probe: wrong unit, an unsupported bound, and a checked ternlog claim

Three coderabbit findings on 5385ebf. Two are errors the PREVIOUS correction
introduced, which is the third generation of one defect class in this PR and the
thing worth recording.

1. The unit was OBSERVATIONS, not widths. The sweep visits 2 bases x 7 k = 14
   distinct widths and repeats them 7 times, so the counter tops out at 98
   samples of 14 widths. "7 of 98 widths" invents 84 widths that do not exist.
   The measured numbers are unchanged; what was wrong is what they counted.

2. "the gap is a LOWER BOUND on any true difference" is withdrawn. Truncation
   compresses the observed gap toward zero — but only from whichever side the
   truly cheaper arm sits on, and which arm that is is exactly what this sample
   cannot say. A bound needs the sign first. Replaced with: selection-biased,
   direction and magnitude unresolved. That is strictly more honest and costs
   nothing, because the decision never rested on the size of D - F, only on the
   absence of support for the expensive option.

3. Asked for a rustdoc example on `probe_fixed4_ternlog`. Declined as asked, and
   done better: this file is in `examples/`, where rustdoc never runs, so a ```
   block would be an untested assertion dressed as a verified one — the exact
   thing this PR spent its time removing. `main` now asserts the semantics
   instead, so the claim is checked on every run.

   That assertion earned its place immediately: it rejected the expected value I
   had written from doing the arithmetic in my head. I had 0xF0F0 & 0x0F0F as
   0x0F00 when the nibbles do not overlap at all, so it is 0x0000, and majority
   is 0x00FF rather than 0x0FFF. A truth table transcribed one bit off would
   still emit plausible `vpternlogq` and survive a read of the assembly — and so
   would a doc example nobody executes.

Blackboard (17) corrects (16) on both counts and tabulates all five instances of
the class, with the mechanical sweep that finds them faster than review does:
for every printed line, name the accumulator behind it, its UNIT and its SCOPE,
then check the words against all three.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DCfrD5y19cvFc4AoyydXYv

Author: claude

.claude/blackboard.md

@@ -1,3 +1,68 @@
+## 2026-09-16 (17) — ⊘ CORRECTS (16) twice: the unit was OBSERVATIONS not widths, and "lower bound" was one claim too many
+
+Both caught by coderabbit on the same PR (#315), both are errors (16) introduced
+while correcting (15), and both are the SAME defect class (15) and (16) already
+name — a label or a claim outrunning what the measurement supports. Third
+generation of one mistake in one session, which is the finding worth keeping.
+
+### 1. "7 of 98 widths" — wrong unit, overstated the design 7×
+
+The sweep visits `2 bases × 7 k = 14` **distinct widths** and repeats them
+`REPEATS = 7` times, so the counter tops out at **98 OBSERVATIONS of 14
+widths**. (16) reported "7 of 98 widths", which invents 84 widths that do not
+exist. Corrected in both the probe's labels and here:
+
+```
+median ABSOLUTE tail cost, 7 qualified observations of 14 widths (ns):
+  P 16.82    D 5.24    S 6.28    F 5.33
+observations where all four tails were measurable: 7 of 98
+  (14 distinct widths × 7 passes)
+```
+
+The measured numbers are unchanged; what was wrong is what they were counting.
+
+### 2. "the gap is a LOWER BOUND" — not established, withdrawn
+
+(16) said the censored D−F gap is "a **lower bound** on any true difference".
+That is one claim too many. Truncation does compress the gap toward zero — but
+only toward zero **from whichever side the truly cheaper arm sits on**, and
+which arm that is is precisely what this sample cannot say. A bound needs the
+sign first. So the honest statement, now in both places:
+
+> **selection-biased; direction and magnitude unresolved.**
+
+Note this is STRICTLY more honest than the claim it replaces, and it weakens
+nothing that mattered: the decision never rested on the size of D−F, only on
+the absence of support for the expensive option.
+
+### Why this keeps happening, stated so the next session can shortcut it
+
+Five instances, one class, three of them introduced *by the fix for the
+previous one*:
+
+| # | the claim | what the code/design actually had |
+|---|---|---|
+| 1 | D/P ratio read as a tail result | arms with different bodies; `tail == 0` rows moved |
+| 2 | "widths where D beats S: N of 14" | a count thresholded by a floor that is itself a draw |
+| 3 | "pooled over all 7 passes" | the last pass alone |
+| 4 | "D removes 121.3% of the padded cost" | a fraction inflated by a negative numerator |
+| 5 | "7 of 98 **widths**" / "a **lower bound**" | 98 observations of 14 widths / no established sign |
+
+**The generalizable rule: correcting one statistic does not audit the ones
+beside it, and the correction itself is a new claim needing the same check.**
+The cheap sweep is mechanical — for every printed line, name the accumulator
+behind it, its UNIT, and its SCOPE, then read whether the words match all
+three. That sweep found instance 5's siblings in one pass (all thirteen
+accumulators pool; none is cleared) where four rounds of review had found them
+one at a time.
+
+Corollary for a verdict rather than a label: state only what the sample can
+support. "No measured support for the expensive option" survives every one of
+the five corrections above. "The cheap option is equal", "the gap is a lower
+bound", and every ratio drawn from a near-zero denominator did not.
+
+---
+
 ## 2026-09-16 (16) — ⊘ CORRECTS (15): its headline numbers came from a BUGGY binary, and the D-vs-F ordering is NOT established
 
 Same PR (#315), same day, four codex findings later. Entry (15) stands on its

examples/mask_algebra_tail_probe.rs

@@ -418,7 +418,12 @@ mod imp {
         // so on some runs NOTHING qualifies and the only honest output is to
         // say the question was not answered.
         let mut qualified = 0usize;
-        // Absolute tail cost in ns on the qualified widths, per arm. Ratios and
+        // Absolute tail cost in ns on the qualified OBSERVATIONS, per arm.
+        // "Observation", not "width": the sweep visits 2 bases x 7 k = 14
+        // distinct widths and repeats them REPEATS times, so the counter tops
+        // out at 98 samples of 14 widths. Calling 98 a width count overstates
+        // the design by 7x (coderabbit, #315) — the same wrong-unit defect as
+        // the pooled-vs-per-pass labels, one field over. Ratios and
         // shares can blow up when a denominator or numerator approaches zero;
         // a nanosecond cannot. These four numbers are the least-processed form
         // of the result and are what the verdict should be sanity-checked
@@ -580,7 +585,7 @@ mod imp {
             }
         };
         println!(
-            "\nmedian ABSOLUTE tail cost on the {qualified} qualified widths (ns):\n\
+            "\nmedian ABSOLUTE tail cost, {qualified} qualified observations of 14 widths (ns):\n\
              \x20 P {:.2}   D {:.2}   S {:.2}   F {:.2}",
             median(&mut p_ns.clone()),
             median(&mut d_ns.clone()),
@@ -601,10 +606,19 @@ mod imp {
         // conditioning, it applies it to both arms.
         //
         // The filter stays because unfiltered is worse — negative tails gave
-        // "D removes 121.3% of the padded cost" — but this is a CENSORED
-        // sample and the D-F gap it yields is a lower bound on any true
-        // difference. Resolving it properly needs precision, not filtering:
-        // more iterations, a quiet machine, or modelling the censored points.
+        // "D removes 121.3% of the padded cost" — but this is a CENSORED sample:
+        // SELECTION-BIASED, with the direction and magnitude of the bias
+        // UNRESOLVED.
+        //
+        // ⊘ An earlier version of this note called the observed D-F gap a
+        // "lower bound on any true difference". That is one claim too many
+        // (coderabbit, #315). Truncation does compress the gap toward zero —
+        // but only toward zero FROM WHICHEVER SIDE the truly cheaper arm sits
+        // on, and which arm that is is precisely what this sample cannot say.
+        // Asserting a bound requires knowing the sign first, so neither the
+        // sign nor the magnitude of the true difference is recoverable here.
+        // Resolving it needs precision, not filtering: more iterations, a
+        // quiet machine, or modelling the censored points.
         println!("\npooled over all {REPEATS} passes -- S {}  D {}  F {}", pc(s_all), pc(d_all), pc(f_all));
         println!("\nShare of the padded tail's cost removed, differenced per pass.");
         println!("Percentage-point gaps, pooled, with the per-pass spread beside them:");
@@ -632,7 +646,8 @@ mod imp {
         // adjudicate the finer D-vs-F question, and saying so is the result.
         let resolvable = qualified * 4 >= rows && ds_med.is_finite() && df_med.is_finite();
         println!(
-            "widths where all four tails were measurable: {qualified} of {rows}               ({}resolvable)",
+            "observations where all four tails were measurable: {qualified} of {rows}  \
+             (14 distinct widths x {REPEATS} passes)  ({}resolvable)",
             if resolvable { "" } else { "NOT " }
         );
         if !resolvable {

examples/narrow_bitop_codegen_probe.rs

@@ -129,6 +129,21 @@ pub extern "C" fn probe_scalar4_and(a: &[u64; 4], b: &[u64; 4], out: &mut [u64;
 /// `IMM` is the 8-bit truth table, matching `mask_ternlog`'s own convention:
 /// bit `(a<<2)|(b<<1)|c` of `IMM` is the output for that input triple. Written
 /// as the canonical sum-of-minterms so nothing but the truth table is assumed.
+///
+/// `IMM = 0xE8` is bitwise MAJORITY — a bit is set where at least two of the
+/// three inputs have it set:
+///
+/// ```text
+/// a = 0xF0F0, b = 0x00FF, c = 0x0F0F
+/// a&b = 0x00F0    a&c = 0x0000    b&c = 0x000F    ->   0x00FF
+/// ```
+///
+/// This is deliberately NOT written as a rustdoc example. This file lives in
+/// `examples/`, where rustdoc never runs, so a ``` block here would be an
+/// untested assertion dressed as a verified one — the exact thing the rest of
+/// this PR spent its time removing (coderabbit asked for a usage example,
+/// #315). `main` asserts the triple above instead, so the claim is CHECKED on
+/// every run rather than decorated.
 #[inline(never)]
 #[unsafe(no_mangle)]
 pub extern "C" fn probe_fixed4_ternlog(a: &[u64; 4], b: &[u64; 4], c: &[u64; 4], out: &mut [u64; 4]) {
@@ -168,8 +183,19 @@ fn main() {
     let b8 = [0x00FFu64; 8];
     let mut o8 = [0u64; 8];
     probe_u64x8_and(&a8, &b8, &mut o8);
+    // Pin the ternlog arm's SEMANTICS, not just that it runs: `IMM = 0xE8` is
+    // bitwise majority, so a bit survives where at least two inputs set it.
+    // 0xF0F0/0x00FF/0x0F0F pairwise-AND to 0x00F0 | 0x0000 | 0x000F = 0x00FF.
+    //
+    // This assertion earned its place on the first run: it rejected 0x0FFF,
+    // which is what I had written from doing the arithmetic in my head (I had
+    // 0xF0F0 & 0x0F0F as 0x0F00 when the nibbles do not overlap at all, so it
+    // is 0x0000). A truth table transcribed one bit off would still emit
+    // plausible `vpternlogq` and survive a read of the assembly — and so would
+    // a doc example nobody executes. This fails instead.
     let c4 = [0x0F0Fu64; 4];
     probe_fixed4_ternlog(&a4, &b4, &c4, &mut o4);
+    assert_eq!(o4, [0x00FFu64; 4], "IMM=0xE8 must be bitwise majority: 0xF0F0/0x00FF/0x0F0F -> 0x00FF");
     let mut o2 = [0u64; 2];
     probe_scalar2_and(&[1, 2], &[3, 3], &mut o2);
     println!("probe: {o4:?} {o8:?} {o2:?}");