Three triage fixes: a diagnostic that could not print, a test that documented the wrong build, and five stale region margins

[JC-000]

Closes #217, closes #208, and closes the CLAUDE.md sub-item of #193.

One commit each; disjoint files. All five profiles build to PRGs byte-identical to master (5/5) — nothing here can reach an image.

e3ef15e — #217, and three more of the same defect

Under set -eo pipefail, four error paths in tools/integration/build_nistcurves_p256.sh killed the shell inside the branch written for exactly the condition being reported, leaving a bare non-zero exit and no message.

1. The reported one. lib_preflight_fail's pin= line was the only one of three adjacent git calls without || true. RED exit=128, zero output; GREEN the full Build error in build_nistcurves_p256.sh #124 remedy message, exit=1.
2. Worse than the reported one. ZP_MEMBER="$(ar65 t … | grep '^zp_config')" — with no matching member grep exits 1, the assignment dies, and the 0) arm never runs. A silently dropped zp_config member is the Build error in build_nistcurves_p256.sh #124 runtime-corruption class: zp_ptr2 reverts to $fd and collides with zp_temp/zp_count, with no link error. RED exit=1 silent; GREEN ERROR: no zp_config member in ….
3. check_zp_slot's got=$(od65 … | awk …) — a failing od65 makes the ${got:-<absent>} message unreachable. RED exit=3 silent; GREEN the full export mismatch.
4. With pin empty, the diagnosis branches asserted a wrong cause: a populated submodule under a non-repo root blamed a stale checkout and prescribed a git submodule update that cannot run there. Empty pin now has its own first branch and its own remedy text, and the original both-empty case keeps its "not checked out at all" sentence as an independent, appended condition rather than losing it to the reordering.

Plus the literal \n that rendered mangled in exactly the message it belonged to.

A measured correction to the review that prompted this. case "$(… | grep -c .)" is not a fourth instance: a command substitution in a case word has its status discarded and set -e never sees it. Verified three ways (arm matched, no arm matched, false | grep -c .) plus end-to-end with the assignment guarded and this line bare — the 0) arm runs and prints. It is the assignment that is fatal, not the pipeline shape. The line is left bare and the asymmetry documented in place, deliberately rather than given a || true that would do nothing: a dead guard there would read as evidence the mechanism was understood. The reviewer who raised it independently retracted after reproducing all three variants.

Every assignment site in the script is now guarded (grep -nE '=\$\(|="\$\(' → 53, 152/153/160/168, 439, 452), with the two for m in $(ar65 t …) loops correctly left bare as word-list expansions.

efe2dc2 — #208: the P-384 negotiation test described an armed build

[1b]'s C=1 was attributed to ecdsa_verify_384_tls's DER parse. That is the ENABLE_P384_VERIFY=1 mechanism; unarmed — every build anyone runs — the carry comes from a bare sec in the gated-off arm, and ecdsa_verify_384.s is filtered out of the link entirely.

Verified four independent ways rather than reworded: the .ifdef in src/crypto/ecdsa_verify.s; Makefile:388-393's filter-out; the caller in src/tls_cert.s tail-calling jmp ecdsa_verify with curve_id=1; and the bytes of the PRG the passing run tested ($6B41: 20 95 3B AD 7F B6 F0 04 38 4C 54 6B, with ecdsa_verify_384_tls appearing 0 times in all five maps).

Review confirmed this is the sole mechanism by patching $6B49 38→18 (SEC→CLC) in the PRG: [1b] went red, restoring it went green. No third source of the carry.

Six sites corrected, not the two originally identified — including the module docstring's "still a sec / rts stub that Phase 4a fills in", the FAIL-branch comment and message string (now (gated-off P-384 arm should sec)), and the PASS string, which claimed "Phase 4a dispatcher reached" when the dispatcher reached is ecdsa_verify. Both the FAIL and PASS strings are exercised — PASS by the normal run, FAIL by the mutation above. Suite still 2/2.

src/tls_cert.s:670-674 carries the same retired vocabulary and is deliberately left alone: this is a docs/test commit and that is source. Filed as follow-up.

7ae1804 — #193: every post-#211 region margin, re-measured

#211 moved ~27 B into HTTP_AUX_CODE2. One paragraph was updated and three were not, leaving CLAUDE.md contradicting itself on three margins — twice within two lines of each other. Load-bearing: tools/uci/_memory_policy.py sizes rig scratch from the comb CRYPTO_OVERLAY tail, and the ip65 block reads as the authoritative sizing paragraph.

region	free	file said
ip65 LOADER ($1FFF − $1FEE)	17 B	21 B
ip65 CRYPTO_OVERLAY ($5FFF − $5F82)	125 B	152 B
comb CRYPTO_OVERLAY ($5FFF − $5F81)	126 B	153 B

Also corrected: HTTP_AUX_CODE2 is 196 B, not the pre-#211 169 B.

LOADER_OVERFLOW no longer claims to carry "~125 B of http.s". http.s has no .segment "LOADER_OVERFLOW" at all — src/http.s:1096-1097 records the eviction itself. The real tenants are boot.o (110 B), vic.o (18 B) and crypto_swap.o (204 B) = 332 B.

The ip65 figures are now labelled ip65-onchip — the shipped product, because they are not all profile-independent: CRYPTO_RESIDENT is 231 B on the REU profile against 145 B on onchip (LIB_NISTCURVES_MUL_CODE at $27 vs $A2). LOADER, CRYPTO_OVERLAY and NET_CODE genuinely are identical across the two, and the block now says which is which. This is precisely the per-profile hazard CLAUDE.md's own maintenance note describes, and the previous wording generalised from three matching figures to a fourth that does not.

The 21 → 17 B LOADER shrink is attributed to http.o's CODE growth from #211's own fix, isolated by reverting only src/http.s to 60022de and rebuilding (Size=00035A → 00035E, whole-segment CODE 0x17DE → 0x17E2). Attribution is to the module and the commit; nobody disassembled which four bytes, and the file says so.

Evidence

#217 is red-green on four reproduced failures plus a healthy-path control at exit 0. #208 and #193 are documentation corrections whose claims are each backed by a build artifact quoted in the commit — a map segment row, a module list, PRG bytes — never by another document.

Two adversarial rounds. Round 1 found the commit fixing CLAUDE.md's self-contradiction had left two more of identical origin; round 2 found a third (CRYPTO_RESIDENT) and a stale attribution (LOADER_OVERFLOW), both now closed, and retracted its own case-line finding.

🤖 Generated with Claude Code