[BUG] Terminal call revisit drops callee discovery after a boundary issue #6

New issue

Closed

opened 2026-09-16 04:06:28 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-16 04:06:28 +02:00

Owner

Summary

Revisiting a terminal call after a weakened register join can remove its previously recorded callee. The still-open fallthrough-boundary diagnostic then prevents recomputation. Consequently, grounded no-return discovery cannot inspect that callee, and complete frame analysis remains conservatively incomplete.

Reproduction

Use an original function beginning at 0x1000 with the following literal instructions, and a separate callee at 0x1100 containing 0f 0b (ud2):

1000: b8 00 00 00 00  mov $0x0,%eax
1005: 85 ff           test %edi,%edi
1007: 75 06           jne 100f
1009: b8 01 00 00 00  mov $0x1,%eax
100e: 90              nop
100f: e8 ec 00 00 00  call 1100

Analyze the function through the ordinary body interpreter. Its declared byte interval ends at 0x1014; padding is outside the function. The alternate predecessor weakens the incoming integer value at the call and queues that site again.

Expected and actual behavior

Expected: retain/recompute the exact call to 0x1100 while keeping unproved fallthrough explicit. The outer analysis must discover the callee and may suppress fallthrough only after deriving its ordinary no-return fact. It must not expand the caller into padding or infer no-return from a name.

Actual: the second visit removes the call record and then skips the site because an earlier boundary issue exists. The body is incomplete and its calls list is empty. The conservative failure is retained; this is not evidence of an accepted unsafe frame.

Environment and identity

Observed while extending signed Exsh efb542a3418badef951d01dff24eec88b8490aee with ordinary comparison/edge analysis. The affected stale-issue ordering predates that extension. The independent literal control uses the existing original ELF fixture and warning-denied Python interpreter; it executes no target code.

Evidence and prior checks

The control retains the boundary issue at 0x100f, maximum local depth eight bytes, six reachable instructions and no call records. Retained runtime/all artifacts also have terminal protected calls whose rejected fallthrough is exactly the declared function end. Two earlier checkpoint descriptions called these guard-interior conflicts; original byte/range inspection corrects that description to function-end fallthrough. This observation does not establish the full source/frame proof or a successful guest build.

Ordinary comparison checkpoint — 16 September 2026: signed Exsh 4ed392bcc53cb46d0296cecbdd930c8be5cd7c28 replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed.

All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets.

The audit also reproduces and fixes terminal-call discovery loss. A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect.

Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup.

Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs d8fbc3a1f3696e02954b81f23511cee513ddfa8c passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required.

Comparison checkpoint CI — 16 September 2026: Exsh CI 243 and 244 are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed.

Docs CI 905 and 906 pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in Exsh #6 while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles.

Tracking

Related to complete emitted frame evidence, Phase 6 shell work and the implementation review. Recompute reached sites despite earlier successor diagnostics, preserving every existing failure and original stack budget. Add returning, unknown-target and grounded no-return regressions, replay exact artifacts, validate and monitor matching CI before closing this defect.

## Summary Revisiting a terminal call after a weakened register join can remove its previously recorded callee. The still-open fallthrough-boundary diagnostic then prevents recomputation. Consequently, grounded no-return discovery cannot inspect that callee, and complete frame analysis remains conservatively incomplete. ## Reproduction Use an original function beginning at `0x1000` with the following literal instructions, and a separate callee at `0x1100` containing `0f 0b` (`ud2`): ```text 1000: b8 00 00 00 00 mov $0x0,%eax 1005: 85 ff test %edi,%edi 1007: 75 06 jne 100f 1009: b8 01 00 00 00 mov $0x1,%eax 100e: 90 nop 100f: e8 ec 00 00 00 call 1100 ``` Analyze the function through the ordinary body interpreter. Its declared byte interval ends at `0x1014`; padding is outside the function. The alternate predecessor weakens the incoming integer value at the call and queues that site again. ## Expected and actual behavior Expected: retain/recompute the exact call to `0x1100` while keeping unproved fallthrough explicit. The outer analysis must discover the callee and may suppress fallthrough only after deriving its ordinary no-return fact. It must not expand the caller into padding or infer no-return from a name. Actual: the second visit removes the call record and then skips the site because an earlier boundary issue exists. The body is incomplete and its `calls` list is empty. The conservative failure is retained; this is not evidence of an accepted unsafe frame. ## Environment and identity Observed while extending signed Exsh `efb542a3418badef951d01dff24eec88b8490aee` with ordinary comparison/edge analysis. The affected stale-issue ordering predates that extension. The independent literal control uses the existing original ELF fixture and warning-denied Python interpreter; it executes no target code. ## Evidence and prior checks The control retains the boundary issue at `0x100f`, maximum local depth eight bytes, six reachable instructions and no call records. Retained runtime/all artifacts also have terminal protected calls whose rejected fallthrough is exactly the declared function end. Two earlier checkpoint descriptions called these guard-interior conflicts; original byte/range inspection corrects that description to function-end fallthrough. This observation does not establish the full source/frame proof or a successful guest build. Ordinary comparison checkpoint — 16 September 2026: signed Exsh `4ed392bcc53cb46d0296cecbdd930c8be5cd7c28` replaces the fixed-register table macro with byte-checked CMP/Jcc facts, live comparison lifetime, unsigned/equality edge refinement and sound producer-width widening. A 32-bit comparison never zeroes upper bits. Every complete immutable target set remains mandatory, and numeric/table values cannot authorize function calls. Unknown predecessors, relevant flag/subject writes and unmodeled effects discard conditions. The obsolete dispatch report field is removed. All 176 checker tests pass, including an independent exhaustive interval oracle, high-register dispatch, sign extension, bypasses, conflicting/unknown joins, stale proofs, complete table arms and large arithmetic loops. Independent original-byte audits check 354/321 comparison edges, eleven table branches per mode, protected function loads and thirteen earlier grounded no-return facts per mode. Original runtime/all pairs reach 271/246 functions and retain 158/126 unresolved observations, down from 164/132. Workspace domains pass; full frame/source status remains incomplete with actual exit 1 and unchanged budgets. The audit also reproduces and fixes [terminal-call discovery loss](https://git.erikinkinen.fi/erix/exsh/issues/6). A prior successor diagnostic no longer suppresses recomputation of a revisited call. Three independent controls retain grounded no-return, returning and unknown-target behavior. Original byte/range inspection corrects earlier descriptions of two guard-interior conflicts: these were fallthrough exactly at declared function ends. Padding remains outside those functions; callee names never supply no-return proof. Matching CI remains required before closing the defect. Profiling identified repeated decoder-effect work. Sharing immutable effects only within one function-body analysis reduces runtime/all effect decoding from 72,668/69,784 to 34,499/32,576 and operand parsing from 75,637/72,547 to 37,468/35,339. Complete paired decisions remain identical. Final single paired profiled observations are 6.633 to 6.425 and 6.416 to 6.269 seconds, including overhead and waiting. The final baseline overlaps host test execution, and earlier pairs show timing variability; these diagnostic durations do not isolate a speedup. This establishes reduced host work, not a timing guarantee or guest speedup. Every Rust/Cargo/linker/build/workflow byte retains the existing strict six-configuration 961-test matrix and six native builds. Formatting, Markdown and canonical checks pass. Signed Docs `d8fbc3a1f3696e02954b81f23511cee513ddfa8c` passes all 45 tests and complete 2,379-page rendering: 435,637 in-bounds word boxes, zero final warnings and two visually reviewed pages. The physical audit covers 3,005 authored code files below 1,000 lines. Matching CI is pending. Remaining indirect calls/branches, full source/direct-versus-nested proof, coherent catalog adoption, complete realm authority and both full confined guest-build generations remain required. Comparison checkpoint CI — 16 September 2026: [Exsh CI 243](https://git.erikinkinen.fi/erix/exsh/actions/runs/243) and [244](https://git.erikinkinen.fi/erix/exsh/actions/runs/244) are terminal. All four complete logs total 314,904 bytes with no compiler/lint warnings. Strict Rust checks, 961 Rust tests, 176 checker tests, Markdown and all four workspace domains per run pass. The required full-frame gate remains failed with 163/126 unresolved observations on these CI artifacts; their identities are distinct from the original static replay pairs. No full frame or guest-build acceptance is claimed. [Docs CI 905](https://git.erikinkinen.fi/erix/docs/actions/runs/905) and [906](https://git.erikinkinen.fi/erix/docs/actions/runs/906) pass with all four complete logs (763,056 bytes), 45 tests and 2,379-page manuals. Both final renders have zero warnings after ordinary reference convergence. The terminal-call discovery controls pass in both Exsh runs, resolving the scoped defect in [Exsh #6](https://git.erikinkinen.fi/erix/exsh/issues/6) while the complete emitted-proof defect stays open. The current physical audit covers 3,690 authored source/config files below 1,000 lines; semantic authority and complete private documentation closure remain required. Original unfinished Integration jobs continue under their existing handles. ## Tracking Related to [complete emitted frame evidence](https://git.erikinkinen.fi/erix/exsh/issues/4), [Phase 6 shell work](https://git.erikinkinen.fi/erix/exsh/issues/2) and [the implementation review](https://git.erikinkinen.fi/erix/exsh/pulls/3). Recompute reached sites despite earlier successor diagnostics, preserving every existing failure and original stack budget. Add returning, unknown-target and grounded no-return regressions, replay exact artifacts, validate and monitor matching CI before closing this defect.

erikinkinen added the

bug

phase-6

labels

2026-09-16 04:06:28 +02:00

erikinkinen referenced this issue from a commit

2026-09-16 04:10:08 +02:00

feat: Prove comparison bounds through ordinary table flow

erikinkinen referenced this issue

2026-09-16 04:11:08 +02:00

[FEATURE] Audit authority, code quality and documentation in exsh #2

~~erikinkinen referenced this issue 2026-09-16 04:11:08 +02:00~~