[WIP 0.71.0] numpy.ma, np.emath and 48 new np.* functions, NumPy-parity fixes, ParquetNet interop, oracle expansion

.claude/skills/oracle/SKILL.md

@@ -48,7 +48,8 @@ in `test/NumSharp.Tests.Oracle/Fuzz/`. (Two *sibling* oracles — flags & layout
 | Harness | `test/NumSharp.Tests.Oracle/Fuzz/{BitDiff,Shrinker}.cs` | Bit-exact compare (NaN tokenized *except* the contractual complex-unary NaN sign; Decimal by value) / shrink to 1 element. |
 | Harness | `test/NumSharp.Tests.Oracle/Fuzz/MisalignedRegistry.cs` | The excused, documented divergences (`Classify(...)` → reason string). |
 | Harness | `test/NumSharp.Tests.Oracle/Fuzz/{OracleSurfaceCoverageTests,OracleCoverageStrengthTests,Journey3TouchedOracleCoverageTests}.cs` | Coverage gates: public-surface inventory / ≥4-cases-per-op / 186 journey3 callables. |
-| Harness | `test/NumSharp.Tests.Oracle/Fuzz/{UndisposedIntermediateTests,NativeAllocationChokepointTests,ScopeAudit}.cs` | **Oracle-FREE leak gates that replay the same corpus through `OpRegistry`** — buffer-pool balance + raw-alloc chokepoint. Adding an op enters these too (see gotchas). |
+| Harness | `test/NumSharp.Tests.Oracle/Fuzz/{UndisposedIntermediateTests{,.Families,.Backend,.Catalogue,.Properties},NativeAllocationChokepointTests,ScopeAudit}.cs` | **Oracle-FREE leak gates that replay the same corpus through `OpRegistry`** — buffer-pool balance over the ordinary/masked/index tiers + every error path, a backend (OpenBLAS) pass, a direct catalogue, a property/field read gate, and the raw-alloc chokepoint. Adding an op enters these too (see gotchas). |
+| Harness | `test/NumSharp.Tests.Oracle/Fuzz/{LeakSurfaceCoverageTests,LeakCatalogue{,.NDArray,.Masked}}.cs` | The leak COMPLETENESS gate (every public member — ApiInventory modules, operators, object surfaces — must be leak-MEASURED somewhere) + the catalogue of direct invocations for members no corpus row reaches. |
 | Harness | `test/NumSharp.Tests.Oracle/Fuzz/{BlasBackendDeltaTests,MatmulParityPin,BlasEngineAutoInstallGuard}.cs` | Managed/OpenBLAS two-pass delta + the host-pin (BLAS-off by default). |
 | Corpus | `test/NumSharp.Tests.Oracle/Fuzz/corpus/**/*.jsonl` | The committed corpus (**~118K rows across 68 files** at 2026-09; grows per regeneration). The csproj glob `Fuzz\corpus\**\*.jsonl` copies it — incl. any `regressions/` — to test output. |
 
@@ -71,7 +72,14 @@ in `test/NumSharp.Tests.Oracle/Fuzz/`. (Two *sibling* oracles — flags & layout
   ≥1 changing axis; all 186 journey3-touched callables have a direct case. A new unclassified API fails here.
 - **`UndisposedIntermediateTests` / `NativeAllocationChokepointTests`** — **oracle-free leak gates** that reuse the
   corpus + `OpRegistry` to assert the buffer pool balances (zero-leak) and that no raw native-alloc site escapes the
-  chokepoint allowlist. (`ScopeAudit`/`[TestCategory("ScopeAudit")]` is the shared pool-counter harness.)
+  chokepoint allowlist. (`ScopeAudit`/`[TestCategory("ScopeAudit")]` is the shared pool-counter harness.) Four
+  shared, run-once measurements: the corpus sweep (ordinary + `ma_*` + `index_*` tiers, success AND error paths), the
+  backend pass (ordinary tiers with OpenBLAS threads=1; `Inconclusive` without a library), the `LeakCatalogue`
+  (direct invocations, harness-error on an entry that cannot run) and the property/field read gate.
+- **`LeakSurfaceCoverageTests`** — the leak COMPLETENESS gate: every member of the public surface (ApiInventory
+  `[ModuleName]` modules, the operators of the array types and of `DType`/`NDArrayFlags`/`poly1d`, the object
+  surfaces) must be credited by a MEASUREMENT of one of the four runs — declared-but-unmeasured never counts. **A new
+  public API fails here until it gains corpus rows or a catalogue entry.**
 - **`BlasBackendDeltaTests`** — replays only the ~1.7K BLAS-affected ordinary cases twice (managed vs OpenBLAS),
   deduplicates identical outcomes, byte-checks the real flips against NumPy on the pinned host.
 - **`MetamorphicTests`** — NumPy-free invariants (round-trips / involutions), no oracle needed.
@@ -164,6 +172,11 @@ is in **`references/add-op.md`** — read it when adding an op. In brief:
   Fix the leak (`[NDScoped]`/dispose the intermediate), don't add a `KnownEscapes` entry. `NativeAllocationChokepointTests`
   separately fails if your op adds a raw `NativeMemory.*`/`Marshal.AllocHGlobal` site outside the chokepoint allowlist —
   route scratch through the pools.
+- **Adding ANY public member enters the leak COMPLETENESS gate.** `LeakSurfaceCoverageTests` fails on a public
+  method/operator/indexer that no run measured. Corpus rows credit it automatically (success path); a member no
+  corpus row reaches needs an `E(...)` entry in `LeakCatalogue*.cs` (`T(...)` for one that always raises; `backend: true`
+  for LAPACK-only). A new property is read automatically unless its owner needs a read target (`ReadTargetsFor`); a new
+  operator on an object type also needs the type in `LeakSurface.OperatorOwners` (the gate names it if missing).
 - **Some tiers go `Inconclusive` off-Windows, not red.** `unary/nan/precision/fft/numpy_f32_kernels` (via
   `RunHostLibmCorpus`) and the host-pinned `matmul_parity`/`random_parity_host`/`generator_parity_host` record bytes
   reproducible only on win-amd64 (CRT libm, SIMD widths, the exact BLAS build). Off-Windows they assert `Inconclusive`,

.claude/skills/oracle/references/add-op.md

@@ -132,7 +132,8 @@ If a case is red, go to `references/triage.md`.
 > through `OpRegistry` and asserts the buffer pool balances — the `KnownEscapes` registry is empty, so if your op
 > strands a pooled intermediate it goes red **even with bit-exact values**. Run `FullyQualifiedName~UndisposedIntermediateTests`
 > too, and fix any leak in the op (dispose the intermediate / `[NDScoped]`) rather than allowlisting it. See
-> `references/triage.md` → "A red that is NOT a value divergence".
+> `references/triage.md` → "A red that is NOT a value divergence". Its corpus rows also credit the new public member
+> in the leak COMPLETENESS gate (`LeakSurfaceCoverageTests`); an API with no corpus route needs a `LeakCatalogue` entry.
 
 ## 6. What you do NOT need to do
 

.claude/skills/oracle/references/architecture.md

@@ -129,7 +129,21 @@ The op corpus + `OpRegistry` are reused for a DIFFERENT claim — no NumPy refer
   every result disposed and asserts the buffer pool's takes==returns. A surplus take is an undisposed intermediate; a
   surplus return is an out-of-pool result buffer. The `KnownEscapes` registry is now **EMPTY** — every op is gated at
   ZERO — so an op that leaks a pooled buffer fails here even when its values are bit-exact. `[DoNotParallelize]`
-  (reads process-global pool counters, shared with `ScopeAudit.cs`).
+  (reads process-global pool counters, shared with `ScopeAudit.cs`). Three corpus FAMILIES are replayed —
+  ordinary op tiers, masked-array tiers (`ma_*`, `.Families.cs`) and index tiers (`index_*`) — each on its success
+  AND error paths (a NumPy-raising case must throw without stranding a buffer). Floors sit 5% under the measured
+  counts (2026-09-23: 213,264 success + 9,123 error paths, identical net10.0/net8.0).
+- `UndisposedIntermediateTests.Backend.cs` — the same ordinary tiers with OpenBLAS installed (threads=1): the LAPACK
+  family (NSE without a backend), the BLAS seams, the Interop glue. `Inconclusive` where no library loads.
+- `UndisposedIntermediateTests.Catalogue.cs` + `LeakCatalogue{,.NDArray,.Masked}.cs` — direct invocations of every
+  public member NO corpus row reaches (np.* conveniences, Array-API linalg forms, ndarray/`NDArray<T>`/`NDMaskedArray`
+  methods, all operators, object surfaces + indexers), measured with the same protocol against a shared
+  `LeakFixture`. `T(...)` = always raises (error path); an entry that cannot run is a harness error (red).
+- `UndisposedIntermediateTests.Properties.cs` — every public property/field read (settable ones round-trip written)
+  on targets built INSIDE the measured region, so a getter caching an allocation on its owner is caught.
+- `LeakSurfaceCoverageTests.cs` — the COMPLETENESS gate: every `LeakSurface` member (ApiInventory modules + operators
+  + object surfaces, 1,348 members) must be credited by a MEASUREMENT of one of the four runs above. Declared but
+  unmeasured never counts; GC-inconclusive counts (never red); backend-skipped counts only where no library loads.
 - `NativeAllocationChokepointTests.cs` — the STATIC complement: every raw `NativeMemory.*` / `Marshal.AllocHGlobal` /
   `VirtualAlloc*` site in `NumSharp.Core` must be a known chokepoint (allowlist pins file → site count). A new raw
   allocation fails until it is routed through the pools or consciously allowlisted. Needs the source tree
@@ -145,8 +159,9 @@ The op corpus + `OpRegistry` are reused for a DIFFERENT claim — no NumPy refer
 - `OpenBugs.FuzzGate.cs` — `MisalignedRegistryTightnessTests` (each excuse branch pinned from both sides — a gross
   regression in the neighbouring cell must NOT be excused) + `FuzzGateRegressionTests` (real bugs the tightening
   exposed, fixed-in-src or pinned `[OpenBugs]`).
-- `fuzz_random.py` — the nightly-soak seeded fuzzer (`.github/workflows/fuzz-soak.yml`), ~1M fresh cases/night;
-  shrunk failures get pinned under `Fuzz/corpus/regressions/`.
+- `fuzz_random.py` — the nightly-soak seeded fuzzer (`.github/workflows/fuzz-soak.yml`): one fixed seed (a
+  deterministic canary) + nine fresh random seeds × 200K cases, ~1.8M fresh cases/night; shrunk failures get
+  pinned under `Fuzz/corpus/regressions/`.
 
 ## Where the corpus lives and how it reaches tests
 

.claude/skills/oracle/references/triage.md

@@ -109,6 +109,15 @@ names the op and the take/return imbalance, not a byte diff. Fix the leak in the
 `[NDScoped]`), never add a `KnownEscapes` entry. `NativeAllocationChokepointTests` is the static twin: a new raw
 `NativeMemory.*`/`Marshal.AllocHGlobal` site fails until pooled or allowlisted.
 
+Two more `ScopeAudit` reds, neither a value divergence:
+- **`EveryInventoryMember_IsLeakAudited`: "N surface members are not leak-audited".** A public member no run
+  measured. Give it corpus rows, or an `E(...)` entry in `LeakCatalogue*.cs` (see the SKILL.md gotcha). The message
+  says when an entry is DECLARED but never ran — that is the next item, not a missing entry.
+- **`Catalogue_EveryEntry_…`: "catalogue entries could not run".** An entry's warm invocation threw (fix its
+  arguments), or a `T(...)` entry started returning (the member now succeeds — make it an ordinary `E(...)`). An
+  entry's own lifetime bugs read as escapes too: return every array the entry owns (the harness disposes results) and
+  never return a fixture array or a member's OWN field (report its size instead).
+
 ## Ledger
 
 The complete, human-readable divergence ledger is `test/NumSharp.Tests.Oracle/Fuzz/README.md`. Keep it and

.git-blame-ignore-revs

@@ -37,3 +37,10 @@ e6fd25438ba488038494c60a2333b2850501ff64
 # (submodule git mv + BCL-snapshot R100 renames) + rewrite all path references
 # across docs/code. Mechanical, no logic change.
 1e7a0c86c313b4913833bbe2f46517a352d08bcd
+
+# Rename the ordered concurrent maps *Dict -> *Dictionary (ConcurrentOrderedDictionary,
+# ConcurrentOrderedCompactDictionary, OrderedDictionary) + their tests/benchmark/probes/ledger
+# references, and delete the experimental ConcurrentPointingDict. Mechanical rename, no logic
+# change. Caveat: git re-attributes this commit's few genuinely NEW doc lines (e.g. the proposal's
+# naming note) to neighbouring older lines; `git blame --no-ignore-revs-file` shows their true origin.
+5635182d1df03bfb6c3e46a0b077593641f6eb6e