Skip to content

docs: findings report for the fuzzing-the-figures brief, with the on-air H1 evidence (re-opened for review) - #111

Open
M0LTE wants to merge 4 commits into
mainfrom
docs/fuzzing-the-figures-findings-v2
Open

M0LTE wants to merge 4 commits into
mainfrom
docs/fuzzing-the-figures-findings-v2

Conversation

@M0LTE

@M0LTE M0LTE commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator

Re-opens, for your review, the findings report that I merged today without it (#89, #90, #92, #106, all reverted by the unwind PR; merge that first, then this diff is the whole report). Four commits, unchanged from what was merged: the report itself (calibration score, novel findings, citation coverage map, pinned delegated semantics, decisions, limits, next steps); the on-air H1 reproduction with the verbatim transcripts, axcall output and run script under docs/evidence/h1-timer-recovery-2026-09-10/ and the explorer-reach update; the link to #91; the link to the verification programme #93. The brief gets a one-line status pointer. Issues #91 and #93 link to this report on main, so those links resolve once this merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ

M0LTE and others added 4 commits September 10, 2026 22:52
* docs: findings report for the fuzzing-the-figures brief

Records what was built against docs/fuzzing-the-figures.md on 10 September 2026 and what it found. Three checkers now run in packet-net/ax25sdl CI: the static totality and determinism lint (#88), the reference interpreter with its golden traces and the clean-room SREJ traces (#75, #76), and the two-station bounded explorer with its calibration suite (#89).

Headline results: the figures are total and deterministic (8051 feasible valuations, no holes, no overlaps, also true before the #40 fix, so static totality could not have found #40); the calibration score is 10 of the 11 known defects rediscovered between the explorer's invariants and the golden traces, with only #41 out of reach; and one novel hypothesis, H1, a station entering Timer Recovery with no drawn path out once the clearing acknowledgement arrives on an I frame, corroborated by an author's note in direwolf's source. The report also carries the citation coverage map (Timer Recovery has 38 of 92 arms uncited), the pinned delegated semantics, the decisions taken against the brief's suggestions, the model's limits, and the recommended next steps. Nothing is filed as an erratum; the brief's report-first contract holds.

The brief gets a one-line status pointer to the findings.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ

* docs(findings): H1 reproduced on packet.net; runtime acknowledge-pending defect

Folds in the packet.net two-station harness reproduction (packet-net/packet.net#811): the Timer Recovery stranding happens on the real runtime in both quirk modes, a T3 expiry is dropped because figc4.5 has no arm for it, and with the figure run as drawn the retry counter ratchets to N2 across recoveries on a working link. The control case with the acknowledgement on an RR completes normally, so only the ack carrier differs. The same trace exposed a runtime-only defect, Acknowledge Pending left set after an inline retransmission, filed as packet-net/packet.net#812 and added to the next steps.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
#48 (#90)

Adds the on-air reproduction of hypothesis H1 (a station stranded in Timer Recovery when the clearing acknowledgement arrives on an I frame): M0LTE (axcall 0.2.27) to GB7RDG (LinBPQ 6.0.25.23) on 40 m QPSK 3600 on 10 September 2026, with the KISS tee dropping exactly one of our I frames. After the recovery the stranded station sent no keepalive poll in 290 s; the identical control run polled at +120 s and +240 s. The decoded transcripts, axcall output and the run script are checked in verbatim under docs/evidence/h1-timer-recovery-2026-09-10/.

Also folds in packet-net/ax25sdl#90: with flow-control moves and a v2.0 stub peer the explorer now reaches #43, #45 and #48 unprompted (seven of the nine live defects), and one of the brief's assumptions is corrected: from a cold connect #44 masks #45, because figc4.2 swallows the FRMR and retries with SABM. The H3 note (the DL-FLOW-OFF/ON busy arms emit RNR/RR with no N(r) staging) is recorded under limits. Next steps now lead with filing H1.


Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant