feat!: Gaussian's EP operations stop wearing arithmetic's clothes

`Gaussian` publicly implemented `Mul`, `Div`, `Add` and `Sub`. They were
the EP product, cavity and variance-space convolutions, and every one of
them lies to a reader who takes the operator at face value:

    a = N(10, 2)   b = N(4, 3)   c = N(1, 1)

    a * b        N(8.15, 1.66)   not 40
    a - b        sigma GREW, 2 -> sqrt(4 + 9)
    a * N(1, 0)  mu = NaN        "multiply by one"
    a / c        pi = -0.75      mu() prints a confident 0

The last is this crate's signature defect on a public operator. `Div` is
the cavity and can legitimately leave a negative precision, which is not
a distribution — and `mu()`/`sigma()` guard `pi <= 0` and report `0.0`
and `inf`, so it comes back as a plausible number with no panic, no
`Debug` marker and nothing to test against.

The four impls are now `pub(crate)` inherent methods that say what they
do: `ep_product`, `cavity`, `convolve`, `convolve_diff`, plus `scale`
for the one operation that genuinely is arithmetic. Nothing in a user's
workflow needed operator syntax; inference did, and it still has it.

`pi()` and `tau()` follow. Storing natural parameters is a performance
decision — it makes message passing two adds — not a contract. The
public surface is now exactly: `from_ms`, `from_mv`, `mu`, `sigma`,
`variance`, `probability_below`, `probability_above`. `from_mv` and
`variance` are promoted from `pub(crate)`; they are the honest pair for
callers who already hold a variance and should not pay a round trip
through the square root.

Four integration tests asserted bit-identity on `(pi, tau)`. They assert
it on `(mu, variance)` instead — still `assert_eq!`, still exact, and
`1/pi` and `tau/pi` are deterministic, so bit-equal natural parameters
give bit-equal moments. `a_nan_sigma_passes_through_from_ms` drops its
`|| g.pi().is_nan()` half: `sigma()` substitutes for `pi <= 0` and
`pi == inf`, so NaN survives to it only from a NaN precision.

`benches/gaussian.rs` is deleted. It timed two f64 additions through the
public operators, and keeping those public solely to feed it is the same
thing #73 objected to when a benchmark was dictating five public types.
The paths it covered are exercised by `batch` and `history_converge`
through the real call chain.

Closes #71.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hcFjNDmHXZF8URGLku5zZ

tests/event_builder_members.rs

@@ -64,8 +64,11 @@ fn members_matches_the_typed_path_exactly() {
     for key in ["player", "layout_7"] {
         let a = typed.current_skill(&key).unwrap();
         let b = fluent.current_skill(&key).unwrap();
-        assert_eq!(a.pi(), b.pi(), "{key} pi");
-        assert_eq!(a.tau(), b.tau(), "{key} tau");
+        // Exact equality, on the public moments rather than the natural
+        // parameters: `mu` and `variance` are `tau/pi` and `1/pi`, so
+        // bit-equal natural parameters give bit-equal moments.
+        assert_eq!(a.mu(), b.mu(), "{key} mu");
+        assert_eq!(a.variance(), b.variance(), "{key} variance");
     }
 }
 

tests/joint_handle.rs

@@ -87,8 +87,8 @@ fn a_joint_answers_exactly_what_the_one_shot_call_does() {
         let terms = [(&a, 1.0), (&b, -1.0)];
         let one_shot = h.posterior_of(&terms).unwrap();
         let cached = joint.posterior_of(&terms).unwrap();
-        assert_eq!(one_shot.pi(), cached.pi(), "{a} - {b}");
-        assert_eq!(one_shot.tau(), cached.tau(), "{a} - {b}");
+        assert_eq!(one_shot.mu(), cached.mu(), "{a} - {b}");
+        assert_eq!(one_shot.variance(), cached.variance(), "{a} - {b}");
     }
 }
 
@@ -104,8 +104,8 @@ fn a_joint_agrees_at_a_pinned_time_too() {
             let cached = joint.posterior_of_at(time, &terms);
             match (one_shot, cached) {
                 (Ok(x), Ok(y)) => {
-                    assert_eq!(x.pi(), y.pi(), "t={time} {a} - {b}");
-                    assert_eq!(x.tau(), y.tau(), "t={time} {a} - {b}");
+                    assert_eq!(x.mu(), y.mu(), "t={time} {a} - {b}");
+                    assert_eq!(x.variance(), y.variance(), "t={time} {a} - {b}");
                 }
                 (Err(x), Err(y)) => assert_eq!(x, y, "t={time} {a} - {b}"),
                 (x, y) => panic!("t={time} {a} - {b}: disagreed on success: {x:?} vs {y:?}"),
@@ -262,8 +262,8 @@ fn unseen_competitors_match_the_one_shot_path() {
     let terms = [(&a, 1.0), (&z, -1.0)];
     let one_shot = h.posterior_of(&terms).unwrap();
     let cached = joint.posterior_of(&terms).unwrap();
-    assert_eq!(one_shot.pi(), cached.pi());
-    assert_eq!(one_shot.tau(), cached.tau());
+    assert_eq!(one_shot.mu(), cached.mu());
+    assert_eq!(one_shot.variance(), cached.variance());
 }
 
 /// A drift too small to represent must collapse, not corrupt the matrix.

tests/registration.rs

@@ -94,8 +94,8 @@ fn registering_matches_configuring_on_the_first_event() {
     };
 
     for ((k, a), (_, b)) in skills(&configured).into_iter().zip(skills(&registered)) {
-        assert_eq!(a.pi(), b.pi(), "{k} pi");
-        assert_eq!(a.tau(), b.tau(), "{k} tau");
+        assert_eq!(a.mu(), b.mu(), "{k} mu");
+        assert_eq!(a.variance(), b.variance(), "{k} variance");
     }
 }
 
@@ -225,8 +225,8 @@ fn registration_makes_the_fit_order_independent() {
     let forward = build(false);
     let backward = build(true);
     for ((k, a), (_, b)) in skills(&forward).into_iter().zip(skills(&backward)) {
-        assert_eq!(a.pi(), b.pi(), "{k} pi");
-        assert_eq!(a.tau(), b.tau(), "{k} tau");
+        assert_eq!(a.mu(), b.mu(), "{k} mu");
+        assert_eq!(a.variance(), b.variance(), "{k} variance");
     }
 }
 
@@ -246,8 +246,8 @@ fn rating_reads_back_what_was_stored() {
     .unwrap();
     let r = h.rating(&"layout").unwrap();
     assert_eq!(r.drift_scale(), 0.25);
-    assert_eq!(r.prior().pi(), PINNED.pi());
-    assert_eq!(r.prior().tau(), PINNED.tau());
+    assert_eq!(r.prior().mu(), PINNED.mu());
+    assert_eq!(r.prior().variance(), PINNED.variance());
 
     // A competitor created by an event reports the history defaults.
     h.record_winner(&"player", &"layout", 1).unwrap();

tests/validation.rs

@@ -248,9 +248,13 @@ mod builder_parameters {
         };
         let zero = fit(0.0);
         let positive = fit(25.0 / 6.0);
-        assert!(zero.pi().is_finite() && zero.pi() > 0.0);
+        // `variance` rather than `pi`: the natural parameters are the crate's
+        // internal representation and no longer public. It is the same
+        // quantity inverted, so a finite positive precision is a finite
+        // positive variance.
+        assert!(zero.variance().is_finite() && zero.variance() > 0.0);
         assert!(
-            (zero.pi() - positive.pi()).abs() > 1e-6,
+            (zero.variance() - positive.variance()).abs() > 1e-6,
             "zero beta must not merely be ignored: {zero:?} vs {positive:?}"
         );
     }
@@ -280,7 +284,10 @@ mod constructor_parameters {
     #[test]
     fn a_nan_sigma_passes_through_from_ms() {
         let g = Gaussian::from_ms(25.0, f64::NAN);
-        assert!(g.sigma().is_nan() || g.pi().is_nan());
+        // `sigma()` is NaN exactly when the precision is: it guards `pi <= 0`
+        // (reporting `inf`) and `pi == inf` (reporting `0.0`), so NaN survives
+        // only from a NaN precision.
+        assert!(g.sigma().is_nan());
     }
 
     #[test]