fold/docs/research/binary-detector-state.md

Binary-lane detector research state (sequential loop)

Tracked by the single research loop. One gap at a time; update this file after each fire so the loop resumes where it left off.

current_gap: done                 # all three gaps' bounded paths resolved
fixture_recipe: zig               # gcc x86-64 cross-link works via Docker (build-linux.sh)
iteration: 8
fixture_recipe_evaluated: true
# RETAINED (F1=1.000): oob-access, div-by-zero, use-after-free (P1 P-Code heap model).
# EXHAUSTED (bounded paths rejected, remaining = deeper features):
#   null-deref (interprocedural null-const propagation), int-overflow (source->sink taint-track).

Order of operations (each fire)

1. Read this state file.
2. If fixture_recipe_evaluated is false, evaluate the clang/gcc fixture-recipe hypothesis FIRST (it unblocks all three gaps): rebuild one fixture (e.g. cwe190_overflow) with clang/gcc instead of zig cc, and re-measure the runtime noise (does the ~153-site checked-arithmetic FP disappear?). Record the result; set fixture_recipe_evaluated: true.
3. For the current gap, run the signal-to-noise pre-check (fire the candidate signal against clean.elf; if it fires there, it is toolchain noise).
4. Implement one bounded sub-hypothesis; validate (ninja -C build/release, bench/score_binary.py, binary tests); retain only on F1 gain with no oob/div0 regression and no clean.elf FP; else revert + document in docs/research/binary-detector-research.md.
5. When a gap is exhausted (all paths retained/rejected), advance current_gap to the next in sequence.

Lessons (do not repeat)

• Rejected for toolchain noise (do NOT retry without a taint filter or a non-zig recipe): forward interprocedural null-deref summary (§19), UAF pcode_scan wiring (§20), carry-flag int-overflow (iteration 1, §iteration-log). EOF