test(sim): commit the differential harness behind the DMA write-address fix (Refs #2348)

[gHashTag]

What

Commits the differential testbench behind PR #2345 as sim/tb_bitnet_dma_write_address.v.

#2348 records that four merged RTL fixes cite differential simulation as their primary
evidence and none commits the instrument. This lands one of the four. The claim was
never in doubt — an independent audit reproduced all four — the defect is that the
evidence was unreproducible from the repository.

Refs #2348
Refs #2003

Path

sim/, not the bootstrap/tests/rtl/ the issue suggested. sim/tb_bitnet_request_overflow.v
(#2351) is the one harness already committed, and one convention is worth more than a
better-named second one. Same directory, same shape, same README structure.

The published number reproduces

PR #2345's body claims: "OLD writes beats to addr 1..4, mem[0] never written; NEW
writes 0..3". First run, before any change to the harness:

== CASE 1: 4-beat read transfer (length=32 bytes) ==
    old: writes=4 addr_range=1..4 done=1
    old wrote: 1(=0),2(=1),3(=2),4(=3)
    new: writes=4 addr_range=0..3 done=1
    new wrote: 0(=0),1(=1),2(=2),3(=3)

(=N) is the payload: beat N lands at address N+1 in the old rendering and at address N
in the new one.

Reconstruction needed no build

bootstrap/src/bitnet_dma.rs has no use statements and no crate:: references, so the
emitter compiles standalone under rustc at any revision. No cargo build, no target
directory. The pre-fix and post-fix renderings come from PR #2345's own base
(cb1f0d4eb980) and head (4db5729b1817); diffing them shows exactly that PR's four
hunks and nothing else. Commands are in sim/README.md.

The harness also passes against current master, whose later waves renamed beat_index to
word_index — every check is made at the module ports.

Three bars

TRUE — the harness compiles under iverilog -g2005 and the numbers above are the
measured output.

ALIVE — it runs, and its anti-vacuity anchors fire. During development the control
case caught itself proving nothing:

  FAIL harness: control produced no AXI write beats -- the write path was never entered and the control proves nothing

BITING — demonstrated with two planted mutants on the post-fix rendering, one per
guard.

Mutant A, reverting the READ_DATA pairing to local_addr <= local_addr + 12'd1:

  FAIL new lowest address written: got 1, want 0
  FAIL new address 0 written 0 times, want exactly 1
  FAIL new wrote address 4, one past the transfer
RESULT: FAIL (14 errors)

Mutant B, deleting only the IDLE re-arm of the index — case 1 still passes, and case 2
alone catches it:

== CASE 1: 4-beat read transfer (length=32 bytes) ==
== CASE 2: second transfer, no reset between ==
  FAIL new lowest address on second transfer: got 4, want 0
  FAIL new highest address on second transfer: got 7, want 3
RESULT: FAIL (6 errors)

That separation is the point: case 2 is not redundant with case 1, and it is the only
check constraining the IDLE hunk.

This is reporting, not a gate

Stated plainly because the distinction matters. vvp exits 0 whether the run prints
RESULT: PASS or RESULT: FAIL — measured both ways, matching tb_bitnet_request_overflow.v.
And nothing executes it: cargo test -p t27c is invoked by no workflow (removed by #2292)
and fpga-build.yml never calls vvp (#2241). Neither is changed here — #2348 is
explicitly about the artefact existing in the tree, and wiring sim/ into CI overlaps
#2241/#2275.

The harness found three defects in itself first

All three are commented at the point of fix, because each is a way a testbench can look
right and measure nothing:

• local_addr is an unsigned 12-bit port; comparing it against an integer seeded to -1
  promotes the expression to unsigned, so the high-water mark never advanced and every
  range read 1..-1.
• A [255:0] label argument silently truncated a 38-character assertion name from the
  left (FAIL ghest address on second transfer).
• The start pulse raced the DUT's own sampling at the same timestep, so the transfer
  never began and three cases reported zeros.

The published numbers reproduced before any of these were corrected, so none of them
was fitted to an expected answer.

Scope

One of four. #2337 (#1977), #2340 (#1985) and #2344 (#2006) still have no committed
harness; #2348 stays open.

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-08-22 01:02:05 UTC

• test(sim): commit the differential harness behind the DMA write-address fix (Refs #2348) #2379 test(sim): commit the differential harness behind the DMA write-address fix (Refs #2348) | Created: 2026-08-22 | Updated: 2026-08-22 | 13 failing / 19 total
• ci(cli-tri): count, name and ratchet the tests that skip themselves #2378 ci(cli-tri): count, name and ratchet the tests that skip themselves | Created: 2026-08-22 | Updated: 2026-08-22 | 7 failing / 24 total
• corpus: freeze the damage, patch one class at a time, and say where one rule stops #2161 corpus: freeze the damage, patch one class at a time, and say where one rule stops | Created: 2026-08-14 | Updated: 2026-08-21 | 0 failing / 9 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	4
PRs with Failing Checks	2
PRs with All Checks Green	2
READY	1
FAILING	2
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=65f033d04125 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

[github-actions]

PR Dashboard

Generated at: 2026-08-22 01:09:50 UTC

• test(sim): commit the differential harness behind the DMA write-address fix (Refs #2348) #2379 test(sim): commit the differential harness behind the DMA write-address fix (Refs #2348) | Created: 2026-08-22 | Updated: 2026-08-22 | 15 failing / 19 total
• corpus: freeze the damage, patch one class at a time, and say where one rule stops #2161 corpus: freeze the damage, patch one class at a time, and say where one rule stops | Created: 2026-08-14 | Updated: 2026-08-21 | 0 failing / 9 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	3
PRs with Failing Checks	1
PRs with All Checks Green	2
READY	1
FAILING	1
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=65f033d04125 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.