tri gates mutate: the boundary scanner never left the control function (Refs #2161)

[gHashTag]

--boundary reported 31 sites for tools/gft_backprop_microcode.py. An independent tokeniser counted 31 comparisons before the if __name__ == "__main__": block. Two numbers agreed, and the story wrote itself: the operator sensibly declines to mutate a file's own self-test.

Both numbers were real. The agreement was a coincidence.

Asking the tool for the site lines instead of the count showed the scan ending at line 371 — nine lines before __main__, at def self_check():. is_control_fn sets in_control, and boundary_sites never resets it, so everything from line 380 to the end of the file had silently never been mutated.

31 → 62 sites, which is exactly the tokeniser's count for the whole file.

When two measurements agree, check what they agree about

The tokeniser answered "how many comparisons precede __main__". The tool answered "how many sites did I find before I stopped". Nothing connected the two but an integer.

What broke the tie was not a third opinion — it was asking for more structure. A total can coincide; a range cannot lie about where it stopped. Prefer a list over a count, a range over a total, a witness over a verdict.

A bug fixed three times, live in the fourth place

Three of four site finders already carried this, in these words:

a function ends at the next TOP-LEVEL statement, not only at the next def

assert_sites, mutable_sites and invert_sites are line-oriented and got it. boundary_sites is byte-oriented — it tracks quotes and comments character by character — so when --boundary was added the fix had no line to attach to.

The motivating file could not test the fix

After the change: 62 sites, none inside self_check's body — correct. But self_check in that file has zero comparisons, so the exclusion half was never exercised by the file that prompted the work. A synthetic helper / control / __main__ source covers all three answers, and reverting the fix makes it fail with [2].

A regression test written from the motivating file tests only the half that was broken.

Also here

_magsub asserts sticky == 0 at every tie. The arm below it is the addition rule in the subtraction path, correct only because it never runs. This makes waking up loud without deciding what the rule should be — that is 30 specs and belongs to #2652. Positive control: waking the detector fires it.

tri pointers regained (?![\w]). Without it .v matched inside docker/Dockerfile.vivado, and the tool's own first run invented a dead pointer to a file nobody had ever named. The guard was in the exploratory version and lost in the rewrite — the cheapest kind of regression and the hardest to see in a diff.

Dead pointers are now split by history:

class	count	meaning
NEVER	12	no commit ever — the pointer was wrong when written
REMOVED	2 → 0	stale, and the history says where it went

Both REMOVED rows were moved by a single docs restructure and are fixed here. board/bpseq.v, which occasioned the tool, was NEVER — and I had read it as REMOVED without checking, which is how it took a decision with it.

Prior art, checked and not adopted

mutmut and cosmic-ray do not attempt equivalent-mutant detection at all. Stryker has disable comments carrying a reason string — the same shape as # mutant-equivalent:, and likewise unverified. So refuting the annotation (#2656) is the delta, not catching up.

Trivial Compiler Equivalence was measured on this tree rather than assumed: zero among real operator mutants. A first pass reported 95 of 527 until I noticed it was mutating comments, which vanish at compile time and therefore always "compile identically". Not building it; recorded so a later tick does not re-chase.

Refs #2161

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-08-24 04:25:51 UTC

• tri gates mutate: the boundary scanner never left the control function (Refs #2161) #2663 tri gates mutate: the boundary scanner never left the control function (Refs #2161) | Created: 2026-08-24 | Updated: 2026-08-24 | 17 failing / 25 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	2
PRs with Failing Checks	1
PRs with All Checks Green	1
READY	0
FAILING	1
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=e6333575ec10 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).