VCR-DEC-001 increment 3: graph-colouring allocator colours ACROSS CALLS — 57 of 68 declines taken, measured (#242)

[avrabe]

v0.54 lane L4 — VCR-DEC-001 increment 3 (epic #242, the North Star allocator endgame).
Flag-off measurement spike. Do not merge before the coordinator sequences the lane fan-in.

What

Increment 2 (v0.53) colours across if/else joins. Its second-largest decline
bucket was call / call-indirect — 68 of the measured corpus — because a
bl had no modeled effect and the join CFG builder refused the whole function.
This increment models the AAPCS call boundary and takes 57 of the 68.

The hazard, and how it is closed

The lane brief named it: "calls need the AAPCS clobber contract modelled in
BOTH the pass AND the validator — a validator treating bl as effect-free would
accept a non-identity equation across it." That was not hypothetical:
validate_cfg_rewrite did exactly that (a non-straight-line op was required
identical and then given NO effect), so an equation (R4, R2) demanded after a
call sailed straight through it.

liveness::call_effect now states the contract once:

defs = {R0, R1, R2, R3, R12, LR}            call-clobbered
uses = {R0, R1, R2, R3} + a `blx`'s target  arguments, conservatively all four

and BOTH consumers read that one definition — the pass (graph_alloc::joins
liveness / interference / identity pins) and the oracle
(validate_cfg_rewrite's backward transfer). Sharing is deliberate: two
hand-maintained copies would be the VCR-ORACLE mirror-pinning failure mode. The
honest consequence — neither validator can catch an error in the contract —
is what the execution differential is for.

reg_effect is deliberately NOT widened: its None-on-call is load-bearing for
the shipping pipeline (fail-safe prologue, shrink_callee_saved_saves' decline,
VCR-RA-003 invariant 1), so widening it would move shipped bytes.

Calls are emitted verbatim, with both rename maps re-checked as the identity
(call-operand-recoloured declines otherwise). Single-block functions
containing a call are taken too — increment 1 structurally cannot, since a call
is not is_straight_line.

Measured (the deliverable)

scripts/repro/vcr_dec_001_join_alloc_measure.py, ARM repro corpus. Bytes from
the ELF symtab, cycles from --emit-wcet sound bounds.

path	increment 2	increment 3
relocatable	−46 B (−0.11 %) / −25 cyc, 275 applied, 8 shrank / 1 grew	−100 B (−0.24 %) / −33 cyc, 307 applied, 24 shrank / 5 grew
self-contained	−70 B (−0.14 %) / −9 cyc, 81 applied, 10 shrank / 1 grew	−120 B (−0.24 %) / −17 cyc, 108 applied, 27 shrank / 3 grew

Zero WCET-bound regressions on either path (12 bounds shrank, 0 grew).

Decline histogram (relocatable)

reason	inc 2	inc 3
unmodeled-op	164	174
single-block	73	73
call	57	0
identity-colouring	18	31
call-indirect	11	11 (call-indirect-pseudo)
unreachable-block	10	11
numeric-branch	9	10

Of the 57 taken, 32 became applied colourings; the other 25 moved on to the NEXT
construct they contain (a numeric branch, an unmodeled i64/FP op, or an identity
colouring) — a decline that MOVED, never one that was deleted. The residual 11
are the high-level Call/CallIndirect pseudo-ops, expanded downstream into
a bounds guard + table load + result move, so the register footprint here is not
the one that ships; they stay declined by name.

Gates

• Flag stays OFF. SYNTH_GRAPH_ALLOC unset never enters the module; frozen
  anchors byte-identical 10/10 (frozen_codegen_bytes.rs +
  vcr_dec_001_graph_alloc_differential.py property 1).
• VCR-RA-003 + validate_cfg_rewrite clean on every emitted function
  (observed via SYNTH_RA003_VERBOSE, not inferred from an exit code).
  Necessary, not sufficient — see below.
• Execution differential extended and CI-wired in the same commit.

Mutation evidence

The contract is shared, so only execution can catch an error in it. A matrix over
its two halves:

mutant	outcome
uses = [] (argument half)	KILLED. Unit: cfg_validator_rejects_a_renamed_call_argument. Execution: 5 wrong results — call6(1,2,3,4,5,6) returns 0x00651321 vs wasmtime's 0x00654321 — once the churn bias is replaced by a churn-maximising one that stops masking it. validate_cfg_rewrite AND VCR-RA-003 both accept the mutant.
control: churn-maximising bias alone, contract intact	0 wrong results — so the failure above is attributable to the contract, not to the bias.
defs = [] and uses = [] (the pre-increment-3 effect-free bl — the briefed hazard)	KILLED by three unit tests.
defs = [] alone	SURVIVES. Documented on call_effect, not papered over — see below.

The surviving mutant is a finding, not a hole. With the conservative uses
intact the two halves OVERLAP for the R0-R8 pool: a value live across a call must
be defined above it, and the (r, r) argument equation the call generates then
collides with the rewritten definition. So defs' independent duties today are
(a) the non-pool {R12, LR} and (b) keeping the PASS from proposing colourings
the oracle would only reject — reach, not soundness. That flips the moment
uses is narrowed: an arity-precise argument set (the obvious next reach win —
an unused argument register currently stays live all the way back from the call
and blocks that colour) makes defs the sole soundness guard for R0-R3. The
call_effect doc says so, in those words, next to the constants.

Also fixed by the matrix: cfg_validator_rejects_a_renamed_call_argument was
originally vacuous w.r.t. the call model — its bx lr STRICT exit seed demanded
R0 all by itself. It now stages R3 and renames to R2 inside a pop {…,pc} frame
where both are dead-out per cfg_exit_observable, so only the argument use
can reject it.

Execution differential (CI-wired, same commit)

New CALL population covering both halves:

• CLOBBER half — local_promote_cross_call::cross_call and
  intra_module_callee_saved::a (both written so a caller-saved home is
  observably wrong) + the self-recursive stack_canary_687::recurse.
• ARGUMENT half — call_5args::caller, call_6_7args::call6/call7, whose
  callees pack each argument into its own nibble, so any dropped, shifted or
  mis-assigned argument changes the result.

Harness: AAPCS argument passing (0-3 in R0-R3, 4+ on an 8-byte-aligned stack —
without it the 5/6/7-arg fixtures would look like miscompiles); every declared
call shape is verified to really CONTAIN a bl/blx in its emitted bytes
(self-declaration checked against bytes); its own non-vacuity floor of ≥4
divergent call-containing functions, re-asserted by the CI awk from the new
CALLSHAPES= summary field (#890). 56/56 checks, 19 engaged functions, 6 call
shapes.

Verification (REAL exit codes)

cargo fmt --check 0 · cargo clippy --workspace --all-targets -D warnings 0 ·
cargo test --workspace 0 · claim_check.py 34/34 ·
vcr_dec_001_graph_alloc_differential.py 0 ·
vcr_dec_001_join_alloc_execution_differential.py 0.

Named follow-ups (not done here, deliberately)

1. Arity-precise argument sets. The conservative all-four uses is the main
   reach cost: an argument register with no in-function definition stays live
   from the entry to the call and blocks that colour across the whole prefix.
   Requires threading callee signatures into the allocator. Read the defs
   warning above before doing it.
2. shrink_callee_saved_saves is leaf-only (it declines on any reg_effect == None op, i.e. every call), so evacuating R4-R8 in a call-containing
   function does not shrink its prologue today — increment 3's size win comes
   from encoding widths, not from the push/pop lever that drove increment 2.
   Widening it would change SHIPPING bytes, so it is out of scope for a flag-off
   spike; it is where the next chunk of this reach converts into bytes.
3. The Call/CallIndirect pseudo-ops (11 declines) need the allocator to run
   after their expansion, or the expansion's register footprint modeled.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 89.42308% with 22 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/graph_alloc.rs	93.15%	13 Missing ⚠️
crates/synth-synthesis/src/liveness.rs	50.00%	9 Missing ⚠️

📢 Thoughts on this report? Let us know!