Repository navigation
docs: findings report for the fuzzing-the-figures brief - #89
Merged
Merged
Conversation
Records what was built against docs/fuzzing-the-figures.md on 10 September 2026 and what it found. Three checkers now run in packet-net/ax25sdl CI: the static totality and determinism lint (#88), the reference interpreter with its golden traces and the clean-room SREJ traces (#75, #76), and the two-station bounded explorer with its calibration suite (#89). Headline results: the figures are total and deterministic (8051 feasible valuations, no holes, no overlaps, also true before the #40 fix, so static totality could not have found #40); the calibration score is 10 of the 11 known defects rediscovered between the explorer's invariants and the golden traces, with only #41 out of reach; and one novel hypothesis, H1, a station entering Timer Recovery with no drawn path out once the clearing acknowledgement arrives on an I frame, corroborated by an author's note in direwolf's source. The report also carries the citation coverage map (Timer Recovery has 38 of 92 arms uncited), the pinned delegated semantics, the decisions taken against the brief's suggestions, the model's limits, and the recommended next steps. Nothing is filed as an erratum; the brief's report-first contract holds. The brief gets a one-line status pointer to the findings. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ
…ing defect Folds in the packet.net two-station harness reproduction (packet-net/packet.net#811): the Timer Recovery stranding happens on the real runtime in both quirk modes, a T3 expiry is dropped because figc4.5 has no arm for it, and with the figure run as drawn the retry counter ratchets to N2 across recoveries on a working link. The control case with the acknowledgement on an RR completes normally, so only the ack carrier differs. The same trace exposed a runtime-only defect, Acknowledge Pending left set after an inline retransmission, filed as packet-net/packet.net#812 and added to the next steps. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ
This was referenced Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The report the brief asked for ("suggest a report first"). It records what was built against
docs/fuzzing-the-figures.mdon 10 September 2026 and what it found. Nothing is filed as an erratum.What landed, all merged in packet-net/ax25sdl: the static totality and determinism lint (#88), the reference interpreter with prose-derived golden traces and the clean-room SREJ traces (#75, #76, open since July), and the two-station bounded explorer with its calibration suite and pre-fix table fixtures (#89).
Headline results. The figures are total and deterministic over 8051 feasible guard valuations, and were before the #40 fix too, so a static check could not have found #40. The calibration score is 10 of 11: between the explorer's invariants and the golden traces every known defect except #41 is rediscovered, and the explorer alone finds #40 on the pre-fix tables (silent on the fixed ones) plus #42, #47, #9 and the #44/#48 pair unprompted. One novel hypothesis, H1: a station can enter Timer Recovery and never leave it when the clearing acknowledgement arrives on an I frame, because figc4.5 exits only on an F=1 supervisory response and has no T3 arm. direwolf's source carries an author's note describing the same symptom. It stays a hypothesis until reproduced against LinBPQ.
Also in the report: the citation coverage map (Timer Recovery has 38 of 92 arms with no implementation citation), the pinned delegated semantics and why the model refuses the sender-side skip that hid #40, the decisions taken against the brief's suggestions, the model's limits, and the recommended next steps. The brief itself gets a one-line status pointer.
🤖 Generated with Claude Code
https://claude.ai/code/session_014qyx5dT8rmRTb8szT4SpEQ