CB-REV-0001: the adversarial review, and it was not approvable

Thirteen challenges, five FATAL, all five conceded. Nothing had reached
ground-game, which is the only reason this is a correction and not a
retraction.

The worst: `Reactive` was not "greedy with one preference changed". It
differed in five, including SpendFreedom — ranked 95 unconditionally
against greedy's `95 if gated else 0` — so the seat burned its Freedom
token in round one of every game. A second change to the exact mechanism
under study, and every number in CB-EV-0031 was measuring it. The pass
claimed ADR-0018's one-varying-parameter discipline in its own workplan
while violating it. GreedyPolicy::rank is now public and the policy
delegates, overriding one match arm, so the control is structurally true.

Withdrawn entirely: "H1-B suppresses DARVO in the attacker". Disabling
H1-B under the corrected policy changes the arm count by exactly zero.
The pass hedged the wrong variable — it disclaimed "the number 2" and
defended "the direction", and the direction is what failed. The
supporting inference was invalid anyway: final Stress cannot show who
armed, because DarvoEnded resets the stage and REVERSE gives its owner -2.

Corrected: criterion 1 was failed on the greedy column while the pass's
own printed table showed 31-1000 arms in the other columns — the
selective-column move, in the file that names it. "Peak Stress was 1" was
a maximum over StressSet payloads, not held state (true: 2); the baseline
game count was 1,600 not 3,200; and "a reckless policy plays identically
to a careful one" is refuted by this repo's own rank-95 policy.

Inert controls replaced, each verified red against the reviewer's own
mutation: the baseline hash test compared two identically-constructed
states (serde(skip) on variant left 57/57 green); the `unchanged:` test
checked 3 of 7 entries and passed with SOLVE made illegal; H1-A's ordering
and H1-B's OU-cancel path had no test at all.

edition-check now covers catalog.yaml and rules_delta.yaml, whose digests
CB-WP-0038 claimed and never recorded — the review found it and reported
it unverified rather than absent, which was the right call.

Still open: H1-B on the DARVO extra-Attack path is untested, regulation.rs
still skips setup failures silently, and round-5 arms are counted though
they can never act.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

games/ground/examples/regulation.rs

@@ -40,31 +40,22 @@ impl Policy for Reactive {
             .players
             .get(&seat)
             .is_some_and(|p| p.stress >= 4 && !p.freedom_gate_lifted);
+        // ONE ARM OVERRIDDEN, THE REST DELEGATED.
+        //
+        // The first version re-typed greedy's ranking and changed one
+        // line of the copy. It differed in five places, and the review
+        // found it: `SpendFreedom` ranked 95 unconditionally instead of
+        // greedy's `95 if gated else 0`, so this seat spent its Freedom
+        // token in round one of every game — a second change to the very
+        // mechanism under study. Delegating makes "exactly one preference
+        // differs" structurally true instead of a claim in a comment.
         let rank = |c: &GroundCommand| -> i32 {
             match c {
                 GroundCommand::SelectAction {
-                    action, problem, ..
-                } => match action {
-                    // THE ONE LINE. Greedy has `Ground if gated => 100`.
-                    Action::Ground if gated => 5,
-                    Action::Solve
-                        if problem
-                            .and_then(|p| state.problems.get(&p))
-                            .is_some_and(|p| p.claimed_by.is_some()) =>
-                    {
-                        20
-                    }
-                    Action::Solve => 90,
-                    Action::Investigate => 80,
-                    Action::Support => 70,
-                    Action::Ground => 5,
-                    Action::Attack => 10,
-                },
-                GroundCommand::SpendFreedom => 95,
-                GroundCommand::ChooseGroundMode { .. } => 50,
-                GroundCommand::RespondToSupport { .. } => 90,
-                GroundCommand::ChooseDarvoTarget { .. } => 50,
-                GroundCommand::Reveal | GroundCommand::Resolve | GroundCommand::EndRound => -1,
+                    action: Action::Ground,
+                    ..
+                } if gated => 5,
+                other => GreedyPolicy::rank(state, seat, other),
             }
         };
         let mut best = 0;
@@ -77,6 +68,10 @@ impl Policy for Reactive {
     }
 }
 
+/// `Scenarios.csv`: "All players start at Stress 2." Named rather than
+/// inlined so the peak metric cannot silently disagree with setup.
+const START_STRESS: u8 = 2;
+
 struct Cell {
     games: u32,
     won: u32,
@@ -136,17 +131,28 @@ fn sweep(mode: ScoringMode, variant: Variant, players: u8, reactive: bool) -> Ce
                 c.atk += 1;
             }
         }
+        // Peak Stress **held**, not peak Stress *assigned*.
+        //
+        // The first version took a maximum over `StressSet` PAYLOADS.
+        // Starting Stress is 2 and is written by `setup`, never by an
+        // event, so a table that sat at 2 all game reported **1**, and a
+        // table with no `StressSet` at all would report 0. CB-EV-0031 §2
+        // built its headline claim on that number. Wrong subject: the
+        // metric answered "highest value ever assigned", the prose said
+        // "highest Stress reached".
+        let mut held: std::collections::BTreeMap<PlayerId, u8> =
+            g.state.players.keys().map(|s| (*s, START_STRESS)).collect();
+        c.peak_stress = c.peak_stress.max(START_STRESS);
         for e in &g.events {
             if matches!(e, games_ground::GroundEvent::DarvoTriggered { .. }) {
                 c.darvo += 1;
             }
-            // How close does Stress actually get to the arm at 5? That is
-            // the number H1's whole mechanism turns on, and CB-EV-0030
-            // had to infer it from a single game.
-            if let games_ground::GroundEvent::StressSet { stress, .. } = e {
+            if let games_ground::GroundEvent::StressSet { player, stress } = e {
+                held.insert(*player, *stress);
                 c.peak_stress = c.peak_stress.max(*stress);
             }
         }
+        let _ = held;
     }
     c
 }

games/ground/src/bot.rs

@@ -323,7 +323,20 @@ impl Policy for RandomPolicy {
 pub struct GreedyPolicy;
 
 impl GreedyPolicy {
-    fn rank(state: &GroundState, seat: PlayerId, cmd: &GroundCommand) -> i32 {
+    /// The ranking, **public so a variant policy can override exactly one
+    /// arm and inherit the rest** (CB-WP-0039, after review).
+    ///
+    /// It was private, so `regulation.rs` re-typed an abridged copy and
+    /// called it "greedy with one preference changed". It differed in
+    /// five places — including `SpendFreedom`, which the copy ranked 95
+    /// unconditionally where this ranks it 0 unless the gate is biting,
+    /// so the "reactive" seat burned its Freedom token in round one of
+    /// every game. **A second change to the exact mechanism the pass was
+    /// studying**, and every number in CB-EV-0031 was measuring it.
+    ///
+    /// Making this callable removes the possibility rather than testing
+    /// for it: a caller that delegates cannot drift.
+    pub fn rank(state: &GroundState, seat: PlayerId, cmd: &GroundCommand) -> i32 {
         let gated = state
             .players
             .get(&seat)

games/ground/src/lib.rs

@@ -2092,14 +2092,40 @@ mod tests {
             s
         }
 
-        /// **The load-bearing control.** A variant system that perturbs
-        /// the baseline invalidates every measurement this repo has.
+        /// **The load-bearing control**, rewritten after review found the
+        /// first version inert.
+        ///
+        /// It compared two states built by the *same* `setup` call, both
+        /// then assigned `Variant::Baseline` — bitwise identical by
+        /// construction, so the assertion could only fail if hashing were
+        /// nondeterministic. It carried no information about variants at
+        /// all. Adding `#[serde(skip)]` to `variant` — which is exactly
+        /// the "a scenario replayed under the wrong variant diverges
+        /// silently" failure the workplan named — left all 57 tests green.
+        ///
+        /// This asserts the two properties that were claimed:
+        /// **the variant reaches the hash**, and **selecting the baseline
+        /// is not a change**.
         #[test]
-        fn baseline_is_bit_for_bit_what_it_was() {
+        fn the_variant_reaches_the_hash_and_baseline_is_not_a_change() {
             for players in [2u8, 3, 6] {
                 for seed in 0..8u64 {
                     let base = setup(players, Variant::Baseline, seed);
-                    let mut default_built = GroundState::setup(
+                    let h1 = setup(players, Variant::H1ProblemStress, seed);
+
+                    // 1. The variant is IN the hash. `#[serde(skip)]` on
+                    //    the field makes these equal, which is the whole
+                    //    silent-divergence failure.
+                    assert_ne!(
+                        cb_events::state_hash_hex(&base),
+                        cb_events::state_hash_hex(&h1),
+                        "{players}p seed {seed}: the variant does not reach the state hash, \
+                         so a recording cannot say which rules it was played under"
+                    );
+
+                    // 2. And selecting the baseline explicitly is not a
+                    //    change from selecting nothing.
+                    let untouched = GroundState::setup(
                         &Setup {
                             players,
                             preset: format!("standard-{players}p"),
@@ -2108,12 +2134,10 @@ mod tests {
                         seed,
                     )
                     .expect("setup");
-                    // Untouched: whatever `setup` produces IS baseline.
-                    assert_eq!(default_built.variant, Variant::Baseline);
-                    default_built.variant = Variant::Baseline;
+                    assert_eq!(untouched.variant, Variant::Baseline, "the default moved");
                     assert_eq!(
                         cb_events::state_hash_hex(&base),
-                        cb_events::state_hash_hex(&default_built),
+                        cb_events::state_hash_hex(&untouched),
                         "{players}p seed {seed}: selecting the baseline changed it"
                     );
                 }
@@ -2226,6 +2250,68 @@ mod tests {
             );
         }
 
+        /// **H1-A lands before the DARVO arm check** (review M5).
+        ///
+        /// The delta orders it "+1 Stress, then clamp, then DARVO arm
+        /// check as today". CB-WP-0038 claimed this was got right and
+        /// nothing tested it: moving the pressure after the arm check
+        /// left every test green.
+        ///
+        /// A seat at 4 with a Problem unclaimed must arm **in the same
+        /// round end** — pressure takes it to 5, and the check sees it.
+        #[test]
+        fn h1a_pressure_arms_darvo_in_the_same_round_end() {
+            let mut s = setup(3, Variant::H1ProblemStress, 7);
+            for p in s.players.values_mut() {
+                p.stress = 4;
+                p.darvo = DarvoStage::Off;
+            }
+            assert!(s.problems.values().any(|p| p.claimed_by.is_none()));
+            let events = s.end_round_events();
+            assert!(
+                events
+                    .iter()
+                    .any(|e| matches!(e, GroundEvent::DarvoTriggered { .. })),
+                "pressure took the seat to 5 but the arm check did not see it, \
+                 so H1-A is ordered after it"
+            );
+            // And the order is visible in the event stream: the Stress
+            // must be set before the trigger, not after.
+            let first_stress = events
+                .iter()
+                .position(|e| matches!(e, GroundEvent::StressSet { .. }));
+            let first_trigger = events
+                .iter()
+                .position(|e| matches!(e, GroundEvent::DarvoTriggered { .. }));
+            assert!(
+                first_stress < first_trigger,
+                "the arm check precedes the pressure in the event stream"
+            );
+        }
+
+        /// **H1-B must not fire on a GROUND—OU cancellation** (review M11).
+        ///
+        /// `resolve_attack` has two cancel paths and the existing test
+        /// exercised only Protection — it passed `&Default::default()`
+        /// for `ou_cancels`, so the other path was never reached.
+        #[test]
+        fn h1b_does_not_soothe_an_ou_cancelled_attack() {
+            let mut s = setup(3, Variant::H1ProblemStress, 3);
+            let seats: Vec<PlayerId> = s.players.keys().copied().collect();
+            let (a, t) = (seats[0], seats[1]);
+            s.players.get_mut(&a).expect("a").stress = 4;
+            let mut ou = std::collections::BTreeSet::new();
+            ou.insert((a, t));
+            let mut events = Vec::new();
+            s.resolve_attack(a, t, &ou, &mut events);
+            assert!(
+                !events
+                    .iter()
+                    .any(|e| matches!(e, GroundEvent::StressSet { player, .. } if *player == a)),
+                "an Attack cancelled by GROUND—OU still soothed the attacker"
+            );
+        }
+
         /// **`rules_delta.yaml`'s `unchanged:` list is ground-game's claim
         /// about their own experiment, and it is checkable.**
         ///
@@ -2260,6 +2346,61 @@ mod tests {
                     base.solution_deck, h1.solution_deck,
                     "{players}p: deck moved"
                 );
+
+                // solve_legality / support / ground_modes: the SAME menu
+                // in the SAME position. Comparing setup fields could not
+                // see a delta that forbids an action -- the review made
+                // SOLVE illegal under H1 and this test stayed green.
+                let seats: Vec<PlayerId> = h1.players.keys().copied().collect();
+                for seat in &seats {
+                    let mut lb: Vec<String> = crate::bot::legal_commands(&base, *seat)
+                        .iter()
+                        .map(|c| format!("{c:?}"))
+                        .collect();
+                    let mut lh: Vec<String> = crate::bot::legal_commands(&h1, *seat)
+                        .iter()
+                        .map(|c| format!("{c:?}"))
+                        .collect();
+                    lb.sort();
+                    lh.sort();
+                    assert_eq!(
+                        lb, lh,
+                        "{players}p {seat}: H1 changed which commands are legal"
+                    );
+                }
+
+                // relation_slots: 2, asserted at the BOUNDARY. The old
+                // check asked `has_free_slot` of a seat with no relations,
+                // which holds for any capacity >= 1.
+                if seats.len() >= 3 {
+                    let mut s = h1.clone();
+                    s.relations
+                        .insert(Pair::new(seats[0], seats[1]), Relation::Bond);
+                    assert!(s.has_free_slot(seats[0]), "one relation leaves a slot");
+                    s.relations
+                        .insert(Pair::new(seats[0], seats[2]), Relation::Bond);
+                    assert!(
+                        !s.has_free_slot(seats[0]),
+                        "{players}p: two relations must fill both slots -- capacity moved"
+                    );
+                }
+
+                // darvo_stage_table: the arm sits at Stress 5. Every
+                // Problem claimed, so H1-A cannot add pressure and the
+                // only question is where the threshold is.
+                let mut s = h1.clone();
+                for p in s.players.values_mut() {
+                    p.stress = 4;
+                }
+                for p in s.problems.values_mut() {
+                    p.claimed_by = Some(seats[0]);
+                }
+                assert!(
+                    !s.end_round_events()
+                        .iter()
+                        .any(|e| matches!(e, GroundEvent::DarvoTriggered { .. })),
+                    "{players}p: DARVO armed below Stress 5 -- the stage table moved"
+                );
             }
         }
     }