Start with one required result: return the first negative position, or the input length when every value is nonnegative. This teaching contract allows at most thirty-two elements and requires the input to remain unchanged. The length limit is a caller assumption, not a check performed by the function.

The faulty scan begins at the second element when the input is nonempty. For minus one followed by two, it returns two, although the required answer is zero. The recorded failure comes from an actual Go call checked against a prewritten literal expectation. It is not a solver counterexample.

The correction starts at zero. At the loop head, the index stays within bounds and every earlier element is nonnegative. Checking the current element before advancing extends that prefix. When the guard becomes false, the prefix explains why the returned position is the first negative, or the end.

The corrected implementation meets all seven selected runtime cases. Its strong source claim still times out, as does the baseline claim. A third variant keeps the faulty body but checks only returned-index bounds. That narrower claim is proved. Its result does not establish the missing first-negative behavior.

Keep termination, arithmetic and input preservation visible. The distance to the end decreases, but no separate solver-backed termination result was obtained. The arithmetic argument uses the stated bounds. All selected input snapshots match, yet the symbolic result omits input preservation and cannot distinguish nil from empty. Caller integration remains unperformed.

Copy the worksheet and identify your actual loop, required result and intent owner. Inspect the retained source, queries and raw results. The portable replay checks the finite contrasts with Go and Python; optional solver paths are separate. Record what remains unresolved before deciding which additional evidence your project needs.