fix(simulation): PR #198 review round — spillway split, courses disclosure, appendix fidelity

Tyre C2: DownstreamTarget::OpenSpillway added — success (open low ground,
complete carved path) split from EdgeUnreachable (strict search exhaustion);
both doc comments exact; test updated. Tyre C3: determinism docstring
corrected (no BTreeMap; the endorheic f64 gate stated as deterministic-by-
derivation). Hoshe H1: vacuous cliff_edge test replaced by
single_basin_bowl_never_carves_a_gorge asserting the known-empty outcome.
Hoshe H2/H3: courses-force-empty disclosure at rect_window_replica and in
the results doc; courses.len() print added to the square production-fn
bench — measured 3/6/10 courses in window (NOT courses-empty, verified
twice); 'faithful stand-in' claim retracted for a precise scope statement;
GJ1c 18-course run identified as the sole production-density rate. Tyre C1:
appendix (4) headline rephrased — the tagged-envelope migration cannot be
dodged by payload optimization (byte math), field-count-rule trigger is a
workshop synthesis call; appendix (2) scope split per-shape.

Hydrology unit suite 15/15; atlas lib suite 679 green; benches compile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/tests/bmv_gridunit_bench.rs

@@ -49,10 +49,18 @@
 //! measurements are taken for each cell-count target:
 //!
 //! 1. **Square, through `build_district_window_layer` itself** (District
-//!    granularity, `n = side`, real function call, unmodified) — the closest
-//!    possible approach to "the actual production entry point," at the
-//!    nearest square cell count to the target (e.g. side=576 → 331,776
-//!    cells, matching 768×432's 331,776 exactly).
+//!    granularity, `n = side`, real function call, unmodified, REAL
+//!    `RiverNetwork` passed in) — the closest possible approach to "the
+//!    actual production entry point," at the nearest square cell count to
+//!    the target (e.g. side=576 → 331,776 cells, matching 768×432's 331,776
+//!    exactly). This path exercises the ACTUAL course-invention +
+//!    riparian-cull machinery `build_district_window_layer` runs in
+//!    production (`invent_courses_near_window`/`crop_courses_for_wire`) —
+//!    confirmed non-empty at every measured shape (`layer.courses.len()` is
+//!    printed and was 3/6/10 at 330K/2.07M/8.3M respectively on the
+//!    synthetic gradient body centred at the world origin; see the results
+//!    doc's H3 correction for exactly what this does and does not validate).
+//!
 //! 2. **Real 16:9 rectangle, via a row-chunked loop that mirrors
 //!    `build_district_window_layer`'s internals cell-for-cell** (same
 //!    `into_par_iter()` row chunking, same `derive_at_metres` call, same
@@ -64,9 +72,43 @@
 //!    "MEASURED (replica loop)" in the results table to distinguish it from
 //!    "MEASURED (production fn)".
 //!
-//! Both converge on the same number at the same cell count (verified by the
-//! square case landing within noise of the rectangle case at 331,776 ≈ 576²)
-//! — see the results doc for the cross-check.
+//!    **DISCLOSED GAP (PR #198 review, Hoshe H2):** [`rect_window_replica`]
+//!    always calls `derive_at_metres` with an EMPTY `&[]` course slice — it
+//!    has no `RiverNetwork`/`invent_courses_near_window` wiring at all, by
+//!    construction (courses are invented ONCE per window, ahead of the
+//!    per-cell loop, inside `build_district_window_layer` itself —
+//!    replicating that machinery was out of scope for a bench loop whose job
+//!    is the per-cell derive rate, not course invention). This means EVERY
+//!    rectangular-canvas number in this file (the three named 16:9 shapes
+//!    AND the 83K deep-step bench) **excludes the per-cell
+//!    `river_course::near_perennial_water` riparian-test cost** production
+//!    pays on every cell of a window with real nearby course geometry.
+//!    `zoom_ladder_bench.rs`'s own `bench_course_cost_on_vs_off` measured
+//!    that cost at District cap (n=64, real GJ1c geometry): **+0.09–0.21 ms
+//!    against a ~5 ms baseline, under 5%** — small, but real, and this file's
+//!    rectangular numbers do not include it. Full disclosure and the
+//!    corrected "what converges with what" statement is in the results doc's
+//!    H2/H3 section — read that section before citing any rectangular-canvas
+//!    number here as courses-inclusive. It is not.
+//!
+//! **Convergence claim, corrected (H3):** the square production-fn path is
+//! courses-INCLUSIVE (light density: 3/6/10 courses at 330K/2.07M/8.3M) and
+//! the rectangular replica-loop path is courses-EMPTY (always `&[]`) — so
+//! their agreement at 331,776 ≈ 576² (~191 ns/cell either way) validates the
+//! ROW-CHUNKED LOOP MECHANICS (chunking granularity, dispatch overhead,
+//! per-cell derive cost) converging across two independently-written call
+//! sites, NOT a courses-empty-vs-courses-inclusive equivalence claim — the
+//! two paths differ in exactly one respect (courses present vs absent) and
+//! happen to land within noise of each other at this course DENSITY (3 out
+//! of 331,776 cells is far too sparse to move the aggregate ns/cell figure
+//! outside the run-to-run noise band, consistent with the <5% per-cell
+//! course-cost delta `zoom_ladder_bench.rs` measured directly). The
+//! courses-inclusive rate at REAL production course density (not this
+//! sparse an origin-window) is covered only by the separate GJ1c real-body
+//! cross-check bench below (18 courses in a 331,776-cell window, deliberately
+//! centred on real river geometry) — see that bench's own doc and the
+//! results doc for the exact scope of what each number does and does not
+//! include.
 //!
 //! Run: `cargo test --release --test bmv_gridunit_bench -- --ignored --nocapture`
 
@@ -222,13 +264,15 @@ fn bench_square_window_production_fn_district_spacing() {
         let ns_per_cell = elapsed.as_secs_f64() * 1e9 / cells as f64;
         println!(
             "  side={side:>5} n={n:>5} cells={cells:>10} (target ~{}): \
-             {ms:>9.2} ms warm, {ns_per_cell:>7.1} ns/cell ({:.3} us/cell)",
+             {ms:>9.2} ms warm, {ns_per_cell:>7.1} ns/cell ({:.3} us/cell), \
+             courses_in_window={}",
             match cells {
                 c if c < 500_000 => "330K",
                 c if c < 4_000_000 => "2.07M",
                 _ => "8.3M",
             },
-            ns_per_cell / 1000.0
+            ns_per_cell / 1000.0,
+            layer.courses.len()
         );
     }
     println!();
@@ -416,6 +460,22 @@ fn bench_square_window_production_fn_gj1c_real_body_crosscheck() {
 /// `build_district_window_layer`'s internal loop shape cell-for-cell (see
 /// module doc for the explicit diff against the real function). Returns
 /// (elapsed, per_cell_ns).
+///
+/// **Courses are FORCE-EMPTY here, disclosed (PR #198 review, Hoshe H2):**
+/// every call site below passes `&[]` for `nearby_courses` — there is no
+/// `RiverNetwork`, no `invent_courses_near_window` call, and no
+/// `river_course::near_perennial_water` riparian test running per cell. This
+/// is a real, measured gap versus production, not a rounding footnote:
+/// `zoom_ladder_bench.rs`'s `bench_course_cost_on_vs_off` measured the
+/// courses-on-vs-off delta directly at District cap (n=64, real GJ1c
+/// geometry) as **+0.09–0.21 ms against a ~5 ms baseline (under 5%)**. Every
+/// number produced by this function — the three 16:9 canvas benches AND the
+/// 83K deep-step bench — excludes that cost. It is EXCLUDED, not zero in
+/// production; readers citing a rectangular-canvas number from this file as
+/// "the real per-cell cost including courses" are citing it wrong. The
+/// courses-inclusive numbers live only in the square
+/// `build_district_window_layer`-backed benches above (which pass a real
+/// `RiverNetwork` and print `courses_in_window`).
 #[allow(clippy::too_many_arguments)]
 fn rect_window_replica(
     seed: SeedChain,