F0: bind Program assessment evidence to context-bound LCS occurrences

[lemone112]

Stack

Draft stacked on #448. Review this delta after #448.

Exact head: a244a61abfc36b76188713d551b997294fd1141d.

This PR remains an intentionally non-mergeable stacked draft. Its exact-head CI is green below. It is the F0/LCS prerequisite for #419, not the terminal Core → WASM → controller cut.

Architecture

• Hard-cuts Program colour inputs to ColorSignal and requires an explicit AppearanceContextId for every assessed occurrence. There is no inferred viewing condition or default context.
• Adds one private ModeledLcsOccurrenceV1: the replayable admitted sRGB8 → XYZ derivation and its provenance, bound to exactly one immutable LcsOccurrence.
• ProgramPointTargetV1 presents the encoded SourceOver result and modeled LCS occurrence to the evaluator. ProgramVisiblePointBindingV1 binds the physical SourceOver certificate and modeled LCS occurrence into one evidence value.
• A physical/modeled signal mismatch fails before evaluator execution.
• Every canonical case × constraint report cell exposes its modeled occurrence through the evidence SSOT, including violations. Any hard violation still suppresses current outputs.
• Output projection reuses the same private Oklab derivation instead of maintaining a second projection-source path.
• Observation and Program bindings retain output-profile identity as ColorSignal; encoded sRGB8 is extracted only at the current physical composition kernel.
• Point support remains encoded-only and cannot impersonate the richer Program evidence.

The new Program algebra introduces no PairFill, PairLabel, Glow, Material, Ladder, or other client-role vocabulary. Existing legacy public Lab UI-shaped modules are outside this delta; this PR adds no compatibility layer for them, and their deletion remains required before a mergeable product cut.

Hard cuts

• No compatibility constructors or adapters.
• No legacy Program-target aliases.
• No implicit appearance contexts.
• No duplicate modeled occurrence field beside evidence.
• No dynamic UCS, invented difference calibration, or fallback context.

Performance invariants

• Exactly one modeled signal → XYZ derivation per unique constrained occurrence × admitted physical case, reused by duplicate constraints.
• Program update performs no eager CAM16 derivation or output projection.
• The immutable compiled epoch is strongly shared; each Session reuses compact scratch storage only for unique constrained occurrences.
• Constraint cells read modeled LCS from their evidence owner instead of copying it twice.

Deliberate non-claims

• Exact/WCAG decisions remain encoded-sRGB8/SourceOver decisions. This slice binds modeled LCS into target and evidence; it does not add an LCS-coordinate decision law.
• Modeled LCS provenance is deterministic ideal colorimetry, not renderer, display, field-observation, or human-subject evidence.
• Output transport remains encoded-sRGB8 Paint.
• No UCS/difference law, dynamic calibration, or resource cap is certified here.
• Existing public legacy role modules are not claimed clean by this delta.
• The PR remains draft because it is a stacked prerequisite, not because its exact head lacks validation.

Validation

• cargo test -p labcolors-core --all-targets --offline: 704 passed, 0 failed, 6 ignored; all four bench targets executed.
• Focused Program/LCS integration: 9/9 passed.
• Clippy with warnings denied: passed.
• Rustdoc and 30/30 doctests: passed.
• Core package build and packaged verification: passed.
• Point-support proof verifier: passed over the exact 19-file semantic closure with 43/43 explicit negative controls.
• Independent emitted-proof replay is byte-identical to the committed artifact.

Exact-head remote validation

• CI #1149: SUCCESS — audit, MSRV, docs, tests/proofs, WASM/headless/size, clippy/rustfmt, and Node 22 consumer floor all passed.
• Native #672: SUCCESS — Linux Swift conformance passed; the manual paid macOS lane was skipped by policy.
• Submitted reviews: 0; inline/unresolved threads: 0. CodeRabbit reported success but skipped the actual review because the PR remains draft, so no CodeRabbit review is claimed.

Refs #419 #440 #441.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2132aace-7414-401c-9625-0c899010327b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/f0-program-lcs-lowering

---

_{Comment @coderabbitai help to get the list of available commands.}

[lemone112]

Superseded by the reviewed cumulative squash merge #465 (24fd1f4). The lower stacked branch was intentionally not merged on its own because its intermediate head was not the safe terminal public boundary.