fix(0129): logical not is truthiness-aware, not a bit flip

The unary .not arm emitted bool_not (LLVM bitwise Not) for every
operand. Correct on i1; on an error binding — an error-set value, u32
tag at the LLVM level — a bitwise not of a nonzero tag stays nonzero,
so 'if !e' held even on a SET error and its branch read the
uninitialized success value (real segfault in the distribution repo's
sqlite tests). Plain integers had the same hole ('!7' was '~7').

Now: bool keeps bool_not; integers and error-set operands lower as the
truthiness complement (cmp_eq against a typed zero); anything else is
diagnosed instead of silently bit-flipped.

Regression: examples/1057 (set error: !e must not hold; success: !e
holds with a real value; integer truthiness) + examples/1171 (!"text"
diagnosed); both FAIL pre-fix. zig build test 426/426;
tests/run_examples.sh 600/600.

issues/0129-negated-error-binding-bitwise-not.md

@@ -0,0 +1,68 @@
+# RESOLVED — 0129: `if !e` held on a SET error binding (logical not lowered bitwise)
+
+> **RESOLVED** (2026-06-12). Root cause: the `.not` arm of unary
+> lowering (src/ir/lower/expr.zig) emitted `bool_not` — LLVM's bitwise
+> `Not` — for EVERY operand type. On a real `i1` bool that is logical
+> not; on an error binding (an error-set value, a u32 tag at the LLVM
+> level) a bitwise not of a nonzero tag is still nonzero, so the branch
+> condition stayed truthy: `if e` and `if !e` BOTH held on a set error,
+> and the `!e` branch read the uninitialized success value. Plain
+> integers had the same hole (`!7` was `~7` — truthy). Fix: `!` is now
+> truthiness-aware — bool keeps `bool_not`; integers and error-set
+> values lower as the complement `operand == 0` (`cmp_eq` against a
+> typed zero); any other operand type is DIAGNOSED ("'!' needs a bool,
+> integer, or error operand") instead of silently bit-flipped.
+> Regression tests: `examples/1057-errors-negated-error-binding.sx`
+> (set error: `!e` must not hold; success: `!e` holds with a real
+> value; `!7`/`!0` integer truthiness) and
+> `examples/1171-diagnostics-logical-not-bad-operand.sx` (`!"text"`
+> diagnosed); both FAIL on pre-fix master. Gates: zig build test
+> 426/426, tests/run_examples.sh 600/600.
+
+## Symptom
+
+`if e { ... }` on an error binding from a value-carrying failable
+correctly tests "error is set", but `if !e { ... }` evaluates TRUE even
+when the error IS set — both branches run, and the success value read
+in the `!e` branch is uninitialized garbage.
+
+Hit in production: /Users/agra/projects/distribution
+`tests/sqlite_api.sx` (2026-06-12) — a `close()` behind `if !ne`
+segfaulted on a garbage handle. The interim workaround routed negated
+error logic through a plain bool.
+
+## Reproduction
+
+```sx
+#import "modules/std.sx";
+
+E :: error { Boom }
+
+f :: (fail: bool) -> (i64, !E) {
+    if fail { raise error.Boom; }
+    return 42;
+}
+
+main :: () -> i32 {
+    v, e := f(true);
+    if e { print("error set\n"); }
+    if !e { print("BUG: !e true on a set error (v={})\n", v); return 1; }
+    return 0;
+}
+```
+
+Observed at master ba37d0b: prints both lines, v is garbage, exits 1.
+Expected: prints only "error set", exits 0.
+
+## Investigation prompt
+
+Suspected area: the unary `.not` lowering in src/ir/lower/expr.zig —
+it emits `bool_not` (src/backend/llvm/ops.zig `emitBoolNot` →
+`LLVMBuildNot`, a bitwise xor-with-all-ones) regardless of operand
+type. Error bindings are error-set values backed by a u32 tag
+(src/backend/llvm/types.zig lowers `.error_set` to i32), so `~tag` of
+a set error is nonzero and the condition holds. Fix: make `!`
+truthiness-aware (complement-of-zero for integer-backed operands), or
+diagnose non-bool operands; silent wrong evaluation is the worst of
+both. Verify with the repro plus an integer-truthiness case, and run
+zig build test + tests/run_examples.sh.