Files
reverse-engineering-anything/experiments/atomic-codemode/switch-study.md
T
f44dca9c37 feat(experiment): expose native case-to-edge facts
Share exact jump-table metadata and paged case relationships across CLI,
MCP and Code Mode. Keep labels, row identities, recovered edges and machine
defaults separate; reclaim independent facts under output capacity.

Verify all 182 SQLite table targets against ELF bytes through both MCP
adapters and retain cases/calls when a real 2 MiB native budget omits IR.
Freeze the next analyst question and oracle before real-model trials.

[AUTOMATED] Experimental native patch; no upstream integration or PR.

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
2026-10-16 15:32:12 +00:00

132 lines
8.1 KiB
Markdown

# Native cases as composable facts
The SQLite VM has 182 table entries and 149 distinct targets. Its native
jump-table owner already knows labels and exact row-to-out-edge mappings;
the experiment previously exported only the optimized CFG. This closes that
export/query gap without deriving labels from edge order or block addresses.
It remains an opt-in experiment, not stock-provider parity or integration.
## Owners and contracts
`atomic_membership` gathers BRANCHIND identities during its existing checked
membership scan. Read-only `JumpTable` accessors borrow native address/label
rows and edge positions. `atomic_switches` checks the exact linked operation,
indexes mappings once and exports an independent version-1 facet alongside
unchanged graph schema 3 and its optional schema-4 compression envelope.
Ordinary non-opt-in analysis and target executable bytes are unchanged.
Native limits are 12,000 switches, 100,000 rows/mappings and a shared 2 MiB
selector/type/address-space text budget, within the existing supervised process
and 8 MiB document bounds. Source labels stay exact hex strings. Missing tables,
labels, targets/mappings and the native reserved no-label marker remain explicit.
No-label status comes from the native owner; it is not guessed from an integer.
`native-switch-contract` admits rows before expanding validation errors;
`native-switch-views` owns identity checks, partial coverage and indexes. A full
graph cross-checks operation/value/edge ownership; without it, shared values are
checked against available calls/projection facts. Bad switch data makes that
facet unavailable while preserving independently valid graph/calls/C.
`switches` returns metadata and selector facts, never an embedded case inventory.
`relations(kind:cases)` selects labels or original row indexes and pages
individual case-to-edge relations. A case has a stable case_id; distinct edges
have distinct relation IDs. Unmapped cases produce one explicit unknown-edge
row. Relation totals are separate from native row and mapping counts. This
avoids an unbounded edge array even when limit=1; a regression reads a late
two-edge page from a 4,096-mapping case in under 1 KiB of returned items.
Raw rows are retained once. Row lookup is direct, labels have an index, and
prefix offsets permit paging without constructing all relation projections.
Single-label offsets are cached only for existing labels, bounded by the
retained source; arbitrary missing labels and filter combinations do not grow
that cache. The validated model/lease owns its lifetime. Both MCP adapters and
the JavaScript CLI consume these same owners.
The native writer keeps old graph/call coverage ahead of the new facet when
space is scarce. A source review found that a later projection omission could
free space without restoring saved switch facts. `bounded_reclaiming` retries
that saved facet whenever a preferred smaller combination fits. It moves trees,
does not clone them, and bounds both encoded string alternatives. A focused
native regression and real 2 MiB CLI captures verify the restored facts.
## Real provider evidence
Upstream: `fe01d6294eb0d1053ce343c8943646df88e143fc`.
Final preserved engine:
`a9ca8a8ac224936afb08a9d4be9c1225feb69473ad9f35764e8d1c4f04875b5b`.
Patch SHA-256:
`9b6642f498f3c9f356b253a2b8b14daf2154cde8eae2d4ab0696f018566e9b73`.
The initial public checks used preserved `ac6bc7ab...`, before the formatter
reclamation fix. Binaries are copied outside mutable Cargo outputs and not
committed. Target/digest and independent machine oracle are in
[switch-oracle.md](switch-oracle.md).
Both final actual MCP paths compare every one of the 182 labelled original
targets with independently reconstructed ELF table entries. Selected loaded
bytes and dispatch instructions also agree. The native mappings cross-check
against the full recovered graph; graph and ordinary C/metadata/calls match the
prior complete golden. That producer comparison does not independently prove
whole machine/IR equivalence. Each route executes fourteen MCP requests.
The final wire document is 3,818,818 bytes. Two real native CLI processes with
an explicit 2 MiB output budget instead produce identical 823,908-byte records:
graph and projection are explicitly unavailable, while C, 416 calls and all
182 cases survive. Replaying their retained source through the shared decoder
again verifies every original target. This establishes the native CLI/decoder
boundary, not a public MCP no-graph run; the MCP owner keeps its 8 MiB budget.
The recovered selector is eight bytes but comes from a one-byte LOAD/ZEXT. The
machine computes its jump address in a different register. Native default edge
`8:42` points to block 778, origin `0xeacf0`; the unsigned machine out-of-range
guard instead jumps to `0xea998`. Defaults, original addresses and optimized
edge identities have separate authority, now stated in the contracts.
## Executed checks and costs
The shared JS suites pass 73 cases. Selected native CLI tests pass thirteen;
one native jump-table test separately checks nonmatching ordinals/labels/edges,
missing labels and inconsistent row lengths. Focused source lint passes without
warnings; upstream compiler warnings are outside this patch. Full native corpus,
stages/workspace and whole-REA gates remain unexecuted or previously resource
limited; no integration readiness is claimed.
| Executed scope | Family wall s | Family CPU s | Kernel peak MiB |
| ----------------------------------------- | ------------: | -----------: | --------------: |
| First native export build | 397.637 | 366.618 | 2,169.6 |
| Identity/text-budget build | 432.413 | 388.136 | 2,130.6 |
| Initial twelve CLI tests | 100.723 | 99.982 | 647.3 |
| Native jump-table test, including compile | 277.247 | 276.646 | 2,855.5 |
| Final thirteen CLI tests | 52.204 | 40.984 | 476.4 |
| Formatter-fix build | 63.414 | 50.208 | 524.5 |
| Cached final build | 0.522 | 0.189 | 30.1 |
| Initial Code MCP, ac6bc7ab | 41.698 | 41.415 | 656.5 |
| Initial direct MCP, ac6bc7ab | 96.920 | 75.949 | 639.2 |
| Two 2 MiB native CLI captures | 79.377 | 79.060 | 514.7 |
| Final direct MCP | 44.440 | 44.201 | 635.0 |
| Final Code MCP | 43.828 | 43.504 | 643.0 |
| Both catalog/reference checks | 2.033 | 1.839 | 144.4 |
| Real CLI empty switch/ID selection | 3.646 | 3.397 | 188.8 |
All resource runs use one CPU, 4 GiB hard / 3 GiB early-stop memory bounds,
verified cleanup and OOM 0. Peaks include charged file cache, not RSS. Final
same-lease snapshot plus selected-case reuse takes 4.8 ms / 0.006 CPU seconds
direct and 8.2 ms / 0.009 Code; cumulative memory peaks only upper-bound isolated
warm memory. OS caches and host contention are uncontrolled. These scripted
measurements do not establish token savings or model outcomes.
The initial direct capture also ran slowly (about 90 seconds), despite
sequential requests and no model. This shows the earlier long capture is not
unique to Code Mode or model interaction. The [overlap diagnostic](overlap-study.md)
did not reproduce it. Its native/host cause remains unresolved; no speed fix or
causal dispatch comparison is claimed.
## Model question
The [question](sqlite-switch-question.txt) and [oracle](switch-oracle.md) must be
committed before either real model launch. They ask for selected labels,
source-byte/normalized-selector widths, signed relative target arithmetic and
the native-default versus machine-guard distinction, starting from function
name/messages. Both lanes get the full catalog and the same exact discovery,
envelope and stopping guidance; reverse engineering facts are not precomputed
for the measured models. Real-model results are pending.