test: no corpus fixture for the belt apportion loop or for FIFO backlog / the four batch rules (README says #949 covers them; it does not)

[bpowers]

Two conveyor/queue corpus gaps are documented in test/conveyors/README.md but tracked by no issue. The README claims otherwise:

Known corpus gaps, all tracked as GH #949.

#949's actual scope is only <arrest>, <sample>, exponential_leak, <leak_integers/>, the §7.2 explicit init list, and a time-varying <len>. The three bullets that follow that sentence at test/conveyors/README.md:111-124 are outside it. The third (discrete="true" as a gate, not an observable) is GH #950. The first two are tracked by nothing. They are restated at docs/design/conveyors.md:1302-1304.

Both live in code paths that the conveyor-engine branch newly lowered to wasm (#922), and both are places where VM-vs-wasm parity is asserted while the underlying behavior has no independent corpus fixture. Per #951, the corpus harness's oracle is the VM, so parity green says nothing about numeric truth -- which makes an absent fixture strictly worse than a weakly-oracled one.

Gap 1: no belt has both a queue-coupled inflow and an equation-driven inflow

test/conveyors/queue_coupled_conveyor.xmile's belt has only the coupled inflow. So the rem_cap drawdown between conv_vol and the equation-driven apportion loop -- emit_phase_b_active step 4, src/simlin-engine/src/wasmgen/belt.rs:1568 -- is never exercised end to end. The README states the consequence plainly:

A fault injected into the apportion loop alone leaves that fixture green.

This is newly-written wasm lowering (#922) with zero corpus coverage of that branch.

Gap 2: no fixture exercises FIFO backlog or the four batch rules

queue_coupled_conveyor.xmile's queue carries an <overflow/>, so it drains fully every DT (queues.md §4.5) and never holds a second cohort. Backlog discipline is therefore untested, and so are all four (one_at_a_time, batch_integrity) combinations, which are compile-time-specialized in emit_take_for_conveyor (src/simlin-engine/src/wasmgen/passes.rs:682) and have unit coverage only.

test/queues/queue_wait.xmile -- the backlog oracle docs/design/queues.md §12 explicitly asks for -- does not exist. test/queues/ holds only minimal_queue.xmile and queue_drain.xmile.

Why it matters

Unit tests build their XMILE in-process via format!, so they never cross the protobuf or XMILE round-trip. The corpus harness (simulate_special_path, src/simlin-engine/tests/integration/simulate.rs) is the only thing that gates the VM, both round-trips, and the wasm blob against each other column-for-column. A writer or serializer that dropped a queue's batch attributes, or a wasm apportion loop that mis-ordered its rem_cap drawdown, would be caught by nothing in the repo.

Components

src/simlin-engine (wasmgen/belt.rs, wasmgen/passes.rs, XMILE reader/writer, protobuf serializer), test/conveyors/, test/queues/.

Suggested approach

1. Add test/queues/queue_wait.xmile: a queue with no <overflow/> whose arrival rate exceeds its service rate, so a backlog accumulates across DTs and a second cohort is held. Cover the four (one_at_a_time, batch_integrity) rules -- as four small fixtures, or one fixture per rule that differs only in those two attributes.
2. Extend queue_coupled_conveyor.xmile (or add a sibling) so the belt carries both a queue-coupled and an equation-driven inflow, exercising the rem_cap drawdown.
3. Wire each into QUEUE_CORPUS_FIXTURES / CONVEYOR_CORPUS_FIXTURES in tests/integration/simulate.rs. The assert_directory_accounted_for gate added by wasm: drop the conveyor Unsupported reject and put conveyor fixtures under the parity harness #924 already fails on an unwired file, so a fixture cannot silently not-run.
4. Verify by mutation. Perturb the apportion loop's rem_cap drawdown, and separately flip one batch rule's specialization, and confirm exactly the new fixtures go red. Per wasm: drop the conveyor Unsupported reject and put conveyor fixtures under the parity harness #924's acceptance note: adding a fixture to the corpus is not the same as running it, and a test that cannot fail is worse than a flaky one.
5. Fix the docs. Scope test/conveyors/README.md:105's "all tracked as GH test: <arrest> and <sample> have no conveyor corpus fixture (proto/XMILE round-trip untested) #949" to the first list only, and cite this issue for the two bullets that follow. Same for docs/design/conveyors.md:1302-1304.

Keep the fixtures tiny -- cargo test --workspace runs under a hard 3-minute wall-clock cap in pre-commit and CI.

How it was discovered

Identified during branch review of the conveyor-engine branch (PR #869), auditing whether every gap the docs disclose has a tracking issue behind it. These two did not. Documented is not tracked.