)
+    u: int = 0
+    x: list = field(default_factory=list)
+    tunnels: list = field(default_factory=list)
+    J: int = 0
+    phi: int = 0
+    F: int = 0
+    scores: list = field(default_factory=list)
+
+    @property
+    def insufficient(self):
+        return bool(self.live) and self.U == 0
+
+
+def t2_bound(edges, plan, V):
+    """F: the program's lossless maximum: every roster head's share counts, a dead head's
+    included (it blocks every total that gives it a unit)."""
+    if not plan.roster:
+        return 0
+    return lossless_bound(edges, plan.roster, plan.tunnels, V)
+
+
+def t2_at(edges, ok, roster, live, dests, k, V, D, headroom, U=None):
+    """The T2 program at count k for the design D (None: unlimited)."""
+    plan = T2Plan(roster, live, k)
+    if not live:
+        return plan
+    plan.U = U if U is not None else t2_common(edges, ok, roster, live, dests, k, V)
+    plan.fluid = t2_fluid(edges, ok, roster, live, dests, k, V)
+    if plan.U == 0:
+        return plan  # no tunnels; program_roster keeps the roster
+    plan.u = t2_working(plan.U, roster, live, k, D)
+    plan.x = t2_canonical(edges, ok, live, dests, k, plan.u, V, headroom)
+    plan.tunnels = t2_program(edges, roster, live, dests, k, plan.x, plan.u)
+    plan.J, plan.phi = t2_objectives(edges, plan.x, V, plan.u, headroom)
+    return plan
+
+
+def live_share(roster, live, z):
+    """G(z): the live heads' part of the round-robin total z."""
+    H = len(roster)
+    return sum(rr(z, H, i) for i, h in enumerate(roster) if h in live)
+
+
+def live_budget(edges, plan, V):
+    """F'(k): the largest total whose live shares fit on the program (dead shares
+    ignored)."""
+    roster = plan.roster
+
+    def fits(z):
+        amounts, _ = entry_shares(z, roster, plan.tunnels)
+        return all(
+            a <= c for a, c in zip(loads(edges, plan.tunnels, amounts), V, strict=True)
+        )
+
+    M = len(roster) * plan.count
+    lo, hi = 0, M * (plan.U + 1)
+    while hi - lo > 1:
+        mid = (lo + hi) // 2
+        lo, hi = (mid, hi) if fits(mid) else (lo, mid)
+    return lo
+
+
+def t2(
+    edges, sources, dests, N, D=None, *, up_to=False, V=None, mask=None, headroom=False
+):
+    """T2 for TunnelCount(N) or TunnelCount(N, up_to=True) on the free capacity V (default: the
+    capacities). Returns the T2Plan with its forwarding bound, and for "up to" the per-count
+    scores."""
+    V = list(V) if V is not None else [c for _, _, c, _ in edges]
+    ok = allowed(edges, mask)
+    xn = set(mask[0]) if mask else set()
+    live_dests = [d for d in dests if d not in xn]
+    roster = roster_of(edges, sources, dests, mask)
+    live = t2_live(edges, roster, dests, V, mask)
+    scores = []
+    if up_to:
+        target = live_share(roster, live, D) if D is not None else None
+        for k in range(1, N + 1):
+            at = t2_at(edges, ok, roster, live, live_dests, k, V, None, headroom)
+            budget = live_budget(edges, at, V) if at.tunnels else 0
+            z = budget if D is None else min(D, budget)
+            scores.append(live_share(roster, live, z) if at.U else 0)
+        hit = [
+            k for k in range(1, N + 1) if target is not None and scores[k - 1] == target
+        ]
+        chosen = (
+            hit[0] if hit else min(range(1, N + 1), key=lambda k: (-scores[k - 1], k))
+        )
+    else:
+        chosen = N
+    plan = t2_at(edges, ok, roster, live, live_dests, chosen, V, D, headroom)
+    if not live:
+        plan.count = 1 if up_to else N
+    plan.F = t2_bound(edges, plan, V)
+    plan.scores = scores
+    return plan
+
+
+def program_roster(plan):
+    """The roster a T2 program installs: the policy's whole roster, also without tunnels."""
+    return plan.roster
diff --git a/tests/reference/policy/README.md b/tests/reference/policy/README.md
new file mode 100644
index 0000000..3eb1ab8
--- /dev/null
+++ b/tests/reference/policy/README.md
@@ -0,0 +1,312 @@
+# Policy fixture reference
+
+## In plain words
+
+`tests/data/policy_fixtures.json` holds 31 small scenarios (graphs, ledgers, policies and their
+calls) together with the result every call must produce. Both replay tests read it:
+`tests/cpp/flow_policy_fixture_tests.cpp` runs the scenarios on the C++ engine and
+`tests/py/test_flow_policy_fixtures.py` runs them through the Python binding; each compares
+every result, trace, ledger state and policy state exactly.
+
+The expected values were **not** computed by this library. They come from an independent
+reference: two plain-Python prototypes written from the design contract before the C++ engine
+existed (prototype 1, the amounts, search and kernels; prototype 2, the placement
+transaction and the policy engine), with every fixture's expected values derived by hand in
+the fixture text. This directory is a frozen copy of that reference and of the exporter that
+ran it to write the JSON file, so a clean checkout can reproduce the data byte for byte without
+the library and without the untracked design tree the code came from.
+
+The data is frozen: it is never regenerated from the build. The command below proves that it
+still equals what the reference computes; a change of the data is a deliberate data change,
+reviewed as such. Four such changes have been made: when edges of capacity 0 became ordinary
+routing edges ("Zero-capacity links stay in routing" below), when the sources of one demand
+were pooled and the origin arrived ("Pooled sources and the origin" below), when `Pinned`
+began to forward programs ("Forwarding programs" below), and when T1 replaced the per-source
+`CapacityAware` ("T1 replaces CapacityAware" below).
+
+## The historical `source` string inside the data
+
+The JSON's `source` field reads "prototype 2 of the design tree dev/design/2026-10-streamline
+(untracked by design): prototypes/p2_transaction in integer units (APPROACH 9), exported by
+gates/1c/export_fixture_data.py". It names the exporter that first wrote the file, under its
+earlier name `tests/data/p2_fixtures.json`, in the design tree's records of sub-PR 1c. The
+exporter copied here (`export_policy_fixtures.py`) replaced it with the same derivation and
+the same bytes when the file was renamed, and deliberately kept the string, because it is part
+of the content: changing it would change the bytes of the data. It is therefore kept
+unchanged, and this document is where it is explained. "APPROACH 9" is the section of the design
+contract on placement transactions; the contract is not part of the repository.
+
+## Reproduce and check
+
+From the repository root, with any Python 3.11 or later (only the standard library is used;
+`-I` keeps the environment and the user's site out, `-S` additionally proves the build is not
+needed, since without site-packages the library cannot be imported):
+
+    venv/bin/python -I -B tests/reference/policy/export_policy_fixtures.py --check
+    # prints "policy fixture data: identical" and exits 0; "DIFFERS" and exit 1 otherwise
+
+    venv/bin/python -I -B -S tests/reference/policy/export_policy_fixtures.py --out /tmp/policy_fixtures.json
+    cmp /tmp/policy_fixtures.json tests/data/policy_fixtures.json
+
+Without `--out` the exporter writes `tests/data/policy_fixtures.json` relative to this
+directory (three levels up). It runs in under a second. Before running the fixtures it checks
+that every module of the reference was imported from this directory (an installed package of
+the same name, such as `graph` or `units`, would otherwise shadow it) and that no module of the
+library (`netgraph_core`, `_netgraph_core`) was imported.
+
+The data file: 189,030 bytes, sha256
+`e55ddf23a7630802fa2f8e4c410b282a2f3ca53d8b06c01875c5fdca56e5aa2e` (31 fixtures, 329
+operations).
+
+This directory is excluded from the source distribution (`sdist.exclude` in `pyproject.toml`);
+the wheel holds only the `netgraph_core` package. No test imports it.
+
+## Contents and origin
+
+The copies are the complete set of modules the exporter imports, found by running it and
+listing the imported modules (lazy imports inside functions included: every fixture runs).
+Their bodies are unchanged except for the rule changes at the end of this file; they
+cite the design contract's sections and notes, which are not in the repository. `p2_transaction/_p1.py` appends the sibling `p1_amount/` to `sys.path`, so
+the two directory names are part of the layout. `run_fixtures.py` is used only for its
+`run_one`; its own `main` would write snapshots beside it and is not used.
+
+Original paths are relative to the design tree `dev/design/2026-10-streamline/` (untracked);
+the copies were taken on 2026-10-09.
+
+| Copy (this directory) | Original | sha256 of the original | sha256 of the copy |
+| --- | --- | --- | --- |
+| `export_policy_fixtures.py` | `equivalence/export_policy_fixtures.py` | `0aea76a050b2d83e7398559af6a7d484a5a82a48b35bac9a3686f5fdf73211d2` | `bf5764501039121ad55c6bcaeac4cce0b4b7cbeaeb95ff401cd01b608e6ef2b1` (relocated; pooled sources; programs; T1, below) |
+| `p2_transaction/_p1.py` | `prototypes/p2_transaction/_p1.py` | `3ec5468e1ee8357faa9d85e6d748c718de63baee22e064c204324e42de42ec98` | same |
+| `p2_transaction/fixtures.py` | `prototypes/p2_transaction/fixtures.py` | `ea05c85ce851fd7b7c6ff34b6a9eedbfd7b280187d0bf7e7965e626e4fe52071` | `255039ac5eaab9205168f9aeb8855ea2742b33a655db08717c761f05a71b0760` (zero capacity; pooled sources; programs; T1, below) |
+| `p2_transaction/policy.py` | `prototypes/p2_transaction/policy.py` | `b367b71c6052cb70c9b107ec7fdd15f491349cfd6fdfcb12a18f24ab69a4d27b` | `cb5f553ee86fe3275132231065f5fda7e39d5d3100a432d9b012eb77b402930a` (zero capacity; pooled sources; programs; T1, below) |
+| `p2_transaction/recorder.py` | `prototypes/p2_transaction/recorder.py` | `fb4a8f20ccc6ecef4bc6d934226df33d84ee4dbf70c59aad9f33a097b9d0eb8a` | same |
+| `p2_transaction/run_fixtures.py` | `prototypes/p2_transaction/run_fixtures.py` | `c20d655a2324c42201e9b743c51ef16bb47942dda56782e2d16b135a9c4db2fa` | same |
+| `p1_amount/apportion.py` | `prototypes/p1_amount/apportion.py` | `c1e2f5082a99db1d0e7de5cf4e713ad5790aca3d85060583d536f5bc7fdcd4b1` | same |
+| `p1_amount/certify.py` | `prototypes/p1_amount/certify.py` | `e4f0cce8a68fd512026e6e1c84c558b370d0741564b8191b8893de5cf173ad95` | `8d27afb711fd54f7063e75fe60137a5e37dbeea7dafb01d5788f6922d7f9c5b7` (zero capacity, below) |
+| `p1_amount/flowcore.py` | `prototypes/p1_amount/flowcore.py` | `72b3d8c91a077017cf759d4c834576b1babd513024e9e227650d273d8b08da2c` | `63a6cf7047cb2fe91d5992f23e5d9bada1b89e70a4cff595be0a24ddabb681df` (zero capacity, below) |
+| `p1_amount/graph.py` | `prototypes/p1_amount/graph.py` | `44051d4a496a423c73ed473b6d4da045c32e30b40701bec0ecb19b8d9e5822a8` | same |
+| `p1_amount/kernels.py` | `prototypes/p1_amount/kernels.py` | `6e8db4d6de8c275d0335a9fddad28b7f84daa7af04d3ab872e4078cc4f709729` | `799aef2bd6735b6e5d26365ecb578448ae641da2bf1e6b47c4d34c9dcafd1094` (zero capacity; T1, below) |
+| `p1_amount/ledger.py` | `prototypes/p1_amount/ledger.py` | `19a8ab41f7ae26ece8b8a0f151c55a287f0cdf22a779d8c6d2f9d8e5dc43fcf6` | `fb55b11fa7c416024dd8c6faef63f08f831f77bf20585e78f3847b515aa3a6c2` (pooled sources, below) |
+| `p1_amount/search.py` | `prototypes/p1_amount/search.py` | `3ab124b99fa68e25d467cfbb22a4e9900ade86e10001269df84f3c99ad31e04a` | `2553786c44644f41990f6e4b0e03a8806dd0fccf9e344f8a0acef8663749e15a` (zero capacity; T1, below) |
+| `p1_amount/snap.py` | `prototypes/p1_amount/snap.py` | `0d62ff46d3c804bdbc80fae3c2c59a25aa0b34c013a086e7e81b7f722bdc0552` | same |
+| `p1_amount/units.py` | `prototypes/p1_amount/units.py` | `38b37a22ae56f592a63554683e860b44036cce678a7080f406a69c281a620cfe` | `7332c631289bd3916357fe68c1c8906476d94918fd5d6fc4b3ad8fd113ab4486` (T1, below) |
+
+The rest of the two prototype directories (their notes, tests, snapshots, the MSD study
+`msd.py` and the historical grid prototypes) is not part of the reference and was not copied.
+
+## Relocation changes
+
+At the relocation only the exporter changed, and only where it named the design tree's layout:
+
+1. The usage line names the new path; a paragraph says the file is a relocated copy and points
+   here (the rest of the docstring describes the original layout and is kept).
+2. Paths: `DESIGN = HERE.parent` is gone; `REPO = HERE.parents[2]` (was `DESIGN.parents[2]`);
+   `P2 = HERE / "p2_transaction"` (was `DESIGN / "prototypes" / "p2_transaction"`). `OUT` is
+   unchanged in meaning (`tests/data/policy_fixtures.json` of the repository).
+3. The origin check: it compared five modules with the prototypes directory
+   (`origin.is_relative_to(DESIGN / "prototypes")`); it now compares every module of the
+   closure (`CLOSURE`, all fourteen) with its exact file in this directory, and also fails if
+   the library was imported.
+4. The comment on removing the script's directory from `sys.path` says the directory held
+   another `recorder.py` in the original layout; the removal is kept.
+
+The output, including the `source` string, is unchanged: the check above compares the bytes.
+
+## Zero-capacity links stay in routing
+
+The library's rule changed: an edge of capacity 0 is no longer treated as missing. Searches,
+static supports, rosters and Stretch baselines read no capacity (only an explicit residual
+filters), an `EqualBalanced` route keeps such an edge as a member that receives its round-robin
+share and carries nothing, a `Weighted` route gives it weight 0 (no member), a priority read
+without a residual reads the capacity as the free capacity (`Headroom` 1, or 0 on an edge of
+capacity 0), and a minimum cut lists every edge leaving the sources' residual closure, whatever its
+free capacity. The reference was changed in exactly these places, by hand from that rule:
+
+1. `p1_amount/search.py`: `member_graph` no longer skips edges below 1 unit; `priority_fn`
+   reads the capacity as the residual when none is given, and `Headroom` is 0 on an edge of
+   capacity 0; the module docstring says so.
+2. `p1_amount/kernels.py`: `make_plan` takes every route edge as a member for `MaxFlow` and
+   `EqualBalanced` (the `Weighted` rules are unchanged); the module docstring says so.
+3. `p2_transaction/policy.py`: a `Pinned` bundle's usable route keeps the allowed edges whatever
+   their capacity.
+4. `p1_amount/flowcore.py` and `p1_amount/certify.py`: the minimum cut (and its certificate) is
+   every active edge leaving the residual closure of the sources, an edge of view 0 too: it adds
+   0 to the cut's value and is listed because every edge leaving the closure is. No fixture's
+   data changes by this rule.
+5. `p2_transaction/fixtures.py`: the two fixtures whose own hand-derived checks stated the old
+   rule. `admission_zero_and_no_route`: `CostOnly` (MaxFlow) on the diamond whose four links have
+   capacity 0 now has source 0 in its roster and, on `place(1)`, creates one zero-delivery record
+   whose bundle is the whole static support (both routes cost 2), route cost 2, `exhausted`
+   (previously an empty roster and `no_route`). `termination_reduction`: its empty-roster case
+   now uses a graph whose only edge leads away from the destination (`1 -> 0`, capacity 1),
+   since a zero-capacity edge would put the source in the roster; its three results are unchanged
+   (only the ledger's residual reads that edge's 1 unit).
+
+Every other fixture is unchanged: the exported data differs from the earlier file only in these
+two fixtures' operations (`admission_zero_and_no_route` operations 6 and 7,
+`termination_reduction` operations 20 to 22) and that graph.
+
+## Pooled sources and the origin
+
+The library's rule changed again: the sources of one demand are pooled and how traffic enters is
+the demand's origin. A CostOnly policy with `EqualBalanced` or `Weighted` prepares, at its
+epoch's first positive call, each roster source's route on the residual at that call's entry and
+forwards over their union: a router several sources pass splits their traffic once, and each
+member's amount (and, where a link drops, what it carries) is given back to the sources by
+highest averages over what each holds; Lossless admits the largest total whose round robin over
+the roster forwards with no drop and gives no share to a source without a member. CostOnly
+`MaxFlow` and Global are controllers: one solve over the union of the routes (CostOnly) or every
+allowed edge (Global), with the optimized origin (one virtual source) by default or the equal
+origin (source i's arc capped at its round-robin share; the largest total that fits, by
+bisection). Results report the demand's accounting and one row per input source instead of the
+per-source outcomes. The reference was changed in exactly these places, by hand from that rule:
+
+1. `p2_transaction/policy.py`: `FlowPolicyConfig` takes an optional placement and selection,
+   `Outputs` a `min_cut` flag, and `PlacementResult` the new fields (`delivery_delta`,
+   `call_drops`, `call_source_loss`, `requested`, `offered`, `admitted`, `delivered`,
+   `unadmitted`, `source_loss`, epoch `drops`, `by_source`, `total_cost`) in place of
+   `local_outcomes`; `ha` (highest averages with zero weights), `Program`, `make_program` and
+   `forward` (the pooled program and its attribution); `_prepare`, `_source_flow`,
+   `_place_pooled` and `_place_controller` (optimized origin only) replace the per-source
+   CostOnly stage and `_place_global`; validation follows the new table (Global takes no placement or selection; the
+   pooled single-path rule); the epoch also resets the offered total, the prepared program and the
+   curve; `Pinned` reports `NO_ACTIVE_WEIGHT` and its Lossy offered total and source loss.
+   The fixture reference has no origin selector: split CostOnly uses EQUAL, and controllers use
+   OPTIMIZED. Equal-origin controllers are checked separately by `tests/py/origin_oracle.py`
+   (`tests/py/test_origin.py`) and the native controller tests (`GlobalEqual.*`,
+   `CostOnlyMaxFlow.*` in `tests/cpp/pooled_origin_tests.cpp`).
+   CapacityAware keeps its per-source transaction and its reduction of per-source outcomes, now
+   only in the trace.
+2. `export_policy_fixtures.py`: a configuration's `selection` may be `None`, and the outputs are
+   written as four flags (`min_cut` last); a record has no `placement` (below).
+3. `p2_transaction/fixtures.py`: `glob()` builds Global without a placement or selection;
+   `lossy_diamond` reads this call's drops as `call_drops`; `termination`'s empty roster reads
+   its zero `by_source` row; `global_capped_underfill` requests `min_cut` by its flag. The
+   multi-source fixtures whose own hand-derived checks stated the per-source rule were derived
+   again by hand from the new rule: `sources_lossy_per_source`
+   (router X splits 8 once; X->3 carries 3 = H(3, [4, 4]) = [2, 1]: deliveries 2 and 1, drops 2
+   and 3), `sources_attribution` and `sources_inf_every_kernel` (Lossless: MaxFlow 3 under the
+   optimized origin, Weighted and EqualBalanced 2 = [1, 1] under the equal origin; Lossy
+   unchanged), `sources_eb_per_source` (8 = [4, 4], not 4 + 10), `sources_1_9_request_4` (MaxFlow
+   [1, 3], 4, complete; Weighted and EqualBalanced [1, 1], 2, exhausted),
+   `sources_partition_1_1_vs_2_0` ([2, 0] for both partitions), `sources_split_cumulative`
+   (MaxFlow supplies [1, 0, 0] then [2, 0, 0]; Lossy offers [1, 0] then [0, 1]),
+   `epochs_place_remove_place` (the supplies, read from the flow core's trace) and
+   `sources_maxflow_vs_global` (its prose: one controller on the union of the shortest walks;
+   value unchanged, 1). The other fixtures change only in the result's and the trace's shape.
+4. A record no longer carries its kernel (`FlowRecord.placement` is gone from the library: the
+   kernel is the policy's configuration). `p1_amount/ledger.py` drops the field from `FlowRecord`
+   and `Draft` and from the record's JSON, `p2_transaction/policy.py` no longer passes it, and the
+   exporter no longer writes it. The data lost exactly the 759 record `placement` keys; nothing
+   else changed.
+
+## Forwarding programs
+
+The library's rule changed again: `Pinned` forwards a `ForwardingProgram` (8.1) instead of a list
+of bundles, `Global(support=dag)` is the controller restricted to a DAG's edges, CostOnly
+`Weighted` takes its weights from a weight basis (`CAPACITY` by default, `RESIDUAL_SNAPSHOT`)
+instead of the selection's priority, and the change flags compare the installed program before and
+after a call. The reference was changed in exactly these places, by hand from those rules:
+
+1. `p2_transaction/policy.py`: `Global` takes a `support` (the controller's edges are the
+   support's edges on walks from the sources to the destinations, trimmed); `FlowPolicyConfig`
+   takes `weights` (CostOnly `Weighted`: `CAPACITY` or `RESIDUAL_SNAPSHOT`, the residual at the
+   preparing call's entry); `Pinned` is gone (no fixture builds one any more); the flags compare
+   the epoch's programs (the ordered heads, each entry's route; the injection and every weight),
+   so a first program sets both flags and a controller's re-solve that changes only an amount sets
+   `weights_changed`; `_decompose` returns the controller's paths.
+2. `export_policy_fixtures.py`: a configuration writes its `support` and `weights`; a policy's
+   state no longer has `usable`.
+3. `p2_transaction/fixtures.py`: every single-bundle "manual" owner (a `Pinned` `MaxFlow` policy
+   on one bundle, 29 owners) is `Global(support=bundle)`: the amounts are unchanged and a record's
+   bundle is the edges that carry its share; the nine `Weighted` configurations whose prose reads
+   the residual name `weights=RESIDUAL_SNAPSHOT` (their values are unchanged); `co()` builds the
+   CostOnly kernels as before. The other Pinned policies are removed, each with the test that now
+   covers what it showed (contract rules 8 to 10, values derived by hand):
+
+   | Removed | What it showed | Covering test |
+   | --- | --- | --- |
+   | `lossy_shared_ingress` (whole fixture) | two Lossy flows on one ingress, consumed in order | the loss rule inside one program: `ProgramLossy.Merge`, `PinnedMapping.SingleBundle` (M5), `test_programs.py::test_loss_rule`; Lossy calls are not additive: `PinnedProgram.Increments` (L10) |
+   | `eb_correlated_remainders` (whole fixture) | the cohort's round robin over flows that share a split | `PinnedProgram.SplitContextsAreSeparate` (each split route splits its own share), `PinnedProgram.Duplicates` (identical routes take their own shares) |
+   | `pinned_kernels_5_1` (whole fixture) | each kernel on routes of 5 and 1 | `PinnedMapping.SingleBundle` (M3, M4: round robin over entries; `Global(support)` for MaxFlow), `PinnedProgram.Duplicates` (`E-static-path-fill`), `ProgramLossy.Merge` (`E-support-pinned-loss`) |
+   | `pinned_bundle_rules` (whole fixture) | the bundle list's rejections, equal bundles kept, a mixed-cost DAG's `route_cost` | `FromRoutes.Texts`, `FromRoutes.Order`, `FromRoutes.ZeroWeightKept`, `PinnedProgram.FieldTexts`, `PinnedProgram.Endpoints`, `PinnedProgram.SeveralEndpoints`, `PinnedMapping.SingleBundle` (M8 to M10), `test_programs.py::test_pinned_facts_of_the_retired_reference_fixtures` (`route_cost` 3) |
+   | the Pinned halves of `four_calls_MaxFlow`, `_W`, `_EB`, `_Lossy` (12 operations each) | four calls of 1 on two pinned routes | `PinnedProgram.Increments` (L9 to L11), `Operations.PlaceContinuesTheEpoch`, `Operations.ControllerWeights` (a supported or unrestricted controller's increments) |
+   | the Pinned cohort of `eb_1_plus_2_vs_3` (7 operations) | `place(1); place(2)` equals `place(3)` | `test_programs.py::test_pinned_facts_of_the_retired_reference_fixtures` (Lossless Pinned is additive) |
+   | the Pinned part of `admission_zero_and_no_route` (3 operations) | every bundle excluded: `NO_ROUTE` | the same test (every tunnel failed: `NO_ROUTE`), `Replay.TunnelFailedByNode` |
+   | the Pinned policy of `limits_kmaxflowspercall` (3 operations) | the creation cap does not count Pinned flows | none: the cap was deleted with T0 ("T1 replaces CapacityAware" below), and with it its test `test_the_creation_cap_does_not_limit_pinned_records` |
+   | the Pinned half of `flag_zero_delivery_creation` (6 operations) | a zero-delivery creation and its flags | `test_programs.py::test_pinned_facts_of_the_retired_reference_fixtures` (both flags on the first program, none on the next zero call), `Operations.OfferOnly` |
+   | the rejected Pinned source set of `sources_limits_and_validation` (1 operation) | Pinned required single endpoints | `PinnedProgram.SeveralEndpoints` (accepted now) |
+
+   The policy ids of the fixtures that lost a policy are renumbered.
+
+The data changed in exactly these ways: four fixtures and 103 operations fewer; the 29 owners'
+configurations and record bundles; `support` and `weights` in the configurations; every policy
+state lost its `usable` key (332 keys); and the flags of the first program of each epoch
+(`weights_changed` true) and of two CostOnly `MaxFlow` re-solves whose paths change
+(`routes_changed` true).
+
+## T1 replaces CapacityAware
+
+The library's rule changed again (the contract's section 6): `CapacityAware` is T1, every head
+setting up its own strict tunnels by CSPF and forwarding over them; the per-source transaction
+(creation, reoptimisation, amounts and growth, the diminishing guard, the call-wide creation cap,
+the local outcomes and their reduction, `LIMIT_FLOWS` and `LIMIT_DIMINISHING`) is gone, and T1
+is checked by the library's own tests (no reference is derived for it here). The reference was
+changed in exactly these places:
+
+1. `p2_transaction/policy.py`: `CapacityAware`, `Diminishing`, the per-source stages and their
+   state (`SourceState`, `_search`, the per-flow amounts, `_offers`, `_place_flows`,
+   `_local_outcome`, `_run_source`, `_stage1` to `_stage4`), the outcome ranks, the creation
+   cap `MAX_FLOWS_PER_CALL` and the per-source Stretch baselines are removed; validation keeps
+   CostOnly's and Global's rules.
+2. `p1_amount/kernels.py`: the per-flow kernels only the stages used (`make_plan`, `alloc`,
+   `fits`, `t_max`, the per-flow `maxflow`, `lossy`) and `check_kernel`'s priority rule (a
+   Weighted flow's weights from the Headroom priority) are removed; `p1_amount/search.py`: the
+   cost ceilings (`check_ceiling`, `stretch_le`, `within_ceiling`, `static_shortest`), which only
+   those stages read; `p1_amount/units.py`: `K_MAX_FLOWS_PER_CALL`.
+3. `export_policy_fixtures.py`: a configuration has no `CapacityAware` fields, a placement no
+   creation cap `cap`, and a policy's flow no `members` and `weights` (outside the per-source
+   transaction they were always the route and null); the trace normalisation no longer drops
+   the stages' probe counts (`evals`, `evaluations`), which no other code emits; the shim no
+   longer records a ledger's `copy` and `reset` or a policy's `destroy`, which no fixture has
+   now (the replay never read them either).
+4. `p2_transaction/fixtures.py`: every `CapacityAware` policy is removed with every later
+   operation on its ledger (their expected values read its records, ids and owners); a fixture
+   left with nothing of its own is removed whole. Removed whole (24): `creation_fewer_routes`,
+   `creation_retry_after_release`, `ten_versus_five`, `eight_versus_ten_capacity`,
+   `eight_versus_ten_residual`, `eight_versus_ten_headroom`, `request_12_on_5_5`,
+   `growth_request_6`, `growth_256_request_1278`, `harmful_growth_10_1`,
+   `hidden_beneficial_route`, `retention_third_party_removal`, `shared_capacity_view`,
+   `reopt_double_spend`, `retention_same_structure`, `limits_kmaxflowspercall`,
+   `limits_diminishing`, `lifetime_remove_orphan_reset`, `flag_table`,
+   `eb_two_flows_per_source_reservation`, `eb_resplit_3_3_to_3_2_2`,
+   `eb_growth_equal_route_stop`, `capacityaware_blocked_inf_remove_place`,
+   `eb_growth_single_path_repeat`. Partly kept (3): `inf_every_kernel` loses its two
+   `CapacityAware` ledgers (6 operations), `admission_zero_and_no_route` its two `CapacityAware`
+   policies (the zero request, the rejected `src == dst` construction and the zero-residual
+   ledger: 6 operations), and `termination_reduction`, renamed
+   `termination_complete_and_no_route`, its four `CapacityAware` ledgers (12 operations); the
+   helpers `tunnel`, `ca`, `routes` and `Ctx.shares` go with them.
+
+   | Removed | What it showed | Covering test |
+   | --- | --- | --- |
+   | creation and growth (`creation_fewer_routes`, the `growth_*` fixtures, `harmful_growth_10_1`, `hidden_beneficial_route`, `eb_growth_*`, `eb_resplit_3_3_to_3_2_2`, the `CapacityAware` part of `inf_every_kernel`) | per-source creation of flows and growth | deleted by the contract (T1 has no growth, 6.4) |
+   | reoptimisation (`retention_third_party_removal`, `shared_capacity_view`, `reopt_double_spend`, `retention_same_structure`) | reroutes of retained flows | deleted by the contract |
+   | the creation cap and the diminishing guard (`limits_kmaxflowspercall`, `limits_diminishing`) | `LIMIT_FLOWS`, `LIMIT_DIMINISHING` | deleted by the contract (14.2 has neither) |
+   | the local outcomes and their reduction (`termination_reduction`'s four `CapacityAware` cases) | per-source terminations | deleted by the contract; T1's terminations: `T1Operations.Terminations`, `T1Forwarding.AllDown` (every tunnel down) |
+   | per-source reservation targets (`ten_versus_five`, `eight_versus_ten_*`, `request_12_on_5_5`, `eb_two_flows_per_source_reservation`) | requests split per source, the priority read on the residual | T1's requests and attempts: `T1Setup.RoundOrder` (the requests in round order), `T1Setup.ContractExamples` (the contract's examples of a last tunnel down and of two heads on a shared link), `T1Setup.PriorityTies`, `T1Setup.PriorityReadsUnreserved` |
+   | a call blocked by another owner, then served after its removal (`creation_retry_after_release`, `capacityaware_blocked_inf_remove_place`) | the view other owners leave | `T1Setup.OtherOwnersHolds`; the epoch rules of +inf, `remove()` and a finite place after +inf: `FlowPolicyRequests.RejectedRequestsLeaveThePolicyAndTheLedger` |
+   | the lifetime law (`lifetime_remove_orphan_reset`) | reset and copy rejected while bound, `remove()` reverts and retires ids, orphans until `reset()`, ids never reused | `FlowLedger.BoundWithFlowsRowAndEpochs`, `FlowLedger.OrphanedRecordsResetAndCopy`, `test_flow_ledger.py::test_lifetime_bound_rows_and_epochs`, `test_flow_ledger.py::test_orphans_from_destruction_reset_and_copy`; with holds: `LedgerProjections.RemoveReleasesBoth`, `LedgerProjections.OrphansAndReset`, `LedgerProjections.Copy` |
+   | the flag table (`flag_table`) | flags as committed events of the per-source transaction | deleted by the contract (flags compare programs, 10.4): `Operations.FirstProgramFlags`, `test_programs.py::test_change_flags_of_empty_programs_and_place_zero`; T1: `T1Operations.Flags`, `T1Operations.FirstFlags` |
+   | `admission_zero_and_no_route`'s `CapacityAware` cases | a zero request creates nothing; `src == dst` rejected; no route on a zero residual | T1 rejects `place` (`TunnelOperations.NoIncrements`); zero offers: `TunnelZero.T1`; endpoints: `FlowPolicyConfig.EveryRejectedCombinationBeforeBinding`; a zero reservation baseline: `LedgerProjections.Baselines` |
+
+   No fixture is left with a copy, a reset or a destruction of a ledger or policy (all were in
+   `lifetime_remove_orphan_reset`), so the data holds only the operations `ledger`, `policy`,
+   `place` and `remove`, and the exporter records only those (item 3). A future fixture with one
+   of the others adds its recording back with the replay of it.
+
+The data changed in exactly these ways: 24 fixtures and 204 operations fewer; in the three
+partly kept fixtures the graph, ledger and policy ids are renumbered and one fixture is renamed;
+every placement lost its `cap` key and every flow of a policy state its `members` and `weights`
+keys. Every other byte of every kept operation is unchanged (checked operation by operation
+against the earlier file).
diff --git a/tests/reference/policy/export_policy_fixtures.py b/tests/reference/policy/export_policy_fixtures.py
new file mode 100644
index 0000000..8ca1706
--- /dev/null
+++ b/tests/reference/policy/export_policy_fixtures.py
@@ -0,0 +1,398 @@
+"""Export prototype 2's fixtures as replay data for the Core tests (sub-PR 1c).
+
+    venv/bin/python -I tests/reference/policy/export_policy_fixtures.py [--check] [--out PATH]
+
+Relocated copy (cleanup batch K2, decision D1): this file and the prototype modules beside it in
+``p2_transaction/`` and ``p1_amount/`` are a frozen copy of the design tree's exporter and of
+its import closure; ``README.md`` here lists the original paths, hashes and every relocation
+change. The text below describes the original layout.
+
+The maintained exporter of the policy fixture data (task 1c-grooming, brief item 8): the saved
+exporter ``gates/1c/export_fixture_data.py`` wrote ``tests/data/p2_fixtures.json`` and stays as
+the 1c gate's history; this copy writes the renamed file ``tests/data/policy_fixtures.json``
+with the same derivation and the same bytes. The data's own ``source`` string still names the
+saved exporter that first wrote it: it is part of the content, which the rename keeps byte for
+byte (a later change of that string is a deliberate data change, not a rename).
+
+Every fixture of ``prototypes/p2_transaction/fixtures.py`` runs on the PROTOTYPE (the
+reference; never the build) with a recording shim installed before ``fixtures`` is
+imported: ``ledger.FlowGraph`` and ``policy.FlowPolicy`` are replaced by subclasses that log
+every construction and call. The output ``tests/data/policy_fixtures.json`` (compact, deterministic)
+holds per fixture:
+
+* ``graphs``: ``n``, ``q`` (the resolution), the edges in input coordinates
+  ``[u, v, capacity units, cost]`` and the B' ``input_index`` (the replay checks that the
+  build ranks the edges the same way);
+* ``ops`` in call order: ``ledger`` (graph, baseline in B' id order or null), ``policy``
+  (ledger, sources and destinations as given, the full configuration with a Global support as
+  an ascending B' edge list and a Weighted weight basis when given, the Eligibility as
+  excluded node and edge ids, or ``error``), ``place`` (volume as an int or ``"inf"``, the
+  outputs flags) and ``remove`` (a ledger's copy and reset and a policy's destruction are not
+  recorded: no fixture has one since T0 was deleted);
+* after every operation the prototype's expected values (``expect``): the call's result
+  (``to_json``: placed, remaining, termination, flags, drops, the cost curve and the
+  requested outputs), the ledger state (allocated and residual in id order, every record
+  field with the bundle as an ascending edge list, next FlowId, bound and orphaned owners),
+  the policy state (roster, requested, +inf, placed demand, per source the flows' id, route,
+  T (null for Lossy: prototype 2 keeps none), delivered and alloc) and the normalised trace
+  (prototype 2's keys; the flow core's ``counters`` and ledger uids dropped; FlowIds as ids).
+
+An operation the prototype rejects is recorded with ``"error": true`` (the build must raise
+too; the messages differ) and the ledger state after it (unchanged). ``--check`` recomputes
+the data and compares it with the file.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REPO = HERE.parents[2]
+P2 = HERE / "p2_transaction"
+OUT = REPO / "tests" / "data" / "policy_fixtures.json"
+# The modules of the reference: each must come from this bundle (p2_transaction/ or
+# p1_amount/), never from an installed package of the same name.
+CLOSURE = (
+    ("_p1", "fixtures", "policy", "recorder", "run_fixtures"),
+    (
+        "apportion",
+        "certify",
+        "flowcore",
+        "graph",
+        "kernels",
+        "ledger",
+        "search",
+        "snap",
+        "units",
+    ),
+)
+
+# The original directory held the old-build recorder.py, and prototype 2 has its own recorder
+# module (its fixtures import PSnap from it): the directory leaves sys.path before the prototypes
+# are imported, so no module of the tooling can shadow one of the reference's (kept in the copy).
+sys.path[:] = [p for p in sys.path if Path(p or ".").resolve() != HERE]
+sys.path.insert(0, str(P2))
+
+import _p1  # noqa: E402, F401  (prototype 1 appended to sys.path)
+import ledger  # noqa: E402
+from snap import jsonable  # noqa: E402
+from units import ContractError  # noqa: E402
+
+BaseFlowGraph = ledger.FlowGraph
+
+
+class Recorder:
+    def __init__(self) -> None:
+        self.graphs: list[dict] = []
+        self.graph_ids: dict[int, int] = {}
+        self.ledgers: list[object] = []
+        self.policies: list[object] = []
+        self.ops: list[dict] = []
+
+    def graph_id(self, g) -> int:
+        got = self.graph_ids.get(g.uid)
+        if got is not None:
+            return got
+        pos = g.input_index()
+        edges = [None] * g.num_edges
+        for e in range(g.num_edges):
+            edges[pos[e]] = [g.src[e], g.dst[e], g.capacity[e], g.cost[e]]
+        self.graphs.append(
+            {
+                "n": g.num_nodes,
+                "q": float(g.q),
+                "edges": edges,
+                "input_index": list(pos),
+            }
+        )
+        self.graph_ids[g.uid] = len(self.graphs) - 1
+        return len(self.graphs) - 1
+
+    def ledger_id(self, fg) -> int:
+        for i, x in enumerate(self.ledgers):
+            if x is fg:
+                return i
+        raise AssertionError("a ledger the recorder did not see")
+
+    def policy_id(self, pol) -> int:
+        for i, x in enumerate(self.policies):
+            if x is pol:
+                return i
+        raise AssertionError("a policy the recorder did not see")
+
+
+REC: Recorder | None = None
+
+
+# ------------------------------------------------------------------ normalisation
+
+
+def norm(x):
+    """Drop process-dependent and operation-count fields; FlowIds to their id."""
+    if isinstance(x, dict):
+        out = {}
+        for k, v in x.items():
+            if k in ("ledger_uid", "counters"):
+                continue
+            if k in ("flow_id", "flow") and isinstance(v, list) and len(v) == 2:
+                out[k] = v[1]
+                continue
+            out[k] = norm(v)
+        return out
+    if isinstance(x, list):
+        return [norm(v) for v in x]
+    return x
+
+
+def ledger_state(fg) -> dict:
+    return {
+        "allocated": list(fg.allocated()),
+        "residual": list(fg.residual()),
+        "records": [
+            {
+                "flow_id": r.flow_id[1],
+                "owner": r.owner,
+                "sources": list(r.sources),
+                "destinations": list(r.destinations),
+                "admission": r.admission,
+                "bundle": sorted(r.bundle),
+                "route_cost": None
+                if r.route_cost == sys.modules["units"].UNREACHABLE
+                else r.route_cost,
+                "offered": r.offered,
+                "delivered": r.delivered,
+                "edges": [[e, x] for e, x in sorted(r.edges.items()) if x],
+                "drops": [[e, x] for e, x in sorted(r.drops.items()) if x],
+            }
+            for r in fg.records()
+        ],
+        "next_flow_id": fg.next_flow_id(),
+        "bound": sorted(fg._bound),
+        "orphans": sorted(fg._orphans),
+    }
+
+
+def policy_state(pol) -> dict:
+    lossy = pol.admission == "Lossy"
+    cohorts = []
+    for s in sorted(pol.cohorts):
+        flows = pol.cohorts[s]
+        if not flows:
+            continue
+        out = []
+        for f in flows:
+            out.append(
+                {
+                    "id": f.flow_id[1],
+                    "route": list(f.route),
+                    "T": None if lossy else f.T,
+                    "delivered": f.delivered,
+                    "alloc": [[e, x] for e, x in sorted(f.alloc.items()) if x],
+                }
+            )
+        cohorts.append([s, out])
+    return {
+        "roster": list(pol.roster),
+        "requested": pol.requested,
+        "infinite": pol.infinite,
+        "placed_demand": pol.placed_demand(),
+        "cohorts": cohorts,
+    }
+
+
+def config_json(cfg) -> dict:
+    r = cfg.routing
+    kind = type(r).__name__
+    routing: dict = {"kind": kind}
+    if kind == "Global" and r.support is not None:
+        routing["support"] = sorted(r.support)
+    sel = cfg.selection
+    out = {
+        "routing": routing,
+        "placement": cfg.placement,
+        "admission": cfg.admission,
+        "selection": None
+        if sel is None
+        else {
+            "multipath": sel.multipath,
+            "multi_edge": sel.multi_edge,
+            "tie_break": sel.tie_break,
+            "priority": sel.priority,
+        },
+    }
+    if cfg.weights is not None:
+        out["weights"] = cfg.weights
+    return out
+
+
+def elig_json(elig):
+    if elig is None:
+        return None
+    return {
+        "nodes": [v for v, ok in enumerate(elig.node_allowed) if not ok],
+        "edges": [e for e, ok in enumerate(elig.edge_allowed) if not ok],
+    }
+
+
+# ------------------------------------------------------------------ the shim
+
+
+class RecFlowGraph(BaseFlowGraph):
+    def __init__(self, g, residual=None) -> None:
+        op = {
+            "op": "ledger",
+            "graph": REC.graph_id(g),
+            "baseline": None if residual is None else list(residual),
+        }
+        try:
+            super().__init__(g, residual)
+        except ContractError:
+            REC.ops.append({**op, "error": True})
+            raise
+        REC.ledgers.append(self)
+        REC.ops.append({**op, "id": len(REC.ledgers) - 1, "error": False})
+
+
+def make_rec_policy(P):
+    Base = P.FlowPolicy
+
+    class RecPolicy(Base):
+        def __init__(
+            self, fg, sources, destinations, cfg, elig=None, cache=None
+        ) -> None:
+            op = {
+                "op": "policy",
+                "ledger": REC.ledger_id(fg),
+                "sources": jsonable(sources),
+                "destinations": jsonable(destinations),
+                "config": config_json(cfg),
+                "elig": elig_json(elig),
+            }
+            try:
+                super().__init__(fg, sources, destinations, cfg, elig, cache)
+            except ContractError:
+                REC.ops.append({**op, "error": True})
+                raise
+            REC.policies.append(self)
+            REC.ops.append(
+                {
+                    **op,
+                    "id": len(REC.policies) - 1,
+                    "error": False,
+                    "expect": {"policy": policy_state(self)},
+                }
+            )
+
+        def place(self, volume, outputs=None):
+            op = {
+                "op": "place",
+                "policy": REC.policy_id(self),
+                "volume": "inf"
+                if isinstance(volume, float) and math.isinf(volume) and volume > 0
+                else jsonable(volume),
+                "outputs": None
+                if outputs is None
+                else [
+                    outputs.edge_flows,
+                    outputs.residual,
+                    outputs.bottleneck,
+                    outputs.min_cut,
+                ],
+            }
+            try:
+                r = super().place(volume, outputs)
+            except ContractError:
+                REC.ops.append(
+                    {**op, "error": True, "expect": {"ledger": ledger_state(self.fg)}}
+                )
+                raise
+            REC.ops.append(
+                {
+                    **op,
+                    "error": False,
+                    "expect": {
+                        "result": jsonable(r.to_json()),
+                        "trace": norm(jsonable(r.trace)),
+                        "ledger": ledger_state(self.fg),
+                        "policy": policy_state(self),
+                    },
+                }
+            )
+            return r
+
+        def remove(self) -> None:
+            super().remove()
+            REC.ops.append(
+                {
+                    "op": "remove",
+                    "policy": REC.policy_id(self),
+                    "error": False,
+                    "expect": {
+                        "ledger": ledger_state(self.fg),
+                        "policy": policy_state(self),
+                    },
+                }
+            )
+
+    return RecPolicy
+
+
+def export() -> dict:
+    global REC
+    ledger.FlowGraph = RecFlowGraph
+    import policy as P
+
+    P.FlowGraph = RecFlowGraph
+    P.FlowPolicy = make_rec_policy(P)
+    from fixtures import FIXTURES
+    from run_fixtures import run_one
+
+    for directory, names in zip((P2, HERE / "p1_amount"), CLOSURE, strict=True):
+        for name in names:
+            origin = Path(sys.modules[name].__file__).resolve()
+            if origin != directory / f"{name}.py":
+                raise AssertionError(f"{name} came from {origin}, not the prototypes")
+    if any(m.split(".")[0] in ("netgraph_core", "_netgraph_core") for m in sys.modules):
+        raise AssertionError("the reference imported the build")
+    out = []
+    for fx in FIXTURES:
+        REC = Recorder()
+        data = run_one(fx)
+        if not data["passed"]:
+            raise AssertionError(f"{fx.name}: the prototype fails its own fixture")
+        out.append({"name": fx.name, "graphs": REC.graphs, "ops": REC.ops})
+    return {
+        "format": "p2-fixtures/1",
+        "source": "prototype 2 of the design tree dev/design/2026-10-streamline (untracked by "
+        "design): prototypes/p2_transaction in integer units (APPROACH 9), exported by "
+        "gates/1c/export_fixture_data.py",
+        "fixtures": out,
+    }
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    ap.add_argument("--check", action="store_true")
+    ap.add_argument("--out", type=Path, default=OUT)
+    args = ap.parse_args(argv)
+    text = json.dumps(export(), separators=(",", ":"), sort_keys=False) + "\n"
+    if args.check:
+        same = args.out.exists() and args.out.read_text() == text
+        print("policy fixture data:", "identical" if same else "DIFFERS")
+        return 0 if same else 1
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    args.out.write_text(text)
+    data = json.loads(text)
+    n_ops = sum(len(f["ops"]) for f in data["fixtures"])
+    print(
+        f"wrote {args.out}: {len(data['fixtures'])} fixtures, {n_ops} operations, {len(text)} bytes"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/reference/policy/p1_amount/apportion.py b/tests/reference/policy/p1_amount/apportion.py
new file mode 100644
index 0000000..744f02b
--- /dev/null
+++ b/tests/reference/policy/p1_amount/apportion.py
@@ -0,0 +1,131 @@
+"""House-monotone integer apportionment (APPROACH revision 24, section 2.1).
+
+* ``round_robin(I, k)``: EqualBalanced and Lossy EqualBalanced. ``floor(I / k)``
+  each, one more unit to the first ``I mod k`` members (members are listed in
+  ascending EdgeId).
+* ``highest_averages(I, w)``: Weighted and Lossy Weighted, the Jefferson / D'Hondt
+  rule with EdgeId ties. Closed-form evaluator: every member starts at its lower
+  quota ``floor(I * w_m / W)`` (exactly the quotients ``w_m / j >= W / I``), then the
+  remaining ``I - sum`` units (fewer than ``k``) go one at a time by a heap of the
+  exact next quotients ``w_m / (a_m + 1)``, ties by ascending EdgeId. Quotients are
+  compared by cross-multiplication; every product is checked to stay below 2^127
+  (the 128-bit claim of the contract).
+* ``highest_averages_slow``: the sequential definition, for tests only.
+* ``hamilton``: largest remainders, the rejected rule (review-13 D1), controls only.
+"""
+
+from __future__ import annotations
+
+import heapq
+from dataclasses import dataclass, field
+
+PRODUCT_LIMIT = 1 << 127
+
+
+@dataclass
+class ApportionStats:
+    """Work counters of the closed-form evaluator (diagnostics)."""
+
+    calls: int = 0
+    heap_pops: int = 0
+    max_product_bits: int = 0
+    pops_per_call: list[int] = field(default_factory=list)
+
+
+STATS = ApportionStats()
+
+
+def round_robin(total: int, k: int) -> list[int]:
+    if k <= 0:
+        raise ValueError("round robin over no member")
+    if total < 0:
+        raise ValueError("negative amount")
+    base, extra = divmod(total, k)
+    return [base + (1 if i < extra else 0) for i in range(k)]
+
+
+def _cross(a: int, b: int) -> int:
+    p = a * b
+    if p >= PRODUCT_LIMIT:
+        raise OverflowError("quotient comparison exceeds 128 bits")
+    bl = p.bit_length()
+    if bl > STATS.max_product_bits:
+        STATS.max_product_bits = bl
+    return p
+
+
+class _Quotient:
+    """Heap entry for ``w / d`` with ascending-EdgeId ties (index = member rank)."""
+
+    __slots__ = ("w", "d", "i")
+
+    def __init__(self, w: int, d: int, i: int) -> None:
+        self.w, self.d, self.i = w, d, i
+
+    def __lt__(self, other: _Quotient) -> bool:
+        # Larger quotient first; equal quotients by lower member rank (EdgeId).
+        left = _cross(self.w, other.d)
+        right = _cross(other.w, self.d)
+        if left != right:
+            return left > right
+        return self.i < other.i
+
+
+def highest_averages(total: int, weights: list[int]) -> list[int]:
+    k = len(weights)
+    if k == 0:
+        raise ValueError("highest averages over no member")
+    if total < 0:
+        raise ValueError("negative amount")
+    if any(w <= 0 for w in weights):
+        raise ValueError("weights must be positive")
+    STATS.calls += 1
+    wsum = sum(weights)
+    alloc = [_cross(total, w) // wsum for w in weights]
+    left = total - sum(alloc)
+    assert 0 <= left < k, (total, weights, alloc)
+    heap = [_Quotient(w, alloc[i] + 1, i) for i, w in enumerate(weights)]
+    heapq.heapify(heap)
+    pops = 0
+    for _ in range(left):
+        q = heapq.heappop(heap)
+        pops += 1
+        alloc[q.i] += 1
+        heapq.heappush(heap, _Quotient(q.w, alloc[q.i] + 1, q.i))
+    STATS.heap_pops += pops
+    STATS.pops_per_call.append(pops)
+    return alloc
+
+
+def highest_averages_slow(total: int, weights: list[int]) -> list[int]:
+    """Sequential D'Hondt: each unit to the member maximising ``w / (a + 1)``."""
+    alloc = [0] * len(weights)
+    for _ in range(total):
+        best = 0
+        for i in range(1, len(weights)):
+            lhs = weights[i] * (alloc[best] + 1)
+            rhs = weights[best] * (alloc[i] + 1)
+            if lhs > rhs:
+                best = i
+        alloc[best] += 1
+    return alloc
+
+
+def hamilton(total: int, weights: list[int]) -> list[int]:
+    """Largest remainders (rejected; not house-monotone: [1, 3, 3] at 3 and 4)."""
+    wsum = sum(weights)
+    alloc = [total * w // wsum for w in weights]
+    order = sorted(range(len(weights)), key=lambda i: (-(total * weights[i] % wsum), i))
+    for i in order[: total - sum(alloc)]:
+        alloc[i] += 1
+    return alloc
+
+
+def split(rule: str, total: int, weights: list[int] | None, k: int) -> list[int]:
+    """The node split of a kernel: ``"rr"`` or ``"ha"`` (weights in member order)."""
+    if rule == "rr":
+        return round_robin(total, k)
+    if rule == "ha":
+        assert weights is not None and len(weights) == k
+        return highest_averages(total, weights)
+    raise ValueError(f"unknown split rule {rule!r}")
diff --git a/tests/reference/policy/p1_amount/certify.py b/tests/reference/policy/p1_amount/certify.py
new file mode 100644
index 0000000..33b3bfb
--- /dev/null
+++ b/tests/reference/policy/p1_amount/certify.py
@@ -0,0 +1,269 @@
+"""Independent checks of the flow core (APPROACH revision 24, section 2.2).
+
+Nothing here imports ``flowcore``: the exhaustive minimum-cost function (tier a),
+an independent complete solver (tier b: successive shortest paths by Bellman-Ford on
+the residual, no potentials, no Dinic, its own arc order), and ``check_solve``, the
+certificate: feasibility, conservation with supply and demand, the attained value,
+the full residual closure, ``min_cut`` presence and value, dual feasibility inside
+the closure with the ``NEVER_REACHED`` sentinel tested first, the virtual-terminal
+convention, the curve shape and moment, and the complete curve on the independent
+domain ``0..min(cap, F_max)`` at the union of both breakpoint sets.
+"""
+
+from __future__ import annotations
+
+from collections import deque
+from fractions import Fraction
+from itertools import product
+
+NEVER_REACHED = -1
+VIRTUAL = (1 << 63) - 2
+
+
+def exhaustive(g, view, sources, dests, edges=None, want_flows=False):
+    """Minimum cost of every integer value; optionally every optimal flow."""
+    edges = list(range(g.num_edges)) if edges is None else sorted(edges)
+    S, D = set(sources), set(dests)
+    best: dict[int, int] = {}
+    argmin: dict[int, list[tuple[int, ...]]] = {}
+    for flow in product(*(range(view[e] + 1) for e in edges)):
+        bal = [0] * g.num_nodes
+        for e, x in zip(edges, flow, strict=True):
+            bal[g.src[e]] -= x
+            bal[g.dst[e]] += x
+        ok = True
+        for v in range(g.num_nodes):
+            if v in S:
+                ok = bal[v] <= 0
+            elif v in D:
+                ok = bal[v] >= 0
+            else:
+                ok = bal[v] == 0
+            if not ok:
+                break
+        if not ok:
+            continue
+        value = -sum(bal[s] for s in S)
+        cost = sum(g.cost[e] * x for e, x in zip(edges, flow, strict=True))
+        full = [0] * g.num_edges
+        for e, x in zip(edges, flow, strict=True):
+            full[e] = x
+        if value not in best or cost < best[value]:
+            best[value] = cost
+            argmin[value] = [tuple(full)]
+        elif cost == best[value] and want_flows:
+            argmin[value].append(tuple(full))
+    assert set(best) == set(range(max(best) + 1))
+    return (best, argmin) if want_flows else best
+
+
+def independent_curve(g, view, sources, dests, edges=None):
+    """Convex breakpoints ``[(value, cost)]`` by Bellman-Ford augmentation."""
+    edges = list(range(g.num_edges)) if edges is None else sorted(edges)
+    n = g.num_nodes
+    s_star, t_star = n, n + 1
+    arcs = []  # [u, v, cap, cost]
+    for e in edges:
+        arcs.append([g.src[e], g.dst[e], view[e], g.cost[e]])
+    for s in sources:
+        arcs.append([s_star, s, VIRTUAL, 0])
+    for d in dests:
+        arcs.append([d, t_star, VIRTUAL, 0])
+    flow = [0] * len(arcs)
+    points = [(0, 0)]
+    while True:
+        dist: list[int | None] = [None] * (n + 2)
+        dist[s_star] = 0
+        parent: dict[int, tuple[int, int]] = {}
+        for _ in range(n + 2):
+            changed = False
+            for i, (u, v, c, w) in enumerate(arcs):
+                if flow[i] < c and dist[u] is not None:
+                    nd = dist[u] + w
+                    if dist[v] is None or nd < dist[v]:
+                        dist[v] = nd
+                        parent[v] = (i, 1)
+                        changed = True
+                if flow[i] > 0 and dist[v] is not None:
+                    nd = dist[v] - w
+                    if dist[u] is None or nd < dist[u]:
+                        dist[u] = nd
+                        parent[u] = (i, -1)
+                        changed = True
+            if not changed:
+                break
+        if dist[t_star] is None:
+            return points
+        path = []
+        v = t_star
+        while v != s_star:
+            i, sign = parent[v]
+            path.append((i, sign))
+            v = arcs[i][0] if sign == 1 else arcs[i][1]
+        amount = min(arcs[i][2] - flow[i] if sign == 1 else flow[i] for i, sign in path)
+        for i, sign in path:
+            flow[i] += sign * amount
+        x, c = points[-1]
+        points.append((x + amount, c + amount * dist[t_star]))
+
+
+def value_at(points, x):
+    for (a, c), (b, d) in zip(points, points[1:], strict=False):
+        if a <= x <= b:
+            return Fraction(c) + Fraction(d - c, b - a) * (x - a)
+    if points and x == points[-1][0]:
+        return Fraction(points[-1][1])
+    raise ValueError(f"value {x} outside the curve domain")
+
+
+def curve_points(curve):
+    pts = [(0, 0)]
+    for c, u in curve:
+        pts.append((pts[-1][0] + u, pts[-1][1] + c * u))
+    return pts
+
+
+def check_solve(g, view, sources, dests, cap, sol, *, edges=None, tier="b"):
+    """Return the list of failed certificate clauses (empty when certified)."""
+    fails: list[str] = []
+    active = set(range(g.num_edges)) if edges is None else set(edges)
+    S, D = sorted(set(sources)), sorted(set(dests))
+    f = sol["edge_flows"]
+    placed = sol["placed"]
+    pi = sol["potentials"]
+    curve = [tuple(t) for t in sol["cost_distribution"]]
+    for e in range(g.num_edges):
+        if e not in active and f[e]:
+            fails.append(f"flow on edge {e} outside the view")
+        if not 0 <= f[e] <= view[e]:
+            fails.append(f"edge {e}: flow {f[e]} outside [0, {view[e]}]")
+    bal = [0] * g.num_nodes
+    for e in range(g.num_edges):
+        bal[g.src[e]] -= f[e]
+        bal[g.dst[e]] += f[e]
+    supply = {s: -bal[s] for s in S}
+    inflow = {d: bal[d] for d in D}
+    for v in range(g.num_nodes):
+        if v in supply:
+            if supply[v] < 0:
+                fails.append(f"source {v} absorbs flow")
+        elif v in inflow:
+            if inflow[v] < 0:
+                fails.append(f"destination {v} emits flow")
+        elif bal[v] != 0:
+            fails.append(f"conservation at node {v}")
+    if sum(supply.values()) != placed or sum(inflow.values()) != placed:
+        fails.append("value differs from supply or inflow")
+    if cap is not None and not 0 <= placed <= cap:
+        fails.append("placed outside [0, cap]")
+    if cap == 0:
+        if pi != [NEVER_REACHED] * g.num_nodes:
+            fails.append("zero cap: potentials must all be NEVER_REACHED")
+        if curve or sol["min_cut"] is not None or any(sol["counters"].values()):
+            fails.append("zero cap: empty curve, min_cut None, counters 0")
+        return fails
+    # full residual closure of the super-source
+    n = g.num_nodes
+    s_star, t_star = n, n + 1
+    out: list[list[tuple[int, int, int]]] = [[] for _ in range(n + 2)]
+    for e in active:
+        u, v = g.src[e], g.dst[e]
+        if f[e] < view[e]:
+            out[u].append((v, g.cost[e], e))
+        if f[e] > 0:
+            out[v].append((u, -g.cost[e], e))
+    for s in S:
+        out[s_star].append((s, 0, -1))
+        if supply[s] > 0:
+            out[s].append((s_star, 0, -1))
+    for d in D:
+        out[d].append((t_star, 0, -1))
+        if inflow[d] > 0:
+            out[t_star].append((d, 0, -1))
+    seen = set(S)  # seeded at the real sources (revision 20)
+    q = deque(S)
+    while q:
+        u = q.popleft()
+        for v, _w, _e in out[u]:
+            if v not in seen:
+                seen.add(v)
+                q.append(v)
+    connected = t_star in seen
+    if cap is None and connected:
+        fails.append("uncapped solve left the destinations connected")
+    if cap is not None and placed != cap and connected:
+        fails.append("attained value: placed < cap with a residual path left")
+    mc = sol["min_cut"]
+    if connected:
+        if mc is not None:
+            fails.append("min_cut present on a connected (non-maximal) solve")
+    else:
+        expect = sorted(e for e in active if g.src[e] in seen and g.dst[e] not in seen)
+        if mc is None:
+            fails.append("min_cut missing on a maximal solve")
+        elif sorted(mc) != expect or list(mc) != sorted(mc):
+            fails.append(f"min_cut {mc} differs from the closure cut {expect}")
+        if sum(view[e] for e in expect) != placed:
+            fails.append("cut value differs from placed")
+    # dual feasibility inside the closure (sentinel tested before arithmetic)
+    for v in range(n):
+        if v in seen and pi[v] == NEVER_REACHED:
+            fails.append(f"closure vertex {v} holds NEVER_REACHED")
+    for s in S:
+        if s in seen and pi[s] != NEVER_REACHED and pi[s] != 0:
+            fails.append(f"reached root {s} has potential {pi[s]}")
+    for u in range(n):
+        if u not in seen or pi[u] == NEVER_REACHED:
+            continue
+        for v, w, _e in out[u]:
+            if v >= n or v not in seen or pi[v] == NEVER_REACHED:
+                continue
+            if w + pi[u] - pi[v] < 0:
+                fails.append(f"negative reduced cost on arc {u}->{v}")
+    reached = [d for d in D if pi[d] != NEVER_REACHED]
+    if reached:
+        pt = min(pi[d] for d in reached)
+        for d in reached:
+            if inflow[d] > 0 and pi[d] != pt:
+                fails.append(f"destination {d} with inflow: potential {pi[d]} != {pt}")
+            if pi[d] < pt:
+                fails.append("destination potential below pi(t*)")
+    elif placed:
+        fails.append("flow delivered but no destination reached")
+    # curve shape and moment
+    if any(u <= 0 for _c, u in curve):
+        fails.append("curve volume not positive")
+    if any(b[0] <= a[0] for a, b in zip(curve, curve[1:], strict=False)):
+        fails.append("curve costs not strictly increasing")
+    if sum(u for _c, u in curve) != placed:
+        fails.append("curve total differs from placed")
+    if sum(c * u for c, u in curve) != sum(
+        g.cost[e] * f[e] for e in range(g.num_edges)
+    ):
+        fails.append("curve moment differs from the flow cost")
+    # complete curve on the independent domain
+    pts = curve_points(curve)
+    if tier == "a":
+        best = exhaustive(g, view, S, D, edges=active)
+        fmax = max(best)
+        top = fmax if cap is None else min(cap, fmax)
+        if placed != top:
+            fails.append(f"placed {placed} != min(cap, F_max) = {top}")
+        for x in range(min(top, placed) + 1):
+            if value_at(pts, x) != best[x]:
+                fails.append(f"curve differs from the exhaustive optimum at {x}")
+                break
+    else:
+        ref = independent_curve(g, view, S, D, edges=active)
+        fmax = ref[-1][0]
+        top = fmax if cap is None else min(cap, fmax)
+        if placed != top:
+            fails.append(f"placed {placed} != min(cap, F_max) = {top}")
+        xs = {x for x, _ in pts} | {x for x, _ in ref}
+        for x in sorted(xs):
+            if x > min(top, placed):
+                continue
+            if value_at(pts, x) != value_at(ref, x):
+                fails.append(f"curve differs from the independent solver at {x}")
+                break
+    return fails
diff --git a/tests/reference/policy/p1_amount/flowcore.py b/tests/reference/policy/p1_amount/flowcore.py
new file mode 100644
index 0000000..a93893a
--- /dev/null
+++ b/tests/reference/policy/p1_amount/flowcore.py
@@ -0,0 +1,367 @@
+"""The one integer minimum-cost flow core (APPROACH revision 24, section 2.2).
+
+One objective on every view: minimum cost for the maximum value attainable under the
+value cap. Successive shortest paths with potentials and blocking flows: each tier
+runs Dijkstra on reduced costs to completion over the reachable residual (from the
+super-source, through the super-sink and onward), adds the distances to the
+potentials of the vertices it settles, then drains the zero-reduced-cost admissible
+subgraph by Dinic phases (BFS levels, DFS with current-arc pointers) until no
+admissible augmenting path remains or the cap is reached; then the next tier.
+
+Arc identity: every edge is its own arc. At a node the forward arcs of its
+out-edges and the reverse arcs of its in-edges are visited in one sequence ordered
+by ascending EdgeId (a self-loop's forward arc before its reverse arc); at a real
+endpoint node its virtual arc comes first; the super-source visits its arcs by
+ascending source NodeId and the super-sink by ascending destination NodeId.
+Virtual arcs cost 0 and carry ``2^63 - 2`` units (never saturated). Every solve starts from zero flow
+on the view, so potentials 0 are valid.
+
+``arc_order`` and ``arc_rank`` are mutant switches for the adjacency-order controls
+only: ``"interleaved"`` is the contract and ``"forward_first"`` visits every forward
+arc before any reverse arc; ``arc_rank[e]`` replaces the EdgeId as the sort key
+(for example the old global ``(cost, src, dst)`` rank of layout B).
+"""
+
+from __future__ import annotations
+
+import heapq
+from collections import deque
+from dataclasses import dataclass, field
+
+from graph import Eligibility, Graph, check_disjoint, check_node_set
+from units import (
+    INTERNAL_CAP_MAX,
+    NEVER_REACHED,
+    VIRTUAL_CAP,
+    ContractError,
+)
+
+COUNTER_NAMES = (
+    "dijkstra_runs",
+    "dijkstra_pops",
+    "settled",
+    "arc_scans",
+    "dinic_phases",
+    "augmentations",
+)
+
+
+@dataclass
+class FlowSolve:
+    """The private payload of ``_place_global_units`` plus diagnostics."""
+
+    placed: int
+    cost_distribution: list[tuple[int, int]]
+    edge_flows: list[int]
+    min_cut: list[int] | None
+    potentials: list[int]
+    counters: dict[str, int]
+    # Diagnostics (not payload fields): per-source supply, per-destination inflow,
+    # the internal super-sink potential, the full residual closure, tier traces.
+    supply: dict[int, int] = field(default_factory=dict)
+    inflow: dict[int, int] = field(default_factory=dict)
+    pi_sink: int | None = None
+    closure: list[int] = field(default_factory=list)
+    sink_in_closure: bool = False
+    tiers: list[dict] = field(default_factory=list)
+
+    def payload(self) -> dict:
+        return {
+            "placed": self.placed,
+            "cost_distribution": [list(t) for t in self.cost_distribution],
+            "edge_flows": list(self.edge_flows),
+            "min_cut": None if self.min_cut is None else list(self.min_cut),
+            "potentials": list(self.potentials),
+            "counters": dict(self.counters),
+        }
+
+
+def place_global_units(
+    g: Graph,
+    view,
+    sources,
+    destinations,
+    elig: Eligibility | None,
+    cap: int | None,
+) -> FlowSolve:
+    """The recorder's private entry point: validated, whole eligible graph."""
+    return solve(g, view, sources, destinations, cap, elig=elig)
+
+
+def _validate(g, view, sources, destinations, cap, elig):
+    if len(view) != g.num_edges:
+        raise ContractError("view length differs from the edge count")
+    for e, x in enumerate(view):
+        if not isinstance(x, int) or isinstance(x, bool):
+            raise ContractError("view entries must be integer units")
+        if not 0 <= x <= g.capacity[e]:
+            raise ContractError(f"view[{e}] = {x} outside [0, capacity]")
+    s = check_node_set(g, sources, "sources")
+    d = check_node_set(g, destinations, "destinations")
+    check_disjoint(s, d)
+    if cap is not None:
+        if not isinstance(cap, int) or isinstance(cap, bool):
+            raise ContractError("cap must be an int or None")
+        if not 0 <= cap <= INTERNAL_CAP_MAX:
+            raise ContractError("cap outside [0, 2^63 - 2]")
+    if elig is not None:
+        elig.check(g)
+    return s, d
+
+
+def solve(
+    g: Graph,
+    view,
+    sources,
+    destinations,
+    cap: int | None,
+    *,
+    edges=None,
+    elig: Eligibility | None = None,
+    arc_order: str = "interleaved",
+    arc_rank=None,
+    trace: bool = False,
+) -> FlowSolve:
+    """Minimum-cost flow of value ``min(cap, max)`` on ``view`` restricted to ``edges``."""
+    srcs, dsts = _validate(g, view, sources, destinations, cap, elig)
+    n = g.num_nodes
+    S, T = n, n + 1
+    allowed = None if elig is None else elig.edge_allowed
+    node_ok = None if elig is None else elig.node_allowed
+    if edges is None:
+        edges = range(g.num_edges)
+    active = sorted(
+        {e for e in edges if allowed is None or allowed[e]},
+    )
+    srcs = [s for s in srcs if node_ok is None or node_ok[s]]
+    dsts = [d for d in dsts if node_ok is None or node_ok[d]]
+
+    counters = dict.fromkeys(COUNTER_NAMES, 0)
+    edge_flows = [0] * g.num_edges
+    if cap == 0:
+        # Zero cap: no Dijkstra, every potential NEVER_REACHED, an empty curve,
+        # min_cut None (the cap was attained), every counter 0.
+        return FlowSolve(
+            placed=0,
+            cost_distribution=[],
+            edge_flows=edge_flows,
+            min_cut=None,
+            potentials=[NEVER_REACHED] * n,
+            counters=counters,
+            supply=dict.fromkeys(srcs, 0),
+            inflow=dict.fromkeys(dsts, 0),
+        )
+
+    # ---- arcs: index j and j ^ 1 are a forward/reverse pair
+    head: list[int] = []
+    res: list[int] = []
+    acost: list[int] = []
+    aedge: list[int] = []  # edge id, or -1 for virtual arcs
+
+    def add(u: int, v: int, c: int, w: int, e: int) -> int:
+        j = len(head)
+        head.extend((v, u))
+        res.extend((c, 0))
+        acost.extend((w, -w))
+        aedge.extend((e, e))
+        return j
+
+    tail: list[int] = []
+    real_arcs: list[list[tuple]] = [[] for _ in range(n)]
+    edge_arc: dict[int, int] = {}
+    if arc_order not in ("interleaved", "forward_first"):
+        raise ValueError(f"unknown arc order {arc_order!r}")
+    for e in active:
+        u, v = g.src[e], g.dst[e]
+        j = add(u, v, view[e], g.cost[e], e)
+        tail.extend((u, v))
+        edge_arc[e] = j
+        key = e if arc_rank is None else arc_rank[e]
+        if arc_order == "forward_first":
+            real_arcs[u].append((0, key, 0, j))
+            real_arcs[v].append((1, key, 1, j + 1))
+        else:
+            real_arcs[u].append((key, 0, j))
+            real_arcs[v].append((key, 1, j + 1))
+    src_arc: dict[int, int] = {}
+    for s in srcs:
+        j = add(S, s, VIRTUAL_CAP, 0, -1)
+        tail.extend((S, s))
+        src_arc[s] = j
+    dst_arc: dict[int, int] = {}
+    for d in dsts:
+        j = add(d, T, VIRTUAL_CAP, 0, -1)
+        tail.extend((d, T))
+        dst_arc[d] = j
+    adj: list[list[int]] = [[] for _ in range(n + 2)]
+    adj[S] = [src_arc[s] for s in srcs]
+    adj[T] = [dst_arc[d] + 1 for d in dsts]
+    for u in range(n):
+        first = []
+        if u in src_arc:
+            first.append(src_arc[u] + 1)
+        if u in dst_arc:
+            first.append(dst_arc[u])
+        adj[u] = first + [item[-1] for item in sorted(real_arcs[u])]
+
+    # A positive cap always runs the solver; the clamp of the internal domain at the
+    # sources' view out-capacity only bounds the arithmetic (Python ints are exact),
+    # so the loop runs on the input cap (revision 20).
+    limit = cap
+
+    pi = [0] * (n + 2)
+    ever = [False] * (n + 2)
+    total = 0
+    curve: list[tuple[int, int]] = []
+    tiers: list[dict] = []
+
+    def reduced(j: int) -> int:
+        return acost[j] + pi[tail[j]] - pi[head[j]]
+
+    while limit is None or total < limit:
+        # ---- Dijkstra on reduced costs, to completion over the reachable residual
+        counters["dijkstra_runs"] += 1
+        dist: list[int | None] = [None] * (n + 2)
+        dist[S] = 0
+        heap = [(0, S)]
+        settled_now: list[int] = []
+        while heap:
+            du, u = heapq.heappop(heap)
+            counters["dijkstra_pops"] += 1
+            if du != dist[u]:
+                continue
+            settled_now.append(u)
+            counters["settled"] += 1
+            for j in adj[u]:
+                counters["arc_scans"] += 1
+                if res[j] <= 0:
+                    continue
+                v = head[j]
+                rc = reduced(j)
+                assert rc >= 0, ("negative reduced cost", j, rc)
+                nd = du + rc
+                dv = dist[v]
+                if dv is None or nd < dv:
+                    dist[v] = nd
+                    heapq.heappush(heap, (nd, v))
+        for u in settled_now:
+            pi[u] += dist[u]
+            ever[u] = True
+        if dist[T] is None:
+            break
+        tier_cost = pi[T] - pi[S]
+        before = total
+        # ---- drain the admissible subgraph by Dinic phases
+        while limit is None or total < limit:
+            level = [-1] * (n + 2)
+            level[S] = 0
+            q = deque([S])
+            while q:
+                u = q.popleft()
+                for j in adj[u]:
+                    counters["arc_scans"] += 1
+                    v = head[j]
+                    if res[j] > 0 and level[v] < 0 and reduced(j) == 0:
+                        level[v] = level[u] + 1
+                        q.append(v)
+            # every BFS level build counts, the last unsuccessful one of a tier included
+            # (revision 23)
+            counters["dinic_phases"] += 1
+            if level[T] < 0:
+                break
+            cur = [0] * (n + 2)
+            while limit is None or total < limit:
+                path = _find_path(S, T, adj, cur, res, head, level, reduced, counters)
+                if path is None:
+                    break
+                amount = min(res[j] for j in path)
+                if limit is not None:
+                    amount = min(amount, limit - total)
+                for j in path:
+                    res[j] -= amount
+                    res[j ^ 1] += amount
+                total += amount
+                counters["augmentations"] += 1
+        drained = total - before
+        assert drained > 0, "a successful Dijkstra drains at least one unit"
+        curve.append((tier_cost, drained))
+        if trace:
+            tiers.append(
+                {
+                    "cost": tier_cost,
+                    "units": drained,
+                    "edge_flows": {
+                        e: res[edge_arc[e] + 1] for e in active if res[edge_arc[e] + 1]
+                    },
+                    "counters": dict(counters),
+                }
+            )
+
+    for e in active:
+        edge_flows[e] = res[edge_arc[e] + 1]
+    # ---- full residual closure seeded at the real sources (reverse and virtual
+    # arcs included; revision 20)
+    seen = [False] * (n + 2)
+    for s in srcs:
+        seen[s] = True
+    q = deque(srcs)
+    while q:
+        u = q.popleft()
+        for j in adj[u]:
+            v = head[j]
+            if res[j] > 0 and not seen[v]:
+                seen[v] = True
+                q.append(v)
+    if seen[T]:
+        min_cut = None
+    else:
+        # Every active edge leaving the closure, an edge of view 0 too (it adds 0 to the
+        # value and is listed because every edge leaving the closure is).
+        min_cut = sorted(e for e in active if seen[g.src[e]] and not seen[g.dst[e]])
+    return FlowSolve(
+        placed=total,
+        cost_distribution=curve,
+        edge_flows=edge_flows,
+        min_cut=min_cut,
+        potentials=[pi[v] if ever[v] else NEVER_REACHED for v in range(n)],
+        counters=counters,
+        supply={s: res[src_arc[s] + 1] for s in srcs},
+        inflow={d: res[dst_arc[d] + 1] for d in dsts},
+        pi_sink=pi[T] if ever[T] else None,
+        closure=[v for v in range(n) if seen[v]],
+        sink_in_closure=seen[T],
+        tiers=tiers,
+    )
+
+
+def _find_path(S, T, adj, cur, res, head, level, reduced, counters):
+    """One augmenting path in the level graph (current-arc pointers kept)."""
+    stack = [S]
+    path: list[int] = []
+    while stack:
+        u = stack[-1]
+        if u == T:
+            return path
+        advanced = False
+        arcs = adj[u]
+        while cur[u] < len(arcs):
+            j = arcs[cur[u]]
+            counters["arc_scans"] += 1
+            v = head[j]
+            if res[j] > 0 and level[v] == level[u] + 1 and reduced(j) == 0:
+                stack.append(v)
+                path.append(j)
+                advanced = True
+                break
+            cur[u] += 1
+        if not advanced:
+            stack.pop()
+            if path:
+                j = path.pop()
+                # The arc into the dead end fails: advance the parent's pointer.
+                cur[stack[-1]] += 1
+    return None
+
+
+def flow_cost(g: Graph, flows) -> int:
+    return sum(g.cost[e] * x for e, x in enumerate(flows))
diff --git a/tests/reference/policy/p1_amount/graph.py b/tests/reference/policy/p1_amount/graph.py
new file mode 100644
index 0000000..6ed4b06
--- /dev/null
+++ b/tests/reference/policy/p1_amount/graph.py
@@ -0,0 +1,243 @@
+"""The one graph type in layout B' (APPROACH revision 24, sections 3 and 4).
+
+Construction arrays are in input coordinates. The public ``EdgeId`` is the rank of
+the edge in the stable order ``(src, cost, dst, input)``; ``input_index()[e]`` is
+the input position of ``e``. Every other per-edge array and id is in id
+coordinates. The inverse permutation is the caller's (``input_to_id``).
+"""
+
+from __future__ import annotations
+
+import itertools
+from dataclasses import dataclass
+from fractions import Fraction
+
+from units import LIMIT, ContractError, check_resolution
+
+_UID = itertools.count(1)
+
+
+class Graph:
+    """StrictMultiDiGraph(num_nodes, src, dst, capacity_units, cost, resolution)."""
+
+    def __init__(self, num_nodes, src, dst, capacity_units, cost, resolution):
+        q = check_resolution(resolution)
+        if not isinstance(num_nodes, int) or isinstance(num_nodes, bool):
+            raise ContractError("num_nodes must be an int")
+        if num_nodes < 0:
+            raise ContractError("num_nodes must be non-negative")
+        e = len(src)
+        if not (len(dst) == len(capacity_units) == len(cost) == e):
+            raise ContractError("edge arrays differ in length")
+        for name, arr in (("src", src), ("dst", dst)):
+            for x in arr:
+                if not isinstance(x, int) or isinstance(x, bool):
+                    raise ContractError(f"{name} entries must be ints")
+                if not 0 <= x < num_nodes:
+                    raise ContractError(f"{name} node {x} out of range")
+        for c in capacity_units:
+            if not isinstance(c, int) or isinstance(c, bool):
+                raise ContractError("capacity_units must be integer units")
+            if not 0 <= c < LIMIT:
+                raise ContractError(f"capacity {c} outside [0, 2^62)")
+        if sum(capacity_units) >= LIMIT:
+            raise ContractError("sum of capacities must be below 2^62 units")
+        for w in cost:
+            if not isinstance(w, int) or isinstance(w, bool):
+                raise ContractError("costs must be integers")
+            if w < 1:
+                raise ContractError(f"cost {w} rejected: costs are positive (rule 28)")
+        if sum(cost) >= LIMIT:
+            raise ContractError("sum of costs must be below 2^62")
+        order = sorted(range(e), key=lambda i: (src[i], cost[i], dst[i], i))
+        self.uid = next(_UID)
+        self.q: Fraction = q
+        self.num_nodes = num_nodes
+        self.num_edges = e
+        self._input_index = tuple(order)
+        self.src = tuple(src[i] for i in order)
+        self.dst = tuple(dst[i] for i in order)
+        self.capacity = tuple(capacity_units[i] for i in order)
+        self.cost = tuple(cost[i] for i in order)
+        offsets = [0] * (num_nodes + 1)
+        for u in self.src:
+            offsets[u + 1] += 1
+        for u in range(num_nodes):
+            offsets[u + 1] += offsets[u]
+        self.row_offsets = tuple(offsets)
+        # Reverse CSR in today's (cost, src, input) order; slots map to ids.
+        in_lists: list[list[int]] = [[] for _ in range(num_nodes)]
+        for eid in sorted(
+            range(e), key=lambda i: (self.cost[i], self.src[i], self._input_index[i])
+        ):
+            in_lists[self.dst[eid]].append(eid)
+        in_off = [0]
+        slots: list[int] = []
+        for v in range(num_nodes):
+            slots.extend(in_lists[v])
+            in_off.append(len(slots))
+        self.in_row_offsets = tuple(in_off)
+        self.in_adj_edge_index = tuple(slots)
+        self.max_cost = max(self.cost, default=0)
+
+    # ------------------------------------------------------------ accessors
+
+    def input_index(self) -> tuple[int, ...]:
+        return self._input_index
+
+    def resolution(self) -> Fraction:
+        return self.q
+
+    def out_ids(self, u: int) -> range:
+        return range(self.row_offsets[u], self.row_offsets[u + 1])
+
+    def in_ids(self, v: int) -> tuple[int, ...]:
+        """In-edge ids of ``v`` in reverse-CSR order ``(cost, src, input)``."""
+        return self.in_adj_edge_index[
+            self.in_row_offsets[v] : self.in_row_offsets[v + 1]
+        ]
+
+    def eligibility(self, excluded_nodes=(), excluded_edges=()) -> Eligibility:
+        return Eligibility.build(self, excluded_nodes, excluded_edges)
+
+    def edge_tuple(self, e: int) -> tuple[int, int, int, int]:
+        return (self.src[e], self.dst[e], self.capacity[e], self.cost[e])
+
+
+def input_to_id(g: Graph) -> list[int]:
+    """The caller's inverse permutation of ``input_index()`` (one O(E) scatter)."""
+    inv = [0] * g.num_edges
+    for eid, pos in enumerate(g.input_index()):
+        inv[pos] = eid
+    return inv
+
+
+def graph_from_input(num_nodes, edges, resolution=1) -> Graph:
+    """Convenience: ``edges`` as ``(u, v, capacity_units, cost)`` in input order."""
+    return Graph(
+        num_nodes,
+        [e[0] for e in edges],
+        [e[1] for e in edges],
+        [e[2] for e in edges],
+        [e[3] for e in edges],
+        resolution,
+    )
+
+
+@dataclass(frozen=True)
+class Eligibility:
+    """Immutable static eligibility: dense node and edge bits, graph-bound."""
+
+    graph_uid: int
+    uid: int
+    node_allowed: tuple[bool, ...]
+    edge_allowed: tuple[bool, ...]
+
+    @staticmethod
+    def build(g: Graph, excluded_nodes=(), excluded_edges=()) -> Eligibility:
+        xn = set()
+        for v in excluded_nodes:
+            if not isinstance(v, int) or not 0 <= v < g.num_nodes:
+                raise ContractError(f"excluded node {v} out of range")
+            xn.add(v)
+        xe = set()
+        for e in excluded_edges:
+            if not isinstance(e, int) or not 0 <= e < g.num_edges:
+                raise ContractError(f"excluded edge {e} out of range")
+            xe.add(e)
+        node_allowed = tuple(v not in xn for v in range(g.num_nodes))
+        edge_allowed = tuple(
+            e not in xe and node_allowed[g.src[e]] and node_allowed[g.dst[e]]
+            for e in range(g.num_edges)
+        )
+        uid = 0 if not xn and not xe else next(_UID)
+        return Eligibility(g.uid, uid, node_allowed, edge_allowed)
+
+    def check(self, g: Graph) -> None:
+        if self.graph_uid != g.uid:
+            raise ContractError("foreign Eligibility")
+
+
+def all_allowed(g: Graph, elig: Eligibility | None) -> Eligibility:
+    if elig is None:
+        return Eligibility.build(g)
+    elig.check(g)
+    return elig
+
+
+def check_node_set(g: Graph, nodes, name: str) -> tuple[int, ...]:
+    """Normalise a root or endpoint set: duplicates removed, ids validated."""
+    if isinstance(nodes, int):
+        nodes = (nodes,)
+    out = set()
+    for v in nodes:
+        if not isinstance(v, int) or isinstance(v, bool) or not 0 <= v < g.num_nodes:
+            raise ContractError(f"{name}: node {v!r} out of range")
+        out.add(v)
+    if not out:
+        raise ContractError(f"{name}: empty set")
+    return tuple(sorted(out))
+
+
+def check_disjoint(sources, destinations) -> None:
+    if set(sources) & set(destinations):
+        raise ContractError("a vertex in both endpoint sets is rejected (rule 13)")
+
+
+def check_dag_edges(g: Graph, edges) -> tuple[int, ...]:
+    """A DAG given by its edge ids: range checked, no duplicates, acyclic."""
+    seen = set()
+    for e in edges:
+        if not isinstance(e, int) or not 0 <= e < g.num_edges:
+            raise ContractError(f"DAG edge {e!r} out of range")
+        if e in seen:
+            raise ContractError(f"duplicate DAG edge {e}")
+        seen.add(e)
+    out_adj: dict[int, list[int]] = {}
+    indeg: dict[int, int] = {}
+    for e in seen:
+        u, v = g.src[e], g.dst[e]
+        out_adj.setdefault(u, []).append(v)
+        indeg[v] = indeg.get(v, 0) + 1
+        indeg.setdefault(u, 0)
+    queue = [v for v, d in indeg.items() if d == 0]
+    count = 0
+    while queue:
+        u = queue.pop()
+        count += 1
+        for v in out_adj.get(u, ()):
+            indeg[v] -= 1
+            if indeg[v] == 0:
+                queue.append(v)
+    if count != len(indeg):
+        raise ContractError("route structure is cyclic")
+    return tuple(sorted(seen))
+
+
+def path_edges(g: Graph, hops) -> tuple[int, ...]:
+    """``Path(g, hops)`` validation; returns the member edge ids (a DAG)."""
+    if not hops:
+        raise ContractError("empty path")
+    members: list[int] = []
+    nodes: list[int] = []
+    for hop in hops:
+        if not hop:
+            raise ContractError("empty hop")
+        for e in hop:
+            if not isinstance(e, int) or not 0 <= e < g.num_edges:
+                raise ContractError(f"path member {e!r} out of range")
+        uv = {(g.src[e], g.dst[e]) for e in hop}
+        if len(uv) != 1:
+            raise ContractError("members of a hop must share (u, v)")
+        (u, v) = next(iter(uv))
+        if nodes and nodes[-1] != u:
+            raise ContractError("hops are not contiguous")
+        if not nodes:
+            nodes.append(u)
+        nodes.append(v)
+        members.extend(hop)
+    if len(set(members)) != len(members):
+        raise ContractError("duplicate path member")
+    if len(set(nodes)) != len(nodes):
+        raise ContractError("path repeats a node")
+    return tuple(sorted(members))
diff --git a/tests/reference/policy/p1_amount/kernels.py b/tests/reference/policy/p1_amount/kernels.py
new file mode 100644
index 0000000..1b76387
--- /dev/null
+++ b/tests/reference/policy/p1_amount/kernels.py
@@ -0,0 +1,85 @@
+"""Placement kernels in units (APPROACH revision 24, sections 2.1, 7 and 16).
+
+The kernel names and the admission rule, a flow's plan as a record (its route, its members and,
+for Weighted, its weights), the split graph of a route (``prune``: the edges on the walks from a
+source to the destination set) and a route's cost. The per-flow kernels of the per-source
+transaction (allocation, the T_max search, the per-flow MaxFlow solve, the Lossy split) left with
+``CapacityAware`` when T0 was deleted (README "T1 replaces CapacityAware"): the pooled
+CostOnly program and the controllers of ``policy.py`` forward and solve on their own.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import search
+from graph import Graph
+from units import ContractError
+
+MAX_FLOW = "MaxFlow"
+WEIGHTED = "Weighted"
+EQUAL_BALANCED = "EqualBalanced"
+KERNELS = (MAX_FLOW, WEIGHTED, EQUAL_BALANCED)
+LOSSLESS = "Lossless"
+LOSSY = "Lossy"
+
+
+def check_kernel(kernel: str, admission: str) -> None:
+    if kernel not in KERNELS:
+        raise ContractError(f"unknown placement {kernel!r}")
+    if admission not in (LOSSLESS, LOSSY):
+        raise ContractError(f"unknown admission {admission!r}")
+    if admission == LOSSY and kernel == MAX_FLOW:
+        raise ContractError("Lossy is rejected with MaxFlow (rule 13)")
+
+
+@dataclass
+class Plan:
+    kernel: str
+    admission: str
+    src: int
+    dsts: tuple[int, ...]
+    route: tuple[int, ...]
+    members: tuple[int, ...]
+    weights: dict[int, int] | None
+
+    def to_json(self) -> dict:
+        return {
+            "kernel": self.kernel,
+            "admission": self.admission,
+            "route": list(self.route),
+            "members": list(self.members),
+            "weights": None
+            if self.weights is None
+            else [[e, w] for e, w in sorted(self.weights.items())],
+        }
+
+
+def prune(g: Graph, edges, src: int, dsts) -> tuple[int, ...]:
+    """Edges on some walk from ``src`` to the destination set (destinations terminal)."""
+    dset = set(dsts)
+    edges = [e for e in edges if g.src[e] not in dset]
+    fwd = {src}
+    changed = True
+    while changed:
+        changed = False
+        for e in edges:
+            if g.src[e] in fwd and g.dst[e] not in fwd:
+                fwd.add(g.dst[e])
+                changed = True
+    back = set(dset)
+    changed = True
+    while changed:
+        changed = False
+        for e in edges:
+            if g.dst[e] in back and g.src[e] not in back:
+                back.add(g.src[e])
+                changed = True
+    return tuple(sorted(e for e in edges if g.src[e] in fwd and g.dst[e] in back))
+
+
+def route_cost(g: Graph, edges, src: int, dsts) -> int | None:
+    """Minimum walk cost of a route from ``src`` to the destination set."""
+    d = search.distances(g, edges, [src])
+    reach = [d[t] for t in dsts if d[t] is not None]
+    return min(reach) if reach else None
diff --git a/tests/reference/policy/p1_amount/ledger.py b/tests/reference/policy/p1_amount/ledger.py
new file mode 100644
index 0000000..b2441f9
--- /dev/null
+++ b/tests/reference/policy/p1_amount/ledger.py
@@ -0,0 +1,296 @@
+"""The integer ledger ``FlowGraph`` (APPROACH revision 24, section 8).
+
+The ledger is mutated only through policies: ``_bind`` registers a policy,
+``_commit`` exchanges a policy's records atomically (feasibility checked before any
+mutation, new FlowIds assigned in creation order), ``_detach`` reverts a policy's
+allocations and retires its ids (``remove()``), ``_orphan`` marks a destroyed
+policy's records as orphans (readable, never changed again). ``reset`` and
+``copy`` are rejected while a policy is bound. Ids are never reused.
+"""
+
+from __future__ import annotations
+
+import itertools
+from dataclasses import dataclass, field, replace
+
+from graph import Eligibility, Graph, check_node_set
+from units import COUNTER_LIMIT, UNREACHABLE, ContractError
+
+_UID = itertools.count(1)
+
+
+@dataclass
+class FlowRecord:
+    flow_id: tuple[int, int]
+    owner: int
+    sources: tuple[int, ...]
+    destinations: tuple[int, ...]
+    admission: str
+    bundle: tuple[int, ...]
+    route_cost: int
+    offered: int | None
+    delivered: int
+    edges: dict[int, int] = field(default_factory=dict)
+    drops: dict[int, int] = field(default_factory=dict)
+
+    def snapshot(self) -> FlowRecord:
+        return replace(self, edges=dict(self.edges), drops=dict(self.drops))
+
+    def to_json(self, g: Graph | None = None) -> dict:
+        pos = None if g is None else g.input_index()
+
+        def pairs(d):
+            return [
+                [e, x] if pos is None else [e, pos[e], x] for e, x in sorted(d.items())
+            ]
+
+        return {
+            "flow_id": list(self.flow_id),
+            "owner": self.owner,
+            "sources": list(self.sources),
+            "destinations": list(self.destinations),
+            "admission": self.admission,
+            "bundle": list(self.bundle),
+            "bundle_input": None
+            if pos is None
+            else sorted(pos[e] for e in self.bundle),
+            "route_cost": None if self.route_cost == UNREACHABLE else self.route_cost,
+            "offered": self.offered,
+            "delivered": self.delivered,
+            "edges": pairs(self.edges),
+            "drops": pairs(self.drops),
+        }
+
+
+@dataclass
+class Draft:
+    """A record proposed by a policy for the commit (``flow_id`` None: new)."""
+
+    flow_id: tuple[int, int] | None
+    sources: tuple[int, ...]
+    destinations: tuple[int, ...]
+    admission: str
+    bundle: tuple[int, ...]
+    route_cost: int
+    offered: int | None
+    delivered: int
+    edges: dict[int, int]
+    drops: dict[int, int]
+
+
+class FlowGraph:
+    def __init__(self, g: Graph, residual=None) -> None:
+        self.graph = g
+        self.uid = next(_UID)
+        self._baseline = self._check_baseline(residual)
+        self._records: dict[int, FlowRecord] = {}
+        self._next_id = 0
+        self._next_owner = 0
+        self._bound: set[int] = set()
+        self._orphans: set[int] = set()
+        self._retired: set[int] = set()
+
+    def _check_baseline(self, residual) -> list[int]:
+        g = self.graph
+        if residual is None:
+            return list(g.capacity)
+        if len(residual) != g.num_edges:
+            raise ContractError("baseline length differs from the edge count")
+        out = []
+        for e, r in enumerate(residual):
+            if not isinstance(r, int) or isinstance(r, bool):
+                raise ContractError("baselines are integer units (to_units first)")
+            if not 0 <= r <= g.capacity[e]:
+                raise ContractError(f"baseline[{e}] = {r} outside [0, capacity]")
+            out.append(r)
+        return out
+
+    # ------------------------------------------------------------ observers
+
+    def capacity_units(self) -> list[int]:
+        return list(self.graph.capacity)
+
+    def baseline(self) -> list[int]:
+        return list(self._baseline)
+
+    def allocated(self) -> list[int]:
+        out = [0] * self.graph.num_edges
+        for r in self._records.values():
+            for e, x in r.edges.items():
+                out[e] += x
+        return out
+
+    def residual(self) -> list[int]:
+        return [b - a for b, a in zip(self._baseline, self.allocated(), strict=True)]
+
+    def records(self) -> list[FlowRecord]:
+        return [self._records[i].snapshot() for i in sorted(self._records)]
+
+    def record(self, flow_id) -> FlowRecord:
+        uid, i = flow_id
+        if uid != self.uid:
+            raise ContractError("FlowId of another ledger")
+        if i not in self._records:
+            raise ContractError(f"retired or unknown FlowId {flow_id}")
+        return self._records[i].snapshot()
+
+    def next_flow_id(self) -> int:
+        return self._next_id
+
+    def owner_records(self, owner: int) -> list[FlowRecord]:
+        return [r for i, r in sorted(self._records.items()) if r.owner == owner]
+
+    def bottleneck(self, sources, elig: Eligibility | None = None) -> list[int]:
+        """Saturation diagnostic: allowed edges of capacity >= 1 leaving the set
+        reachable from the sources over forward arcs with residual >= 1."""
+        g = self.graph
+        srcs = check_node_set(g, sources, "sources")
+        if elig is not None:
+            elig.check(g)
+        ok = (lambda e: True) if elig is None else (lambda e: elig.edge_allowed[e])
+        node_ok = (lambda v: True) if elig is None else (lambda v: elig.node_allowed[v])
+        res = self.residual()
+        seen = {s for s in srcs if node_ok(s)}
+        stack = list(seen)
+        while stack:
+            u = stack.pop()
+            for e in g.out_ids(u):
+                v = g.dst[e]
+                if ok(e) and res[e] >= 1 and v not in seen:
+                    seen.add(v)
+                    stack.append(v)
+        return [
+            e
+            for e in range(g.num_edges)
+            if g.src[e] in seen
+            and g.dst[e] not in seen
+            and ok(e)
+            and g.capacity[e] >= 1
+        ]
+
+    # ------------------------------------------------------------ lifetime
+
+    def bound_policies(self) -> int:
+        return len(self._bound)
+
+    def reset(self, residual=None) -> None:
+        if self._bound:
+            raise ContractError("reset is rejected while a policy is bound")
+        baseline = self._check_baseline(residual)
+        self._retired.update(self._records)
+        self._records.clear()
+        self._orphans.clear()
+        self._baseline = baseline
+
+    def copy(self) -> FlowGraph:
+        if self._bound:
+            raise ContractError("a ledger with bound policies cannot be copied")
+        other = FlowGraph.__new__(FlowGraph)
+        other.graph = self.graph
+        other.uid = next(_UID)
+        other._baseline = list(self._baseline)
+        other._records = {
+            i: replace(r.snapshot(), flow_id=(other.uid, i))
+            for i, r in self._records.items()
+        }
+        other._next_id = self._next_id
+        other._next_owner = self._next_owner
+        other._bound = set()
+        other._orphans = set(self._orphans)
+        other._retired = set(self._retired)
+        return other
+
+    # ------------------------------------------------------------ policy-private
+
+    def _bind(self) -> int:
+        owner = self._next_owner
+        self._next_owner += 1
+        self._bound.add(owner)
+        return owner
+
+    def _orphan(self, owner: int) -> None:
+        """The policy was destroyed without ``remove()``: its records stay."""
+        self._bound.discard(owner)
+        self._orphans.add(owner)
+
+    def _detach(self, owner: int) -> list[int]:
+        """``remove()``: revert the owner's allocations and retire its ids."""
+        ids = [i for i, r in self._records.items() if r.owner == owner]
+        for i in ids:
+            del self._records[i]
+            self._retired.add(i)
+        return ids
+
+    def _commit(self, owner: int, drafts: list[Draft]) -> list[tuple[int, int]]:
+        """One atomic exchange of the owner's records; returns the new FlowIds."""
+        if owner not in self._bound:
+            raise ContractError("commit by an unbound policy")
+        g = self.graph
+        current = {i for i, r in self._records.items() if r.owner == owner}
+        kept = {d.flow_id[1] for d in drafts if d.flow_id is not None}
+        if kept != current:
+            raise ContractError("a commit must carry every live record of the policy")
+        alloc = [0] * g.num_edges
+        for r in self._records.values():
+            if r.owner != owner:
+                for e, x in r.edges.items():
+                    alloc[e] += x
+        for d in drafts:
+            for e, x in d.edges.items():
+                if x < 0:
+                    raise AssertionError("negative allocation in a commit")
+                alloc[e] += x
+            for x in d.drops.values():
+                if not 0 <= x < COUNTER_LIMIT:
+                    raise ContractError("drop counter outside the 128-bit domain")
+            if d.offered is not None and not 0 <= d.offered < COUNTER_LIMIT:
+                raise ContractError("offered counter outside the 128-bit domain")
+        for e in range(g.num_edges):
+            if alloc[e] > self._baseline[e]:
+                raise AssertionError(f"infeasible commit on edge {e}")
+        new_ids: list[tuple[int, int]] = []
+        for d in drafts:
+            if d.flow_id is None:
+                i = self._next_id
+                self._next_id += 1
+                fid = (self.uid, i)
+                new_ids.append(fid)
+            else:
+                fid = d.flow_id
+                i = fid[1]
+            self._records[i] = FlowRecord(
+                flow_id=fid,
+                owner=owner,
+                sources=d.sources,
+                destinations=d.destinations,
+                admission=d.admission,
+                bundle=d.bundle,
+                route_cost=d.route_cost,
+                offered=d.offered,
+                delivered=d.delivered,
+                edges={e: x for e, x in d.edges.items() if x},
+                drops={e: x for e, x in d.drops.items() if x},
+            )
+        return new_ids
+
+    # ------------------------------------------------------------ state digest
+
+    def state(self) -> dict:
+        g = self.graph
+        pos = g.input_index()
+        alloc = self.allocated()
+        res = self.residual()
+        by_input_alloc = [0] * g.num_edges
+        by_input_res = [0] * g.num_edges
+        for e in range(g.num_edges):
+            by_input_alloc[pos[e]] = alloc[e]
+            by_input_res[pos[e]] = res[e]
+        return {
+            "ledger_uid": self.uid,
+            "allocated_input": by_input_alloc,
+            "residual_input": by_input_res,
+            "records": [r.to_json(g) for r in self.records()],
+            "bound": sorted(self._bound),
+            "orphan_owners": sorted(self._orphans),
+            "next_flow_id": self._next_id,
+        }
diff --git a/tests/reference/policy/p1_amount/search.py b/tests/reference/policy/p1_amount/search.py
new file mode 100644
index 0000000..46701d3
--- /dev/null
+++ b/tests/reference/policy/p1_amount/search.py
@@ -0,0 +1,351 @@
+"""Search semantics of APPROACH revision 24, section 6, as internal routines.
+
+* member graph: static eligibility (capacity is never read: an edge of capacity 0 is a
+  member like any other), optional residual gating at ``min_residual``; ``multi_edge = False`` keeps one member per ``(u, v)`` by
+  ``select_adjacency``: minimum cost, then (``PreferHigherPriority``) the highest
+  priority value, then the lowest EdgeId;
+* the unique shortest-path DAG (positive costs, 2.4): tight edges; with targets the
+  walks from the roots to the nearest targets (anycast), one edge set for both
+  directions;
+* the staged canonical single path: (1) the tight DAG of the pair, (2) under
+  ``PreferHigherPriority`` the best attainable bottleneck ``B*`` (capped by a Yen
+  prefix's bottleneck) and the DAG restricted to priority ``>= B*``, (3) one reverse
+  hop count ``h`` and a greedy walk taking the smallest tight edge whose head has
+  ``h(v) = h(u) - 1``;
+
+Priority values: ``Residual`` = residual units, ``Capacity`` = static capacity
+units, ``Headroom`` = the exact rational ``residual / capacity`` (0 on an edge of
+capacity 0). A search without a residual reads the static capacity as the residual:
+``Residual`` and ``Capacity`` the capacity, ``Headroom`` 1 (0 on an edge of capacity 0)
+(contract r8 3.5, step 1 of the next Core change).
+"""
+
+from __future__ import annotations
+
+import heapq
+import math
+from collections import deque
+from dataclasses import dataclass
+from fractions import Fraction
+
+from graph import Eligibility, Graph, check_disjoint, check_node_set
+from units import ContractError
+
+DETERMINISTIC = "Deterministic"
+PREFER = "PreferHigherPriority"
+PRIORITIES = ("Residual", "Capacity", "Headroom")
+
+
+@dataclass(frozen=True)
+class Selection:
+    """PathSelection {multipath, multi_edge, tie_break, priority}."""
+
+    multipath: bool = True
+    multi_edge: bool = True
+    tie_break: str = DETERMINISTIC
+    priority: str = "Residual"
+
+    def __post_init__(self) -> None:
+        if self.tie_break not in (DETERMINISTIC, PREFER):
+            raise ContractError(f"unknown tie_break {self.tie_break!r}")
+        if self.priority not in PRIORITIES:
+            raise ContractError(f"unknown priority {self.priority!r}")
+
+
+def priority_fn(g: Graph, priority: str, residual):
+    """Per-edge priority value (exact: ints or Fractions)."""
+    free = (lambda e: g.capacity[e]) if residual is None else (lambda e: residual[e])
+    if priority == "Capacity":
+        return lambda e: g.capacity[e]
+    if priority == "Residual":
+        return free
+    if priority == "Headroom":
+        return lambda e: Fraction(free(e), g.capacity[e]) if g.capacity[e] else 0
+    raise ContractError(f"unknown priority {priority!r}")
+
+
+def check_residual(g: Graph, residual) -> None:
+    if residual is None:
+        return
+    if len(residual) != g.num_edges:
+        raise ContractError("residual length differs from the edge count")
+    for e, r in enumerate(residual):
+        if not isinstance(r, int) or isinstance(r, bool):
+            raise ContractError("residual entries must be integer units")
+        if not 0 <= r <= g.capacity[e]:
+            raise ContractError(f"residual[{e}] = {r} outside [0, capacity]")
+
+
+def member_graph(
+    g: Graph,
+    elig: Eligibility | None,
+    selection: Selection,
+    residual=None,
+    min_residual: int = 1,
+) -> list[int]:
+    """Eligible routable edges, collapsed per ``(u, v)`` when ``multi_edge`` is off."""
+    if elig is not None:
+        elig.check(g)
+    if min_residual < 1:
+        raise ContractError("min_residual is at least 1 unit")
+    ok = []
+    for e in range(g.num_edges):
+        if elig is not None and not elig.edge_allowed[e]:
+            continue
+        if residual is not None and residual[e] < min_residual:
+            continue
+        ok.append(e)
+    if selection.multi_edge:
+        return ok
+    return collapse(g, ok, selection, residual)
+
+
+def collapse(g: Graph, edges, selection: Selection, residual) -> list[int]:
+    prio = priority_fn(g, selection.priority, residual)
+    best: dict[tuple[int, int], int] = {}
+    for e in edges:
+        key = (g.src[e], g.dst[e])
+        cur = best.get(key)
+        if cur is None or _select_key(g, e, selection, prio) < _select_key(
+            g, cur, selection, prio
+        ):
+            best[key] = e
+    return sorted(best.values())
+
+
+def _select_key(g, e, selection, prio):
+    if selection.tie_break == PREFER:
+        return (g.cost[e], -prio(e), e)
+    return (g.cost[e], 0, e)
+
+
+def distances(
+    g: Graph, edges, roots, reverse: bool = False, excluded_nodes=frozenset()
+) -> list[int | None]:
+    """Dijkstra over ``edges`` from (or, reverse, toward) the root set."""
+    adj: list[list[tuple[int, int]]] = [[] for _ in range(g.num_nodes)]
+    for e in edges:
+        u, v = g.src[e], g.dst[e]
+        if u in excluded_nodes or v in excluded_nodes:
+            continue
+        if reverse:
+            adj[v].append((u, g.cost[e]))
+        else:
+            adj[u].append((v, g.cost[e]))
+    dist: list[int | None] = [None] * g.num_nodes
+    heap = []
+    for r in roots:
+        if r in excluded_nodes:
+            continue
+        dist[r] = 0
+        heap.append((0, r))
+    heapq.heapify(heap)
+    while heap:
+        d, u = heapq.heappop(heap)
+        if d != dist[u]:
+            continue
+        for v, c in adj[u]:
+            nd = d + c
+            dv = dist[v]
+            if dv is None or nd < dv:
+                dist[v] = nd
+                heapq.heappush(heap, (nd, v))
+    return dist
+
+
+def full_dag(g: Graph, edges, roots, reverse: bool = False) -> list[int]:
+    """All tight edges over the nodes reached from (or toward) the roots."""
+    d = distances(g, edges, roots, reverse)
+    out = []
+    for e in edges:
+        u, v = g.src[e], g.dst[e]
+        if reverse:
+            if d[v] is not None and d[u] is not None and d[v] + g.cost[e] == d[u]:
+                out.append(e)
+        elif d[u] is not None and d[v] is not None and d[u] + g.cost[e] == d[v]:
+            out.append(e)
+    return sorted(out)
+
+
+def tight_dag(
+    g: Graph, edges, sources, destinations, excluded_nodes=frozenset()
+) -> tuple[int | None, list[int]]:
+    """Edges on the minimum-cost walks from the source set to the destination set.
+
+    The walks of cost ``d* = min dist(S, D)``; destinations and sources are terminal
+    (positive costs). Identical for a forward search with targets and a reverse
+    search with the roles swapped (2.4).
+    """
+    ds = distances(g, edges, sources, False, excluded_nodes)
+    dd = distances(g, edges, destinations, True, excluded_nodes)
+    reach = [ds[t] for t in destinations if ds[t] is not None]
+    if not reach:
+        return None, []
+    dstar = min(reach)
+    out = []
+    for e in edges:
+        u, v = g.src[e], g.dst[e]
+        if u in excluded_nodes or v in excluded_nodes:
+            continue
+        du, dv = ds[u], dd[v]
+        if du is not None and dv is not None and du + g.cost[e] + dv == dstar:
+            out.append(e)
+    return dstar, sorted(out)
+
+
+@dataclass
+class SinglePath:
+    edges: list[int]
+    cost: int
+    bottleneck: object  # min priority value along the walk (None: Deterministic)
+    b_star: object  # the stage-2 threshold (None: Deterministic)
+
+
+def canonical_path(
+    g: Graph,
+    edges,
+    sources,
+    destinations,
+    prio=None,
+    prefix_cap=None,
+    excluded_nodes=frozenset(),
+) -> SinglePath | None:
+    """The staged canonical single path (section 6) on the member edges ``edges``.
+
+    ``prio`` is the priority function under ``PreferHigherPriority`` (``None`` for
+    ``Deterministic``); ``prefix_cap`` caps ``B*`` by a Yen root prefix's bottleneck.
+    """
+    dstar, dag = tight_dag(g, edges, sources, destinations, excluded_nodes)
+    if dstar is None:
+        return None
+    dests = set(destinations)
+    b_star = None
+    if prio is not None:
+        ds = distances(g, dag, sources, False, excluded_nodes)
+        best: dict[int, object] = {}
+        for s in sources:
+            if s not in excluded_nodes and ds[s] == 0:
+                best[s] = math.inf
+        order = sorted(
+            (v for v in range(g.num_nodes) if ds[v] is not None), key=ds.__getitem__
+        )
+        out_adj: dict[int, list[int]] = {}
+        for e in dag:
+            out_adj.setdefault(g.src[e], []).append(e)
+        for u in order:
+            if u not in best:
+                continue
+            for e in out_adj.get(u, ()):
+                cand = min(best[u], prio(e))
+                v = g.dst[e]
+                if v not in best or cand > best[v]:
+                    best[v] = cand
+        b_star = max(best[t] for t in destinations if t in best and ds[t] == dstar)
+        if prefix_cap is not None and prefix_cap < b_star:
+            b_star = prefix_cap
+        dag = [e for e in dag if prio(e) >= b_star]
+    # hop counts toward the destinations inside the (restricted) DAG
+    radj: dict[int, list[int]] = {}
+    for e in dag:
+        radj.setdefault(g.dst[e], []).append(e)
+    h: dict[int, int] = {t: 0 for t in destinations if t not in excluded_nodes}
+    q = deque(h)
+    while q:
+        v = q.popleft()
+        for e in radj.get(v, ()):
+            u = g.src[e]
+            if u not in h:
+                h[u] = h[v] + 1
+                q.append(u)
+    starts = [s for s in sources if s in h]
+    if not starts:
+        return None
+    hmin = min(h[s] for s in starts)
+    out_adj2: dict[int, list[int]] = {}
+    for e in dag:
+        out_adj2.setdefault(g.src[e], []).append(e)
+    frontier = [s for s in starts if h[s] == hmin]
+    walk: list[int] = []
+    u = None
+    while True:
+        cands = []
+        for x in [u] if u is not None else frontier:
+            for e in out_adj2.get(x, ()):
+                v = g.dst[e]
+                if v in h and h[v] == h[x] - 1:
+                    cands.append(e)
+        if not cands:
+            break
+        e = min(cands)
+        walk.append(e)
+        u = g.dst[e]
+        if u in dests:
+            break
+    if not walk:
+        return None
+    cost = sum(g.cost[e] for e in walk)
+    assert cost == dstar
+    bottleneck = None if prio is None else min(prio(e) for e in walk)
+    return SinglePath(walk, cost, bottleneck, b_star)
+
+
+# ------------------------------------------------------------------ public-shaped spf
+
+
+@dataclass
+class SpfResult:
+    costs: list[int | None] | None
+    dag: list[int]
+    target_cost: int | None
+    path: SinglePath | None = None
+
+
+def spf(
+    g: Graph,
+    roots,
+    *,
+    direction: str = "Forward",
+    targets=None,
+    selection: Selection | None = None,
+    residual=None,
+    min_residual: int = 1,
+    elig: Eligibility | None = None,
+) -> SpfResult:
+    selection = Selection() if selection is None else selection
+    roots = check_node_set(g, roots, "roots")
+    if targets is not None:
+        targets = check_node_set(g, targets, "targets")
+        check_disjoint(roots, targets)
+    elif not selection.multipath:
+        raise ContractError("multipath = false requires targets (rule 13)")
+    if direction not in ("Forward", "Reverse"):
+        raise ContractError(f"unknown direction {direction!r}")
+    check_residual(g, residual)
+    members = member_graph(g, elig, selection, residual, min_residual)
+    node_ok = (lambda v: True) if elig is None else (lambda v: elig.node_allowed[v])
+    live_roots = [r for r in roots if node_ok(r)]
+    if targets is None:
+        d = distances(g, members, live_roots, direction == "Reverse")
+        return SpfResult(
+            d, full_dag(g, members, live_roots, direction == "Reverse"), None
+        )
+    live_targets = [t for t in targets if node_ok(t)]
+    src, dst = (
+        (live_roots, live_targets)
+        if direction == "Forward"
+        else (live_targets, live_roots)
+    )
+    if not src or not dst:
+        return SpfResult(None, [], None)
+    if selection.multipath:
+        dstar, dag = tight_dag(g, members, src, dst)
+        return SpfResult(None, dag, dstar)
+    prio = (
+        priority_fn(g, selection.priority, residual)
+        if selection.tie_break == PREFER
+        else None
+    )
+    path = canonical_path(g, members, src, dst, prio)
+    if path is None:
+        return SpfResult(None, [], None)
+    return SpfResult(None, sorted(path.edges), path.cost, path)
diff --git a/tests/reference/policy/p1_amount/snap.py b/tests/reference/policy/p1_amount/snap.py
new file mode 100644
index 0000000..a0b4470
--- /dev/null
+++ b/tests/reference/policy/p1_amount/snap.py
@@ -0,0 +1,174 @@
+"""Snapshot recording for prototype 1 fixtures.
+
+Every fixture records its graphs (input coordinates, the B' order and
+``input_index``), every operation with its arguments, its result, its trace (views,
+plans, ``T`` values, ``T_max`` searches, flow-core payloads with tiers) and the
+ledger state after it (allocations and residuals in input coordinates, records with
+ids and input positions), and every expectation with the expected and actual values.
+"""
+
+from __future__ import annotations
+
+import math
+from fractions import Fraction
+
+from graph import Graph, graph_from_input, input_to_id
+from units import ContractError
+
+
+def jsonable(x):
+    if isinstance(x, bool) or x is None or isinstance(x, (int, str)):
+        return x
+    if isinstance(x, float):
+        if math.isinf(x):
+            return "inf" if x > 0 else "-inf"
+        if math.isnan(x):
+            return "nan"
+        return x
+    if isinstance(x, Fraction):
+        return str(x)
+    if isinstance(x, dict):
+        return {str(k): jsonable(v) for k, v in x.items()}
+    if isinstance(x, (list, tuple, set, frozenset)):
+        seq = sorted(x) if isinstance(x, (set, frozenset)) else x
+        return [jsonable(v) for v in seq]
+    if hasattr(x, "to_json"):
+        return jsonable(x.to_json())
+    return repr(x)
+
+
+class Snap:
+    def __init__(self, name: str, family: str, description: str, rules) -> None:
+        self.data: dict = {
+            "fixture": name,
+            "family": family,
+            "description": description,
+            "rules": list(rules),
+            "graphs": {},
+            "steps": [],
+            "checks": [],
+        }
+        self.failures: list[str] = []
+        self.ledgers: dict[str, object] = {}
+        self.labels: dict[int, str] = {}
+
+    # ------------------------------------------------------------ inputs
+
+    def graph(self, label: str, n: int, edges, resolution=1) -> tuple[Graph, list[int]]:
+        g = graph_from_input(n, edges, resolution)
+        inv = input_to_id(g)
+        self.labels[g.uid] = label
+        self.data["graphs"][label] = {
+            "num_nodes": n,
+            "resolution": str(g.q),
+            "edges_input": [list(e) for e in edges],
+            "input_index": list(g.input_index()),
+            "edges_by_id": [list(g.edge_tuple(e)) for e in range(g.num_edges)],
+        }
+        return g, inv
+
+    def note(self, text: str, **data) -> None:
+        self.data["steps"].append({"op": "note", "text": text, **jsonable(data)})
+
+    def step(self, op: str, **data) -> None:
+        self.data["steps"].append({"op": op, **jsonable(data)})
+
+    # ------------------------------------------------------------ operations
+
+    def place(self, label: str, policy, volume, fg=None):
+        entry: dict = {"op": "place", "policy": label, "request": jsonable(volume)}
+        try:
+            r = policy.place(volume)
+        except ContractError as exc:
+            entry["error"] = f"{type(exc).__name__}: {exc}"
+            self.data["steps"].append(entry)
+            return exc
+        entry["result"] = jsonable(r.to_json())
+        entry["trace"] = jsonable(getattr(r, "trace", {}))
+        fg = fg if fg is not None else getattr(policy, "fg", None)
+        if fg is not None:
+            entry["graph"] = self.labels.get(fg.graph.uid)
+            entry["state"] = jsonable(fg.state())
+        self.data["steps"].append(entry)
+        return r
+
+    def call(self, label: str, fn, *args, fg=None, **kw):
+        entry: dict = {"op": label}
+        try:
+            out = fn(*args, **kw)
+        except ContractError as exc:
+            entry["error"] = f"{type(exc).__name__}: {exc}"
+            self.data["steps"].append(entry)
+            return exc
+        entry["result"] = jsonable(out)
+        if fg is not None:
+            entry["state"] = jsonable(fg.state())
+        self.data["steps"].append(entry)
+        return out
+
+    # ------------------------------------------------------------ expectations
+
+    def expect(self, name: str, actual, expected) -> bool:
+        ok = jsonable(actual) == jsonable(expected)
+        self.data["checks"].append(
+            {
+                "name": name,
+                "expected": jsonable(expected),
+                "actual": jsonable(actual),
+                "ok": ok,
+            }
+        )
+        if not ok:
+            self.failures.append(f"{name}: expected {expected!r}, got {actual!r}")
+        return ok
+
+    def check(self, name: str, ok: bool, detail=None) -> bool:
+        self.data["checks"].append(
+            {"name": name, "ok": bool(ok), "detail": jsonable(detail)}
+        )
+        if not ok:
+            self.failures.append(f"{name}: {detail!r}")
+        return bool(ok)
+
+    def raises(self, name: str, fn, *args, **kw) -> bool:
+        try:
+            fn(*args, **kw)
+        except ContractError as exc:
+            self.data["checks"].append(
+                {"name": name, "ok": True, "error": f"{type(exc).__name__}: {exc}"}
+            )
+            return True
+        self.failures.append(f"{name}: no ContractError")
+        self.data["checks"].append({"name": name, "ok": False, "error": None})
+        return False
+
+    def finish(self) -> dict:
+        self.data["passed"] = not self.failures
+        self.data["failures"] = list(self.failures)
+        self.data["counts"] = {
+            "steps": len(self.data["steps"]),
+            "checks": len(self.data["checks"]),
+        }
+        return self.data
+
+
+def to_input(g: Graph, per_id) -> list:
+    """A per-edge array in id coordinates, re-indexed by input position."""
+    out = [0] * g.num_edges
+    pos = g.input_index()
+    for e, x in enumerate(per_id):
+        out[pos[e]] = x
+    return out
+
+
+def dict_to_input(g: Graph, d: dict) -> list:
+    out = [0] * g.num_edges
+    pos = g.input_index()
+    for e, x in d.items():
+        out[pos[e]] = x
+    return out
+
+
+def ids(inv: list[int], positions) -> list[int]:
+    """Input positions to B' ids (through the caller's inverse of input_index)."""
+    return sorted(inv[p] for p in positions)
diff --git a/tests/reference/policy/p1_amount/units.py b/tests/reference/policy/p1_amount/units.py
new file mode 100644
index 0000000..3ffa981
--- /dev/null
+++ b/tests/reference/policy/p1_amount/units.py
@@ -0,0 +1,97 @@
+"""Integer units: the one numeric domain (APPROACH revision 24, sections 2.1 and 2.3).
+
+Every amount is a Python ``int`` number of units of the graph's resolution ``q``.
+There is no finer grid; physical values enter only through ``to_units`` (round half
+up) and leave only through ``as_float``. Costs are positive integers and are never
+converted.
+"""
+
+from __future__ import annotations
+
+import math
+from fractions import Fraction
+
+LIMIT = 1 << 62  # exclusive bound: capacities, their sum, finite requests, cost sums
+VIRTUAL_CAP = (1 << 63) - 2  # virtual arcs never saturate (2.2, revision 20)
+INT64_MAX = (1 << 63) - 1
+UNREACHABLE = INT64_MAX  # path-cost sentinel (None in Python accessors)
+NEVER_REACHED = -1  # potential sentinel of the private flow-core payload (2.2)
+INTERNAL_CAP_MAX = (1 << 63) - 2  # internal flow-core cap domain [0, 2^63 - 2]
+COUNTER_LIMIT = 1 << 127  # signed 128-bit cumulative counters (offered, drops)
+INF = math.inf  # the only non-integer request: +inf
+
+
+class ContractError(ValueError):
+    """Invalid input rejected before any mutation (rule 13)."""
+
+
+def check_resolution(q) -> Fraction:
+    """A power of two in [2^-32, 2^32], given explicitly (no default in Core)."""
+    if isinstance(q, bool):
+        raise ContractError("resolution must be a number")
+    if isinstance(q, float) and not math.isfinite(q):
+        raise ContractError("resolution must be finite")
+    try:
+        f = Fraction(q)
+    except (TypeError, ValueError) as exc:
+        raise ContractError(f"resolution {q!r} is not a number") from exc
+    if f <= 0:
+        raise ContractError("resolution must be positive")
+    num, den = f.numerator, f.denominator
+    if num & (num - 1) or den & (den - 1):
+        raise ContractError(f"resolution {q!r} is not a power of two")
+    exponent = num.bit_length() - den.bit_length()
+    if not -32 <= exponent <= 32:
+        raise ContractError(f"resolution 2^{exponent} outside [2^-32, 2^32]")
+    return f
+
+
+def to_units(x, q) -> int:
+    """Round half up of ``x / q``; NaN, infinity and negative values rejected.
+
+    The scalar form of the conversion; arrays convert element by element.
+    """
+    qf = check_resolution(q)
+    if isinstance(x, bool):
+        raise ContractError("physical amount must be a number")
+    if isinstance(x, float) and not math.isfinite(x):
+        raise ContractError("physical amount must be finite")
+    value = Fraction(x)
+    if value < 0:
+        raise ContractError("physical amount must be non-negative")
+    scaled = value / qf + Fraction(1, 2)
+    return scaled.numerator // scaled.denominator
+
+
+def to_units_array(xs, q) -> list[int]:
+    return [to_units(x, q) for x in xs]
+
+
+def as_float(units: int, q) -> float:
+    """Units to a physical double: exact below 2^53 units (q is a power of two)."""
+    qf = check_resolution(q)
+    if not isinstance(units, int) or isinstance(units, bool):
+        raise ContractError("as_float takes integer units")
+    return float(Fraction(units) * qf)
+
+
+def check_units(name: str, x, *, upper: int = LIMIT) -> int:
+    """An integer amount in [0, upper)."""
+    if not isinstance(x, int) or isinstance(x, bool):
+        raise ContractError(f"{name} must be an integer number of units")
+    if x < 0 or x >= upper:
+        raise ContractError(f"{name} = {x} outside [0, {upper})")
+    return x
+
+
+def check_request(volume) -> int | None:
+    """A request in units: an int in [0, 2^62) or +inf (returned as None)."""
+    if isinstance(volume, float):
+        if volume == math.inf:
+            return None
+        raise ContractError("requests are integer units or +inf")
+    return check_units("request", volume)
+
+
+def bits(x: int) -> int:
+    return abs(x).bit_length()
diff --git a/tests/reference/policy/p2_transaction/_p1.py b/tests/reference/policy/p2_transaction/_p1.py
new file mode 100644
index 0000000..f31b1fb
--- /dev/null
+++ b/tests/reference/policy/p2_transaction/_p1.py
@@ -0,0 +1,13 @@
+"""Make prototype 1's library importable (units, apportion, graph, flowcore, search,
+kernels, ledger, pinned, certify).
+
+The directory is appended, not prepended, so this prototype's own ``fixtures``,
+``run_fixtures`` and ``tests`` modules are never shadowed by prototype 1's.
+"""
+
+import sys
+from pathlib import Path
+
+P1_DIR = Path(__file__).resolve().parent.parent / "p1_amount"
+if str(P1_DIR) not in sys.path:
+    sys.path.append(str(P1_DIR))
diff --git a/tests/reference/policy/p2_transaction/fixtures.py b/tests/reference/policy/p2_transaction/fixtures.py
new file mode 100644
index 0000000..418450c
--- /dev/null
+++ b/tests/reference/policy/p2_transaction/fixtures.py
@@ -0,0 +1,1081 @@
+"""Prototype 2 fixtures in integer units (APPROACH revision 24, sections 8, 9 and 16).
+
+The fixtures of the grid prototype regenerated in units (the old names mapped in
+``FIXTURE_MAP``), plus the review witnesses of review 13 to review 17; the deletion of T0 removed every
+``CapacityAware`` fixture and part with that routing mode (README "T1 replaces
+CapacityAware"). Graphs are
+stated in input coordinates; bundles and expected per-edge arrays are input
+positions translated through the inverse of ``input_index()``. Expected values are
+derived in the fixture text or bodies (round robin, highest averages, hand-traced
+transactions), never read back from the engine. "Manual" owners are ``Global``
+policies whose support is one bundle (a controller restricted to it; step 3 converted the
+former single-bundle ``Pinned`` MaxFlow owners by this rule: the same minimum-cost flow on the
+same DAG). CostOnly Weighted configurations with the selection priority Residual take the
+residual-snapshot weight basis (step 3: weights no longer come from the priority).
+
+Graph shapes (input positions):
+* ``diamond(s0, t0, s1, t1)``: 0 -[0]-> 1 -[1]-> 3 and 0 -[2]-> 2 -[3]-> 3; route 0
+  = {0, 1}, route 1 = {2, 3};
+* ``parallel(caps)``: links 0 -> 1.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import _p1  # noqa: F401
+import certify
+import policy as P
+import search
+from ledger import FlowGraph
+from recorder import PSnap
+from snap import dict_to_input
+from units import INF
+
+MF, W, EB = P.MF, P.W_, P.EB
+LOSSLESS, LOSSY = P.LOSSLESS, P.LOSSY
+
+# Old fixture name -> regenerated fixture (the 44 grid fixtures).
+FIXTURE_MAP = {
+    "admission_zero_src_dst_no_route": "admission_zero_and_no_route",
+    "cancellation_dag": "cancellation_dag",
+    "combine_custom_edges_explicit": "sources_augmentation_edges",
+    "combine_eb_pseudo_root": "sources_eb_per_source",
+    "combine_forward_vs_reverse_3_vs_5": "sources_lossy_per_source",
+    "combine_inf_every_kernel": "sources_inf_every_kernel",
+    "combine_limits_and_validation": "sources_limits_and_validation",
+    "combine_multi_source_attribution": "sources_attribution",
+    "combine_proportional_2_vs_3": "sources_maxflow_vs_global",
+    "combine_source_split_additivity": "sources_split_cumulative",
+    "eb_1_plus_2_vs_3": "eb_1_plus_2_vs_3",
+    "eb_unequal_1_10": "eb_unequal_1_10",
+    "four_calls_EB": "four_calls_EB",
+    "four_calls_Lossy": "four_calls_Lossy",
+    "four_calls_P": "four_calls_MaxFlow",
+    "four_calls_W": "four_calls_W",
+    "inf_every_kernel": "inf_every_kernel",
+    "lossy_diamond_10_then_1": "lossy_diamond_10_then_1",
+    "third_party_occupancy": "third_party_occupancy",
+    "weighted_1_plus_5_vs_6": "weighted_1_plus_5_vs_6",
+    "weighted_frozen_third_party": "weighted_frozen_third_party",
+}
+
+
+@dataclass
+class Fixture:
+    name: str
+    family: str
+    rules: tuple[str, ...]
+    description: str
+    run: object
+
+
+FIXTURES: list[Fixture] = []
+
+
+def fixture(name, family, rules, description):
+    def wrap(fn):
+        FIXTURES.append(Fixture(name, family, tuple(rules), description, fn))
+        return fn
+
+    return wrap
+
+
+# ------------------------------------------------------------------ helpers
+
+
+def diamond(s0, t0, s1, t1, c0=1, c1=1):
+    return 4, [(0, 1, s0, c0), (1, 3, t0, c0), (0, 2, s1, c1), (2, 3, t1, c1)]
+
+
+def parallel(caps, costs=None):
+    costs = costs or [1] * len(caps)
+    return 2, [(0, 1, c, w) for c, w in zip(caps, costs, strict=True)]
+
+
+def co(kernel, adm=LOSSLESS, sel=None):
+    sel = sel or search.Selection()
+    # By rule (step 3): Weighted with the Residual priority read its weights from the residual
+    # at preparation, which is the residual-snapshot weight basis.
+    weights = "ResidualSnapshot" if kernel == W and sel.priority == "Residual" else None
+    return P.FlowPolicyConfig(P.CostOnly(), kernel, adm, sel, weights)
+
+
+def glob():
+    # Step 2: Global takes neither a placement nor a selection.
+    return P.FlowPolicyConfig(P.Global(), None, LOSSLESS, None)
+
+
+class Ctx:
+    """One graph, its caller-side inverse map, and helpers in input coordinates."""
+
+    def __init__(self, s: PSnap, label, spec, resolution=1):
+        n, edges = spec
+        self.s, self.n, self.edges = s, n, edges
+        self.g, self.inv = s.graph(label, n, edges, resolution)
+
+    def ids(self, positions):
+        return tuple(sorted(self.inv[p] for p in positions))
+
+    def ledger(self, residual_input=None):
+        if residual_input is None:
+            return FlowGraph(self.g)
+        return FlowGraph(self.g, [residual_input[p] for p in self.g.input_index()])
+
+    def manual(self, fg, src, dst, positions, amount, label="manual owner"):
+        """A fixed-structure owner: Global with one bundle as its support."""
+        cfg = P.FlowPolicyConfig(P.Global(self.ids(positions)), None, LOSSLESS, None)
+        pol = P.FlowPolicy(fg, src, dst, cfg)
+        r = self.s.place(label, pol, amount, fg=fg)
+        return pol, r
+
+    def alloc(self, fg):
+        return fg.state()["allocated_input"]
+
+    def own(self, fg, pol):
+        out = [0] * self.g.num_edges
+        for r in pol.records():
+            for e, x in r.edges.items():
+                out[self.g.input_index()[e]] += x
+        return out
+
+    def routes_of(self, pol, src=None):
+        st = pol.state()["cohorts"]
+        src = next(iter(st)) if src is None else src
+        return [f["route_input"] for f in st[src]]
+
+
+# ====================================================================== four calls
+
+
+def _four_calls(s: PSnap, kernel, adm, expected):
+    for shape, caps in (("equal", (5, 5)), ("unequal", (1, 10))):
+        c = Ctx(s, f"diamond_{shape}", diamond(caps[0], caps[0], caps[1], caps[1]))
+        for mode in ("CostOnly",):
+            fg = c.ledger()
+            cfg = co(kernel, adm)
+            pol = P.FlowPolicy(fg, 0, 3, cfg)
+            got = [
+                s.place(f"{shape} {mode} call {i}", pol, 1, fg=fg).placed
+                for i in range(4)
+            ]
+            s.expect(f"{shape} {mode}", got, expected[shape])
+
+
+@fixture(
+    "four_calls_MaxFlow",
+    "four_calls",
+    ["8a", "16.4"],
+    "MaxFlow, four calls of 1 on equal (5/5) and unequal (1/10) routes, one "
+    "CostOnly flow on the diamond: 1, 1, 1, 1.",
+)
+def four_calls_mf(s: PSnap):
+    _four_calls(s, MF, LOSSLESS, {"equal": [1] * 4, "unequal": [1] * 4})
+
+
+@fixture(
+    "four_calls_W",
+    "four_calls",
+    ["8a", "16.4"],
+    "Weighted (Residual weights at creation, 1:10 on the unequal diamond; highest "
+    "averages gives [0, T] up to T = 9): 1, 1, 1, 1 everywhere.",
+)
+def four_calls_w(s: PSnap):
+    _four_calls(s, W, LOSSLESS, {"equal": [1] * 4, "unequal": [1] * 4})
+
+
+@fixture(
+    "four_calls_EB",
+    "four_calls",
+    ["8a", "16.4"],
+    "EqualBalanced: equal 1, 1, 1, 1; unequal 1/10: 1, 1, 0, 0 (round robin [2, 1] "
+    "overfills the 1-route at T = 3).",
+)
+def four_calls_eb(s: PSnap):
+    _four_calls(s, EB, LOSSLESS, {"equal": [1] * 4, "unequal": [1, 1, 0, 0]})
+
+
+@fixture(
+    "four_calls_Lossy",
+    "four_calls",
+    ["19", "16.6"],
+    "Lossy EB (per-call offers, round robin from the lowest EdgeId every call): "
+    "equal 1, 1, 1, 1; unequal 1, 0, 0, 0 (every one-unit offer goes to the full "
+    "1-route and is dropped there; the grid prototype's halves do not exist in "
+    "units).",
+)
+def four_calls_lossy(s: PSnap):
+    _four_calls(s, EB, LOSSY, {"equal": [1] * 4, "unequal": [1, 0, 0, 0]})
+
+
+@fixture(
+    "eb_unequal_1_10",
+    "four_calls",
+    ["8a", "9.4"],
+    "EB on the unequal 1/10 diamond (one CostOnly flow): 1, 1, 0, 0; the third and "
+    "fourth calls are exhausted with nothing placed.",
+)
+def eb_unequal(s: PSnap):
+    c = Ctx(s, "diamond_1_10", diamond(1, 1, 10, 10))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, co(EB))
+    rs = [s.place(f"call {i}", pol, 1) for i in range(4)]
+    s.expect("placed", [r.placed for r in rs], [1, 1, 0, 0])
+    s.expect(
+        "terminations",
+        [r.termination for r in rs],
+        ["complete", "complete", "exhausted", "exhausted"],
+    )
+
+
+@fixture(
+    "cancellation_dag",
+    "four_calls",
+    ["20", "16.4"],
+    "CostOnly MaxFlow on the cancellation DAG (all costs 1): calls 1 then 1 give 1 "
+    "and 1 (edge 1->3 goes 1 -> 0), a single call of 2 gives the same allocation "
+    "[1,1,0,1,1,1,1].",
+)
+def cancellation(s: PSnap):
+    pairs = [(0, 1), (0, 2), (1, 3), (1, 4), (2, 3), (3, 5), (4, 5)]
+    c = Ctx(s, "cancellation", (6, [(u, v, 1, 1) for u, v in pairs]))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 5, co(MF))
+    a = s.place("call 1", pol, 1)
+    s.expect("after call 1", c.alloc(fg), [1, 0, 1, 0, 0, 1, 0])
+    b = s.place("call 2", pol, 1)
+    s.expect("two calls", (a.placed, b.placed), (1, 1))
+    s.expect("after call 2", c.alloc(fg), [1, 1, 0, 1, 1, 1, 1])
+    fg2 = c.ledger()
+    s.place("single call 2", P.FlowPolicy(fg2, 0, 5, co(MF)), 2, fg=fg2)
+    s.expect("1 + 1 equals 2", c.alloc(fg2), c.alloc(fg))
+
+
+# ====================================================================== Lossy
+
+
+@fixture(
+    "lossy_diamond_10_then_1",
+    "lossy",
+    ["19", "16.6", "15"],
+    "CostOnly Lossy EB on source links 10/10 over tails 1/10: request 10 delivers "
+    "6 (complete, 4 dropped on the 1-tail, remaining 4); request 1 is offered to the "
+    "full branch and dropped (complete, delivered 0); the record keeps offered 11, "
+    "delivered 6 and 5 drops on the tail; drops are never re-offered.",
+)
+def lossy_diamond(s: PSnap):
+    c = Ctx(s, "diamond_10_1_10_10", diamond(10, 1, 10, 10))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, co(EB, LOSSY))
+    tail = c.ids([1])[0]
+    a = s.place("request 10", pol, 10)
+    s.expect(
+        "first",
+        (a.placed, a.termination, a.remaining, a.call_drops),
+        (6, "complete", 4, [(tail, 4)]),
+    )
+    b = s.place("request 1", pol, 1)
+    s.expect(
+        "second",
+        (b.placed, b.termination, b.remaining, b.call_drops),
+        (0, "complete", 1, [(tail, 1)]),
+    )
+    rec = pol.records()[0]
+    s.expect("record", (rec.offered, rec.delivered, rec.drops), (11, 6, {tail: 5}))
+
+
+# ====================================================================== +inf
+
+
+@fixture(
+    "inf_every_kernel",
+    "infinite",
+    ["15", "8a", "8b"],
+    "+inf for every kernel: CostOnly MaxFlow, Weighted and EB on 5/5 place 10 "
+    "(exhausted, remaining +inf); Lossy injects every source member to its residual: 11 "
+    "on the 1/10 diamond; on 10/10 over 1/10 delivered 11 with 20 offered and 9 dropped.",
+)
+def inf_every_kernel(s: PSnap):
+    c = Ctx(s, "diamond_5", diamond(5, 5, 5, 5))
+    for kernel in (MF, W, EB):
+        fg = c.ledger()
+        r = s.place(
+            f"CostOnly {kernel} +inf", P.FlowPolicy(fg, 0, 3, co(kernel)), INF, fg=fg
+        )
+        s.expect(
+            f"CostOnly {kernel}",
+            (r.placed, r.remaining, r.termination),
+            (10, None, "exhausted"),
+        )
+    c2 = Ctx(s, "diamond_1_10", diamond(1, 1, 10, 10))
+    fg = c2.ledger()
+    r = s.place("Lossy +inf 1/10", P.FlowPolicy(fg, 0, 3, co(EB, LOSSY)), INF, fg=fg)
+    s.expect("Lossy 1/10", (r.placed, r.termination), (11, "exhausted"))
+    c3 = Ctx(s, "diamond_10_1_10_10", diamond(10, 1, 10, 10))
+    fg = c3.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, co(EB, LOSSY))
+    r = s.place("Lossy +inf transit", pol, INF, fg=fg)
+    rec = pol.records()[0]
+    s.expect(
+        "Lossy transit", (r.placed, rec.offered, sum(rec.drops.values())), (11, 20, 9)
+    )
+
+
+# ====================================================================== third parties
+
+
+@fixture(
+    "weighted_frozen_third_party",
+    "third_party",
+    ["8a", "16.2", "9.4"],
+    "CostOnly Weighted on source links 10/10 over tails t/10: weights [10, 10] "
+    "captured at creation and frozen. (a) t = 1: 2 then 1 give 2 then 0 (T = 3 "
+    "needs 2 on the 1-tail). (b) t = 2: request 2 ([1, 1]); a third party takes 1 "
+    "on the tail; request 1 places 0; after the third party leaves, request 1 places "
+    "1. The plan never changes; weights_changed stays false.",
+)
+def weighted_frozen(s: PSnap):
+    c = Ctx(s, "diamond_10_1", diamond(10, 1, 10, 10))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, co(W))
+    a = s.place("(a) request 2", pol, 2)
+    b = s.place("(a) request 1", pol, 1)
+    s.expect("(a)", (a.placed, b.placed), (2, 0))
+    c2 = Ctx(s, "diamond_10_2", diamond(10, 2, 10, 10))
+    fg = c2.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, co(W))
+    s.place("(b) request 2", pol, 2, fg=fg)
+    plan = pol.state()["cohorts"][0][0]["plan"]
+    other, _ = c2.manual(fg, 1, 3, [1], 1, "(b) third party on the tail")
+    r1 = s.place("(b) request 1 blocked", pol, 1, fg=fg)
+    other.remove()
+    r2 = s.place("(b) request 1 after removal", pol, 1, fg=fg)
+    s.expect("(b)", (r1.placed, r2.placed), (0, 1))
+    s.expect("(b) plan frozen", pol.state()["cohorts"][0][0]["plan"], plan)
+    s.expect(
+        "(b) weights_changed", (r1.weights_changed, r2.weights_changed), (False, False)
+    )
+
+
+@fixture(
+    "third_party_occupancy",
+    "third_party",
+    ["8a", "16.2", "18"],
+    "Capacity 10, baseline 8, own 4, another owner 3: the residual is 1 and the "
+    "view 5; request 2 adds exactly 1 for MaxFlow, Weighted and EB (exhausted) and "
+    "never touches the other owner's record.",
+)
+def third_party(s: PSnap):
+    c = Ctx(s, "one_link", parallel([10]))
+    for kernel in (MF, W, EB):
+        fg = c.ledger([8])
+        pol = P.FlowPolicy(fg, 0, 1, co(kernel))
+        s.place(f"{kernel} own 4", pol, 4, fg=fg)
+        other, _ = c.manual(fg, 0, 1, [0], 3)
+        r = s.place(f"{kernel} request 2", pol, 2, fg=fg)
+        s.expect(f"{kernel}", (r.placed, r.termination), (1, "exhausted"))
+        s.expect(
+            f"{kernel} other untouched", [x.delivered for x in other.records()], [3]
+        )
+
+
+# ====================================================================== cohorts in units
+
+
+@fixture(
+    "eb_1_plus_2_vs_3",
+    "units",
+    ["16.4", "16.5"],
+    "Three ample parallel links: EB place(1); place(2) equals place(3) exactly "
+    "([1, 1, 1]) for one CostOnly flow.",
+)
+def eb_additivity(s: PSnap):
+    c = Ctx(s, "parallel_10", parallel([10, 10, 10]))
+    for mode in ("CostOnly",):
+        finals = []
+        for calls in ([1, 2], [3]):
+            fg = c.ledger()
+            cfg = co(EB)
+            pol = P.FlowPolicy(fg, 0, 1, cfg)
+            got = [s.place(f"{mode} {v}", pol, v, fg=fg).placed for v in calls]
+            s.expect(f"{mode} {calls}", got, calls)
+            finals.append(c.alloc(fg))
+        s.expect(f"{mode} 1 + 2 equals 3", finals[0], finals[1])
+        s.expect(f"{mode} allocation", finals[1], [1, 1, 1])
+
+
+@fixture(
+    "weighted_1_plus_5_vs_6",
+    "units",
+    ["16.4"],
+    "Three equal parallel capacity-2 links, CostOnly Weighted: place(1); place(5) "
+    "equals place(6) ([2, 2, 2]).",
+)
+def weighted_additivity(s: PSnap):
+    c = Ctx(s, "parallel_2", parallel([2, 2, 2]))
+    finals = []
+    for calls in ([1, 5], [6]):
+        fg = c.ledger()
+        pol = P.FlowPolicy(fg, 0, 1, co(W))
+        got = [s.place(f"{calls} {v}", pol, v, fg=fg).placed for v in calls]
+        s.expect(f"{calls}", got, calls)
+        finals.append(c.alloc(fg))
+    s.expect("1 + 5 equals 6", finals[0], finals[1])
+    s.expect("allocation", finals[1], [2, 2, 2])
+
+
+# ====================================================================== admission
+
+
+@fixture(
+    "admission_zero_and_no_route",
+    "admission",
+    ["13", "9.4", "8"],
+    "Overlapping endpoint sets are rejected at construction (rule 13). Zero capacity "
+    "is not a missing route (the contract's 3.5): CostOnly over zero-capacity "
+    "links has the source in its roster and creates its zero-delivery record on "
+    "the static support (exhausted: MaxFlow carries 0 there).",
+)
+def admission(s: PSnap):
+    c = Ctx(s, "diamond_5", diamond(5, 5, 5, 5))
+    fg = c.ledger()
+    s.raises("overlapping sets rejected", P.FlowPolicy, fg, [0, 1], [1, 3], co(MF))
+    c0 = Ctx(s, "diamond_0", diamond(0, 0, 0, 0))
+    fg0 = c0.ledger()
+    p0 = P.FlowPolicy(fg0, 0, 3, co(MF))
+    r = s.place("CostOnly over zero-capacity links", p0, 1, fg=fg0)
+    # Both routes of the diamond cost 2, so the static support is all four links and the
+    # MaxFlow route is that support; every link has capacity 0, so the flow carries 0.
+    s.expect(
+        "CostOnly zero capacity",
+        (
+            r.termination,
+            r.placed,
+            p0.roster,
+            [(x.delivered, x.route_cost, len(x.bundle)) for x in fg0.records()],
+        ),
+        ("exhausted", 0, [0], [(0, 2, 4)]),
+    )
+
+
+# ====================================================================== flags
+
+
+@fixture(
+    "flag_zero_delivery_creation",
+    "flags",
+    ["9.4", "8"],
+    "Revision-20 witness: a first place(1) on a static route whose unit another "
+    "owner holds creates a zero-delivery record: routes_changed true, termination "
+    "exhausted, the record stays (CostOnly); a second zero-delivery call keeps the same "
+    "ids and sets no flag (revision 21).",
+)
+def flag_zero_delivery(s: PSnap):
+    c = Ctx(s, "one_unit", parallel([1]))
+    for mode in ("CostOnly",):
+        fg = c.ledger()
+        c.manual(fg, 0, 1, [0], 1)
+        cfg = co(EB)
+        pol = P.FlowPolicy(fg, 0, 1, cfg)
+        r = s.place(f"{mode} place(1)", pol, 1, fg=fg)
+        s.expect(
+            f"{mode}",
+            (
+                r.placed,
+                r.termination,
+                r.routes_changed,
+                [x.delivered for x in pol.records()],
+            ),
+            (0, "exhausted", True, [0]),
+        )
+        ids = pol.flow_ids()
+        r = s.place(f"{mode} place(1) again", pol, 1, fg=fg)
+        s.expect(
+            f"{mode} records stay pinned (revision 21)",
+            (r.placed, r.routes_changed, pol.flow_ids()),
+            (0, False, ids),
+        )
+
+
+# ====================================================================== source sets
+
+
+def two_direct(caps, costs=(1, 1)):
+    """Sources 0 and 1, each with one link to the destination 2."""
+    return 3, [(0, 2, caps[0], costs[0]), (1, 2, caps[1], costs[1])]
+
+
+@fixture(
+    "sources_lossy_per_source",
+    "sources",
+    ["24", "26", "19", "9.3"],
+    "Lossy with pooled sources (replaces the zero-cost forward-versus-reverse witness; "
+    "step 2, contract r8 5.1 and 9.1): sources 0 and 1 reach 3 through X (0->X 4, 1->X "
+    "4, X->3 3) and source 1 also through Y (1->Y 4, Y->3 4, cost 2 each). Request 8 "
+    "offers [4, 4]; source 1's routes are its own shortest walks (1->X->3 only, cost 2 < "
+    "4); router X holds 8 and sends it all on X->3, attributed [4, 4]; the link carries "
+    "3 = H(3, [4, 4]) = [2, 1]: source 0 delivers 2 and drops 2, source 1 delivers 1 "
+    "and drops 3. Delivered 3, complete.",
+)
+def sources_lossy(s: PSnap):
+    edges = [(0, 3, 4, 1), (1, 3, 4, 1), (3, 5, 3, 1), (1, 4, 4, 2), (4, 5, 4, 2)]
+    c = Ctx(s, "per_source", (6, edges))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1], 5, co(EB, LOSSY))
+    r = s.place("request 8", pol, 8)
+    s.expect("offers", r.trace["offers"], {0: 4, 1: 4})
+    s.expect("result", (r.placed, r.termination), (3, "complete"))
+    recs = {x.sources[0]: x for x in pol.records()}
+    s.expect(
+        "source 0",
+        (recs[0].delivered, dict_to_input(c.g, recs[0].drops)),
+        (2, [0, 0, 2, 0, 0]),
+    )
+    s.expect(
+        "source 1",
+        (recs[1].delivered, dict_to_input(c.g, recs[1].drops)),
+        (1, [0, 0, 3, 0, 0]),
+    )
+
+
+@fixture(
+    "sources_attribution",
+    "sources",
+    ["24", "26", "12", "9.3"],
+    "Sources A (A->T 1, cost 1) and B (B->M 10, M->T 2, cost 1 each). Lossy "
+    "request 20 (offers [10, 10]): A delivers 1 and drops 9 on A->T; B delivers 2 "
+    "and drops 8 on M->T; placed 3, complete. Lossless (step 2): MaxFlow is a controller "
+    "with the optimized origin, 1 + 2 = 3; Weighted and EB have the equal origin, the "
+    "largest total whose round-robin shares fit: 2 ([1, 1]; 3 would give A 2). All "
+    "exhausted. Route costs per record: 1 and 2.",
+)
+def sources_attribution(s: PSnap):
+    c = Ctx(s, "attribution", (4, [(0, 3, 1, 1), (1, 2, 10, 1), (2, 3, 2, 1)]))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1], 3, co(EB, LOSSY))
+    r = s.place("Lossy 20", pol, 20)
+    recs = {x.sources[0]: x for x in pol.records()}
+    s.expect("Lossy", (r.placed, r.termination), (3, "complete"))
+    s.expect(
+        "A",
+        (
+            recs[0].offered,
+            recs[0].delivered,
+            sum(recs[0].drops.values()),
+            recs[0].route_cost,
+        ),
+        (10, 1, 9, 1),
+    )
+    s.expect(
+        "B",
+        (
+            recs[1].offered,
+            recs[1].delivered,
+            sum(recs[1].drops.values()),
+            recs[1].route_cost,
+        ),
+        (10, 2, 8, 2),
+    )
+    for kernel, want in ((MF, (3, [1, 2])), (W, (2, [1, 1])), (EB, (2, [1, 1]))):
+        fg = c.ledger()
+        pol = P.FlowPolicy(fg, [0, 1], 3, co(kernel))
+        r = s.place(f"{kernel} 20", pol, 20, fg=fg)
+        s.expect(
+            f"{kernel}",
+            (r.placed, r.termination, [x.delivered for x in pol.records()]),
+            (want[0], "exhausted", want[1]),
+        )
+
+
+@fixture(
+    "sources_eb_per_source",
+    "sources",
+    ["26", "9.3"],
+    "EqualBalanced with the equal origin (step 2, contract r8 3.4 and 5.1): A (A->T 4, "
+    "cost 1) and B (B->T 10, cost 2). Lossless admits the largest total whose round-robin "
+    "shares fit: 8 ([4, 4]; 9 would give A 5). +inf also 8. (Independent per-source "
+    "placement, the rule before step 2, gave 4 + 10 = 14.)",
+)
+def sources_eb(s: PSnap):
+    c = Ctx(s, "two_direct", two_direct((4, 10), (1, 2)))
+    for v, term in ((20, "exhausted"), (INF, "exhausted")):
+        fg = c.ledger()
+        pol = P.FlowPolicy(fg, [0, 1], 2, co(EB))
+        r = s.place(f"EB {v}", pol, v, fg=fg)
+        s.expect(
+            f"EB {v}",
+            (r.placed, r.termination, [x.delivered for x in pol.records()]),
+            (8, term, [4, 4]),
+        )
+
+
+@fixture(
+    "sources_augmentation_edges",
+    "sources",
+    ["21", "9.3"],
+    "User augmentation links are ordinary positive-cost edges (no custom fanout): "
+    "source A with a real link A->T (1, cost 2) and an augmentation path A->X->T "
+    "(9 each, cost 1): the CostOnly DAG holds both cost-2 walks; MaxFlow places 10; "
+    "EB splits [ceil, floor] at A over A->X (lower id) and A->T: 3.",
+)
+def sources_augmentation(s: PSnap):
+    c = Ctx(s, "augmentation", (3, [(0, 2, 1, 2), (0, 1, 9, 1), (1, 2, 9, 1)]))
+    for kernel, placed in ((MF, 10), (EB, 3)):
+        fg = c.ledger()
+        r = s.place(f"{kernel} +inf", P.FlowPolicy(fg, 0, 2, co(kernel)), INF, fg=fg)
+        s.expect(f"{kernel}", r.placed, placed)
+
+
+@fixture(
+    "sources_inf_every_kernel",
+    "sources",
+    ["24", "15", "9.3"],
+    "+inf on the attribution graph: MaxFlow 3 (optimized origin), Weighted 2 and EB 2 "
+    "(equal origin: [1, 1]) (exhausted); Lossy injects every source member to its "
+    "residual (A 1, B 10): delivered 3, offered 11, drops 8, exhausted.",
+)
+def sources_inf(s: PSnap):
+    c = Ctx(s, "attribution", (4, [(0, 3, 1, 1), (1, 2, 10, 1), (2, 3, 2, 1)]))
+    for kernel, want in ((MF, 3), (W, 2), (EB, 2)):
+        fg = c.ledger()
+        r = s.place(
+            f"{kernel} +inf", P.FlowPolicy(fg, [0, 1], 3, co(kernel)), INF, fg=fg
+        )
+        s.expect(f"{kernel}", (r.placed, r.termination), (want, "exhausted"))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1], 3, co(EB, LOSSY))
+    r = s.place("Lossy +inf", pol, INF, fg=fg)
+    s.expect(
+        "Lossy",
+        (
+            r.placed,
+            r.termination,
+            sum(x.offered for x in pol.records()),
+            sum(sum(x.drops.values()) for x in pol.records()),
+        ),
+        (3, "exhausted", 11, 8),
+    )
+
+
+@fixture(
+    "sources_limits_and_validation",
+    "sources",
+    ["13", "9.3"],
+    "Endpoint-set validation: an empty source set and overlapping sets are "
+    "rejected; an excluded source is skipped from the roster "
+    "(roster [1]); a source that does not reach a destination statically is not in "
+    "the roster; three sources of a CostOnly policy create three records.",
+)
+def sources_validation(s: PSnap):
+    c = Ctx(
+        s,
+        "three_sources",
+        (5, [(0, 3, 5, 1), (1, 3, 5, 1), (2, 3, 5, 1), (4, 0, 1, 1)]),
+    )
+    fg = c.ledger()
+    s.raises("empty source set", P.FlowPolicy, fg, [], 3, co(MF))
+    s.raises("overlap", P.FlowPolicy, fg, [0, 3], 3, co(MF))
+    elig = c.g.eligibility(excluded_nodes=[0])
+    pe = P.FlowPolicy(fg, [0, 1], 3, co(MF), elig)
+    s.expect("excluded source skipped", pe.roster, [1])
+    fg2 = c.ledger()
+    p3 = P.FlowPolicy(fg2, [0, 1, 2], 3, co(MF))
+    r = s.place("three sources request 3", p3, 3, fg=fg2)
+    s.expect("three records", (r.placed, len(p3.records())), (3, 3))
+    c2 = Ctx(s, "unreachable_source", (3, [(0, 2, 5, 1), (2, 1, 5, 1)]))
+    p = P.FlowPolicy(c2.ledger(), [0, 1], 2, co(MF))
+    s.expect("roster excludes a source without a static route", p.roster, [0])
+
+
+@fixture(
+    "sources_maxflow_vs_global",
+    "sources",
+    ["24", "27", "9.3"],
+    "Shortest routes versus the whole graph: 0->2 (cost 2), 1->2 (cost 1), 2->3 "
+    "(cost 1) and 0->3 (cost 5), unit capacities. CostOnly MaxFlow (step 2) is one "
+    "controller on the union of the sources' shortest walks, 0->2->3 (cost 3) and "
+    "1->2->3: the shared edge 2->3 limits +inf to 1 (0->3 is on no source's shortest "
+    "walk). Global's unique optimum (cost 7 against 8) routes source 0 over 0->3 and "
+    "source 1 over 1->2->3: 2.",
+)
+def sources_vs_global(s: PSnap):
+    c = Ctx(
+        s, "shared_edge", (4, [(0, 2, 1, 2), (1, 2, 1, 1), (2, 3, 1, 1), (0, 3, 1, 5)])
+    )
+    fg = c.ledger()
+    r = s.place(
+        "CostOnly MaxFlow +inf", P.FlowPolicy(fg, [0, 1], 3, co(MF)), INF, fg=fg
+    )
+    s.expect("union of the shortest walks", r.placed, 1)
+    fg = c.ledger()
+    pg = P.FlowPolicy(fg, [0, 1], 3, glob())
+    r = s.place("Global +inf", pg, INF, fg=fg)
+    s.expect("Global", (r.placed, c.alloc(fg)), (2, [0, 1, 1, 1]))
+    s.expect(
+        "Global per-source records",
+        [(x.sources[0], x.delivered) for x in pg.records()],
+        [(0, 1), (1, 1)],
+    )
+
+
+@fixture(
+    "sources_split_cumulative",
+    "sources",
+    ["24", "16.7", "9.3"],
+    "Cumulative requests (16.7; step 2): sources A, B, C with direct links of 10. "
+    "CostOnly MaxFlow is a controller with the optimized origin that re-solves the "
+    "cumulative value from zero: place(1); place(1) supplies [1, 0, 0] then [2, 0, 0] "
+    "(the root's arc to the lowest NodeId first, its path takes both units), identical "
+    "to place(2). Lossy follows the cumulative round-robin split: two calls of 1 over "
+    "two sources offer [1, 0] then [0, 1].",
+)
+def sources_split(s: PSnap):
+    c = Ctx(s, "three_direct", (4, [(0, 3, 10, 1), (1, 3, 10, 1), (2, 3, 10, 1)]))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1, 2], 3, co(MF))
+    a = s.place("call 1", pol, 1)
+    b = s.place("call 2", pol, 1)
+    s.expect(
+        "supplies",
+        (a.trace["flow_core"]["supply"], b.trace["flow_core"]["supply"]),
+        ({0: 1, 1: 0, 2: 0}, {0: 2, 1: 0, 2: 0}),
+    )
+    fg2 = c.ledger()
+    s.place("one call of 2", P.FlowPolicy(fg2, [0, 1, 2], 3, co(MF)), 2, fg=fg2)
+    s.expect("1 + 1 equals 2", c.alloc(fg), c.alloc(fg2))
+    c2 = Ctx(s, "two_direct", two_direct((5, 5)))
+    fg3 = c2.ledger()
+    lp = P.FlowPolicy(fg3, [0, 1], 2, co(EB, LOSSY))
+    x = s.place("Lossy 1", lp, 1, fg=fg3)
+    y = s.place("Lossy 1", lp, 1, fg=fg3)
+    s.expect(
+        "Lossy cumulative offers",
+        (x.trace["offers"], y.trace["offers"]),
+        ({0: 1, 1: 0}, {0: 0, 1: 1}),
+    )
+
+
+@fixture(
+    "sources_1_9_request_4",
+    "sources",
+    ["24", "9.3", "9.4"],
+    "Review-13 source budget witness under step 2's origins: sources with capacities "
+    "[1, 9], request 4. MaxFlow (the optimized origin) supplies [1, 3]: placed 4, "
+    "complete. Weighted and EB (the equal origin) admit the largest total whose "
+    "round-robin shares fit: 2 ([1, 1]; 3 would give the 1-link source 2), remaining 2, "
+    "exhausted.",
+)
+def sources_1_9(s: PSnap):
+    c = Ctx(s, "two_direct_1_9", two_direct((1, 9)))
+    for kernel, want in (
+        (MF, ([1, 3], 4, 0, "complete")),
+        (W, ([1, 1], 2, 2, "exhausted")),
+        (EB, ([1, 1], 2, 2, "exhausted")),
+    ):
+        fg = c.ledger()
+        pol = P.FlowPolicy(fg, [0, 1], 2, co(kernel))
+        r = s.place(f"{kernel} request 4", pol, 4, fg=fg)
+        s.expect(
+            f"{kernel}",
+            (
+                [x.delivered for x in pol.records()],
+                r.placed,
+                r.remaining,
+                r.termination,
+            ),
+            want,
+        )
+
+
+@fixture(
+    "sources_partition_1_1_vs_2_0",
+    "sources",
+    ["24", "16.4", "9.2"],
+    "Source-set allocation of CostOnly MaxFlow (review-14 R3; step 2): 0->2 and 1->2 "
+    "(2 each) share 2->3 (2). The controller re-solves the cumulative value from zero "
+    "with one virtual source, so place(2); place(2) and place(4) both give deliveries "
+    "[2, 0] (the root's arc to source 0 comes first): partition-independent (before step "
+    "2 the independent per-source placement gave [1, 1] and [2, 0]).",
+)
+def sources_partition(s: PSnap):
+    c = Ctx(s, "shared_2", (4, [(0, 2, 2, 1), (1, 2, 2, 1), (2, 3, 2, 1)]))
+    out = []
+    for calls in ([2, 2], [4]):
+        fg = c.ledger()
+        pol = P.FlowPolicy(fg, [0, 1], 3, co(MF))
+        for v in calls:
+            s.place(f"{calls} call {v}", pol, v, fg=fg)
+        out.append([x.delivered for x in pol.records()])
+    s.expect("partition independence", out, [[2, 0], [2, 0]])
+
+
+# ====================================================================== termination
+
+
+@fixture(
+    "termination_complete_and_no_route",
+    "termination",
+    ["9.4", "14"],
+    "The terminations of the 14.2 table without a reduction: a Lossy finite offer "
+    "consumed with drops is complete; v = 0 is complete; an empty static roster (no "
+    "walk from the source; a zero-capacity walk would count) is no_route.",
+)
+def termination(s: PSnap):
+    cl = Ctx(s, "lossy", parallel([1, 10]))
+    fgl = cl.ledger()
+    r = s.place(
+        "Lossy finite with drops", P.FlowPolicy(fgl, 0, 1, co(EB, LOSSY)), 4, fg=fgl
+    )
+    s.expect(
+        "Lossy complete with drops",
+        (r.placed, r.termination, r.remaining),
+        (3, "complete", 1),
+    )
+    r = s.place("v = 0", P.FlowPolicy(cl.ledger(), 0, 1, co(EB)), 0)
+    s.expect("v = 0", r.termination, "complete")
+    c0 = Ctx(s, "no_roster", (2, [(1, 0, 1, 1)]))
+    p0 = P.FlowPolicy(c0.ledger(), 0, 1, co(EB))
+    r = s.place("empty roster", p0, 1)
+    s.expect(
+        "empty roster",
+        (r.termination, r.by_source),
+        ("no_route", [(0, None, 0, 0, 0, 0)]),
+    )
+    s.place("empty roster +inf", p0, INF)
+    s.raises("finite after +inf with an empty roster", p0.place, 1)
+
+
+# ====================================================================== Global
+
+
+@fixture(
+    "global_chain_plus_bypasses",
+    "global",
+    ["27", "25", "16.4"],
+    "Global is a replacement kernel (review-13 D5): chain 0-1-2-3 (cost 1) with "
+    "bypasses 0->2 and 1->3 (cost 3). place(1) takes the chain (cost 3); the next "
+    "place(1) re-solves the cumulative value 2 on W + own: both bypasses, the middle "
+    "edge released, placed 1 (total 2, not 1), cost_distribution [(3, 1), (5, 1)], "
+    "routes_changed true (support changed). place(2) on a fresh ledger gives the "
+    "same allocation and curve (additive on a fixed view).",
+)
+def global_chain(s: PSnap):
+    c = Ctx(
+        s,
+        "chain",
+        (4, [(0, 1, 1, 1), (1, 2, 1, 1), (2, 3, 1, 1), (0, 2, 1, 3), (1, 3, 1, 3)]),
+    )
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 3, glob())
+    a = s.place("place(1)", pol, 1)
+    s.expect(
+        "first",
+        (a.placed, a.cost_distribution, c.alloc(fg), a.routes_changed),
+        (1, [(3, 1)], [1, 1, 1, 0, 0], True),
+    )
+    b = s.place("place(1)", pol, 1)
+    s.expect(
+        "second",
+        (b.placed, b.cost_distribution, c.alloc(fg), b.routes_changed),
+        (1, [(3, 1), (5, 1)], [1, 0, 1, 1, 1], True),
+    )
+    fg2 = c.ledger()
+    p2 = P.FlowPolicy(fg2, 0, 3, glob())
+    r = s.place("place(2)", p2, 2, fg=fg2)
+    s.expect(
+        "additive on a fixed view",
+        (r.cost_distribution, c.alloc(fg2)),
+        (b.cost_distribution, c.alloc(fg)),
+    )
+    sol = {k: v for k, v in b.trace["flow_core"].items() if k != "supply"}
+    s.expect(
+        "maximal at cap 2: min_cut present",
+        sorted(sol["min_cut"]),
+        sorted(c.ids([0, 3])),
+    )
+    s.check(
+        "cumulative solve certified",
+        not certify.check_solve(c.g, list(c.g.capacity), [0], [3], 2, sol, tier="a"),
+    )
+
+
+@fixture(
+    "global_capped_underfill_control",
+    "global",
+    ["2.2", "27"],
+    "Attained value at the policy level: Global place(2) on one 3-unit edge places "
+    "2 (min_cut None: a residual path is left; requested with the min_cut output), "
+    "the cumulative solve passes the certificate; a mutated producer returning 1 "
+    "under cap 2 is rejected; place(+inf) then places the last unit and min_cut is "
+    "[0].",
+)
+def global_underfill(s: PSnap):
+    c = Ctx(s, "one_edge", (2, [(0, 1, 3, 7)]))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, 0, 1, glob())
+    r = s.place("place(2)", pol, 2, outputs=P.Outputs(bottleneck=True, min_cut=True))
+    s.expect("capped", (r.placed, r.termination, r.min_cut), (2, "complete", None))
+    payload = {k: v for k, v in r.trace["flow_core"].items() if k != "supply"}
+    s.check(
+        "certified", not certify.check_solve(c.g, [3], [0], [1], 2, payload, tier="a")
+    )
+    bad = dict(payload, placed=1, edge_flows=[1], cost_distribution=[[7, 1]])
+    s.check(
+        "underfill rejected",
+        bool(certify.check_solve(c.g, [3], [0], [1], 2, bad, tier="a")),
+    )
+    r = s.place(
+        "place(+inf)", pol, INF, outputs=P.Outputs(bottleneck=True, min_cut=True)
+    )
+    s.expect("maximal", (r.placed, r.termination, r.min_cut), (1, "exhausted", [0]))
+
+
+@fixture(
+    "global_zero_growth_support_change",
+    "global",
+    ["9.4", "27", "20"],
+    "Review-16 R1: edges 0->1 (cost 1, cap 1), 0->1 (cost 3, cap 2), 1->2 (cap 2). "
+    "Owner X holds the cheap link and one unit of 1->2; Global place(1) takes the "
+    "costly link (cost 4). X leaves; owner Y takes the costly link and the rest of "
+    "1->2. Global place(1): the view admits no growth (placed 0, exhausted) but the "
+    "re-solve moves the unit onto the released cheap link (cost 2): routes_changed "
+    "true at placed 0; Y untouched; the next place(1) changes nothing (flags false).",
+)
+def global_support(s: PSnap):
+    c = Ctx(s, "release", (3, [(0, 1, 1, 1), (0, 1, 2, 3), (1, 2, 2, 1)]))
+    fg = c.ledger()
+    x, _ = c.manual(fg, 0, 2, [0, 2], 1, "X")
+    pol = P.FlowPolicy(fg, 0, 2, glob())
+    r = s.place("Global place(1)", pol, 1)
+    s.expect("costly", (r.placed, c.own(fg, pol)), (1, [0, 1, 1]))
+    x.remove()
+    y, _ = c.manual(fg, 0, 2, [1, 2], 1, "Y")
+    r = s.place("Global place(1) at zero growth", pol, 1)
+    s.expect(
+        "moved",
+        (r.placed, r.termination, r.routes_changed, c.own(fg, pol)),
+        (0, "exhausted", True, [1, 0, 1]),
+    )
+    s.expect("Y untouched", c.own(fg, y), [0, 1, 1])
+    r = s.place("Global place(1) unchanged", pol, 1)
+    s.expect(
+        "unchanged", (r.placed, r.routes_changed, r.weights_changed), (0, False, False)
+    )
+
+
+@fixture(
+    "global_epochs",
+    "global",
+    ["8", "27", "9.1"],
+    "Epochs for Global (review-16, revision 20): sources 0 (cost 3) and 1 (cost 1), "
+    "each directly connected to the destination with capacity 2. place(0) creates "
+    "nothing; place(1) opens the cohort with records for both sources (ids [0, 1]) "
+    "and supply [0, 1] (no round robin: the controller picks the cheaper source); "
+    "remove(); place(1) again supplies [0, 1] under ids [2, 3]. place(+inf) gives 4; "
+    "a finite request and place(0) after +inf are rejected; remove(); place(1) is "
+    "accepted.",
+)
+def global_epochs(s: PSnap):
+    c = Ctx(s, "two_costs", two_direct((2, 2), (3, 1)))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1], 2, glob())
+    r = s.place("place(0)", pol, 0)
+    s.expect("no creation", (r.termination, fg.next_flow_id()), ("complete", 0))
+    r = s.place("place(1)", pol, 1)
+    s.expect(
+        "epoch 1",
+        (
+            [x.flow_id[1] for x in pol.records()],
+            [x.delivered for x in pol.records()],
+            r.routes_changed,
+        ),
+        ([0, 1], [0, 1], True),
+    )
+    pol.remove()
+    r = s.place("place(1) after remove", pol, 1)
+    s.expect(
+        "epoch 2",
+        (
+            [x.flow_id[1] for x in pol.records()],
+            [x.delivered for x in pol.records()],
+            r.routes_changed,
+        ),
+        ([2, 3], [0, 1], True),
+    )
+    r = s.place("place(+inf)", pol, INF)
+    s.expect(
+        "+inf", (r.placed, pol.placed_demand(), r.termination), (3, 4, "exhausted")
+    )
+    s.raises("finite after +inf", pol.place, 1)
+    s.raises("place(0) after +inf", pol.place, 0)
+    pol.remove()
+    r = s.place("place(1) in a new epoch", pol, 1)
+    s.expect("accepted", r.placed, 1)
+
+
+@fixture(
+    "epochs_place_remove_place",
+    "lifetime",
+    ["8", "9.3", "24"],
+    "Section 8's epoch law for CostOnly MaxFlow over two sources: place(1) supplies "
+    "[1, 0] and creates both records (ids [0, 1], source 1 at zero delivery); remove(); "
+    "place(1) supplies [1, 0] again (requested reset) with ids [2, 3]; "
+    "place(+inf); remove(); place(1) is accepted; remove() on an empty cohort "
+    "resets the epoch state.",
+)
+def epochs(s: PSnap):
+    c = Ctx(s, "two_direct", two_direct((5, 5)))
+    fg = c.ledger()
+    pol = P.FlowPolicy(fg, [0, 1], 2, co(MF))
+    r = s.place("place(1)", pol, 1)
+    s.expect(
+        "epoch 1",
+        (
+            r.trace["flow_core"]["supply"],
+            [x.flow_id[1] for x in pol.records()],
+            [x.delivered for x in pol.records()],
+        ),
+        ({0: 1, 1: 0}, [0, 1], [1, 0]),
+    )
+    pol.remove()
+    r = s.place("place(1) after remove", pol, 1)
+    s.expect(
+        "epoch 2",
+        (r.trace["flow_core"]["supply"], [x.flow_id[1] for x in pol.records()]),
+        ({0: 1, 1: 0}, [2, 3]),
+    )
+    s.place("place(+inf)", pol, INF)
+    pol.remove()
+    r = s.place("place(1) after +inf and remove", pol, 1)
+    s.expect("accepted", (r.placed, r.trace["flow_core"]["supply"]), (1, {0: 1, 1: 0}))
+    pol.remove()
+    pol.remove()
+    s.expect(
+        "reset state", (pol.requested, pol.infinite, pol.records()), (0, False, [])
+    )
+
+
+@fixture(
+    "collapse_projection_every_priority",
+    "selection",
+    ["16", "9.1", "10"],
+    "Selection is a projection at creation on the full static support (review-15 "
+    "C4, review-16): equal-cost parallel links of capacities [3, 2], creation "
+    "residual [0, 2] (another owner holds link 0). A CostOnly EB policy with "
+    "multi_edge false keeps link 1 under PreferHigherPriority with Residual or "
+    "Headroom and link 0 otherwise, for both multipath settings (12 cases).",
+)
+def collapse_projection(s: PSnap):
+    c = Ctx(s, "parallel_3_2", parallel([3, 2]))
+    for mp in (False, True):
+        for tie in (search.DETERMINISTIC, search.PREFER):
+            for prio in search.PRIORITIES:
+                fg = c.ledger()
+                c.manual(fg, 0, 1, [0], 3)
+                sel = search.Selection(
+                    multipath=mp, multi_edge=False, tie_break=tie, priority=prio
+                )
+                pol = P.FlowPolicy(fg, 0, 1, co(EB, sel=sel))
+                s.place(f"mp={mp} {tie} {prio}", pol, 1, fg=fg)
+                want = [1] if tie == search.PREFER and prio != "Capacity" else [0]
+                s.expect(f"mp={mp} {tie} {prio}", c.routes_of(pol), [want])
diff --git a/tests/reference/policy/p2_transaction/policy.py b/tests/reference/policy/p2_transaction/policy.py
new file mode 100644
index 0000000..8e0c8a3
--- /dev/null
+++ b/tests/reference/policy/p2_transaction/policy.py
@@ -0,0 +1,944 @@
+"""The policy engine ``FlowPolicy`` in integer units (APPROACH revision 24, 8 and 9).
+
+One placement engine for the routing modes ``CostOnly`` and ``Global`` (with or without
+a support), the kernels ``MaxFlow``, ``Weighted`` and ``EqualBalanced`` and the admissions
+``Lossless`` and ``Lossy``. The roster is fixed at construction (eligible sources that
+statically reach a destination, ascending NodeId); there is one commit per call. ``Global``
+is a replacement kernel over the whole eligible graph (or exactly over its support) with the
+canonical per-source decomposition. Epochs follow section 8.
+
+Step 2 of the next Core change (contract r8, sections 2.2, 4.1, 5.1, 9.1, 10.2, 14.1,
+14.2; README "Pooled sources and the origin"): ``CostOnly`` pools its sources. Its
+routes are prepared once per epoch on the residual at the first positive call's entry
+and joined into one program (``make_program``); EqualBalanced and Weighted forward the
+equal origin over it (``forward``: one split per router, attribution by highest
+averages); MaxFlow and Global are controllers (``_place_controller``) with the optimized
+origin. The result has the 14.1 shape (``PlacementResult``) and the 14.2 termination.
+
+Step 3 (contract r8, sections 4.1, 5.2, 8, 10.4; README "Programs and Global with a
+support"): ``Pinned`` is gone from the reference (its programs are checked by the library's
+own tests); ``Global(support)`` is the controller restricted to a supplied DAG, trimmed to the
+walks from the sources to the allowed destinations; CostOnly Weighted takes its weights from a
+weight basis (``weights``: capacity, or the residual snapshot at preparation) instead of the
+selection's priority; the change flags of CostOnly and the controllers compare programs (a
+CostOnly program is created at the epoch's first positive call; a controller's program is its
+solve cut into paths, compared path by path, with the optimized origin's supplies).
+
+When T0 was deleted (the contract's section 6; README "T1 replaces CapacityAware"), the per-source
+``CapacityAware`` transaction is gone from the reference with the library's (its tunnel
+form, T1, is checked by the library's own tests).
+
+Readings where the contract is silent are listed in ``NOTES.md`` (P-numbers).
+"""
+
+from __future__ import annotations
+
+import copy
+from dataclasses import dataclass, field
+
+import _p1  # noqa: F401
+import flowcore
+import kernels as K
+import search
+from apportion import highest_averages, round_robin, split
+from graph import Eligibility, check_dag_edges, check_disjoint, check_node_set
+from ledger import Draft, FlowGraph
+from units import (
+    INF,
+    UNREACHABLE,
+    ContractError,
+    check_request,
+)
+
+MF, W_, EB = K.MAX_FLOW, K.WEIGHTED, K.EQUAL_BALANCED
+LOSSLESS, LOSSY = K.LOSSLESS, K.LOSSY
+
+
+# ====================================================================== configuration
+
+
+@dataclass(frozen=True)
+class CostOnly:
+    pass
+
+
+@dataclass(frozen=True)
+class Global:
+    support: tuple[int, ...] | None = None
+
+
+@dataclass(frozen=True)
+class FlowPolicyConfig:
+    """Global takes no placement and no selection (both None); the origin is the model's
+    default (step 2: EQUAL for CostOnly EqualBalanced and Weighted, OPTIMIZED for CostOnly
+    MaxFlow and Global; the equal origin of the controllers is not modelled here)."""
+
+    routing: object
+    placement: str | None
+    admission: str
+    selection: search.Selection | None
+    weights: str | None = (
+        None  # CostOnly Weighted: "Capacity" (None) or "ResidualSnapshot"
+    )
+
+
+@dataclass
+class Outputs:
+    edge_flows: bool = False
+    residual: bool = False
+    bottleneck: bool = False
+    min_cut: bool = False
+
+
+@dataclass
+class PlacementResult:
+    """The result of one call (step 2 shape): this call's values, then the demand's state
+    after it (epoch totals), then the optional outputs."""
+
+    placed: int
+    remaining: int | None
+    termination: str
+    routes_changed: bool
+    weights_changed: bool
+    call_drops: list[tuple[int, int]]
+    call_source_loss: int = 0
+    requested: int | None = 0  # None: +inf
+    offered: int | None = None  # Lossy only
+    admitted: int = 0
+    delivered: int = 0
+    unadmitted: int | None = 0
+    source_loss: int = 0
+    drops: list[tuple[int, int]] = field(default_factory=list)
+    by_source: list[tuple] = field(default_factory=list)
+    total_cost: int | None = None
+    cost_distribution: list[tuple[int, int]] | None = None
+    edge_flows: list[int] | None = None
+    residual: list[int] | None = None
+    bottleneck: list[int] | None = None
+    min_cut: list[int] | None = None
+    trace: dict = field(default_factory=dict)
+
+    def to_json(self) -> dict:
+        out = {
+            "placed": self.placed,
+            "remaining": "inf" if self.remaining is None else self.remaining,
+            "delivery_delta": self.placed,
+            "call_drops": [list(x) for x in self.call_drops],
+            "call_source_loss": self.call_source_loss,
+            "termination": self.termination,
+            "routes_changed": self.routes_changed,
+            "weights_changed": self.weights_changed,
+            "requested": "inf" if self.requested is None else self.requested,
+            "admitted": self.admitted,
+            "delivered": self.delivered,
+            "source_loss": self.source_loss,
+            "drops": [list(x) for x in self.drops],
+            "by_source": [list(x) for x in self.by_source],
+        }
+        for name in ("offered", "unadmitted", "total_cost"):
+            value = getattr(self, name)
+            if value is not None:
+                out[name] = value
+        if self.cost_distribution is not None:
+            out["cost_distribution"] = [list(x) for x in self.cost_distribution]
+        for name in ("edge_flows", "residual", "bottleneck", "min_cut"):
+            value = getattr(self, name)
+            if value is not None:
+                out[name] = list(value)
+        return out
+
+
+def ha(total: int, weights: list[int]) -> list[int]:
+    """Highest averages with zero weights allowed: a zero weight gets nothing, all-zero
+    weights give nothing (step 2: the attribution of pooled traffic to its sources)."""
+    out = [0] * len(weights)
+    pos = [i for i, w in enumerate(weights) if w > 0]
+    if pos and total:
+        for i, x in zip(
+            pos, highest_averages(total, [weights[i] for i in pos]), strict=True
+        ):
+            out[i] = x
+    return out
+
+
+@dataclass
+class Program:
+    """A CostOnly demand's pooled program (step 2, contract r8 5.1): the union of the roster's
+    routes, its members (EqualBalanced: every route edge; Weighted: the edges of positive weight
+    on the walks from a root to a destination), the frozen weights, per node its members in
+    ascending EdgeId and a topological order of every node."""
+
+    kernel: str
+    roots: list[int]
+    dsts: tuple[int, ...]
+    members: tuple[int, ...]
+    weights: dict[int, int] | None
+    out: dict[int, list[int]]
+    topo: list[int]
+
+
+def make_program(g, kernel, roots, dsts, union, basis, view) -> Program:
+    """Weighted weights by the weight basis (contract r8 5.2): the static capacity, or the free
+    capacity `view` at preparation (ResidualSnapshot)."""
+    union = tuple(sorted(union))
+    snapshot = basis == "ResidualSnapshot"
+    if kernel != W_:
+        cand = union
+    elif snapshot:
+        cand = tuple(e for e in union if view[e] >= 1)
+    else:
+        cand = tuple(e for e in union if g.capacity[e] >= 1)
+    members = tuple(sorted({e for r in roots for e in K.prune(g, cand, r, dsts)}))
+    weights = None
+    if kernel == W_:
+        weights = {e: (view[e] if snapshot else g.capacity[e]) for e in members}
+    out: dict[int, list[int]] = {}
+    nodes = set(roots) | set(dsts)
+    for e in members:
+        out.setdefault(g.src[e], []).append(e)
+        nodes.update((g.src[e], g.dst[e]))
+    indeg = dict.fromkeys(nodes, 0)
+    for e in members:
+        indeg[g.dst[e]] += 1
+    topo, ready = [], sorted(v for v in nodes if indeg[v] == 0)
+    while ready:
+        u = ready.pop(0)
+        topo.append(u)
+        for e in out.get(u, ()):
+            indeg[g.dst[e]] -= 1
+            if indeg[g.dst[e]] == 0:
+                ready.append(g.dst[e])
+                ready.sort()
+    assert len(topo) == len(nodes), "the pooled program is cyclic"
+    return Program(kernel, list(roots), tuple(dsts), members, weights, out, topo)
+
+
+def forward(g, prog: Program, inject, W):
+    """One forwarding of a pooled program: inject[i] at roots[i] (None: the first-hop
+    experiment, every root's out-members each injected with exactly their W), each node's
+    inflow (own injection plus carried arrivals) split once by round robin or highest
+    averages; a member's amount attributed to the roots by highest averages over their
+    remaining inflows (member by member), then (W given) the member carries min(arrivals, W[e])
+    attributed by highest averages over the roots' arrivals (contract 5.1, 9.1). Returns per
+    root: offered, source loss, delivered and {edge: carried}, {edge: dropped}; and the totals."""
+    k = len(prog.roots)
+    index = {r: i for i, r in enumerate(prog.roots)}
+    offered, lost, delivered = [0] * k, [0] * k, [0] * k
+    carried = [dict() for _ in range(k)]
+    dropped = [dict() for _ in range(k)]
+    inflow: dict[int, dict[int, int]] = {}
+    own_at: dict[int, int] = {}
+    for i, r in enumerate(prog.roots):
+        if inject is None:
+            if prog.out.get(r):
+                own_at[r] = i
+                offered[i] = sum(W[e] for e in prog.out[r])
+            continue
+        offered[i] = inject[i]
+        if not inject[i]:
+            continue
+        if not prog.out.get(r):
+            lost[i] = inject[i]
+        else:
+            inflow.setdefault(r, {})[i] = inject[i]
+    dset = set(prog.dsts)
+    for u in prog.topo:
+        rem = dict(inflow.get(u, {}))
+        if u in dset:
+            for i, x in rem.items():
+                delivered[i] += x
+            continue
+        own = own_at.get(u)
+        amount = sum(rem.values())
+        if amount == 0 and own is None:
+            continue
+        outs = prog.out.get(u, [])
+        weights = None if prog.weights is None else [prog.weights[e] for e in outs]
+        part = (
+            split("ha" if prog.kernel == W_ else "rr", amount, weights, len(outs))
+            if amount
+            else [0] * len(outs)
+        )
+        order = sorted(set(rem) | ({own} if own is not None else set()))
+        for e, x in zip(outs, part, strict=True):
+            row = ha(x, [rem.get(i, 0) for i in order])
+            for i, y in zip(order, row, strict=True):
+                rem[i] = rem.get(i, 0) - y
+            arrive = [
+                y + (W[e] if i == own else 0) for i, y in zip(order, row, strict=True)
+            ]
+            total = sum(arrive)
+            if total == 0:
+                continue
+            c = total if W is None else min(total, W[e])
+            keep = arrive if c == total else ha(c, arrive)
+            for i, a, kk in zip(order, arrive, keep, strict=True):
+                if kk:
+                    carried[i][e] = carried[i].get(e, 0) + kk
+                    inflow.setdefault(g.dst[e], {})
+                    inflow[g.dst[e]][i] = inflow[g.dst[e]].get(i, 0) + kk
+                if a - kk:
+                    dropped[i][e] = dropped[i].get(e, 0) + a - kk
+        assert all(v == 0 for v in rem.values()), (
+            "a router's inflow is attributed in full"
+        )
+    return offered, lost, delivered, carried, dropped, index
+
+
+# ====================================================================== working flows
+
+
+@dataclass
+class Flow:
+    src: int
+    route: tuple[int, ...]
+    plan: K.Plan
+    cost: int
+    flow_id: tuple[int, int] | None = None
+    T: int = 0
+    alloc: dict[int, int] = field(default_factory=dict)
+    offered: int | None = None
+    delivered: int = 0
+    drops: dict[int, int] = field(default_factory=dict)
+    new: bool = False
+    seq: int = 0
+
+
+def add_view(W: list[int], alloc: dict[int, int]) -> list[int]:
+    out = list(W)
+    for e, x in alloc.items():
+        out[e] += x
+    return out
+
+
+def merge(allocs) -> dict[int, int]:
+    out: dict[int, int] = {}
+    for a in allocs:
+        for e, x in a.items():
+            out[e] = out.get(e, 0) + x
+    return out
+
+
+class FlowPolicy:
+    def __init__(
+        self,
+        fg: FlowGraph,
+        sources,
+        destinations,
+        cfg: FlowPolicyConfig,
+        elig: Eligibility | None = None,
+        cache=None,
+    ) -> None:
+        g = fg.graph
+        self.fg, self.g, self.cfg = fg, g, cfg
+        if cache is not None:
+            raise ContractError("DagCache is not modelled by prototype 2")
+        if elig is not None:
+            elig.check(g)
+        self.elig = elig
+        self.sources = check_node_set(g, sources, "sources")
+        self.destinations = check_node_set(g, destinations, "destinations")
+        check_disjoint(self.sources, self.destinations)
+        self._validate_cfg()
+        self.mode = type(cfg.routing).__name__
+        self.kernel = MF if self.mode == "Global" else cfg.placement
+        self.support = cfg.routing.support if self.mode == "Global" else None
+        self.admission = cfg.admission
+        self.selection = cfg.selection or search.Selection()
+        static = search.member_graph(g, elig, search.Selection())
+        self._static = static
+        node_ok = (lambda v: True) if elig is None else (lambda v: elig.node_allowed[v])
+        self._dests_ok = tuple(d for d in self.destinations if node_ok(d))
+        if self.support is not None:
+            # The support trimmed to the walks from each allowed source to an allowed destination
+            # over its allowed edges; the roster is the sources that reach one inside it.
+            ok = [
+                e
+                for e in check_dag_edges(g, self.support)
+                if elig is None or elig.edge_allowed[e]
+            ]
+            trimmed: set[int] = set()
+            roster = []
+            for s in self.sources:
+                if not node_ok(s):
+                    continue
+                part = K.prune(g, ok, s, self._dests_ok)
+                if part:
+                    roster.append(s)
+                    trimmed.update(part)
+            self.roster = roster
+            self.trimmed = tuple(sorted(trimmed))
+        else:
+            roster = []
+            for s in self.sources:
+                if not node_ok(s):
+                    continue
+                d = search.distances(g, static, [s])
+                if any(d[t] is not None for t in self._dests_ok):
+                    roster.append(s)
+            self.roster = roster
+        self.owner = fg._bind()
+        self._reset_epoch()
+
+    # ------------------------------------------------------------ validation
+
+    def _validate_cfg(self) -> None:
+        cfg = self.cfg
+        r = cfg.routing
+        if not isinstance(r, (CostOnly, Global)):
+            raise ContractError("unknown routing variant")
+        if isinstance(r, Global):
+            # Global takes no placement and no selection; a controller is lossless.
+            if cfg.placement is not None or cfg.selection is not None:
+                raise ContractError("Global takes no placement and no selection")
+            if cfg.admission != LOSSLESS:
+                raise ContractError("MAX_FLOW requires admission=LOSSLESS")
+        else:
+            if cfg.placement is None:
+                raise ContractError("placement is required")
+            sel = cfg.selection or search.Selection()
+            K.check_kernel(cfg.placement, cfg.admission)
+            if cfg.weights is not None and cfg.placement != W_:
+                raise ContractError("weights require CostOnly placement=WEIGHTED")
+            if (
+                len(self.sources) > 1
+                and not sel.multipath
+                and sel.tie_break == search.PREFER
+            ):
+                raise ContractError("the pooled single-path rule (Q12)")
+
+    # ------------------------------------------------------------ state
+
+    def _reset_epoch(self) -> None:
+        self.cohorts: dict[int, list[Flow]] = {}
+        self.requested = 0
+        self.offered = 0
+        self.infinite = False
+        self.epoch_started = False
+        self.prepared = False
+        self.program: Program | None = None
+        self.union: tuple[int, ...] = ()
+        self.curve: list[tuple[int, int]] = []
+        # A controller's program (10.4): its paths (source, walk) and its weights (the paths'
+        # amounts, the optimized origin's supplies); None before the first solve.
+        self.paths: tuple | None = None
+
+    def placed_demand(self) -> int:
+        return sum(f.delivered for c in self.cohorts.values() for f in c)
+
+    def records(self):
+        return [r for r in self.fg.records() if r.owner == self.owner]
+
+    def record(self, flow_id):
+        return self.fg.record(flow_id)
+
+    def flow_ids(self) -> list[tuple[int, int]]:
+        return sorted(f.flow_id for c in self.cohorts.values() for f in c)
+
+    def state(self) -> dict:
+        pos = self.g.input_index()
+        return {
+            "mode": self.mode,
+            "roster": list(self.roster),
+            "requested": self.requested,
+            "infinite": self.infinite,
+            "placed_demand": self.placed_demand(),
+            "cohorts": {
+                s: [
+                    {
+                        "flow_id": None if f.flow_id is None else list(f.flow_id),
+                        "route": list(f.route),
+                        "route_input": sorted(pos[e] for e in f.route),
+                        "T": f.T,
+                        "delivered": f.delivered,
+                        "alloc": sorted(f.alloc.items()),
+                        "plan": f.plan.to_json(),
+                    }
+                    for f in c
+                ]
+                for s, c in sorted(self.cohorts.items())
+            },
+        }
+
+    def remove(self) -> None:
+        """Detach every flow (allocations reverted, ids retired), new epoch."""
+        self.fg._detach(self.owner)
+        self._reset_epoch()
+
+    def destroy(self) -> None:
+        self.fg._orphan(self.owner)
+
+    # ------------------------------------------------------------ routes
+
+    def _route_cost(self, route, src) -> int:
+        c = K.route_cost(self.g, route, src, self._dests_ok)
+        return UNREACHABLE if c is None else c
+
+    def _cost_only_route(self, src, W) -> tuple[int, ...]:
+        """Static support restricted to the source, selection projected on W."""
+        g, sel = self.g, self.selection
+        _, support = search.tight_dag(g, self._static, [src], self._dests_ok)
+        members = support
+        if not sel.multi_edge:
+            members = search.collapse(g, support, sel, W)
+        if sel.multipath:
+            _, dag = search.tight_dag(g, members, [src], self._dests_ok)
+            return tuple(dag)
+        prio = (
+            search.priority_fn(g, sel.priority, W)
+            if sel.tie_break == search.PREFER
+            else None
+        )
+        p = search.canonical_path(g, members, [src], self._dests_ok, prio)
+        return tuple() if p is None else tuple(sorted(p.edges))
+
+    # ------------------------------------------------------------ place
+
+    def place(self, volume, outputs: Outputs | None = None) -> PlacementResult:
+        req = check_request(volume)
+        if self.infinite and req is not None:
+            # validation precedes the zero shortcut (revision 20, section 8)
+            raise ContractError("a finite request after +inf is rejected (rule 13)")
+        if req is not None and self.requested + req >= 1 << 127:
+            raise ContractError("cumulative request counter overflow")
+        outputs = outputs or Outputs()
+        controller = self.mode == "Global" or (
+            self.mode == "CostOnly" and self.kernel == MF
+        )
+        if req == 0:
+            # The current state, every flag false; before the epoch's first positive call it is
+            # all zeros (contract r8 10.3). Global reports its curve once prepared.
+            r = PlacementResult(0, 0, "complete", False, False, [])
+            if self._dense_global() and self.prepared:
+                r.cost_distribution = list(self.curve)
+            return self._finish(r, outputs, None, controller)
+        if not self.roster:
+            # the epoch's finite-or-infinite state and `requested` record every positive
+            # request, also one that finds no roster (section 8); a Lossy offer is lost before
+            # it enters (the demand's source loss; every source's row stays zero)
+            if req is None:
+                self.infinite = True
+            else:
+                self.requested += req
+                if self.admission == LOSSY:
+                    self.offered += req
+            self.prepared = True
+            r = PlacementResult(
+                0,
+                req,
+                "no_route",
+                False,
+                False,
+                [],
+                call_source_loss=req
+                if self.admission == LOSSY and req is not None
+                else 0,
+                trace={"roster": []},
+            )
+            if self._dense_global():
+                r.cost_distribution = []
+                if outputs.min_cut:
+                    r.min_cut = []
+            return self._finish(r, outputs, None, controller)
+        if controller:
+            return self._place_controller(req, outputs)
+        return self._place_pooled(req, outputs)
+
+    def _finish(
+        self, result: PlacementResult, outputs: Outputs, sol, controller=False
+    ) -> PlacementResult:
+        """The demand's state after the call (contract r8 14.1) from the committed records,
+        then the optional outputs."""
+        lossy = self.admission == LOSSY
+        recs = self.records()
+        result.requested = None if self.infinite else self.requested
+        result.delivered = sum(r.delivered for r in recs)
+        rows = []
+        for s in self.sources:
+            mine = [r for r in recs if r.sources[0] == s]
+            delivered = sum(r.delivered for r in mine)
+            if lossy:
+                off = sum(r.offered or 0 for r in mine)
+                dropped = sum(x for r in mine for x in r.drops.values())
+                rows.append(
+                    (s, off, off, delivered, off - delivered - dropped, dropped)
+                )
+            else:
+                rows.append((s, None, delivered, delivered, 0, 0))
+        result.by_source = rows
+        if lossy:
+            drops: dict[int, int] = {}
+            for r in recs:
+                for e, x in r.drops.items():
+                    drops[e] = drops.get(e, 0) + x
+            result.drops = sorted((e, x) for e, x in drops.items() if x)
+            result.offered = self.offered
+            result.admitted = self.offered
+            result.unadmitted = 0
+            result.source_loss = self.offered - result.delivered - sum(drops.values())
+        else:
+            result.admitted = result.delivered
+            result.unadmitted = (
+                None if self.infinite else self.requested - result.delivered
+            )
+        if controller:
+            result.total_cost = sum(
+                self.g.cost[e] * x for r in recs for e, x in r.edges.items()
+            )
+        if outputs.edge_flows:
+            alloc = [0] * self.g.num_edges
+            for r in recs:
+                for e, x in r.edges.items():
+                    alloc[e] += x
+            result.edge_flows = alloc
+        if outputs.residual:
+            result.residual = self.fg.residual()
+        if outputs.bottleneck:
+            result.bottleneck = self.fg.bottleneck(self.sources, self.elig)
+        if outputs.min_cut and self._dense_global() and sol is not None:
+            result.min_cut = sol.min_cut
+        return result
+
+    def _dense_global(self) -> bool:
+        """Global over every eligible edge (no support): the curve and the cut."""
+        return self.mode == "Global" and self.support is None
+
+    # ------------------------------------------------------------ CostOnly (step 2)
+
+    def _prepare(self, W):
+        """The epoch's routes of a CostOnly demand on the residual at the first positive call's
+        entry: per roster source its route (record bundle, route cost), their union, and one
+        continuation per router (contract r8 5.1)."""
+        routes = {s: self._cost_only_route(s, W) for s in self.roster}
+        union = tuple(sorted({e for r in routes.values() for e in r}))
+        for r in routes.values():
+            for e in r:
+                u = self.g.src[e]
+                assert sorted(x for x in r if self.g.src[x] == u) == sorted(
+                    x for x in union if self.g.src[x] == u
+                ), "two roster sources continue differently at a router"
+        return routes, union
+
+    def _source_flow(self, s, route, prev) -> Flow:
+        plan = K.Plan(
+            self.kernel, self.admission, s, self._dests_ok, route, route, None
+        )
+        return Flow(
+            src=s,
+            route=route,
+            plan=plan,
+            cost=self._route_cost(route, s),
+            flow_id=None if prev is None else prev.flow_id,
+            offered=0 if self.admission == LOSSY else None,
+            new=prev is None,
+            seq=self.roster.index(s),
+        )
+
+    def _place_pooled(self, req, outputs) -> PlacementResult:
+        g, fg = self.g, self.fg
+        W = fg.residual()
+        created = not self.cohorts
+        trace: dict = {"prepare": None}
+        if created:
+            routes, union = self._prepare(W)
+            prog = make_program(
+                g,
+                self.kernel,
+                self.roster,
+                self._dests_ok,
+                union,
+                self.cfg.weights or "Capacity",
+                W,
+            )
+            flows = {s: self._source_flow(s, routes[s], None) for s in self.roster}
+            trace["prepare"] = {s: list(routes[s]) for s in self.roster}
+        else:
+            prog = self.program
+            flows = {s: c[0] for s, c in copy.deepcopy(self.cohorts).items()}
+        k = len(self.roster)
+        if self.admission == LOSSLESS:
+            admitted = sum(f.delivered for f in flows.values())
+            own = merge(f.alloc for f in flows.values())
+            V = add_view(W, own)
+            # the largest total in [admitted, admitted + req] whose no-drop forwarding of the
+            # round-robin shares fits V and gives no root without a member a share
+            bound = 0
+            for i, r in enumerate(self.roster):
+                if not prog.out.get(r):
+                    bound = min(bound, i)
+                    break
+                bound += sum(V[e] for e in prog.out[r])
+            hi = bound if req is None else min(admitted + req, bound)
+
+            def fits(t):
+                inj = round_robin(t, k)
+                if any(
+                    x and not prog.out.get(r)
+                    for r, x in zip(self.roster, inj, strict=True)
+                ):
+                    return False
+                _, _, _, carried, _, _ = forward(g, prog, inj, None)
+                return all(x <= V[e] for e, x in merge(carried).items())
+
+            lo = admitted
+            if hi > lo and fits(hi):
+                lo = hi
+            else:
+                while hi - lo > 1:
+                    mid = (lo + hi) // 2
+                    if fits(mid):
+                        lo = mid
+                    else:
+                        hi = mid
+            _, _, delivered, carried, _, _ = forward(g, prog, round_robin(lo, k), None)
+            for i, s in enumerate(self.roster):
+                flows[s].alloc = dict(carried[i])
+                flows[s].T = flows[s].delivered = delivered[i]
+            placed = lo - admitted
+            call_drops, source_loss = [], 0
+            trace["T"] = [admitted, lo]
+        else:
+            if req is None:
+                inj = None
+            else:
+                old = round_robin(self.offered, k)
+                new = round_robin(self.offered + req, k)
+                inj = [b - a for a, b in zip(old, new, strict=True)]
+            offered, lost, delivered, carried, dropped, _ = forward(g, prog, inj, W)
+            for i, s in enumerate(self.roster):
+                f = flows[s]
+                for e, x in carried[i].items():
+                    f.alloc[e] = f.alloc.get(e, 0) + x
+                for e, x in dropped[i].items():
+                    f.drops[e] = f.drops.get(e, 0) + x
+                f.offered = (f.offered or 0) + offered[i]
+                f.delivered += delivered[i]
+            placed = sum(delivered)
+            call_drops = sorted(merge(dropped).items())
+            source_loss = sum(lost)
+            self.offered += sum(offered)
+            trace["offers"] = {
+                s: "inf" if inj is None else inj[i] for i, s in enumerate(self.roster)
+            }
+        cohorts = {s: [f] for s, f in flows.items()}
+        drafts, order = self._drafts(cohorts)
+        new_ids = fg._commit(self.owner, drafts)
+        self._assign_ids(order, new_ids)
+        self.cohorts = cohorts
+        self.program = prog
+        self.prepared = True
+        if req is None:
+            self.infinite = True
+        else:
+            self.requested += req
+        if not prog.members:
+            term = "no_active_weight"
+        elif self.admission == LOSSY:
+            term = "complete" if req is not None else "exhausted"
+        else:
+            term = "complete" if req is not None and placed == req else "exhausted"
+        # The flags compare programs (10.4): the epoch's first call creates one (its routes and
+        # its weights); an increment changes neither.
+        result = PlacementResult(
+            placed,
+            None if req is None else req - placed,
+            term,
+            created,
+            created,
+            call_drops,
+            call_source_loss=source_loss,
+            trace=trace,
+        )
+        return self._finish(result, outputs, None)
+
+    # ------------------------------------------------------------ the controllers
+
+    def _place_controller(self, req, outputs) -> PlacementResult:
+        """Global over every eligible edge, CostOnly MaxFlow over the union of the roster's
+        routes: a minimum-cost flow of the cumulative value from one virtual source (the
+        optimized origin)."""
+        g, fg = self.g, self.fg
+        W = fg.residual()
+        old = self.cohorts
+        created = not old
+        glob = self.mode == "Global"
+        dense = self._dense_global()
+        trace: dict = {}
+        if glob:
+            routes, union = None, self.trimmed if not dense else None
+        elif created:
+            routes, union = self._prepare(W)
+            trace["prepare"] = {s: list(routes[s]) for s in self.roster}
+        else:
+            routes, union = None, self.union
+            trace["prepare"] = None
+        own = merge(f.alloc for c in old.values() for f in c)
+        V = add_view(W, own)
+        P = self.placed_demand()
+        cap = None if req is None else P + req
+        if dense:
+            sol = flowcore.solve(g, V, self.roster, self._dests_ok, cap, elig=self.elig)
+        else:
+            sol = flowcore.solve(g, V, self.roster, self._dests_ok, cap, edges=union)
+        assert sol.placed >= P, "a controller call never reduces placed_demand()"
+        shares, paths = self._decompose(sol)
+        new_cohorts: dict[int, list[Flow]] = {}
+        for s in self.roster:
+            alloc = shares[s]
+            prev = old.get(s, [None])[0]
+            if glob:
+                route = tuple(sorted(alloc))
+                plan = K.Plan(MF, LOSSLESS, s, self._dests_ok, route, route, None)
+                f = Flow(
+                    src=s,
+                    route=route,
+                    plan=plan,
+                    cost=self._route_cost(route, s),
+                    flow_id=None if prev is None else prev.flow_id,
+                    new=prev is None,
+                    seq=self.roster.index(s),
+                )
+            else:
+                f = (
+                    copy.deepcopy(prev)
+                    if prev is not None
+                    else self._source_flow(s, routes[s], None)
+                )
+            f.T = f.delivered = sol.supply.get(s, 0)
+            f.alloc = alloc
+            new_cohorts[s] = [f]
+        placed = sol.placed - P
+        drafts, order = self._drafts(new_cohorts)
+        new_ids = fg._commit(self.owner, drafts)
+        self._assign_ids(order, new_ids)
+        self.cohorts = new_cohorts
+        # The program (10.4): the paths in decomposition order with their amounts, and the
+        # optimized origin's supplies (every roster source, zero included). No program and a
+        # program without a path are equal.
+        program = (
+            tuple((s, walk) for s, walk, _ in paths),
+            (
+                tuple(x for _, _, x in paths),
+                tuple(sol.supply.get(s, 0) for s in self.roster),
+            ),
+        )
+        before = self.paths or ((), None)
+        if not before[0] and not program[0]:
+            routes_changed = weights_changed = False
+        else:
+            routes_changed = before[0] != program[0]
+            weights_changed = before[1] != program[1]
+        self.paths = program
+        if not glob and created:
+            self.union = union
+        self.prepared = True
+        if req is None:
+            self.infinite = True
+        else:
+            self.requested += req
+        term = "complete" if req is not None and placed == req else "exhausted"
+        if dense:
+            trace.update(
+                {
+                    "V": V,
+                    "cap": cap,
+                    "flow_core": {**sol.payload(), "supply": sol.supply},
+                    "shares": {s: sorted(a.items()) for s, a in shares.items()},
+                }
+            )
+            self.curve = list(sol.cost_distribution)
+        else:
+            trace.update(
+                {
+                    "cap": cap,
+                    "flow_core": {
+                        "placed": sol.placed,
+                        "edge_flows": list(sol.edge_flows),
+                        "supply": sol.supply,
+                    },
+                    "shares": {s: sorted(a.items()) for s, a in shares.items()},
+                }
+            )
+        result = PlacementResult(
+            placed,
+            None if req is None else req - placed,
+            term,
+            routes_changed,
+            weights_changed,
+            [],
+            cost_distribution=list(sol.cost_distribution) if dense else None,
+            trace=trace,
+        )
+        return self._finish(result, outputs, sol, True)
+
+    def _decompose(self, sol):
+        """Canonical per-source decomposition (9.1, contract r8 4.1): sources ascending; the
+        smallest EdgeId walk with positive remaining flow to the first destination reached,
+        saturated by min(walk bottleneck, remaining virtual supply). Returns the per-source shares
+        and the paths (source, walk, amount) in that order."""
+        g = self.g
+        remaining = dict(enumerate(sol.edge_flows))
+        dests = set(self._dests_ok)
+        out: dict[int, dict[int, int]] = {}
+        paths: list[tuple[int, tuple[int, ...], int]] = []
+        for s in self.roster:
+            mine: dict[int, int] = {}
+            left = sol.supply.get(s, 0)
+            while left > 0:
+                u, walk = s, []
+                while not (walk and u in dests):
+                    cands = [e for e in g.out_ids(u) if remaining.get(e, 0) > 0]
+                    assert cands, "flow conservation guarantees a continuation"
+                    e = min(cands)
+                    walk.append(e)
+                    u = g.dst[e]
+                    assert len(walk) <= g.num_nodes, "acyclic support"
+                amount = min(min(remaining[e] for e in walk), left)
+                for e in walk:
+                    remaining[e] -= amount
+                    mine[e] = mine.get(e, 0) + amount
+                left -= amount
+                paths.append((s, tuple(walk), amount))
+            out[s] = mine
+        assert all(x == 0 for x in remaining.values()), "decomposition covers the flow"
+        return out, paths
+
+    # ------------------------------------------------------------ commit
+
+    def _drafts(self, cohorts) -> tuple[list[Draft], list[Flow]]:
+        drafts: list[Draft] = []
+        order: list[Flow] = []
+        flows = [f for s in sorted(cohorts) for f in cohorts[s]]
+        old = [f for f in flows if not f.new]
+        new = sorted(
+            (f for f in flows if f.new),
+            key=lambda f: (f.seq if self.mode != "Global" else f.src),
+        )
+        for f in old + new:
+            drafts.append(
+                Draft(
+                    flow_id=None if f.new else f.flow_id,
+                    sources=(f.src,),
+                    destinations=self._dests_ok,
+                    admission=self.admission,
+                    bundle=f.route,
+                    route_cost=f.cost,
+                    offered=f.offered if self.admission == LOSSY else None,
+                    delivered=f.delivered,
+                    edges=dict(f.alloc),
+                    drops=dict(f.drops),
+                )
+            )
+            order.append(f)
+        return drafts, [f for f in order if f.new]
+
+    def _assign_ids(self, new_flows: list[Flow], new_ids) -> None:
+        for f, fid in zip(new_flows, new_ids, strict=True):
+            f.flow_id = fid
+            f.new = False
+
+
+def capacity(g, sources, destinations, cfg, elig=None, outputs=None) -> PlacementResult:
+    """``capacity`` = ``place(+inf)`` on a fresh ledger (section 11)."""
+    fg = FlowGraph(g)
+    return FlowPolicy(fg, sources, destinations, cfg, elig).place(INF, outputs)
diff --git a/tests/reference/policy/p2_transaction/recorder.py b/tests/reference/policy/p2_transaction/recorder.py
new file mode 100644
index 0000000..a9c20c8
--- /dev/null
+++ b/tests/reference/policy/p2_transaction/recorder.py
@@ -0,0 +1,31 @@
+"""Snapshot recording for prototype 2 (prototype 1's ``Snap`` plus policy state)."""
+
+from __future__ import annotations
+
+import _p1  # noqa: F401
+from snap import Snap, jsonable
+from units import ContractError
+
+
+class PSnap(Snap):
+    def place(self, label: str, policy, volume, fg=None, outputs=None):
+        entry: dict = {"op": "place", "policy": label, "request": jsonable(volume)}
+        try:
+            r = (
+                policy.place(volume)
+                if outputs is None
+                else policy.place(volume, outputs)
+            )
+        except ContractError as exc:
+            entry["error"] = f"{type(exc).__name__}: {exc}"
+            self.data["steps"].append(entry)
+            return exc
+        entry["result"] = jsonable(r.to_json())
+        entry["trace"] = jsonable(r.trace)
+        fg = fg if fg is not None else policy.fg
+        entry["graph"] = self.labels.get(fg.graph.uid)
+        entry["state"] = jsonable(fg.state())
+        if hasattr(policy, "state"):
+            entry["policy_state"] = jsonable(policy.state())
+        self.data["steps"].append(entry)
+        return r
diff --git a/tests/reference/policy/p2_transaction/run_fixtures.py b/tests/reference/policy/p2_transaction/run_fixtures.py
new file mode 100644
index 0000000..33dcd87
--- /dev/null
+++ b/tests/reference/policy/p2_transaction/run_fixtures.py
@@ -0,0 +1,62 @@
+"""Run every prototype-2 fixture and write ``snapshots/<fixture>.json``.
+
+Usage: ``venv/bin/python run_fixtures.py [fixture ...]``; exit status 1 on any
+failed expectation.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import time
+from pathlib import Path
+
+import _p1  # noqa: F401
+from fixtures import FIXTURE_MAP, FIXTURES
+from recorder import PSnap
+
+HERE = Path(__file__).resolve().parent
+
+
+def run_one(fx) -> dict:
+    s = PSnap(fx.name, fx.family, fx.description, fx.rules)
+    fx.run(s)
+    data = s.finish()
+    old = [k for k, v in FIXTURE_MAP.items() if v == fx.name]
+    data["regenerates"] = old
+    return data
+
+
+def main(argv: list[str]) -> int:
+    only = set(argv[1:])
+    out = HERE / "snapshots"
+    out.mkdir(exist_ok=True)
+    failed, steps, checks = [], 0, 0
+    t0 = time.perf_counter()
+    names = {fx.name for fx in FIXTURES}
+    missing = sorted(v for v in FIXTURE_MAP.values() if v not in names)
+    assert not missing, missing
+    for fx in FIXTURES:
+        if only and fx.name not in only:
+            continue
+        data = run_one(fx)
+        (out / f"{fx.name}.json").write_text(json.dumps(data, indent=1) + "\n")
+        steps += data["counts"]["steps"]
+        checks += data["counts"]["checks"]
+        print(
+            f"{'ok  ' if data['passed'] else 'FAIL'} {fx.name} ({data['counts']['checks']} checks)"
+        )
+        for f in data["failures"]:
+            print(f"     {f}")
+        if not data["passed"]:
+            failed.append(fx.name)
+    n = len(only) if only else len(FIXTURES)
+    print(
+        f"{n - len(failed)}/{n} fixtures pass ({len(FIXTURE_MAP)} regenerated from the "
+        f"grid set), {steps} operations, {checks} checks, {time.perf_counter() - t0:.1f} s"
+    )
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/tests/typing/invalid_client.py b/tests/typing/invalid_client.py
new file mode 100644
index 0000000..3f92dac
--- /dev/null
+++ b/tests/typing/invalid_client.py
@@ -0,0 +1,140 @@
+"""A deliberately invalid client: every marked line must get exactly its expected diagnostic.
+
+dev/stubs/run.sh type-checks it with Pyright against an installed wheel and an installation
+built from the sdist. Each line ending in "# expect: RULE[, RULE...]" must produce one
+diagnostic of each listed Pyright rule, and no other line may produce any. It is never run:
+each marked line is a mistake the compiled module rejects at run time (or, for the Optional
+and dtype lines, a mistake in the caller's own code) that a type checker must catch before.
+"""
+
+import typing
+from decimal import Decimal
+from fractions import Fraction
+
+import numpy as np
+import numpy.typing as npt
+
+import netgraph_core as ng
+
+g = ng.Graph(2, [0], [1], [10], [1], 1.0)
+opt = ng.SourceAllocation.OPTIMIZED
+cfg = ng.FlowPolicyConfig(routing=ng.CentralizedTE(source_allocation=opt))
+
+# The twelve result and factory classes have no constructor ("No constructor defined!").
+ng.Eligibility()  # expect: reportCallIssue
+ng.PredecessorDAG()  # expect: reportCallIssue
+ng.FlowRecord()  # expect: reportCallIssue
+ng.PlacementResult()  # expect: reportCallIssue
+ng.SourceFlow()  # expect: reportCallIssue
+ng.ShortestPathCacheStats()  # expect: reportCallIssue
+ng.SensitivityEntry()  # expect: reportCallIssue
+ng.SensitivityResult()  # expect: reportCallIssue
+ng.SpfResult()  # expect: reportCallIssue
+ng.ForwardingProgram()  # expect: reportCallIssue
+ng.Tunnel()  # expect: reportCallIssue
+ng.TunnelFlow()  # expect: reportCallIssue
+
+# dtype mistakes: the capacities are an int64 array of ints. (NumPy's own stubs type an element
+# read arr[i] as Any, so "text: str = g.edge_capacity_units()[0]" cannot be caught by any stub; an
+# element read through .item() and the array itself carry the dtype.)
+# fmt: off
+floats: npt.NDArray[np.float64] = g.edge_capacity_units()  # expect: reportAssignmentType
+# fmt: on
+text: str = g.edge_capacity_units().item(0)  # expect: reportAssignmentType
+
+# Wrong argument types (the module raises ValueError or TypeError).
+ng.Graph("wrong", [0], [1], [10], [1], 1.0)  # expect: reportArgumentType
+ng.Graph(2, [0], [1], [1.5], [1], 1.0)  # expect: reportArgumentType
+# fmt: off
+ng.FlowLedger(g, service_baseline=np.zeros(1, dtype=np.float64))  # expect: reportArgumentType
+# fmt: on
+ng.spf(g, 0, ng.KspOptions(1))  # expect: reportArgumentType
+ng.SpfOptions(ng.Direction.FORWARD, multipath=None)  # expect: reportArgumentType
+ng.CostStretch("1.2")  # expect: reportArgumentType
+ng.evaluate_demand(g, 0, 1, cfg)  # expect: reportArgumentType
+ng.EvaluationOptions(cfg, offer="4")  # expect: reportArgumentType
+guard = ng.TunnelCount(2)
+ng.DistributedTE(guard, cost_ceiling=guard)  # expect: reportArgumentType
+ng.CentralizedTE(source_allocation=opt, tunnel_count=2)  # expect: reportArgumentType
+# fmt: off
+ng.CentralizedTE(source_allocation=opt, prefer_headroom="yes")  # expect: reportArgumentType
+# fmt: on
+# CentralizedTE names its source allocation; the allocations and weights are the models' fields.
+ng.CentralizedTE()  # expect: reportCallIssue
+sp = ng.ShortestPaths()
+ng.FlowPolicyConfig(routing=sp, placement=None)  # expect: reportCallIssue
+ng.ShortestPaths(allocation="EQUAL")  # expect: reportArgumentType
+ng.to_units("1.5", 1.0)  # expect: reportCallIssue, reportArgumentType
+# FlowPolicyConfig takes keywords only.
+ng.FlowPolicyConfig(ng.CentralizedTE(source_allocation=opt))  # expect: reportCallIssue
+dag = ng.Path(g, [[0]]).to_dag()
+ng.Pinned([dag])  # expect: reportArgumentType
+# Integer arrays serve as hops and pairs; float arrays do not.
+ng.Path(g, np.zeros((1, 1), dtype=np.float64))  # expect: reportArgumentType
+float_pairs = np.zeros((1, 2), dtype=np.float64)
+# fmt: off
+ng.evaluate_pairs(g, float_pairs, ng.EvaluationOptions(cfg))  # expect: reportArgumentType
+# fmt: on
+
+# Missing Optional checks: these results may be None.
+result = ng.spf(g, 0, ng.SpfOptions(ng.Direction.FORWARD, targets=1))
+cost: int = result.target_cost  # expect: reportAssignmentType
+first = result.costs[0]  # expect: reportOptionalSubscript
+flows = ng.evaluate_demand(g, 0, 1, ng.EvaluationOptions(cfg)).edge_flows
+total = flows.sum()  # expect: reportOptionalMemberAccess
+best = ng.evaluate_demand(g, 0, 1, ng.EvaluationOptions(cfg))
+cost_total: int = best.total_cost  # expect: reportAssignmentType
+weights = best.program.source_weights  # expect: reportOptionalMemberAccess
+
+# A list takes actions, its mode by keyword only, and an action takes a number.
+lister = ng.FlowLedger(g)
+listed_policy = ng.FlowPolicy(lister, 0, 1, cfg)
+ng.apply_actions(lister, [listed_policy])  # expect: reportArgumentType
+ng.apply_actions(lister, [], ng.BatchMode.ORDERED)  # expect: reportCallIssue
+ng.Replace(listed_policy, "1")  # expect: reportArgumentType
+
+
+class PolicySubclass(ng.FlowPolicy):  # expect: reportGeneralTypeIssues
+    pass
+
+
+# Unknown ndarray rank cannot promise an array, and a general index protocol may be a sequence.
+a0 = np.array(1.5)
+c: npt.NDArray[np.int64] = ng.to_units(a0, 0.5)  # expect: reportAssignmentType
+
+
+def require_float(x: typing.SupportsIndex) -> float:
+    return ng.as_float(x, 0.5)  # expect: reportReturnType
+
+
+ng.to_units(1.5, Fraction(1, 2))  # expect: reportCallIssue, reportArgumentType
+ng.as_float(3, Fraction(1, 2))  # expect: reportCallIssue, reportArgumentType
+
+
+class IndexResolution:
+    def __index__(self) -> int:
+        return 1
+
+
+class FloatResolution:
+    def __float__(self) -> float:
+        return 1.0
+
+
+ng.Graph(2, [0], [1], [10], [1], Fraction(1))  # expect: reportArgumentType
+ng.Graph(2, [0], [1], [10], [1], Decimal(1))  # expect: reportArgumentType
+ng.Graph(2, [0], [1], [10], [1], IndexResolution())  # expect: reportArgumentType
+ng.Graph(2, [0], [1], [10], [1], FloatResolution())  # expect: reportArgumentType
+
+
+class BothResolution(IndexResolution, FloatResolution):
+    pass
+
+
+ng.Graph(2, [0], [1], [10], [1], BothResolution())  # expect: reportArgumentType
+ng.Graph(2, [0], [1], [10], [1], np.array(1.0))  # expect: reportArgumentType
+
+ng.CentralizedTE(
+    source_allocation=ng.SourceAllocation.WEIGHTED,
+    source_weights=[1.5],  # expect: reportArgumentType
+)
diff --git a/tests/typing/valid_client.py b/tests/typing/valid_client.py
new file mode 100644
index 0000000..b7fbf32
--- /dev/null
+++ b/tests/typing/valid_client.py
@@ -0,0 +1,340 @@
+"""A valid client of the installed package: no type checker diagnostic, and it runs.
+
+dev/stubs/run.sh type-checks it with Pyright against an installed wheel and an installation
+built from the sdist (zero diagnostics expected), then runs it. assert_type pins the declared
+types of the generated stub: a wrong dtype, a lost Optional or a widened result fails here.
+"""
+
+from fractions import Fraction
+from typing import SupportsIndex, assert_type
+
+import numpy as np
+import numpy.typing as npt
+
+import netgraph_core as ng
+
+# The graph: integers as lists, tuples or NumPy arrays of any integer dtype.
+g = ng.Graph(
+    4,
+    np.array([0, 0, 1, 2], dtype=np.int32),
+    (1, 2, 3, 3),
+    [10, 5, ng.to_units(2.5, 1.0), 4],
+    np.array([1, 2, 1, 1], dtype=np.uint8),
+    1.0,
+)
+assert_type(g.edge_capacity_units(), npt.NDArray[np.int64])
+assert_type(g.edge_costs(), npt.NDArray[np.int64])
+assert_type(g.edge_sources(), npt.NDArray[np.int32])
+assert_type(g.outgoing_offsets(), npt.NDArray[np.int32])
+assert_type(g.num_edges(), int)
+first_capacity: int = int(g.edge_capacity_units()[0])
+
+eligibility = g.eligibility(excluded_nodes=[np.int64(2)])
+assert_type(eligibility.edge_allowed(), npt.NDArray[np.bool_])
+both = ng.Eligibility.intersect(eligibility, g.eligibility())
+assert_type(both, ng.Eligibility)
+
+# Graph resolutions take concrete Python and NumPy number scalars.
+for resolution in (1, 1.0, np.int32(1), np.uint64(1), np.float32(1), np.float64(1)):
+    numeric_graph = ng.Graph(2, [0], [1], [10], [1], resolution)
+    assert_type(numeric_graph.resolution(), float)
+    assert numeric_graph.resolution() == 1.0
+
+# Units: scalars and Python sequences have known shapes; ndarray rank needs narrowing.
+assert_type(ng.to_units(1.5, 0.5), int)
+assert_type(ng.to_units(np.float32(0.1), np.int64(1)), int)
+assert_type(ng.to_units(3, np.float32(0.5)), int)
+assert_type(ng.to_units([1.5, 2.0], 0.5), npt.NDArray[np.int64])
+assert_type(ng.to_units((np.int64(3), np.float32(2)), 0.5), npt.NDArray[np.int64])
+assert_type(ng.to_units(np.array(1.5), 0.5), int | npt.NDArray[np.int64])
+assert_type(ng.to_units(np.array([1.5, 2.0]), 0.5), int | npt.NDArray[np.int64])
+converted = ng.to_units(np.array([1.5, 2.0]), 0.5)
+if isinstance(converted, np.ndarray):
+    assert_type(converted, npt.NDArray[np.int64])
+    assert converted.tolist() == [3, 4]
+assert type(ng.to_units(np.array(1.5), 0.5)) is int
+assert_type(ng.as_float(3, 0.5), float)
+assert_type(ng.as_float(np.int64(3), 0.5), float)
+assert_type(ng.as_float([3, 4], 0.5), npt.NDArray[np.float64])
+assert_type(ng.as_float(np.array([3, 4]), 0.5), npt.NDArray[np.float64])
+
+
+class IndexValue:
+    def __index__(self) -> int:
+        return 3
+
+
+def physical_index(x: SupportsIndex) -> float | npt.NDArray[np.float64]:
+    assert_type(ng.as_float(x, 0.5), float | npt.NDArray[np.float64])
+    return ng.as_float(x, 0.5)
+
+
+assert physical_index(IndexValue()) == 1.5
+
+
+# A structural integer protocol may also be a sequence. Sequence classification wins at runtime.
+class IndexSequence(list[int]):
+    def __index__(self) -> int:
+        return 3
+
+
+assert_type(ng.as_float(IndexSequence([3, 4]), 0.5), npt.NDArray[np.float64])
+assert isinstance(physical_index(IndexSequence([3, 4])), np.ndarray)
+
+
+# Integer subclasses keep the scalar overload even when they expose sequence methods.
+class IntegerSequence(int):
+    def __len__(self) -> int:
+        return 2
+
+    def __getitem__(self, index: int) -> int:
+        if index in (0, 1):
+            return (3, 4)[index]
+        raise IndexError(index)
+
+
+scalar_from_integer = ng.as_float(IntegerSequence(7), 0.5)
+assert_type(scalar_from_integer, float)
+assert type(scalar_from_integer) is float
+assert scalar_from_integer == 3.5
+assert scalar_from_integer.hex() == (3.5).hex()
+
+# The search: optional results are checked before use.
+full = ng.spf(
+    g, 0, ng.SpfOptions(ng.Direction.FORWARD, tie_break=ng.RouteTieBreak.FEWER_HOPS)
+)
+costs = full.costs
+assert_type(costs, npt.NDArray[np.int64] | None)
+if costs is not None:
+    reached = int(costs[3])
+near = ng.spf(
+    g,
+    [0],
+    ng.SpfOptions(
+        ng.Direction.FORWARD, targets=3, multipath=False, eligibility=eligibility
+    ),
+)
+cost = near.target_cost
+if cost is not None:
+    assert_type(cost, int)
+dag = near.dag
+assert_type(dag.parents(), npt.NDArray[np.int32])
+paths = ng.resolve_to_paths(g, full.dag, 0, 3, max_paths=None)
+assert_type(paths, list[ng.Path])
+for c, p in ng.ksp(
+    g, 0, 3, ng.KspOptions(2, parallel_edges=False, cost_ceiling=ng.AbsoluteCost(9))
+):
+    assert_type(c, int)
+    hops: list[list[int]] = p.hops()
+same = ng.PredecessorDAG.from_csr(
+    g, dag.parent_offsets(), dag.parents(), np.asarray(dag.via_edges())
+)
+# An integer array serves as the sequence of hops (one row per hop): the walk 0 -> 1 -> 3.
+walk = ng.Path(g, np.array([[0], [2]], dtype=np.int32))
+assert_type(walk.cost(), int)
+
+# The ledger and a policy.
+ledger = ng.FlowLedger(g, service_baseline=None)
+policy = ng.FlowPolicy(
+    ledger,
+    0,
+    [3],
+    ng.FlowPolicyConfig(
+        routing=ng.DistributedTE(ng.TunnelCount(2), cost_ceiling=ng.CostStretch(1.5)),
+        admission=ng.Admission.LOSSLESS,
+    ),
+)
+result = policy.replace(
+    10,
+    design_demand=8,
+    outputs=ng.OutputOptions(residual=True, edge_reservations=True),
+)
+assert_type(result, ng.PlacementResult)
+plan = result.plan
+if plan is not None:
+    assert_type(plan.design_demand, int | float)
+    assert_type(plan.design_by_head, tuple[tuple[int, int], ...])
+assert_type(
+    result.program.tunnels[0].edges if result.program else None, tuple[int, ...] | None
+)
+# T2: the controller's tunnels; the plan's exact fields (a Fraction, ints above 2^64).
+te16 = ng.FlowPolicy(
+    ng.FlowLedger(g),
+    0,
+    3,
+    ng.FlowPolicyConfig(
+        routing=ng.CentralizedTE(
+            source_allocation=ng.SourceAllocation.EQUAL,
+            tunnel_count=ng.TunnelCount(2, up_to=True),
+            prefer_headroom=True,
+        ),
+        admission=ng.Admission.LOSSY,
+    ),
+)
+t2 = te16.replace(4, design_demand=4).plan
+if t2 is not None:
+    assert_type(t2.max_fractional_bandwidth_per_tunnel, Fraction | None)
+    assert_type(t2.heads_with_capacity, tuple[int, ...] | None)
+    assert_type(t2.total_tunnel_cost, int | None)
+    assert_type(t2.headroom_penalty, int | None)
+    assert_type(t2.max_lossless_offer, int | None)
+    assert_type(t2.insufficient_resolution, bool | None)
+t2 = ng.CentralizedTE(
+    source_allocation=ng.SourceAllocation.EQUAL, tunnel_count=ng.TunnelCount(16)
+)
+assert_type(
+    t2.tunnel_count,
+    ng.TunnelCount | None,
+)
+assert_type(t2.prefer_headroom, bool)
+assert_type(t2.source_allocation, ng.SourceAllocation)
+assert_type(result.program.tunnels[0].planned_bandwidth if result.program else 0, int)
+held = result.edge_reservations
+if held is not None:
+    assert_type(held, npt.NDArray[np.int64])
+assert_type(ledger.reserved(), npt.NDArray[np.int64])
+assert_type(result.call_undelivered, int | float)
+residual = result.residual
+if residual is not None:
+    assert_type(residual, npt.NDArray[np.int64])
+for record in policy.records():
+    assert_type(record.edge_flows, list[tuple[int, int]])
+    assert_type(record.min_route_cost, int | None)
+    assert_type(ledger.record(record.flow_id), ng.FlowRecord)
+policy.remove()
+
+# The result's accounting: exact ints, None where a field does not apply, per-source rows.
+assert_type(result.requested, int | float)
+assert_type(result.offered, int | None)
+assert_type(result.unadmitted, int | None)
+assert_type(result.total_cost, int | None)
+assert_type(result.call_edge_drops, list[tuple[int, int]])
+for row in result.by_source:
+    assert_type(row, ng.SourceFlow)
+    assert_type(row.admitted, int)
+    assert_type(row.offered, int | None)
+
+# Forwarding programs: built from routes (a Path or a PredecessorDAG), exported by a policy, forwarded
+# by Pinned under a mask and with black holes; the full-offer calls return results too.
+route = ng.RouteDefinition(0, ng.Path(g, [[0], [2]]), weight=np.int64(2))
+program = ng.ForwardingProgram.from_routes(
+    g,
+    0,
+    [3],
+    [ng.RouteDefinition(0, full.dag), route],
+    allocation=ng.RouteAllocation.WEIGHTED,
+)
+assert_type(program, ng.ForwardingProgram)
+pooled = ng.ForwardingProgram.from_dag(
+    g, [0], np.array([3]), full.dag, allocation=ng.RouteAllocation.EQUAL
+)
+assert_type(pooled, ng.ForwardingProgram)
+assert_type(program.tunnels, tuple[ng.Tunnel, ...])
+assert_type(program.source_weights, tuple[tuple[int, int], ...] | None)
+for tunnel in program.tunnels:
+    assert_type(tunnel.edges, tuple[int, ...] | None)
+pinned_cfg = ng.FlowPolicyConfig(
+    routing=ng.Pinned(program, black_holes=eligibility), admission=ng.Admission.LOSSY
+)
+replay = ng.FlowPolicy(ng.FlowLedger(g), 0, 3, pinned_cfg, g.eligibility())
+replaced = replay.replace(np.int64(4), outputs=None)
+assert_type(replaced, ng.PlacementResult)
+for tunnel_row in replaced.by_tunnel:
+    assert_type(tunnel_row, ng.TunnelFlow)
+    assert_type(tunnel_row.assigned, int)
+    assert_type(tunnel_row.status, ng.TunnelStatus)
+exported = ng.FlowPolicy(
+    ng.FlowLedger(g),
+    0,
+    3,
+    ng.FlowPolicyConfig(
+        routing=ng.CentralizedTE(source_allocation=ng.SourceAllocation.OPTIMIZED)
+    ),
+)
+assert_type(exported.evaluate(4).program, ng.ForwardingProgram | None)
+exported.replace(4)
+assert_type(exported.forward(float("inf"), black_holes=None), ng.PlacementResult)
+wcmp = ng.ShortestPaths(
+    allocation=ng.RouteAllocation.WEIGHTED,
+    weight_basis=ng.WeightBasis.EXPLICIT,
+    edge_weights=np.array([1, 2, 1, 1], dtype=np.int64),
+)
+assert_type(wcmp.edge_weights, tuple[int, ...] | None)
+assert_type(ng.FlowPolicyConfig(routing=wcmp).admission, ng.Admission)
+lossy_opts = ng.EvaluationOptions(pinned_cfg, offer=4)
+assert_type(lossy_opts.offer, int | float | None)
+assert_type(
+    ng.evaluate_demand(g, 0, 3, lossy_opts).by_tunnel, tuple[ng.TunnelFlow, ...]
+)
+
+# The evaluators, with optional arguments left out or None. Only ShortestPaths reads a cache;
+# CentralizedTE names its source allocation.
+controller = ng.ShortestPaths(
+    allocation=ng.RouteAllocation.OPTIMIZED, source_allocation=ng.SourceAllocation.EQUAL
+)
+assert_type(controller.source_allocation, ng.SourceAllocation | None)
+cfg = ng.FlowPolicyConfig(routing=controller)
+cache = ng.ShortestPathCache(g)
+opts = ng.EvaluationOptions(cfg, eligibility=None, cache=cache)
+assert_type(opts.eligibility, ng.Eligibility | None)
+call_delivered: int = ng.evaluate_demand(g, 0, 3, opts).call_delivered
+batch = ng.evaluate_pairs(g, [(0, 3), ([0, 1], np.array([3]))], opts, workers=1)
+assert_type(batch, list[ng.PlacementResult])
+# Integer arrays serve as the pairs too: one row (sources, destinations) per pair, or one pair.
+from_rows = ng.evaluate_pairs(g, np.array([[0, 3], [1, 3]], dtype=np.int64), opts)
+from_pair = ng.evaluate_pairs(g, [np.array([0, 3], dtype=np.int64)], opts)
+assert_type(from_rows, list[ng.PlacementResult])
+assert_type(from_pair, list[ng.PlacementResult])
+global_cfg = ng.FlowPolicyConfig(
+    routing=ng.CentralizedTE(source_allocation=ng.SourceAllocation.OPTIMIZED)
+)
+sens = ng.evaluate_edge_failures(g, 0, 3, ng.EvaluationOptions(global_cfg))
+for entry in sens.entries:
+    assert_type(entry.delivery_reduction, int)
+assert_type(cache.stats().hits, int)
+routing = global_cfg.routing
+if isinstance(routing, ng.CentralizedTE):
+    print("CentralizedTE routing:", routing)
+print(call_delivered, len(batch), len(paths), ng.UNREACHABLE, ng.__version__)
+
+# CostStretch takes a Fraction, a float, a NumPy floating value or an integer; factor is a Fraction.
+stretches = [
+    ng.CostStretch(Fraction(6, 5)),
+    ng.CostStretch(1.2),
+    ng.CostStretch(np.float32(1.2)),
+    ng.CostStretch(2),
+]
+assert_type(stretches[0].factor, Fraction)
+
+# Several policies in one operation: the actions keep their offers as given, the list returns one
+# result per action.
+listed = ng.FlowLedger(g)
+lossy_cfg = ng.FlowPolicyConfig(
+    routing=ng.ShortestPaths(), admission=ng.Admission.LOSSY
+)
+first_policy = ng.FlowPolicy(listed, 0, 3, lossy_cfg)
+second_policy = ng.FlowPolicy(listed, 1, 3, lossy_cfg)
+actions = [ng.Replace(first_policy, 2), ng.Replace(second_policy, np.int64(2))]
+assert_type(actions[0].offer, int | float)
+assert_type(actions[0].design_demand, int | float | None)
+assert_type(ng.Forward(first_policy, 1).black_holes, ng.Eligibility | None)
+together = ng.apply_actions(listed, actions, mode=ng.BatchMode.SIMULTANEOUS)
+assert_type(together, list[ng.PlacementResult])
+in_order = ng.apply_actions(listed, (ng.Place(first_policy, 1),))
+assert_type(in_order[0].call_delivered, int)
+
+# Units' floating branches describe allowed positive infinity, including NumPy float32.
+units_inf = np.float32(np.inf)
+assert ng.EvaluationOptions(
+    ng.FlowPolicyConfig(routing=ng.ShortestPaths()), offer=units_inf
+).offer == float("inf")
+
+# Prescribed source weights are owned immutable node-indexed values.
+weighted_sources = ng.CentralizedTE(
+    source_allocation=ng.SourceAllocation.WEIGHTED, source_weights=range(g.num_nodes())
+)
+assert_type(weighted_sources.source_weights, tuple[int, ...] | None)
+ng.CentralizedTE(
+    source_allocation=ng.SourceAllocation.WEIGHTED,
+    source_weights=np.zeros(g.num_nodes(), dtype=np.int64),
+)
diff --git a/third_party/pybind11/LICENSE b/third_party/pybind11/LICENSE
new file mode 100644
index 0000000..e466b0d
--- /dev/null
+++ b/third_party/pybind11/LICENSE
@@ -0,0 +1,29 @@
+Copyright (c) 2016 Wenzel Jakob <wenzel.jakob@epfl.ch>, All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Please also refer to the file .github/CONTRIBUTING.md, which clarifies licensing of
+external contributions to this project including patches, pull requests, etc.