DOG-012 HIGH: BRAM fallback double-counts region; alignment + recursion hardening

dog/BRAM.c's bram_region (BRAM.c:114-131) silently corrupts the edit list on an inner-diff failure. When BRAMu64s fails (NOROOM/budget), it appends a wholesale DEL(olen)+INS(nlen) — but the failed recursion has usually ALREADY appended part of the region into the caller-owned edl (BRAMu64s rewinds BASS, never the edl gauge; failure can hit mid-way through bram_core steps 4/5, :301-311). The region is double-counted, bram_region returns OK, so the edit list no longer sums to the token counts and the weave/merge layer applies a WRONG diff with no error. The rollback is subtle: DIFFu64AddEntry coalesces into the previous entry (abc/DIFFx.h:12-24), so a fix must snapshot BOTH edl[0] and the trailing entry's value before recursing and restore both before the fallback. Method: Issues.

Input

Context

Double-count: BRAM.c:114-131 fallback after a partial inner append.
Misaligned typed access UB: all scratch carved a_carve(u8,…) (1-byte align,
abc/Bx.h:507) then cast to bram_line*(u64 member)/bram_pair*/u64*/u32* (BRAM.c:174-244); after the byte carves ina_buf/inb_buf (:205-206) the head has arbitrary parity → ah_a=(u64*)ah_a_buf[0] (:241) misaligned when la_n%8!=0. SIGBUS on strict-alignment targets, UBSan noise.
Unbounded mutual recursion: bram_region→BRAMu64s→bram_core→bram_region
(:127); BASS rewinds per level (MEM-018) but the C stack does not — depth bounded only by anchor nesting (worst case O(#lines)) → stack overflow.
32-bit size wrap: (na+1)*sizeof(bram_line) (:174-175, same at :188) wraps
in 32-bit before the size_t multiply; na=UINT32_MAX → zero-size carve then OOB write in bram_lines. Unreachable today (4G tokens) but wrong arithmetic.
Integrity: equality is declared purely by UNSEEDED 64-bit RAPHash (:57-82,
:222-230, :283-313) with NO byte re-check on a hash hit — unlike NEIL's NEILTokEq memcmp. A predictable collision renders a real change as DIFF_EQ, so WEAVE keeps the OLD bytes and silently drops the NEW change (~2^64 targeted, hence integrity-grade, but the missing verify is a genuine gap).

Goals

A failed inner diff leaves edl byte-identical to its pre-recursion state
before the wholesale fallback is appended (snapshot head + trailing entry).
Typed scratch carved with the element type so bAcquire alignment applies.
A depth counter bottoms out at DIFFu64s/wholesale DEL+INS past a cap.
Size arithmetic is size_t throughout.

Constraints

dog/ libdog, ABC style; diff output byte-identical for the success path.
qsort (BRAM.c:203) → abc/SORT.h (CLAUDE.md discourages stdlib) — fold in.

WIP

TODOs

T1 repro: a region that fails the inner budget mid-append; assert the edit
list still sums to token counts (currently double-counts silently).
T2 snapshot/restore edl head + trailing entry around the fallback.
T3 typed carves for alignment; size_t sizing.
T4 recursion depth cap.
T5 byte-recheck (memcmp) on a hash-equal line/token before emitting
DIFF_EQ (and/or seed RAPHash), closing the collision integrity gap.

Blockers and bummers

Audit 2026-07-07: re-verified in libdog HEAD 79612854 — bram_region fallback still appends DEL+INS with no edl rollback after a failed BRAMu64s (BRAM.c:127-131), qsort still at :203. NOTHING landed; WIP fix UNLANDED in worktree ~/src/DOG-012 (BRAM.c modified).

Outcome

OPEN — filed 2026-07-06, the libdog code-quality review session.