feat(adr-001): sparse solve witness — per-entry residual audit

[ruvnet]

Summary

Closes ADR-001 open question #3: "does `solve_on_change` need a witness?" YES — but a full `A·x` matvec costs `O(nnz(A))` and would dominate the SubLinear orchestrator's own cost. This PR's refinement: verify ONLY the closure entries.

Math

For each entry row `i` returned by the SubLinear orchestrator:

```
r_i = b[i] - Σ_j A[i,j] · x_new[j]
```

where `x_new[j]` uses the orchestrator's value if `j` is in the closure, and `prev_solution[j]` otherwise (the closure-boundary contract). Audit passes iff `max_i |r_i| ≤ tolerance · max(1, ‖b‖_∞)`. Cost is `O(|entries| · avg_row_nnz)` — same complexity class as the orchestrator.

API

```rust
pub fn verify_sparse_solution(
matrix: &dyn Matrix,
prev_solution: &[Precision],
b: &[Precision],
entries: &[(usize, Precision)],
tolerance: Precision,
) -> Result

pub struct WitnessReport {
pub max_residual: Precision,
pub threshold: Precision,
pub ok: bool,
pub worst_row: Option,
}

pub struct VerifySparseSolutionOp; // SubLinear class marker
```

Use cases

• Audit mode in development — a witness failure on strict-DD input is a real solver bug, not just a tolerance miss.
• Trust-but-verify in production — gate downstream actions on witness success at essentially the same cost as the solve.
• Regression guards — property-test fuzz deltas + assert witness.

Test plan

• 7 `witness::tests::*` covering Op class, pass on genuine output (strong-DD ring, depth=8 → ρ^8 ≈ 1e-8 trivially under 1e-3 audit), fail on deliberately corrupted entry, empty trivially-pass, DimensionMismatch on wrong-sized prev/b, OOB indices silently dropped
• `cargo test --lib -- witness::` → 7/7 pass
• Full CI

🤖 Generated with claude-flow