runCodecLaws

The codec laws: a state that has been through encode/decode is interchangeable with the one that has not — over causalPool, O(pool²).

This is the seam every other law in this file skips. Replicas here hand each other in-process objects; Quilter encodes a delta, sends the bytes over a Seam, and the receiver joins what it decodes. So a Quilted whose serializer is lossy but deterministic passes associativity, commutativity, idempotence, least-upper-bound and both byte laws — every comparison those make is between two encodings produced by the same lossy path, so the loss cancels. On the wire the receiver holds a state missing the omitted part, and a removed element resurrects on the next merge.

Three arms, in the order they are checked, because each one catches what the one before it cannot. They are not three spellings of one property:

1. decode(encode(s)) == s — the codec preserves the value. The strongest arm and the one that reds on ordinary field loss. It is strong enough that the two below are, on a healthy type, implied by it; they exist for the two ways a type can be unhealthy that it is structurally blind to.

2. encode(decode(encode(s))) is byte-identical to encode(s) — the codec is stable. Arm 1 is blind here whenever the loss is invisible to equals (a field equality ignores), and so is every existing byte law, which only ever compares two built states. This is the arm that sees a state whose encoding depends on how the object was constructed rather than on what it holds — parsed versus built — which is a live hazard for any type whose merge yields an insertion-ordered collection. It matters because #1955's root-hash gate compares digests: a receiver whose decoded state hashes differently from the sender's reads as diverged and skips the fast path, while comparing perfectly equal.

3. a ⊔ decode(encode(b)) equals a ⊔ b, and encodes to the same bytes — equality is a congruence for the join through the codec. Arms 1 and 2 are both blind to a field that equals ignores and encode also drops, but that piece reads: round-trip and re-encode are then both green, and the join lands somewhere else. LWWRegister's (timestamp, replica) tag is the shape — drop it, and every join afterwards picks a different winner while every state still compares equal to itself.

The counts in CodecReport are the rig receipt, and two of them are asserted. All three laws hold vacuously over a pool that degenerated to one value; arm 1 would stay green on a serializer that encodes nothing at all. So the pass refuses a pool with fewer than two distinct states, refuses a codec that emitted fewer than two distinct encodings over it, and refuses an arm-3 loop in which no join ever had to absorb its decoded operand. On a healthy codec every one of those is implied by arm 1 — they are there to red when the pool degenerates, which arm 1 cannot notice.

O(pool²) joins and encodes, against the associativity pass's O(pool³): this costs a rounding error beside it, and roughly what runOtherJoinLaws costs.