grpc: saturate wire rung before narrowing (codex P2 #626) + repair pre-existing lab-feature breakage

codex P2: DispatchRequest.rung is a proto uint32; 'as u8' truncation made
256 wrap to Surface (the shallowest depth) where the pre-dedup match
saturated any out-of-range value to Transcendent. Fixed via
rung_from_wire_u32 (u8::try_from().unwrap_or(u8::MAX) -> from_u8) +
regression test covering the exact wrap cases (256, 257, u32::MAX).
wire.rs is unaffected (its rung field is already u8).

Verifying the fix required repairing pre-existing --features grpc
breakage (broken on the merge-base too, verified by stash-check):
- wire.rs + grpc.rs ShaderDispatch initializers missing the Pillar-7
  merge_override / alpha_saturation_override fields -> None defaults
  (the wire DTO / proto do not carry them).
- cypher_bridge.rs tests calling ContextChain::new(8) against the
  contract's zero-arg new().
Lab-feature suite now green: 186 lib tests incl. the new saturation
test; default suite still 100/100.

CodeRabbit (2 findings): plan 'Option C' label corrected to 'the dated
ADDENDUM strengthening Option B' (the issue defines only A/B). The
ISSUES.md rewrite request is declined on-thread: board files are
append-only ledgers — corrections append as dated entries, never
rewrite prior text.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.claude/plans/v3-convergence-wiring-v1.md

@@ -110,7 +110,9 @@ Recorded in `ISS-Q2-CASCADE3-NIBBLE-ANCESTRY` (board).
   (contract 763+, core 925, planner 204, arigraph 124).
 - **osint `0x0700` reconciliation:** operator decision; the two-id-spaces
   reading (classid space vs concept-vocabulary space, aliasing in the lo u16)
-  is on `ISS-OSINT-SYSTEM-ROOT-SLOT-VIOLATION` as Option C.
+  is on `ISS-OSINT-SYSTEM-ROOT-SLOT-VIOLATION` as the dated ADDENDUM
+  strengthening its Option B (the issue defines Options A/B; no separate
+  option was minted).
 - **classid human-readable reorder (`0x07:01::1000`):** DEFERRED-by-design,
   hands off until post-V3, implemented as the one flippable split-order.
 

crates/cognitive-shader-driver/src/cypher_bridge.rs

@@ -251,15 +251,15 @@ mod tests {
     /// TD-INT-6 — empty candidate list escalates.
     #[test]
     fn disambiguate_empty_candidates_escalates() {
-        let chain = ContextChain::new(8);
+        let chain = ContextChain::new();
         let result = disambiguate_parse_candidates(&chain, 0, Vec::new());
         assert!(result.is_err(), "empty candidates must escalate");
     }
 
     /// TD-INT-6 — single candidate escalates (margin = 0).
     #[test]
     fn disambiguate_single_candidate_escalates() {
-        let chain = ContextChain::new(8);
+        let chain = ContextChain::new();
         let cand = CrystalFingerprint::Binary16K(Box::new([0u64; 256]));
         let result = disambiguate_parse_candidates(&chain, 0, vec![cand]);
         assert!(result.is_err(), "single candidate must escalate");

crates/cognitive-shader-driver/src/grpc.rs

@@ -346,7 +346,7 @@ fn proto_to_dispatch(req: &pb::DispatchRequest) -> ShaderDispatch {
         })
         .unwrap_or(StyleSelector::Auto);
 
-    let rung = RungLevel::from_u8(req.rung as u8);
+    let rung = rung_from_wire_u32(req.rung);
 
     let emit = match pb::EmitMode::try_from(req.emit) {
         Ok(pb::EmitMode::Bundle) => EmitMode::Bundle,
@@ -376,6 +376,10 @@ fn proto_to_dispatch(req: &pb::DispatchRequest) -> ShaderDispatch {
         max_cycles: req.max_cycles as u16,
         entropy_floor: req.entropy_floor,
         emit,
+        // Pillar-7 knobs: the proto does not carry them; keep the documented
+        // defaults (no sink-stage merge override).
+        merge_override: None,
+        alpha_saturation_override: None,
     }
 }
 
@@ -398,3 +402,30 @@ fn unified_styles_proto() -> Vec<pb::StyleInfo> {
         })
         .collect()
 }
+
+/// Decode the proto `uint32` rung, saturating BEFORE narrowing: an
+/// out-of-range client value clamps to `Transcendent` (the pre-dedup match's
+/// `_ =>` arm), never wraps (`256 as u8 == 0` would silently run the request
+/// at `Surface`, the shallowest depth — codex P2 on #626).
+fn rung_from_wire_u32(v: u32) -> RungLevel {
+    RungLevel::from_u8(u8::try_from(v).unwrap_or(u8::MAX))
+}
+
+#[cfg(test)]
+mod rung_wire_tests {
+    use super::*;
+
+    #[test]
+    fn wire_rung_saturates_never_wraps() {
+        // In-range ordinals round-trip.
+        assert_eq!(rung_from_wire_u32(0), RungLevel::Surface);
+        assert_eq!(rung_from_wire_u32(6), RungLevel::Counterfactual);
+        assert_eq!(rung_from_wire_u32(9), RungLevel::Transcendent);
+        // Out-of-range clamps to the SAFEST maximum depth — the codex-P2
+        // wrap cases: 256 must NOT become Surface, 257 must NOT become Shallow.
+        assert_eq!(rung_from_wire_u32(10), RungLevel::Transcendent);
+        assert_eq!(rung_from_wire_u32(256), RungLevel::Transcendent);
+        assert_eq!(rung_from_wire_u32(257), RungLevel::Transcendent);
+        assert_eq!(rung_from_wire_u32(u32::MAX), RungLevel::Transcendent);
+    }
+}

crates/cognitive-shader-driver/src/wire.rs

@@ -946,6 +946,10 @@ impl WireDispatch {
             max_cycles: self.max_cycles,
             entropy_floor: self.entropy_floor,
             emit,
+            // Pillar-7 knobs: the wire DTO does not carry them; keep the
+            // documented defaults (no sink-stage merge override).
+            merge_override: None,
+            alpha_saturation_override: None,
         }
     }
 }