From 8b20e0c560135bdc9e4bcac5e229bc26cfaf00da Mon Sep 17 00:00:00 2001
From: Anders Olsson <anders.e.olsson@gmail.com>
Date: Tue, 8 Sep 2026 21:03:16 +0200
Subject: [PATCH] fix!: reject non-finite weights at ingestion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Measured, a NaN weight behaved exactly as `0.0`:

  weight NaN -> Ok, converged: true, 1 iteration, step (0.0, 0.0)
                skill pi 0.027777777777777776, tau 0.0
  weight 0.0 -> Ok, same skill, bit for bit

So a NaN arriving from a division or a parse was indistinguishable from
a deliberate zero, and the fit reported itself as cleanly converged.

Worth correcting an earlier description of this: the event does not
vanish. The member contributes nothing, which is precisely what weight
zero means, and that equivalence is what makes it undetectable rather
than merely wrong.

Zero and negative weights stay accepted. Both are expressible choices
about how much a member contributes, and tests/degenerate_inputs.rs pins
their behaviour deliberately; only values that are not quantities at all
are rejected. A test asserts they still ingest, so the new check cannot
quietly widen.

This completes the boundary: every malformed input that previously
produced a plausible answer — a one-team event, an empty team, a
non-finite score, a non-finite weight — now fails where it enters.

BREAKING CHANGE: an event carrying a non-finite weight returns
`InvalidParameter` instead of silently treating that member as weightless.

Refs #18

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hcFjNDmHXZF8URGLku5zZ
---
 src/history.rs           | 23 +++++++++++++++++++++
 tests/ingestion_shape.rs | 43 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/src/history.rs b/src/history.rs
index a2a4c2c..bd86277 100644
--- a/src/history.rs
+++ b/src/history.rs
@@ -1753,6 +1753,29 @@ impl<T: Time, D: Drift<T>, O: Observer<T>, K: Eq + Hash + Clone> History<T, D, O
             }
         }
 
+        // A non-finite weight is not a weight. Measured, it behaves exactly as
+        // `0.0` — the member contributes nothing — while `converge` reports
+        // `converged: true` after one iteration with a step of `(0.0, 0.0)`.
+        // So a NaN arriving from a division or a parse is indistinguishable
+        // from a deliberate zero, and looks like a clean fit.
+        //
+        // Zero and negative weights stay accepted: both are expressible
+        // choices about how much a member contributes, and
+        // `tests/degenerate_inputs.rs` pins them deliberately. Only the values
+        // that are not quantities at all are rejected.
+        if let Some(weights) = weights.as_ref() {
+            for team_weights in weights.iter().flatten() {
+                for weight in team_weights {
+                    if !weight.is_finite() {
+                        return Err(InferenceError::InvalidParameter {
+                            name: "weight",
+                            value: *weight,
+                        });
+                    }
+                }
+            }
+        }
+
         // Chokepoint for tie validation: every ingestion route lands here,
         // including `record_draw`, which builds its results directly rather
         // than going through `Outcome`.
diff --git a/tests/ingestion_shape.rs b/tests/ingestion_shape.rs
index 7b1c36e..cd43ab4 100644
--- a/tests/ingestion_shape.rs
+++ b/tests/ingestion_shape.rs
@@ -120,6 +120,49 @@ fn a_non_finite_score_is_rejected_at_ingestion() {
     }
 }
 
+/// A non-finite weight behaved exactly as `0.0` — the member contributed
+/// nothing — while `converge` reported `converged: true` after one iteration
+/// with a step of `(0.0, 0.0)`. So a NaN arriving from a division or a parse
+/// was indistinguishable from a deliberate zero, and looked like a clean fit.
+#[test]
+fn a_non_finite_weight_is_rejected_at_ingestion() {
+    for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+        let mut h = history();
+        let err = h
+            .event(1)
+            .team(["a"])
+            .weights([bad])
+            .team(["b"])
+            .winner(0)
+            .commit()
+            .unwrap_err();
+        assert!(
+            matches!(err, InferenceError::InvalidParameter { name: "weight", .. }),
+            "{bad}: {err:?}"
+        );
+        assert!(h.current_skill(&"a").is_none(), "{bad} reached the history");
+    }
+}
+
+/// Zero and negative weights are expressible choices about how much a member
+/// contributes, not malformed input, and `tests/degenerate_inputs.rs` pins
+/// their behaviour deliberately. Rejecting non-finite values must not catch
+/// them too.
+#[test]
+fn zero_and_negative_weights_still_ingest() {
+    for w in [0.0, -1.0, 0.5] {
+        let mut h = history();
+        h.event(1)
+            .team(["a"])
+            .weights([w])
+            .team(["b"])
+            .winner(0)
+            .commit()
+            .unwrap_or_else(|e| panic!("weight {w} should ingest: {e:?}"));
+        assert!(h.current_skill(&"a").is_some(), "weight {w}");
+    }
+}
+
 /// The fluent builder routes through the same chokepoint, so it inherits the
 /// checks rather than needing its own.
 #[test]