phase3: cJSON cross-language win verified + audited; robustness fix; case studies

phase3-cjson-002 (class 5+3): stack-buffer number parsing + strtod
round-trip replacing sscanf. +8.85% median, 95% CI [+7.5%, +10.0%] on
the C target, banked. 100% audit: byte-identical golden replay,
independent ASan+UBSan clean, 10k-input differential fuzz 0 divergences,
patch bounds/free-gating verified by eye.

- verdict: an infrastructure sanitizer-BUILD failure (missing runtime,
  broken toolchain) now caps the accept at needs-human-review and logs
  it, instead of crashing the verdict and losing a measured bench.
- results/phase3/: four public case studies (tokei class-5 wins; build
  flags + allocators; the comrak caught false-accept; the cJSON
  cross-language proof) + README. Compound-speedup claim stated as an
  approximation, not a measured figure (CIs don't multiply).
- .gitignore: cjson build-artifact dirs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

results/phase3/04-cjson-c-target.md

@@ -0,0 +1,86 @@
+# Case study 4 — cJSON: the cross-language proof (C, classes 3 + 5)
+
+**Target:** [cJSON](https://github.com/DaveGamble/cJSON) v1.7.19 — an
+ultralightweight C JSON parser/printer, MIT. **Workload:** a 5.6 MB
+deterministic JSON corpus (20k records: nested objects/arrays,
+escaped/unicode strings, integers, dense floats), parsed and serialized,
+single-threaded, CPU-pinned. **Result:** the first verified win on a
+C/C++ target — proof the trust layer, the gates, and the ROI story
+carry across languages, not just across Rust crates.
+
+## Getting C through the same pipeline
+
+Nothing in the trust layer assumes cargo anymore. cJSON is "just a
+`target.toml`" pointing at `clang` build commands, with:
+
+- a **hermetic Unity/CTest suite** (19 tests: `parse_number`,
+  `parse_string`, `print_*`, `misc_tests`, …) as the upstream-test gate;
+- a **trust-layer harness driver** (`targets/cjson/harness.c`) compiled
+  *with* the patched `cJSON.c` — the agent can patch the parser but not
+  the measurement rig (it lives outside the workspace allowlist);
+- **ASan + UBSan** as the sanitizer gate (the C analogue of the Rust
+  nightly ASan path);
+- its own **A/A calibration**: 0/20 false positives, 20/20
+  injected-slowdown detections — the C workload is a trusted anchor
+  before any verdict runs.
+
+## The profile
+
+callgrind cache-sim put **~22% of instructions in glibc float I/O** —
+`__printf_fp` (number serialization) and `strtod`/`str_to_mpn` (number
+parsing) — plus `parse_value`, `parse_string`, and heavy malloc/free
+churn. A number-dense JSON document spends most of its time turning
+numbers into strings and back.
+
+## Attempt 1 — the honest rejection (`phase3-cjson-001`, class 3)
+
+`parse_number` heap-allocated a temporary NUL-terminated buffer
+(`malloc` + `memcpy` + `free`) for **every** number, just to hand a
+clean string to `strtod`. With ~100k+ numbers in the corpus that is a
+large share of the allocation churn. The fix: a 64-byte **stack buffer**
+for the common short-number case, heap only for pathologically long
+number strings — byte-identical (strtod sees the same bytes).
+
+- **Speedup: 1.012 median, 95% CI [1.004, 1.022]** → **rejected-bench.**
+
+A real mechanism, a real +1.2%, but the CI lower bound (+0.4%) does not
+clear the 2% bar — because the corpus's wall-clock is dominated by float
+*formatting*, not by malloc. The statistical bar rejected a genuine win,
+exactly as designed. It is in the ledger.
+
+## Attempt 2 — the accepted win (`phase3-cjson-002`, classes 5 + 3)
+
+Adding the class-5 lever: `print_number` verified every fractional
+number's `"%1.15g"` round-trip by calling **`sscanf("%lg")`** — a full
+`strtod` *plus* format-string interpretation, per number. Replacing it
+with a direct `strtod` is the identical parse with none of the
+format-string overhead. Combined with the stack buffer:
+
+- **Speedup: 1.089 median, 95% CI [1.075, 1.100]** → **accepted.**
+- Upstream Unity suite: **PASS**. Golden replay: **byte-identical**.
+- **ASan + UBSan: clean** — through the machine-enforced sanitizer gate.
+- **10,000-input differential fuzz** (`scripts/diff-fuzz-cjson.py`),
+  pristine vs candidate, **0 divergences**.
+
+A **+8.9%** verified win on a C target, banked.
+
+## A finding worth keeping
+
+The first cJSON accept nearly wasn't recorded: the ASan+UBSan build
+failed to link because the clang sanitizer runtime (`libclang_rt.asan`)
+was not installed, and `sanitizer_check` treated that as a hard error —
+crashing the verdict and losing the measured bench. The fix hardened the
+gate: an **infrastructure** build failure (missing runtime, broken
+toolchain) now caps the accept at `needs-human-review` and logs the
+failure for the operator, rather than discarding a real result. "Cannot
+verify" is a review tier, not a crash.
+
+## What it demonstrates
+
+The progression — a real win *rejected* for being too small, then a
+larger win *accepted* only after golden replay, fuzzing, and sanitizers
+all held — is the whole method in miniature, now shown on C. Nothing
+about the trust story is Rust-specific. The cheapest safe lever (skip a
+per-number allocation) wasn't enough; the algorithmic lever (stop doing a
+redundant heavyweight parse) was — and the pipeline proved it the same
+way it proves everything else.