fix: harden numerical and release evidence

- Surface determinant overflow even when error-bound terms underflow.
- Measure complete benchmark operations symmetrically and bind retained reports to atomic, validated provenance.
- Fail closed on inconsistent release metadata, tags, changelog sections, Semgrep annotations, and recorded CPU provenance.
- Align docs.rs feature annotations, citation identifiers, all-target linting, and configurable property-test runs with documented contracts.

Author: acgetchell

CITATION.cff

@@ -3,13 +3,14 @@ message: "If you use this software, please cite it as below."
 type: software
 title: "la-stack: Fast, stack-allocated linear algebra for fixed dimensions in Rust"
 version: 0.4.4
-date-released: 2026-07-12
+date-released: 2026-07-13
 url: "https://github.com/acgetchell/la-stack"
 repository-code: "https://github.com/acgetchell/la-stack"
+doi: "10.5281/zenodo.18158926"
 identifiers:
-  - description: "Zenodo concept DOI (all versions)"
+  - description: "Zenodo DOI for version 0.4.4"
     type: doi
-    value: "10.5281/zenodo.18158926"
+    value: "10.5281/zenodo.21331524"
 authors:
   - family-names: "Getchell"
     given-names: "Adam"

CONTRIBUTING.md

@@ -7,7 +7,7 @@ clarity, and the fixed-dimension stack-allocation model.
 ## Getting Started
 
 Install Rust 1.97.1 through [rustup](https://rustup.rs/), Git, Python 3.14,
-[`uv` 0.12.1](https://docs.astral.sh/uv/), and `jq`. Install the repository's
+[`uv` 0.12.3](https://docs.astral.sh/uv/), and `jq`. Install the repository's
 pinned `just` version from its locked dependency graph:
 
 ```bash
@@ -109,10 +109,12 @@ For final validation of a non-core change, compose each affected surface once:
 - Examples: `just examples`
 
 Run `just ci` for core Rust, public behavior, or GitHub-equivalent validation.
-It composes leaf validators directly, runs unit and integration tests together
-once through the release-profile `test-rust-ci` bucket, and keeps doctests
-separate because nextest does not execute them. `just clippy` remains an
-optional all-target sweep outside this CI path.
+It composes leaf validators directly and runs `clippy-all-targets` to match the
+GitHub Clippy SARIF workflow. Unit and integration tests still run together once
+through the release-profile `test-rust-ci` bucket, and doctests remain separate
+because nextest does not execute them. The test, example, and benchmark buckets
+retain their execution or compile-contract roles because ordinary compilation
+does not execute Clippy lints.
 
 `la-stack` intentionally has no notebook validation bucket: the repository has
 no notebooks or supported Python binding surface. Add notebook tooling only

Cargo.lock

@@ -31,6 +31,7 @@ include = [
     "/src/**/*.rs",
     "/tests/*.proptest-regressions",
     "/tests/*.rs",
+    "/tests/common/**/*.rs",
 ]
 
 [dependencies]
@@ -82,14 +83,15 @@ codegen-units = 1
 
 [package.metadata.docs.rs]
 features = [ "exact" ]
+rustdoc-args = [ "--cfg", "docsrs" ]
 
 [lints.rust]
 warnings = { level = "deny", priority = -1 }
 unsafe_code = "forbid"
 missing_docs = { level = "deny", priority = 0 }
 dead_code = { level = "deny", priority = 0 }
 unreachable_pub = { level = "deny", priority = 0 }
-unexpected_cfgs = { level = "deny", priority = 0, check-cfg = [ 'cfg(la_stack_v0_4_3_api)' ] }
+unexpected_cfgs = { level = "deny", priority = 0, check-cfg = [ 'cfg(docsrs)', 'cfg(la_stack_v0_4_3_api)' ] }
 
 [lints.rustdoc]
 bare_urls = "deny"

Cargo.toml

@@ -515,7 +515,7 @@ across operations.
 Timings count only when the implementation preserves the documented
 correctness guarantees and invariants. Performance claims require comparable
 before-and-after evidence using the same inputs, configuration, and environment.
-This snapshot records the measured source state, CPU, operating system, Rust
+This snapshot records the measured source state, available CPU model, operating system, Rust
 toolchain, dependency lock and harness digests, Criterion command, and
 correctness-gate result in the adjacent JSON sidecar. The publication workflow
 requires complete canonical-dimension coverage and regenerates the CSV, SVG,
@@ -571,7 +571,7 @@ cargo run --features exact --example exact_solve_3x3
 A short contributor workflow:
 
 Install Rust 1.97.1 through [rustup](https://rustup.rs/), Git, Python 3.14,
-[`uv` 0.12.1](https://docs.astral.sh/uv/), and `jq`. Then install the pinned
+[`uv` 0.12.3](https://docs.astral.sh/uv/), and `jq`. Then install the pinned
 `just` release from its locked dependency graph:
 
 ```bash

README.md

@@ -50,9 +50,10 @@ See `src/exact.rs` for the full architecture description.
 
 `solve_exact()`, `solve_exact_f64()`, and `solve_exact_rounded_f64()` share the determinant
 path's exact f64 decomposition and integer scaling. Matrix and RHS entries are decomposed via
-IEEE 754 bit extraction [9]. Each collection is scaled independently to its own minimum
-exponent, producing a `BigInt` matrix and RHS without inflating one side to accommodate the
-other's range. Forward elimination runs in `BigInt` using Bareiss fraction-free updates
+IEEE 754 bit extraction [9]. Matrix and RHS scales start from their respective minimum
+exponents. When the scales differ by at most 64 bits, both sides use the lower scale to share
+common factors; larger gaps retain independent scales so one side is not inflated excessively.
+Forward elimination runs in `BigInt` using Bareiss fraction-free updates
 [7]—no `BigRational` and no GCD normalisation in the `O(D³)` phase. The upper-triangular
 result is then lifted into `BigRational` for back-substitution, where fractions are inherent
 and the cost is only `O(D²)`. Row swaps from first-non-zero pivoting are applied to both the