/survey: a grep that finds something has not shown you all of it

Third instance today of one shape -- reading a truncated view and treating it
as the whole. The first two were greps whose [a-z_] class silently excluded
digits, and /survey already carries that. This one is the other half, and it
was the expensive one:

    void *, wasmtime_context_t *, uint32_t);

was printed for a callback typedef and read as the signature. The return type,
wasmtime_error_t* rather than void, was on the line above and outside the
window. Declaring the upcall void made wasmtime read a garbage register as an
error pointer and crash *after* the callback had run correctly, so every probe
printed success and the search went to ownership of an unrelated pointer for
two turns.

So the rule now says both halves, and adds the specific one that earned it:
before binding a C function through FFM, read its whole declaration from the
file rather than from a match. A wrong descriptor's symptom is a native crash
with no Clojure frame in it, and the cost of being sure is one Read.

Prose rather than machinery, and in the file that already carries the adjacent
rule, because there is nothing here to mechanize -- checking a descriptor
against a header automatically would mean parsing headers.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

.claude/skills/survey/SKILL.md

@@ -78,6 +78,24 @@ character class, or search for the surrounding prose rather than the
 identifier. This is the cheap half of the constraint already in
 `.claude/CLAUDE.md`: *ask what a negative result was incapable of showing you.*
 
+**A grep that finds something has not shown you all of it either.** The same
+day, a survey printed
+
+```
+    void *, wasmtime_context_t *, uint32_t);
+```
+
+for a callback typedef and the parameters were read as the signature. The
+return type — `wasmtime_error_t *`, not `void` — was on the line above, outside
+the window. Declaring that upcall `void` made wasmtime read a garbage register
+as an error pointer and crash *after* the callback had run correctly, so every
+printed probe said it worked.
+
+**Before binding a C function through FFM, read its whole declaration** —
+return type included — from the file, not from a match. A wrong descriptor's
+symptom is a native crash with no Clojure frame in it, and the cost of being
+sure is one `Read`.
+
 ## Two failure modes specific to surveying
 
 The general ones — no local paths, siblings' conclusions don't transfer — are