Rounding-Site Census (0.5.0 item 0c)

STATUS: IMPLEMENTED 2026-08-23 (stage b). Every "Change for 0c" row below has landed; tests/rounding_unification.rs gates cross-path bit-equality (sweeps + constructed exact ties) per profile, and all five profiles pass their full suites. Corrections discovered during implementation:

• Canonical decimal divide tiers 1–5 were NOT truncating; they are exact-or-rational-fallback (PrecisionLoss → symbolic), which is better than any rounding rule and was kept; only the tier-6 best-effort arm truncated, now banker's.
• decimal_to_binary_storage truncated on four arms and add-half-rounded on q16_16: unified to nearest ties-+∞ (result domain rule).
• The UGOD binary divide's old half-away adjust also mis-signed its bump for exact quotients in (−1, 0) raw units (branched on quotient < 0, which is 0 there): fixed by deriving the sign from the operands.
• Ternary Tier-4 saturating_neg → fail-loud MIN assert (0.4.33 flag).
• LU singularity nuance surfaced: exact-zero pivots for matrices with storage-inexact multipliers (e.g. pivoting on 7 → 1/7) were a truncation-cancellation coincidence; nearest leaves honest ulp noise. Tests updated: dyadic-multiplier matrices must still fail loud, the non-dyadic classic asserts an ulp-noise determinant bound.

Original census (stage a) follows.

Every rounding site that determines result bits, catalogued from source 2026-08-14. This is the evidence base for the uniform rounding policy (ROADMAP 0.5.0 item 0c): exact when representable, round once otherwise, one tie rule per domain across every path: binary nearest-ties-up, decimal banker's, ternary nearest (tie-free by theorem).

Method: exhaustive grep for round_bit / banker / bare-shift / truncating-division patterns, then source reads of every hit. Sites marked [verified] were read line-by-line; a handful are [catalogued]: located but their rule pinned down during implementation.

A. Storage-result rounding sites (the policy surface)

Binary domain: target: round-to-nearest, ties toward +∞

Headline finding: the imperative binary multiply uses THREE different rules by profile (floor / banker's / toward-zero), and the imperative divide truncates everywhere: CONTRACT.md §3 was still wrong after the 2026-08-14 correction, which had only checked the embedded kernel. §3 is re-corrected alongside this census.

Measured consequence (compact, 44,044 sampled raw pairs): imperative vs canonical storage-tier multiply differ on 48.7% of products, max 1 ulp: floor vs nearest diverges whenever the discarded bits are >= half an ulp, i.e. on ~half of all inexact products, NOT just on exotic ties. The same argument applies to divide on every profile (truncate vs half-away). Path independence for direct storage-tier mul/div is therefore materially broken today on most profiles; compound/tier-N+1 paths are unaffected (single shared downscale). This is the strongest motivation for 0c: unification does not just simplify the mental model, it REPAIRS the path-independence contract for plain arithmetic.

Decimal domain: target: banker's (half-even)

Ternary domain: target: nearest (tie-free; no rule can be needed)

Contracted exceptions (documented truncation: keep as-is)

B. Compute-tier internal roundings (absorbed by tier N+1, out of policy scope)

These round below the storage ulp and are erased by the single downscale; listed for completeness, no change:

• compute_divide: truncating (all profile arms)
• mul_to_* wide-product downscales in i512.rs/i1024.rs: ties-up round-bit
• Transcendental engine internals (exp/ln table+Taylor steps, decimal exp 4-stage, sincos reductions): various, validated end-to-end at 0 ULP
• compute.rs 18 round-bit sites: the ties-up downscale family

Blast-radius summary for 0c implementation

• Exact-ties-only changes (astronomically rare inputs): embedded imperative mul (banker's→ties-up), UGOD div (half-away→ties-up).
• Up-to-1-ulp-on-common-inputs changes (real churn, real improvement): imperative mul on realtime/compact (floor→nearest) and balanced/scientific (trunc→nearest); imperative div everywhere (trunc→nearest); canonical decimal div (trunc→banker's); ternary mul/div (trunc→nearest, <½ ulp).
• Consumers freezing hashed/persisted outputs (GeoH-class) must pin versions across the 0.5.0 boundary; the imperative-div change is the widest-reaching single item and deserves its own line in the notice.
• Every change lands with constructed-tie/cross-path equivalence tests; CONTRACT.md §3 collapses to one row per domain when done.

Appendix (0b, 2026-08-23): unsigned widening-multiply call-site audit

Classification of every mul_to_i512/i1024/i2048 caller: see ROADMAP item 0b (delivered) for the summary. Verdicts: sign-wrapped ✓ (linalg ×8, decimal_compute ×3, compute_multiply, ln's Q128/Q256/Q512 helpers, ternary 0.4.34 fixes, I2048::Mul); positive-by-construction now debug_asserted (exp chains/Taylor ×8, ln Taylor ×2, sqrt Newton via renamed _nonneg helper); shadowing hazard removed (exp+sqrt private unsigned twins of the sign-safe multiply_i1024_q512_512 renamed *_nonneg); latent sign bugs fixed in UNREACHABLE code (pow_tier_n_plus_1.rs ×3: dead module, since REMOVED per owner decision, 0.5.0). mul_i128_to_i256 verified sign-safe (explicit handling). Enforcement: tests/negative_operand_battery.rs + the debug_asserts running under every test suite on every profile.