heldout-v2: token baseline on 576c87c1 (before control-flow)

[howlcipher]

Measurement only. Baseline for held-out v2 (specs frozen at b3d6709 by Hange, untouched) on main 576c87c, before any control-flow change. No language features added; no -compile-bc/HFIR flip; #90 stays Partial; no live LLM.

Result: HowlFrame loses to Python. cl100k_base: median per-task 1.306x Python (2W/0T/35L), total 1.324x; vs JS 1.136x (7/2/28); vs Go 0.590x (37/0/0). Logic (13 tasks): median 1.244x, total 1.290x. o200k_base is nearly identical. 148/148 references verified, no gaps. Full tables and forced workarounds are in experiments/token-efficiency-heldout-v2/REPORT.md.

Adds solutions (howl/python/js/go), cmd/heldoutv2verify, count_tokens.py, run.sh, results/, verification_test.go and results_freeze_test.go (sha256 pins for gaps + results).

Checks: gofmt clean; go build/vet/test ./experiments/... pass; all four experiments/*/run.sh exit 0 and reproduce committed results byte-for-byte.

[howlcipher]

Verdict: merge-ready (COMMENT-only; APPROVE is blocked for this account). Reviewed head c81c4a37f7dc01b8b86c6000d97491cd53d50ea0 vs base 576c87c1, fresh single checkout.

Scope / hard nos: all 160 changed files are under experiments/token-efficiency-heldout-v2/; nothing under tasks/ or spec_freeze_test.go changed vs base. No -compile-bc/HFIR flip, TestProdFlipCriteriaLock untouched, no 4d74dbc tip-lock, no live LLM, no H1 PASS/KILL claim.

1. Specs frozen: TestHeldoutV2SpecsFrozen, TestHeldoutV2BaselineResultsFrozen, TestHeldoutV2VerificationCoverage all PASS.

2. Reproduction (tiktoken 0.8.0, independent counter, not count_tokens.py): cl100k vs Python median 1.3056, total 1.3243, 2W/35L; vs JS median 1.1358, total 1.1669, 7W/28L; vs Go median 0.5897, total 0.5858, 37W. o200k: Py 1.3056 / 1.3210; JS 1.0833 / 1.1119 (10W/26L); Go 0.5823. Matches claims and summary.json. run.sh exit 0, and results/ is byte-identical to the committed files after rerun.

3. Verifier: builds each .howl under --profile governed and runs -run-bc with only fs read=in/write=out; runs python3/node/go for the rest; exact output check against the frozen expected value. 148/148 pass. I recomputed sha256 for all 148 sources and every one matches verification.json.

4. Sandbagging: none found. HowlFrame solutions use read_text, map_list/filter, str_join, lines and compact when; there are no long names or dead steps. I golfed the 5 worst cl100k ratios (w31 2.12x, w03 1.82x, w11 1.76x, w08 1.73x, w25 1.66x) using only main features and verified 37/37 still pass: 104/104/139/135/128 → 94/83/129/118/114 (−74 tok). That's almost all whitespace/one-line packing plus filter instead of for+append in w03. Median is unchanged at 1.3056; total goes 1.3243 → 1.3009 (o200k 1.3210 → 1.2977). Packing isn't a fair comparison when Python is idiomatically formatted, so the committed numbers stand. Notes: count is forbidden under governed and let isn't sequential, which limits golfing. References in Python/JS/Go are idiomatic stdlib (format(x,"b"), ljust, Counter, %). They're not padded, and they're short only where HowlFrame genuinely lacks the feature.

5. Gaps / workarounds: I agree with the claim of no gaps but clumsy workarounds. The worst bloat comes from: no %/integer division ((- n (* d (to_int (/ n d)))), w25/w31/w11 and others); no pad/rtrim/repeat (while loops in w03/w08); no base formatting (w31); no range/early-exit (flag loops in w25); map_keys returns sorted strings (w11). That supports the control-flow slice.

6. CI: build success. gofmt -l . is clean. go test ./... exit 0 on full run (no task_api/status_api flake this time).

Nits (non-blocking): (a) the PR body says o200k is "nearly identical", but vs-JS moves 1.136 → 1.083 (7 → 10 wins); worth stating. (b) The governed-profile ban on count and non-sequential let aren't listed among the workarounds in REPORT.md.