1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
//! VCR-SEL-004 / VCR-ORACLE-001 (#242, #428) — cmp→select fusion CENSUS.
//!
//! The blast-radius datum for gale's default-on FLIP decision. The flip turns
//! `SYNTH_CMP_SELECT_FUSE` on by default (byte-changing, silicon-gated); its
//! go/no-go rests on three pieces of evidence — gale owns runtime correctness
//! (`gust_codegen_bench`) and the M4-regression check (G474RE DWT); the synth-side
//! half is the *blast radius*: across the real frozen fixtures, how many select
//! sites fuse, split into the in-place single-move form vs the two-move
//! `mov{c}…mov{invert(c)}` form whose `mov{invert(c)}` arm #7 made reachable.
//!
//! HEADLINE FINDING (locked here): on EVERY real frozen fixture the two-move count
//! is ZERO — all fused sites are the in-place form. #7's two-move arm fires on no
//! real frozen fixture; its only exercisers are gale's `gust_mix` bench and the
//! synthetic `cmp_select_two_move.wat`. So the flip's novel-at-runtime path has
//! *thin real-code coverage* — gale's bench is load-bearing for it, not redundant.
//!
//! Frozen-safe: drives the shipped binary with `SYNTH_CMP_SELECT_FUSE=1`
//! `SYNTH_FUSE_STATS=1` and parses the `[cmp-select-fuse] N … (K two-move, M
//! in-place)` diagnostic. The flag is OFF by default, so production bytes are
//! unchanged (the frozen byte gates #445/#446 lock that). This test changes no
//! emitted bytes; it records a measurement baseline. If a selector change moves
//! these counts, the census moves and a reviewer sees the blast radius shift.
use std::process::Command;
fn synth() -> &'static str {
env!("CARGO_BIN_EXE_synth")
}
fn fixture(name: &str) -> std::path::PathBuf {
std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
.join("../..")
.join("scripts/repro")
.join(name)
}
/// Compile `fix` (a frozen fixture) with fusion + stats on; return the summed
/// `(total, two_move)` across every `[cmp-select-fuse]` line (one per function).
fn census(fix: &str) -> (usize, usize) {
let path = fixture(fix);
let out = Command::new(synth())
.env("SYNTH_CMP_SELECT_FUSE", "1")
.env("SYNTH_FUSE_STATS", "1")
.args([
"compile",
path.to_str().unwrap(),
"-o",
&format!("/tmp/census_{fix}.elf"),
"--target",
"cortex-m4",
"--all-exports",
"--relocatable",
])
.output()
.expect("run synth");
assert!(
out.status.success(),
"synth compile failed for {fix}: {}",
String::from_utf8_lossy(&out.stderr)
);
let combined = format!(
"{}{}",
String::from_utf8_lossy(&out.stdout),
String::from_utf8_lossy(&out.stderr)
);
let mut total = 0usize;
let mut two_move = 0usize;
for l in combined.lines().filter(|l| l.contains("[cmp-select-fuse]")) {
// `[cmp-select-fuse] N select(s) fused to predicated moves (K two-move, M in-place)`
let n: usize = l
.split("[cmp-select-fuse]")
.nth(1)
.and_then(|r| r.trim_start().split(' ').next())
.and_then(|s| s.parse().ok())
.unwrap_or_else(|| panic!("unparseable fuse line: {l}"));
// `… moves (K two-move, …)` — anchor on the "two-move" token and take the
// trailing number before it (can't split on '(' — `select(s)` has one too).
let k: usize = l
.split("two-move")
.next()
.and_then(|seg| {
seg.trim_end()
.rsplit(|c: char| c.is_whitespace() || c == '(')
.find(|s| !s.is_empty())
})
.and_then(|s| s.parse().ok())
.unwrap_or_else(|| panic!("unparseable two-move count: {l}"));
total += n;
two_move += k;
}
(total, two_move)
}
/// Per-fixture baseline: `(fixture, total_fused, two_move)`. Measured 2026-06-23
/// on the v0.12.0 selector. `in_place = total - two_move`.
const BASELINE: &[(&str, usize, usize)] = &[
("control_step.wasm", 3, 0),
("flight_seam.wasm", 12, 0),
("flight_seam_flat.wasm", 12, 0),
("signed_div_const.wasm", 0, 0),
];
#[test]
fn fusion_census_matches_frozen_baseline_428() {
let mut grand_total = 0usize;
let mut grand_two_move = 0usize;
for &(fix, want_total, want_two_move) in BASELINE {
let (total, two_move) = census(fix);
assert_eq!(
(total, two_move),
(want_total, want_two_move),
"{fix}: fusion census drifted — got (total={total}, two_move={two_move}), \
baseline (total={want_total}, two_move={want_two_move}). A selector change \
altered the cmp→select blast radius; re-measure and update BASELINE \
deliberately (and tell gale — the flip blast radius moved)."
);
grand_total += total;
grand_two_move += two_move;
}
// Non-vacuity: the lever genuinely reaches real code (not a plumbing no-op).
assert!(
grand_total >= 1,
"expected cmp→select to fuse on the frozen fixtures (got {grand_total})"
);
// The headline finding: #7's two-move arm fires on NO real frozen fixture.
// If this ever becomes non-zero, a real fixture started exercising the
// mov{invert(c)} arm — that is GOOD (more real coverage of the flip's novel
// path) but must be a deliberate baseline update, and gale should know its
// bench is no longer the sole runtime exerciser.
assert_eq!(
grand_two_move, 0,
"a real frozen fixture now exercises the two-move arm ({grand_two_move} sites) — \
update BASELINE and notify gale that the flip's runtime path gained real-code \
coverage beyond gust_mix"
);
}