Archive — history, not state. Kept for its reasoning and its evidence; its plan is closed.

Exact linked pure-leaf substitution

Status: rejected by the production performance gate on 2026-07-14. The active shop/Mach/native/PGO integration and its pass flag were deleted. The later artifact audit found that the rejected experiment’s origin stamping, packed sidecar, proof/pairer modules, focused tests, probes, and executable fixtures were still dormant in the tree. Those executable artifacts are now deleted; this document is the durable negative evidence so the design is not retried.

Goal

A literal call through use('module').member(...) has stronger semantics than an honest dynamic call: the executable graph resolves the module to one content hash and the module binding is immutable. The rejected narrow consumer additionally retained an exact call-origin sidecar. It consumer substitutes a tiny exported Pit function body at that call site. It does not introduce an opcode, runtime guard, shape transition, target metadata, or per-actor state.

The acceptance fixture exports seven() from an explicitly stoned record and calls leaf.seven() two million times. The gate is at least 25% faster Mach, 50% faster native, no more than 10% changed-function target-code growth, exact results, and zero target/runtime metadata.

aot_bench/linked_pure_leaf_runtime.ce was the real shop/executable gate. It reports the internal loop time after the CLI’s initial request so daemon and actor startup do not contaminate the 2M-call comparison. The matching suite source was removed with the rejected implementation; the measurements below preserve its result.

Proof boundary

The deleted pit-compiler/linked_leaf_substitute.cm failed closed unless all of these held:

• the consumer fact came from a literal statically linked export call and still names the exact direct call/callee slot;
• the provider is present under the canonical executable-graph name and its content hash equals the graph’s expected hash;
• the provider is a module whose initializer constructs one fresh record, stores the selected exact function member, explicitly stones that record, and returns it;
• call and callee arity are exactly equal, from zero through four;
• the leaf has no captures, disruption handler, calls, allocation, heap or cell access, escape, suspension, or control edge, and contains at most 24 modeled operations and at most 255 slots (the shared Mach format’s hard limit);
• every local use is defined and every operand/slot is in range.

The general proof/rewriter can represent a larger straight-line leaf, but the first production admission is intentionally narrower: the rewrite must be one immediate numeric access replacing one call, must add no slot, and must keep every function’s instruction count and slot count identical. This is not a code-size heuristic. It is the boundary that keeps finalized lowering facts in the same PC/slot coordinate system until general fact transport exists.

Numeric access is admitted because it is the canonical immediate-number form (return 7 lowers to access slot, 7). Text access is rejected because it can allocate and is provider-unit-relative. Unknown operations reject.

Build artifacts are normalized to a private operand-only view using the full opcode-arity schema. The transform does not assume that the final two array members are source locations. If locations are needed for transient provenance, they come from the debug sidecar. This also prevents provider instruction tails from being mistaken for semantic operands.

Rewrite and memory behavior

All callee slots, including parameters, map to fresh caller-frame slots. Caller arguments are copied before executing the leaf, preserving ordinary call-frame isolation even when the provider overwrites a parameter. A single-definition return temporary can map directly to the caller result only when that result does not alias the callee or an argument. The zero-argument constant fixture therefore replaces its call with one immediate-number operation.

The ordinary linked-export cache initialization and provider closure are not deleted. That avoids inventing a second lifetime rule and preserves semantics for every rejected site. The cost of a general admitted leaf is bounded fresh frame slots in the already-live caller; there is no per-call allocation. The constant fixture adds no slot. Caller/provider/hash/function/PC provenance is returned as a transient linker table and is not attached to Mach or native artifacts.

The production module deliberately has its own small admitted-op def/use table; it does not import or retain the much larger structured mid-end. Link time does temporarily reload each exact canonical unit in the executable graph. That is compiler/shop heap proportional to the graph, released after wrapping, and is the only expected memory increase. Actor frames, runtime heaps, export records, and target metadata are unchanged; the accepted constant site adds zero slots and zero per-call allocation.

Before lowering, the private derived unit hydrates the finalized fact sidecar and audits every retained fact that can touch the replaced PC or destination. The literal must agree with _write_types, exact _type_spans, _types_at, and any constant fact. Arithmetic, record-shape/template, or Mach checked-store facts colliding with the former call PC reject the rewrite. The old _resolved_calls[pc] entry is explicitly removed. Thus equal instruction counts alone never justify retaining a call-specific fact.

Correctness evidence

The isolated suite covers:

• operand-only stoned export substitution and absence of closure cloning;
• executable Mach equivalence on a self-contained exact-call oracle;
• mutable export rejection;
• capture rejection;
• exact-arity rejection and fresh parameter-slot isolation;
• provider-hash and callee-slot tamper rejection;
• located optimizer-object normalization by opcode arity.

The final focused run passed 18/18 across tests/linked_call_origins.cm and tests/linked_leaf_substitute.cm. It also exposed and fixed an independent provenance bug: LICM inserted loop preheaders without shifting exact _linked_call_origins PCs. Before that fix, the production gate’s raw three facts became one final fact and the intended leaf site could not be derived. After exact PC transport, all three facts survive and the private derivation reports one changed site. A production-shaped regression covers that seam.

The focused cases also verify compatible literal facts, reject an incompatible destination type, remove the obsolete resolved-call identity, classify wide integral literals through the floating lane, and cap admitted Mach functions at 255 slots.

Rejected production integration

The rejected implementation waited until the full executable graph was known, then reloaded exact unit artifacts by the hashes already present in the bundle and builds a canonical provider map. It derives private consumer code and recompiles only changed units to Mach. PGO collection and consumption use the same derived private unit before the existing prepare/compile/clear sequence. Facts are not rebuilt: the admitted one-op/no-slot rewrite preserves their coordinates, audits them, and deletes the one stale resolved-call entry. Canonical semantic graph identity stays unchanged.

Native handoff rehydrates the same exact program/provider artifacts and repeats the deterministic private derivation before QBE lowering. Canonical unit hashes, cache objects, and executable semantic identity remain unchanged. If an exact provider, linked-call sidecar, opcode, or proof is unavailable, the original cached call is compiled without modification. A missing or malformed finalized lowering sidecar is different: the v4 artifact/cache contract rejects it rather than silently lowering incomplete facts or treating it as an optimization miss.

Its diagnostic control was PIT_STREAMLINE_DISABLE=linked_leaf. The integration, flag, standalone proof/pairer, production origin sidecar, tests, probes, and fixtures have all been removed.

Performance gate

The fixture warms twice and reports the median of eleven samples from one realized executable; every arm returned exactly 7. Native therefore fails decisively even before code growth can matter. The Mach control marked * is a single clean timed sample: changing the daemon environment repeatedly left the shop booted without a listener for more than 100 seconds, so a paired eleven-run control could not be obtained. Even taking that favorable preliminary control, the composed arm is far below its 25% gate.

The isolated executable-Mach oracle remained within the 10% code-size ceiling, and the one-op rewrite preserved instruction/slot counts with no target/runtime metadata. Those properties do not compensate for missing both speed gates. Production integration was therefore deleted as specified. The durable result is that substituting this ultra-narrow constant leaf at link time is not a useful production lever by itself; future call work must attack a materially larger part of call/return/activation lowering rather than repeat this exact constant-call special case.

Tooling observations

Two unrelated workflow problems made the experiment slower and less obvious:

• this experiment predated the canonical CLI landing; bare ./pit file.ce now sends {} and has no implicit help probe;
• changing PIT_STREAMLINE_DISABLE invalidates the compiler fleet, and cold daemon restarts in this worktree repeatedly failed to publish their listener within 30-100 seconds. PIT_INPROCESS=1 was usable for focused correctness, but one Mach benchmark boot also stalled during realization.

Source: plans/archive/perf-2026-07/perf-linked-leaf-substitution.md