Release 0.7.0: v1 library, CLI and docs in 9 reviewable commits - #142

Filter invalid target lengths before starting the CLI search

For opaque HRPs near the short/long checksum boundary, the generated target lengths include forbidden expanded lengths 94 and 95. These contexts reach _prepare(), where _checksum_for_encoded_length() raises and aborts the entire search before fixed BCH correction runs. For example, a valid 90-character zz card with one substituted checksum symbol produces expanded codex32 lengths 94 and 95 are invalid instead of a correction. Validate and skip impossible target contexts, as the public unknown-length correction path already does.

Useful? React with 👍 / 👎.

AI-assisted validation: confirmed at 5fc90bc. A valid 90-character opaque zz card with one checksum substitution reaches impossible 94/95 targets and raises InvalidLength before BCH. Filter unsupported expanded lengths before constructing contexts.

Match the actual separator before accepting correction context

When the input contains another 1 after the supplied context prefix, this startswith check accepts it even though Bech32 uses the last 1 as the separator. The public correction API then treats that separator as a mutable erasure and returns an artifact in a different namespace. Reproducing with a 48-character master-seed string s, replacing s[15] with 1, and calling correct(CorrectionContext('ms', expected_length=48), damaged) returns the original ms artifact despite the entered HRP extending through position 14. Reject a syntactically present HRP/separator that disagrees with the context rather than correcting it away; the mandatory boundary contract requires this context to remain immutable.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

AI-assisted validation: confirmed at 5fc90bc. Replacing position 15 with 1 still recovers the original 48-character ms seed under CorrectionContext("ms", ...), so the entered separator is being corrected away. Keep the syntactically present separator immutable.

Share admission capacity across mixed-case interpretations

For mixed-case input, the normalized and minority-erased interpretations each call _search_many(), but _frontier() starts with a fresh admission budget every time; capture_layers accumulates accounting only after admission. Consequently, their combined admitted mass can exceed the mandatory bound of 1. For example, let s = MasterSeed.from_seed(bytes(16), identifier='test').text and correct s[:10] + 'P'*13 + s[23:] with an expected length of 48: the erased interpretation admits mass 1, the normalized interpretation admits another approximately 0.318, and the public API returns a candidate whose reported cumulative mass is approximately 1.318. Admission must consume one shared budget across both interpretations, rather than merely combining their metadata afterward.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

AI-assisted validation: confirmed at 5fc90bc. The mixed-case example reports 48,626,079,622,538,851,158 / 2^65 ≈ 1.318 cumulative mass. Both interpretations must consume one admission budget.

Preserve fixed witnesses during mixed-case optional searches

When mixed-case scheduling invokes this function with optional_only=True, the fixed-witness dictionary stays empty even though discovery already found candidates. _covered_candidates() interprets the missing witness as a completed, unsuccessful fixed decode and prunes optional layers that could improve a known candidate's rank. For example, encode bytes(range(16)) with identifier test, swap zero-based positions 11/12 and 23/34, and capitalize position 40: _scheduled_candidates() reports a complete search with capture volume 2,663,936, whereas the identical lowercase input finds the cheaper admitted explanation with volume 83,248. Carry the fixed witnesses into the optional pass, or distinguish an unavailable witness from a failed decode, so pruning preserves ranking rather than only discovery.

AGENTS.md reference: AGENTS.md:L79-L81

Useful? React with 👍 / 👎.

AI-assisted validation: confirmed at 5fc90bc. The bytes(range(16)) example ranks the same source at 2,663,936 in the mixed-case optional pass versus 83,248 lowercase. Preserve the fixed witness used by competitor pruning.

The build job executes repository code under python -m build --no-isolation while actions/checkout persists a contents: write token by default. Keep the build read-only; give write authority only to the release-upload boundary (or disable persisted credentials).