Refactor/445 realization validation

.config/nextest.toml

@@ -45,6 +45,14 @@ path = "test-results/junit.xml"
 store-success-output = false
 store-failure-output = true
 
+[profile.debug]
+# Debug assertions and overflow checks make exact-geometry paths slower than
+# their release counterparts. Keep a finite watchdog without weakening CI's
+# release/default 10-second budget.
+inherits = "ci"
+retries = 0
+slow-timeout = { period = "60s", terminate-after = 1 }
+
 [profile.coverage]
 # Coverage runs execute LLVM-instrumented binaries in parallel, so exact
 # predicate regressions need more headroom than the normal CI profile while

.github/actions/setup-just/action.yml

@@ -0,0 +1,51 @@
+name: Set up just
+description: Resolve the pinned just version from justfile and install it.
+
+outputs:
+  version:
+    description: Resolved just version from justfile.
+    value: ${{ steps.resolve.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve just version
+      id: resolve
+      shell: bash
+      run: |
+        set -euo pipefail
+        shopt -s extglob
+
+        version=""
+        declaration_re='^[[:space:]]*just_version[[:space:]]*:=[[:space:]]*(.*)$'
+        while IFS= read -r line; do
+          if [[ "$line" =~ $declaration_re ]]; then
+            value="${BASH_REMATCH[1]}"
+            value="${value%%#*}"
+            value="${value##+([[:space:]])}"
+            value="${value%%+([[:space:]])}"
+
+            if [[ ${#value} -ge 2 ]]; then
+              first="${value:0:1}"
+              last="${value: -1}"
+              if [[ "$first" == "$last" && ( "$first" == '"' || "$first" == "'" ) ]]; then
+                value="${value:1:${#value}-2}"
+              fi
+            fi
+
+            version="$value"
+            break
+          fi
+        done < justfile
+
+        if [[ -z "$version" ]]; then
+          echo "::error::Could not resolve just_version from justfile"
+          exit 1
+        fi
+
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    - name: Install just
+      uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+      with:
+        tool: just@${{ steps.resolve.outputs.version }}

.github/workflows/audit.yml

@@ -4,13 +4,19 @@ on:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
+      - .github/actions/setup-just/action.yml
+      # Run if tool-version source changes
+      - justfile
       # Run on changed dependencies
       - "**/Cargo.toml"
       - "**/Cargo.lock"
   pull_request:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
+      - .github/actions/setup-just/action.yml
+      # Run if tool-version source changes
+      - justfile
       # Run on changed dependencies
       - "**/Cargo.toml"
       - "**/Cargo.lock"
@@ -29,8 +35,6 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    env:
-      CARGO_AUDIT_VERSION: "0.22.2"
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -43,6 +47,23 @@ jobs:
           cache-bin: false
           # toolchain, components, etc. are specified in rust-toolchain.toml
 
+      - name: Set up just
+        uses: ./.github/actions/setup-just
+
+      - name: Resolve cargo-audit version
+        id: cargo_audit_version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          version="$(just --evaluate cargo_audit_version)"
+          if [[ -z "$version" ]]; then
+            echo "::error::Could not resolve cargo_audit_version from justfile"
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Cache audit database
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
@@ -53,7 +74,7 @@ jobs:
       - name: Install cargo-audit
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-audit@${{ env.CARGO_AUDIT_VERSION }}
+          tool: cargo-audit@${{ steps.cargo_audit_version.outputs.version }}
 
       - name: Run cargo audit
         run: |

.github/workflows/benchmarks.yml

@@ -13,6 +13,9 @@ on:
       - main
     # Only run on changes that could affect performance
     paths:
+      - ".github/workflows/benchmarks.yml"
+      - ".github/actions/setup-just/action.yml"
+      - "justfile"
       - "src/**"
       - "benches/**"
       - "Cargo.toml"
@@ -24,6 +27,9 @@ on:
       - main
     # Only run on changes that could affect performance
     paths:
+      - ".github/workflows/benchmarks.yml"
+      - ".github/actions/setup-just/action.yml"
+      - "justfile"
       - "src/**"
       - "benches/**"
       - "Cargo.toml"
@@ -42,8 +48,7 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  UV_VERSION: "0.11.27"
-  BENCHMARK_TIMEOUT: 1800 # 30 min; pre-computed seeds + reduced 5D counts keep runtime well under this
+  BENCHMARK_TIMEOUT_SECONDS: 1800 # 30 min; pre-computed seeds + reduced 5D counts keep runtime well under this
   DELAUNAY_BENCH_DISCOVER_SEEDS_LIMIT: 256 # fallback only; ci_performance_suite uses pre-computed seeds
 
 jobs:
@@ -64,10 +69,28 @@ jobs:
           cache-bin: false
           # Toolchain from rust-toolchain.toml.
 
+      - name: Set up just
+        id: setup_just
+        uses: ./.github/actions/setup-just
+
+      - name: Resolve uv version
+        id: uv_version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          version="$(just --evaluate uv_version)"
+          if [[ -z "$version" ]]; then
+            echo "::error::Could not resolve uv_version from justfile"
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Install uv (Python package manager)
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.uv_version.outputs.version }}
 
       - name: Verify uv installation
         run: uv --version
@@ -170,7 +193,7 @@ jobs:
 
           uv run benchmark-utils compare \
             --baseline "baseline-artifact/baseline_results.txt" \
-            --bench-timeout "${BENCHMARK_TIMEOUT}"
+            --bench-timeout "${BENCHMARK_TIMEOUT_SECONDS}"
       - name: Classify benchmark comparison outcome
         if: env.BASELINE_EXISTS == 'true' && env.SKIP_BENCHMARKS == 'false'
         env:

.github/workflows/ci.yml

@@ -22,14 +22,6 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  CARGO_NEXTEST_VERSION: "0.9.140"
-  DPRINT_VERSION: "0.55.1"
-  JUST_VERSION: "1.55.1"
-  RUMDL_VERSION: "0.2.28"
-  TAPLO_VERSION: "0.10.0"
-  TYPOS_VERSION: "1.48.0"
-  UV_VERSION: "0.11.27"
-  ZIZMOR_VERSION: "1.26.1"
 
 jobs:
   build:
@@ -69,61 +61,76 @@ jobs:
           cache-bin: false # Avoid restoring stale rustup/cargo shims from cache.
       # toolchain, components, etc. are specified in rust-toolchain.toml
 
+      - name: Set up just
+        id: setup_just
+        uses: ./.github/actions/setup-just
+
+      - name: Export tool versions
+        id: tool_versions
+        shell: bash
+        run: |
+          {
+            echo "CARGO_NEXTEST_VERSION=$(just --evaluate nextest_version)"
+            echo "DPRINT_VERSION=$(just --evaluate dprint_version)"
+            echo "RUMDL_VERSION=$(just --evaluate rumdl_version)"
+            echo "TAPLO_VERSION=$(just --evaluate taplo_version)"
+            echo "TYPOS_VERSION=$(just --evaluate typos_version)"
+            echo "UV_VERSION=$(just --evaluate uv_version)"
+            echo "ZIZMOR_VERSION=$(just --evaluate zizmor_version)"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version-file: ".python-version"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.tool_versions.outputs.UV_VERSION }}
           enable-cache: true
 
       - name: Sync Python tooling
         run: uv sync --locked --group dev
 
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ env.JUST_VERSION }}
-
       - name: Install cargo-nextest
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
+          tool: cargo-nextest@${{ steps.tool_versions.outputs.CARGO_NEXTEST_VERSION }}
 
       - name: Install rumdl (for Markdown linting)
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: rumdl@${{ env.RUMDL_VERSION }}
+          tool: rumdl@${{ steps.tool_versions.outputs.RUMDL_VERSION }}
 
       - name: Install dprint (for YAML formatting)
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: dprint@${{ env.DPRINT_VERSION }}
+          tool: dprint@${{ steps.tool_versions.outputs.DPRINT_VERSION }}
 
       - name: Install typos-cli
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: typos-cli@${{ env.TYPOS_VERSION }}
+          tool: typos-cli@${{ steps.tool_versions.outputs.TYPOS_VERSION }}
 
       - name: Install taplo (for TOML formatting and linting)
         id: install-taplo
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: taplo-cli@${{ env.TAPLO_VERSION }}
+          tool: taplo-cli@${{ steps.tool_versions.outputs.TAPLO_VERSION }}
 
       - name: Install taplo on Windows after cached install failure
         if: matrix.os == 'windows-latest' && steps.install-taplo.outcome == 'failure'
         shell: pwsh
         run: cargo install --locked taplo-cli --version $env:TAPLO_VERSION
+        env:
+          TAPLO_VERSION: ${{ steps.tool_versions.outputs.TAPLO_VERSION }}
 
       - name: Install zizmor
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: zizmor@${{ env.ZIZMOR_VERSION }}
+          tool: zizmor@${{ steps.tool_versions.outputs.ZIZMOR_VERSION }}
 
       - name: Run CI checks
         run: just ci

.github/workflows/codecov.yml

@@ -20,10 +20,6 @@ jobs:
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
-    env:
-      CARGO_LLVM_COV_VERSION: "0.8.7"
-      JUST_VERSION: "1.55.1"
-      NEXTEST_VERSION: "0.9.140"
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -38,23 +34,30 @@ jobs:
           cache-bin: false
           # toolchain, components, etc. are specified in rust-toolchain.toml
 
+      - name: Set up just
+        id: setup_just
+        uses: ./.github/actions/setup-just
+
+      - name: Export coverage tool versions
+        id: tool_versions
+        run: |
+          {
+            echo "CARGO_LLVM_COV_VERSION=$(just --evaluate cargo_llvm_cov_version)"
+            echo "CARGO_NEXTEST_VERSION=$(just --evaluate nextest_version)"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Install LLVM coverage tools
         run: rustup component add llvm-tools-preview
 
       - name: Install cargo-llvm-cov
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}
-
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ env.JUST_VERSION }}
+          tool: cargo-llvm-cov@${{ steps.tool_versions.outputs.CARGO_LLVM_COV_VERSION }}
 
       - name: Install cargo-nextest
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-nextest@${{ env.NEXTEST_VERSION }}
+          tool: cargo-nextest@${{ steps.tool_versions.outputs.CARGO_NEXTEST_VERSION }}
 
       - name: Verify cargo-nextest
         run: cargo nextest --version

.github/workflows/generate-baseline.yml

@@ -26,7 +26,6 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  UV_VERSION: "0.11.27"
   # Seed search limit for both old (pre-v0.8) and current env var names.
   # Old tags read DELAUNAY_BENCH_SEED_SEARCH_LIMIT; current code reads
   # DELAUNAY_BENCH_DISCOVER_SEEDS_LIMIT. Setting both ensures backward
@@ -55,10 +54,28 @@ jobs:
           cache-bin: false
           # Toolchain from rust-toolchain.toml
 
+      - name: Set up just
+        id: setup_just
+        uses: ./.github/actions/setup-just
+
+      - name: Resolve uv version
+        id: uv_version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          version="$(just --evaluate uv_version)"
+          if [[ -z "$version" ]]; then
+            echo "::error::Could not resolve uv_version from justfile"
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Install uv (Python package manager)
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.uv_version.outputs.version }}
           enable-cache: false
 
       - name: Verify uv installation