docs(plan): the 90/100 verification law (Nick 2026-10-05)

- 100% branch coverage on the deterministic Rust kernels (achievable,
  exhaustive via parity matrices)
- ≥90% per-slice changed-lines working bar, aiming higher per slice
- floor ratchet climbs after clean waves (70->76->84->90)
- honest fixtures only — a lying-fixture branch is worse than uncovered
- assertion quality counts: value-verifying asserts only

plans/2026-10-04-total-rebase-tranche.md

@@ -218,6 +218,35 @@ critiques (2026-10-04):
   or honestly flagged, never silent.
 - Deploy qualification per merge (the pipeline that proved itself today).
 
+### The 90/100 coverage law (Nick, 2026-10-05 — GOVERNING from W3.4 on)
+
+Per Nick: "if it's realistically achievable but aim higher also if that's
+realistically achievable. go to 100% where achievable."
+
+- **100% where achievable — the deterministic Rust kernels.** Every kernel
+  crate (memory_retrieval, cognition_core, scaffold_core, memory_storage,
+  and every future crate) targets 100% BRANCH coverage via its parity
+  matrices + the pytest shim battery: every branch has real reachable
+  semantics, and exhaustive enumeration is exactly what the batteries do.
+  Achievability is measured per crate at wave close; a kernel below 100%
+  carries the named unreachable case or it isn't done.
+- **≥90% on the changed-lines bar (diff-cover), aiming higher.** The floor
+  stays a floor; the working standard per slice is 90%+ on changed lines;
+  whatever a slice achieves beyond 90 becomes the next slice's personal
+  benchmark (per-unit "aim higher" — the number climbs wave over wave).
+  The floor ratchet itself moves after consecutive clean waves
+  (70 → 76 → 84 → 90; each raise is a commit, never a step down).
+- **Glue/failure branches: 90%+ with byte-compare proofs.** The stubs and
+  probe branches that only fire in a broken world are covered by honest
+  fixtures (real import-failure probes like the from-import resolution
+  law) — never by fake-triggered pragmas. A branch covered by a lying
+  fixture is WORSE than uncovered; if it can't be honestly reached, it's
+  named in the wave's closure report with the reason.
+- **Assertion quality is part of the bar.** A test that touches a line
+  without verifying its OUTPUT doesn't count toward the bar — byte-compare
+  / exact-value asserts are the standard; "is not None" assertions reject
+  at review.
+
 ## 7. Risk register
 
 - **SQLite FFI correctness** (Wave 2) — the storage layer is retained but