PLN asked what tooling would have caught tonight's mute-bomb. Honest answer:
nothing we had, and not tidal-ears — it analyses audio, and this bug produced
SILENCE. Silence is indistinguishable from silence no matter how well measured.
The defect was symbolic: a pattern emitting zero events.

Typechecking could not catch it either. `gF1 $ sound "bd"` is perfectly
well-typed while producing NO EVENTS, because an untouched "^NN" yields nothing
and `#` cannot emit without a right-hand value. Pass 1 of this script was green
throughout the entire outage.

The missing capability was the ability to ask one question mechanically:
"what does this helper do with an EMPTY control map?" — i.e. on a fresh boot,
before any knob has moved. That is now pass 3: it extracts the helper block,
appends assertions, compiles, and RUNS them, checking that each of gF1/gF2/gF3,
gMask, gMute1-3, gM1-3, gPanic, midiGdef and a composed gF1.gM2 stack all emit
events with `State (Arc 0 1) M.empty`.

It is a real execution rather than a typecheck, but pure pattern evaluation
only: no stream, no scsynth, no MIDI, no port binding. Safe to run mid-set.

Verified in BOTH directions, which is the whole point:
  - current BootTidal.hs        -> 13/13 audible, exit 0
  - orDef guards stripped out
    (i.e. the pre-3685c743 code) -> 11 FAILs naming each silent helper, exit 1

That negative test also confirmed something useful about the shape of the bug:
gPanic and midiGdef stayed audible even with the guards stripped, because they
route through `range`/arithmetic that survives an empty map differently from
`#`. So a partial fix would have looked partially fine — exactly the kind of
half-green result that lets a bug like this hide for months.

Turns the ad-hoc Haskell probe written during the incident into a permanent
regression test. This bug class has now bitten three times (#21 djfbus, #48's
one-directional filters, #55's untouched-control silence); pass 3 is the first
thing that would have caught any of them before a boot.