log v1 experiments: nineteen cycles, organised by the method that produced them

cycles/    one file per Ishikawa -> scientific method -> Six Sigma loop, named
           for the DEFECT not the fix, carrying the commit record as written at
           the time
findings/  what the cycles produced, cross-cut: live bugs, architecture answers,
           and defects in my own measurement

The organising finding is that predictions which came back FALSE produced every
significant result. Eleven of sixty-one failed, and those eleven found: that the
arity table was not drifted but 40% incomplete; that the AST traversal is
irreducible and only rules and judgments move; that guards could refuse through
the seam after all; and that routing el_bin_lookup through the gate did NOT fix
the SIGSEGV, because the fallback strlen was the hazard -- a wrong fix I would
otherwise have shipped as verified.

One cycle was run without committing predictions first and had to be discarded
as rigged. It is kept, in full, as 18-async-half-expressible.md.

docs/v1/experiments/findings/answers.md

@@ -0,0 +1,12 @@
+# Architecture questions closed
+
+All five were open in `geometry-vs-code.md`. Each was closed by measurement, not
+by argument.
+
+| Question | Answer |
+|---|---|
+| **Concurrency** — hardware threads are code, but is *ordering* geometric? | **Ordering is geometric.** Causality is a partial order (Lamport 1978); a total order is an arbitrary extension that "cannot be depended on to imply a causal relationship." Languages force a total order at authoring time, so every lock, barrier and fence is apparatus for recovering the partial order that was destroyed. CALM: a program has a coordination-free implementation **iff monotone**. What breaks monotonicity is destructive update. **Coordination is the price of forgetting.** |
+| **Error handling** — does `grounded: false` cover *failed*? | **No.** Standing is a *signed* component: `>0` supported, `=0` unknown, `<0` contradicted. Not-known and known-false are opposite directions on one axis; a boolean cannot tell them apart. `inhibitory` as an int32 flag is that sign wearing a boolean. |
+| **Parsing** — is a grammar a convention, or a region? | **A grammar is a basis; parsing is transduction onto it.** Lexeme→token is convention, shape recognition is a region, byte traversal is irreducible. **But the SHOULD gate refused the obvious move:** the keyword table stays code, because the set is closed by the language definition and the lexer runs before the program is understood. Same verdict as `is_digit` in ASCII. |
+| **Numeric literals** — is `3` a position or a convention? | **The numeral is convention; the number is a position — and a bare `3` is a magnitude with no axis.** It is not a position until something gives it a direction, which is why `3.days` needs a calendar. Demonstrated: `t + 3` refused, `t + 1.hour` accepted. |
+| **The module system** — if the partition is a neighbourhood, does linking survive? | **Premature.** The partition is a filesystem path and there is no namespacing at all. `import` is textual inlining; with a `.elh` header, symbols resolve at C link time. Two modules defining `helper` emit two C functions into one translation unit. Linking barely survives the *path* partition. |

docs/v1/experiments/findings/bugs.md

@@ -0,0 +1,74 @@
+# Live defects found
+
+Every one compiled clean, ran, and produced a wrong result or a crash with **no
+diagnostic at any layer**. All four were present before this session; none was
+introduced by it.
+
+## Silent miscompilations
+
+### 1. An unannotated `let` loses its type
+
+```el
+let a = str_len("hello")     // no annotation
+let b = str_len("hi")
+let c = a + b                // → el_str_concat(a, b) on two integers
+```
+
+Compiled clean. Printed **nothing** where it should print 7. Fixed: an
+unannotated `let` takes its type from what its initialiser returns. The return
+types were already required for dispatch and were simply never consulted at the
+binding site.
+
+### 2. Reserved keywords that reserved nothing
+
+```el
+let seed = 42
+let impl = seed + 1
+```
+
+`sealed`, `activate`, `seed`, `protocol`, `impl` were keywords in the lexer and
+consumed by no parser or codegen path. Using one did not fail to parse — it
+compiled clean, with zero `cc` errors, and printed **0 instead of 44**. Fixed by
+removing all five.
+
+### 3. `Instant + Int` was never refused
+
+```el
+let t: Instant = now()
+let u: Instant = t + 3       // → (t + 3), reported clean
+```
+
+`Duration + Int` was refused — *"an Int carries no unit"* — while adding a
+dimensionless number to a **point** silently moved the instant by an
+unspecified amount. Three of *what*? Whatever the representation happens to be.
+The rule was simply never written.
+
+## Security-relevant
+
+### 4. Annotations are never verified
+
+```el
+let x: Int = "hello"; x + 1     →  4343631981   a string POINTER used as an integer
+let s: String = 42; println(s)  →  nothing      address 42 dereferenced
+```
+
+The first **leaks a raw memory address into program output**. The second is an
+**arbitrary-read primitive** if the integer is ever attacker-influenced.
+
+### 5. `sha256_hex(<integer>)` segfaults
+
+```el
+let h: String = sha256_hex(50000)    →  exit 139, SIGSEGV
+```
+
+Compiled clean. `el_bin_lookup` checked only a 4096 floor — no alignment, no
+small-int, no negative — and reads **eight bytes backward** from the pointer.
+And the actual crash was one level further on: `el_input_len` fell through to
+`strlen()` on address 50000, because a NULL check does not establish that a slot
+is a pointer.
+
+Fixed, and the guard is now a **gate**: `el_tagged()` is exported in
+`el_runtime.h`. `geom_of` and `mfld_of` were always correct because their authors
+knew to call `looks_like_heap_obj`; `el_bin_lookup` and `el_input_len` were wrong
+because theirs did not, and the function was `static`, so every sibling
+translation unit re-derived it.

docs/v1/experiments/findings/measurement-defects.md

@@ -0,0 +1,41 @@
+# Defects in my own measurement
+
+Recorded because the pattern is the point: **four of these, all the same shape —
+searching by name or scope instead of by the operation itself.** Each was caught
+by running something, never by reading.
+
+### 1. Scoped the search to one file
+
+Reported `test` as an inert keyword by checking only `parser.el`. **codegen**
+consumes it at 4135 for `--test` mode, and the tree has 408 uses. Removing it
+would have broken every test in the suite — including the ones used to verify
+the removal.
+
+### 2. Searched by variable name, not by operation
+
+Grepped for `native_list_append(tokens` to find direct token appends.
+`interp_tokens_append_all` calls its parameters `dst`/`result`, carries its own
+copy of the stride, and corrupted generation 2 — while generation 1 built fine,
+because the compiler's own source uses string interpolation.
+
+### 3. Scoped to compiler sources; the stride had escaped into tests
+
+`tok_count` in `test_compiler.el` computed `len/2` independently. 21 tests failed
+after the token layout changed.
+
+### 4. Read the wrong exit code
+
+```bash
+timeout 10 /tmp/leakrun 2>&1 | head -2; echo "exit=$?"     # reports head's exit
+```
+
+Reported `exit=0` for a program that was returning **139 (SIGSEGV)**. I nearly
+recorded a segfault as a clean run.
+
+### And one that was not a measurement defect but a method defect
+
+One cycle was run **without committing predictions first** — see
+`cycles/18-async-half-expressible.md`. The test joined the thread immediately
+after creating it and printed the word `DEFERRED` itself. A test authored by the
+party holding the conclusion, with nothing committed beforehand, cannot fail.
+It had to be discarded and re-run.