Independent tile polygon repair

The implementation replaces the deferred tile-grid repair formerly in crates/terrio/src/tiles/valid.rs. The public ops/topology.rs operation is a separate path and is outside this replacement. The behavioral contract is in the specification. This record preserves the implementation's provenance; the one-off agent launcher and package scaffold are not part of Terrio's maintained tooling. Runtime and regression tests do not depend on an AI provider, a sandbox launcher or login credentials. The specification's original observation filename now refers to the unchanged canonical fixture at crates/terrio/tests/data/make-valid.json.

Information boundary and authorship

The implementer was configured as Claude Opus 5.5 (claude-opus-5-5 without fallback) in a fresh process without inherited transcripts or saved project state. Its checked isolation boundary excluded the original checkout, repository history, host home, other conversations, browser and MCP access. Approved inputs were the behavioral specification, recorded observations, reference adapters, compiler tools, vendored dependencies and hashed executable reference libraries. Reference implementations were executed through public APIs, not supplied as source. The exposure summary records the reported access and its limits.

The implementer authored the replacement kernel, design and original tests. The source-exposed custodian authored the behavioral package, reference adapter and production integration. The custodian supplied an error-policy and fallible API decision, not a repair algorithm from the retired source.

The original run identifier, isolation/transport setup and authentication history are retained in the pinned historical integration record. They describe the completed implementation run, not tooling contributors must operate or maintain. The launcher, gateway and handoff scaffold are absent from the maintained tree. No credential file or token value was included in the PR.

These are documented task-local access and provenance controls. They cannot establish what a pretrained model previously encountered or constitute a legal opinion about the repository as a whole.

Production integration

The entire 628-line legacy tiles/valid.rs was removed, including its graph/face machinery, ordering code, orientation/envelope helpers and shared grid index. The JTS-derived validity checker remains separate and imports only plain point and polygon aliases from the new module. The existing clipping-failure predictor now obtains envelope candidate pairs through the already installed rstar dependency. No repair dependency was added.

The production repair uses try_make_valid, returning an explicit error for internal invariant failures. That error propagates through polygon encoding, per-tile preparation and cut_layers to the writer. The harness's infallible, panicking compatibility wrapper is absent from production. The polygon encoder also checks all signed cursor deltas: full-range inputs that cannot be encoded fail with InvalidData instead of overflowing arithmetic. A regression exercises both overflowing directions and the representable signed endpoints.

The import ledger records original and production hashes and the complete source retirement boundary. The three kernel module files were compared against the final implementer delivery after changing only crate imports to super and applying rustfmt. The fallible repair entry point's body was checked for exact equality. The custodian authored the caller error propagation, checked encoder arithmetic, R-tree adapter and test wiring.

Review follow-up adds checks outside the delivered kernel: tiles/repair_checks.rs compares complete fixture rings after normalizing ring starts, directions and polygon/hole order, preserving connectivity and grouping. Valid-input fixtures are excluded from that exact comparison because their contract permits added contact nodes. A writer-entry regression also checks propagation of unsupported coordinate deltas with large extent and buffer options. The delivered kernel and its original tests remain unchanged.

Final PR packaging rechecked every source hash against the sealed delivery archive (SHA256 5257385a86089d787eee6adf80102872d5fd84c3e0858828bc2ccac1a99cc1ab). The original ledger had retained an earlier hash for the standalone test file; the ledger now records the final archive hash and preserves the previous value explicitly. No production kernel or test code changed in that correction. All three runtime kernel modules were also compared mechanically against the archive after only the documented import changes and rustfmt.

Both root and crate NOTICE files now identify this independent MIT implementation separately from the JTS ports. The earlier JTS record retains its historical scope and points here for the later repair replacement.

Implementer delivery and checks

The original design, exposure summary and pinned original, standalone validation, approved manifest, run metadata and process-control message are preserved, with verbose one-off setup records pinned to the original reviewed commit. The implementation brief and custodian interface decision are also historical evidence, removed from the maintained tree. The custodian process research and package-preparation checks are historical references rather than setup instructions for Terrio contributors. Historical links use the upstream repository's immutable commit URLs. The linked records were retrieved through upstream and checked byte-for-byte against the retained commits; contributors do not need the personal fork to read them. The standalone validation predates production integration and its outstanding integration list is historical; the production results below apply.

The independent design uses an exact planar arrangement, rational intersection nodes, exact wide-product comparisons, deterministic graph traversal and an iterative face fill. Conversion to binary64 occurs at the output boundary. Only Rust's standard library is used by the kernel.

These local stress measurements establish completion and resource observations, not reference agreement. The optional reference comparison of those largest inputs was interrupted after several CPU minutes, before a result, and is explicitly incomplete. The control message provided only process priorities and the fallible interface decision, with no algorithm or prohibited source.

The retained kernel's notes/design.md reference names its original delivery path; that document is packaged here as docs/make-valid-clean-room/design.md. Its complexity section states the quadratic worst case for iterative fill: each pass traces the current rotation, and the number of passes is bounded by the edge count. The source comment gives the cost per iteration, not the total. The stress record includes 401 iterations for crossing squares/diamonds (9.3 s) and 467 for a dense random ring (47.6 s). The delivered kernel and its original tests remain unchanged.

Production validation

The production evidence preserves exact commands, artifact/data hashes, initial failures and the final classifications.

The first broad integration attempt failed on three absent external fixtures (landsat.mbtiles, countries_mvt.mbtiles, cb_2018_us_zcta510_500k.pmtiles) and an Antarctica coordinate outside Web Mercator. The retained final run uses the documented countries subset without Antarctica and names the three excluded tests explicitly. Those missing tests are not claimed as passes. The five other JTS behavior regressions and the repair-specific real-data comparisons ran.

GDAL comparison classifications. Countries match at zooms 0–6. Counties were checked at zooms 0–3, comparing 13,930 feature instances; countries account for 4,122 feature instances. The writer's existing synthetic clipping differences remain unchanged at 25 feature-key/zoom combinations; actual geometries were checked against frozen baseline outputs, rather than waiving a list of IDs.

Seven county feature instances, across six key/zoom combinations, have a separate invalid collinear-ring ordering difference. Each contains a ring that becomes collinear after integer truncation. The oriented integer ring multisets are exactly identical, and polygon groupings of every non-collinear ring agree. GDAL associates the zero-area collinear ring with a different preceding polygon because the independent implementation enumerates polygons differently. One reference decode consequently reports negative area; its geometry is already invalid. These cases are reported as serialization differences, not as valid geometry matches or silently treated as unchanged baseline output.

The initial strict comparison rejected those six keys. The final comparator adds only the explicit collinear-ring classification: both geometries must be invalid, coordinates must reconstruct the exact tile grid, all oriented rings and multiplicities must match, and non-collinear polygon groupings must match. It cannot waive a changed nonzero hole or missing ring. Nine positive/negative controls exercise those restrictions. The original failed report is retained. The 16 reference-invalid county feature instances remain labelled invalid.

All original 51 kernel observations and their 50 supported encoder comparisons still pass the unchanged standalone replay. The collinear-ring classification changes only the additional production comparison's handling of undefined invalid decoded geometry; the repair implementation and recorded fixtures were not edited in response.

Scope and limitations

The compatibility target is the polygonal content of GEOS 3.14.1 linework repair for integer tile inputs. Polygon/ring enumeration and ring starts are not a compatibility requirement. Kernel tolerances are those in the specification; the encoder comparisons use exact integer geometry and feature presence.

Full-range i32 inputs remain useful kernel tests but are not universally encodable with signed 32-bit cursor deltas. The eight candidate-only overflow cases remain output-order differences from the reference; production now returns an error on such an unsupported delta. No claim of matching the reference's private traversal order is made. The implementer's validation also records the edge case of distinct exact nodes coalescing under binary64 rounding, and unguarded allocator exhaustion. A subsequent integer-input regression reaches the rounding case: a self-crossing ring has four polygonal components near the origin, including a triangle of area about 8.3e-18. Translating it by 1e9 makes that triangle's three exact nodes round to one binary64 point. Executable GEOS 3.14.1 and the replacement both return three polygons; the integration regression requires exact normalized coordinates and ring connectivity for both offsets. This confirms one reachable case, not every possible rounding collision. The MSRV 1.90 toolchain was not available; builds used the installed Rust 1.99 toolchain.

The existing pre-quantization clipping-failure heuristic and other geometry operations retain their documented scope. This replacement does not certify every possible geometry, every GEOS version or the rest of Terrio's licensing.