Stage PR 40 CI repairs: asmdecl, symbol offsets and explicit coverage

[cpunion]

Purpose and boundaries

Stage xgo-dev/plan9asm#40 repairs in the cpunion fork. Both PRs remain Draft. Do not update the upstream-connected branch until fork validation and exclusion review pass.

Current-head CI: complete and passing

Run 36524259971, attempt 2 passed 126/126 jobs at head fe028700, including all 64/64 discovery shards, strict aggregation, platform/runtime jobs, race, coverage and benchmarks. The PR has 128 successful checks. All 64 raw reports were downloaded and independently verified against the exact scan ledger, source content, Go 1.27.1, LLVM 22 and tool identities. complete=true, verified=true; no failed or pending candidates.

The passing assembly ledger is committed locally as 29d624c1 for the next batch. This evidence-only commit is not pushed yet; the currently pushed snapshot still says pending. No evidence-only push was used to interrupt the completed CI run.

Assembly outcome at the verified source	Exact versions / unique module paths
Selected assembly-bearing candidates	4,783
Translation and LLVM 22 object compilation passed	3,944
Current-Go source/target N/A, with evidence	826
Independently proved invalid source	6
Superseded exact versions	2
Pinned private extension	1
Provisional native-layout exclusions	4
Failed	0
Pending	0

There were 78,675 successful target translations/object compilations. These are not the external libraries' own runtime test results. The 13 exclusions are not passes; the four native-layout exclusions still require policy review.

Repair and performance

The preceding run 36509240233 finished before repair: 123/126 jobs passed. Only shards 38 and 42 and their strict aggregate failed. Both Hysteria candidates had deterministic Go source rejection followed by directory not empty during private-cache cleanup. Cleanup errors remained failures, never source N/A.

Red/green regressions reproduced descendants surviving command success, failure and cancellation, including inherited output-pipe hangs. The fix gives Unix commands their own process groups, terminates descendants, keeps Git maintenance foreground, bounds pipe waits and retries only transient directory-not-empty removal races. Persistent infrastructure errors still fail. No exclusion was added for this repair. Focused Linux repetitions, macOS race checks, Go 1.20 compatibility, Windows cross-compilation, full root/nested suites, vet and workflow-policy checks passed before CI.

Package build/asmdecl checks are batched per target with precise fallback, and at most two independent translator processes run per target. Each process releases LLVM objects on exit. All target/file accounting remains mandatory. This CI/performance batch adds zero new instruction forms.

The latest green run's longest discovery job was 85m07s. The preceding run's 61m58s and older roughly 112-minute/129-minute observations are different runs, not controlled performance comparisons. Large individual candidates remain an optimization opportunity.

The latest strict standard-library benchmark compiled 185/185 files across linux/{386,amd64,arm,arm64} and js/wasm, with zero skip/N/A/failure: 41 seconds of target wall time plus 39 seconds of tool build time. Every target and total budget passed using LLVM 22.

Discovery funnel and next frozen scope

Inventory stage	Current PR's tested checkpoint	Latest validated standalone checkpoint
Index entries	12,665,430	17,765,136
Contiguous recorded intervals	154	205
Unique module paths retained	811,704	948,933
Successfully inspected exact versions	802,019	936,811
Assembly-bearing exact versions	4,783	5,911
Assembly source paths	61,029	76,236
Retained retryable scan failures	13,631	16,065

The tested checkpoint spans 2026-03-18T00:17:13.411942Z through 2026-09-22T22:43:08Z. The standalone checkpoint extends history to 2025-10-26T01:11:01.304101Z, with the same head endpoint. 17,765,136 is not the complete Go Module Index. Counts cover validated contiguous windows only; an all-Go-module denominator has not been established. Retained failures are not successful inspection. The separate cgo inventory and its deployment settings stay outside this repository.

The requested next scope is now history through 2025-10-01T00:00:00Z (inclusive). The standalone scanner has a tested bounded-history option and controller: preserve the derived head cursor, retain complete timestamp groups, compare cutoff timestamps at nanosecond precision, publish a locked snapshot at the cutoff, then exit. Its recovered stale publication locks were preserved outside the ledger after confirming all owners had exited. Previously persisted records remain authoritative.

The October 1 snapshot is not complete or imported yet, and the 5,911 inventory candidates are not all certified by the old 4,783-candidate CI run. Coverage now runs concurrently with inventory, without waiting for the cutoff. Local source fdaa4de8 freezes the already-synchronized 17,665,136-entry checkpoint: 5,891 assembly versions, including 1,113 exact versions absent from the last verified set, with 4,778 overlapping and five retired/replaced versions. Discovery and corpus-tool tests passed before the frozen run.

Four local shards run concurrently, ordered by their new-version counts (11, 30, 29 and 32 first); all 64 shards remain mandatory. At 2026-09-29T10:28:58Z, audited reports had 5/64 complete passing shards, plus four shards publishing partial progress:

Local frozen batch outcome	Exact versions
Selected	5,891
Translation / LLVM 22 object compilation passed	617
Source / target N/A, with evidence	105
Pinned invalid source	2
Provisional native layout	1
Failed	1
Pending	5,165

Among the 1,113 newly discovered exact versions, 164 passed, 21 were source N/A, one failed and 927 remained pending. The failure is raw Intel VMCALL in github.com/danbia/tamago@v1.25.5, not a source-applicability exemption. These are partial results at source fdaa4de8, not current-repair-head success. A separate evidence worktree updates the ledger while the runner remains frozen; committed checkpoints include 548d4c8d and f2111d87.

New server exports, including the eventual October 1 checkpoint, queue outside the running test tree. The cutoff watcher collects/exports only; it cannot rewrite this frozen ledger or start a competing full run. Import queued records at a completed-run boundary, fix genuine failures, and publish matching assembly evidence. Changed inputs invalidate old reports. Batch code/records pushes after verification.

Issue 44 and raw hypercall repair — local, not pushed

Include issue 44 in this batch. ABI0 passes arguments/results through stack slots; the public Go binding previously omitted frame metadata on declared callees. Local commit fafdf295 retains those frames, handles result-only calls and nested aggregates, models framed amd64 BP/SP aliasing, and infers typed indirect callbacks only from a complete straight-line forwarding proof.

TDD reproduced five failures: scalar arguments, result-only calls, BP-relative locals, indirect callbacks and Uint128 struct arguments. Focused LLVM 22 object tests now pass for Linux/macOS/Windows amd64; value-checking runtime tests pass on Linux/amd64 and macOS through Rosetta. The real modernc.org/libc@v1.75.7 file also verifies through the public API with 1,875 wrappers and emits a Linux object. This is not the library's complete runtime suite or unmodified llgo end-to-end success: llgo's separate C ABI pass crashes when sizing intrinsic metadata parameters. A diagnostic overlay is not included in this contribution.

The first full root command hit its 20-minute total timeout; its failed log is retained. The replacement full-root run partitioned all 2,979 listed root tests/examples/fuzz targets into four disjoint groups, verified their exact union, and all four groups passed at the combined repair head. Combined-head nested command/internal suites, vet, focused Go 1.20 compatibility and official instruction coverage also passed. The strict benchmark passed 185/185 files across five architectures, with zero skip/N/A/failure: 48 seconds target wall time plus 16 seconds tool build. Existing host-specific runtime exclusions still require their cross-runtime CI counterparts; a local pass does not replace the next fork CI run.

Local commit c80f4342 adds raw Intel VMCALL, sharing the existing VMMCALL KVM hypercall ABI. Red/green tests cover both encodings, operand/suffix rejection, supported-op extraction and LLVM 22 objects across all five x86 platform targets. This adds one newly supported mnemonic/encoding, not the entire Intel VMX management set. Privileged hypercalls were not executed in a user process; the discovering shard still needs repair-head replay.

Evidence-only commit 9087dde9 deliberately resets the combined repair's assembly results to pending, rather than inheriting passes from a different source fingerprint. Shards 17 and 19 are now replaying against that frozen repair; a separate evidence worktree records their partial progress. These local repairs have not been pushed.

The older frozen batch also exposed raw ENQCMD in github.com/intel/ixl-go@v0.0.0-20260223204051-3e809238f558 (shard 39). Both ENQCMD and ENQCMDS were reproduced failing on all five x86 platform targets before implementation. Local commit 4757e113 now shares one address grammar/lowerer for both, with LLVM 22 object tests for the five targets, SIB/displacements, extended registers, 16/32-bit address overrides, explicit FS/GS prefixes and retry/status flags. An emitted-assembly regression caught LLVM dropping segment address spaces from inline-asm memory operands; explicit prefixes fix this path. Negative forms, command-side supported-op extraction, Go 1.20 compatibility and vet pass. Focused function coverage is 88.1% / 89.0%, not Codecov approval. Raw PC-relative command sources still fail closed without proven source-layout context. Device hypercalls/enqueues are not claimed as executed on hardware.

Evidence-only commit e70f9c36 binds a pending ledger to that newer enqueue repair. Its shard-39 replay is queued behind the active ABI0 repair replays, rather than increasing concurrent corpus work. Its full-root/current-head CI gates remain pending; the completed full-root result above belongs to 9087dde9. Neither unsupported instruction is reclassified as source N/A. Evidence commit ace54678 preserves the earlier partial results and failure checkpoint.

The discovering TamaGo version passed its actual repair-head replay at 9087dde9: seven applicable assembly files, 19 successful target translations/object compilations, seven targets. Evidence commit 2c4630f7 records it alongside partial shard progress (86 passed, 10 N/A, zero failed, 5,795 pending at that checkpoint). This repairs the observed VMCALL failure; it does not certify unrun candidates or a different source head.

At the live server publication checked on 2026-09-29 after the enqueue repair, inventory had 18,365,001 index entries, 945,955 inspected exact versions, 5,980 assembly-bearing versions, and 16,260 retryable failures, with history at 2025-10-09T04:56:49.664666Z. This live publication is separate from the validated/exported checkpoint table above. The October 1 cutoff is still pending.

The ongoing original frozen batch subsequently exposed a third failure: github.com/SnellerInc/Sneller@v0.0.0-20251209211248-dc69d73211f5, shard 36, internal/aes.auxExpandFromKey128, rejects VMOVDQU key+8(FP), X0. This FP vector-source form remains unfixed/pending; it is retained as failure, not skipped. At that audited checkpoint the original source had 978 passed versions, 175 N/A, three invalid-source exclusions, one provisional native-layout exclusion, three failed and 4,731 pending (7 passing whole shards, 2 failed whole shards). Do not merge these old-source counts with repair-head replay counts.

Draft review gate

Four exact versions (GopherJRE, gojit and two Sharkie path spellings) have provisional native-byte-layout/JIT exclusions, pinned by source hashes, selected targets and Go-object witnesses. Every other applicable file still compiles. This exception policy is not accepted; green compile CI is not full semantic compatibility. Review, required patch coverage and this policy must be resolved before Ready or upstream promotion.