Correct the public docs the dependency drop left stale

Four review findings, all valid, all mine.

Codex P2 -- src/lib.rs and README.md still told downstream users that enabling
`std` pulls the external blake3 crate and that the hpc modules import it
directly. That was true before this branch and false after it, which is worse
than saying nothing: it is wrong feature and dependency information on the
crate's two most-read public surfaces. Both rewritten to state that BLAKE3 is
in-tree and that blake3 / constant_time_eq / arrayref / arrayvec are absent
from the dependency graph at every feature combination.

CodeRabbit -- the Cargo.toml comment I wrote in the first commit claimed the
in-tree module is "built on ndarray::simd::U32x16 (it is a ChaCha-derived u32
ARX kernel)". That is simply false. src/hpc/blake3.rs says so in its own
header: "a portable-only (no SIMD, no unsafe) transcription" of the reference
implementation. Its only `simd` reference is crate::simd_ops::array_chunks, a
slicing helper. Corrected, and the cycle paragraph now says dropping the dep
enables a FUTURE ndarray-backed implementation and the AdaWorldAPI/BLAKE3
fork -- not this module, which is portable.

CodeRabbit -- the knowledge doc said "14 call sites" in one place and the swap
record said 15. Both were right about different things: 14 calls plus one type
position (merkle_tree::truncate_hash's `&blake3::Hash` parameter). Made
explicit rather than reconciled to one number, since the distinction is the
reason the counts differed.

Verified: cargo build --features std clean, fmt clean, and no "pulls blake3"
claim survives anywhere in README.md, src/lib.rs or Cargo.toml.

Claude-Session: https://claude.ai/code/session_01VdfbkUCBbtZhy3yjSfCDHp

Author: claude

.claude/knowledge/blake3-in-tree-measured.md

@@ -35,10 +35,16 @@ cycle — the only rung of the ladder that has one (`the-simd-ladder.md`).
 Cutting it means ndarray owning BLAKE3 rather than consuming the crate.
 
 Scoping finding that made this small: **ndarray's usage is entirely
-single-input.** 14 call sites across 8 files use only `hash`,
-`Hasher::{new, new_keyed, update, finalize, finalize_xof().fill()}`,
-`Hash::as_bytes`, and `Hash` as a signature type. **No `hash_many`.** So the
-serial core suffices, and it needs no SIMD at all.
+single-input.** 15 `blake3::` references across 8 files — 14 calls plus one
+type position (`merkle_tree::truncate_hash`'s `&blake3::Hash` parameter) —
+using only `hash`, `Hasher::{new, new_keyed, update, finalize,
+finalize_xof().fill()}`, `Hash::as_bytes`, and `Hash` as a signature type.
+**No `hash_many`.** So the serial core suffices, and it needs no SIMD at all.
+
+(An earlier revision said "14 call sites", counting calls but not the type
+position, while the swap record above counts all 15 references. Raised by
+CodeRabbit on #269; both numbers were describing different things, and the
+distinction is now explicit rather than a discrepancy.)
 
 ## Correctness — proven
 

Cargo.toml

@@ -157,18 +157,23 @@ matrixmultiply = { version = "0.3.2", default-features = false, features=["cgemm
 # blake3 — NO LONGER A DEPENDENCY. Do not re-add it.
 # =====================================================================
 #
-# BLAKE3 now lives in-tree at `src/hpc/blake3.rs`, built on
-# `ndarray::simd::U32x16` (it is a ChaCha-derived u32 ARX kernel). The
-# external crate was removed because even with `default-features = false,
-# features = ["pure"]` it carried its own SSE2/SSE4.1/AVX2 intrinsics —
-# a second SIMD surface beside `ndarray::simd`, which is exactly what the
-# matryoshka pattern exists to prevent. The old comment block here said
-# "Tracked, not done here"; this is it being done.
+# BLAKE3 now lives in-tree at `src/hpc/blake3.rs`, as a **portable-only
+# transcription of the BLAKE3 reference implementation -- no SIMD, no
+# unsafe**. See that module's own header. It is the serial path every
+# conformant implementation reduces to at `simd_degree() == 1`, which
+# suffices here because ndarray's usage is entirely single-input.
+#
+# The external crate was removed because even with `default-features =
+# false, features = ["pure"]` it carried its own SSE2/SSE4.1/AVX2
+# intrinsics -- a second SIMD surface beside `ndarray::simd`, which is
+# exactly what the matryoshka pattern exists to prevent. The old comment
+# block here said "Tracked, not done here"; this is it being done.
 #
 # It also breaks a cycle. `ndarray -> blake3` meant blake3 could never be
 # built ON `ndarray::simd` without cargo seeing `ndarray -> blake3 ->
 # ndarray`. Dropping the dep is what makes an ndarray-backed BLAKE3
-# possible at all -- here, and in the AdaWorldAPI fork.
+# possible -- NOT here (this module is portable), but for a future
+# SIMD-backed implementation and for the AdaWorldAPI/BLAKE3 fork.
 #
 # Separately: blake3 carried `cc` as an unconditional build-dependency, and
 # the `pure` feature existed only to stop that `cc` from compiling the

README.md

@@ -210,20 +210,26 @@ cargo test
 
 ### Transitive dependencies of the `std` feature
 
-Enabling the `std` feature (the default) pulls in **`blake3`** as a hard
-transitive dependency. The cognitive substrate modules under `hpc/` —
-`plane`, `seal`, `merkle_tree`, `vsa`, `spo_bundle`, `crystal_encoder`,
-`compression_curves`, `deepnsm` — import `blake3` directly for integrity
-hashing and XOF expansion, and there is no separate feature to enable it.
-This was previously gated behind `hpc-extras`, which caused recurring
-"missing blake3" build errors for consumers (e.g. `burn-ndarray`) that
-selected `default-features = false, features = ["std"]` to shed the
-`p64` / `fractal` dependency tree. Pinning blake3 to `std` removes that
-footgun: any `std`-enabled build automatically gets blake3.
+**None for hashing.** BLAKE3 is in-tree.
+
+The cognitive substrate modules under `hpc/` — `plane`, `seal`,
+`merkle_tree`, `vsa`, `spo_bundle`, `crystal_encoder`, `compression_curves`,
+`deepnsm` — use `hpc::blake3` for integrity hashing and XOF expansion. That
+is a portable pure-Rust transcription of the BLAKE3 reference
+implementation, shipped in this crate: no SIMD, no `unsafe`, no C, and no
+build script.
+
+Earlier revisions pulled the external **`blake3`** crate here, first gated
+behind `hpc-extras` (which caused recurring "missing blake3" build errors
+for consumers such as `burn-ndarray` selecting
+`default-features = false, features = ["std"]`), then pinned to `std`.
+**Both are gone.** `blake3` and its transitive `constant_time_eq`,
+`arrayref` and `arrayvec` no longer appear in the dependency graph at any
+feature combination, so the footgun cannot recur.
 
 Consumers building `default-features = false` (no `std`, e.g. the
-`thumbv6m-none-eabi` nostd target) skip both the `hpc` module and the
-blake3 dep, so the nostd link is unaffected.
+`thumbv6m-none-eabi` nostd target) skip the `hpc` module and the BLAKE3
+code with it, so the nostd link is unaffected.
 
 ## Ecosystem
 

src/lib.rs

@@ -485,16 +485,21 @@ pub mod backend;
 /// extra deps. Cognitive/research modules (p64_bridge, crystal_encoder,
 /// deepnsm, etc.) are gated behind `hpc-extras` inside `hpc/mod.rs`.
 ///
-/// ## blake3 transitive dep
-///
-/// Enabling `std` (the default) automatically pulls `blake3`, which the
-/// cognitive substrate modules (`plane`, `seal`, `merkle_tree`, `vsa`,
-/// `spo_bundle`, `crystal_encoder`, `compression_curves`, `deepnsm`)
-/// import directly and unconditionally. There is no separate feature
-/// to enable; `std` is enough. Consumers building `default-features = false`
-/// without `std` (e.g. the `thumbv6m-none-eabi` nostd target) skip both
-/// the `hpc` module and the blake3 dep. See the `blake3` comment block
-/// in `Cargo.toml` for the rationale.
+/// ## BLAKE3 is in-tree — there is no `blake3` dependency
+///
+/// The cognitive substrate modules (`plane`, `seal`, `merkle_tree`, `vsa`,
+/// `spo_bundle`, `crystal_encoder`, `compression_curves`, `deepnsm`) hash
+/// with `hpc::blake3`, a portable pure-Rust transcription of the BLAKE3
+/// reference implementation that ships inside this crate.
+///
+/// **Enabling `std` no longer pulls the external `blake3` crate.** It, and
+/// its transitive `constant_time_eq`, `arrayref` and `arrayvec`, are gone
+/// from the dependency graph entirely.
+///
+/// Consumers building `default-features = false` without `std` (e.g. the
+/// `thumbv6m-none-eabi` nostd target) skip the `hpc` module, and with it
+/// the BLAKE3 code. See the `blake3` comment block in `Cargo.toml` for why
+/// the dependency was dropped and what it cost.
 #[cfg(feature = "std")]
 #[allow(clippy::all, unused_imports, unused_variables, unused_mut, dead_code)]
 pub mod hpc;