fix(measurements): a zero-value ledger survives a contradiction, not just a record

Reported by @jatmn, and it is a hole in my own previous fix rather than a new
defect.

That fix made a declared-but-not-constructed Ledger survive Record by
initialising the two maps Record touches. It left `raised` nil. Only Conflicts
and ConflictsAcrossRuns write that map, and they write it exclusively on the
contradiction path — the dedupe that stops the same wrong number being reported
twice — so nothing in the Record path could reach it.

The test I wrote could not catch this. It asked an AGREEING claim:

	ledger.Conflicts(Run{}, "TestSomething took 1.25s")   // against a recorded 1.25s

which returns early with no conflict and never reaches the write. A contradicting
claim panics:

	var ledger Ledger
	ledger.Record(Run{}, "--- PASS: TestSomething (1.25s)\n")
	ledger.Conflicts(Run{}, "TestSomething took 99s")
	-> panic: assignment to entry in nil map

Centralised into ensureMaps rather than adding a third `if` beside the other two.
The field list now sits beside NewLedger's, so a fourth map added later is a
visible omission in one place instead of a panic in whichever entry point forgot
it — this is the second time these lists have drifted apart.

TestAZeroValueLedgerSurvivesAContradiction covers both conflict entry points and
also asserts the dedupe actually works, since that is what `raised` is for.

Honest note on the mutation checks: removing `raised` from ensureMaps panics the
new test, so the real defect is covered. Removing the ensureMaps call from
ConflictsAcrossRuns does NOT fail anything — neither conflict path can write
`raised` without data having been recorded first, and Record initialises. Those
two calls are defence-in-depth for a future entry point, not independently
reachable today.

Author: gnanam1990

internal/measurements/measurements.go

@@ -208,6 +208,33 @@ func NewLedger() *Ledger {
 	}
 }
 
+// ensureMaps makes a zero-value Ledger behave like a constructed one.
+//
+// ONE PLACE, NOT THREE. The nil receiver is handled separately, but a Ledger
+// that was DECLARED rather than built by NewLedger reached the map writes with
+// nil maps and panicked. The first attempt at this fixed the two maps Record
+// touches and missed `raised`, which only Conflicts and ConflictsAcrossRuns
+// write — and they write it exclusively on the contradiction path, so a test
+// asking an agreeing claim never reached it. Reported by @jatmn.
+//
+// Every caller that can write a map calls this, and the field list lives beside
+// NewLedger's, so a fourth map added later is a compile-time-visible omission in
+// one spot rather than a panic in whichever entry point forgot it.
+//
+// Callers hold l.mu; this only fills nil fields, so a constructed Ledger pays
+// three nil checks and nothing else.
+func (l *Ledger) ensureMaps() {
+	if l.observed == nil {
+		l.observed = map[string]map[string][]float64{}
+	}
+	if l.runs == nil {
+		l.runs = map[string]Run{}
+	}
+	if l.raised == nil {
+		l.raised = map[raisedKey]bool{}
+	}
+}
+
 // Record reads any timings out of a command's output and remembers them against
 // the run that produced it. Returns how many it took, which is what a test
 // asserts on.
@@ -226,18 +253,7 @@ func (l *Ledger) Record(run Run, text string) int {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	key := run.key()
-	// A LEDGER THAT WAS NEVER CONSTRUCTED STILL HAS TO BEHAVE. The nil receiver
-	// above is already handled, but a zero-value Ledger got past it and panicked
-	// with "assignment to entry in nil map" on the first Record — a value that is
-	// trivially easy to reach by declaring one rather than calling NewLedger.
-	// Allocating here costs nothing on the NewLedger path, where both maps are
-	// already non-nil.
-	if l.observed == nil {
-		l.observed = map[string]map[string][]float64{}
-	}
-	if l.runs == nil {
-		l.runs = map[string]Run{}
-	}
+	l.ensureMaps()
 	byName := l.observed[key]
 	if byName == nil {
 		byName = map[string][]float64{}
@@ -278,6 +294,7 @@ func (l *Ledger) Conflicts(run Run, claim string) []Conflict {
 		return nil
 	}
 	l.mu.Lock()
+	l.ensureMaps()
 	defer l.mu.Unlock()
 
 	// ONLY THIS RUN'S VALUES. A claim about `go test ./...` is not answered by a
@@ -695,6 +712,7 @@ func (l *Ledger) ConflictsAcrossRuns(claim string) []Conflict {
 		return nil
 	}
 	l.mu.Lock()
+	l.ensureMaps()
 	defer l.mu.Unlock()
 
 	// Names are gathered across runs first, so a name recorded by two commands

internal/measurements/measurements_test.go

@@ -823,3 +823,31 @@ func TestAZeroValueLedgerRecordsWithoutPanicking(t *testing.T) {
 		t.Errorf("a zero-value ledger reported a conflict against its own record: %+v", conflicts)
 	}
 }
+
+// THE AGREEING CLAIM ABOVE NEVER REACHES THE MAP THAT PANICS. `raised` is
+// written only when a contradiction is actually found — it is the dedupe that
+// stops the same wrong number being reported twice — so a test that asks a
+// truthful claim returns early and proves nothing about it. The first fix for
+// the zero-value Ledger initialised the two maps Record touches and left
+// `raised` nil, and this test passed anyway. Reported by @jatmn.
+//
+// Both conflict entry points are covered: they write different key shapes into
+// the same map, so one of them holding says nothing about the other.
+func TestAZeroValueLedgerSurvivesAContradiction(t *testing.T) {
+	var single Ledger
+	single.Record(Run{}, "--- PASS: TestSomething (1.25s)\n")
+	conflicts := single.Conflicts(Run{}, "TestSomething took 99s")
+	if len(conflicts) != 1 || conflicts[0].Claimed != 99 {
+		t.Errorf("a zero-value ledger did not report the contradiction: %+v", conflicts)
+	}
+	// And the dedupe it just wrote actually works, which is what that map is for.
+	if again := single.Conflicts(Run{}, "TestSomething took 99s"); len(again) != 0 {
+		t.Errorf("the same wrong number was reported twice: %+v", again)
+	}
+
+	var across Ledger
+	across.Record(Run{}, "--- PASS: TestSomething (1.25s)\n")
+	if conflicts := across.ConflictsAcrossRuns("TestSomething took 99s"); len(conflicts) != 1 {
+		t.Errorf("a zero-value ledger did not report the contradiction across runs: %+v", conflicts)
+	}
+}