FEAT-098: file the guard scry declines to read, which is what made slice 2a inert - #202
Merged
Conversation
…ice 2a inert FEAT-057 slice 2a (#201) shipped polyhedra into the fixpoint and MEASURED ITSELF INERT for the class it exists to serve: 5,138 linear constraints across 130 functions on scry_mcdc.wasm, and ZERO involving three or more locals -- nothing the octagon could not already express. Instrumented, not guessed: of 94 `z := x + y` sites reaching the transfer, ZERO have a provable no-wrap, because the operands are ⊤. The operands are ⊤ because the guard that would bound them is declined. `guard_op` maps only SIGNED comparisons; every `*U` variant returns `None`, and the code says why -- unsigned comparisons wrap, so refining with a signed constant is not sound. That refusal is CORRECT. It is also the most consequential precision decision in the analyzer, because LLVM emits array bounds checks as `i32.lt_u index, len`: the one idiom that would bound an index is the one shape scry declines to read. THE REFINEMENT IS AVAILABLE UNDER A SIDE CONDITION, and the side condition is exactly the bounds-check shape. For `x <u c` with `0 <= c <= 2^31`, the SIGNED interval `[0, c-1]` is sound -- unsigned `x < c <= 2^31` puts x in `[0, 2^31-1]`, representable as non-negative signed, so no wrap into the negative half. VERIFIED EXHAUSTIVELY at w=8 over all (c, x) pairs BEFORE filing, in both directions. Zero counterexamples for `0 <= c <= 2^(w-1)`. And 127 constants ABOVE it where the signed reading FAILS -- so the side condition is load-bearing, not decorative, and a version that dropped it would be unsound. A rule that held for every c would have meant I had mis-stated it. NOT A POLYHEDRA FEATURE. Bounding locals feeds the interval domain, the octagon, the no-wrap gate, the trap checks, and the OOB proven rate (FEAT-069 measured 0.67% and diagnosed PRECISION, not format). Filed as its own artifact rather than buried in FEAT-057's residual because it blocks several things and, like FEAT-095, nothing tracked it. Typed `depends-on FEAT-057 -> FEAT-098` so the dependency is machine- visible rather than prose (the FEAT-096 lesson). Both are v3.4.0, so the ordering gate stays green -- CONFIRMED IT IS ACTUALLY READ by mutating FEAT-098 into v3.5.0: the gate fired naming the new pair, then went green on revert. First inversion the gate has caught that I did not seed at build time. AC#4 and AC#5 demand the MEASURED delta after implementation -- the >=3-local count (0 today), the no-wrap-provable share of 94 sites (0 today), and FEAT-069's 0.67%. "The number did not move" is written to be a reportable outcome rather than a silent one. Refs: FEAT-098 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc
📐 rivet artifact deltaPR: #202 Base SHA: Validationhead — `rivet validate` resultbase — `rivet validate` result (for comparison)Artifact stats
full stats — headDiff (base → head)AADL model — headPosted by the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FEAT-057 slice 2a (#201) shipped polyhedra into the fixpoint and measured itself inert for the class it exists to serve: 5,138 linear constraints across 130 functions on
scry_mcdc.wasm, and zero involving three or more locals — nothing the octagon could not already express.Instrumented, not guessed: of 94
z := x + ysites reaching the transfer, zero have a provable no-wrap, because the operands are ⊤.The operands are ⊤ because the guard that would bound them is declined
guard_opmaps only signed comparisons to aGuardOp. Every*Uvariant returnsNone, and the code says why:That refusal is correct. It is also the most consequential precision decision in the analyzer, because LLVM emits array bounds checks as
i32.lt_u index, len— so the one idiom that would bound an index is the one shape scry declines to read.The refinement is available under a side condition — and it is exactly the bounds-check shape
For
x <u cwith a constant0 ≤ c ≤ 2^31, the signed interval[0, c-1]is sound: unsignedx < c ≤ 2^31putsxin[0, 2^31-1], representable as a non-negative signed i32, so no wrap into the negative half is possible.Verified exhaustively at w=8 over every
(c, x)pair before filing, in both directions:0 ≤ c ≤ 2^(w-1)The negative control matters as much as the positive one: the side condition is load-bearing, not decorative, and a version that dropped it would be unsound. A rule that held for every
cwould have meant I'd mis-stated it.Not a polyhedra feature
Bounding locals feeds the interval domain, the octagon, the no-wrap gate, the trap checks, and the OOB proven rate — FEAT-069 measured 0.67% proven and diagnosed precision, not format. Filed as its own artifact rather than buried in FEAT-057's residual because it blocks several things and, like FEAT-095, nothing tracked it.
The dependency is typed, and I confirmed the gate actually reads it
FEAT-057 --depends-on--> FEAT-098, both v3.4.0, so the ordering gate stays green. Rather than assume the link is machine-visible, I mutated FEAT-098 into v3.5.0:Green again on revert. This is the first inversion FEAT-096's gate has caught that I did not seed at build time.
The acceptance criteria demand measured deltas, not fixtures
AC#4 and AC#5 require reporting, after implementation: the ≥3-local linear count (0 today), the no-wrap-provable share of the 94 sites (0 today), and FEAT-069's 0.67%. Written so that "the number did not move" is a reportable outcome rather than a silent one — because this feature is filed on a causal claim, and that claim is checkable.
Honest risk, in the residual
Scope is the constant-operand shape only.
x <u ybetween two locals needs a bound onyfirst — the same problem one level up. The motivating LLVM idiom isindex <u lenwherelenis often a local, not a constant, so a real corpus may see less benefit than constant-form fixtures suggest. That is why AC#4 demands the measured delta rather than a passing fixture.Refs: FEAT-098 · FEAT-057
🤖 Generated with Claude Code
https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc