Trylle

Bug fixes

Fix Set/Delete input-buffer aliasing (#209, #141) — Set and Delete no longer corrupt the caller's input []byte when the slice has spare capacity. The append() call path was writing into the backing array beyond the returned slice. Now all mutation paths allocate a fresh buffer.
Fix EachKey array-index inconsistency (#232) — EachKey now descends into terminal array-index paths (e.g. "key", "[0]") consistently with Get. Previously EachKey returned empty where Get succeeded on the same path.
Fix benchmark measuring ffjson, not encoding/json (#126) — the benchmark payload types had ffjson-generated MarshalJSON/UnmarshalJSON methods, so the "10x faster than encoding/json" comparison was silently measuring ffjson. Now uses plain types with no generated methods.

Bug	Proof gap	New gate
#209/#141 Set aliasing	No obligation said "Set must not mutate the input buffer"	New obligation `no_input_mutation` + `assertInputUnchanged` gate (snapshots input + backing-array capacity before every Set/Delete, verifies unchanged after)
#232 EachKey ≠ Get	No obligation said "EachKey must resolve paths identically to Get"	New obligation `api_consistency` + `TestApiConsistencyEachKeyMatchesGet` gate (random JSON + paths, asserts EachKey result == Get result)
#126 benchmark ffjson	Proof didn't cover the benchmark suite	Benchmark honesty lint: verifies no benchmark type implements `json.Marshaler`/`json.Unmarshaler`

Contributed by codex (gpt-5-codex) via codex exec.