fix: a refusal about a size names the key the recipe actually carries

[donislawdev]

Stability report finding T1, the half that does not need a contract decision. Reproduced on today's tree first.

One thing in the report is wrong, and it matters

T1 says the refusal "carries no address. There is no at naming the target". It does. Measured:

$ tfg validate r.yaml --json
"at": "targets[1].size"

But that surfaced a real defect underneath. The recipe says size-range. The address says size - a key that recipe does not have. So validate --json sends a script, and the window sends a person, to a box that is neither on their screen nor in their file.

The format is handed a count of bytes and answers about bytes, so every size refusal it produces says size, the only size key it knows. It cannot know which key held the number. The substitution now happens in atTarget, where the target is in hand.

"at": "targets[1].size-range"     <- range target
"at": "targets[1].size"           <- ordinary target, unchanged

Nothing else moved, and that was measured

probe	result
refusalcorpus.py - 48 recipes x 2 commands	96 identical, 0 differing
bytesweep.py - every format	23 identical, 0 moved

Only the address moved. Every refusal is word for word what it was.

The comment is corrected in the same commit

drawSizes promised: "the range either works for every file or for none". The code does not provide that. The low-end check is sufficient only if a format's reachable sizes are one unbroken interval from its minimum, and for four of them they are not - PNG has an unreachable band of eleven byte counts above every picture's encoded size, and the OPC three declare the same shape.

So a drawn size can land in a band and be refused later, and whether that happens depends on the count. One 64x64 PNG recipe, one seed, size-range 143-200:

count	1	2	3	5	8	12	20	40
	ok	ok	refused	refused	refused	refused	refused	refused

That is left open deliberately. Closing it needs the format to declare its unreachable bands so the whole interval can be judged before anything is drawn - a change to format.Descriptor, and yours to call. What this commit does is stop the comment claiming otherwise, because it was persuasive enough that a future reader would trust it.

Guard

TestASizeRefusalIsAddressedToTheKeyTheRecipeCarries, two mutations in opposite directions, both caught. The pair matters more than either half: a build answering size-range for every size refusal would satisfy the first case and misaddress every ordinary target in the tree.

Checked first that this was not already guarded. The table in TestEveryRecipeRefusalSaysWhichSettingItIsAbout has a size-range case, but that refusal comes from the recipe reader, which knows which key it read. Both of my cases were tried there first and came back valid, because nothing on that path plans a file.

preflight --quick green on all 12. One self-inflicted catch worth recording: the punctuation guard rejected a 🔴 I had left in a shipped source comment, which is rule 13 doing its job.

🤖 Generated with Claude Code