[DanielLuning]

What changed

The last gap of epic defk-o08, found in its closing check. defk-9za was opened for examples/rolling_stats.exs mean_std, where old = if i >= w, do: x[i - w], else: 0.0 keeps a bounds check. defk-b38 made the compiler drop that check once a raising guard establishes w >= 1, and 9za closed on a test kernel that has the guard. The catalog kernel never got the guard.

• examples/rolling_stats.exs: mean_std now starts with if w < 1 or w > n, do: raise(ArgumentError, "the window must be in 1..length(x)"). Past the guard, 1 <= w <= n holds: an or that is false narrows both sides. That proves x[i - w], and both out writes, because m = n - w + 1 >= 1 and length(out) == 2 * m. The kernel's comment and the example's header say so.
• test/non_finite_test.exs: a test used the catalog mean_std with invalid windows (-1, 0) to put a bad value and an out-of-range read or a zero divisor in one flagged strip. The guard now raises first, which is correct in Elixir order, and both modes agree.
  • That test now runs on Defk.NonFiniteTest.Rolling, an unguarded copy of the old kernel. Its assertions and C checks are unchanged.
  • A new test covers the catalog kernel: w = -1, 0 and n + 1 raise the guard's ArgumentError before any read; a NaN with a valid window still raises; w = n succeeds; and the C still checks the window-sum reads once per strip, with no checked read left.
• docs/performance.md: a new entry 6.42.

Results

From the fast-path report under report: :full, before → after:

• Bounds checks kept: 3 → 0 (x[i - w], out[i - w + 1], out[m + i - w + 1]).
• The loop's flagged strip: it carried float, overflow and bounds checks, and now carries only float checks. The overflow checks of the index arithmetic went with the bounds facts.
• Vectorisation: clang's remark no longer cites "cannot identify array bounds". But the sliding sums are a recurrence, so the loop stays scalar, and no speed-up from vector code is expected.
• Not timed: the stored scoreboard row is stale until a new measurement is asked for (docs/agents/runs.md).

How it was checked

• mix ci on the laptop (macOS) passed: 2305 tests, Credo found no issues, Dialyzer reported 0 errors.

• mix defk.examples --only rolling_stats: the example's check passed, without timing.

• mix dump_c examples/rolling_stats.exs: Rolling.Kernels.report lists all four accesses as dropped.

• Touches a promised surface? No: an example script and a test. No CHANGELOG.md entry.

• Touches test/stability/? No.