t27b: repair crypto and rust_convert; distinguish PR ledger lag

[dmitrii-f-t27]

Closes #9635
Closes #9632
Refs #9600

What this PR carries

One carrier for the three things that keep t27b-native-ratchet red on every pull request. It is the existing branch of this PR (crypto fix, already published) plus two commits on top. No second PR was opened.

1. Crypto JIT/interpreter mismatch (#9635)

specs/port/trios/crates/trios-mesh-node/src/crypto.t27 made t27b report mismatch (jit Ok(1), interpreter Fault) where the reference passes. A runtime mismatch is a defect, never ledger lag: the steward refuses it (specs/tri/t27b/ledger_steward.t27, RR_DEFECT). This is the commit already on the branch (9983c52). After it, root measured t27b test --check exit 0, 23/23 tests, 156 runtime asserts, and the reference t27c test-report exit 0 (logs below). It is sealed with the standard tool (t27c seal --save, Zig 0.16, 23/23, tests.forced false): .trinity/seals/src_port::trios_mesh_node_crypto.json.

2. rust_convert pass -> blocked, FnDecl(reference CSE hoist) (#9632)

specs/tools/t27o/rust_convert.t27, fn out_format: the expression f + 1 was spelled twice over a const local (and fq - 1 twice), so the optimizer's _cse temporary for the repeated expression reads a local of the fn body, and t27b refuses such a fn (FnDecl(reference CSE hoist), rule from #6359). Measured on master cd8a656 (/tmp/t27-ci-native-master-20261015/run.json): the reference passes this spec, native t27b reports it blocked with that blocker. I did not check whether the reference could compile the old file in isolation, and I do not claim it. The edit spells each expression once (piece = p, const tail_end); values are identical, no test, assert or guard is removed. Regenerated with the standard tool: gen/rust/tools/t27o/rust_convert.rs and .trinity/seals/t27o_T27oRust.json (65/65).

3. The ratchet reads a pull request, not only master (#9600, FR-002 and FR-004)

specs/ci/derived_data.t27 ledger_code_verdict already says: UNEXPECTED PASS, MOVED, STALE and UNLISTED are V_PENDING (lag, the refresh bot owes the row); UNEXPECTED FAILURE, OVER CAP and BAD REASON are V_RED. Nothing read it: tri t27b ratchet used the strict ratchet_is_red, so every spec-adding PR was red for master's ledger lag.

• specs/tri/t27b/steward.t27: new ratchet_red(code, got, pr). With pr false it is exactly ratchet_is_red. With pr true, lag is pending (UNEXPECTED PASS, MOVED, STALE, and UNLISTED where t27b passes or cannot compile the construct yet: pass, pass_vacuous, blocked, frontend, codegen). Still red: UNEXPECTED FAILURE, OVER CAP, BAD REASON, an unknown code, and an UNLISTED spec where t27b fails, mismatches, crashes, times out, or did not run. An UNLISTED spec with a runtime defect is never read as lag (the wider MOVED limit is stated at the end).
• Tests are in the spec: 9 new tests, 7 of them negative controls (UNLISTED mismatch, crash, fail, timeout, not run, missing; the regression codes 2, 8, 9, 10), and an invariant that pr false equals ratchet_is_red.
• Glue only: scripts/tri_loop/t27b_rules.py calls the generated function; scripts/tri_loop/t27b.py gets a --pr flag and carries each finding's t27b verdict; .github/workflows/t27b-native.yml passes --pr on pull_request events only. These files are listed in tools/policy/foreign-exceptions.txt (t27b dogfood: our own specs first #6457, t27b: native arm64 CI per PR on ubuntu-24.04-arm and macos-14 (off the Mac, off qemu) #6444).
• Master, workflow_dispatch, the lab and every other caller keep the strict default. This is deliberate: the ledger steward starts only from a red master ratchet (ledger_steward.t27 run_starts_job; contrib/railway/t27b-lab/lab.py calls ratchet --json without the flag), so a lenient default would stop it from ever opening the ledger PR.
• Generated by the standard tool, not by hand: gen/c/tri/t27b/steward.c, .trinity/seals/t27b_T27bSteward.json (137/137).

What "pending" means here

Pending is a CI policy reading of derived_data.t27: the finding is printed but does not fail the check. It is not a test that ran and passed. The ledger rows for the lagging specs are still owed by the steward or by a blessed ledger PR (#9600 FR-001), which this PR does not do.

Evidence (local, run by the PR author's tooling; none of it is CI)

• steward.t27: t27b test --check --blockers exit 0, 137/137, 184 runtime asserts (/tmp/t27-ci-steward-native-20261015.log); reference t27c test-report + Zig 0.16 exit 0, 137/137, 0 vacuous (/tmp/t27-ci-steward-reference-20261015.log).
• python3 scripts/ci/test_the_t27b_steward_decides_in_t27.py exit 0, byte-for-byte gen-c compare and mutant controls pass (/tmp/t27-ci-steward-wiring-20261015.log).
• python3 scripts/ci/test_a_t27b_spec_cannot_move_silently.py exit 0, mutant control passes (/tmp/t27-ci-steward-move-control-20261015.log).
• rust_convert: t27b --check 65/65, 146 runtime asserts, reference 65/65 (/tmp/t27-ci-native-rustconvert-after-20261015.log, /tmp/t27-ci-rustconvert-exact-reference-20261015.log).
• crypto: 23/23, 156 asserts, reference exit 0 (/tmp/t27-ci-crypto-native-20261015.log, /tmp/t27-ci-crypto-reference-20261015.log).
• t27c validate-seals --pr-files on the three source specs of this carrier: exit 0 (/tmp/t27-ci-native-validate-seals-20261015.log). This covers those seals only; it is not a corpus result. The seal of ledger_steward.t27, which uses functions of steward.t27, is being checked separately and is not claimed here.
• Negative control, offline replay of master's artifact (cd8a656) through both modes: strict and --pr are both red, with UNEXPECTED FAILURE 1 (rust_convert, the base without this fix) and the real crypto mismatch among 158 UNLISTED (/tmp/t27-ci-steward-replay-strict-20261015.json, /tmp/t27-ci-steward-replay-pr-20261015.json). It shows the lenient mode does not hide the defects. It is not a new full corpus.

Not done, stated plainly

• No full local corpus was run; the full corpus runs in CI after the push, and the ledger is NOT blessed. Whether t27b-native-ratchet is green on this PR is unknown until CI finishes on the final head SHA. This stays a draft, and is not made ready or merged while any required or relevant check is red.
• This PR does not close t27b-native ratchet is red on every master run since it landed: ledger 099ac2224 predates 16 improvements and 40+ new specs #9600: FR-001 (bless the ledger from a clean integrated master run, or the steward's PR) waits for this carrier to merge.
• The 8 gen_w ConstDecl rows stay UNLISTED blocked until spec(port): share tree helpers across eight gen_w ports (Closes #9633) #9636 (duplicate-bodies: share tree helpers across eight gen_w bench ports #9633) lands; that is lag, not a defect.
• The foreign-line budget (net foreign added <= deleted) is my hand count (net 0: the t27b.py docstring was compacted to offset the flag and the workflow env lines). The own-language hook decides; I do not claim it passed.
• Other red checks on this PR (cli-tri, duplicate-bodies) are shared base failures with their own work (cli-tri: retire deleted-workflow test and refresh measured census pins #9634 for the gates.rs activation, ci: remove copied helpers from STEP1/STEP2 t27 ports #9631); this PR does not touch them.
• Known limit, not introduced here: a ledger-listed blocked spec that becomes mismatch is reported as MOVED in both modes (not red). To be filed separately if confirmed.

Dmitrii Fedorov (@dmitrii-f-t27)

[dmitrii-f-t27]

Verification of the mesh crypto fix on the CI side (head 9983c52).

The native ratchet of run https://github.com/gHashTag/t27/actions/runs/38764743137 was downloaded and read, and its source head matches this PR. The artifact row for specs/port/trios/crates/trios-mesh-node/src/crypto.t27 is:
reference: pass, t27b: pass, tests: 23, asserts: 156, detail: "".

Before the change the same spec gave 23 passing tests, 150 asserts and 1 JIT/interpreter mismatch (1-byte read at stack+0x93 of bytes never written). After it: 23 tests, 156 asserts, 0 mismatch; reference 23 of 23, 0 vacuous. The new public and digest parameters remove the test's calls to the undefined; stubs. No cryptography is implemented.

This is not a merge-ready PR. The overall native ratchet of that run still has 1 unexpected failure (rust_convert, #9632) and 158 unlisted specs, over cap 0, and three shared checks stay red: cli-tri (#9634), duplicate-bodies (#9631 and #9633) and the native ratchet (#9600). No new request to the owner is made here.

Dmitrii Fedorov (@dmitrii-f-t27)