# Binary-lane detector research state (sequential loop)

Tracked by the single research loop. One gap at a time; update this file after
each fire so the loop resumes where it left off.

```yaml
current_gap: done                 # all three gaps' bounded paths resolved
fixture_recipe: zig               # gcc x86-64 cross-link works via Docker (build-linux.sh)
iteration: 8
fixture_recipe_evaluated: true
# RETAINED (F1=1.000): oob-access, div-by-zero, use-after-free (P1 P-Code heap model).
# EXHAUSTED (bounded paths rejected, remaining = deeper features):
#   null-deref (interprocedural null-const propagation), int-overflow (source->sink taint-track).
```

## Order of operations (each fire)

1. Read this state file.
2. If `fixture_recipe_evaluated` is false, evaluate the clang/gcc fixture-recipe
   hypothesis FIRST (it unblocks all three gaps): rebuild one fixture (e.g.
   `cwe190_overflow`) with `clang`/`gcc` instead of `zig cc`, and re-measure the
   runtime noise (does the ~153-site checked-arithmetic FP disappear?). Record
   the result; set `fixture_recipe_evaluated: true`.
3. For the current gap, run the signal-to-noise pre-check (fire the candidate
   signal against `clean.elf`; if it fires there, it is toolchain noise).
4. Implement one bounded sub-hypothesis; validate (`ninja -C build/release`,
   `bench/score_binary.py`, binary tests); retain only on F1 gain with no
   oob/div0 regression and no clean.elf FP; else revert + document in
   `docs/research/binary-detector-research.md`.
5. When a gap is exhausted (all paths retained/rejected), advance
   `current_gap` to the next in sequence.

## Lessons (do not repeat)

- Rejected for toolchain noise (do NOT retry without a taint filter or a non-zig
  recipe): forward interprocedural null-deref summary (§19), UAF pcode_scan
  wiring (§20), carry-flag int-overflow (iteration 1, §iteration-log).
EOF