RQ-59-FRESHNESS (#977): all 48 named stale-artifact sites converted — freshness coverage 7/58 -> 58/58

[avrabe]

RQ-58-FLAKE's stated residual, closed: the 48 sites #1006 named as unable to notice a stale artifact are all converted (or, for shapes the guard does not fit, closed with the same discipline). Freshness coverage over the survey's 58 compile-then-parse sites goes 7/58 -> 58/58. No second guard was written — every conversion routes through artifact_guard (#1006), which grew exactly one delegating variant (compile_artifact_with_output, for gates that assert on the compiler's own stderr; compile_artifact now delegates to it).

How the sites were ranked

By what a stale read would RE-CERTIFY, the way frozen_codegen_bytes.rs re-certified the SHA-256 anchors:

1. Flip/byte-identity gates first — their assertions COMPARE two artifacts (off vs on). A stale arm silently reduces the gate to comparing last run's bytes with itself: the rollback proof for a default-on lever is re-confirmed by evidence this run never produced. These are the CI-pinned opt-out proofs the North Star table leans on.
2. Validator/attestation gates — VCR-VER-003's read-back records, the ProvenSafeBoundsChecker: elide software bounds checks using scry's proven-safe verdicts #901 elision attestation sidecar, the Parity benchmark: reproducible wasm→synth-AOT vs native-C→LLVM comparison — counter the 'wasm is ~40% slower' claim with measured cycles+bytes #735/Codegen: close the 3.9× size gap vs LLVM on the gust hot path (regalloc + addressing-mode folding) #390 measured pins. A stale read re-certifies a validator verdict or an attestation.
3. Structure/linkability/DWARF/provenance gates — symbol/section/reloc shape claims.
4. The helper-split trio — named structurally resistant in RQ-58-FLAKE (#977): the flake was a shared output path — and the silent direction was reading a STALE ELF and passing #1006; see below.
5. The conformance suite and the feature-gated trio last: wast_compile.rs was the one file already checking .exists() (loud on the missing-file half), and the fact_spec trio needs the --features verify build to run its own oracle.

Batches, each with its oracle and the SILENT-direction demonstration

Every batch ends green with its own pinned evidence unchanged — that is the byte-identity oracle: the artifacts the gates read after conversion are the same bytes the pinned goldens describe. Nothing the compiler EMITS changed; frozen anchors are 10/10 in the full workspace run.

Batch	Files (sites)	Oracle	Silent-direction demonstration
1 — flip gates	base_cse_flip_468 (1), const_cse_reduction_242 (2), flag_flip_wave_242 (1), spill_realloc_242 (1), rv32_cmp_select_flip_472 (1), rv32_local_promo_flip_472 (1), volatile_segment_flag_543 (1), volatile_segment_phase2_543 (1), vcr_ver_001_gate_242 (1)	pinned goldens unchanged (base_cse sha256 pair, const_cse FNV pair, no-grow + non-vacuity floors)	freshness_guard_refuses_stale_flip_artifact_977 (base_cse_flip_468.rs)
2 — validator/attestation	vcr_ver_003_addr_777 (2), proven_safe_bounds_901 (3), size_attribution_390 (1), parity_benchmark_735 (1), promotion_exhaustion_fallback_474 (1), wsc_facts_ingestion_494 (1)	measured pins unchanged (parity 84 B, proven-safe 138/80/50 partition, promotion off≡on byte-identity, .wasm_data record bytes)	freshness_guard_refuses_stale_validator_artifact_977 (vcr_ver_003_addr_777.rs)
3 — structure/linkability	dwarf_debug_line_emit_394 (2), elf_tooling_637_656 (1), multi_memory_406 (1), heterogeneous_table_676 (1), cabi_arena_bind_418 (2), cabi_arena_realloc_linkability_418 (1), call_indirect_275_selfcontained (3), async_intrinsics_gate (1), provenance_reconciliation_396 (1), provenance_introduced_origin_944 (1)	all symbol/section/DWARF/provenance assertions green; llvm-dwarfdump (independent parser) still verifies; the co-link test's REAL linker still links the guarded artifacts	freshness_guard_refuses_stale_structure_artifact_977 (multi_memory_406.rs)
4 — helper-split trio, THREADED	multi_sp_rebase_707 (1), static_downshift_678 (1), static_above_sp_739 (2)	pinned structure numbers unchanged (addends 576/616/4200/0x10000C, bss 584/512/4096, slot vectors)	freshness_guard_refuses_stale_reloc_artifact_977 (static_above_sp_739.rs)
5 — conformance suite	wast_compile (10: the helper behind 20 tests + 9 inline sites)	all 32 tests green (magic/e_machine/e_type/BL-resolution unchanged)	freshness_guard_refuses_stale_conformance_artifact_977 (wast_compile.rs)
6 — feature-gated + cross-crate	fact_spec_clamp/bounds/div_494 (3), linker_integration_test (synth-backend, 1)	ran with the fact-spec CI job's own invocation (--features verify): 12/12 green incl. the flag-off ≡ baseline byte-identity gates	covered by the guard's own always-run artifact_guard_* demos; the linker site is not a compile-then-parse (see below)

Each demonstration proves the counterfactual the way #1006 did: (1) plant a VALID artifact minted by that batch's own compile shape and assert it parses and carries the very thing the batch's gates assert on (.text, .wasm_data, .synth.wasm_mem_1, the __synth_wasm_data addend, the ARM e_machine) — i.e. the pre-conversion shape WOULD have passed on last run's bytes; (2) run a FAILING compile at that exact path; (3) require the guard to refuse naming the COMPILE (never the parser) and to leave NOTHING at the path. All five run in CI on every push, alongside the four artifact_guard_* guard-observation tests from #1006.

The structurally-resistant shape dissolved

#1006 left the trio (multi_sp_rebase_707, static_above_sp_739, static_downshift_678) because compile and read were split across helpers taking a &str path. The small contained change that closes it: every reader (bss_size, global_slots, wasm_data_addends, max_wasm_data_addend, has_baked_pair_in_window) now takes BYTES, and bytes are only handed out by a guarded compile. After this the split cannot recur in these files — a reader physically cannot open a path a previous run populated. No gate file was restructured beyond its own helpers.

Stated remaining boundary

• Refusal-only sites are out of scope by the survey's own definition (a site = a compile whose artifact is READ BACK). Tests that expect a FAILING compile and assert only on exit/stderr keep their Output-returning helpers (multi_memory refusals, the static_* straddle/flag-honesty refusals, cabi bad-sig, call_indirect imports/skip-target, vcr_ver_003 span refusals). A few still name fixed /tmp paths, at which nothing is produced or read.
• linker_integration_test.rs is not a compile-then-parse — a library API (generate_to_file) writes the file; there is no Command for the guard to wrap and duplicating the guard was refused. Closed with the same discipline the guard encodes: per-process-unique path + remove-first ahead of the write.
• External-tool reads are by-path by nature: the dwarf helper and elf_tooling hand a PATH to llvm-dwarfdump / the real linker. The artifact is proven fresh (remove-first + status + exists/non-empty) at hand-out and stays in place for the tool; each path has a single writer in a single test.
• Python harnesses unchanged, per RQ-58-FLAKE (#977): the flake was a shared output path — and the silent direction was reading a STALE ELF and passing #1006's audit: all five flagged were false positives, and the CI steps that produce their objects run under bash -e on ephemeral runners.

Gates

cargo fmt --all clean · cargo clippy --workspace --all-targets -- -D warnings clean · cargo clippy -p synth-cli --features verify --all-targets clean · cargo test --workspace TRUE exit 0 (146 green result lines; frozen anchors 10/10) · cargo test -p synth-cli --features verify --test fact_spec_* 12/12 · python3 scripts/claim_check.py claims.yaml 50/50 · python3 scripts/model_coverage_audit.py --check ok. No .wat added; no compiler source touched — only how harnesses READ artifacts changed, never what the compiler emits.

Refs #977

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!