Source RAM preservation repair — 2026-09-16

The RAM repair passes the complete current workspaces and local CLI gates. FINAL6 remains a rejected candidate; these source changes do not amend its frozen bytes or earlier proof receipts. The full coordinated release is open.

Contract and implementation

Ordinary source RAM retains every Field address. The canonical language and IR contracts now explicitly require compiler stack operations to preserve it.

• Trident's multiword return cleanup removes dead words on the stack, then restores result order with three reversals. It no longer writes a return frame at 2^30. The independent abstract-stack test covers all65 result widths0–64 and129 dead-frame sizes0–128 with an unchanged three-word prefix.
• Trisha spills only enough words to make an access native. It checks each candidate scratch cell for zero; a zero sum of occupied cells is insufficient. If the preferred block at 2^31 is occupied, a monotonic scanner finds a zero run elsewhere. Used cells are restored to zero before any source operation. The search rejects field-address exhaustion before writing. Its cost depends on RAM occupancy; this is not a new source heap or a reserved address interval.
• Consecutive pure stack operations share one checked temporary frame when that costs less than individual accesses. The owner reconstructs the exact result permutation, including duplicate/discarded words, then clears the frame before any other operation. Optimization limits bound planning work, not source RAM.
• Inline assembly leaves compiler locals on the operand stack. Opaque assembly must preserve the compiler-owned prefix and declare its net effect. Declared consumption of a named binding is rejected; anonymous aggregate consumption counts words correctly. This removes the old hidden RAM spill around asm. The compiler still does not parse arbitrary assembly for undeclared clobbers.

The older unreserved spills were observable even with ordinary source writes. The preserved pre-repair binarySHA256 498e3c496711ef0f55ba08fa376ef00c3300878fe90daf940804b3136c6ebbc9 reproduces all three cases in both debug/release source profiles:

Commands, complete source strings and outputs are preserved in the repair receipt. Original historical review: RAM scratch review.

Validation checkpoint

The complete Trident neural workspace passes896 tests. Its default library passes682 tests, including the cleanup grid and anonymous-word accounting. The complete Trisha workspace with all features passes460 tests, with six explicitly ignored proof gates retained in the receipt. The Joy workspace passes71 tests with no ignored tests, including genuine private proofs and public-input/output mutation rejection. All three suites have zero failures and Rust warnings. All24 release-tooling tests pass. Trisha's focused native tests pass deep-stack word preservation, occupied RAM, scalar/block source memory, multiword returns, inline assembly and address-wrap cases. The final RAM matrix includes120 deep-operation runs with occupied/fragmented RAM and a field-sum cancellation trap. Source cases additionally cover12 runtime-address/block vectors,10 repeated-return vectors, two assembly vectors and two rejected assembly effects. An additional64 deterministic mixed-operation sequences check both stack semantics and RAM at intervening source reads. The native source profiles are debug and release.

The rebuilt CLI (SHA256 129660aaac3ac27e4a4704ec66581cd7772918cdd710ec3dc888ffaa9f9ef8be) executes all three counterexamples correctly in both profiles. It generates six fresh default-security STARKs, verifies each, and rejects all six artifacts with changed public output while retaining the original proof bytes and program hash. These are local CLI gates; no installed archive is inferred from them.

The first correct linear-search implementation passed130/133 baseline fixtures; three self-hash-bound custom-token fixtures require independent regeneration because the executing program changed. Across the96 comparable positive fixtures,5 improved,48 were unchanged,43 regressed; the maximum was3.261219x the previous cycle count. Those results are retained, not counted as a complete baseline pass. With batched zero checking and stack-sequence fusion, all133 fixtures and all43 hand baselines pass. Of the99 positive cases,51 improve,48 are unchanged and none regresses. The three custom-token positive fixtures were regenerated by the existing independent codec oracle against the new native self-hash; only their classic input and secret fields change. Their hand input/witness and all expected outputs, including the wrong-selfhash rejection fixture, are unchanged. Among the96 fixtures with unchanged inputs,48 improve and48 are unchanged. Full before/after cycle rows and the superseded linear-search measurements are retained in the receipt, not reduced to a selected subset.

The first complete Trisha rerun exposed a regression outside that99-fixture positive set: keccak_all_rounds_all_lanes exceeded its10,000,000-cycle limit with the struct API. That failure is retained (225 preceding passes, one failure, two ignored at the point the workspace stopped). Sharing temporary frames fixes the regression without raising the limit. Both independent zero/lanes vectors now take2,240,003 cycles versus8,117,373 with the pre-repair compiler; every one of the50 output words matches its independent vector. These two extra execution vectors are reported separately from the133-fixture baseline inventory.

The installed smoke script now includes a combined RAM/deep-stack/return/assembly program on both Trident delegation and direct Trisha routes, both profiles, two fresh proofs and altered-output rejection. The exact extracted Nushell section passes with the current local binaries, including both fresh proofs and both altered-output rejections. Together with the six counterexample proofs, this checkpoint has eight fresh verified native proofs and eight public-output mutation rejections. The complete installed smoke remains a gate for the next frozen candidate; an extracted section does not certify that complete suite.

No new source archive, installed-platform matrix, full198-proof gate, fresh Neptune SingleProof/node admission or coordinated published release is claimed.