docs: root-cause the 'size-sensitive' miscompile (it was the fixpoint gate)

The long-standing 'removing ASTDUMP breaks the fixpoint' was not
size-sensitive and not a codegen bug.  ASTDUMP dumped the AST to stdout;
built from its own sources that dump contained the driver's literal
'Parsed correctly', and M2make's gate was 'grep -q Parsed' -- so the gate
passed while the session reported 'Incorrect source'.  Removing the dump
unmasked the real errors (Lower's forward procedure calls -> invalid
call), which looked like a size effect.

Already fixed in a3ef897 (remove ASTDUMP, gate on 'Parsed correctly',
declare Lower's walkers).  Verified: the gate now fails on errors
(t_fwdvar prints 'Incorrect source' and the gate fails); self-hosting is
byte-identical across the session's four size-changing commits.

Docs only; no source change.  The distinct record-array-field/open-array
codegen issue remains open and is now tracked separately.

docs/STATUS.md

@@ -117,9 +117,17 @@ declarations still work (`t_fwdproc`, `t_fwdok`).
    `undeclared identifier`, `invalid call`); separate them from gm2
    leniencies (`docs/gaps/`) and missing stdlib imports (`LIB`).  See
    `docs/analysis_gaps.md`.
-2. **The size-sensitive V3 miscompile** — the long-standing "removing
-   `ASTDUMP` from `M2.atg` breaks the fixpoint" has never been
-   root-caused.  A real correctness landmine.
+2. ~~**The size-sensitive V3 miscompile**~~ — **root-caused and fixed**
+   (2026-10-19; see `docs/summary_l3_selfhost_fix.md`).  It was never
+   size-sensitive: the fixpoint gate matched the literal string
+   `"Parsed correctly"` that the `ASTDUMP` debug dump printed
+   unconditionally, so the gate passed while the compiler session was
+   actually reporting `Incorrect source` (Lower's forward procedure
+   references → `invalid call`).  Removing `ASTDUMP` merely removed the
+   masking line, which looked like a size effect.  Fixed by `a3ef897`
+   (remove ASTDUMP; gate on `Parsed correctly`; declare Lower's walkers
+   in `Lower.def`).  The gate now fails on errors (verified with
+   `t_fwdvar`), and self-hosting stays byte-identical.
 3. **Robustness** — fixed table limits resolve silently when exceeded;
    weak error recovery; error-message polish.
 4. **Library holes** — channel/device framework (`docs/wip/`).

docs/gaps/README.md

@@ -157,7 +157,16 @@ The `gap13` remainder (standard builtins as identifiers) and `gap14`
 
 ## Not represented by a source
 
-- **Size-sensitive V3 miscompile** — a *latent* codegen bug that only
-  manifests at the compiler's own scale (the historical "removing
-  `ASTDUMP` breaks the fixpoint"); see `docs/summary_l3_selfhost_fix.md`.
-  No small standalone source triggers it.
+- **Record array field passed as an open array** — a record's inline
+  array field loses its length word when the record sits in static
+  array-of-record data, so passing the field as an `ARRAY OF …` actual
+  reads length 0 and traps.  Worked around by flattening Lower's tables;
+  the general fix and `docs/wip/nested-array-field-bug.mod` remain open
+  (see `docs/summary_l3_selfhost_fix.md`).
+
+- ~~**Size-sensitive V3 miscompile**~~ — **root-caused 2026-10-19**: not
+  size-sensitive, and not a codegen bug at all.  The `ASTDUMP` debug dump
+  printed the literal `"Parsed correctly"`, which satisfied the
+  fixpoint's `grep -q Parsed` gate while the compiler session was
+  reporting `Incorrect source`; removing the dump simply unmasked the
+  real errors (Lower's forward procedure calls).  Fixed in `a3ef897`.

docs/handoff-2026-10-19-next.md

@@ -81,12 +81,19 @@ Tests: `t_fwdvar`/`t_fwdsel`/`t_fwdprop` now *expected to fail*
 gm2-leniency files (`block`, `blockindirect`, `nestedfor`, …) are now
 correctly rejected.  The drop is intended conformance, not a regression.
 
-## P4 — latent correctness
-
-The **size-sensitive V3 miscompile** is still unroot-caused.  Note: the
-2026-10-19 Lowering change moved code around, so re-check whether the
-old symptom ("removing `ASTDUMP` breaks the fixpoint") still reproduces
-before bisecting.  Dedicated session; a real correctness landmine.
+## P4 — latent correctness  ✅ DONE (2026-10-19)
+
+Root-caused: **not size-sensitive, not a codegen bug.**  `ASTDUMP`
+printed the literal `"Parsed correctly"`, and the fixpoint's M2make gate
+was `grep -q Parsed` — so the gate passed while the compiler session was
+reporting `Incorrect source`.  Removing the dump unmasked *real* errors
+(Lower's forward procedure calls).  Already fixed in `a3ef897`; verified
+the gate now fails on errors.  See `docs/summary_l3_selfhost_fix.md`.
+
+**New remaining latent item:** the *record array field as an open-array
+actual* bug (inline length word lost in static array-of-record data) —
+worked around by flattening; the general codegen fix and
+`docs/wip/nested-array-field-bug.mod` are still open.
 
 ## P5 — housekeeping
 

docs/summary_l3_selfhost_fix.md

@@ -70,10 +70,29 @@ Options for the follow-up:
 Also documented: `docs/wip/nested-array-field-bug.mod` (nested-array
 record field) is a related, still-open case.
 
-## Latent fragility (do not touch without care)
-
-Removing the pre-existing `ASTDUMP` in `M2.atg`'s root production makes
-the V3-built compiler emit **spurious** semantic errors in `Lower.mod`
-(`AST.NChild: invalid call`, etc.) and breaks the fixpoint.  So the
-debug dump stays for now; it is a symptom of the remaining
-"parser-size-sensitive" V3 miscompile and should be revisited separately.
+## Latent fragility — root-caused (2026-10-19)
+
+The old note here said removing `ASTDUMP` from `M2.atg` broke the
+fixpoint and was a symptom of a "parser-size-sensitive" miscompile.
+That was a **misdiagnosis**.  `ASTDUMP` dumped the whole AST to stdout;
+when the compiler was built from its own sources that dump *contained*
+the string literal `"Parsed correctly"` (the driver's success message),
+and the fixpoint's M2make gate was `grep -q Parsed` — so the gate passed
+even when the compiler session was reporting `Incorrect source`.
+Removing the dump removed the masking line, and the *pre-existing*
+session errors surfaced — not a size effect.  The errors were real:
+`Lower.mod` called its mutually recursive walkers before their
+declarations (`invalid call`, codegen dropping the calls), plus the
+`FormalOk` open-array comparison bug.
+
+All fixed in `a3ef897`: `ASTDUMP` removed, the gate tightened to
+`grep -q 'Parsed correctly'`, Lower's walkers declared in `Lower.def`,
+`FormalOk` corrected.  The gate now fails on any session error
+(verified: a data-order violation makes `M2` print `Incorrect source`
+and the gate fails), and the fixpoint is byte-identical across the
+four size-changing commits of 2026-10-19.
+
+(The separate record-array-field / open-array codegen issue is described
+above; the deferred general `ArrBodyItems` fix and
+`docs/wip/nested-array-field-bug.mod` remain open — that is a *distinct*
+bug from the `ASTDUMP` one.)