fix: reject malformed events at the ingestion boundary

A one-team event reached `run_chain`, which builds one diff link per
adjacent pair of teams, leaving it to index `links[1..]` on an empty
vector. That panicked with "range start index 1 out of range for slice
of length 0" — from `History::add_events`, in a release build, through
entirely safe API.

An empty team was the quieter half of the same gap. It contributes no
performance, so a malformed event converged and handed back a finite,
plausible-looking posterior for whoever it was matched against. That is
this crate's characteristic defect: a public surface reporting a
constant that looks like an answer.

A non-finite score was the third. `converge` did report NonFiniteResult,
so it was detected — but a caller reading `current_skill` before
converging was handed `tau: NaN` with nothing to say so.

`NotEnoughTeams` and `EmptyTeam` already existed. They were checked on
the prediction paths and nowhere else, which is exactly why ingestion
could still manufacture the states they describe. The checks go in
`add_events_with_prior` alongside the tie check, for the same reason
that one is there: every ingestion route lands on it, so `record_winner`,
`record_draw` and `EventBuilder` inherit them rather than each needing
their own.

Also corrects documentation that had been stating the opposite of the
code since 8c087ad in 0.4.0. README.md and the `with_prior` /
`with_drift_scale` doc comments all still said competitor configuration
was "captured at first appearance" and had "no effect" on a known key.
It now applies whenever supplied and refits the whole history. A reader
would have concluded late configuration was impossible and built a
workaround for a limitation that does not exist. CI compiles README code
blocks but not prose, which is why it survived three releases.

The comment in tests/degenerate_inputs.rs claiming a one-team event was
"rejected for an unrelated reason" was wrong when written — it panicked.

Refs #18, #26

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hcFjNDmHXZF8URGLku5zZ

src/event.rs

@@ -88,7 +88,9 @@ impl<K> Member<K> {
 
     /// Set this competitor's starting skill estimate.
     ///
-    /// Captured at the competitor's first appearance; see the type docs.
+    /// Competitor configuration, not a per-event value: it applies for the
+    /// whole history and applies whenever it is supplied, including on a key
+    /// the history already knows. See the type docs.
     pub fn with_prior(mut self, prior: Gaussian) -> Self {
         self.prior = Some(prior);
         self
@@ -104,7 +106,8 @@ impl<K> Member<K> {
     /// shares a scale with moving competitors but should not itself move: a bot
     /// at a known strength, a rating floor, a course difficulty.
     ///
-    /// Captured at the competitor's first appearance; see the type docs.
+    /// Applies for the whole history and whenever it is supplied, including on
+    /// a key the history already knows; see the type docs.
     /// Must be finite and non-negative, or ingestion fails with
     /// [`InferenceError::InvalidParameter`](crate::InferenceError::InvalidParameter).
     pub fn with_drift_scale(mut self, scale: f64) -> Self {

src/history.rs

@@ -1505,6 +1505,50 @@ impl<T: Time, D: Drift<T>, O: Observer<T>, K: Eq + Hash + Clone> History<T, D, O
             });
         }
 
+        // Chokepoint for event shape, for the same reason as the tie check
+        // below: every ingestion route lands here.
+        //
+        // `run_chain` builds one diff link per adjacent pair of teams, so a
+        // one-team event leaves it with an empty link vector and panics
+        // indexing `links[1..]` — a reachable panic from safe API, in release.
+        // An empty team is the quieter half: it contributes no performance,
+        // so a malformed event yields a finite, plausible-looking posterior
+        // for whoever it was matched against.
+        //
+        // Both errors already existed; they were only ever checked on the
+        // prediction paths, which is why ingestion could still produce them.
+        for teams in &composition {
+            if teams.len() < 2 {
+                return Err(InferenceError::NotEnoughTeams { got: teams.len() });
+            }
+            for (team, members) in teams.iter().enumerate() {
+                if members.is_empty() {
+                    return Err(InferenceError::EmptyTeam { team });
+                }
+            }
+        }
+
+        // A non-finite outcome poisons the history rather than failing it:
+        // `converge` does report `NonFiniteResult`, but a caller who reads
+        // `current_skill` before converging is handed a NaN posterior with
+        // nothing to say it is one.
+        if let Some(results) = results.as_ref() {
+            for (event_results, kind) in results.iter().zip(kinds.iter()) {
+                let name = match kind {
+                    EventKind::Ranked => "rank",
+                    EventKind::Scored { .. } => "score",
+                };
+                for value in event_results {
+                    if !value.is_finite() {
+                        return Err(InferenceError::InvalidParameter {
+                            name,
+                            value: *value,
+                        });
+                    }
+                }
+            }
+        }
+
         // Chokepoint for tie validation: every ingestion route lands here,
         // including `record_draw`, which builds its results directly rather
         // than going through `Outcome`.