kill: purge old-paradigm dist/platform binaries from tree

The generated C, amalgams, vendored runtime pins, and compiled binaries
from the Claude Code era are removed from the worktree. The El sources
survive; this tree is now source-only for the first-principles rebuild.

Per Principal direction 2026-08-19.

tools/evidence/report-prove.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# report-prove.sh — evidence the report generator works. Both directions.
+# The negative arms are the point: it must REFUSE, not degrade.
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+python3 - <<'PY'
+import sys, os, shutil, tempfile
+sys.path.insert(0, 'tools/evidence')
+from report import load, extract, cite, narrative_ok, Unbacked
+F=0; N=0
+def chk(name, cond, extra=""):
+    global F,N; N+=1
+    print(f"  {'ok  ' if cond else 'FAIL'}  {name}{'' if cond else '  '+extra}")
+    if not cond: F+=1
+
+EV = 'docs/experiments/evidence'
+print("POSITIVE — reads and verifies a real evidence directory")
+rows = load(EV)
+chk("manifest loaded and every artifact hash re-verified", len(rows) > 0, f"{len(rows)} rows")
+
+print()
+print("POSITIVE — a number is EXTRACTED from an artifact, not typed")
+val, r = extract(rows, 'compiler-code-lines', r'^code lines:\s*(\d+)')
+chk(f"pulled code-line count from captured stdout: {val}", val.isdigit())
+print(f"        source: {cite(r)}")
+
+print()
+print("NEGATIVE — refuses a claim whose artifact does not exist")
+try:
+    extract(rows, 'no-such-artifact-anywhere', r'(\d+)'); chk("refused", False, "it did NOT refuse")
+except Unbacked as e: chk("a claim with no artifact raises, does not degrade to blank", True)
+
+print()
+print("NEGATIVE — refuses a pattern that is not present in the artifact")
+try:
+    extract(rows, 'compiler-code-lines', r'^TOTAL COST IN DOLLARS:\s*(\d+)'); chk("refused", False, "it did NOT refuse")
+except Unbacked as e: chk("a number not present in the source raises", True)
+
+print()
+print("NEGATIVE — refuses an ALTERED artifact")
+tmp = tempfile.mkdtemp()
+shutil.copytree(EV, os.path.join(tmp,'ev'))
+target = [f for f in os.listdir(os.path.join(tmp,'ev')) if f.endswith('.out')][0]
+with open(os.path.join(tmp,'ev',target),'a') as f: f.write("tampered\n")
+try:
+    load(os.path.join(tmp,'ev')); chk("refused", False, "it accepted a tampered artifact")
+except Unbacked as e: chk("a tampered artifact halts the report entirely", 'ALTERED' in str(e))
+shutil.rmtree(tmp)
+
+print()
+print("NEGATIVE — refuses an empty manifest")
+tmp2 = tempfile.mkdtemp()
+open(os.path.join(tmp2,'MANIFEST.tsv'),'w').write("sha256\tbytes\texit\tms\tcommit\ttree\tutc\tartifact\tcommand\n")
+try:
+    load(tmp2); chk("refused", False, "an empty manifest passed")
+except Unbacked as e: chk("an empty manifest is a failure, not a clean report", True)
+shutil.rmtree(tmp2)
+
+print()
+print("POSITIVE — narrative may not carry a quantity")
+ok1,_ = narrative_ok("The seam binds after the build, which is the whole claim.")
+ok2,bad = narrative_ok("The compiler shrank by 10.6 percent, which is a lot.")
+chk("prose with no digits passes", ok1)
+chk("prose containing a bare number is REJECTED", not ok2, f"caught {bad}")
+
+print()
+print(f"  {'PROVEN' if F==0 else 'NOT PROVEN'} — {N} checks, {F} failed")
+sys.exit(F)
+PY

tools/evidence/report.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""report.py — the report is GENERATED from the artifacts. It is never composed.
+
+Every failure in this project's record lived at the report layer: the primary
+data was right and the summary of it was wrong. The enumeration said 7, the
+summary said 6. The harness ran 7 assertions and reported 6. The checker listed
+the new defect and printed 'ok'. Six agent results arrived and three were dropped.
+
+So the report layer stops being written by hand. Rules, enforced mechanically:
+
+  1. A number appears ONLY if it was extracted from a captured artifact.
+  2. An artifact whose bytes no longer match its manifest hash is a HARD FAILURE
+     -- the report refuses to render at all.
+  3. A claim naming an artifact that does not exist is a HARD FAILURE. It does
+     not degrade to a blank, a dash, or 'not available'.
+  4. Narrative may say why something matters. It may not contain a digit.
+"""
+import sys, os, csv, hashlib, re, subprocess
+
+class Unbacked(Exception): pass
+
+def sha256(p):
+    h = hashlib.sha256()
+    with open(p, 'rb') as f:
+        for b in iter(lambda: f.read(65536), b''): h.update(b)
+    return h.hexdigest()
+
+def load(evdir):
+    """Read a manifest and VERIFY every artifact before anything may be quoted."""
+    man = os.path.join(evdir, 'MANIFEST.tsv')
+    if not os.path.exists(man): raise Unbacked(f"no manifest at {evdir}")
+    rows = []
+    with open(man) as f:
+        for r in csv.DictReader(f, delimiter='\t'):
+            art = os.path.join(evdir, r['artifact'])
+            if not os.path.exists(art): raise Unbacked(f"artifact missing: {r['artifact']}")
+            actual = sha256(art)
+            if actual != r['sha256']:
+                raise Unbacked(f"artifact ALTERED: {r['artifact']}\n  manifest {r['sha256']}\n  actual   {actual}")
+            r['_path'] = art
+            rows.append(r)
+    if not rows: raise Unbacked(f"manifest at {evdir} has no rows -- nothing to report")
+    return rows
+
+def extract(rows, artifact, pattern, group=1):
+    """Pull a value OUT OF the captured stdout. Cannot be typed, only found."""
+    for r in rows:
+        if r['artifact'].endswith(artifact) or artifact in r['artifact']:
+            txt = open(r['_path'], errors='replace').read()
+            m = re.search(pattern, txt, re.M)
+            if not m: raise Unbacked(f"pattern not found in {r['artifact']}: {pattern!r}")
+            return m.group(group), r
+    raise Unbacked(f"no artifact matching {artifact!r} -- the number has no source")
+
+def cite(r):
+    return f"`{r['artifact']}` · sha `{r['sha256'][:12]}` · commit `{r['commit']}` · exit `{r['exit']}`"
+
+def narrative_ok(text):
+    """Rule 4. Prose may not carry a quantity."""
+    stripped = re.sub(r'`[^`]*`', '', text)
+    bad = re.findall(r'\b\d+(?:\.\d+)?\b', stripped)
+    return (not bad), bad