===== 1. matrix (plain same-source rig) =====
== DF-5690 matrix: 34 plist value forms x 8 numeric getters ==
== wrong-type elements ==
== OOB index + NULL array type guards ==
== set/add/externalize roundtrips ==
KNOWN(DF-2240): add_uint8(255) ext->reint get ret=0 (expected false)
KNOWN(DF-2240): add_uint16(65535) ext->reint get ret=0 (expected false)
KNOWN(DF-2240): add_uint32(4294967295) ext->reint get ret=0 (expected false)
KNOWN(DF-2240): add_uint64(18446744073709551615) ext->reint get ret=0 (expected false)
== known DF-2240 rows (documented, not counted) ==
KNOWN(DF-2240): add_uint64(0x8000000000000000) -> get_uint64 ret=0 (signed-creator: expected false)
KNOWN(DF-2240): add_uint32(0x80000000) -> get_uint32 ret=0 (expected false)
MATRIX: 811 checks, 0 failures, 6 known(DF-2240) rows
--- matrix exit=0

===== 2. nolife BASELINE (guard-page rig, stock prop_string.c) =====
== DF-5690 nolife (BASELINE build): trap=SIGSEGV on guard/freed page ==
T1: borrowed cp=0x80048b000 into string storage
T1  get_cstring_nocopy dangling read after slot replace -> TRAP(SIGSEGV)  [base want TRAP(SIGSEGV)] OK
T2: string borrows owner=0x800485000 (PS_F_NOCOPY); caller now REUSES the buffer
T2: externalized:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
	<string>PWNED-BY-BUFFER-REUSE</string>
</array>
</plist>
T2  set_cstring_nocopy + buffer reuse + externalize -> exit=0         [base want exit=0] OK
T2b: string borrows owner=0x800485000; caller FREES it
T2b set_cstring_nocopy + buffer freed + nocopy read -> TRAP(SIGSEGV)  [base want TRAP(SIGSEGV)] OK
T3: ps_size=15 frozen; owner buffer now reused
T3  set_cstring_nocopy frozen ps_size + strcpy overrun -> TRAP(SIGSEGV)  [base want TRAP(SIGSEGV)] OK
T4(control): externalize=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
	<string>control</string>
</array>
</plist>
T4  control: copy-variant set + owner free -> exit=0         [base want exit=0] OK
NOLIFE(base): all expectations met
--- nolife baseline exit=0

===== 3. nolife FIXED (guard-page rig + fix.diff) =====
== DF-5690 nolife (FIXED build): trap=SIGSEGV on guard/freed page ==
T1: borrowed cp=0x80048b000 into string storage
T1  get_cstring_nocopy dangling read after slot replace -> TRAP(SIGSEGV)  [fixed want TRAP(SIGSEGV)] OK
T2: string borrows owner=0x800485000 (PS_F_NOCOPY); caller now REUSES the buffer
T2: externalized:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
	<string>transient-buffer</string>
</array>
</plist>
T2  set_cstring_nocopy + buffer reuse + externalize -> exit=3         [fixed want exit=3] OK
T2b: string borrows owner=0x800485000; caller FREES it
T2b: NO TRAP, intact content "transient-buffer"
T2b set_cstring_nocopy + buffer freed + nocopy read -> exit=0         [fixed want exit=0] OK
T3: ps_size=15 frozen; owner buffer now reused
T3: NO TRAP copy=BBBBBBBBBBBBBBB... (len=15)
T3  set_cstring_nocopy frozen ps_size + strcpy overrun -> exit=0         [fixed want exit=0] OK
T4(control): externalize=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
	<string>control</string>
</array>
</plist>
T4  control: copy-variant set + owner free -> exit=0         [fixed want exit=0] OK
note: T1 trap is the documented caller contract (keep parent array alive); fix targets T2/T2b/T3 only.
NOLIFE(fixed): all expectations met
--- nolife fixed exit=0