feat(tests): the conformance suite's local column — the dual-tier dispatch-coverage shape green (wave 2)

- tests/conformance/local_column.rs: the first dual-tier column, run
  against the kv = mem + large = local factory (ADR-012 §6.3) — fresh
  temp-root store per open, per-instance tracked roots, idempotent
  teardown safe against abandoned/panicking rows (structural tests
  included); never skips (mem-gated — the dual-tier constructor rides
  feature mem until wave 3 provides an ungated kv engine)
- the reference INV row set (rows.rs) mirrored against the dual-tier
  factory at a column-declared tuned threshold (1024), so the shared
  matrix and race fixtures exercise both tiers' bodies (INV-7)
- dispatch rows grown: pure-function routing across put paths and
  re-puts with an on-disk placement oracle (tier residency is
  facade-invisible; with kv = mem the medium is the oracle), threshold
  boundary legs at the tuned and shipped-default thresholds with the
  constructor-tuned re-route leg, and fall-through per op with
  both-tier miss shapes (ADR-003/ADR-012 §6.1/§6.3/§6.5)
- local-specific rows: on-disk stage-hygiene exact counts over both
  put paths (the real stage form, INV-3), pread windows over committed
  files with slice digests verified independently (ADR-006/ADR-010),
  virgin-store no-ops on a fresh root, and exact sweep counts over a
  both-tiers pool (INV-4/INV-5's both-tiers form)
- rows.rs shared fixtures made pub(crate); README records the column's
  row inventory (§Columns beyond the reference set), the declared-
  threshold posture, and the new current state
- stat-as-stat rides the mirrored INV-6 row's over-threshold legs;
  the Drop-cancellation hygiene form stays per-engine (recorded)

Verification: cargo test (default) green; cargo test --features mem
green (97 lib + 37 conformance + 4 git-interop); cargo test
--all-features green; clippy --all-targets -D warnings green in both
feature shapes (default + all-features); cargo fmt --check green;
cargo doc --no-deps shows only the pre-existing warning class

tests/conformance/README.md

@@ -185,6 +185,49 @@ families' first shapes (the `SweeperLock` abort) complete the three
 `GcAbortCause` variants within the single-node exact-count family
 (ADR-013 §2's lease, its in-process ADR-012 §5 form).
 
+## Columns beyond the reference set (INV-7's mirror + extension)
+
+The constructor-mode rows of the reference set run wherever the mode
+they name is constructible (README §The reference row set). A
+multi-tier column mirrors the set and grows **its own rows** for what
+its configuration carries that the reference set's single-tier host
+did not: the dispatch-coverage shape (ADR-012 §6.3 — both tiers
+load-bearing) and the engine's tier-specific properties. Those rows
+are still conformance rows — ADR-stamped, named for the property,
+traced — but they take the **column's concrete factory** instead of
+the `StoreFactory` trait: they observe the backing medium, which an
+engine-uniform row (unable to branch on any engine, and unable to see
+any tier's residency through the facade) cannot. Tier placement is
+facade-invisible by design; with `kv = mem`, the medium itself is the
+oracle — the mem kv tier never touches the factory's disk, so a
+committed file outside the staging area under the column's temp root
+is exactly one large-tier entry, and its absence beside a served read
+is exactly a kv-tier entry.
+
+**The local column's own rows** (tests/conformance/local_column.rs,
+the dispatch-coverage and local-specific families):
+
+| Row | Traces to |
+|---|---|
+| `routing_is_a_pure_function_of_length_across_put_paths_and_re_puts` | ADR-003 §Dispatch policy (purity/no-migration); ADR-012 §6.3; INV-7 facade-contract row |
+| `threshold_boundary_lengths_route_deterministically` | ADR-003 §Dispatch policy (at/below/above the threshold; constructor-tuned re-route); ADR-012 §6.3 |
+| `kv_tier_misses_fall_through_to_the_large_tier_per_op` | ADR-012 §6.1 (fall-through per op); ADR-012 §6.5 ruling 5 (miss shapes); ADR-006 |
+| `stage_hygiene_exact_counts_on_disk_over_both_put_paths` | INV-3's stage form (exact counts on disk); ADR-010 §1; ADR-003 |
+| `pread_windows_read_committed_files_mid_slices_and_eof_clamped` | store-api.md §Read path; ADR-010 §1 (streaming cursor); ADR-006 |
+| `virgin_store_reads_are_no_ops_on_a_fresh_root` | store-api.md §Error model (virgin-store semantics); ADR-012 §6.5 |
+| `sweep_counts_stay_exact_over_both_tiers` | INV-4/INV-5's both-tiers form (exact counts + list correctness through outcomes); ADR-005; ADR-012 §1/§6.3/§6.7 |
+
+**The dual-tier threshold is declared configuration, not a
+behavioral probe.** The kv-only reference row discovers its factory's
+threshold by probing (rejections read nothing — free). A dual-tier
+store never rejects a length, and tier residency is facade-invisible,
+so there is nothing to probe: the dispatch rows take the threshold
+the column's factory declares (the same value its constructor took —
+configuration, like the mem column's kv-only threshold). The mem-only
+and kv-only mode rows do not mirror onto the dual-tier factories (the
+precondition `mode()` shapes they assert are not this column's mode);
+the dispatch rows are the dual-tier mode's facade-contract coverage.
+
 ## Column plan
 
 **mem is the contract-reference engine** (ADR-011 §2): wave 2 lands
@@ -197,15 +240,33 @@ and first run in wave 6.
 
 ## Current state
 
-The harness is green on the **mem column** (wave 2): the factory
-binding is the concrete `alkblobs::Store` facade (see §The factory
-contract — the binding demonstrator remains in `binding.rs`), the
-reference row set is landed (§The reference row set — `rows.rs`,
-every row ADR-stamped and traced to the backlog), the column's
-factories (`mem-only`, the reference; `kv-only(mem)` at a
-column-declared threshold) vend fresh isolated stores with idempotent
-teardown (`mem_column.rs`, the structural factory-contract tests
-included), and mem never skips. The column runs under feature `mem`
-(`cargo test --features mem`); the row set compiles ungated so the
-reference rows stay type-checked in default builds. The local column
-grows next.
+The harness is green on **two columns** (wave 2). The **mem column**
+is the contract-reference column: the factory binding is the concrete
+`alkblobs::Store` facade (see §The factory contract — the binding
+demonstrator remains in `binding.rs`), the reference row set is landed
+(§The reference row set — `rows.rs`, every row ADR-stamped and traced
+to the backlog), the column's factories (`mem-only`, the reference;
+`kv-only(mem)` at a column-declared threshold) vend fresh isolated
+stores with idempotent teardown (`mem_column.rs`, the structural
+factory-contract tests included), and mem never skips.
+
+The **local column** (the suite's first dual-tier column, the
+dispatch-coverage shape ADR-012 §6.3 names) mirrors the reference INV
+rows against its `kv = mem` + `large = local` factory at a
+column-declared tuned threshold — the shared matrix and race fixtures
+cross it, so both tiers' bodies are exercised — and grows the
+dispatch-coverage rows (pure-function routing with an on-disk
+placement oracle, fall-through per op, threshold boundaries at both
+the tuned and the shipped-default threshold) plus the local-specific
+rows (on-disk stage hygiene exact counts, pread windows, virgin-store
+no-ops, the both-tiers sweep shape) — §Columns beyond the reference
+set is the recorded inventory. Its factory instances each track and
+remove their own temp roots (idempotent teardown, panicking-row-safe;
+each runner owns its instance so concurrent rows never share roots).
+mem-only/kv-only modes and the local column never skip, but the local
+column is feature-gated on `mem`: the `dual_tier_mem_local`
+constructor rides feature `mem` because mem is the only constructible
+kv engine until wave 3 (the gate is the kv pairing's, not the local
+engine's, which is ungated in `src/`) — the column runs under `cargo
+test --features mem`, with the reference row set compiling ungated so
+it stays type-checked in default builds.