Agreement to 5.5e-16 across 8,000 boards did not stop a solver calling safe squares mines

The number that condemns the code is not 13.96. It is 1e-10.

A mean-field estimate of 0.9999999999 sits that far below 1 ^[11], and the promotion threshold inside `finalize()` was 1e-9 ^[9]. The estimate cleared the bar with a factor of ten in hand ^[12]. That threshold was sized for the residue of exact arithmetic, where binomial weighting and division can return 3e-17 for a cell that is genuinely safe ^[10], and at that scale it does the job it was written for. Pointed at the output of twelve rounds of iterative relaxation ^[8], it converts a guess into a claim of proof, because by the time the numbers reach `finalize()` there is no record of which path produced them ^[11].

The differential test is the more instructive failure. The oracle works by enumerating every legal mine placement and counting ^[2]. The fallback exists precisely because that enumeration explodes once a component's frontier passes `maxComponentCells` ^[7]. So the oracle cannot cover the branch: the boards that reach it are the boards it cannot finish. Agreement to 5.551e-16 across 8,000 boards ^[3] is roughly two and a half units in the last place of a double ^[4], which is the signature of two implementations doing the same arithmetic, on the same path, correctly. More boards from the same generator buy more of that same evidence.

What the author did test hard is the part he knew was subtle: weighting each global mine total by `C(outsideCells, remainingMines - T)` ^[5]. On a 5x3 board with one mine left and two clues, the intersection square is a guaranteed mine and the other twelve squares are guaranteed safe ^[14]. Enumerate the frontier without the global budget and that square comes back at 0.0588 ^[13], an understatement of about seventeen times ^[15], and it is the lowest number on the board, so the solver recommends the one click that certainly loses ^[16]. That path was tested heavily and works ^[17]. The tests covered the mechanism the author already respected.

The check that would have caught the shipped bug needs no second implementation at all. Per-cell mine probabilities must sum to the mines remaining, exactly, by linearity of expectation [c6b]. The failing board summed to 13.96 against ten mines ^[6], nearly four phantom mines and a 39.6 percent excess ^[20], and it is one pass over the grid to notice. That is a check which runs on every board in production, including the boards no enumerating oracle can reach.

The output was consumed by a website taking `safe[]` from the library ^[21], and four of the six squares it called certain mines were not mines ^[19].