Compute admission

The synchronous Core-1 embedding API checks each source-backed input against the checked message’s rank and layout before executing its dataflow. A mismatch returns ZL_STATUS_COMPILE_ERROR with ZL_COMPUTE_ERROR_SHAPE_MISMATCH_V2 and ZL-COMPUTE-0001; it does not publish a tensor. Input arity and malformed graph failures remain ZL_COMPUTE_ERROR_INVALID_KERNEL_V2.

Both scalar and Apple CPU SIMD materializers share input/graph admission and retain independent graph walks. Unknown opcodes, out-of-range input indices, and forward dataflow references reject before either graph walk. This includes unreachable malformed nodes: choosing a different output is not permission to admit an invalid kernel.

Views borrow storage for the duration of the synchronous call. Nonempty views must have an addressable element count and positive, non-overlapping strides in their declared row/column layout order; sliced views may contain gaps. Singleton axes may have zero stride. Negative strides and overlapping logical elements are outside this bounded profile and return ZL_COMPUTE_ERROR_INVALID_SHAPE_V2. Multiple read-only input views may share the same allocation. Returned tensors always own their allocation.

The C caller remains responsible for the actual allocation size and lifetime: a pointer plus strides cannot prove that storage exists. Likewise an opened device is borrowed only until zl_compute_device_close_v2; using a closed C handle is not permitted by the embedding contract.

Any zero extent makes a shape empty independently of axis order, even if the product of its other extents would overflow. Constructors give empty views zero strides without multiplying those extents. Nonempty views must fit the PTRDIFF_MAX / sizeof(double) element limit. An unaddressable view constructor returns ZL_COMPUTE_ERROR_INVALID_ARGUMENT_V2 without allocating or reading.

Evidence: runtime.core1_compute_admission_{typed,views,bounds,nodes} exercises both native providers, including valid owned output and noncontiguous input. tests/properties/test_compute_admission.py checks zero-extent axis/layout invariance through the public C constructors, and --suite compute-admission provides behavior-mapped negative controls. Existing source/AST/wire schemas and frozen benchmark revisions are unchanged by these admission fixes.

This is the admission slice of ZER5-25, not completion of the full checked compute surface. The dataflow extension covers source broadcasts, views, and bounded index spaces. Relaxed policy and the 21 scaffold promotions are tracked separately within that ticket.