cider-tbd-diff, the fifteenth binary of graph-specs. It parses the SDK libSystem.tbd re-export closure for the OFFICIAL macOS export set, reads the ACTUAL export set out of the built dylibs through the Mach-O exports TRIE rather than nm, and diffs them. The trie is not a detail: it carries RE-EXPORT aliases, and cider exports _memcpy as a re-export of __platform_memmove, which never appears in nm -gU, so an nm scan wildly under-reports the surface. BYTE IDENTITY ON THE REAL INPUT WAS IMPOSSIBLE, and here is exactly why: the Apple SDK is not realised in this store, only apple-sdk-14.4.drv, so there is no libSystem.tbd for --sdk to point at and nothing to compare on. The gate is a hand-built FIXTURE SDK instead, built to exercise every branch the two parsers have rather than to look real: a v4 root with a QUOTED install-name, a $ld$ pseudo-symbol that must be dropped, and a reexported-libraries list SPLIT ACROSS TWO LINES, which is the whole reason the bracket collector exists; a v4 leaf with per-entry target filtering (an i386 entry that must not be picked up), weak-symbols, and a symbols list wrapped across lines; a v5 JSON leaf reached THROUGH the closure, with a targets-less group that counts, an arm64 group that does not, and a reexport naming a file that is not there; a demand file, and a cider root holding a file that is NOT a Mach-O, so the objdump failure path is the one that runs. Six modes compared byte for byte on stdout, stderr and exit code: supply only, --arch arm64, --demand, --cider-root, a missing root tbd, and the --out plus --json writers compared as FILES. Plus the control: x86_64 and arm64 must differ, and do, which is what proves the target filter is live rather than ignored. ONE DIFFERENCE, named: a missing --sdk is argparse own usage text and exit 2 in the python. There is nothing to reproduce there, so the Rust prints its own one-line message and keeps the 2. scripts/ python: 7 files to 6, 5,784 lines to 5,435.