AlgoScan

At ratio exactly 1.0 (only the all-0xff digest IS exactly 1.0; the rest of the top 2^-129 digest interval rounds up to it), the accumulated f128 CDF reaches exactly 1.0 only for some distributions, decided at ulp granularity: money=1954/exp=1500 stops at j=3 with total=1_999_999_999_999_964 but falls through with total=2_000_000_000_000_000, 36 more. Other distributions never get within half an ulp of 1.0 (p=1/2 with money=100 leaves cdf(99) = 1 - 2^-100, 2^28 ulps short) and the walk runs to money -- which, with the rounded threshold fixed at 1.0, is also the exact-CDF count, since the exact CDF is < 1 for every j < money. The previous text presented the early stop as the behavior and money as hypothetical; this had it backwards.

Reframe the f128 round-to-nearest rationale accordingly: RNE is required because every result must be the correctly-rounded 128-bit value to stay bit-identical to the 128-bit big.Float oracle; the ratio==1.0 edge is a consequence, not the requirement. Boost's double CDF -- evaluated independently per j via ibetac rather than accumulated -- can also saturate to 1.0 on its far coarser grid, potentially at a different (typically earlier) j, so old-vs-new divergence at this edge can be as large as money vs. a few.

TestSelectF128RatioExactlyOne now pins both branches and both boundaries: the hair-trigger total pair (j=3 vs money), the provably-stuck money=100/p=1/2 case, and the exact tie money=129/p=1/2 where true cdf(128) = 1 - 2^-129 sits precisely on the rounding midpoint and ties-to-even rounds it up to 1.0 (stops at j=128). The rounds-to-1.0 digest is constructed with exactly 129 leading one bits, the minimal such digest.

The committee size is a uint64 in the protocol (CommitteeSize(proto)); the float64 parameter only mirrored the C++ double signature and forced casts at every caller. Passing the exact integers lets each PMF-recurrence constant be a SINGLE round-to-nearest-even f128 divide of exact values -- q = (total-expected)/total and pq = expected/(total-expected) -- instead of stacking roundings through an intermediate float64 p (float64(totalMoney) is itself inexact above 2^53). Invalid probabilities (NaN/Inf/negative/fractional) become unrepresentable and p >= 1 is an exact integer comparison, so the differential fuzz no longer needs any input filtering.

f128FromFloat64 loses its only caller and is removed; sub and its norm192s helper likewise lose theirs (1-p is now a direct divide of exact integers, one rounding instead of two) and are removed along with their fuzz checks. The oracle mirrors the integer-quotient constants. Boost agreement is unchanged (200000/200000); the fuzz explored the new signature for 8.1M execs clean. Setup now does two divs instead of convert+sub+div: ~170ns/op (was ~159), still 1 alloc.

sub was previously exercised only through the (1, p) operand shape in newBinomialF128; fuzz it across the full operand space, with seeds for the sticky/borrow path (exponent diff >= 65) and near-equal cancellation. Fuzz div alongside TestDivVsBig for ongoing corpus-driven coverage.

Also correct the newBinomialF128 comment: 1-p is correctly rounded rather than exact for p below ~2^-76 (it still matches the 128-bit big.Float oracle bit-for-bit, which is the property the fuzz checks). BenchmarkSelectF128 mirrors BenchmarkSortition for direct comparison with the cgo/Boost path.

Compute p/(1-p) with a native round-to-nearest-even f128 divide (128/128
via Knuth long division, used once per setup) instead of big.Float. With
the earlier native 1-p, newBinomialF128 is now heap-free apart from the
returned struct: 658ns/19allocs -> 195ns/1alloc, and the SelectF128 common
path drops 984ns/25allocs -> 535ns/7allocs (the remaining allocs are the
VRF->ratio big.Float work shared with Select).

div is fuzz-checked bit-identical to the big.Float oracle via SelectF128,
and TestDivVsBig cross-checks it directly against a 128-bit big.Float
divide on 5M broad random operands. Removes the now-dead f128FromBigFloat,
f128bigMask, and toBigFloat helpers and the math/big import.

1-p is exact for any float64 p, so compute it with a native f128
subtraction instead of big.Float, dropping one f128FromBigFloat
conversion (~6 fewer allocs, ~17% off newBinomialF128). sub is done
exactly in a 192-bit field so it is correct under cancellation, and is
fuzz-checked bit-identical to the big.Float oracle.