From db4a967964c477d9f4ef8455917b0b8e03c468ec Mon Sep 17 00:00:00 2001 From: joyful-ii-V-I Date: Sat, 12 Sep 2026 16:19:54 -0400 Subject: [PATCH 1/3] =?UTF-8?q?diag(noalias):=20four=20more=20contracts=20?= =?UTF-8?q?at=20function=20entry=20=E2=80=94=20waterFillRecallShares=20tak?= =?UTF-8?q?es=20the=20buffer=20form=20(309=20=E2=86=92=20301)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #200/#201 from the audit's apply list: A1 recall.h waterFillRecallShares (VERIFY_NO_ALIAS_BUF on demand/alloc — the one row with a codegen delta, re-measured under the build flags: 309 → 301), D5 notes.h splitNoteTail (VERIFY_NO_ALIAS3), D6 quality.h takeAckNamedToken (VERIFY_NO_ALIAS), E1 quality.h computeDelta (null-safe VERIFY_TEXT: both out-pointers default to nullptr). --edit-check on all four: unchanged, incompatible=0. Still deferred to the owning lane: C3 graph.h markCandidateFilesIncludingDecl, B3 verbs_quality.h partitionByScope. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 7 +++++++ src/notes.h | 1 + src/quality.h | 3 +++ src/recall.h | 2 ++ 4 files changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a9fd9b5f1..263e3c70e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -122,6 +122,13 @@ regenerated (2026-09-11). `-mllvm -basic-aa-separate-storage` to our targets (and to the ld64 link under LTO), and the gate classifies the compiler by compiling the real slice three ways, with a `=false` negative control and a cross-check against the cached CMake probe. +- **Four more aliasing contracts at function entry, one of them the tree's only codegen row.** `waterFillRecallShares` + (`src/recall.h`) reads `demand[i]` while writing `alloc[i]` and never resizes either, so it takes the buffer form: + release codegen 309 → 301 instructions under the build's own flags. `splitNoteTail` (`src/notes.h`), + `takeAckNamedToken` and `computeDelta` (`src/quality.h`) take debug-only guards; `computeDelta`'s two out-pointers + both default to null, so its guard is a null-safe `VERIFY_TEXT` rather than the object form. Two rows remain, + `markCandidateFilesIncludingDecl` (`src/graph.h`) and `partitionByScope` (`src/verbs_quality.h`), until the lane that + owns those files lands. ## [0.6.0] — 2026-09-11 diff --git a/src/notes.h b/src/notes.h index b43d1ca72..e32f9dee2 100644 --- a/src/notes.h +++ b/src/notes.h @@ -298,6 +298,7 @@ inline std::string shortSha( std::string_view sha ) // empty); a third but no fourth ⇒ a hand-edited 4-field oddity (sha only, degrade rather than reject). inline void splitNoteTail( std::string_view rest, std::string& text, std::string& sha, std::string& branch ) { + VERIFY_NO_ALIAS3( text, sha, branch ); const std::size_t t3 = rest.find( '\t' ); if( t3 == std::string_view::npos ) { text = std::string( rest ); return; } text = std::string( rest.substr( 0, t3 ) ); diff --git a/src/quality.h b/src/quality.h index 4ba91693a..a264e59a0 100644 --- a/src/quality.h +++ b/src/quality.h @@ -4805,6 +4805,7 @@ inline std::string normalizeLegacyAckKind( const std::string& kind, std::uint32_ // different language, and a caller that rejects the value restores `reason` itself. inline bool takeAckNamedToken( std::string& reason, std::string_view name, std::string& valueOut ) { + VERIFY_NO_ALIAS( reason, valueOut ); if( reason.size() < name.size() || reason.compare( 0, name.size(), name ) != 0 ) { return false; @@ -6099,6 +6100,8 @@ inline std::vector computeDelta( const IngestResult& ing, const Grap std::size_t* registerMacroExcludedOut = nullptr, // P2.2: honest disclosure count, additive+optional — see isDeadCandidate std::size_t* apiNewSurfaceOut = nullptr ) // Q-DIAL-4: the api-surface new-symbol COUNT that replaced N never-gating rows { + VERIFY_TEXT( registerMacroExcludedOut == nullptr || registerMacroExcludedOut != apiNewSurfaceOut, + "computeDelta: registerMacroExcludedOut and apiNewSurfaceOut must be distinct" ); // both default to nullptr, so the object form would dereference null std::vector regs; if( registerMacroExcludedOut ) { diff --git a/src/recall.h b/src/recall.h index 8c2bd0847..b379b0a92 100644 --- a/src/recall.h +++ b/src/recall.h @@ -11,6 +11,7 @@ // best score of any symbol it holds (the markdown file-node, which indexes the whole body, dominates). The // graph half ([[links]]/PageRank) is intentionally NOT fused — the eval showed importance ≠ relatedness. +#include "infra/Diagnostics.h" // VERIFY_NO_ALIAS_BUF — waterFillRecallShares reads demand[] while writing alloc[] #include "docparse.h" // §P2b: the generated-document signals (marker / size+fences) + the ONE markdown // fence scanner — a doc-side property, computed from the file's own bytes #include "layout.h" // §L4.3: layout::lineOf — the ONE byte-offset-to-line-number helper (reused, not @@ -1611,6 +1612,7 @@ inline std::size_t recallServedPrefix( const std::vector& overhead, inline std::size_t waterFillRecallShares( const std::vector& demand, std::size_t served, std::size_t avail, std::vector& isSatisfied, std::vector& alloc ) { + VERIFY_NO_ALIAS_BUF( demand, alloc ); // read demand[i] / write alloc[i] in one loop; never resized here, so the buffer promise holds std::size_t remaining = avail; std::size_t unsatisfied = served; std::size_t share = 0; From cf69220427d649d0597906ec0266aee6a33d3943 Mon Sep 17 00:00:00 2001 From: joyful-ii-V-I Date: Sat, 12 Sep 2026 16:54:35 -0400 Subject: [PATCH 2/3] =?UTF-8?q?diag(noalias):=20the=20last=20two=20contrac?= =?UTF-8?q?ts=20=E2=80=94=20markCandidateFilesIncludingDecl=20and=20partit?= =?UTF-8?q?ionByScope;=20the=20audit's=20apply=20list=20is=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit src/graph.h and src/verbs_quality.h were freed by #210 (silent-zero round 3). C3 markCandidateFilesIncludingDecl: VERIFY_NO_ALIAS3( isDecl, isCand, proven ) — proven[] written while isDecl[]/isCand[] are read, same-role dense arrays. B3 partitionByScope: VERIFY_NO_ALIAS( regs, outOfScope ) — push_back into outOfScope while iterating regs. --edit-check on both: unchanged, incompatible=0. quality-delta: two ambient short-horizon-churn rows, gating=0. With these, all 21 rows of the audit's apply list are in the tree. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 6 +++--- src/graph.h | 1 + src/verbs_quality.h | 1 + 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 263e3c70e..f41f22202 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -126,9 +126,9 @@ regenerated (2026-09-11). (`src/recall.h`) reads `demand[i]` while writing `alloc[i]` and never resizes either, so it takes the buffer form: release codegen 309 → 301 instructions under the build's own flags. `splitNoteTail` (`src/notes.h`), `takeAckNamedToken` and `computeDelta` (`src/quality.h`) take debug-only guards; `computeDelta`'s two out-pointers - both default to null, so its guard is a null-safe `VERIFY_TEXT` rather than the object form. Two rows remain, - `markCandidateFilesIncludingDecl` (`src/graph.h`) and `partitionByScope` (`src/verbs_quality.h`), until the lane that - owns those files lands. + both default to null, so its guard is a null-safe `VERIFY_TEXT` rather than the object form. + `markCandidateFilesIncludingDecl` (`src/graph.h`) and `partitionByScope` (`src/verbs_quality.h`) take the last two + guards of the audit's apply list, which is now complete: 21 functions state their no-alias contract at entry. ## [0.6.0] — 2026-09-11 diff --git a/src/graph.h b/src/graph.h index 30e4431fe..3371142c1 100644 --- a/src/graph.h +++ b/src/graph.h @@ -4135,6 +4135,7 @@ inline std::size_t definitionCountOfName( const IngestResult& ing, NodeId focus inline void markCandidateFilesIncludingDecl( const IngestResult& ing, const std::vector& isDecl, const std::vector& isCand, std::vector& proven ) { + VERIFY_NO_ALIAS3( isDecl, isCand, proven ); // three same-role dense arrays: proven[] is written while isDecl[]/isCand[] are read // The index: ONE entry per DECLARATION file, keyed the way buildPreciseIncludeAdj keys its own // (lexicalNormalize on BOTH sides, so a `.`-rooted crawl's `./a/x.h` and a resolved `a/x.h` agree). HashMap declIndex; diff --git a/src/verbs_quality.h b/src/verbs_quality.h index 5fe1b7f8f..230fb6ac0 100644 --- a/src/verbs_quality.h +++ b/src/verbs_quality.h @@ -379,6 +379,7 @@ std::size_t partitionByScope( const rw::quality::Scope& scope, std::vector& outOfScope, const gtl::btree_map& acks ) { + VERIFY_NO_ALIAS( regs, outOfScope ); // push_back into outOfScope while iterating regs: the same vector twice is UB if( !scope.active() ) { return 0; From ba0ada289157149a6d104a41068291f5b35f85c3 Mon Sep 17 00:00:00 2001 From: joyful-ii-V-I Date: Sat, 12 Sep 2026 17:16:52 -0400 Subject: [PATCH 3/3] docs(changelog): #211's entry states what the object form is in release, with the compiler scope Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f41f22202..0867f4b39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -125,8 +125,11 @@ regenerated (2026-09-11). - **Four more aliasing contracts at function entry, one of them the tree's only codegen row.** `waterFillRecallShares` (`src/recall.h`) reads `demand[i]` while writing `alloc[i]` and never resizes either, so it takes the buffer form: release codegen 309 → 301 instructions under the build's own flags. `splitNoteTail` (`src/notes.h`), - `takeAckNamedToken` and `computeDelta` (`src/quality.h`) take debug-only guards; `computeDelta`'s two out-pointers - both default to null, so its guard is a null-safe `VERIFY_TEXT` rather than the object form. + `takeAckNamedToken` and `computeDelta` (`src/quality.h`) take the object form, whose check runs in debug and whose + release residue is the `separate_storage` promise on the two objects (read on clang 18+ by default, on LLVM 17 / + AppleClang 16 only with the CMake-added flag and for scalar accesses, never on GCC or clang before 17); for these + it measured no codegen change. `computeDelta`'s two out-pointers both default to null, so its guard is a + null-safe `VERIFY_TEXT` rather than the object form. `markCandidateFilesIncludingDecl` (`src/graph.h`) and `partitionByScope` (`src/verbs_quality.h`) take the last two guards of the audit's apply list, which is now complete: 21 functions state their no-alias contract at entry.