Today's buffer clobber should have been caught. It was not, for two reasons that
are each worse than the bug:
1. tools/check-drift.sh was NOT wired into gig-up.sh at all. Grepping this file
for it returns nothing. The memory note claiming it was wired in was simply
wrong, and had been trusted since.
2. The script was mode 100644, so invoking it exits 126 (permission denied) —
the FOURTH occurrence of the chmod-vs-git-mode bug, and the reason the "tools
executable" check exists. check-drift.sh was not in that check's list either.
A check that exists, is documented as guarding the gate, and is never called is
worse than no check: it buys confidence it does not deliver. That is the same
lesson as the two dead checks found when gig-up was first assembled.
NEW HARD SECTION 1c "surface grid intact", asserting two things:
* check-drift.sh passes (the committed grid still holds)
* migrate-columns.py --plan reports 0 moves (the WORKING TREE needs none)
The second is what actually caught today's clobber. When Pulsar wrote its stale
buffer over wap.tidal, d4's octer knobs reverted ^32 -> ^52, undoing a migration
committed and pushed hours earlier. That was invisible in `git status` — the
file just reads as modified, mixed in with PLN's own real edits. What made it
visible was migrate-columns being IDEMPOTENT: 0 moves one minute, 1 move the
next. Any property a tool can re-derive is a property a gate can assert.
PROVEN BY MUTATION, and the first mutation was wrong in a useful way. Flipping
ONE knob ^32 -> ^52 did not trip the check, and that is correct: B4 and C4 are
both legal d4 slots, so two effects merely swapping slots is not drift. The real
clobber put BOTH effects on ^52 — one knob driving two effects — and that trips
it immediately, printing the offending moves. Had I stopped at the green run I
would have shipped a check I believed in for the wrong reason.
Also adds check-drift.sh and take-segments.py to the executable-bit check, and
records 100755 for both in git.
