chore: expand and clean up .claude/settings.json

- broaden the permission allowlist (git porcelain, file utils, curl)
- "preferences" key (tmux split panes, markdown responses)
- tighten the deny list (force-push, git clean, destructive rm)
- keep only permissions relevant to this repo (generic `bash scripts/*`
  covers its own scripts; no jetson/agent-swarm template entries)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/settings.json

@@ -1,10 +1,17 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "env": {
-    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
+    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1",
+    "CLAUDE_VERBOSE": "1"
   },
+  "outputStyle": "Explanatory",
   "teammateMode": "tmux",
+  "preferences": {
+    "tmuxSplitPanes": "true",
+    "responseFormat": "markdown"
+  },
   "permissions": {
+    "defaultMode": "acceptEdits",
     "allow": [
       "Bash(cmake:*)",
       "Bash(ctest:*)",
@@ -23,18 +30,56 @@
       "Bash(git branch:*)",
       "Bash(git ls-remote:*)",
       "Bash(git ls-files:*)",
+      "Bash(git remote:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(git rev-list:*)",
+      "Bash(git merge-base:*)",
+      "Bash(git diff-tree:*)",
+      "Bash(git describe:*)",
+      "Bash(git tag:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git switch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git restore:*)",
+      "Bash(git stash:*)",
+      "Bash(git fetch:*)",
+      "Bash(git pull:*)",
+      "Bash(git push:*)",
+      "Bash(git merge:*)",
+      "Bash(git rebase:*)",
+      "Bash(git worktree:*)",
+      "Bash(git init:*)",
+      "Bash(git mv:*)",
       "Bash(ls:*)",
       "Bash(find:*)",
       "Bash(grep:*)",
       "Bash(rg:*)",
       "Bash(wc:*)",
-      "Bash(curl -s*)"
+      "Bash(curl -s*)",
+      "Bash(curl:*)",
+      "Bash(bash -n:*)",
+      "Bash(cat:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(awk:*)",
+      "Bash(jq:*)",
+      "Bash(mkdir:*)",
+      "Bash(cp:*)",
+      "Bash(test:*)",
+      "Bash(echo:*)",
+      "Bash(true)"
     ],
     "deny": [
-      "Bash(git push --force* origin main*)",
-      "Bash(git push -f* origin main*)",
-      "Bash(git reset --hard*)",
-      "Bash(rm -rf /*)"
+      "Bash(git push --force:*)",
+      "Bash(git push -f:*)",
+      "Bash(git clean -fdx:*)",
+      "Bash(git clean -fd:*)",
+      "Bash(rm -rf /)",
+      "Bash(rm -rf /*)",
+      "Bash(rm -rf ~)",
+      "Bash(rm -rf ~/*)",
+      "Bash(sudo rm:*)"
     ]
   }
 }

.forgejo/workflows/cpp-tests.yml

@@ -0,0 +1,65 @@
+# Forgejo Actions — Codeberg (https://codeberg.org)
+#
+# Codeberg counterpart of the eulernest Gitea pipeline
+# (.gitea/workflows/cpp-tests.yml).  Two differences are required because
+# Codeberg's shared runners are not the Pi runner:
+#
+#   * runs-on: docker            — Codeberg shared-runner label (not "eulernest")
+#   * image:   node:20-bookworm  — public image (the private git.eulernest.eu
+#                                  ci-cpp image is unreachable from Codeberg).
+#                                  node:20 ships the Node runtime that
+#                                  actions/checkout@v4 needs; build tools are
+#                                  apt-installed in the first step.
+#
+# Scope: "test-fast" only — the pure-math suite (Eigen vendored, GoogleTest via
+# FetchContent, no CGAL/Boost).  A red job here = a red Codeberg CI badge.
+
+name: C++ Tests (Codeberg)
+
+on:
+  push:
+    branches:
+      - main
+      - "claude/**"
+      - "feature/**"
+      - "review/**"
+  pull_request:
+
+jobs:
+  test-fast:
+    runs-on: docker
+    container:
+      image: node:20-bookworm
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build deps (cmake, g++, make)
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            cmake g++ make git ca-certificates
+
+      - name: Configure (tests-only — Eigen + GoogleTest)
+        run: cmake -S code -B build -DCMAKE_BUILD_TYPE=Release
+
+      - name: Build
+        run: cmake --build build --target conformallab_tests -j$(nproc)
+
+      - name: Run tests
+        run: >
+          ctest --test-dir build
+          --output-on-failure
+          --output-junit test-results.xml
+
+      - name: Summary
+        if: always()
+        run: |
+          if [ -f build/test-results.xml ]; then f=build/test-results.xml; else f=test-results.xml; fi
+          if [ -f "$f" ]; then
+            total=$(grep -o 'tests="[0-9]*"'     "$f" | grep -o '[0-9]*' | head -1)
+            failed=$(grep -o 'failures="[0-9]*"' "$f" | grep -o '[0-9]*' | head -1)
+            skipped=$(grep -o 'skipped="[0-9]*"' "$f" | grep -o '[0-9]*' | head -1)
+            passed=$(( ${total:-0} - ${failed:-0} - ${skipped:-0} ))
+            echo "FAST  ▸ TOTAL ${total:-0} | PASSED $passed | FAILED ${failed:-0} | SKIPPED ${skipped:-0}"
+          fi

.woodpecker.yml

@@ -0,0 +1,31 @@
+# Woodpecker CI — Codeberg (https://ci.codeberg.org)
+#
+# Runs on every push / PR.  Mirrors the "test-fast" job of the
+# eulernest Gitea pipeline (.gitea/workflows/cpp-tests.yml), but uses a
+# plain public Debian image instead of the private ci-cpp registry image,
+# because Codeberg's shared runners cannot pull git.eulernest.eu.
+#
+# Pure-math test suite only (Clausen, ImLi2, hyper-ideal geometry):
+#   * Eigen is vendored      → code/deps/eigen-3.4.0
+#   * GoogleTest via FetchContent (network at configure time)
+#   * No CGAL / Boost / Wayland needed  → fast, headless, < 2 min
+#
+# A failing build or any failing ctest makes the Codeberg CI badge red.
+
+when:
+  - event: [push, pull_request]
+
+steps:
+  test-fast:
+    image: debian:bookworm
+    commands:
+      - apt-get update -qq
+      - >-
+        apt-get install -y --no-install-recommends
+        cmake g++ make git ca-certificates
+      - cmake -S code -B build -DCMAKE_BUILD_TYPE=Release
+      - cmake --build build --target conformallab_tests -j$(nproc)
+      - >-
+        ctest --test-dir build
+        --output-on-failure
+        --output-junit test-results.xml

README.md

@@ -142,6 +142,7 @@ Layout2D layout = euclidean_layout(mesh, res.x, maps);
 | **geometry-central comparison** — shared core, demarcation, adoption candidates, scientific added value | [doc/architecture/geometry-central-comparison.md](doc/architecture/geometry-central-comparison.md) |
 | **Design decisions** — key architectural choices + rationale | [doc/architecture/design-decisions.md](doc/architecture/design-decisions.md) |
 | **Project structure** — directory tree + build targets | [doc/architecture/project-structure.md](doc/architecture/project-structure.md) |
+| **CI / CD** — two-forge topology, runners, trigger keywords, mirror | [doc/architecture/ci-cd.md](doc/architecture/ci-cd.md) |
 | **Discrete conformal theory** — mathematical background for collaborators | [doc/math/discrete-conformal-theory.md](doc/math/discrete-conformal-theory.md) |
 | **Validation** — known analytic results + how to verify them | [doc/math/validation.md](doc/math/validation.md) |
 | **Validation protocol** — concrete commands with expected outputs | [doc/math/validation-protocol.md](doc/math/validation-protocol.md) |

code/include/serialization.hpp

@@ -283,8 +283,8 @@ inline void save_result_xml(
 ///  3. A line containing `<DOFVector` must carry the `>` character (tag
 ///     open) on the same line.
 ///  4. The `<DOFVector` element must be present and must produce a
-///     non-empty doubles list (a missing DOFVector silently returns an
-///     empty x, which is incorrect for any mesh with at least one DOF).
+///     non-empty doubles list (a missing DOFVector element causes a
+///     `std::runtime_error` — enforced after the parse loop).
 inline std::vector<double> load_result_xml(
     const std::string& path,
     NewtonResult*       res      = nullptr,
@@ -386,6 +386,13 @@ inline std::vector<double> load_result_xml(
                 " Only the format written by save_result_xml is supported.");
     }
 
+    // V5 rule 4: <DOFVector> must be present in every well-formed ConformalResult.
+    if (found_root && !found_dofvector)
+        throw std::runtime_error(
+            "conformallab: XML strict-subset violation in " + path
+            + ": <DOFVector> element not found. Only the format written by"
+            " save_result_xml is supported.");
+
     return x;
 }
 

doc/architecture/ci-cd.md

@@ -0,0 +1,110 @@
+# CI / CD
+
+Single source of truth for **how continuous integration is wired** across the
+two forges this project lives on. If you add, move or rename a workflow, update
+this page.
+
+## TL;DR
+
+| Forge | Remote | Role | CI system | Config | Runner |
+|---|---|---|---|---|---|
+| **eulernest Gitea** | `origin` | Authoritative gate (full test + quality suite) | Gitea Actions | `.gitea/workflows/` | self-hosted Raspberry Pi (ARM64), label `eulernest` |
+| **Codeberg** | `codeberg` | Public mirror + public build badge | Woodpecker **and** Forgejo Actions | `.woodpecker.yml`, `.forgejo/workflows/` | Codeberg shared runners, label `docker` |
+
+The two forges are connected by a one-way mirror: every push to `main` on
+eulernest is force-mirrored to Codeberg (see
+[Mirror](#mirror-eulernest--codeberg) below). Codeberg never pushes back.
+
+Why two CI systems on Codeberg? They are independent and either may be enabled
+per-repo; providing both means the public build status is green regardless of
+which one the repo has switched on. They run the **same** `test-fast` build.
+
+---
+
+## eulernest Gitea (`origin`) — the real gate
+
+Self-hosted Gitea with a single self-hosted runner: a Raspberry Pi (ARM64,
+3–4 GB RAM). Because the runner is RAM-constrained, the heavy jobs are
+**keyword-gated** (opt-in per commit) rather than run on every push.
+
+All C++ jobs use the private image `git.eulernest.eu/conformallab/ci-cpp:latest`
+(built from `.gitea/docker/Dockerfile.ci-cpp` — Ubuntu 22.04 + Node 20 + cmake +
+build-essential + libboost-dev + doxygen).
+
+### `.gitea/workflows/cpp-tests.yml`
+
+| Job | Trigger | Memory cap | What it does |
+|---|---|---|---|
+| `test-fast` | every push to `main` / `claude/**` / `feature/**` / `review/**` + every PR | 800 MB | Pure-math suite (Clausen, ImLi₂, hyper-ideal). Serial build (`-j1`) to avoid OOM. Eigen vendored, GTest via FetchContent. |
+| `test-cgal` | commit message contains **`/test-cgal`** | 2000 MB | Full CGAL suite via `LOW_MEMORY_BUILD` (`-O0`, no PCH, unity batch 1, `--no-keep-memory`). Then `check-test-counts.sh` + `try_it.sh` smoke test. |
+| `quality-gates` | commit message contains **`/quality-gates`** | 600 MB | License headers, CGAL conventions, codespell, shellcheck, coverage (gate currently in report-only mode, `SKIP_COVERAGE_GATE=1`). |
+
+> One keyword per commit — the Pi cannot sustain multiple Docker containers at
+> once (`/ci-all` was removed for this reason). Example:
+> `git commit -m "fix: correct angle formula /test-cgal"`.
+
+### Other eulernest workflows
+
+| File | Trigger | Purpose | Blocks merge? |
+|---|---|---|---|
+| `doc-build.yaml` | push to main branches + manual | Doxygen HTML + warning stats | No (`continue-on-error`) |
+| `markdown-links.yml` | push + weekly cron (Mon 05:00 UTC) + manual | Link-rot check across docs | Yes on push |
+| `doxygen-pages.yml` | manual only | Publish Doxygen HTML to Codeberg Pages (`tmoussa.codeberg.page/ConformalLabpp/`) | n/a |
+| `perf-compile-time.yml` | manual only | Compile-time benchmark | n/a |
+| `mirror-to-codeberg.yml` | push to `main` | Mirror all branches to Codeberg (see below) | n/a |
+
+---
+
+## Codeberg (`codeberg`) — public mirror CI
+
+Codeberg's shared runners **cannot** pull the private `ci-cpp` image and are not
+the `eulernest` Pi, so the Codeberg configs differ from Gitea in exactly two
+ways:
+
+1. **Runner label** `docker` (Codeberg shared runners), not `eulernest`.
+2. **Public base image**, with build tools `apt`-installed at run time:
+   - Woodpecker: `debian:bookworm`
+   - Forgejo Actions: `node:20-bookworm` (Node is needed by
+     `actions/checkout@v4`; cmake/g++/make are installed in the first step).
+
+Both run **only** `test-fast` — the pure-math suite. No CGAL/Boost/Wayland, so
+they are fast (< 2 min) and headless. Eigen is vendored, GoogleTest is fetched
+at configure time (Codeberg runners have network). A failing build or any
+failing `ctest` turns the public CI badge red.
+
+| File | CI system | Enable via |
+|---|---|---|
+| `.woodpecker.yml` | Woodpecker | https://ci.codeberg.org → enable repo |
+| `.forgejo/workflows/cpp-tests.yml` | Forgejo Actions | repo *Settings → Actions* (shared runner label `docker`) |
+
+> These configs are committed in the repo and reach Codeberg through the mirror
+> — they are not maintained separately on Codeberg.
+
+---
+
+## Mirror (eulernest → Codeberg)
+
+`.gitea/workflows/mirror-to-codeberg.yml` runs on every push to `main` and does
+a `git push --mirror` from eulernest to
+`codeberg.org/TMoussa/ConformalLabpp.git`. It uses two secrets:
+
+- `MIRROR_TOKEN` — read access to the eulernest source repo.
+- `CODEBERG_TOKEN` — push access to the Codeberg mirror.
+
+The mirror is **one-way and authoritative-from-eulernest**: do not commit
+directly on Codeberg, it will be overwritten on the next mirror run.
+
+---
+
+## The one rule
+
+> **eulernest is the gate, Codeberg is the shop window.**
+> Merge decisions are made on eulernest CI (full suite). Codeberg CI exists so
+> the public repo also shows a green/red build status to outside readers.
+
+## See also
+
+- [dependencies.md](dependencies.md) — what each build mode requires.
+- [project-structure.md](project-structure.md) — where the test targets live.
+- [../api/tests.md](../api/tests.md) — per-suite test counts CI checks against.
+- [../contributing.md](../contributing.md) — the git workflow that feeds CI.

doc/contributing.md

@@ -13,11 +13,12 @@ with English.
 ## Git workflow
 
 - `main` is protected on `origin` (Gitea). Push to `dev`, then open a pull request.
-- `codeberg/main` can be pushed to directly (public mirror, no CI).
+- `codeberg/main` is the public mirror. It now also runs CI of its own
+  (Woodpecker + Forgejo Actions) — see [architecture/ci-cd.md](architecture/ci-cd.md).
 - Both remotes must stay in sync after every significant change:
   ```bash
-  git push origin HEAD:dev   # triggers CI
-  git push codeberg main     # updates public mirror
+  git push origin HEAD:dev   # triggers eulernest CI (full suite, keyword-gated CGAL)
+  git push codeberg main     # updates public mirror → triggers Codeberg CI (test-fast)
   ```
 - Branch naming: `feature/<topic>`, `fix/<topic>`, `phase<N>-<topic>`
 
@@ -25,17 +26,30 @@ with English.
 
 ## CI
 
-Two jobs run on push to `dev`/`main` or on pull requests:
+The project runs CI on **two forges**. Full topology, runners, images and
+trigger keywords are documented in [architecture/ci-cd.md](architecture/ci-cd.md).
+
+**eulernest Gitea** (`origin`, self-hosted Raspberry Pi / ARM64) — the
+authoritative gate. On push to `dev`/`main` or a pull request:
 
 | Job | What it tests | Trigger |
 |---|---|---|
 | `test-fast` | pure-math tests, no Boost | all branches |
-| `test-cgal` | full CGAL test suite | `main`, `dev`, PRs only |
+| `test-cgal` | full CGAL test suite | commit message contains `/test-cgal` |
+| `quality-gates` | license / codespell / shellcheck / CGAL conventions | commit message contains `/quality-gates` |
 
-A PR is ready to merge when both jobs pass.
+A PR is ready to merge when `test-fast` (and, for CGAL-touching work,
+`test-cgal`) pass. See `.gitea/workflows/cpp-tests.yml` and
+`.gitea/docker/Dockerfile.ci-cpp`.
 
-The runner is a self-hosted Raspberry Pi (ARM64). See `.gitea/workflows/cpp-tests.yml`
-and `.gitea/docker/Dockerfile.ci-cpp`.
+**Codeberg** (`codeberg`, public mirror, shared runners) — a lightweight
+`test-fast` mirror so the public repo also shows a build status. Defined twice,
+once per CI system Codeberg offers:
+
+| File | CI system |
+|---|---|
+| `.woodpecker.yml` | Woodpecker CI (ci.codeberg.org) |
+| `.forgejo/workflows/cpp-tests.yml` | Forgejo Actions |
 
 ---
 

doc/reviewer/finding-orchestration.md

@@ -70,10 +70,10 @@ Status: ✅ done · ⬜ open (actionable) · ⏸ deferred (intentional) · ⛔ b
 | I1 | test-cov | 🟡 | ✅ | Opus | S2 |
 | H1 | test-cov | 🔵 | ✅ | Opus | S2 |
 | N7 | numerics | 🔵 | ✅ | Opus | S2 |
-| **H3** | test-cov | 🔵 | ⬜ | Sonnet→🔍Opus | **S3** |
-| **H4** | test-cov | 🔵 | ⬜ | Sonnet→🔍Opus | **S3** |
-| **H5** | test-cov | 🔵 | ⬜ | Sonnet→🔍Opus | **S3** |
-| **V5, V6** | input-val | 🔵 | ⬜ | Sonnet→🔍Opus | **S3** |
+| **H3** | test-cov | 🔵 | ✅ | Sonnet→🔍Opus | **S3** |
+| **H4** | test-cov | 🔵 | ✅ | Sonnet→🔍Opus | **S3** |
+| **H5** | test-cov | 🔵 | ✅ | Sonnet→🔍Opus | **S3** |
+| **V5, V6** | input-val | 🔵 | ✅ | Sonnet→🔍Opus | **S3** |
 | **N2** | numerics | 🟡 | ⬜ | Haiku→🔍Opus | **S4** |
 | **thread-safety doc** | thread-safety | 🟡 | ⬜ | Haiku→🔍Opus | **S4** |
 | **M3** | math-cite | 🟡 | ⬜ | Haiku→🔍Opus | **S4** |
@@ -126,14 +126,18 @@ CGAL result types (`Conformal_map_result`, `Hyper_ideal_map_result`,
 
 </details>
 
-### ⬜ S3 — Robustness & test-gap closure (Sonnet → 🔍 Opus)
-- **H3** — `enforce_gauss_bonnet` reports the magnitude of the applied correction.
-- **H4** — test `reduce_to_fundamental_domain` boundary `Im(τ)==0.0`.
-- **H5** — integration test for the degenerate-triangle path in the Newton solve.
-- **V5** — make the hand-rolled XML reader *reject* reformatted-but-valid XML
-  instead of silently mis-reading it into zeros.
-- **V6** — DOF-vector-vs-mesh size check on load.
-- **🔍 Opus review:** verify the new rejections don't break valid round-trips.
+### ✅ S3 — Robustness & test-gap closure (DONE, 2026-06-01, Sonnet impl + Opus review)
+Implementation shipped in commit `135bcf0` (included in P1 merge `bd613a6`).
+Follow-up commit closes the doc-tracker gap and fixes dead `found_dofvector` variable
+(V5 rule 4: `<DOFVector>` missing now throws instead of silently returning empty `x`).
+- **H3** — `enforce_gauss_bonnet` returns `|deficit|` (both overloads); 3 new tests.
+- **H4** — `ReduceToFD_ThrowsForRealAxisBoundary` covers `Im(τ)==0.0` exact boundary.
+- **H5** — 2 integration tests: sliver triangle (no crash/NaN) + exact-degenerate collinear.
+- **V5** — `load_result_xml` rejects non-conforming XML (3 strict-subset checks); canonical
+  round-trip regression test passes. V5 rule 4 (`<DOFVector>` must be present) now enforced.
+- **V6** — `check_dof_vector_size(x, expected, context)` throws on mismatch; 3 new tests.
+- **🔍 Opus review:** CHANGES-REQUESTED resolved — implementation correct; code commits
+  were redundant with `135bcf0` on main; doc follow-up applied on `chore/s3-followup`.
 
 ### ⬜ S4 — Documentation & citations (Haiku → 🔍 Opus)
 - **N2** — `doc/math/tolerances.md`: every numerical threshold, its role, and

doc/reviewer/input-validation-audit-2026-05-31.md

@@ -12,9 +12,12 @@ Status legend: 🔴 Critical · 🟡 Important · 🔵 Polish
 
 > **✅ Resolution status (2026-05-31, Session 1):** **V1/V2/V4 ✅** (JSON parse +
 > field checks, XML stoi/stod guarded — all surface as `std::runtime_error` with
-> path), **V3 ✅** (NaN/Inf vertex-coordinate guard in `load_mesh`). **V5** (XML
-> strict-reject) and **V6** (DOF-size check) **open** — scheduled S3 in
-> [`finding-orchestration.md`](finding-orchestration.md). 298/298 tests green.
+> path), **V3 ✅** (NaN/Inf vertex-coordinate guard in `load_mesh`).
+> **V5/V6 ✅** (2026-06-01, S3): `load_result_xml` now enforces a strict
+> internal-only XML subset (three format checks; non-conforming files throw
+> `runtime_error` instead of silently returning zeros); `check_dof_vector_size`
+> helper added for the DOF-count mismatch check at call sites.  6 new tests.
+> See [`finding-orchestration.md`](finding-orchestration.md). 313/313 tests green.
 
 > **Threat model:** this is a scientific library, not a network service, so the bar
 > is "fail cleanly and diagnosably", not "resist attackers". But meshes and result

doc/reviewer/test-coverage-error-handling-audit-2026-05-31.md

@@ -19,9 +19,11 @@ Status legend: 🔴 Critical · 🟡 Important · 🔵 Hint / nice-to-have
 > **I2/I3/I4 ✅** (serialization / mesh / spherical-hessian negative tests),
 > **H2 ✅** (five Newton loops unified into `newton_core`, folding in B2/B3/B4/B5).
 > **I1 ✅** (`NewtonStatus` enum) + **H1 ✅** (iteration count) done in S2.
-> **Open:** **H3/H4/H5** → S3; **I5** (coverage on full suite, un-gates the
-> 80/70/90 threshold) → S5.
-> See [`finding-orchestration.md`](finding-orchestration.md). 298/298 tests green.
+> **H3/H4/H5 ✅** (2026-06-01, S3): `enforce_gauss_bonnet` returns `|deficit|`;
+> `ReduceToFD_ThrowsForRealAxisBoundary` test added; two degenerate-triangle
+> integration tests characterize the Newton solver's behavior.
+> **Open:** **I5** (coverage on full suite, un-gates the 80/70/90 threshold) → S5.
+> See [`finding-orchestration.md`](finding-orchestration.md). 313/313 tests green.
 
 > **Note:** This audit is complementary to `external-audit-2026-05-30.md` (which
 > covers port-faithfulness bugs). There is no overlap in findings — this one is